Context Navigation

source: trunk/src/sh_gpg.c@ 116

Last change on this file since 116 was 111, checked in by rainer, 17 years ago
Fix for ticket #69 (wrappers for name service routines not used everywhere).
File size: 29.7 KB

Rev	Line
[1]	1	/* SAMHAIN file system integrity testing */
	2	/* Copyright (C) 1999, 2000 Rainer Wichmann */
	3	/* */
	4	/* This program is free software; you can redistribute it */
	5	/* and/or modify */
	6	/* it under the terms of the GNU General Public License as */
	7	/* published by */
	8	/* the Free Software Foundation; either version 2 of the License, or */
	9	/* (at your option) any later version. */
	10	/* */
	11	/* This program is distributed in the hope that it will be useful, */
	12	/* but WITHOUT ANY WARRANTY; without even the implied warranty of */
	13	/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
	14	/* GNU General Public License for more details. */
	15	/* */
	16	/* You should have received a copy of the GNU General Public License */
	17	/* along with this program; if not, write to the Free Software */
	18	/* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
	19
	20	#include "config_xor.h"
	21
	22	#include <stdio.h>
	23	#include <stdlib.h>
	24
	25
	26	#if defined(WITH_GPG) \|\| defined(WITH_PGP)
	27
	28	#include <unistd.h>
	29	#include <fcntl.h>
	30	#include <signal.h>
	31	#if defined(SH_WITH_SERVER)
	32	#include <pwd.h>
	33	#endif
	34	#include <sys/stat.h>
	35	#include <sys/types.h>
	36	#include <errno.h>
	37	#include <sys/wait.h>
	38
	39	#include <string.h>
	40	#ifdef HAVE_MEMORY_H
	41	#include <memory.h>
	42	#endif
	43
	44
	45	#if !defined(O_NONBLOCK)
	46	#if defined(O_NDELAY)
	47	#define O_NONBLOCK O_NDELAY
	48	#else
	49	#define O_NONBLOCK 0
	50	#endif
	51	#endif
	52
	53
	54	#include "samhain.h"
	55	#include "sh_utils.h"
	56	#include "sh_error.h"
	57	#include "sh_tiger.h"
	58	#if defined(SH_WITH_SERVER)
	59	#define SH_NEED_PWD_GRP 1
	60	#include "sh_static.h"
	61	#endif
	62
	63	static struct {
	64	char conf_id[SH_MINIBUF+1];
	65	char conf_fp[SH_MINIBUF+1];
	66	char data_id[SH_MINIBUF+1];
	67	char data_fp[SH_MINIBUF+1];
	68	} gp;
	69
	70	typedef struct {
	71	pid_t pid;
	72	FILE * pipe;
	73	} sh_gpg_popen_t;
	74
	75	#define SH_GPG_OK 0
	76	#define SH_GPG_BAD 1
	77	#define SH_GPG_BADSIGN 2
	78
	79	/* replace #if 0 by #if 1 and set an appropriate path in front of '/pdbg.'
	80	* for debugging
	81	*/
	82	#if 0
	83	#define PDGBFILE "/pdbg."
	84	#endif
	85
	86	#if defined(PDGBFILE)
	87	FILE * pdbg;
	88	FILE * pdbgc;
	89	#define PDBG_OPEN pdbg = fopen(PDGBFILE"main", "a")
	90	#define PDBG_CLOSE fclose (pdbg)
	91	#define PDBG(arg) fprintf(pdbg, "PDBG: step %d\n", arg); fflush(pdbg)
	92	#define PDBG_D(arg) fprintf(pdbg, "PDBG: %d\n", arg); fflush(pdbg)
	93	#define PDBG_S(arg) fprintf(pdbg, "PDBG: %s\n", arg); fflush(pdbg)
	94
	95	#define PDBGC_OPEN pdbgc = fopen(PDGBFILE"child", "a")
	96	#define PDBGC_CLOSE fclose (pdbgc)
	97	#define PDBGC(arg) fprintf(pdbgc, "PDBG: step %d\n", arg); fflush(pdbgc)
	98	#define PDBGC_D(arg) fprintf(pdbgc, "PDBG: %d\n", arg); fflush(pdbgc)
	99	#define PDBGC_S(arg) fprintf(pdbgc, "PDBG: %s\n", arg); fflush(pdbgc)
	100	#else
	101	#define PDBG_OPEN
	102	#define PDBG_CLOSE
	103	#define PDBG(arg)
	104	#define PDBG_D(arg)
	105	#define PDBG_S(arg)
	106	#define PDBGC_OPEN
	107	#define PDBGC_CLOSE
	108	#define PDBGC(arg)
	109	#define PDBGC_D(arg)
	110	#define PDBGC_S(arg)
	111	#endif
	112
	113	#undef FIL__
	114	#define FIL__ _("sh_gpg.c")
	115
	116	#ifdef GPG_HASH
[86]	117
[1]	118	static int sh_gpg_checksum (SL_TICKET checkfd, int flag)
	119	{
	120	char * test_gpg;
	121	char * test_ptr1 = NULL;
	122	char * test_ptr2 = NULL;
	123	char wstrip1[128];
	124	char wstrip2[128];
	125	int i, k;
	126	#include "sh_gpg_chksum.h"
	127
	128	SL_ENTER(_("sh_gpg_checksum"));
	129
	130	tiger_fd = checkfd;
	131	#if defined(WITH_PGP)
	132	test_gpg = sh_tiger_hash_gpg (DEFAULT_PGP_PATH, TIGER_FD, 0);
	133	#else
	134	test_gpg = sh_tiger_hash_gpg (DEFAULT_GPG_PATH, TIGER_FD, 0);
	135	#endif
	136
	137	test_ptr1 = strchr(GPG_HASH, ':');
	138	if (test_gpg != NULL)
