Merge lp:~diego-biurrun/hipl/unused_code into lp:hipl

[Diego Biurrun]

This is a quick respin of an old branch I had lying around which eliminates some dead code. I would assume that further inspection could reveal even more dead code, but this branch drops 800 lines, which is a considerable amount already.

[Miika Komu (miika-iki)]

You're killing userspace IPsec and certificate code?

review: Needs Information

[Diego Biurrun (diego-biurrun)]

On Tue, Oct 18, 2011 at 08:44:25AM +0000, Miika Komu wrote:
> Review: Needs Information
>
> You're killing userspace IPsec and certificate code?

I kill unused code without second thoughts towards its (theoretical) use ;)

Diego

[René Hummen (rene-hummen)]

I don't have the time right now to check this merge proposal, but it proposes to remove some esp token and userspace ipsec code. So, I have to disapprove the proposal until I had a closer look at it.

review: Disapprove

[Diego Biurrun (diego-biurrun)]

On Tue, Oct 25, 2011 at 12:32:33PM +0000, René Hummen wrote:
> Review: Disapprove
>
> I don't have the time right now to check this merge proposal, but it
> proposes to remove some esp token and userspace ipsec code. So, I have
> to disapprove the proposal until I had a closer look at it.

Could you have another look and/or be more specific which code must
stay and which can go?

Diego

[Henrik Ziegeldorf (henrik-ziegeldorf)]

> You're killing userspace IPsec and certificate code?

Some of the certificate code (the X509 stuff) is used and significantly modified in my PISA branch.
I don't use the SPKI stuff, though. However, I think there's more to remove there than proposed in this merge.

I'd propose the following:
1) You prepare another merge-proposal without the certificate stuff.
2) I'll merge the PISA stuff (after it has been approved)
3) You do a second branch for removing unused certificate functionality (SPKI-related stuff), if nobody has compelling reasons to keep that stuff.

[Miika Komu (miika-iki)]

I think the removal of userspace IPsec stuff should be separated as well.

[Diego Biurrun (diego-biurrun)]

On Wed, Dec 21, 2011 at 09:32:23AM +0000, Henrik Ziegeldorf wrote:
> > You're killing userspace IPsec and certificate code?
>
> Some of the certificate code (the X509 stuff) is used and significantly modified in my PISA branch.
> I don't use the SPKI stuff, though. However, I think there's more to remove there than proposed in this merge.
>
> I'd propose the following:
> 1) You prepare another merge-proposal without the certificate stuff.
> 2) I'll merge the PISA stuff (after it has been approved)
> 3) You do a second branch for removing unused certificate functionality (SPKI-related stuff), if nobody has compelling reasons to keep that stuff.

I will but it would be simpler if you guys could just approve or disapprove
certain parts directly. I have committed it in several small parts, just
go and look at the Launchpad web frontend for merge request handling.

Updated request coming up in a moment.

Diego

Unmerged revisions

5855. By Diego Biurrun on 2011-10-17

Merge current HEAD.

5854. By Diego Biurrun on 2011-10-17

Merge current HEAD.

5853. By Diego Biurrun on 2011-04-14

Merge current HEAD.

5852. By Diego Biurrun on 2011-04-14

Restore no longer unused modularization functions.

5851. By Diego Biurrun on 2011-04-14

Merge current HEAD.

5850. By Diego Biurrun on 2011-04-14

Merge current HEAD.

5849. By Diego Biurrun on 2011-04-05

Remove unused function hip_cert_spki_send_to_verification().

5848. By Diego Biurrun on 2011-04-05

Remove unused (outside of test programs) x509 code.

5847. By Diego Biurrun on 2011-04-05

Remove unused function esp_prot_sa_add().

5846. By Diego Biurrun on 2011-04-04

Remove unused function hip_del_pending_request().

=== modified file 'Makefile.am'
--- Makefile.am	2011-10-17 18:14:10 +0000
+++ Makefile.am	2011-10-17 18:32:42 +0000
@@ -121,7 +121,6 @@
                     hipd/registration.c          \
                     hipd/user.c                  \
                     hipd/user_ipsec_hipd_msg.c   \
-                    hipd/user_ipsec_sadb_api.c   \
                     modules/heartbeat/hipd/heartbeat.c          \
                     modules/heartbeat_update/hipd/hb_update.c   \
                     modules/midauth/lib/midauth_builder.c       \
 
=== modified file 'hipd/esp_prot_hipd_msg.c'
--- hipd/esp_prot_hipd_msg.c	2011-10-17 15:22:35 +0000
+++ hipd/esp_prot_hipd_msg.c	2011-10-17 18:32:42 +0000
@@ -459,87 +459,6 @@
     return err;
 }
 
