source: trunk/src/sh_entropy.c@ 126

Last change on this file since 126 was 102, checked in by rainer, 18 years ago

Flush before fork (fix for ticket #60), and fix for kcheck on 2.6.21 (ticket #63).
File size: 21.9 KB
RevLine 
[1]1/* SAMHAIN file system integrity testing */
2/* Copyright (C) 1999, 2000 Rainer Wichmann */
3/* */
4/* This program is free software; you can redistribute it */
5/* and/or modify */
6/* it under the terms of the GNU General Public License as */
7/* published by */
8/* the Free Software Foundation; either version 2 of the License, or */
9/* (at your option) any later version. */
10/* */
11/* This program is distributed in the hope that it will be useful, */
12/* but WITHOUT ANY WARRANTY; without even the implied warranty of */
13/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
14/* GNU General Public License for more details. */
15/* */
16/* You should have received a copy of the GNU General Public License */
17/* along with this program; if not, write to the Free Software */
18/* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
19
20
21#include "config_xor.h"
22
23#include <stdio.h>
24#include <string.h>
25
26#include <sys/types.h>
27
28#ifdef HAVE_MEMORY_H
29#include <memory.h>
30#endif
31
32#if TIME_WITH_SYS_TIME
33#include <sys/time.h>
34#include <time.h>
35#else
36#if HAVE_SYS_TIME_H
37#include <sys/time.h>
38#else
39#include <time.h>
40#endif
41#endif
42
43
44#include <stdlib.h>
45#include <pwd.h>
46#include <unistd.h>
47#include <fcntl.h>
48#include <signal.h>
49#include <sys/stat.h>
50#include <errno.h>
51#include <sys/wait.h>
52
53
54#ifdef HAVE_SYS_SELECT_H
55#include <sys/select.h>
56#endif
57#include <sys/types.h>
58
59
60
61#include "samhain.h"
62#include "sh_utils.h"
63#include "sh_unix.h"
64#include "sh_tiger.h"
65#include "sh_calls.h"
66
67#undef FIL__
68#define FIL__ _("sh_entropy.c")
69
70#if defined (HAVE_EGD_RANDOM)
71/* rndegd.c - interface to the EGD
72 * Copyright (C) 1999, 2000, 2001 Free Software Foundation, Inc.
73 */
74#include <stddef.h>
75#include <sys/socket.h>
76#include <sys/un.h>
77
78static int
79do_write( int fd, void *buf, size_t nbytes )
80{
81 size_t nleft = nbytes;
82 int nwritten;
83
84 while( nleft > 0 ) {
85 nwritten = write( fd, buf, nleft);
86 if( nwritten < 0 ) {
87 if( errno == EINTR )
88 continue;
89 return -1;
90 }
91 nleft -= nwritten;
92 buf = (char*)buf + nwritten;
93 }
94 return 0;
95}
96
97static int
98do_read( int fd, void *buf, int nbytes )
99{
100 int n, nread = 0;
101
102 if (nbytes < 0)
103 return 0;
104
105 do {
106 do {
107 n = read(fd, (char*)buf + nread, nbytes );
108 } while( n == -1 && errno == EINTR );
109 if( n == -1 )
110 return -1;
111 nread += n;
112 } while( nread < nbytes );
113 return nbytes;
114}
115
116
117int sh_entropy(int getbytes, char * nbuf)
118{
119 static int fd = -1;
120 int n;
121 byte buffer[256+2];
122 int nbytes;
123 int do_restart = 0;
124 int myerror = 0;
125 int length;
126 char * p = nbuf;
127 int i;
128
129 SL_ENTER(_("sh_entropy"));
130
131 if( getbytes <= 0)