	139	test_ptr2 = strchr(test_gpg, ':');
	140
	141	if (test_ptr2 != NULL)
	142	test_ptr2 += 2;
	143	else
	144	test_ptr2 = test_gpg;
	145	if (test_ptr1 != NULL)
	146	test_ptr1 += 2;
	147	else
	148	test_ptr1 = GPG_HASH;
	149
	150	/* Tue Jun 24 23:11:54 CEST 2003 (1.7.9) -- strip whitespace
	151	*/
	152	k = 0;
	153	for (i = 0; i < 127; ++i)
	154	{
	155	if (test_ptr1[i] == '\0')
	156	break;
	157	if (test_ptr1[i] != ' ')
	158	{
	159	wstrip1[k] = test_ptr1[i];
	160	++k;
	161	}
	162	}
	163	wstrip1[k] = '\0';
	164
	165	for(i = 0; i < KEY_LEN; ++i)
	166	{
	167	if (gpgchk[i] != wstrip1[i])
	168	{
	169	sh_error_handle(SH_ERR_SEVERE, FIL__, __LINE__, 0, MSG_E_GPG_CHK,
	170	gpgchk, wstrip1);
	171	break;
	172	}
	173	}
	174
	175	k = 0;
	176	for (i = 0; i < 127; ++i)
	177	{
	178	if (test_ptr2[i] == '\0')
	179	break;
	180	if (test_ptr2[i] != ' ')
	181	{
	182	wstrip2[k] = test_ptr2[i];
	183	++k;
	184	}
	185	}
	186	wstrip2[k] = '\0';
	187
	188	if (0 != sl_strncmp(wstrip1, wstrip2, 127))
	189	{
	190	TPT(((0), FIL__, __LINE__, _("msg=<pgp checksum: %s>\n"), test_gpg));
	191	TPT(((0), FIL__, __LINE__, _("msg=<Compiled-in : %s>\n"), GPG_HASH));
	192	TPT(((0), FIL__, __LINE__, _("msg=<wstrip1 : %s>\n"), wstrip1));
	193	TPT(((0), FIL__, __LINE__, _("msg=<wstrip2 : %s>\n"), wstrip2));
	194	if (flag == 1)
	195	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_GPG,
	196	GPG_HASH, test_gpg);
	197	dlog(1, FIL__, __LINE__, _("The compiled-in checksum of the gpg binary\n(%s)\ndoes not match the actual checksum\n(%s).\nYou need to recompile with the correct checksum."), wstrip1, wstrip2);
	198	SH_FREE(test_gpg);
	199	SL_RETURN((-1), _("sh_gpg_checksum"));
	200	}
	201	SH_FREE(test_gpg);
	202	SL_RETURN( (0), _("sh_gpg_checksum"));
	203	}
	204	#endif
	205
[86]	206	struct startup_info {
	207	long line;
	208	char * program;
	209	long uid;
	210	char * path;
	211	char * key_uid;
	212	char * key_id;
	213	};
	214
	215	static struct startup_info startInfo = { 0, NULL, 0, NULL, NULL, NULL };
	216
	217	void sh_gpg_log_startup ()
	218	{
	219	if (startInfo.program != NULL)
	220	{
	221	sh_error_handle ((-1), FIL__, startInfo.line, 0, MSG_START_GH,
	222	startInfo.program, startInfo.uid,
	223	startInfo.path,
	224	startInfo.key_uid, startInfo.key_id);
	225	}
	226	return;
	227	}
	228
	229	static void sh_gpg_fill_startup (long line, char * program, long uid, char * path,
	230	char * key_uid, char * key_id)
	231	{
	232	startInfo.line = line;
	233	startInfo.program = sh_util_strdup(program);
	234	startInfo.uid = uid;
	235	startInfo.path = sh_util_strdup(path);
	236	startInfo.key_uid = sh_util_strdup(key_uid);
	237	startInfo.key_id = sh_util_strdup(key_id);
	238	return;
	239	}
	240
[1]	241	static FILE * sh_gpg_popen (sh_gpg_popen_t *source, int fd,
	242	int mode, char * id, char * homedir)
	243	{
	244	int pipedes[2];
	245	FILE * outf = NULL;
	246	char * envp[2];
[22]	247	size_t len;
[1]	248	char path[256];
	249	char cc1[32];
	250	char cc2[32];
	251	#if defined(WITH_PGP)
	252	char cc3[32];
	253	char cc0[3] = "-f";
	254	#endif
	255	#if defined(WITH_GPG)
	256	char cc0[2] = "-";
	257	char cc3[32];
	258	char cc4[SH_PATHBUF+32];
	259	char cc5[32] = "--no-tty";
	260	#endif
	261
	262	char * arg[9];
	263
	264	#if defined(HAVE_GPG_CHECKSUM)
	265	SL_TICKET checkfd;
	266	int myrand;
	267	int i;
	268	#if defined(__linux__)
	269	int get_the_fd(SL_TICKET);
	270	char pname[128];
	271	int pfd;
	272	#endif
	273	#endif
	274
	275	SL_ENTER(_("sh_gpg_popen"));
	276
	277	#if defined(WITH_GPG)
	278	/* -- GnuPG -- */
	279	sl_strlcpy (path, DEFAULT_GPG_PATH, 256);
	280	sl_strlcpy (cc1, _("--status-fd"), 32);
	281	sl_strlcpy (cc2, _("--verify"), 32);
	282	sl_strlcpy (cc3, _("--homedir"), 32);
	283	/* sl_strlcpy (cc4, sh.effective.home, SH_PATHBUF+32); */
	284	sl_strlcpy (cc4, homedir, SH_PATHBUF+32);
	285	sl_strlcat (cc4, _("/.gnupg"), SH_PATHBUF+32);
	286
	287	/* fprintf(stderr, "YULE: homedir=%s\n", homedir); */
	288
	289	#if defined(SH_WITH_SERVER)
	290	if (0 == sl_ret_euid()) /* privileges not dropped yet */
	291	{
	292	struct stat lbuf;
	293	int status_stat = 0;
[111]	294	struct passwd * tempres = sh_getpwnam(DEFAULT_IDENT);
	295
[1]	296	if (!tempres)
	297	{
	298	dlog(1, FIL__, __LINE__,
	299	_("User %s does not exist. Please add the user to your system.\n"),
	300	DEFAULT_IDENT);
	301	status_stat = -1;
	302	}
	303	if (!tempres->pw_dir \|\| tempres->pw_dir[0] == '\0')
	304	{
	305	dlog(1, FIL__, __LINE__,
	306	_("User %s does not have a home directory.\nPlease add the home directory for this user to your system.\n"),
	307	DEFAULT_IDENT);
	308	status_stat = -2;
	309	}
	310	if (status_stat == 0)
	311	{
	312	sl_strlcpy (cc4, tempres->pw_dir, SH_PATHBUF+32);
	313	sl_strlcat (cc4, _("/.gnupg"), SH_PATHBUF+32);
	314	status_stat = retry_lstat(FIL__, __LINE__, cc4, &lbuf);
	315	if (status_stat == -1)
	316	{
	317	dlog(1, FIL__, __LINE__,
	318	_("Gnupg directory %s for user %s\ndoes not exist or is not accessible.\nPlease add the directory and put the keyring (pubring.gpg) there\nto verify the configuration file.\n"),
	319	cc4, DEFAULT_IDENT);
	320	status_stat = -3;
	321	}
	322	}
	323	if (status_stat == 0 && lbuf.st_uid != tempres->pw_uid)
	324	{
	325	dlog(1, FIL__, __LINE__,
	326	_("Gnupg directory %s\nis not owned by user %s.\n"),
	327	cc4, DEFAULT_IDENT);
	328	status_stat = -4;
	329	}
	330	if (status_stat == 0)
	331	{
	332	sl_strlcat (cc4, _("/pubring.gpg"), SH_PATHBUF+32);
	333	status_stat = retry_lstat(FIL__, __LINE__, cc4, &lbuf);
	334	if (status_stat == -1)
	335	{
	336	dlog(1, FIL__, __LINE__,
	337	_("Gnupg public keyring %s for user %s\ndoes not exist or is not accessible.\nPlease add the directory and put the keyring (pubring.gpg) there\nto verify the configuration file.\n"),
	338	cc4, DEFAULT_IDENT);
	339	status_stat = -5;
	340	}
	341	}
	342	if (status_stat == 0 && lbuf.st_uid != tempres->pw_uid)
	343	{
	344	dlog(1, FIL__, __LINE__,
	345	_("Gnupg public keyring %s\nis not owned by user %s.\n"),
	346	cc4, DEFAULT_IDENT);
	347	status_stat = -6;
	348	}
	349	if (status_stat != 0)
	350	{
	351	sh_error_handle((-1), FIL__, __LINE__, status_stat, MSG_EXIT_ABORT1,
	352	sh.prg_name);
	353	aud_exit (FIL__, __LINE__, EXIT_FAILURE);
	354	}
	355	sl_strlcpy (cc4, tempres->pw_dir, SH_PATHBUF+32);
	356	sl_strlcat (cc4, _("/.gnupg"), SH_PATHBUF+32);
	357	}
	358	#endif
	359
	360	arg[0] = path;
	361	arg[1] = cc1;
	362	arg[2] = "1";
	363	arg[3] = cc2;
	364	arg[4] = cc3;
	365	arg[5] = cc4;
	366	arg[6] = cc5;
	367	arg[7] = cc0;
	368	arg[8] = NULL;
	369
	370	/* catch 'unused parameter' compiler warning
	371	*/
	372	(void) mode;
	373	(void) id;
	374	#elif defined(WITH_PGP)
	375	/* -- PGP -- */
	376	sl_strlcpy (path, DEFAULT_PGP_PATH, 256);
	377	if (mode == 0)
	378	{
	379	sl_strlcpy (cc1, _("+language=en"), 32);
	380	sl_strlcpy (cc2, _("-o"), 32);
	381	sl_strlcpy (cc3, _("/dev/null"), 32);
	382
	383	arg[0] = path;
	384	arg[1] = cc1;
	385	arg[2] = cc2;
	386	arg[3] = cc3;
	387	arg[4] = cc0;
	388	arg[5] = NULL;
	389	}
	390	else
	391	{
	392	sl_strlcpy (cc1, _("+language=en"), 32);
	393	sl_strlcpy (cc2, _("-kvc"), 32);
	394
	395	arg[0] = path;
	396	arg[1] = cc1;
	397	arg[2] = cc2;
	398	arg[3] = id;
	399	arg[4] = NULL;
	400	arg[5] = NULL;
	401	}
	402	#endif
	403
	404	/* use homedir of effective user
	405	*/
	406	if (sh.effective.home != NULL)
	407	{
[22]	408	len = sl_strlen(sh.effective.home) + 6;
	409	envp[0] = malloc (len); /* free() ok */
[1]	410	if (envp[0] != NULL)
[22]	411	sl_snprintf (envp[0], len, "HOME=%s", sh.effective.home);
[1]	412	envp[1] = NULL;
	413	}
	414	else
	415	{
	416	envp[0] = NULL;
	417	}
	418
	419	/* Create the pipe
	420	*/
	421	if (aud_pipe(FIL__, __LINE__, pipedes) < 0)
	422	{
	423	if (envp[0] != NULL)
	424	free(envp[0]);
	425	SL_RETURN( (NULL), _("sh_gpg_popen"));
	426	}
[102]	427
	428	fflush (NULL);
[1]	429
	430	source->pid = aud_fork(FIL__, __LINE__);
	431
	432	/* Failure
	433	*/
	434	if (source->pid == (pid_t) - 1)
	435	{
	436	close(pipedes[0]);
	437	close(pipedes[1]);
	438	if (envp[0] != NULL)
	439	free(envp[0]);
	440	SL_RETURN( (NULL), _("sh_gpg_popen"));
	441	}
	442
	443	if (source->pid == (pid_t) 0)
	444	{
	445
	446	/* child - make read side of the pipe stdout
	447	*/
	448	if (retry_aud_dup2(FIL__, __LINE__,
