Changeset 169

Timestamp:

Apr 13, 2008, 9:59:55 PM (19 years ago)

Author:

katerina

Message:

Fixes for tickes #93 to #104 (yes, big commit, bad, bad,...).

Location:

trunk

Files:

• Makefile.in (modified) (1 diff)
• aclocal.m4 (modified) (1 diff)
• configure.ac (modified) (6 diffs)
• depend.dep (modified) (1 diff)
• depend.sum (modified) (1 diff)
• docs/Changelog (modified) (1 diff)
• docs/MANUAL-2_3.html.tar (modified) ( previous)
• docs/MANUAL-2_3.pdf (modified) ( previous)
• docs/TODO (modified) (1 diff)
• include/sh_cat.h (modified) (1 diff)
• include/sh_extern.h (modified) (1 diff)
• include/sh_hash.h (modified) (1 diff)
• include/sh_string.h (added)
• include/sh_unix.h (modified) (1 diff)
• include/slib.h (modified) (1 diff)
• man/samhain.8 (modified) (1 diff)
• man/samhainrc.5 (modified) (1 diff)
• src/cutest_slib.c (modified) (1 diff)
• src/samhain.c (modified) (1 diff)
• src/sh_calls.c (modified) (1 diff)
• src/sh_cat.c (modified) (2 diffs)
• src/sh_extern.c (modified) (3 diffs)
• src/sh_getopt.c (modified) (3 diffs)
• src/sh_hash.c (modified) (10 diffs)
• src/sh_mounts.c (modified) (6 diffs)
• src/sh_portcheck.c (modified) (12 diffs)
• src/sh_prelude.c (modified) (4 diffs)
• src/sh_processcheck.c (modified) (5 diffs)
• src/sh_readconf.c (modified) (1 diff)
• src/sh_string.c (added)
• src/sh_tools.c (modified) (2 diffs)
• src/sh_unix.c (modified) (13 diffs)
• src/slib.c (modified) (20 diffs)
• test/testrun_1.sh (modified) (13 diffs)
• test/testrun_1b.sh (modified) (3 diffs)
• test/testrun_1d.sh (modified) (1 diff)

trunk/Makefile.in

@@ -1698 +1698 @@
 sh_portcheck.o: $(srcsrc)/sh_portcheck.c Makefile config_xor.h $(srcinc)/samhain.h $(srcinc)/sh_error.h $(srcinc)/sh_mem.h $(srcinc)/sh_calls.h $(srcinc)/sh_utils.h $(srcinc)/sh_modules.h $(srcinc)/sh_static.h $(srcinc)/sh_pthread.h $(srcinc)/CuTest.h 
 sh_pthread.o: $(srcsrc)/sh_pthread.c Makefile config_xor.h $(srcinc)/sh_pthread.h $(srcinc)/sh_calls.h $(srcinc)/sh_modules.h 
-sh_string.o: $(srcsrc)/sh_string.c Makefile $(srcinc)/sh_string.h $(srcinc)/sh_mem.h $(srcinc)/CuTest.h 
+sh_string.o: $(srcsrc)/sh_string.c Makefile config_xor.h $(srcinc)/sh_string.h $(srcinc)/sh_mem.h $(srcinc)/CuTest.h 

trunk/aclocal.m4

@@ -1914 +1914 @@
         CPPFLAGS="$ZLIB_OLD_CPPFLAGS"
         AC_MSG_RESULT(failed)
-        AC_MSG_ERROR([zlib not found in ZLIB_HOME, /usr/local, or /usr])
+        AC_MSG_WARN([zlib not found in ZLIB_HOME, /usr/local, or /usr])
 fi
 

trunk/configure.ac

@@ -13 +13 @@
 dnl start
 dnl
-AM_INIT_AUTOMAKE(samhain, 2.4.3) 
+AM_INIT_AUTOMAKE(samhain, 2.4.4) 
 AC_CANONICAL_HOST
 
@@ -100 +100 @@
         
         *openbsd*)
+        AC_DEFINE([HOST_IS_OPENBSD], 1, [Define if host OS is OPENBSD])
         selectconfig=freebsd
         AC_MSG_RESULT(none)
@@ -589 +590 @@
 $PS ax >/dev/null 2>&1
 if test $? -eq 0; then
+   case "$host_os" in
+   *openbsd*)
+   one=`$PS akx | wc -l`
+   ;;
+   *)
    one=`$PS ax | wc -l`
+   ;;
+   esac
 else
    one=0
@@ -601 +609 @@
 if test $one -ge $two 
 then
-    PSARG="ax"
+   case "$host_os" in
+   *openbsd*)
+        PSARG="akx"
+        ;;
+   *)
+        PSARG="ax"
+        ;;
+   esac
 else
-    PSARG="-e"
+        PSARG="-e"
 fi
 AC_DEFINE_UNQUOTED([PSARG], _("$PSARG"), [Argument for ps])
@@ -2146 +2161 @@
         [
         if test "x${cross_compiling}" = xyes; then
-                :
+                my_tmp_dir="$withval"
+                AC_DEFINE_UNQUOTED(SH_TMPDIR, _("${my_tmp_dir}") )
         else
                 if test -d "${withval}"; then
@@ -2152 +2168 @@
                         AC_DEFINE_UNQUOTED(SH_TMPDIR, _("${my_tmp_dir}") )
                 else
-                        AC_MSG_ERROR([--with-tmp-dir: tmp directory ${withval} does not exist])
+                        my_tmp_dir="$withval"
+                        AC_DEFINE_UNQUOTED(SH_TMPDIR, _("${my_tmp_dir}") )
+                        AC_MSG_WARN([--with-tmp-dir: tmp directory ${withval} does not exist])
                 fi
         fi

trunk/depend.dep

@@ -63 +63 @@
 sh_pthread.o: $(srcsrc)/sh_pthread.c Makefile config_xor.h $(srcinc)/sh_pthread.h $(srcinc)/sh_calls.h $(srcinc)/sh_modules.h 
 kern_head.o: $(srcsrc)/kern_head.c Makefile config.h $(srcinc)/kern_head.h $(srcinc)/kern_head.h 
-sh_string.o: $(srcsrc)/sh_string.c Makefile $(srcinc)/sh_string.h $(srcinc)/sh_mem.h $(srcinc)/CuTest.h 
+sh_string.o: $(srcsrc)/sh_string.c Makefile config_xor.h $(srcinc)/sh_string.h $(srcinc)/sh_mem.h $(srcinc)/CuTest.h 

trunk/depend.sum

@@ -1 @@
-2783424603
+3805394239

trunk/docs/Changelog

@@ -1 +1 @@
 2.4.4:
-        * fill content if MODI_TXT, base64 encode and add as link_path 
-          in sh_unix.c; add to report in sh_hash.c; needs listing option
+        * configure.ac: warn, but accept nonexistent tmp dir
+          (Problem reported by Brian)
+        * sh_unix.c: undef P_ALL, P_PID, P_PGID before including 
+          sys/wait.h (compile problem reported by Reputation)
+        * syslog function tested ok with Syslog Fuzzer v0.1 
+          by Jaime Blasco (c) 2008
+        * slib.c: call fflush when writing trace to file
+        * sh_readconf.c: don't set OnlyStderr to false if gpg (problem
+          reported by Irene Reed)
+        * fix unconditional removal of pid file in atexit handler (bug
+          reported by Brian)
+        * fix invalid free() in sh_unix_checksum_size()
+        * sh_processcheck.c: workaround for stupid OpenBSD bug (returns
+          ENODEV instead of EAGAIN, because fgetc does 
+          fcntl(0,F_SETFL,O_NONBLOCK) [ENODEV] internally), problem
+          reported by Roman R.
+        * fix buf that cause incomplete reporting of modified symlink if
+          symlink has changed and both old and new paths are >48 bytes
+        * fix bug that prevented mount check from running in one-shot mode
+        * enable mount check for openbsd
+        * fix processcheck default options and test script for openbsd
+        * option --list-file to list content of file (if saved)
+        * sh_tools.c: use strcasecmp in reverse lookup since DNS is case
+          insensitive (bug reported by Phil)
+        * fill content if MODI_TXT, zlib compress, base64 encode and add 
+          as link_path in sh_unix.c; add to report in sh_hash.c
         * testsuite: add test for gpg fingerprint option
         * sh_extern.c: add 'CloseCommand' for syntactic sugar, 
           add in testsuite
 
-2.4.3a:
-        * fix compile error cause by open() with O_CREAT and no third argument
+2.4.3a (12-02-2008):
+        * fix compile error caused by open() with O_CREAT and no third argument
           (reported by J.-S. Eon)
 
