X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~mdw/git/tripe/blobdiff_plain/91ac51aa6d078ba287972988fc9cca6593bfbe8f..4a3882945f605704ede113a9fe98cd19a92363a7:/server/tripe.h

diff --git a/server/tripe.h b/server/tripe.h
index 72a47a10..10a03f5f 100644
--- a/server/tripe.h
+++ b/server/tripe.h
@@ -9,19 +9,18 @@
  *
  * This file is part of Trivial IP Encryption (TrIPE).
  *
- * TrIPE is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
+ * TrIPE is free software: you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 3 of the License, or (at your
+ * option) any later version.
  *
- * TrIPE is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
+ * TrIPE is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
  *
  * You should have received a copy of the GNU General Public License
- * along with TrIPE; if not, write to the Free Software Foundation,
- * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ * along with TrIPE.  If not, see <https://www.gnu.org/licenses/>.
  */
 
 #ifndef TRIPE_H
@@ -63,10 +62,18 @@
 #include <pwd.h>
 #include <grp.h>
 
+#ifdef HAVE_LIBADNS
+#  define ADNS_FEATURE_MANYAF
+#  include <adns.h>
+#endif
+
 #include <mLib/alloc.h>
 #include <mLib/arena.h>
 #include <mLib/base64.h>
-#include <mLib/bres.h>
+#ifndef HAVE_LIBADNS
+#  include <mLib/bres.h>
+#endif
+#include <mLib/codec.h>
 #include <mLib/daemonize.h>
 #include <mLib/dstr.h>
 #include <mLib/env.h>
@@ -89,22 +96,29 @@
 #include <mLib/versioncmp.h>
 
 #include <catacomb/buf.h>
+#include <catacomb/ct.h>
 
+#include <catacomb/chacha.h>
 #include <catacomb/gcipher.h>
 #include <catacomb/gmac.h>
 #include <catacomb/grand.h>
 #include <catacomb/key.h>
 #include <catacomb/paranoia.h>
+#include <catacomb/poly1305.h>
+#include <catacomb/salsa20.h>
 
 #include <catacomb/noise.h>
 #include <catacomb/rand.h>
 
 #include <catacomb/mp.h>
+#include <catacomb/mpmont.h>
 #include <catacomb/mprand.h>
 #include <catacomb/dh.h>
 #include <catacomb/ec.h>
+#include <catacomb/ec-raw.h>
 #include <catacomb/ec-keys.h>
-#include <catacomb/group.h>
+#include <catacomb/x25519.h>
+#include <catacomb/x448.h>
 
