privsep.c   [plain text]

/*	$NetBSD: privsep.c,v 1.6 2006/09/09 16:22:10 manu Exp $	*/

/* Id: privsep.c,v 1.15 2005/08/08 11:23:44 vanhu Exp */

/*
 * Copyright (C) 2004 Emmanuel Dreyfus
 * All rights reserved.
 * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. Neither the name of the project nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 * 
 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

#include "config.h"

#include <unistd.h>
#include <string.h>
#ifdef __NetBSD__
#include <stdlib.h>	/* for setproctitle */
#endif
#include <errno.h>
#include <signal.h>
#include <pwd.h>

#include <sys/socket.h>
#include <sys/param.h>

#include "gcmalloc.h"
#include "vmbuf.h"
#include "misc.h"
#include "plog.h"
#include "var.h"
#include "libpfkey.h"

#include "crypto_openssl.h"
#include "isakmp_var.h"
#include "isakmp.h"
#ifdef ENABLE_HYBRID
#include "resolv.h"
#include "isakmp_xauth.h"
#include "isakmp_cfg.h"
#endif
#include "localconf.h"
#include "remoteconf.h"
#include "admin.h"
#include "sockmisc.h"
#include "privsep.h"

#ifdef HAVE_OPENSSL
static int privsep_sock[2] = { -1, -1 };

static int privsep_recv(int, struct privsep_com_msg **, size_t *);
static int privsep_send(int, struct privsep_com_msg *, size_t);
static int safety_check(struct privsep_com_msg *, int i);
static int port_check(int);
static int unsafe_env(char *const *);
static int unknown_name(int);
static int unsafe_path(char *, int);
#endif

#ifdef HAVE_OPENSSL
static int
privsep_send(sock, buf, len)
	int sock;
	struct privsep_com_msg *buf;
	size_t len;
{
	if (buf == NULL)
		return 0;

	if (sendto(sock, (char *)buf, len, 0, NULL, 0) == -1) {
		plog(LLV_ERROR, LOCATION, NULL,
		    "privsep_send failed: %s\n", 
		    strerror(errno));
		return -1;
	}

	racoon_free((char *)buf);

	return 0;
}


static int
privsep_recv(sock, bufp, lenp)
	int sock;
	struct privsep_com_msg **bufp;
	size_t *lenp;
{
	struct admin_com com;
	struct admin_com *combuf;
	size_t len;

	*bufp = NULL;
	*lenp = 0;

	/* Get the header */
	while ((len = recvfrom(sock, (char *)&com, 
	    sizeof(com), MSG_PEEK, NULL, NULL)) == -1) {
		if (errno == EINTR)
			continue;

		plog(LLV_ERROR, LOCATION, NULL,
		    "privsep_recv failed: %s\n",
		    strerror(errno));
		return -1;
	}
	
	/* Check for short packets */
	if (len < sizeof(com)) {
		plog(LLV_ERROR, LOCATION, NULL,
		    "corrupted privsep message (short header)\n");
		return -1;
	}

	/* Allocate buffer for the whole message */
	if ((combuf = (struct admin_com *)racoon_malloc(com.ac_len)) == NULL) {
		plog(LLV_ERROR, LOCATION, NULL,
		    "failed to allocate memory: %s\n", strerror(errno));
		return -1;
	}

	/* Get the whole buffer */
	while ((len = recvfrom(sock, (char *)combuf, 
	    com.ac_len, 0, NULL, NULL)) == -1) {
		if (errno == EINTR)
			continue;
		plog(LLV_ERROR, LOCATION, NULL,
		    "failed to recv privsep command: %s\n", 
		    strerror(errno));
		return -1;
	}

	/* We expect len to match */
	if (len != com.ac_len) {
		plog(LLV_ERROR, LOCATION, NULL,
		    "corrupted privsep message (short packet)\n");
		return -1;
	}

	*bufp = (struct privsep_com_msg *)combuf;
	*lenp = len;

	return 0;
}
#endif /* HAVE_OPENSSL */

#ifdef HAVE_OPENSSL
int
privsep_init(void)
{
	int i;
	pid_t child_pid;

	/* If running as root, we don't use the privsep code path */
	if (lcconf->uid == 0)
		return 0;

	/*
	 * When running privsep, certificate and script paths
	 * are mandatory, as they enable us to check path safety
	 * in the privilegied instance
	 */
	if ((lcconf->pathinfo[LC_PATHTYPE_CERT] == NULL) ||
	    (lcconf->pathinfo[LC_PATHTYPE_SCRIPT] == NULL)) {
		plog(LLV_ERROR, LOCATION, NULL, "privilege separation "
		   "require path cert and path script in the config file\n");
		return -1;
	}

	if (socketpair(PF_LOCAL, SOCK_DGRAM, 0, privsep_sock) != 0) {
		plog(LLV_ERROR, LOCATION, NULL, 
		    "Cannot allocate privsep_sock: %s\n", strerror(errno));
		return -1;
	}