-2.4.3:
+2.4.3 (31-01-2008):
         * sh_kern.c: don't require asm/segment.h for kernel check module
         * use global var with pid of initial thread instead of getpid(),

trunk/docs/TODO

@@ -1 +1 @@
 
 
-check thread_safe sh_entropy
-check thread_safe rng
-
-
+check reported problem with rpmbuild (samhain_setpwd)

trunk/include/sh_cat.h

@@ -142 +142 @@
 
 #ifdef SH_USE_PORTCHECK
- MSG_PORT_REPORT,
+ MSG_PORT_MISS,
+ MSG_PORT_NEW,
+ MSG_PORT_RESTART,
+ MSG_PORT_NEWPORT,
 #endif
 

trunk/include/sh_extern.h

@@ -10 +10 @@
   char   *  envv[32];
   char      checksum[KEY_LEN + 1];
-
+#if 0
   uid_t     trusted_users[32];
+#endif
   uid_t     run_user_uid;
   gid_t     run_user_gid;

trunk/include/sh_hash.h

@@ -47 +47 @@
  */
 int sh_hash_list_db (const char * db_file);
+
+/* List database content for a single file
+ */
+int set_list_file (const char * c);
 
 /* List database content with full detail

trunk/include/sh_unix.h

@@ -91 +91 @@
 #define MODI_PREL (1 << 13)
 /* get content     */
-#define MODI_TXT (1 << 14)
+#define MODI_TXT ((1 << 14)|MODI_CHK)
 
 #define SH_TXT_MAX 9200

trunk/include/slib.h

@@ -213 +213 @@
 
   /*
+   * robust strcasecmp replacement
+   */
+  int sl_strcasecmp(const char * one, const char * two);
+
+  /*
    * robust strlen replacement
    */

trunk/man/samhain.8

@@ -262 +262 @@
 [\-a | \-\-full\-detail]
 List all informations for each file, not only those you would get
-with ls \-l.
+with ls \-l. Must precede the \-d option.
 .TP
 [\-\-delimited]
 List all informations for each file, in a comma-separated format.
+Must precede the \-d option.
+.TP
+.RI [\-\-list\-file= file ]
+List the literal content of the given file as stored in the database.
+Content is not stored by default, must be enabled in the runtime
+configuration file. Must precede the \-d option.
 
 .SS "OPTIONS TO VERIFY AN AUDIT TRAIL"

trunk/man/samhainrc.5

@@ -648 +648 @@
 .BI RedefReadOnly= +/-XXX,+/-YYY,...
 Add or subtract tests XXX from the ReadOnly policy.
-Tests are: CHK (checksum), LNK (link), 
+Tests are: CHK (checksum), TXT (store literal content), LNK (link), 
 HLN (hardlink), INO (inode), USR (user), GRP (group), MTM (mtime),
 ATM (atime), CTM (ctime), SIZ (size), RDEV (device numbers) 

trunk/src/cutest_slib.c

@@ -24 +24 @@
 }
 
+void Test_sl_strcasecmp (CuTest *tc) {
+  char one[64], two[64];
+  int  res;
 
+  strcpy(one, "foo");
+  strcpy(two, "foo");
+  res = sl_strcasecmp(one, two);
+  CuAssertIntEquals(tc, 0, res);
+
+  strcpy(one, "fo");
+  strcpy(two, "foo");
+  res = sl_strcasecmp(one, two);
+  CuAssertIntEquals(tc, -1, res);
+
+  strcpy(one, "foo");
+  strcpy(two, "fo");
+  res = sl_strcasecmp(one, two);
+  CuAssertIntEquals(tc, 1, res);
+
+  strcpy(one, "1234");
+  strcpy(two, "2345");
+  res = sl_strcasecmp(one, two);
+  CuAssertIntEquals(tc, -1, res);
+
+  strcpy(one, "234");
+  strcpy(two, "123");
+  res = sl_strcasecmp(one, two);
+  CuAssertIntEquals(tc, 1, res);
+
+  strcpy(one, "");
+  strcpy(two, "123");
+  res = sl_strcasecmp(one, two);
+  CuAssertIntEquals(tc, -1, res);
+
+  strcpy(one, "234");
+  strcpy(two, "");
+  res = sl_strcasecmp(one, two);
+  CuAssertIntEquals(tc, 1, res);
+
+  strcpy(one, "");
+  strcpy(two, "");
+  res = sl_strcasecmp(one, two);
+  CuAssertTrue(tc, res == 0);
+
+#ifndef SL_FAIL_ON_ERROR
+  res = sl_strcasecmp(NULL, two);
+  CuAssertIntEquals(tc, -1, res);
+
+  res = sl_strcasecmp(one, NULL);
+  CuAssertIntEquals(tc, 1, res);
+
+  res = sl_strcasecmp(NULL, NULL);
+  CuAssertTrue(tc, res != 0);
+#endif
+}

trunk/src/samhain.c

@@ -775 +775 @@
    */
   (void) sh_unix_rm_lock_file (sh.srvlog.name);
-  (void) sh_unix_rm_pid_file ();
+  if (sh.flag.isdaemon == S_TRUE)
+    (void) sh_unix_rm_pid_file ();
   if (skey != NULL)
     memset (skey, (int) '\0', sizeof(sh_key_t));

trunk/src/sh_calls.c

@@ -341 +341 @@
 #endif
 
-  SL_ENTER(_("retry_fcntl"));
+  SL_ENTER(_("retry_msleep"));
 
   errno  = 0;

trunk/src/sh_cat.c

@@ -134 +134 @@
 
 #ifdef SH_USE_PORTCHECK
-  { MSG_PORT_REPORT, SH_ERR_SEVERE,  EVENT, N_("msg=\"%s\"")},
+  { MSG_PORT_MISS,   SH_ERR_SEVERE,  EVENT, N_("msg=\"POLICY [ServiceMissing] %s\"")},
+  { MSG_PORT_NEW,    SH_ERR_SEVERE,  EVENT, N_("msg=\"POLICY [ServiceNew] %s\"")},
+  { MSG_PORT_RESTART,SH_ERR_SEVERE,  EVENT, N_("msg=\"POLICY [ServiceRestarted] %s\"")},
+  { MSG_PORT_NEWPORT,SH_ERR_SEVERE,  EVENT, N_("msg=\"POLICY [ServicePortSwitch] %s\"")},
 #endif
 
@@ -449 +452 @@
 
 #ifdef SH_USE_PORTCHECK
-  { MSG_PORT_REPORT, SH_ERR_SEVERE,  EVENT, N_("msg=<%s>")},
+  { MSG_PORT_MISS,   SH_ERR_SEVERE,  EVENT, N_("msg=<POLICY [ServiceMissing] %s>")},
+  { MSG_PORT_NEW,    SH_ERR_SEVERE,  EVENT, N_("msg=<POLICY [ServiceNew] %s>")},
+  { MSG_PORT_RESTART,SH_ERR_SEVERE,  EVENT, N_("msg=<POLICY [ServiceRestarted] %s>")},
+  { MSG_PORT_NEWPORT,SH_ERR_SEVERE,  EVENT, N_("msg=<POLICY [ServicePortSwitch] %s>")},
 #endif
 

trunk/src/sh_extern.c

@@ -143 +143 @@
    * --  check whether path is trustworthy
    */
+  status = sl_trustfile(task->command, NULL, NULL);
+#if 0
   if ((uid_t) -1 != task->trusted_users[0])
     {
       status = sl_trustfile(task->command, task->trusted_users, NULL);
     }
+#endif
 
   PDBG_OPEN;
@@ -647 +650 @@
       tas->argv[i]          = NULL;
       tas->envv[i]          = NULL;
+#if 0
       tas->trusted_users[i] = (uid_t) -1;
+#endif
     }
 
@@ -826 +831 @@
 
   (void) sl_get_euid(&ff_euid);
+#if 0
   ext_com->tas.trusted_users[0] = (uid_t) 0;
   ext_com->tas.trusted_users[1] = (uid_t) (ff_euid);
+#endif
 
   /* ------------------------------------------------- */

trunk/src/sh_getopt.c

@@ -225 +225 @@
     HAS_ARG_NO, 
     sh_getopt_forever},
+  { N_("list-file"),  
+    '-', 
+    N_("Modify -d to list content of a single file"),  
+    HAS_ARG_YES, 
+    set_list_file},
   { N_("full-detail"),  
     'a', 
@@ -417 +422 @@
 #if defined(SL_DEBUG)
   if (num > 0) fputc ('\n', stdout);
-  fputs (_(" debug build"), stdout); ++num;
+  fputs (_(" debug build (don't use for production)"), stdout); ++num;
 #endif
 #if defined(SCREW_IT_UP)
@@ -433 +438 @@
 
 #if defined(SH_WITH_CLIENT) || defined(SH_STANDALONE)
+#if defined(HAVE_LIBZ)
+  if (num > 0) fputc ('\n', stdout);
+  fputs (_(" optionally store full text for files"), stdout); ++num;
+#endif
 #if defined(USE_XATTR)
   if (num > 0) fputc ('\n', stdout);

trunk/src/sh_hash.c

@@ -2497 +2497 @@
   sl_strlcat(msg, tmp, SH_BUFSIZE); 
 
-  if (theFile->c_mode[0] == 'l' || theFile->link_path != NULL)
+  if (theFile->c_mode[0] == 'l' || 
+      (theFile->link_path != NULL && theFile->link_path[0] != '-'))
     {
       tmp_lnk     = sh_util_safe_name(theFile->link_path);
@@ -2663 +2664 @@
   sl_strlcat(msg, tmp, SH_BUFSIZE); 
 
