base/SOURCES/sudo-1.8.6p7-digest-backport.patch

From c8a6eecf768d8102a9a77f5fdb5b516e571d462e Mon Sep 17 00:00:00 2001
From: Radovan Sroka <rsroka@redhat.com>
Date: Tue, 23 Aug 2016 13:43:08 +0200
Subject: [PATCH] Using libgcrypt

Using libgcrypt and not sudo implementation of SHA...

Rebased patch of digest backport.
Added option --with-gcrypt

Rebased from:
Patch35: sudo-1.8.6p7-digest-backport.patch

Resolves:
rhbz#1183818
---
 configure.ac                 |  16 +++++++
 plugins/sudoers/Makefile.in  |   9 +++-
 plugins/sudoers/filedigest.c | 104 +++++++++++++++++++++++++++++++++++++++++++
 plugins/sudoers/filedigest.h |  17 +++++++
 plugins/sudoers/match.c      |  94 ++++++++++++++++++++++++++++++--------
 5 files changed, 219 insertions(+), 21 deletions(-)
 create mode 100644 plugins/sudoers/filedigest.c
 create mode 100644 plugins/sudoers/filedigest.h

diff --git a/configure.ac b/configure.ac
index 13c3c1b..54929b2 100644
--- a/configure.ac
+++ b/configure.ac
@@ -35,6 +35,7 @@ AC_SUBST([SUDO_OBJS])
 AC_SUBST([LIBS])
 AC_SUBST([SUDO_LIBS])
 AC_SUBST([SUDOERS_LIBS])
+AC_SUBST([LIBPARSESUDOERS_LIBS])
 AC_SUBST([STATIC_SUDOERS])
 AC_SUBST([NET_LIBS])
 AC_SUBST([AFS_LIBS])
@@ -1517,6 +1518,19 @@ AC_ARG_WITH(selinux, [AS_HELP_STRING([--with-selinux], [enable SELinux support])
 		;;
 esac], [with_selinux=no])
 
+AC_ARG_WITH(gcrypt, [AS_HELP_STRING([--with-gcrypt], [enable libgcrypt support])],
+[case $with_gcrypt in
+    yes)
+               AC_DEFINE(HAVE_LIBGCRYPT)
+               LIBPARSESUDOERS_LIBS="${LIBPARSESUDOERS_LIBS} -lgcrypt"
+               AC_CHECK_LIB([gcrypt], [gcry_md_open],
+                   [AC_DEFINE(HAVE_GCRY_MD_OPEN)])
+               ;;
+    no)                ;;
+    *)         AC_MSG_ERROR(["--with-gcrypt does not take an argument."])
+               ;;
+esac])
+
 dnl
 dnl gss_krb5_ccache_name() may not work on Heimdal so we don't use it by default
 dnl
@@ -4344,6 +4358,8 @@ AH_TEMPLATE(HAVE_PROJECT_H, [Define to 1 if you have the <project.h> header file
 AH_TEMPLATE(HAVE_SECURID, [Define to 1 if you use SecurID for authentication.])
 AH_TEMPLATE(HAVE_SELINUX, [Define to 1 to enable SELinux RBAC support.])
 AH_TEMPLATE(HAVE_SETKEYCREATECON, [Define to 1 if you have the `setkeycreatecon' function.])
+AH_TEMPLATE(HAVE_LIBGCRYPT, [Define to 1 to enable libgcrypt support.])
+AH_TEMPLATE(HAVE_GCRY_MD_OPEN, [Define to 1 if you have the `gcry_md_open' function.])
 AH_TEMPLATE(HAVE_SHL_LOAD, [Define to 1 if you have the `shl_load' function.])
 AH_TEMPLATE(HAVE_SKEY, [Define to 1 if you use S/Key.])
 AH_TEMPLATE(HAVE_SKEYACCESS, [Define to 1 if your S/Key library has skeyaccess().])
diff --git a/plugins/sudoers/Makefile.in b/plugins/sudoers/Makefile.in
index f36f9ef..32c0ed0 100644
--- a/plugins/sudoers/Makefile.in
+++ b/plugins/sudoers/Makefile.in
@@ -55,6 +55,7 @@ LT_LIBS = $(top_builddir)/lib/util/libsudo_util.la
 LIBS = $(LT_LIBS)
 NET_LIBS = @NET_LIBS@
 SUDOERS_LIBS = @SUDOERS_LIBS@ @AFS_LIBS@ @GETGROUPS_LIB@ $(LIBS) $(NET_LIBS) @ZLIB@ @LIBMD@
+LIBPARSESUDOERS_LIBS = @LIBPARSESUDOERS_LIBS@
 REPLAY_LIBS = @REPLAY_LIBS@ @ZLIB@
 VISUDO_LIBS = $(NET_LIBS) @LIBMD@
 TESTSUDOERS_LIBS = $(NET_LIBS) @LIBMD@
@@ -153,7 +154,7 @@ AUTH_OBJS = sudo_auth.lo @AUTH_OBJS@
 LIBPARSESUDOERS_OBJS = alias.lo audit.lo base64.lo defaults.lo hexchar.lo \
 		       gram.lo match.lo match_addr.lo pwutil.lo pwutil_impl.lo \
 		       rcstr.lo redblack.lo sudoers_debug.lo timestr.lo \
-		       toke.lo toke_util.lo
+		       toke.lo toke_util.lo filedigest.lo
 
