lib: Replace shim IPCPs with points of attachment

Removes the UDP and Ethernet shim IPCPs. The unicast and broadcast
IPCPs can now directly attach to a "legacy" socket. We adopt Saltzer's
Point-of-Attachment terminology, also advocated in Day's "Patterns in
Network Architecture". The "poa" component manages these
PoA's with one management thread, one link monitoring thread and one
thread per attached point.

For Ethernet PoA's the irm connect and enroll can resolve the
destination IPCP or Layer name with a broadcast name query over the
attached PoAs (first reply wins). UDP PoA's require a destination IP
address or FQDN.

attach to a local endpoint (required both server and client side):

 irm ipcp poa attach name a udp 10.0.0.1
 irm ipcp poa attach name a udp 10.0.0.1:3435
 irm ipcp poa attach name a udp [::1]:3435
 irm ipcp poa attach name a eth dev eth0
 irm ipcp poa attach name a eth dev eth0 ethertype 0xA000

release a PoA (refused while it carries a flow):

 irm ipcp poa detach name a udp 10.0.0.1:3435
 irm ipcp poa detach name a eth eth0

list an IPCP's PoAs:

 irm ipcp poa list name a

connect to a peer, by name or at an address:

 irm ipcp connect name b dst a
 irm ipcp connect name b dst a eth
 irm ipcp connect name b dst a eth dev eth0
 irm ipcp connect name b dst a udp 10.0.0.1:3435
 irm ipcp connect name b dst a udp peer.example.com:3435

disconnect by peer name, no address:

 irm ipcp disconnect name b dst a
 irm ipcp disconnect name b dst a component mgmt

enroll has the same shape as connect:

 irm ipcp enroll name b layer lr autobind
 irm ipcp enroll name b layer lr autobind eth dev eth0
 irm ipcp enroll name b layer lr autobind udp 10.0.0.1:3435

the IRMd config file attaches PoAs and names peers the same way:

 udp = [ "10.0.0.1", "10.0.0.1:3436" ]
 eth = [ "eth0", {dev="eth1", ethertype=0xA007} ]

 enrol={dst="LAN", eth={dev="eth0"}}
 conn=[{dst="lan3", eth={}}, {dst="lan4", udp="10.0.0.1:3435"}]

Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks>
Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>

1 files changed, 23 insertions, 15 deletions

diff --git a/src/irmd/oap/cli.c b/src/irmd/oap/cli.c
index ebfcd71f..2203596f 100644
--- a/src/irmd/oap/cli.c
+++ b/src/irmd/oap/cli.c
@@ -50,6 +50,7 @@
 struct oap_cli_ctx {
         uint8_t           __id[OAP_ID_SIZE];
         buffer_t          id;
+        char              peer[NAME_SIZE + 1]; /* expected server name */
         uint8_t           kex_buf[CRYPT_KEY_BUFSZ];
         uint8_t           req_hash[MAX_HASH_SIZE];
         size_t            req_hash_len;
@@ -241,6 +242,7 @@ static int do_client_kex_prepare(const char *         server_name,
 
 int oap_cli_prepare(void **                  ctx,
                     const struct name_info * info,
+                    const char *             peer,
                     buffer_t *               req_buf,
                     buffer_t                 data,
                     bool                     rekey)
@@ -259,6 +261,11 @@ int oap_cli_prepare(void **                  ctx,
         clrbuf(*req_buf);
         *ctx = NULL;
 
+        if (peer != NULL && strlen(peer) > NAME_SIZE) {
+                log_err("Peer name too long.");
+                return -EINVAL;
+        }
+
         /* Allocate ctx to carry between prepare and complete */
         s = malloc(sizeof(*s));
         if (s == NULL) {
@@ -269,13 +276,15 @@ int oap_cli_prepare(void **                  ctx,
         memset(s, 0, sizeof(*s));
         OAP_CLI_CTX_INIT(s);
 
+        strcpy(s->peer, peer != NULL ? peer : info->name);
+
         /* Generate session ID */
         if (random_buffer(s->__id, OAP_ID_SIZE) < 0) {
                 log_err("Failed to generate OAP session ID.");
                 goto fail_id;
         }
 
-        log_dbg_id(s->id.data, "Preparing OAP request for %s.", info->name);
+        log_dbg_id(s->id.data, "Preparing OAP request for %s.", s->peer);
 
         /* Load client credentials */
         if (load_cli_credentials(info, &pkp, &crt) < 0) {
@@ -315,7 +324,7 @@ int oap_cli_prepare(void **                  ctx,
 
         oap_hdr_init(&s->local_hdr, s->id, s->kex_buf, data, s->scfg.c.nid);
 
-        if (do_client_kex_prepare(info->name, s) < 0) {
+        if (do_client_kex_prepare(s->peer, s) < 0) {
                 log_err_id(s->id.data, "Failed to prepare client KEX.");
                 goto fail_kex;
         }
@@ -482,7 +491,8 @@ static int do_client_kex_complete(struct oap_cli_ctx *   s,
         }
 
         SET_KEX_CIPHER(scfg, peer_hdr->cipher_str);
-        if (crypt_validate_nid(scfg->c.nid) < 0) {
+
+        if (crypt_cipher_rank(scfg->c.nid) < 0) {
                 log_err_id(id, "Server cipher '%s' not supported.",
                            peer_hdr->cipher_str);
                 return -ENOTSUP;
@@ -518,13 +528,12 @@ static int do_client_kex_complete(struct oap_cli_ctx *   s,
         return do_client_kex_complete_dhe(s, peer_hdr, sk);
 }
 
-int oap_cli_complete(void *                   ctx,
-                     const struct name_info * info,
-                     buffer_t                 rsp_buf,
-                     buffer_t *               data,
-                     struct crypt_sk *        sk,
-                     const buffer_t *         cached_crt,
-                     buffer_t *               peer_crt)
+int oap_cli_complete(void *            ctx,
+                     buffer_t          rsp_buf,
+                     buffer_t *        data,
+                     struct crypt_sk * sk,
+                     const buffer_t *  cached_crt,
+                     buffer_t *        peer_crt)
 {
         struct oap_cli_ctx * s = ctx;
         struct oap_hdr       peer_hdr;
@@ -538,7 +547,6 @@ int oap_cli_complete(void *                   ctx,
         int                  rc;
 
         assert(ctx != NULL);
-        assert(info != NULL);
         assert(data != NULL);
         assert(sk != NULL);
 
@@ -550,7 +558,7 @@ int oap_cli_complete(void *                   ctx,
 
         id = s->id.data;
 
-        log_dbg_id(id, "Completing OAP for %s.", info->name);
+        log_dbg_id(id, "Completing OAP for %s.", s->peer);
 
         /* Decode response header using client's md_nid for hash length */
         if (oap_hdr_decode(&peer_hdr, rsp_buf, s->req_md_nid, false) < 0) {
@@ -616,9 +624,9 @@ int oap_cli_complete(void *                   ctx,
         }
 
         /* Verify peer certificate name matches expected destination */
-        if (peer_hdr.crt.len > 0 && strcmp(peer, info->name) != 0) {
+        if (peer_hdr.crt.len > 0 && strcmp(peer, s->peer) != 0) {
                 log_err_id(id, "Peer crt for '%s' does not match '%s'.",
-                         peer, info->name);
+                         peer, s->peer);
                 goto fail_oap;
         }
 
@@ -667,7 +675,7 @@ int oap_cli_complete(void *                   ctx,
                 goto fail_oap;
         }
 
-        log_info_id(id, "OAP completed for %s.", info->name);
+        log_info_id(id, "OAP completed for %s.", s->peer);
 
         freebuf(peer_hdr.sealed_pt);