/* test.c */ /* $Id: test.c,v 1.1 2001/09/17 19:06:59 bodo Exp $ */ #define L_PORT 9999 #define C_PORT 443 #include #include #include #include #include #include #include #include #include #include #include #include #include "test.h" #include "easy-tls.h" void test_process_init(int fd, int client_p, void *apparg) { fprintf(stderr, "test_process_init(fd = %d, client_p = %d, apparg = %p)\n", fd, client_p, apparg); } void test_errflush(int child_p, char *errbuf, size_t num, void *apparg) { fputs(errbuf, stderr); } int main(int argc, char *argv[]) { int s, fd, r; FILE *conn_in; FILE *conn_out; char buf[256]; SSL_CTX *ctx; int client_p = 0; int port; int tls = 0; char infobuf[TLS_INFO_SIZE + 1]; if (argc > 1 && argv[1][0] == '-') { fputs("Usage: test [port] -- server\n" " test num.num.num.num [port] -- client\n", stderr); exit(1); } if (argc > 1) { if (strchr(argv[1], '.')) { client_p = 1; } } fputs(client_p ? "Client\n" : "Server\n", stderr); { struct tls_create_ctx_args a = tls_create_ctx_defaultargs(); a.client_p = client_p; a.certificate_file = "cert.pem"; a.key_file = "cert.pem"; a.ca_file = "cacerts.pem"; ctx = tls_create_ctx(a, NULL); if (ctx == NULL) exit(1); } s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); if (s == -1) { perror("socket"); exit(1); } if (client_p) { struct sockaddr_in addr; size_t addr_len = sizeof addr; addr.sin_family = AF_INET; assert(argc > 1); if (argc > 2) sscanf(argv[2], "%d", &port); else port = C_PORT; addr.sin_port = htons(port); addr.sin_addr.s_addr = inet_addr(argv[1]); r = connect(s, &addr, addr_len); if (r != 0) { perror("connect"); exit(1); } fd = s; fprintf(stderr, "Connect (fd = %d).\n", fd); } else { /* server */ { int i = 1; r = setsockopt(s, SOL_SOCKET, SO_REUSEADDR, (void *) &i, sizeof i); if (r == -1) { perror("setsockopt"); exit(1); } } { struct sockaddr_in addr; size_t addr_len = sizeof addr; if (argc > 1) sscanf(argv[1], "%d", &port); else port = L_PORT; addr.sin_family = AF_INET; addr.sin_port = htons(port); addr.sin_addr.s_addr = INADDR_ANY; r = bind(s, &addr, addr_len); if (r != 0) { perror("bind"); exit(1); } } r = listen(s, 1); if (r == -1) { perror("listen"); exit(1); } fprintf(stderr, "Listening at port %i.\n", port); fd = accept(s, NULL, 0); if (fd == -1) { perror("accept"); exit(1); } fprintf(stderr, "Accept (fd = %d).\n", fd); } conn_in = fdopen(fd, "r"); if (conn_in == NULL) { perror("fdopen"); exit(1); } conn_out = fdopen(fd, "w"); if (conn_out == NULL) { perror("fdopen"); exit(1); } setvbuf(conn_in, NULL, _IOLBF, 256); setvbuf(conn_out, NULL, _IOLBF, 256); while (fgets(buf, sizeof buf, stdin) != NULL) { if (buf[0] == 'W') { fprintf(conn_out, "%.*s\r\n", (int)(strlen(buf + 1) - 1), buf + 1); fprintf(stderr, ">>> %.*s\n", (int)(strlen(buf + 1) - 1), buf + 1); } else if (buf[0] == 'C') { fprintf(stderr, "Closing.\n"); fclose(conn_in); fclose(conn_out); exit(0); } else if (buf[0] == 'R') { int lines = 0; sscanf(buf + 1, "%d", &lines); do { if (fgets(buf, sizeof buf, conn_in) == NULL) { if (ferror(conn_in)) { fprintf(stderr, "ERROR\n"); exit(1); } fprintf(stderr, "CLOSED\n"); return 0; } fprintf(stderr, "<<< %s", buf); } while (--lines > 0); } else if (buf[0] == 'T') { int infofd; tls++; { struct tls_start_proxy_args a = tls_start_proxy_defaultargs(); a.fd = fd; a.client_p = client_p; a.ctx = ctx; a.infofd = &infofd; r = tls_start_proxy(a, NULL); } assert(r != 1); if (r != 0) { fprintf(stderr, "tls_start_proxy failed: %d\n", r); switch (r) { case -1: fputs("socketpair", stderr); break; case 2: fputs("FD_SETSIZE exceeded", stderr); break; case -3: fputs("pipe", stderr); break; case -4: fputs("fork", stderr); break; case -5: fputs("dup2", stderr); break; default: fputs("?", stderr); } if (r < 0) perror(""); else fputc('\n', stderr); exit(1); } r = read(infofd, infobuf, sizeof infobuf - 1); if (r > 0) { const char *info = infobuf; const char *eol; infobuf[r] = '\0'; while ((eol = strchr(info, '\n')) != NULL) { fprintf(stderr, "+++ `%.*s'\n", eol - info, info); info = eol+1; } close (infofd); } } else { fprintf(stderr, "W... write line to network\n" "R[n] read line (n lines) from network\n" "C close\n" "T start %sTLS proxy\n", tls ? "another " : ""); } } return 0; } lass='alt'>
41874e89


7a742ef8


























dd6d1bfc





c43bc05c


dd6d1bfc

7a742ef8































































































































41874e89


7a742ef8







41874e89


7a742ef8


















1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65

66
67

68
69
70
71

72

73
74

75
76

77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102

103
104
105
106
107

108
109

110

111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237

238
239

240
241
242
243
244
245
246

247
248

249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
















                                                                  
















































                                                                      

                                                                



                                                                     
                                                               

                                                     

                                                                

























                                                                      




                                                                    

                                          
                                              






























































































































                                                                    

                                                                






                                                                     

                                                                

















                                                                                                
;;; -*- Lisp -*-
;;; $Id$
;;;
;;; Scratch pad for working out API design for RPKI engine.
;;;
;;; This file is psuedocode, I just wanted to take advantage of
;;; emacs's built-in support for languages with reasonable syntax.
;;;
;;; Terminology:
;;;
;;; - IRBE: Internet Registry Back End
;;;
;;; - RE: RPKI Engine

;;; Current problems:

;;; Need revoke and rekey operations.

;;; And, er, how do things like publication URIs (which also go into
;;; some of the X.509 extensions in the resource certs) get into the
;;; RE anyway?  This is close to being the same question as how do we
;;; configure the publication point, as the data are largely the same.
;;; Part of the problem is that, if we create CAs on the fly in
;;; response to what we learn from our parent, how do we map that to
;;; any kind of preconfigured data on where we should publish?  This
;;; is a mess.
;;;
;;; Might it help to have per-parent config for this, since we have to
;;; config parents anyway?  That'd give us the head of the publication
;;; URI, leaving us to figure out just the tail.  Could gensym name
;;; tail for dynamically created CAs, could take name tail from chat
;;; with parent (risky?  evil parent gives us dangerous name?), could
;;; take name tail from local config but it's hard to see how.
;;;
;;; We now think that there's a negotiation involved here with both
;;; the parent and the publisher.  The publication URI directory
;;; breaks into three pieces: head/middle/tail/.  head comes from the
;;; publisher, middle comes from the parent, and tail comes from this
;;; RE.  head is just the prefix for where we're allowed to put stuff
;;; within the publication repository; this could be configured by the
;;; IRBE or we could ask the publication repository, we currently
;;; think the latter is better.  Middle comes from this RE's parent,
;;; and should be a new attribute in the up-down XML protocol: it's
;;; the parent's advice on where to put this particular CA's outputs
;;; in order to get the nice hierarchical properties we want.  Tail is
;;; something this RE comes up with, it's per-CA, and all that really
;;; matters is that it's stable; it could be gensymed, or could be our
;;; internal name for the CA, whatever.  This hack may require finding
;;; out the parent's publication URI (which we might get from the
;;; parent's cert or not to be decided later), sort this out later.
;;;
;;; If there is any preliminary negotation with publisher before
;;; publication, it is all hypothetical and assumes that proof will be
;;; given with actual publication request.  Thing that needs to be
;;; proven is that publication client A is not stepping on publication
;;; client B even when B is A's parent.

;;; Perhaps "cust-id" is really a bad choice, as we have two different
;;; models in which it means different thigs.  In this model the
;;; cust-id is the entity which is executing, which is -issuing-
;;; stuff.  In the other model, cust-id refers to the entity to which
;;; we are issuing, which is a subject-id; in the terms used below,
;;; this is a child-id.  We probably need better names, because people
;;; keep getting confused by this conflict.

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;
;;; Protocol operations between IRBE and RE.
;;;
;;; This is really two separate protocols over channels that might or
;;; not be the same.  Both are client/server protocols, but for some
;;; the RE is the client and for others the IRBE is the client.
;;;
;;; This set of operations are initiated by the IRBE.
;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

(create-cust-id)
=> (customer-id)

(destroy-cust-id :cust-id 42)
=> ()

(list-cust-ids)
=> (customer-id ...)

;; RobK wonders whether there needs to be an operation that blows away
;; most of the context but preserves things like audit logs.  No
;; current consensus on need for this.

(get-preference :cust-id 42
		:preference-name :favorite-color)
=> ("obsidian")

(set-preference :cust-id 42
		:name  :favorite-color
		:value "obsidian")
=> ()

;; Extensions might also show up as preferences that nobody but this
;; IRBE operator has ever heard of


;; This creates both a context and a keypair.  Do we need to specify
;; what kind of key in addition to length?

(create-biz-signing-context :cust-id 42
			    &optional
			    :key-type :rsa
			    :key-length  2048)
=> (biz-signing-context-id pkcs10-cert-request)

(destroy-biz-signing-context :cust-id 42
			     :biz-signing-context-id biz-context-id)
=> ()

(list-biz-signing-contexts :cust-id 42)
=> (biz-signing-context-id ...)

(get-biz-signing-certs :cust-id 42
		       :biz-signing-context-id splat)
=> (cert ...)

(set-biz-signing-certs :cust-id 42
		       :biz-signing-context-id splat
		       (cert ...))
=> ()

(create-parent-context :cust-id 42)
=> (parent)

(destroy-parent-context :cust-id 42
			:parent foo)
=> ()

(list-parents :cust-id 42)
=> (parent ...)

(set-parent-ta :cust-id 42
	       :parent foo
	       :ta ta)
=> ()

(get-parent-ta :cust-id 42
	       :parent foo)
=> (ta)

(set-parent-uri :cust-id 42
		:parent foo
		:uri uri)
=> ()

(get-parent-uri :cust-id 42
		:parent foo)
=> (uri)

(set-parent-biz-signing-context :cust-id 42
				:parent foo
				:biz-signing-context foo)
=> ()

(get-parent-biz-signing-context :cust-id 42
				:parent foo)
=> (biz-signing-context)

(create-child :cust-id 42)
=> (child)

(destroy-child :cust-id 42
	       :child bar)
=> ()

(list-children  :cust-id id)
=> (child ...)

(get-child-id :cust-id 42
	      :child foo)
=> (child-id)

(set-child-id :cust-id 42
	      :child foo
	      :id bar)
=> ()

(set-child-ta :cust-id 42
	      :child foo
	      :ta bar)
=> ()

(get-child-ta :cust-id 42
	      :child foo)
=> (ta)

(set-child-biz-signing-context :cust-id 42
			       :child foo
			       :biz-signing-context bar)
=> ()

(get-child-biz-signing-context :cust-id 42
			       :child foo)
=> (signing-context)

;;; The following repo stuff is now wrong, need to come back to it

(set-ca-repo-ta :cust-id 42
		:ca foo
		:ta ta)
=> ()

(get-ca-repo-ta :cust-id 42
		:ca foo)
=> (ta)

(set-ca-repo-uri :cust-id 42
		 :ca foo
		 :uri uri)
=> ()

(get-ca-repo-uri :cust-id 42
		 :ca foo)
=> (uri)

(set-ca-repo-biz-signing-context :cust-id 42
				 :ca foo
				 :biz-signing-context foo)
=> ()

(get-ca-repo-biz-signing-context :cust-id 42
				 :ca foo)
=> (biz-signing-context)

(please-run-this-cust-id-now :cust-id 42)
=> ()

(please-publish-world-right-now :cust-id 42)
=> ()

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;
;;; Protocol operations between IRBE and RE.
;;;
;;; This is really two separate protocols over channels that might or
;;; not be the same.  Both are client/server protocols, but for some
;;; the rpki engine and for others the irbe is the client.
;;;
;;; This set of operations are initiated by the RE.
;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

(list-resources :cust-id 42		; issuer id
		&optional		; If left off, we're asking about self rather than child
		:child id)		; subject id
=> ((:ipv4-address "10.0.0.44/32" "10.3.0.44/32")
    (:ipv6-address "fe80:dead:beef::/24")
    (:as-number "666")
    ...)

(list-rights-to-route :cust-id 42)	; Self
=> ((as-number :ipv4 prefix-or-range :ipv6 prefix-or-range ...)
    (as-number "ipv6 prefix-or-range :ipv6 prefix-or-range :ipv4 prefix-or-range ...)
    ...)

(report-error :cust-id 42
	      :error-token :your-hair-is-on-fire
	      :bag-of-data whatever)
=> ()