source: trunk/include/samhain.h@ 144

Last change on this file since 144 was 143, checked in by rainer, 17 years ago

Bugfixes and threaded process check.
File size: 12.6 KB
RevLine 
[1]1/* SAMHAIN file system integrity testing */
2/* Copyright (C) 1999 Rainer Wichmann */
3/* */
4/* This program is free software; you can redistribute it */
5/* and/or modify */
6/* it under the terms of the GNU General Public License as */
7/* published by */
8/* the Free Software Foundation; either version 2 of the License, or */
9/* (at your option) any later version. */
10/* */
11/* This program is distributed in the hope that it will be useful, */
12/* but WITHOUT ANY WARRANTY; without even the implied warranty of */
13/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
14/* GNU General Public License for more details. */
15/* */
16/* You should have received a copy of the GNU General Public License */
17/* along with this program; if not, write to the Free Software */
18/* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
19
20#ifndef SAMHAIN_H
21#define SAMHAIN_H
22
23#include <sys/types.h>
24#include "slib.h"
25
26#ifdef SH_ENCRYPT
27#include "rijndael-api-fst.h"
28#endif
29
30/**************************************************
31 *
32 * STANDARD DEFINES
33 *
34 **************************************************/
35
36#define REPLACE_OLD
37
38/* Standard buffer sizes.
39 */
40#define SH_MINIBUF 64
41#define SH_BUFSIZE 1024
42#define SH_MAXBUF 4096
43#define SH_PATHBUF 256
44
[132]45#define SH_ERRBUF_SIZE 64
[131]46
[1]47/* Sizes for arrays (user, group, timestamp).
48 */
[40]49#define SOCKPASS_MAX 14
[1]50#define USER_MAX 20
51#define GROUP_MAX 20
52#define TIM_MAX 32
53
[40]54
[1]55/* The number of bytes in a key,
56 * the number of chars in its hex repesentation,
57 * and the block size of the hash algorithm.
58 */
59#define KEY_BYT 24
60#define KEY_LEN 48
61#define KEY_BLOCK 24
[133]62#define KEYBUF_SIZE (KEY_LEN+1)
[1]63
64/* The length of the compiled-in password.
65 */
66#define PW_LEN 8
67
68#undef GOOD
69#define GOOD 1
70#undef BAD
71#define BAD 0
72#undef ON
73#define ON 1
74#undef OFF
75#define OFF 0
76#undef S_TRUE
77#define S_TRUE 1
78#undef S_FALSE
79#define S_FALSE 0
80
81/* An unsigned integer guaranteed to be 32 bit.
82 */
83#if defined(HAVE_INT_32)
84#define UINT32 unsigned int
85#define SINT32 int
86#elif defined(HAVE_LONG_32)
87#define UINT32 unsigned long
88#define SINT32 long
89#elif defined(HAVE_SHORT_32)
90#define UINT32 unsigned short
91#define SINT32 short
92#endif
93
94#ifdef HAVE_INTTYPES_H
95#include <inttypes.h>
96#else
97#ifdef HAVE_STDINT_H
98#include <stdint.h>
99#endif
100#endif
101
102#if !defined(HAVE_INTTYPES_H) && !defined(HAVE_STDINT_H)
103
104#ifdef HAVE_LONG_LONG_64
105#define UINT64 unsigned long long
106#else
107#ifdef HAVE_LONG_64
108#define UINT64 unsigned long
109#else
110#define UINT64_IS_32
111#define UINT64 unsigned long
112#endif
113#endif
114
115#else
116#define UINT64 uint64_t
117#endif
118
119
120
121#define UBYTE unsigned char
122
123
124enum {
125 SH_CHECK_NONE = 0,
126 SH_CHECK_INIT = 1,
