?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
No empty .Rs/.Re
[netbsd-mini2440.git] / crypto / dist / ipsec-tools / src / racoon / privsep.c
blob0804da7d300a7ad03cf1551717d2ab37fa8760ee
1 /* $NetBSD: privsep.c,v 1.18 2008/12/08 06:00:53 tteras Exp $ */
2
3 /* Id: privsep.c,v 1.15 2005/08/08 11:23:44 vanhu Exp */
4
5 /*
6 * Copyright (C) 2004 Emmanuel Dreyfus
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the project nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34 #include "config.h"
35
36 #include <unistd.h>
37 #include <string.h>
38 #ifdef __NetBSD__
39 #include <stdlib.h> /* for setproctitle */
40 #endif
41 #include <errno.h>
42 #include <signal.h>
43 #include <pwd.h>
44
45 #include <sys/types.h>
46 #include <sys/socket.h>
47 #include <sys/param.h>
48
49 #include <netinet/in.h>
50
51 #include "gcmalloc.h"
52 #include "vmbuf.h"
53 #include "misc.h"
54 #include "plog.h"
55 #include "var.h"
56
57 #include "crypto_openssl.h"
58 #include "isakmp_var.h"
59 #include "isakmp.h"
60 #ifdef ENABLE_HYBRID
61 #include "resolv.h"
62 #include "isakmp_xauth.h"
63 #include "isakmp_cfg.h"
64 #endif
65 #include "localconf.h"
66 #include "remoteconf.h"
67 #include "admin.h"
68 #include "sockmisc.h"
69 #include "privsep.h"
70
71 static int privsep_sock[2] = { -1, -1 };
72
73 static int privsep_recv(int, struct privsep_com_msg **, size_t *);
74 static int privsep_send(int, struct privsep_com_msg *, size_t);
75 static int safety_check(struct privsep_com_msg *, int i);
76 static int port_check(int);
77 static int unsafe_env(char *const *);
78 static int unknown_name(int);
79 static int unsafe_path(char *, int);
80 static int rec_fd(int);
81 static int send_fd(int, int);
82
83 struct socket_args {
84 int domain;
85 int type;
86 int protocol;
87 };
88
89 struct sockopt_args {
90 int s;
91 int level;
92 int optname;
93 const void *optval;
94 socklen_t optlen;
95 };
96
97 struct bind_args {
98 int s;
99 const struct sockaddr *addr;
100 socklen_t addrlen;
101 };
102
103 static int
104 privsep_send(sock, buf, len)
105 int sock;
106 struct privsep_com_msg *buf;
107 size_t len;
108 {
109 if (buf == NULL)
110 return 0;
111
112 if (sendto(sock, (char *)buf, len, 0, NULL, 0) == -1) {
113 plog(LLV_ERROR, LOCATION, NULL,
114 "privsep_send failed: %s\n",
115 strerror(errno));
116 return -1;
117 }
118
119 racoon_free((char *)buf);
120
121 return 0;
122 }
123
124
125 static int
126 privsep_recv(sock, bufp, lenp)
127 int sock;
128 struct privsep_com_msg **bufp;
129 size_t *lenp;
130 {
131 struct admin_com com;
132 struct admin_com *combuf;
133 size_t len;
134
135 *bufp = NULL;
136 *lenp = 0;
137
138 /* Get the header */
139 while ((len = recvfrom(sock, (char *)&com,
140 sizeof(com), MSG_PEEK, NULL, NULL)) == -1) {
141 if (errno == EINTR)
142 continue;
143 if (errno == ECONNRESET)
144 return -1;
145
146 plog(LLV_ERROR, LOCATION, NULL,
147 "privsep_recv failed: %s\n",
148 strerror(errno));
149 return -1;
150 }
151
152 /* EOF, other side has closed. */
153 if (len == 0)
154 return -1;
155
156 /* Check for short packets */
157 if (len < sizeof(com)) {
158 plog(LLV_ERROR, LOCATION, NULL,
159 "corrupted privsep message (short header)\n");
160 return -1;
161 }
162
163 /* Allocate buffer for the whole message */
164 if ((combuf = (struct admin_com *)racoon_malloc(com.ac_len)) == NULL) {
165 plog(LLV_ERROR, LOCATION, NULL,
166 "failed to allocate memory: %s\n", strerror(errno));
167 return -1;
168 }
169
170 /* Get the whole buffer */
171 while ((len = recvfrom(sock, (char *)combuf,
172 com.ac_len, 0, NULL, NULL)) == -1) {
173 if (errno == EINTR)
174 continue;
175 if (errno == ECONNRESET)
176 return -1;
177 plog(LLV_ERROR, LOCATION, NULL,
178 "failed to recv privsep command: %s\n",
179 strerror(errno));
180 return -1;
181 }
182
183 /* We expect len to match */
184 if (len != com.ac_len) {
185 plog(LLV_ERROR, LOCATION, NULL,
186 "corrupted privsep message (short packet)\n");
187 return -1;
188 }
189
190 *bufp = (struct privsep_com_msg *)combuf;
191 *lenp = len;
192
193 return 0;
194 }
195
196 int
197 privsep_init(void)
198 {
199 int i;
200 pid_t child_pid;
201
202 /* If running as root, we don't use the privsep code path */
203 if (lcconf->uid == 0)
204 return 0;
205
206 /*
207 * When running privsep, certificate and script paths
208 * are mandatory, as they enable us to check path safety
209 * in the privileged instance
210 */
211 if ((lcconf->pathinfo[LC_PATHTYPE_CERT] == NULL) ||
212 (lcconf->pathinfo[LC_PATHTYPE_SCRIPT] == NULL)) {
213 plog(LLV_ERROR, LOCATION, NULL, "privilege separation "
214 "require path cert and path script in the config file\n");
215 return -1;
216 }
217
218 if (socketpair(PF_LOCAL, SOCK_STREAM, 0, privsep_sock) != 0) {
219 plog(LLV_ERROR, LOCATION, NULL,
220 "Cannot allocate privsep_sock: %s\n", strerror(errno));
221 return -1;
222 }
223
224 switch (child_pid = fork()) {
225 case -1:
226 plog(LLV_ERROR, LOCATION, NULL, "Cannot fork privsep: %s\n",
227 strerror(errno));
228 return -1;
229 break;
230
231 case 0: /* Child: drop privileges */
232 (void)close(privsep_sock[0]);
233
234 if (lcconf->chroot != NULL) {
235 if (chdir(lcconf->chroot) != 0) {
236 plog(LLV_ERROR, LOCATION, NULL,
237 "Cannot chdir(%s): %s\n", lcconf->chroot,
238 strerror(errno));
239 return -1;
240 }
241 if (chroot(lcconf->chroot) != 0) {
242 plog(LLV_ERROR, LOCATION, NULL,
243 "Cannot chroot(%s): %s\n", lcconf->chroot,
244 strerror(errno));
245 return -1;
246 }
247 }
248
249 if (setgid(lcconf->gid) != 0) {
250 plog(LLV_ERROR, LOCATION, NULL,
251 "Cannot setgid(%d): %s\n", lcconf->gid,
252 strerror(errno));
253 return -1;
254 }
255
256 if (setegid(lcconf->gid) != 0) {
257 plog(LLV_ERROR, LOCATION, NULL,
258 "Cannot setegid(%d): %s\n", lcconf->gid,
259 strerror(errno));
260 return -1;
261 }
262
263 if (setuid(lcconf->uid) != 0) {
264 plog(LLV_ERROR, LOCATION, NULL,
265 "Cannot setuid(%d): %s\n", lcconf->uid,
266 strerror(errno));
267 return -1;
268 }
269
270 if (seteuid(lcconf->uid) != 0) {
271 plog(LLV_ERROR, LOCATION, NULL,
272 "Cannot seteuid(%d): %s\n", lcconf->uid,
273 strerror(errno));
274 return -1;
275 }
276
277 return 0;
278 break;
279
280 default: /* Parent: privileged process */
281 break;
282 }
283
284 /*
285 * Close everything except the socketpair,
286 * and stdout if running in the forground.
