Compare commits
No commits in common. 'c9' and 'i10cs' have entirely different histories.
@ -1 +1 @@
|
|||||||
b97f65bb12701a42baa2cce45b41ed6367a70734 SOURCES/aide-0.16.tar.gz
|
c699190eba9fcaa29ee362f57fb1a05dd74d947a SOURCES/aide-0.18.6.tar.gz
|
||||||
|
|||||||
@ -1 +1 @@
|
|||||||
SOURCES/aide-0.16.tar.gz
|
SOURCES/aide-0.18.6.tar.gz
|
||||||
|
|||||||
@ -1,496 +0,0 @@
|
|||||||
diff -up ./doc/aide.conf.5.in.syslog_format ./doc/aide.conf.5.in
|
|
||||||
--- ./doc/aide.conf.5.in.syslog_format 2016-07-25 22:58:12.000000000 +0200
|
|
||||||
+++ ./doc/aide.conf.5.in 2018-09-27 19:09:09.697371212 +0200
|
|
||||||
@@ -57,6 +57,25 @@ inclusive. This parameter can only be gi
|
|
||||||
occurrence is used. If \-\-verbose or \-V is used then the value from that
|
|
||||||
is used. The default is 5. If verbosity is 20 then additional report
|
|
||||||
output is written when doing \-\-check, \-\-update or \-\-compare.
|
|
||||||
+.IP "syslog_format"
|
|
||||||
+Valid values are yes,true,no and false. This option enables new syslog format
|
|
||||||
+which is suitable for logging. Every change is logged as one simple line. This option
|
|
||||||
+changes verbose level to 0 and prints everything that was changed. It is suggested
|
|
||||||
+to use this option with "report_url=syslog:...". Default value is "false/no".
|
|
||||||
+Maximum size of message is 1KB which is limitation of syslog call. If message is
|
|
||||||
+greater than limit, message will be truncated.
|
|
||||||
+Option summarize_changes has no impact for this format.
|
|
||||||
+.nf
|
|
||||||
+.eo
|
|
||||||
+
|
|
||||||
+Output always starts with:
|
|
||||||
+"AIDE found differences between database and filesystem!!"
|
|
||||||
+And it is followed by summary:
|
|
||||||
+summary;total_number_of_files=1000;added_files=0;removed_files=0;changed_files=1
|
|
||||||
+And finally there are logs about changes:
|
|
||||||
+dir=/usr/sbin;Mtime_old=0000-00-00 00:00:00;Mtime_new=0000-00-00 00:00:00;...
|
|
||||||
+.ec
|
|
||||||
+.fi
|
|
||||||
.IP "report_url"
|
|
||||||
The url that the output is written to. There can be multiple instances
|
|
||||||
of this parameter. Output is written to all of them. The default is
|
|
||||||
diff -up ./include/db_config.h.syslog_format ./include/db_config.h
|
|
||||||
--- ./include/db_config.h.syslog_format 2016-07-25 22:56:55.000000000 +0200
|
|
||||||
+++ ./include/db_config.h 2018-09-27 19:09:09.697371212 +0200
|
|
||||||
@@ -311,6 +311,7 @@ typedef struct db_config {
|
|
||||||
FILE* db_out;
|
|
||||||
|
|
||||||
int config_check;
|
|
||||||
+ int syslog_format;
|
|
||||||
|
|
||||||
struct md_container *mdc_in;
|
|
||||||
struct md_container *mdc_out;
|
|
||||||
diff -up ./src/aide.c.syslog_format ./src/aide.c
|
|
||||||
--- ./src/aide.c.syslog_format 2018-09-27 19:09:09.695371197 +0200
|
|
||||||
+++ ./src/aide.c 2018-09-27 19:09:09.698371220 +0200
|
|
||||||
@@ -283,6 +283,7 @@ static void setdefaults_before_config()
|
|
||||||
}
|
|
||||||
|
|
||||||
/* Setting some defaults */
|
|
||||||
+ conf->syslog_format=0;
|
|
||||||
conf->report_db=0;
|
|
||||||
conf->tree=NULL;
|
|
||||||
conf->config_check=0;
|
|
||||||
@@ -495,6 +496,10 @@ static void setdefaults_after_config()
|
|
||||||
if(conf->verbose_level==-1){
|
|
||||||
conf->verbose_level=5;
|
|
||||||
}
|
|
||||||
+ if(conf->syslog_format==1){
|
|
||||||
+ conf->verbose_level=0;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
diff -up ./src/compare_db.c.syslog_format ./src/compare_db.c
|
|
||||||
--- ./src/compare_db.c.syslog_format 2016-07-25 22:56:55.000000000 +0200
|
|
||||||
+++ ./src/compare_db.c 2018-09-27 19:09:09.698371220 +0200
|
|
||||||
@@ -110,7 +110,7 @@ const DB_ATTR_TYPE details_attributes[]
|
|
||||||
#endif
|
|
||||||
};
|
|
||||||
|
|
||||||
-const char* details_string[] = { _("File type") , _("Lname"), _("Size"), _("Size (>)"), _("Bcount"), _("Perm"), _("Uid"), _("Gid"), _("Atime"), _("Mtime"), _("Ctime"), _("Inode"), _("Linkcount"), _("MD5"), _("SHA1"), _("RMD160"), _("TIGER"), _("SHA256"), _("SHA512")
|
|
||||||
+const char* details_string[] = { _("File type") , _("Lname"), _("Size"), _("Size"), _("Bcount"), _("Perm"), _("Uid"), _("Gid"), _("Atime"), _("Mtime"), _("Ctime"), _("Inode"), _("Linkcount"), _("MD5"), _("SHA1"), _("RMD160"), _("TIGER"), _("SHA256"), _("SHA512")
|
|
||||||
#ifdef WITH_MHASH
|
|
||||||
, _("CRC32"), _("HAVAL"), _("GOST"), _("CRC32B"), _("WHIRLPOOL")
|
|
||||||
#endif
|
|
||||||
@@ -269,12 +269,19 @@ static int xattrs2array(xattrs_type* xat
|
|
||||||
if ((len == xattrs->ents[num - 1].vsz) || ((len == (xattrs->ents[num - 1].vsz - 1)) && !val[len])) {
|
|
||||||
length = 8 + width + strlen(xattrs->ents[num - 1].key) + strlen(val);
|
|
||||||
(*values)[num]=malloc(length *sizeof(char));
|
|
||||||
- snprintf((*values)[num], length , "[%.*zd] %s = %s", width, num, xattrs->ents[num - 1].key, val);
|
|
||||||
+
|
|
||||||
+ char * fmt = "[%.*zd] %s = %s";
|
|
||||||
+ if (conf->syslog_format) fmt = "[%.*zd]%s=%s"; // its smaller so it has to be enough space allocated.
|
|
||||||
+ snprintf((*values)[num], length , fmt, width, num, xattrs->ents[num - 1].key, val);
|
|
||||||
+
|
|
||||||
} else {
|
|
||||||
val = encode_base64(xattrs->ents[num - 1].val, xattrs->ents[num - 1].vsz);
|
|
||||||
length = 10 + width + strlen(xattrs->ents[num - 1].key) + strlen(val);
|
|
||||||
(*values)[num]=malloc( length *sizeof(char));
|
|
||||||
- snprintf((*values)[num], length , "[%.*zd] %s <=> %s", width, num, xattrs->ents[num - 1].key, val);
|
|
||||||
+
|
|
||||||
+ char * fmt = "[%.*zd] %s <=> %s";
|
|
||||||
+ if (conf->syslog_format) fmt = "[%.*zd]%s<=>%s"; // its smaller so it has to be enough space allocated.
|
|
||||||
+ snprintf((*values)[num], length , fmt, width, num, xattrs->ents[num - 1].key, val);
|
|
||||||
free(val);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -302,6 +309,26 @@ static int acl2array(acl_type* acl, char
|
|
||||||
}
|
|
||||||
if (acl->acl_a || acl->acl_d) {
|
|
||||||
int j, k, i;
|
|
||||||
+ if (conf->syslog_format) {
|
|
||||||
+ *values = malloc(2 * sizeof(char*));
|
|
||||||
+
|
|
||||||
+ char *A, *D = "<NONE>";
|
|
||||||
+
|
|
||||||
+ if (acl->acl_a) { A = acl->acl_a; }
|
|
||||||
+ if (acl->acl_d) { D = acl->acl_d; }
|
|
||||||
+
|
|
||||||
+ (*values)[0] = (char*) malloc(strlen(A) + 3); // "A:" and \0
|
|
||||||
+ snprintf((*values)[0], strlen(A) + 3, "A:%s", A);
|
|
||||||
+
|
|
||||||
+ (*values)[1] = (char*) malloc(strlen(D) + 3); // "D:" and \0
|
|
||||||
+ snprintf((*values)[1], strlen(D) + 3, "D:%s", D);
|
|
||||||
+
|
|
||||||
+ i = 0; while ( (*values)[0][i] ) { if ( (*values)[0][i]=='\n') { (*values)[0][i] = ' '; } i++; }
|
|
||||||
+ i = 0; while ( (*values)[1][i] ) { if ( (*values)[1][i]=='\n') { (*values)[1][i] = ' '; } i++; }
|
|
||||||
+
|
|
||||||
+ return 2;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
if (acl->acl_a) { i = 0; while (acl->acl_a[i]) { if (acl->acl_a[i++]=='\n') { n++; } } }
|
|
||||||
if (acl->acl_d) { i = 0; while (acl->acl_d[i]) { if (acl->acl_d[i++]=='\n') { n++; } } }
|
|
||||||
*values = malloc(n * sizeof(char*));
|
|
||||||
@@ -338,25 +365,25 @@ static char* e2fsattrs2string(unsigned l
|
|
||||||
|
|
||||||
static char* get_file_type_string(mode_t mode) {
|
|
||||||
switch (mode & S_IFMT) {
|
|
||||||
- case S_IFREG: return _("File");
|
|
||||||
- case S_IFDIR: return _("Directory");
|
|
||||||
+ case S_IFREG: return conf->syslog_format ? "file" : _("File");
|
|
||||||
+ case S_IFDIR: return conf->syslog_format ? "dir" : _("Directory");
|
|
||||||
#ifdef S_IFIFO
|
|
||||||
- case S_IFIFO: return _("FIFO");
|
|
||||||
+ case S_IFIFO: return conf->syslog_format ? "fifo" : _("FIFO");
|
|
||||||
#endif
|
|
||||||
- case S_IFLNK: return _("Link");
|
|
||||||
- case S_IFBLK: return _("Block device");
|
|
||||||
- case S_IFCHR: return _("Character device");
|
|
||||||
+ case S_IFLNK: return conf->syslog_format ? "link" : _("Link");
|
|
||||||
+ case S_IFBLK: return conf->syslog_format ? "blockd" : _("Block device");
|
|
||||||
+ case S_IFCHR: return conf->syslog_format ? "chard" : _("Character device");
|
|
||||||
#ifdef S_IFSOCK
|
|
||||||
- case S_IFSOCK: return _("Socket");
|
|
||||||
+ case S_IFSOCK: return conf->syslog_format ? "socket" : _("Socket");
|
|
||||||
#endif
|
|
||||||
#ifdef S_IFDOOR
|
|
||||||
- case S_IFDOOR: return _("Door");
|
|
||||||
+ case S_IFDOOR: return conf->syslog_format ? "door" : _("Door");
|
|
||||||
#endif
|
|
||||||
#ifdef S_IFPORT
|
|
||||||
- case S_IFPORT: return _("Port");
|
|
||||||
+ case S_IFPORT: return conf->syslog_format ? "port" : _("Port");
|
|
||||||
#endif
|
|
||||||
case 0: return NULL;
|
|
||||||
- default: return _("Unknown file type");
|
|
||||||
+ default: return conf->syslog_format ? "unknown" : _("Unknown file type");
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
@@ -554,6 +581,51 @@ static void print_dbline_attributes(db_l
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
+
|
|
||||||
+static void print_dbline_attributes_syslog(db_line* oline, db_line* nline, DB_ATTR_TYPE
|
|
||||||
+ changed_attrs, DB_ATTR_TYPE force_attrs) {
|
|
||||||
+ char **ovalue, **nvalue;
|
|
||||||
+ int onumber, nnumber, i, j;
|
|
||||||
+ int length = sizeof(details_attributes)/sizeof(DB_ATTR_TYPE);
|
|
||||||
+ DB_ATTR_TYPE attrs;
|
|
||||||
+ char *file_type = get_file_type_string((nline==NULL?oline:nline)->perm);
|
|
||||||
+ if (file_type) {
|
|
||||||
+ error(0,"%s=", file_type);
|
|
||||||
+ }
|
|
||||||
+ error(0,"%s", (nline==NULL?oline:nline)->filename);
|
|
||||||
+ attrs=force_attrs|(~(ignored_changed_attrs)&changed_attrs);
|
|
||||||
+ for (j=0; j < length; ++j) {
|
|
||||||
+ if (details_attributes[j]&attrs) {
|
|
||||||
+ onumber=get_attribute_values(details_attributes[j], oline, &ovalue);
|
|
||||||
+ nnumber=get_attribute_values(details_attributes[j], nline, &nvalue);
|
|
||||||
+
|
|
||||||
+ if (details_attributes[j] == DB_ACL || details_attributes[j] == DB_XATTRS) {
|
|
||||||
+
|
|
||||||
+ error(0, ";%s_old=|", details_string[j]);
|
|
||||||
+
|
|
||||||
+ for (i = 0 ; i < onumber ; i++) {
|
|
||||||
+ error(0, "%s|", ovalue[i]);
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ error(0, ";%s_new=|", details_string[j]);
|
|
||||||
+
|
|
||||||
+ for (i = 0 ; i < nnumber ; i++) {
|
|
||||||
+ error(0, "%s|", nvalue[i]);
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ } else {
|
|
||||||
+
|
|
||||||
+ error(0, ";%s_old=%s;%s_new=%s", details_string[j], *ovalue, details_string[j], *nvalue);
|
|
||||||
+
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ for(i=0; i < onumber; ++i) { free(ovalue[i]); ovalue[i]=NULL; } free(ovalue); ovalue=NULL;
|
|
||||||
+ for(i=0; i < nnumber; ++i) { free(nvalue[i]); nvalue[i]=NULL; } free(nvalue); nvalue=NULL;
|
|
||||||
+ }
|
|
||||||
+ }
|
|
||||||
+ error(0, "\n");
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
static void print_attributes_added_node(db_line* line) {
|
|
||||||
print_dbline_attributes(NULL, line, 0, line->attr);
|
|
||||||
}
|
|
||||||
@@ -562,6 +634,26 @@ static void print_attributes_removed_nod
|
|
||||||
print_dbline_attributes(line, NULL, 0, line->attr);
|
|
||||||
}
|
|
||||||
|
|
||||||
+static void print_attributes_added_node_syslog(db_line* line) {
|
|
||||||
+
|
|
||||||
+ char *file_type = get_file_type_string(line->perm);
|
|
||||||
+ if (file_type) {
|
|
||||||
+ error(0,"%s=", file_type);
|
|
||||||
+ }
|
|
||||||
+ error(0,"%s; added\n", line->filename);
|
|
||||||
+
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+static void print_attributes_removed_node_syslog(db_line* line) {
|
|
||||||
+
|
|
||||||
+ char *file_type = get_file_type_string(line->perm);
|
|
||||||
+ if (file_type) {
|
|
||||||
+ error(0,"%s=", file_type);
|
|
||||||
+ }
|
|
||||||
+ error(0,"%s; removed\n", line->filename);
|
|
||||||
+
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
static void terse_report(seltree* node) {
|
|
||||||
list* r=NULL;
|
|
||||||
if ((node->checked&(DB_OLD|DB_NEW)) != 0) {
|
|
||||||
@@ -626,6 +718,26 @@ static void print_report_details(seltree
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
+static void print_syslog_format(seltree* node) {
|
|
||||||
+ list* r=NULL;
|
|
||||||
+
|
|
||||||
+ if (node->checked&NODE_CHANGED) {
|
|
||||||
+ print_dbline_attributes_syslog(node->old_data, node->new_data, node->changed_attrs, forced_attrs);
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ if (node->checked&NODE_ADDED) {
|
|
||||||
+ print_attributes_added_node_syslog(node->new_data);
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ if (node->checked&NODE_REMOVED) {
|
|
||||||
+ print_attributes_removed_node_syslog(node->old_data);
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ for(r=node->childs;r;r=r->next){
|
|
||||||
+ print_syslog_format((seltree*)r->data);
|
|
||||||
+ }
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
static void print_report_header() {
|
|
||||||
char *time;
|
|
||||||
int first = 1;
|
|
||||||
@@ -747,39 +859,53 @@ int gen_report(seltree* node) {
|
|
||||||
send_audit_report();
|
|
||||||
#endif
|
|
||||||
if ((nadd|nrem|nchg) > 0 || conf->report_quiet == 0) {
|
|
||||||
- print_report_header();
|
|
||||||
- if(conf->action&(DO_COMPARE|DO_DIFF) || (conf->action&DO_INIT && conf->report_detailed_init) ) {
|
|
||||||
- if (conf->grouped) {
|
|
||||||
- if (nadd) {
|
|
||||||
- error(2,(char*)report_top_format,_("Added entries"));
|
|
||||||
- print_report_list(node, NODE_ADDED);
|
|
||||||
- }
|
|
||||||
- if (nrem) {
|
|
||||||
- error(2,(char*)report_top_format,_("Removed entries"));
|
|
||||||
- print_report_list(node, NODE_REMOVED);
|
|
||||||
- }
|
|
||||||
- if (nchg) {
|
|
||||||
- error(2,(char*)report_top_format,_("Changed entries"));
|
|
||||||
- print_report_list(node, NODE_CHANGED);
|
|
||||||
- }
|
|
||||||
- } else if (nadd || nrem || nchg) {
|
|
||||||
- if (nadd && nrem && nchg) { error(2,(char*)report_top_format,_("Added, removed and changed entries")); }
|
|
||||||
- else if (nadd && nrem) { error(2,(char*)report_top_format,_("Added and removed entries")); }
|
|
||||||
- else if (nadd && nchg) { error(2,(char*)report_top_format,_("Added and changed entries")); }
|
|
||||||
- else if (nrem && nchg) { error(2,(char*)report_top_format,_("Removed and changed entries")); }
|
|
||||||
- else if (nadd) { error(2,(char*)report_top_format,_("Added entries")); }
|
|
||||||
- else if (nrem) { error(2,(char*)report_top_format,_("Removed entries")); }
|
|
||||||
- else if (nchg) { error(2,(char*)report_top_format,_("Changed entries")); }
|
|
||||||
- print_report_list(node, NODE_ADDED|NODE_REMOVED|NODE_CHANGED);
