plan:HEADmaster

sign the network part with the system host key
after verifying local connectivity of the IP <-- TODO
and if we have peer nodes,
  in our not-at-all-implemented cluster,
  then verifying connectivity through that address+key
    through encrypting our signed message to the addresses of our peers
    in a cryptographic scheme allowing their revelation by vote
    thus it is an offline verification allowing us to publish the encrypted data
      put that shit in http:///.well-known ??
then extract the local part from the signature's public key

4 files changed, 145 insertions, 0 deletions

diff --git a/signme.bash b/signme.bash
new file mode 100755
index 0000000..3d764e7
--- /dev/null
+++ b/signme.bash
@@ -0,0 +1,76 @@
+#!/bin/bash
+set -e
+set -o pipefail
+
+extract_local_ip ()
+{
+  sed -n -E -e 's/^[0-9]+ bytes from (fe80::[a-f:0-9]+(%[^ ]*)?): .*/\1/ip'
+}
+
+local_ips ()
+{
+  ping -n -w1 ff02::1${INTERFACE:+%$INTERFACE} 2>/dev/null | extract_local_ip
+}
+
+scan ()
+{
+  ssh-keyscan -t ed25519 -D "$@" 2>/dev/null
+}
+
+select_sha256 ()
+{
+  while read
+  do
+    set -- $REPLY
+    if [ "$2 $3 $4 $5" = "IN SSHFP 4 2" ]
+    then
+      printf '%s\n' "$1 $6"
+    fi
+  done
+}
+
+addr_select ()
+{
+    jq -r \
+'
+    .[] | {
+            ifname,
+            addr_info: .addr_info | .[] | select(.scope == "global")
+                                        | select(.prefixlen < 128)
+                                        | {local, prefixlen}
+          } |
+          .ifname + " " + .addr_info.local + " " + (.addr_info.prefixlen | tostring)
+'
+}
+
+with_ip_bits()
+{
+  local ip="$1"
+  shift
+  ./src/inet_pton "$ip" | "$@" | ./src/inet_ntop
+}
+
+self_ip()
+{
+  scan ::1 | select_sha256 | while read localhost hash
+  do
+    [ "$localhost" = ::1 ] || exit 28
+    printf '%s' "$hash" | tail -c 32 | base16 -d | ./src/inet_ntop
+    break
+  done
+}
+
+self_ip=$(self_ip) || exit 3
+
+/sbin/ip -6 -j addr | addr_select | while read iface network_ip bits
+do
+  localip=$(with_ip_bits $self_ip ./a.out $bits)
+  network=$(with_ip_bits $network_ip ./a.out -$bits)
+  echo $iface $localip >&2
+  echo $network/$bits
+done
+exit
+
+IPS=($(local_ips))
+scan "${IPS[@]}" | select_sha256
+
diff --git a/src/inet_lnaof.c b/src/inet_lnaof.c
new file mode 100644
index 0000000..e45ee34
--- /dev/null
+++ b/src/inet_lnaof.c
@@ -0,0 +1,58 @@
+#include <assert.h>
+#include <netinet/in.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <strings.h>
+#include <sys/socket.h>
+
+/* Why am I writing code like this
+in 2023 though?  Why isn't this in
+some library somewhere I can find?
+Seriously, wtf? */
+
+void zero_from_the_left(uint8_t *res, size_t zero_bits)
+{
+  size_t zero_bytes = zero_bits / 8;
+  zero_bits -= zero_bytes * 8;
+
+  bzero(res, zero_bytes);
+  res[zero_bytes] <<= zero_bits;
+  res[zero_bytes] >>= zero_bits;
+}
+
+void zero_from_the_right(uint8_t *res, size_t zero_bits)
+{
+  size_t zero_bytes = zero_bits / 8;
+  zero_bits -= zero_bytes * 8;
+
+  assert(zero_bytes <= 16);
+  bzero(&res[16 - zero_bytes], zero_bytes);
+  res[0] >>= zero_bits;
+  res[0] <<= zero_bits;
+}
+
+int main(int argc, char **argv)
+{
+  if (argc != 2)
+    return 1;
+  int bit_count = atoi(argv[1]);
+  bool from_right = bit_count < 0;
+  if (from_right)
+    bit_count += 128;
+  if (bit_count < 0)
+    return 2;
+  if (bit_count > 128)
+    return 3;
+
+  uint8_t address[16];
+  if (fread(address, 16, 1, stdin) != 1)
+    return 4;
+
+  if (from_right)
+    zero_from_the_right(address, bit_count);
+  else
+    zero_from_the_left(address, bit_count);
+
+  return fwrite(address, 16, 1, stdout) == 1 ? 0 : 5;
+}
diff --git a/src/inet_ntop b/src/inet_ntop
new file mode 100755
index 0000000..5c8f5cc
--- /dev/null
+++ b/src/inet_ntop
@@ -0,0 +1,7 @@
+#!/usr/bin/perl
+use Socket qw(inet_ntop AF_INET6);
+@ARGV == 0 || die "usage: $0 <<< <binary ipv6 address>\n";
+binmode STDIN, ":raw" or die $!;
+read STDIN, $address, 16 or die $!;
+$address = inet_ntop (AF_INET6, $address) || die "inet_ntop: $!\n";
+print "$address\n";
diff --git a/src/inet_pton b/src/inet_pton
new file mode 100755
index 0000000..f41f8ad
--- /dev/null
+++ b/src/inet_pton
@@ -0,0 +1,4 @@
+#!/usr/bin/perl
+use Socket qw(inet_pton AF_INET6);
+@ARGV == 1 || die "usage: $0 <ipv6 address>\n";
+print STDOUT (inet_pton (AF_INET6, $ARGV[0]) || die "inet_pton: $!\n");