-  if (theFile->c_mode[0] == 'l' || theFile->link_path != NULL)
+  if (theFile->c_mode[0] == 'l' || 
+      (theFile->link_path != NULL && theFile->link_path[0] != '-'))
     {
       tmp_lnk     = sh_util_safe_name(theFile->link_path);
@@ -2739 +2741 @@
   char timstr2m[32];
   char linkHash[KEY_LEN+1];
+  char * linkComp;
   int  maxcomp;
 
@@ -2869 +2872 @@
   if (p->theFile.c_mode[0] == 'l') 
     {
-      if (sl_strlen(theFile->link_path) >= MAX_PATH_STORE) 
-        {
-          sl_strlcpy(linkHash, 
-                     sh_tiger_hash(theFile->link_path, 
-                                   TIGER_DATA,
-                                   sl_strlen(theFile->link_path),
-                                   hashbuf, sizeof(hashbuf)), 
-                     MAX_PATH_STORE+1);
-          maxcomp = MAX_PATH_STORE;
-        } 
-      else 
-        {
-          sl_strlcpy(linkHash, theFile->link_path, KEY_LEN + 1);
-          maxcomp = KEY_LEN;
-        }
-      
-
-      if ( sl_strncmp (linkHash, p->linkpath, maxcomp) != 0 &&
-           (theFile->check_mask & MODI_LNK) != 0)
-        {
+      if (!(theFile->link_path) &&
+          (theFile->check_mask & MODI_LNK) != 0)
+        {
+          linkComp = NULL;
           modi_mask |= MODI_LNK;
           change_code[1] = 'L';
           TPT ((0, FIL__, __LINE__, _("mod=<link>")));
-        } 
+        }
+      else
+        {
+          if (sl_strlen(theFile->link_path) >= MAX_PATH_STORE) 
+            {
+              sl_strlcpy(linkHash, 
+                         sh_tiger_hash(theFile->link_path, 
+                                       TIGER_DATA,
+                                       sl_strlen(theFile->link_path),
+                                       hashbuf, sizeof(hashbuf)), 
+                         MAX_PATH_STORE+1);
+              linkComp = linkHash;
+              maxcomp  = KEY_LEN;
+            } 
+          else 
+            {
+              linkComp = theFile->link_path;
+              maxcomp  = MAX_PATH_STORE;
+            }
+          
+          if ( sl_strncmp (linkComp, p->linkpath, maxcomp) != 0 &&
+               (theFile->check_mask & MODI_LNK) != 0)
+            {
+              modi_mask |= MODI_LNK;
+              change_code[1] = 'L';
+              TPT ((0, FIL__, __LINE__, _("mod=<link>")));
+            } 
+        }
     }
 
@@ -3349 +3363 @@
             }
 #endif
-        }
-
-
-      if ((modi_mask & MODI_LNK) != 0 && theFile->c_mode[0] == 'l')
-        {
-          tmp_lnk     = sh_util_safe_name(theFile->link_path);
-          tmp_lnk_old = sh_util_safe_name(p->linkpath);
+          /* FIXME is this correct? */
+          if (theFile->c_mode[0] != 'l' && theFile->link_path &&
+              strlen(theFile->link_path) > 2)
+            modi_mask |= MODI_LNK;
+        }
+
+
+      if ((modi_mask & MODI_LNK) != 0 /* && theFile->c_mode[0] == 'l' */)
+        {
+          if (theFile->link_path)
+            tmp_lnk     = sh_util_safe_name(theFile->link_path);
+          else
+            tmp_lnk     = sh_util_strdup("-");
+          if (p->linkpath)
+            tmp_lnk_old = sh_util_safe_name(p->linkpath);
+          else
+            tmp_lnk_old = sh_util_strdup("-");
 #ifdef SH_USE_XML
           sl_snprintf(tmp, SH_BUFSIZE, _("link_old=\"%s\" link_new=\"%s\" "),
@@ -3599 +3623 @@
 #endif
 
-static int ListFullDetail = S_FALSE;
+static int ListFullDetail    = S_FALSE;
 static int ListWithDelimiter = S_FALSE;
+static char * ListFile       = NULL;
+
+int set_list_file (const char * c)
+{
+  ListFile = sh_util_strdup(c);
+  return 0;
+}
 
 int set_full_detail (const char * c)
@@ -3858 +3889 @@
 }
 
+#ifdef HAVE_LIBZ
+#include <zlib.h>
+#endif    
+
+int sh_hash_printcontent(char * linkpath)
+{
+#ifdef HAVE_LIBZ
+  unsigned char * decoded;
+  unsigned char * decompressed = NULL;
+  size_t dlen;
+  unsigned long clen;
+  unsigned long clen_o;
+  int    res;
+
+  if (linkpath && *linkpath != '-')
+    {
+      dlen = sh_util_base64_dec_alloc (&decoded, 
+                                       (unsigned char *)linkpath, 
+                                       strlen(linkpath));
+      clen = dlen * 2 + 1;
+      do {
+        if (decompressed)
+          SH_FREE(decompressed);
+        clen += dlen; clen_o = clen;
+        decompressed = SH_ALLOC(clen);
+        res = uncompress(decompressed, &clen, decoded, dlen);
+        if (res == Z_MEM_ERROR)
+          { fprintf(stderr, _("Error: Not enough memory\n")); return -1; }
+        if (res == Z_DATA_ERROR)
+          { fprintf(stderr, _("Error: Data corrupt or incomplete\n")); return -1; }
+      } while (res == Z_BUF_ERROR || clen == clen_o);
+      decompressed[clen] = '\0';
+      fputs( (char*) decompressed, stdout);
+      return 0;
+    }
+#else
+  (void) linkpath;
+#endif
+  fprintf(stderr, _("Error: No data available\n")); 
+  return -1;
+}
+
 int sh_hash_list_db (const char * db_file)
 {
@@ -3863 +3936 @@
   SL_TICKET fd;
   char * line;
+  int  flag = 0;
 
   if (!db_file)
@@ -3900 +3974 @@
     {
       p = sh_hash_getdataent (fd, line, MAX_PATH_STORE);
-      if ((p != NULL) && (p->fullpath[0] != 'K'))
-        {
-          if (ListFullDetail == S_FALSE)
-            sh_hash_list_db_entry (p); 
+      if ((p != NULL) && (p->fullpath[0] == '/'))
+        {
+          if (!ListFile)
+            {
+              flag = 1;
+              if (ListFullDetail == S_FALSE)
+                sh_hash_list_db_entry (p); 
+              else
+                sh_hash_list_db_entry_full_detail (p);
+            }
           else
-            sh_hash_list_db_entry_full_detail (p); 
+            {
+              if (0 != sl_strcmp(ListFile, p->fullpath))
+                {
+                  continue;
+                }
+              flag = 1;
+              if ('l' != p->theFile.c_mode[0])
+                {
+                  if (sh_hash_printcontent(p->linkpath) < 0)
+                    {
+                      _exit(EXIT_FAILURE);
+                      return -1;
+                    }
+                }
+              else
+                {
+                  fprintf(stderr, _("File is a link\n"));
+                  _exit(EXIT_FAILURE);
+                  return -1;
+                }
+              break;
+            }
         }
       else if (p == NULL)
@@ -3919 +4020 @@
   fflush(NULL);
 
+  if (flag == 0)
+    {
+      fprintf(stderr, _("No file found\n"));
+      _exit(EXIT_FAILURE);
+    }
   _exit(EXIT_SUCCESS);
   return 0; 

trunk/src/sh_mounts.c

@@ -180 +180 @@
   }
 
-  lastcheck = time(NULL);
-
   SL_RETURN(0, _("sh_mounts_init"));
 }
@@ -197 +195 @@
     SL_RETURN(-1, _("sh_mounts_timer"));
   }
-  
+ 
   SL_RETURN(0, _("sh_mounts_timer"));
 }
@@ -400 +398 @@
 
 /* FreeBSD includes */
-#ifdef HOST_IS_FREEBSD
+#if defined(HOST_IS_FREEBSD) || defined(HOST_IS_OPENBSD) 
 #include <sys/param.h>
 #include <sys/ucred.h>
@@ -577 +575 @@
 #endif
 
-#if defined(HOST_IS_FREEBSD)
+#if defined(HOST_IS_FREEBSD) || defined(HOST_IS_OPENBSD)
 
 /* FreeBSD returns flags instead of strings as mount options, so we'll convert
@@ -595 +593 @@
                 {"local",       MNT_LOCAL},
                 {"quota",       MNT_QUOTA},
+#ifdef MNT_NOATIME
+                {"noatime",     MNT_NOATIME},
+#endif
                 {"bound",       -1}
         };
@@ -665 +666 @@
         list = m;
 
