RPKI protocol with one cache server per protocol

The RPKI protocol (RFC 6810) using the RTRLib
(http://rpki.realmv6.org/) that is integrated inside
the BIRD's code.

Implemeted transports are:
 - unprotected transport over TCP
 - secure transport over SSHv2

Example configuration of bird.conf:
  ...
  roa4 table r4;
  roa6 table r6;

  protocol rpki {
    debug all;

    # Import both IPv4 and IPv6 ROAs
    roa4 { table r4; };
    roa6 { table r6; };

    # Set cache server (validator) address,
    # overwrite default port 323
    remote "rpki-validator.realmv6.org" port 8282;

    # Overwrite default time intervals
    retry   10;         # Default 600 seconds
    refresh 60;         # Default 3600 seconds
    expire 600;         # Default 7200 seconds
  }

  protocol rpki {
    debug all;

    # Import only IPv4 routes
    roa4 { table r4; };

    # Set cache server address to localhost,
    # use default ports tcp => 323 or ssh => 22
    remote 127.0.0.1;

    # Use SSH transport instead of unprotected transport over TCP
    ssh encryption {
      bird private key "/home/birdgeek/.ssh/id_rsa";
      remote public key "/home/birdgeek/.ssh/known_hosts";
      user "birdgeek";
    };
  }
  ...

1 files changed, 83 insertions, 0 deletions

diff --git a/proto/rpki/ssh_transport.c b/proto/rpki/ssh_transport.c
new file mode 100644
index 00000000..8fc32626
--- /dev/null
+++ b/proto/rpki/ssh_transport.c
@@ -0,0 +1,83 @@
+/*
+ *	BIRD -- An implementation of the SSH protocol for the RPKI transport
+ *
+ *	(c) 2015 CZ.NIC
+ *	(c) 2015 Pavel Tvrdik <pawel.tvrdik@gmail.com>
+ *
+ *	This file was a part of RTRlib: http://rpki.realmv6.org/
+ *	This transport implementation uses libssh (http://www.libssh.org/)
+ *
+ *	Can be freely distributed and used under the terms of the GNU GPL.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/time.h>
+
+#include "rpki.h"
+#include "lib/libssh.h"
+
+static int
+rpki_tr_ssh_open(struct rpki_tr_sock *tr)
+{
+  struct rpki_cache *cache = tr->cache;
+  struct rpki_config *cf = (void *) cache->p->p.cf;
+  struct rpki_tr_ssh_config *ssh_cf = (void *) cf->tr_config.spec;
+  sock *sk = tr->sk;
+
+  const char *err_msg;
+  if ((err_msg = load_libssh()) != NULL)
+  {
+    CACHE_TRACE(D_EVENTS, cache, "%s", err_msg);
+    return RPKI_TR_ERROR;
+  }
+
+  sk->type = SK_SSH_ACTIVE;
+  sk->ssh = mb_allocz(sk->pool, sizeof(struct ssh_sock));
+  sk->ssh->username = ssh_cf->user;
+  sk->ssh->client_privkey_path = ssh_cf->bird_private_key;
+  sk->ssh->server_hostkey_path = ssh_cf->cache_public_key;
+  sk->ssh->subsystem = "rpki-rtr";
+  sk->ssh->state = SK_SSH_CONNECT;
+
+  if (sk_open(sk) != 0)
+    return RPKI_TR_ERROR;
+
+  return RPKI_TR_SUCCESS;
+}
+
+static const char *
+rpki_tr_ssh_ident(struct rpki_tr_sock *tr)
+{
+  ASSERT(tr != NULL);
+
+  struct rpki_cache *cache = tr->cache;
+  struct rpki_config *cf = (void *) cache->p->p.cf;
+  struct rpki_tr_ssh_config *ssh_cf = (void *) cf->tr_config.spec;
+
+  if (tr->ident != NULL)
+    return tr->ident;
+
+  const char *username = ssh_cf->user;
+  const char *host = cf->hostname;
+  u16 port = cf->port;
+
+  size_t len = strlen(username) + 1 + strlen(host) + 1 + 5 + 1; /* <user> + '@' + <host> + ':' + <port> + '\0' */
+  char *ident = mb_alloc(cache->pool, len);
+  bsnprintf(ident, len, "%s@%s:%u", username, host, port);
+  tr->ident = ident;
+
+  return tr->ident;
+}
+
+/**
+ * rpki_tr_ssh_init - initializes the RPKI transport structure for a SSH connection
+ * @tr: allocated RPKI transport structure
+ */
+void
+rpki_tr_ssh_init(struct rpki_tr_sock *tr)
+{
+  tr->open_fp = &rpki_tr_ssh_open;
+  tr->ident_fp = &rpki_tr_ssh_ident;
+}