182498Sroberto/* 282498Sroberto * ntp_crypto.c - NTP version 4 public key routines 382498Sroberto */ 482498Sroberto#ifdef HAVE_CONFIG_H 582498Sroberto#include <config.h> 682498Sroberto#endif 782498Sroberto 8285612Sdelphij#ifdef AUTOKEY 982498Sroberto#include <stdio.h> 10285612Sdelphij#include <stdlib.h> /* strtoul */ 1182498Sroberto#include <sys/types.h> 12132451Sroberto#include <sys/param.h> 1382498Sroberto#include <unistd.h> 1482498Sroberto#include <fcntl.h> 1582498Sroberto 1682498Sroberto#include "ntpd.h" 1782498Sroberto#include "ntp_stdlib.h" 18132451Sroberto#include "ntp_unixtime.h" 1982498Sroberto#include "ntp_string.h" 20285612Sdelphij#include "ntp_random.h" 21285612Sdelphij#include "ntp_assert.h" 22285612Sdelphij#include "ntp_calendar.h" 23285612Sdelphij#include "ntp_leapsec.h" 2482498Sroberto 25132451Sroberto#include "openssl/bn.h" 26132451Sroberto#include "openssl/err.h" 27132451Sroberto#include "openssl/evp.h" 28132451Sroberto#include "openssl/pem.h" 29132451Sroberto#include "openssl/rand.h" 30132451Sroberto#include "openssl/x509v3.h" 31310419Sdelphij#include "libssl_compat.h" 32132451Sroberto 3382498Sroberto#ifdef KERNEL_PLL 3482498Sroberto#include "ntp_syscall.h" 3582498Sroberto#endif /* KERNEL_PLL */ 3682498Sroberto 3782498Sroberto/* 38285612Sdelphij * calcomp - compare two calendar structures, ignoring yearday and weekday; like strcmp 39285612Sdelphij * No, it's not a plotter. If you don't understand that, you're too young. 40285612Sdelphij */ 41285612Sdelphijstatic int calcomp(struct calendar *pjd1, struct calendar *pjd2) 42285612Sdelphij{ 43285612Sdelphij int32_t diff; /* large enough to hold the signed difference between two uint16_t values */ 44285612Sdelphij 45285612Sdelphij diff = pjd1->year - pjd2->year; 46285612Sdelphij if (diff < 0) return -1; else if (diff > 0) return 1; 47285612Sdelphij /* same year; compare months */ 48285612Sdelphij diff = pjd1->month - pjd2->month; 49285612Sdelphij if (diff < 0) return -1; else if (diff > 0) return 1; 50285612Sdelphij /* same year and month; compare monthday */ 51285612Sdelphij diff = pjd1->monthday - pjd2->monthday; 52285612Sdelphij if (diff < 0) return -1; else if (diff > 0) return 1; 53285612Sdelphij /* same year and month and monthday; compare time */ 54285612Sdelphij diff = pjd1->hour - pjd2->hour; 55285612Sdelphij if (diff < 0) return -1; else if (diff > 0) return 1; 56285612Sdelphij diff = pjd1->minute - pjd2->minute; 57285612Sdelphij if (diff < 0) return -1; else if (diff > 0) return 1; 58285612Sdelphij diff = pjd1->second - pjd2->second; 59285612Sdelphij if (diff < 0) return -1; else if (diff > 0) return 1; 60285612Sdelphij /* identical */ 61285612Sdelphij return 0; 62285612Sdelphij} 63285612Sdelphij 64285612Sdelphij/* 65132451Sroberto * Extension field message format 6682498Sroberto * 67132451Sroberto * These are always signed and saved before sending in network byte 68132451Sroberto * order. They must be converted to and from host byte order for 69132451Sroberto * processing. 7082498Sroberto * 71132451Sroberto * +-------+-------+ 72132451Sroberto * | op | len | <- extension pointer 73132451Sroberto * +-------+-------+ 74285612Sdelphij * | associd | 75132451Sroberto * +---------------+ 76132451Sroberto * | timestamp | <- value pointer 77132451Sroberto * +---------------+ 78132451Sroberto * | filestamp | 79132451Sroberto * +---------------+ 80132451Sroberto * | value len | 81132451Sroberto * +---------------+ 82132451Sroberto * | | 83132451Sroberto * = value = 84132451Sroberto * | | 85132451Sroberto * +---------------+ 86132451Sroberto * | signature len | 87132451Sroberto * +---------------+ 88132451Sroberto * | | 89132451Sroberto * = signature = 90132451Sroberto * | | 91132451Sroberto * +---------------+ 9282498Sroberto * 93132451Sroberto * The CRYPTO_RESP bit is set to 0 for requests, 1 for responses. 94132451Sroberto * Requests carry the association ID of the receiver; responses carry 95132451Sroberto * the association ID of the sender. Some messages include only the 96132451Sroberto * operation/length and association ID words and so have length 8 97132451Sroberto * octets. Ohers include the value structure and associated value and 98132451Sroberto * signature fields. These messages include the timestamp, filestamp, 99132451Sroberto * value and signature words and so have length at least 24 octets. The 100132451Sroberto * signature and/or value fields can be empty, in which case the 101132451Sroberto * respective length words are zero. An empty value with nonempty 102132451Sroberto * signature is syntactically valid, but semantically questionable. 103132451Sroberto * 104132451Sroberto * The filestamp represents the time when a cryptographic data file such 105132451Sroberto * as a public/private key pair is created. It follows every reference 106132451Sroberto * depending on that file and serves as a means to obsolete earlier data 107132451Sroberto * of the same type. The timestamp represents the time when the 108132451Sroberto * cryptographic data of the message were last signed. Creation of a 109132451Sroberto * cryptographic data file or signing a message can occur only when the 110132451Sroberto * creator or signor is synchronized to an authoritative source and 111132451Sroberto * proventicated to a trusted authority. 112132451Sroberto * 113285612Sdelphij * Note there are several conditions required for server trust. First, 114285612Sdelphij * the public key on the server certificate must be verified, which can 115285612Sdelphij * involve a hike along the certificate trail to a trusted host. Next, 116285612Sdelphij * the server trust must be confirmed by one of several identity 117285612Sdelphij * schemes. Valid cryptographic values are signed with attached 118285612Sdelphij * timestamp and filestamp. Individual packet trust is confirmed 119285612Sdelphij * relative to these values by a message digest with keys generated by a 120285612Sdelphij * reverse-order pseudorandom hash. 121285612Sdelphij * 122285612Sdelphij * State decomposition. These flags are lit in the order given. They are 123285612Sdelphij * dim only when the association is demobilized. 124285612Sdelphij * 125285612Sdelphij * CRYPTO_FLAG_ENAB Lit upon acceptance of a CRYPTO_ASSOC message 126285612Sdelphij * CRYPTO_FLAG_CERT Lit when a self-digned trusted certificate is 127285612Sdelphij * accepted. 128285612Sdelphij * CRYPTO_FLAG_VRFY Lit when identity is confirmed. 129285612Sdelphij * CRYPTO_FLAG_PROV Lit when the first signature is verified. 130285612Sdelphij * CRYPTO_FLAG_COOK Lit when a valid cookie is accepted. 131285612Sdelphij * CRYPTO_FLAG_AUTO Lit when valid autokey values are accepted. 132285612Sdelphij * CRYPTO_FLAG_SIGN Lit when the server signed certificate is 133285612Sdelphij * accepted. 134285612Sdelphij * CRYPTO_FLAG_LEAP Lit when the leapsecond values are accepted. 13582498Sroberto */ 13682498Sroberto/* 137132451Sroberto * Cryptodefines 13882498Sroberto */ 139132451Sroberto#define TAI_1972 10 /* initial TAI offset (s) */ 140132451Sroberto#define MAX_LEAP 100 /* max UTC leapseconds (s) */ 141132451Sroberto#define VALUE_LEN (6 * 4) /* min response field length */ 142281230Sdelphij#define MAX_VALLEN (65535 - VALUE_LEN) 143132451Sroberto#define YEAR (60 * 60 * 24 * 365) /* seconds in year */ 14482498Sroberto 14582498Sroberto/* 146132451Sroberto * Global cryptodata in host byte order 14782498Sroberto */ 148132451Srobertou_int32 crypto_flags = 0x0; /* status word */ 149285612Sdelphijint crypto_nid = KEY_TYPE_MD5; /* digest nid */ 150285612Sdelphijchar *sys_hostname = NULL; 151285612Sdelphijchar *sys_groupname = NULL; 152285612Sdelphijstatic char *host_filename = NULL; /* host file name */ 153285612Sdelphijstatic char *ident_filename = NULL; /* group file name */ 15482498Sroberto 15582498Sroberto/* 156132451Sroberto * Global cryptodata in network byte order 15782498Sroberto */ 158285612Sdelphijstruct cert_info *cinfo = NULL; /* certificate info/value cache */ 159285612Sdelphijstruct cert_info *cert_host = NULL; /* host certificate */ 160285612Sdelphijstruct pkey_info *pkinfo = NULL; /* key info/value cache */ 161132451Srobertostruct value hostval; /* host value */ 162132451Srobertostruct value pubkey; /* public key */ 163285612Sdelphijstruct value tai_leap; /* leapseconds values */ 164285612Sdelphijstruct pkey_info *iffkey_info = NULL; /* IFF keys */ 165285612Sdelphijstruct pkey_info *gqkey_info = NULL; /* GQ keys */ 166285612Sdelphijstruct pkey_info *mvkey_info = NULL; /* MV keys */ 16782498Sroberto 16882498Sroberto/* 169132451Sroberto * Private cryptodata in host byte order 17082498Sroberto */ 171132451Srobertostatic char *passwd = NULL; /* private key password */ 172132451Srobertostatic EVP_PKEY *host_pkey = NULL; /* host key */ 173132451Srobertostatic EVP_PKEY *sign_pkey = NULL; /* sign key */ 174132451Srobertostatic const EVP_MD *sign_digest = NULL; /* sign digest */ 175132451Srobertostatic u_int sign_siglen; /* sign key length */ 176132451Srobertostatic char *rand_file = NULL; /* random seed file */ 17782498Sroberto 17882498Sroberto/* 17982498Sroberto * Cryptotypes 18082498Sroberto */ 181285612Sdelphijstatic int crypto_verify (struct exten *, struct value *, 182285612Sdelphij struct peer *); 183285612Sdelphijstatic int crypto_encrypt (const u_char *, u_int, keyid_t *, 184285612Sdelphij struct value *); 185285612Sdelphijstatic int crypto_alice (struct peer *, struct value *); 186285612Sdelphijstatic int crypto_alice2 (struct peer *, struct value *); 187285612Sdelphijstatic int crypto_alice3 (struct peer *, struct value *); 188285612Sdelphijstatic int crypto_bob (struct exten *, struct value *); 189285612Sdelphijstatic int crypto_bob2 (struct exten *, struct value *); 190285612Sdelphijstatic int crypto_bob3 (struct exten *, struct value *); 191285612Sdelphijstatic int crypto_iff (struct exten *, struct peer *); 192285612Sdelphijstatic int crypto_gq (struct exten *, struct peer *); 193285612Sdelphijstatic int crypto_mv (struct exten *, struct peer *); 194285612Sdelphijstatic int crypto_send (struct exten *, struct value *, int); 195285612Sdelphijstatic tstamp_t crypto_time (void); 196285612Sdelphijstatic void asn_to_calendar (ASN1_TIME *, struct calendar*); 197285612Sdelphijstatic struct cert_info *cert_parse (const u_char *, long, tstamp_t); 198285612Sdelphijstatic int cert_sign (struct exten *, struct value *); 199285612Sdelphijstatic struct cert_info *cert_install (struct exten *, struct peer *); 200285612Sdelphijstatic int cert_hike (struct peer *, struct cert_info *); 201285612Sdelphijstatic void cert_free (struct cert_info *); 202285612Sdelphijstatic struct pkey_info *crypto_key (char *, char *, sockaddr_u *); 203285612Sdelphijstatic void bighash (BIGNUM *, BIGNUM *); 204285612Sdelphijstatic struct cert_info *crypto_cert (char *); 205289999Sglebiusstatic u_int exten_payload_size(const struct exten *); 20682498Sroberto 207132451Sroberto#ifdef SYS_WINNT 208132451Srobertoint 209132451Srobertoreadlink(char * link, char * file, int len) { 210132451Sroberto return (-1); 211132451Sroberto} 212132451Sroberto#endif 21382498Sroberto 21482498Sroberto/* 21582498Sroberto * session_key - generate session key 21682498Sroberto * 21782498Sroberto * This routine generates a session key from the source address, 21882498Sroberto * destination address, key ID and private value. The value of the 21982498Sroberto * session key is the MD5 hash of these values, while the next key ID is 22082498Sroberto * the first four octets of the hash. 221132451Sroberto * 222285612Sdelphij * Returns the next key ID or 0 if there is no destination address. 22382498Sroberto */ 224132451Srobertokeyid_t 22582498Srobertosession_key( 226285612Sdelphij sockaddr_u *srcadr, /* source address */ 227285612Sdelphij sockaddr_u *dstadr, /* destination address */ 228132451Sroberto keyid_t keyno, /* key ID */ 229132451Sroberto keyid_t private, /* private value */ 230132451Sroberto u_long lifetime /* key lifetime */ 23182498Sroberto ) 23282498Sroberto{ 233310419Sdelphij EVP_MD_CTX *ctx; /* message digest context */ 234132451Sroberto u_char dgst[EVP_MAX_MD_SIZE]; /* message digest */ 235132451Sroberto keyid_t keyid; /* key identifer */ 236132451Sroberto u_int32 header[10]; /* data in network byte order */ 237132451Sroberto u_int hdlen, len; 23882498Sroberto 239182007Sroberto if (!dstadr) 240182007Sroberto return 0; 241182007Sroberto 24282498Sroberto /* 24382498Sroberto * Generate the session key and key ID. If the lifetime is 24482498Sroberto * greater than zero, install the key and call it trusted. 24582498Sroberto */ 246132451Sroberto hdlen = 0; 247285612Sdelphij switch(AF(srcadr)) { 248132451Sroberto case AF_INET: 249285612Sdelphij header[0] = NSRCADR(srcadr); 250285612Sdelphij header[1] = NSRCADR(dstadr); 251132451Sroberto header[2] = htonl(keyno); 252132451Sroberto header[3] = htonl(private); 253132451Sroberto hdlen = 4 * sizeof(u_int32); 254132451Sroberto break; 255182007Sroberto 256132451Sroberto case AF_INET6: 257285612Sdelphij memcpy(&header[0], PSOCK_ADDR6(srcadr), 258132451Sroberto sizeof(struct in6_addr)); 259285612Sdelphij memcpy(&header[4], PSOCK_ADDR6(dstadr), 260132451Sroberto sizeof(struct in6_addr)); 261132451Sroberto header[8] = htonl(keyno); 262132451Sroberto header[9] = htonl(private); 263132451Sroberto hdlen = 10 * sizeof(u_int32); 264132451Sroberto break; 265132451Sroberto } 266310419Sdelphij ctx = EVP_MD_CTX_new(); 267310419Sdelphij EVP_DigestInit(ctx, EVP_get_digestbynid(crypto_nid)); 268310419Sdelphij EVP_DigestUpdate(ctx, (u_char *)header, hdlen); 269310419Sdelphij EVP_DigestFinal(ctx, dgst, &len); 270310419Sdelphij EVP_MD_CTX_free(ctx); 271132451Sroberto memcpy(&keyid, dgst, 4); 27282498Sroberto keyid = ntohl(keyid); 27382498Sroberto if (lifetime != 0) { 274294904Sdelphij MD5auth_setkey(keyno, crypto_nid, dgst, len, NULL); 27582498Sroberto authtrust(keyno, lifetime); 27682498Sroberto } 277285612Sdelphij DPRINTF(2, ("session_key: %s > %s %08x %08x hash %08x life %lu\n", 278132451Sroberto stoa(srcadr), stoa(dstadr), keyno, 279285612Sdelphij private, keyid, lifetime)); 280285612Sdelphij 28182498Sroberto return (keyid); 28282498Sroberto} 28382498Sroberto 28482498Sroberto 28582498Sroberto/* 28682498Sroberto * make_keylist - generate key list 28782498Sroberto * 288182007Sroberto * Returns 289182007Sroberto * XEVNT_OK success 290285612Sdelphij * XEVNT_ERR protocol error 291182007Sroberto * 29282498Sroberto * This routine constructs a pseudo-random sequence by repeatedly 29382498Sroberto * hashing the session key starting from a given source address, 29482498Sroberto * destination address, private value and the next key ID of the 29582498Sroberto * preceeding session key. The last entry on the list is saved along 29682498Sroberto * with its sequence number and public signature. 29782498Sroberto */ 298182007Srobertoint 29982498Srobertomake_keylist( 30082498Sroberto struct peer *peer, /* peer structure pointer */ 30182498Sroberto struct interface *dstadr /* interface */ 30282498Sroberto ) 30382498Sroberto{ 304310419Sdelphij EVP_MD_CTX *ctx; /* signature context */ 305132451Sroberto tstamp_t tstamp; /* NTP timestamp */ 30682498Sroberto struct autokey *ap; /* autokey pointer */ 307132451Sroberto struct value *vp; /* value pointer */ 308132451Sroberto keyid_t keyid = 0; /* next key ID */ 309132451Sroberto keyid_t cookie; /* private value */ 310285612Sdelphij long lifetime; 311182007Sroberto u_int len, mpoll; 312132451Sroberto int i; 31382498Sroberto 314182007Sroberto if (!dstadr) 315285612Sdelphij return XEVNT_ERR; 316182007Sroberto 31782498Sroberto /* 31882498Sroberto * Allocate the key list if necessary. 31982498Sroberto */ 320132451Sroberto tstamp = crypto_time(); 32182498Sroberto if (peer->keylist == NULL) 322285612Sdelphij peer->keylist = eallocarray(NTP_MAXSESSION, 323285612Sdelphij sizeof(keyid_t)); 32482498Sroberto 32582498Sroberto /* 32682498Sroberto * Generate an initial key ID which is unique and greater than 32782498Sroberto * NTP_MAXKEY. 32882498Sroberto */ 32982498Sroberto while (1) { 330285612Sdelphij keyid = ntp_random() & 0xffffffff; 331285612Sdelphij if (keyid <= NTP_MAXKEY) 332285612Sdelphij continue; 333285612Sdelphij 33482498Sroberto if (authhavekey(keyid)) 33582498Sroberto continue; 33682498Sroberto break; 33782498Sroberto } 33882498Sroberto 33982498Sroberto /* 34082498Sroberto * Generate up to NTP_MAXSESSION session keys. Stop if the 34182498Sroberto * next one would not be unique or not a session key ID or if 34282498Sroberto * it would expire before the next poll. The private value 34382498Sroberto * included in the hash is zero if broadcast mode, the peer 34482498Sroberto * cookie if client mode or the host cookie if symmetric modes. 34582498Sroberto */ 346182007Sroberto mpoll = 1 << min(peer->ppoll, peer->hpoll); 347285612Sdelphij lifetime = min(1U << sys_automax, NTP_MAXSESSION * mpoll); 34882498Sroberto if (peer->hmode == MODE_BROADCAST) 34982498Sroberto cookie = 0; 35082498Sroberto else 351132451Sroberto cookie = peer->pcookie; 35282498Sroberto for (i = 0; i < NTP_MAXSESSION; i++) { 35382498Sroberto peer->keylist[i] = keyid; 35482498Sroberto peer->keynumber = i; 35582498Sroberto keyid = session_key(&dstadr->sin, &peer->srcadr, keyid, 356285612Sdelphij cookie, lifetime + mpoll); 357182007Sroberto lifetime -= mpoll; 35882498Sroberto if (auth_havekey(keyid) || keyid <= NTP_MAXKEY || 359285612Sdelphij lifetime < 0 || tstamp == 0) 36082498Sroberto break; 36182498Sroberto } 36282498Sroberto 36382498Sroberto /* 36482498Sroberto * Save the last session key ID, sequence number and timestamp, 36582498Sroberto * then sign these values for later retrieval by the clients. Be 366132451Sroberto * careful not to use invalid key media. Use the public values 367132451Sroberto * timestamp as filestamp. 36882498Sroberto */ 369132451Sroberto vp = &peer->sndval; 370132451Sroberto if (vp->ptr == NULL) 371132451Sroberto vp->ptr = emalloc(sizeof(struct autokey)); 372132451Sroberto ap = (struct autokey *)vp->ptr; 37382498Sroberto ap->seq = htonl(peer->keynumber); 37482498Sroberto ap->key = htonl(keyid); 375132451Sroberto vp->tstamp = htonl(tstamp); 376132451Sroberto vp->fstamp = hostval.tstamp; 377132451Sroberto vp->vallen = htonl(sizeof(struct autokey)); 378132451Sroberto vp->siglen = 0; 379182007Sroberto if (tstamp != 0) { 380132451Sroberto if (vp->sig == NULL) 381132451Sroberto vp->sig = emalloc(sign_siglen); 382310419Sdelphij ctx = EVP_MD_CTX_new(); 383310419Sdelphij EVP_SignInit(ctx, sign_digest); 384310419Sdelphij EVP_SignUpdate(ctx, (u_char *)vp, 12); 385310419Sdelphij EVP_SignUpdate(ctx, vp->ptr, sizeof(struct autokey)); 386310419Sdelphij if (EVP_SignFinal(ctx, vp->sig, &len, sign_pkey)) { 387289999Sglebius INSIST(len <= sign_siglen); 388132451Sroberto vp->siglen = htonl(len); 389285612Sdelphij peer->flags |= FLAG_ASSOC; 390285612Sdelphij } 391310419Sdelphij EVP_MD_CTX_free(ctx); 392132451Sroberto } 393285612Sdelphij DPRINTF(1, ("make_keys: %d %08x %08x ts %u fs %u poll %d\n", 394285612Sdelphij peer->keynumber, keyid, cookie, ntohl(vp->tstamp), 395285612Sdelphij ntohl(vp->fstamp), peer->hpoll)); 396182007Sroberto return (XEVNT_OK); 39782498Sroberto} 39882498Sroberto 39982498Sroberto 40082498Sroberto/* 40182498Sroberto * crypto_recv - parse extension fields 40282498Sroberto * 40382498Sroberto * This routine is called when the packet has been matched to an 40482498Sroberto * association and passed sanity, format and MAC checks. We believe the 40582498Sroberto * extension field values only if the field has proper format and 40682498Sroberto * length, the timestamp and filestamp are valid and the signature has 40782498Sroberto * valid length and is verified. There are a few cases where some values 408132451Sroberto * are believed even if the signature fails, but only if the proventic 40982498Sroberto * bit is not set. 410285612Sdelphij * 411285612Sdelphij * Returns 412285612Sdelphij * XEVNT_OK success 413285612Sdelphij * XEVNT_ERR protocol error 414285612Sdelphij * XEVNT_LEN bad field format or length 41582498Sroberto */ 416132451Srobertoint 41782498Srobertocrypto_recv( 41882498Sroberto struct peer *peer, /* peer structure pointer */ 41982498Sroberto struct recvbuf *rbufp /* packet buffer pointer */ 42082498Sroberto ) 42182498Sroberto{ 422132451Sroberto const EVP_MD *dp; /* message digest algorithm */ 423132451Sroberto u_int32 *pkt; /* receive packet pointer */ 424132451Sroberto struct autokey *ap, *bp; /* autokey pointer */ 425132451Sroberto struct exten *ep, *fp; /* extension pointers */ 426285612Sdelphij struct cert_info *xinfo; /* certificate info pointer */ 427289999Sglebius int macbytes; /* length of MAC field, signed by intention */ 428132451Sroberto int authlen; /* offset of MAC field */ 429132451Sroberto associd_t associd; /* association ID */ 430132451Sroberto tstamp_t fstamp = 0; /* filestamp */ 431132451Sroberto u_int len; /* extension field length */ 432132451Sroberto u_int code; /* extension field opcode */ 433132451Sroberto u_int vallen = 0; /* value length */ 434132451Sroberto X509 *cert; /* X509 certificate */ 435132451Sroberto char statstr[NTP_MAXSTRLEN]; /* statistics for filegen */ 436132451Sroberto keyid_t cookie; /* crumbles */ 437182007Sroberto int hismode; /* packet mode */ 438132451Sroberto int rval = XEVNT_OK; 439285612Sdelphij const u_char *puch; 440132451Sroberto u_int32 temp32; 44182498Sroberto 44282498Sroberto /* 44382498Sroberto * Initialize. Note that the packet has already been checked for 444132451Sroberto * valid format and extension field lengths. First extract the 445132451Sroberto * field length, command code and association ID in host byte 446132451Sroberto * order. These are used with all commands and modes. Then check 447132451Sroberto * the version number, which must be 2, and length, which must 448132451Sroberto * be at least 8 for requests and VALUE_LEN (24) for responses. 449132451Sroberto * Packets that fail either test sink without a trace. The 450132451Sroberto * association ID is saved only if nonzero. 45182498Sroberto */ 45282498Sroberto authlen = LEN_PKT_NOMAC; 453182007Sroberto hismode = (int)PKT_MODE((&rbufp->recv_pkt)->li_vn_mode); 454289999Sglebius while ((macbytes = rbufp->recv_length - authlen) > (int)MAX_MAC_LEN) { 455289999Sglebius /* We can be reasonably sure that we can read at least 456289999Sglebius * the opcode and the size field here. More stringent 457289999Sglebius * checks follow up shortly. 458289999Sglebius */ 459132451Sroberto pkt = (u_int32 *)&rbufp->recv_pkt + authlen / 4; 460132451Sroberto ep = (struct exten *)pkt; 461132451Sroberto code = ntohl(ep->opcode) & 0xffff0000; 462132451Sroberto len = ntohl(ep->opcode) & 0x0000ffff; 463285612Sdelphij // HMS: Why pkt[1] instead of ep->associd ? 464285612Sdelphij associd = (associd_t)ntohl(pkt[1]); 465132451Sroberto rval = XEVNT_OK; 466285612Sdelphij DPRINTF(1, ("crypto_recv: flags 0x%x ext offset %d len %u code 0x%x associd %d\n", 467132451Sroberto peer->crypto, authlen, len, code >> 16, 468285612Sdelphij associd)); 469132451Sroberto 470132451Sroberto /* 471132451Sroberto * Check version number and field length. If bad, 472132451Sroberto * quietly ignore the packet. 473132451Sroberto */ 474182007Sroberto if (((code >> 24) & 0x3f) != CRYPTO_VN || len < 8) { 475285612Sdelphij sys_badlength++; 476132451Sroberto code |= CRYPTO_ERROR; 477132451Sroberto } 478132451Sroberto 479289999Sglebius /* Check if the declared size fits into the remaining 480293893Sglebius * buffer. We *know* 'macbytes' > 0 here! 481289999Sglebius */ 482293893Sglebius if (len > (u_int)macbytes) { 483289999Sglebius DPRINTF(1, ("crypto_recv: possible attack detected, associd %d\n", 484289999Sglebius associd)); 485289999Sglebius return XEVNT_LEN; 486289999Sglebius } 487289999Sglebius 488289999Sglebius /* Check if the paylod of the extension fits into the 489289999Sglebius * declared frame. 490289999Sglebius */ 491132451Sroberto if (len >= VALUE_LEN) { 492132451Sroberto fstamp = ntohl(ep->fstamp); 493132451Sroberto vallen = ntohl(ep->vallen); 494281230Sdelphij /* 495281230Sdelphij * Bug 2761: I hope this isn't too early... 496281230Sdelphij */ 497281230Sdelphij if ( vallen == 0 498281230Sdelphij || len - VALUE_LEN < vallen) 499281230Sdelphij return XEVNT_LEN; 500132451Sroberto } 50182498Sroberto switch (code) { 50282498Sroberto 50382498Sroberto /* 504132451Sroberto * Install status word, host name, signature scheme and 505132451Sroberto * association ID. In OpenSSL the signature algorithm is 506132451Sroberto * bound to the digest algorithm, so the NID completely 507132451Sroberto * defines the signature scheme. Note the request and 508132451Sroberto * response are identical, but neither is validated by 509132451Sroberto * signature. The request is processed here only in 510182007Sroberto * symmetric modes. The server name field might be 511132451Sroberto * useful to implement access controls in future. 51282498Sroberto */ 513132451Sroberto case CRYPTO_ASSOC: 514132451Sroberto 515132451Sroberto /* 516285612Sdelphij * If our state machine is running when this 517285612Sdelphij * message arrives, the other fellow might have 518285612Sdelphij * restarted. However, this could be an 519285612Sdelphij * intruder, so just clamp the poll interval and 520285612Sdelphij * find out for ourselves. Otherwise, pass the 521285612Sdelphij * extension field to the transmit side. 522132451Sroberto */ 523285612Sdelphij if (peer->crypto & CRYPTO_FLAG_CERT) { 524182007Sroberto rval = XEVNT_ERR; 525182007Sroberto break; 526182007Sroberto } 527285612Sdelphij if (peer->cmmd) { 528285612Sdelphij if (peer->assoc != associd) { 529285612Sdelphij rval = XEVNT_ERR; 530285612Sdelphij break; 531285612Sdelphij } 532289999Sglebius free(peer->cmmd); /* will be set again! */ 533285612Sdelphij } 534132451Sroberto fp = emalloc(len); 535132451Sroberto memcpy(fp, ep, len); 536285612Sdelphij fp->associd = htonl(peer->associd); 537132451Sroberto peer->cmmd = fp; 538132451Sroberto /* fall through */ 539132451Sroberto 54082498Sroberto case CRYPTO_ASSOC | CRYPTO_RESP: 541132451Sroberto 542132451Sroberto /* 543132451Sroberto * Discard the message if it has already been 544182007Sroberto * stored or the message has been amputated. 545132451Sroberto */ 546285612Sdelphij if (peer->crypto) { 547285612Sdelphij if (peer->assoc != associd) 548285612Sdelphij rval = XEVNT_ERR; 549132451Sroberto break; 550285612Sdelphij } 551285612Sdelphij INSIST(len >= VALUE_LEN); 552182007Sroberto if (vallen == 0 || vallen > MAXHOSTNAME || 553281230Sdelphij len - VALUE_LEN < vallen) { 554132451Sroberto rval = XEVNT_LEN; 555132451Sroberto break; 55682498Sroberto } 557285612Sdelphij DPRINTF(1, ("crypto_recv: ident host 0x%x %d server 0x%x %d\n", 558285612Sdelphij crypto_flags, peer->associd, fstamp, 559285612Sdelphij peer->assoc)); 560285612Sdelphij temp32 = crypto_flags & CRYPTO_FLAG_MASK; 561132451Sroberto 562132451Sroberto /* 563285612Sdelphij * If the client scheme is PC, the server scheme 564285612Sdelphij * must be PC. The public key and identity are 565285612Sdelphij * presumed valid, so we skip the certificate 566285612Sdelphij * and identity exchanges and move immediately 567285612Sdelphij * to the cookie exchange which confirms the 568285612Sdelphij * server signature. 569132451Sroberto */ 570132451Sroberto if (crypto_flags & CRYPTO_FLAG_PRIV) { 571182007Sroberto if (!(fstamp & CRYPTO_FLAG_PRIV)) { 572132451Sroberto rval = XEVNT_KEY; 573182007Sroberto break; 574285612Sdelphij } 575285612Sdelphij fstamp |= CRYPTO_FLAG_CERT | 576285612Sdelphij CRYPTO_FLAG_VRFY | CRYPTO_FLAG_SIGN; 577182007Sroberto 578182007Sroberto /* 579285612Sdelphij * It is an error if either peer supports 580285612Sdelphij * identity, but the other does not. 581182007Sroberto */ 582285612Sdelphij } else if (hismode == MODE_ACTIVE || hismode == 583285612Sdelphij MODE_PASSIVE) { 584285612Sdelphij if ((temp32 && !(fstamp & 585285612Sdelphij CRYPTO_FLAG_MASK)) || 586285612Sdelphij (!temp32 && (fstamp & 587285612Sdelphij CRYPTO_FLAG_MASK))) { 588285612Sdelphij rval = XEVNT_KEY; 589285612Sdelphij break; 590285612Sdelphij } 591132451Sroberto } 592132451Sroberto 593132451Sroberto /* 594182007Sroberto * Discard the message if the signature digest 595182007Sroberto * NID is not supported. 596132451Sroberto */ 597132451Sroberto temp32 = (fstamp >> 16) & 0xffff; 598132451Sroberto dp = 599132451Sroberto (const EVP_MD *)EVP_get_digestbynid(temp32); 600182007Sroberto if (dp == NULL) { 601132451Sroberto rval = XEVNT_MD; 602132451Sroberto break; 603182007Sroberto } 604132451Sroberto 605132451Sroberto /* 606132451Sroberto * Save status word, host name and message 607285612Sdelphij * digest/signature type. If this is from a 608285612Sdelphij * broadcast and the association ID has changed, 609285612Sdelphij * request the autokey values. 610132451Sroberto */ 611285612Sdelphij peer->assoc = associd; 612285612Sdelphij if (hismode == MODE_SERVER) 613285612Sdelphij fstamp |= CRYPTO_FLAG_AUTO; 614285612Sdelphij if (!(fstamp & CRYPTO_FLAG_TAI)) 615285612Sdelphij fstamp |= CRYPTO_FLAG_LEAP; 616285612Sdelphij RAND_bytes((u_char *)&peer->hcookie, 4); 617132451Sroberto peer->crypto = fstamp; 618132451Sroberto peer->digest = dp; 619285612Sdelphij if (peer->subject != NULL) 620285612Sdelphij free(peer->subject); 621132451Sroberto peer->subject = emalloc(vallen + 1); 622132451Sroberto memcpy(peer->subject, ep->pkt, vallen); 623132451Sroberto peer->subject[vallen] = '\0'; 624285612Sdelphij if (peer->issuer != NULL) 625285612Sdelphij free(peer->issuer); 626285612Sdelphij peer->issuer = estrdup(peer->subject); 627285612Sdelphij snprintf(statstr, sizeof(statstr), 628285612Sdelphij "assoc %d %d host %s %s", peer->associd, 629285612Sdelphij peer->assoc, peer->subject, 630285612Sdelphij OBJ_nid2ln(temp32)); 631132451Sroberto record_crypto_stats(&peer->srcadr, statstr); 632285612Sdelphij DPRINTF(1, ("crypto_recv: %s\n", statstr)); 63382498Sroberto break; 63482498Sroberto 63582498Sroberto /* 636132451Sroberto * Decode X509 certificate in ASN.1 format and extract 637132451Sroberto * the data containing, among other things, subject 638132451Sroberto * name and public key. In the default identification 639132451Sroberto * scheme, the certificate trail is followed to a self 640132451Sroberto * signed trusted certificate. 64182498Sroberto */ 642132451Sroberto case CRYPTO_CERT | CRYPTO_RESP: 643132451Sroberto 644132451Sroberto /* 645285612Sdelphij * Discard the message if empty or invalid. 646132451Sroberto */ 647285612Sdelphij if (len < VALUE_LEN) 648285612Sdelphij break; 649285612Sdelphij 650132451Sroberto if ((rval = crypto_verify(ep, NULL, peer)) != 651132451Sroberto XEVNT_OK) 652132451Sroberto break; 653132451Sroberto 654132451Sroberto /* 655132451Sroberto * Scan the certificate list to delete old 656132451Sroberto * versions and link the newest version first on 657285612Sdelphij * the list. Then, verify the signature. If the 658285612Sdelphij * certificate is bad or missing, just ignore 659285612Sdelphij * it. 660132451Sroberto */ 661285612Sdelphij if ((xinfo = cert_install(ep, peer)) == NULL) { 662285612Sdelphij rval = XEVNT_CRT; 663132451Sroberto break; 664285612Sdelphij } 665285612Sdelphij if ((rval = cert_hike(peer, xinfo)) != XEVNT_OK) 666285612Sdelphij break; 667132451Sroberto 668132451Sroberto /* 669182007Sroberto * We plug in the public key and lifetime from 670132451Sroberto * the first certificate received. However, note 671132451Sroberto * that this certificate might not be signed by 672132451Sroberto * the server, so we can't check the 673132451Sroberto * signature/digest NID. 674132451Sroberto */ 675132451Sroberto if (peer->pkey == NULL) { 676285612Sdelphij puch = xinfo->cert.ptr; 677285612Sdelphij cert = d2i_X509(NULL, &puch, 678285612Sdelphij ntohl(xinfo->cert.vallen)); 679132451Sroberto peer->pkey = X509_get_pubkey(cert); 680132451Sroberto X509_free(cert); 68182498Sroberto } 682182007Sroberto peer->flash &= ~TEST8; 683285612Sdelphij temp32 = xinfo->nid; 684285612Sdelphij snprintf(statstr, sizeof(statstr), 685285612Sdelphij "cert %s %s 0x%x %s (%u) fs %u", 686285612Sdelphij xinfo->subject, xinfo->issuer, xinfo->flags, 687132451Sroberto OBJ_nid2ln(temp32), temp32, 688132451Sroberto ntohl(ep->fstamp)); 689132451Sroberto record_crypto_stats(&peer->srcadr, statstr); 690285612Sdelphij DPRINTF(1, ("crypto_recv: %s\n", statstr)); 69182498Sroberto break; 69282498Sroberto 69382498Sroberto /* 694285612Sdelphij * Schnorr (IFF) identity scheme. This scheme is 695285612Sdelphij * designed for use with shared secret server group keys 696285612Sdelphij * and where the certificate may be generated by a third 697285612Sdelphij * party. The client sends a challenge to the server, 698285612Sdelphij * which performs a calculation and returns the result. 699285612Sdelphij * A positive result is possible only if both client and 700132451Sroberto * server contain the same secret group key. 70182498Sroberto */ 702132451Sroberto case CRYPTO_IFF | CRYPTO_RESP: 70382498Sroberto 704132451Sroberto /* 705285612Sdelphij * Discard the message if invalid. 706132451Sroberto */ 707132451Sroberto if ((rval = crypto_verify(ep, NULL, peer)) != 708132451Sroberto XEVNT_OK) 709132451Sroberto break; 710132451Sroberto 71182498Sroberto /* 712285612Sdelphij * If the challenge matches the response, the 713285612Sdelphij * server public key, signature and identity are 714132451Sroberto * all verified at the same time. The server is 715132451Sroberto * declared trusted, so we skip further 716285612Sdelphij * certificate exchanges and move immediately to 717285612Sdelphij * the cookie exchange. 71882498Sroberto */ 719132451Sroberto if ((rval = crypto_iff(ep, peer)) != XEVNT_OK) 720132451Sroberto break; 721132451Sroberto 722285612Sdelphij peer->crypto |= CRYPTO_FLAG_VRFY; 723182007Sroberto peer->flash &= ~TEST8; 724285612Sdelphij snprintf(statstr, sizeof(statstr), "iff %s fs %u", 725285612Sdelphij peer->issuer, ntohl(ep->fstamp)); 726132451Sroberto record_crypto_stats(&peer->srcadr, statstr); 727285612Sdelphij DPRINTF(1, ("crypto_recv: %s\n", statstr)); 72882498Sroberto break; 72982498Sroberto 73082498Sroberto /* 731132451Sroberto * Guillou-Quisquater (GQ) identity scheme. This scheme 732132451Sroberto * is designed for use with public certificates carrying 733132451Sroberto * the GQ public key in an extension field. The client 734132451Sroberto * sends a challenge to the server, which performs a 735132451Sroberto * calculation and returns the result. A positive result 736132451Sroberto * is possible only if both client and server contain 737132451Sroberto * the same group key and the server has the matching GQ 738132451Sroberto * private key. 73982498Sroberto */ 740132451Sroberto case CRYPTO_GQ | CRYPTO_RESP: 741132451Sroberto 742132451Sroberto /* 743285612Sdelphij * Discard the message if invalid 744132451Sroberto */ 745132451Sroberto if ((rval = crypto_verify(ep, NULL, peer)) != 746132451Sroberto XEVNT_OK) 747132451Sroberto break; 748132451Sroberto 749132451Sroberto /* 750285612Sdelphij * If the challenge matches the response, the 751285612Sdelphij * server public key, signature and identity are 752132451Sroberto * all verified at the same time. The server is 753132451Sroberto * declared trusted, so we skip further 754285612Sdelphij * certificate exchanges and move immediately to 755285612Sdelphij * the cookie exchange. 756132451Sroberto */ 757132451Sroberto if ((rval = crypto_gq(ep, peer)) != XEVNT_OK) 758132451Sroberto break; 759132451Sroberto 760285612Sdelphij peer->crypto |= CRYPTO_FLAG_VRFY; 761182007Sroberto peer->flash &= ~TEST8; 762285612Sdelphij snprintf(statstr, sizeof(statstr), "gq %s fs %u", 763285612Sdelphij peer->issuer, ntohl(ep->fstamp)); 764132451Sroberto record_crypto_stats(&peer->srcadr, statstr); 765285612Sdelphij DPRINTF(1, ("crypto_recv: %s\n", statstr)); 76682498Sroberto break; 76782498Sroberto 76882498Sroberto /* 769285612Sdelphij * Mu-Varadharajan (MV) identity scheme. This scheme is 770285612Sdelphij * designed for use with three levels of trust, trusted 771285612Sdelphij * host, server and client. The trusted host key is 772285612Sdelphij * opaque to servers and clients; the server keys are 773285612Sdelphij * opaque to clients and each client key is different. 774285612Sdelphij * Client keys can be revoked without requiring new key 775285612Sdelphij * generations. 77682498Sroberto */ 777132451Sroberto case CRYPTO_MV | CRYPTO_RESP: 778132451Sroberto 779132451Sroberto /* 780285612Sdelphij * Discard the message if invalid. 781132451Sroberto */ 782132451Sroberto if ((rval = crypto_verify(ep, NULL, peer)) != 783132451Sroberto XEVNT_OK) 784132451Sroberto break; 785132451Sroberto 786132451Sroberto /* 787285612Sdelphij * If the challenge matches the response, the 788285612Sdelphij * server public key, signature and identity are 789132451Sroberto * all verified at the same time. The server is 790132451Sroberto * declared trusted, so we skip further 791285612Sdelphij * certificate exchanges and move immediately to 792285612Sdelphij * the cookie exchange. 793132451Sroberto */ 794132451Sroberto if ((rval = crypto_mv(ep, peer)) != XEVNT_OK) 795132451Sroberto break; 796132451Sroberto 797285612Sdelphij peer->crypto |= CRYPTO_FLAG_VRFY; 798182007Sroberto peer->flash &= ~TEST8; 799285612Sdelphij snprintf(statstr, sizeof(statstr), "mv %s fs %u", 800285612Sdelphij peer->issuer, ntohl(ep->fstamp)); 801132451Sroberto record_crypto_stats(&peer->srcadr, statstr); 802285612Sdelphij DPRINTF(1, ("crypto_recv: %s\n", statstr)); 803132451Sroberto break; 80482498Sroberto 805132451Sroberto 806132451Sroberto /* 807132451Sroberto * Cookie response in client and symmetric modes. If the 808132451Sroberto * cookie bit is set, the working cookie is the EXOR of 809132451Sroberto * the current and new values. 810132451Sroberto */ 811132451Sroberto case CRYPTO_COOK | CRYPTO_RESP: 812132451Sroberto 81382498Sroberto /* 814285612Sdelphij * Discard the message if invalid or signature 815285612Sdelphij * not verified with respect to the cookie 816285612Sdelphij * values. 81782498Sroberto */ 818132451Sroberto if ((rval = crypto_verify(ep, &peer->cookval, 819132451Sroberto peer)) != XEVNT_OK) 820132451Sroberto break; 821132451Sroberto 82282498Sroberto /* 823132451Sroberto * Decrypt the cookie, hunting all the time for 824132451Sroberto * errors. 82582498Sroberto */ 826285612Sdelphij if (vallen == (u_int)EVP_PKEY_size(host_pkey)) { 827310419Sdelphij RSA *rsa = EVP_PKEY_get0_RSA(host_pkey); 828310419Sdelphij u_int32 *cookiebuf = malloc(RSA_size(rsa)); 829285612Sdelphij if (!cookiebuf) { 830276072Sdelphij rval = XEVNT_CKY; 831276072Sdelphij break; 832276072Sdelphij } 833285612Sdelphij 834276072Sdelphij if (RSA_private_decrypt(vallen, 835132451Sroberto (u_char *)ep->pkt, 836276072Sdelphij (u_char *)cookiebuf, 837310419Sdelphij rsa, 838276072Sdelphij RSA_PKCS1_OAEP_PADDING) != 4) { 839276072Sdelphij rval = XEVNT_CKY; 840276072Sdelphij free(cookiebuf); 841276072Sdelphij break; 842276072Sdelphij } else { 843276072Sdelphij cookie = ntohl(*cookiebuf); 844276072Sdelphij free(cookiebuf); 845276072Sdelphij } 846132451Sroberto } else { 847132451Sroberto rval = XEVNT_CKY; 848132451Sroberto break; 849132451Sroberto } 85082498Sroberto 85182498Sroberto /* 852132451Sroberto * Install cookie values and light the cookie 853132451Sroberto * bit. If this is not broadcast client mode, we 854132451Sroberto * are done here. 85582498Sroberto */ 856132451Sroberto key_expire(peer); 857285612Sdelphij if (hismode == MODE_ACTIVE || hismode == 858285612Sdelphij MODE_PASSIVE) 859285612Sdelphij peer->pcookie = peer->hcookie ^ cookie; 860132451Sroberto else 861132451Sroberto peer->pcookie = cookie; 862285612Sdelphij peer->crypto |= CRYPTO_FLAG_COOK; 863182007Sroberto peer->flash &= ~TEST8; 864285612Sdelphij snprintf(statstr, sizeof(statstr), 865285612Sdelphij "cook %x ts %u fs %u", peer->pcookie, 866285612Sdelphij ntohl(ep->tstamp), ntohl(ep->fstamp)); 867132451Sroberto record_crypto_stats(&peer->srcadr, statstr); 868285612Sdelphij DPRINTF(1, ("crypto_recv: %s\n", statstr)); 86982498Sroberto break; 87082498Sroberto 87182498Sroberto /* 872132451Sroberto * Install autokey values in broadcast client and 873132451Sroberto * symmetric modes. We have to do this every time the 874132451Sroberto * sever/peer cookie changes or a new keylist is 875132451Sroberto * rolled. Ordinarily, this is automatic as this message 876132451Sroberto * is piggybacked on the first NTP packet sent upon 877132451Sroberto * either of these events. Note that a broadcast client 878132451Sroberto * or symmetric peer can receive this response without a 879132451Sroberto * matching request. 88082498Sroberto */ 881132451Sroberto case CRYPTO_AUTO | CRYPTO_RESP: 88282498Sroberto 883132451Sroberto /* 884285612Sdelphij * Discard the message if invalid or signature 885285612Sdelphij * not verified with respect to the receive 886285612Sdelphij * autokey values. 887132451Sroberto */ 888132451Sroberto if ((rval = crypto_verify(ep, &peer->recval, 889285612Sdelphij peer)) != XEVNT_OK) 890132451Sroberto break; 891132451Sroberto 89282498Sroberto /* 893285612Sdelphij * Discard the message if a broadcast client and 894285612Sdelphij * the association ID does not match. This might 895285612Sdelphij * happen if a broacast server restarts the 896285612Sdelphij * protocol. A protocol restart will occur at 897285612Sdelphij * the next ASSOC message. 898285612Sdelphij */ 899285612Sdelphij if ((peer->cast_flags & MDF_BCLNT) && 900285612Sdelphij peer->assoc != associd) 901285612Sdelphij break; 902285612Sdelphij 903285612Sdelphij /* 904132451Sroberto * Install autokey values and light the 905132451Sroberto * autokey bit. This is not hard. 90682498Sroberto */ 907285612Sdelphij if (ep->tstamp == 0) 908285612Sdelphij break; 909285612Sdelphij 910132451Sroberto if (peer->recval.ptr == NULL) 911132451Sroberto peer->recval.ptr = 912132451Sroberto emalloc(sizeof(struct autokey)); 913132451Sroberto bp = (struct autokey *)peer->recval.ptr; 914132451Sroberto peer->recval.tstamp = ep->tstamp; 915132451Sroberto peer->recval.fstamp = ep->fstamp; 916132451Sroberto ap = (struct autokey *)ep->pkt; 917132451Sroberto bp->seq = ntohl(ap->seq); 918132451Sroberto bp->key = ntohl(ap->key); 919132451Sroberto peer->pkeyid = bp->key; 920132451Sroberto peer->crypto |= CRYPTO_FLAG_AUTO; 921182007Sroberto peer->flash &= ~TEST8; 922285612Sdelphij snprintf(statstr, sizeof(statstr), 923132451Sroberto "auto seq %d key %x ts %u fs %u", bp->seq, 924132451Sroberto bp->key, ntohl(ep->tstamp), 925132451Sroberto ntohl(ep->fstamp)); 926132451Sroberto record_crypto_stats(&peer->srcadr, statstr); 927285612Sdelphij DPRINTF(1, ("crypto_recv: %s\n", statstr)); 92882498Sroberto break; 929182007Sroberto 930182007Sroberto /* 931182007Sroberto * X509 certificate sign response. Validate the 932182007Sroberto * certificate signed by the server and install. Later 933182007Sroberto * this can be provided to clients of this server in 934182007Sroberto * lieu of the self signed certificate in order to 935182007Sroberto * validate the public key. 936182007Sroberto */ 937182007Sroberto case CRYPTO_SIGN | CRYPTO_RESP: 93882498Sroberto 939182007Sroberto /* 940285612Sdelphij * Discard the message if invalid. 941182007Sroberto */ 942182007Sroberto if ((rval = crypto_verify(ep, NULL, peer)) != 943182007Sroberto XEVNT_OK) 944182007Sroberto break; 945182007Sroberto 946182007Sroberto /* 947182007Sroberto * Scan the certificate list to delete old 948182007Sroberto * versions and link the newest version first on 949182007Sroberto * the list. 950182007Sroberto */ 951285612Sdelphij if ((xinfo = cert_install(ep, peer)) == NULL) { 952285612Sdelphij rval = XEVNT_CRT; 953182007Sroberto break; 954285612Sdelphij } 955182007Sroberto peer->crypto |= CRYPTO_FLAG_SIGN; 956182007Sroberto peer->flash &= ~TEST8; 957285612Sdelphij temp32 = xinfo->nid; 958285612Sdelphij snprintf(statstr, sizeof(statstr), 959285612Sdelphij "sign %s %s 0x%x %s (%u) fs %u", 960285612Sdelphij xinfo->subject, xinfo->issuer, xinfo->flags, 961182007Sroberto OBJ_nid2ln(temp32), temp32, 962182007Sroberto ntohl(ep->fstamp)); 963182007Sroberto record_crypto_stats(&peer->srcadr, statstr); 964285612Sdelphij DPRINTF(1, ("crypto_recv: %s\n", statstr)); 965182007Sroberto break; 966182007Sroberto 96782498Sroberto /* 968285612Sdelphij * Install leapseconds values. While the leapsecond 969285612Sdelphij * values epoch, TAI offset and values expiration epoch 970285612Sdelphij * are retained, only the current TAI offset is provided 971285612Sdelphij * via the kernel to other applications. 97282498Sroberto */ 973285612Sdelphij case CRYPTO_LEAP | CRYPTO_RESP: 974132451Sroberto /* 975285612Sdelphij * Discard the message if invalid. We can't 976285612Sdelphij * compare the value timestamps here, as they 977285612Sdelphij * can be updated by different servers. 978132451Sroberto */ 979285612Sdelphij rval = crypto_verify(ep, NULL, peer); 980285612Sdelphij if ((rval != XEVNT_OK ) || 981285612Sdelphij (vallen != 3*sizeof(uint32_t)) ) 982132451Sroberto break; 983132451Sroberto 984285612Sdelphij /* Check if we can update the basic TAI offset 985285612Sdelphij * for our current leap frame. This is a hack 986285612Sdelphij * and ignores the time stamps in the autokey 987285612Sdelphij * message. 988132451Sroberto */ 989285612Sdelphij if (sys_leap != LEAP_NOTINSYNC) 990285612Sdelphij leapsec_autokey_tai(ntohl(ep->pkt[0]), 991285612Sdelphij rbufp->recv_time.l_ui, NULL); 992285612Sdelphij tai_leap.tstamp = ep->tstamp; 993285612Sdelphij tai_leap.fstamp = ep->fstamp; 994285612Sdelphij crypto_update(); 995285612Sdelphij mprintf_event(EVNT_TAI, peer, 996285612Sdelphij "%d seconds", ntohl(ep->pkt[0])); 997132451Sroberto peer->crypto |= CRYPTO_FLAG_LEAP; 998182007Sroberto peer->flash &= ~TEST8; 999285612Sdelphij snprintf(statstr, sizeof(statstr), 1000285612Sdelphij "leap TAI offset %d at %u expire %u fs %u", 1001285612Sdelphij ntohl(ep->pkt[0]), ntohl(ep->pkt[1]), 1002285612Sdelphij ntohl(ep->pkt[2]), ntohl(ep->fstamp)); 1003132451Sroberto record_crypto_stats(&peer->srcadr, statstr); 1004285612Sdelphij DPRINTF(1, ("crypto_recv: %s\n", statstr)); 100582498Sroberto break; 100682498Sroberto 100782498Sroberto /* 1008132451Sroberto * We come here in symmetric modes for miscellaneous 1009132451Sroberto * commands that have value fields but are processed on 1010132451Sroberto * the transmit side. All we need do here is check for 1011285612Sdelphij * valid field length. Note that ASSOC is handled 1012285612Sdelphij * separately. 101382498Sroberto */ 1014182007Sroberto case CRYPTO_CERT: 1015132451Sroberto case CRYPTO_IFF: 1016132451Sroberto case CRYPTO_GQ: 1017132451Sroberto case CRYPTO_MV: 1018285612Sdelphij case CRYPTO_COOK: 1019132451Sroberto case CRYPTO_SIGN: 1020132451Sroberto if (len < VALUE_LEN) { 1021132451Sroberto rval = XEVNT_LEN; 102282498Sroberto break; 1023132451Sroberto } 1024132451Sroberto /* fall through */ 1025132451Sroberto 1026132451Sroberto /* 1027285612Sdelphij * We come here in symmetric modes for requests 1028285612Sdelphij * requiring a response (above plus AUTO and LEAP) and 1029285612Sdelphij * for responses. If a request, save the extension field 1030285612Sdelphij * for later; invalid requests will be caught on the 1031285612Sdelphij * transmit side. If an error or invalid response, 1032285612Sdelphij * declare a protocol error. 1033132451Sroberto */ 1034132451Sroberto default: 1035132451Sroberto if (code & (CRYPTO_RESP | CRYPTO_ERROR)) { 1036182007Sroberto rval = XEVNT_ERR; 1037285612Sdelphij } else if (peer->cmmd == NULL) { 1038132451Sroberto fp = emalloc(len); 1039132451Sroberto memcpy(fp, ep, len); 1040132451Sroberto peer->cmmd = fp; 1041132451Sroberto } 104282498Sroberto } 1043132451Sroberto 1044132451Sroberto /* 1045132451Sroberto * The first error found terminates the extension field 1046285612Sdelphij * scan and we return the laundry to the caller. 1047132451Sroberto */ 1048285612Sdelphij if (rval != XEVNT_OK) { 1049285612Sdelphij snprintf(statstr, sizeof(statstr), 1050285612Sdelphij "%04x %d %02x %s", htonl(ep->opcode), 1051285612Sdelphij associd, rval, eventstr(rval)); 1052182007Sroberto record_crypto_stats(&peer->srcadr, statstr); 1053285612Sdelphij DPRINTF(1, ("crypto_recv: %s\n", statstr)); 1054285612Sdelphij return (rval); 1055132451Sroberto } 1056285612Sdelphij authlen += (len + 3) / 4 * 4; 105782498Sroberto } 1058132451Sroberto return (rval); 105982498Sroberto} 106082498Sroberto 106182498Sroberto 106282498Sroberto/* 106382498Sroberto * crypto_xmit - construct extension fields 106482498Sroberto * 106582498Sroberto * This routine is called both when an association is configured and 1066132451Sroberto * when one is not. The only case where this matters is to retrieve the 1067132451Sroberto * autokey information, in which case the caller has to provide the 106882498Sroberto * association ID to match the association. 1069132451Sroberto * 1070285612Sdelphij * Side effect: update the packet offset. 1071285612Sdelphij * 1072285612Sdelphij * Errors 1073285612Sdelphij * XEVNT_OK success 1074285612Sdelphij * XEVNT_CRT bad or missing certificate 1075285612Sdelphij * XEVNT_ERR protocol error 1076285612Sdelphij * XEVNT_LEN bad field format or length 1077285612Sdelphij * XEVNT_PER host certificate expired 107882498Sroberto */ 1079132451Srobertoint 108082498Srobertocrypto_xmit( 1081285612Sdelphij struct peer *peer, /* peer structure pointer */ 1082132451Sroberto struct pkt *xpkt, /* transmit packet pointer */ 1083285612Sdelphij struct recvbuf *rbufp, /* receive buffer pointer */ 1084132451Sroberto int start, /* offset to extension field */ 1085132451Sroberto struct exten *ep, /* extension pointer */ 1086132451Sroberto keyid_t cookie /* session cookie */ 108782498Sroberto ) 108882498Sroberto{ 1089285612Sdelphij struct exten *fp; /* extension pointers */ 1090285612Sdelphij struct cert_info *cp, *xp, *yp; /* cert info/value pointer */ 1091285612Sdelphij sockaddr_u *srcadr_sin; /* source address */ 1092132451Sroberto u_int32 *pkt; /* packet pointer */ 1093132451Sroberto u_int opcode; /* extension field opcode */ 1094132451Sroberto char certname[MAXHOSTNAME + 1]; /* subject name buffer */ 1095132451Sroberto char statstr[NTP_MAXSTRLEN]; /* statistics for filegen */ 1096182007Sroberto tstamp_t tstamp; 1097285612Sdelphij struct calendar tscal; 1098132451Sroberto u_int vallen; 1099132451Sroberto struct value vtemp; 1100132451Sroberto associd_t associd; 1101132451Sroberto int rval; 1102285612Sdelphij int len; 1103132451Sroberto keyid_t tcookie; 110482498Sroberto 110582498Sroberto /* 110682498Sroberto * Generate the requested extension field request code, length 1107132451Sroberto * and association ID. If this is a response and the host is not 1108132451Sroberto * synchronized, light the error bit and go home. 110982498Sroberto */ 1110132451Sroberto pkt = (u_int32 *)xpkt + start / 4; 1111132451Sroberto fp = (struct exten *)pkt; 1112132451Sroberto opcode = ntohl(ep->opcode); 1113285612Sdelphij if (peer != NULL) { 1114285612Sdelphij srcadr_sin = &peer->srcadr; 1115285612Sdelphij if (!(opcode & CRYPTO_RESP)) 1116285612Sdelphij peer->opcode = ep->opcode; 1117285612Sdelphij } else { 1118285612Sdelphij srcadr_sin = &rbufp->recv_srcadr; 1119285612Sdelphij } 1120132451Sroberto associd = (associd_t) ntohl(ep->associd); 112182498Sroberto len = 8; 1122285612Sdelphij fp->opcode = htonl((opcode & 0xffff0000) | len); 1123285612Sdelphij fp->associd = ep->associd; 1124132451Sroberto rval = XEVNT_OK; 1125182007Sroberto tstamp = crypto_time(); 1126132451Sroberto switch (opcode & 0xffff0000) { 112782498Sroberto 112882498Sroberto /* 1129132451Sroberto * Send association request and response with status word and 1130132451Sroberto * host name. Note, this message is not signed and the filestamp 1131182007Sroberto * contains only the status word. 113282498Sroberto */ 1133285612Sdelphij case CRYPTO_ASSOC: 113482498Sroberto case CRYPTO_ASSOC | CRYPTO_RESP: 1135285612Sdelphij len = crypto_send(fp, &hostval, start); 1136182007Sroberto fp->fstamp = htonl(crypto_flags); 1137182007Sroberto break; 1138182007Sroberto 113982498Sroberto /* 1140132451Sroberto * Send certificate request. Use the values from the extension 1141132451Sroberto * field. 114282498Sroberto */ 1143132451Sroberto case CRYPTO_CERT: 1144132451Sroberto memset(&vtemp, 0, sizeof(vtemp)); 1145132451Sroberto vtemp.tstamp = ep->tstamp; 1146132451Sroberto vtemp.fstamp = ep->fstamp; 1147132451Sroberto vtemp.vallen = ep->vallen; 1148182007Sroberto vtemp.ptr = (u_char *)ep->pkt; 1149285612Sdelphij len = crypto_send(fp, &vtemp, start); 1150132451Sroberto break; 1151132451Sroberto 1152132451Sroberto /* 1153285612Sdelphij * Send sign request. Use the host certificate, which is self- 1154285612Sdelphij * signed and may or may not be trusted. 1155132451Sroberto */ 1156132451Sroberto case CRYPTO_SIGN: 1157285612Sdelphij (void)ntpcal_ntp_to_date(&tscal, tstamp, NULL); 1158285612Sdelphij if ((calcomp(&tscal, &(cert_host->first)) < 0) 1159285612Sdelphij || (calcomp(&tscal, &(cert_host->last)) > 0)) 1160285612Sdelphij rval = XEVNT_PER; 1161285612Sdelphij else 1162285612Sdelphij len = crypto_send(fp, &cert_host->cert, start); 1163285612Sdelphij break; 1164285612Sdelphij 1165285612Sdelphij /* 1166285612Sdelphij * Send certificate response. Use the name in the extension 1167285612Sdelphij * field to find the certificate in the cache. If the request 1168285612Sdelphij * contains no subject name, assume the name of this host. This 1169285612Sdelphij * is for backwards compatibility. Private certificates are 1170285612Sdelphij * never sent. 1171285612Sdelphij * 1172285612Sdelphij * There may be several certificates matching the request. First 1173285612Sdelphij * choice is a self-signed trusted certificate; second choice is 1174285612Sdelphij * any certificate signed by another host. There is no third 1175285612Sdelphij * choice. 1176285612Sdelphij */ 1177132451Sroberto case CRYPTO_CERT | CRYPTO_RESP: 1178289999Sglebius vallen = exten_payload_size(ep); /* Must be <64k */ 1179289999Sglebius if (vallen == 0 || vallen >= sizeof(certname) ) { 1180182007Sroberto rval = XEVNT_LEN; 118182498Sroberto break; 118282498Sroberto } 1183182007Sroberto 1184182007Sroberto /* 1185285612Sdelphij * Find all public valid certificates with matching 1186285612Sdelphij * subject. If a self-signed, trusted certificate is 1187285612Sdelphij * found, use that certificate. If not, use the last non 1188285612Sdelphij * self-signed certificate. 1189182007Sroberto */ 1190285612Sdelphij memcpy(certname, ep->pkt, vallen); 1191285612Sdelphij certname[vallen] = '\0'; 1192285612Sdelphij xp = yp = NULL; 1193132451Sroberto for (cp = cinfo; cp != NULL; cp = cp->link) { 1194285612Sdelphij if (cp->flags & (CERT_PRIV | CERT_ERROR)) 1195132451Sroberto continue; 1196182007Sroberto 1197285612Sdelphij if (strcmp(certname, cp->subject) != 0) 1198285612Sdelphij continue; 1199285612Sdelphij 1200285612Sdelphij if (strcmp(certname, cp->issuer) != 0) 1201285612Sdelphij yp = cp; 1202285612Sdelphij else if (cp ->flags & CERT_TRUST) 1203285612Sdelphij xp = cp; 1204285612Sdelphij continue; 1205132451Sroberto } 1206182007Sroberto 1207182007Sroberto /* 1208285612Sdelphij * Be careful who you trust. If the certificate is not 1209285612Sdelphij * found, return an empty response. Note that we dont 1210285612Sdelphij * enforce lifetimes here. 1211182007Sroberto * 1212285612Sdelphij * The timestamp and filestamp are taken from the 1213182007Sroberto * certificate value structure. For all certificates the 1214182007Sroberto * timestamp is the latest signature update time. For 1215182007Sroberto * host and imported certificates the filestamp is the 1216182007Sroberto * creation epoch. For signed certificates the filestamp 1217182007Sroberto * is the creation epoch of the trusted certificate at 1218285612Sdelphij * the root of the certificate trail. In principle, this 1219182007Sroberto * allows strong checking for signature masquerade. 1220182007Sroberto */ 1221285612Sdelphij if (xp == NULL) 1222285612Sdelphij xp = yp; 1223285612Sdelphij if (xp == NULL) 1224285612Sdelphij break; 1225285612Sdelphij 1226182007Sroberto if (tstamp == 0) 1227182007Sroberto break; 1228182007Sroberto 1229285612Sdelphij len = crypto_send(fp, &xp->cert, start); 123082498Sroberto break; 123182498Sroberto 123282498Sroberto /* 1233132451Sroberto * Send challenge in Schnorr (IFF) identity scheme. 123482498Sroberto */ 1235132451Sroberto case CRYPTO_IFF: 1236285612Sdelphij if (peer == NULL) 1237285612Sdelphij break; /* hack attack */ 1238285612Sdelphij 1239182007Sroberto if ((rval = crypto_alice(peer, &vtemp)) == XEVNT_OK) { 1240285612Sdelphij len = crypto_send(fp, &vtemp, start); 1241182007Sroberto value_free(&vtemp); 1242182007Sroberto } 124382498Sroberto break; 124482498Sroberto 124582498Sroberto /* 1246132451Sroberto * Send response in Schnorr (IFF) identity scheme. 124782498Sroberto */ 1248132451Sroberto case CRYPTO_IFF | CRYPTO_RESP: 1249182007Sroberto if ((rval = crypto_bob(ep, &vtemp)) == XEVNT_OK) { 1250285612Sdelphij len = crypto_send(fp, &vtemp, start); 1251182007Sroberto value_free(&vtemp); 1252182007Sroberto } 1253132451Sroberto break; 1254132451Sroberto 125582498Sroberto /* 1256132451Sroberto * Send challenge in Guillou-Quisquater (GQ) identity scheme. 125782498Sroberto */ 1258132451Sroberto case CRYPTO_GQ: 1259285612Sdelphij if (peer == NULL) 1260285612Sdelphij break; /* hack attack */ 1261285612Sdelphij 1262182007Sroberto if ((rval = crypto_alice2(peer, &vtemp)) == XEVNT_OK) { 1263285612Sdelphij len = crypto_send(fp, &vtemp, start); 1264182007Sroberto value_free(&vtemp); 1265182007Sroberto } 126682498Sroberto break; 126782498Sroberto 126882498Sroberto /* 1269132451Sroberto * Send response in Guillou-Quisquater (GQ) identity scheme. 127082498Sroberto */ 1271132451Sroberto case CRYPTO_GQ | CRYPTO_RESP: 1272182007Sroberto if ((rval = crypto_bob2(ep, &vtemp)) == XEVNT_OK) { 1273285612Sdelphij len = crypto_send(fp, &vtemp, start); 1274182007Sroberto value_free(&vtemp); 1275182007Sroberto } 1276132451Sroberto break; 1277132451Sroberto 1278132451Sroberto /* 1279132451Sroberto * Send challenge in MV identity scheme. 1280132451Sroberto */ 1281132451Sroberto case CRYPTO_MV: 1282285612Sdelphij if (peer == NULL) 1283285612Sdelphij break; /* hack attack */ 1284285612Sdelphij 1285182007Sroberto if ((rval = crypto_alice3(peer, &vtemp)) == XEVNT_OK) { 1286285612Sdelphij len = crypto_send(fp, &vtemp, start); 1287182007Sroberto value_free(&vtemp); 1288182007Sroberto } 128982498Sroberto break; 129082498Sroberto 129182498Sroberto /* 1292132451Sroberto * Send response in MV identity scheme. 129382498Sroberto */ 1294132451Sroberto case CRYPTO_MV | CRYPTO_RESP: 1295182007Sroberto if ((rval = crypto_bob3(ep, &vtemp)) == XEVNT_OK) { 1296285612Sdelphij len = crypto_send(fp, &vtemp, start); 1297182007Sroberto value_free(&vtemp); 1298182007Sroberto } 1299132451Sroberto break; 1300132451Sroberto 1301132451Sroberto /* 1302132451Sroberto * Send certificate sign response. The integrity of the request 1303132451Sroberto * certificate has already been verified on the receive side. 1304132451Sroberto * Sign the response using the local server key. Use the 1305132451Sroberto * filestamp from the request and use the timestamp as the 1306132451Sroberto * current time. Light the error bit if the certificate is 1307132451Sroberto * invalid or contains an unverified signature. 1308132451Sroberto */ 1309132451Sroberto case CRYPTO_SIGN | CRYPTO_RESP: 1310285612Sdelphij if ((rval = cert_sign(ep, &vtemp)) == XEVNT_OK) { 1311285612Sdelphij len = crypto_send(fp, &vtemp, start); 1312285612Sdelphij value_free(&vtemp); 1313285612Sdelphij } 1314132451Sroberto break; 1315132451Sroberto 1316132451Sroberto /* 1317132451Sroberto * Send public key and signature. Use the values from the public 1318132451Sroberto * key. 1319132451Sroberto */ 1320132451Sroberto case CRYPTO_COOK: 1321285612Sdelphij len = crypto_send(fp, &pubkey, start); 1322132451Sroberto break; 1323132451Sroberto 1324132451Sroberto /* 1325132451Sroberto * Encrypt and send cookie and signature. Light the error bit if 1326132451Sroberto * anything goes wrong. 1327132451Sroberto */ 1328132451Sroberto case CRYPTO_COOK | CRYPTO_RESP: 1329281230Sdelphij vallen = ntohl(ep->vallen); /* Must be <64k */ 1330281230Sdelphij if ( vallen == 0 1331281230Sdelphij || (vallen >= MAX_VALLEN) 1332281230Sdelphij || (opcode & 0x0000ffff) < VALUE_LEN + vallen) { 1333182007Sroberto rval = XEVNT_LEN; 133482498Sroberto break; 133582498Sroberto } 1336285612Sdelphij if (peer == NULL) 1337132451Sroberto tcookie = cookie; 1338285612Sdelphij else 1339285612Sdelphij tcookie = peer->hcookie; 1340281230Sdelphij if ((rval = crypto_encrypt((const u_char *)ep->pkt, vallen, &tcookie, &vtemp)) 1341281230Sdelphij == XEVNT_OK) { 1342285612Sdelphij len = crypto_send(fp, &vtemp, start); 1343281230Sdelphij value_free(&vtemp); 1344281230Sdelphij } 134582498Sroberto break; 134682498Sroberto 134782498Sroberto /* 1348132451Sroberto * Find peer and send autokey data and signature in broadcast 1349132451Sroberto * server and symmetric modes. Use the values in the autokey 1350132451Sroberto * structure. If no association is found, either the server has 1351132451Sroberto * restarted with new associations or some perp has replayed an 1352132451Sroberto * old message, in which case light the error bit. 135382498Sroberto */ 1354132451Sroberto case CRYPTO_AUTO | CRYPTO_RESP: 1355285612Sdelphij if (peer == NULL) { 1356285612Sdelphij if ((peer = findpeerbyassoc(associd)) == NULL) { 1357285612Sdelphij rval = XEVNT_ERR; 1358285612Sdelphij break; 1359285612Sdelphij } 136082498Sroberto } 1361132451Sroberto peer->flags &= ~FLAG_ASSOC; 1362285612Sdelphij len = crypto_send(fp, &peer->sndval, start); 136382498Sroberto break; 136482498Sroberto 136582498Sroberto /* 1366285612Sdelphij * Send leapseconds values and signature. Use the values from 1367285612Sdelphij * the tai structure. If no table has been loaded, just send an 1368182007Sroberto * empty request. 136982498Sroberto */ 1370285612Sdelphij case CRYPTO_LEAP | CRYPTO_RESP: 1371285612Sdelphij len = crypto_send(fp, &tai_leap, start); 137282498Sroberto break; 137382498Sroberto 137482498Sroberto /* 1375285612Sdelphij * Default - Send a valid command for unknown requests; send 1376285612Sdelphij * an error response for unknown resonses. 137782498Sroberto */ 137882498Sroberto default: 137982498Sroberto if (opcode & CRYPTO_RESP) 1380182007Sroberto rval = XEVNT_ERR; 138182498Sroberto } 138282498Sroberto 138382498Sroberto /* 1384182007Sroberto * In case of error, flame the log. If a request, toss the 1385182007Sroberto * puppy; if a response, return so the sender can flame, too. 1386132451Sroberto */ 1387182007Sroberto if (rval != XEVNT_OK) { 1388285612Sdelphij u_int32 uint32; 1389285612Sdelphij 1390285612Sdelphij uint32 = CRYPTO_ERROR; 1391285612Sdelphij opcode |= uint32; 1392285612Sdelphij fp->opcode |= htonl(uint32); 1393285612Sdelphij snprintf(statstr, sizeof(statstr), 1394285612Sdelphij "%04x %d %02x %s", opcode, associd, rval, 1395285612Sdelphij eventstr(rval)); 1396132451Sroberto record_crypto_stats(srcadr_sin, statstr); 1397285612Sdelphij DPRINTF(1, ("crypto_xmit: %s\n", statstr)); 1398182007Sroberto if (!(opcode & CRYPTO_RESP)) 1399182007Sroberto return (0); 1400132451Sroberto } 1401285612Sdelphij DPRINTF(1, ("crypto_xmit: flags 0x%x offset %d len %d code 0x%x associd %d\n", 1402285612Sdelphij crypto_flags, start, len, opcode >> 16, associd)); 140382498Sroberto return (len); 140482498Sroberto} 140582498Sroberto 1406132451Sroberto 140782498Sroberto/* 1408285612Sdelphij * crypto_verify - verify the extension field value and signature 1409132451Sroberto * 1410132451Sroberto * Returns 1411132451Sroberto * XEVNT_OK success 1412285612Sdelphij * XEVNT_ERR protocol error 1413285612Sdelphij * XEVNT_FSP bad filestamp 1414132451Sroberto * XEVNT_LEN bad field format or length 1415132451Sroberto * XEVNT_PUB bad or missing public key 1416132451Sroberto * XEVNT_SGL bad signature length 1417132451Sroberto * XEVNT_SIG signature not verified 1418285612Sdelphij * XEVNT_TSP bad timestamp 141982498Sroberto */ 1420132451Srobertostatic int 1421132451Srobertocrypto_verify( 1422132451Sroberto struct exten *ep, /* extension pointer */ 1423132451Sroberto struct value *vp, /* value pointer */ 1424132451Sroberto struct peer *peer /* peer structure pointer */ 1425132451Sroberto ) 142682498Sroberto{ 1427132451Sroberto EVP_PKEY *pkey; /* server public key */ 1428310419Sdelphij EVP_MD_CTX *ctx; /* signature context */ 1429182007Sroberto tstamp_t tstamp, tstamp1 = 0; /* timestamp */ 1430182007Sroberto tstamp_t fstamp, fstamp1 = 0; /* filestamp */ 1431132451Sroberto u_int vallen; /* value length */ 1432132451Sroberto u_int siglen; /* signature length */ 1433132451Sroberto u_int opcode, len; 1434132451Sroberto int i; 143582498Sroberto 143682498Sroberto /* 1437285612Sdelphij * We are extremely parannoyed. We require valid opcode, length, 1438285612Sdelphij * association ID, timestamp, filestamp, public key, digest, 1439285612Sdelphij * signature length and signature, where relevant. Note that 1440285612Sdelphij * preliminary length checks are done in the main loop. 144182498Sroberto */ 1442132451Sroberto len = ntohl(ep->opcode) & 0x0000ffff; 1443132451Sroberto opcode = ntohl(ep->opcode) & 0xffff0000; 144482498Sroberto 144582498Sroberto /* 1446285612Sdelphij * Check for valid value header, association ID and extension 1447285612Sdelphij * field length. Remember, it is not an error to receive an 1448285612Sdelphij * unsolicited response; however, the response ID must match 1449285612Sdelphij * the association ID. 145082498Sroberto */ 1451132451Sroberto if (opcode & CRYPTO_ERROR) 1452182007Sroberto return (XEVNT_ERR); 1453182007Sroberto 1454285612Sdelphij if (len < VALUE_LEN) 1455285612Sdelphij return (XEVNT_LEN); 1456285612Sdelphij 1457285612Sdelphij if (opcode == (CRYPTO_AUTO | CRYPTO_RESP) && (peer->pmode == 1458285612Sdelphij MODE_BROADCAST || (peer->cast_flags & MDF_BCLNT))) { 1459285612Sdelphij if (ntohl(ep->associd) != peer->assoc) 1460285612Sdelphij return (XEVNT_ERR); 1461132451Sroberto } else { 1462285612Sdelphij if (ntohl(ep->associd) != peer->associd) 1463285612Sdelphij return (XEVNT_ERR); 1464132451Sroberto } 1465182007Sroberto 1466132451Sroberto /* 1467285612Sdelphij * We have a valid value header. Check for valid value and 1468285612Sdelphij * signature field lengths. The extension field length must be 1469285612Sdelphij * long enough to contain the value header, value and signature. 1470285612Sdelphij * Note both the value and signature field lengths are rounded 1471285612Sdelphij * up to the next word (4 octets). 1472132451Sroberto */ 1473132451Sroberto vallen = ntohl(ep->vallen); 1474281230Sdelphij if ( vallen == 0 1475281230Sdelphij || vallen > MAX_VALLEN) 1476281230Sdelphij return (XEVNT_LEN); 1477285612Sdelphij 1478132451Sroberto i = (vallen + 3) / 4; 1479132451Sroberto siglen = ntohl(ep->pkt[i++]); 1480281230Sdelphij if ( siglen > MAX_VALLEN 1481281230Sdelphij || len - VALUE_LEN < ((vallen + 3) / 4) * 4 1482281230Sdelphij || len - VALUE_LEN - ((vallen + 3) / 4) * 4 1483281230Sdelphij < ((siglen + 3) / 4) * 4) 1484132451Sroberto return (XEVNT_LEN); 1485132451Sroberto 1486182007Sroberto /* 1487182007Sroberto * Check for valid timestamp and filestamp. If the timestamp is 1488182007Sroberto * zero, the sender is not synchronized and signatures are 1489285612Sdelphij * not possible. If nonzero the timestamp must not precede the 1490182007Sroberto * filestamp. The timestamp and filestamp must not precede the 1491285612Sdelphij * corresponding values in the value structure, if present. 1492285612Sdelphij */ 1493182007Sroberto tstamp = ntohl(ep->tstamp); 1494182007Sroberto fstamp = ntohl(ep->fstamp); 1495182007Sroberto if (tstamp == 0) 1496285612Sdelphij return (XEVNT_TSP); 1497182007Sroberto 1498182007Sroberto if (tstamp < fstamp) 1499182007Sroberto return (XEVNT_TSP); 1500182007Sroberto 1501182007Sroberto if (vp != NULL) { 1502182007Sroberto tstamp1 = ntohl(vp->tstamp); 1503182007Sroberto fstamp1 = ntohl(vp->fstamp); 1504285612Sdelphij if (tstamp1 != 0 && fstamp1 != 0) { 1505285612Sdelphij if (tstamp < tstamp1) 1506285612Sdelphij return (XEVNT_TSP); 1507182007Sroberto 1508285612Sdelphij if ((tstamp < fstamp1 || fstamp < fstamp1)) 1509285612Sdelphij return (XEVNT_FSP); 1510285612Sdelphij } 1511182007Sroberto } 1512182007Sroberto 1513182007Sroberto /* 1514285612Sdelphij * At the time the certificate message is validated, the public 1515285612Sdelphij * key in the message is not available. Thus, don't try to 1516285612Sdelphij * verify the signature. 1517285612Sdelphij */ 1518285612Sdelphij if (opcode == (CRYPTO_CERT | CRYPTO_RESP)) 1519285612Sdelphij return (XEVNT_OK); 1520285612Sdelphij 1521285612Sdelphij /* 1522182007Sroberto * Check for valid signature length, public key and digest 1523182007Sroberto * algorithm. 1524182007Sroberto */ 1525132451Sroberto if (crypto_flags & peer->crypto & CRYPTO_FLAG_PRIV) 1526132451Sroberto pkey = sign_pkey; 1527132451Sroberto else 1528132451Sroberto pkey = peer->pkey; 1529182007Sroberto if (siglen == 0 || pkey == NULL || peer->digest == NULL) 1530285612Sdelphij return (XEVNT_ERR); 1531132451Sroberto 1532182007Sroberto if (siglen != (u_int)EVP_PKEY_size(pkey)) 1533182007Sroberto return (XEVNT_SGL); 1534182007Sroberto 1535132451Sroberto /* 1536182007Sroberto * Darn, I thought we would never get here. Verify the 1537182007Sroberto * signature. If the identity exchange is verified, light the 1538285612Sdelphij * proventic bit. What a relief. 1539132451Sroberto */ 1540310419Sdelphij ctx = EVP_MD_CTX_new(); 1541310419Sdelphij EVP_VerifyInit(ctx, peer->digest); 1542281230Sdelphij /* XXX: the "+ 12" needs to be at least documented... */ 1543310419Sdelphij EVP_VerifyUpdate(ctx, (u_char *)&ep->tstamp, vallen + 12); 1544310419Sdelphij if (EVP_VerifyFinal(ctx, (u_char *)&ep->pkt[i], siglen, 1545310419Sdelphij pkey) <= 0) { 1546310419Sdelphij EVP_MD_CTX_free(ctx); 1547182007Sroberto return (XEVNT_SIG); 1548310419Sdelphij } 1549310419Sdelphij EVP_MD_CTX_free(ctx); 1550182007Sroberto 1551285612Sdelphij if (peer->crypto & CRYPTO_FLAG_VRFY) 1552182007Sroberto peer->crypto |= CRYPTO_FLAG_PROV; 1553182007Sroberto return (XEVNT_OK); 1554132451Sroberto} 1555132451Sroberto 1556132451Sroberto 1557132451Sroberto/* 1558281230Sdelphij * crypto_encrypt - construct vp (encrypted cookie and signature) from 1559281230Sdelphij * the public key and cookie. 1560132451Sroberto * 1561281230Sdelphij * Returns: 1562132451Sroberto * XEVNT_OK success 1563285612Sdelphij * XEVNT_CKY bad or missing cookie 1564132451Sroberto * XEVNT_PUB bad or missing public key 1565132451Sroberto */ 1566132451Srobertostatic int 1567132451Srobertocrypto_encrypt( 1568281230Sdelphij const u_char *ptr, /* Public Key */ 1569281230Sdelphij u_int vallen, /* Length of Public Key */ 1570281230Sdelphij keyid_t *cookie, /* server cookie */ 1571281230Sdelphij struct value *vp /* value pointer */ 1572132451Sroberto ) 1573132451Sroberto{ 1574132451Sroberto EVP_PKEY *pkey; /* public key */ 1575310419Sdelphij EVP_MD_CTX *ctx; /* signature context */ 1576132451Sroberto tstamp_t tstamp; /* NTP timestamp */ 1577132451Sroberto u_int32 temp32; 1578285612Sdelphij u_char *puch; 1579132451Sroberto 1580132451Sroberto /* 1581132451Sroberto * Extract the public key from the request. 1582132451Sroberto */ 1583281230Sdelphij pkey = d2i_PublicKey(EVP_PKEY_RSA, NULL, &ptr, vallen); 1584132451Sroberto if (pkey == NULL) { 1585285612Sdelphij msyslog(LOG_ERR, "crypto_encrypt: %s", 1586132451Sroberto ERR_error_string(ERR_get_error(), NULL)); 1587132451Sroberto return (XEVNT_PUB); 158882498Sroberto } 158982498Sroberto 159082498Sroberto /* 1591132451Sroberto * Encrypt the cookie, encode in ASN.1 and sign. 159282498Sroberto */ 1593285612Sdelphij memset(vp, 0, sizeof(struct value)); 1594132451Sroberto tstamp = crypto_time(); 1595132451Sroberto vp->tstamp = htonl(tstamp); 1596132451Sroberto vp->fstamp = hostval.tstamp; 1597281230Sdelphij vallen = EVP_PKEY_size(pkey); 1598281230Sdelphij vp->vallen = htonl(vallen); 1599281230Sdelphij vp->ptr = emalloc(vallen); 1600285612Sdelphij puch = vp->ptr; 1601132451Sroberto temp32 = htonl(*cookie); 1602285612Sdelphij if (RSA_public_encrypt(4, (u_char *)&temp32, puch, 1603310419Sdelphij EVP_PKEY_get0_RSA(pkey), RSA_PKCS1_OAEP_PADDING) <= 0) { 1604285612Sdelphij msyslog(LOG_ERR, "crypto_encrypt: %s", 1605132451Sroberto ERR_error_string(ERR_get_error(), NULL)); 1606285612Sdelphij free(vp->ptr); 1607132451Sroberto EVP_PKEY_free(pkey); 1608132451Sroberto return (XEVNT_CKY); 1609132451Sroberto } 1610132451Sroberto EVP_PKEY_free(pkey); 1611132451Sroberto if (tstamp == 0) 1612132451Sroberto return (XEVNT_OK); 1613182007Sroberto 1614132451Sroberto vp->sig = emalloc(sign_siglen); 1615310419Sdelphij ctx = EVP_MD_CTX_new(); 1616310419Sdelphij EVP_SignInit(ctx, sign_digest); 1617310419Sdelphij EVP_SignUpdate(ctx, (u_char *)&vp->tstamp, 12); 1618310419Sdelphij EVP_SignUpdate(ctx, vp->ptr, vallen); 1619310419Sdelphij if (EVP_SignFinal(ctx, vp->sig, &vallen, sign_pkey)) { 1620289999Sglebius INSIST(vallen <= sign_siglen); 1621285612Sdelphij vp->siglen = htonl(vallen); 1622285612Sdelphij } 1623310419Sdelphij EVP_MD_CTX_free(ctx); 1624132451Sroberto return (XEVNT_OK); 1625132451Sroberto} 162682498Sroberto 1627132451Sroberto 1628132451Sroberto/* 1629132451Sroberto * crypto_ident - construct extension field for identity scheme 1630132451Sroberto * 1631132451Sroberto * This routine determines which identity scheme is in use and 1632132451Sroberto * constructs an extension field for that scheme. 1633285612Sdelphij * 1634285612Sdelphij * Returns 1635285612Sdelphij * CRYTPO_IFF IFF scheme 1636285612Sdelphij * CRYPTO_GQ GQ scheme 1637285612Sdelphij * CRYPTO_MV MV scheme 1638285612Sdelphij * CRYPTO_NULL no available scheme 1639132451Sroberto */ 1640132451Srobertou_int 1641132451Srobertocrypto_ident( 1642132451Sroberto struct peer *peer /* peer structure pointer */ 1643132451Sroberto ) 1644132451Sroberto{ 1645285612Sdelphij char filename[MAXFILENAME]; 1646285612Sdelphij const char * scheme_name; 1647285612Sdelphij u_int scheme_id; 1648132451Sroberto 164982498Sroberto /* 1650285612Sdelphij * We come here after the group trusted host has been found; its 1651285612Sdelphij * name defines the group name. Search the key cache for all 1652285612Sdelphij * keys matching the same group name in order IFF, GQ and MV. 1653285612Sdelphij * Use the first one available. 165482498Sroberto */ 1655285612Sdelphij scheme_name = NULL; 1656132451Sroberto if (peer->crypto & CRYPTO_FLAG_IFF) { 1657285612Sdelphij scheme_name = "iff"; 1658285612Sdelphij scheme_id = CRYPTO_IFF; 1659285612Sdelphij } else if (peer->crypto & CRYPTO_FLAG_GQ) { 1660285612Sdelphij scheme_name = "gq"; 1661285612Sdelphij scheme_id = CRYPTO_GQ; 1662285612Sdelphij } else if (peer->crypto & CRYPTO_FLAG_MV) { 1663285612Sdelphij scheme_name = "mv"; 1664285612Sdelphij scheme_id = CRYPTO_MV; 1665132451Sroberto } 1666132451Sroberto 1667285612Sdelphij if (scheme_name != NULL) { 1668285612Sdelphij snprintf(filename, sizeof(filename), "ntpkey_%spar_%s", 1669285612Sdelphij scheme_name, peer->ident); 1670285612Sdelphij peer->ident_pkey = crypto_key(filename, NULL, 1671285612Sdelphij &peer->srcadr); 1672132451Sroberto if (peer->ident_pkey != NULL) 1673285612Sdelphij return scheme_id; 1674132451Sroberto } 1675132451Sroberto 1676285612Sdelphij msyslog(LOG_NOTICE, 1677285612Sdelphij "crypto_ident: no identity parameters found for group %s", 1678285612Sdelphij peer->ident); 1679285612Sdelphij 1680285612Sdelphij return CRYPTO_NULL; 1681132451Sroberto} 168282498Sroberto 1683132451Sroberto 1684132451Sroberto/* 1685132451Sroberto * crypto_args - construct extension field from arguments 1686132451Sroberto * 1687132451Sroberto * This routine creates an extension field with current timestamps and 1688132451Sroberto * specified opcode, association ID and optional string. Note that the 1689132451Sroberto * extension field is created here, but freed after the crypto_xmit() 1690132451Sroberto * call in the protocol module. 1691132451Sroberto * 1692285612Sdelphij * Returns extension field pointer (no errors) 1693281230Sdelphij * 1694281230Sdelphij * XXX: opcode and len should really be 32-bit quantities and 1695281230Sdelphij * we should make sure that str is not too big. 1696132451Sroberto */ 1697132451Srobertostruct exten * 1698132451Srobertocrypto_args( 1699132451Sroberto struct peer *peer, /* peer structure pointer */ 1700132451Sroberto u_int opcode, /* operation code */ 1701285612Sdelphij associd_t associd, /* association ID */ 1702132451Sroberto char *str /* argument string */ 1703132451Sroberto ) 1704132451Sroberto{ 1705132451Sroberto tstamp_t tstamp; /* NTP timestamp */ 1706132451Sroberto struct exten *ep; /* extension field pointer */ 1707132451Sroberto u_int len; /* extension field length */ 1708285612Sdelphij size_t slen = 0; 1709132451Sroberto 1710132451Sroberto tstamp = crypto_time(); 1711132451Sroberto len = sizeof(struct exten); 1712281230Sdelphij if (str != NULL) { 1713281230Sdelphij slen = strlen(str); 1714285612Sdelphij INSIST(slen < MAX_VALLEN); 1715281230Sdelphij len += slen; 1716281230Sdelphij } 1717285612Sdelphij ep = emalloc_zero(len); 1718182007Sroberto if (opcode == 0) 1719182007Sroberto return (ep); 1720182007Sroberto 1721285612Sdelphij REQUIRE(0 == (len & ~0x0000ffff)); 1722285612Sdelphij REQUIRE(0 == (opcode & ~0xffff0000)); 1723285612Sdelphij 1724132451Sroberto ep->opcode = htonl(opcode + len); 1725285612Sdelphij ep->associd = htonl(associd); 1726132451Sroberto ep->tstamp = htonl(tstamp); 1727132451Sroberto ep->fstamp = hostval.tstamp; 1728132451Sroberto ep->vallen = 0; 1729132451Sroberto if (str != NULL) { 1730281230Sdelphij ep->vallen = htonl(slen); 1731281230Sdelphij memcpy((char *)ep->pkt, str, slen); 1732132451Sroberto } 1733132451Sroberto return (ep); 173482498Sroberto} 173582498Sroberto 173682498Sroberto 173782498Sroberto/* 1738132451Sroberto * crypto_send - construct extension field from value components 1739132451Sroberto * 1740285612Sdelphij * The value and signature fields are zero-padded to a word boundary. 1741285612Sdelphij * Note: it is not polite to send a nonempty signature with zero 1742285612Sdelphij * timestamp or a nonzero timestamp with an empty signature, but those 1743285612Sdelphij * rules are not enforced here. 1744281230Sdelphij * 1745281230Sdelphij * XXX This code won't work on a box with 16-bit ints. 174682498Sroberto */ 1747285612Sdelphijint 1748132451Srobertocrypto_send( 1749132451Sroberto struct exten *ep, /* extension field pointer */ 1750285612Sdelphij struct value *vp, /* value pointer */ 1751285612Sdelphij int start /* buffer offset */ 1752132451Sroberto ) 175382498Sroberto{ 1754285612Sdelphij u_int len, vallen, siglen, opcode; 1755285612Sdelphij u_int i, j; 175682498Sroberto 175782498Sroberto /* 1758285612Sdelphij * Calculate extension field length and check for buffer 1759285612Sdelphij * overflow. Leave room for the MAC. 176082498Sroberto */ 1761285612Sdelphij len = 16; /* XXX Document! */ 1762285612Sdelphij vallen = ntohl(vp->vallen); 1763285612Sdelphij INSIST(vallen <= MAX_VALLEN); 1764285612Sdelphij len += ((vallen + 3) / 4 + 1) * 4; 1765285612Sdelphij siglen = ntohl(vp->siglen); 1766285612Sdelphij len += ((siglen + 3) / 4 + 1) * 4; 1767285612Sdelphij if (start + len > sizeof(struct pkt) - MAX_MAC_LEN) 1768285612Sdelphij return (0); 1769285612Sdelphij 1770285612Sdelphij /* 1771285612Sdelphij * Copy timestamps. 1772285612Sdelphij */ 1773132451Sroberto ep->tstamp = vp->tstamp; 1774132451Sroberto ep->fstamp = vp->fstamp; 1775132451Sroberto ep->vallen = vp->vallen; 1776132451Sroberto 1777132451Sroberto /* 1778285612Sdelphij * Copy value. If the data field is empty or zero length, 1779285612Sdelphij * encode an empty value with length zero. 1780285612Sdelphij */ 1781285612Sdelphij i = 0; 1782285612Sdelphij if (vallen > 0 && vp->ptr != NULL) { 1783285612Sdelphij j = vallen / 4; 1784285612Sdelphij if (j * 4 < vallen) 1785285612Sdelphij ep->pkt[i + j++] = 0; 1786285612Sdelphij memcpy(&ep->pkt[i], vp->ptr, vallen); 1787285612Sdelphij i += j; 1788285612Sdelphij } 1789285612Sdelphij 1790285612Sdelphij /* 1791132451Sroberto * Copy signature. If the signature field is empty or zero 1792132451Sroberto * length, encode an empty signature with length zero. 1793132451Sroberto */ 1794132451Sroberto ep->pkt[i++] = vp->siglen; 1795285612Sdelphij if (siglen > 0 && vp->sig != NULL) { 1796285612Sdelphij j = siglen / 4; 1797285612Sdelphij if (j * 4 < siglen) 1798285612Sdelphij ep->pkt[i + j++] = 0; 1799285612Sdelphij memcpy(&ep->pkt[i], vp->sig, siglen); 1800289999Sglebius /* i += j; */ /* We don't use i after this */ 1801285612Sdelphij } 1802285612Sdelphij opcode = ntohl(ep->opcode); 1803285612Sdelphij ep->opcode = htonl((opcode & 0xffff0000) | len); 1804285612Sdelphij ENSURE(len <= MAX_VALLEN); 1805132451Sroberto return (len); 1806132451Sroberto} 1807132451Sroberto 1808132451Sroberto 1809132451Sroberto/* 1810132451Sroberto * crypto_update - compute new public value and sign extension fields 1811132451Sroberto * 1812132451Sroberto * This routine runs periodically, like once a day, and when something 1813132451Sroberto * changes. It updates the timestamps on three value structures and one 1814132451Sroberto * value structure list, then signs all the structures: 1815132451Sroberto * 1816132451Sroberto * hostval host name (not signed) 1817132451Sroberto * pubkey public key 1818132451Sroberto * cinfo certificate info/value list 1819285612Sdelphij * tai_leap leap values 1820132451Sroberto * 1821285612Sdelphij * Filestamps are proventic data, so this routine runs only when the 1822285612Sdelphij * host is synchronized to a proventicated source. Thus, the timestamp 1823285612Sdelphij * is proventic and can be used to deflect clogging attacks. 1824132451Sroberto * 1825132451Sroberto * Returns void (no errors) 1826132451Sroberto */ 1827132451Srobertovoid 1828132451Srobertocrypto_update(void) 1829132451Sroberto{ 1830310419Sdelphij EVP_MD_CTX *ctx; /* message digest context */ 1831285612Sdelphij struct cert_info *cp; /* certificate info/value */ 1832132451Sroberto char statstr[NTP_MAXSTRLEN]; /* statistics for filegen */ 1833285612Sdelphij u_int32 *ptr; 1834132451Sroberto u_int len; 1835285612Sdelphij leap_result_t leap_data; 1836132451Sroberto 1837285612Sdelphij hostval.tstamp = htonl(crypto_time()); 1838285612Sdelphij if (hostval.tstamp == 0) 183982498Sroberto return; 1840182007Sroberto 1841310419Sdelphij ctx = EVP_MD_CTX_new(); 1842310419Sdelphij 184382498Sroberto /* 1844132451Sroberto * Sign public key and timestamps. The filestamp is derived from 1845132451Sroberto * the host key file extension from wherever the file was 1846132451Sroberto * generated. 184782498Sroberto */ 1848132451Sroberto if (pubkey.vallen != 0) { 1849132451Sroberto pubkey.tstamp = hostval.tstamp; 1850132451Sroberto pubkey.siglen = 0; 1851132451Sroberto if (pubkey.sig == NULL) 1852132451Sroberto pubkey.sig = emalloc(sign_siglen); 1853310419Sdelphij EVP_SignInit(ctx, sign_digest); 1854310419Sdelphij EVP_SignUpdate(ctx, (u_char *)&pubkey, 12); 1855310419Sdelphij EVP_SignUpdate(ctx, pubkey.ptr, ntohl(pubkey.vallen)); 1856310419Sdelphij if (EVP_SignFinal(ctx, pubkey.sig, &len, sign_pkey)) { 1857289999Sglebius INSIST(len <= sign_siglen); 1858132451Sroberto pubkey.siglen = htonl(len); 1859285612Sdelphij } 186082498Sroberto } 186182498Sroberto 186282498Sroberto /* 1863132451Sroberto * Sign certificates and timestamps. The filestamp is derived 1864132451Sroberto * from the certificate file extension from wherever the file 1865182007Sroberto * was generated. Note we do not throw expired certificates 1866182007Sroberto * away; they may have signed younger ones. 186782498Sroberto */ 1868285612Sdelphij for (cp = cinfo; cp != NULL; cp = cp->link) { 1869182007Sroberto cp->cert.tstamp = hostval.tstamp; 1870182007Sroberto cp->cert.siglen = 0; 1871182007Sroberto if (cp->cert.sig == NULL) 1872182007Sroberto cp->cert.sig = emalloc(sign_siglen); 1873310419Sdelphij EVP_SignInit(ctx, sign_digest); 1874310419Sdelphij EVP_SignUpdate(ctx, (u_char *)&cp->cert, 12); 1875310419Sdelphij EVP_SignUpdate(ctx, cp->cert.ptr, 1876182007Sroberto ntohl(cp->cert.vallen)); 1877310419Sdelphij if (EVP_SignFinal(ctx, cp->cert.sig, &len, sign_pkey)) { 1878289999Sglebius INSIST(len <= sign_siglen); 1879182007Sroberto cp->cert.siglen = htonl(len); 1880285612Sdelphij } 188182498Sroberto } 188282498Sroberto 188382498Sroberto /* 1884285612Sdelphij * Sign leapseconds values and timestamps. Note it is not an 1885285612Sdelphij * error to return null values. 188682498Sroberto */ 1887285612Sdelphij tai_leap.tstamp = hostval.tstamp; 1888285612Sdelphij tai_leap.fstamp = hostval.fstamp; 1889285612Sdelphij 1890285612Sdelphij /* Get the leap second era. We might need a full lookup early 1891285612Sdelphij * after start, when the cache is not yet loaded. 1892285612Sdelphij */ 1893285612Sdelphij leapsec_frame(&leap_data); 1894285612Sdelphij if ( ! memcmp(&leap_data.ebase, &leap_data.ttime, sizeof(vint64))) { 1895285612Sdelphij time_t now = time(NULL); 1896285612Sdelphij uint32_t nowntp = (uint32_t)now + JAN_1970; 1897285612Sdelphij leapsec_query(&leap_data, nowntp, &now); 189882498Sroberto } 1899285612Sdelphij 1900285612Sdelphij /* Create the data block. The protocol does not work without. */ 1901285612Sdelphij len = 3 * sizeof(u_int32); 1902285612Sdelphij if (tai_leap.ptr == NULL || ntohl(tai_leap.vallen) != len) { 1903285612Sdelphij free(tai_leap.ptr); 1904285612Sdelphij tai_leap.ptr = emalloc(len); 1905285612Sdelphij tai_leap.vallen = htonl(len); 1906285612Sdelphij } 1907285612Sdelphij ptr = (u_int32 *)tai_leap.ptr; 1908285612Sdelphij if (leap_data.tai_offs > 10) { 1909285612Sdelphij /* create a TAI / leap era block. The end time is a 1910285612Sdelphij * fake -- maybe we can do better. 1911285612Sdelphij */ 1912285612Sdelphij ptr[0] = htonl(leap_data.tai_offs); 1913285612Sdelphij ptr[1] = htonl(leap_data.ebase.d_s.lo); 1914285612Sdelphij if (leap_data.ttime.d_s.hi >= 0) 1915285612Sdelphij ptr[2] = htonl(leap_data.ttime.D_s.lo + 7*86400); 1916285612Sdelphij else 1917285612Sdelphij ptr[2] = htonl(leap_data.ebase.D_s.lo + 25*86400); 1918285612Sdelphij } else { 1919285612Sdelphij /* no leap era available */ 1920285612Sdelphij memset(ptr, 0, len); 1921285612Sdelphij } 1922285612Sdelphij if (tai_leap.sig == NULL) 1923285612Sdelphij tai_leap.sig = emalloc(sign_siglen); 1924310419Sdelphij EVP_SignInit(ctx, sign_digest); 1925310419Sdelphij EVP_SignUpdate(ctx, (u_char *)&tai_leap, 12); 1926310419Sdelphij EVP_SignUpdate(ctx, tai_leap.ptr, len); 1927310419Sdelphij if (EVP_SignFinal(ctx, tai_leap.sig, &len, sign_pkey)) { 1928289999Sglebius INSIST(len <= sign_siglen); 1929285612Sdelphij tai_leap.siglen = htonl(len); 1930285612Sdelphij } 1931285612Sdelphij crypto_flags |= CRYPTO_FLAG_TAI; 1932285612Sdelphij 1933285612Sdelphij snprintf(statstr, sizeof(statstr), "signature update ts %u", 1934285612Sdelphij ntohl(hostval.tstamp)); 1935132451Sroberto record_crypto_stats(NULL, statstr); 1936285612Sdelphij DPRINTF(1, ("crypto_update: %s\n", statstr)); 1937310419Sdelphij EVP_MD_CTX_free(ctx); 193882498Sroberto} 193982498Sroberto 1940285612Sdelphij/* 1941285612Sdelphij * crypto_update_taichange - eventually trigger crypto_update 1942285612Sdelphij * 1943285612Sdelphij * This is called when a change in 'sys_tai' is detected. This will 1944285612Sdelphij * happen shortly after a leap second is detected, but unhappily also 1945285612Sdelphij * early after system start; also, the crypto stuff might be unused and 1946285612Sdelphij * an unguarded call to crypto_update() causes a crash. 1947285612Sdelphij * 1948285612Sdelphij * This function makes sure that there already *is* a valid crypto block 1949285612Sdelphij * for the use with autokey, and only calls 'crypto_update()' if it can 1950285612Sdelphij * succeed. 1951285612Sdelphij * 1952285612Sdelphij * Returns void (no errors) 1953285612Sdelphij */ 1954285612Sdelphijvoid 1955285612Sdelphijcrypto_update_taichange(void) 1956285612Sdelphij{ 1957285612Sdelphij static const u_int len = 3 * sizeof(u_int32); 195882498Sroberto 1959285612Sdelphij /* check if the signing digest algo is available */ 1960285612Sdelphij if (sign_digest == NULL || sign_pkey == NULL) 1961285612Sdelphij return; 1962285612Sdelphij 1963285612Sdelphij /* check size of TAI extension block */ 1964285612Sdelphij if (tai_leap.ptr == NULL || ntohl(tai_leap.vallen) != len) 1965285612Sdelphij return; 1966285612Sdelphij 1967285612Sdelphij /* crypto_update should at least not crash here! */ 1968285612Sdelphij crypto_update(); 1969285612Sdelphij} 1970285612Sdelphij 197182498Sroberto/* 1972132451Sroberto * value_free - free value structure components. 1973132451Sroberto * 1974132451Sroberto * Returns void (no errors) 197582498Sroberto */ 1976132451Srobertovoid 1977132451Srobertovalue_free( 1978132451Sroberto struct value *vp /* value structure */ 197982498Sroberto ) 198082498Sroberto{ 1981132451Sroberto if (vp->ptr != NULL) 1982132451Sroberto free(vp->ptr); 1983132451Sroberto if (vp->sig != NULL) 1984132451Sroberto free(vp->sig); 1985132451Sroberto memset(vp, 0, sizeof(struct value)); 1986132451Sroberto} 198782498Sroberto 1988132451Sroberto 1989132451Sroberto/* 1990285612Sdelphij * crypto_time - returns current NTP time. 1991285612Sdelphij * 1992285612Sdelphij * Returns NTP seconds if in synch, 0 otherwise 1993132451Sroberto */ 1994132451Srobertotstamp_t 1995132451Srobertocrypto_time() 1996132451Sroberto{ 1997285612Sdelphij l_fp tstamp; /* NTP time */ 1998132451Sroberto 1999132451Sroberto L_CLR(&tstamp); 2000132451Sroberto if (sys_leap != LEAP_NOTINSYNC) 2001132451Sroberto get_systime(&tstamp); 2002132451Sroberto return (tstamp.l_ui); 2003132451Sroberto} 2004132451Sroberto 2005132451Sroberto 2006132451Sroberto/* 2007285612Sdelphij * asn_to_calendar - convert ASN1_TIME time structure to struct calendar. 2008285612Sdelphij * 2009132451Sroberto */ 2010285612Sdelphijstatic 2011285612Sdelphijvoid 2012285612Sdelphijasn_to_calendar ( 2013285612Sdelphij ASN1_TIME *asn1time, /* pointer to ASN1_TIME structure */ 2014285612Sdelphij struct calendar *pjd /* pointer to result */ 2015132451Sroberto ) 2016132451Sroberto{ 2017285612Sdelphij size_t len; /* length of ASN1_TIME string */ 2018285612Sdelphij char v[24]; /* writable copy of ASN1_TIME string */ 2019285612Sdelphij unsigned long temp; /* result from strtoul */ 2020132451Sroberto 202182498Sroberto /* 2022132451Sroberto * Extract time string YYMMDDHHMMSSZ from ASN1 time structure. 2023285612Sdelphij * Or YYYYMMDDHHMMSSZ. 2024132451Sroberto * Note that the YY, MM, DD fields start with one, the HH, MM, 2025285612Sdelphij * SS fields start with zero and the Z character is ignored. 2026285612Sdelphij * Also note that two-digit years less than 50 map to years greater than 2027285612Sdelphij * 100. Dontcha love ASN.1? Better than MIL-188. 202882498Sroberto */ 2029285612Sdelphij len = asn1time->length; 2030289999Sglebius REQUIRE(len < sizeof(v)); 2031285612Sdelphij (void)strncpy(v, (char *)(asn1time->data), len); 2032289999Sglebius REQUIRE(len >= 13); 2033285612Sdelphij temp = strtoul(v+len-3, NULL, 10); 2034285612Sdelphij pjd->second = temp; 2035285612Sdelphij v[len-3] = '\0'; 2036182007Sroberto 2037285612Sdelphij temp = strtoul(v+len-5, NULL, 10); 2038285612Sdelphij pjd->minute = temp; 2039285612Sdelphij v[len-5] = '\0'; 2040285612Sdelphij 2041285612Sdelphij temp = strtoul(v+len-7, NULL, 10); 2042285612Sdelphij pjd->hour = temp; 2043285612Sdelphij v[len-7] = '\0'; 2044285612Sdelphij 2045285612Sdelphij temp = strtoul(v+len-9, NULL, 10); 2046285612Sdelphij pjd->monthday = temp; 2047285612Sdelphij v[len-9] = '\0'; 2048285612Sdelphij 2049285612Sdelphij temp = strtoul(v+len-11, NULL, 10); 2050285612Sdelphij pjd->month = temp; 2051285612Sdelphij v[len-11] = '\0'; 2052285612Sdelphij 2053285612Sdelphij temp = strtoul(v, NULL, 10); 2054285612Sdelphij /* handle two-digit years */ 2055285612Sdelphij if (temp < 50UL) 2056285612Sdelphij temp += 100UL; 2057285612Sdelphij if (temp < 150UL) 2058285612Sdelphij temp += 1900UL; 2059285612Sdelphij pjd->year = temp; 2060285612Sdelphij 2061285612Sdelphij pjd->yearday = pjd->weekday = 0; 2062285612Sdelphij return; 2063132451Sroberto} 2064132451Sroberto 2065132451Sroberto 2066132451Sroberto/* 2067132451Sroberto * bigdig() - compute a BIGNUM MD5 hash of a BIGNUM number. 2068285612Sdelphij * 2069285612Sdelphij * Returns void (no errors) 2070132451Sroberto */ 2071285612Sdelphijstatic void 2072132451Srobertobighash( 2073132451Sroberto BIGNUM *bn, /* BIGNUM * from */ 2074132451Sroberto BIGNUM *bk /* BIGNUM * to */ 2075132451Sroberto ) 2076132451Sroberto{ 2077310419Sdelphij EVP_MD_CTX *ctx; /* message digest context */ 2078132451Sroberto u_char dgst[EVP_MAX_MD_SIZE]; /* message digest */ 2079132451Sroberto u_char *ptr; /* a BIGNUM as binary string */ 2080132451Sroberto u_int len; 2081132451Sroberto 2082132451Sroberto len = BN_num_bytes(bn); 2083132451Sroberto ptr = emalloc(len); 2084132451Sroberto BN_bn2bin(bn, ptr); 2085310419Sdelphij ctx = EVP_MD_CTX_new(); 2086310419Sdelphij EVP_DigestInit(ctx, EVP_md5()); 2087310419Sdelphij EVP_DigestUpdate(ctx, ptr, len); 2088310419Sdelphij EVP_DigestFinal(ctx, dgst, &len); 2089310419Sdelphij EVP_MD_CTX_free(ctx); 2090132451Sroberto BN_bin2bn(dgst, len, bk); 2091285612Sdelphij free(ptr); 2092132451Sroberto} 2093132451Sroberto 2094132451Sroberto 2095132451Sroberto/* 2096132451Sroberto *********************************************************************** 2097132451Sroberto * * 2098132451Sroberto * The following routines implement the Schnorr (IFF) identity scheme * 2099132451Sroberto * * 2100132451Sroberto *********************************************************************** 2101132451Sroberto * 2102132451Sroberto * The Schnorr (IFF) identity scheme is intended for use when 2103285612Sdelphij * certificates are generated by some other trusted certificate 2104285612Sdelphij * authority and the certificate cannot be used to convey public 2105285612Sdelphij * parameters. There are two kinds of files: encrypted server files that 2106285612Sdelphij * contain private and public values and nonencrypted client files that 2107285612Sdelphij * contain only public values. New generations of server files must be 2108285612Sdelphij * securely transmitted to all servers of the group; client files can be 2109285612Sdelphij * distributed by any means. The scheme is self contained and 2110285612Sdelphij * independent of new generations of host keys, sign keys and 2111285612Sdelphij * certificates. 2112132451Sroberto * 2113285612Sdelphij * The IFF values hide in a DSA cuckoo structure which uses the same 2114285612Sdelphij * parameters. The values are used by an identity scheme based on DSA 2115285612Sdelphij * cryptography and described in Stimson p. 285. The p is a 512-bit 2116285612Sdelphij * prime, g a generator of Zp* and q a 160-bit prime that divides p - 1 2117285612Sdelphij * and is a qth root of 1 mod p; that is, g^q = 1 mod p. The TA rolls a 2118285612Sdelphij * private random group key b (0 < b < q) and public key v = g^b, then 2119285612Sdelphij * sends (p, q, g, b) to the servers and (p, q, g, v) to the clients. 2120285612Sdelphij * Alice challenges Bob to confirm identity using the protocol described 2121285612Sdelphij * below. 2122132451Sroberto * 2123132451Sroberto * How it works 2124132451Sroberto * 2125132451Sroberto * The scheme goes like this. Both Alice and Bob have the public primes 2126132451Sroberto * p, q and generator g. The TA gives private key b to Bob and public 2127285612Sdelphij * key v to Alice. 2128132451Sroberto * 2129285612Sdelphij * Alice rolls new random challenge r (o < r < q) and sends to Bob in 2130285612Sdelphij * the IFF request message. Bob rolls new random k (0 < k < q), then 2131285612Sdelphij * computes y = k + b r mod q and x = g^k mod p and sends (y, hash(x)) 2132285612Sdelphij * to Alice in the response message. Besides making the response 2133285612Sdelphij * shorter, the hash makes it effectivey impossible for an intruder to 2134285612Sdelphij * solve for b by observing a number of these messages. 2135132451Sroberto * 2136132451Sroberto * Alice receives the response and computes g^y v^r mod p. After a bit 2137132451Sroberto * of algebra, this simplifies to g^k. If the hash of this result 2138132451Sroberto * matches hash(x), Alice knows that Bob has the group key b. The signed 2139132451Sroberto * response binds this knowledge to Bob's private key and the public key 2140132451Sroberto * previously received in his certificate. 2141132451Sroberto * 2142132451Sroberto * crypto_alice - construct Alice's challenge in IFF scheme 2143132451Sroberto * 2144132451Sroberto * Returns 2145132451Sroberto * XEVNT_OK success 2146285612Sdelphij * XEVNT_ID bad or missing group key 2147132451Sroberto * XEVNT_PUB bad or missing public key 2148132451Sroberto */ 2149132451Srobertostatic int 2150132451Srobertocrypto_alice( 2151132451Sroberto struct peer *peer, /* peer pointer */ 2152132451Sroberto struct value *vp /* value pointer */ 2153132451Sroberto ) 2154132451Sroberto{ 2155132451Sroberto DSA *dsa; /* IFF parameters */ 2156132451Sroberto BN_CTX *bctx; /* BIGNUM context */ 2157310419Sdelphij EVP_MD_CTX *ctx; /* signature context */ 2158132451Sroberto tstamp_t tstamp; 2159132451Sroberto u_int len; 2160310419Sdelphij const BIGNUM *q; 2161132451Sroberto 2162132451Sroberto /* 2163132451Sroberto * The identity parameters must have correct format and content. 2164132451Sroberto */ 2165285612Sdelphij if (peer->ident_pkey == NULL) { 2166285612Sdelphij msyslog(LOG_NOTICE, "crypto_alice: scheme unavailable"); 2167132451Sroberto return (XEVNT_ID); 2168285612Sdelphij } 2169182007Sroberto 2170310419Sdelphij if ((dsa = EVP_PKEY_get0_DSA(peer->ident_pkey->pkey)) == NULL) { 2171285612Sdelphij msyslog(LOG_NOTICE, "crypto_alice: defective key"); 2172132451Sroberto return (XEVNT_PUB); 2173132451Sroberto } 2174132451Sroberto 2175132451Sroberto /* 2176285612Sdelphij * Roll new random r (0 < r < q). 2177132451Sroberto */ 2178132451Sroberto if (peer->iffval != NULL) 2179132451Sroberto BN_free(peer->iffval); 2180132451Sroberto peer->iffval = BN_new(); 2181310419Sdelphij DSA_get0_pqg(dsa, NULL, &q, NULL); 2182310419Sdelphij len = BN_num_bytes(q); 2183285612Sdelphij BN_rand(peer->iffval, len * 8, -1, 1); /* r mod q*/ 2184285612Sdelphij bctx = BN_CTX_new(); 2185310419Sdelphij BN_mod(peer->iffval, peer->iffval, q, bctx); 2186132451Sroberto BN_CTX_free(bctx); 2187132451Sroberto 2188132451Sroberto /* 2189132451Sroberto * Sign and send to Bob. The filestamp is from the local file. 2190132451Sroberto */ 2191285612Sdelphij memset(vp, 0, sizeof(struct value)); 2192132451Sroberto tstamp = crypto_time(); 2193132451Sroberto vp->tstamp = htonl(tstamp); 2194285612Sdelphij vp->fstamp = htonl(peer->ident_pkey->fstamp); 2195132451Sroberto vp->vallen = htonl(len); 2196132451Sroberto vp->ptr = emalloc(len); 2197132451Sroberto BN_bn2bin(peer->iffval, vp->ptr); 2198132451Sroberto if (tstamp == 0) 2199132451Sroberto return (XEVNT_OK); 2200182007Sroberto 2201132451Sroberto vp->sig = emalloc(sign_siglen); 2202310419Sdelphij ctx = EVP_MD_CTX_new(); 2203310419Sdelphij EVP_SignInit(ctx, sign_digest); 2204310419Sdelphij EVP_SignUpdate(ctx, (u_char *)&vp->tstamp, 12); 2205310419Sdelphij EVP_SignUpdate(ctx, vp->ptr, len); 2206310419Sdelphij if (EVP_SignFinal(ctx, vp->sig, &len, sign_pkey)) { 2207289999Sglebius INSIST(len <= sign_siglen); 2208132451Sroberto vp->siglen = htonl(len); 2209285612Sdelphij } 2210310419Sdelphij EVP_MD_CTX_free(ctx); 2211132451Sroberto return (XEVNT_OK); 2212132451Sroberto} 2213132451Sroberto 2214132451Sroberto 2215132451Sroberto/* 2216132451Sroberto * crypto_bob - construct Bob's response to Alice's challenge 2217132451Sroberto * 2218132451Sroberto * Returns 2219132451Sroberto * XEVNT_OK success 2220285612Sdelphij * XEVNT_ERR protocol error 2221182007Sroberto * XEVNT_ID bad or missing group key 2222132451Sroberto */ 2223132451Srobertostatic int 2224132451Srobertocrypto_bob( 2225132451Sroberto struct exten *ep, /* extension pointer */ 2226132451Sroberto struct value *vp /* value pointer */ 2227132451Sroberto ) 2228132451Sroberto{ 2229132451Sroberto DSA *dsa; /* IFF parameters */ 2230132451Sroberto DSA_SIG *sdsa; /* DSA signature context fake */ 2231132451Sroberto BN_CTX *bctx; /* BIGNUM context */ 2232310419Sdelphij EVP_MD_CTX *ctx; /* signature context */ 2233132451Sroberto tstamp_t tstamp; /* NTP timestamp */ 2234132451Sroberto BIGNUM *bn, *bk, *r; 2235132451Sroberto u_char *ptr; 2236289999Sglebius u_int len; /* extension field value length */ 2237310419Sdelphij const BIGNUM *p, *q, *g; 2238310419Sdelphij const BIGNUM *priv_key; 2239132451Sroberto 2240132451Sroberto /* 2241132451Sroberto * If the IFF parameters are not valid, something awful 2242132451Sroberto * happened or we are being tormented. 2243132451Sroberto */ 2244285612Sdelphij if (iffkey_info == NULL) { 2245285612Sdelphij msyslog(LOG_NOTICE, "crypto_bob: scheme unavailable"); 2246182007Sroberto return (XEVNT_ID); 2247132451Sroberto } 2248310419Sdelphij dsa = EVP_PKEY_get0_DSA(iffkey_info->pkey); 2249310419Sdelphij DSA_get0_pqg(dsa, &p, &q, &g); 2250310419Sdelphij DSA_get0_key(dsa, NULL, &priv_key); 2251132451Sroberto 2252132451Sroberto /* 2253132451Sroberto * Extract r from the challenge. 2254132451Sroberto */ 2255289999Sglebius len = exten_payload_size(ep); 2256289999Sglebius if (len == 0 || len > MAX_VALLEN) 2257289999Sglebius return (XEVNT_LEN); 2258289999Sglebius if ((r = BN_bin2bn((u_char *)ep->pkt, len, NULL)) == NULL) { 2259285612Sdelphij msyslog(LOG_ERR, "crypto_bob: %s", 2260132451Sroberto ERR_error_string(ERR_get_error(), NULL)); 2261182007Sroberto return (XEVNT_ERR); 2262132451Sroberto } 2263132451Sroberto 2264132451Sroberto /* 2265132451Sroberto * Bob rolls random k (0 < k < q), computes y = k + b r mod q 2266132451Sroberto * and x = g^k mod p, then sends (y, hash(x)) to Alice. 2267132451Sroberto */ 2268132451Sroberto bctx = BN_CTX_new(); bk = BN_new(); bn = BN_new(); 2269132451Sroberto sdsa = DSA_SIG_new(); 2270289999Sglebius BN_rand(bk, len * 8, -1, 1); /* k */ 2271310419Sdelphij BN_mod_mul(bn, priv_key, r, q, bctx); /* b r mod q */ 2272132451Sroberto BN_add(bn, bn, bk); 2273310419Sdelphij BN_mod(bn, bn, q, bctx); /* k + b r mod q */ 2274310419Sdelphij BN_mod_exp(bk, g, bk, p, bctx); /* g^k mod p */ 2275132451Sroberto bighash(bk, bk); 2276310419Sdelphij DSA_SIG_set0(sdsa, bn, bk); 2277132451Sroberto BN_CTX_free(bctx); 2278310419Sdelphij BN_free(r); 2279285612Sdelphij#ifdef DEBUG 2280285612Sdelphij if (debug > 1) 2281285612Sdelphij DSA_print_fp(stdout, dsa, 0); 2282285612Sdelphij#endif 2283132451Sroberto 2284132451Sroberto /* 2285285612Sdelphij * Encode the values in ASN.1 and sign. The filestamp is from 2286285612Sdelphij * the local file. 2287132451Sroberto */ 2288289999Sglebius len = i2d_DSA_SIG(sdsa, NULL); 2289289999Sglebius if (len == 0) { 2290285612Sdelphij msyslog(LOG_ERR, "crypto_bob: %s", 2291132451Sroberto ERR_error_string(ERR_get_error(), NULL)); 2292132451Sroberto DSA_SIG_free(sdsa); 2293182007Sroberto return (XEVNT_ERR); 2294132451Sroberto } 2295289999Sglebius if (len > MAX_VALLEN) { 2296289999Sglebius msyslog(LOG_ERR, "crypto_bob: signature is too big: %u", 2297289999Sglebius len); 2298281230Sdelphij DSA_SIG_free(sdsa); 2299281230Sdelphij return (XEVNT_LEN); 2300281230Sdelphij } 2301281230Sdelphij memset(vp, 0, sizeof(struct value)); 2302281230Sdelphij tstamp = crypto_time(); 2303281230Sdelphij vp->tstamp = htonl(tstamp); 2304285612Sdelphij vp->fstamp = htonl(iffkey_info->fstamp); 2305289999Sglebius vp->vallen = htonl(len); 2306289999Sglebius ptr = emalloc(len); 2307132451Sroberto vp->ptr = ptr; 2308132451Sroberto i2d_DSA_SIG(sdsa, &ptr); 2309132451Sroberto DSA_SIG_free(sdsa); 2310132451Sroberto if (tstamp == 0) 2311132451Sroberto return (XEVNT_OK); 2312182007Sroberto 2313281230Sdelphij /* XXX: more validation to make sure the sign fits... */ 2314132451Sroberto vp->sig = emalloc(sign_siglen); 2315310419Sdelphij ctx = EVP_MD_CTX_new(); 2316310419Sdelphij EVP_SignInit(ctx, sign_digest); 2317310419Sdelphij EVP_SignUpdate(ctx, (u_char *)&vp->tstamp, 12); 2318310419Sdelphij EVP_SignUpdate(ctx, vp->ptr, len); 2319310419Sdelphij if (EVP_SignFinal(ctx, vp->sig, &len, sign_pkey)) { 2320289999Sglebius INSIST(len <= sign_siglen); 2321289999Sglebius vp->siglen = htonl(len); 2322285612Sdelphij } 2323310419Sdelphij EVP_MD_CTX_free(ctx); 2324132451Sroberto return (XEVNT_OK); 2325132451Sroberto} 2326132451Sroberto 2327132451Sroberto 2328132451Sroberto/* 2329132451Sroberto * crypto_iff - verify Bob's response to Alice's challenge 2330132451Sroberto * 2331132451Sroberto * Returns 2332132451Sroberto * XEVNT_OK success 2333285612Sdelphij * XEVNT_FSP bad filestamp 2334285612Sdelphij * XEVNT_ID bad or missing group key 2335132451Sroberto * XEVNT_PUB bad or missing public key 2336132451Sroberto */ 2337132451Srobertoint 2338132451Srobertocrypto_iff( 2339132451Sroberto struct exten *ep, /* extension pointer */ 2340132451Sroberto struct peer *peer /* peer structure pointer */ 2341132451Sroberto ) 2342132451Sroberto{ 2343132451Sroberto DSA *dsa; /* IFF parameters */ 2344132451Sroberto BN_CTX *bctx; /* BIGNUM context */ 2345132451Sroberto DSA_SIG *sdsa; /* DSA parameters */ 2346132451Sroberto BIGNUM *bn, *bk; 2347132451Sroberto u_int len; 2348285612Sdelphij const u_char *ptr; 2349132451Sroberto int temp; 2350310419Sdelphij const BIGNUM *p, *g; 2351310419Sdelphij const BIGNUM *r, *s; 2352310419Sdelphij const BIGNUM *pub_key; 2353132451Sroberto 2354132451Sroberto /* 2355132451Sroberto * If the IFF parameters are not valid or no challenge was sent, 2356132451Sroberto * something awful happened or we are being tormented. 2357132451Sroberto */ 2358132451Sroberto if (peer->ident_pkey == NULL) { 2359285612Sdelphij msyslog(LOG_NOTICE, "crypto_iff: scheme unavailable"); 2360182007Sroberto return (XEVNT_ID); 2361132451Sroberto } 2362285612Sdelphij if (ntohl(ep->fstamp) != peer->ident_pkey->fstamp) { 2363285612Sdelphij msyslog(LOG_NOTICE, "crypto_iff: invalid filestamp %u", 2364132451Sroberto ntohl(ep->fstamp)); 2365132451Sroberto return (XEVNT_FSP); 2366132451Sroberto } 2367310419Sdelphij if ((dsa = EVP_PKEY_get0_DSA(peer->ident_pkey->pkey)) == NULL) { 2368285612Sdelphij msyslog(LOG_NOTICE, "crypto_iff: defective key"); 2369132451Sroberto return (XEVNT_PUB); 2370132451Sroberto } 2371132451Sroberto if (peer->iffval == NULL) { 2372285612Sdelphij msyslog(LOG_NOTICE, "crypto_iff: missing challenge"); 2373182007Sroberto return (XEVNT_ID); 2374132451Sroberto } 2375132451Sroberto 2376132451Sroberto /* 2377132451Sroberto * Extract the k + b r and g^k values from the response. 2378132451Sroberto */ 2379132451Sroberto bctx = BN_CTX_new(); bk = BN_new(); bn = BN_new(); 2380132451Sroberto len = ntohl(ep->vallen); 2381285612Sdelphij ptr = (u_char *)ep->pkt; 2382132451Sroberto if ((sdsa = d2i_DSA_SIG(NULL, &ptr, len)) == NULL) { 2383285612Sdelphij BN_free(bn); BN_free(bk); BN_CTX_free(bctx); 2384285612Sdelphij msyslog(LOG_ERR, "crypto_iff: %s", 2385132451Sroberto ERR_error_string(ERR_get_error(), NULL)); 2386182007Sroberto return (XEVNT_ERR); 2387132451Sroberto } 2388132451Sroberto 2389132451Sroberto /* 2390132451Sroberto * Compute g^(k + b r) g^(q - b)r mod p. 2391132451Sroberto */ 2392310419Sdelphij DSA_get0_key(dsa, &pub_key, NULL); 2393310419Sdelphij DSA_get0_pqg(dsa, &p, NULL, &g); 2394310419Sdelphij DSA_SIG_get0(sdsa, &r, &s); 2395310419Sdelphij BN_mod_exp(bn, pub_key, peer->iffval, p, bctx); 2396310419Sdelphij BN_mod_exp(bk, g, r, p, bctx); 2397310419Sdelphij BN_mod_mul(bn, bn, bk, p, bctx); 2398132451Sroberto 2399132451Sroberto /* 2400132451Sroberto * Verify the hash of the result matches hash(x). 2401132451Sroberto */ 2402132451Sroberto bighash(bn, bn); 2403310419Sdelphij temp = BN_cmp(bn, s); 2404132451Sroberto BN_free(bn); BN_free(bk); BN_CTX_free(bctx); 2405132451Sroberto BN_free(peer->iffval); 2406132451Sroberto peer->iffval = NULL; 2407132451Sroberto DSA_SIG_free(sdsa); 2408132451Sroberto if (temp == 0) 2409132451Sroberto return (XEVNT_OK); 2410182007Sroberto 2411285612Sdelphij msyslog(LOG_NOTICE, "crypto_iff: identity not verified"); 2412285612Sdelphij return (XEVNT_ID); 2413132451Sroberto} 2414132451Sroberto 2415132451Sroberto 2416132451Sroberto/* 2417132451Sroberto *********************************************************************** 2418132451Sroberto * * 2419132451Sroberto * The following routines implement the Guillou-Quisquater (GQ) * 2420132451Sroberto * identity scheme * 2421132451Sroberto * * 2422132451Sroberto *********************************************************************** 2423132451Sroberto * 2424132451Sroberto * The Guillou-Quisquater (GQ) identity scheme is intended for use when 2425285612Sdelphij * the certificate can be used to convey public parameters. The scheme 2426285612Sdelphij * uses a X509v3 certificate extension field do convey the public key of 2427285612Sdelphij * a private key known only to servers. There are two kinds of files: 2428285612Sdelphij * encrypted server files that contain private and public values and 2429285612Sdelphij * nonencrypted client files that contain only public values. New 2430285612Sdelphij * generations of server files must be securely transmitted to all 2431285612Sdelphij * servers of the group; client files can be distributed by any means. 2432285612Sdelphij * The scheme is self contained and independent of new generations of 2433285612Sdelphij * host keys and sign keys. The scheme is self contained and independent 2434285612Sdelphij * of new generations of host keys and sign keys. 2435132451Sroberto * 2436285612Sdelphij * The GQ parameters hide in a RSA cuckoo structure which uses the same 2437285612Sdelphij * parameters. The values are used by an identity scheme based on RSA 2438285612Sdelphij * cryptography and described in Stimson p. 300 (with errors). The 512- 2439285612Sdelphij * bit public modulus is n = p q, where p and q are secret large primes. 2440285612Sdelphij * The TA rolls private random group key b as RSA exponent. These values 2441285612Sdelphij * are known to all group members. 2442132451Sroberto * 2443285612Sdelphij * When rolling new certificates, a server recomputes the private and 2444132451Sroberto * public keys. The private key u is a random roll, while the public key 2445132451Sroberto * is the inverse obscured by the group key v = (u^-1)^b. These values 2446132451Sroberto * replace the private and public keys normally generated by the RSA 2447132451Sroberto * scheme. Alice challenges Bob to confirm identity using the protocol 2448132451Sroberto * described below. 2449132451Sroberto * 2450132451Sroberto * How it works 2451132451Sroberto * 2452132451Sroberto * The scheme goes like this. Both Alice and Bob have the same modulus n 2453132451Sroberto * and some random b as the group key. These values are computed and 2454132451Sroberto * distributed in advance via secret means, although only the group key 2455132451Sroberto * b is truly secret. Each has a private random private key u and public 2456132451Sroberto * key (u^-1)^b, although not necessarily the same ones. Bob and Alice 2457132451Sroberto * can regenerate the key pair from time to time without affecting 2458132451Sroberto * operations. The public key is conveyed on the certificate in an 2459132451Sroberto * extension field; the private key is never revealed. 2460132451Sroberto * 2461132451Sroberto * Alice rolls new random challenge r and sends to Bob in the GQ 2462132451Sroberto * request message. Bob rolls new random k, then computes y = k u^r mod 2463132451Sroberto * n and x = k^b mod n and sends (y, hash(x)) to Alice in the response 2464132451Sroberto * message. Besides making the response shorter, the hash makes it 2465132451Sroberto * effectivey impossible for an intruder to solve for b by observing 2466132451Sroberto * a number of these messages. 2467132451Sroberto * 2468132451Sroberto * Alice receives the response and computes y^b v^r mod n. After a bit 2469132451Sroberto * of algebra, this simplifies to k^b. If the hash of this result 2470132451Sroberto * matches hash(x), Alice knows that Bob has the group key b. The signed 2471132451Sroberto * response binds this knowledge to Bob's private key and the public key 2472132451Sroberto * previously received in his certificate. 2473132451Sroberto * 2474132451Sroberto * crypto_alice2 - construct Alice's challenge in GQ scheme 2475132451Sroberto * 2476132451Sroberto * Returns 2477132451Sroberto * XEVNT_OK success 2478285612Sdelphij * XEVNT_ID bad or missing group key 2479132451Sroberto * XEVNT_PUB bad or missing public key 2480132451Sroberto */ 2481132451Srobertostatic int 2482132451Srobertocrypto_alice2( 2483132451Sroberto struct peer *peer, /* peer pointer */ 2484132451Sroberto struct value *vp /* value pointer */ 2485132451Sroberto ) 2486132451Sroberto{ 2487132451Sroberto RSA *rsa; /* GQ parameters */ 2488132451Sroberto BN_CTX *bctx; /* BIGNUM context */ 2489310419Sdelphij EVP_MD_CTX *ctx; /* signature context */ 2490132451Sroberto tstamp_t tstamp; 2491132451Sroberto u_int len; 2492310419Sdelphij const BIGNUM *n; 2493132451Sroberto 2494132451Sroberto /* 2495132451Sroberto * The identity parameters must have correct format and content. 2496132451Sroberto */ 2497132451Sroberto if (peer->ident_pkey == NULL) 2498132451Sroberto return (XEVNT_ID); 2499182007Sroberto 2500310419Sdelphij if ((rsa = EVP_PKEY_get0_RSA(peer->ident_pkey->pkey)) == NULL) { 2501285612Sdelphij msyslog(LOG_NOTICE, "crypto_alice2: defective key"); 2502132451Sroberto return (XEVNT_PUB); 250382498Sroberto } 250482498Sroberto 250582498Sroberto /* 2506285612Sdelphij * Roll new random r (0 < r < n). 250782498Sroberto */ 2508132451Sroberto if (peer->iffval != NULL) 2509132451Sroberto BN_free(peer->iffval); 2510132451Sroberto peer->iffval = BN_new(); 2511310419Sdelphij RSA_get0_key(rsa, &n, NULL, NULL); 2512310419Sdelphij len = BN_num_bytes(n); 2513132451Sroberto BN_rand(peer->iffval, len * 8, -1, 1); /* r mod n */ 2514285612Sdelphij bctx = BN_CTX_new(); 2515310419Sdelphij BN_mod(peer->iffval, peer->iffval, n, bctx); 2516132451Sroberto BN_CTX_free(bctx); 2517132451Sroberto 2518132451Sroberto /* 2519132451Sroberto * Sign and send to Bob. The filestamp is from the local file. 2520132451Sroberto */ 2521285612Sdelphij memset(vp, 0, sizeof(struct value)); 2522132451Sroberto tstamp = crypto_time(); 2523132451Sroberto vp->tstamp = htonl(tstamp); 2524285612Sdelphij vp->fstamp = htonl(peer->ident_pkey->fstamp); 2525132451Sroberto vp->vallen = htonl(len); 2526132451Sroberto vp->ptr = emalloc(len); 2527132451Sroberto BN_bn2bin(peer->iffval, vp->ptr); 2528132451Sroberto if (tstamp == 0) 2529132451Sroberto return (XEVNT_OK); 2530182007Sroberto 2531132451Sroberto vp->sig = emalloc(sign_siglen); 2532310419Sdelphij ctx = EVP_MD_CTX_new(); 2533310419Sdelphij EVP_SignInit(ctx, sign_digest); 2534310419Sdelphij EVP_SignUpdate(ctx, (u_char *)&vp->tstamp, 12); 2535310419Sdelphij EVP_SignUpdate(ctx, vp->ptr, len); 2536310419Sdelphij if (EVP_SignFinal(ctx, vp->sig, &len, sign_pkey)) { 2537289999Sglebius INSIST(len <= sign_siglen); 2538132451Sroberto vp->siglen = htonl(len); 2539285612Sdelphij } 2540310419Sdelphij EVP_MD_CTX_free(ctx); 2541132451Sroberto return (XEVNT_OK); 2542132451Sroberto} 2543132451Sroberto 2544132451Sroberto 2545132451Sroberto/* 2546132451Sroberto * crypto_bob2 - construct Bob's response to Alice's challenge 2547132451Sroberto * 2548132451Sroberto * Returns 2549132451Sroberto * XEVNT_OK success 2550285612Sdelphij * XEVNT_ERR protocol error 2551182007Sroberto * XEVNT_ID bad or missing group key 2552132451Sroberto */ 2553132451Srobertostatic int 2554132451Srobertocrypto_bob2( 2555132451Sroberto struct exten *ep, /* extension pointer */ 2556132451Sroberto struct value *vp /* value pointer */ 2557132451Sroberto ) 2558132451Sroberto{ 2559132451Sroberto RSA *rsa; /* GQ parameters */ 2560132451Sroberto DSA_SIG *sdsa; /* DSA parameters */ 2561132451Sroberto BN_CTX *bctx; /* BIGNUM context */ 2562310419Sdelphij EVP_MD_CTX *ctx; /* signature context */ 2563132451Sroberto tstamp_t tstamp; /* NTP timestamp */ 2564132451Sroberto BIGNUM *r, *k, *g, *y; 2565132451Sroberto u_char *ptr; 2566132451Sroberto u_int len; 2567285612Sdelphij int s_len; 2568310419Sdelphij const BIGNUM *n, *p, *e; 2569132451Sroberto 2570132451Sroberto /* 2571132451Sroberto * If the GQ parameters are not valid, something awful 2572132451Sroberto * happened or we are being tormented. 2573132451Sroberto */ 2574285612Sdelphij if (gqkey_info == NULL) { 2575285612Sdelphij msyslog(LOG_NOTICE, "crypto_bob2: scheme unavailable"); 2576182007Sroberto return (XEVNT_ID); 257782498Sroberto } 2578310419Sdelphij rsa = EVP_PKEY_get0_RSA(gqkey_info->pkey); 2579310419Sdelphij RSA_get0_key(rsa, &n, &p, &e); 258082498Sroberto 258182498Sroberto /* 2582132451Sroberto * Extract r from the challenge. 258382498Sroberto */ 2584289999Sglebius len = exten_payload_size(ep); 2585289999Sglebius if (len == 0 || len > MAX_VALLEN) 2586289999Sglebius return (XEVNT_LEN); 2587132451Sroberto if ((r = BN_bin2bn((u_char *)ep->pkt, len, NULL)) == NULL) { 2588285612Sdelphij msyslog(LOG_ERR, "crypto_bob2: %s", 2589132451Sroberto ERR_error_string(ERR_get_error(), NULL)); 2590182007Sroberto return (XEVNT_ERR); 2591132451Sroberto } 2592132451Sroberto 2593132451Sroberto /* 2594132451Sroberto * Bob rolls random k (0 < k < n), computes y = k u^r mod n and 2595132451Sroberto * x = k^b mod n, then sends (y, hash(x)) to Alice. 2596132451Sroberto */ 2597132451Sroberto bctx = BN_CTX_new(); k = BN_new(); g = BN_new(); y = BN_new(); 2598132451Sroberto sdsa = DSA_SIG_new(); 2599132451Sroberto BN_rand(k, len * 8, -1, 1); /* k */ 2600310419Sdelphij BN_mod(k, k, n, bctx); 2601310419Sdelphij BN_mod_exp(y, p, r, n, bctx); /* u^r mod n */ 2602310419Sdelphij BN_mod_mul(y, k, y, n, bctx); /* k u^r mod n */ 2603310419Sdelphij BN_mod_exp(g, k, e, n, bctx); /* k^b mod n */ 2604132451Sroberto bighash(g, g); 2605310419Sdelphij DSA_SIG_set0(sdsa, y, g); 2606132451Sroberto BN_CTX_free(bctx); 2607310419Sdelphij BN_free(r); BN_free(k); 2608285612Sdelphij#ifdef DEBUG 2609285612Sdelphij if (debug > 1) 2610285612Sdelphij RSA_print_fp(stdout, rsa, 0); 2611285612Sdelphij#endif 2612132451Sroberto 2613132451Sroberto /* 2614285612Sdelphij * Encode the values in ASN.1 and sign. The filestamp is from 2615285612Sdelphij * the local file. 2616132451Sroberto */ 2617285612Sdelphij len = s_len = i2d_DSA_SIG(sdsa, NULL); 2618285612Sdelphij if (s_len <= 0) { 2619285612Sdelphij msyslog(LOG_ERR, "crypto_bob2: %s", 2620132451Sroberto ERR_error_string(ERR_get_error(), NULL)); 2621132451Sroberto DSA_SIG_free(sdsa); 2622182007Sroberto return (XEVNT_ERR); 2623132451Sroberto } 2624285612Sdelphij memset(vp, 0, sizeof(struct value)); 2625285612Sdelphij tstamp = crypto_time(); 2626285612Sdelphij vp->tstamp = htonl(tstamp); 2627285612Sdelphij vp->fstamp = htonl(gqkey_info->fstamp); 2628132451Sroberto vp->vallen = htonl(len); 2629132451Sroberto ptr = emalloc(len); 2630132451Sroberto vp->ptr = ptr; 2631132451Sroberto i2d_DSA_SIG(sdsa, &ptr); 2632132451Sroberto DSA_SIG_free(sdsa); 2633132451Sroberto if (tstamp == 0) 2634132451Sroberto return (XEVNT_OK); 2635182007Sroberto 2636132451Sroberto vp->sig = emalloc(sign_siglen); 2637310419Sdelphij ctx = EVP_MD_CTX_new(); 2638310419Sdelphij EVP_SignInit(ctx, sign_digest); 2639310419Sdelphij EVP_SignUpdate(ctx, (u_char *)&vp->tstamp, 12); 2640310419Sdelphij EVP_SignUpdate(ctx, vp->ptr, len); 2641310419Sdelphij if (EVP_SignFinal(ctx, vp->sig, &len, sign_pkey)) { 2642289999Sglebius INSIST(len <= sign_siglen); 2643132451Sroberto vp->siglen = htonl(len); 2644285612Sdelphij } 2645310419Sdelphij EVP_MD_CTX_free(ctx); 2646132451Sroberto return (XEVNT_OK); 2647132451Sroberto} 2648132451Sroberto 2649132451Sroberto 2650132451Sroberto/* 2651132451Sroberto * crypto_gq - verify Bob's response to Alice's challenge 2652132451Sroberto * 2653132451Sroberto * Returns 2654132451Sroberto * XEVNT_OK success 2655182007Sroberto * XEVNT_ERR protocol error 2656132451Sroberto * XEVNT_FSP bad filestamp 2657285612Sdelphij * XEVNT_ID bad or missing group keys 2658285612Sdelphij * XEVNT_PUB bad or missing public key 2659132451Sroberto */ 2660132451Srobertoint 2661132451Srobertocrypto_gq( 2662132451Sroberto struct exten *ep, /* extension pointer */ 2663132451Sroberto struct peer *peer /* peer structure pointer */ 2664132451Sroberto ) 2665132451Sroberto{ 2666132451Sroberto RSA *rsa; /* GQ parameters */ 2667132451Sroberto BN_CTX *bctx; /* BIGNUM context */ 2668132451Sroberto DSA_SIG *sdsa; /* RSA signature context fake */ 2669132451Sroberto BIGNUM *y, *v; 2670285612Sdelphij const u_char *ptr; 2671285612Sdelphij long len; 2672285612Sdelphij u_int temp; 2673310419Sdelphij const BIGNUM *n, *e; 2674310419Sdelphij const BIGNUM *r, *s; 2675132451Sroberto 2676132451Sroberto /* 2677132451Sroberto * If the GQ parameters are not valid or no challenge was sent, 2678285612Sdelphij * something awful happened or we are being tormented. Note that 2679285612Sdelphij * the filestamp on the local key file can be greater than on 2680285612Sdelphij * the remote parameter file if the keys have been refreshed. 2681132451Sroberto */ 2682132451Sroberto if (peer->ident_pkey == NULL) { 2683285612Sdelphij msyslog(LOG_NOTICE, "crypto_gq: scheme unavailable"); 2684182007Sroberto return (XEVNT_ID); 2685132451Sroberto } 2686285612Sdelphij if (ntohl(ep->fstamp) < peer->ident_pkey->fstamp) { 2687285612Sdelphij msyslog(LOG_NOTICE, "crypto_gq: invalid filestamp %u", 2688132451Sroberto ntohl(ep->fstamp)); 2689132451Sroberto return (XEVNT_FSP); 2690132451Sroberto } 2691310419Sdelphij if ((rsa = EVP_PKEY_get0_RSA(peer->ident_pkey->pkey)) == NULL) { 2692285612Sdelphij msyslog(LOG_NOTICE, "crypto_gq: defective key"); 2693132451Sroberto return (XEVNT_PUB); 2694132451Sroberto } 2695310419Sdelphij RSA_get0_key(rsa, &n, NULL, &e); 2696132451Sroberto if (peer->iffval == NULL) { 2697285612Sdelphij msyslog(LOG_NOTICE, "crypto_gq: missing challenge"); 2698182007Sroberto return (XEVNT_ID); 2699132451Sroberto } 2700132451Sroberto 2701132451Sroberto /* 2702132451Sroberto * Extract the y = k u^r and hash(x = k^b) values from the 2703132451Sroberto * response. 2704132451Sroberto */ 2705132451Sroberto bctx = BN_CTX_new(); y = BN_new(); v = BN_new(); 2706132451Sroberto len = ntohl(ep->vallen); 2707285612Sdelphij ptr = (u_char *)ep->pkt; 2708132451Sroberto if ((sdsa = d2i_DSA_SIG(NULL, &ptr, len)) == NULL) { 2709285612Sdelphij BN_CTX_free(bctx); BN_free(y); BN_free(v); 2710285612Sdelphij msyslog(LOG_ERR, "crypto_gq: %s", 2711132451Sroberto ERR_error_string(ERR_get_error(), NULL)); 2712182007Sroberto return (XEVNT_ERR); 2713132451Sroberto } 2714310419Sdelphij DSA_SIG_get0(sdsa, &r, &s); 2715132451Sroberto 2716132451Sroberto /* 2717132451Sroberto * Compute v^r y^b mod n. 2718132451Sroberto */ 2719285612Sdelphij if (peer->grpkey == NULL) { 2720285612Sdelphij msyslog(LOG_NOTICE, "crypto_gq: missing group key"); 2721285612Sdelphij return (XEVNT_ID); 2722285612Sdelphij } 2723310419Sdelphij BN_mod_exp(v, peer->grpkey, peer->iffval, n, bctx); 2724132451Sroberto /* v^r mod n */ 2725310419Sdelphij BN_mod_exp(y, r, e, n, bctx); /* y^b mod n */ 2726310419Sdelphij BN_mod_mul(y, v, y, n, bctx); /* v^r y^b mod n */ 2727132451Sroberto 2728132451Sroberto /* 2729132451Sroberto * Verify the hash of the result matches hash(x). 2730132451Sroberto */ 2731132451Sroberto bighash(y, y); 2732310419Sdelphij temp = BN_cmp(y, s); 2733132451Sroberto BN_CTX_free(bctx); BN_free(y); BN_free(v); 2734132451Sroberto BN_free(peer->iffval); 2735132451Sroberto peer->iffval = NULL; 2736132451Sroberto DSA_SIG_free(sdsa); 2737132451Sroberto if (temp == 0) 2738132451Sroberto return (XEVNT_OK); 2739182007Sroberto 2740285612Sdelphij msyslog(LOG_NOTICE, "crypto_gq: identity not verified"); 2741285612Sdelphij return (XEVNT_ID); 2742132451Sroberto} 2743132451Sroberto 2744132451Sroberto 2745132451Sroberto/* 2746132451Sroberto *********************************************************************** 2747132451Sroberto * * 2748132451Sroberto * The following routines implement the Mu-Varadharajan (MV) identity * 2749132451Sroberto * scheme * 2750132451Sroberto * * 2751132451Sroberto *********************************************************************** 2752285612Sdelphij * 2753132451Sroberto * The Mu-Varadharajan (MV) cryptosystem was originally intended when 2754132451Sroberto * servers broadcast messages to clients, but clients never send 2755132451Sroberto * messages to servers. There is one encryption key for the server and a 2756132451Sroberto * separate decryption key for each client. It operated something like a 2757132451Sroberto * pay-per-view satellite broadcasting system where the session key is 2758132451Sroberto * encrypted by the broadcaster and the decryption keys are held in a 2759132451Sroberto * tamperproof set-top box. 2760132451Sroberto * 2761132451Sroberto * The MV parameters and private encryption key hide in a DSA cuckoo 2762132451Sroberto * structure which uses the same parameters, but generated in a 2763132451Sroberto * different way. The values are used in an encryption scheme similar to 2764132451Sroberto * El Gamal cryptography and a polynomial formed from the expansion of 2765132451Sroberto * product terms (x - x[j]), as described in Mu, Y., and V. 2766132451Sroberto * Varadharajan: Robust and Secure Broadcasting, Proc. Indocrypt 2001, 2767132451Sroberto * 223-231. The paper has significant errors and serious omissions. 2768132451Sroberto * 2769285612Sdelphij * Let q be the product of n distinct primes s1[j] (j = 1...n), where 2770285612Sdelphij * each s1[j] has m significant bits. Let p be a prime p = 2 * q + 1, so 2771285612Sdelphij * that q and each s1[j] divide p - 1 and p has M = n * m + 1 2772285612Sdelphij * significant bits. Let g be a generator of Zp; that is, gcd(g, p - 1) 2773285612Sdelphij * = 1 and g^q = 1 mod p. We do modular arithmetic over Zq and then 2774285612Sdelphij * project into Zp* as exponents of g. Sometimes we have to compute an 2775285612Sdelphij * inverse b^-1 of random b in Zq, but for that purpose we require 2776285612Sdelphij * gcd(b, q) = 1. We expect M to be in the 500-bit range and n 2777285612Sdelphij * relatively small, like 30. These are the parameters of the scheme and 2778285612Sdelphij * they are expensive to compute. 2779132451Sroberto * 2780132451Sroberto * We set up an instance of the scheme as follows. A set of random 2781132451Sroberto * values x[j] mod q (j = 1...n), are generated as the zeros of a 2782132451Sroberto * polynomial of order n. The product terms (x - x[j]) are expanded to 2783132451Sroberto * form coefficients a[i] mod q (i = 0...n) in powers of x. These are 2784132451Sroberto * used as exponents of the generator g mod p to generate the private 2785132451Sroberto * encryption key A. The pair (gbar, ghat) of public server keys and the 2786132451Sroberto * pairs (xbar[j], xhat[j]) (j = 1...n) of private client keys are used 2787132451Sroberto * to construct the decryption keys. The devil is in the details. 2788132451Sroberto * 2789285612Sdelphij * This routine generates a private server encryption file including the 2790285612Sdelphij * private encryption key E and partial decryption keys gbar and ghat. 2791285612Sdelphij * It then generates public client decryption files including the public 2792285612Sdelphij * keys xbar[j] and xhat[j] for each client j. The partial decryption 2793285612Sdelphij * files are used to compute the inverse of E. These values are suitably 2794285612Sdelphij * blinded so secrets are not revealed. 2795285612Sdelphij * 2796132451Sroberto * The distinguishing characteristic of this scheme is the capability to 2797132451Sroberto * revoke keys. Included in the calculation of E, gbar and ghat is the 2798285612Sdelphij * product s = prod(s1[j]) (j = 1...n) above. If the factor s1[j] is 2799132451Sroberto * subsequently removed from the product and E, gbar and ghat 2800132451Sroberto * recomputed, the jth client will no longer be able to compute E^-1 and 2801285612Sdelphij * thus unable to decrypt the messageblock. 2802132451Sroberto * 2803132451Sroberto * How it works 2804132451Sroberto * 2805285612Sdelphij * The scheme goes like this. Bob has the server values (p, E, q, gbar, 2806285612Sdelphij * ghat) and Alice has the client values (p, xbar, xhat). 2807132451Sroberto * 2808285612Sdelphij * Alice rolls new random nonce r mod p and sends to Bob in the MV 2809285612Sdelphij * request message. Bob rolls random nonce k mod q, encrypts y = r E^k 2810285612Sdelphij * mod p and sends (y, gbar^k, ghat^k) to Alice. 2811132451Sroberto * 2812285612Sdelphij * Alice receives the response and computes the inverse (E^k)^-1 from 2813285612Sdelphij * the partial decryption keys gbar^k, ghat^k, xbar and xhat. She then 2814285612Sdelphij * decrypts y and verifies it matches the original r. The signed 2815285612Sdelphij * response binds this knowledge to Bob's private key and the public key 2816285612Sdelphij * previously received in his certificate. 2817132451Sroberto * 2818132451Sroberto * crypto_alice3 - construct Alice's challenge in MV scheme 2819132451Sroberto * 2820132451Sroberto * Returns 2821132451Sroberto * XEVNT_OK success 2822285612Sdelphij * XEVNT_ID bad or missing group key 2823132451Sroberto * XEVNT_PUB bad or missing public key 2824132451Sroberto */ 2825132451Srobertostatic int 2826132451Srobertocrypto_alice3( 2827132451Sroberto struct peer *peer, /* peer pointer */ 2828132451Sroberto struct value *vp /* value pointer */ 2829132451Sroberto ) 2830132451Sroberto{ 2831132451Sroberto DSA *dsa; /* MV parameters */ 2832132451Sroberto BN_CTX *bctx; /* BIGNUM context */ 2833310419Sdelphij EVP_MD_CTX *ctx; /* signature context */ 2834132451Sroberto tstamp_t tstamp; 2835132451Sroberto u_int len; 2836310419Sdelphij const BIGNUM *p; 2837132451Sroberto 2838132451Sroberto /* 2839132451Sroberto * The identity parameters must have correct format and content. 2840132451Sroberto */ 2841132451Sroberto if (peer->ident_pkey == NULL) 2842132451Sroberto return (XEVNT_ID); 2843182007Sroberto 2844310419Sdelphij if ((dsa = EVP_PKEY_get0_DSA(peer->ident_pkey->pkey)) == NULL) { 2845285612Sdelphij msyslog(LOG_NOTICE, "crypto_alice3: defective key"); 2846132451Sroberto return (XEVNT_PUB); 284782498Sroberto } 2848310419Sdelphij DSA_get0_pqg(dsa, &p, NULL, NULL); 284982498Sroberto 285082498Sroberto /* 2851285612Sdelphij * Roll new random r (0 < r < q). 285282498Sroberto */ 2853132451Sroberto if (peer->iffval != NULL) 2854132451Sroberto BN_free(peer->iffval); 2855132451Sroberto peer->iffval = BN_new(); 2856310419Sdelphij len = BN_num_bytes(p); 2857285612Sdelphij BN_rand(peer->iffval, len * 8, -1, 1); /* r mod p */ 2858285612Sdelphij bctx = BN_CTX_new(); 2859310419Sdelphij BN_mod(peer->iffval, peer->iffval, p, bctx); 2860132451Sroberto BN_CTX_free(bctx); 2861132451Sroberto 2862132451Sroberto /* 2863132451Sroberto * Sign and send to Bob. The filestamp is from the local file. 2864132451Sroberto */ 2865285612Sdelphij memset(vp, 0, sizeof(struct value)); 2866132451Sroberto tstamp = crypto_time(); 2867132451Sroberto vp->tstamp = htonl(tstamp); 2868285612Sdelphij vp->fstamp = htonl(peer->ident_pkey->fstamp); 2869132451Sroberto vp->vallen = htonl(len); 2870132451Sroberto vp->ptr = emalloc(len); 2871132451Sroberto BN_bn2bin(peer->iffval, vp->ptr); 2872132451Sroberto if (tstamp == 0) 2873132451Sroberto return (XEVNT_OK); 2874182007Sroberto 2875132451Sroberto vp->sig = emalloc(sign_siglen); 2876310419Sdelphij ctx = EVP_MD_CTX_new(); 2877310419Sdelphij EVP_SignInit(ctx, sign_digest); 2878310419Sdelphij EVP_SignUpdate(ctx, (u_char *)&vp->tstamp, 12); 2879310419Sdelphij EVP_SignUpdate(ctx, vp->ptr, len); 2880310419Sdelphij if (EVP_SignFinal(ctx, vp->sig, &len, sign_pkey)) { 2881289999Sglebius INSIST(len <= sign_siglen); 2882132451Sroberto vp->siglen = htonl(len); 2883285612Sdelphij } 2884310419Sdelphij EVP_MD_CTX_free(ctx); 2885132451Sroberto return (XEVNT_OK); 2886132451Sroberto} 2887132451Sroberto 2888132451Sroberto 2889132451Sroberto/* 2890132451Sroberto * crypto_bob3 - construct Bob's response to Alice's challenge 2891132451Sroberto * 2892132451Sroberto * Returns 2893132451Sroberto * XEVNT_OK success 2894182007Sroberto * XEVNT_ERR protocol error 2895132451Sroberto */ 2896132451Srobertostatic int 2897132451Srobertocrypto_bob3( 2898132451Sroberto struct exten *ep, /* extension pointer */ 2899132451Sroberto struct value *vp /* value pointer */ 2900132451Sroberto ) 2901132451Sroberto{ 2902132451Sroberto DSA *dsa; /* MV parameters */ 2903132451Sroberto DSA *sdsa; /* DSA signature context fake */ 2904132451Sroberto BN_CTX *bctx; /* BIGNUM context */ 2905310419Sdelphij EVP_MD_CTX *ctx; /* signature context */ 2906132451Sroberto tstamp_t tstamp; /* NTP timestamp */ 2907132451Sroberto BIGNUM *r, *k, *u; 2908132451Sroberto u_char *ptr; 2909132451Sroberto u_int len; 2910310419Sdelphij const BIGNUM *p, *q, *g; 2911310419Sdelphij const BIGNUM *pub_key, *priv_key; 2912310419Sdelphij BIGNUM *sp, *sq, *sg; 2913132451Sroberto 2914132451Sroberto /* 2915132451Sroberto * If the MV parameters are not valid, something awful 2916132451Sroberto * happened or we are being tormented. 2917132451Sroberto */ 2918285612Sdelphij if (mvkey_info == NULL) { 2919285612Sdelphij msyslog(LOG_NOTICE, "crypto_bob3: scheme unavailable"); 2920182007Sroberto return (XEVNT_ID); 292182498Sroberto } 2922310419Sdelphij dsa = EVP_PKEY_get0_DSA(mvkey_info->pkey); 2923310419Sdelphij DSA_get0_pqg(dsa, &p, &q, &g); 2924310419Sdelphij DSA_get0_key(dsa, &pub_key, &priv_key); 2925132451Sroberto 2926132451Sroberto /* 2927132451Sroberto * Extract r from the challenge. 2928132451Sroberto */ 2929289999Sglebius len = exten_payload_size(ep); 2930289999Sglebius if (len == 0 || len > MAX_VALLEN) 2931289999Sglebius return (XEVNT_LEN); 2932132451Sroberto if ((r = BN_bin2bn((u_char *)ep->pkt, len, NULL)) == NULL) { 2933285612Sdelphij msyslog(LOG_ERR, "crypto_bob3: %s", 2934132451Sroberto ERR_error_string(ERR_get_error(), NULL)); 2935182007Sroberto return (XEVNT_ERR); 2936132451Sroberto } 2937132451Sroberto 2938132451Sroberto /* 2939132451Sroberto * Bob rolls random k (0 < k < q), making sure it is not a 2940285612Sdelphij * factor of q. He then computes y = r A^k and sends (y, gbar^k, 2941285612Sdelphij * and ghat^k) to Alice. 2942132451Sroberto */ 2943132451Sroberto bctx = BN_CTX_new(); k = BN_new(); u = BN_new(); 2944132451Sroberto sdsa = DSA_new(); 2945310419Sdelphij sp = BN_new(); sq = BN_new(); sg = BN_new(); 2946132451Sroberto while (1) { 2947310419Sdelphij BN_rand(k, BN_num_bits(q), 0, 0); 2948310419Sdelphij BN_mod(k, k, q, bctx); 2949310419Sdelphij BN_gcd(u, k, q, bctx); 2950132451Sroberto if (BN_is_one(u)) 2951132451Sroberto break; 2952132451Sroberto } 2953310419Sdelphij BN_mod_exp(u, g, k, p, bctx); /* A^k r */ 2954310419Sdelphij BN_mod_mul(sp, u, r, p, bctx); 2955310419Sdelphij BN_mod_exp(sq, priv_key, k, p, bctx); /* gbar */ 2956310419Sdelphij BN_mod_exp(sg, pub_key, k, p, bctx); /* ghat */ 2957310419Sdelphij DSA_set0_key(sdsa, BN_dup(pub_key), NULL); 2958310419Sdelphij DSA_set0_pqg(sdsa, sp, sq, sg); 2959132451Sroberto BN_CTX_free(bctx); BN_free(k); BN_free(r); BN_free(u); 2960285612Sdelphij#ifdef DEBUG 2961285612Sdelphij if (debug > 1) 2962285612Sdelphij DSA_print_fp(stdout, sdsa, 0); 2963285612Sdelphij#endif 2964132451Sroberto 2965132451Sroberto /* 2966285612Sdelphij * Encode the values in ASN.1 and sign. The filestamp is from 2967285612Sdelphij * the local file. 2968132451Sroberto */ 2969285612Sdelphij memset(vp, 0, sizeof(struct value)); 2970132451Sroberto tstamp = crypto_time(); 2971132451Sroberto vp->tstamp = htonl(tstamp); 2972285612Sdelphij vp->fstamp = htonl(mvkey_info->fstamp); 2973132451Sroberto len = i2d_DSAparams(sdsa, NULL); 2974285612Sdelphij if (len == 0) { 2975285612Sdelphij msyslog(LOG_ERR, "crypto_bob3: %s", 2976132451Sroberto ERR_error_string(ERR_get_error(), NULL)); 2977132451Sroberto DSA_free(sdsa); 2978182007Sroberto return (XEVNT_ERR); 2979132451Sroberto } 2980132451Sroberto vp->vallen = htonl(len); 2981132451Sroberto ptr = emalloc(len); 2982132451Sroberto vp->ptr = ptr; 2983132451Sroberto i2d_DSAparams(sdsa, &ptr); 2984132451Sroberto DSA_free(sdsa); 2985132451Sroberto if (tstamp == 0) 2986132451Sroberto return (XEVNT_OK); 2987182007Sroberto 2988132451Sroberto vp->sig = emalloc(sign_siglen); 2989310419Sdelphij ctx = EVP_MD_CTX_new(); 2990310419Sdelphij EVP_SignInit(ctx, sign_digest); 2991310419Sdelphij EVP_SignUpdate(ctx, (u_char *)&vp->tstamp, 12); 2992310419Sdelphij EVP_SignUpdate(ctx, vp->ptr, len); 2993310419Sdelphij if (EVP_SignFinal(ctx, vp->sig, &len, sign_pkey)) { 2994289999Sglebius INSIST(len <= sign_siglen); 2995132451Sroberto vp->siglen = htonl(len); 2996285612Sdelphij } 2997310419Sdelphij EVP_MD_CTX_free(ctx); 2998132451Sroberto return (XEVNT_OK); 2999132451Sroberto} 3000132451Sroberto 3001132451Sroberto 3002132451Sroberto/* 3003132451Sroberto * crypto_mv - verify Bob's response to Alice's challenge 3004132451Sroberto * 3005132451Sroberto * Returns 3006132451Sroberto * XEVNT_OK success 3007182007Sroberto * XEVNT_ERR protocol error 3008132451Sroberto * XEVNT_FSP bad filestamp 3009285612Sdelphij * XEVNT_ID bad or missing group key 3010285612Sdelphij * XEVNT_PUB bad or missing public key 3011132451Sroberto */ 3012132451Srobertoint 3013132451Srobertocrypto_mv( 3014132451Sroberto struct exten *ep, /* extension pointer */ 3015132451Sroberto struct peer *peer /* peer structure pointer */ 3016132451Sroberto ) 3017132451Sroberto{ 3018132451Sroberto DSA *dsa; /* MV parameters */ 3019132451Sroberto DSA *sdsa; /* DSA parameters */ 3020132451Sroberto BN_CTX *bctx; /* BIGNUM context */ 3021132451Sroberto BIGNUM *k, *u, *v; 3022132451Sroberto u_int len; 3023285612Sdelphij const u_char *ptr; 3024132451Sroberto int temp; 3025310419Sdelphij const BIGNUM *p; 3026310419Sdelphij const BIGNUM *pub_key, *priv_key; 3027310419Sdelphij const BIGNUM *sp, *sq, *sg; 3028132451Sroberto 3029132451Sroberto /* 3030132451Sroberto * If the MV parameters are not valid or no challenge was sent, 3031132451Sroberto * something awful happened or we are being tormented. 3032132451Sroberto */ 3033132451Sroberto if (peer->ident_pkey == NULL) { 3034285612Sdelphij msyslog(LOG_NOTICE, "crypto_mv: scheme unavailable"); 3035182007Sroberto return (XEVNT_ID); 3036132451Sroberto } 3037285612Sdelphij if (ntohl(ep->fstamp) != peer->ident_pkey->fstamp) { 3038285612Sdelphij msyslog(LOG_NOTICE, "crypto_mv: invalid filestamp %u", 3039132451Sroberto ntohl(ep->fstamp)); 3040132451Sroberto return (XEVNT_FSP); 3041132451Sroberto } 3042310419Sdelphij if ((dsa = EVP_PKEY_get0_DSA(peer->ident_pkey->pkey)) == NULL) { 3043285612Sdelphij msyslog(LOG_NOTICE, "crypto_mv: defective key"); 3044132451Sroberto return (XEVNT_PUB); 3045132451Sroberto } 3046310419Sdelphij DSA_get0_pqg(dsa, &p, NULL, NULL); 3047310419Sdelphij DSA_get0_key(dsa, &pub_key, &priv_key); 3048132451Sroberto if (peer->iffval == NULL) { 3049285612Sdelphij msyslog(LOG_NOTICE, "crypto_mv: missing challenge"); 3050182007Sroberto return (XEVNT_ID); 3051132451Sroberto } 3052132451Sroberto 3053132451Sroberto /* 3054285612Sdelphij * Extract the y, gbar and ghat values from the response. 3055132451Sroberto */ 3056132451Sroberto bctx = BN_CTX_new(); k = BN_new(); u = BN_new(); v = BN_new(); 3057132451Sroberto len = ntohl(ep->vallen); 3058285612Sdelphij ptr = (u_char *)ep->pkt; 3059132451Sroberto if ((sdsa = d2i_DSAparams(NULL, &ptr, len)) == NULL) { 3060285612Sdelphij msyslog(LOG_ERR, "crypto_mv: %s", 3061132451Sroberto ERR_error_string(ERR_get_error(), NULL)); 3062182007Sroberto return (XEVNT_ERR); 3063132451Sroberto } 3064310419Sdelphij DSA_get0_pqg(sdsa, &sp, &sq, &sg); 3065132451Sroberto 3066132451Sroberto /* 3067285612Sdelphij * Compute (gbar^xhat ghat^xbar) mod p. 3068132451Sroberto */ 3069310419Sdelphij BN_mod_exp(u, sq, pub_key, p, bctx); 3070310419Sdelphij BN_mod_exp(v, sg, priv_key, p, bctx); 3071310419Sdelphij BN_mod_mul(u, u, v, p, bctx); 3072310419Sdelphij BN_mod_mul(u, u, sp, p, bctx); 3073132451Sroberto 3074132451Sroberto /* 3075285612Sdelphij * The result should match r. 3076132451Sroberto */ 3077285612Sdelphij temp = BN_cmp(u, peer->iffval); 3078132451Sroberto BN_CTX_free(bctx); BN_free(k); BN_free(u); BN_free(v); 3079132451Sroberto BN_free(peer->iffval); 3080132451Sroberto peer->iffval = NULL; 3081132451Sroberto DSA_free(sdsa); 3082132451Sroberto if (temp == 0) 3083132451Sroberto return (XEVNT_OK); 3084182007Sroberto 3085285612Sdelphij msyslog(LOG_NOTICE, "crypto_mv: identity not verified"); 3086285612Sdelphij return (XEVNT_ID); 3087132451Sroberto} 3088132451Sroberto 3089132451Sroberto 3090132451Sroberto/* 3091132451Sroberto *********************************************************************** 3092132451Sroberto * * 3093132451Sroberto * The following routines are used to manipulate certificates * 3094132451Sroberto * * 3095132451Sroberto *********************************************************************** 3096132451Sroberto */ 3097132451Sroberto/* 3098182007Sroberto * cert_sign - sign x509 certificate equest and update value structure. 3099132451Sroberto * 3100182007Sroberto * The certificate request includes a copy of the host certificate, 3101182007Sroberto * which includes the version number, subject name and public key of the 3102182007Sroberto * host. The resulting certificate includes these values plus the 3103182007Sroberto * serial number, issuer name and valid interval of the server. The 3104182007Sroberto * valid interval extends from the current time to the same time one 3105182007Sroberto * year hence. This may extend the life of the signed certificate beyond 3106182007Sroberto * that of the signer certificate. 3107132451Sroberto * 3108182007Sroberto * It is convenient to use the NTP seconds of the current time as the 3109182007Sroberto * serial number. In the value structure the timestamp is the current 3110182007Sroberto * time and the filestamp is taken from the extension field. Note this 3111182007Sroberto * routine is called only when the client clock is synchronized to a 3112182007Sroberto * proventic source, so timestamp comparisons are valid. 3113182007Sroberto * 3114182007Sroberto * The host certificate is valid from the time it was generated for a 3115182007Sroberto * period of one year. A signed certificate is valid from the time of 3116182007Sroberto * signature for a period of one year, but only the host certificate (or 3117182007Sroberto * sign certificate if used) is actually used to encrypt and decrypt 3118182007Sroberto * signatures. The signature trail is built from the client via the 3119182007Sroberto * intermediate servers to the trusted server. Each signature on the 3120182007Sroberto * trail must be valid at the time of signature, but it could happen 3121182007Sroberto * that a signer certificate expire before the signed certificate, which 3122182007Sroberto * remains valid until its expiration. 3123182007Sroberto * 3124132451Sroberto * Returns 3125132451Sroberto * XEVNT_OK success 3126285612Sdelphij * XEVNT_CRT bad or missing certificate 3127285612Sdelphij * XEVNT_PER host certificate expired 3128132451Sroberto * XEVNT_PUB bad or missing public key 3129132451Sroberto * XEVNT_VFY certificate not verified 313082498Sroberto */ 3131132451Srobertostatic int 3132132451Srobertocert_sign( 3133132451Sroberto struct exten *ep, /* extension field pointer */ 3134132451Sroberto struct value *vp /* value pointer */ 313582498Sroberto ) 313682498Sroberto{ 3137132451Sroberto X509 *req; /* X509 certificate request */ 3138132451Sroberto X509 *cert; /* X509 certificate */ 3139132451Sroberto X509_EXTENSION *ext; /* certificate extension */ 3140132451Sroberto ASN1_INTEGER *serial; /* serial number */ 3141132451Sroberto X509_NAME *subj; /* distinguished (common) name */ 3142132451Sroberto EVP_PKEY *pkey; /* public key */ 3143310419Sdelphij EVP_MD_CTX *ctx; /* message digest context */ 3144132451Sroberto tstamp_t tstamp; /* NTP timestamp */ 3145285612Sdelphij struct calendar tscal; 3146132451Sroberto u_int len; 3147285612Sdelphij const u_char *cptr; 3148285612Sdelphij u_char *ptr; 3149132451Sroberto int i, temp; 315082498Sroberto 315182498Sroberto /* 3152132451Sroberto * Decode ASN.1 objects and construct certificate structure. 3153182007Sroberto * Make sure the system clock is synchronized to a proventic 3154182007Sroberto * source. 315582498Sroberto */ 3156132451Sroberto tstamp = crypto_time(); 3157132451Sroberto if (tstamp == 0) 3158132451Sroberto return (XEVNT_TSP); 3159132451Sroberto 3160289999Sglebius len = exten_payload_size(ep); 3161289999Sglebius if (len == 0 || len > MAX_VALLEN) 3162289999Sglebius return (XEVNT_LEN); 3163285612Sdelphij cptr = (void *)ep->pkt; 3164289999Sglebius if ((req = d2i_X509(NULL, &cptr, len)) == NULL) { 3165285612Sdelphij msyslog(LOG_ERR, "cert_sign: %s", 3166132451Sroberto ERR_error_string(ERR_get_error(), NULL)); 3167132451Sroberto return (XEVNT_CRT); 316882498Sroberto } 3169132451Sroberto /* 3170132451Sroberto * Extract public key and check for errors. 3171132451Sroberto */ 3172132451Sroberto if ((pkey = X509_get_pubkey(req)) == NULL) { 3173285612Sdelphij msyslog(LOG_ERR, "cert_sign: %s", 3174132451Sroberto ERR_error_string(ERR_get_error(), NULL)); 3175132451Sroberto X509_free(req); 3176132451Sroberto return (XEVNT_PUB); 3177132451Sroberto } 317882498Sroberto 317982498Sroberto /* 3180285612Sdelphij * Generate X509 certificate signed by this server. If this is a 3181285612Sdelphij * trusted host, the issuer name is the group name; otherwise, 3182285612Sdelphij * it is the host name. Also copy any extensions that might be 3183285612Sdelphij * present. 318482498Sroberto */ 3185132451Sroberto cert = X509_new(); 3186132451Sroberto X509_set_version(cert, X509_get_version(req)); 3187132451Sroberto serial = ASN1_INTEGER_new(); 3188132451Sroberto ASN1_INTEGER_set(serial, tstamp); 3189132451Sroberto X509_set_serialNumber(cert, serial); 3190132451Sroberto X509_gmtime_adj(X509_get_notBefore(cert), 0L); 3191132451Sroberto X509_gmtime_adj(X509_get_notAfter(cert), YEAR); 3192132451Sroberto subj = X509_get_issuer_name(cert); 3193132451Sroberto X509_NAME_add_entry_by_txt(subj, "commonName", MBSTRING_ASC, 3194285612Sdelphij hostval.ptr, strlen((const char *)hostval.ptr), -1, 0); 3195132451Sroberto subj = X509_get_subject_name(req); 3196132451Sroberto X509_set_subject_name(cert, subj); 3197132451Sroberto X509_set_pubkey(cert, pkey); 3198132451Sroberto temp = X509_get_ext_count(req); 3199132451Sroberto for (i = 0; i < temp; i++) { 3200132451Sroberto ext = X509_get_ext(req, i); 3201285612Sdelphij INSIST(X509_add_ext(cert, ext, -1)); 320282498Sroberto } 3203132451Sroberto X509_free(req); 320482498Sroberto 320582498Sroberto /* 3206285612Sdelphij * Sign and verify the client certificate, but only if the host 3207285612Sdelphij * certificate has not expired. 320882498Sroberto */ 3209285612Sdelphij (void)ntpcal_ntp_to_date(&tscal, tstamp, NULL); 3210285612Sdelphij if ((calcomp(&tscal, &(cert_host->first)) < 0) 3211285612Sdelphij || (calcomp(&tscal, &(cert_host->last)) > 0)) { 3212285612Sdelphij X509_free(cert); 3213285612Sdelphij return (XEVNT_PER); 3214285612Sdelphij } 3215132451Sroberto X509_sign(cert, sign_pkey, sign_digest); 3216285612Sdelphij if (X509_verify(cert, sign_pkey) <= 0) { 3217285612Sdelphij msyslog(LOG_ERR, "cert_sign: %s", 3218132451Sroberto ERR_error_string(ERR_get_error(), NULL)); 3219132451Sroberto X509_free(cert); 3220132451Sroberto return (XEVNT_VFY); 3221132451Sroberto } 3222132451Sroberto len = i2d_X509(cert, NULL); 322382498Sroberto 322482498Sroberto /* 3225132451Sroberto * Build and sign the value structure. We have to sign it here, 3226132451Sroberto * since the response has to be returned right away. This is a 3227132451Sroberto * clogging hazard. 322882498Sroberto */ 3229132451Sroberto memset(vp, 0, sizeof(struct value)); 3230132451Sroberto vp->tstamp = htonl(tstamp); 3231132451Sroberto vp->fstamp = ep->fstamp; 3232132451Sroberto vp->vallen = htonl(len); 3233132451Sroberto vp->ptr = emalloc(len); 3234132451Sroberto ptr = vp->ptr; 3235285612Sdelphij i2d_X509(cert, (unsigned char **)(intptr_t)&ptr); 3236132451Sroberto vp->siglen = 0; 3237285612Sdelphij if (tstamp != 0) { 3238285612Sdelphij vp->sig = emalloc(sign_siglen); 3239310419Sdelphij ctx = EVP_MD_CTX_new(); 3240310419Sdelphij EVP_SignInit(ctx, sign_digest); 3241310419Sdelphij EVP_SignUpdate(ctx, (u_char *)vp, 12); 3242310419Sdelphij EVP_SignUpdate(ctx, vp->ptr, len); 3243310419Sdelphij if (EVP_SignFinal(ctx, vp->sig, &len, sign_pkey)) { 3244289999Sglebius INSIST(len <= sign_siglen); 3245285612Sdelphij vp->siglen = htonl(len); 3246285612Sdelphij } 3247310419Sdelphij EVP_MD_CTX_free(ctx); 3248285612Sdelphij } 324982498Sroberto#ifdef DEBUG 3250132451Sroberto if (debug > 1) 3251132451Sroberto X509_print_fp(stdout, cert); 325282498Sroberto#endif 3253132451Sroberto X509_free(cert); 3254132451Sroberto return (XEVNT_OK); 325582498Sroberto} 325682498Sroberto 325782498Sroberto 325882498Sroberto/* 3259285612Sdelphij * cert_install - install certificate in certificate cache 3260132451Sroberto * 3261132451Sroberto * This routine encodes an extension field into a certificate info/value 3262132451Sroberto * structure. It searches the certificate list for duplicates and 3263285612Sdelphij * expunges whichever is older. Finally, it inserts this certificate 3264285612Sdelphij * first on the list. 3265132451Sroberto * 3266285612Sdelphij * Returns certificate info pointer if valid, NULL if not. 3267132451Sroberto */ 3268285612Sdelphijstruct cert_info * 3269132451Srobertocert_install( 3270132451Sroberto struct exten *ep, /* cert info/value */ 3271132451Sroberto struct peer *peer /* peer structure */ 3272132451Sroberto ) 3273132451Sroberto{ 3274285612Sdelphij struct cert_info *cp, *xp, **zp; 3275132451Sroberto 327682498Sroberto /* 3277132451Sroberto * Parse and validate the signed certificate. If valid, 3278285612Sdelphij * construct the info/value structure; otherwise, scamper home 3279285612Sdelphij * empty handed. 328082498Sroberto */ 3281285612Sdelphij if ((cp = cert_parse((u_char *)ep->pkt, (long)ntohl(ep->vallen), 3282285612Sdelphij (tstamp_t)ntohl(ep->fstamp))) == NULL) 3283285612Sdelphij return (NULL); 3284132451Sroberto 3285132451Sroberto /* 3286132451Sroberto * Scan certificate list looking for another certificate with 3287132451Sroberto * the same subject and issuer. If another is found with the 3288132451Sroberto * same or older filestamp, unlink it and return the goodies to 3289182007Sroberto * the heap. If another is found with a later filestamp, discard 3290285612Sdelphij * the new one and leave the building with the old one. 3291182007Sroberto * 3292182007Sroberto * Make a note to study this issue again. An earlier certificate 3293182007Sroberto * with a long lifetime might be overtaken by a later 3294182007Sroberto * certificate with a short lifetime, thus invalidating the 3295182007Sroberto * earlier signature. However, we gotta find a way to leak old 3296182007Sroberto * stuff from the cache, so we do it anyway. 3297132451Sroberto */ 3298132451Sroberto zp = &cinfo; 3299132451Sroberto for (xp = cinfo; xp != NULL; xp = xp->link) { 3300132451Sroberto if (strcmp(cp->subject, xp->subject) == 0 && 3301132451Sroberto strcmp(cp->issuer, xp->issuer) == 0) { 3302132451Sroberto if (ntohl(cp->cert.fstamp) <= 3303132451Sroberto ntohl(xp->cert.fstamp)) { 3304285612Sdelphij cert_free(cp); 3305285612Sdelphij cp = xp; 3306285612Sdelphij } else { 3307285612Sdelphij *zp = xp->link; 3308132451Sroberto cert_free(xp); 3309285612Sdelphij xp = NULL; 3310132451Sroberto } 3311132451Sroberto break; 3312132451Sroberto } 3313132451Sroberto zp = &xp->link; 3314132451Sroberto } 3315285612Sdelphij if (xp == NULL) { 3316285612Sdelphij cp->link = cinfo; 3317285612Sdelphij cinfo = cp; 3318285612Sdelphij } 3319285612Sdelphij cp->flags |= CERT_VALID; 3320285612Sdelphij crypto_update(); 3321285612Sdelphij return (cp); 3322285612Sdelphij} 3323132451Sroberto 3324285612Sdelphij 3325285612Sdelphij/* 3326285612Sdelphij * cert_hike - verify the signature using the issuer public key 3327285612Sdelphij * 3328285612Sdelphij * Returns 3329285612Sdelphij * XEVNT_OK success 3330285612Sdelphij * XEVNT_CRT bad or missing certificate 3331285612Sdelphij * XEVNT_PER host certificate expired 3332285612Sdelphij * XEVNT_VFY certificate not verified 3333285612Sdelphij */ 3334285612Sdelphijint 3335285612Sdelphijcert_hike( 3336285612Sdelphij struct peer *peer, /* peer structure pointer */ 3337285612Sdelphij struct cert_info *yp /* issuer certificate */ 3338285612Sdelphij ) 3339285612Sdelphij{ 3340285612Sdelphij struct cert_info *xp; /* subject certificate */ 3341285612Sdelphij X509 *cert; /* X509 certificate */ 3342285612Sdelphij const u_char *ptr; 3343285612Sdelphij 3344132451Sroberto /* 3345285612Sdelphij * Save the issuer on the new certificate, but remember the old 3346285612Sdelphij * one. 3347132451Sroberto */ 3348285612Sdelphij if (peer->issuer != NULL) 3349285612Sdelphij free(peer->issuer); 3350285612Sdelphij peer->issuer = estrdup(yp->issuer); 3351285612Sdelphij xp = peer->xinfo; 3352285612Sdelphij peer->xinfo = yp; 3353132451Sroberto 3354285612Sdelphij /* 3355285612Sdelphij * If subject Y matches issuer Y, then the certificate trail is 3356285612Sdelphij * complete. If Y is not trusted, the server certificate has yet 3357285612Sdelphij * been signed, so keep trying. Otherwise, save the group key 3358285612Sdelphij * and light the valid bit. If the host certificate is trusted, 3359285612Sdelphij * do not execute a sign exchange. If no identity scheme is in 3360285612Sdelphij * use, light the identity and proventic bits. 3361285612Sdelphij */ 3362285612Sdelphij if (strcmp(yp->subject, yp->issuer) == 0) { 3363285612Sdelphij if (!(yp->flags & CERT_TRUST)) 3364285612Sdelphij return (XEVNT_OK); 3365132451Sroberto 3366285612Sdelphij /* 3367285612Sdelphij * If the server has an an identity scheme, fetch the 3368285612Sdelphij * identity credentials. If not, the identity is 3369285612Sdelphij * verified only by the trusted certificate. The next 3370285612Sdelphij * signature will set the server proventic. 3371285612Sdelphij */ 3372285612Sdelphij peer->crypto |= CRYPTO_FLAG_CERT; 3373285612Sdelphij peer->grpkey = yp->grpkey; 3374285612Sdelphij if (peer->ident == NULL || !(peer->crypto & 3375285612Sdelphij CRYPTO_FLAG_MASK)) 3376285612Sdelphij peer->crypto |= CRYPTO_FLAG_VRFY; 3377285612Sdelphij } 3378132451Sroberto 3379285612Sdelphij /* 3380285612Sdelphij * If X exists, verify signature X using public key Y. 3381285612Sdelphij */ 3382285612Sdelphij if (xp == NULL) 3383285612Sdelphij return (XEVNT_OK); 3384182007Sroberto 3385285612Sdelphij ptr = (u_char *)xp->cert.ptr; 3386285612Sdelphij cert = d2i_X509(NULL, &ptr, ntohl(xp->cert.vallen)); 3387285612Sdelphij if (cert == NULL) { 3388285612Sdelphij xp->flags |= CERT_ERROR; 3389285612Sdelphij return (XEVNT_CRT); 3390285612Sdelphij } 3391285612Sdelphij if (X509_verify(cert, yp->pkey) <= 0) { 3392285612Sdelphij X509_free(cert); 3393285612Sdelphij xp->flags |= CERT_ERROR; 3394285612Sdelphij return (XEVNT_VFY); 3395285612Sdelphij } 3396285612Sdelphij X509_free(cert); 3397182007Sroberto 3398285612Sdelphij /* 3399285612Sdelphij * Signature X is valid only if it begins during the 3400285612Sdelphij * lifetime of Y. 3401285612Sdelphij */ 3402285612Sdelphij if ((calcomp(&(xp->first), &(yp->first)) < 0) 3403285612Sdelphij || (calcomp(&(xp->first), &(yp->last)) > 0)) { 3404285612Sdelphij xp->flags |= CERT_ERROR; 3405285612Sdelphij return (XEVNT_PER); 3406285612Sdelphij } 3407285612Sdelphij xp->flags |= CERT_SIGN; 3408285612Sdelphij return (XEVNT_OK); 3409285612Sdelphij} 3410132451Sroberto 3411132451Sroberto 3412285612Sdelphij/* 3413285612Sdelphij * cert_parse - parse x509 certificate and create info/value structures. 3414285612Sdelphij * 3415285612Sdelphij * The server certificate includes the version number, issuer name, 3416285612Sdelphij * subject name, public key and valid date interval. If the issuer name 3417285612Sdelphij * is the same as the subject name, the certificate is self signed and 3418285612Sdelphij * valid only if the server is configured as trustable. If the names are 3419285612Sdelphij * different, another issuer has signed the server certificate and 3420285612Sdelphij * vouched for it. In this case the server certificate is valid if 3421285612Sdelphij * verified by the issuer public key. 3422285612Sdelphij * 3423285612Sdelphij * Returns certificate info/value pointer if valid, NULL if not. 3424285612Sdelphij */ 3425285612Sdelphijstruct cert_info * /* certificate information structure */ 3426285612Sdelphijcert_parse( 3427285612Sdelphij const u_char *asn1cert, /* X509 certificate */ 3428285612Sdelphij long len, /* certificate length */ 3429285612Sdelphij tstamp_t fstamp /* filestamp */ 3430285612Sdelphij ) 3431285612Sdelphij{ 3432285612Sdelphij X509 *cert; /* X509 certificate */ 3433285612Sdelphij struct cert_info *ret; /* certificate info/value */ 3434285612Sdelphij BIO *bp; 3435285612Sdelphij char pathbuf[MAXFILENAME]; 3436285612Sdelphij const u_char *ptr; 3437285612Sdelphij char *pch; 3438310419Sdelphij int cnt, i; 3439285612Sdelphij struct calendar fscal; 3440132451Sroberto 3441285612Sdelphij /* 3442285612Sdelphij * Decode ASN.1 objects and construct certificate structure. 3443285612Sdelphij */ 3444285612Sdelphij ptr = asn1cert; 3445285612Sdelphij if ((cert = d2i_X509(NULL, &ptr, len)) == NULL) { 3446285612Sdelphij msyslog(LOG_ERR, "cert_parse: %s", 3447285612Sdelphij ERR_error_string(ERR_get_error(), NULL)); 3448285612Sdelphij return (NULL); 3449285612Sdelphij } 3450285612Sdelphij#ifdef DEBUG 3451285612Sdelphij if (debug > 1) 3452285612Sdelphij X509_print_fp(stdout, cert); 3453285612Sdelphij#endif 3454132451Sroberto 3455285612Sdelphij /* 3456285612Sdelphij * Extract version, subject name and public key. 3457285612Sdelphij */ 3458285612Sdelphij ret = emalloc_zero(sizeof(*ret)); 3459285612Sdelphij if ((ret->pkey = X509_get_pubkey(cert)) == NULL) { 3460285612Sdelphij msyslog(LOG_ERR, "cert_parse: %s", 3461285612Sdelphij ERR_error_string(ERR_get_error(), NULL)); 3462285612Sdelphij cert_free(ret); 3463285612Sdelphij X509_free(cert); 3464285612Sdelphij return (NULL); 3465285612Sdelphij } 3466285612Sdelphij ret->version = X509_get_version(cert); 3467285612Sdelphij X509_NAME_oneline(X509_get_subject_name(cert), pathbuf, 3468285612Sdelphij sizeof(pathbuf)); 3469285612Sdelphij pch = strstr(pathbuf, "CN="); 3470285612Sdelphij if (NULL == pch) { 3471285612Sdelphij msyslog(LOG_NOTICE, "cert_parse: invalid subject %s", 3472285612Sdelphij pathbuf); 3473285612Sdelphij cert_free(ret); 3474285612Sdelphij X509_free(cert); 3475285612Sdelphij return (NULL); 3476285612Sdelphij } 3477285612Sdelphij ret->subject = estrdup(pch + 3); 3478132451Sroberto 3479285612Sdelphij /* 3480285612Sdelphij * Extract remaining objects. Note that the NTP serial number is 3481285612Sdelphij * the NTP seconds at the time of signing, but this might not be 3482285612Sdelphij * the case for other authority. We don't bother to check the 3483285612Sdelphij * objects at this time, since the real crunch can happen only 3484285612Sdelphij * when the time is valid but not yet certificated. 3485285612Sdelphij */ 3486310419Sdelphij ret->nid = X509_get_signature_nid(cert); 3487285612Sdelphij ret->digest = (const EVP_MD *)EVP_get_digestbynid(ret->nid); 3488285612Sdelphij ret->serial = 3489285612Sdelphij (u_long)ASN1_INTEGER_get(X509_get_serialNumber(cert)); 3490285612Sdelphij X509_NAME_oneline(X509_get_issuer_name(cert), pathbuf, 3491285612Sdelphij sizeof(pathbuf)); 3492285612Sdelphij if ((pch = strstr(pathbuf, "CN=")) == NULL) { 3493285612Sdelphij msyslog(LOG_NOTICE, "cert_parse: invalid issuer %s", 3494285612Sdelphij pathbuf); 3495285612Sdelphij cert_free(ret); 3496285612Sdelphij X509_free(cert); 3497285612Sdelphij return (NULL); 3498285612Sdelphij } 3499285612Sdelphij ret->issuer = estrdup(pch + 3); 3500285612Sdelphij asn_to_calendar(X509_get_notBefore(cert), &(ret->first)); 3501285612Sdelphij asn_to_calendar(X509_get_notAfter(cert), &(ret->last)); 3502285612Sdelphij 3503285612Sdelphij /* 3504285612Sdelphij * Extract extension fields. These are ad hoc ripoffs of 3505285612Sdelphij * currently assigned functions and will certainly be changed 3506285612Sdelphij * before prime time. 3507285612Sdelphij */ 3508285612Sdelphij cnt = X509_get_ext_count(cert); 3509285612Sdelphij for (i = 0; i < cnt; i++) { 3510310419Sdelphij X509_EXTENSION *ext; 3511310419Sdelphij ASN1_OBJECT *obj; 3512310419Sdelphij int nid; 3513310419Sdelphij ASN1_OCTET_STRING *data; 3514310419Sdelphij 3515285612Sdelphij ext = X509_get_ext(cert, i); 3516310419Sdelphij obj = X509_EXTENSION_get_object(ext); 3517310419Sdelphij nid = OBJ_obj2nid(obj); 3518285612Sdelphij 3519310419Sdelphij switch (nid) { 3520310419Sdelphij 3521285612Sdelphij /* 3522285612Sdelphij * If a key_usage field is present, we decode whether 3523285612Sdelphij * this is a trusted or private certificate. This is 3524285612Sdelphij * dorky; all we want is to compare NIDs, but OpenSSL 3525285612Sdelphij * insists on BIO text strings. 3526285612Sdelphij */ 3527285612Sdelphij case NID_ext_key_usage: 3528285612Sdelphij bp = BIO_new(BIO_s_mem()); 3529285612Sdelphij X509V3_EXT_print(bp, ext, 0, 0); 3530285612Sdelphij BIO_gets(bp, pathbuf, sizeof(pathbuf)); 3531285612Sdelphij BIO_free(bp); 3532285612Sdelphij if (strcmp(pathbuf, "Trust Root") == 0) 3533285612Sdelphij ret->flags |= CERT_TRUST; 3534285612Sdelphij else if (strcmp(pathbuf, "Private") == 0) 3535285612Sdelphij ret->flags |= CERT_PRIV; 3536285612Sdelphij DPRINTF(1, ("cert_parse: %s: %s\n", 3537310419Sdelphij OBJ_nid2ln(nid), pathbuf)); 3538285612Sdelphij break; 3539285612Sdelphij 3540285612Sdelphij /* 3541285612Sdelphij * If a NID_subject_key_identifier field is present, it 3542285612Sdelphij * contains the GQ public key. 3543285612Sdelphij */ 3544285612Sdelphij case NID_subject_key_identifier: 3545310419Sdelphij data = X509_EXTENSION_get_data(ext); 3546310419Sdelphij ret->grpkey = BN_bin2bn(&data->data[2], 3547310419Sdelphij data->length - 2, NULL); 3548285612Sdelphij /* fall through */ 3549285612Sdelphij default: 3550285612Sdelphij DPRINTF(1, ("cert_parse: %s\n", 3551310419Sdelphij OBJ_nid2ln(nid))); 3552285612Sdelphij break; 3553132451Sroberto } 3554132451Sroberto } 3555285612Sdelphij if (strcmp(ret->subject, ret->issuer) == 0) { 3556132451Sroberto 3557285612Sdelphij /* 3558285612Sdelphij * If certificate is self signed, verify signature. 3559285612Sdelphij */ 3560285612Sdelphij if (X509_verify(cert, ret->pkey) <= 0) { 3561285612Sdelphij msyslog(LOG_NOTICE, 3562285612Sdelphij "cert_parse: signature not verified %s", 3563285612Sdelphij ret->subject); 3564285612Sdelphij cert_free(ret); 3565285612Sdelphij X509_free(cert); 3566285612Sdelphij return (NULL); 3567285612Sdelphij } 3568285612Sdelphij } else { 3569285612Sdelphij 3570285612Sdelphij /* 3571285612Sdelphij * Check for a certificate loop. 3572285612Sdelphij */ 3573285612Sdelphij if (strcmp((const char *)hostval.ptr, ret->issuer) == 0) { 3574285612Sdelphij msyslog(LOG_NOTICE, 3575285612Sdelphij "cert_parse: certificate trail loop %s", 3576285612Sdelphij ret->subject); 3577285612Sdelphij cert_free(ret); 3578285612Sdelphij X509_free(cert); 3579285612Sdelphij return (NULL); 3580285612Sdelphij } 3581285612Sdelphij } 3582285612Sdelphij 3583132451Sroberto /* 3584285612Sdelphij * Verify certificate valid times. Note that certificates cannot 3585285612Sdelphij * be retroactive. 3586132451Sroberto */ 3587285612Sdelphij (void)ntpcal_ntp_to_date(&fscal, fstamp, NULL); 3588285612Sdelphij if ((calcomp(&(ret->first), &(ret->last)) > 0) 3589285612Sdelphij || (calcomp(&(ret->first), &fscal) < 0)) { 3590285612Sdelphij msyslog(LOG_NOTICE, 3591285612Sdelphij "cert_parse: invalid times %s first %u-%02u-%02uT%02u:%02u:%02u last %u-%02u-%02uT%02u:%02u:%02u fstamp %u-%02u-%02uT%02u:%02u:%02u", 3592285612Sdelphij ret->subject, 3593285612Sdelphij ret->first.year, ret->first.month, ret->first.monthday, 3594285612Sdelphij ret->first.hour, ret->first.minute, ret->first.second, 3595285612Sdelphij ret->last.year, ret->last.month, ret->last.monthday, 3596285612Sdelphij ret->last.hour, ret->last.minute, ret->last.second, 3597285612Sdelphij fscal.year, fscal.month, fscal.monthday, 3598285612Sdelphij fscal.hour, fscal.minute, fscal.second); 3599285612Sdelphij cert_free(ret); 3600285612Sdelphij X509_free(cert); 3601285612Sdelphij return (NULL); 3602285612Sdelphij } 3603285612Sdelphij 3604285612Sdelphij /* 3605285612Sdelphij * Build the value structure to sign and send later. 3606285612Sdelphij */ 3607285612Sdelphij ret->cert.fstamp = htonl(fstamp); 3608285612Sdelphij ret->cert.vallen = htonl(len); 3609285612Sdelphij ret->cert.ptr = emalloc(len); 3610285612Sdelphij memcpy(ret->cert.ptr, asn1cert, len); 3611285612Sdelphij X509_free(cert); 3612285612Sdelphij return (ret); 3613132451Sroberto} 3614132451Sroberto 3615132451Sroberto 3616132451Sroberto/* 3617132451Sroberto * cert_free - free certificate information structure 3618132451Sroberto */ 3619132451Srobertovoid 3620132451Srobertocert_free( 3621132451Sroberto struct cert_info *cinf /* certificate info/value structure */ 3622132451Sroberto ) 3623132451Sroberto{ 3624132451Sroberto if (cinf->pkey != NULL) 3625132451Sroberto EVP_PKEY_free(cinf->pkey); 3626132451Sroberto if (cinf->subject != NULL) 3627132451Sroberto free(cinf->subject); 3628132451Sroberto if (cinf->issuer != NULL) 3629132451Sroberto free(cinf->issuer); 3630132451Sroberto if (cinf->grpkey != NULL) 3631285612Sdelphij BN_free(cinf->grpkey); 3632132451Sroberto value_free(&cinf->cert); 3633132451Sroberto free(cinf); 3634132451Sroberto} 3635132451Sroberto 3636132451Sroberto 3637132451Sroberto/* 3638285612Sdelphij * crypto_key - load cryptographic parameters and keys 3639132451Sroberto * 3640285612Sdelphij * This routine searches the key cache for matching name in the form 3641285612Sdelphij * ntpkey_<key>_<name>, where <key> is one of host, sign, iff, gq, mv, 3642285612Sdelphij * and <name> is the host/group name. If not found, it tries to load a 3643285612Sdelphij * PEM-encoded file of the same name and extracts the filestamp from 3644285612Sdelphij * the first line of the file name. It returns the key pointer if valid, 3645285612Sdelphij * NULL if not. 3646132451Sroberto */ 3647285612Sdelphijstatic struct pkey_info * 3648132451Srobertocrypto_key( 3649132451Sroberto char *cp, /* file name */ 3650285612Sdelphij char *passwd1, /* password */ 3651285612Sdelphij sockaddr_u *addr /* IP address */ 3652132451Sroberto ) 3653132451Sroberto{ 3654132451Sroberto FILE *str; /* file handle */ 3655285612Sdelphij struct pkey_info *pkp; /* generic key */ 3656132451Sroberto EVP_PKEY *pkey = NULL; /* public/private key */ 3657285612Sdelphij tstamp_t fstamp; 3658132451Sroberto char filename[MAXFILENAME]; /* name of key file */ 3659132451Sroberto char linkname[MAXFILENAME]; /* filestamp buffer) */ 3660132451Sroberto char statstr[NTP_MAXSTRLEN]; /* statistics for filegen */ 3661132451Sroberto char *ptr; 3662132451Sroberto 3663132451Sroberto /* 3664285612Sdelphij * Search the key cache for matching key and name. 3665285612Sdelphij */ 3666285612Sdelphij for (pkp = pkinfo; pkp != NULL; pkp = pkp->link) { 3667285612Sdelphij if (strcmp(cp, pkp->name) == 0) 3668285612Sdelphij return (pkp); 3669285612Sdelphij } 3670285612Sdelphij 3671285612Sdelphij /* 3672132451Sroberto * Open the key file. If the first character of the file name is 3673132451Sroberto * not '/', prepend the keys directory string. If something goes 3674132451Sroberto * wrong, abandon ship. 3675132451Sroberto */ 367682498Sroberto if (*cp == '/') 3677285612Sdelphij strlcpy(filename, cp, sizeof(filename)); 367882498Sroberto else 3679285612Sdelphij snprintf(filename, sizeof(filename), "%s/%s", keysdir, 3680285612Sdelphij cp); 368182498Sroberto str = fopen(filename, "r"); 3682132451Sroberto if (str == NULL) 3683132451Sroberto return (NULL); 3684132451Sroberto 3685132451Sroberto /* 3686132451Sroberto * Read the filestamp, which is contained in the first line. 3687132451Sroberto */ 3688285612Sdelphij if ((ptr = fgets(linkname, sizeof(linkname), str)) == NULL) { 3689285612Sdelphij msyslog(LOG_ERR, "crypto_key: empty file %s", 3690132451Sroberto filename); 3691285612Sdelphij fclose(str); 3692132451Sroberto return (NULL); 369382498Sroberto } 3694132451Sroberto if ((ptr = strrchr(ptr, '.')) == NULL) { 3695285612Sdelphij msyslog(LOG_ERR, "crypto_key: no filestamp %s", 3696132451Sroberto filename); 3697285612Sdelphij fclose(str); 3698132451Sroberto return (NULL); 3699132451Sroberto } 3700285612Sdelphij if (sscanf(++ptr, "%u", &fstamp) != 1) { 3701285612Sdelphij msyslog(LOG_ERR, "crypto_key: invalid filestamp %s", 3702132451Sroberto filename); 3703285612Sdelphij fclose(str); 3704132451Sroberto return (NULL); 3705132451Sroberto } 370682498Sroberto 370782498Sroberto /* 3708285612Sdelphij * Read and decrypt PEM-encoded private key. If it fails to 3709285612Sdelphij * decrypt, game over. 371082498Sroberto */ 3711285612Sdelphij pkey = PEM_read_PrivateKey(str, NULL, NULL, passwd1); 3712132451Sroberto fclose(str); 3713132451Sroberto if (pkey == NULL) { 3714285612Sdelphij msyslog(LOG_ERR, "crypto_key: %s", 3715132451Sroberto ERR_error_string(ERR_get_error(), NULL)); 3716285612Sdelphij exit (-1); 371782498Sroberto } 371882498Sroberto 371982498Sroberto /* 3720285612Sdelphij * Make a new entry in the key cache. 3721285612Sdelphij */ 3722285612Sdelphij pkp = emalloc(sizeof(struct pkey_info)); 3723285612Sdelphij pkp->link = pkinfo; 3724285612Sdelphij pkinfo = pkp; 3725285612Sdelphij pkp->pkey = pkey; 3726285612Sdelphij pkp->name = estrdup(cp); 3727285612Sdelphij pkp->fstamp = fstamp; 3728285612Sdelphij 3729285612Sdelphij /* 3730132451Sroberto * Leave tracks in the cryptostats. 373182498Sroberto */ 3732132451Sroberto if ((ptr = strrchr(linkname, '\n')) != NULL) 3733132451Sroberto *ptr = '\0'; 3734285612Sdelphij snprintf(statstr, sizeof(statstr), "%s mod %d", &linkname[2], 3735132451Sroberto EVP_PKEY_size(pkey) * 8); 3736285612Sdelphij record_crypto_stats(addr, statstr); 3737285612Sdelphij 3738285612Sdelphij DPRINTF(1, ("crypto_key: %s\n", statstr)); 3739132451Sroberto#ifdef DEBUG 3740132451Sroberto if (debug > 1) { 3741310419Sdelphij if (EVP_PKEY_base_id(pkey) == EVP_PKEY_DSA) 3742310419Sdelphij DSA_print_fp(stdout, EVP_PKEY_get0_DSA(pkey), 0); 3743310419Sdelphij else if (EVP_PKEY_base_id(pkey) == EVP_PKEY_RSA) 3744310419Sdelphij RSA_print_fp(stdout, EVP_PKEY_get0_RSA(pkey), 0); 374582498Sroberto } 3746132451Sroberto#endif 3747285612Sdelphij return (pkp); 3748132451Sroberto} 374982498Sroberto 3750132451Sroberto 3751132451Sroberto/* 3752285612Sdelphij *********************************************************************** 3753285612Sdelphij * * 3754285612Sdelphij * The following routines are used only at initialization time * 3755285612Sdelphij * * 3756285612Sdelphij *********************************************************************** 3757285612Sdelphij */ 3758285612Sdelphij/* 3759132451Sroberto * crypto_cert - load certificate from file 3760132451Sroberto * 3761285612Sdelphij * This routine loads an X.509 RSA or DSA certificate from a file and 3762132451Sroberto * constructs a info/cert value structure for this machine. The 3763132451Sroberto * structure includes a filestamp extracted from the file name. Later 3764285612Sdelphij * the certificate can be sent to another machine on request. 3765132451Sroberto * 3766132451Sroberto * Returns certificate info/value pointer if valid, NULL if not. 3767132451Sroberto */ 3768132451Srobertostatic struct cert_info * /* certificate information */ 3769132451Srobertocrypto_cert( 3770132451Sroberto char *cp /* file name */ 3771132451Sroberto ) 3772132451Sroberto{ 3773132451Sroberto struct cert_info *ret; /* certificate information */ 3774132451Sroberto FILE *str; /* file handle */ 3775132451Sroberto char filename[MAXFILENAME]; /* name of certificate file */ 3776132451Sroberto char linkname[MAXFILENAME]; /* filestamp buffer */ 3777132451Sroberto char statstr[NTP_MAXSTRLEN]; /* statistics for filegen */ 3778132451Sroberto tstamp_t fstamp; /* filestamp */ 3779132451Sroberto long len; 3780132451Sroberto char *ptr; 3781132451Sroberto char *name, *header; 3782132451Sroberto u_char *data; 3783132451Sroberto 378482498Sroberto /* 3785132451Sroberto * Open the certificate file. If the first character of the file 3786132451Sroberto * name is not '/', prepend the keys directory string. If 3787132451Sroberto * something goes wrong, abandon ship. 378882498Sroberto */ 3789132451Sroberto if (*cp == '/') 3790285612Sdelphij strlcpy(filename, cp, sizeof(filename)); 3791132451Sroberto else 3792285612Sdelphij snprintf(filename, sizeof(filename), "%s/%s", keysdir, 3793285612Sdelphij cp); 3794132451Sroberto str = fopen(filename, "r"); 3795132451Sroberto if (str == NULL) 3796132451Sroberto return (NULL); 379782498Sroberto 3798132451Sroberto /* 3799132451Sroberto * Read the filestamp, which is contained in the first line. 3800132451Sroberto */ 3801285612Sdelphij if ((ptr = fgets(linkname, sizeof(linkname), str)) == NULL) { 3802285612Sdelphij msyslog(LOG_ERR, "crypto_cert: empty file %s", 3803132451Sroberto filename); 3804285612Sdelphij fclose(str); 3805132451Sroberto return (NULL); 3806132451Sroberto } 3807132451Sroberto if ((ptr = strrchr(ptr, '.')) == NULL) { 3808285612Sdelphij msyslog(LOG_ERR, "crypto_cert: no filestamp %s", 3809132451Sroberto filename); 3810285612Sdelphij fclose(str); 3811132451Sroberto return (NULL); 3812132451Sroberto } 3813132451Sroberto if (sscanf(++ptr, "%u", &fstamp) != 1) { 3814285612Sdelphij msyslog(LOG_ERR, "crypto_cert: invalid filestamp %s", 3815132451Sroberto filename); 3816285612Sdelphij fclose(str); 3817132451Sroberto return (NULL); 3818132451Sroberto } 381982498Sroberto 382082498Sroberto /* 3821132451Sroberto * Read PEM-encoded certificate and install. 382282498Sroberto */ 3823132451Sroberto if (!PEM_read(str, &name, &header, &data, &len)) { 3824285612Sdelphij msyslog(LOG_ERR, "crypto_cert: %s", 3825132451Sroberto ERR_error_string(ERR_get_error(), NULL)); 3826285612Sdelphij fclose(str); 3827132451Sroberto return (NULL); 3828132451Sroberto } 3829285612Sdelphij fclose(str); 3830132451Sroberto free(header); 3831285612Sdelphij if (strcmp(name, "CERTIFICATE") != 0) { 3832285612Sdelphij msyslog(LOG_NOTICE, "crypto_cert: wrong PEM type %s", 3833132451Sroberto name); 3834132451Sroberto free(name); 3835132451Sroberto free(data); 3836132451Sroberto return (NULL); 3837132451Sroberto } 3838132451Sroberto free(name); 383982498Sroberto 384082498Sroberto /* 3841285612Sdelphij * Parse certificate and generate info/value structure. The 3842285612Sdelphij * pointer and copy nonsense is due something broken in Solaris. 384382498Sroberto */ 3844132451Sroberto ret = cert_parse(data, len, fstamp); 3845132451Sroberto free(data); 3846132451Sroberto if (ret == NULL) 3847132451Sroberto return (NULL); 3848182007Sroberto 3849132451Sroberto if ((ptr = strrchr(linkname, '\n')) != NULL) 3850132451Sroberto *ptr = '\0'; 3851285612Sdelphij snprintf(statstr, sizeof(statstr), "%s 0x%x len %lu", 3852285612Sdelphij &linkname[2], ret->flags, len); 3853132451Sroberto record_crypto_stats(NULL, statstr); 3854285612Sdelphij DPRINTF(1, ("crypto_cert: %s\n", statstr)); 3855132451Sroberto return (ret); 385682498Sroberto} 385782498Sroberto 385882498Sroberto 385982498Sroberto/* 3860285612Sdelphij * crypto_setup - load keys, certificate and identity parameters 3861132451Sroberto * 3862285612Sdelphij * This routine loads the public/private host key and certificate. If 3863285612Sdelphij * available, it loads the public/private sign key, which defaults to 3864285612Sdelphij * the host key. The host key must be RSA, but the sign key can be 3865285612Sdelphij * either RSA or DSA. If a trusted certificate, it loads the identity 3866285612Sdelphij * parameters. In either case, the public key on the certificate must 3867285612Sdelphij * agree with the sign key. 3868285612Sdelphij * 3869285612Sdelphij * Required but missing files and inconsistent data and errors are 3870285612Sdelphij * fatal. Allowing configuration to continue would be hazardous and 3871285612Sdelphij * require really messy error checks. 387282498Sroberto */ 3873285612Sdelphijvoid 3874285612Sdelphijcrypto_setup(void) 387582498Sroberto{ 3876285612Sdelphij struct pkey_info *pinfo; /* private/public key */ 3877285612Sdelphij char filename[MAXFILENAME]; /* file name buffer */ 3878285612Sdelphij char hostname[MAXFILENAME]; /* host name buffer */ 3879285612Sdelphij char *randfile; 3880132451Sroberto char statstr[NTP_MAXSTRLEN]; /* statistics for filegen */ 3881285612Sdelphij l_fp seed; /* crypto PRNG seed as NTP timestamp */ 3882132451Sroberto u_int len; 3883285612Sdelphij int bytes; 3884285612Sdelphij u_char *ptr; 388582498Sroberto 388682498Sroberto /* 3887285612Sdelphij * Check for correct OpenSSL version and avoid initialization in 3888285612Sdelphij * the case of multiple crypto commands. 388982498Sroberto */ 3890285612Sdelphij if (crypto_flags & CRYPTO_FLAG_ENAB) { 3891285612Sdelphij msyslog(LOG_NOTICE, 3892285612Sdelphij "crypto_setup: spurious crypto command"); 389382498Sroberto return; 389482498Sroberto } 3895285612Sdelphij ssl_check_version(); 389682498Sroberto 389782498Sroberto /* 3898285612Sdelphij * Load required random seed file and seed the random number 3899285612Sdelphij * generator. Be default, it is found as .rnd in the user home 3900285612Sdelphij * directory. The root home directory may be / or /root, 3901285612Sdelphij * depending on the system. Wiggle the contents a bit and write 3902285612Sdelphij * it back so the sequence does not repeat when we next restart. 390382498Sroberto */ 3904285612Sdelphij if (!RAND_status()) { 3905285612Sdelphij if (rand_file == NULL) { 3906285612Sdelphij RAND_file_name(filename, sizeof(filename)); 3907285612Sdelphij randfile = filename; 3908285612Sdelphij } else if (*rand_file != '/') { 3909285612Sdelphij snprintf(filename, sizeof(filename), "%s/%s", 3910285612Sdelphij keysdir, rand_file); 3911285612Sdelphij randfile = filename; 3912285612Sdelphij } else 3913285612Sdelphij randfile = rand_file; 3914182007Sroberto 3915285612Sdelphij if ((bytes = RAND_load_file(randfile, -1)) == 0) { 3916285612Sdelphij msyslog(LOG_ERR, 3917285612Sdelphij "crypto_setup: random seed file %s missing", 3918285612Sdelphij randfile); 3919285612Sdelphij exit (-1); 3920285612Sdelphij } 3921285612Sdelphij arc4random_buf(&seed, sizeof(l_fp)); 3922285612Sdelphij RAND_seed(&seed, sizeof(l_fp)); 3923285612Sdelphij RAND_write_file(randfile); 3924285612Sdelphij DPRINTF(1, ("crypto_setup: OpenSSL version %lx random seed file %s bytes read %d\n", 3925285612Sdelphij SSLeay(), randfile, bytes)); 392682498Sroberto } 392782498Sroberto 392882498Sroberto /* 3929132451Sroberto * Initialize structures. 393082498Sroberto */ 3931285612Sdelphij gethostname(hostname, sizeof(hostname)); 3932285612Sdelphij if (host_filename != NULL) 3933285612Sdelphij strlcpy(hostname, host_filename, sizeof(hostname)); 3934132451Sroberto if (passwd == NULL) 3935285612Sdelphij passwd = estrdup(hostname); 3936132451Sroberto memset(&hostval, 0, sizeof(hostval)); 3937132451Sroberto memset(&pubkey, 0, sizeof(pubkey)); 3938132451Sroberto memset(&tai_leap, 0, sizeof(tai_leap)); 3939132451Sroberto 3940132451Sroberto /* 3941285612Sdelphij * Load required host key from file "ntpkey_host_<hostname>". If 3942285612Sdelphij * no host key file is not found or has invalid password, life 3943285612Sdelphij * as we know it ends. The host key also becomes the default 3944285612Sdelphij * sign key. 3945132451Sroberto */ 3946285612Sdelphij snprintf(filename, sizeof(filename), "ntpkey_host_%s", hostname); 3947285612Sdelphij pinfo = crypto_key(filename, passwd, NULL); 3948285612Sdelphij if (pinfo == NULL) { 3949132451Sroberto msyslog(LOG_ERR, 3950132451Sroberto "crypto_setup: host key file %s not found or corrupt", 3951285612Sdelphij filename); 3952132451Sroberto exit (-1); 3953132451Sroberto } 3954310419Sdelphij if (EVP_PKEY_base_id(pinfo->pkey) != EVP_PKEY_RSA) { 3955132451Sroberto msyslog(LOG_ERR, 3956132451Sroberto "crypto_setup: host key is not RSA key type"); 3957132451Sroberto exit (-1); 3958132451Sroberto } 3959285612Sdelphij host_pkey = pinfo->pkey; 3960285612Sdelphij sign_pkey = host_pkey; 3961285612Sdelphij hostval.fstamp = htonl(pinfo->fstamp); 3962132451Sroberto 3963132451Sroberto /* 3964132451Sroberto * Construct public key extension field for agreement scheme. 3965132451Sroberto */ 3966132451Sroberto len = i2d_PublicKey(host_pkey, NULL); 3967132451Sroberto ptr = emalloc(len); 3968132451Sroberto pubkey.ptr = ptr; 3969132451Sroberto i2d_PublicKey(host_pkey, &ptr); 3970285612Sdelphij pubkey.fstamp = hostval.fstamp; 3971132451Sroberto pubkey.vallen = htonl(len); 3972132451Sroberto 3973132451Sroberto /* 3974132451Sroberto * Load optional sign key from file "ntpkey_sign_<hostname>". If 3975285612Sdelphij * available, it becomes the sign key. 3976132451Sroberto */ 3977285612Sdelphij snprintf(filename, sizeof(filename), "ntpkey_sign_%s", hostname); 3978285612Sdelphij pinfo = crypto_key(filename, passwd, NULL); 3979285612Sdelphij if (pinfo != NULL) 3980285612Sdelphij sign_pkey = pinfo->pkey; 3981132451Sroberto 3982132451Sroberto /* 3983285612Sdelphij * Load required certificate from file "ntpkey_cert_<hostname>". 3984132451Sroberto */ 3985285612Sdelphij snprintf(filename, sizeof(filename), "ntpkey_cert_%s", hostname); 3986285612Sdelphij cinfo = crypto_cert(filename); 3987285612Sdelphij if (cinfo == NULL) { 3988285612Sdelphij msyslog(LOG_ERR, 3989285612Sdelphij "crypto_setup: certificate file %s not found or corrupt", 3990285612Sdelphij filename); 3991285612Sdelphij exit (-1); 3992132451Sroberto } 3993285612Sdelphij cert_host = cinfo; 3994285612Sdelphij sign_digest = cinfo->digest; 3995285612Sdelphij sign_siglen = EVP_PKEY_size(sign_pkey); 3996285612Sdelphij if (cinfo->flags & CERT_PRIV) 3997285612Sdelphij crypto_flags |= CRYPTO_FLAG_PRIV; 3998132451Sroberto 3999132451Sroberto /* 4000285612Sdelphij * The certificate must be self-signed. 4001132451Sroberto */ 4002285612Sdelphij if (strcmp(cinfo->subject, cinfo->issuer) != 0) { 4003285612Sdelphij msyslog(LOG_ERR, 4004285612Sdelphij "crypto_setup: certificate %s is not self-signed", 4005285612Sdelphij filename); 4006285612Sdelphij exit (-1); 4007132451Sroberto } 4008285612Sdelphij hostval.ptr = estrdup(cinfo->subject); 4009285612Sdelphij hostval.vallen = htonl(strlen(cinfo->subject)); 4010285612Sdelphij sys_hostname = hostval.ptr; 4011285612Sdelphij ptr = (u_char *)strchr(sys_hostname, '@'); 4012285612Sdelphij if (ptr != NULL) 4013285612Sdelphij sys_groupname = estrdup((char *)++ptr); 4014285612Sdelphij if (ident_filename != NULL) 4015285612Sdelphij strlcpy(hostname, ident_filename, sizeof(hostname)); 4016132451Sroberto 4017132451Sroberto /* 4018285612Sdelphij * Load optional IFF parameters from file 4019285612Sdelphij * "ntpkey_iffkey_<hostname>". 4020132451Sroberto */ 4021285612Sdelphij snprintf(filename, sizeof(filename), "ntpkey_iffkey_%s", 4022285612Sdelphij hostname); 4023285612Sdelphij iffkey_info = crypto_key(filename, passwd, NULL); 4024285612Sdelphij if (iffkey_info != NULL) 4025285612Sdelphij crypto_flags |= CRYPTO_FLAG_IFF; 4026132451Sroberto 4027132451Sroberto /* 4028285612Sdelphij * Load optional GQ parameters from file 4029285612Sdelphij * "ntpkey_gqkey_<hostname>". 4030132451Sroberto */ 4031285612Sdelphij snprintf(filename, sizeof(filename), "ntpkey_gqkey_%s", 4032285612Sdelphij hostname); 4033285612Sdelphij gqkey_info = crypto_key(filename, passwd, NULL); 4034285612Sdelphij if (gqkey_info != NULL) 4035285612Sdelphij crypto_flags |= CRYPTO_FLAG_GQ; 4036132451Sroberto 4037132451Sroberto /* 4038285612Sdelphij * Load optional MV parameters from file 4039285612Sdelphij * "ntpkey_mvkey_<hostname>". 4040132451Sroberto */ 4041285612Sdelphij snprintf(filename, sizeof(filename), "ntpkey_mvkey_%s", 4042285612Sdelphij hostname); 4043285612Sdelphij mvkey_info = crypto_key(filename, passwd, NULL); 4044285612Sdelphij if (mvkey_info != NULL) 4045285612Sdelphij crypto_flags |= CRYPTO_FLAG_MV; 4046132451Sroberto 4047132451Sroberto /* 4048285612Sdelphij * We met the enemy and he is us. Now strike up the dance. 4049132451Sroberto */ 4050285612Sdelphij crypto_flags |= CRYPTO_FLAG_ENAB | (cinfo->nid << 16); 4051285612Sdelphij snprintf(statstr, sizeof(statstr), "setup 0x%x host %s %s", 4052285612Sdelphij crypto_flags, hostname, OBJ_nid2ln(cinfo->nid)); 4053285612Sdelphij record_crypto_stats(NULL, statstr); 4054285612Sdelphij DPRINTF(1, ("crypto_setup: %s\n", statstr)); 405582498Sroberto} 405682498Sroberto 405782498Sroberto 405882498Sroberto/* 4059285612Sdelphij * crypto_config - configure data from the crypto command. 406082498Sroberto */ 406182498Srobertovoid 406282498Srobertocrypto_config( 4063132451Sroberto int item, /* configuration item */ 4064285612Sdelphij char *cp /* item name */ 406582498Sroberto ) 406682498Sroberto{ 4067285612Sdelphij int nid; 406882498Sroberto 4069285612Sdelphij DPRINTF(1, ("crypto_config: item %d %s\n", item, cp)); 407082498Sroberto 4071285612Sdelphij switch (item) { 4072132451Sroberto 4073132451Sroberto /* 4074285612Sdelphij * Set host name (host). 4075132451Sroberto */ 407682498Sroberto case CRYPTO_CONF_PRIV: 4077285612Sdelphij if (NULL != host_filename) 4078285612Sdelphij free(host_filename); 4079285612Sdelphij host_filename = estrdup(cp); 408082498Sroberto break; 408182498Sroberto 408282498Sroberto /* 4083285612Sdelphij * Set group name (ident). 408482498Sroberto */ 4085285612Sdelphij case CRYPTO_CONF_IDENT: 4086285612Sdelphij if (NULL != ident_filename) 4087285612Sdelphij free(ident_filename); 4088285612Sdelphij ident_filename = estrdup(cp); 408982498Sroberto break; 409082498Sroberto 409182498Sroberto /* 4092285612Sdelphij * Set private key password (pw). 409382498Sroberto */ 4094285612Sdelphij case CRYPTO_CONF_PW: 4095285612Sdelphij if (NULL != passwd) 4096285612Sdelphij free(passwd); 4097285612Sdelphij passwd = estrdup(cp); 409882498Sroberto break; 409982498Sroberto 410082498Sroberto /* 4101285612Sdelphij * Set random seed file name (randfile). 410282498Sroberto */ 4103285612Sdelphij case CRYPTO_CONF_RAND: 4104285612Sdelphij if (NULL != rand_file) 4105285612Sdelphij free(rand_file); 4106285612Sdelphij rand_file = estrdup(cp); 410782498Sroberto break; 410882498Sroberto 410982498Sroberto /* 4110285612Sdelphij * Set message digest NID. 411182498Sroberto */ 4112285612Sdelphij case CRYPTO_CONF_NID: 4113285612Sdelphij nid = OBJ_sn2nid(cp); 4114285612Sdelphij if (nid == 0) 4115285612Sdelphij msyslog(LOG_ERR, 4116285612Sdelphij "crypto_config: invalid digest name %s", cp); 4117285612Sdelphij else 4118285612Sdelphij crypto_nid = nid; 411982498Sroberto break; 412082498Sroberto } 412182498Sroberto} 4122289999Sglebius 4123289999Sglebius/* 4124289999Sglebius * Get the payload size (internal value length) of an extension packet. 4125289999Sglebius * If the inner value size does not match the outer packet size (that 4126289999Sglebius * is, the value would end behind the frame given by the opcode/size 4127289999Sglebius * field) the function will effectively return UINT_MAX. If the frame is 4128289999Sglebius * too short to hold a variable-sized value, the return value is zero. 4129289999Sglebius */ 4130289999Sglebiusstatic u_int 4131289999Sglebiusexten_payload_size( 4132289999Sglebius const struct exten * ep) 4133289999Sglebius{ 4134289999Sglebius typedef const u_char *BPTR; 4135289999Sglebius 4136289999Sglebius size_t extn_size; 4137289999Sglebius size_t data_size; 4138289999Sglebius size_t head_size; 4139289999Sglebius 4140289999Sglebius data_size = 0; 4141289999Sglebius if (NULL != ep) { 4142289999Sglebius head_size = (BPTR)(&ep->vallen + 1) - (BPTR)ep; 4143289999Sglebius extn_size = (uint16_t)(ntohl(ep->opcode) & 0x0000ffff); 4144289999Sglebius if (extn_size >= head_size) { 4145289999Sglebius data_size = (uint32_t)ntohl(ep->vallen); 4146289999Sglebius if (data_size > extn_size - head_size) 4147289999Sglebius data_size = ~(size_t)0u; 4148289999Sglebius } 4149289999Sglebius } 4150289999Sglebius return (u_int)data_size; 4151289999Sglebius} 4152285612Sdelphij# else /* !AUTOKEY follows */ 415382498Srobertoint ntp_crypto_bs_pubkey; 4154285612Sdelphij# endif /* !AUTOKEY */ 4155