source: branches/samhain-2_2-branch/src/sh_readconf.c@ 202

Last change on this file since 202 was 27, checked in by rainer, 19 years ago

Support for server-to-server relay and more user policies
File size: 34.9 KB
Line 
1/* SAMHAIN file system integrity testing */
2/* Copyright (C) 1999, 2000 Rainer Wichmann */
3/* */
4/* This program is free software; you can redistribute it */
5/* and/or modify */
6/* it under the terms of the GNU General Public License as */
7/* published by */
8/* the Free Software Foundation; either version 2 of the License, or */
9/* (at your option) any later version. */
10/* */
11/* This program is distributed in the hope that it will be useful, */
12/* but WITHOUT ANY WARRANTY; without even the implied warranty of */
13/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
14/* GNU General Public License for more details. */
15/* */
16/* You should have received a copy of the GNU General Public License */
17/* along with this program; if not, write to the Free Software */
18/* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
19
20#include "config_xor.h"
21
22
23#include <stdlib.h>
24#include <stdio.h>
25#include <string.h>
26#include <ctype.h>
27
28
29#include "samhain.h"
30#include "sh_error.h"
31#include "sh_database.h"
32#include "sh_unix.h"
33#include "sh_utils.h"
34#include "sh_files.h"
35#include "sh_mail.h"
36#include "sh_calls.h"
37#include "sh_tiger.h"
38#include "sh_forward.h"
39#include "sh_modules.h"
40#include "sh_gpg.h"
41#include "sh_hash.h"
42#include "sh_ignore.h"
43#include "sh_prelink.h"
44#include "sh_extern.h"
45
46#ifdef WITH_DATABASE
47#include "sh_database.h"
48#endif
49
50#ifdef HAVE_LIBPRELUDE_9
51#include "sh_prelude.h"
52#endif
53
54extern int set_reverse_lookup (const char * c);
55
56#undef FIL__
57#define FIL__ _("sh_readconf.c")
58
59typedef enum {
60 SH_SECTION_NONE,
61 SH_SECTION_LOG,
62 SH_SECTION_MISC,
63 SH_SECTION_ATTRIBUTES,
64 SH_SECTION_READONLY,
65 SH_SECTION_LOGFILES,
66 SH_SECTION_LOGGROW,
67 SH_SECTION_NOIGNORE,
68 SH_SECTION_ALLIGNORE,
69 SH_SECTION_USER0,
70 SH_SECTION_USER1,
71 SH_SECTION_USER2,
72 SH_SECTION_USER3,
73 SH_SECTION_USER4,
74 SH_SECTION_PRELINK,
75#if defined (SH_WITH_MAIL)
76 SH_SECTION_MAIL,
77#endif
78#if defined (SH_WITH_CLIENT)
79 SH_SECTION_CLT,
80#endif
81#ifdef WITH_EXTERNAL
82 SH_SECTION_EXTERNAL,
83#endif
84#ifdef WITH_DATABASE
85 SH_SECTION_DATABASE,
86#endif
87#if defined (SH_WITH_CLIENT) || defined (SH_STANDALONE)
88 SH_SECTION_OTHER,
89#endif
90#ifdef SH_WITH_SERVER
91 SH_SECTION_CLIENTS,
92 SH_SECTION_SRV,
93#endif
94 SH_SECTION_THRESHOLD
95} ShSectionType;
96
97typedef struct str_ListSections {
98 char * name;
99 int type;
100} sh_str_ListSections;
101
102struct str_ListSections tab_ListSections[] = {
103 { N_("[Log]"), SH_SECTION_LOG},
104 { N_("[Misc]"), SH_SECTION_MISC},
105 { N_("[Attributes]"), SH_SECTION_ATTRIBUTES},
106 { N_("[ReadOnly]"), SH_SECTION_READONLY},
107 { N_("[LogFiles]"), SH_SECTION_LOGFILES},
108 { N_("[GrowingLogFiles]"), SH_SECTION_LOGGROW},
109 { N_("[IgnoreAll]"), SH_SECTION_ALLIGNORE},
110 { N_("[IgnoreNone]"), SH_SECTION_NOIGNORE},
111 { N_("[User0]"), SH_SECTION_USER0},
112 { N_("[User1]"), SH_SECTION_USER1},
113 { N_("[User2]"), SH_SECTION_USER2},
114 { N_("[User3]"), SH_SECTION_USER3},
115 { N_("[User4]"), SH_SECTION_USER4},
116 { N_("[Prelink]"), SH_SECTION_PRELINK},
117#ifdef WITH_EXTERNAL
118 { N_("[External]"), SH_SECTION_EXTERNAL},
119#endif
120#ifdef WITH_DATABASE
121 { N_("[Database]"), SH_SECTION_DATABASE},
122#endif
123 { N_("[EventSeverity]"), SH_SECTION_THRESHOLD},
124#ifdef SH_WITH_SERVER
125 { N_("[Clients]"), SH_SECTION_CLIENTS},
126 { N_("[Server]"), SH_SECTION_SRV},
127#endif
128#if defined (SH_WITH_CLIENT)
129 { N_("[Client]"), SH_SECTION_CLT},
130#endif
131#if defined (SH_WITH_MAIL)
132 { N_("[Mail]"), SH_SECTION_MAIL},
133#endif
134 { NULL, SH_SECTION_NONE}
135};
136
137
138static int sh_readconfig_line (char * line);
139
140static ShSectionType read_mode = SH_SECTION_NONE;
141
142static int conf_line = 0;
143
144/* --- Read the configuration file. ---
145 */
146int sh_readconf_read (void)
147{
148#if defined (SH_WITH_CLIENT) || defined (SH_STANDALONE)
149 /* This is for modules.
150 */
151 int modnum;
152#endif
153
154 int i;
155
156 SL_TICKET fd = -1;
157#if defined(SH_STEALTH) && !defined(SH_STEALTH_MICRO)
158 SL_TICKET fdTmp = -1;
159 SL_TICKET open_tmp (void);
160#endif
161 char * tmp;
162 char * lptr;
163
164 char line_in[512+2];
165 char * line;
166 int line_int;
167
168 char myident[3*SH_MINIBUF+3];
169
170 /* This is for nested conditionals.
