Context Navigation

source: trunk/src/sh_gpg.c@ 114

Last change on this file since 114 was 111, checked in by rainer, 17 years ago
Fix for ticket #69 (wrappers for name service routines not used everywhere).
File size: 29.7 KB

Line
1	/* SAMHAIN file system integrity testing */
2	/* Copyright (C) 1999, 2000 Rainer Wichmann */
3	/* */
4	/* This program is free software; you can redistribute it */
5	/* and/or modify */
6	/* it under the terms of the GNU General Public License as */
7	/* published by */
8	/* the Free Software Foundation; either version 2 of the License, or */
9	/* (at your option) any later version. */
10	/* */
11	/* This program is distributed in the hope that it will be useful, */
12	/* but WITHOUT ANY WARRANTY; without even the implied warranty of */
13	/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
14	/* GNU General Public License for more details. */
15	/* */
16	/* You should have received a copy of the GNU General Public License */
17	/* along with this program; if not, write to the Free Software */
18	/* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
19
20	#include "config_xor.h"
21
22	#include <stdio.h>
23	#include <stdlib.h>
24
25
26	#if defined(WITH_GPG) \|\| defined(WITH_PGP)
27
28	#include <unistd.h>
29	#include <fcntl.h>
30	#include <signal.h>
31	#if defined(SH_WITH_SERVER)
32	#include <pwd.h>
33	#endif
34	#include <sys/stat.h>
35	#include <sys/types.h>
36	#include <errno.h>
37	#include <sys/wait.h>
38
39	#include <string.h>
40	#ifdef HAVE_MEMORY_H
41	#include <memory.h>
42	#endif
43
44
45	#if !defined(O_NONBLOCK)
46	#if defined(O_NDELAY)
47	#define O_NONBLOCK O_NDELAY
48	#else
49	#define O_NONBLOCK 0
50	#endif
51	#endif
52
53
54	#include "samhain.h"
55	#include "sh_utils.h"
56	#include "sh_error.h"
57	#include "sh_tiger.h"
58	#if defined(SH_WITH_SERVER)
59	#define SH_NEED_PWD_GRP 1
60	#include "sh_static.h"
61	#endif
62
63	static struct {
64	char conf_id[SH_MINIBUF+1];
65	char conf_fp[SH_MINIBUF+1];
66	char data_id[SH_MINIBUF+1];
67	char data_fp[SH_MINIBUF+1];
68	} gp;
69
70	typedef struct {
71	pid_t pid;
72	FILE * pipe;
73	} sh_gpg_popen_t;
74
75	#define SH_GPG_OK 0
76	#define SH_GPG_BAD 1
77	#define SH_GPG_BADSIGN 2
78
79	/* replace #if 0 by #if 1 and set an appropriate path in front of '/pdbg.'
80	* for debugging
81	*/
82	#if 0
83	#define PDGBFILE "/pdbg."
84	#endif
85
86	#if defined(PDGBFILE)
87	FILE * pdbg;
88	FILE * pdbgc;
89	#define PDBG_OPEN pdbg = fopen(PDGBFILE"main", "a")
90	#define PDBG_CLOSE fclose (pdbg)
91	#define PDBG(arg) fprintf(pdbg, "PDBG: step %d\n", arg); fflush(pdbg)
92	#define PDBG_D(arg) fprintf(pdbg, "PDBG: %d\n", arg); fflush(pdbg)
93	#define PDBG_S(arg) fprintf(pdbg, "PDBG: %s\n", arg); fflush(pdbg)
94
95	#define PDBGC_OPEN pdbgc = fopen(PDGBFILE"child", "a")
96	#define PDBGC_CLOSE fclose (pdbgc)
97	#define PDBGC(arg) fprintf(pdbgc, "PDBG: step %d\n", arg); fflush(pdbgc)
98	#define PDBGC_D(arg) fprintf(pdbgc, "PDBG: %d\n", arg); fflush(pdbgc)
99	#define PDBGC_S(arg) fprintf(pdbgc, "PDBG: %s\n", arg); fflush(pdbgc)
100	#else
101	#define PDBG_OPEN
102	#define PDBG_CLOSE
103	#define PDBG(arg)
104	#define PDBG_D(arg)
105	#define PDBG_S(arg)
106	#define PDBGC_OPEN
107	#define PDBGC_CLOSE
108	#define PDBGC(arg)
109	#define PDBGC_D(arg)
110	#define PDBGC_S(arg)
111	#endif
112
113	#undef FIL__
114	#define FIL__ _("sh_gpg.c")
115
116	#ifdef GPG_HASH
117
118	static int sh_gpg_checksum (SL_TICKET checkfd, int flag)
119	{
120	char * test_gpg;
121	char * test_ptr1 = NULL;
122	char * test_ptr2 = NULL;
123	char wstrip1[128];
124	char wstrip2[128];
125	int i, k;
126	#include "sh_gpg_chksum.h"
127
128	SL_ENTER(_("sh_gpg_checksum"));
129
130	tiger_fd = checkfd;
131	#if defined(WITH_PGP)
132	test_gpg = sh_tiger_hash_gpg (DEFAULT_PGP_PATH, TIGER_FD, 0);
133	#else
134	test_gpg = sh_tiger_hash_gpg (DEFAULT_GPG_PATH, TIGER_FD, 0);
135	#endif
136
137	test_ptr1 = strchr(GPG_HASH, ':');
138	if (test_gpg != NULL)
