X-Git-Url: https://git.distorted.org.uk/~mdw/tripe/blobdiff_plain/e9fcf28eed6a6e44d2e2b963b06bad2ae76309e1..a47e5f929c244078a87c737ae99294fecfb269c0:/server/tripe.h diff --git a/server/tripe.h b/server/tripe.h index 5550c1fd..05956826 100644 --- a/server/tripe.h +++ b/server/tripe.h @@ -62,10 +62,17 @@ #include #include +#ifdef HAVE_LIBADNS +# define ADNS_FEATURE_MANYAF +# include +#endif + #include #include #include -#include +#ifndef HAVE_LIBADNS +# include +#endif #include #include #include @@ -402,6 +409,7 @@ struct algswitch { struct kdata { unsigned ref; /* Reference counter */ struct knode *kn; /* Pointer to cache entry */ + uint32 id; /* The underlying key's id */ char *tag; /* Full tag name of the key */ dhgrp *grp; /* The group we work in */ dhsc *k; /* The private key (or null) */ @@ -427,6 +435,27 @@ extern const bulkops bulktab[]; /*----- Data structures ---------------------------------------------------*/ +/* --- The address-family table --- */ + +#define ADDRFAM(_) \ + _(INET, want_ipv4) \ + _(INET6, want_ipv6) + +enum { +#define ENUM(af, qf) AFIX_##af, + ADDRFAM(ENUM) +#undef ENUM + NADDRFAM +}; + +extern const struct addrfam { + int af; + const char *name; +#ifdef HAVE_LIBADNS + adns_queryflags qf; +#endif +} aftab[NADDRFAM]; + /* --- Socket addresses --- * * * A magic union of supported socket addresses. @@ -435,6 +464,7 @@ extern const bulkops bulktab[]; typedef union addr { struct sockaddr sa; struct sockaddr_in sin; + struct sockaddr_in6 sin6; } addr; /* --- Mapping keyed on addresses --- */ @@ -609,12 +639,14 @@ typedef struct peerspec { char *name; /* Peer's name */ char *privtag; /* Private key tag */ char *tag; /* Public key tag */ + char *knock; /* Knock string, or null */ const tunnel_ops *tops; /* Tunnel operations */ unsigned long t_ka; /* Keep alive interval */ addr sa; /* Socket address to speak to */ unsigned f; /* Flags for the peer */ #define PSF_KXMASK 255u /* Key-exchange flags to set */ #define PSF_MOBILE 256u /* Address may change rapidly */ +#define PSF_EPHEM 512u /* Association is ephemeral */ } peerspec; typedef struct peer_byname { @@ -632,6 +664,7 @@ typedef struct peer { peer_byaddr *byaddr; /* Lookup-by-address block */ struct ping *pings; /* Pings we're waiting for */ peerspec spec; /* Specifications for this peer */ + int afix; /* Index of address family */ tunnel *t; /* Tunnel for local packets */ char *ifname; /* Interface name for tunnel */ keyset *ks; /* List head for keysets */ @@ -643,6 +676,11 @@ typedef struct peer { typedef struct peer_iter { sym_iter i; } peer_iter; +typedef struct udpsocket { + sel_file sf; /* Selector for the socket */ + unsigned port; /* Chosen port number */ +} udpsocket; + typedef struct ping { struct ping *next, *prev; /* Links to next and previous */ peer *p; /* Peer so we can free it */ @@ -688,9 +726,14 @@ typedef struct admin_bgop { typedef struct admin_resop { admin_bgop bg; /* Background operation header */ char *addr; /* Hostname to be resolved */ +#ifdef HAVE_LIBADNS + adns_query q; +#else bres_client r; /* Background resolver task */ +#endif sel_timer t; /* Timer for resolver */ addr sa; /* Socket address */ + unsigned port; /* Port number chosen */ size_t sasz; /* Socket address size */ void (*func)(struct admin_resop *, int); /* Handler */ } admin_resop; @@ -774,6 +817,7 @@ extern sel_state sel; /* Global I/O event state */ extern octet buf_i[PKBUFSZ], buf_o[PKBUFSZ], buf_t[PKBUFSZ], buf_u[PKBUFSZ]; extern const tunnel_ops *tunnels[]; /* Table of tunnels (0-term) */ extern const tunnel_ops *tun_default; /* Default tunnel to use */ +extern udpsocket udpsock[NADDRFAM]; /* The master UDP sockets */ extern kdata *master; /* Default private key */ extern const char *tag_priv; /* Default private key tag */ @@ -827,6 +871,19 @@ extern int km_reload(void); extern