source: trunk/src/sh_gpg.c@ 114

Last change on this file since 114 was 111, checked in by rainer, 17 years ago

Fix for ticket #69 (wrappers for name service routines not used everywhere).

File size: 29.7 KB
Line 
1/* SAMHAIN file system integrity testing */
2/* Copyright (C) 1999, 2000 Rainer Wichmann */
3/* */
4/* This program is free software; you can redistribute it */
5/* and/or modify */
6/* it under the terms of the GNU General Public License as */
7/* published by */
8/* the Free Software Foundation; either version 2 of the License, or */
9/* (at your option) any later version. */
10/* */
11/* This program is distributed in the hope that it will be useful, */
12/* but WITHOUT ANY WARRANTY; without even the implied warranty of */
13/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
14/* GNU General Public License for more details. */
15/* */
16/* You should have received a copy of the GNU General Public License */
17/* along with this program; if not, write to the Free Software */
18/* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
19
20#include "config_xor.h"
21
22#include <stdio.h>
23#include <stdlib.h>
24
25
26#if defined(WITH_GPG) || defined(WITH_PGP)
27
28#include <unistd.h>
29#include <fcntl.h>
30#include <signal.h>
31#if defined(SH_WITH_SERVER)
32#include <pwd.h>
33#endif
34#include <sys/stat.h>
35#include <sys/types.h>
36#include <errno.h>
37#include <sys/wait.h>
38
39#include <string.h>
40#ifdef HAVE_MEMORY_H
41#include <memory.h>
42#endif
43
44
45#if !defined(O_NONBLOCK)
46#if defined(O_NDELAY)
47#define O_NONBLOCK O_NDELAY
48#else
49#define O_NONBLOCK 0
50#endif
51#endif
52
53
54#include "samhain.h"
55#include "sh_utils.h"
56#include "sh_error.h"
57#include "sh_tiger.h"
58#if defined(SH_WITH_SERVER)
59#define SH_NEED_PWD_GRP 1
60#include "sh_static.h"
61#endif
62
63static struct {
64 char conf_id[SH_MINIBUF+1];
65 char conf_fp[SH_MINIBUF+1];
66 char data_id[SH_MINIBUF+1];
67 char data_fp[SH_MINIBUF+1];
68} gp;
69
70typedef struct {
71 pid_t pid;
72 FILE * pipe;
73} sh_gpg_popen_t;
74
75#define SH_GPG_OK 0
76#define SH_GPG_BAD 1
77#define SH_GPG_BADSIGN 2
78
79/* replace #if 0 by #if 1 and set an appropriate path in front of '/pdbg.'
80 * for debugging
81 */
82#if 0
83#define PDGBFILE "/pdbg."
84#endif
85
86#if defined(PDGBFILE)
87FILE * pdbg;
88FILE * pdbgc;
89#define PDBG_OPEN pdbg = fopen(PDGBFILE"main", "a")
90#define PDBG_CLOSE fclose (pdbg)
91#define PDBG(arg) fprintf(pdbg, "PDBG: step %d\n", arg); fflush(pdbg)
92#define PDBG_D(arg) fprintf(pdbg, "PDBG: %d\n", arg); fflush(pdbg)
93#define PDBG_S(arg) fprintf(pdbg, "PDBG: %s\n", arg); fflush(pdbg)
94
95#define PDBGC_OPEN pdbgc = fopen(PDGBFILE"child", "a")
96#define PDBGC_CLOSE fclose (pdbgc)
97#define PDBGC(arg) fprintf(pdbgc, "PDBG: step %d\n", arg); fflush(pdbgc)
98#define PDBGC_D(arg) fprintf(pdbgc, "PDBG: %d\n", arg); fflush(pdbgc)
99#define PDBGC_S(arg) fprintf(pdbgc, "PDBG: %s\n", arg); fflush(pdbgc)
100#else
101#define PDBG_OPEN
102#define PDBG_CLOSE
103#define PDBG(arg)
104#define PDBG_D(arg)
105#define PDBG_S(arg)
106#define PDBGC_OPEN
107#define PDBGC_CLOSE
108#define PDBGC(arg)
109#define PDBGC_D(arg)
110#define PDBGC_S(arg)
111#endif
112
113#undef FIL__
114#define FIL__ _("sh_gpg.c")
115
116#ifdef GPG_HASH
117
118static int sh_gpg_checksum (SL_TICKET checkfd, int flag)
119{
120 char * test_gpg;
121 char * test_ptr1 = NULL;
122 char * test_ptr2 = NULL;
123 char wstrip1[128];
124 char wstrip2[128];
125 int i, k;
126#include "sh_gpg_chksum.h"
127
128 SL_ENTER(_("sh_gpg_checksum"));
129
130 tiger_fd = checkfd;
131#if defined(WITH_PGP)
132 test_gpg = sh_tiger_hash_gpg (DEFAULT_PGP_PATH, TIGER_FD, 0);
133#else
134 test_gpg = sh_tiger_hash_gpg (DEFAULT_GPG_PATH, TIGER_FD, 0);
135#endif
136
137 test_ptr1 = strchr(GPG_HASH, ':');
138 if (test_gpg != NULL)
139 test_ptr2 = strchr(test_gpg, ':');
140
141 if (test_ptr2 != NULL)
142 test_ptr2 += 2;
