1 /* 2 * ntp_crypto.c - NTP version 4 public key routines 3 */ 4 #ifdef HAVE_CONFIG_H 5 #include <config.h> 6 #endif 7 8 #ifdef AUTOKEY 9 #include <stdio.h> 10 #include <stdlib.h> /* strtoul */ 11 #include <sys/types.h> 12 #include <sys/param.h> 13 #include <unistd.h> 14 #include <fcntl.h> 15 16 #include "ntpd.h" 17 #include "ntp_stdlib.h" 18 #include "ntp_unixtime.h" 19 #include "ntp_string.h" 20 #include "ntp_random.h" 21 #include "ntp_assert.h" 22 #include "ntp_calendar.h" 23 #include "ntp_leapsec.h" 24 25 #include "openssl/asn1.h" 26 #include "openssl/bn.h" 27 #include "openssl/crypto.h" 28 #include "openssl/err.h" 29 #include "openssl/evp.h" 30 #include "openssl/opensslv.h" 31 #include "openssl/pem.h" 32 #include "openssl/rand.h" 33 #include "openssl/x509.h" 34 #include "openssl/x509v3.h" 35 #include "libssl_compat.h" 36 37 #ifdef KERNEL_PLL 38 #include "ntp_syscall.h" 39 #endif /* KERNEL_PLL */ 40 41 /* 42 * calcomp - compare two calendar structures, ignoring yearday and weekday; like strcmp 43 * No, it's not a plotter. If you don't understand that, you're too young. 44 */ 45 static int calcomp(struct calendar *pjd1, struct calendar *pjd2) 46 { 47 int32_t diff; /* large enough to hold the signed difference between two uint16_t values */ 48 49 diff = pjd1->year - pjd2->year; 50 if (diff < 0) return -1; else if (diff > 0) return 1; 51 /* same year; compare months */ 52 diff = pjd1->month - pjd2->month; 53 if (diff < 0) return -1; else if (diff > 0) return 1; 54 /* same year and month; compare monthday */ 55 diff = pjd1->monthday - pjd2->monthday; 56 if (diff < 0) return -1; else if (diff > 0) return 1; 57 /* same year and month and monthday; compare time */ 58 diff = pjd1->hour - pjd2->hour; 59 if (diff < 0) return -1; else if (diff > 0) return 1; 60 diff = pjd1->minute - pjd2->minute; 61 if (diff < 0) return -1; else if (diff > 0) return 1; 62 diff = pjd1->second - pjd2->second; 63 if (diff < 0) return -1; else if (diff > 0) return 1; 64 /* identical */ 65 return 0; 66 } 67 68 /* 69 * Extension field message format 70 * 71 * These are always signed and saved before sending in network byte 72 * order. They must be converted to and from host byte order for 73 * processing. 74 * 75 * +-------+-------+ 76 * | op | len | <- extension pointer 77 * +-------+-------+ 78 * | associd | 79 * +---------------+ 80 * | timestamp | <- value pointer 81 * +---------------+ 82 * | filestamp | 83 * +---------------+ 84 * | value len | 85 * +---------------+ 86 * | | 87 * = value = 88 * | | 89 * +---------------+ 90 * | signature len | 91 * +---------------+ 92 * | | 93 * = signature = 94 * | | 95 * +---------------+ 96 * 97 * The CRYPTO_RESP bit is set to 0 for requests, 1 for responses. 98 * Requests carry the association ID of the receiver; responses carry 99 * the association ID of the sender. Some messages include only the 100 * operation/length and association ID words and so have length 8 101 * octets. Ohers include the value structure and associated value and 102 * signature fields. These messages include the timestamp, filestamp, 103 * value and signature words and so have length at least 24 octets. The 104 * signature and/or value fields can be empty, in which case the 105 * respective length words are zero. An empty value with nonempty 106 * signature is syntactically valid, but semantically questionable. 107 * 108 * The filestamp represents the time when a cryptographic data file such 109 * as a public/private key pair is created. It follows every reference 110 * depending on that file and serves as a means to obsolete earlier data 111 * of the same type. The timestamp represents the time when the 112 * cryptographic data of the message were last signed. Creation of a 113 * cryptographic data file or signing a message can occur only when the 114 * creator or signor is synchronized to an authoritative source and 115 * proventicated to a trusted authority. 116 * 117 * Note there are several conditions required for server trust. First, 118 * the public key on the server certificate must be verified, which can 119 * involve a hike along the certificate trail to a trusted host. Next, 120 * the server trust must be confirmed by one of several identity 121 * schemes. Valid cryptographic values are signed with attached 122 * timestamp and filestamp. Individual packet trust is confirmed 123 * relative to these values by a message digest with keys generated by a 124 * reverse-order pseudorandom hash. 125 * 126 * State decomposition. These flags are lit in the order given. They are 127 * dim only when the association is demobilized. 128 * 129 * CRYPTO_FLAG_ENAB Lit upon acceptance of a CRYPTO_ASSOC message 130 * CRYPTO_FLAG_CERT Lit when a self-digned trusted certificate is 131 * accepted. 132 * CRYPTO_FLAG_VRFY Lit when identity is confirmed. 133 * CRYPTO_FLAG_PROV Lit when the first signature is verified. 134 * CRYPTO_FLAG_COOK Lit when a valid cookie is accepted. 135 * CRYPTO_FLAG_AUTO Lit when valid autokey values are accepted. 136 * CRYPTO_FLAG_SIGN Lit when the server signed certificate is 137 * accepted. 138 * CRYPTO_FLAG_LEAP Lit when the leapsecond values are accepted. 139 */ 140 /* 141 * Cryptodefines 142 */ 143 #define TAI_1972 10 /* initial TAI offset (s) */ 144 #define MAX_LEAP 100 /* max UTC leapseconds (s) */ 145 #define VALUE_LEN (6 * 4) /* min response field length */ 146 #define MAX_VALLEN (65535 - VALUE_LEN) 147 #define YEAR (60 * 60 * 24 * 365) /* seconds in year */ 148 149 /* 150 * Global cryptodata in host byte order 151 */ 152 u_int32 crypto_flags = 0x0; /* status word */ 153 int crypto_nid = KEY_TYPE_MD5; /* digest nid */ 154 char *sys_hostname = NULL; 155 char *sys_groupname = NULL; 156 static char *host_filename = NULL; /* host file name */ 157 static char *ident_filename = NULL; /* group file name */ 158 159 /* 160 * Global cryptodata in network byte order 161 */ 162 struct cert_info *cinfo = NULL; /* certificate info/value cache */ 163 struct cert_info *cert_host = NULL; /* host certificate */ 164 struct pkey_info *pkinfo = NULL; /* key info/value cache */ 165 struct value hostval; /* host value */ 166 struct value pubkey; /* public key */ 167 struct value tai_leap; /* leapseconds values */ 168 struct pkey_info *iffkey_info = NULL; /* IFF keys */ 169 struct pkey_info *gqkey_info = NULL; /* GQ keys */ 170 struct pkey_info *mvkey_info = NULL; /* MV keys */ 171 172 /* 173 * Private cryptodata in host byte order 174 */ 175 static char *passwd = NULL; /* private key password */ 176 static EVP_PKEY *host_pkey = NULL; /* host key */ 177 static EVP_PKEY *sign_pkey = NULL; /* sign key */ 178 static const EVP_MD *sign_digest = NULL; /* sign digest */ 179 static u_int sign_siglen; /* sign key length */ 180 static char *rand_file = NULL; /* random seed file */ 181 182 /* 183 * Cryptotypes 184 */ 185 static int crypto_verify (struct exten *, struct value *, 186 struct peer *); 187 static int crypto_encrypt (const u_char *, u_int, keyid_t *, 188 struct value *); 189 static int crypto_alice (struct peer *, struct value *); 190 static int crypto_alice2 (struct peer *, struct value *); 191 static int crypto_alice3 (struct peer *, struct value *); 192 static int crypto_bob (struct exten *, struct value *); 193 static int crypto_bob2 (struct exten *, struct value *); 194 static int crypto_bob3 (struct exten *, struct value *); 195 static int crypto_iff (struct exten *, struct peer *); 196 static int crypto_gq (struct exten *, struct peer *); 197 static int crypto_mv (struct exten *, struct peer *); 198 static int crypto_send (struct exten *, struct value *, int); 199 static tstamp_t crypto_time (void); 200 static void asn_to_calendar (const ASN1_TIME *, struct calendar*); 201 static struct cert_info *cert_parse (const u_char *, long, tstamp_t); 202 static int cert_sign (struct exten *, struct value *); 203 static struct cert_info *cert_install (struct exten *, struct peer *); 204 static int cert_hike (struct peer *, struct cert_info *); 205 static void cert_free (struct cert_info *); 206 static struct pkey_info *crypto_key (char *, char *, sockaddr_u *); 207 static void bighash (BIGNUM *, BIGNUM *); 208 static struct cert_info *crypto_cert (char *); 209 static u_int exten_payload_size(const struct exten *); 210 211 #ifdef SYS_WINNT 212 int 213 readlink(char * link, char * file, int len) { 214 return (-1); 215 } 216 #endif 217 218 /* 219 * session_key - generate session key 220 * 221 * This routine generates a session key from the source address, 222 * destination address, key ID and private value. The value of the 223 * session key is the MD5 hash of these values, while the next key ID is 224 * the first four octets of the hash. 225 * 226 * Returns the next key ID or 0 if there is no destination address. 227 */ 228 keyid_t 229 session_key( 230 sockaddr_u *srcadr, /* source address */ 231 sockaddr_u *dstadr, /* destination address */ 232 keyid_t keyno, /* key ID */ 233 keyid_t private, /* private value */ 234 u_long lifetime /* key lifetime */ 235 ) 236 { 237 EVP_MD_CTX *ctx; /* message digest context */ 238 u_char dgst[EVP_MAX_MD_SIZE]; /* message digest */ 239 keyid_t keyid; /* key identifer */ 240 u_int32 header[10]; /* data in network byte order */ 241 u_int hdlen, len; 242 243 if (!dstadr) 244 return 0; 245 246 /* 247 * Generate the session key and key ID. If the lifetime is 248 * greater than zero, install the key and call it trusted. 249 */ 250 hdlen = 0; 251 switch(AF(srcadr)) { 252 case AF_INET: 253 header[0] = NSRCADR(srcadr); 254 header[1] = NSRCADR(dstadr); 255 header[2] = htonl(keyno); 256 header[3] = htonl(private); 257 hdlen = 4 * sizeof(u_int32); 258 break; 259 260 case AF_INET6: 261 memcpy(&header[0], PSOCK_ADDR6(srcadr), 262 sizeof(struct in6_addr)); 263 memcpy(&header[4], PSOCK_ADDR6(dstadr), 264 sizeof(struct in6_addr)); 265 header[8] = htonl(keyno); 266 header[9] = htonl(private); 267 hdlen = 10 * sizeof(u_int32); 268 break; 269 } 270 ctx = EVP_MD_CTX_new(); 271 # if defined(OPENSSL) && defined(EVP_MD_CTX_FLAG_NON_FIPS_ALLOW) 272 /* [Bug 3457] set flags and don't kill them again */ 273 EVP_MD_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW); 274 EVP_DigestInit_ex(ctx, EVP_get_digestbynid(crypto_nid), NULL); 275 # else 276 EVP_DigestInit(ctx, EVP_get_digestbynid(crypto_nid)); 277 # endif 278 EVP_DigestUpdate(ctx, (u_char *)header, hdlen); 279 EVP_DigestFinal(ctx, dgst, &len); 280 EVP_MD_CTX_free(ctx); 281 memcpy(&keyid, dgst, 4); 282 keyid = ntohl(keyid); 283 if (lifetime != 0) { 284 MD5auth_setkey(keyno, crypto_nid, dgst, len, NULL); 285 authtrust(keyno, lifetime); 286 } 287 DPRINTF(2, ("session_key: %s > %s %08x %08x hash %08x life %lu\n", 288 stoa(srcadr), stoa(dstadr), keyno, 289 private, keyid, lifetime)); 290 291 return (keyid); 292 } 293 294 295 /* 296 * make_keylist - generate key list 297 * 298 * Returns 299 * XEVNT_OK success 300 * XEVNT_ERR protocol error 301 * 302 * This routine constructs a pseudo-random sequence by repeatedly 303 * hashing the session key starting from a given source address, 304 * destination address, private value and the next key ID of the 305 * preceeding session key. The last entry on the list is saved along 306 * with its sequence number and public signature. 307 */ 308 int 309 make_keylist( 310 struct peer *peer, /* peer structure pointer */ 311 struct interface *dstadr /* interface */ 312 ) 313 { 314 EVP_MD_CTX *ctx; /* signature context */ 315 tstamp_t tstamp; /* NTP timestamp */ 316 struct autokey *ap; /* autokey pointer */ 317 struct value *vp; /* value pointer */ 318 keyid_t keyid = 0; /* next key ID */ 319 keyid_t cookie; /* private value */ 320 long lifetime; 321 u_int len, mpoll; 322 int i; 323 324 if (!dstadr) 325 return XEVNT_ERR; 326 327 /* 328 * Allocate the key list if necessary. 329 */ 330 tstamp = crypto_time(); 331 if (peer->keylist == NULL) 332 peer->keylist = eallocarray(NTP_MAXSESSION, 333 sizeof(keyid_t)); 334 335 /* 336 * Generate an initial key ID which is unique and greater than 337 * NTP_MAXKEY. 338 */ 339 while (1) { 340 keyid = ntp_random() & 0xffffffff; 341 if (keyid <= NTP_MAXKEY) 342 continue; 343 344 if (authhavekey(keyid)) 345 continue; 346 break; 347 } 348 349 /* 350 * Generate up to NTP_MAXSESSION session keys. Stop if the 351 * next one would not be unique or not a session key ID or if 352 * it would expire before the next poll. The private value 353 * included in the hash is zero if broadcast mode, the peer 354 * cookie if client mode or the host cookie if symmetric modes. 355 */ 356 mpoll = 1U << min(peer->ppoll, peer->hpoll); 357 lifetime = min((1UL << sys_automax), NTP_MAXSESSION * mpoll); 358 if (peer->hmode == MODE_BROADCAST) 359 cookie = 0; 360 else 361 cookie = peer->pcookie; 362 for (i = 0; i < NTP_MAXSESSION; i++) { 363 peer->keylist[i] = keyid; 364 peer->keynumber = i; 365 keyid = session_key(&dstadr->sin, &peer->srcadr, keyid, 366 cookie, lifetime + mpoll); 367 lifetime -= mpoll; 368 if (auth_havekey(keyid) || keyid <= NTP_MAXKEY || 369 lifetime < 0 || tstamp == 0) 370 break; 371 } 372 373 /* 374 * Save the last session key ID, sequence number and timestamp, 375 * then sign these values for later retrieval by the clients. Be 376 * careful not to use invalid key media. Use the public values 377 * timestamp as filestamp. 378 */ 379 vp = &peer->sndval; 380 if (vp->ptr == NULL) 381 vp->ptr = emalloc(sizeof(struct autokey)); 382 ap = (struct autokey *)vp->ptr; 383 ap->seq = htonl(peer->keynumber); 384 ap->key = htonl(keyid); 385 vp->tstamp = htonl(tstamp); 386 vp->fstamp = hostval.tstamp; 387 vp->vallen = htonl(sizeof(struct autokey)); 388 vp->siglen = 0; 389 if (tstamp != 0) { 390 if (vp->sig == NULL) 391 vp->sig = emalloc(sign_siglen); 392 ctx = EVP_MD_CTX_new(); 393 EVP_SignInit(ctx, sign_digest); 394 EVP_SignUpdate(ctx, (u_char *)vp, 12); 395 EVP_SignUpdate(ctx, vp->ptr, sizeof(struct autokey)); 396 if (EVP_SignFinal(ctx, vp->sig, &len, sign_pkey)) { 397 INSIST(len <= sign_siglen); 398 vp->siglen = htonl(len); 399 peer->flags |= FLAG_ASSOC; 400 } 401 EVP_MD_CTX_free(ctx); 402 } 403 DPRINTF(1, ("make_keys: %d %08x %08x ts %u fs %u poll %d\n", 404 peer->keynumber, keyid, cookie, ntohl(vp->tstamp), 405 ntohl(vp->fstamp), peer->hpoll)); 406 return (XEVNT_OK); 407 } 408 409 410 /* 411 * crypto_recv - parse extension fields 412 * 413 * This routine is called when the packet has been matched to an 414 * association and passed sanity, format and MAC checks. We believe the 415 * extension field values only if the field has proper format and 416 * length, the timestamp and filestamp are valid and the signature has 417 * valid length and is verified. There are a few cases where some values 418 * are believed even if the signature fails, but only if the proventic 419 * bit is not set. 420 * 421 * Returns 422 * XEVNT_OK success 423 * XEVNT_ERR protocol error 424 * XEVNT_LEN bad field format or length 425 */ 426 int 427 crypto_recv( 428 struct peer *peer, /* peer structure pointer */ 429 struct recvbuf *rbufp /* packet buffer pointer */ 430 ) 431 { 432 const EVP_MD *dp; /* message digest algorithm */ 433 u_int32 *pkt; /* receive packet pointer */ 434 struct autokey *ap, *bp; /* autokey pointer */ 435 struct exten *ep, *fp; /* extension pointers */ 436 struct cert_info *xinfo; /* certificate info pointer */ 437 int macbytes; /* length of MAC field, signed by intention */ 438 int authlen; /* offset of MAC field */ 439 associd_t associd; /* association ID */ 440 tstamp_t fstamp = 0; /* filestamp */ 441 u_int len; /* extension field length */ 442 u_int code; /* extension field opcode */ 443 u_int vallen = 0; /* value length */ 444 X509 *cert; /* X509 certificate */ 445 char statstr[NTP_MAXSTRLEN]; /* statistics for filegen */ 446 keyid_t cookie; /* crumbles */ 447 int hismode; /* packet mode */ 448 int rval = XEVNT_OK; 449 const u_char *puch; 450 u_int32 temp32; 451 452 /* 453 * Initialize. Note that the packet has already been checked for 454 * valid format and extension field lengths. First extract the 455 * field length, command code and association ID in host byte 456 * order. These are used with all commands and modes. Then check 457 * the version number, which must be 2, and length, which must 458 * be at least 8 for requests and VALUE_LEN (24) for responses. 459 * Packets that fail either test sink without a trace. The 460 * association ID is saved only if nonzero. 461 */ 462 authlen = LEN_PKT_NOMAC; 463 hismode = (int)PKT_MODE((&rbufp->recv_pkt)->li_vn_mode); 464 while ((macbytes = rbufp->recv_length - authlen) > (int)MAX_MAC_LEN) { 465 /* We can be reasonably sure that we can read at least 466 * the opcode and the size field here. More stringent 467 * checks follow up shortly. 468 */ 469 pkt = (u_int32 *)&rbufp->recv_pkt + authlen / 4; 470 ep = (struct exten *)pkt; 471 code = ntohl(ep->opcode) & 0xffff0000; 472 len = ntohl(ep->opcode) & 0x0000ffff; 473 // HMS: Why pkt[1] instead of ep->associd ? 474 associd = (associd_t)ntohl(pkt[1]); 475 rval = XEVNT_OK; 476 DPRINTF(1, ("crypto_recv: flags 0x%x ext offset %d len %u code 0x%x associd %d\n", 477 peer->crypto, authlen, len, code >> 16, 478 associd)); 479 480 /* 481 * Check version number and field length. If bad, 482 * quietly ignore the packet. 483 */ 484 if (((code >> 24) & 0x3f) != CRYPTO_VN || len < 8) { 485 sys_badlength++; 486 code |= CRYPTO_ERROR; 487 } 488 489 /* Check if the declared size fits into the remaining 490 * buffer. We *know* 'macbytes' > 0 here! 491 */ 492 if (len > (u_int)macbytes) { 493 DPRINTF(1, ("crypto_recv: possible attack detected, associd %d\n", 494 associd)); 495 return XEVNT_LEN; 496 } 497 498 /* Check if the paylod of the extension fits into the 499 * declared frame. 500 */ 501 if (len >= VALUE_LEN) { 502 fstamp = ntohl(ep->fstamp); 503 vallen = ntohl(ep->vallen); 504 /* 505 * Bug 2761: I hope this isn't too early... 506 */ 507 if ( vallen == 0 508 || len - VALUE_LEN < vallen) 509 return XEVNT_LEN; 510 } 511 switch (code) { 512 513 /* 514 * Install status word, host name, signature scheme and 515 * association ID. In OpenSSL the signature algorithm is 516 * bound to the digest algorithm, so the NID completely 517 * defines the signature scheme. Note the request and 518 * response are identical, but neither is validated by 519 * signature. The request is processed here only in 520 * symmetric modes. The server name field might be 521 * useful to implement access controls in future. 522 */ 523 case CRYPTO_ASSOC: 524 525 /* 526 * If our state machine is running when this 527 * message arrives, the other fellow might have 528 * restarted. However, this could be an 529 * intruder, so just clamp the poll interval and 530 * find out for ourselves. Otherwise, pass the 531 * extension field to the transmit side. 532 */ 533 if (peer->crypto & CRYPTO_FLAG_CERT) { 534 rval = XEVNT_ERR; 535 break; 536 } 537 if (peer->cmmd) { 538 if (peer->assoc != associd) { 539 rval = XEVNT_ERR; 540 break; 541 } 542 free(peer->cmmd); /* will be set again! */ 543 } 544 fp = emalloc(len); 545 memcpy(fp, ep, len); 546 fp->associd = htonl(peer->associd); 547 peer->cmmd = fp; 548 /* fall through */ 549 550 case CRYPTO_ASSOC | CRYPTO_RESP: 551 552 /* 553 * Discard the message if it has already been 554 * stored or the message has been amputated. 555 */ 556 if (peer->crypto) { 557 if (peer->assoc != associd) 558 rval = XEVNT_ERR; 559 break; 560 } 561 INSIST(len >= VALUE_LEN); 562 if (vallen == 0 || vallen > MAXHOSTNAME || 563 len - VALUE_LEN < vallen) { 564 rval = XEVNT_LEN; 565 break; 566 } 567 DPRINTF(1, ("crypto_recv: ident host 0x%x %d server 0x%x %d\n", 568 crypto_flags, peer->associd, fstamp, 569 peer->assoc)); 570 temp32 = crypto_flags & CRYPTO_FLAG_MASK; 571 572 /* 573 * If the client scheme is PC, the server scheme 574 * must be PC. The public key and identity are 575 * presumed valid, so we skip the certificate 576 * and identity exchanges and move immediately 577 * to the cookie exchange which confirms the 578 * server signature. 579 */ 580 if (crypto_flags & CRYPTO_FLAG_PRIV) { 581 if (!(fstamp & CRYPTO_FLAG_PRIV)) { 582 rval = XEVNT_KEY; 583 break; 584 } 585 fstamp |= CRYPTO_FLAG_CERT | 586 CRYPTO_FLAG_VRFY | CRYPTO_FLAG_SIGN; 587 588 /* 589 * It is an error if either peer supports 590 * identity, but the other does not. 591 */ 592 } else if (hismode == MODE_ACTIVE || hismode == 593 MODE_PASSIVE) { 594 if ((temp32 && !(fstamp & 595 CRYPTO_FLAG_MASK)) || 596 (!temp32 && (fstamp & 597 CRYPTO_FLAG_MASK))) { 598 rval = XEVNT_KEY; 599 break; 600 } 601 } 602 603 /* 604 * Discard the message if the signature digest 605 * NID is not supported. 606 */ 607 temp32 = (fstamp >> 16) & 0xffff; 608 dp = 609 (const EVP_MD *)EVP_get_digestbynid(temp32); 610 if (dp == NULL) { 611 rval = XEVNT_MD; 612 break; 613 } 614 615 /* 616 * Save status word, host name and message 617 * digest/signature type. If this is from a 618 * broadcast and the association ID has changed, 619 * request the autokey values. 620 */ 621 peer->assoc = associd; 622 if (hismode == MODE_SERVER) 623 fstamp |= CRYPTO_FLAG_AUTO; 624 if (!(fstamp & CRYPTO_FLAG_TAI)) 625 fstamp |= CRYPTO_FLAG_LEAP; 626 RAND_bytes((u_char *)&peer->hcookie, 4); 627 peer->crypto = fstamp; 628 peer->digest = dp; 629 if (peer->subject != NULL) 630 free(peer->subject); 631 peer->subject = emalloc(vallen + 1); 632 memcpy(peer->subject, ep->pkt, vallen); 633 peer->subject[vallen] = '\0'; 634 if (peer->issuer != NULL) 635 free(peer->issuer); 636 peer->issuer = estrdup(peer->subject); 637 snprintf(statstr, sizeof(statstr), 638 "assoc %d %d host %s %s", peer->associd, 639 peer->assoc, peer->subject, 640 OBJ_nid2ln(temp32)); 641 record_crypto_stats(&peer->srcadr, statstr); 642 DPRINTF(1, ("crypto_recv: %s\n", statstr)); 643 break; 644 645 /* 646 * Decode X509 certificate in ASN.1 format and extract 647 * the data containing, among other things, subject 648 * name and public key. In the default identification 649 * scheme, the certificate trail is followed to a self 650 * signed trusted certificate. 651 */ 652 case CRYPTO_CERT | CRYPTO_RESP: 653 654 /* 655 * Discard the message if empty or invalid. 656 */ 657 if (len < VALUE_LEN) 658 break; 659 660 if ((rval = crypto_verify(ep, NULL, peer)) != 661 XEVNT_OK) 662 break; 663 664 /* 665 * Scan the certificate list to delete old 666 * versions and link the newest version first on 667 * the list. Then, verify the signature. If the 668 * certificate is bad or missing, just ignore 669 * it. 670 */ 671 if ((xinfo = cert_install(ep, peer)) == NULL) { 672 rval = XEVNT_CRT; 673 break; 674 } 675 if ((rval = cert_hike(peer, xinfo)) != XEVNT_OK) 676 break; 677 678 /* 679 * We plug in the public key and lifetime from 680 * the first certificate received. However, note 681 * that this certificate might not be signed by 682 * the server, so we can't check the 683 * signature/digest NID. 684 */ 685 if (peer->pkey == NULL) { 686 puch = xinfo->cert.ptr; 687 cert = d2i_X509(NULL, &puch, 688 ntohl(xinfo->cert.vallen)); 689 peer->pkey = X509_get_pubkey(cert); 690 X509_free(cert); 691 } 692 peer->flash &= ~TEST8; 693 temp32 = xinfo->nid; 694 snprintf(statstr, sizeof(statstr), 695 "cert %s %s 0x%x %s (%u) fs %u", 696 xinfo->subject, xinfo->issuer, xinfo->flags, 697 OBJ_nid2ln(temp32), temp32, 698 ntohl(ep->fstamp)); 699 record_crypto_stats(&peer->srcadr, statstr); 700 DPRINTF(1, ("crypto_recv: %s\n", statstr)); 701 break; 702 703 /* 704 * Schnorr (IFF) identity scheme. This scheme is 705 * designed for use with shared secret server group keys 706 * and where the certificate may be generated by a third 707 * party. The client sends a challenge to the server, 708 * which performs a calculation and returns the result. 709 * A positive result is possible only if both client and 710 * server contain the same secret group key. 711 */ 712 case CRYPTO_IFF | CRYPTO_RESP: 713 714 /* 715 * Discard the message if invalid. 716 */ 717 if ((rval = crypto_verify(ep, NULL, peer)) != 718 XEVNT_OK) 719 break; 720 721 /* 722 * If the challenge matches the response, the 723 * server public key, signature and identity are 724 * all verified at the same time. The server is 725 * declared trusted, so we skip further 726 * certificate exchanges and move immediately to 727 * the cookie exchange. 728 */ 729 if ((rval = crypto_iff(ep, peer)) != XEVNT_OK) 730 break; 731 732 peer->crypto |= CRYPTO_FLAG_VRFY; 733 peer->flash &= ~TEST8; 734 snprintf(statstr, sizeof(statstr), "iff %s fs %u", 735 peer->issuer, ntohl(ep->fstamp)); 736 record_crypto_stats(&peer->srcadr, statstr); 737 DPRINTF(1, ("crypto_recv: %s\n", statstr)); 738 break; 739 740 /* 741 * Guillou-Quisquater (GQ) identity scheme. This scheme 742 * is designed for use with public certificates carrying 743 * the GQ public key in an extension field. The client 744 * sends a challenge to the server, which performs a 745 * calculation and returns the result. A positive result 746 * is possible only if both client and server contain 747 * the same group key and the server has the matching GQ 748 * private key. 749 */ 750 case CRYPTO_GQ | CRYPTO_RESP: 751 752 /* 753 * Discard the message if invalid 754 */ 755 if ((rval = crypto_verify(ep, NULL, peer)) != 756 XEVNT_OK) 757 break; 758 759 /* 760 * If the challenge matches the response, the 761 * server public key, signature and identity are 762 * all verified at the same time. The server is 763 * declared trusted, so we skip further 764 * certificate exchanges and move immediately to 765 * the cookie exchange. 766 */ 767 if ((rval = crypto_gq(ep, peer)) != XEVNT_OK) 768 break; 769 770 peer->crypto |= CRYPTO_FLAG_VRFY; 771 peer->flash &= ~TEST8; 772 snprintf(statstr, sizeof(statstr), "gq %s fs %u", 773 peer->issuer, ntohl(ep->fstamp)); 774 record_crypto_stats(&peer->srcadr, statstr); 775 DPRINTF(1, ("crypto_recv: %s\n", statstr)); 776 break; 777 778 /* 779 * Mu-Varadharajan (MV) identity scheme. This scheme is 780 * designed for use with three levels of trust, trusted 781 * host, server and client. The trusted host key is 782 * opaque to servers and clients; the server keys are 783 * opaque to clients and each client key is different. 784 * Client keys can be revoked without requiring new key 785 * generations. 786 */ 787 case CRYPTO_MV | CRYPTO_RESP: 788 789 /* 790 * Discard the message if invalid. 791 */ 792 if ((rval = crypto_verify(ep, NULL, peer)) != 793 XEVNT_OK) 794 break; 795 796 /* 797 * If the challenge matches the response, the 798 * server public key, signature and identity are 799 * all verified at the same time. The server is 800 * declared trusted, so we skip further 801 * certificate exchanges and move immediately to 802 * the cookie exchange. 803 */ 804 if ((rval = crypto_mv(ep, peer)) != XEVNT_OK) 805 break; 806 807 peer->crypto |= CRYPTO_FLAG_VRFY; 808 peer->flash &= ~TEST8; 809 snprintf(statstr, sizeof(statstr), "mv %s fs %u", 810 peer->issuer, ntohl(ep->fstamp)); 811 record_crypto_stats(&peer->srcadr, statstr); 812 DPRINTF(1, ("crypto_recv: %s\n", statstr)); 813 break; 814 815 816 /* 817 * Cookie response in client and symmetric modes. If the 818 * cookie bit is set, the working cookie is the EXOR of 819 * the current and new values. 820 */ 821 case CRYPTO_COOK | CRYPTO_RESP: 822 823 /* 824 * Discard the message if invalid or signature 825 * not verified with respect to the cookie 826 * values. 827 */ 828 if ((rval = crypto_verify(ep, &peer->cookval, 829 peer)) != XEVNT_OK) 830 break; 831 832 /* 833 * Decrypt the cookie, hunting all the time for 834 * errors. 835 */ 836 if (vallen == (u_int)EVP_PKEY_size(host_pkey)) { 837 RSA *rsa = EVP_PKEY_get0_RSA(host_pkey); 838 u_int32 *cookiebuf = malloc(RSA_size(rsa)); 839 if (!cookiebuf) { 840 rval = XEVNT_CKY; 841 break; 842 } 843 844 if (RSA_private_decrypt(vallen, 845 (u_char *)ep->pkt, 846 (u_char *)cookiebuf, 847 rsa, 848 RSA_PKCS1_OAEP_PADDING) != 4) { 849 rval = XEVNT_CKY; 850 free(cookiebuf); 851 break; 852 } else { 853 cookie = ntohl(*cookiebuf); 854 free(cookiebuf); 855 } 856 } else { 857 rval = XEVNT_CKY; 858 break; 859 } 860 861 /* 862 * Install cookie values and light the cookie 863 * bit. If this is not broadcast client mode, we 864 * are done here. 865 */ 866 key_expire(peer); 867 if (hismode == MODE_ACTIVE || hismode == 868 MODE_PASSIVE) 869 peer->pcookie = peer->hcookie ^ cookie; 870 else 871 peer->pcookie = cookie; 872 peer->crypto |= CRYPTO_FLAG_COOK; 873 peer->flash &= ~TEST8; 874 snprintf(statstr, sizeof(statstr), 875 "cook %x ts %u fs %u", peer->pcookie, 876 ntohl(ep->tstamp), ntohl(ep->fstamp)); 877 record_crypto_stats(&peer->srcadr, statstr); 878 DPRINTF(1, ("crypto_recv: %s\n", statstr)); 879 break; 880 881 /* 882 * Install autokey values in broadcast client and 883 * symmetric modes. We have to do this every time the 884 * sever/peer cookie changes or a new keylist is 885 * rolled. Ordinarily, this is automatic as this message 886 * is piggybacked on the first NTP packet sent upon 887 * either of these events. Note that a broadcast client 888 * or symmetric peer can receive this response without a 889 * matching request. 890 */ 891 case CRYPTO_AUTO | CRYPTO_RESP: 892 893 /* 894 * Discard the message if invalid or signature 895 * not verified with respect to the receive 896 * autokey values. 897 */ 898 if ((rval = crypto_verify(ep, &peer->recval, 899 peer)) != XEVNT_OK) 900 break; 901 902 /* 903 * Discard the message if a broadcast client and 904 * the association ID does not match. This might 905 * happen if a broacast server restarts the 906 * protocol. A protocol restart will occur at 907 * the next ASSOC message. 908 */ 909 if ((peer->cast_flags & MDF_BCLNT) && 910 peer->assoc != associd) 911 break; 912 913 /* 914 * Install autokey values and light the 915 * autokey bit. This is not hard. 916 */ 917 if (ep->tstamp == 0) 918 break; 919 920 if (peer->recval.ptr == NULL) 921 peer->recval.ptr = 922 emalloc(sizeof(struct autokey)); 923 bp = (struct autokey *)peer->recval.ptr; 924 peer->recval.tstamp = ep->tstamp; 925 peer->recval.fstamp = ep->fstamp; 926 ap = (struct autokey *)ep->pkt; 927 bp->seq = ntohl(ap->seq); 928 bp->key = ntohl(ap->key); 929 peer->pkeyid = bp->key; 930 peer->crypto |= CRYPTO_FLAG_AUTO; 931 peer->flash &= ~TEST8; 932 snprintf(statstr, sizeof(statstr), 933 "auto seq %d key %x ts %u fs %u", bp->seq, 934 bp->key, ntohl(ep->tstamp), 935 ntohl(ep->fstamp)); 936 record_crypto_stats(&peer->srcadr, statstr); 937 DPRINTF(1, ("crypto_recv: %s\n", statstr)); 938 break; 939 940 /* 941 * X509 certificate sign response. Validate the 942 * certificate signed by the server and install. Later 943 * this can be provided to clients of this server in 944 * lieu of the self signed certificate in order to 945 * validate the public key. 946 */ 947 case CRYPTO_SIGN | CRYPTO_RESP: 948 949 /* 950 * Discard the message if invalid. 951 */ 952 if ((rval = crypto_verify(ep, NULL, peer)) != 953 XEVNT_OK) 954 break; 955 956 /* 957 * Scan the certificate list to delete old 958 * versions and link the newest version first on 959 * the list. 960 */ 961 if ((xinfo = cert_install(ep, peer)) == NULL) { 962 rval = XEVNT_CRT; 963 break; 964 } 965 peer->crypto |= CRYPTO_FLAG_SIGN; 966 peer->flash &= ~TEST8; 967 temp32 = xinfo->nid; 968 snprintf(statstr, sizeof(statstr), 969 "sign %s %s 0x%x %s (%u) fs %u", 970 xinfo->subject, xinfo->issuer, xinfo->flags, 971 OBJ_nid2ln(temp32), temp32, 972 ntohl(ep->fstamp)); 973 record_crypto_stats(&peer->srcadr, statstr); 974 DPRINTF(1, ("crypto_recv: %s\n", statstr)); 975 break; 976 977 /* 978 * Install leapseconds values. While the leapsecond 979 * values epoch, TAI offset and values expiration epoch 980 * are retained, only the current TAI offset is provided 981 * via the kernel to other applications. 982 */ 983 case CRYPTO_LEAP | CRYPTO_RESP: 984 /* 985 * Discard the message if invalid. We can't 986 * compare the value timestamps here, as they 987 * can be updated by different servers. 988 */ 989 rval = crypto_verify(ep, NULL, peer); 990 if ((rval != XEVNT_OK ) || 991 (vallen != 3*sizeof(uint32_t)) ) 992 break; 993 994 /* Check if we can update the basic TAI offset 995 * for our current leap frame. This is a hack 996 * and ignores the time stamps in the autokey 997 * message. 998 */ 999 if (sys_leap != LEAP_NOTINSYNC) 1000 leapsec_autokey_tai(ntohl(ep->pkt[0]), 1001 rbufp->recv_time.l_ui, NULL); 1002 tai_leap.tstamp = ep->tstamp; 1003 tai_leap.fstamp = ep->fstamp; 1004 crypto_update(); 1005 mprintf_event(EVNT_TAI, peer, 1006 "%d seconds", ntohl(ep->pkt[0])); 1007 peer->crypto |= CRYPTO_FLAG_LEAP; 1008 peer->flash &= ~TEST8; 1009 snprintf(statstr, sizeof(statstr), 1010 "leap TAI offset %d at %u expire %u fs %u", 1011 ntohl(ep->pkt[0]), ntohl(ep->pkt[1]), 1012 ntohl(ep->pkt[2]), ntohl(ep->fstamp)); 1013 record_crypto_stats(&peer->srcadr, statstr); 1014 DPRINTF(1, ("crypto_recv: %s\n", statstr)); 1015 break; 1016 1017 /* 1018 * We come here in symmetric modes for miscellaneous 1019 * commands that have value fields but are processed on 1020 * the transmit side. All we need do here is check for 1021 * valid field length. Note that ASSOC is handled 1022 * separately. 1023 */ 1024 case CRYPTO_CERT: 1025 case CRYPTO_IFF: 1026 case CRYPTO_GQ: 1027 case CRYPTO_MV: 1028 case CRYPTO_COOK: 1029 case CRYPTO_SIGN: 1030 if (len < VALUE_LEN) { 1031 rval = XEVNT_LEN; 1032 break; 1033 } 1034 /* fall through */ 1035 1036 /* 1037 * We come here in symmetric modes for requests 1038 * requiring a response (above plus AUTO and LEAP) and 1039 * for responses. If a request, save the extension field 1040 * for later; invalid requests will be caught on the 1041 * transmit side. If an error or invalid response, 1042 * declare a protocol error. 1043 */ 1044 default: 1045 if (code & (CRYPTO_RESP | CRYPTO_ERROR)) { 1046 rval = XEVNT_ERR; 1047 } else if (peer->cmmd == NULL) { 1048 fp = emalloc(len); 1049 memcpy(fp, ep, len); 1050 peer->cmmd = fp; 1051 } 1052 } 1053 1054 /* 1055 * The first error found terminates the extension field 1056 * scan and we return the laundry to the caller. 1057 */ 1058 if (rval != XEVNT_OK) { 1059 snprintf(statstr, sizeof(statstr), 1060 "%04x %d %02x %s", htonl(ep->opcode), 1061 associd, rval, eventstr(rval)); 1062 record_crypto_stats(&peer->srcadr, statstr); 1063 DPRINTF(1, ("crypto_recv: %s\n", statstr)); 1064 return (rval); 1065 } 1066 authlen += (len + 3) / 4 * 4; 1067 } 1068 return (rval); 1069 } 1070 1071 1072 /* 1073 * crypto_xmit - construct extension fields 1074 * 1075 * This routine is called both when an association is configured and 1076 * when one is not. The only case where this matters is to retrieve the 1077 * autokey information, in which case the caller has to provide the 1078 * association ID to match the association. 1079 * 1080 * Side effect: update the packet offset. 1081 * 1082 * Errors 1083 * XEVNT_OK success 1084 * XEVNT_CRT bad or missing certificate 1085 * XEVNT_ERR protocol error 1086 * XEVNT_LEN bad field format or length 1087 * XEVNT_PER host certificate expired 1088 */ 1089 int 1090 crypto_xmit( 1091 struct peer *peer, /* peer structure pointer */ 1092 struct pkt *xpkt, /* transmit packet pointer */ 1093 struct recvbuf *rbufp, /* receive buffer pointer */ 1094 int start, /* offset to extension field */ 1095 struct exten *ep, /* extension pointer */ 1096 keyid_t cookie /* session cookie */ 1097 ) 1098 { 1099 struct exten *fp; /* extension pointers */ 1100 struct cert_info *cp, *xp, *yp; /* cert info/value pointer */ 1101 sockaddr_u *srcadr_sin; /* source address */ 1102 u_int32 *pkt; /* packet pointer */ 1103 u_int opcode; /* extension field opcode */ 1104 char certname[MAXHOSTNAME + 1]; /* subject name buffer */ 1105 char statstr[NTP_MAXSTRLEN]; /* statistics for filegen */ 1106 tstamp_t tstamp; 1107 struct calendar tscal; 1108 u_int vallen; 1109 struct value vtemp; 1110 associd_t associd; 1111 int rval; 1112 int len; 1113 keyid_t tcookie; 1114 1115 /* 1116 * Generate the requested extension field request code, length 1117 * and association ID. If this is a response and the host is not 1118 * synchronized, light the error bit and go home. 1119 */ 1120 pkt = (u_int32 *)xpkt + start / 4; 1121 fp = (struct exten *)pkt; 1122 opcode = ntohl(ep->opcode); 1123 if (peer != NULL) { 1124 srcadr_sin = &peer->srcadr; 1125 if (!(opcode & CRYPTO_RESP)) 1126 peer->opcode = ep->opcode; 1127 } else { 1128 srcadr_sin = &rbufp->recv_srcadr; 1129 } 1130 associd = (associd_t) ntohl(ep->associd); 1131 len = 8; 1132 fp->opcode = htonl((opcode & 0xffff0000) | len); 1133 fp->associd = ep->associd; 1134 rval = XEVNT_OK; 1135 tstamp = crypto_time(); 1136 switch (opcode & 0xffff0000) { 1137 1138 /* 1139 * Send association request and response with status word and 1140 * host name. Note, this message is not signed and the filestamp 1141 * contains only the status word. 1142 */ 1143 case CRYPTO_ASSOC: 1144 case CRYPTO_ASSOC | CRYPTO_RESP: 1145 len = crypto_send(fp, &hostval, start); 1146 fp->fstamp = htonl(crypto_flags); 1147 break; 1148 1149 /* 1150 * Send certificate request. Use the values from the extension 1151 * field. 1152 */ 1153 case CRYPTO_CERT: 1154 memset(&vtemp, 0, sizeof(vtemp)); 1155 vtemp.tstamp = ep->tstamp; 1156 vtemp.fstamp = ep->fstamp; 1157 vtemp.vallen = ep->vallen; 1158 vtemp.ptr = (u_char *)ep->pkt; 1159 len = crypto_send(fp, &vtemp, start); 1160 break; 1161 1162 /* 1163 * Send sign request. Use the host certificate, which is self- 1164 * signed and may or may not be trusted. 1165 */ 1166 case CRYPTO_SIGN: 1167 (void)ntpcal_ntp_to_date(&tscal, tstamp, NULL); 1168 if ((calcomp(&tscal, &(cert_host->first)) < 0) 1169 || (calcomp(&tscal, &(cert_host->last)) > 0)) 1170 rval = XEVNT_PER; 1171 else 1172 len = crypto_send(fp, &cert_host->cert, start); 1173 break; 1174 1175 /* 1176 * Send certificate response. Use the name in the extension 1177 * field to find the certificate in the cache. If the request 1178 * contains no subject name, assume the name of this host. This 1179 * is for backwards compatibility. Private certificates are 1180 * never sent. 1181 * 1182 * There may be several certificates matching the request. First 1183 * choice is a self-signed trusted certificate; second choice is 1184 * any certificate signed by another host. There is no third 1185 * choice. 1186 */ 1187 case CRYPTO_CERT | CRYPTO_RESP: 1188 vallen = exten_payload_size(ep); /* Must be <64k */ 1189 if (vallen == 0 || vallen >= sizeof(certname) ) { 1190 rval = XEVNT_LEN; 1191 break; 1192 } 1193 1194 /* 1195 * Find all public valid certificates with matching 1196 * subject. If a self-signed, trusted certificate is 1197 * found, use that certificate. If not, use the last non 1198 * self-signed certificate. 1199 */ 1200 memcpy(certname, ep->pkt, vallen); 1201 certname[vallen] = '\0'; 1202 xp = yp = NULL; 1203 for (cp = cinfo; cp != NULL; cp = cp->link) { 1204 if (cp->flags & (CERT_PRIV | CERT_ERROR)) 1205 continue; 1206 1207 if (strcmp(certname, cp->subject) != 0) 1208 continue; 1209 1210 if (strcmp(certname, cp->issuer) != 0) 1211 yp = cp; 1212 else if (cp ->flags & CERT_TRUST) 1213 xp = cp; 1214 continue; 1215 } 1216 1217 /* 1218 * Be careful who you trust. If the certificate is not 1219 * found, return an empty response. Note that we dont 1220 * enforce lifetimes here. 1221 * 1222 * The timestamp and filestamp are taken from the 1223 * certificate value structure. For all certificates the 1224 * timestamp is the latest signature update time. For 1225 * host and imported certificates the filestamp is the 1226 * creation epoch. For signed certificates the filestamp 1227 * is the creation epoch of the trusted certificate at 1228 * the root of the certificate trail. In principle, this 1229 * allows strong checking for signature masquerade. 1230 */ 1231 if (xp == NULL) 1232 xp = yp; 1233 if (xp == NULL) 1234 break; 1235 1236 if (tstamp == 0) 1237 break; 1238 1239 len = crypto_send(fp, &xp->cert, start); 1240 break; 1241 1242 /* 1243 * Send challenge in Schnorr (IFF) identity scheme. 1244 */ 1245 case CRYPTO_IFF: 1246 if (peer == NULL) 1247 break; /* hack attack */ 1248 1249 if ((rval = crypto_alice(peer, &vtemp)) == XEVNT_OK) { 1250 len = crypto_send(fp, &vtemp, start); 1251 value_free(&vtemp); 1252 } 1253 break; 1254 1255 /* 1256 * Send response in Schnorr (IFF) identity scheme. 1257 */ 1258 case CRYPTO_IFF | CRYPTO_RESP: 1259 if ((rval = crypto_bob(ep, &vtemp)) == XEVNT_OK) { 1260 len = crypto_send(fp, &vtemp, start); 1261 value_free(&vtemp); 1262 } 1263 break; 1264 1265 /* 1266 * Send challenge in Guillou-Quisquater (GQ) identity scheme. 1267 */ 1268 case CRYPTO_GQ: 1269 if (peer == NULL) 1270 break; /* hack attack */ 1271 1272 if ((rval = crypto_alice2(peer, &vtemp)) == XEVNT_OK) { 1273 len = crypto_send(fp, &vtemp, start); 1274 value_free(&vtemp); 1275 } 1276 break; 1277 1278 /* 1279 * Send response in Guillou-Quisquater (GQ) identity scheme. 1280 */ 1281 case CRYPTO_GQ | CRYPTO_RESP: 1282 if ((rval = crypto_bob2(ep, &vtemp)) == XEVNT_OK) { 1283 len = crypto_send(fp, &vtemp, start); 1284 value_free(&vtemp); 1285 } 1286 break; 1287 1288 /* 1289 * Send challenge in MV identity scheme. 1290 */ 1291 case CRYPTO_MV: 1292 if (peer == NULL) 1293 break; /* hack attack */ 1294 1295 if ((rval = crypto_alice3(peer, &vtemp)) == XEVNT_OK) { 1296 len = crypto_send(fp, &vtemp, start); 1297 value_free(&vtemp); 1298 } 1299 break; 1300 1301 /* 1302 * Send response in MV identity scheme. 1303 */ 1304 case CRYPTO_MV | CRYPTO_RESP: 1305 if ((rval = crypto_bob3(ep, &vtemp)) == XEVNT_OK) { 1306 len = crypto_send(fp, &vtemp, start); 1307 value_free(&vtemp); 1308 } 1309 break; 1310 1311 /* 1312 * Send certificate sign response. The integrity of the request 1313 * certificate has already been verified on the receive side. 1314 * Sign the response using the local server key. Use the 1315 * filestamp from the request and use the timestamp as the 1316 * current time. Light the error bit if the certificate is 1317 * invalid or contains an unverified signature. 1318 */ 1319 case CRYPTO_SIGN | CRYPTO_RESP: 1320 if ((rval = cert_sign(ep, &vtemp)) == XEVNT_OK) { 1321 len = crypto_send(fp, &vtemp, start); 1322 value_free(&vtemp); 1323 } 1324 break; 1325 1326 /* 1327 * Send public key and signature. Use the values from the public 1328 * key. 1329 */ 1330 case CRYPTO_COOK: 1331 len = crypto_send(fp, &pubkey, start); 1332 break; 1333 1334 /* 1335 * Encrypt and send cookie and signature. Light the error bit if 1336 * anything goes wrong. 1337 */ 1338 case CRYPTO_COOK | CRYPTO_RESP: 1339 vallen = ntohl(ep->vallen); /* Must be <64k */ 1340 if ( vallen == 0 1341 || (vallen >= MAX_VALLEN) 1342 || (opcode & 0x0000ffff) < VALUE_LEN + vallen) { 1343 rval = XEVNT_LEN; 1344 break; 1345 } 1346 if (peer == NULL) 1347 tcookie = cookie; 1348 else 1349 tcookie = peer->hcookie; 1350 if ((rval = crypto_encrypt((const u_char *)ep->pkt, vallen, &tcookie, &vtemp)) 1351 == XEVNT_OK) { 1352 len = crypto_send(fp, &vtemp, start); 1353 value_free(&vtemp); 1354 } 1355 break; 1356 1357 /* 1358 * Find peer and send autokey data and signature in broadcast 1359 * server and symmetric modes. Use the values in the autokey 1360 * structure. If no association is found, either the server has 1361 * restarted with new associations or some perp has replayed an 1362 * old message, in which case light the error bit. 1363 */ 1364 case CRYPTO_AUTO | CRYPTO_RESP: 1365 if (peer == NULL) { 1366 if ((peer = findpeerbyassoc(associd)) == NULL) { 1367 rval = XEVNT_ERR; 1368 break; 1369 } 1370 } 1371 peer->flags &= ~FLAG_ASSOC; 1372 len = crypto_send(fp, &peer->sndval, start); 1373 break; 1374 1375 /* 1376 * Send leapseconds values and signature. Use the values from 1377 * the tai structure. If no table has been loaded, just send an 1378 * empty request. 1379 */ 1380 case CRYPTO_LEAP | CRYPTO_RESP: 1381 len = crypto_send(fp, &tai_leap, start); 1382 break; 1383 1384 /* 1385 * Default - Send a valid command for unknown requests; send 1386 * an error response for unknown resonses. 1387 */ 1388 default: 1389 if (opcode & CRYPTO_RESP) 1390 rval = XEVNT_ERR; 1391 } 1392 1393 /* 1394 * In case of error, flame the log. If a request, toss the 1395 * puppy; if a response, return so the sender can flame, too. 1396 */ 1397 if (rval != XEVNT_OK) { 1398 u_int32 opcode_bits; 1399 1400 opcode_bits = CRYPTO_ERROR; 1401 opcode |= opcode_bits; 1402 fp->opcode |= htonl(opcode_bits); 1403 snprintf(statstr, sizeof(statstr), 1404 "%04x %d %02x %s", opcode, associd, rval, 1405 eventstr(rval)); 1406 record_crypto_stats(srcadr_sin, statstr); 1407 DPRINTF(1, ("crypto_xmit: %s\n", statstr)); 1408 if (!(opcode & CRYPTO_RESP)) 1409 return (0); 1410 } 1411 DPRINTF(1, ("crypto_xmit: flags 0x%x offset %d len %d code 0x%x associd %d\n", 1412 crypto_flags, start, len, opcode >> 16, associd)); 1413 return (len); 1414 } 1415 1416 1417 /* 1418 * crypto_verify - verify the extension field value and signature 1419 * 1420 * Returns 1421 * XEVNT_OK success 1422 * XEVNT_ERR protocol error 1423 * XEVNT_FSP bad filestamp 1424 * XEVNT_LEN bad field format or length 1425 * XEVNT_PUB bad or missing public key 1426 * XEVNT_SGL bad signature length 1427 * XEVNT_SIG signature not verified 1428 * XEVNT_TSP bad timestamp 1429 */ 1430 static int 1431 crypto_verify( 1432 struct exten *ep, /* extension pointer */ 1433 struct value *vp, /* value pointer */ 1434 struct peer *peer /* peer structure pointer */ 1435 ) 1436 { 1437 EVP_PKEY *pkey; /* server public key */ 1438 EVP_MD_CTX *ctx; /* signature context */ 1439 tstamp_t tstamp, tstamp1 = 0; /* timestamp */ 1440 tstamp_t fstamp, fstamp1 = 0; /* filestamp */ 1441 u_int vallen; /* value length */ 1442 u_int siglen; /* signature length */ 1443 u_int opcode, len; 1444 int i; 1445 1446 /* 1447 * We are extremely parannoyed. We require valid opcode, length, 1448 * association ID, timestamp, filestamp, public key, digest, 1449 * signature length and signature, where relevant. Note that 1450 * preliminary length checks are done in the main loop. 1451 */ 1452 len = ntohl(ep->opcode) & 0x0000ffff; 1453 opcode = ntohl(ep->opcode) & 0xffff0000; 1454 1455 /* 1456 * Check for valid value header, association ID and extension 1457 * field length. Remember, it is not an error to receive an 1458 * unsolicited response; however, the response ID must match 1459 * the association ID. 1460 */ 1461 if (opcode & CRYPTO_ERROR) 1462 return (XEVNT_ERR); 1463 1464 if (len < VALUE_LEN) 1465 return (XEVNT_LEN); 1466 1467 if (opcode == (CRYPTO_AUTO | CRYPTO_RESP) && (peer->pmode == 1468 MODE_BROADCAST || (peer->cast_flags & MDF_BCLNT))) { 1469 if (ntohl(ep->associd) != peer->assoc) 1470 return (XEVNT_ERR); 1471 } else { 1472 if (ntohl(ep->associd) != peer->associd) 1473 return (XEVNT_ERR); 1474 } 1475 1476 /* 1477 * We have a valid value header. Check for valid value and 1478 * signature field lengths. The extension field length must be 1479 * long enough to contain the value header, value and signature. 1480 * Note both the value and signature field lengths are rounded 1481 * up to the next word (4 octets). 1482 */ 1483 vallen = ntohl(ep->vallen); 1484 if ( vallen == 0 1485 || vallen > MAX_VALLEN) 1486 return (XEVNT_LEN); 1487 1488 i = (vallen + 3) / 4; 1489 siglen = ntohl(ep->pkt[i]); 1490 ++i; 1491 if ( siglen > MAX_VALLEN 1492 || len - VALUE_LEN < ((vallen + 3) / 4) * 4 1493 || len - VALUE_LEN - ((vallen + 3) / 4) * 4 1494 < ((siglen + 3) / 4) * 4) 1495 return (XEVNT_LEN); 1496 1497 /* 1498 * Check for valid timestamp and filestamp. If the timestamp is 1499 * zero, the sender is not synchronized and signatures are 1500 * not possible. If nonzero the timestamp must not precede the 1501 * filestamp. The timestamp and filestamp must not precede the 1502 * corresponding values in the value structure, if present. 1503 */ 1504 tstamp = ntohl(ep->tstamp); 1505 fstamp = ntohl(ep->fstamp); 1506 if (tstamp == 0) 1507 return (XEVNT_TSP); 1508 1509 if (tstamp < fstamp) 1510 return (XEVNT_TSP); 1511 1512 if (vp != NULL) { 1513 tstamp1 = ntohl(vp->tstamp); 1514 fstamp1 = ntohl(vp->fstamp); 1515 if (tstamp1 != 0 && fstamp1 != 0) { 1516 if (tstamp < tstamp1) 1517 return (XEVNT_TSP); 1518 1519 if ((tstamp < fstamp1 || fstamp < fstamp1)) 1520 return (XEVNT_FSP); 1521 } 1522 } 1523 1524 /* 1525 * At the time the certificate message is validated, the public 1526 * key in the message is not available. Thus, don't try to 1527 * verify the signature. 1528 */ 1529 if (opcode == (CRYPTO_CERT | CRYPTO_RESP)) 1530 return (XEVNT_OK); 1531 1532 /* 1533 * Check for valid signature length, public key and digest 1534 * algorithm. 1535 */ 1536 if (crypto_flags & peer->crypto & CRYPTO_FLAG_PRIV) 1537 pkey = sign_pkey; 1538 else 1539 pkey = peer->pkey; 1540 if (siglen == 0 || pkey == NULL || peer->digest == NULL) 1541 return (XEVNT_ERR); 1542 1543 if (siglen != (u_int)EVP_PKEY_size(pkey)) 1544 return (XEVNT_SGL); 1545 1546 /* 1547 * Darn, I thought we would never get here. Verify the 1548 * signature. If the identity exchange is verified, light the 1549 * proventic bit. What a relief. 1550 */ 1551 ctx = EVP_MD_CTX_new(); 1552 EVP_VerifyInit(ctx, peer->digest); 1553 /* XXX: the "+ 12" needs to be at least documented... */ 1554 EVP_VerifyUpdate(ctx, (u_char *)&ep->tstamp, vallen + 12); 1555 if (EVP_VerifyFinal(ctx, (u_char *)&ep->pkt[i], siglen, 1556 pkey) <= 0) { 1557 EVP_MD_CTX_free(ctx); 1558 return (XEVNT_SIG); 1559 } 1560 EVP_MD_CTX_free(ctx); 1561 1562 if (peer->crypto & CRYPTO_FLAG_VRFY) 1563 peer->crypto |= CRYPTO_FLAG_PROV; 1564 return (XEVNT_OK); 1565 } 1566 1567 1568 /* 1569 * crypto_encrypt - construct vp (encrypted cookie and signature) from 1570 * the public key and cookie. 1571 * 1572 * Returns: 1573 * XEVNT_OK success 1574 * XEVNT_CKY bad or missing cookie 1575 * XEVNT_PUB bad or missing public key 1576 */ 1577 static int 1578 crypto_encrypt( 1579 const u_char *ptr, /* Public Key */ 1580 u_int vallen, /* Length of Public Key */ 1581 keyid_t *cookie, /* server cookie */ 1582 struct value *vp /* value pointer */ 1583 ) 1584 { 1585 EVP_PKEY *pkey; /* public key */ 1586 EVP_MD_CTX *ctx; /* signature context */ 1587 tstamp_t tstamp; /* NTP timestamp */ 1588 u_int32 temp32; 1589 u_char *puch; 1590 1591 /* 1592 * Extract the public key from the request. 1593 */ 1594 pkey = d2i_PublicKey(EVP_PKEY_RSA, NULL, &ptr, vallen); 1595 if (pkey == NULL) { 1596 msyslog(LOG_ERR, "crypto_encrypt: %s", 1597 ERR_error_string(ERR_get_error(), NULL)); 1598 return (XEVNT_PUB); 1599 } 1600 1601 /* 1602 * Encrypt the cookie, encode in ASN.1 and sign. 1603 */ 1604 memset(vp, 0, sizeof(struct value)); 1605 tstamp = crypto_time(); 1606 vp->tstamp = htonl(tstamp); 1607 vp->fstamp = hostval.tstamp; 1608 vallen = EVP_PKEY_size(pkey); 1609 vp->vallen = htonl(vallen); 1610 vp->ptr = emalloc(vallen); 1611 puch = vp->ptr; 1612 temp32 = htonl(*cookie); 1613 if (RSA_public_encrypt(4, (u_char *)&temp32, puch, 1614 EVP_PKEY_get0_RSA(pkey), RSA_PKCS1_OAEP_PADDING) <= 0) { 1615 msyslog(LOG_ERR, "crypto_encrypt: %s", 1616 ERR_error_string(ERR_get_error(), NULL)); 1617 free(vp->ptr); 1618 EVP_PKEY_free(pkey); 1619 return (XEVNT_CKY); 1620 } 1621 EVP_PKEY_free(pkey); 1622 if (tstamp == 0) 1623 return (XEVNT_OK); 1624 1625 vp->sig = emalloc(sign_siglen); 1626 ctx = EVP_MD_CTX_new(); 1627 EVP_SignInit(ctx, sign_digest); 1628 EVP_SignUpdate(ctx, (u_char *)&vp->tstamp, 12); 1629 EVP_SignUpdate(ctx, vp->ptr, vallen); 1630 if (EVP_SignFinal(ctx, vp->sig, &vallen, sign_pkey)) { 1631 INSIST(vallen <= sign_siglen); 1632 vp->siglen = htonl(vallen); 1633 } 1634 EVP_MD_CTX_free(ctx); 1635 return (XEVNT_OK); 1636 } 1637 1638 1639 /* 1640 * crypto_ident - construct extension field for identity scheme 1641 * 1642 * This routine determines which identity scheme is in use and 1643 * constructs an extension field for that scheme. 1644 * 1645 * Returns 1646 * CRYTPO_IFF IFF scheme 1647 * CRYPTO_GQ GQ scheme 1648 * CRYPTO_MV MV scheme 1649 * CRYPTO_NULL no available scheme 1650 */ 1651 u_int 1652 crypto_ident( 1653 struct peer *peer /* peer structure pointer */ 1654 ) 1655 { 1656 char filename[MAXFILENAME]; 1657 const char * scheme_name; 1658 u_int scheme_id; 1659 1660 /* 1661 * We come here after the group trusted host has been found; its 1662 * name defines the group name. Search the key cache for all 1663 * keys matching the same group name in order IFF, GQ and MV. 1664 * Use the first one available. 1665 */ 1666 scheme_name = NULL; 1667 if (peer->crypto & CRYPTO_FLAG_IFF) { 1668 scheme_name = "iff"; 1669 scheme_id = CRYPTO_IFF; 1670 } else if (peer->crypto & CRYPTO_FLAG_GQ) { 1671 scheme_name = "gq"; 1672 scheme_id = CRYPTO_GQ; 1673 } else if (peer->crypto & CRYPTO_FLAG_MV) { 1674 scheme_name = "mv"; 1675 scheme_id = CRYPTO_MV; 1676 } 1677 1678 if (scheme_name != NULL) { 1679 snprintf(filename, sizeof(filename), "ntpkey_%spar_%s", 1680 scheme_name, peer->ident); 1681 peer->ident_pkey = crypto_key(filename, NULL, 1682 &peer->srcadr); 1683 if (peer->ident_pkey != NULL) 1684 return scheme_id; 1685 } 1686 1687 msyslog(LOG_NOTICE, 1688 "crypto_ident: no identity parameters found for group %s", 1689 peer->ident); 1690 1691 return CRYPTO_NULL; 1692 } 1693 1694 1695 /* 1696 * crypto_args - construct extension field from arguments 1697 * 1698 * This routine creates an extension field with current timestamps and 1699 * specified opcode, association ID and optional string. Note that the 1700 * extension field is created here, but freed after the crypto_xmit() 1701 * call in the protocol module. 1702 * 1703 * Returns extension field pointer (no errors) 1704 * 1705 * XXX: opcode and len should really be 32-bit quantities and 1706 * we should make sure that str is not too big. 1707 */ 1708 struct exten * 1709 crypto_args( 1710 struct peer *peer, /* peer structure pointer */ 1711 u_int opcode, /* operation code */ 1712 associd_t associd, /* association ID */ 1713 char *str /* argument string */ 1714 ) 1715 { 1716 tstamp_t tstamp; /* NTP timestamp */ 1717 struct exten *ep; /* extension field pointer */ 1718 u_int len; /* extension field length */ 1719 size_t slen = 0; 1720 1721 tstamp = crypto_time(); 1722 len = sizeof(struct exten); 1723 if (str != NULL) { 1724 slen = strlen(str); 1725 INSIST(slen < MAX_VALLEN); 1726 len += slen; 1727 } 1728 ep = emalloc_zero(len); 1729 if (opcode == 0) 1730 return (ep); 1731 1732 REQUIRE(0 == (len & ~0x0000ffff)); 1733 REQUIRE(0 == (opcode & ~0xffff0000)); 1734 1735 ep->opcode = htonl(opcode + len); 1736 ep->associd = htonl(associd); 1737 ep->tstamp = htonl(tstamp); 1738 ep->fstamp = hostval.tstamp; 1739 ep->vallen = 0; 1740 if (str != NULL) { 1741 ep->vallen = htonl(slen); 1742 memcpy((char *)ep->pkt, str, slen); 1743 } 1744 return (ep); 1745 } 1746 1747 1748 /* 1749 * crypto_send - construct extension field from value components 1750 * 1751 * The value and signature fields are zero-padded to a word boundary. 1752 * Note: it is not polite to send a nonempty signature with zero 1753 * timestamp or a nonzero timestamp with an empty signature, but those 1754 * rules are not enforced here. 1755 * 1756 * XXX This code won't work on a box with 16-bit ints. 1757 */ 1758 int 1759 crypto_send( 1760 struct exten *ep, /* extension field pointer */ 1761 struct value *vp, /* value pointer */ 1762 int start /* buffer offset */ 1763 ) 1764 { 1765 u_int len, vallen, siglen, opcode; 1766 u_int i, j; 1767 1768 /* 1769 * Calculate extension field length and check for buffer 1770 * overflow. Leave room for the MAC. 1771 */ 1772 len = 16; /* XXX Document! */ 1773 vallen = ntohl(vp->vallen); 1774 INSIST(vallen <= MAX_VALLEN); 1775 len += ((vallen + 3) / 4 + 1) * 4; 1776 siglen = ntohl(vp->siglen); 1777 len += ((siglen + 3) / 4 + 1) * 4; 1778 if (start + len > sizeof(struct pkt) - MAX_MAC_LEN) 1779 return (0); 1780 1781 /* 1782 * Copy timestamps. 1783 */ 1784 ep->tstamp = vp->tstamp; 1785 ep->fstamp = vp->fstamp; 1786 ep->vallen = vp->vallen; 1787 1788 /* 1789 * Copy value. If the data field is empty or zero length, 1790 * encode an empty value with length zero. 1791 */ 1792 i = 0; 1793 if (vallen > 0 && vp->ptr != NULL) { 1794 j = vallen / 4; 1795 if (j * 4 < vallen) 1796 ep->pkt[i + j++] = 0; 1797 memcpy(&ep->pkt[i], vp->ptr, vallen); 1798 i += j; 1799 } 1800 1801 /* 1802 * Copy signature. If the signature field is empty or zero 1803 * length, encode an empty signature with length zero. 1804 */ 1805 ep->pkt[i++] = vp->siglen; 1806 if (siglen > 0 && vp->sig != NULL) { 1807 j = siglen / 4; 1808 if (j * 4 < siglen) 1809 ep->pkt[i + j++] = 0; 1810 memcpy(&ep->pkt[i], vp->sig, siglen); 1811 /* i += j; */ /* We don't use i after this */ 1812 } 1813 opcode = ntohl(ep->opcode); 1814 ep->opcode = htonl((opcode & 0xffff0000) | len); 1815 ENSURE(len <= MAX_VALLEN); 1816 return (len); 1817 } 1818 1819 1820 /* 1821 * crypto_update - compute new public value and sign extension fields 1822 * 1823 * This routine runs periodically, like once a day, and when something 1824 * changes. It updates the timestamps on three value structures and one 1825 * value structure list, then signs all the structures: 1826 * 1827 * hostval host name (not signed) 1828 * pubkey public key 1829 * cinfo certificate info/value list 1830 * tai_leap leap values 1831 * 1832 * Filestamps are proventic data, so this routine runs only when the 1833 * host is synchronized to a proventicated source. Thus, the timestamp 1834 * is proventic and can be used to deflect clogging attacks. 1835 * 1836 * Returns void (no errors) 1837 */ 1838 void 1839 crypto_update(void) 1840 { 1841 EVP_MD_CTX *ctx; /* message digest context */ 1842 struct cert_info *cp; /* certificate info/value */ 1843 char statstr[NTP_MAXSTRLEN]; /* statistics for filegen */ 1844 u_int32 *ptr; 1845 u_int len; 1846 leap_result_t leap_data; 1847 1848 hostval.tstamp = htonl(crypto_time()); 1849 if (hostval.tstamp == 0) 1850 return; 1851 1852 ctx = EVP_MD_CTX_new(); 1853 1854 /* 1855 * Sign public key and timestamps. The filestamp is derived from 1856 * the host key file extension from wherever the file was 1857 * generated. 1858 */ 1859 if (pubkey.vallen != 0) { 1860 pubkey.tstamp = hostval.tstamp; 1861 pubkey.siglen = 0; 1862 if (pubkey.sig == NULL) 1863 pubkey.sig = emalloc(sign_siglen); 1864 EVP_SignInit(ctx, sign_digest); 1865 EVP_SignUpdate(ctx, (u_char *)&pubkey, 12); 1866 EVP_SignUpdate(ctx, pubkey.ptr, ntohl(pubkey.vallen)); 1867 if (EVP_SignFinal(ctx, pubkey.sig, &len, sign_pkey)) { 1868 INSIST(len <= sign_siglen); 1869 pubkey.siglen = htonl(len); 1870 } 1871 } 1872 1873 /* 1874 * Sign certificates and timestamps. The filestamp is derived 1875 * from the certificate file extension from wherever the file 1876 * was generated. Note we do not throw expired certificates 1877 * away; they may have signed younger ones. 1878 */ 1879 for (cp = cinfo; cp != NULL; cp = cp->link) { 1880 cp->cert.tstamp = hostval.tstamp; 1881 cp->cert.siglen = 0; 1882 if (cp->cert.sig == NULL) 1883 cp->cert.sig = emalloc(sign_siglen); 1884 EVP_SignInit(ctx, sign_digest); 1885 EVP_SignUpdate(ctx, (u_char *)&cp->cert, 12); 1886 EVP_SignUpdate(ctx, cp->cert.ptr, 1887 ntohl(cp->cert.vallen)); 1888 if (EVP_SignFinal(ctx, cp->cert.sig, &len, sign_pkey)) { 1889 INSIST(len <= sign_siglen); 1890 cp->cert.siglen = htonl(len); 1891 } 1892 } 1893 1894 /* 1895 * Sign leapseconds values and timestamps. Note it is not an 1896 * error to return null values. 1897 */ 1898 tai_leap.tstamp = hostval.tstamp; 1899 tai_leap.fstamp = hostval.fstamp; 1900 1901 /* Get the leap second era. We might need a full lookup early 1902 * after start, when the cache is not yet loaded. 1903 */ 1904 leapsec_frame(&leap_data); 1905 if ( ! memcmp(&leap_data.ebase, &leap_data.ttime, sizeof(vint64))) { 1906 time_t now = time(NULL); 1907 uint32_t nowntp = (uint32_t)now + JAN_1970; 1908 leapsec_query(&leap_data, nowntp, &now); 1909 } 1910 1911 /* Create the data block. The protocol does not work without. */ 1912 len = 3 * sizeof(u_int32); 1913 if (tai_leap.ptr == NULL || ntohl(tai_leap.vallen) != len) { 1914 free(tai_leap.ptr); 1915 tai_leap.ptr = emalloc(len); 1916 tai_leap.vallen = htonl(len); 1917 } 1918 ptr = (u_int32 *)tai_leap.ptr; 1919 if (leap_data.tai_offs > 10) { 1920 /* create a TAI / leap era block. The end time is a 1921 * fake -- maybe we can do better. 1922 */ 1923 ptr[0] = htonl(leap_data.tai_offs); 1924 ptr[1] = htonl(leap_data.ebase.d_s.lo); 1925 if (leap_data.ttime.d_s.hi >= 0) 1926 ptr[2] = htonl(leap_data.ttime.D_s.lo + 7*86400); 1927 else 1928 ptr[2] = htonl(leap_data.ebase.D_s.lo + 25*86400); 1929 } else { 1930 /* no leap era available */ 1931 memset(ptr, 0, len); 1932 } 1933 if (tai_leap.sig == NULL) 1934 tai_leap.sig = emalloc(sign_siglen); 1935 EVP_SignInit(ctx, sign_digest); 1936 EVP_SignUpdate(ctx, (u_char *)&tai_leap, 12); 1937 EVP_SignUpdate(ctx, tai_leap.ptr, len); 1938 if (EVP_SignFinal(ctx, tai_leap.sig, &len, sign_pkey)) { 1939 INSIST(len <= sign_siglen); 1940 tai_leap.siglen = htonl(len); 1941 } 1942 crypto_flags |= CRYPTO_FLAG_TAI; 1943 1944 snprintf(statstr, sizeof(statstr), "signature update ts %u", 1945 ntohl(hostval.tstamp)); 1946 record_crypto_stats(NULL, statstr); 1947 DPRINTF(1, ("crypto_update: %s\n", statstr)); 1948 EVP_MD_CTX_free(ctx); 1949 } 1950 1951 /* 1952 * crypto_update_taichange - eventually trigger crypto_update 1953 * 1954 * This is called when a change in 'sys_tai' is detected. This will 1955 * happen shortly after a leap second is detected, but unhappily also 1956 * early after system start; also, the crypto stuff might be unused and 1957 * an unguarded call to crypto_update() causes a crash. 1958 * 1959 * This function makes sure that there already *is* a valid crypto block 1960 * for the use with autokey, and only calls 'crypto_update()' if it can 1961 * succeed. 1962 * 1963 * Returns void (no errors) 1964 */ 1965 void 1966 crypto_update_taichange(void) 1967 { 1968 static const u_int len = 3 * sizeof(u_int32); 1969 1970 /* check if the signing digest algo is available */ 1971 if (sign_digest == NULL || sign_pkey == NULL) 1972 return; 1973 1974 /* check size of TAI extension block */ 1975 if (tai_leap.ptr == NULL || ntohl(tai_leap.vallen) != len) 1976 return; 1977 1978 /* crypto_update should at least not crash here! */ 1979 crypto_update(); 1980 } 1981 1982 /* 1983 * value_free - free value structure components. 1984 * 1985 * Returns void (no errors) 1986 */ 1987 void 1988 value_free( 1989 struct value *vp /* value structure */ 1990 ) 1991 { 1992 if (vp->ptr != NULL) 1993 free(vp->ptr); 1994 if (vp->sig != NULL) 1995 free(vp->sig); 1996 memset(vp, 0, sizeof(struct value)); 1997 } 1998 1999 2000 /* 2001 * crypto_time - returns current NTP time. 2002 * 2003 * Returns NTP seconds if in synch, 0 otherwise 2004 */ 2005 tstamp_t 2006 crypto_time() 2007 { 2008 l_fp tstamp; /* NTP time */ 2009 2010 L_CLR(&tstamp); 2011 if (sys_leap != LEAP_NOTINSYNC) 2012 get_systime(&tstamp); 2013 return (tstamp.l_ui); 2014 } 2015 2016 2017 /* 2018 * asn_to_calendar - convert ASN1_TIME time structure to struct calendar. 2019 * 2020 */ 2021 static 2022 void 2023 asn_to_calendar ( 2024 const ASN1_TIME *asn1time, /* pointer to ASN1_TIME structure */ 2025 struct calendar *pjd /* pointer to result */ 2026 ) 2027 { 2028 size_t len; /* length of ASN1_TIME string */ 2029 char v[24]; /* writable copy of ASN1_TIME string */ 2030 unsigned long temp; /* result from strtoul */ 2031 2032 /* 2033 * Extract time string YYMMDDHHMMSSZ from ASN1 time structure. 2034 * Or YYYYMMDDHHMMSSZ. 2035 * Note that the YY, MM, DD fields start with one, the HH, MM, 2036 * SS fields start with zero and the Z character is ignored. 2037 * Also note that two-digit years less than 50 map to years greater than 2038 * 100. Dontcha love ASN.1? Better than MIL-188. 2039 */ 2040 len = asn1time->length; 2041 REQUIRE(len < sizeof(v)); 2042 (void)strncpy(v, (char *)(asn1time->data), len); 2043 REQUIRE(len >= 13); 2044 temp = strtoul(v+len-3, NULL, 10); 2045 pjd->second = temp; 2046 v[len-3] = '\0'; 2047 2048 temp = strtoul(v+len-5, NULL, 10); 2049 pjd->minute = temp; 2050 v[len-5] = '\0'; 2051 2052 temp = strtoul(v+len-7, NULL, 10); 2053 pjd->hour = temp; 2054 v[len-7] = '\0'; 2055 2056 temp = strtoul(v+len-9, NULL, 10); 2057 pjd->monthday = temp; 2058 v[len-9] = '\0'; 2059 2060 temp = strtoul(v+len-11, NULL, 10); 2061 pjd->month = temp; 2062 v[len-11] = '\0'; 2063 2064 temp = strtoul(v, NULL, 10); 2065 /* handle two-digit years */ 2066 if (temp < 50UL) 2067 temp += 100UL; 2068 if (temp < 150UL) 2069 temp += 1900UL; 2070 pjd->year = temp; 2071 2072 pjd->yearday = pjd->weekday = 0; 2073 return; 2074 } 2075 2076 2077 /* 2078 * bigdig() - compute a BIGNUM MD5 hash of a BIGNUM number. 2079 * 2080 * Returns void (no errors) 2081 */ 2082 static void 2083 bighash( 2084 BIGNUM *bn, /* BIGNUM * from */ 2085 BIGNUM *bk /* BIGNUM * to */ 2086 ) 2087 { 2088 EVP_MD_CTX *ctx; /* message digest context */ 2089 u_char dgst[EVP_MAX_MD_SIZE]; /* message digest */ 2090 u_char *ptr; /* a BIGNUM as binary string */ 2091 u_int len; 2092 2093 len = BN_num_bytes(bn); 2094 ptr = emalloc(len); 2095 BN_bn2bin(bn, ptr); 2096 ctx = EVP_MD_CTX_new(); 2097 # if defined(OPENSSL) && defined(EVP_MD_CTX_FLAG_NON_FIPS_ALLOW) 2098 /* [Bug 3457] set flags and don't kill them again */ 2099 EVP_MD_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW); 2100 EVP_DigestInit_ex(ctx, EVP_md5(), NULL); 2101 # else 2102 EVP_DigestInit(ctx, EVP_md5()); 2103 # endif 2104 EVP_DigestUpdate(ctx, ptr, len); 2105 EVP_DigestFinal(ctx, dgst, &len); 2106 EVP_MD_CTX_free(ctx); 2107 BN_bin2bn(dgst, len, bk); 2108 free(ptr); 2109 } 2110 2111 2112 /* 2113 *********************************************************************** 2114 * * 2115 * The following routines implement the Schnorr (IFF) identity scheme * 2116 * * 2117 *********************************************************************** 2118 * 2119 * The Schnorr (IFF) identity scheme is intended for use when 2120 * certificates are generated by some other trusted certificate 2121 * authority and the certificate cannot be used to convey public 2122 * parameters. There are two kinds of files: encrypted server files that 2123 * contain private and public values and nonencrypted client files that 2124 * contain only public values. New generations of server files must be 2125 * securely transmitted to all servers of the group; client files can be 2126 * distributed by any means. The scheme is self contained and 2127 * independent of new generations of host keys, sign keys and 2128 * certificates. 2129 * 2130 * The IFF values hide in a DSA cuckoo structure which uses the same 2131 * parameters. The values are used by an identity scheme based on DSA 2132 * cryptography and described in Stimson p. 285. The p is a 512-bit 2133 * prime, g a generator of Zp* and q a 160-bit prime that divides p - 1 2134 * and is a qth root of 1 mod p; that is, g^q = 1 mod p. The TA rolls a 2135 * private random group key b (0 < b < q) and public key v = g^b, then 2136 * sends (p, q, g, b) to the servers and (p, q, g, v) to the clients. 2137 * Alice challenges Bob to confirm identity using the protocol described 2138 * below. 2139 * 2140 * How it works 2141 * 2142 * The scheme goes like this. Both Alice and Bob have the public primes 2143 * p, q and generator g. The TA gives private key b to Bob and public 2144 * key v to Alice. 2145 * 2146 * Alice rolls new random challenge r (o < r < q) and sends to Bob in 2147 * the IFF request message. Bob rolls new random k (0 < k < q), then 2148 * computes y = k + b r mod q and x = g^k mod p and sends (y, hash(x)) 2149 * to Alice in the response message. Besides making the response 2150 * shorter, the hash makes it effectivey impossible for an intruder to 2151 * solve for b by observing a number of these messages. 2152 * 2153 * Alice receives the response and computes g^y v^r mod p. After a bit 2154 * of algebra, this simplifies to g^k. If the hash of this result 2155 * matches hash(x), Alice knows that Bob has the group key b. The signed 2156 * response binds this knowledge to Bob's private key and the public key 2157 * previously received in his certificate. 2158 * 2159 * crypto_alice - construct Alice's challenge in IFF scheme 2160 * 2161 * Returns 2162 * XEVNT_OK success 2163 * XEVNT_ID bad or missing group key 2164 * XEVNT_PUB bad or missing public key 2165 */ 2166 static int 2167 crypto_alice( 2168 struct peer *peer, /* peer pointer */ 2169 struct value *vp /* value pointer */ 2170 ) 2171 { 2172 DSA *dsa; /* IFF parameters */ 2173 BN_CTX *bctx; /* BIGNUM context */ 2174 EVP_MD_CTX *ctx; /* signature context */ 2175 tstamp_t tstamp; 2176 u_int len; 2177 const BIGNUM *q; 2178 2179 /* 2180 * The identity parameters must have correct format and content. 2181 */ 2182 if (peer->ident_pkey == NULL) { 2183 msyslog(LOG_NOTICE, "crypto_alice: scheme unavailable"); 2184 return (XEVNT_ID); 2185 } 2186 2187 if ((dsa = EVP_PKEY_get0_DSA(peer->ident_pkey->pkey)) == NULL) { 2188 msyslog(LOG_NOTICE, "crypto_alice: defective key"); 2189 return (XEVNT_PUB); 2190 } 2191 2192 /* 2193 * Roll new random r (0 < r < q). 2194 */ 2195 if (peer->iffval != NULL) 2196 BN_free(peer->iffval); 2197 peer->iffval = BN_new(); 2198 DSA_get0_pqg(dsa, NULL, &q, NULL); 2199 len = BN_num_bytes(q); 2200 BN_rand(peer->iffval, len * 8, -1, 1); /* r mod q*/ 2201 bctx = BN_CTX_new(); 2202 BN_mod(peer->iffval, peer->iffval, q, bctx); 2203 BN_CTX_free(bctx); 2204 2205 /* 2206 * Sign and send to Bob. The filestamp is from the local file. 2207 */ 2208 memset(vp, 0, sizeof(struct value)); 2209 tstamp = crypto_time(); 2210 vp->tstamp = htonl(tstamp); 2211 vp->fstamp = htonl(peer->ident_pkey->fstamp); 2212 vp->vallen = htonl(len); 2213 vp->ptr = emalloc(len); 2214 BN_bn2bin(peer->iffval, vp->ptr); 2215 if (tstamp == 0) 2216 return (XEVNT_OK); 2217 2218 vp->sig = emalloc(sign_siglen); 2219 ctx = EVP_MD_CTX_new(); 2220 EVP_SignInit(ctx, sign_digest); 2221 EVP_SignUpdate(ctx, (u_char *)&vp->tstamp, 12); 2222 EVP_SignUpdate(ctx, vp->ptr, len); 2223 if (EVP_SignFinal(ctx, vp->sig, &len, sign_pkey)) { 2224 INSIST(len <= sign_siglen); 2225 vp->siglen = htonl(len); 2226 } 2227 EVP_MD_CTX_free(ctx); 2228 return (XEVNT_OK); 2229 } 2230 2231 2232 /* 2233 * crypto_bob - construct Bob's response to Alice's challenge 2234 * 2235 * Returns 2236 * XEVNT_OK success 2237 * XEVNT_ERR protocol error 2238 * XEVNT_ID bad or missing group key 2239 */ 2240 static int 2241 crypto_bob( 2242 struct exten *ep, /* extension pointer */ 2243 struct value *vp /* value pointer */ 2244 ) 2245 { 2246 DSA *dsa; /* IFF parameters */ 2247 DSA_SIG *sdsa; /* DSA signature context fake */ 2248 BN_CTX *bctx; /* BIGNUM context */ 2249 EVP_MD_CTX *ctx; /* signature context */ 2250 tstamp_t tstamp; /* NTP timestamp */ 2251 BIGNUM *bn, *bk, *r; 2252 u_char *ptr; 2253 u_int len; /* extension field value length */ 2254 const BIGNUM *p, *q, *g; 2255 const BIGNUM *priv_key; 2256 2257 /* 2258 * If the IFF parameters are not valid, something awful 2259 * happened or we are being tormented. 2260 */ 2261 if (iffkey_info == NULL) { 2262 msyslog(LOG_NOTICE, "crypto_bob: scheme unavailable"); 2263 return (XEVNT_ID); 2264 } 2265 dsa = EVP_PKEY_get0_DSA(iffkey_info->pkey); 2266 DSA_get0_pqg(dsa, &p, &q, &g); 2267 DSA_get0_key(dsa, NULL, &priv_key); 2268 2269 /* 2270 * Extract r from the challenge. 2271 */ 2272 len = exten_payload_size(ep); 2273 if (len == 0 || len > MAX_VALLEN) 2274 return (XEVNT_LEN); 2275 if ((r = BN_bin2bn((u_char *)ep->pkt, len, NULL)) == NULL) { 2276 msyslog(LOG_ERR, "crypto_bob: %s", 2277 ERR_error_string(ERR_get_error(), NULL)); 2278 return (XEVNT_ERR); 2279 } 2280 2281 /* 2282 * Bob rolls random k (0 < k < q), computes y = k + b r mod q 2283 * and x = g^k mod p, then sends (y, hash(x)) to Alice. 2284 */ 2285 bctx = BN_CTX_new(); bk = BN_new(); bn = BN_new(); 2286 sdsa = DSA_SIG_new(); 2287 BN_rand(bk, len * 8, -1, 1); /* k */ 2288 BN_mod_mul(bn, priv_key, r, q, bctx); /* b r mod q */ 2289 BN_add(bn, bn, bk); 2290 BN_mod(bn, bn, q, bctx); /* k + b r mod q */ 2291 BN_mod_exp(bk, g, bk, p, bctx); /* g^k mod p */ 2292 bighash(bk, bk); 2293 DSA_SIG_set0(sdsa, bn, bk); 2294 BN_CTX_free(bctx); 2295 BN_free(r); 2296 #ifdef DEBUG 2297 if (debug > 1) 2298 DSA_print_fp(stdout, dsa, 0); 2299 #endif 2300 2301 /* 2302 * Encode the values in ASN.1 and sign. The filestamp is from 2303 * the local file. 2304 */ 2305 len = i2d_DSA_SIG(sdsa, NULL); 2306 if (len == 0) { 2307 msyslog(LOG_ERR, "crypto_bob: %s", 2308 ERR_error_string(ERR_get_error(), NULL)); 2309 DSA_SIG_free(sdsa); 2310 return (XEVNT_ERR); 2311 } 2312 if (len > MAX_VALLEN) { 2313 msyslog(LOG_ERR, "crypto_bob: signature is too big: %u", 2314 len); 2315 DSA_SIG_free(sdsa); 2316 return (XEVNT_LEN); 2317 } 2318 memset(vp, 0, sizeof(struct value)); 2319 tstamp = crypto_time(); 2320 vp->tstamp = htonl(tstamp); 2321 vp->fstamp = htonl(iffkey_info->fstamp); 2322 vp->vallen = htonl(len); 2323 ptr = emalloc(len); 2324 vp->ptr = ptr; 2325 i2d_DSA_SIG(sdsa, &ptr); 2326 DSA_SIG_free(sdsa); 2327 if (tstamp == 0) 2328 return (XEVNT_OK); 2329 2330 /* XXX: more validation to make sure the sign fits... */ 2331 vp->sig = emalloc(sign_siglen); 2332 ctx = EVP_MD_CTX_new(); 2333 EVP_SignInit(ctx, sign_digest); 2334 EVP_SignUpdate(ctx, (u_char *)&vp->tstamp, 12); 2335 EVP_SignUpdate(ctx, vp->ptr, len); 2336 if (EVP_SignFinal(ctx, vp->sig, &len, sign_pkey)) { 2337 INSIST(len <= sign_siglen); 2338 vp->siglen = htonl(len); 2339 } 2340 EVP_MD_CTX_free(ctx); 2341 return (XEVNT_OK); 2342 } 2343 2344 2345 /* 2346 * crypto_iff - verify Bob's response to Alice's challenge 2347 * 2348 * Returns 2349 * XEVNT_OK success 2350 * XEVNT_FSP bad filestamp 2351 * XEVNT_ID bad or missing group key 2352 * XEVNT_PUB bad or missing public key 2353 */ 2354 int 2355 crypto_iff( 2356 struct exten *ep, /* extension pointer */ 2357 struct peer *peer /* peer structure pointer */ 2358 ) 2359 { 2360 DSA *dsa; /* IFF parameters */ 2361 BN_CTX *bctx; /* BIGNUM context */ 2362 DSA_SIG *sdsa; /* DSA parameters */ 2363 BIGNUM *bn, *bk; 2364 u_int len; 2365 const u_char *ptr; 2366 int temp; 2367 const BIGNUM *p, *g; 2368 const BIGNUM *r, *s; 2369 const BIGNUM *pub_key; 2370 2371 /* 2372 * If the IFF parameters are not valid or no challenge was sent, 2373 * something awful happened or we are being tormented. 2374 */ 2375 if (peer->ident_pkey == NULL) { 2376 msyslog(LOG_NOTICE, "crypto_iff: scheme unavailable"); 2377 return (XEVNT_ID); 2378 } 2379 if (ntohl(ep->fstamp) != peer->ident_pkey->fstamp) { 2380 msyslog(LOG_NOTICE, "crypto_iff: invalid filestamp %u", 2381 ntohl(ep->fstamp)); 2382 return (XEVNT_FSP); 2383 } 2384 if ((dsa = EVP_PKEY_get0_DSA(peer->ident_pkey->pkey)) == NULL) { 2385 msyslog(LOG_NOTICE, "crypto_iff: defective key"); 2386 return (XEVNT_PUB); 2387 } 2388 if (peer->iffval == NULL) { 2389 msyslog(LOG_NOTICE, "crypto_iff: missing challenge"); 2390 return (XEVNT_ID); 2391 } 2392 2393 /* 2394 * Extract the k + b r and g^k values from the response. 2395 */ 2396 bctx = BN_CTX_new(); bk = BN_new(); bn = BN_new(); 2397 len = ntohl(ep->vallen); 2398 ptr = (u_char *)ep->pkt; 2399 if ((sdsa = d2i_DSA_SIG(NULL, &ptr, len)) == NULL) { 2400 BN_free(bn); BN_free(bk); BN_CTX_free(bctx); 2401 msyslog(LOG_ERR, "crypto_iff: %s", 2402 ERR_error_string(ERR_get_error(), NULL)); 2403 return (XEVNT_ERR); 2404 } 2405 2406 /* 2407 * Compute g^(k + b r) g^(q - b)r mod p. 2408 */ 2409 DSA_get0_key(dsa, &pub_key, NULL); 2410 DSA_get0_pqg(dsa, &p, NULL, &g); 2411 DSA_SIG_get0(sdsa, &r, &s); 2412 BN_mod_exp(bn, pub_key, peer->iffval, p, bctx); 2413 BN_mod_exp(bk, g, r, p, bctx); 2414 BN_mod_mul(bn, bn, bk, p, bctx); 2415 2416 /* 2417 * Verify the hash of the result matches hash(x). 2418 */ 2419 bighash(bn, bn); 2420 temp = BN_cmp(bn, s); 2421 BN_free(bn); BN_free(bk); BN_CTX_free(bctx); 2422 BN_free(peer->iffval); 2423 peer->iffval = NULL; 2424 DSA_SIG_free(sdsa); 2425 if (temp == 0) 2426 return (XEVNT_OK); 2427 2428 msyslog(LOG_NOTICE, "crypto_iff: identity not verified"); 2429 return (XEVNT_ID); 2430 } 2431 2432 2433 /* 2434 *********************************************************************** 2435 * * 2436 * The following routines implement the Guillou-Quisquater (GQ) * 2437 * identity scheme * 2438 * * 2439 *********************************************************************** 2440 * 2441 * The Guillou-Quisquater (GQ) identity scheme is intended for use when 2442 * the certificate can be used to convey public parameters. The scheme 2443 * uses a X509v3 certificate extension field do convey the public key of 2444 * a private key known only to servers. There are two kinds of files: 2445 * encrypted server files that contain private and public values and 2446 * nonencrypted client files that contain only public values. New 2447 * generations of server files must be securely transmitted to all 2448 * servers of the group; client files can be distributed by any means. 2449 * The scheme is self contained and independent of new generations of 2450 * host keys and sign keys. The scheme is self contained and independent 2451 * of new generations of host keys and sign keys. 2452 * 2453 * The GQ parameters hide in a RSA cuckoo structure which uses the same 2454 * parameters. The values are used by an identity scheme based on RSA 2455 * cryptography and described in Stimson p. 300 (with errors). The 512- 2456 * bit public modulus is n = p q, where p and q are secret large primes. 2457 * The TA rolls private random group key b as RSA exponent. These values 2458 * are known to all group members. 2459 * 2460 * When rolling new certificates, a server recomputes the private and 2461 * public keys. The private key u is a random roll, while the public key 2462 * is the inverse obscured by the group key v = (u^-1)^b. These values 2463 * replace the private and public keys normally generated by the RSA 2464 * scheme. Alice challenges Bob to confirm identity using the protocol 2465 * described below. 2466 * 2467 * How it works 2468 * 2469 * The scheme goes like this. Both Alice and Bob have the same modulus n 2470 * and some random b as the group key. These values are computed and 2471 * distributed in advance via secret means, although only the group key 2472 * b is truly secret. Each has a private random private key u and public 2473 * key (u^-1)^b, although not necessarily the same ones. Bob and Alice 2474 * can regenerate the key pair from time to time without affecting 2475 * operations. The public key is conveyed on the certificate in an 2476 * extension field; the private key is never revealed. 2477 * 2478 * Alice rolls new random challenge r and sends to Bob in the GQ 2479 * request message. Bob rolls new random k, then computes y = k u^r mod 2480 * n and x = k^b mod n and sends (y, hash(x)) to Alice in the response 2481 * message. Besides making the response shorter, the hash makes it 2482 * effectivey impossible for an intruder to solve for b by observing 2483 * a number of these messages. 2484 * 2485 * Alice receives the response and computes y^b v^r mod n. After a bit 2486 * of algebra, this simplifies to k^b. If the hash of this result 2487 * matches hash(x), Alice knows that Bob has the group key b. The signed 2488 * response binds this knowledge to Bob's private key and the public key 2489 * previously received in his certificate. 2490 * 2491 * crypto_alice2 - construct Alice's challenge in GQ scheme 2492 * 2493 * Returns 2494 * XEVNT_OK success 2495 * XEVNT_ID bad or missing group key 2496 * XEVNT_PUB bad or missing public key 2497 */ 2498 static int 2499 crypto_alice2( 2500 struct peer *peer, /* peer pointer */ 2501 struct value *vp /* value pointer */ 2502 ) 2503 { 2504 RSA *rsa; /* GQ parameters */ 2505 BN_CTX *bctx; /* BIGNUM context */ 2506 EVP_MD_CTX *ctx; /* signature context */ 2507 tstamp_t tstamp; 2508 u_int len; 2509 const BIGNUM *n; 2510 2511 /* 2512 * The identity parameters must have correct format and content. 2513 */ 2514 if (peer->ident_pkey == NULL) 2515 return (XEVNT_ID); 2516 2517 if ((rsa = EVP_PKEY_get0_RSA(peer->ident_pkey->pkey)) == NULL) { 2518 msyslog(LOG_NOTICE, "crypto_alice2: defective key"); 2519 return (XEVNT_PUB); 2520 } 2521 2522 /* 2523 * Roll new random r (0 < r < n). 2524 */ 2525 if (peer->iffval != NULL) 2526 BN_free(peer->iffval); 2527 peer->iffval = BN_new(); 2528 RSA_get0_key(rsa, &n, NULL, NULL); 2529 len = BN_num_bytes(n); 2530 BN_rand(peer->iffval, len * 8, -1, 1); /* r mod n */ 2531 bctx = BN_CTX_new(); 2532 BN_mod(peer->iffval, peer->iffval, n, bctx); 2533 BN_CTX_free(bctx); 2534 2535 /* 2536 * Sign and send to Bob. The filestamp is from the local file. 2537 */ 2538 memset(vp, 0, sizeof(struct value)); 2539 tstamp = crypto_time(); 2540 vp->tstamp = htonl(tstamp); 2541 vp->fstamp = htonl(peer->ident_pkey->fstamp); 2542 vp->vallen = htonl(len); 2543 vp->ptr = emalloc(len); 2544 BN_bn2bin(peer->iffval, vp->ptr); 2545 if (tstamp == 0) 2546 return (XEVNT_OK); 2547 2548 vp->sig = emalloc(sign_siglen); 2549 ctx = EVP_MD_CTX_new(); 2550 EVP_SignInit(ctx, sign_digest); 2551 EVP_SignUpdate(ctx, (u_char *)&vp->tstamp, 12); 2552 EVP_SignUpdate(ctx, vp->ptr, len); 2553 if (EVP_SignFinal(ctx, vp->sig, &len, sign_pkey)) { 2554 INSIST(len <= sign_siglen); 2555 vp->siglen = htonl(len); 2556 } 2557 EVP_MD_CTX_free(ctx); 2558 return (XEVNT_OK); 2559 } 2560 2561 2562 /* 2563 * crypto_bob2 - construct Bob's response to Alice's challenge 2564 * 2565 * Returns 2566 * XEVNT_OK success 2567 * XEVNT_ERR protocol error 2568 * XEVNT_ID bad or missing group key 2569 */ 2570 static int 2571 crypto_bob2( 2572 struct exten *ep, /* extension pointer */ 2573 struct value *vp /* value pointer */ 2574 ) 2575 { 2576 RSA *rsa; /* GQ parameters */ 2577 DSA_SIG *sdsa; /* DSA parameters */ 2578 BN_CTX *bctx; /* BIGNUM context */ 2579 EVP_MD_CTX *ctx; /* signature context */ 2580 tstamp_t tstamp; /* NTP timestamp */ 2581 BIGNUM *r, *k, *g, *y; 2582 u_char *ptr; 2583 u_int len; 2584 int s_len; 2585 const BIGNUM *n, *p, *e; 2586 2587 /* 2588 * If the GQ parameters are not valid, something awful 2589 * happened or we are being tormented. 2590 */ 2591 if (gqkey_info == NULL) { 2592 msyslog(LOG_NOTICE, "crypto_bob2: scheme unavailable"); 2593 return (XEVNT_ID); 2594 } 2595 rsa = EVP_PKEY_get0_RSA(gqkey_info->pkey); 2596 RSA_get0_key(rsa, &n, &p, &e); 2597 2598 /* 2599 * Extract r from the challenge. 2600 */ 2601 len = exten_payload_size(ep); 2602 if (len == 0 || len > MAX_VALLEN) 2603 return (XEVNT_LEN); 2604 if ((r = BN_bin2bn((u_char *)ep->pkt, len, NULL)) == NULL) { 2605 msyslog(LOG_ERR, "crypto_bob2: %s", 2606 ERR_error_string(ERR_get_error(), NULL)); 2607 return (XEVNT_ERR); 2608 } 2609 2610 /* 2611 * Bob rolls random k (0 < k < n), computes y = k u^r mod n and 2612 * x = k^b mod n, then sends (y, hash(x)) to Alice. 2613 */ 2614 bctx = BN_CTX_new(); k = BN_new(); g = BN_new(); y = BN_new(); 2615 sdsa = DSA_SIG_new(); 2616 BN_rand(k, len * 8, -1, 1); /* k */ 2617 BN_mod(k, k, n, bctx); 2618 BN_mod_exp(y, p, r, n, bctx); /* u^r mod n */ 2619 BN_mod_mul(y, k, y, n, bctx); /* k u^r mod n */ 2620 BN_mod_exp(g, k, e, n, bctx); /* k^b mod n */ 2621 bighash(g, g); 2622 DSA_SIG_set0(sdsa, y, g); 2623 BN_CTX_free(bctx); 2624 BN_free(r); BN_free(k); 2625 #ifdef DEBUG 2626 if (debug > 1) 2627 RSA_print_fp(stdout, rsa, 0); 2628 #endif 2629 2630 /* 2631 * Encode the values in ASN.1 and sign. The filestamp is from 2632 * the local file. 2633 */ 2634 len = s_len = i2d_DSA_SIG(sdsa, NULL); 2635 if (s_len <= 0) { 2636 msyslog(LOG_ERR, "crypto_bob2: %s", 2637 ERR_error_string(ERR_get_error(), NULL)); 2638 DSA_SIG_free(sdsa); 2639 return (XEVNT_ERR); 2640 } 2641 memset(vp, 0, sizeof(struct value)); 2642 tstamp = crypto_time(); 2643 vp->tstamp = htonl(tstamp); 2644 vp->fstamp = htonl(gqkey_info->fstamp); 2645 vp->vallen = htonl(len); 2646 ptr = emalloc(len); 2647 vp->ptr = ptr; 2648 i2d_DSA_SIG(sdsa, &ptr); 2649 DSA_SIG_free(sdsa); 2650 if (tstamp == 0) 2651 return (XEVNT_OK); 2652 2653 vp->sig = emalloc(sign_siglen); 2654 ctx = EVP_MD_CTX_new(); 2655 EVP_SignInit(ctx, sign_digest); 2656 EVP_SignUpdate(ctx, (u_char *)&vp->tstamp, 12); 2657 EVP_SignUpdate(ctx, vp->ptr, len); 2658 if (EVP_SignFinal(ctx, vp->sig, &len, sign_pkey)) { 2659 INSIST(len <= sign_siglen); 2660 vp->siglen = htonl(len); 2661 } 2662 EVP_MD_CTX_free(ctx); 2663 return (XEVNT_OK); 2664 } 2665 2666 2667 /* 2668 * crypto_gq - verify Bob's response to Alice's challenge 2669 * 2670 * Returns 2671 * XEVNT_OK success 2672 * XEVNT_ERR protocol error 2673 * XEVNT_FSP bad filestamp 2674 * XEVNT_ID bad or missing group keys 2675 * XEVNT_PUB bad or missing public key 2676 */ 2677 int 2678 crypto_gq( 2679 struct exten *ep, /* extension pointer */ 2680 struct peer *peer /* peer structure pointer */ 2681 ) 2682 { 2683 RSA *rsa; /* GQ parameters */ 2684 BN_CTX *bctx; /* BIGNUM context */ 2685 DSA_SIG *sdsa; /* RSA signature context fake */ 2686 BIGNUM *y, *v; 2687 const u_char *ptr; 2688 long len; 2689 u_int temp; 2690 const BIGNUM *n, *e; 2691 const BIGNUM *r, *s; 2692 2693 /* 2694 * If the GQ parameters are not valid or no challenge was sent, 2695 * something awful happened or we are being tormented. Note that 2696 * the filestamp on the local key file can be greater than on 2697 * the remote parameter file if the keys have been refreshed. 2698 */ 2699 if (peer->ident_pkey == NULL) { 2700 msyslog(LOG_NOTICE, "crypto_gq: scheme unavailable"); 2701 return (XEVNT_ID); 2702 } 2703 if (ntohl(ep->fstamp) < peer->ident_pkey->fstamp) { 2704 msyslog(LOG_NOTICE, "crypto_gq: invalid filestamp %u", 2705 ntohl(ep->fstamp)); 2706 return (XEVNT_FSP); 2707 } 2708 if ((rsa = EVP_PKEY_get0_RSA(peer->ident_pkey->pkey)) == NULL) { 2709 msyslog(LOG_NOTICE, "crypto_gq: defective key"); 2710 return (XEVNT_PUB); 2711 } 2712 RSA_get0_key(rsa, &n, NULL, &e); 2713 if (peer->iffval == NULL) { 2714 msyslog(LOG_NOTICE, "crypto_gq: missing challenge"); 2715 return (XEVNT_ID); 2716 } 2717 2718 /* 2719 * Extract the y = k u^r and hash(x = k^b) values from the 2720 * response. 2721 */ 2722 bctx = BN_CTX_new(); y = BN_new(); v = BN_new(); 2723 len = ntohl(ep->vallen); 2724 ptr = (u_char *)ep->pkt; 2725 if ((sdsa = d2i_DSA_SIG(NULL, &ptr, len)) == NULL) { 2726 BN_CTX_free(bctx); BN_free(y); BN_free(v); 2727 msyslog(LOG_ERR, "crypto_gq: %s", 2728 ERR_error_string(ERR_get_error(), NULL)); 2729 return (XEVNT_ERR); 2730 } 2731 DSA_SIG_get0(sdsa, &r, &s); 2732 2733 /* 2734 * Compute v^r y^b mod n. 2735 */ 2736 if (peer->grpkey == NULL) { 2737 msyslog(LOG_NOTICE, "crypto_gq: missing group key"); 2738 return (XEVNT_ID); 2739 } 2740 BN_mod_exp(v, peer->grpkey, peer->iffval, n, bctx); 2741 /* v^r mod n */ 2742 BN_mod_exp(y, r, e, n, bctx); /* y^b mod n */ 2743 BN_mod_mul(y, v, y, n, bctx); /* v^r y^b mod n */ 2744 2745 /* 2746 * Verify the hash of the result matches hash(x). 2747 */ 2748 bighash(y, y); 2749 temp = BN_cmp(y, s); 2750 BN_CTX_free(bctx); BN_free(y); BN_free(v); 2751 BN_free(peer->iffval); 2752 peer->iffval = NULL; 2753 DSA_SIG_free(sdsa); 2754 if (temp == 0) 2755 return (XEVNT_OK); 2756 2757 msyslog(LOG_NOTICE, "crypto_gq: identity not verified"); 2758 return (XEVNT_ID); 2759 } 2760 2761 2762 /* 2763 *********************************************************************** 2764 * * 2765 * The following routines implement the Mu-Varadharajan (MV) identity * 2766 * scheme * 2767 * * 2768 *********************************************************************** 2769 * 2770 * The Mu-Varadharajan (MV) cryptosystem was originally intended when 2771 * servers broadcast messages to clients, but clients never send 2772 * messages to servers. There is one encryption key for the server and a 2773 * separate decryption key for each client. It operated something like a 2774 * pay-per-view satellite broadcasting system where the session key is 2775 * encrypted by the broadcaster and the decryption keys are held in a 2776 * tamperproof set-top box. 2777 * 2778 * The MV parameters and private encryption key hide in a DSA cuckoo 2779 * structure which uses the same parameters, but generated in a 2780 * different way. The values are used in an encryption scheme similar to 2781 * El Gamal cryptography and a polynomial formed from the expansion of 2782 * product terms (x - x[j]), as described in Mu, Y., and V. 2783 * Varadharajan: Robust and Secure Broadcasting, Proc. Indocrypt 2001, 2784 * 223-231. The paper has significant errors and serious omissions. 2785 * 2786 * Let q be the product of n distinct primes s1[j] (j = 1...n), where 2787 * each s1[j] has m significant bits. Let p be a prime p = 2 * q + 1, so 2788 * that q and each s1[j] divide p - 1 and p has M = n * m + 1 2789 * significant bits. Let g be a generator of Zp; that is, gcd(g, p - 1) 2790 * = 1 and g^q = 1 mod p. We do modular arithmetic over Zq and then 2791 * project into Zp* as exponents of g. Sometimes we have to compute an 2792 * inverse b^-1 of random b in Zq, but for that purpose we require 2793 * gcd(b, q) = 1. We expect M to be in the 500-bit range and n 2794 * relatively small, like 30. These are the parameters of the scheme and 2795 * they are expensive to compute. 2796 * 2797 * We set up an instance of the scheme as follows. A set of random 2798 * values x[j] mod q (j = 1...n), are generated as the zeros of a 2799 * polynomial of order n. The product terms (x - x[j]) are expanded to 2800 * form coefficients a[i] mod q (i = 0...n) in powers of x. These are 2801 * used as exponents of the generator g mod p to generate the private 2802 * encryption key A. The pair (gbar, ghat) of public server keys and the 2803 * pairs (xbar[j], xhat[j]) (j = 1...n) of private client keys are used 2804 * to construct the decryption keys. The devil is in the details. 2805 * 2806 * This routine generates a private server encryption file including the 2807 * private encryption key E and partial decryption keys gbar and ghat. 2808 * It then generates public client decryption files including the public 2809 * keys xbar[j] and xhat[j] for each client j. The partial decryption 2810 * files are used to compute the inverse of E. These values are suitably 2811 * blinded so secrets are not revealed. 2812 * 2813 * The distinguishing characteristic of this scheme is the capability to 2814 * revoke keys. Included in the calculation of E, gbar and ghat is the 2815 * product s = prod(s1[j]) (j = 1...n) above. If the factor s1[j] is 2816 * subsequently removed from the product and E, gbar and ghat 2817 * recomputed, the jth client will no longer be able to compute E^-1 and 2818 * thus unable to decrypt the messageblock. 2819 * 2820 * How it works 2821 * 2822 * The scheme goes like this. Bob has the server values (p, E, q, gbar, 2823 * ghat) and Alice has the client values (p, xbar, xhat). 2824 * 2825 * Alice rolls new random nonce r mod p and sends to Bob in the MV 2826 * request message. Bob rolls random nonce k mod q, encrypts y = r E^k 2827 * mod p and sends (y, gbar^k, ghat^k) to Alice. 2828 * 2829 * Alice receives the response and computes the inverse (E^k)^-1 from 2830 * the partial decryption keys gbar^k, ghat^k, xbar and xhat. She then 2831 * decrypts y and verifies it matches the original r. The signed 2832 * response binds this knowledge to Bob's private key and the public key 2833 * previously received in his certificate. 2834 * 2835 * crypto_alice3 - construct Alice's challenge in MV scheme 2836 * 2837 * Returns 2838 * XEVNT_OK success 2839 * XEVNT_ID bad or missing group key 2840 * XEVNT_PUB bad or missing public key 2841 */ 2842 static int 2843 crypto_alice3( 2844 struct peer *peer, /* peer pointer */ 2845 struct value *vp /* value pointer */ 2846 ) 2847 { 2848 DSA *dsa; /* MV parameters */ 2849 BN_CTX *bctx; /* BIGNUM context */ 2850 EVP_MD_CTX *ctx; /* signature context */ 2851 tstamp_t tstamp; 2852 u_int len; 2853 const BIGNUM *p; 2854 2855 /* 2856 * The identity parameters must have correct format and content. 2857 */ 2858 if (peer->ident_pkey == NULL) 2859 return (XEVNT_ID); 2860 2861 if ((dsa = EVP_PKEY_get0_DSA(peer->ident_pkey->pkey)) == NULL) { 2862 msyslog(LOG_NOTICE, "crypto_alice3: defective key"); 2863 return (XEVNT_PUB); 2864 } 2865 DSA_get0_pqg(dsa, &p, NULL, NULL); 2866 2867 /* 2868 * Roll new random r (0 < r < q). 2869 */ 2870 if (peer->iffval != NULL) 2871 BN_free(peer->iffval); 2872 peer->iffval = BN_new(); 2873 len = BN_num_bytes(p); 2874 BN_rand(peer->iffval, len * 8, -1, 1); /* r mod p */ 2875 bctx = BN_CTX_new(); 2876 BN_mod(peer->iffval, peer->iffval, p, bctx); 2877 BN_CTX_free(bctx); 2878 2879 /* 2880 * Sign and send to Bob. The filestamp is from the local file. 2881 */ 2882 memset(vp, 0, sizeof(struct value)); 2883 tstamp = crypto_time(); 2884 vp->tstamp = htonl(tstamp); 2885 vp->fstamp = htonl(peer->ident_pkey->fstamp); 2886 vp->vallen = htonl(len); 2887 vp->ptr = emalloc(len); 2888 BN_bn2bin(peer->iffval, vp->ptr); 2889 if (tstamp == 0) 2890 return (XEVNT_OK); 2891 2892 vp->sig = emalloc(sign_siglen); 2893 ctx = EVP_MD_CTX_new(); 2894 EVP_SignInit(ctx, sign_digest); 2895 EVP_SignUpdate(ctx, (u_char *)&vp->tstamp, 12); 2896 EVP_SignUpdate(ctx, vp->ptr, len); 2897 if (EVP_SignFinal(ctx, vp->sig, &len, sign_pkey)) { 2898 INSIST(len <= sign_siglen); 2899 vp->siglen = htonl(len); 2900 } 2901 EVP_MD_CTX_free(ctx); 2902 return (XEVNT_OK); 2903 } 2904 2905 2906 /* 2907 * crypto_bob3 - construct Bob's response to Alice's challenge 2908 * 2909 * Returns 2910 * XEVNT_OK success 2911 * XEVNT_ERR protocol error 2912 */ 2913 static int 2914 crypto_bob3( 2915 struct exten *ep, /* extension pointer */ 2916 struct value *vp /* value pointer */ 2917 ) 2918 { 2919 DSA *dsa; /* MV parameters */ 2920 DSA *sdsa; /* DSA signature context fake */ 2921 BN_CTX *bctx; /* BIGNUM context */ 2922 EVP_MD_CTX *ctx; /* signature context */ 2923 tstamp_t tstamp; /* NTP timestamp */ 2924 BIGNUM *r, *k, *u; 2925 u_char *ptr; 2926 u_int len; 2927 const BIGNUM *p, *q, *g; 2928 const BIGNUM *pub_key, *priv_key; 2929 BIGNUM *sp, *sq, *sg; 2930 2931 /* 2932 * If the MV parameters are not valid, something awful 2933 * happened or we are being tormented. 2934 */ 2935 if (mvkey_info == NULL) { 2936 msyslog(LOG_NOTICE, "crypto_bob3: scheme unavailable"); 2937 return (XEVNT_ID); 2938 } 2939 dsa = EVP_PKEY_get0_DSA(mvkey_info->pkey); 2940 DSA_get0_pqg(dsa, &p, &q, &g); 2941 DSA_get0_key(dsa, &pub_key, &priv_key); 2942 2943 /* 2944 * Extract r from the challenge. 2945 */ 2946 len = exten_payload_size(ep); 2947 if (len == 0 || len > MAX_VALLEN) 2948 return (XEVNT_LEN); 2949 if ((r = BN_bin2bn((u_char *)ep->pkt, len, NULL)) == NULL) { 2950 msyslog(LOG_ERR, "crypto_bob3: %s", 2951 ERR_error_string(ERR_get_error(), NULL)); 2952 return (XEVNT_ERR); 2953 } 2954 2955 /* 2956 * Bob rolls random k (0 < k < q), making sure it is not a 2957 * factor of q. He then computes y = r A^k and sends (y, gbar^k, 2958 * and ghat^k) to Alice. 2959 */ 2960 bctx = BN_CTX_new(); k = BN_new(); u = BN_new(); 2961 sdsa = DSA_new(); 2962 sp = BN_new(); sq = BN_new(); sg = BN_new(); 2963 while (1) { 2964 BN_rand(k, BN_num_bits(q), 0, 0); 2965 BN_mod(k, k, q, bctx); 2966 BN_gcd(u, k, q, bctx); 2967 if (BN_is_one(u)) 2968 break; 2969 } 2970 BN_mod_exp(u, g, k, p, bctx); /* A^k r */ 2971 BN_mod_mul(sp, u, r, p, bctx); 2972 BN_mod_exp(sq, priv_key, k, p, bctx); /* gbar */ 2973 BN_mod_exp(sg, pub_key, k, p, bctx); /* ghat */ 2974 DSA_set0_key(sdsa, BN_dup(pub_key), NULL); 2975 DSA_set0_pqg(sdsa, sp, sq, sg); 2976 BN_CTX_free(bctx); BN_free(k); BN_free(r); BN_free(u); 2977 #ifdef DEBUG 2978 if (debug > 1) 2979 DSA_print_fp(stdout, sdsa, 0); 2980 #endif 2981 2982 /* 2983 * Encode the values in ASN.1 and sign. The filestamp is from 2984 * the local file. 2985 */ 2986 memset(vp, 0, sizeof(struct value)); 2987 tstamp = crypto_time(); 2988 vp->tstamp = htonl(tstamp); 2989 vp->fstamp = htonl(mvkey_info->fstamp); 2990 len = i2d_DSAparams(sdsa, NULL); 2991 if (len == 0) { 2992 msyslog(LOG_ERR, "crypto_bob3: %s", 2993 ERR_error_string(ERR_get_error(), NULL)); 2994 DSA_free(sdsa); 2995 return (XEVNT_ERR); 2996 } 2997 vp->vallen = htonl(len); 2998 ptr = emalloc(len); 2999 vp->ptr = ptr; 3000 i2d_DSAparams(sdsa, &ptr); 3001 DSA_free(sdsa); 3002 if (tstamp == 0) 3003 return (XEVNT_OK); 3004 3005 vp->sig = emalloc(sign_siglen); 3006 ctx = EVP_MD_CTX_new(); 3007 EVP_SignInit(ctx, sign_digest); 3008 EVP_SignUpdate(ctx, (u_char *)&vp->tstamp, 12); 3009 EVP_SignUpdate(ctx, vp->ptr, len); 3010 if (EVP_SignFinal(ctx, vp->sig, &len, sign_pkey)) { 3011 INSIST(len <= sign_siglen); 3012 vp->siglen = htonl(len); 3013 } 3014 EVP_MD_CTX_free(ctx); 3015 return (XEVNT_OK); 3016 } 3017 3018 3019 /* 3020 * crypto_mv - verify Bob's response to Alice's challenge 3021 * 3022 * Returns 3023 * XEVNT_OK success 3024 * XEVNT_ERR protocol error 3025 * XEVNT_FSP bad filestamp 3026 * XEVNT_ID bad or missing group key 3027 * XEVNT_PUB bad or missing public key 3028 */ 3029 int 3030 crypto_mv( 3031 struct exten *ep, /* extension pointer */ 3032 struct peer *peer /* peer structure pointer */ 3033 ) 3034 { 3035 DSA *dsa; /* MV parameters */ 3036 DSA *sdsa; /* DSA parameters */ 3037 BN_CTX *bctx; /* BIGNUM context */ 3038 BIGNUM *k, *u, *v; 3039 u_int len; 3040 const u_char *ptr; 3041 int temp; 3042 const BIGNUM *p; 3043 const BIGNUM *pub_key, *priv_key; 3044 const BIGNUM *sp, *sq, *sg; 3045 3046 /* 3047 * If the MV parameters are not valid or no challenge was sent, 3048 * something awful happened or we are being tormented. 3049 */ 3050 if (peer->ident_pkey == NULL) { 3051 msyslog(LOG_NOTICE, "crypto_mv: scheme unavailable"); 3052 return (XEVNT_ID); 3053 } 3054 if (ntohl(ep->fstamp) != peer->ident_pkey->fstamp) { 3055 msyslog(LOG_NOTICE, "crypto_mv: invalid filestamp %u", 3056 ntohl(ep->fstamp)); 3057 return (XEVNT_FSP); 3058 } 3059 if ((dsa = EVP_PKEY_get0_DSA(peer->ident_pkey->pkey)) == NULL) { 3060 msyslog(LOG_NOTICE, "crypto_mv: defective key"); 3061 return (XEVNT_PUB); 3062 } 3063 DSA_get0_pqg(dsa, &p, NULL, NULL); 3064 DSA_get0_key(dsa, &pub_key, &priv_key); 3065 if (peer->iffval == NULL) { 3066 msyslog(LOG_NOTICE, "crypto_mv: missing challenge"); 3067 return (XEVNT_ID); 3068 } 3069 3070 /* 3071 * Extract the y, gbar and ghat values from the response. 3072 */ 3073 bctx = BN_CTX_new(); k = BN_new(); u = BN_new(); v = BN_new(); 3074 len = ntohl(ep->vallen); 3075 ptr = (u_char *)ep->pkt; 3076 if ((sdsa = d2i_DSAparams(NULL, &ptr, len)) == NULL) { 3077 msyslog(LOG_ERR, "crypto_mv: %s", 3078 ERR_error_string(ERR_get_error(), NULL)); 3079 return (XEVNT_ERR); 3080 } 3081 DSA_get0_pqg(sdsa, &sp, &sq, &sg); 3082 3083 /* 3084 * Compute (gbar^xhat ghat^xbar) mod p. 3085 */ 3086 BN_mod_exp(u, sq, pub_key, p, bctx); 3087 BN_mod_exp(v, sg, priv_key, p, bctx); 3088 BN_mod_mul(u, u, v, p, bctx); 3089 BN_mod_mul(u, u, sp, p, bctx); 3090 3091 /* 3092 * The result should match r. 3093 */ 3094 temp = BN_cmp(u, peer->iffval); 3095 BN_CTX_free(bctx); BN_free(k); BN_free(u); BN_free(v); 3096 BN_free(peer->iffval); 3097 peer->iffval = NULL; 3098 DSA_free(sdsa); 3099 if (temp == 0) 3100 return (XEVNT_OK); 3101 3102 msyslog(LOG_NOTICE, "crypto_mv: identity not verified"); 3103 return (XEVNT_ID); 3104 } 3105 3106 3107 /* 3108 *********************************************************************** 3109 * * 3110 * The following routines are used to manipulate certificates * 3111 * * 3112 *********************************************************************** 3113 */ 3114 /* 3115 * cert_sign - sign x509 certificate equest and update value structure. 3116 * 3117 * The certificate request includes a copy of the host certificate, 3118 * which includes the version number, subject name and public key of the 3119 * host. The resulting certificate includes these values plus the 3120 * serial number, issuer name and valid interval of the server. The 3121 * valid interval extends from the current time to the same time one 3122 * year hence. This may extend the life of the signed certificate beyond 3123 * that of the signer certificate. 3124 * 3125 * It is convenient to use the NTP seconds of the current time as the 3126 * serial number. In the value structure the timestamp is the current 3127 * time and the filestamp is taken from the extension field. Note this 3128 * routine is called only when the client clock is synchronized to a 3129 * proventic source, so timestamp comparisons are valid. 3130 * 3131 * The host certificate is valid from the time it was generated for a 3132 * period of one year. A signed certificate is valid from the time of 3133 * signature for a period of one year, but only the host certificate (or 3134 * sign certificate if used) is actually used to encrypt and decrypt 3135 * signatures. The signature trail is built from the client via the 3136 * intermediate servers to the trusted server. Each signature on the 3137 * trail must be valid at the time of signature, but it could happen 3138 * that a signer certificate expire before the signed certificate, which 3139 * remains valid until its expiration. 3140 * 3141 * Returns 3142 * XEVNT_OK success 3143 * XEVNT_CRT bad or missing certificate 3144 * XEVNT_PER host certificate expired 3145 * XEVNT_PUB bad or missing public key 3146 * XEVNT_VFY certificate not verified 3147 */ 3148 static int 3149 cert_sign( 3150 struct exten *ep, /* extension field pointer */ 3151 struct value *vp /* value pointer */ 3152 ) 3153 { 3154 X509 *req; /* X509 certificate request */ 3155 X509 *cert; /* X509 certificate */ 3156 X509_EXTENSION *ext; /* certificate extension */ 3157 ASN1_INTEGER *serial; /* serial number */ 3158 X509_NAME *subj; /* distinguished (common) name */ 3159 EVP_PKEY *pkey; /* public key */ 3160 EVP_MD_CTX *ctx; /* message digest context */ 3161 tstamp_t tstamp; /* NTP timestamp */ 3162 struct calendar tscal; 3163 u_int len; 3164 const u_char *cptr; 3165 u_char *ptr; 3166 int i, temp; 3167 3168 /* 3169 * Decode ASN.1 objects and construct certificate structure. 3170 * Make sure the system clock is synchronized to a proventic 3171 * source. 3172 */ 3173 tstamp = crypto_time(); 3174 if (tstamp == 0) 3175 return (XEVNT_TSP); 3176 3177 len = exten_payload_size(ep); 3178 if (len == 0 || len > MAX_VALLEN) 3179 return (XEVNT_LEN); 3180 cptr = (void *)ep->pkt; 3181 if ((req = d2i_X509(NULL, &cptr, len)) == NULL) { 3182 msyslog(LOG_ERR, "cert_sign: %s", 3183 ERR_error_string(ERR_get_error(), NULL)); 3184 return (XEVNT_CRT); 3185 } 3186 /* 3187 * Extract public key and check for errors. 3188 */ 3189 if ((pkey = X509_get_pubkey(req)) == NULL) { 3190 msyslog(LOG_ERR, "cert_sign: %s", 3191 ERR_error_string(ERR_get_error(), NULL)); 3192 X509_free(req); 3193 return (XEVNT_PUB); 3194 } 3195 3196 /* 3197 * Generate X509 certificate signed by this server. If this is a 3198 * trusted host, the issuer name is the group name; otherwise, 3199 * it is the host name. Also copy any extensions that might be 3200 * present. 3201 */ 3202 cert = X509_new(); 3203 X509_set_version(cert, X509_get_version(req)); 3204 serial = ASN1_INTEGER_new(); 3205 ASN1_INTEGER_set(serial, tstamp); 3206 X509_set_serialNumber(cert, serial); 3207 X509_gmtime_adj(X509_getm_notBefore(cert), 0L); 3208 X509_gmtime_adj(X509_getm_notAfter(cert), YEAR); 3209 subj = X509_get_issuer_name(cert); 3210 X509_NAME_add_entry_by_txt(subj, "commonName", MBSTRING_ASC, 3211 hostval.ptr, strlen((const char *)hostval.ptr), -1, 0); 3212 subj = X509_get_subject_name(req); 3213 X509_set_subject_name(cert, subj); 3214 X509_set_pubkey(cert, pkey); 3215 temp = X509_get_ext_count(req); 3216 for (i = 0; i < temp; i++) { 3217 ext = X509_get_ext(req, i); 3218 INSIST(X509_add_ext(cert, ext, -1)); 3219 } 3220 X509_free(req); 3221 3222 /* 3223 * Sign and verify the client certificate, but only if the host 3224 * certificate has not expired. 3225 */ 3226 (void)ntpcal_ntp_to_date(&tscal, tstamp, NULL); 3227 if ((calcomp(&tscal, &(cert_host->first)) < 0) 3228 || (calcomp(&tscal, &(cert_host->last)) > 0)) { 3229 X509_free(cert); 3230 return (XEVNT_PER); 3231 } 3232 X509_sign(cert, sign_pkey, sign_digest); 3233 if (X509_verify(cert, sign_pkey) <= 0) { 3234 msyslog(LOG_ERR, "cert_sign: %s", 3235 ERR_error_string(ERR_get_error(), NULL)); 3236 X509_free(cert); 3237 return (XEVNT_VFY); 3238 } 3239 len = i2d_X509(cert, NULL); 3240 3241 /* 3242 * Build and sign the value structure. We have to sign it here, 3243 * since the response has to be returned right away. This is a 3244 * clogging hazard. 3245 */ 3246 memset(vp, 0, sizeof(struct value)); 3247 vp->tstamp = htonl(tstamp); 3248 vp->fstamp = ep->fstamp; 3249 vp->vallen = htonl(len); 3250 vp->ptr = emalloc(len); 3251 ptr = vp->ptr; 3252 i2d_X509(cert, (unsigned char **)(intptr_t)&ptr); 3253 vp->siglen = 0; 3254 if (tstamp != 0) { 3255 vp->sig = emalloc(sign_siglen); 3256 ctx = EVP_MD_CTX_new(); 3257 EVP_SignInit(ctx, sign_digest); 3258 EVP_SignUpdate(ctx, (u_char *)vp, 12); 3259 EVP_SignUpdate(ctx, vp->ptr, len); 3260 if (EVP_SignFinal(ctx, vp->sig, &len, sign_pkey)) { 3261 INSIST(len <= sign_siglen); 3262 vp->siglen = htonl(len); 3263 } 3264 EVP_MD_CTX_free(ctx); 3265 } 3266 #ifdef DEBUG 3267 if (debug > 1) 3268 X509_print_fp(stdout, cert); 3269 #endif 3270 X509_free(cert); 3271 return (XEVNT_OK); 3272 } 3273 3274 3275 /* 3276 * cert_install - install certificate in certificate cache 3277 * 3278 * This routine encodes an extension field into a certificate info/value 3279 * structure. It searches the certificate list for duplicates and 3280 * expunges whichever is older. Finally, it inserts this certificate 3281 * first on the list. 3282 * 3283 * Returns certificate info pointer if valid, NULL if not. 3284 */ 3285 struct cert_info * 3286 cert_install( 3287 struct exten *ep, /* cert info/value */ 3288 struct peer *peer /* peer structure */ 3289 ) 3290 { 3291 struct cert_info *cp, *xp, **zp; 3292 3293 /* 3294 * Parse and validate the signed certificate. If valid, 3295 * construct the info/value structure; otherwise, scamper home 3296 * empty handed. 3297 */ 3298 if ((cp = cert_parse((u_char *)ep->pkt, (long)ntohl(ep->vallen), 3299 (tstamp_t)ntohl(ep->fstamp))) == NULL) 3300 return (NULL); 3301 3302 /* 3303 * Scan certificate list looking for another certificate with 3304 * the same subject and issuer. If another is found with the 3305 * same or older filestamp, unlink it and return the goodies to 3306 * the heap. If another is found with a later filestamp, discard 3307 * the new one and leave the building with the old one. 3308 * 3309 * Make a note to study this issue again. An earlier certificate 3310 * with a long lifetime might be overtaken by a later 3311 * certificate with a short lifetime, thus invalidating the 3312 * earlier signature. However, we gotta find a way to leak old 3313 * stuff from the cache, so we do it anyway. 3314 */ 3315 zp = &cinfo; 3316 for (xp = cinfo; xp != NULL; xp = xp->link) { 3317 if (strcmp(cp->subject, xp->subject) == 0 && 3318 strcmp(cp->issuer, xp->issuer) == 0) { 3319 if (ntohl(cp->cert.fstamp) <= 3320 ntohl(xp->cert.fstamp)) { 3321 cert_free(cp); 3322 cp = xp; 3323 } else { 3324 *zp = xp->link; 3325 cert_free(xp); 3326 xp = NULL; 3327 } 3328 break; 3329 } 3330 zp = &xp->link; 3331 } 3332 if (xp == NULL) { 3333 cp->link = cinfo; 3334 cinfo = cp; 3335 } 3336 cp->flags |= CERT_VALID; 3337 crypto_update(); 3338 return (cp); 3339 } 3340 3341 3342 /* 3343 * cert_hike - verify the signature using the issuer public key 3344 * 3345 * Returns 3346 * XEVNT_OK success 3347 * XEVNT_CRT bad or missing certificate 3348 * XEVNT_PER host certificate expired 3349 * XEVNT_VFY certificate not verified 3350 */ 3351 int 3352 cert_hike( 3353 struct peer *peer, /* peer structure pointer */ 3354 struct cert_info *yp /* issuer certificate */ 3355 ) 3356 { 3357 struct cert_info *xp; /* subject certificate */ 3358 X509 *cert; /* X509 certificate */ 3359 const u_char *ptr; 3360 3361 /* 3362 * Save the issuer on the new certificate, but remember the old 3363 * one. 3364 */ 3365 if (peer->issuer != NULL) 3366 free(peer->issuer); 3367 peer->issuer = estrdup(yp->issuer); 3368 xp = peer->xinfo; 3369 peer->xinfo = yp; 3370 3371 /* 3372 * If subject Y matches issuer Y, then the certificate trail is 3373 * complete. If Y is not trusted, the server certificate has yet 3374 * been signed, so keep trying. Otherwise, save the group key 3375 * and light the valid bit. If the host certificate is trusted, 3376 * do not execute a sign exchange. If no identity scheme is in 3377 * use, light the identity and proventic bits. 3378 */ 3379 if (strcmp(yp->subject, yp->issuer) == 0) { 3380 if (!(yp->flags & CERT_TRUST)) 3381 return (XEVNT_OK); 3382 3383 /* 3384 * If the server has an an identity scheme, fetch the 3385 * identity credentials. If not, the identity is 3386 * verified only by the trusted certificate. The next 3387 * signature will set the server proventic. 3388 */ 3389 peer->crypto |= CRYPTO_FLAG_CERT; 3390 peer->grpkey = yp->grpkey; 3391 if (peer->ident == NULL || !(peer->crypto & 3392 CRYPTO_FLAG_MASK)) 3393 peer->crypto |= CRYPTO_FLAG_VRFY; 3394 } 3395 3396 /* 3397 * If X exists, verify signature X using public key Y. 3398 */ 3399 if (xp == NULL) 3400 return (XEVNT_OK); 3401 3402 ptr = (u_char *)xp->cert.ptr; 3403 cert = d2i_X509(NULL, &ptr, ntohl(xp->cert.vallen)); 3404 if (cert == NULL) { 3405 xp->flags |= CERT_ERROR; 3406 return (XEVNT_CRT); 3407 } 3408 if (X509_verify(cert, yp->pkey) <= 0) { 3409 X509_free(cert); 3410 xp->flags |= CERT_ERROR; 3411 return (XEVNT_VFY); 3412 } 3413 X509_free(cert); 3414 3415 /* 3416 * Signature X is valid only if it begins during the 3417 * lifetime of Y. 3418 */ 3419 if ((calcomp(&(xp->first), &(yp->first)) < 0) 3420 || (calcomp(&(xp->first), &(yp->last)) > 0)) { 3421 xp->flags |= CERT_ERROR; 3422 return (XEVNT_PER); 3423 } 3424 xp->flags |= CERT_SIGN; 3425 return (XEVNT_OK); 3426 } 3427 3428 3429 /* 3430 * cert_parse - parse x509 certificate and create info/value structures. 3431 * 3432 * The server certificate includes the version number, issuer name, 3433 * subject name, public key and valid date interval. If the issuer name 3434 * is the same as the subject name, the certificate is self signed and 3435 * valid only if the server is configured as trustable. If the names are 3436 * different, another issuer has signed the server certificate and 3437 * vouched for it. In this case the server certificate is valid if 3438 * verified by the issuer public key. 3439 * 3440 * Returns certificate info/value pointer if valid, NULL if not. 3441 */ 3442 struct cert_info * /* certificate information structure */ 3443 cert_parse( 3444 const u_char *asn1cert, /* X509 certificate */ 3445 long len, /* certificate length */ 3446 tstamp_t fstamp /* filestamp */ 3447 ) 3448 { 3449 X509 *cert; /* X509 certificate */ 3450 struct cert_info *ret; /* certificate info/value */ 3451 BIO *bp; 3452 char pathbuf[MAXFILENAME]; 3453 const u_char *ptr; 3454 char *pch; 3455 int cnt, i; 3456 struct calendar fscal; 3457 3458 /* 3459 * Decode ASN.1 objects and construct certificate structure. 3460 */ 3461 ptr = asn1cert; 3462 if ((cert = d2i_X509(NULL, &ptr, len)) == NULL) { 3463 msyslog(LOG_ERR, "cert_parse: %s", 3464 ERR_error_string(ERR_get_error(), NULL)); 3465 return (NULL); 3466 } 3467 #ifdef DEBUG 3468 if (debug > 1) 3469 X509_print_fp(stdout, cert); 3470 #endif 3471 3472 /* 3473 * Extract version, subject name and public key. 3474 */ 3475 ret = emalloc_zero(sizeof(*ret)); 3476 if ((ret->pkey = X509_get_pubkey(cert)) == NULL) { 3477 msyslog(LOG_ERR, "cert_parse: %s", 3478 ERR_error_string(ERR_get_error(), NULL)); 3479 cert_free(ret); 3480 X509_free(cert); 3481 return (NULL); 3482 } 3483 ret->version = X509_get_version(cert); 3484 X509_NAME_oneline(X509_get_subject_name(cert), pathbuf, 3485 sizeof(pathbuf)); 3486 pch = strstr(pathbuf, "CN="); 3487 if (NULL == pch) { 3488 msyslog(LOG_NOTICE, "cert_parse: invalid subject %s", 3489 pathbuf); 3490 cert_free(ret); 3491 X509_free(cert); 3492 return (NULL); 3493 } 3494 ret->subject = estrdup(pch + 3); 3495 3496 /* 3497 * Extract remaining objects. Note that the NTP serial number is 3498 * the NTP seconds at the time of signing, but this might not be 3499 * the case for other authority. We don't bother to check the 3500 * objects at this time, since the real crunch can happen only 3501 * when the time is valid but not yet certificated. 3502 */ 3503 ret->nid = X509_get_signature_nid(cert); 3504 ret->digest = (const EVP_MD *)EVP_get_digestbynid(ret->nid); 3505 ret->serial = 3506 (u_long)ASN1_INTEGER_get(X509_get_serialNumber(cert)); 3507 X509_NAME_oneline(X509_get_issuer_name(cert), pathbuf, 3508 sizeof(pathbuf)); 3509 if ((pch = strstr(pathbuf, "CN=")) == NULL) { 3510 msyslog(LOG_NOTICE, "cert_parse: invalid issuer %s", 3511 pathbuf); 3512 cert_free(ret); 3513 X509_free(cert); 3514 return (NULL); 3515 } 3516 ret->issuer = estrdup(pch + 3); 3517 asn_to_calendar(X509_get0_notBefore(cert), &(ret->first)); 3518 asn_to_calendar(X509_get0_notAfter(cert), &(ret->last)); 3519 3520 /* 3521 * Extract extension fields. These are ad hoc ripoffs of 3522 * currently assigned functions and will certainly be changed 3523 * before prime time. 3524 */ 3525 cnt = X509_get_ext_count(cert); 3526 for (i = 0; i < cnt; i++) { 3527 X509_EXTENSION *ext; 3528 ASN1_OBJECT *obj; 3529 int nid; 3530 ASN1_OCTET_STRING *data; 3531 3532 ext = X509_get_ext(cert, i); 3533 obj = X509_EXTENSION_get_object(ext); 3534 nid = OBJ_obj2nid(obj); 3535 3536 switch (nid) { 3537 3538 /* 3539 * If a key_usage field is present, we decode whether 3540 * this is a trusted or private certificate. This is 3541 * dorky; all we want is to compare NIDs, but OpenSSL 3542 * insists on BIO text strings. 3543 */ 3544 case NID_ext_key_usage: 3545 bp = BIO_new(BIO_s_mem()); 3546 X509V3_EXT_print(bp, ext, 0, 0); 3547 BIO_gets(bp, pathbuf, sizeof(pathbuf)); 3548 BIO_free(bp); 3549 if (strcmp(pathbuf, "Trust Root") == 0) 3550 ret->flags |= CERT_TRUST; 3551 else if (strcmp(pathbuf, "Private") == 0) 3552 ret->flags |= CERT_PRIV; 3553 DPRINTF(1, ("cert_parse: %s: %s\n", 3554 OBJ_nid2ln(nid), pathbuf)); 3555 break; 3556 3557 /* 3558 * If a NID_subject_key_identifier field is present, it 3559 * contains the GQ public key. 3560 */ 3561 case NID_subject_key_identifier: 3562 data = X509_EXTENSION_get_data(ext); 3563 ret->grpkey = BN_bin2bn(&data->data[2], 3564 data->length - 2, NULL); 3565 /* fall through */ 3566 default: 3567 DPRINTF(1, ("cert_parse: %s\n", 3568 OBJ_nid2ln(nid))); 3569 break; 3570 } 3571 } 3572 if (strcmp(ret->subject, ret->issuer) == 0) { 3573 3574 /* 3575 * If certificate is self signed, verify signature. 3576 */ 3577 if (X509_verify(cert, ret->pkey) <= 0) { 3578 msyslog(LOG_NOTICE, 3579 "cert_parse: signature not verified %s", 3580 ret->subject); 3581 cert_free(ret); 3582 X509_free(cert); 3583 return (NULL); 3584 } 3585 } else { 3586 3587 /* 3588 * Check for a certificate loop. 3589 */ 3590 if (strcmp((const char *)hostval.ptr, ret->issuer) == 0) { 3591 msyslog(LOG_NOTICE, 3592 "cert_parse: certificate trail loop %s", 3593 ret->subject); 3594 cert_free(ret); 3595 X509_free(cert); 3596 return (NULL); 3597 } 3598 } 3599 3600 /* 3601 * Verify certificate valid times. Note that certificates cannot 3602 * be retroactive. 3603 */ 3604 (void)ntpcal_ntp_to_date(&fscal, fstamp, NULL); 3605 if ((calcomp(&(ret->first), &(ret->last)) > 0) 3606 || (calcomp(&(ret->first), &fscal) < 0)) { 3607 msyslog(LOG_NOTICE, 3608 "cert_parse: invalid times %s first %u-%02u-%02uT%02u:%02u:%02u last %u-%02u-%02uT%02u:%02u:%02u fstamp %u-%02u-%02uT%02u:%02u:%02u", 3609 ret->subject, 3610 ret->first.year, ret->first.month, ret->first.monthday, 3611 ret->first.hour, ret->first.minute, ret->first.second, 3612 ret->last.year, ret->last.month, ret->last.monthday, 3613 ret->last.hour, ret->last.minute, ret->last.second, 3614 fscal.year, fscal.month, fscal.monthday, 3615 fscal.hour, fscal.minute, fscal.second); 3616 cert_free(ret); 3617 X509_free(cert); 3618 return (NULL); 3619 } 3620 3621 /* 3622 * Build the value structure to sign and send later. 3623 */ 3624 ret->cert.fstamp = htonl(fstamp); 3625 ret->cert.vallen = htonl(len); 3626 ret->cert.ptr = emalloc(len); 3627 memcpy(ret->cert.ptr, asn1cert, len); 3628 X509_free(cert); 3629 return (ret); 3630 } 3631 3632 3633 /* 3634 * cert_free - free certificate information structure 3635 */ 3636 void 3637 cert_free( 3638 struct cert_info *cinf /* certificate info/value structure */ 3639 ) 3640 { 3641 if (cinf->pkey != NULL) 3642 EVP_PKEY_free(cinf->pkey); 3643 if (cinf->subject != NULL) 3644 free(cinf->subject); 3645 if (cinf->issuer != NULL) 3646 free(cinf->issuer); 3647 if (cinf->grpkey != NULL) 3648 BN_free(cinf->grpkey); 3649 value_free(&cinf->cert); 3650 free(cinf); 3651 } 3652 3653 3654 /* 3655 * crypto_key - load cryptographic parameters and keys 3656 * 3657 * This routine searches the key cache for matching name in the form 3658 * ntpkey_<key>_<name>, where <key> is one of host, sign, iff, gq, mv, 3659 * and <name> is the host/group name. If not found, it tries to load a 3660 * PEM-encoded file of the same name and extracts the filestamp from 3661 * the first line of the file name. It returns the key pointer if valid, 3662 * NULL if not. 3663 */ 3664 static struct pkey_info * 3665 crypto_key( 3666 char *cp, /* file name */ 3667 char *passwd1, /* password */ 3668 sockaddr_u *addr /* IP address */ 3669 ) 3670 { 3671 FILE *str; /* file handle */ 3672 struct pkey_info *pkp; /* generic key */ 3673 EVP_PKEY *pkey = NULL; /* public/private key */ 3674 tstamp_t fstamp; 3675 char filename[MAXFILENAME]; /* name of key file */ 3676 char linkname[MAXFILENAME]; /* filestamp buffer) */ 3677 char statstr[NTP_MAXSTRLEN]; /* statistics for filegen */ 3678 char *ptr; 3679 3680 /* 3681 * Search the key cache for matching key and name. 3682 */ 3683 for (pkp = pkinfo; pkp != NULL; pkp = pkp->link) { 3684 if (strcmp(cp, pkp->name) == 0) 3685 return (pkp); 3686 } 3687 3688 /* 3689 * Open the key file. If the first character of the file name is 3690 * not '/', prepend the keys directory string. If something goes 3691 * wrong, abandon ship. 3692 */ 3693 if (*cp == '/') 3694 strlcpy(filename, cp, sizeof(filename)); 3695 else 3696 snprintf(filename, sizeof(filename), "%s/%s", keysdir, 3697 cp); 3698 str = fopen(filename, "r"); 3699 if (str == NULL) 3700 return (NULL); 3701 3702 /* 3703 * Read the filestamp, which is contained in the first line. 3704 */ 3705 if ((ptr = fgets(linkname, sizeof(linkname), str)) == NULL) { 3706 msyslog(LOG_ERR, "crypto_key: empty file %s", 3707 filename); 3708 fclose(str); 3709 return (NULL); 3710 } 3711 if ((ptr = strrchr(ptr, '.')) == NULL) { 3712 msyslog(LOG_ERR, "crypto_key: no filestamp %s", 3713 filename); 3714 fclose(str); 3715 return (NULL); 3716 } 3717 if (sscanf(++ptr, "%u", &fstamp) != 1) { 3718 msyslog(LOG_ERR, "crypto_key: invalid filestamp %s", 3719 filename); 3720 fclose(str); 3721 return (NULL); 3722 } 3723 3724 /* 3725 * Read and decrypt PEM-encoded private key. If it fails to 3726 * decrypt, game over. 3727 */ 3728 pkey = PEM_read_PrivateKey(str, NULL, NULL, passwd1); 3729 fclose(str); 3730 if (pkey == NULL) { 3731 msyslog(LOG_ERR, "crypto_key: %s", 3732 ERR_error_string(ERR_get_error(), NULL)); 3733 exit (-1); 3734 } 3735 3736 /* 3737 * Make a new entry in the key cache. 3738 */ 3739 pkp = emalloc(sizeof(struct pkey_info)); 3740 pkp->link = pkinfo; 3741 pkinfo = pkp; 3742 pkp->pkey = pkey; 3743 pkp->name = estrdup(cp); 3744 pkp->fstamp = fstamp; 3745 3746 /* 3747 * Leave tracks in the cryptostats. 3748 */ 3749 if ((ptr = strrchr(linkname, '\n')) != NULL) 3750 *ptr = '\0'; 3751 snprintf(statstr, sizeof(statstr), "%s mod %d", &linkname[2], 3752 EVP_PKEY_size(pkey) * 8); 3753 record_crypto_stats(addr, statstr); 3754 3755 DPRINTF(1, ("crypto_key: %s\n", statstr)); 3756 #ifdef DEBUG 3757 if (debug > 1) { 3758 if (EVP_PKEY_base_id(pkey) == EVP_PKEY_DSA) 3759 DSA_print_fp(stdout, EVP_PKEY_get0_DSA(pkey), 0); 3760 else if (EVP_PKEY_base_id(pkey) == EVP_PKEY_RSA) 3761 RSA_print_fp(stdout, EVP_PKEY_get0_RSA(pkey), 0); 3762 } 3763 #endif 3764 return (pkp); 3765 } 3766 3767 3768 /* 3769 *********************************************************************** 3770 * * 3771 * The following routines are used only at initialization time * 3772 * * 3773 *********************************************************************** 3774 */ 3775 /* 3776 * crypto_cert - load certificate from file 3777 * 3778 * This routine loads an X.509 RSA or DSA certificate from a file and 3779 * constructs a info/cert value structure for this machine. The 3780 * structure includes a filestamp extracted from the file name. Later 3781 * the certificate can be sent to another machine on request. 3782 * 3783 * Returns certificate info/value pointer if valid, NULL if not. 3784 */ 3785 static struct cert_info * /* certificate information */ 3786 crypto_cert( 3787 char *cp /* file name */ 3788 ) 3789 { 3790 struct cert_info *ret; /* certificate information */ 3791 FILE *str; /* file handle */ 3792 char filename[MAXFILENAME]; /* name of certificate file */ 3793 char linkname[MAXFILENAME]; /* filestamp buffer */ 3794 char statstr[NTP_MAXSTRLEN]; /* statistics for filegen */ 3795 tstamp_t fstamp; /* filestamp */ 3796 long len; 3797 char *ptr; 3798 char *name, *header; 3799 u_char *data; 3800 3801 /* 3802 * Open the certificate file. If the first character of the file 3803 * name is not '/', prepend the keys directory string. If 3804 * something goes wrong, abandon ship. 3805 */ 3806 if (*cp == '/') 3807 strlcpy(filename, cp, sizeof(filename)); 3808 else 3809 snprintf(filename, sizeof(filename), "%s/%s", keysdir, 3810 cp); 3811 str = fopen(filename, "r"); 3812 if (str == NULL) 3813 return (NULL); 3814 3815 /* 3816 * Read the filestamp, which is contained in the first line. 3817 */ 3818 if ((ptr = fgets(linkname, sizeof(linkname), str)) == NULL) { 3819 msyslog(LOG_ERR, "crypto_cert: empty file %s", 3820 filename); 3821 fclose(str); 3822 return (NULL); 3823 } 3824 if ((ptr = strrchr(ptr, '.')) == NULL) { 3825 msyslog(LOG_ERR, "crypto_cert: no filestamp %s", 3826 filename); 3827 fclose(str); 3828 return (NULL); 3829 } 3830 if (sscanf(++ptr, "%u", &fstamp) != 1) { 3831 msyslog(LOG_ERR, "crypto_cert: invalid filestamp %s", 3832 filename); 3833 fclose(str); 3834 return (NULL); 3835 } 3836 3837 /* 3838 * Read PEM-encoded certificate and install. 3839 */ 3840 if (!PEM_read(str, &name, &header, &data, &len)) { 3841 msyslog(LOG_ERR, "crypto_cert: %s", 3842 ERR_error_string(ERR_get_error(), NULL)); 3843 fclose(str); 3844 return (NULL); 3845 } 3846 fclose(str); 3847 free(header); 3848 if (strcmp(name, "CERTIFICATE") != 0) { 3849 msyslog(LOG_NOTICE, "crypto_cert: wrong PEM type %s", 3850 name); 3851 free(name); 3852 free(data); 3853 return (NULL); 3854 } 3855 free(name); 3856 3857 /* 3858 * Parse certificate and generate info/value structure. The 3859 * pointer and copy nonsense is due something broken in Solaris. 3860 */ 3861 ret = cert_parse(data, len, fstamp); 3862 free(data); 3863 if (ret == NULL) 3864 return (NULL); 3865 3866 if ((ptr = strrchr(linkname, '\n')) != NULL) 3867 *ptr = '\0'; 3868 snprintf(statstr, sizeof(statstr), "%s 0x%x len %lu", 3869 &linkname[2], ret->flags, len); 3870 record_crypto_stats(NULL, statstr); 3871 DPRINTF(1, ("crypto_cert: %s\n", statstr)); 3872 return (ret); 3873 } 3874 3875 3876 /* 3877 * crypto_setup - load keys, certificate and identity parameters 3878 * 3879 * This routine loads the public/private host key and certificate. If 3880 * available, it loads the public/private sign key, which defaults to 3881 * the host key. The host key must be RSA, but the sign key can be 3882 * either RSA or DSA. If a trusted certificate, it loads the identity 3883 * parameters. In either case, the public key on the certificate must 3884 * agree with the sign key. 3885 * 3886 * Required but missing files and inconsistent data and errors are 3887 * fatal. Allowing configuration to continue would be hazardous and 3888 * require really messy error checks. 3889 */ 3890 void 3891 crypto_setup(void) 3892 { 3893 struct pkey_info *pinfo; /* private/public key */ 3894 char filename[MAXFILENAME]; /* file name buffer */ 3895 char hostname[MAXFILENAME]; /* host name buffer */ 3896 char *randfile; 3897 char statstr[NTP_MAXSTRLEN]; /* statistics for filegen */ 3898 l_fp seed; /* crypto PRNG seed as NTP timestamp */ 3899 u_int len; 3900 int bytes; 3901 u_char *ptr; 3902 3903 /* 3904 * Check for correct OpenSSL version and avoid initialization in 3905 * the case of multiple crypto commands. 3906 */ 3907 if (crypto_flags & CRYPTO_FLAG_ENAB) { 3908 msyslog(LOG_NOTICE, 3909 "crypto_setup: spurious crypto command"); 3910 return; 3911 } 3912 ssl_check_version(); 3913 3914 /* 3915 * Load required random seed file and seed the random number 3916 * generator. Be default, it is found as .rnd in the user home 3917 * directory. The root home directory may be / or /root, 3918 * depending on the system. Wiggle the contents a bit and write 3919 * it back so the sequence does not repeat when we next restart. 3920 */ 3921 if (!RAND_status()) { 3922 if (rand_file == NULL) { 3923 RAND_file_name(filename, sizeof(filename)); 3924 randfile = filename; 3925 } else if (*rand_file != '/') { 3926 snprintf(filename, sizeof(filename), "%s/%s", 3927 keysdir, rand_file); 3928 randfile = filename; 3929 } else 3930 randfile = rand_file; 3931 3932 if ((bytes = RAND_load_file(randfile, -1)) == 0) { 3933 msyslog(LOG_ERR, 3934 "crypto_setup: random seed file %s missing", 3935 randfile); 3936 exit (-1); 3937 } 3938 arc4random_buf(&seed, sizeof(l_fp)); 3939 RAND_seed(&seed, sizeof(l_fp)); 3940 RAND_write_file(randfile); 3941 DPRINTF(1, ("crypto_setup: OpenSSL version %lx random seed file %s bytes read %d\n", 3942 OpenSSL_version_num(), randfile, bytes)); 3943 3944 } 3945 3946 /* 3947 * Initialize structures. 3948 */ 3949 gethostname(hostname, sizeof(hostname)); 3950 if (host_filename != NULL) 3951 strlcpy(hostname, host_filename, sizeof(hostname)); 3952 if (passwd == NULL) 3953 passwd = estrdup(hostname); 3954 memset(&hostval, 0, sizeof(hostval)); 3955 memset(&pubkey, 0, sizeof(pubkey)); 3956 memset(&tai_leap, 0, sizeof(tai_leap)); 3957 3958 /* 3959 * Load required host key from file "ntpkey_host_<hostname>". If 3960 * no host key file is not found or has invalid password, life 3961 * as we know it ends. The host key also becomes the default 3962 * sign key. 3963 */ 3964 snprintf(filename, sizeof(filename), "ntpkey_host_%s", hostname); 3965 pinfo = crypto_key(filename, passwd, NULL); 3966 if (pinfo == NULL) { 3967 msyslog(LOG_ERR, 3968 "crypto_setup: host key file %s not found or corrupt", 3969 filename); 3970 exit (-1); 3971 } 3972 if (EVP_PKEY_base_id(pinfo->pkey) != EVP_PKEY_RSA) { 3973 msyslog(LOG_ERR, 3974 "crypto_setup: host key is not RSA key type"); 3975 exit (-1); 3976 } 3977 host_pkey = pinfo->pkey; 3978 sign_pkey = host_pkey; 3979 hostval.fstamp = htonl(pinfo->fstamp); 3980 3981 /* 3982 * Construct public key extension field for agreement scheme. 3983 */ 3984 len = i2d_PublicKey(host_pkey, NULL); 3985 ptr = emalloc(len); 3986 pubkey.ptr = ptr; 3987 i2d_PublicKey(host_pkey, &ptr); 3988 pubkey.fstamp = hostval.fstamp; 3989 pubkey.vallen = htonl(len); 3990 3991 /* 3992 * Load optional sign key from file "ntpkey_sign_<hostname>". If 3993 * available, it becomes the sign key. 3994 */ 3995 snprintf(filename, sizeof(filename), "ntpkey_sign_%s", hostname); 3996 pinfo = crypto_key(filename, passwd, NULL); 3997 if (pinfo != NULL) 3998 sign_pkey = pinfo->pkey; 3999 4000 /* 4001 * Load required certificate from file "ntpkey_cert_<hostname>". 4002 */ 4003 snprintf(filename, sizeof(filename), "ntpkey_cert_%s", hostname); 4004 cinfo = crypto_cert(filename); 4005 if (cinfo == NULL) { 4006 msyslog(LOG_ERR, 4007 "crypto_setup: certificate file %s not found or corrupt", 4008 filename); 4009 exit (-1); 4010 } 4011 cert_host = cinfo; 4012 sign_digest = cinfo->digest; 4013 sign_siglen = EVP_PKEY_size(sign_pkey); 4014 if (cinfo->flags & CERT_PRIV) 4015 crypto_flags |= CRYPTO_FLAG_PRIV; 4016 4017 /* 4018 * The certificate must be self-signed. 4019 */ 4020 if (strcmp(cinfo->subject, cinfo->issuer) != 0) { 4021 msyslog(LOG_ERR, 4022 "crypto_setup: certificate %s is not self-signed", 4023 filename); 4024 exit (-1); 4025 } 4026 hostval.ptr = estrdup(cinfo->subject); 4027 hostval.vallen = htonl(strlen(cinfo->subject)); 4028 sys_hostname = hostval.ptr; 4029 ptr = (u_char *)strchr(sys_hostname, '@'); 4030 if (ptr != NULL) 4031 sys_groupname = estrdup((char *)++ptr); 4032 if (ident_filename != NULL) 4033 strlcpy(hostname, ident_filename, sizeof(hostname)); 4034 4035 /* 4036 * Load optional IFF parameters from file 4037 * "ntpkey_iffkey_<hostname>". 4038 */ 4039 snprintf(filename, sizeof(filename), "ntpkey_iffkey_%s", 4040 hostname); 4041 iffkey_info = crypto_key(filename, passwd, NULL); 4042 if (iffkey_info != NULL) 4043 crypto_flags |= CRYPTO_FLAG_IFF; 4044 4045 /* 4046 * Load optional GQ parameters from file 4047 * "ntpkey_gqkey_<hostname>". 4048 */ 4049 snprintf(filename, sizeof(filename), "ntpkey_gqkey_%s", 4050 hostname); 4051 gqkey_info = crypto_key(filename, passwd, NULL); 4052 if (gqkey_info != NULL) 4053 crypto_flags |= CRYPTO_FLAG_GQ; 4054 4055 /* 4056 * Load optional MV parameters from file 4057 * "ntpkey_mvkey_<hostname>". 4058 */ 4059 snprintf(filename, sizeof(filename), "ntpkey_mvkey_%s", 4060 hostname); 4061 mvkey_info = crypto_key(filename, passwd, NULL); 4062 if (mvkey_info != NULL) 4063 crypto_flags |= CRYPTO_FLAG_MV; 4064 4065 /* 4066 * We met the enemy and he is us. Now strike up the dance. 4067 */ 4068 crypto_flags |= CRYPTO_FLAG_ENAB | (cinfo->nid << 16); 4069 snprintf(statstr, sizeof(statstr), "setup 0x%x host %s %s", 4070 crypto_flags, hostname, OBJ_nid2ln(cinfo->nid)); 4071 record_crypto_stats(NULL, statstr); 4072 DPRINTF(1, ("crypto_setup: %s\n", statstr)); 4073 } 4074 4075 4076 /* 4077 * crypto_config - configure data from the crypto command. 4078 */ 4079 void 4080 crypto_config( 4081 int item, /* configuration item */ 4082 char *cp /* item name */ 4083 ) 4084 { 4085 int nid; 4086 4087 DPRINTF(1, ("crypto_config: item %d %s\n", item, cp)); 4088 4089 switch (item) { 4090 4091 /* 4092 * Set host name (host). 4093 */ 4094 case CRYPTO_CONF_PRIV: 4095 if (NULL != host_filename) 4096 free(host_filename); 4097 host_filename = estrdup(cp); 4098 break; 4099 4100 /* 4101 * Set group name (ident). 4102 */ 4103 case CRYPTO_CONF_IDENT: 4104 if (NULL != ident_filename) 4105 free(ident_filename); 4106 ident_filename = estrdup(cp); 4107 break; 4108 4109 /* 4110 * Set private key password (pw). 4111 */ 4112 case CRYPTO_CONF_PW: 4113 if (NULL != passwd) 4114 free(passwd); 4115 passwd = estrdup(cp); 4116 break; 4117 4118 /* 4119 * Set random seed file name (randfile). 4120 */ 4121 case CRYPTO_CONF_RAND: 4122 if (NULL != rand_file) 4123 free(rand_file); 4124 rand_file = estrdup(cp); 4125 break; 4126 4127 /* 4128 * Set message digest NID. 4129 */ 4130 case CRYPTO_CONF_NID: 4131 nid = OBJ_sn2nid(cp); 4132 if (nid == 0) 4133 msyslog(LOG_ERR, 4134 "crypto_config: invalid digest name %s", cp); 4135 else 4136 crypto_nid = nid; 4137 break; 4138 } 4139 } 4140 4141 /* 4142 * Get the payload size (internal value length) of an extension packet. 4143 * If the inner value size does not match the outer packet size (that 4144 * is, the value would end behind the frame given by the opcode/size 4145 * field) the function will effectively return UINT_MAX. If the frame is 4146 * too short to hold a variable-sized value, the return value is zero. 4147 */ 4148 static u_int 4149 exten_payload_size( 4150 const struct exten * ep) 4151 { 4152 typedef const u_char *BPTR; 4153 4154 size_t extn_size; 4155 size_t data_size; 4156 size_t head_size; 4157 4158 data_size = 0; 4159 if (NULL != ep) { 4160 head_size = (BPTR)(&ep->vallen + 1) - (BPTR)ep; 4161 extn_size = (uint16_t)(ntohl(ep->opcode) & 0x0000ffff); 4162 if (extn_size >= head_size) { 4163 data_size = (uint32_t)ntohl(ep->vallen); 4164 if (data_size > extn_size - head_size) 4165 data_size = ~(size_t)0u; 4166 } 4167 } 4168 return (u_int)data_size; 4169 } 4170 # else /* !AUTOKEY follows */ 4171 int ntp_crypto_bs_pubkey; 4172 # endif /* !AUTOKEY */ 4173