|
|
||||||
- }
|
|
||||||
- if (nadd || nrem || nchg) {
|
|
||||||
- error(nchg?5:7,(char*)report_top_format,_("Detailed information about changes"));
|
|
||||||
- print_report_details(node);
|
|
||||||
- }
|
|
||||||
- }
|
|
||||||
- print_report_databases();
|
|
||||||
- conf->end_time=time(&(conf->end_time));
|
|
||||||
- print_report_footer();
|
|
||||||
+
|
|
||||||
+ if (!conf->syslog_format) {
|
|
||||||
+ print_report_header();
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ if(conf->action&(DO_COMPARE|DO_DIFF) || (conf->action&DO_INIT && conf->report_detailed_init) ) {
|
|
||||||
+ if (!conf->syslog_format && conf->grouped) {
|
|
||||||
+ if (nadd) {
|
|
||||||
+ error(2,(char*)report_top_format,_("Added entries"));
|
|
||||||
+ print_report_list(node, NODE_ADDED);
|
|
||||||
+ }
|
|
||||||
+ if (nrem) {
|
|
||||||
+ error(2,(char*)report_top_format,_("Removed entries"));
|
|
||||||
+ print_report_list(node, NODE_REMOVED);
|
|
||||||
+ }
|
|
||||||
+ if (nchg) {
|
|
||||||
+ error(2,(char*)report_top_format,_("Changed entries"));
|
|
||||||
+ print_report_list(node, NODE_CHANGED);
|
|
||||||
+ }
|
|
||||||
+ } else if (!conf->syslog_format && ( nadd || nrem || nchg ) ) {
|
|
||||||
+ if (nadd && nrem && nchg) { error(2,(char*)report_top_format,_("Added, removed and changed entries")); }
|
|
||||||
+ else if (nadd && nrem) { error(2,(char*)report_top_format,_("Added and removed entries")); }
|
|
||||||
+ else if (nadd && nchg) { error(2,(char*)report_top_format,_("Added and changed entries")); }
|
|
||||||
+ else if (nrem && nchg) { error(2,(char*)report_top_format,_("Removed and changed entries")); }
|
|
||||||
+ else if (nadd) { error(2,(char*)report_top_format,_("Added entries")); }
|
|
||||||
+ else if (nrem) { error(2,(char*)report_top_format,_("Removed entries")); }
|
|
||||||
+ else if (nchg) { error(2,(char*)report_top_format,_("Changed entries")); }
|
|
||||||
+ print_report_list(node, NODE_ADDED|NODE_REMOVED|NODE_CHANGED);
|
|
||||||
+ }
|
|
||||||
+ if (nadd || nrem || nchg) {
|
|
||||||
+ if (!conf->syslog_format) {
|
|
||||||
+ error(nchg?5:7,(char*)report_top_format,_("Detailed information about changes"));
|
|
||||||
+ print_report_details(node);
|
|
||||||
+ } else {
|
|
||||||
+ /* Syslog Format */
|
|
||||||
+ error(0, "AIDE found differences between database and filesystem!!\n");
|
|
||||||
+ error(0, "summary;total_number_of_files=%ld;added_files=%ld;"
|
|
||||||
+ "removed_files=%ld;changed_files=%ld\n",ntotal,nadd,nrem,nchg);
|
|
||||||
+ print_syslog_format(node);
|
|
||||||
+ }
|
|
||||||
+ }
|
|
||||||
+ }
|
|
||||||
+ if (!conf->syslog_format) {
|
|
||||||
+ print_report_databases();
|
|
||||||
+ conf->end_time=time(&(conf->end_time));
|
|
||||||
+ print_report_footer();
|
|
||||||
+ }
|
|
||||||
}
|
|
||||||
|
|
||||||
return conf->action&(DO_COMPARE|DO_DIFF) ? (nadd!=0)*1+(nrem!=0)*2+(nchg!=0)*4 : 0;
|
|
||||||
diff -up ./src/conf_lex.l.syslog_format ./src/conf_lex.l
|
|
||||||
--- ./src/conf_lex.l.syslog_format 2016-07-25 22:56:55.000000000 +0200
|
|
||||||
+++ ./src/conf_lex.l 2018-09-27 19:09:09.698371220 +0200
|
|
||||||
@@ -401,6 +401,12 @@ int var_in_conflval=0;
|
|
||||||
return (TROOT_PREFIX);
|
|
||||||
}
|
|
||||||
|
|
||||||
+^[\t\ ]*"syslog_format"{E} {
|
|
||||||
+ error(230,"%li:syslog_format =\n",conf_lineno);
|
|
||||||
+ BEGIN CONFVALHUNT;
|
|
||||||
+ return (SYSLOG_FORMAT);
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
^[\t\ ]*"recstop"{E} {
|
|
||||||
error(230,"%li:recstop =\n",conf_lineno);
|
|
||||||
BEGIN CONFVALHUNT;
|
|
||||||
diff -up ./src/conf_yacc.y.syslog_format ./src/conf_yacc.y
|
|
||||||
--- ./src/conf_yacc.y.syslog_format 2016-07-25 22:56:55.000000000 +0200
|
|
||||||
+++ ./src/conf_yacc.y 2018-09-27 19:09:09.699371228 +0200
|
|
||||||
@@ -89,6 +89,7 @@ extern long conf_lineno;
|
|
||||||
%token TREPORT_URL
|
|
||||||
%token TGZIPDBOUT
|
|
||||||
%token TROOT_PREFIX
|
|
||||||
+%token SYSLOG_FORMAT
|
|
||||||
%token TUMASK
|
|
||||||
%token TTRUE
|
|
||||||
%token TFALSE
|
|
||||||
@@ -160,7 +161,7 @@ line : rule | equrule | negrule | define
|
|
||||||
| ifdefstmt | ifndefstmt | ifhoststmt | ifnhoststmt
|
|
||||||
| groupdef | db_in | db_out | db_new | db_attrs | verbose | report_detailed_init | config_version
|
|
||||||
| database_add_metadata | report | gzipdbout | root_prefix | report_base16 | report_quiet
|
|
||||||
- | report_ignore_e2fsattrs | recursion_stopper | warn_dead_symlinks | grouped
|
|
||||||
+ | report_ignore_e2fsattrs | syslogformat | recursion_stopper | warn_dead_symlinks | grouped
|
|
||||||
| summarize_changes | acl_no_symlink_follow | beginconfigstmt | endconfigstmt
|
|
||||||
| TEOF {
|
|
||||||
newlinelastinconfig=1;
|
|
||||||
@@ -408,6 +409,15 @@ conf->gzip_dbout=0;
|
|
||||||
#endif
|
|
||||||
} ;
|
|
||||||
|
|
||||||
+syslogformat : SYSLOG_FORMAT TTRUE {
|
|
||||||
+conf->syslog_format=1;
|
|
||||||
+} |
|
|
||||||
+ SYSLOG_FORMAT TFALSE {
|
|
||||||
+conf->syslog_format=0;
|
|
||||||
+} ;
|
|
||||||
+
|
|
||||||
+
|
|
||||||
+
|
|
||||||
recursion_stopper : TRECSTOP TSTRING {
|
|
||||||
/* FIXME implement me */
|
|
||||||
|
|
||||||
diff -up ./src/error.c.syslog_format ./src/error.c
|
|
||||||
--- ./src/error.c.syslog_format 2016-07-25 22:56:55.000000000 +0200
|
|
||||||
+++ ./src/error.c 2018-09-27 19:13:40.312416750 +0200
|
|
||||||
@@ -38,6 +38,9 @@
|
|
||||||
/*for locale support*/
|
|
||||||
#include "util.h"
|
|
||||||
|
|
||||||
+#define MAX_BUFFER_SIZE 1024
|
|
||||||
+static char syslog_buffer[MAX_BUFFER_SIZE+1];
|
|
||||||
+
|
|
||||||
int cmp_url(url_t* url1,url_t* url2){
|
|
||||||
|
|
||||||
return ((url1->type==url2->type)&&(strcmp(url1->value,url2->value)==0));
|
|
||||||
@@ -48,7 +51,9 @@ int error_init(url_t* url,int initial)
|
|
||||||
{
|
|
||||||
list* r=NULL;
|
|
||||||
FILE* fh=NULL;
|
|
||||||
- int sfac;
|
|
||||||
+ int sfac;
|
|
||||||
+
|
|
||||||
+ memset(syslog_buffer, 0, MAX_BUFFER_SIZE+1);
|
|
||||||
|
|
||||||
if (url->type==url_database) {
|
|
||||||
conf->report_db++;
|
|
||||||
@@ -163,13 +168,24 @@ void error(int errorlevel,char* error_ms
|
|
||||||
}
|
|
||||||
#ifdef HAVE_SYSLOG
|
|
||||||
if(conf->initial_report_url->type==url_syslog){
|
|
||||||
-#ifdef HAVE_VSYSLOG
|
|
||||||
- vsyslog(SYSLOG_PRIORITY,error_msg,ap);
|
|
||||||
-#else
|
|
||||||
- char buf[1024];
|
|
||||||
- vsnprintf(buf,1024,error_msg,ap);
|
|
||||||
- syslog(SYSLOG_PRIORITY,"%s",buf);
|
|
||||||
-#endif
|
|
||||||
+
|
|
||||||
+ char buff[MAX_BUFFER_SIZE+1];
|
|
||||||
+ vsnprintf(buff,MAX_BUFFER_SIZE,error_msg,ap);
|
|
||||||
+ size_t buff_len = strlen(buff);
|
|
||||||
+
|
|
||||||
+ char result_buff[MAX_BUFFER_SIZE+1];
|
|
||||||
+#pragma GCC diagnostic push
|
|
||||||
+#pragma GCC diagnostic ignored "-Wformat-truncation"
|
|
||||||
+ snprintf(result_buff, MAX_BUFFER_SIZE, "%s%s", syslog_buffer, buff);
|
|
||||||
+#pragma GCC diagnostic pop
|
|
||||||
+
|
|
||||||
+ if(buff[buff_len-1] == '\n'){
|
|
||||||
+ syslog(SYSLOG_PRIORITY,"%s",result_buff);
|
|
||||||
+ memset(syslog_buffer, 0, MAX_BUFFER_SIZE+1);
|
|
||||||
+ } else {
|
|
||||||
+ memcpy(syslog_buffer, result_buff, MAX_BUFFER_SIZE);
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
va_end(ap);
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
@@ -181,17 +197,25 @@ void error(int errorlevel,char* error_ms
|
|
||||||
|
|
||||||
#ifdef HAVE_SYSLOG
|
|
||||||
if (conf->report_syslog!=0) {
|
|
||||||
-#ifdef HAVE_VSYSLOG
|
|
||||||
- va_start(ap,error_msg);
|
|
||||||
- vsyslog(SYSLOG_PRIORITY,error_msg,ap);
|
|
||||||
- va_end(ap);
|
|
||||||
-#else
|
|
||||||
- char buf[1024];
|
|
||||||
- va_start(ap,error_msg);
|
|
||||||
- vsnprintf(buf,1024,error_msg,ap);
|
|
||||||
+ va_start(ap, error_msg);
|
|
||||||
+
|
|
||||||
+ char buff[MAX_BUFFER_SIZE+1];
|
|
||||||
+ vsnprintf(buff,MAX_BUFFER_SIZE,error_msg,ap);
|
|
||||||
+ size_t buff_len = strlen(buff);
|
|
||||||
+
|
|
||||||
+ char result_buff[MAX_BUFFER_SIZE+1];
|
|
||||||
+#pragma GCC diagnostic push
|
|
||||||
+#pragma GCC diagnostic ignored "-Wformat-truncation"
|
|
||||||
+ snprintf(result_buff, MAX_BUFFER_SIZE, "%s%s", syslog_buffer, buff);
|
|
||||||
+#pragma GCC diagnostic pop
|
|
||||||
+
|
|
||||||
+ if(buff[buff_len-1] == '\n'){
|
|
||||||
+ syslog(SYSLOG_PRIORITY,"%s",result_buff);
|
|
||||||
+ memset(syslog_buffer, 0, MAX_BUFFER_SIZE+1);
|
|
||||||
+ } else {
|
|
||||||
+ memcpy(syslog_buffer, result_buff, MAX_BUFFER_SIZE);
|
|
||||||
+ }
|
|
||||||
va_end(ap);
|
|
||||||
- syslog(SYSLOG_PRIORITY,"%s",buf);
|
|
||||||
-#endif
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
|
|
||||||
@ -1,123 +0,0 @@
|
|||||||
diff --git a/include/base64.h b/include/base64.h
|
|
||||||
index 0ff7116..381ef5d 100644
|
|
||||||
--- a/include/base64.h
|
|
||||||
+++ b/include/base64.h
|
|
||||||
@@ -36,7 +36,6 @@
|
|
||||||
#include <assert.h>
|
|
||||||
#include "types.h"
|
|
||||||
|
|
||||||
-#define B64_BUF 16384
|
|
||||||
#define FAIL -1
|
|
||||||
#define SKIP -2
|
|
||||||
|
|
||||||
diff --git a/src/base64.c b/src/base64.c
|
|
||||||
index fd01bac..1b0f301 100644
|
|
||||||
--- a/src/base64.c
|
|
||||||
+++ b/src/base64.c
|
|
||||||
@@ -85,11 +85,9 @@ FAIL, FAIL, FAIL, FAIL, FAIL, FAIL, FAIL, FAIL
|
|
||||||
};
|
|
||||||
|
|
||||||
/* Returns NULL on error */
|
|
||||||
-/* FIXME Possible buffer overflow on outputs larger than B64_BUF */
|
|
||||||
char* encode_base64(byte* src,size_t ssize)
|
|
||||||
{
|
|
||||||
char* outbuf;
|
|
||||||
- char* retbuf;
|
|
||||||
int pos;
|
|
||||||
int i, l, left;
|
|
||||||
unsigned long triple;
|
|
||||||
@@ -101,7 +99,10 @@ char* encode_base64(byte* src,size_t ssize)
|
|
||||||
error(240,"\n");
|
|
||||||
return NULL;
|
|
||||||
}
|
|
||||||
- outbuf = (char *)malloc(sizeof(char)*B64_BUF);
|
|
||||||
+
|
|
||||||
+ /* length of encoded base64 string (padded) */
|
|
||||||
+ size_t length = sizeof(char)* ((ssize + 2) / 3) * 4;
|
|
||||||
+ outbuf = (char *)malloc(length + 1);
|
|
||||||
|
|
||||||
/* Initialize working pointers */
|
|
||||||
inb = src;
|
|
||||||
@@ -162,20 +163,14 @@ char* encode_base64(byte* src,size_t ssize)
|
|
||||||
inb++;
|
|
||||||
}
|
|
||||||
|
|
||||||
- /* outbuf is not completely used so we use retbuf */
|
|
||||||
- retbuf=(char*)malloc(sizeof(char)*(pos+1));
|
|
||||||
- memcpy(retbuf,outbuf,pos);
|
|
||||||
- retbuf[pos]='\0';
|
|
||||||
- free(outbuf);
|
|
||||||
+ outbuf[pos]='\0';
|
|
||||||
|
|
||||||
- return retbuf;
|
|
||||||
+ return outbuf;
|
|
||||||
}
|
|
||||||
|
|
||||||
-/* FIXME Possible buffer overflow on outputs larger than B64_BUF */
|
|
||||||
byte* decode_base64(char* src,size_t ssize, size_t *ret_len)
|
|
||||||
{
|
|
||||||
byte* outbuf;
|
|
||||||
- byte* retbuf;
|
|
||||||
char* inb;
|
|
||||||
int i;
|
|
||||||
int l;
|
|
||||||
@@ -188,10 +183,18 @@ byte* decode_base64(char* src,size_t ssize, size_t *ret_len)
|
|
||||||
if (!ssize||src==NULL)
|
|
||||||
return NULL;
|
|
||||||
|
|
||||||
+ /* exit on unpadded input */
|
|
||||||
+ if (ssize % 4) {
|
|
||||||
+ error(3, "decode_base64: '%s' has invalid length (missing padding characters?)", src);
|
|
||||||
+ return NULL;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ /* calculate length of decoded string, substract padding chars if any (ssize is >= 4) */
|
|
||||||
+ size_t length = sizeof(byte) * ((ssize / 4) * 3)- (src[ssize-1] == '=') - (src[ssize-2] == '=');
|
|
||||||
|
|
||||||
/* Initialize working pointers */
|
|
||||||
inb = src;
|
|
||||||
- outbuf = (byte *)malloc(sizeof(byte)*B64_BUF);
|
|
||||||
+ outbuf = (byte *)malloc(length + 1);
|
|
||||||
|
|
||||||
l = 0;
|
|
||||||
triple = 0;
|
|
||||||
@@ -243,15 +246,11 @@ byte* decode_base64(char* src,size_t ssize, size_t *ret_len)
|
|
||||||
inb++;
|
|
||||||
}
|
|
||||||
|
|
||||||
- retbuf=(byte*)malloc(sizeof(byte)*(pos+1));
|
|
||||||
- memcpy(retbuf,outbuf,pos);
|
|
||||||
- retbuf[pos]='\0';
|
|
||||||
-
|
|
||||||
- free(outbuf);
|
|
||||||
+ outbuf[pos]='\0';
|
|
||||||
|
|
||||||
if (ret_len) *ret_len = pos;
|
|
||||||
|
|
||||||
- return retbuf;
|
|
||||||
+ return outbuf;
|
|
||||||
}
|
|
||||||
|
|
||||||
size_t length_base64(char* src,size_t ssize)
|
|
||||||
diff --git a/src/db.c b/src/db.c
|
|
||||||
index 858240d..62c4faa 100644
|
|
||||||
--- a/src/db.c
|
|
||||||
+++ b/src/db.c
|
|
||||||
@@ -664,13 +664,15 @@ db_line* db_char2line(char** ss,int db){
|
|
||||||
|
|
||||||
time_t base64totime_t(char* s){
|
|
||||||
|
|
||||||
+ if(strcmp(s,"0")==0){
|
|
||||||
+ return 0;
|
|
||||||
+ }
|
|
||||||
byte* b=decode_base64(s,strlen(s),NULL);
|
|
||||||
char* endp;
|
|
||||||
|
|
||||||
- if (b==NULL||strcmp(s,"0")==0) {
|
|
||||||
+ if (b==NULL) {
|
|
||||||
|
|
||||||
/* Should we print error here? */
|
|
||||||
- free(b);
|
|
||||||
|
|
||||||
return 0;
|
|
||||||
} else {
|
|
||||||
@ -1,58 +0,0 @@
|
|||||||
From c7caa6027c92b28aa11b8da74d56357e12f56d67 Mon Sep 17 00:00:00 2001
|
|
||||||
From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= <dkopecek@redhat.com>
|
|
||||||
Date: Wed, 20 Feb 2019 12:00:56 +0100
|
|
||||||
Subject: [PATCH] Use LDADD for adding curl library to the linker command
|
|
||||||
|
|
||||||
---
|
|
||||||
Makefile.am | 2 +-
|
|
||||||
configure.ac | 5 +++--
|
|
||||||
2 files changed, 4 insertions(+), 3 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/Makefile.am b/Makefile.am
|
|
||||||
index 4b05d7a..1541d56 100644
|
|
||||||
--- a/Makefile.am
|
|
||||||
+++ b/Makefile.am
|
|
||||||
@@ -55,7 +55,7 @@ if USE_CURL
|
|
||||||
aide_SOURCES += include/fopen.h src/fopen.c
|
|
||||||
endif
|
|
||||||
|
|
||||||
-aide_LDADD = -lm @PCRELIB@ @CRYPTLIB@ @ACLLIB@ @SELINUXLIB@ @AUDITLIB@ @ATTRLIB@ @E2FSATTRSLIB@ @ELFLIB@
|
|
||||||
+aide_LDADD = -lm @PCRELIB@ @CRYPTLIB@ @ACLLIB@ @SELINUXLIB@ @AUDITLIB@ @ATTRLIB@ @E2FSATTRSLIB@ @ELFLIB@ @CURLLIB@
|
|
||||||
AM_CFLAGS = @AIDE_DEFS@ -W -Wall -g
|
|
||||||
AM_CPPFLAGS = -I$(top_srcdir) \
|
|
||||||
-I$(top_srcdir)/include \
|
|
||||||
diff --git a/configure.ac b/configure.ac
|
|
||||||
index 3598ebe..0418c59 100644
|
|
||||||
--- a/configure.ac
|
|
||||||
+++ b/configure.ac
|
|
||||||
@@ -702,24 +702,25 @@ if test x$with_zlib = xyes; then
|
|
||||||
compoptionstring="${compoptionstring}WITH_ZLIB\\n"
|
|
||||||
fi
|
|
||||||
|
|
||||||
+CURLLIB=
|
|
||||||
if test x$with_curl = xyes; then
|
|
||||||
AC_PATH_PROG(curlconfig, "curl-config")
|
|
||||||
if test "_$curlconfig" != _ ; then
|
|
||||||
CURL_CFLAGS=`$curlconfig --cflags`
|
|
||||||
- CURL_LIBS=`$curlconfig --libs`
|
|
||||||
+ CURLLIB=`$curlconfig --libs`
|
|
||||||
else
|
|
||||||
AC_MSG_ERROR([You don't have curl properly installed. Install it or try --without-curl.])
