[Git][NTPsec/ntpsec][server] 3 commits: ntpd/refclock_jjy.c: Just remove tabs. Weird comments...
Hal Murray (@hal.murray)
gitlab at mg.gitlab.com
Thu Aug 6 17:13:18 UTC 2026
Hal Murray pushed to branch server at NTPsec / ntpsec
Commits:
676d82c4 by Gary E. Miller at 2026-08-04T22:13:07-07:00
ntpd/refclock_jjy.c: Just remove tabs. Weird comments...
- - - - -
18971ee4 by Gary E. Miller at 2026-08-06T10:13:07-07:00
ntpd/nts_server.c: Remove tabs, Single line /* comments to //
No functional changes.
- - - - -
96061e0b by Gary E. Miller at 2026-08-06T10:13:07-07:00
ntpd/nts_server.c: restore previous comment indents
No functional changes.
- - - - -
2 changed files:
- ntpd/nts_server.c
- ntpd/refclock_jjy.c
Changes:
=====================================
ntpd/nts_server.c
=====================================
@@ -56,200 +56,200 @@ static void nts_ke_setup_send(struct BufCtl_t *buf, int aead,
pthread_mutex_t certificate_lock = PTHREAD_MUTEX_INITIALIZER;
static int alpn_select_cb(SSL *ssl,
- const unsigned char **out,
- unsigned char *outlen,
- const unsigned char *in,
- unsigned int inlen,
- void *arg)
+ const unsigned char **out,
+ unsigned char *outlen,
+ const unsigned char *in,
+ unsigned int inlen,
+ void *arg)
{
- static const unsigned char alpn[] = {
+ static const unsigned char alpn[] = {
'n', 't', 's', 'k', 'e', '/', '1' };
- unsigned i, len;
+ unsigned i, len;
- UNUSED_ARG(ssl);
- UNUSED_ARG(arg);
+ UNUSED_ARG(ssl);
+ UNUSED_ARG(arg);
- for (i = 0; i < inlen; i += len+1) {
- len = in[i]; // first byte is the length
+ for (i = 0; i < inlen; i += len+1) {
+ len = in[i]; // first byte is the length
#if 0
- char foo[256];
- strlcpy(foo, (const char*)in+i+1, len);
- msyslog(LOG_DEBUG, "DEBUG: alpn_select_cb: %u, %u, %s", inlen-i, len, foo);
+ char foo[256];
+ strlcpy(foo, (const char*)in+i+1, len);
+ msyslog(LOG_DEBUG, "DEBUG: alpn_select_cb: %u, %u, %s", inlen-i, len, foo);
#endif
- if (len+1 > inlen-i)
- /* bogus arg: length overlaps end of in buffer */
- return SSL_TLSEXT_ERR_ALERT_FATAL;
- if (len == sizeof(alpn) && !memcmp(in+i+1, alpn, len)) {
- *out = in+i+1;
- *outlen = len;
- return SSL_TLSEXT_ERR_OK;
- }
- }
-
- return SSL_TLSEXT_ERR_NOACK;
+ if (len+1 > inlen-i)
+ // bogus arg: length overlaps end of in buffer
+ return SSL_TLSEXT_ERR_ALERT_FATAL;
+ if (len == sizeof(alpn) && !memcmp(in+i+1, alpn, len)) {
+ *out = in+i+1;
+ *outlen = len;
+ return SSL_TLSEXT_ERR_OK;
+ }
+ }
+
+ return SSL_TLSEXT_ERR_NOACK;
}
bool nts_server_init(void) {
- bool ok = true;
-
- msyslog(LOG_INFO, "NTSs: starting NTS-KE server listening on port %d",
- NTS_KE_PORT);
-
- server_ctx = SSL_CTX_new(TLS_server_method());
- if (NULL == server_ctx) {
- /* Happens if no ciphers */
- msyslog(LOG_INFO, "NTSs: NULL server_ctx");
- nts_log_ssl_error();
- return false;
- }
-
- SSL_CTX_set_alpn_select_cb(server_ctx, alpn_select_cb, NULL);
- SSL_CTX_set_session_cache_mode(server_ctx, SSL_SESS_CACHE_OFF);
- SSL_CTX_set_timeout(server_ctx, NTS_KE_TIMEOUT); /* session lifetime */
-
- ok &= nts_load_versions(server_ctx);
- ok &= nts_load_ciphers(server_ctx);
- ok &= nts_load_ecdhcurves(server_ctx);
- ok &= nts_set_cipher_order(server_ctx);
-
- if (!ok) {
- msyslog(LOG_ERR, "NTSs: Disabling NTS-KE server");
- SSL_CTX_free(server_ctx);
- server_ctx = NULL;
- return false;
- };
-
- msyslog(LOG_INFO, "NTSs: OpenSSL security level is %d",
- SSL_CTX_get_security_level(server_ctx));
-
- msyslog(LOG_INFO, "NTSs: starting NTS-KE server listening on port %d",
- NTS_KE_PORT);