127 SH_CHECK_CHECK = 2
128};
129
[143]130#define SH_MOD_THREAD 1
131#define SH_MOD_ACTIVE 0
132#define SH_MOD_FAILED -1
133
[114]134/* Flags for file status
135 */
136#define SH_FFLAG_ALLIGNORE (1<<0)
137#define SH_FFLAG_VISITED (1<<1)
138#define SH_FFLAG_CHECKED (1<<3)
139#define SH_FFLAG_REPORTED (1<<3)
[115]140#define SH_FFLAG_SUIDCHK (1<<4)
[93]141
[114]142#define SH_FFLAG_ALLIGNORE_SET(a) (((a) & SH_FFLAG_ALLIGNORE) != 0)
143#define SET_SH_FFLAG_ALLIGNORE(a) ((a) |= SH_FFLAG_ALLIGNORE)
144#define CLEAR_SH_FFLAG_ALLIGNORE(a) ((a) &= ~SH_FFLAG_ALLIGNORE)
145
146#define SH_FFLAG_VISITED_SET(a) (((a) & SH_FFLAG_VISITED) != 0)
147#define SET_SH_FFLAG_VISITED(a) ((a) |= SH_FFLAG_VISITED)
148#define CLEAR_SH_FFLAG_VISITED(a) ((a) &= ~SH_FFLAG_VISITED)
149
150#define SH_FFLAG_CHECKED_SET(a) (((a) & SH_FFLAG_VISITED) != 0)
151#define SET_SH_FFLAG_CHECKED(a) ((a) |= SH_FFLAG_VISITED)
152#define CLEAR_SH_FFLAG_CHECKED(a) ((a) &= ~SH_FFLAG_VISITED)
153
154#define SH_FFLAG_REPORTED_SET(a) (((a) & SH_FFLAG_REPORTED) != 0)
155#define SET_SH_FFLAG_REPORTED(a) ((a) |= SH_FFLAG_REPORTED)
156#define CLEAR_SH_FFLAG_REPORTED(a) ((a) &= ~SH_FFLAG_REPORTED)
157
[115]158#define SH_FFLAG_SUIDCHK_SET(a) (((a) & SH_FFLAG_SUIDCHK) != 0)
159#define SET_SH_FFLAG_SUIDCHK(a) ((a) |= SH_FFLAG_SUIDCHK)
160#define CLEAR_SH_FFLAG_SUIDCHK(a) ((a) &= ~SH_FFLAG_SUIDCHK)
[114]161
162
[115]163
[1]164/**************************************************
165 *
166 * TYPEDEFS
167 *
168 **************************************************/
169
170enum {
171 SH_LEVEL_READONLY = 1,
172 SH_LEVEL_LOGFILES = 2,
173 SH_LEVEL_LOGGROW = 3,
174 SH_LEVEL_NOIGNORE = 4,
175 SH_LEVEL_ALLIGNORE = 5,
176 SH_LEVEL_ATTRIBUTES = 6,
177 SH_LEVEL_USER0 = 7,
178 SH_LEVEL_USER1 = 8,
[27]179 SH_LEVEL_USER2 = 9,
180 SH_LEVEL_USER3 = 10,
181 SH_LEVEL_USER4 = 11,
182 SH_LEVEL_PRELINK = 12
[1]183};
184
185typedef struct {
186 time_t alarm_interval;
187 time_t alarm_last;
188} sh_timer_t;
189
190typedef struct {
191 char path[SH_PATHBUF];
192 char hash[KEY_LEN+1];
193} sh_sh_df;
194
195typedef struct {
196 char user[USER_MAX];
197 char group[GROUP_MAX];
198 char home[SH_PATHBUF];
199 uid_t uid;
200 gid_t gid;
201} sh_sh_user;
202
203typedef struct {
204 char name[SH_PATHBUF]; /* local hostname */
205 char system[SH_MINIBUF]; /* system */
206 char release[SH_MINIBUF]; /* release */
207 char machine[SH_MINIBUF]; /* machine */
208} sh_sh_local;
209
210typedef struct {
211 char name[SH_PATHBUF];
212 char alt[SH_PATHBUF];
213} sh_sh_remote;
214
215typedef struct {
216 unsigned long bytes_hashed; /* bytes last check */
217 unsigned long bytes_speed; /* bytes/sec last check */
218 unsigned long mail_success; /* mails sent */
219 unsigned long mail_failed; /* mails not sent */
220 time_t time_start; /* start last check */
221 time_t time_check; /* time last check */
222 unsigned long dirs_checked; /* #dirs last check */
223 unsigned long files_checked; /* #files last check */
224} sh_sh_stat;
225
226typedef struct {
227 int exit; /* exit value */
228 int checkSum; /* whether to init/check checksums */