|
|
||||||
fi
|
|
||||||
AC_CHECK_HEADERS(curl/curl.h,,
|
|
||||||
[AC_MSG_ERROR([You don't have curl properly installed. Install it or try --without-curl.])])
|
|
||||||
CFLAGS="$CFLAGS $CURL_CFLAGS"
|
|
||||||
- LDFLAGS="$LDFLAGS $CURL_LIBS"
|
|
||||||
AC_CHECK_LIB(curl,curl_easy_init,havecurl=yes,
|
|
||||||
[AC_MSG_ERROR([You don't have curl properly installed. Install it or try --without-curl.])]
|
|
||||||
)
|
|
||||||
AC_DEFINE(WITH_CURL,1,[use curl])
|
|
||||||
compoptionstring="${compoptionstring}WITH_CURL\\n"
|
|
||||||
fi
|
|
||||||
+AC_SUBST(CURLLIB)
|
|
||||||
AM_CONDITIONAL(USE_CURL, test x$havecurl = xyes)
|
|
||||||
|
|
||||||
AC_ARG_WITH(mhash,
|
|
||||||
--
|
|
||||||
2.20.1
|
|
||||||
|
|
||||||
@ -1,17 +0,0 @@
|
|||||||
--- ./src/do_md.c 2018-03-19 05:10:19.994957024 -0400
|
|
||||||
+++ ./src/do_md.c 2018-03-19 05:19:05.829957024 -0400
|
|
||||||
@@ -135,8 +135,13 @@
|
|
||||||
continue;
|
|
||||||
|
|
||||||
while (!bingo && (data = elf_getdata (scn, data)) != NULL) {
|
|
||||||
- int maxndx = data->d_size / shdr.sh_entsize;
|
|
||||||
+ int maxndx;
|
|
||||||
int ndx;
|
|
||||||
+
|
|
||||||
+ if (shdr.sh_entsize != 0)
|
|
||||||
+ maxndx = data->d_size / shdr.sh_entsize;
|
|
||||||
+ else
|
|
||||||
+ continue;
|
|
||||||
|
|
||||||
for (ndx = 0; ndx < maxndx; ++ndx) {
|
|
||||||
(void) gelf_getdyn (data, ndx, &dyn);
|
|
||||||
@ -1,153 +0,0 @@
|
|||||||
diff -up ./include/md.h.crypto ./include/md.h
|
|
||||||
--- ./include/md.h.crypto 2016-07-25 22:56:55.000000000 +0200
|
|
||||||
+++ ./include/md.h 2018-08-29 15:00:30.827491299 +0200
|
|
||||||
@@ -149,6 +149,7 @@ int init_md(struct md_container*);
|
|
||||||
int update_md(struct md_container*,void*,ssize_t);
|
|
||||||
int close_md(struct md_container*);
|
|
||||||
void md2line(struct md_container*,struct db_line*);
|
|
||||||
+DB_ATTR_TYPE get_available_crypto();
|
|
||||||
|
|
||||||
|
|
||||||
#endif /*_MD_H_INCLUDED*/
|
|
||||||
diff -up ./src/aide.c.crypto ./src/aide.c
|
|
||||||
--- ./src/aide.c.crypto 2018-08-29 15:00:30.825491309 +0200
|
|
||||||
+++ ./src/aide.c 2018-08-29 15:00:30.827491299 +0200
|
|
||||||
@@ -349,7 +349,7 @@ static void setdefaults_before_config()
|
|
||||||
|
|
||||||
conf->db_attrs = 0;
|
|
||||||
#if defined(WITH_MHASH) || defined(WITH_GCRYPT)
|
|
||||||
- conf->db_attrs |= DB_MD5|DB_TIGER|DB_HAVAL|DB_CRC32|DB_SHA1|DB_RMD160|DB_SHA256|DB_SHA512;
|
|
||||||
+ conf->db_attrs |= get_available_crypto();
|
|
||||||
#ifdef WITH_MHASH
|
|
||||||
conf->db_attrs |= DB_GOST;
|
|
||||||
#ifdef HAVE_MHASH_WHIRLPOOL
|
|
||||||
diff -up ./src/md.c.crypto ./src/md.c
|
|
||||||
--- ./src/md.c.crypto 2018-08-29 15:00:30.823491319 +0200
|
|
||||||
+++ ./src/md.c 2018-08-29 15:02:28.013903479 +0200
|
|
||||||
@@ -78,6 +78,49 @@ DB_ATTR_TYPE hash_gcrypt2attr(int i) {
|
|
||||||
return r;
|
|
||||||
}
|
|
||||||
|
|
||||||
+const char * hash_gcrypt2str(int i) {
|
|
||||||
+ char * r = "?";
|
|
||||||
+#ifdef WITH_GCRYPT
|
|
||||||
+ switch (i) {
|
|
||||||
+ case GCRY_MD_MD5: {
|
|
||||||
+ r = "MD5";
|
|
||||||
+ break;
|
|
||||||
+ }
|
|
||||||
+ case GCRY_MD_SHA1: {
|
|
||||||
+ r = "SHA1";
|
|
||||||
+ break;
|
|
||||||
+ }
|
|
||||||
+ case GCRY_MD_RMD160: {
|
|
||||||
+ r = "RMD160";
|
|
||||||
+ break;
|
|
||||||
+ }
|
|
||||||
+ case GCRY_MD_TIGER: {
|
|
||||||
+ r = "TIGER";
|
|
||||||
+ break;
|
|
||||||
+ }
|
|
||||||
+ case GCRY_MD_HAVAL: {
|
|
||||||
+ r = "HAVAL";
|
|
||||||
+ break;
|
|
||||||
+ }
|
|
||||||
+ case GCRY_MD_SHA256: {
|
|
||||||
+ r = "SHA256";
|
|
||||||
+ break;
|
|
||||||
+ }
|
|
||||||
+ case GCRY_MD_SHA512: {
|
|
||||||
+ r = "SHA512";
|
|
||||||
+ break;
|
|
||||||
+ }
|
|
||||||
+ case GCRY_MD_CRC32: {
|
|
||||||
+ r = "CRC32";
|
|
||||||
+ break;
|
|
||||||
+ }
|
|
||||||
+ default:
|
|
||||||
+ break;
|
|
||||||
+ }
|
|
||||||
+#endif
|
|
||||||
+ return r;
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
DB_ATTR_TYPE hash_mhash2attr(int i) {
|
|
||||||
DB_ATTR_TYPE r=0;
|
|
||||||
#ifdef WITH_MHASH
|
|
||||||
@@ -163,6 +206,44 @@ DB_ATTR_TYPE hash_mhash2attr(int i) {
|
|
||||||
Initialise md_container according it's todo_attr field
|
|
||||||
*/
|
|
||||||
|
|
||||||
+DB_ATTR_TYPE get_available_crypto() {
|
|
||||||
+
|
|
||||||
+ DB_ATTR_TYPE ret = 0;
|
|
||||||
+
|
|
||||||
+/*
|
|
||||||
+ * This function is usually called before config processing
|
|
||||||
+ * and default verbose level is 5
|
|
||||||
+ */
|
|
||||||
+#define lvl 255
|
|
||||||
+
|
|
||||||
+ error(lvl, "get_available_crypto called\n");
|
|
||||||
+
|
|
||||||
+#ifdef WITH_GCRYPT
|
|
||||||
+
|
|
||||||
+ /*
|
|
||||||
+ * some initialization for FIPS
|
|
||||||
+ */
|
|
||||||
+ gcry_check_version(NULL);
|
|
||||||
+ error(lvl, "Found algos:");
|
|
||||||
+
|
|
||||||
+ for(int i=0;i<=HASH_GCRYPT_COUNT;i++) {
|
|
||||||
+
|
|
||||||
+ if ( (hash_gcrypt2attr(i) & HASH_USE_GCRYPT) == 0 )
|
|
||||||
+ continue;
|
|
||||||
+
|
|
||||||
+ if (gcry_md_algo_info(i, GCRYCTL_TEST_ALGO, NULL, NULL) == 0) {
|
|
||||||
+ ret |= hash_gcrypt2attr(i);
|
|
||||||
+ error(lvl, " %s", hash_gcrypt2str(i));
|
|
||||||
+ }
|
|
||||||
+ }
|
|
||||||
+ error(lvl, "\n");
|
|
||||||
+
|
|
||||||
+#endif
|
|
||||||
+
|
|
||||||
+ error(lvl, "get_available_crypto_returned with %lld\n", ret);
|
|
||||||
+ return ret;
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
int init_md(struct md_container* md) {
|
|
||||||
|
|
||||||
int i;
|
|
||||||
@@ -201,18 +282,27 @@ int init_md(struct md_container* md) {
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
#ifdef WITH_GCRYPT
|
|
||||||
- if(gcry_md_open(&md->mdh,0,GCRY_MD_FLAG_SECURE)!=GPG_ERR_NO_ERROR){
|
|
||||||
+ if(gcry_md_open(&md->mdh,0,GCRY_MD_FLAG_SECURE)!=GPG_ERR_NO_ERROR){
|
|
||||||
error(0,"gcrypt_md_open failed\n");
|
|
||||||
exit(IO_ERROR);
|
|
||||||
}
|
|
||||||
for(i=0;i<=HASH_GCRYPT_COUNT;i++) {
|
|
||||||
+
|
|
||||||
+
|
|
||||||
if (((hash_gcrypt2attr(i)&HASH_USE_GCRYPT)&md->todo_attr)!=0) {
|
|
||||||
- DB_ATTR_TYPE h=hash_gcrypt2attr(i);
|
|
||||||
- error(255,"inserting %llu\n",h);
|
|
||||||
+
|
|
||||||
+ DB_ATTR_TYPE h=hash_gcrypt2attr(i);
|
|
||||||
+
|
|
||||||
+ if (gcry_md_algo_info(i, GCRYCTL_TEST_ALGO, NULL, NULL) != 0) {
|
|
||||||
+ error(0,"Algo %s is not available\n", hash_gcrypt2str(i));
|
|
||||||
+ exit(-1);
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ error(255,"inserting %llu\n",h);
|
|
||||||
if(gcry_md_enable(md->mdh,i)==GPG_ERR_NO_ERROR){
|
|
||||||
md->calc_attr|=h;
|
|
||||||
} else {
|
|
||||||
- error(0,"gcry_md_enable %i failed",i);
|
|
||||||
+ error(0,"gcry_md_enable %i failed\n",i);
|
|
||||||
md->todo_attr&=~h;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,103 +0,0 @@
|
|||||||
diff -up ./src/aide.c.orig ./aide-0.16b1/src/aide.c
|
|
||||||
--- ./src/aide.c.orig 2016-07-12 11:10:08.013158385 +0200
|
|
||||||
+++ ./src/aide.c 2016-07-12 11:30:54.867833064 +0200
|
|
||||||
@@ -511,9 +511,28 @@ int main(int argc,char**argv)
|
|
||||||
#endif
|
|
||||||
umask(0177);
|
|
||||||
init_sighandler();
|
|
||||||
-
|
|
||||||
setdefaults_before_config();
|
|
||||||
|
|
||||||
+#if WITH_GCRYPT
|
|
||||||
+ error(255,"Gcrypt library initialization\n");
|
|
||||||
+ /*
|
|
||||||
+ * Initialize libgcrypt as per
|
|
||||||
+ * http://www.gnupg.org/documentation/manuals/gcrypt/Initializing-the-library.html
|
|
||||||
+ *
|
|
||||||
+ *
|
|
||||||
+ */
|
|
||||||
+ gcry_control(GCRYCTL_SET_ENFORCED_FIPS_FLAG, 0);
|
|
||||||
+ gcry_control(GCRYCTL_INIT_SECMEM, 1);
|
|
||||||
+
|
|
||||||
+ if(!gcry_check_version(GCRYPT_VERSION)) {
|
|
||||||
+ error(0,"libgcrypt version mismatch\n");
|
|
||||||
+ exit(VERSION_MISMATCH_ERROR);
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ gcry_control(GCRYCTL_INITIALIZATION_FINISHED, 0);
|
|
||||||
+#endif /* WITH_GCRYPT */
|
|
||||||
+
|
|
||||||
+
|
|
||||||
if(read_param(argc,argv)==RETFAIL){
|
|
||||||
error(0, _("Invalid argument\n") );
|
|
||||||
exit(INVALID_ARGUMENT_ERROR);
|
|
||||||
@@ -646,6 +665,9 @@ int main(int argc,char**argv)
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
}
|
|
||||||
+#ifdef WITH_GCRYPT
|
|
||||||
+ gcry_control(GCRYCTL_TERM_SECMEM, 0);
|
|
||||||
+#endif /* WITH_GCRYPT */
|
|
||||||
return RETOK;
|
|
||||||
}
|
|
||||||
const char* aide_key_3=CONFHMACKEY_03;
|
|
||||||
diff -up ./src/md.c.orig ./aide-0.16b1/src/md.c
|
|
||||||
--- ./src/md.c.orig 2016-04-15 23:30:16.000000000 +0200
|
|
||||||
+++ ./src/md.c 2016-07-12 11:35:04.007675329 +0200
|
|
||||||
@@ -201,14 +201,7 @@ int init_md(struct md_container* md) {
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
#ifdef WITH_GCRYPT
|
|
||||||
- error(255,"Gcrypt library initialization\n");
|
|
||||||
- if(!gcry_check_version(GCRYPT_VERSION)) {
|
|
||||||
- error(0,"libgcrypt version mismatch\n");
|
|
||||||
- exit(VERSION_MISMATCH_ERROR);
|
|
||||||
- }
|
|
||||||
- gcry_control(GCRYCTL_DISABLE_SECMEM, 0);
|
|
||||||
- gcry_control(GCRYCTL_INITIALIZATION_FINISHED, 0);
|
|
||||||
- if(gcry_md_open(&md->mdh,0,0)!=GPG_ERR_NO_ERROR){
|
|
||||||
+ if(gcry_md_open(&md->mdh,0,GCRY_MD_FLAG_SECURE)!=GPG_ERR_NO_ERROR){
|
|
||||||
error(0,"gcrypt_md_open failed\n");
|
|
||||||
exit(IO_ERROR);
|
|
||||||
}
|
|
||||||
@@ -299,7 +292,7 @@ int close_md(struct md_container* md) {
|
|
||||||
|
|
||||||
/*. There might be more hashes in the library. Add those here.. */
|
|
||||||
|
|
||||||
- gcry_md_reset(md->mdh);
|
|
||||||
+ gcry_md_close(md->mdh);
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#ifdef WITH_MHASH
|
|
||||||
diff -up ./src/util.c.orig ./aide-0.16b1/src/util.c
|
|
||||||
--- ./src/util.c.orig 2016-07-12 11:39:17.023437355 +0200
|
|
||||||
+++ ./src/util.c 2016-07-12 11:39:51.618721157 +0200
|
|
||||||
@@ -519,28 +519,5 @@ int syslog_facility_lookup(char *s)
|
|
||||||
return(AIDE_SYSLOG_FACILITY);
|
|
||||||
}
|
|
||||||
|
|
||||||
-/* We need these dummy stubs to fool the linker into believing that
|
|
||||||
- we do not need them at link time */
|
|
||||||
-
|
|
||||||
-void* dlopen(char*filename,int flag)
|
|
||||||
-{
|
|
||||||
- return NULL;
|
|
||||||
-}
|
|
||||||
-
|
|
||||||
-void* dlsym(void*handle,char*symbol)
|
|
||||||
-{
|
|
||||||
- return NULL;
|
|
||||||
-}
|
|
||||||
-
|
|
||||||
-void* dlclose(void*handle)
|
|
||||||
-{
|
|
||||||
- return NULL;
|
|
||||||
-}
|
|
||||||
-
|
|
||||||
-const char* dlerror(void)
|
|
||||||
-{
|
|
||||||
- return NULL;
|
|
||||||
-}
|
|
||||||
-
|
|
||||||
const char* aide_key_2=CONFHMACKEY_02;
|
|
||||||
const char* db_key_2=DBHMACKEY_02;
|
|
||||||
@ -1,15 +0,0 @@
|
|||||||
diff -up ./doc/aide.1.in.orig ./doc/aide.1.in
|
|
||||||
--- ./doc/aide.1.in.orig 2016-07-12 16:10:01.724595895 +0200
|
|
||||||
+++ ./doc/aide.1.in 2016-07-12 16:06:21.968639822 +0200
|
|
||||||
@@ -103,9 +103,9 @@ echo <encoded_checksum> | base64 \-d | h
|
|
||||||
.SH FILES
|
|
||||||
.IP \fB@sysconfdir@/aide.conf\fR
|
|
||||||
Default aide configuration file.
