chiark / gitweb /
secnet.git
7 months agoMakefiles: Use Final.sd.mk to implementing RECHECK_RM master
Ian Jackson [Sun, 16 Feb 2020 18:06:23 +0000 (18:06 +0000)]
Makefiles: Use Final.sd.mk to implementing RECHECK_RM

This is now read by make after all the other makefiles.  This allows
us to move the addition of {stest,mtest}/d-* to RECHECK_RM from
Dir.sd.mk into test-common.sd.mk, where it belongs.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agoMerge subdirmk 0.4
Ian Jackson [Sun, 16 Feb 2020 18:45:25 +0000 (18:45 +0000)]
Merge subdirmk 0.4

git subtree pull.  Fix up test-example/Dir.sd.mk for the incompatible
change (`&${' needs to become `&{').

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agoREADME: Update copyright date
Ian Jackson [Sun, 16 Feb 2020 18:39:51 +0000 (18:39 +0000)]
README: Update copyright date

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agoREADME: Fix documentation errors relating to &{ etc.
Ian Jackson [Sun, 16 Feb 2020 17:29:52 +0000 (17:29 +0000)]
README: Fix documentation errors relating to &{ etc.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agologging: site: Log state on PHASE_RUN entry instead of initially
Ian Jackson [Sun, 16 Feb 2020 15:06:34 +0000 (15:06 +0000)]
logging: site: Log state on PHASE_RUN entry instead of initially

site_startup calls enter_state_run which would print a message, but
logging is not set up that early.  The result is a message printed to
stderr before daemonisation.

We can distinguish this situation from other calls to enter_state_run
because the old state is SITE_STOP, which only occurs between config
reading (closure invocation) and site_startup being called.
So we can suppress this message.

But it did serve a purpose: it would only be printed if the site was
listed in `sites'; otherwise site_startup wouldn't be called and the
`entering state RUN' message would be absent.

So instead we provide a more explicit way to tell: on entering
PHASE_RUN, site_startup has either been called, or not.  And logging
is set up.  state is then STOP or RUN.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agosite: Rename site_phase_hook to site_phase_shutdown_hook
Ian Jackson [Sun, 16 Feb 2020 15:06:00 +0000 (15:06 +0000)]
site: Rename site_phase_hook to site_phase_shutdown_hook

This is misnamed.  And we are going to add yet another phase hook.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agologging: Move "starting" message earlier
Ian Jackson [Sun, 16 Feb 2020 14:47:24 +0000 (14:47 +0000)]
logging: Move "starting" message earlier

We are going to add some log messages to PHASE_RUN hooks.  We want the
overall startup message to come first.  Doing this right after
PHASE_DAEMONIZE makes sense as PHASE_DAEMONIZE now sets up logging,
too.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agosite: Change site->control(bool_t) to site->startup()
Ian Jackson [Sun, 16 Feb 2020 14:23:24 +0000 (14:23 +0000)]
site: Change site->control(bool_t) to site->startup()

This is only ever called with run=True.  We are going to want to rely
on this property.

If we ever do more runtime reconfig that will be done differently.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agologging; site: Do not log transport_peers_clear if already clear
Ian Jackson [Sun, 16 Feb 2020 14:18:49 +0000 (14:18 +0000)]
logging; site: Do not log transport_peers_clear if already clear

This suppresses a pointles message at startup.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agologging: site: Introduce transport_peers_init which doesn't log
Ian Jackson [Sun, 16 Feb 2020 14:21:09 +0000 (14:21 +0000)]
logging: site: Introduce transport_peers_init which doesn't log

This eliminates some spurious startup messages.  It also allows
transport_peers_clear to read *peers, since it doesn't have to do
initialisation.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agologging: start rather earlier
Ian Jackson [Sun, 16 Feb 2020 14:42:31 +0000 (14:42 +0000)]
logging: start rather earlier

This moves some messages printed by by early netlink and polypath
setup to the proper logfile / syslog directly, rather than having them
captured by the stderr capture from daemonize.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agostartup: Break out start_sites
Ian Jackson [Sun, 16 Feb 2020 13:21:00 +0000 (13:21 +0000)]
startup: Break out start_sites

We were going to want to change when this happens.  But actually it
seems that is not right.  Keep the commit anyway, as I think it
improves clarity a bit.