-/* The FreeBSD way */
-#ifdef HOST_IS_FREEBSD
+/* The Open/FreeBSD way */
+#if defined(HOST_IS_FREEBSD) || defined(HOST_IS_OPENBSD)
 {
         struct statfs *fsp;

trunk/src/sh_portcheck.c

@@ -384 +384 @@
           if (ptr->flag != SH_PORT_OPT && ptr->flag != SH_PORT_IGN)
             {
-              snprintf (errbuf, sizeof(errbuf), _("POLICY [ServiceMissing] port %s:%d/%s (%s)"), 
+              snprintf (errbuf, sizeof(errbuf), _("port: %s:%d/%s (%s)"), 
                         ptr->interface, ptr->port, SH_PROTO_STR(proto), 
                         ptr->service ? ptr->service : check_services(ptr->port, proto));
@@ -395 +395 @@
                   SH_MUTEX_LOCK(mutex_thread_nolog);
                   sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0, 
-                                  MSG_PORT_REPORT, errbuf);
+                                  MSG_PORT_MISS, errbuf);
                   SH_MUTEX_UNLOCK(mutex_thread_nolog);
                 }
@@ -497 +497 @@
       if (!portent)
         {
-          snprintf (errbuf, sizeof(errbuf), _("POLICY [ServiceNew] port %s:%d/%s (%s)"), 
+          snprintf (errbuf, sizeof(errbuf), _("port: %s:%d/%s (%s)"), 
                     inet_ntoa(haddr), port, SH_PROTO_STR(proto), service);
 #ifdef TEST_ONLY
@@ -505 +505 @@
           SH_MUTEX_LOCK(mutex_thread_nolog);
           sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0, 
-                          MSG_PORT_REPORT, errbuf);
+                          MSG_PORT_NEW, errbuf);
           SH_MUTEX_UNLOCK(mutex_thread_nolog);
 #endif
@@ -515 +515 @@
       else if (portent->status == SH_PORT_MISS && portent->flag != SH_PORT_IGN)
         {
-          snprintf (errbuf, sizeof(errbuf), _("POLICY [ServiceRestarted] port %s:%d/%s to %d/%s (%s)"), 
-                    inet_ntoa(haddr), portent->port, SH_PROTO_STR(proto), port, SH_PROTO_STR(proto), service);
+          snprintf (errbuf, sizeof(errbuf), _("port: %s:%d/%s (%s), was %d/%s"), 
+                    inet_ntoa(haddr), port, SH_PROTO_STR(proto), service, portent->port, SH_PROTO_STR(proto));
 #ifdef TEST_ONLY
           fprintf(stderr, _("service: %s\n"), errbuf);
@@ -522 +522 @@
           SH_MUTEX_LOCK(mutex_thread_nolog);
           sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0, 
-                          MSG_PORT_REPORT, errbuf);
+                          MSG_PORT_RESTART, errbuf);
           SH_MUTEX_UNLOCK(mutex_thread_nolog);
 #endif
@@ -530 +530 @@
       else if (port != portent->port && (-1) != portent->port)
         {
-          snprintf (errbuf, sizeof(errbuf), _("POLICY [ServicePortSwitch] port %s:%d/%s to %d/%s (%s)"), 
-                    inet_ntoa(haddr), portent->port, SH_PROTO_STR(proto), port, SH_PROTO_STR(proto), service);
+          snprintf (errbuf, sizeof(errbuf), _("port: %s:%d/%s (%s), was %d/%s"), 
+                    inet_ntoa(haddr), port, SH_PROTO_STR(proto), service, portent->port, SH_PROTO_STR(proto));
 #ifdef TEST_ONLY
           fprintf(stderr, _("service: %s\n"), errbuf);
@@ -537 +537 @@
           SH_MUTEX_LOCK(mutex_thread_nolog);
           sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0, 
-                          MSG_PORT_REPORT, errbuf);
+                          MSG_PORT_NEWPORT, errbuf);
           SH_MUTEX_UNLOCK(mutex_thread_nolog);
 #endif
@@ -552 +552 @@
       if (!portent)
         {
-          snprintf (errbuf, sizeof(errbuf), _("POLICY [ServiceNew] port %s:%d/%s (%s)"), 
+          snprintf (errbuf, sizeof(errbuf), _("port: %s:%d/%s (%s)"), 
                     inet_ntoa(haddr), port, SH_PROTO_STR(proto), check_services(port, proto));
 #ifdef TEST_ONLY
@@ -560 +560 @@
           SH_MUTEX_LOCK(mutex_thread_nolog);
           sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0, 
-                          MSG_PORT_REPORT, errbuf);
+                          MSG_PORT_NEW, errbuf);
           SH_MUTEX_UNLOCK(mutex_thread_nolog);
 #endif
@@ -570 +570 @@
       else if (portent->status == SH_PORT_MISS && portent->flag != SH_PORT_IGN)
         {
-          snprintf (errbuf, sizeof(errbuf), _("POLICY [ServiceRestarted] port %s:%d/%s (%s)"), 
+          snprintf (errbuf, sizeof(errbuf), _("port: %s:%d/%s (%s)"), 
                     inet_ntoa(haddr), port, SH_PROTO_STR(proto), check_services(port, proto));
 #ifdef TEST_ONLY
@@ -577 +577 @@
           SH_MUTEX_LOCK(mutex_thread_nolog);
           sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0, 
-                          MSG_PORT_REPORT, errbuf);
+                          MSG_PORT_RESTART, errbuf);
           SH_MUTEX_UNLOCK(mutex_thread_nolog);
 #endif

trunk/src/sh_prelude.c

@@ -85 +85 @@
 #define SH_NEED_PWD_GRP 1
 #include "sh_static.h"
-
+char * sh_util_strdup (const char * str) SH_GNUC_MALLOC;
 /*
  * When SH_USE_XML is set, value are formated using name="value".
@@ -651 +651 @@
 #endif
 
+#ifdef SH_USE_PORTCHECK
+                { MSG_PORT_MISS, N_("Service closed"), IDMEF_IMPACT_TYPE_OTHER },
+                { MSG_PORT_NEW, N_("Service opened"), IDMEF_IMPACT_TYPE_OTHER },
+                { MSG_PORT_RESTART, N_("Service restarted"), IDMEF_IMPACT_TYPE_OTHER },
+                { MSG_PORT_NEWPORT, N_("Service restarted"), IDMEF_IMPACT_TYPE_OTHER },
+#endif
+
 #ifdef SH_USE_SUIDCHK
                 { MSG_SUID_POLICY, N_("SUID/SGID File Detected"), IDMEF_IMPACT_TYPE_FILE },
@@ -684 +691 @@
 
 
+#ifdef SH_USE_PORTCHECK
+static int get_service_info(char *msg, idmef_alert_t *alert)
+{
+        int ret;
+        long port;
+        char *ptr, *new, *tmp, *ip, *srv, *end;
+        prelude_string_t *str;
+        idmef_address_t *address;
+        idmef_node_t *node;
+        idmef_service_t *service;
+        idmef_source_t *source = idmef_alert_get_next_source(alert, NULL);
+
+        new = sh_util_strdup(msg);
+ 
+        ptr = strstr(new, _("port: "));
+        if ( ! ptr ) {
+                sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
+                                _("malformed Samhain port check message"), _("get_service_info"));
+                SH_FREE( new );
+                return -1;
+        }
+
+        ptr += 6; /* skip 'port: ', position on first byte of interface */
+        tmp = strchr(ptr, ':');
+        if ( ! tmp ) {
+                sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
+                                _("malformed Samhain port check message (no port)"), _("get_service_info"));
+                SH_FREE( new );
+                return -1;
+        }
+        *tmp = '\0';
+
+        ip = strdup(ptr);
+        if ( ip ) {
+                if ( ! source ) {
+                        ret = idmef_alert_new_source(alert, &source, IDMEF_LIST_APPEND);
+                        if ( ret < 0 ) {
+                                free(ip);
+                                SH_FREE( new );
+                                return ret;
+                        }
+                }
+
+                ret = idmef_source_new_node(source, &node);
+                if ( ret < 0 ) {
+                        free(ip);
+                        SH_FREE( new );
+                        return ret;
+                }
+                
+                ret = idmef_node_new_address(node, &address, IDMEF_LIST_APPEND);
+                if ( ret < 0 ) {
+                        free(ip);
+                        SH_FREE( new );
+                        return ret;
+                }
+                
+                ret = idmef_address_new_address(address, &str);
+                if ( ret < 0 ) {
+                        free(ip);
+                        SH_FREE( new );
+                        return ret;
+                }
+                
+                prelude_string_set_nodup(str, ip);
+        }
+
+        ptr = tmp;
+        ++ptr;
+        tmp = strchr(ptr, '/');
+        if ( ! tmp ) {
+                sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
+                                _("malformed Samhain port check message (no protocol)"), _("get_service_info"));
+                SH_FREE( new );
+                return -1;
+        }
+        *tmp = '\0';
+
+        port = strtol(ptr, &end, 0);
+        if ( *ptr && *end == '\0' && port >= 0 && port < 65536) {
+
+                if ( ! source ) {
+                        ret = idmef_alert_new_source(alert, &source, IDMEF_LIST_APPEND);
+                        if ( ret < 0 ) {
+                                free(srv);
+                                SH_FREE( new );
+                                return ret;
+                        }
+                }
+
+                ret = idmef_source_new_service(source, &service);
+                if ( ret < 0 ) {
+                        free(srv);
+                        SH_FREE( new );
+                        return ret;
+                }
+
+                idmef_service_set_port(service, port);
+        }
+
+        ptr = tmp;
+        ++ptr;
+        ptr = strchr(ptr, '(');
+        if ( ! ptr ) {
+                sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
+                                _("malformed Samhain port check message (no service)"), _("get_service_info"));
+                SH_FREE( new );
+                return -1;
+        }
+        ++ptr;
+        tmp = strchr(ptr, ')');
+        if ( ! tmp ) {
+                sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
+                                _("malformed Samhain port check message (service not closed)"), _("get_service_info"));
+                SH_FREE( new );
+                return -1;
+        }
+        *tmp = '\0';
+
+        srv = strdup(ptr);
+        if ( srv ) {
+                if ( ! source ) {
+                        ret = idmef_alert_new_source(alert, &source, IDMEF_LIST_APPEND);
+                        if ( ret < 0 ) {
+                                free(srv);
+                                SH_FREE( new );
+                                return ret;
+                        }
+                }
+
+                if ( ! service ) {
+                        ret = idmef_source_new_service(source, &service);
+                        if ( ret < 0 ) {
+                                free(srv);
+                                SH_FREE( new );
+                                return ret;
+                        }
+                }
+
+                ret = idmef_service_new_ident(service, &str);
+                if ( ret < 0 ) {
+                        free(srv);
+                        SH_FREE( new );
+                        return ret;
+                }
+                
+                prelude_string_set_nodup(str, srv);
+        }
+
+        SH_FREE( new );
+
+        return 0;
+}
+#endif
 
