/*

 * ima-evm-utils - IMA/EVM support utilities

 *

 * Copyright (C) 2011 Nokia Corporation

 * Copyright (C) 2011,2012,2013 Intel Corporation

 * Copyright (C) 2013,2014 Samsung Electronics

 *

 * Authors:

 * Dmitry Kasatkin <dmitry.kasatkin@nokia.com>

 *                 <dmitry.kasatkin@intel.com>

 *                 <d.kasatkin@samsung.com>

 *

 * This program is free software; you can redistribute it and/or

 * modify it under the terms of the GNU General Public License

 * version 2 as published by the Free Software Foundation.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * along with this program.  If not, see <http://www.gnu.org/licenses/>.

 *

 * As a special exception, the copyright holders give permission to link the

 * code of portions of this program with the OpenSSL library under certain

 * conditions as described in each individual source file and distribute

 * linked combinations including the program with the OpenSSL library. You

 * must comply with the GNU General Public License in all respects

 * for all of the code used other than as permitted herein. If you modify

 * file(s) with this exception, you may extend this exception to your

 * version of the file(s), but you are not obligated to do so. If you do not

 * wish to do so, delete this exception statement from your version. If you

 * delete this exception statement from all source files in the program,

 * then also delete it in the license file.

 *

 * File: evmctl.c

 *	 IMA/EVM control program

 */

#include <sys/types.h>

#include <sys/param.h>

#include <sys/stat.h>

#include <sys/ioctl.h>

#include <fcntl.h>

#include <unistd.h>

#include <stdlib.h>

#include <stdio.h>

#include <stdint.h>

#include <string.h>

#include <dirent.h>

#include <attr/xattr.h>

#include <linux/xattr.h>

#include <getopt.h>

#include <keyutils.h>

#include <ctype.h>

#include <termios.h>

#include <openssl/sha.h>

#include <openssl/pem.h>

#include <openssl/hmac.h>

#include <openssl/err.h>

#include <openssl/rsa.h>

#define USE_FPRINTF

#include "imaevm.h"

static char *evm_default_xattrs[] = {

	XATTR_NAME_SELINUX,

	XATTR_NAME_SMACK,

	XATTR_NAME_IMA,

	XATTR_NAME_CAPS,

	NULL

};

static char *evm_extra_smack_xattrs[] = {

	XATTR_NAME_SELINUX,

	XATTR_NAME_SMACK,

	XATTR_NAME_SMACKEXEC,

	XATTR_NAME_SMACKTRANSMUTE,

	XATTR_NAME_SMACKMMAP,

	XATTR_NAME_IMA,

	XATTR_NAME_CAPS,

	NULL

};

static char **evm_config_xattrnames = evm_default_xattrs;

struct command {

	char *name;

	int (*func)(struct command *cmd);

	int cmd;

	char *arg;

	char *msg;		/* extra info message */

};

static int g_argc;

static char **g_argv;

static int xattr = 1;

static bool check_xattr;

static int sigdump;

static int digest;

static int digsig;

static int sigfile;

static char *uuid_str;

static char *ino_str;

static char *uid_str;

static char *gid_str;

static char *mode_str;

static char *generation_str;

static char *caps_str;

static char *ima_str;

static char *selinux_str;

static char *search_type;

static int measurement_list;

static int recursive;

static int msize;

static dev_t fs_dev;

static bool evm_immutable;

static bool evm_portable;

#define HMAC_FLAG_NO_UUID	0x0001

#define HMAC_FLAG_CAPS_SET	0x0002

static unsigned long hmac_flags;

typedef int (*find_cb_t)(const char *path);

static int find(const char *path, int dts, find_cb_t func);

#define REG_MASK	(1 << DT_REG)

#define DIR_MASK	(1 << DT_DIR)

#define LNK_MASK	(1 << DT_LNK)

#define CHR_MASK	(1 << DT_CHR)

#define BLK_MASK	(1 << DT_BLK)

struct command cmds[];

static void print_usage(struct command *cmd);

static int bin2file(const char *file, const char *ext, const unsigned char *data, int len)

{

	FILE *fp;

	char name[strlen(file) + (ext ? strlen(ext) : 0) + 2];

	int err;

	if (ext)

		sprintf(name, "%s.%s", file, ext);

	else

		sprintf(name, "%s", file);

	log_info("Writing to %s\n", name);

	fp = fopen(name, "w");

	if (!fp) {

		log_err("Failed to open: %s\n", name);

		return -1;

	}

	err = fwrite(data, len, 1, fp);

	fclose(fp);

	return err;

}

static unsigned char *file2bin(const char *file, const char *ext, int *size)

{

	FILE *fp;

	int len;

	unsigned char *data;

	char name[strlen(file) + (ext ? strlen(ext) : 0) + 2];

	if (ext)

		sprintf(name, "%s.%s", file, ext);

	else

		sprintf(name, "%s", file);

	log_info("Reading to %s\n", name);

	len = get_filesize(name);

	fp = fopen(name, "r");

	if (!fp) {

		log_err("Failed to open: %s\n", name);

		return NULL;

	}

	data = malloc(len);

	if (!fread(data, len, 1, fp))

		len = 0;

	fclose(fp);

	*size = len;

	return data;

}

static int find_xattr(const char *list, int list_size, const char *xattr)

{

	int len;

	for (; list_size > 0; len++, list_size -= len, list += len) {

		len = strlen(list);

		if (!strcmp(list, xattr))

			return 1;

	}

	return 0;

}

static int hex_to_bin(char ch)

{

	if ((ch >= '0') && (ch <= '9'))

		return ch - '0';

	ch = tolower(ch);

	if ((ch >= 'a') && (ch <= 'f'))

		return ch - 'a' + 10;

	return -1;

}

static int hex2bin(void *dst, const char *src, size_t count)

{

	int hi, lo;

	while (count--) {

		if (*src == ' ')

			src++;

		hi = hex_to_bin(*src++);

		lo = hex_to_bin(*src++);

		if ((hi < 0) || (lo < 0))

			return -1;

		*(uint8_t *)dst++ = (hi << 4) | lo;

	}

	return 0;

}

#define hex_asc_lo(x)   hex_asc[((x) & 0x0f)]

#define hex_asc_hi(x)   hex_asc[((x) & 0xf0) >> 4]

const char hex_asc[] = "0123456789abcdef";

/* this is faster than fprintf - makes sense? */

static void bin2hex(uint8_t *buf, size_t buflen, FILE *stream)

{

	char asciihex[2];

	for (; buflen--; buf++) {

		asciihex[0] = hex_asc_hi(*buf);

		asciihex[1] = hex_asc_lo(*buf);

		fwrite(asciihex, 2, 1, stream);

	}

}

static int pack_uuid(const char *uuid_str, char *uuid)

{

	int i;

	char *to = uuid;

	for (i = 0; i < 16; ++i) {

		if (!uuid_str[0] || !uuid_str[1]) {

			log_err("wrong UUID format\n");

			return -1;

		}

		*to++ = (hex_to_bin(*uuid_str) << 4) |

			(hex_to_bin(*(uuid_str + 1)));

		uuid_str += 2;

		switch (i) {

		case 3:

		case 5:

		case 7:

		case 9:

			if (*uuid_str != '-') {

				log_err("wrong UUID format\n");

				return -1;

			}

			uuid_str++;

			continue;

		}

	}

	log_info("uuid: ");

	log_dump(uuid, 16);

	return 0;

}

static int get_uuid(struct stat *st, char *uuid)

{

	uint32_t dev;

	unsigned minor, major;

	char path[PATH_MAX], _uuid[37];

	FILE *fp;

	size_t len;

	if (uuid_str)

		return pack_uuid(uuid_str, uuid);

	dev = st->st_dev;

	major = (dev & 0xfff00) >> 8;

	minor = (dev & 0xff) | ((dev >> 12) & 0xfff00);

	log_debug("dev: %u:%u\n", major, minor);

	sprintf(path, "blkid -s UUID -o value /dev/block/%u:%u", major, minor);

	fp = popen(path, "r");

	if (!fp)

		goto err;

	len = fread(_uuid, 1, sizeof(_uuid), fp);

	pclose(fp);

	if (len != sizeof(_uuid))

		goto err;

	return pack_uuid(_uuid, uuid);

err:

	log_err("Failed to read UUID. Root access might require.\n");

	return -1;

}

static int calc_evm_hash(const char *file, unsigned char *hash)

{

	struct stat st;

	int err;

	uint32_t generation = 0;

	EVP_MD_CTX *pctx;

	unsigned int mdlen;

	char **xattrname;

	char xattr_value[1024];

	char list[1024];

	ssize_t list_size;

	char uuid[16];

	struct h_misc_64 hmac_misc;

	int hmac_size;

#if OPENSSL_VERSION_NUMBER < 0x10100000

	EVP_MD_CTX ctx;

	pctx = &ctx;

#else

	pctx = EVP_MD_CTX_new();

#endif

	if (lstat(file, &st)) {

		log_err("Failed to stat: %s\n", file);

		return -1;

	}

	if (generation_str)

		generation = strtoul(generation_str, NULL, 10);

	if (ino_str)

		st.st_ino = strtoul(ino_str, NULL, 10);

	if (uid_str)

		st.st_uid = strtoul(uid_str, NULL, 10);

	if (gid_str)

		st.st_gid = strtoul(gid_str, NULL, 10);

	if (mode_str)

		st.st_mode = strtoul(mode_str, NULL, 10);

	if (!evm_immutable) {

		if ((S_ISREG(st.st_mode) || S_ISDIR(st.st_mode)) && !generation_str) {

			/* we cannot at the momement to get generation of

			   special files kernel API does not support it */

			int fd = open(file, 0);

			if (fd < 0) {

				log_err("Failed to open: %s\n", file);

				return -1;

			}

			if (ioctl(fd, FS_IOC_GETVERSION, &generation)) {

				log_err("ioctl() failed\n");

				close(fd);

				return -1;

			}

			close(fd);

		}

		log_info("generation: %u\n", generation);

	}

	list_size = llistxattr(file, list, sizeof(list));

	if (list_size < 0) {

		log_err("llistxattr() failed\n");

		return -1;

	}

	err = EVP_DigestInit(pctx, EVP_sha1());

	if (!err) {

		log_err("EVP_DigestInit() failed\n");

		return 1;

	}

	for (xattrname = evm_config_xattrnames; *xattrname != NULL; xattrname++) {

		if (!strcmp(*xattrname, XATTR_NAME_SELINUX) && selinux_str) {

			strcpy(xattr_value, selinux_str);

			err = strlen(selinux_str) + 1;

		} else if (!strcmp(*xattrname, XATTR_NAME_IMA) && ima_str) {

			hex2bin(xattr_value, ima_str, strlen(ima_str) / 2);

			err = strlen(ima_str) / 2;

		} else if (!strcmp(*xattrname, XATTR_NAME_CAPS) && (hmac_flags & HMAC_FLAG_CAPS_SET)) {

			if (!caps_str)

				continue;

			strcpy(xattr_value, caps_str);

			err = strlen(caps_str);

		} else {

			err = lgetxattr(file, *xattrname, xattr_value, sizeof(xattr_value));

			if (err < 0) {

				log_info("no xattr: %s\n", *xattrname);

				continue;

			}

			if (!find_xattr(list, list_size, *xattrname)) {

				log_info("skipping xattr: %s\n", *xattrname);

				continue;

			}

		}

		/*log_debug("name: %s, value: %s, size: %d\n", *xattrname, xattr_value, err);*/

		log_info("name: %s, size: %d\n", *xattrname, err);

		log_debug_dump(xattr_value, err);

		err = EVP_DigestUpdate(pctx, xattr_value, err);

		if (!err) {

			log_err("EVP_DigestUpdate() failed\n");

			return 1;

		}

	}

	memset(&hmac_misc, 0, sizeof(hmac_misc));

	if (evm_immutable) {

		struct h_misc_digsig *hmac = (struct h_misc_digsig *)&hmac_misc;

		hmac_size = sizeof(*hmac);

		hmac->uid = st.st_uid;

		hmac->gid = st.st_gid;

		hmac->mode = st.st_mode;

	} else if (msize == 0) {

		struct h_misc *hmac = (struct h_misc *)&hmac_misc;

		hmac_size = sizeof(*hmac);

		if (!evm_portable) {

			hmac->ino = st.st_ino;

			hmac->generation = generation;

		}

		hmac->uid = st.st_uid;

		hmac->gid = st.st_gid;

		hmac->mode = st.st_mode;

	} else if (msize == 64) {

		struct h_misc_64 *hmac = (struct h_misc_64 *)&hmac_misc;

		hmac_size = sizeof(*hmac);

		if (!evm_portable) {

			hmac->ino = st.st_ino;

			hmac->generation = generation;

		}

		hmac->uid = st.st_uid;

		hmac->gid = st.st_gid;

		hmac->mode = st.st_mode;

	} else {

		struct h_misc_32 *hmac = (struct h_misc_32 *)&hmac_misc;

		hmac_size = sizeof(*hmac);

		if (!evm_portable) {

			hmac->ino = st.st_ino;

			hmac->generation = generation;

		}

		hmac->uid = st.st_uid;

		hmac->gid = st.st_gid;

		hmac->mode = st.st_mode;

	}

	log_debug("hmac_misc (%d): ", hmac_size);

	log_debug_dump(&hmac_misc, hmac_size);

	err = EVP_DigestUpdate(pctx, &hmac_misc, hmac_size);

	if (!err) {

		log_err("EVP_DigestUpdate() failed\n");

		return 1;

	}

	if (!evm_immutable && !evm_portable &&

	    !(hmac_flags & HMAC_FLAG_NO_UUID)) {

		err = get_uuid(&st, uuid);

		if (err)

			return -1;

		err = EVP_DigestUpdate(pctx, (const unsigned char *)uuid, sizeof(uuid));

		if (!err) {

			log_err("EVP_DigestUpdate() failed\n");

			return 1;

		}

	}

	err = EVP_DigestFinal(pctx, hash, &mdlen);

	if (!err) {

		log_err("EVP_DigestFinal() failed\n");

		return 1;

	}

	return mdlen;

}

static int sign_evm(const char *file, const char *key)

{

	unsigned char hash[20];

	unsigned char sig[1024];

	int len, err;

	len = calc_evm_hash(file, hash);

	if (len <= 1)

		return len;

	len = sign_hash("sha1", hash, len, key, NULL, sig + 1);

	if (len <= 1)

		return len;

	/* add header */

	len++;

	if (evm_portable)

		sig[0] = EVM_XATTR_PORTABLE_DIGSIG;

	else

		sig[0] = EVM_IMA_XATTR_DIGSIG;

	if (evm_immutable)

		sig[1] = 3; /* immutable signature version */

	if (sigdump || params.verbose >= LOG_INFO)

		dump(sig, len);

	if (xattr) {

		err = lsetxattr(file, "security.evm", sig, len, 0);

		if (err < 0) {

			log_err("setxattr failed: %s\n", file);

			return err;

		}

	}

	return 0;

}

static int hash_ima(const char *file)

{

	unsigned char hash[66]; /* MAX hash size + 2 */

	int len, err, offset;

	int algo = get_hash_algo(params.hash_algo);

	if (algo > PKEY_HASH_SHA1) {

		hash[0] = IMA_XATTR_DIGEST_NG;

		hash[1] = algo;

		offset = 2;

	} else {

		hash[0] = IMA_XATTR_DIGEST;

		offset = 1;

	}

	len = ima_calc_hash(file, hash + offset);

	if (len <= 1)

		return len;

	len += offset;

	if (params.verbose >= LOG_INFO)

		log_info("hash: ");

	if (sigdump || params.verbose >= LOG_INFO)

		dump(hash, len);

	if (xattr) {

		err = lsetxattr(file, "security.ima", hash, len, 0);

		if (err < 0) {

			log_err("setxattr failed: %s\n", file);

			return err;

		}

	}

	return 0;

}

static int sign_ima(const char *file, const char *key)

{

	unsigned char hash[64];

	unsigned char sig[1024];

	int len, err;

	len = ima_calc_hash(file, hash);

	if (len <= 1)

		return len;

	len = sign_hash(params.hash_algo, hash, len, key, NULL, sig + 1);

	if (len <= 1)

		return len;

	/* add header */

	len++;

	sig[0] = EVM_IMA_XATTR_DIGSIG;

	if (sigdump || params.verbose >= LOG_INFO)

		dump(sig, len);

	if (sigfile)

		bin2file(file, "sig", sig, len);

	if (xattr) {

		err = lsetxattr(file, "security.ima", sig, len, 0);

		if (err < 0) {

			log_err("setxattr failed: %s\n", file);

			return err;

		}

	}

	return 0;

}

static int get_file_type(const char *path, const char *search_type)

{

	int err, dts = 0, i;

	struct stat st;

	for (i = 0; search_type[i]; i++) {

		switch (search_type[i]) {

		case 'f':

			dts |= REG_MASK; break;

		case 'd':

			dts |= DIR_MASK; break;

		case 's':

			dts |= BLK_MASK | CHR_MASK | LNK_MASK; break;

		case 'x':

			check_xattr = true; break;

		case 'm':

			/* stay within the same filesystem*/

			err = lstat(path, &st);

			if (err < 0) {

				log_err("Failed to stat: %s\n", path);

				return err;

			}

			fs_dev = st.st_dev; /* filesystem to start from */

			break;

		}

	}

	return dts;

}

static int do_cmd(struct command *cmd, find_cb_t func)

{

	char *path = g_argv[optind++];

	int err, dts = REG_MASK; /* only regular files by default */

	if (!path) {

		log_err("Parameters missing\n");

		print_usage(cmd);

		return -1;

	}

	if (recursive) {

		if (search_type) {

			dts = get_file_type(path, search_type);

			if (dts < 0)

				return dts;

		}

		err = find(path, dts, func);

	} else {

		err = func(path);

	}

	return err;

}

static int cmd_hash_ima(struct command *cmd)

{

	return do_cmd(cmd, hash_ima);

}

static int sign_ima_file(const char *file)

{

	const char *key;

	key = params.keyfile ? : "/etc/keys/privkey_evm.pem";

	return sign_ima(file, key);

}

static int cmd_sign_ima(struct command *cmd)

{

	return do_cmd(cmd, sign_ima_file);

}

static int cmd_sign_hash(struct command *cmd)

{

	const char *key;

	char *token, *line = NULL;

	int hashlen = 0;

	size_t line_len;

	ssize_t len;

	unsigned char hash[64];

	unsigned char sig[1024] = "\x03";

	int siglen;

	key = params.keyfile ? : "/etc/keys/privkey_evm.pem";

	/* support reading hash (eg. output of shasum) */

	while ((len = getline(&line, &line_len, stdin)) > 0) {

		/* remove end of line */

		if (line[len - 1] == '\n')

			line[--len] = '\0';

		/* find the end of the hash */

		token = strpbrk(line, ", \t");

		hashlen = token ? token - line : strlen(line);

		hex2bin(hash, line, hashlen);

		siglen = sign_hash(params.hash_algo, hash, hashlen/2,

				 key, NULL, sig + 1);

		if (siglen <= 1)

			return siglen;

		fwrite(line, len, 1, stdout);

		fprintf(stdout, " ");

		bin2hex(sig, siglen + 1, stdout);

		fprintf(stdout, "\n");

	}

	if (!hashlen) {

		log_err("Parameters missing\n");

		print_usage(cmd);

		return -1;

	}

	return 0;

}

static int sign_evm_path(const char *file)

{

	const char *key;

	int err;

	key = params.keyfile ? : "/etc/keys/privkey_evm.pem";

	if (digsig) {

		err = sign_ima(file, key);

		if (err)

			return err;

	}

	if (digest) {

		err = hash_ima(file);

		if (err)

			return err;

	}

	return sign_evm(file, key);

}

static int cmd_sign_evm(struct command *cmd)

{

	return do_cmd(cmd, sign_evm_path);

}

static int verify_evm(const char *file)

{

	unsigned char hash[20];

	unsigned char sig[1024];

	int len;

	len = calc_evm_hash(file, hash);

	if (len <= 1)

		return len;

	len = lgetxattr(file, "security.evm", sig, sizeof(sig));

	if (len < 0) {

		log_err("getxattr failed: %s\n", file);

		return len;

	}

	if (sig[0] != 0x03) {

		log_err("security.evm has no signature\n");

		return -1;

	}

	return verify_hash(file, hash, sizeof(hash), sig + 1, len - 1);

}

static int cmd_verify_evm(struct command *cmd)

{

	char *file = g_argv[optind++];

	int err;

	if (!file) {

		log_err("Parameters missing\n");

		print_usage(cmd);

		return -1;

	}

	err = verify_evm(file);

	if (!err && params.verbose >= LOG_INFO)

		log_info("%s: verification is OK\n", file);

	return err;

}

static int verify_ima(const char *file)

{

	unsigned char sig[1024];

	int len;

	if (sigfile) {

		void *tmp = file2bin(file, "sig", &len;;

		memcpy(sig, tmp, len);

		free(tmp);

	} else {

		len = lgetxattr(file, "security.ima", sig, sizeof(sig));

		if (len < 0) {

			log_err("getxattr failed: %s\n", file);

			return len;

		}

	}

	return ima_verify_signature(file, sig, len, NULL, 0);

}

static int cmd_verify_ima(struct command *cmd)

{

	char *file = g_argv[optind++];

	int err;

	errno = 0;

	if (!file) {

		log_err("Parameters missing\n");

		print_usage(cmd);

		return -1;

	}

	err = verify_ima(file);

	if (!err && params.verbose >= LOG_INFO)

		log_info("%s: verification is OK\n", file);

	return err;

}

static int cmd_convert(struct command *cmd)

{

	char *inkey;

	unsigned char _pub[1024], *pub = _pub;

	int len, err = 0;

	char name[20];

	uint8_t keyid[8];

	RSA *key;

	params.x509 = 0;

	inkey = g_argv[optind++];

	if (!inkey) {

		inkey = params.x509 ? "/etc/keys/x509_evm.der" :

				      "/etc/keys/pubkey_evm.pem";

	}

	key = read_pub_key(inkey, params.x509);

	if (!key)

		return 1;

	len = key2bin(key, pub);

	calc_keyid_v1(keyid, name, pub, len);

	bin2file(inkey, "bin", pub, len);

	bin2file(inkey, "keyid", (const unsigned char *)name, strlen(name));

	RSA_free(key);

	return err;

}

static int cmd_import(struct command *cmd)

{

	char *inkey, *ring = NULL;

	unsigned char _pub[1024], *pub = _pub;

	int id, len, err = 0;

	char name[20];

	uint8_t keyid[8];

	RSA *key;

	inkey = g_argv[optind++];

	if (!inkey) {

		inkey = params.x509 ? "/etc/keys/x509_evm.der" :

				      "/etc/keys/pubkey_evm.pem";

	} else

		ring = g_argv[optind++];

	id = KEY_SPEC_USER_KEYRING; /* default keyring */

	if (ring) {

		if (ring[0] != '@') {

			int base = 10;

			if (ring[0] == '0' && ring[1] == 'x')