Merge pull request #86 from painless-security/jennifer/aaa_server_port

Allow configurable TID and TRP ports

diff --combined mon/mons.c
index 3733357,c2f6ca0..72070cf
--- 1/mon/mons.c
--- 2/mon/mons.c
+++ b/mon/mons.c
@@@ -73,7 -73,7 +73,7 @@@ MONS_INSTANCE *mons_new(TALLOC_CTX *mem
  
    if (mons) {
      mons->hostname = NULL;
-     mons->port = 0;
+     mons->mon_port = 0;
      mons->tids = NULL;
      mons->trps = NULL;
      mons->req_handler = NULL;
@@@ -175,16 -175,22 +175,22 @@@ cleanup
   * @param max_fd
   * @return
   */
- int mons_get_listener(MONS_INSTANCE *mons, MONS_REQ_FUNC *req_handler, MONS_AUTH_FUNC *auth_handler, const char *hostname,
-                       unsigned int port, void *cookie, int *fd_out, size_t max_fd)
+ int mons_get_listener(MONS_INSTANCE *mons,
+                       MONS_REQ_FUNC *req_handler,
+                       MONS_AUTH_FUNC *auth_handler,
+                       const char *hostname,
+                       int port,
+                       void *cookie,
+                       int *fd_out,
+                       size_t max_fd)
  {
    size_t n_fd=0;
    size_t ii=0;
  
-   mons->port = port;
+   mons->mon_port = port;
    n_fd = tr_sock_listen_all(port, fd_out, max_fd);
    if (n_fd<=0)
 -    tr_err("mons_get_listener: Error opening port %d");
 +    tr_err("mons_get_listener: Error opening port %d", port);
    else {
      /* opening port succeeded */
      tr_info("mons_get_listener: Opened port %d.", port);

diff --combined tid/tids.c
index ddd91b0,7b486d4..f600d66
--- 1/tid/tids.c
--- 2/tid/tids.c
+++ b/tid/tids.c
@@@ -356,7 -356,7 +356,7 @@@ nfds_t tids_get_listener(TIDS_INSTANCE 
                           TIDS_REQ_FUNC *req_handler,
                           tids_auth_func *auth_handler,
                           const char *hostname,
-                          unsigned int port,
+                          int port,
                           void *cookie,
                           int *fd_out,
                           size_t max_fd)
@@@ -368,7 -368,7 +368,7 @@@
    n_fd = tr_sock_listen_all(port, fd_out, max_fd);
  
    if (n_fd == 0)
 -    tr_err("tids_get_listener: Error opening port %d");
 +    tr_err("tids_get_listener: Error opening port %d", port);
    else {
      /* opening port succeeded */
      tr_info("tids_get_listener: Opened port %d.", port);
@@@ -574,12 -574,12 +574,12 @@@ void tids_sweep_procs(TIDS_INSTANCE *ti
  }
  
  /* Process tids requests forever. Should not return except on error. */
- int tids_start (TIDS_INSTANCE *tids,
-                 TIDS_REQ_FUNC *req_handler,
-                 tids_auth_func *auth_handler,
-                 const char *hostname,
-                 unsigned int port,
-                 void *cookie)
+ int tids_start(TIDS_INSTANCE *tids,
+                TIDS_REQ_FUNC *req_handler,
+                tids_auth_func *auth_handler,
+                const char *hostname,
+                int port,
+                void *cookie)
  {
    int fd[TR_MAX_SOCKETS]={0};
    nfds_t n_fd=0;

