MM-22273 New auditing system (phase 1) (#13967)

* New auditing API outputting to syslog via TLS

* New config section for specifying remote syslog server IP, port, and cert.

* Legacy audit API retained for access history feature

app/audit.go

@@ -4,9 +4,27 @@
 package app
 
 import (
+	"fmt"
+
+	"github.com/mattermost/mattermost-server/v5/audit"
+	"github.com/mattermost/mattermost-server/v5/mlog"
 	"github.com/mattermost/mattermost-server/v5/model"
 )
 
+const (
+	RestLevelID        = 240
+	RestContentLevelID = 241
+	RestPermsLevelID   = 242
+	CLILevelID         = 243
+)
+
+var (
+	RestLevel        = audit.Level{ID: RestLevelID, Name: "audit-rest", Stacktrace: false}
+	RestContentLevel = audit.Level{ID: RestContentLevelID, Name: "audit-rest-content", Stacktrace: false}
+	RestPermsLevel   = audit.Level{ID: RestPermsLevelID, Name: "audit-rest-perms", Stacktrace: false}
+	CLILevel         = audit.Level{ID: CLILevelID, Name: "audit-cli", Stacktrace: false}
+)
+
 func (a *App) GetAudits(userId string, limit int) (model.Audits, *model.AppError) {
 	return a.Srv().Store.Audit().Get(userId, 0, limit)
 }
@@ -14,3 +32,51 @@ func (a *App) GetAudits(userId string, limit int) (model.Audits, *model.AppError
 func (a *App) GetAuditsPage(userId string, page int, perPage int) (model.Audits, *model.AppError) {
 	return a.Srv().Store.Audit().Get(userId, page*perPage, perPage)
 }
+
+func (s *Server) configureAudit(adt *audit.Audit) {
+	adt.OnQueueFull = s.onAuditTargetQueueFull
+	adt.OnError = s.onAuditError
+
+	// For now we only support sending audit records to Syslog via TLS.
+	// See https://www.rsyslog.com/doc/v8-stable/tutorials/tls_cert_summary.html
+	if *s.Config().ExperimentalAuditSettings.Enabled {
+		IP := *s.Config().ExperimentalAuditSettings.IP
+		if IP == "" {
+			IP = "localhost"
+		}
+		port := *s.Config().ExperimentalAuditSettings.Port
+		if port <= 0 {
+			port = 6514
+		}
+		raddr := fmt.Sprintf("%s:%d", IP, port)
+		maxQSize := *s.Config().ExperimentalAuditSettings.MaxQSize
+		if maxQSize <= 0 {
+			maxQSize = audit.DefMaxQueueSize
+		}
+
+		params := &audit.SyslogParams{
+			Raddr:    raddr,
+			Cert:     *s.Config().ExperimentalAuditSettings.Cert,
+			Tag:      *s.Config().ExperimentalAuditSettings.Tag,
+			Insecure: *s.Config().ExperimentalAuditSettings.Insecure,
+		}
+
+		filter := adt.MakeFilter(RestLevel, RestContentLevel, RestPermsLevel, CLILevel)
+		formatter := adt.MakeJSONFormatter()
+		target, err := audit.NewSyslogTLSTarget(filter, formatter, params, maxQSize)
+		if err != nil {
+			mlog.Error("cannot configure SysLogTLS audit target", mlog.Err(err))
+			return
+		}
+		mlog.Debug("SysLogTLS audit target connected successfully", mlog.String("raddy", raddr))
+		adt.AddTarget(target)
+	}
+}
+
+func (s *Server) onAuditTargetQueueFull(qname string, maxQSize int) {
+	mlog.Warn("Audit Queue Full", mlog.String("qname", qname), mlog.Int("maxQSize", maxQSize))
+}
+
+func (s *Server) onAuditError(err error) {
+	mlog.Error("Audit Error", mlog.Err(err))
+}

app/server.go

@@ -24,6 +24,7 @@ import (
 	"github.com/throttled/throttled"
 	"golang.org/x/crypto/acme/autocert"
 
+	"github.com/mattermost/mattermost-server/v5/audit"
 	"github.com/mattermost/mattermost-server/v5/config"
 	"github.com/mattermost/mattermost-server/v5/einterfaces"
 	"github.com/mattermost/mattermost-server/v5/jobs"
@@ -117,6 +118,7 @@ type Server struct {
 
 	ImageProxy *imageproxy.ImageProxy
 
+	Audit            *audit.Audit
 	Log              *mlog.Logger
 	NotificationsLog *mlog.Logger
 
@@ -278,6 +280,12 @@ func NewServer(options ...Option) (*Server, error) {
 
 	s.ReloadConfig()
 
+	if s.Audit == nil {
+		s.Audit = &audit.Audit{}
+		s.Audit.Init(audit.DefMaxQueueSize)
+		s.configureAudit(s.Audit)
+	}
+
 	// Enable developer settings if this is a "dev" build
 	if model.BuildNumber == "dev" {
 		s.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.EnableDeveloper = true })
@@ -406,6 +414,8 @@ func (s *Server) Shutdown() error {
 	s.RemoveConfigListener(s.configListenerId)
 	s.RemoveConfigListener(s.logListenerId)
 
+	s.Audit.Shutdown()
+
 	s.configStore.Close()
 
 	if s.Cluster != nil {