RPKI protocol with one cache server per protocol

The RPKI protocol (RFC 6810) using the RTRLib
(http://rpki.realmv6.org/) that is integrated inside
the BIRD's code.

Implemeted transports are:
 - unprotected transport over TCP
 - secure transport over SSHv2

Example configuration of bird.conf:
  ...
  roa4 table r4;
  roa6 table r6;

  protocol rpki {
    debug all;

    # Import both IPv4 and IPv6 ROAs
    roa4 { table r4; };
    roa6 { table r6; };

    # Set cache server (validator) address,
    # overwrite default port 323
    remote "rpki-validator.realmv6.org" port 8282;

    # Overwrite default time intervals
    retry   10;         # Default 600 seconds
    refresh 60;         # Default 3600 seconds
    expire 600;         # Default 7200 seconds
  }

  protocol rpki {
    debug all;

    # Import only IPv4 routes
    roa4 { table r4; };

    # Set cache server address to localhost,
    # use default ports tcp => 323 or ssh => 22
    remote 127.0.0.1;

    # Use SSH transport instead of unprotected transport over TCP
    ssh encryption {
      bird private key "/home/birdgeek/.ssh/id_rsa";
      remote public key "/home/birdgeek/.ssh/known_hosts";
      user "birdgeek";
    };
  }
  ...

6 files changed, 260 insertions, 5 deletions

diff --git a/lib/Makefile b/lib/Makefile
index 8e372bd3..1634e5e5 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -1,3 +1,7 @@
-src := bitops.c checksum.c event.c idm.c ip.c lists.c md5.c mempool.c net.c patmatch.c printf.c resource.c sha1.c sha256.c sha512.c slab.c slists.c tbf.c xmalloc.c
+src := bitops.c checksum.c ip.c lists.c md5.c net.c patmatch.c printf.c sha1.c sha256.c sha512.c slists.c xmalloc.c
+obj := $(src-o-files)
+$(all-client)
+
+src := bitops.c checksum.c event.c idm.c ip.c libssh.c lists.c md5.c mempool.c net.c patmatch.c printf.c resource.c sha1.c sha256.c sha512.c slab.c slists.c tbf.c xmalloc.c
 obj := $(src-o-files)
 $(all-daemon)
diff --git a/lib/libssh.c b/lib/libssh.c
new file mode 100644
index 00000000..9449ab30
--- /dev/null
+++ b/lib/libssh.c
@@ -0,0 +1,106 @@
+/*
+ *	BIRD -- Mockup of SSH Library for loading LibSSH using dlopen
+ *
+ *	(c) 2015 CZ.NIC
+ *
+ *	This file was part of SSH Library: http://www.libssh.org/
+ *	(c) 2003-2009 by Aris Adamantiadis (SSH Library)
+ *
+ *	Can be freely distributed and used under the terms of the GNU GPL.
+ */
+
+#include <dlfcn.h>
+#include "nest/bird.h"
+#include "lib/libssh.h"
+
+#define FILENAME_OF_SHARED_OBJECT_LIBSSH "libssh.so"
+
+struct ssh_function {
+  void **fn;
+  const char *name;
+};
+
+ssh_session (*ssh_new)(void);
+void (*ssh_set_blocking)(ssh_session session, int blocking);
+int (*ssh_options_set)(ssh_session session, enum ssh_options_e type, const void *value);
+int (*ssh_connect)(ssh_session session);
+socket_t (*ssh_get_fd)(ssh_session session);
+int (*ssh_is_server_known)(ssh_session session);
+int (*ssh_userauth_publickey_auto)(ssh_session session, const char *username, const char *passphrase);
+const char * (*ssh_get_error)(void *error);
+int (*ssh_get_error_code)(void *error);
+void (*ssh_disconnect)(ssh_session session);
+void (*ssh_free)(ssh_session session);
+
+ssh_channel (*ssh_channel_new)(ssh_session session);
+int (*ssh_channel_is_open)(ssh_channel channel);
+int (*ssh_channel_close)(ssh_channel channel);
+void (*ssh_channel_free)(ssh_channel channel);
+int (*ssh_channel_open_session)(ssh_channel channel);
+int (*ssh_channel_request_subsystem)(ssh_channel channel, const char *subsystem);
+int (*ssh_channel_read_nonblocking)(ssh_channel channel, void *dest, uint32_t count, int is_stderr);
+int (*ssh_channel_is_eof)(ssh_channel channel);
+int (*ssh_channel_select)(ssh_channel *readchans, ssh_channel *writechans, ssh_channel *exceptchans, struct timeval * timeout);
+int (*ssh_channel_write)(ssh_channel channel, const void *data, uint32_t len);
+
+#define SSH_FN(x) { .fn = (void **) &x, .name = #x }
+static struct ssh_function all_ssh_fn[] = {
+    SSH_FN(ssh_new),
+    SSH_FN(ssh_set_blocking),
+    SSH_FN(ssh_options_set),
+    SSH_FN(ssh_connect),
+    SSH_FN(ssh_get_fd),
+    SSH_FN(ssh_is_server_known),
+    SSH_FN(ssh_userauth_publickey_auto),
+    SSH_FN(ssh_get_error),
+    SSH_FN(ssh_get_error_code),
+    SSH_FN(ssh_disconnect),
+    SSH_FN(ssh_free),
+    SSH_FN(ssh_channel_new),
+    SSH_FN(ssh_channel_is_open),
+    SSH_FN(ssh_channel_close),
+    SSH_FN(ssh_channel_free),
+    SSH_FN(ssh_channel_open_session),
+    SSH_FN(ssh_channel_request_subsystem),
+    SSH_FN(ssh_channel_read_nonblocking),
+    SSH_FN(ssh_channel_is_eof),
+    SSH_FN(ssh_channel_select),
+    SSH_FN(ssh_channel_write),
+};
+#undef SSH_FN
+
+static void *libssh;
+
+/**
+ * load_libssh - Prepare all ssh_* functions
+ *
+ * Initialize for use all ssh_* functions. Returns normally NULL.
+ * If an error occurs then returns static string with the error description.
+ */
+const char *
+load_libssh(void)
+{
+  char *err_buf;
+
+  libssh = dlopen(FILENAME_OF_SHARED_OBJECT_LIBSSH, RTLD_LAZY);
+  if (!libssh)
+  {
+    /* This would be probably often repeated problem */
+    char *help_msg = "You have to install libssh library.";
+    err_buf = mb_alloc(&root_pool, 512); /* FIXME: free memory */
+    bsnprintf(err_buf, 512, "%s. %s", dlerror(), help_msg);
+    return err_buf;
+  }
+
+  dlerror(); /* Clear any existing error */
+
+  for (int i = 0; i < sizeof(all_ssh_fn)/sizeof(all_ssh_fn[0]); i++)
+  {
+    *all_ssh_fn[i].fn = (void *) dlsym(libssh, all_ssh_fn[i].name);
+    err_buf = dlerror();
+    if (err_buf)
+      return err_buf;
+  }
+
+  return NULL;
+}
diff --git a/lib/libssh.h b/lib/libssh.h
new file mode 100644
index 00000000..74e11e59
--- /dev/null
+++ b/lib/libssh.h
@@ -0,0 +1,123 @@
+/*
+ *	BIRD -- Mockup headers of SSH Library for loading LibSSH using dlopen
+ *
+ *	(c) 2015 CZ.NIC
+ *
+ *	This file was part of SSH Library: http://www.libssh.org/
+ *	(c) 2003-2009 by Aris Adamantiadis (SSH Library)
+ *
+ *	Can be freely distributed and used under the terms of the GNU GPL.
+ */
+
+#ifndef _BIRD_LIBSSH_H_
+#define _BIRD_LIBSSH_H_
+
+#include <unistd.h>
+#include <inttypes.h>
+
+typedef struct ssh_session_struct* ssh_session;
+typedef struct ssh_channel_struct* ssh_channel;
+
+/* Error return codes */
+#define SSH_OK 0     /* No error */
+#define SSH_ERROR -1 /* Error of some kind */
+#define SSH_AGAIN -2 /* The nonblocking call must be repeated */
+#define SSH_EOF -127 /* We have already a eof */
+
+enum ssh_server_known_e {
+  SSH_SERVER_ERROR=-1,
+  SSH_SERVER_NOT_KNOWN=0,
+  SSH_SERVER_KNOWN_OK,
+  SSH_SERVER_KNOWN_CHANGED,
+  SSH_SERVER_FOUND_OTHER,
+  SSH_SERVER_FILE_NOT_FOUND
+};
+
+enum ssh_auth_e {
+  SSH_AUTH_SUCCESS=0,
+  SSH_AUTH_DENIED,
+  SSH_AUTH_PARTIAL,
+  SSH_AUTH_INFO,
+  SSH_AUTH_AGAIN,
+  SSH_AUTH_ERROR=-1
+};
+
+enum ssh_error_types_e {
+  SSH_NO_ERROR=0,
+  SSH_REQUEST_DENIED,
+  SSH_FATAL,
+  SSH_EINTR
+};
+
+enum ssh_options_e {
+  SSH_OPTIONS_HOST,
+  SSH_OPTIONS_PORT,
+  SSH_OPTIONS_PORT_STR,
+  SSH_OPTIONS_FD,
+  SSH_OPTIONS_USER,
+  SSH_OPTIONS_SSH_DIR,
+  SSH_OPTIONS_IDENTITY,
+  SSH_OPTIONS_ADD_IDENTITY,
+  SSH_OPTIONS_KNOWNHOSTS,
+  SSH_OPTIONS_TIMEOUT,
+  SSH_OPTIONS_TIMEOUT_USEC,
+  SSH_OPTIONS_SSH1,
+  SSH_OPTIONS_SSH2,
+  SSH_OPTIONS_LOG_VERBOSITY,
+  SSH_OPTIONS_LOG_VERBOSITY_STR,
+  SSH_OPTIONS_CIPHERS_C_S,
+  SSH_OPTIONS_CIPHERS_S_C,
+  SSH_OPTIONS_COMPRESSION_C_S,
+  SSH_OPTIONS_COMPRESSION_S_C,
+  SSH_OPTIONS_PROXYCOMMAND,
+  SSH_OPTIONS_BINDADDR,
+  SSH_OPTIONS_STRICTHOSTKEYCHECK,
+  SSH_OPTIONS_COMPRESSION,
+  SSH_OPTIONS_COMPRESSION_LEVEL,
+  SSH_OPTIONS_KEY_EXCHANGE,
+  SSH_OPTIONS_HOSTKEYS,
+  SSH_OPTIONS_GSSAPI_SERVER_IDENTITY,
+  SSH_OPTIONS_GSSAPI_CLIENT_IDENTITY,
+  SSH_OPTIONS_GSSAPI_DELEGATE_CREDENTIALS,
+  SSH_OPTIONS_HMAC_C_S,
+  SSH_OPTIONS_HMAC_S_C,
+};
+
+enum {
+  SSH_LOG_NOLOG=0,		/* No logging at all */
+  SSH_LOG_WARNING,		/* Only warnings */
+  SSH_LOG_PROTOCOL,		/* High level protocol information */
+  SSH_LOG_PACKET,		/* Lower level protocol informations, packet level */
+  SSH_LOG_FUNCTIONS		/* Every function path */
+};
+
+#ifndef socket_t
+typedef int socket_t;
+#endif
+
+extern ssh_session (*ssh_new)(void);
+extern void (*ssh_set_blocking)(ssh_session session, int blocking);
+extern int (*ssh_options_set)(ssh_session session, enum ssh_options_e type, const void *value);
+extern int (*ssh_connect)(ssh_session session);
+extern socket_t (*ssh_get_fd)(ssh_session session);
+extern int (*ssh_is_server_known)(ssh_session session);
+extern int (*ssh_userauth_publickey_auto)(ssh_session session, const char *username, const char *passphrase);
+extern const char * (*ssh_get_error)(void *error);
+extern int (*ssh_get_error_code)(void *error);
+extern void (*ssh_disconnect)(ssh_session session);
+extern void (*ssh_free)(ssh_session session);
+
+extern ssh_channel (*ssh_channel_new)(ssh_session session);
+extern int (*ssh_channel_is_open)(ssh_channel channel);
+extern int (*ssh_channel_close)(ssh_channel channel);
+extern void (*ssh_channel_free)(ssh_channel channel);
+extern int (*ssh_channel_open_session)(ssh_channel channel);
+extern int (*ssh_channel_request_subsystem)(ssh_channel channel, const char *subsystem);
+extern int (*ssh_channel_read_nonblocking)(ssh_channel channel, void *dest, uint32_t count, int is_stderr);
+extern int (*ssh_channel_is_eof)(ssh_channel channel);
+extern int (*ssh_channel_select)(ssh_channel *readchans, ssh_channel *writechans, ssh_channel *exceptchans, struct timeval * timeout);
+extern int (*ssh_channel_write)(ssh_channel channel, const void *data, uint32_t len);
+
+const char *load_libssh(void);
+
+#endif /* _BIRD_LIBSSH_H_ */
diff --git a/lib/resource.c b/lib/resource.c
index 68718dfb..ab8c800f 100644
--- a/lib/resource.c
+++ b/lib/resource.c
@@ -31,7 +31,7 @@
 struct pool {
   resource r;
   list inside;
-  char *name;
+  const char *name;
 };
 
 static void pool_dump(resource *);
@@ -61,7 +61,7 @@ static int indent;
  * parent pool.
  */
 pool *
-rp_new(pool *p, char *name)
+rp_new(pool *p, const char *name)
 {
   pool *z = ralloc(p, &pool_class);
   z->name = name;
diff --git a/lib/resource.h b/lib/resource.h
index 1a62d389..1a0568b4 100644
--- a/lib/resource.h
+++ b/lib/resource.h
@@ -37,7 +37,7 @@ struct resclass {
 typedef struct pool pool;
 
 void resource_init(void);
-pool *rp_new(pool *, char *);		/* Create new pool */
+pool *rp_new(pool *, const char *);	/* Create new pool */
 void rfree(void *);			/* Free single resource */
 void rdump(void *);			/* Dump to debug output */
 size_t rmemsize(void *res);		/* Return size of memory used by the resource */
diff --git a/lib/socket.h b/lib/socket.h
index 7d1aa7ef..ce06a19c 100644
--- a/lib/socket.h
+++ b/lib/socket.h
@@ -12,6 +12,24 @@
 #include <errno.h>
 
 #include "lib/resource.h"
+#include "lib/libssh.h"
+
+struct ssh_sock {
+    const char *username;		/* (Required) SSH user name */
+    const char *server_hostkey_path;	/* (Optional) Filepath to the SSH public key of remote side, can be knownhost file */
+    const char *client_privkey_path;	/* (Optional) Filepath to the SSH private key of BIRD */
+    const char *subsystem;		/* (Optional) Name of SSH subsytem */
+    ssh_session session;		/* Internal */
+    ssh_channel channel;		/* Internal */
+    int state;				/* Internal */
+#define SK_SSH_CONNECT		0	/* Start state */
+#define SK_SSH_SERVER_KNOWN	1	/* Internal */
+#define SK_SSH_USERAUTH		2	/* Internal */
+#define SK_SSH_CHANNEL		3	/* Internal */
+#define SK_SSH_SESSION		4	/* Internal */
+#define SK_SSH_SUBSYSTEM 	5	/* Internal */
+#define SK_SSH_ESTABLISHED	6	/* Final state */
+};
 
 typedef struct birdsock {
   resource r;
@@ -20,6 +38,7 @@ typedef struct birdsock {
   int subtype;				/* Socket subtype */
   void *data;				/* User data */
   ip_addr saddr, daddr;			/* IPA_NONE = unspecified */
+  const char *host;			/* Alternative to daddr, NULL = unspecified */
   uint sport, dport;			/* 0 = unspecified (for IP: protocol type) */
   int tos;				/* TOS / traffic class, -1 = default */
   int priority;				/* Local socket priority, -1 = default */
@@ -52,7 +71,8 @@ typedef struct birdsock {
   node n;
   void *rbuf_alloc, *tbuf_alloc;
   char *password;			/* Password for MD5 authentication */
-  char *err;				/* Error message */
+  const char *err;			/* Error message */
+  struct ssh_sock *ssh;			/* Used in SK_SSH */
 } sock;
 
 sock *sock_new(pool *);			/* Allocate new socket */
@@ -115,6 +135,8 @@ extern int sk_priority_control;		/* Suggested priority for control traffic, shou
 #define SK_MAGIC	7	   /* Internal use by sysdep code */
 #define SK_UNIX_PASSIVE	8
 #define SK_UNIX		9
+#define SK_SSH_ACTIVE	10         /* -  -  *  *  -  ?   -	DA = host */
+#define SK_SSH		11
 
 /*
  *	Socket subtypes