	449	pipedes[STDOUT_FILENO], STDOUT_FILENO) < 0)
	450	{
	451	TPT(((0), FIL__, __LINE__, _("msg=<dup2 on pipe failed>\n")));
	452	dlog(1, FIL__, __LINE__, _("Internal error: dup2 failed\n"));
	453	aud__exit(FIL__, __LINE__, EXIT_FAILURE);
	454	}
	455
	456	/* close the pipe descriptors
	457	*/
	458	close (pipedes[STDIN_FILENO]);
	459	close (pipedes[STDOUT_FILENO]);
	460
	461
	462	#if defined(WITH_PGP)
	463	if (mode == 0)
	464	{
	465	if (retry_aud_dup2(FIL__, __LINE__, fd, STDIN_FILENO) < 0)
	466	{
	467	TPT(((0), FIL__, __LINE__, _("msg=<dup2 on fd failed>\n")));
	468	dlog(1, FIL__, __LINE__, _("Internal error: dup2 failed\n"));
	469	aud__exit(FIL__, __LINE__, EXIT_FAILURE);
	470	}
	471	}
	472	#else
	473	if (retry_aud_dup2(FIL__, __LINE__, fd, STDIN_FILENO) < 0)
	474	{
	475	TPT(((0), FIL__, __LINE__, _("msg=<dup2 on fd failed>\n")));
	476	dlog(1, FIL__, __LINE__, _("Internal error: dup2 failed\n"));
	477	aud__exit(FIL__, __LINE__, EXIT_FAILURE);
	478	}
	479	#endif
	480
	481	/* don't leak file descriptors
	482	*/
	483	sh_unix_closeall (3, -1); /* in child process */
	484
	485	freopen(_("/dev/null"), "r+", stderr);
	486
	487	/* We should become privileged if SUID,
	488	* to be able to read the keyring.
	489	* We have checked that gpg is OK,
	490	* AND that only a trusted user could overwrite
	491	* gpg.
	492	*/
	493	memset (skey, '\0', sizeof(sh_key_t));
	494	aud_setuid(FIL__, __LINE__, geteuid());
	495
	496	PDBGC_OPEN;
	497	PDBGC_D((int)getuid());
	498	PDBGC_D((int)geteuid());
	499
	500	{
	501	int i = 0;
	502	while (arg[i] != NULL)
	503	{
	504	PDBGC_S(arg[i]);
	505	++i;
	506	}
	507	}
	508	PDBGC_CLOSE;
	509
	510	/* exec the program */
	511
	512	#if defined(__linux__) && defined(HAVE_GPG_CHECKSUM)
	513	/*
	514	* -- emulate an fexecve with checksum testing
	515	*/
	516	#if defined(WITH_PGP)
	517	checkfd = sl_open_read(DEFAULT_PGP_PATH, SL_NOPRIV);
	518	#else
	519	checkfd = sl_open_read(DEFAULT_GPG_PATH, SL_NOPRIV);
	520	#endif
	521
	522	if (0 != sh_gpg_checksum(checkfd, 0))
	523	aud__exit(FIL__, __LINE__, EXIT_FAILURE);
	524
	525	pfd = get_the_fd(checkfd);
[22]	526	sl_snprintf(pname, sizeof(pname), _("/proc/self/fd/%d"), pfd);
	527	if (0 == access(pname, R_OK\|X_OK)) /* flawfinder: ignore */
	528
[1]	529	{
	530	fcntl (pfd, F_SETFD, FD_CLOEXEC);
	531	retry_aud_execve (FIL__, __LINE__, pname, arg, envp);
	532
	533	dlog(1, FIL__, __LINE__, _("Unexpected error: execve %s failed\n"),
	534	pname);
	535	/* failed
	536	*/
	537	aud__exit(FIL__, __LINE__, EXIT_FAILURE);
	538	}
	539
	540	/* procfs not working, go ahead
	541	*/
	542	sl_close(checkfd);
	543	#endif
	544
	545	#if defined(HAVE_GPG_CHECKSUM)
	546	/* This is an incredibly ugly kludge to prevent an attacker
	547	* from knowing when it is safe to slip in a fake executable
	548	* between the integrity check and the execve
	549	*/
	550	myrand = (int) taus_get (&(skey->rng0[0]), &(skey->rng1[0]),
	551	&(skey->rng2[0]));
	552	myrand = (myrand < 0) ? (-myrand) : myrand;
	553	myrand = (myrand % 32) + 2;
	554
	555	for (i = 0; i < myrand; ++i)
	556	{
	557	#if defined(WITH_PGP)
	558	checkfd = sl_open_fastread(DEFAULT_PGP_PATH, SL_NOPRIV);
	559	#else
	560	checkfd = sl_open_fastread(DEFAULT_GPG_PATH, SL_NOPRIV);
	561	#endif
	562	if (0 != sh_gpg_checksum(checkfd, 0)) {
	563	aud__exit(FIL__, __LINE__, EXIT_FAILURE);
	564	}
	565	sl_close(checkfd);
	566	}
	567	#endif
	568
	569
	570	#if defined(WITH_GPG)
	571	retry_aud_execve (FIL__, __LINE__, DEFAULT_GPG_PATH, arg, envp);
	572	dlog(1, FIL__, __LINE__, _("Unexpected error: execve %s failed\n"),
	573	DEFAULT_GPG_PATH);
	574	#elif defined(WITH_PGP)
	575	retry_aud_execve (FIL__, __LINE__, DEFAULT_PGP_PATH, arg, envp);
	576	#endif
	577
	578	/* failed
	579	*/
	580	TPT(((0), FIL__, __LINE__, _("msg=<execve failed>\n")));
	581	dlog(1, FIL__, __LINE__, _("Unexpected error: execve failed\n"));
	582	aud__exit(FIL__, __LINE__, EXIT_FAILURE);
	583	}
	584
	585	/* parent
	586	*/
	587
	588	if (envp[0] != NULL)
	589	free(envp[0]);
	590
	591	close (pipedes[STDOUT_FILENO]);
	592	retry_fcntl (FIL__, __LINE__, pipedes[STDIN_FILENO], F_SETFD, FD_CLOEXEC);
