/*        $Id: main.c,v 1.45 2019/03/09 18:07:40 benno Exp $ */
/*
 * Copyright (c) 2016 Kristaps Dzonsons <kristaps@bsd.lv>
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHORS DISCLAIM ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */

#ifdef __VMS
#include "wcme_config.h"
#endif

#include <sys/socket.h>

#include <ctype.h>
#include <err.h>
#include <libgen.h>
#include <stdarg.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

#include "extern.h"

#ifndef WCME_IDIOM
#include "parse.h"

#define WWW_DIR "/var/www/acme"
#define CONF_FILE "/etc/acme-client.conf"

#else /* WCME_IDIOM */

#define SS$_NORMAL 1
#define SS$_NOPRIV 36
#define SS$_ABORT 44
#define SS$_BUGCHECK 676
#define SS$_OPINCOMPL 724

char* CertManAuthorityApi ();
char* doasprintf (char*, ...);
char* UtilOds2FileName (char*, char*, char*);

#endif /* WCME_IDIOM */

int
main(int argc, char *argv[])
{
        const char         **alts = NULL;
        char                 *certdir = NULL, *certfile = NULL;
        char                 *chainfile = NULL, *fullchainfile = NULL;
        char                 *acctkey = NULL;
        char                 *chngdir = NULL, *auth = NULL;
        char                 *conffile = CONF_FILE;
        char                 *tmps, *tmpsd;
        int                  key_fds[2], acct_fds[2], chng_fds[2], cert_fds[2];
        int                  file_fds[2], dns_fds[2], rvk_fds[2];
        int                  force = 0;
        int                  c, rc, revocate = 0;
        int                  popts = 0;
        pid_t                  pids[COMP__MAX];
        extern int          verbose;
        extern enum comp  proccomp;
        size_t                  i, altsz, ne;

        struct acme_conf        *conf = NULL;
        struct authority_c        *authority = NULL;
        struct domain_c                *domain = NULL;
        struct altname_c        *ac;

#ifdef WCME_IDIOM

        /********/
        /* WCME */
        /********/

/*
        /API=<url>        non-default URL of CA (e.g. Let's Encrypt)
        /CERTIFY=<list>   certify the domain name and optional alt names
        /CHECK=<keyword>  test the specified facility
        /FORCE            force update of certificate 
        /LIST             list the certificates being managed
        /MANAGE           run the once-per-day certificate management
        /NAMES=<list>     (internal use) domain name then comma/space alt names
        /PROCESS=<string> (internal use) name/purpose of subprocess
        /REGISTER         generate new account & domain keys and register
        /REVOKE           revoke the certificate
        /VERBOSE          be a bit chattier
        /VERSION          display software version
        /WCME=<string>    for backward compatibility with version 1
*/
        int  cnt,
             nargc = 0,
             newacct = 0,
             newdkey = 0,
             pnargc = 0;
        char  *cptr, *sptr, *zptr,
              *keyfile = NULL;
        char  api [256] = "",
              certman [1024] = "",
              names [1024] = "",
              process [16] = "";
        char  *nargv [16];
	struct authority_c  authc;

        /* always be a bit chatty */
        verbose = 1;

#ifdef WCME_DBG_MAIN
        doddbg("main() %d |%s|%s|%s|", argc, argv[0], argv[1], argv[2]);
#endif

        /* ensure SYSPRV starts disabled and is only enabled as required */
        UtilMereMortal();

        if (!UtilInteractive())
        {
           /* not designed to operate in CGIplus environment */
           if (getenv ("CGIPLUSEOF") != NULL) exit (SS$_ABORT);

           if ((getenv("WWW_SERVER_SOFTWARE") != NULL &&
                getenv("WWW_REQUEST_METHOD") != NULL) ||
               (getenv("SERVER_SOFTWARE") != NULL &&
                getenv("REQUEST_METHOD") != NULL))
           {
              ScriptProcess (argc, argv);
              /* shouldn't */
              exit (SS$_BUGCHECK);
           }

           if (argc > 1 && !strncasecmp(argv[1],"/OVERSEER",5))
           {
              OverseerProcess (argc, argv);
              /* shouldn't */
              exit (SS$_BUGCHECK);
           }

