blob: 46ad752ba885c97edb538d95fe62b9ee9ec1e5ea (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
|
;;; -*- Lisp -*-
;;; $Id$
;;;
;;; Scratch pad for working out API design for RPKI engine.
;;;
;;; This file is psuedocode, I just wanted to take advantage of
;;; emacs's built-in support for languages with reasonable syntax.
;;;
;;; Terminology:
;;;
;;; - IRBE: Internet Registry Back End
;;;
;;; - RE: RPKI Engine
;;; Protocol operations between RE and signing engine. This assumes
;;; the model in which the signing engine stores nothing but keypairs
;;; and takes orders from the RE on what to sign; this still needs to
;;; be checked by competent paranoids.
;; Create a keypair. :length is the number of bits for the key
;; (default 2048?).
(create-keypair :cust-id 42
:length 2048)
=> (public-key key-id)
;; Destroy a keypair.
(destroy-keypair :cust-id 42
:key-id key-id)
=> ()
;; List existing keypairs
(list-keypairs :cust-id 42)
=> ((key-id public-key)
(key-id public-key)
...)
;; Sign something. how-to-sign tells us both what signature method to
;; use (ie, what kind of object we're signing) and also the signature
;; algorithm to use (where there are multiple choices, which perhaps
;; there should not be?).
(sign-thing :cust-id 42
:what-to-sign cert-without-signature
:how-to-sign :cert-rsa/sha256
:key-id key-id)
=> (signed-thing)
;;; Protocol operations between IRBE and RE.
;;;
;;; This is really two separate protocols over channels that might or
;;; not be the same. Both are client/server protocols, but for some
;;; the rpki engine and for others the irbe is the client.
;;;
;;; This set of operations are initiated by the IRBE.
(create-cust-id)
=> (customer-id)
(destroy-cust-id :cust-id 42)
=> ()
(list-cust-ids)
=> (customer-id ...)
(get-preference :cust-id 42
:preference-name :favorite-color)
=> ("obsidian")
(set-preference :cust-id 42
:name :favorite-color
:value "obsidian")
=> ()
(get-biz-private-key :cust-id 42)
=> (private-key)
(set-biz-private-key :cust-id 42
:new-key new-private-key)
=> ()
(get-biz-signing-certs :cust-id 42)
=> (cert ...)
(set-biz-signing-certs :cust-id 42
(cert ...))
=> ()
(add-friend-biz-cert :cust-id 42
:cert cert)
=> ()
(del-friend-biz-cert :cust-id 42
:cert cert)
=> ()
(list-friend-biz-certs :cust-id 42)
=> (cert ...)
;;; Protocol operations between IRBE and RE.
;;;
;;; This is really two separate protocols over channels that might or
;;; not be the same. Both are client/server protocols, but for some
;;; the rpki engine and for others the irbe is the client.
;;;
;;; This set of operations are initiated by the IRBE.
(list-resources :cust-id 42)
=> ((:ipv4-address "10.0.0.44/32" "10.3.0.44/32")
(:ipv6-address "fe80:dead:beef::/24")
...)
(list-rights-to-route :cust-id 42)
=> ((as-number :ipv4 prefix-or-range :ipv6 prefix-or-range ...)
(as-number "ipv6 prefix-or-range :ipv6 prefix-or-range :ipv4 prefix-or-range ...)
...)
|