143 else
144 test_ptr2 = test_gpg;
145 if (test_ptr1 != NULL)
146 test_ptr1 += 2;
147 else
148 test_ptr1 = GPG_HASH;
149
150 /* Tue Jun 24 23:11:54 CEST 2003 (1.7.9) -- strip whitespace
151 */
152 k = 0;
153 for (i = 0; i < 127; ++i)
154 {
155 if (test_ptr1[i] == '\0')
156 break;
157 if (test_ptr1[i] != ' ')
158 {
159 wstrip1[k] = test_ptr1[i];
160 ++k;
161 }
162 }
163 wstrip1[k] = '\0';
164
165 for(i = 0; i < KEY_LEN; ++i)
166 {
167 if (gpgchk[i] != wstrip1[i])
168 {
169 sh_error_handle(SH_ERR_SEVERE, FIL__, __LINE__, 0, MSG_E_GPG_CHK,
170 gpgchk, wstrip1);
171 break;
172 }
173 }
174
175 k = 0;
176 for (i = 0; i < 127; ++i)
177 {
178 if (test_ptr2[i] == '\0')
179 break;
180 if (test_ptr2[i] != ' ')
181 {
182 wstrip2[k] = test_ptr2[i];
183 ++k;
184 }
185 }
186 wstrip2[k] = '\0';
187
188 if (0 != sl_strncmp(wstrip1, wstrip2, 127))
189 {
190 TPT(((0), FIL__, __LINE__, _("msg=<pgp checksum: %s>\n"), test_gpg));
191 TPT(((0), FIL__, __LINE__, _("msg=<Compiled-in : %s>\n"), GPG_HASH));
192 TPT(((0), FIL__, __LINE__, _("msg=<wstrip1 : %s>\n"), wstrip1));
193 TPT(((0), FIL__, __LINE__, _("msg=<wstrip2 : %s>\n"), wstrip2));
194 if (flag == 1)
195 sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_GPG,
196 GPG_HASH, test_gpg);
197 dlog(1, FIL__, __LINE__, _("The compiled-in checksum of the gpg binary\n(%s)\ndoes not match the actual checksum\n(%s).\nYou need to recompile with the correct checksum."), wstrip1, wstrip2);
198 SH_FREE(test_gpg);
199 SL_RETURN((-1), _("sh_gpg_checksum"));
200 }
201 SH_FREE(test_gpg);
202 SL_RETURN( (0), _("sh_gpg_checksum"));
203}
204#endif
205
206struct startup_info {
207 long line;
208 char * program;
209 long uid;
210 char * path;
211 char * key_uid;
212 char * key_id;
213};
214
215static struct startup_info startInfo = { 0, NULL, 0, NULL, NULL, NULL };
216
217void sh_gpg_log_startup ()
218{
219 if (startInfo.program != NULL)
220 {
221 sh_error_handle ((-1), FIL__, startInfo.line, 0, MSG_START_GH,
222 startInfo.program, startInfo.uid,
223 startInfo.path,
224 startInfo.key_uid, startInfo.key_id);
225 }
226 return;
227}
228
229static void sh_gpg_fill_startup (long line, char * program, long uid, char * path,
230 char * key_uid, char * key_id)
231{
232 startInfo.line = line;
233 startInfo.program = sh_util_strdup(program);
234 startInfo.uid = uid;
235 startInfo.path = sh_util_strdup(path);
236 startInfo.key_uid = sh_util_strdup(key_uid);
237 startInfo.key_id = sh_util_strdup(key_id);
238 return;
239}
240
241static FILE * sh_gpg_popen (sh_gpg_popen_t *source, int fd,
242 int mode, char * id, char * homedir)
243{
244 int pipedes[2];
245 FILE * outf = NULL;
246 char * envp[2];
247 size_t len;
248 char path[256];
249 char cc1[32];
250 char cc2[32];
251#if defined(WITH_PGP)
252 char cc3[32];
253 char cc0[3] = "-f";
254#endif
255#if defined(WITH_GPG)
256 char cc0[2] = "-";
257 char cc3[32];
258 char cc4[SH_PATHBUF+32];
259 char cc5[32] = "--no-tty";
260#endif
261
262 char * arg[9];
263
264#if defined(HAVE_GPG_CHECKSUM)
265 SL_TICKET checkfd;
266 int myrand;
267 int i;
268#if defined(__linux__)
269 int get_the_fd(SL_TICKET);
270 char pname[128];
271 int pfd;
272#endif
273#endif
274
275 SL_ENTER(_("sh_gpg_popen"));
276
277#if defined(WITH_GPG)
278 /* -- GnuPG -- */
279 sl_strlcpy (path, DEFAULT_GPG_PATH, 256);
280 sl_strlcpy (cc1, _("--status-fd"), 32);
281 sl_strlcpy (cc2, _("--verify"), 32);
282 sl_strlcpy (cc3, _("--homedir"), 32);
283 /* sl_strlcpy (cc4, sh.effective.home, SH_PATHBUF+32); */
284 sl_strlcpy (cc4, homedir, SH_PATHBUF+32);
285 sl_strlcat (cc4, _("/.gnupg"), SH_PATHBUF+32);
286
287 /* fprintf(stderr, "YULE: homedir=%s\n", homedir); */
288
289#if defined(SH_WITH_SERVER)
290 if (0 == sl_ret_euid()) /* privileges not dropped yet */
291 {
292 struct stat lbuf;
293 int status_stat = 0;
294 struct passwd * tempres = sh_getpwnam(DEFAULT_IDENT);
295
296 if (!tempres)
297 {
298 dlog(1, FIL__, __LINE__,
