Context Navigation

source: trunk/src/sh_registry.c@ 335

Last change on this file since 335 was 335, checked in by katerina, 13 years ago
Module cleanup/thread restart at configuration reload.
File size: 23.2 KB

Line
1	/* SAMHAIN file system integrity testing */
2	/* Copyright (C) 2010 Rainer Wichmann */
3	/* */
4	/* This program is free software; you can redistribute it */
5	/* and/or modify */
6	/* it under the terms of the GNU General Public License as */
7	/* published by */
8	/* the Free Software Foundation; either version 2 of the License, or */
9	/* (at your option) any later version. */
10	/* */
11	/* This program is distributed in the hope that it will be useful, */
12	/* but WITHOUT ANY WARRANTY; without even the implied warranty of */
13	/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
14	/* GNU General Public License for more details. */
15	/* */
16	/* You should have received a copy of the GNU General Public License */
17	/* along with this program; if not, write to the Free Software */
18	/* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
19
20	/***************************************************************************
21	*
22	* This file provides a module for samhain to check the MS Windows registry.
23	*
24	*/
25
26	#include "config_xor.h"
27
28	#ifdef USE_REGISTRY_CHECK
29
30	#include <windows.h>
31	#include <stdio.h>
32	#include <time.h>
33
34	#define FIL__ _("sh_registry.c")
35
36	/* We don't want to build this into yule
37	*/
38	#if defined (SH_WITH_CLIENT) \|\| defined (SH_STANDALONE)
39
40	#include <sys/types.h>
41	#include <regex.h>
42
43	#include "samhain.h"
44	#include "sh_pthread.h"
45	#include "sh_utils.h"
46	#include "sh_unix.h"
47	#include "sh_modules.h"
48	#include "sh_hash.h"
49	#include "sh_tiger.h"
50
51	static int check_key (char * name, int isSingle);
52
53	static int sh_reg_set_active (const char *s);
54	static int sh_reg_set_interval (const char * c);
55	static int sh_reg_set_severity (const char *s);
56	static int sh_reg_add_key (const char *s);
57	static int sh_reg_add_hierarchy (const char *s);
58	static int sh_reg_add_stop (const char *s);
59	static int sh_reg_add_ign (const char *s);
60
61	#define STOP_FALSE 0
62	#define STOP_CHECK 1
63	#define STOP_IGN 2
64
65	sh_rconf sh_reg_check_table[] = {
66	{
67	N_("severitychange"),
68	sh_reg_set_severity,
69	},
70	{
71	N_("registrycheckactive"),
72	sh_reg_set_active,
73	},
74	{
75	N_("registrycheckinterval"),
76	sh_reg_set_interval,
77	},
78	{
79	N_("singlekey"),
80	sh_reg_add_key,
81	},
82	{
83	N_("hierarchy"),
84	sh_reg_add_hierarchy,
85	},
86	{
87	N_("stopatkey"),
88	sh_reg_add_stop,
89	},
90	{
91	N_("ignorekey"),
92	sh_reg_add_ign,
93	},
94	{
95	NULL,
96	NULL
97	}
98	};
99
100	/* Runtime configuration */
101
102	#define SH_REGISTRY_INTERVAL 300
103
104	static int ShRegCheckActive = S_FALSE;
105	static time_t sh_reg_check_interval = SH_REGISTRY_INTERVAL;
106	static int sh_reg_check_severity = SH_ERR_SEVERE;