	593	retry_fcntl (FIL__, __LINE__, pipedes[STDIN_FILENO], F_SETFL, O_NONBLOCK);
	594
	595	outf = fdopen (pipedes[STDIN_FILENO], "r");
	596
	597	if (outf == NULL)
	598	{
	599	aud_kill (FIL__, __LINE__, source->pid, SIGKILL);
	600	close (pipedes[STDOUT_FILENO]);
	601	waitpid (source->pid, NULL, 0);
	602	source->pid = 0;
	603	SL_RETURN( (NULL), _("sh_gpg_popen"));
	604	}
	605
	606	SL_RETURN( (outf), _("sh_gpg_popen"));
	607	}
	608
	609
	610	static int sh_gpg_pclose (sh_gpg_popen_t *source)
	611	{
	612	int status = 0;
	613
	614	SL_ENTER(_("sh_gpg_pclose"));
	615
	616	status = fclose(source->pipe);
	617	if (status)
	618	SL_RETURN( (-1), _("sh_gpg_pclose"));
	619
	620	if (waitpid(source->pid, NULL, 0) != source->pid)
	621	status = -1;
	622
	623	source->pipe = NULL;
	624	source->pid = 0;
	625	SL_RETURN( (status), _("sh_gpg_pclose"));
	626	}
	627
	628	static
	629	int sh_gpg_check_file_sign(int fd, char * sign_id, char * sign_fp,
	630	char * homedir, int whichfile)
	631	{
	632	struct stat buf;
	633	char line[256];
	634	sh_gpg_popen_t source;
	635	int have_id = BAD, have_fp = BAD, status = 0;
	636	#ifdef WITH_PGP
	637	char *ptr;
	638	#endif
	639
	640	#ifdef HAVE_GPG_CHECKSUM
	641	SL_TICKET checkfd;
	642	#endif
	643
	644	SL_ENTER(_("sh_gpg_check_file_sign"));
	645
	646	/* check whether GnuPG exists and has the correct checksum
	647	*/
	648	#if defined(WITH_GPG)
	649
	650	TPT(((0), FIL__, __LINE__, _("msg=<Check signature>\n")));
	651	TPT(((0), FIL__, __LINE__, _("msg=<gpg is %s>\n"), DEFAULT_GPG_PATH));
	652
	653	if (0 != retry_lstat(FIL__, __LINE__, DEFAULT_GPG_PATH, &buf))
	654	{
	655	status = errno;
	656	sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, status, MSG_ERR_LSTAT,
	657	sh_error_message(status), DEFAULT_GPG_PATH);
	658	SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
	659	}
	660
	661	if (0 != tf_trust_check (DEFAULT_GPG_PATH, SL_YESPRIV))
	662	SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
	663
	664	#ifdef HAVE_GPG_CHECKSUM
	665	checkfd = sl_open_read(DEFAULT_GPG_PATH, SL_YESPRIV);
	666
	667	if (0 != sh_gpg_checksum(checkfd, 1))
	668	{
	669	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
	670	_("Checksum mismatch"),
	671	_("gpg_check_file_sign"));
	672	sl_close(checkfd);
	673	SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
	674	}
	675	sl_close(checkfd);
	676	#endif
	677
	678	#elif defined(WITH_PGP)
	679
	680	TPT(((0), FIL__, __LINE__, _("msg=<Check signature>\n")));
	681	TPT(((0), FIL__, __LINE__, _("msg=<pgp is %s>\n"), DEFAULT_PGP_PATH));
	682
	683	if (0 != retry_lstat(FIL__, __LINE__, DEFAULT_PGP_PATH, &buf))
	684	{
	685	status = errno;
	686	sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, status, MSG_ERR_LSTAT,
	687	sh_error_message(status), DEFAULT_PGP_PATH);
	688	SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
	689	}
	690	if (0 != tf_trust_check (DEFAULT_PGP_PATH, SL_YESPRIV))
	691	SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
	692
	693	#ifdef HAVE_GPG_CHECKSUM
	694	checkfd = sl_open_read(DEFAULT_PGP_PATH, SL_YESPRIV);
	695
	696	if (0 != sh_gpg_checksum(checkfd, 1))
	697	{
	698	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
	699	_("Checksum mismatch"),
	700	_("gpg_check_file_sign"));
	701	sl_close(checkfd);
	702	SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
	703	}
	704	sl_close(checkfd);
	705	#endif
	706
	707	#endif
	708
	709	TPT(((0), FIL__, __LINE__, _("msg=<Open pipe to check signature>\n")));
	710
	711	fflush(NULL);
	712
	713	source.pipe = sh_gpg_popen ( &source, fd, 0, NULL, homedir );
	714
	715	if (NULL == source.pipe)
	716	{
	717	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
	718	_("Could not open pipe"),
	719	_("gpg_check_file_sign"));
	720	SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
	721	}
	722
	723	TPT(((0), FIL__, __LINE__, _("msg=<Open pipe success>\n")));
	724
	725	xagain:
	726
	727	errno = 0;
	728
[34]	729	while (NULL != fgets(line, sizeof(line), source.pipe))
[1]	730	{
	731
	732	TPT(((0), FIL__, __LINE__, _("msg=<gpg out: %s>\n"), line));
	733	if (line[strlen(line)-1] == '\n')
	734	line[strlen(line)-1] = ' ';