|
|
||||||
-.IP \fB@sysconfdir@/aide.db\fR
|
|
||||||
+.IP \fB@localstatedir@/lib/aide/aide.db\fR
|
|
||||||
Default aide database.
|
|
||||||
-.IP \fB@sysconfdir@/aide.db.new\fR
|
|
||||||
+.IP \fB@localstatedir@/lib/aide/aide.db.new\fR
|
|
||||||
Default aide output database.
|
|
||||||
.SH SEE ALSO
|
|
||||||
.BR aide.conf (5)
|
|
||||||
@ -1,51 +0,0 @@
|
|||||||
diff --color -ru a/configure.ac b/configure.ac
|
|
||||||
--- a/configure.ac 2021-05-20 09:31:11.686987129 +0200
|
|
||||||
+++ b/configure.ac 2021-05-20 09:39:43.369967457 +0200
|
|
||||||
@@ -784,11 +784,11 @@
|
|
||||||
[if test "x$withval" = "xmd5" ;then
|
|
||||||
CONFIGHMACTYPE="MHASH_MD5"
|
|
||||||
else if test "x$withval" = "xsha1" ;then
|
|
||||||
- CONFIGHMACTYPE="MHASH_SHA1"
|
|
||||||
+ CONFIGHMACTYPE="MHASH_SHA1"
|
|
||||||
else if test "x$withval" = "xsha256" ;then
|
|
||||||
- CONFIGHMACTYPE="MHASH_SHA256"
|
|
||||||
+ CONFIGHMACTYPE="MHASH_SHA256"
|
|
||||||
else if test "x$withval" = "xsha512" ;then
|
|
||||||
- CONFIGHMACTYPE="MHASH_SHA512"
|
|
||||||
+ CONFIGHMACTYPE="MHASH_SHA512"
|
|
||||||
else
|
|
||||||
echo "Valid parameters for --with-confighmactype are md5, sha1, sha256 and sha512"
|
|
||||||
exit 1
|
|
||||||
@@ -799,7 +799,6 @@
|
|
||||||
AC_DEFINE_UNQUOTED(CONFIGHMACTYPE,$CONFIGHMACTYPE,[hash type for config file check])],
|
|
||||||
[
|
|
||||||
AC_DEFINE_UNQUOTED(CONFIGHMACTYPE,MHASH_MD5,[hash type for config file check])]
|
|
||||||
-,
|
|
||||||
)
|
|
||||||
|
|
||||||
AC_ARG_WITH([confighmackey],
|
|
||||||
@@ -846,18 +845,18 @@
|
|
||||||
|
|
||||||
AC_ARG_WITH([dbhmactype],
|
|
||||||
AC_HELP_STRING([--with-dbhmactype=TYPE],
|
|
||||||
- [Hash type to use for checking db. Valid values are md5 and sha1.]),
|
|
||||||
+ [Hash type to use for checking db. Valid values are md5, sha1, sha256 and sha512.]),
|
|
||||||
[if test "x$withval" = "xmd5" ;then
|
|
||||||
DBHMACTYPE="MHASH_MD5"
|
|
||||||
else if test "x$withval" = "xsha1" ;then
|
|
||||||
- DBHMACTYPE="MHASH_SHA1"
|
|
||||||
+ DBHMACTYPE="MHASH_SHA1"
|
|
||||||
else if test "x$withval" = "xsha256" ;then
|
|
||||||
- CONFIGHMACTYPE="MHASH_SHA256"
|
|
||||||
+ DBHMACTYPE="MHASH_SHA256"
|
|
||||||
else if test "x$withval" = "xsha512" ;then
|
|
||||||
- CONFIGHMACTYPE="MHASH_SHA512"
|
|
||||||
+ DBHMACTYPE="MHASH_SHA512"
|
|
||||||
else
|
|
||||||
- echo "Valid parameters for --with-dbhmactype are md5, sha1, sha256 and sha512"
|
|
||||||
- exit 1
|
|
||||||
+ echo "Valid parameters for --with-dbhmactype are md5, sha1, sha256 and sha512"
|
|
||||||
+ exit 1
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
@ -1,171 +0,0 @@
|
|||||||
Only in b: config.log
|
|
||||||
diff --color -ru a/contrib/sshaide.sh b/contrib/sshaide.sh
|
|
||||||
--- a/contrib/sshaide.sh 2016-07-25 22:56:55.000000000 +0200
|
|
||||||
+++ b/contrib/sshaide.sh 2021-05-20 11:11:24.112542472 +0200
|
|
||||||
@@ -260,7 +260,7 @@
|
|
||||||
_randword=`grep -n . ${_wordlist} | grep "^${_linenum}:" | cut -d: -f2`
|
|
||||||
|
|
||||||
# If $_randword has anything other than lower-case chars, try again
|
|
||||||
- (echo ${_randword} | LC_ALL=C grep '[^a-z]' 2>&1 >> /dev/null \
|
|
||||||
+ ({ echo ${_randword} | LC_ALL=C grep '[^a-z]' 2>&1; } >> /dev/null \
|
|
||||||
&& gen_rand_word ) || \
|
|
||||||
|
|
||||||
# Return the word
|
|
||||||
diff --color -ru a/src/commandconf.c b/src/commandconf.c
|
|
||||||
--- a/src/commandconf.c 2021-05-20 10:37:53.842382143 +0200
|
|
||||||
+++ b/src/commandconf.c 2021-05-25 14:16:43.278526146 +0200
|
|
||||||
@@ -313,7 +313,7 @@
|
|
||||||
} else {
|
|
||||||
/* gzread returns 0 even if uncompressed bytes were read*/
|
|
||||||
error(240,"nread=%d,strlen(buf)=%lu,errno=%s,gzerr=%s\n",
|
|
||||||
- retval,(unsigned long)strnlen((char*)buf, max_size),
|
|
||||||
+ retval,(unsigned long)strnlen((char*)buf, retval),
|
|
||||||
strerror(errno),gzerror(*db_gzp,&err));
|
|
||||||
if(retval==0){
|
|
||||||
retval=strnlen((char*)buf, max_size);
|
|
||||||
@@ -836,6 +836,11 @@
|
|
||||||
}
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
+ default: {
|
|
||||||
+ error(0,"Unsupported dbtype.\n");
|
|
||||||
+ free(u);
|
|
||||||
+ break;
|
|
||||||
+ }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
free(val);
|
|
||||||
@@ -900,7 +905,7 @@
|
|
||||||
} else {
|
|
||||||
error_init(u,0);
|
|
||||||
}
|
|
||||||
-
|
|
||||||
+ free(u->value);
|
|
||||||
free(u);
|
|
||||||
}
|
|
||||||
|
|
||||||
diff --color -ru a/src/db_disk.c b/src/db_disk.c
|
|
||||||
--- a/src/db_disk.c 2021-05-20 10:37:53.842382143 +0200
|
|
||||||
+++ b/src/db_disk.c 2021-05-20 12:37:00.081493364 +0200
|
|
||||||
@@ -125,10 +125,10 @@
|
|
||||||
|
|
||||||
ret = (char *) malloc (len);
|
|
||||||
ret[0] = (char) 0;
|
|
||||||
- strncpy(ret, conf->root_prefix, conf->root_prefix_length+1);
|
|
||||||
- strncat (ret, r->path, len2);
|
|
||||||
+ strcpy(ret, conf->root_prefix);
|
|
||||||
+ strcat (ret, r->path);
|
|
||||||
if (r->path[len2 - 1] != '/') {
|
|
||||||
- strncat (ret, "/", 1);
|
|
||||||
+ strcat (ret, "/");
|
|
||||||
}
|
|
||||||
strcat (ret, s);
|
|
||||||
return ret;
|
|
||||||
@@ -207,8 +207,8 @@
|
|
||||||
if (!root_handled) {
|
|
||||||
root_handled = 1;
|
|
||||||
fullname=malloc((conf->root_prefix_length+2)*sizeof(char));
|
|
||||||
- strncpy(fullname, conf->root_prefix, conf->root_prefix_length+1);
|
|
||||||
- strncat (fullname, "/", 1);
|
|
||||||
+ strcpy(fullname, conf->root_prefix);
|
|
||||||
+ strcat (fullname, "/");
|
|
||||||
if (!get_file_status(&fullname[conf->root_prefix_length], &fs)) {
|
|
||||||
add = check_rxtree (&fullname[conf->root_prefix_length], conf->tree, &attr, fs.st_mode);
|
|
||||||
error (240, "%s match=%d, tree=%p, attr=%llu\n", &fullname[conf->root_prefix_length], add,
|
|
||||||
@@ -346,8 +346,8 @@
|
|
||||||
error (255, "r->childs %p, r->parent %p,r->checked %i\n",
|
|
||||||
r->childs, r->parent, r->checked);
|
|
||||||
fullname=malloc((conf->root_prefix_length+strlen(r->path)+1)*sizeof(char));
|
|
||||||
- strncpy(fullname, conf->root_prefix, conf->root_prefix_length+1);
|
|
||||||
- strncat(fullname, r->path, strlen(r->path));
|
|
||||||
+ strcpy(fullname, conf->root_prefix);
|
|
||||||
+ strcat(fullname, r->path);
|
|
||||||
dirh=open_dir(fullname);
|
|
||||||
if (! dirh) {
|
|
||||||
|
|
||||||
@@ -441,8 +441,8 @@
|
|
||||||
|
|
||||||
|
|
||||||
char* fullname=malloc((conf->root_prefix_length+2)*sizeof(char));
|
|
||||||
- strncpy(fullname, conf->root_prefix, conf->root_prefix_length+1);
|
|
||||||
- strncat (fullname, "/", 1);
|
|
||||||
+ strcpy(fullname, conf->root_prefix);
|
|
||||||
+ strcat (fullname, "/");
|
|
||||||
dirh=open_dir(fullname);
|
|
||||||
free(fullname);
|
|
||||||
|
|
||||||
diff --color -ru a/src/error.c b/src/error.c
|
|
||||||
--- a/src/error.c 2021-05-20 10:37:53.836382037 +0200
|
|
||||||
+++ b/src/error.c 2021-05-21 11:49:09.781313097 +0200
|
|
||||||
@@ -125,7 +125,7 @@
|
|
||||||
fh=be_init(0,url,0);
|
|
||||||
if(fh!=NULL) {
|
|
||||||
conf->report_fd=list_append(conf->report_fd,(void*)fh);
|
|
||||||
- conf->report_url=list_append(conf->report_url,(void*)url);
|
|
||||||
+ conf->report_url=list_append(conf->report_url,(void*)strdup(url));
|
|
||||||
return RETOK;
|
|
||||||
}
|
|
||||||
|
|
||||||
diff --color -ru a/src/util.c b/src/util.c
|
|
||||||
--- a/src/util.c 2021-05-20 10:37:53.843382160 +0200
|
|
||||||
+++ b/src/util.c 2021-05-25 11:04:39.507278771 +0200
|
|
||||||
@@ -105,13 +105,15 @@
|
|
||||||
for(i=0;r[0]!='/'&&r[0]!='\0';r++,i++);
|
|
||||||
if(r[0]=='\0'){
|
|
||||||
error(0,"Invalid file-URL,no path after hostname: file:%s\n",t);
|
|
||||||
+ free(u);
|
|
||||||
+ free(val_copy);
|
|
||||||
free(hostname);
|
|
||||||
return NULL;
|
|
||||||
}
|
|
||||||
u->value=strdup(r);
|
|
||||||
r[0]='\0';
|
|
||||||
if(gethostname(hostname,MAXHOSTNAMELEN)==-1){
|
|
||||||
- strncpy(hostname,"localhost", 10);
|
|
||||||
+ strncpy(hostname,"localhost",MAXHOSTNAMELEN);
|
|
||||||
}
|
|
||||||
|
|
||||||
if( (strcmp(t,"localhost")==0)||(strcmp(t,hostname)==0)){
|
|
||||||
@@ -119,6 +121,9 @@
|
|
||||||
break;
|
|
||||||
} else {
|
|
||||||
error(0,"Invalid file-URL, cannot use hostname other than localhost or %s: file:%s\n",hostname,u->value);
|
|
||||||
+ free(u->value);
|
|
||||||
+ free(u);
|
|
||||||
+ free(val_copy);
|
|
||||||
free(hostname);
|
|
||||||
return NULL;
|
|
||||||
}
|
|
||||||
@@ -229,6 +234,10 @@
|
|
||||||
int i=0;
|
|
||||||
|
|
||||||
pc=(char*)malloc(sizeof(char)*11);
|
|
||||||
+ if (!pc) {
|
|
||||||
+ error(0, "Memory allocation failed.\n");
|
|
||||||
+ return NULL;
|
|
||||||
+ }
|
|
||||||
for(i=0;i<10;i++){
|
|
||||||
pc[i]='-';
|
|
||||||
}
|
|
||||||
@@ -369,14 +378,17 @@
|
|
||||||
|
|
||||||
if (path != NULL) {
|
|
||||||
if (path[0] == '~') {
|
|
||||||
- if((homedir=getenv("HOME")) != NULL) {
|
|
||||||
+ if ((homedir=getenv("HOME")) != NULL) {
|
|
||||||
path_len = strlen(path+sizeof(char));
|
|
||||||
homedir_len = strlen(homedir);
|
|
||||||
full_len = homedir_len+path_len;
|
|
||||||
full = malloc(sizeof(char) * (full_len+1));
|
|
||||||
- strncpy(full, homedir, homedir_len);
|
|
||||||
- strncpy(full+homedir_len, path+sizeof(char), path_len);
|
|
||||||
- full[full_len] = '\0';
|
|
||||||
+ if (!full) {
|
|
||||||
+ error(0, "Memory allocation failed.\n");
|
|
||||||
+ return path;
|
|
||||||
+ }
|
|
||||||
+ strcpy(full, homedir);
|
|
||||||
+ strcat(full, path+sizeof(char));
|
|
||||||
free(path);
|
|
||||||
/* Don't free(homedir); because it is not safe on some platforms */
|
|
||||||
path = full;
|
|
||||||
@ -0,0 +1,34 @@
|
|||||||
|
diff -up ./src/conf_eval.c.verbose ./src/conf_eval.c
|
||||||
|
--- ./src/conf_eval.c.verbose 2023-04-01 18:25:38.000000000 +0200
|
||||||
|
+++ ./src/conf_eval.c 2024-05-15 00:08:41.040033220 +0200
|
||||||
|
@@ -187,6 +187,7 @@ static void set_database_attr_option(DB_
|
||||||
|
static void eval_config_statement(config_option_statement statement, int linenumber, char *filename, char* linebuf) {
|
||||||
|
char *str;
|
||||||
|
bool b;
|
||||||
|
+ long num;
|
||||||
|
DB_ATTR_TYPE attr;
|
||||||
|
switch (statement.option) {
|
||||||
|
ATTRIBUTE_CONFIG_OPTION_CASE(REPORT_IGNORE_ADDED_ATTRS_OPTION, report_ignore_added_attrs)
|
||||||
|
@@ -298,8 +299,20 @@ static void eval_config_statement(config
|
||||||
|
LOG_CONFIG_FORMAT_LINE(LOG_LEVEL_CONFIG, "set 'config_version' option to '%s'", str)
|
||||||
|
break;
|
||||||
|
case VERBOSE_OPTION:
|
||||||
|
- log_msg(LOG_LEVEL_ERROR, "%s:%d: 'verbose' option is no longer supported, use 'log_level' and 'report_level' options instead (see man aide.conf for details) (line: '%s')", conf_filename, conf_linenumber, conf_linebuf);
|
||||||
|
- exit(INVALID_CONFIGURELINE_ERROR);
|
||||||
|
+ log_msg(LOG_LEVEL_CONFIG, "%s:%d: 'verbose' option is deprecated, use 'log_level' and 'report_level' options instead (see man aide.conf for details) (line: '%s')", conf_filename, conf_linenumber, conf_linebuf);
|
||||||
|
+ str = eval_string_expression(statement.e, linenumber, filename, linebuf);
|
||||||
|
+ num = strtol(str, NULL, 10);
|
||||||
|
+
|
||||||
|
+ if (num < 0 || num > 255) {
|
||||||
|
+ LOG_CONFIG_FORMAT_LINE(LOG_LEVEL_ERROR, "invalid verbose level: '%s'", str);
|
||||||
|
+ exit(INVALID_CONFIGURELINE_ERROR);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ if (num >= 10) {
|
||||||
|
+ set_log_level(LOG_LEVEL_DEBUG);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ free(str);
|
||||||
|
break;
|
||||||
|
case LIMIT_CMDLINE_OPTION:
|
||||||
|
/* command-line options are ignored here */
|
||||||
@ -1,642 +0,0 @@
|
|||||||
diff -up ./include/be.h.coverity ./include/be.h
|
|
||||||
--- ./include/be.h.coverity 2016-07-25 22:56:55.000000000 +0200
|
|
||||||
+++ ./include/be.h 2018-10-10 19:27:18.680632681 +0200
|
|
||||||
@@ -22,6 +22,6 @@
|
|
||||||
#define _BE_H_INCLUDED
|
|
||||||
#include "db_config.h"
|
|
||||||
|
|
||||||
-FILE* be_init(int inout,url_t* u,int iszipped);
|
|
||||||
+void* be_init(int inout,url_t* u,int iszipped);
|
|
||||||
|
|
||||||
#endif /* _BE_H_INCLUDED */
|
|
||||||
diff -up ./include/db_config.h.coverity ./include/db_config.h
|
|
||||||
--- ./include/db_config.h.coverity 2018-10-10 19:27:18.672632611 +0200
|
|
||||||
+++ ./include/db_config.h 2018-10-10 19:27:18.681632689 +0200
|
|
||||||
@@ -376,7 +376,7 @@ typedef struct db_config {