 SUDOERS_OBJS = $(AUTH_OBJS) boottime.lo check.lo editor.lo env.lo find_path.lo \
 	       gc.lo goodpath.lo group_plugin.lo interfaces.lo iolog.lo \
@@ -217,7 +218,7 @@ Makefile: $(srcdir)/Makefile.in
 	(cd $(top_builddir) && ./config.status --file plugins/sudoers/Makefile)
 
 libparsesudoers.la: $(LIBPARSESUDOERS_OBJS)
-	$(LIBTOOL) $(LTFLAGS) --mode=link $(CC) -o $@ $(LIBPARSESUDOERS_OBJS) -no-install
+	$(LIBTOOL) --mode=link $(CC) -o $@ $(LIBPARSESUDOERS_OBJS) $(LIBPARSESUDOERS_LIBS) -no-install
 
 sudoers.la: $(SUDOERS_OBJS) $(LT_LIBS) libparsesudoers.la @LT_LDDEP@
 	case "$(LT_LDFLAGS)" in \
@@ -656,6 +657,10 @@ env.lo: $(srcdir)/env.c $(devdir)/def_data.h $(incdir)/compat/stdbool.h \
         $(srcdir)/sudoers.h $(srcdir)/sudoers_debug.h $(top_builddir)/config.h \
         $(top_builddir)/pathnames.h
 	$(LIBTOOL) $(LTFLAGS) --mode=compile $(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(SSP_CFLAGS) $(srcdir)/env.c
+filedigest.lo: $(srcdir)/filedigest.c $(top_builddir)/config.h \
+        $(incdir)/sudo_debug.h
+	$(LIBTOOL) --mode=compile $(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(SSP_CFLAGS) $(DEFS) $(srcdir)/filedigest.c
+filedigest.o: filedigest.lo
 find_path.lo: $(srcdir)/find_path.c $(devdir)/def_data.h \
               $(incdir)/compat/stdbool.h $(incdir)/sudo_compat.h \
               $(incdir)/sudo_conf.h $(incdir)/sudo_debug.h \
diff --git a/plugins/sudoers/filedigest.c b/plugins/sudoers/filedigest.c
new file mode 100644
index 0000000..c173741
--- /dev/null
+++ b/plugins/sudoers/filedigest.c
@@ -0,0 +1,104 @@
+#include <config.h>
+#include <errno.h>
+#include <stddef.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include "filedigest.h"
+#include "sudo_compat.h"
+#include "sudo_debug.h"
+
+#if defined(HAVE_LIBGCRYPT)
+#include <gcrypt.h>
+
+static int sudo_filedigest_gcrypt(int fd, int algo, unsigned char **dvalue, size_t *dvalue_size)
+{
+  char buffer[4096];
+  gcry_md_hd_t ctx;
+  int gcry_algo;
+  debug_decl(sudo_filedigest_gcrypt, SUDO_DEBUG_UTIL);
+
+  switch(algo) {
+  case SUDO_DIGEST_SHA224:
+    gcry_algo = GCRY_MD_SHA224; break;
+  case SUDO_DIGEST_SHA256:
+    gcry_algo = GCRY_MD_SHA256; break;
+  case SUDO_DIGEST_SHA384:
+    gcry_algo = GCRY_MD_SHA384; break;
+  case SUDO_DIGEST_SHA512:
+    gcry_algo = GCRY_MD_SHA512; break;
+  default:
+    debug_return_int(-1);
+  }
+
