![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to integrity_checker.c CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / strongswan / src / libstrongswan / utils|
Return to integrity_checker.c CVS log | Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / strongswan / src / libstrongswan / utils |
1.1 misho 1: /*
2: * Copyright (C) 2009 Martin Willi
3: * HSR Hochschule fuer Technik Rapperswil
4: *
5: * This program is free software; you can redistribute it and/or modify it
6: * under the terms of the GNU General Public License as published by the
7: * Free Software Foundation; either version 2 of the License, or (at your
8: * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9: *
10: * This program is distributed in the hope that it will be useful, but
11: * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12: * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13: * for more details.
14: */
15:
16: #define _GNU_SOURCE
17:
18: #include "integrity_checker.h"
19:
20: #include <dlfcn.h>
21: #include <link.h>
22: #include <fcntl.h>
23: #include <errno.h>
24: #include <unistd.h>
25: #include <sys/stat.h>
26: #include <sys/types.h>
27:
28: #include "debug.h"
29: #include "library.h"
30:
31: typedef struct private_integrity_checker_t private_integrity_checker_t;
32:
33: /**
34: * Private data of an integrity_checker_t object.
35: */
36: struct private_integrity_checker_t {
37:
38: /**
39: * Public integrity_checker_t interface.
40: */
41: integrity_checker_t public;
42:
43: /**
44: * dlopen handle to checksum library
45: */
46: void *handle;
47:
48: /**
49: * checksum array
50: */
51: integrity_checksum_t *checksums;
52:
53: /**
54: * number of checksums in array
55: */
56: int checksum_count;
57: };
58:
59: METHOD(integrity_checker_t, build_file, uint32_t,
60: private_integrity_checker_t *this, char *file, size_t *len)
61: {
62: uint32_t checksum;
63: chunk_t *contents;
64:
65: contents = chunk_map(file, FALSE);
66: if (!contents)
67: {
68: DBG1(DBG_LIB, " opening '%s' failed: %s", file, strerror(errno));
69: return 0;
70: }
71: *len = contents->len;
72: checksum = chunk_hash_static(*contents);
73: chunk_unmap(contents);
74:
75: return checksum;
76: }
77:
78: /**
79: * dl_iterate_phdr callback function
80: */
81: static int callback(struct dl_phdr_info *dlpi, size_t size, Dl_info *dli)
82: {
83: /* We are looking for the dlpi_addr matching the address of our dladdr().
84: * dl_iterate_phdr() returns such an address for other (unknown) objects
85: * in very rare cases (e.g. in a chrooted gentoo, but only if
86: * the checksum_builder is invoked by 'make'). As a workaround, we filter
87: * objects by dlpi_name; valid objects have a library name.
88: */
89: if (dli->dli_fbase == (void*)dlpi->dlpi_addr &&
90: dlpi->dlpi_name && *dlpi->dlpi_name)
91: {
92: int i;
93:
94: for (i = 0; i < dlpi->dlpi_phnum; i++)
95: {
96: const ElfW(Phdr) *sgmt = &dlpi->dlpi_phdr[i];
97:
98: /* we are interested in the executable LOAD segment */
99: if (sgmt->p_type == PT_LOAD && (sgmt->p_flags & PF_X))
100: {
101: /* safe begin of segment in dli_fbase */
102: dli->dli_fbase = (void*)sgmt->p_vaddr + dlpi->dlpi_addr;
103: /* safe end of segment in dli_saddr */
104: dli->dli_saddr = dli->dli_fbase + sgmt->p_memsz;
105: return 1;
106: }
107: }
108: }
109: return 0;
110: }
111:
112: METHOD(integrity_checker_t, build_segment, uint32_t,
113: private_integrity_checker_t *this, void *sym, size_t *len)
114: {
115: chunk_t segment;
116: Dl_info dli;
117:
118: if (dladdr(sym, &dli) == 0)
119: {
120: DBG1(DBG_LIB, " unable to locate symbol: %s", dlerror());
121: return 0;
122: }
123: /* we reuse the Dl_info struct as in/out parameter */
124: if (!dl_iterate_phdr((void*)callback, &dli))
125: {
126: DBG1(DBG_LIB, " executable section not found");
127: return 0;
128: }
129:
130: segment = chunk_create(dli.dli_fbase, dli.dli_saddr - dli.dli_fbase);