	735	sh_error_handle(SH_ERR_ALL, FIL__, __LINE__, 0, MSG_E_SUBGEN,
	736	line,
	737	_("gpg_check_file_sign"));
	738
	739	if (sl_strlen(line) < 18)
	740	continue;
	741	#if defined(WITH_GPG)
	742	/* Sun May 27 18:40:05 CEST 2001
	743	*/
	744	if (0 == sl_strncmp(_("BADSIG"), &line[9], 6) \|\|
	745	0 == sl_strncmp(_("ERRSIG"), &line[9], 6) \|\|
	746	0 == sl_strncmp(_("NO_PUBKEY"), &line[9], 6) \|\|
	747	0 == sl_strncmp(_("NODATA"), &line[9], 6) \|\|
	748	0 == sl_strncmp(_("SIGEXPIRED"), &line[9], 6))
	749	{
	750	if (0 == sl_strncmp(_("BADSIG"), &line[9], 6)) {
	751	dlog(1, FIL__, __LINE__,
	752	_("%s file is signed, but the signature is invalid."),
	753	((whichfile == 1) ? _("Configuration") : _("Database")));
	754	}
	755	else if (0 == sl_strncmp(_("NO_PUBKEY"), &line[9], 6)) {
	756	dlog(1, FIL__, __LINE__,
	757	_("%s file is signed, but the public key to verify the signature is not in my keyring %s/.gnupg/pubring.asc."),
	758	((whichfile == 1) ? _("Configuration") : _("Database")),
	759	homedir);
	760	}
	761	else if (0 == sl_strncmp(_("ERRSIG"), &line[9], 6)) {
	762	dlog(1, FIL__, __LINE__,
	763	_("%s file is signed, but the public key to verify the signature is not in my keyring %s/.gnupg/pubring.asc."),
	764	((whichfile == 1) ? _("Configuration") : _("Database")),
	765	homedir);
	766	}
	767	else if (0 == sl_strncmp(_("SIGEXPIRED"), &line[9], 6)) {
	768	dlog(1, FIL__, __LINE__,
	769	_("%s file is signed, but the public key to verify the signature has expired."),
	770	((whichfile == 1) ? _("Configuration") : _("Database")));
	771	}
	772	else if (0 == sl_strncmp(_("NODATA"), &line[9], 6)) {
	773	dlog(1, FIL__, __LINE__,
	774	_("%s file is not signed."),
	775	((whichfile == 1) ? _("Configuration") : _("Database")));
	776	}
	777
	778	have_fp = BAD; have_id = BAD;
	779	break;
	780	}
	781	if (0 == sl_strncmp(_("GOODSIG"), &line[9], 7))
	782	{
	783	sl_strlcpy (sign_id, &line[25], SH_MINIBUF+1);
	784	sign_id[sl_strlen(sign_id)-1] = '\0'; /* remove trailing '"' */
	785	have_id = GOOD;
	786	}
	787	if (0 == sl_strncmp(_("VALIDSIG"), &line[9], 8))
	788	{
	789	strncpy (sign_fp, &line[18], 40);
	790	sign_fp[40] = '\0';
	791	have_fp = GOOD;
	792	}
	793	#elif defined(WITH_PGP)
	794	if (0 == sl_strncmp(_("Bad signature"), line, 13) \|\|
	795	0 == sl_strncmp(_("Error"), line, 5) \|\|
	796	0 == sl_strncmp(_("Malformed"), line, 9) \|\|
	797	0 == sl_strncmp(_("WARNING"), line, 7) \|\|
	798	0 == sl_strncmp(_("ERROR"), line, 5)
	799	)
	800	{
	801	have_fp = BAD; have_id = BAD;
	802	break;
	803	}
	804	if (0 == sl_strncmp(_("Good signature"), line, 14))
	805	{
	806	ptr = strchr ( line, '"');
	807	++ptr;
	808	sl_strlcpy (sign_id, ptr, SH_MINIBUF+1);
	809	sign_id[sl_strlen(sign_id)-1] = '\0'; /* remove trailing dot */
	810	sign_id[sl_strlen(sign_id)-2] = '\0'; /* remove trailing '"' */
	811	have_id = GOOD;
	812	}
	813	#endif
	814	}
	815
	816	if (ferror(source.pipe) && errno == EAGAIN)
	817	{
	818	clearerr(source.pipe);
	819	goto xagain;
	820	}
	821
	822	sh_gpg_pclose (&source);
	823
	824	TPT(((0), FIL__, __LINE__, _("msg=<Close pipe>\n")));
	825
	826	#ifdef WITH_PGP
	827	/* get the fingerprint */
	828
	829	source.pipe = sh_gpg_popen ( &source, fd, 1, sign_id, homedir);
	830	if (NULL == source.pipe)
	831	{
	832	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
	833	_("Could not open pipe for fp"),
	834	_("gpg_check_file_sign"));
	835	SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
	836	}
	837
	838	TPT(((0), FIL__, __LINE__, _("msg=<Open pipe success>\n")));
	839
	840	yagain:
	841
	842	errno = 0;
	843
[34]	844	while (NULL != fgets(line, sizeof(line), source.pipe))
[1]	845	{
	846	if (line[strlen(line)-1] == '\n')
	847	line[strlen(line)-1] = ' ';
	848	sh_error_handle(SH_ERR_ALL, FIL__, __LINE__, 0, MSG_E_SUBGEN,
	849	line,
	850	_("gpg_check_file_sign"));
	851
	852	if (sl_strlen(line) < 18)
	853	continue;
	854	ptr = strtok (line, " ");
	855	while (ptr)
	856	{
	857	ptr = strtok (NULL, " ");
	858	if (ptr && 0 == sl_strncmp (ptr, _("fingerprint"), 11))
	859	{
	860	ptr = strtok (NULL, " "); /* to '=' */
	861	sign_fp[0] = '\0';
	862	while (ptr)
	863	{
	864	ptr = strtok (NULL, " "); /* part of fingerprint */
