gen_list.c

This piece of software was written as a replacement and extension for Tripwire. Tripwire is an exce

 */
void add_file_to_tree(seltree* tree,db_line* file,int db,int status,int attr)
{
  seltree* node=NULL;
  int localignorelist=0;
  int ignorelist=0;

  node=get_seltree_node(tree,file->filename);

  if(!node){
    node=new_seltree_node(tree,file->filename,0,NULL);
  }

  if(file==NULL){
    error(0, "add_file_to_tree was called with NULL db_line\n");
  }

  /* add note to this node which db has modified it */
  node->checked|=db;

  /* add note whether to add this node's children */
  if(S_ISDIR(file->perm)&&status==NODE_ADD_CHILDREN){
    node->checked|=NODE_ADD_CHILDREN;
  }

  node->attr=attr;

  strip_dbline(file,attr);

  switch (db) {
  case DB_OLD: {
    node->old_data=file;
    break;
  }
  case DB_NEW: {
    node->new_data=file;
    break;
  }
  }
  /* We have a way to ignore some changes... */

  ignorelist=get_groupval("ignore_list");

  if (ignorelist==-1) {
    ignorelist=0;
  }

  if((node->checked&DB_OLD)&&(node->checked&DB_NEW)){
    localignorelist=(node->new_data->attr^node->old_data->attr);
    if (localignorelist!=0) {
      error(5,"File %s in databases has different attributes, %i,%i\n",node->old_data->filename,node->old_data->attr,node->new_data->attr);
    }
    
    localignorelist|=ignorelist;

    /* Free the data if same else leave as is for report_tree */
    if(compare_dbline(node->old_data,node->new_data,localignorelist)==RETOK){
      /* FIXME this messes up the tree on SunOS. Don't know why. Fix
	 needed badly otherwise we leak memory like hell. */

      free_db_line(node->old_data);
      free(node->old_data);
      free_db_line(node->new_data);
      free(node->new_data);
      
      node->old_data=NULL;
      node->new_data=NULL;      
    }
  }
}

int check_rxtree(char* filename,seltree* tree,int* attr)
{
  int retval=0;
  char * tmp=NULL;
  char * parentname=NULL;
  seltree* pnode=NULL;

  parentname=strdup(filename);
  tmp=strrchr(parentname,'/');
  if(tmp!=parentname){
    *tmp='\0';
  }else {
    
    if(parentname[1]!='\0'){
      /* we are in the root dir */
      parentname[1]='\0';
    }
  }
  pnode=get_seltree_node(tree,parentname);

  if(pnode&&(pnode->checked&NODE_ADD_CHILDREN)){
    *attr=pnode->attr;
    retval=check_node_for_match(pnode,filename,1,attr);
  }else{
    *attr=0;
    retval=check_node_for_match(pnode,filename,0,attr);
  }
    
  free(parentname);

  return retval;
}

db_line* get_file_attrs(char* filename,int attr)
{
  struct AIDE_STAT_TYPE fs;
  int sres=0;
  db_line* line=NULL;
  time_t cur_time;
  
  sres=AIDE_LSTAT_FUNC(filename,&fs);  
  if(sres==-1){
    char* er=strerror(errno);
    if (er==NULL) {
      error(0,"lstat() failed for %s. strerror failed for %i\n",filename,errno);
    } else {
      error(0,"lstat() failed for %s:%s\n",filename,strerror(errno));
    }
    return NULL;
  } 
  /*
    Get current time for future time notification.
   */
  cur_time=time(NULL);
  
  if (cur_time==(time_t)-1) {
    char* er=strerror(errno);
    if (er==NULL) {
      error(0,_("Can not get current time. strerror failed for %i\n"),errno);
    } else {
      error(0,_("Can not get current time with reason %s\n"),er);
    }
  } else {
    
    if(fs.st_atime>cur_time){
      error(CLOCK_SKEW,_("%s atime in future\n"),filename);
    }
    if(fs.st_mtime>cur_time){
      error(CLOCK_SKEW,_("%s mtime in future\n"),filename);
    }
    if(fs.st_ctime>cur_time){
      error(CLOCK_SKEW,_("%s ctime in future\n"),filename);
    }
  }
  
  /*
    Malloc if we have something to store..
  */
  
  line=(db_line*)malloc(sizeof(db_line));
  
  memset(line,0,sizeof(db_line));
  
  /*
    We want filename and linkname
  */

  line->attr=attr|DB_FILENAME|DB_LINKNAME;
  
  /*
    Just copy some needed fields.
  */
  
  line->filename=filename;
  line->perm_o=fs.st_mode;
  line->size_o=fs.st_size;
  line->linkname=NULL;

  /*
    Handle symbolic link
  */
  
  hsymlnk(line);
  