 static int get_login_info(char *msg, idmef_alert_t *alert)
@@ -902 +1063 @@
                 goto err;
         
+#ifdef SH_USE_PORTCHECK
+        if (msgid == MSG_PORT_MISS || msgid == MSG_PORT_NEW || msgid == MSG_PORT_RESTART || msgid == MSG_PORT_NEWPORT) {
+                ret = get_service_info(message, alert);
+                if ( ret < 0 )
+                        goto err;
+        }
+#endif
+   
         map_policy_to_class(message, msgid, impact, str);
 

trunk/src/sh_processcheck.c

@@ -837 +837 @@
           else if (errno == EAGAIN)
             {
+              clearerr(in);
               continue;
             }
+#ifdef HOST_IS_OPENBSD
+          else if (errno == ENODEV)
+            {
+              clearerr(in);
+              continue;
+            }
+#endif
           else
             {
@@ -1049 +1057 @@
   size_t i, j;
   char  tests[512];
+  int   retval;
 
   pid_t this_pid;
@@ -1060 +1069 @@
       SH_MUTEX_LOCK(mutex_thread_nolog);
       sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN, 
-                      _("Internal error: NULL argument"), 
+                      _("Internal error: NULL argument, switching off"), 
                       _("sh_process_check_int"));
       SH_MUTEX_UNLOCK(mutex_thread_nolog);
@@ -1067 +1076 @@
 
   SH_MUTEX_LOCK(mutex_thread_nolog);
-  sh_processes_runps (res, NULL, 0, SH_PR_PS, 0);
+  retval = sh_processes_runps (res, NULL, 0, SH_PR_PS, 0);
   SH_MUTEX_UNLOCK(mutex_thread_nolog);
   for (i = sh_prochk_minpid; i != sh_prochk_maxpid; ++i)
@@ -1075 +1084 @@
     }
   SH_MUTEX_LOCK(mutex_thread_nolog);
-  sh_processes_runps (res, NULL, 0, SH_PR_PS2, 0);
+  retval += sh_processes_runps (res, NULL, 0, SH_PR_PS2, 0);
   SH_MUTEX_UNLOCK(mutex_thread_nolog);
+
+  if (retval != 0)
+    {
+      SH_MUTEX_LOCK(mutex_thread_nolog);
+      sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN, 
+                      _("Failed to run ps, switching off"), 
+                      _("sh_process_check_int"));
+      SH_MUTEX_UNLOCK(mutex_thread_nolog);
+      SL_RETURN ((-1), _("sh_process_check_int"));
+    }
 
   /* Evaluate results

trunk/src/sh_readconf.c

@@ -573 +573 @@
    */
   sl_rewind (fd);
-  sh_error_only_stderr (S_FALSE);
   if (0 != sh_gpg_check_sign (fd, 0, 1))
     aud_exit (FIL__, __LINE__, EXIT_FAILURE);

trunk/src/sh_tools.c

@@ -582 +582 @@
                       *errnum = 0;
                       if (sl_strlen(host_entry->h_name) == 0 || 
-                          (*errnum = sl_strcmp(host_name,host_entry->h_name)) != 0)
+                          (*errnum = sl_strcasecmp(host_name,host_entry->h_name)) != 0)
                         { 
                           if (*errnum)
@@ -1663 +1663 @@
         SH_FREE (file);
         SH_FREE(my_tmp_dir);
+        sh_error_handle(SH_ERR_ALL, FIL__, __LINE__, status, MSG_E_SUBGEN, 
+                        _("Error (lstat) while opening temporary file"), _("open_tmp"));
         TPT(( 0, FIL__, __LINE__, _("msg=<Unexpected error %d>\n"), error));
         SL_RETURN((-1), _("open_tmp"));

trunk/src/sh_unix.c

@@ -43 +43 @@
 #include <fcntl.h>
 #include <unistd.h>
+/* need to undef these, since the #define's may be picked up from
+ * linux/wait.h, and will clash with a typedef in sys/wait.h
+ */
+#undef P_ALL
+#undef P_PID
+#undef P_PGID
 #include <sys/wait.h>
 
@@ -2993 +2999 @@
               someval *= 1000;  /* milliseconds in a second */
               sometime = (unsigned long) someval;
-              /* fprintf(stderr, "FIXME PAUSE %ld\n", sometime); */
               retry_msleep(0, sometime);
             }
@@ -2999 +3004 @@
             {
               sometime = (unsigned long) someval;
-              /* fprintf(stderr, "FIXME PAUSE %ld sec\n", sometime); */
               retry_msleep (sometime, 0);
             }
@@ -3037 +3041 @@
 
   SL_ENTER(_("sh_unix_checksum_size"));
+
+  tmpFile.link_path = NULL;
 
   if (sh.flag.checkSum != SH_CHECK_INIT)
@@ -3256 +3262 @@
 }
 #endif
-    
+
+#ifdef HAVE_LIBZ
+#include <zlib.h>
+#endif    
 
 int sh_unix_getinfo (int level, char * filename, file_type * theFile, 
@@ -3402 +3411 @@
               UINT64 length_nolim = TIGER_NOLIM;
 
-              if ((theFile->check_mask & MODI_TXT) != 0 && fbuf.st_size < SH_TXT_MAX)
+              if ((theFile->check_mask & MODI_TXT) != 0 && fbuf.st_size < (10 * SH_TXT_MAX))
                 {
                   sl_init_content (rval_open, fbuf.st_size);
@@ -3415 +3424 @@
 
               content = sl_get_content(rval_open);
+              content = sh_string_copy(content);
 
               if ((theFile->check_mask & MODI_SGROW) != 0)
@@ -3454 +3464 @@
               UINT64 length_nolim = TIGER_NOLIM;
 
-              if ((theFile->check_mask & MODI_TXT) != 0 && fbuf.st_size < SH_TXT_MAX)
+              if ((theFile->check_mask & MODI_TXT) != 0 && fbuf.st_size < (10 * SH_TXT_MAX))
                 {
                   sl_init_content (rval_open, fbuf.st_size);
@@ -3467 +3477 @@
 
               content = sl_get_content(rval_open);
+              content = sh_string_copy(content);
 
               if ((theFile->check_mask & MODI_SGROW) != 0) 
@@ -3759 +3770 @@
       if (content)
         {
-          sh_util_base64_enc_alloc (&(theFile->link_path), 
-                                    sh_string_str(content), 
-                                    sh_string_len(content));
+#ifdef HAVE_LIBZ
+          unsigned long   clen = compressBound(sh_string_len(content));
+          unsigned char * compressed = SH_ALLOC(clen);
+          if (Z_OK == compress(compressed, &clen, 
+                               (unsigned char *) sh_string_str(content), 
+                               sh_string_len(content)))
+              {
+                if (clen < SH_TXT_MAX)
+                  {
+                    sh_util_base64_enc_alloc (&(theFile->link_path), 
+                                              (char *) compressed, clen);
+                  }
+                else
+                  {
+                    char tmsg[128];
+                    char * tpath = sh_util_safe_name (theFile->fullpath);
+                    sl_snprintf(tmsg, sizeof(tmsg), 
+                                _("compressed file too large (%lu bytes)"),
+                                clen);
+                    sh_error_handle (SH_ERR_WARN, FIL__, __LINE__, -1, 
+                                     MSG_E_SUBGPATH, tmsg, 
+                                     _("sh_unix_getinfo"), tpath);
+                    SH_FREE(tpath);
+                  }
+              }
+          SH_FREE(compressed);
+#endif
+          sh_string_destroy(&content);
         }
     } 
@@ -3770 +3806 @@
 #endif
 
