Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: decodes audit log extended data #350

Merged
merged 2 commits into from
Jun 11, 2024
Merged

feat: decodes audit log extended data #350

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
deed5de
feat: decodes audit log extended data
matt-primrose Jun 10, 2024
18c3c1d
Merge branch 'main' into auditlog-extended-data
madhavilosetty-intel Jun 11, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
130 changes: 71 additions & 59 deletions pkg/wsman/amt/auditlog/decoder.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ package auditlog

import (
"encoding/base64"
"strconv"
"strings"
"time"

Expand Down Expand Up @@ -186,7 +187,7 @@ func convertToAuditLogResult(auditlogdata []string) []AuditLogRecord {
exlen := []byte(decodedEventRecordStr[ptr : ptr+1])[0]
ptr++
auditLogRecord.Ex = decodedEventRecordStr[ptr : ptr+int(exlen)]
// auditLogRecord.ExStr = GetAuditLogExtendedDataString((auditLogRecord.AuditAppID*100)+auditLogRecord.EventID, auditLogRecord.Ex)
auditLogRecord.ExStr = GetAuditLogExtendedDataString((auditLogRecord.AuditAppID*100)+auditLogRecord.EventID, auditLogRecord.Ex)

records = append([]AuditLogRecord{auditLogRecord}, records...)
}
Expand All @@ -209,67 +210,78 @@ const (
SendConsentCode = 3001
)

var RealmNames = []string{
"Redirection",
"PT Administration",
"Hardware Asset",
"Remote Control",
"Storage",
"Event Manager",
"Storage Admin",
"Agent Presence Local",
"Agent Presence Remote",
"Circuit Breaker",
"Network Time",
"General Information",
"Firmware Update",
"EIT",
"LocalUN",
"Endpoint Access Control",
"Endpoint Access Control Admin",
"Event Log Reader",
"Audit Log",
"ACL Realm",
"",
"",
"Local System",
// Add more as needed
}

// Return human readable extended audit log data
// TODO: Just put some of them here, but many more still need to be added, helpful link here:
// https://software.intel.com/sites/manageability/AMT_Implementation_and_Reference_Guide/default.htm?turl=WordDocuments%2Fsecurityadminevents.htm
// func GetAuditLogExtendedDataString(auditEventId int, data string) string {
// extendedDataString := ""

// switch auditEventId {
// case AclEntryAdded:
// case AclEntryRemoved:
// if data[0:1] == "0" {
// indx, _ := strconv.Atoi(data[0:1])
// extendedDataString = data[2 : 2+indx]
// }
// break
// case AclEntryModified:
// if data[1:2] == "0" {
// extendedDataString = data[3:4]
// }
// break
// case AclAccessWithInvalidCredentials:
// extendedDataString = "" //['Invalid ME access', 'Invalid MEBx access'][data[:0]]
// break
// case AclEntryStateChanged:
// {
// // r := ['Disabled', 'Enabled'][data[:0]]
// // if (data[:1] === 0) {
// // r += ', ' + data.substring(3)
// // }
// extendedDataString = r
// break
// }
// case TlsStateChanged:
// //extendedDataString = 'Remote ' + ['NoAuth', 'ServerAuth', 'MutualAuth'][data[:0]] + ', Local ' + ['NoAuth', 'ServerAuth', 'MutualAuth'][data[:1]]
// break
// case SetRealmAuthenticationMode:
// //extendedDataString = RealmNames[Common.ReadInt(data, 0)] + ', ' + ['NoAuth', 'Auth', 'Disabled'][data[:4]]
// break
// case AmtUnprovisioningStarted:
// //extendedDataString = ['BIOS', 'MEBx', 'Local MEI', 'Local WSMAN', 'Remote WSMAN'][data[:0]]
// break
// case FirmwareUpdate:
// //extendedDataString = 'From ' + Common.ReadShort(data, 0) + '.' + Common.ReadShort(data, 2) + '.' + Common.ReadShort(data, 4) + '.' + Common.ReadShort(data, 6) + ' to ' + Common.ReadShort(data, 8) + '.' + Common.ReadShort(data, 10) + '.' + Common.ReadShort(data, 12) + '.' + Common.ReadShort(data, 14)
// break
// case AmtTimeSet:
// {
// // const t4 = new Date()
// // t4.setTime(Common.ReadInt(data, 0) * 1000 + (new Date().getTimezoneOffset() * 60000))
// // extendedDataString = t4.toLocaleString()
// break
// }
// case OptInPolicyChange:
// //extendedDataString = 'From ' + ['None', 'KVM', 'All'][data[:0]] + ' to ' + ['None', 'KVM', 'All'][data[:1]]
// break
// case SendConsentCode:
// //extendedDataString = ['Success', 'Failed 3 times'][data[:0]]
// break
// default:
// extendedDataString = null
// }
// return extendedDataString
// }
func GetAuditLogExtendedDataString(auditEventId int, data string) string {
var extendedDataString string

switch auditEventId {
case ACLEntryAdded, ACLEntryRemoved:
if data[0] == 0 {
extendedDataString = data[2 : 2+data[1]]
}
case ACLEntryModified:
if data[1] == 0 {
extendedDataString = data[2:]
}
case ACLAccessWithInvalidCredentials:
extendedDataString = []string{"Invalid ME access", "Invalid MEBx access"}[data[0]]
case ACLEntryStateChanged:
r := []string{"Disabled", "Enabled"}[data[0]]
if data[1] == 0 {
r += ", " + data[2:]
}

