Programmer Tasks

1. The programmer identifies the code points in the bank server program. Because each of the five operations (corresponding to an RPC interface) offered by the bank server is a security-relevant operation, the programmer deems that all these operations are security relevant, and assigns a codepoint to each operation. Each code point corresponds to an audit event.

acct_open() /* first code point */

acct_close() /* second code point */

acct_withdraw() /* third code point */

acct_deposit() /* fourth code point */

acct_transfer() /* fifth code point */

2. The programmer then assigns an event number to each audit event (corresponding to each code point). For example, the programmer defines these numbers in his header file as follows:

/* event number for the 1st code point, acct_open() */

#define evt_vn_bank_server_acct_open 0xC1000000

/* event number for the 2nd code point, acct_close() */

#define evt_vn_bank_server_acct_close 0xC1000001

/* event number for the 3rd code point, acct_withdraw() */

#define evt_vn_bank_server_acct_withdraw 0xC1000002

/* event number for the 4th code point, acct_deposit() */

#define evt_vn_bank_server_acct_deposit 0xC1000003

/* event number for the 5th code point, acct_transfer() */

#define evt_vn_bank_server_acct_transfer 0xC1000004

3. The programmer now starts adding audit API functions to the bank server program.

In the initialization part of the server, the application programmer uses the dce_aud_open( ) API to open an audit trail file for writing the audit records. This function uses the lowest-numbered event as one of its parameters; in this case, 0xC1000000 (evt_vn_bank_server_acct_open). Using the lowest-numbered event enhances the performance of the filter search.

/* open an audit trail file for writing */

dce_aud_open(aud_c_trl_open_write, description,

evt_vn_bank_server_acct_open,

5, &audit_trail, &status);

4. The programmer invokes the following DCE audit APIs at each code point:

· The dce_aud_start( ) API, to initialize an audit record. This function assigns the event number to the event represented by the code point. Thus, it uses the event number corresponding to that code point as one of its parameters.

· The dce_aud_put_ev_info( ) API, to add event-specific information to the audit record.

· The dce_aud_commit( ) API, to commit the audit record in the audit trail file.

The use of these three APIs is illustrated in the following example of the bank server program:

acct_open() /* first code point */

/* Uses the event number for acct_open(),

evt_vn_bank_server_acct_open */

dce_aud_start(evt_vn_bank_server_acct_open,

binding,options,outcome,&ard, &status);

/* If events need to be logged,

add trailer info (optional) */

if (ard)

dce_aud_put_ev_info(ard,info,&status);

/* If events need to be logged,

add header and trailer info */

if (ard)

dce_aud_commit(at,ard,options,format,&outcome,&status);

acct_close() /* second code point */

/* Uses the event number for acct_close(),

* evt_vn_bank_server_acct_close */

dce_aud_start(evt_vn_bank_server_acct_close,

binding,options,outcome,&ard, &status);

if (ard) /* If events need to be logged */

dce_aud_put_ev_info(ard,info,&status);

if (ard) /* If events need to be logged */

dce_aud_commit(at,ard,options,format,&outcome,&status);

5. The programmer uses the dce_aud_close( ) API in the termination routine of the application server. This API closes the audit trail file (and frees up memory) if the application server shuts down.

The coding of the application program to enable auditing is essentially complete at this point.