132 SL_RETURN( -1, _("sh_entropy"));
133 if (getbytes > KEY_BYT)
134 getbytes = KEY_BYT;
135 length = getbytes;
136
137 restart:
138 if( do_restart ) {
139 if( fd != -1 ) {
140 close( fd );
141 fd = -1;
142 }
143 }
144 if( fd == -1 ) {
145 const char *bname = NULL;
146 char *name;
147 struct sockaddr_un addr;
148 int addr_len;
149
150 #ifdef EGD_SOCKET_NAME
151 bname = EGD_SOCKET_NAME;
152 #endif
153 if ( !bname || !*bname )
154 bname = _("=entropy");
155
156 if ( *bname == '=' && bname[1] )
157 name = sh_util_strconcat ( DEFAULT_DATAROOT, "/", bname+1 , NULL );
158 else
159 name = sh_util_strconcat ( bname , NULL );
160
161 if ( strlen(name)+1 >= sizeof(addr.sun_path) )
162 {
163 sh_error_handle ((-1), FIL__, __LINE__, ENAMETOOLONG, MSG_E_SUBGEN,
164 _("EGD socketname is too long"),
165 _("sh_entropy") );
166 SH_FREE(name);
167 SL_RETURN( -1, _("sh_entropy") );
168 }
169
170 memset( &addr, 0, sizeof(addr) );
171 addr.sun_family = AF_UNIX;
[22]172 sl_strlcpy( addr.sun_path, name, sizeof(addr.sun_path) );
[1]173 addr_len = offsetof( struct sockaddr_un, sun_path )
174 + strlen( addr.sun_path );
175
176 fd = socket(AF_UNIX, SOCK_STREAM, 0);
177 if( fd == -1 )
178 {
179 myerror = errno;
180 sh_error_handle ((-1), FIL__, __LINE__, myerror, MSG_E_SUBGEN,
181 _("cannot create unix domain socket"),
182 _("sh_entropy") );
183 SH_FREE(name);
184 SL_RETURN( -1, _("sh_entropy") );
185 }
186 if( connect( fd, (struct sockaddr*)&addr, addr_len) == -1 )
187 {
188 myerror = errno;
189 sh_error_handle ((-1), FIL__, __LINE__, myerror, MSG_E_SUBGEN,
190 _("cannot connect to unix domain socket"),
191 _("sh_entropy") );
192 SH_FREE(name);
193 SL_RETURN( -1, _("sh_entropy") );
194 }
195 SH_FREE(name);
196 }
197 do_restart = 0;
198
199 nbytes = length < 255? length : 255;
200 /* first time we do it with a non blocking request */
201 buffer[0] = 1; /* non blocking */
202 buffer[1] = nbytes;
203 if( do_write( fd, buffer, 2 ) == -1 )
204 {
205 myerror = errno;
206 sh_error_handle ((-1), FIL__, __LINE__, myerror, MSG_E_SUBGEN,
207 _("cannot write to EGD"),
208 _("sh_entropy") );
209 SL_RETURN( -1, _("sh_entropy") );
210 }
211 n = do_read( fd, buffer, 1 );
212 if( n == -1 ) {
213 myerror = errno;
214 sh_error_handle (SH_ERR_ALL, FIL__, __LINE__, myerror, MSG_E_SUBGEN,
215 _("read error on EGD"),
216 _("sh_entropy") );
217 do_restart = 1;
218 goto restart;
219 }
220 n = buffer[0];
221 if( n ) {
222 n = do_read( fd, buffer, n );
223 if( n == -1 ) {
224 myerror = errno;
225 sh_error_handle (SH_ERR_ALL, FIL__, __LINE__, myerror,MSG_E_SUBGEN,
226 _("read error on EGD"),
227 _("sh_entropy") );
228 do_restart = 1;
229 goto restart;
230 }
231 for (i = 0; i < n; ++i)
232 {
233 if (getbytes >= 0)
234 { *p = buffer[i]; ++p; --getbytes; }
235 }
236 length -= n;
237 }
238
239 while( length ) {
240 nbytes = length < 255? length : 255;
241
242 buffer[0] = 2; /* blocking */
243 buffer[1] = nbytes;
244 if( do_write( fd, buffer, 2 ) == -1 )
245 {
246 myerror = errno;
247 sh_error_handle ((-1), FIL__, __LINE__, myerror, MSG_E_SUBGEN,
