[Git][NTPsec/ntpsec][issue-579] 3 commits: NTS: add -4, -6 processing for NTS-KE DNS lookup

Matt Selsky gitlab at mg.gitlab.com
Thu Mar 21 13:39:48 UTC 2019



Matt Selsky pushed to branch issue-579 at NTPsec / ntpsec


Commits:
48ec2f61 by Hal Murray at 2019-03-21T07:25:37Z
NTS: add -4, -6 processing for NTS-KE DNS lookup

- - - - -
12e409aa by Matt Selsky at 2019-03-21T13:19:42Z
Re-sync libaes_siv with upstream to get ct_poison() fix

Use
https://github.com/dfoxfranke/libaes_siv/commit/a58601b312ce4f50c8048cc5ec4f7ee71d83e0a8

Fixes GitLab #578

- - - - -
4e4abdd0 by Matt Selsky at 2019-03-21T13:39:27Z
Update Coverity CI build to include all refclocks

Fixes GitLab #579
- - - - -


6 changed files:

- .gitlab-ci.yml
- libaes_siv/README.md
- libaes_siv/aes_siv.c
- libaes_siv/demo.c
- libaes_siv/tests.c
- ntpd/nts_client.c


Changes:

=====================================
.gitlab-ci.yml
=====================================
@@ -578,7 +578,7 @@ gentoo-hardened-refclocks:
 
 coverity-scan:
   script:
-    - ./waf configure
+    - ./waf configure --refclock=all
     - /opt/cov-analysis/bin/cov-build --dir cov-int ./waf build
     - tar czf ntpsec_coverity.tgz cov-int
     - curl --form token=$COVERITY_TOKEN --form email=security at ntpsec.org --form file=@ntpsec_coverity.tgz --form version="$(git rev-parse --short HEAD)" --form description="Automatic submission by gitlab-ci" https://scan.coverity.com/builds?project=ntpsec


=====================================
libaes_siv/README.md
=====================================
@@ -84,9 +84,14 @@ To build and install on POSIX-like platforms:
     sudo make install
 ```
 
+NOTE:  Out-of-source builds are allowed, but out-of-source manpage builds
+require a2x's -D option, which may provoke an apparently bogus warning from a2x.
+
 If you want to build on an OS X machine, install the Xcode development
-environment and the command line tools, then use the Homebrew package
-manager https://brew.sh/ to install cmake and OpenSSL:
+environment and the command line tools, then use either the Homebrew package
+manager or the MacPorts package manager to install cmake and OpenSSL.
+
+Homebrew (https://brew.sh/):
 ```
     brew install cmake openssl &&
     cmake -DCMAKE_PREFIX_PATH=/usr/local/opt/openssl . &&
@@ -94,6 +99,14 @@ manager https://brew.sh/ to install cmake and OpenSSL:
     make test &&
     sudo make install
 ```
+MacPorts (https://www.macports.org/):
+```
+    sudo port install cmake openssl &&
+    cmake . &&
+    make &&
+    make test &&
+    sudo make install
+```
 
 To create a native Windows build, you will first need to build
 OpenSSL.  Install Visual Studio, CMake, ActiveState Perl, and NASM, and


=====================================
libaes_siv/aes_siv.c
=====================================
@@ -239,8 +239,13 @@ void AES_SIV_CTX_cleanup(AES_SIV_CTX *ctx) {
 void AES_SIV_CTX_free(AES_SIV_CTX *ctx) {
         if (ctx) {
                 EVP_CIPHER_CTX_free(ctx->cipher_ctx);
-                CMAC_CTX_free(ctx->cmac_ctx_init);
-                CMAC_CTX_free(ctx->cmac_ctx);
+                /* Prior to OpenSSL 1.0.2b, CMAC_CTX_free() crashes on NULL */
+                if (LIKELY(ctx->cmac_ctx_init != NULL)) {
+                        CMAC_CTX_free(ctx->cmac_ctx_init);
+                }
+                if (LIKELY(ctx->cmac_ctx != NULL)) {
+                        CMAC_CTX_free(ctx->cmac_ctx);
+                }
 		OPENSSL_cleanse(&ctx->d, sizeof ctx->d);
                 free(ctx);
         }
@@ -287,7 +292,7 @@ int AES_SIV_Init(AES_SIV_CTX *ctx, unsigned char const *key, size_t key_len) {
         size_t out_len;
         int ret = 0;
 
-        ct_poison(key, sizeof key);
+        ct_poison(key, key_len);
 
         switch (key_len) {
         case 32:


=====================================
libaes_siv/demo.c
=====================================
@@ -164,7 +164,7 @@ int main(int argc, char const* argv[])
     fprintf(stderr, "Invalid key length %zu bytes, must be one of 32, 48, or 64\n", key_len);
     goto fail;
   }
-
+  
   if(load_file(ad_file, &ad, &ad_len) < 0)
   {
     fprintf(stderr, "Could not load associated data file %s : %s\n", ad_file, strerror(errno));
@@ -245,7 +245,7 @@ int main(int argc, char const* argv[])
     perror("fwrite");
     goto fail;
   }
-
+  
   free(plaintext);
   free(key);
   free(ad);


=====================================
libaes_siv/tests.c
=====================================
@@ -70,14 +70,14 @@ static void test_malloc_failure(void) {
         int ret, i=0;
         AES_SIV_CTX *ctx;
 
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
+#if OPENSSL_VERSION_NUMBER < 0x10100000L	
         ret = CRYPTO_set_mem_functions(mock_malloc, realloc, free);
 #else
 	ret = CRYPTO_set_mem_functions(mock_malloc_ex, mock_realloc_ex, mock_free_ex);
 #endif
         assert(ret == 1);
 
-        printf("Test allocation failure:\n" );
+        printf("Test allocation failure cases:\n" );
 
         do {
                 fail_allocation_counter = i++;
@@ -95,7 +95,7 @@ static void test_cleanup_before_free(void) {
 	AES_SIV_CTX_cleanup(ctx);
 	AES_SIV_CTX_free(ctx);
 	printf("OK\n");
-}
+}	
 
 static void test_vector_1(void) {
         const unsigned char key[] = {


=====================================
ntpd/nts_client.c
=====================================
@@ -27,7 +27,7 @@
 #include "nts2.h"
 #include "ntp_dns.h"
 
-int open_TCP_socket(const char *hostname);
+int open_TCP_socket(struct peer* peer);
 bool nts_set_cert_search(SSL_CTX *ctx);
 bool check_certificate(struct peer* peer, SSL *ssl);
 bool nts_client_send_request(struct peer* peer, SSL *ssl);
@@ -101,7 +101,7 @@ bool nts_probe(struct peer * peer) {
   addrOK = false;
   get_systime(&start);
 
-  server = open_TCP_socket(peer->hostname);
+  server = open_TCP_socket(peer);
   if (-1 == server) {
     nts_ke_probes_bad++;
     return false;
@@ -188,7 +188,7 @@ bool nts_check(struct peer *peer) {
   return addrOK;
 }
 
-int open_TCP_socket(const char *hostname) {
+int open_TCP_socket(struct peer *peer) {
   char host[256], port[32];
   char *tmp;
   struct addrinfo hints;
@@ -198,12 +198,12 @@ int open_TCP_socket(const char *hostname) {
   l_fp start, finish;
 
   /* copy avoids dancing around const warnings */
-  strlcpy(host, hostname, sizeof(host));
+  strlcpy(host, peer->hostname, sizeof(host));
 
   ZERO(hints);
   hints.ai_protocol = IPPROTO_TCP;
   hints.ai_socktype = SOCK_STREAM;
-  hints.ai_family = AF_UNSPEC;
+  hints.ai_family = AF(&peer->srcadr);
   tmp = strchr(host, ']');
   if (NULL == tmp) {
     tmp = strchr(host, ':');
@@ -224,13 +224,13 @@ int open_TCP_socket(const char *hostname) {
   gai_rc = getaddrinfo(host, port, &hints, &answer);
   if (0 != gai_rc) {
     msyslog(LOG_INFO, "NTSc: nts_probe: DNS error trying to contact %s: %d, %s",
-      hostname, gai_rc, gai_strerror(gai_rc));
+      peer->hostname, gai_rc, gai_strerror(gai_rc));
     return -1;
   }
   get_systime(&finish);
   finish -= start;
   msyslog(LOG_INFO, "NTSc: DNS lookup of %s took %.3Lf sec",
-    hostname, lfptod(finish));
+    peer->hostname, lfptod(finish));
 
   /* Save first answer for NTP */
   memcpy(&sockaddr, answer->ai_addr, answer->ai_addrlen);



View it on GitLab: https://gitlab.com/NTPsec/ntpsec/compare/87cd0930ed50364cbb73d1d3b54908df1c981089...4e4abdd0257e4230126cdd368ff59a7290fd1d8c

-- 
View it on GitLab: https://gitlab.com/NTPsec/ntpsec/compare/87cd0930ed50364cbb73d1d3b54908df1c981089...4e4abdd0257e4230126cdd368ff59a7290fd1d8c
You're receiving this email because of your account on gitlab.com.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ntpsec.org/pipermail/vc/attachments/20190321/e59598fc/attachment-0001.html>


More information about the vc mailing list