/* $NetBSD: privsep.c,v 1.6 2006/09/09 16:22:10 manu Exp $ */
|
|
/* Id: privsep.c,v 1.15 2005/08/08 11:23:44 vanhu Exp */
|
|
/*
|
* Copyright (C) 2004 Emmanuel Dreyfus
|
* All rights reserved.
|
*
|
* Redistribution and use in source and binary forms, with or without
|
* modification, are permitted provided that the following conditions
|
* are met:
|
* 1. Redistributions of source code must retain the above copyright
|
* notice, this list of conditions and the following disclaimer.
|
* 2. Redistributions in binary form must reproduce the above copyright
|
* notice, this list of conditions and the following disclaimer in the
|
* documentation and/or other materials provided with the distribution.
|
* 3. Neither the name of the project nor the names of its contributors
|
* may be used to endorse or promote products derived from this software
|
* without specific prior written permission.
|
*
|
* THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
* SUCH DAMAGE.
|
*/
|
|
#include "config.h"
|
|
#include <unistd.h>
|
#include <string.h>
|
#ifdef __NetBSD__
|
#include <stdlib.h> /* for setproctitle */
|
#endif
|
#include <errno.h>
|
#include <signal.h>
|
#include <pwd.h>
|
|
#include <sys/socket.h>
|
#include <sys/param.h>
|
|
#include "gcmalloc.h"
|
#include "vmbuf.h"
|
#include "misc.h"
|
#include "plog.h"
|
#include "var.h"
|
#include "libpfkey.h"
|
|
#include "crypto_openssl.h"
|
#include "isakmp_var.h"
|
#include "isakmp.h"
|
#ifdef ENABLE_HYBRID
|
#include "resolv.h"
|
#include "isakmp_xauth.h"
|
#include "isakmp_cfg.h"
|
#endif
|
#include "localconf.h"
|
#include "remoteconf.h"
|
#include "admin.h"
|
#include "sockmisc.h"
|
#include "privsep.h"
|
|
static int privsep_sock[2] = { -1, -1 };
|
|
static int privsep_recv(int, struct privsep_com_msg **, size_t *);
|
static int privsep_send(int, struct privsep_com_msg *, size_t);
|
static int safety_check(struct privsep_com_msg *, int i);
|
static int port_check(int);
|
static int unsafe_env(char *const *);
|
static int unknown_name(int);
|
static int unsafe_path(char *, int);
|
|
static int
|
privsep_send(sock, buf, len)
|
int sock;
|
struct privsep_com_msg *buf;
|
size_t len;
|
{
|
if (buf == NULL)
|
return 0;
|
|
if (sendto(sock, (char *)buf, len, 0, NULL, 0) == -1) {
|
plog(LLV_ERROR, LOCATION, NULL,
|
"privsep_send failed: %s\n",
|
strerror(errno));
|
return -1;
|
}
|
|
racoon_free((char *)buf);
|
|
return 0;
|
}
|
|
|
static int
|
privsep_recv(sock, bufp, lenp)
|
int sock;
|
struct privsep_com_msg **bufp;
|
size_t *lenp;
|
{
|
struct admin_com com;
|
struct admin_com *combuf;
|
size_t len;
|
|
*bufp = NULL;
|
*lenp = 0;
|
|
/* Get the header */
|
while ((len = recvfrom(sock, (char *)&com,
|
sizeof(com), MSG_PEEK, NULL, NULL)) == -1) {
|
if (errno == EINTR)
|
continue;
|
|
plog(LLV_ERROR, LOCATION, NULL,
|
"privsep_recv failed: %s\n",
|
strerror(errno));
|
return -1;
|
}
|
|
/* Check for short packets */
|
if (len < sizeof(com)) {
|
plog(LLV_ERROR, LOCATION, NULL,
|
"corrupted privsep message (short header)\n");
|
return -1;
|
}
|
|
/* Allocate buffer for the whole message */
|
if ((combuf = (struct admin_com *)racoon_malloc(com.ac_len)) == NULL) {
|
plog(LLV_ERROR, LOCATION, NULL,
|
"failed to allocate memory: %s\n", strerror(errno));
|
return -1;
|
}
|
|
/* Get the whole buffer */
|
while ((len = recvfrom(sock, (char *)combuf,
|
com.ac_len, 0, NULL, NULL)) == -1) {
|
if (errno == EINTR)
|
continue;
|
plog(LLV_ERROR, LOCATION, NULL,
|
"failed to recv privsep command: %s\n",
|
strerror(errno));
|
return -1;
|
}
|
|
/* We expect len to match */
|
if (len != com.ac_len) {
|
plog(LLV_ERROR, LOCATION, NULL,
|
"corrupted privsep message (short packet)\n");
|
return -1;
|
}
|
|
*bufp = (struct privsep_com_msg *)combuf;
|
*lenp = len;
|
|
return 0;
|
}
|
|
int
|
privsep_init(void)
|
{
|
int i;
|
pid_t child_pid;
|
|
/* If running as root, we don't use the privsep code path */
|
if (lcconf->uid == 0)
|
return 0;
|
|
/*
|
* When running privsep, certificate and script paths
|
* are mandatory, as they enable us to check path safety
|
* in the privilegied instance
|
*/
|
if ((lcconf->pathinfo[LC_PATHTYPE_CERT] == NULL) ||
|
(lcconf->pathinfo[LC_PATHTYPE_SCRIPT] == NULL)) {
|
plog(LLV_ERROR, LOCATION, NULL, "privilege separation "
|
"require path cert and path script in the config file\n");
|
return -1;
|
}
|
|
if (socketpair(PF_LOCAL, SOCK_DGRAM, 0, privsep_sock) != 0) {
|
plog(LLV_ERROR, LOCATION, NULL,
|
"Cannot allocate privsep_sock: %s\n", strerror(errno));
|
return -1;
|
}
|
|
switch (child_pid = fork()) {
|
case -1:
|
plog(LLV_ERROR, LOCATION, NULL, "Cannot fork privsep: %s\n",
|
strerror(errno));
|
return -1;
|
break;
|
|
case 0: /* Child: drop privileges */
|
if (lcconf->chroot != NULL) {
|
if (chdir(lcconf->chroot) != 0) {
|
plog(LLV_ERROR, LOCATION, NULL,
|
"Cannot chdir(%s): %s\n", lcconf->chroot,
|
strerror(errno));
|
return -1;
|
}
|
if (chroot(lcconf->chroot) != 0) {
|
plog(LLV_ERROR, LOCATION, NULL,
|
"Cannot chroot(%s): %s\n", lcconf->chroot,
|
strerror(errno));
|
return -1;
|
}
|
}
|
|
if (setgid(lcconf->gid) != 0) {
|
plog(LLV_ERROR, LOCATION, NULL,
|
"Cannot setgid(%d): %s\n", lcconf->gid,
|
strerror(errno));
|
return -1;
|
}
|
|
if (setegid(lcconf->gid) != 0) {
|
plog(LLV_ERROR, LOCATION, NULL,
|
"Cannot setegid(%d): %s\n", lcconf->gid,
|
strerror(errno));
|
return -1;
|
}
|
|
if (setuid(lcconf->uid) != 0) {
|
plog(LLV_ERROR, LOCATION, NULL,
|
"Cannot setuid(%d): %s\n", lcconf->uid,
|
strerror(errno));
|
return -1;
|
}
|
|
if (seteuid(lcconf->uid) != 0) {
|
plog(LLV_ERROR, LOCATION, NULL,
|
"Cannot seteuid(%d): %s\n", lcconf->uid,
|
strerror(errno));
|
return -1;
|
}
|
|
return 0;
|
break;
|
|
default: /* Parent: privilegied process */
|
break;
|
}
|
|
/*
|
* Close everything except the socketpair,
|
* and stdout if running in the forground.
|
*/
|
for (i = sysconf(_SC_OPEN_MAX); i > 0; i--) {
|
if (i == privsep_sock[0])
|
continue;
|
if (i == privsep_sock[1])
|
continue;
|
if ((f_foreground) && (i == 1))
|
continue;
|
(void)close(i);
|
}
|
|
/* Above trickery closed the log file, reopen it */
|
ploginit();
|
|
plog(LLV_INFO, LOCATION, NULL,
|
"racoon privilegied process running with PID %d\n", getpid());
|
|
#ifdef __NetBSD__
|
setproctitle("[priv]");
|
#endif
|
|
/*
|
* Don't catch any signal
|
* This duplicate session:signals[], which is static...
|
*/
|
signal(SIGHUP, SIG_DFL);
|
signal(SIGINT, SIG_DFL);
|
signal(SIGTERM, SIG_DFL);
|
signal(SIGUSR1, SIG_DFL);
|
signal(SIGUSR2, SIG_DFL);
|
signal(SIGCHLD, SIG_DFL);
|
|
while (1) {
|
size_t len;
|
struct privsep_com_msg *combuf;
|
struct privsep_com_msg *reply;
|
char *data;
|
size_t *buflen;
|
size_t totallen;
|
char *bufs[PRIVSEP_NBUF_MAX];
|
int i;
|
|
if (privsep_recv(privsep_sock[0], &combuf, &len) != 0)
|
goto out;
|
|
/* Safety checks and gather the data */
|
if (len < sizeof(*combuf)) {
|
plog(LLV_ERROR, LOCATION, NULL,
|
"corrupted privsep message (short buflen)\n");
|
goto out;
|
}
|
|
data = (char *)(combuf + 1);
|
totallen = sizeof(*combuf);
|
for (i = 0; i < PRIVSEP_NBUF_MAX; i++) {
|
bufs[i] = (char *)data;
|
data += combuf->bufs.buflen[i];
|
totallen += combuf->bufs.buflen[i];
|
}
|
|
if (totallen > len) {
|
plog(LLV_ERROR, LOCATION, NULL,
|
"corrupted privsep message (bufs too big)\n");
|
goto out;
|
}
|
|
/* Prepare the reply buffer */
|
if ((reply = racoon_malloc(sizeof(*reply))) == NULL) {
|
plog(LLV_ERROR, LOCATION, NULL,
|
"Cannot allocate reply buffer: %s\n",
|
strerror(errno));
|
goto out;
|
}
|
bzero(reply, sizeof(*reply));
|
reply->hdr.ac_cmd = combuf->hdr.ac_cmd;
|
reply->hdr.ac_len = sizeof(*reply);
|
|
switch(combuf->hdr.ac_cmd) {
|
/*
|
* XXX Improvement: instead of returning the key,
|
* stuff eay_get_pkcs1privkey and eay_get_x509sign
|
* together and sign the hash in the privilegied
|
* instance?
|
* pro: the key remains inaccessible to unpriv
|
* con: a compromised unpriv racoon can still sign anything
|
*/
|
case PRIVSEP_EAY_GET_PKCS1PRIVKEY: {
|
vchar_t *privkey;
|
|
/* Make sure the string is NULL terminated */
|
if (safety_check(combuf, 0) != 0)
|
break;
|
bufs[0][combuf->bufs.buflen[0] - 1] = '\0';
|
|
if (unsafe_path(bufs[0], LC_PATHTYPE_CERT) != 0) {
|
plog(LLV_ERROR, LOCATION, NULL,
|
"privsep_eay_get_pkcs1privkey: "
|
"unsafe cert \"%s\"\n", bufs[0]);
|
}
|
|
plog(LLV_DEBUG, LOCATION, NULL,
|
"eay_get_pkcs1privkey(\"%s\")\n", bufs[0]);
|
|
if ((privkey = eay_get_pkcs1privkey(bufs[0])) == NULL){
|
reply->hdr.ac_errno = errno;
|
break;
|
}
|
|
reply->bufs.buflen[0] = privkey->l;
|
reply->hdr.ac_len = sizeof(*reply) + privkey->l;
|
reply = racoon_realloc(reply, reply->hdr.ac_len);
|
if (reply == NULL) {
|
plog(LLV_ERROR, LOCATION, NULL,
|
"Cannot allocate reply buffer: %s\n",
|
strerror(errno));
|
goto out;
|
}
|
|
memcpy(reply + 1, privkey->v, privkey->l);
|
vfree(privkey);
|
break;
|
}
|
|
case PRIVSEP_SCRIPT_EXEC: {
|
char *script;
|
int name;
|
char **envp = NULL;
|
int envc = 0;
|
int count = 0;
|
int i;
|
|
/*
|
* First count the bufs, and make sure strings
|
* are NULL terminated.
|
*
|
* We expect: script, name, envp[], void
|
*/
|
if (safety_check(combuf, 0) != 0)
|
break;
|
bufs[0][combuf->bufs.buflen[0] - 1] = '\0';
|
count++; /* script */
|
|
count++; /* name */
|
|
for (; count < PRIVSEP_NBUF_MAX; count++) {
|
if (combuf->bufs.buflen[count] == 0)
|
break;
|
bufs[count]
|
[combuf->bufs.buflen[count] - 1] = '\0';
|
envc++;
|
}
|
|
/* count a void buf and perform safety check */
|
count++;
|
if (count >= PRIVSEP_NBUF_MAX) {
|
plog(LLV_ERROR, LOCATION, NULL,
|
"privsep_script_exec: too many args\n");
|
goto out;
|
}
|
|
|
/*
|
* Allocate the arrays for envp
|
*/
|
envp = racoon_malloc((envc + 1) * sizeof(char *));
|
if (envp == NULL) {
|
plog(LLV_ERROR, LOCATION, NULL,
|
"cannot allocate memory: %s\n",
|
strerror(errno));
|
goto out;
|
}
|
bzero(envp, (envc + 1) * sizeof(char *));
|
|
|
/*
|
* Populate script, name and envp
|
*/
|
count = 0;
|
script = bufs[count++];
|
|
if (combuf->bufs.buflen[count] != sizeof(name)) {
|
plog(LLV_ERROR, LOCATION, NULL,
|
"privsep_script_exec: corrupted message\n");
|
goto out;
|
}
|
memcpy((char *)&name, bufs[count++], sizeof(name));
|
|
for (i = 0; combuf->bufs.buflen[count]; count++)
|
envp[i++] = bufs[count];
|
|
count++; /* void */
|
|
plog(LLV_DEBUG, LOCATION, NULL,
|
"script_exec(\"%s\", %d, %p)\n",
|
script, name, envp);
|
|
/*
|
* Check env for dangerous variables
|
* Check script path and name
|
* Perform fork and execve
|
*/
|
if ((unsafe_env(envp) == 0) &&
|
(unknown_name(name) == 0) &&
|
(unsafe_path(script, LC_PATHTYPE_SCRIPT) == 0))
|
(void)script_exec(script, name, envp);
|
else
|
plog(LLV_ERROR, LOCATION, NULL,
|
"privsep_script_exec: "
|
"unsafe script \"%s\"\n", script);
|
|
racoon_free(envp);
|
break;
|
}
|
|
case PRIVSEP_GETPSK: {
|
vchar_t *psk;
|
int keylen;
|
|
/* Make sure the string is NULL terminated */
|
if (safety_check(combuf, 0) != 0)
|
break;
|
bufs[0][combuf->bufs.buflen[0] - 1] = '\0';
|
|
if (combuf->bufs.buflen[1] != sizeof(keylen)) {
|
plog(LLV_ERROR, LOCATION, NULL,
|
"privsep_getpsk: corrupted message\n");
|
goto out;
|
}
|
memcpy(&keylen, bufs[1], sizeof(keylen));
|
|
plog(LLV_DEBUG, LOCATION, NULL,
|
"getpsk(\"%s\", %d)\n", bufs[0], keylen);
|
|
if ((psk = getpsk(bufs[0], keylen)) == NULL) {
|
reply->hdr.ac_errno = errno;
|
break;
|
}
|
|
reply->bufs.buflen[0] = psk->l;
|
reply->hdr.ac_len = sizeof(*reply) + psk->l;
|
reply = racoon_realloc(reply, reply->hdr.ac_len);
|
if (reply == NULL) {
|
plog(LLV_ERROR, LOCATION, NULL,
|
"Cannot allocate reply buffer: %s\n",
|
strerror(errno));
|
goto out;
|
}
|
|
memcpy(reply + 1, psk->v, psk->l);
|
vfree(psk);
|
break;
|
}
|
|
#ifdef ENABLE_HYBRID
|
case PRIVSEP_ACCOUNTING_SYSTEM: {
|
int pool_size;
|
int port;
|
int inout;
|
struct sockaddr *raddr;
|
|
if (safety_check(combuf, 0) != 0)
|
break;
|
if (safety_check(combuf, 1) != 0)
|
break;
|
if (safety_check(combuf, 2) != 0)
|
break;
|
if (safety_check(combuf, 3) != 0)
|
break;
|
|
memcpy(&port, bufs[0], sizeof(port));
|
raddr = (struct sockaddr *)bufs[1];
|
|
bufs[2][combuf->bufs.buflen[2] - 1] = '\0';
|
memcpy(&inout, bufs[3], sizeof(port));
|
|
if (port_check(port) != 0)
|
break;
|
|
plog(LLV_DEBUG, LOCATION, NULL,
|
"accounting_system(%d, %s, %s)\n",
|
port, saddr2str(raddr), bufs[2]);
|
|
errno = 0;
|
if (isakmp_cfg_accounting_system(port,
|
raddr, bufs[2], inout) != 0) {
|
if (errno == 0)
|
reply->hdr.ac_errno = EINVAL;
|
else
|
reply->hdr.ac_errno = errno;
|
}
|
break;
|
}
|
case PRIVSEP_XAUTH_LOGIN_SYSTEM: {
|
if (safety_check(combuf, 0) != 0)
|
break;
|
bufs[0][combuf->bufs.buflen[0] - 1] = '\0';
|
|
if (safety_check(combuf, 1) != 0)
|
break;
|
bufs[1][combuf->bufs.buflen[1] - 1] = '\0';
|
|
plog(LLV_DEBUG, LOCATION, NULL,
|
"xauth_login_system(\"%s\", <password>)\n",
|
bufs[0]);
|
|
errno = 0;
|
if (xauth_login_system(bufs[0], bufs[1]) != 0) {
|
if (errno == 0)
|
reply->hdr.ac_errno = EINVAL;
|
else
|
reply->hdr.ac_errno = errno;
|
}
|
break;
|
}
|
#ifdef HAVE_LIBPAM
|
case PRIVSEP_ACCOUNTING_PAM: {
|
int port;
|
int inout;
|
int pool_size;
|
|
if (safety_check(combuf, 0) != 0)
|
break;
|
if (safety_check(combuf, 1) != 0)
|
break;
|
if (safety_check(combuf, 2) != 0)
|
break;
|
|
memcpy(&port, bufs[0], sizeof(port));
|
memcpy(&inout, bufs[1], sizeof(inout));
|
memcpy(&pool_size, bufs[2], sizeof(pool_size));
|
|
if (pool_size != isakmp_cfg_config.pool_size)
|
if (isakmp_cfg_resize_pool(pool_size) != 0)
|
break;
|
|
if (port_check(port) != 0)
|
break;
|
|
plog(LLV_DEBUG, LOCATION, NULL,
|
"isakmp_cfg_accounting_pam(%d, %d)\n",
|
port, inout);
|
|
errno = 0;
|
if (isakmp_cfg_accounting_pam(port, inout) != 0) {
|
if (errno == 0)
|
reply->hdr.ac_errno = EINVAL;
|
else
|
reply->hdr.ac_errno = errno;
|
}
|
break;
|
}
|
|
case PRIVSEP_XAUTH_LOGIN_PAM: {
|
int port;
|
int pool_size;
|
struct sockaddr *raddr;
|
|
if (safety_check(combuf, 0) != 0)
|
break;
|
if (safety_check(combuf, 1) != 0)
|
break;
|
if (safety_check(combuf, 2) != 0)
|
break;
|
if (safety_check(combuf, 3) != 0)
|
break;
|
if (safety_check(combuf, 4) != 0)
|
break;
|
|
memcpy(&port, bufs[0], sizeof(port));
|
memcpy(&pool_size, bufs[1], sizeof(pool_size));
|
raddr = (struct sockaddr *)bufs[2];
|
|
bufs[3][combuf->bufs.buflen[3] - 1] = '\0';
|
bufs[4][combuf->bufs.buflen[4] - 1] = '\0';
|
|
if (pool_size != isakmp_cfg_config.pool_size)
|
if (isakmp_cfg_resize_pool(pool_size) != 0)
|
break;
|
|
if (port_check(port) != 0)
|
break;
|
|
plog(LLV_DEBUG, LOCATION, NULL,
|
"xauth_login_pam(%d, %s, \"%s\", <password>)\n",
|
port, saddr2str(raddr), bufs[3]);
|
|
errno = 0;
|
if (xauth_login_pam(port,
|
raddr, bufs[3], bufs[4]) != 0) {
|
if (errno == 0)
|
reply->hdr.ac_errno = EINVAL;
|
else
|
reply->hdr.ac_errno = errno;
|
}
|
break;
|
}
|
|
case PRIVSEP_CLEANUP_PAM: {
|
int port;
|
int pool_size;
|
|
if (safety_check(combuf, 0) != 0)
|
break;
|
if (safety_check(combuf, 1) != 0)
|
break;
|
|
memcpy(&port, bufs[0], sizeof(port));
|
memcpy(&pool_size, bufs[1], sizeof(pool_size));
|
|
if (pool_size != isakmp_cfg_config.pool_size)
|
if (isakmp_cfg_resize_pool(pool_size) != 0)
|
break;
|
|
if (port_check(port) != 0)
|
break;
|
|
plog(LLV_DEBUG, LOCATION, NULL,
|
"cleanup_pam(%d)\n", port);
|
|
cleanup_pam(port);
|
reply->hdr.ac_errno = 0;
|
|
break;
|
}
|
#endif /* HAVE_LIBPAM */
|
#endif /* ENABLE_HYBRID */
|
|
default:
|
plog(LLV_ERROR, LOCATION, NULL,
|
"unexpected privsep command %d\n",
|
combuf->hdr.ac_cmd);
|
goto out;
|
break;
|
}
|
|
/* This frees reply */
|
if (privsep_send(privsep_sock[0],
|
reply, reply->hdr.ac_len) != 0)
|
goto out;
|
|
racoon_free(combuf);
|
}
|
|
out:
|
plog(LLV_INFO, LOCATION, NULL, "privsep exit\n");
|
_exit(0);
|
}
|
|
|
vchar_t *
|
privsep_eay_get_pkcs1privkey(path)
|
char *path;
|
{
|
vchar_t *privkey;
|
struct privsep_com_msg *msg;
|
size_t len;
|
|
if (geteuid() == 0)
|
return eay_get_pkcs1privkey(path);
|
|
len = sizeof(*msg) + strlen(path) + 1;
|
if ((msg = racoon_malloc(len)) == NULL) {
|
plog(LLV_ERROR, LOCATION, NULL,
|
"Cannot allocate memory: %s\n", strerror(errno));
|
return NULL;
|
}
|
bzero(msg, len);
|
msg->hdr.ac_cmd = PRIVSEP_EAY_GET_PKCS1PRIVKEY;
|
msg->hdr.ac_len = len;
|
msg->bufs.buflen[0] = len - sizeof(*msg);
|
memcpy(msg + 1, path, msg->bufs.buflen[0]);
|
|
if (privsep_send(privsep_sock[1], msg, len) != 0)
|
return NULL;
|
|
if (privsep_recv(privsep_sock[1], &msg, &len) != 0)
|
return NULL;
|
|
if (msg->hdr.ac_errno != 0) {
|
errno = msg->hdr.ac_errno;
|
goto out;
|
}
|
|
if ((privkey = vmalloc(len - sizeof(*msg))) == NULL)
|
goto out;
|
|
memcpy(privkey->v, msg + 1, privkey->l);
|
racoon_free(msg);
|
return privkey;
|
|
out:
|
racoon_free(msg);
|
return NULL;
|
}
|
|
/*
|
* No prigilege separation trick here, we just open PFKEY before
|
* dropping root privs and we remember it later.
|
*/
|
static int pfkey_socket = -1;
|
int
|
privsep_pfkey_open(void)
|
{
|
int ps;
|
|
if (pfkey_socket != -1)
|
return pfkey_socket;
|
|
ps = pfkey_open();
|
if (ps != -1)
|
pfkey_socket = ps;
|
|
return ps;
|
}
|
|
/*
|
* Consequence of the above trickery: don't
|
* really close PFKEY as we never re-open it.
|
*/
|
void
|
privsep_pfkey_close(ps)
|
int ps;
|
{
|
return;
|
}
|
|
int
|
privsep_script_exec(script, name, envp)
|
char *script;
|
int name;
|
char *const envp[];
|
{
|
int count = 0;
|
char *const *c;
|
char *data;
|
size_t len;
|
struct privsep_com_msg *msg;
|
|
if (geteuid() == 0)
|
return script_exec(script, name, envp);
|
|
if ((msg = racoon_malloc(sizeof(*msg))) == NULL) {
|
plog(LLV_ERROR, LOCATION, NULL,
|
"Cannot allocate memory: %s\n", strerror(errno));
|
return -1;
|
}
|
|
bzero(msg, sizeof(*msg));
|
msg->hdr.ac_cmd = PRIVSEP_SCRIPT_EXEC;
|
msg->hdr.ac_len = sizeof(*msg);
|
|
/*
|
* We send:
|
* script, name, envp[0], ... envp[N], void
|
*/
|
|
/*
|
* Safety check on the counts: PRIVSEP_NBUF_MAX max
|
*/
|
count = 0;
|
count++; /* script */
|
count++; /* name */
|
for (c = envp; *c; c++) /* envp */
|
count++;
|
count++; /* void */
|
|
if (count > PRIVSEP_NBUF_MAX) {
|
plog(LLV_ERROR, LOCATION, NULL, "Unexpected error: "
|
"privsep_script_exec count > PRIVSEP_NBUF_MAX\n");
|
racoon_free(msg);
|
return -1;
|
}
|
|
|
/*
|
* Compute the length
|
*/
|
count = 0;
|
msg->bufs.buflen[count] = strlen(script) + 1; /* script */
|
msg->hdr.ac_len += msg->bufs.buflen[count++];
|
|
msg->bufs.buflen[count] = sizeof(name); /* name */
|
msg->hdr.ac_len += msg->bufs.buflen[count++];
|
|
for (c = envp; *c; c++) { /* envp */
|
msg->bufs.buflen[count] = strlen(*c) + 1;
|
msg->hdr.ac_len += msg->bufs.buflen[count++];
|
}
|
|
msg->bufs.buflen[count] = 0; /* void */
|
msg->hdr.ac_len += msg->bufs.buflen[count++];
|
|
if ((msg = racoon_realloc(msg, msg->hdr.ac_len)) == NULL) {
|
plog(LLV_ERROR, LOCATION, NULL,
|
"Cannot allocate memory: %s\n", strerror(errno));
|
return -1;
|
}
|
|
/*
|
* Now copy the data
|
*/
|
data = (char *)(msg + 1);
|
count = 0;
|
|
memcpy(data, (char *)script, msg->bufs.buflen[count]); /* script */
|
data += msg->bufs.buflen[count++];
|
|
memcpy(data, (char *)&name, msg->bufs.buflen[count]); /* name */
|
data += msg->bufs.buflen[count++];
|
|
for (c = envp; *c; c++) { /* envp */
|
memcpy(data, *c, msg->bufs.buflen[count]);
|
data += msg->bufs.buflen[count++];
|
}
|
|
count++; /* void */
|
|
/*
|
* And send it!
|
*/
|
if (privsep_send(privsep_sock[1], msg, msg->hdr.ac_len) != 0)
|
return -1;
|
|
if (privsep_recv(privsep_sock[1], &msg, &len) != 0)
|
return -1;
|
|
if (msg->hdr.ac_errno != 0) {
|
errno = msg->hdr.ac_errno;
|
racoon_free(msg);
|
return -1;
|
}
|
|
racoon_free(msg);
|
return 0;
|
}
|
|
vchar_t *
|
privsep_getpsk(str, keylen)
|
const char *str;
|
int keylen;
|
{
|
vchar_t *psk;
|
struct privsep_com_msg *msg;
|
size_t len;
|
int *keylenp;
|
char *data;
|
|
if (geteuid() == 0)
|
return getpsk(str, keylen);
|
|
len = sizeof(*msg) + strlen(str) + 1 + sizeof(keylen);
|
if ((msg = racoon_malloc(len)) == NULL) {
|
plog(LLV_ERROR, LOCATION, NULL,
|
"Cannot allocate memory: %s\n", strerror(errno));
|
return NULL;
|
}
|
bzero(msg, len);
|
msg->hdr.ac_cmd = PRIVSEP_GETPSK;
|
msg->hdr.ac_len = len;
|
|
data = (char *)(msg + 1);
|
msg->bufs.buflen[0] = strlen(str) + 1;
|
memcpy(data, str, msg->bufs.buflen[0]);
|
|
data += msg->bufs.buflen[0];
|
msg->bufs.buflen[1] = sizeof(keylen);
|
memcpy(data, &keylen, sizeof(keylen));
|
|
if (privsep_send(privsep_sock[1], msg, len) != 0)
|
return NULL;
|
|
if (privsep_recv(privsep_sock[1], &msg, &len) != 0)
|
return NULL;
|
|
if (msg->hdr.ac_errno != 0) {
|
errno = msg->hdr.ac_errno;
|
goto out;
|
}
|
|
if ((psk = vmalloc(len - sizeof(*msg))) == NULL)
|
goto out;
|
|
memcpy(psk->v, msg + 1, psk->l);
|
racoon_free(msg);
|
return psk;
|
|
out:
|
racoon_free(msg);
|
return NULL;
|
}
|
|
#ifdef ENABLE_HYBRID
|
int
|
privsep_xauth_login_system(usr, pwd)
|
char *usr;
|
char *pwd;
|
{
|
struct privsep_com_msg *msg;
|
size_t len;
|
char *data;
|
|
if (geteuid() == 0)
|
return xauth_login_system(usr, pwd);
|
|
len = sizeof(*msg) + strlen(usr) + 1 + strlen(pwd) + 1;
|
if ((msg = racoon_malloc(len)) == NULL) {
|
plog(LLV_ERROR, LOCATION, NULL,
|
"Cannot allocate memory: %s\n", strerror(errno));
|
return -1;
|
}
|
bzero(msg, len);
|
msg->hdr.ac_cmd = PRIVSEP_XAUTH_LOGIN_SYSTEM;
|
msg->hdr.ac_len = len;
|
|
data = (char *)(msg + 1);
|
msg->bufs.buflen[0] = strlen(usr) + 1;
|
memcpy(data, usr, msg->bufs.buflen[0]);
|
data += msg->bufs.buflen[0];
|
|
msg->bufs.buflen[1] = strlen(pwd) + 1;
|
memcpy(data, pwd, msg->bufs.buflen[1]);
|
|
if (privsep_send(privsep_sock[1], msg, len) != 0)
|
return -1;
|
|
if (privsep_recv(privsep_sock[1], &msg, &len) != 0)
|
return -1;
|
|
if (msg->hdr.ac_errno != 0) {
|
racoon_free(msg);
|
return -1;
|
}
|
|
racoon_free(msg);
|
return 0;
|
}
|
|
int
|
privsep_accounting_system(port, raddr, usr, inout)
|
int port;
|
struct sockaddr *raddr;
|
char *usr;
|
int inout;
|
{
|
struct privsep_com_msg *msg;
|
size_t len;
|
char *data;
|
int result;
|
|
if (geteuid() == 0)
|
return isakmp_cfg_accounting_system(port, raddr,
|
usr, inout);
|
|
len = sizeof(*msg)
|
+ sizeof(port)
|
+ sysdep_sa_len(raddr)
|
+ strlen(usr) + 1
|
+ sizeof(inout);
|
|
if ((msg = racoon_malloc(len)) == NULL) {
|
plog(LLV_ERROR, LOCATION, NULL,
|
"Cannot allocate memory: %s\n", strerror(errno));
|
return -1;
|
}
|
bzero(msg, len);
|
msg->hdr.ac_cmd = PRIVSEP_ACCOUNTING_SYSTEM;
|
msg->hdr.ac_len = len;
|
msg->bufs.buflen[0] = sizeof(port);
|
msg->bufs.buflen[1] = sysdep_sa_len(raddr);
|
msg->bufs.buflen[2] = strlen(usr) + 1;
|
msg->bufs.buflen[3] = sizeof(inout);
|
|
data = (char *)(msg + 1);
|
memcpy(data, &port, msg->bufs.buflen[0]);
|
|
data += msg->bufs.buflen[0];
|
memcpy(data, raddr, msg->bufs.buflen[1]);
|
|
data += msg->bufs.buflen[1];
|
memcpy(data, usr, msg->bufs.buflen[2]);
|
|
data += msg->bufs.buflen[2];
|
memcpy(data, &inout, msg->bufs.buflen[3]);
|
|
if (privsep_send(privsep_sock[1], msg, len) != 0)
|
return -1;
|
|
if (privsep_recv(privsep_sock[1], &msg, &len) != 0)
|
return -1;
|
|
if (msg->hdr.ac_errno != 0) {
|
errno = msg->hdr.ac_errno;
|
goto out;
|
}
|
|
racoon_free(msg);
|
return 0;
|
|
out:
|
racoon_free(msg);
|
return -1;
|
}
|
|
static int
|
port_check(port)
|
int port;
|
{
|
if ((port < 0) || (port >= isakmp_cfg_config.pool_size)) {
|
plog(LLV_ERROR, LOCATION, NULL,
|
"privsep: port %d outside of allowed range [0,%zu]\n",
|
port, isakmp_cfg_config.pool_size - 1);
|
return -1;
|
}
|
|
return 0;
|
}
|
#endif
|
|
static int
|
safety_check(msg, index)
|
struct privsep_com_msg *msg;
|
int index;
|
{
|
if (index >= PRIVSEP_NBUF_MAX) {
|
plog(LLV_ERROR, LOCATION, NULL,
|
"privsep: Corrupted message, too many buffers\n");
|
return -1;
|
}
|
|
if (msg->bufs.buflen[index] == 0) {
|
plog(LLV_ERROR, LOCATION, NULL,
|
"privsep: Corrupted message, unexpected void buffer\n");
|
return -1;
|
}
|
|
return 0;
|
}
|
|
/*
|
* Filter unsafe environement variables
|
*/
|
static int
|
unsafe_env(envp)
|
char *const *envp;
|
{
|
char *const *e;
|
char *const *be;
|
char *const bad_env[] = { "PATH=", "LD_LIBRARY_PATH=", "IFS=", NULL };
|
|
for (e = envp; *e; e++) {
|
for (be = bad_env; *be; be++) {
|
if (strncmp(*e, *be, strlen(*be)) == 0) {
|
goto found;
|
}
|
}
|
}
|
|
return 0;
|
found:
|
plog(LLV_ERROR, LOCATION, NULL,
|
"privsep_script_exec: unsafe environement variable\n");
|
return -1;
|
}
|
|
/*
|
* Check path safety
|
*/
|
static int
|
unsafe_path(script, pathtype)
|
char *script;
|
int pathtype;
|
{
|
char *path;
|
char rpath[MAXPATHLEN + 1];
|
size_t len;
|
|
if (script == NULL)
|
return -1;
|
|
path = lcconf->pathinfo[pathtype];
|
|
/* No path was given for scripts: skip the check */
|
if (path == NULL)
|
return 0;
|
|
if (realpath(script, rpath) == NULL) {
|
plog(LLV_ERROR, LOCATION, NULL,
|
"script path \"%s\" is invalid\n", script);
|
return -1;
|
}
|
|
len = strlen(path);
|
if (strncmp(path, rpath, len) != 0)
|
return -1;
|
|
return 0;
|
}
|
|
static int
|
unknown_name(name)
|
int name;
|
{
|
if ((name < 0) || (name > SCRIPT_MAX)) {
|
plog(LLV_ERROR, LOCATION, NULL,
|
"privsep_script_exec: unsafe name index\n");
|
return -1;
|
}
|
|
return 0;
|
}
|
|
#ifdef HAVE_LIBPAM
|
int
|
privsep_accounting_pam(port, inout)
|
int port;
|
int inout;
|
{
|
struct privsep_com_msg *msg;
|
size_t len;
|
int *port_data;
|
int *inout_data;
|
int *pool_size_data;
|
int result;
|
|
if (geteuid() == 0)
|
return isakmp_cfg_accounting_pam(port, inout);
|
|
len = sizeof(*msg)
|
+ sizeof(port)
|
+ sizeof(inout)
|
+ sizeof(isakmp_cfg_config.pool_size);
|
|
if ((msg = racoon_malloc(len)) == NULL) {
|
plog(LLV_ERROR, LOCATION, NULL,
|
"Cannot allocate memory: %s\n", strerror(errno));
|
return -1;
|
}
|
bzero(msg, len);
|
msg->hdr.ac_cmd = PRIVSEP_ACCOUNTING_PAM;
|
msg->hdr.ac_len = len;
|
msg->bufs.buflen[0] = sizeof(port);
|
msg->bufs.buflen[1] = sizeof(inout);
|
msg->bufs.buflen[2] = sizeof(isakmp_cfg_config.pool_size);
|
|
port_data = (int *)(msg + 1);
|
inout_data = (int *)(port_data + 1);
|
pool_size_data = (int *)(inout_data + 1);
|
|
*port_data = port;
|
*inout_data = inout;
|
*pool_size_data = isakmp_cfg_config.pool_size;
|
|
if (privsep_send(privsep_sock[1], msg, len) != 0)
|
return -1;
|
|
if (privsep_recv(privsep_sock[1], &msg, &len) != 0)
|
return -1;
|
|
if (msg->hdr.ac_errno != 0) {
|
errno = msg->hdr.ac_errno;
|
goto out;
|
}
|
|
racoon_free(msg);
|
return 0;
|
|
out:
|
racoon_free(msg);
|
return -1;
|
}
|
|
int
|
privsep_xauth_login_pam(port, raddr, usr, pwd)
|
int port;
|
struct sockaddr *raddr;
|
char *usr;
|
char *pwd;
|
{
|
struct privsep_com_msg *msg;
|
size_t len;
|
char *data;
|
int result;
|
|
if (geteuid() == 0)
|
return xauth_login_pam(port, raddr, usr, pwd);
|
|
len = sizeof(*msg)
|
+ sizeof(port)
|
+ sizeof(isakmp_cfg_config.pool_size)
|
+ sysdep_sa_len(raddr)
|
+ strlen(usr) + 1
|
+ strlen(pwd) + 1;
|
|
if ((msg = racoon_malloc(len)) == NULL) {
|
plog(LLV_ERROR, LOCATION, NULL,
|
"Cannot allocate memory: %s\n", strerror(errno));
|
return -1;
|
}
|
bzero(msg, len);
|
msg->hdr.ac_cmd = PRIVSEP_XAUTH_LOGIN_PAM;
|
msg->hdr.ac_len = len;
|
msg->bufs.buflen[0] = sizeof(port);
|
msg->bufs.buflen[1] = sizeof(isakmp_cfg_config.pool_size);
|
msg->bufs.buflen[2] = sysdep_sa_len(raddr);
|
msg->bufs.buflen[3] = strlen(usr) + 1;
|
msg->bufs.buflen[4] = strlen(pwd) + 1;
|
|
data = (char *)(msg + 1);
|
memcpy(data, &port, msg->bufs.buflen[0]);
|
|
data += msg->bufs.buflen[0];
|
memcpy(data, &isakmp_cfg_config.pool_size, msg->bufs.buflen[1]);
|
|
data += msg->bufs.buflen[1];
|
memcpy(data, raddr, msg->bufs.buflen[2]);
|
|
data += msg->bufs.buflen[2];
|
memcpy(data, usr, msg->bufs.buflen[3]);
|
|
data += msg->bufs.buflen[3];
|
memcpy(data, pwd, msg->bufs.buflen[4]);
|
|
if (privsep_send(privsep_sock[1], msg, len) != 0)
|
return -1;
|
|
if (privsep_recv(privsep_sock[1], &msg, &len) != 0)
|
return -1;
|
|
if (msg->hdr.ac_errno != 0) {
|
errno = msg->hdr.ac_errno;
|
goto out;
|
}
|
|
racoon_free(msg);
|
return 0;
|
|
out:
|
racoon_free(msg);
|
return -1;
|
}
|
|
void
|
privsep_cleanup_pam(port)
|
int port;
|
{
|
struct privsep_com_msg *msg;
|
size_t len;
|
char *data;
|
int result;
|
|
if (geteuid() == 0)
|
return cleanup_pam(port);
|
|
len = sizeof(*msg)
|
+ sizeof(port)
|
+ sizeof(isakmp_cfg_config.pool_size);
|
|
if ((msg = racoon_malloc(len)) == NULL) {
|
plog(LLV_ERROR, LOCATION, NULL,
|
"Cannot allocate memory: %s\n", strerror(errno));
|
return;
|
}
|
bzero(msg, len);
|
msg->hdr.ac_cmd = PRIVSEP_CLEANUP_PAM;
|
msg->hdr.ac_len = len;
|
msg->bufs.buflen[0] = sizeof(port);
|
msg->bufs.buflen[1] = sizeof(isakmp_cfg_config.pool_size);
|
|
data = (char *)(msg + 1);
|
memcpy(data, &port, msg->bufs.buflen[0]);
|
|
data += msg->bufs.buflen[0];
|
memcpy(data, &isakmp_cfg_config.pool_size, msg->bufs.buflen[1]);
|
|
if (privsep_send(privsep_sock[1], msg, len) != 0)
|
return;
|
|
if (privsep_recv(privsep_sock[1], &msg, &len) != 0)
|
return;
|
|
if (msg->hdr.ac_errno != 0)
|
errno = msg->hdr.ac_errno;
|
|
racoon_free(msg);
|
return;
|
}
|
#endif
|