171 */
172 int some_other_host[16] = { 0 };
173 int some_other_system[16] = { 0 };
174 int seen_host = 0;
175 int seen_system = 0;
176 int host_int = 0;
177 int sys_int = 0;
178
179 int invert = 0;
180 int length = sl_strlen(sh.host.name);
181
182 int local_file = 1;
183 char local_flag = 'R';
184
185#if defined(WITH_GPG) || defined(WITH_PGP)
186 int signed_content = S_FALSE;
187 int true_content = S_FALSE;
188#endif
189#if defined(SH_STEALTH) && !defined(SH_STEALTH_MICRO)
190 int hidden_count = 0;
191#endif
192 uid_t euid;
193
194 SL_ENTER(_("sh_readconf_read"));
195
196 /* --- Open config file, exit on failure. ---
197 */
198#if defined(SH_WITH_CLIENT)
199 if (0 == sl_strcmp(file_path('C', 'R'), _("REQ_FROM_SERVER")))
200 {
201 sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_D_START);
202
203 fd = sh_forward_req_file(_("CONF"));
204
205 if (!SL_ISERROR(fd))
206 local_file = 0;
207 else if (sh.flag.checkSum != SH_CHECK_INIT)
208 aud_exit (FIL__, __LINE__, EXIT_FAILURE);
209 else
210 {
211 sh_error_handle ((-1), FIL__, __LINE__, fd, MSG_D_FAIL);
212 local_file = 1;
213 local_flag = 'I';
214 }
215 }
216#endif
217
218 /* Use a local configuration file.
219 */
220 if (local_file == 1)
221 {
222 if (0 != tf_trust_check (file_path('C', local_flag), SL_YESPRIV))
223 {
224 sl_get_euid(&euid);
225 dlog(1, FIL__, __LINE__,
226 _("The configuration file: %s is untrusted, i.e. an\nuntrusted user owns or can write to some directory in the path.\n"),
227 ( (NULL == file_path('C', local_flag))
228 ? _("(null)") : file_path('C', local_flag) ));
229 sh_error_handle ((-1), FIL__, __LINE__, EACCES, MSG_TRUST,
230 (long) euid,
231 ( (NULL == file_path('C', local_flag))
232 ? _("(null)") : file_path('C', local_flag) )
233 );
234 aud_exit (FIL__, __LINE__, EXIT_FAILURE);
235 }
236 if (SL_ISERROR(fd = sl_open_read(file_path('C',local_flag),SL_YESPRIV)))
237 {
238 sl_get_euid(&euid);
239 dlog(1, FIL__, __LINE__,
240 _("Could not open the local configuration file for reading because\nof the following error: %s (errnum = %ld)\nIf this is a permission problem, you need to change file permissions\nto make the file readable for the effective UID: %d\n"),
241 sl_get_errmsg(), fd, (int) euid);
242 sh_error_handle ((-1), FIL__, __LINE__, fd, MSG_NOACCESS,
243 (long) euid,
244 ( (NULL == file_path('C', local_flag))
245 ? _("(null)") : file_path('C', local_flag) )
246 );
247 aud_exit (FIL__, __LINE__, EXIT_FAILURE);
248 }
249 }
250
251 /* Compute the checksum of the open file.
252 */
253 tiger_fd = fd;
254 sl_strlcpy(sh.conf.hash,
255 sh_tiger_hash(file_path('C',local_flag),TIGER_FD, 0),
256 KEY_LEN+1);
257 sl_rewind (fd);
258
259#if defined(SH_STEALTH) && !defined(SH_STEALTH_MICRO)
260 /* extract the data and copy to temporary file
261 */
262 fdTmp = open_tmp();
263 while ( sh_unix_getline_stealth (fd, line_in, 512) > 0) {
264 hidden_count++;
265 if (line_in[0] == '\n')
266 {
267 sl_write(fdTmp, line_in, 1);
268 }
269 else
270 {
271 sl_write_line(fdTmp, line_in, sl_strlen(line_in));
272 }
273#if defined(WITH_GPG) || defined(WITH_PGP)
274 if (0 == sl_strncmp(line_in, _("-----END PGP SIGNATURE-----"), 25))
275 break;
276#else
277 if (0 == sl_strncmp(line_in, _("[EOF]"), 5))
278 break;
279#endif
280 if (hidden_count > 4096) /* arbitrary safeguard */
281 break;
282 }
283 sl_close(fd);
284 fd = fdTmp;
285 sl_rewind (fd);
286#endif
287
288 /* The system type, release, and machine.
289 */
290 sl_snprintf(myident, sizeof(myident), _("%s:%s:%s"),
291 sh.host.system, /* flawfinder: ignore */
292 sh.host.release, sh.host.machine);
293
294
295 /* --- Start reading lines. ---
296 */
297 conf_line = 0;
298
299 while ( sh_unix_getline (fd, line_in, 512) > 0) {
300
301 ++conf_line;
302
303 line = &(line_in[0]);
304
305 /* fprintf(stderr, "<%s>\n", line); */
306
307 /* Sun May 27 18:40:05 CEST 2001
308 */
309#if defined(WITH_GPG) || defined(WITH_PGP)
310 if (signed_content == S_FALSE)
311 {
312 if (0 == sl_strcmp(line, _("-----BEGIN PGP SIGNED MESSAGE-----")))
313 signed_content = S_TRUE;
314 else
315 continue;
316 }
317 else if (true_content == S_FALSE)
318 {
319 if (line[0] == '\n')
320 true_content = S_TRUE;
321 else
322 continue;
323 }
324 else if (signed_content == S_TRUE)
325 {
326 if (0 == sl_strcmp(line, _("-----BEGIN PGP SIGNATURE-----")))
327 break;
328 else if (0 == sl_strcmp(line, _("-----BEGIN PGP SIGNED MESSAGE-----")))
329 {
330 sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
331 _("second signed message in file"),
332 _("sh_readconf_read"));
333 dlog(1, FIL__, __LINE__,
334 _("There seems to be more than one signed message in the configuration\nfile. Please make sure there is only one signed message.\n"));
335 sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_EXIT_ABORT1,
336 sh.prg_name);
337 aud_exit (FIL__, __LINE__,EXIT_FAILURE);
338 }
339 }
340#endif
341
342 /* Skip leading white space.
