1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
23  *
24  * send audit records to remote host
25  *
26  */
27 
28 /*
29  * auditd_plugin_open(), auditd_plugin() and auditd_plugin_close()
30  * implement a replaceable library for use by auditd; they are a
31  * project private interface and may change without notice.
32  */
33 
34 #include <arpa/inet.h>
35 #include <assert.h>
36 #include <audit_plugin.h>
37 #include <bsm/audit.h>
38 #include <bsm/audit_record.h>
39 #include <bsm/libbsm.h>
40 #include <errno.h>
41 #include <fcntl.h>
42 #include <gssapi/gssapi.h>
43 #include <libintl.h>
44 #include <netdb.h>
45 #include <pthread.h>
46 #include <rpc/rpcsec_gss.h>
47 #include <secdb.h>
48 #include <signal.h>
49 #include <stdio.h>
50 #include <stdlib.h>
51 #include <string.h>
52 #include <strings.h>
53 #include <ctype.h>
54 #include <sys/param.h>
55 #include <sys/socket.h>
56 #include <sys/types.h>
57 #include <unistd.h>
58 #include <poll.h>
59 
60 #include "audit_remote.h"
61 
62 #define	DEFAULT_TIMEOUT	5	/* default connection timeout (in secs) */
63 #define	NOSUCCESS_DELAY	20	/* unsuccessful delivery to all p_hosts */
64 
65 #define	FL_SET		B_TRUE	/* set_fdfl(): set the flag */
66 #define	FL_UNSET	B_FALSE	/* set_fdfl(): unset the flag */
67 
68 static int	nosuccess_cnt;	/* unsuccessful delivery counter */
69 
70 static int	retries;		/* connection retries */
71 int		timeout;		/* connection timeout */
72 static int	timeout_p_timeout;	/* p_timeout attr storage */
73 
74 /* semi-exponential timeout back off; x .. attempts, y .. timeout */
75 #define	BOFF_TIMEOUT(x, y)	(x < 3 ? y * 2 * x : y * 8)
76 
77 /* general plugin lock */
78 pthread_mutex_t	plugin_mutex = PTHREAD_MUTEX_INITIALIZER;
79 
80 static struct hostlist_s	*current_host;
81 static struct hostlist_s	*hosts;
82 static struct hostlist_s	*hosts_prev;
83 
84 extern struct transq_hdr_s	transq_hdr;
85 static long			transq_count_max;
86 extern pthread_mutex_t		transq_lock;
87 
88 extern pthread_t	recv_tid;
89 
90 extern boolean_t	notify_pipe_ready;
91 extern int		notify_pipe[2];
92 
93 #if DEBUG
94 FILE		*dfile;		/* debug file */
95 #endif
96 
97 /*
98  * set_transq_count_max() - sets the transq_count_max value based on kernel
99  * audit queue high water mark. This is backup solution for a case, when the
100  * the default qsize zero value is (intentionally) set in the audit_remote(5)
101  * plugin configuration.
102  */
103 static auditd_rc_t
set_transq_count_max()104 set_transq_count_max()
105 {
106 	struct au_qctrl	qctrl;
107 
108 	if (auditon(A_GETQCTRL, (caddr_t)&qctrl, 0) != -1) {
109 		transq_count_max = qctrl.aq_hiwater;
110 		DPRINT((dfile, "Transmission queue max length set to %ld\n",
111 		    transq_count_max));
112 		return (AUDITD_SUCCESS);
113 	}
114 
115 	DPRINT((dfile, "Setting the transmission queue max length failed\n"));
116 	return (AUDITD_RETRY);
117 }
118 
119 /*
120  * get_port_default() - set the default port number; note, that "solaris-audit"
121  * used below in the code is the IANA assigned service name for the secure
122  * remote solaris audit logging.
123  */
124 static auditd_rc_t
get_port_default(int * port_default)125 get_port_default(int *port_default)
126 {
127 
128 	struct servent  serventry;
129 	char  		serventry_buf[1024];
130 
131 	if (getservbyname_r("solaris-audit", "tcp", &serventry,
132 	    (char *)&serventry_buf, sizeof (serventry_buf)) == NULL) {
133 		DPRINT((dfile, "unable to get default port number\n"));
134 #if DEBUG
135 		if (errno == ERANGE) {
136 			DPRINT((dfile, "low on buffer\n"));
137 		}
138 #endif
139 		return (AUDITD_INVALID);
140 	}
141 	*port_default = ntohs(serventry.s_port);
142 	DPRINT((dfile, "default port: %d\n", *port_default));
143 
144 	return (AUDITD_SUCCESS);
145 }
146 
147 /*
148  * trim_me() - trims the white space characters around the specified string.