248 _("cannot write to EGD"),
249 _("sh_entropy") );
250 SL_RETURN( -1, _("sh_entropy") );
251 }
252 n = do_read( fd, buffer, nbytes );
253 if( n == -1 ) {
254 myerror = errno;
255 sh_error_handle (SH_ERR_ALL, FIL__, __LINE__, myerror,MSG_E_SUBGEN,
256 _("read error on EGD"),
257 _("sh_entropy") );
258 do_restart = 1;
259 goto restart;
260 }
261 for (i = 0; i < n; ++i)
262 {
263 if (getbytes >= 0)
264 { *p = buffer[i]; ++p; --getbytes; }
265 }
266 length -= n;
267 }
268 memset(buffer, 0, sizeof(buffer) );
269
270 SL_RETURN( 0, _("sh_entropy") ); /* success */
271}
272
273/* HAVE_EGD_RANDOM */
274#endif
275
276#if defined (HAVE_URANDOM)
277
278#include <setjmp.h>
279
280static jmp_buf entropy_timeout;
281
282static void sh_entropy_alarmhandle (int mysignal)
283{
284 (void) mysignal; /* avoid compiler warning */
285 longjmp (entropy_timeout, 1);
286}
287
288
289int read_mbytes(int timeout_val, char * path, char * nbuf, int nbytes)
290{
291 int count, m_count;
292 int fd2;
293
294 struct sigaction new_act;
295 sigset_t unblock;
296
297 struct sigaction old_act;
298 volatile unsigned int old_alarm = 0;
299
300 new_act.sa_handler = sh_entropy_alarmhandle;
301 sigemptyset( &new_act.sa_mask ); /* set an empty mask */
302 new_act.sa_flags = 0; /* init sa_flags */
303
304 sigemptyset(&unblock);
305 sigaddset (&unblock, SIGALRM);
306
307 SL_ENTER(_("read_mbytes"));
308
309 if ((fd2 = aud_open (FIL__, __LINE__, SL_NOPRIV, path, O_RDONLY, 0)) >= 0)
310 {
311 /* Test whether file is a character device, and is
[78]312 * readable.
[1]313 */
[78]314 if (0 == sh_unix_device_readable(fd2))
[1]315 {
316
317 /* alarm was triggered
318 */
319 if (setjmp(entropy_timeout) != 0)
320 {
321 alarm(0);
322 sigaction (SIGALRM, &old_act, NULL);
323 alarm(old_alarm);
324 sigprocmask(SIG_UNBLOCK, &unblock, NULL);
325 TPT((0,FIL__,__LINE__, _("msg=<read_mbytes: timeout>\n")));
326 close (fd2);
327 SL_RETURN(0, _("read_mbytes"));
328 }
329
330 /* timeout after 30 seconds
331 */
332 old_alarm = alarm(0);
333 sigaction (SIGALRM, &new_act, &old_act);
334 alarm(timeout_val);
335
336 m_count = 0;
337
338 while (m_count < nbytes)
339 {
340 errno = 0; /* paranoia */
341 count = read (fd2, &nbuf[m_count], nbytes-m_count);
342
343 switch (count)
344 {
345 case -1:
346#ifdef EWOULDBLOCK
347 if (errno == EINTR || errno == EAGAIN ||
348 errno == EWOULDBLOCK)
349#else
350 if (errno == EINTR || errno == EAGAIN)
351#endif
352 continue;
353
354 /* if errno == -1 && no continue: fallthrough to this */
355 case 0:
356 break;
357 default:
358 m_count += count;
359 }
360 }
361 close (fd2);
362
363 alarm(0);
364 sigaction (SIGALRM, &old_act, NULL);
365 alarm(old_alarm);
366 sigprocmask(SIG_UNBLOCK, &unblock, NULL);
367 }
368 else
369 m_count = 0;
370 }
371 else
372 m_count = 0;
373
374 TPT((0, FIL__, __LINE__, _("msg=<read_mbytes: OK>\n")));
375 SL_RETURN(m_count, _("read_mbytes"));
376}
377
378/* Read nbytes bytes from /dev/random, mix them with
379 * previous reads using a hash function, and give out
380 * nbytes bytes from the result.