diff --combined trp/trps.c
index f663232,64dade4..a489133
--- 1/trp/trps.c
--- 2/trp/trps.c
+++ b/trp/trps.c
@@@ -69,7 -69,7 +69,7 @@@ TRPS_INSTANCE *trps_new (TALLOC_CTX *me
    TRPS_INSTANCE *trps=talloc(mem_ctx, TRPS_INSTANCE);
    if (trps!=NULL)  {
      trps->hostname=NULL;
-     trps->port=0;
+     trps->trps_port=0;
      trps->cookie=NULL;
      trps->conn=NULL;
      trps->trpc=NULL;
@@@ -196,7 -196,7 +196,7 @@@ TR_NAME *trps_dup_label(TRPS_INSTANCE *
  {
    TALLOC_CTX *tmp_ctx=talloc_new(NULL);
    TR_NAME *label=NULL;
-   char *s=talloc_asprintf(tmp_ctx, "%s:%u", trps->hostname, trps->port);
+   char *s=talloc_asprintf(tmp_ctx, "%s:%u", trps->hostname, trps->trps_port);
    if (s==NULL)
      goto cleanup;
    label=tr_new_name(s);
@@@ -362,7 -362,6 +362,6 @@@ static TRP_RC trps_read_message(TRPS_IN
    switch (tr_msg_get_msg_type(*msg)) {
    case TRP_UPDATE:
      trp_upd_set_peer(tr_msg_get_trp_upd(*msg), tr_dup_name(conn_peer));
-     trp_upd_set_next_hop(tr_msg_get_trp_upd(*msg), trp_peer_get_server(peer), 0); /* TODO: 0 should be the configured TID port */
      /* update provenance if necessary */
      trp_upd_add_to_provenance(tr_msg_get_trp_upd(*msg), trp_peer_get_label(peer));
      break;
@@@ -385,7 -384,7 +384,7 @@@ int trps_get_listener(TRPS_INSTANCE *tr
                        TRPS_MSG_FUNC msg_handler,
                        TRP_AUTH_FUNC auth_handler,
                        const char *hostname,
-                       unsigned int port,
+                       int port,
                        void *cookie,
                        int *fd_out,
                        size_t max_fd)
@@@ -396,7 -395,7 +395,7 @@@
    n_fd = tr_sock_listen_all(port, fd_out, max_fd);
  
    if (n_fd == 0)
 -    tr_err("trps_get_listener: Error opening port %d.");
 +    tr_err("trps_get_listener: Error opening port %d.", port);
    else {
      /* opening port succeeded */
      tr_info("trps_get_listener: Opened port %d.", port);
@@@ -420,7 -419,7 +419,7 @@@
      trps->msg_handler = msg_handler;
      trps->auth_handler = auth_handler;
      trps->hostname = talloc_strdup(trps, hostname);
-     trps->port = port;
+     trps->trps_port = port;
      trps->cookie = cookie;
    }
  
@@@ -502,12 -501,27 +501,27 @@@ static TRP_RC trps_validate_inforec(TRP
    switch(trp_inforec_get_type(rec)) {
    case TRP_INFOREC_TYPE_ROUTE:
      if ((trp_inforec_get_trust_router(rec)==NULL)
-        || (trp_inforec_get_next_hop(rec)==NULL)) {
+         || (trp_inforec_get_next_hop(rec)==NULL)) {
        tr_debug("trps_validate_inforec: missing record info.");
        return TRP_ERROR;
      }
  
-     /* check for valid metric */
+     /* check for valid ports */
+     if ((trp_inforec_get_trust_router_port(rec) <= 0)
+         || (trp_inforec_get_trust_router_port(rec) > 65535)) {
+       tr_debug("trps_validate_inforec: invalid trust router port (%d)",
+                trp_inforec_get_trust_router_port(rec));
+       return TRP_ERROR;
+     }
+ 
+       if ((trp_inforec_get_next_hop_port(rec) <= 0)
+           || (trp_inforec_get_next_hop_port(rec) > 65535)) {
+         tr_debug("trps_validate_inforec: invalid next hop port (%d)",
+                  trp_inforec_get_next_hop_port(rec));
+         return TRP_ERROR;
+       }
+ 
+       /* check for valid metric */
      if (trp_metric_is_invalid(trp_inforec_get_metric(rec))) {
        tr_debug("trps_validate_inforec: invalid metric (%u).", trp_inforec_get_metric(rec));
        return TRP_ERROR;
@@@ -593,6 -607,17 +607,17 @@@ static struct timespec *trps_compute_ex
    return ts;
  }
  
+ 
+ /* compare hostname/port of the trust router, return 0 if they match */
+ static int trust_router_changed(TRP_ROUTE *route, TRP_INFOREC *rec)
+ {
+   if (trp_route_get_trust_router_port(route) != trp_inforec_get_trust_router_port(rec))
+     return 1;
+ 
+   return tr_name_cmp(trp_route_get_trust_router(route),
+                      trp_inforec_get_trust_router(rec));
+ }
+ 
  static TRP_RC trps_accept_update(TRPS_INSTANCE *trps, TRP_UPD *upd, TRP_INFOREC *rec)
  {
    TRP_ROUTE *entry=NULL;
@@@ -612,8 -637,9 +637,9 @@@
      trp_route_set_realm(entry, trp_upd_dup_realm(upd));
      trp_route_set_peer(entry, trp_upd_dup_peer(upd));
      trp_route_set_trust_router(entry, trp_inforec_dup_trust_router(rec));
+     trp_route_set_trust_router_port(entry, trp_inforec_get_trust_router_port(rec));
      trp_route_set_next_hop(entry, trp_inforec_dup_next_hop(rec));
-     /* TODO: pass next hop port (now defaults to TID_PORT) --jlr */
+     trp_route_set_next_hop_port(entry, trp_inforec_get_next_hop_port(rec));
      if ((trp_route_get_comm(entry)==NULL)
         ||(trp_route_get_realm(entry)==NULL)
         ||(trp_route_get_peer(entry)==NULL)
@@@ -635,13 -661,13 +661,13 @@@
    trp_route_set_metric(entry, trp_inforec_get_metric(rec));
    trp_route_set_interval(entry, trp_inforec_get_interval(rec));
  
-   /* check whether the trust router has changed */
-   if (0!=tr_name_cmp(trp_route_get_trust_router(entry),
-                      trp_inforec_get_trust_router(rec))) {
+   /* check whether the trust router has changed (either name or port) */
+   if (trust_router_changed(entry, rec)) {
      /* The name changed. Set this route as triggered. */
      tr_debug("trps_accept_update: trust router for route changed.");
      trp_route_set_triggered(entry, 1);
      trp_route_set_trust_router(entry, trp_inforec_dup_trust_router(rec)); /* frees old name */
+     trp_route_set_trust_router_port(entry, trp_inforec_get_trust_router_port(rec));
    }
    if (!trps_route_retracted(trps, entry)) {
      tr_debug("trps_accept_update: route not retracted, setting expiry timer.");
@@@ -689,8 -715,7 +715,7 @@@ static TRP_RC trps_handle_inforec_route
          trps_accept_update(trps, upd, rec);
        } else {
          /* Update is infeasible. Ignore it unless the trust router has changed. */
-         if (0!=tr_name_cmp(trp_route_get_trust_router(route),
-                            trp_inforec_get_trust_router(rec))) {
+         if (trust_router_changed(route, rec)) {
            /* the trust router associated with the route has changed, treat update as a retraction */
            trps_retract_route(trps, route);
          }
@@@ -1349,13 -1374,23 +1374,23 @@@ static TRP_INFOREC *trps_route_to_infor
                                                                trp_route_get_peer(route)));
      }
  
-     /* Note that we leave the next hop empty since the recipient fills that in.
-      * This is where we add the link cost (currently always 1) to the next peer. */
-     if ((trp_inforec_set_trust_router(rec, trp_route_dup_trust_router(route)) != TRP_SUCCESS)
-        ||(trp_inforec_set_metric(rec,
-                                  trps_metric_add(trp_route_get_metric(route),
-                                                  linkcost)) != TRP_SUCCESS)
-        ||(trp_inforec_set_interval(rec, trps_get_update_interval(trps)) != TRP_SUCCESS)) {
+     /*
+      * This is where we add the link cost (currently always 1) to the next peer.
+      *
+      * Here, set next_hop to our TID address/port rather than passing along our own
+      * next_hop. That is the one *we* use to forward requests. We are advertising
+      * ourselves as a hop for our peers.
+      */
+     if ((TRP_SUCCESS != trp_inforec_set_trust_router(rec,
+                                                      trp_route_dup_trust_router(route),
+                                                      trp_route_get_trust_router_port(route)))
+         ||(TRP_SUCCESS != trp_inforec_set_next_hop(rec,
+                                                    tr_new_name(trps->hostname),
+                                                    trps->tids_port))
+         ||(TRP_SUCCESS != trp_inforec_set_metric(rec,
+                                                  trps_metric_add(trp_route_get_metric(route),
+                                                                  linkcost)))
+         ||(TRP_SUCCESS != trp_inforec_set_interval(rec, trps_get_update_interval(trps)))) {
        tr_err("trps_route_to_inforec: error creating route update.");
        talloc_free(rec);
        rec=NULL;