server/admin.c: Don't leak `privtag' from `ADD' command.

[tripe] / server / admin.c

/* -*-c-*-
 *
 * Admin interface for configuration
 *
 * (c) 2001 Straylight/Edgeware
 */

/*----- Licensing notice --------------------------------------------------*
 *
 * This file is part of Trivial IP Encryption (TrIPE).
 *
 * TrIPE is free software: you can redistribute it and/or modify it under
 * the terms of the GNU General Public License as published by the Free
 * Software Foundation; either version 3 of the License, or (at your
 * option) any later version.
 *
 * TrIPE is distributed in the hope that it will be useful, but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with TrIPE.  If not, see <https://www.gnu.org/licenses/>.
 */

/*----- Header files ------------------------------------------------------*/

#include "tripe.h"

/*----- Global variables --------------------------------------------------*/

#ifndef NTRACE

const trace_opt tr_opts[] = {
  { 't',	T_TUNNEL,	"tunnel events" },
  { 'r',	T_PEER,		"peer events" },
  { 'a',	T_ADMIN,	"admin interface" },
  { 's',	T_KEYSET,	"symmetric keyset management" },
  { 'x',	T_KEYEXCH,	"key exchange" },
  { 'm',	T_KEYMGMT,	"key management" },
  { 'l',	T_CHAL,		"challenge management" },
  { 'v',	T_PRIVSEP,	"privilege separation" },
  { 'p',	T_PACKET,	"packet contents" },
  { 'c',	T_CRYPTO,	"crypto details" },
  { 'A',	T_ALL,		"all of the above" },
  { 0,		0,		0 }
};

unsigned tr_flags = 0;
#endif

static const trace_opt w_opts[] = {
#ifndef NTRACE
  { 't',	AF_TRACE,	"trace messages" },
#endif
  { 'n',	AF_NOTE,	"asynchronous notifications" },
  { 'w',	AF_WARN,	"warnings" },
  { 'A',	AF_ALLMSGS,	"all of the above" },
  { 0,		0,		0 }
};

/*----- Static variables --------------------------------------------------*/

static admin *admins;
static admin *a_dead;
static sel_file sock;
static const char *sockname;
static sym_table a_svcs;
static unsigned flags = 0;
static admin *a_stdin = 0;
static sig s_term, s_int, s_hup;

#define F_DAEMON 1u
#define F_INIT 2u
#define F_FOREGROUND 4u

#define T_RESOLVE SEC(30)
#define T_PING SEC(5)

static void a_destroy(admin */*a*/);

#define BOOL(x) ((x) ? "t" : "nil")

/*----- Output functions --------------------------------------------------*/

/* --- @trywrite@ --- *
 *
 * Arguments:	@admin *a@ = pointer to an admin block
 *		@const char *p@ = pointer to buffer to write
 *		@size_t sz@ = size of data to write
 *
 * Returns:	The number of bytes written, or less than zero on error.
 *
 * Use:		Attempts to write data to a client.
 */

static ssize_t trywrite(admin *a, const char *p, size_t sz)
{
  ssize_t n, done = 0;

again:
  if (!sz)
    return (done);
  n = write(a->w.fd, p, sz);
  if (n > 0) {
    done += n;
    p += n;
    sz -= n;
    goto again;
  }
  if (n < 0) {
    if (errno == EINTR)
      goto again;
    if (errno != EAGAIN && errno != EWOULDBLOCK) {
      a_destroy(a);
      a_warn("ADMIN", "client-write-error", "?ERRNO", A_END);
      return (-1);
    }
  }
  return (done);
}

/* --- @doqueue@ -- *
 *
 * Arguments:	@oqueue *q@ = pointer to output queue
 *		@const char *p@ = pointer to buffer to write
 *		@size_t sz@ = size of buffer
 *
 * Returns:	Nonzero if the queue was previously empty.
 *
 * Use:		Queues data to be written later.
 */

static int doqueue(oqueue *q, const char *p, size_t sz)
{
  obuf *o;
  int rc = 0;
  size_t n;

  o = q->tl;
  if (!o)
    rc = 1;
  else if (o->p_in < o->buf + OBUFSZ)
    goto noalloc;

  do {
    o = xmalloc(sizeof(obuf));
    o->next = 0;
    o->p_in = o->p_out = o->buf;
    if (q->tl)
      q->tl->next = o;
    else
      q->hd = o;
    q->tl = o;

  noalloc:
    n = o->buf + OBUFSZ - o->p_in;
    if (n > sz)
      n = sz;
    memcpy(o->p_in, p, n);
    o->p_in += n;
    p += n;
    sz -= n;
  } while (sz);

  return (rc);
}

/* --- @dosend@ --- *
 *
 * Arguemnts:	@admin *a@ = pointer to an admin block
 *		@const char *p@ = pointer to buffer to write
 *		@size_t sz@ = size of data to write
 *
 * Returns:	---
 *
 * Use:		Sends data to an admin client.
 */

static void dosend(admin *a, const char *p, size_t sz)
{
  ssize_t n;

  if (a->f & AF_DEAD)
    return;
  if (!a->out.hd) {
    if ((n = trywrite(a, p, sz)) < 0)
      return;
    p += n;
    sz -= n;
    if (!sz)
      return;
  }
  if (doqueue(&a->out, p, sz))
    sel_addfile(&a->w);
}

/* --- @a_flush@ --- *
 *
 * Arguments:	@int fd@ = file descriptor
 *		@unsigned mode@ = what's happening
 *		@void *v@ = pointer to my admin block
 *
 * Returns:	---
 *
 * Use:		Flushes buffers when a client is ready to read again.
 */

static void a_flush(int fd, unsigned mode, void *v)
{
  admin *a = v;
  obuf *o, *oo;
  ssize_t n;

  o = a->out.hd;
  while (o) {
    if ((n = trywrite(a, o->p_out, o->p_in - o->p_out)) < 0)
      return;
    o->p_out += n;
    if (o->p_in < o->p_out)
      break;
    oo = o;
    o = o->next;
    xfree(oo);
  }
  a->out.hd = o;
  if (!o) {
    a->out.tl = 0;
    sel_rmfile(&a->w);
  }
}

/*----- Utility functions -------------------------------------------------*/

/* --- @a_vformat@ --- *
 *
 * Arguments:	@dstr *d@ = where to leave the formatted message
 *		@const char *fmt@ = pointer to format string
 *		@va_list *ap@ = arguments in list
 *
 * Returns:	---
 *
 * Use:		Main message token formatting driver.  The arguments are
 *		interleaved formatting tokens and their parameters, finally
 *		terminated by an entry @A_END@.
 *
 *		Tokens recognized:
 *
 *		  * "*..." ... -- pretokenized @dstr_putf@-like string
 *
 *		  * "?ADDR" SOCKADDR -- a socket address, to be converted
 *
 *		  * "?B64" BUFFER SIZE -- binary data to be base64-encoded
 *
 *		  * "?TOKENS" VECTOR -- null-terminated vector of tokens
 *
 *		  * "?PEER" PEER -- peer's name
 *
 *		  * "?ERRNO" ERRNO -- system error code
 *
 *		  * "[!]..." ... -- @dstr_putf@-like string as single token
 */

void a_vformat(dstr *d, const char *fmt, va_list *ap)
{
  dstr dd = DSTR_INIT;

  while (fmt) {
    if (*fmt == '*') {
      if (d->len) dstr_putc(d, ' ');
      dstr_vputf(d, fmt + 1, ap);
    } else if (*fmt == '?') {
      if (strcmp(fmt, "?ADDR") == 0) {
	const addr *a = va_arg(*ap, const addr *);
	switch (a->sa.sa_family) {
	  case AF_INET:
	    u_quotify(d, "INET");
	    u_quotify(d, inet_ntoa(a->sin.sin_addr));
	    dstr_putf(d, " %u", (unsigned)ntohs(a->sin.sin_port));
	    break;
	  default:
	    abort();
	}
      } else if (strcmp(fmt, "?B64") == 0) {
	const octet *p = va_arg(*ap, const octet *);
	size_t n = va_arg(*ap, size_t);
	codec *b64 = base64_class.encoder(CDCF_NOEQPAD, "", 0);
	dstr_putc(d, ' ');
	b64->ops->code(b64, p, n, d);
	b64->ops->code(b64, 0, 0, d);
	b64->ops->destroy(b64);
      } else if (strcmp(fmt, "?TOKENS") == 0) {
	const char *const *av = va_arg(*ap, const char *const *);
	while (*av) u_quotify(d, *av++);
      } else if (strcmp(fmt, "?PEER") == 0)
	u_quotify(d, p_name(va_arg(*ap, peer *)));
      else if (strcmp(fmt, "?ERRNO") == 0) {
	dstr_putf(d, " E%d", errno);
	u_quotify(d, strerror(errno));
      } else
	abort();
    } else {
      if (*fmt == '!') fmt++;
      DRESET(&dd);
      dstr_vputf(&dd, fmt, ap);
      u_quotify(d, dd.buf);
    }
    fmt = va_arg(*ap, const char *);
  }
  dstr_putz(d);