107
108	struct regkeylist {
109	char * name;
110	int stop;
111	int single;
112	#ifdef HAVE_REGEX_H
113	regex_t preg;
114	#endif
115
116	struct regkeylist *next;
117	};
118
119	static struct regkeylist * keylist = NULL;
120
121	static int sh_reg_set_active(const char *s)
122	{
123	int value;
124
125	SL_ENTER(_("sh_reg_set_active"));
126
127	value = sh_util_flagval(s, &ShRegCheckActive);
128
129	SL_RETURN((value), _("sh_reg_set_active"));
130	}
131
132	static int sh_reg_set_interval (const char * c)
133	{
134	int retval = 0;
135	long val;
136
137	SL_ENTER(_("sh_reg_set_interval"));
138	val = strtol (c, (char **)NULL, 10);
139	if (val <= 0)
140	{
141	SH_MUTEX_LOCK(mutex_thread_nolog);
142	sh_error_handle ((-1), FIL__, __LINE__, EINVAL, MSG_EINVALS,
143	_("registry check interval"), c);
144	SH_MUTEX_UNLOCK(mutex_thread_nolog);
145	retval = -1;
146	}
147
148	sh_reg_check_interval = (time_t) val;
149	SL_RETURN(0, _("sh_reg_set_interval"));
150	}
151
152	static int sh_reg_set_severity (const char *s)
153	{
154	char tmp[32];
155	tmp[0] = '='; tmp[1] = '\0';
156	sl_strlcat (tmp, s, 32);
157	return sh_error_set_level (tmp, &sh_reg_check_severity);
158	}
159
160	static int sh_reg_add_key_int (const char *s, int isSingle, int isStop)
161	{
162	struct regkeylist * newkey;
163	size_t len = sl_strlen(s);
164
165	if (len > 0)
166	{
167	newkey = SH_ALLOC(sizeof(struct regkeylist));
168	newkey->single = isSingle;
169	newkey->stop = isStop;
170	newkey->name = NULL;
171
172	if (STOP_FALSE == isStop)
173	{
174	newkey->name = SH_ALLOC(len + 1);
175	sl_strlcpy(newkey->name, s, len+1);
176	}
177	else
178	{
179	#ifdef HAVE_REGEX_H
180	int status = regcomp(&(newkey->preg), s, REG_NOSUB\|REG_EXTENDED);
181	if (status != 0)
182	{
183	char errbuf[256];
184	regerror(status, &(newkey->preg), errbuf, sizeof(errbuf));
185	SH_MUTEX_LOCK(mutex_thread_nolog);
186	sh_error_handle((-1), FIL__, __LINE__, status, MSG_E_SUBGEN,
187	errbuf, _("sh_reg_add_key_int"));
188	SH_MUTEX_UNLOCK(mutex_thread_nolog);
189	SH_FREE(newkey);
190	return -1;
191	}
192	#else
193	newkey->name = SH_ALLOC(len + 1);
194	sl_strlcpy(newkey->name, s, len+1);
195	#endif
196	}
197	newkey->next = keylist;
198	keylist = newkey;
199	return 0;
200	}
201	return -1;
202	}
203
204	static int sh_reg_add_key (const char *s)
205	{
206	return sh_reg_add_key_int (s, S_TRUE, STOP_FALSE);
207	}
208	static int sh_reg_add_hierarchy (const char *s)
209	{
210	return sh_reg_add_key_int (s, S_FALSE, STOP_FALSE);
211	}
212	static int sh_reg_add_stop (const char *s)
213	{
214	return sh_reg_add_key_int (s, S_FALSE, STOP_CHECK);
215	}
216	static int sh_reg_add_ign (const char *s)
217	{
218	return sh_reg_add_key_int (s, S_FALSE, STOP_IGN);
219	}
220
221	/* Module functions */
222
223	int sh_reg_check_init(struct mod_type * arg)
224	{
225	#ifndef HAVE_PTHREAD
226	(void) arg;
227	#endif
228
229	if (ShRegCheckActive == S_FALSE)
230	return SH_MOD_FAILED;
231	#ifdef HAVE_PTHREAD