381 */
382int sh_entropy(int nbytes, char * nbuf)
383{
384 int i, m_count = 0;
385 char * keybuf;
386 char addbuf[2 * KEY_BYT];
387
388 SL_ENTER(_("sh_entropy"));
389
390 ASSERT((nbytes <= KEY_BYT), _("nbytes <= KEY_BYT"))
391
392 if (nbytes > KEY_BYT)
393 nbytes = KEY_BYT;
394
395 memset(nbuf, '\0', nbytes);
396
397#ifdef NAME_OF_DEV_URANDOM
398 m_count = read_mbytes (30, NAME_OF_DEV_RANDOM, nbuf, nbytes);
399#else
400 m_count = read_mbytes (300, NAME_OF_DEV_RANDOM, nbuf, nbytes);
401#endif
402
403 if (m_count == 0)
404 {
405#ifdef NAME_OF_DEV_URANDOM
406 sh_error_handle (SH_ERR_NOTICE, FIL__, __LINE__, EIO, MSG_NODEV,
407 (long) sh.real.uid, NAME_OF_DEV_RANDOM);
408#else
409 sh_error_handle ((-1), FIL__, __LINE__, EIO, MSG_NODEV,
410 (long) sh.real.uid, NAME_OF_DEV_RANDOM);
411#endif
412 }
413
414#ifdef NAME_OF_DEV_URANDOM
415 if (m_count < nbytes)
416 {
417 i = read_mbytes(30, NAME_OF_DEV_URANDOM, &nbuf[m_count], nbytes-m_count);
418 if (i == 0)
419 sh_error_handle ((-1), FIL__, __LINE__, EIO, MSG_NODEV,
420 (long) sh.real.uid, NAME_OF_DEV_URANDOM);
421 else
422 m_count += i;
423 }
424#endif
425
426
427 if (m_count > 0)
428 {
429 /* -- Add previous entropy into the new pool. --
430 */
431 memset(addbuf, '\0', sizeof(addbuf));
432 for (i = 0; i < m_count; ++i)
433 addbuf[i] = nbuf[i];
434 for (i = 0; i < KEY_BYT; ++i)
435 addbuf[i+KEY_BYT] = skey->poolv[i];
436 keybuf = (char *) sh_tiger_hash_uint32 (addbuf,
437 TIGER_DATA, 2 * KEY_BYT);
438 memset(addbuf, '\0', sizeof(addbuf));
439
440 /* -- Give out nbytes bytes from the new pool. --
441 */
442 for (i = 0; i < KEY_BYT; ++i)
443 {
444 skey->poolv[i] = keybuf[i];
445 if (i < nbytes)
446 nbuf[i] = keybuf[i];
447 }
448 memset (keybuf, '\0', KEY_BYT);
449
450 SL_RETURN(0, _("sh_entropy"));
451 }
452 else
453 {
454 SL_RETURN((-1), _("sh_entropy"));
455 }
456}
457
458/* HAVE_URANDOM */
459#endif
460
461#ifdef HAVE_UNIX_RANDOM
462
463#ifndef FD_SET
464#define NFDBITS 32
465#define FD_SET(n, p) ((p)->fds_bits[(n)/NFDBITS] |= (1 << ((n) % NFDBITS)))
466#define FD_CLR(n, p) ((p)->fds_bits[(n)/NFDBITS] &= ~(1 << ((n) % NFDBITS)))
467#define FD_ISSET(n, p) ((p)->fds_bits[(n)/NFDBITS] & (1 << ((n) % NFDBITS)))
468#endif /* !FD_SET */
469#ifndef FD_SETSIZE
470#define FD_SETSIZE 32
471#endif
472#ifndef FD_ZERO
473#define FD_ZERO(p) memset((char *)(p), '\0', sizeof(*(p)))
474#endif
475
476#include "sh_static.h"
477
478static
479char * com_path[] = {
[30]480 N_("/usr/bin/xpg4/"),
[1]481 N_("/usr/ucb/"),
482 N_("/bin/"),
483 N_("/sbin/"),
484 N_("/usr/bin/"),
485 N_("/usr/sbin/"),
486 N_("/usr/local/bin/"),
487 NULL
488};