343 */
344 while (*line)
345 {
346 line_int = *line;
347 if (!isspace(line_int))
348 break;
349 ++line;
350 }
351
352 /* Skip header etc.
353 */
354 if (line[0] == '#' || line[0] == '\0' || line[0] == ';' ||
355 (line[0] == '/' && line[1] == '/'))
356 continue;
357
358 /* Clip off trailing white space.
359 */
360 tmp = line + sl_strlen( line ); --tmp;
361 while( isspace((int) *tmp ) && tmp >= line ) *tmp-- = '\0';
362
363
364 /* ------- starts a section ------------ */
365
366 if (line[0] == '[' &&
367 some_other_host[seen_host] == 0 &&
368 some_other_system[seen_system] == 0)
369 {
370 read_mode = SH_SECTION_NONE;
371
372 if (sl_strncmp (line, _("[EOF]"),
373 5) == 0)
374 {
375 goto nopel;
376 }
377
378 i = 0;
379
380 while (tab_ListSections[i].name != 0)
381 {
382 if (sl_strncmp (line, _(tab_ListSections[i].name),
383 sl_strlen(tab_ListSections[i].name)) == 0)
384 {
385 read_mode = tab_ListSections[i].type;
386 break;
387 }
388 ++i;
389 }
390
391#if defined (SH_WITH_CLIENT) || defined (SH_STANDALONE)
392 if (read_mode == SH_SECTION_NONE)
393 {
394 for (modnum = 0; modList[modnum].name != NULL; ++modnum)
395 {
396 if (0 == sl_strncmp (line, _(modList[modnum].conf_section),
397 sl_strlen(modList[modnum].conf_section)) )
398 read_mode = SH_SECTION_OTHER;
399 }
400 }
401#endif
402 if (read_mode == SH_SECTION_NONE)
403 {
404 sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_EINVALHEAD,
405 (long) conf_line);
406 }
407 }
408
409 /* --- an @host directive -------------- */
410
411 else if (line[0] == '@' || (line[0] == '!' && line[1] == '@'))
412 {
413 if (line[0] == '!')
414 {
415 lptr = &line[2];
416 invert = 1;
417 }
418 else
419 {
420 lptr = &line[1];
421 invert = 0;
422 }
423
424 if (sl_strncmp (lptr, _("end"), 3) == 0)
425 {
426 if (0 == seen_host)
427 sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_EINVALD,
428 _("config file"),
429 (long) conf_line);
430
431 else if (host_int == 0)
432 {
433 /* end of an @host directive
434 */
435 some_other_host[seen_host] = 0;
436 --seen_host;
437 seen_host = (seen_host < 0) ? 0 : seen_host;
438 }
439
440 else
441 {
442 --host_int;
443 host_int = (host_int < 0) ? 0 : host_int;
444 }
445 }
446 else if (some_other_host[seen_host] == 0 &&
447 some_other_system[seen_system] == 0 &&
448 seen_host < 15)
449 {
450 if (sl_strncmp (lptr, sh.host.name, length) == 0
451#ifdef HAVE_REGEX_H
452 || sh_util_regcmp (lptr, sh.host.name) == 0
453#endif
454 )
455 {
456 /* if match and '@', set some_other_host = 0;
457 * if match and '!@', set some_other_host = 1;
458 */
459 ++seen_host;
460 some_other_host[seen_host] = invert;
461 }
462 else
463 {
464 /* if no match and '@', set some_other_host = 1;
465 * if no match and '!@', set some_other_host = 0;
466 */
467 ++seen_host;
468 some_other_host[seen_host] = (invert == 0) ? 1 : 0;
469 }
470 }
471 else
472 ++host_int;
473 }
474
475 /* --- an %schedule directive ------------ */
476
477 else if (line[0] == '%' || (line[0] == '!' && line[1] == '%'))
478 {
479#if defined (SH_WITH_CLIENT) || defined (SH_STANDALONE)
480 if (line[0] == '!' && 0 == sl_strcmp(&(line[2]), _("SCHEDULE_TWO")))
481 set_dirList(1);
482 else if (0 == sl_strcmp(&(line[1]), _("SCHEDULE_TWO")))
483 set_dirList(2);
484#else
485 ;
486#endif
487 }
488
489 /* --- an $system directive -------------- */
490
491 else if (line[0] == '$' || (line[0] == '!' && line[1] == '$'))
492 {
493 if (line[0] == '!')
494 {
495 lptr = &line[2];
496 invert = 1;
497 }
498 else
499 {
500 lptr = &line[1];
501 invert = 0;
502 }
503
504 if (sl_strncmp (lptr, _("end"), 3) == 0)
505 {
506 if (0 == seen_system)
507 sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_EINVALD,
508 _("config file"),
509 (long) conf_line);
510
511 else if (sys_int == 0)
512 {
513 /* end of an $system directive
514 */
515 some_other_system[seen_system] = 0;
516 --seen_system;
517 seen_system = (seen_system < 0) ? 0 : seen_system;
518 }
519 else
520 {
521 --sys_int;
522 sys_int = (sys_int < 0) ? 0 : sys_int;
523 }
524 }
525 else if (some_other_host[seen_host] == 0 &&
526 some_other_system[seen_system] == 0 &&
527 seen_system < 15)
528 {
529 if (sl_strncmp (lptr, myident, sl_strlen(myident)) == 0
530#ifdef HAVE_REGEX_H
531 || sh_util_regcmp (lptr, myident) == 0
532#endif
533 )
534 {
535 ++seen_system;
536 some_other_system[seen_system] = invert;
537 }
538 else
539 {
540 ++seen_system;
541 some_other_system[seen_system] = (invert == 0) ? 1 : 0;
542 }
543 }
544 else
545 ++sys_int;
546 }
547
548 /* ------ no new section -------------- */
549
550
551 else if (some_other_host[seen_host] == 0 &&
552 some_other_system[seen_system] == 0 &&
553 read_mode != SH_SECTION_NONE)
554 {
555 if (0 != sh_readconfig_line (line))
556 {
557 sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_EINVALCONF,
558 (long) conf_line);
559 }
560 }
561
562 }
563
564 nopel:
565
566 if (0 != seen_host || 0 != seen_system)
567 sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_EINVALDD,
568 _("config file"),
569 (long) conf_line);
570
571#if defined(WITH_GPG) || defined(WITH_PGP)
572 /* Validate signature of open file.
