Re: RPKI support without SSH transport

[Clemens Schrimpe]

> On 25. Mar 2020, at 13:37, Ondrej Zajicek  wrote:
> 
> Yes, current code in git should be OK, all code in ssh_transport.c is
> commented out.

Confirmed. Thank you very much for the great work (not only this patch ... :-)

Greetings,

Clemens

Re: RPKI support without SSH transport

[Clemens Schrimpe]

> On 25. Mar 2020, at 13:37, Ondrej Zajicek  wrote:
> 
> Yes, current code in git should be OK, all code in ssh_transport.c is
> commented out.

I'll git pull and try it out asap. Thanks,

Clemens

Re: RPKI support without SSH transport

[Ondrej Zajicek]

On Wed, Mar 25, 2020 at 02:17:13PM +0300, Mikhail Grishin wrote:
> Hi,
> 
> In my case all compiled fine:
> 
> ./configure --disable-libssh

Yes, current code in git should be OK, all code in ssh_transport.c is
commented out.

> CC -o obj/proto/rpki/ssh_transport.o -c proto/rpki/ssh_transport.c
> CC -o obj/proto/rpki/transport.o -c proto/rpki/transport.c
> CC -o obj/proto/static/static.o -c proto/static/static.c
> 
> > No, unfortunately it does not - not any more, at least:
> > 
> > Configured with
> > 
> > ./configure --disable-libssh
> > 
> > it doesn't compile /proto/rpki/ssh_transport.c /because it references
> > "struct ssh_sock" and "SK_SSH_CONNECT", whose definitions are excluded
> > in lib/socket.h unless HAVE_LIBSSH is defined →
> > 
> > CC -o obj/proto/rpki/ssh_transport.o -c proto/rpki/ssh_transport.c
> > proto/rpki/ssh_transport.c: In function 'rpki_tr_ssh_open':
> > proto/rpki/ssh_transport.c:29:40: error: invalid application of
> > 'sizeof' to incomplete type 'struct ssh_sock'
> >sk->ssh = mb_allocz(sk->pool, sizeof(struct ssh_sock));
> > ^~
> > proto/rpki/ssh_transport.c:30:10: error: dereferencing pointer to
> > incomplete type 'struct ssh_sock'
> >  sk->ssh->username = ssh_cf->user;
> >   ^~
> > proto/rpki/ssh_transport.c:34:20: error: 'SK_SSH_CONNECT'
> > undeclared (first use in this function)
> >sk->ssh->state = SK_SSH_CONNECT;
> > ^~
> > 
> > 
> > Again: Thanks for your great support!
> > 
> > Clemens
> > 
> > 
> 

-- 
Elen sila lumenn' omentielvo

Ondrej 'Santiago' Zajicek (email: santi...@crfreenet.org)
OpenPGP encrypted e-mails preferred (KeyID 0x11DEADC3, wwwkeys.pgp.net)
"To err is human -- to blame it on a computer is even more so."

Re: RPKI support without SSH transport

[Mikhail Grishin]

Hi,

In my case all compiled fine:

./configure --disable-libssh
.


CC -o obj/proto/rpki/ssh_transport.o -c proto/rpki/ssh_transport.c
CC -o obj/proto/rpki/transport.o -c proto/rpki/transport.c
CC -o obj/proto/static/static.o -c proto/static/static.c


Clemens Schrimpe пишет 19.03.2020 16:44:

Hello and sorry for the late feedback ... lots of things going on ...


On 14. Jan 2020, at 16:45, Maria Matějka > wrote:


however, attempts to build it without /--disable-libssh/ result in a 
linking error:


Oops, sorry, I missed one include. Here is the fixed patch, now it 
compiles both with and without libSSH.


