From 65d2a88dd2aaef7344cfa62918e3ddf4c72ca50a Mon Sep 17 00:00:00 2001 From: Pavel Tvrdík Date: Thu, 17 Sep 2015 17:15:30 +0200 Subject: RPKI protocol with one cache server per protocol The RPKI protocol (RFC 6810) using the RTRLib (http://rpki.realmv6.org/) that is integrated inside the BIRD's code. Implemeted transports are: - unprotected transport over TCP - secure transport over SSHv2 Example configuration of bird.conf: ... roa4 table r4; roa6 table r6; protocol rpki { debug all; # Import both IPv4 and IPv6 ROAs roa4 { table r4; }; roa6 { table r6; }; # Set cache server (validator) address, # overwrite default port 323 remote "rpki-validator.realmv6.org" port 8282; # Overwrite default time intervals retry 10; # Default 600 seconds refresh 60; # Default 3600 seconds expire 600; # Default 7200 seconds } protocol rpki { debug all; # Import only IPv4 routes roa4 { table r4; }; # Set cache server address to localhost, # use default ports tcp => 323 or ssh => 22 remote 127.0.0.1; # Use SSH transport instead of unprotected transport over TCP ssh encryption { bird private key "/home/birdgeek/.ssh/id_rsa"; remote public key "/home/birdgeek/.ssh/known_hosts"; user "birdgeek"; }; } ... --- lib/Makefile | 6 ++- lib/libssh.c | 106 +++++++++++++++++++++++++++++++++++++++++++++++++ lib/libssh.h | 123 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++ lib/resource.c | 4 +- lib/resource.h | 2 +- lib/socket.h | 24 ++++++++++- 6 files changed, 260 insertions(+), 5 deletions(-) create mode 100644 lib/libssh.c create mode 100644 lib/libssh.h (limited to 'lib') diff --git a/lib/Makefile b/lib/Makefile index 8e372bd3..1634e5e5 100644 --- a/lib/Makefile +++ b/lib/Makefile @@ -1,3 +1,7 @@ -src := bitops.c checksum.c event.c idm.c ip.c lists.c md5.c mempool.c net.c patmatch.c printf.c resource.c sha1.c sha256.c sha512.c slab.c slists.c tbf.c xmalloc.c +src := bitops.c checksum.c ip.c lists.c md5.c net.c patmatch.c printf.c sha1.c sha256.c sha512.c slists.c xmalloc.c +obj := $(src-o-files) +$(all-client) + +src := bitops.c checksum.c event.c idm.c ip.c libssh.c lists.c md5.c mempool.c net.c patmatch.c printf.c resource.c sha1.c sha256.c sha512.c slab.c slists.c tbf.c xmalloc.c obj := $(src-o-files) $(all-daemon) diff --git a/lib/libssh.c b/lib/libssh.c new file mode 100644 index 00000000..9449ab30 --- /dev/null +++ b/lib/libssh.c @@ -0,0 +1,106 @@ +/* + * BIRD -- Mockup of SSH Library for loading LibSSH using dlopen + * + * (c) 2015 CZ.NIC + * + * This file was part of SSH Library: http://www.libssh.org/ + * (c) 2003-2009 by Aris Adamantiadis (SSH Library) + * + * Can be freely distributed and used under the terms of the GNU GPL. + */ + +#include +#include "nest/bird.h" +#include "lib/libssh.h" + +#define FILENAME_OF_SHARED_OBJECT_LIBSSH "libssh.so" + +struct ssh_function { + void **fn; + const char *name; +}; + +ssh_session (*ssh_new)(void); +void (*ssh_set_blocking)(ssh_session session, int blocking); +int (*ssh_options_set)(ssh_session session, enum ssh_options_e type, const void *value); +int (*ssh_connect)(ssh_session session); +socket_t (*ssh_get_fd)(ssh_session session); +int (*ssh_is_server_known)(ssh_session session); +int (*ssh_userauth_publickey_auto)(ssh_session session, const char *username, const char *passphrase); +const char * (*ssh_get_error)(void *error); +int (*ssh_get_error_code)(void *error); +void (*ssh_disconnect)(ssh_session session); +void (*ssh_free)(ssh_session session); + +ssh_channel (*ssh_channel_new)(ssh_session session); +int (*ssh_channel_is_open)(ssh_channel channel); +int (*ssh_channel_close)(ssh_channel channel); +void (*ssh_channel_free)(ssh_channel channel); +int (*ssh_channel_open_session)(ssh_channel channel); +int (*ssh_channel_request_subsystem)(ssh_channel channel, const char *subsystem); +int (*ssh_channel_read_nonblocking)(ssh_channel channel, void *dest, uint32_t count, int is_stderr); +int (*ssh_channel_is_eof)(ssh_channel channel); +int (*ssh_channel_select)(ssh_channel *readchans, ssh_channel *writechans, ssh_channel *exceptchans, struct timeval * timeout); +int (*ssh_channel_write)(ssh_channel channel, const void *data, uint32_t len); + +#define SSH_FN(x) { .fn = (void **) &x, .name = #x } +static struct ssh_function all_ssh_fn[] = { + SSH_FN(ssh_new), + SSH_FN(ssh_set_blocking), + SSH_FN(ssh_options_set), + SSH_FN(ssh_connect), + SSH_FN(ssh_get_fd), + SSH_FN(ssh_is_server_known), + SSH_FN(ssh_userauth_publickey_auto), + SSH_FN(ssh_get_error), + SSH_FN(ssh_get_error_code), + SSH_FN(ssh_disconnect), + SSH_FN(ssh_free), + SSH_FN(ssh_channel_new), + SSH_FN(ssh_channel_is_open), + SSH_FN(ssh_channel_close), + SSH_FN(ssh_channel_free), + SSH_FN(ssh_channel_open_session), + SSH_FN(ssh_channel_request_subsystem), + SSH_FN(ssh_channel_read_nonblocking), + SSH_FN(ssh_channel_is_eof), + SSH_FN(ssh_channel_select), + SSH_FN(ssh_channel_write), +}; +#undef SSH_FN + +static void *libssh; + +/** + * load_libssh - Prepare all ssh_* functions + * + * Initialize for use all ssh_* functions. Returns normally NULL. + * If an error occurs then returns static string with the error description. + */ +const char * +load_libssh(void) +{ + char *err_buf; + + libssh = dlopen(FILENAME_OF_SHARED_OBJECT_LIBSSH, RTLD_LAZY); + if (!libssh) + { + /* This would be probably often repeated problem */ + char *help_msg = "You have to install libssh library."; + err_buf = mb_alloc(&root_pool, 512); /* FIXME: free memory */ + bsnprintf(err_buf, 512, "%s. %s", dlerror(), help_msg); + return err_buf; + } + + dlerror(); /* Clear any existing error */ + + for (int i = 0; i < sizeof(all_ssh_fn)/sizeof(all_ssh_fn[0]); i++) + { + *all_ssh_fn[i].fn = (void *) dlsym(libssh, all_ssh_fn[i].name); + err_buf = dlerror(); + if (err_buf) + return err_buf; + } + + return NULL; +} diff --git a/lib/libssh.h b/lib/libssh.h new file mode 100644 index 00000000..74e11e59 --- /dev/null +++ b/lib/libssh.h @@ -0,0 +1,123 @@ +/* + * BIRD -- Mockup headers of SSH Library for loading LibSSH using dlopen + * + * (c) 2015 CZ.NIC + * + * This file was part of SSH Library: http://www.libssh.org/ + * (c) 2003-2009 by Aris Adamantiadis (SSH Library) + * + * Can be freely distributed and used under the terms of the GNU GPL. + */ + +#ifndef _BIRD_LIBSSH_H_ +#define _BIRD_LIBSSH_H_ + +#include +#include + +typedef struct ssh_session_struct* ssh_session; +typedef struct ssh_channel_struct* ssh_channel; + +/* Error return codes */ +#define SSH_OK 0 /* No error */ +#define SSH_ERROR -1 /* Error of some kind */ +#define SSH_AGAIN -2 /* The nonblocking call must be repeated */ +#define SSH_EOF -127 /* We have already a eof */ + +enum ssh_server_known_e { + SSH_SERVER_ERROR=-1, + SSH_SERVER_NOT_KNOWN=0, + SSH_SERVER_KNOWN_OK, + SSH_SERVER_KNOWN_CHANGED, + SSH_SERVER_FOUND_OTHER, + SSH_SERVER_FILE_NOT_FOUND +}; + +enum ssh_auth_e { + SSH_AUTH_SUCCESS=0, + SSH_AUTH_DENIED, + SSH_AUTH_PARTIAL, + SSH_AUTH_INFO, + SSH_AUTH_AGAIN, + SSH_AUTH_ERROR=-1 +}; + +enum ssh_error_types_e { + SSH_NO_ERROR=0, + SSH_REQUEST_DENIED, + SSH_FATAL, + SSH_EINTR +}; + +enum ssh_options_e { + SSH_OPTIONS_HOST, + SSH_OPTIONS_PORT, + SSH_OPTIONS_PORT_STR, + SSH_OPTIONS_FD, + SSH_OPTIONS_USER, + SSH_OPTIONS_SSH_DIR, + SSH_OPTIONS_IDENTITY, + SSH_OPTIONS_ADD_IDENTITY, + SSH_OPTIONS_KNOWNHOSTS, + SSH_OPTIONS_TIMEOUT, + SSH_OPTIONS_TIMEOUT_USEC, + SSH_OPTIONS_SSH1, + SSH_OPTIONS_SSH2, + SSH_OPTIONS_LOG_VERBOSITY, + SSH_OPTIONS_LOG_VERBOSITY_STR, + SSH_OPTIONS_CIPHERS_C_S, + SSH_OPTIONS_CIPHERS_S_C, + SSH_OPTIONS_COMPRESSION_C_S, + SSH_OPTIONS_COMPRESSION_S_C, + SSH_OPTIONS_PROXYCOMMAND, + SSH_OPTIONS_BINDADDR, + SSH_OPTIONS_STRICTHOSTKEYCHECK, + SSH_OPTIONS_COMPRESSION, + SSH_OPTIONS_COMPRESSION_LEVEL, + SSH_OPTIONS_KEY_EXCHANGE, + SSH_OPTIONS_HOSTKEYS, + SSH_OPTIONS_GSSAPI_SERVER_IDENTITY, + SSH_OPTIONS_GSSAPI_CLIENT_IDENTITY, + SSH_OPTIONS_GSSAPI_DELEGATE_CREDENTIALS, + SSH_OPTIONS_HMAC_C_S, + SSH_OPTIONS_HMAC_S_C, +}; + +enum { + SSH_LOG_NOLOG=0, /* No logging at all */ + SSH_LOG_WARNING, /* Only warnings */ + SSH_LOG_PROTOCOL, /* High level protocol information */ + SSH_LOG_PACKET, /* Lower level protocol informations, packet level */ + SSH_LOG_FUNCTIONS /* Every function path */ +}; + +#ifndef socket_t +typedef int socket_t; +#endif + +extern ssh_session (*ssh_new)(void); +extern void (*ssh_set_blocking)(ssh_session session, int blocking); +extern int (*ssh_options_set)(ssh_session session, enum ssh_options_e type, const void *value); +extern int (*ssh_connect)(ssh_session session); +extern socket_t (*ssh_get_fd)(ssh_session session); +extern int (*ssh_is_server_known)(ssh_session session); +extern int (*ssh_userauth_publickey_auto)(ssh_session session, const char *username, const char *passphrase); +extern const char * (*ssh_get_error)(void *error); +extern int (*ssh_get_error_code)(void *error); +extern void (*ssh_disconnect)(ssh_session session); +extern void (*ssh_free)(ssh_session session); + +extern ssh_channel (*ssh_channel_new)(ssh_session session); +extern int (*ssh_channel_is_open)(ssh_channel channel); +extern int (*ssh_channel_close)(ssh_channel channel); +extern void (*ssh_channel_free)(ssh_channel channel); +extern int (*ssh_channel_open_session)(ssh_channel channel); +extern int (*ssh_channel_request_subsystem)(ssh_channel channel, const char *subsystem); +extern int (*ssh_channel_read_nonblocking)(ssh_channel channel, void *dest, uint32_t count, int is_stderr); +extern int (*ssh_channel_is_eof)(ssh_channel channel); +extern int (*ssh_channel_select)(ssh_channel *readchans, ssh_channel *writechans, ssh_channel *exceptchans, struct timeval * timeout); +extern int (*ssh_channel_write)(ssh_channel channel, const void *data, uint32_t len); + +const char *load_libssh(void); + +#endif /* _BIRD_LIBSSH_H_ */ diff --git a/lib/resource.c b/lib/resource.c index 68718dfb..ab8c800f 100644 --- a/lib/resource.c +++ b/lib/resource.c @@ -31,7 +31,7 @@ struct pool { resource r; list inside; - char *name; + const char *name; }; static void pool_dump(resource *); @@ -61,7 +61,7 @@ static int indent; * parent pool. */ pool * -rp_new(pool *p, char *name) +rp_new(pool *p, const char *name) { pool *z = ralloc(p, &pool_class); z->name = name; diff --git a/lib/resource.h b/lib/resource.h index 1a62d389..1a0568b4 100644 --- a/lib/resource.h +++ b/lib/resource.h @@ -37,7 +37,7 @@ struct resclass { typedef struct pool pool; void resource_init(void); -pool *rp_new(pool *, char *); /* Create new pool */ +pool *rp_new(pool *, const char *); /* Create new pool */ void rfree(void *); /* Free single resource */ void rdump(void *); /* Dump to debug output */ size_t rmemsize(void *res); /* Return size of memory used by the resource */ diff --git a/lib/socket.h b/lib/socket.h index 7d1aa7ef..ce06a19c 100644 --- a/lib/socket.h +++ b/lib/socket.h @@ -12,6 +12,24 @@ #include #include "lib/resource.h" +#include "lib/libssh.h" + +struct ssh_sock { + const char *username; /* (Required) SSH user name */ + const char *server_hostkey_path; /* (Optional) Filepath to the SSH public key of remote side, can be knownhost file */ + const char *client_privkey_path; /* (Optional) Filepath to the SSH private key of BIRD */ + const char *subsystem; /* (Optional) Name of SSH subsytem */ + ssh_session session; /* Internal */ + ssh_channel channel; /* Internal */ + int state; /* Internal */ +#define SK_SSH_CONNECT 0 /* Start state */ +#define SK_SSH_SERVER_KNOWN 1 /* Internal */ +#define SK_SSH_USERAUTH 2 /* Internal */ +#define SK_SSH_CHANNEL 3 /* Internal */ +#define SK_SSH_SESSION 4 /* Internal */ +#define SK_SSH_SUBSYSTEM 5 /* Internal */ +#define SK_SSH_ESTABLISHED 6 /* Final state */ +}; typedef struct birdsock { resource r; @@ -20,6 +38,7 @@ typedef struct birdsock { int subtype; /* Socket subtype */ void *data; /* User data */ ip_addr saddr, daddr; /* IPA_NONE = unspecified */ + const char *host; /* Alternative to daddr, NULL = unspecified */ uint sport, dport; /* 0 = unspecified (for IP: protocol type) */ int tos; /* TOS / traffic class, -1 = default */ int priority; /* Local socket priority, -1 = default */ @@ -52,7 +71,8 @@ typedef struct birdsock { node n; void *rbuf_alloc, *tbuf_alloc; char *password; /* Password for MD5 authentication */ - char *err; /* Error message */ + const char *err; /* Error message */ + struct ssh_sock *ssh; /* Used in SK_SSH */ } sock; sock *sock_new(pool *); /* Allocate new socket */ @@ -115,6 +135,8 @@ extern int sk_priority_control; /* Suggested priority for control traffic, shou #define SK_MAGIC 7 /* Internal use by sysdep code */ #define SK_UNIX_PASSIVE 8 #define SK_UNIX 9 +#define SK_SSH_ACTIVE 10 /* - - * * - ? - DA = host */ +#define SK_SSH 11 /* * Socket subtypes -- cgit v1.2.3