Context Navigation

source: trunk/src/sh_gpg.c@ 204

Last change on this file since 204 was 203, checked in by katerina, 16 years ago
Fix compile failures on RHEL3 (ticket #130) and FreeBSD7 amd64 (ticket #131).
File size: 31.8 KB

Line
1	/* SAMHAIN file system integrity testing */
2	/* Copyright (C) 1999, 2000 Rainer Wichmann */
3	/* */
4	/* This program is free software; you can redistribute it */
5	/* and/or modify */
6	/* it under the terms of the GNU General Public License as */
7	/* published by */
8	/* the Free Software Foundation; either version 2 of the License, or */
9	/* (at your option) any later version. */
10	/* */
11	/* This program is distributed in the hope that it will be useful, */
12	/* but WITHOUT ANY WARRANTY; without even the implied warranty of */
13	/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
14	/* GNU General Public License for more details. */
15	/* */
16	/* You should have received a copy of the GNU General Public License */
17	/* along with this program; if not, write to the Free Software */
18	/* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
19
20	#include "config_xor.h"
21
22	#include <stdio.h>
23	#include <stdlib.h>
24
25
26	#if defined(WITH_GPG) \|\| defined(WITH_PGP)
27
28	#include <unistd.h>
29	#include <fcntl.h>
30	#include <signal.h>
31	#if defined(SH_WITH_SERVER)
32	#include <pwd.h>
33	#endif
34	#include <sys/stat.h>
35	#include <sys/types.h>
36	#include <errno.h>
37	#include <sys/wait.h>
38
39	#include <string.h>
40	#ifdef HAVE_MEMORY_H
41	#include <memory.h>
42	#endif
43
44
45	#if !defined(O_NONBLOCK)
46	#if defined(O_NDELAY)
47	#define O_NONBLOCK O_NDELAY
48	#else
49	#define O_NONBLOCK 0
50	#endif
51	#endif
52
53
54	#include "samhain.h"
55	#include "sh_utils.h"
56	#include "sh_error.h"
57	#include "sh_tiger.h"
58	#if defined(SH_WITH_SERVER)
59	#define SH_NEED_PWD_GRP 1
60	#include "sh_static.h"
61	#endif
62
63	static struct {
64	char conf_id[SH_MINIBUF+1];
65	char conf_fp[SH_MINIBUF+1];
66	char data_id[SH_MINIBUF+1];
67	char data_fp[SH_MINIBUF+1];
68	} gp;
69
70	typedef struct {
71	pid_t pid;
72	FILE * pipe;
73	} sh_gpg_popen_t;
74
75	#define SH_GPG_OK 0
76	#define SH_GPG_BAD 1
77	#define SH_GPG_BADSIGN 2
78
79	/* replace #if 0 by #if 1 and set an appropriate path in front of '/pdbg.'
80	* for debugging
81	*/
82	#if 0
83	#define PDGBFILE "/pdbg."
84	#endif
85
86	#if defined(PDGBFILE)
87	FILE * pdbg;
88	FILE * pdbgc;
89	#define PDBG_OPEN pdbg = fopen(PDGBFILE"main", "a")
90	#define PDBG_CLOSE fclose (pdbg)
91	#define PDBG(arg) fprintf(pdbg, "PDBG: step %d\n", arg); fflush(pdbg)
92	#define PDBG_D(arg) fprintf(pdbg, "PDBG: %d\n", arg); fflush(pdbg)
93	#define PDBG_S(arg) fprintf(pdbg, "PDBG: %s\n", arg); fflush(pdbg)
94
95	#define PDBGC_OPEN pdbgc = fopen(PDGBFILE"child", "a")
96	#define PDBGC_CLOSE fclose (pdbgc)
97	#define PDBGC(arg) fprintf(pdbgc, "PDBG: step %d\n", arg); fflush(pdbgc)
98	#define PDBGC_D(arg) fprintf(pdbgc, "PDBG: %d\n", arg); fflush(pdbgc)
99	#define PDBGC_S(arg) fprintf(pdbgc, "PDBG: %s\n", arg); fflush(pdbgc)
100	#else
101	#define PDBG_OPEN
102	#define PDBG_CLOSE
103	#define PDBG(arg)
104	#define PDBG_D(arg)
105	#define PDBG_S(arg)
106	#define PDBGC_OPEN
107	#define PDBGC_CLOSE
108	#define PDBGC(arg)
109	#define PDBGC_D(arg)
110	#define PDBGC_S(arg)
111	#endif
112
113	#undef FIL__
114	#define FIL__ _("sh_gpg.c")
115
116	#ifdef GPG_HASH
117
118	static int sh_gpg_checksum (SL_TICKET checkfd, int flag)
119	{
120	char * test_gpg;
121	char * test_ptr1 = NULL;
122	char * test_ptr2 = NULL;
123	char wstrip1[128];
124	char wstrip2[128];
125	int i, k;
126	#include "sh_gpg_chksum.h"
127
128	SL_ENTER(_("sh_gpg_checksum"));
129
130	#if defined(WITH_PGP)
131	test_gpg = sh_tiger_hash_gpg (DEFAULT_PGP_PATH, checkfd, TIGER_NOLIM);
132	#else
133	test_gpg = sh_tiger_hash_gpg (DEFAULT_GPG_PATH, checkfd, TIGER_NOLIM);
134	#endif
135
136	test_ptr1 = strchr(GPG_HASH, ':');
137	if (test_gpg != NULL)
138	test_ptr2 = strchr(test_gpg, ':');
139
140	if (test_ptr2 != NULL)
141	test_ptr2 += 2;
142	else
143	test_ptr2 = test_gpg;
144	if (test_ptr1 != NULL)
145	test_ptr1 += 2;
146	else
147	test_ptr1 = GPG_HASH;
148
149	/* Tue Jun 24 23:11:54 CEST 2003 (1.7.9) -- strip whitespace