 #include "priv.h"
 #include "protocol.h"
@@ -155,28 +169,254 @@
 
 /*----- Cipher selections -------------------------------------------------*/
 
-typedef struct algswitch {
-  const gccipher *c;			/* Symmetric encryption scheme */
+typedef struct keyset keyset;
+typedef struct algswitch algswitch;
+typedef struct kdata kdata;
+typedef struct admin admin;
+
+typedef struct dhgrp {
+  const struct dhops *ops;
+  size_t scsz;
+} dhgrp;
+
+typedef struct dhsc dhsc;
+typedef struct dhge dhge;
+
+enum {
+  DHFMT_STD,		    /* Fixed-width format, suitable for encryption */
+  DHFMT_HASH,		     /* Deterministic format, suitable for hashing */
+  DHFMT_VAR		       /* Variable-width-format, mostly a bad idea */
+};
+
+typedef struct deriveargs {
+  const char *what;			/* Operation name (hashed) */
+  unsigned f;				/* Flags */
+#define DF_IN 1u			/*   Make incoming key */
+#define DF_OUT 2u			/*   Make outgoing key */
+  const gchash *hc;			/* Hash class */
+  const octet *k;			/* Pointer to contributions */
+  size_t x, y, z;			/* Markers in contributions */
+} deriveargs;
+
+typedef struct bulkalgs {
+  const struct bulkops *ops;
+} bulkalgs;
+
+typedef struct bulkctx {
+  const struct bulkops *ops;
+} bulkctx;
+
+typedef struct bulkchal {
+  const struct bulkops *ops;
+  size_t tagsz;
+} bulkchal;
+
+typedef struct dhops {
+  const char *name;
+
+  int (*ldpriv)(key_file */*kf*/, key */*k*/, key_data */*d*/,
+		kdata */*kd*/, dstr */*t*/, dstr */*e*/);
+	/* Load a private key from @d@, storing the data in @kd@.  The key's
+	 * file and key object are in @kf@ and @k@, mostly in case its
+	 * attributes are interesting; the key tag is in @t@; errors are
+	 * reported by writing tokens to @e@ and returning nonzero.
+	 */
+
+  int (*ldpub)(key_file */*kf*/, key */*k*/, key_data */*d*/,
+	       kdata */*kd*/, dstr */*t*/, dstr */*e*/);
+	/* Load a public key from @d@, storing the data in @kd@.  The key's
+	 * file and key object are in @kf@ and @k@, mostly in case its
+	 * attributes are interesting; the key tag is in @t@; errors are
+	 * reported by writing tokens to @e@ and returning nonzero.
+	 */
+
+  const char *(*checkgrp)(const dhgrp */*g*/);
+	/* Check that the group is valid; return null on success, or an error
+	 * string.
+	 */
+
+  void (*grpinfo)(const dhgrp */*g*/, admin */*a*/);
+	/* Report on the group to an admin client. */
+
+  T( void (*tracegrp)(const dhgrp */*g*/); )
+	/* Trace a description of the group. */
+
+  int (*samegrpp)(const dhgrp */*g*/, const dhgrp */*gg*/);
+	/* Return nonzero if the two group objects represent the same
+	 * group.
+	 */
+
+  void (*freegrp)(dhgrp */*g*/);
+	/* Free a group and the resources it holds. */
+
+  dhsc *(*ldsc)(const dhgrp */*g*/, const void */*p*/, size_t /*sz*/);
+	/* Load a scalar from @p@, @sz@ and return it.  Return null on
+	 * error.
+	 */
+
+  int (*stsc)(const dhgrp */*g*/,
+	       void */*p*/, size_t /*sz*/, const dhsc */*x*/);
+	/* Store a scalar at @p@, @sz@.  Return nonzero on error. */
+
+  dhsc *(*randsc)(const dhgrp */*g*/);
+	/* Return a random scalar. */
+
+  T( const char *(*scstr)(const dhgrp */*g*/, const dhsc */*x*/); )
+	/* Return a human-readable representation of @x@; @buf_t@ may be used
+	 * to hold it.
+	 */
+
+  void (*freesc)(const dhgrp */*g*/, dhsc */*x*/);
+	/* Free a scalar and the resources it holds. */
+
+  dhge *(*ldge)(const dhgrp */*g*/, buf */*b*/, int /*fmt*/);
+	/* Load a group element from @b@, encoded using format @fmt@.  Return
+	 * null on error.
+	 */
+
+  int (*stge)(const dhgrp */*g*/, buf */*b*/,
+	      const dhge */*Y*/, int /*fmt*/);
+	/* Store a group element in @b@, encoded using format @fmt@.  Return
+	 * nonzero on error.
+	 */
+
+  int (*checkge)(const dhgrp */*h*/, const dhge */*Y*/);
+	/* Check a group element for validity.  Return zero if everything
+	 * checks out; nonzero on failure.
+	 */
+
+  int (*eq)(const dhgrp */*g*/, const dhge */*Y*/, const dhge */*Z*/);
+	/* Return nonzero if @Y@ and @Z@ are equal. */
+
+  dhge *(*mul)(const dhgrp */*g*/, const dhsc */*x*/, const dhge */*Y*/);
+	/* Multiply a group element by a scalar, resulting in a shared-secret
+	 * group element.  If @y@ is null, then multiply the well-known
+	 * generator.
+	 */
+
+  T( const char *(*gestr)(const dhgrp */*g*/, const dhge */*Y*/); )
+	/* Return a human-readable representation of @Y@; @buf_t@ may be used
+	 * to hold it.
+	 */
+
+  void (*freege)(const dhgrp */*g*/, dhge */*Y*/);
+	/* Free a group element and the resources it holds. */
+
+} dhops;
+
+typedef struct bulkops {
+  const char *name;
+
+  bulkalgs *(*getalgs)(const algswitch */*asw*/, dstr */*e*/,
+		       key_file */*kf*/, key */*k*/);
+	/* Determine algorithms to use and return a @bulkalgs@ object
+	 * representing the decision.  On error, write tokens to @e@ and
+	 * return null.
+	 */
+
+  T( void (*tracealgs)(const bulkalgs */*a*/); )
+	/* Write trace information about the algorithm selection. */
+
+  int (*checkalgs)(bulkalgs */*a*/, const algswitch */*asw*/, dstr */*e*/);
+	/* Check that the algorithms in @a@ and @asw@ are acceptable.  On
+	 * error, write tokens to @e@ and return @-1@; otherwise return zero.
+	 */
+
+  int (*samealgsp)(const bulkalgs */*a*/, const bulkalgs */*aa*/);
+	/* If @a@ and @aa@ represent the same algorithm selection, return
+	 * nonzero; if not, return zero.
+	 */
+
+  void (*alginfo)(const bulkalgs */*a*/, admin */*adm*/);
+	/* Report on the algorithm selection to an admin client: call
+	 * @a_info@ with appropriate key-value pairs.
+	 */
+
+  size_t (*overhead)(const bulkalgs */*a*/);
+	/* Return the per-packet overhead of the bulk transform, in bytes. */
+
+  size_t (*expsz)(const bulkalgs */*a*/);
+	/* Return the total size limit for the bulk transform, in bytes,
+	 * after which the keys must no longer be used.
+	 */
+
+  bulkctx *(*genkeys)(const bulkalgs */*a*/, const deriveargs */*a*/);
+	/* Generate session keys and construct and return an appropriate
+	 * context for using them.  The offsets @a->x@, @a->y@ and @a->z@
+	 * separate the key material into three parts.  Between @a->k@ and
+	 * @a->k + a->x@ is `my' contribution to the key material; between
+	 * @a->k + a->x@ and @a->k + a->y@ is `your' contribution; and
+	 * between @a->k + a->y@ and @a->k + a->z@ is a shared value we made
+	 * together.  These are used to construct (up to) two collections of
+	 * symmetric keys: one for outgoing messages, the other for incoming
+	 * messages.  If @a->x == 0@ (or @a->y == a->x@) then my (or your)
+	 * contribution is omitted.
+	 */
+
+  bulkchal *(*genchal)(const bulkalgs */*a*/);
+	/* Construct and return a challenge issuing and verification
+	 * context with a fresh random key.
+	 */
+
+  void (*freealgs)(bulkalgs */*a*/);
+	/* Release an algorithm selection object.  (Associated bulk
+	 * encryption contexts and challenge contexts may still exist and
+	 * must remain valid.)
+	 */
+
+  int (*encrypt)(bulkctx */*bc*/, unsigned /*ty*/,
+		 buf */*b*/, buf */*bb*/, uint32 /*seq*/);
+	/* Encrypt the packet in @b@, with type @ty@ (which doesn't need
+	 * encoding separately) and sequence number @seq@ (which must be
+	 * recoverable by @decrypt@), and write the result to @bb@.  On
+	 * error, return a @KSERR_...@ code and/or break the output buffer.
+	 */
+
+  int (*decrypt)(bulkctx */*bc*/, unsigned /*ty*/,
+		 buf */*b*/, buf */*bb*/, uint32 */*seq*/);
+	/* Decrypt the packet in @b@, with type @ty@, writing the result to
+	 * @bb@ and storing the incoming (claimed) sequence number in @seq@.
+	 * On error, return a @KSERR_...@ code.
+	 */
+
+  void (*freectx)(bulkctx */*a*/);
+	/* Release a bulk encryption context and the resources it holds. */
+
+  int (*chaltag)(bulkchal */*bc*/, const void */*m*/, size_t /*msz*/,
+		 uint32 /*seq*/, void */*t*/);
+	/* Calculate a tag for the challenge in @m@, @msz@, with the sequence
+	 * number @seq@, and write it to @t@.  Return @-1@ on error, zero on
+	 * success.
+	 */
+
+  int (*chalvrf)(bulkchal */*bc*/, const void */*m*/, size_t /*msz*/,
+		 uint32 /*seq*/, const void */*t*/);
+	/* Check the tag @t@ on @m@, @msz@ and @seq@: return zero if the tag
+	 * is OK, nonzero if it's bad.
+	 */
+
+  void (*freechal)(bulkchal */*bc*/);
+	/* Release a challenge context and the resources it holds. */
+
+} bulkops;
+
+struct algswitch {
+  const gchash *h; size_t hashsz;	/* Hash function */
   const gccipher *mgf;			/* Mask-generation function */
-  const gchash *h;			/* Hash function */
-  const gcmac *m;			/* Message authentication code */
-  size_t hashsz;			/* Hash output size */
-  size_t tagsz;				/* Length to truncate MAC tags */
-  size_t expsz;				/* Size of data to process */
-  size_t cksz, mksz;			/* Key lengths for @c@ and @m@ */
-} algswitch;
-
-typedef struct kdata {
+  bulkalgs *bulk;			/* Bulk crypto algorithms */
+};
+
+struct kdata {
   unsigned ref;				/* Reference counter */
   struct knode *kn;			/* Pointer to cache entry */
+  uint32 id;				/* The underlying key's id */
   char *tag;				/* Full tag name of the key */
-  group *g;				/* The group we work in */
-  size_t indexsz;			/* Size of exponent for the group */
-  mp *kpriv;				/* The private key (or null) */
-  ge *kpub;				/* The public key */
+  dhgrp *grp;				/* The group we work in */
+  dhsc *k;				/* The private key (or null) */
+  dhge *K;				/* The public key */
   time_t t_exp;				/* Expiry time of the key */
   algswitch algs;			/* Collection of algorithms */
-} kdata;
+};
 
 typedef struct knode {
   sym_base _b;				/* Symbol table intrusion */
@@ -190,8 +430,32 @@ typedef struct knode {
 
 #define HASH_STRING(h, s) GH_HASH((h), (s), sizeof(s))
 
+extern const dhops dhtab[];
+extern const bulkops bulktab[];
+
 /*----- Data structures ---------------------------------------------------*/
 
+/* --- The address-family table --- */
+
+#define ADDRFAM(_)							\
+  _(INET,	want_ipv4)						\
+  _(INET6,	want_ipv6)
+
+enum {
+#define ENUM(af, qf) AFIX_##af,
+  ADDRFAM(ENUM)
+#undef ENUM
+  NADDRFAM
+};
+
+extern const struct addrfam {
+  int af;
+  const char *name;
+#ifdef HAVE_LIBADNS
+  adns_queryflags qf;
+#endif
+} aftab[NADDRFAM];
+
 /* --- Socket addresses --- *
  *
  * A magic union of supported socket addresses.
@@ -200,6 +464,7 @@ typedef struct knode {
 typedef union addr {
   struct sockaddr sa;
   struct sockaddr_in sin;
+  struct sockaddr_in6 sin6;
 } addr;
 
 /* --- Mapping keyed on addresses --- */
@@ -236,7 +501,9 @@ typedef struct seqwin {
  * expiry.
  */
 
-typedef struct keyset {
+enum { DIR_IN, DIR_OUT, NDIR };
+
+struct keyset {
   struct keyset *next;			/* Next active keyset in the list */
   unsigned ref;				/* Reference count for keyset */
   struct peer *p;			/* Pointer to peer structure */
@@ -244,12 +511,10 @@ typedef struct keyset {
   unsigned long sz_exp, sz_regen;	/* Data limits for the keyset */
   T( unsigned seq; )			/* Sequence number for tracing */
   unsigned f;				/* Various useful flags */
-  gcipher *cin, *cout;			/* Keyset ciphers for encryption */
-  size_t tagsz;				/* Length to truncate MAC tags */
-  gmac *min, *mout;			/* Keyset MACs for integrity */
+  bulkctx *bulk;			/* Bulk crypto transform */
   uint32 oseq;				/* Outbound sequence number */
   seqwin iseq;				/* Inbound sequence number */
-} keyset;
+};
 
 #define KSF_LISTEN 1u			/* Don't encrypt packets yet */
 #define KSF_LINK 2u			/* Key is in a linked list */
@@ -277,8 +542,8 @@ typedef struct retry {
 
 typedef struct kxchal {
   struct keyexch *kx;			/* Pointer back to key exchange */
-  ge *c;				/* Responder's challenge */
-  ge *r;				/* My reply to the challenge */
+  dhge *C;				/* Responder's challenge */
+  dhge *R;				/* My reply to the challenge */
   keyset *ks;				/* Pointer to temporary keyset */
   unsigned f;				/* Various useful flags */
   sel_timer t;				/* Response timer for challenge */
@@ -300,9 +565,9 @@ typedef struct keyexch {
   unsigned s;				/* Current state in exchange */
   sel_timer t;				/* Timer for next exchange */
   retry rs;				/* Retry state */
-  mp *alpha;				/* My temporary secret */
-  ge *c;				/* My challenge */
-  ge *rx;				/* The expected response */
+  dhsc *a;				/* My temporary secret */
+  dhge *C;				/* My challenge */
+  dhge *RX;				/* The expected response */
   unsigned nr;				/* Number of extant responses */
   time_t t_valid;			/* When this exchange goes bad */
   octet hc[MAXHASHSZ];			/* Hash of my challenge */
@@ -374,13 +639,14 @@ typedef struct peerspec {
   char *name;				/* Peer's name */
   char *privtag;			/* Private key tag */
   char *tag;				/* Public key tag */
+  char *knock;				/* Knock string, or null */
   const tunnel_ops *tops;		/* Tunnel operations */
   unsigned long t_ka;			/* Keep alive interval */
   addr sa;				/* Socket address to speak to */
-  size_t sasz;				/* Socket address size */
   unsigned f;				/* Flags for the peer */
 #define PSF_KXMASK 255u			/*   Key-exchange flags to set */
 #define PSF_MOBILE 256u			/*   Address may change rapidly */
+#define PSF_EPHEM 512u			/*   Association is ephemeral */
 } peerspec;
 
 typedef struct peer_byname {
@@ -398,6 +664,7 @@ typedef struct peer {
   peer_byaddr *byaddr;			/* Lookup-by-address block */
   struct ping *pings;			/* Pings we're waiting for */
   peerspec spec;			/* Specifications for this peer */
+  int afix;				/* Index of address family */
   tunnel *t;				/* Tunnel for local packets */
   char *ifname;				/* Interface name for tunnel */
   keyset *ks;				/* List head for keysets */
@@ -454,9 +721,14 @@ typedef struct admin_bgop {
 typedef struct admin_resop {
   admin_bgop bg;			/* Background operation header */
   char *addr;				/* Hostname to be resolved */
+#ifdef HAVE_LIBADNS
+  adns_query q;
+#else
   bres_client r;			/* Background resolver task */
+#endif
   sel_timer t;				/* Timer for resolver */
   addr sa;				/* Socket address */
+  unsigned port;			/* Port number chosen */
   size_t sasz;				/* Socket address size */
   void (*func)(struct admin_resop *, int); /* Handler */
 } admin_resop;
@@ -503,7 +775,7 @@ typedef struct admin_jobtable {
   admin_jobentry *v;			/* And the big array of entries */
 } admin_jobtable;
 
-typedef struct admin {
+struct admin {
   struct admin *next, *prev;		/* Links to next and previous */
   unsigned f;				/* Various useful flags */
   unsigned ref;				/* Reference counter */
@@ -517,14 +789,14 @@ typedef struct admin {
   admin_jobtable j;			/* Table of outstanding jobs */
   selbuf b;				/* Line buffer for commands */
   sel_file w;				/* Selector for write buffering */
-} admin;
+};
 
 #define AF_DEAD 1u			/* Destroy this admin block */
 #define AF_CLOSE 2u			/* Client closed connection */
 #define AF_NOTE 4u			/* Catch notifications */
 #define AF_WARN 8u			/* Catch warning messages */
 #ifndef NTRACE
-  #define AF_TRACE 16u			/* Catch tracing */
+#  define AF_TRACE 16u			/* Catch tracing */
 #endif
 #define AF_FOREGROUND 32u		/* Quit server when client closes */
 
@@ -540,6 +812,7 @@ extern sel_state sel;			/* Global I/O event state */
 extern octet buf_i[PKBUFSZ], buf_o[PKBUFSZ], buf_t[PKBUFSZ], buf_u[PKBUFSZ];
 extern const tunnel_ops *tunnels[];	/* Table of tunnels (0-term) */
 extern const tunnel_ops *tun_default;	/* Default tunnel to use */
+extern sel_file udpsock[NADDRFAM];	/* The master UDP sockets */
 extern kdata *master;			/* Default private key */
 extern const char *tag_priv;		/* Default private key tag */
 
@@ -550,7 +823,8 @@ extern unsigned tr_flags;		/* Trace options flags */
 
 /*----- Other macros ------------------------------------------------------*/
 
-#define TIMER noise_timer(RAND_GLOBAL)
+#define QUICKRAND							\
+  do { rand_quick(RAND_GLOBAL); noise_timer(RAND_GLOBAL); } while (0)
 
 /*----- Key management ----------------------------------------------------*/
 
@@ -592,6 +866,19 @@ extern int km_reload(void);
 extern kdata *km_findpub(const char */*tag*/);
 extern kdata *km_findpriv(const char */*tag*/);
 
+/* --- @km_findpubbyid@, @km_findprivbyid@ --- *
+ *
+ * Arguments:	@uint32 id@ = key id to load
+ *
+ * Returns:	Pointer to the kdata object if successful, or null on error.
+ *
+ * Use:		Fetches a public or private key from the keyring given its
+ *		numeric id.
+ */
+
+extern kdata *km_findpubbyid(uint32 /*id*/);
+extern kdata *km_findprivbyid(uint32 /*id*/);
+
 /* --- @km_samealgsp@ --- *
  *
  * Arguments:	@const kdata *kdx, *kdy@ = two key data objects
@@ -654,16 +941,18 @@ extern void kx_start(keyexch */*kx*/, int /*forcep*/);
 /* --- @kx_message@ --- *
  *
  * Arguments:	@keyexch *kx@ = pointer to key exchange context
+ *		@const addr *a@ = sender's IP address and port
  *		@unsigned msg@ = the message code
  *		@buf *b@ = pointer to buffer containing the packet
  *
- * Returns:	---
+ * Returns:	Nonzero if the sender's address was unknown.
  *
  * Use:		Reads a packet containing key exchange messages and handles
  *		it.
  */
 
-extern void kx_message(keyexch */*kx*/, unsigned /*msg*/, buf */*b*/);
+extern int kx_message(keyexch */*kx*/, const addr */*a*/,
+		      unsigned /*msg*/, buf */*b*/);
 
 /* --- @kx_free@ --- *
  *
@@ -690,7 +979,7 @@ extern void kx_free(keyexch */*kx*/);
 
 extern void kx_newkeys(keyexch */*kx*/);
 
-/* --- @kx_init@ --- *
+/* --- @kx_setup@ --- *
  *
  * Arguments:	@keyexch *kx@ = pointer to key exchange context
  *		@peer *p@ = pointer to peer context
@@ -704,8 +993,19 @@ extern void kx_newkeys(keyexch */*kx*/);
  *		exchange.
  */
 
-extern int kx_init(keyexch */*kx*/, peer */*p*/,
-		   keyset **/*ks*/, unsigned /*f*/);
+extern int kx_setup(keyexch */*kx*/, peer */*p*/,
+		    keyset **/*ks*/, unsigned /*f*/);
+
+/* --- @kx_init@ --- *
+ *
+ * Arguments:	---
+ *
+ * Returns:	---
+ *
+ * Use:		Initializes the key-exchange logic.
+ */
+
+extern void kx_init(void);
 
 /*----- Keysets and symmetric cryptography --------------------------------*/
 
@@ -723,30 +1023,21 @@ extern void ks_drop(keyset */*ks*/);
 
 /* --- @ks_gen@ --- *
  *
- * Arguments:	@const void *k@ = pointer to key material
- *		@size_t x, y, z@ = offsets into key material (see below)
+ * Arguments:	@deriveargs *a@ = key derivation parameters (modified)
  *		@peer *p@ = pointer to peer information
  *
  * Returns:	A pointer to the new keyset.
  *
- * Use:		Derives a new keyset from the given key material.  The
- *		offsets @x@, @y@ and @z@ separate the key material into three
- *		parts.  Between the @k@ and @k + x@ is `my' contribution to
- *		the key material; between @k + x@ and @k + y@ is `your'
- *		contribution; and between @k + y@ and @k + z@ is a shared
- *		value we made together.  These are used to construct two
- *		pairs of symmetric keys.  Each pair consists of an encryption
- *		key and a message authentication key.  One pair is used for
- *		outgoing messages, the other for incoming messages.
+ * Use:		Derives a new keyset from the given key material.  This will
+ *		set the @what@, @f@, and @hc@ members in @*a@; other members
+ *		must be filled in by the caller.
  *
  *		The new key is marked so that it won't be selected for output
  *		by @ksl_encrypt@.  You can still encrypt data with it by
  *		calling @ks_encrypt@ directly.
  */
 
-extern keyset *ks_gen(const void */*k*/,
-		      size_t /*x*/, size_t /*y*/, size_t /*z*/,
-		      peer */*p*/);
+extern keyset *ks_gen(deriveargs */*a*/, peer */*p*/);
 
 /* --- @ks_activate@ --- *
  *
@@ -776,6 +1067,11 @@ extern void ks_activate(keyset */*ks*/);
  *		ought to be replaced' notification is only ever given once
  *		for each key.  Also note that this call forces a keyset to be
  *		used even if it's marked as not for data output.
+ *
+ *		The encryption transform is permitted to corrupt @buf_u@ for
+ *		its own purposes.  Neither the source nor destination should
+ *		be within @buf_u@; and callers mustn't expect anything stored
+ *		in @buf_u@ to still
  */
 
 extern int ks_encrypt(keyset */*ks*/, unsigned /*ty*/,
@@ -795,6 +1091,11 @@ extern int ks_encrypt(keyset */*ks*/, unsigned /*ty*/,
  * Use:		Attempts to decrypt a message using a given key.  Note that
  *		requesting decryption with a key directly won't clear a
  *		marking that it's not for encryption.
+ *
+ *		The decryption transform is permitted to corrupt @buf_u@ for
+ *		its own purposes.  Neither the source nor destination should
+ *		be within @buf_u@; and callers mustn't expect anything stored
+ *		in @buf_u@ to still
  */
 
 extern int ks_decrypt(keyset */*ks*/, unsigned /*ty*/,
@@ -875,25 +1176,29 @@ extern int ksl_decrypt(keyset **/*ksroot*/, unsigned /*ty*/,
 
 /* --- @c_new@ --- *
  *
- * Arguments:	@buf *b@ = where to put the challenge
+ * Arguments:	@const void *m@ = pointer to associated message, or null
+ *		@size_t msz@ = length of associated message
+ *		@buf *b@ = where to put the challenge
  *
  * Returns:	Zero if OK, nonzero on error.
  *
  * Use:		Issues a new challenge.
  */
 
-extern int c_new(buf */*b*/);
+extern int c_new(const void */*m*/, size_t /*msz*/, buf */*b*/);
 
 /* --- @c_check@ --- *
  *
- * Arguments:	@buf *b@ = where to find the challenge
+ * Arguments:	@const void *m@ = pointer to associated message, or null
+ *		@size_t msz@ = length of associated message
+ *		@buf *b@ = where to find the challenge
  *
  * Returns:	Zero if OK, nonzero if it didn't work.
  *
  * Use:		Checks a challenge.  On failure, the buffer is broken.
  */
 
-extern int c_check(buf */*b*/);
+extern int c_check(const void */*m*/, size_t /*msz*/, buf */*b*/);
 
 /*----- Administration interface ------------------------------------------*/
 
@@ -903,7 +1208,7 @@ extern int c_check(buf */*b*/);
  *
  * Arguments:	@dstr *d@ = where to leave the formatted message
  *		@const char *fmt@ = pointer to format string
- *		@va_list ap@ = arguments in list
+ *		@va_list *ap@ = arguments in list
  *
  * Returns:	---
  *
@@ -928,7 +1233,7 @@ extern int c_check(buf */*b*/);
  *		  * "[!]..." ... -- @dstr_putf@-like string as single token
  */
 
-extern void a_vformat(dstr */*d*/, const char */*fmt*/, va_list /*ap*/);
+extern void a_vformat(dstr */*d*/, const char */*fmt*/, va_list */*ap*/);
 
 /* --- @a_format@ --- *
  *
@@ -941,7 +1246,20 @@ extern void a_vformat(dstr */*d*/, const char */*fmt*/, va_list /*ap*/);
  *		presentation.
  */
 
-extern void a_format(dstr */*d*/, const char */*fmt*/, ...);
+extern void EXECL_LIKE(0) a_format(dstr */*d*/, const char */*fmt*/, ...);
+
+/* --- @a_info@ --- *
+ *
+ * Arguments:	@admin *a@ = connection
+ *		@const char *fmt@ = format string
+ *		@...@ = other arguments
+ *
+ * Returns:	---
+ *
+ * Use:		Report information to an admin client.
+ */
+
+extern void EXECL_LIKE(0) a_info(admin */*a*/, const char */*fmt*/, ...);
 
 /* --- @a_warn@ --- *
  *
@@ -953,7 +1271,7 @@ extern void a_format(dstr */*d*/, const char */*fmt*/, ...);
  * Use:		Informs all admin connections of a warning.
  */
 
-extern void a_warn(const char */*fmt*/, ...);
+extern void EXECL_LIKE(0) a_warn(const char */*fmt*/, ...);
 
 /* --- @a_notify@ --- *
  *
@@ -965,7 +1283,7 @@ extern void a_warn(const char */*fmt*/, ...);
  * Use:		Sends a notification to interested admin connections.
  */
 
-extern void a_notify(const char */*fmt*/, ...);
+extern void EXECL_LIKE(0) a_notify(const char */*fmt*/, ...);
 
 /* --- @a_create@ --- *
  *
@@ -1096,7 +1414,8 @@ extern void am_remove(addrmap */*m*/, void */*i*/);
  * Use:		Writes a trace message.
  */
 
-T( extern void ps_trace(unsigned /*mask*/, const char */*fmt*/, ...); )
+T( extern void PRINTF_LIKE(2, 3)
+     ps_trace(unsigned /*mask*/, const char */*fmt*/, ...); )
 
 /* --- @ps_warn@ --- *
  *
@@ -1108,7 +1427,7 @@ T( extern void ps_trace(unsigned /*mask*/, const char */*fmt*/, ...); )
  * Use:		Writes a warning message.
  */
 
-extern void ps_warn(const char */*fmt*/, ...);
+extern void PRINTF_LIKE(1, 2) ps_warn(const char */*fmt*/, ...);
 
 /* --- @ps_tunfd@ --- *
  *
@@ -1147,6 +1466,19 @@ extern void ps_quit(void);
 
 /*----- Peer management ---------------------------------------------------*/
 
+/* --- @p_updateaddr@ --- *
+ *
+ * Arguments:	@peer *p@ = pointer to peer block
+ *		@const addr *a@ = address to associate with this peer
+ *
+ * Returns:	Zero if the address was changed; @+1@ if it was already
+ *		right.
+ *
+ * Use:		Updates our idea of @p@'s address.
+ */
+
+extern int p_updateaddr(peer */*p*/, const addr */*a*/);
+
 /* --- @p_txstart@ --- *
  *
  * Arguments:	@peer *p@ = pointer to peer block
@@ -1160,6 +1492,20 @@ extern void ps_quit(void);
 
 extern buf *p_txstart(peer */*p*/, unsigned /*msg*/);
 
+/* --- @p_txaddr@ --- *
+ *
+ * Arguments:	@const addr *a@ = recipient address
+ *		@const void *p@ = pointer to packet to send
+ *		@size_t sz@ = length of packet
+ *
+ * Returns:	Zero if successful, nonzero on error.
+ *
+ * Use:		Sends a packet to an address which (possibly) isn't a current
+ *		peer.
+ */
+
+extern int p_txaddr(const addr */*a*/, const void */*p*/, size_t /*sz*/);
+
 /* --- @p_txend@ --- *
  *
  * Arguments:	@peer *p@ = pointer to peer block
@@ -1290,24 +1636,23 @@ extern const addr *p_addr(peer */*p*/);
 
 /* --- @p_init@ --- *
  *
- * Arguments:	@struct in_addr addr@ = address to bind to
- *		@unsigned port@ = port number to listen to
+ * Arguments:	@struct addrinfo *ailist@ = addresses to bind to
  *
  * Returns:	---
  *
  * Use:		Initializes the peer system; creates the socket.
  */
 
-extern void p_init(struct in_addr /*addr*/, unsigned /*port*/);
+extern void p_init(struct addrinfo */*ailist*/);
 
 /* --- @p_port@ --- *
  *
- * Arguments:	---
+ * Arguments:	@int i@ = address family index to retrieve
  *
  * Returns:	Port number used for socket.
  */
 
-unsigned p_port(void);
+extern unsigned p_port(int /*i*/);
 
 /* --- @p_create@ --- *
  *
@@ -1384,13 +1729,14 @@ extern peer *p_find(const char */*name*/);
 /* --- @p_destroy@ --- *
  *
  * Arguments:	@peer *p@ = pointer to a peer
+ *		@int bye@ = say goodbye to the peer?
  *
  * Returns:	---
  *
  * Use:		Destroys a peer.
  */
 
-extern void p_destroy(peer */*p*/);
+extern void p_destroy(peer */*p*/, int /*bye*/);
 
 /* --- @FOREACH_PEER@ --- *
  *
@@ -1446,51 +1792,57 @@ extern const tunnel_ops tun_slip;
 
 /*----- Other handy utilities ---------------------------------------------*/
 
-/* --- @mpstr@ --- *
+/* --- @timestr@ --- *
  *
- * Arguments:	@mp *m@ = a multiprecision integer
+ * Arguments:	@time_t t@ = a time to convert
  *
- * Returns:	A pointer to the integer's textual representation.
+ * Returns:	A pointer to a textual representation of the time.
  *
- * Use:		Converts a multiprecision integer to a string.  Corrupts
+ * Use:		Converts a time to a textual representation.  Corrupts
  *		@buf_u@.
  */
 
-extern const char *mpstr(mp */*m*/);
+extern const char *timestr(time_t /*t*/);
 
-/* --- @gestr@ --- *
- *
- * Arguments:	@group *g@ = a group
- *		@ge *x@ = a group element
+/* --- @mystrieq@ --- *
  *
- * Returns:	A pointer to the element's textual representation.
+ * Arguments:	@const char *x, *y@ = two strings
  *
- * Use:		Converts a group element to a string.  Corrupts
- *		@buf_u@.
+ * Returns:	True if @x@ and @y are equal, up to case.
  */
 
-extern const char *gestr(group */*g*/, ge */*x*/);
+extern int mystrieq(const char */*x*/, const char */*y*/);
 
-/* --- @timestr@ --- *
+/* --- @afix@ --- *
  *
- * Arguments:	@time_t t@ = a time to convert
+ * Arguments:	@int af@ = an address family code
  *
- * Returns:	A pointer to a textual representation of the time.
+ * Returns:	The index of the address family's record in @aftab@, or @-1@.
+ */
+
+extern int afix(int af);
+
+/* --- @addrsz@ --- *
  *
- * Use:		Converts a time to a textual representation.  Corrupts
- *		@buf_u@.
+ * Arguments:	@const addr *a@ = a network address
+ *
+ * Returns:	The size of the address, for passing into the sockets API.
  */
 
-extern const char *timestr(time_t /*t*/);
+extern socklen_t addrsz(const addr */*a*/);
 
-/* --- @mystrieq@ --- *
+/* --- @getport@, @setport@ --- *
  *
- * Arguments:	@const char *x, *y@ = two strings
+ * Arguments:	@addr *a@ = a network address
+ *		@unsigned port@ = port number to set
  *
- * Returns:	True if @x@ and @y are equal, up to case.
+ * Returns:	---
+ *
+ * Use:		Retrieves or sets the port number in an address structure.
  */
 
-extern int mystrieq(const char */*x*/, const char */*y*/);
+extern unsigned getport(addr */*a*/);
+extern void setport(addr */*a*/, unsigned /*port*/);
 
 /* --- @seq_reset@ --- *
  *
@@ -1517,6 +1869,75 @@ extern void seq_reset(seqwin */*s*/);
 
 extern int seq_check(seqwin */*s*/, uint32 /*q*/, const char */*service*/);
 
+typedef struct ratelim {
+  unsigned n, max, persec;
+  struct timeval when;
+} ratelim;
+
+/* --- @ratelim_init@ --- *
+ *
+ * Arguments:	@ratelim *r@ = rate-limiting state to fill in
+ *		@unsigned persec@ = credit to accumulate per second
+ *		@unsigned max@ = maximum credit to retain
+ *
+ * Returns:	---
+ *
+ * Use:		Initialize a rate-limiting state.
+ */
+
+extern void ratelim_init(ratelim */*r*/,
+			 unsigned /*persec*/, unsigned /*max*/);
+
+/* --- @ratelim_withdraw@ --- *
+ *
+ * Arguments:	@ratelim *r@ = rate-limiting state
+ *		@unsigned n@ = credit to withdraw
+ *
+ * Returns:	Zero if successful; @-1@ if there is unsufficient credit
+ *
+ * Use:		Updates the state with any accumulated credit.  Then, if
+ *		there there are more than @n@ credits available, withdraw @n@
+ *		and return successfully; otherwise, report failure.
+ */
+
+extern int ratelim_withdraw(ratelim */*r*/, unsigned /*n*/);
+
+/* --- @ies_encrypt@ --- *
+ *
+ * Arguments:	@kdata *kpub@ = recipient's public key
+ *		@unsigned ty@ = message type octet
+ *		@buf *b@ = input message buffer
+ *		@buf *bb@ = output buffer for the ciphertext
+ *
+ * Returns:	On error, returns a @KSERR_...@ code or breaks the buffer;
+ *		on success, returns zero and the buffer is good.
+ *
+ * Use:		Encrypts a message for a recipient, given their public key.
+ *		This does not (by itself) provide forward secrecy or sender
+ *		authenticity.  The ciphertext is self-delimiting (unlike
+ *		@ks_encrypt@).
+ */
+
+extern int ies_encrypt(kdata */*kpub*/, unsigned /*ty*/,
+		       buf */*b*/, buf */*bb*/);
+
+/* --- @ies_decrypt@ --- *
+ *
+ * Arguments:	@kdata *kpub@ = private key key
+ *		@unsigned ty@ = message type octet
+ *		@buf *b@ = input ciphertext buffer
+ *		@buf *bb@ = output buffer for the message
+ *
+ * Returns:	On error, returns a @KSERR_...@ code; on success, returns
+ *		zero and the buffer is good.
+ *
+ * Use:		Decrypts a message encrypted using @ies_encrypt@, given our
+ *		private key.
+ */
+
+extern int ies_decrypt(kdata */*kpriv*/, unsigned /*ty*/,
+		       buf */*b*/, buf */*bb*/);
+
 /*----- That's all, folks -------------------------------------------------*/
 
 #ifdef __cplusplus