573 */
574 sl_rewind (fd);
575 sh_error_only_stderr (S_FALSE);
576 if (0 != sh_gpg_check_sign (fd, 0, 1))
577 aud_exit (FIL__, __LINE__, EXIT_FAILURE);
578#endif
579
580 sl_close (fd);
581
582 sh_error_fixup();
583
584 read_mode = SH_SECTION_NONE; /* reset b/o sighup reload */
585
586 SL_RETURN( 0, _("sh_readconf_read"));
587}
588
589int sh_readconf_set_path (char * which, const char * what)
590{
591 int len;
592 SL_ENTER( _("sh_readconf_set_path"));
593
594 if (which == NULL || what == NULL)
595 {
596 TPT((0, FIL__, __LINE__ , _("msg=<Input error>\n")));
597 SL_RETURN( -1, _("sh_readconf_set_path"));
598 }
599
600 if (0 == sl_strcmp(what, _("AUTO")))
601 {
602 len = sl_strlen(which);
603 if ( (len + sl_strlen(sh.host.name) + 2) > SH_PATHBUF)
604 {
605 TPT((0, FIL__, __LINE__ , _("msg=<Path too large: %s:%s>\n"),
606 which, sh.host.name));
607 SL_RETURN( -1, _("sh_readconf_set_path"));
608 }
609 else
610 {
611 which[len] = ':'; which[len+1] = '\0';
612 sl_strlcat(which, sh.host.name, SH_PATHBUF);
613 }
614 }
615 else /* not auto */
616 {
617 if (sl_strlen(what) > (SH_PATHBUF-1))
618 {
619 TPT((0, FIL__, __LINE__ , _("msg=<Path too large: %s>\n"), what));
620 SL_RETURN( -1, _("sh_readconf_set_path"));
621 }
622 else
623 {
624 sl_strlcpy(which, what, SH_PATHBUF);
625 }
626 }
627 SL_RETURN( 0, _("sh_readconf_set_path"));
628}
629
630int sh_readconf_set_database_path (const char * what)
631{
632 return (sh_readconf_set_path(sh.data.path, what));
633}
634
635int sh_readconf_set_logfile_path (const char * what)
636{
637 return (sh_readconf_set_path(sh.srvlog.name, what));
638}
639
640int sh_readconf_set_lockfile_path (const char * what)
641{
642 return( sh_readconf_set_path(sh.srvlog.alt, what));
643}
644
645
646
647
648typedef enum {
649 SET_MAILTIME,
650 SET_FILETIME
651} ShTimerItem;
652
653
654int sh_readconf_setTime (const char * str, ShTimerItem what)
655{
656 unsigned long i = atoi (str);
657
658 SL_ENTER( _("sh_readconf_setTime"));
659
660 if (i < LONG_MAX)
661 {
662 if (what == SET_MAILTIME)
663 {
664 TPT((0, FIL__, __LINE__, _("msg=<Set mail timer to %ld>\n"), i));
665 sh.mailTime.alarm_interval = i;
666 }
667 else if (what == SET_FILETIME)
668 {
669 TPT((0, FIL__, __LINE__, _("msg=<Set filecheck timer to %ld>\n"),i));
670 sh.fileCheck.alarm_interval = i;
671 }
672
673 SL_RETURN( 0, _("sh_readconf_setTime"));
674 }
675 else
676 {
677 sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_EINVALL,
678 _("set timer"), (long) i);
679 SL_RETURN( (-1), _("sh_readconf_setTime"));
680 }
681}
682
683int sh_readconf_setMailtime (const char * c)
684{
685 return sh_readconf_setTime (c, SET_MAILTIME);
686}
687
688int sh_readconf_setFiletime (const char * c)
689{
690 return sh_readconf_setTime (c, SET_FILETIME);
691}
692
693int sh_readconf_set_nice (const char * c)
694{
695 long val;
696
697 SL_ENTER(_("sh_readconf_set_nice"));
698
699 val = strtol (c, (char **)NULL, 10);
700 if (val < -20 || val > 20)
701 {
702 SL_RETURN((-1), _("sh_readconf_set_nice"));
703 }
704
705 val = (val < -19 ? -19 : val);
706 val = (val > 19 ? 19 : val);
707
708 sh.flag.nice = val;
709 SL_RETURN((0), _("sh_readconf_set_nice"));
710}
711
712#ifdef FANCY_LIBCAP
713int sh_readconf_setCaps(const char * c)
714{
715 int i;
716 SL_ENTER(_("sh_readconf_setCaps"));
717
718 i = sh_util_flagval(c, &sl_useCaps);
719 SL_RETURN((i), _("sh_readconf_setCaps"));
720}
721#endif
722
723typedef struct _cfg_options {
724 char * optname;
725 ShSectionType section;
726 ShSectionType alt_section;
727 int (*func)(const char * opt);
728} cfg_options;
729
730#if defined (SH_WITH_CLIENT) || defined (SH_STANDALONE)
731extern int sh_set_schedule_one(const char * str);
732extern int sh_set_schedule_two(const char * str);
733#endif
734#if defined (SH_WITH_SERVER)
735extern int sh_socket_use (const char * c);
736extern int sh_socket_uid (const char * c);
737extern int sh_socket_password (const char * c);
738#endif
739
740cfg_options ext_table[] = {
741#if defined(WITH_EXTERNAL)
742 { N_("opencommand"), SH_SECTION_EXTERNAL, SH_SECTION_NONE,
743 sh_ext_setcommand },
744 { N_("setcommandline"), SH_SECTION_EXTERNAL, SH_SECTION_NONE,
745 sh_ext_add_argv },