150	*/
151	k = 0;
152	for (i = 0; i < 127; ++i)
153	{
154	if (test_ptr1[i] == '\0')
155	break;
156	if (test_ptr1[i] != ' ')
157	{
158	wstrip1[k] = test_ptr1[i];
159	++k;
160	}
161	}
162	wstrip1[k] = '\0';
163
164	for(i = 0; i < KEY_LEN; ++i)
165	{
166	if (gpgchk[i] != wstrip1[i])
167	{
168	sh_error_handle(SH_ERR_SEVERE, FIL__, __LINE__, 0, MSG_E_GPG_CHK,
169	gpgchk, wstrip1);
170	break;
171	}
172	}
173
174	k = 0;
175	for (i = 0; i < 127; ++i)
176	{
177	if (test_ptr2[i] == '\0')
178	break;
179	if (test_ptr2[i] != ' ')
180	{
181	wstrip2[k] = test_ptr2[i];
182	++k;
183	}
184	}
185	wstrip2[k] = '\0';
186
187	if (0 != sl_strncmp(wstrip1, wstrip2, 127))
188	{
189	TPT(((0), FIL__, __LINE__, _("msg=<pgp checksum: %s>\n"), test_gpg));
190	TPT(((0), FIL__, __LINE__, _("msg=<Compiled-in : %s>\n"), GPG_HASH));
191	TPT(((0), FIL__, __LINE__, _("msg=<wstrip1 : %s>\n"), wstrip1));
192	TPT(((0), FIL__, __LINE__, _("msg=<wstrip2 : %s>\n"), wstrip2));
193	if (flag == 1)
194	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_GPG,
195	GPG_HASH, test_gpg);
196	dlog(1, FIL__, __LINE__, _("The compiled-in checksum of the gpg binary\n(%s)\ndoes not match the actual checksum\n(%s).\nYou need to recompile with the correct checksum."), wstrip1, wstrip2);
197	SH_FREE(test_gpg);
198	SL_RETURN((-1), _("sh_gpg_checksum"));
199	}
200	SH_FREE(test_gpg);
201	SL_RETURN( (0), _("sh_gpg_checksum"));
202	}
203	#endif
204
205	struct startup_info {
206	long line;
207	char * program;
208	long uid;
209	char * path;
210	char * key_uid;
211	char * key_id;
212	};
213
214	static struct startup_info startInfo = { 0, NULL, 0, NULL, NULL, NULL };
215
216	void sh_gpg_log_startup (void)
217	{
218	if (startInfo.program != NULL)
219	{
220	sh_error_handle ((-1), FIL__, startInfo.line, 0, MSG_START_GH,
221	startInfo.program, startInfo.uid,
222	startInfo.path,
223	startInfo.key_uid, startInfo.key_id);
224	}
225	return;
226	}
227
228	static void sh_gpg_fill_startup (long line, char * program, long uid, char * path,
229	char * key_uid, char * key_id)
230	{
231	startInfo.line = line;
232	startInfo.program = sh_util_strdup(program);
233	startInfo.uid = uid;
234	startInfo.path = sh_util_strdup(path);
235	startInfo.key_uid = sh_util_strdup(key_uid);
236	startInfo.key_id = sh_util_strdup(key_id);
237	return;
238	}
239
240	static FILE * sh_gpg_popen (sh_gpg_popen_t *source, int fd,
241	int mode, char * id, char * homedir)
242	{
243	extern int flag_err_debug;
244	int pipedes[2];
245	FILE * outf = NULL;
246	char * envp[2];
247	size_t len;
248	char path[256];
249	char cc1[32];
250	char cc2[32];
251	#if defined(WITH_PGP)
252	char cc3[32];
253	char cc0[3] = "-f";
254	#endif
255	#if defined(WITH_GPG)
256	char cc0[2] = "-";
257	char cc3[32];
258	char cc4[SH_PATHBUF+32];
259	char cc5[32];
260	#endif
261
262	char * arg[9];
263
264	#if defined(HAVE_GPG_CHECKSUM)
265	SL_TICKET checkfd;
266	int myrand;
267	int i;
268	#if defined(__linux__)
269	int get_the_fd(SL_TICKET);
270	char pname[128];
271	int pfd;
272	#endif
273	#endif
274
275	SL_ENTER(_("sh_gpg_popen"));
276
277	#if defined(WITH_GPG)
278	/* -- GnuPG -- */
279	sl_strlcpy (path, DEFAULT_GPG_PATH, 256);
280	sl_strlcpy (cc1, _("--status-fd"), 32);
281	sl_strlcpy (cc2, _("--verify"), 32);
282	sl_strlcpy (cc3, _("--homedir"), 32);
283	/* sl_strlcpy (cc4, sh.effective.home, SH_PATHBUF+32); */
284	sl_strlcpy (cc4, homedir, SH_PATHBUF+32);
285	sl_strlcat (cc4, _("/.gnupg"), SH_PATHBUF+32);
286	sl_strlcpy (cc5, _("--no-tty"), 32);
287
288	/* fprintf(stderr, "YULE: homedir=%s\n", homedir); */
289
290	#if defined(SH_WITH_SERVER)
291	if (0 == sl_ret_euid()) /* privileges not dropped yet */
292	{
293	struct stat lbuf;
294	int status_stat = 0;
295	#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETPWNAM_R)
296	struct passwd pwd;
297	char buffer[SH_PWBUF_SIZE];
298	struct passwd * tempres;
299	sh_getpwnam_r(DEFAULT_IDENT, &pwd, buffer, sizeof(buffer), &tempres);
300	#else
301	struct passwd * tempres = sh_getpwnam(DEFAULT_IDENT);
302	#endif
303
304	if (!tempres)
305	{
306	dlog(1, FIL__, __LINE__,
307	_("User %s does not exist. Please add the user to your system.\n"),
308	DEFAULT_IDENT);
309	status_stat = -1;
310	}
