Skip to content

Commit

Permalink
[202311] Fix TACACS local accounting disabled when debug flag disable…
Browse files Browse the repository at this point in the history
…d. (#19060)

* [TACACS] Ignore TACACS accounting trace log when debug disabled. (#16482)

Ignore TACACS accounting trace log when debug disabled.

#### Why I did it
TACACS accounting trace log is only for debug, improve code to not generate trace log when debug disabled.

##### Work item tracking
- Microsoft ADO: 25270078

#### How I did it
Ignore TACACS accounting trace log when debug disabled.

#### How to verify it
Pass all UT.
Manually verified the auditd-tacplus not generate trace log when debug disabled. 

### Description for the changelog
Ignore TACACS accounting trace log when debug disabled.

* Fix tacacs local accounting break. (#18357)

Fix TACACS local accounting disabled when debug flag disabled.

#### Why I did it
TACACS local accounting use trace() method to output local accounting log, following PR disable trace log when debug flag disabled, 
#16482

Because test case issue, this regression not found. the issue only exists on master branch.

### How I did it
Fix TACACS local accounting disabled when debug flag disabled.

#### How to verify it
Pass all UT.
Fix TACACS accounting UT to prevent regression.

### Tested branch (Please provide the tested image version)

- [] SONiC.master-16482.360728-2c8b4066f

#### Description for the changelog
Fix TACACS local accounting disabled when debug flag disabled.
  • Loading branch information
liuh-80 authored May 28, 2024
1 parent 2e1892b commit 006f940
Show file tree
Hide file tree
Showing 2 changed files with 15 additions and 5 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -13,15 +13,15 @@ Subject: [PATCH] Remove user secret from accounting log.
regex_helper.h | 17 +++
sudoers_helper.c | 250 +++++++++++++++++++++++++++++++++++++++
sudoers_helper.h | 18 +++
trace.c | 21 ++++
trace.c | 31 +++++
trace.h | 10 ++
unittest/Makefile | 21 ++++
unittest/mock.h | 17 +++
unittest/mock_helper.c | 65 ++++++++++
unittest/mock_helper.h | 48 ++++++++
unittest/password_test.c | 199 +++++++++++++++++++++++++++++++
unittest/sudoers | 5 +
17 files changed, 931 insertions(+), 4 deletions(-)
17 files changed, 941 insertions(+), 4 deletions(-)
create mode 100644 password.c
create mode 100644 password.h
create mode 100644 regex_helper.c
Expand Down Expand Up @@ -700,7 +700,7 @@ new file mode 100644
index 0000000..44bbbc7
--- /dev/null
+++ b/trace.c
@@ -0,0 +1,21 @@
@@ -0,0 +1,31 @@
+#include <stdarg.h>
+#include <stdio.h>
+#include <string.h>
Expand All @@ -709,9 +709,19 @@ index 0000000..44bbbc7
+
+#include "trace.h"
+
+/* Tacacs+ support lib */
+#include <libtac/support.h>
+
+/* Tacacs control flag */
+extern int tacacs_ctrl;
+
+/* Output trace log. */
+void trace(const char *format, ...)
+{
+ if ((tacacs_ctrl & PAM_TAC_DEBUG) == 0) {
+ return;
+ }
+
+ // convert log to a string because va args resoursive issue:
+ // http://www.c-faq.com/varargs/handoff.html
+ char logBuffer[MAX_LINE_SIZE];
Expand Down
4 changes: 2 additions & 2 deletions src/tacacs/audisp/patches/0003-Add-local-accounting.patch
Original file line number Diff line number Diff line change
Expand Up @@ -70,12 +70,12 @@ index 0000000..e23acec
+#include "trace.h"
+
+/* Accounting log format. */
+#define ACCOUNTING_LOG_FORMAT "Accounting: user: %s, tty: %s, host: %s, command: %s, type: %d, task ID: %d"
+#define ACCOUNTING_LOG_FORMAT "Audisp-tacplus: Accounting: user: %s, tty: %s, host: %s, command: %s, type: %d, task ID: %d"
+
+/* Write the accounting information to syslog. */
+void accounting_to_syslog(char *user, char *tty, char *host, char *cmdmsg, int type, uint16_t task_id)
+{
+ trace(ACCOUNTING_LOG_FORMAT, user, tty, host, cmdmsg, type, task_id);
+ syslog(LOG_INFO, ACCOUNTING_LOG_FORMAT, user, tty, host, cmdmsg, type, task_id);
+}
\ No newline at end of file
diff --git a/local_accounting.h b/local_accounting.h
Expand Down

0 comments on commit 006f940

Please sign in to comment.