Maria



No, unfortunately it does not - not any more, at least:

Configured with

./configure --disable-libssh

it doesn't compile /proto/rpki/ssh_transport.c /because it references 
"struct ssh_sock" and "SK_SSH_CONNECT", whose definitions are excluded 
in lib/socket.h unless HAVE_LIBSSH is defined →


CC -o obj/proto/rpki/ssh_transport.o -c proto/rpki/ssh_transport.c
proto/rpki/ssh_transport.c: In function 'rpki_tr_ssh_open':
proto/rpki/ssh_transport.c:29:40: error: invalid application of
'sizeof' to incomplete type 'struct ssh_sock'
   sk->ssh = mb_allocz(sk->pool, sizeof(struct ssh_sock));
^~
proto/rpki/ssh_transport.c:30:10: error: dereferencing pointer to
incomplete type 'struct ssh_sock'
 sk->ssh->username = ssh_cf->user;
  ^~
proto/rpki/ssh_transport.c:34:20: error: 'SK_SSH_CONNECT'
undeclared (first use in this function)
   sk->ssh->state = SK_SSH_CONNECT;
^~


Again: Thanks for your great support!

Clemens

Re: RPKI support without SSH transport

[Clemens Schrimpe]

Hello and sorry for the late feedback ... lots of things going on ... 


> On 14. Jan 2020, at 16:45, Maria Matějka  wrote:
> 
>> however, attempts to build it without /--disable-libssh/ result in a linking 
>> error:
> 
> Oops, sorry, I missed one include. Here is the fixed patch, now it compiles 
> both with and without libSSH.
> 
> Maria
> 

No, unfortunately it does not - not any more, at least:

Configured with

./configure --disable-libssh

it doesn't compile proto/rpki/ssh_transport.c because it references "struct 
ssh_sock" and "SK_SSH_CONNECT", whose definitions are excluded in lib/socket.h 
unless HAVE_LIBSSH is defined →

CC -o obj/proto/rpki/ssh_transport.o -c proto/rpki/ssh_transport.c
proto/rpki/ssh_transport.c: In function 'rpki_tr_ssh_open':
proto/rpki/ssh_transport.c:29:40: error: invalid application of 'sizeof' to 
incomplete type 'struct ssh_sock'
   sk->ssh = mb_allocz(sk->pool, sizeof(struct ssh_sock));
^~
proto/rpki/ssh_transport.c:30:10: error: dereferencing pointer to incomplete 
type 'struct ssh_sock'
   sk->ssh->username = ssh_cf->user;
  ^~
proto/rpki/ssh_transport.c:34:20: error: 'SK_SSH_CONNECT' undeclared (first use 
in this function)
   sk->ssh->state = SK_SSH_CONNECT;
^~

Again: Thanks for your great support!

Clemens

Re: RPKI support without SSH transport

[Maria Matějka]

> however, attempts to build it without /--disable-libssh/ result in a linking 
> error:

Oops, sorry, I missed one include. Here is the fixed patch, now it compiles 
both with and without libSSH.

Maria
diff --git a/configure.ac b/configure.ac
index 40f021a1..da8546a6 100644
--- a/configure.ac
+++ b/configure.ac
@@ -37,7 +37,7 @@ AC_ARG_ENABLE([pthreads],
 )
 
 AC_ARG_ENABLE([libssh],
-  [AS_HELP_STRING([--enable-libssh], [enable LibSSH support together with RPKI @<:@try@:>@])],
+  [AS_HELP_STRING([--enable-libssh], [enable LibSSH support in RPKI @<:@try@:>@])],
   [],
   [enable_libssh=try]
 )
@@ -271,7 +271,6 @@ if test "$enable_libssh" != no ; then
   if test "$fail" != yes ; then
 AC_DEFINE([HAVE_LIBSSH], [1], [Define to 1 if you have the `ssh' library (-lssh).])
 DAEMON_LIBS="-lssh $DAEMON_LIBS"
-proto_rpki=rpki
 enable_libssh=yes
   else
 if test "$enable_libssh" = yes ; then
@@ -296,7 +295,7 @@ if test "$enable_mpls_kernel" != no ; then
   fi
 fi
 
