Class DefaultAgentAuditPolicy

java.lang.Object
org.snmp4j.agent.audit.DefaultAgentAuditPolicy
All Implemented Interfaces:
Serializable, EventListener, AgentAuditPolicy, FileAuditListener, MOServerLookupListener, org.snmp4j.transport.TransportAuditListener
public class DefaultAgentAuditPolicy extends Object implements AgentAuditPolicy, Serializable
The default AgentAuditPolicy implementation for SNMP4J-Agent. It enforces the access restrictions defined by an AgentPolicyProfile and audits (logs) the relevant transport, file and managed object access events according to the configured AgentAuditLevel: Managed object access (lookupEvent(MOServerLookupEvent) and queryEvent(MOServerLookupEvent)) cannot be denied through these (void) listener callbacks - the actual enforcement of managed object access is performed by the View-based Access Control Model (VACM). This policy therefore audits managed object access and logs policy violations (as warnings on WARN and RESTRICT level) so that misconfigurations and VACM gaps become visible.

Audit records are written through a LogAdapter obtained from LogFactory. In addition, an optional OutputStream (backed for example by a file, System.out or System.err) can be supplied to receive a copy of every audit record independent of the logging configuration.

Since:
3.12.0
Version:
3.12.0
Author:
Frank Fock
See Also:

  • Field Details

  • Constructor Details

    • DefaultAgentAuditPolicy

      public DefaultAgentAuditPolicy(AgentPolicyProfile agentPolicyProfile, AgentAuditLevel auditLevel)
      Creates a DefaultAgentAuditPolicy that logs audit records through the LogFactory logging only.
      Parameters:
      agentPolicyProfile - the policy profile that defines the access restrictions to enforce, or null to permit all operations (audit only).
      auditLevel - the audit level to apply, or null which is interpreted as AgentAuditLevel.OFF.

    • DefaultAgentAuditPolicy

      public DefaultAgentAuditPolicy(AgentPolicyProfile agentPolicyProfile, AgentAuditLevel auditLevel, OutputStream auditOutputStream)
      Creates a DefaultAgentAuditPolicy that logs audit records through the LogFactory logging and, in addition, writes a copy of every audit record to the supplied OutputStream.
      Parameters:
      agentPolicyProfile - the policy profile that defines the access restrictions to enforce, or null to permit all operations (audit only).
      auditLevel - the audit level to apply, or null which is interpreted as AgentAuditLevel.OFF.
      auditOutputStream - an optional output stream that receives a copy of every audit record (for example a FileOutputStream, System.out or System.err), or null for logging through LogFactory only.

  • Method Details

    • getAuditLevel

      public AgentAuditLevel getAuditLevel()
      Description copied from interface: AgentAuditPolicy
      Retrieves the current audit level for the agent. The audit level specifies the behavior of the agent in logging and enforcing access to managed objects and transport operations.
      Specified by:
      getAuditLevel in interface AgentAuditPolicy
      Returns:
      the current audit level, which can be one of the following: OFF, LOG, WARN, or RESTRICT.

    • getAgentPolicyProfile

      public AgentPolicyProfile getAgentPolicyProfile()
      Gets the policy profile that defines the access restrictions enforced by this policy.
      Returns:
      the AgentPolicyProfile or null if all operations are permitted (audit only).

    • setAuditOutputStream

      public final void setAuditOutputStream(OutputStream auditOutputStream)
      Sets (or clears) the optional output stream that receives a copy of every audit record. This can be used to write the audit trail to a dedicated file or to System.out/System.err in clear text, independent of the LogFactory logging configuration.
      Parameters:
      auditOutputStream - the output stream to use, or null to disable audit stream output.

    • fileAudit

      public boolean fileAudit(FileAuditEvent event)
      Description copied from interface: FileAuditListener
      Audits a file system operation described by the provided FileAuditEvent and decides whether the operation is permitted.
      Specified by:
      fileAudit in interface FileAuditListener
      Parameters:
      event - the FileAuditEvent describing the file operation to be audited.
      Returns:
      true if the operation is permitted, false to deny (prevent) it. The return value is ignored for FileAuditEvent.FileOperation.DELETE events that report an already executed deletion.

    • transportAudit

      public boolean transportAudit(org.snmp4j.transport.TransportAuditEvent event)
      Specified by:
      transportAudit in interface org.snmp4j.transport.TransportAuditListener

    • lookupEvent

      public void lookupEvent(MOServerLookupEvent event)
      Description copied from interface: MOServerLookupListener
      A MOServer instance has looked up a managed object for which the listener has been registered.
      Specified by:
      lookupEvent in interface MOServerLookupListener
      Parameters:
      event - a MOServerLookupEvent describing the lookup query and the managed object that has been looked up.

    • queryEvent

      public void queryEvent(MOServerLookupEvent event)
      Description copied from interface: MOServerLookupListener
      A MOServer instance is about to check if the managed object for which the listener had been registered matches a query. A managed object with dynamic content like a non-static table might use this event to update its content.
      Specified by:
      queryEvent in interface MOServerLookupListener
      Parameters:
      event - a MOServerLookupEvent describing the lookup query and the managed object that is to be queried.

    • isTransportOperationAllowed

      protected boolean isTransportOperationAllowed(org.snmp4j.transport.TransportAuditEvent event)
      Evaluates whether the supplied transport operation is permitted by the AgentPolicyProfile.
      Parameters:
      event - the transport audit event to evaluate.
      Returns:
      true if the operation is permitted by the policy profile, false otherwise.

    • isFileOperationAllowed

      protected boolean isFileOperationAllowed(FileAuditEvent event)
      Evaluates whether the supplied file operation is permitted by the AgentPolicyProfile.
      Parameters:
      event - the file audit event to evaluate.
      Returns:
      true if the operation is permitted by the policy profile, false otherwise.

    • isManagedObjectAccessAllowed

      protected boolean isManagedObjectAccessAllowed(MOServerLookupEvent event)
      Evaluates whether the managed object access described by the supplied lookup event conforms to the AgentPolicyProfile. The result is used for auditing only (logging), since managed object access is enforced by VACM.
      Parameters:
      event - the managed object server lookup event to evaluate.
      Returns:
      true if the access conforms to the policy profile, false otherwise.

    • logDecision

      protected boolean logDecision(boolean permittedByPolicy, boolean enforceable, String category, Object eventDescription)
      Logs the outcome of a policy decision according to the configured AgentAuditLevel and returns whether the audited operation is permitted.
      Parameters:
      permittedByPolicy - true if the operation conforms to the policy profile.
      enforceable - true if the calling listener method can actually deny the operation (transport and file audits), false for observational audits (managed object lookups).
      category - a short category label for the audit record (e.g. "TRANSPORT").
      eventDescription - the audited event (its toString() is included in the audit record).
      Returns:
      true if the operation is permitted (always true unless the level is AgentAuditLevel.RESTRICT, the operation violates the policy and is enforceable).