<?php
/*
** Zabbix
** Copyright (C) 2001-2023 Zabbix SIA
**
** This program is free software; you can redistribute it and/or modify
** it under the terms of the GNU General Public License as published by
** the Free Software Foundation; either version 2 of the License, or
** (at your option) any later version.
**
** This program is distributed in the hope that it will be useful,
** but WITHOUT ANY WARRANTY; without even the implied warranty of
** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
** GNU General Public License for more details.
**
** You should have received a copy of the GNU General Public License
** along with this program; if not, write to the Free Software
** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
**/
class CAuditOld {
private const AUDITLOG_ENABLE = 1;
/**
* Supported resources list, every record contains:
* resource id field name
* resource name field name
* resource table name
* resource API name
*/
private static $supported_type = [
CAudit::RESOURCE_ACTION => ['actionid', 'name', 'actions', 'action'],
CAudit::RESOURCE_AUTHENTICATION => ['configid', null, 'config', 'authentication'],
CAudit::RESOURCE_AUTH_TOKEN => ['tokenid', 'name', 'token', 'token'],
CAudit::RESOURCE_AUTOREGISTRATION => ['configid', null, 'config', 'autoregistration'],
CAudit::RESOURCE_CORRELATION => ['correlationid', 'name', 'correlation', 'correlation'],
CAudit::RESOURCE_DASHBOARD => ['dashboardid', 'name', 'dashboard', 'dashboard'],
CAudit::RESOURCE_DISCOVERY_RULE => ['druleid', 'name', 'drules', 'drule'],
CAudit::RESOURCE_GRAPH => ['graphid', 'name', 'graphs', 'graph'],
CAudit::RESOURCE_GRAPH_PROTOTYPE => ['graphid', 'name', 'graphs', 'graphprototype'],
CAudit::RESOURCE_HOST => ['hostid', 'name', 'hosts', 'host'],
CAudit::RESOURCE_HOST_GROUP => ['groupid', 'name', 'groups', 'hostgroup'],
CAudit::RESOURCE_HOST_PROTOTYPE => ['hostid', 'host', 'hosts', 'hostprototype'],
CAudit::RESOURCE_HOUSEKEEPING => ['configid', null, 'config', 'housekeeping'],
CAudit::RESOURCE_ICON_MAP => ['iconmapid', 'name', 'icon_map', 'iconmap'],
CAudit::RESOURCE_IMAGE => ['imageid', 'name', 'images', 'image'],
CAudit::RESOURCE_IT_SERVICE => ['serviceid', 'name', 'services', 'service'],
CAudit::RESOURCE_ITEM => ['itemid', 'name', 'items', 'item'],
CAudit::RESOURCE_ITEM_PROTOTYPE => ['itemid', 'name', 'items', 'itemprototype'],
CAudit::RESOURCE_MACRO => ['globalmacroid', 'macro', 'globalmacro', 'usermacro'],
CAudit::RESOURCE_MAINTENANCE => ['maintenanceid', 'name', 'maintenances', 'maintenance'],
CAudit::RESOURCE_MAP => ['sysmapid', 'name', 'sysmaps', 'map'],
CAudit::RESOURCE_MEDIA_TYPE => ['mediatypeid', 'name', 'media_type', 'mediatype'],
CAudit::RESOURCE_MODULE => ['moduleid', 'id', 'module', 'module'],
CAudit::RESOURCE_PROXY => ['proxyid', 'name', 'proxy', 'proxy'],
CAudit::RESOURCE_SCENARIO => ['httptestid', 'name', 'httptest', 'httptest'],
CAudit::RESOURCE_SCHEDULED_REPORT => ['reportid', 'name', 'report', 'report'],
CAudit::RESOURCE_SCRIPT => ['scriptid', 'name', 'scripts', 'script'],
CAudit::RESOURCE_SETTINGS => ['configid', null, 'config', 'settings'],
CAudit::RESOURCE_TEMPLATE => ['templateid', 'name', 'hosts', 'template'],
CAudit::RESOURCE_TRIGGER => ['triggerid', 'description', 'triggers', 'trigger'],
CAudit::RESOURCE_TRIGGER_PROTOTYPE => ['triggerid', 'description', 'triggers', 'triggerprototype'],
CAudit::RESOURCE_USER => ['userid', 'username', 'users', 'user'],
CAudit::RESOURCE_USER_GROUP => ['usrgrpid', 'name', 'usrgrp', 'usergroup'],
CAudit::RESOURCE_USER_ROLE => ['roleid', 'name', 'role', 'role'],
CAudit::RESOURCE_VALUE_MAP => ['valuemapid', 'name', 'valuemaps', 'valuemap'],
CAudit::RESOURCE_TEMPLATE_DASHBOARD => ['dashboardid', 'name', 'dashboard', 'templatedashboard']
];
private static $masked_fields = [
'config' => [
'fields' => ['tls_psk_identity' => true, 'tls_psk' => true]
],
'globalmacro' => [
'fields' => ['value' => true],
'conditions' => ['type' => ZBX_MACRO_TYPE_SECRET]
],
'hosts' => [
'fields' => ['tls_psk_identity' => true, 'tls_psk' => true]
],
'media_type' => [
'fields' => ['passwd' => true]
],
'token' => [
'fields' => ['token' => true]
],
'users' => [
'fields' => ['passwd' => true]
]
];
/**
* Add simple audit record.
*
* @param string $userid
* @param string $ip
* @param int $action AUDIT_ACTION_*
* @param int $resourcetype AUDIT_RESOURCE_*
* @param string $note
*/
// static public function addDetails($userid, $ip, $action, $resourcetype, $note = '') {
// DB::insert('auditlog', [[
// 'userid' => $userid,
// 'clock' => time(),
// 'ip' => substr($ip, 0, 39),
// 'action' => $action,
// 'resourcetype' => $resourcetype,
// 'note' => $note
// ]]);
// }
private static function getRecordSetId(): string {
static $recordsetid = null;
if ($recordsetid === null) {
$recordsetid = CCuid::generate();
}
return $recordsetid;
}
/**
* Add audit records.
*
* @param string $userid
* @param string $ip
* @param string $username
* @param int $action CAudit::ACTION_*
* @param int $resourcetype CAudit::RESOURCE_*
* @param array $objects
* @param array $objects_old
*/
public static function addBulk(string $userid, string $ip, string $username, int $action, int $resourcetype,
array $objects, array $objects_old = null) {
if (!array_key_exists($resourcetype, self::$supported_type)) {
return;
}
if (CSettingsHelper::get(CSettingsHelper::AUDITLOG_ENABLED) != self::AUDITLOG_ENABLE
&& ($resourcetype != CAudit::RESOURCE_SETTINGS
|| !array_key_exists(CSettingsHelper::AUDITLOG_ENABLED, current($objects)))) {
return;
}
$recordsetid = self::getRecordSetId();
[$field_name_resourceid, $field_name_resourcename, $table_name, $api_name] = self::$supported_type[$resourcetype];
$clock = time();
$ip = substr($ip, 0, 39);
$auditlog = [];
foreach ($objects as $object) {
$resourceid = $object[$field_name_resourceid];
$diff = '';
if ($action == CAudit::ACTION_UPDATE) {
$object_old = $objects_old[$resourceid];
/**
* Convert two dimension array to one dimension array,
* because array_diff and array_intersect work only with one dimension array.
*/
$object_old = array_filter($object_old, function ($val) {
return !is_array($val);
});
$object = array_filter($object, function ($val) {
return !is_array($val);
});
$object_diff = array_diff_assoc(array_intersect_key($object_old, $object), $object);
if (!$object_diff) {
continue;
}
if (array_key_exists($table_name, self::$masked_fields)) {
$table_masked_fields = self::$masked_fields[$table_name]['fields'];
$mask_object_old = true;
$mask_object = true;
if (array_key_exists('conditions', self::$masked_fields[$table_name])) {
foreach (self::$masked_fields[$table_name]['conditions'] as $field_name => $value) {
if ($mask_object_old) {
$mask_object_old = ($object_old[$field_name] == $value);
}
if ($mask_object) {
$mask_object = array_key_exists($field_name, $object)
? ($object[$field_name] == $value)
: ($object_old[$field_name] == $value);
}
}
}
}
else {
$table_masked_fields = [];
$mask_object_old = false;
$mask_object = false;
}
$details = [];
foreach (array_keys($object_diff) as $field_name) {
if (array_key_exists($field_name, $table_masked_fields)) {
if ($mask_object_old) {
$object_old[$field_name] = ZBX_SECRET_MASK;
}
if ($mask_object) {
$object[$field_name] = ZBX_SECRET_MASK;
}
}
$details[$api_name.'.'.$field_name] = ['update', $object[$field_name], $object_old[$field_name]];
}
$diff = json_encode($details);
$resourcename = ($field_name_resourcename !== null) ? $object_old[$field_name_resourcename] : '';
}
else {
$resourcename = ($field_name_resourcename !== null) ? $object[$field_name_resourcename] : '';
}
if (mb_strlen($resourcename) > 255) {
$resourcename = mb_substr($resourcename, 0, 252).'...';
}
$auditlog[] = [
'userid' => $userid,
'username' => $username,
'clock' => $clock,
'ip' => $ip,
'action' => $action,
'resourcetype' => $resourcetype,
'resourceid' => $resourceid,
'resourcename' => $resourcename,
'recordsetid' => $recordsetid,
'details' => $diff
];
}
DB::insertBatch('auditlog', $auditlog);
}
}