-all_protocols="$proto_bfd babel bgp mrt ospf perf pipe radv rip $proto_rpki static"
+all_protocols="$proto_bfd babel bgp mrt ospf perf pipe radv rip rpki static"
 
 all_protocols=`echo $all_protocols | sed 's/ /,/g'`
 
@@ -453,6 +452,7 @@ AC_MSG_RESULT([System configuration:	$sysdesc])
 AC_MSG_RESULT([Debugging:		$enable_debug])
 AC_MSG_RESULT([POSIX threads:		$enable_pthreads])
 AC_MSG_RESULT([Routing protocols:	$protocols])
+AC_MSG_RESULT([LibSSH support in RPKI:	$enable_libssh])
 AC_MSG_RESULT([Kernel MPLS support:	$enable_mpls_kernel])
 AC_MSG_RESULT([Client:			$enable_client])
 
diff --git a/proto/rpki/config.Y b/proto/rpki/config.Y
index 63c7105c..924066f8 100644
--- a/proto/rpki/config.Y
+++ b/proto/rpki/config.Y
@@ -117,9 +117,13 @@ rpki_transport_tcp_init:
 
 rpki_transport_ssh_init:
 {
+#if HAVE_LIBSSH
   rpki_check_unused_transport();
   RPKI_CFG->tr_config.spec = cfg_allocz(sizeof(struct rpki_tr_ssh_config));
   RPKI_CFG->tr_config.type = RPKI_TR_SSH;
+#else
+  cf_error("This build doesn't support SSH");
+#endif
 };
 
 rpki_transport_ssh_opts:
diff --git a/proto/rpki/rpki.c b/proto/rpki/rpki.c
index 70cd0cdd..aa07f7d9 100644
--- a/proto/rpki/rpki.c
+++ b/proto/rpki/rpki.c
@@ -579,7 +579,9 @@ rpki_init_cache(struct rpki_proto *p, struct rpki_config *cf)
   switch (cf->tr_config.type)
   {
   case RPKI_TR_TCP: rpki_tr_tcp_init(cache->tr_sock); break;
+#if HAVE_LIBSSH
   case RPKI_TR_SSH: rpki_tr_ssh_init(cache->tr_sock); break;
+#endif
   };
 
   CACHE_DBG(cache, "Connection object created");
@@ -683,6 +685,7 @@ rpki_reconfigure_cache(struct rpki_proto *p UNUSED, struct rpki_cache *cache, st
 CACHE_TRACE(D_EVENTS, cache, "Transport type changed");
 return NEED_RESTART;
   }
+#if HAVE_LIBSSH
   else if (new->tr_config.type == RPKI_TR_SSH)
   {
 struct rpki_tr_ssh_config *ssh_old = (void *) old->tr_config.spec;
@@ -695,6 +698,7 @@ rpki_reconfigure_cache(struct rpki_proto *p UNUSED, struct rpki_cache *cache, st
   try_fast_reconnect = 1;
 }
   }
+#endif
 
 #define TEST_INTERVAL(name, Name) 		\
 if (cache->name##_interval != new->name##_interval ||			\
@@ -813,7 +817,9 @@ rpki_show_proto_info(struct proto *P)
 
 switch (cf->tr_config.type)
 {
+#if HAVE_LIBSSH
 case RPKI_TR_SSH: transport_name = "SSHv2"; break;
+#endif
 case RPKI_TR_TCP: transport_name = "Unprotected over TCP"; break;
 };
 
@@ -887,9 +893,11 @@ rpki_check_config(struct rpki_config *cf)
 /* Set default port numbers */
 switch (cf->tr_config.type)
 {
+#if HAVE_LIBSSH
 case RPKI_TR_SSH:
   cf->port = RPKI_SSH_PORT;
   break;
+#endif
 default:
   cf->port = RPKI_TCP_PORT;
 }
diff --git a/proto/rpki/ssh_transport.c b/proto/rpki/ssh_transport.c
index 13e061fc..469eb199 100644
--- a/proto/rpki/ssh_transport.c
+++ b/proto/rpki/ssh_transport.c
@@ -17,6 +17,8 @@
 
 #include "rpki.h"
 
+#if HAVE_LIBSSH
+
 static int
 rpki_tr_ssh_open(struct rpki_tr_sock *tr)
 {
@@ -71,3 +73,5 @@ rpki_tr_ssh_init(struct rpki_tr_sock *tr)
   tr->open_fp = &rpki_tr_ssh_open;
   tr->ident_fp = &rpki_tr_ssh_ident;
 }
+
+#endif
diff --git a/proto/rpki/transport.h b/proto/rpki/transport.h
index f90b7e42..bb8d41eb 100644
--- a/proto/rpki/transport.h
+++ b/proto/rpki/transport.h
@@ -51,7 +51,9 @@ const char *rpki_tr_ident(struct rpki_tr_sock *tr);
 /* Types of supported transports */
 enum rpki_tr_type {
   RPKI_TR_TCP,/* Unprotected transport over TCP */
+#if HAVE_LIBSSH
   RPKI_TR_SSH,/* Protected transport by SSHv2 connection */
+#endif
 };
 
 /* Common configure structure for transports */


smime.p7s
Description: S/MIME Cryptographic Signature

Re: RPKI support without SSH transport

[Clemens Schrimpe]

> Please try the attached patch. It has not been tested, yet it compiles
> with no LibSSH available.