-/** sets the ESP protection extension transform and anchor in user-messages
- * sent to the firewall in order to add a new SA
- *
- * @param entry         the host association entry for this connection
- * @param msg           the user-message sent by the firewall
- * @param direction     direction of the entry to be created
- * @param update        this was triggered by an update
- * @return              0 if ok, != 0 else
- */
-int esp_prot_sa_add(struct hip_hadb_state *entry, struct hip_common *msg,
-                    const int direction, const int update)
-{
-    unsigned char (*hchain_anchors)[MAX_HASH_LENGTH] = NULL;
-    int      hash_length      = 0;
-    uint32_t hash_item_length = 0;
-    int      err              = 0, i;
-
-    HIP_DEBUG("direction: %i\n", direction);
-
-    // we always tell the negotiated transform to the firewall
-    HIP_DEBUG("esp protection transform is %u \n", entry->esp_prot_transform);
-    HIP_IFEL(hip_build_param_contents(msg, &entry->esp_prot_transform,
-                                      HIP_PARAM_ESP_PROT_TFM, sizeof(uint8_t)), -1,
-             "build param contents failed\n");
-
-    // but we only transmit the anchor to the firewall, if the esp extension is used
-    if (entry->esp_prot_transform > ESP_PROT_TFM_UNUSED) {
-        hash_length = anchor_db_get_anchor_length(entry->esp_prot_transform);
-
-        // choose the anchor depending on the direction and update or add
-        if (update) {
-            if (direction == HIP_SPI_DIRECTION_OUT) {
-                HIP_IFEL(!(hchain_anchors = entry->esp_local_update_anchors), -1,
-                         "hchain anchor expected, but not present\n");
-
-                hash_item_length = entry->esp_local_update_length;
-            } else {
-                HIP_IFEL(!(hchain_anchors = entry->esp_peer_update_anchors), -1,
-                         "hchain anchor expected, but not present\n");
-
-                hash_item_length = entry->esp_peer_update_length;
-            }
-        } else {
-            if (direction == HIP_SPI_DIRECTION_OUT) {
-                HIP_IFEL(!(hchain_anchors = entry->esp_local_anchors), -1,
-                         "hchain anchor expected, but not present\n");
-
-                hash_item_length = entry->esp_local_active_length;
-            } else {
-                HIP_IFEL(!(hchain_anchors = entry->esp_peer_anchors), -1,
-                         "hchain anchor expected, but not present\n");
-
-                hash_item_length = entry->esp_peer_active_length;
-            }
-        }
-
-        // add parameters to hipfw message
-        HIP_IFEL(hip_build_param_contents(msg, &hash_item_length,
-                                          HIP_PARAM_ITEM_LENGTH, sizeof(uint32_t)), -1,
-                 "build param contents failed\n");
-
-        // add parameters to hipfw message
-        HIP_IFEL(hip_build_param_contents(msg, &esp_prot_num_parallel_hchains,
-                                          HIP_PARAM_UINT, sizeof(uint16_t)), -1,
-                 "build param contents failed\n");
-
-        for (i = 0; i < esp_prot_num_parallel_hchains; i++) {
-            HIP_HEXDUMP("esp protection anchor is ", &hchain_anchors[i][0], hash_length);
-
-            HIP_IFEL(hip_build_param_contents(msg, &hchain_anchors[i][0],
-                                              HIP_PARAM_HCHAIN_ANCHOR, hash_length), -1,
-                     "build param contents failed\n");
-        }
-    } else {
-        HIP_DEBUG("no anchor added, transform UNUSED\n");
-    }
-
-out_err:
-    return err;
-}
-
 /********************* BEX parameters *********************/
 
 /**
 
=== modified file 'hipd/esp_prot_hipd_msg.h'
--- hipd/esp_prot_hipd_msg.h	2011-10-17 15:22:35 +0000
+++ hipd/esp_prot_hipd_msg.h	2011-10-17 18:32:42 +0000
@@ -47,8 +47,6 @@
 int esp_prot_set_preferred_transforms(const struct hip_common *msg);
 int esp_prot_handle_trigger_update_msg(const struct hip_common *msg);
 int esp_prot_handle_anchor_change_msg(const struct hip_common *msg);
-int esp_prot_sa_add(struct hip_hadb_state *entry, struct hip_common *msg,
-                    const int direction, const int update);
 int esp_prot_r1_add_transforms(struct hip_common *msg);
 int esp_prot_r1_handle_transforms(UNUSED const uint8_t packet_type,
                                   UNUSED const enum hip_state ha_state,
 
=== modified file 'hipd/pkt_handling.c'
--- hipd/pkt_handling.c	2011-10-17 15:22:35 +0000
+++ hipd/pkt_handling.c	2011-10-17 18:32:42 +0000
@@ -101,26 +101,6 @@
 }
 
 /**
- * Remove a handle function from the list.
- *
- * @param packet_type The packet type of the control message (RFC 5201, 5.3.)
- * @param ha_state The host association state (RFC 5201, 4.4.1.)
- * @param handle_function Pointer to the function which should be unregistered.
- *
- * @return Success =  0
- *         Error   = -1
- */
-int hip_unregister_handle_function(const uint8_t packet_type,
-                                   const enum hip_state ha_state,
-                                   int (*handle_function)(const uint8_t packet_type,
-                                                          const enum hip_state ha_state,
-                                                          struct hip_packet_context *ctx))
-{
-    return lmod_unregister_function(hip_handle_functions[packet_type][ha_state],
-                                    handle_function);
-}
-
-/**
  * Run all handle functions for specified combination from packet type and host
  * association state.
  *
 
=== modified file 'hipd/pkt_handling.h'
--- hipd/pkt_handling.h	2011-10-17 15:22:35 +0000
+++ hipd/pkt_handling.h	2011-10-17 18:32:42 +0000
@@ -38,12 +38,6 @@
                                                         struct hip_packet_context *ctx),
                                  const uint16_t priority);
 
-int hip_unregister_handle_function(const uint8_t packet_type,
-                                   const enum hip_state ha_state,
-                                   int (*handle_function)(const uint8_t packet_type,
-                                                          const enum hip_state ha_state,
-                                                          struct hip_packet_context *ctx));
-
 int hip_run_handle_functions(const uint8_t packet_type,
                              const enum hip_state ha_state,
                              struct hip_packet_context *ctx);
 
=== modified file 'hipd/registration.c'
--- hipd/registration.c	2011-08-15 14:11:56 +0000
+++ hipd/registration.c	2011-10-17 18:32:42 +0000
@@ -112,7 +112,6 @@
     const struct hip_ll_node   *iter    = NULL;
     struct hip_pending_request *request = NULL;
 
-    /* See hip_del_pending_request() for a comment. */
     while ((iter = hip_ll_iterate(&pending_requests, iter)) != NULL) {
         request = iter->ptr;
         if (now - request->created > HIP_PENDING_REQUEST_LIFETIME) {
@@ -233,37 +232,6 @@
 }
 