746 { N_("setchecksum"), SH_SECTION_EXTERNAL, SH_SECTION_NONE,
747 sh_ext_checksum },
748 { N_("setdefault"), SH_SECTION_EXTERNAL, SH_SECTION_NONE,
749 sh_ext_add_default },
750 { N_("setenviron"), SH_SECTION_EXTERNAL, SH_SECTION_NONE,
751 sh_ext_add_environ },
752 { N_("setdeadtime"), SH_SECTION_EXTERNAL, SH_SECTION_NONE,
753 sh_ext_deadtime },
754 { N_("settype"), SH_SECTION_EXTERNAL, SH_SECTION_NONE,
755 sh_ext_type },
756 { N_("setcredentials"), SH_SECTION_EXTERNAL, SH_SECTION_NONE,
757 sh_ext_priv },
758 { N_("setfilternot"), SH_SECTION_EXTERNAL, SH_SECTION_NONE,
759 sh_ext_add_not },
760 { N_("setfilterand"), SH_SECTION_EXTERNAL, SH_SECTION_NONE,
761 sh_ext_add_and },
762 { N_("setfilteror"), SH_SECTION_EXTERNAL, SH_SECTION_NONE,
763 sh_ext_add_or },
764 { N_("externalseverity"),SH_SECTION_LOG, SH_SECTION_EXTERNAL,
765 sh_error_set_external },
766 { N_("externalclass"), SH_SECTION_LOG, SH_SECTION_EXTERNAL,
767 sh_error_external_mask },
768#endif
769
770#if defined(WITH_DATABASE)
771 { N_("usepersistent"), SH_SECTION_DATABASE, SH_SECTION_NONE,
772 sh_database_use_persistent },
773 { N_("setdbname"), SH_SECTION_DATABASE, SH_SECTION_NONE,
774 sh_database_set_database },
775 { N_("setdbtable"), SH_SECTION_DATABASE, SH_SECTION_NONE,
776 sh_database_set_table },
777 { N_("setdbhost"), SH_SECTION_DATABASE, SH_SECTION_NONE,
778 sh_database_set_host },
779 { N_("setdbuser"), SH_SECTION_DATABASE, SH_SECTION_NONE,
780 sh_database_set_user },
781 { N_("setdbpassword"), SH_SECTION_DATABASE, SH_SECTION_NONE,
782 sh_database_set_password },
783 { N_("addtodbhash"), SH_SECTION_DATABASE, SH_SECTION_NONE,
784 sh_database_add_to_hash },
785 { N_("databaseseverity"),SH_SECTION_LOG, SH_SECTION_DATABASE,
786 sh_error_set_database },
787 { N_("databaseclass"), SH_SECTION_LOG, SH_SECTION_DATABASE,
788 sh_error_database_mask },
789 { N_("setdbservertstamp"), SH_SECTION_DATABASE, SH_SECTION_NONE,
790 set_enter_wrapper },
791#endif
792
793
794#if defined (SH_WITH_CLIENT) || defined (SH_STANDALONE)
795 { N_("dir"), SH_SECTION_ATTRIBUTES, SH_SECTION_NONE,
796 sh_files_pushdir_attr },
797 { N_("file"), SH_SECTION_ATTRIBUTES, SH_SECTION_NONE,
798 sh_files_pushfile_attr },
799 { N_("dir"), SH_SECTION_READONLY, SH_SECTION_NONE,
800 sh_files_pushdir_ro },
801 { N_("file"), SH_SECTION_READONLY, SH_SECTION_NONE,
802 sh_files_pushfile_ro },
803 { N_("dir"), SH_SECTION_LOGFILES, SH_SECTION_NONE,
804 sh_files_pushdir_log },
805 { N_("file"), SH_SECTION_LOGFILES, SH_SECTION_NONE,
806 sh_files_pushfile_log },
807 { N_("dir"), SH_SECTION_LOGGROW, SH_SECTION_NONE,
808 sh_files_pushdir_glog },
809 { N_("file"), SH_SECTION_LOGGROW, SH_SECTION_NONE,
810 sh_files_pushfile_glog },
811 { N_("dir"), SH_SECTION_NOIGNORE, SH_SECTION_NONE,
812 sh_files_pushdir_noig },
813 { N_("file"), SH_SECTION_NOIGNORE, SH_SECTION_NONE,
814 sh_files_pushfile_noig },
815 { N_("dir"), SH_SECTION_ALLIGNORE, SH_SECTION_NONE,
816 sh_files_pushdir_allig },
817 { N_("file"), SH_SECTION_ALLIGNORE, SH_SECTION_NONE,
818 sh_files_pushfile_allig },
819
820 { N_("dir"), SH_SECTION_USER0, SH_SECTION_NONE,
821 sh_files_pushdir_user0 },
822 { N_("file"), SH_SECTION_USER0, SH_SECTION_NONE,
823 sh_files_pushfile_user0 },
824 { N_("dir"), SH_SECTION_USER1, SH_SECTION_NONE,
825 sh_files_pushdir_user1 },
826 { N_("file"), SH_SECTION_USER1, SH_SECTION_NONE,
827 sh_files_pushfile_user1 },
828 { N_("dir"), SH_SECTION_USER2, SH_SECTION_NONE,
829 sh_files_pushdir_user2 },
830 { N_("file"), SH_SECTION_USER2, SH_SECTION_NONE,
831 sh_files_pushfile_user2 },
832 { N_("dir"), SH_SECTION_USER3, SH_SECTION_NONE,
833 sh_files_pushdir_user3 },
834 { N_("file"), SH_SECTION_USER3, SH_SECTION_NONE,
835 sh_files_pushfile_user3 },
836 { N_("dir"), SH_SECTION_USER4, SH_SECTION_NONE,
837 sh_files_pushdir_user4 },
838 { N_("file"), SH_SECTION_USER4, SH_SECTION_NONE,
839 sh_files_pushfile_user4 },
840 { N_("dir"), SH_SECTION_PRELINK, SH_SECTION_NONE,
841 sh_files_pushdir_prelink },
842 { N_("file"), SH_SECTION_PRELINK, SH_SECTION_NONE,
843 sh_files_pushfile_prelink },
844
845 { N_("ignoreadded"), SH_SECTION_MISC, SH_SECTION_NONE,
846 sh_ignore_add_new },
847 { N_("ignoremissing"), SH_SECTION_MISC, SH_SECTION_NONE,
