X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=secnet.git;a=blobdiff_plain;f=secnet.h;h=79a3fc448e4a1a3a8ca81333746f0e12ee091e75;hp=7da7c2d5a9935a7cd6bbb8285c8921faa7506594;hb=HEAD;hpb=c2fe245748bf2110bc6acf823f266715b08707db diff --git a/secnet.h b/secnet.h index 7da7c2d..79a3fc4 100644 --- a/secnet.h +++ b/secnet.h @@ -27,6 +27,8 @@ #include #include #include +#include +#include #include #include #include @@ -43,15 +45,22 @@ #include +#include "osdep.h" + #define MAX_PEER_ADDRS 5 /* send at most this many copies; honour at most that many addresses */ #define MAX_NAK_MSG 80 +#define MAX_SIG_KEYS 4 struct hash_if; struct comm_if; struct comm_addr; struct priomsg; +struct log_if; +struct buffer_if; +struct sigpubkey_if; +struct sigprivkey_if; typedef char *string_t; typedef const char *cstring_t; @@ -68,6 +77,31 @@ union iaddr { #endif }; +#define GRPIDSZ 4 +#define ALGIDSZ 1 +#define KEYIDSZ (GRPIDSZ+ALGIDSZ) + /* Changing these is complex: this is the group id plus algo id */ + /* They are costructed by pubkeys.fl.pl. Also hardcoded in _PR_ */ +struct sigkeyid { uint8_t b[KEYIDSZ]; }; + +#define SIGKEYID_PR_FMT "%02x%02x%02x%02x%02x" +#define SIGKEYID_PR_VAL(id) /* SIGKEYID_PR_VAL(const sigkeyid *id) */ \ + ((id) == (const struct sigkeyid*)0, (id)->b[0]), \ + (id)->b[1],(id)->b[2],(id)->b[3],(id)->b[4] +static inline bool_t sigkeyid_equal(const struct sigkeyid *a, + const struct sigkeyid *b) { + return !memcmp(a->b, b->b, KEYIDSZ); +} + +#define SERIALSZ 4 +typedef uint32_t serialt; +static inline int serial_cmp(serialt a, serialt b) { + if (a==b) return 0; + if (!a) return -1; + if (!b) return +1; + return b-a <= (serialt)0x7fffffffUL ? +1 : -1; +} + #define ASSERT(x) do { if (!(x)) { fatal("assertion failed line %d file " \ __FILE__,__LINE__); } } while(0) @@ -164,7 +198,7 @@ extern item_t *list_elem(list_t *l, int32_t index); extern list_t *new_closure(closure_t *cl); extern void add_closure(dict_t *dict, cstring_t name, apply_fn apply); extern void *find_cl_if(dict_t *dict, cstring_t name, uint32_t type, - bool_t fail_if_invalid, cstring_t desc, + bool_t required, cstring_t desc, struct cloc loc); extern item_t *dict_find_item(dict_t *dict, cstring_t key, bool_t required, cstring_t desc, struct cloc loc); @@ -343,6 +377,7 @@ typedef void init_module(dict_t *dict); extern void init_builtin_modules(dict_t *dict); +extern init_module pubkeys_init; extern init_module resolver_module; extern init_module random_module; extern init_module udp_module; @@ -359,9 +394,57 @@ extern init_module slip_module; extern init_module tun_module; extern init_module sha1_module; extern init_module log_module; +extern init_module privcache_module; /***** END of module support *****/ +/***** SIGNATURE SCHEMES *****/ + +struct sigscheme_info; + +typedef bool_t sigscheme_loadpub(const struct sigscheme_info *algo, + struct buffer_if *pubkeydata, + struct sigpubkey_if **sigpub_r, + closure_t **closure_r, + struct log_if *log, struct cloc loc); + /* pubkeydata is (supposedly) for this algorithm. + * loadpub should log an error if it fails. + * pubkeydata may be modified (but not freed). + * both *sigpub_r and *closure_r must always be written and must + * refer to the same object, so on successful return + * (*closure_r)->type==CL_SIGPUBKEY + * and (*closure_r)->interface==*sigpub_r */ + +typedef bool_t sigscheme_loadpriv(const struct sigscheme_info *algo, + struct buffer_if *privkeydata, + struct sigprivkey_if **sigpriv_r, + closure_t **closure_r, + struct log_if *log, struct cloc loc); + /* Ideally, check whether privkeydata contains data for any algorithm. + * That avoids security problems if a key file is misidentified (which + * might happen if the file is simply renamed). + * If there is an error (including that the key data is not for this + * algorithm, return False and log an error at M_ERROR. + * On entry privkeydata->base==start. loadpriv may modify + * privkeydata, including the contents. */ + +struct sigscheme_info { + const char *name; + const uint8_t algid; + sigscheme_loadpub *loadpub; + sigscheme_loadpriv *loadpriv; +}; + +extern const struct sigscheme_info rsa1_sigscheme; +extern const struct sigscheme_info sigschemes[]; /* sentinel has name==0 */ + +const struct sigscheme_info *sigscheme_lookup(const char *name); + +extern sigscheme_loadpriv rsa1_loadpriv; +extern sigscheme_loadpub rsa1_loadpub; + +/***** END of signature schemes *****/ + /***** CLOSURE TYPES and interface definitions *****/ #define CL_PURE 0 @@ -378,6 +461,12 @@ extern init_module log_module; #define CL_HASH 12 #define CL_BUFFER 13 #define CL_NETLINK 14 +#define CL_PRIVCACHE 15 +/* When editing this list, edit closure_type_names[] too */ + +extern const char *const closure_type_names[]; + +const char *closure_type_name(uint32_t ty, char buf[]); struct buffer_if; @@ -422,16 +511,18 @@ struct random_if { /* SIGPUBKEY interface */ -typedef void sig_sethash_fn(void *st, struct hash_if *hash); +typedef void sig_dispose_fn(void *st); + typedef bool_t sig_unpick_fn(void *sst, struct buffer_if *msg, struct alg_msg_data *sig); typedef bool_t sig_checksig_fn(void *st, uint8_t *data, int32_t datalen, const struct alg_msg_data *sig); struct sigpubkey_if { void *st; - sig_sethash_fn *sethash; /* must be called before check, if non-0 */ sig_unpick_fn *unpick; sig_checksig_fn *check; + const struct hash_if *hash; + sig_dispose_fn *dispose; }; /* SIGPRIVKEY interface */ @@ -442,8 +533,21 @@ typedef bool_t sig_makesig_fn(void *st, uint8_t *data, int32_t datalen, struct buffer_if *msg); struct sigprivkey_if { void *st; - sig_sethash_fn *sethash; /* must be called before sign, if non-0 */ sig_makesig_fn *sign; + const struct hash_if *hash; + sig_dispose_fn *dispose; +}; + +/* PRIVCACHE interface */ + +typedef struct sigprivkey_if *privcache_lookup_fn(void *st, + const struct sigkeyid *id, + struct log_if*); + /* Return is valid only until you return from the current event! */ + +struct privcache_if { + void *st; + privcache_lookup_fn *lookup; }; /* COMM interface */ @@ -538,15 +642,34 @@ FORMAT(printf,3,4); extern void vslilog_part(struct log_if *lf, int class, const char *message, va_list) FORMAT(printf,3,0); +void cfgfile_log__vmsg(void *sst, int class, const char *message, va_list); +struct cfgfile_log { + struct log_if log; + /* private fields */ + struct cloc loc; + const char *facility; +}; +static inline void cfgfile_log_init(struct cfgfile_log *cfl, + struct cloc loc, const char *facility) +{ + cfl->log.st=cfl; + cfl->log.vlogfn=cfgfile_log__vmsg; + cfl->loc=loc; + cfl->facility=facility; +} + +void log_early_init(void); +void log_early_setlevel(void); + /* SITE interface */ /* Pretty much a placeholder; allows starting and stopping of processing, key expiry, etc. */ -typedef void site_control_fn(void *st, bool_t run); +typedef void site_startup_fn(void *st); typedef uint32_t site_status_fn(void *st); struct site_if { void *st; - site_control_fn *control; + site_startup_fn *startup; site_status_fn *status; }; @@ -665,6 +788,8 @@ struct hash_if { hash_final_fn *final; }; +extern struct hash_if *const sha1_hash_if; /* for where this is hardcoded */ + /* BUFFER interface */ struct buffer_if { @@ -716,13 +841,17 @@ extern NORETURN(cfgfatal(struct cloc loc, cstring_t facility, extern void cfgfile_postreadcheck(struct cloc loc, FILE *f); extern NORETURN(vcfgfatal_maybefile(FILE *maybe_f, struct cloc loc, cstring_t facility, const char *message, - va_list)) + va_list, const char *suffix)) FORMAT(printf,4,0); extern NORETURN(cfgfatal_maybefile(FILE *maybe_f, struct cloc loc, cstring_t facility, const char *message, ...)) FORMAT(printf,4,5); +extern NORETURN(cfgfatal_cl_type(struct cloc loc, const char *facility, + closure_t *cl, uint32_t exp_type, + const char *name)); + extern void Message(uint32_t class, const char *message, ...) FORMAT(printf,2,3); extern void log_from_fd(int fd, cstring_t prefix, struct log_if *log);