-int sh_unix_unlock (char * lockfile, char * flag);
-int sh_unix_lock   (char * lockfile, char * flag);
+int sh_unix_unlock(char * lockfile, char * flag)
+{
+  int         error = 0;
+  
+  SL_ENTER(_("sh_unix_unlock"));
+
+  if (sh.flag.isdaemon == S_FALSE && flag == NULL)
+    SL_RETURN((0),_("sh_unix_unlock"));
+
+  /* --- Logfile is not locked to us. ---
+   */
+  if (sh.flag.islocked == BAD && flag != NULL) 
+    SL_RETURN((-1),_("sh_unix_unlock"));
+
+  /* --- Check whether the directory is secure. ---
+   */
+  if (0 != tf_trust_check (lockfile, SL_YESPRIV))
+    SL_RETURN((-1),_("sh_unix_unlock"));
+
+  /* --- Delete the lock file. --- 
+   */
+  error = retry_aud_unlink (FIL__, __LINE__, lockfile);
+  
+  if (error == 0)
+    {
+      if (flag != NULL)
+        sh.flag.islocked = BAD; /* not locked anymore */
+    }
+  else if (flag != NULL)
+    {
+      char errbuf[SH_ERRBUF_SIZE];
+      error = errno;
+      sh_error_handle ((-1), FIL__, __LINE__, error, MSG_E_UNLNK,
+                       sh_error_message(error, errbuf, sizeof(errbuf)), 
+                       lockfile);
+      SL_RETURN((-1),_("sh_unix_unlock"));
+    }
+  SL_RETURN((0),_("sh_unix_unlock"));
+}
+
+int sh_unix_lock (char * lockfile, char * flag)
+{
+  int filed;
+  int errnum;
+  char myPid[64];
+  SL_TICKET  fd;
+  extern int get_the_fd (SL_TICKET ticket);
+
+  SL_ENTER(_("sh_unix_lock"));
+
+  sprintf (myPid, "%ld\n", (long) sh.pid);             /* known to fit  */
+
+  fd = sl_open_safe_rdwr (lockfile, SL_YESPRIV);       /* fails if file exists */
+
+  if (!SL_ISERROR(fd))
+    {
+      errnum = sl_write (fd, myPid, sl_strlen(myPid));
+      filed = get_the_fd(fd);
+      fchmod (filed, S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH);
+      sl_close (fd);
+
+      if (!SL_ISERROR(errnum))
+        {
+          if (flag != NULL)
+            sh.flag.islocked = GOOD;
+          SL_RETURN((0),_("sh_unix_lock"));
+        }
+    }
+
+  TPT((0, FIL__, __LINE__, _("msg=<open pid file failed>\n")));
+  if (flag != NULL)
+    sh.flag.islocked       = BAD;
+  SL_RETURN((-1),_("sh_unix_lock"));
+
+  /* notreached */
+}
+
 
 /* check whether file is locked
@@ -3964 +4075 @@
 }
 
-int sh_unix_unlock(char * lockfile, char * flag)
-{
-  int         error = 0;
-  
-  SL_ENTER(_("sh_unix_unlock"));
-
-  /* --- Logfile is not locked to us. ---
-   */
-  if (sh.flag.islocked == BAD && flag != NULL) 
-    SL_RETURN((-1),_("sh_unix_unlock"));
-
-  /* --- Check whether the directory is secure. ---
-   */
-  if (0 != tf_trust_check (lockfile, SL_YESPRIV))
-    SL_RETURN((-1),_("sh_unix_unlock"));
-
-  /* --- Delete the lock file. --- 
-   */
-  error = retry_aud_unlink (FIL__, __LINE__, lockfile);
-  
-  if (error == 0)
-    {
-      if (flag != NULL)
-        sh.flag.islocked = BAD; /* not locked anymore */
-    }
-  else if (flag != NULL)
-    {
-      char errbuf[SH_ERRBUF_SIZE];
-      error = errno;
-      sh_error_handle ((-1), FIL__, __LINE__, error, MSG_E_UNLNK,
-                       sh_error_message(error, errbuf, sizeof(errbuf)), 
-                       lockfile);
-      SL_RETURN((-1),_("sh_unix_unlock"));
-    }
-  SL_RETURN((0),_("sh_unix_unlock"));
-}
-
 /* rm lock for filename
  */
@@ -4029 +4103 @@
 {
   return sh_unix_unlock(sh.srvlog.alt, NULL);
-}
-
-int sh_unix_lock (char * lockfile, char * flag)
-{
-  int filed;
-  int errnum;
-  char myPid[64];
-  SL_TICKET  fd;
-  extern int get_the_fd (SL_TICKET ticket);
-
-  SL_ENTER(_("sh_unix_lock"));
-
-  sprintf (myPid, "%ld\n", (long) sh.pid);             /* known to fit  */
-
-  fd = sl_open_safe_rdwr (lockfile, SL_YESPRIV);       /* fails if file exists */
-
-  if (!SL_ISERROR(fd))
-    {
-      errnum = sl_write (fd, myPid, sl_strlen(myPid));
-      filed = get_the_fd(fd);
-      fchmod (filed, S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH);
-      sl_close (fd);
-
-      if (!SL_ISERROR(errnum))
-        {
-          if (flag != NULL)
-            sh.flag.islocked = GOOD;
-          SL_RETURN((0),_("sh_unix_lock"));
-        }
-    }
-
-  TPT((0, FIL__, __LINE__, _("msg=<open pid file failed>\n")));
-  if (flag != NULL)
-    sh.flag.islocked       = BAD;
-  SL_RETURN((-1),_("sh_unix_lock"));
-
-  /* notreached */
 }
 

trunk/src/slib.c

@@ -108 +108 @@
 int  sl_trace_use (const char * dummy)
 {
-  if (dummy)
-    slib_do_trace = 1;
-  else
-    slib_do_trace = 1;
+  (void) dummy;
+  slib_do_trace = 1;
   return 0;
 }
@@ -156 +154 @@
           fprintf(trace_fp, "[%2d] %s \t - File %c%s%c at line %d\n", 
                  trace_level, str, 0x22, file, 0x22, line);
+          fflush(trace_fp);
         }
       else
@@ -191 +190 @@
           fprintf(trace_fp, _("[%2d] %s \t - File %c%s%c at line %d\n"), 
                  trace_level, str, 0x22, file, 0x22, line);
+          fflush(trace_fp);
         }
       else
@@ -1007 +1007 @@
 }
 
+#include <ctype.h>
+int sl_strcasecmp(const char * one, const char * two)
+{
+#ifdef SL_FAIL_ON_ERROR
+  SL_REQUIRE (one != NULL, _("one != NULL"));
+  SL_REQUIRE (two != NULL, _("two != NULL"));
+#endif
+
+  if (one && two)
+    {
+      do {
+        if (*one && *two)
+          {
+            if (tolower(*one) == tolower(*two))
+              {
+                ++one; ++two;
+              }
+            else if (tolower(*one) < tolower(*two))
+              return -1;
+            else
+              return 1;
+          }
+        else if (*one == '\0' && *two == '\0')
+          return 0;
+        else if (*one == '\0')
+          return -1;
+        else
+          return 1;
+      } while (1 == 1);
+    }
+  else if (one == NULL && two != NULL)
+    return -1;
+  else if (one != NULL && two == NULL)
+    return 1;
+  else
+    return -7; /* default to not equal */
+}
 
 int sl_strcmp(const char * a, const char * b)
@@ -1022 +1059 @@
     return (1);
   else
-    return (-7); /* arbitrary */
+    return (-7); /* default to not equal */
 }
 
@@ -1040 +1077 @@
     return (1);
   else
-    return (-7); /* arbitrary */
+    return (-7); /* default to not equal */
 }
 
@@ -2232 +2269 @@
                   if (is_nonblocking == SL_FALSE)
                       retry_fcntl(FIL__, __LINE__, fd, F_SETFL, sflags);
+                  TPT(( 0, FIL__, __LINE__, _("msg=<read error>")));
                   return (SL_EREAD);
                 }
@@ -2247 +2285 @@
           if (is_nonblocking == SL_FALSE)
               retry_fcntl(FIL__, __LINE__, fd, F_SETFL, sflags);
+          TPT(( 0, FIL__, __LINE__, _("msg=<timeout>")));
           return (SL_TIMEOUT);
         }
@@ -2253 +2292 @@
           if (is_nonblocking == SL_FALSE)
               retry_fcntl(FIL__, __LINE__, fd, F_SETFL, sflags);
+          TPT(( 0, FIL__, __LINE__, _("msg=<timeout>")));
           return (SL_EREAD);
         }
@@ -2260 +2300 @@
           if (is_nonblocking == SL_FALSE)
               retry_fcntl(FIL__, __LINE__, fd, F_SETFL, sflags);
+          TPT(( 0, FIL__, __LINE__, _("msg=<terminated>")));
           return (SL_EREAD);
         }
@@ -2270 +2311 @@
           if (is_nonblocking == SL_FALSE)
               retry_fcntl(FIL__, __LINE__, fd, F_SETFL, sflags);
+          TPT(( 0, FIL__, __LINE__, _("msg=<timeout>")));
           return (SL_TIMEOUT);
         }
@@ -2282 +2324 @@
                      int timeout, int is_nonblocking)
 {
-  int    fd;
+  int    fd, retval;
  