311	if (!tempres->pw_dir \|\| tempres->pw_dir[0] == '\0')
312	{
313	dlog(1, FIL__, __LINE__,
314	_("User %s does not have a home directory.\nPlease add the home directory for this user to your system.\n"),
315	DEFAULT_IDENT);
316	status_stat = -2;
317	}
318	if (status_stat == 0)
319	{
320	sl_strlcpy (cc4, tempres->pw_dir, SH_PATHBUF+32);
321	sl_strlcat (cc4, _("/.gnupg"), SH_PATHBUF+32);
322	status_stat = retry_lstat(FIL__, __LINE__, cc4, &lbuf);
323	if (status_stat == -1)
324	{
325	dlog(1, FIL__, __LINE__,
326	_("Gnupg directory %s for user %s\ndoes not exist or is not accessible.\nPlease add the directory and put the keyring (pubring.gpg) there\nto verify the configuration file.\n"),
327	cc4, DEFAULT_IDENT);
328	status_stat = -3;
329	}
330	}
331	if (status_stat == 0 && lbuf.st_uid != tempres->pw_uid)
332	{
333	dlog(1, FIL__, __LINE__,
334	_("Gnupg directory %s\nis not owned by user %s.\n"),
335	cc4, DEFAULT_IDENT);
336	status_stat = -4;
337	}
338	if (status_stat == 0)
339	{
340	sl_strlcat (cc4, _("/pubring.gpg"), SH_PATHBUF+32);
341	status_stat = retry_lstat(FIL__, __LINE__, cc4, &lbuf);
342	if (status_stat == -1)
343	{
344	dlog(1, FIL__, __LINE__,
345	_("Gnupg public keyring %s for user %s\ndoes not exist or is not accessible.\nPlease add the directory and put the keyring (pubring.gpg) there\nto verify the configuration file.\n"),
346	cc4, DEFAULT_IDENT);
347	status_stat = -5;
348	}
349	}
350	if (status_stat == 0 && lbuf.st_uid != tempres->pw_uid)
351	{
352	dlog(1, FIL__, __LINE__,
353	_("Gnupg public keyring %s\nis not owned by user %s.\n"),
354	cc4, DEFAULT_IDENT);
355	status_stat = -6;
356	}
357	if (status_stat != 0)
358	{
359	sh_error_handle((-1), FIL__, __LINE__, status_stat, MSG_EXIT_ABORT1,
360	sh.prg_name);
361	aud_exit (FIL__, __LINE__, EXIT_FAILURE);
362	}
363	sl_strlcpy (cc4, tempres->pw_dir, SH_PATHBUF+32);
364	sl_strlcat (cc4, _("/.gnupg"), SH_PATHBUF+32);
365	}
366	#endif
367
368	arg[0] = path;
369	arg[1] = cc1;
370	arg[2] = "1";
371	arg[3] = cc2;
372	arg[4] = cc3;
373	arg[5] = cc4;
374	arg[6] = cc5;
375	arg[7] = cc0;
376	arg[8] = NULL;
377
378	/* catch 'unused parameter' compiler warning
379	*/
380	(void) mode;
381	(void) id;
382	#elif defined(WITH_PGP)
383	/* -- PGP -- */
384	sl_strlcpy (path, DEFAULT_PGP_PATH, 256);
385	if (mode == 0)
386	{
387	sl_strlcpy (cc1, _("+language=en"), 32);
388	sl_strlcpy (cc2, _("-o"), 32);
389	sl_strlcpy (cc3, _("/dev/null"), 32);
390
391	arg[0] = path;
392	arg[1] = cc1;
393	arg[2] = cc2;
394	arg[3] = cc3;
395	arg[4] = cc0;
396	arg[5] = NULL;
397	}
398	else
399	{
400	sl_strlcpy (cc1, _("+language=en"), 32);
401	sl_strlcpy (cc2, _("-kvc"), 32);
402
403	arg[0] = path;
404	arg[1] = cc1;
405	arg[2] = cc2;
406	arg[3] = id;
407	arg[4] = NULL;
408	arg[5] = NULL;
409	}
410	#endif
411
412	/* use homedir of effective user
413	*/
414	if (sh.effective.home != NULL)
415	{
416	len = sl_strlen(sh.effective.home) + 6;
417	envp[0] = malloc (len); /* free() ok */
418	if (envp[0] != NULL)
419	sl_snprintf (envp[0], len, _("HOME=%s"), sh.effective.home);
420	envp[1] = NULL;
421	}
422	else
423	{
424	envp[0] = NULL;
425	}
426
427	/* Create the pipe
428	*/
429	if (aud_pipe(FIL__, __LINE__, pipedes) < 0)
430	{
431	if (envp[0] != NULL)
432	free(envp[0]);
433	SL_RETURN( (NULL), _("sh_gpg_popen"));
434	}
435
436	fflush (NULL);
437
438	source->pid = aud_fork(FIL__, __LINE__);
439
440	/* Failure
441	*/
442	if (source->pid == (pid_t) - 1)
443	{
444	close(pipedes[0]);
445	close(pipedes[1]);
446	if (envp[0] != NULL)
447	free(envp[0]);
448	SL_RETURN( (NULL), _("sh_gpg_popen"));
449	}
450
451	if (source->pid == (pid_t) 0)
452	{
453
454	/* child - make read side of the pipe stdout
455	*/
456	if (retry_aud_dup2(FIL__, __LINE__,
457	pipedes[STDOUT_FILENO], STDOUT_FILENO) < 0)
458	{
459	TPT(((0), FIL__, __LINE__, _("msg=<dup2 on pipe failed>\n")));
460	dlog(1, FIL__, __LINE__, _("Internal error: dup2 failed\n"));
461	aud__exit(FIL__, __LINE__, EXIT_FAILURE);
462	}
463
464	/* close the pipe descriptors
465	*/
466	close (pipedes[STDIN_FILENO]);
467	close (pipedes[STDOUT_FILENO]);
468
469
470	#if defined(WITH_PGP)
471	if (mode == 0)
472	{
473	if (retry_aud_dup2(FIL__, __LINE__, fd, STDIN_FILENO) < 0)
474	{