|
|
||||||
#endif
|
|
||||||
|
|
||||||
url_t* initial_report_url;
|
|
||||||
- FILE* initial_report_fd;
|
|
||||||
+ void* initial_report_fd;
|
|
||||||
|
|
||||||
/* report_url is a list of url_t*s */
|
|
||||||
list* report_url;
|
|
||||||
diff -up ./src/aide.c.coverity ./src/aide.c
|
|
||||||
--- ./src/aide.c.coverity 2018-10-10 19:27:18.678632663 +0200
|
|
||||||
+++ ./src/aide.c 2018-10-10 19:27:18.681632689 +0200
|
|
||||||
@@ -278,7 +278,7 @@ static void setdefaults_before_config()
|
|
||||||
error(0,_("Couldn't get hostname"));
|
|
||||||
free(s);
|
|
||||||
} else {
|
|
||||||
- s=(char*)realloc((void*)s,strlen(s)+1);
|
|
||||||
+ // s=(char*)realloc((void*)s,strlen(s)+1);
|
|
||||||
do_define("HOSTNAME",s);
|
|
||||||
}
|
|
||||||
|
|
||||||
@@ -506,8 +506,6 @@ static void setdefaults_after_config()
|
|
||||||
int main(int argc,char**argv)
|
|
||||||
{
|
|
||||||
int errorno=0;
|
|
||||||
- byte* dig=NULL;
|
|
||||||
- char* digstr=NULL;
|
|
||||||
|
|
||||||
#ifdef USE_LOCALE
|
|
||||||
setlocale(LC_ALL,"");
|
|
||||||
@@ -544,6 +542,10 @@ int main(int argc,char**argv)
|
|
||||||
}
|
|
||||||
|
|
||||||
errorno=commandconf('C',conf->config_file);
|
|
||||||
+ if (errorno==RETFAIL){
|
|
||||||
+ error(0,_("Configuration error\n"));
|
|
||||||
+ exit(INVALID_CONFIGURELINE_ERROR);
|
|
||||||
+ }
|
|
||||||
|
|
||||||
errorno=commandconf('D',"");
|
|
||||||
if (errorno==RETFAIL){
|
|
||||||
@@ -594,6 +596,9 @@ int main(int argc,char**argv)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
#ifdef WITH_MHASH
|
|
||||||
+ byte* dig=NULL;
|
|
||||||
+ char* digstr=NULL;
|
|
||||||
+
|
|
||||||
if(conf->config_check&&FORCECONFIGMD){
|
|
||||||
error(0,"Can't give config checksum when compiled with --enable-forced_configmd\n");
|
|
||||||
exit(INVALID_ARGUMENT_ERROR);
|
|
||||||
diff -up ./src/base64.c.coverity ./src/base64.c
|
|
||||||
--- ./src/base64.c.coverity 2016-07-25 22:56:55.000000000 +0200
|
|
||||||
+++ ./src/base64.c 2018-10-10 19:27:18.681632689 +0200
|
|
||||||
@@ -209,6 +209,7 @@ byte* decode_base64(char* src,size_t ssi
|
|
||||||
case FAIL:
|
|
||||||
error(3, "decode_base64: Illegal character: %c\n", *inb);
|
|
||||||
error(230, "decode_base64: Illegal line:\n%s\n", src);
|
|
||||||
+ free(outbuf);
|
|
||||||
return NULL;
|
|
||||||
break;
|
|
||||||
case SKIP:
|
|
||||||
@@ -260,7 +261,7 @@ size_t length_base64(char* src,size_t ss
|
|
||||||
int l;
|
|
||||||
int left;
|
|
||||||
size_t pos;
|
|
||||||
- unsigned long triple;
|
|
||||||
+ //unsigned long triple;
|
|
||||||
|
|
||||||
error(235, "decode base64\n");
|
|
||||||
/* Exit on empty input */
|
|
||||||
@@ -273,7 +274,7 @@ size_t length_base64(char* src,size_t ss
|
|
||||||
inb = src;
|
|
||||||
|
|
||||||
l = 0;
|
|
||||||
- triple = 0;
|
|
||||||
+ //triple = 0;
|
|
||||||
pos=0;
|
|
||||||
left = ssize;
|
|
||||||
/*
|
|
||||||
@@ -293,7 +294,7 @@ size_t length_base64(char* src,size_t ss
|
|
||||||
case SKIP:
|
|
||||||
break;
|
|
||||||
default:
|
|
||||||
- triple = triple<<6 | (0x3f & i);
|
|
||||||
+ //triple = triple<<6 | (0x3f & i);
|
|
||||||
l++;
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
@@ -302,10 +303,10 @@ size_t length_base64(char* src,size_t ss
|
|
||||||
switch(l)
|
|
||||||
{
|
|
||||||
case 2:
|
|
||||||
- triple = triple>>4;
|
|
||||||
+ //triple = triple>>4;
|
|
||||||
break;
|
|
||||||
case 3:
|
|
||||||
- triple = triple>>2;
|
|
||||||
+ //triple = triple>>2;
|
|
||||||
break;
|
|
||||||
default:
|
|
||||||
break;
|
|
||||||
@@ -314,7 +315,7 @@ size_t length_base64(char* src,size_t ss
|
|
||||||
{
|
|
||||||
pos++;
|
|
||||||
}
|
|
||||||
- triple = 0;
|
|
||||||
+ //triple = 0;
|
|
||||||
l = 0;
|
|
||||||
}
|
|
||||||
inb++;
|
|
||||||
diff -up ./src/be.c.coverity ./src/be.c
|
|
||||||
--- ./src/be.c.coverity 2016-07-25 22:56:55.000000000 +0200
|
|
||||||
+++ ./src/be.c 2018-10-10 19:27:18.681632689 +0200
|
|
||||||
@@ -117,9 +117,9 @@ static char* get_first_value(char** in){
|
|
||||||
|
|
||||||
#endif
|
|
||||||
|
|
||||||
-FILE* be_init(int inout,url_t* u,int iszipped)
|
|
||||||
+void* be_init(int inout,url_t* u,int iszipped)
|
|
||||||
{
|
|
||||||
- FILE* fh=NULL;
|
|
||||||
+ void* fh=NULL;
|
|
||||||
long a=0;
|
|
||||||
char* err=NULL;
|
|
||||||
int fd;
|
|
||||||
diff -up ./src/commandconf.c.coverity ./src/commandconf.c
|
|
||||||
--- ./src/commandconf.c.coverity 2016-07-25 22:56:55.000000000 +0200
|
|
||||||
+++ ./src/commandconf.c 2018-10-10 19:27:18.682632698 +0200
|
|
||||||
@@ -106,7 +106,7 @@ int commandconf(const char mode,const ch
|
|
||||||
rv=0;
|
|
||||||
} else {
|
|
||||||
|
|
||||||
- rv=access(config,R_OK);
|
|
||||||
+ if (config != NULL) rv=access(config,R_OK);
|
|
||||||
if(rv==-1){
|
|
||||||
error(0,_("Cannot access config file: %s: %s\n"),config,strerror(errno));
|
|
||||||
}
|
|
||||||
@@ -166,14 +166,11 @@ int commandconf(const char mode,const ch
|
|
||||||
int conf_input_wrapper(char* buf, int max_size, FILE* in)
|
|
||||||
{
|
|
||||||
int retval=0;
|
|
||||||
- int c=0;
|
|
||||||
- char* tmp=NULL;
|
|
||||||
- void* key=NULL;
|
|
||||||
- int keylen=0;
|
|
||||||
|
|
||||||
/* FIXME Add support for gzipped config. :) */
|
|
||||||
#ifdef WITH_MHASH
|
|
||||||
/* Read a character at a time until we are doing md */
|
|
||||||
+ int c=0;
|
|
||||||
if(conf->do_configmd){
|
|
||||||
retval=fread(buf,1,max_size,in);
|
|
||||||
}else {
|
|
||||||
@@ -185,6 +182,9 @@ int conf_input_wrapper(char* buf, int ma
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#ifdef WITH_MHASH
|
|
||||||
+ char* tmp=NULL;
|
|
||||||
+ void* key=NULL;
|
|
||||||
+ int keylen=0;
|
|
||||||
if(conf->do_configmd||conf->config_check){
|
|
||||||
if(((conf->do_configmd==1)&&conf->config_check)||!conf->confmd){
|
|
||||||
if(conf->do_configmd==1){
|
|
||||||
@@ -276,6 +276,9 @@ int db_input_wrapper(char* buf, int max_
|
|
||||||
#endif
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
+ default: {
|
|
||||||
+ return 0;
|
|
||||||
+ }
|
|
||||||
}
|
|
||||||
|
|
||||||
#ifdef WITH_CURL
|
|
||||||
@@ -651,7 +654,6 @@ int handle_endif(int doit,int allow_else
|
|
||||||
case 0 : {
|
|
||||||
conferror("@@endif or @@else expected");
|
|
||||||
return -1;
|
|
||||||
- count=0;
|
|
||||||
}
|
|
||||||
|
|
||||||
default : {
|
|
||||||
@@ -816,6 +818,7 @@ void do_dbdef(int dbtype,char* val)
|
|
||||||
if(u==NULL||u->type==url_unknown||u->type==url_stdout
|
|
||||||
||u->type==url_stderr) {
|
|
||||||
error(0,_("Unsupported input URL-type:%s\n"),val);
|
|
||||||
+ free(u);
|
|
||||||
}
|
|
||||||
else {
|
|
||||||
*conf_db_url=u;
|
|
||||||
@@ -825,6 +828,7 @@ void do_dbdef(int dbtype,char* val)
|
|
||||||
case DB_WRITE: {
|
|
||||||
if(u==NULL||u->type==url_unknown||u->type==url_stdin){
|
|
||||||
error(0,_("Unsupported output URL-type:%s\n"),val);
|
|
||||||
+ free(u);
|
|
||||||
}
|
|
||||||
else{
|
|
||||||
conf->db_out_url=u;
|
|
||||||
@@ -848,6 +852,7 @@ void do_dbindef(char* val)
|
|
||||||
if(u==NULL||u->type==url_unknown||u->type==url_stdout
|
|
||||||
||u->type==url_stderr) {
|
|
||||||
error(0,_("Unsupported input URL-type:%s\n"),val);
|
|
||||||
+ free(u);
|
|
||||||
}
|
|
||||||
else {
|
|
||||||
conf->db_in_url=u;
|
|
||||||
@@ -869,6 +874,7 @@ void do_dboutdef(char* val)
|
|
||||||
* both input and output urls */
|
|
||||||
if(u==NULL||u->type==url_unknown||u->type==url_stdin){
|
|
||||||
error(0,_("Unsupported output URL-type:%s\n"),val);
|
|
||||||
+ free(u);
|
|
||||||
}
|
|
||||||
else{
|
|
||||||
conf->db_out_url=u;
|
|
||||||
@@ -894,7 +900,8 @@ void do_repurldef(char* val)
|
|
||||||
} else {
|
|
||||||
error_init(u,0);
|
|
||||||
}
|
|
||||||
-
|
|
||||||
+
|
|
||||||
+ free(u);
|
|
||||||
}
|
|
||||||
|
|
||||||
void do_verbdef(char* val)
|
|
||||||
@@ -984,7 +991,7 @@ void do_report_ignore_e2fsattrs(char* va
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
- *val++;
|
|
||||||
+ val++;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
diff -up ./src/compare_db.c.coverity ./src/compare_db.c
|
|
||||||
--- ./src/compare_db.c.coverity 2018-10-10 19:27:18.673632619 +0200
|
|
||||||
+++ ./src/compare_db.c 2018-10-10 19:27:18.682632698 +0200
|
|
||||||
@@ -312,7 +312,7 @@ static int acl2array(acl_type* acl, char
|
|
||||||
if (conf->syslog_format) {
|
|
||||||
*values = malloc(2 * sizeof(char*));
|
|
||||||
|
|
||||||
- char *A, *D = "<NONE>";
|
|
||||||
+ char *A= "<NONE>", *D = "<NONE>";
|
|
||||||
|
|
||||||
if (acl->acl_a) { A = acl->acl_a; }
|
|
||||||
if (acl->acl_d) { D = acl->acl_d; }
|
|
||||||
diff -up ./src/conf_lex.l.coverity ./src/conf_lex.l
|
|
||||||
--- ./src/conf_lex.l.coverity 2018-10-10 19:27:18.673632619 +0200
|
|
||||||
+++ ./src/conf_lex.l 2018-10-10 19:27:18.682632698 +0200
|
|
||||||
@@ -133,7 +133,7 @@ int var_in_conflval=0;
|
|
||||||
<EXPR>[\ \t]*\n {
|
|
||||||
conf_lineno++;
|
|
||||||
return (TNEWLINE);
|
|
||||||
- BEGIN 0;
|
|
||||||
+// BEGIN 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
<EXPR>\+ {
|
|
||||||
diff -up ./src/db.c.coverity ./src/db.c
|
|
||||||
--- ./src/db.c.coverity 2016-07-25 22:56:55.000000000 +0200
|
|
||||||
+++ ./src/db.c 2018-10-10 19:27:18.683632707 +0200
|
|
||||||
@@ -27,6 +27,7 @@
|
|
||||||
#include "db_file.h"
|
|
||||||
#include "db_disk.h"
|
|
||||||
#include "md.h"
|
|
||||||
+#include "fopen.h"
|
|
||||||
|
|
||||||
#ifdef WITH_PSQL
|
|
||||||
#include "db_sql.h"
|
|
||||||
@@ -269,6 +270,9 @@ db_line* db_readline(int db){
|
|
||||||
db_order=&(conf->db_new_order);
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
+ default: {
|
|
||||||
+ return NULL;
|
|
||||||
+ }
|
|
||||||
}
|
|
||||||
|
|
||||||
switch (db_url->type) {
|
|
||||||
@@ -368,7 +372,7 @@ db_line* db_char2line(char** ss,int db){
|
|
||||||
|
|
||||||
int i;
|
|
||||||
db_line* line=(db_line*)malloc(sizeof(db_line)*1);
|
|
||||||
- int* db_osize=0;
|
|
||||||
+ int* db_osize=NULL;
|
|
||||||
DB_FIELD** db_order=NULL;
|
|
||||||
|
|
||||||
switch (db) {
|
|
||||||
@@ -382,6 +386,10 @@ db_line* db_char2line(char** ss,int db){
|
|
||||||
db_order=&(conf->db_new_order);
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
+ default: {
|
|
||||||
+ free(line);
|
|
||||||
+ return NULL;
|
|
||||||
+ }
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
@@ -601,7 +609,9 @@ db_line* db_char2line(char** ss,int db){
|
|
||||||
size_t vsz = 0;
|
|
||||||
|
|
||||||
tval = strtok(NULL, ",");
|
|
||||||
- line->xattrs->ents[num].key = db_readchar(strdup(tval));
|
|
||||||
+ char * tmp = strdup(tval);
|
|
||||||
+ line->xattrs->ents[num].key = db_readchar(tmp);
|
|
||||||
+ free(tmp);
|
|
||||||
tval = strtok(NULL, ",");
|
|
||||||
val = base64tobyte(tval, strlen(tval), &vsz);
|
|
||||||
line->xattrs->ents[num].val = val;
|
|
||||||
@@ -648,6 +658,8 @@ db_line* db_char2line(char** ss,int db){
|
|
||||||
|
|
||||||
default : {
|
|
||||||
error(0,_("Not implemented in db_char2line %i \n"),(*db_order)[i]);
|
|
||||||
+ free_db_line(line);
|
|
||||||
+ free(line);
|
|
||||||
return NULL;
|
|
||||||
}
|
|
||||||
|
|
||||||
@@ -826,7 +838,7 @@ void db_close() {
|
|
||||||
case url_ftp:
|
|
||||||
{
|
|
||||||
if (conf->db_out!=NULL) {
|
|
||||||
- url_fclose(conf->db_out);
|
|
||||||
+ url_fclose((URL_FILE*)conf->db_out);
|
|
||||||
}
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
diff -up ./src/db_disk.c.coverity ./src/db_disk.c
|
|
||||||
--- ./src/db_disk.c.coverity 2016-07-25 22:56:55.000000000 +0200
|
|
||||||
+++ ./src/db_disk.c 2018-10-10 19:28:00.108995089 +0200
|
|
||||||
@@ -79,9 +79,15 @@ static DIR *open_dir(char* path) {
|
|
||||||
|
|
||||||
static void next_in_dir (void)
|
|
||||||
{
|
|
||||||
+
|
|
||||||
#ifdef HAVE_READDIR_R
|
|
||||||
- if (dirh != NULL)
|
|
||||||
+ if (dirh != NULL) {
|
|
||||||
+#pragma GCC diagnostic push
|
|
||||||
+#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
|
|
||||||
rdres = AIDE_READDIR_R_FUNC (dirh, entp, resp);
|
|
||||||
+#pragma GCC diagnostic pop
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
#else
|
|
||||||
#ifdef HAVE_READDIR
|
|
||||||
if (dirh != NULL) {
|
|
||||||
diff -up ./src/db_file.c.coverity ./src/db_file.c
|
|
||||||
--- ./src/db_file.c.coverity 2016-07-25 22:56:55.000000000 +0200
|
|
||||||
+++ ./src/db_file.c 2018-10-10 19:27:18.683632707 +0200
|
|
||||||
@@ -171,7 +171,7 @@ int dofprintf( const char* s,...)
