2018-07-05 10:18:17 +00:00
|
|
|
# frozen_string_literal: true
|
|
|
|
|
2015-07-03 11:54:50 +00:00
|
|
|
class AuditEventService
|
2020-02-19 09:08:59 +00:00
|
|
|
# Instantiates a new service
|
|
|
|
#
|
2020-02-25 09:09:10 +00:00
|
|
|
# @param [User] author the user who authors the change
|
|
|
|
# @param [User, Project, Group] entity the scope which audit event belongs to
|
|
|
|
# This param is also used to determine the visibility of the audit event.
|
|
|
|
# - Project: events are visible at Project and Instance level
|
|
|
|
# - Group: events are visible at Group and Instance level
|
2020-02-19 09:08:59 +00:00
|
|
|
# - User: events are visible at Instance level
|
2020-02-25 09:09:10 +00:00
|
|
|
# @param [Hash] details extra data of audit event
|
2020-02-19 09:08:59 +00:00
|
|
|
#
|
|
|
|
# @return [AuditEventService]
|
2015-07-03 11:54:50 +00:00
|
|
|
def initialize(author, entity, details = {})
|
2020-04-03 12:09:52 +00:00
|
|
|
@author = build_author(author)
|
2020-02-19 09:08:59 +00:00
|
|
|
@entity = entity
|
|
|
|
@details = details
|
2021-06-29 12:08:48 +00:00
|
|
|
@ip_address = resolve_ip_address(@author)
|
2015-07-03 11:54:50 +00:00
|
|
|
end
|
|
|
|
|
2020-02-19 09:08:59 +00:00
|
|
|
# Builds the @details attribute for authentication
|
|
|
|
#
|
2020-02-25 09:09:10 +00:00
|
|
|
# This uses the @author as the target object being audited
|
2020-02-19 09:08:59 +00:00
|
|
|
#
|
|
|
|
# @return [AuditEventService]
|
2015-07-03 11:54:50 +00:00
|
|
|
def for_authentication
|
2020-09-18 06:09:31 +00:00
|
|
|
mark_as_authentication_event!
|
|
|
|
|
2015-07-03 11:54:50 +00:00
|
|
|
@details = {
|
|
|
|
with: @details[:with],
|
|
|
|
target_id: @author.id,
|
2016-07-06 13:26:59 +00:00
|
|
|
target_type: 'User',
|
2017-05-03 11:22:03 +00:00
|
|
|
target_details: @author.name
|
2015-07-03 11:54:50 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
self
|
|
|
|
end
|
|
|
|
|
2020-02-19 09:08:59 +00:00
|
|
|
# Writes event to a file and creates an event record in DB
|
|
|
|
#
|
2020-08-21 09:10:08 +00:00
|
|
|
# @return [AuditEvent] persited if saves and non-persisted if fails
|
2015-07-03 11:54:50 +00:00
|
|
|
def security_event
|
Add support for JSON logging for audit events
This will add audit_json.log that writes one line per audit event. For
example:
{
"severity":"INFO",
"time":"2018-10-17T17:38:22.523Z",
"author_id":3,
"entity_id":2,
"entity_type":"Project",
"change":"visibility",
"from":"Private",
"to":"Public",
"author_name":"John Doe4",
"target_id":2,
"target_type":"Project",
"target_details":"namespace2/project2"
}
2018-10-18 19:50:21 +00:00
|
|
|
log_security_event_to_file
|
2020-09-18 06:09:31 +00:00
|
|
|
log_authentication_event_to_database
|
Add support for JSON logging for audit events
This will add audit_json.log that writes one line per audit event. For
example:
{
"severity":"INFO",
"time":"2018-10-17T17:38:22.523Z",
"author_id":3,
"entity_id":2,
"entity_type":"Project",
"change":"visibility",
"from":"Private",
"to":"Public",
"author_name":"John Doe4",
"target_id":2,
"target_type":"Project",
"target_details":"namespace2/project2"
}
2018-10-18 19:50:21 +00:00
|
|
|
log_security_event_to_database
|
|
|
|
end
|
|
|
|
|
2020-02-19 09:08:59 +00:00
|
|
|
# Writes event to a file
|
2019-08-27 21:50:17 +00:00
|
|
|
def log_security_event_to_file
|
|
|
|
file_logger.info(base_payload.merge(formatted_details))
|
|
|
|
end
|
|
|
|
|
Add support for JSON logging for audit events
This will add audit_json.log that writes one line per audit event. For
example:
{
"severity":"INFO",
"time":"2018-10-17T17:38:22.523Z",
"author_id":3,
"entity_id":2,
"entity_type":"Project",
"change":"visibility",
"from":"Private",
"to":"Public",
"author_name":"John Doe4",
"target_id":2,
"target_type":"Project",
"target_details":"namespace2/project2"
}
2018-10-18 19:50:21 +00:00
|
|
|
private
|
|
|
|
|
2020-07-15 15:09:21 +00:00
|
|
|
attr_reader :ip_address
|
|
|
|
|
2020-04-03 12:09:52 +00:00
|
|
|
def build_author(author)
|
2020-05-15 15:08:04 +00:00
|
|
|
case author
|
|
|
|
when User
|
|
|
|
author.impersonated? ? Gitlab::Audit::ImpersonatedAuthor.new(author) : author
|
2020-04-03 12:09:52 +00:00
|
|
|
else
|
|
|
|
Gitlab::Audit::UnauthenticatedAuthor.new(name: author)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2021-06-29 12:08:48 +00:00
|
|
|
def resolve_ip_address(author)
|
|
|
|
Gitlab::RequestContext.instance.client_ip ||
|
2020-10-27 06:08:27 +00:00
|
|
|
author.current_sign_in_ip
|
|
|
|
end
|
|
|
|
|
Add support for JSON logging for audit events
This will add audit_json.log that writes one line per audit event. For
example:
{
"severity":"INFO",
"time":"2018-10-17T17:38:22.523Z",
"author_id":3,
"entity_id":2,
"entity_type":"Project",
"change":"visibility",
"from":"Private",
"to":"Public",
"author_name":"John Doe4",
"target_id":2,
"target_type":"Project",
"target_details":"namespace2/project2"
}
2018-10-18 19:50:21 +00:00
|
|
|
def base_payload
|
|
|
|
{
|
2015-07-03 11:54:50 +00:00
|
|
|
author_id: @author.id,
|
2020-07-07 12:09:16 +00:00
|
|
|
author_name: @author.name,
|
2015-07-03 11:54:50 +00:00
|
|
|
entity_id: @entity.id,
|
Add support for JSON logging for audit events
This will add audit_json.log that writes one line per audit event. For
example:
{
"severity":"INFO",
"time":"2018-10-17T17:38:22.523Z",
"author_id":3,
"entity_id":2,
"entity_type":"Project",
"change":"visibility",
"from":"Private",
"to":"Public",
"author_name":"John Doe4",
"target_id":2,
"target_type":"Project",
"target_details":"namespace2/project2"
}
2018-10-18 19:50:21 +00:00
|
|
|
entity_type: @entity.class.name
|
|
|
|
}
|
|
|
|
end
|
|
|
|
|
2020-09-18 06:09:31 +00:00
|
|
|
def authentication_event_payload
|
|
|
|
{
|
|
|
|
# @author can be a User or various Gitlab::Audit authors.
|
|
|
|
# Only capture real users for successful authentication events.
|
|
|
|
user: author_if_user,
|
|
|
|
user_name: @author.name,
|
|
|
|
ip_address: ip_address,
|
|
|
|
result: AuthenticationEvent.results[:success],
|
|
|
|
provider: @details[:with]
|
|
|
|
}
|
|
|
|
end
|
|
|
|
|
|
|
|
def author_if_user
|
|
|
|
@author if @author.is_a?(User)
|
|
|
|
end
|
|
|
|
|
Add support for JSON logging for audit events
This will add audit_json.log that writes one line per audit event. For
example:
{
"severity":"INFO",
"time":"2018-10-17T17:38:22.523Z",
"author_id":3,
"entity_id":2,
"entity_type":"Project",
"change":"visibility",
"from":"Private",
"to":"Public",
"author_name":"John Doe4",
"target_id":2,
"target_type":"Project",
"target_details":"namespace2/project2"
}
2018-10-18 19:50:21 +00:00
|
|
|
def file_logger
|
|
|
|
@file_logger ||= Gitlab::AuditJsonLogger.build
|
|
|
|
end
|
|
|
|
|
2019-07-03 22:58:05 +00:00
|
|
|
def formatted_details
|
|
|
|
@details.merge(@details.slice(:from, :to).transform_values(&:to_s))
|
|
|
|
end
|
|
|
|
|
2020-09-18 06:09:31 +00:00
|
|
|
def mark_as_authentication_event!
|
2020-09-18 21:10:11 +00:00
|
|
|
@authentication_event = true
|
2020-09-18 06:09:31 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def authentication_event?
|
2020-09-18 21:10:11 +00:00
|
|
|
@authentication_event
|
2020-09-18 06:09:31 +00:00
|
|
|
end
|
|
|
|
|
Add support for JSON logging for audit events
This will add audit_json.log that writes one line per audit event. For
example:
{
"severity":"INFO",
"time":"2018-10-17T17:38:22.523Z",
"author_id":3,
"entity_id":2,
"entity_type":"Project",
"change":"visibility",
"from":"Private",
"to":"Public",
"author_name":"John Doe4",
"target_id":2,
"target_type":"Project",
"target_details":"namespace2/project2"
}
2018-10-18 19:50:21 +00:00
|
|
|
def log_security_event_to_database
|
2021-08-02 09:10:09 +00:00
|
|
|
return if Gitlab::Database.read_only?
|
2020-02-06 03:08:47 +00:00
|
|
|
|
2020-09-24 15:09:51 +00:00
|
|
|
event = AuditEvent.new(base_payload.merge(details: @details))
|
|
|
|
save_or_track event
|
|
|
|
|
|
|
|
event
|
2015-07-03 11:54:50 +00:00
|
|
|
end
|
2020-09-18 06:09:31 +00:00
|
|
|
|
|
|
|
def log_authentication_event_to_database
|
2021-08-02 09:10:09 +00:00
|
|
|
return unless Gitlab::Database.read_write? && authentication_event?
|
2020-09-18 06:09:31 +00:00
|
|
|
|
2020-09-24 15:09:51 +00:00
|
|
|
event = AuthenticationEvent.new(authentication_event_payload)
|
|
|
|
save_or_track event
|
|
|
|
|
|
|
|
event
|
|
|
|
end
|
|
|
|
|
|
|
|
def save_or_track(event)
|
|
|
|
event.save!
|
2021-04-26 12:09:44 +00:00
|
|
|
rescue StandardError => e
|
2020-09-24 15:09:51 +00:00
|
|
|
Gitlab::ErrorTracking.track_exception(e, audit_event_type: event.class.to_s)
|
2020-09-18 06:09:31 +00:00
|
|
|
end
|
2015-07-03 11:54:50 +00:00
|
|
|
end
|
2019-09-13 13:26:31 +00:00
|
|
|
|
2021-05-11 21:10:21 +00:00
|
|
|
AuditEventService.prepend_mod_with('AuditEventService')
|