299 _("User %s does not exist. Please add the user to your system.\n"),
300 DEFAULT_IDENT);
301 status_stat = -1;
302 }
303 if (!tempres->pw_dir || tempres->pw_dir[0] == '\0')
304 {
305 dlog(1, FIL__, __LINE__,
306 _("User %s does not have a home directory.\nPlease add the home directory for this user to your system.\n"),
307 DEFAULT_IDENT);
308 status_stat = -2;
309 }
310 if (status_stat == 0)
311 {
312 sl_strlcpy (cc4, tempres->pw_dir, SH_PATHBUF+32);
313 sl_strlcat (cc4, _("/.gnupg"), SH_PATHBUF+32);
314 status_stat = retry_lstat(FIL__, __LINE__, cc4, &lbuf);
315 if (status_stat == -1)
316 {
317 dlog(1, FIL__, __LINE__,
318 _("Gnupg directory %s for user %s\ndoes not exist or is not accessible.\nPlease add the directory and put the keyring (pubring.gpg) there\nto verify the configuration file.\n"),
319 cc4, DEFAULT_IDENT);
320 status_stat = -3;
321 }
322 }
323 if (status_stat == 0 && lbuf.st_uid != tempres->pw_uid)
324 {
325 dlog(1, FIL__, __LINE__,
326 _("Gnupg directory %s\nis not owned by user %s.\n"),
327 cc4, DEFAULT_IDENT);
328 status_stat = -4;
329 }
330 if (status_stat == 0)
331 {
332 sl_strlcat (cc4, _("/pubring.gpg"), SH_PATHBUF+32);
333 status_stat = retry_lstat(FIL__, __LINE__, cc4, &lbuf);
334 if (status_stat == -1)
335 {
336 dlog(1, FIL__, __LINE__,
337 _("Gnupg public keyring %s for user %s\ndoes not exist or is not accessible.\nPlease add the directory and put the keyring (pubring.gpg) there\nto verify the configuration file.\n"),
338 cc4, DEFAULT_IDENT);
339 status_stat = -5;
340 }
341 }
342 if (status_stat == 0 && lbuf.st_uid != tempres->pw_uid)
343 {
344 dlog(1, FIL__, __LINE__,
345 _("Gnupg public keyring %s\nis not owned by user %s.\n"),
346 cc4, DEFAULT_IDENT);
347 status_stat = -6;
348 }
349 if (status_stat != 0)
350 {
351 sh_error_handle((-1), FIL__, __LINE__, status_stat, MSG_EXIT_ABORT1,
352 sh.prg_name);
353 aud_exit (FIL__, __LINE__, EXIT_FAILURE);
354 }
355 sl_strlcpy (cc4, tempres->pw_dir, SH_PATHBUF+32);
356 sl_strlcat (cc4, _("/.gnupg"), SH_PATHBUF+32);
357 }
358#endif
359
360 arg[0] = path;
361 arg[1] = cc1;
362 arg[2] = "1";
363 arg[3] = cc2;
364 arg[4] = cc3;
365 arg[5] = cc4;
366 arg[6] = cc5;
367 arg[7] = cc0;
368 arg[8] = NULL;
369
370 /* catch 'unused parameter' compiler warning
371 */
372 (void) mode;
373 (void) id;
374#elif defined(WITH_PGP)
375 /* -- PGP -- */
376 sl_strlcpy (path, DEFAULT_PGP_PATH, 256);
377 if (mode == 0)
378 {
379 sl_strlcpy (cc1, _("+language=en"), 32);
380 sl_strlcpy (cc2, _("-o"), 32);
381 sl_strlcpy (cc3, _("/dev/null"), 32);
382
383 arg[0] = path;
384 arg[1] = cc1;
385 arg[2] = cc2;
386 arg[3] = cc3;
387 arg[4] = cc0;
388 arg[5] = NULL;
389 }
390 else
391 {
392 sl_strlcpy (cc1, _("+language=en"), 32);
393 sl_strlcpy (cc2, _("-kvc"), 32);
394
395 arg[0] = path;
396 arg[1] = cc1;
397 arg[2] = cc2;
398 arg[3] = id;
399 arg[4] = NULL;
400 arg[5] = NULL;
401 }
402#endif
403
404 /* use homedir of effective user
405 */
406 if (sh.effective.home != NULL)
407 {
408 len = sl_strlen(sh.effective.home) + 6;
409 envp[0] = malloc (len); /* free() ok */
410 if (envp[0] != NULL)
411 sl_snprintf (envp[0], len, "HOME=%s", sh.effective.home);
412 envp[1] = NULL;
413 }
414 else
415 {
416 envp[0] = NULL;
417 }
418
419 /* Create the pipe
420 */
421 if (aud_pipe(FIL__, __LINE__, pipedes) < 0)
422 {
423 if (envp[0] != NULL)
424 free(envp[0]);
425 SL_RETURN( (NULL), _("sh_gpg_popen"));
426 }
427
428 fflush (NULL);
429
430 source->pid = aud_fork(FIL__, __LINE__);
431
432 /* Failure
433 */
434 if (source->pid == (pid_t) - 1)
435 {
436 close(pipedes[0]);
437 close(pipedes[1]);
438 if (envp[0] != NULL)
439 free(envp[0]);
440 SL_RETURN( (NULL), _("sh_gpg_popen"));
441 }
442
443 if (source->pid == (pid_t) 0)
444 {
445
446 /* child - make read side of the pipe stdout
447 */
448 if (retry_aud_dup2(FIL__, __LINE__,
449 pipedes[STDOUT_FILENO], STDOUT_FILENO) < 0)
450 {
451 TPT(((0), FIL__, __LINE__, _("msg=<dup2 on pipe failed>\n")));