848 sh_ignore_add_del },
849
850 { N_("filecheckscheduleone"), SH_SECTION_MISC, SH_SECTION_NONE,
851 sh_set_schedule_one },
852 { N_("filecheckscheduletwo"), SH_SECTION_MISC, SH_SECTION_NONE,
853 sh_set_schedule_two },
854
855 { N_("usehardlinkcheck"), SH_SECTION_MISC, SH_SECTION_NONE,
856 sh_files_check_hardlinks },
857 { N_("hardlinkoffset"), SH_SECTION_MISC, SH_SECTION_NONE,
858 sh_files_hle_reg },
859 { N_("addokchars"), SH_SECTION_MISC, SH_SECTION_NONE,
860 sh_util_obscure_ok },
861 { N_("setrecursionlevel"), SH_SECTION_MISC, SH_SECTION_NONE,
862 sh_files_setrecursion },
863 { N_("checksumtest"), SH_SECTION_MISC, SH_SECTION_NONE,
864 sh_util_setchecksum },
865 { N_("reportonlyonce"), SH_SECTION_MISC, SH_SECTION_NONE,
866 sh_files_reportonce },
867 { N_("reportfulldetail"), SH_SECTION_MISC, SH_SECTION_NONE,
868 sh_files_fulldetail },
869 { N_("uselocaltime"), SH_SECTION_MISC, SH_SECTION_NONE,
870 sh_unix_uselocaltime },
871
872 { N_("setnicelevel"), SH_SECTION_MISC, SH_SECTION_NONE,
873 sh_readconf_set_nice },
874
875#if defined(FANCY_LIBCAP)
876 { N_("usecaps"), SH_SECTION_MISC, SH_SECTION_NONE,
877 sh_readconf_setCaps },
878#endif
879
880 { N_("setiolimit"), SH_SECTION_MISC, SH_SECTION_NONE,
881 sh_unix_set_io_limit },
882
883 { N_("versionstring"), SH_SECTION_MISC, SH_SECTION_NONE,
884 sh_hash_version_string },
885
886 { N_("digestalgo"), SH_SECTION_MISC, SH_SECTION_NONE,
887 sh_tiger_hashtype },
888
889 { N_("redefreadonly"), SH_SECTION_MISC, SH_SECTION_NONE,
890 sh_files_redef_readonly },
891
892 { N_("redeflogfiles"), SH_SECTION_MISC, SH_SECTION_NONE,
893 sh_files_redef_logfiles },
894
895 { N_("redefgrowinglogfiles"), SH_SECTION_MISC, SH_SECTION_NONE,
896 sh_files_redef_loggrow },
897
898 { N_("redefattributes"), SH_SECTION_MISC, SH_SECTION_NONE,
899 sh_files_redef_attributes },
900
901 { N_("redefignorenone"), SH_SECTION_MISC, SH_SECTION_NONE,
902 sh_files_redef_noignore },
903
904 { N_("redefignoreall"), SH_SECTION_MISC, SH_SECTION_NONE,
905 sh_files_redef_allignore },
906
907 { N_("redefuser0"), SH_SECTION_MISC, SH_SECTION_NONE,
908 sh_files_redef_user0 },
909
910 { N_("redefuser1"), SH_SECTION_MISC, SH_SECTION_NONE,
911 sh_files_redef_user1 },
912
913 { N_("redefuser2"), SH_SECTION_MISC, SH_SECTION_NONE,
914 sh_files_redef_user2 },
915
916 { N_("redefuser3"), SH_SECTION_MISC, SH_SECTION_NONE,
917 sh_files_redef_user3 },
918
919 { N_("redefuser4"), SH_SECTION_MISC, SH_SECTION_NONE,
920 sh_files_redef_user4 },
921
922 { N_("redefprelink"), SH_SECTION_MISC, SH_SECTION_NONE,
923 sh_files_redef_prelink },
924
925
926 { N_("setprelinkpath"), SH_SECTION_MISC, SH_SECTION_NONE,
927 sh_prelink_set_path },
928 { N_("setprelinkchecksum"), SH_SECTION_MISC, SH_SECTION_NONE,
929 sh_prelink_set_hash },
930
931 /* client or standalone
932 */
933#endif
934
935#ifdef SH_WITH_SERVER
936#ifdef INET_SYSLOG
937 { N_("setudpactive"), SH_SECTION_SRV, SH_SECTION_MISC,
938 set_syslog_active },
939#endif
940 { N_("setusesocket"), SH_SECTION_SRV, SH_SECTION_MISC,
941 sh_socket_use },
942 { N_("setsocketallowuid"), SH_SECTION_SRV, SH_SECTION_MISC,
943 sh_socket_uid },
944 { N_("setsocketpassword"), SH_SECTION_SRV, SH_SECTION_MISC,
945 sh_socket_password },
946 { N_("setstripdomain"), SH_SECTION_SRV, SH_SECTION_MISC,
947 sh_forward_set_strip },
948 { N_("useseparatelogs"), SH_SECTION_SRV, SH_SECTION_MISC,
949 set_flag_sep_log },
950 { N_("setchrootdir"), SH_SECTION_SRV, SH_SECTION_MISC,
951 sh_unix_set_chroot },
952 { N_("setclienttimelimit"), SH_SECTION_SRV, SH_SECTION_MISC,
953 sh_forward_set_time_limit },
954 { N_("useclientseverity"), SH_SECTION_SRV, SH_SECTION_MISC,
955 sh_forward_use_clt_sev },
956 { N_("useclientclass"), SH_SECTION_SRV, SH_SECTION_MISC,
957 sh_forward_use_clt_class },
958 { N_("severitylookup"), SH_SECTION_SRV, SH_SECTION_MISC,
959 sh_forward_lookup_level },
960 { N_("setclientfromaccept"), SH_SECTION_SRV, SH_SECTION_MISC,
961 set_socket_peer },
962 { N_("setserverport"), SH_SECTION_SRV, SH_SECTION_MISC,
963 sh_forward_set_port },
964 { N_("setserverinterface"), SH_SECTION_SRV, SH_SECTION_MISC,
965 sh_forward_set_interface },
966 { N_("client"), SH_SECTION_CLIENTS, SH_SECTION_NONE,