475	TPT(((0), FIL__, __LINE__, _("msg=<dup2 on fd failed>\n")));
476	dlog(1, FIL__, __LINE__, _("Internal error: dup2 failed\n"));
477	aud__exit(FIL__, __LINE__, EXIT_FAILURE);
478	}
479	}
480	#else
481	if (retry_aud_dup2(FIL__, __LINE__, fd, STDIN_FILENO) < 0)
482	{
483	TPT(((0), FIL__, __LINE__, _("msg=<dup2 on fd failed>\n")));
484	dlog(1, FIL__, __LINE__, _("Internal error: dup2 failed\n"));
485	aud__exit(FIL__, __LINE__, EXIT_FAILURE);
486	}
487	#endif
488
489	/* don't leak file descriptors
490	*/
491	sh_unix_closeall (3, -1, SL_TRUE); /* in child process */
492
493	if (flag_err_debug != SL_TRUE)
494	{
495	if (NULL == freopen(_("/dev/null"), "r+", stderr))
496	{
497	dlog(1, FIL__, __LINE__, _("Internal error: freopen failed\n"));
498	aud__exit(FIL__, __LINE__, EXIT_FAILURE);
499	}
500	}
501
502
503	/* We should become privileged if SUID,
504	* to be able to read the keyring.
505	* We have checked that gpg is OK,
506	* AND that only a trusted user could overwrite
507	* gpg.
508	*/
509	memset (skey, '\0', sizeof(sh_key_t));
510	aud_setuid(FIL__, __LINE__, geteuid());
511
512	PDBGC_OPEN;
513	PDBGC_D((int)getuid());
514	PDBGC_D((int)geteuid());
515
516	{
517	int i = 0;
518	while (arg[i] != NULL)
519	{
520	PDBGC_S(arg[i]);
521	++i;
522	}
523	}
524	PDBGC_CLOSE;
525
526	/* exec the program */
527
528	#if defined(__linux__) && defined(HAVE_GPG_CHECKSUM)
529	/*
530	* -- emulate an fexecve with checksum testing
531	*/
532	#if defined(WITH_PGP)
533	checkfd = sl_open_read(DEFAULT_PGP_PATH, SL_NOPRIV);
534	#else
535	checkfd = sl_open_read(DEFAULT_GPG_PATH, SL_NOPRIV);
536	#endif
537
538	if (0 != sh_gpg_checksum(checkfd, 0))
539	aud__exit(FIL__, __LINE__, EXIT_FAILURE);
540
541	pfd = get_the_fd(checkfd);
542	sl_snprintf(pname, sizeof(pname), _("/proc/self/fd/%d"), pfd);
543	if (0 == access(pname, R_OK\|X_OK)) /* flawfinder: ignore */
544
545	{
546	fcntl (pfd, F_SETFD, FD_CLOEXEC);
547	retry_aud_execve (FIL__, __LINE__, pname, arg, envp);
548
549	dlog(1, FIL__, __LINE__, _("Unexpected error: execve %s failed\n"),
550	pname);
551	/* failed
552	*/
553	aud__exit(FIL__, __LINE__, EXIT_FAILURE);
554	}
555
556	/* procfs not working, go ahead
557	*/
558	sl_close(checkfd);
559	#endif
560
561	#if defined(HAVE_GPG_CHECKSUM)
562	/* This is an incredibly ugly kludge to prevent an attacker
563	* from knowing when it is safe to slip in a fake executable
564	* between the integrity check and the execve
565	*/
566	myrand = (int) taus_get ();
567
568	myrand = (myrand < 0) ? (-myrand) : myrand;
569	myrand = (myrand % 32) + 2;
570
571	for (i = 0; i < myrand; ++i)
572	{
573	#if defined(WITH_PGP)
574	checkfd = sl_open_fastread(DEFAULT_PGP_PATH, SL_NOPRIV);
575	#else
576	checkfd = sl_open_fastread(DEFAULT_GPG_PATH, SL_NOPRIV);
577	#endif
578	if (0 != sh_gpg_checksum(checkfd, 0)) {
579	aud__exit(FIL__, __LINE__, EXIT_FAILURE);
580	}
581	sl_close(checkfd);
582	}
583	#endif
584
585
586	#if defined(WITH_GPG)
587	retry_aud_execve (FIL__, __LINE__, DEFAULT_GPG_PATH, arg, envp);
588	dlog(1, FIL__, __LINE__, _("Unexpected error: execve %s failed\n"),
589	DEFAULT_GPG_PATH);
590	#elif defined(WITH_PGP)
591	retry_aud_execve (FIL__, __LINE__, DEFAULT_PGP_PATH, arg, envp);
592	#endif
593
594	/* failed
595	*/
596	TPT(((0), FIL__, __LINE__, _("msg=<execve failed>\n")));
597	dlog(1, FIL__, __LINE__, _("Unexpected error: execve failed\n"));
598	aud__exit(FIL__, __LINE__, EXIT_FAILURE);
599	}
600
601	/* parent
602	*/
603
604	if (envp[0] != NULL)
605	free(envp[0]);
606
607	close (pipedes[STDOUT_FILENO]);
608	retry_fcntl (FIL__, __LINE__, pipedes[STDIN_FILENO], F_SETFD, FD_CLOEXEC);
609	retry_fcntl (FIL__, __LINE__, pipedes[STDIN_FILENO], F_SETFL, O_NONBLOCK);
610
611	outf = fdopen (pipedes[STDIN_FILENO], "r");
612
613	if (outf == NULL)
614	{
615	aud_kill (FIL__, __LINE__, source->pid, SIGKILL);
616	close (pipedes[STDOUT_FILENO]);
617	waitpid (source->pid, NULL, 0);
618	source->pid = 0;
619	SL_RETURN( (NULL), _("sh_gpg_popen"));
620	}
621
622	SL_RETURN( (outf), _("sh_gpg_popen"));
623	}
624
625
626	static int sh_gpg_pclose (sh_gpg_popen_t *source)
627	{
628	int status = 0;
629
630	SL_ENTER(_("sh_gpg_pclose"));
631
632	status = fclose(source->pipe);
633	if (status)