452 dlog(1, FIL__, __LINE__, _("Internal error: dup2 failed\n"));
453 aud__exit(FIL__, __LINE__, EXIT_FAILURE);
454 }
455
456 /* close the pipe descriptors
457 */
458 close (pipedes[STDIN_FILENO]);
459 close (pipedes[STDOUT_FILENO]);
460
461
462#if defined(WITH_PGP)
463 if (mode == 0)
464 {
465 if (retry_aud_dup2(FIL__, __LINE__, fd, STDIN_FILENO) < 0)
466 {
467 TPT(((0), FIL__, __LINE__, _("msg=<dup2 on fd failed>\n")));
468 dlog(1, FIL__, __LINE__, _("Internal error: dup2 failed\n"));
469 aud__exit(FIL__, __LINE__, EXIT_FAILURE);
470 }
471 }
472#else
473 if (retry_aud_dup2(FIL__, __LINE__, fd, STDIN_FILENO) < 0)
474 {
475 TPT(((0), FIL__, __LINE__, _("msg=<dup2 on fd failed>\n")));
476 dlog(1, FIL__, __LINE__, _("Internal error: dup2 failed\n"));
477 aud__exit(FIL__, __LINE__, EXIT_FAILURE);
478 }
479#endif
480
481 /* don't leak file descriptors
482 */
483 sh_unix_closeall (3, -1); /* in child process */
484
485 freopen(_("/dev/null"), "r+", stderr);
486
487 /* We should become privileged if SUID,
488 * to be able to read the keyring.
489 * We have checked that gpg is OK,
490 * AND that only a trusted user could overwrite
491 * gpg.
492 */
493 memset (skey, '\0', sizeof(sh_key_t));
494 aud_setuid(FIL__, __LINE__, geteuid());
495
496 PDBGC_OPEN;
497 PDBGC_D((int)getuid());
498 PDBGC_D((int)geteuid());
499
500 {
501 int i = 0;
502 while (arg[i] != NULL)
503 {
504 PDBGC_S(arg[i]);
505 ++i;
506 }
507 }
508 PDBGC_CLOSE;
509
510 /* exec the program */
511
512#if defined(__linux__) && defined(HAVE_GPG_CHECKSUM)
513 /*
514 * -- emulate an fexecve with checksum testing
515 */
516#if defined(WITH_PGP)
517 checkfd = sl_open_read(DEFAULT_PGP_PATH, SL_NOPRIV);
518#else
519 checkfd = sl_open_read(DEFAULT_GPG_PATH, SL_NOPRIV);
520#endif
521
522 if (0 != sh_gpg_checksum(checkfd, 0))
523 aud__exit(FIL__, __LINE__, EXIT_FAILURE);
524
525 pfd = get_the_fd(checkfd);
526 sl_snprintf(pname, sizeof(pname), _("/proc/self/fd/%d"), pfd);
527 if (0 == access(pname, R_OK|X_OK)) /* flawfinder: ignore */
528
529 {
530 fcntl (pfd, F_SETFD, FD_CLOEXEC);
531 retry_aud_execve (FIL__, __LINE__, pname, arg, envp);
532
533 dlog(1, FIL__, __LINE__, _("Unexpected error: execve %s failed\n"),
534 pname);
535 /* failed
536 */
537 aud__exit(FIL__, __LINE__, EXIT_FAILURE);
538 }
539
540 /* procfs not working, go ahead
541 */
542 sl_close(checkfd);
543#endif
544
545#if defined(HAVE_GPG_CHECKSUM)
546 /* This is an incredibly ugly kludge to prevent an attacker
547 * from knowing when it is safe to slip in a fake executable
548 * between the integrity check and the execve
549 */
550 myrand = (int) taus_get (&(skey->rng0[0]), &(skey->rng1[0]),
551 &(skey->rng2[0]));
552 myrand = (myrand < 0) ? (-myrand) : myrand;
553 myrand = (myrand % 32) + 2;
554
555 for (i = 0; i < myrand; ++i)
556 {
557#if defined(WITH_PGP)
558 checkfd = sl_open_fastread(DEFAULT_PGP_PATH, SL_NOPRIV);
559#else
560 checkfd = sl_open_fastread(DEFAULT_GPG_PATH, SL_NOPRIV);
561#endif
562 if (0 != sh_gpg_checksum(checkfd, 0)) {
563 aud__exit(FIL__, __LINE__, EXIT_FAILURE);
564 }
565 sl_close(checkfd);
566 }
567#endif
568
569
570#if defined(WITH_GPG)
571 retry_aud_execve (FIL__, __LINE__, DEFAULT_GPG_PATH, arg, envp);
572 dlog(1, FIL__, __LINE__, _("Unexpected error: execve %s failed\n"),
573 DEFAULT_GPG_PATH);
574#elif defined(WITH_PGP)
575 retry_aud_execve (FIL__, __LINE__, DEFAULT_PGP_PATH, arg, envp);
576#endif
577
578 /* failed
579 */
580 TPT(((0), FIL__, __LINE__, _("msg=<execve failed>\n")));
581 dlog(1, FIL__, __LINE__, _("Unexpected error: execve failed\n"));
582 aud__exit(FIL__, __LINE__, EXIT_FAILURE);
583 }
584
585 /* parent
586 */
587
588 if (envp[0] != NULL)
589 free(envp[0]);
590
591 close (pipedes[STDOUT_FILENO]);
592 retry_fcntl (FIL__, __LINE__, pipedes[STDIN_FILENO], F_SETFD, FD_CLOEXEC);
593 retry_fcntl (FIL__, __LINE__, pipedes[STDIN_FILENO], F_SETFL, O_NONBLOCK);
594
595 outf = fdopen (pipedes[STDIN_FILENO], "r");
596
597 if (outf == NULL)
598 {
599 aud_kill (FIL__, __LINE__, source->pid, SIGKILL);
600 close (pipedes[STDOUT_FILENO]);
601 waitpid (source->pid, NULL, 0);
602 source->pid = 0;
603 SL_RETURN( (NULL), _("sh_gpg_popen"));
604 }
605
606 SL_RETURN( (outf), _("sh_gpg_popen"));
607}
608
609
610static int sh_gpg_pclose (sh_gpg_popen_t *source)
611{
612 int status = 0;
613
614 SL_ENTER(_("sh_gpg_pclose"));
615
616 status = fclose(source->pipe);
617 if (status)
618 SL_RETURN( (-1), _("sh_gpg_pclose"));
619
620 if (waitpid(source->pid, NULL, 0) != source->pid)
621 status = -1;
622
623 source->pipe = NULL;
624 source->pid = 0;
625 SL_RETURN( (status), _("sh_gpg_pclose"));
626}
627
628static
629int sh_gpg_check_file_sign(int fd, char * sign_id, char * sign_fp,
630 char * homedir, int whichfile)
631{
632 struct stat buf;
633 char line[256];
634 sh_gpg_popen_t source;
635 int have_id = BAD, have_fp = BAD, status = 0;
636#ifdef WITH_PGP
637 char *ptr;
638#endif
639
640#ifdef HAVE_GPG_CHECKSUM
641 SL_TICKET checkfd;
642#endif
643
644 SL_ENTER(_("sh_gpg_check_file_sign"));
645
646 /* check whether GnuPG exists and has the correct checksum
647 */
648#if defined(WITH_GPG)
649
650 TPT(((0), FIL__, __LINE__, _("msg=<Check signature>\n")));
651 TPT(((0), FIL__, __LINE__, _("msg=<gpg is %s>\n"), DEFAULT_GPG_PATH));
652
653 if (0 != retry_lstat(FIL__, __LINE__, DEFAULT_GPG_PATH, &buf))
654 {
655 status = errno;
656 sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, status, MSG_ERR_LSTAT,
657 sh_error_message(status), DEFAULT_GPG_PATH);
658 SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
659 }
660
661 if (0 != tf_trust_check (DEFAULT_GPG_PATH, SL_YESPRIV))
662 SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
663
664#ifdef HAVE_GPG_CHECKSUM
665 checkfd = sl_open_read(DEFAULT_GPG_PATH, SL_YESPRIV);
666
667 if (0 != sh_gpg_checksum(checkfd, 1))
668 {
669 sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
670 _("Checksum mismatch"),
671 _("gpg_check_file_sign"));
672 sl_close(checkfd);
673 SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
674 }
675 sl_close(checkfd);
676#endif
677
678#elif defined(WITH_PGP)
679
680 TPT(((0), FIL__, __LINE__, _("msg=<Check signature>\n")));
681 TPT(((0), FIL__, __LINE__, _("msg=<pgp is %s>\n"), DEFAULT_PGP_PATH));
682
683 if (0 != retry_lstat(FIL__, __LINE__, DEFAULT_PGP_PATH, &buf))
684 {
685 status = errno;
686 sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, status, MSG_ERR_LSTAT,
687 sh_error_message(status), DEFAULT_PGP_PATH);
688 SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
689 }
690 if (0 != tf_trust_check (DEFAULT_PGP_PATH, SL_YESPRIV))
691 SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
692
693#ifdef HAVE_GPG_CHECKSUM
694 checkfd = sl_open_read(DEFAULT_PGP_PATH, SL_YESPRIV);
695
696 if (0 != sh_gpg_checksum(checkfd, 1))
697 {
698 sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
699 _("Checksum mismatch"),
700 _("gpg_check_file_sign"));
701 sl_close(checkfd);
702 SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
703 }
704 sl_close(checkfd);
705#endif
706
707#endif
708
709 TPT(((0), FIL__, __LINE__, _("msg=<Open pipe to check signature>\n")));
710
711 fflush(NULL);
712
713 source.pipe = sh_gpg_popen ( &source, fd, 0, NULL, homedir );
714
715 if (NULL == source.pipe)
716 {
717 sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
718 _("Could not open pipe"),
719 _("gpg_check_file_sign"));
720 SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
721 }
722
723 TPT(((0), FIL__, __LINE__, _("msg=<Open pipe success>\n")));
724
725 xagain:
726
727 errno = 0;
728
729 while (NULL != fgets(line, sizeof(line), source.pipe))
730 {
731
732 TPT(((0), FIL__, __LINE__, _("msg=<gpg out: %s>\n"), line));
733 if (line[strlen(line)-1] == '\n')
734 line[strlen(line)-1] = ' ';
735 sh_error_handle(SH_ERR_ALL, FIL__, __LINE__, 0, MSG_E_SUBGEN,