|
|
||||||
int db_file_read_spec(int db){
|
|
||||||
|
|
||||||
int i=0;
|
|
||||||
- int* db_osize=0;
|
|
||||||
+ int* db_osize=NULL;
|
|
||||||
DB_FIELD** db_order=NULL;
|
|
||||||
|
|
||||||
switch (db) {
|
|
||||||
@@ -187,6 +187,9 @@ int db_file_read_spec(int db){
|
|
||||||
db_lineno=&db_new_lineno;
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
+ default: {
|
|
||||||
+ return RETFAIL;
|
|
||||||
+ }
|
|
||||||
}
|
|
||||||
|
|
||||||
*db_order=(DB_FIELD*) malloc(1*sizeof(DB_FIELD));
|
|
||||||
@@ -198,13 +201,10 @@ int db_file_read_spec(int db){
|
|
||||||
int l;
|
|
||||||
|
|
||||||
|
|
||||||
- /* Yes... we do not check if realloc returns nonnull */
|
|
||||||
-
|
|
||||||
- *db_order=(DB_FIELD*)
|
|
||||||
- realloc((void*)*db_order,
|
|
||||||
+ void * tmp = realloc((void*)*db_order,
|
|
||||||
((*db_osize)+1)*sizeof(DB_FIELD));
|
|
||||||
-
|
|
||||||
- if(*db_order==NULL){
|
|
||||||
+ if (tmp != NULL) *db_order=(DB_FIELD*) tmp;
|
|
||||||
+ else {
|
|
||||||
return RETFAIL;
|
|
||||||
}
|
|
||||||
|
|
||||||
@@ -291,8 +291,8 @@ char** db_readline_file(int db){
|
|
||||||
int* domd=NULL;
|
|
||||||
#ifdef WITH_MHASH
|
|
||||||
MHASH* md=NULL;
|
|
||||||
-#endif
|
|
||||||
char** oldmdstr=NULL;
|
|
||||||
+#endif
|
|
||||||
int* db_osize=0;
|
|
||||||
DB_FIELD** db_order=NULL;
|
|
||||||
FILE** db_filep=NULL;
|
|
||||||
@@ -302,9 +302,9 @@ char** db_readline_file(int db){
|
|
||||||
case DB_OLD: {
|
|
||||||
#ifdef WITH_MHASH
|
|
||||||
md=&(conf->dboldmd);
|
|
||||||
+ oldmdstr=&(conf->old_dboldmdstr);
|
|
||||||
#endif
|
|
||||||
domd=&(conf->do_dboldmd);
|
|
||||||
- oldmdstr=&(conf->old_dboldmdstr);
|
|
||||||
|
|
||||||
db_osize=&(conf->db_in_size);
|
|
||||||
db_order=&(conf->db_in_order);
|
|
||||||
@@ -316,9 +316,9 @@ char** db_readline_file(int db){
|
|
||||||
case DB_NEW: {
|
|
||||||
#ifdef WITH_MHASH
|
|
||||||
md=&(conf->dbnewmd);
|
|
||||||
+ oldmdstr=&(conf->old_dbnewmdstr);
|
|
||||||
#endif
|
|
||||||
domd=&(conf->do_dbnewmd);
|
|
||||||
- oldmdstr=&(conf->old_dbnewmdstr);
|
|
||||||
|
|
||||||
db_osize=&(conf->db_new_size);
|
|
||||||
db_order=&(conf->db_new_order);
|
|
||||||
@@ -328,7 +328,9 @@ char** db_readline_file(int db){
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
-
|
|
||||||
+
|
|
||||||
+ if (db_osize == NULL) return NULL;
|
|
||||||
+
|
|
||||||
if (*db_osize==0) {
|
|
||||||
db_buff(db,*db_filep);
|
|
||||||
|
|
||||||
@@ -737,8 +739,6 @@ int db_writespec_file(db_config* dbconf)
|
|
||||||
int i=0;
|
|
||||||
int j=0;
|
|
||||||
int retval=1;
|
|
||||||
- void*key=NULL;
|
|
||||||
- int keylen=0;
|
|
||||||
struct tm* st;
|
|
||||||
time_t tim=time(&tim);
|
|
||||||
st=localtime(&tim);
|
|
||||||
@@ -750,6 +750,8 @@ int db_writespec_file(db_config* dbconf)
|
|
||||||
|
|
||||||
#ifdef WITH_MHASH
|
|
||||||
/* From hereon everything must MD'd before write to db */
|
|
||||||
+ void*key=NULL;
|
|
||||||
+ int keylen=0;
|
|
||||||
if((key=get_db_key())!=NULL){
|
|
||||||
keylen=get_db_key_len();
|
|
||||||
dbconf->do_dbnewmd=1;
|
|
||||||
diff -up ./src/do_md.c.coverity ./src/do_md.c
|
|
||||||
--- ./src/do_md.c.coverity 2016-07-25 22:56:55.000000000 +0200
|
|
||||||
+++ ./src/do_md.c 2018-10-10 19:27:18.683632707 +0200
|
|
||||||
@@ -202,7 +202,6 @@ void calc_md(struct AIDE_STAT_TYPE* old_
|
|
||||||
and we don't read from a pipe :)
|
|
||||||
*/
|
|
||||||
struct AIDE_STAT_TYPE fs;
|
|
||||||
- int sres=0;
|
|
||||||
int stat_diff,filedes;
|
|
||||||
#ifdef WITH_PRELINK
|
|
||||||
pid_t pid;
|
|
||||||
@@ -237,7 +236,7 @@ void calc_md(struct AIDE_STAT_TYPE* old_
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
|
|
||||||
- sres=AIDE_FSTAT_FUNC(filedes,&fs);
|
|
||||||
+ AIDE_FSTAT_FUNC(filedes,&fs);
|
|
||||||
if(!(line->attr&DB_RDEV))
|
|
||||||
fs.st_rdev=0;
|
|
||||||
|
|
||||||
@@ -331,7 +330,7 @@ void calc_md(struct AIDE_STAT_TYPE* old_
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
#endif /* not HAVE_MMAP */
|
|
||||||
- buf=malloc(READ_BLOCK_SIZE);
|
|
||||||
+// buf=malloc(READ_BLOCK_SIZE);
|
|
||||||
#if READ_BLOCK_SIZE>SSIZE_MAX
|
|
||||||
#error "READ_BLOCK_SIZE" is too large. Max value is SSIZE_MAX, and current is READ_BLOCK_SIZE
|
|
||||||
#endif
|
|
||||||
diff -up ./src/gen_list.c.coverity ./src/gen_list.c
|
|
||||||
--- ./src/gen_list.c.coverity 2016-07-25 22:56:55.000000000 +0200
|
|
||||||
+++ ./src/gen_list.c 2018-10-10 19:27:18.684632716 +0200
|
|
||||||
@@ -843,15 +843,15 @@ static void add_file_to_tree(seltree* tr
|
|
||||||
DB_ATTR_TYPE localignorelist=0;
|
|
||||||
DB_ATTR_TYPE ignored_added_attrs, ignored_removed_attrs, ignored_changed_attrs;
|
|
||||||
|
|
||||||
+ if(file==NULL){
|
|
||||||
+ error(0, "add_file_to_tree was called with NULL db_line\n");
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
node=get_seltree_node(tree,file->filename);
|
|
||||||
|
|
||||||
if(!node){
|
|
||||||
node=new_seltree_node(tree,file->filename,0,NULL);
|
|
||||||
}
|
|
||||||
-
|
|
||||||
- if(file==NULL){
|
|
||||||
- error(0, "add_file_to_tree was called with NULL db_line\n");
|
|
||||||
- }
|
|
||||||
|
|
||||||
/* add note to this node which db has modified it */
|
|
||||||
node->checked|=db;
|
|
||||||
diff -up ./src/md.c.coverity ./src/md.c
|
|
||||||
--- ./src/md.c.coverity 2018-10-10 19:27:18.679632672 +0200
|
|
||||||
+++ ./src/md.c 2018-10-10 19:27:18.684632716 +0200
|
|
||||||
@@ -36,8 +36,8 @@
|
|
||||||
*/
|
|
||||||
|
|
||||||
DB_ATTR_TYPE hash_gcrypt2attr(int i) {
|
|
||||||
- DB_ATTR_TYPE r=0;
|
|
||||||
#ifdef WITH_GCRYPT
|
|
||||||
+ DB_ATTR_TYPE r=0;
|
|
||||||
switch (i) {
|
|
||||||
case GCRY_MD_MD5: {
|
|
||||||
r=DB_MD5;
|
|
||||||
@@ -74,13 +74,15 @@ DB_ATTR_TYPE hash_gcrypt2attr(int i) {
|
|
||||||
default:
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
-#endif
|
|
||||||
return r;
|
|
||||||
+#else /* !WITH_GCRYPT */
|
|
||||||
+ return 0;
|
|
||||||
+#endif
|
|
||||||
}
|
|
||||||
|
|
||||||
const char * hash_gcrypt2str(int i) {
|
|
||||||
- char * r = "?";
|
|
||||||
#ifdef WITH_GCRYPT
|
|
||||||
+ char * r = "?";
|
|
||||||
switch (i) {
|
|
||||||
case GCRY_MD_MD5: {
|
|
||||||
r = "MD5";
|
|
||||||
@@ -117,13 +119,17 @@ const char * hash_gcrypt2str(int i) {
|
|
||||||
default:
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
-#endif
|
|
||||||
return r;
|
|
||||||
+#else /* !WITH_GCRYPT */
|
|
||||||
+ return "?";
|
|
||||||
+#endif
|
|
||||||
}
|
|
||||||
|
|
||||||
+#pragma GCC diagnostic push
|
|
||||||
+#pragma GCC diagnostic ignored "-Wunused-parameter"
|
|
||||||
DB_ATTR_TYPE hash_mhash2attr(int i) {
|
|
||||||
- DB_ATTR_TYPE r=0;
|
|
||||||
#ifdef WITH_MHASH
|
|
||||||
+ DB_ATTR_TYPE r=0;
|
|
||||||
switch (i) {
|
|
||||||
case MHASH_CRC32: {
|
|
||||||
r=DB_CRC32;
|
|
||||||
@@ -198,10 +204,15 @@ DB_ATTR_TYPE hash_mhash2attr(int i) {
|
|
||||||
default:
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
-#endif
|
|
||||||
+
|
|
||||||
return r;
|
|
||||||
+#else /*!WITH_MHASH */
|
|
||||||
+ return 0;
|
|
||||||
+#endif
|
|
||||||
}
|
|
||||||
|
|
||||||
+#pragma GCC diagnostic pop
|
|
||||||
+
|
|
||||||
/*
|
|
||||||
Initialise md_container according it's todo_attr field
|
|
||||||
*/
|
|
||||||
@@ -317,7 +328,6 @@ int init_md(struct md_container* md) {
|
|
||||||
*/
|
|
||||||
|
|
||||||
int update_md(struct md_container* md,void* data,ssize_t size) {
|
|
||||||
- int i;
|
|
||||||
|
|
||||||
error(255,"update_md called\n");
|
|
||||||
|
|
||||||
@@ -328,6 +338,7 @@ int update_md(struct md_container* md,vo
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#ifdef WITH_MHASH
|
|
||||||
+ int i;
|
|
||||||
|
|
||||||
for(i=0;i<=HASH_MHASH_COUNT;i++) {
|
|
||||||
if (md->mhash_mdh[i]!=MHASH_FAILED) {
|
|
||||||
@@ -348,7 +359,6 @@ int update_md(struct md_container* md,vo
|
|
||||||
*/
|
|
||||||
|
|
||||||
int close_md(struct md_container* md) {
|
|
||||||
- int i;
|
|
||||||
#ifdef _PARAMETER_CHECK_
|
|
||||||
if (md==NULL) {
|
|
||||||
return RETFAIL;
|
|
||||||
@@ -356,6 +366,7 @@ int close_md(struct md_container* md) {
|
|
||||||
#endif
|
|
||||||
error(255,"close_md called \n");
|
|
||||||
#ifdef WITH_MHASH
|
|
||||||
+ int i;
|
|
||||||
for(i=0;i<=HASH_MHASH_COUNT;i++) {
|
|
||||||
if (md->mhash_mdh[i]!=MHASH_FAILED) {
|
|
||||||
mhash (md->mhash_mdh[i], NULL, 0);
|
|
||||||
diff -up ./src/util.c.coverity ./src/util.c
|
|
||||||
--- ./src/util.c.coverity 2018-10-10 19:27:18.670632593 +0200
|
|
||||||
+++ ./src/util.c 2018-10-10 19:27:18.684632716 +0200
|
|
||||||
@@ -105,13 +105,15 @@ url_t* parse_url(char* val)
|
|
||||||
for(i=0;r[0]!='/'&&r[0]!='\0';r++,i++);
|
|
||||||
if(r[0]=='\0'){
|
|
||||||
error(0,"Invalid file-URL,no path after hostname: file:%s\n",t);
|
|
||||||
+ free(hostname);
|
|
||||||
return NULL;
|
|
||||||
}
|
|
||||||
u->value=strdup(r);
|
|
||||||
r[0]='\0';
|
|
||||||
if(gethostname(hostname,MAXHOSTNAMELEN)==-1){
|
|
||||||
- strncpy(hostname,"localhost", 10);
|
|
||||||
+ strncpy(hostname,"localhost", 10);
|
|
||||||
}
|
|
||||||
+
|
|
||||||
if( (strcmp(t,"localhost")==0)||(strcmp(t,hostname)==0)){
|
|
||||||
free(hostname);
|
|
||||||
break;
|
|
||||||
@@ -120,7 +122,7 @@ url_t* parse_url(char* val)
|
|
||||||
free(hostname);
|
|
||||||
return NULL;
|
|
||||||
}
|
|
||||||
- free(hostname);
|
|
||||||
+
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
u->value=strdup(r);
|
|
||||||
@ -0,0 +1,487 @@
|
|||||||
|
diff -up ./configure.ac.gnutls ./configure.ac
|
||||||
|
--- ./configure.ac.gnutls 2023-06-13 20:53:43.000000000 +0200
|
||||||
|
+++ ./configure.ac 2024-05-14 19:09:47.419448389 +0200
|
||||||
|
@@ -350,6 +350,10 @@ AC_MSG_CHECKING(for Mhash)
|
||||||
|
AC_ARG_WITH([mhash], AS_HELP_STRING([--with-mhash], [use Mhash (default: check)]), [with_mhash=$withval], [with_mhash=check])
|
||||||
|
AC_MSG_RESULT([$with_mhash])
|
||||||
|
|
||||||
|
+AC_MSG_CHECKING(for GnuTLS)
|
||||||
|
+AC_ARG_WITH([gnutls], AS_HELP_STRING([--with-gnutls], [use GnuTLS library (default: check)]), [with_gnutls=$withval], [with_gnutls=check])
|
||||||
|
+AC_MSG_RESULT([$with_gnutls])
|
||||||
|
+
|
||||||
|
AC_MSG_CHECKING(for GNU crypto library)
|
||||||
|
AC_ARG_WITH([gcrypt], AS_HELP_STRING([--with-gcrypt], [use GNU crypto library (default: check)]), [with_gcrypt=$withval], [with_gcrypt=check])
|
||||||
|
AC_MSG_RESULT([$with_gcrypt])
|
||||||
|
@@ -363,19 +367,29 @@ AS_IF([test x"$with_mhash" = xyes], [
|
||||||
|
)],AC_DEFINE(HAVE_MHASH_WHIRLPOOL,1,[mhash has whirlpool]))
|
||||||
|
AS_IF([test x"$with_gcrypt" = xcheck], [
|
||||||
|
with_gcrypt=no
|
||||||
|
+ with_gnutls=no
|
||||||
|
])
|
||||||
|
])
|
||||||
|
AIDE_PKG_CHECK_MODULES_OPTIONAL(gcrypt, GCRYPT, libgcrypt)
|
||||||
|
+AIDE_PKG_CHECK_MODULES_OPTIONAL(gnutls, GNUTLS, gnutls)
|
||||||
|
AS_IF([test x"$with_mhash" != xno && test x"$with_gcrypt" != xno], [
|
||||||
|
AC_MSG_ERROR([Using gcrypt together with mhash makes no sense. To disable mhash use --without-mhash])
|
||||||
|
])
|
||||||
|
-AS_IF([test x"$with_mhash" = xno && test x"$with_gcrypt" = xno], [
|
||||||
|
- AC_MSG_ERROR([AIDE requires mhash or libcrypt for hashsum calculation])
|
||||||
|
+AS_IF([test x"$with_mhash" != xno && test x"$with_gnutls" != xno], [
|
||||||
|
+ AC_MSG_ERROR([Using gnutls together with mhash makes no sense. To disable mhash use --without-mhash])
|
||||||
|
+])
|
||||||
|
+AS_IF([test x"$with_gcrypt" != xno && test x"$with_gnutls" != xno], [
|
||||||
|
+ AC_MSG_ERROR([Using gnutls together with gcrypt makes no sense. To disable gcrypt use --without-gcrypt])
|
||||||
|
+])
|
||||||
|
+AS_IF([test x"$with_mhash" = xno && test x"$with_gcrypt" = xno && test x"$with_gnutls" == xno], [
|
||||||
|
+ AC_MSG_ERROR([AIDE requires mhash, gnutls or libcrypt for hashsum calculation])
|
||||||
|
])
|
||||||
|
compoptionstring="${compoptionstring}use Mhash: $with_mhash\\n"
|
||||||
|
AM_CONDITIONAL(HAVE_MHASH, [test "x$MHASH_LIBS" != "x"])
|
||||||
|
compoptionstring="${compoptionstring}use GNU crypto library: $with_gcrypt\\n"
|
||||||
|
AM_CONDITIONAL(HAVE_GCRYPT, [test "x$GCRYPT_LIBS" != "x"])
|
||||||
|
+compoptionstring="${compoptionstring}use GnuTLS: $with_gnutls\\n"
|
||||||
|
+AM_CONDITIONAL(HAVE_GNUTLS, [test "x$GNUTLS_LIBS" != "x"])
|
||||||
|
|
||||||
|
AIDE_PKG_CHECK(audit, Linux Auditing Framework, no, AUDIT, audit)
|
||||||
|
|
||||||
|
diff -up ./doc/aide.conf.5.gnutls ./doc/aide.conf.5
|
||||||
|
--- ./doc/aide.conf.5.gnutls 2023-08-01 10:47:59.000000000 +0200
|
||||||
|
+++ ./doc/aide.conf.5 2024-05-14 19:09:47.420448380 +0200
|
||||||
|
@@ -866,6 +866,7 @@ haval256 checksum
|
||||||
|
.TP
|
||||||
|
.B "crc32"
|
||||||
|
crc32 checksum
|
||||||
|
+(\fIlibmhash\fR and \fIlibgcrypt\fR only)
|
||||||
|
.TP
|
||||||
|
.B "crc32b"
|
||||||
|
crc32 checksum
|
||||||
|
@@ -876,14 +877,15 @@ GOST R 34.11-94 checksum
|
||||||
|
.TP
|
||||||
|
.B "whirlpool"
|
||||||
|
whirlpool checksum
|
||||||
|
+(\fIlibgcrypt\fR and \fIlibmhash\fRonly)
|
||||||
|
.TP
|
||||||
|
.B "stribog256"
|
||||||
|
GOST R 34.11-2012, 256 bit checksum
|
||||||
|
-(\fIlibgcrypt\fR only, added in AIDE v0.17)
|
||||||
|
+(\fIlibgcrypt\fR and \fIgnutls\fR only, added in AIDE v0.17)
|
||||||
|
.TP
|
||||||
|
.B "stribog512"
|
||||||
|
GOST R 34.11-2012, 512 bit checksum
|
||||||
|
-(\fIlibgcrypt\fR only, added in AIDE v0.17)
|
||||||
|
+(\fIlibgcrypt\fR and \fIgnutls\fR only, added in AIDE v0.17)
|
||||||
|
.PP
|
||||||
|
|
||||||
|
Use 'aide --version' to show which hashsums are available.
