Modify checkhash.pl so it can be run standalone or included as a funtion

in another perl script.
This commit is contained in:
Dr. Stephen Henson
2005-04-17 12:37:08 +00:00
parent 0e23faec0a
commit 48d0ba4a1e

View File

@@ -1,5 +1,20 @@
#!/usr/local/bin/perl -w #!/usr/local/bin/perl -w
my $package = caller;
if (!(defined $package))
{
my $retval = check_hashes(@ARGV);
exit $retval;
}
1;
sub check_hashes
{
my @args = @_;
my $change_dir = ""; my $change_dir = "";
my $check_program = "sha1/fips_standalone_sha1"; my $check_program = "sha1/fips_standalone_sha1";
@@ -12,47 +27,48 @@ my $recurse = 0;
my @fingerprint_files; my @fingerprint_files;
while (@ARGV) while (@args)
{ {
my $arg = $ARGV[0]; my $arg = $args[0];
if ($arg eq "-chdir") if ($arg eq "-chdir")
{ {
shift @ARGV; shift @args;
$change_dir = shift @ARGV; $change_dir = shift @args;
} }
elsif ($arg eq "-rebuild") elsif ($arg eq "-rebuild")
{ {
shift @ARGV; shift @args;
$rebuild = 1; $rebuild = 1;
} }
elsif ($arg eq "-verbose") elsif ($arg eq "-verbose")
{ {
shift @ARGV; shift @args;
$verbose = 1; $verbose = 1;
} }
elsif ($arg eq "-force-rewrite") elsif ($arg eq "-force-rewrite")
{ {
shift @ARGV; shift @args;
$force_rewrite = 1; $force_rewrite = 1;
} }
elsif ($arg eq "-hash_file") elsif ($arg eq "-hash_file")
{ {
shift @ARGV; shift @args;
$hash_file = shift @ARGV; $hash_file = shift @args;
} }
elsif ($arg eq "-recurse") elsif ($arg eq "-recurse")
{ {
shift @ARGV; shift @args;
$recurse = 1; $recurse = 1;
} }
elsif ($arg eq "-program_path") elsif ($arg eq "-program_path")
{ {
shift @ARGV; shift @args;
$check_program = shift @ARGV; $check_program = shift @args;
} }
else else
{ {
die "Unknown Option $arg"; print STDERR "Unknown Option $arg";
return 1;
} }
} }
@@ -71,7 +87,11 @@ else
foreach $fp (@fingerprint_files) foreach $fp (@fingerprint_files)
{ {
open(IN, "$fp") || die "Can't open file $fp"; if (!open(IN, "$fp"))
{
print STDERR "Can't open file $fp";
return 1;
}
print STDERR "Opening Fingerprint file $fp\n" if $verbose; print STDERR "Opening Fingerprint file $fp\n" if $verbose;
my $dir = $fp; my $dir = $fp;
$dir =~ s/[^\/]*$//; $dir =~ s/[^\/]*$//;
@@ -83,22 +103,26 @@ foreach $fp (@fingerprint_files)
print STDERR "FATAL: Invalid syntax in file $fp\n"; print STDERR "FATAL: Invalid syntax in file $fp\n";
print STDERR "Line:\n$_\n"; print STDERR "Line:\n$_\n";
fatal_error(); fatal_error();
return 1;
} }
if (!$rebuild && length($hash) != 40) if (!$rebuild && length($hash) != 40)
{ {
print STDERR "FATAL: Invalid hash length in $fp for file $file\n"; print STDERR "FATAL: Invalid hash length in $fp for file $file\n";
fatal_error(); fatal_error();
return 1;
} }
push @hashed_files, "$dir$file"; push @hashed_files, "$dir$file";
if (exists $hashes{"$dir$file"}) if (exists $hashes{"$dir$file"})
{ {
print STDERR "FATAL: Duplicate Hash file $dir$file\n"; print STDERR "FATAL: Duplicate Hash file $dir$file\n";
fatal_error(); fatal_error();
return 1;
} }
if (! -r "$dir$file") if (! -r "$dir$file")
{ {
print STDERR "FATAL: Can't access $dir$file\n"; print STDERR "FATAL: Can't access $dir$file\n";
fatal_error(); fatal_error();
return 1;
} }
$hashes{"$dir$file"} = $hash; $hashes{"$dir$file"} = $hash;
} }
@@ -111,12 +135,14 @@ if ($? != 0)
{ {
print STDERR "Error running hash program $check_program\n"; print STDERR "Error running hash program $check_program\n";
fatal_error(); fatal_error();
return 1;
} }
if (@checked_hashes != @hashed_files) if (@checked_hashes != @hashed_files)
{ {
print STDERR "FATAL: hash count incorrect\n"; print STDERR "FATAL: hash count incorrect\n";
fatal_error(); fatal_error();
return 1;
} }
foreach (@checked_hashes) foreach (@checked_hashes)
@@ -127,11 +153,13 @@ foreach (@checked_hashes)
print STDERR "FATAL: Invalid syntax in file $fp\n"; print STDERR "FATAL: Invalid syntax in file $fp\n";
print STDERR "Line:\n$_\n"; print STDERR "Line:\n$_\n";
fatal_error(); fatal_error();
return 1;
} }
if (length($hash) != 40) if (length($hash) != 40)
{ {
print STDERR "FATAL: Invalid hash length for file $file\n"; print STDERR "FATAL: Invalid hash length for file $file\n";
fatal_error(); fatal_error();
return 1;
} }
if ($hash ne $hashes{$file}) if ($hash ne $hashes{$file})
{ {
@@ -155,12 +183,17 @@ if ($badfiles && !$rebuild)
{ {
print STDERR "FATAL: hash mismatch on $badfiles files\n"; print STDERR "FATAL: hash mismatch on $badfiles files\n";
fatal_error(); fatal_error();
return 1;
} }
if ($badfiles || $force_rewrite) if ($badfiles || $force_rewrite)
{ {
print "Updating Hash file $hash_file\n"; print "Updating Hash file $hash_file\n";
open OUT, ">$hash_file" || die "Error rewriting $hash_file"; if (!open(OUT, ">$hash_file"))
{
print STDERR "Error rewriting $hash_file";
return 1;
}
foreach (@hashed_files) foreach (@hashed_files)
{ {
print OUT "HMAC-SHA1($_)= $hashes{$_}\n"; print OUT "HMAC-SHA1($_)= $hashes{$_}\n";
@@ -173,9 +206,12 @@ if (!$badfiles)
print "FIPS hash check successful\n"; print "FIPS hash check successful\n";
} }
}
sub fatal_error sub fatal_error
{ {
print STDERR "*** Your source code does not match the FIPS validated source ***\n"; print STDERR "*** Your source code does not match the FIPS validated source ***\n";
exit 1;
} }