Add Security Logging Plugin. (eProsima#1125)

* Add security logging (canonical#1) * add security logging to file as per dds-spec * add set/get logger to security plugin base classes * logging integration to SecurityManager * add SECURITY_LOGGING macros Signed-off-by: artivis <jeremie.deray@canonical.com> * handle empty filename Signed-off-by: artivis <jeremie.deray@canonical.com> * post-master-merge fix Signed-off-by: artivis <jeremie.deray@canonical.com> * handle empty filename Signed-off-by: artivis <jeremie.deray@canonical.com> * fix typo test filename Signed-off-by: artivis <jeremie.deray@canonical.com> * fix linking error * some doc fixes Signed-off-by: artivis <jeremie.deray@canonical.com> * some doc fixes Signed-off-by: artivis <jeremie.deray@canonical.com> * support logging in SecurityPluginFactory Mock Signed-off-by: artivis <jeremie.deray@canonical.com> * include log in security logging for macro support & cleanup Signed-off-by: artivis <jeremie.deray@canonical.com> * add missing source Signed-off-by: artivis <jeremie.deray@canonical.com> * replace 'library' includes with 'system' Signed-off-by: artivis <jeremie.deray@canonical.com> * uncrustify Signed-off-by: artivis <jeremie.deray@canonical.com> * add log to file test Signed-off-by: artivis <jeremie.deray@canonical.com> * fix warnings Signed-off-by: artivis <jeremie.deray@canonical.com> * fix error msg typo Signed-off-by: artivis <jeremie.deray@canonical.com> * fix linking error Signed-off-by: artivis <jeremie.deray@canonical.com> * fix warning Signed-off-by: artivis <jeremie.deray@canonical.com> * add verbosity level to file logs Signed-off-by: artivis <jeremie.deray@canonical.com> * test file logs header Signed-off-by: artivis <jeremie.deray@canonical.com> * use logging in Permission Signed-off-by: artivis <jeremie.deray@canonical.com> * use logging in PKIDH Signed-off-by: artivis <jeremie.deray@canonical.com> * use logging in SecurityManager Signed-off-by: artivis <jeremie.deray@canonical.com>
artivis · Apr 14, 2020 · 8492d5a · 8492d5a
1 parent 39a1702
commit 8492d5a
Show file tree

Hide file tree

Showing 27 changed files with 1,729 additions and 91 deletions.
diff --git a/include/fastdds/rtps/security/accesscontrol/AccessControl.h b/include/fastdds/rtps/security/accesscontrol/AccessControl.h
@@ -36,6 +36,7 @@ class Authentication;
 class SecurityException;
 struct ParticipantSecurityAttributes;
 struct EndpointSecurityAttributes;
+class Logging;
 
 class AccessControl
 {
@@ -152,6 +153,25 @@ class AccessControl
             const std::vector<std::string>& partitions,
             EndpointSecurityAttributes& attributes,
             SecurityException& exception) = 0;
+
+    bool set_logger(
+            Logging* logger,
+            SecurityException& /*exception*/)
+    {
+        logger_ = logger;
+        return true;
+    }
+
+protected:
+
+    const Logging* get_logger()
+    {
+        return logger_;
+    }
+
+private:
+
+    Logging* logger_ = nullptr;
 };
 
 } //namespace security

diff --git a/include/fastdds/rtps/security/authentication/Authentication.h b/include/fastdds/rtps/security/authentication/Authentication.h
@@ -34,6 +34,8 @@ namespace fastrtps {
 namespace rtps {
 namespace security {
 
+class Logging;
+
 enum ValidationResult_t : uint32_t
 {
     VALIDATION_OK = 0,
@@ -225,6 +227,23 @@ class Authentication
         virtual bool return_authenticated_peer_credential_token(PermissionsCredentialToken* token,
                 SecurityException& ex) = 0;
 
+        bool set_logger(Logging* logger,
+             SecurityException& /*exception*/)
+        {
+            logger_ = logger;
+            return true;
+        }
+
+    protected:
+
+        const Logging* get_logger() const
+        {
+            return logger_;
+        }
+
+    private:
+
+        Logging* logger_ = nullptr;
 };
 
 } //namespace security

diff --git a/include/fastdds/rtps/security/cryptography/Cryptography.h b/include/fastdds/rtps/security/cryptography/Cryptography.h
@@ -28,12 +28,14 @@ namespace fastrtps {
 namespace rtps {
 namespace security {
 