|
||||||
|
diff -up ./include/md.h.gnutls ./include/md.h
|
||||||
|
--- ./include/md.h.gnutls 2023-04-01 18:25:38.000000000 +0200
|
||||||
|
+++ ./include/md.h 2024-05-14 19:09:47.420448380 +0200
|
||||||
|
@@ -29,6 +29,10 @@
|
||||||
|
#ifdef WITH_GCRYPT
|
||||||
|
#include <gcrypt.h>
|
||||||
|
#endif
|
||||||
|
+#ifdef WITH_GNUTLS
|
||||||
|
+#include <gnutls/gnutls.h>
|
||||||
|
+#include <gnutls/crypto.h>
|
||||||
|
+#endif
|
||||||
|
#include <sys/types.h>
|
||||||
|
#include "attributes.h"
|
||||||
|
#include "hashsum.h"
|
||||||
|
@@ -61,6 +65,10 @@ typedef struct md_container {
|
||||||
|
gcry_md_hd_t mdh;
|
||||||
|
#endif
|
||||||
|
|
||||||
|
+#ifdef WITH_GNUTLS
|
||||||
|
+ gnutls_hash_hd_t gnutls_mdh[num_hashes];
|
||||||
|
+#endif
|
||||||
|
+
|
||||||
|
} md_container;
|
||||||
|
|
||||||
|
typedef struct md_hashsums {
|
||||||
|
diff -up ./Makefile.am.gnutls ./Makefile.am
|
||||||
|
--- ./Makefile.am.gnutls 2024-05-14 19:09:47.420448380 +0200
|
||||||
|
+++ ./Makefile.am 2024-05-14 19:23:09.347757387 +0200
|
||||||
|
@@ -64,17 +64,35 @@ if HAVE_CURL
|
||||||
|
aide_SOURCES += include/fopen.h src/fopen.c
|
||||||
|
endif
|
||||||
|
|
||||||
|
-aide_CFLAGS = @AIDE_DEFS@ -W -Wall -g ${PTHREAD_CFLAGS}
|
||||||
|
-aide_LDADD = -lm ${PCRE2_LIBS} ${ZLIB_LIBS} ${MHASH_LIBS} ${GCRYPT_LIBS} ${POSIX_ACL_LIBS} ${SELINUX_LIBS} ${AUDIT_LIBS} ${XATTR_LIBS} ${ELF_LIBS} ${E2FSATTRS_LIBS} ${CAPABILITIES_LIBS} ${CURL_LIBS} ${PTHREAD_LIBS}
|
||||||
|
+aide_CFLAGS = @AIDE_DEFS@ -W -Wall -g ${PTHREAD_CFLAGS} ${GNUTLS_CFLAGS}
|
||||||
|
+aide_LDADD = -lm ${PCRE2_LIBS} ${ZLIB_LIBS} ${MHASH_LIBS} ${GNUTLS_LIBS} ${GCRYPT_LIBS} ${POSIX_ACL_LIBS} ${SELINUX_LIBS} ${AUDIT_LIBS} ${XATTR_LIBS} ${ELF_LIBS} ${E2FSATTRS_LIBS} ${CAPABILITIES_LIBS} ${CURL_LIBS} ${PTHREAD_LIBS}
|
||||||
|
|
||||||
|
if HAVE_CHECK
|
||||||
|
-TESTS = check_aide
|
||||||
|
-check_PROGRAMS = check_aide
|
||||||
|
+TESTS = check_aide check_md
|
||||||
|
+check_PROGRAMS = check_aide check_md
|
||||||
|
check_aide_SOURCES = tests/check_aide.c tests/check_aide.h \
|
||||||
|
tests/check_attributes.c src/attributes.c \
|
||||||
|
src/log.c src/util.c
|
||||||
|
-check_aide_CFLAGS = -I$(top_srcdir)/include $(CHECK_CFLAGS)
|
||||||
|
-check_aide_LDADD = -lm ${PCRE2_LIBS} ${MHASH_LIBS} ${GCRYPT_LIBS} $(CHECK_LIBS)
|
||||||
|
+check_aide_CFLAGS = -I$(top_srcdir)/include $(CHECK_CFLAGS) ${GNUTLS_CFLAGS}
|
||||||
|
+check_aide_LDADD = -lm ${PCRE2_LIBS} ${MHASH_LIBS} ${GCRYPT_LIBS} $(CHECK_LIBS) ${GNUTLS_LIBS}
|
||||||
|
+
|
||||||
|
+check_md_SOURCES = tests/check_md.c tests/check_md.h \
|
||||||
|
+ tests/check_hashes.c \
|
||||||
|
+ src/log.c src/util.c src/md.c src/base64.c src/hashsum.c src/attributes.c
|
||||||
|
+
|
||||||
|
+check_md_CFLAGS = -I$(top_srcdir)/include \
|
||||||
|
+ $(CHECK_CFLAGS) \
|
||||||
|
+ $(GCRYPT_CFLAGS) \
|
||||||
|
+ $(GNUTLS_CFLAGS) \
|
||||||
|
+ $(MHASH_CFLAGS) \
|
||||||
|
+ $(PCRE2_CFLAGS)
|
||||||
|
+check_md_LDADD = -lm \
|
||||||
|
+ $(CHECK_LIBS) \
|
||||||
|
+ ${GCRYPT_LIBS} \
|
||||||
|
+ ${GNUTLS_LIBS} \
|
||||||
|
+ ${MHASH_LIBS} \
|
||||||
|
+ ${PCRE2_LIBS}
|
||||||
|
+
|
||||||
|
endif # HAVE_CHECK
|
||||||
|
|
||||||
|
AM_CFLAGS = @AIDE_DEFS@ -W -Wall -g
|
||||||
|
diff -up ./README.gnutls ./README
|
||||||
|
--- ./README.gnutls 2023-08-01 10:47:59.000000000 +0200
|
||||||
|
+++ ./README 2024-05-14 19:09:47.419448389 +0200
|
||||||
|
@@ -132,11 +132,15 @@
|
||||||
|
o GNU make.
|
||||||
|
o pkg-config
|
||||||
|
o PCRE2 library
|
||||||
|
- o Mhash (optional, but highly recommended). Mhash is currently
|
||||||
|
- available from http://mhash.sourceforge.net/. A static version of
|
||||||
|
- libmhash needs to be build using the --enable-static=yes
|
||||||
|
- configure option.
|
||||||
|
+
|
||||||
|
+ One of the following crypto libraries:
|
||||||
|
+
|
||||||
|
+ o Mhash. Mhash is currently available from
|
||||||
|
+ http://mhash.sourceforge.net/. A static version of libmhash needs
|
||||||
|
+ to be build using the --enable-static=yes configure option.
|
||||||
|
Aide requires at least mhash version 0.9.2
|
||||||
|
+ o GNU libgcrypt
|
||||||
|
+ o GnuTLS
|
||||||
|
|
||||||
|
o libcheck (optional, needed for 'make check', license: LGPL-2.1)
|
||||||
|
|
||||||
|
diff -up ./src/aide.c.gnutls ./src/aide.c
|
||||||
|
--- ./src/aide.c.gnutls 2023-06-13 20:52:39.000000000 +0200
|
||||||
|
+++ ./src/aide.c 2024-05-14 19:09:47.420448380 +0200
|
||||||
|
@@ -66,6 +66,9 @@ char* after = NULL;
|
||||||
|
#include <gcrypt.h>
|
||||||
|
#define NEED_LIBGCRYPT_VERSION "1.8.0"
|
||||||
|
#endif
|
||||||
|
+#ifdef WITH_GNUTLS
|
||||||
|
+#include <gnutls/gnutls.h>
|
||||||
|
+#endif
|
||||||
|
|
||||||
|
static void usage(int exitvalue)
|
||||||
|
{
|
||||||
|
@@ -522,9 +525,6 @@ static void setdefaults_before_config()
|
||||||
|
DB_ATTR_TYPE common_attrs = ATTR(attr_perm)|ATTR(attr_ftype)|ATTR(attr_inode)|ATTR(attr_linkcount)|ATTR(attr_uid)|ATTR(attr_gid);
|
||||||
|
|
||||||
|
DB_ATTR_TYPE GROUP_R_HASHES=0LLU;
|
||||||
|
-#ifdef WITH_MHASH
|
||||||
|
- GROUP_R_HASHES=ATTR(attr_md5);
|
||||||
|
-#endif
|
||||||
|
#ifdef WITH_GCRYPT
|
||||||
|
if (gcry_fips_mode_active()) {
|
||||||
|
char* str;
|
||||||
|
@@ -533,6 +533,8 @@ static void setdefaults_before_config()
|
||||||
|
} else {
|
||||||
|
GROUP_R_HASHES = ATTR(attr_md5);
|
||||||
|
}
|
||||||
|
+#else /* WITH_MHASH or WITH_GNUTLS */
|
||||||
|
+ GROUP_R_HASHES=ATTR(attr_md5);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
log_msg(LOG_LEVEL_INFO, "define default groups definitions");
|
||||||
|
diff -up ./src/hashsum.c.gnutls ./src/hashsum.c
|
||||||
|
--- ./src/hashsum.c.gnutls 2023-04-01 18:25:38.000000000 +0200
|
||||||
|
+++ ./src/hashsum.c 2024-05-14 19:09:47.420448380 +0200
|
||||||
|
@@ -29,6 +29,9 @@
|
||||||
|
#ifdef WITH_GCRYPT
|
||||||
|
#include <gcrypt.h>
|
||||||
|
#endif
|
||||||
|
+#ifdef WITH_GNUTLS
|
||||||
|
+#include <gnutls/gnutls.h>
|
||||||
|
+#endif
|
||||||
|
|
||||||
|
hashsum_t hashsums[] = {
|
||||||
|
{ attr_md5, 16 },
|
||||||
|
@@ -86,6 +89,24 @@ int algorithms[] = { /* order must match
|
||||||
|
};
|
||||||
|
#endif
|
||||||
|
|
||||||
|
+#ifdef WITH_GNUTLS
|
||||||
|
+int algorithms[] = { /* order must match hashsums array */
|
||||||
|
+ GNUTLS_DIG_MD5,
|
||||||
|
+ GNUTLS_DIG_SHA1,
|
||||||
|
+ GNUTLS_DIG_SHA256,
|
||||||
|
+ GNUTLS_DIG_SHA512,
|
||||||
|
+ GNUTLS_DIG_RMD160,
|
||||||
|
+ -1, /* TIGER is not available */
|
||||||
|
+ -1, /* CRC32 is not available */
|
||||||
|
+ -1, /* CRC32B is not available */
|
||||||
|
+ -1, /* GCRY_MD_HAVAL is not available */
|
||||||
|
+ -1, /* WHIRLPOOL is not available */
|
||||||
|
+ -1, /* GNUTLS_DIG_GOSTR_94 gives different results than Gcrypt */
|
||||||
|
+ GNUTLS_DIG_STREEBOG_256,
|
||||||
|
+ GNUTLS_DIG_STREEBOG_512,
|
||||||
|
+};
|
||||||
|
+#endif
|
||||||
|
+
|
||||||
|
DB_ATTR_TYPE get_hashes(bool include_unsupported) {
|
||||||
|
DB_ATTR_TYPE attr = 0LLU;
|
||||||
|
for (int i = 0; i < num_hashes; ++i) {
|
||||||
|
diff -up ./src/md.c.gnutls ./src/md.c
|
||||||
|
--- ./src/md.c.gnutls 2023-04-01 18:25:38.000000000 +0200
|
||||||
|
+++ ./src/md.c 2024-05-14 19:28:09.651209390 +0200
|
||||||
|
@@ -40,6 +40,11 @@
|
||||||
|
#include <gcrypt.h>
|
||||||
|
#endif
|
||||||
|
|
||||||
|
+#ifdef WITH_GNUTLS
|
||||||
|
+#include <gnutls/gnutls.h>
|
||||||
|
+#include <gnutls/crypto.h>
|
||||||
|
+#endif
|
||||||
|
+
|
||||||
|
/*
|
||||||
|
Initialise md_container according its todo_attr field
|
||||||
|
*/
|
||||||
|
@@ -90,6 +95,22 @@ int init_md(struct md_container* md, con
|
||||||
|
}
|
||||||
|
}
|
||||||
|
#endif
|
||||||
|
+#ifdef WITH_GNUTLS
|
||||||
|
+ for (HASHSUM i = 0 ; i < num_hashes ; ++i) {
|
||||||
|
+ DB_ATTR_TYPE h = ATTR(hashsums[i].attribute);
|
||||||
|
+ if (h&md->todo_attr) {
|
||||||
|
+ if(gnutls_hash_init(&(md->gnutls_mdh[i]),algorithms[i])>=0){
|
||||||
|
+ md->calc_attr|=h;
|
||||||
|
+ } else {
|
||||||
|
+ log_msg(LOG_LEVEL_WARNING,"%s: gnutls_hash_init (%s) failed for '%s'", filename, attributes[hashsums[i].attribute].db_name, filename);
|
||||||
|
+ md->todo_attr&=~h;
|
||||||
|
+ md->gnutls_mdh[i] = NULL;
|
||||||
|
+ }
|
||||||
|
+ } else {
|
||||||
|
+ md->gnutls_mdh[i] = NULL;
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+#endif
|
||||||
|
char *str;
|
||||||
|
log_msg(LOG_LEVEL_DEBUG, "%s> initialized md_container: %s (%p)", filename, str = diff_attributes(0, md->calc_attr), md);
|
||||||
|
free(str);
|
||||||
|
@@ -120,6 +141,13 @@ int update_md(struct md_container* md,vo
|
||||||
|
#ifdef WITH_GCRYPT
|
||||||
|
gcry_md_write(md->mdh, data, size);
|
||||||
|
#endif
|
||||||
|
+#ifdef WITH_GNUTLS
|
||||||
|
+ for (HASHSUM i = 0 ; i < num_hashes ; ++i) {
|
||||||
|
+ if(md->gnutls_mdh[i] != NULL){
|
||||||
|
+ gnutls_hash(md->gnutls_mdh[i], data, size);
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+#endif
|
||||||
|
return RETOK;
|
||||||
|
}
|
||||||
|
|
||||||
|
@@ -163,6 +191,14 @@ int close_md(struct md_container* md, md
|
||||||
|
}
|
||||||
|
}
|
||||||
|
#endif
|
||||||
|
+#ifdef WITH_GNUTLS
|
||||||
|
+ for (HASHSUM i = 0 ; i < num_hashes ; ++i) {
|
||||||
|
+ if(md->gnutls_mdh[i] != NULL){
|
||||||
|
+ gnutls_hash_deinit(md->gnutls_mdh[i], hs?hs->hashsums[i]:NULL);
|
||||||
|
+ md->gnutls_mdh[i] = NULL;
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+#endif /* WITH_MHASH */
|
||||||
|
if (hs) {
|
||||||
|
hs->attrs = md->calc_attr;
|
||||||
|
}
|
||||||
|
diff -up ./tests/check_hashes.c.gnutls ./tests/check_hashes.c
|
||||||
|
--- ./tests/check_hashes.c.gnutls 2024-05-14 19:09:47.420448380 +0200
|
||||||
|
+++ ./tests/check_hashes.c 2024-05-14 19:09:47.420448380 +0200
|
||||||
|
@@ -0,0 +1,111 @@
|
||||||
|
+/*
|
||||||
|
+ * AIDE (Advanced Intrusion Detection Environment)
|
||||||
|
+ *
|
||||||
|
+ * Copyright (C) 2024 Jakub Jelen
|
||||||
|
+ *
|
||||||
|
+ * This program is free software; you can redistribute it and/or
|
||||||
|
+ * modify it under the terms of the GNU General Public License as
|
||||||
|
+ * published by the Free Software Foundation; either version 2 of the
|
||||||
|
+ * License, or (at your option) any later version.
