source: trunk/include/samhain.h@ 454

Last change on this file since 454 was 444, checked in by katerina, 11 years ago

Support for sha2-256 checksum (ticket #348).
File size: 14.9 KB
RevLine 
[1]1/* SAMHAIN file system integrity testing */
2/* Copyright (C) 1999 Rainer Wichmann */
3/* */
4/* This program is free software; you can redistribute it */
5/* and/or modify */
6/* it under the terms of the GNU General Public License as */
7/* published by */
8/* the Free Software Foundation; either version 2 of the License, or */
9/* (at your option) any later version. */
10/* */
11/* This program is distributed in the hope that it will be useful, */
12/* but WITHOUT ANY WARRANTY; without even the implied warranty of */
13/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
14/* GNU General Public License for more details. */
15/* */
16/* You should have received a copy of the GNU General Public License */
17/* along with this program; if not, write to the Free Software */
18/* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
19
20#ifndef SAMHAIN_H
21#define SAMHAIN_H
22
23#include <sys/types.h>
24#include "slib.h"
25
26#ifdef SH_ENCRYPT
27#include "rijndael-api-fst.h"
28#endif
29
30/**************************************************
31 *
32 * STANDARD DEFINES
33 *
34 **************************************************/
35
[295]36/* IPv6 */
37#if defined(HAVE_GETNAMEINFO) && defined(HAVE_GETADDRINFO)
38
39#if defined(SH_COMPILE_STATIC) && defined(__linux__)
40#undef USE_IPVX
41#define SH_SOCKMAX 1
42#else
43
44#if defined(USE_IPV4)
45#undef USE_IPVX
46#else
47#define USE_IPVX 1
48#endif
49
50#define SH_SOCKMAX 8
51#endif
52
53#else
54#undef USE_IPVX
55#define SH_SOCKMAX 1
56#endif
57
58/* end IPv6 */
59
[1]60#define REPLACE_OLD
61
[283]62/* Standard buffer sizes.
63 * IPv6 is 8 groups of 4 hex digits seperated by colons.
[1]64 */
[295]65#define SH_IP_BUF 48
[1]66#define SH_MINIBUF 64
67#define SH_BUFSIZE 1024
68#define SH_MAXBUF 4096
69#define SH_PATHBUF 256
[170]70#define SH_MSG_BUF 64512
[1]71
[132]72#define SH_ERRBUF_SIZE 64
[131]73
[170]74/* MAX_PATH_STORE must be >= KEY_LEN
75 */
76#define MAX_PATH_STORE 12287
77
[1]78/* Sizes for arrays (user, group, timestamp).
79 */
[40]80#define SOCKPASS_MAX 14
[149]81#define USER_MAX 20
82#define GROUP_MAX 20
83#define TIM_MAX 32
[1]84
[149]85#define CMODE_SIZE 11
[40]86
[149]87#define ATTRBUF_SIZE 16
88#define ATTRBUF_USED 12
89
[1]90/* The number of bytes in a key,
91 * the number of chars in its hex repesentation,
92 * and the block size of the hash algorithm.
93 */
94#define KEY_BYT 24
95#define KEY_LEN 48
96#define KEY_BLOCK 24
[133]97#define KEYBUF_SIZE (KEY_LEN+1)
[1]98
99/* The length of the compiled-in password.
100 */
101#define PW_LEN 8
102
103#undef GOOD
104#define GOOD 1
105#undef BAD
106#define BAD 0
107#undef ON
108#define ON 1
109#undef OFF
110#define OFF 0
111#undef S_TRUE
112#define S_TRUE 1
113#undef S_FALSE
114#define S_FALSE 0
115
116/* An unsigned integer guaranteed to be 32 bit.
117 */
118#if defined(HAVE_INT_32)
119#define UINT32 unsigned int
120#define SINT32 int
121#elif defined(HAVE_LONG_32)
122#define UINT32 unsigned long
123#define SINT32 long
124#elif defined(HAVE_SHORT_32)
125#define UINT32 unsigned short
126#define SINT32 short
[415]127#else
128#error "No 32 bit integer type found"
[1]129#endif
130
131#ifdef HAVE_INTTYPES_H
132#include <inttypes.h>
[156]133#endif
[1]134#ifdef HAVE_STDINT_H
135#include <stdint.h>
136#endif
137
[265]138#if !defined(HAVE_UINT16_T)
139#define UINT16 unsigned short
140#else
141#define UINT16 uint16_t
142#endif
143
[156]144#if !defined(HAVE_UINT64_T)
[1]145
146#ifdef HAVE_LONG_LONG_64
147#define UINT64 unsigned long long
148#else
149#ifdef HAVE_LONG_64
150#define UINT64 unsigned long
151#else
[156]152#error "no 64bit type found"
[1]153#endif
154#endif
155
156#else
157#define UINT64 uint64_t
158#endif
159
160
161
162#define UBYTE unsigned char
163
[444]164enum {
165 SH_TIGER192 = 0,
166 SH_SHA1 = 1,
167 SH_MD5 = 2,
168 SH_SHA256 = 3
169};
[1]170
[444]171
[1]172enum {
173 SH_CHECK_NONE = 0,
174 SH_CHECK_INIT = 1,
175 SH_CHECK_CHECK = 2
176};
177
[143]178#define SH_MOD_THREAD 1
179#define SH_MOD_ACTIVE 0
180#define SH_MOD_FAILED -1
[207]181#define SH_MOD_OFFSET 10
[156]182
[114]183/* Flags for file status
184 */
185#define SH_FFLAG_ALLIGNORE (1<<0)
186#define SH_FFLAG_VISITED (1<<1)
187#define SH_FFLAG_CHECKED (1<<3)
188#define SH_FFLAG_REPORTED (1<<3)
[115]189#define SH_FFLAG_SUIDCHK (1<<4)
[93]190
[114]191#define SH_FFLAG_ALLIGNORE_SET(a) (((a) & SH_FFLAG_ALLIGNORE) != 0)
192#define SET_SH_FFLAG_ALLIGNORE(a) ((a) |= SH_FFLAG_ALLIGNORE)
193#define CLEAR_SH_FFLAG_ALLIGNORE(a) ((a) &= ~SH_FFLAG_ALLIGNORE)
194
195#define SH_FFLAG_VISITED_SET(a) (((a) & SH_FFLAG_VISITED) != 0)
196#define SET_SH_FFLAG_VISITED(a) ((a) |= SH_FFLAG_VISITED)
197#define CLEAR_SH_FFLAG_VISITED(a) ((a) &= ~SH_FFLAG_VISITED)
198
199#define SH_FFLAG_CHECKED_SET(a) (((a) & SH_FFLAG_VISITED) != 0)
200#define SET_SH_FFLAG_CHECKED(a) ((a) |= SH_FFLAG_VISITED)
201#define CLEAR_SH_FFLAG_CHECKED(a) ((a) &= ~SH_FFLAG_VISITED)
202
203#define SH_FFLAG_REPORTED_SET(a) (((a) & SH_FFLAG_REPORTED) != 0)
204#define SET_SH_FFLAG_REPORTED(a) ((a) |= SH_FFLAG_REPORTED)
205#define CLEAR_SH_FFLAG_REPORTED(a) ((a) &= ~SH_FFLAG_REPORTED)
206
[115]207#define SH_FFLAG_SUIDCHK_SET(a) (((a) & SH_FFLAG_SUIDCHK) != 0)
208#define SET_SH_FFLAG_SUIDCHK(a) ((a) |= SH_FFLAG_SUIDCHK)
209#define CLEAR_SH_FFLAG_SUIDCHK(a) ((a) &= ~SH_FFLAG_SUIDCHK)
[114]210
[367]211/* Flags for inotify
212 */
213#define SH_INOTIFY_USE (1<<0)
214#define SH_INOTIFY_DOSCAN (1<<1)
215#define SH_INOTIFY_NEEDINIT (1<<2)
[373]216#define SH_INOTIFY_INSCAN (1<<3)
[433]217#define SH_INOTIFY_IFUSED(a) if ((sh.flag.inotify & SH_INOTIFY_USE) != 0) { a }
[114]218
[367]219
[1]220/**************************************************
221 *
222 * TYPEDEFS
223 *
224 **************************************************/
225
226enum {
227 SH_LEVEL_READONLY = 1,
228 SH_LEVEL_LOGFILES = 2,
229 SH_LEVEL_LOGGROW = 3,
230 SH_LEVEL_NOIGNORE = 4,
231 SH_LEVEL_ALLIGNORE = 5,
232 SH_LEVEL_ATTRIBUTES = 6,
233 SH_LEVEL_USER0 = 7,
234 SH_LEVEL_USER1 = 8,
[27]235 SH_LEVEL_USER2 = 9,
236 SH_LEVEL_USER3 = 10,
237 SH_LEVEL_USER4 = 11,
238 SH_LEVEL_PRELINK = 12
[1]239};
240
241typedef struct {
242 time_t alarm_interval;
243 time_t alarm_last;
244} sh_timer_t;
245
246typedef struct {
247 char path[SH_PATHBUF];
248 char hash[KEY_LEN+1];
249} sh_sh_df;
250
251typedef struct {
252 char user[USER_MAX];
253 char group[GROUP_MAX];
254 char home[SH_PATHBUF];
255 uid_t uid;
256 gid_t gid;
257} sh_sh_user;
258
259typedef struct {
260 char name[SH_PATHBUF]; /* local hostname */
261 char system[SH_MINIBUF]; /* system */
262 char release[SH_MINIBUF]; /* release */
263 char machine[SH_MINIBUF]; /* machine */
264} sh_sh_local;
265
266typedef struct {
267 char name[SH_PATHBUF];
268 char alt[SH_PATHBUF];
269} sh_sh_remote;
270
271typedef struct {
272 unsigned long bytes_hashed; /* bytes last check */
273 unsigned long bytes_speed; /* bytes/sec last check */
274 unsigned long mail_success; /* mails sent */
275 unsigned long mail_failed; /* mails not sent */
276 time_t time_start; /* start last check */
277 time_t time_check; /* time last check */
278 unsigned long dirs_checked; /* #dirs last check */
279 unsigned long files_checked; /* #files last check */
[405]280 unsigned long files_report; /* #file reports */
281 unsigned long files_error; /* #file access error */
282 unsigned long files_nodir; /* #file not a directory*/
[1]283} sh_sh_stat;
284
285typedef struct {
286 int exit; /* exit value */
287 int checkSum; /* whether to init/check checksums */
288 int update; /* update db */
289 int opts; /* reading cl options */
[256]290 int started; /* finished with startup stuff */
[1]291 int isdaemon; /* daemon or not */
292 int loop; /* go in loop even if not daemon */
293 int nice; /* desired nicety */
294 int isserver; /* server or not */
295 int islocked; /* BAD if logfile not locked */
296 int smsg; /* GOOD if end message sent */
297 int log_start; /* TRUE if new audit trail */
298 int reportonce; /* TRUE if bad files only once rep.*/
299 int fulldetail; /* TRUE if full details requested */
300 int client_severity; /* TRUE if client severity used */
301 int client_class; /* TRUE if client class used */
302 int audit;
303 unsigned long aud_mask;
[367]304 int hidefile; /* TRUE if file not shown in log */
305 int inotify; /* Flags for inotify */
[1]306} sh_sh_flag;
307
308typedef struct {
309
310 char prg_name[8];
[162]311
312 UINT64 pid;
[1]313
314 sh_sh_df exec;
315 sh_sh_df conf;
316 sh_sh_df data;
317
318 sh_sh_user real;
319 sh_sh_user effective;
320 sh_sh_user run;
321
322 sh_sh_local host;
323
324 sh_sh_remote srvtime;
325 sh_sh_remote srvmail;
326 sh_sh_remote srvexport;
327 sh_sh_remote srvcons;
328 sh_sh_remote srvlog;
329
330 sh_sh_stat statistics;
331 sh_sh_flag flag;
332
333#ifdef SH_STEALTH
334 unsigned long off_data;
335#endif
336
337 sh_timer_t mailNum;
338 sh_timer_t mailTime;
339 sh_timer_t fileCheck;
340
341 int looptime; /* timing for main loop */
342 /*@null@*//*@out@*/ char * timezone;
[411]343
344#ifdef SCREW_IT_UP
345 int sigtrap_max_duration;
346#endif
347
[1]348} sh_struct;
349
350
351extern volatile int sig_raised;
352extern volatile int sig_urgent;
353extern volatile int sig_debug_switch; /* SIGUSR1 */
354extern volatile int sig_suspend_switch; /* SIGUSR2 */
[143]355extern volatile int sh_global_suspend_flag;
[1]356extern volatile int sig_fresh_trail; /* SIGIOT */
[143]357extern volatile int sh_thread_pause_flag;
[1]358extern volatile int sig_config_read_again; /* SIGHUP */
359extern volatile int sig_terminate; /* SIGQUIT */
360extern volatile int sig_termfast; /* SIGTERM */
361extern volatile int sig_force_check; /* SIGTTOU */
362
363extern long int eintr__result;
364
[20]365extern int sh_argc_store;
366extern char ** sh_argv_store;
367
[1]368#include "sh_calls.h"
369
370
371typedef struct {
[40]372 char sh_sockpass[2*SOCKPASS_MAX+2];
[1]373 char sigkey_old[KEY_LEN+1];
374 char sigkey_new[KEY_LEN+1];
375 char mailkey_old[KEY_LEN+1];
376 char mailkey_new[KEY_LEN+1];
377 char crypt[KEY_LEN+1];
378 char session[KEY_LEN+1];
379 char vernam[KEY_LEN+1];
380 int mlock_failed;
381
382 char pw[PW_LEN];
383
384 char poolv[KEY_BYT];
385 int poolc;
386
387 int rngI;
388 UINT32 rng0[3];
389 UINT32 rng1[3];
390 UINT32 rng2[3];
391
[156]392 UINT32 res_vec[6];
393
[1]394 UINT32 ErrFlag[2];
395
396#ifdef SH_ENCRYPT
397 /*@out@*/ keyInstance keyInstE;
398 /*@out@*/ keyInstance keyInstD;
399#endif
400} sh_key_t;
401
402extern sh_struct sh;
403/*@null@*/ extern sh_key_t *skey;
404
[22]405/**************************************************
406 *
407 * macros
408 *
409 **************************************************/
[1]410
[76]411#if defined(__GNUC__) && (__GNUC__ >= 4)
[149]412#define SH_GNUC_SENTINEL __attribute__((__sentinel__))
[76]413#else
[149]414#define SH_GNUC_SENTINEL
[76]415#endif
416
[149]417#if defined(__GNUC__) && (__GNUC__ >= 3)
418#undef SH_GNUC_PURE
419#define SH_GNUC_PURE __attribute__((pure))
420#undef SH_GNUC_CONST
421#define SH_GNUC_CONST __attribute__((const))
422#undef SH_GNUC_NORETURN
423#define SH_GNUC_NORETURN __attribute__((noreturn))
424#undef SH_GNUC_MALLOC
425#define SH_GNUC_MALLOC __attribute__((malloc))
426#else
427#undef SH_GNUC_PURE
428#define SH_GNUC_PURE
429#undef SH_GNUC_CONST
430#define SH_GNUC_CONST
431#undef SH_GNUC_NORETURN
432#define SH_GNUC_NORETURN
433#undef SH_GNUC_MALLOC
434#define SH_GNUC_MALLOC
435#endif
436
437
[76]438/* The semantics of the built-in are that it is expected that expr == const
439 * for __builtin_expect ((expr), const)
440 */
441#if defined(__GNUC__) && (__GNUC__ > 2) && defined(__OPTIMIZE__)
442#define SH_LIKELY(expr) (__builtin_expect((expr), 1))
443#define SH_UNLIKELY(expr) (__builtin_expect((expr), 0))
444#else
445#define SH_LIKELY(expr) (expr)
446#define SH_UNLIKELY(expr) (expr)
447#endif
448
[22]449/* signal-safe log function
450 */
[170]451int safe_logger (int thesignal, int method, char * details);
452void safe_fatal (const char * details, const char *f, int l);
[22]453
[25]454#define SH_VALIDATE_EQ(a,b) \
[22]455 do { \
[34]456 if ((a) != (b)) safe_fatal(#a " != " #b, FIL__, __LINE__);\
[22]457 } while (0)
458
[25]459#define SH_VALIDATE_NE(a,b) \
460 do { \
[34]461 if ((a) == (b)) safe_fatal(#a " == " #b, FIL__, __LINE__);\
[25]462 } while (0)
[22]463
[68]464#define SH_VALIDATE_GE(a,b) \
465 do { \
466 if ((a) < (b)) safe_fatal(#a " < " #b, FIL__, __LINE__);\
467 } while (0)
468
[1]469#if defined(HAVE_MLOCK) && !defined(HAVE_BROKEN_MLOCK)
[412]470#ifdef USE_SUID
[1]471#define MLOCK(a, b) \
472 if ((skey != NULL) && skey->mlock_failed == SL_FALSE){ \
473 (void) sl_set_suid(); \
[19]474 if (sh_unix_mlock(FIL__, __LINE__, a, b) < 0) skey->mlock_failed = SL_TRUE; \
[412]475 (void) sl_unset_suid(); }
[1]476#else
477#define MLOCK(a, b) \
[412]478 if ((skey != NULL) && skey->mlock_failed == SL_FALSE){ \
479 if (sh_unix_mlock(FIL__, __LINE__, a, b) < 0) skey->mlock_failed = SL_TRUE; }
480#endif
481#else
482#define MLOCK(a, b) \
[1]483 ;
484#endif
485
486#if defined(HAVE_MLOCK) && !defined(HAVE_BROKEN_MLOCK)
[412]487#ifdef USE_SUID
[1]488#define MUNLOCK(a, b) \
489 if ((skey != NULL) && skey->mlock_failed == SL_FALSE){ \
490 (void) sl_set_suid(); \
491 (void) sh_unix_munlock( a, b );\
[412]492 (void) sl_unset_suid(); }
[1]493#else
494#define MUNLOCK(a, b) \
[412]495 if ((skey != NULL) && skey->mlock_failed == SL_FALSE){ \
496 (void) sh_unix_munlock( a, b ); }
497#endif
498#else
499#define MUNLOCK(a, b) \
[1]500 ;
501#endif
502
503#ifdef SH_STEALTH
504void sh_do_encode (char * str, int len);
505#define sh_do_decode sh_do_encode
506#endif
507
508/* #if defined(SCREW_IT_UP)
509 * extern volatile int sh_not_traced;
510 * inline int sh_sigtrap_prepare();
511 * inline int sh_derr();
512 * #endif
513 */
514
515#if defined(SCREW_IT_UP) && (defined(__FreeBSD__) || defined(__linux__)) && defined(__i386__)
516#define BREAKEXIT(expr) \
517 do { \
518 int ixi; \
519 for (ixi = 0; ixi < 8; ++ixi) { \
520 if ((*(volatile unsigned *)((unsigned) expr + ixi) & 0xff) == 0xcc) \
521 _exit(EXIT_FAILURE); \
522 } \
523 } \
524 while (1 == 0)
525#else
526#define BREAKEXIT(expr)
527#endif
528
529
530
531#include "sh_cat.h"
532#include "sh_trace.h"
533#include "sh_mem.h"
534
535#endif
536
537/* CRIT: */
538/* NEW_CLIENT <client> */
539/* BAD_CLIENT <client> -- <details> */
540/* ERR_CLIENT <client> -- <details> */
541
542/* ALERT: */
543/* LOG_KEY samhain|yule <key> */
544/* STARTUP samhain|yule -- user <username> */
545/* EXIT samhain|yule */
546/* GOODSIG <file> <user> */
547/* FP_KEY <fingerprint> */
548/* GOODSIG_DAT <file> <user> */
549/* FP_KEY_DAT <fingerprint> */
550/* TIGER_CFG <file> <checksum> */
551/* TIGER_DAT <file> <checksum> */
552
553/* PANIC -- <details> */
554/* ERROR -- <details> */
555
556/* Policy */
557/* POLICY <code> <file> */
558/* <code> = MISSING || ADDED || NOT_A_DIRECTORY || <policy> */
559
560
561
Note: See TracBrowser for help on using the repository browser.