kdata *km_findpub(const char */*tag*/); extern kdata *km_findpriv(const char */*tag*/); +/* --- @km_findpubbyid@, @km_findprivbyid@ --- * + * + * Arguments: @uint32 id@ = key id to load + * + * Returns: Pointer to the kdata object if successful, or null on error. + * + * Use: Fetches a public or private key from the keyring given its + * numeric id. + */ + +extern kdata *km_findpubbyid(uint32 /*id*/); +extern kdata *km_findprivbyid(uint32 /*id*/); + /* --- @km_samealgsp@ --- * * * Arguments: @const kdata *kdx, *kdy@ = two key data objects @@ -889,16 +946,18 @@ extern void kx_start(keyexch */*kx*/, int /*forcep*/); /* --- @kx_message@ --- * * * Arguments: @keyexch *kx@ = pointer to key exchange context + * @const addr *a@ = sender's IP address and port * @unsigned msg@ = the message code * @buf *b@ = pointer to buffer containing the packet * - * Returns: --- + * Returns: Nonzero if the sender's address was unknown. * * Use: Reads a packet containing key exchange messages and handles * it. */ -extern void kx_message(keyexch */*kx*/, unsigned /*msg*/, buf */*b*/); +extern int kx_message(keyexch */*kx*/, const addr */*a*/, + unsigned /*msg*/, buf */*b*/); /* --- @kx_free@ --- * * @@ -942,6 +1001,17 @@ extern void kx_newkeys(keyexch */*kx*/); extern int kx_setup(keyexch */*kx*/, peer */*p*/, keyset **/*ks*/, unsigned /*f*/); +/* --- @kx_init@ --- * + * + * Arguments: --- + * + * Returns: --- + * + * Use: Initializes the key-exchange logic. + */ + +extern void kx_init(void); + /*----- Keysets and symmetric cryptography --------------------------------*/ /* --- @ks_drop@ --- * @@ -1227,7 +1297,10 @@ extern void EXECL_LIKE(0) a_notify(const char */*fmt*/, ...); * * Returns: --- * - * Use: Creates a new admin connection. + * Use: Creates a new admin connection. It's safe to call this + * before @a_init@ -- and, indeed, this makes sense if you also + * call @a_switcherr@ to report initialization errors through + * the administration machinery. */ extern void a_create(int /*fd_in*/, int /*fd_out*/, unsigned /*f*/); @@ -1267,6 +1340,50 @@ extern void a_preselect(void); extern void a_daemon(void); +/* --- @a_listen@ --- * + * + * Arguments: @const char *name@ = socket name to create + * @uid_t u@ = user to own the socket + * @gid_t g@ = group to own the socket + * @mode_t m@ = permissions to set on the socket + * + * Returns: --- + * + * Use: Creates the admin listening socket. + */ + +extern void a_listen(const char */*sock*/, + uid_t /*u*/, gid_t /*g*/, mode_t /*m*/); + +/* --- @a_switcherr@ --- * + * + * Arguments: --- + * + * Returns: --- + * + * Use: Arrange to report warnings, trace messages, etc. to + * administration clients rather than the standard-error stream. + * + * Obviously this makes no sense unless there is at least one + * client established. Calling @a_listen@ won't help with this, + * because the earliest a new client can connect is during the + * first select-loop iteration, which is too late: some initial + * client must have been added manually using @a_create@. + */ + +extern void a_switcherr(void); + +/* --- @a_signals@ --- * + * + * Arguments: --- + * + * Returns: --- + * + * Use: Establishes handlers for the obvious signals. + */ + +extern void a_signals(void); + /* --- @a_init@ --- * * * Arguments: @const char *sock@ = socket name to create @@ -1279,8 +1396,7 @@ extern void a_daemon(void); * Use: Creates the admin listening socket. */ -extern void a_init(const char */*sock*/, - uid_t /*u*/, gid_t /*g*/, mode_t /*m*/); +extern void a_init(void); /*----- Mapping with addresses as keys ------------------------------------*/ @@ -1427,6 +1543,20 @@ extern int p_updateaddr(peer */*p*/, const addr */*a*/); extern buf *p_txstart(peer */*p*/, unsigned /*msg*/); +/* --- @p_txaddr@ --- * + * + * Arguments: @const addr *a@ = recipient address + * @const void *p@ = pointer to packet to send + * @size_t sz@ = length of packet + * + * Returns: Zero if successful, nonzero on error. + * + * Use: Sends a packet to an address which (possibly) isn't a current + * peer. + */ + +extern int p_txaddr(const addr */*a*/, const void */*p*/, size_t /*sz*/); + /* --- @p_txend@ --- * * * Arguments: @peer *p@ = pointer to peer block @@ -1555,26 +1685,27 @@ extern void p_setifname(peer */*p*/, const char */*name*/); extern const addr *p_addr(peer */*p*/); -/* --- @p_init@ --- * +/* --- @p_bind@ --- * * - * Arguments: @struct in_addr addr@ = address to bind to - * @unsigned port@ = port number to listen to + * Arguments: @struct addrinfo *ailist@ = addresses to bind to * * Returns: --- * - * Use: Initializes the peer system; creates the socket. + * Use: Binds to the main UDP sockets. */ -extern void p_init(struct in_addr /*addr*/, unsigned /*port*/); +extern void p_bind(struct addrinfo */*ailist*/); -/* --- @p_port@ --- * +/* --- @p_init@ --- * * * Arguments: --- * - * Returns: Port number used for socket. + * Returns: --- + * + * Use: Initializes the peer system. */ -unsigned p_port(void); +extern void p_init(void); /* --- @p_create@ --- * * @@ -1651,13 +1782,14 @@ extern peer *p_find(const char */*name*/); /* --- @p_destroy@ --- * * * Arguments: @peer *p@ = pointer to a peer + * @int bye@ = say goodbye to the peer? * * Returns: --- * * Use: Destroys a peer. */ -extern void p_destroy(peer */*p*/); +extern void p_destroy(peer */*p*/, int /*bye*/); /* --- @FOREACH_PEER@ --- * * @@ -1734,6 +1866,15 @@ extern const char *timestr(time_t /*t*/); extern int mystrieq(const char */*x*/, const char */*y*/); +/* --- @afix@ --- * + * + * Arguments: @int af@ = an address family code + * + * Returns: The index of the address family's record in @aftab@, or @-1@. + */ + +extern int afix(int af); + /* --- @addrsz@ --- * * * Arguments: @const addr *a@ = a network address @@ -1743,6 +1884,19 @@ extern int mystrieq(const char */*x*/, const char */*y*/); extern socklen_t addrsz(const addr */*a*/); +/* --- @getport@, @setport@ --- * + * + * Arguments: @addr *a@ = a network address + * @unsigned port@ = port number to set + * + * Returns: --- + * + * Use: Retrieves or sets the port number in an address structure. + */ + +extern unsigned getport(addr */*a*/); +extern void setport(addr */*a*/, unsigned /*port*/); + /* --- @seq_reset@ --- * * * Arguments: @seqwin *s@ = sequence-checking window @@ -1801,6 +1955,42 @@ extern void ratelim_init(ratelim */*r*/, extern int ratelim_withdraw(ratelim */*r*/, unsigned /*n*/); +/* --- @ies_encrypt@ --- * + * + * Arguments: @kdata *kpub@ = recipient's public key + * @unsigned ty@ = message type octet + * @buf *b@ = input message buffer + * @buf *bb@ = output buffer for the ciphertext + * + * Returns: On error, returns a @KSERR_...@ code or breaks the buffer; + * on success, returns zero and the buffer is good. + * + * Use: Encrypts a message for a recipient, given their public key. + * This does not (by itself) provide forward secrecy or sender + * authenticity. The ciphertext is self-delimiting (unlike + * @ks_encrypt@). + */ + +extern int ies_encrypt(kdata */*kpub*/, unsigned /*ty*/, + buf */*b*/, buf */*bb*/); + +/* --- @ies_decrypt@ --- * + * + * Arguments: @kdata *kpub@ = private key key + * @unsigned ty@ = message type octet + * @buf *b@ = input ciphertext buffer + * @buf *bb@ = output buffer for the message + * + * Returns: On error, returns a @KSERR_...@ code; on success, returns + * zero and the buffer is good. + * + * Use: Decrypts a message encrypted using @ies_encrypt@, given our + * private key. + */ + +extern int ies_decrypt(kdata */*kpriv*/, unsigned /*ty*/, + buf */*b*/, buf */*bb*/); + /*----- That's all, folks -------------------------------------------------*/ #ifdef __cplusplus