489
490
491typedef struct {
492 char * command;
493 char * arg;
494 int pipeFD;
495 pid_t pid;
496 int isset;
497 FILE * pipe;
498} sourcetable_t;
499
500static
501sourcetable_t source[] = {
502 { N_("w"),
503 N_("w"),
504 0,
505 0,
506 0,
507 NULL },
508 { N_("netstat"),
509 N_("netstat -n"),
510 0,
511 0,
512 0,
513 NULL },
514 { N_("ps"),
515 N_("ps -ef"),
516 0,
517 0,
518 0,
519 NULL },
520 { N_("arp"),
521 N_("arp -a"),
522 0,
523 0,
524 0,
525 NULL },
526 { N_("free"),
527 N_("free"),
528 0,
529 0,
530 0,
531 NULL },
532 { N_("uptime"),
533 N_("uptime"),
534 0,
535 0,
536 0,
537 NULL },
538 { N_("procinfo"),
539 N_("procinfo -a"),
540 0,
541 0,
542 0,
543 NULL },
544 { N_("vmstat"),
545 N_("vmstat"),
546 0,
547 0,
548 0,
549 NULL },
550 { N_("w"), /* Play it again, Sam. */
551 N_("w"),
552 0,
553 0,
554 0,
555 NULL },
556 { NULL,
557 NULL,
558 0,
559 0,
560 0,
561 NULL }
562};
563
564
565static FILE * sh_popen (sourcetable_t *source, char * command)
566{
567 int i;
568 int pipedes[2];
569 FILE *outf = NULL;
570 struct passwd * tempres;
571 char * arg[4];
572 char * envp[2];
[22]573 size_t len;
[32]574 char arg0[80];
575 char arg1[80];
[1]576
577 SL_ENTER(_("sh_popen"));
578
[32]579 strncpy (arg0, _("/bin/sh"), sizeof(arg0));
580 arg[0] = arg0;
581 strncpy (arg1, _("-c"), sizeof(arg1));
582 arg[1] = arg1;
[1]583 arg[2] = command;
584 arg[3] = NULL;
585
586 if (sh.timezone != NULL)
587 {
[22]588 len = sl_strlen(sh.timezone) + 4;
589 envp[0] = malloc (len); /* free() ok */
[1]590 if (envp[0] != NULL)
[22]591 sl_snprintf (envp[0], len, "TZ=%s", sh.timezone);
[1]592 else
593 envp[0] = NULL;
594 envp[1] = NULL;
595 }
596 else
597 {
598 envp[0] = NULL;
599 }
600
601
602 /* Create the pipe
603 */
604 if (aud_pipe(FIL__, __LINE__, pipedes) < 0) {
605 if (envp[0] != NULL) free(envp[0]);
606 SL_RETURN(NULL, _("sh_popen"));
607 }
608
[102]609 fflush (NULL);
610
[1]611 source->pid = aud_fork(FIL__, __LINE__);
612
613 /* Failure
614 */
615 if (source->pid == (pid_t) - 1) {
616 close(pipedes[0]);
617 close(pipedes[1]);
618 if (envp[0] != NULL) free(envp[0]);
619 SL_RETURN(NULL, _("sh_popen"));
620 }
621
622 if (source->pid == (pid_t) 0)
623 {
624
625 /* child - make read side of the pipe stdout
626 */
627 if (retry_aud_dup2(FIL__, __LINE__,
628 pipedes[STDOUT_FILENO], STDOUT_FILENO) < 0)
629 aud__exit(FIL__, __LINE__, EXIT_FAILURE);
630
631 /* close the pipe descriptors
632 */
633 close (pipedes[STDIN_FILENO]);
634 close (pipedes[STDOUT_FILENO]);
635
636 /* don't leak file descriptors
637 */
638 sh_unix_closeall (3, -1); /* in child process */
639
640 /* zero priv info