  /*
    Set normal part
  */
  
  fs2db_line(&fs,line);
  
  /*
    ACL stuff
  */
#ifdef WITH_ACL
  acl2line(line);
#endif

  if (attr&DB_HASHES && S_ISREG(fs.st_mode)) {
    calc_md(&fs,line);
  } else {
    /*
      We cannot calculate hash for nonfile.
      Mark it to attr.
    */
    no_hash(line);
  }
  
  return line;
}

#if 0
void stat_dir(char* dir)
{
  DIR* dirh=NULL;
  struct AIDE_DIRENT_TYPE* entp=NULL;
  struct AIDE_DIRENT_TYPE** resp=NULL;
  int rdres=0;
  int add=0;
  
  if(!(dirh=opendir(dir))){
    error(5,"populate_tree():%s: %s\n", strerror(errno),tree->path);
    return;
  }
  
#ifdef HAVE_READDIR_R
  resp=(struct AIDE_DIRENT_TYPE**)
    malloc(sizeof(struct AIDE_DIRENT_TYPE)+_POSIX_PATH_MAX);
  entp=(struct AIDE_DIRENT_TYPE*)
    malloc(sizeof(struct AIDE_DIRENT_TYPE)+_POSIX_PATH_MAX);
  
  for(rdres=AIDE_READDIR_R_FUNC(dirh,entp,resp);
      (rdres==0&&(*resp)!=NULL);
      rdres=AIDE_READDIR_R_FUNC(dirh,entp,resp)){
#else
#ifdef HAVE_READDIR
    for(entp=AIDE_READDIR_FUNC(dirh);
	(entp!=NULL&&td!=telldir(dirh));
	entp=AIDE_READDIR_FUNC(dirh)){
      td=telldir(dirh);
#else
#error AIDE needs readdir or readdir_r
#endif
#endif
      if(strncmp(entp->d_name,".",1)==0){
	if(strncmp(entp->d_name,".",strlen(entp->d_name))==0)
	  continue;
	if(strncmp(entp->d_name,"..",strlen(entp->d_name))==0)
	  continue;
      }
      /* Construct fully qualified pathname for the file in question */
      fullname=(char*)
	malloc(sizeof(char)*(strlen(entp->d_name)+strlen(tree->path)+2));
      strncpy(fullname,tree->path,strlen(tree->path));
      if(strncmp(tree->path,"/",strlen(tree->path))!=0){
	strncpy(fullname+strlen(tree->path),"/",1);
	    e=1;
      }else {
	e=0;
      }
      strncpy(fullname+strlen(tree->path)+e,entp->d_name,strlen(entp->d_name));
      fullname[(strlen(tree->path)+e+strlen(entp->d_name))]='\0';
      error(230,_("Checking %s for match\n"),fullname);
      add=check_rxtree("/",tree,&attr);
#ifdef HAVE_READDIR_R
    }
#else
#ifdef HAVE_READDIR
  }
#endif
#endif
}
#endif

void populate_tree(seltree* tree)
{
  /* FIXME this function could really use threads */
  int i=0;
  int add=0;
  db_line* old=NULL;
  db_line* new=NULL;
  int initdbwarningprinted=0;
  int ignorelist=0;
  int attr=0;
  seltree* node=NULL;
  
  /* With this we avoid unnecessary checking of removed files. */
  if(conf->action&DO_INIT){
    initdbwarningprinted=1;
  }
  
  /* We have a way to ignore some changes... */ 
  
  ignorelist=get_groupval("ignore_list");

  if (ignorelist==-1) {
    ignorelist=0;
  }
  
  do{
    /* We add 100 files every turn from both inputs 
       if the other input is disk it is added one dir at a time until
       100 files have been added  
    */
    if((conf->action&DO_COMPARE)||(conf->action&DO_DIFF)){
      i=0;
      for(old=db_readline(DB_OLD);i<100&&old;){
	/* This is needed because check_rxtree assumes there is a parent
	   for the node for old->filename */
	if((node=get_seltree_node(tree,old->filename))==NULL){
	  node=new_seltree_node(tree,old->filename,0,NULL);
	}
	if((add=check_rxtree(old->filename,tree,&attr))>0){
	  if(add==1){
	    add_file_to_tree(tree,old,DB_OLD,NODE_ADD_CHILDREN,attr);
	  }else {
	    if(add==2){
	      add_file_to_tree(tree,old,DB_OLD,0,attr);
	    }
	  }
	  i++;
	}else if(!initdbwarningprinted){
	  error(5,_("WARNING: Old db contains a file that shouldn\'t be there, run --init or --update\n"));
	  initdbwarningprinted=1;
	}
	if(i<100){
	  old=db_readline(DB_OLD);
	}
      }
    }
    if(conf->action&DO_DIFF){
      i=0;
      for(new=db_readline(DB_NEW);i<100&&new;){
	/* FIXME add support config checking at this stage 
	   config check = add only those files that match config rxs
	   make this configurable
	   Only configurability is not implemented.
	*/
	/* This is needed because check_rxtree assumes there is a parent
	   for the node for old->filename */
	if((node=get_seltree_node(tree,new->filename))==NULL){
	  node=new_seltree_node(tree,new->filename,0,NULL);
	}
	if((add=check_rxtree(new->filename,tree,&attr))>0){
	  if(add==1){
	    add_file_to_tree(tree,new,DB_NEW,NODE_ADD_CHILDREN,attr);
	  }else if (add==2) {
	    add_file_to_tree(tree,new,DB_NEW,0,attr);
	  }
	  i++;
	}
	if(i<100){
	  new=db_readline(DB_NEW);
	}
      }
    }
    