           /* each subprocess needs an independent C-RTL I/O buffer */
           if (cptr = getenv ("WCME_LOG_FILE"))
              OverseerSubprocessLog (cptr);
        }

        /* interactive user must possess SYSPRV */
        if (!UtilHaveSysPrv()) exit (SS$_NOPRIV);

        /* /wcme=.. activates various actions at the command-line */
        if (argc > 1)
        {
           if (!strncasecmp(argv[1],"/VERSION",5))
           {
              DisplayVersion ();
              exit (SS$_NORMAL);
           }
        }

        /* defined in wcme_config.h */
        certdir = SSL_DIR;
        chngdir = WWW_DIR;
        acctkey = ACCT_KEY;
        keyfile = PRIV_KEY;

        /* /api=.. may override this default */
        authority = &authc;
        authority->api = CertManAuthorityApi();

        /* build our own argument list (first is the image name) */
        nargv[nargc++] = argv[0];
        for (cnt = 1; cnt < argc; cnt++)
        {
           if (!strncasecmp(argv[cnt],"/API=",4))
           {
              for (cptr = argv[cnt]; *cptr && *cptr != '='; cptr++);
              if (*cptr) cptr++;
              if (*cptr == '\"') cptr++;
              zptr = (sptr = api) + sizeof(api)-1;
              while (*cptr && sptr < zptr) *sptr++ = *cptr++;
              if (*(sptr-1) == '\"') sptr--;
              *sptr = '\0';
              if (api[0]) authority->api = api;
           }
           else
           if (!strncasecmp(argv[cnt],"/CERTIFY=",7))
           {
              /* include the "certify=" string for CertManCLI() */
              cptr = argv[cnt] + 1;
              zptr = (sptr = certman) + sizeof(certman)-32;
              while (*cptr && sptr < zptr) *sptr++ = *cptr++;
              *sptr = '\0';
           }
           else
           if (!strncasecmp(argv[cnt],"/CHECK=",7))
           {
              /* include the "check=" string for CertManCLI() */
              cptr = argv[cnt] + 1;
              zptr = (sptr = certman) + sizeof(certman)-32;
              while (*cptr && sptr < zptr) *sptr++ = *cptr++;
              *sptr = '\0';
           }
           else
           if (!strncasecmp(argv[cnt],"/FORCE",4))
              force = 1;
           else
           if (!strncasecmp(argv[cnt],"/LIST",4))
              strcpy (certman, "list");
           else
           if (!strncasecmp(argv[cnt],"/MANAGE",4))
              strcpy (certman, "manage");
           else
           if (!strncasecmp(argv[cnt],"/NAMES=",4))
           {
              for (cptr = argv[cnt]; *cptr && *cptr != '='; cptr++);
              if (*cptr) cptr++;
              if (*cptr == '\"') cptr++;
              zptr = (sptr = names) + sizeof(names)-1;
              while (*cptr && sptr < zptr) *sptr++ = *cptr++;
              if (*(sptr-1) == '\"') sptr--;
              *sptr = '\0';
           }
           else
           if (!strncasecmp(argv[cnt],"/PROCESS=",4))
           {
              pnargc = nargc;
              for (cptr = argv[cnt]; *cptr && *cptr != '='; cptr++);
              if (*cptr) cptr++;
              if (*cptr == '\"') cptr++;
              zptr = (sptr = process) + sizeof(process)-1;
              while (*cptr && sptr < zptr) *sptr++ = *cptr++;
              if (*(sptr-1) == '\"') sptr--;
              *sptr = '\0';
           }
           else
           if (!strncasecmp(argv[cnt],"/REGISTER",4))
              newacct = newdkey = 1;
           else
           if (!strncasecmp(argv[cnt],"/REVOKE",4))
              revocate = 1;
           else
           if (!strncasecmp(argv[cnt],"/VERBOSE",4))
              verbose = 2;
           else
           if (!strncasecmp(argv[cnt],"/WCME=",6))
           {
              cptr = argv[cnt] + 6;
              zptr = (sptr = certman) + sizeof(certman)-32;
              while (*cptr && sptr < zptr) *sptr++ = *cptr++;
              *sptr = '\0';
           }
           nargv[nargc++] = argv[cnt];
        }

        if (certman[0])
        {
#ifdef WCME_DBG_MAIN
           doddbg("certman |%s|", certman);
#endif
           if (force) strcat (certman, " /force");
           if (revocate) strcat (certman, " /revoke");
           CertManCli (certman);
           /* shouldn't */
           exit (SS$_BUGCHECK);
        }

        if (!pnargc)
        {
           /* no process name, allocate space for one */
           pnargc = nargc++;
           nargv[pnargc] = "/process=";
        }
        /* ensure there is space for furk() to copy in the process name */
        cptr = calloc (1, strlen(nargv[pnargc])+16);
        strcpy (cptr, nargv[pnargc]);
        nargv[pnargc] = cptr;

        if (nargc > 15) errx (EXIT_FAILURE, "exceeded nargc");
        /* terminate our argument list */
        nargv[nargc] = NULL;

#ifdef WCME_DBG_MAIN
        for (cnt = 0; cnt < nargc; cnt++)
           dodbg("nargv[%d] |%s|", cnt, nargv[cnt]);
#endif

        if (!UtilSetPrn (process))
        {
           c = 0;
           goto out;
        };

        /* establish the base number of the IPC socket sequence */
        cnt = pairofsockets (NULL);
        acct_fds[0] = cnt++;
        acct_fds[1] = cnt++;
        cert_fds[0] = cnt++;
        cert_fds[1] = cnt++;
        chng_fds[0] = cnt++;
        chng_fds[1] = cnt++;
        dns_fds[0] = cnt++;
        dns_fds[1] = cnt++;
        file_fds[0] = cnt++;
        file_fds[1] = cnt++;
        key_fds[0] = cnt++;
        key_fds[1] = cnt++;
        rvk_fds[0] = cnt++;
        rvk_fds[1] = cnt++;

        /* parse out each of the names to be certified */
        altsz = 0;
	alts = calloc (128, sizeof(char*));
        for (cptr = names; *cptr; *cptr++ = '\0')
        {
           while (*cptr && (isspace(*cptr) || *cptr == ',')) cptr++;
           if (!*cptr) break;
           alts[altsz++] = cptr;
           if (altsz > 127) errx (EXIT_FAILURE, "exceeded altsz");
           while (*cptr && !(isspace(*cptr) || *cptr == ',')) cptr++;
        }

#ifdef WCME_DBG_MAIN
        for (cnt = 0; cnt < altsz; cnt++)
           dodbg("alts[%d] |%s|", cnt, alts[cnt]);
#endif

        /* without a domain we're just querying the CA */
        if (altsz)
        {
           /* first site (host name) becomes the domain */
           char  tmp [256];
           sprintf (tmp, "cert_%s", (char*)alts[0]);
           certfile = UtilOds2FileName (NULL, tmp, ".pem");
           sprintf (tmp, "chain_%s", (char*)alts[0]);
           chainfile = UtilOds2FileName (NULL, tmp, ".pem");
           sprintf (tmp, "fullchain_%s", (char*)alts[0]);
           fullchainfile = UtilOds2FileName (NULL, tmp, ".pem");
        }

        /****************/
        /* subprocesses */
        /****************/

        if (!strcmp (process, "netproc"))
        {
           proccomp = COMP_NET;
           close (key_fds[0]);
           close (acct_fds[0]);
           close (chng_fds[0]);
           close (cert_fds[0]);
           close (file_fds[0]);
           close (file_fds[1]);
           close (dns_fds[0]);
           close (rvk_fds[0]);
           c = netproc (key_fds[1], acct_fds[1],
                        chng_fds[1], cert_fds[1],
                        dns_fds[1], rvk_fds[1],
		        newacct, revocate, authority,
		        (const char *const *)alts, altsz);
           goto out;
        }

        if (!strcmp (process, "keyproc"))
        {
           proccomp = COMP_KEY;
           close (cert_fds[0]);
           close (dns_fds[0]);
           close (rvk_fds[0]);
           close (acct_fds[0]);
           close (chng_fds[0]);
           close (file_fds[0]);
           close (file_fds[1]);
           c = keyproc (key_fds[0], keyfile,
                        (const char **)alts, altsz, newdkey);
           goto out;
        }

        if (!strcmp (process, "acctproc"))
        {
           if (!altsz && !newacct) acctkey = NULL;
           proccomp = COMP_ACCOUNT;
           close (cert_fds[0]);
           close (dns_fds[0]);
           close (rvk_fds[0]);
           close (chng_fds[0]);
           close (file_fds[0]);
           close (file_fds[1]);
           c = acctproc (acct_fds[0], acctkey, newacct);
           goto out;
        }

        if (!strcmp (process, "chngproc"))
        {
           proccomp = COMP_CHALLENGE;
           close (cert_fds[0]);
           close (dns_fds[0]);
           close (rvk_fds[0]);
           close (file_fds[0]);
           close (file_fds[1]);
           c = chngproc (chng_fds[0], chngdir);
           goto out;
        }

        if (!strcmp (process, "certproc"))
        {
           proccomp = COMP_CERT;
           close (dns_fds[0]);
           close (rvk_fds[0]);
           close (file_fds[1]);
           c = certproc (cert_fds[0], file_fds[0]);
           goto out;
        }

        if (!strcmp (process, "fileproc"))
        {
           proccomp = COMP_FILE;
           close(dns_fds[0]);
           close(rvk_fds[0]);
           c = fileproc (file_fds[1], certdir,
                         certfile, chainfile, fullchainfile);
           goto out;
        }

        if (!strcmp (process, "dnsproc"))
        {
           proccomp = COMP_DNS;
           close (rvk_fds[0]);
           c = dnsproc (dns_fds[0]);
           goto out;
        }

        if (!strcmp (process, "revproc"))
        {
           proccomp = COMP_REVOKE;
           c = revokeproc (rvk_fds[0], certdir,
                           /* the reverse of the original */
                           fullchainfile != NULL ? fullchainfile : certfile,
                           force, revocate,
                           (const char *const *)alts, altsz);
           goto out;
        }

        if (process[0])
           errx(EXIT_FAILURE, "%s: unknown process", process);

        /********/
        /* main */
        /********/

	/* do some quick checks to see if our paths exist */
	ne = 0;

        if (altsz)
        {
           /* without a domain we're just querying the CA */
           if (access(certdir, R_OK) == -1) {
              warnx("%s: cert directory must exist", certdir);
              ne++;
           }

           if (!newdkey && access(keyfile, R_OK) == -1) {
              warnx("%s: domain key file must exist", keyfile);
              ne++;
           }
           else
           if (newdkey && access(keyfile, R_OK) != -1) {
              dodbg("%s: domain key exists (not creating)", keyfile);
              newdkey = 0;
           }

           if (!newacct && access(acctkey, R_OK) == -1) {
              warnx("%s: account key file must exist", acctkey);
              ne++;
           }
           else
           if (newacct && access(acctkey, R_OK) != -1) {
              dodbg("%s: account key exists (not creating)", acctkey);
              newacct = 0;
           }

           if (access(chngdir, R_OK) == -1) {
              warnx("%s: challenge directory must exist", chngdir);
              ne++;
           }

           if (ne > 0) goto out;
        }

	pairofsockets(NULL);
	if (pairofsockets(acct_fds) == -1)
           err(EXIT_FAILURE, "socketpair");
	if (pairofsockets(cert_fds) == -1)
           err(EXIT_FAILURE, "socketpair");
	if (pairofsockets(chng_fds) == -1)
           err(EXIT_FAILURE, "socketpair");
	if (pairofsockets(dns_fds) == -1)
           err(EXIT_FAILURE, "socketpair");
	if (pairofsockets(file_fds) == -1)
           err(EXIT_FAILURE, "socketpair");
	if (pairofsockets(key_fds) == -1)
           err(EXIT_FAILURE, "socketpair");
	if (pairofsockets(rvk_fds) == -1)
           err(EXIT_FAILURE, "socketpair");

        if ((pids[COMP_NET] = furk ("netproc", nargv)) == -1)
           err(EXIT_FAILURE, "furk() netproc");

        close (key_fds[1]);
        close (acct_fds[1]);
        close (chng_fds[1]);
        close (cert_fds[1]);
        close (dns_fds[1]);
        close (rvk_fds[1]);

        if ((pids[COMP_KEY] = furk ("keyproc", nargv)) == -1)
           err(EXIT_FAILURE, "furk() keyproc");

        close (key_fds[0]);

        if ((pids[COMP_ACCOUNT] = furk ("acctproc", nargv)) == -1)
           err(EXIT_FAILURE, "furk() acctproc");

        close (acct_fds[0]);

        if ((pids[COMP_CHALLENGE] = furk ("chngproc", nargv)) == -1)
           err(EXIT_FAILURE, "furk() chngproc");

        close (chng_fds[0]);

        if ((pids[COMP_CERT] = furk ("certproc", nargv)) == -1)
           err(EXIT_FAILURE, "furk() certproc");

        close (cert_fds[0]);
        close (file_fds[0]);

        if ((pids[COMP_FILE] = furk ("fileproc", nargv)) == -1)
           err(EXIT_FAILURE, "furk() fileproc");

        close (file_fds[1]);

        if ((pids[COMP_DNS] = furk ("dnsproc", nargv)) == -1)
           err(EXIT_FAILURE, "furk() dnsproc");

        close (dns_fds[0]);

        if ((pids[COMP_REVOKE] = furk ("revproc", nargv)) == -1)
           err(EXIT_FAILURE, "furk() revproc");

        close (rvk_fds[0]);

	/*
	 * Collect our subprocesses.
	 * Require that they both have exited cleanly.
	 */

	rc = checkexit(pids[COMP_KEY], COMP_KEY) +
	     checkexit(pids[COMP_CERT], COMP_CERT) +
	     checkexit(pids[COMP_NET], COMP_NET) +
	     checkexit_ext(&c, pids[COMP_FILE], COMP_FILE) +
	     checkexit(pids[COMP_ACCOUNT], COMP_ACCOUNT) +
	     checkexit(pids[COMP_CHALLENGE], COMP_CHALLENGE) +
	     checkexit(pids[COMP_DNS], COMP_DNS) +
	     checkexit(pids[COMP_REVOKE], COMP_REVOKE);

        if (rc == COMP__MAX && c != 2) c = 1;

out:
        doddbg ("exiting %d", c);

        if (c == 1 || c == 2)
           exit (SS$_NORMAL);
        else
           exit (SS$_OPINCOMPL);

#else /* WCME_IDIOM */

        /**************/
        /* NOT (wcme) */
        /**************/

        while ((c = getopt(argc, argv, "ADFnrvf:")) != -1)
                switch (c) {
                case 'A':
                        popts |= ACME_OPT_NEWACCT;
                        break;
                case 'D':
                        popts |= ACME_OPT_NEWDKEY;
                        break;
                case 'F':
                        force = 1;
                        break;
                case 'f':
                        if ((conffile = strdup(optarg)) == NULL)
                                err(EXIT_FAILURE, "strdup");
                        break;
                case 'n':
                        popts |= ACME_OPT_CHECK;
                        break;
                case 'r':
                        revocate = 1;
                        break;
                case 'v':
                        verbose = verbose ? 2 : 1;
                        popts |= ACME_OPT_VERBOSE;
                        break;
                default:
                        goto usage;
                }

        if (getuid() != 0)
                errx(EXIT_FAILURE, "must be run as root");

        /* parse config file */
        if ((conf = parse_config(conffile, popts)) == NULL)
                return EXIT_FAILURE;

        argc -= optind;
        argv += optind;
        if (argc != 1)
                goto usage;

        if ((domain = domain_find(conf, argv[0])) == NULL)
                errx(EXIT_FAILURE, "domain %s not found", argv[0]);

        argc--;
        argv++;

        /* the parser enforces that at least cert or fullchain is set */
        tmps = domain->cert ? domain->cert : domain->fullchain;
        if ((tmps = strdup(tmps)) == NULL)
                err(EXIT_FAILURE, "strdup");
        if ((tmpsd = dirname(tmps)) == NULL)
                err(EXIT_FAILURE, "dirname");
        if ((certdir = strdup(tmpsd)) == NULL)
                err(EXIT_FAILURE, "strdup");        
        free(tmps);
        tmps = tmpsd = NULL;

        if (domain->cert != NULL) {
                if ((tmps = strdup(domain->cert)) == NULL)
                        err(EXIT_FAILURE, "strdup");
                if ((certfile = basename(tmps)) == NULL)
                        err(EXIT_FAILURE, "basename");
                if ((certfile = strdup(certfile)) == NULL)
                        err(EXIT_FAILURE, "strdup");
        }

        if (domain->chain != NULL) {
                if ((tmps = strdup(domain->chain)) == NULL)
                        err(EXIT_FAILURE, "strdup");
                if ((chainfile = basename(tmps)) == NULL)
                        err(EXIT_FAILURE, "basename");
                if ((chainfile = strdup(chainfile)) == NULL)
                        err(EXIT_FAILURE, "strdup");
        }

        if (domain->fullchain != NULL) {
                if ((tmps = strdup(domain->fullchain)) == NULL)
                        err(EXIT_FAILURE, "strdup");
                if ((fullchainfile = basename(tmps)) == NULL)
                        err(EXIT_FAILURE, "basename");
                if ((fullchainfile = strdup(fullchainfile)) == NULL)
                        err(EXIT_FAILURE, "strdup");
        }

        if ((auth = domain->auth) == NULL) {
                /* use the first authority from the config as default XXX */
                authority = authority_find0(conf);
                if (authority == NULL)
                        errx(EXIT_FAILURE, "no authorities configured");
        } else {
                authority = authority_find(conf, auth);
                if (authority == NULL)
                        errx(EXIT_FAILURE, "authority %s not found", auth);
        }

        acctkey = authority->account;

        if ((chngdir = domain->challengedir) == NULL)
                if ((chngdir = strdup(WWW_DIR)) == NULL)
                        err(EXIT_FAILURE, "strdup");

        /*
         * Do some quick checks to see if our paths exist.
         * This will be done in the children, but we might as well check
         * now before the fork.
         * XXX maybe use conf_check_file() from parse.y
         */

        ne = 0;

        if (access(certdir, R_OK) == -1) {
                warnx("%s: cert directory must exist", certdir);
                ne++;
        }

        if (!(popts & ACME_OPT_NEWDKEY) && access(domain->key, R_OK) == -1) {
                warnx("%s: domain key file must exist", domain->key);
                ne++;
        } else if ((popts & ACME_OPT_NEWDKEY) && access(domain->key, R_OK)
            != -1) {
                dodbg("%s: domain key exists (not creating)", domain->key);
                popts &= ~ACME_OPT_NEWDKEY;
        }

        if (access(chngdir, R_OK) == -1) {
                warnx("%s: challenge directory must exist", chngdir);
                ne++;
        }

        if (!(popts & ACME_OPT_NEWACCT) && access(acctkey, R_OK) == -1) {
                warnx("%s: account key file must exist", acctkey);
                ne++;
        } else if ((popts & ACME_OPT_NEWACCT) && access(acctkey, R_OK) != -1) {
                dodbg("%s: account key exists (not creating)", acctkey);
                popts &= ~ACME_OPT_NEWACCT;
        }

        if (ne > 0)
                return EXIT_FAILURE;

        if (popts & ACME_OPT_CHECK)
                return EXIT_SUCCESS;

        /* Set the zeroth altname as our domain. */
        altsz = domain->altname_count + 1;
        alts = calloc(altsz, sizeof(char *));
        if (alts == NULL)
                err(EXIT_FAILURE, "calloc");
        alts[0] = domain->domain;
        i = 1;
        /* XXX get rid of alts[] later */
        TAILQ_FOREACH(ac, &domain->altname_list, entry)
                alts[i++] = ac->domain;

        /*
         * Open channels between our components.
         */

        if (socketpair(AF_UNIX, SOCK_STREAM, 0, key_fds) == -1)
                err(EXIT_FAILURE, "socketpair");
        if (socketpair(AF_UNIX, SOCK_STREAM, 0, acct_fds) == -1)
                err(EXIT_FAILURE, "socketpair");
        if (socketpair(AF_UNIX, SOCK_STREAM, 0, chng_fds) == -1)
                err(EXIT_FAILURE, "socketpair");
        if (socketpair(AF_UNIX, SOCK_STREAM, 0, cert_fds) == -1)
                err(EXIT_FAILURE, "socketpair");
        if (socketpair(AF_UNIX, SOCK_STREAM, 0, file_fds) == -1)
                err(EXIT_FAILURE, "socketpair");
        if (socketpair(AF_UNIX, SOCK_STREAM, 0, dns_fds) == -1)
                err(EXIT_FAILURE, "socketpair");
        if (socketpair(AF_UNIX, SOCK_STREAM, 0, rvk_fds) == -1)
                err(EXIT_FAILURE, "socketpair");

        /* Start with the network-touching process. */

        if ((pids[COMP_NET] = fork()) == -1)
                err(EXIT_FAILURE, "fork");

        if (pids[COMP_NET] == 0) {
                proccomp = COMP_NET;
                close(key_fds[0]);
                close(acct_fds[0]);
                close(chng_fds[0]);
                close(cert_fds[0]);
                close(file_fds[0]);
                close(file_fds[1]);
                close(dns_fds[0]);
                close(rvk_fds[0]);
                c = netproc(key_fds[1], acct_fds[1],
                    chng_fds[1], cert_fds[1],
                    dns_fds[1], rvk_fds[1],
                    (popts & ACME_OPT_NEWACCT), revocate, authority,
                    (const char *const *)alts, altsz);
                exit(c ? EXIT_SUCCESS : EXIT_FAILURE);
        }

        close(key_fds[1]);
        close(acct_fds[1]);
        close(chng_fds[1]);
        close(cert_fds[1]);
        close(dns_fds[1]);
        close(rvk_fds[1]);

        /* Now the key-touching component. */

        if ((pids[COMP_KEY] = fork()) == -1)
                err(EXIT_FAILURE, "fork");

        if (pids[COMP_KEY] == 0) {
                proccomp = COMP_KEY;
                close(cert_fds[0]);
                close(dns_fds[0]);
                close(rvk_fds[0]);
                close(acct_fds[0]);
                close(chng_fds[0]);
                close(file_fds[0]);
                close(file_fds[1]);
                c = keyproc(key_fds[0], domain->key,
                    (const char **)alts, altsz, (popts & ACME_OPT_NEWDKEY));
                exit(c ? EXIT_SUCCESS : EXIT_FAILURE);
        }

        close(key_fds[0]);

        /* The account-touching component. */

        if ((pids[COMP_ACCOUNT] = fork()) == -1)
                err(EXIT_FAILURE, "fork");

        if (pids[COMP_ACCOUNT] == 0) {
                proccomp = COMP_ACCOUNT;
                close(cert_fds[0]);
                close(dns_fds[0]);
                close(rvk_fds[0]);
                close(chng_fds[0]);
                close(file_fds[0]);
                close(file_fds[1]);
                c = acctproc(acct_fds[0], acctkey, (popts & ACME_OPT_NEWACCT));
                exit(c ? EXIT_SUCCESS : EXIT_FAILURE);
        }

        close(acct_fds[0]);

        /* The challenge-accepting component. */

        if ((pids[COMP_CHALLENGE] = fork()) == -1)
                err(EXIT_FAILURE, "fork");

        if (pids[COMP_CHALLENGE] == 0) {
                proccomp = COMP_CHALLENGE;
                close(cert_fds[0]);
                close(dns_fds[0]);
                close(rvk_fds[0]);
                close(file_fds[0]);
                close(file_fds[1]);
                c = chngproc(chng_fds[0], chngdir);
                exit(c ? EXIT_SUCCESS : EXIT_FAILURE);
        }

        close(chng_fds[0]);

        /* The certificate-handling component. */

        if ((pids[COMP_CERT] = fork()) == -1)
                err(EXIT_FAILURE, "fork");

        if (pids[COMP_CERT] == 0) {
                proccomp = COMP_CERT;
                close(dns_fds[0]);
                close(rvk_fds[0]);
                close(file_fds[1]);
                c = certproc(cert_fds[0], file_fds[0]);
                exit(c ? EXIT_SUCCESS : EXIT_FAILURE);
        }

        close(cert_fds[0]);
        close(file_fds[0]);

        /* The certificate-handling component. */

        if ((pids[COMP_FILE] = fork()) == -1)
                err(EXIT_FAILURE, "fork");

        if (pids[COMP_FILE] == 0) {
                proccomp = COMP_FILE;
                close(dns_fds[0]);
                close(rvk_fds[0]);
                c = fileproc(file_fds[1], certdir, certfile, chainfile,
                    fullchainfile);
                /*
                 * This is different from the other processes in that it
                 * can return 2 if the certificates were updated.
                 */
                exit(c > 1 ? 2 : (c ? EXIT_SUCCESS : EXIT_FAILURE));
        }

        close(file_fds[1]);

        /* The DNS lookup component. */

        if ((pids[COMP_DNS] = fork()) == -1)
                err(EXIT_FAILURE, "fork");

        if (pids[COMP_DNS] == 0) {
                proccomp = COMP_DNS;
                close(rvk_fds[0]);
                c = dnsproc(dns_fds[0]);
                exit(c ? EXIT_SUCCESS : EXIT_FAILURE);
        }

        close(dns_fds[0]);

        /* The expiration component. */

        if ((pids[COMP_REVOKE] = fork()) == -1)
                err(EXIT_FAILURE, "fork");

        if (pids[COMP_REVOKE] == 0) {
                proccomp = COMP_REVOKE;
                c = revokeproc(rvk_fds[0], certdir,
                    certfile != NULL ? certfile : fullchainfile,
                    force, revocate,
                    (const char *const *)alts, altsz);
                exit(c ? EXIT_SUCCESS : EXIT_FAILURE);
        }

        close(rvk_fds[0]);

        /* Jail: sandbox, file-system, user. */

        if (pledge("stdio", NULL) == -1)
                err(EXIT_FAILURE, "pledge");

        /*
         * Collect our subprocesses.
         * Require that they both have exited cleanly.
         */

        rc = checkexit(pids[COMP_KEY], COMP_KEY) +
            checkexit(pids[COMP_CERT], COMP_CERT) +
            checkexit(pids[COMP_NET], COMP_NET) +
            checkexit_ext(&c, pids[COMP_FILE], COMP_FILE) +
            checkexit(pids[COMP_ACCOUNT], COMP_ACCOUNT) +
            checkexit(pids[COMP_CHALLENGE], COMP_CHALLENGE) +
            checkexit(pids[COMP_DNS], COMP_DNS) +
            checkexit(pids[COMP_REVOKE], COMP_REVOKE);

        return rc != COMP__MAX ? EXIT_FAILURE : (c == 2 ? EXIT_SUCCESS : 2);
usage:
        fprintf(stderr,
            "usage: acme-client [-ADFnrv] [-f configfile] domain\n");
        return EXIT_FAILURE;

#endif /* WCME_IDIOM */

}