- tedu@cvs.openbsd.org 2010/01/17 21:49:09

[openssh.git] / audit.c

diff --git a/audit.c b/audit.c
index 5cef3813309f9f3c4a495f507cccf9296571e1cd..bb386d852a648577e38f0c5f41153959c51f1c70 100644 (file)
--- a/audit.c
+++ b/audit.c
@@ -26,10 +26,15 @@
 
 #include "includes.h"
 
-#ifdef AUDIT_EVENTS
+#include <stdarg.h>
+#include <string.h>
+
+#ifdef SSH_AUDIT_EVENTS
 
 #include "audit.h"
 #include "log.h"
+#include "key.h"
+#include "hostfile.h"
 #include "auth.h"
 
 /*
@@ -44,22 +49,22 @@ ssh_audit_event_t
 audit_classify_auth(const char *method)
 {
        if (strcmp(method, "none") == 0)
-               return AUTH_FAIL_NONE;
+               return SSH_AUTH_FAIL_NONE;
        else if (strcmp(method, "password") == 0)
-               return AUTH_FAIL_PASSWD;
+               return SSH_AUTH_FAIL_PASSWD;
        else if (strcmp(method, "publickey") == 0 ||
            strcmp(method, "rsa") == 0)
-               return AUTH_FAIL_PUBKEY;
+               return SSH_AUTH_FAIL_PUBKEY;
        else if (strncmp(method, "keyboard-interactive", 20) == 0 ||
            strcmp(method, "challenge-response") == 0)
-               return AUTH_FAIL_KBDINT;
+               return SSH_AUTH_FAIL_KBDINT;
        else if (strcmp(method, "hostbased") == 0 ||
            strcmp(method, "rhosts-rsa") == 0)
-               return AUTH_FAIL_HOSTBASED;
+               return SSH_AUTH_FAIL_HOSTBASED;
        else if (strcmp(method, "gssapi-with-mic") == 0)
-               return AUTH_FAIL_GSSAPI;
+               return SSH_AUTH_FAIL_GSSAPI;
        else
-               return AUDIT_UNKNOWN;
+               return SSH_AUDIT_UNKNOWN;
 }
 
 /* helper to return supplied username */
@@ -84,32 +89,32 @@ audit_event_lookup(ssh_audit_event_t ev)
                ssh_audit_event_t event;
                const char *name;
        } event_lookup[] = {
-               {LOGIN_EXCEED_MAXTRIES, "LOGIN_EXCEED_MAXTRIES"},
-               {LOGIN_ROOT_DENIED,     "LOGIN_ROOT_DENIED"},
-               {AUTH_SUCCESS,          "AUTH_SUCCESS"},
-               {AUTH_FAIL_NONE,        "AUTH_FAIL_NONE"},
-               {AUTH_FAIL_PASSWD,      "AUTH_FAIL_PASSWD"},
-               {AUTH_FAIL_KBDINT,      "AUTH_FAIL_KBDINT"},
-               {AUTH_FAIL_PUBKEY,      "AUTH_FAIL_PUBKEY"},
-               {AUTH_FAIL_HOSTBASED,   "AUTH_FAIL_HOSTBASED"},
-               {AUTH_FAIL_GSSAPI,      "AUTH_FAIL_GSSAPI"},
-               {INVALID_USER,          "INVALID_USER"},
-               {NOLOGIN,               "NOLOGIN"},
-               {CONNECTION_CLOSE,      "CONNECTION_CLOSE"},
-               {CONNECTION_ABANDON,    "CONNECTION_ABANDON"},
-               {AUDIT_UNKNOWN,         "AUDIT_UNKNOWN"}
+               {SSH_LOGIN_EXCEED_MAXTRIES,     "LOGIN_EXCEED_MAXTRIES"},
+               {SSH_LOGIN_ROOT_DENIED,         "LOGIN_ROOT_DENIED"},
+               {SSH_AUTH_SUCCESS,              "AUTH_SUCCESS"},
+               {SSH_AUTH_FAIL_NONE,            "AUTH_FAIL_NONE"},
+               {SSH_AUTH_FAIL_PASSWD,          "AUTH_FAIL_PASSWD"},
+               {SSH_AUTH_FAIL_KBDINT,          "AUTH_FAIL_KBDINT"},
+               {SSH_AUTH_FAIL_PUBKEY,          "AUTH_FAIL_PUBKEY"},
+               {SSH_AUTH_FAIL_HOSTBASED,       "AUTH_FAIL_HOSTBASED"},
+               {SSH_AUTH_FAIL_GSSAPI,          "AUTH_FAIL_GSSAPI"},
+               {SSH_INVALID_USER,              "INVALID_USER"},
+               {SSH_NOLOGIN,                   "NOLOGIN"},
+               {SSH_CONNECTION_CLOSE,          "CONNECTION_CLOSE"},
+               {SSH_CONNECTION_ABANDON,        "CONNECTION_ABANDON"},
+               {SSH_AUDIT_UNKNOWN,             "AUDIT_UNKNOWN"}
        };
 
-       for (i = 0; event_lookup[i].event != AUDIT_UNKNOWN; i++)
+       for (i = 0; event_lookup[i].event != SSH_AUDIT_UNKNOWN; i++)
                if (event_lookup[i].event == ev)
                        break;
        return(event_lookup[i].name);
 }
 
-# ifndef CUSTOM_AUDIT_EVENTS
+# ifndef CUSTOM_SSH_AUDIT_EVENTS
 /*
  * Null implementations of audit functions.
- * These get used if AUDIT_EVENTS is defined but no audit module is enabled.
+ * These get used if SSH_AUDIT_EVENTS is defined but no audit module is enabled.
  */
 
 /*
@@ -120,7 +125,7 @@ void
 audit_connection_from(const char *host, int port)
 {
        debug("audit connection from %s port %d euid %d", host, port,
-          (int)geteuid());
+           (int)geteuid());
 }
 
 /*
@@ -147,7 +152,7 @@ audit_session_open(const char *ttyn)
        const char *t = ttyn ? ttyn : "(no tty)";
 
        debug("audit session open euid %d user %s tty name %s", geteuid(),
-            audit_username(), t);
+           audit_username(), t);
 }
 
 /*
@@ -163,7 +168,7 @@ audit_session_close(const char *ttyn)
        const char *t = ttyn ? ttyn : "(no tty)";
 
        debug("audit session close euid %d user %s tty name %s", geteuid(),
-            audit_username(), t);
+           audit_username(), t);
 }
 
 /*
@@ -177,5 +182,5 @@ audit_run_command(const char *command)
        debug("audit run command euid %d user %s command '%.200s'", geteuid(),
            audit_username(), command);
 }
-# endif  /* !defined CUSTOM_AUDIT_EVENTS */
-#endif /* AUDIT_EVENTS */
+# endif  /* !defined CUSTOM_SSH_AUDIT_EVENTS */
+#endif /* SSH_AUDIT_EVENTS */