287 */
288 for (i = sysconf(_SC_OPEN_MAX); i > 0; i--) {
289 if (i == privsep_sock[0])
290 continue;
291 if ((f_foreground) && (i == 1))
292 continue;
293 (void)close(i);
294 }
295
296 /* Above trickery closed the log file, reopen it */
297 ploginit();
298
299 plog(LLV_INFO, LOCATION, NULL,
300 "racoon privileged process running with PID %d\n", getpid());
301
302 plog(LLV_INFO, LOCATION, NULL,
303 "racoon unprivileged process running with PID %d\n", child_pid);
304
305 #if defined(__NetBSD__) || defined(__FreeBSD__)
306 setproctitle("[priv]");
307 #endif
308
309 /*
310 * Don't catch any signal
311 * This duplicate session:signals[], which is static...
312 */
313 signal(SIGPIPE, SIG_IGN);
314 signal(SIGHUP, SIG_DFL);
315 signal(SIGINT, SIG_DFL);
316 signal(SIGTERM, SIG_DFL);
317 signal(SIGUSR1, SIG_DFL);
318 signal(SIGUSR2, SIG_DFL);
319 signal(SIGCHLD, SIG_DFL);
320
321 while (1) {
322 size_t len;
323 struct privsep_com_msg *combuf;
324 struct privsep_com_msg *reply;
325 char *data;
326 size_t *buflen;
327 size_t totallen;
328 char *bufs[PRIVSEP_NBUF_MAX];
329 int i;
330
331 if (privsep_recv(privsep_sock[0], &combuf, &len) != 0)
332 goto out;
333
334 /* Safety checks and gather the data */
335 if (len < sizeof(*combuf)) {
336 plog(LLV_ERROR, LOCATION, NULL,
337 "corrupted privsep message (short buflen)\n");
338 goto out;
339 }
340
341 data = (char *)(combuf + 1);
342 totallen = sizeof(*combuf);
343 for (i = 0; i < PRIVSEP_NBUF_MAX; i++) {
344 bufs[i] = (char *)data;
345 data += combuf->bufs.buflen[i];
346 totallen += combuf->bufs.buflen[i];
347 }
348
349 if (totallen > len) {
350 plog(LLV_ERROR, LOCATION, NULL,
351 "corrupted privsep message (bufs too big)\n");
352 goto out;
353 }
354
355 /* Prepare the reply buffer */
356 if ((reply = racoon_malloc(sizeof(*reply))) == NULL) {
357 plog(LLV_ERROR, LOCATION, NULL,
358 "Cannot allocate reply buffer: %s\n",
359 strerror(errno));
360 goto out;
361 }
362 bzero(reply, sizeof(*reply));
363 reply->hdr.ac_cmd = combuf->hdr.ac_cmd;
364 reply->hdr.ac_len = sizeof(*reply);
365
366 switch(combuf->hdr.ac_cmd) {
367 /*
368 * XXX Improvement: instead of returning the key,
369 * stuff eay_get_pkcs1privkey and eay_get_x509sign
370 * together and sign the hash in the privileged
371 * instance?
372 * pro: the key remains inaccessible to unpriv
373 * con: a compromised unpriv racoon can still sign anything
374 */
375 case PRIVSEP_EAY_GET_PKCS1PRIVKEY: {
376 vchar_t *privkey;
377
378 /* Make sure the string is NULL terminated */
379 if (safety_check(combuf, 0) != 0)
380 break;
381 bufs[0][combuf->bufs.buflen[0] - 1] = '\0';
382
383 if (unsafe_path(bufs[0], LC_PATHTYPE_CERT) != 0) {
384 plog(LLV_ERROR, LOCATION, NULL,
385 "privsep_eay_get_pkcs1privkey: "
386 "unsafe cert \"%s\"\n", bufs[0]);
387 }
388
389 plog(LLV_DEBUG, LOCATION, NULL,
390 "eay_get_pkcs1privkey(\"%s\")\n", bufs[0]);
391
392 if ((privkey = eay_get_pkcs1privkey(bufs[0])) == NULL){
393 reply->hdr.ac_errno = errno;
394 break;
395 }
396
397 reply->bufs.buflen[0] = privkey->l;
398 reply->hdr.ac_len = sizeof(*reply) + privkey->l;
399 reply = racoon_realloc(reply, reply->hdr.ac_len);
400 if (reply == NULL) {
401 plog(LLV_ERROR, LOCATION, NULL,
402 "Cannot allocate reply buffer: %s\n",
403 strerror(errno));
404 goto out;
405 }
406
407 memcpy(reply + 1, privkey->v, privkey->l);
408 vfree(privkey);
409 break;
410 }
411
412 case PRIVSEP_SCRIPT_EXEC: {
413 char *script;
414 int name;
415 char **envp = NULL;
416 int envc = 0;
417 int count = 0;
418 int i;
419
420 /*
421 * First count the bufs, and make sure strings
422 * are NULL terminated.
423 *
424 * We expect: script, name, envp[], void
425 */
426 if (safety_check(combuf, 0) != 0)
427 break;
428 bufs[0][combuf->bufs.buflen[0] - 1] = '\0';
429 count++; /* script */
430
431 count++; /* name */
432
433 for (; count < PRIVSEP_NBUF_MAX; count++) {
434 if (combuf->bufs.buflen[count] == 0)
435 break;
436 bufs[count]
437 [combuf->bufs.buflen[count] - 1] = '\0';
438 envc++;
439 }
440
441 /* count a void buf and perform safety check */
442 count++;
443 if (count >= PRIVSEP_NBUF_MAX) {
444 plog(LLV_ERROR, LOCATION, NULL,
445 "privsep_script_exec: too many args\n");
446 goto out;
447 }
448
449
450 /*
451 * Allocate the arrays for envp
452 */
453 envp = racoon_malloc((envc + 1) * sizeof(char *));
454 if (envp == NULL) {
455 plog(LLV_ERROR, LOCATION, NULL,
456 "cannot allocate memory: %s\n",
457 strerror(errno));
458 goto out;
459 }
460 bzero(envp, (envc + 1) * sizeof(char *));
461
462
463 /*
464 * Populate script, name and envp
465 */
466 count = 0;
467 script = bufs[count++];
468
469 if (combuf->bufs.buflen[count] != sizeof(name)) {
470 plog(LLV_ERROR, LOCATION, NULL,
471 "privsep_script_exec: corrupted message\n");
472 goto out;
473 }
474 memcpy((char *)&name, bufs[count++], sizeof(name));
475
476 for (i = 0; combuf->bufs.buflen[count]; count++)
477 envp[i++] = bufs[count];
478
479 count++; /* void */
480
481 plog(LLV_DEBUG, LOCATION, NULL,
482 "script_exec(\"%s\", %d, %p)\n",
483 script, name, envp);
484
485 /*
486 * Check env for dangerous variables
487 * Check script path and name
488 * Perform fork and execve
489 */
490 if ((unsafe_env(envp) == 0) &&
491 (unknown_name(name) == 0) &&
492 (unsafe_path(script, LC_PATHTYPE_SCRIPT) == 0))
493 (void)script_exec(script, name, envp);
494 else
495 plog(LLV_ERROR, LOCATION, NULL,
496 "privsep_script_exec: "
497 "unsafe script \"%s\"\n", script);
498
499 racoon_free(envp);
500 break;
501 }
502
503 case PRIVSEP_GETPSK: {
504 vchar_t *psk;
505 int keylen;
506
507 /* Make sure the string is NULL terminated */
508 if (safety_check(combuf, 0) != 0)
509 break;
510 bufs[0][combuf->bufs.buflen[0] - 1] = '\0';
511
512 if (combuf->bufs.buflen[1] != sizeof(keylen)) {
513 plog(LLV_ERROR, LOCATION, NULL,
514 "privsep_getpsk: corrupted message\n");
515 goto out;
516 }
517 memcpy(&keylen, bufs[1], sizeof(keylen));
518
519 plog(LLV_DEBUG, LOCATION, NULL,
520 "getpsk(\"%s\", %d)\n", bufs[0], keylen);
521
522 if ((psk = getpsk(bufs[0], keylen)) == NULL) {
523 reply->hdr.ac_errno = errno;
524 break;
525 }
526
527 reply->bufs.buflen[0] = psk->l;
528 reply->hdr.ac_len = sizeof(*reply) + psk->l;
529 reply = racoon_realloc(reply, reply->hdr.ac_len);
530 if (reply == NULL) {
531 plog(LLV_ERROR, LOCATION, NULL,
532 "Cannot allocate reply buffer: %s\n",
533 strerror(errno));
534 goto out;
535 }
536
537 memcpy(reply + 1, psk->v, psk->l);
538 vfree(psk);
539 break;
540 }
541
542 case PRIVSEP_SOCKET: {
543 struct socket_args socket_args;
544 int s;
545
546 /* Make sure the string is NULL terminated */
547 if (safety_check(combuf, 0) != 0)
548 break;
549
550 if (combuf->bufs.buflen[0] !=
551 sizeof(struct socket_args)) {
552 plog(LLV_ERROR, LOCATION, NULL,
553 "privsep_socket: corrupted message\n");
554 goto out;
555 }
556 memcpy(&socket_args, bufs[0],
557 sizeof(struct socket_args));
558
559 if (socket_args.domain != PF_INET &&
560 socket_args.domain != PF_INET6) {
561 plog(LLV_ERROR, LOCATION, NULL,
562 "privsep_socket: "
563 "unauthorized domain (%d)\n",
564 socket_args.domain);
565 goto out;
566 }
567
568 if ((s = socket(socket_args.domain, socket_args.type,
569 socket_args.protocol)) == -1) {
570 reply->hdr.ac_errno = errno;
571 break;
572 }
573
574 if (send_fd(privsep_sock[0], s) < 0) {
575 plog(LLV_ERROR, LOCATION, NULL,
576 "privsep_socket: send_fd failed\n");
577 close(s);
578 goto out;
579 }
580
581 close(s);
582 break;
583 }
584
585 case PRIVSEP_BIND: {
586 struct bind_args bind_args;
587 int err, port = 0;
588
589 /* Make sure the string is NULL terminated */
590 if (safety_check(combuf, 0) != 0)
591 break;
592
593 if (combuf->bufs.buflen[0] !=
594 sizeof(struct bind_args)) {
595 plog(LLV_ERROR, LOCATION, NULL,
596 "privsep_bind: corrupted message\n");
597 goto out;
598 }
599 memcpy(&bind_args, bufs[0], sizeof(struct bind_args));
600
601 if (combuf->bufs.buflen[1] != bind_args.addrlen) {
602 plog(LLV_ERROR, LOCATION, NULL,
603 "privsep_bind: corrupted message\n");
604 goto out;
605 }
606 bind_args.addr = (const struct sockaddr *)bufs[1];
607
608 if ((bind_args.s = rec_fd(privsep_sock[0])) < 0) {
609 plog(LLV_ERROR, LOCATION, NULL,
610 "privsep_bind: rec_fd failed\n");
611 goto out;
612 }
613
614 port = extract_port(bind_args.addr);
615 if (port != PORT_ISAKMP && port != PORT_ISAKMP_NATT &&
616 port != lcconf->port_isakmp &&
617 port != lcconf->port_isakmp_natt) {
618 plog(LLV_ERROR, LOCATION, NULL,
619 "privsep_bind: "
620 "unauthorized port (%d)\n",
621 port);
622 close(bind_args.s);
623 goto out;
624 }
625
626 err = bind(bind_args.s, bind_args.addr,
627 bind_args.addrlen);
628
629 if (err)
630 reply->hdr.ac_errno = errno;
631
632 close(bind_args.s);
633 break;
634 }
635
636 case PRIVSEP_SETSOCKOPTS: {
637 struct sockopt_args sockopt_args;
638 int err;
639
640 /* Make sure the string is NULL terminated */
641 if (safety_check(combuf, 0) != 0)
642 break;
643
644 if (combuf->bufs.buflen[0] !=
645 sizeof(struct sockopt_args)) {
646 plog(LLV_ERROR, LOCATION, NULL,
647 "privsep_setsockopt: "
648 "corrupted message\n");
649 goto out;
650 }
651 memcpy(&sockopt_args, bufs[0],
652 sizeof(struct sockopt_args));
653
654 if (combuf->bufs.buflen[1] != sockopt_args.optlen) {
655 plog(LLV_ERROR, LOCATION, NULL,
656 "privsep_setsockopt: corrupted message\n");
657 goto out;
658 }
659 sockopt_args.optval = bufs[1];
660
661 if (sockopt_args.optname !=
662 (sockopt_args.level ==
663 IPPROTO_IP ? IP_IPSEC_POLICY :
664 IPV6_IPSEC_POLICY)) {
665 plog(LLV_ERROR, LOCATION, NULL,
666 "privsep_setsockopt: "
667 "unauthorized option (%d)\n",
668 sockopt_args.optname);
669 goto out;
670 }
671
672 if ((sockopt_args.s = rec_fd(privsep_sock[0])) < 0) {
673 plog(LLV_ERROR, LOCATION, NULL,
674 "privsep_setsockopt: rec_fd failed\n");
675 goto out;
676 }
677
678 err = setsockopt(sockopt_args.s,
679 sockopt_args.level,
680 sockopt_args.optname,
681 sockopt_args.optval,
682 sockopt_args.optlen);
683 if (err)
684 reply->hdr.ac_errno = errno;
685
686 close(sockopt_args.s);
687 break;
688 }
689
690 #ifdef ENABLE_HYBRID
691 case PRIVSEP_ACCOUNTING_SYSTEM: {
692 int pool_size;
693 int port;
694 int inout;
695 struct sockaddr *raddr;
696
697 if (safety_check(combuf, 0) != 0)
698 break;
699 if (safety_check(combuf, 1) != 0)
700 break;
701 if (safety_check(combuf, 2) != 0)
702 break;
703 if (safety_check(combuf, 3) != 0)
704 break;
705
706 memcpy(&port, bufs[0], sizeof(port));
707 raddr = (struct sockaddr *)bufs[1];
708
709 bufs[2][combuf->bufs.buflen[2] - 1] = '\0';
710 memcpy(&inout, bufs[3], sizeof(port));
711
712 if (port_check(port) != 0)
713 break;
714
715 plog(LLV_DEBUG, LOCATION, NULL,
716 "accounting_system(%d, %s, %s)\n",
717 port, saddr2str(raddr), bufs[2]);
718
719 errno = 0;
720 if (isakmp_cfg_accounting_system(port,
721 raddr, bufs[2], inout) != 0) {
722 if (errno == 0)
723 reply->hdr.ac_errno = EINVAL;
724 else
725 reply->hdr.ac_errno = errno;
726 }
727 break;
728 }
729 case PRIVSEP_XAUTH_LOGIN_SYSTEM: {
730 if (safety_check(combuf, 0) != 0)
731 break;
732 bufs[0][combuf->bufs.buflen[0] - 1] = '\0';
733
734 if (safety_check(combuf, 1) != 0)
735 break;
736 bufs[1][combuf->bufs.buflen[1] - 1] = '\0';
737
738 plog(LLV_DEBUG, LOCATION, NULL,
739 "xauth_login_system(\"%s\", <password>)\n",
740 bufs[0]);
741
742 errno = 0;
743 if (xauth_login_system(bufs[0], bufs[1]) != 0) {
744 if (errno == 0)
745 reply->hdr.ac_errno = EINVAL;
746 else
747 reply->hdr.ac_errno = errno;
748 }
749 break;
750 }
751 #ifdef HAVE_LIBPAM
752 case PRIVSEP_ACCOUNTING_PAM: {
753 int port;
754 int inout;
755 int pool_size;
756
757 if (safety_check(combuf, 0) != 0)
758 break;
759 if (safety_check(combuf, 1) != 0)
760 break;
761 if (safety_check(combuf, 2) != 0)
762 break;
763
764 memcpy(&port, bufs[0], sizeof(port));
765 memcpy(&inout, bufs[1], sizeof(inout));
766 memcpy(&pool_size, bufs[2], sizeof(pool_size));
767
768 if (pool_size != isakmp_cfg_config.pool_size)
769 if (isakmp_cfg_resize_pool(pool_size) != 0)
770 break;
771
772 if (port_check(port) != 0)
773 break;
774
775 plog(LLV_DEBUG, LOCATION, NULL,
776 "isakmp_cfg_accounting_pam(%d, %d)\n",
777 port, inout);
778
779 errno = 0;
780 if (isakmp_cfg_accounting_pam(port, inout) != 0) {
781 if (errno == 0)
782 reply->hdr.ac_errno = EINVAL;
783 else
784 reply->hdr.ac_errno = errno;
785 }
786 break;
787 }
788
789 case PRIVSEP_XAUTH_LOGIN_PAM: {
790 int port;
791 int pool_size;
792 struct sockaddr *raddr;
793
794 if (safety_check(combuf, 0) != 0)
795 break;
796 if (safety_check(combuf, 1) != 0)
797 break;
798 if (safety_check(combuf, 2) != 0)
799 break;
800 if (safety_check(combuf, 3) != 0)
801 break;
802 if (safety_check(combuf, 4) != 0)
803 break;
804
805 memcpy(&port, bufs[0], sizeof(port));
806 memcpy(&pool_size, bufs[1], sizeof(pool_size));
807 raddr = (struct sockaddr *)bufs[2];
808
809 bufs[3][combuf->bufs.buflen[3] - 1] = '\0';
810 bufs[4][combuf->bufs.buflen[4] - 1] = '\0';
811
812 if (pool_size != isakmp_cfg_config.pool_size)
813 if (isakmp_cfg_resize_pool(pool_size) != 0)
814 break;
815
816 if (port_check(port) != 0)
817 break;
818
819 plog(LLV_DEBUG, LOCATION, NULL,
820 "xauth_login_pam(%d, %s, \"%s\", <password>)\n",
821 port, saddr2str(raddr), bufs[3]);
822
823 errno = 0;
824 if (xauth_login_pam(port,
825 raddr, bufs[3], bufs[4]) != 0) {
826 if (errno == 0)
827 reply->hdr.ac_errno = EINVAL;
828 else
829 reply->hdr.ac_errno = errno;
830 }
831 break;
832 }
833
834 case PRIVSEP_CLEANUP_PAM: {
835 int port;
836 int pool_size;
837
838 if (safety_check(combuf, 0) != 0)
839 break;
840 if (safety_check(combuf, 1) != 0)
841 break;
842
843 memcpy(&port, bufs[0], sizeof(port));
844 memcpy(&pool_size, bufs[1], sizeof(pool_size));
845
846 if (pool_size != isakmp_cfg_config.pool_size)
847 if (isakmp_cfg_resize_pool(pool_size) != 0)
848 break;
849
850 if (port_check(port) != 0)
851 break;
852
853 plog(LLV_DEBUG, LOCATION, NULL,
854 "cleanup_pam(%d)\n", port);
855
856 cleanup_pam(port);
857 reply->hdr.ac_errno = 0;
858
859 break;
860 }
861 #endif /* HAVE_LIBPAM */
862 #endif /* ENABLE_HYBRID */
863
864 default:
865 plog(LLV_ERROR, LOCATION, NULL,
866 "unexpected privsep command %d\n",
867 combuf->hdr.ac_cmd);
868 goto out;
869 break;
870 }
871
872 /* This frees reply */
873 if (privsep_send(privsep_sock[0],
874 reply, reply->hdr.ac_len) != 0) {
875 racoon_free(reply);
876 goto out;
877 }
878
879 racoon_free(combuf);
880 }
881
882 out:
883 plog(LLV_INFO, LOCATION, NULL,
884 "racoon privileged process %d terminated\n", getpid());
885 _exit(0);
886 }
887
888
889 vchar_t *
890 privsep_eay_get_pkcs1privkey(path)
891 char *path;
892 {
893 vchar_t *privkey;
894 struct privsep_com_msg *msg;
895 size_t len;
896
897 if (geteuid() == 0)
898 return eay_get_pkcs1privkey(path);
899
900 len = sizeof(*msg) + strlen(path) + 1;
901 if ((msg = racoon_malloc(len)) == NULL) {
902 plog(LLV_ERROR, LOCATION, NULL,
903 "Cannot allocate memory: %s\n", strerror(errno));
904 return NULL;
905 }
906 bzero(msg, len);
907 msg->hdr.ac_cmd = PRIVSEP_EAY_GET_PKCS1PRIVKEY;
908 msg->hdr.ac_len = len;
909 msg->bufs.buflen[0] = len - sizeof(*msg);
910 memcpy(msg + 1, path, msg->bufs.buflen[0]);
911
912 if (privsep_send(privsep_sock[1], msg, len) != 0)
913 return NULL;
914
915 if (privsep_recv(privsep_sock[1], &msg, &len) != 0)
916 return NULL;
917
918 if (msg->hdr.ac_errno != 0) {
919 errno = msg->hdr.ac_errno;
920 goto out;
921 }
922
923 if ((privkey = vmalloc(len - sizeof(*msg))) == NULL)
924 goto out;
925
926 memcpy(privkey->v, msg + 1, privkey->l);
927 racoon_free(msg);
928 return privkey;
929
930 out:
931 racoon_free(msg);
932 return NULL;
933 }
934
935 int
936 privsep_script_exec(script, name, envp)
937 char *script;
938 int name;
939 char *const envp[];
940 {
941 int count = 0;
942 char *const *c;
943 char *data;
944 size_t len;
945 struct privsep_com_msg *msg;
946
947 if (geteuid() == 0)
948 return script_exec(script, name, envp);
949
950 if ((msg = racoon_malloc(sizeof(*msg))) == NULL) {
951 plog(LLV_ERROR, LOCATION, NULL,
952 "Cannot allocate memory: %s\n", strerror(errno));
953 return -1;
954 }
955
956 bzero(msg, sizeof(*msg));
957 msg->hdr.ac_cmd = PRIVSEP_SCRIPT_EXEC;
958 msg->hdr.ac_len = sizeof(*msg);
959
960 /*
961 * We send:
962 * script, name, envp[0], ... envp[N], void
963 */
964
965 /*
966 * Safety check on the counts: PRIVSEP_NBUF_MAX max
967 */
968 count = 0;
969 count++; /* script */
970 count++; /* name */
971 for (c = envp; *c; c++) /* envp */
972 count++;
973 count++; /* void */
974
975 if (count > PRIVSEP_NBUF_MAX) {
976 plog(LLV_ERROR, LOCATION, NULL, "Unexpected error: "
977 "privsep_script_exec count > PRIVSEP_NBUF_MAX\n");
978 racoon_free(msg);
979 return -1;
980 }
981
982
983 /*
984 * Compute the length
985 */
986 count = 0;
987 msg->bufs.buflen[count] = strlen(script) + 1; /* script */
988 msg->hdr.ac_len += msg->bufs.buflen[count++];
989
990 msg->bufs.buflen[count] = sizeof(name); /* name */
991 msg->hdr.ac_len += msg->bufs.buflen[count++];
992
993 for (c = envp; *c; c++) { /* envp */
994 msg->bufs.buflen[count] = strlen(*c) + 1;
995 msg->hdr.ac_len += msg->bufs.buflen[count++];
996 }
997
998 msg->bufs.buflen[count] = 0; /* void */
999 msg->hdr.ac_len += msg->bufs.buflen[count++];
1000
1001 if ((msg = racoon_realloc(msg, msg->hdr.ac_len)) == NULL) {
1002 plog(LLV_ERROR, LOCATION, NULL,
1003 "Cannot allocate memory: %s\n", strerror(errno));
1004 return -1;
1005 }
1006
1007 /*
1008 * Now copy the data
1009 */
1010 data = (char *)(msg + 1);
1011 count = 0;
1012
1013 memcpy(data, (char *)script, msg->bufs.buflen[count]); /* script */
1014 data += msg->bufs.buflen[count++];
1015
1016 memcpy(data, (char *)&name, msg->bufs.buflen[count]); /* name */
1017 data += msg->bufs.buflen[count++];
1018
1019 for (c = envp; *c; c++) { /* envp */
1020 memcpy(data, *c, msg->bufs.buflen[count]);
1021 data += msg->bufs.buflen[count++];
1022 }
1023
1024 count++; /* void */
1025
1026 /*
1027 * And send it!
1028 */
1029 if (privsep_send(privsep_sock[1], msg, msg->hdr.ac_len) != 0)
1030 return -1;
1031
1032 if (privsep_recv(privsep_sock[1], &msg, &len) != 0)
1033 return -1;
1034
1035 if (msg->hdr.ac_errno != 0) {
1036 errno = msg->hdr.ac_errno;
1037 racoon_free(msg);
1038 return -1;
1039 }
1040
1041 racoon_free(msg);
1042 return 0;
1043 }
1044
1045 vchar_t *
1046 privsep_getpsk(str, keylen)
1047 const char *str;
1048 int keylen;
1049 {
1050 vchar_t *psk;
1051 struct privsep_com_msg *msg;
1052 size_t len;
1053 int *keylenp;
1054 char *data;
1055
1056 if (geteuid() == 0)
1057 return getpsk(str, keylen);
1058
1059 len = sizeof(*msg) + strlen(str) + 1 + sizeof(keylen);
1060 if ((msg = racoon_malloc(len)) == NULL) {
1061 plog(LLV_ERROR, LOCATION, NULL,
1062 "Cannot allocate memory: %s\n", strerror(errno));
1063 return NULL;
1064 }
1065 bzero(msg, len);
1066 msg->hdr.ac_cmd = PRIVSEP_GETPSK;
1067 msg->hdr.ac_len = len;
1068
1069 data = (char *)(msg + 1);
1070 msg->bufs.buflen[0] = strlen(str) + 1;
1071 memcpy(data, str, msg->bufs.buflen[0]);
1072
1073 data += msg->bufs.buflen[0];
1074 msg->bufs.buflen[1] = sizeof(keylen);
1075 memcpy(data, &keylen, sizeof(keylen));
1076
1077 if (privsep_send(privsep_sock[1], msg, len) != 0)
1078 return NULL;
1079
1080 if (privsep_recv(privsep_sock[1], &msg, &len) != 0)
1081 return NULL;
1082
1083 if (msg->hdr.ac_errno != 0) {
1084 errno = msg->hdr.ac_errno;
1085 goto out;
1086 }
1087
1088 if ((psk = vmalloc(len - sizeof(*msg))) == NULL)
1089 goto out;
1090
1091 memcpy(psk->v, msg + 1, psk->l);
1092 racoon_free(msg);
1093 return psk;
1094
1095 out:
1096 racoon_free(msg);
1097 return NULL;
1098 }
1099
1100 /*
1101 * Create a privileged socket. On BSD systems a socket obtains special
1102 * capabilities if it is created by root; setsockopt(IP_IPSEC_POLICY) will
1103 * succeed but will be ineffective if performed on an unprivileged socket.
1104 */
1105 int
1106 privsep_socket(domain, type, protocol)
1107 int domain;
1108 int type;
1109 int protocol;
1110 {
1111 struct privsep_com_msg *msg;
1112 size_t len;
1113 char *data;
1114 struct socket_args socket_args;
1115 int s, saved_errno = 0;
1116
1117 if (geteuid() == 0)
1118 return socket(domain, type, protocol);
1119
1120 len = sizeof(*msg) + sizeof(socket_args);
1121
1122 if ((msg = racoon_malloc(len)) == NULL) {
1123 plog(LLV_ERROR, LOCATION, NULL,
1124 "Cannot allocate memory: %s\n", strerror(errno));
1125 return -1;
1126 }
1127 bzero(msg, len);
1128 msg->hdr.ac_cmd = PRIVSEP_SOCKET;
1129 msg->hdr.ac_len = len;
1130
1131 socket_args.domain = domain;
1132 socket_args.type = type;
1133 socket_args.protocol = protocol;
1134
1135 data = (char *)(msg + 1);
1136 msg->bufs.buflen[0] = sizeof(socket_args);
1137 memcpy(data, &socket_args, msg->bufs.buflen[0]);
1138
1139 /* frees msg */
1140 if (privsep_send(privsep_sock[1], msg, len) != 0)
1141 goto out;
1142
1143 /* Get the privileged socket descriptor from the privileged process. */
1144 if ((s = rec_fd(privsep_sock[1])) == -1)
1145 return -1;
1146
1147 if (privsep_recv(privsep_sock[1], &msg, &len) != 0)
1148 goto out;
1149
1150 if (msg->hdr.ac_errno != 0) {
1151 errno = msg->hdr.ac_errno;
1152 goto out;
1153 }
1154
1155 racoon_free(msg);
1156 return s;
1157
1158 out:
1159 racoon_free(msg);
1160 return -1;
1161 }
1162
1163 /*
1164 * Bind() a socket to a port. This works just like regular bind(), except that
1165 * if you want to bind to the designated isakmp ports and you don't have the
1166 * privilege to do so, it will ask a privileged process to do it.
1167 */
1168 int
1169 privsep_bind(s, addr, addrlen)
1170 int s;
1171 const struct sockaddr *addr;
1172 socklen_t addrlen;
1173 {
1174 struct privsep_com_msg *msg;
1175 size_t len;
1176 char *data;
1177 struct bind_args bind_args;
1178 int err, saved_errno = 0;
1179
1180 err = bind(s, addr, addrlen);
1181 if ((err == 0) || (saved_errno = errno) != EACCES || geteuid() == 0) {
1182 if (saved_errno)
1183 plog(LLV_ERROR, LOCATION, NULL,
1184 "privsep_bind (%s) = %d\n", strerror(saved_errno), err);
1185 errno = saved_errno;
1186 return err;
1187 }
1188
1189 len = sizeof(*msg) + sizeof(bind_args) + addrlen;
1190
1191 if ((msg = racoon_malloc(len)) == NULL) {
1192 plog(LLV_ERROR, LOCATION, NULL,
1193 "Cannot allocate memory: %s\n", strerror(errno));
1194 return -1;
1195 }
1196 bzero(msg, len);
1197 msg->hdr.ac_cmd = PRIVSEP_BIND;
1198 msg->hdr.ac_len = len;
1199
1200 bind_args.s = -1;
1201 bind_args.addr = NULL;
1202 bind_args.addrlen = addrlen;
1203
1204 data = (char *)(msg + 1);
1205 msg->bufs.buflen[0] = sizeof(bind_args);
1206 memcpy(data, &bind_args, msg->bufs.buflen[0]);
1207
1208 data += msg->bufs.buflen[0];
1209 msg->bufs.buflen[1] = addrlen;
1210 memcpy(data, addr, addrlen);
1211
1212 /* frees msg */
1213 if (privsep_send(privsep_sock[1], msg, len) != 0)
1214 goto out;
1215
1216 /* Send the socket descriptor to the privileged process. */
1217 if (send_fd(privsep_sock[1], s) < 0)
1218 return -1;
1219
1220 if (privsep_recv(privsep_sock[1], &msg, &len) != 0)
1221 goto out;
1222
1223 if (msg->hdr.ac_errno != 0) {
1224 errno = msg->hdr.ac_errno;
1225 goto out;
1226 }
1227
1228 racoon_free(msg);
1229 return 0;
1230
1231 out:
1232 racoon_free(msg);
1233 return -1;
1234 }
1235
1236 /*
1237 * Set socket options. This works just like regular setsockopt(), except that
1238 * if you want to change IP_IPSEC_POLICY or IPV6_IPSEC_POLICY and you don't
1239 * have the privilege to do so, it will ask a privileged process to do it.
1240 */
1241 int
1242 privsep_setsockopt(s, level, optname, optval, optlen)
1243 int s;
1244 int level;
1245 int optname;
1246 const void *optval;
1247 socklen_t optlen;
1248 {
1249 struct privsep_com_msg *msg;
1250 size_t len;
1251 char *data;
1252 struct sockopt_args sockopt_args;
1253 int err, saved_errno = 0;
1254
1255 if ((err = setsockopt(s, level, optname, optval, optlen) == 0) ||
1256 (saved_errno = errno) != EACCES ||
1257 geteuid() == 0) {
1258 if (saved_errno)
1259 plog(LLV_ERROR, LOCATION, NULL,
1260 "privsep_setsockopt (%s)\n",
1261 strerror(saved_errno));
1262
1263 errno = saved_errno;
1264 return err;
1265 }
1266
1267 len = sizeof(*msg) + sizeof(sockopt_args) + optlen;
1268
1269 if ((msg = racoon_malloc(len)) == NULL) {
1270 plog(LLV_ERROR, LOCATION, NULL,
1271 "Cannot allocate memory: %s\n", strerror(errno));
1272 return -1;
1273 }
1274 bzero(msg, len);
1275 msg->hdr.ac_cmd = PRIVSEP_SETSOCKOPTS;
1276 msg->hdr.ac_len = len;
1277
1278 sockopt_args.s = -1;
1279 sockopt_args.level = level;
1280 sockopt_args.optname = optname;
1281 sockopt_args.optval = NULL;
1282 sockopt_args.optlen = optlen;
1283
1284 data = (char *)(msg + 1);
1285 msg->bufs.buflen[0] = sizeof(sockopt_args);
1286 memcpy(data, &sockopt_args, msg->bufs.buflen[0]);
1287
1288 data += msg->bufs.buflen[0];
1289 msg->bufs.buflen[1] = optlen;
1290 memcpy(data, optval, optlen);
1291
1292 /* frees msg */
1293 if (privsep_send(privsep_sock[1], msg, len) != 0)
1294 goto out;
1295
1296 if (send_fd(privsep_sock[1], s) < 0)
1297 return -1;
1298
1299 if (privsep_recv(privsep_sock[1], &msg, &len) != 0) {
1300 plog(LLV_ERROR, LOCATION, NULL,
1301 "privsep_recv failed\n");
1302 goto out;
1303 }
1304
1305 if (msg->hdr.ac_errno != 0) {
1306 errno = msg->hdr.ac_errno;
1307 goto out;
1308 }
1309
1310 racoon_free(msg);
1311 return 0;
1312
1313 out:
1314 racoon_free(msg);
1315 return -1;
1316 }
1317
1318 #ifdef ENABLE_HYBRID
1319 int
1320 privsep_xauth_login_system(usr, pwd)
1321 char *usr;
1322 char *pwd;
1323 {
1324 struct privsep_com_msg *msg;
1325 size_t len;
1326 char *data;
1327
1328 if (geteuid() == 0)
1329 return xauth_login_system(usr, pwd);
1330
1331 len = sizeof(*msg) + strlen(usr) + 1 + strlen(pwd) + 1;
1332 if ((msg = racoon_malloc(len)) == NULL) {
1333 plog(LLV_ERROR, LOCATION, NULL,
1334 "Cannot allocate memory: %s\n", strerror(errno));
1335 return -1;
1336 }
1337 bzero(msg, len);
1338 msg->hdr.ac_cmd = PRIVSEP_XAUTH_LOGIN_SYSTEM;
1339 msg->hdr.ac_len = len;
1340
1341 data = (char *)(msg + 1);
1342 msg->bufs.buflen[0] = strlen(usr) + 1;
1343 memcpy(data, usr, msg->bufs.buflen[0]);
1344 data += msg->bufs.buflen[0];
1345
1346 msg->bufs.buflen[1] = strlen(pwd) + 1;
1347 memcpy(data, pwd, msg->bufs.buflen[1]);
1348
1349 /* frees msg */
1350 if (privsep_send(privsep_sock[1], msg, len) != 0)
1351 return -1;
1352
1353 if (privsep_recv(privsep_sock[1], &msg, &len) != 0)
1354 return -1;
1355
1356 if (msg->hdr.ac_errno != 0) {
1357 racoon_free(msg);
1358 return -1;
1359 }
1360
1361 racoon_free(msg);
1362 return 0;
1363 }
1364
1365 int
1366 privsep_accounting_system(port, raddr, usr, inout)
1367 int port;
1368 struct sockaddr *raddr;
1369 char *usr;
1370 int inout;
1371 {
1372 struct privsep_com_msg *msg;
1373 size_t len;
1374 char *data;
1375 int result;
1376
1377 if (geteuid() == 0)
1378 return isakmp_cfg_accounting_system(port, raddr,
1379 usr, inout);
1380
1381 len = sizeof(*msg)
1382 + sizeof(port)
1383 + sysdep_sa_len(raddr)
1384 + strlen(usr) + 1
1385 + sizeof(inout);
1386
1387 if ((msg = racoon_malloc(len)) == NULL) {
1388 plog(LLV_ERROR, LOCATION, NULL,
1389 "Cannot allocate memory: %s\n", strerror(errno));
1390 return -1;
1391 }
1392 bzero(msg, len);
1393 msg->hdr.ac_cmd = PRIVSEP_ACCOUNTING_SYSTEM;
1394 msg->hdr.ac_len = len;
1395 msg->bufs.buflen[0] = sizeof(port);
1396 msg->bufs.buflen[1] = sysdep_sa_len(raddr);
1397 msg->bufs.buflen[2] = strlen(usr) + 1;
1398 msg->bufs.buflen[3] = sizeof(inout);
1399
1400 data = (char *)(msg + 1);
1401 memcpy(data, &port, msg->bufs.buflen[0]);
1402
1403 data += msg->bufs.buflen[0];
1404 memcpy(data, raddr, msg->bufs.buflen[1]);
1405
1406 data += msg->bufs.buflen[1];
1407 memcpy(data, usr, msg->bufs.buflen[2]);
1408
1409 data += msg->bufs.buflen[2];
1410 memcpy(data, &inout, msg->bufs.buflen[3]);
1411
1412 /* frees msg */
1413 if (privsep_send(privsep_sock[1], msg, len) != 0)
1414 return -1;
1415
1416 if (privsep_recv(privsep_sock[1], &msg, &len) != 0)
1417 return -1;
1418
1419 if (msg->hdr.ac_errno != 0) {
1420 errno = msg->hdr.ac_errno;
1421 goto out;
1422 }
1423
1424 racoon_free(msg);
1425 return 0;
1426
1427 out:
1428 racoon_free(msg);
1429 return -1;
1430 }
1431
1432 static int
1433 port_check(port)
1434 int port;
1435 {
1436 if ((port < 0) || (port >= isakmp_cfg_config.pool_size)) {
1437 plog(LLV_ERROR, LOCATION, NULL,
1438 "privsep: port %d outside of allowed range [0,%zu]\n",
1439 port, isakmp_cfg_config.pool_size - 1);
1440 return -1;
1441 }
1442
1443 return 0;
1444 }
1445 #endif
1446
1447 static int
1448 safety_check(msg, index)
1449 struct privsep_com_msg *msg;
1450 int index;
1451 {
1452 if (index >= PRIVSEP_NBUF_MAX) {
1453 plog(LLV_ERROR, LOCATION, NULL,
1454 "privsep: Corrupted message, too many buffers\n");
1455 return -1;
1456 }
1457
1458 if (msg->bufs.buflen[index] == 0) {
1459 plog(LLV_ERROR, LOCATION, NULL,
1460 "privsep: Corrupted message, unexpected void buffer\n");
1461 return -1;
1462 }
1463
1464 return 0;
1465 }
1466
1467 /*
1468 * Filter unsafe environement variables
1469 */
1470 static int
1471 unsafe_env(envp)
1472 char *const *envp;
1473 {
1474 char *const *e;
1475 char *const *be;
1476 char *const bad_env[] = { "PATH=", "LD_LIBRARY_PATH=", "IFS=", NULL };
1477
1478 for (e = envp; *e; e++) {
1479 for (be = bad_env; *be; be++) {
1480 if (strncmp(*e, *be, strlen(*be)) == 0) {
1481 goto found;
1482 }
1483 }
1484 }
1485
1486 return 0;
1487 found:
1488 plog(LLV_ERROR, LOCATION, NULL,
1489 "privsep_script_exec: unsafe environement variable\n");
1490 return -1;
1491 }
1492
1493 /*
1494 * Check path safety
1495 */
1496 static int
1497 unsafe_path(script, pathtype)
1498 char *script;
1499 int pathtype;
1500 {
1501 char *path;
1502 char rpath[MAXPATHLEN + 1];
1503 size_t len;
1504
1505 if (script == NULL)
1506 return -1;
1507
1508 path = lcconf->pathinfo[pathtype];
1509
1510 /* No path was given for scripts: skip the check */
1511 if (path == NULL)
1512 return 0;
1513
1514 if (realpath(script, rpath) == NULL) {
1515 plog(LLV_ERROR, LOCATION, NULL,
1516 "script path \"%s\" is invalid\n", script);
1517 return -1;
1518 }
1519
1520 len = strlen(path);
1521 if (strncmp(path, rpath, len) != 0)
1522 return -1;
1523
1524 return 0;
1525 }
1526
1527 static int
1528 unknown_name(name)
1529 int name;
1530 {
1531 if ((name < 0) || (name > SCRIPT_MAX)) {
1532 plog(LLV_ERROR, LOCATION, NULL,
1533 "privsep_script_exec: unsafe name index\n");
1534 return -1;
1535 }
1536
1537 return 0;
1538 }
1539
1540 /* Receive a file descriptor through the argument socket */
1541 static int
1542 rec_fd(s)
1543 int s;
1544 {
1545 struct msghdr msg;
1546 struct cmsghdr *cmsg;
1547 int fd;
1548 char cmsbuf[1024];
1549 struct iovec iov;
1550 char iobuf[1];
1551
1552 iov.iov_base = iobuf;
1553 iov.iov_len = 1;
1554
1555 if (sizeof(cmsbuf) < CMSG_SPACE(sizeof(fd))) {
1556 plog(LLV_ERROR, LOCATION, NULL,
1557 "send_fd: buffer size too small\n");
1558 return -1;
1559 }
1560 bzero(&msg, sizeof(msg));
1561 msg.msg_name = NULL;
1562 msg.msg_namelen = 0;
1563 msg.msg_iov = &iov;
1564 msg.msg_iovlen = 1;
1565 msg.msg_control = cmsbuf;
1566 msg.msg_controllen = CMSG_SPACE(sizeof(fd));
1567
1568 if (recvmsg(s, &msg, MSG_WAITALL) == -1)
1569 return -1;
1570
1571 cmsg = CMSG_FIRSTHDR(&msg);
1572 return *(int *)CMSG_DATA(cmsg);
1573 }
1574
1575 /* Send the file descriptor fd through the argument socket s */
1576 static int
1577 send_fd(s, fd)
1578 int s;
1579 int fd;
1580 {
1581 struct msghdr msg;
1582 struct cmsghdr *cmsg;
1583 char cmsbuf[1024];
1584 struct iovec iov;
1585
1586 iov.iov_base = " ";
1587 iov.iov_len = 1;
1588
1589 if (sizeof(cmsbuf) < CMSG_SPACE(sizeof(fd))) {
1590 plog(LLV_ERROR, LOCATION, NULL,
1591 "send_fd: buffer size too small\n");
1592 return -1;
1593 }
1594 bzero(&msg, sizeof(msg));
1595 msg.msg_name = NULL;
1596 msg.msg_namelen = 0;
1597 msg.msg_iov = &iov;
1598 msg.msg_iovlen = 1;
1599 msg.msg_control = cmsbuf;
1600 msg.msg_controllen = CMSG_SPACE(sizeof(fd));
1601 msg.msg_flags = 0;
1602
1603 cmsg = CMSG_FIRSTHDR(&msg);
1604 cmsg->cmsg_level = SOL_SOCKET;
1605 cmsg->cmsg_type = SCM_RIGHTS;
1606 cmsg->cmsg_len = CMSG_LEN(sizeof(fd));
1607 *(int *)CMSG_DATA(cmsg) = fd;
1608 msg.msg_controllen = cmsg->cmsg_len;
1609
1610 if (sendmsg(s, &msg, 0) == -1)
1611 return -1;
1612
1613 return 0;
1614 }
1615
1616 #ifdef HAVE_LIBPAM
1617 int
1618 privsep_accounting_pam(port, inout)
1619 int port;
1620 int inout;
1621 {
1622 struct privsep_com_msg *msg;
1623 size_t len;
1624 int *port_data;
1625 int *inout_data;
1626 int *pool_size_data;
1627 int result;
1628
1629 if (geteuid() == 0)
1630 return isakmp_cfg_accounting_pam(port, inout);
1631
1632 len = sizeof(*msg)
1633 + sizeof(port)
1634 + sizeof(inout)
1635 + sizeof(isakmp_cfg_config.pool_size);
1636
1637 if ((msg = racoon_malloc(len)) == NULL) {
1638 plog(LLV_ERROR, LOCATION, NULL,
1639 "Cannot allocate memory: %s\n", strerror(errno));
1640 return -1;
1641 }
1642 bzero(msg, len);
1643 msg->hdr.ac_cmd = PRIVSEP_ACCOUNTING_PAM;
1644 msg->hdr.ac_len = len;
1645 msg->bufs.buflen[0] = sizeof(port);
1646 msg->bufs.buflen[1] = sizeof(inout);
1647 msg->bufs.buflen[2] = sizeof(isakmp_cfg_config.pool_size);
1648
1649 port_data = (int *)(msg + 1);
1650 inout_data = (int *)(port_data + 1);
1651 pool_size_data = (int *)(inout_data + 1);
1652
1653 *port_data = port;
1654 *inout_data = inout;
1655 *pool_size_data = isakmp_cfg_config.pool_size;
1656
1657 /* frees msg */
1658 if (privsep_send(privsep_sock[1], msg, len) != 0)
1659 return -1;
1660
1661 if (privsep_recv(privsep_sock[1], &msg, &len) != 0)
1662 return -1;
1663
1664 if (msg->hdr.ac_errno != 0) {
1665 errno = msg->hdr.ac_errno;
1666 goto out;
1667 }
1668
1669 racoon_free(msg);
1670 return 0;
1671
1672 out:
1673 racoon_free(msg);
1674 return -1;
1675 }
1676
1677 int
1678 privsep_xauth_login_pam(port, raddr, usr, pwd)
1679 int port;
1680 struct sockaddr *raddr;
1681 char *usr;
1682 char *pwd;
1683 {
1684 struct privsep_com_msg *msg;
1685 size_t len;
1686 char *data;
1687 int result;
1688
1689 if (geteuid() == 0)
1690 return xauth_login_pam(port, raddr, usr, pwd);
1691
1692 len = sizeof(*msg)
1693 + sizeof(port)
1694 + sizeof(isakmp_cfg_config.pool_size)
1695 + sysdep_sa_len(raddr)
1696 + strlen(usr) + 1
1697 + strlen(pwd) + 1;
1698
1699 if ((msg = racoon_malloc(len)) == NULL) {
1700 plog(LLV_ERROR, LOCATION, NULL,
1701 "Cannot allocate memory: %s\n", strerror(errno));
1702 return -1;
1703 }
1704 bzero(msg, len);
1705 msg->hdr.ac_cmd = PRIVSEP_XAUTH_LOGIN_PAM;
1706 msg->hdr.ac_len = len;
1707 msg->bufs.buflen[0] = sizeof(port);
1708 msg->bufs.buflen[1] = sizeof(isakmp_cfg_config.pool_size);
1709 msg->bufs.buflen[2] = sysdep_sa_len(raddr);
1710 msg->bufs.buflen[3] = strlen(usr) + 1;
1711 msg->bufs.buflen[4] = strlen(pwd) + 1;
1712
1713 data = (char *)(msg + 1);
1714 memcpy(data, &port, msg->bufs.buflen[0]);
1715
1716 data += msg->bufs.buflen[0];
1717 memcpy(data, &isakmp_cfg_config.pool_size, msg->bufs.buflen[1]);
1718
1719 data += msg->bufs.buflen[1];
1720 memcpy(data, raddr, msg->bufs.buflen[2]);
1721
1722 data += msg->bufs.buflen[2];
1723 memcpy(data, usr, msg->bufs.buflen[3]);
1724
1725 data += msg->bufs.buflen[3];
1726 memcpy(data, pwd, msg->bufs.buflen[4]);
1727
1728 /* frees msg */
1729 if (privsep_send(privsep_sock[1], msg, len) != 0)
1730 return -1;
1731
1732 if (privsep_recv(privsep_sock[1], &msg, &len) != 0)
1733 return -1;
1734
1735 if (msg->hdr.ac_errno != 0) {
1736 errno = msg->hdr.ac_errno;
1737 goto out;
1738 }
1739
1740 racoon_free(msg);
1741 return 0;
1742
1743 out:
1744 racoon_free(msg);
1745 return -1;
1746 }
1747
1748 void
1749 privsep_cleanup_pam(port)
1750 int port;
1751 {
1752 struct privsep_com_msg *msg;
1753 size_t len;
1754 char *data;
1755 int result;
1756
1757 if (geteuid() == 0)
1758 return cleanup_pam(port);
1759
1760 len = sizeof(*msg)
1761 + sizeof(port)
1762 + sizeof(isakmp_cfg_config.pool_size);
1763
1764 if ((msg = racoon_malloc(len)) == NULL) {
1765 plog(LLV_ERROR, LOCATION, NULL,
1766 "Cannot allocate memory: %s\n", strerror(errno));
1767 return;
1768 }
1769 bzero(msg, len);
1770 msg->hdr.ac_cmd = PRIVSEP_CLEANUP_PAM;
1771 msg->hdr.ac_len = len;
1772 msg->bufs.buflen[0] = sizeof(port);
1773 msg->bufs.buflen[1] = sizeof(isakmp_cfg_config.pool_size);
1774
1775 data = (char *)(msg + 1);
1776 memcpy(data, &port, msg->bufs.buflen[0]);
1777
1778 data += msg->bufs.buflen[0];
1779 memcpy(data, &isakmp_cfg_config.pool_size, msg->bufs.buflen[1]);
1780
1781 /* frees msg */
1782 if (privsep_send(privsep_sock[1], msg, len) != 0)
1783 return;
1784
1785 if (privsep_recv(privsep_sock[1], &msg, &len) != 0)
1786 return;
1787
1788 if (msg->hdr.ac_errno != 0)
1789 errno = msg->hdr.ac_errno;
1790
1791 racoon_free(msg);
1792 return;
1793 }
1794 #endif
NetBSD on the FriendlyARM MINI2440