|
||||||
|
+ *
|
||||||
|
+ * This program is distributed in the hope that it will be useful, but
|
||||||
|
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||||
|
+ * General Public License for more details.
|
||||||
|
+ *
|
||||||
|
+ * You should have received a copy of the GNU General Public License along
|
||||||
|
+ * with this program; if not, write to the Free Software Foundation, Inc.,
|
||||||
|
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||||
|
+ */
|
||||||
|
+
|
||||||
|
+#include "config.h"
|
||||||
|
+
|
||||||
|
+#include <check.h>
|
||||||
|
+#include <stdlib.h>
|
||||||
|
+
|
||||||
|
+#include "hashsum.h"
|
||||||
|
+#include "md.h"
|
||||||
|
+
|
||||||
|
+typedef struct {
|
||||||
|
+ const char *input;
|
||||||
|
+ ssize_t input_len;
|
||||||
|
+ md_hashsums expected;
|
||||||
|
+} diff_digests_t;
|
||||||
|
+
|
||||||
|
+static diff_digests_t diff_digests_tests[] = {
|
||||||
|
+ { "", 0, {{
|
||||||
|
+ "\xd4\x1d\x8c\xd9\x8f\x00\xb2\x04\xe9\x80\x09\x98\xec\xf8\x42\x7e",
|
||||||
|
+ "\xda\x39\xa3\xee\x5e\x6b\x4b\x0d\x32\x55\xbf\xef\x95\x60\x18\x90\xaf\xd8\x07\x09",
|
||||||
|
+ "\xe3\xb0\xc4\x42\x98\xfc\x1c\x14\x9a\xfb\xf4\xc8\x99\x6f\xb9\x24\x27\xae\x41\xe4\x64\x9b\x93\x4c\xa4\x95\x99\x1b\x78\x52\xb8\x55",
|
||||||
|
+ "\xcf\x83\xe1\x35\x7e\xef\xb8\xbd\xf1\x54\x28\x50\xd6\x6d\x80\x07\xd6\x20\xe4\x05\x0b\x57\x15\xdc\x83\xf4\xa9\x21\xd3\x6c\xe9\xce\x47\xd0\xd1\x3c\x5d\x85\xf2\xb0\xff\x83\x18\xd2\x87\x7e\xec\x2f\x63\xb9\x31\xbd\x47\x41\x7a\x81\xa5\x38\x32\x7a\xf9\x27\xda\x3e",
|
||||||
|
+ "\x9c\x11\x85\xa5\xc5\xe9\xfc\x54\x61\x28\x08\x97\x7e\xe8\xf5\x48\xb2\x25\x8d\x31",
|
||||||
|
+ "\x24\xf0\x13\x0c\x63\xac\x93\x32\x16\x16\x6e\x76\xb1\xbb\x92\x5f\xf3\x73\xde\x2d\x49\x58\x4e\x7a",
|
||||||
|
+ "\x00\x00\x00\x00",
|
||||||
|
+ "\x00\x00\x00\x00",
|
||||||
|
+ "\x4f\x69\x38\x53\x1f\x0b\xc8\x99\x1f\x62\xda\x7b\xbd\x6f\x7d\xe3\xfa\xd4\x45\x62\xb8\xc6\xf4\xeb\xf1\x46\xd5\xb4\xe4\x6f\x7c\x17",
|
||||||
|
+ "\x19\xfa\x61\xd7\x55\x22\xa4\x66\x9b\x44\xe3\x9c\x1d\x2e\x17\x26\xc5\x30\x23\x21\x30\xd4\x07\xf8\x9a\xfe\xe0\x96\x49\x97\xf7\xa7\x3e\x83\xbe\x69\x8b\x28\x8f\xeb\xcf\x88\xe3\xe0\x3c\x4f\x07\x57\xea\x89\x64\xe5\x9b\x63\xd9\x37\x08\xb1\x38\xcc\x42\xa6\x6e\xb3",
|
||||||
|
+ "\xce\x85\xb9\x9c\xc4\x67\x52\xff\xfe\xe3\x5c\xab\x9a\x7b\x02\x78\xab\xb4\xc2\xd2\x05\x5c\xff\x68\x5a\xf4\x91\x2c\x49\x49\x0f\x8d",
|
||||||
|
+ "\x3f\x53\x9a\x21\x3e\x97\xc8\x02\xcc\x22\x9d\x47\x4c\x6a\xa3\x2a\x82\x5a\x36\x0b\x2a\x93\x3a\x94\x9f\xd9\x25\x20\x8d\x9c\xe1\xbb",
|
||||||
|
+ "\x8e\x94\x5d\xa2\x09\xaa\x86\x9f\x04\x55\x92\x85\x29\xbc\xae\x46\x79\xe9\x87\x3a\xb7\x07\xb5\x53\x15\xf5\x6c\xeb\x98\xbe\xf0\xa7\x36\x2f\x71\x55\x28\x35\x6e\xe8\x3c\xda\x5f\x2a\xac\x4c\x6a\xd2\xba\x3a\x71\x5c\x1b\xcd\x81\xcb\x8e\x9f\x90\xbf\x4c\x1c\x1a\x8a" }
|
||||||
|
+ }},
|
||||||
|
+ { "hello", 5, {{
|
||||||
|
+ "\x5d\x41\x40\x2a\xbc\x4b\x2a\x76\xb9\x71\x9d\x91\x10\x17\xc5\x92",
|
||||||
|
+ "\xaa\xf4\xc6\x1d\xdc\xc5\xe8\xa2\xda\xbe\xde\x0f\x3b\x48\x2c\xd9\xae\xa9\x43\x4d",
|
||||||
|
+ "\x2c\xf2\x4d\xba\x5f\xb0\xa3\x0e\x26\xe8\x3b\x2a\xc5\xb9\xe2\x9e\x1b\x16\x1e\x5c\x1f\xa7\x42\x5e\x73\x04\x33\x62\x93\x8b\x98\x24",
|
||||||
|
+ "\x9b\x71\xd2\x24\xbd\x62\xf3\x78\x5d\x96\xd4\x6a\xd3\xea\x3d\x73\x31\x9b\xfb\xc2\x89\x0c\xaa\xda\xe2\xdf\xf7\x25\x19\x67\x3c\xa7\x23\x23\xc3\xd9\x9b\xa5\xc1\x1d\x7c\x7a\xcc\x6e\x14\xb8\xc5\xda\x0c\x46\x63\x47\x5c\x2e\x5c\x3a\xde\xf4\x6f\x73\xbc\xde\xc0\x43",
|
||||||
|
+ "\x10\x8f\x07\xb8\x38\x24\x12\x61\x2c\x04\x8d\x07\xd1\x3f\x81\x41\x18\x44\x5a\xcd",
|
||||||
|
+ "\xa7\x88\x62\x33\x6f\x7f\xfd\x2c\x8a\x38\x74\xf8\x9b\x1b\x74\xf2\xf2\x7b\xdb\xca\x39\x66\x02\x54",
|
||||||
|
+#ifdef WITH_MHASH
|
||||||
|
+ "\x3d\x65\x31\x19",
|
||||||
|
+#else
|
||||||
|
+ "\x36\x10\xa6\x86",
|
||||||
|
+#endif
|
||||||
|
+ "\x86\xa6\x10\x36",
|
||||||
|
+ "\x26\x71\x8e\x4f\xb0\x55\x95\xcb\x87\x03\xa6\x72\xa8\xae\x91\xee\xa0\x71\xca\xc5\xe7\x42\x61\x73\xd4\xc2\x5a\x61\x1c\x4b\x80\x22",
|
||||||
|
+ "\x0a\x25\xf5\x5d\x73\x08\xec\xa6\xb9\x56\x7a\x7e\xd3\xbd\x1b\x46\x32\x7f\x0f\x1f\xfd\xc8\x04\xdd\x8b\xb5\xaf\x40\xe8\x8d\x78\xb8\x8d\xf0\xd0\x02\xa8\x9e\x2f\xdb\xd5\x87\x6c\x52\x3f\x1b\x67\xbc\x44\xe9\xf8\x70\x47\x59\x8e\x75\x48\x29\x8e\xa1\xc8\x1c\xfd\x73",
|
||||||
|
+ "\xa7\xeb\x5d\x08\xdd\xf2\x36\x3f\x1e\xa0\x31\x7a\x80\x3f\xce\xf8\x1d\x33\x86\x3c\x8b\x2f\x9f\x6d\x7d\x14\x95\x1d\x22\x9f\x45\x67",
|
||||||
|
+ "\x3f\xb0\x70\x0a\x41\xce\x6e\x41\x41\x3b\xa7\x64\xf9\x8b\xf2\x13\x5b\xa6\xde\xd5\x16\xbe\xa2\xfa\xe8\x42\x9c\xc5\xbd\xd4\x6d\x6d",
|
||||||
|
+ "\x8d\xf4\x14\x26\x09\x66\xbe\xb7\xb3\x4d\x92\x07\x63\x07\x9e\x15\xdf\x1f\x63\x29\x7e\xb3\xdd\x43\x11\xe8\xb5\x85\xd4\xbf\x2f\x59\x23\x21\x4f\x1d\xfe\xd3\xfd\xee\x4a\xaf\x01\x83\x30\xa1\x2a\xcd\xe0\xef\xcc\x33\x8e\xb5\x29\x22\xf3\xe5\x71\x21\x2d\x42\xc8\xde" }
|
||||||
|
+ }},
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+static int num_diff_digests_tests = sizeof diff_digests_tests / sizeof(diff_digests_t);
|
||||||
|
+
|
||||||
|
+START_TEST (test_diff_digests) {
|
||||||
|
+ const char *filename = "filename"; /* used only in the debug logs */
|
||||||
|
+ md_hashsums hs = {0};
|
||||||
|
+ struct md_container *mdc = calloc(1, sizeof(struct md_container));
|
||||||
|
+ mdc->todo_attr = get_hashes(false);
|
||||||
|
+
|
||||||
|
+#ifdef WITH_GCRYPT
|
||||||
|
+ gcry_control(GCRYCTL_DISABLE_SECMEM, 0);
|
||||||
|
+ gcry_control(GCRYCTL_INITIALIZATION_FINISHED, 0);
|
||||||
|
+#endif
|
||||||
|
+
|
||||||
|
+ init_md(mdc, filename);
|
||||||
|
+ update_md(mdc, (void *)diff_digests_tests[_i].input, diff_digests_tests[_i].input_len);
|
||||||
|
+ close_md(mdc, &hs, filename);
|
||||||
|
+ free(mdc);
|
||||||
|
+
|
||||||
|
+ for (HASHSUM i = 0 ; i < num_hashes ; ++i) {
|
||||||
|
+ DB_ATTR_TYPE attr = ATTR(hashsums[i].attribute);
|
||||||
|
+ if (algorithms[i] >= 0 && hs.attrs&attr) {
|
||||||
|
+ ck_assert_mem_eq(diff_digests_tests[_i].expected.hashsums[i], hs.hashsums[i], hashsums[i].length);
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+}
|
||||||
|
+END_TEST
|
||||||
|
+
|
||||||
|
+Suite *make_md_suite(void) {
|
||||||
|
+
|
||||||
|
+ Suite *s = suite_create ("md");
|
||||||
|
+
|
||||||
|
+ TCase *tc_diff_digests = tcase_create ("diff_digests");
|
||||||
|
+
|
||||||
|
+ tcase_add_loop_test (tc_diff_digests, test_diff_digests, 0, num_diff_digests_tests);
|
||||||
|
+
|
||||||
|
+ suite_add_tcase (s, tc_diff_digests);
|
||||||
|
+
|
||||||
|
+ return s;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
diff -up ./tests/check_md.c.gnutls ./tests/check_md.c
|
||||||
|
--- ./tests/check_md.c.gnutls 2024-05-14 19:09:47.420448380 +0200
|
||||||
|
+++ ./tests/check_md.c 2024-05-14 19:09:47.420448380 +0200
|
||||||
|
@@ -0,0 +1,36 @@
|
||||||
|
+/*
|
||||||
|
+ * AIDE (Advanced Intrusion Detection Environment)
|
||||||
|
+ *
|
||||||
|
+ * Copyright (C) 2024 Jakub Jelen
|
||||||
|
+ *
|
||||||
|
+ * This program is free software; you can redistribute it and/or
|
||||||
|
+ * modify it under the terms of the GNU General Public License as
|
||||||
|
+ * published by the Free Software Foundation; either version 2 of the
|
||||||
|
+ * License, or (at your option) any later version.
|
||||||
|
+ *
|
||||||
|
+ * This program is distributed in the hope that it will be useful, but
|
||||||
|
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||||
|
+ * General Public License for more details.
|
||||||
|
+ *
|
||||||
|
+ * You should have received a copy of the GNU General Public License along
|
||||||
|
+ * with this program; if not, write to the Free Software Foundation, Inc.,
|
||||||
|
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||||
|
+ */
|
||||||
|
+
|
||||||
|
+#include <stdlib.h>
|
||||||
|
+
|
||||||
|
+#include "check_md.h"
|
||||||
|
+
|
||||||
|
+int main (void) {
|
||||||
|
+ int number_failed;
|
||||||
|
+ SRunner *sr;
|
||||||
|
+
|
||||||
|
+ sr = srunner_create (make_md_suite());
|
||||||
|
+
|
||||||
|
+ srunner_run_all (sr, CK_NORMAL);
|
||||||
|
+ number_failed = srunner_ntests_failed (sr);
|
||||||
|
+
|
||||||
|
+ srunner_free (sr);
|
||||||
|
+ return (number_failed == 0) ? EXIT_SUCCESS : EXIT_FAILURE;
|
||||||
|
+}
|
||||||
|
diff -up ./tests/check_md.h.gnutls ./tests/check_md.h
|
||||||
|
--- ./tests/check_md.h.gnutls 2024-05-14 19:09:47.421448372 +0200
|
||||||
|
+++ ./tests/check_md.h 2024-05-14 19:09:47.421448372 +0200
|
||||||
|
@@ -0,0 +1,23 @@
|
||||||
|
+/*
|
||||||
|
+ * AIDE (Advanced Intrusion Detection Environment)
|
||||||
|
+ *
|
||||||
|
+ * Copyright (C) 2024 Jakub Jelen
|
||||||
|
+ *
|
||||||
|
+ * This program is free software; you can redistribute it and/or
|
||||||
|
+ * modify it under the terms of the GNU General Public License as
|
||||||
|
+ * published by the Free Software Foundation; either version 2 of the
|
||||||
|
+ * License, or (at your option) any later version.
|
||||||
|
+ *
|
||||||
|
+ * This program is distributed in the hope that it will be useful, but
|
||||||
|
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||||
|
+ * General Public License for more details.
|
||||||
|
+ *
|
||||||
|
+ * You should have received a copy of the GNU General Public License along
|
||||||
|
+ * with this program; if not, write to the Free Software Foundation, Inc.,
|
||||||
|
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||||
|
+ */
|
||||||
|
+
|
||||||
|
+#include <check.h>
|
||||||
|
+
|
||||||
|
+Suite *make_md_suite(void);
|
||||||
Loading…
Reference in new issue