	865	sl_strlcat (sign_fp, ptr, SH_MINIBUF+1);
	866	}
	867	/* sign_fp[sl_strlen(sign_fp)-1] = '\0'; remove trailing '\n' */
	868	if (sl_strlen(sign_fp) > 0)
	869	have_fp = GOOD;
	870	break;
	871	}
	872	}
	873	}
	874
	875	if (ferror(source.pipe) && errno == EAGAIN)
	876	{
	877	clearerr(source.pipe);
	878	goto yagain;
	879	}
	880
	881	sh_gpg_pclose (&source);
	882	#endif
	883
	884	if (have_id == GOOD)
	885	{
	886	TPT(((0), FIL__, __LINE__, _("msg=<Got signator ID>\n")));
	887	;
	888	}
	889	if (have_fp == GOOD)
	890	{
	891	TPT(((0), FIL__, __LINE__, _("msg=<Got fingerprint>\n")));
	892	;
	893	}
	894
	895	if (have_id == GOOD && have_fp == GOOD)
	896	SL_RETURN( SH_GPG_OK, _("sh_gpg_check_file_sign"));
	897	else
	898	{
	899	if (have_id == BAD)
	900	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
	901	_("No good signature"),
	902	_("gpg_check_file_sign"));
	903	else
	904	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
	905	_("No fingerprint for key"),
	906	_("gpg_check_file_sign"));
	907	SL_RETURN( SH_GPG_BADSIGN, _("sh_gpg_check_file_sign"));
	908	}
	909	}
	910
	911	int get_the_fd(SL_TICKET file_1);
	912
	913	int sh_gpg_check_sign (long file_1, long file_2, int what)
	914	{
	915	int status = SH_GPG_BAD;
	916	int fd1 = 0;
	917	int fd2 = 0;
	918	static int smsg = S_FALSE;
	919	char * tmp;
	920	char * tmp2;
	921
	922	char * homedir = sh.effective.home;
	923	#if defined(SH_WITH_SERVER)
	924	struct passwd * tempres;
	925	#endif
	926	#ifdef USE_FINGERPRINT
	927	#include "sh_gpg_fp.h"
	928	#endif
	929
	930	SL_ENTER(_("sh_gpg_check_sign"));
	931
	932
	933	if (what == 0 \|\| what == 1)
	934	fd1 = get_the_fd(file_1);
	935	if (what == 0 \|\| what == 2)
	936	fd2 = get_the_fd(file_2);
	937
	938
	939	if (fd1 < 0 \|\| fd2 < 0)
	940	{
	941	TPT(((0), FIL__, __LINE__, _("msg=<GPG_CHECK: FD1 = %d>\n"), fd1));
	942	TPT(((0), FIL__, __LINE__, _("msg=<GPG_CHECK: FD2 = %d>\n"), fd2));
	943	dlog(1, FIL__, __LINE__,
	944	_("This looks like an unexpected internal error.\n"));
	945	sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_EXIT_ABORT1, sh.prg_name);
	946	aud_exit (FIL__, __LINE__, EXIT_FAILURE);
	947	SL_RETURN( (-1), _("sh_gpg_check_sign"));
	948	}
	949
	950	if (what == 0 \|\| what == 1)
	951	{
	952	TPT(((0), FIL__, __LINE__, _("msg=<GPG_CHECK: FD1 = %d>\n"), fd1));
	953	#if defined(SH_WITH_SERVER)
[111]	954	tempres = sh_getpwnam(DEFAULT_IDENT);
	955
[1]	956	if ((tempres != NULL) && (0 == sl_ret_euid()))
	957	{
	958	/* privileges not dropped yet*/
	959	homedir = tempres->pw_dir;
	960	}
	961	#endif
	962	status = sh_gpg_check_file_sign(fd1, gp.conf_id, gp.conf_fp, homedir, 1);
	963	TPT(((0), FIL__, __LINE__, _("msg=<CONF SIGUSR: \|%s\|>\n"), gp.conf_id));
	964	TPT(((0), FIL__, __LINE__, _("msg=<CONF SIGFP: \|%s\|>\n"), gp.conf_fp));
	965	}
	966
	967	if ((what == 0 && SH_GPG_OK == status) \|\| what == 2)
	968	{
	969	TPT(((0), FIL__, __LINE__, _("msg=<GPG_CHECK: FD2 = %d>\n"), fd2));
	970	#if defined(SH_WITH_SERVER)
[111]	971	tempres = sh_getpwnam(DEFAULT_IDENT);
	972
[1]	973	if ((tempres != NULL) && (0 == sl_ret_euid()))
	974	{
	975	/* privileges not dropped yet*/
	976	homedir = tempres->pw_dir;
	977	}
	978	#endif
	979	status = sh_gpg_check_file_sign(fd2, gp.data_id, gp.data_fp, homedir, 2);
	980	TPT(((0), FIL__, __LINE__, _("msg=<DATA SIGUSR: \|%s\|>\n"), gp.data_id));
	981	TPT(((0), FIL__, __LINE__, _("msg=<DATA SIGFP: \|%s\|>\n"), gp.data_fp));
	982	}
	983
	984	if (SH_GPG_OK == status && what == 1)
	985	{
	986	#ifdef USE_FINGERPRINT
	987	if ((sl_strcmp(SH_GPG_FP, gp.conf_fp) == 0))
	988	{
	989	int i;
	990
	991	for(i = 0; i < (int) sl_strlen(gp.conf_fp); ++i)
	992	{
	993	if (gpgfp[i] != gp.conf_fp[i])
	994	{
	995	sh_error_handle(SH_ERR_SEVERE, FIL__, __LINE__, 0,
	996	MSG_E_GPG_FP,
	997	gpgfp, gp.conf_fp);
	998	break;
	999	}
	1000	}
	1001
	1002	if (smsg == S_FALSE)
	1003	{
	1004	tmp = sh_util_safe_name(gp.conf_id);
[87]	1005	sh_gpg_fill_startup (__LINE__,
[86]	1006	/* sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_START_GH, */
[1]	1007	sh.prg_name, sh.real.uid,
	1008	(sh.flag.hidefile == S_TRUE) ?