736 line,
737 _("gpg_check_file_sign"));
738
739 if (sl_strlen(line) < 18)
740 continue;
741#if defined(WITH_GPG)
742 /* Sun May 27 18:40:05 CEST 2001
743 */
744 if (0 == sl_strncmp(_("BADSIG"), &line[9], 6) ||
745 0 == sl_strncmp(_("ERRSIG"), &line[9], 6) ||
746 0 == sl_strncmp(_("NO_PUBKEY"), &line[9], 6) ||
747 0 == sl_strncmp(_("NODATA"), &line[9], 6) ||
748 0 == sl_strncmp(_("SIGEXPIRED"), &line[9], 6))
749 {
750 if (0 == sl_strncmp(_("BADSIG"), &line[9], 6)) {
751 dlog(1, FIL__, __LINE__,
752 _("%s file is signed, but the signature is invalid."),
753 ((whichfile == 1) ? _("Configuration") : _("Database")));
754 }
755 else if (0 == sl_strncmp(_("NO_PUBKEY"), &line[9], 6)) {
756 dlog(1, FIL__, __LINE__,
757 _("%s file is signed, but the public key to verify the signature is not in my keyring %s/.gnupg/pubring.asc."),
758 ((whichfile == 1) ? _("Configuration") : _("Database")),
759 homedir);
760 }
761 else if (0 == sl_strncmp(_("ERRSIG"), &line[9], 6)) {
762 dlog(1, FIL__, __LINE__,
763 _("%s file is signed, but the public key to verify the signature is not in my keyring %s/.gnupg/pubring.asc."),
764 ((whichfile == 1) ? _("Configuration") : _("Database")),
765 homedir);
766 }
767 else if (0 == sl_strncmp(_("SIGEXPIRED"), &line[9], 6)) {
768 dlog(1, FIL__, __LINE__,
769 _("%s file is signed, but the public key to verify the signature has expired."),
770 ((whichfile == 1) ? _("Configuration") : _("Database")));
771 }
772 else if (0 == sl_strncmp(_("NODATA"), &line[9], 6)) {
773 dlog(1, FIL__, __LINE__,
774 _("%s file is not signed."),
775 ((whichfile == 1) ? _("Configuration") : _("Database")));
776 }
777
778 have_fp = BAD; have_id = BAD;
779 break;
780 }
781 if (0 == sl_strncmp(_("GOODSIG"), &line[9], 7))
782 {
783 sl_strlcpy (sign_id, &line[25], SH_MINIBUF+1);
784 sign_id[sl_strlen(sign_id)-1] = '\0'; /* remove trailing '"' */
785 have_id = GOOD;
786 }
787 if (0 == sl_strncmp(_("VALIDSIG"), &line[9], 8))
788 {
789 strncpy (sign_fp, &line[18], 40);
790 sign_fp[40] = '\0';
791 have_fp = GOOD;
792 }
793#elif defined(WITH_PGP)
794 if (0 == sl_strncmp(_("Bad signature"), line, 13) ||
795 0 == sl_strncmp(_("Error"), line, 5) ||
796 0 == sl_strncmp(_("Malformed"), line, 9) ||
797 0 == sl_strncmp(_("WARNING"), line, 7) ||
798 0 == sl_strncmp(_("ERROR"), line, 5)
799 )
800 {
801 have_fp = BAD; have_id = BAD;
802 break;
803 }
804 if (0 == sl_strncmp(_("Good signature"), line, 14))
805 {
806 ptr = strchr ( line, '"');
807 ++ptr;
808 sl_strlcpy (sign_id, ptr, SH_MINIBUF+1);
809 sign_id[sl_strlen(sign_id)-1] = '\0'; /* remove trailing dot */
810 sign_id[sl_strlen(sign_id)-2] = '\0'; /* remove trailing '"' */
811 have_id = GOOD;
812 }
813#endif
814 }
815
816 if (ferror(source.pipe) && errno == EAGAIN)
817 {
818 clearerr(source.pipe);
819 goto xagain;
820 }
821
822 sh_gpg_pclose (&source);
823
824 TPT(((0), FIL__, __LINE__, _("msg=<Close pipe>\n")));
825
826#ifdef WITH_PGP
827 /* get the fingerprint */
828
829 source.pipe = sh_gpg_popen ( &source, fd, 1, sign_id, homedir);
830 if (NULL == source.pipe)
831 {
832 sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
833 _("Could not open pipe for fp"),
834 _("gpg_check_file_sign"));
835 SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
836 }
837
838 TPT(((0), FIL__, __LINE__, _("msg=<Open pipe success>\n")));
839
840 yagain:
841
842 errno = 0;
843
844 while (NULL != fgets(line, sizeof(line), source.pipe))
845 {
846 if (line[strlen(line)-1] == '\n')
847 line[strlen(line)-1] = ' ';
848 sh_error_handle(SH_ERR_ALL, FIL__, __LINE__, 0, MSG_E_SUBGEN,
849 line,
850 _("gpg_check_file_sign"));
851
852 if (sl_strlen(line) < 18)
853 continue;
854 ptr = strtok (line, " ");
855 while (ptr)
856 {
857 ptr = strtok (NULL, " ");
858 if (ptr && 0 == sl_strncmp (ptr, _("fingerprint"), 11))
859 {
860 ptr = strtok (NULL, " "); /* to '=' */
861 sign_fp[0] = '\0';
862 while (ptr)
863 {
