source: trunk/include/samhain.h@ 413

Last change on this file since 413 was 412, checked in by katerina, 12 years ago

Enhancements for ticket #312 (logrotate) and #313 (--enable-suid).
File size: 14.7 KB
Line 
1/* SAMHAIN file system integrity testing */
2/* Copyright (C) 1999 Rainer Wichmann */
3/* */
4/* This program is free software; you can redistribute it */
5/* and/or modify */
6/* it under the terms of the GNU General Public License as */
7/* published by */
8/* the Free Software Foundation; either version 2 of the License, or */
9/* (at your option) any later version. */
10/* */
11/* This program is distributed in the hope that it will be useful, */
12/* but WITHOUT ANY WARRANTY; without even the implied warranty of */
13/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
14/* GNU General Public License for more details. */
15/* */
16/* You should have received a copy of the GNU General Public License */
17/* along with this program; if not, write to the Free Software */
18/* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
19
20#ifndef SAMHAIN_H
21#define SAMHAIN_H
22
23#include <sys/types.h>
24#include "slib.h"
25
26#ifdef SH_ENCRYPT
27#include "rijndael-api-fst.h"
28#endif
29
30/**************************************************
31 *
32 * STANDARD DEFINES
33 *
34 **************************************************/
35
36/* IPv6 */
37#if defined(HAVE_GETNAMEINFO) && defined(HAVE_GETADDRINFO)
38
39#if defined(SH_COMPILE_STATIC) && defined(__linux__)
40#undef USE_IPVX
41#define SH_SOCKMAX 1
42#else
43
44#if defined(USE_IPV4)
45#undef USE_IPVX
46#else
47#define USE_IPVX 1
48#endif
49
50#define SH_SOCKMAX 8
51#endif
52
53#else
54#undef USE_IPVX
55#define SH_SOCKMAX 1
56#endif
57
58/* end IPv6 */
59
60#define REPLACE_OLD
61
62/* Standard buffer sizes.
63 * IPv6 is 8 groups of 4 hex digits seperated by colons.
64 */
65#define SH_IP_BUF 48
66#define SH_MINIBUF 64
67#define SH_BUFSIZE 1024
68#define SH_MAXBUF 4096
69#define SH_PATHBUF 256
70#define SH_MSG_BUF 64512
71
72#define SH_ERRBUF_SIZE 64
73
74/* MAX_PATH_STORE must be >= KEY_LEN
75 */
76#define MAX_PATH_STORE 12287
77
78/* Sizes for arrays (user, group, timestamp).
79 */
80#define SOCKPASS_MAX 14
81#define USER_MAX 20
82#define GROUP_MAX 20
83#define TIM_MAX 32
84
85#define CMODE_SIZE 11
86
87#define ATTRBUF_SIZE 16
88#define ATTRBUF_USED 12
89
90/* The number of bytes in a key,
91 * the number of chars in its hex repesentation,
92 * and the block size of the hash algorithm.
93 */
94#define KEY_BYT 24
95#define KEY_LEN 48
96#define KEY_BLOCK 24
97#define KEYBUF_SIZE (KEY_LEN+1)
98
99/* The length of the compiled-in password.
100 */
101#define PW_LEN 8
102
103#undef GOOD
104#define GOOD 1
105#undef BAD
106#define BAD 0
107#undef ON
108#define ON 1
109#undef OFF
110#define OFF 0
111#undef S_TRUE
112#define S_TRUE 1
113#undef S_FALSE
114#define S_FALSE 0
115
116/* An unsigned integer guaranteed to be 32 bit.