	switch (child_pid = fork()) {
	case -1:
		plog(LLV_ERROR, LOCATION, NULL, "Cannot fork privsep: %s\n", 
		    strerror(errno));
		return -1;
		break;

	case 0: /* Child: drop privileges */
		if (lcconf->chroot != NULL) {
			if (chdir(lcconf->chroot) != 0) {
				plog(LLV_ERROR, LOCATION, NULL, 
				    "Cannot chdir(%s): %s\n", lcconf->chroot, 
				    strerror(errno));
				return -1;
			}
			if (chroot(lcconf->chroot) != 0) {
				plog(LLV_ERROR, LOCATION, NULL, 
				    "Cannot chroot(%s): %s\n", lcconf->chroot, 
				    strerror(errno));
				return -1;
			}
		}

		if (setgid(lcconf->gid) != 0) {
			plog(LLV_ERROR, LOCATION, NULL, 
			    "Cannot setgid(%d): %s\n", lcconf->gid,
			    strerror(errno));
			return -1;
		}

		if (setegid(lcconf->gid) != 0) {
			plog(LLV_ERROR, LOCATION, NULL, 
			    "Cannot setegid(%d): %s\n", lcconf->gid,
			    strerror(errno));
			return -1;
		}

		if (setuid(lcconf->uid) != 0) {
			plog(LLV_ERROR, LOCATION, NULL, 
			    "Cannot setuid(%d): %s\n", lcconf->uid,
			    strerror(errno));
			return -1;
		}

		if (seteuid(lcconf->uid) != 0) {
			plog(LLV_ERROR, LOCATION, NULL, 
			    "Cannot seteuid(%d): %s\n", lcconf->uid,
			    strerror(errno));
			return -1;
		}

		return 0;
		break;

	default: /* Parent: privilegied process */
		break;
	}

	/* 
	 * Close everything except the socketpair, 
	 * and stdout if running in the forground.
	 */
	for (i = sysconf(_SC_OPEN_MAX); i > 0; i--) {
		if (i == privsep_sock[0])
			continue;
		if (i == privsep_sock[1])
			continue;
		if ((f_foreground) && (i == 1))
			continue;
		(void)close(i);
	}

	/* Above trickery closed the log file, reopen it */
	ploginit();

	plog(LLV_INFO, LOCATION, NULL, 
	    "racoon privilegied process running with PID %d\n", getpid());

#ifdef __NetBSD__
	setproctitle("[priv]");
#endif
	
	/* 
	 * Don't catch any signal 
	 * This duplicate session:signals[], which is static...
	 */
	signal(SIGHUP, SIG_DFL);
	signal(SIGINT, SIG_DFL);
	signal(SIGTERM, SIG_DFL);
	signal(SIGUSR1, SIG_DFL);
	signal(SIGUSR2, SIG_DFL);
	signal(SIGCHLD, SIG_DFL);

	while (1) {
		size_t len;
		struct privsep_com_msg *combuf;
		struct privsep_com_msg *reply;
		char *data;
		size_t *buflen;
		size_t totallen;
		char *bufs[PRIVSEP_NBUF_MAX];
		int i;

		if (privsep_recv(privsep_sock[0], &combuf, &len) != 0)
			goto out;

		/* Safety checks and gather the data */
		if (len < sizeof(*combuf)) {
			plog(LLV_ERROR, LOCATION, NULL,
			    "corrupted privsep message (short buflen)\n");
			goto out;
		}

		data = (char *)(combuf + 1);
		totallen = sizeof(*combuf);
		for (i = 0; i < PRIVSEP_NBUF_MAX; i++) {
			bufs[i] = (char *)data;
			data += combuf->bufs.buflen[i];
			totallen += combuf->bufs.buflen[i];
		}

		if (totallen > len) {
			plog(LLV_ERROR, LOCATION, NULL,
			    "corrupted privsep message (bufs too big)\n");
			goto out;
		}
	
		/* Prepare the reply buffer */
		if ((reply = racoon_malloc(sizeof(*reply))) == NULL) {
			plog(LLV_ERROR, LOCATION, NULL,
			    "Cannot allocate reply buffer: %s\n", 
			    strerror(errno));
			goto out;
		}
		bzero(reply, sizeof(*reply));
		reply->hdr.ac_cmd = combuf->hdr.ac_cmd;
		reply->hdr.ac_len = sizeof(*reply);

		switch(combuf->hdr.ac_cmd) {
		/* 
		 * XXX Improvement: instead of returning the key, 
		 * stuff eay_get_pkcs1privkey and eay_get_x509sign
		 * together and sign the hash in the privilegied 
		 * instance? 
		 * pro: the key remains inaccessible to unpriv
		 * con: a compromised unpriv racoon can still sign anything
		 */
		case PRIVSEP_EAY_GET_PKCS1PRIVKEY: {
			vchar_t *privkey;