- ok &= create_listener4(NTS_KE_PORT);
- ok &= create_listener6(NTS_KE_PORT);
-
- return ok;
+ bool ok = true;
+
+ msyslog(LOG_INFO, "NTSs: starting NTS-KE server listening on port %d",
+ NTS_KE_PORT);
+
+ server_ctx = SSL_CTX_new(TLS_server_method());
+ if (NULL == server_ctx) {
+ // Happens if no ciphers
+ msyslog(LOG_INFO, "NTSs: NULL server_ctx");
+ nts_log_ssl_error();
+ return false;
+ }
+
+ SSL_CTX_set_alpn_select_cb(server_ctx, alpn_select_cb, NULL);
+ SSL_CTX_set_session_cache_mode(server_ctx, SSL_SESS_CACHE_OFF);
+ SSL_CTX_set_timeout(server_ctx, NTS_KE_TIMEOUT); // session lifetime
+
+ ok &= nts_load_versions(server_ctx);
+ ok &= nts_load_ciphers(server_ctx);
+ ok &= nts_load_ecdhcurves(server_ctx);
+ ok &= nts_set_cipher_order(server_ctx);
+
+ if (!ok) {
+ msyslog(LOG_ERR, "NTSs: Disabling NTS-KE server");
+ SSL_CTX_free(server_ctx);
+ server_ctx = NULL;
+ return false;
+ };
+
+ msyslog(LOG_INFO, "NTSs: OpenSSL security level is %d",
+ SSL_CTX_get_security_level(server_ctx));
+
+ msyslog(LOG_INFO, "NTSs: starting NTS-KE server listening on port %d",
+ NTS_KE_PORT);
+ ok &= create_listener4(NTS_KE_PORT);
+ ok &= create_listener6(NTS_KE_PORT);
+
+ return ok;
}
bool nts_server_init2(void) {
- pthread_t worker;
- sigset_t block_mask, saved_sig_mask;
- int rc;
- char errbuf[100];
-
- if (!nts_load_certificate(server_ctx)) {
- return false;
- }
-
- sigfillset(&block_mask);
- pthread_sigmask(SIG_BLOCK, &block_mask, &saved_sig_mask);
- if (listener4_sock != -1) {
- rc = pthread_create(&worker, NULL, nts_ke_listener, &listener4_sock);
- if (rc) {
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- msyslog(LOG_ERR, "NTSs: nts_start_server4: error from pthread_create: %s", errbuf);
- }
- }
- if (listener6_sock != -1) {
- rc = pthread_create(&worker, NULL, nts_ke_listener, &listener6_sock);
- if (rc) {
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- msyslog(LOG_ERR, "NTSs: nts_start_server6: error from pthread_create: %s", errbuf);
- }
- }
- pthread_sigmask(SIG_SETMASK, &saved_sig_mask, NULL);
-
- return true;
+ pthread_t worker;
+ sigset_t block_mask, saved_sig_mask;
+ int rc;
+ char errbuf[100];
+
+ if (!nts_load_certificate(server_ctx)) {
+ return false;
+ }
+
+ sigfillset(&block_mask);
+ pthread_sigmask(SIG_BLOCK, &block_mask, &saved_sig_mask);
+ if (listener4_sock != -1) {
+ rc = pthread_create(&worker, NULL, nts_ke_listener, &listener4_sock);
+ if (rc) {
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ msyslog(LOG_ERR, "NTSs: nts_start_server4: error from pthread_create: %s", errbuf);
+ }
+ }
+ if (listener6_sock != -1) {
+ rc = pthread_create(&worker, NULL, nts_ke_listener, &listener6_sock);
+ if (rc) {
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ msyslog(LOG_ERR, "NTSs: nts_start_server6: error from pthread_create: %s", errbuf);
+ }
+ }
+ pthread_sigmask(SIG_SETMASK, &saved_sig_mask, NULL);
+
+ return true;
}
-/* called every hour */
+// called every hour
void nts_cert_timer(void) {
- check_cert_file();
+ check_cert_file();
}
-/* call hourly and by SIGHUP */
+// call hourly and by SIGHUP
void check_cert_file(void) {
- if (NULL == server_ctx)
- return;
- nts_lock_certlock();
- nts_reload_certificate(server_ctx);
- nts_unlock_certlock();
+ if (NULL == server_ctx)
+ return;
+ nts_lock_certlock();
+ nts_reload_certificate(server_ctx);
+ nts_unlock_certlock();
}
void nts_lock_certlock(void) {
- int err = pthread_mutex_lock(&certificate_lock);
- if (0 != err) {
- msyslog(LOG_ERR, "ERR: Can't lock certificate_lock: %d", err);
- exit(2);
- }