229 int update; /* update db */
230 int opts; /* reading cl options */
231 int isdaemon; /* daemon or not */
232 int loop; /* go in loop even if not daemon */
233 int nice; /* desired nicety */
234 int isserver; /* server or not */
235 int islocked; /* BAD if logfile not locked */
236 int smsg; /* GOOD if end message sent */
237 int log_start; /* TRUE if new audit trail */
238 int reportonce; /* TRUE if bad files only once rep.*/
239 int fulldetail; /* TRUE if full details requested */
240 int client_severity; /* TRUE if client severity used */
241 int client_class; /* TRUE if client class used */
242 int audit;
243 unsigned long aud_mask;
244 int hidefile; /* TRUE if file not reveled in log */
245} sh_sh_flag;
246
247typedef struct {
248
249 char prg_name[8];
250
251 sh_sh_df exec;
252 sh_sh_df conf;
253 sh_sh_df data;
254
255 sh_sh_user real;
256 sh_sh_user effective;
257 sh_sh_user run;
258
259 sh_sh_local host;
260
261 sh_sh_remote srvtime;
262 sh_sh_remote srvmail;
263 sh_sh_remote srvexport;
264 sh_sh_remote srvcons;
265 sh_sh_remote srvlog;
266
267 sh_sh_stat statistics;
268 sh_sh_flag flag;
269
270#ifdef SH_STEALTH
271 unsigned long off_data;
272#endif
273
274 sh_timer_t mailNum;
275 sh_timer_t mailTime;
276 sh_timer_t fileCheck;
277
278 int looptime; /* timing for main loop */
279 /*@null@*//*@out@*/ char * timezone;
280} sh_struct;
281
282
283extern volatile int sig_raised;
284extern volatile int sig_urgent;
285extern volatile int sig_debug_switch; /* SIGUSR1 */
286extern volatile int sig_suspend_switch; /* SIGUSR2 */
[143]287extern volatile int sh_global_suspend_flag;
[1]288extern volatile int sig_fresh_trail; /* SIGIOT */
[143]289extern volatile int sh_thread_pause_flag;
[1]290extern volatile int sig_config_read_again; /* SIGHUP */
291extern volatile int sig_terminate; /* SIGQUIT */
292extern volatile int sig_termfast; /* SIGTERM */
293extern volatile int sig_force_check; /* SIGTTOU */
294
295extern long int eintr__result;
296
[20]297extern int sh_argc_store;
298extern char ** sh_argv_store;
299
[1]300#include "sh_calls.h"
301
302
303typedef struct {
[40]304 char sh_sockpass[2*SOCKPASS_MAX+2];
[1]305 char sigkey_old[KEY_LEN+1];
306 char sigkey_new[KEY_LEN+1];
307 char mailkey_old[KEY_LEN+1];
308 char mailkey_new[KEY_LEN+1];
309 char crypt[KEY_LEN+1];
310 char session[KEY_LEN+1];
311 char vernam[KEY_LEN+1];
312 int mlock_failed;
313
314 char pw[PW_LEN];
315
316 char poolv[KEY_BYT];
317 int poolc;
318
319 int rngI;
320 UINT32 rng0[3];
321 UINT32 rng1[3];
322 UINT32 rng2[3];
323
324 UINT32 ErrFlag[2];
325
326#ifdef SH_ENCRYPT
327 /*@out@*/ keyInstance keyInstE;
328 /*@out@*/ keyInstance keyInstD;
329#endif
330} sh_key_t;
331
332extern sh_struct sh;
333/*@null@*/ extern sh_key_t *skey;
334
[22]335/**************************************************
336 *
337 * macros
338 *
339 **************************************************/
[1]340
[76]341#if defined(__GNUC__) && (__GNUC__ >= 4)
342#define SH_GNUC_NULL_TERMINATED __attribute__((__sentinel__))
343#else
344#define SH_GNUC_NULL_TERMINATED
345#endif
346
347/* The semantics of the built-in are that it is expected that expr == const
348 * for __builtin_expect ((expr), const)
349 */
350#if defined(__GNUC__) && (__GNUC__ > 2) && defined(__OPTIMIZE__)
351#define SH_LIKELY(expr) (__builtin_expect((expr), 1))
352#define SH_UNLIKELY(expr) (__builtin_expect((expr), 0))
353#else
354#define SH_LIKELY(expr) (expr)
355#define SH_UNLIKELY(expr) (expr)
356#endif
357
[22]358/* signal-safe log function
359 */
[30]360int safe_logger (int signal, int method, char * details);
[34]361void safe_fatal (char * details, char *f, int l);
[22]362
[25]363#define SH_VALIDATE_EQ(a,b) \
[22]364 do { \
[34]365 if ((a) != (b)) safe_fatal(#a " != " #b, FIL__, __LINE__);\
[22]366 } while (0)
367
[25]368#define SH_VALIDATE_NE(a,b) \
369 do { \
[34]370 if ((a) == (b)) safe_fatal(#a " == " #b, FIL__, __LINE__);\
[25]371 } while (0)
[22]372
[68]373#define SH_VALIDATE_GE(a,b) \
374 do { \
375 if ((a) < (b)) safe_fatal(#a " < " #b, FIL__, __LINE__);\
376 } while (0)
377
[1]378#if defined(HAVE_MLOCK) && !defined(HAVE_BROKEN_MLOCK)
379#define MLOCK(a, b) \
380 if ((skey != NULL) && skey->mlock_failed == SL_FALSE){ \
381 (void) sl_set_suid(); \
[19]382 if (sh_unix_mlock(FIL__, __LINE__, a, b) < 0) skey->mlock_failed = SL_TRUE; \
[1]383 (void) sl_unset_suid(); }
384#else
385#define MLOCK(a, b) \
386 ;
387#endif
388
389#if defined(HAVE_MLOCK) && !defined(HAVE_BROKEN_MLOCK)
390#define MUNLOCK(a, b) \
391 if ((skey != NULL) && skey->mlock_failed == SL_FALSE){ \
392 (void) sl_set_suid(); \
393 (void) sh_unix_munlock( a, b );\
394 (void) sl_unset_suid(); }
395#else
396#define MUNLOCK(a, b) \
397 ;
398#endif
399
400#ifdef SH_STEALTH
401void sh_do_encode (char * str, int len);
402#define sh_do_decode sh_do_encode
403#endif
404
405/* #if defined(SCREW_IT_UP)
406 * extern volatile int sh_not_traced;
407 * inline int sh_sigtrap_prepare();
408 * inline int sh_derr();
409 * #endif
410 */
411
412#if defined(SCREW_IT_UP) && (defined(__FreeBSD__) || defined(__linux__)) && defined(__i386__)
413#define BREAKEXIT(expr) \
414 do { \
415 int ixi; \
416 for (ixi = 0; ixi < 8; ++ixi) { \
417 if ((*(volatile unsigned *)((unsigned) expr + ixi) & 0xff) == 0xcc) \
418 _exit(EXIT_FAILURE); \
419 } \
420 } \
421 while (1 == 0)
422#else
423#define BREAKEXIT(expr)
424#endif
425
426
427
428#include "sh_cat.h"
429#include "sh_trace.h"
430#include "sh_mem.h"
431
432#endif
433
434/* CRIT: */
435/* NEW_CLIENT <client> */
436/* BAD_CLIENT <client> -- <details> */
437/* ERR_CLIENT <client> -- <details> */
438
439/* ALERT: */
440/* LOG_KEY samhain|yule <key> */
441/* STARTUP samhain|yule -- user <username> */
442/* EXIT samhain|yule */
443/* GOODSIG <file> <user> */
444/* FP_KEY <fingerprint> */
445/* GOODSIG_DAT <file> <user> */
446/* FP_KEY_DAT <fingerprint> */
447/* TIGER_CFG <file> <checksum> */
448/* TIGER_DAT <file> <checksum> */
449
450/* PANIC -- <details> */
451/* ERROR -- <details> */
452
453/* Policy */
454/* POLICY <code> <file> */
455/* <code> = MISSING || ADDED || NOT_A_DIRECTORY || <policy> */
456
457
458
Note: See TracBrowser for help on using the repository browser.