  dstr_destroy(&dd);
}

/* --- @a_format@ --- *
 *
 * Arguments:	@dstr *d@ = where to leave the formatted message
 *		@const char *fmt@ = pointer to format string
 *
 * Returns:	---
 *
 * Use:		Writes a tokenized message into a string, for later
 *		presentation.
 */

void a_format(dstr *d, const char *fmt, ...)
{
  va_list ap;

  va_start(ap, fmt);
  a_vformat(d, fmt, &ap);
  va_end(ap);
}

/* --- @a_write@, @a_vwrite@ --- *
 *
 * Arguments:	@admin *a@ = admin connection to write to
 *		@const char *status@ = status code to report
 *		@const char *tag@ = tag string, or null
 *		@const char *fmt@ = pointer to format string
 *		@va_list *ap@ = arguments in list
 *		@...@ = other arguments
 *
 * Returns:	---
 *
 * Use:		Sends a message to an admin connection.
 */

static void a_vwrite(admin *a, const char *status, const char *tag,
		     const char *fmt, va_list *ap)
{
  dstr d = DSTR_INIT;

  if (tag) dstr_puts(&d, "BG");
  dstr_puts(&d, status);
  if (tag) u_quotify(&d, tag);
  a_vformat(&d, fmt, ap);
  dstr_putc(&d, '\n');
  dosend(a, d.buf, d.len);
  dstr_destroy(&d);
}

static void a_write(admin *a, const char *status, const char *tag,
		    const char *fmt, ...)
{
  va_list ap;

  va_start(ap, fmt);
  a_vwrite(a, status, tag, fmt, &ap);
  va_end(ap);
}

/* --- @a_ok@, @a_fail@ --- *
 *
 * Arguments:	@admin *a@ = connection
 *		@const char *fmt@ = format string
 *		@...@ = other arguments
 *
 * Returns:	---
 *
 * Use:		Convenience functions for @a_write@.
 */

static void a_ok(admin *a) { a_write(a, "OK", 0, A_END); }

static void a_fail(admin *a, const char *fmt, ...)
{
  va_list ap;

  va_start(ap, fmt);
  a_vwrite(a, "FAIL", 0, fmt, &ap);
  va_end(ap);
}

/* --- @a_info@ --- *
 *
 * Arguments:	@admin *a@ = connection
 *		@const char *fmt@ = format string
 *		@...@ = other arguments
 *
 * Returns:	---
 *
 * Use:		Report information to an admin client.
 */

void a_info(admin *a, const char *fmt, ...)
{
  va_list ap;

  va_start(ap, fmt);
  a_vwrite(a, "INFO", 0, fmt, &ap);
  va_end(ap);
}

/* --- @a_alert@, @a_valert@, @a_rawalert@ --- *
 *
 * Arguments:	@unsigned f_and, f_eq@ = filter for connections
 *		@const char *status@ = status string
 *		@const char *fmt@ = pointer to format string
 *		@const char *p@ = pointer to raw string
 *		@size_t sz@ = size of raw string
 *		@va_list *ap@ = arguments in list
 *		@...@ = other arguments
 *
 * Returns:	---
 *
 * Use:		Write a message to all admin connections matched by the given
 *		filter.
 */

static void a_rawalert(unsigned f_and, unsigned f_eq, const char *status,
		       const char *p, size_t sz)
{
  admin *a, *aa;
  dstr d = DSTR_INIT;

  if (!(flags & F_INIT))
    return;
  dstr_puts(&d, status);
  if (p) {
    dstr_putc(&d, ' ');
    dstr_putm(&d, p, sz);
  }
  dstr_putc(&d, '\n');
  p = d.buf;
  sz = d.len;
  for (a = admins; a; a = aa) {
    aa = a->next;
    if ((a->f & f_and) == f_eq)
      dosend(a, d.buf, d.len);
  }
  dstr_destroy(&d);
}

static void a_valert(unsigned f_and, unsigned f_eq, const char *status,
		     const char *fmt, va_list *ap)
{
  dstr d = DSTR_INIT;

  if (!(flags & F_INIT))
    return;
  a_vformat(&d, fmt, ap);
  a_rawalert(f_and, f_eq, status, fmt ? d.buf : 0, fmt ? d.len : 0);
  dstr_destroy(&d);
}

static void a_alert(unsigned f_and, unsigned f_eq, const char *status,
		    const char *fmt, ...)
{
  va_list ap;

  va_start(ap, fmt);
  a_valert(f_and, f_eq, status, fmt, &ap);
  va_end(ap);
}

/* --- @a_warn@ --- *
 *
 * Arguments:	@const char *fmt@ = pointer to format string
 *		@...@ = other arguments
 *
 * Returns:	---
 *
 * Use:		Informs all admin connections of a warning.
 */

void a_warn(const char *fmt, ...)
{
  va_list ap;

  va_start(ap, fmt);
  if (flags & F_INIT)
    a_valert(0, 0, "WARN", fmt, &ap);
  else {
    dstr d = DSTR_INIT;
    fprintf(stderr, "%s: ", QUIS);
    a_vformat(&d, fmt, &ap);
    dstr_putc(&d, '\n');
    dstr_write(&d, stderr);
    dstr_destroy(&d);
  }
  va_end(ap);
}

/* --- @a_trace@ --- *
 *
 * Arguments:	@const char *p@ = pointer to a buffer
 *		@size_t sz@ = size of the buffer
 *		@void *v@ = uninteresting pointer
 *
 * Returns:	---
 *
 * Use:		Custom trace output handler.  Sends trace messages to
 *		interested admin connections.
 */

#ifndef NTRACE
static void a_trace(const char *p, size_t sz, void *v)
  { a_rawalert(AF_TRACE, AF_TRACE, "TRACE", p, sz); }
#endif

/* --- @a_notify@ --- *
 *
 * Arguments:	@const char *fmt@ = pointer to format string
 *		@...@ = other arguments
 *
 * Returns:	---
 *
 * Use:		Sends a notification to interested admin connections.
 */

void a_notify(const char *fmt, ...)
{
  va_list ap;

  va_start(ap, fmt);
  a_valert(AF_NOTE, AF_NOTE, "NOTE", fmt, &ap);
  va_end(ap);
}

/* --- @a_quit@ --- *
 *
 * Arguments:	---
 *
 * Returns:	---
 *
 * Use:		Shuts things down nicely.
 */

void a_quit(void)
{
  close(sock.fd);
  unlink(sockname);
  FOREACH_PEER(p, { p_destroy(p); });
  ps_quit();
  exit(0);
}

/* --- @a_sigdie@ --- *
 *
 * Arguments:	@int sig@ = signal number
 *		@void *v@ = an uninteresting argument
 *
 * Returns:	---
 *
 * Use		Shuts down on receipt of a fatal signal.
 */

static void a_sigdie(int sig, void *v)
{
  char *p;
  char buf[20];

  switch (sig) {
    case SIGTERM:	p = "SIGTERM"; break;
    case SIGINT:	p = "SIGINT"; break;
    default:
      sprintf(buf, "%i", sig);
      p = buf;
      break;
  }
  a_warn("SERVER", "quit", "signal", "%s", p, A_END);
  a_quit();
}

/* --- @a_sighup@ --- *
 *
 * Arguments:	@int sig@ = signal number
 *		@void *v@ = an uninteresting argument
 *
 * Returns:	---
 *
 * Use		Logs a message about SIGHUP not being useful.
 */

static void a_sighup(int sig, void *v)
  { a_warn("SERVER", "ignore", "signal", "SIGHUP", A_END); }

/* --- @a_parsetime@ --- *
 *
 * Arguments;	@const char *p@ = time string to parse
 *
 * Returns:	Time in seconds, or @< 0@ on error.
 */

static long a_parsetime(const char *p)
{
  char *q;
  long t = strtol(p, &q, 0);

  switch (*q) {
    case 'd': t *= 24;
    case 'h': t *= 60;
    case 'm': t *= 60;
    case 's': if (q[1] != 0)
    default:	t = -1;
    case 0:   break;
  }
  return (t);
}

/* --- @a_findpeer@ --- *
 *
 * Arguments:	@admin *a@ = admin connection
 *		@const char *pn@ = peer name
 *
 * Returns:	The peer, or null if not there.
 *
 * Use:		Finds a peer, reporting an error if it failed.
 */

static peer *a_findpeer(admin *a, const char *pn)
{
  peer *p;

  if ((p = p_find(pn)) == 0)
    a_fail(a, "unknown-peer", "%s", pn, A_END);
  return (p);
}

/*----- Backgrounded operations -------------------------------------------*/

#define BGTAG(bg)							\
  (((admin_bgop *)(bg))->tag ? ((admin_bgop *)(bg))->tag : "<foreground>")

/* --- @a_bgfind@ --- *
 *
 * Arguments:	@admin *a@ = a client block
 *		@const char *tag@ = the requested tag
 *
 * Returns:	The requested background job, or null.
 */

static admin_bgop *a_bgfind(admin *a, const char *tag)
{
  admin_bgop *bg;

  for (bg = a->bg; bg; bg = bg->next) {
    if (bg->tag && strcmp(tag, bg->tag) == 0)
      return (bg);
  }
  return (0);
}

/* --- @a_bgrelease@ --- *
 *
 * Arguments:	@admin_bgop *bg@ = backgrounded operation
 *
 * Returns:	---
 *
 * Use:		Removes a backgrounded operation from the queue, since
 *		(presumably) it's done.
 */

static void a_bgrelease(admin_bgop *bg)
{
  admin *a = bg->a;

  T( trace(T_ADMIN, "admin: release bgop %s", BGTAG(bg)); )
  if (bg->tag) xfree(bg->tag);
  else selbuf_enable(&a->b);
  if (bg->next) bg->next->prev = bg->prev;
  if (bg->prev) bg->prev->next = bg->next;
  else a->bg = bg->next;
  xfree(bg);
  if (!a->bg && (a->f & AF_CLOSE)) a_destroy(a);
}

/* --- @a_bgok@, @a_bginfo@, @a_bgfail@ --- *
 *
 * Arguments:	@admin_bgop *bg@ = backgrounded operation
 *		@const char *fmt@ = format string
 *		@...@ = other arguments
 *
 * Returns:	---
 *
 * Use:		Convenience functions for @a_write@.
 */

static void a_bgok(admin_bgop *bg)
  { a_write(bg->a, "OK", bg->tag, A_END); }

static void a_bginfo(admin_bgop *bg, const char *fmt, ...)
{
  va_list ap;
  va_start(ap, fmt);
  a_vwrite(bg->a, "INFO", bg->tag, fmt, &ap);
  va_end(ap);
}

static void a_bgfail(admin_bgop *bg, const char *fmt, ...)
{
  va_list ap;
  va_start(ap, fmt);
  a_vwrite(bg->a, "FAIL", bg->tag, fmt, &ap);
  va_end(ap);
}

/* --- @a_bgadd@ --- *
 *
 * Arguments:	@admin *a@ = administration connection
 *		@admin_bgop *bg@ = pointer to background operation
 *		@const char *tag@ = background tag, or null for foreground
 *		@void (*cancel)(admin_bgop *)@ = cancel function
 *
 * Returns:	Zero for success, nonzero on failure.
 *
 * Use:		Links a background job into the list.
 */

static int a_bgadd(admin *a, admin_bgop *bg, const char *tag,
		   void (*cancel)(admin_bgop *))
{
  if (tag) {
    if (a_bgfind(a, tag)) {
      a_fail(a, "tag-exists", "%s", tag, A_END);
      return (-1);
    }
    bg->tag = xstrdup(tag);
  }
  else {
    bg->tag = 0;
    selbuf_disable(&a->b);
  }
  bg->a = a;
  bg->cancel = cancel;
  bg->next = a->bg;
  bg->prev = 0;
  if (a->bg) a->bg->prev = bg;
  a->bg = bg;
  T( trace(T_ADMIN, "admin: add bgop %s", BGTAG(bg)); )
  if (tag) a_write(a, "DETACH", tag, A_END);
  return (0);
}

/*----- Job table manipulation --------------------------------------------*/

#define JOB_SHIFT 16
#define JOB_INDEXMASK ((1ul << JOB_SHIFT) - 1)
#define JOB_SEQMASK ((1ul << (32 - JOB_SHIFT)) - 1)

#define JOB_END 0xfffffffful

static unsigned long a_joboffset;

/* --- @a_jobidencode@ --- *
 *
 * Arguments:	@admin_svcop *svc@ = pointer to a service operation
 *
 * Returns:	A jobid for this job, in an internal static buffer.
 *
 * Use:		Constructs a jobid.  In order to dissuade people from
 *		predicting jobids, we obfuscate them.
 *
 *		A `raw' jobid consists of two 16-bit fields.  The low 16 bits
 *		are an index into a big array.  The high 16 bits are a
 *		sequence number recording how many times that slot has been
 *		reused.
 *
 *		This `raw' jobid is then obfuscated by adding a randomly-
 *		generated offset, and multiplying (mod %$2^{32}$%) by a fixed
 *		odd constant.
 */

static const char *a_jobidencode(admin_svcop *svc)
{
  admin_jobtable *j = &svc->prov->j;
  static char buf[10];
  unsigned long pre;
  unsigned seq;

  assert(svc->index <= JOB_INDEXMASK);
  seq = j->v[svc->index].seq;
  assert(seq <= JOB_SEQMASK);
  pre = (unsigned long)svc->index | ((unsigned long)seq << JOB_SHIFT);
  sprintf(buf, "J%08lx", ((pre + a_joboffset) * 0x0f87a7a3ul) & 0xffffffff);
  return (buf);
}

/* --- @a_jobiddecode@ --- *
 *
 * Arguments:	@admin_jobtable *j@ = pointer to a job table
 *		@const char *jid@ = pointer to a jobid string
 *
 * Returns:	A pointer to the job's @svcop@ structure.
 */

static admin_svcop *a_jobiddecode(admin_jobtable *j, const char *jid)
{
  unsigned i;
  unsigned long pre;

  if (jid[0] != 'J')
    return (0);
  for (i = 1; i < 9; i++) {
    if (!isxdigit((unsigned char)jid[i]))
      return (0);
  }
  if (jid[9] != 0)
    return (0);
  pre = strtoul(jid + 1, 0, 16);
  pre = ((pre * 0xbd11c40bul) - a_joboffset) & 0xffffffff;
  i = pre & JOB_INDEXMASK;
  if (i >= j->n || j->v[i].seq != (pre >> JOB_SHIFT))
    return (0);
  return (j->v[i].u.op);
}

/* --- @a_jobcreate@ --- *
 *
 * Arguments:	@admin *a@ = pointer to administration client
 *
 * Returns:	A pointer to a freshly-allocated @svcop@, or null.
 *
 * Use:		Allocates a fresh @svcop@ and links it into a job table.
 */

static admin_svcop *a_jobcreate(admin *a)
{
  admin_svcop *svc;
  unsigned i;
  unsigned sz;
  admin_jobtable *j = &a->j;

  if (j->free != JOB_END) {
    i = j->free;
    j->free = j->v[i].u.next;
  } else {
    if (j->n == j->sz) {
      if (j->sz > JOB_INDEXMASK)
	return (0);
      sz = j->sz;
      if (!sz) {
	j->sz = 16;
	j->v = xmalloc(j->sz * sizeof(*j->v));
      } else {
	j->sz = sz << 1;
	j->v = xrealloc(j->v, j->sz * sizeof(*j->v), sz * sizeof(*j->v));
      }
    }
    i = j->n++;
    j->v[i].seq = 0;
  }
  svc = xmalloc(sizeof(*svc));
  svc->index = i;
  svc->prov = a;
  svc->next = j->active;
  svc->prev = 0;
  if (j->active) j->active->prev = svc;
  j->active = svc;
  j->v[i].u.op = svc;
  IF_TRACING(T_ADMIN, {
    trace(T_ADMIN, "admin: created job %s (%u)", a_jobidencode(svc), i);
  })
  return (svc);
}

/* --- @a_jobdestroy@ --- *
 *
 * Arguments:	@admin_svcop *svc@ = pointer to job block
 *
 * Returns:	---
 *
 * Use:		Frees up a completed (or cancelled) job.
 */

static void a_jobdestroy(admin_svcop *svc)
{
  admin *a = svc->prov;
  admin_jobtable *j = &a->j;
  unsigned i = svc->index;

  IF_TRACING(T_ADMIN, {
    trace(T_ADMIN, "admin: destroying job %s (%u)", a_jobidencode(svc), i);
  })
  assert(j->v[i].u.op = svc);
  j->v[i].u.next = j->free;
  j->v[i].seq++;
  j->free = i;
  if (svc->next) svc->next->prev = svc->prev;
  if (svc->prev) svc->prev->next = svc->next;
  else j->active = svc->next;
}

/* --- @a_jobtableinit@ --- *
 *
 * Arguments:	@admin_jobtable *j@ = pointer to job table
 *
 * Returns:	---
 *
 * Use:		Initializes a job table.
 */

static void a_jobtableinit(admin_jobtable *j)
{
  if (!a_joboffset)
    a_joboffset = GR_RANGE(&rand_global, 0xffffffff) + 1;
  j->n = j->sz = 0;
  j->active = 0;
  j->free = JOB_END;
  j->v = 0;
}

/* --- @a_jobtablefinal@ --- *
 *
 * Arguments:	@admin_jobtable *j@ = pointer to job table
 *
 * Returns:	---
 *
 * Use:		Closes down a job table.
 */

static void a_jobtablefinal(admin_jobtable *j)
{
  admin_svcop *svc, *ssvc;

  for (svc = j->active; svc; svc = ssvc) {
    ssvc = svc->next;
    a_bgfail(&svc->bg, "provider-failed", A_END);
    a_bgrelease(&svc->bg);
  }
  if (j->v) xfree(j->v);
}

/*----- Services infrastructure -------------------------------------------*/

/* --- @a_svcfind@ --- *
 *
 * Arguments:	@admin *a@ = the requesting client
 *		@const char *name@ = service name wanted
 *
 * Returns:	The service requested, or null.
 *
 * Use:		Finds a service; reports an error if the service couldn't be
 *		found.
 */

static admin_service *a_svcfind(admin *a, const char *name)
{
  admin_service *svc;

  if ((svc = sym_find(&a_svcs, name, -1, 0, 0)) == 0) {
    a_fail(a, "unknown-service", "%s", name, A_END);
    return (0);
  }
  return (svc);
}