No functional change.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agochangelog: Start 0.6.1
Ian Jackson [Sun, 16 Feb 2020 13:00:49 +0000 (13:00 +0000)]
changelog: Start 0.6.1

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agoFinalise 0.6.0 v0.6.0
Ian Jackson [Sun, 16 Feb 2020 12:48:27 +0000 (12:48 +0000)]
Finalise 0.6.0

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agoconfigure[.ac]: Arrange to cope with jessie's gcc
Ian Jackson [Sun, 16 Feb 2020 12:39:39 +0000 (12:39 +0000)]
configure[.ac]: Arrange to cope with jessie's gcc

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agoRevert "site, pubkeys: Avoid for (int a=..."
Ian Jackson [Sun, 16 Feb 2020 12:40:51 +0000 (12:40 +0000)]
Revert "site, pubkeys: Avoid for (int a=..."

This reverts commit 983e0900816ece898f3d53a530fe0f2c73932bbc.

7 months agosite, pubkeys: Avoid for (int a=...
Ian Jackson [Sun, 16 Feb 2020 12:11:34 +0000 (12:11 +0000)]
site, pubkeys: Avoid for (int a=...

In jessie, gcc hates this unless you pass -std=gnu11 or something.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agomake-secnet-sites: Do ascii conversion after % format
Ian Jackson [Sun, 16 Feb 2020 12:10:50 +0000 (12:10 +0000)]
make-secnet-sites: Do ascii conversion after % format

In Python 3.4 (jessie) the % operator cannot take a bytes format.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agochangelog: Fix typo
Ian Jackson [Sun, 16 Feb 2020 11:27:43 +0000 (11:27 +0000)]
changelog: Fix typo

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agopretest-to-tested: Do not descend into subtree histories
Ian Jackson [Sat, 15 Feb 2020 22:05:52 +0000 (22:05 +0000)]
pretest-to-tested: Do not descend into subtree histories

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agochangelog: tidy up changes since 0.5.1
Ian Jackson [Fri, 14 Feb 2020 20:45:23 +0000 (20:45 +0000)]
changelog: tidy up changes since 0.5.1

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agochangelog: tidy up changes since 0.5.1
Ian Jackson [Fri, 14 Feb 2020 19:13:37 +0000 (19:13 +0000)]
changelog: tidy up changes since 0.5.1

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agochangelog: add notes about changes since 0.5.1
Ian Jackson [Fri, 14 Feb 2020 18:30:05 +0000 (18:30 +0000)]
changelog: add notes about changes since 0.5.1

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agochangelog: work on documentation of changes since ea31544cc33a
Ian Jackson [Fri, 14 Feb 2020 15:52:11 +0000 (15:52 +0000)]
changelog: work on documentation of changes since ea31544cc33a

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agosig: Abolish sethash and defhash everywhere
Ian Jackson [Thu, 13 Feb 2020 17:13:11 +0000 (17:13 +0000)]
sig: Abolish sethash and defhash everywhere

The only consumer of this wrongheaded interface was rsa1, which has
been updated.  Delete it all.

There is nothing to delete in the documentation, mostly because much
of this wasn't documented when we introduced it.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agorsa: Bring hash selection in-house
Ian Jackson [Thu, 13 Feb 2020 17:10:56 +0000 (17:10 +0000)]
rsa: Bring hash selection in-house

In
  13b8fbf4548f3457b02afd36e9284d39839d6f85
  sig: Move hashing into algorithm
we introduced a scheme were for rsa1 the hash function is stored
in the signature scheme's key structure, but provided by the caller.

The intent was to allow defaulting, with context-specific overrides.
However, this does not work correctly.  In particular, most sites
have a single "local-key" setting at the top level in the main config,
but take "hash" keys from the sites file.

The result is that as the various sites are initialised, ->sethash is
called multiple times, once for each site.  Possibly with different
hash_if's.  I did not foresee this and it is clearly wrong.

If all the hash_if's are sha1 then this is harmless.  However, they
might not be, in particular if certain site(s) or vpn(s) in the sites
file(s) specify a different hash.  Such a configuration would be
rather wrong, because it would imply reuse of the same raw RSA key
material with a different hash function.  (Also since the default hash
is sha1 and historically the only alternative was md5, this is surely
wrong simply because it implies md5 is being used somewhere.)

But it has come to my attention that such installations exist.  Even a
non-operational, vestigial, use of a different hash, can cause
lossage.

To fix this properly and allow hash-agility with a single private key,
we would have to have call sites continue to look up the hash, but to
pass in into the signature function.  This is too annoying,
particularly when it is in support only of unreasonable and very old
configurations.

Instead, change the semantics so that the two rsa closure verbs nail
down their hash at key load time, defaulting to sha1.  The "hash"
config key is now looked up sort of implicitly in the context.  This
is slightly odd, but it has roughly the right effect with sites.conf
files generated by make-secnet-sites.  And it is contained within the
rsa1 signature scheme which is a thing we should be replacing anyway.

This change makes it more clearly impossible (as it has, in fact, been
since 0.4.x) to use the same loaded private key with different hashes.

Installations which are only using sha1 with their rsa1 will just keep
working an all is well.

Installations which are using md5 everywhere can be made to work by
adding a global config hash= setting in every instance.

Installations which are using a mixture have a more complicated task
to keep things working (maybe loading the key twice, or propagating
hash information in sites files, or something), if they don't want a
flag day transition to sha1.

In the future for rsa1, what hash a site is using becomes a property
which should be carried with public key; so a non-sha1 hash must be
specified in the config file (alongside `local-key') and also
documented in the sites file entry.

For forthcoming non-rsa1 algorithms hash choice will be handled within
the signature scheme in a less irregular way, and this "hash" key will
thereby become obsolete.

Reported-by: Matthew Vernon <matthewv@chiark.greenend.org.uk>
Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agoconfig: Reject rather than silently ignoring wrong closure values
Ian Jackson [Thu, 13 Feb 2020 17:02:57 +0000 (17:02 +0000)]
config: Reject rather than silently ignoring wrong closure values

find_cl_if(...,fail_if_invalid=False,,..) is only called in places
where a particular closure, or nothing, is expected.

It is really not a good idea for this function to silently ignore
config keys of the wrongn type.  It should behave more like
dict_read_number and dict_read_bool.

There are possible compatibility implications, but they can be solved
by deleting the wrong (currently-ignored) information from the config
file(s).

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agosha1: Provide sha1_hash_if
Ian Jackson [Thu, 13 Feb 2020 16:55:51 +0000 (16:55 +0000)]
sha1: Provide sha1_hash_if

This will be useful in a moment.

As a side effect, the sha1 st is statically allocated now.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agorsa: Provide dict context argument in load_ctx
Ian Jackson [Thu, 13 Feb 2020 16:48:37 +0000 (16:48 +0000)]
rsa: Provide dict context argument in load_ctx

This is going to be used to make the old rsa-public and rsa-private
names honour a "hash" dictionary key in the context.

The new generic privcache and keyset machinery will use a fixed hash
so does not pass the dictionary.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agomobile sites: Do not ever expire peer addresses
Ian Jackson [Sun, 2 Feb 2020 12:22:57 +0000 (12:22 +0000)]
mobile sites: Do not ever expire peer addresses

For mobile sites, peer addresses come from our config or DNS name
lookup.  Ones that are not working now may work later in a different
network environment.  The mobile end is in charge of public path
selection so it needs to retain the information to try these
currently-non-working addresses.

In practice, this change allows me to switch backwards and forwards
between the FOSDEM v6-only wifi, and my v4-only USB stick.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agotest-example: Use subdirmk's new &:macro feature
Ian Jackson [Mon, 30 Dec 2019 12:02:26 +0000 (12:02 +0000)]
test-example: Use subdirmk's new &:macro feature

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agosite: Always advertise all capabilities
Ian Jackson [Sat, 14 Dec 2019 15:19:32 +0000 (15:19 +0000)]
site: Always advertise all capabilities

The first version that can cope with this is 0.3.0 which is already
quite old (September 2013).  All older versions are quite badly
broken: eg, they use the serpent256-cbc transform.

This is the next phase in eventually getting rid of the distinction
between early and late capabilities.  When every running version of
secnet has this commit, we can declare every capability early since
every secnet will always advertise them early.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agobuild system: Fix race bug in recheck target
Ian Jackson [Sat, 14 Dec 2019 13:35:45 +0000 (13:35 +0000)]
build system: Fix race bug in recheck target

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agodh: Fix mpz padding bug in use of write_mpbin
Ian Jackson [Sun, 8 Dec 2019 13:15:37 +0000 (13:15 +0000)]
dh: Fix mpz padding bug in use of write_mpbin

If the BN needs less than buflen bytes, write_mpbin would write only
the first len bytes.  dh_makeshared wouldn't notice.  The remaining
bytes will be left uninitialised.

In current code this is only called from site.c, where it so happens
right now that this buffer is always zero on entry.  So the effect is
thst we pad the bignum with zeroes at the LS end, which is wrong.

We can't just change this because it's baked into the protocol.
So actually implement it properly.

We do this in the write_mpbin function, renaming it, because the old
API for write_mpbin invites precisely this error.

I don't think this is of an significant consequence
cryptographically.  Perhaps we should introduce a non-anomalous
version of DH over prime fields.  Or perhaps we should just leave it
as is and expect to switch to X448 or something.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agodh: move write_mpbin in to dh.c
Ian Jackson [Sun, 8 Dec 2019 13:13:34 +0000 (13:13 +0000)]
dh: move write_mpbin in to dh.c

This function has a hazardous API.  In fact, the one call site misuses
it, as we shall see in a moment.

If we wanted a thing like this with a less hazardous API we probably
wouldn't base it on mpz_get_str nowadays.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agostest: Print spawn rune on a line by itself
Ian Jackson [Sun, 8 Dec 2019 13:04:01 +0000 (13:04 +0000)]
stest: Print spawn rune on a line by itself

Especially useful with SECNET_STEST_DIVERT_*=i...: now you can c&p the
whole line.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agostest: Allow SECNET_STEST_DIVERT_*='i <some stuff>'
Ian Jackson [Sun, 8 Dec 2019 12:56:16 +0000 (12:56 +0000)]
stest: Allow SECNET_STEST_DIVERT_*='i <some stuff>'

Eg,
  SECNET_STEST_DIVERT_inside='i gdb --args'
which causes it to print something like this
  spawn UDP_PRELOAD_DIR=./stest/d-nonnego-oo/s LD_PRELOAD=./stest/udp-preload.so:libgtk3-nocsd.so.0 gdb --args ./secnet -dvnc ./stest/d-nonnego-oo/inside.conf
which is convenient.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agostest: Require SECNET_STEST_DIVERT_* paths to start / or ./
Ian Jackson [Sun, 8 Dec 2019 12:51:40 +0000 (12:51 +0000)]
stest: Require SECNET_STEST_DIVERT_* paths to start / or ./

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agostest: When SECNET_STEST_DIVERT_* set, print diverted command too
Ian Jackson [Sun, 8 Dec 2019 12:50:21 +0000 (12:50 +0000)]
stest: When SECNET_STEST_DIVERT_* set, print diverted command too

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agostest: Move puts $argl into divert branches
Ian Jackson [Sun, 8 Dec 2019 12:49:55 +0000 (12:49 +0000)]
stest: Move puts $argl into divert branches

We're going to want to do something slightly different in each one.

No functional change yet.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agostest: Honour SECNET_STEST_TIMEOUT_MUL to multiply timeouts
Ian Jackson [Sun, 8 Dec 2019 12:46:11 +0000 (12:46 +0000)]
stest: Honour SECNET_STEST_TIMEOUT_MUL to multiply timeouts

This is handy, for example, when running under valgrind.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agostest: Introduce adj-after
Ian Jackson [Sun, 8 Dec 2019 11:24:39 +0000 (11:24 +0000)]
stest: Introduce adj-after

We are going to want this to do something more complicated.

No functional change.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agoparallel bisect scripts: Honour $1 as iteration count
Ian Jackson [Sun, 8 Dec 2019 10:58:45 +0000 (10:58 +0000)]
parallel bisect scripts: Honour $1 as iteration count

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agoparallel bisect scripts: Better logging
Ian Jackson [Sun, 8 Dec 2019 02:15:48 +0000 (02:15 +0000)]
parallel bisect scripts: Better logging

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agoparallel bisect scripts: ad-hoc
Ian Jackson [Sun, 8 Dec 2019 02:07:02 +0000 (02:07 +0000)]
parallel bisect scripts: ad-hoc

This is as I just used to bisect a P(1/256) bug.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agosite: Move earlier all things needed for slog
Ian Jackson [Sun, 8 Dec 2019 10:19:19 +0000 (10:19 +0000)]
site: Move earlier all things needed for slog

Before this we actually read uninitialised memory!
But it was st->log_events which was generally all-bit-zero.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agolog: Remove a now-redundant conditional
Ian Jackson [Sun, 8 Dec 2019 10:19:02 +0000 (10:19 +0000)]
log: Remove a now-redundant conditional

system_log is always non-NULL now.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agolog: Provide system_log from the very start
Ian Jackson [Sun, 8 Dec 2019 10:17:27 +0000 (10:17 +0000)]
log: Provide system_log from the very start

It is just too inconvenient not to have this while reading the config.
Set up a default system_log which logs to stderr.  When setup_log
is called, system_log will be overwritten and this struct is no
longer used.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agolog: Break out logfile_file_init
Ian Jackson [Sun, 8 Dec 2019 10:16:55 +0000 (10:16 +0000)]
log: Break out logfile_file_init

We are going to reuse this.

No functional change.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agostest: Add test for load-private
Ian Jackson [Sat, 7 Dec 2019 16:05:37 +0000 (16:05 +0000)]
stest: Add test for load-private

The resulting interface for privkey() is a bit odd: it's either a list
of a string, and we look at both ends.  Ah well, it's only test code.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agoload-private: Use cfgfile_log, not system_log
Ian Jackson [Sat, 7 Dec 2019 16:30:17 +0000 (16:30 +0000)]
load-private: Use cfgfile_log, not system_log

Otherwise if this goes wrong, we segfault, because system_log is in
fact not available this early.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agosecnet: Provide `load-private' verb
Ian Jackson [Sat, 7 Dec 2019 14:25:53 +0000 (14:25 +0000)]
secnet: Provide `load-private' verb

This allows the config file to specify the use of the scheme loadpriv
call with an arbitrary private key file and algorithm, without having
to enable the private key negotiation system.

This is the private key counterpart to
  secnet: Provide `make-public' verb

Like the first provision of `make-public', there is a bug: we use
system_log for reporting errors, but that is not set up until after
the configuration is read.  So errors turn into segfaults.  We will
fix that in a moment.

Aside from that, with this change, new public key schemes can just
provide an entry in the sigschemes table.  They do not need to (and
should not) define their own toplevel config bindings.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agoprivcache: Break out DEFAULT_MAXPRIV_BYTES
Ian Jackson [Sat, 7 Dec 2019 16:31:08 +0000 (16:31 +0000)]
privcache: Break out DEFAULT_MAXPRIV_BYTES

We're going to reuse this.

No functional change.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agosecnet: loadpriv interface: Return a closure_t too
Ian Jackson [Sat, 7 Dec 2019 14:57:04 +0000 (14:57 +0000)]
secnet: loadpriv interface: Return a closure_t too

We are going to want this for the `load-private' verb.
This is the private key counterpart to:
   secnet: loadpub interface: Return a closure_t too

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agoprivcache: Minor style fixes
Ian Jackson [Sat, 7 Dec 2019 15:41:06 +0000 (15:41 +0000)]
privcache: Minor style fixes

We had some unconventional-for-secnet whitespace around `='.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agoprivcache: Regularise error handling in missing defhash case
Ian Jackson [Sat, 7 Dec 2019 14:49:50 +0000 (14:49 +0000)]
privcache: Regularise error handling in missing defhash case

Now it is clearer to see that we don't leak sigpriv;

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agoprivcache; uncached_load_file: Introduce error_out
Ian Jackson [Sat, 7 Dec 2019 14:43:54 +0000 (14:43 +0000)]
privcache; uncached_load_file: Introduce error_out

The error handling here is a bit fragile: we rely on not having set
`ok' inappropriately.  Indeed actually we *do* set `ok'
inappropriately if we lack defhash, but in that case we set sigpriv to
0 so do return 0 as needed.  So we are fixing a latent bug.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agoCL_GET_STR_ARG: Move into util.h
Ian Jackson [Sat, 7 Dec 2019 14:19:44 +0000 (14:19 +0000)]
CL_GET_STR_ARG: Move into util.h

Move this handy macro from pubkeys.c so that we can reuse it.
(And rename it appropriately.)

No functional change.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agoprivcache: Break out uncached_load_file
Ian Jackson [Sat, 7 Dec 2019 14:13:24 +0000 (14:13 +0000)]
privcache: Break out uncached_load_file

We are going to want to reuse this to make a new entrypoint.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agoprivcache: Transpose scheme lookup and file opening
Ian Jackson [Sat, 7 Dec 2019 14:04:58 +0000 (14:04 +0000)]
privcache: Transpose scheme lookup and file opening

This makes no real difference, except that it provides a different
error message if both things are wrong.

This new odrering is more consistent with a change we are about to
make.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agoprivcache: uncached_get: Introduce `databuf' local
Ian Jackson [Sat, 7 Dec 2019 14:02:49 +0000 (14:02 +0000)]
privcache: uncached_get: Introduce `databuf' local

This is a bit more convenient and will also make a future commit much
easier too read.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agoprivcache: uncached_get: Introduce `defhash' local
Ian Jackson [Sat, 7 Dec 2019 14:01:57 +0000 (14:01 +0000)]
privcache: uncached_get: Introduce `defhash' local

This is a bit more convenient and will also make a future commit much
easier too read.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agoprivcache: uncached_get: Introduce `path' local
Ian Jackson [Sat, 7 Dec 2019 13:01:32 +0000 (13:01 +0000)]
privcache: uncached_get: Introduce `path' local

This is a bit more convenient and will also make a future commit much
easier too read.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agostest/t-Cnonnego-onr: New test
Ian Jackson [Thu, 5 Dec 2019 01:24:02 +0000 (01:24 +0000)]
stest/t-Cnonnego-onr: New test

Check that the new site can initiate key exchange when talking to a
old one, as well as vice versa.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agostest: Make it possible to have kex initiated by `outside'
Ian Jackson [Thu, 5 Dec 2019 01:23:16 +0000 (01:23 +0000)]
stest: Make it possible to have kex initiated by `outside'

Introduce new `initiator' variable.  No functional change (other than
to messages) with existing tests.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agosest/t-Cnonnego-on: New test
Ian Jackson [Thu, 5 Dec 2019 00:58:16 +0000 (00:58 +0000)]
sest/t-Cnonnego-on: New test

See if we can do key exchange with an older secnet, if the user has
told us where to find one to try it with.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agostest: Machinery for runing an old secnet if a test wants
Ian Jackson [Thu, 5 Dec 2019 00:58:10 +0000 (00:58 +0000)]
stest: Machinery for runing an old secnet if a test wants

Tests can now set oldsecnet(SITE).

Old secnets want a "filename" key in their log config.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agotest-common: Framework for compatibility tests
Ian Jackson [Fri, 6 Dec 2019 23:00:53 +0000 (23:00 +0000)]
test-common: Framework for compatibility tests

Now normal tests must start with a letter.  Ones starting with C
require OLD_SECNET_DIR.  (Right now that must be both source and build
dir because it's tedious to have to distinguish them and pass both.)

Update comprehensive-test to (i) notice if the user forgot to set
this (ii) make it into an absolute path.  Note that comprehensive-test
therefore has a different default to `make check': If OLD_SECNET_DIR
is not set, `make check' will do none of those tests, but
comprehensive-test will complain (and wants "" to disable those
tests).

We do not need to print this variable in our debugging output about
how we are running secnet (or how the user who specifies _DIVERT_=i
should run it).

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agotest-common: Use $(wildcard ) rather than $(shell echo )
Ian Jackson [Thu, 5 Dec 2019 01:18:26 +0000 (01:18 +0000)]
test-common: Use $(wildcard ) rather than $(shell echo )

This is probably a bit faster, but more relevantly it would DTRT if
for some reason there were no applicable tests.  Which is going to
happen in a moment, when we add some machinery before the applicable
test.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agomtest/t-filter: New test for --filter mode
Ian Jackson [Wed, 4 Dec 2019 22:06:37 +0000 (22:06 +0000)]
mtest/t-filter: New test for --filter mode

Checked the output with
  env -u LESS git-diff --color --word-diff -w :test-example/sites :mtest/e-filter.sites
and it looks right.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agomake-secnet-sites: Provide --filter mode
Ian Jackson [Wed, 4 Dec 2019 16:56:31 +0000 (16:56 +0000)]
make-secnet-sites: Provide --filter mode

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agoREADME.make-secnet-sites: Slightly restructure mode docs
Ian Jackson [Wed, 4 Dec 2019 16:54:59 +0000 (16:54 +0000)]
README.make-secnet-sites: Slightly restructure mode docs

This will make it easier to add a new mode.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agomake-secnet-sites: OpConf: Move positional_args to OpBase
Ian Jackson [Wed, 4 Dec 2019 16:51:52 +0000 (16:51 +0000)]
make-secnet-sites: OpConf: Move positional_args to OpBase

This is actually a general-purpose input/output file handler.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agomake-secnet-sites: OpUserv: Rename sitesfile to outputfile
Ian Jackson [Wed, 4 Dec 2019 16:50:48 +0000 (16:50 +0000)]
make-secnet-sites: OpUserv: Rename sitesfile to outputfile

This is not entirely right for OpUserv because OpUserv reads it too.
But this is going to make sense when we reuse more of OpBase.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agomake-secnet-sites: OpBase.write_out: Move heading back into OpUserv
Ian Jackson [Wed, 4 Dec 2019 16:44:58 +0000 (16:44 +0000)]
make-secnet-sites: OpBase.write_out: Move heading back into OpUserv

This relies on self.user, and in more general cases we want the output
to be reproducible so don't want the time either.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agomake-secnet-sites: OpBase.write_out: Tolerate sitesfile is None
Ian Jackson [Wed, 4 Dec 2019 16:42:46 +0000 (16:42 +0000)]
make-secnet-sites: OpBase.write_out: Tolerate sitesfile is None

This will let us write to stdout.  The only user right now is OpUserv
which always sets sitesfile so no functional change yet.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agomake-secnet-sites: Abolish now-obsolete `service' variable
Ian Jackson [Wed, 4 Dec 2019 16:38:02 +0000 (16:38 +0000)]
make-secnet-sites: Abolish now-obsolete `service' variable

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agomake-secnet-sites: Provide explicit --conf mode option
Ian Jackson [Wed, 4 Dec 2019 16:35:44 +0000 (16:35 +0000)]
make-secnet-sites: Provide explicit --conf mode option

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agomake-secnet-sites: OpBase.read_in: save read lines
Ian Jackson [Wed, 4 Dec 2019 16:33:52 +0000 (16:33 +0000)]
make-secnet-sites: OpBase.read_in: save read lines

We are going to use this for a new filtering mode.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agomake-secnet-sites: Move sites file writing into OpBase
Ian Jackson [Wed, 4 Dec 2019 16:32:41 +0000 (16:32 +0000)]
make-secnet-sites: Move sites file writing into OpBase

We provide a callback for the contents.

This is in OpBase rather than OpUserv because we are going to want to
reuse it.

No functional change.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agomake-secnet-sites: Refactor operational code into OpModes
Ian Jackson [Wed, 4 Dec 2019 16:19:23 +0000 (16:19 +0000)]
make-secnet-sites: Refactor operational code into OpModes

Everywhere we had conditionals on `service', move the two arms of the
if into methods on OpConf and OpUserv (of which we make one
singleton).

Many global variables become instance variables on the OpMode object.

The read_in method of OpConf is in OpBase because we are going to want
to reuse it.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agomake-secnet-sites: Introduce new OpMod classes
Ian Jackson [Wed, 4 Dec 2019 16:06:58 +0000 (16:06 +0000)]
make-secnet-sites: Introduce new OpMod classes

This is going to replace the use of the `service' boolean.
Mode-specific functionality will be moved into these classes.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agostest/t-nonnego-oo: Use `make-public' verb
Ian Jackson [Tue, 3 Dec 2019 23:33:16 +0000 (23:33 +0000)]
stest/t-nonnego-oo: Use `make-public' verb

This was previously untested.  It is awkward to get make-secnet-sites
to generate this right now because it wants to generate `rsa-public'
calls for rsa1 keys for compatibility reasons.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agostest: Honour new sitesconf_hook
Ian Jackson [Tue, 3 Dec 2019 23:26:20 +0000 (23:26 +0000)]
stest: Honour new sitesconf_hook

This lets individual tests fiddle with the sites.conf.

By default, we provide a proc that does nothing.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agomtest: Use --pubkeys-elide instead of --output-version
Ian Jackson [Sun, 1 Dec 2019 14:00:41 +0000 (14:00 +0000)]
mtest: Use --pubkeys-elide instead of --output-version

We don't want our basic tests of make-secnet-sites to produce an
artificially old output version.

But also it's not really convenient for these tests to make a pubkeys
directory.  (That functionality is tested by test-example's sites.conf
generator and stest's uses of the resulting pubkeys directory.)

So use --pubkeys-elide, conveniently producing a test case for that
option, which we were previously lacking.

Because we don't pass --pubkeys-dir, the result is that the output
paths contain the default pubkeys directory.  That's OK.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agostest: Fix an entry in &DEPS
Ian Jackson [Wed, 4 Dec 2019 21:54:31 +0000 (21:54 +0000)]
stest: Fix an entry in &DEPS

We don't want to refer to all-privkeys, actually.  This is a phony
target and causes needless rebuilds (well, retests).

Instead, depend on the now-provided $(test-example_PRIVKEYS).

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agotest-example: all-privkeys: Define, and indirect through, a variable
Ian Jackson [Wed, 4 Dec 2019 21:58:54 +0000 (21:58 +0000)]
test-example: all-privkeys: Define, and indirect through, a variable

This seems more natural.  Also it provides a variable
$(test-example_PRIVKEYS) which can be used elsewhere.  (We are in fact
going to want that.)

One resulting change is that now the keys in *.privkeys/ are part of
&TARGETS too.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agotest-example: Test new long-term key arrangements
Ian Jackson [Sat, 16 Nov 2019 17:39:50 +0000 (17:39 +0000)]
test-example: Test new long-term key arrangements

Finally we can test this!

Specifically, we switch the defaults to the privkeys directories,
which affects the existing t-basic-kex test.  We introduce two new
tests for testing the old arrangements.

The consequences for the t-basic-kex test are:
 * Use the sites file generated with --install-pubkeys, thus
   testing the new make-secnet-sites.
 * Use peer-keys, so testing secnet's new pubkey loading
   mechanisms.
 * Use priv-cache, so testing secnet's new privkey loading
   mechanisms.
 * Test the new public key choice negotation mechanism.

The old tests tests the compatibility of the key choice negotiation
mechanism, as well as the capability to generate
old-style (compatible) sites.conf files.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agotest-example: Generate new style sites.conf
Ian Jackson [Sun, 29 Dec 2019 14:44:59 +0000 (14:44 +0000)]
test-example: Generate new style sites.conf

The key change here is to make the `normal' test-exampple/sites.conf
file be new-style, with peer-keys entries.

We also switch the tests to use the old-style file.  So the tests in
fact run just as before.

The directory we give to make-secnet-sites is already mkdir'd, and
cleaned, appropriately.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agotest-example: Make sites.conf variable, in principle
Ian Jackson [Tue, 3 Dec 2019 21:52:07 +0000 (21:52 +0000)]
test-example: Make sites.conf variable, in principle

In this commit we split the setting of the sites.conf into two
branches depending on the value of privkey($site).  The path prefix
is common - only the leafname varies.

Right now there isn't actually any change because both branches use
the same sites.conf.  The new-style arrangement needs a new-style
sites file which isn't there yet.

So no functional change.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agotest-example: Provide a new-style public key set for site outside
Ian Jackson [Fri, 8 Nov 2019 20:09:39 +0000 (20:09 +0000)]
test-example: Provide a new-style public key set for site outside

With --output-version=1, this produces the same output.

The base91 data here is the output of
  base91s/base91s -w0 <test-example/rsa1-sites2.key.pub

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agotests: Pass --output-version=1 to make-secnet-sites
Ian Jackson [Sun, 1 Dec 2019 11:35:02 +0000 (11:35 +0000)]
tests: Pass --output-version=1 to make-secnet-sites

We are going to introduce some new public keys in the sites file but
for now we don't want to change the sites.conf output.  This is what
--output-version is for.

Later we will relegate this to compatibility tests, and make the new
approach the default.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agostest: Honour new privkey() hash
Ian Jackson [Tue, 3 Dec 2019 21:03:46 +0000 (21:03 +0000)]
stest: Honour new privkey() hash

If set to a path not ending in /, it refers to a key file, and we
generate the "rsa-private" call.  With the default value, this
produces the same path as before.

But now it can be set to a directory ending in /, in which case we
specify a priv-cache.

No functional change yet.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agostest: Provide a global `hash' key
Ian Jackson [Tue, 3 Dec 2019 21:00:24 +0000 (21:00 +0000)]
stest: Provide a global `hash' key

This is mostly going to be for the benefit of priv-cache, which we are
going to start using.  But putting it at the top level seems sensible.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agostest: Transfer pubkeys from test-example
Ian Jackson [Tue, 3 Dec 2019 20:56:42 +0000 (20:56 +0000)]
stest: Transfer pubkeys from test-example

We are going to have tests which use the peer-keys site config key,
which refers to external key files from a pubkeys directory.  In the
case of stest, these are pubkeys from test-example.

Because secnet may rename files etc. in this directory, we need a
private one per test.  So, for each test, when making the config file,
make a copy of the pubkeys directory.  Of course this means that
directory needs to exist, so mkdir it (and clean it), although the
machinery for populating it doesn't exist yet.

Also, when copying the sites.conf file, adjust references to
test-example to refer to the copy.  (Currently there won't be any such
references.)

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agotest-example: Add a 2nd rsa1 key
Ian Jackson [Sat, 16 Nov 2019 15:50:49 +0000 (15:50 +0000)]
test-example: Add a 2nd rsa1 key

We add it to the build rules so we install it in privkeys, and so on,
but right now we don't do anything with it.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agotest-example: Add the inside.key to the privcache too
Ian Jackson [Sun, 24 Nov 2019 00:28:38 +0000 (00:28 +0000)]
test-example: Add the inside.key to the privcache too

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agotest-example: Make privkeys by default
Ian Jackson [Sat, 23 Nov 2019 18:55:20 +0000 (18:55 +0000)]
test-example: Make privkeys by default

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agotest-example: Rules for making a privkeys directory
Ian Jackson [Mon, 2 Dec 2019 13:45:16 +0000 (13:45 +0000)]
test-example: Rules for making a privkeys directory

This generates a directory suitable for use with the priv-cache
closure.  Nothing uses it yet.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
7 months agomake-secnet-sites: Declare `pubkey' directive old
Ian Jackson [Fri, 8 Nov 2019 23:32:31 +0000 (23:32 +0000)]
make-secnet-sites: Declare `pubkey' directive old

In help output and error messages.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>