139	test_ptr2 = strchr(test_gpg, ':');
140
141	if (test_ptr2 != NULL)
142	test_ptr2 += 2;
143	else
144	test_ptr2 = test_gpg;
145	if (test_ptr1 != NULL)
146	test_ptr1 += 2;
147	else
148	test_ptr1 = GPG_HASH;
149
150	/* Tue Jun 24 23:11:54 CEST 2003 (1.7.9) -- strip whitespace
151	*/
152	k = 0;
153	for (i = 0; i < 127; ++i)
154	{
155	if (test_ptr1[i] == '\0')
156	break;
157	if (test_ptr1[i] != ' ')
158	{
159	wstrip1[k] = test_ptr1[i];
160	++k;
161	}
162	}
163	wstrip1[k] = '\0';
164
165	for(i = 0; i < KEY_LEN; ++i)
166	{
167	if (gpgchk[i] != wstrip1[i])
168	{
169	sh_error_handle(SH_ERR_SEVERE, FIL__, __LINE__, 0, MSG_E_GPG_CHK,
170	gpgchk, wstrip1);
171	break;
172	}
173	}
174
175	k = 0;
176	for (i = 0; i < 127; ++i)
177	{
178	if (test_ptr2[i] == '\0')
179	break;
180	if (test_ptr2[i] != ' ')
181	{
182	wstrip2[k] = test_ptr2[i];
183	++k;
184	}
185	}
186	wstrip2[k] = '\0';
187
188	if (0 != sl_strncmp(wstrip1, wstrip2, 127))
189	{
190	TPT(((0), FIL__, __LINE__, _("msg=<pgp checksum: %s>\n"), test_gpg));
191	TPT(((0), FIL__, __LINE__, _("msg=<Compiled-in : %s>\n"), GPG_HASH));
192	TPT(((0), FIL__, __LINE__, _("msg=<wstrip1 : %s>\n"), wstrip1));
193	TPT(((0), FIL__, __LINE__, _("msg=<wstrip2 : %s>\n"), wstrip2));
194	if (flag == 1)
195	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_GPG,
196	GPG_HASH, test_gpg);
197	dlog(1, FIL__, __LINE__, _("The compiled-in checksum of the gpg binary\n(%s)\ndoes not match the actual checksum\n(%s).\nYou need to recompile with the correct checksum."), wstrip1, wstrip2);
198	SH_FREE(test_gpg);
199	SL_RETURN((-1), _("sh_gpg_checksum"));
200	}
201	SH_FREE(test_gpg);
202	SL_RETURN( (0), _("sh_gpg_checksum"));
203	}
204	#endif
205
206	struct startup_info {
207	long line;
208	char * program;
209	long uid;
210	char * path;
211	char * key_uid;
212	char * key_id;
213	};
214
215	static struct startup_info startInfo = { 0, NULL, 0, NULL, NULL, NULL };
216
217	void sh_gpg_log_startup ()
218	{
219	if (startInfo.program != NULL)
220	{
221	sh_error_handle ((-1), FIL__, startInfo.line, 0, MSG_START_GH,
222	startInfo.program, startInfo.uid,
223	startInfo.path,
224	startInfo.key_uid, startInfo.key_id);
225	}
226	return;
227	}
228
229	static void sh_gpg_fill_startup (long line, char * program, long uid, char * path,
230	char * key_uid, char * key_id)
231	{
232	startInfo.line = line;
233	startInfo.program = sh_util_strdup(program);
234	startInfo.uid = uid;
235	startInfo.path = sh_util_strdup(path);
236	startInfo.key_uid = sh_util_strdup(key_uid);
237	startInfo.key_id = sh_util_strdup(key_id);
238	return;
239	}
240
241	static FILE * sh_gpg_popen (sh_gpg_popen_t *source, int fd,
242	int mode, char * id, char * homedir)
243	{
244	int pipedes[2];
245	FILE * outf = NULL;
246	char * envp[2];
247	size_t len;
248	char path[256];
249	char cc1[32];
250	char cc2[32];
251	#if defined(WITH_PGP)
252	char cc3[32];
253	char cc0[3] = "-f";
254	#endif
255	#if defined(WITH_GPG)
256	char cc0[2] = "-";
257	char cc3[32];
258	char cc4[SH_PATHBUF+32];
259	char cc5[32] = "--no-tty";
260	#endif
261
262	char * arg[9];
263
264	#if defined(HAVE_GPG_CHECKSUM)
265	SL_TICKET checkfd;
266	int myrand;
267	int i;
268	#if defined(__linux__)
269	int get_the_fd(SL_TICKET);
270	char pname[128];
271	int pfd;
272	#endif
273	#endif
274
275	SL_ENTER(_("sh_gpg_popen"));
276
277	#if defined(WITH_GPG)
278	/* -- GnuPG -- */
279	sl_strlcpy (path, DEFAULT_GPG_PATH, 256);
280	sl_strlcpy (cc1, _("--status-fd"), 32);
281	sl_strlcpy (cc2, _("--verify"), 32);
282	sl_strlcpy (cc3, _("--homedir"), 32);
283	/* sl_strlcpy (cc4, sh.effective.home, SH_PATHBUF+32); */
284	sl_strlcpy (cc4, homedir, SH_PATHBUF+32);
285	sl_strlcat (cc4, _("/.gnupg"), SH_PATHBUF+32);
286
287	/* fprintf(stderr, "YULE: homedir=%s\n", homedir); */
288
289	#if defined(SH_WITH_SERVER)
290	if (0 == sl_ret_euid()) /* privileges not dropped yet */
291	{
292	struct stat lbuf;
293	int status_stat = 0;
294	struct passwd * tempres = sh_getpwnam(DEFAULT_IDENT);
295
296	if (!tempres)
297	{
298	dlog(1, FIL__, __LINE__,
299	_("User %s does not exist. Please add the user to your system.\n"),
300	DEFAULT_IDENT);
301	status_stat = -1;
302	}
303	if (!tempres->pw_dir \|\| tempres->pw_dir[0] == '\0')
304	{
305	dlog(1, FIL__, __LINE__,
306	_("User %s does not have a home directory.\nPlease add the home directory for this user to your system.\n"),
307	DEFAULT_IDENT);
308	status_stat = -2;
309	}
310	if (status_stat == 0)
311	{
312	sl_strlcpy (cc4, tempres->pw_dir, SH_PATHBUF+32);
313	sl_strlcat (cc4, _("/.gnupg"), SH_PATHBUF+32);
314	status_stat = retry_lstat(FIL__, __LINE__, cc4, &lbuf);
315	if (status_stat == -1)
316	{
317	dlog(1, FIL__, __LINE__,
318	_("Gnupg directory %s for user %s\ndoes not exist or is not accessible.\nPlease add the directory and put the keyring (pubring.gpg) there\nto verify the configuration file.\n"),
319	cc4, DEFAULT_IDENT);
320	status_stat = -3;
321	}
322	}
323	if (status_stat == 0 && lbuf.st_uid != tempres->pw_uid)
324	{
325	dlog(1, FIL__, __LINE__,
326	_("Gnupg directory %s\nis not owned by user %s.\n"),
327	cc4, DEFAULT_IDENT);
328	status_stat = -4;
329	}
330	if (status_stat == 0)
331	{
332	sl_strlcat (cc4, _("/pubring.gpg"), SH_PATHBUF+32);
333	status_stat = retry_lstat(FIL__, __LINE__, cc4, &lbuf);
334	if (status_stat == -1)
335	{
336	dlog(1, FIL__, __LINE__,
337	_("Gnupg public keyring %s for user %s\ndoes not exist or is not accessible.\nPlease add the directory and put the keyring (pubring.gpg) there\nto verify the configuration file.\n"),
338	cc4, DEFAULT_IDENT);
339	status_stat = -5;
340	}
341	}
342	if (status_stat == 0 && lbuf.st_uid != tempres->pw_uid)
343	{
344	dlog(1, FIL__, __LINE__,
345	_("Gnupg public keyring %s\nis not owned by user %s.\n"),
346	cc4, DEFAULT_IDENT);
347	status_stat = -6;
348	}
349	if (status_stat != 0)
350	{
351	sh_error_handle((-1), FIL__, __LINE__, status_stat, MSG_EXIT_ABORT1,
352	sh.prg_name);
353	aud_exit (FIL__, __LINE__, EXIT_FAILURE);
354	}
355	sl_strlcpy (cc4, tempres->pw_dir, SH_PATHBUF+32);
356	sl_strlcat (cc4, _("/.gnupg"), SH_PATHBUF+32);
357	}
358	#endif
359
360	arg[0] = path;
361	arg[1] = cc1;
362	arg[2] = "1";
363	arg[3] = cc2;
364	arg[4] = cc3;
365	arg[5] = cc4;
366	arg[6] = cc5;
367	arg[7] = cc0;
368	arg[8] = NULL;
369
370	/* catch 'unused parameter' compiler warning
371	*/
372	(void) mode;
373	(void) id;
374	#elif defined(WITH_PGP)
375	/* -- PGP -- */
376	sl_strlcpy (path, DEFAULT_PGP_PATH, 256);
377	if (mode == 0)
378	{
379	sl_strlcpy (cc1, _("+language=en"), 32);
380	sl_strlcpy (cc2, _("-o"), 32);
381	sl_strlcpy (cc3, _("/dev/null"), 32);
382
383	arg[0] = path;
384	arg[1] = cc1;
385	arg[2] = cc2;
386	arg[3] = cc3;
387	arg[4] = cc0;
388	arg[5] = NULL;
389	}
390	else
391	{
392	sl_strlcpy (cc1, _("+language=en"), 32);
393	sl_strlcpy (cc2, _("-kvc"), 32);
394
395	arg[0] = path;
396	arg[1] = cc1;
397	arg[2] = cc2;
398	arg[3] = id;
399	arg[4] = NULL;
400	arg[5] = NULL;
401	}
402	#endif
403
404	/* use homedir of effective user
405	*/
406	if (sh.effective.home != NULL)
407	{
408	len = sl_strlen(sh.effective.home) + 6;
409	envp[0] = malloc (len); /* free() ok */
410	if (envp[0] != NULL)
411	sl_snprintf (envp[0], len, "HOME=%s", sh.effective.home);
412	envp[1] = NULL;
413	}
414	else
415	{
416	envp[0] = NULL;
417	}
418
419	/* Create the pipe
420	*/
421	if (aud_pipe(FIL__, __LINE__, pipedes) < 0)
422	{
423	if (envp[0] != NULL)
424	free(envp[0]);
425	SL_RETURN( (NULL), _("sh_gpg_popen"));
426	}
427
428	fflush (NULL);
429
430	source->pid = aud_fork(FIL__, __LINE__);
431
432	/* Failure
433	*/
434	if (source->pid == (pid_t) - 1)
435	{
436	close(pipedes[0]);
437	close(pipedes[1]);
438	if (envp[0] != NULL)
439	free(envp[0]);
440	SL_RETURN( (NULL), _("sh_gpg_popen"));
441	}
442
443	if (source->pid == (pid_t) 0)
444	{
445
446	/* child - make read side of the pipe stdout
447	*/
448	if (retry_aud_dup2(FIL__, __LINE__,
449	pipedes[STDOUT_FILENO], STDOUT_FILENO) < 0)
450	{
451	TPT(((0), FIL__, __LINE__, _("msg=<dup2 on pipe failed>\n")));
452	dlog(1, FIL__, __LINE__, _("Internal error: dup2 failed\n"));
453	aud__exit(FIL__, __LINE__, EXIT_FAILURE);
454	}
455
456	/* close the pipe descriptors
457	*/
458	close (pipedes[STDIN_FILENO]);
459	close (pipedes[STDOUT_FILENO]);
460
461
462	#if defined(WITH_PGP)
463	if (mode == 0)
464	{
465	if (retry_aud_dup2(FIL__, __LINE__, fd, STDIN_FILENO) < 0)
466	{
467	TPT(((0), FIL__, __LINE__, _("msg=<dup2 on fd failed>\n")));
468	dlog(1, FIL__, __LINE__, _("Internal error: dup2 failed\n"));
469	aud__exit(FIL__, __LINE__, EXIT_FAILURE);
470	}
471	}
472	#else
473	if (retry_aud_dup2(FIL__, __LINE__, fd, STDIN_FILENO) < 0)
474	{
475	TPT(((0), FIL__, __LINE__, _("msg=<dup2 on fd failed>\n")));
476	dlog(1, FIL__, __LINE__, _("Internal error: dup2 failed\n"));
477	aud__exit(FIL__, __LINE__, EXIT_FAILURE);
478	}
479	#endif
480
481	/* don't leak file descriptors
482	*/
483	sh_unix_closeall (3, -1); /* in child process */
484
485	freopen(_("/dev/null"), "r+", stderr);
486
487	/* We should become privileged if SUID,
488	* to be able to read the keyring.
489	* We have checked that gpg is OK,
490	* AND that only a trusted user could overwrite
491	* gpg.
492	*/
493	memset (skey, '\0', sizeof(sh_key_t));
494	aud_setuid(FIL__, __LINE__, geteuid());
495
496	PDBGC_OPEN;
497	PDBGC_D((int)getuid());
498	PDBGC_D((int)geteuid());
499
500	{
501	int i = 0;
502	while (arg[i] != NULL)
503	{
504	PDBGC_S(arg[i]);
505	++i;
506	}
507	}
508	PDBGC_CLOSE;
509
510	/* exec the program */
511
512	#if defined(__linux__) && defined(HAVE_GPG_CHECKSUM)
513	/*
514	* -- emulate an fexecve with checksum testing
515	*/
516	#if defined(WITH_PGP)
517	checkfd = sl_open_read(DEFAULT_PGP_PATH, SL_NOPRIV);
518	#else
519	checkfd = sl_open_read(DEFAULT_GPG_PATH, SL_NOPRIV);
520	#endif
521
522	if (0 != sh_gpg_checksum(checkfd, 0))
523	aud__exit(FIL__, __LINE__, EXIT_FAILURE);
524
525	pfd = get_the_fd(checkfd);
526	sl_snprintf(pname, sizeof(pname), _("/proc/self/fd/%d"), pfd);
527	if (0 == access(pname, R_OK\|X_OK)) /* flawfinder: ignore */
528
529	{
530	fcntl (pfd, F_SETFD, FD_CLOEXEC);
531	retry_aud_execve (FIL__, __LINE__, pname, arg, envp);
532
533	dlog(1, FIL__, __LINE__, _("Unexpected error: execve %s failed\n"),
534	pname);
535	/* failed
536	*/
537	aud__exit(FIL__, __LINE__, EXIT_FAILURE);
538	}
539
540	/* procfs not working, go ahead
541	*/
542	sl_close(checkfd);
543	#endif
544
545	#if defined(HAVE_GPG_CHECKSUM)
546	/* This is an incredibly ugly kludge to prevent an attacker
547	* from knowing when it is safe to slip in a fake executable
548	* between the integrity check and the execve
549	*/
550	myrand = (int) taus_get (&(skey->rng0[0]), &(skey->rng1[0]),
551	&(skey->rng2[0]));
552	myrand = (myrand < 0) ? (-myrand) : myrand;
553	myrand = (myrand % 32) + 2;
554
555	for (i = 0; i < myrand; ++i)
556	{
557	#if defined(WITH_PGP)
558	checkfd = sl_open_fastread(DEFAULT_PGP_PATH, SL_NOPRIV);
559	#else
560	checkfd = sl_open_fastread(DEFAULT_GPG_PATH, SL_NOPRIV);
561	#endif
562	if (0 != sh_gpg_checksum(checkfd, 0)) {
563	aud__exit(FIL__, __LINE__, EXIT_FAILURE);
564	}
565	sl_close(checkfd);
566	}
567	#endif
568
569
570	#if defined(WITH_GPG)
571	retry_aud_execve (FIL__, __LINE__, DEFAULT_GPG_PATH, arg, envp);
572	dlog(1, FIL__, __LINE__, _("Unexpected error: execve %s failed\n"),
573	DEFAULT_GPG_PATH);
574	#elif defined(WITH_PGP)
575	retry_aud_execve (FIL__, __LINE__, DEFAULT_PGP_PATH, arg, envp);
576	#endif
577
578	/* failed
579	*/
580	TPT(((0), FIL__, __LINE__, _("msg=<execve failed>\n")));
581	dlog(1, FIL__, __LINE__, _("Unexpected error: execve failed\n"));
582	aud__exit(FIL__, __LINE__, EXIT_FAILURE);
583	}
584
585	/* parent
586	*/
587
588	if (envp[0] != NULL)
589	free(envp[0]);
590
591	close (pipedes[STDOUT_FILENO]);
592	retry_fcntl (FIL__, __LINE__, pipedes[STDIN_FILENO], F_SETFD, FD_CLOEXEC);
593	retry_fcntl (FIL__, __LINE__, pipedes[STDIN_FILENO], F_SETFL, O_NONBLOCK);
594
595	outf = fdopen (pipedes[STDIN_FILENO], "r");
596
597	if (outf == NULL)
598	{
599	aud_kill (FIL__, __LINE__, source->pid, SIGKILL);
600	close (pipedes[STDOUT_FILENO]);
601	waitpid (source->pid, NULL, 0);
602	source->pid = 0;
603	SL_RETURN( (NULL), _("sh_gpg_popen"));
604	}
605
606	SL_RETURN( (outf), _("sh_gpg_popen"));
607	}
608
609
610	static int sh_gpg_pclose (sh_gpg_popen_t *source)
611	{
612	int status = 0;
613
614	SL_ENTER(_("sh_gpg_pclose"));
615
616	status = fclose(source->pipe);
617	if (status)
618	SL_RETURN( (-1), _("sh_gpg_pclose"));
619
620	if (waitpid(source->pid, NULL, 0) != source->pid)
621	status = -1;
622
623	source->pipe = NULL;
624	source->pid = 0;
625	SL_RETURN( (status), _("sh_gpg_pclose"));
626	}
627
628	static
629	int sh_gpg_check_file_sign(int fd, char * sign_id, char * sign_fp,
630	char * homedir, int whichfile)
631	{
632	struct stat buf;
633	char line[256];
634	sh_gpg_popen_t source;
635	int have_id = BAD, have_fp = BAD, status = 0;
636	#ifdef WITH_PGP
637	char *ptr;
638	#endif
639
640	#ifdef HAVE_GPG_CHECKSUM
641	SL_TICKET checkfd;
642	#endif
643
644	SL_ENTER(_("sh_gpg_check_file_sign"));
645
646	/* check whether GnuPG exists and has the correct checksum
647	*/
648	#if defined(WITH_GPG)
649
650	TPT(((0), FIL__, __LINE__, _("msg=<Check signature>\n")));
651	TPT(((0), FIL__, __LINE__, _("msg=<gpg is %s>\n"), DEFAULT_GPG_PATH));
652
653	if (0 != retry_lstat(FIL__, __LINE__, DEFAULT_GPG_PATH, &buf))
654	{
655	status = errno;
656	sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, status, MSG_ERR_LSTAT,
657	sh_error_message(status), DEFAULT_GPG_PATH);
658	SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
659	}
660
661	if (0 != tf_trust_check (DEFAULT_GPG_PATH, SL_YESPRIV))
662	SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
663
664	#ifdef HAVE_GPG_CHECKSUM
665	checkfd = sl_open_read(DEFAULT_GPG_PATH, SL_YESPRIV);
666
667	if (0 != sh_gpg_checksum(checkfd, 1))
668	{
669	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
670	_("Checksum mismatch"),
671	_("gpg_check_file_sign"));
672	sl_close(checkfd);
673	SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
674	}
675	sl_close(checkfd);
676	#endif
677
678	#elif defined(WITH_PGP)
679
680	TPT(((0), FIL__, __LINE__, _("msg=<Check signature>\n")));
681	TPT(((0), FIL__, __LINE__, _("msg=<pgp is %s>\n"), DEFAULT_PGP_PATH));
682
683	if (0 != retry_lstat(FIL__, __LINE__, DEFAULT_PGP_PATH, &buf))
684	{
685	status = errno;
686	sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, status, MSG_ERR_LSTAT,
687	sh_error_message(status), DEFAULT_PGP_PATH);
688	SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
689	}
690	if (0 != tf_trust_check (DEFAULT_PGP_PATH, SL_YESPRIV))
691	SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
692
693	#ifdef HAVE_GPG_CHECKSUM
694	checkfd = sl_open_read(DEFAULT_PGP_PATH, SL_YESPRIV);
695
696	if (0 != sh_gpg_checksum(checkfd, 1))
697	{
698	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
699	_("Checksum mismatch"),
700	_("gpg_check_file_sign"));
701	sl_close(checkfd);
702	SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
703	}
704	sl_close(checkfd);
705	#endif
706
707	#endif
708
709	TPT(((0), FIL__, __LINE__, _("msg=<Open pipe to check signature>\n")));
710
711	fflush(NULL);
712
713	source.pipe = sh_gpg_popen ( &source, fd, 0, NULL, homedir );
714
715	if (NULL == source.pipe)
716	{
717	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
718	_("Could not open pipe"),
719	_("gpg_check_file_sign"));
720	SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
721	}
722
723	TPT(((0), FIL__, __LINE__, _("msg=<Open pipe success>\n")));
724
725	xagain:
726
727	errno = 0;
728
729	while (NULL != fgets(line, sizeof(line), source.pipe))
730	{
731
732	TPT(((0), FIL__, __LINE__, _("msg=<gpg out: %s>\n"), line));
733	if (line[strlen(line)-1] == '\n')
734	line[strlen(line)-1] = ' ';
735	sh_error_handle(SH_ERR_ALL, FIL__, __LINE__, 0, MSG_E_SUBGEN,
736	line,
737	_("gpg_check_file_sign"));
738
739	if (sl_strlen(line) < 18)
740	continue;
741	#if defined(WITH_GPG)
742	/* Sun May 27 18:40:05 CEST 2001
743	*/
744	if (0 == sl_strncmp(_("BADSIG"), &line[9], 6) \|\|
745	0 == sl_strncmp(_("ERRSIG"), &line[9], 6) \|\|
746	0 == sl_strncmp(_("NO_PUBKEY"), &line[9], 6) \|\|
747	0 == sl_strncmp(_("NODATA"), &line[9], 6) \|\|
748	0 == sl_strncmp(_("SIGEXPIRED"), &line[9], 6))
749	{
750	if (0 == sl_strncmp(_("BADSIG"), &line[9], 6)) {
751	dlog(1, FIL__, __LINE__,
752	_("%s file is signed, but the signature is invalid."),
753	((whichfile == 1) ? _("Configuration") : _("Database")));
754	}
755	else if (0 == sl_strncmp(_("NO_PUBKEY"), &line[9], 6)) {
756	dlog(1, FIL__, __LINE__,
757	_("%s file is signed, but the public key to verify the signature is not in my keyring %s/.gnupg/pubring.asc."),
758	((whichfile == 1) ? _("Configuration") : _("Database")),
759	homedir);
760	}
761	else if (0 == sl_strncmp(_("ERRSIG"), &line[9], 6)) {
762	dlog(1, FIL__, __LINE__,
763	_("%s file is signed, but the public key to verify the signature is not in my keyring %s/.gnupg/pubring.asc."),
764	((whichfile == 1) ? _("Configuration") : _("Database")),
765	homedir);
766	}
767	else if (0 == sl_strncmp(_("SIGEXPIRED"), &line[9], 6)) {
768	dlog(1, FIL__, __LINE__,
769	_("%s file is signed, but the public key to verify the signature has expired."),
770	((whichfile == 1) ? _("Configuration") : _("Database")));
771	}
772	else if (0 == sl_strncmp(_("NODATA"), &line[9], 6)) {
773	dlog(1, FIL__, __LINE__,
774	_("%s file is not signed."),
775	((whichfile == 1) ? _("Configuration") : _("Database")));
776	}
777
778	have_fp = BAD; have_id = BAD;
779	break;
780	}
781	if (0 == sl_strncmp(_("GOODSIG"), &line[9], 7))
782	{
783	sl_strlcpy (sign_id, &line[25], SH_MINIBUF+1);
784	sign_id[sl_strlen(sign_id)-1] = '\0'; /* remove trailing '"' */
785	have_id = GOOD;
786	}
787	if (0 == sl_strncmp(_("VALIDSIG"), &line[9], 8))
788	{
789	strncpy (sign_fp, &line[18], 40);
790	sign_fp[40] = '\0';
791	have_fp = GOOD;
792	}
793	#elif defined(WITH_PGP)
794	if (0 == sl_strncmp(_("Bad signature"), line, 13) \|\|
795	0 == sl_strncmp(_("Error"), line, 5) \|\|
796	0 == sl_strncmp(_("Malformed"), line, 9) \|\|
797	0 == sl_strncmp(_("WARNING"), line, 7) \|\|
798	0 == sl_strncmp(_("ERROR"), line, 5)
799	)
800	{
801	have_fp = BAD; have_id = BAD;
802	break;
803	}
804	if (0 == sl_strncmp(_("Good signature"), line, 14))
805	{
806	ptr = strchr ( line, '"');
807	++ptr;
808	sl_strlcpy (sign_id, ptr, SH_MINIBUF+1);
809	sign_id[sl_strlen(sign_id)-1] = '\0'; /* remove trailing dot */
810	sign_id[sl_strlen(sign_id)-2] = '\0'; /* remove trailing '"' */
811	have_id = GOOD;
812	}
813	#endif
814	}
815
816	if (ferror(source.pipe) && errno == EAGAIN)
817	{
818	clearerr(source.pipe);
819	goto xagain;
820	}
821
822	sh_gpg_pclose (&source);
823
824	TPT(((0), FIL__, __LINE__, _("msg=<Close pipe>\n")));
825
826	#ifdef WITH_PGP
827	/* get the fingerprint */
828
829	source.pipe = sh_gpg_popen ( &source, fd, 1, sign_id, homedir);
830	if (NULL == source.pipe)
831	{
832	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
833	_("Could not open pipe for fp"),
834	_("gpg_check_file_sign"));
835	SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
836	}
837
838	TPT(((0), FIL__, __LINE__, _("msg=<Open pipe success>\n")));
839
840	yagain:
841
842	errno = 0;
843
844	while (NULL != fgets(line, sizeof(line), source.pipe))
845	{
846	if (line[strlen(line)-1] == '\n')
847	line[strlen(line)-1] = ' ';
848	sh_error_handle(SH_ERR_ALL, FIL__, __LINE__, 0, MSG_E_SUBGEN,
849	line,
850	_("gpg_check_file_sign"));
851
852	if (sl_strlen(line) < 18)
853	continue;
854	ptr = strtok (line, " ");
855	while (ptr)
856	{
857	ptr = strtok (NULL, " ");
858	if (ptr && 0 == sl_strncmp (ptr, _("fingerprint"), 11))
859	{
860	ptr = strtok (NULL, " "); /* to '=' */
861	sign_fp[0] = '\0';
862	while (ptr)
863	{
864	ptr = strtok (NULL, " "); /* part of fingerprint */
865	sl_strlcat (sign_fp, ptr, SH_MINIBUF+1);
866	}
867	/* sign_fp[sl_strlen(sign_fp)-1] = '\0'; remove trailing '\n' */
868	if (sl_strlen(sign_fp) > 0)
869	have_fp = GOOD;
870	break;
871	}
872	}
873	}
874
875	if (ferror(source.pipe) && errno == EAGAIN)
876	{
877	clearerr(source.pipe);
878	goto yagain;
879	}
880
881	sh_gpg_pclose (&source);
882	#endif
883
884	if (have_id == GOOD)
885	{
886	TPT(((0), FIL__, __LINE__, _("msg=<Got signator ID>\n")));
887	;
888	}
889	if (have_fp == GOOD)
890	{
891	TPT(((0), FIL__, __LINE__, _("msg=<Got fingerprint>\n")));
892	;
893	}
894
895	if (have_id == GOOD && have_fp == GOOD)
896	SL_RETURN( SH_GPG_OK, _("sh_gpg_check_file_sign"));
897	else
898	{
899	if (have_id == BAD)
900	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
901	_("No good signature"),
902	_("gpg_check_file_sign"));
903	else
904	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
905	_("No fingerprint for key"),
906	_("gpg_check_file_sign"));
907	SL_RETURN( SH_GPG_BADSIGN, _("sh_gpg_check_file_sign"));
908	}
909	}
910
911	int get_the_fd(SL_TICKET file_1);
912
913	int sh_gpg_check_sign (long file_1, long file_2, int what)
914	{
915	int status = SH_GPG_BAD;
916	int fd1 = 0;
917	int fd2 = 0;
918	static int smsg = S_FALSE;
919	char * tmp;
920	char * tmp2;
921
922	char * homedir = sh.effective.home;
923	#if defined(SH_WITH_SERVER)
924	struct passwd * tempres;
925	#endif
926	#ifdef USE_FINGERPRINT
927	#include "sh_gpg_fp.h"
928	#endif
929
930	SL_ENTER(_("sh_gpg_check_sign"));
931
932
933	if (what == 0 \|\| what == 1)
934	fd1 = get_the_fd(file_1);
935	if (what == 0 \|\| what == 2)
936	fd2 = get_the_fd(file_2);
937
938
939	if (fd1 < 0 \|\| fd2 < 0)
940	{
941	TPT(((0), FIL__, __LINE__, _("msg=<GPG_CHECK: FD1 = %d>\n"), fd1));
942	TPT(((0), FIL__, __LINE__, _("msg=<GPG_CHECK: FD2 = %d>\n"), fd2));
943	dlog(1, FIL__, __LINE__,
944	_("This looks like an unexpected internal error.\n"));
945	sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_EXIT_ABORT1, sh.prg_name);
946	aud_exit (FIL__, __LINE__, EXIT_FAILURE);
947	SL_RETURN( (-1), _("sh_gpg_check_sign"));
948	}
949
950	if (what == 0 \|\| what == 1)
951	{
952	TPT(((0), FIL__, __LINE__, _("msg=<GPG_CHECK: FD1 = %d>\n"), fd1));
953	#if defined(SH_WITH_SERVER)
954	tempres = sh_getpwnam(DEFAULT_IDENT);
955
956	if ((tempres != NULL) && (0 == sl_ret_euid()))
957	{
958	/* privileges not dropped yet*/
959	homedir = tempres->pw_dir;
960	}
961	#endif
962	status = sh_gpg_check_file_sign(fd1, gp.conf_id, gp.conf_fp, homedir, 1);
963	TPT(((0), FIL__, __LINE__, _("msg=<CONF SIGUSR: \|%s\|>\n"), gp.conf_id));
964	TPT(((0), FIL__, __LINE__, _("msg=<CONF SIGFP: \|%s\|>\n"), gp.conf_fp));
965	}
966
967	if ((what == 0 && SH_GPG_OK == status) \|\| what == 2)
968	{
969	TPT(((0), FIL__, __LINE__, _("msg=<GPG_CHECK: FD2 = %d>\n"), fd2));
970	#if defined(SH_WITH_SERVER)
971	tempres = sh_getpwnam(DEFAULT_IDENT);
972
973	if ((tempres != NULL) && (0 == sl_ret_euid()))
974	{
975	/* privileges not dropped yet*/
976	homedir = tempres->pw_dir;
977	}
978	#endif
979	status = sh_gpg_check_file_sign(fd2, gp.data_id, gp.data_fp, homedir, 2);
980	TPT(((0), FIL__, __LINE__, _("msg=<DATA SIGUSR: \|%s\|>\n"), gp.data_id));
981	TPT(((0), FIL__, __LINE__, _("msg=<DATA SIGFP: \|%s\|>\n"), gp.data_fp));
982	}
983
984	if (SH_GPG_OK == status && what == 1)
985	{
986	#ifdef USE_FINGERPRINT
987	if ((sl_strcmp(SH_GPG_FP, gp.conf_fp) == 0))
988	{
989	int i;
990
991	for(i = 0; i < (int) sl_strlen(gp.conf_fp); ++i)
992	{
993	if (gpgfp[i] != gp.conf_fp[i])
994	{
995	sh_error_handle(SH_ERR_SEVERE, FIL__, __LINE__, 0,
996	MSG_E_GPG_FP,
997	gpgfp, gp.conf_fp);
998	break;
999	}
1000	}
1001
1002	if (smsg == S_FALSE)
1003	{
1004	tmp = sh_util_safe_name(gp.conf_id);
1005	sh_gpg_fill_startup (__LINE__,
1006	/* sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_START_GH, */
1007	sh.prg_name, sh.real.uid,
1008	(sh.flag.hidefile == S_TRUE) ?
1009	_("(hidden)") : file_path('C', 'R'),
1010	tmp,
1011	gp.conf_fp);
1012	SH_FREE(tmp);
1013	}
1014	smsg = S_TRUE;
1015	SL_RETURN(0, _("sh_gpg_check_sign"));
1016	}
1017	else
1018	{
1019	/* fp mismatch
1020	*/
1021	dlog(1, FIL__, __LINE__,
1022	_("The fingerprint of the signing key: %s\ndoes not match the compiled-in fingerprint: %s.\nTherefore the signature could not be verified.\n"),
1023	gp.conf_fp, SH_GPG_FP);
1024	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
1025	_("Fingerprint mismatch"),
1026	_("gpg_check_sign"));
1027	status = SH_GPG_BADSIGN;
1028	}
1029	#else
1030	if (smsg == S_FALSE)
1031	{
1032	tmp = sh_util_safe_name(gp.conf_id);
1033	sh_gpg_fill_startup (__LINE__,
1034	/* sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_START_GH, */
1035	sh.prg_name, sh.real.uid,
1036	(sh.flag.hidefile == S_TRUE) ?
1037	_("(hidden)") : file_path('C', 'R'),
1038	tmp,
1039	gp.conf_fp);
1040	SH_FREE(tmp);
1041	}
1042	smsg = S_TRUE;
1043	SL_RETURN(0, _("sh_gpg_check_sign"));
1044	#endif
1045	}
1046
1047	else if (SH_GPG_OK == status && (what == 2 \|\| what == 0))
1048	{
1049	if ((sl_strcmp(gp.data_id, gp.conf_id) == 0) &&
1050	(sl_strcmp(gp.data_fp, gp.conf_fp) == 0))
1051	{
1052	SL_RETURN(0, _("sh_gpg_check_sign"));
1053	}
1054	else
1055	{
1056	/* ID or fp not equal
1057	*/
1058	dlog(1, FIL__, __LINE__,
1059	_("The fingerprint or ID of the signing key is not the same for the\nconfiguration file and the file signature database.\nTherefore the signature could not be verified.\n"));
1060	tmp = sh_util_safe_name (gp.conf_id);
1061	tmp2 = sh_util_safe_name (gp.data_id);
1062	sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_START_GH2,
1063	sh.prg_name, sh.real.uid,
1064	(sh.flag.hidefile == S_TRUE) ? _("(hidden)") : file_path('C', 'R'),
1065	tmp, gp.conf_fp,
1066	(sh.flag.hidefile == S_TRUE) ? _("(hidden)") : file_path('D', 'R'),
1067	tmp2, gp.data_fp);
1068	SH_FREE(tmp);
1069	SH_FREE(tmp2);
1070	}
1071	}
1072
1073	if (status != SH_GPG_OK)
1074	{
1075	uid_t e_uid = sl_ret_euid();
1076	char * e_home = sh.effective.home;
1077
1078	#if defined(SH_WITH_SERVER)
1079	struct passwd * e_tempres = sh_getpwnam(DEFAULT_IDENT);
1080
1081	if ((e_tempres != NULL) && (0 == sl_ret_euid()))
1082	{
1083	/* privileges not dropped yet */
1084	e_uid = e_tempres->pw_uid;
1085	e_home = e_tempres->pw_dir;
1086	}
1087	#endif
1088	dlog(1, FIL__, __LINE__,
1089	_("The signature of the configuration file or the file signature database\ncould not be verified. Possible reasons are:\n - gpg binary (%s) not found\n - invalid signature\n - the signature key is not in the private keyring of UID %d,\n - there is no keyring in %s/.gnupg, or\n - the file is not signed - did you move /filename.asc to /filename ?\nTo create a signed file, use (remove old signatures before):\n gpg -a --clearsign --not-dash-escaped FILE\n mv FILE.asc FILE\n"),
1090	#if defined(WITH_GPG)
1091	DEFAULT_GPG_PATH,
1092	#else
1093	DEFAULT_PGP_PATH,
1094	#endif
1095	(int) e_uid, e_home);
1096	}
1097
1098	TPT(((0), FIL__, __LINE__, _("msg=<Status = %d>\n"), status));
1099
1100	sh_error_handle((-1), FIL__, __LINE__, status, MSG_EXIT_ABORT1, sh.prg_name);
1101	aud_exit (FIL__, __LINE__, EXIT_FAILURE);
1102
1103	return (-1); /* make compiler happy */
1104	}
1105
1106	/* #ifdef WITH_GPG */
1107	#endif
1108
1109
1110
1111
1112
1113
1114
1115

Note: See TracBrowser for help on using the repository browser.

Download in other formats: