#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
#ifdef AUTOKEY
#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/param.h>
#include <unistd.h>
#include <fcntl.h>
#include "ntpd.h"
#include "ntp_stdlib.h"
#include "ntp_unixtime.h"
#include "ntp_string.h"
#include "ntp_random.h"
#include "ntp_assert.h"
#include "ntp_calendar.h"
#include "ntp_leapsec.h"
#include "openssl/asn1.h"
#include "openssl/bn.h"
#include "openssl/crypto.h"
#include "openssl/err.h"
#include "openssl/evp.h"
#include "openssl/opensslv.h"
#include "openssl/pem.h"
#include "openssl/rand.h"
#include "openssl/x509.h"
#include "openssl/x509v3.h"
#include "libssl_compat.h"
#ifdef KERNEL_PLL
#include "ntp_syscall.h"
#endif
static int calcomp(struct calendar *pjd1, struct calendar *pjd2)
{
int32_t diff;
diff = pjd1->year - pjd2->year;
if (diff < 0) return -1; else if (diff > 0) return 1;
diff = pjd1->month - pjd2->month;
if (diff < 0) return -1; else if (diff > 0) return 1;
diff = pjd1->monthday - pjd2->monthday;
if (diff < 0) return -1; else if (diff > 0) return 1;
diff = pjd1->hour - pjd2->hour;
if (diff < 0) return -1; else if (diff > 0) return 1;
diff = pjd1->minute - pjd2->minute;
if (diff < 0) return -1; else if (diff > 0) return 1;
diff = pjd1->second - pjd2->second;
if (diff < 0) return -1; else if (diff > 0) return 1;
return 0;
}
#define TAI_1972 10
#define MAX_LEAP 100
#define VALUE_LEN (6 * 4)
#define MAX_VALLEN (65535 - VALUE_LEN)
#define YEAR (60 * 60 * 24 * 365)
u_int32 crypto_flags = 0x0;
int crypto_nid = KEY_TYPE_MD5;
char *sys_hostname = NULL;
char *sys_groupname = NULL;
static char *host_filename = NULL;
static char *ident_filename = NULL;
struct cert_info *cinfo = NULL;
struct cert_info *cert_host = NULL;
struct pkey_info *pkinfo = NULL;
struct value hostval;
struct value pubkey;
struct value tai_leap;
struct pkey_info *iffkey_info = NULL;
struct pkey_info *gqkey_info = NULL;
struct pkey_info *mvkey_info = NULL;
static char *passwd = NULL;
static EVP_PKEY *host_pkey = NULL;
static EVP_PKEY *sign_pkey = NULL;
static const EVP_MD *sign_digest = NULL;
static u_int sign_siglen;
static char *rand_file = NULL;
static int crypto_verify (struct exten *, struct value *,
struct peer *);
static int crypto_encrypt (const u_char *, u_int, keyid_t *,
struct value *);
static int crypto_alice (struct peer *, struct value *);
static int crypto_alice2 (struct peer *, struct value *);
static int crypto_alice3 (struct peer *, struct value *);
static int crypto_bob (struct exten *, struct value *);
static int crypto_bob2 (struct exten *, struct value *);
static int crypto_bob3 (struct exten *, struct value *);
static int crypto_iff (struct exten *, struct peer *);
static int crypto_gq (struct exten *, struct peer *);
static int crypto_mv (struct exten *, struct peer *);
static int crypto_send (struct exten *, struct value *, int);
static tstamp_t crypto_time (void);
static void asn_to_calendar (const ASN1_TIME *, struct calendar*);
static struct cert_info *cert_parse (const u_char *, long, tstamp_t);
static int cert_sign (struct exten *, struct value *);
static struct cert_info *cert_install (struct exten *, struct peer *);
static int cert_hike (struct peer *, struct cert_info *);
static void cert_free (struct cert_info *);
static struct pkey_info *crypto_key (char *, char *, sockaddr_u *);
static void bighash (BIGNUM *, BIGNUM *);
static struct cert_info *crypto_cert (char *);
static u_int exten_payload_size(const struct exten *);
#ifdef SYS_WINNT
int
readlink(char * link, char * file, int len) {
return (-1);
}
#endif
keyid_t
session_key(
sockaddr_u *srcadr,
sockaddr_u *dstadr,
keyid_t keyno,
keyid_t private,
u_long lifetime
)
{
EVP_MD_CTX *ctx;
u_char dgst[EVP_MAX_MD_SIZE];
keyid_t keyid;
u_int32 header[10];
u_int hdlen, len;
if (!dstadr)
return 0;
hdlen = 0;
switch(AF(srcadr)) {
case AF_INET:
header[0] = NSRCADR(srcadr);
header[1] = NSRCADR(dstadr);
header[2] = htonl(keyno);
header[3] = htonl(private);
hdlen = 4 * sizeof(u_int32);
break;
case AF_INET6:
memcpy(&header[0], PSOCK_ADDR6(srcadr),
sizeof(struct in6_addr));
memcpy(&header[4], PSOCK_ADDR6(dstadr),
sizeof(struct in6_addr));
header[8] = htonl(keyno);
header[9] = htonl(private);
hdlen = 10 * sizeof(u_int32);
break;
}
ctx = EVP_MD_CTX_new();
EVP_DigestInit(ctx, EVP_get_digestbynid(crypto_nid));
EVP_DigestUpdate(ctx, (u_char *)header, hdlen);
EVP_DigestFinal(ctx, dgst, &len);
EVP_MD_CTX_free(ctx);
memcpy(&keyid, dgst, 4);
keyid = ntohl(keyid);
if (lifetime != 0) {
MD5auth_setkey(keyno, crypto_nid, dgst, len, NULL);
authtrust(keyno, lifetime);
}
DPRINTF(2, ("session_key: %s > %s %08x %08x hash %08x life %lu\n",
stoa(srcadr), stoa(dstadr), keyno,
private, keyid, lifetime));
return (keyid);
}
int
make_keylist(
struct peer *peer,
struct interface *dstadr
)
{
EVP_MD_CTX *ctx;
tstamp_t tstamp;
struct autokey *ap;
struct value *vp;
keyid_t keyid = 0;
keyid_t cookie;
long lifetime;
u_int len, mpoll;
int i;
if (!dstadr)
return XEVNT_ERR;
tstamp = crypto_time();
if (peer->keylist == NULL)
peer->keylist = eallocarray(NTP_MAXSESSION,
sizeof(keyid_t));
while (1) {
keyid = ntp_random() & 0xffffffff;
if (keyid <= NTP_MAXKEY)
continue;
if (authhavekey(keyid))
continue;
break;
}
mpoll = 1 << min(peer->ppoll, peer->hpoll);
lifetime = min(1U << sys_automax, NTP_MAXSESSION * mpoll);
if (peer->hmode == MODE_BROADCAST)
cookie = 0;
else
cookie = peer->pcookie;
for (i = 0; i < NTP_MAXSESSION; i++) {
peer->keylist[i] = keyid;
peer->keynumber = i;
keyid = session_key(&dstadr->sin, &peer->srcadr, keyid,
cookie, lifetime + mpoll);
lifetime -= mpoll;
if (auth_havekey(keyid) || keyid <= NTP_MAXKEY ||
lifetime < 0 || tstamp == 0)
break;
}
vp = &peer->sndval;
if (vp->ptr == NULL)
vp->ptr = emalloc(sizeof(struct autokey));
ap = (struct autokey *)vp->ptr;
ap->seq = htonl(peer->keynumber);
ap->key = htonl(keyid);
vp->tstamp = htonl(tstamp);
vp->fstamp = hostval.tstamp;
vp->vallen = htonl(sizeof(struct autokey));
vp->siglen = 0;
if (tstamp != 0) {
if (vp->sig == NULL)
vp->sig = emalloc(sign_siglen);
ctx = EVP_MD_CTX_new();
EVP_SignInit(ctx, sign_digest);
EVP_SignUpdate(ctx, (u_char *)vp, 12);
EVP_SignUpdate(ctx, vp->ptr, sizeof(struct autokey));
if (EVP_SignFinal(ctx, vp->sig, &len, sign_pkey)) {
INSIST(len <= sign_siglen);
vp->siglen = htonl(len);
peer->flags |= FLAG_ASSOC;
}
EVP_MD_CTX_free(ctx);
}
DPRINTF(1, ("make_keys: %d %08x %08x ts %u fs %u poll %d\n",
peer->keynumber, keyid, cookie, ntohl(vp->tstamp),
ntohl(vp->fstamp), peer->hpoll));
return (XEVNT_OK);
}
int
crypto_recv(
struct peer *peer,
struct recvbuf *rbufp
)
{
const EVP_MD *dp;
u_int32 *pkt;
struct autokey *ap, *bp;
struct exten *ep, *fp;
struct cert_info *xinfo;
int macbytes;
int authlen;
associd_t associd;
tstamp_t fstamp = 0;
u_int len;
u_int code;
u_int vallen = 0;
X509 *cert;
char statstr[NTP_MAXSTRLEN];
keyid_t cookie;
int hismode;
int rval = XEVNT_OK;
const u_char *puch;
u_int32 temp32;
authlen = LEN_PKT_NOMAC;
hismode = (int)PKT_MODE((&rbufp->recv_pkt)->li_vn_mode);
while ((macbytes = rbufp->recv_length - authlen) > (int)MAX_MAC_LEN) {
pkt = (u_int32 *)&rbufp->recv_pkt + authlen / 4;
ep = (struct exten *)pkt;
code = ntohl(ep->opcode) & 0xffff0000;
len = ntohl(ep->opcode) & 0x0000ffff;
associd = (associd_t)ntohl(pkt[1]);
rval = XEVNT_OK;
DPRINTF(1, ("crypto_recv: flags 0x%x ext offset %d len %u code 0x%x associd %d\n",
peer->crypto, authlen, len, code >> 16,
associd));
if (((code >> 24) & 0x3f) != CRYPTO_VN || len < 8) {
sys_badlength++;
code |= CRYPTO_ERROR;
}
if (len > (u_int)macbytes) {
DPRINTF(1, ("crypto_recv: possible attack detected, associd %d\n",
associd));
return XEVNT_LEN;
}
if (len >= VALUE_LEN) {
fstamp = ntohl(ep->fstamp);
vallen = ntohl(ep->vallen);
if ( vallen == 0
|| len - VALUE_LEN < vallen)
return XEVNT_LEN;
}
switch (code) {
case CRYPTO_ASSOC:
if (peer->crypto & CRYPTO_FLAG_CERT) {
rval = XEVNT_ERR;
break;
}
if (peer->cmmd) {
if (peer->assoc != associd) {
rval = XEVNT_ERR;
break;
}
free(peer->cmmd);
}
fp = emalloc(len);
memcpy(fp, ep, len);
fp->associd = htonl(peer->associd);
peer->cmmd = fp;
case CRYPTO_ASSOC | CRYPTO_RESP:
if (peer->crypto) {
if (peer->assoc != associd)
rval = XEVNT_ERR;
break;
}
INSIST(len >= VALUE_LEN);
if (vallen == 0 || vallen > MAXHOSTNAME ||
len - VALUE_LEN < vallen) {
rval = XEVNT_LEN;
break;
}
DPRINTF(1, ("crypto_recv: ident host 0x%x %d server 0x%x %d\n",
crypto_flags, peer->associd, fstamp,
peer->assoc));
temp32 = crypto_flags & CRYPTO_FLAG_MASK;
if (crypto_flags & CRYPTO_FLAG_PRIV) {
if (!(fstamp & CRYPTO_FLAG_PRIV)) {
rval = XEVNT_KEY;
break;
}
fstamp |= CRYPTO_FLAG_CERT |
CRYPTO_FLAG_VRFY | CRYPTO_FLAG_SIGN;
} else if (hismode == MODE_ACTIVE || hismode ==
MODE_PASSIVE) {
if ((temp32 && !(fstamp &
CRYPTO_FLAG_MASK)) ||
(!temp32 && (fstamp &
CRYPTO_FLAG_MASK))) {
rval = XEVNT_KEY;
break;
}
}
temp32 = (fstamp >> 16) & 0xffff;
dp =
(const EVP_MD *)EVP_get_digestbynid(temp32);
if (dp == NULL) {
rval = XEVNT_MD;
break;
}
peer->assoc = associd;
if (hismode == MODE_SERVER)
fstamp |= CRYPTO_FLAG_AUTO;
if (!(fstamp & CRYPTO_FLAG_TAI))
fstamp |= CRYPTO_FLAG_LEAP;
RAND_bytes((u_char *)&peer->hcookie, 4);
peer->crypto = fstamp;
peer->digest = dp;
if (peer->subject != NULL)
free(peer->subject);
peer->subject = emalloc(vallen + 1);
memcpy(peer->subject, ep->pkt, vallen);
peer->subject[vallen] = '\0';
if (peer->issuer != NULL)
free(peer->issuer);
peer->issuer = estrdup(peer->subject);
snprintf(statstr, sizeof(statstr),
"assoc %d %d host %s %s", peer->associd,
peer->assoc, peer->subject,
OBJ_nid2ln(temp32));
record_crypto_stats(&peer->srcadr, statstr);
DPRINTF(1, ("crypto_recv: %s\n", statstr));
break;
case CRYPTO_CERT | CRYPTO_RESP:
if (len < VALUE_LEN)
break;
if ((rval = crypto_verify(ep, NULL, peer)) !=
XEVNT_OK)
break;
if ((xinfo = cert_install(ep, peer)) == NULL) {
rval = XEVNT_CRT;
break;
}
if ((rval = cert_hike(peer, xinfo)) != XEVNT_OK)
break;
if (peer->pkey == NULL) {
puch = xinfo->cert.ptr;
cert = d2i_X509(NULL, &puch,
ntohl(xinfo->cert.vallen));
peer->pkey = X509_get_pubkey(cert);
X509_free(cert);
}
peer->flash &= ~TEST8;
temp32 = xinfo->nid;
snprintf(statstr, sizeof(statstr),
"cert %s %s 0x%x %s (%u) fs %u",
xinfo->subject, xinfo->issuer, xinfo->flags,
OBJ_nid2ln(temp32), temp32,
ntohl(ep->fstamp));
record_crypto_stats(&peer->srcadr, statstr);
DPRINTF(1, ("crypto_recv: %s\n", statstr));
break;
case CRYPTO_IFF | CRYPTO_RESP:
if ((rval = crypto_verify(ep, NULL, peer)) !=
XEVNT_OK)
break;
if ((rval = crypto_iff(ep, peer)) != XEVNT_OK)
break;
peer->crypto |= CRYPTO_FLAG_VRFY;
peer->flash &= ~TEST8;
snprintf(statstr, sizeof(statstr), "iff %s fs %u",
peer->issuer, ntohl(ep->fstamp));
record_crypto_stats(&peer->srcadr, statstr);
DPRINTF(1, ("crypto_recv: %s\n", statstr));
break;
case CRYPTO_GQ | CRYPTO_RESP:
if ((rval = crypto_verify(ep, NULL, peer)) !=
XEVNT_OK)
break;
if ((rval = crypto_gq(ep, peer)) != XEVNT_OK)
break;
peer->crypto |= CRYPTO_FLAG_VRFY;
peer->flash &= ~TEST8;
snprintf(statstr, sizeof(statstr), "gq %s fs %u",
peer->issuer, ntohl(ep->fstamp));
record_crypto_stats(&peer->srcadr, statstr);
DPRINTF(1, ("crypto_recv: %s\n", statstr));
break;
case CRYPTO_MV | CRYPTO_RESP:
if ((rval = crypto_verify(ep, NULL, peer)) !=
XEVNT_OK)
break;
if ((rval = crypto_mv(ep, peer)) != XEVNT_OK)
break;
peer->crypto |= CRYPTO_FLAG_VRFY;
peer->flash &= ~TEST8;
snprintf(statstr, sizeof(statstr), "mv %s fs %u",
peer->issuer, ntohl(ep->fstamp));
record_crypto_stats(&peer->srcadr, statstr);
DPRINTF(1, ("crypto_recv: %s\n", statstr));
break;
case CRYPTO_COOK | CRYPTO_RESP:
if ((rval = crypto_verify(ep, &peer->cookval,
peer)) != XEVNT_OK)
break;
if (vallen == (u_int)EVP_PKEY_size(host_pkey)) {
RSA *rsa = EVP_PKEY_get0_RSA(host_pkey);
u_int32 *cookiebuf = malloc(RSA_size(rsa));
if (!cookiebuf) {
rval = XEVNT_CKY;
break;
}
if (RSA_private_decrypt(vallen,
(u_char *)ep->pkt,
(u_char *)cookiebuf,
rsa,
RSA_PKCS1_OAEP_PADDING) != 4) {
rval = XEVNT_CKY;
free(cookiebuf);
break;
} else {
cookie = ntohl(*cookiebuf);
free(cookiebuf);
}
} else {
rval = XEVNT_CKY;
break;
}
key_expire(peer);
if (hismode == MODE_ACTIVE || hismode ==
MODE_PASSIVE)
peer->pcookie = peer->hcookie ^ cookie;
else
peer->pcookie = cookie;
peer->crypto |= CRYPTO_FLAG_COOK;
peer->flash &= ~TEST8;
snprintf(statstr, sizeof(statstr),
"cook %x ts %u fs %u", peer->pcookie,
ntohl(ep->tstamp), ntohl(ep->fstamp));
record_crypto_stats(&peer->srcadr, statstr);
DPRINTF(1, ("crypto_recv: %s\n", statstr));
break;
case CRYPTO_AUTO | CRYPTO_RESP:
if ((rval = crypto_verify(ep, &peer->recval,
peer)) != XEVNT_OK)
break;
if ((peer->cast_flags & MDF_BCLNT) &&
peer->assoc != associd)
break;
if (ep->tstamp == 0)
break;
if (peer->recval.ptr == NULL)
peer->recval.ptr =
emalloc(sizeof(struct autokey));
bp = (struct autokey *)peer->recval.ptr;
peer->recval.tstamp = ep->tstamp;
peer->recval.fstamp = ep->fstamp;
ap = (struct autokey *)ep->pkt;
bp->seq = ntohl(ap->seq);
bp->key = ntohl(ap->key);
peer->pkeyid = bp->key;
peer->crypto |= CRYPTO_FLAG_AUTO;
peer->flash &= ~TEST8;
snprintf(statstr, sizeof(statstr),
"auto seq %d key %x ts %u fs %u", bp->seq,
bp->key, ntohl(ep->tstamp),
ntohl(ep->fstamp));
record_crypto_stats(&peer->srcadr, statstr);
DPRINTF(1, ("crypto_recv: %s\n", statstr));
break;
case CRYPTO_SIGN | CRYPTO_RESP:
if ((rval = crypto_verify(ep, NULL, peer)) !=
XEVNT_OK)
break;
if ((xinfo = cert_install(ep, peer)) == NULL) {
rval = XEVNT_CRT;
break;
}
peer->crypto |= CRYPTO_FLAG_SIGN;
peer->flash &= ~TEST8;
temp32 = xinfo->nid;
snprintf(statstr, sizeof(statstr),
"sign %s %s 0x%x %s (%u) fs %u",
xinfo->subject, xinfo->issuer, xinfo->flags,
OBJ_nid2ln(temp32), temp32,
ntohl(ep->fstamp));
record_crypto_stats(&peer->srcadr, statstr);
DPRINTF(1, ("crypto_recv: %s\n", statstr));
break;
case CRYPTO_LEAP | CRYPTO_RESP:
rval = crypto_verify(ep, NULL, peer);
if ((rval != XEVNT_OK ) ||
(vallen != 3*sizeof(uint32_t)) )
break;
if (sys_leap != LEAP_NOTINSYNC)
leapsec_autokey_tai(ntohl(ep->pkt[0]),
rbufp->recv_time.l_ui, NULL);
tai_leap.tstamp = ep->tstamp;
tai_leap.fstamp = ep->fstamp;
crypto_update();
mprintf_event(EVNT_TAI, peer,
"%d seconds", ntohl(ep->pkt[0]));
peer->crypto |= CRYPTO_FLAG_LEAP;
peer->flash &= ~TEST8;
snprintf(statstr, sizeof(statstr),
"leap TAI offset %d at %u expire %u fs %u",
ntohl(ep->pkt[0]), ntohl(ep->pkt[1]),
ntohl(ep->pkt[2]), ntohl(ep->fstamp));
record_crypto_stats(&peer->srcadr, statstr);
DPRINTF(1, ("crypto_recv: %s\n", statstr));
break;
case CRYPTO_CERT:
case CRYPTO_IFF:
case CRYPTO_GQ:
case CRYPTO_MV:
case CRYPTO_COOK:
case CRYPTO_SIGN:
if (len < VALUE_LEN) {
rval = XEVNT_LEN;
break;
}
default:
if (code & (CRYPTO_RESP | CRYPTO_ERROR)) {
rval = XEVNT_ERR;
} else if (peer->cmmd == NULL) {
fp = emalloc(len);
memcpy(fp, ep, len);
peer->cmmd = fp;
}
}
if (rval != XEVNT_OK) {
snprintf(statstr, sizeof(statstr),
"%04x %d %02x %s", htonl(ep->opcode),
associd, rval, eventstr(rval));
record_crypto_stats(&peer->srcadr, statstr);
DPRINTF(1, ("crypto_recv: %s\n", statstr));
return (rval);
}
authlen += (len + 3) / 4 * 4;
}
return (rval);
}
int
crypto_xmit(
struct peer *peer,
struct pkt *xpkt,
struct recvbuf *rbufp,
int start,
struct exten *ep,
keyid_t cookie
)
{
struct exten *fp;
struct cert_info *cp, *xp, *yp;
sockaddr_u *srcadr_sin;
u_int32 *pkt;
u_int opcode;
char certname[MAXHOSTNAME + 1];
char statstr[NTP_MAXSTRLEN];
tstamp_t tstamp;
struct calendar tscal;
u_int vallen;
struct value vtemp;
associd_t associd;
int rval;
int len;
keyid_t tcookie;
pkt = (u_int32 *)xpkt + start / 4;
fp = (struct exten *)pkt;
opcode = ntohl(ep->opcode);
if (peer != NULL) {
srcadr_sin = &peer->srcadr;
if (!(opcode & CRYPTO_RESP))
peer->opcode = ep->opcode;
} else {
srcadr_sin = &rbufp->recv_srcadr;
}
associd = (associd_t) ntohl(ep->associd);
len = 8;
fp->opcode = htonl((opcode & 0xffff0000) | len);
fp->associd = ep->associd;
rval = XEVNT_OK;
tstamp = crypto_time();
switch (opcode & 0xffff0000) {
case CRYPTO_ASSOC:
case CRYPTO_ASSOC | CRYPTO_RESP:
len = crypto_send(fp, &hostval, start);
fp->fstamp = htonl(crypto_flags);
break;
case CRYPTO_CERT:
memset(&vtemp, 0, sizeof(vtemp));
vtemp.tstamp = ep->tstamp;
vtemp.fstamp = ep->fstamp;
vtemp.vallen = ep->vallen;
vtemp.ptr = (u_char *)ep->pkt;
len = crypto_send(fp, &vtemp, start);
break;
case CRYPTO_SIGN:
(void)ntpcal_ntp_to_date(&tscal, tstamp, NULL);
if ((calcomp(&tscal, &(cert_host->first)) < 0)
|| (calcomp(&tscal, &(cert_host->last)) > 0))
rval = XEVNT_PER;
else
len = crypto_send(fp, &cert_host->cert, start);
break;
case CRYPTO_CERT | CRYPTO_RESP:
vallen = exten_payload_size(ep);
if (vallen == 0 || vallen >= sizeof(certname) ) {
rval = XEVNT_LEN;
break;
}
memcpy(certname, ep->pkt, vallen);
certname[vallen] = '\0';
xp = yp = NULL;
for (cp = cinfo; cp != NULL; cp = cp->link) {
if (cp->flags & (CERT_PRIV | CERT_ERROR))
continue;
if (strcmp(certname, cp->subject) != 0)
continue;
if (strcmp(certname, cp->issuer) != 0)
yp = cp;
else if (cp ->flags & CERT_TRUST)
xp = cp;
continue;
}
if (xp == NULL)
xp = yp;
if (xp == NULL)
break;
if (tstamp == 0)
break;
len = crypto_send(fp, &xp->cert, start);
break;
case CRYPTO_IFF:
if (peer == NULL)
break;
if ((rval = crypto_alice(peer, &vtemp)) == XEVNT_OK) {
len = crypto_send(fp, &vtemp, start);
value_free(&vtemp);
}
break;
case CRYPTO_IFF | CRYPTO_RESP:
if ((rval = crypto_bob(ep, &vtemp)) == XEVNT_OK) {
len = crypto_send(fp, &vtemp, start);
value_free(&vtemp);
}
break;
case CRYPTO_GQ:
if (peer == NULL)
break;
if ((rval = crypto_alice2(peer, &vtemp)) == XEVNT_OK) {
len = crypto_send(fp, &vtemp, start);
value_free(&vtemp);
}
break;
case CRYPTO_GQ | CRYPTO_RESP:
if ((rval = crypto_bob2(ep, &vtemp)) == XEVNT_OK) {
len = crypto_send(fp, &vtemp, start);
value_free(&vtemp);
}
break;
case CRYPTO_MV:
if (peer == NULL)
break;
if ((rval = crypto_alice3(peer, &vtemp)) == XEVNT_OK) {
len = crypto_send(fp, &vtemp, start);
value_free(&vtemp);
}
break;
case CRYPTO_MV | CRYPTO_RESP:
if ((rval = crypto_bob3(ep, &vtemp)) == XEVNT_OK) {
len = crypto_send(fp, &vtemp, start);
value_free(&vtemp);
}
break;
case CRYPTO_SIGN | CRYPTO_RESP:
if ((rval = cert_sign(ep, &vtemp)) == XEVNT_OK) {
len = crypto_send(fp, &vtemp, start);
value_free(&vtemp);
}
break;
case CRYPTO_COOK:
len = crypto_send(fp, &pubkey, start);
break;
case CRYPTO_COOK | CRYPTO_RESP:
vallen = ntohl(ep->vallen);
if ( vallen == 0
|| (vallen >= MAX_VALLEN)
|| (opcode & 0x0000ffff) < VALUE_LEN + vallen) {
rval = XEVNT_LEN;
break;
}
if (peer == NULL)
tcookie = cookie;
else
tcookie = peer->hcookie;
if ((rval = crypto_encrypt((const u_char *)ep->pkt, vallen, &tcookie, &vtemp))
== XEVNT_OK) {
len = crypto_send(fp, &vtemp, start);
value_free(&vtemp);
}
break;
case CRYPTO_AUTO | CRYPTO_RESP:
if (peer == NULL) {
if ((peer = findpeerbyassoc(associd)) == NULL) {
rval = XEVNT_ERR;
break;
}
}
peer->flags &= ~FLAG_ASSOC;
len = crypto_send(fp, &peer->sndval, start);
break;
case CRYPTO_LEAP | CRYPTO_RESP:
len = crypto_send(fp, &tai_leap, start);
break;
default:
if (opcode & CRYPTO_RESP)
rval = XEVNT_ERR;
}
if (rval != XEVNT_OK) {
u_int32 uint32;
uint32 = CRYPTO_ERROR;
opcode |= uint32;
fp->opcode |= htonl(uint32);
snprintf(statstr, sizeof(statstr),
"%04x %d %02x %s", opcode, associd, rval,
eventstr(rval));
record_crypto_stats(srcadr_sin, statstr);
DPRINTF(1, ("crypto_xmit: %s\n", statstr));
if (!(opcode & CRYPTO_RESP))
return (0);
}
DPRINTF(1, ("crypto_xmit: flags 0x%x offset %d len %d code 0x%x associd %d\n",
crypto_flags, start, len, opcode >> 16, associd));
return (len);
}
static int
crypto_verify(
struct exten *ep,
struct value *vp,
struct peer *peer
)
{
EVP_PKEY *pkey;
EVP_MD_CTX *ctx;
tstamp_t tstamp, tstamp1 = 0;
tstamp_t fstamp, fstamp1 = 0;
u_int vallen;
u_int siglen;
u_int opcode, len;
int i;
len = ntohl(ep->opcode) & 0x0000ffff;
opcode = ntohl(ep->opcode) & 0xffff0000;
if (opcode & CRYPTO_ERROR)
return (XEVNT_ERR);
if (len < VALUE_LEN)
return (XEVNT_LEN);
if (opcode == (CRYPTO_AUTO | CRYPTO_RESP) && (peer->pmode ==
MODE_BROADCAST || (peer->cast_flags & MDF_BCLNT))) {
if (ntohl(ep->associd) != peer->assoc)
return (XEVNT_ERR);
} else {
if (ntohl(ep->associd) != peer->associd)
return (XEVNT_ERR);
}
vallen = ntohl(ep->vallen);
if ( vallen == 0
|| vallen > MAX_VALLEN)
return (XEVNT_LEN);
i = (vallen + 3) / 4;
siglen = ntohl(ep->pkt[i++]);
if ( siglen > MAX_VALLEN
|| len - VALUE_LEN < ((vallen + 3) / 4) * 4
|| len - VALUE_LEN - ((vallen + 3) / 4) * 4
< ((siglen + 3) / 4) * 4)
return (XEVNT_LEN);
tstamp = ntohl(ep->tstamp);
fstamp = ntohl(ep->fstamp);
if (tstamp == 0)
return (XEVNT_TSP);
if (tstamp < fstamp)
return (XEVNT_TSP);
if (vp != NULL) {
tstamp1 = ntohl(vp->tstamp);
fstamp1 = ntohl(vp->fstamp);
if (tstamp1 != 0 && fstamp1 != 0) {
if (tstamp < tstamp1)
return (XEVNT_TSP);
if ((tstamp < fstamp1 || fstamp < fstamp1))
return (XEVNT_FSP);
}
}
if (opcode == (CRYPTO_CERT | CRYPTO_RESP))
return (XEVNT_OK);
if (crypto_flags & peer->crypto & CRYPTO_FLAG_PRIV)
pkey = sign_pkey;
else
pkey = peer->pkey;
if (siglen == 0 || pkey == NULL || peer->digest == NULL)
return (XEVNT_ERR);
if (siglen != (u_int)EVP_PKEY_size(pkey))
return (XEVNT_SGL);
ctx = EVP_MD_CTX_new();
EVP_VerifyInit(ctx, peer->digest);
EVP_VerifyUpdate(ctx, (u_char *)&ep->tstamp, vallen + 12);
if (EVP_VerifyFinal(ctx, (u_char *)&ep->pkt[i], siglen,
pkey) <= 0) {
EVP_MD_CTX_free(ctx);
return (XEVNT_SIG);
}
EVP_MD_CTX_free(ctx);
if (peer->crypto & CRYPTO_FLAG_VRFY)
peer->crypto |= CRYPTO_FLAG_PROV;
return (XEVNT_OK);
}
static int
crypto_encrypt(
const u_char *ptr,
u_int vallen,
keyid_t *cookie,
struct value *vp
)
{
EVP_PKEY *pkey;
EVP_MD_CTX *ctx;
tstamp_t tstamp;
u_int32 temp32;
u_char *puch;
pkey = d2i_PublicKey(EVP_PKEY_RSA, NULL, &ptr, vallen);
if (pkey == NULL) {
msyslog(LOG_ERR, "crypto_encrypt: %s",
ERR_error_string(ERR_get_error(), NULL));
return (XEVNT_PUB);
}
memset(vp, 0, sizeof(struct value));
tstamp = crypto_time();
vp->tstamp = htonl(tstamp);
vp->fstamp = hostval.tstamp;
vallen = EVP_PKEY_size(pkey);
vp->vallen = htonl(vallen);
vp->ptr = emalloc(vallen);
puch = vp->ptr;
temp32 = htonl(*cookie);
if (RSA_public_encrypt(4, (u_char *)&temp32, puch,
EVP_PKEY_get0_RSA(pkey), RSA_PKCS1_OAEP_PADDING) <= 0) {
msyslog(LOG_ERR, "crypto_encrypt: %s",
ERR_error_string(ERR_get_error(), NULL));
free(vp->ptr);
EVP_PKEY_free(pkey);
return (XEVNT_CKY);
}
EVP_PKEY_free(pkey);
if (tstamp == 0)
return (XEVNT_OK);
vp->sig = emalloc(sign_siglen);
ctx = EVP_MD_CTX_new();
EVP_SignInit(ctx, sign_digest);
EVP_SignUpdate(ctx, (u_char *)&vp->tstamp, 12);
EVP_SignUpdate(ctx, vp->ptr, vallen);
if (EVP_SignFinal(ctx, vp->sig, &vallen, sign_pkey)) {
INSIST(vallen <= sign_siglen);
vp->siglen = htonl(vallen);
}
EVP_MD_CTX_free(ctx);
return (XEVNT_OK);
}
u_int
crypto_ident(
struct peer *peer
)
{
char filename[MAXFILENAME];
const char * scheme_name;
u_int scheme_id;
scheme_name = NULL;
if (peer->crypto & CRYPTO_FLAG_IFF) {
scheme_name = "iff";
scheme_id = CRYPTO_IFF;
} else if (peer->crypto & CRYPTO_FLAG_GQ) {
scheme_name = "gq";
scheme_id = CRYPTO_GQ;
} else if (peer->crypto & CRYPTO_FLAG_MV) {
scheme_name = "mv";
scheme_id = CRYPTO_MV;
}
if (scheme_name != NULL) {
snprintf(filename, sizeof(filename), "ntpkey_%spar_%s",
scheme_name, peer->ident);
peer->ident_pkey = crypto_key(filename, NULL,
&peer->srcadr);
if (peer->ident_pkey != NULL)
return scheme_id;
}
msyslog(LOG_NOTICE,
"crypto_ident: no identity parameters found for group %s",
peer->ident);
return CRYPTO_NULL;
}
struct exten *
crypto_args(
struct peer *peer,
u_int opcode,
associd_t associd,
char *str
)
{
tstamp_t tstamp;
struct exten *ep;
u_int len;
size_t slen = 0;
tstamp = crypto_time();
len = sizeof(struct exten);
if (str != NULL) {
slen = strlen(str);
INSIST(slen < MAX_VALLEN);
len += slen;
}
ep = emalloc_zero(len);
if (opcode == 0)
return (ep);
REQUIRE(0 == (len & ~0x0000ffff));
REQUIRE(0 == (opcode & ~0xffff0000));
ep->opcode = htonl(opcode + len);
ep->associd = htonl(associd);
ep->tstamp = htonl(tstamp);
ep->fstamp = hostval.tstamp;
ep->vallen = 0;
if (str != NULL) {
ep->vallen = htonl(slen);
memcpy((char *)ep->pkt, str, slen);
}
return (ep);
}
int
crypto_send(
struct exten *ep,
struct value *vp,
int start
)
{
u_int len, vallen, siglen, opcode;
u_int i, j;
len = 16;
vallen = ntohl(vp->vallen);
INSIST(vallen <= MAX_VALLEN);
len += ((vallen + 3) / 4 + 1) * 4;
siglen = ntohl(vp->siglen);
len += ((siglen + 3) / 4 + 1) * 4;
if (start + len > sizeof(struct pkt) - MAX_MAC_LEN)
return (0);
ep->tstamp = vp->tstamp;
ep->fstamp = vp->fstamp;
ep->vallen = vp->vallen;
i = 0;
if (vallen > 0 && vp->ptr != NULL) {
j = vallen / 4;
if (j * 4 < vallen)
ep->pkt[i + j++] = 0;
memcpy(&ep->pkt[i], vp->ptr, vallen);
i += j;
}
ep->pkt[i++] = vp->siglen;
if (siglen > 0 && vp->sig != NULL) {
j = siglen / 4;
if (j * 4 < siglen)
ep->pkt[i + j++] = 0;
memcpy(&ep->pkt[i], vp->sig, siglen);
}
opcode = ntohl(ep->opcode);
ep->opcode = htonl((opcode & 0xffff0000) | len);
ENSURE(len <= MAX_VALLEN);
return (len);
}
void
crypto_update(void)
{
EVP_MD_CTX *ctx;
struct cert_info *cp;
char statstr[NTP_MAXSTRLEN];
u_int32 *ptr;
u_int len;
leap_result_t leap_data;
hostval.tstamp = htonl(crypto_time());
if (hostval.tstamp == 0)
return;
ctx = EVP_MD_CTX_new();
if (pubkey.vallen != 0) {
pubkey.tstamp = hostval.tstamp;
pubkey.siglen = 0;
if (pubkey.sig == NULL)
pubkey.sig = emalloc(sign_siglen);
EVP_SignInit(ctx, sign_digest);
EVP_SignUpdate(ctx, (u_char *)&pubkey, 12);
EVP_SignUpdate(ctx, pubkey.ptr, ntohl(pubkey.vallen));
if (EVP_SignFinal(ctx, pubkey.sig, &len, sign_pkey)) {
INSIST(len <= sign_siglen);
pubkey.siglen = htonl(len);
}
}
for (cp = cinfo; cp != NULL; cp = cp->link) {
cp->cert.tstamp = hostval.tstamp;
cp->cert.siglen = 0;
if (cp->cert.sig == NULL)
cp->cert.sig = emalloc(sign_siglen);
EVP_SignInit(ctx, sign_digest);
EVP_SignUpdate(ctx, (u_char *)&cp->cert, 12);
EVP_SignUpdate(ctx, cp->cert.ptr,
ntohl(cp->cert.vallen));
if (EVP_SignFinal(ctx, cp->cert.sig, &len, sign_pkey)) {
INSIST(len <= sign_siglen);
cp->cert.siglen = htonl(len);
}
}
tai_leap.tstamp = hostval.tstamp;
tai_leap.fstamp = hostval.fstamp;
leapsec_frame(&leap_data);
if ( ! memcmp(&leap_data.ebase, &leap_data.ttime, sizeof(vint64))) {
time_t now = time(NULL);
uint32_t nowntp = (uint32_t)now + JAN_1970;
leapsec_query(&leap_data, nowntp, &now);
}
len = 3 * sizeof(u_int32);
if (tai_leap.ptr == NULL || ntohl(tai_leap.vallen) != len) {
free(tai_leap.ptr);
tai_leap.ptr = emalloc(len);
tai_leap.vallen = htonl(len);
}
ptr = (u_int32 *)tai_leap.ptr;
if (leap_data.tai_offs > 10) {
ptr[0] = htonl(leap_data.tai_offs);
ptr[1] = htonl(leap_data.ebase.d_s.lo);
if (leap_data.ttime.d_s.hi >= 0)
ptr[2] = htonl(leap_data.ttime.D_s.lo + 7*86400);
else
ptr[2] = htonl(leap_data.ebase.D_s.lo + 25*86400);
} else {
memset(ptr, 0, len);
}
if (tai_leap.sig == NULL)
tai_leap.sig = emalloc(sign_siglen);
EVP_SignInit(ctx, sign_digest);
EVP_SignUpdate(ctx, (u_char *)&tai_leap, 12);
EVP_SignUpdate(ctx, tai_leap.ptr, len);
if (EVP_SignFinal(ctx, tai_leap.sig, &len, sign_pkey)) {
INSIST(len <= sign_siglen);
tai_leap.siglen = htonl(len);
}
crypto_flags |= CRYPTO_FLAG_TAI;
snprintf(statstr, sizeof(statstr), "signature update ts %u",
ntohl(hostval.tstamp));
record_crypto_stats(NULL, statstr);
DPRINTF(1, ("crypto_update: %s\n", statstr));
EVP_MD_CTX_free(ctx);
}
void
crypto_update_taichange(void)
{
static const u_int len = 3 * sizeof(u_int32);
if (sign_digest == NULL || sign_pkey == NULL)
return;
if (tai_leap.ptr == NULL || ntohl(tai_leap.vallen) != len)
return;
crypto_update();
}
void
value_free(
struct value *vp
)
{
if (vp->ptr != NULL)
free(vp->ptr);
if (vp->sig != NULL)
free(vp->sig);
memset(vp, 0, sizeof(struct value));
}
tstamp_t
crypto_time()
{
l_fp tstamp;
L_CLR(&tstamp);
if (sys_leap != LEAP_NOTINSYNC)
get_systime(&tstamp);
return (tstamp.l_ui);
}
static
void
asn_to_calendar (
const ASN1_TIME *asn1time,
struct calendar *pjd
)
{
size_t len;
char v[24];
unsigned long temp;
len = asn1time->length;
REQUIRE(len < sizeof(v));
(void)strncpy(v, (char *)(asn1time->data), len);
REQUIRE(len >= 13);
temp = strtoul(v+len-3, NULL, 10);
pjd->second = temp;
v[len-3] = '\0';
temp = strtoul(v+len-5, NULL, 10);
pjd->minute = temp;
v[len-5] = '\0';
temp = strtoul(v+len-7, NULL, 10);
pjd->hour = temp;
v[len-7] = '\0';
temp = strtoul(v+len-9, NULL, 10);
pjd->monthday = temp;
v[len-9] = '\0';
temp = strtoul(v+len-11, NULL, 10);
pjd->month = temp;
v[len-11] = '\0';
temp = strtoul(v, NULL, 10);
if (temp < 50UL)
temp += 100UL;
if (temp < 150UL)
temp += 1900UL;
pjd->year = temp;
pjd->yearday = pjd->weekday = 0;
return;
}
static void
bighash(
BIGNUM *bn,
BIGNUM *bk
)
{
EVP_MD_CTX *ctx;
u_char dgst[EVP_MAX_MD_SIZE];
u_char *ptr;
u_int len;
len = BN_num_bytes(bn);
ptr = emalloc(len);
BN_bn2bin(bn, ptr);
ctx = EVP_MD_CTX_new();
EVP_DigestInit(ctx, EVP_md5());
EVP_DigestUpdate(ctx, ptr, len);
EVP_DigestFinal(ctx, dgst, &len);
EVP_MD_CTX_free(ctx);
BN_bin2bn(dgst, len, bk);
free(ptr);
}
static int
crypto_alice(
struct peer *peer,
struct value *vp
)
{
DSA *dsa;
BN_CTX *bctx;
EVP_MD_CTX *ctx;
tstamp_t tstamp;
u_int len;
const BIGNUM *q;
if (peer->ident_pkey == NULL) {
msyslog(LOG_NOTICE, "crypto_alice: scheme unavailable");
return (XEVNT_ID);
}
if ((dsa = EVP_PKEY_get0_DSA(peer->ident_pkey->pkey)) == NULL) {
msyslog(LOG_NOTICE, "crypto_alice: defective key");
return (XEVNT_PUB);
}
if (peer->iffval != NULL)
BN_free(peer->iffval);
peer->iffval = BN_new();
DSA_get0_pqg(dsa, NULL, &q, NULL);
len = BN_num_bytes(q);
BN_rand(peer->iffval, len * 8, -1, 1);
bctx = BN_CTX_new();
BN_mod(peer->iffval, peer->iffval, q, bctx);
BN_CTX_free(bctx);
memset(vp, 0, sizeof(struct value));
tstamp = crypto_time();
vp->tstamp = htonl(tstamp);
vp->fstamp = htonl(peer->ident_pkey->fstamp);
vp->vallen = htonl(len);
vp->ptr = emalloc(len);
BN_bn2bin(peer->iffval, vp->ptr);
if (tstamp == 0)
return (XEVNT_OK);
vp->sig = emalloc(sign_siglen);
ctx = EVP_MD_CTX_new();
EVP_SignInit(ctx, sign_digest);
EVP_SignUpdate(ctx, (u_char *)&vp->tstamp, 12);
EVP_SignUpdate(ctx, vp->ptr, len);
if (EVP_SignFinal(ctx, vp->sig, &len, sign_pkey)) {
INSIST(len <= sign_siglen);
vp->siglen = htonl(len);
}
EVP_MD_CTX_free(ctx);
return (XEVNT_OK);
}
static int
crypto_bob(
struct exten *ep,
struct value *vp
)
{
DSA *dsa;
DSA_SIG *sdsa;
BN_CTX *bctx;
EVP_MD_CTX *ctx;
tstamp_t tstamp;
BIGNUM *bn, *bk, *r;
u_char *ptr;
u_int len;
const BIGNUM *p, *q, *g;
const BIGNUM *priv_key;
if (iffkey_info == NULL) {
msyslog(LOG_NOTICE, "crypto_bob: scheme unavailable");
return (XEVNT_ID);
}
dsa = EVP_PKEY_get0_DSA(iffkey_info->pkey);
DSA_get0_pqg(dsa, &p, &q, &g);
DSA_get0_key(dsa, NULL, &priv_key);
len = exten_payload_size(ep);
if (len == 0 || len > MAX_VALLEN)
return (XEVNT_LEN);
if ((r = BN_bin2bn((u_char *)ep->pkt, len, NULL)) == NULL) {
msyslog(LOG_ERR, "crypto_bob: %s",
ERR_error_string(ERR_get_error(), NULL));
return (XEVNT_ERR);
}
bctx = BN_CTX_new(); bk = BN_new(); bn = BN_new();
sdsa = DSA_SIG_new();
BN_rand(bk, len * 8, -1, 1);
BN_mod_mul(bn, priv_key, r, q, bctx);
BN_add(bn, bn, bk);
BN_mod(bn, bn, q, bctx);
BN_mod_exp(bk, g, bk, p, bctx);
bighash(bk, bk);
DSA_SIG_set0(sdsa, bn, bk);
BN_CTX_free(bctx);
BN_free(r);
#ifdef DEBUG
if (debug > 1)
DSA_print_fp(stdout, dsa, 0);
#endif
len = i2d_DSA_SIG(sdsa, NULL);
if (len == 0) {
msyslog(LOG_ERR, "crypto_bob: %s",
ERR_error_string(ERR_get_error(), NULL));
DSA_SIG_free(sdsa);
return (XEVNT_ERR);
}
if (len > MAX_VALLEN) {
msyslog(LOG_ERR, "crypto_bob: signature is too big: %u",
len);
DSA_SIG_free(sdsa);
return (XEVNT_LEN);
}
memset(vp, 0, sizeof(struct value));
tstamp = crypto_time();
vp->tstamp = htonl(tstamp);
vp->fstamp = htonl(iffkey_info->fstamp);
vp->vallen = htonl(len);
ptr = emalloc(len);
vp->ptr = ptr;
i2d_DSA_SIG(sdsa, &ptr);
DSA_SIG_free(sdsa);
if (tstamp == 0)
return (XEVNT_OK);
vp->sig = emalloc(sign_siglen);
ctx = EVP_MD_CTX_new();
EVP_SignInit(ctx, sign_digest);
EVP_SignUpdate(ctx, (u_char *)&vp->tstamp, 12);
EVP_SignUpdate(ctx, vp->ptr, len);
if (EVP_SignFinal(ctx, vp->sig, &len, sign_pkey)) {
INSIST(len <= sign_siglen);
vp->siglen = htonl(len);
}
EVP_MD_CTX_free(ctx);
return (XEVNT_OK);
}
int
crypto_iff(
struct exten *ep,
struct peer *peer
)
{
DSA *dsa;
BN_CTX *bctx;
DSA_SIG *sdsa;
BIGNUM *bn, *bk;
u_int len;
const u_char *ptr;
int temp;
const BIGNUM *p, *g;
const BIGNUM *r, *s;
const BIGNUM *pub_key;
if (peer->ident_pkey == NULL) {
msyslog(LOG_NOTICE, "crypto_iff: scheme unavailable");
return (XEVNT_ID);
}
if (ntohl(ep->fstamp) != peer->ident_pkey->fstamp) {
msyslog(LOG_NOTICE, "crypto_iff: invalid filestamp %u",
ntohl(ep->fstamp));
return (XEVNT_FSP);
}
if ((dsa = EVP_PKEY_get0_DSA(peer->ident_pkey->pkey)) == NULL) {
msyslog(LOG_NOTICE, "crypto_iff: defective key");
return (XEVNT_PUB);
}
if (peer->iffval == NULL) {
msyslog(LOG_NOTICE, "crypto_iff: missing challenge");
return (XEVNT_ID);
}
bctx = BN_CTX_new(); bk = BN_new(); bn = BN_new();
len = ntohl(ep->vallen);
ptr = (u_char *)ep->pkt;
if ((sdsa = d2i_DSA_SIG(NULL, &ptr, len)) == NULL) {
BN_free(bn); BN_free(bk); BN_CTX_free(bctx);
msyslog(LOG_ERR, "crypto_iff: %s",
ERR_error_string(ERR_get_error(), NULL));
return (XEVNT_ERR);
}
DSA_get0_key(dsa, &pub_key, NULL);
DSA_get0_pqg(dsa, &p, NULL, &g);
DSA_SIG_get0(sdsa, &r, &s);
BN_mod_exp(bn, pub_key, peer->iffval, p, bctx);
BN_mod_exp(bk, g, r, p, bctx);
BN_mod_mul(bn, bn, bk, p, bctx);
bighash(bn, bn);
temp = BN_cmp(bn, s);
BN_free(bn); BN_free(bk); BN_CTX_free(bctx);
BN_free(peer->iffval);
peer->iffval = NULL;
DSA_SIG_free(sdsa);
if (temp == 0)
return (XEVNT_OK);
msyslog(LOG_NOTICE, "crypto_iff: identity not verified");
return (XEVNT_ID);
}
static int
crypto_alice2(
struct peer *peer,
struct value *vp
)
{
RSA *rsa;
BN_CTX *bctx;
EVP_MD_CTX *ctx;
tstamp_t tstamp;
u_int len;
const BIGNUM *n;
if (peer->ident_pkey == NULL)
return (XEVNT_ID);
if ((rsa = EVP_PKEY_get0_RSA(peer->ident_pkey->pkey)) == NULL) {
msyslog(LOG_NOTICE, "crypto_alice2: defective key");
return (XEVNT_PUB);
}
if (peer->iffval != NULL)
BN_free(peer->iffval);
peer->iffval = BN_new();
RSA_get0_key(rsa, &n, NULL, NULL);
len = BN_num_bytes(n);
BN_rand(peer->iffval, len * 8, -1, 1);
bctx = BN_CTX_new();
BN_mod(peer->iffval, peer->iffval, n, bctx);
BN_CTX_free(bctx);
memset(vp, 0, sizeof(struct value));
tstamp = crypto_time();
vp->tstamp = htonl(tstamp);
vp->fstamp = htonl(peer->ident_pkey->fstamp);
vp->vallen = htonl(len);
vp->ptr = emalloc(len);
BN_bn2bin(peer->iffval, vp->ptr);
if (tstamp == 0)
return (XEVNT_OK);
vp->sig = emalloc(sign_siglen);
ctx = EVP_MD_CTX_new();
EVP_SignInit(ctx, sign_digest);
EVP_SignUpdate(ctx, (u_char *)&vp->tstamp, 12);
EVP_SignUpdate(ctx, vp->ptr, len);
if (EVP_SignFinal(ctx, vp->sig, &len, sign_pkey)) {
INSIST(len <= sign_siglen);
vp->siglen = htonl(len);
}
EVP_MD_CTX_free(ctx);
return (XEVNT_OK);
}
static int
crypto_bob2(
struct exten *ep,
struct value *vp
)
{
RSA *rsa;
DSA_SIG *sdsa;
BN_CTX *bctx;
EVP_MD_CTX *ctx;
tstamp_t tstamp;
BIGNUM *r, *k, *g, *y;
u_char *ptr;
u_int len;
int s_len;
const BIGNUM *n, *p, *e;
if (gqkey_info == NULL) {
msyslog(LOG_NOTICE, "crypto_bob2: scheme unavailable");
return (XEVNT_ID);
}
rsa = EVP_PKEY_get0_RSA(gqkey_info->pkey);
RSA_get0_key(rsa, &n, &p, &e);
len = exten_payload_size(ep);
if (len == 0 || len > MAX_VALLEN)
return (XEVNT_LEN);
if ((r = BN_bin2bn((u_char *)ep->pkt, len, NULL)) == NULL) {
msyslog(LOG_ERR, "crypto_bob2: %s",
ERR_error_string(ERR_get_error(), NULL));
return (XEVNT_ERR);
}
bctx = BN_CTX_new(); k = BN_new(); g = BN_new(); y = BN_new();
sdsa = DSA_SIG_new();
BN_rand(k, len * 8, -1, 1);
BN_mod(k, k, n, bctx);
BN_mod_exp(y, p, r, n, bctx);
BN_mod_mul(y, k, y, n, bctx);
BN_mod_exp(g, k, e, n, bctx);
bighash(g, g);
DSA_SIG_set0(sdsa, y, g);
BN_CTX_free(bctx);
BN_free(r); BN_free(k);
#ifdef DEBUG
if (debug > 1)
RSA_print_fp(stdout, rsa, 0);
#endif
len = s_len = i2d_DSA_SIG(sdsa, NULL);
if (s_len <= 0) {
msyslog(LOG_ERR, "crypto_bob2: %s",
ERR_error_string(ERR_get_error(), NULL));
DSA_SIG_free(sdsa);
return (XEVNT_ERR);
}
memset(vp, 0, sizeof(struct value));
tstamp = crypto_time();
vp->tstamp = htonl(tstamp);
vp->fstamp = htonl(gqkey_info->fstamp);
vp->vallen = htonl(len);
ptr = emalloc(len);
vp->ptr = ptr;
i2d_DSA_SIG(sdsa, &ptr);
DSA_SIG_free(sdsa);
if (tstamp == 0)
return (XEVNT_OK);
vp->sig = emalloc(sign_siglen);
ctx = EVP_MD_CTX_new();
EVP_SignInit(ctx, sign_digest);
EVP_SignUpdate(ctx, (u_char *)&vp->tstamp, 12);
EVP_SignUpdate(ctx, vp->ptr, len);
if (EVP_SignFinal(ctx, vp->sig, &len, sign_pkey)) {
INSIST(len <= sign_siglen);
vp->siglen = htonl(len);
}
EVP_MD_CTX_free(ctx);
return (XEVNT_OK);
}
int
crypto_gq(
struct exten *ep,
struct peer *peer
)
{
RSA *rsa;
BN_CTX *bctx;
DSA_SIG *sdsa;
BIGNUM *y, *v;
const u_char *ptr;
long len;
u_int temp;
const BIGNUM *n, *e;
const BIGNUM *r, *s;
if (peer->ident_pkey == NULL) {
msyslog(LOG_NOTICE, "crypto_gq: scheme unavailable");
return (XEVNT_ID);
}
if (ntohl(ep->fstamp) < peer->ident_pkey->fstamp) {
msyslog(LOG_NOTICE, "crypto_gq: invalid filestamp %u",
ntohl(ep->fstamp));
return (XEVNT_FSP);
}
if ((rsa = EVP_PKEY_get0_RSA(peer->ident_pkey->pkey)) == NULL) {
msyslog(LOG_NOTICE, "crypto_gq: defective key");
return (XEVNT_PUB);
}
RSA_get0_key(rsa, &n, NULL, &e);
if (peer->iffval == NULL) {
msyslog(LOG_NOTICE, "crypto_gq: missing challenge");
return (XEVNT_ID);
}
bctx = BN_CTX_new(); y = BN_new(); v = BN_new();
len = ntohl(ep->vallen);
ptr = (u_char *)ep->pkt;
if ((sdsa = d2i_DSA_SIG(NULL, &ptr, len)) == NULL) {
BN_CTX_free(bctx); BN_free(y); BN_free(v);
msyslog(LOG_ERR, "crypto_gq: %s",
ERR_error_string(ERR_get_error(), NULL));
return (XEVNT_ERR);
}
DSA_SIG_get0(sdsa, &r, &s);
if (peer->grpkey == NULL) {
msyslog(LOG_NOTICE, "crypto_gq: missing group key");
return (XEVNT_ID);
}
BN_mod_exp(v, peer->grpkey, peer->iffval, n, bctx);
BN_mod_exp(y, r, e, n, bctx);
BN_mod_mul(y, v, y, n, bctx);
bighash(y, y);
temp = BN_cmp(y, s);
BN_CTX_free(bctx); BN_free(y); BN_free(v);
BN_free(peer->iffval);
peer->iffval = NULL;
DSA_SIG_free(sdsa);
if (temp == 0)
return (XEVNT_OK);
msyslog(LOG_NOTICE, "crypto_gq: identity not verified");
return (XEVNT_ID);
}
static int
crypto_alice3(
struct peer *peer,
struct value *vp
)
{
DSA *dsa;
BN_CTX *bctx;
EVP_MD_CTX *ctx;
tstamp_t tstamp;
u_int len;
const BIGNUM *p;
if (peer->ident_pkey == NULL)
return (XEVNT_ID);
if ((dsa = EVP_PKEY_get0_DSA(peer->ident_pkey->pkey)) == NULL) {
msyslog(LOG_NOTICE, "crypto_alice3: defective key");
return (XEVNT_PUB);
}
DSA_get0_pqg(dsa, &p, NULL, NULL);
if (peer->iffval != NULL)
BN_free(peer->iffval);
peer->iffval = BN_new();
len = BN_num_bytes(p);
BN_rand(peer->iffval, len * 8, -1, 1);
bctx = BN_CTX_new();
BN_mod(peer->iffval, peer->iffval, p, bctx);
BN_CTX_free(bctx);
memset(vp, 0, sizeof(struct value));
tstamp = crypto_time();
vp->tstamp = htonl(tstamp);
vp->fstamp = htonl(peer->ident_pkey->fstamp);
vp->vallen = htonl(len);
vp->ptr = emalloc(len);
BN_bn2bin(peer->iffval, vp->ptr);
if (tstamp == 0)
return (XEVNT_OK);
vp->sig = emalloc(sign_siglen);
ctx = EVP_MD_CTX_new();
EVP_SignInit(ctx, sign_digest);
EVP_SignUpdate(ctx, (u_char *)&vp->tstamp, 12);
EVP_SignUpdate(ctx, vp->ptr, len);
if (EVP_SignFinal(ctx, vp->sig, &len, sign_pkey)) {
INSIST(len <= sign_siglen);
vp->siglen = htonl(len);
}
EVP_MD_CTX_free(ctx);
return (XEVNT_OK);
}
static int
crypto_bob3(
struct exten *ep,
struct value *vp
)
{
DSA *dsa;
DSA *sdsa;
BN_CTX *bctx;
EVP_MD_CTX *ctx;
tstamp_t tstamp;
BIGNUM *r, *k, *u;
u_char *ptr;
u_int len;
const BIGNUM *p, *q, *g;
const BIGNUM *pub_key, *priv_key;
BIGNUM *sp, *sq, *sg;
if (mvkey_info == NULL) {
msyslog(LOG_NOTICE, "crypto_bob3: scheme unavailable");
return (XEVNT_ID);
}
dsa = EVP_PKEY_get0_DSA(mvkey_info->pkey);
DSA_get0_pqg(dsa, &p, &q, &g);
DSA_get0_key(dsa, &pub_key, &priv_key);
len = exten_payload_size(ep);
if (len == 0 || len > MAX_VALLEN)
return (XEVNT_LEN);
if ((r = BN_bin2bn((u_char *)ep->pkt, len, NULL)) == NULL) {
msyslog(LOG_ERR, "crypto_bob3: %s",
ERR_error_string(ERR_get_error(), NULL));
return (XEVNT_ERR);
}
bctx = BN_CTX_new(); k = BN_new(); u = BN_new();
sdsa = DSA_new();
sp = BN_new(); sq = BN_new(); sg = BN_new();
while (1) {
BN_rand(k, BN_num_bits(q), 0, 0);
BN_mod(k, k, q, bctx);
BN_gcd(u, k, q, bctx);
if (BN_is_one(u))
break;
}
BN_mod_exp(u, g, k, p, bctx);
BN_mod_mul(sp, u, r, p, bctx);
BN_mod_exp(sq, priv_key, k, p, bctx);
BN_mod_exp(sg, pub_key, k, p, bctx);
DSA_set0_key(sdsa, BN_dup(pub_key), NULL);
DSA_set0_pqg(sdsa, sp, sq, sg);
BN_CTX_free(bctx); BN_free(k); BN_free(r); BN_free(u);
#ifdef DEBUG
if (debug > 1)
DSA_print_fp(stdout, sdsa, 0);
#endif
memset(vp, 0, sizeof(struct value));
tstamp = crypto_time();
vp->tstamp = htonl(tstamp);
vp->fstamp = htonl(mvkey_info->fstamp);
len = i2d_DSAparams(sdsa, NULL);
if (len == 0) {
msyslog(LOG_ERR, "crypto_bob3: %s",
ERR_error_string(ERR_get_error(), NULL));
DSA_free(sdsa);
return (XEVNT_ERR);
}
vp->vallen = htonl(len);
ptr = emalloc(len);
vp->ptr = ptr;
i2d_DSAparams(sdsa, &ptr);
DSA_free(sdsa);
if (tstamp == 0)
return (XEVNT_OK);
vp->sig = emalloc(sign_siglen);
ctx = EVP_MD_CTX_new();
EVP_SignInit(ctx, sign_digest);
EVP_SignUpdate(ctx, (u_char *)&vp->tstamp, 12);
EVP_SignUpdate(ctx, vp->ptr, len);
if (EVP_SignFinal(ctx, vp->sig, &len, sign_pkey)) {
INSIST(len <= sign_siglen);
vp->siglen = htonl(len);
}
EVP_MD_CTX_free(ctx);
return (XEVNT_OK);
}
int
crypto_mv(
struct exten *ep,
struct peer *peer
)
{
DSA *dsa;
DSA *sdsa;
BN_CTX *bctx;
BIGNUM *k, *u, *v;
u_int len;
const u_char *ptr;
int temp;
const BIGNUM *p;
const BIGNUM *pub_key, *priv_key;
const BIGNUM *sp, *sq, *sg;
if (peer->ident_pkey == NULL) {
msyslog(LOG_NOTICE, "crypto_mv: scheme unavailable");
return (XEVNT_ID);
}
if (ntohl(ep->fstamp) != peer->ident_pkey->fstamp) {
msyslog(LOG_NOTICE, "crypto_mv: invalid filestamp %u",
ntohl(ep->fstamp));
return (XEVNT_FSP);
}
if ((dsa = EVP_PKEY_get0_DSA(peer->ident_pkey->pkey)) == NULL) {
msyslog(LOG_NOTICE, "crypto_mv: defective key");
return (XEVNT_PUB);
}
DSA_get0_pqg(dsa, &p, NULL, NULL);
DSA_get0_key(dsa, &pub_key, &priv_key);
if (peer->iffval == NULL) {
msyslog(LOG_NOTICE, "crypto_mv: missing challenge");
return (XEVNT_ID);
}
bctx = BN_CTX_new(); k = BN_new(); u = BN_new(); v = BN_new();
len = ntohl(ep->vallen);
ptr = (u_char *)ep->pkt;
if ((sdsa = d2i_DSAparams(NULL, &ptr, len)) == NULL) {
msyslog(LOG_ERR, "crypto_mv: %s",
ERR_error_string(ERR_get_error(), NULL));
return (XEVNT_ERR);
}
DSA_get0_pqg(sdsa, &sp, &sq, &sg);
BN_mod_exp(u, sq, pub_key, p, bctx);
BN_mod_exp(v, sg, priv_key, p, bctx);
BN_mod_mul(u, u, v, p, bctx);
BN_mod_mul(u, u, sp, p, bctx);
temp = BN_cmp(u, peer->iffval);
BN_CTX_free(bctx); BN_free(k); BN_free(u); BN_free(v);
BN_free(peer->iffval);
peer->iffval = NULL;
DSA_free(sdsa);
if (temp == 0)
return (XEVNT_OK);
msyslog(LOG_NOTICE, "crypto_mv: identity not verified");
return (XEVNT_ID);
}
static int
cert_sign(
struct exten *ep,
struct value *vp
)
{
X509 *req;
X509 *cert;
X509_EXTENSION *ext;
ASN1_INTEGER *serial;
X509_NAME *subj;
EVP_PKEY *pkey;
EVP_MD_CTX *ctx;
tstamp_t tstamp;
struct calendar tscal;
u_int len;
const u_char *cptr;
u_char *ptr;
int i, temp;
tstamp = crypto_time();
if (tstamp == 0)
return (XEVNT_TSP);
len = exten_payload_size(ep);
if (len == 0 || len > MAX_VALLEN)
return (XEVNT_LEN);
cptr = (void *)ep->pkt;
if ((req = d2i_X509(NULL, &cptr, len)) == NULL) {
msyslog(LOG_ERR, "cert_sign: %s",
ERR_error_string(ERR_get_error(), NULL));
return (XEVNT_CRT);
}
if ((pkey = X509_get_pubkey(req)) == NULL) {
msyslog(LOG_ERR, "cert_sign: %s",
ERR_error_string(ERR_get_error(), NULL));
X509_free(req);
return (XEVNT_PUB);
}
cert = X509_new();
X509_set_version(cert, X509_get_version(req));
serial = ASN1_INTEGER_new();
ASN1_INTEGER_set(serial, tstamp);
X509_set_serialNumber(cert, serial);
X509_gmtime_adj(X509_getm_notBefore(cert), 0L);
X509_gmtime_adj(X509_getm_notAfter(cert), YEAR);
subj = X509_get_issuer_name(cert);
X509_NAME_add_entry_by_txt(subj, "commonName", MBSTRING_ASC,
hostval.ptr, strlen((const char *)hostval.ptr), -1, 0);
subj = X509_get_subject_name(req);
X509_set_subject_name(cert, subj);
X509_set_pubkey(cert, pkey);
temp = X509_get_ext_count(req);
for (i = 0; i < temp; i++) {
ext = X509_get_ext(req, i);
INSIST(X509_add_ext(cert, ext, -1));
}
X509_free(req);
(void)ntpcal_ntp_to_date(&tscal, tstamp, NULL);
if ((calcomp(&tscal, &(cert_host->first)) < 0)
|| (calcomp(&tscal, &(cert_host->last)) > 0)) {
X509_free(cert);
return (XEVNT_PER);
}
X509_sign(cert, sign_pkey, sign_digest);
if (X509_verify(cert, sign_pkey) <= 0) {
msyslog(LOG_ERR, "cert_sign: %s",
ERR_error_string(ERR_get_error(), NULL));
X509_free(cert);
return (XEVNT_VFY);
}
len = i2d_X509(cert, NULL);
memset(vp, 0, sizeof(struct value));
vp->tstamp = htonl(tstamp);
vp->fstamp = ep->fstamp;
vp->vallen = htonl(len);
vp->ptr = emalloc(len);
ptr = vp->ptr;
i2d_X509(cert, (unsigned char **)(intptr_t)&ptr);
vp->siglen = 0;
if (tstamp != 0) {
vp->sig = emalloc(sign_siglen);
ctx = EVP_MD_CTX_new();
EVP_SignInit(ctx, sign_digest);
EVP_SignUpdate(ctx, (u_char *)vp, 12);
EVP_SignUpdate(ctx, vp->ptr, len);
if (EVP_SignFinal(ctx, vp->sig, &len, sign_pkey)) {
INSIST(len <= sign_siglen);
vp->siglen = htonl(len);
}
EVP_MD_CTX_free(ctx);
}
#ifdef DEBUG
if (debug > 1)
X509_print_fp(stdout, cert);
#endif
X509_free(cert);
return (XEVNT_OK);
}
struct cert_info *
cert_install(
struct exten *ep,
struct peer *peer
)
{
struct cert_info *cp, *xp, **zp;
if ((cp = cert_parse((u_char *)ep->pkt, (long)ntohl(ep->vallen),
(tstamp_t)ntohl(ep->fstamp))) == NULL)
return (NULL);
zp = &cinfo;
for (xp = cinfo; xp != NULL; xp = xp->link) {
if (strcmp(cp->subject, xp->subject) == 0 &&
strcmp(cp->issuer, xp->issuer) == 0) {
if (ntohl(cp->cert.fstamp) <=
ntohl(xp->cert.fstamp)) {
cert_free(cp);
cp = xp;
} else {
*zp = xp->link;
cert_free(xp);
xp = NULL;
}
break;
}
zp = &xp->link;
}
if (xp == NULL) {
cp->link = cinfo;
cinfo = cp;
}
cp->flags |= CERT_VALID;
crypto_update();
return (cp);
}
int
cert_hike(
struct peer *peer,
struct cert_info *yp
)
{
struct cert_info *xp;
X509 *cert;
const u_char *ptr;
if (peer->issuer != NULL)
free(peer->issuer);
peer->issuer = estrdup(yp->issuer);
xp = peer->xinfo;
peer->xinfo = yp;
if (strcmp(yp->subject, yp->issuer) == 0) {
if (!(yp->flags & CERT_TRUST))
return (XEVNT_OK);
peer->crypto |= CRYPTO_FLAG_CERT;
peer->grpkey = yp->grpkey;
if (peer->ident == NULL || !(peer->crypto &
CRYPTO_FLAG_MASK))
peer->crypto |= CRYPTO_FLAG_VRFY;
}
if (xp == NULL)
return (XEVNT_OK);
ptr = (u_char *)xp->cert.ptr;
cert = d2i_X509(NULL, &ptr, ntohl(xp->cert.vallen));
if (cert == NULL) {
xp->flags |= CERT_ERROR;
return (XEVNT_CRT);
}
if (X509_verify(cert, yp->pkey) <= 0) {
X509_free(cert);
xp->flags |= CERT_ERROR;
return (XEVNT_VFY);
}
X509_free(cert);
if ((calcomp(&(xp->first), &(yp->first)) < 0)
|| (calcomp(&(xp->first), &(yp->last)) > 0)) {
xp->flags |= CERT_ERROR;
return (XEVNT_PER);
}
xp->flags |= CERT_SIGN;
return (XEVNT_OK);
}
struct cert_info *
cert_parse(
const u_char *asn1cert,
long len,
tstamp_t fstamp
)
{
X509 *cert;
struct cert_info *ret;
BIO *bp;
char pathbuf[MAXFILENAME];
const u_char *ptr;
char *pch;
int cnt, i;
struct calendar fscal;
ptr = asn1cert;
if ((cert = d2i_X509(NULL, &ptr, len)) == NULL) {
msyslog(LOG_ERR, "cert_parse: %s",
ERR_error_string(ERR_get_error(), NULL));
return (NULL);
}
#ifdef DEBUG
if (debug > 1)
X509_print_fp(stdout, cert);
#endif
ret = emalloc_zero(sizeof(*ret));
if ((ret->pkey = X509_get_pubkey(cert)) == NULL) {
msyslog(LOG_ERR, "cert_parse: %s",
ERR_error_string(ERR_get_error(), NULL));
cert_free(ret);
X509_free(cert);
return (NULL);
}
ret->version = X509_get_version(cert);
X509_NAME_oneline(X509_get_subject_name(cert), pathbuf,
sizeof(pathbuf));
pch = strstr(pathbuf, "CN=");
if (NULL == pch) {
msyslog(LOG_NOTICE, "cert_parse: invalid subject %s",
pathbuf);
cert_free(ret);
X509_free(cert);
return (NULL);
}
ret->subject = estrdup(pch + 3);
ret->nid = X509_get_signature_nid(cert);
ret->digest = (const EVP_MD *)EVP_get_digestbynid(ret->nid);
ret->serial =
(u_long)ASN1_INTEGER_get(X509_get_serialNumber(cert));
X509_NAME_oneline(X509_get_issuer_name(cert), pathbuf,
sizeof(pathbuf));
if ((pch = strstr(pathbuf, "CN=")) == NULL) {
msyslog(LOG_NOTICE, "cert_parse: invalid issuer %s",
pathbuf);
cert_free(ret);
X509_free(cert);
return (NULL);
}
ret->issuer = estrdup(pch + 3);
asn_to_calendar(X509_get0_notBefore(cert), &(ret->first));
asn_to_calendar(X509_get0_notAfter(cert), &(ret->last));
cnt = X509_get_ext_count(cert);
for (i = 0; i < cnt; i++) {
X509_EXTENSION *ext;
ASN1_OBJECT *obj;
int nid;
ASN1_OCTET_STRING *data;
ext = X509_get_ext(cert, i);
obj = X509_EXTENSION_get_object(ext);
nid = OBJ_obj2nid(obj);
switch (nid) {
case NID_ext_key_usage:
bp = BIO_new(BIO_s_mem());
X509V3_EXT_print(bp, ext, 0, 0);
BIO_gets(bp, pathbuf, sizeof(pathbuf));
BIO_free(bp);
if (strcmp(pathbuf, "Trust Root") == 0)
ret->flags |= CERT_TRUST;
else if (strcmp(pathbuf, "Private") == 0)
ret->flags |= CERT_PRIV;
DPRINTF(1, ("cert_parse: %s: %s\n",
OBJ_nid2ln(nid), pathbuf));
break;
case NID_subject_key_identifier:
data = X509_EXTENSION_get_data(ext);
ret->grpkey = BN_bin2bn(&data->data[2],
data->length - 2, NULL);
default:
DPRINTF(1, ("cert_parse: %s\n",
OBJ_nid2ln(nid)));
break;
}
}
if (strcmp(ret->subject, ret->issuer) == 0) {
if (X509_verify(cert, ret->pkey) <= 0) {
msyslog(LOG_NOTICE,
"cert_parse: signature not verified %s",
ret->subject);
cert_free(ret);
X509_free(cert);
return (NULL);
}
} else {
if (strcmp((const char *)hostval.ptr, ret->issuer) == 0) {
msyslog(LOG_NOTICE,
"cert_parse: certificate trail loop %s",
ret->subject);
cert_free(ret);
X509_free(cert);
return (NULL);
}
}
(void)ntpcal_ntp_to_date(&fscal, fstamp, NULL);
if ((calcomp(&(ret->first), &(ret->last)) > 0)
|| (calcomp(&(ret->first), &fscal) < 0)) {
msyslog(LOG_NOTICE,
"cert_parse: invalid times %s first %u-%02u-%02uT%02u:%02u:%02u last %u-%02u-%02uT%02u:%02u:%02u fstamp %u-%02u-%02uT%02u:%02u:%02u",
ret->subject,
ret->first.year, ret->first.month, ret->first.monthday,
ret->first.hour, ret->first.minute, ret->first.second,
ret->last.year, ret->last.month, ret->last.monthday,
ret->last.hour, ret->last.minute, ret->last.second,
fscal.year, fscal.month, fscal.monthday,
fscal.hour, fscal.minute, fscal.second);
cert_free(ret);
X509_free(cert);
return (NULL);
}
ret->cert.fstamp = htonl(fstamp);
ret->cert.vallen = htonl(len);
ret->cert.ptr = emalloc(len);
memcpy(ret->cert.ptr, asn1cert, len);
X509_free(cert);
return (ret);
}
void
cert_free(
struct cert_info *cinf
)
{
if (cinf->pkey != NULL)
EVP_PKEY_free(cinf->pkey);
if (cinf->subject != NULL)
free(cinf->subject);
if (cinf->issuer != NULL)
free(cinf->issuer);
if (cinf->grpkey != NULL)
BN_free(cinf->grpkey);
value_free(&cinf->cert);
free(cinf);
}
static struct pkey_info *
crypto_key(
char *cp,
char *passwd1,
sockaddr_u *addr
)
{
FILE *str;
struct pkey_info *pkp;
EVP_PKEY *pkey = NULL;
tstamp_t fstamp;
char filename[MAXFILENAME];
char linkname[MAXFILENAME];
char statstr[NTP_MAXSTRLEN];
char *ptr;
for (pkp = pkinfo; pkp != NULL; pkp = pkp->link) {
if (strcmp(cp, pkp->name) == 0)
return (pkp);
}
if (*cp == '/')
strlcpy(filename, cp, sizeof(filename));
else
snprintf(filename, sizeof(filename), "%s/%s", keysdir,
cp);
str = fopen(filename, "r");
if (str == NULL)
return (NULL);
if ((ptr = fgets(linkname, sizeof(linkname), str)) == NULL) {
msyslog(LOG_ERR, "crypto_key: empty file %s",
filename);
fclose(str);
return (NULL);
}
if ((ptr = strrchr(ptr, '.')) == NULL) {
msyslog(LOG_ERR, "crypto_key: no filestamp %s",
filename);
fclose(str);
return (NULL);
}
if (sscanf(++ptr, "%u", &fstamp) != 1) {
msyslog(LOG_ERR, "crypto_key: invalid filestamp %s",
filename);
fclose(str);
return (NULL);
}
pkey = PEM_read_PrivateKey(str, NULL, NULL, passwd1);
fclose(str);
if (pkey == NULL) {
msyslog(LOG_ERR, "crypto_key: %s",
ERR_error_string(ERR_get_error(), NULL));
exit (-1);
}
pkp = emalloc(sizeof(struct pkey_info));
pkp->link = pkinfo;
pkinfo = pkp;
pkp->pkey = pkey;
pkp->name = estrdup(cp);
pkp->fstamp = fstamp;
if ((ptr = strrchr(linkname, '\n')) != NULL)
*ptr = '\0';
snprintf(statstr, sizeof(statstr), "%s mod %d", &linkname[2],
EVP_PKEY_size(pkey) * 8);
record_crypto_stats(addr, statstr);
DPRINTF(1, ("crypto_key: %s\n", statstr));
#ifdef DEBUG
if (debug > 1) {
if (EVP_PKEY_base_id(pkey) == EVP_PKEY_DSA)
DSA_print_fp(stdout, EVP_PKEY_get0_DSA(pkey), 0);
else if (EVP_PKEY_base_id(pkey) == EVP_PKEY_RSA)
RSA_print_fp(stdout, EVP_PKEY_get0_RSA(pkey), 0);
}
#endif
return (pkp);
}
static struct cert_info *
crypto_cert(
char *cp
)
{
struct cert_info *ret;
FILE *str;
char filename[MAXFILENAME];
char linkname[MAXFILENAME];
char statstr[NTP_MAXSTRLEN];
tstamp_t fstamp;
long len;
char *ptr;
char *name, *header;
u_char *data;
if (*cp == '/')
strlcpy(filename, cp, sizeof(filename));
else
snprintf(filename, sizeof(filename), "%s/%s", keysdir,
cp);
str = fopen(filename, "r");
if (str == NULL)
return (NULL);
if ((ptr = fgets(linkname, sizeof(linkname), str)) == NULL) {
msyslog(LOG_ERR, "crypto_cert: empty file %s",
filename);
fclose(str);
return (NULL);
}
if ((ptr = strrchr(ptr, '.')) == NULL) {
msyslog(LOG_ERR, "crypto_cert: no filestamp %s",
filename);
fclose(str);
return (NULL);
}
if (sscanf(++ptr, "%u", &fstamp) != 1) {
msyslog(LOG_ERR, "crypto_cert: invalid filestamp %s",
filename);
fclose(str);
return (NULL);
}
if (!PEM_read(str, &name, &header, &data, &len)) {
msyslog(LOG_ERR, "crypto_cert: %s",
ERR_error_string(ERR_get_error(), NULL));
fclose(str);
return (NULL);
}
fclose(str);
free(header);
if (strcmp(name, "CERTIFICATE") != 0) {
msyslog(LOG_NOTICE, "crypto_cert: wrong PEM type %s",
name);
free(name);
free(data);
return (NULL);
}
free(name);
ret = cert_parse(data, len, fstamp);
free(data);
if (ret == NULL)
return (NULL);
if ((ptr = strrchr(linkname, '\n')) != NULL)
*ptr = '\0';
snprintf(statstr, sizeof(statstr), "%s 0x%x len %lu",
&linkname[2], ret->flags, len);
record_crypto_stats(NULL, statstr);
DPRINTF(1, ("crypto_cert: %s\n", statstr));
return (ret);
}
void
crypto_setup(void)
{
struct pkey_info *pinfo;
char filename[MAXFILENAME];
char hostname[MAXFILENAME];
char *randfile;
char statstr[NTP_MAXSTRLEN];
l_fp seed;
u_int len;
int bytes;
u_char *ptr;
if (crypto_flags & CRYPTO_FLAG_ENAB) {
msyslog(LOG_NOTICE,
"crypto_setup: spurious crypto command");
return;
}
ssl_check_version();
if (!RAND_status()) {
if (rand_file == NULL) {
RAND_file_name(filename, sizeof(filename));
randfile = filename;
} else if (*rand_file != '/') {
snprintf(filename, sizeof(filename), "%s/%s",
keysdir, rand_file);
randfile = filename;
} else
randfile = rand_file;
if ((bytes = RAND_load_file(randfile, -1)) == 0) {
msyslog(LOG_ERR,
"crypto_setup: random seed file %s missing",
randfile);
exit (-1);
}
get_systime(&seed);
RAND_seed(&seed, sizeof(l_fp));
RAND_write_file(randfile);
DPRINTF(1, ("crypto_setup: OpenSSL version %lx random seed file %s bytes read %d\n",
OpenSSL_version_num(), randfile, bytes));
}
gethostname(hostname, sizeof(hostname));
if (host_filename != NULL)
strlcpy(hostname, host_filename, sizeof(hostname));
if (passwd == NULL)
passwd = estrdup(hostname);
memset(&hostval, 0, sizeof(hostval));
memset(&pubkey, 0, sizeof(pubkey));
memset(&tai_leap, 0, sizeof(tai_leap));
snprintf(filename, sizeof(filename), "ntpkey_host_%s", hostname);
pinfo = crypto_key(filename, passwd, NULL);
if (pinfo == NULL) {
msyslog(LOG_ERR,
"crypto_setup: host key file %s not found or corrupt",
filename);
exit (-1);
}
if (EVP_PKEY_base_id(pinfo->pkey) != EVP_PKEY_RSA) {
msyslog(LOG_ERR,
"crypto_setup: host key is not RSA key type");
exit (-1);
}
host_pkey = pinfo->pkey;
sign_pkey = host_pkey;
hostval.fstamp = htonl(pinfo->fstamp);
len = i2d_PublicKey(host_pkey, NULL);
ptr = emalloc(len);
pubkey.ptr = ptr;
i2d_PublicKey(host_pkey, &ptr);
pubkey.fstamp = hostval.fstamp;
pubkey.vallen = htonl(len);
snprintf(filename, sizeof(filename), "ntpkey_sign_%s", hostname);
pinfo = crypto_key(filename, passwd, NULL);
if (pinfo != NULL)
sign_pkey = pinfo->pkey;
snprintf(filename, sizeof(filename), "ntpkey_cert_%s", hostname);
cinfo = crypto_cert(filename);
if (cinfo == NULL) {
msyslog(LOG_ERR,
"crypto_setup: certificate file %s not found or corrupt",
filename);
exit (-1);
}
cert_host = cinfo;
sign_digest = cinfo->digest;
sign_siglen = EVP_PKEY_size(sign_pkey);
if (cinfo->flags & CERT_PRIV)
crypto_flags |= CRYPTO_FLAG_PRIV;
if (strcmp(cinfo->subject, cinfo->issuer) != 0) {
msyslog(LOG_ERR,
"crypto_setup: certificate %s is not self-signed",
filename);
exit (-1);
}
hostval.ptr = estrdup(cinfo->subject);
hostval.vallen = htonl(strlen(cinfo->subject));
sys_hostname = hostval.ptr;
ptr = (u_char *)strchr(sys_hostname, '@');
if (ptr != NULL)
sys_groupname = estrdup((char *)++ptr);
if (ident_filename != NULL)
strlcpy(hostname, ident_filename, sizeof(hostname));
snprintf(filename, sizeof(filename), "ntpkey_iffkey_%s",
hostname);
iffkey_info = crypto_key(filename, passwd, NULL);
if (iffkey_info != NULL)
crypto_flags |= CRYPTO_FLAG_IFF;
snprintf(filename, sizeof(filename), "ntpkey_gqkey_%s",
hostname);
gqkey_info = crypto_key(filename, passwd, NULL);
if (gqkey_info != NULL)
crypto_flags |= CRYPTO_FLAG_GQ;
snprintf(filename, sizeof(filename), "ntpkey_mvkey_%s",
hostname);
mvkey_info = crypto_key(filename, passwd, NULL);
if (mvkey_info != NULL)
crypto_flags |= CRYPTO_FLAG_MV;
crypto_flags |= CRYPTO_FLAG_ENAB | (cinfo->nid << 16);
snprintf(statstr, sizeof(statstr), "setup 0x%x host %s %s",
crypto_flags, hostname, OBJ_nid2ln(cinfo->nid));
record_crypto_stats(NULL, statstr);
DPRINTF(1, ("crypto_setup: %s\n", statstr));
}
void
crypto_config(
int item,
char *cp
)
{
int nid;
DPRINTF(1, ("crypto_config: item %d %s\n", item, cp));
switch (item) {
case CRYPTO_CONF_PRIV:
if (NULL != host_filename)
free(host_filename);
host_filename = estrdup(cp);
break;
case CRYPTO_CONF_IDENT:
if (NULL != ident_filename)
free(ident_filename);
ident_filename = estrdup(cp);
break;
case CRYPTO_CONF_PW:
if (NULL != passwd)
free(passwd);
passwd = estrdup(cp);
break;
case CRYPTO_CONF_RAND:
if (NULL != rand_file)
free(rand_file);
rand_file = estrdup(cp);
break;
case CRYPTO_CONF_NID:
nid = OBJ_sn2nid(cp);
if (nid == 0)
msyslog(LOG_ERR,
"crypto_config: invalid digest name %s", cp);
else
crypto_nid = nid;
break;
}
}
static u_int
exten_payload_size(
const struct exten * ep)
{
typedef const u_char *BPTR;
size_t extn_size;
size_t data_size;
size_t head_size;
data_size = 0;
if (NULL != ep) {
head_size = (BPTR)(&ep->vallen + 1) - (BPTR)ep;
extn_size = (uint16_t)(ntohl(ep->opcode) & 0x0000ffff);
if (extn_size >= head_size) {
data_size = (uint32_t)ntohl(ep->vallen);
if (data_size > extn_size - head_size)
data_size = ~(size_t)0u;
}
}
return (u_int)data_size;
}
# else
int ntp_crypto_bs_pubkey;
# endif