logenc: support keyfiles in rscryutil

4 files changed, 88 insertions, 7 deletions

diff --git a/runtime/Makefile.am b/runtime/Makefile.am
index e1f0673c..ee5a3ef2 100644
--- a/runtime/Makefile.am
+++ b/runtime/Makefile.am
@@ -1,6 +1,6 @@
 sbin_PROGRAMS =
 man_MANS = 
-noinst_LTLIBRARIES = librsyslog.la librsgt.la
+noinst_LTLIBRARIES = librsyslog.la
 pkglib_LTLIBRARIES =
 #pkglib_LTLIBRARIES = librsyslog.la
 
@@ -178,15 +178,14 @@ endif
 # support library for libgcrypt
 #
 if ENABLE_LIBGCRYPT
-#noinst_LTLIBRARIES += libgcry.la
-#libgcry_la_SOURCES = libgcry.c libgcry.h
-#libcgry_la_CPPFLAGS = $(RSRT_CFLAGS) $(LIBGCRYPT_CFLAGS)
+   noinst_LTLIBRARIES += libgcry.la
+   libgcry_la_SOURCES = libgcry.c libgcry_common.c libgcry.h
+   libgcry_la_CPPFLAGS = $(RSRT_CFLAGS) $(LIBGCRYPT_CFLAGS)
    pkglib_LTLIBRARIES += lmcry_gcry.la
-   lmcry_gcry_la_SOURCES = lmcry_gcry.c lmcry_gcry.h libgcry.c libgcry.h
+   lmcry_gcry_la_SOURCES = lmcry_gcry.c lmcry_gcry.h
    lmcry_gcry_la_CPPFLAGS = $(RSRT_CFLAGS) $(LIBGCRYPT_CFLAGS)
    lmcry_gcry_la_LDFLAGS = -module -avoid-version `libgcrypt-config --libs`
-#lmcry_gcry_la_LIBADD = libgcry.la $(LIBGCRYPT_LIBS)
-   lmcry_gcry_la_LIBADD = $(LIBGCRYPT_LIBS)
+   lmcry_gcry_la_LIBADD = libgcry.la $(LIBGCRYPT_LIBS)
 endif
 
 
@@ -194,6 +193,7 @@ endif
 # support library for guardtime
 #
 if ENABLE_GUARDTIME
+   noinst_LTLIBRARIES +=  librsgt.la
    librsgt_la_SOURCES = librsgt.c librsgt_read.c librsgt.h
    pkglib_LTLIBRARIES += lmsig_gt.la
    lmsig_gt_la_SOURCES = lmsig_gt.c lmsig_gt.h
diff --git a/runtime/libgcry.c b/runtime/libgcry.c
index ef94e8ac..e57ee8bc 100644
--- a/runtime/libgcry.c
+++ b/runtime/libgcry.c
@@ -43,6 +43,8 @@
 #include <gcrypt.h>
 #include <sys/stat.h>
 #include <sys/uio.h>
+#include <sys/types.h>
+#include <unistd.h>
 #include <fcntl.h>
 #include <errno.h>
 
@@ -199,6 +201,7 @@ finalize_it:
 	RETiRet;
 }
 
+
 gcryctx
 gcryCtxNew(void)
 {
diff --git a/runtime/libgcry.h b/runtime/libgcry.h
index d699124d..5dde1576 100644
--- a/runtime/libgcry.h
+++ b/runtime/libgcry.h
@@ -41,6 +41,7 @@ struct gcryfile_s {
 	gcryctx ctx;
 };
 
+int gcryGetKeyFromFile(char *fn, char **key, unsigned *keylen);
 int rsgcryInit(void);
 void rsgcryExit(void);
 int rsgcrySetKey(gcryctx ctx, unsigned char *key, uint16_t keyLen);
diff --git a/runtime/libgcry_common.c b/runtime/libgcry_common.c
new file mode 100644
index 00000000..49a0e669
--- /dev/null
+++ b/runtime/libgcry_common.c
@@ -0,0 +1,77 @@
+/* libgcry_common.c
+ * This file hosts functions both being used by the rsyslog runtime as
+ * well as tools who do not use the runtime (so we can maintain the
+ * code at a single place).
+ *
+ * Copyright 2013 Adiscon GmbH.
+ *
+ * This file is part of rsyslog.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *       -or-
+ *       see COPYING.ASL20 in the source distribution
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#if HAVE_CONFIG_H
+#include "config.h"
+#endif
+#include <stdio.h>
+#include <gcrypt.h>
+#include <sys/stat.h>
+#include <sys/uio.h>
+#include <sys/types.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <errno.h>
+
+#include "rsyslog.h" /* we need data typedefs */
+#include "libgcry.h"
+
+
+/* read a key from a key file
+ * @param[out] key - key buffer, must be freed by caller
+ * @param[out] keylen - length of buffer
+ * @returns 0 if OK, something else otherwise (we do not use
+ *            iRet as this is also called from non-rsyslog w/o runtime)
+ * The key length is limited to 64KiB to prevent DoS.
+ * Note well: key is a blob, not a C string (NUL may be present!)
+ */
+int
+gcryGetKeyFromFile(char *fn, char **key, unsigned *keylen)
+{
+	struct stat sb;
+	int fd;
+	int r;
+
+	if(stat(fn, &sb) == -1) {
+		r = 1; goto done;
+	}
+	if((sb.st_mode & S_IFMT) != S_IFREG) {
+		r = 2; goto done;
+	}
+	if(sb.st_size > 64*1024) {
+		r = 3; goto done;
+	}
+	if((*key = malloc(sb.st_size)) == NULL) {
+		r = -1; goto done;
+	}
+	if((fd = open(fn, O_RDONLY)) < 0) {
+		r = 4; goto done;
+	}
+	if(read(fd, *key, sb.st_size) != sb.st_size) {
+		r = 5; goto done;
+	}
+	*keylen = sb.st_size;
+	close(fd);
+	r = 0;
+done:	return r;
+}