182498Sroberto/* 282498Sroberto * ntp_crypto.h - definitions for cryptographic operations 382498Sroberto */ 4290001Sglebius#ifndef NTP_CRYPTO_H 5290001Sglebius#define NTP_CRYPTO_H 6290001Sglebius 7290001Sglebius/* 8290001Sglebius * Configuration codes (also needed for parser without AUTOKEY) 9290001Sglebius */ 10290001Sglebius#define CRYPTO_CONF_NONE 0 /* nothing doing */ 11290001Sglebius#define CRYPTO_CONF_PRIV 1 /* host name */ 12290001Sglebius#define CRYPTO_CONF_IDENT 2 /* group name */ 13290001Sglebius#define CRYPTO_CONF_CERT 3 /* certificate file name */ 14290001Sglebius#define CRYPTO_CONF_RAND 4 /* random seed file name */ 15290001Sglebius#define CRYPTO_CONF_IFFPAR 5 /* IFF parameters file name */ 16290001Sglebius#define CRYPTO_CONF_GQPAR 6 /* GQ parameters file name */ 17290001Sglebius#define CRYPTO_CONF_MVPAR 7 /* MV parameters file name */ 18290001Sglebius#define CRYPTO_CONF_PW 8 /* private key password */ 19290001Sglebius#define CRYPTO_CONF_NID 9 /* specify digest name */ 20290001Sglebius 21290001Sglebius#ifdef AUTOKEY 22290001Sglebius#ifndef OPENSSL 23290001Sglebius#error AUTOKEY should be defined only if OPENSSL is. 24290001Sglebiusinvalidsyntax: AUTOKEY should be defined only if OPENSSL is. 25290001Sglebius#endif 26290001Sglebius 27132451Sroberto#include "openssl/evp.h" 28290001Sglebius#include "ntp_calendar.h" /* for fields in the cert_info structure */ 29290001Sglebius 30290001Sglebius 31132451Sroberto/* 32132451Sroberto * The following bits are set by the CRYPTO_ASSOC message from 33132451Sroberto * the server and are not modified by the client. 34132451Sroberto */ 35132451Sroberto#define CRYPTO_FLAG_ENAB 0x0001 /* crypto enable */ 36132451Sroberto#define CRYPTO_FLAG_TAI 0x0002 /* leapseconds table */ 3782498Sroberto 38132451Sroberto#define CRYPTO_FLAG_PRIV 0x0010 /* PC identity scheme */ 39132451Sroberto#define CRYPTO_FLAG_IFF 0x0020 /* IFF identity scheme */ 40132451Sroberto#define CRYPTO_FLAG_GQ 0x0040 /* GQ identity scheme */ 41132451Sroberto#define CRYPTO_FLAG_MV 0x0080 /* MV identity scheme */ 42132451Sroberto#define CRYPTO_FLAG_MASK 0x00f0 /* identity scheme mask */ 43132451Sroberto 44132451Sroberto/* 45132451Sroberto * The following bits are used by the client during the protocol 46132451Sroberto * exchange. 47132451Sroberto */ 48290001Sglebius#define CRYPTO_FLAG_CERT 0x0100 /* public key verified */ 49132451Sroberto#define CRYPTO_FLAG_VRFY 0x0200 /* identity verified */ 50132451Sroberto#define CRYPTO_FLAG_PROV 0x0400 /* signature verified */ 51290001Sglebius#define CRYPTO_FLAG_COOK 0x0800 /* cookie verifed */ 52132451Sroberto#define CRYPTO_FLAG_AUTO 0x1000 /* autokey verified */ 53132451Sroberto#define CRYPTO_FLAG_SIGN 0x2000 /* certificate signed */ 54290001Sglebius#define CRYPTO_FLAG_LEAP 0x4000 /* leapsecond values verified */ 55290001Sglebius#define CRYPTO_FLAG_ALL 0x7f00 /* all mask */ 5682498Sroberto 5782498Sroberto/* 58132451Sroberto * Flags used for certificate management 5982498Sroberto */ 60182007Sroberto#define CERT_TRUST 0x01 /* certificate is trusted */ 61182007Sroberto#define CERT_SIGN 0x02 /* certificate is signed */ 62182007Sroberto#define CERT_VALID 0x04 /* certificate is valid */ 63182007Sroberto#define CERT_PRIV 0x08 /* certificate is private */ 64132451Sroberto#define CERT_ERROR 0x80 /* certificate has errors */ 6582498Sroberto 6682498Sroberto/* 6782498Sroberto * Extension field definitions 6882498Sroberto */ 69132451Sroberto#define CRYPTO_MAXLEN 1024 /* max extension field length */ 70132451Sroberto#define CRYPTO_VN 2 /* current protocol version number */ 71132451Sroberto#define CRYPTO_CMD(x) (((CRYPTO_VN << 8) | (x)) << 16) 72132451Sroberto#define CRYPTO_NULL CRYPTO_CMD(0) /* no operation */ 73132451Sroberto#define CRYPTO_ASSOC CRYPTO_CMD(1) /* association */ 74132451Sroberto#define CRYPTO_CERT CRYPTO_CMD(2) /* certificate */ 75132451Sroberto#define CRYPTO_COOK CRYPTO_CMD(3) /* cookie value */ 76132451Sroberto#define CRYPTO_AUTO CRYPTO_CMD(4) /* autokey values */ 77290001Sglebius#define CRYPTO_LEAP CRYPTO_CMD(5) /* leapsecond values */ 78132451Sroberto#define CRYPTO_SIGN CRYPTO_CMD(6) /* certificate sign */ 79132451Sroberto#define CRYPTO_IFF CRYPTO_CMD(7) /* IFF identity scheme */ 80132451Sroberto#define CRYPTO_GQ CRYPTO_CMD(8) /* GQ identity scheme */ 81132451Sroberto#define CRYPTO_MV CRYPTO_CMD(9) /* MV identity scheme */ 82132451Sroberto#define CRYPTO_RESP 0x80000000 /* response */ 83132451Sroberto#define CRYPTO_ERROR 0x40000000 /* error */ 8482498Sroberto 85132451Sroberto/* 86132451Sroberto * Autokey event codes 87132451Sroberto */ 88132451Sroberto#define XEVNT_CMD(x) (CRPT_EVENT | (x)) 89132451Sroberto#define XEVNT_OK XEVNT_CMD(0) /* success */ 90132451Sroberto#define XEVNT_LEN XEVNT_CMD(1) /* bad field format or length */ 91132451Sroberto#define XEVNT_TSP XEVNT_CMD(2) /* bad timestamp */ 92132451Sroberto#define XEVNT_FSP XEVNT_CMD(3) /* bad filestamp */ 93182007Sroberto#define XEVNT_PUB XEVNT_CMD(4) /* bad or missing public key */ 94132451Sroberto#define XEVNT_MD XEVNT_CMD(5) /* unsupported digest type */ 95132451Sroberto#define XEVNT_KEY XEVNT_CMD(6) /* unsupported identity type */ 96132451Sroberto#define XEVNT_SGL XEVNT_CMD(7) /* bad signature length */ 97132451Sroberto#define XEVNT_SIG XEVNT_CMD(8) /* signature not verified */ 98132451Sroberto#define XEVNT_VFY XEVNT_CMD(9) /* certificate not verified */ 99182007Sroberto#define XEVNT_PER XEVNT_CMD(10) /* host certificate expired */ 100132451Sroberto#define XEVNT_CKY XEVNT_CMD(11) /* bad or missing cookie */ 101290001Sglebius#define XEVNT_DAT XEVNT_CMD(12) /* bad or missing leapseconds */ 102132451Sroberto#define XEVNT_CRT XEVNT_CMD(13) /* bad or missing certificate */ 103182007Sroberto#define XEVNT_ID XEVNT_CMD(14) /* bad or missing group key */ 104182007Sroberto#define XEVNT_ERR XEVNT_CMD(15) /* protocol error */ 10582498Sroberto 10682498Sroberto/* 107132451Sroberto * Miscellaneous crypto stuff 10882498Sroberto */ 109132451Sroberto#define NTP_MAXSESSION 100 /* maximum session key list entries */ 110290001Sglebius#define NTP_MAXEXTEN 2048 /* maximum extension field size */ 111290001Sglebius#define NTP_AUTOMAX 12 /* default key list timeout (log2 s) */ 112290001Sglebius#define KEY_REVOKE 17 /* default key revoke timeout (log2 s) */ 113290001Sglebius#define NTP_REFRESH 19 /* default restart timeout (log2 s) */ 114290001Sglebius#define NTP_MAXKEY 65535 /* maximum symmetric key ID */ 11582498Sroberto 11682498Sroberto/* 117132451Sroberto * The autokey structure holds the values used to authenticate key IDs. 118132451Sroberto */ 119132451Srobertostruct autokey { /* network byte order */ 120132451Sroberto keyid_t key; /* key ID */ 121132451Sroberto int32 seq; /* key number */ 122132451Sroberto}; 123132451Sroberto 124132451Sroberto/* 125132451Sroberto * The value structure holds variable length data such as public 126132451Sroberto * key, agreement parameters, public valule and leapsecond table. 127132451Sroberto * They are in network byte order. 128132451Sroberto */ 129132451Srobertostruct value { /* network byte order */ 130132451Sroberto tstamp_t tstamp; /* timestamp */ 131132451Sroberto tstamp_t fstamp; /* filestamp */ 132132451Sroberto u_int32 vallen; /* value length */ 133290001Sglebius void *ptr; /* data pointer (various) */ 134132451Sroberto u_int32 siglen; /* signature length */ 135132451Sroberto u_char *sig; /* signature */ 136132451Sroberto}; 137132451Sroberto 138132451Sroberto/* 139132451Sroberto * The packet extension field structures are used to hold values 140132451Sroberto * and signatures in network byte order. 141132451Sroberto */ 142132451Srobertostruct exten { 143132451Sroberto u_int32 opcode; /* opcode */ 144132451Sroberto u_int32 associd; /* association ID */ 145132451Sroberto u_int32 tstamp; /* timestamp */ 146132451Sroberto u_int32 fstamp; /* filestamp */ 147132451Sroberto u_int32 vallen; /* value length */ 148132451Sroberto u_int32 pkt[1]; /* start of value field */ 149132451Sroberto}; 150132451Sroberto 151290001Sglebius 152132451Sroberto/* 153132451Sroberto * The certificate info/value structure 154132451Sroberto */ 155132451Srobertostruct cert_info { 156132451Sroberto struct cert_info *link; /* forward link */ 157132451Sroberto u_int flags; /* flags that wave */ 158132451Sroberto EVP_PKEY *pkey; /* generic key */ 159132451Sroberto long version; /* X509 version */ 160132451Sroberto int nid; /* signature/digest ID */ 161132451Sroberto const EVP_MD *digest; /* message digest algorithm */ 162132451Sroberto u_long serial; /* serial number */ 163290001Sglebius struct calendar first; /* not valid before */ 164290001Sglebius struct calendar last; /* not valid after */ 165132451Sroberto char *subject; /* subject common name */ 166132451Sroberto char *issuer; /* issuer common name */ 167290001Sglebius BIGNUM *grpkey; /* GQ group key */ 168132451Sroberto struct value cert; /* certificate/value */ 169132451Sroberto}; 170132451Sroberto 171132451Sroberto/* 172290001Sglebius * The keys info/value structure 173290001Sglebius */ 174290001Sglebiusstruct pkey_info { 175290001Sglebius struct pkey_info *link; /* forward link */ 176290001Sglebius EVP_PKEY *pkey; /* generic key */ 177290001Sglebius char *name; /* file name */ 178290001Sglebius tstamp_t fstamp; /* filestamp */ 179290001Sglebius}; 180290001Sglebius 181290001Sglebius/* 18282498Sroberto * Cryptographic values 18382498Sroberto */ 18482498Srobertoextern u_int crypto_flags; /* status word */ 185290001Sglebiusextern int crypto_nid; /* digest nid */ 186132451Srobertoextern struct value hostval; /* host name/value */ 187132451Srobertoextern struct cert_info *cinfo; /* host certificate information */ 18882498Srobertoextern struct value tai_leap; /* leapseconds table */ 189290001Sglebius#endif /* AUTOKEY */ 190290001Sglebius#endif /* NTP_CRYPTO_H */ 191