232	if (arg != NULL && arg->initval < 0 &&
233	(sh.flag.isdaemon == S_TRUE \|\| sh.flag.loop == S_TRUE))
234	{
235	if (0 == sh_pthread_create(sh_threaded_module_run, (void *)arg))
236	return SH_MOD_THREAD;
237	else
238	return SH_MOD_FAILED;
239	}
240	else if (arg != NULL && arg->initval == SH_MOD_THREAD &&
241	(sh.flag.isdaemon == S_TRUE \|\| sh.flag.loop == S_TRUE))
242	{
243	return SH_MOD_THREAD;
244	}
245	#endif
246	return 0;
247	}
248
249	int sh_reg_check_timer(time_t tcurrent)
250	{
251	static time_t lastcheck = 0;
252
253	SL_ENTER(_("sh_reg_check_timer"));
254	if ((time_t) (tcurrent - lastcheck) >= sh_reg_check_interval)
255	{
256	lastcheck = tcurrent;
257	SL_RETURN((-1), _("sh_reg_check_timer"));
258	}
259	SL_RETURN(0, _("sh_reg_check_timer"));
260	}
261
262	#define SH_REGFORM_NEW 1
263	#define SH_REGFORM_OLD 2
264
265	static char * format_changes(int flag, char * buf, size_t len,
266	time_t time_old, unsigned long size_old,
267	unsigned long keys_old, unsigned long values_old,
268	char * hash_old,
269	time_t time_new, unsigned long size_new,
270	unsigned long keys_new, unsigned long values_new,
271	char * hash_new)
272	{
273	char timestr1[32];
274	char timestr2[32];
275	char timestr3[32];
276
277	char buf_old[512] = "";
278	char buf_new[512] = "";
279
280	if ((0 != (flag & SH_REGFORM_NEW)) && (NULL != hash_new))
281	{
282	(void) sh_unix_gmttime (time_new, timestr1, sizeof(timestr1));
283	(void) sh_unix_gmttime (keys_new, timestr2, sizeof(timestr2));
284	(void) sh_unix_gmttime (values_new, timestr3, sizeof(timestr3));
285
286	#ifdef SH_USE_XML
287	sl_snprintf(buf_new, sizeof(buf_new),
288	"size_new=\"%lu\" mtime_new=\"%s\" ctime_new=\"%s\" atime_new=\"%s\" chksum_new=\"%s\"",
289	size_new, timestr1, timestr2, timestr3, hash_new);
290	#else
291	sl_snprintf(buf_new, sizeof(buf_new),
292	"size_new=<%lu>, mtime_new=<%s>, ctime_new=<%s>, atime_new=<%s>, chksum_new=<%s>",
293	size_new, timestr1, timestr2, timestr3, hash_new);
294	#endif
295	}
296
297	if ((0 != (flag & SH_REGFORM_OLD)) && (NULL != hash_old))
298	{
299	(void) sh_unix_gmttime (time_old, timestr1, sizeof(timestr1));
300	(void) sh_unix_gmttime (keys_old, timestr2, sizeof(timestr2));
301	(void) sh_unix_gmttime (values_old, timestr3, sizeof(timestr3));
302
303	#ifdef SH_USE_XML
304	sl_snprintf(buf_old, sizeof(buf_old),
305	" size_old=\"%lu\" mtime_old=\"%s\" ctime_old=\"%s\" atime_old=\"%s\" chksum_old=\"%s\"",
306	size_old, timestr1, timestr2, timestr3, hash_old);
307	#else
308	sl_snprintf(buf_old, sizeof(buf_old),
309	" size_old=<%lu>, mtime_old=<%s>, ctime_old=<%s>, atime_old=<%s>, chksum_old=<%s>",
310	size_old, timestr1, timestr2, timestr3, hash_old);
311	#endif
312	}
313
314	sl_strlcpy(buf, buf_new, len);
315	sl_strlcat(buf, buf_old, len);
316
317	return buf;
318	}
319
320	static void report_missing_entry(const char * path)
321	{
322	char * infobuf = SH_ALLOC(1024);
323	char * errbuf = SH_ALLOC(1024);
324	char * tmp = sh_util_safe_name (path);