extendedDataString = r
case TLSStateChanged:
extendedDataString = "Remote " + []string{"NoAuth", "ServerAuth", "MutualAuth"}[data[0]] + ", Local " + []string{"NoAuth", "ServerAuth", "MutualAuth"}[data[1]]
case SetRealmAuthenticationMode:
extendedDataString = RealmNames[common.ReadInt(data, 0)] + ", " + []string{"NoAuth", "Auth", "Disabled"}[data[4]]
case AMTUnprovisioningStarted:
extendedDataString = []string{"BIOS", "MEBx", "Local MEI", "Local WSMAN", "Remote WSMAN"}[data[0]]
case FirmwareUpdate:
extendedDataString = "From " + strconv.Itoa(common.ReadShort(data, 0)) + "." + strconv.Itoa(common.ReadShort(data, 2)) + "." + strconv.Itoa(common.ReadShort(data, 4)) + "." + strconv.Itoa(common.ReadShort(data, 6)) + " to " + strconv.Itoa(common.ReadShort(data, 8)) + "." + strconv.Itoa(common.ReadShort(data, 10)) + "." + strconv.Itoa(common.ReadShort(data, 12)) + "." + strconv.Itoa(common.ReadShort(data, 14))
case AMTTimeSet:
t := time.Unix(int64(common.ReadInt(data, 0)), 0).Local()
extendedDataString = t.Format(time.RFC1123)
case OptInPolicyChange:
extendedDataString = "From " + []string{"None", "KVM", "All"}[data[0]] + " to " + []string{"None", "KVM", "All"}[data[1]]
case SendConsentCode:
extendedDataString = []string{"Success", "Failed 3 times"}[data[0]]
default:
extendedDataString = ""
}

return extendedDataString
}

const (
HTTPDigest byte = 0
Expand Down
38 changes: 37 additions & 1 deletion pkg/wsman/amt/auditlog/decoder_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,10 @@

package auditlog

import "testing"
import (
"testing"
"time"
)

func TestOverwritePolicy_String(t *testing.T) {
tests := []struct {
Expand Down Expand Up @@ -100,3 +103,36 @@ func TestRequestedState_String(t *testing.T) {
}
}
}

func TestGetAuditLogExtendedDataString(t *testing.T) {
tests := []struct {
name string
auditEventId int
data string
expected string
}{
{"ACLEntryAdded", ACLEntryAdded, "\x00\x05Hello World", "Hello"},
{"ACLEntryRemoved", ACLEntryRemoved, "\x00\x05Hello World", "Hello"},
{"ACLEntryModified", ACLEntryModified, "\x01\x00Hello World", "Hello World"},
{"ACLAccessWithInvalidCredentials", ACLAccessWithInvalidCredentials, "\x00", "Invalid ME access"},
{"ACLAccessWithInvalidCredentials", ACLAccessWithInvalidCredentials, "\x01", "Invalid MEBx access"},
{"ACLEntryStateChanged", ACLEntryStateChanged, "\x00\x00Hello World", "Disabled, Hello World"},
{"ACLEntryStateChanged", ACLEntryStateChanged, "\x01\x01", "Enabled"},
{"TLSStateChanged", TLSStateChanged, "\x01\x02", "Remote ServerAuth, Local MutualAuth"},
{"SetRealmAuthenticationMode", SetRealmAuthenticationMode, "\x00\x00\x00\x00\x02", "Redirection, Disabled"},
{"AMTUnprovisioningStarted", AMTUnprovisioningStarted, "\x03", "Local WSMAN"},
{"FirmwareUpdate", FirmwareUpdate, "\x00\x01\x00\x02\x00\x03\x00\x04\x00\x05\x00\x06\x00\x07\x00\x08", "From 1.2.3.4 to 5.6.7.8"},
{"AMTTimeSet", AMTTimeSet, "\x00\x00\x00\x00", time.Unix(0, 0).Local().Format(time.RFC1123)},
{"OptInPolicyChange", OptInPolicyChange, "\x00\x01", "From None to KVM"},
{"SendConsentCode", SendConsentCode, "\x00", "Success"},
}

for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
result := GetAuditLogExtendedDataString(tt.auditEventId, tt.data)
if result != tt.expected {
t.Errorf("GetAuditLogExtendedDataString(%d, %q) = %v; want %v", tt.auditEventId, tt.data, result, tt.expected)
}
})
}
}
4 changes: 2 additions & 2 deletions pkg/wsman/amt/auditlog/message_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -176,7 +176,7 @@ func TestPositiveAMT_AuditLog(t *testing.T) {
MCLocationType: 0x2,
NetAddress: "",
Ex: "\x00\f\x00\x00\x00(\x05\x99\x00\f\x00\x00\x00$\x05\x94",
ExStr: "",
ExStr: "From 12.0.40.1433 to 12.0.36.1428",
},
{
AuditAppID: 19,
Expand All @@ -189,7 +189,7 @@ func TestPositiveAMT_AuditLog(t *testing.T) {
MCLocationType: 0x2,
NetAddress: "",
Ex: "\x00\f\x00\x00\x00(\x05\x99\x00\f\x00\x00\x00$\x05\x94",
ExStr: "",
ExStr: "From 12.0.40.1433 to 12.0.36.1428",
},
},
},
Expand Down
Loading