634	SL_RETURN( (-1), _("sh_gpg_pclose"));
635
636	if (waitpid(source->pid, NULL, 0) != source->pid)
637	status = -1;
638
639	source->pipe = NULL;
640	source->pid = 0;
641	SL_RETURN( (status), _("sh_gpg_pclose"));
642	}
643
644	static
645	int sh_gpg_check_file_sign(int fd, char * sign_id, char * sign_fp,
646	char * homedir, int whichfile)
647	{
648	struct stat buf;
649	char line[256];
650	sh_gpg_popen_t source;
651	int have_id = BAD, have_fp = BAD, status = 0;
652	#ifdef WITH_PGP
653	char *ptr;
654	#endif
655
656	#ifdef HAVE_GPG_CHECKSUM
657	SL_TICKET checkfd;
658	#endif
659
660	SL_ENTER(_("sh_gpg_check_file_sign"));
661
662	/* check whether GnuPG exists and has the correct checksum
663	*/
664	#if defined(WITH_GPG)
665
666	TPT(((0), FIL__, __LINE__, _("msg=<Check signature>\n")));
667	TPT(((0), FIL__, __LINE__, _("msg=<gpg is %s>\n"), DEFAULT_GPG_PATH));
668
669	if (0 != retry_lstat(FIL__, __LINE__, DEFAULT_GPG_PATH, &buf))
670	{
671	char errbuf[SH_ERRBUF_SIZE];
672
673	status = errno;
674	sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, status, MSG_ERR_LSTAT,
675	sh_error_message(status, errbuf, sizeof(errbuf)), DEFAULT_GPG_PATH);
676	SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
677	}
678
679	if (0 != tf_trust_check (DEFAULT_GPG_PATH, SL_YESPRIV))
680	SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
681
682	#ifdef HAVE_GPG_CHECKSUM
683	checkfd = sl_open_read(DEFAULT_GPG_PATH, SL_YESPRIV);
684
685	if (0 != sh_gpg_checksum(checkfd, 1))
686	{
687	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
688	_("Checksum mismatch"),
689	_("gpg_check_file_sign"));
690	sl_close(checkfd);
691	SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
692	}
693	sl_close(checkfd);
694	#endif
695
696	#elif defined(WITH_PGP)
697
698	TPT(((0), FIL__, __LINE__, _("msg=<Check signature>\n")));
699	TPT(((0), FIL__, __LINE__, _("msg=<pgp is %s>\n"), DEFAULT_PGP_PATH));
700
701	if (0 != retry_lstat(FIL__, __LINE__, DEFAULT_PGP_PATH, &buf))
702	{
703	char errbuf[SH_ERRBUF_SIZE];
704
705	status = errno;
706	sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, status, MSG_ERR_LSTAT,
707	sh_error_message(status, errbuf, sizeof(errbuf)), DEFAULT_PGP_PATH);
708	SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
709	}
710	if (0 != tf_trust_check (DEFAULT_PGP_PATH, SL_YESPRIV))
711	SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
712
713	#ifdef HAVE_GPG_CHECKSUM
714	checkfd = sl_open_read(DEFAULT_PGP_PATH, SL_YESPRIV);
715
716	if (0 != sh_gpg_checksum(checkfd, 1))
717	{
718	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
719	_("Checksum mismatch"),
720	_("gpg_check_file_sign"));
721	sl_close(checkfd);
722	SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
723	}
724	sl_close(checkfd);
725	#endif
726
727	#endif
728
729	TPT(((0), FIL__, __LINE__, _("msg=<Open pipe to check signature>\n")));
730
731	fflush(NULL);
732
733	source.pipe = sh_gpg_popen ( &source, fd, 0, NULL, homedir );
734
735	if (NULL == source.pipe)
736	{
737	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
738	_("Could not open pipe"),
739	_("gpg_check_file_sign"));
740	SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
741	}
742
743	TPT(((0), FIL__, __LINE__, _("msg=<Open pipe success>\n")));
744
745	xagain:
746
747	errno = 0;
748
749	while (NULL != fgets(line, sizeof(line), source.pipe))
750	{
751
752	TPT(((0), FIL__, __LINE__, _("msg=<gpg out: %s>\n"), line));
753	if (line[strlen(line)-1] == '\n')
754	line[strlen(line)-1] = ' ';
755	sh_error_handle(SH_ERR_ALL, FIL__, __LINE__, 0, MSG_E_SUBGEN,
756	line,
757	_("gpg_check_file_sign"));
758
759	if (sl_strlen(line) < 18)
760	continue;
761	#if defined(WITH_GPG)
762	/* Sun May 27 18:40:05 CEST 2001
763	*/
764	if (0 == sl_strncmp(_("BADSIG"), &line[9], 6) \|\|
765	0 == sl_strncmp(_("ERRSIG"), &line[9], 6) \|\|
766	0 == sl_strncmp(_("NO_PUBKEY"), &line[9], 6) \|\|
767	0 == sl_strncmp(_("NODATA"), &line[9], 6) \|\|
768	0 == sl_strncmp(_("SIGEXPIRED"), &line[9], 6))
769	{
770	if (0 == sl_strncmp(_("BADSIG"), &line[9], 6)) {
771	dlog(1, FIL__, __LINE__,
772	_("%s file is signed, but the signature is invalid."),
773	((whichfile == 1) ? _("Configuration") : _("Database")));
774	}