325	char timestr[32];
326	struct store2db save;
327
328	memset(&save, '\0', sizeof(struct store2db));
329	sh_hash_db2pop (path, &save);
330
331	(void) sh_unix_gmttime (save.val1, timestr, sizeof(timestr));
332
333	sl_snprintf(infobuf, 1024, _("mtime=%s size=%lu subkeys=%lu values=%lu"),
334	timestr,
335	(unsigned long) save.val0,
336	(unsigned long) save.val2,
337	(unsigned long) save.val3);
338
339	(void) format_changes (SH_REGFORM_OLD, errbuf, 1024,
340	save.val1, save.val0, save.val2, save.val3, save.checksum,
341	0, 0, 0, 0, NULL);
342
343	SH_MUTEX_LOCK(mutex_thread_nolog);
344	sh_error_handle(sh_reg_check_severity, FIL__, __LINE__, 0, MSG_REG_MISS,
345	infobuf, tmp, errbuf);
346	SH_MUTEX_UNLOCK(mutex_thread_nolog);
347
348	SH_FREE(tmp);
349	SH_FREE(errbuf);
350	SH_FREE(infobuf);
351	return;
352	}
353
354	int sh_reg_check_run(void)
355	{
356	struct regkeylist *this = keylist;
357
358	if (this)
359	{
360	SH_MUTEX_LOCK(mutex_thread_nolog);
361	sh_error_handle(SH_ERR_INFO, FIL__, __LINE__, 0, MSG_E_SUBGEN,
362	_("Checking the registry"),
363	_("sh_reg_check_run"));
364	SH_MUTEX_UNLOCK(mutex_thread_nolog);
365
366	while (this)
367	{
368	if (STOP_FALSE == this->stop)
369	{
370	/*
371	* -- Check key --
372	*/
373	check_key (this->name, this->single);
374	}
375	this = this->next;
376	}
377	}
378	sh_hash_unvisited_custom ('H', report_missing_entry);
379
380	return 0;
381	}
382
383	int sh_reg_check_reconf(void)
384	{
385	struct regkeylist *this;
386
387	while (keylist)
388	{
389	this = keylist;
390	keylist = keylist->next;
391
392	if (this->name)
393	SH_FREE(this->name);
394	#ifdef HAVE_REGEX_H
395	if (STOP_FALSE != this->stop)
396	regfree(&(this->preg));
397	#endif
398	SH_FREE(this);
399	}
400
401	sh_reg_check_interval = SH_REGISTRY_INTERVAL;
402
403	return 0;
404	}
405
406	int sh_reg_check_cleanup(void)
407	{
408	sh_reg_check_reconf();
409	return 0;
410	}
411
412	/* >>>>>>>>>>>> Main check function <<<<<<<<<<<< */
413
414
415	#include <windows.h>
416
417	#define MAX_KEY_LENGTH (2*256)
418	#define MAX_VALUE_NAME (2*16384)
419
420	CHAR achValue[MAX_VALUE_NAME];
421
422	unsigned long nKeys = 0;
423	unsigned long nVals = 0;
424
425	static int CheckThisSubkey (HKEY key, char * subkey, char * path,
426	int isSingle, int view);
427
428	static time_t convertTime(FILETIME * ft)
429	{
430	time_t result;
431
432	/* Shift high part up by 2^32
433	*/
434	UINT64 date = ((UINT64)ft->dwHighDateTime) << 32;
435
436	/* Add low part
437	*/
438	date \|= (UINT64)ft->dwLowDateTime;
439
440	/* Subtract difference between Jan 1, 1601 and Jan 1, 1970
441	*/
442	date -= ((UINT64)116444736) * ((UINT64)100) * ((UINT64)10000000);
443
444	/* Divide by number of 100-nanosecond intervals per second
445	*/
446	date /= ((UINT64)10000000);
447
448	/* Convert to a time_t
449	*/
450	result = (time_t) date;
451
452	return result;
453	}
454
455	#if !defined(KEY_WOW64_64KEY)
456	#define KEY_WOW64_64KEY 0x0100;
457	#endif
