1/* 2 * ntp_crypto.c - NTP version 4 public key routines 3 */ 4#ifdef HAVE_CONFIG_H 5#include <config.h> 6#endif 7 8#ifdef OPENSSL 9#include <stdio.h> 10#include <sys/types.h> 11#include <sys/param.h> 12#include <unistd.h> 13#include <fcntl.h> 14 15#include "ntpd.h" 16#include "ntp_stdlib.h" 17#include "ntp_unixtime.h" 18#include "ntp_string.h" 19#include "ntp_random.h" 20#include "ntp_assert.h" 21 22#include "openssl/asn1_mac.h" 23#include "openssl/bn.h" 24#include "openssl/err.h" 25#include "openssl/evp.h" 26#include "openssl/pem.h" 27#include "openssl/rand.h" 28#include "openssl/x509v3.h" 29 30#ifdef KERNEL_PLL 31#include "ntp_syscall.h" 32#endif /* KERNEL_PLL */ 33 34/* 35 * Extension field message format 36 * 37 * These are always signed and saved before sending in network byte 38 * order. They must be converted to and from host byte order for 39 * processing. 40 * 41 * +-------+-------+ 42 * | op | len | <- extension pointer 43 * +-------+-------+ 44 * | associd | 45 * +---------------+ 46 * | timestamp | <- value pointer 47 * +---------------+ 48 * | filestamp | 49 * +---------------+ 50 * | value len | 51 * +---------------+ 52 * | | 53 * = value = 54 * | | 55 * +---------------+ 56 * | signature len | 57 * +---------------+ 58 * | | 59 * = signature = 60 * | | 61 * +---------------+ 62 * 63 * The CRYPTO_RESP bit is set to 0 for requests, 1 for responses. 64 * Requests carry the association ID of the receiver; responses carry 65 * the association ID of the sender. Some messages include only the 66 * operation/length and association ID words and so have length 8 67 * octets. Ohers include the value structure and associated value and 68 * signature fields. These messages include the timestamp, filestamp, 69 * value and signature words and so have length at least 24 octets. The 70 * signature and/or value fields can be empty, in which case the 71 * respective length words are zero. An empty value with nonempty 72 * signature is syntactically valid, but semantically questionable. 73 * 74 * The filestamp represents the time when a cryptographic data file such 75 * as a public/private key pair is created. It follows every reference 76 * depending on that file and serves as a means to obsolete earlier data 77 * of the same type. The timestamp represents the time when the 78 * cryptographic data of the message were last signed. Creation of a 79 * cryptographic data file or signing a message can occur only when the 80 * creator or signor is synchronized to an authoritative source and 81 * proventicated to a trusted authority. 82 * 83 * Note there are several conditions required for server trust. First, 84 * the public key on the server certificate must be verified, which can 85 * involve a hike along the certificate trail to a trusted host. Next, 86 * the server trust must be confirmed by one of several identity 87 * schemes. Valid cryptographic values are signed with attached 88 * timestamp and filestamp. Individual packet trust is confirmed 89 * relative to these values by a message digest with keys generated by a 90 * reverse-order pseudorandom hash. 91 * 92 * State decomposition. These flags are lit in the order given. They are 93 * dim only when the association is demobilized. 94 * 95 * CRYPTO_FLAG_ENAB Lit upon acceptance of a CRYPTO_ASSOC message 96 * CRYPTO_FLAG_CERT Lit when a self-digned trusted certificate is 97 * accepted. 98 * CRYPTO_FLAG_VRFY Lit when identity is confirmed. 99 * CRYPTO_FLAG_PROV Lit when the first signature is verified. 100 * CRYPTO_FLAG_COOK Lit when a valid cookie is accepted. 101 * CRYPTO_FLAG_AUTO Lit when valid autokey values are accepted. 102 * CRYPTO_FLAG_SIGN Lit when the server signed certificate is 103 * accepted. 104 * CRYPTO_FLAG_LEAP Lit when the leapsecond values are accepted. 105 */ 106/* 107 * Cryptodefines 108 */ 109#define TAI_1972 10 /* initial TAI offset (s) */ 110#define MAX_LEAP 100 /* max UTC leapseconds (s) */ 111#define VALUE_LEN (6 * 4) /* min response field length */ 112#define YEAR (60 * 60 * 24 * 365) /* seconds in year */ 113 114/* 115 * Global cryptodata in host byte order 116 */ 117u_int32 crypto_flags = 0x0; /* status word */ 118int crypto_nid = KEY_TYPE_MD5; /* digest nid */ 119char *sys_hostname = NULL; /* host name */ 120char *sys_groupname = NULL; /* group name */ 121 122/* 123 * Global cryptodata in network byte order 124 */ 125struct cert_info *cinfo = NULL; /* certificate info/value cache */ 126struct cert_info *cert_host = NULL; /* host certificate */ 127struct pkey_info *pkinfo = NULL; /* key info/value cache */ 128struct value hostval; /* host value */ 129struct value pubkey; /* public key */ 130struct value tai_leap; /* leapseconds values */ 131struct pkey_info *iffkey_info = NULL; /* IFF keys */ 132struct pkey_info *gqkey_info = NULL; /* GQ keys */ 133struct pkey_info *mvkey_info = NULL; /* MV keys */ 134 135/* 136 * Private cryptodata in host byte order 137 */ 138static char *passwd = NULL; /* private key password */ 139static EVP_PKEY *host_pkey = NULL; /* host key */ 140static EVP_PKEY *sign_pkey = NULL; /* sign key */ 141static const EVP_MD *sign_digest = NULL; /* sign digest */ 142static u_int sign_siglen; /* sign key length */ 143static char *rand_file = NULL; /* random seed file */ 144 145/* 146 * Cryptotypes 147 */ 148static int crypto_verify (struct exten *, struct value *, 149 struct peer *); 150static int crypto_encrypt (struct exten *, struct value *, 151 keyid_t *); 152static int crypto_alice (struct peer *, struct value *); 153static int crypto_alice2 (struct peer *, struct value *); 154static int crypto_alice3 (struct peer *, struct value *); 155static int crypto_bob (struct exten *, struct value *); 156static int crypto_bob2 (struct exten *, struct value *); 157static int crypto_bob3 (struct exten *, struct value *); 158static int crypto_iff (struct exten *, struct peer *); 159static int crypto_gq (struct exten *, struct peer *); 160static int crypto_mv (struct exten *, struct peer *); 161static int crypto_send (struct exten *, struct value *, int); 162static tstamp_t crypto_time (void); 163static u_long asn2ntp (ASN1_TIME *); 164static struct cert_info *cert_parse (u_char *, long, tstamp_t); 165static int cert_sign (struct exten *, struct value *); 166static struct cert_info *cert_install (struct exten *, struct peer *); 167static int cert_hike (struct peer *, struct cert_info *); 168static void cert_free (struct cert_info *); 169static struct pkey_info *crypto_key (char *, char *, sockaddr_u *); 170static void bighash (BIGNUM *, BIGNUM *); 171static struct cert_info *crypto_cert (char *); 172 173#ifdef SYS_WINNT 174int 175readlink(char * link, char * file, int len) { 176 return (-1); 177} 178#endif 179 180/* 181 * session_key - generate session key 182 * 183 * This routine generates a session key from the source address, 184 * destination address, key ID and private value. The value of the 185 * session key is the MD5 hash of these values, while the next key ID is 186 * the first four octets of the hash. 187 * 188 * Returns the next key ID or 0 if there is no destination address. 189 */ 190keyid_t 191session_key( 192 sockaddr_u *srcadr, /* source address */ 193 sockaddr_u *dstadr, /* destination address */ 194 keyid_t keyno, /* key ID */ 195 keyid_t private, /* private value */ 196 u_long lifetime /* key lifetime */ 197 ) 198{ 199 EVP_MD_CTX ctx; /* message digest context */ 200 u_char dgst[EVP_MAX_MD_SIZE]; /* message digest */ 201 keyid_t keyid; /* key identifer */ 202 u_int32 header[10]; /* data in network byte order */ 203 u_int hdlen, len; 204 205 if (!dstadr) 206 return 0; 207 208 /* 209 * Generate the session key and key ID. If the lifetime is 210 * greater than zero, install the key and call it trusted. 211 */ 212 hdlen = 0; 213 switch(AF(srcadr)) { 214 case AF_INET: 215 header[0] = NSRCADR(srcadr); 216 header[1] = NSRCADR(dstadr); 217 header[2] = htonl(keyno); 218 header[3] = htonl(private); 219 hdlen = 4 * sizeof(u_int32); 220 break; 221 222 case AF_INET6: 223 memcpy(&header[0], PSOCK_ADDR6(srcadr), 224 sizeof(struct in6_addr)); 225 memcpy(&header[4], PSOCK_ADDR6(dstadr), 226 sizeof(struct in6_addr)); 227 header[8] = htonl(keyno); 228 header[9] = htonl(private); 229 hdlen = 10 * sizeof(u_int32); 230 break; 231 } 232 EVP_DigestInit(&ctx, EVP_get_digestbynid(crypto_nid)); 233 EVP_DigestUpdate(&ctx, (u_char *)header, hdlen); 234 EVP_DigestFinal(&ctx, dgst, &len); 235 memcpy(&keyid, dgst, 4); 236 keyid = ntohl(keyid); 237 if (lifetime != 0) { 238 MD5auth_setkey(keyno, crypto_nid, dgst, len); 239 authtrust(keyno, lifetime); 240 } 241 DPRINTF(2, ("session_key: %s > %s %08x %08x hash %08x life %lu\n", 242 stoa(srcadr), stoa(dstadr), keyno, 243 private, keyid, lifetime)); 244 245 return (keyid); 246} 247 248 249/* 250 * make_keylist - generate key list 251 * 252 * Returns 253 * XEVNT_OK success 254 * XEVNT_ERR protocol error 255 * 256 * This routine constructs a pseudo-random sequence by repeatedly 257 * hashing the session key starting from a given source address, 258 * destination address, private value and the next key ID of the 259 * preceeding session key. The last entry on the list is saved along 260 * with its sequence number and public signature. 261 */ 262int 263make_keylist( 264 struct peer *peer, /* peer structure pointer */ 265 struct interface *dstadr /* interface */ 266 ) 267{ 268 EVP_MD_CTX ctx; /* signature context */ 269 tstamp_t tstamp; /* NTP timestamp */ 270 struct autokey *ap; /* autokey pointer */ 271 struct value *vp; /* value pointer */ 272 keyid_t keyid = 0; /* next key ID */ 273 keyid_t cookie; /* private value */ 274 long lifetime; 275 u_int len, mpoll; 276 int i; 277 278 if (!dstadr) 279 return XEVNT_ERR; 280 281 /* 282 * Allocate the key list if necessary. 283 */ 284 tstamp = crypto_time(); 285 if (peer->keylist == NULL) 286 peer->keylist = emalloc(sizeof(keyid_t) * 287 NTP_MAXSESSION); 288 289 /* 290 * Generate an initial key ID which is unique and greater than 291 * NTP_MAXKEY. 292 */ 293 while (1) { 294 keyid = ntp_random() & 0xffffffff; 295 if (keyid <= NTP_MAXKEY) 296 continue; 297 298 if (authhavekey(keyid)) 299 continue; 300 break; 301 } 302 303 /* 304 * Generate up to NTP_MAXSESSION session keys. Stop if the 305 * next one would not be unique or not a session key ID or if 306 * it would expire before the next poll. The private value 307 * included in the hash is zero if broadcast mode, the peer 308 * cookie if client mode or the host cookie if symmetric modes. 309 */ 310 mpoll = 1 << min(peer->ppoll, peer->hpoll); 311 lifetime = min(1 << sys_automax, NTP_MAXSESSION * mpoll); 312 if (peer->hmode == MODE_BROADCAST) 313 cookie = 0; 314 else 315 cookie = peer->pcookie; 316 for (i = 0; i < NTP_MAXSESSION; i++) { 317 peer->keylist[i] = keyid; 318 peer->keynumber = i; 319 keyid = session_key(&dstadr->sin, &peer->srcadr, keyid, 320 cookie, lifetime + mpoll); 321 lifetime -= mpoll; 322 if (auth_havekey(keyid) || keyid <= NTP_MAXKEY || 323 lifetime < 0 || tstamp == 0) 324 break; 325 } 326 327 /* 328 * Save the last session key ID, sequence number and timestamp, 329 * then sign these values for later retrieval by the clients. Be 330 * careful not to use invalid key media. Use the public values 331 * timestamp as filestamp. 332 */ 333 vp = &peer->sndval; 334 if (vp->ptr == NULL) 335 vp->ptr = emalloc(sizeof(struct autokey)); 336 ap = (struct autokey *)vp->ptr; 337 ap->seq = htonl(peer->keynumber); 338 ap->key = htonl(keyid); 339 vp->tstamp = htonl(tstamp); 340 vp->fstamp = hostval.tstamp; 341 vp->vallen = htonl(sizeof(struct autokey)); 342 vp->siglen = 0; 343 if (tstamp != 0) { 344 if (vp->sig == NULL) 345 vp->sig = emalloc(sign_siglen); 346 EVP_SignInit(&ctx, sign_digest); 347 EVP_SignUpdate(&ctx, (u_char *)vp, 12); 348 EVP_SignUpdate(&ctx, vp->ptr, sizeof(struct autokey)); 349 if (EVP_SignFinal(&ctx, vp->sig, &len, sign_pkey)) { 350 vp->siglen = htonl(sign_siglen); 351 peer->flags |= FLAG_ASSOC; 352 } 353 } 354#ifdef DEBUG 355 if (debug) 356 printf("make_keys: %d %08x %08x ts %u fs %u poll %d\n", 357 peer->keynumber, keyid, cookie, ntohl(vp->tstamp), 358 ntohl(vp->fstamp), peer->hpoll); 359#endif 360 return (XEVNT_OK); 361} 362 363 364/* 365 * crypto_recv - parse extension fields 366 * 367 * This routine is called when the packet has been matched to an 368 * association and passed sanity, format and MAC checks. We believe the 369 * extension field values only if the field has proper format and 370 * length, the timestamp and filestamp are valid and the signature has 371 * valid length and is verified. There are a few cases where some values 372 * are believed even if the signature fails, but only if the proventic 373 * bit is not set. 374 * 375 * Returns 376 * XEVNT_OK success 377 * XEVNT_ERR protocol error 378 * XEVNT_LEN bad field format or length 379 */ 380int 381crypto_recv( 382 struct peer *peer, /* peer structure pointer */ 383 struct recvbuf *rbufp /* packet buffer pointer */ 384 ) 385{ 386 const EVP_MD *dp; /* message digest algorithm */ 387 u_int32 *pkt; /* receive packet pointer */ 388 struct autokey *ap, *bp; /* autokey pointer */ 389 struct exten *ep, *fp; /* extension pointers */ 390 struct cert_info *xinfo; /* certificate info pointer */ 391 int has_mac; /* length of MAC field */ 392 int authlen; /* offset of MAC field */ 393 associd_t associd; /* association ID */ 394 tstamp_t tstamp = 0; /* timestamp */ 395 tstamp_t fstamp = 0; /* filestamp */ 396 u_int len; /* extension field length */ 397 u_int code; /* extension field opcode */ 398 u_int vallen = 0; /* value length */ 399 X509 *cert; /* X509 certificate */ 400 char statstr[NTP_MAXSTRLEN]; /* statistics for filegen */ 401 keyid_t cookie; /* crumbles */ 402 int hismode; /* packet mode */ 403 int rval = XEVNT_OK; 404 u_char *ptr; 405 u_int32 temp32; 406 407 /* 408 * Initialize. Note that the packet has already been checked for 409 * valid format and extension field lengths. First extract the 410 * field length, command code and association ID in host byte 411 * order. These are used with all commands and modes. Then check 412 * the version number, which must be 2, and length, which must 413 * be at least 8 for requests and VALUE_LEN (24) for responses. 414 * Packets that fail either test sink without a trace. The 415 * association ID is saved only if nonzero. 416 */ 417 authlen = LEN_PKT_NOMAC; 418 hismode = (int)PKT_MODE((&rbufp->recv_pkt)->li_vn_mode); 419 while ((has_mac = rbufp->recv_length - authlen) > MAX_MAC_LEN) { 420 pkt = (u_int32 *)&rbufp->recv_pkt + authlen / 4; 421 ep = (struct exten *)pkt; 422 code = ntohl(ep->opcode) & 0xffff0000; 423 len = ntohl(ep->opcode) & 0x0000ffff; 424 associd = (associd_t)ntohl(pkt[1]); 425 rval = XEVNT_OK; 426#ifdef DEBUG 427 if (debug) 428 printf( 429 "crypto_recv: flags 0x%x ext offset %d len %u code 0x%x associd %d\n", 430 peer->crypto, authlen, len, code >> 16, 431 associd); 432#endif 433 434 /* 435 * Check version number and field length. If bad, 436 * quietly ignore the packet. 437 */ 438 if (((code >> 24) & 0x3f) != CRYPTO_VN || len < 8) { 439 sys_badlength++; 440 code |= CRYPTO_ERROR; 441 } 442 443 if (len >= VALUE_LEN) { 444 tstamp = ntohl(ep->tstamp); 445 fstamp = ntohl(ep->fstamp); 446 vallen = ntohl(ep->vallen); 447 } 448 switch (code) { 449 450 /* 451 * Install status word, host name, signature scheme and 452 * association ID. In OpenSSL the signature algorithm is 453 * bound to the digest algorithm, so the NID completely 454 * defines the signature scheme. Note the request and 455 * response are identical, but neither is validated by 456 * signature. The request is processed here only in 457 * symmetric modes. The server name field might be 458 * useful to implement access controls in future. 459 */ 460 case CRYPTO_ASSOC: 461 462 /* 463 * If our state machine is running when this 464 * message arrives, the other fellow might have 465 * restarted. However, this could be an 466 * intruder, so just clamp the poll interval and 467 * find out for ourselves. Otherwise, pass the 468 * extension field to the transmit side. 469 */ 470 if (peer->crypto & CRYPTO_FLAG_CERT) { 471 rval = XEVNT_ERR; 472 break; 473 } 474 if (peer->cmmd) { 475 if (peer->assoc != associd) { 476 rval = XEVNT_ERR; 477 break; 478 } 479 } 480 fp = emalloc(len); 481 memcpy(fp, ep, len); 482 fp->associd = htonl(peer->associd); 483 peer->cmmd = fp; 484 /* fall through */ 485 486 case CRYPTO_ASSOC | CRYPTO_RESP: 487 488 /* 489 * Discard the message if it has already been 490 * stored or the message has been amputated. 491 */ 492 if (peer->crypto) { 493 if (peer->assoc != associd) 494 rval = XEVNT_ERR; 495 break; 496 } 497 if (vallen == 0 || vallen > MAXHOSTNAME || 498 len < VALUE_LEN + vallen) { 499 rval = XEVNT_LEN; 500 break; 501 } 502#ifdef DEBUG 503 if (debug) 504 printf( 505 "crypto_recv: ident host 0x%x %d server 0x%x %d\n", 506 crypto_flags, peer->associd, fstamp, 507 peer->assoc); 508#endif 509 temp32 = crypto_flags & CRYPTO_FLAG_MASK; 510 511 /* 512 * If the client scheme is PC, the server scheme 513 * must be PC. The public key and identity are 514 * presumed valid, so we skip the certificate 515 * and identity exchanges and move immediately 516 * to the cookie exchange which confirms the 517 * server signature. 518 */ 519 if (crypto_flags & CRYPTO_FLAG_PRIV) { 520 if (!(fstamp & CRYPTO_FLAG_PRIV)) { 521 rval = XEVNT_KEY; 522 break; 523 } 524 fstamp |= CRYPTO_FLAG_CERT | 525 CRYPTO_FLAG_VRFY | CRYPTO_FLAG_SIGN; 526 527 /* 528 * It is an error if either peer supports 529 * identity, but the other does not. 530 */ 531 } else if (hismode == MODE_ACTIVE || hismode == 532 MODE_PASSIVE) { 533 if ((temp32 && !(fstamp & 534 CRYPTO_FLAG_MASK)) || 535 (!temp32 && (fstamp & 536 CRYPTO_FLAG_MASK))) { 537 rval = XEVNT_KEY; 538 break; 539 } 540 } 541 542 /* 543 * Discard the message if the signature digest 544 * NID is not supported. 545 */ 546 temp32 = (fstamp >> 16) & 0xffff; 547 dp = 548 (const EVP_MD *)EVP_get_digestbynid(temp32); 549 if (dp == NULL) { 550 rval = XEVNT_MD; 551 break; 552 } 553 554 /* 555 * Save status word, host name and message 556 * digest/signature type. If this is from a 557 * broadcast and the association ID has changed, 558 * request the autokey values. 559 */ 560 peer->assoc = associd; 561 if (hismode == MODE_SERVER) 562 fstamp |= CRYPTO_FLAG_AUTO; 563 if (!(fstamp & CRYPTO_FLAG_TAI)) 564 fstamp |= CRYPTO_FLAG_LEAP; 565 RAND_bytes((u_char *)&peer->hcookie, 4); 566 peer->crypto = fstamp; 567 peer->digest = dp; 568 if (peer->subject != NULL) 569 free(peer->subject); 570 peer->subject = emalloc(vallen + 1); 571 memcpy(peer->subject, ep->pkt, vallen); 572 peer->subject[vallen] = '\0'; 573 if (peer->issuer != NULL) 574 free(peer->issuer); 575 peer->issuer = emalloc(vallen + 1); 576 strcpy(peer->issuer, peer->subject); 577 snprintf(statstr, NTP_MAXSTRLEN, 578 "assoc %d %d host %s %s", peer->associd, 579 peer->assoc, peer->subject, 580 OBJ_nid2ln(temp32)); 581 record_crypto_stats(&peer->srcadr, statstr); 582#ifdef DEBUG 583 if (debug) 584 printf("crypto_recv: %s\n", statstr); 585#endif 586 break; 587 588 /* 589 * Decode X509 certificate in ASN.1 format and extract 590 * the data containing, among other things, subject 591 * name and public key. In the default identification 592 * scheme, the certificate trail is followed to a self 593 * signed trusted certificate. 594 */ 595 case CRYPTO_CERT | CRYPTO_RESP: 596 597 /* 598 * Discard the message if empty or invalid. 599 */ 600 if (len < VALUE_LEN) 601 break; 602 603 if ((rval = crypto_verify(ep, NULL, peer)) != 604 XEVNT_OK) 605 break; 606 607 /* 608 * Scan the certificate list to delete old 609 * versions and link the newest version first on 610 * the list. Then, verify the signature. If the 611 * certificate is bad or missing, just ignore 612 * it. 613 */ 614 if ((xinfo = cert_install(ep, peer)) == NULL) { 615 rval = XEVNT_CRT; 616 break; 617 } 618 if ((rval = cert_hike(peer, xinfo)) != XEVNT_OK) 619 break; 620 621 /* 622 * We plug in the public key and lifetime from 623 * the first certificate received. However, note 624 * that this certificate might not be signed by 625 * the server, so we can't check the 626 * signature/digest NID. 627 */ 628 if (peer->pkey == NULL) { 629 ptr = (u_char *)xinfo->cert.ptr; 630 cert = d2i_X509(NULL, &ptr, 631 ntohl(xinfo->cert.vallen)); 632 peer->pkey = X509_get_pubkey(cert); 633 X509_free(cert); 634 } 635 peer->flash &= ~TEST8; 636 temp32 = xinfo->nid; 637 snprintf(statstr, NTP_MAXSTRLEN, 638 "cert %s %s 0x%x %s (%u) fs %u", 639 xinfo->subject, xinfo->issuer, xinfo->flags, 640 OBJ_nid2ln(temp32), temp32, 641 ntohl(ep->fstamp)); 642 record_crypto_stats(&peer->srcadr, statstr); 643#ifdef DEBUG 644 if (debug) 645 printf("crypto_recv: %s\n", statstr); 646#endif 647 break; 648 649 /* 650 * Schnorr (IFF) identity scheme. This scheme is 651 * designed for use with shared secret server group keys 652 * and where the certificate may be generated by a third 653 * party. The client sends a challenge to the server, 654 * which performs a calculation and returns the result. 655 * A positive result is possible only if both client and 656 * server contain the same secret group key. 657 */ 658 case CRYPTO_IFF | CRYPTO_RESP: 659 660 /* 661 * Discard the message if invalid. 662 */ 663 if ((rval = crypto_verify(ep, NULL, peer)) != 664 XEVNT_OK) 665 break; 666 667 /* 668 * If the challenge matches the response, the 669 * server public key, signature and identity are 670 * all verified at the same time. The server is 671 * declared trusted, so we skip further 672 * certificate exchanges and move immediately to 673 * the cookie exchange. 674 */ 675 if ((rval = crypto_iff(ep, peer)) != XEVNT_OK) 676 break; 677 678 peer->crypto |= CRYPTO_FLAG_VRFY; 679 peer->flash &= ~TEST8; 680 snprintf(statstr, NTP_MAXSTRLEN, "iff %s fs %u", 681 peer->issuer, ntohl(ep->fstamp)); 682 record_crypto_stats(&peer->srcadr, statstr); 683#ifdef DEBUG 684 if (debug) 685 printf("crypto_recv: %s\n", statstr); 686#endif 687 break; 688 689 /* 690 * Guillou-Quisquater (GQ) identity scheme. This scheme 691 * is designed for use with public certificates carrying 692 * the GQ public key in an extension field. The client 693 * sends a challenge to the server, which performs a 694 * calculation and returns the result. A positive result 695 * is possible only if both client and server contain 696 * the same group key and the server has the matching GQ 697 * private key. 698 */ 699 case CRYPTO_GQ | CRYPTO_RESP: 700 701 /* 702 * Discard the message if invalid 703 */ 704 if ((rval = crypto_verify(ep, NULL, peer)) != 705 XEVNT_OK) 706 break; 707 708 /* 709 * If the challenge matches the response, the 710 * server public key, signature and identity are 711 * all verified at the same time. The server is 712 * declared trusted, so we skip further 713 * certificate exchanges and move immediately to 714 * the cookie exchange. 715 */ 716 if ((rval = crypto_gq(ep, peer)) != XEVNT_OK) 717 break; 718 719 peer->crypto |= CRYPTO_FLAG_VRFY; 720 peer->flash &= ~TEST8; 721 snprintf(statstr, NTP_MAXSTRLEN, "gq %s fs %u", 722 peer->issuer, ntohl(ep->fstamp)); 723 record_crypto_stats(&peer->srcadr, statstr); 724#ifdef DEBUG 725 if (debug) 726 printf("crypto_recv: %s\n", statstr); 727#endif 728 break; 729 730 /* 731 * Mu-Varadharajan (MV) identity scheme. This scheme is 732 * designed for use with three levels of trust, trusted 733 * host, server and client. The trusted host key is 734 * opaque to servers and clients; the server keys are 735 * opaque to clients and each client key is different. 736 * Client keys can be revoked without requiring new key 737 * generations. 738 */ 739 case CRYPTO_MV | CRYPTO_RESP: 740 741 /* 742 * Discard the message if invalid. 743 */ 744 if ((rval = crypto_verify(ep, NULL, peer)) != 745 XEVNT_OK) 746 break; 747 748 /* 749 * If the challenge matches the response, the 750 * server public key, signature and identity are 751 * all verified at the same time. The server is 752 * declared trusted, so we skip further 753 * certificate exchanges and move immediately to 754 * the cookie exchange. 755 */ 756 if ((rval = crypto_mv(ep, peer)) != XEVNT_OK) 757 break; 758 759 peer->crypto |= CRYPTO_FLAG_VRFY; 760 peer->flash &= ~TEST8; 761 snprintf(statstr, NTP_MAXSTRLEN, "mv %s fs %u", 762 peer->issuer, ntohl(ep->fstamp)); 763 record_crypto_stats(&peer->srcadr, statstr); 764#ifdef DEBUG 765 if (debug) 766 printf("crypto_recv: %s\n", statstr); 767#endif 768 break; 769 770 771 /* 772 * Cookie response in client and symmetric modes. If the 773 * cookie bit is set, the working cookie is the EXOR of 774 * the current and new values. 775 */ 776 case CRYPTO_COOK | CRYPTO_RESP: 777 778 /* 779 * Discard the message if invalid or signature 780 * not verified with respect to the cookie 781 * values. 782 */ 783 if ((rval = crypto_verify(ep, &peer->cookval, 784 peer)) != XEVNT_OK) 785 break; 786 787 /* 788 * Decrypt the cookie, hunting all the time for 789 * errors. 790 */ 791 if (vallen == (u_int)EVP_PKEY_size(host_pkey)) { 792 if (RSA_private_decrypt(vallen, 793 (u_char *)ep->pkt, 794 (u_char *)&temp32, 795 host_pkey->pkey.rsa, 796 RSA_PKCS1_OAEP_PADDING) <= 0) { 797 rval = XEVNT_CKY; 798 break; 799 } else { 800 cookie = ntohl(temp32); 801 } 802 } else { 803 rval = XEVNT_CKY; 804 break; 805 } 806 807 /* 808 * Install cookie values and light the cookie 809 * bit. If this is not broadcast client mode, we 810 * are done here. 811 */ 812 key_expire(peer); 813 if (hismode == MODE_ACTIVE || hismode == 814 MODE_PASSIVE) 815 peer->pcookie = peer->hcookie ^ cookie; 816 else 817 peer->pcookie = cookie; 818 peer->crypto |= CRYPTO_FLAG_COOK; 819 peer->flash &= ~TEST8; 820 snprintf(statstr, NTP_MAXSTRLEN, 821 "cook %x ts %u fs %u", peer->pcookie, 822 ntohl(ep->tstamp), ntohl(ep->fstamp)); 823 record_crypto_stats(&peer->srcadr, statstr); 824#ifdef DEBUG 825 if (debug) 826 printf("crypto_recv: %s\n", statstr); 827#endif 828 break; 829 830 /* 831 * Install autokey values in broadcast client and 832 * symmetric modes. We have to do this every time the 833 * sever/peer cookie changes or a new keylist is 834 * rolled. Ordinarily, this is automatic as this message 835 * is piggybacked on the first NTP packet sent upon 836 * either of these events. Note that a broadcast client 837 * or symmetric peer can receive this response without a 838 * matching request. 839 */ 840 case CRYPTO_AUTO | CRYPTO_RESP: 841 842 /* 843 * Discard the message if invalid or signature 844 * not verified with respect to the receive 845 * autokey values. 846 */ 847 if ((rval = crypto_verify(ep, &peer->recval, 848 peer)) != XEVNT_OK) 849 break; 850 851 /* 852 * Discard the message if a broadcast client and 853 * the association ID does not match. This might 854 * happen if a broacast server restarts the 855 * protocol. A protocol restart will occur at 856 * the next ASSOC message. 857 */ 858 if (peer->cast_flags & MDF_BCLNT && 859 peer->assoc != associd) 860 break; 861 862 /* 863 * Install autokey values and light the 864 * autokey bit. This is not hard. 865 */ 866 if (ep->tstamp == 0) 867 break; 868 869 if (peer->recval.ptr == NULL) 870 peer->recval.ptr = 871 emalloc(sizeof(struct autokey)); 872 bp = (struct autokey *)peer->recval.ptr; 873 peer->recval.tstamp = ep->tstamp; 874 peer->recval.fstamp = ep->fstamp; 875 ap = (struct autokey *)ep->pkt; 876 bp->seq = ntohl(ap->seq); 877 bp->key = ntohl(ap->key); 878 peer->pkeyid = bp->key; 879 peer->crypto |= CRYPTO_FLAG_AUTO; 880 peer->flash &= ~TEST8; 881 snprintf(statstr, NTP_MAXSTRLEN, 882 "auto seq %d key %x ts %u fs %u", bp->seq, 883 bp->key, ntohl(ep->tstamp), 884 ntohl(ep->fstamp)); 885 record_crypto_stats(&peer->srcadr, statstr); 886#ifdef DEBUG 887 if (debug) 888 printf("crypto_recv: %s\n", statstr); 889#endif 890 break; 891 892 /* 893 * X509 certificate sign response. Validate the 894 * certificate signed by the server and install. Later 895 * this can be provided to clients of this server in 896 * lieu of the self signed certificate in order to 897 * validate the public key. 898 */ 899 case CRYPTO_SIGN | CRYPTO_RESP: 900 901 /* 902 * Discard the message if invalid. 903 */ 904 if ((rval = crypto_verify(ep, NULL, peer)) != 905 XEVNT_OK) 906 break; 907 908 /* 909 * Scan the certificate list to delete old 910 * versions and link the newest version first on 911 * the list. 912 */ 913 if ((xinfo = cert_install(ep, peer)) == NULL) { 914 rval = XEVNT_CRT; 915 break; 916 } 917 peer->crypto |= CRYPTO_FLAG_SIGN; 918 peer->flash &= ~TEST8; 919 temp32 = xinfo->nid; 920 snprintf(statstr, NTP_MAXSTRLEN, 921 "sign %s %s 0x%x %s (%u) fs %u", 922 xinfo->subject, xinfo->issuer, xinfo->flags, 923 OBJ_nid2ln(temp32), temp32, 924 ntohl(ep->fstamp)); 925 record_crypto_stats(&peer->srcadr, statstr); 926#ifdef DEBUG 927 if (debug) 928 printf("crypto_recv: %s\n", statstr); 929#endif 930 break; 931 932 /* 933 * Install leapseconds values. While the leapsecond 934 * values epoch, TAI offset and values expiration epoch 935 * are retained, only the current TAI offset is provided 936 * via the kernel to other applications. 937 */ 938 case CRYPTO_LEAP | CRYPTO_RESP: 939 940 /* 941 * Discard the message if invalid. We can't 942 * compare the value timestamps here, as they 943 * can be updated by different servers. 944 */ 945 if ((rval = crypto_verify(ep, NULL, peer)) != 946 XEVNT_OK) 947 break; 948 949 /* 950 * If the packet leap values are more recent 951 * than the stored ones, install the new leap 952 * values and recompute the signatures. 953 */ 954 if (ntohl(ep->pkt[2]) > leap_expire) { 955 char tbuf[80], str1 [20], str2[20]; 956 957 tai_leap.tstamp = ep->tstamp; 958 tai_leap.fstamp = ep->fstamp; 959 tai_leap.vallen = ep->vallen; 960 leap_tai = ntohl(ep->pkt[0]); 961 leap_sec = ntohl(ep->pkt[1]); 962 leap_expire = ntohl(ep->pkt[2]); 963 crypto_update(); 964 strcpy(str1, fstostr(leap_sec)); 965 strcpy(str2, fstostr(leap_expire)); 966 snprintf(tbuf, sizeof(tbuf), 967 "%d leap %s expire %s", leap_tai, str1, 968 str2); 969 report_event(EVNT_TAI, peer, tbuf); 970 } 971 peer->crypto |= CRYPTO_FLAG_LEAP; 972 peer->flash &= ~TEST8; 973 snprintf(statstr, NTP_MAXSTRLEN, 974 "leap TAI offset %d at %u expire %u fs %u", 975 ntohl(ep->pkt[0]), ntohl(ep->pkt[1]), 976 ntohl(ep->pkt[2]), ntohl(ep->fstamp)); 977 record_crypto_stats(&peer->srcadr, statstr); 978#ifdef DEBUG 979 if (debug) 980 printf("crypto_recv: %s\n", statstr); 981#endif 982 break; 983 984 /* 985 * We come here in symmetric modes for miscellaneous 986 * commands that have value fields but are processed on 987 * the transmit side. All we need do here is check for 988 * valid field length. Note that ASSOC is handled 989 * separately. 990 */ 991 case CRYPTO_CERT: 992 case CRYPTO_IFF: 993 case CRYPTO_GQ: 994 case CRYPTO_MV: 995 case CRYPTO_COOK: 996 case CRYPTO_SIGN: 997 if (len < VALUE_LEN) { 998 rval = XEVNT_LEN; 999 break; 1000 } 1001 /* fall through */ 1002 1003 /* 1004 * We come here in symmetric modes for requests 1005 * requiring a response (above plus AUTO and LEAP) and 1006 * for responses. If a request, save the extension field 1007 * for later; invalid requests will be caught on the 1008 * transmit side. If an error or invalid response, 1009 * declare a protocol error. 1010 */ 1011 default: 1012 if (code & (CRYPTO_RESP | CRYPTO_ERROR)) { 1013 rval = XEVNT_ERR; 1014 } else if (peer->cmmd == NULL) { 1015 fp = emalloc(len); 1016 memcpy(fp, ep, len); 1017 peer->cmmd = fp; 1018 } 1019 } 1020 1021 /* 1022 * The first error found terminates the extension field 1023 * scan and we return the laundry to the caller. 1024 */ 1025 if (rval != XEVNT_OK) { 1026 snprintf(statstr, NTP_MAXSTRLEN, 1027 "%04x %d %02x %s", htonl(ep->opcode), 1028 associd, rval, eventstr(rval)); 1029 record_crypto_stats(&peer->srcadr, statstr); 1030#ifdef DEBUG 1031 if (debug) 1032 printf("crypto_recv: %s\n", statstr); 1033#endif 1034 return (rval); 1035 } 1036 authlen += (len + 3) / 4 * 4; 1037 } 1038 return (rval); 1039} 1040 1041 1042/* 1043 * crypto_xmit - construct extension fields 1044 * 1045 * This routine is called both when an association is configured and 1046 * when one is not. The only case where this matters is to retrieve the 1047 * autokey information, in which case the caller has to provide the 1048 * association ID to match the association. 1049 * 1050 * Side effect: update the packet offset. 1051 * 1052 * Errors 1053 * XEVNT_OK success 1054 * XEVNT_CRT bad or missing certificate 1055 * XEVNT_ERR protocol error 1056 * XEVNT_LEN bad field format or length 1057 * XEVNT_PER host certificate expired 1058 */ 1059int 1060crypto_xmit( 1061 struct peer *peer, /* peer structure pointer */ 1062 struct pkt *xpkt, /* transmit packet pointer */ 1063 struct recvbuf *rbufp, /* receive buffer pointer */ 1064 int start, /* offset to extension field */ 1065 struct exten *ep, /* extension pointer */ 1066 keyid_t cookie /* session cookie */ 1067 ) 1068{ 1069 struct exten *fp; /* extension pointers */ 1070 struct cert_info *cp, *xp, *yp; /* cert info/value pointer */ 1071 sockaddr_u *srcadr_sin; /* source address */ 1072 u_int32 *pkt; /* packet pointer */ 1073 u_int opcode; /* extension field opcode */ 1074 char certname[MAXHOSTNAME + 1]; /* subject name buffer */ 1075 char statstr[NTP_MAXSTRLEN]; /* statistics for filegen */ 1076 tstamp_t tstamp; 1077 u_int vallen; 1078 struct value vtemp; 1079 associd_t associd; 1080 int rval; 1081 int len; 1082 keyid_t tcookie; 1083 1084 /* 1085 * Generate the requested extension field request code, length 1086 * and association ID. If this is a response and the host is not 1087 * synchronized, light the error bit and go home. 1088 */ 1089 pkt = (u_int32 *)xpkt + start / 4; 1090 fp = (struct exten *)pkt; 1091 opcode = ntohl(ep->opcode); 1092 if (peer != NULL) { 1093 srcadr_sin = &peer->srcadr; 1094 if (!(opcode & CRYPTO_RESP)) 1095 peer->opcode = ep->opcode; 1096 } else { 1097 srcadr_sin = &rbufp->recv_srcadr; 1098 } 1099 associd = (associd_t) ntohl(ep->associd); 1100 len = 8; 1101 fp->opcode = htonl((opcode & 0xffff0000) | len); 1102 fp->associd = ep->associd; 1103 rval = XEVNT_OK; 1104 tstamp = crypto_time(); 1105 switch (opcode & 0xffff0000) { 1106 1107 /* 1108 * Send association request and response with status word and 1109 * host name. Note, this message is not signed and the filestamp 1110 * contains only the status word. 1111 */ 1112 case CRYPTO_ASSOC: 1113 case CRYPTO_ASSOC | CRYPTO_RESP: 1114 len = crypto_send(fp, &hostval, start); 1115 fp->fstamp = htonl(crypto_flags); 1116 break; 1117 1118 /* 1119 * Send certificate request. Use the values from the extension 1120 * field. 1121 */ 1122 case CRYPTO_CERT: 1123 memset(&vtemp, 0, sizeof(vtemp)); 1124 vtemp.tstamp = ep->tstamp; 1125 vtemp.fstamp = ep->fstamp; 1126 vtemp.vallen = ep->vallen; 1127 vtemp.ptr = (u_char *)ep->pkt; 1128 len = crypto_send(fp, &vtemp, start); 1129 break; 1130 1131 /* 1132 * Send sign request. Use the host certificate, which is self- 1133 * signed and may or may not be trusted. 1134 */ 1135 case CRYPTO_SIGN: 1136 if (tstamp < cert_host->first || tstamp > 1137 cert_host->last) 1138 rval = XEVNT_PER; 1139 else 1140 len = crypto_send(fp, &cert_host->cert, start); 1141 break; 1142 1143 /* 1144 * Send certificate response. Use the name in the extension 1145 * field to find the certificate in the cache. If the request 1146 * contains no subject name, assume the name of this host. This 1147 * is for backwards compatibility. Private certificates are 1148 * never sent. 1149 * 1150 * There may be several certificates matching the request. First 1151 * choice is a self-signed trusted certificate; second choice is 1152 * any certificate signed by another host. There is no third 1153 * choice. 1154 */ 1155 case CRYPTO_CERT | CRYPTO_RESP: 1156 vallen = ntohl(ep->vallen); 1157 if (vallen == 0 || vallen > MAXHOSTNAME) { 1158 rval = XEVNT_LEN; 1159 break; 1160 1161 } else { 1162 memcpy(certname, ep->pkt, vallen); 1163 certname[vallen] = '\0'; 1164 } 1165 1166 /* 1167 * Find all public valid certificates with matching 1168 * subject. If a self-signed, trusted certificate is 1169 * found, use that certificate. If not, use the last non 1170 * self-signed certificate. 1171 */ 1172 xp = yp = NULL; 1173 for (cp = cinfo; cp != NULL; cp = cp->link) { 1174 if (cp->flags & (CERT_PRIV | CERT_ERROR)) 1175 continue; 1176 1177 if (strcmp(certname, cp->subject) != 0) 1178 continue; 1179 1180 if (strcmp(certname, cp->issuer) != 0) 1181 yp = cp; 1182 else if (cp ->flags & CERT_TRUST) 1183 xp = cp; 1184 continue; 1185 } 1186 1187 /* 1188 * Be careful who you trust. If the certificate is not 1189 * found, return an empty response. Note that we dont 1190 * enforce lifetimes here. 1191 * 1192 * The timestamp and filestamp are taken from the 1193 * certificate value structure. For all certificates the 1194 * timestamp is the latest signature update time. For 1195 * host and imported certificates the filestamp is the 1196 * creation epoch. For signed certificates the filestamp 1197 * is the creation epoch of the trusted certificate at 1198 * the root of the certificate trail. In principle, this 1199 * allows strong checking for signature masquerade. 1200 */ 1201 if (xp == NULL) 1202 xp = yp; 1203 if (xp == NULL) 1204 break; 1205 1206 if (tstamp == 0) 1207 break; 1208 1209 len = crypto_send(fp, &xp->cert, start); 1210 break; 1211 1212 /* 1213 * Send challenge in Schnorr (IFF) identity scheme. 1214 */ 1215 case CRYPTO_IFF: 1216 if (peer == NULL) 1217 break; /* hack attack */ 1218 1219 if ((rval = crypto_alice(peer, &vtemp)) == XEVNT_OK) { 1220 len = crypto_send(fp, &vtemp, start); 1221 value_free(&vtemp); 1222 } 1223 break; 1224 1225 /* 1226 * Send response in Schnorr (IFF) identity scheme. 1227 */ 1228 case CRYPTO_IFF | CRYPTO_RESP: 1229 if ((rval = crypto_bob(ep, &vtemp)) == XEVNT_OK) { 1230 len = crypto_send(fp, &vtemp, start); 1231 value_free(&vtemp); 1232 } 1233 break; 1234 1235 /* 1236 * Send challenge in Guillou-Quisquater (GQ) identity scheme. 1237 */ 1238 case CRYPTO_GQ: 1239 if (peer == NULL) 1240 break; /* hack attack */ 1241 1242 if ((rval = crypto_alice2(peer, &vtemp)) == XEVNT_OK) { 1243 len = crypto_send(fp, &vtemp, start); 1244 value_free(&vtemp); 1245 } 1246 break; 1247 1248 /* 1249 * Send response in Guillou-Quisquater (GQ) identity scheme. 1250 */ 1251 case CRYPTO_GQ | CRYPTO_RESP: 1252 if ((rval = crypto_bob2(ep, &vtemp)) == XEVNT_OK) { 1253 len = crypto_send(fp, &vtemp, start); 1254 value_free(&vtemp); 1255 } 1256 break; 1257 1258 /* 1259 * Send challenge in MV identity scheme. 1260 */ 1261 case CRYPTO_MV: 1262 if (peer == NULL) 1263 break; /* hack attack */ 1264 1265 if ((rval = crypto_alice3(peer, &vtemp)) == XEVNT_OK) { 1266 len = crypto_send(fp, &vtemp, start); 1267 value_free(&vtemp); 1268 } 1269 break; 1270 1271 /* 1272 * Send response in MV identity scheme. 1273 */ 1274 case CRYPTO_MV | CRYPTO_RESP: 1275 if ((rval = crypto_bob3(ep, &vtemp)) == XEVNT_OK) { 1276 len = crypto_send(fp, &vtemp, start); 1277 value_free(&vtemp); 1278 } 1279 break; 1280 1281 /* 1282 * Send certificate sign response. The integrity of the request 1283 * certificate has already been verified on the receive side. 1284 * Sign the response using the local server key. Use the 1285 * filestamp from the request and use the timestamp as the 1286 * current time. Light the error bit if the certificate is 1287 * invalid or contains an unverified signature. 1288 */ 1289 case CRYPTO_SIGN | CRYPTO_RESP: 1290 if ((rval = cert_sign(ep, &vtemp)) == XEVNT_OK) { 1291 len = crypto_send(fp, &vtemp, start); 1292 value_free(&vtemp); 1293 } 1294 break; 1295 1296 /* 1297 * Send public key and signature. Use the values from the public 1298 * key. 1299 */ 1300 case CRYPTO_COOK: 1301 len = crypto_send(fp, &pubkey, start); 1302 break; 1303 1304 /* 1305 * Encrypt and send cookie and signature. Light the error bit if 1306 * anything goes wrong. 1307 */ 1308 case CRYPTO_COOK | CRYPTO_RESP: 1309 if ((opcode & 0xffff) < VALUE_LEN) { 1310 rval = XEVNT_LEN; 1311 break; 1312 } 1313 if (peer == NULL) 1314 tcookie = cookie; 1315 else 1316 tcookie = peer->hcookie; 1317 if ((rval = crypto_encrypt(ep, &vtemp, &tcookie)) == 1318 XEVNT_OK) { 1319 len = crypto_send(fp, &vtemp, start); 1320 value_free(&vtemp); 1321 } 1322 break; 1323 1324 /* 1325 * Find peer and send autokey data and signature in broadcast 1326 * server and symmetric modes. Use the values in the autokey 1327 * structure. If no association is found, either the server has 1328 * restarted with new associations or some perp has replayed an 1329 * old message, in which case light the error bit. 1330 */ 1331 case CRYPTO_AUTO | CRYPTO_RESP: 1332 if (peer == NULL) { 1333 if ((peer = findpeerbyassoc(associd)) == NULL) { 1334 rval = XEVNT_ERR; 1335 break; 1336 } 1337 } 1338 peer->flags &= ~FLAG_ASSOC; 1339 len = crypto_send(fp, &peer->sndval, start); 1340 break; 1341 1342 /* 1343 * Send leapseconds values and signature. Use the values from 1344 * the tai structure. If no table has been loaded, just send an 1345 * empty request. 1346 */ 1347 case CRYPTO_LEAP | CRYPTO_RESP: 1348 len = crypto_send(fp, &tai_leap, start); 1349 break; 1350 1351 /* 1352 * Default - Send a valid command for unknown requests; send 1353 * an error response for unknown resonses. 1354 */ 1355 default: 1356 if (opcode & CRYPTO_RESP) 1357 rval = XEVNT_ERR; 1358 } 1359 1360 /* 1361 * In case of error, flame the log. If a request, toss the 1362 * puppy; if a response, return so the sender can flame, too. 1363 */ 1364 if (rval != XEVNT_OK) { 1365 u_int32 uint32; 1366 1367 uint32 = CRYPTO_ERROR; 1368 opcode |= uint32; 1369 fp->opcode |= htonl(uint32); 1370 snprintf(statstr, NTP_MAXSTRLEN, 1371 "%04x %d %02x %s", opcode, associd, rval, 1372 eventstr(rval)); 1373 record_crypto_stats(srcadr_sin, statstr); 1374#ifdef DEBUG 1375 if (debug) 1376 printf("crypto_xmit: %s\n", statstr); 1377#endif 1378 if (!(opcode & CRYPTO_RESP)) 1379 return (0); 1380 } 1381#ifdef DEBUG 1382 if (debug) 1383 printf( 1384 "crypto_xmit: flags 0x%x offset %d len %d code 0x%x associd %d\n", 1385 crypto_flags, start, len, opcode >> 16, associd); 1386#endif 1387 return (len); 1388} 1389 1390 1391/* 1392 * crypto_verify - verify the extension field value and signature 1393 * 1394 * Returns 1395 * XEVNT_OK success 1396 * XEVNT_ERR protocol error 1397 * XEVNT_FSP bad filestamp 1398 * XEVNT_LEN bad field format or length 1399 * XEVNT_PUB bad or missing public key 1400 * XEVNT_SGL bad signature length 1401 * XEVNT_SIG signature not verified 1402 * XEVNT_TSP bad timestamp 1403 */ 1404static int 1405crypto_verify( 1406 struct exten *ep, /* extension pointer */ 1407 struct value *vp, /* value pointer */ 1408 struct peer *peer /* peer structure pointer */ 1409 ) 1410{ 1411 EVP_PKEY *pkey; /* server public key */ 1412 EVP_MD_CTX ctx; /* signature context */ 1413 tstamp_t tstamp, tstamp1 = 0; /* timestamp */ 1414 tstamp_t fstamp, fstamp1 = 0; /* filestamp */ 1415 u_int vallen; /* value length */ 1416 u_int siglen; /* signature length */ 1417 u_int opcode, len; 1418 int i; 1419 1420 /* 1421 * We are extremely parannoyed. We require valid opcode, length, 1422 * association ID, timestamp, filestamp, public key, digest, 1423 * signature length and signature, where relevant. Note that 1424 * preliminary length checks are done in the main loop. 1425 */ 1426 len = ntohl(ep->opcode) & 0x0000ffff; 1427 opcode = ntohl(ep->opcode) & 0xffff0000; 1428 1429 /* 1430 * Check for valid value header, association ID and extension 1431 * field length. Remember, it is not an error to receive an 1432 * unsolicited response; however, the response ID must match 1433 * the association ID. 1434 */ 1435 if (opcode & CRYPTO_ERROR) 1436 return (XEVNT_ERR); 1437 1438 if (len < VALUE_LEN) 1439 return (XEVNT_LEN); 1440 1441 if (opcode == (CRYPTO_AUTO | CRYPTO_RESP) && (peer->pmode == 1442 MODE_BROADCAST || (peer->cast_flags & MDF_BCLNT))) { 1443 if (ntohl(ep->associd) != peer->assoc) 1444 return (XEVNT_ERR); 1445 } else { 1446 if (ntohl(ep->associd) != peer->associd) 1447 return (XEVNT_ERR); 1448 } 1449 1450 /* 1451 * We have a valid value header. Check for valid value and 1452 * signature field lengths. The extension field length must be 1453 * long enough to contain the value header, value and signature. 1454 * Note both the value and signature field lengths are rounded 1455 * up to the next word (4 octets). 1456 */ 1457 vallen = ntohl(ep->vallen); 1458 if (vallen == 0) 1459 return (XEVNT_LEN); 1460 1461 i = (vallen + 3) / 4; 1462 siglen = ntohl(ep->pkt[i++]); 1463 if (len < VALUE_LEN + ((vallen + 3) / 4) * 4 + ((siglen + 3) / 1464 4) * 4) 1465 return (XEVNT_LEN); 1466 1467 /* 1468 * Check for valid timestamp and filestamp. If the timestamp is 1469 * zero, the sender is not synchronized and signatures are 1470 * not possible. If nonzero the timestamp must not precede the 1471 * filestamp. The timestamp and filestamp must not precede the 1472 * corresponding values in the value structure, if present. 1473 */ 1474 tstamp = ntohl(ep->tstamp); 1475 fstamp = ntohl(ep->fstamp); 1476 if (tstamp == 0) 1477 return (XEVNT_TSP); 1478 1479 if (tstamp < fstamp) 1480 return (XEVNT_TSP); 1481 1482 if (vp != NULL) { 1483 tstamp1 = ntohl(vp->tstamp); 1484 fstamp1 = ntohl(vp->fstamp); 1485 if (tstamp1 != 0 && fstamp1 != 0) { 1486 if (tstamp < tstamp1) 1487 return (XEVNT_TSP); 1488 1489 if ((tstamp < fstamp1 || fstamp < fstamp1)) 1490 return (XEVNT_FSP); 1491 } 1492 } 1493 1494 /* 1495 * At the time the certificate message is validated, the public 1496 * key in the message is not available. Thus, don't try to 1497 * verify the signature. 1498 */ 1499 if (opcode == (CRYPTO_CERT | CRYPTO_RESP)) 1500 return (XEVNT_OK); 1501 1502 /* 1503 * Check for valid signature length, public key and digest 1504 * algorithm. 1505 */ 1506 if (crypto_flags & peer->crypto & CRYPTO_FLAG_PRIV) 1507 pkey = sign_pkey; 1508 else 1509 pkey = peer->pkey; 1510 if (siglen == 0 || pkey == NULL || peer->digest == NULL) 1511 return (XEVNT_ERR); 1512 1513 if (siglen != (u_int)EVP_PKEY_size(pkey)) 1514 return (XEVNT_SGL); 1515 1516 /* 1517 * Darn, I thought we would never get here. Verify the 1518 * signature. If the identity exchange is verified, light the 1519 * proventic bit. What a relief. 1520 */ 1521 EVP_VerifyInit(&ctx, peer->digest); 1522 EVP_VerifyUpdate(&ctx, (u_char *)&ep->tstamp, vallen + 12); 1523 if (EVP_VerifyFinal(&ctx, (u_char *)&ep->pkt[i], siglen, 1524 pkey) <= 0) 1525 return (XEVNT_SIG); 1526 1527 if (peer->crypto & CRYPTO_FLAG_VRFY) 1528 peer->crypto |= CRYPTO_FLAG_PROV; 1529 return (XEVNT_OK); 1530} 1531 1532 1533/* 1534 * crypto_encrypt - construct encrypted cookie and signature from 1535 * extension field and cookie 1536 * 1537 * Returns 1538 * XEVNT_OK success 1539 * XEVNT_CKY bad or missing cookie 1540 * XEVNT_PUB bad or missing public key 1541 */ 1542static int 1543crypto_encrypt( 1544 struct exten *ep, /* extension pointer */ 1545 struct value *vp, /* value pointer */ 1546 keyid_t *cookie /* server cookie */ 1547 ) 1548{ 1549 EVP_PKEY *pkey; /* public key */ 1550 EVP_MD_CTX ctx; /* signature context */ 1551 tstamp_t tstamp; /* NTP timestamp */ 1552 u_int32 temp32; 1553 u_int len; 1554 u_char *ptr; 1555 1556 /* 1557 * Extract the public key from the request. 1558 */ 1559 len = ntohl(ep->vallen); 1560 ptr = (u_char *)ep->pkt; 1561 pkey = d2i_PublicKey(EVP_PKEY_RSA, NULL, &ptr, len); 1562 if (pkey == NULL) { 1563 msyslog(LOG_ERR, "crypto_encrypt: %s", 1564 ERR_error_string(ERR_get_error(), NULL)); 1565 return (XEVNT_PUB); 1566 } 1567 1568 /* 1569 * Encrypt the cookie, encode in ASN.1 and sign. 1570 */ 1571 memset(vp, 0, sizeof(struct value)); 1572 tstamp = crypto_time(); 1573 vp->tstamp = htonl(tstamp); 1574 vp->fstamp = hostval.tstamp; 1575 len = EVP_PKEY_size(pkey); 1576 vp->vallen = htonl(len); 1577 vp->ptr = emalloc(len); 1578 ptr = vp->ptr; 1579 temp32 = htonl(*cookie); 1580 if (RSA_public_encrypt(4, (u_char *)&temp32, ptr, 1581 pkey->pkey.rsa, RSA_PKCS1_OAEP_PADDING) <= 0) { 1582 msyslog(LOG_ERR, "crypto_encrypt: %s", 1583 ERR_error_string(ERR_get_error(), NULL)); 1584 free(vp->ptr); 1585 EVP_PKEY_free(pkey); 1586 return (XEVNT_CKY); 1587 } 1588 EVP_PKEY_free(pkey); 1589 if (tstamp == 0) 1590 return (XEVNT_OK); 1591 1592 vp->sig = emalloc(sign_siglen); 1593 EVP_SignInit(&ctx, sign_digest); 1594 EVP_SignUpdate(&ctx, (u_char *)&vp->tstamp, 12); 1595 EVP_SignUpdate(&ctx, vp->ptr, len); 1596 if (EVP_SignFinal(&ctx, vp->sig, &len, sign_pkey)) 1597 vp->siglen = htonl(sign_siglen); 1598 return (XEVNT_OK); 1599} 1600 1601 1602/* 1603 * crypto_ident - construct extension field for identity scheme 1604 * 1605 * This routine determines which identity scheme is in use and 1606 * constructs an extension field for that scheme. 1607 * 1608 * Returns 1609 * CRYTPO_IFF IFF scheme 1610 * CRYPTO_GQ GQ scheme 1611 * CRYPTO_MV MV scheme 1612 * CRYPTO_NULL no available scheme 1613 */ 1614u_int 1615crypto_ident( 1616 struct peer *peer /* peer structure pointer */ 1617 ) 1618{ 1619 char filename[MAXFILENAME]; 1620 1621 /* 1622 * We come here after the group trusted host has been found; its 1623 * name defines the group name. Search the key cache for all 1624 * keys matching the same group name in order IFF, GQ and MV. 1625 * Use the first one available. 1626 */ 1627 if (peer->crypto & CRYPTO_FLAG_IFF) { 1628 snprintf(filename, MAXFILENAME, "ntpkey_iffpar_%s", 1629 peer->issuer); 1630 peer->ident_pkey = crypto_key(filename, NULL, 1631 &peer->srcadr); 1632 if (peer->ident_pkey != NULL) 1633 return (CRYPTO_IFF); 1634 } 1635 if (peer->crypto & CRYPTO_FLAG_GQ) { 1636 snprintf(filename, MAXFILENAME, "ntpkey_gqpar_%s", 1637 peer->issuer); 1638 peer->ident_pkey = crypto_key(filename, NULL, 1639 &peer->srcadr); 1640 if (peer->ident_pkey != NULL) 1641 return (CRYPTO_GQ); 1642 } 1643 if (peer->crypto & CRYPTO_FLAG_MV) { 1644 snprintf(filename, MAXFILENAME, "ntpkey_mvpar_%s", 1645 peer->issuer); 1646 peer->ident_pkey = crypto_key(filename, NULL, 1647 &peer->srcadr); 1648 if (peer->ident_pkey != NULL) 1649 return (CRYPTO_MV); 1650 } 1651 msyslog(LOG_NOTICE, 1652 "crypto_ident: no identity parameters found for group %s", 1653 peer->issuer); 1654 return (CRYPTO_NULL); 1655} 1656 1657 1658/* 1659 * crypto_args - construct extension field from arguments 1660 * 1661 * This routine creates an extension field with current timestamps and 1662 * specified opcode, association ID and optional string. Note that the 1663 * extension field is created here, but freed after the crypto_xmit() 1664 * call in the protocol module. 1665 * 1666 * Returns extension field pointer (no errors) 1667 */ 1668struct exten * 1669crypto_args( 1670 struct peer *peer, /* peer structure pointer */ 1671 u_int opcode, /* operation code */ 1672 associd_t associd, /* association ID */ 1673 char *str /* argument string */ 1674 ) 1675{ 1676 tstamp_t tstamp; /* NTP timestamp */ 1677 struct exten *ep; /* extension field pointer */ 1678 u_int len; /* extension field length */ 1679 1680 tstamp = crypto_time(); 1681 len = sizeof(struct exten); 1682 if (str != NULL) 1683 len += strlen(str); 1684 ep = emalloc(len); 1685 memset(ep, 0, len); 1686 if (opcode == 0) 1687 return (ep); 1688 1689 ep->opcode = htonl(opcode + len); 1690 ep->associd = htonl(associd); 1691 ep->tstamp = htonl(tstamp); 1692 ep->fstamp = hostval.tstamp; 1693 ep->vallen = 0; 1694 if (str != NULL) { 1695 ep->vallen = htonl(strlen(str)); 1696 memcpy((char *)ep->pkt, str, strlen(str)); 1697 } 1698 return (ep); 1699} 1700 1701 1702/* 1703 * crypto_send - construct extension field from value components 1704 * 1705 * The value and signature fields are zero-padded to a word boundary. 1706 * Note: it is not polite to send a nonempty signature with zero 1707 * timestamp or a nonzero timestamp with an empty signature, but those 1708 * rules are not enforced here. 1709 */ 1710int 1711crypto_send( 1712 struct exten *ep, /* extension field pointer */ 1713 struct value *vp, /* value pointer */ 1714 int start /* buffer offset */ 1715 ) 1716{ 1717 u_int len, vallen, siglen, opcode; 1718 int i, j; 1719 1720 /* 1721 * Calculate extension field length and check for buffer 1722 * overflow. Leave room for the MAC. 1723 */ 1724 len = 16; 1725 vallen = ntohl(vp->vallen); 1726 len += ((vallen + 3) / 4 + 1) * 4; 1727 siglen = ntohl(vp->siglen); 1728 len += ((siglen + 3) / 4 + 1) * 4; 1729 if (start + len > sizeof(struct pkt) - MAX_MAC_LEN) 1730 return (0); 1731 1732 /* 1733 * Copy timestamps. 1734 */ 1735 ep->tstamp = vp->tstamp; 1736 ep->fstamp = vp->fstamp; 1737 ep->vallen = vp->vallen; 1738 1739 /* 1740 * Copy value. If the data field is empty or zero length, 1741 * encode an empty value with length zero. 1742 */ 1743 i = 0; 1744 if (vallen > 0 && vp->ptr != NULL) { 1745 j = vallen / 4; 1746 if (j * 4 < vallen) 1747 ep->pkt[i + j++] = 0; 1748 memcpy(&ep->pkt[i], vp->ptr, vallen); 1749 i += j; 1750 } 1751 1752 /* 1753 * Copy signature. If the signature field is empty or zero 1754 * length, encode an empty signature with length zero. 1755 */ 1756 ep->pkt[i++] = vp->siglen; 1757 if (siglen > 0 && vp->sig != NULL) { 1758 j = vallen / 4; 1759 if (j * 4 < siglen) 1760 ep->pkt[i + j++] = 0; 1761 memcpy(&ep->pkt[i], vp->sig, siglen); 1762 i += j; 1763 } 1764 opcode = ntohl(ep->opcode); 1765 ep->opcode = htonl((opcode & 0xffff0000) | len); 1766 return (len); 1767} 1768 1769 1770/* 1771 * crypto_update - compute new public value and sign extension fields 1772 * 1773 * This routine runs periodically, like once a day, and when something 1774 * changes. It updates the timestamps on three value structures and one 1775 * value structure list, then signs all the structures: 1776 * 1777 * hostval host name (not signed) 1778 * pubkey public key 1779 * cinfo certificate info/value list 1780 * tai_leap leap values 1781 * 1782 * Filestamps are proventic data, so this routine runs only when the 1783 * host is synchronized to a proventicated source. Thus, the timestamp 1784 * is proventic and can be used to deflect clogging attacks. 1785 * 1786 * Returns void (no errors) 1787 */ 1788void 1789crypto_update(void) 1790{ 1791 EVP_MD_CTX ctx; /* message digest context */ 1792 struct cert_info *cp; /* certificate info/value */ 1793 char statstr[NTP_MAXSTRLEN]; /* statistics for filegen */ 1794 u_int32 *ptr; 1795 u_int len; 1796 1797 hostval.tstamp = htonl(crypto_time()); 1798 if (hostval.tstamp == 0) 1799 return; 1800 1801 1802 /* 1803 * Sign public key and timestamps. The filestamp is derived from 1804 * the host key file extension from wherever the file was 1805 * generated. 1806 */ 1807 if (pubkey.vallen != 0) { 1808 pubkey.tstamp = hostval.tstamp; 1809 pubkey.siglen = 0; 1810 if (pubkey.sig == NULL) 1811 pubkey.sig = emalloc(sign_siglen); 1812 EVP_SignInit(&ctx, sign_digest); 1813 EVP_SignUpdate(&ctx, (u_char *)&pubkey, 12); 1814 EVP_SignUpdate(&ctx, pubkey.ptr, ntohl(pubkey.vallen)); 1815 if (EVP_SignFinal(&ctx, pubkey.sig, &len, sign_pkey)) 1816 pubkey.siglen = htonl(sign_siglen); 1817 } 1818 1819 /* 1820 * Sign certificates and timestamps. The filestamp is derived 1821 * from the certificate file extension from wherever the file 1822 * was generated. Note we do not throw expired certificates 1823 * away; they may have signed younger ones. 1824 */ 1825 for (cp = cinfo; cp != NULL; cp = cp->link) { 1826 cp->cert.tstamp = hostval.tstamp; 1827 cp->cert.siglen = 0; 1828 if (cp->cert.sig == NULL) 1829 cp->cert.sig = emalloc(sign_siglen); 1830 EVP_SignInit(&ctx, sign_digest); 1831 EVP_SignUpdate(&ctx, (u_char *)&cp->cert, 12); 1832 EVP_SignUpdate(&ctx, cp->cert.ptr, 1833 ntohl(cp->cert.vallen)); 1834 if (EVP_SignFinal(&ctx, cp->cert.sig, &len, sign_pkey)) 1835 cp->cert.siglen = htonl(sign_siglen); 1836 } 1837 1838 /* 1839 * Sign leapseconds values and timestamps. Note it is not an 1840 * error to return null values. 1841 */ 1842 tai_leap.tstamp = hostval.tstamp; 1843 tai_leap.fstamp = hostval.fstamp; 1844 len = 3 * sizeof(u_int32); 1845 if (tai_leap.ptr == NULL) 1846 tai_leap.ptr = emalloc(len); 1847 tai_leap.vallen = htonl(len); 1848 ptr = (u_int32 *)tai_leap.ptr; 1849 ptr[0] = htonl(leap_tai); 1850 ptr[1] = htonl(leap_sec); 1851 ptr[2] = htonl(leap_expire); 1852 if (tai_leap.sig == NULL) 1853 tai_leap.sig = emalloc(sign_siglen); 1854 EVP_SignInit(&ctx, sign_digest); 1855 EVP_SignUpdate(&ctx, (u_char *)&tai_leap, 12); 1856 EVP_SignUpdate(&ctx, tai_leap.ptr, len); 1857 if (EVP_SignFinal(&ctx, tai_leap.sig, &len, sign_pkey)) 1858 tai_leap.siglen = htonl(sign_siglen); 1859 if (leap_sec > 0) 1860 crypto_flags |= CRYPTO_FLAG_TAI; 1861 snprintf(statstr, NTP_MAXSTRLEN, "signature update ts %u", 1862 ntohl(hostval.tstamp)); 1863 record_crypto_stats(NULL, statstr); 1864#ifdef DEBUG 1865 if (debug) 1866 printf("crypto_update: %s\n", statstr); 1867#endif 1868} 1869 1870 1871/* 1872 * value_free - free value structure components. 1873 * 1874 * Returns void (no errors) 1875 */ 1876void 1877value_free( 1878 struct value *vp /* value structure */ 1879 ) 1880{ 1881 if (vp->ptr != NULL) 1882 free(vp->ptr); 1883 if (vp->sig != NULL) 1884 free(vp->sig); 1885 memset(vp, 0, sizeof(struct value)); 1886} 1887 1888 1889/* 1890 * crypto_time - returns current NTP time. 1891 * 1892 * Returns NTP seconds if in synch, 0 otherwise 1893 */ 1894tstamp_t 1895crypto_time() 1896{ 1897 l_fp tstamp; /* NTP time */ 1898 1899 L_CLR(&tstamp); 1900 if (sys_leap != LEAP_NOTINSYNC) 1901 get_systime(&tstamp); 1902 return (tstamp.l_ui); 1903} 1904 1905 1906/* 1907 * asn2ntp - convert ASN1_TIME time structure to NTP time. 1908 * 1909 * Returns NTP seconds (no errors) 1910 */ 1911u_long 1912asn2ntp ( 1913 ASN1_TIME *asn1time /* pointer to ASN1_TIME structure */ 1914 ) 1915{ 1916 char *v; /* pointer to ASN1_TIME string */ 1917 struct tm tm; /* used to convert to NTP time */ 1918 1919 /* 1920 * Extract time string YYMMDDHHMMSSZ from ASN1 time structure. 1921 * Note that the YY, MM, DD fields start with one, the HH, MM, 1922 * SS fiels start with zero and the Z character is ignored. 1923 * Also note that years less than 50 map to years greater than 1924 * 100. Dontcha love ASN.1? Better than MIL-188. 1925 */ 1926 v = (char *)asn1time->data; 1927 tm.tm_year = (v[0] - '0') * 10 + v[1] - '0'; 1928 if (tm.tm_year < 50) 1929 tm.tm_year += 100; 1930 tm.tm_mon = (v[2] - '0') * 10 + v[3] - '0' - 1; 1931 tm.tm_mday = (v[4] - '0') * 10 + v[5] - '0'; 1932 tm.tm_hour = (v[6] - '0') * 10 + v[7] - '0'; 1933 tm.tm_min = (v[8] - '0') * 10 + v[9] - '0'; 1934 tm.tm_sec = (v[10] - '0') * 10 + v[11] - '0'; 1935 tm.tm_wday = 0; 1936 tm.tm_yday = 0; 1937 tm.tm_isdst = 0; 1938 return ((u_long)timegm(&tm) + JAN_1970); 1939} 1940 1941 1942/* 1943 * bigdig() - compute a BIGNUM MD5 hash of a BIGNUM number. 1944 * 1945 * Returns void (no errors) 1946 */ 1947static void 1948bighash( 1949 BIGNUM *bn, /* BIGNUM * from */ 1950 BIGNUM *bk /* BIGNUM * to */ 1951 ) 1952{ 1953 EVP_MD_CTX ctx; /* message digest context */ 1954 u_char dgst[EVP_MAX_MD_SIZE]; /* message digest */ 1955 u_char *ptr; /* a BIGNUM as binary string */ 1956 u_int len; 1957 1958 len = BN_num_bytes(bn); 1959 ptr = emalloc(len); 1960 BN_bn2bin(bn, ptr); 1961 EVP_DigestInit(&ctx, EVP_md5()); 1962 EVP_DigestUpdate(&ctx, ptr, len); 1963 EVP_DigestFinal(&ctx, dgst, &len); 1964 BN_bin2bn(dgst, len, bk); 1965 free(ptr); 1966} 1967 1968 1969/* 1970 *********************************************************************** 1971 * * 1972 * The following routines implement the Schnorr (IFF) identity scheme * 1973 * * 1974 *********************************************************************** 1975 * 1976 * The Schnorr (IFF) identity scheme is intended for use when 1977 * certificates are generated by some other trusted certificate 1978 * authority and the certificate cannot be used to convey public 1979 * parameters. There are two kinds of files: encrypted server files that 1980 * contain private and public values and nonencrypted client files that 1981 * contain only public values. New generations of server files must be 1982 * securely transmitted to all servers of the group; client files can be 1983 * distributed by any means. The scheme is self contained and 1984 * independent of new generations of host keys, sign keys and 1985 * certificates. 1986 * 1987 * The IFF values hide in a DSA cuckoo structure which uses the same 1988 * parameters. The values are used by an identity scheme based on DSA 1989 * cryptography and described in Stimson p. 285. The p is a 512-bit 1990 * prime, g a generator of Zp* and q a 160-bit prime that divides p - 1 1991 * and is a qth root of 1 mod p; that is, g^q = 1 mod p. The TA rolls a 1992 * private random group key b (0 < b < q) and public key v = g^b, then 1993 * sends (p, q, g, b) to the servers and (p, q, g, v) to the clients. 1994 * Alice challenges Bob to confirm identity using the protocol described 1995 * below. 1996 * 1997 * How it works 1998 * 1999 * The scheme goes like this. Both Alice and Bob have the public primes 2000 * p, q and generator g. The TA gives private key b to Bob and public 2001 * key v to Alice. 2002 * 2003 * Alice rolls new random challenge r (o < r < q) and sends to Bob in 2004 * the IFF request message. Bob rolls new random k (0 < k < q), then 2005 * computes y = k + b r mod q and x = g^k mod p and sends (y, hash(x)) 2006 * to Alice in the response message. Besides making the response 2007 * shorter, the hash makes it effectivey impossible for an intruder to 2008 * solve for b by observing a number of these messages. 2009 * 2010 * Alice receives the response and computes g^y v^r mod p. After a bit 2011 * of algebra, this simplifies to g^k. If the hash of this result 2012 * matches hash(x), Alice knows that Bob has the group key b. The signed 2013 * response binds this knowledge to Bob's private key and the public key 2014 * previously received in his certificate. 2015 * 2016 * crypto_alice - construct Alice's challenge in IFF scheme 2017 * 2018 * Returns 2019 * XEVNT_OK success 2020 * XEVNT_ID bad or missing group key 2021 * XEVNT_PUB bad or missing public key 2022 */ 2023static int 2024crypto_alice( 2025 struct peer *peer, /* peer pointer */ 2026 struct value *vp /* value pointer */ 2027 ) 2028{ 2029 DSA *dsa; /* IFF parameters */ 2030 BN_CTX *bctx; /* BIGNUM context */ 2031 EVP_MD_CTX ctx; /* signature context */ 2032 tstamp_t tstamp; 2033 u_int len; 2034 2035 /* 2036 * The identity parameters must have correct format and content. 2037 */ 2038 if (peer->ident_pkey == NULL) 2039 return (XEVNT_ID); 2040 2041 if ((dsa = peer->ident_pkey->pkey->pkey.dsa) == NULL) { 2042 msyslog(LOG_NOTICE, "crypto_alice: defective key"); 2043 return (XEVNT_PUB); 2044 } 2045 2046 /* 2047 * Roll new random r (0 < r < q). 2048 */ 2049 if (peer->iffval != NULL) 2050 BN_free(peer->iffval); 2051 peer->iffval = BN_new(); 2052 len = BN_num_bytes(dsa->q); 2053 BN_rand(peer->iffval, len * 8, -1, 1); /* r mod q*/ 2054 bctx = BN_CTX_new(); 2055 BN_mod(peer->iffval, peer->iffval, dsa->q, bctx); 2056 BN_CTX_free(bctx); 2057 2058 /* 2059 * Sign and send to Bob. The filestamp is from the local file. 2060 */ 2061 memset(vp, 0, sizeof(struct value)); 2062 tstamp = crypto_time(); 2063 vp->tstamp = htonl(tstamp); 2064 vp->fstamp = htonl(peer->ident_pkey->fstamp); 2065 vp->vallen = htonl(len); 2066 vp->ptr = emalloc(len); 2067 BN_bn2bin(peer->iffval, vp->ptr); 2068 if (tstamp == 0) 2069 return (XEVNT_OK); 2070 2071 vp->sig = emalloc(sign_siglen); 2072 EVP_SignInit(&ctx, sign_digest); 2073 EVP_SignUpdate(&ctx, (u_char *)&vp->tstamp, 12); 2074 EVP_SignUpdate(&ctx, vp->ptr, len); 2075 if (EVP_SignFinal(&ctx, vp->sig, &len, sign_pkey)) 2076 vp->siglen = htonl(sign_siglen); 2077 return (XEVNT_OK); 2078} 2079 2080 2081/* 2082 * crypto_bob - construct Bob's response to Alice's challenge 2083 * 2084 * Returns 2085 * XEVNT_OK success 2086 * XEVNT_ERR protocol error 2087 * XEVNT_ID bad or missing group key 2088 */ 2089static int 2090crypto_bob( 2091 struct exten *ep, /* extension pointer */ 2092 struct value *vp /* value pointer */ 2093 ) 2094{ 2095 DSA *dsa; /* IFF parameters */ 2096 DSA_SIG *sdsa; /* DSA signature context fake */ 2097 BN_CTX *bctx; /* BIGNUM context */ 2098 EVP_MD_CTX ctx; /* signature context */ 2099 tstamp_t tstamp; /* NTP timestamp */ 2100 BIGNUM *bn, *bk, *r; 2101 u_char *ptr; 2102 u_int len; 2103 2104 /* 2105 * If the IFF parameters are not valid, something awful 2106 * happened or we are being tormented. 2107 */ 2108 if (iffkey_info == NULL) { 2109 msyslog(LOG_NOTICE, "crypto_bob: scheme unavailable"); 2110 return (XEVNT_ID); 2111 } 2112 dsa = iffkey_info->pkey->pkey.dsa; 2113 2114 /* 2115 * Extract r from the challenge. 2116 */ 2117 len = ntohl(ep->vallen); 2118 if ((r = BN_bin2bn((u_char *)ep->pkt, len, NULL)) == NULL) { 2119 msyslog(LOG_ERR, "crypto_bob: %s", 2120 ERR_error_string(ERR_get_error(), NULL)); 2121 return (XEVNT_ERR); 2122 } 2123 2124 /* 2125 * Bob rolls random k (0 < k < q), computes y = k + b r mod q 2126 * and x = g^k mod p, then sends (y, hash(x)) to Alice. 2127 */ 2128 bctx = BN_CTX_new(); bk = BN_new(); bn = BN_new(); 2129 sdsa = DSA_SIG_new(); 2130 BN_rand(bk, len * 8, -1, 1); /* k */ 2131 BN_mod_mul(bn, dsa->priv_key, r, dsa->q, bctx); /* b r mod q */ 2132 BN_add(bn, bn, bk); 2133 BN_mod(bn, bn, dsa->q, bctx); /* k + b r mod q */ 2134 sdsa->r = BN_dup(bn); 2135 BN_mod_exp(bk, dsa->g, bk, dsa->p, bctx); /* g^k mod p */ 2136 bighash(bk, bk); 2137 sdsa->s = BN_dup(bk); 2138 BN_CTX_free(bctx); 2139 BN_free(r); BN_free(bn); BN_free(bk); 2140#ifdef DEBUG 2141 if (debug > 1) 2142 DSA_print_fp(stdout, dsa, 0); 2143#endif 2144 2145 /* 2146 * Encode the values in ASN.1 and sign. The filestamp is from 2147 * the local file. 2148 */ 2149 len = i2d_DSA_SIG(sdsa, NULL); 2150 if (len == 0) { 2151 msyslog(LOG_ERR, "crypto_bob: %s", 2152 ERR_error_string(ERR_get_error(), NULL)); 2153 DSA_SIG_free(sdsa); 2154 return (XEVNT_ERR); 2155 } 2156 memset(vp, 0, sizeof(struct value)); 2157 tstamp = crypto_time(); 2158 vp->tstamp = htonl(tstamp); 2159 vp->fstamp = htonl(iffkey_info->fstamp); 2160 vp->vallen = htonl(len); 2161 ptr = emalloc(len); 2162 vp->ptr = ptr; 2163 i2d_DSA_SIG(sdsa, &ptr); 2164 DSA_SIG_free(sdsa); 2165 if (tstamp == 0) 2166 return (XEVNT_OK); 2167 2168 vp->sig = emalloc(sign_siglen); 2169 EVP_SignInit(&ctx, sign_digest); 2170 EVP_SignUpdate(&ctx, (u_char *)&vp->tstamp, 12); 2171 EVP_SignUpdate(&ctx, vp->ptr, len); 2172 if (EVP_SignFinal(&ctx, vp->sig, &len, sign_pkey)) 2173 vp->siglen = htonl(sign_siglen); 2174 return (XEVNT_OK); 2175} 2176 2177 2178/* 2179 * crypto_iff - verify Bob's response to Alice's challenge 2180 * 2181 * Returns 2182 * XEVNT_OK success 2183 * XEVNT_FSP bad filestamp 2184 * XEVNT_ID bad or missing group key 2185 * XEVNT_PUB bad or missing public key 2186 */ 2187int 2188crypto_iff( 2189 struct exten *ep, /* extension pointer */ 2190 struct peer *peer /* peer structure pointer */ 2191 ) 2192{ 2193 DSA *dsa; /* IFF parameters */ 2194 BN_CTX *bctx; /* BIGNUM context */ 2195 DSA_SIG *sdsa; /* DSA parameters */ 2196 BIGNUM *bn, *bk; 2197 u_int len; 2198 const u_char *ptr; 2199 int temp; 2200 2201 /* 2202 * If the IFF parameters are not valid or no challenge was sent, 2203 * something awful happened or we are being tormented. 2204 */ 2205 if (peer->ident_pkey == NULL) { 2206 msyslog(LOG_NOTICE, "crypto_iff: scheme unavailable"); 2207 return (XEVNT_ID); 2208 } 2209 if (ntohl(ep->fstamp) != peer->ident_pkey->fstamp) { 2210 msyslog(LOG_NOTICE, "crypto_iff: invalid filestamp %u", 2211 ntohl(ep->fstamp)); 2212 return (XEVNT_FSP); 2213 } 2214 if ((dsa = peer->ident_pkey->pkey->pkey.dsa) == NULL) { 2215 msyslog(LOG_NOTICE, "crypto_iff: defective key"); 2216 return (XEVNT_PUB); 2217 } 2218 if (peer->iffval == NULL) { 2219 msyslog(LOG_NOTICE, "crypto_iff: missing challenge"); 2220 return (XEVNT_ID); 2221 } 2222 2223 /* 2224 * Extract the k + b r and g^k values from the response. 2225 */ 2226 bctx = BN_CTX_new(); bk = BN_new(); bn = BN_new(); 2227 len = ntohl(ep->vallen); 2228 ptr = (u_char *)ep->pkt; 2229 if ((sdsa = d2i_DSA_SIG(NULL, &ptr, len)) == NULL) { 2230 BN_free(bn); BN_free(bk); BN_CTX_free(bctx); 2231 msyslog(LOG_ERR, "crypto_iff: %s", 2232 ERR_error_string(ERR_get_error(), NULL)); 2233 return (XEVNT_ERR); 2234 } 2235 2236 /* 2237 * Compute g^(k + b r) g^(q - b)r mod p. 2238 */ 2239 BN_mod_exp(bn, dsa->pub_key, peer->iffval, dsa->p, bctx); 2240 BN_mod_exp(bk, dsa->g, sdsa->r, dsa->p, bctx); 2241 BN_mod_mul(bn, bn, bk, dsa->p, bctx); 2242 2243 /* 2244 * Verify the hash of the result matches hash(x). 2245 */ 2246 bighash(bn, bn); 2247 temp = BN_cmp(bn, sdsa->s); 2248 BN_free(bn); BN_free(bk); BN_CTX_free(bctx); 2249 BN_free(peer->iffval); 2250 peer->iffval = NULL; 2251 DSA_SIG_free(sdsa); 2252 if (temp == 0) 2253 return (XEVNT_OK); 2254 2255 msyslog(LOG_NOTICE, "crypto_iff: identity not verified"); 2256 return (XEVNT_ID); 2257} 2258 2259 2260/* 2261 *********************************************************************** 2262 * * 2263 * The following routines implement the Guillou-Quisquater (GQ) * 2264 * identity scheme * 2265 * * 2266 *********************************************************************** 2267 * 2268 * The Guillou-Quisquater (GQ) identity scheme is intended for use when 2269 * the certificate can be used to convey public parameters. The scheme 2270 * uses a X509v3 certificate extension field do convey the public key of 2271 * a private key known only to servers. There are two kinds of files: 2272 * encrypted server files that contain private and public values and 2273 * nonencrypted client files that contain only public values. New 2274 * generations of server files must be securely transmitted to all 2275 * servers of the group; client files can be distributed by any means. 2276 * The scheme is self contained and independent of new generations of 2277 * host keys and sign keys. The scheme is self contained and independent 2278 * of new generations of host keys and sign keys. 2279 * 2280 * The GQ parameters hide in a RSA cuckoo structure which uses the same 2281 * parameters. The values are used by an identity scheme based on RSA 2282 * cryptography and described in Stimson p. 300 (with errors). The 512- 2283 * bit public modulus is n = p q, where p and q are secret large primes. 2284 * The TA rolls private random group key b as RSA exponent. These values 2285 * are known to all group members. 2286 * 2287 * When rolling new certificates, a server recomputes the private and 2288 * public keys. The private key u is a random roll, while the public key 2289 * is the inverse obscured by the group key v = (u^-1)^b. These values 2290 * replace the private and public keys normally generated by the RSA 2291 * scheme. Alice challenges Bob to confirm identity using the protocol 2292 * described below. 2293 * 2294 * How it works 2295 * 2296 * The scheme goes like this. Both Alice and Bob have the same modulus n 2297 * and some random b as the group key. These values are computed and 2298 * distributed in advance via secret means, although only the group key 2299 * b is truly secret. Each has a private random private key u and public 2300 * key (u^-1)^b, although not necessarily the same ones. Bob and Alice 2301 * can regenerate the key pair from time to time without affecting 2302 * operations. The public key is conveyed on the certificate in an 2303 * extension field; the private key is never revealed. 2304 * 2305 * Alice rolls new random challenge r and sends to Bob in the GQ 2306 * request message. Bob rolls new random k, then computes y = k u^r mod 2307 * n and x = k^b mod n and sends (y, hash(x)) to Alice in the response 2308 * message. Besides making the response shorter, the hash makes it 2309 * effectivey impossible for an intruder to solve for b by observing 2310 * a number of these messages. 2311 * 2312 * Alice receives the response and computes y^b v^r mod n. After a bit 2313 * of algebra, this simplifies to k^b. If the hash of this result 2314 * matches hash(x), Alice knows that Bob has the group key b. The signed 2315 * response binds this knowledge to Bob's private key and the public key 2316 * previously received in his certificate. 2317 * 2318 * crypto_alice2 - construct Alice's challenge in GQ scheme 2319 * 2320 * Returns 2321 * XEVNT_OK success 2322 * XEVNT_ID bad or missing group key 2323 * XEVNT_PUB bad or missing public key 2324 */ 2325static int 2326crypto_alice2( 2327 struct peer *peer, /* peer pointer */ 2328 struct value *vp /* value pointer */ 2329 ) 2330{ 2331 RSA *rsa; /* GQ parameters */ 2332 BN_CTX *bctx; /* BIGNUM context */ 2333 EVP_MD_CTX ctx; /* signature context */ 2334 tstamp_t tstamp; 2335 u_int len; 2336 2337 /* 2338 * The identity parameters must have correct format and content. 2339 */ 2340 if (peer->ident_pkey == NULL) 2341 return (XEVNT_ID); 2342 2343 if ((rsa = peer->ident_pkey->pkey->pkey.rsa) == NULL) { 2344 msyslog(LOG_NOTICE, "crypto_alice2: defective key"); 2345 return (XEVNT_PUB); 2346 } 2347 2348 /* 2349 * Roll new random r (0 < r < n). 2350 */ 2351 if (peer->iffval != NULL) 2352 BN_free(peer->iffval); 2353 peer->iffval = BN_new(); 2354 len = BN_num_bytes(rsa->n); 2355 BN_rand(peer->iffval, len * 8, -1, 1); /* r mod n */ 2356 bctx = BN_CTX_new(); 2357 BN_mod(peer->iffval, peer->iffval, rsa->n, bctx); 2358 BN_CTX_free(bctx); 2359 2360 /* 2361 * Sign and send to Bob. The filestamp is from the local file. 2362 */ 2363 memset(vp, 0, sizeof(struct value)); 2364 tstamp = crypto_time(); 2365 vp->tstamp = htonl(tstamp); 2366 vp->fstamp = htonl(peer->ident_pkey->fstamp); 2367 vp->vallen = htonl(len); 2368 vp->ptr = emalloc(len); 2369 BN_bn2bin(peer->iffval, vp->ptr); 2370 if (tstamp == 0) 2371 return (XEVNT_OK); 2372 2373 vp->sig = emalloc(sign_siglen); 2374 EVP_SignInit(&ctx, sign_digest); 2375 EVP_SignUpdate(&ctx, (u_char *)&vp->tstamp, 12); 2376 EVP_SignUpdate(&ctx, vp->ptr, len); 2377 if (EVP_SignFinal(&ctx, vp->sig, &len, sign_pkey)) 2378 vp->siglen = htonl(sign_siglen); 2379 return (XEVNT_OK); 2380} 2381 2382 2383/* 2384 * crypto_bob2 - construct Bob's response to Alice's challenge 2385 * 2386 * Returns 2387 * XEVNT_OK success 2388 * XEVNT_ERR protocol error 2389 * XEVNT_ID bad or missing group key 2390 */ 2391static int 2392crypto_bob2( 2393 struct exten *ep, /* extension pointer */ 2394 struct value *vp /* value pointer */ 2395 ) 2396{ 2397 RSA *rsa; /* GQ parameters */ 2398 DSA_SIG *sdsa; /* DSA parameters */ 2399 BN_CTX *bctx; /* BIGNUM context */ 2400 EVP_MD_CTX ctx; /* signature context */ 2401 tstamp_t tstamp; /* NTP timestamp */ 2402 BIGNUM *r, *k, *g, *y; 2403 u_char *ptr; 2404 u_int len; 2405 2406 /* 2407 * If the GQ parameters are not valid, something awful 2408 * happened or we are being tormented. 2409 */ 2410 if (gqkey_info == NULL) { 2411 msyslog(LOG_NOTICE, "crypto_bob2: scheme unavailable"); 2412 return (XEVNT_ID); 2413 } 2414 rsa = gqkey_info->pkey->pkey.rsa; 2415 2416 /* 2417 * Extract r from the challenge. 2418 */ 2419 len = ntohl(ep->vallen); 2420 if ((r = BN_bin2bn((u_char *)ep->pkt, len, NULL)) == NULL) { 2421 msyslog(LOG_ERR, "crypto_bob2: %s", 2422 ERR_error_string(ERR_get_error(), NULL)); 2423 return (XEVNT_ERR); 2424 } 2425 2426 /* 2427 * Bob rolls random k (0 < k < n), computes y = k u^r mod n and 2428 * x = k^b mod n, then sends (y, hash(x)) to Alice. 2429 */ 2430 bctx = BN_CTX_new(); k = BN_new(); g = BN_new(); y = BN_new(); 2431 sdsa = DSA_SIG_new(); 2432 BN_rand(k, len * 8, -1, 1); /* k */ 2433 BN_mod(k, k, rsa->n, bctx); 2434 BN_mod_exp(y, rsa->p, r, rsa->n, bctx); /* u^r mod n */ 2435 BN_mod_mul(y, k, y, rsa->n, bctx); /* k u^r mod n */ 2436 sdsa->r = BN_dup(y); 2437 BN_mod_exp(g, k, rsa->e, rsa->n, bctx); /* k^b mod n */ 2438 bighash(g, g); 2439 sdsa->s = BN_dup(g); 2440 BN_CTX_free(bctx); 2441 BN_free(r); BN_free(k); BN_free(g); BN_free(y); 2442#ifdef DEBUG 2443 if (debug > 1) 2444 RSA_print_fp(stdout, rsa, 0); 2445#endif 2446 2447 /* 2448 * Encode the values in ASN.1 and sign. The filestamp is from 2449 * the local file. 2450 */ 2451 len = i2d_DSA_SIG(sdsa, NULL); 2452 if (len <= 0) { 2453 msyslog(LOG_ERR, "crypto_bob2: %s", 2454 ERR_error_string(ERR_get_error(), NULL)); 2455 DSA_SIG_free(sdsa); 2456 return (XEVNT_ERR); 2457 } 2458 memset(vp, 0, sizeof(struct value)); 2459 tstamp = crypto_time(); 2460 vp->tstamp = htonl(tstamp); 2461 vp->fstamp = htonl(gqkey_info->fstamp); 2462 vp->vallen = htonl(len); 2463 ptr = emalloc(len); 2464 vp->ptr = ptr; 2465 i2d_DSA_SIG(sdsa, &ptr); 2466 DSA_SIG_free(sdsa); 2467 if (tstamp == 0) 2468 return (XEVNT_OK); 2469 2470 vp->sig = emalloc(sign_siglen); 2471 EVP_SignInit(&ctx, sign_digest); 2472 EVP_SignUpdate(&ctx, (u_char *)&vp->tstamp, 12); 2473 EVP_SignUpdate(&ctx, vp->ptr, len); 2474 if (EVP_SignFinal(&ctx, vp->sig, &len, sign_pkey)) 2475 vp->siglen = htonl(sign_siglen); 2476 return (XEVNT_OK); 2477} 2478 2479 2480/* 2481 * crypto_gq - verify Bob's response to Alice's challenge 2482 * 2483 * Returns 2484 * XEVNT_OK success 2485 * XEVNT_ERR protocol error 2486 * XEVNT_FSP bad filestamp 2487 * XEVNT_ID bad or missing group keys 2488 * XEVNT_PUB bad or missing public key 2489 */ 2490int 2491crypto_gq( 2492 struct exten *ep, /* extension pointer */ 2493 struct peer *peer /* peer structure pointer */ 2494 ) 2495{ 2496 RSA *rsa; /* GQ parameters */ 2497 BN_CTX *bctx; /* BIGNUM context */ 2498 DSA_SIG *sdsa; /* RSA signature context fake */ 2499 BIGNUM *y, *v; 2500 const u_char *ptr; 2501 long len; 2502 u_int temp; 2503 2504 /* 2505 * If the GQ parameters are not valid or no challenge was sent, 2506 * something awful happened or we are being tormented. Note that 2507 * the filestamp on the local key file can be greater than on 2508 * the remote parameter file if the keys have been refreshed. 2509 */ 2510 if (peer->ident_pkey == NULL) { 2511 msyslog(LOG_NOTICE, "crypto_gq: scheme unavailable"); 2512 return (XEVNT_ID); 2513 } 2514 if (ntohl(ep->fstamp) < peer->ident_pkey->fstamp) { 2515 msyslog(LOG_NOTICE, "crypto_gq: invalid filestamp %u", 2516 ntohl(ep->fstamp)); 2517 return (XEVNT_FSP); 2518 } 2519 if ((rsa = peer->ident_pkey->pkey->pkey.rsa) == NULL) { 2520 msyslog(LOG_NOTICE, "crypto_gq: defective key"); 2521 return (XEVNT_PUB); 2522 } 2523 if (peer->iffval == NULL) { 2524 msyslog(LOG_NOTICE, "crypto_gq: missing challenge"); 2525 return (XEVNT_ID); 2526 } 2527 2528 /* 2529 * Extract the y = k u^r and hash(x = k^b) values from the 2530 * response. 2531 */ 2532 bctx = BN_CTX_new(); y = BN_new(); v = BN_new(); 2533 len = ntohl(ep->vallen); 2534 ptr = (u_char *)ep->pkt; 2535 if ((sdsa = d2i_DSA_SIG(NULL, &ptr, len)) == NULL) { 2536 BN_CTX_free(bctx); BN_free(y); BN_free(v); 2537 msyslog(LOG_ERR, "crypto_gq: %s", 2538 ERR_error_string(ERR_get_error(), NULL)); 2539 return (XEVNT_ERR); 2540 } 2541 2542 /* 2543 * Compute v^r y^b mod n. 2544 */ 2545 if (peer->grpkey == NULL) { 2546 msyslog(LOG_NOTICE, "crypto_gq: missing group key"); 2547 return (XEVNT_ID); 2548 } 2549 BN_mod_exp(v, peer->grpkey, peer->iffval, rsa->n, bctx); 2550 /* v^r mod n */ 2551 BN_mod_exp(y, sdsa->r, rsa->e, rsa->n, bctx); /* y^b mod n */ 2552 BN_mod_mul(y, v, y, rsa->n, bctx); /* v^r y^b mod n */ 2553 2554 /* 2555 * Verify the hash of the result matches hash(x). 2556 */ 2557 bighash(y, y); 2558 temp = BN_cmp(y, sdsa->s); 2559 BN_CTX_free(bctx); BN_free(y); BN_free(v); 2560 BN_free(peer->iffval); 2561 peer->iffval = NULL; 2562 DSA_SIG_free(sdsa); 2563 if (temp == 0) 2564 return (XEVNT_OK); 2565 2566 msyslog(LOG_NOTICE, "crypto_gq: identity not verified"); 2567 return (XEVNT_ID); 2568} 2569 2570 2571/* 2572 *********************************************************************** 2573 * * 2574 * The following routines implement the Mu-Varadharajan (MV) identity * 2575 * scheme * 2576 * * 2577 *********************************************************************** 2578 * 2579 * The Mu-Varadharajan (MV) cryptosystem was originally intended when 2580 * servers broadcast messages to clients, but clients never send 2581 * messages to servers. There is one encryption key for the server and a 2582 * separate decryption key for each client. It operated something like a 2583 * pay-per-view satellite broadcasting system where the session key is 2584 * encrypted by the broadcaster and the decryption keys are held in a 2585 * tamperproof set-top box. 2586 * 2587 * The MV parameters and private encryption key hide in a DSA cuckoo 2588 * structure which uses the same parameters, but generated in a 2589 * different way. The values are used in an encryption scheme similar to 2590 * El Gamal cryptography and a polynomial formed from the expansion of 2591 * product terms (x - x[j]), as described in Mu, Y., and V. 2592 * Varadharajan: Robust and Secure Broadcasting, Proc. Indocrypt 2001, 2593 * 223-231. The paper has significant errors and serious omissions. 2594 * 2595 * Let q be the product of n distinct primes s1[j] (j = 1...n), where 2596 * each s1[j] has m significant bits. Let p be a prime p = 2 * q + 1, so 2597 * that q and each s1[j] divide p - 1 and p has M = n * m + 1 2598 * significant bits. Let g be a generator of Zp; that is, gcd(g, p - 1) 2599 * = 1 and g^q = 1 mod p. We do modular arithmetic over Zq and then 2600 * project into Zp* as exponents of g. Sometimes we have to compute an 2601 * inverse b^-1 of random b in Zq, but for that purpose we require 2602 * gcd(b, q) = 1. We expect M to be in the 500-bit range and n 2603 * relatively small, like 30. These are the parameters of the scheme and 2604 * they are expensive to compute. 2605 * 2606 * We set up an instance of the scheme as follows. A set of random 2607 * values x[j] mod q (j = 1...n), are generated as the zeros of a 2608 * polynomial of order n. The product terms (x - x[j]) are expanded to 2609 * form coefficients a[i] mod q (i = 0...n) in powers of x. These are 2610 * used as exponents of the generator g mod p to generate the private 2611 * encryption key A. The pair (gbar, ghat) of public server keys and the 2612 * pairs (xbar[j], xhat[j]) (j = 1...n) of private client keys are used 2613 * to construct the decryption keys. The devil is in the details. 2614 * 2615 * This routine generates a private server encryption file including the 2616 * private encryption key E and partial decryption keys gbar and ghat. 2617 * It then generates public client decryption files including the public 2618 * keys xbar[j] and xhat[j] for each client j. The partial decryption 2619 * files are used to compute the inverse of E. These values are suitably 2620 * blinded so secrets are not revealed. 2621 * 2622 * The distinguishing characteristic of this scheme is the capability to 2623 * revoke keys. Included in the calculation of E, gbar and ghat is the 2624 * product s = prod(s1[j]) (j = 1...n) above. If the factor s1[j] is 2625 * subsequently removed from the product and E, gbar and ghat 2626 * recomputed, the jth client will no longer be able to compute E^-1 and 2627 * thus unable to decrypt the messageblock. 2628 * 2629 * How it works 2630 * 2631 * The scheme goes like this. Bob has the server values (p, E, q, gbar, 2632 * ghat) and Alice has the client values (p, xbar, xhat). 2633 * 2634 * Alice rolls new random nonce r mod p and sends to Bob in the MV 2635 * request message. Bob rolls random nonce k mod q, encrypts y = r E^k 2636 * mod p and sends (y, gbar^k, ghat^k) to Alice. 2637 * 2638 * Alice receives the response and computes the inverse (E^k)^-1 from 2639 * the partial decryption keys gbar^k, ghat^k, xbar and xhat. She then 2640 * decrypts y and verifies it matches the original r. The signed 2641 * response binds this knowledge to Bob's private key and the public key 2642 * previously received in his certificate. 2643 * 2644 * crypto_alice3 - construct Alice's challenge in MV scheme 2645 * 2646 * Returns 2647 * XEVNT_OK success 2648 * XEVNT_ID bad or missing group key 2649 * XEVNT_PUB bad or missing public key 2650 */ 2651static int 2652crypto_alice3( 2653 struct peer *peer, /* peer pointer */ 2654 struct value *vp /* value pointer */ 2655 ) 2656{ 2657 DSA *dsa; /* MV parameters */ 2658 BN_CTX *bctx; /* BIGNUM context */ 2659 EVP_MD_CTX ctx; /* signature context */ 2660 tstamp_t tstamp; 2661 u_int len; 2662 2663 /* 2664 * The identity parameters must have correct format and content. 2665 */ 2666 if (peer->ident_pkey == NULL) 2667 return (XEVNT_ID); 2668 2669 if ((dsa = peer->ident_pkey->pkey->pkey.dsa) == NULL) { 2670 msyslog(LOG_NOTICE, "crypto_alice3: defective key"); 2671 return (XEVNT_PUB); 2672 } 2673 2674 /* 2675 * Roll new random r (0 < r < q). 2676 */ 2677 if (peer->iffval != NULL) 2678 BN_free(peer->iffval); 2679 peer->iffval = BN_new(); 2680 len = BN_num_bytes(dsa->p); 2681 BN_rand(peer->iffval, len * 8, -1, 1); /* r mod p */ 2682 bctx = BN_CTX_new(); 2683 BN_mod(peer->iffval, peer->iffval, dsa->p, bctx); 2684 BN_CTX_free(bctx); 2685 2686 /* 2687 * Sign and send to Bob. The filestamp is from the local file. 2688 */ 2689 memset(vp, 0, sizeof(struct value)); 2690 tstamp = crypto_time(); 2691 vp->tstamp = htonl(tstamp); 2692 vp->fstamp = htonl(peer->ident_pkey->fstamp); 2693 vp->vallen = htonl(len); 2694 vp->ptr = emalloc(len); 2695 BN_bn2bin(peer->iffval, vp->ptr); 2696 if (tstamp == 0) 2697 return (XEVNT_OK); 2698 2699 vp->sig = emalloc(sign_siglen); 2700 EVP_SignInit(&ctx, sign_digest); 2701 EVP_SignUpdate(&ctx, (u_char *)&vp->tstamp, 12); 2702 EVP_SignUpdate(&ctx, vp->ptr, len); 2703 if (EVP_SignFinal(&ctx, vp->sig, &len, sign_pkey)) 2704 vp->siglen = htonl(sign_siglen); 2705 return (XEVNT_OK); 2706} 2707 2708 2709/* 2710 * crypto_bob3 - construct Bob's response to Alice's challenge 2711 * 2712 * Returns 2713 * XEVNT_OK success 2714 * XEVNT_ERR protocol error 2715 */ 2716static int 2717crypto_bob3( 2718 struct exten *ep, /* extension pointer */ 2719 struct value *vp /* value pointer */ 2720 ) 2721{ 2722 DSA *dsa; /* MV parameters */ 2723 DSA *sdsa; /* DSA signature context fake */ 2724 BN_CTX *bctx; /* BIGNUM context */ 2725 EVP_MD_CTX ctx; /* signature context */ 2726 tstamp_t tstamp; /* NTP timestamp */ 2727 BIGNUM *r, *k, *u; 2728 u_char *ptr; 2729 u_int len; 2730 2731 /* 2732 * If the MV parameters are not valid, something awful 2733 * happened or we are being tormented. 2734 */ 2735 if (mvkey_info == NULL) { 2736 msyslog(LOG_NOTICE, "crypto_bob3: scheme unavailable"); 2737 return (XEVNT_ID); 2738 } 2739 dsa = mvkey_info->pkey->pkey.dsa; 2740 2741 /* 2742 * Extract r from the challenge. 2743 */ 2744 len = ntohl(ep->vallen); 2745 if ((r = BN_bin2bn((u_char *)ep->pkt, len, NULL)) == NULL) { 2746 msyslog(LOG_ERR, "crypto_bob3: %s", 2747 ERR_error_string(ERR_get_error(), NULL)); 2748 return (XEVNT_ERR); 2749 } 2750 2751 /* 2752 * Bob rolls random k (0 < k < q), making sure it is not a 2753 * factor of q. He then computes y = r A^k and sends (y, gbar^k, 2754 * and ghat^k) to Alice. 2755 */ 2756 bctx = BN_CTX_new(); k = BN_new(); u = BN_new(); 2757 sdsa = DSA_new(); 2758 sdsa->p = BN_new(); sdsa->q = BN_new(); sdsa->g = BN_new(); 2759 while (1) { 2760 BN_rand(k, BN_num_bits(dsa->q), 0, 0); 2761 BN_mod(k, k, dsa->q, bctx); 2762 BN_gcd(u, k, dsa->q, bctx); 2763 if (BN_is_one(u)) 2764 break; 2765 } 2766 BN_mod_exp(u, dsa->g, k, dsa->p, bctx); /* A^k r */ 2767 BN_mod_mul(sdsa->p, u, r, dsa->p, bctx); 2768 BN_mod_exp(sdsa->q, dsa->priv_key, k, dsa->p, bctx); /* gbar */ 2769 BN_mod_exp(sdsa->g, dsa->pub_key, k, dsa->p, bctx); /* ghat */ 2770 BN_CTX_free(bctx); BN_free(k); BN_free(r); BN_free(u); 2771#ifdef DEBUG 2772 if (debug > 1) 2773 DSA_print_fp(stdout, sdsa, 0); 2774#endif 2775 2776 /* 2777 * Encode the values in ASN.1 and sign. The filestamp is from 2778 * the local file. 2779 */ 2780 memset(vp, 0, sizeof(struct value)); 2781 tstamp = crypto_time(); 2782 vp->tstamp = htonl(tstamp); 2783 vp->fstamp = htonl(mvkey_info->fstamp); 2784 len = i2d_DSAparams(sdsa, NULL); 2785 if (len == 0) { 2786 msyslog(LOG_ERR, "crypto_bob3: %s", 2787 ERR_error_string(ERR_get_error(), NULL)); 2788 DSA_free(sdsa); 2789 return (XEVNT_ERR); 2790 } 2791 vp->vallen = htonl(len); 2792 ptr = emalloc(len); 2793 vp->ptr = ptr; 2794 i2d_DSAparams(sdsa, &ptr); 2795 DSA_free(sdsa); 2796 if (tstamp == 0) 2797 return (XEVNT_OK); 2798 2799 vp->sig = emalloc(sign_siglen); 2800 EVP_SignInit(&ctx, sign_digest); 2801 EVP_SignUpdate(&ctx, (u_char *)&vp->tstamp, 12); 2802 EVP_SignUpdate(&ctx, vp->ptr, len); 2803 if (EVP_SignFinal(&ctx, vp->sig, &len, sign_pkey)) 2804 vp->siglen = htonl(sign_siglen); 2805 return (XEVNT_OK); 2806} 2807 2808 2809/* 2810 * crypto_mv - verify Bob's response to Alice's challenge 2811 * 2812 * Returns 2813 * XEVNT_OK success 2814 * XEVNT_ERR protocol error 2815 * XEVNT_FSP bad filestamp 2816 * XEVNT_ID bad or missing group key 2817 * XEVNT_PUB bad or missing public key 2818 */ 2819int 2820crypto_mv( 2821 struct exten *ep, /* extension pointer */ 2822 struct peer *peer /* peer structure pointer */ 2823 ) 2824{ 2825 DSA *dsa; /* MV parameters */ 2826 DSA *sdsa; /* DSA parameters */ 2827 BN_CTX *bctx; /* BIGNUM context */ 2828 BIGNUM *k, *u, *v; 2829 u_int len; 2830 const u_char *ptr; 2831 int temp; 2832 2833 /* 2834 * If the MV parameters are not valid or no challenge was sent, 2835 * something awful happened or we are being tormented. 2836 */ 2837 if (peer->ident_pkey == NULL) { 2838 msyslog(LOG_NOTICE, "crypto_mv: scheme unavailable"); 2839 return (XEVNT_ID); 2840 } 2841 if (ntohl(ep->fstamp) != peer->ident_pkey->fstamp) { 2842 msyslog(LOG_NOTICE, "crypto_mv: invalid filestamp %u", 2843 ntohl(ep->fstamp)); 2844 return (XEVNT_FSP); 2845 } 2846 if ((dsa = peer->ident_pkey->pkey->pkey.dsa) == NULL) { 2847 msyslog(LOG_NOTICE, "crypto_mv: defective key"); 2848 return (XEVNT_PUB); 2849 } 2850 if (peer->iffval == NULL) { 2851 msyslog(LOG_NOTICE, "crypto_mv: missing challenge"); 2852 return (XEVNT_ID); 2853 } 2854 2855 /* 2856 * Extract the y, gbar and ghat values from the response. 2857 */ 2858 bctx = BN_CTX_new(); k = BN_new(); u = BN_new(); v = BN_new(); 2859 len = ntohl(ep->vallen); 2860 ptr = (u_char *)ep->pkt; 2861 if ((sdsa = d2i_DSAparams(NULL, &ptr, len)) == NULL) { 2862 msyslog(LOG_ERR, "crypto_mv: %s", 2863 ERR_error_string(ERR_get_error(), NULL)); 2864 return (XEVNT_ERR); 2865 } 2866 2867 /* 2868 * Compute (gbar^xhat ghat^xbar) mod p. 2869 */ 2870 BN_mod_exp(u, sdsa->q, dsa->pub_key, dsa->p, bctx); 2871 BN_mod_exp(v, sdsa->g, dsa->priv_key, dsa->p, bctx); 2872 BN_mod_mul(u, u, v, dsa->p, bctx); 2873 BN_mod_mul(u, u, sdsa->p, dsa->p, bctx); 2874 2875 /* 2876 * The result should match r. 2877 */ 2878 temp = BN_cmp(u, peer->iffval); 2879 BN_CTX_free(bctx); BN_free(k); BN_free(u); BN_free(v); 2880 BN_free(peer->iffval); 2881 peer->iffval = NULL; 2882 DSA_free(sdsa); 2883 if (temp == 0) 2884 return (XEVNT_OK); 2885 2886 msyslog(LOG_NOTICE, "crypto_mv: identity not verified"); 2887 return (XEVNT_ID); 2888} 2889 2890 2891/* 2892 *********************************************************************** 2893 * * 2894 * The following routines are used to manipulate certificates * 2895 * * 2896 *********************************************************************** 2897 */ 2898/* 2899 * cert_sign - sign x509 certificate equest and update value structure. 2900 * 2901 * The certificate request includes a copy of the host certificate, 2902 * which includes the version number, subject name and public key of the 2903 * host. The resulting certificate includes these values plus the 2904 * serial number, issuer name and valid interval of the server. The 2905 * valid interval extends from the current time to the same time one 2906 * year hence. This may extend the life of the signed certificate beyond 2907 * that of the signer certificate. 2908 * 2909 * It is convenient to use the NTP seconds of the current time as the 2910 * serial number. In the value structure the timestamp is the current 2911 * time and the filestamp is taken from the extension field. Note this 2912 * routine is called only when the client clock is synchronized to a 2913 * proventic source, so timestamp comparisons are valid. 2914 * 2915 * The host certificate is valid from the time it was generated for a 2916 * period of one year. A signed certificate is valid from the time of 2917 * signature for a period of one year, but only the host certificate (or 2918 * sign certificate if used) is actually used to encrypt and decrypt 2919 * signatures. The signature trail is built from the client via the 2920 * intermediate servers to the trusted server. Each signature on the 2921 * trail must be valid at the time of signature, but it could happen 2922 * that a signer certificate expire before the signed certificate, which 2923 * remains valid until its expiration. 2924 * 2925 * Returns 2926 * XEVNT_OK success 2927 * XEVNT_CRT bad or missing certificate 2928 * XEVNT_PER host certificate expired 2929 * XEVNT_PUB bad or missing public key 2930 * XEVNT_VFY certificate not verified 2931 */ 2932static int 2933cert_sign( 2934 struct exten *ep, /* extension field pointer */ 2935 struct value *vp /* value pointer */ 2936 ) 2937{ 2938 X509 *req; /* X509 certificate request */ 2939 X509 *cert; /* X509 certificate */ 2940 X509_EXTENSION *ext; /* certificate extension */ 2941 ASN1_INTEGER *serial; /* serial number */ 2942 X509_NAME *subj; /* distinguished (common) name */ 2943 EVP_PKEY *pkey; /* public key */ 2944 EVP_MD_CTX ctx; /* message digest context */ 2945 tstamp_t tstamp; /* NTP timestamp */ 2946 u_int len; 2947 u_char *ptr; 2948 int i, temp; 2949 2950 /* 2951 * Decode ASN.1 objects and construct certificate structure. 2952 * Make sure the system clock is synchronized to a proventic 2953 * source. 2954 */ 2955 tstamp = crypto_time(); 2956 if (tstamp == 0) 2957 return (XEVNT_TSP); 2958 2959 ptr = (u_char *)ep->pkt; 2960 if ((req = d2i_X509(NULL, &ptr, ntohl(ep->vallen))) == NULL) { 2961 msyslog(LOG_ERR, "cert_sign: %s", 2962 ERR_error_string(ERR_get_error(), NULL)); 2963 return (XEVNT_CRT); 2964 } 2965 /* 2966 * Extract public key and check for errors. 2967 */ 2968 if ((pkey = X509_get_pubkey(req)) == NULL) { 2969 msyslog(LOG_ERR, "cert_sign: %s", 2970 ERR_error_string(ERR_get_error(), NULL)); 2971 X509_free(req); 2972 return (XEVNT_PUB); 2973 } 2974 2975 /* 2976 * Generate X509 certificate signed by this server. If this is a 2977 * trusted host, the issuer name is the group name; otherwise, 2978 * it is the host name. Also copy any extensions that might be 2979 * present. 2980 */ 2981 cert = X509_new(); 2982 X509_set_version(cert, X509_get_version(req)); 2983 serial = ASN1_INTEGER_new(); 2984 ASN1_INTEGER_set(serial, tstamp); 2985 X509_set_serialNumber(cert, serial); 2986 X509_gmtime_adj(X509_get_notBefore(cert), 0L); 2987 X509_gmtime_adj(X509_get_notAfter(cert), YEAR); 2988 subj = X509_get_issuer_name(cert); 2989 X509_NAME_add_entry_by_txt(subj, "commonName", MBSTRING_ASC, 2990 hostval.ptr, strlen(hostval.ptr), -1, 0); 2991 subj = X509_get_subject_name(req); 2992 X509_set_subject_name(cert, subj); 2993 X509_set_pubkey(cert, pkey); 2994 ext = X509_get_ext(req, 0); 2995 temp = X509_get_ext_count(req); 2996 for (i = 0; i < temp; i++) { 2997 ext = X509_get_ext(req, i); 2998 X509_add_ext(cert, ext, -1); 2999 } 3000 X509_free(req); 3001 3002 /* 3003 * Sign and verify the client certificate, but only if the host 3004 * certificate has not expired. 3005 */ 3006 if (tstamp < cert_host->first || tstamp > cert_host->last) { 3007 X509_free(cert); 3008 return (XEVNT_PER); 3009 } 3010 X509_sign(cert, sign_pkey, sign_digest); 3011 if (X509_verify(cert, sign_pkey) <= 0) { 3012 msyslog(LOG_ERR, "cert_sign: %s", 3013 ERR_error_string(ERR_get_error(), NULL)); 3014 X509_free(cert); 3015 return (XEVNT_VFY); 3016 } 3017 len = i2d_X509(cert, NULL); 3018 3019 /* 3020 * Build and sign the value structure. We have to sign it here, 3021 * since the response has to be returned right away. This is a 3022 * clogging hazard. 3023 */ 3024 memset(vp, 0, sizeof(struct value)); 3025 vp->tstamp = htonl(tstamp); 3026 vp->fstamp = ep->fstamp; 3027 vp->vallen = htonl(len); 3028 vp->ptr = emalloc(len); 3029 ptr = vp->ptr; 3030 i2d_X509(cert, &ptr); 3031 vp->siglen = 0; 3032 if (tstamp != 0) { 3033 vp->sig = emalloc(sign_siglen); 3034 EVP_SignInit(&ctx, sign_digest); 3035 EVP_SignUpdate(&ctx, (u_char *)vp, 12); 3036 EVP_SignUpdate(&ctx, vp->ptr, len); 3037 if (EVP_SignFinal(&ctx, vp->sig, &len, sign_pkey)) 3038 vp->siglen = htonl(sign_siglen); 3039 } 3040#ifdef DEBUG 3041 if (debug > 1) 3042 X509_print_fp(stdout, cert); 3043#endif 3044 X509_free(cert); 3045 return (XEVNT_OK); 3046} 3047 3048 3049/* 3050 * cert_install - install certificate in certificate cache 3051 * 3052 * This routine encodes an extension field into a certificate info/value 3053 * structure. It searches the certificate list for duplicates and 3054 * expunges whichever is older. Finally, it inserts this certificate 3055 * first on the list. 3056 * 3057 * Returns certificate info pointer if valid, NULL if not. 3058 */ 3059struct cert_info * 3060cert_install( 3061 struct exten *ep, /* cert info/value */ 3062 struct peer *peer /* peer structure */ 3063 ) 3064{ 3065 struct cert_info *cp, *xp, **zp; 3066 3067 /* 3068 * Parse and validate the signed certificate. If valid, 3069 * construct the info/value structure; otherwise, scamper home 3070 * empty handed. 3071 */ 3072 if ((cp = cert_parse((u_char *)ep->pkt, (long)ntohl(ep->vallen), 3073 (tstamp_t)ntohl(ep->fstamp))) == NULL) 3074 return (NULL); 3075 3076 /* 3077 * Scan certificate list looking for another certificate with 3078 * the same subject and issuer. If another is found with the 3079 * same or older filestamp, unlink it and return the goodies to 3080 * the heap. If another is found with a later filestamp, discard 3081 * the new one and leave the building with the old one. 3082 * 3083 * Make a note to study this issue again. An earlier certificate 3084 * with a long lifetime might be overtaken by a later 3085 * certificate with a short lifetime, thus invalidating the 3086 * earlier signature. However, we gotta find a way to leak old 3087 * stuff from the cache, so we do it anyway. 3088 */ 3089 zp = &cinfo; 3090 for (xp = cinfo; xp != NULL; xp = xp->link) { 3091 if (strcmp(cp->subject, xp->subject) == 0 && 3092 strcmp(cp->issuer, xp->issuer) == 0) { 3093 if (ntohl(cp->cert.fstamp) <= 3094 ntohl(xp->cert.fstamp)) { 3095 cert_free(cp); 3096 cp = xp; 3097 } else { 3098 *zp = xp->link; 3099 cert_free(xp); 3100 xp = NULL; 3101 } 3102 break; 3103 } 3104 zp = &xp->link; 3105 } 3106 if (xp == NULL) { 3107 cp->link = cinfo; 3108 cinfo = cp; 3109 } 3110 cp->flags |= CERT_VALID; 3111 crypto_update(); 3112 return (cp); 3113} 3114 3115 3116/* 3117 * cert_hike - verify the signature using the issuer public key 3118 * 3119 * Returns 3120 * XEVNT_OK success 3121 * XEVNT_CRT bad or missing certificate 3122 * XEVNT_PER host certificate expired 3123 * XEVNT_VFY certificate not verified 3124 */ 3125int 3126cert_hike( 3127 struct peer *peer, /* peer structure pointer */ 3128 struct cert_info *yp /* issuer certificate */ 3129 ) 3130{ 3131 struct cert_info *xp; /* subject certificate */ 3132 X509 *cert; /* X509 certificate */ 3133 u_char *ptr; 3134 3135 /* 3136 * Save the issuer on the new certificate, but remember the old 3137 * one. 3138 */ 3139 if (peer->issuer != NULL) 3140 free(peer->issuer); 3141 peer->issuer = emalloc(strlen(yp->issuer) + 1); 3142 strcpy(peer->issuer, yp->issuer); 3143 xp = peer->xinfo; 3144 peer->xinfo = yp; 3145 3146 /* 3147 * If subject Y matches issuer Y, then the certificate trail is 3148 * complete. If Y is not trusted, the server certificate has yet 3149 * been signed, so keep trying. Otherwise, save the group key 3150 * and light the valid bit. If the host certificate is trusted, 3151 * do not execute a sign exchange. If no identity scheme is in 3152 * use, light the identity and proventic bits. 3153 */ 3154 if (strcmp(yp->subject, yp->issuer) == 0) { 3155 if (!(yp->flags & CERT_TRUST)) 3156 return (XEVNT_OK); 3157 3158 peer->grpkey = yp->grpkey; 3159 peer->crypto |= CRYPTO_FLAG_CERT; 3160 if (!(peer->crypto & CRYPTO_FLAG_MASK)) 3161 peer->crypto |= CRYPTO_FLAG_VRFY | 3162 CRYPTO_FLAG_PROV; 3163 3164 /* 3165 * If the server has an an identity scheme, fetch the 3166 * identity credentials. If not, the identity is 3167 * verified only by the trusted certificate. The next 3168 * signature will set the server proventic. 3169 */ 3170 if (!(peer->crypto & CRYPTO_FLAG_MASK) || 3171 sys_groupname == NULL) 3172 peer->crypto |= CRYPTO_FLAG_VRFY; 3173 } 3174 3175 /* 3176 * If X exists, verify signature X using public key Y. 3177 */ 3178 if (xp == NULL) 3179 return (XEVNT_OK); 3180 3181 ptr = (u_char *)xp->cert.ptr; 3182 cert = d2i_X509(NULL, &ptr, ntohl(xp->cert.vallen)); 3183 if (cert == NULL) { 3184 xp->flags |= CERT_ERROR; 3185 return (XEVNT_CRT); 3186 } 3187 if (X509_verify(cert, yp->pkey) <= 0) { 3188 X509_free(cert); 3189 xp->flags |= CERT_ERROR; 3190 return (XEVNT_VFY); 3191 } 3192 X509_free(cert); 3193 3194 /* 3195 * Signature X is valid only if it begins during the 3196 * lifetime of Y. 3197 */ 3198 if (xp->first < yp->first || xp->first > yp->last) { 3199 xp->flags |= CERT_ERROR; 3200 return (XEVNT_PER); 3201 } 3202 xp->flags |= CERT_SIGN; 3203 return (XEVNT_OK); 3204} 3205 3206 3207/* 3208 * cert_parse - parse x509 certificate and create info/value structures. 3209 * 3210 * The server certificate includes the version number, issuer name, 3211 * subject name, public key and valid date interval. If the issuer name 3212 * is the same as the subject name, the certificate is self signed and 3213 * valid only if the server is configured as trustable. If the names are 3214 * different, another issuer has signed the server certificate and 3215 * vouched for it. In this case the server certificate is valid if 3216 * verified by the issuer public key. 3217 * 3218 * Returns certificate info/value pointer if valid, NULL if not. 3219 */ 3220struct cert_info * /* certificate information structure */ 3221cert_parse( 3222 u_char *asn1cert, /* X509 certificate */ 3223 long len, /* certificate length */ 3224 tstamp_t fstamp /* filestamp */ 3225 ) 3226{ 3227 X509 *cert; /* X509 certificate */ 3228 X509_EXTENSION *ext; /* X509v3 extension */ 3229 struct cert_info *ret; /* certificate info/value */ 3230 BIO *bp; 3231 char pathbuf[MAXFILENAME]; 3232 u_char *ptr; 3233 int temp, cnt, i; 3234 3235 /* 3236 * Decode ASN.1 objects and construct certificate structure. 3237 */ 3238 ptr = asn1cert; 3239 if ((cert = d2i_X509(NULL, &ptr, len)) == NULL) { 3240 msyslog(LOG_ERR, "cert_parse: %s", 3241 ERR_error_string(ERR_get_error(), NULL)); 3242 return (NULL); 3243 } 3244#ifdef DEBUG 3245 if (debug > 1) 3246 X509_print_fp(stdout, cert); 3247#endif 3248 3249 /* 3250 * Extract version, subject name and public key. 3251 */ 3252 ret = emalloc(sizeof(struct cert_info)); 3253 memset(ret, 0, sizeof(struct cert_info)); 3254 if ((ret->pkey = X509_get_pubkey(cert)) == NULL) { 3255 msyslog(LOG_ERR, "cert_parse: %s", 3256 ERR_error_string(ERR_get_error(), NULL)); 3257 cert_free(ret); 3258 X509_free(cert); 3259 return (NULL); 3260 } 3261 ret->version = X509_get_version(cert); 3262 X509_NAME_oneline(X509_get_subject_name(cert), pathbuf, 3263 MAXFILENAME); 3264 ptr = strstr(pathbuf, "CN="); 3265 if (ptr == NULL) { 3266 msyslog(LOG_NOTICE, "cert_parse: invalid subject %s", 3267 pathbuf); 3268 cert_free(ret); 3269 X509_free(cert); 3270 return (NULL); 3271 } 3272 ret->subject = estrdup(ptr + 3); 3273 3274 /* 3275 * Extract remaining objects. Note that the NTP serial number is 3276 * the NTP seconds at the time of signing, but this might not be 3277 * the case for other authority. We don't bother to check the 3278 * objects at this time, since the real crunch can happen only 3279 * when the time is valid but not yet certificated. 3280 */ 3281 ret->nid = OBJ_obj2nid(cert->cert_info->signature->algorithm); 3282 ret->digest = (const EVP_MD *)EVP_get_digestbynid(ret->nid); 3283 ret->serial = 3284 (u_long)ASN1_INTEGER_get(X509_get_serialNumber(cert)); 3285 X509_NAME_oneline(X509_get_issuer_name(cert), pathbuf, 3286 MAXFILENAME); 3287 if ((ptr = strstr(pathbuf, "CN=")) == NULL) { 3288 msyslog(LOG_NOTICE, "cert_parse: invalid issuer %s", 3289 pathbuf); 3290 cert_free(ret); 3291 X509_free(cert); 3292 return (NULL); 3293 } 3294 ret->issuer = estrdup(ptr + 3); 3295 ret->first = asn2ntp(X509_get_notBefore(cert)); 3296 ret->last = asn2ntp(X509_get_notAfter(cert)); 3297 3298 /* 3299 * Extract extension fields. These are ad hoc ripoffs of 3300 * currently assigned functions and will certainly be changed 3301 * before prime time. 3302 */ 3303 cnt = X509_get_ext_count(cert); 3304 for (i = 0; i < cnt; i++) { 3305 ext = X509_get_ext(cert, i); 3306 temp = OBJ_obj2nid(ext->object); 3307 switch (temp) { 3308 3309 /* 3310 * If a key_usage field is present, we decode whether 3311 * this is a trusted or private certificate. This is 3312 * dorky; all we want is to compare NIDs, but OpenSSL 3313 * insists on BIO text strings. 3314 */ 3315 case NID_ext_key_usage: 3316 bp = BIO_new(BIO_s_mem()); 3317 X509V3_EXT_print(bp, ext, 0, 0); 3318 BIO_gets(bp, pathbuf, MAXFILENAME); 3319 BIO_free(bp); 3320 if (strcmp(pathbuf, "Trust Root") == 0) 3321 ret->flags |= CERT_TRUST; 3322 else if (strcmp(pathbuf, "Private") == 0) 3323 ret->flags |= CERT_PRIV; 3324#if DEBUG 3325 if (debug) 3326 printf("cert_parse: %s: %s\n", 3327 OBJ_nid2ln(temp), pathbuf); 3328#endif 3329 break; 3330 3331 /* 3332 * If a NID_subject_key_identifier field is present, it 3333 * contains the GQ public key. 3334 */ 3335 case NID_subject_key_identifier: 3336 ret->grpkey = BN_bin2bn(&ext->value->data[2], 3337 ext->value->length - 2, NULL); 3338 /* fall through */ 3339#if DEBUG 3340 default: 3341 if (debug) 3342 printf("cert_parse: %s\n", 3343 OBJ_nid2ln(temp)); 3344#endif 3345 } 3346 } 3347 if (strcmp(ret->subject, ret->issuer) == 0) { 3348 3349 /* 3350 * If certificate is self signed, verify signature. 3351 */ 3352 if (X509_verify(cert, ret->pkey) <= 0) { 3353 msyslog(LOG_NOTICE, 3354 "cert_parse: signature not verified %s", 3355 ret->subject); 3356 cert_free(ret); 3357 X509_free(cert); 3358 return (NULL); 3359 } 3360 } else { 3361 3362 /* 3363 * Check for a certificate loop. 3364 */ 3365 if (strcmp(hostval.ptr, ret->issuer) == 0) { 3366 msyslog(LOG_NOTICE, 3367 "cert_parse: certificate trail loop %s", 3368 ret->subject); 3369 cert_free(ret); 3370 X509_free(cert); 3371 return (NULL); 3372 } 3373 } 3374 3375 /* 3376 * Verify certificate valid times. Note that certificates cannot 3377 * be retroactive. 3378 */ 3379 if (ret->first > ret->last || ret->first < fstamp) { 3380 msyslog(LOG_NOTICE, 3381 "cert_parse: invalid times %s first %u last %u fstamp %u", 3382 ret->subject, ret->first, ret->last, fstamp); 3383 cert_free(ret); 3384 X509_free(cert); 3385 return (NULL); 3386 } 3387 3388 /* 3389 * Build the value structure to sign and send later. 3390 */ 3391 ret->cert.fstamp = htonl(fstamp); 3392 ret->cert.vallen = htonl(len); 3393 ret->cert.ptr = emalloc(len); 3394 memcpy(ret->cert.ptr, asn1cert, len); 3395 X509_free(cert); 3396 return (ret); 3397} 3398 3399 3400/* 3401 * cert_free - free certificate information structure 3402 */ 3403void 3404cert_free( 3405 struct cert_info *cinf /* certificate info/value structure */ 3406 ) 3407{ 3408 if (cinf->pkey != NULL) 3409 EVP_PKEY_free(cinf->pkey); 3410 if (cinf->subject != NULL) 3411 free(cinf->subject); 3412 if (cinf->issuer != NULL) 3413 free(cinf->issuer); 3414 if (cinf->grpkey != NULL) 3415 BN_free(cinf->grpkey); 3416 value_free(&cinf->cert); 3417 free(cinf); 3418} 3419 3420 3421/* 3422 * crypto_key - load cryptographic parameters and keys 3423 * 3424 * This routine searches the key cache for matching name in the form 3425 * ntpkey_<key>_<name>, where <key> is one of host, sign, iff, gq, mv, 3426 * and <name> is the host/group name. If not found, it tries to load a 3427 * PEM-encoded file of the same name and extracts the filestamp from 3428 * the first line of the file name. It returns the key pointer if valid, 3429 * NULL if not. 3430 */ 3431static struct pkey_info * 3432crypto_key( 3433 char *cp, /* file name */ 3434 char *passwd1, /* password */ 3435 sockaddr_u *addr /* IP address */ 3436 ) 3437{ 3438 FILE *str; /* file handle */ 3439 struct pkey_info *pkp; /* generic key */ 3440 EVP_PKEY *pkey = NULL; /* public/private key */ 3441 tstamp_t fstamp; 3442 char filename[MAXFILENAME]; /* name of key file */ 3443 char linkname[MAXFILENAME]; /* filestamp buffer) */ 3444 char statstr[NTP_MAXSTRLEN]; /* statistics for filegen */ 3445 char *ptr; 3446 3447 /* 3448 * Search the key cache for matching key and name. 3449 */ 3450 for (pkp = pkinfo; pkp != NULL; pkp = pkp->link) { 3451 if (strcmp(cp, pkp->name) == 0) 3452 return (pkp); 3453 } 3454 3455 /* 3456 * Open the key file. If the first character of the file name is 3457 * not '/', prepend the keys directory string. If something goes 3458 * wrong, abandon ship. 3459 */ 3460 if (*cp == '/') 3461 strcpy(filename, cp); 3462 else 3463 snprintf(filename, MAXFILENAME, "%s/%s", keysdir, cp); 3464 str = fopen(filename, "r"); 3465 if (str == NULL) 3466 return (NULL); 3467 3468 /* 3469 * Read the filestamp, which is contained in the first line. 3470 */ 3471 if ((ptr = fgets(linkname, MAXFILENAME, str)) == NULL) { 3472 msyslog(LOG_ERR, "crypto_key: empty file %s", 3473 filename); 3474 fclose(str); 3475 return (NULL); 3476 } 3477 if ((ptr = strrchr(ptr, '.')) == NULL) { 3478 msyslog(LOG_ERR, "crypto_key: no filestamp %s", 3479 filename); 3480 fclose(str); 3481 return (NULL); 3482 } 3483 if (sscanf(++ptr, "%u", &fstamp) != 1) { 3484 msyslog(LOG_ERR, "crypto_key: invalid filestamp %s", 3485 filename); 3486 fclose(str); 3487 return (NULL); 3488 } 3489 3490 /* 3491 * Read and decrypt PEM-encoded private key. If it fails to 3492 * decrypt, game over. 3493 */ 3494 pkey = PEM_read_PrivateKey(str, NULL, NULL, passwd1); 3495 fclose(str); 3496 if (pkey == NULL) { 3497 msyslog(LOG_ERR, "crypto_key: %s", 3498 ERR_error_string(ERR_get_error(), NULL)); 3499 exit (-1); 3500 } 3501 3502 /* 3503 * Make a new entry in the key cache. 3504 */ 3505 pkp = emalloc(sizeof(struct pkey_info)); 3506 pkp->link = pkinfo; 3507 pkinfo = pkp; 3508 pkp->pkey = pkey; 3509 pkp->name = emalloc(strlen(cp) + 1); 3510 pkp->fstamp = fstamp; 3511 strcpy(pkp->name, cp); 3512 3513 /* 3514 * Leave tracks in the cryptostats. 3515 */ 3516 if ((ptr = strrchr(linkname, '\n')) != NULL) 3517 *ptr = '\0'; 3518 snprintf(statstr, NTP_MAXSTRLEN, "%s mod %d", &linkname[2], 3519 EVP_PKEY_size(pkey) * 8); 3520 record_crypto_stats(addr, statstr); 3521#ifdef DEBUG 3522 if (debug) 3523 printf("crypto_key: %s\n", statstr); 3524 if (debug > 1) { 3525 if (pkey->type == EVP_PKEY_DSA) 3526 DSA_print_fp(stdout, pkey->pkey.dsa, 0); 3527 else if (pkey->type == EVP_PKEY_RSA) 3528 RSA_print_fp(stdout, pkey->pkey.rsa, 0); 3529 } 3530#endif 3531 return (pkp); 3532} 3533 3534 3535/* 3536 *********************************************************************** 3537 * * 3538 * The following routines are used only at initialization time * 3539 * * 3540 *********************************************************************** 3541 */ 3542/* 3543 * crypto_cert - load certificate from file 3544 * 3545 * This routine loads an X.509 RSA or DSA certificate from a file and 3546 * constructs a info/cert value structure for this machine. The 3547 * structure includes a filestamp extracted from the file name. Later 3548 * the certificate can be sent to another machine on request. 3549 * 3550 * Returns certificate info/value pointer if valid, NULL if not. 3551 */ 3552static struct cert_info * /* certificate information */ 3553crypto_cert( 3554 char *cp /* file name */ 3555 ) 3556{ 3557 struct cert_info *ret; /* certificate information */ 3558 FILE *str; /* file handle */ 3559 char filename[MAXFILENAME]; /* name of certificate file */ 3560 char linkname[MAXFILENAME]; /* filestamp buffer */ 3561 char statstr[NTP_MAXSTRLEN]; /* statistics for filegen */ 3562 tstamp_t fstamp; /* filestamp */ 3563 long len; 3564 char *ptr; 3565 char *name, *header; 3566 u_char *data; 3567 3568 /* 3569 * Open the certificate file. If the first character of the file 3570 * name is not '/', prepend the keys directory string. If 3571 * something goes wrong, abandon ship. 3572 */ 3573 if (*cp == '/') 3574 strcpy(filename, cp); 3575 else 3576 snprintf(filename, MAXFILENAME, "%s/%s", keysdir, cp); 3577 str = fopen(filename, "r"); 3578 if (str == NULL) 3579 return (NULL); 3580 3581 /* 3582 * Read the filestamp, which is contained in the first line. 3583 */ 3584 if ((ptr = fgets(linkname, MAXFILENAME, str)) == NULL) { 3585 msyslog(LOG_ERR, "crypto_cert: empty file %s", 3586 filename); 3587 fclose(str); 3588 return (NULL); 3589 } 3590 if ((ptr = strrchr(ptr, '.')) == NULL) { 3591 msyslog(LOG_ERR, "crypto_cert: no filestamp %s\n", 3592 filename); 3593 fclose(str); 3594 return (NULL); 3595 } 3596 if (sscanf(++ptr, "%u", &fstamp) != 1) { 3597 msyslog(LOG_ERR, "crypto_cert: invalid filestamp %s\n", 3598 filename); 3599 fclose(str); 3600 return (NULL); 3601 } 3602 3603 /* 3604 * Read PEM-encoded certificate and install. 3605 */ 3606 if (!PEM_read(str, &name, &header, &data, &len)) { 3607 msyslog(LOG_ERR, "crypto_cert: %s\n", 3608 ERR_error_string(ERR_get_error(), NULL)); 3609 fclose(str); 3610 return (NULL); 3611 } 3612 fclose(str); 3613 free(header); 3614 if (strcmp(name, "CERTIFICATE") != 0) { 3615 msyslog(LOG_NOTICE, "crypto_cert: wrong PEM type %s", 3616 name); 3617 free(name); 3618 free(data); 3619 return (NULL); 3620 } 3621 free(name); 3622 3623 /* 3624 * Parse certificate and generate info/value structure. The 3625 * pointer and copy nonsense is due something broken in Solaris. 3626 */ 3627 ret = cert_parse(data, len, fstamp); 3628 free(data); 3629 if (ret == NULL) 3630 return (NULL); 3631 3632 if ((ptr = strrchr(linkname, '\n')) != NULL) 3633 *ptr = '\0'; 3634 snprintf(statstr, NTP_MAXSTRLEN, "%s 0x%x len %lu", 3635 &linkname[2], ret->flags, len); 3636 record_crypto_stats(NULL, statstr); 3637#ifdef DEBUG 3638 if (debug) 3639 printf("crypto_cert: %s\n", statstr); 3640#endif 3641 return (ret); 3642} 3643 3644 3645/* 3646 * crypto_setup - load keys, certificate and identity parameters 3647 * 3648 * This routine loads the public/private host key and certificate. If 3649 * available, it loads the public/private sign key, which defaults to 3650 * the host key. The host key must be RSA, but the sign key can be 3651 * either RSA or DSA. If a trusted certificate, it loads the identity 3652 * parameters. In either case, the public key on the certificate must 3653 * agree with the sign key. 3654 * 3655 * Required but missing files and inconsistent data and errors are 3656 * fatal. Allowing configuration to continue would be hazardous and 3657 * require really messy error checks. 3658 */ 3659void 3660crypto_setup(void) 3661{ 3662 struct pkey_info *pinfo; /* private/public key */ 3663 char filename[MAXFILENAME]; /* file name buffer */ 3664 char * randfile; 3665 char statstr[NTP_MAXSTRLEN]; /* statistics for filegen */ 3666 l_fp seed; /* crypto PRNG seed as NTP timestamp */ 3667 u_int len; 3668 int bytes; 3669 u_char *ptr; 3670 3671 /* 3672 * Check for correct OpenSSL version and avoid initialization in 3673 * the case of multiple crypto commands. 3674 */ 3675 if (crypto_flags & CRYPTO_FLAG_ENAB) { 3676 msyslog(LOG_NOTICE, 3677 "crypto_setup: spurious crypto command"); 3678 return; 3679 } 3680 ssl_check_version(); 3681 3682 /* 3683 * Load required random seed file and seed the random number 3684 * generator. Be default, it is found as .rnd in the user home 3685 * directory. The root home directory may be / or /root, 3686 * depending on the system. Wiggle the contents a bit and write 3687 * it back so the sequence does not repeat when we next restart. 3688 */ 3689 if (!RAND_status()) { 3690 if (rand_file == NULL) { 3691 RAND_file_name(filename, sizeof(filename)); 3692 randfile = filename; 3693 } else if (*rand_file != '/') { 3694 snprintf(filename, sizeof(filename), "%s/%s", 3695 keysdir, rand_file); 3696 randfile = filename; 3697 } else 3698 randfile = rand_file; 3699 3700 if ((bytes = RAND_load_file(randfile, -1)) == 0) { 3701 msyslog(LOG_ERR, 3702 "crypto_setup: random seed file %s missing", 3703 randfile); 3704 exit (-1); 3705 } 3706 get_systime(&seed); 3707 RAND_seed(&seed, sizeof(l_fp)); 3708 RAND_write_file(randfile); 3709#ifdef DEBUG 3710 if (debug) 3711 printf( 3712 "crypto_setup: OpenSSL version %lx random seed file %s bytes read %d\n", 3713 SSLeay(), randfile, bytes); 3714#endif 3715 } 3716 3717 /* 3718 * Initialize structures. 3719 */ 3720 if (sys_hostname == NULL) { 3721 gethostname(filename, MAXFILENAME); 3722 sys_hostname = emalloc(strlen(filename) + 1); 3723 strcpy(sys_hostname, filename); 3724 } 3725 if (passwd == NULL) 3726 passwd = sys_hostname; 3727 memset(&hostval, 0, sizeof(hostval)); 3728 memset(&pubkey, 0, sizeof(pubkey)); 3729 memset(&tai_leap, 0, sizeof(tai_leap)); 3730 3731 /* 3732 * Load required host key from file "ntpkey_host_<hostname>". If 3733 * no host key file is not found or has invalid password, life 3734 * as we know it ends. The host key also becomes the default 3735 * sign key. 3736 */ 3737 snprintf(filename, MAXFILENAME, "ntpkey_host_%s", sys_hostname); 3738 pinfo = crypto_key(filename, passwd, NULL); 3739 if (pinfo == NULL) { 3740 msyslog(LOG_ERR, 3741 "crypto_setup: host key file %s not found or corrupt", 3742 filename); 3743 exit (-1); 3744 } 3745 if (pinfo->pkey->type != EVP_PKEY_RSA) { 3746 msyslog(LOG_ERR, 3747 "crypto_setup: host key is not RSA key type"); 3748 exit (-1); 3749 } 3750 host_pkey = pinfo->pkey; 3751 sign_pkey = host_pkey; 3752 hostval.fstamp = htonl(pinfo->fstamp); 3753 3754 /* 3755 * Construct public key extension field for agreement scheme. 3756 */ 3757 len = i2d_PublicKey(host_pkey, NULL); 3758 ptr = emalloc(len); 3759 pubkey.ptr = ptr; 3760 i2d_PublicKey(host_pkey, &ptr); 3761 pubkey.fstamp = hostval.fstamp; 3762 pubkey.vallen = htonl(len); 3763 3764 /* 3765 * Load optional sign key from file "ntpkey_sign_<hostname>". If 3766 * available, it becomes the sign key. 3767 */ 3768 snprintf(filename, MAXFILENAME, "ntpkey_sign_%s", sys_hostname); 3769 pinfo = crypto_key(filename, passwd, NULL); if (pinfo != NULL) 3770 sign_pkey = pinfo->pkey; 3771 3772 /* 3773 * Load required certificate from file "ntpkey_cert_<hostname>". 3774 */ 3775 snprintf(filename, MAXFILENAME, "ntpkey_cert_%s", sys_hostname); 3776 cinfo = crypto_cert(filename); 3777 if (cinfo == NULL) { 3778 msyslog(LOG_ERR, 3779 "crypto_setup: certificate file %s not found or corrupt", 3780 filename); 3781 exit (-1); 3782 } 3783 cert_host = cinfo; 3784 sign_digest = cinfo->digest; 3785 sign_siglen = EVP_PKEY_size(sign_pkey); 3786 if (cinfo->flags & CERT_PRIV) 3787 crypto_flags |= CRYPTO_FLAG_PRIV; 3788 3789 /* 3790 * The certificate must be self-signed. 3791 */ 3792 if (strcmp(cinfo->subject, cinfo->issuer) != 0) { 3793 msyslog(LOG_ERR, 3794 "crypto_setup: certificate %s is not self-signed", 3795 filename); 3796 exit (-1); 3797 } 3798 hostval.vallen = htonl(strlen(cinfo->subject)); 3799 hostval.ptr = cinfo->subject; 3800 3801 /* 3802 * If trusted certificate, the subject name must match the group 3803 * name. 3804 */ 3805 if (cinfo->flags & CERT_TRUST) { 3806 if (sys_groupname == NULL) { 3807 sys_groupname = hostval.ptr; 3808 } else if (strcmp(hostval.ptr, sys_groupname) != 0) { 3809 msyslog(LOG_ERR, 3810 "crypto_setup: trusted certificate name %s does not match group name %s", 3811 hostval.ptr, sys_groupname); 3812 exit (-1); 3813 } 3814 } 3815 if (sys_groupname != NULL) { 3816 3817 /* 3818 * Load optional IFF parameters from file 3819 * "ntpkey_iffkey_<groupname>". 3820 */ 3821 snprintf(filename, MAXFILENAME, "ntpkey_iffkey_%s", 3822 sys_groupname); 3823 iffkey_info = crypto_key(filename, passwd, NULL); 3824 if (iffkey_info != NULL) 3825 crypto_flags |= CRYPTO_FLAG_IFF; 3826 3827 /* 3828 * Load optional GQ parameters from file 3829 * "ntpkey_gqkey_<groupname>". 3830 */ 3831 snprintf(filename, MAXFILENAME, "ntpkey_gqkey_%s", 3832 sys_groupname); 3833 gqkey_info = crypto_key(filename, passwd, NULL); 3834 if (gqkey_info != NULL) 3835 crypto_flags |= CRYPTO_FLAG_GQ; 3836 3837 /* 3838 * Load optional MV parameters from file 3839 * "ntpkey_mvkey_<groupname>". 3840 */ 3841 snprintf(filename, MAXFILENAME, "ntpkey_mvkey_%s", 3842 sys_groupname); 3843 mvkey_info = crypto_key(filename, passwd, NULL); 3844 if (mvkey_info != NULL) 3845 crypto_flags |= CRYPTO_FLAG_MV; 3846 } 3847 3848 /* 3849 * We met the enemy and he is us. Now strike up the dance. 3850 */ 3851 crypto_flags |= CRYPTO_FLAG_ENAB | (cinfo->nid << 16); 3852 snprintf(statstr, NTP_MAXSTRLEN, 3853 "setup 0x%x host %s %s", crypto_flags, sys_hostname, 3854 OBJ_nid2ln(cinfo->nid)); 3855 record_crypto_stats(NULL, statstr); 3856#ifdef DEBUG 3857 if (debug) 3858 printf("crypto_setup: %s\n", statstr); 3859#endif 3860} 3861 3862 3863/* 3864 * crypto_config - configure data from the crypto command. 3865 */ 3866void 3867crypto_config( 3868 int item, /* configuration item */ 3869 char *cp /* item name */ 3870 ) 3871{ 3872 int nid; 3873 3874#ifdef DEBUG 3875 if (debug > 1) 3876 printf("crypto_config: item %d %s\n", item, cp); 3877#endif 3878 switch (item) { 3879 3880 /* 3881 * Set host name (host). 3882 */ 3883 case CRYPTO_CONF_PRIV: 3884 sys_hostname = emalloc(strlen(cp) + 1); 3885 strcpy(sys_hostname, cp); 3886 break; 3887 3888 /* 3889 * Set group name (ident). 3890 */ 3891 case CRYPTO_CONF_IDENT: 3892 sys_groupname = emalloc(strlen(cp) + 1); 3893 strcpy(sys_groupname, cp); 3894 break; 3895 3896 /* 3897 * Set private key password (pw). 3898 */ 3899 case CRYPTO_CONF_PW: 3900 passwd = emalloc(strlen(cp) + 1); 3901 strcpy(passwd, cp); 3902 break; 3903 3904 /* 3905 * Set random seed file name (randfile). 3906 */ 3907 case CRYPTO_CONF_RAND: 3908 rand_file = emalloc(strlen(cp) + 1); 3909 strcpy(rand_file, cp); 3910 break; 3911 3912 /* 3913 * Set message digest NID. 3914 */ 3915 case CRYPTO_CONF_NID: 3916 nid = OBJ_sn2nid(cp); 3917 if (nid == 0) 3918 msyslog(LOG_ERR, 3919 "crypto_config: invalid digest name %s", cp); 3920 else 3921 crypto_nid = nid; 3922 break; 3923 } 3924} 3925# else 3926int ntp_crypto_bs_pubkey; 3927# endif /* OPENSSL */ 3928