			/* Make sure the string is NULL terminated */
			if (safety_check(combuf, 0) != 0)
				break;
			bufs[0][combuf->bufs.buflen[0] - 1] = '\0';

			if (unsafe_path(bufs[0], LC_PATHTYPE_CERT) != 0) {
				plog(LLV_ERROR, LOCATION, NULL, 
				    "privsep_eay_get_pkcs1privkey: "
				    "unsafe cert \"%s\"\n", bufs[0]);
			}

			plog(LLV_DEBUG, LOCATION, NULL, 
			    "eay_get_pkcs1privkey(\"%s\")\n", bufs[0]);

			if ((privkey = eay_get_pkcs1privkey(bufs[0])) == NULL){
				reply->hdr.ac_errno = errno;
				break;
			}

			reply->bufs.buflen[0] = privkey->l;
			reply->hdr.ac_len = sizeof(*reply) + privkey->l;
			reply = racoon_realloc(reply, reply->hdr.ac_len);
			if (reply == NULL) {
				plog(LLV_ERROR, LOCATION, NULL,
				    "Cannot allocate reply buffer: %s\n", 
				    strerror(errno));
				goto out;
			}

			memcpy(reply + 1, privkey->v, privkey->l);
			vfree(privkey);
			break;
		}
		
		case PRIVSEP_SCRIPT_EXEC: {
			char *script;
			int name;
			char **envp = NULL;
			int envc = 0;
			int count = 0;
			int i;

			/*
			 * First count the bufs, and make sure strings
			 * are NULL terminated. 
			 *
			 * We expect: script, name, envp[], void
			 */ 
			if (safety_check(combuf, 0) != 0)
				break;
			bufs[0][combuf->bufs.buflen[0] - 1] = '\0';
			count++;	/* script */
			count++;	/* name */

			for (; count < PRIVSEP_NBUF_MAX; count++) {
				if (combuf->bufs.buflen[count] == 0)
					break;
				bufs[count]
				    [combuf->bufs.buflen[count] - 1] = '\0';
				envc++;
			}

			/* count a void buf and perform safety check */
			count++;
			if (count >= PRIVSEP_NBUF_MAX) {
				plog(LLV_ERROR, LOCATION, NULL, 
				    "privsep_script_exec: too many args\n");
				goto out;
			}


			/* 
			 * Allocate the arrays for envp 
			 */
			envp = racoon_malloc((envc + 1) * sizeof(char *));
			if (envp == NULL) {
				plog(LLV_ERROR, LOCATION, NULL, 
				    "cannot allocate memory: %s\n",
				    strerror(errno));
				goto out;
			}
			bzero(envp, (envc + 1) * sizeof(char *));

	
			/*
			 * Populate script, name and envp 
			 */
			count = 0;
			script = bufs[count++];

			if (combuf->bufs.buflen[count] != sizeof(name)) {
				plog(LLV_ERROR, LOCATION, NULL, 
				    "privsep_script_exec: corrupted message\n");
				goto out;
			}
			memcpy((char *)&name, bufs[count++], sizeof(name));

			for (i = 0; combuf->bufs.buflen[count]; count++)
				envp[i++] = bufs[count];

			count++;		/* void */

			plog(LLV_DEBUG, LOCATION, NULL, 
			    "script_exec(\"%s\", %d, %p)\n", 
			    script, name, envp);

			/* 
			 * Check env for dangerous variables
			 * Check script path and name
			 * Perform fork and execve
			 */
			if ((unsafe_env(envp) == 0) &&
			    (unknown_name(name) == 0) &&
			    (unsafe_path(script, LC_PATHTYPE_SCRIPT) == 0))
				(void)script_exec(script, name, envp);
			else
				plog(LLV_ERROR, LOCATION, NULL, 
				    "privsep_script_exec: "
				    "unsafe script \"%s\"\n", script);

			racoon_free(envp);
			break;
		}

		case PRIVSEP_GETPSK: {
			vchar_t *psk;
			int keylen;

			/* Make sure the string is NULL terminated */
			if (safety_check(combuf, 0) != 0)
				break;
			bufs[0][combuf->bufs.buflen[0] - 1] = '\0';

			if (combuf->bufs.buflen[1] != sizeof(keylen)) {
				plog(LLV_ERROR, LOCATION, NULL, 
				    "privsep_getpsk: corrupted message\n");
				goto out;
			}
			memcpy(&keylen, bufs[1], sizeof(keylen));

			plog(LLV_DEBUG, LOCATION, NULL, 
			    "getpsk(\"%s\", %d)\n", bufs[0], keylen);

			if ((psk = getpsk(bufs[0], keylen)) == NULL) {
				reply->hdr.ac_errno = errno;
				break;
			}

			reply->bufs.buflen[0] = psk->l;
			reply->hdr.ac_len = sizeof(*reply) + psk->l;
			reply = racoon_realloc(reply, reply->hdr.ac_len); 
			if (reply == NULL) {
				plog(LLV_ERROR, LOCATION, NULL,
				    "Cannot allocate reply buffer: %s\n", 
				    strerror(errno));
				goto out;
			}

			memcpy(reply + 1, psk->v, psk->l);
			vfree(psk);
			break;
		}

#ifdef ENABLE_HYBRID
		case PRIVSEP_ACCOUNTING_SYSTEM: {
			int pool_size;
			int port;
			int inout;
			struct sockaddr *raddr;

			if (safety_check(combuf, 0) != 0)
				break;
			if (safety_check(combuf, 1) != 0)
				break;
			if (safety_check(combuf, 2) != 0)
				break;
			if (safety_check(combuf, 3) != 0)
				break;

			memcpy(&port, bufs[0], sizeof(port));
			raddr = (struct sockaddr *)bufs[1];

			bufs[2][combuf->bufs.buflen[2] - 1] = '\0';
			memcpy(&inout, bufs[3], sizeof(port));

			if (port_check(port) != 0)
				break;

			plog(LLV_DEBUG, LOCATION, NULL, 
			    "accounting_system(%d, %s, %s)\n", 
			    port, saddr2str(raddr), bufs[2]); 

			errno = 0;
			if (isakmp_cfg_accounting_system(port, 
			    raddr, bufs[2], inout) != 0) {
				if (errno == 0)
					reply->hdr.ac_errno = EINVAL;
				else
					reply->hdr.ac_errno = errno;
			}
			break;
		}
		case PRIVSEP_XAUTH_LOGIN_SYSTEM: {
			if (safety_check(combuf, 0) != 0)
				break;
			bufs[0][combuf->bufs.buflen[0] - 1] = '\0';

			if (safety_check(combuf, 1) != 0)
				break;
			bufs[1][combuf->bufs.buflen[1] - 1] = '\0';

			plog(LLV_DEBUG, LOCATION, NULL, 
			    "xauth_login_system(\"%s\", <password>)\n", 
			    bufs[0]);

			errno = 0;
			if (xauth_login_system(bufs[0], bufs[1]) != 0) {
				if (errno == 0)
					reply->hdr.ac_errno = EINVAL;
				else
					reply->hdr.ac_errno = errno;
			}
			break;
		}
#ifdef HAVE_LIBPAM
		case PRIVSEP_ACCOUNTING_PAM: {
			int port;
			int inout;
			int pool_size;

			if (safety_check(combuf, 0) != 0)
				break;
			if (safety_check(combuf, 1) != 0)
				break;
			if (safety_check(combuf, 2) != 0)
				break;

			memcpy(&port, bufs[0], sizeof(port));
			memcpy(&inout, bufs[1], sizeof(inout));
			memcpy(&pool_size, bufs[2], sizeof(pool_size));

			if (pool_size != isakmp_cfg_config.pool_size)
				if (isakmp_cfg_resize_pool(pool_size) != 0)
					break;

			if (port_check(port) != 0)
				break;

			plog(LLV_DEBUG, LOCATION, NULL, 
			    "isakmp_cfg_accounting_pam(%d, %d)\n", 
			    port, inout); 

			errno = 0;
			if (isakmp_cfg_accounting_pam(port, inout) != 0) {
				if (errno == 0)
					reply->hdr.ac_errno = EINVAL;
				else
					reply->hdr.ac_errno = errno;
			}
			break;
		}

		case PRIVSEP_XAUTH_LOGIN_PAM: {
			int port;
			int pool_size;
			struct sockaddr *raddr;

			if (safety_check(combuf, 0) != 0)
				break;
			if (safety_check(combuf, 1) != 0)
				break;
			if (safety_check(combuf, 2) != 0)
				break;
			if (safety_check(combuf, 3) != 0)
				break;
			if (safety_check(combuf, 4) != 0)
				break;

			memcpy(&port, bufs[0], sizeof(port));
			memcpy(&pool_size, bufs[1], sizeof(pool_size));
			raddr = (struct sockaddr *)bufs[2];
			
			bufs[3][combuf->bufs.buflen[3] - 1] = '\0';
			bufs[4][combuf->bufs.buflen[4] - 1] = '\0';

			if (pool_size != isakmp_cfg_config.pool_size)
				if (isakmp_cfg_resize_pool(pool_size) != 0)
					break;

			if (port_check(port) != 0)
				break;

			plog(LLV_DEBUG, LOCATION, NULL, 
			    "xauth_login_pam(%d, %s, \"%s\", <password>)\n", 
			    port, saddr2str(raddr), bufs[3]); 

			errno = 0;
			if (xauth_login_pam(port, 
			    raddr, bufs[3], bufs[4]) != 0) {
				if (errno == 0)
					reply->hdr.ac_errno = EINVAL;
				else
					reply->hdr.ac_errno = errno;
			}
			break;
		}

		case PRIVSEP_CLEANUP_PAM: {
			int port;
			int pool_size;

			if (safety_check(combuf, 0) != 0)
				break;
			if (safety_check(combuf, 1) != 0)
				break;

			memcpy(&port, bufs[0], sizeof(port));
			memcpy(&pool_size, bufs[1], sizeof(pool_size));

			if (pool_size != isakmp_cfg_config.pool_size)
				if (isakmp_cfg_resize_pool(pool_size) != 0)
					break;

			if (port_check(port) != 0)
				break;

			plog(LLV_DEBUG, LOCATION, NULL, 
			    "cleanup_pam(%d)\n", port);

			cleanup_pam(port);
			reply->hdr.ac_errno = 0;

			break;
		}
#endif /* HAVE_LIBPAM */
#endif /* ENABLE_HYBRID */

		default:
			plog(LLV_ERROR, LOCATION, NULL,
			    "unexpected privsep command %d\n", 
			    combuf->hdr.ac_cmd);
			goto out;
			break;
		}

		/* This frees reply */
		if (privsep_send(privsep_sock[0], 
		    reply, reply->hdr.ac_len) != 0)
			goto out;

		racoon_free(combuf);
	}

out:
	plog(LLV_INFO, LOCATION, NULL, "privsep exit\n");
	_exit(0);
}
#endif /* HAVE_OPENSSL */

#ifdef HAVE_OPENSSL
vchar_t *
privsep_eay_get_pkcs1privkey(path) 
	char *path;
{
	vchar_t *privkey;
	struct privsep_com_msg *msg;
	size_t len;

	if (geteuid() == 0)
		return eay_get_pkcs1privkey(path);

	len = sizeof(*msg) + strlen(path) + 1;
	if ((msg = racoon_malloc(len)) == NULL) {
		plog(LLV_ERROR, LOCATION, NULL, 
		    "Cannot allocate memory: %s\n", strerror(errno));
		return NULL;
	}
	bzero(msg, len);
	msg->hdr.ac_cmd = PRIVSEP_EAY_GET_PKCS1PRIVKEY;
	msg->hdr.ac_len = len;
	msg->bufs.buflen[0] = len - sizeof(*msg);
	memcpy(msg + 1, path, msg->bufs.buflen[0]);

	if (privsep_send(privsep_sock[1], msg, len) != 0)
		return NULL;

	if (privsep_recv(privsep_sock[1], &msg, &len) != 0)
		return NULL;

	if (msg->hdr.ac_errno != 0) {
		errno = msg->hdr.ac_errno;
		goto out;
	}

	if ((privkey = vmalloc(len - sizeof(*msg))) == NULL)
		goto out;

	memcpy(privkey->v, msg + 1, privkey->l);
	racoon_free(msg);
	return privkey;

out:
	racoon_free(msg);
	return NULL;
}
#endif

/*
 * No prigilege separation trick here, we just open PFKEY before
 * dropping root privs and we remember it later.
 */
static int  pfkey_socket = -1;
int
privsep_pfkey_open(void)
{
	int ps;

	if (pfkey_socket != -1)
		return pfkey_socket;

	ps = pfkey_open();
	if (ps != -1)
		pfkey_socket = ps;

	return ps;
}

/*
 * Consequence of the above trickery: don't 
 * really close PFKEY as we never re-open it.
 */
void
privsep_pfkey_close(ps)
	int ps;
{
	return;
}

#ifdef HAVE_OPENSSL
int
privsep_script_exec(script, name, envp)
	char *script;
	int name;
	char *const envp[];
{
	int count = 0;
	char *const *c;
	char *data;
	size_t len;
	struct privsep_com_msg *msg;

	if (geteuid() == 0)
		return script_exec(script, name, envp);

	if ((msg = racoon_malloc(sizeof(*msg))) == NULL) {
		plog(LLV_ERROR, LOCATION, NULL, 
		    "Cannot allocate memory: %s\n", strerror(errno));
		return -1;
	}

	bzero(msg, sizeof(*msg));
	msg->hdr.ac_cmd = PRIVSEP_SCRIPT_EXEC;
	msg->hdr.ac_len = sizeof(*msg);

	/*
	 * We send: 
	 * script, name, envp[0], ... envp[N], void
	 */

	/*
	 * Safety check on the counts: PRIVSEP_NBUF_MAX max
	 */
	count = 0;
	count++;					/* script */
	count++;					/* name */
	for (c = envp; *c; c++)				/* envp */
		count++;
	count++;					/* void */

	if (count > PRIVSEP_NBUF_MAX) {
		plog(LLV_ERROR, LOCATION, NULL, "Unexpected error: "
		    "privsep_script_exec count > PRIVSEP_NBUF_MAX\n");
		racoon_free(msg);
		return -1;
	}


	/*
	 * Compute the length
	 */
	count = 0;
	msg->bufs.buflen[count] = strlen(script) + 1;	/* script */
	msg->hdr.ac_len += msg->bufs.buflen[count++];

	msg->bufs.buflen[count] = sizeof(name);		/* name */
	msg->hdr.ac_len += msg->bufs.buflen[count++];

	for (c = envp; *c; c++) {			/* envp */
		msg->bufs.buflen[count] = strlen(*c) + 1;
		msg->hdr.ac_len += msg->bufs.buflen[count++];
	}

	msg->bufs.buflen[count] = 0; 			/* void */
	msg->hdr.ac_len += msg->bufs.buflen[count++];

	if ((msg = racoon_realloc(msg, msg->hdr.ac_len)) == NULL) {
		plog(LLV_ERROR, LOCATION, NULL, 
		    "Cannot allocate memory: %s\n", strerror(errno));
		return -1;
	}
	
	/*
	 * Now copy the data
	 */
	data = (char *)(msg + 1);
	count = 0;

	memcpy(data, (char *)script, msg->bufs.buflen[count]);	/* script */
	data += msg->bufs.buflen[count++];

	memcpy(data, (char *)&name, msg->bufs.buflen[count]);	/* name */
	data += msg->bufs.buflen[count++];

	for (c = envp; *c; c++) {				/* envp */
		memcpy(data, *c, msg->bufs.buflen[count]); 
		data += msg->bufs.buflen[count++];
	}

	count++;						/* void */

	/*
	 * And send it!
	 */
	if (privsep_send(privsep_sock[1], msg, msg->hdr.ac_len) != 0)
		return -1;

	if (privsep_recv(privsep_sock[1], &msg, &len) != 0)
		return -1;

	if (msg->hdr.ac_errno != 0) {
		errno = msg->hdr.ac_errno;
		racoon_free(msg);
		return -1;
	}

	racoon_free(msg);
	return 0;
}
#endif

#ifdef HAVE_OPENSSL
vchar_t *
privsep_getpsk(str, keylen)
	const char *str;
	int keylen;
{
	vchar_t *psk;
	struct privsep_com_msg *msg;
	size_t len;
	int *keylenp;
	char *data;

	if (geteuid() == 0)
		return getpsk(str, keylen);

	len = sizeof(*msg) + strlen(str) + 1 + sizeof(keylen);
	if ((msg = racoon_malloc(len)) == NULL) {
		plog(LLV_ERROR, LOCATION, NULL, 
		    "Cannot allocate memory: %s\n", strerror(errno));
		return NULL;
	}
	bzero(msg, len);
	msg->hdr.ac_cmd = PRIVSEP_GETPSK;
	msg->hdr.ac_len = len;

	data = (char *)(msg + 1);
	msg->bufs.buflen[0] = strlen(str) + 1;
	memcpy(data, str, msg->bufs.buflen[0]);

	data += msg->bufs.buflen[0];
	msg->bufs.buflen[1] = sizeof(keylen);
	memcpy(data, &keylen, sizeof(keylen));

	if (privsep_send(privsep_sock[1], msg, len) != 0)
		return NULL;

	if (privsep_recv(privsep_sock[1], &msg, &len) != 0)
		return NULL;

	if (msg->hdr.ac_errno != 0) {
		errno = msg->hdr.ac_errno;
		goto out;
	}

	if ((psk = vmalloc(len - sizeof(*msg))) == NULL)
		goto out;

	memcpy(psk->v, msg + 1, psk->l);
	racoon_free(msg);
	return psk;

out:
	racoon_free(msg);
	return NULL;
}
#endif

#ifdef HAVE_OPENSSL
#ifdef ENABLE_HYBRID
int
privsep_xauth_login_system(usr, pwd)
	char *usr;
	char *pwd;
{
	struct privsep_com_msg *msg;
	size_t len;
	char *data;

	if (geteuid() == 0)
		return xauth_login_system(usr, pwd);

	len = sizeof(*msg) + strlen(usr) + 1 + strlen(pwd) + 1;
	if ((msg = racoon_malloc(len)) == NULL) {
		plog(LLV_ERROR, LOCATION, NULL, 
		    "Cannot allocate memory: %s\n", strerror(errno));
		return -1;
	}
	bzero(msg, len);
	msg->hdr.ac_cmd = PRIVSEP_XAUTH_LOGIN_SYSTEM;
	msg->hdr.ac_len = len;

	data = (char *)(msg + 1);
	msg->bufs.buflen[0] = strlen(usr) + 1;
	memcpy(data, usr, msg->bufs.buflen[0]);
	data += msg->bufs.buflen[0];

	msg->bufs.buflen[1] = strlen(pwd) + 1;
	memcpy(data, pwd, msg->bufs.buflen[1]);
	
	if (privsep_send(privsep_sock[1], msg, len) != 0)
		return -1;

	if (privsep_recv(privsep_sock[1], &msg, &len) != 0)
		return -1;

	if (msg->hdr.ac_errno != 0) {
		racoon_free(msg);
		return -1;
	}

	racoon_free(msg);
	return 0;
}

int 
privsep_accounting_system(port, raddr, usr, inout)
	int port;
	struct sockaddr *raddr;
	char *usr;
	int inout;
{
	struct privsep_com_msg *msg;
	size_t len;
	char *data;
	int result;

	if (geteuid() == 0)
		return isakmp_cfg_accounting_system(port, raddr,
						    usr, inout);

	len = sizeof(*msg) 
	    + sizeof(port)
	    + sysdep_sa_len(raddr) 
	    + strlen(usr) + 1
	    + sizeof(inout);

	if ((msg = racoon_malloc(len)) == NULL) {
		plog(LLV_ERROR, LOCATION, NULL, 
		    "Cannot allocate memory: %s\n", strerror(errno));
		return -1;
	}
	bzero(msg, len);
	msg->hdr.ac_cmd = PRIVSEP_ACCOUNTING_SYSTEM;
	msg->hdr.ac_len = len;
	msg->bufs.buflen[0] = sizeof(port);
	msg->bufs.buflen[1] = sysdep_sa_len(raddr);
	msg->bufs.buflen[2] = strlen(usr) + 1;
	msg->bufs.buflen[3] = sizeof(inout);

	data = (char *)(msg + 1);
	memcpy(data, &port, msg->bufs.buflen[0]);

	data += msg->bufs.buflen[0];
	memcpy(data, raddr, msg->bufs.buflen[1]);

	data += msg->bufs.buflen[1];
	memcpy(data, usr, msg->bufs.buflen[2]);

	data += msg->bufs.buflen[2];
	memcpy(data, &inout, msg->bufs.buflen[3]);

	if (privsep_send(privsep_sock[1], msg, len) != 0)
		return -1;

	if (privsep_recv(privsep_sock[1], &msg, &len) != 0)
		return -1;

	if (msg->hdr.ac_errno != 0) {
		errno = msg->hdr.ac_errno;
		goto out;
	}

	racoon_free(msg);
	return 0;

out:
	racoon_free(msg);
	return -1;
}
#endif

static int
port_check(port)
	int port;
{
	if ((port < 0) || (port >= isakmp_cfg_config.pool_size)) {
		plog(LLV_ERROR, LOCATION, NULL, 
		    "privsep: port %d outside of allowed range [0,%zu]\n",
		    port, isakmp_cfg_config.pool_size - 1);
		return -1;
	}

	return 0;
}
#endif /* HAVE_OPENSSL */

#ifdef HAVE_OPENSSL
static int 
safety_check(msg, index)
	struct privsep_com_msg *msg;
	int index;
{
	if (index >= PRIVSEP_NBUF_MAX) {
		plog(LLV_ERROR, LOCATION, NULL, 
		    "privsep: Corrupted message, too many buffers\n");
		return -1;
	}
		
	if (msg->bufs.buflen[index] == 0) {
		plog(LLV_ERROR, LOCATION, NULL, 
		    "privsep: Corrupted message, unexpected void buffer\n");
		return -1;
	}

	return 0;
}

/*
 * Filter unsafe environement variables
 */
static int
unsafe_env(envp)
	char *const *envp;
{
	char *const *e;
	char *const *be;
	char *const bad_env[] = { "PATH=", "LD_LIBRARY_PATH=", "IFS=", NULL };

	for (e = envp; *e; e++) {
		for (be = bad_env; *be; be++) {
			if (strncmp(*e, *be, strlen(*be)) == 0) {
				goto found;
			}
		}
	}

	return 0;
found:
	plog(LLV_ERROR, LOCATION, NULL, 
	    "privsep_script_exec: unsafe environement variable\n");
	return -1;
}

/*
 * Check path safety
 */
static int 
unsafe_path(script, pathtype)
	char *script;
	int pathtype;
{
	char *path;
	char rpath[MAXPATHLEN + 1];
	size_t len;

	if (script == NULL) 
		return -1;

	path = lcconf->pathinfo[pathtype];

	/* No path was given for scripts: skip the check */
	if (path == NULL)
		return 0;

	if (realpath(script, rpath) == NULL) {
		plog(LLV_ERROR, LOCATION, NULL,
		    "script path \"%s\" is invalid\n", script);
		return -1;
	}

	len = strlen(path);
	if (strncmp(path, rpath, len) != 0)
		return -1;

	return 0;
}

static int 
unknown_name(name)
	int name;
{
	if ((name < 0) || (name > SCRIPT_MAX)) {
		plog(LLV_ERROR, LOCATION, NULL, 
		    "privsep_script_exec: unsafe name index\n");
		return -1;
	}

	return 0;
}
#endif /* HAVE_OPENSSL */

#ifdef HAVE_LIBPAM
int 
privsep_accounting_pam(port, inout)
	int port;
	int inout;
{
	struct privsep_com_msg *msg;
	size_t len;
	int *port_data;
	int *inout_data;
	int *pool_size_data;
	int result;

	if (geteuid() == 0)
		return isakmp_cfg_accounting_pam(port, inout);

	len = sizeof(*msg) 
	    + sizeof(port) 
	    + sizeof(inout)
	    + sizeof(isakmp_cfg_config.pool_size);

	if ((msg = racoon_malloc(len)) == NULL) {
		plog(LLV_ERROR, LOCATION, NULL, 
		    "Cannot allocate memory: %s\n", strerror(errno));
		return -1;
	}
	bzero(msg, len);
	msg->hdr.ac_cmd = PRIVSEP_ACCOUNTING_PAM;
	msg->hdr.ac_len = len;
	msg->bufs.buflen[0] = sizeof(port);
	msg->bufs.buflen[1] = sizeof(inout);
	msg->bufs.buflen[2] = sizeof(isakmp_cfg_config.pool_size);

	port_data = (int *)(msg + 1);
	inout_data = (int *)(port_data + 1);
	pool_size_data = (int *)(inout_data + 1);

	*port_data = port;
	*inout_data = inout;
	*pool_size_data = isakmp_cfg_config.pool_size;

	if (privsep_send(privsep_sock[1], msg, len) != 0)
		return -1;

	if (privsep_recv(privsep_sock[1], &msg, &len) != 0)
		return -1;

	if (msg->hdr.ac_errno != 0) {
		errno = msg->hdr.ac_errno;
		goto out;
	}

	racoon_free(msg);
	return 0;

out:
	racoon_free(msg);
	return -1;
}

int 
privsep_xauth_login_pam(port, raddr, usr, pwd)
	int port;
	struct sockaddr *raddr;
	char *usr;
	char *pwd;
{
	struct privsep_com_msg *msg;
	size_t len;
	char *data;
	int result;

	if (geteuid() == 0)
		return xauth_login_pam(port, raddr, usr, pwd);

	len = sizeof(*msg) 
	    + sizeof(port)
	    + sizeof(isakmp_cfg_config.pool_size)
	    + sysdep_sa_len(raddr) 
	    + strlen(usr) + 1
	    + strlen(pwd) + 1;

	if ((msg = racoon_malloc(len)) == NULL) {
		plog(LLV_ERROR, LOCATION, NULL, 
		    "Cannot allocate memory: %s\n", strerror(errno));
		return -1;
	}
	bzero(msg, len);
	msg->hdr.ac_cmd = PRIVSEP_XAUTH_LOGIN_PAM;
	msg->hdr.ac_len = len;
	msg->bufs.buflen[0] = sizeof(port);
	msg->bufs.buflen[1] = sizeof(isakmp_cfg_config.pool_size);
	msg->bufs.buflen[2] = sysdep_sa_len(raddr);
	msg->bufs.buflen[3] = strlen(usr) + 1;
	msg->bufs.buflen[4] = strlen(pwd) + 1;

	data = (char *)(msg + 1);
	memcpy(data, &port, msg->bufs.buflen[0]);

	data += msg->bufs.buflen[0];
	memcpy(data, &isakmp_cfg_config.pool_size, msg->bufs.buflen[1]);

	data += msg->bufs.buflen[1];
	memcpy(data, raddr, msg->bufs.buflen[2]);

	data += msg->bufs.buflen[2];
	memcpy(data, usr, msg->bufs.buflen[3]);

	data += msg->bufs.buflen[3];
	memcpy(data, pwd, msg->bufs.buflen[4]);

	if (privsep_send(privsep_sock[1], msg, len) != 0)
		return -1;

	if (privsep_recv(privsep_sock[1], &msg, &len) != 0)
		return -1;

	if (msg->hdr.ac_errno != 0) {
		errno = msg->hdr.ac_errno;
		goto out;
	}

	racoon_free(msg);
	return 0;

out:
	racoon_free(msg);
	return -1;
}

void
privsep_cleanup_pam(port)
	int port;
{
	struct privsep_com_msg *msg;
	size_t len;
	char *data;
	int result;

	if (geteuid() == 0)
		return cleanup_pam(port);

	len = sizeof(*msg) 
	    + sizeof(port)
	    + sizeof(isakmp_cfg_config.pool_size);

	if ((msg = racoon_malloc(len)) == NULL) {
		plog(LLV_ERROR, LOCATION, NULL, 
		    "Cannot allocate memory: %s\n", strerror(errno));
		return;
	}
	bzero(msg, len);
	msg->hdr.ac_cmd = PRIVSEP_CLEANUP_PAM;
	msg->hdr.ac_len = len;
	msg->bufs.buflen[0] = sizeof(port);
	msg->bufs.buflen[1] = sizeof(isakmp_cfg_config.pool_size);

	data = (char *)(msg + 1);
	memcpy(data, &port, msg->bufs.buflen[0]);

	data += msg->bufs.buflen[0];
	memcpy(data, &isakmp_cfg_config.pool_size, msg->bufs.buflen[1]);

	if (privsep_send(privsep_sock[1], msg, len) != 0)
		return;

	if (privsep_recv(privsep_sock[1], &msg, &len) != 0)
		return;

	if (msg->hdr.ac_errno != 0)
		errno = msg->hdr.ac_errno;

	racoon_free(msg);
	return;
}
#endif