458	#if !defined(KEY_WOW64_32KEY)
459	#define KEY_WOW64_32KEY 0x0200;
460	#endif
461
462
463	#define SH_KEY_NULL _("000000000000000000000000000000000000000000000000")
464
465	int QueryKey(HKEY hKey, char * path, size_t pathlen, int isSingle)
466	{
467	CHAR achKey[MAX_KEY_LENGTH]; /* buffer for subkey name */
468	DWORD cbName; /* size of name string */
469	/* CHAR achClass[MAX_PATH] = ""; // buffer for class name */
470	/* DWORD cchClassName = MAX_PATH/2;// size of class string */
471	DWORD cSubKeys=0; /* number of subkeys */
472	DWORD cbMaxSubKey; /* longest subkey size */
473	DWORD cchMaxClass; /* longest class string */
474	DWORD cValues; /* number of values for key */
475	DWORD cchMaxValue; /* longest value name */
476	DWORD cbMaxValueData; /* longest value data */
477	DWORD cbSecurityDescriptor; /* size of security descriptor */
478	FILETIME ftLastWriteTime; /* last write time */
479	DWORD lpType; /* type of data stored in value */
480	BYTE lpData[256]; /* buffer for data in value */
481	DWORD lpcbData; /* size of lpData buffer */
482	DWORD i, retCode;
483	DWORD cchValue = MAX_VALUE_NAME/2;
484
485	char hashbuf[KEYBUF_SIZE];
486	unsigned long totalSize = 0;
487	time_t fTime = 0;
488
489	char * tPath = NULL;
490	int doUpdate = S_FALSE;
491
492	retCode = RegQueryInfoKey(
493	hKey, /* key handle */
494	NULL /* achClass /, / buffer for class name */
495	NULL /* &cchClassName /,/ size of class string */
496	NULL, /* reserved */
497	&cSubKeys, /* number of subkeys */
498	&cbMaxSubKey, /* longest subkey size */
499	&cchMaxClass, /* longest class string */
500	&cValues, /* number of values for this key */
501	&cchMaxValue, /* longest value name */
502	&cbMaxValueData, /* longest value data */
503	&cbSecurityDescriptor, /* security descriptor */
504	&ftLastWriteTime); /* last write time */
505
506	if (retCode != ERROR_SUCCESS)
507	{
508	return -1;
509	}
510
511	++nKeys;
512
513	fTime = convertTime (&ftLastWriteTime);
514
515	/* Enumerate the subkeys, until RegEnumKeyEx fails. */
516
517	if (cSubKeys)
518	{
519	/*
520	* printf( "\nNumber of subkeys: %lu\n", (unsigned long) cSubKeys);
521	*/
522
523	for (i=0; i<cSubKeys; i++)
524	{
525	cbName = MAX_KEY_LENGTH/2;
526	retCode = RegEnumKeyEx(hKey, i,
527	achKey,
528	&cbName,
529	NULL,
530	NULL,
531	NULL,
532	&ftLastWriteTime);
533
534	if (retCode == ERROR_SUCCESS && S_TRUE != isSingle)
535	{
536	/*
537	* _tprintf(TEXT("(%lu) %s\\%s\n"), (unsigned long) i+1,
538	* path, achKey);
539	*/
540	CheckThisSubkey (hKey, achKey, path, isSingle, 0);
541	}
542	}
543	}
544
545	/* Enumerate the key values. */
546
547	if (cValues)
548	{
549	char hashtmp[3][KEYBUF_SIZE];
550
551	memset(hashbuf, '0', sizeof(hashbuf));
552
553	/* Loop over values and build checksum */
554
555	for (i=0, retCode=ERROR_SUCCESS; i<cValues; i++)
556	{
557	LPBYTE lpDataAlloc = NULL;
558
559	cchValue = MAX_VALUE_NAME/2;
560	achValue[0] = '\0';
561	lpcbData = sizeof(lpData);
562	retCode = RegEnumValue(hKey, i,