+ int err = pthread_mutex_lock(&certificate_lock);
+ if (0 != err) {
+ msyslog(LOG_ERR, "ERR: Can't lock certificate_lock: %d", err);
+ exit(2);
+ }
}
void nts_unlock_certlock(void) {
- int err = pthread_mutex_unlock(&certificate_lock);
- if (0 != err) {
- msyslog(LOG_ERR, "ERR: Can't unlock certificate_lock: %d", err);
- exit(2);
- }
+ int err = pthread_mutex_unlock(&certificate_lock);
+ if (0 != err) {
+ msyslog(LOG_ERR, "ERR: Can't unlock certificate_lock: %d", err);
+ exit(2);
+ }
}
-/* lfptod goes to long double */
+// lfptod goes to long double
static inline double lfptox(l_fp r) {
-/* l_fp to double */
+// l_fp to double
return ldexp((double)((int64_t)r), -32);
}
void* nts_ke_listener(void* arg) {
- struct timeval timeout = {.tv_sec = NTS_KE_TIMEOUT, .tv_usec = 0};
- int sock = *(int*)arg;
- char errbuf[100];
- char addrbuf[100];
- char usingbuf[100];
- struct timespec start, finish; /* wall clock */
- l_fp wall, usr, sys;
- const char *errtxt; /* not NULL if error */
+ struct timeval timeout = {.tv_sec = NTS_KE_TIMEOUT, .tv_usec = 0};
+ int sock = *(int*)arg;
+ char errbuf[100];
+ char addrbuf[100];
+ char usingbuf[100];
+ struct timespec start, finish; // wall clock
+ l_fp wall, usr, sys;
+ const char *errtxt; // not NULL if error
#ifdef RUSAGE_THREAD
- /* Not in NetBSD 10.1, 2026-Apr-05 */
- struct timespec start_u, finish_u; /* CPU user */
- struct timespec start_s, finish_s; /* CPU system */
- struct rusage usage;
+ // Not in NetBSD 10.1, 2026-Apr-05
+ struct timespec start_u, finish_u; // CPU user
+ struct timespec start_s, finish_s; // CPU system
+ struct rusage usage;
#endif
#ifdef HAVE_SECCOMP_H
- setup_SIGSYS_trap(); /* enable trap for this thread */
+ setup_SIGSYS_trap(); // enable trap for this thread
#endif
#ifdef RUSAGE_THREAD
- /* NB: start_u and start_s are from near the end of the previous cycle.
- * Thus usage timing includes the TCP accept and
- * writing the previous msyslog message.
- */
- getrusage(RUSAGE_THREAD, &usage);
- start_u = tval_to_tspec(usage.ru_utime);
- start_s = tval_to_tspec(usage.ru_stime);
+ /* NB: start_u and start_s are from near the end of the previous cycle.
+ * Thus usage timing includes the TCP accept and
+ * writing the previous msyslog message.
+ */
+ getrusage(RUSAGE_THREAD, &usage);
+ start_u = tval_to_tspec(usage.ru_utime);
+ start_s = tval_to_tspec(usage.ru_stime);
#else
- usr = 0;
- sys = 0;
+ usr = 0;
+ sys = 0;
#endif
- while(1) {
- NTSKE_Status status = NTSKE_SSL_Failed;
- sockaddr_u addr;
- socklen_t len = sizeof(addr);
- SSL *ssl;
- int client, err;
-
- sleep(1); /* FIXME: log clutter/DoS */
- errtxt = NULL;
- client = accept(sock, &addr.sa, &len);
- if (client < 0) {
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- msyslog(LOG_ERR, "NTSs: TCP accept failed: %s", errbuf);
- if (EBADF == errno)
- return NULL;
- continue;
- }
- clock_gettime(CLOCK_MONOTONIC, &start);
- sockporttoa_r(&addr, addrbuf, sizeof(addrbuf));
+ while(1) {
+ NTSKE_Status status = NTSKE_SSL_Failed;
+ sockaddr_u addr;
+ socklen_t len = sizeof(addr);
+ SSL *ssl;
+ int client, err;
+
+ sleep(1); // FIXME: log clutter/DoS
+ errtxt = NULL;
+ client = accept(sock, &addr.sa, &len);
+ if (client < 0) {
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ msyslog(LOG_ERR, "NTSs: TCP accept failed: %s", errbuf);
+ if (EBADF == errno)
+ return NULL;
+ continue;
+ }
+ clock_gettime(CLOCK_MONOTONIC, &start);
+ sockporttoa_r(&addr, addrbuf, sizeof(addrbuf));
/* This is disabled in order to reduce clutter in the log file.
