VAULT-17078: Implement Register and Deregister Audit Devices for EventLogger Framework (#21898)

* begin refactoring of event package into audit package

* audit options additions

* rename option structs

* Trying to remove 'audit' from the start of names.

* typo

* typo

* typo

* newEvent required params

* typo

* comments on noop sink

* more refactoring - merge json/jsonx formatters

* fix file backend and tests

* Moved unexported funcs to formatter, fixed file tests

* typos, comments, moved func

* fix corehelpers

* fix backends (syslog, socket)

* Moved some sinks back to generic event package.

* return of the file sink

* remove unneeded sink params/return vars

* Implement Register and Deregister Audit Devices for EventLogger Framework (#21940)

* add function to create StdoutSinkNode

* add boolean argument to audit Factory function

* create eventlogger nodes in backend factory functions

* simplify NewNoopSink function and remove DiscardSinkNode

* make the sanity test in the file backend mutually exclusive based on useEventLogger value

* remove test cases that no longer made sense and were failing

* NewFileSink attempts to open file for sanity check

* fix FileSink tests and update FileSink to remove discard, stdout but add /dev/null

* Moved WithPrefix from FileSink to EventFormatter

* move prefix in backend

* NewFormatterConfig and Options (tests fixed)

* Little tidy up

* add test where audit file is created with useEventLogger set to true

* only create eventlogger.Node instances when useEventLogger is true
fix failing test due to invalid string conversion of FileMode value

* moved variable definition to more appropriate scope

---------

Co-authored-by: Marc Boudreau <marc.boudreau@hashicorp.com>

builtin/audit/socket/backend.go

@@ -12,9 +12,11 @@ import (
 	"sync"
 	"time"
 
+	"github.com/hashicorp/eventlogger"
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/go-secure-stdlib/parseutil"
 	"github.com/hashicorp/vault/audit"
+	"github.com/hashicorp/vault/internal/observability/event"
 	"github.com/hashicorp/vault/sdk/helper/salt"
 	"github.com/hashicorp/vault/sdk/logical"
 )
@@ -48,10 +50,10 @@ func Factory(ctx context.Context, conf *audit.BackendConfig, useEventLogger bool
 
 	format, ok := conf.Config["format"]
 	if !ok {
-		format = "json"
+		format = audit.JSONFormat.String()
 	}
 	switch format {
-	case "json", "jsonx":
+	case audit.JSONFormat.String(), audit.JSONxFormat.String():
 	default:
 		return nil, fmt.Errorf("unknown format type %q", format)
 	}
@@ -112,9 +114,9 @@ func Factory(ctx context.Context, conf *audit.BackendConfig, useEventLogger bool
 	}
 	var w audit.Writer
 	switch format {
-	case "json":
+	case audit.JSONFormat.String():
 		w = &audit.JSONWriter{Prefix: conf.Config["prefix"]}
-	case "jsonx":
+	case audit.JSONxFormat.String():
 		w = &audit.JSONxWriter{Prefix: conf.Config["prefix"]}
 	}
 
@@ -125,6 +127,29 @@ func Factory(ctx context.Context, conf *audit.BackendConfig, useEventLogger bool
 
 	b.formatter = fw
 
+	if useEventLogger {
+		b.nodeIDList = make([]eventlogger.NodeID, 2)
+		b.nodeMap = make(map[eventlogger.NodeID]eventlogger.Node)
+
+		formatterNodeID, err := event.GenerateNodeID()
+		if err != nil {
+			return nil, fmt.Errorf("error generating random NodeID for formatter node: %w", err)
+		}
+		b.nodeIDList[0] = formatterNodeID
+		b.nodeMap[formatterNodeID] = f
+
+		sinkNode, err := event.NewSocketSink(format, address, event.WithSocketType(socketType), event.WithMaxDuration(writeDuration.String()))
+		if err != nil {
+			return nil, fmt.Errorf("error creating socket sink node: %w", err)
+		}
+		sinkNodeID, err := event.GenerateNodeID()
+		if err != nil {
+			return nil, fmt.Errorf("error generating random NodeID for sink node: %w", err)
+		}
+		b.nodeIDList[1] = sinkNodeID
+		b.nodeMap[sinkNodeID] = sinkNode
+	}
+
 	return b, nil
 }
 
@@ -145,6 +170,9 @@ type Backend struct {
 	salt       *salt.Salt
 	saltConfig *salt.Config
 	saltView   logical.Storage
+
+	nodeIDList []eventlogger.NodeID
+	nodeMap    map[eventlogger.NodeID]eventlogger.Node
 }
 
 var _ audit.Backend = (*Backend)(nil)
@@ -306,3 +334,21 @@ func (b *Backend) Invalidate(_ context.Context) {
 	defer b.saltMutex.Unlock()
 	b.salt = nil
 }
+
+// RegisterNodesAndPipeline registers the nodes and a pipeline as required by
+// the audit.Backend interface.
+func (b *Backend) RegisterNodesAndPipeline(broker *eventlogger.Broker, name string) error {
+	for id, node := range b.nodeMap {
+		if err := broker.RegisterNode(id, node); err != nil {
+			return err
+		}
+	}
+
+	pipeline := eventlogger.Pipeline{
+		PipelineID: eventlogger.PipelineID(name),
+		EventType:  eventlogger.EventType("audit"),
+		NodeIDs:    b.nodeIDList,
+	}
+
+	return broker.RegisterPipeline(pipeline)
+}