/* --- @a_svcunlink@ --- *
 *
 * Arguments:	@admin_service *svc@ = pointer to service structure
 *
 * Returns:	---
 *
 * Use:		Unlinks the service from its provider, without issuing a
 *		message or freeing the structure.  The version string is
 *		freed, however.
 */

static void a_svcunlink(admin_service *svc)
{
  if (svc->next)
    svc->next->prev = svc->prev;
  if (svc->prev)
    svc->prev->next = svc->next;
  else
    svc->prov->svcs = svc->next;
  xfree(svc->version);
}

/* --- @a_svcrelease@ --- *
 *
 * Arguments:	@admin_service *svc@ = pointer to service structure
 *
 * Returns:	---
 *
 * Use:		Releases a service and frees its structure.
 */

static void a_svcrelease(admin_service *svc)
{
  a_notify("SVCRELEASE", "%s", SYM_NAME(svc), A_END);
  a_svcunlink(svc);
  sym_remove(&a_svcs, svc);
}

/*----- Name resolution operations ----------------------------------------*/

/* --- @a_resolved@ --- *
 *
 * Arguments:	@struct hostent *h@ = pointer to resolved hostname
 *		@void *v@ = pointer to resolver operation
 *
 * Returns:	---
 *
 * Use:		Handles a completed name resolution.
 */

static void a_resolved(struct hostent *h, void *v)
{
  admin_resop *r = v;

  T( trace(T_ADMIN, "admin: resop %s resolved", BGTAG(r)); )
  QUICKRAND;
  if (!h) {
    a_bgfail(&r->bg, "resolve-error", "%s", r->addr, A_END);
    r->func(r, ARES_FAIL);
  } else {
    memcpy(&r->sa.sin.sin_addr, h->h_addr, sizeof(struct in_addr));
    r->func(r, ARES_OK);
  }
  sel_rmtimer(&r->t);
  xfree(r->addr);
  a_bgrelease(&r->bg);
}

/* --- @a_restimer@ --- *
 *
 * Arguments:	@struct timeval *tv@ = timer
 *		@void *v@ = pointer to resolver operation
 *
 * Returns:	---
 *
 * Use:		Times out a resolver.
 */

static void a_restimer(struct timeval *tv, void *v)
{
  admin_resop *r = v;

  T( trace(T_ADMIN, "admin: resop %s timeout", BGTAG(r)); )
  a_bgfail(&r->bg, "resolver-timeout", "%s", r->addr, A_END);
  r->func(r, ARES_FAIL);
  bres_abort(&r->r);
  xfree(r->addr);
  a_bgrelease(&r->bg);
}

/* --- @a_rescancel@ --- *
 *
 * Arguments:	@admin_bgop *bg@ = background operation
 *
 * Returns:	---
 *
 * Use:		Cancels an add operation.
 */

static void a_rescancel(admin_bgop *bg)
{
  admin_resop *r = (admin_resop *)bg;

  T( trace(T_ADMIN, "admin: cancel resop %s", BGTAG(r)); )
  r->func(r, ARES_FAIL);
  sel_rmtimer(&r->t);
  xfree(r->addr);
  bres_abort(&r->r);
}

/* --- @a_resolve@ --- *
 *
 * Arguments:	@admin *a@ = administration connection
 *		@admin_resop *r@ = resolver operation to run
 *		@const char *tag@ = background operation tag
 *		@void (*func)(struct admin_resop *, int@ = handler function
 *		@unsigned ac@ = number of remaining arguments
 *		@char *av[]@ = pointer to remaining arguments
 *
 * Returns:	---
 *
 * Use:		Cranks up a resolver job.
 */

static void a_resolve(admin *a, admin_resop *r, const char *tag,
		      void (*func)(struct admin_resop *, int),
		      unsigned ac, char *av[])
{
  struct timeval tv;
  unsigned long pt;
  char *p;
  int i = 0;

  /* --- Fill in the easy bits of address --- */

  r->bg.tag = "<starting>";
  r->addr = 0;
  r->func = func;
  if (mystrieq(av[i], "inet")) i++;
  if (ac - i != 1 && ac - i != 2) {
    a_fail(a, "bad-addr-syntax", "[inet] ADDRESS [PORT]", A_END);
    goto fail;
  }
  r->sa.sin.sin_family = AF_INET;
  r->sasz = sizeof(r->sa.sin);
  r->addr = xstrdup(av[i]);
  if (!av[i + 1])
    pt = TRIPE_PORT;
  else {
    pt = strtoul(av[i + 1], &p, 0);
    if (*p) {
      struct servent *s = getservbyname(av[i + 1], "udp");
      if (!s) {
	a_fail(a, "unknown-service", "%s", av[i + 1], A_END);
	goto fail;
      }
      pt = ntohs(s->s_port);
    }
  }
  if (pt == 0 || pt >= 65536) {
    a_fail(a, "invalid-port", "%lu", pt, A_END);
    goto fail;
  }
  r->sa.sin.sin_port = htons(pt);

  /* --- Report backgrounding --- *
   *
   * Do this for consistency of interface, even if we're going to get the
   * answer straight away.
   */

  if (a_bgadd(a, &r->bg, tag, a_rescancel))
    goto fail;
  T( trace(T_ADMIN, "admin: %u, resop %s, hostname `%s'",
	   a->seq, BGTAG(r), r->addr); )

  /* --- If the name is numeric, do it the easy way --- */

  if (inet_aton(av[i], &r->sa.sin.sin_addr)) {
    T( trace(T_ADMIN, "admin: resop %s done the easy way", BGTAG(r)); )
    func(r, ARES_OK);
    xfree(r->addr);
    a_bgrelease(&r->bg);
    return;
  }

  /* --- Store everything for later and crank up the resolver --- */

  gettimeofday(&tv, 0);
  tv.tv_sec += T_RESOLVE;
  sel_addtimer(&sel, &r->t, &tv, a_restimer, r);
  bres_byname(&r->r, r->addr, a_resolved, r);
  return;

fail:
  func(r, ARES_FAIL);
  if (r->addr) xfree(r->addr);
  xfree(r);
}

/*----- Option parsing ----------------------------------------------------*/

#define OPTIONS(argc, argv, guts) do {					\
  char **o_av = argv;							\
  for (;; o_av++) {							\
    if (!*o_av)								\
      break;								\
    if (mystrieq(*o_av, "--")) {					\
      o_av++;								\
      break;								\
    }									\
    guts								\
    if (**o_av == '-')							\
      goto bad_syntax;							\
    break;								\
  }									\
  argc -= o_av - argv;							\
  argv = o_av;								\
} while (0)

#define OPT(name, guts) if (mystrieq(*o_av, name)) { guts continue; }

#define OPTARG(name, arg, guts) OPT(name, {				\
  const char *arg;							\
  arg = *++o_av;							\
  if (!arg) goto bad_syntax;						\
  guts									\
})

#define OPTTIME(name, arg, guts) OPTARG(name, o_arg, {			\
  long arg;								\
  if ((arg = a_parsetime(o_arg)) < 0) {					\
    a_fail(a, "bad-time-spec", "%s", o_arg, A_END);			\
    goto fail;								\
  }									\
  guts									\
})

/*----- Adding peers ------------------------------------------------------*/

/* --- @a_doadd@ --- *
 *
 * Arguments:	@admin_resop *r@ = resolver operation
 *		@int rc@ = how it worked
 *
 * Returns:	---
 *
 * Use:		Handles a completed resolution.
 */

static void a_doadd(admin_resop *r, int rc)
{
  admin_addop *add = (admin_addop *)r;

  T( trace(T_ADMIN, "admin: done add op %s", BGTAG(add)); )

  if (rc == ARES_OK) {
    add->peer.sasz = add->r.sasz;
    add->peer.sa = add->r.sa;
    if (p_findbyaddr(&add->r.sa))
      a_bgfail(&add->r.bg, "peer-addr-exists", "?ADDR", &add->r.sa, A_END);
    else if (p_find(add->peer.name))
      a_bgfail(&add->r.bg, "peer-exists", "%s", add->peer.name, A_END);
    else if (!p_create(&add->peer))
      a_bgfail(&add->r.bg, "peer-create-fail", "%s", add->peer.name, A_END);
    else
      a_bgok(&add->r.bg);
  }

  if (add->peer.tag) xfree(add->peer.tag);
  if (add->peer.privtag) xfree(add->peer.privtag);
  xfree(add->peer.name);
}

/* --- @acmd_add@ --- *
 *
 * Arguments:	@admin *a@ = connection which requested the addition
 *		@unsigned ac@ = argument count
 *		@char *av[]@ = pointer to the argument list
 *
 * Returns:	---
 *
 * Use:		Adds a new peer.
 */

static void acmd_add(admin *a, unsigned ac, char *av[])
{
  const char *tag = 0;
  admin_addop *add;

