move implementation to internal/ directory (#828)

internal/transport/fromconfig/transport_fromconfig.go

@@ -0,0 +1,59 @@
+// Package fromconfig instantiates transports based on zrepl config structures
+// (see package config).
+package fromconfig
+
+import (
+	"fmt"
+
+	"github.com/pkg/errors"
+
+	"github.com/zrepl/zrepl/internal/config"
+	"github.com/zrepl/zrepl/internal/transport"
+	"github.com/zrepl/zrepl/internal/transport/local"
+	"github.com/zrepl/zrepl/internal/transport/ssh"
+	"github.com/zrepl/zrepl/internal/transport/tcp"
+	"github.com/zrepl/zrepl/internal/transport/tls"
+)
+
+func ListenerFactoryFromConfig(g *config.Global, in config.ServeEnum, parseFlags config.ParseFlags) (transport.AuthenticatedListenerFactory, error) {
+
+	var (
+		l   transport.AuthenticatedListenerFactory
+		err error
+	)
+	switch v := in.Ret.(type) {
+	case *config.TCPServe:
+		l, err = tcp.TCPListenerFactoryFromConfig(g, v)
+	case *config.TLSServe:
+		l, err = tls.TLSListenerFactoryFromConfig(g, v, parseFlags)
+	case *config.StdinserverServer:
+		l, err = ssh.MultiStdinserverListenerFactoryFromConfig(g, v)
+	case *config.LocalServe:
+		l, err = local.LocalListenerFactoryFromConfig(g, v)
+	default:
+		return nil, errors.Errorf("internal error: unknown serve type %T", v)
+	}
+
+	return l, err
+}
+
+func ConnecterFromConfig(g *config.Global, in config.ConnectEnum, parseFlags config.ParseFlags) (transport.Connecter, error) {
+	var (
+		connecter transport.Connecter
+		err       error
+	)
+	switch v := in.Ret.(type) {
+	case *config.SSHStdinserverConnect:
+		connecter, err = ssh.SSHStdinserverConnecterFromConfig(v)
+	case *config.TCPConnect:
+		connecter, err = tcp.TCPConnecterFromConfig(v)
+	case *config.TLSConnect:
+		connecter, err = tls.TLSConnecterFromConfig(v, parseFlags)
+	case *config.LocalConnect:
+		connecter, err = local.LocalConnecterFromConfig(v)
+	default:
+		panic(fmt.Sprintf("implementation error: unknown connecter type %T", v))
+	}
+
+	return connecter, err
+}

internal/transport/local/connect_local.go

@@ -0,0 +1,48 @@
+package local
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/zrepl/zrepl/internal/config"
+	"github.com/zrepl/zrepl/internal/transport"
+)
+
+type LocalConnecter struct {
+	listenerName   string
+	clientIdentity string
+	dialTimeout    time.Duration
+}
+
+func LocalConnecterFromConfig(in *config.LocalConnect) (*LocalConnecter, error) {
+	if in.ClientIdentity == "" {
+		return nil, fmt.Errorf("ClientIdentity must not be empty")
+	}
+	if in.ListenerName == "" {
+		return nil, fmt.Errorf("ListenerName must not be empty")
+	}
+	if in.DialTimeout < 0 {
+		return nil, fmt.Errorf("DialTimeout must be zero or positive")
+	}
+	cn := &LocalConnecter{
+		listenerName:   in.ListenerName,
+		clientIdentity: in.ClientIdentity,
+		dialTimeout:    in.DialTimeout,
+	}
+	return cn, nil
+}
+
+func (c *LocalConnecter) Connect(dialCtx context.Context) (transport.Wire, error) {
+	l := GetLocalListener(c.listenerName)
+	if c.dialTimeout > 0 {
+		ctx, cancel := context.WithTimeout(dialCtx, c.dialTimeout)
+		defer cancel()
+		dialCtx = ctx // shadow
+	}
+	w, err := l.Connect(dialCtx, c.clientIdentity)
+	if err == context.DeadlineExceeded {
+		return nil, fmt.Errorf("local listener %q not reachable", c.listenerName)
+	}
+	return w, err
+}