864 ptr = strtok (NULL, " "); /* part of fingerprint */
865 sl_strlcat (sign_fp, ptr, SH_MINIBUF+1);
866 }
867 /* sign_fp[sl_strlen(sign_fp)-1] = '\0'; remove trailing '\n' */
868 if (sl_strlen(sign_fp) > 0)
869 have_fp = GOOD;
870 break;
871 }
872 }
873 }
874
875 if (ferror(source.pipe) && errno == EAGAIN)
876 {
877 clearerr(source.pipe);
878 goto yagain;
879 }
880
881 sh_gpg_pclose (&source);
882#endif
883
884 if (have_id == GOOD)
885 {
886 TPT(((0), FIL__, __LINE__, _("msg=<Got signator ID>\n")));
887 ;
888 }
889 if (have_fp == GOOD)
890 {
891 TPT(((0), FIL__, __LINE__, _("msg=<Got fingerprint>\n")));
892 ;
893 }
894
895 if (have_id == GOOD && have_fp == GOOD)
896 SL_RETURN( SH_GPG_OK, _("sh_gpg_check_file_sign"));
897 else
898 {
899 if (have_id == BAD)
900 sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
901 _("No good signature"),
902 _("gpg_check_file_sign"));
903 else
904 sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
905 _("No fingerprint for key"),
906 _("gpg_check_file_sign"));
907 SL_RETURN( SH_GPG_BADSIGN, _("sh_gpg_check_file_sign"));
908 }
909}
910
911int get_the_fd(SL_TICKET file_1);
912
913int sh_gpg_check_sign (long file_1, long file_2, int what)
914{
915 int status = SH_GPG_BAD;
916 int fd1 = 0;
917 int fd2 = 0;
918 static int smsg = S_FALSE;
919 char * tmp;
920 char * tmp2;
921
922 char * homedir = sh.effective.home;
923#if defined(SH_WITH_SERVER)
924 struct passwd * tempres;
925#endif
926#ifdef USE_FINGERPRINT
927#include "sh_gpg_fp.h"
928#endif
929
930 SL_ENTER(_("sh_gpg_check_sign"));
931
932
933 if (what == 0 || what == 1)
934 fd1 = get_the_fd(file_1);
935 if (what == 0 || what == 2)
936 fd2 = get_the_fd(file_2);
937
938
939 if (fd1 < 0 || fd2 < 0)
940 {
941 TPT(((0), FIL__, __LINE__, _("msg=<GPG_CHECK: FD1 = %d>\n"), fd1));
942 TPT(((0), FIL__, __LINE__, _("msg=<GPG_CHECK: FD2 = %d>\n"), fd2));
943 dlog(1, FIL__, __LINE__,
944 _("This looks like an unexpected internal error.\n"));
945 sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_EXIT_ABORT1, sh.prg_name);
946 aud_exit (FIL__, __LINE__, EXIT_FAILURE);
947 SL_RETURN( (-1), _("sh_gpg_check_sign"));
948 }
949
950 if (what == 0 || what == 1)
951 {
952 TPT(((0), FIL__, __LINE__, _("msg=<GPG_CHECK: FD1 = %d>\n"), fd1));
953#if defined(SH_WITH_SERVER)
954 tempres = sh_getpwnam(DEFAULT_IDENT);
955
956 if ((tempres != NULL) && (0 == sl_ret_euid()))
957 {
958 /* privileges not dropped yet*/
959 homedir = tempres->pw_dir;
960 }
961#endif
962 status = sh_gpg_check_file_sign(fd1, gp.conf_id, gp.conf_fp, homedir, 1);
963 TPT(((0), FIL__, __LINE__, _("msg=<CONF SIGUSR: |%s|>\n"), gp.conf_id));
964 TPT(((0), FIL__, __LINE__, _("msg=<CONF SIGFP: |%s|>\n"), gp.conf_fp));
965 }
966
967 if ((what == 0 && SH_GPG_OK == status) || what == 2)
968 {
969 TPT(((0), FIL__, __LINE__, _("msg=<GPG_CHECK: FD2 = %d>\n"), fd2));
970#if defined(SH_WITH_SERVER)
971 tempres = sh_getpwnam(DEFAULT_IDENT);
972
973 if ((tempres != NULL) && (0 == sl_ret_euid()))
974 {
975 /* privileges not dropped yet*/
976 homedir = tempres->pw_dir;
977 }
978#endif
979 status = sh_gpg_check_file_sign(fd2, gp.data_id, gp.data_fp, homedir, 2);
980 TPT(((0), FIL__, __LINE__, _("msg=<DATA SIGUSR: |%s|>\n"), gp.data_id));
981 TPT(((0), FIL__, __LINE__, _("msg=<DATA SIGFP: |%s|>\n"), gp.data_fp));
982 }
983
984 if (SH_GPG_OK == status && what == 1)
985 {
986#ifdef USE_FINGERPRINT
987 if ((sl_strcmp(SH_GPG_FP, gp.conf_fp) == 0))
988 {
989 int i;
990
991 for(i = 0; i < (int) sl_strlen(gp.conf_fp); ++i)
992 {
993 if (gpgfp[i] != gp.conf_fp[i])
994 {
995 sh_error_handle(SH_ERR_SEVERE, FIL__, __LINE__, 0,
996 MSG_E_GPG_FP,
997 gpgfp, gp.conf_fp);
998 break;
999 }
1000 }
1001
1002 if (smsg == S_FALSE)
1003 {
1004 tmp = sh_util_safe_name(gp.conf_id);
1005 sh_gpg_fill_startup (__LINE__,
1006 /* sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_START_GH, */
1007 sh.prg_name, sh.real.uid,
1008 (sh.flag.hidefile == S_TRUE) ?