641 */
642 memset(skey, 0, sizeof(sh_key_t));
643
644 /* drop root privileges
645 */
646 i = 0;
647 if (0 == geteuid()) {
648 tempres = sh_getpwnam(DEFAULT_IDENT);
649 if (NULL != tempres) {
650 i = aud_setgid(FIL__, __LINE__, tempres->pw_gid);
651 if (i == 0)
652 i = sh_unix_initgroups(DEFAULT_IDENT ,tempres->pw_gid);
653 if (i == 0)
654 i = aud_setuid(FIL__, __LINE__, tempres->pw_uid);
655 /* make sure we cannot get root again
656 */
657 if ((tempres->pw_uid != 0) && (aud_setuid(FIL__, __LINE__, 0) >= 0))
658 i = -1;
659 } else {
660 i = -1;
661 }
662 }
663
664 /* some problem ...
665 */
666 if (i == -1) {
667 aud__exit(FIL__, __LINE__, EXIT_FAILURE);
668 }
669
670 freopen (_("/dev/null"), "r+", stderr);
671
672 /* exec the program */
673 retry_aud_execve (FIL__, __LINE__, _("/bin/sh"), arg, envp);
674
675 /* failed
676 */
677 aud__exit(FIL__, __LINE__, EXIT_FAILURE);
678 }
679
680 /* parent
681 */
682 if (envp[0] != NULL)
683 free(envp[0]);
684
685 close (pipedes[STDOUT_FILENO]);
686 retry_fcntl (FIL__, __LINE__, pipedes[STDIN_FILENO], F_SETFD, FD_CLOEXEC);
687
688 outf = fdopen (pipedes[STDIN_FILENO], "r");
689
690 if (outf == NULL)
691 {
692 aud_kill (FIL__, __LINE__, source->pid, SIGKILL);
693 close (pipedes[STDOUT_FILENO]);
694 waitpid (source->pid, NULL, 0);
695 source->pid = 0;
696 SL_RETURN(NULL, _("sh_popen"));
697 }
698
699 SL_RETURN(outf, _("sh_popen"));
700}
701
702
703static int sh_pclose (sourcetable_t *source)
704{
705 int status = 0;
[32]706 int retval;
707 char msg[128];
[1]708
709 SL_ENTER(_("sh_pclose"));
710
[32]711 retval = fclose(source->pipe);
712 if (retval)
[1]713 {
[32]714 sh_error_handle (SH_ERR_ALL, FIL__, __LINE__, retval,
715 MSG_E_SUBGEN,
716 sh_error_message(retval),
717 _("sh_pclose"));
[1]718 SL_RETURN((-1), _("sh_pclose"));
719 }
720
[32]721 retval = waitpid(source->pid, &status, 0);
722 if (retval != source->pid)
723 {
724 sh_error_handle (SH_ERR_ALL, FIL__, __LINE__, retval,
725 MSG_E_SUBGEN,
726 sh_error_message(retval),
727 _("sh_pclose"));
[1]728
[32]729 status = -1;
730 }
731 else if (WIFSIGNALED(status))
732 {
733 sl_snprintf(msg, sizeof(msg), _("Subprocess terminated by signal %d"),
734 WTERMSIG(status));
735 sh_error_handle (SH_ERR_ALL, FIL__, __LINE__, retval,
736 MSG_E_SUBGEN,
737 msg,
738 _("sh_pclose"));
739 status = -1;
740 }
741
[1]742 source->pipe = NULL;
743 source->pid = 0;
744 SL_RETURN(status, _("sh_pclose"));
745}
746
747#define BUF_ENT 32766
748
749/* Poll the system for randomness, mix results with
750 * previous reads using a hash function, and give out
751 * nbytes bytes from the result.