563	achValue,
564	&cchValue,
565	NULL,
566	&lpType,
567	lpData,
568	&lpcbData);
569
570	if (retCode == ERROR_MORE_DATA)
571	{
572	lpDataAlloc = SH_ALLOC(lpcbData);
573
574	retCode = RegEnumValue(hKey, i,
575	achValue,
576	&cchValue,
577	NULL,
578	&lpType,
579	lpDataAlloc,
580	&lpcbData);
581	}
582
583	if (retCode == ERROR_SUCCESS)
584	{
585	totalSize += lpcbData;
586
587	/* checksum(valuename) */
588	sh_tiger_hash (achValue, TIGER_DATA, cchValue,
589	hashtmp[0], KEYBUF_SIZE);
590
591	/* checksum(valuedata) */
592	if (NULL == lpDataAlloc)
593	{
594	sh_tiger_hash ((char*) lpData, TIGER_DATA, lpcbData,
595	hashtmp[1], KEYBUF_SIZE);
596	}
597	else
598	{
599	sh_tiger_hash ((char*) lpDataAlloc, TIGER_DATA, lpcbData,
600	hashtmp[1], KEYBUF_SIZE);
601	}
602
603	/* old_checksum */
604	memcpy(hashtmp[2], hashbuf, KEYBUF_SIZE);
605
606	/* hash(hash(valuename)+hash(valuedata)+old_hash) */
607	sh_tiger_hash ((char*) hashtmp, TIGER_DATA,
608	sizeof(hashtmp), hashbuf, sizeof(hashbuf));
609
610	++nVals;
611	}
612
613	if (lpDataAlloc)
614	{
615	SH_FREE(lpDataAlloc);
616	}
617	}
618	}
619	else
620	{
621	/* no values */
622	sl_strlcpy(hashbuf, SH_KEY_NULL, sizeof(hashbuf));
623	}
624
625	/* Here we have:
626	* hashbuf [checksum over values],
627	* fTime [last write time],
628	* totalSize [size of all value data],
629	* cSubKeys [number of subkeys],
630	* cValues [number of values],
631	* path, pathlen [which may be up to 131072 (256*512) bytes]
632	*/
633
634	if (pathlen > (PATH_MAX-1))
635	{
636	char hashbuf2[KEYBUF_SIZE];
637	char * p = strchr(path, '\\');
638
639	if (p)
640	{
641	char *q = p;
642
643	++p;
644
645	tPath = SH_ALLOC(256 + KEYBUF_SIZE);
646	*q = '\0';
647	sl_strlcpy(tPath, path, 256); /* truncates */
648	*q = '\\';
649	sl_strlcat(tPath, "\\", 257);
650	(void) sh_tiger_hash(p, TIGER_DATA, sl_strlen(p),
651	hashbuf2, sizeof(hashbuf2));
652	sl_strlcat(tPath, hashbuf2, 256 + KEYBUF_SIZE);
653	}
654	}
655
656	if (sh.flag.checkSum == SH_CHECK_CHECK \|\| sh.flag.update == S_TRUE)
657	{
658	struct store2db save;
659
660	memset(&save, '\0', sizeof(struct store2db));
661
662	if (tPath)
663	{
664	sh_hash_db2pop (tPath, &save);
665	}
666	else
667	{
668	sh_hash_db2pop (path, &save);
669	}
670
671	if (save.size == -1)
672	{
673	/* Not in database */
674
675	char * infobuf = SH_ALLOC(1024);
676	char * errbuf = SH_ALLOC(1024);
677	char * tmp = sh_util_safe_name ((tPath == NULL) ? path : tPath);
678	char timestr[32];
679
680	(void) sh_unix_gmttime (fTime, timestr, sizeof(timestr));
681
682	sl_snprintf(infobuf, 1024,
683	_("mtime=%s size=%lu subkeys=%lu values=%lu"),
684	timestr,
685	(unsigned long) totalSize,
686	(unsigned long) cSubKeys,
687	(unsigned long) cValues);
688
689	(void) format_changes (SH_REGFORM_NEW, errbuf, 1024,
690	0, 0, 0, 0, NULL,
691	fTime, totalSize, cSubKeys, cValues, hashbuf);
692
693	SH_MUTEX_LOCK(mutex_thread_nolog);
694	sh_error_handle(sh_reg_check_severity, FIL__, __LINE__,
695	0, MSG_REG_NEW,
696	infobuf, tmp, errbuf);
697	SH_MUTEX_UNLOCK(mutex_thread_nolog);
698
699	SH_FREE(tmp);
700	SH_FREE(errbuf);
701	SH_FREE(infobuf);
702
703	doUpdate = S_TRUE;
704	}
705	else if (save.val0 != totalSize \|\|
706	((time_t) save.val1) != fTime \|\|
707	save.val2 != cSubKeys \|\|
708	save.val3 != cValues \|\|
709	0 != strcmp(save.checksum, hashbuf))
710	{
711	/* Change detected */
712	char * infobuf = SH_ALLOC(1024);
713	char * errbuf = SH_ALLOC(1024);
714	char * tmp = sh_util_safe_name ((tPath == NULL) ? path : tPath);
715	char timestr_new[32];
716
717	(void) sh_unix_gmttime (fTime, timestr_new, sizeof(timestr_new));
718
719	sl_snprintf(infobuf, 1024,
720	_("mtime=%s size %lu->%lu subkeys %lu->%lu values %lu->%lu checksum %s"),
721	timestr_new,
722	(unsigned long) save.val0, (unsigned long) totalSize,
723	(unsigned long) save.val2, (unsigned long) cSubKeys,
724	(unsigned long) save.val3, (unsigned long) cValues,
725	(0 == strcmp(save.checksum, hashbuf)) ? _("good") : _("bad"));
726
727	(void) format_changes (SH_REGFORM_OLD\|SH_REGFORM_NEW, errbuf, 1024,
728	save.val1, save.val0,
729	save.val2, save.val3, save.checksum,
730	fTime, totalSize,
731	cSubKeys, cValues, hashbuf);
732
733	SH_MUTEX_LOCK(mutex_thread_nolog);
734	sh_error_handle(sh_reg_check_severity, FIL__, __LINE__,
735	0, MSG_REG_CHANGE,
736	infobuf, tmp, errbuf);
737	SH_MUTEX_UNLOCK(mutex_thread_nolog);
738
739	SH_FREE(tmp);
740	SH_FREE(errbuf);
741	SH_FREE(infobuf);
742
743	doUpdate = S_TRUE;
744	}
745	}
746
747	if ( sh.flag.checkSum == SH_CHECK_INIT \|\| doUpdate == S_TRUE )
748	{
749	struct store2db save;
750
751	memset(&save, '\0', sizeof(struct store2db));
752
753	save.val0 = totalSize;
754	save.val1 = fTime;
755	save.val2 = cSubKeys;
756	save.val3 = cValues;
757	sl_strlcpy(save.checksum, hashbuf, KEY_LEN+1);
758
759	if (tPath)
760	{
761	sh_hash_push2db (tPath, &save);
762	}
763	else
764	{
765	sh_hash_push2db (path, &save);
766	}
767	}
768
769	if (tPath)
770	sh_hash_set_visited (tPath);
771	else
772	sh_hash_set_visited (path);
773
774	if (tPath)
775	{
776	SH_FREE(tPath);
777	}
778
779	return 0;
780	}
781
782	static int check_for_stop (char * name)
783	{
784	struct regkeylist *this = keylist;
785
786	while (this)
787	{
788	if (STOP_FALSE != this->stop)
789	{
790	#ifdef HAVE_REGEX_H
791	if (0 == regexec(&(this->preg), name, 0, NULL, 0))
792	return this->stop;
793	#else
794	if (0 == strcmp(this->name, name))
795	return this->stop;
796	#endif
797	}
798	this = this->next;
799	}
800	return STOP_FALSE;
801	}
802
803
804	int CheckThisSubkey (HKEY key, char * subkey, char * path, int isSingle,
805	int view)
806	{
807	HKEY hTestKey;
808	char * newpath;
809	size_t len;
810	int retval = -1;
811
812	len = strlen(path) + 1 + strlen(subkey) + 1;
813	newpath = SH_ALLOC(len);
814	snprintf(newpath, len, "%s\\%s", path, subkey);
815
816	/* Check for stop condition, if not single key.
817	* Set flag to isSingle = S_TRUE if we should stop here.
818	*/
819	if (S_TRUE != isSingle)
820	{
821	int isStop = check_for_stop(newpath);
822
823	if (STOP_CHECK == isStop)
824	{
825	isSingle = S_TRUE;
826	}
827	else if (STOP_IGN == isStop)
828	{
829	SH_FREE(newpath);
830	return 0;
831	}
832	}
833
834	len = strlen(path) + 1 + strlen(subkey) + 1;
835	newpath = SH_ALLOC(len);
836	snprintf(newpath, len, "%s\\%s", path, subkey);
837
838	if( RegOpenKeyEx( key,
839	subkey,
840	0,
841	(KEY_READ \| view),
842	&hTestKey) == ERROR_SUCCESS
843	)
844	{
845	QueryKey(hTestKey, newpath, len-1, isSingle);
846	RegCloseKey(hTestKey);
847	retval = 0;
848	}
849	else
850	{
851	/* Error message */
852	char * tmp = sh_util_safe_name (newpath);
853	size_t tlen = sl_strlen(tmp);
854
855	if (SL_TRUE == sl_ok_adds(64, tlen))
856	{
857	char * errbuf = SH_ALLOC(64 + tlen);
858	sl_snprintf(errbuf, 64+tlen, _("Failed to open key %s"), tmp);
859
860	SH_MUTEX_LOCK(mutex_thread_nolog);
861	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
862	errbuf, _("CheckThisSubkey"));
863	SH_MUTEX_UNLOCK(mutex_thread_nolog);
864
865	SH_FREE(errbuf);
866	}
867	sh_reg_add_ign (tmp);
868	SH_FREE(tmp);
869	}
870
871	SH_FREE(newpath);
872	return retval;
873	}
874
875
876	int check_key (char * key, int isSingle)
877	{
878	HKEY topKey;
879	char * subkey;
880	char path[20] = "";
881	int pos = 0;
882	int retval = -1;
883
884	if (0 == strncmp(key, _("HKEY_CLASSES_ROOT"), 17))
885	{
886	topKey = HKEY_CLASSES_ROOT;
887	pos = 17;
888	strncpy(path, _("HKEY_CLASSES_ROOT"), sizeof(path));
889	}
890	else if (0 == strncmp(key, _("HKEY_CURRENT_USER"), 17))
891	{
892	topKey = HKEY_CURRENT_USER;
893	pos = 17;
894	strncpy(path, _("HKEY_CURRENT_USER"), sizeof(path));
895	}
896	else if (0 == strncmp(key, _("HKEY_LOCAL_MACHINE"), 18))
897	{
898	topKey = HKEY_LOCAL_MACHINE;
899	pos = 18;
900	strncpy(path, _("HKEY_LOCAL_MACHINE"), sizeof(path));
901	}
902	else if (0 == strncmp(key, _("HKEY_USERS"), 10))
903	{
904	topKey = HKEY_USERS;
905	pos = 10;
906	strncpy(path, _("HKEY_USERS"), sizeof(path));
907	}
908
909
910	if (pos > 0)
911	{
912	if (key[pos] == '\\')
913	{
914	++pos;
915	subkey = &key[pos];
916	}
917	}
918	else
919	{
920
921	char * tmp = sh_util_safe_name_keepspace(key);
922	size_t tlen = sl_strlen(tmp);
923
924	if (SL_TRUE == sl_ok_adds(64, tlen))
925	{
926	char * errbuf = SH_ALLOC(64 + tlen);
927
928	sl_snprintf(errbuf, 64+tlen, _("Invalid key %s"), tmp);
929
930	SH_MUTEX_LOCK(mutex_thread_nolog);
931	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
932	errbuf, _("check_key"));
933	SH_MUTEX_UNLOCK(mutex_thread_nolog);
934
935	SH_FREE(errbuf);
936	}
937	SH_FREE(tmp);
938	return -1;
939	}
940
941	/************************
942	if (ShCheckBothViews)
943	{
944	CheckThisSubkey (topKey, subkey, path, isSingle, KEY_WOW64_32KEY);
945	return CheckThisSubkey (topKey, subkey, path, isSingle, KEY_WOW64_64KEY);
946	}
947	*************************/
948
949	return CheckThisSubkey (topKey, subkey, path, isSingle, 0);
950	}
951
952	/* #if defined (SH_WITH_CLIENT) \|\| defined (SH_STANDALONE) */
953	#endif
954
955	/* #ifdef USE_REGISTRY_CHECK */
956	#endif
957

Note: See TracBrowser for help on using the repository browser.

Download in other formats: