[Git][NTPsec/ntpsec][master] Cookies now getting through
Hal Murray
gitlab at mg.gitlab.com
Mon Feb 11 05:26:59 UTC 2019
Hal Murray pushed to branch master at NTPsec / ntpsec
Commits:
72c3c450 by Hal Murray at 2019-02-11T05:25:48Z
Cookies now getting through
- - - - -
4 changed files:
- include/nts.h
- ntpd/nts.c
- ntpd/nts_client.c
- ntpd/nts_server.c
Changes:
=====================================
include/nts.h
=====================================
@@ -97,6 +97,7 @@ void nts_append_bytes(BufCtl* buf, uint8_t *data, int length);
uint16_t nts_next_record(BufCtl* buf, int *length);
uint16_t nts_next_uint16(BufCtl* buf);
+uint16_t nts_next_bytes(BufCtl* buf, uint8_t *data, int length);
#endif /* GUARD_NTS_H */
=====================================
ntpd/nts.c
=====================================
@@ -132,7 +132,7 @@ int nts_decorate(struct ntscfg_t *cfg, struct ntsstate_t *state,
/* Troubles with signed/unsigned compares when using sizeof() */
void nts_append_record_null(BufCtl* buf, uint16_t type) {
- nts_append_header(buf, type, NTS_KE_DATA2_LNG);
+ nts_append_header(buf, type, 0);
}
void nts_append_record_uint16(BufCtl* buf, uint16_t type, uint16_t data) {
@@ -182,18 +182,25 @@ uint16_t nts_next_record(BufCtl* buf, int *length) {
uint16_t *ptr = (uint16_t *)buf->next;
uint16_t type = ntohs(*ptr++);
*length = ntohs(*ptr++);
- buf->next += sizeof(type)+sizeof(*length);
- buf->left -= sizeof(type)+sizeof(*length);
+ buf->next += NTS_KE_HDR_LNG;
+ buf->left -= NTS_KE_HDR_LNG;
return type;
}
uint16_t nts_next_uint16(BufCtl* buf) {
uint16_t *ptr = (uint16_t *)buf->next;
uint16_t data = ntohs(*ptr++);
- buf->next += sizeof(data);
- buf->left -= sizeof(data);
+ buf->next += NTS_KE_DATA2_LNG;
+ buf->left -= NTS_KE_DATA2_LNG;
return data;
}
+uint16_t nts_next_bytes(BufCtl* buf, uint8_t *data, int length) {
+ memcpy(data, buf->next, length);
+ buf->next += length;
+ buf->left -= length;
+ return length;
+}
+
/* end */
=====================================
ntpd/nts_client.c
=====================================
@@ -45,11 +45,13 @@ bool nts_probe(struct peer * peer) {
// Fedora 29: 0x1010101fL 1.1.1a
// Fedora 28: 0x1010009fL 1.1.0i
// Debian 9: 0x101000afL 1.1.0j
+// Debian 8: 0x1000114fL 1.0.1t
// CentOS 7: 0x100020bfL 1.0.2k
// CentOS 6: 0x1000105fL 1.0.1e
// NetBSD 8: 0x100020bfL 1.0.2k
// NetBSD 7: 0x1000115fL 1.0.1u
// FreeBSD 12: 0x1010101fL 1.1.1a-freebsd
+// FreeBSD 11: 0x100020ffL 1.0.2o-freebsd
#if (OPENSSL_VERSION_NUMBER > 0x1010000fL)
ctx = SSL_CTX_new(TLS_client_method());
SSL_CTX_set_min_proto_version(ctx, TLS1_2_VERSION); // FIXME
@@ -63,6 +65,14 @@ bool nts_probe(struct peer * peer) {
SSL_CTX_set_options(ctx, NO_OLD_VERSIONS);
#endif
+#if (OPENSSL_VERSION_NUMBER > 0x1000200fL)
+ {
+ // 4., ALPN, RFC 7301
+ static unsigned char alpn [] = { 7, 'n', 't', 's', 'k', 'e', '/', '1' };
+ SSL_CTX_set_alpn_protos(ctx, alpn, sizeof(alpn));
+ }
+#endif
+
SSL_CTX_set_default_verify_paths(ctx); // Use system root certs
if (NULL != ntsconfig.tlsciphers) {
@@ -175,7 +185,7 @@ bool nts_probe(struct peer * peer) {
/* We are using AEAD_AES_SIV_CMAC_256, from RFC 5297
* There are no alternatives and no clean API yet.
*/
- peer->nts_state.keylen = get_key_length(AEAD_AES_SIV_CMAC_256_KEYLEN);
+ peer->nts_state.keylen = get_key_length(AEAD_AES_SIV_CMAC_256);
nts_make_keys(ssl,
peer->nts_state.c2s,
peer->nts_state.s2c,
@@ -205,7 +215,7 @@ int open_TCP_socket(const char *hostname) {
hints.ai_protocol = IPPROTO_TCP;
hints.ai_socktype = SOCK_STREAM;
hints.ai_family = AF_UNSPEC;
- gai_rc = getaddrinfo(hostname, "8123", &hints, &answer); // FIXME
+ gai_rc = getaddrinfo(hostname, "123", &hints, &answer); // FIXME
if (0 != gai_rc) {
msyslog(LOG_INFO, "NTSc: nts_probe: DNS error: %d, %s",
gai_rc, gai_strerror(gai_rc));
@@ -293,6 +303,8 @@ bool process_recv_data(struct peer* peer, SSL *ssl) {
critical = true;
type &= ~CRITICAL;
}
+ if (0) // Handy for debugging but very verbose
+ msyslog(LOG_ERR, "NTSc: Record: T=%d, L=%d, C=%d", type, length, critical);
switch (type) {
case error:
data = nts_next_uint16(&buf);
@@ -327,22 +339,17 @@ bool process_recv_data(struct peer* peer, SSL *ssl) {
if (length != peer->nts_state.cookie_length) {
msyslog(LOG_ERR, "NTSc: Cookie length mismatch %d, %d.",
length, peer->nts_state.cookie_length);
- break;
return false;
}
idx = peer->nts_state.next_cookie;
+ nts_next_bytes(&buf, (uint8_t*)&peer->nts_state.cookies[idx], length);
if (NTS_MAX_COOKIES <= peer->nts_state.cookie_count) {
- msyslog(LOG_ERR, "NTSc: Extra cookie ignored.");
- buf.next += length;
- buf.left -= length;
+ msyslog(LOG_ERR, "NTSc: Extra cookie.");
break;
}
- memcpy(&peer->nts_state.cookies[idx], buf.next, length);
peer->nts_state.valid[idx] = true;
peer->nts_state.next_cookie++;
peer->nts_state.cookie_count++;
- buf.next += length;
- buf.left -= length;
break;
case end_of_message:
if ((0 != length) || !critical) {
@@ -354,6 +361,7 @@ bool process_recv_data(struct peer* peer, SSL *ssl) {
msyslog(LOG_ERR, "NTSc: EOM not at end: %d", buf.left);
return false;
}
+ // FIXME check for no more
break;
default:
msyslog(LOG_ERR, "NTSc: received strange type: T=%d, C=%d, L=%d",
=====================================
ntpd/nts_server.c
=====================================
@@ -149,7 +149,7 @@ void nts_ke_request(SSL *ssl) {
/* 4.1.2 Next Protocol, 0 for NTP */
nts_append_record_uint16(&buf, next_protocol_negotiation, 0);
/* 4.1.5 AEAD Algorithm List */
- nts_append_record_uint16(&buf, algorithm_negotiation, AEAD_AES_SIV_CMAC_256);
+ nts_append_record_uint16(&buf, algorithm_negotiation, aead);
for (int i=0; i<NTS_MAX_COOKIES; i++) {
cookielen = make_cookie(cookie, aead, c2s, s2c, keylen);
@@ -161,7 +161,7 @@ void nts_ke_request(SSL *ssl) {
used = sizeof(buff)-buf.left;
bytes_written = SSL_write(ssl, buff, used);
- if (bytes_written != bytes_read) {
+ if (bytes_written != used) {
msyslog(LOG_INFO, "NTSs: SSL_write error");
return;
}
@@ -207,6 +207,7 @@ int get_key_length(int aead) {
}
}
+// FIXME - this is a total hack to test pack/unpack
/* returns actual length */
int make_cookie(uint8_t *cookie,
uint16_t aead,
View it on GitLab: https://gitlab.com/NTPsec/ntpsec/commit/72c3c450ab85a9146bbc121a56e9e6519f4029e1
--
View it on GitLab: https://gitlab.com/NTPsec/ntpsec/commit/72c3c450ab85a9146bbc121a56e9e6519f4029e1
You're receiving this email because of your account on gitlab.com.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ntpsec.org/pipermail/vc/attachments/20190211/ed5698d8/attachment-0001.html>
More information about the vc
mailing list