  /* --- Set stuff up --- */

  add = xmalloc(sizeof(*add));
  add->peer.name = 0;
  add->peer.tag = 0;
  add->peer.privtag = 0;
  add->peer.t_ka = 0;
  add->peer.tops = tun_default;
  add->peer.f = 0;

  /* --- Parse options --- */

  OPTIONS(ac, av, {
    OPTARG("-background", arg, { tag = arg; })
    OPTARG("-tunnel", arg, {
      unsigned i;
      for (i = 0;; i++) {
	if (!tunnels[i]) {
	  a_fail(a, "unknown-tunnel", "%s", arg, A_END);
	  goto fail;
	}
	if (mystrieq(arg, tunnels[i]->name)) {
	  add->peer.tops = tunnels[i];
	  break;
	}
      }
    })
    OPTTIME("-keepalive", t, { add->peer.t_ka = t; })
    OPT("-cork", { add->peer.f |= KXF_CORK; })
    OPTARG("-key", arg, {
      if (add->peer.tag)
	xfree(add->peer.tag);
      add->peer.tag = xstrdup(arg);
    })
    OPT("-mobile", { add->peer.f |= PSF_MOBILE; })
    OPTARG("-priv", arg, {
      if (add->peer.privtag)
	xfree(add->peer.privtag);
      add->peer.privtag = xstrdup(arg);
    })
  });

  /* --- Make sure someone's not got there already --- */

  if (!av[0] || !av[1])
    goto bad_syntax;
  if (p_find(*av)) {
    a_fail(a, "peer-exists", "%s", *av, A_END);
    goto fail;
  }
  add->peer.name = xstrdup(*av++);
  ac--;

  /* --- Crank up the resolver --- */

  a_resolve(a, &add->r, tag, a_doadd, ac, av);
  return;

  /* --- Clearing up --- */

bad_syntax:
  a_fail(a, "bad-syntax", "add", "[OPTIONS] PEER ADDR ...", A_END);
fail:
  if (add->peer.name) xfree(add->peer.name);
  if (add->peer.tag) xfree(add->peer.tag);
  if (add->peer.privtag) xfree(add->peer.privtag);
  xfree(add);
  return;
}

/*----- Ping --------------------------------------------------------------*/

/* --- @a_pingcancel@ --- *
 *
 * Arguments:	@admin_bgop *bg@ = background operation block
 *
 * Returns:	---
 *
 * Use:		Cancels a running ping.
 */

static void a_pingcancel(admin_bgop *bg)
{
  admin_pingop *pg = (admin_pingop *)bg;
  T( trace(T_ADMIN, "admin: cancel ping op %s", BGTAG(pg)); )
  p_pingdone(&pg->ping, PING_NONOTIFY);
}

/* --- @a_pong@ --- *
 *
 * Arguments:	@int rc@ = return code
 *		@void *v@ = ping operation block
 *
 * Returns:	---
 *
 * Use:		Collects what happened to a ping message.
 */

static void a_pong(int rc, void *v)
{
  admin_pingop *pg = v;
  struct timeval tv;
  double millis;

  switch (rc) {
    case PING_OK:
      gettimeofday(&tv, 0);
      tv_sub(&tv, &tv, &pg->pingtime);
      millis = (double)tv.tv_sec * 1000 + (double)tv.tv_usec/1000;
      a_bginfo(&pg->bg, "ping-ok", "%.1f", millis, A_END);
      a_bgok(&pg->bg);
      break;
    case PING_TIMEOUT:
      a_bginfo(&pg->bg, "ping-timeout", A_END);
      a_bgok(&pg->bg);
      break;
    case PING_PEERDIED:
      a_bginfo(&pg->bg, "ping-peer-died", A_END);
      a_bgok(&pg->bg);
      break;
    default:
      abort();
  }
  T( trace(T_ADMIN, "admin: ponged ping op %s", BGTAG(pg)); )
  a_bgrelease(&pg->bg);
}

/* --- @acmd_ping@, @acmd_eping@ --- *
 *
 * Arguments:	@admin *a@ = connection which requested the ping
 *		@unsigned ac@ = argument count
 *		@char *av[]@ = pointer to the argument list
 *
 * Returns:	---
 *
 * Use:		Pings a peer.
 */

static void a_ping(admin *a, unsigned ac, char *av[],
		   const char *cmd, unsigned msg)
{
  long t = T_PING;
  peer *p;
  admin_pingop *pg = 0;
  const char *tag = 0;

  OPTIONS(ac, av, {
    OPTARG("-background", arg, { tag = arg; })
    OPTTIME("-timeout", arg, { t = arg; })
  });
  if (!*av || av[1]) goto bad_syntax;
  if ((p = a_findpeer(a, *av)) == 0)
    return;
  pg = xmalloc(sizeof(*pg));
  gettimeofday(&pg->pingtime, 0);
  if (a_bgadd(a, &pg->bg, tag, a_pingcancel))
    goto fail;
  T( trace(T_ADMIN, "admin: ping op %s: %s to %s",
	   BGTAG(pg), cmd, p_name(p)); )
  if (p_pingsend(p, &pg->ping, msg, t, a_pong, pg)) {
    a_bgfail(&pg->bg, "ping-send-failed", A_END);
    a_bgrelease(&pg->bg);
  }
  return;

bad_syntax:
  a_fail(a, "bad-syntax", "%s", cmd, "[OPTIONS] PEER", cmd, A_END);
fail:
  if (pg) xfree(pg);
  return;
}

static void acmd_ping(admin *a, unsigned ac, char *av[])
  { a_ping(a, ac, av, "ping", MISC_PING); }
static void acmd_eping(admin *a, unsigned ac, char *av[])
  { a_ping(a, ac, av, "eping", MISC_EPING); }

/*----- Service commands --------------------------------------------------*/

static void acmd_svcclaim(admin *a, unsigned ac, char *av[])
{
  admin_service *svc;
  unsigned f;

  svc = sym_find(&a_svcs, av[0], -1, sizeof(*svc), &f);
  if (f) {
    if (versioncmp(av[1], svc->version) <= 0) {
      a_fail(a,
	     "service-exists",
	     "%s", SYM_NAME(svc),
	     "%s", svc->version,
	     A_END);
      return;
    }
    a_write(svc->prov, "SVCCLAIM", 0, "%s", av[0], "%s", av[1], A_END);
    a_svcunlink(svc);
  }
  svc->prov = a;
  svc->version = xstrdup(av[1]);
  svc->next = a->svcs;
  svc->prev = 0;
  if (a->svcs) a->svcs->prev = svc;
  a->svcs = svc;
  a_notify("SVCCLAIM", "%s", SYM_NAME(svc), "%s", svc->version, A_END);
  a_ok(a);
}

static void acmd_svcrelease(admin *a, unsigned ac, char *av[])
{
  admin_service *svc;

  if ((svc = a_svcfind(a, av[0])) == 0)
    return;
  if (svc->prov != a) {
    a_fail(a, "not-service-provider", "%s", SYM_NAME(svc), A_END);
    return;
  }
  a_svcrelease(svc);
  a_ok(a);
}

static void acmd_svcensure(admin *a, unsigned ac, char *av[])
{
  admin_service *svc;

  if ((svc = a_svcfind(a, av[0])) == 0)
    return;
  if (av[1] && versioncmp(svc->version, av[1]) < 0) {
    a_fail(a, "service-too-old",
	   "%s", SYM_NAME(svc),
	   "%s", svc->version,
	   A_END);
    return;
  }
  a_ok(a);
}

static void acmd_svcquery(admin *a, unsigned ac, char *av[])
{
  admin_service *svc;

  if ((svc = a_svcfind(a, av[0])) != 0) {
    a_info(a, "name=%s", SYM_NAME(svc), "version=%s", svc->version, A_END);
    a_ok(a);
  }
}

static void acmd_svclist(admin *a, unsigned ac, char *av[])
{
  admin_service *svc;
  sym_iter i;

  for (sym_mkiter(&i, &a_svcs); (svc = sym_next(&i)) != 0; )
    a_info(a, "%s", SYM_NAME(svc), "%s", svc->version, A_END);
  a_ok(a);
}

static void a_canceljob(admin_bgop *bg)
{
  admin_svcop *svc = (admin_svcop *)bg;

  a_write(svc->prov, "SVCCANCEL", 0, "%s", a_jobidencode(svc), A_END);
  a_jobdestroy(svc);
}

static void acmd_svcsubmit(admin *a, unsigned ac, char *av[])
{
  const char *tag = 0;
  admin_service *svc;
  admin_svcop *svcop;
  const char *ver = 0;
  dstr d = DSTR_INIT;