+  gcry_md_open(&ctx, gcry_algo, 0);
+
+  /* Read block of data from fd and digest them */
+  while (1) {
+    const ssize_t read_bytes = read(fd, buffer, sizeof buffer);
+
+    if (read_bytes < 0) {
+      /* Error */
+      gcry_md_close(ctx);
+      debug_return_int(-1);
+    }
+    else if (read_bytes > 0) {
+      /* Some data read -- update the digest */
+      gcry_md_write(ctx, buffer, (size_t)read_bytes);
+    }
+    else {
+      /* EOF */
+      break;
+    }
+  }
+
+  /*
+   * All data digested. Finalize the digest value.
+   */
+  const unsigned char *value = gcry_md_read(ctx, gcry_algo);
+
+  if (value == NULL) {
+    debug_return_int(-1);
+  }
+
+  /*
+   * Make a copy of the digest value. The pointer
+   * returned from gcry_md_read cannot be used after
+   * gcry_md_close was called
+   */
+  (*dvalue_size) = gcry_md_get_algo_dlen(gcry_algo);
+  (*dvalue) = malloc(*dvalue_size);
+
+  if (*dvalue == NULL) {
+    debug_return_int(-1);
+  }
+
+  memcpy(*dvalue, value, *dvalue_size);
+  gcry_md_close(ctx);
+
+  debug_return_int(0);
+}
+#endif
+
+#include <stdio.h>
+
+int sudo_filedigest(const char *path, int algo, unsigned char **dvalue, size_t *dvalue_size)
+{
+  int rc = -1;
+  int fd = -1;
+  debug_decl(sudo_filedigest, SUDO_DEBUG_UTIL);
+
+  if ((fd = open(path, O_RDONLY)) < 0) {
+    debug_return_int(rc);
+  }
+
+#if defined(HAVE_LIBGCRYPT)
+  rc = sudo_filedigest_gcrypt(fd, algo, dvalue, dvalue_size);
+  close(fd);
+#else
+  rc = -1;
+  errno = ENOTSUP;
+#endif
+  debug_return_int(rc);
+}
diff --git a/plugins/sudoers/filedigest.h b/plugins/sudoers/filedigest.h
new file mode 100644
index 0000000..437f02f
--- /dev/null
+++ b/plugins/sudoers/filedigest.h
@@ -0,0 +1,17 @@
+#include <stddef.h>
+
+#define SUDO_DIGEST_SHA224	0
+#define SUDO_DIGEST_SHA256	1
+#define SUDO_DIGEST_SHA384	2
+#define SUDO_DIGEST_SHA512	3
+#define SUDO_DIGEST_INVALID     4
+
+#define SUDO_SHA224_DIGEST_LENGTH 28
+#define SUDO_SHA256_DIGEST_LENGTH 32
+#define SUDO_SHA384_DIGEST_LENGTH 48
+#define SUDO_SHA512_DIGEST_LENGTH 64
+
+/*
+ * Compute a digest of a given file. Returns 0 on success, -1 otherwise.
+ */
+int sudo_filedigest(const char *path, int algo, unsigned char **dvalue, size_t *dvalue_size);
diff --git a/plugins/sudoers/match.c b/plugins/sudoers/match.c
index 1916bde..2a9ea4b 100644
--- a/plugins/sudoers/match.c
+++ b/plugins/sudoers/match.c
@@ -62,6 +62,7 @@
 