967 sh_forward_register_client },
968#endif
969
970#if defined(SH_WITH_CLIENT) || defined(SH_WITH_SERVER)
971 { N_("exportseverity"), SH_SECTION_LOG, SH_SECTION_NONE,
972 sh_error_setexport },
973 { N_("exportclass"), SH_SECTION_LOG, SH_SECTION_NONE,
974 sh_error_export_mask },
975#if defined(SH_WITH_SERVER)
976 { N_("setlogserver"), SH_SECTION_SRV, SH_SECTION_MISC,
977 sh_forward_setlogserver },
978#else
979 { N_("setlogserver"), SH_SECTION_CLT, SH_SECTION_MISC,
980 sh_forward_setlogserver },
981#endif
982#endif
983 { N_("setfilechecktime"), SH_SECTION_MISC, SH_SECTION_NONE,
984 sh_readconf_setFiletime },
985 { N_("setlooptime"), SH_SECTION_MISC, SH_SECTION_NONE,
986 sh_util_setlooptime },
987
988#ifdef SH_WITH_MAIL
989 { N_("mailseverity"), SH_SECTION_LOG, SH_SECTION_NONE,
990 sh_error_setseverity },
991 { N_("mailclass"), SH_SECTION_LOG, SH_SECTION_NONE,
992 sh_error_mail_mask },
993 { N_("setmailtime"), SH_SECTION_MAIL, SH_SECTION_MISC,
994 sh_readconf_setMailtime },
995 { N_("setmailnum"), SH_SECTION_MAIL, SH_SECTION_MISC,
996 sh_mail_setNum },
997 { N_("setmailaddress"), SH_SECTION_MAIL, SH_SECTION_MISC,
998 sh_mail_setaddress },
999 { N_("setmailrelay"), SH_SECTION_MAIL, SH_SECTION_MISC,
1000 sh_mail_set_relay },
1001 { N_("mailsingle"), SH_SECTION_MAIL, SH_SECTION_MISC,
1002 sh_mail_setFlag },
1003 { N_("mailsubject"), SH_SECTION_MAIL, SH_SECTION_MISC,
1004 set_mail_subject },
1005 { N_("setmailsender"), SH_SECTION_MAIL, SH_SECTION_MISC,
1006 sh_mail_set_sender },
1007 { N_("setmailfilternot"), SH_SECTION_MAIL, SH_SECTION_MISC,
1008 sh_mail_add_not },
1009 { N_("setmailfilterand"), SH_SECTION_MAIL, SH_SECTION_MISC,
1010 sh_mail_add_and },
1011 { N_("setmailfilteror"), SH_SECTION_MAIL, SH_SECTION_MISC,
1012 sh_mail_add_or },
1013#endif
1014 { N_("setbindaddress"), SH_SECTION_MISC, SH_SECTION_NONE,
1015 sh_calls_set_bind_addr },
1016 { N_("daemon"), SH_SECTION_MISC, SH_SECTION_NONE,
1017 sh_unix_setdeamon },
1018 { N_("samhainpath"), SH_SECTION_MISC, SH_SECTION_NONE,
1019 sh_unix_self_hash },
1020 { N_("trusteduser"), SH_SECTION_MISC, SH_SECTION_NONE,
1021 tf_add_trusted_user },
1022 { N_("settimeserver"), SH_SECTION_MISC, SH_SECTION_NONE,
1023 sh_unix_settimeserver },
1024
1025 { N_("printseverity"), SH_SECTION_LOG, SH_SECTION_NONE,
1026 sh_error_setprint },
1027 { N_("printclass"), SH_SECTION_LOG, SH_SECTION_NONE,
1028 sh_error_print_mask },
1029
1030 { N_("logseverity"), SH_SECTION_LOG, SH_SECTION_NONE,
1031 sh_error_setlog },
1032 { N_("logclass"), SH_SECTION_LOG, SH_SECTION_NONE,
1033 sh_error_log_mask },
1034
1035 { N_("syslogseverity"), SH_SECTION_LOG, SH_SECTION_NONE,
1036 sh_error_set_syslog },
1037 { N_("syslogclass"), SH_SECTION_LOG, SH_SECTION_NONE,
1038 sh_error_syslog_mask },
1039#ifdef HAVE_LIBPRELUDE
1040 { N_("preludeseverity"), SH_SECTION_LOG, SH_SECTION_NONE,
1041 sh_error_set_prelude },
1042 { N_("preludeclass"), SH_SECTION_LOG, SH_SECTION_NONE,
1043 sh_error_prelude_mask },
1044#ifdef HAVE_LIBPRELUDE_9
1045 { N_("preludeprofile"), SH_SECTION_MISC, SH_SECTION_NONE,
1046 sh_prelude_set_profile },
1047 { N_("preludemaptoinfo"), SH_SECTION_MISC, SH_SECTION_NONE,
1048 sh_prelude_map_info },
1049 { N_("preludemaptolow"), SH_SECTION_MISC, SH_SECTION_NONE,
1050 sh_prelude_map_low },
1051 { N_("preludemaptomedium"), SH_SECTION_MISC, SH_SECTION_NONE,
1052 sh_prelude_map_medium },
1053 { N_("preludemaptohigh"), SH_SECTION_MISC, SH_SECTION_NONE,
1054 sh_prelude_map_high },
1055#endif
1056#endif
1057
1058 { N_("logcalls"), SH_SECTION_LOG, SH_SECTION_NONE,
1059 sh_aud_set_functions },
1060
1061 { N_("messageheader"), SH_SECTION_MISC, SH_SECTION_NONE,
1062 sh_error_ehead },
1063
1064 { N_("setconsole"), SH_SECTION_MISC, SH_SECTION_NONE,
1065 sh_log_set_console },
1066
1067#ifdef WITH_MESSAGE_QUEUE
1068 { N_("messagequeueactive"),SH_SECTION_MISC, SH_SECTION_NONE,
1069 enable_msgq },
1070#endif
1071
1072 { N_("setreverselookup"), SH_SECTION_MISC, SH_SECTION_NONE,
1073 set_reverse_lookup },
1074
1075 { N_("setdatabasepath"), SH_SECTION_MISC, SH_SECTION_NONE,
1076 sh_readconf_set_database_path },
1077
1078 { N_("setlogfilepath"), SH_SECTION_MISC, SH_SECTION_NONE,
1079 sh_readconf_set_logfile_path },
