404 lines
8.1 KiB
C
404 lines
8.1 KiB
C
/*
|
|
* Copyright (C) 2012 Andreas Steffen
|
|
* HSR Hochschule fuer Technik Rapperswil
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify it
|
|
* under the terms of the GNU General Public License as published by the
|
|
* Free Software Foundation; either version 2 of the License, or (at your
|
|
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
|
*
|
|
* This program is distributed in the hope that it will be useful, but
|
|
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
|
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
|
* for more details.
|
|
*/
|
|
|
|
#define _GNU_SOURCE
|
|
#include <getopt.h>
|
|
#include <unistd.h>
|
|
#include <stdio.h>
|
|
#include <string.h>
|
|
#include <errno.h>
|
|
#include <syslog.h>
|
|
#include <time.h>
|
|
|
|
#include <library.h>
|
|
#include <utils/debug.h>
|
|
|
|
/**
|
|
* global debug output variables
|
|
*/
|
|
static int debug_level = 1;
|
|
static bool stderr_quiet = TRUE;
|
|
|
|
/**
|
|
* pacman dbg function
|
|
*/
|
|
static void pacman_dbg(debug_t group, level_t level, char *fmt, ...)
|
|
{
|
|
int priority = LOG_INFO;
|
|
char buffer[8192];
|
|
char *current = buffer, *next;
|
|
va_list args;
|
|
|
|
if (level <= debug_level)
|
|
{
|
|
if (!stderr_quiet)
|
|
{
|
|
va_start(args, fmt);
|
|
vfprintf(stderr, fmt, args);
|
|
fprintf(stderr, "\n");
|
|
va_end(args);
|
|
}
|
|
|
|
/* write in memory buffer first */
|
|
va_start(args, fmt);
|
|
vsnprintf(buffer, sizeof(buffer), fmt, args);
|
|
va_end(args);
|
|
|
|
/* do a syslog with every line */
|
|
while (current)
|
|
{
|
|
next = strchr(current, '\n');
|
|
if (next)
|
|
{
|
|
*(next++) = '\0';
|
|
}
|
|
syslog(priority, "%s\n", current);
|
|
current = next;
|
|
}
|
|
}
|
|
}
|
|
|
|
/**
|
|
* atexit handler to close everything on shutdown
|
|
*/
|
|
static void cleanup(void)
|
|
{
|
|
closelog();
|
|
library_deinit();
|
|
}
|
|
|
|
static void usage(void)
|
|
{
|
|
printf("Usage:\n"
|
|
"ipsec pacman --file <filename> --package <name>\n");
|
|
}
|
|
|
|
/**
|
|
* Extract the time the package file was generated
|
|
*/
|
|
static time_t extract_time(char *line)
|
|
{
|
|
struct tm t;
|
|
char wday[4], mon[4];
|
|
char* months[] = { "Jan", "Feb", "Mar", "Apr", "May", "Jun",
|
|
"Jul", "Aug", "Sep", "Oct", "Nov", "Dec" };
|
|
int i;
|
|
|
|
if (sscanf(line, "Generated: %3s %3s %2d %2d:%2d:%2d %4d UTC", wday, mon,
|
|
&t.tm_mday, &t.tm_hour, &t.tm_min, &t.tm_sec, &t.tm_year) != 7)
|
|
{
|
|
return UNDEFINED_TIME;
|
|
}
|
|
t.tm_isdst = 0;
|
|
t.tm_year -= 1900;
|
|
t.tm_mon = 12;
|
|
|
|
for (i = 0; i < countof(months); i++)
|
|
{
|
|
if (streq(mon, months[i]))
|
|
{
|
|
t.tm_mon = i;
|
|
break;
|
|
}
|
|
}
|
|
if (t.tm_mon == 12)
|
|
{
|
|
return UNDEFINED_TIME;
|
|
}
|
|
|
|
return mktime(&t) - timezone;
|
|
}
|
|
|
|
/**
|
|
* Process a package file and store updates in the database
|
|
*/
|
|
static void process_packages(char *filename, char *product, bool update)
|
|
{
|
|
char *uri, line[12288], *pos;
|
|
int count = 0, errored = 0, vulnerable = 0;
|
|
int new_packages = 0, new_versions = 0;
|
|
u_int32_t pid = 0;
|
|
enumerator_t *e;
|
|
database_t *db;
|
|
FILE *file;
|
|
|
|
/* opening package file */
|
|
printf("loading\"%s\"\n", filename);
|
|
file = fopen(filename, "r");
|
|
if (!file)
|
|
{
|
|
fprintf(stderr, "could not open \"%s\"\n", filename);
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
/* connect package database */
|
|
uri = lib->settings->get_str(lib->settings, "pacman.database", NULL);
|
|
if (!uri)
|
|
{
|
|
fprintf(stderr, "database URI pacman.database not set\n");
|
|
fclose(file);
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
db = lib->db->create(lib->db, uri);
|
|
if (!db)
|
|
{
|
|
fprintf(stderr, "could not connect to database '%s'\n", uri);
|
|
fclose(file);
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
/* check if product is already in database */
|
|
e = db->query(db, "SELECT id FROM products WHERE name = ?",
|
|
DB_TEXT, product, DB_INT);
|
|
if (e)
|
|
{
|
|
if (!e->enumerate(e, &pid))
|
|
{
|
|
pid = 0;
|
|
}
|
|
e->destroy(e);
|
|
}
|
|
if (!pid)
|
|
{
|
|
if (db->execute(db, &pid, "INSERT INTO products (name) VALUES (?)",
|
|
DB_TEXT, product) != 1)
|
|
{
|
|
fprintf(stderr, "could not store product '%s' to database\n",
|
|
product);
|
|
fclose(file);
|
|
db->destroy(db);
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
}
|
|
|
|
while (fgets(line, sizeof(line), file))
|
|
{
|
|
char *package, *version, *current_version;
|
|
bool security, update_version = TRUE;
|
|
int current_security;
|
|
u_int32_t gid = 0, vid = 0;
|
|
time_t generation_time;
|
|
|
|
count++;
|
|
if (count == 1)
|
|
{
|
|
printf("%s", line);
|
|
}
|
|
if (count == 3)
|
|
{
|
|
generation_time = extract_time(line);
|
|
|
|
if (generation_time == UNDEFINED_TIME)
|
|
{
|
|
fprintf(stderr, "could not extract generation time\n");
|
|
fclose(file);
|
|
db->destroy(db);
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
printf("Generated: %T\n", &generation_time, TRUE);
|
|
}
|
|
if (count < 7)
|
|
{
|
|
continue;
|
|
}
|
|
|
|
/* look for the package name */
|
|
pos = strchr(line, ' ');
|
|
if (!pos)
|
|
{
|
|
fprintf(stderr, "could not extract package name from '%.*s'",
|
|
strlen(line)-1, line);
|
|
errored++;
|
|
continue;
|
|
}
|
|
*pos++ = '\0';
|
|
package = line;
|
|
|
|
/* look for version string in parentheses */
|
|
if (*pos == '(')
|
|
{
|
|
version = ++pos;
|
|
pos = strchr(pos, ')');
|
|
if (pos)
|
|
{
|
|
*pos++ = '\0';
|
|
}
|
|
else
|
|
{
|
|
fprintf(stderr, "could not extract package version from '%.*s'\n",
|
|
strlen(line)-1, line);
|
|
errored++;
|
|
continue;
|
|
}
|
|
}
|
|
else
|
|
{
|
|
/* no version information, skip entry */
|
|
continue;
|
|
}
|
|
security = (strstr(pos, "[security]") != NULL);
|
|
if (security)
|
|
{
|
|
vulnerable++;
|
|
}
|
|
|
|
/* handle non-security packages in update mode only */
|
|
if (!update && !security)
|
|
{
|
|
continue;
|
|
}
|
|
|
|
/* check if package is already in database */
|
|
e = db->query(db, "SELECT id FROM packages WHERE name = ?",
|
|
DB_TEXT, package, DB_INT);
|
|
if (e)
|
|
{
|
|
if (!e->enumerate(e, &gid))
|
|
{
|
|
gid = 0;
|
|
}
|
|
e->destroy(e);
|
|
}
|
|
if (!gid && security)
|
|
{
|
|
if (db->execute(db, &gid, "INSERT INTO packages (name) VALUES (?)",
|
|
DB_TEXT, package) != 1)
|
|
{
|
|
fprintf(stderr, "could not store package '%s' to database\n",
|
|
package);
|
|
fclose(file);
|
|
db->destroy(db);
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
new_packages++;
|
|
}
|
|
|
|
/* check for package versions already in database */
|
|
e = db->query(db, "SELECT id, release, security FROM versions "
|
|
"WHERE package = ? AND product = ?",
|
|
DB_INT, gid, DB_INT, pid, DB_INT, DB_TEXT, DB_INT);
|
|
if (e)
|
|
{
|
|
while (e->enumerate(e, &vid, ¤t_version, ¤t_security))
|
|
{
|
|
if (streq(version, current_version))
|
|
{
|
|
update_version = FALSE;
|
|
}
|
|
}
|
|
e->destroy(e);
|
|
}
|
|
if ((!vid && security) || (vid && update_version))
|
|
{
|
|
printf("'%s' (%s) %s\n", package, version, security ? "[s]" : "");
|
|
|
|
if (db->execute(db, &gid,
|
|
"INSERT INTO versions (package, product, release, security) "
|
|
"VALUES (?, ?, ?, ?)", DB_INT, gid, DB_INT, pid,
|
|
DB_TEXT, version, DB_INT, security) != 1)
|
|
{
|
|
fprintf(stderr, "could not store version '%s' to database\n",
|
|
version);
|
|
fclose(file);
|
|
db->destroy(db);
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
new_versions++;
|
|
}
|
|
}
|
|
|
|
fclose(file);
|
|
db->destroy(db);
|
|
printf("processed %d packages, %d vulnerable, %d errored, "
|
|
"%d new packages, %d new versions\n", count - 6, vulnerable,
|
|
errored, new_packages, new_versions);
|
|
}
|
|
|
|
static void do_args(int argc, char *argv[])
|
|
{
|
|
char *filename = NULL, *product = NULL;
|
|
bool update = FALSE;
|
|
|
|
/* reinit getopt state */
|
|
optind = 0;
|
|
|
|
while (TRUE)
|
|
{
|
|
int c;
|
|
|
|
struct option long_opts[] = {
|
|
{ "help", no_argument, NULL, 'h' },
|
|
{ "file", required_argument, NULL, 'f' },
|
|
{ "product", required_argument, NULL, 'p' },
|
|
{ "update", no_argument, NULL, 'u' },
|
|
{ 0,0,0,0 }
|
|
};
|
|
|
|
c = getopt_long(argc, argv, "", long_opts, NULL);
|
|
switch (c)
|
|
{
|
|
case EOF:
|
|
break;
|
|
case 'h':
|
|
usage();
|
|
exit(EXIT_SUCCESS);
|
|
case 'f':
|
|
filename = optarg;
|
|
continue;
|
|
case 'p':
|
|
product = optarg;
|
|
continue;
|
|
case 'u':
|
|
update = TRUE;
|
|
continue;
|
|
}
|
|
break;
|
|
}
|
|
|
|
if (filename && product)
|
|
{
|
|
process_packages(filename, product, update);
|
|
}
|
|
else
|
|
{
|
|
usage();
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
}
|
|
|
|
int main(int argc, char *argv[])
|
|
{
|
|
/* enable attest debugging hook */
|
|
dbg = pacman_dbg;
|
|
openlog("pacman", 0, LOG_DEBUG);
|
|
|
|
atexit(cleanup);
|
|
|
|
/* initialize library */
|
|
if (!library_init(NULL))
|
|
{
|
|
exit(SS_RC_LIBSTRONGSWAN_INTEGRITY);
|
|
}
|
|
if (!lib->plugins->load(lib->plugins, NULL,
|
|
lib->settings->get_str(lib->settings, "attest.load", "sqlite")))
|
|
{
|
|
exit(SS_RC_INITIALIZATION_FAILED);
|
|
}
|
|
do_args(argc, argv);
|
|
|
|
exit(EXIT_SUCCESS);
|
|
}
|
|
|