752 */
753int sh_entropy(int nbytes, char * nbuf)
754{
755 int caperr;
756 char combuf[80];
757 char * buffer;
758 int i, j, icount;
759 int bufcount = 0;
760 int count;
761
762 char * keybuf;
763 char addbuf[2 * KEY_BYT];
764
765 struct timeval tv;
766 fd_set fds;
767 unsigned long select_now = 0;
768 int maxFD = 0;
769 int imax, selcount;
770
771 SL_ENTER(_("sh_entropy"));
772
773 ASSERT((nbytes <= KEY_BYT), _("nbytes <= KEY_BYT"))
774
775 if (nbytes > KEY_BYT)
776 nbytes = KEY_BYT;
777
778
779 /* --- If there is entropy in the pool, return it. ---
780 */
781 if (skey->poolc >= nbytes)
782 {
783 j = KEY_BYT - skey->poolc;
784 for (i = 0; i < nbytes; ++i)
785 {
786 nbuf[i] = skey->poolv[i+j];
787 --skey->poolc;
788 }
789 SL_RETURN(0, _("sh_entropy"));
790 }
791
792
793 FD_ZERO(&fds);
794
795 i = 0; icount = 0;
796 buffer = SH_ALLOC(BUF_ENT+2);
797
798 if (0 != (caperr = sl_get_cap_sub()))
799 {
800 sh_error_handle((-1), FIL__, __LINE__, caperr, MSG_E_SUBGEN,
801 sh_error_message (caperr),
802 _("sl_get_cap_sub"));
803 }
804
805 while (source[i].command != NULL) {
806
807 j = 0;
808 while (com_path[j] != NULL)
809 {
810 sl_strlcpy(combuf, _(com_path[j]), 80);
811 sl_strlcat(combuf, _(source[i].command), 80);
812
[22]813 /* flawfinder: ignore */
[1]814 if ( access (combuf, X_OK) == 0)
815 {
816 sl_strlcpy(combuf, _(com_path[j]), 80);
817 sl_strlcat(combuf, _(source[i].arg), 80);
818 sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_ENSTART,
819 combuf);
820 break;
821 }
822 ++j;
823 }
824
825 /* Not found, try next command.
826 */
827 if (com_path[j] == NULL)
828 {
829 ++i;
830 continue;
831 }
832
833 /* Source exists
834 */
835 source[i].pipe = sh_popen ( &source[i], combuf );
836 if (NULL != source[i].pipe)
837 {
838 source[i].pipeFD = fileno ( source[i].pipe );
839 sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_ENEXEC,
840 combuf, (long) source[i].pipeFD);
841
842 maxFD = (source[i].pipeFD > maxFD) ? source[i].pipeFD : maxFD;
843 retry_fcntl( FIL__, __LINE__, source[i].pipeFD, F_SETFL, O_NONBLOCK);
844 FD_SET( source[i].pipeFD, &fds );
845 source[i].isset = 1;
846 ++icount;
847 }
848 else
849 {
850 sh_error_handle ((-1), FIL__, __LINE__, EIO, MSG_ENFAIL,
851 combuf);
852 }
853
854 ++i;
855 }
856
857 imax = i;
858 tv.tv_sec = 1;
859 tv.tv_usec = 0;
860 bufcount = 0;
861
862 while ( (icount > 0) && (bufcount < BUF_ENT) ) {
863
864 if ( (selcount = select (maxFD+1, &fds, NULL, NULL, &tv)) == -1)
865 break;
866
867 /* reset timeout for select()
868 */
869 tv.tv_sec = 1;
870 tv.tv_usec = 0;
871
872 /* timeout - let's not hang on forever
873 */
874 if (selcount == 0)