* The client's address is now included in the final message.
@@ -266,85 +266,85 @@ void* nts_ke_listener(void* arg) {
* fall into the normal (non-error) path which does include the address.
* Enabling this might make strange cases easier to understand.
*/
-/* msyslog(LOG_INFO, "NTSs: TCP accept-ed from %s", addrbuf); */
-
- err = setsockopt(client, SOL_SOCKET, SO_RCVTIMEO,
- &timeout, sizeof(timeout));
- if (0 > err) {
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- msyslog(LOG_ERR, "NTSs: can't set recv timeout: %s", errbuf);
- close(client);
- ntske_cnt.serves_bad++;
- continue;
- }
- err = setsockopt(client, SOL_SOCKET, SO_SNDTIMEO,
- &timeout, sizeof(timeout));
- if (0 > err) {
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- msyslog(LOG_ERR, "NTSs: can't set send timeout: %s", errbuf);
- close(client);
- ntske_cnt.serves_bad++;
- continue;
- }
-
- /* WARN: For high volume servers, this should go in a new thread. */
- nts_lock_certlock();
- ssl = SSL_new(server_ctx);
- nts_unlock_certlock();
- SSL_set_fd(ssl, client);
-
- err = SSL_accept(ssl);
- if (0 >= err) {
- int code = SSL_get_error(ssl, err);
- SSL_free(ssl);
- close(client);
- clock_gettime(CLOCK_MONOTONIC, &finish);
- wall = tspec_intv_to_lfp(sub_tspec(finish, start));
+// msyslog(LOG_INFO, "NTSs: TCP accept-ed from %s", addrbuf);
+
+ err = setsockopt(client, SOL_SOCKET, SO_RCVTIMEO,
+ &timeout, sizeof(timeout));
+ if (0 > err) {
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ msyslog(LOG_ERR, "NTSs: can't set recv timeout: %s", errbuf);
+ close(client);
+ ntske_cnt.serves_bad++;
+ continue;
+ }
+ err = setsockopt(client, SOL_SOCKET, SO_SNDTIMEO,
+ &timeout, sizeof(timeout));
+ if (0 > err) {
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ msyslog(LOG_ERR, "NTSs: can't set send timeout: %s", errbuf);
+ close(client);
+ ntske_cnt.serves_bad++;
+ continue;
+ }
+
+ // WARN: For high volume servers, this should go in a new thread.
+ nts_lock_certlock();
+ ssl = SSL_new(server_ctx);
+ nts_unlock_certlock();
+ SSL_set_fd(ssl, client);
+
+ err = SSL_accept(ssl);
+ if (0 >= err) {
+ int code = SSL_get_error(ssl, err);
+ SSL_free(ssl);
+ close(client);
+ clock_gettime(CLOCK_MONOTONIC, &finish);
+ wall = tspec_intv_to_lfp(sub_tspec(finish, start));
#ifdef RUSAGE_THREAD
- getrusage(RUSAGE_THREAD, &usage);
- finish_u = tval_to_tspec(usage.ru_utime);
- finish_s = tval_to_tspec(usage.ru_stime);
- usr = tspec_intv_to_lfp(sub_tspec(finish_u, start_u));
- sys = tspec_intv_to_lfp(sub_tspec(finish_s, start_s));
- start_u = finish_u;
- start_s = finish_s;
+ getrusage(RUSAGE_THREAD, &usage);
+ finish_u = tval_to_tspec(usage.ru_utime);
+ finish_s = tval_to_tspec(usage.ru_stime);
+ usr = tspec_intv_to_lfp(sub_tspec(finish_u, start_u));
+ sys = tspec_intv_to_lfp(sub_tspec(finish_s, start_s));
+ start_u = finish_u;
+ start_s = finish_s;
#endif
- nts_ke_accept_fail(addrbuf,
- lfptox(wall), lfptox(usr), lfptox(sys), code);
- continue;
- }
-
- /* Save info for final message. */
- snprintf(usingbuf, sizeof(usingbuf), "%s:%s(%d)",
- SSL_get_version(ssl),
- SSL_get_cipher_name(ssl),
- SSL_get_cipher_bits(ssl, NULL));
-
- status = NTSKE_Failed;
- nts_ke_request(ssl, errbuf, sizeof(errbuf), &errtxt);
- if (NULL==errtxt) status = NTSKE_OK;
-
- SSL_shutdown(ssl);
- SSL_free(ssl);
- close(client);
-
- clock_gettime(CLOCK_MONOTONIC, &finish);
- wall = tspec_intv_to_lfp(sub_tspec(finish, start));
+ nts_ke_accept_fail(addrbuf,
+ lfptox(wall), lfptox(usr), lfptox(sys), code);
+ continue;
+ }
+
+ // Save info for final message.