775	else if (0 == sl_strncmp(_("NO_PUBKEY"), &line[9], 6)) {
776	dlog(1, FIL__, __LINE__,
777	_("%s file is signed, but the public key to verify the signature is not in my keyring %s/.gnupg/pubring.asc."),
778	((whichfile == 1) ? _("Configuration") : _("Database")),
779	homedir);
780	}
781	else if (0 == sl_strncmp(_("ERRSIG"), &line[9], 6)) {
782	dlog(1, FIL__, __LINE__,
783	_("%s file is signed, but the public key to verify the signature is not in my keyring %s/.gnupg/pubring.asc."),
784	((whichfile == 1) ? _("Configuration") : _("Database")),
785	homedir);
786	}
787	else if (0 == sl_strncmp(_("SIGEXPIRED"), &line[9], 6)) {
788	dlog(1, FIL__, __LINE__,
789	_("%s file is signed, but the public key to verify the signature has expired."),
790	((whichfile == 1) ? _("Configuration") : _("Database")));
791	}
792	else if (0 == sl_strncmp(_("NODATA"), &line[9], 6)) {
793	dlog(1, FIL__, __LINE__,
794	_("%s file is not signed."),
795	((whichfile == 1) ? _("Configuration") : _("Database")));
796	}
797
798	have_fp = BAD; have_id = BAD;
799	break;
800	}
801	if (0 == sl_strncmp(_("GOODSIG"), &line[9], 7))
802	{
803	sl_strlcpy (sign_id, &line[25], SH_MINIBUF+1);
804	sign_id[sl_strlen(sign_id)-1] = '\0'; /* remove trailing '"' */
805	have_id = GOOD;
806	}
807	if (0 == sl_strncmp(_("VALIDSIG"), &line[9], 8))
808	{
809	strncpy (sign_fp, &line[18], 40);
810	sign_fp[40] = '\0';
811	have_fp = GOOD;
812	}
813	#elif defined(WITH_PGP)
814	if (0 == sl_strncmp(_("Bad signature"), line, 13) \|\|
815	0 == sl_strncmp(_("Error"), line, 5) \|\|
816	0 == sl_strncmp(_("Malformed"), line, 9) \|\|
817	0 == sl_strncmp(_("WARNING"), line, 7) \|\|
818	0 == sl_strncmp(_("ERROR"), line, 5)
819	)
820	{
821	have_fp = BAD; have_id = BAD;
822	break;
823	}
824	if (0 == sl_strncmp(_("Good signature"), line, 14))
825	{
826	ptr = strchr ( line, '"');
827	++ptr;
828	sl_strlcpy (sign_id, ptr, SH_MINIBUF+1);
829	sign_id[sl_strlen(sign_id)-1] = '\0'; /* remove trailing dot */
830	sign_id[sl_strlen(sign_id)-2] = '\0'; /* remove trailing '"' */
831	have_id = GOOD;
832	}
833	#endif
834	}
835
836	if (ferror(source.pipe) && errno == EAGAIN)
837	{
838	clearerr(source.pipe);
839	goto xagain;
840	}
841
842	sh_gpg_pclose (&source);
843
844	TPT(((0), FIL__, __LINE__, _("msg=<Close pipe>\n")));
845
846	#ifdef WITH_PGP
847	/* get the fingerprint */
848
849	source.pipe = sh_gpg_popen ( &source, fd, 1, sign_id, homedir);
850	if (NULL == source.pipe)
851	{
852	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
853	_("Could not open pipe for fp"),
854	_("gpg_check_file_sign"));
855	SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
856	}
857
858	TPT(((0), FIL__, __LINE__, _("msg=<Open pipe success>\n")));
859
860	yagain:
861
862	errno = 0;
863
864	while (NULL != fgets(line, sizeof(line), source.pipe))
865	{
866	#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_STRTOK_R)
867	char * saveptr = NULL;
868	#endif
869	if (line[strlen(line)-1] == '\n')
870	line[strlen(line)-1] = ' ';
871	sh_error_handle(SH_ERR_ALL, FIL__, __LINE__, 0, MSG_E_SUBGEN,
872	line,
873	_("gpg_check_file_sign"));
874
875	if (sl_strlen(line) < 18)
876	continue;
877	#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_STRTOK_R)
878	ptr = strtok_r (line, " ", &saveptr);
879	#else
880	ptr = strtok (line, " ");
881	#endif
882	while (ptr)
883	{
884	#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_STRTOK_R)
885	ptr = strtok_r (NULL, " ", &saveptr);
886	#else
887	ptr = strtok (NULL, " ");
888	#endif
889	if (ptr && 0 == sl_strncmp (ptr, _("fingerprint"), 11))
890	{
891	#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_STRTOK_R)
892	ptr = strtok_r (NULL, " ", &saveptr); /* to '=' */
893	#else
894	ptr = strtok (NULL, " "); /* to '=' */
895	#endif
896	sign_fp[0] = '\0';
897	while (ptr)
898	{
899	#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_STRTOK_R)
900	ptr = strtok_r (NULL, " ", &saveptr); /* part of fingerprint */
901	#else
902	ptr = strtok (NULL, " "); /* part of fingerprint */
903	#endif
904	sl_strlcat (sign_fp, ptr, SH_MINIBUF+1);
905	}
906	/* sign_fp[sl_strlen(sign_fp)-1] = '\0'; remove trailing '\n' */
907	if (sl_strlen(sign_fp) > 0)
908	have_fp = GOOD;
909	break;
910	}
911	}
912	}
913
