Add a separate client communicating by unix socket

This is pretty rough for now; the service provider only handles one client,
and dies ungracefully when anything goes wrong. It seems to work, though.

1 files changed, 79 insertions, 18 deletions

diff --git a/service_provider.h b/service_provider.h
index 3399cb4..b55285c 100644
--- a/service_provider.h
+++ b/service_provider.h
@@ -9,12 +9,64 @@
 
 struct service_provider;
 
+/* Client-service protocol: */
+
+/* 1. Client sends user_request to service.
+ *
+ * 2. Client sends additional data to service, if needed.
+ *
+ * 3. Service sends filled tm_request to client for signature.
+ *
+ * 4. Client verifies that the tm_request is appropriate.
+ *
+ * 5. Client sends HMAC(tm_request, user key) to service.
+ *
+ * 6. Service performs action.
+ *
+ * 7. Service sends module's authenticated acknowledgement (and
+ * response, in the case of RETRIEVE_INFO) to client.
+ *
+ * 8. Client verifies acknowledgement against earlier tm_request or
+ * response.
+ */
+
+/* request from the client to the service */
+struct user_request {
+    enum { CREATE_FILE, MODIFY_FILE, MODIFY_ACL, RETRIEVE_INFO, RETRIEVE_FILE } type;
+    union {
+        struct {
+            uint64_t user_id;
+        } create;
+        struct {
+            uint64_t user_id, file_idx;
+            /* ACL IOMT will follow */
+        } modify_acl;
+        struct {
+            uint64_t user_id, file_idx;
+            hash_t encrypted_secret, kf;
+            /* file contents, build code IOMT, and compose file IOMT
+             * will follow */
+
+            /* will respond with module's HMAC of tm_request struct
+             * plus a zero byte */
+        } modify_file;
+        struct {
+            /* same structure for retrieve file and retrieve info */
+            uint64_t user_id, file_idx, version;
+            /* will respond with either version_info struct, plus
+             * HMAC, or file contents and key (which the client can
+             * verify themselves) */
+        } retrieve;
+    };
+} __attribute__((packed));
+
+#ifndef CLIENT
 struct service_provider *sp_new(const void *key, size_t keylen, int logleaves);
 void sp_free(struct service_provider *sp);
 
 /* see .c file for documentation */
 struct tm_cert sp_request(struct service_provider *sp,
-                          const struct user_request *req, hash_t req_hmac,
+                          const struct tm_request *req, hash_t req_hmac,
                           hash_t *hmac_out,
                           struct tm_cert *vr_out, hash_t *vr_hmac_out,
                           hash_t *ack_hmac_out,
@@ -26,23 +78,29 @@ struct tm_cert sp_request(struct service_provider *sp,
 /* Reserve a new file index with user_id added to the ACL. Returns
  * cert on failure. Authenticated with ack_hmac, which is the returned
  * request with a zero byte appended, signed by the module. */
-struct user_request sp_createfile(struct service_provider *sp,
-                                  uint64_t user_id, const void *key, size_t keylen,
-                                  hash_t *ack_hmac);
-
-struct user_request sp_modifyacl(struct service_provider *sp,
-                                 uint64_t user_id, const void *key, size_t keylen,
-                                 uint64_t file_idx,
-                                 struct iomt *new_acl,
-                                 hash_t *ack_hmac);
-
-struct user_request sp_modifyfile(struct service_provider *sp,
-                                  uint64_t user_id, const void *key, size_t keylen,
-                                  uint64_t file_idx,
-                                  hash_t encrypted_secret, hash_t kf,
-                                  const struct iomt *buildcode, const struct iomt *composefile,
-                                  const void *encrypted_file, size_t filelen,
-                                  hash_t *ack_hmac);
+struct tm_request sp_createfile(struct service_provider *sp,
+                                uint64_t user_id,
+                                hash_t (*sign_request)(void *userdata, const struct tm_request *req),
+                                void *userdata,
+                                hash_t *ack_hmac);
+
+struct tm_request sp_modifyacl(struct service_provider *sp,
+                               uint64_t user_id,
+                               hash_t (*sign_request)(void *userdata, const struct tm_request *req),
+                               void *userdata,
+                               uint64_t file_idx,
+                               struct iomt *new_acl,
+                               hash_t *ack_hmac);
+
+struct tm_request sp_modifyfile(struct service_provider *sp,
+                                uint64_t user_id,
+                                hash_t (*sign_request)(void *userdata, const struct tm_request *req),
+                                void *userdata,
+                                uint64_t file_idx,
+                                hash_t encrypted_secret, hash_t kf,
+                                const struct iomt *buildcode, const struct iomt *composefile,
+                                const void *encrypted_file, size_t filelen,
+                                hash_t *ack_hmac);
 
 /* Retrieve authenticated information on a version of a file; if
  * version is zero, default to the latest version. */
@@ -59,6 +117,9 @@ void *sp_retrieve_file(struct service_provider *sp,
                        hash_t *encrypted_secret,
                        size_t *len);
 
+int sp_main(int sockfd);
+
 void sp_test(void);
+#endif
 
 #endif