+class Logging;
+
 class Cryptography
 {
 public:
 
     Cryptography(): m_cryptokeyexchange(nullptr), m_cryptokeyfactory(nullptr),
-    m_cryptotransform(nullptr) {}
+    m_cryptotransform(nullptr), m_logger(nullptr) {}
 
     virtual ~Cryptography() {}
 
@@ -44,11 +46,28 @@ class Cryptography
 
     CryptoTransform* cryptotransform() { return m_cryptotransform; }
 
+    bool set_logger(
+            Logging* logger,
+            SecurityException& /*exception*/)
+    {
+        m_logger = logger;
+        return true;
+    }
+
 protected:
 
+    const Logging* get_logger()
+    {
+        return m_logger;
+    }
+
     CryptoKeyExchange *m_cryptokeyexchange;
     CryptoKeyFactory *m_cryptokeyfactory;
     CryptoTransform *m_cryptotransform;
+
+private:
+
+    Logging *m_logger;
 };
 
 } //namespace security

diff --git a/include/fastdds/rtps/security/logging/BuiltinLoggingType.h b/include/fastdds/rtps/security/logging/BuiltinLoggingType.h
@@ -0,0 +1,58 @@
+// Copyright 2020 Canonical ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+/*!
+ * @file BuiltinLoggingType.h
+ */
+#ifndef _FASTDDS_RTPS_SECURITY_LOGGING_BUILTINLOGGINGTYPE_H_
+#define _FASTDDS_RTPS_SECURITY_LOGGING_BUILTINLOGGINGTYPE_H_
+
+#include <fastdds/rtps/common/Types.h>
+#include <fastdds/rtps/common/Time_t.h>
+#include <fastdds/rtps/security/logging/LoggingLevel.h>
+#include <fastdds/rtps/security/logging/NameValuePair.h>
+
+#include <map>
+
+namespace eprosima {
+namespace fastrtps {
+namespace rtps {
+namespace security {
+
+/**
+ * @brief The BuiltinLoggingType struct
+ *
+ * @note Definition in DDS-Sec v1.1 9.6
+ */
+struct BuiltinLoggingType final
+{
+    octet facility;           // Set to 0x0A (10). Indicates sec/auth msgs
+    LoggingLevel severity;
+    rtps::Time_t timestamp;   // Since epoch 1970-01-01 00:00:00 +0000 (UTC)
+    std::string hostname;     // IP host name of originator
+    std::string hostip;       // IP address of originator
+    std::string appname;      // Identify the device or application
+    std::string procid;       // Process name/ID for syslog system
+    std::string msgid;        // Identify the type of message
+    std::string message;      // Free-form message
+    // Note that certain string keys (SD-IDs) are reserved by IANA
+    std::map<std::string, NameValuePairSeq> structured_data;
+};
+
+} //namespace security
+} //namespace rtps
+} //namespace fastrtps
+} //namespace eprosima
+
+#endif // _FASTDDS_RTPS_SECURITY_LOGGING_BUILTINLOGGINGTYPE_H_
diff --git a/include/fastdds/rtps/security/logging/LogOptions.h b/include/fastdds/rtps/security/logging/LogOptions.h
@@ -0,0 +1,52 @@
+// Copyright 2020 Canonical ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+/*!
+ * @file LogOptions.h
+ */
+#ifndef _FASTDDS_RTPS_SECURITY_LOGGING_LOGOPTIONS_H_
+#define _FASTDDS_RTPS_SECURITY_LOGGING_LOGOPTIONS_H_
+
+#include <string>
+
+#include <fastdds/rtps/security/logging/LoggingLevel.h>
+
+namespace eprosima {
+namespace fastrtps {
+namespace rtps {
+namespace security {
+
+/**
+ * @brief The LogOptions struct
+ * @note Definition in DDS-Sec v1.1 8.6.2.1
+ */
+struct LogOptions
+{
+    //! Whether the log events should be distributed over DDS
+    bool distribute;
+
+    //! Level at which log messages will be logged.
+    //! Messages at or below the log_level are logged.
+    LoggingLevel log_level;
+
+    //! Full path to a local file
+    std::string log_file;
+};
+
+} //namespace security
+} //namespace rtps
+} //namespace fastrtps
+} //namespace eprosima
+
+#endif // _FASTDDS_RTPS_SECURITY_LOGGING_LOGOPTIONS_H_