 #include "sudoers.h"
 #include "parse.h"
+#include "filedigest.h"
 #include <gram.h>
 
 #ifdef HAVE_FNMATCH
@@ -576,6 +577,7 @@ command_matches_normal(const char *sudoers_cmnd, const char *sudoers_args, const
 }
 #else /* !SUDOERS_NAME_MATCH */
 
+#ifndef HAVE_LIBGCRYPT /* !!! */
 static struct digest_function {
     const char *digest_name;
     const unsigned int digest_len;
@@ -616,24 +618,43 @@ static struct digest_function {
 	NULL
     }
 };
+#endif /* !HAVE_LIBGCRYPT */
+
+static const char *digesttype2str(int digest_type)
+{
+    switch(digest_type) {
+        case SUDO_DIGEST_SHA224:
+            return "SHA224";
+        case SUDO_DIGEST_SHA256:
+            return "SHA256";
+        case SUDO_DIGEST_SHA384:
+            return "SHA384";
+        case SUDO_DIGEST_SHA512:
+            return "SHA512";
+    }
+    return "<INVALID>";
+}
 
 static bool
 digest_matches(const char *file, const struct sudo_digest *sd, int *fd)
 {
-    unsigned char file_digest[SHA512_DIGEST_LENGTH];
-    unsigned char sudoers_digest[SHA512_DIGEST_LENGTH];
+    unsigned char * file_digest = NULL;
+    unsigned char * sudoers_digest = NULL;
+    size_t digest_size;
     unsigned char buf[32 * 1024];
-    struct digest_function *func = NULL;
 #ifdef HAVE_FEXECVE
     bool first = true;
     bool is_script = false;
 #endif /* HAVE_FEXECVE */
     size_t nread;
-    SHA2_CTX ctx;
     FILE *fp;
     unsigned int i;
     debug_decl(digest_matches, SUDOERS_DEBUG_MATCH)
 