This appears to work nicely. After running autoreconf and ./configure 
--disable-libssh it builds a bird with RPKI support, which is still "lean":

DEV 2.x MIPS:~/bird-patch> ldd bird
linux-vdso.so.1 (0x771ed000)
libpthread.so.0 => /lib/mips-linux-gnu/libpthread.so.0 (0x770a2000)
libc.so.6 => /lib/mips-linux-gnu/libc.so.6 (0x76f2)
/lib/ld.so.1 => /lib64/ld.so.1 (0x771bc000)

however, attempts to build it without --disable-libssh result in a linking 
error:

/tmp/ccz8W8kL.ltrans12.ltrans.o: In function `rpki_init_cache':
/home/csch/bird-patch/proto/rpki/rpki.c:583: undefined reference to 
`rpki_tr_ssh_init'
/home/csch/bird-patch/proto/rpki/rpki.c:583: undefined reference to 
`rpki_tr_ssh_init'
collect2: error: ld returned 1 exit status

It still works without the patch, but (as mentioned) yields a bird with many 
external dependencies:

DEV 2.x MIPS:~/bird> ldd bird
linux-vdso.so.1 (0x7755a000)
libssh.so.4 => /usr/lib/mips-linux-gnu/libssh.so.4 (0x773bb000)
libpthread.so.0 => /lib/mips-linux-gnu/libpthread.so.0 (0x7738e000)
libc.so.6 => /lib/mips-linux-gnu/libc.so.6 (0x7720c000)
librt.so.1 => /lib/mips-linux-gnu/librt.so.1 (0x771f4000)
libcrypto.so.1.0.2 => /usr/lib/mips-linux-gnu/libcrypto.so.1.0.2 
(0x77034000)
libz.so.1 => /lib/mips-linux-gnu/libz.so.1 (0x7700b000)
libgssapi_krb5.so.2 => /usr/lib/mips-linux-gnu/libgssapi_krb5.so.2 
(0x76fb8000)
/lib/ld.so.1 => /lib64/ld.so.1 (0x77529000)
libdl.so.2 => /lib/mips-linux-gnu/libdl.so.2 (0x76fa5000)
libkrb5.so.3 => /usr/lib/mips-linux-gnu/libkrb5.so.3 (0x76ed6000)
libk5crypto.so.3 => /usr/lib/mips-linux-gnu/libk5crypto.so.3 
(0x76e91000)
libcom_err.so.2 => /lib/mips-linux-gnu/libcom_err.so.2 (0x76e7d000)
libkrb5support.so.0 => /usr/lib/mips-linux-gnu/libkrb5support.so.0 
(0x76e62000)
libkeyutils.so.1 => /lib/mips-linux-gnu/libkeyutils.so.1 (0x76e4e000)
libresolv.so.2 => /lib/mips-linux-gnu/libresolv.so.2 (0x76e28000)

To summarize → your patch works fine in "the forward direction" (towards 
solving the problem), but apparently creates another problem when building with 
libssh now.

🤷🏼‍♂️

Thanks for your efforts!

Clemens

Re: RPKI support without SSH transport

[Maria Matejka]

Hello!

Please try the attached patch. It has not been tested, yet it compiles
with no LibSSH available.

Maria

On 1/9/20 3:07 PM, Clemens Schrimpe wrote:
> Ahoj BIRD Parents -
> 
> I was wondering if there is a reason, why BIRD 2.0.x can't be built for RPKI 
> support without libssh, although RPKI-RTR would also work on an unencrypted 
> transport (as documented in the BIRD user documentation).
> 
> I am asking, because I am building BIRD for a hardware router platform 
> (Ubiquiti's EdgeRouters) and including libssh is, although doable, a real 
> pain-in-the-rear, depending on the OS version and hardware architecture (4 
> variants in the EdgeOS world at the moment).
> 
> Without libssh, which drags a whole slew of other library-crap behind it 🙄, 
> BIRD is pretty lightweight and very easy to deploy.
> 
> Just curious ...
> 
> Thanks a lot (again) for this great piece of software!
> 
>   Clemens
> 
> 
diff --git a/configure.ac b/configure.ac
index 40f021a1..da8546a6 100644
--- a/configure.ac
+++ b/configure.ac
@@ -37,7 +37,7 @@ AC_ARG_ENABLE([pthreads],
 )
 
 AC_ARG_ENABLE([libssh],
-  [AS_HELP_STRING([--enable-libssh], [enable LibSSH support together with RPKI @<:@try@:>@])],
+  [AS_HELP_STRING([--enable-libssh], [enable LibSSH support in RPKI @<:@try@:>@])],
   [],
   [enable_libssh=try]
 )
@@ -271,7 +271,6 @@ if test "$enable_libssh" != no ; then
   if test "$fail" != yes ; then
 AC_DEFINE([HAVE_LIBSSH], [1], [Define to 1 if you have the `ssh' library (-lssh).])
 DAEMON_LIBS="-lssh $DAEMON_LIBS"
-proto_rpki=rpki
 enable_libssh=yes
   else
 if test "$enable_libssh" = yes ; then
@@ -296,7 +295,7 @@ if test "$enable_mpls_kernel" != no ; then
   fi
 fi
 
-all_protocols="$proto_bfd babel bgp mrt ospf perf pipe radv rip $proto_rpki static"
+all_protocols="$proto_bfd babel bgp mrt ospf perf pipe radv rip rpki static"
 
 all_protocols=`echo $all_protocols | sed 's/ /,/g'`
 
@@ -453,6 +452,7 @@ AC_MSG_RESULT([System configuration:	$sysdesc])
 AC_MSG_RESULT([Debugging:		$enable_debug])
 AC_MSG_RESULT([POSIX threads:		$enable_pthreads])
 AC_MSG_RESULT([Routing protocols:	$protocols])
+AC_MSG_RESULT([LibSSH support in RPKI:	$enable_libssh])
 AC_MSG_RESULT([Kernel MPLS support:	$enable_mpls_kernel])
 AC_MSG_RESULT([Client:			$enable_client])
 
diff --git a/proto/rpki/config.Y b/proto/rpki/config.Y
index 63c7105c..924066f8 100644
--- a/proto/rpki/config.Y
+++ b/proto/rpki/config.Y
@@ -117,9 +117,13 @@ rpki_transport_tcp_init:
 
 rpki_transport_ssh_init:
 {
+#if HAVE_LIBSSH
   rpki_check_unused_transport();
   RPKI_CFG->tr_config.spec = cfg_allocz(sizeof(struct rpki_tr_ssh_config));
   RPKI_CFG->tr_config.type = RPKI_TR_SSH;
+#else
+  cf_error("This build doesn't support SSH");
+#endif
 };
 
 rpki_transport_ssh_opts:
diff --git a/proto/rpki/rpki.c b/proto/rpki/rpki.c
index 70cd0cdd..aa07f7d9 100644
--- a/proto/rpki/rpki.c
+++ b/proto/rpki/rpki.c
@@ -579,7 +579,9 @@ rpki_init_cache(struct rpki_proto *p, struct rpki_config *cf)
   switch (cf->tr_config.type)
   {
   case RPKI_TR_TCP: rpki_tr_tcp_init(cache->tr_sock); break;
+#if HAVE_LIBSSH
   case RPKI_TR_SSH: rpki_tr_ssh_init(cache->tr_sock); break;
+#endif
   };
 
   CACHE_DBG(cache, "Connection object created");
@@ -683,6 +685,7 @@ rpki_reconfigure_cache(struct rpki_proto *p UNUSED, struct rpki_cache *cache, st
 CACHE_TRACE(D_EVENTS, cache, "Transport type changed");
 return NEED_RESTART;
   }
+#if HAVE_LIBSSH
   else if (new->tr_config.type == RPKI_TR_SSH)
   {
 struct rpki_tr_ssh_config *ssh_old = (void *) old->tr_config.spec;
@@ -695,6 +698,7 @@ rpki_reconfigure_cache(struct rpki_proto *p UNUSED, struct rpki_cache *cache, st
   try_fast_reconnect = 1;
 }
   }
+#endif
 
 #define TEST_INTERVAL(name, Name) 		\
 if (cache->name##_interval != new->name##_interval ||			\
@@ -813,7 +817,9 @@ rpki_show_proto_info(struct proto *P)
 
 switch (cf->tr_config.type)
 {
+#if HAVE_LIBSSH
 case RPKI_TR_SSH: transport_name = "SSHv2"; break;
+#endif
 case RPKI_TR_TCP: transport_name = "Unprotected over TCP"; break;
 };
 
@@ -887,9 +893,11 @@ rpki_check_config(struct rpki_config *cf)
 /* Set default port numbers */
 switch (cf->tr_config.type)
 {
+#if HAVE_LIBSSH
 case RPKI_TR_SSH:
   cf->port = RPKI_SSH_PORT;
   break;
+#endif
 default:
   cf->port = RPKI_TCP_PORT;
 }
diff --git a/proto/rpki/ssh_transport.c b/proto/rpki/ssh_transport.c
index 13e061fc..1f508c80 100644
--- a/proto/rpki/ssh_transport.c
+++ b/proto/rpki/ssh_transport.c
@@ -15,6 +15,8 @@
 #include 
 #include 
 
+#if HAVE_LIBSSH
+
 #include "rpki.h"
 
 static int
@@ -71,3 +73,5 @@ rpki_tr_ssh_init(struct rpki_tr_sock *tr)
   tr->open_fp = &rpki_tr_ssh_open;
   tr->ident_fp = &rpki_tr_ssh_ident;
 }
+
+#endif
diff --git a/proto/rpki/transport.h b/proto/rpki/transport.h
index f90b7e42..bb8d41eb 100644
--- a/proto/rpki/transport.h
+++ b/proto/rpki/transport.h
@

Re: RPKI support without SSH transport

[Ondrej Zajicek]

On Thu, Jan 09, 2020 at 03:07:15PM +0100, Clemens Schrimpe wrote:
> Ahoj BIRD Parents -
> 
> I was wondering if there is a reason, why BIRD 2.0.x can't be built for
> RPKI support without libssh, although RPKI-RTR would also work on an
> unencrypted transport (as documented in the BIRD user documentation).

Mainly that protocol-based compile-time variability was already there.
But i agree that it would make sense to have support for RPKI without SSH
transport / libssh dependency, and i already got some requests for that.
So perhaps we will update that.


> I am asking, because I am building BIRD for a hardware router platform 
> (Ubiquiti's EdgeRouters) and including libssh is, although doable, a real 
> pain-in-the-rear, depending on the OS version and hardware architecture (4 
> variants in the EdgeOS world at the moment).

Isn't EdgeOS based on Debian? So i suppose there should not be problem
with libssh / libgcrypt there.

But last time i played with EdgeRouter i just dropped whole EdgeOS and
used vanilla Debian with Ubiquiti EdgeRouter Linux kernel.

-- 
Elen sila lumenn' omentielvo

Ondrej 'Santiago' Zajicek (email: santi...@crfreenet.org)
OpenPGP encrypted e-mails preferred (KeyID 0x11DEADC3, wwwkeys.pgp.net)
"To err is human -- to blame it on a computer is even more so."

RPKI support without SSH transport

[Clemens Schrimpe]

Ahoj BIRD Parents -

I was wondering if there is a reason, why BIRD 2.0.x can't be built for RPKI 
support without libssh, although RPKI-RTR would also work on an unencrypted 
transport (as documented in the BIRD user documentation).

I am asking, because I am building BIRD for a hardware router platform 
(Ubiquiti's EdgeRouters) and including libssh is, although doable, a real 
pain-in-the-rear, depending on the OS version and hardware architecture (4 
variants in the EdgeOS world at the moment).

Without libssh, which drags a whole slew of other library-crap behind it 🙄, 
BIRD is pretty lightweight and very easy to deploy.

Just curious ...

Thanks a lot (again) for this great piece of software!

Clemens