internal/transport/local/serve_local.go

@@ -0,0 +1,194 @@
+package local
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"sync"
+
+	"github.com/zrepl/zrepl/internal/config"
+	"github.com/zrepl/zrepl/internal/transport"
+	"github.com/zrepl/zrepl/internal/util/socketpair"
+)
+
+var localListeners struct {
+	m    map[string]*LocalListener // listenerName -> listener
+	init sync.Once
+	mtx  sync.Mutex
+}
+
+func GetLocalListener(listenerName string) *LocalListener {
+
+	localListeners.init.Do(func() {
+		localListeners.m = make(map[string]*LocalListener)
+	})
+
+	localListeners.mtx.Lock()
+	defer localListeners.mtx.Unlock()
+
+	l, ok := localListeners.m[listenerName]
+	if !ok {
+		l = newLocalListener()
+		localListeners.m[listenerName] = l
+	}
+	return l
+
+}
+
+type connectRequest struct {
+	clientIdentity string
+	callback       chan connectResult
+}
+
+type connectResult struct {
+	conn transport.Wire
+	err  error
+}
+
+type LocalListener struct {
+	connects chan connectRequest
+}
+
+func newLocalListener() *LocalListener {
+	return &LocalListener{
+		connects: make(chan connectRequest),
+	}
+}
+
+// Connect to the LocalListener from a client with identity clientIdentity
+func (l *LocalListener) Connect(dialCtx context.Context, clientIdentity string) (conn transport.Wire, err error) {
+
+	// place request
+	req := connectRequest{
+		clientIdentity: clientIdentity,
+		// ensure non-blocking send in Accept, we don't necessarily read from callback before
+		// Accept writes to it
+		callback: make(chan connectResult, 1),
+	}
+	select {
+	case l.connects <- req:
+	case <-dialCtx.Done():
+		return nil, dialCtx.Err()
+	}
+
+	// wait for listener response
+	select {
+	case connRes := <-req.callback:
+		conn, err = connRes.conn, connRes.err
+	case <-dialCtx.Done():
+		close(req.callback) // sending to the channel afterwards will panic, the listener has to catch this
+		conn, err = nil, dialCtx.Err()
+	}
+
+	return conn, err
+}
+
+type localAddr struct {
+	S string
+}
+
+func (localAddr) Network() string { return "local" }
+
+func (a localAddr) String() string { return a.S }
+
+func (l *LocalListener) Addr() net.Addr { return localAddr{"<listening>"} }
+
+func (l *LocalListener) Accept(ctx context.Context) (*transport.AuthConn, error) {
+	respondToRequest := func(req connectRequest, res connectResult) (err error) {
+
+		transport.GetLogger(ctx).
+			WithField("res.conn", res.conn).WithField("res.err", res.err).
+			Debug("responding to client request")
+
+		// contract between Connect and Accept is that Connect sends a req.callback
+		// into which we can send one result non-blockingly.
+		// We want to panic if that contract is violated (impl error)
+		//
+		// However, Connect also supports timeouts through context cancellation:
+		// Connect closes the channel into which we might send, which will panic.
+		//
+		// ==> distinguish those cases in defer
+		const clientCallbackBlocked = "client-provided callback did block on send"
+		defer func() {
+			errv := recover()
+			if errv == clientCallbackBlocked {
+				// this would be a violation of contract between Connect and Accept, see above
+				panic(clientCallbackBlocked)
+			} else {
+				transport.GetLogger(ctx).WithField("recover_err", errv).
+					Debug("panic on send to client callback, likely a legitimate client-side timeout")
+			}
+		}()
+		select {
+		case req.callback <- res:
+			err = nil
+		default:
+			panic(clientCallbackBlocked)
+		}
+		close(req.callback)
+		return err
+	}
+
+	transport.GetLogger(ctx).Debug("waiting for local client connect requests")
+	var req connectRequest
+	select {
+	case req = <-l.connects:
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	}
+
+	transport.GetLogger(ctx).WithField("client_identity", req.clientIdentity).Debug("got connect request")
+	if req.clientIdentity == "" {
+		res := connectResult{nil, fmt.Errorf("client identity must not be empty")}
+		if err := respondToRequest(req, res); err != nil {
+			return nil, err
+		}
+		return nil, fmt.Errorf("client connected with empty client identity")
+	}
+
+	transport.GetLogger(ctx).Debug("creating socketpair")
+	left, right, err := socketpair.SocketPair()
+	if err != nil {
+		res := connectResult{nil, fmt.Errorf("server error: %s", err)}
+		if respErr := respondToRequest(req, res); respErr != nil {
+			// returning the socketpair error properly is more important than the error sent to the client
+			transport.GetLogger(ctx).WithError(respErr).Error("error responding to client")
+		}
+		return nil, err
+	}
+
+	transport.GetLogger(ctx).Debug("responding with left side of socketpair")
+	res := connectResult{left, nil}
+	if err := respondToRequest(req, res); err != nil {
+		transport.GetLogger(ctx).WithError(err).Error("error responding to client")
+		if err := left.Close(); err != nil {
+			transport.GetLogger(ctx).WithError(err).Error("cannot close left side of socketpair")
+		}
+		if err := right.Close(); err != nil {
+			transport.GetLogger(ctx).WithError(err).Error("cannot close right side of socketpair")
+		}
+		return nil, err
+	}
+
+	return transport.NewAuthConn(right, req.clientIdentity), nil
+}
+
+func (l *LocalListener) Close() error {
+	// FIXME: make sure concurrent Accepts return with error, and further Accepts return that error, too
+	// Example impl: for each accept, do context.WithCancel, and store the cancel in a list
+	// When closing, set a member variable to state=closed, make sure accept will exit early
+	// and then call all cancels in the list
+	// The code path from Accept entry over check if state=closed to list entry must be protected by a mutex.
+	return nil
+}
+
+func LocalListenerFactoryFromConfig(g *config.Global, in *config.LocalServe) (transport.AuthenticatedListenerFactory, error) {
+	if in.ListenerName == "" {
+		return nil, fmt.Errorf("ListenerName must not be empty")
+	}
+	listenerName := in.ListenerName
+	lf := func() (transport.AuthenticatedListener, error) {
+		return GetLocalListener(listenerName), nil
+	}
+	return lf, nil
+}

internal/transport/ssh/connect_ssh.go

@@ -0,0 +1,57 @@
+package ssh
+
+import (
+	"context"
+	"time"
+
+	"github.com/jinzhu/copier"
+	"github.com/pkg/errors"
+	"github.com/problame/go-netssh"
+
+	"github.com/zrepl/zrepl/internal/config"
+	"github.com/zrepl/zrepl/internal/transport"
+)
+
+type SSHStdinserverConnecter struct {
+	Host                 string
+	User                 string
+	Port                 uint16
+	IdentityFile         string
+	TransportOpenCommand []string
+	SSHCommand           string
+	Options              []string
+	dialTimeout          time.Duration
+}
+
+func SSHStdinserverConnecterFromConfig(in *config.SSHStdinserverConnect) (c *SSHStdinserverConnecter, err error) {
+
+	c = &SSHStdinserverConnecter{
+		Host:         in.Host,
+		User:         in.User,
+		Port:         in.Port,
+		IdentityFile: in.IdentityFile,
+		SSHCommand:   in.SSHCommand,
+		Options:      in.Options,
+		dialTimeout:  in.DialTimeout,
+	}
+	return
+
+}
+
+func (c *SSHStdinserverConnecter) Connect(dialCtx context.Context) (transport.Wire, error) {
+
+	var endpoint netssh.Endpoint
+	if err := copier.Copy(&endpoint, c); err != nil {
+		return nil, errors.WithStack(err)
+	}
+	dialCtx, dialCancel := context.WithTimeout(dialCtx, c.dialTimeout) // context.TODO tied to error handling below
+	defer dialCancel()
+	nconn, err := netssh.Dial(dialCtx, endpoint)
+	if err != nil {
+		if err == context.DeadlineExceeded {
+			err = errors.Errorf("dial_timeout of %s exceeded", c.dialTimeout)
+		}
+		return nil, err
+	}
+	return nconn, nil
+}

internal/transport/ssh/serve_stdinserver.go

@@ -0,0 +1,149 @@
+package ssh
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"path"
+	"sync/atomic"
+
+	"github.com/pkg/errors"
+	"github.com/problame/go-netssh"
+
+	"github.com/zrepl/zrepl/internal/config"
+	"github.com/zrepl/zrepl/internal/daemon/nethelpers"
+	"github.com/zrepl/zrepl/internal/transport"
+)
+
+func MultiStdinserverListenerFactoryFromConfig(g *config.Global, in *config.StdinserverServer) (transport.AuthenticatedListenerFactory, error) {
+
+	for _, ci := range in.ClientIdentities {
+		if err := transport.ValidateClientIdentity(ci); err != nil {
+			return nil, errors.Wrapf(err, "invalid client identity %q", ci)
+		}
+	}
+
+	clientIdentities := in.ClientIdentities
+	sockdir := g.Serve.StdinServer.SockDir
+
+	lf := func() (transport.AuthenticatedListener, error) {
+		return multiStdinserverListenerFromClientIdentities(sockdir, clientIdentities)
+	}
+
+	return lf, nil
+}
+
+type multiStdinserverAcceptRes struct {
+	conn *transport.AuthConn
+	err  error
+}
+
+type MultiStdinserverListener struct {
+	listeners []*stdinserverListener
+	accepts   chan multiStdinserverAcceptRes
+	closed    int32
+}
+
+// client identities must be validated
+func multiStdinserverListenerFromClientIdentities(sockdir string, cis []string) (*MultiStdinserverListener, error) {
+	listeners := make([]*stdinserverListener, 0, len(cis))
+	var err error
+	for _, ci := range cis {
+		sockpath := path.Join(sockdir, ci)
+		l := &stdinserverListener{clientIdentity: ci}
+		if err = nethelpers.PreparePrivateSockpath(sockpath); err != nil {
+			break
+		}
+		if l.l, err = netssh.Listen(sockpath); err != nil {
+			break
+		}
+		listeners = append(listeners, l)
+	}
+	if err != nil {
+		for _, l := range listeners {
+			l.Close() // FIXME error reporting?
+		}
+		return nil, err
+	}
+	return &MultiStdinserverListener{listeners: listeners}, nil
+}
+
+func (m *MultiStdinserverListener) Accept(ctx context.Context) (*transport.AuthConn, error) {
+
+	if m.accepts == nil {
+		m.accepts = make(chan multiStdinserverAcceptRes, len(m.listeners))
+		for i := range m.listeners {
+			go func(i int) {
+				for atomic.LoadInt32(&m.closed) == 0 {
+					conn, err := m.listeners[i].Accept(context.TODO())
+					m.accepts <- multiStdinserverAcceptRes{conn, err}
+				}
+			}(i)
+		}
+	}
+
+	res := <-m.accepts
+	return res.conn, res.err
+
+}
+
+type multiListenerAddr struct {
+	clients []string
+}
+
+func (multiListenerAddr) Network() string { return "netssh" }
+
+func (l multiListenerAddr) String() string {
+	return fmt.Sprintf("netssh:clients=%v", l.clients)
+}
+
+func (m *MultiStdinserverListener) Addr() net.Addr {
+	cis := make([]string, len(m.listeners))
+	for i := range cis {
+		cis[i] = m.listeners[i].clientIdentity
+	}
+	return multiListenerAddr{cis}
+}
+
+func (m *MultiStdinserverListener) Close() error {
+	atomic.StoreInt32(&m.closed, 1)
+	var oneErr error
+	for _, l := range m.listeners {
+		if err := l.Close(); err != nil && oneErr == nil {
+			oneErr = err
+		}
+	}
+	return oneErr
+}
+
+// a single stdinserverListener (part of multiStdinserverListener)
+type stdinserverListener struct {
+	l              *netssh.Listener
+	clientIdentity string
+}
+
+type listenerAddr struct {
+	clientIdentity string
+}
+
+func (listenerAddr) Network() string { return "netssh" }
+
+func (a listenerAddr) String() string {
+	return fmt.Sprintf("netssh:client=%q", a.clientIdentity)
+}
+
+func (l stdinserverListener) Addr() net.Addr {
+	return listenerAddr{l.clientIdentity}
+}
+
+func (l stdinserverListener) Accept(ctx context.Context) (*transport.AuthConn, error) {
+	c, err := l.l.Accept()
+	if err != nil {
+		return nil, err
+	}
+	return transport.NewAuthConn(c, l.clientIdentity), nil
+}
+
+func (l stdinserverListener) Close() (err error) {
+	return l.l.Close()
+}

internal/transport/tcp/connect_tcp.go

@@ -0,0 +1,30 @@
+package tcp
+
+import (
+	"context"
+	"net"
+
+	"github.com/zrepl/zrepl/internal/config"
+	"github.com/zrepl/zrepl/internal/transport"
+)
+
+type TCPConnecter struct {
+	Address string
+	dialer  net.Dialer
+}
+
+func TCPConnecterFromConfig(in *config.TCPConnect) (*TCPConnecter, error) {
+	dialer := net.Dialer{
+		Timeout: in.DialTimeout,
+	}
+
+	return &TCPConnecter{in.Address, dialer}, nil
+}
+
+func (c *TCPConnecter) Connect(dialCtx context.Context) (transport.Wire, error) {
+	conn, err := c.dialer.DialContext(dialCtx, "tcp", c.Address)
+	if err != nil {
+		return nil, err
+	}
+	return conn.(*net.TCPConn), nil
+}

internal/transport/tcp/serve_tcp.go

@@ -0,0 +1,56 @@
+package tcp
+
+import (
+	"context"
+	"net"
+
+	"github.com/pkg/errors"
+
+	"github.com/zrepl/zrepl/internal/config"
+	"github.com/zrepl/zrepl/internal/transport"
+	"github.com/zrepl/zrepl/internal/util/tcpsock"
+)
+
+func TCPListenerFactoryFromConfig(c *config.Global, in *config.TCPServe) (transport.AuthenticatedListenerFactory, error) {
+	clientMap, err := ipMapFromConfig(in.Clients)
+	if err != nil {
+		return nil, errors.Wrap(err, "cannot parse client IP map")
+	}
+	lf := func() (transport.AuthenticatedListener, error) {
+		l, err := tcpsock.Listen(in.Listen, in.ListenFreeBind)
+		if err != nil {
+			return nil, err
+		}
+		return &TCPAuthListener{l, clientMap}, nil
+	}
+	return lf, nil
+}
+
+type TCPAuthListener struct {
+	*net.TCPListener
+	clientMap *ipMap
+}
+
+func (f *TCPAuthListener) Accept(ctx context.Context) (*transport.AuthConn, error) {
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+	go func() {
+		<-ctx.Done()
+		cancel()
+	}()
+	nc, err := f.TCPListener.AcceptTCP()
+	if err != nil {
+		return nil, err
+	}
+	clientAddr := &net.IPAddr{
+		IP:   nc.RemoteAddr().(*net.TCPAddr).IP,
+		Zone: nc.RemoteAddr().(*net.TCPAddr).Zone,
+	}
+	clientIdent, err := f.clientMap.Get(clientAddr)
+	if err != nil {
+		transport.GetLogger(ctx).WithField("ipaddr", clientAddr).Error("client IP not in client map")
+		nc.Close()
+		return nil, err
+	}
+	return transport.NewAuthConn(nc, clientIdent), nil
+}

internal/transport/tcp/serve_tcp_ipmap.go

@@ -0,0 +1,167 @@
+package tcp
+
+import (
+	"bytes"
+	"fmt"
+	"net"
+	"sort"
+	"strings"
+
+	"github.com/pkg/errors"
+	"golang.org/x/sys/unix"
+
+	"github.com/zrepl/zrepl/internal/transport"
+)
+
+type ipMapEntry struct {
+	subnet *net.IPNet
+	// ident is always not empty
+	ident string
+	// zone may be empty (e.g. for IPv4)
+	zone string
+}
+
+type ipMap struct {
+	entries []*ipMapEntry
+}
+
+func ipMapFromConfig(clients map[string]string) (*ipMap, error) {
+
+	entries := make([]*ipMapEntry, 0, len(clients))
+	for clientInput, clientIdent := range clients {
+		userIPMapEntry, err := newIPMapEntry(clientInput, clientIdent)
+		if err != nil {
+			return nil, errors.Wrapf(err, "cannot not parse %q:%q", clientInput, clientIdent)
+		}
+
+		entries = append(entries, userIPMapEntry)
+	}
+
+	sort.Sort(byPrefixlen(entries))
+
+	return &ipMap{entries: entries}, nil
+}
+
+func (m *ipMap) Get(ipAddr *net.IPAddr) (string, error) {
+	for _, e := range m.entries {
+		if e.zone != ipAddr.Zone {
+			continue
+		}
+		if e.subnet.Contains(ipAddr.IP) {
+			return zfsDatasetPathComponentCompatibleRepresentation(e.ident, ipAddr), nil
+		}
+	}
+	return "", errors.Errorf("no identity mapping for client IP: %s%%%s", ipAddr.IP, ipAddr.Zone)
+}
+
+var ipv6FullySpecifiedMask = bytes.Repeat([]byte{0xff}, net.IPv6len)
+
+func newIPMapEntry(input string, ident string) (*ipMapEntry, error) {
+	ip := input
+	var zone string
+
+	ipZoneSplit := strings.SplitN(input, "%", 2)
+	if len(ipZoneSplit) > 1 {
+		ip = ipZoneSplit[0]
+		zone = ipZoneSplit[1]
+	}
+
+	_, subnet, err := net.ParseCIDR(ip)
+	if err != nil {
+		// expect full IP, no '*' placeholder expansion
+
+		if strings.Count(ident, "*") != 0 {
+			return nil, fmt.Errorf("non-CIDR matches must not contain '*' placeholder")
+		}
+
+		if err := transport.ValidateClientIdentity(ident); err != nil {
+			return nil, errors.Wrapf(err, "invalid client identity %q for IP %q", ident, ip)
+		}
+
+		parsedIP := net.ParseIP(ip)
+		if parsedIP == nil {
+			return nil, errors.Wrapf(err, "invalid client address %q", ip)
+		}
+		parsedIP = parsedIP.To16()
+
+		return &ipMapEntry{
+			subnet: &net.IPNet{
+				IP:   parsedIP,
+				Mask: ipv6FullySpecifiedMask,
+			},
+			zone:  zone,
+			ident: ident,
+		}, nil
+	}
+
+	// expect CIDR and '*' placeholder expansion
+
+	if strings.Count(ident, "*") != 1 {
+		err = fmt.Errorf("CIDRs require 1 IP placeholder")
+		return nil, errors.Wrapf(err, "invalid client identity %q for IP %q", ident, ip)
+	}
+
+	longestIPAddr := net.IPAddr{
+		IP:   net.IP(bytes.Repeat([]byte{0xff}, net.IPv6len)),
+		Zone: strings.Repeat("i", unix.IFNAMSIZ),
+	}
+	longestIdent := zfsDatasetPathComponentCompatibleRepresentation(ident, &longestIPAddr)
+
+	if err := transport.ValidateClientIdentity(longestIdent); err != nil {
+		return nil, errors.Wrapf(err, "invalid client identity for IP %q", ip)
+	}
+
+	ones, _ := subnet.Mask.Size()
+	preExpansionAddrlen := len(subnet.IP) * 8
+	expanded := subnet.IP.To16()
+	postExpansionAddrlen := len(expanded) * 8
+	return &ipMapEntry{
+		subnet: &net.IPNet{
+			IP:   expanded,
+			Mask: net.CIDRMask(postExpansionAddrlen-preExpansionAddrlen+ones, postExpansionAddrlen),
+		},
+		zone:  zone,
+		ident: ident,
+	}, nil
+}
+
+func zfsDatasetPathComponentCompatibleRepresentation(identityWithWildcard string, addr *net.IPAddr) string {
+	// If a Zone exists we append it after the IP using a "-" because "%"
+	// is a zfs dataset forbidden char.
+	if addr.Zone != "" {
+		return strings.Replace(identityWithWildcard, "*", addr.IP.String()+"-"+addr.Zone, 1)
+	}
+	// newIPMapEntry validates that the line contains exactly one "*"
+	return strings.Replace(identityWithWildcard, "*", addr.IP.String(), 1)
+}
+
+func (e *ipMapEntry) String() string {
+	return fmt.Sprintf("&ipMapEntry{subnet=%q, ident=%q, zone=%q}", e.subnet.String(), e.ident, e.zone)
+}
+
+func (e *ipMapEntry) PrefixLen() int {
+	ones, bits := e.subnet.Mask.Size()
+	if bits != net.IPv6len*8 {
+		panic(fmt.Sprintf("impl error: we represent all addresses as 16byte internally ones=%v bits=%v: %s", ones, bits, e))
+	}
+	return ones
+}
+
+// newtype to support sorting by prefixlength
+type byPrefixlen []*ipMapEntry
+
+func (m byPrefixlen) Len() int { return len(m) }
+func (m byPrefixlen) Less(i, j int) bool {
+
+	if m[i].PrefixLen() != m[j].PrefixLen() {
+		return m[i].PrefixLen() > m[j].PrefixLen()
+	}
+
+	addrCmp := bytes.Compare(m[i].subnet.IP.To16(), m[j].subnet.IP.To16())
+	if addrCmp != 0 {
+		return addrCmp < 0
+	}
+
+	return strings.Compare(m[i].zone, m[j].zone) < 0
+}
+func (m byPrefixlen) Swap(i, j int) { m[i], m[j] = m[j], m[i] }

internal/transport/tcp/serve_tcp_ipmap_test.go

@@ -0,0 +1,202 @@
+package tcp
+
+import (
+	"net"
+	"os"
+	"testing"
+
+	"github.com/kr/pretty"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestIPMap(t *testing.T) {
+	type testCaseExpect struct {
+		expectNoMapping bool
+		expectIdent     string
+	}
+	type testCase struct {
+		name          string
+		config        map[string]string
+		expectInitErr bool
+		expect        map[string]testCaseExpect
+	}
+
+	cases := []testCase{
+		{
+			name:          "regular ips",
+			expectInitErr: false,
+			config: map[string]string{
+				"192.168.123.234": "ident1",
+				"192.168.20.23":   "ident2",
+			},
+			expect: map[string]testCaseExpect{
+				"192.168.123.234": {expectIdent: "ident1"},
+				"192.168.20.23":   {expectIdent: "ident2"},
+				"192.168.20.10":   {expectNoMapping: true},
+			},
+		},
+		{
+			name:          "full wildcard",
+			expectInitErr: false,
+			config: map[string]string{
+				"0.0.0.0/0": "*",
+				"0::/0":     "*",
+			},
+			expect: map[string]testCaseExpect{
+				"10.123.234.24": {expectIdent: "10.123.234.24"},
+				// '[' and ']' are forbiddenin dataset names
+				"fe80::23:42": {expectIdent: "fe80::23:42"},
+			},
+		},
+		{
+			name:          "longest prefix matching",
+			expectInitErr: false,
+			config: map[string]string{
+				"10.1.2.3":              "specific-host",
+				"10.1.2.0/24":           "subnet-one-two-*",
+				"10.1.1.0/24":           "subnet-one-one-*",
+				"10.1.0.0/24":           "subnet-one-zero-*",
+				"10.1.0.0/16":           "subnet-one-*",
+				"fde4:8dba:82e1:1::1":   "v6-48-1-specialhost",
+				"fde4:8dba:82e1::/48":   "v6-48-*",
+				"fde4:8dba:82e1:1::/64": "v6-64-1-*",
+				"fde4:8dba:82e1:2::/64": "v6-64-2-*",
+			},
+			expect: map[string]testCaseExpect{
+				"10.1.2.3":             {expectIdent: "specific-host"},
+				"10.1.2.1":             {expectIdent: "subnet-one-two-10.1.2.1"},
+				"10.1.1.1":             {expectIdent: "subnet-one-one-10.1.1.1"},
+				"10.1.0.23":            {expectIdent: "subnet-one-zero-10.1.0.23"},
+				"10.1.3.1":             {expectIdent: "subnet-one-10.1.3.1"},
+				"10.2.1.1":             {expectNoMapping: true},
+				"fde4:8dba:82e1:1::1":  {expectIdent: "v6-48-1-specialhost"},
+				"fde4:8dba:82e1:23::1": {expectIdent: "v6-48-fde4:8dba:82e1:23::1"},
+				"fde4:8dba:82e1:1::2":  {expectIdent: "v6-64-1-fde4:8dba:82e1:1::2"},
+				"fde4:8dba:82e1:2::1":  {expectIdent: "v6-64-2-fde4:8dba:82e1:2::1"},
+				"fde4:8dba:82e2::1":    {expectNoMapping: true},
+			},
+		},
+		{
+			name:          "different prefixes, mixed ipv4 ipv6, with interface ids",
+			expectInitErr: false,
+			config: map[string]string{
+				"192.168.23.0/24": "db-*",
+				"192.168.23.23":   "db-twentythree",
+				"192.168.42.0/24": "web-*",
+				"10.1.4.0/24":     "my-*-server",
+				"2001:0db8:85a3:0000:0000:8a2e:0370:7334":      "aspecifichost",
+				"2001:0db8:85a3:0000:0000:8a2e:0370:7334%eth1": "aspecifichost",
+				"fe80::/16%eth1":      "san-*",
+				"fde4:8dba:82e1::/64": "sub64-*",
+			},
+			expect: map[string]testCaseExpect{
+				"10.1.2.3":      {expectNoMapping: true},
+				"192.168.23.1":  {expectIdent: "db-192.168.23.1"},
+				"192.168.42.1":  {expectIdent: "web-192.168.42.1"},
+				"192.168.23.23": {expectIdent: "db-twentythree"},
+				"10.1.4.5":      {expectIdent: "my-10.1.4.5-server"},
+
+				// v6 matching
+				"fe80::23:42%eth1": {expectIdent: "san-fe80::23:42-eth1"},
+				"fe80::23:42%eth2": {expectNoMapping: true},
+
+				// v6 subnet matching
+				"fde4:8dba:82e1::1": {expectIdent: "sub64-fde4:8dba:82e1::1"},
+				// v6 subnet matching with suffix that matches another allowed IPv4
+				"fde4:8dba:82e1::c0a8:1717": {expectIdent: "sub64-fde4:8dba:82e1::c0a8:1717"},
+
+				"2001:0db8:85a3:0000:0000:8a2e:0370:7334":      {expectIdent: "aspecifichost"},
+				"2001:0db8:85a3:0000:0000:8a2e:0370:7334%eth1": {expectIdent: "aspecifichost"},
+				"2001:0db8:85a3:0000:0000:8a2e:0370:7334%eth2": {expectNoMapping: true},
+			},
+		},
+		{
+			name:          "invalid user input: non ip or cidr",
+			expectInitErr: true,
+			config: map[string]string{
+				"jimmy": "db",
+			},
+		},
+		{
+			name:          "invalid user input: v4 ip with an identity containing *",
+			expectInitErr: true,
+			config: map[string]string{
+				"192.168.1.2": "db-*",
+			},
+		},
+		{
+			name:          "invalid user input: v4 subnet without an identity containing *",
+			expectInitErr: true,
+			config: map[string]string{
+				"192.168.1.0/24": "db-",
+			},
+		},
+		{
+			name:          "invalid user input: v6 ip with an identity containing *",
+			expectInitErr: true,
+			config: map[string]string{
+				"2001:0db8:85a3:0000:0000:8a2e:0370:7334": "aspecifichost*",
+			},
+		},
+		{
+			name:          "invalid user input: v6 subnet without identity containing *",
+			expectInitErr: true,
+			config: map[string]string{
+				"fe80::/16%eth1": "db-",
+			},
+		},
+		{
+			name:          "invalid user input with subnet match: client identity with forbidden zfs dataset name char @",
+			expectInitErr: true,
+			config: map[string]string{
+				"fe80::/16": "db@-*",
+			},
+		},
+		{
+			name:          "invalid user input with IP match: client identity with forbidden zfs dataset name char @",
+			expectInitErr: true,
+			config: map[string]string{
+				"fe80::1": "db@foo",
+			},
+		},
+	}
+
+	for i := range cases {
+		c := cases[i]
+		t.Run(c.name, func(t *testing.T) {
+			pretty.Fprintf(os.Stderr, "running %#v\n", c)
+			m, err := ipMapFromConfig(c.config)
+			if c.expectInitErr {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+				require.NotNil(t, m)
+			}
+			for input, expect := range c.expect {
+				// reuse newIPMapEntry to parse test case input
+				// "test" is not used during testing but must not be empty.
+				ipMapEntry, err := newIPMapEntry(input, "test")
+				require.NoError(t, err)
+				ones, bits := ipMapEntry.subnet.Mask.Size()
+				require.Equal(t, bits, net.IPv6len*8, "and we know ipMapEntry always expands its IPs to 16bytes")
+				require.Equal(t, ones, net.IPv6len*8, "test case addresses must be fully specified")
+				require.NotNil(t, ipMapEntry)
+				ident, err := m.Get(&net.IPAddr{
+					IP:   ipMapEntry.subnet.IP,
+					Zone: ipMapEntry.zone,
+				})
+				if expect.expectNoMapping {
+					assert.Empty(t, ident)
+				} else {
+					assert.NoError(t, err)
+					assert.Equal(t, expect.expectIdent, ident)
+				}
+			}
+		})
+	}
+}
+
+func TestPackageNetAssumptions(t *testing.T) {
+
+}

internal/transport/tls/connect_tls.go

@@ -0,0 +1,56 @@
+package tls
+
+import (
+	"context"
+	"crypto/tls"
+	"net"
+
+	"github.com/pkg/errors"
+
+	"github.com/zrepl/zrepl/internal/config"
+	"github.com/zrepl/zrepl/internal/tlsconf"
+	"github.com/zrepl/zrepl/internal/transport"
+)
+
+type TLSConnecter struct {
+	Address   string
+	dialer    net.Dialer
+	tlsConfig *tls.Config
+}
+
+func TLSConnecterFromConfig(in *config.TLSConnect, parseFlags config.ParseFlags) (*TLSConnecter, error) {
+	dialer := net.Dialer{
+		Timeout: in.DialTimeout,
+	}
+
+	if parseFlags&config.ParseFlagsNoCertCheck != 0 {
+		return &TLSConnecter{in.Address, dialer, nil}, nil
+	}
+
+	ca, err := tlsconf.ParseCAFile(in.Ca)
+	if err != nil {
+		return nil, errors.Wrap(err, "cannot parse ca file")
+	}
+
+	cert, err := tls.LoadX509KeyPair(in.Cert, in.Key)
+	if err != nil {
+		return nil, errors.Wrap(err, "cannot parse cert/key pair")
+	}
+
+	tlsConfig, err := tlsconf.ClientAuthClient(in.ServerCN, ca, cert)
+	if err != nil {
+		return nil, errors.Wrap(err, "cannot build tls config")
+	}
+
+	return &TLSConnecter{in.Address, dialer, tlsConfig}, nil
+}
+
+func (c *TLSConnecter) Connect(dialCtx context.Context) (transport.Wire, error) {
+	conn, err := c.dialer.DialContext(dialCtx, "tcp", c.Address)
+	if err != nil {
+		return nil, err
+	}
+	tcpConn := conn.(*net.TCPConn)
+	tlsConn := tls.Client(conn, c.tlsConfig)
+	return newWireAdaptor(tlsConn, tcpConn), nil
+}

internal/transport/tls/serve_tls.go

@@ -0,0 +1,94 @@
+package tls
+
+import (
+	"context"
+	"crypto/tls"
+	"fmt"
+	"time"
+
+	"github.com/pkg/errors"
+
+	"github.com/zrepl/zrepl/internal/config"
+	"github.com/zrepl/zrepl/internal/tlsconf"
+	"github.com/zrepl/zrepl/internal/transport"
+	"github.com/zrepl/zrepl/internal/util/tcpsock"
+)
+
+type TLSListenerFactory struct{}
+
+func TLSListenerFactoryFromConfig(c *config.Global, in *config.TLSServe, parseFlags config.ParseFlags) (transport.AuthenticatedListenerFactory, error) {
+
+	address := in.Listen
+	handshakeTimeout := in.HandshakeTimeout
+
+	if in.Ca == "" || in.Cert == "" || in.Key == "" {
+		return nil, errors.New("fields 'ca', 'cert' and 'key'must be specified")
+	}
+
+	if parseFlags&config.ParseFlagsNoCertCheck != 0 {
+		return func() (transport.AuthenticatedListener, error) { return nil, nil }, nil
+	}
+
+	clientCA, err := tlsconf.ParseCAFile(in.Ca)
+	if err != nil {
+		return nil, errors.Wrap(err, "cannot parse ca file")
+	}
+
+	serverCert, err := tls.LoadX509KeyPair(in.Cert, in.Key)
+	if err != nil {
+		return nil, errors.Wrap(err, "cannot parse cert/key pair")
+	}
+
+	clientCNs := make(map[string]struct{}, len(in.ClientCNs))
+	for i, cn := range in.ClientCNs {
+		if err := transport.ValidateClientIdentity(cn); err != nil {
+			return nil, errors.Wrapf(err, "unsuitable client_cn #%d %q", i, cn)
+		}
+		// dupes are ok fr now
+		clientCNs[cn] = struct{}{}
+	}
+
+	lf := func() (transport.AuthenticatedListener, error) {
+		l, err := tcpsock.Listen(address, in.ListenFreeBind)
+		if err != nil {
+			return nil, err
+		}
+		tl := tlsconf.NewClientAuthListener(l, clientCA, serverCert, handshakeTimeout)
+		return &tlsAuthListener{tl, clientCNs}, nil
+	}
+
+	return lf, nil
+}
+
+type tlsAuthListener struct {
+	*tlsconf.ClientAuthListener
+	clientCNs map[string]struct{}
+}
+
+func (l tlsAuthListener) Accept(ctx context.Context) (*transport.AuthConn, error) {
+	tcpConn, tlsConn, cn, err := l.ClientAuthListener.Accept()
+	if err != nil {
+		return nil, err
+	}
+	if _, ok := l.clientCNs[cn]; !ok {
+		log := transport.GetLogger(ctx)
+		if dl, ok := ctx.Deadline(); ok {
+			defer func() {
+				err := tlsConn.SetDeadline(time.Time{})
+				if err != nil {
+					log.WithError(err).Error("cannot clear connection deadline")
+				}
+			}()
+			err := tlsConn.SetDeadline(dl)
+			if err != nil {
+				log.WithError(err).WithField("deadline", dl).Error("cannot set connection deadline inherited from context")
+			}
+		}
+		if err := tlsConn.Close(); err != nil {
+			log.WithError(err).Error("error closing connection with unauthorized common name")
+		}
+		return nil, fmt.Errorf("unauthorized client common name %q from %s", cn, tlsConn.RemoteAddr())
+	}
+	adaptor := newWireAdaptor(tlsConn, tcpConn)
+	return transport.NewAuthConn(adaptor, cn), nil
+}

internal/transport/tls/tls_wire_adaptor.go

@@ -0,0 +1,47 @@
+package tls
+
+import (
+	"crypto/tls"
+	"fmt"
+	"net"
+	"os"
+)
+
+// adapts a tls.Conn and its underlying net.TCPConn into a valid transport.Wire
+type transportWireAdaptor struct {
+	*tls.Conn
+	tcpConn *net.TCPConn
+}
+
+func newWireAdaptor(tlsConn *tls.Conn, tcpConn *net.TCPConn) transportWireAdaptor {
+	return transportWireAdaptor{tlsConn, tcpConn}
+}
+
+// CloseWrite implements transport.Wire.CloseWrite which is different from *tls.Conn.CloseWrite:
+// the former requires that the other side observes io.EOF, but *tls.Conn.CloseWrite does not
+// close the underlying connection so no io.EOF would be observed.
+func (w transportWireAdaptor) CloseWrite() error {
+	if err := w.Conn.CloseWrite(); err != nil {
+		// TODO log error
+		fmt.Fprintf(os.Stderr, "transport/tls.CloseWrite() error: %s\n", err)
+	}
+	return w.tcpConn.CloseWrite()
+}
+
+// Close implements transport.Wire.Close which is different from a *tls.Conn.Close:
+// At the time of writing (Go 1.11), closing tls.Conn closes the TCP connection immediately,
+// which results in io.ErrUnexpectedEOF on the other side.
+// We assume that w.Conn has a deadline set for the close, so the CloseWrite will time out if it blocks,
+// falling through to the actual Close()
+func (w transportWireAdaptor) Close() error {
+	//	var buf [1<<15]byte
+	//	w.Conn.Write(buf[:])
+	// CloseWrite will send a TLS alert record down the line which
+	// in the Go implementation acts like a flush...?
+	//	if err := w.Conn.CloseWrite(); err != nil {
+	//		// TODO log error
+	//		fmt.Fprintf(os.Stderr, "transport/tls.Close() close write error: %s\n", err)
+	//	}
+	//	time.Sleep(1 * time.Second)
+	return w.Conn.Close()
+}

internal/transport/transport.go

@@ -0,0 +1,72 @@
+// Package transport defines a common interface for
+// network connections that have an associated client identity.
+package transport
+
+import (
+	"context"
+	"net"
+	"syscall"
+
+	"github.com/pkg/errors"
+
+	"github.com/zrepl/zrepl/internal/daemon/logging"
+	"github.com/zrepl/zrepl/internal/logger"
+	"github.com/zrepl/zrepl/internal/rpc/dataconn/timeoutconn"
+	"github.com/zrepl/zrepl/internal/zfs"
+)
+
+type AuthConn struct {
+	Wire
+	clientIdentity string
+}
+
+var _ timeoutconn.SyscallConner = AuthConn{}
+
+func (a AuthConn) SyscallConn() (rawConn syscall.RawConn, err error) {
+	scc, ok := a.Wire.(timeoutconn.SyscallConner)
+	if !ok {
+		return nil, timeoutconn.SyscallConnNotSupported
+	}
+	return scc.SyscallConn()
+}
+
+func NewAuthConn(conn Wire, clientIdentity string) *AuthConn {
+	return &AuthConn{conn, clientIdentity}
+}
+
+func (c *AuthConn) ClientIdentity() string {
+	if err := ValidateClientIdentity(c.clientIdentity); err != nil {
+		panic(err)
+	}
+	return c.clientIdentity
+}
+
+// like net.Listener, but with an AuthenticatedConn instead of net.Conn
+type AuthenticatedListener interface {
+	Addr() net.Addr
+	Accept(ctx context.Context) (*AuthConn, error)
+	Close() error
+}
+
+type AuthenticatedListenerFactory func() (AuthenticatedListener, error)
+
+type Wire = timeoutconn.Wire
+
+type Connecter interface {
+	Connect(ctx context.Context) (Wire, error)
+}
+
+// A client identity must be a single component in a ZFS filesystem path
+func ValidateClientIdentity(in string) error {
+	err := zfs.ComponentNamecheck(in)
+	if err != nil {
+		return errors.Wrap(err, "client identity must be usable as a single dataset path component")
+	}
+	return nil
+}
+
+type Logger = logger.Logger
+
+func GetLogger(ctx context.Context) Logger {
+	return logging.GetLogger(ctx, logging.SubsysTransport)
+}