+  SL_ENTER(_("sl_read_timeout"));
+
   if (buf_in == NULL || SL_ISERROR(fd = get_the_fd(ticket)))
     {
@@ -2289 +2333 @@
         {
           TPT(( 0, FIL__, __LINE__, _("msg=<null buffer>")));
-          return (SL_ENULL);
+          SL_IRETURN((SL_ENULL), _("sl_read_timeout"));
         }
       if (SL_ISERROR(fd = get_the_fd(ticket)))
         {
           TPT(( 0, FIL__, __LINE__, _("msg=<ticket error> errno=<%d>"), fd));
-          return (fd);
+          SL_IRETURN((fd),  _("sl_read_timeout"));
         }
     }
 
-  return sl_read_timeout_fd (fd, buf_in, count, timeout, is_nonblocking);
+  retval = sl_read_timeout_fd (fd, buf_in, count, timeout, is_nonblocking);
+  SL_IRETURN((retval), _("sl_read_timeout"));
 }
 
@@ -2310 +2355 @@
   char * buf;
 
+  SL_ENTER(_("sl_read"));
+
   if (count < 1)
     {
       TPT(( 0, FIL__, __LINE__, _("msg=<range error>")));
-      return(SL_ERANGE);
+      SL_IRETURN((SL_ERANGE), _("sl_read"));
     }
   if (buf_in == NULL)
     {
       TPT(( 0, FIL__, __LINE__, _("msg=<null buffer>")));
-      return (SL_ENULL);
+      SL_IRETURN((SL_ENULL), _("sl_read"));
     }
 
@@ -2324 +2371 @@
     {
       TPT(( 0, FIL__, __LINE__, _("msg=<ticket error> errno=<%d>"), fd));
-      return (fd);
+      SL_IRETURN((fd), _("sl_read"));
     }
 
@@ -2345 +2392 @@
     {
       TPT(( 0, FIL__, __LINE__, _("msg=<read error> errno=<%d>\n"), errno));
-      return (SL_EREAD);
-    }
-  return (bytes);
+      SL_IRETURN((SL_EREAD), _("sl_read"));
+    }
+  SL_IRETURN((bytes), _("sl_read"));
 }
 
@@ -2357 +2404 @@
   char * buf;
 
+  SL_ENTER(_("sl_read_fast"));
+
   if (count < 1)
     {
       TPT(( 0, FIL__, __LINE__, _("msg=<range error>")));
-      return(SL_ERANGE);
+      SL_IRETURN((SL_ERANGE), _("sl_read_fast"));
     }
   if (buf_in == NULL)
     {
       TPT(( 0, FIL__, __LINE__, _("msg=<null buffer>")));
-      return (SL_ENULL);
+      SL_IRETURN((SL_ENULL), _("sl_read_fast"));
     }
 
@@ -2371 +2420 @@
     {
       TPT(( 0, FIL__, __LINE__, _("msg=<ticket error> errno=<%d>"), fd));
-      return (fd);
+      SL_IRETURN((fd), _("sl_read_fast"));
     }
 
@@ -2381 +2430 @@
       if (byteread >= 0) 
         {
-          return (byteread);
+          SL_IRETURN((byteread), _("sl_read_fast"));
         }  
     } while ( byteread == -1 && (errno == EINTR || errno == EAGAIN));
@@ -2389 +2438 @@
     {
       TPT(( 0, FIL__, __LINE__, _("msg=<read error> errno=<%d>\n"), errno));
-      return (SL_EREAD);
-    }
-  return (0);
+      SL_IRETURN((SL_EREAD), _("sl_read_fast"));
+    }
+  SL_IRETURN((0), _("sl_read_fast"));
 }
 

trunk/test/testrun_1.sh

@@ -41 +41 @@
 testrun1_setup=0
 
-MAXTEST=13; export MAXTEST
+MAXTEST=15; export MAXTEST
 
 test_dirs () {
@@ -65 +65 @@
         fi
     done
+}
+
+
+TESTPOLICY_15="
+[Misc]
+DigestAlgo=SHA1
+RedefReadOnly = +TXT
+[ReadOnly]
+dir=${BASE}
+"
+mod_testdata_15 () {
+    mod_testdata_1
+}
+chk_testdata_15 () {
+    chk_testdata_1
+}
+
+TESTPOLICY_14="
+[Misc]
+DigestAlgo=MD5
+RedefReadOnly = +TXT
+[ReadOnly]
+dir=${BASE}
+"
+mod_testdata_14 () {
+    mod_testdata_1
+}
+chk_testdata_14 () {
+    chk_testdata_1
 }
 
@@ -455 +484 @@
 mod_testdata_5 () {
     mod_testdata_4
-    echo "This is a xxxx file"  > "${BASE}/a/a/b/x"    # GrowingLogFiles
-    echo "This is a test file" > "${BASE}/a/a/b/y"     # GrowingLogFiles
-    echo "This is a xxxx file bad" > "${BASE}/a/a/b/z" # GrowingLogFiles
+    echo "1 This is a xxxx file" > "${BASE}/a/a/b/x"     # GrowingLogFiles
+    echo "1 This is a test file" > "${BASE}/a/a/b/y"     # GrowingLogFiles
+    echo "2 This is a test file" >> "${BASE}/a/a/b/y"    # GrowingLogFiles
+    echo "1 This is a xxxx file bad" > "${BASE}/a/a/b/z" # GrowingLogFiles
+    echo "2 This is a xxxx file bad" >>"${BASE}/a/a/b/z" # GrowingLogFiles
+    echo "3 This is a xxxx file bad" >>"${BASE}/a/a/b/z" # GrowingLogFiles
 }
 
@@ -716 +748 @@
 "
 mod_testdata_2 () {
-    mod_testdata_1;
+    # mod_testdata_1;
+    one_sec_sleep
+    touch "${BASE}/a/a/x"
+    chmod 0555 "${BASE}/a/a/y"
+    mv "${BASE}/a/b/y" "${BASE}/a/b/yy"; 
+    echo "1 This is a test file" >  "${BASE}/a/b/y";
+    echo "2 This is a test file" >> "${BASE}/a/b/y";
+    echo "4 This is a test file" >> "${BASE}/a/b/z";
+    rm "${BASE}/a/b/yy"; # mv/rm to force new inode
+    rm "${BASE}/a/b/l_y";
+    ln -s "${BASE}/a/b/x" "${BASE}/a/b/l_y";
+    echo "foobar" > "${BASE}/a/c/y"
     rm "${BASE}/a/a/c/y"
     echo "foobar" > "${BASE}/a/a/c/foo"
@@ -762 +805 @@
     fi
     tmp=`grep CRIT $LOGFILE | wc -l`
-    if [ $tmp -ne 8 ]; then
+    if [ $tmp -ne 10 ]; then
         [ -z "$verbose" ] || log_msg_fail "policy count";
         return 1
@@ -769 +812 @@
 
 TESTPOLICY_1="
+[Misc]
+RedefReadOnly = +TXT
 [ReadOnly]
 dir=${BASE}
@@ -777 +822 @@
     touch "${BASE}/a/a/x"
     chmod 0555 "${BASE}/a/a/y"
-    mv "${BASE}/a/b/y"  "${BASE}/a/b/yy"; echo "This is a test file" > "${BASE}/a/b/y"; rm "${BASE}/a/b/yy"
+    mv "${BASE}/a/b/y" "${BASE}/a/b/yy"; 
+    echo "1 This is a test file" >  "${BASE}/a/b/y";
+    echo "2 This is a test file" >> "${BASE}/a/b/y";
+    echo "4 This is a test file" >> "${BASE}/a/b/z";
+    rm "${BASE}/a/b/yy"; # mv/rm to force new inode
+    rm "${BASE}/a/b/l_y";
+    ln -s "${BASE}/a/b/x" "${BASE}/a/b/l_y";
     echo "foobar" > "${BASE}/a/c/y"
+    #
+    mv "${BASE}/b/x" "${BASE}/b/xx"; # mv/rm to force new inode 
+    mkdir "${BASE}/b/x"
+    rm "${BASE}/b/xx";
+    #
+    mv "${BASE}/b/y" "${BASE}/b/yy"; # mv/rm to force new inode
+    ln -s  "${BASE}/b/z" "${BASE}/b/y"
+    rm "${BASE}/b/yy";
+    #
+    rm "${BASE}/b/l_x";  echo "1 This is a test file" >  "${BASE}/b/l_x"; 
 }
 