  OPTIONS(ac, av, {
    OPTARG("-background", arg, { tag = arg; })
    OPTARG("-version", arg, { ver = arg; })
  });
  if (!*av) goto bad_syntax;
  if ((svc = a_svcfind(a, *av)) == 0) goto fail;
  if (ver && versioncmp(svc->version, ver) < 0) {
    a_fail(a, "service-too-old",
	   "%s", SYM_NAME(svc),
	   "%s", svc->version,
	   A_END);
    goto fail;
  }
  if ((svcop = a_jobcreate(svc->prov)) == 0) {
    a_fail(a, "provider-overloaded", A_END);
    goto fail;
  }
  if (a_bgadd(a, &svcop->bg, tag, a_canceljob)) {
    a_jobdestroy(svcop);
    goto fail;
  }
  a_write(svc->prov, "SVCJOB", 0,
	  "%s", a_jobidencode(svcop),
	  "?TOKENS", av,
	  A_END);
  goto done;

bad_syntax:
  a_fail(a, "bad-syntax", "svcsubmit", "[OPTIONS] SERVICE ARGS...", A_END);
fail:
done:
  dstr_destroy(&d);
  return;
}

static void a_replycmd(admin *a, const char *status, int donep, char *av[])
{
  admin_svcop *svc;

  if ((svc = a_jobiddecode(&a->j, av[0])) == 0) {
    a_fail(a, "unknown-jobid", av[0], A_END);
    return;
  }
  a_write(svc->bg.a, status, svc->bg.tag, "?TOKENS", av + 1, A_END);
  if (donep) {
    a_jobdestroy(svc);
    a_bgrelease(&svc->bg);
  }
  a_ok(a);
}

static void acmd_svcok(admin *a, unsigned ac, char *av[])
  { a_replycmd(a, "OK", 1, av); }
static void acmd_svcinfo(admin *a, unsigned ac, char *av[])
  { a_replycmd(a, "INFO", 0, av); }
static void acmd_svcfail(admin *a, unsigned ac, char *av[])
  { a_replycmd(a, "FAIL", 1, av); }

/*----- Administration commands -------------------------------------------*/

/* --- Miscellaneous commands --- */

/* --- @traceish@ --- *
 *
 * Arguments:	@admin *a@ = connection to complain on
 *		@unsigned ac@ = number of arguments
 *		@char *av[]@ = vector of arguments
 *		@const char *what@ = what we're messing with
 *		@const trace_opt *tt@ = options table
 *		@unsigned *ff@ = where the flags are
 *
 * Returns:	Nonzero if anything changed.
 *
 * Use:		Guts of trace-ish commands like `trace' and `watch'.
 */

static int traceish(admin *a, unsigned ac, char *av[],
		    const char *what, const trace_opt *tt, unsigned *ff)
{
  int ch = 0;

  if (!ac || strcmp(av[0], "?") == 0) {
    const trace_opt *t;
    for (t = tt; t->ch; t++) {
      a_info(a, "*%c%c %s",
	     t->ch, (*ff & t->f) == t->f ? '+' : ' ', t->help, A_END);
    }
  } else {
    unsigned sense = 1;
    unsigned f = *ff;
    const trace_opt *t;
    char *p = av[0];

    while (*p) {
      switch (*p) {
	case '+': sense = 1; break;
	case '-': sense = 0; break;
	default:
	  for (t = tt; t->ch; t++) {
	    if (t->ch == *p) {
	      if (sense) f |= t->f;
	      else f &= ~t->f;
	      goto tropt_ok;
	    }
	  }
	  a_fail(a, "bad-%s-option", what, "%c", *p, A_END);
	  return (0);
	tropt_ok:;
	  break;
      }
      p++;
    }
    *ff = f;
    ch = 1;
  }
  a_ok(a);
  return (ch);
}

#ifndef NTRACE

static void acmd_trace(admin *a, unsigned ac, char *av[])
{
  if (traceish(a, ac, av, "trace", tr_opts, &tr_flags))
    trace_level(tr_flags);
}

#endif

static void acmd_watch(admin *a, unsigned ac, char *av[])
  { traceish(a, ac, av, "watch", w_opts, &a->f); }

static void alertcmd(admin *a, unsigned f_and, unsigned f_eq,
		     const char *status, char *av[])
  { a_alert(f_and, f_eq, status, "USER", "?TOKENS", av, A_END); a_ok(a); }
static void acmd_notify(admin *a, unsigned ac, char *av[])
  { alertcmd(a, AF_NOTE, AF_NOTE, "NOTE", av); }
static void acmd_warn(admin *a, unsigned ac, char *av[])
  { alertcmd(a, AF_WARN, AF_WARN, "WARN", av); }

static void acmd_port(admin *a, unsigned ac, char *av[])
  { a_info(a, "%u", p_port(), A_END); a_ok(a); }

static void acmd_daemon(admin *a, unsigned ac, char *av[])
{
  if (flags & F_DAEMON)
    a_fail(a, "already-daemon", A_END);
  else {
    a_notify("DAEMON", A_END);
    if (a_stdin)
      a_destroy(a_stdin);
    if (daemonize())
      a_fail(a, "daemon-error", "?ERRNO", A_END);
    else {
      flags |= F_DAEMON;
      a_ok(a);
    }
  }
}

static void acmd_jobs(admin *a, unsigned ac, char *av[])
{
  admin_bgop *bg;

  for (bg = a->bg; bg; bg = bg->next) {
    assert(bg->tag);
    a_info(a, "%s", bg->tag, A_END);
  }
  a_ok(a);
}

static void acmd_bgcancel(admin *a, unsigned ac, char *av[])
{
  admin_bgop *bg;

  if ((bg = a_bgfind(a, av[0])) == 0)
    a_fail(a, "unknown-tag", "%s", av[0], A_END);
  else {
    bg->cancel(bg);
    a_bgrelease(bg);
    a_ok(a);
  }
}

static void acmd_algs(admin *a, unsigned ac, char *av[])
{
  peer *p;
  const kdata *kd;
  const dhgrp *g;
  const algswitch *algs;

  if (!ac)
    kd = master;
  else {
    if ((p = a_findpeer(a, av[0])) == 0) return;
    kd = p->kx.kpriv;
  }
  g = kd->grp;
  algs = &kd->algs;

  g->ops->grpinfo(g, a);
  a_info(a,
	 "hash=%s", algs->h->name,
	 "mgf=%s", algs->mgf->name,
	 "hash-sz=%lu", (unsigned long)algs->h->hashsz,
	 A_END);
  a_info(a,
	 "bulk-transform=%s", algs->bulk->ops->name,
	 "bulk-overhead=%lu",
	 (unsigned long)algs->bulk->ops->overhead(algs->bulk),
	 A_END);
  algs->bulk->ops->alginfo(algs->bulk, a);
  a_info(a,
	 "cipher-data-limit=%lu",
	 (unsigned long)algs->bulk->ops->expsz(algs->bulk),
	 A_END);
  a_ok(a);
}

static void acmd_list(admin *a, unsigned ac, char *av[])
{
  FOREACH_PEER(p, {  a_info(a, "%s", p_name(p), A_END); });
  a_ok(a);
}

static void acmd_ifname(admin *a, unsigned ac, char *av[])
{
  peer *p;

  if ((p = a_findpeer(a, av[0])) != 0) {
    a_info(a, "%s", p_ifname(p), A_END);
    a_ok(a);
  }
}

static void acmd_setifname(admin *a, unsigned ac, char *av[])
{
  peer *p;

  if ((p = a_findpeer(a, av[0])) != 0) {
    a_notify("NEWIFNAME", "?PEER", p, "%s", p_ifname(p), "%s", av[1], A_END);
    p_setifname(p, av[1]);
    a_ok(a);
  }
}

static void acmd_getchal(admin *a, unsigned ac, char *av[])
{
  buf b;

  buf_init(&b, buf_i, PKBUFSZ);
  c_new(&b);
  a_info(a, "?B64", BBASE(&b), (size_t)BLEN(&b), A_END);
  a_ok(a);
}

static void acmd_checkchal(admin *a, unsigned ac, char *av[])
{
  codec *b64 = base64_class.decoder(CDCF_NOEQPAD);
  int err;
  buf b;
  dstr d = DSTR_INIT;

  if ((err = b64->ops->code(b64, av[0], strlen(av[0]), &d)) != 0 ||
      (err = b64->ops->code(b64, 0, 0, &d)) != 0)
    a_fail(a, "bad-base64", "%s", codec_strerror(err), A_END);
  else {
    buf_init(&b, d.buf, d.len);
    if (c_check(&b) || BBAD(&b) || BLEFT(&b))
      a_fail(a, "invalid-challenge", A_END);
    else
      a_ok(a);
  }
  b64->ops->destroy(b64);
  dstr_destroy(&d);
}

static void acmd_greet(admin *a, unsigned ac, char *av[])
{
  peer *p;
  int err;
  codec *b64;
  dstr d = DSTR_INIT;

  if ((p = a_findpeer(a, av[0])) == 0) return;
  b64 = base64_class.decoder(CDCF_NOEQPAD);
  if ((err = b64->ops->code(b64, av[1], strlen(av[1]), &d)) != 0 ||
      (err = b64->ops->code(b64, 0, 0, &d)) != 0)
    a_fail(a, "bad-base64", "%s", codec_strerror(err), A_END);
  else {
    p_greet(p, d.buf, d.len);
    a_ok(a);
  }
  b64->ops->destroy(b64);
  dstr_destroy(&d);
}

static void acmd_addr(admin *a, unsigned ac, char *av[])
{
  peer *p;
  const addr *ad;