914	if (ferror(source.pipe) && errno == EAGAIN)
915	{
916	clearerr(source.pipe);
917	goto yagain;
918	}
919
920	sh_gpg_pclose (&source);
921	#endif
922
923	if (have_id == GOOD)
924	{
925	TPT(((0), FIL__, __LINE__, _("msg=<Got signator ID>\n")));
926	;
927	}
928	if (have_fp == GOOD)
929	{
930	TPT(((0), FIL__, __LINE__, _("msg=<Got fingerprint>\n")));
931	;
932	}
933
934	if (have_id == GOOD && have_fp == GOOD)
935	SL_RETURN( SH_GPG_OK, _("sh_gpg_check_file_sign"));
936	else
937	{
938	if (have_id == BAD)
939	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
940	_("No good signature"),
941	_("gpg_check_file_sign"));
942	else
943	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
944	_("No fingerprint for key"),
945	_("gpg_check_file_sign"));
946	SL_RETURN( SH_GPG_BADSIGN, _("sh_gpg_check_file_sign"));
947	}
948	}
949
950	int get_the_fd(SL_TICKET file_1);
951
952	int sh_gpg_check_sign (long file_1, long file_2, int what)
953	{
954	int status = SH_GPG_BAD;
955	int fd1 = 0;
956	int fd2 = 0;
957	static int smsg = S_FALSE;
958	char * tmp;
959	char * tmp2;
960
961	char * homedir = sh.effective.home;
962	#if defined(SH_WITH_SERVER)
963	struct passwd * tempres;
964	#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETPWNAM_R)
965	struct passwd pwd;
966	char buffer[SH_PWBUF_SIZE];
967	#endif
968	#endif
969
970	#ifdef USE_FINGERPRINT
971	#include "sh_gpg_fp.h"
972	#endif
973
974	SL_ENTER(_("sh_gpg_check_sign"));
975
976
977	if (what == 0 \|\| what == 1)
978	fd1 = get_the_fd(file_1);
979	if (what == 0 \|\| what == 2)
980	fd2 = get_the_fd(file_2);
981
982
983	if (fd1 < 0 \|\| fd2 < 0)
984	{
985	TPT(((0), FIL__, __LINE__, _("msg=<GPG_CHECK: FD1 = %d>\n"), fd1));
986	TPT(((0), FIL__, __LINE__, _("msg=<GPG_CHECK: FD2 = %d>\n"), fd2));
987	dlog(1, FIL__, __LINE__,
988	_("This looks like an unexpected internal error.\n"));
989	sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_EXIT_ABORT1, sh.prg_name);
990	aud_exit (FIL__, __LINE__, EXIT_FAILURE);
991	SL_RETURN( (-1), _("sh_gpg_check_sign"));
992	}
993
994	if (what == 0 \|\| what == 1)
995	{
996	TPT(((0), FIL__, __LINE__, _("msg=<GPG_CHECK: FD1 = %d>\n"), fd1));
997	#if defined(SH_WITH_SERVER)
998	#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETPWNAM_R)
999	sh_getpwnam_r(DEFAULT_IDENT, &pwd, buffer, sizeof(buffer), &tempres);
1000	#else
1001	tempres = sh_getpwnam(DEFAULT_IDENT);
1002	#endif
1003
1004	if ((tempres != NULL) && (0 == sl_ret_euid()))
1005	{
1006	/* privileges not dropped yet*/
1007	homedir = tempres->pw_dir;
1008	}
1009	#endif
1010	status = sh_gpg_check_file_sign(fd1, gp.conf_id, gp.conf_fp, homedir, 1);
1011	TPT(((0), FIL__, __LINE__, _("msg=<CONF SIGUSR: \|%s\|>\n"), gp.conf_id));
1012	TPT(((0), FIL__, __LINE__, _("msg=<CONF SIGFP: \|%s\|>\n"), gp.conf_fp));
1013	}
1014
1015	if ((what == 0 && SH_GPG_OK == status) \|\| what == 2)
1016	{
1017	TPT(((0), FIL__, __LINE__, _("msg=<GPG_CHECK: FD2 = %d>\n"), fd2));
1018	#if defined(SH_WITH_SERVER)
1019	#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETPWNAM_R)
1020	sh_getpwnam_r(DEFAULT_IDENT, &pwd, buffer, sizeof(buffer), &tempres);
1021	#else
1022	tempres = sh_getpwnam(DEFAULT_IDENT);
1023	#endif
1024
1025	if ((tempres != NULL) && (0 == sl_ret_euid()))
1026	{
1027	/* privileges not dropped yet*/
1028	homedir = tempres->pw_dir;
1029	}
1030	#endif
1031	status = sh_gpg_check_file_sign(fd2, gp.data_id, gp.data_fp, homedir, 2);
1032	TPT(((0), FIL__, __LINE__, _("msg=<DATA SIGUSR: \|%s\|>\n"), gp.data_id));
1033	TPT(((0), FIL__, __LINE__, _("msg=<DATA SIGFP: \|%s\|>\n"), gp.data_fp));
1034	}
1035
1036	if (SH_GPG_OK == status && what == 1)
1037	{
1038	#ifdef USE_FINGERPRINT
1039	if ((sl_strcmp(SH_GPG_FP, gp.conf_fp) == 0))
1040	{
1041	int i;
1042
1043	for(i = 0; i < (int) sl_strlen(gp.conf_fp); ++i)
1044	{
1045	if (gpgfp[i] != gp.conf_fp[i])
1046	{
1047	sh_error_handle(SH_ERR_SEVERE, FIL__, __LINE__, 0,
1048	MSG_E_GPG_FP,
1049	gpgfp, gp.conf_fp);
1050	break;
1051	}
1052	}
1053
1054	if (smsg == S_FALSE)
1055	{
1056	tmp = sh_util_safe_name(gp.conf_id);
1057	sh_gpg_fill_startup (__LINE__,
1058	/* sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_START_GH, */
1059	sh.prg_name, sh.real.uid,
1060	(sh.flag.hidefile == S_TRUE) ?
