This change introduces a new audit subsystem that allows tracking and logging of database operations for security and compliance purposes. Key features include: - Configurable audit logging to either syslog or a dedicated system table (audit.audit_log) - Selective auditing based on: - Operation categories (QUERY, DML, DDL, DCL, AUTH, ADMIN) - Specific keyspaces - Specific tables - New configuration options: - audit: Controls audit destination (none/syslog/table) - audit_categories: Comma-separated list of operation categories to audit - audit_tables: Specific tables to audit - audit_keyspaces: Specific keyspaces to audit - audit_unix_socket_path: Path for syslog socket - audit_syslog_write_buffer_size: Buffer size for syslog writes The audit logs capture details including: - Operation timestamp - Node and client IP addresses - Operation category and query - Username - Success/failure status - Affected keyspace and table names
150 lines
4.7 KiB
C++
150 lines
4.7 KiB
C++
/*
|
|
* Copyright (C) 2014-present ScyllaDB
|
|
*
|
|
* Modified by ScyllaDB
|
|
*/
|
|
|
|
/*
|
|
* SPDX-License-Identifier: (LicenseRef-ScyllaDB-Source-Available-1.0 and Apache-2.0)
|
|
*/
|
|
|
|
#pragma once
|
|
|
|
#include "timeout_config.hh"
|
|
#include "service/raft/raft_group0_client.hh"
|
|
#include "audit/audit.hh"
|
|
|
|
namespace service {
|
|
|
|
class storage_proxy;
|
|
class query_state;
|
|
class client_state;
|
|
|
|
}
|
|
|
|
namespace cql_transport {
|
|
|
|
namespace messages {
|
|
|
|
class result_message;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
namespace cql3 {
|
|
|
|
class query_processor;
|
|
|
|
class metadata;
|
|
seastar::shared_ptr<const metadata> make_empty_metadata();
|
|
|
|
class query_options;
|
|
|
|
// A vector of CQL warnings generated during execution of a statement.
|
|
using cql_warnings_vec = std::vector<sstring>;
|
|
|
|
class cql_statement {
|
|
timeout_config_selector _timeout_config_selector;
|
|
audit::audit_info_ptr _audit_info;
|
|
public:
|
|
// CQL statement text
|
|
seastar::sstring raw_cql_statement;
|
|
|
|
// Returns true for statements that needs guard to be taken before the execution
|
|
virtual bool needs_guard(query_processor& qp, service::query_state& state) const {
|
|
return false;
|
|
}
|
|
|
|
explicit cql_statement(timeout_config_selector timeout_selector) : _timeout_config_selector(timeout_selector) {}
|
|
cql_statement(cql_statement&& o) = default;
|
|
cql_statement(const cql_statement& o) : _timeout_config_selector(o._timeout_config_selector), _audit_info(o._audit_info ? std::make_unique<audit::audit_info>(*o._audit_info) : nullptr) { }
|
|
virtual ~cql_statement()
|
|
{ }
|
|
|
|
timeout_config_selector get_timeout_config_selector() const { return _timeout_config_selector; }
|
|
|
|
virtual uint32_t get_bound_terms() const = 0;
|
|
|
|
/**
|
|
* Perform any access verification necessary for the statement.
|
|
*
|
|
* @param state the current client state
|
|
*/
|
|
virtual seastar::future<> check_access(query_processor& qp, const service::client_state& state) const = 0;
|
|
|
|
/**
|
|
* Perform additional validation required by the statement.
|
|
* To be overridden by subclasses if needed.
|
|
*
|
|
* @param state the current client state
|
|
*/
|
|
virtual void validate(query_processor& qp, const service::client_state& state) const {}
|
|
|
|
/**
|
|
* Execute the statement and return the resulting result or null if there is no result.
|
|
*
|
|
* In case of a failure, it must return an exceptional future. It must not use
|
|
* the result_message::exception to indicate failure.
|
|
*
|
|
* @param state the current query state
|
|
* @param options options for this query (consistency, variables, pageSize, ...)
|
|
*/
|
|
virtual seastar::future<seastar::shared_ptr<cql_transport::messages::result_message>>
|
|
execute(query_processor& qp, service::query_state& state, const query_options& options, std::optional<service::group0_guard> guard) const = 0;
|
|
|
|
/**
|
|
* Execute the statement and return the resulting result or null if there is no result.
|
|
*
|
|
* Unlike execute(), it is allowed to return a result_message::exception which contains
|
|
* an exception that needs to be explicitly handled.
|
|
*
|
|
* @param state the current query state
|
|
* @param options options for this query (consistency, variables, pageSize, ...)
|
|
*/
|
|
virtual seastar::future<seastar::shared_ptr<cql_transport::messages::result_message>>
|
|
execute_without_checking_exception_message(query_processor& qp, service::query_state& state, const query_options& options, std::optional<service::group0_guard> guard) const {
|
|
return execute(qp, state, options, std::move(guard));
|
|
}
|
|
|
|
virtual bool depends_on(std::string_view ks_name, std::optional<std::string_view> cf_name) const = 0;
|
|
|
|
virtual seastar::shared_ptr<const metadata> get_result_metadata() const = 0;
|
|
|
|
virtual bool is_conditional() const {
|
|
return false;
|
|
}
|
|
|
|
audit::audit_info* get_audit_info() { return _audit_info.get(); }
|
|
void set_audit_info(audit::audit_info_ptr&& info) { _audit_info = std::move(info); }
|
|
|
|
virtual void sanitize_audit_info() {}
|
|
};
|
|
|
|
class cql_statement_no_metadata : public cql_statement {
|
|
public:
|
|
using cql_statement::cql_statement;
|
|
virtual seastar::shared_ptr<const metadata> get_result_metadata() const override {
|
|
return make_empty_metadata();
|
|
}
|
|
};
|
|
|
|
// Conditional modification statements and batches
|
|
// return a result set and have metadata, while same
|
|
// statements without conditions do not.
|
|
class cql_statement_opt_metadata : public cql_statement {
|
|
protected:
|
|
// Result set metadata, may be empty for simple updates and batches
|
|
seastar::shared_ptr<metadata> _metadata;
|
|
public:
|
|
using cql_statement::cql_statement;
|
|
virtual seastar::shared_ptr<const metadata> get_result_metadata() const override {
|
|
if (_metadata) {
|
|
return _metadata;
|
|
}
|
|
return make_empty_metadata();
|
|
}
|
|
};
|
|
|
|
}
|