    if((conf->action&DO_INIT)||(conf->action&DO_COMPARE)){
      /* FIXME  */
      new=NULL;
      i=0;
      for(new=db_readline(DB_DISK);i<100&&new;){
	/* Write to db only if needed */
	if(conf->action&DO_INIT){
	  db_writeline(new,conf);
	}
	/* Populate tree only if it is needed later */
	if(conf->action&DO_COMPARE){
	  if((add=check_rxtree(new->filename,tree,&attr))>0){
	    if(add==1){
	      add_file_to_tree(tree,new,DB_NEW,NODE_ADD_CHILDREN,attr);
	    }else if (add==2) {
	      add_file_to_tree(tree,new,DB_NEW,0,attr);
	    }
	    i++;
	  }
	}
	if((conf->action&DO_INIT)&&!(conf->action&DO_COMPARE)){
	  free_db_line(new);
	}
	if(i<100){
	  new=db_readline(DB_DISK);
	}
      }

    }
  }while(old || new);
}

void hsymlnk(db_line* line) {
  
  if((S_ISLNK(line->perm_o))){
    int len=0;
#ifdef WITH_ACL   
    if(conf->no_acl_on_symlinks!=1) {
      line->attr&=(~DB_ACL);
    }
#endif   
    
    if(conf->warn_dead_symlinks==1) {
      struct AIDE_STAT_TYPE fs;
      int sres;
      sres=AIDE_STAT_FUNC(line->filename,&fs);
      if (sres!=0 && sres!=EACCES) {
	error(5,"Dead symlink detected at %s\n",line->filename);
      }
    }
    /*
      Is this valid??
      I think not.
    */
    /*      if(conf->symlinks_found==0){ */
    /*        int it=0; */
    /*        DB_FIELD dbtmp; */
    /*        DB_FIELD dbtmp2; */
    /*        dbtmp=conf->db_out_order[1]; */
    /*        conf->db_out_order[1]=db_linkname; */
    /*        for(it=2;it<conf->db_out_size;it++){ */
    /*  	dbtmp2=conf->db_out_order[it]; */
    /*  	conf->db_out_order[it]=dbtmp; */
    /*  	dbtmp=dbtmp2; */
    /*        } */
    /*        conf->db_out_order[conf->db_out_size++]=dbtmp; */
    /*        conf->symlinks_found=1; */
    /*      } */
    
    line->linkname=(char*)malloc(_POSIX_PATH_MAX+1);
    if(line->linkname==NULL){
      error(0,_("malloc failed in add_file_to_list()\n"));
      abort();
    }
    
    /*
      Remember to nullify the buffer, because man page says
      
      readlink  places the contents of the symbolic link path in
      the buffer buf, which has size bufsiz.  readlink does  not
      append  a NUL character to buf.  It will truncate the con-
      tents (to a length of  bufsiz  characters),  in  case  the
      buffer is too small to hold all of the contents.
      
    */
    memset(line->linkname,0,_POSIX_PATH_MAX+1);
    
    len=readlink(line->filename,line->linkname,_POSIX_PATH_MAX+1);
    
    /*
      lnkbuf=(char*)malloc(len+1);
      if(lnkbuf==NULL){
      error(0,_("malloc failed in add_file_to_list()\n"));
      abort();
      }

      strncpy(lnkbuf,lnktmp,len);
      lnkbuf[len]='\0';
      line->linkname=lnkbuf;
      free(lnktmp);
    */
    /*
     * We use realloc :)
     */
    line->linkname=realloc(line->linkname,len+1);
    line->attr|=DB_LINKNAME;
  }else {
    /* Just remove linkname avaivilibity bit from this entry */
    line->attr&=(~DB_LINKNAME); 
  }
  
}
/*
const char* aide_key_13=KEY_13;
*/