source: trunk/src/sh_readconf.c@ 20

Last change on this file since 20 was 20, checked in by rainer, 19 years ago

Enable command-line parsing for prelude, and make prelude regression test safer.
File size: 35.2 KB
Line 
1/* SAMHAIN file system integrity testing */
2/* Copyright (C) 1999, 2000 Rainer Wichmann */
3/* */
4/* This program is free software; you can redistribute it */
5/* and/or modify */
6/* it under the terms of the GNU General Public License as */
7/* published by */
8/* the Free Software Foundation; either version 2 of the License, or */
9/* (at your option) any later version. */
10/* */
11/* This program is distributed in the hope that it will be useful, */
12/* but WITHOUT ANY WARRANTY; without even the implied warranty of */
13/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
14/* GNU General Public License for more details. */
15/* */
16/* You should have received a copy of the GNU General Public License */
17/* along with this program; if not, write to the Free Software */
18/* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
19
20#include "config_xor.h"
21
22
23#include <stdlib.h>
24#include <stdio.h>
25#include <string.h>
26#include <ctype.h>
27
28
29#include "samhain.h"
30#include "sh_error.h"
31#include "sh_database.h"
32#include "sh_unix.h"
33#include "sh_utils.h"
34#include "sh_files.h"
35#include "sh_mail.h"
36#include "sh_calls.h"
37#include "sh_tiger.h"
38#include "sh_forward.h"
39#include "sh_modules.h"
40#include "sh_gpg.h"
41#include "sh_hash.h"
42#include "sh_ignore.h"
43#include "sh_prelink.h"
44#include "sh_extern.h"
45
46#ifdef WITH_DATABASE
47#include "sh_database.h"
48#endif
49
50#ifdef HAVE_LIBPRELUDE_9
51#include "sh_prelude.h"
52#endif
53
54extern int set_reverse_lookup (char * c);
55
56#undef FIL__
57#define FIL__ _("sh_readconf.c")
58
59typedef enum {
60 SH_SECTION_NONE,
61 SH_SECTION_LOG,
62 SH_SECTION_MISC,
63 SH_SECTION_ATTRIBUTES,
64 SH_SECTION_READONLY,
65 SH_SECTION_LOGFILES,
66 SH_SECTION_LOGGROW,
67 SH_SECTION_NOIGNORE,
68 SH_SECTION_ALLIGNORE,
69 SH_SECTION_USER0,
70 SH_SECTION_USER1,
71 SH_SECTION_PRELINK,
72#if defined (SH_WITH_MAIL)
73 SH_SECTION_MAIL,
74#endif
75#if defined (SH_WITH_CLIENT)
76 SH_SECTION_CLT,
77#endif
78#ifdef WITH_EXTERNAL
79 SH_SECTION_EXTERNAL,
80#endif
81#ifdef WITH_DATABASE
82 SH_SECTION_DATABASE,
83#endif
84#if defined (SH_WITH_CLIENT) || defined (SH_STANDALONE)
85 SH_SECTION_OTHER,
86#endif
87#ifdef SH_WITH_SERVER
88 SH_SECTION_CLIENTS,
89 SH_SECTION_SRV,
90#endif
91 SH_SECTION_THRESHOLD
92} ShSectionType;
93
94typedef struct str_ListSections {
95 char * name;
96 int type;
97} sh_str_ListSections;
98
99struct str_ListSections tab_ListSections[] = {
100 { N_("[Log]"), SH_SECTION_LOG},
101 { N_("[Misc]"), SH_SECTION_MISC},
102 { N_("[Attributes]"), SH_SECTION_ATTRIBUTES},
103 { N_("[ReadOnly]"), SH_SECTION_READONLY},
104 { N_("[LogFiles]"), SH_SECTION_LOGFILES},
105 { N_("[GrowingLogFiles]"), SH_SECTION_LOGGROW},
106 { N_("[IgnoreAll]"), SH_SECTION_ALLIGNORE},
107 { N_("[IgnoreNone]"), SH_SECTION_NOIGNORE},
108 { N_("[User0]"), SH_SECTION_USER0},
109 { N_("[User1]"), SH_SECTION_USER1},
110 { N_("[Prelink]"), SH_SECTION_PRELINK},
111#ifdef WITH_EXTERNAL
112 { N_("[External]"), SH_SECTION_EXTERNAL},
113#endif
114#ifdef WITH_DATABASE
115 { N_("[Database]"), SH_SECTION_DATABASE},
116#endif
117 { N_("[EventSeverity]"), SH_SECTION_THRESHOLD},
118#ifdef SH_WITH_SERVER
119 { N_("[Clients]"), SH_SECTION_CLIENTS},
120 { N_("[Server]"), SH_SECTION_SRV},
121#endif
122#if defined (SH_WITH_CLIENT)
123 { N_("[Client]"), SH_SECTION_CLT},
124#endif
125#if defined (SH_WITH_MAIL)
126 { N_("[Mail]"), SH_SECTION_MAIL},
127#endif
128 { NULL, SH_SECTION_NONE}
129};
130
131
132static int sh_readconfig_line (char * line);
133
134static ShSectionType read_mode = SH_SECTION_NONE;
135
136static int conf_line = 0;
137
138/* --- Read the configuration file. ---
139 */
140int sh_readconf_read (void)
141{
142#if defined (SH_WITH_CLIENT) || defined (SH_STANDALONE)
143 /* This is for modules.
144 */
145 int modnum;
146#endif
147
148 int i;
149
150 SL_TICKET fd = -1;
151#if defined(SH_STEALTH) && !defined(SH_STEALTH_MICRO)
152 SL_TICKET fdTmp = -1;
153 SL_TICKET open_tmp (void);
154#endif
155 char * tmp;
156 char * lptr;
157
158 char line_in[512+2];
159 char * line;
160 int line_int;
161
162 char myident[3*SH_MINIBUF+3];
163
164 /* This is for nested conditionals.