131: *len = segment.len;
132: return chunk_hash_static(segment);
133: }
134:
135: /**
136: * Find a checksum by its name
137: */
138: static integrity_checksum_t *find_checksum(private_integrity_checker_t *this,
139: char *name)
140: {
141: int i;
142:
143: for (i = 0; i < this->checksum_count; i++)
144: {
145: if (streq(this->checksums[i].name, name))
146: {
147: return &this->checksums[i];
148: }
149: }
150: return NULL;
151: }
152:
153: METHOD(integrity_checker_t, check_file, bool,
154: private_integrity_checker_t *this, char *name, char *file)
155: {
156: integrity_checksum_t *cs;
157: uint32_t sum;
158: size_t len = 0;
159:
160: cs = find_checksum(this, name);
161: if (!cs)
162: {
163: DBG1(DBG_LIB, " '%s' file checksum not found", name);
164: return FALSE;
165: }
166: sum = build_file(this, file, &len);
167: if (!sum)
168: {
169: return FALSE;
170: }
171: if (cs->file_len != len)
172: {
173: DBG1(DBG_LIB, " invalid '%s' file size: %u bytes, expected %u bytes",
174: name, len, cs->file_len);
175: return FALSE;
176: }
177: if (cs->file != sum)
178: {
179: DBG1(DBG_LIB, " invalid '%s' file checksum: %08x, expected %08x",
180: name, sum, cs->file);
181: return FALSE;
182: }
183: DBG2(DBG_LIB, " valid '%s' file checksum: %08x", name, sum);
184: return TRUE;
185: }
186:
187: METHOD(integrity_checker_t, check_segment, bool,
188: private_integrity_checker_t *this, char *name, void *sym)
189: {
190: integrity_checksum_t *cs;
191: uint32_t sum;
192: size_t len = 0;
193:
194: cs = find_checksum(this, name);
195: if (!cs)
196: {
197: DBG1(DBG_LIB, " '%s' segment checksum not found", name);
198: return FALSE;
199: }
200: sum = build_segment(this, sym, &len);
201: if (!sum)
202: {
203: return FALSE;
204: }
205: if (cs->segment_len != len)
206: {
207: DBG1(DBG_LIB, " invalid '%s' segment size: %u bytes,"
208: " expected %u bytes", name, len, cs->segment_len);
209: return FALSE;
210: }
211: if (cs->segment != sum)
212: {
213: DBG1(DBG_LIB, " invalid '%s' segment checksum: %08x, expected %08x",
214: name, sum, cs->segment);
215: return FALSE;
216: }
217: DBG2(DBG_LIB, " valid '%s' segment checksum: %08x", name, sum);
218: return TRUE;
219: }
220:
221: METHOD(integrity_checker_t, check, bool,
222: private_integrity_checker_t *this, char *name, void *sym)
223: {
224: Dl_info dli;
225:
226: if (dladdr(sym, &dli) == 0)
227: {
228: DBG1(DBG_LIB, "unable to locate symbol: %s", dlerror());
229: return FALSE;
230: }
231: if (!check_file(this, name, (char*)dli.dli_fname))
232: {
233: return FALSE;
234: }
235: if (!check_segment(this, name, sym))
236: {
237: return FALSE;
238: }
239: return TRUE;
240: }
241:
242: METHOD(integrity_checker_t, destroy, void,
243: private_integrity_checker_t *this)
244: {
245: if (this->handle)
246: {
247: dlclose(this->handle);
248: }
249: free(this);
250: }
251:
252: /**
253: * See header
254: */
255: integrity_checker_t *integrity_checker_create(char *checksum_library)
256: {
257: private_integrity_checker_t *this;
258:
259: INIT(this,
260: .public = {
261: .check_file = _check_file,
262: .build_file = _build_file,
263: .check_segment = _check_segment,
264: .build_segment = _build_segment,
265: .check = _check,
266: .destroy = _destroy,
267: },
268: );
269:
270: if (checksum_library)
271: {
272: this->handle = dlopen(checksum_library, RTLD_LAZY);
273: if (this->handle)
274: {
275: int *checksum_count;
276:
277: this->checksums = dlsym(this->handle, "checksums");
278: checksum_count = dlsym(this->handle, "checksum_count");
279: if (this->checksums && checksum_count)
280: {
281: this->checksum_count = *checksum_count;
282: }
283: else
284: {
285: DBG1(DBG_LIB, "checksum library '%s' invalid",
286: checksum_library);
287: }
288: }
289: else
290: {
291: DBG1(DBG_LIB, "loading checksum library '%s' failed",
292: checksum_library);
293: }
294: }
295: return &this->public;
296: }