@@ -792 +853 @@
         if [ $tmp -ne 1 ]; then
             [ -z "$verbose" ] || log_msg_fail "${BASE}/${ff} (multiple)";
+            return 1
         fi
         #
@@ -797 +859 @@
             egrep "Checksum.*${BASE}/${ff}/${gg}" $LOGFILE >/dev/null 2>&1
             if [ $? -ne 0 ]; then
-                [ -z "$verbose" ] || log_msg_fail "${BASE}/${ff}/${gg} (checking)";
-                return 1
+                if [ "${BASE}/${ff}" != "${BASE}/b" ]; then
+                    [ -z "$verbose" ] || log_msg_fail "${BASE}/${ff}/${gg} (checksum)";
+                    return 1
+                fi
             fi
             tmp=`egrep "Checksum.*${BASE}/${ff}/${gg}" $LOGFILE 2>/dev/null | wc -l`
             if [ $tmp -ne 1 ]; then
-                [ -z "$verbose" ] || log_msg_fail "${BASE}/${ff}/${gg} (multiple)";
+                if [ "${BASE}/${ff}" != "${BASE}/b" ]; then
+                    [ -z "$verbose" ] || log_msg_fail "${BASE}/${ff}/${gg} (multiple)";
+                    return 1
+                fi
             fi
         done
     done
+    #
+    #
+    #
+    egrep "CRIT.*POLICY \[ReadOnly\] ----H---T-.*${BASE}/b" $LOGFILE >/dev/null 2>&1
+    if [ $? -ne 0 ]; then
+        [ -z "$verbose" ] || log_msg_fail "${BASE}/b";
+        return 1
+    fi
+    egrep "CRIT.*POLICY \[ReadOnly\] CL-I-M--TS.*${BASE}/b/y" $LOGFILE >/dev/null 2>&1
+    if [ $? -ne 0 ]; then
+        [ -z "$verbose" ] || log_msg_fail "${BASE}/b/y";
+        return 1
+    fi
+    egrep "CRIT.*POLICY \[ReadOnly\] CL---M--TS.*${BASE}/b/l_x" $LOGFILE >/dev/null 2>&1
+    if [ $? -ne 0 ]; then
+        [ -z "$verbose" ] || log_msg_fail "${BASE}/b/l_x";
+        return 1
+    fi
+    egrep "CRIT.*POLICY \[ReadOnly\] C--IHM--TS.*${BASE}/b/x" $LOGFILE >/dev/null 2>&1
+    if [ $? -ne 0 ]; then
+        [ -z "$verbose" ] || log_msg_fail "${BASE}/b/x";
+        return 1
+    fi
+    #
+    #
+    #
     egrep "CRIT.*POLICY \[ReadOnly\] --------T-.*${BASE}/a/a/x" $LOGFILE >/dev/null 2>&1
     if [ $? -ne 0 ]; then
@@ -821 +914 @@
         return 1
     fi
+    egrep "CRIT.*POLICY \[ReadOnly\] -L-I----T-.*${BASE}/a/b/l_y" $LOGFILE >/dev/null 2>&1
+    if [ $? -ne 0 ]; then
+        [ -z "$verbose" ] || log_msg_fail "${BASE}/a/b/l_y";
+        return 1
+    fi
     egrep "CRIT.*POLICY \[ReadOnly\] --------T-.*${BASE}/a/b" $LOGFILE >/dev/null 2>&1
     if [ $? -ne 0 ]; then
@@ -826 +924 @@
         return 1
     fi
+    egrep "CRIT.*POLICY \[ReadOnly\] C-------TS.*${BASE}/a/b/z" $LOGFILE >/dev/null 2>&1
+    if [ $? -ne 0 ]; then
+        [ -z "$verbose" ] || log_msg_fail "${BASE}/a/b/z";
+        return 1
+    fi
     egrep "CRIT.*POLICY \[ReadOnly\] C-------TS.*${BASE}/a/c/y" $LOGFILE >/dev/null 2>&1
     if [ $? -ne 0 ]; then
@@ -832 +935 @@
     fi
     tmp=`grep CRIT $LOGFILE | wc -l`
-    if [ $tmp -ne 5 ]; then
+    if [ $tmp -ne 11 ]; then
         [ -z "$verbose" ] || log_msg_fail "policy count";
         return 1
     fi
+    for ff in x y z; do
+        ./samhain --list-file "${BASE}/a/a/${ff}" -d "$PW_DIR/.samhain_file" > "$PW_DIR/.samhain_tmp"
+        diff "$PW_DIR/.samhain_tmp" "${BASE}/a/a/${ff}" >/dev/null
+        if [ $? -ne 0 ]; then
+            [ -z "$verbose" ] || log_msg_fail "diff $PW_DIR/.samhain_tmp ${BASE}/a/a/${ff}"
+            return 1
+        fi
+    done
+
     return 0
 }
@@ -1028 +1140 @@
         chmod 0755 "${BASE}/${ff}"
         for gg in $TFILES; do
-            echo "This is a test file" > "${BASE}/${ff}/${gg}"
+            echo "1 This is a test file" > "${BASE}/${ff}/${gg}"
             chmod 0644 "${BASE}/${ff}/${gg}"
+            ln -s "${BASE}/${ff}/${gg}" "${BASE}/${ff}/l_${gg}"
         done
+        echo "2 This is a test file" >> "${BASE}/${ff}/y"
+        echo "2 This is a test file" >> "${BASE}/${ff}/z"
+        echo "3 This is a test file" >> "${BASE}/${ff}/z"
     done
 }

trunk/test/testrun_1b.sh

@@ -20 +20 @@
 #
 
-MAXTEST=5; export MAXTEST
+MAXTEST=6; export MAXTEST
 LOGFILE="$PW_DIR/.samhain_log"; export LOGFILE
 RCFILE="$PW_DIR/testrc_1.dyn";  export RCFILE
@@ -136 +136 @@
 
         mv $PW_DIR/.samhain_file.asc $PW_DIR/.samhain_file
+}
+
+testrun1b_nogpg ()
+{
+        BUILDOPTS="$1"
+        #
+        # test standalone compilation
+        #
+        [ -z "$verbose" ] || { echo; echo "${S}Building standalone agent${E}"; echo; }
+        #
+        if test -r "Makefile"; then
+                $MAKE distclean >/dev/null >&1
+        fi
+
+        ${TOP_SRCDIR}/configure ${BUILDOPTS} 2>/dev/null 
+        #
+        #
+        if test x$? = x0; then
+                [ -z "$verbose" ] ||     log_msg_ok "configure..."; 
+                $MAKE  > /dev/null 2>&1
+                if test x$? = x0; then
+                    [ -z "$verbose" ] || log_msg_ok "make..."; 
+                else
+                    [ -z "$quiet" ] &&   log_msg_fail "make..."; 
+                    return 1
+                fi
+
+        else
+                [ -z "$quiet" ] &&       log_msg_fail "configure...";
+                return 1
+        fi
+
+        rm -f ./.samhain_file
+        rm -f ./.samhain_log
+        rm -f ./.samhain_lock
+
+        cp "${SCRIPTDIR}/testrc_1" "${RCFILE}"
+
+        ./samhain -t init -p none -l info
+
+        if test x$? = x0; then
+            [ -z "$verbose" ] || log_msg_ok    "init...";
+        else
+            [ -z "$quiet" ]   && log_msg_fail  "init...";
+            return 1
+        fi
+
 }
 
@@ -316 +363 @@
                 fi
             fi
+
+            #
+            # -------------  sixth test -------------
+            #
+            if test -f /usr/local/lib/libprelude.so
+            then
+                    LD_LIBRARY_PATH="/usr/local/lib:$LD_LIBRARY_PATH"
+                    export LD_LIBRARY_PATH
+            fi
+            #
+            PM=`find_path prelude-manager`
+            if [ -z "$PM" ]; then
+                log_skip 6 $MAXTEST 'prelude-manager not found in $PATH'
+            elif [ -z "$doall" ]; then
+                log_skip 6 $MAXTEST 'logging to prelude (or use --really-all)'
+            else
+                BUILDOPTS="--quiet $TRUST --with-prelude --enable-login-watch --enable-mounts-check --enable-process-check --enable-port-check --enable-suidcheck --prefix=$PW_DIR --localstatedir=$PW_DIR --with-config-file=$RCFILE  --with-log-file=$PW_DIR/.samhain_log --with-pid-file=$PW_DIR/.samhain_lock --with-data-file=$PW_DIR/.samhain_file"
+                testrun1b_nogpg "${BUILDOPTS} CFLAGS=-DSH_NOFAILOVER=1"
+                do_test_1b_2
+                if [ $? -eq 0 ]; then
+                    log_ok   6 $MAXTEST 'logging to prelude'
+                else
+                    log_fail 6 $MAXTEST 'logging to prelude'
+                fi
+            fi
+
         fi
     fi

trunk/test/testrun_1d.sh

@@ -197 +197 @@
 proc_psarg ()
 {
-    OS=`uname -o`
+    OS=`uname -s`
     case $OS in
         *Linux*|*linux*)
             PSARG="-eT";;
+        *OpenBSD*)
+            PSARG="akx";;
         *)
             PS=`proc_pspath`