165 */
166 int some_other_host[16] = { 0 };
167 int some_other_system[16] = { 0 };
168 int seen_host = 0;
169 int seen_system = 0;
170 int host_int = 0;
171 int sys_int = 0;
172
173 int invert = 0;
174 int length = sl_strlen(sh.host.name);
175
176 int local_file = 1;
177 char local_flag = 'R';
178
179#if defined(WITH_GPG) || defined(WITH_PGP)
180 int signed_content = S_FALSE;
181 int true_content = S_FALSE;
182#endif
183#if defined(SH_STEALTH) && !defined(SH_STEALTH_MICRO)
184 int hidden_count = 0;
185#endif
186 uid_t euid;
187
188 SL_ENTER(_("sh_readconf_read"));
189
190 /* --- Open config file, exit on failure. ---
191 */
192#if defined(SH_WITH_CLIENT)
193 if (0 == sl_strcmp(file_path('C', 'R'), _("REQ_FROM_SERVER")))
194 {
195 sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_D_START);
196
197 fd = sh_forward_req_file(_("CONF"));
198
199 if (!SL_ISERROR(fd))
200 local_file = 0;
201 else if (sh.flag.checkSum != SH_CHECK_INIT)
202 aud_exit (FIL__, __LINE__, EXIT_FAILURE);
203 else
204 {
205 sh_error_handle ((-1), FIL__, __LINE__, fd, MSG_D_FAIL);
206 local_file = 1;
207 local_flag = 'I';
208 }
209 }
210#endif
211
212 /* Use a local configuration file.
213 */
214 if (local_file == 1)
215 {
216 if (0 != tf_trust_check (file_path('C', local_flag), SL_YESPRIV))
217 {
218 sl_get_euid(&euid);
219 dlog(1, FIL__, __LINE__,
220 _("The configuration file: %s is untrusted, i.e. an\nuntrusted user owns or can write to some directory in the path.\n"),
221 ( (NULL == file_path('C', local_flag))
222 ? _("(null)") : file_path('C', local_flag) ));
223 sh_error_handle ((-1), FIL__, __LINE__, EACCES, MSG_TRUST,
224 (long) euid,
225 ( (NULL == file_path('C', local_flag))
226 ? _("(null)") : file_path('C', local_flag) )
227 );
228 aud_exit (FIL__, __LINE__, EXIT_FAILURE);
229 }
230 if (SL_ISERROR(fd = sl_open_read(file_path('C',local_flag),SL_YESPRIV)))
231 {
232 sl_get_euid(&euid);
233 dlog(1, FIL__, __LINE__,
234 _("Could not open the local configuration file for reading because\nof the following error: %s (errnum = %ld)\nIf this is a permission problem, you need to change file permissions\nto make the file readable for the effective UID: %d\n"),
235 sl_get_errmsg(), fd, (int) euid);
236 sh_error_handle ((-1), FIL__, __LINE__, fd, MSG_NOACCESS,
237 (long) euid,
238 ( (NULL == file_path('C', local_flag))
239 ? _("(null)") : file_path('C', local_flag) )
240 );
241 aud_exit (FIL__, __LINE__, EXIT_FAILURE);
242 }
243 }
244
245 /* Compute the checksum of the open file.
246 */
247 tiger_fd = fd;
248 sl_strlcpy(sh.conf.hash,
249 sh_tiger_hash(file_path('C',local_flag),TIGER_FD, 0),
250 KEY_LEN+1);
251 sl_rewind (fd);
252
253#if defined(SH_STEALTH) && !defined(SH_STEALTH_MICRO)
254 /* extract the data and copy to temporary file
255 */
256 fdTmp = open_tmp();
257 while ( sh_unix_getline_stealth (fd, line_in, 512) > 0) {
258 hidden_count++;
259 if (line_in[0] == '\n')
260 {
261 sl_write(fdTmp, line_in, 1);
262 }
263 else
264 {
265 sl_write_line(fdTmp, line_in, sl_strlen(line_in));
266 }
267#if defined(WITH_GPG) || defined(WITH_PGP)
268 if (0 == sl_strncmp(line_in, _("-----END PGP SIGNATURE-----"), 25))
269 break;
270#else
271 if (0 == sl_strncmp(line_in, _("[EOF]"), 5))
272 break;
273#endif
274 if (hidden_count > 4096) /* arbitrary safeguard */
275 break;
276 }
277 sl_close(fd);
278 fd = fdTmp;
279 sl_rewind (fd);
280#endif
281
282 /* The system type, release, and machine.
283 */
284 sprintf(myident, _("%s:%s:%s"), /* known to fit */
285 sh.host.system, sh.host.release, sh.host.machine);
286
287
288 /* --- Start reading lines. ---
289 */
290 conf_line = 0;
291
292 while ( sh_unix_getline (fd, line_in, 512) > 0) {
293
294 ++conf_line;
295
296 line = &(line_in[0]);
297
298 /* fprintf(stderr, "<%s>\n", line); */
299
300 /* Sun May 27 18:40:05 CEST 2001
301 */
302#if defined(WITH_GPG) || defined(WITH_PGP)
303 if (signed_content == S_FALSE)
304 {
305 if (0 == sl_strcmp(line, _("-----BEGIN PGP SIGNED MESSAGE-----")))
306 signed_content = S_TRUE;
307 else
308 continue;
309 }
310 else if (true_content == S_FALSE)
311 {
312 if (line[0] == '\n')
313 true_content = S_TRUE;
314 else
315 continue;
316 }
317 else if (signed_content == S_TRUE)
318 {
319 if (0 == sl_strcmp(line, _("-----BEGIN PGP SIGNATURE-----")))
320 break;
321 else if (0 == sl_strcmp(line, _("-----BEGIN PGP SIGNED MESSAGE-----")))
322 {
323 sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
324 _("second signed message in file"),
325 _("sh_readconf_read"));
326 dlog(1, FIL__, __LINE__,
327 _("There seems to be more than one signed message in the configuration\nfile. Please make sure there is only one signed message.\n"));
328 sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_EXIT_ABORT1,
329 sh.prg_name);
330 aud_exit (FIL__, __LINE__,EXIT_FAILURE);
331 }
332 }
333#endif
334
335 /* Skip leading white space.
336 */
337 while (*line)
338 {
339 line_int = *line;
340 if (!isspace(line_int))
341 break;
342 ++line;
343 }
344
345 /* Skip header etc.
346 */
347 if (line[0] == '#' || line[0] == '\0' || line[0] == ';' ||
348 (line[0] == '/' && line[1] == '/'))
349 continue;
350
351 /* Clip off trailing white space.
352 */
353 tmp = line + sl_strlen( line ); --tmp;
354 while( isspace((int) *tmp ) && tmp >= line ) *tmp-- = '\0';
355
356
357 /* ------- starts a section ------------ */
358
359 if (line[0] == '[' &&
360 some_other_host[seen_host] == 0 &&
361 some_other_system[seen_system] == 0)
362 {
363 read_mode = SH_SECTION_NONE;
364
365 if (sl_strncmp (line, _("[EOF]"),
366 5) == 0)
367 {
368 goto nopel;
369 }
370
371 i = 0;
372
373 while (tab_ListSections[i].name != 0)
374 {
375 if (sl_strncmp (line, _(tab_ListSections[i].name),
376 sl_strlen(tab_ListSections[i].name)) == 0)
377 {
378 read_mode = tab_ListSections[i].type;
379 break;
380 }
381 ++i;
382 }
383
384#if defined (SH_WITH_CLIENT) || defined (SH_STANDALONE)
385 if (read_mode == SH_SECTION_NONE)
386 {
387 for (modnum = 0; modList[modnum].name != NULL; ++modnum)
388 {
389 if (0 == sl_strncmp (line, _(modList[modnum].conf_section),
390 sl_strlen(modList[modnum].conf_section)) )
391 read_mode = SH_SECTION_OTHER;
392 }
393 }
394#endif
395 if (read_mode == SH_SECTION_NONE)
396 {
397 sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_EINVALHEAD,
398 (long) conf_line);
399 }
400 }
401
402 /* --- an @host directive -------------- */
403
404 else if (line[0] == '@' || (line[0] == '!' && line[1] == '@'))
405 {
406 if (line[0] == '!')
407 {
408 lptr = &line[2];
409 invert = 1;
410 }
411 else
412 {
413 lptr = &line[1];
414 invert = 0;
415 }
416
417 if (sl_strncmp (lptr, _("end"), 3) == 0)
418 {
419 if (0 == seen_host)
420 sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_EINVALD,
421 _("config file"),
422 (long) conf_line);
423
424 else if (host_int == 0)
425 {
426 /* end of an @host directive
427 */
428 some_other_host[seen_host] = 0;
429 --seen_host;
430 seen_host = (seen_host < 0) ? 0 : seen_host;
431 }
432
433 else
434 {
435 --host_int;
436 host_int = (host_int < 0) ? 0 : host_int;
437 }
438 }
439 else if (some_other_host[seen_host] == 0 &&
440 some_other_system[seen_system] == 0 &&
441 seen_host < 15)
442 {
443 if (sl_strncmp (lptr, sh.host.name, length) == 0
444#ifdef HAVE_REGEX_H
445 || sh_util_regcmp (lptr, sh.host.name) == 0
446#endif
447 )
448 {
449 /* if match and '@', set some_other_host = 0;
450 * if match and '!@', set some_other_host = 1;
451 */
452 ++seen_host;
453 some_other_host[seen_host] = invert;
454 }
455 else
456 {
457 /* if no match and '@', set some_other_host = 1;
458 * if no match and '!@', set some_other_host = 0;
459 */
460 ++seen_host;
461 some_other_host[seen_host] = (invert == 0) ? 1 : 0;
462 }
463 }
464 else
465 ++host_int;
466 }
467
468 /* --- an %schedule directive ------------ */
469
470 else if (line[0] == '%' || (line[0] == '!' && line[1] == '%'))
471 {
472#if defined (SH_WITH_CLIENT) || defined (SH_STANDALONE)
473 if (line[0] == '!' && 0 == sl_strcmp(&(line[2]), _("SCHEDULE_TWO")))
474 set_dirList(1);
475 else if (0 == sl_strcmp(&(line[1]), _("SCHEDULE_TWO")))
476 set_dirList(2);
477#else
478 ;
479#endif
480 }
481
482 /* --- an $system directive -------------- */
483
484 else if (line[0] == '$' || (line[0] == '!' && line[1] == '$'))
485 {
486 if (line[0] == '!')
487 {
488 lptr = &line[2];
489 invert = 1;
490 }
491 else
492 {
493 lptr = &line[1];
494 invert = 0;
495 }
496
497 if (sl_strncmp (lptr, _("end"), 3) == 0)
498 {
499 if (0 == seen_system)
500 sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_EINVALD,
501 _("config file"),
502 (long) conf_line);
503
504 else if (sys_int == 0)
505 {
506 /* end of an $system directive
507 */
508 some_other_system[seen_system] = 0;
509 --seen_system;
510 seen_system = (seen_system < 0) ? 0 : seen_system;
511 }
512 else
513 {
514 --sys_int;
515 sys_int = (sys_int < 0) ? 0 : sys_int;
516 }
517 }
518 else if (some_other_host[seen_host] == 0 &&
519 some_other_system[seen_system] == 0 &&
520 seen_system < 15)
521 {
522 if (sl_strncmp (lptr, myident, sl_strlen(myident)) == 0
523#ifdef HAVE_REGEX_H
524 || sh_util_regcmp (lptr, myident) == 0
525#endif
526 )
527 {
528 ++seen_system;
529 some_other_system[seen_system] = invert;
530 }
531 else
532 {
533 ++seen_system;
534 some_other_system[seen_system] = (invert == 0) ? 1 : 0;
535 }
536 }
537 else
538 ++sys_int;
539 }
540
541 /* ------ no new section -------------- */
542
543
544 else if (some_other_host[seen_host] == 0 &&
545 some_other_system[seen_system] == 0 &&
546 read_mode != SH_SECTION_NONE)
547 {
548 if (0 != sh_readconfig_line (line))
549 {
550 sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_EINVALCONF,
551 (long) conf_line);
552 }
553 }
554
555 }
556
557 nopel:
558
559 if (0 != seen_host || 0 != seen_system)
560 sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_EINVALDD,
561 _("config file"),
562 (long) conf_line);
563
564#if defined(WITH_GPG) || defined(WITH_PGP)
565 /* Validate signature of open file.
566 */
567 sl_rewind (fd);
568 sh_error_only_stderr (S_FALSE);
569 if (0 != sh_gpg_check_sign (fd, 0, 1))
570 aud_exit (FIL__, __LINE__, EXIT_FAILURE);
571#endif
572
573 sl_close (fd);
574
575 sh_error_fixup();
576
577 read_mode = SH_SECTION_NONE; /* reset b/o sighup reload */
578
579 SL_RETURN( 0, _("sh_readconf_read"));
580}
581
582int sh_readconf_set_path (char * which, char * what)
583{
584 int len;
585 SL_ENTER( _("sh_readconf_set_path"));
586
587 if (which == NULL || what == NULL)
588 {
589 TPT((0, FIL__, __LINE__ , _("msg=<Input error>\n")));
590 SL_RETURN( -1, _("sh_readconf_set_path"));
591 }
592
593 if (0 == sl_strcmp(what, _("AUTO")))
594 {
595 len = sl_strlen(which);
596 if ( (len + sl_strlen(sh.host.name) + 2) > SH_PATHBUF)
597 {
598 TPT((0, FIL__, __LINE__ , _("msg=<Path too large: %s:%s>\n"),
599 which, sh.host.name));
600 SL_RETURN( -1, _("sh_readconf_set_path"));
601 }
602 else
603 {
604 which[len] = ':'; which[len+1] = '\0';
605 sl_strlcat(which, sh.host.name, SH_PATHBUF);
606 }
607 }
608 else /* not auto */
609 {
610 if (sl_strlen(what) > (SH_PATHBUF-1))
611 {
612 TPT((0, FIL__, __LINE__ , _("msg=<Path too large: %s>\n"), what));
613 SL_RETURN( -1, _("sh_readconf_set_path"));
614 }
615 else
616 {
617 sl_strlcpy(which, what, SH_PATHBUF);
618 }
619 }
620 SL_RETURN( 0, _("sh_readconf_set_path"));
621}
622
623int sh_readconf_set_database_path (char * what)
624{
625 return (sh_readconf_set_path(sh.data.path, what));
626}
627
628int sh_readconf_set_logfile_path (char * what)
629{
630 return (sh_readconf_set_path(sh.srvlog.name, what));
631}
632
633int sh_readconf_set_lockfile_path (char * what)
634{
635 return( sh_readconf_set_path(sh.srvlog.alt, what));
636}
637
638
639
640
641typedef enum {
642 SET_MAILTIME,
643 SET_FILETIME
644} ShTimerItem;
645
646
647int sh_readconf_setTime (char * str, ShTimerItem what)
648{
649 unsigned long i = atoi (str);
650
651 SL_ENTER( _("sh_readconf_setTime"));
652
653 if (i < LONG_MAX)
654 {
655 if (what == SET_MAILTIME)
656 {
657 TPT((0, FIL__, __LINE__, _("msg=<Set mail timer to %ld>\n"), i));
658 sh.mailTime.alarm_interval = i;
659 }
660 else if (what == SET_FILETIME)
661 {
662 TPT((0, FIL__, __LINE__, _("msg=<Set filecheck timer to %ld>\n"),i));
663 sh.fileCheck.alarm_interval = i;
664 }
665
666 SL_RETURN( 0, _("sh_readconf_setTime"));
667 }
668 else
669 {
670 sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_EINVALL,
671 _("set timer"), (long) i);
672 SL_RETURN( (-1), _("sh_readconf_setTime"));
673 }
674}
675
676int sh_readconf_setMailtime (char * c)
677{
678 return sh_readconf_setTime (c, SET_MAILTIME);
679}
680
681int sh_readconf_setFiletime (char * c)
682{
683 return sh_readconf_setTime (c, SET_FILETIME);
684}
685
686int sh_readconf_set_nice (char * c)
687{
688 long val;
689
690 SL_ENTER(_("sh_readconf_set_nice"));
691
692 val = strtol (c, (char **)NULL, 10);
693 if (val < -20 || val > 20)
694 {
695 SL_RETURN((-1), _("sh_readconf_set_nice"));
696 }
697
698 val = (val < -19 ? -19 : val);
699 val = (val > 19 ? 19 : val);
700
701 sh.flag.nice = val;
702 SL_RETURN((0), _("sh_readconf_set_nice"));
703}
704
705#ifdef FANCY_LIBCAP
706int sh_readconf_setCaps(char * c)
707{
708 int i;
709 SL_ENTER(_("sh_readconf_setCaps"));
710
711 i = sh_util_flagval(c, &sl_useCaps);
712 SL_RETURN((i), _("sh_readconf_setCaps"));
713}
714#endif
715
716typedef struct _cfg_options {
717 char * optname;
718 ShSectionType section;
719 ShSectionType alt_section;
720 int (*func)(char * opt);
721} cfg_options;
722
723#if defined (SH_WITH_CLIENT) || defined (SH_STANDALONE)
724extern int sh_set_schedule_one(char * str);
725extern int sh_set_schedule_two(char * str);
726#endif
727#if defined (SH_WITH_SERVER)
728extern int sh_socket_use (char * c);
729extern int sh_socket_uid (char * c);
730extern int sh_socket_password (char * c);
731#endif
732
733/* Yes, this isn't very elegant ;)
734 */
735#if defined(WITH_EXTERNAL)
736int sh_error_set_external_wrap (char * str) {
737 return sh_error_set_external ((const char *) str);
738}
739#endif
740#if defined (SH_WITH_CLIENT) || defined (SH_STANDALONE)
741int sh_files_setrecursion_wrap (char * str) {
742 return sh_files_setrecursion ((const char *) str);
743}
744int sh_util_setchecksum_wrap (char * str) {
745 return sh_util_setchecksum ((const char *) str);
746}
747#endif
748int sh_util_setlooptime_wrap (char * str) {
749 return sh_util_setlooptime ((const char *) str);
750}
751#ifdef SH_WITH_MAIL
752int sh_error_setseverity_wrap (char * str) {
753 return sh_error_setseverity ((const char *) str);
754}
755#endif
756int sh_calls_set_bind_addr_wrap (char * str) {
757 return sh_calls_set_bind_addr ((const char *) str);
758}
759int sh_unix_setdeamon_wrap (char * str) {
760 return sh_unix_setdeamon ((const char *) str);
761}
762int sh_error_setprint_wrap (char * str) {
763 return sh_error_setprint ((const char *) str);
764}
765int sh_error_setlog_wrap (char * str) {
766 return sh_error_setlog ((const char *) str);
767}
768int sh_error_set_syslog_wrap (char * str) {
769 return sh_error_set_syslog ((const char *) str);
770}
771#ifdef HAVE_LIBPRELUDE
772int sh_error_set_prelude_wrap (char * str) {
773 return sh_error_set_prelude ((const char *) str);
774}
775#endif
776#ifdef SH_WITH_CLIENT
777int sh_error_setexport_wrap (char * str) {
778 return sh_error_setexport ((const char *) str);
779}
780#endif
781#ifdef SH_WITH_SERVER
782int sh_forward_set_strip_wrap (char * str) {
783 return sh_forward_set_strip ((const char *) str);
784}
785int sh_unix_set_chroot_wrap (char * str) {
786 return sh_unix_set_chroot ((const char *) str);
787}
788#endif
789#if defined(WITH_DATABASE)
790int sh_error_set_database_wrap (char * str) {
791 return sh_error_set_database ((const char *) str);
792}
793#endif
794
795cfg_options ext_table[] = {
796#if defined(WITH_EXTERNAL)
797 { N_("opencommand"), SH_SECTION_EXTERNAL, SH_SECTION_NONE,
798 sh_ext_setcommand },
799 { N_("setcommandline"), SH_SECTION_EXTERNAL, SH_SECTION_NONE,
800 sh_ext_add_argv },
801 { N_("setchecksum"), SH_SECTION_EXTERNAL, SH_SECTION_NONE,
802 sh_ext_checksum },
803 { N_("setdefault"), SH_SECTION_EXTERNAL, SH_SECTION_NONE,
804 sh_ext_add_default },
805 { N_("setenviron"), SH_SECTION_EXTERNAL, SH_SECTION_NONE,
806 sh_ext_add_environ },
807 { N_("setdeadtime"), SH_SECTION_EXTERNAL, SH_SECTION_NONE,
808 sh_ext_deadtime },
809 { N_("settype"), SH_SECTION_EXTERNAL, SH_SECTION_NONE,
810 sh_ext_type },
811 { N_("setcredentials"), SH_SECTION_EXTERNAL, SH_SECTION_NONE,
812 sh_ext_priv },
813 { N_("setfilternot"), SH_SECTION_EXTERNAL, SH_SECTION_NONE,
814 sh_ext_add_not },
815 { N_("setfilterand"), SH_SECTION_EXTERNAL, SH_SECTION_NONE,
816 sh_ext_add_and },
817 { N_("setfilteror"), SH_SECTION_EXTERNAL, SH_SECTION_NONE,
818 sh_ext_add_or },
819 { N_("externalseverity"),SH_SECTION_LOG, SH_SECTION_EXTERNAL,
820 sh_error_set_external_wrap },
821 { N_("externalclass"), SH_SECTION_LOG, SH_SECTION_EXTERNAL,
822 sh_error_external_mask },
823#endif
824
825#if defined(WITH_DATABASE)
826 { N_("usepersistent"), SH_SECTION_DATABASE, SH_SECTION_NONE,
827 sh_database_use_persistent },
828 { N_("setdbname"), SH_SECTION_DATABASE, SH_SECTION_NONE,
829 sh_database_set_database },
830 { N_("setdbtable"), SH_SECTION_DATABASE, SH_SECTION_NONE,
831 sh_database_set_table },
832 { N_("setdbhost"), SH_SECTION_DATABASE, SH_SECTION_NONE,
833 sh_database_set_host },
834 { N_("setdbuser"), SH_SECTION_DATABASE, SH_SECTION_NONE,
835 sh_database_set_user },
836 { N_("setdbpassword"), SH_SECTION_DATABASE, SH_SECTION_NONE,
837 sh_database_set_password },
838 { N_("addtodbhash"), SH_SECTION_DATABASE, SH_SECTION_NONE,
839 sh_database_add_to_hash },
840 { N_("databaseseverity"),SH_SECTION_LOG, SH_SECTION_DATABASE,
841 sh_error_set_database },
842 { N_("databaseclass"), SH_SECTION_LOG, SH_SECTION_DATABASE,
843 sh_error_database_mask },
844 { N_("setdbservertstamp"), SH_SECTION_DATABASE, SH_SECTION_NONE,
845 set_enter_wrapper },
846#endif
847
848#if defined (SH_WITH_CLIENT) || defined (SH_STANDALONE)
849 { N_("dir"), SH_SECTION_ATTRIBUTES, SH_SECTION_NONE,
850 sh_files_pushdir_attr },
851 { N_("file"), SH_SECTION_ATTRIBUTES, SH_SECTION_NONE,
852 sh_files_pushfile_attr },
853 { N_("dir"), SH_SECTION_READONLY, SH_SECTION_NONE,
854 sh_files_pushdir_ro },
855 { N_("file"), SH_SECTION_READONLY, SH_SECTION_NONE,
856 sh_files_pushfile_ro },
857 { N_("dir"), SH_SECTION_LOGFILES, SH_SECTION_NONE,
858 sh_files_pushdir_log },
859 { N_("file"), SH_SECTION_LOGFILES, SH_SECTION_NONE,
860 sh_files_pushfile_log },
861 { N_("dir"), SH_SECTION_LOGGROW, SH_SECTION_NONE,
862 sh_files_pushdir_glog },
863 { N_("file"), SH_SECTION_LOGGROW, SH_SECTION_NONE,
864 sh_files_pushfile_glog },
865 { N_("dir"), SH_SECTION_NOIGNORE, SH_SECTION_NONE,
866 sh_files_pushdir_noig },
867 { N_("file"), SH_SECTION_NOIGNORE, SH_SECTION_NONE,
868 sh_files_pushfile_noig },
869 { N_("dir"), SH_SECTION_ALLIGNORE, SH_SECTION_NONE,
870 sh_files_pushdir_allig },
871 { N_("file"), SH_SECTION_ALLIGNORE, SH_SECTION_NONE,
872 sh_files_pushfile_allig },
873
874 { N_("dir"), SH_SECTION_USER0, SH_SECTION_NONE,
875 sh_files_pushdir_user0 },
876 { N_("file"), SH_SECTION_USER0, SH_SECTION_NONE,
877 sh_files_pushfile_user0 },
878 { N_("dir"), SH_SECTION_USER1, SH_SECTION_NONE,
879 sh_files_pushdir_user1 },
880 { N_("file"), SH_SECTION_USER1, SH_SECTION_NONE,
881 sh_files_pushfile_user1 },
882 { N_("dir"), SH_SECTION_PRELINK, SH_SECTION_NONE,
883 sh_files_pushdir_prelink },
884 { N_("file"), SH_SECTION_PRELINK, SH_SECTION_NONE,
885 sh_files_pushfile_prelink },
886
887 { N_("ignoreadded"), SH_SECTION_MISC, SH_SECTION_NONE,
888 sh_ignore_add_new },
889 { N_("ignoremissing"), SH_SECTION_MISC, SH_SECTION_NONE,
890 sh_ignore_add_del },
891
892 { N_("filecheckscheduleone"), SH_SECTION_MISC, SH_SECTION_NONE,
893 sh_set_schedule_one },
894 { N_("filecheckscheduletwo"), SH_SECTION_MISC, SH_SECTION_NONE,
895 sh_set_schedule_two },
896
897 { N_("usehardlinkcheck"), SH_SECTION_MISC, SH_SECTION_NONE,
898 sh_files_check_hardlinks },
899 { N_("hardlinkoffset"), SH_SECTION_MISC, SH_SECTION_NONE,
900 sh_files_hle_reg },
901 { N_("addokchars"), SH_SECTION_MISC, SH_SECTION_NONE,
902 sh_util_obscure_ok },
903 { N_("setrecursionlevel"), SH_SECTION_MISC, SH_SECTION_NONE,
904 sh_files_setrecursion_wrap },
905 { N_("checksumtest"), SH_SECTION_MISC, SH_SECTION_NONE,
906 sh_util_setchecksum_wrap },
907 { N_("reportonlyonce"), SH_SECTION_MISC, SH_SECTION_NONE,
908 sh_files_reportonce },
909 { N_("reportfulldetail"), SH_SECTION_MISC, SH_SECTION_NONE,
910 sh_files_fulldetail },
911 { N_("uselocaltime"), SH_SECTION_MISC, SH_SECTION_NONE,
912 sh_unix_uselocaltime },
913
914 { N_("setnicelevel"), SH_SECTION_MISC, SH_SECTION_NONE,
915 sh_readconf_set_nice },
916
917#if defined(FANCY_LIBCAP)
918 { N_("usecaps"), SH_SECTION_MISC, SH_SECTION_NONE,
919 sh_readconf_setCaps },
920#endif
921
922 { N_("setiolimit"), SH_SECTION_MISC, SH_SECTION_NONE,
923 sh_unix_set_io_limit },
924
925 { N_("versionstring"), SH_SECTION_MISC, SH_SECTION_NONE,
926 sh_hash_version_string },
927
928 { N_("digestalgo"), SH_SECTION_MISC, SH_SECTION_NONE,
929 sh_tiger_hashtype },
930
931 { N_("redefreadonly"), SH_SECTION_MISC, SH_SECTION_NONE,
932 sh_files_redef_readonly },
933
934 { N_("redeflogfiles"), SH_SECTION_MISC, SH_SECTION_NONE,
935 sh_files_redef_logfiles },
936
937 { N_("redefgrowinglogfiles"), SH_SECTION_MISC, SH_SECTION_NONE,
938 sh_files_redef_loggrow },
939
940 { N_("redefattributes"), SH_SECTION_MISC, SH_SECTION_NONE,
941 sh_files_redef_attributes },
942
943 { N_("redefignorenone"), SH_SECTION_MISC, SH_SECTION_NONE,
944 sh_files_redef_noignore },
945
946 { N_("redefignoreall"), SH_SECTION_MISC, SH_SECTION_NONE,
947 sh_files_redef_allignore },
948
949 { N_("redefuser0"), SH_SECTION_MISC, SH_SECTION_NONE,
950 sh_files_redef_user0 },
951
952 { N_("redefuser1"), SH_SECTION_MISC, SH_SECTION_NONE,
953 sh_files_redef_user1 },
954
955 { N_("redefprelink"), SH_SECTION_MISC, SH_SECTION_NONE,
956 sh_files_redef_prelink },
957
958
959 { N_("setprelinkpath"), SH_SECTION_MISC, SH_SECTION_NONE,
960 sh_prelink_set_path },
961 { N_("setprelinkchecksum"), SH_SECTION_MISC, SH_SECTION_NONE,
962 sh_prelink_set_hash },
963 /* client or standalone
964 */
965#endif
966
967#ifdef SH_WITH_SERVER
968#ifdef INET_SYSLOG
969 { N_("setudpactive"), SH_SECTION_SRV, SH_SECTION_MISC,
970 set_syslog_active },
971#endif
972 { N_("setusesocket"), SH_SECTION_SRV, SH_SECTION_MISC,
973 sh_socket_use },
974 { N_("setsocketallowuid"), SH_SECTION_SRV, SH_SECTION_MISC,
975 sh_socket_uid },
976 { N_("setsocketpassword"), SH_SECTION_SRV, SH_SECTION_MISC,
977 sh_socket_password },
978 { N_("setstripdomain"), SH_SECTION_SRV, SH_SECTION_MISC,
979 sh_forward_set_strip_wrap },
980 { N_("useseparatelogs"), SH_SECTION_SRV, SH_SECTION_MISC,
981 set_flag_sep_log },
982 { N_("setchrootdir"), SH_SECTION_SRV, SH_SECTION_MISC,
983 sh_unix_set_chroot_wrap },
984 { N_("setclienttimelimit"), SH_SECTION_SRV, SH_SECTION_MISC,
985 sh_forward_set_time_limit },
986 { N_("useclientseverity"), SH_SECTION_SRV, SH_SECTION_MISC,
987 sh_forward_use_clt_sev },
988 { N_("useclientclass"), SH_SECTION_SRV, SH_SECTION_MISC,
989 sh_forward_use_clt_class },
990 { N_("severitylookup"), SH_SECTION_SRV, SH_SECTION_MISC,
991 sh_forward_lookup_level },
992 { N_("setclientfromaccept"), SH_SECTION_SRV, SH_SECTION_MISC,
993 set_socket_peer },
994 { N_("setserverport"), SH_SECTION_SRV, SH_SECTION_MISC,
995 sh_forward_set_port },
996 { N_("setserverinterface"), SH_SECTION_SRV, SH_SECTION_MISC,
997 sh_forward_set_interface },
998 { N_("client"), SH_SECTION_CLIENTS, SH_SECTION_NONE,
999 sh_forward_register_client },
1000#endif
1001
1002#ifdef SH_WITH_CLIENT
1003 { N_("exportseverity"), SH_SECTION_LOG, SH_SECTION_NONE,
1004 sh_error_setexport_wrap },
1005 { N_("exportclass"), SH_SECTION_LOG, SH_SECTION_NONE,
1006 sh_error_export_mask },
1007 { N_("setlogserver"), SH_SECTION_CLT, SH_SECTION_MISC,
1008 sh_forward_setlogserver },
1009#endif
1010 { N_("setfilechecktime"), SH_SECTION_MISC, SH_SECTION_NONE,
1011 sh_readconf_setFiletime },
1012 { N_("setlooptime"), SH_SECTION_MISC, SH_SECTION_NONE,
1013 sh_util_setlooptime_wrap },
1014
1015#ifdef SH_WITH_MAIL
1016 { N_("mailseverity"), SH_SECTION_LOG, SH_SECTION_NONE,
1017 sh_error_setseverity_wrap },
1018 { N_("mailclass"), SH_SECTION_LOG, SH_SECTION_NONE,
1019 sh_error_mail_mask },
1020 { N_("setmailtime"), SH_SECTION_MAIL, SH_SECTION_MISC,
1021 sh_readconf_setMailtime },
1022 { N_("setmailnum"), SH_SECTION_MAIL, SH_SECTION_MISC,
1023 sh_mail_setNum },
1024 { N_("setmailaddress"), SH_SECTION_MAIL, SH_SECTION_MISC,
1025 sh_mail_setaddress },
1026 { N_("setmailrelay"), SH_SECTION_MAIL, SH_SECTION_MISC,
1027 sh_mail_set_relay },
1028 { N_("mailsingle"), SH_SECTION_MAIL, SH_SECTION_MISC,
1029 sh_mail_setFlag },
1030 { N_("mailsubject"), SH_SECTION_MAIL, SH_SECTION_MISC,
1031 set_mail_subject },
1032 { N_("setmailsender"), SH_SECTION_MAIL, SH_SECTION_MISC,
1033 sh_mail_set_sender },
1034 { N_("setmailfilternot"), SH_SECTION_MAIL, SH_SECTION_MISC,
1035 sh_mail_add_not },
1036 { N_("setmailfilterand"), SH_SECTION_MAIL, SH_SECTION_MISC,
1037 sh_mail_add_and },
1038 { N_("setmailfilteror"), SH_SECTION_MAIL, SH_SECTION_MISC,
1039 sh_mail_add_or },
1040#endif
1041 { N_("setbindaddress"), SH_SECTION_MISC, SH_SECTION_NONE,
1042 sh_calls_set_bind_addr_wrap },
1043 { N_("daemon"), SH_SECTION_MISC, SH_SECTION_NONE,
1044 sh_unix_setdeamon_wrap },
1045 { N_("samhainpath"), SH_SECTION_MISC, SH_SECTION_NONE,
1046 sh_unix_self_hash },
1047 { N_("trusteduser"), SH_SECTION_MISC, SH_SECTION_NONE,
1048 tf_add_trusted_user },
1049 { N_("settimeserver"), SH_SECTION_MISC, SH_SECTION_NONE,
1050 sh_unix_settimeserver },
1051
1052 { N_("printseverity"), SH_SECTION_LOG, SH_SECTION_NONE,
1053 sh_error_setprint_wrap },
1054 { N_("printclass"), SH_SECTION_LOG, SH_SECTION_NONE,
1055 sh_error_print_mask },
1056
1057 { N_("logseverity"), SH_SECTION_LOG, SH_SECTION_NONE,
1058 sh_error_setlog_wrap },
1059 { N_("logclass"), SH_SECTION_LOG, SH_SECTION_NONE,
1060 sh_error_log_mask },
1061
1062 { N_("syslogseverity"), SH_SECTION_LOG, SH_SECTION_NONE,
1063 sh_error_set_syslog_wrap },
1064 { N_("syslogclass"), SH_SECTION_LOG, SH_SECTION_NONE,
1065 sh_error_syslog_mask },
1066#ifdef HAVE_LIBPRELUDE
1067 { N_("preludeseverity"), SH_SECTION_LOG, SH_SECTION_NONE,
1068 sh_error_set_prelude_wrap },
1069 { N_("preludeclass"), SH_SECTION_LOG, SH_SECTION_NONE,
1070 sh_error_prelude_mask },
1071#ifdef HAVE_LIBPRELUDE_9
1072 { N_("preludeprofile"), SH_SECTION_MISC, SH_SECTION_NONE,
1073 sh_prelude_set_profile },
1074 { N_("preludemaptoinfo"), SH_SECTION_MISC, SH_SECTION_NONE,
1075 sh_prelude_map_info },
1076 { N_("preludemaptolow"), SH_SECTION_MISC, SH_SECTION_NONE,
1077 sh_prelude_map_low },
1078 { N_("preludemaptomedium"), SH_SECTION_MISC, SH_SECTION_NONE,
1079 sh_prelude_map_medium },
1080 { N_("preludemaptohigh"), SH_SECTION_MISC, SH_SECTION_NONE,
1081 sh_prelude_map_high },
1082#endif
1083#endif
1084
1085 { N_("logcalls"), SH_SECTION_LOG, SH_SECTION_NONE,
1086 sh_aud_set_functions },
1087
1088 { N_("messageheader"), SH_SECTION_MISC, SH_SECTION_NONE,
1089 sh_error_ehead },
1090
1091 { N_("setconsole"), SH_SECTION_MISC, SH_SECTION_NONE,
1092 sh_log_set_console },
1093
1094#ifdef WITH_MESSAGE_QUEUE
1095 { N_("messagequeueactive"),SH_SECTION_MISC, SH_SECTION_NONE,
1096 enable_msgq },
1097#endif
1098
1099 { N_("setreverselookup"), SH_SECTION_MISC, SH_SECTION_NONE,
1100 set_reverse_lookup },
1101
1102 { N_("setdatabasepath"), SH_SECTION_MISC, SH_SECTION_NONE,
1103 sh_readconf_set_database_path },
1104
1105 { N_("setlogfilepath"), SH_SECTION_MISC, SH_SECTION_NONE,
1106 sh_readconf_set_logfile_path },
1107
1108 { N_("setlockfilepath"), SH_SECTION_MISC, SH_SECTION_NONE,
1109 sh_readconf_set_lockfile_path },
1110
1111 { N_("hidesetup"), SH_SECTION_MISC, SH_SECTION_NONE,
1112 sh_util_hidesetup },
1113
1114 { N_("syslogfacility"), SH_SECTION_LOG, SH_SECTION_MISC,
1115 sh_log_set_facility },
1116
1117 { N_("mactype"), SH_SECTION_MISC, SH_SECTION_NONE,
1118 sh_util_sigtype },
1119
1120 { NULL, 0, 0, NULL}
1121};
1122
1123
1124
1125
1126static int sh_readconfig_line (char * line)
1127{
1128 char * c;
1129 char * tmp;
1130 int i;
1131 int good_opt = -1;
1132
1133#if defined (SH_WITH_CLIENT) || defined (SH_STANDALONE)
1134 int modnum, modkey;
1135#endif
1136
1137 static char *ident[] = {
1138 N_("severityreadonly"),
1139 N_("severitylogfiles"),
1140 N_("severitygrowinglogs"),
1141 N_("severityignorenone"),
1142 N_("severityignoreall"),
1143 N_("severityattributes"),
1144 N_("severitydirs"),
1145 N_("severityfiles"),
1146 N_("severitynames"),
1147 N_("severityuser0"),
1148 N_("severityuser1"),
1149 N_("severityprelink"),
1150 NULL
1151 };
1152
1153 static int identnum[] = {
1154 SH_ERR_T_RO,
1155 SH_ERR_T_LOGS,
1156 SH_ERR_T_GLOG,
1157 SH_ERR_T_NOIG,
1158 SH_ERR_T_ALLIG,
1159 SH_ERR_T_ATTR,
1160 SH_ERR_T_DIR,
1161 SH_ERR_T_FILE,
1162 SH_ERR_T_NAME,
1163 SH_ERR_T_USER0,
1164 SH_ERR_T_USER1,
1165 SH_ERR_T_PRELINK,
1166 };
1167
1168 SL_ENTER(_("sh_readconf_line"));
1169
1170 /* interpret line */
1171
1172 c = strchr(line, '=');
1173 if (c == NULL || (*c) == '\0')
1174 {
1175 if (line != NULL)
1176 {
1177 TPT(( 0, FIL__, __LINE__, _("msg=<ConfigFile: not key=value: %s>\n"),
1178 line));
1179 }
1180 SL_RETURN(good_opt, _("sh_readconf_line"));
1181 }
1182 else
1183 ++c;
1184
1185 /* skip leading whitespace
1186 */
1187 while ((*c) == ' ' || (*c) == '\t')
1188 ++c;
1189
1190 if ((*c) == '\0') /* no value */
1191 {
1192 if (line != NULL)
1193 {
1194 TPT(( 0, FIL__, __LINE__, _("msg=<ConfigFile: not key=value: %s>\n"),
1195 line));
1196 }
1197 SL_RETURN(good_opt, _("sh_readconf_line"));
1198 }
1199
1200 /* convert to lowercase */
1201
1202 tmp = line;
1203 while (*tmp != '=')
1204 {
1205 *tmp = tolower( (int) *tmp);
1206 ++tmp;
1207 }
1208
1209 if (!sl_is_suid())
1210 {
1211 TPT(( 0, FIL__, __LINE__, _("msg=<ConfigFile: %s>\n"), line));
1212 }
1213
1214
1215#if defined (SH_WITH_CLIENT) || defined (SH_STANDALONE)
1216 if (read_mode == SH_SECTION_OTHER)
1217 {
1218 for (modnum = 0; modList[modnum].name != NULL; ++modnum)
1219 {
1220 for (modkey = 0; modList[modnum].conf_table[modkey].the_opt != NULL;
1221 ++modkey)
1222 {
1223 if (sl_strncmp (line,
1224 _(modList[modnum].conf_table[modkey].the_opt),
1225 sl_strlen(modList[modnum].conf_table[modkey].the_opt) ) == 0)
1226 {
1227 good_opt = 0;
1228 if (0 != modList[modnum].conf_table[modkey].func(c))
1229 sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_EINVALS,
1230 _(modList[modnum].conf_table[modkey].the_opt), c);
1231 if (!sl_is_suid())
1232 {
1233 TPT(( 0, FIL__, __LINE__,
1234 _("msg=<line = %s, option = %s>\n"), line,
1235 _(modList[modnum].conf_table[modkey].the_opt)));
1236 }
1237 goto outburst;
1238 }
1239 }
1240 }
1241 }
1242 outburst:
1243#endif
1244
1245
1246 if (read_mode == SH_SECTION_THRESHOLD)
1247 {
1248 i = 0;
1249 while (ident[i] != NULL) {
1250 if (sl_strncmp (line, _(ident[i]), sl_strlen(ident[i])-1) == 0)
1251 {
1252 good_opt = 0;
1253 sh_error_set_iv (identnum[i], c);
1254 break;
1255 }
1256 ++i;
1257 }
1258 }
1259 else
1260 {
1261 i = 0;
1262 while (ext_table[i].optname != NULL)
1263 {
1264 if ((ext_table[i].section == read_mode ||
1265 ext_table[i].alt_section == read_mode) &&
1266 sl_strncmp (line, _(ext_table[i].optname),
1267 sl_strlen(ext_table[i].optname)) == 0)
1268 {
1269 good_opt = 0;
1270 if (0 != ext_table[i].func (c))
1271 sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_EINVALS,
1272 _(ext_table[i].optname), c);
1273 break;
1274 }
1275 ++i;
1276 }
1277 }
1278
1279 SL_RETURN(good_opt, _("sh_readconf_line"));
1280}
1281
1282
Note: See TracBrowser for help on using the repository browser.