117 */
118#if defined(HAVE_INT_32)
119#define UINT32 unsigned int
120#define SINT32 int
121#elif defined(HAVE_LONG_32)
122#define UINT32 unsigned long
123#define SINT32 long
124#elif defined(HAVE_SHORT_32)
125#define UINT32 unsigned short
126#define SINT32 short
127#endif
128
129#ifdef HAVE_INTTYPES_H
130#include <inttypes.h>
131#endif
132#ifdef HAVE_STDINT_H
133#include <stdint.h>
134#endif
135
136#if !defined(HAVE_UINT16_T)
137#define UINT16 unsigned short
138#else
139#define UINT16 uint16_t
140#endif
141
142#if !defined(HAVE_UINT64_T)
143
144#ifdef HAVE_LONG_LONG_64
145#define UINT64 unsigned long long
146#else
147#ifdef HAVE_LONG_64
148#define UINT64 unsigned long
149#else
150#error "no 64bit type found"
151#endif
152#endif
153
154#else
155#define UINT64 uint64_t
156#endif
157
158
159
160#define UBYTE unsigned char
161
162
163enum {
164 SH_CHECK_NONE = 0,
165 SH_CHECK_INIT = 1,
166 SH_CHECK_CHECK = 2
167};
168
169#define SH_MOD_THREAD 1
170#define SH_MOD_ACTIVE 0
171#define SH_MOD_FAILED -1
172#define SH_MOD_OFFSET 10
173
174/* Flags for file status
175 */
176#define SH_FFLAG_ALLIGNORE (1<<0)
177#define SH_FFLAG_VISITED (1<<1)
178#define SH_FFLAG_CHECKED (1<<3)
179#define SH_FFLAG_REPORTED (1<<3)
180#define SH_FFLAG_SUIDCHK (1<<4)
181
182#define SH_FFLAG_ALLIGNORE_SET(a) (((a) & SH_FFLAG_ALLIGNORE) != 0)
183#define SET_SH_FFLAG_ALLIGNORE(a) ((a) |= SH_FFLAG_ALLIGNORE)
184#define CLEAR_SH_FFLAG_ALLIGNORE(a) ((a) &= ~SH_FFLAG_ALLIGNORE)
185
186#define SH_FFLAG_VISITED_SET(a) (((a) & SH_FFLAG_VISITED) != 0)
187#define SET_SH_FFLAG_VISITED(a) ((a) |= SH_FFLAG_VISITED)
188#define CLEAR_SH_FFLAG_VISITED(a) ((a) &= ~SH_FFLAG_VISITED)
189
190#define SH_FFLAG_CHECKED_SET(a) (((a) & SH_FFLAG_VISITED) != 0)
191#define SET_SH_FFLAG_CHECKED(a) ((a) |= SH_FFLAG_VISITED)
192#define CLEAR_SH_FFLAG_CHECKED(a) ((a) &= ~SH_FFLAG_VISITED)
193
194#define SH_FFLAG_REPORTED_SET(a) (((a) & SH_FFLAG_REPORTED) != 0)
195#define SET_SH_FFLAG_REPORTED(a) ((a) |= SH_FFLAG_REPORTED)
196#define CLEAR_SH_FFLAG_REPORTED(a) ((a) &= ~SH_FFLAG_REPORTED)
197
198#define SH_FFLAG_SUIDCHK_SET(a) (((a) & SH_FFLAG_SUIDCHK) != 0)
199#define SET_SH_FFLAG_SUIDCHK(a) ((a) |= SH_FFLAG_SUIDCHK)
200#define CLEAR_SH_FFLAG_SUIDCHK(a) ((a) &= ~SH_FFLAG_SUIDCHK)
201
202/* Flags for inotify
203 */
204#define SH_INOTIFY_USE (1<<0)
205#define SH_INOTIFY_DOSCAN (1<<1)
206#define SH_INOTIFY_NEEDINIT (1<<2)
207#define SH_INOTIFY_INSCAN (1<<3)
208
209
210/**************************************************
211 *
212 * TYPEDEFS
213 *
214 **************************************************/
215
216enum {
217 SH_LEVEL_READONLY = 1,
218 SH_LEVEL_LOGFILES = 2,
219 SH_LEVEL_LOGGROW = 3,
220 SH_LEVEL_NOIGNORE = 4,
221 SH_LEVEL_ALLIGNORE = 5,
222 SH_LEVEL_ATTRIBUTES = 6,
223 SH_LEVEL_USER0 = 7,
224 SH_LEVEL_USER1 = 8,
225 SH_LEVEL_USER2 = 9,
226 SH_LEVEL_USER3 = 10,
227 SH_LEVEL_USER4 = 11,
228 SH_LEVEL_PRELINK = 12
229};
230
231typedef struct {
232 time_t alarm_interval;
233 time_t alarm_last;
234} sh_timer_t;
235
236typedef struct {
237 char path[SH_PATHBUF];
238 char hash[KEY_LEN+1];
239} sh_sh_df;
240
241typedef struct {
242 char user[USER_MAX];
243 char group[GROUP_MAX];
244 char home[SH_PATHBUF];
245 uid_t uid;
246 gid_t gid;
247} sh_sh_user;
248
249typedef struct {
250 char name[SH_PATHBUF]; /* local hostname */
251 char system[SH_MINIBUF]; /* system */
252 char release[SH_MINIBUF]; /* release */
253 char machine[SH_MINIBUF]; /* machine */
254} sh_sh_local;
255
256typedef struct {
257 char name[SH_PATHBUF];
258 char alt[SH_PATHBUF];
259} sh_sh_remote;
260
261typedef struct {
262 unsigned long bytes_hashed; /* bytes last check */
263 unsigned long bytes_speed; /* bytes/sec last check */
264 unsigned long mail_success; /* mails sent */
265 unsigned long mail_failed; /* mails not sent */
266 time_t time_start; /* start last check */
267 time_t time_check; /* time last check */
268 unsigned long dirs_checked; /* #dirs last check */
269 unsigned long files_checked; /* #files last check */
270 unsigned long files_report; /* #file reports */
271 unsigned long files_error; /* #file access error */
272 unsigned long files_nodir; /* #file not a directory*/
273} sh_sh_stat;
274
275typedef struct {
276 int exit; /* exit value */
277 int checkSum; /* whether to init/check checksums */
278 int update; /* update db */
279 int opts; /* reading cl options */
280 int started; /* finished with startup stuff */
281 int isdaemon; /* daemon or not */
282 int loop; /* go in loop even if not daemon */
283 int nice; /* desired nicety */
284 int isserver; /* server or not */
285 int islocked; /* BAD if logfile not locked */
286 int smsg; /* GOOD if end message sent */
287 int log_start; /* TRUE if new audit trail */
288 int reportonce; /* TRUE if bad files only once rep.*/
289 int fulldetail; /* TRUE if full details requested */
290 int client_severity; /* TRUE if client severity used */
291 int client_class; /* TRUE if client class used */
292 int audit;
293 unsigned long aud_mask;
294 int hidefile; /* TRUE if file not shown in log */
295 int inotify; /* Flags for inotify */
296} sh_sh_flag;
297
298typedef struct {
299
300 char prg_name[8];
301
302 UINT64 pid;
303
304 sh_sh_df exec;
305 sh_sh_df conf;
306 sh_sh_df data;
307
308 sh_sh_user real;
309 sh_sh_user effective;
310 sh_sh_user run;
311
312 sh_sh_local host;
313
314 sh_sh_remote srvtime;
315 sh_sh_remote srvmail;
316 sh_sh_remote srvexport;
317 sh_sh_remote srvcons;
318 sh_sh_remote srvlog;
319
320 sh_sh_stat statistics;
321 sh_sh_flag flag;
322
323#ifdef SH_STEALTH
324 unsigned long off_data;
325#endif
326
327 sh_timer_t mailNum;
328 sh_timer_t mailTime;
329 sh_timer_t fileCheck;
330
331 int looptime; /* timing for main loop */
332 /*@null@*//*@out@*/ char * timezone;
333
334#ifdef SCREW_IT_UP
335 int sigtrap_max_duration;
336#endif
337
338} sh_struct;
339
340
341extern volatile int sig_raised;
342extern volatile int sig_urgent;
343extern volatile int sig_debug_switch; /* SIGUSR1 */
344extern volatile int sig_suspend_switch; /* SIGUSR2 */
345extern volatile int sh_global_suspend_flag;
346extern volatile int sig_fresh_trail; /* SIGIOT */
347extern volatile int sh_thread_pause_flag;
348extern volatile int sig_config_read_again; /* SIGHUP */
349extern volatile int sig_terminate; /* SIGQUIT */
350extern volatile int sig_termfast; /* SIGTERM */
351extern volatile int sig_force_check; /* SIGTTOU */
352
353extern long int eintr__result;
354
355extern int sh_argc_store;
356extern char ** sh_argv_store;
357
358#include "sh_calls.h"
359
360
361typedef struct {
362 char sh_sockpass[2*SOCKPASS_MAX+2];
363 char sigkey_old[KEY_LEN+1];
364 char sigkey_new[KEY_LEN+1];
365 char mailkey_old[KEY_LEN+1];
366 char mailkey_new[KEY_LEN+1];
367 char crypt[KEY_LEN+1];
368 char session[KEY_LEN+1];
369 char vernam[KEY_LEN+1];
370 int mlock_failed;
371
372 char pw[PW_LEN];
373
374 char poolv[KEY_BYT];
375 int poolc;
376
377 int rngI;
378 UINT32 rng0[3];
379 UINT32 rng1[3];
380 UINT32 rng2[3];
381
382 UINT32 res_vec[6];
383
384 UINT32 ErrFlag[2];
385
386#ifdef SH_ENCRYPT
387 /*@out@*/ keyInstance keyInstE;
388 /*@out@*/ keyInstance keyInstD;
389#endif
390} sh_key_t;
391
392extern sh_struct sh;
393/*@null@*/ extern sh_key_t *skey;
394
395/**************************************************
396 *
397 * macros
398 *
399 **************************************************/
400
401#if defined(__GNUC__) && (__GNUC__ >= 4)
402#define SH_GNUC_SENTINEL __attribute__((__sentinel__))
403#else
404#define SH_GNUC_SENTINEL
405#endif
406
407#if defined(__GNUC__) && (__GNUC__ >= 3)
408#undef SH_GNUC_PURE
409#define SH_GNUC_PURE __attribute__((pure))
410#undef SH_GNUC_CONST
411#define SH_GNUC_CONST __attribute__((const))
412#undef SH_GNUC_NORETURN
413#define SH_GNUC_NORETURN __attribute__((noreturn))
414#undef SH_GNUC_MALLOC
415#define SH_GNUC_MALLOC __attribute__((malloc))
416#else
417#undef SH_GNUC_PURE
418#define SH_GNUC_PURE
419#undef SH_GNUC_CONST
420#define SH_GNUC_CONST
421#undef SH_GNUC_NORETURN
422#define SH_GNUC_NORETURN
423#undef SH_GNUC_MALLOC
424#define SH_GNUC_MALLOC
425#endif
426
427
428/* The semantics of the built-in are that it is expected that expr == const
429 * for __builtin_expect ((expr), const)
430 */
431#if defined(__GNUC__) && (__GNUC__ > 2) && defined(__OPTIMIZE__)
432#define SH_LIKELY(expr) (__builtin_expect((expr), 1))
433#define SH_UNLIKELY(expr) (__builtin_expect((expr), 0))
434#else
435#define SH_LIKELY(expr) (expr)
436#define SH_UNLIKELY(expr) (expr)
437#endif
438
439/* signal-safe log function
440 */
441int safe_logger (int thesignal, int method, char * details);
442void safe_fatal (const char * details, const char *f, int l);
443
444#define SH_VALIDATE_EQ(a,b) \
445 do { \
446 if ((a) != (b)) safe_fatal(#a " != " #b, FIL__, __LINE__);\
447 } while (0)
448
449#define SH_VALIDATE_NE(a,b) \
450 do { \
451 if ((a) == (b)) safe_fatal(#a " == " #b, FIL__, __LINE__);\
452 } while (0)
453
454#define SH_VALIDATE_GE(a,b) \
455 do { \
456 if ((a) < (b)) safe_fatal(#a " < " #b, FIL__, __LINE__);\
457 } while (0)
458
459#if defined(HAVE_MLOCK) && !defined(HAVE_BROKEN_MLOCK)
460#ifdef USE_SUID
461#define MLOCK(a, b) \
462 if ((skey != NULL) && skey->mlock_failed == SL_FALSE){ \
463 (void) sl_set_suid(); \
464 if (sh_unix_mlock(FIL__, __LINE__, a, b) < 0) skey->mlock_failed = SL_TRUE; \
465 (void) sl_unset_suid(); }
466#else
467#define MLOCK(a, b) \
468 if ((skey != NULL) && skey->mlock_failed == SL_FALSE){ \
469 if (sh_unix_mlock(FIL__, __LINE__, a, b) < 0) skey->mlock_failed = SL_TRUE; }
470#endif
471#else
472#define MLOCK(a, b) \
473 ;
474#endif
475
476#if defined(HAVE_MLOCK) && !defined(HAVE_BROKEN_MLOCK)
477#ifdef USE_SUID
478#define MUNLOCK(a, b) \
479 if ((skey != NULL) && skey->mlock_failed == SL_FALSE){ \
480 (void) sl_set_suid(); \
481 (void) sh_unix_munlock( a, b );\
482 (void) sl_unset_suid(); }
483#else
484#define MUNLOCK(a, b) \
485 if ((skey != NULL) && skey->mlock_failed == SL_FALSE){ \
486 (void) sh_unix_munlock( a, b ); }
487#endif
488#else
489#define MUNLOCK(a, b) \
490 ;
491#endif
492
493#ifdef SH_STEALTH
494void sh_do_encode (char * str, int len);
495#define sh_do_decode sh_do_encode
496#endif
497
498/* #if defined(SCREW_IT_UP)
499 * extern volatile int sh_not_traced;
500 * inline int sh_sigtrap_prepare();
501 * inline int sh_derr();
502 * #endif
503 */
504
505#if defined(SCREW_IT_UP) && (defined(__FreeBSD__) || defined(__linux__)) && defined(__i386__)
506#define BREAKEXIT(expr) \
507 do { \
508 int ixi; \
509 for (ixi = 0; ixi < 8; ++ixi) { \
510 if ((*(volatile unsigned *)((unsigned) expr + ixi) & 0xff) == 0xcc) \
511 _exit(EXIT_FAILURE); \
512 } \
513 } \
514 while (1 == 0)
515#else
516#define BREAKEXIT(expr)
517#endif
518
519
520
521#include "sh_cat.h"
522#include "sh_trace.h"
523#include "sh_mem.h"
524
525#endif
526
527/* CRIT: */
528/* NEW_CLIENT <client> */
529/* BAD_CLIENT <client> -- <details> */
530/* ERR_CLIENT <client> -- <details> */
531
532/* ALERT: */
533/* LOG_KEY samhain|yule <key> */
534/* STARTUP samhain|yule -- user <username> */
535/* EXIT samhain|yule */
536/* GOODSIG <file> <user> */
537/* FP_KEY <fingerprint> */
538/* GOODSIG_DAT <file> <user> */
539/* FP_KEY_DAT <fingerprint> */
540/* TIGER_CFG <file> <checksum> */
541/* TIGER_DAT <file> <checksum> */
542
543/* PANIC -- <details> */
544/* ERROR -- <details> */
545
546/* Policy */
547/* POLICY <code> <file> */
548/* <code> = MISSING || ADDED || NOT_A_DIRECTORY || <policy> */
549
550
551
Note: See TracBrowser for help on using the repository browser.