149  * Inputs - pointer to the beginning of the string (str_ptr); returns - pointer
150  * to the trimmed string. Function returns NULL pointer in case of received
151  * empty string, NULL pointer or in case the pointed string consists of white
152  * space characters only.
153  */
154 static char *
trim_me(char * str_ptr)155 trim_me(char *str_ptr) {
156 
157 	char	*str_end;
158 
159 	if (str_ptr == NULL || *str_ptr == '\0') {
160 		return (NULL);
161 	}
162 
163 	while (isspace(*str_ptr)) {
164 		str_ptr++;
165 	}
166 	if (*str_ptr == '\0') {
167 		return (NULL);
168 	}
169 
170 	str_end = str_ptr + strlen(str_ptr);
171 
172 	while (str_end > str_ptr && isspace(str_end[-1])) {
173 		str_end--;
174 	}
175 	*str_end = '\0';
176 
177 	return (str_ptr);
178 }
179 
180 /*
181  * Frees host list - should be called while keeping auditd_mutex.
182  */
183 static void
freehostlist(hostlist_t ** hostlist_ptr)184 freehostlist(hostlist_t **hostlist_ptr)
185 {
186 	hostlist_t *h, *n;
187 
188 	h = *hostlist_ptr;
189 
190 	while (h != NULL)  {
191 		n = h->next_host;
192 		freehostent(h->host);
193 		free(h);
194 		h = n;
195 	}
196 	*hostlist_ptr = NULL;
197 }
198 
199 /*
200  * parsehosts() end parses the host string (hosts_str)
201  */
202 static auditd_rc_t
parsehosts(char * hosts_str,char ** error)203 parsehosts(char *hosts_str, char **error)
204 {
205 	char 		*hostportmech, *hpm;
206 	char		*hostname;
207 	char		*port_str;
208 	char		*mech_str;
209 	int		port;
210 	int		port_default = -1;
211 	gss_OID		mech_oid;
212 	char 		*lasts_hpm;
213 	hostlist_t 	*lasthost = NULL;
214 	hostlist_t 	*hosts_new = NULL;
215 	hostlist_t	*newhost;
216 	struct hostent 	*hostentry;
217 	int		error_num;
218 	int		rc;
219 #if DEBUG
220 	char 		addr_buf[INET6_ADDRSTRLEN];
221 	int		num_of_hosts = 0;
222 #endif
223 
224 	DPRINT((dfile, "parsing %s\n", hosts_str));
225 	while ((hostportmech = strtok_r(hosts_str, ",", &lasts_hpm)) != NULL) {
226 
227 		hosts_str = NULL;
228 		hostname = NULL;
229 		port_str = NULL;
230 		port = port_default;
231 		mech_str = NULL;
232 		mech_oid = GSS_C_NO_OID;
233 
234 		DPRINT((dfile, "parsing host:port:mech %s\n", hostportmech));
235 
236 		if (strncmp(hostportmech, ":", 1 == 0)) { /* ":port:" case */
237 			*error = strdup(gettext("no hostname specified"));
238 			return (AUDITD_INVALID);
239 		}
240 
241 		/* parse single host:port:mech target */
242 		while ((hpm = strsep(&hostportmech, ":")) != NULL) {
243 
244 			if (hostname == NULL) {
245 				hostname = hpm;
246 				continue;
247 			}
248 			if (port_str == NULL) {
249 				port_str = hpm;
250 				continue;
251 			}
252 			if (mech_str == NULL) {
253 				mech_str = hpm;
254 				continue;
255 			}
256 
257 			/* too many colons in the hostportmech string */
258 			*error = strdup(gettext("invalid host:port:mech "
259 			    "specification"));
260 			return (AUDITD_INVALID);
261 		}
262 
263 		if (hostname == NULL || *hostname == '\0') {
264 			*error = strdup(gettext("invalid hostname "
265 			    "specification"));
266 			return (AUDITD_INVALID);
267 		}
268 
269 		/* trim hostname */
270 		hostname = trim_me(hostname);
271 		if (hostname == NULL || *hostname == '\0') {
272 			*error = strdup(gettext("empty hostname "
273 			    "specification"));
274 			return (AUDITD_INVALID);
275 		}
276 
277 		DPRINT((dfile, "resolving address for %s\n", hostname));
278 
279 		hostentry = getipnodebyname(hostname, AF_INET6, 0, &error_num);
280 		if (!hostentry) {
281 			hostentry = getipnodebyname(hostname, AF_INET, 0,
282 			    &error_num);
283 		}
284 		if (!hostentry) {
285 			if (error_num == TRY_AGAIN) {
286 				*error = strdup(gettext("host not found, "
287 				    "try later"));
288 				return (AUDITD_RETRY);
289 			} else {
290 				*error = strdup(gettext("host not found"));
291 				return (AUDITD_INVALID);
292 			}
293 		}
294 		DPRINT((dfile, "hostentry: h_name=%s, addr_len=%d, addr=%s\n",
295 		    hostentry->h_name, hostentry->h_length,
296 		    inet_ntop(hostentry->h_addrtype,
297 		    hostentry->h_addr_list[0], addr_buf,
298 		    INET6_ADDRSTRLEN)));
299 
300 		/* trim port */
301 		port_str = trim_me(port_str);
302 		if (port_str == NULL || *port_str == '\0') {
303 			if (port_default == -1 &&
304 			    (rc = get_port_default(&port_default))
305 			    != AUDITD_SUCCESS) {
306 				*error = strdup(gettext(
307 				    "unable to get default port number"));
308 				return (rc);
309 			}
310 			port = port_default;
311 			DPRINT((dfile, "port: %d (default)\n", port));
312 		} else {
313 			errno = 0;
314 			port = atoi(port_str);
315 			if (errno != 0 || port < 1 || port > USHRT_MAX) {
316 				*error = strdup(gettext("invalid port number"));
317 				return (AUDITD_INVALID);
318 			}
319 			DPRINT((dfile, "port: %d\n", port));
320 		}
321 
322 		/* trim mechanism */
323 		mech_str = trim_me(mech_str);
324 		if (mech_str != NULL && *mech_str != '\0') {
325 			if (rpc_gss_mech_to_oid(mech_str, &mech_oid) != TRUE) {
326 				*error = strdup(gettext("unknown mechanism"));
327 				return (AUDITD_INVALID);
328 			}
329 			DPRINT((dfile, "mechanism: %s\n", mech_str));
330 #if DEBUG
331 		} else {
332 			DPRINT((dfile, "mechanism: null (default)\n"));
333 #endif
334 		}
335 
336 		/* add this host to host list */
337 		newhost = malloc(sizeof (hostlist_t));
338 		if (newhost == NULL) {
339 			*error = strdup(gettext("no memory"));
340 			return (AUDITD_NO_MEMORY);
341 		}
342 		newhost->host = hostentry;
343 		newhost->port = htons(port);
344 		newhost->mech = mech_oid;
345 		newhost->next_host = NULL;
346 		if (lasthost != NULL) {
347 			lasthost->next_host = newhost;
348 			lasthost = lasthost->next_host;
349 		} else {
350 			lasthost = newhost;
351 			hosts_new = newhost;
352 		}
353 #if DEBUG
354 		num_of_hosts++;
355 #endif
356 	}
357 
358 	(void) pthread_mutex_lock(&plugin_mutex);
359 	if (hosts_prev == NULL) {
360 		hosts_prev = hosts;
361 	}
362 	hosts = hosts_new;
363 	current_host = hosts;
364 	(void) pthread_mutex_unlock(&plugin_mutex);
365 
366 	DPRINT((dfile, "Configured %d hosts.\n", num_of_hosts));
367 
368 	return (AUDITD_SUCCESS);
369 }
370 
371 
372 #if DEBUG
373 static char *
auditd_message(auditd_rc_t msg_code)374 auditd_message(auditd_rc_t msg_code) {
375 	char 	*rc_msg;
376 
377 	switch (msg_code) {
378 	case AUDITD_SUCCESS:
379 		rc_msg = strdup("ok");
380 		break;
381 	case AUDITD_RETRY:
382 		rc_msg = strdup("retry after a delay");
383 		break;
384 	case AUDITD_NO_MEMORY:
385 		rc_msg = strdup("can't allocate memory");
386 		break;
387 	case AUDITD_INVALID:
388 		rc_msg = strdup("bad input");
389 		break;
390 	case AUDITD_COMM_FAIL:
391 		rc_msg = strdup("communications failure");
392 		break;
393 	case AUDITD_FATAL:
394 		rc_msg = strdup("other error");
395 		break;
396 	case AUDITD_FAIL:
397 		rc_msg = strdup("other non-fatal error");
398 		break;
399 	}
400 	return (rc_msg);
401 }
402 #endif
403 
404 /*
405  * rsn_to_msg() - translation of the reason of closure identifier to the more
406  * human readable/understandable form.
407  */
408 static char *
rsn_to_msg(close_rsn_t reason)409 rsn_to_msg(close_rsn_t reason)
410 {
411 	char 	*rc_msg;
412 
413 	switch (reason) {
414 	case RSN_UNDEFINED:
415 		rc_msg = strdup(gettext("not defined reason of failure"));
416 		break;
417 	case RSN_INIT_POLL:
418 		rc_msg = strdup(gettext("poll() initialization failed"));
419 		break;
420 	case RSN_TOK_RECV_FAILED:
421 		rc_msg = strdup(gettext("token receiving failed"));
422 		break;
423 	case RSN_TOK_TOO_BIG:
424 		rc_msg = strdup(gettext("unacceptable token size"));
425 		break;
426 	case RSN_TOK_UNVERIFIABLE:
427 		rc_msg = strdup(gettext("received unverifiable token"));
428 		break;
429 	case RSN_SOCKET_CLOSE:
430 		rc_msg = strdup(gettext("closed socket"));
431 		break;
432 	case RSN_SOCKET_CREATE:
433 		rc_msg = strdup(gettext("socket creation failed"));
434 		break;
435 	case RSN_CONNECTION_CREATE:
436 		rc_msg = strdup(gettext("connection creation failed"));
437 		break;
438 	case RSN_PROTOCOL_NEGOTIATE:
439 		rc_msg = strdup(gettext("protocol negotiation failed"));
440 		break;
441 	case RSN_GSS_CTX_ESTABLISH:
442 		rc_msg = strdup(gettext("context establishing failed"));
443 		break;
444 	case RSN_GSS_CTX_EXP:
445 		rc_msg = strdup(gettext("context expired"));
446 		break;
447 	case RSN_UNKNOWN_AF:
448 		rc_msg = strdup(gettext("unknown address family"));
449 		break;
450 	case RSN_MEMORY_ALLOCATE:
451 		rc_msg = strdup(gettext("memory allocation failed"));
452 		break;
453 	default:	/* RSN_OTHER_ERR */
454 		rc_msg = strdup(gettext("other, not classified error"));
455 		break;
456 	}
457 	return (rc_msg);
458 }
459 
460 /*
461  * set_fdfl() - based on set_fl (FL_SET/FL_UNSET) un/sets the fl flag associated
462  * with fd file descriptor.
463  */
464 static boolean_t
set_fdfl(int fd,int fl,boolean_t set_fl)465 set_fdfl(int fd, int fl, boolean_t set_fl)
466 {
467 	int	flags;
468 
469 	/* power of two test - only single bit flags are allowed */
470 	if (!fl || (fl & (fl-1))) {
471 		DPRINT((dfile, "incorrect flag - %d isn't power of two\n", fl));
472 		return (B_FALSE);
473 	}
474 
475 	if ((flags = fcntl(fd, F_GETFL, 0)) < 0) {
476 		DPRINT((dfile, "cannot get file descriptor flags\n"));
477 		return (B_FALSE);
478 	}
479 
480 	if (set_fl) {	/* set the fl flag */
481 		if (flags & fl) {
482 			return (B_TRUE);
483 		}
484 
485 		flags |= fl;
486 
487 	} else {	/* unset the fl flag */
488 		if (~flags & fl) {
489 			return (B_TRUE);
490 		}
491 
492 		flags &= ~fl;
493 	}
494 
495 	if (fcntl(fd, F_SETFL, flags) == -1) {
496 		DPRINT((dfile, "cannot %s file descriptor flags\n",
497 		    (set_fl ? "set" : "unset")));
498 		return (B_FALSE);
499 	}
500 
501 	DPRINT((dfile, "fd: %d - flag: 0%o was %s\n", fd, fl,
502 	    (set_fl ? "set" : "unset")));
503 	return (B_TRUE);
504 }
505 
506 
507 /*
508  * create_notify_pipe() - creates the notification pipe. Function returns
509  * B_TRUE/B_FALSE on success/failure.
510  */
511 static boolean_t
create_notify_pipe(int * notify_pipe,char ** error)512 create_notify_pipe(int *notify_pipe, char **error)
513 {
514 
515 	if (pipe(notify_pipe) < 0) {
516 		DPRINT((dfile, "Cannot create notify pipe: %s\n",
517 		    strerror(errno)));
518 		*error = strdup(gettext("failed to create notification pipe"));
519 		return (B_FALSE);
520 	} else {
521 		DPRINT((dfile, "Pipe created in:%d out:%d\n", notify_pipe[0],
522 		    notify_pipe[1]));
523 		/* make (only) the pipe "in" end nonblocking */
524 		if (!set_fdfl(notify_pipe[0], O_NONBLOCK, FL_UNSET) ||
525 		    !set_fdfl(notify_pipe[1], O_NONBLOCK, FL_SET)) {
526 			DPRINT((dfile, "Cannot prepare blocking scheme on top "
527 			    "of the notification pipe: %s\n", strerror(errno)));
528 			(void) close(notify_pipe[0]);
529 			(void) close(notify_pipe[1]);
530 
531 			*error = strdup(gettext("failed to prepare blocking "
532 			    "scheme on top of the notification pipe"));
533 			return (B_FALSE);
534 		}
535 	}
536 
537 	return (B_TRUE);
538 }
539 
540 
541 /*
542  * auditd_plugin() sends a record via a tcp connection.
543  *
544  * Operation:
545  *   - 1 tcp connection opened at a time, referenced by current_host->sockfd
546  *   - tries to (open and) send a record to the current_host where its address
547  *     is taken from the first hostent h_addr_list entry
548  *   - if connection times out, tries second host
549  *   - if all hosts where tried tries again for retries number of times
550  *   - if everything fails, it bails out with AUDITD_RETRY
551  *
552  *   Note, that space on stack allocated for any error message returned along
553  *   with AUDITD_RETRY is subsequently freed by auditd.
554  *
555  */
556 auditd_rc_t
auditd_plugin(const char * input,size_t in_len,uint64_t sequence,char ** error)557 auditd_plugin(const char *input, size_t in_len, uint64_t sequence, char **error)
558 {
559 	int 		rc = AUDITD_FAIL;
560 	int 		send_record_rc = SEND_RECORD_FAIL;
561 	hostlist_t 	*start_host;
562 	int 		attempts = 0;
563 	char		*ext_error;	/* extended error string */
564 	close_rsn_t	err_rsn = RSN_UNDEFINED;
565 	char		*rsn_msg;
566 
567 #if DEBUG
568 	char		*rc_msg;
569 	static uint64_t	last_sequence = 0;
570 
571 	if ((last_sequence > 0) && (sequence != last_sequence + 1)) {
572 		DPRINT((dfile, "audit_remote: buffer sequence=%llu "
573 		    "but prev=%llu\n", sequence, last_sequence));
574 	}
575 	last_sequence = sequence;
576 
577 	DPRINT((dfile, "audit_remote: input seq=%llu, len=%d\n",
578 	    sequence, in_len));
579 #endif
580 
581 	(void) pthread_mutex_lock(&transq_lock);
582 
583 	if (transq_hdr.count == transq_count_max) {
584 		DPRINT((dfile, "Transmission queue is full (%ld)\n",
585 		    transq_hdr.count));
586 		(void) pthread_mutex_unlock(&transq_lock);
587 		*error = strdup(gettext("retransmission queue is full"));
588 		return (AUDITD_RETRY);
589 	}
590 	(void) pthread_mutex_unlock(&transq_lock);
591 
592 
593 	(void) pthread_mutex_lock(&plugin_mutex);
594 
595 	/* cycle over the hosts and possibly deliver the record */
596 	start_host = current_host;
597 	while (rc != AUDITD_SUCCESS) {
598 		DPRINT((dfile, "Trying to send record to %s [attempt:%d/%d]\n",
599 		    current_host->host->h_name, attempts + 1, retries));
600 
601 		send_record_rc = send_record(current_host, input, in_len,
602 		    sequence, &err_rsn);
603 		DPRINT((dfile, "send_record() returned %d - ", send_record_rc));
604 
605 		switch (send_record_rc) {
606 		case SEND_RECORD_SUCCESS:
607 			DPRINT((dfile, "success\n"));
608 			nosuccess_cnt = 0;
609 			rc = AUDITD_SUCCESS;
610 			if (hosts_prev != NULL) {
611 				freehostlist(&hosts_prev);
612 				DPRINT((dfile, "stale host list freed\n"));
613 			}
614 			break;
615 		case SEND_RECORD_NEXT:
616 			DPRINT((dfile, "retry the same host: %s (penalty) "
617 			    "rsn:%d\n", current_host->host->h_name, err_rsn));
618 			attempts++;
619 			break;
620 		case SEND_RECORD_RETRY:
621 			DPRINT((dfile, "retry the same host: %s (no penalty) "
622 			    "rsn:%d\n", current_host->host->h_name, err_rsn));
623 			break;
624 		}
625 
626 		if (send_record_rc == SEND_RECORD_NEXT) {
627 
628 			/* warn about unsuccessful auditd record delivery */
629 			rsn_msg = rsn_to_msg(err_rsn);
630 			(void) asprintf(&ext_error,
631 			    "retry %d connection %s:%d %s", attempts + 1,
632 			    current_host->host->h_name,
633 			    ntohs(current_host->port), rsn_msg);
634 			if (ext_error == NULL) {
635 				free(rsn_msg);
636 				*error = strdup(gettext("no memory"));
637 				rc = AUDITD_NO_MEMORY;
638 				break;
639 			}
640 			__audit_dowarn2("plugin", "audit_remote.so", "retry",
641 			    ext_error, attempts + 1);
642 			free(rsn_msg);
643 			free(ext_error);
644 
645 			if (attempts < retries) {
646 				/* semi-exponential timeout back off */
647 				timeout = BOFF_TIMEOUT(attempts, timeout);
648 				DPRINT((dfile, "New timeout=%d\n", timeout));
649 			} else {
650 				/* get next host */
651 				current_host = current_host->next_host;
652 				if (current_host == NULL) {
653 					current_host = hosts;
654 				}
655 				timeout = timeout_p_timeout;
656 				DPRINT((dfile, "New timeout=%d\n", timeout));
657 				attempts = 0;
658 			}
659 
660 			/* one cycle finished */
661 			if (current_host == start_host && attempts == 0) {
662 				nosuccess_cnt++;
663 				(void) asprintf(&ext_error, "all hosts defined "
664 				    "as p_hosts were tried to deliver "
665 				    "the audit record to with no success "
666 				    "- sleeping for %d seconds",
667 				    NOSUCCESS_DELAY);
668 				if (ext_error == NULL) {
669 					*error = strdup(gettext("no memory"));
670 					rc = AUDITD_NO_MEMORY;
671 					break;
672 				}
673 				__audit_dowarn2("plugin", "audit_remote.so",
674 				    "retry", ext_error, nosuccess_cnt);
675 				free(ext_error);
676 				(void) sleep(NOSUCCESS_DELAY);
677 			}
678 
679 		} /* if (send_record_rc == SEND_RECORD_NEXT) */
680 
681 		err_rsn = RSN_UNDEFINED;
682 
683 	} /* while (rc != AUDITD_SUCCESS) */
684 
685 	(void) pthread_mutex_unlock(&plugin_mutex);
686 
687 #if DEBUG
688 	rc_msg = auditd_message(rc);
689 	DPRINT((dfile, "audit_remote: returning: %s\n", rc_msg));
690 	free(rc_msg);
691 #endif
692 
693 	return (rc);
694 }
695 
696 /*
697  * auditd_plugin_open() may be called multiple times; on initial open or
698  * `audit -s`, then kvlist != NULL; on `audit -n`, then kvlist == NULL.
699  * For more information see audit(1M).
700  *
701  * Note, that space on stack allocated for any error message returned along
702  * with AUDITD_RETRY is subsequently freed by auditd.
703  *
704  */
705 auditd_rc_t
auditd_plugin_open(const kva_t * kvlist,char ** ret_list,char ** error)706 auditd_plugin_open(const kva_t *kvlist, char **ret_list, char **error)
707 {
708 	kva_t	*kv;
709 	char	*val_str;
710 	int	val;
711 	long	val_l;
712 	int	rc = 0;
713 
714 	*error = NULL;
715 	*ret_list = NULL;
716 	kv = (kva_t *)kvlist;
717 
718 #if DEBUG
719 	dfile = __auditd_debug_file_open();
720 #endif
721 
722 	/* initial open or audit -s */
723 	if (kvlist != NULL) {
724 		DPRINT((dfile, "Action: initial open or `audit -s`\n"));
725 		val_str = kva_match(kv, "p_timeout");
726 		if (val_str == NULL) {
727 			*error = strdup(
728 			    gettext("p_timeout attribute not found"));
729 			return (AUDITD_RETRY);
730 		}
731 		DPRINT((dfile, "val_str=%s\n", val_str));
732 		errno = 0;
733 		val = atoi(val_str);
734 		if (errno == 0 && val >= 1) {
735 			timeout_p_timeout = val;
736 			timeout = val;
737 		} else {
738 			timeout_p_timeout = DEFAULT_TIMEOUT;
739 			timeout = timeout_p_timeout;
740 			DPRINT((dfile, "p_timeout set to default value: %d\n",
741 			    timeout));
742 		}
743 
744 		val_str = kva_match(kv, "p_retries");
745 		if (val_str == NULL) {
746 			*error = strdup(
747 			    gettext("p_retries attribute not found"));
748 			return (AUDITD_RETRY);
749 		}
750 		DPRINT((dfile, "val_str=%s\n", val_str));
751 		errno = 0;
752 		val = atoi(val_str);
753 		if (errno == 0 && val >= 0) {
754 			retries = val;
755 		}
756 
757 		val_str = kva_match(kv, "qsize");
758 		if (val_str == NULL) {
759 			*error = strdup(gettext("qsize attribute not found"));
760 			return (AUDITD_RETRY);
761 		}
762 		DPRINT((dfile, "qsize=%s\n", val_str));
763 		errno = 0;
764 		val_l = atol(val_str);
765 		if (errno == 0 && val_l >= 0) {
766 			transq_count_max = val_l;
767 		}
768 		if (transq_count_max == 0 &&
769 		    (rc = set_transq_count_max()) != AUDITD_SUCCESS) {
770 			*error = strdup(gettext("cannot get kernel "
771 			    "auditd queue high water mark\n"));
772 			return (rc);
773 		}
774 		DPRINT((dfile, "timeout=%d, retries=%d, transq_count_max=%ld\n",
775 		    timeout, retries, transq_count_max));
776 
777 		val_str = kva_match(kv, "p_hosts");
778 		if (val_str == NULL) {
779 			*error = strdup(gettext("no hosts configured"));
780 			return (AUDITD_RETRY);
781 		}
782 		if ((rc = parsehosts(val_str, error)) != AUDITD_SUCCESS) {
783 			return (rc);
784 		}
785 
786 		/* create the notification pipe towards the receiving thread */
787 		if (!notify_pipe_ready) {
788 			if (create_notify_pipe(notify_pipe, error)) {
789 				notify_pipe_ready = B_TRUE;
790 			} else {
791 				return (AUDITD_RETRY);
792 			}
793 		}
794 
795 #if DEBUG
796 	} else { /* audit -n */
797 		DPRINT((dfile, "Action: `audit -n`\n"));
798 #endif
799 	}
800 
801 	return (AUDITD_SUCCESS);
802 }
803 
804 /*
805  * auditd_plugin_close() performs shutdown operations. The return values are
806  * used by auditd to output warnings via the audit_warn(1M) script and the
807  * string returned via "error_text", is passed to audit_warn.
808  *
809  * Note, that space on stack allocated for any error message returned along
810  * with AUDITD_RETRY is subsequently freed by auditd.
811  *
812  */
813 auditd_rc_t
auditd_plugin_close(char ** error)814 auditd_plugin_close(char **error)
815 {
816 	reset_transport(DO_EXIT, DO_SYNC);
817 	if (pthread_join(recv_tid, NULL) != 0) {
818 		*error = strdup(gettext("unable to close receiving thread"));
819 		return (AUDITD_RETRY);
820 	}
821 
822 	(void) pthread_mutex_lock(&plugin_mutex);
823 	freehostlist(&hosts);
824 	freehostlist(&hosts_prev);
825 	(void) pthread_mutex_unlock(&plugin_mutex);
826 	current_host = NULL;
827 	*error = NULL;
828 	return (AUDITD_SUCCESS);
829 }
830