875 {
876 ++select_now;
877 sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_ENTOUT,
878 (unsigned long) select_now);
879 if ( select_now > 9 )
880 break;
881 }
882
883 for (i = 0; i < imax; ++i) {
884
885 if ( FD_ISSET (source[i].pipeFD, &fds) ) {
886 count = fread (&buffer[bufcount],
887 1,
888 BUF_ENT-bufcount,
889 source[i].pipe );
890 if (count == 0)
891 {
892 if (0 != feof(source[i].pipe))
893 sh_error_handle ((-1), FIL__, __LINE__, EIO, MSG_ENCLOS,
894 (long) source[i].pipeFD);
895 else
896 sh_error_handle ((-1), FIL__, __LINE__, EIO, MSG_ENCLOS1,
897 (long) source[i].pipeFD);
898 source[i].isset = 0;
899 sh_pclose ( &source[i] );
900 --icount;
901 }
902 else
903 {
904 sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_ENREAD,
905 (long) source[i].pipeFD, (long) count);
906 }
907 bufcount += count;
908
909 }
910 }
911
912 maxFD = 0;
913 FD_ZERO(&fds);
914
915 for (i = 0; i < imax; ++i)
916 {
917 if (source[i].isset == 1)
918 {
919 FD_SET( source[i].pipeFD, &fds );
920 maxFD = (source[i].pipeFD > maxFD) ? source[i].pipeFD : maxFD;
921 }
922 }
923 }
924
925 for (i = 0; i < imax; ++i)
926 {
927 if (source[i].isset == 1)
928 {
929 sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_ENCLOS1,
930 (long) source[i].pipeFD);
931 sh_pclose ( &source[i] );
932 }
933 }
934 buffer[bufcount] = '\0';
935
936 if (0 != (caperr = sl_drop_cap_sub()))
937 {
938 sh_error_handle((-1), FIL__, __LINE__, caperr, MSG_E_SUBGEN,
939 sh_error_message (caperr),
940 _("sl_drop_cap_sub"));
941 }
942
943 if (bufcount > 0)
944 {
945 keybuf = (char *) sh_tiger_hash_uint32 (buffer,
946 TIGER_DATA, sl_strlen(buffer));
947
948 /* add previous entropy into the new pool
949 */
950 memset(addbuf, '\0', sizeof(addbuf));
951 for (i = 0; i < KEY_BYT; ++i)
952 {
953 addbuf[i] = keybuf[i];
954 addbuf[i+KEY_BYT] = skey->poolv[i];
955 }
956 keybuf = (char *) sh_tiger_hash_uint32 (addbuf,
957 TIGER_DATA, sizeof(addbuf));
958 memset(addbuf, '\0', sizeof(addbuf));
959
960 /* store in system pool
961 */
962 for (i = 0; i < KEY_BYT; ++i)
963 skey->poolv[i] = keybuf[i];
964 skey->poolc = KEY_BYT;
965 memset (buffer, '\0', BUF_ENT+2);
966 memset (keybuf, '\0', KEY_BYT);
967 SH_FREE(buffer);
968 }
969 else
970 {
971 SH_FREE(buffer);
972 SL_RETURN((-1), _("sh_entropy"));
973 }
974
975 /* give out nbytes Bytes from the entropy pool
976 */
977 for (i = 0; i < nbytes; ++i)
978 {
979 nbuf[i] = skey->poolv[i];
980 --skey->poolc;
981 }
982
983 SL_RETURN(0, _("sh_entropy"));
984}
985
986/* HAVE_UNIX_RANDOM */
987#endif
988
989
990
991
992
993
994
Note: See TracBrowser for help on using the repository browser.