Commit 41f4b594 authored by Pavel Tvrdík's avatar Pavel Tvrdík
Browse files

RPKI protocol with integrated RTRLib inside 

Add the RPKI protocol (RFC 6810) using the RTRLib
(http://rpki.realmv6.org/) that is integrated inside
the BIRD's code.

Implemeted transports are:
 - unprotected transport over TCP
 - secure transport over SSHv2

The code should work properly with one or more cache servers per protocol.

Example configuration of bird.conf:
  ...
  roa4 table roatable;

  protocol rpki {
    table roatable;

    cache 127.0.0.1; # defaults: port 8282, preference 1, no encryption

    cache 127.0.0.1 {
      preference 1;
      port 2222;
      ssh encryption {
        bird private key "/home/birdgeek/.ssh/id_rsa";
        cache public key "/home/birdgeek/.ssh/known_hosts";
        user "birdgeek";
      };
    };

    cache "rpki-validator.realmv6.org" {
      preference 2;
    };
  }
  ...
parent 74d94167

conf/confbase.Y

+19 −0
Original line number Diff line number Diff line
@@ -10,6 +10,8 @@ CF_HDR 


#define PARSER 1



#include <stdio.h>



#include "nest/bird.h"

#include "conf/conf.h"

#include "lib/resource.h"
@@ -26,6 +28,13 @@ CF_HDR 


CF_DEFINES



static void

check_u8(unsigned val)

{

  if (val > 0xFF)

    cf_error("Value %d out of range (0-255)", val);

}



static void

check_u16(unsigned val)

{
@@ -33,6 +42,16 @@ check_u16(unsigned val) 
    cf_error("Value %d out of range (0-65535)", val);

}



static void

check_file_readability(const char *file_path)

{

  FILE *file = fopen(file_path, "r");

  if (file)

    fclose(file);

  else

    cf_error("File '%s' cannot be open for read: %m", file_path);

}



CF_DECLS



%union {

configure.in

+5 −3
Original line number Diff line number Diff line
@@ -175,9 +175,7 @@ fi 


AC_SUBST(iproutedir)



# all_protocols="$proto_bfd bgp ospf pipe radv rip static"

all_protocols="$proto_bfd ospf pipe radv rip static"



all_protocols="$proto_bfd ospf pipe radv rip rpki static" # TODO: add BGP

all_protocols=`echo $all_protocols | sed 's/ /,/g'`



if test "$with_protocols" = all ; then
@@ -234,6 +232,10 @@ if test "$enable_debug" = yes ; then 
	fi

fi



BIRD_LIBS=

AC_CHECK_LIB(dl, dlopen, BIRD_LIBS="-ldl")

AC_SUBST(BIRD_LIBS)



CLIENT=

CLIENT_LIBS=

if test "$enable_client" = yes ; then

lib/Modules

+2 −0
Original line number Diff line number Diff line
@@ -34,3 +34,5 @@ checksum.c 
checksum.h

alloca.h

net.c

libssh.c

libssh.h
 
 No newline at end of file

lib/libssh.c

0 → 100644
+126 −0
Original line number Diff line number Diff line 
/*

 *	BIRD -- Mockup of SSH Library for loading LibSSH using dlopen

 *

 *	(c) 2015 CZ.NIC

 *

 *	This file was part of SSH Library: http://www.libssh.org/

 *	(c) 2003-2009 by Aris Adamantiadis (SSH Library)

 *

 *	Can be freely distributed and used under the terms of the GNU GPL.

 */



#include <dlfcn.h>

#include "nest/bird.h"

#include "lib/libssh.h"



#define FILENAME_OF_SHARED_OBJECT_LIBSSH "libssh.so"



static void *libssh;



/*

 * @return NULL if success

 * @return string with error if failed

 */

const char *

load_libssh(void)

{

  char *err_buf;



  libssh = dlopen(FILENAME_OF_SHARED_OBJECT_LIBSSH, RTLD_LAZY);

  if (!libssh)

  {

    /* This would be probably often repeated problem */

    char *help_msg = "You have to install libssh library.";

    err_buf = mb_alloc(&root_pool, 512); /* FIXME: free memory */

    bsnprintf(err_buf, 512, "%s. %s", dlerror(), help_msg);

    return err_buf;

  }



  dlerror(); /* Clear any existing error */



  ssh_new = (ssh_session (*)(void)) dlsym(libssh, "ssh_new");

  if ((err_buf = dlerror()) != NULL)

    return err_buf;



  ssh_set_blocking = (void (*)(ssh_session, int)) dlsym(libssh, "ssh_set_blocking");

  if ((err_buf = dlerror()) != NULL)

    return err_buf;



  ssh_options_set = (int (*)(ssh_session, enum ssh_options_e, const void *)) dlsym(libssh, "ssh_options_set");

  if ((err_buf = dlerror()) != NULL)

    return err_buf;



  ssh_connect = (int (*)(ssh_session)) dlsym(libssh, "ssh_connect");

  if ((err_buf = dlerror()) != NULL)

    return err_buf;



  ssh_get_fd = (socket_t (*)(ssh_session)) dlsym(libssh, "ssh_get_fd");

  if ((err_buf = dlerror()) != NULL)

    return err_buf;



  ssh_is_server_known = (int (*)(ssh_session)) dlsym(libssh, "ssh_is_server_known");

  if ((err_buf = dlerror()) != NULL)

    return err_buf;



  ssh_userauth_publickey_auto = (int (*)(ssh_session, const char *, const char *)) dlsym(libssh, "ssh_userauth_publickey_auto");

  if ((err_buf = dlerror()) != NULL)

    return err_buf;



  ssh_get_error = (const char * (*)(void *)) dlsym(libssh, "ssh_get_error");

  if ((err_buf = dlerror()) != NULL)

    return err_buf;



  ssh_get_error_code = (int (*)(void *)) dlsym(libssh, "ssh_get_error_code");

  if ((err_buf = dlerror()) != NULL)

    return err_buf;



  ssh_disconnect = (void (*)(ssh_session)) dlsym(libssh, "ssh_disconnect");

  if ((err_buf = dlerror()) != NULL)

    return err_buf;



  ssh_free = (void (*)(ssh_session)) dlsym(libssh, "ssh_free");

  if ((err_buf = dlerror()) != NULL)

    return err_buf;



  ssh_channel_new = (ssh_channel (*)(ssh_session)) dlsym(libssh, "ssh_channel_new");

  if ((err_buf = dlerror()) != NULL)

    return err_buf;



  ssh_channel_is_open = (int (*)(ssh_channel)) dlsym(libssh, "ssh_channel_is_open");

  if ((err_buf = dlerror()) != NULL)

    return err_buf;



  ssh_channel_close = (int (*)(ssh_channel)) dlsym(libssh, "ssh_channel_close");

  if ((err_buf = dlerror()) != NULL)

    return err_buf;



  ssh_channel_free = (void (*)(ssh_channel)) dlsym(libssh, "ssh_channel_free");

  if ((err_buf = dlerror()) != NULL)

    return err_buf;



  ssh_channel_open_session = (int (*)(ssh_channel)) dlsym(libssh, "ssh_channel_open_session");

  if ((err_buf = dlerror()) != NULL)

    return err_buf;



  ssh_channel_request_subsystem = (int (*)(ssh_channel, const char *)) dlsym(libssh, "ssh_channel_request_subsystem");

  if ((err_buf = dlerror()) != NULL)

    return err_buf;



  ssh_channel_read_nonblocking = (int (*)(ssh_channel, void *, uint32_t, int)) dlsym(libssh, "ssh_channel_read_nonblocking");

  if ((err_buf = dlerror()) != NULL)

    return err_buf;



  ssh_channel_is_eof = (int (*)(ssh_channel)) dlsym(libssh, "ssh_channel_is_eof");

  if ((err_buf = dlerror()) != NULL)

    return err_buf;



  ssh_channel_select = (int (*)(ssh_channel *, ssh_channel *, ssh_channel *, struct timeval *)) dlsym(libssh, "ssh_channel_select");

  if ((err_buf = dlerror()) != NULL)

    return err_buf;



  ssh_channel_write = (int (*)(ssh_channel, const void *, uint32_t)) dlsym(libssh, "ssh_channel_write");

  if ((err_buf = dlerror()) != NULL)

    return err_buf;



  return NULL;

}

lib/libssh.h

0 → 100644
+133 −0
Original line number Diff line number Diff line 
/*

 *	BIRD -- Mockup headers of SSH Library for loading LibSSH using dlopen

 *

 *	(c) 2015 CZ.NIC

 *

 *	This file was part of SSH Library: http://www.libssh.org/

 *	(c) 2003-2009 by Aris Adamantiadis (SSH Library)

 *

 *	Can be freely distributed and used under the terms of the GNU GPL.

 */



#ifndef _BIRD_LIBSSH_H_

#define _BIRD_LIBSSH_H_



#include <unistd.h>

#include <inttypes.h>



typedef struct ssh_session_struct* ssh_session;

typedef struct ssh_channel_struct* ssh_channel;



/* Error return codes */

#define SSH_OK 0     /* No error */

#define SSH_ERROR -1 /* Error of some kind */

#define SSH_AGAIN -2 /* The nonblocking call must be repeated */

#define SSH_EOF -127 /* We have already a eof */



enum ssh_server_known_e {

  SSH_SERVER_ERROR=-1,

  SSH_SERVER_NOT_KNOWN=0,

  SSH_SERVER_KNOWN_OK,

  SSH_SERVER_KNOWN_CHANGED,

  SSH_SERVER_FOUND_OTHER,

  SSH_SERVER_FILE_NOT_FOUND

};



enum ssh_auth_e {

  SSH_AUTH_SUCCESS=0,

  SSH_AUTH_DENIED,

  SSH_AUTH_PARTIAL,

  SSH_AUTH_INFO,

  SSH_AUTH_AGAIN,

  SSH_AUTH_ERROR=-1

};



enum ssh_error_types_e {

  SSH_NO_ERROR=0,

  SSH_REQUEST_DENIED,

  SSH_FATAL,

  SSH_EINTR

};



enum ssh_options_e {

  SSH_OPTIONS_HOST,

  SSH_OPTIONS_PORT,

  SSH_OPTIONS_PORT_STR,

  SSH_OPTIONS_FD,

  SSH_OPTIONS_USER,

  SSH_OPTIONS_SSH_DIR,

  SSH_OPTIONS_IDENTITY,

  SSH_OPTIONS_ADD_IDENTITY,

  SSH_OPTIONS_KNOWNHOSTS,

  SSH_OPTIONS_TIMEOUT,

  SSH_OPTIONS_TIMEOUT_USEC,

  SSH_OPTIONS_SSH1,

  SSH_OPTIONS_SSH2,

  SSH_OPTIONS_LOG_VERBOSITY,

  SSH_OPTIONS_LOG_VERBOSITY_STR,

  SSH_OPTIONS_CIPHERS_C_S,

  SSH_OPTIONS_CIPHERS_S_C,

  SSH_OPTIONS_COMPRESSION_C_S,

  SSH_OPTIONS_COMPRESSION_S_C,

  SSH_OPTIONS_PROXYCOMMAND,

  SSH_OPTIONS_BINDADDR,

  SSH_OPTIONS_STRICTHOSTKEYCHECK,

  SSH_OPTIONS_COMPRESSION,

  SSH_OPTIONS_COMPRESSION_LEVEL,

  SSH_OPTIONS_KEY_EXCHANGE,

  SSH_OPTIONS_HOSTKEYS,

  SSH_OPTIONS_GSSAPI_SERVER_IDENTITY,

  SSH_OPTIONS_GSSAPI_CLIENT_IDENTITY,

  SSH_OPTIONS_GSSAPI_DELEGATE_CREDENTIALS,

  SSH_OPTIONS_HMAC_C_S,

  SSH_OPTIONS_HMAC_S_C,

};



enum {

  /** No logging at all

   */

  SSH_LOG_NOLOG=0,

  /** Only warnings

   */

  SSH_LOG_WARNING,

  /** High level protocol information

   */

  SSH_LOG_PROTOCOL,

  /** Lower level protocol infomations, packet level

   */

  SSH_LOG_PACKET,

  /** Every function path

   */

  SSH_LOG_FUNCTIONS

};



#ifndef socket_t

typedef int socket_t;

#endif



ssh_session (*ssh_new)(void);

void (*ssh_set_blocking)(ssh_session session, int blocking);

int (*ssh_options_set)(ssh_session session, enum ssh_options_e type, const void *value);

int (*ssh_connect)(ssh_session session);

socket_t (*ssh_get_fd)(ssh_session session);

int (*ssh_is_server_known)(ssh_session session);

int (*ssh_userauth_publickey_auto)(ssh_session session, const char *username, const char *passphrase);

const char * (*ssh_get_error)(void *error);

int (*ssh_get_error_code)(void *error);

void (*ssh_disconnect)(ssh_session session);

void (*ssh_free)(ssh_session session);



ssh_channel (*ssh_channel_new)(ssh_session session);

int (*ssh_channel_is_open)(ssh_channel channel);

int (*ssh_channel_close)(ssh_channel channel);

void (*ssh_channel_free)(ssh_channel channel);

int (*ssh_channel_open_session)(ssh_channel channel);

int (*ssh_channel_request_subsystem)(ssh_channel channel, const char *subsystem);

int (*ssh_channel_read_nonblocking)(ssh_channel channel, void *dest, uint32_t count, int is_stderr);

int (*ssh_channel_is_eof)(ssh_channel channel);

int (*ssh_channel_select)(ssh_channel *readchans, ssh_channel *writechans, ssh_channel *exceptchans, struct timeval * timeout);

int (*ssh_channel_write)(ssh_channel channel, const void *data, uint32_t len);



const char *load_libssh(void);



#endif /* _BIRD_LIBSSH_H_ */

CRA Git | Maintained and supported by SUSTech CRA and CCSE