1080
1081 { N_("setlockfilepath"), SH_SECTION_MISC, SH_SECTION_NONE,
1082 sh_readconf_set_lockfile_path },
1083
1084 { N_("hidesetup"), SH_SECTION_MISC, SH_SECTION_NONE,
1085 sh_util_hidesetup },
1086
1087 { N_("syslogfacility"), SH_SECTION_LOG, SH_SECTION_MISC,
1088 sh_log_set_facility },
1089
1090 { N_("mactype"), SH_SECTION_MISC, SH_SECTION_NONE,
1091 sh_util_sigtype },
1092
1093 { NULL, 0, 0, NULL}
1094};
1095
1096
1097
1098
1099static int sh_readconfig_line (char * line)
1100{
1101 char * c;
1102 char * tmp;
1103 int i;
1104 int good_opt = -1;
1105
1106#if defined (SH_WITH_CLIENT) || defined (SH_STANDALONE)
1107 int modnum, modkey;
1108#endif
1109
1110 static char *ident[] = {
1111 N_("severityreadonly"),
1112 N_("severitylogfiles"),
1113 N_("severitygrowinglogs"),
1114 N_("severityignorenone"),
1115 N_("severityignoreall"),
1116 N_("severityattributes"),
1117 N_("severitydirs"),
1118 N_("severityfiles"),
1119 N_("severitynames"),
1120 N_("severityuser0"),
1121 N_("severityuser1"),
1122 N_("severityuser2"),
1123 N_("severityuser3"),
1124 N_("severityuser4"),
1125 N_("severityprelink"),
1126 NULL
1127 };
1128
1129 static int identnum[] = {
1130 SH_ERR_T_RO,
1131 SH_ERR_T_LOGS,
1132 SH_ERR_T_GLOG,
1133 SH_ERR_T_NOIG,
1134 SH_ERR_T_ALLIG,
1135 SH_ERR_T_ATTR,
1136 SH_ERR_T_DIR,
1137 SH_ERR_T_FILE,
1138 SH_ERR_T_NAME,
1139 SH_ERR_T_USER0,
1140 SH_ERR_T_USER1,
1141 SH_ERR_T_USER2,
1142 SH_ERR_T_USER3,
1143 SH_ERR_T_USER4,
1144 SH_ERR_T_PRELINK,
1145 };
1146
1147 SL_ENTER(_("sh_readconf_line"));
1148
1149 /* interpret line */
1150
1151 c = strchr(line, '=');
1152 if (c == NULL || (*c) == '\0')
1153 {
1154 if (line != NULL)
1155 {
1156 TPT(( 0, FIL__, __LINE__, _("msg=<ConfigFile: not key=value: %s>\n"),
1157 line));
1158 }
1159 SL_RETURN(good_opt, _("sh_readconf_line"));
1160 }
1161 else
1162 ++c;
1163
1164 /* skip leading whitespace
1165 */
1166 while ((*c) == ' ' || (*c) == '\t')
1167 ++c;
1168
1169 if ((*c) == '\0') /* no value */
1170 {
1171 if (line != NULL)
1172 {
1173 TPT(( 0, FIL__, __LINE__, _("msg=<ConfigFile: not key=value: %s>\n"),
1174 line));
1175 }
1176 SL_RETURN(good_opt, _("sh_readconf_line"));
1177 }
1178
1179 /* convert to lowercase */
1180
1181 tmp = line;
1182 while (*tmp != '=')
1183 {
1184 *tmp = tolower( (int) *tmp);
1185 ++tmp;
1186 }
1187
1188 if (!sl_is_suid())
1189 {
1190 TPT(( 0, FIL__, __LINE__, _("msg=<ConfigFile: %s>\n"), line));
1191 }
1192
1193
1194#if defined (SH_WITH_CLIENT) || defined (SH_STANDALONE)
1195 if (read_mode == SH_SECTION_OTHER)
1196 {
1197 for (modnum = 0; modList[modnum].name != NULL; ++modnum)
1198 {
1199 for (modkey = 0; modList[modnum].conf_table[modkey].the_opt != NULL;
1200 ++modkey)
1201 {
1202 if (sl_strncmp (line,
1203 _(modList[modnum].conf_table[modkey].the_opt),
1204 sl_strlen(modList[modnum].conf_table[modkey].the_opt) ) == 0)
1205 {
1206 good_opt = 0;
1207 if (0 != modList[modnum].conf_table[modkey].func(c))
1208 sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_EINVALS,
1209 _(modList[modnum].conf_table[modkey].the_opt), c);
1210 if (!sl_is_suid())
1211 {
1212 TPT(( 0, FIL__, __LINE__,
1213 _("msg=<line = %s, option = %s>\n"), line,
1214 _(modList[modnum].conf_table[modkey].the_opt)));
1215 }
1216 goto outburst;
1217 }
1218 }
1219 }
1220 }
1221 outburst:
1222#endif
1223
1224
1225 if (read_mode == SH_SECTION_THRESHOLD)
1226 {
1227 i = 0;
1228 while (ident[i] != NULL) {
1229 if (sl_strncmp (line, _(ident[i]), sl_strlen(ident[i])-1) == 0)
1230 {
1231 good_opt = 0;
1232 sh_error_set_iv (identnum[i], c);
1233 break;
1234 }
1235 ++i;
1236 }
1237 }
1238 else
1239 {
1240 i = 0;
1241 while (ext_table[i].optname != NULL)
1242 {
1243 if ((ext_table[i].section == read_mode ||
1244 ext_table[i].alt_section == read_mode) &&
1245 sl_strncmp (line, _(ext_table[i].optname),
1246 sl_strlen(ext_table[i].optname)) == 0)
1247 {
1248 good_opt = 0;
1249 if (0 != ext_table[i].func (c))
1250 sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_EINVALS,
1251 _(ext_table[i].optname), c);
1252 break;
1253 }
1254 ++i;
1255 }
1256 }
1257
1258 SL_RETURN(good_opt, _("sh_readconf_line"));
1259}
1260
1261
Note: See TracBrowser for help on using the repository browser.