	1009	_("(hidden)") : file_path('C', 'R'),
	1010	tmp,
	1011	gp.conf_fp);
	1012	SH_FREE(tmp);
	1013	}
	1014	smsg = S_TRUE;
	1015	SL_RETURN(0, _("sh_gpg_check_sign"));
	1016	}
	1017	else
	1018	{
	1019	/* fp mismatch
	1020	*/
	1021	dlog(1, FIL__, __LINE__,
	1022	_("The fingerprint of the signing key: %s\ndoes not match the compiled-in fingerprint: %s.\nTherefore the signature could not be verified.\n"),
	1023	gp.conf_fp, SH_GPG_FP);
	1024	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
	1025	_("Fingerprint mismatch"),
	1026	_("gpg_check_sign"));
	1027	status = SH_GPG_BADSIGN;
	1028	}
	1029	#else
	1030	if (smsg == S_FALSE)
	1031	{
	1032	tmp = sh_util_safe_name(gp.conf_id);
[86]	1033	sh_gpg_fill_startup (__LINE__,
	1034	/* sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_START_GH, */
[1]	1035	sh.prg_name, sh.real.uid,
	1036	(sh.flag.hidefile == S_TRUE) ?
	1037	_("(hidden)") : file_path('C', 'R'),
	1038	tmp,
	1039	gp.conf_fp);
	1040	SH_FREE(tmp);
	1041	}
	1042	smsg = S_TRUE;
	1043	SL_RETURN(0, _("sh_gpg_check_sign"));
	1044	#endif
	1045	}
	1046
	1047	else if (SH_GPG_OK == status && (what == 2 \|\| what == 0))
	1048	{
	1049	if ((sl_strcmp(gp.data_id, gp.conf_id) == 0) &&
	1050	(sl_strcmp(gp.data_fp, gp.conf_fp) == 0))
	1051	{
	1052	SL_RETURN(0, _("sh_gpg_check_sign"));
	1053	}
	1054	else
	1055	{
	1056	/* ID or fp not equal
	1057	*/
	1058	dlog(1, FIL__, __LINE__,
	1059	_("The fingerprint or ID of the signing key is not the same for the\nconfiguration file and the file signature database.\nTherefore the signature could not be verified.\n"));
	1060	tmp = sh_util_safe_name (gp.conf_id);
	1061	tmp2 = sh_util_safe_name (gp.data_id);
	1062	sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_START_GH2,
	1063	sh.prg_name, sh.real.uid,
	1064	(sh.flag.hidefile == S_TRUE) ? _("(hidden)") : file_path('C', 'R'),
	1065	tmp, gp.conf_fp,
	1066	(sh.flag.hidefile == S_TRUE) ? _("(hidden)") : file_path('D', 'R'),
	1067	tmp2, gp.data_fp);
	1068	SH_FREE(tmp);
	1069	SH_FREE(tmp2);
	1070	}
	1071	}
	1072
	1073	if (status != SH_GPG_OK)
	1074	{
	1075	uid_t e_uid = sl_ret_euid();
	1076	char * e_home = sh.effective.home;
	1077
	1078	#if defined(SH_WITH_SERVER)
[111]	1079	struct passwd * e_tempres = sh_getpwnam(DEFAULT_IDENT);
	1080
[1]	1081	if ((e_tempres != NULL) && (0 == sl_ret_euid()))
	1082	{
	1083	/* privileges not dropped yet */
	1084	e_uid = e_tempres->pw_uid;
	1085	e_home = e_tempres->pw_dir;
	1086	}
	1087	#endif
	1088	dlog(1, FIL__, __LINE__,
	1089	_("The signature of the configuration file or the file signature database\ncould not be verified. Possible reasons are:\n - gpg binary (%s) not found\n - invalid signature\n - the signature key is not in the private keyring of UID %d,\n - there is no keyring in %s/.gnupg, or\n - the file is not signed - did you move /filename.asc to /filename ?\nTo create a signed file, use (remove old signatures before):\n gpg -a --clearsign --not-dash-escaped FILE\n mv FILE.asc FILE\n"),
	1090	#if defined(WITH_GPG)
	1091	DEFAULT_GPG_PATH,
	1092	#else
	1093	DEFAULT_PGP_PATH,
	1094	#endif
	1095	(int) e_uid, e_home);
	1096	}
	1097
	1098	TPT(((0), FIL__, __LINE__, _("msg=<Status = %d>\n"), status));
	1099
	1100	sh_error_handle((-1), FIL__, __LINE__, status, MSG_EXIT_ABORT1, sh.prg_name);
	1101	aud_exit (FIL__, __LINE__, EXIT_FAILURE);
	1102
	1103	return (-1); /* make compiler happy */
	1104	}
	1105
	1106	/* #ifdef WITH_GPG */
	1107	#endif
	1108
	1109
	1110
	1111
	1112
	1113
	1114
	1115

Note: See TracBrowser for help on using the repository browser.

Download in other formats: