/contrib/ntp/ntpd/ntp_crypto.c
C | 4189 lines | 2414 code | 326 blank | 1449 comment | 577 complexity | 24628f797239e75d9f4988848ef9a38c MD5 | raw file
Large files files are truncated, but you can click here to view the full file
1/* 2 * ntp_crypto.c - NTP version 4 public key routines 3 */ 4#ifdef HAVE_CONFIG_H 5#include <config.h> 6#endif 7 8#ifdef OPENSSL 9#include <stdio.h> 10#include <sys/types.h> 11#include <sys/param.h> 12#include <unistd.h> 13#include <fcntl.h> 14 15#include "ntpd.h" 16#include "ntp_stdlib.h" 17#include "ntp_unixtime.h" 18#include "ntp_string.h" 19#include <ntp_random.h> 20 21#include "openssl/asn1_mac.h" 22#include "openssl/bn.h" 23#include "openssl/err.h" 24#include "openssl/evp.h" 25#include "openssl/pem.h" 26#include "openssl/rand.h" 27#include "openssl/x509v3.h" 28 29#ifdef KERNEL_PLL 30#include "ntp_syscall.h" 31#endif /* KERNEL_PLL */ 32 33/* 34 * Extension field message format 35 * 36 * These are always signed and saved before sending in network byte 37 * order. They must be converted to and from host byte order for 38 * processing. 39 * 40 * +-------+-------+ 41 * | op | len | <- extension pointer 42 * +-------+-------+ 43 * | assocID | 44 * +---------------+ 45 * | timestamp | <- value pointer 46 * +---------------+ 47 * | filestamp | 48 * +---------------+ 49 * | value len | 50 * +---------------+ 51 * | | 52 * = value = 53 * | | 54 * +---------------+ 55 * | signature len | 56 * +---------------+ 57 * | | 58 * = signature = 59 * | | 60 * +---------------+ 61 * 62 * The CRYPTO_RESP bit is set to 0 for requests, 1 for responses. 63 * Requests carry the association ID of the receiver; responses carry 64 * the association ID of the sender. Some messages include only the 65 * operation/length and association ID words and so have length 8 66 * octets. Ohers include the value structure and associated value and 67 * signature fields. These messages include the timestamp, filestamp, 68 * value and signature words and so have length at least 24 octets. The 69 * signature and/or value fields can be empty, in which case the 70 * respective length words are zero. An empty value with nonempty 71 * signature is syntactically valid, but semantically questionable. 72 * 73 * The filestamp represents the time when a cryptographic data file such 74 * as a public/private key pair is created. It follows every reference 75 * depending on that file and serves as a means to obsolete earlier data 76 * of the same type. The timestamp represents the time when the 77 * cryptographic data of the message were last signed. Creation of a 78 * cryptographic data file or signing a message can occur only when the 79 * creator or signor is synchronized to an authoritative source and 80 * proventicated to a trusted authority. 81 * 82 * Note there are four conditions required for server trust. First, the 83 * public key on the certificate must be verified, which involves a 84 * number of format, content and consistency checks. Next, the server 85 * identity must be confirmed by one of four schemes: private 86 * certificate, IFF scheme, GQ scheme or certificate trail hike to a 87 * self signed trusted certificate. Finally, the server signature must 88 * be verified. 89 */ 90/* 91 * Cryptodefines 92 */ 93#define TAI_1972 10 /* initial TAI offset (s) */ 94#define MAX_LEAP 100 /* max UTC leapseconds (s) */ 95#define VALUE_LEN (6 * 4) /* min response field length */ 96#define YEAR (60 * 60 * 24 * 365) /* seconds in year */ 97 98/* 99 * Global cryptodata in host byte order 100 */ 101u_int32 crypto_flags = 0x0; /* status word */ 102 103/* 104 * Global cryptodata in network byte order 105 */ 106struct cert_info *cinfo = NULL; /* certificate info/value */ 107struct value hostval; /* host value */ 108struct value pubkey; /* public key */ 109struct value tai_leap; /* leapseconds table */ 110EVP_PKEY *iffpar_pkey = NULL; /* IFF parameters */ 111EVP_PKEY *gqpar_pkey = NULL; /* GQ parameters */ 112EVP_PKEY *mvpar_pkey = NULL; /* MV parameters */ 113char *iffpar_file = NULL; /* IFF parameters file */ 114char *gqpar_file = NULL; /* GQ parameters file */ 115char *mvpar_file = NULL; /* MV parameters file */ 116 117/* 118 * Private cryptodata in host byte order 119 */ 120static char *passwd = NULL; /* private key password */ 121static EVP_PKEY *host_pkey = NULL; /* host key */ 122static EVP_PKEY *sign_pkey = NULL; /* sign key */ 123static const EVP_MD *sign_digest = NULL; /* sign digest */ 124static u_int sign_siglen; /* sign key length */ 125static char *rand_file = NULL; /* random seed file */ 126static char *host_file = NULL; /* host key file */ 127static char *sign_file = NULL; /* sign key file */ 128static char *cert_file = NULL; /* certificate file */ 129static char *leap_file = NULL; /* leapseconds file */ 130static tstamp_t if_fstamp = 0; /* IFF filestamp */ 131static tstamp_t gq_fstamp = 0; /* GQ file stamp */ 132static tstamp_t mv_fstamp = 0; /* MV filestamp */ 133static u_int ident_scheme = 0; /* server identity scheme */ 134 135/* 136 * Cryptotypes 137 */ 138static int crypto_verify P((struct exten *, struct value *, 139 struct peer *)); 140static int crypto_encrypt P((struct exten *, struct value *, 141 keyid_t *)); 142static int crypto_alice P((struct peer *, struct value *)); 143static int crypto_alice2 P((struct peer *, struct value *)); 144static int crypto_alice3 P((struct peer *, struct value *)); 145static int crypto_bob P((struct exten *, struct value *)); 146static int crypto_bob2 P((struct exten *, struct value *)); 147static int crypto_bob3 P((struct exten *, struct value *)); 148static int crypto_iff P((struct exten *, struct peer *)); 149static int crypto_gq P((struct exten *, struct peer *)); 150static int crypto_mv P((struct exten *, struct peer *)); 151static u_int crypto_send P((struct exten *, struct value *)); 152static tstamp_t crypto_time P((void)); 153static u_long asn2ntp P((ASN1_TIME *)); 154static struct cert_info *cert_parse P((u_char *, u_int, tstamp_t)); 155static int cert_sign P((struct exten *, struct value *)); 156static int cert_valid P((struct cert_info *, EVP_PKEY *)); 157static int cert_install P((struct exten *, struct peer *)); 158static void cert_free P((struct cert_info *)); 159static EVP_PKEY *crypto_key P((char *, tstamp_t *)); 160static int bighash P((BIGNUM *, BIGNUM *)); 161static struct cert_info *crypto_cert P((char *)); 162static void crypto_tai P((char *)); 163 164#ifdef SYS_WINNT 165int 166readlink(char * link, char * file, int len) { 167 return (-1); 168} 169#endif 170 171/* 172 * session_key - generate session key 173 * 174 * This routine generates a session key from the source address, 175 * destination address, key ID and private value. The value of the 176 * session key is the MD5 hash of these values, while the next key ID is 177 * the first four octets of the hash. 178 * 179 * Returns the next key ID 180 */ 181keyid_t 182session_key( 183 struct sockaddr_storage *srcadr, /* source address */ 184 struct sockaddr_storage *dstadr, /* destination address */ 185 keyid_t keyno, /* key ID */ 186 keyid_t private, /* private value */ 187 u_long lifetime /* key lifetime */ 188 ) 189{ 190 EVP_MD_CTX ctx; /* message digest context */ 191 u_char dgst[EVP_MAX_MD_SIZE]; /* message digest */ 192 keyid_t keyid; /* key identifer */ 193 u_int32 header[10]; /* data in network byte order */ 194 u_int hdlen, len; 195 196 if (!dstadr) 197 return 0; 198 199 /* 200 * Generate the session key and key ID. If the lifetime is 201 * greater than zero, install the key and call it trusted. 202 */ 203 hdlen = 0; 204 switch(srcadr->ss_family) { 205 case AF_INET: 206 header[0] = ((struct sockaddr_in *)srcadr)->sin_addr.s_addr; 207 header[1] = ((struct sockaddr_in *)dstadr)->sin_addr.s_addr; 208 header[2] = htonl(keyno); 209 header[3] = htonl(private); 210 hdlen = 4 * sizeof(u_int32); 211 break; 212 213 case AF_INET6: 214 memcpy(&header[0], &GET_INADDR6(*srcadr), 215 sizeof(struct in6_addr)); 216 memcpy(&header[4], &GET_INADDR6(*dstadr), 217 sizeof(struct in6_addr)); 218 header[8] = htonl(keyno); 219 header[9] = htonl(private); 220 hdlen = 10 * sizeof(u_int32); 221 break; 222 } 223 EVP_DigestInit(&ctx, EVP_md5()); 224 EVP_DigestUpdate(&ctx, (u_char *)header, hdlen); 225 EVP_DigestFinal(&ctx, dgst, &len); 226 memcpy(&keyid, dgst, 4); 227 keyid = ntohl(keyid); 228 if (lifetime != 0) { 229 MD5auth_setkey(keyno, dgst, len); 230 authtrust(keyno, lifetime); 231 } 232#ifdef DEBUG 233 if (debug > 1) 234 printf( 235 "session_key: %s > %s %08x %08x hash %08x life %lu\n", 236 stoa(srcadr), stoa(dstadr), keyno, 237 private, keyid, lifetime); 238#endif 239 return (keyid); 240} 241 242 243/* 244 * make_keylist - generate key list 245 * 246 * Returns 247 * XEVNT_OK success 248 * XEVNT_PER host certificate expired 249 * 250 * This routine constructs a pseudo-random sequence by repeatedly 251 * hashing the session key starting from a given source address, 252 * destination address, private value and the next key ID of the 253 * preceeding session key. The last entry on the list is saved along 254 * with its sequence number and public signature. 255 */ 256int 257make_keylist( 258 struct peer *peer, /* peer structure pointer */ 259 struct interface *dstadr /* interface */ 260 ) 261{ 262 EVP_MD_CTX ctx; /* signature context */ 263 tstamp_t tstamp; /* NTP timestamp */ 264 struct autokey *ap; /* autokey pointer */ 265 struct value *vp; /* value pointer */ 266 keyid_t keyid = 0; /* next key ID */ 267 keyid_t cookie; /* private value */ 268 u_long lifetime; 269 u_int len, mpoll; 270 int i; 271 272 if (!dstadr) 273 return XEVNT_OK; 274 275 /* 276 * Allocate the key list if necessary. 277 */ 278 tstamp = crypto_time(); 279 if (peer->keylist == NULL) 280 peer->keylist = emalloc(sizeof(keyid_t) * 281 NTP_MAXSESSION); 282 283 /* 284 * Generate an initial key ID which is unique and greater than 285 * NTP_MAXKEY. 286 */ 287 while (1) { 288 keyid = (ntp_random() + NTP_MAXKEY + 1) & ((1 << 289 sizeof(keyid_t)) - 1); 290 if (authhavekey(keyid)) 291 continue; 292 break; 293 } 294 295 /* 296 * Generate up to NTP_MAXSESSION session keys. Stop if the 297 * next one would not be unique or not a session key ID or if 298 * it would expire before the next poll. The private value 299 * included in the hash is zero if broadcast mode, the peer 300 * cookie if client mode or the host cookie if symmetric modes. 301 */ 302 mpoll = 1 << min(peer->ppoll, peer->hpoll); 303 lifetime = min(sys_automax, NTP_MAXSESSION * mpoll); 304 if (peer->hmode == MODE_BROADCAST) 305 cookie = 0; 306 else 307 cookie = peer->pcookie; 308 for (i = 0; i < NTP_MAXSESSION; i++) { 309 peer->keylist[i] = keyid; 310 peer->keynumber = i; 311 keyid = session_key(&dstadr->sin, &peer->srcadr, keyid, 312 cookie, lifetime); 313 lifetime -= mpoll; 314 if (auth_havekey(keyid) || keyid <= NTP_MAXKEY || 315 lifetime <= mpoll) 316 break; 317 } 318 319 /* 320 * Save the last session key ID, sequence number and timestamp, 321 * then sign these values for later retrieval by the clients. Be 322 * careful not to use invalid key media. Use the public values 323 * timestamp as filestamp. 324 */ 325 vp = &peer->sndval; 326 if (vp->ptr == NULL) 327 vp->ptr = emalloc(sizeof(struct autokey)); 328 ap = (struct autokey *)vp->ptr; 329 ap->seq = htonl(peer->keynumber); 330 ap->key = htonl(keyid); 331 vp->tstamp = htonl(tstamp); 332 vp->fstamp = hostval.tstamp; 333 vp->vallen = htonl(sizeof(struct autokey)); 334 vp->siglen = 0; 335 if (tstamp != 0) { 336 if (tstamp < cinfo->first || tstamp > cinfo->last) 337 return (XEVNT_PER); 338 339 if (vp->sig == NULL) 340 vp->sig = emalloc(sign_siglen); 341 EVP_SignInit(&ctx, sign_digest); 342 EVP_SignUpdate(&ctx, (u_char *)vp, 12); 343 EVP_SignUpdate(&ctx, vp->ptr, sizeof(struct autokey)); 344 if (EVP_SignFinal(&ctx, vp->sig, &len, sign_pkey)) 345 vp->siglen = htonl(len); 346 else 347 msyslog(LOG_ERR, "make_keys %s\n", 348 ERR_error_string(ERR_get_error(), NULL)); 349 peer->flags |= FLAG_ASSOC; 350 } 351#ifdef DEBUG 352 if (debug) 353 printf("make_keys: %d %08x %08x ts %u fs %u poll %d\n", 354 ntohl(ap->seq), ntohl(ap->key), cookie, 355 ntohl(vp->tstamp), ntohl(vp->fstamp), peer->hpoll); 356#endif 357 return (XEVNT_OK); 358} 359 360 361/* 362 * crypto_recv - parse extension fields 363 * 364 * This routine is called when the packet has been matched to an 365 * association and passed sanity, format and MAC checks. We believe the 366 * extension field values only if the field has proper format and 367 * length, the timestamp and filestamp are valid and the signature has 368 * valid length and is verified. There are a few cases where some values 369 * are believed even if the signature fails, but only if the proventic 370 * bit is not set. 371 */ 372int 373crypto_recv( 374 struct peer *peer, /* peer structure pointer */ 375 struct recvbuf *rbufp /* packet buffer pointer */ 376 ) 377{ 378 const EVP_MD *dp; /* message digest algorithm */ 379 u_int32 *pkt; /* receive packet pointer */ 380 struct autokey *ap, *bp; /* autokey pointer */ 381 struct exten *ep, *fp; /* extension pointers */ 382 int has_mac; /* length of MAC field */ 383 int authlen; /* offset of MAC field */ 384 associd_t associd; /* association ID */ 385 tstamp_t tstamp = 0; /* timestamp */ 386 tstamp_t fstamp = 0; /* filestamp */ 387 u_int len; /* extension field length */ 388 u_int code; /* extension field opcode */ 389 u_int vallen = 0; /* value length */ 390 X509 *cert; /* X509 certificate */ 391 char statstr[NTP_MAXSTRLEN]; /* statistics for filegen */ 392 keyid_t cookie; /* crumbles */ 393 int hismode; /* packet mode */ 394 int rval = XEVNT_OK; 395 u_char *ptr; 396 u_int32 temp32; 397 398 /* 399 * Initialize. Note that the packet has already been checked for 400 * valid format and extension field lengths. First extract the 401 * field length, command code and association ID in host byte 402 * order. These are used with all commands and modes. Then check 403 * the version number, which must be 2, and length, which must 404 * be at least 8 for requests and VALUE_LEN (24) for responses. 405 * Packets that fail either test sink without a trace. The 406 * association ID is saved only if nonzero. 407 */ 408 authlen = LEN_PKT_NOMAC; 409 hismode = (int)PKT_MODE((&rbufp->recv_pkt)->li_vn_mode); 410 while ((has_mac = rbufp->recv_length - authlen) > MAX_MAC_LEN) { 411 pkt = (u_int32 *)&rbufp->recv_pkt + authlen / 4; 412 ep = (struct exten *)pkt; 413 code = ntohl(ep->opcode) & 0xffff0000; 414 len = ntohl(ep->opcode) & 0x0000ffff; 415 associd = (associd_t) ntohl(pkt[1]); 416 rval = XEVNT_OK; 417#ifdef DEBUG 418 if (debug) 419 printf( 420 "crypto_recv: flags 0x%x ext offset %d len %u code 0x%x assocID %d\n", 421 peer->crypto, authlen, len, code >> 16, 422 associd); 423#endif 424 425 /* 426 * Check version number and field length. If bad, 427 * quietly ignore the packet. 428 */ 429 if (((code >> 24) & 0x3f) != CRYPTO_VN || len < 8) { 430 sys_unknownversion++; 431 code |= CRYPTO_ERROR; 432 } 433 434 /* 435 * Little vulnerability bandage here. If a perp tosses a 436 * fake association ID over the fence, we better toss it 437 * out. Only the first one counts. 438 */ 439 if (code & CRYPTO_RESP) { 440 if (peer->assoc == 0) 441 peer->assoc = associd; 442 else if (peer->assoc != associd) 443 code |= CRYPTO_ERROR; 444 } 445 if (len >= VALUE_LEN) { 446 tstamp = ntohl(ep->tstamp); 447 fstamp = ntohl(ep->fstamp); 448 vallen = ntohl(ep->vallen); 449 } 450 switch (code) { 451 452 /* 453 * Install status word, host name, signature scheme and 454 * association ID. In OpenSSL the signature algorithm is 455 * bound to the digest algorithm, so the NID completely 456 * defines the signature scheme. Note the request and 457 * response are identical, but neither is validated by 458 * signature. The request is processed here only in 459 * symmetric modes. The server name field might be 460 * useful to implement access controls in future. 461 */ 462 case CRYPTO_ASSOC: 463 464 /* 465 * If the machine is running when this message 466 * arrives, the other fellow has reset and so 467 * must we. Otherwise, pass the extension field 468 * to the transmit side. 469 */ 470 if (peer->crypto) { 471 rval = XEVNT_ERR; 472 break; 473 } 474 fp = emalloc(len); 475 memcpy(fp, ep, len); 476 temp32 = CRYPTO_RESP; 477 fp->opcode |= htonl(temp32); 478 peer->cmmd = fp; 479 /* fall through */ 480 481 case CRYPTO_ASSOC | CRYPTO_RESP: 482 483 /* 484 * Discard the message if it has already been 485 * stored or the message has been amputated. 486 */ 487 if (peer->crypto) 488 break; 489 490 if (vallen == 0 || vallen > MAXHOSTNAME || 491 len < VALUE_LEN + vallen) { 492 rval = XEVNT_LEN; 493 break; 494 } 495 496 /* 497 * Check the identity schemes are compatible. If 498 * the client has PC, the server must have PC, 499 * in which case the server public key and 500 * identity are presumed valid, so we skip the 501 * certificate and identity exchanges and move 502 * immediately to the cookie exchange which 503 * confirms the server signature. 504 */ 505#ifdef DEBUG 506 if (debug) 507 printf( 508 "crypto_recv: ident host 0x%x server 0x%x\n", 509 crypto_flags, fstamp); 510#endif 511 temp32 = (crypto_flags | ident_scheme) & 512 fstamp & CRYPTO_FLAG_MASK; 513 if (crypto_flags & CRYPTO_FLAG_PRIV) { 514 if (!(fstamp & CRYPTO_FLAG_PRIV)) { 515 rval = XEVNT_KEY; 516 break; 517 518 } else { 519 fstamp |= CRYPTO_FLAG_VALID | 520 CRYPTO_FLAG_VRFY | 521 CRYPTO_FLAG_SIGN; 522 } 523 /* 524 * In symmetric modes it is an error if either 525 * peer requests identity and the other peer 526 * does not support it. 527 */ 528 } else if ((hismode == MODE_ACTIVE || hismode == 529 MODE_PASSIVE) && ((crypto_flags | fstamp) & 530 CRYPTO_FLAG_MASK) && !temp32) { 531 rval = XEVNT_KEY; 532 break; 533 /* 534 * It is an error if the client requests 535 * identity and the server does not support it. 536 */ 537 } else if (hismode == MODE_CLIENT && (fstamp & 538 CRYPTO_FLAG_MASK) && !temp32) { 539 rval = XEVNT_KEY; 540 break; 541 } 542 543 /* 544 * Otherwise, the identity scheme(s) are those 545 * that both client and server support. 546 */ 547 fstamp = temp32 | (fstamp & ~CRYPTO_FLAG_MASK); 548 549 /* 550 * Discard the message if the signature digest 551 * NID is not supported. 552 */ 553 temp32 = (fstamp >> 16) & 0xffff; 554 dp = 555 (const EVP_MD *)EVP_get_digestbynid(temp32); 556 if (dp == NULL) { 557 rval = XEVNT_MD; 558 break; 559 } 560 561 /* 562 * Save status word, host name and message 563 * digest/signature type. 564 */ 565 peer->crypto = fstamp; 566 peer->digest = dp; 567 peer->subject = emalloc(vallen + 1); 568 memcpy(peer->subject, ep->pkt, vallen); 569 peer->subject[vallen] = '\0'; 570 peer->issuer = emalloc(vallen + 1); 571 strcpy(peer->issuer, peer->subject); 572 temp32 = (fstamp >> 16) & 0xffff; 573 snprintf(statstr, NTP_MAXSTRLEN, 574 "flags 0x%x host %s signature %s", fstamp, 575 peer->subject, OBJ_nid2ln(temp32)); 576 record_crypto_stats(&peer->srcadr, statstr); 577#ifdef DEBUG 578 if (debug) 579 printf("crypto_recv: %s\n", statstr); 580#endif 581 break; 582 583 /* 584 * Decode X509 certificate in ASN.1 format and extract 585 * the data containing, among other things, subject 586 * name and public key. In the default identification 587 * scheme, the certificate trail is followed to a self 588 * signed trusted certificate. 589 */ 590 case CRYPTO_CERT | CRYPTO_RESP: 591 592 /* 593 * Discard the message if invalid. 594 */ 595 if ((rval = crypto_verify(ep, NULL, peer)) != 596 XEVNT_OK) 597 break; 598 599 /* 600 * Scan the certificate list to delete old 601 * versions and link the newest version first on 602 * the list. 603 */ 604 if ((rval = cert_install(ep, peer)) != XEVNT_OK) 605 break; 606 607 /* 608 * If we snatch the certificate before the 609 * server certificate has been signed by its 610 * server, it will be self signed. When it is, 611 * we chase the certificate issuer, which the 612 * server has, and keep going until a self 613 * signed trusted certificate is found. Be sure 614 * to update the issuer field, since it may 615 * change. 616 */ 617 if (peer->issuer != NULL) 618 free(peer->issuer); 619 peer->issuer = emalloc(strlen(cinfo->issuer) + 620 1); 621 strcpy(peer->issuer, cinfo->issuer); 622 623 /* 624 * We plug in the public key and lifetime from 625 * the first certificate received. However, note 626 * that this certificate might not be signed by 627 * the server, so we can't check the 628 * signature/digest NID. 629 */ 630 if (peer->pkey == NULL) { 631 ptr = (u_char *)cinfo->cert.ptr; 632 cert = d2i_X509(NULL, &ptr, 633 ntohl(cinfo->cert.vallen)); 634 peer->pkey = X509_get_pubkey(cert); 635 X509_free(cert); 636 } 637 peer->flash &= ~TEST8; 638 temp32 = cinfo->nid; 639 snprintf(statstr, NTP_MAXSTRLEN, 640 "cert %s 0x%x %s (%u) fs %u", 641 cinfo->subject, cinfo->flags, 642 OBJ_nid2ln(temp32), temp32, 643 ntohl(ep->fstamp)); 644 record_crypto_stats(&peer->srcadr, statstr); 645#ifdef DEBUG 646 if (debug) 647 printf("crypto_recv: %s\n", statstr); 648#endif 649 break; 650 651 /* 652 * Schnorr (IFF)identity scheme. This scheme is designed 653 * for use with shared secret group keys and where the 654 * certificate may be generated by a third party. The 655 * client sends a challenge to the server, which 656 * performs a calculation and returns the result. A 657 * positive result is possible only if both client and 658 * server contain the same secret group key. 659 */ 660 case CRYPTO_IFF | CRYPTO_RESP: 661 662 /* 663 * Discard the message if invalid or certificate 664 * trail not trusted. 665 */ 666 if (!(peer->crypto & CRYPTO_FLAG_VALID)) { 667 rval = XEVNT_ERR; 668 break; 669 } 670 if ((rval = crypto_verify(ep, NULL, peer)) != 671 XEVNT_OK) 672 break; 673 674 /* 675 * If the the challenge matches the response, 676 * the certificate public key, as well as the 677 * server public key, signatyre and identity are 678 * all verified at the same time. The server is 679 * declared trusted, so we skip further 680 * certificate stages and move immediately to 681 * the cookie stage. 682 */ 683 if ((rval = crypto_iff(ep, peer)) != XEVNT_OK) 684 break; 685 686 peer->crypto |= CRYPTO_FLAG_VRFY | 687 CRYPTO_FLAG_PROV; 688 peer->flash &= ~TEST8; 689 snprintf(statstr, NTP_MAXSTRLEN, "iff fs %u", 690 ntohl(ep->fstamp)); 691 record_crypto_stats(&peer->srcadr, statstr); 692#ifdef DEBUG 693 if (debug) 694 printf("crypto_recv: %s\n", statstr); 695#endif 696 break; 697 698 /* 699 * Guillou-Quisquater (GQ) identity scheme. This scheme 700 * is designed for use with public certificates carrying 701 * the GQ public key in an extension field. The client 702 * sends a challenge to the server, which performs a 703 * calculation and returns the result. A positive result 704 * is possible only if both client and server contain 705 * the same group key and the server has the matching GQ 706 * private key. 707 */ 708 case CRYPTO_GQ | CRYPTO_RESP: 709 710 /* 711 * Discard the message if invalid or certificate 712 * trail not trusted. 713 */ 714 if (!(peer->crypto & CRYPTO_FLAG_VALID)) { 715 rval = XEVNT_ERR; 716 break; 717 } 718 if ((rval = crypto_verify(ep, NULL, peer)) != 719 XEVNT_OK) 720 break; 721 722 /* 723 * If the the challenge matches the response, 724 * the certificate public key, as well as the 725 * server public key, signatyre and identity are 726 * all verified at the same time. The server is 727 * declared trusted, so we skip further 728 * certificate stages and move immediately to 729 * the cookie stage. 730 */ 731 if ((rval = crypto_gq(ep, peer)) != XEVNT_OK) 732 break; 733 734 peer->crypto |= CRYPTO_FLAG_VRFY | 735 CRYPTO_FLAG_PROV; 736 peer->flash &= ~TEST8; 737 snprintf(statstr, NTP_MAXSTRLEN, "gq fs %u", 738 ntohl(ep->fstamp)); 739 record_crypto_stats(&peer->srcadr, statstr); 740#ifdef DEBUG 741 if (debug) 742 printf("crypto_recv: %s\n", statstr); 743#endif 744 break; 745 746 /* 747 * MV 748 */ 749 case CRYPTO_MV | CRYPTO_RESP: 750 751 /* 752 * Discard the message if invalid or certificate 753 * trail not trusted. 754 */ 755 if (!(peer->crypto & CRYPTO_FLAG_VALID)) { 756 rval = XEVNT_ERR; 757 break; 758 } 759 if ((rval = crypto_verify(ep, NULL, peer)) != 760 XEVNT_OK) 761 break; 762 763 /* 764 * If the the challenge matches the response, 765 * the certificate public key, as well as the 766 * server public key, signatyre and identity are 767 * all verified at the same time. The server is 768 * declared trusted, so we skip further 769 * certificate stages and move immediately to 770 * the cookie stage. 771 */ 772 if ((rval = crypto_mv(ep, peer)) != XEVNT_OK) 773 break; 774 775 peer->crypto |= CRYPTO_FLAG_VRFY | 776 CRYPTO_FLAG_PROV; 777 peer->flash &= ~TEST8; 778 snprintf(statstr, NTP_MAXSTRLEN, "mv fs %u", 779 ntohl(ep->fstamp)); 780 record_crypto_stats(&peer->srcadr, statstr); 781#ifdef DEBUG 782 if (debug) 783 printf("crypto_recv: %s\n", statstr); 784#endif 785 break; 786 787 /* 788 * Cookie request in symmetric modes. Roll a random 789 * cookie and install in symmetric mode. Encrypt for the 790 * response, which is transmitted later. 791 */ 792 case CRYPTO_COOK: 793 794 /* 795 * Discard the message if invalid or certificate 796 * trail not trusted. 797 */ 798 if (!(peer->crypto & CRYPTO_FLAG_VALID)) { 799 rval = XEVNT_ERR; 800 break; 801 } 802 if ((rval = crypto_verify(ep, NULL, peer)) != 803 XEVNT_OK) 804 break; 805 806 /* 807 * Pass the extension field to the transmit 808 * side. If already agreed, walk away. 809 */ 810 fp = emalloc(len); 811 memcpy(fp, ep, len); 812 temp32 = CRYPTO_RESP; 813 fp->opcode |= htonl(temp32); 814 peer->cmmd = fp; 815 if (peer->crypto & CRYPTO_FLAG_AGREE) { 816 peer->flash &= ~TEST8; 817 break; 818 } 819 820 /* 821 * Install cookie values and light the cookie 822 * bit. The transmit side will pick up and 823 * encrypt it for the response. 824 */ 825 key_expire(peer); 826 peer->cookval.tstamp = ep->tstamp; 827 peer->cookval.fstamp = ep->fstamp; 828 RAND_bytes((u_char *)&peer->pcookie, 4); 829 peer->crypto &= ~CRYPTO_FLAG_AUTO; 830 peer->crypto |= CRYPTO_FLAG_AGREE; 831 peer->flash &= ~TEST8; 832 snprintf(statstr, NTP_MAXSTRLEN, "cook %x ts %u fs %u", 833 peer->pcookie, ntohl(ep->tstamp), 834 ntohl(ep->fstamp)); 835 record_crypto_stats(&peer->srcadr, statstr); 836#ifdef DEBUG 837 if (debug) 838 printf("crypto_recv: %s\n", statstr); 839#endif 840 break; 841 842 /* 843 * Cookie response in client and symmetric modes. If the 844 * cookie bit is set, the working cookie is the EXOR of 845 * the current and new values. 846 */ 847 case CRYPTO_COOK | CRYPTO_RESP: 848 849 /* 850 * Discard the message if invalid or identity 851 * not confirmed or signature not verified with 852 * respect to the cookie values. 853 */ 854 if (!(peer->crypto & CRYPTO_FLAG_VRFY)) { 855 rval = XEVNT_ERR; 856 break; 857 } 858 if ((rval = crypto_verify(ep, &peer->cookval, 859 peer)) != XEVNT_OK) 860 break; 861 862 /* 863 * Decrypt the cookie, hunting all the time for 864 * errors. 865 */ 866 if (vallen == (u_int) EVP_PKEY_size(host_pkey)) { 867 RSA_private_decrypt(vallen, 868 (u_char *)ep->pkt, 869 (u_char *)&temp32, 870 host_pkey->pkey.rsa, 871 RSA_PKCS1_OAEP_PADDING); 872 cookie = ntohl(temp32); 873 } else { 874 rval = XEVNT_CKY; 875 break; 876 } 877 878 /* 879 * Install cookie values and light the cookie 880 * bit. If this is not broadcast client mode, we 881 * are done here. 882 */ 883 key_expire(peer); 884 peer->cookval.tstamp = ep->tstamp; 885 peer->cookval.fstamp = ep->fstamp; 886 if (peer->crypto & CRYPTO_FLAG_AGREE) 887 peer->pcookie ^= cookie; 888 else 889 peer->pcookie = cookie; 890 if (peer->hmode == MODE_CLIENT && 891 !(peer->cast_flags & MDF_BCLNT)) 892 peer->crypto |= CRYPTO_FLAG_AUTO; 893 else 894 peer->crypto &= ~CRYPTO_FLAG_AUTO; 895 peer->crypto |= CRYPTO_FLAG_AGREE; 896 peer->flash &= ~TEST8; 897 snprintf(statstr, NTP_MAXSTRLEN, "cook %x ts %u fs %u", 898 peer->pcookie, ntohl(ep->tstamp), 899 ntohl(ep->fstamp)); 900 record_crypto_stats(&peer->srcadr, statstr); 901#ifdef DEBUG 902 if (debug) 903 printf("crypto_recv: %s\n", statstr); 904#endif 905 break; 906 907 /* 908 * Install autokey values in broadcast client and 909 * symmetric modes. We have to do this every time the 910 * sever/peer cookie changes or a new keylist is 911 * rolled. Ordinarily, this is automatic as this message 912 * is piggybacked on the first NTP packet sent upon 913 * either of these events. Note that a broadcast client 914 * or symmetric peer can receive this response without a 915 * matching request. 916 */ 917 case CRYPTO_AUTO | CRYPTO_RESP: 918 919 /* 920 * Discard the message if invalid or identity 921 * not confirmed or signature not verified with 922 * respect to the receive autokey values. 923 */ 924 if (!(peer->crypto & CRYPTO_FLAG_VRFY)) { 925 rval = XEVNT_ERR; 926 break; 927 } 928 if ((rval = crypto_verify(ep, &peer->recval, 929 peer)) != XEVNT_OK) 930 break; 931 932 /* 933 * Install autokey values and light the 934 * autokey bit. This is not hard. 935 */ 936 if (peer->recval.ptr == NULL) 937 peer->recval.ptr = 938 emalloc(sizeof(struct autokey)); 939 bp = (struct autokey *)peer->recval.ptr; 940 peer->recval.tstamp = ep->tstamp; 941 peer->recval.fstamp = ep->fstamp; 942 ap = (struct autokey *)ep->pkt; 943 bp->seq = ntohl(ap->seq); 944 bp->key = ntohl(ap->key); 945 peer->pkeyid = bp->key; 946 peer->crypto |= CRYPTO_FLAG_AUTO; 947 peer->flash &= ~TEST8; 948 snprintf(statstr, NTP_MAXSTRLEN, 949 "auto seq %d key %x ts %u fs %u", bp->seq, 950 bp->key, ntohl(ep->tstamp), 951 ntohl(ep->fstamp)); 952 record_crypto_stats(&peer->srcadr, statstr); 953#ifdef DEBUG 954 if (debug) 955 printf("crypto_recv: %s\n", statstr); 956#endif 957 break; 958 959 /* 960 * X509 certificate sign response. Validate the 961 * certificate signed by the server and install. Later 962 * this can be provided to clients of this server in 963 * lieu of the self signed certificate in order to 964 * validate the public key. 965 */ 966 case CRYPTO_SIGN | CRYPTO_RESP: 967 968 /* 969 * Discard the message if invalid or not 970 * proventic. 971 */ 972 if (!(peer->crypto & CRYPTO_FLAG_PROV)) { 973 rval = XEVNT_ERR; 974 break; 975 } 976 if ((rval = crypto_verify(ep, NULL, peer)) != 977 XEVNT_OK) 978 break; 979 980 /* 981 * Scan the certificate list to delete old 982 * versions and link the newest version first on 983 * the list. 984 */ 985 if ((rval = cert_install(ep, peer)) != XEVNT_OK) 986 break; 987 988 peer->crypto |= CRYPTO_FLAG_SIGN; 989 peer->flash &= ~TEST8; 990 temp32 = cinfo->nid; 991 snprintf(statstr, NTP_MAXSTRLEN, 992 "sign %s 0x%x %s (%u) fs %u", 993 cinfo->issuer, cinfo->flags, 994 OBJ_nid2ln(temp32), temp32, 995 ntohl(ep->fstamp)); 996 record_crypto_stats(&peer->srcadr, statstr); 997#ifdef DEBUG 998 if (debug) 999 printf("crypto_recv: %s\n", statstr); 1000#endif 1001 break; 1002 1003 /* 1004 * Install leapseconds table in symmetric modes. This 1005 * table is proventicated to the NIST primary servers, 1006 * either by copying the file containing the table from 1007 * a NIST server to a trusted server or directly using 1008 * this protocol. While the entire table is installed at 1009 * the server, presently only the current TAI offset is 1010 * provided via the kernel to other applications. 1011 */ 1012 case CRYPTO_TAI: 1013 1014 /* 1015 * Discard the message if invalid. 1016 */ 1017 if ((rval = crypto_verify(ep, NULL, peer)) != 1018 XEVNT_OK) 1019 break; 1020 1021 /* 1022 * Pass the extension field to the transmit 1023 * side. Continue below if a leapseconds table 1024 * accompanies the message. 1025 */ 1026 fp = emalloc(len); 1027 memcpy(fp, ep, len); 1028 temp32 = CRYPTO_RESP; 1029 fp->opcode |= htonl(temp32); 1030 peer->cmmd = fp; 1031 if (len <= VALUE_LEN) { 1032 peer->flash &= ~TEST8; 1033 break; 1034 } 1035 /* fall through */ 1036 1037 case CRYPTO_TAI | CRYPTO_RESP: 1038 1039 /* 1040 * If this is a response, discard the message if 1041 * signature not verified with respect to the 1042 * leapsecond table values. 1043 */ 1044 if (peer->cmmd == NULL) { 1045 if ((rval = crypto_verify(ep, 1046 &peer->tai_leap, peer)) != XEVNT_OK) 1047 break; 1048 } 1049 1050 /* 1051 * Initialize peer variables with latest update. 1052 */ 1053 peer->tai_leap.tstamp = ep->tstamp; 1054 peer->tai_leap.fstamp = ep->fstamp; 1055 peer->tai_leap.vallen = ep->vallen; 1056 1057 /* 1058 * Install the new table if there is no stored 1059 * table or the new table is more recent than 1060 * the stored table. Since a filestamp may have 1061 * changed, recompute the signatures. 1062 */ 1063 if (ntohl(peer->tai_leap.fstamp) > 1064 ntohl(tai_leap.fstamp)) { 1065 tai_leap.fstamp = ep->fstamp; 1066 tai_leap.vallen = ep->vallen; 1067 if (tai_leap.ptr != NULL) 1068 free(tai_leap.ptr); 1069 tai_leap.ptr = emalloc(vallen); 1070 memcpy(tai_leap.ptr, ep->pkt, vallen); 1071 crypto_update(); 1072 } 1073 crypto_flags |= CRYPTO_FLAG_TAI; 1074 peer->crypto |= CRYPTO_FLAG_LEAP; 1075 peer->flash &= ~TEST8; 1076 snprintf(statstr, NTP_MAXSTRLEN, 1077 "leap %u ts %u fs %u", vallen, 1078 ntohl(ep->tstamp), ntohl(ep->fstamp)); 1079 record_crypto_stats(&peer->srcadr, statstr); 1080#ifdef DEBUG 1081 if (debug) 1082 printf("crypto_recv: %s\n", statstr); 1083#endif 1084 break; 1085 1086 /* 1087 * We come here in symmetric modes for miscellaneous 1088 * commands that have value fields but are processed on 1089 * the transmit side. All we need do here is check for 1090 * valid field length. Remaining checks are below and on 1091 * the transmit side. 1092 */ 1093 case CRYPTO_CERT: 1094 case CRYPTO_IFF: 1095 case CRYPTO_GQ: 1096 case CRYPTO_MV: 1097 case CRYPTO_SIGN: 1098 if (len < VALUE_LEN) { 1099 rval = XEVNT_LEN; 1100 break; 1101 } 1102 /* fall through */ 1103 1104 /* 1105 * We come here for miscellaneous requests and unknown 1106 * requests and responses. If an unknown response or 1107 * error, forget it. If a request, save the extension 1108 * field for later. Unknown requests will be caught on 1109 * the transmit side. 1110 */ 1111 default: 1112 if (code & (CRYPTO_RESP | CRYPTO_ERROR)) { 1113 rval = XEVNT_ERR; 1114 } else if ((rval = crypto_verify(ep, NULL, 1115 peer)) == XEVNT_OK) { 1116 fp = emalloc(len); 1117 memcpy(fp, ep, len); 1118 temp32 = CRYPTO_RESP; 1119 fp->opcode |= htonl(temp32); 1120 peer->cmmd = fp; 1121 } 1122 } 1123 1124 /* 1125 * We don't log length/format/timestamp errors and 1126 * duplicates, which are log clogging vulnerabilities. 1127 * The first error found terminates the extension field 1128 * scan and we return the laundry to the caller. A 1129 * length/format/timestamp error on transmit is 1130 * cheerfully ignored, as the message is not sent. 1131 */ 1132 if (rval > XEVNT_TSP) { 1133 snprintf(statstr, NTP_MAXSTRLEN, 1134 "error %x opcode %x ts %u fs %u", rval, 1135 code, tstamp, fstamp); 1136 record_crypto_stats(&peer->srcadr, statstr); 1137 report_event(rval, peer); 1138#ifdef DEBUG 1139 if (debug) 1140 printf("crypto_recv: %s\n", statstr); 1141#endif 1142 break; 1143 1144 } else if (rval > XEVNT_OK && (code & CRYPTO_RESP)) { 1145 rval = XEVNT_OK; 1146 } 1147 authlen += len; 1148 } 1149 return (rval); 1150} 1151 1152 1153/* 1154 * crypto_xmit - construct extension fields 1155 * 1156 * This routine is called both when an association is configured and 1157 * when one is not. The only case where this matters is to retrieve the 1158 * autokey information, in which case the caller has to provide the 1159 * association ID to match the association. 1160 * 1161 * Returns length of extension field. 1162 */ 1163int 1164crypto_xmit( 1165 struct pkt *xpkt, /* transmit packet pointer */ 1166 struct sockaddr_storage *srcadr_sin, /* active runway */ 1167 int start, /* offset to extension field */ 1168 struct exten *ep, /* extension pointer */ 1169 keyid_t cookie /* session cookie */ 1170 ) 1171{ 1172 u_int32 *pkt; /* packet pointer */ 1173 struct peer *peer; /* peer structure pointer */ 1174 u_int opcode; /* extension field opcode */ 1175 struct exten *fp; /* extension pointers */ 1176 struct cert_info *cp, *xp; /* certificate info/value pointer */ 1177 char certname[MAXHOSTNAME + 1]; /* subject name buffer */ 1178 char statstr[NTP_MAXSTRLEN]; /* statistics for filegen */ 1179 tstamp_t tstamp; 1180 u_int vallen; 1181 u_int len; 1182 struct value vtemp; 1183 associd_t associd; 1184 int rval; 1185 keyid_t tcookie; 1186 1187 /* 1188 * Generate the requested extension field request code, length 1189 * and association ID. If this is a response and the host is not 1190 * synchronized, light the error bit and go home. 1191 */ 1192 pkt = (u_int32 *)xpkt + start / 4; 1193 fp = (struct exten *)pkt; 1194 opcode = ntohl(ep->opcode); 1195 associd = (associd_t) ntohl(ep->associd); 1196 fp->associd = htonl(associd); 1197 len = 8; 1198 rval = XEVNT_OK; 1199 tstamp = crypto_time(); 1200 switch (opcode & 0xffff0000) { 1201 1202 /* 1203 * Send association request and response with status word and 1204 * host name. Note, this message is not signed and the filestamp 1205 * contains only the status word. 1206 */ 1207 case CRYPTO_ASSOC | CRYPTO_RESP: 1208 len += crypto_send(fp, &hostval); 1209 fp->fstamp = htonl(crypto_flags); 1210 break; 1211 1212 case CRYPTO_ASSOC: 1213 len += crypto_send(fp, &hostval); 1214 fp->fstamp = htonl(crypto_flags | ident_scheme); 1215 break; 1216 1217 /* 1218 * Send certificate request. Use the values from the extension 1219 * field. 1220 */ 1221 case CRYPTO_CERT: 1222 memset(&vtemp, 0, sizeof(vtemp)); 1223 vtemp.tstamp = ep->tstamp; 1224 vtemp.fstamp = ep->fstamp; 1225 vtemp.vallen = ep->vallen; 1226 vtemp.ptr = (u_char *)ep->pkt; 1227 len += crypto_send(fp, &vtemp); 1228 break; 1229 1230 /* 1231 * Send certificate response or sign request. Use the values 1232 * from the certificate cache. If the request contains no 1233 * subject name, assume the name of this host. This is for 1234 * backwards compatibility. Private certificates are never sent. 1235 */ 1236 case CRYPTO_SIGN: 1237 case CRYPTO_CERT | CRYPTO_RESP: 1238 vallen = ntohl(ep->vallen); 1239 if (vallen == 8) { 1240 strcpy(certname, sys_hostname); 1241 } else if (vallen == 0 || vallen > MAXHOSTNAME) { 1242 rval = XEVNT_LEN; 1243 break; 1244 1245 } else { 1246 memcpy(certname, ep->pkt, vallen); 1247 certname[vallen] = '\0'; 1248 } 1249 1250 /* 1251 * Find all certificates with matching subject. If a 1252 * self-signed, trusted certificate is found, use that. 1253 * If not, use the first one with matching subject. A 1254 * private certificate is never divulged or signed. 1255 */ 1256 xp = NULL; 1257 for (cp = cinfo; cp != NULL; cp = cp->link) { 1258 if (cp->flags & CERT_PRIV) 1259 continue; 1260 1261 if (strcmp(certname, cp->subject) == 0) { 1262 if (xp == NULL) 1263 xp = cp; 1264 if (strcmp(certname, cp->issuer) == 1265 0 && cp->flags & CERT_TRUST) { 1266 xp = cp; 1267 break; 1268 } 1269 } 1270 } 1271 1272 /* 1273 * Be careful who you trust. If not yet synchronized, 1274 * give back an empty response. If certificate not found 1275 * or beyond the lifetime, return an error. This is to 1276 * avoid a bad dude trying to get an expired certificate 1277 * re-signed. Otherwise, send it. 1278 * 1279 * Note the timestamp and filestamp are taken from the 1280 * certificate value structure. For all certificates the 1281 * timestamp is the latest signature update time. For 1282 * host and imported certificates the filestamp is the 1283 * creation epoch. For signed certificates the filestamp 1284 * is the creation epoch of the trusted certificate at 1285 * the base of the certificate trail. In principle, this 1286 * allows strong checking for signature masquerade. 1287 */ 1288 if (tstamp == 0) 1289 break; 1290 1291 if (xp == NULL) 1292 rval = XEVNT_CRT; 1293 else if (tstamp < xp->first || tstamp > xp->last) 1294 rval = XEVNT_SRV; 1295 else 1296 len += crypto_send(fp, &xp->cert); 1297 break; 1298 1299 /* 1300 * Send challenge in Schnorr (IFF) identity scheme. 1301 */ 1302 case CRYPTO_IFF: 1303 if ((peer = findpeerbyassoc(ep->pkt[0])) == NULL) { 1304 rval = XEVNT_ERR; 1305 break; 1306 } 1307 if ((rval = crypto_alice(peer, &vtemp)) == XEVNT_OK) { 1308 len += crypto_send(fp, &vtemp); 1309 value_free(&vtemp); 1310 } 1311 break; 1312 1313 /* 1314 * Send response in Schnorr (IFF) identity scheme. 1315 */ 1316 case CRYPTO_IFF | CRYPTO_RESP: 1317 if ((rval = crypto_bob(ep, &vtemp)) == XEVNT_OK) { 1318 len += crypto_send(fp, &vtemp); 1319 value_free(&vtemp); 1320 } 1321 break; 1322 1323 /* 1324 * Send challenge in Guillou-Quisquater (GQ) identity scheme. 1325 */ 1326 case CRYPTO_GQ: 1327 if ((peer = findpeerbyassoc(ep->pkt[0])) == NULL) { 1328 rval = XEVNT_ERR; 1329 break; 1330 } 1331 if ((rval = crypto_alice2(peer, &vtemp)) == XEVNT_OK) { 1332 len += crypto_send(fp, &vtemp); 1333 value_free(&vtemp); 1334 } 1335 break; 1336 1337 /* 1338 * Send response in Guillou-Quisquater (GQ) identity scheme. 1339 */ 1340 case CRYPTO_GQ | CRYPTO_RESP: 1341 if ((rval = crypto_bob2(ep, &vtemp)) == XEVNT_OK) { 1342 len += crypto_send(fp, &vtemp); 1343 value_free(&vtemp); 1344 } 1345 break; 1346 1347 /* 1348 * Send challenge in MV identity scheme. 1349 */ 1350 case CRYPTO_MV: 1351 if ((peer = findpeerbyassoc(ep->pkt[0])) == NULL) { 1352 rval = XEVNT_ERR; 1353 break; 1354 } 1355 if ((rval = crypto_alice3(peer, &vtemp)) == XEVNT_OK) { 1356 len += crypto_send(fp, &vtemp); 1357 value_free(&vtemp); 1358 } 1359 break; 1360 1361 /* 1362 * Send response in MV identity scheme. 1363 */ 1364 case CRYPTO_MV | CRYPTO_RESP: 1365 if ((rval = crypto_bob3(ep, &vtemp)) == XEVNT_OK) { 1366 len += crypto_send(fp, &vtemp); 1367 value_free(&vtemp); 1368 } 1369 break; 1370 1371 /* 1372 * Send certificate sign response. The integrity of the request 1373 * certificate has already been verified on the receive side. 1374 * Sign the response using the local server key. Use the 1375 * filestamp from the request and use the timestamp as the 1376 * current time. Light the error bit if the certificate is 1377 * invalid or contains an unverified signature. 1378 */ 1379 case CRYPTO_SIGN | CRYPTO_RESP: 1380 if ((rval = cert_sign(ep, &vtemp)) == XEVNT_OK) 1381 len += crypto_send(fp, &vtemp); 1382 value_free(&vtemp); 1383 break; 1384 1385 /* 1386 * Send public key and signature. Use the values from the public 1387 * key. 1388 */ 1389 case CRYPTO_COOK: 1390 len += crypto_send(fp, &pubkey); 1391 break; 1392 1393 /* 1394 * Encrypt and send cookie and signature. Light the error bit if 1395 * anything goes wrong. 1396 */ 1397 case CRYPTO_COOK | CRYPTO_RESP: 1398 if ((opcode & 0xffff) < VALUE_LEN) { 1399 rval = XEVNT_LEN; 1400 break; 1401 } 1402 if (PKT_MODE(xpkt->li_vn_mode) == MODE_SERVER) { 1403 tcookie = cookie; 1404 } else { 1405 if ((peer = findpeerbyassoc(associd)) == NULL) { 1406 rval = XEVNT_ERR; 1407 break; 1408 } 1409 tcookie = peer->pcookie; 1410 } 1411 if ((rval = crypto_encrypt(ep, &vtemp, &tcookie)) == 1412 XEVNT_OK) 1413 len += crypto_send(fp, &vtemp); 1414 value_free(&vtemp); 1415 break; 1416 1417 /* 1418 * Find peer and send autokey data and signature in broadcast 1419 * server and symmetric modes. Use the values in the autokey 1420 * structure. If no association is found, either the server has 1421 * restarted with new associations or some perp has replayed an 1422 * old message, in which case light the error bit. 1423 */ 1424 case CRYPTO_AUTO | CRYPTO_RESP: 1425 if ((peer = findpeerbyassoc(associd)) == NULL) { 1426 rval = XEVNT_ERR; 1427 break; 1428 } 1429 peer->flags &= ~FLAG_ASSOC; 1430 len += crypto_send(fp, &peer->sndval); 1431 break; 1432 1433 /* 1434 * Send leapseconds table and signature. Use the values from the 1435 * tai structure. If no table has been loaded, just send an 1436 * empty request. 1437 */ 1438 case CRYPTO_TAI: 1439 case CRYPTO_TAI | CRYPTO_RESP: 1440 if (crypto_flags & CRYPTO_FLAG_TAI) 1441 len += crypto_send(fp, &tai_leap); 1442 break; 1443 1444 /* 1445 * Default - Fall through for requests; for unknown responses, 1446 * flag as error. 1447 */ 1448 default: 1449 if (opcode & CRYPTO_RESP) 1450 rval = XEVNT_ERR; 1451 } 1452 1453 /* 1454 * In case of error, flame the log. If a request, toss the 1455 * puppy; if a response, return so the sender can flame, too. 1456 */ 1457 if (rval != XEVNT_OK) { 1458 opcode |= CRYPTO_ERROR; 1459 snprintf(statstr, NTP_MAXSTRLEN, 1460 "error %x opcode %x", rval, opcode); 1461 record_crypto_stats(srcadr_sin, statstr); 1462 report_event(rval, NULL); 1463#ifdef DEBUG 1464 if (debug) 1465 printf("crypto_xmit: %s\n", statstr); 1466#endif 1467 if (!(opcode & CRYPTO_RESP)) 1468 return (0); 1469 } 1470 1471 /* 1472 * Round up the field length to a multiple of 8 bytes and save 1473 * the request code and length. 1474 */ 1475 len = ((len + 7) / 8) * 8; 1476 fp->opcode = htonl((opcode & 0xffff0000) | len); 1477#ifdef DEBUG 1478 if (debug) 1479 printf( 1480 "crypto_xmit: flags 0x%x ext offset %d len %u code 0x%x assocID %d\n", 1481 crypto_flags, start, len, opcode >> 16, associd); 1482#endif 1483 return (len); 1484} 1485 1486 1487/* 1488 * crypto_verify - parse and verify the extension field and value 1489 * 1490 * Returns 1491 * XEVNT_OK success 1492 * XEVNT_LEN bad field format or length 1493 * XEVNT_TSP bad timestamp 1494 * XEVNT_FSP bad filestamp 1495 * XEVNT_PUB bad or missing public key 1496 * XEVNT_SGL bad signature length 1497 * XEVNT_SIG signature not verified 1498 * XEVNT_ERR protocol error 1499 */ 1500static int 1501crypto_verify( 1502 struct exten *ep, /* extension pointer */ 1503 struct value *vp, /* value pointer */ 1504 struct peer *peer /* peer structure pointer */ 1505 ) 1506{ 1507 EVP_PKEY *pkey; /* server public key */ 1508 EVP_MD_CTX ctx; /* signature context */ 1509 tstamp_t tstamp, tstamp1 = 0; /* timestamp */ 1510 tstamp_t fstamp, fstamp1 = 0; /* filestamp */ 1511 u_int vallen; /* value length */ 1512 u_int siglen; /* signature length */ 1513 u_int opcode, len; 1514 int i; 1515 1516 /* 1517 * We require valid opcode and field lengths, timestamp, 1518 * filestamp, public key, digest, signature length and 1519 * signature, where relevant. Note that preliminary length 1520 * checks are done in the main loop. 1521 */ 1522 len = ntohl(ep->opcode) & 0x0000ffff; 1523 opcode = ntohl(ep->opcode) & 0xffff0000; 1524 1525 /* 1526 * Check for valid operation code and protocol. The opcode must 1527 * not have the error bit set. If a response, it must have a 1528 * value header. If a request and does not contain a value 1529 * header, no need for further checking. 1530 */ 1531 if (opcode & CRYPTO_ERROR) 1532 return (XEVNT_ERR); 1533 1534 if (opcode & CRYPTO_RESP) { 1535 if (len < VALUE_LEN) 1536 return (XEVNT_LEN); 1537 } else { 1538 if (len < VALUE_LEN) 1539 return (XEVNT_OK); 1540 } 1541 1542 /* 1543 * We have a value header. Check for valid field lengths. The 1544 * field length must be long enough to contain the value header, 1545 * value and signature. Note both the value and signature fields 1546 * are rounded up to the next word. 1547 */ 1548 vallen = ntohl(ep->vallen); 1549 i = (vallen + 3) / 4; 1550 siglen = ntohl(ep->pkt[i++]); 1551 if (len < VALUE_LEN + ((vallen + 3) / 4) * 4 + ((siglen + 3) / 1552 4) * 4) 1553 return (XEVNT_LEN); 1554 1555 /* 1556 * Punt if this is a response with no data. Punt if this is a 1557 * request and a previous response is pending. 1558 */ 1559 if (opcode & CRYPTO_RESP) { 1560 if (vallen == 0) 1561 return (XEVNT_LEN); 1562 } else { 1563 if (peer->cmmd != NULL) 1564 return (XEVNT_LEN); 1565 } 1566 1567 /* 1568 * Check for valid timestamp and filestamp. If the timestamp is 1569 * zero, the sender is not synchronized and signatures are 1570 * disregarded. If not, the timestamp must not precede the 1571 * filestamp. The timestamp and filestamp must not precede the 1572 * corresponding values in the value structure, if present. Once 1573 * the autokey values have been installed, the timestamp must 1574 * always be later than the corresponding value in the value 1575 * structure. Duplicate timestamps are illegal once the cookie 1576 * has been validated. 1577 */ 1578 tstamp = ntohl(ep->tstamp); 1579 fstamp = ntohl(ep->fstamp); 1580 if (tstamp == 0) 1581 return (XEVNT_OK); 1582 1583 if (tstamp < fstamp) 1584 return (XEVNT_TSP); 1585 1586 if (vp != NULL) { 1587 tstamp1 = ntohl(vp->tstamp); 1588 fstamp1 = ntohl(vp->fstamp); 1589 if ((tstamp < tstamp1 || (tstamp == tstamp1 && 1590 (peer->crypto & CRYPTO_FLAG_AUTO)))) 1591 return (XEVNT_TSP); 1592 1593 if ((tstamp < fstamp1 || fstamp < fstamp1)) 1594 return (XEVNT_FSP); 1595 } 1596 1597 /* 1598 * Check for valid signature length, public key and digest 1599 * algorithm. 1600 */ 1601 if (crypto_flags & peer->crypto & CRYPTO_FLAG_PRIV) 1602 pkey = sign_pkey; 1603 else 1604 pkey = peer->pkey; 1605 if (siglen == 0 || pkey == NULL || peer->digest == NULL) 1606 return (XEVNT_OK); 1607 1608 if (siglen != (u_int)EVP_PKEY_size(pkey)) 1609 return (XEVNT_SGL); 1610 1611 /* 1612 * Darn, I thought we would never get here. Verify the 1613 * signature. If the identity exchange is verified, light the 1614 * proventic bit. If no client identity scheme is specified, 1615 * avoid doing the sign exchange. 1616 */ 1617 EVP_VerifyInit(&ctx, peer->digest); 1618 EVP_VerifyUpdate(&ctx, (u_char *)&ep->tstamp, vallen + 12); 1619 if (EVP_VerifyFinal(&ctx, (u_char *)&ep->pkt[i], siglen, pkey) <= 0) 1620 return (XEVNT_SIG); 1621 1622 if (peer->crypto & CRYPTO_FLAG_VRFY) { 1623 peer->crypto |= CRYPTO_FLAG_PROV; 1624 if (!(crypto_flags & CRYPTO_FLAG_MASK)) 1625 peer->crypto |= CRYPTO_FLAG_SIGN; 1626 } 1627 return (XEVNT_OK); 1628} 1629 1630 1631/* 1632 * crypto_encrypt - construct encrypted cookie and signature from 1633 * extension field and cookie 1634 * 1635 * Returns 1636 * XEVNT_OK success 1637 * XEVNT_PUB bad or missing public key 1638 * XEVNT_CKY bad or missing cookie 1639 * XEVNT_PER host certificate expired 1640 */ 1641static int 1642crypto_encrypt( 1643 struct exten *ep, /* extension pointer */ 1644 struct value *vp, /* value pointer */ 1645 keyid_t *cookie /* server cookie */ 1646 ) 1647{ 1648 EVP_PKEY *pkey; /* public key */ 1649 EVP_MD_CTX ctx; /* signature context */ 1650 tstamp_t tstamp; /* NTP timestamp */ 1651 u_int32 temp32; 1652 u_int len; 1653 u_char *ptr; 1654 1655 /* 1656 * Extract the public key from the request. 1657 */ 1658 len = ntohl(ep->vallen); 1659 ptr = (u_char *)ep->pkt; 1660 pkey = d2i_PublicKey(EVP_PKEY_RSA, NULL, &ptr, len); 1661 if (pkey == NULL) { 1662 msyslog(LOG_ERR, "crypto_encrypt %s\n", 1663 ERR_error_string(ERR_get_error(), NULL)); 1664 return (XEVNT_PUB); 1665 } 1666 1667 /* 1668 * Encrypt the cookie, encode in ASN.1 and sign. 1669 */ 1670 tstamp = crypto_time(); 1671 memset(vp, 0, sizeof(struct value)); 1672 vp->tstamp = htonl(tstamp); 1673 vp->fstamp = hostval.tstamp; 1674 len = EVP_PKEY_size(pkey); 1675 vp->vallen = htonl(len); 1676 vp->ptr = emalloc(len); 1677 temp32 = htonl(*cookie); 1678 if (!RSA_public_encrypt(4, (u_char *)&temp32, vp->ptr, 1679 pkey->pkey.rsa, RSA_PKCS1_OAEP_PADDING)) { 1680 msyslog(LOG_ERR, "crypto_encrypt %s\n", 1681 ERR_error_string(ERR_get_error(), NULL)); 1682 EVP_PKEY_free(pkey); 1683 return (XEVNT_CKY); 1684 } 1685 EVP_PKEY_free(pkey); 1686 vp->siglen = 0; 1687 if (tstamp == 0) 1688 return (XEVNT_OK); 1689 1690 if (tstamp < cinfo->first || tstamp > cinfo->last) 1691 return (XEVNT_PER); 1692 1693 vp->sig = emalloc(sign_siglen); 1694 EVP_SignInit(&ctx, sign_digest); 1695 EVP_SignUpdate(&ctx, (u_char *)&vp->tstamp, 12); 1696 EVP_SignUpdate(&ctx, vp->ptr, len); 1697 if (EVP_SignFinal(&ctx, vp->sig, &len, sign_pkey)) 1698 vp->siglen = htonl(len); 1699 return (XEVNT_OK); 1700} 1701 1702 1703/* 1704 * crypto_ident - construct extension field for identity scheme 1705 * 1706 * This routine determines which identity scheme is in use and 1707 * constructs an extension field for that scheme. 1708 */ 1709u_int 1710crypto_ident( 1711 struct peer *peer /* peer structure pointer */ 1712 ) 1713{ 1714 char filename[MAXFILENAME + 1]; 1715 1716 /* 1717 * If the server identity has already been verified, no further 1718 * action is necessary. Otherwise, try to load the identity file 1719 * of the certificate issuer. If the issuer file is not found, 1720 * try the host file. If nothing found, declare a cryptobust. 1721 * Note we can't get here unless the trusted certificate has 1722 * been found and the CRYPTO_FLAG_VALID bit is set, so the 1723 * certificate issuer is valid. 1724 */ 1725 if (peer->ident_pkey != NULL) 1726 EVP_PKEY_free(peer->ident_pkey); 1727 if (peer->crypto & CRYPTO_FLAG_GQ) { 1728 snprintf(filename, MAXFILENAME, "ntpkey_gq_%s", 1729 peer->issuer); 1730 peer->ident_pkey = crypto_key(filename, &peer->fstamp); 1731 if (peer->ident_pkey != NULL) 1732 return (CRYPTO_GQ); 1733 1734 snprintf(filename, MAXFILENAME, "ntpkey_gq_%s", 1735 sys_hostname); 1736 peer->ident_pkey = crypto_key(filename, &peer->fstamp); 1737 if (peer->ident_pkey != NULL) 1738 return (CRYPTO_GQ); 1739 } 1740 if (peer->crypto & CRYPTO_FLAG_IFF) { 1741 snprintf(filename, MAXFILENAME, "ntpkey_iff_%s", 1742 peer->issuer); 1743 peer->ident_pkey = crypto_key(filename, &peer->fstamp); 1744 if (peer->ident_pkey != NULL) 1745 return (CRYPTO_IFF); 1746 1747 snprintf(filename, MAXFILENAME, "ntpkey_iff_%s", 1748 sys_hostname); 1749 peer->ident_pkey = crypto_key(filename, &peer->fstamp); 1750 if (peer->ident_pkey != NULL) 1751 return (CRYPTO_IFF); 1752 } 1753 if (peer->crypto & CRYPTO_FLAG_MV) { 1754 snprintf(filename, MAXFILENAME, "ntpkey_mv_%s", 1755 peer->issuer); 1756 peer->ident_pkey = crypto_key(filename, &peer->fstamp); 1757 if (peer->ident_pkey != NULL) 1758 return (CRYPTO_MV); 1759 1760 snprintf(filename, MAXFILENAME, "ntpkey_mv_%s", 1761 sys_hostname); 1762 peer->ident_pkey = crypto_key(filename, &peer->fstamp); 1763 if (p…
Large files files are truncated, but you can click here to view the full file