server/admin: New ALGS command.

Returns information about crypto algorithms in use.  Can be used to
compute MTUs, for example.

diff --git a/server/admin.c b/server/admin.c
index c4433e45005e3e34c1375405af64723977da55d0..045727f71a9df12378786e7a2be311cbf33d154d 100644 (file)
--- a/server/admin.c
+++ b/server/admin.c
@@ -1646,6 +1646,34 @@ static void acmd_bgcancel(admin *a, unsigned ac, char *av[])
   }
 }
 
+static void acmd_algs(admin *a, unsigned ac, char *av[])
+{
+  a_info(a,
+        "kx-group=%s", gg->ops->name,
+        "kx-group-order-bits=%lu", (unsigned long)mp_bits(gg->r),
+        "kx-group-elt-bits=%lu", (unsigned long)gg->nbits,
+        A_END);
+  a_info(a,
+        "hash=%s", algs.h->name,
+        "mgf=%s", algs.mgf->name,
+        "hash-sz=%lu", (unsigned long)algs.h->hashsz,
+        A_END);
+  a_info(a,
+        "cipher=%s", algs.c->name,
+        "cipher-keysz=%lu", (unsigned long)algs.cksz,
+        "cipher-blksz=%lu", (unsigned long)algs.c->blksz,
+        A_END);
+  a_info(a,
+        "cipher-data-limit=%lu", (unsigned long)algs.expsz,
+        A_END);
+  a_info(a,
+        "mac=%s", algs.m->name,
+        "mac-keysz=%lu", (unsigned long)algs.mksz,
+        "mac-tagsz=%lu", (unsigned long)algs.tagsz,
+        A_END);
+  a_ok(a);
+}
+
 static void acmd_list(admin *a, unsigned ac, char *av[])
 {
   FOREACH_PEER(p, {  a_info(a, "%s", p_name(p), A_END); });
@@ -1846,6 +1874,7 @@ static void acmd_help(admin */*a*/, unsigned /*ac*/, char */*av*/[]);
 static const acmd acmdtab[] = {
   { "add",     "[OPTIONS] PEER ADDR ...", 2,   0xffff, acmd_add },
   { "addr",    "PEER",                 1,      1,      acmd_addr },
+  { "algs",    0,                      0,      0,      acmd_algs },
   { "bgcancel",        "TAG",                  1,      1,      acmd_bgcancel },
   { "checkchal", "CHAL",               1,      1,      acmd_checkchal },
   { "daemon",  0,                      0,      0,      acmd_daemon },

diff --git a/server/tripe-admin.5.in b/server/tripe-admin.5.in
index 3442b02310bf9f29c8f6cef1e032def0a1c1613f..c493d1872d1ac040f148213fd5f2b9faea1bd359 100644 (file)
--- a/server/tripe-admin.5.in
+++ b/server/tripe-admin.5.in
@@ -344,6 +344,78 @@ Emits an
 line reporting the IP address and port number stored for
 .IR peer .
 .SP
+.B "ALGS"
+Emits information about the cryptographic algorithms in use, in
+key-value form.  The keys are as follows.
+.RS
+.TP
+.B kx-group
+Type of key-exchange group in use, currently either
+.B ec
+or
+.BR prime .
+.TP
+.B kx-group-order-bits
+Length of the group order, in bits.  This gives an approximate measure
+of the group strength.
+.TP
+.B kx-group-elt-bits
+Length of a group element, in bits.  This may be useful when analyzing
+protocol traces.
+.TP
+.B hash
+The hash function in use, e.g.,
+.BR sha256 .
+.TP
+.B mgf
+The mask-generating function in use, e.g.,
+.BR whirlpool-mgf .
+.TP
+.B hashsz
+The size of the hash function's output, in octets.
+.TP
+.B cipher
+The name of the bulk data cipher in use, e.g.,
+.BR blowfish-cbc .
+.TP
+.B cipher-keysz
+The length of key used by the bulk data cipher, in octets.
+.TP
+.B cipher-blksz
+The block size of the bulk data cipher, or zero if it's not based on a
+block cipher.
+.TP
+.B cipher-data-limit
+The maximum amount of data to be encrypted using a single key.  (A new
+key exchange is instigated well before the limit is reached, in order to
+allow for a seamless changeover of keys.)
+.TP
+.B mac
+The message authentication algorithm in use, e.g.,
+.BR ripemd160-hmac ..
+.TP
+.B mac-keysz
+The length of the key used by the message authentication algorithm, in
+octets.
+.TP
+.B mac-tagsz
+The length of the message authentication tag, in octets.
+.PP
+The various sizes are useful, for example, when computing the MTU for a
+tunnel interface.  If
+.I MTU
+is the MTU of the path to the peer, then the tunnel MTU should be
+.IP
+.I MTU
+\- 33 \-
+.I cipher-blksz
+\-
+.I mac-tagsz
+.PP
+allowing 20 bytes of IP header, 8 bytes of UDP header, a packet type
+octet, a four-octet sequence number, an IV, and a MAC tag.
+.RE
+.SP
 .BI "BGCANCEL " tag
 Cancels the background job with the named
 .IR tag .