1009 _("(hidden)") : file_path('C', 'R'),
1010 tmp,
1011 gp.conf_fp);
1012 SH_FREE(tmp);
1013 }
1014 smsg = S_TRUE;
1015 SL_RETURN(0, _("sh_gpg_check_sign"));
1016 }
1017 else
1018 {
1019 /* fp mismatch
1020 */
1021 dlog(1, FIL__, __LINE__,
1022 _("The fingerprint of the signing key: %s\ndoes not match the compiled-in fingerprint: %s.\nTherefore the signature could not be verified.\n"),
1023 gp.conf_fp, SH_GPG_FP);
1024 sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
1025 _("Fingerprint mismatch"),
1026 _("gpg_check_sign"));
1027 status = SH_GPG_BADSIGN;
1028 }
1029#else
1030 if (smsg == S_FALSE)
1031 {
1032 tmp = sh_util_safe_name(gp.conf_id);
1033 sh_gpg_fill_startup (__LINE__,
1034 /* sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_START_GH, */
1035 sh.prg_name, sh.real.uid,
1036 (sh.flag.hidefile == S_TRUE) ?
1037 _("(hidden)") : file_path('C', 'R'),
1038 tmp,
1039 gp.conf_fp);
1040 SH_FREE(tmp);
1041 }
1042 smsg = S_TRUE;
1043 SL_RETURN(0, _("sh_gpg_check_sign"));
1044#endif
1045 }
1046
1047 else if (SH_GPG_OK == status && (what == 2 || what == 0))
1048 {
1049 if ((sl_strcmp(gp.data_id, gp.conf_id) == 0) &&
1050 (sl_strcmp(gp.data_fp, gp.conf_fp) == 0))
1051 {
1052 SL_RETURN(0, _("sh_gpg_check_sign"));
1053 }
1054 else
1055 {
1056 /* ID or fp not equal
1057 */
1058 dlog(1, FIL__, __LINE__,
1059 _("The fingerprint or ID of the signing key is not the same for the\nconfiguration file and the file signature database.\nTherefore the signature could not be verified.\n"));
1060 tmp = sh_util_safe_name (gp.conf_id);
1061 tmp2 = sh_util_safe_name (gp.data_id);
1062 sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_START_GH2,
1063 sh.prg_name, sh.real.uid,
1064 (sh.flag.hidefile == S_TRUE) ? _("(hidden)") : file_path('C', 'R'),
1065 tmp, gp.conf_fp,
1066 (sh.flag.hidefile == S_TRUE) ? _("(hidden)") : file_path('D', 'R'),
1067 tmp2, gp.data_fp);
1068 SH_FREE(tmp);
1069 SH_FREE(tmp2);
1070 }
1071 }
1072
1073 if (status != SH_GPG_OK)
1074 {
1075 uid_t e_uid = sl_ret_euid();
1076 char * e_home = sh.effective.home;
1077
1078#if defined(SH_WITH_SERVER)
1079 struct passwd * e_tempres = sh_getpwnam(DEFAULT_IDENT);
1080
1081 if ((e_tempres != NULL) && (0 == sl_ret_euid()))
1082 {
1083 /* privileges not dropped yet */
1084 e_uid = e_tempres->pw_uid;
1085 e_home = e_tempres->pw_dir;
1086 }
1087#endif
1088 dlog(1, FIL__, __LINE__,
1089 _("The signature of the configuration file or the file signature database\ncould not be verified. Possible reasons are:\n - gpg binary (%s) not found\n - invalid signature\n - the signature key is not in the private keyring of UID %d,\n - there is no keyring in %s/.gnupg, or\n - the file is not signed - did you move /filename.asc to /filename ?\nTo create a signed file, use (remove old signatures before):\n gpg -a --clearsign --not-dash-escaped FILE\n mv FILE.asc FILE\n"),
1090#if defined(WITH_GPG)
1091 DEFAULT_GPG_PATH,
1092#else
1093 DEFAULT_PGP_PATH,
1094#endif
1095 (int) e_uid, e_home);
1096 }
1097
1098 TPT(((0), FIL__, __LINE__, _("msg=<Status = %d>\n"), status));
1099
1100 sh_error_handle((-1), FIL__, __LINE__, status, MSG_EXIT_ABORT1, sh.prg_name);
1101 aud_exit (FIL__, __LINE__, EXIT_FAILURE);
1102
1103 return (-1); /* make compiler happy */
1104}
1105
1106/* #ifdef WITH_GPG */
1107#endif
1108
1109
1110
1111
1112
1113
1114
1115
Note: See TracBrowser for help on using the repository browser.