 /**
- * Deletes a pending request. Deletes a pending request identified by the host
- * association @c entry from the linked list @c pending_requests.
- *
- * @param  entry a pointer to the host association to which the pending request
- *               to be deleted is bound.
- * @return       zero if the pending request was succesfully deleted, -1
- *               otherwise.
- */
-int hip_del_pending_request(struct hip_hadb_state *entry)
-{
-    int                       idx  = 0;
-    const struct hip_ll_node *iter = NULL;
-
-    /* Iterate through the linked list. The iterator itself can't be used
-     * for deleting nodes from the list. Therefore, we just get the index of
-     * the element to be deleted using the iterator and then call
-     * hip_ll_del() to do the actual deletion. */
-    while ((iter = hip_ll_iterate(&pending_requests, iter)) != NULL) {
-        if (((struct hip_pending_request *) (iter->ptr))->entry == entry) {
-            HIP_DEBUG("Deleting and freeing a pending request at " \
-                      "index %u.\n", idx);
-            hip_ll_del(&pending_requests, idx, free);
-            return 0;
-        }
-        idx++;
-    }
-
-    return -1;
-}
-
-/**
  * Deletes a pending request of given type. Deletes a pending request identified
  * by the host association @c entry and matching the given type @c reg_type from
  * the linked list @c pending_requests.
@@ -281,7 +249,6 @@
     const struct hip_ll_node   *iter    = NULL;
     struct hip_pending_request *request = NULL;
 
-    /* See hip_del_pending_request() for a comment. */
     while ((iter = hip_ll_iterate(&pending_requests, iter)) != NULL) {
         request = iter->ptr;
         if (request->entry == entry && request->reg_type == reg_type) {
 
=== modified file 'hipd/registration.h'
--- hipd/registration.h	2011-08-15 14:11:56 +0000
+++ hipd/registration.h	2011-10-17 18:32:42 +0000
@@ -64,7 +64,6 @@
 int hip_get_active_services(struct hip_srv *active_services,
                             unsigned int *active_service_count);
 int hip_add_pending_request(struct hip_pending_request *request);
-int hip_del_pending_request(struct hip_hadb_state *entry);
 int hip_replace_pending_requests(struct hip_hadb_state *entry_old,
                                  struct hip_hadb_state *entry_new);
 int hip_handle_param_reg_info(struct hip_hadb_state *entry,
 
=== modified file 'hipd/user_ipsec_hipd_msg.c'
--- hipd/user_ipsec_hipd_msg.c	2011-08-15 14:11:56 +0000
+++ hipd/user_ipsec_hipd_msg.c	2011-10-17 18:32:42 +0000
@@ -43,7 +43,6 @@
 #include "esp_prot_hipd_msg.h"
 #include "hipd.h"
 #include "init.h"
-#include "user_ipsec_sadb_api.h"
 #include "user_ipsec_hipd_msg.h"
 
 
@@ -81,219 +80,3 @@
 
     return err;
 }
-
-/** creates a user-message to add a SA to userspace IPsec
- *
- * @param saddr          outer globally routable source ip address
- * @param daddr          outer globally routable destination ip address
- * @param src_hit    inner source address
- * @param dst_hit    inner destination address
- * @param spi               ipsec spi for demultiplexing
- * @param ealg              crypto transform to be used for the SA
- * @param enckey           raw encryption key
- * @param authkey          raw authentication key
- * @param retransmission    notification if this event is due to retransmission
- * @param direction         represents inbound or outbound direction
- * @param update            notification if this event derives from an update
- * @param entry             host association entry for this connection
- * @return                  the msg, NULL if an error occurred
- */
-struct hip_common *create_add_sa_msg(const struct in6_addr *saddr,
-                                     const struct in6_addr *daddr,
-                                     const struct in6_addr *src_hit,
-                                     const struct in6_addr *dst_hit,
-                                     const uint32_t spi, const int ealg,
-                                     const struct hip_crypto_key *enckey,
-                                     const struct hip_crypto_key *authkey,
-                                     const int retransmission,
-                                     const int direction, const int update,
-                                     struct hip_hadb_state *entry)
-{
-    struct hip_common *msg = NULL;
-    int                err = 0;
-
-    HIP_IFEL(!(msg = malloc(HIP_MAX_PACKET)), -1,
-             "alloc memory for adding sa entry\n");
-
-    hip_msg_init(msg);
-
-    HIP_IFEL(hip_build_user_hdr(msg, HIP_MSG_IPSEC_ADD_SA, 0), -1,
-             "build hdr failed\n");
-
-    HIP_DEBUG_IN6ADDR("Source IP address: ", saddr);
-    HIP_IFEL(hip_build_param_contents(msg, saddr,
-                                      HIP_PARAM_IPV6_ADDR,
-                                      sizeof(struct in6_addr)), -1,
-             "build param contents failed\n");
-
-    HIP_DEBUG_IN6ADDR("Destination IP address : ", daddr);
-    HIP_IFEL(hip_build_param_contents(msg, daddr,
-                                      HIP_PARAM_IPV6_ADDR,
-                                      sizeof(struct in6_addr)), -1,
-             "build param contents failed\n");
-
-    HIP_DEBUG_HIT("Source HIT: ", src_hit);
-    HIP_IFEL(hip_build_param_contents(msg, src_hit, HIP_PARAM_HIT,
-                                      sizeof(struct in6_addr)), -1,
-             "build param contents failed\n");
-
-    HIP_DEBUG_HIT("Destination HIT: ", dst_hit);
-    HIP_IFEL(hip_build_param_contents(msg, dst_hit, HIP_PARAM_HIT,
-                                      sizeof(struct in6_addr)), -1,
-             "build param contents failed\n");
-
-    HIP_DEBUG("the spi value is : %x \n", spi);
-    HIP_IFEL(hip_build_param_contents(msg, &spi, HIP_PARAM_UINT,
-                                      sizeof(uint32_t)), -1,
-             "build param contents failed\n");
-
-    HIP_DEBUG("the nat_mode value is %u \n", entry->nat_mode);
-    HIP_IFEL(hip_build_param_contents(msg, &entry->nat_mode, HIP_PARAM_UINT,
-                                      sizeof(uint8_t)), -1,
-             "build param contents failed\n");
-
-    HIP_DEBUG("the local_port value is %u \n", entry->local_udp_port);
-    HIP_IFEL(hip_build_param_contents(msg, &entry->local_udp_port,
-                                      HIP_PARAM_UINT, sizeof(uint16_t)), -1, "build param contents failed\n");
-
-    HIP_DEBUG("the peer_port value is %u \n", entry->peer_udp_port);
-    HIP_IFEL(hip_build_param_contents(msg, &entry->peer_udp_port,
-                                      HIP_PARAM_UINT, sizeof(uint16_t)), -1, "build param contents failed\n");
-
-    // params needed by the esp protection extension
-    HIP_IFEL(esp_prot_sa_add(entry, msg, direction, update), -1,
-             "failed to add esp prot params\n");
-
-    HIP_HEXDUMP("crypto key :", enckey, sizeof(struct hip_crypto_key));
-    HIP_IFEL(hip_build_param_contents(msg,
-                                      enckey,
-                                      HIP_PARAM_KEYS,
-                                      sizeof(struct hip_crypto_key)), -1,
-             "build param contents failed\n");
-
-    HIP_HEXDUMP("authen key :", authkey, sizeof(struct hip_crypto_key));
-    HIP_IFEL(hip_build_param_contents(msg,
-                                      authkey,
-                                      HIP_PARAM_KEYS,
-                                      sizeof(struct hip_crypto_key)), -1,
-             "build param contents failed\n");
-
-    HIP_DEBUG("ealg value is %d \n", ealg);
-    HIP_IFEL(hip_build_param_contents(msg, &ealg, HIP_PARAM_INT,
-                                      sizeof(int)), -1,
-             "build param contents failed\n");
-
-    HIP_DEBUG("retransmission value is %d \n", retransmission);
-    HIP_IFEL(hip_build_param_contents(msg, &retransmission,
-                                      HIP_PARAM_INT, sizeof(int)), -1,
-             "build param contents failed\n");
-
-    HIP_DEBUG("the direction value is %d \n", direction);
-    HIP_IFEL(hip_build_param_contents(msg, &direction,
-                                      HIP_PARAM_INT,
-                                      sizeof(int)), -1,
-             "build param contents failed\n");
-
-    HIP_DEBUG("the update value is %d \n", update);
-    HIP_IFEL(hip_build_param_contents(msg, &update, HIP_PARAM_INT,
-                                      sizeof(int)), -1,
-             "build param contents failed\n");
-
-out_err:
-    if (err) {
-        free(msg);
-        msg = NULL;
-    }
-
-    return msg;
-}
-
-/** creates a user-message to delete a SA from userspace IPsec
- *
- * @param spi       ipsec spi for demultiplexing
- * @param peer_addr  outer globally routable source ip address
- * @param dst_addr  outer globally routable destination ip address
- * @param family    protocol family of above addresses
- * @param src_port  local port for this host association
- * @param dst_port  peer port for this host association
- * @return          the msg, NULL if an error occured
- */
-struct hip_common *create_delete_sa_msg(const uint32_t spi,
-                                        const struct in6_addr *peer_addr,
-                                        const struct in6_addr *dst_addr,
-                                        const int family,
-                                        const int src_port,
-                                        const int dst_port)
-{
-    struct hip_common *msg = NULL;
-    int                err = 0;
-
-    HIP_IFEL(!(msg = malloc(HIP_MAX_PACKET)), -1,
-             "alloc memory for adding sa entry\n");
-
-    hip_msg_init(msg);
-
-    HIP_IFEL(hip_build_user_hdr(msg, HIP_MSG_IPSEC_DELETE_SA, 0), -1,
-             "build hdr failed\n");
-
-    HIP_DEBUG("spi value: %u\n", spi);
-    HIP_IFEL(hip_build_param_contents(msg, &spi, HIP_PARAM_UINT,
-                                      sizeof(uint32_t)), -1, "build param contents failed\n");
-
-    HIP_DEBUG_IN6ADDR("peer address: ", peer_addr);
-    HIP_IFEL(hip_build_param_contents(msg, peer_addr, HIP_PARAM_IPV6_ADDR,
-                                      sizeof(struct in6_addr)), -1, "build param contents failed\n");
-
-    HIP_DEBUG_IN6ADDR("destination address: ", dst_addr);
-    HIP_IFEL(hip_build_param_contents(msg, dst_addr, HIP_PARAM_IPV6_ADDR,
-                                      sizeof(struct in6_addr)), -1, "build param contents failed\n");
-
-    HIP_DEBUG("family: %i\n", family);
-    HIP_IFEL(hip_build_param_contents(msg, &family, HIP_PARAM_INT,
-                                      sizeof(int)), -1, "build param contents failed\n");
-
-    HIP_DEBUG("src_port: %i\n", src_port);
-    HIP_IFEL(hip_build_param_contents(msg, &src_port, HIP_PARAM_INT,
-                                      sizeof(int)), -1, "build param contents failed\n");
-
-    HIP_DEBUG("src_port: %i\n", dst_port);
-    HIP_IFEL(hip_build_param_contents(msg, &dst_port, HIP_PARAM_INT,
-                                      sizeof(int)), -1, "build param contents failed\n");
-
-out_err:
-    if (err) {
-        free(msg);
-        msg = NULL;
-    }
-
-    return msg;
-}
-
-/**
- * create a user-message to flush all SAs from userspace IPsec
- *
- * @return      the msg, NULL if an error occured
- */
-struct hip_common *create_flush_all_sa_msg(void)
-{
-    struct hip_common *msg = NULL;
-    int                err = 0;
-
-    HIP_IFEL(!(msg = malloc(HIP_MAX_PACKET)), -1,
-             "alloc memory for adding sa entry\n");
-
-    hip_msg_init(msg);
-
-    HIP_IFEL(hip_build_user_hdr(msg, HIP_MSG_IPSEC_FLUSH_ALL_SA, 0), -1,
-             "build hdr failed\n");
-
-    // this triggers the flushing without specifying any parameters
-
-out_err:
-    if (err) {
-        free(msg);
-        msg = NULL;
-    }
-
-    return msg;
-}
 
=== modified file 'hipd/user_ipsec_hipd_msg.h'
--- hipd/user_ipsec_hipd_msg.h	2011-08-15 14:11:56 +0000
+++ hipd/user_ipsec_hipd_msg.h	2011-10-17 18:32:42 +0000
@@ -39,22 +39,5 @@
 #include "lib/core/protodefs.h"
 
 int hip_userspace_ipsec_activate(const struct hip_common *msg);
-struct hip_common *create_add_sa_msg(const struct in6_addr *saddr,
-                                     const struct in6_addr *daddr,
-                                     const struct in6_addr *src_hit,
-                                     const struct in6_addr *dst_hit,
-                                     const uint32_t spi, const int ealg,
-                                     const struct hip_crypto_key *enckey,
-                                     const struct hip_crypto_key *authkey,
-                                     const int retransmission,
-                                     const int direction, const int update,
-                                     struct hip_hadb_state *entry);
-struct hip_common *create_delete_sa_msg(const uint32_t spi,
-                                        const struct in6_addr *peer_addr,
-                                        const struct in6_addr *dst_addr,
-                                        const int family,
-                                        const int src_port,
-                                        const int dst_port);
-struct hip_common *create_flush_all_sa_msg(void);
 
 #endif /* HIP_HIPD_USER_IPSEC_HIPD_MSG_H */
 
=== removed file 'hipd/user_ipsec_sadb_api.c'
--- hipd/user_ipsec_sadb_api.c	2011-08-15 14:11:56 +0000
+++ hipd/user_ipsec_sadb_api.c	1970-01-01 00:00:00 +0000
@@ -1,133 +0,0 @@
-/*
- * Copyright (c) 2010 Aalto University and RWTH Aachen University.
- *
- * Permission is hereby granted, free of charge, to any person
- * obtaining a copy of this software and associated documentation
- * files (the "Software"), to deal in the Software without
- * restriction, including without limitation the rights to use,
- * copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the
- * Software is furnished to do so, subject to the following
- * conditions:
- *
- * The above copyright notice and this permission notice shall be
- * included in all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
- * OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
- * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
- * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
- * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
- * OTHER DEALINGS IN THE SOFTWARE.
- */
-
-/**
- * @file
- * Provides the API used by the hipd to set up and maintain the
- * userspace IPsec state in the hipfw.
- *
- * @brief API used by the hipd to set up and maintain userspace IPsec state
- */
-
-#include <stdint.h>
-#include <arpa/inet.h>
-#include <netinet/in.h>
-
-#include "lib/core/debug.h"
-#include "lib/core/icomm.h"
-#include "lib/core/ife.h"
-#include "lib/core/prefix.h"
-#include "lib/core/protodefs.h"
-#include "lib/core/state.h"
-#include "user.h"
-#include "user_ipsec_hipd_msg.h"
-#include "user_ipsec_sadb_api.h"
-
-
-/** generic send function used to send the below created messages
- *
- * @param msg   the message to be sent
- * @return      0, if correct, else != 0
- */
-static int hip_userspace_ipsec_send_to_fw(const struct hip_common *msg)
-{
-    struct sockaddr_in6 hip_fw_addr;
-    struct in6_addr     loopback = in6addr_loopback;
-    int                 err      = 0;
-
-    HIP_ASSERT(msg != NULL);
-
-    // destination is firewall
-    hip_fw_addr.sin6_family = AF_INET6;
-    hip_fw_addr.sin6_port   = htons(HIP_FIREWALL_PORT);
-    ipv6_addr_copy(&hip_fw_addr.sin6_addr, &loopback);
-
-    err = hip_sendto_user(msg, (struct sockaddr *) &hip_fw_addr);
-    if (err < 0) {
-        HIP_ERROR("sending of message to firewall failed\n");
-
-        err = -1;
-        goto out_err;
-    } else {
-        HIP_DEBUG("sending of message to firewall successful\n");
-
-        // this is needed if we want to use HIP_IFEL
-        err = 0;
-    }
-
-out_err:
-    return err;
-}
-
-/** adds a new SA entry for the specified direction to the sadb in userspace ipsec
- * @note  If you make changes to this function, please change also hip_add_sa()
- *
- * @param saddr          outer globally routable source ip address
- * @param daddr          outer globally routable destination ip address
- * @param src_hit    inner source address
- * @param dst_hit    inner destination address
- * @param spi               ipsec spi for demultiplexing
- * @param ealg              crypto transform to be used for the SA
- * @param enckey           raw encryption key
- * @param authkey          raw authentication key
- * @param retransmission    notification if this event is due to retransmission
- * @param direction         represents inbound or outbound direction
- * @param update            notification if this event derives from an update
- * @param entry             host association entry for this connection
- * @return                  0, if correct, otherwise -1
- */
-uint32_t hip_userspace_ipsec_add_sa(const struct in6_addr *saddr,
-                                    const struct in6_addr *daddr,
-                                    const struct in6_addr *src_hit,
-                                    const struct in6_addr *dst_hit,
-                                    const uint32_t spi, const int ealg,
-                                    const struct hip_crypto_key *enckey,
-                                    const struct hip_crypto_key *authkey,
-                                    const int retransmission,
-                                    const int direction, const int update,
-                                    struct hip_hadb_state *entry)
-{
-    struct hip_common *msg = NULL;
-    int                err = 0;
-
-    HIP_ASSERT(spi != 0);
-
-    HIP_IFEL(entry->disable_sas == 1, 0, "SA creation disabled\n");
-
-    if (direction == HIP_SPI_DIRECTION_OUT) {
-        entry->outbound_sa_count++;
-    } else {
-        entry->inbound_sa_count++;
-    }
-
-    HIP_IFEL(!(msg = create_add_sa_msg(saddr, daddr, src_hit, dst_hit, spi, ealg, enckey,
-                                       authkey, retransmission, direction, update, entry)), -1,
-             "failed to create add_sa message\n");
-
-    HIP_IFEL(hip_userspace_ipsec_send_to_fw(msg), -1, "failed to send msg to fw\n");
-
-out_err:
-    return err;
-}
 
=== removed file 'hipd/user_ipsec_sadb_api.h'
--- hipd/user_ipsec_sadb_api.h	2011-08-15 14:11:56 +0000
+++ hipd/user_ipsec_sadb_api.h	1970-01-01 00:00:00 +0000
@@ -1,55 +0,0 @@
-/*
- * Copyright (c) 2010 Aalto University and RWTH Aachen University.
- *
- * Permission is hereby granted, free of charge, to any person
- * obtaining a copy of this software and associated documentation
- * files (the "Software"), to deal in the Software without
- * restriction, including without limitation the rights to use,
- * copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the
- * Software is furnished to do so, subject to the following
- * conditions:
- *
- * The above copyright notice and this permission notice shall be
- * included in all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
- * OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
- * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
- * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
- * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
- * OTHER DEALINGS IN THE SOFTWARE.
- */
-
-/**
- * @file
- * Provides the API used by the hipd to set up and maintain the
- * userspace IPsec state in the hipfw.
- *
- * @brief API used by the hipd to set up and maintain userspace IPsec state
- */
-
-#ifndef HIP_HIPD_USER_IPSEC_SADB_API_H
-#define HIP_HIPD_USER_IPSEC_SADB_API_H
-
-#include <stdint.h>
-#include <netinet/in.h>
-
-#include "lib/core/protodefs.h"
-
-uint32_t hip_userspace_ipsec_add_sa(const struct in6_addr *saddr,
-                                    const struct in6_addr *daddr,
-                                    const struct in6_addr *src_hit,
-                                    const struct in6_addr *dst_hit,
-                                    const uint32_t spi, const int ealg,
-                                    const struct hip_crypto_key *enckey,
-                                    const struct hip_crypto_key *authkey,
-                                    const int retransmission,
-                                    const int direction, const int update,
-                                    struct hip_hadb_state *entry);
-
-int hip_userspace_ipsec_setup_default_sp_prefix_pair(void);
-
-#endif /* HIP_HIPD_USER_IPSEC_SADB_API_H */
 
=== modified file 'lib/core/builder.c'
--- lib/core/builder.c	2011-08-15 14:11:56 +0000
+++ lib/core/builder.c	2011-10-17 18:32:42 +0000
@@ -918,18 +918,6 @@
  * @return pointer to the contents of the tlv_common (just after the
  *          the type and length fields)
  */
-void *hip_get_param_contents_direct_readwrite(void *tlv_common)
-{
-    return ((uint8_t *) tlv_common) + sizeof(struct hip_tlv_common);
-}
-
-/**
- * hip_get_param_contents_direct - get parameter contents direct from TLV
- *
- * @param tlv_common pointer to a parameter
- * @return pointer to the contents of the tlv_common (just after the
- *          the type and length fields)
- */
 const void *hip_get_param_contents_direct(const void *tlv_common)
 {
     return ((const uint8_t *) tlv_common) + sizeof(struct hip_tlv_common);
@@ -3373,56 +3361,6 @@
 }
 
 /**
- * Build and append a X509 certiticate request parameter into a HIP control
- * message (on-the-wire)
- *
- * @param msg a pointer to the message where the parameter will be
- *            appended
- * @param addr the subject for the certificate
- * @return zero on success, or negative on failure
- * @see <a href="http://tools.ietf.org/html/draft-ietf-hip-cert">draft-ietf-hip-cert</a>
- *
- */
-int hip_build_param_cert_x509_req(struct hip_common *msg, struct in6_addr *addr)
-{
-    struct hip_cert_x509_req subj;
-
-    hip_set_param_type((struct hip_tlv_common *) &subj, HIP_PARAM_CERT_X509_REQ);
-    hip_calc_param_len((struct hip_tlv_common *) &subj,
-                       sizeof(struct hip_cert_x509_req)
-                       - sizeof(struct hip_tlv_common));
-    ipv6_addr_copy(&subj.addr, addr);
-
-    return hip_build_param(msg, &subj);
-}
-
-/**
- * build and append a X509 certificate verification parameter into a
- * HIP control message (on-the-wire)
- *
- * @param msg a pointer to the message where the parameter will be
- *            appended
- * @param der der field
- * @param len length of the der field in bytes
- * @return zero on success, or negative on failure
- * @see <a href="http://tools.ietf.org/html/draft-ietf-hip-cert">draft-ietf-hip-cert</a>
- *
- */
-int hip_build_param_cert_x509_ver(struct hip_common *msg, char *der, int len)
-{
-    struct hip_cert_x509_resp subj;
-
-    hip_set_param_type((struct hip_tlv_common *) &subj, HIP_PARAM_CERT_X509_REQ);
-    hip_calc_param_len((struct hip_tlv_common *) &subj,
-                       sizeof(struct hip_cert_x509_resp)
-                       - sizeof(struct hip_tlv_common));
-    memcpy(&subj.der, der, len);
-    subj.der_len = len;
-
-    return hip_build_param(msg, &subj);
-}
-
-/**
  * build and append a X509 certificate response into a HIP control message
  * (on-the-wire)
  *
 
=== modified file 'lib/core/builder.h'
--- lib/core/builder.h	2011-08-15 14:11:56 +0000
+++ lib/core/builder.h	2011-10-17 18:32:42 +0000
@@ -155,9 +155,7 @@
                             const struct in6_addr rvs_addresses[]);
 int hip_build_param_cert_spki_info(struct hip_common *msg,
                                    struct hip_cert_spki_info *cert_info);
-int hip_build_param_cert_x509_req(struct hip_common *, struct in6_addr *);
 int hip_build_param_cert_x509_resp(struct hip_common *, char *, int);
-int hip_build_param_cert_x509_ver(struct hip_common *, char *, int);
 
 int hip_build_param_hit_to_ip_set(struct hip_common *, const char *);
 int hip_build_user_hdr(struct hip_common *, hip_hdr, hip_hdr_err);
@@ -187,7 +185,6 @@
 void       *hip_get_param_readwrite(struct hip_common *, hip_tlv);
 const void *hip_get_param_contents(const struct hip_common *, hip_tlv);
 const void *hip_get_param_contents_direct(const void *);
-void *hip_get_param_contents_direct_readwrite(void *);
 hip_tlv_len hip_get_param_contents_len(const void *);
 int hip_get_param_host_id_di_type_len(const struct hip_host_id *,
                                       const char **, int *);
 
=== modified file 'lib/core/certtools.c'
--- lib/core/certtools.c	2011-08-15 14:11:56 +0000
+++ lib/core/certtools.c	2011-10-17 18:32:42 +0000
@@ -624,139 +624,6 @@
     return err;
 }
 
-/**
- * Function that sends the given hip_cert_spki_info to the daemon to
- * verification
- *
- * @param to_verification is the cert to be verified
- *
- * @return 0 if ok and negative if error or unsuccesfull.
- *
- * @note use hip_cert_spki_char2certinfo to build the hip_cert_spki_info
- */
-int hip_cert_spki_send_to_verification(struct hip_cert_spki_info *to_verification)
-{
-    int                              err = 0;
-    struct hip_common               *msg;
-    const struct hip_cert_spki_info *returned;
-
-    HIP_IFEL(!(msg = malloc(HIP_MAX_PACKET)), -1,
-             "Malloc for msg failed\n");
-    hip_msg_init(msg);
-    /* build the msg to be sent to the daemon */
-    HIP_IFEL(hip_build_user_hdr(msg, HIP_MSG_CERT_SPKI_VERIFY, 0), -1,
-             "Failed to build user header\n");
-    HIP_IFEL(hip_build_param_cert_spki_info(msg, to_verification), -1,
-             "Failed to build cert_info\n");
-
-    /* send and wait */
-    HIP_DEBUG("Sending request to verify SPKI cert to "
-              "daemon and waiting for answer\n");
-    hip_send_recv_daemon_info(msg, 0, 0);
-
-    HIP_IFEL(!(returned = hip_get_param(msg, HIP_PARAM_CERT_SPKI_INFO)),
-             -1, "No hip_cert_spki_info struct found from daemons msg\n");
-
-    memcpy(to_verification, returned, sizeof(struct hip_cert_spki_info));
-
-out_err:
-    free(msg);
-    return err;
-}
-
-/******************************************************************************
- * FUNCTIONS FOR x509v3                                                       *
- ******************************************************************************/
-
-/**
- * Function that requests for a certificate from daemon and gives it back.
- *
- * @param subject is the subjects HIT
- *
- * @param certificate is pointer to a buffer to which this function writes the completed cert
- *
- * @return positive on success negative otherwise
- *
- * @note The certificate is given in DER encoding
- */
-int hip_cert_x509v3_request_certificate(struct in6_addr *subject,
-                                        unsigned char *certificate)
-{
-    int                              err = 0;
-    struct hip_common               *msg;
-    const struct hip_cert_x509_resp *p;
-
-    HIP_IFEL(!(msg = malloc(HIP_MAX_PACKET)), -1,
-             "Malloc for msg failed\n");
-    hip_msg_init(msg);
-    /* build the msg to be sent to the daemon */
-
-    HIP_IFEL(hip_build_user_hdr(msg, HIP_MSG_CERT_X509V3_SIGN, 0), -1,
-             "Failed to build user header\n");
-    HIP_IFEL(hip_build_param_cert_x509_req(msg, subject), -1,
-             "Failed to build cert_info\n");
-    /* send and wait */
-    HIP_DEBUG("Sending request to sign x509 cert to "
-              "daemon and waiting for answer\n");
-    hip_send_recv_daemon_info(msg, 0, 0);
-    /* get the struct from the message sent back by the daemon */
-    HIP_IFEL(!(p = hip_get_param(msg, HIP_PARAM_CERT_X509_RESP)), -1,
-             "No name x509 struct found\n");
-    memcpy(certificate, p->der, p->der_len);
-    err = p->der_len;
-
-out_err:
-    free(msg);
-    return err;
-}
-
-/**
- * Function that requests for a verification of a certificate from
- * daemon and tells the result.
- *
- * @param certificate is pointer to a certificate to be verified
- * @param len is the length of the cert in certificate parameter in bytes
- *
- * @return 0 on success negative otherwise
- *
- * @note give the certificate in PEM encoding
- */
-int hip_cert_x509v3_request_verification(unsigned char *certificate, int len)
-{
-    int                              err = 0;
-    struct hip_common               *msg;
-    const struct hip_cert_x509_resp *received;
-
-    HIP_IFEL(!(msg = malloc(HIP_MAX_PACKET)), -1,
-             "Malloc for msg failed\n");
-    hip_msg_init(msg);
-
-    /* build the msg to be sent to the daemon */
-    HIP_IFEL(hip_build_user_hdr(msg, HIP_MSG_CERT_X509V3_VERIFY, 0), -1,
-             "Failed to build user header\n");
-    HIP_IFEL(hip_build_param_cert_x509_ver(msg, (char *) certificate, len), -1,
-             "Failed to build cert_info\n");
-
-    /* send and wait */
-    HIP_DEBUG("Sending request to verify x509  cert to "
-              "daemon and waiting for answer\n");
-    hip_send_recv_daemon_info(msg, 0, 0);
-
-    /* get the struct from the message sent back by the daemon */
-    HIP_IFEL(!(received = hip_get_param(msg, HIP_PARAM_CERT_X509_RESP)), -1,
-             "No x509 struct found\n");
-    err = hip_get_msg_err(msg);
-    if (err == 0) {
-        HIP_DEBUG("Verified successfully\n");
-    } else {
-        HIP_DEBUG("Verification failed\n");
-    }
-
-out_err:
-    free(msg);
-    return err;
-}
-
 /*******************************************************************************
  * UTILITARY FUNCTIONS                                                         *
  *******************************************************************************/
 
=== modified file 'lib/core/certtools.h'
--- lib/core/certtools.h	2011-08-15 14:11:56 +0000
+++ lib/core/certtools.h	2011-10-17 18:32:42 +0000
@@ -64,11 +64,6 @@
                               const char *, struct in6_addr *,
                               time_t *, time_t *);
 int hip_cert_spki_char2certinfo(char *, struct hip_cert_spki_info *);
-int hip_cert_spki_send_to_verification(struct hip_cert_spki_info *);
-
-/* x509v3 cert related functions */
-int hip_cert_x509v3_request_certificate(struct in6_addr *, unsigned char *);
-int hip_cert_x509v3_request_verification(unsigned char *, int);
 
 /** Utilitary functions */
 STACK_OF(CONF_VALUE) * hip_cert_read_conf_section(const char *, CONF *);
 
=== modified file 'lib/core/modularization.c'
--- lib/core/modularization.c	2011-10-12 09:20:36 +0000
+++ lib/core/modularization.c	2011-10-17 18:32:42 +0000
@@ -95,8 +95,7 @@
 /**
  * List of parameter types.
  *
- * Used to track all registered parameter types. Each module which defines a new
- * parameter type must register it using lmod_register_parameter_type.
+ * Used to track all registered parameter types.
  */
 static struct hip_ll parameter_types;
 
 
=== modified file 'lib/tool/xfrmapi.c'
--- lib/tool/xfrmapi.c	2011-08-15 14:11:56 +0000
+++ lib/tool/xfrmapi.c	2011-10-17 18:32:42 +0000
@@ -701,8 +701,6 @@
  * @param entry corresponding host association
  * @return zero on success and non-zero on error
  * @note IPv4 addresses in IPv6 mapped format
- * @note If you make changes to this function, please change also
- * hipd/user_ipsec_sadb_api.c:hip_userspace_ipsec_add_sa().
  */
 uint32_t hip_add_sa(const struct in6_addr *saddr,
                     const struct in6_addr *daddr,
 
=== modified file 'test/certteststub.c'
--- test/certteststub.c	2011-08-15 14:11:56 +0000
+++ test/certteststub.c	2011-10-17 18:32:42 +0000
@@ -48,25 +48,18 @@
 #include "lib/core/protodefs.h"
 
 
-int main(int argc, char *argv[])
+int main(void)
 {
-    int                        err             = 0, i = 0, len;
+    int                        err             = 0, i = 0;
     struct hip_cert_spki_info *cert            = NULL;
     struct hip_cert_spki_info *to_verification = NULL;
     time_t                     not_before      = 0, not_after = 0;
     struct hip_common         *msg;
     struct in6_addr           *defhit;
     char                       certificate[1024];
-    unsigned char              der_cert[1024];
     CONF                      *conf;
     CONF_VALUE                *item;
-    STACK_OF(CONF_VALUE) * sec      = NULL;
-    STACK_OF(CONF_VALUE) * sec_name = NULL;
-
-    if (argc != 2) {
-        printf("Usage: %s spki|x509\n", argv[0]);
-        exit(EXIT_SUCCESS);
-    }
+    STACK_OF(CONF_VALUE) * sec = NULL;
 
     HIP_DEBUG("- This test tool has to be run as root otherwise this will fail!\n");
     HIP_DEBUG("- Hipd has to run otherwise this will hang!\n");
@@ -78,10 +71,6 @@
         goto out_err;
     }
 
-    if (strcmp(argv[1], "spki")) {
-        goto skip_spki;
-    }
-
     HIP_DEBUG("Starting to test SPKI certficate tools\n");
 
     cert = malloc(sizeof(struct hip_cert_spki_info));
@@ -142,51 +131,12 @@
     HIP_IFEL(hip_cert_spki_char2certinfo(certificate, to_verification), -1,
              "Failed to construct the hip_cert_spki_info from certificate\n");
 
-    /*
-     * below, commented out, is the daemons version of the verification
-     * and below that is the lib version of the verification
-     */
-    /*
-     * HIP_DEBUG("Sending the certificate to daemon for verification\n");
-     *
-     * HIP_IFEL(hip_cert_spki_send_to_verification(to_verification), -1,
-     *       "Failed in sending to verification\n");
-     * HIP_IFEL(to_verification->success, -1,
-     *       "Verification was not successfull\n");
-     * HIP_DEBUG("Verification was successfull (return value %d)\n",
-     *        to_verification->success);
-     */
     /* Lets do the verification in library */
     HIP_IFEL(hip_cert_spki_lib_verify(to_verification), -1,
              "Verification was not succesfull\n");
     HIP_DEBUG("Verification was successfull (return value %d)\n",
               to_verification->success);
 
-    goto out_err;
-
-skip_spki:
-    HIP_DEBUG("Starting to test x509v3 support\n");
-
-    conf     = hip_cert_open_conf();
-    sec_name = hip_cert_read_conf_section("hip_x509v3_name", conf);
-
-    for (i = 0; i < sk_CONF_VALUE_num(sec_name); i++) {
-        item = sk_CONF_VALUE_value(sec_name, i);
-        if (!strcmp(item->name, "issuerhit")) {
-            err = inet_pton(AF_INET6, item->value, defhit);
-            if (err < 1) {
-                err = -1;
-                goto out_err;
-            }
-        }
-    }
-    NCONF_free(conf);
-    len = hip_cert_x509v3_request_certificate(defhit, der_cert);
-
-    /** Now send it back for the verification */
-    HIP_IFEL((err = hip_cert_x509v3_request_verification(der_cert, len) < 0),
-             -1, "Failed to verify a certificate\n");
-
 out_err:
     HIP_DEBUG("If there was no errors above, \"everything\" is OK\n");