ntp-92/ntpd/ntp_crypto.c

74  * The filestamp represents the time when a cryptographic data file such
76  * depending on that file and serves as a means to obsolete earlier data
79  * cryptographic data file or signing a message can occur only when the
119 char	*sys_hostname = NULL;	/* host name */
120 char	*sys_groupname = NULL;	/* group name */
143 static char *rand_file = NULL;	/* random seed file */
175 readlink(char * link, char * file, int len) {
451 		 * Install status word, host name, signature scheme and
457 		 * symmetric modes. The server name field might be
555 			 * Save status word, host name and message
591 		 * name and public key. In the default identification
1074 	char	certname[MAXHOSTNAME + 1]; /* subject name buffer */
1109 	 * host name. Note, this message is not signed and the filestamp
1144 	 * Send certificate response. Use the name in the extension
1146 	 * contains no subject name, assume the name of this host. This
1623 	 * name defines the group name. Search the key cache for all
1624 	 * keys matching the same group name in order IFF, GQ and MV.
1777  * hostval	host name (not signed)
1804 	 * the host key file extension from wherever the file was
1821 	 * from the certificate file extension from wherever the file
2059 	 * Sign and send to Bob. The filestamp is from the local file.
2147 	 * the local file.
2199 	int	temp;
2247 	temp = BN_cmp(bn, sdsa->s);
2252 	if (temp == 0)
2361 	 * Sign and send to Bob. The filestamp is from the local file.
2449 	 * the local file.
2502 	u_int	temp;
2507 	 * the filestamp on the local key file can be greater than on
2508 	 * the remote parameter file if the keys have been refreshed.
2558 	temp = BN_cmp(y, sdsa->s);
2563 	if (temp == 0)
2615  * This routine generates a private server encryption file including the
2687 	 * Sign and send to Bob. The filestamp is from the local file.
2778 	 * the local file.
2831 	int	temp;
2878 	temp = BN_cmp(u, peer->iffval);
2883 	if (temp == 0)
2902  * which includes the version number, subject name and public key of the
2904  * serial number, issuer name and valid interval of the server. The
2942 	X509_NAME *subj;	/* distinguished (common) name */
2948 	int	i, temp;
2977 	 * trusted host, the issuer name is the group name; otherwise,
2978 	 * it is the host name. Also copy any extensions that might be
2995 	temp = X509_get_ext_count(req);
2996 	for (i = 0; i < temp; i++) {
3210  * The server certificate includes the version number, issuer name,
3211  * subject name, public key and valid date interval. If the issuer name
3212  * is the same as the subject name, the certificate is self signed and
3233 	int	temp, cnt, i;
3250 	 * Extract version, subject name and public key.
3306 		temp = OBJ_obj2nid(ext->object);
3307 		switch (temp) {
3327 				    OBJ_nid2ln(temp), pathbuf);
3343 				    OBJ_nid2ln(temp));
3424  * This routine searches the key cache for matching name in the form
3425  * ntpkey_<key>_<name>, where <key> is one of host, sign, iff, gq, mv,
3426  * and <name> is the host/group name. If not found, it tries to load a
3427  * PEM-encoded file of the same name and extracts the filestamp from
3428  * the first line of the file name. It returns the key pointer if valid,
3433 	char	*cp,		/* file name */
3438 	FILE	*str;		/* file handle */
3442 	char	filename[MAXFILENAME]; /* name of key file */
3448 	 * Search the key cache for matching key and name.
3451 		if (strcmp(cp, pkp->name) == 0)
3456 	 * Open the key file. If the first character of the file name is
3472 		msyslog(LOG_ERR, "crypto_key: empty file %s",
3509 	pkp->name = emalloc(strlen(cp) + 1);
3511 	strcpy(pkp->name, cp);
3543  * crypto_cert - load certificate from file
3545  * This routine loads an X.509 RSA or DSA certificate from a file and
3547  * structure includes a filestamp extracted from the file name. Later
3554 	char	*cp		/* file name */
3558 	FILE	*str;		/* file handle */
3559 	char	filename[MAXFILENAME]; /* name of certificate file */
3565 	char	*name, *header;
3569 	 * Open the certificate file. If the first character of the file
3570 	 * name is not '/', prepend the keys directory string. If
3585 		msyslog(LOG_ERR, "crypto_cert: empty file %s",
3606 	if (!PEM_read(str, &name, &header, &data, &len)) {
3614 	if (strcmp(name, "CERTIFICATE") != 0) {
3616 		    name);
3617 		free(name);
3621 	free(name);
3663 	char	filename[MAXFILENAME]; /* file name buffer */
3683 	 * Load required random seed file and seed the random number
3702 			    "crypto_setup: random seed file %s missing",
3712 			    "crypto_setup: OpenSSL version %lx random seed file %s bytes read %d\n",
3732 	 * Load required host key from file "ntpkey_host_<hostname>". If
3733 	 * no host key file is not found or has invalid password, life
3741 		    "crypto_setup: host key file %s not found or corrupt",
3765 	 * Load optional sign key from file "ntpkey_sign_<hostname>". If
3773 	 * Load required certificate from file "ntpkey_cert_<hostname>".
3779 		    "crypto_setup: certificate file %s not found or corrupt",
3802 	 * If trusted certificate, the subject name must match the group
3803 	 * name.
3810 			    "crypto_setup: trusted certificate name %s does not match group name %s",
3818 		 * Load optional IFF parameters from file
3828 		 * Load optional GQ parameters from file
3838 		 * Load optional MV parameters from file
3869 	char	*cp		/* item name */
3881 	 * Set host name (host).
3889 	 * Set group name (ident).
3905 	 * Set random seed file name (randfile).
3919 			    "crypto_config: invalid digest name %s", cp);