+#ifndef HAVE_LIBGCRYPT /* !!! */
+
+    SHA2_CTX ctx;
+    struct digest_function *func = NULL;
     for (i = 0; digest_functions[i].digest_name != NULL; i++) {
 	if (sd->digest_type == i) {
 	    func = &digest_functions[i];
@@ -644,9 +665,33 @@ digest_matches(const char *file, const struct sudo_digest *sd, int *fd)
 	sudo_warnx(U_("unsupported digest type %d for %s"), sd->digest_type, file);
 	debug_return_bool(false);
     }
-    if (strlen(sd->digest_str) == func->digest_len * 2) {
+
+    digest_size = func->digest_len;
+
+    file_digest = malloc(digest_size);
+    if (file_digest == NULL) {
+	debug_return_bool(false);
+    }
+
+#elif HAVE_LIBGCRYPT
+
+    if (sudo_filedigest(file, sd->digest_type,
+        &file_digest, &digest_size) != 0) {
+        sudo_warnx(U_("Cannot compute digest type %d for %s"), sd->digest_type, file);
+        goto clean_up;
+    }
+
+#endif /* !HAVE_LIBGCRYPT */
+
+    sudoers_digest = malloc(digest_size);
+    if (sudoers_digest == NULL) {
+        free(file_digest);
+	debug_return_bool(false);
+    }
+
+    if (strlen(sd->digest_str) == digest_size * 2) {
 	/* Convert the command digest from ascii hex to binary. */
-	for (i = 0; i < func->digest_len; i++) {
+	for (i = 0; i < digest_size ; i++) {
 	    const int h = hexchar(&sd->digest_str[i + i]);
 	    if (h == -1)
 		goto bad_format;
@@ -654,11 +699,11 @@ digest_matches(const char *file, const struct sudo_digest *sd, int *fd)
 	}
     } else {
 	size_t len = base64_decode(sd->digest_str, sudoers_digest,
-	    sizeof(sudoers_digest));
-	if (len != func->digest_len) {
+	    digest_size);
+	if (len != digest_size) {
 	    sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
-		"incorrect length for digest, expected %u, got %zu",
-		func->digest_len, len);
+		"incorrect length for digest, expected %zu, got %zu",
+		digest_size, len);
 	    goto bad_format;
 	}
     }
@@ -666,10 +711,11 @@ digest_matches(const char *file, const struct sudo_digest *sd, int *fd)
     if ((fp = fopen(file, "r")) == NULL) {
 	sudo_debug_printf(SUDO_DEBUG_INFO, "unable to open %s: %s",
 	    file, strerror(errno));
-	debug_return_bool(false);
+        goto clean_up;
     }
-
+#ifndef HAVE_LIBGCRYPT
     func->init(&ctx);
+#endif /* !HAVE_LIBGCRYPT */
     while ((nread = fread(buf, 1, sizeof(buf), fp)) != 0) {
 #ifdef HAVE_FEXECVE
 	/* Check for #! cookie and set is_script. */
@@ -679,21 +725,24 @@ digest_matches(const char *file, const struct sudo_digest *sd, int *fd)
 		is_script = true;
 	}
 #endif /* HAVE_FEXECVE */
+#ifndef HAVE_LIBGCRYPT
 	func->update(&ctx, buf, nread);
+#endif /* !HAVE_LIBGCRYPT */
     }
     if (ferror(fp)) {
 	sudo_warnx(U_("%s: read error"), file);
 	fclose(fp);
-	debug_return_bool(false);
+        goto clean_up;
     }
+#ifndef HAVE_LIBGCRYPT
     func->final(file_digest, &ctx);
-
-    if (memcmp(file_digest, sudoers_digest, func->digest_len) != 0) {
+#endif /* !HAVE_LIBGCRYPT */
+    if (memcmp(file_digest, sudoers_digest, digest_size) != 0) {
 	fclose(fp);
 	sudo_debug_printf(SUDO_DEBUG_DIAG|SUDO_DEBUG_LINENO,
 	    "%s digest mismatch for %s, expecting %s",
-	    func->digest_name, file, sd->digest_str);
-	debug_return_bool(false);
+	    digesttype2str(sd->digest_type), file, sd->digest_str);
+        goto clean_up;
     }
 
 #ifdef HAVE_FEXECVE
@@ -705,7 +754,7 @@ digest_matches(const char *file, const struct sudo_digest *sd, int *fd)
 	sudo_debug_printf(SUDO_DEBUG_INFO, "unable to dup %s: %s",
 	    file, strerror(errno));
 	fclose(fp);
-	debug_return_bool(false);
+        goto clean_up;
     }
     /*
      * Shell scripts go through namei twice and so we can't set the close
@@ -715,10 +764,17 @@ digest_matches(const char *file, const struct sudo_digest *sd, int *fd)
 	(void)fcntl(*fd, F_SETFD, FD_CLOEXEC);
 #endif /* HAVE_FEXECVE */
     fclose(fp);
+    free(file_digest);
+    free(sudoers_digest);
     debug_return_bool(true);
 bad_format:
     sudo_warnx(U_("digest for %s (%s) is not in %s form"), file,
-	sd->digest_str, func->digest_name);
+	sd->digest_str, digesttype2str(sd->digest_type));
+clean_up:
+    if (file_digest)
+        free(file_digest);
+    if (sudoers_digest)
+        free(sudoers_digest);
     debug_return_bool(false);
 }
 
-- 
2.7.4