  if ((p = a_findpeer(a, av[0])) != 0) {
    ad = p_addr(p);
    assert(ad->sa.sa_family == AF_INET);
    a_info(a, "?ADDR", ad, A_END);
    a_ok(a);
  }
}

static void acmd_peerinfo(admin *a, unsigned ac, char *av[])
{
  peer *p;
  const peerspec *ps;
  const char *ptag;

  if ((p = a_findpeer(a, av[0])) != 0) {
    ps = p_spec(p);
    a_info(a, "tunnel=%s", ps->tops->name, A_END);
    a_info(a, "key=%s", p_tag(p),
	   "current-key=%s", p->kx.kpub->tag, A_END);
    if ((ptag = p_privtag(p)) == 0) ptag = "(default)";
    a_info(a, "private-key=%s", ptag,
	   "current-private-key=%s", p->kx.kpriv->tag, A_END);
    a_info(a, "keepalive=%lu", ps->t_ka, A_END);
    a_ok(a);
  }
}

static void acmd_servinfo(admin *a, unsigned ac, char *av[])
{
  a_info(a, "implementation=edgeware-tripe", A_END);
  a_info(a, "version=%s", VERSION, A_END);
  a_info(a, "daemon=%s", BOOL(flags & F_DAEMON), A_END);
  a_ok(a);
}

static void acmd_stats(admin *a, unsigned ac, char *av[])
{
  peer *p;
  stats *st;

  if ((p = a_findpeer(a, av[0])) == 0)
    return;

  st = p_stats(p);
  a_info(a, "start-time=%s", timestr(st->t_start), A_END);
  a_info(a, "last-packet-time=%s", timestr(st->t_last), A_END);
  a_info(a, "last-keyexch-time=%s", timestr(st->t_kx), A_END);
  a_info(a, "packets-in=%lu", st->n_in, "bytes-in=%lu", st->sz_in, A_END);
  a_info(a,
	 "packets-out=%lu", st->n_out,
	 "bytes-out=%lu", st->sz_out,
	 A_END);
  a_info(a,
	 "keyexch-packets-in=%lu", st->n_kxin,
	 "keyexch-bytes-in=%lu", st->sz_kxin,
	 A_END);
  a_info(a,
	 "keyexch-packets-out=%lu", st->n_kxout,
	 "keyexch-bytes-out=%lu", st->sz_kxout,
	 A_END);
  a_info(a,
	 "ip-packets-in=%lu", st->n_ipin,
	 "ip-bytes-in=%lu", st->sz_ipin,
	 A_END);
  a_info(a,
	 "ip-packets-out=%lu", st->n_ipout,
	 "ip-bytes-out=%lu", st->sz_ipout,
	 A_END);
  a_info(a, "rejected-packets=%lu", st->n_reject, A_END);
  a_ok(a);
}

static void acmd_kill(admin *a, unsigned ac, char *av[])
{
  peer *p;

  if ((p = a_findpeer(a, av[0])) != 0) {
    p_destroy(p);
    a_ok(a);
  }
}

static void acmd_forcekx(admin *a, unsigned ac, char *av[])
{
  peer *p;

  if ((p = a_findpeer(a, av[0])) != 0) {
    kx_start(&p->kx, 1);
    a_ok(a);
  }
}

static void acmd_reload(admin *a, unsigned ac, char *av[])
  { p_keyreload(); a_ok(a); }

static void acmd_quit(admin *a, unsigned ac, char *av[])
{
  a_warn("SERVER", "quit", "admin-request", A_END);
  a_ok(a);
  a_quit();
}

static void acmd_version(admin *a, unsigned ac, char *av[])
{
  a_info(a, "%s", PACKAGE, "%s", VERSION, A_END);
  a_ok(a);
}

static void acmd_tunnels(admin *a, unsigned ac, char *av[])
{
  int i;

  for (i = 0; tunnels[i]; i++)
    a_info(a, "%s", tunnels[i]->name, A_END);
  a_ok(a);
}

/* --- The command table and help --- */

typedef struct acmd {
  const char *name;
  const char *help;
  unsigned argmin, argmax;
  void (*func)(admin */*a*/, unsigned /*ac*/, char */*av*/[]);
} acmd;

static void acmd_help(admin */*a*/, unsigned /*ac*/, char */*av*/[]);

static const acmd acmdtab[] = {
  { "add",	"[OPTIONS] PEER ADDR ...", 2,	0xffff,	acmd_add },
  { "addr",	"PEER",			1,	1,	acmd_addr },
  { "algs",	"[PEER]",		0,	1,	acmd_algs },
  { "bgcancel",	"TAG",			1,	1,	acmd_bgcancel },
  { "checkchal", "CHAL",		1,	1,	acmd_checkchal },
  { "daemon",	0,			0,	0,	acmd_daemon },
  { "eping",	"[OPTIONS] PEER",	1,	0xffff,	acmd_eping },
  { "forcekx",	"PEER",			1,	1,	acmd_forcekx },
  { "getchal",	0,			0,	0,	acmd_getchal },
  { "greet",	"PEER CHAL",		2,	2,	acmd_greet },
  { "help",	0,			0,	0,	acmd_help },
  { "ifname",	"PEER",			1,	1,	acmd_ifname },
  { "jobs",	0,			0,	0,	acmd_jobs },
  { "kill",	"PEER",			1,	1,	acmd_kill },
  { "list",	0,			0,	0,	acmd_list },
  { "notify",	"MESSAGE ...",		1,	0xffff,	acmd_notify },
  { "peerinfo",	"PEER",			1,	1,	acmd_peerinfo },
  { "ping",	"[OPTIONS] PEER",	1,	0xffff,	acmd_ping },
  { "port",	0,			0,	0,	acmd_port },
  { "quit",	0,			0,	0,	acmd_quit },
  { "reload",	0,			0,	0,	acmd_reload },
  { "servinfo",	0,			0,	0,	acmd_servinfo },
  { "setifname", "PEER NEW-NAME",	2,	2,	acmd_setifname },
  { "svcclaim",	"SERVICE VERSION",	2,	2,	acmd_svcclaim },
  { "svcensure", "SERVICE [VERSION]",	1,	2,	acmd_svcensure },
  { "svcfail",	"JOBID TOKENS...",	1,	0xffff,	acmd_svcfail },
  { "svcinfo",	"JOBID TOKENS...",	1,	0xffff,	acmd_svcinfo },
  { "svclist",	0,			0,	0,	acmd_svclist },
  { "svcok",	"JOBID",		1,	1,	acmd_svcok },
  { "svcquery",	"SERVICE",		1,	1,	acmd_svcquery },
  { "svcrelease", "SERVICE",		1,	1,	acmd_svcrelease },
  { "svcsubmit", "[OPTIONS] SERVICE TOKENS...",
					2,	0xffff,	acmd_svcsubmit },
  { "stats",	"PEER",			1,	1,	acmd_stats },
#ifndef NTRACE
  { "trace",	"[OPTIONS]",		0,	1,	acmd_trace },
#endif
  { "tunnels",	0,			0,	0,	acmd_tunnels },
  { "version",	0,			0,	0,	acmd_version },
  { "warn",	"MESSAGE ...",		1,	0xffff,	acmd_warn },
  { "watch",	"[OPTIONS]",		0,	1,	acmd_watch },
  { 0,		0,			0,	0,	0 }
};

static void acmd_help(admin *a, unsigned ac, char *av[])
{
  const acmd *c;

  for (c = acmdtab; c->name; c++) {
    if (c->help)
      a_info(a, "%s", c->name, "*%s", c->help, A_END);
    else
      a_info(a, "%s", c->name, A_END);
  }
  a_ok(a);
}

/*----- Connection handling -----------------------------------------------*/

/* --- @a_destroypending@ --- *
 *
 * Arguments:	---
 *
 * Returns:	---
 *
 * Use:		Destroys pending admin connections at a safe time.
 */

static void a_destroypending(void)
{
  admin *a, *aa, *head;
  admin_bgop *bg, *bbg;
  admin_service *svc, *ssvc;

  /* --- Destroy connections marked as pending --- *
   *
   * Slightly messy.  Killing clients may cause others to finally die.  Make
   * sure that they can be put on the list without clobbering anything or
   * getting lost.
   */

  while (a_dead) {
    head = a_dead;
    a_dead = 0;
    for (a = head; a; a = aa) {
      aa = a->next;
      assert(a->f & AF_DEAD);

      /* --- Report what we're doing --- */

      T( trace(T_ADMIN, "admin: completing destruction of connection %u",
	       a->seq); )

      /* --- If this is the foreground client then shut down --- */

      if (a->f & AF_FOREGROUND) {
	T( trace(T_ADMIN, "admin: foreground client quit: shutting down"); )
	a_warn("SERVER", "quit", "foreground-eof", A_END);
	a_quit();
      }

      /* --- Abort any background jobs in progress --- */

      for (bg = a->bg; bg; bg = bbg) {
	bbg = bg->next;
	bg->cancel(bg);
	if (bg->tag) xfree(bg->tag);
	xfree(bg);
      }

      /* --- Release services I hold, and abort pending jobs --- */

      for (svc = a->svcs; svc; svc = ssvc) {
	ssvc = svc->next;
	a_svcrelease(svc);
      }
      a_jobtablefinal(&a->j);

      /* --- Close file descriptors and selectory --- */

      selbuf_destroy(&a->b);
      if (a->b.reader.fd != a->w.fd) close(a->b.reader.fd);
      close(a->w.fd);
      if (a_stdin == a) a_stdin = 0;

      /* --- Done --- */

      DESTROY(a);
    }
  }
}

/* --- @a_destroy@ --- *
 *
 * Arguments:	@admin *a@ = pointer to an admin block
 *
 * Returns:	---
 *
 * Use:		Destroys an admin block.  This requires a certain amount of
 *		care.
 */

static void freequeue(oqueue *q)
{
  obuf *o, *oo;

  for (o = q->hd; o; o = oo) {
    oo = o->next;
    xfree(o);
  }
  q->hd = q->tl = 0;
}

static void a_destroy(admin *a)
{
  if (a->f & AF_DEAD)
    return;

  if (a->next) a->next->prev = a->prev;
  if (a->prev) a->prev->next = a->next;
  else admins = a->next;

  if (a->out.hd) sel_rmfile(&a->w);
  freequeue(&a->out);

  a->f |= AF_DEAD;
  a->next = a_dead;
  a_dead = a;

  T( trace(T_ADMIN, "admin: killing connection %u", a->seq); )
}

/* --- @a_line@ --- *
 *
 * Arguments:	@char *p@ = pointer to the line read
 *		@size_t len@ = length of the line
 *		@void *vp@ = pointer to my admin block
 *
 * Returns:	---
 *
 * Use:		Handles a line of input.
 */

static void a_line(char *p, size_t len, void *vp)
{
  admin *a = vp;
  const acmd *c;
  char *av[16 + 1];
  size_t ac;

  QUICKRAND;
  if (a->f & AF_DEAD)
    return;
  if (!p) {
    if (!a->bg)
      a_destroy(a);
    else {
      a->f |= AF_CLOSE;
      selbuf_disable(&a->b);
    }
    return;
  }
  ac = str_qsplit(p, av, N(av) - 1, 0, STRF_QUOTE);
  if (!ac)
    return;
  av[ac] = 0;
  for (c = acmdtab; c->name; c++) {
    if (mystrieq(av[0], c->name)) {
      ac--;
      if (c->argmin > ac || ac > c->argmax) {
	if (!c->help)
	  a_fail(a, "bad-syntax", "%s", c->name, "", A_END);
	else
	  a_fail(a, "bad-syntax", "%s", c->name, "%s", c->help, A_END);
      } else
	c->func(a, ac, av + 1);
      return;
    }
  }
  a_fail(a, "unknown-command", "%s", av[0], A_END);
}

/* --- @a_create@ --- *
 *
 * Arguments:	@int fd_in, fd_out@ = file descriptors to use
 *		@unsigned f@ = initial flags to set
 *
 * Returns:	---
 *
 * Use:		Creates a new admin connection.
 */

void a_create(int fd_in, int fd_out, unsigned f)
{
  admin *a = CREATE(admin);

  T( static unsigned seq = 0;
     a->seq = seq++; )
  T( trace(T_ADMIN, "admin: accepted connection %u", a->seq); )
  a->bg = 0;
  a->ref = 0;
  a->svcs = 0;
  a_jobtableinit(&a->j);
  a->f = f;
  if (fd_in == STDIN_FILENO) a_stdin = a;
  fdflags(fd_in, O_NONBLOCK, O_NONBLOCK, FD_CLOEXEC, FD_CLOEXEC);
  if (fd_out != fd_in)
    fdflags(fd_out, O_NONBLOCK, O_NONBLOCK, FD_CLOEXEC, FD_CLOEXEC);
  selbuf_init(&a->b, &sel, fd_in, a_line, a);
  sel_initfile(&sel, &a->w, fd_out, SEL_WRITE, a_flush, a);
  a->out.hd = a->out.tl = 0;
  a->next = admins;
  a->prev = 0;
  if (admins) admins->prev = a;
  admins = a;
}

/* --- @a_accept@ --- *
 *
 * Arguments:	@int fd@ = file descriptor to accept
 *		@unsigned mode@ = what to do
 *		@void *v@ = uninteresting pointer
 *
 * Returns:	---
 *
 * Use:		Accepts a new admin connection.
 */

static void a_accept(int fd, unsigned mode, void *v)
{
  int nfd;
  struct sockaddr_un sun;
  socklen_t sz = sizeof(sun);

  if ((nfd = accept(fd, (struct sockaddr *)&sun, &sz)) < 0) {
    if (errno != EINTR && errno != EAGAIN && errno != EWOULDBLOCK &&
	errno != ECONNABORTED && errno != EPROTO)
      a_warn("ADMIN", "accept-error", "?ERRNO", A_END);
    return;
  }
  a_create(nfd, nfd, 0);
}

/* --- @a_preselect@ --- *
 *
 * Arguments:	---
 *
 * Returns:	---
 *
 * Use:		Informs the admin module that we're about to select again,
 *		and that it should do cleanup things it has delayed until a
 *		`safe' time.
 */

void a_preselect(void) { if (a_dead) a_destroypending(); }

/* --- @a_daemon@ --- *
 *
 * Arguments:	---
 *
 * Returns:	---
 *
 * Use:		Informs the admin module that it's a daemon.
 */

void a_daemon(void) { flags |= F_DAEMON; }

/* --- @a_init@ --- *
 *
 * Arguments:	@const char *name@ = socket name to create
 *		@uid_t u@ = user to own the socket
 *		@gid_t g@ = group to own the socket
 *		@mode_t m@ = permissions to set on the socket
 *
 * Returns:	---
 *
 * Use:		Creates the admin listening socket.
 */

void a_init(const char *name, uid_t u, gid_t g, mode_t m)
{
  int fd;
  int n = 5;
  struct sockaddr_un sun;
  struct sigaction sa;
  size_t sz;
  mode_t omask;

  /* --- Create services table --- */

  sym_create(&a_svcs);

  /* --- Set up the socket address --- */

  sz = strlen(name) + 1;
  if (sz > sizeof(sun.sun_path))
    die(EXIT_FAILURE, "socket name `%s' too long", name);
  BURN(sun);
  sun.sun_family = AF_UNIX;
  memcpy(sun.sun_path, name, sz);
  sz += offsetof(struct sockaddr_un, sun_path);

  /* --- Attempt to bind to the socket --- */

  omask = umask(0077);
again:
  if ((fd = socket(PF_UNIX, SOCK_STREAM, 0)) < 0)
    die(EXIT_FAILURE, "couldn't create socket: %s", strerror(errno));
  if (bind(fd, (struct sockaddr *)&sun, sz) < 0) {
    struct stat st;
    int e = errno;
    if (errno != EADDRINUSE) {
      die(EXIT_FAILURE, "couldn't bind to address `%s': %s",
	  sun.sun_path, strerror(e));
    }
    if (!n)
      die(EXIT_FAILURE, "too many retries; giving up");
    n--;
    if (!connect(fd, (struct sockaddr *)&sun, sz)) {
      die(EXIT_FAILURE, "server already listening on admin socket `%s'",
	  sun.sun_path);
    }
    if (errno != ECONNREFUSED)
      die(EXIT_FAILURE, "couldn't bind to address: %s", strerror(e));
    if (stat(sun.sun_path, &st)) {
      die(EXIT_FAILURE, "couldn't stat `%s': %s",
	  sun.sun_path, strerror(errno));
    }
    if (!S_ISSOCK(st.st_mode))
      die(EXIT_FAILURE, "object `%s' isn't a socket", sun.sun_path);
    T( trace(T_ADMIN, "admin: stale socket found; removing it"); )
    unlink(sun.sun_path);
    close(fd);
    goto again;
  }
  if (chown(sun.sun_path, u, g)) {
    die(EXIT_FAILURE, "failed to set socket owner: %s",
	strerror(errno));
  }
  if (chmod(sun.sun_path, m)) {
    die(EXIT_FAILURE, "failed to set socket permissions: %s",
	strerror(errno));
  }
  umask(omask);
  fdflags(fd, O_NONBLOCK, O_NONBLOCK, FD_CLOEXEC, FD_CLOEXEC);
  if (listen(fd, 5))
    die(EXIT_FAILURE, "couldn't listen on socket: %s", strerror(errno));

  /* --- Listen to the socket --- */

  sel_initfile(&sel, &sock, fd, SEL_READ, a_accept, 0);
  sel_addfile(&sock);
  sockname = name;
  bres_init(&sel);
  T( trace_custom(a_trace, 0);
     trace(T_ADMIN, "admin: enabled custom tracing"); )
  flags |= F_INIT;

  /* --- Set up signal handlers --- */

  sig_add(&s_term, SIGTERM, a_sigdie, 0);
  sig_add(&s_hup, SIGHUP, a_sighup, 0);
  signal(SIGPIPE, SIG_IGN);
  sigaction(SIGINT, 0, &sa);
  if (sa.sa_handler != SIG_IGN)
    sig_add(&s_int, SIGINT, a_sigdie, 0);
}

/*----- That's all, folks -------------------------------------------------*/