1061	_("(hidden)") : file_path('C', 'R'),
1062	tmp,
1063	gp.conf_fp);
1064	SH_FREE(tmp);
1065	}
1066	smsg = S_TRUE;
1067	SL_RETURN(0, _("sh_gpg_check_sign"));
1068	}
1069	else
1070	{
1071	/* fp mismatch
1072	*/
1073	dlog(1, FIL__, __LINE__,
1074	_("The fingerprint of the signing key: %s\ndoes not match the compiled-in fingerprint: %s.\nTherefore the signature could not be verified.\n"),
1075	gp.conf_fp, SH_GPG_FP);
1076	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
1077	_("Fingerprint mismatch"),
1078	_("gpg_check_sign"));
1079	status = SH_GPG_BADSIGN;
1080	}
1081	#else
1082	if (smsg == S_FALSE)
1083	{
1084	tmp = sh_util_safe_name(gp.conf_id);
1085	sh_gpg_fill_startup (__LINE__,
1086	/* sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_START_GH, */
1087	sh.prg_name, sh.real.uid,
1088	(sh.flag.hidefile == S_TRUE) ?
1089	_("(hidden)") : file_path('C', 'R'),
1090	tmp,
1091	gp.conf_fp);
1092	SH_FREE(tmp);
1093	}
1094	smsg = S_TRUE;
1095	SL_RETURN(0, _("sh_gpg_check_sign"));
1096	#endif
1097	}
1098
1099	else if (SH_GPG_OK == status && (what == 2 \|\| what == 0))
1100	{
1101	if ((sl_strcmp(gp.data_id, gp.conf_id) == 0) &&
1102	(sl_strcmp(gp.data_fp, gp.conf_fp) == 0))
1103	{
1104	SL_RETURN(0, _("sh_gpg_check_sign"));
1105	}
1106	else
1107	{
1108	/* ID or fp not equal
1109	*/
1110	dlog(1, FIL__, __LINE__,
1111	_("The fingerprint or ID of the signing key is not the same for the\nconfiguration file and the file signature database.\nTherefore the signature could not be verified.\n"));
1112	tmp = sh_util_safe_name (gp.conf_id);
1113	tmp2 = sh_util_safe_name (gp.data_id);
1114	sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_START_GH2,
1115	sh.prg_name, sh.real.uid,
1116	(sh.flag.hidefile == S_TRUE) ? _("(hidden)") : file_path('C', 'R'),
1117	tmp, gp.conf_fp,
1118	(sh.flag.hidefile == S_TRUE) ? _("(hidden)") : file_path('D', 'R'),
1119	tmp2, gp.data_fp);
1120	SH_FREE(tmp);
1121	SH_FREE(tmp2);
1122	}
1123	}
1124
1125	if (status != SH_GPG_OK)
1126	{
1127	uid_t e_uid = sl_ret_euid();
1128	char * e_home = sh.effective.home;
1129
1130	#if defined(SH_WITH_SERVER)
1131	#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETPWNAM_R)
1132	struct passwd e_pwd;
1133	char e_buffer[SH_PWBUF_SIZE];
1134	struct passwd * e_tempres;
1135	sh_getpwnam_r(DEFAULT_IDENT, &e_pwd, e_buffer, sizeof(e_buffer), &e_tempres);
1136	#else
1137	struct passwd * e_tempres = sh_getpwnam(DEFAULT_IDENT);
1138	#endif
1139
1140	if ((e_tempres != NULL) && (0 == sl_ret_euid()))
1141	{
1142	/* privileges not dropped yet */
1143	e_uid = e_tempres->pw_uid;
1144	e_home = e_tempres->pw_dir;
1145	}
1146	#endif
1147	dlog(1, FIL__, __LINE__,
1148	_("The signature of the configuration file or the file signature database\ncould not be verified. Possible reasons are:\n - gpg binary (%s) not found\n - invalid signature\n - the signature key is not in the private keyring of UID %d,\n - there is no keyring in %s/.gnupg, or\n - the file is not signed - did you move /filename.asc to /filename ?\nTo create a signed file, use (remove old signatures before):\n gpg -a --clearsign --not-dash-escaped FILE\n mv FILE.asc FILE\n"),
1149	#if defined(WITH_GPG)
1150	DEFAULT_GPG_PATH,
1151	#else
1152	DEFAULT_PGP_PATH,
1153	#endif
1154	(int) e_uid, e_home);
1155	}
1156
1157	TPT(((0), FIL__, __LINE__, _("msg=<Status = %d>\n"), status));
1158
1159	sh_error_handle((-1), FIL__, __LINE__, status, MSG_EXIT_ABORT1, sh.prg_name);
1160	aud_exit (FIL__, __LINE__, EXIT_FAILURE);
1161
1162	return (-1); /* make compiler happy */
1163	}
1164
1165	/* #ifdef WITH_GPG */
1166	#endif
1167
1168
1169
1170
1171
1172
1173
1174

Note: See TracBrowser for help on using the repository browser.

Download in other formats: