X-Git-Url: https://git.strongswan.org/?p=strongswan.git;a=blobdiff_plain;f=src%2Flibstrongswan%2Fintegrity_checker.c;h=32a296d79e988fc75ba7b3613d1c714bbb037b21;hp=eb0bc1407dfa1b523c5f72d22ec3fc8ec84ff7dc;hb=e1089f5906e4e148f5f1659373ff5f71a8dfcba2;hpb=8ce8e190682be9bafb7a69a77cf7c1443e53cf03

diff --git a/src/libstrongswan/integrity_checker.c b/src/libstrongswan/integrity_checker.c
index eb0bc14..32a296d 100644
--- a/src/libstrongswan/integrity_checker.c
+++ b/src/libstrongswan/integrity_checker.c
@@ -60,7 +60,8 @@ struct private_integrity_checker_t {
 /**
  * Implementation of integrity_checker_t.build_file
  */
-static u_int32_t build_file(private_integrity_checker_t *this, char *file)
+static u_int32_t build_file(private_integrity_checker_t *this, char *file,
+							size_t *len)
 {
 	u_int32_t checksum;
 	chunk_t contents;
@@ -71,13 +72,13 @@ static u_int32_t build_file(private_integrity_checker_t *this, char *file)
 	fd = open(file, O_RDONLY);
 	if (fd == -1)
 	{
-		DBG1("opening '%s' failed: %s", file, strerror(errno));
+		DBG1("  opening '%s' failed: %s", file, strerror(errno));
 		return 0;
 	}
 	
 	if (fstat(fd, &sb) == -1)
 	{
-		DBG1("getting file size of '%s' failed: %s", file, strerror(errno));
+		DBG1("  getting file size of '%s' failed: %s", file, strerror(errno));
 		close(fd);
 		return 0;
 	}
@@ -85,11 +86,12 @@ static u_int32_t build_file(private_integrity_checker_t *this, char *file)
 	addr = mmap(NULL, sb.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
 	if (addr == MAP_FAILED)
 	{
-		DBG1("mapping '%s' failed: %s", file, strerror(errno));
+		DBG1("  mapping '%s' failed: %s", file, strerror(errno));
 		close(fd);
 		return 0;
 	}
-	
+
+	*len = sb.st_size;	
 	contents = chunk_create(addr, sb.st_size);
 	checksum = chunk_hash(contents);
 	
@@ -136,24 +138,26 @@ static int callback(struct dl_phdr_info *dlpi, size_t size, Dl_info *dli)
 /**
  * Implementation of integrity_checker_t.build_segment
  */
-static u_int32_t build_segment(private_integrity_checker_t *this, void *sym)
+static u_int32_t build_segment(private_integrity_checker_t *this, void *sym,
+							   size_t *len)
 {
 	chunk_t segment;
 	Dl_info dli;
 	
 	if (dladdr(sym, &dli) == 0)
 	{
-		DBG1("unable to locate symbol: %s", dlerror());
+		DBG1("  unable to locate symbol: %s", dlerror());
 		return 0;
 	}
 	/* we reuse the Dl_info struct as in/out parameter */
 	if (!dl_iterate_phdr((void*)callback, &dli))
 	{
-		DBG1("executable section not found");
+		DBG1("  executable section not found");
 		return 0;
 	}
 	
 	segment = chunk_create(dli.dli_fbase, dli.dli_saddr - dli.dli_fbase);
+	*len = segment.len;
 	return chunk_hash(segment);
 }
 
@@ -183,6 +187,7 @@ static bool check_file(private_integrity_checker_t *this,
 {
 	integrity_checksum_t *cs;
 	u_int32_t sum;
+	size_t len = 0;
 	
 	cs = find_checksum(this, name);
 	if (!cs)
@@ -190,8 +195,18 @@ static bool check_file(private_integrity_checker_t *this,
 		DBG1("  '%s' file checksum not found", name);
 		return FALSE;
 	}
-	sum = build_file(this, file);
-	if (!sum || cs->file != sum)
+	sum = build_file(this, file, &len);
+	if (!sum)
+	{
+		return FALSE;
+	}
+	if (cs->file_len != len)
+	{
+		DBG1("  invalid '%s' file size: %u bytes, expected %u bytes",
+			 name, len, cs->file_len);
+		return FALSE;
+	}
+	if (cs->file != sum)
 	{
 		DBG1("  invalid '%s' file checksum: %08x, expected %08x",
 			 name, sum, cs->file);
@@ -209,6 +224,7 @@ static bool check_segment(private_integrity_checker_t *this,
 {
 	integrity_checksum_t *cs;
 	u_int32_t sum;
+	size_t len = 0;
 	
 	cs = find_checksum(this, name);
 	if (!cs)
@@ -216,8 +232,18 @@ static bool check_segment(private_integrity_checker_t *this,
 		DBG1("  '%s' segment checksum not found", name);
 		return FALSE;
 	}
-	sum = build_segment(this, sym);
-	if (!sum || cs->segment != sum)
+	sum = build_segment(this, sym, &len);
+	if (!sum)
+	{
+		return FALSE;
+	}
+	if (cs->segment_len != len)
+	{
+		DBG1("  invalid '%s' segment size: %u bytes, expected %u bytes",
+			 name, len, cs->segment_len);
+		return FALSE;
+	}
+	if (cs->segment != sum)
 	{
 		DBG1("  invalid '%s' segment checksum: %08x, expected %08x",
 			 name, sum, cs->segment);
@@ -270,9 +296,9 @@ integrity_checker_t *integrity_checker_create(char *checksum_library)
 	private_integrity_checker_t *this = malloc_thing(private_integrity_checker_t);
 	
 	this->public.check_file = (bool(*)(integrity_checker_t*, char *name, char *file))check_file;
-	this->public.build_file = (u_int32_t(*)(integrity_checker_t*, char *file))build_file;
+	this->public.build_file = (u_int32_t(*)(integrity_checker_t*, char *file, size_t *len))build_file;
 	this->public.check_segment = (bool(*)(integrity_checker_t*, char *name, void *sym))check_segment;
-	this->public.build_segment = (u_int32_t(*)(integrity_checker_t*, void *sym))build_segment;
+	this->public.build_segment = (u_int32_t(*)(integrity_checker_t*, void *sym, size_t *len))build_segment;
 	this->public.check = (bool(*)(integrity_checker_t*, char *name, void *sym))check;
 	this->public.destroy = (void(*)(integrity_checker_t*))destroy;