+ snprintf(usingbuf, sizeof(usingbuf), "%s:%s(%d)",
+ SSL_get_version(ssl),
+ SSL_get_cipher_name(ssl),
+ SSL_get_cipher_bits(ssl, NULL));
+
+ status = NTSKE_Failed;
+ nts_ke_request(ssl, errbuf, sizeof(errbuf), &errtxt);
+ if (NULL==errtxt) status = NTSKE_OK;
+
+ SSL_shutdown(ssl);
+ SSL_free(ssl);
+ close(client);
+
+ clock_gettime(CLOCK_MONOTONIC, &finish);
+ wall = tspec_intv_to_lfp(sub_tspec(finish, start));
#ifdef RUSAGE_THREAD
- getrusage(RUSAGE_THREAD, &usage);
- finish_u = tval_to_tspec(usage.ru_utime);
- finish_s = tval_to_tspec(usage.ru_stime);
- usr = tspec_intv_to_lfp(sub_tspec(finish_u, start_u));
- sys = tspec_intv_to_lfp(sub_tspec(finish_s, start_s));
- start_u = finish_u;
- start_s = finish_s;
+ getrusage(RUSAGE_THREAD, &usage);
+ finish_u = tval_to_tspec(usage.ru_utime);
+ finish_s = tval_to_tspec(usage.ru_stime);
+ usr = tspec_intv_to_lfp(sub_tspec(finish_u, start_u));
+ sys = tspec_intv_to_lfp(sub_tspec(finish_s, start_s));
+ start_u = finish_u;
+ start_s = finish_s;
#endif
- record_ntske_log(status, addrbuf, usingbuf,
- lfptox(wall), lfptox(usr), lfptox(sys),
- errtxt);
- }
+ record_ntske_log(status, addrbuf, usingbuf,
+ lfptox(wall), lfptox(usr), lfptox(sys),
+ errtxt);
+ }
- return NULL;
+ return NULL;
}
/* Analyze failure from SSL_accept
@@ -353,329 +353,329 @@ void* nts_ke_listener(void* arg) {
*/
void nts_ke_accept_fail(char* hostname,
double wall, double usr, double sys, int code) {
- unsigned long err = ERR_peek_error();
- char errbuf[100];
- char buff[200];
- const char *msg = NULL;
- const char *errmsg = NULL;
- if (0 == err) {
- switch (code) {
- case SSL_ERROR_WANT_READ:
- msg = "Timeout";
- break;
- case SSL_ERROR_SYSCALL:
- if (ECONNRESET==errno) {
- msg = "Connection reset";
- break;
- }
- /* fall through */
- default:
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- snprintf(buff, sizeof(buff), "code %d, errno=>%d, %s",
- code, errno, errbuf);
- msg = buff;
- break;
- }
- } else {
- if (code==SSL_ERROR_SSL) {
- msg = ERR_reason_error_string(err);
- err = 0;
- } else {
- // Maybe we need to handle other codes
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- snprintf(buff, sizeof(buff), "code %d, errno=>%d, %s, %lx=>%s",
- code, errno, errbuf, err, ERR_reason_error_string(err));
- err = 0;
- msg = buff;
- }
- }
- record_ntske_log(NTSKE_SSL_Failed, hostname, msg,
- wall, usr, sys, errmsg);
+ unsigned long err = ERR_peek_error();
+ char errbuf[100];
+ char buff[200];
+ const char *msg = NULL;
+ const char *errmsg = NULL;
+ if (0 == err) {
+ switch (code) {
+ case SSL_ERROR_WANT_READ:
+ msg = "Timeout";
+ break;
+ case SSL_ERROR_SYSCALL:
+ if (ECONNRESET==errno) {
+ msg = "Connection reset";
+ break;
+ }
+ // fall through
+ default:
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ snprintf(buff, sizeof(buff), "code %d, errno=>%d, %s",
+ code, errno, errbuf);
+ msg = buff;
+ break;
+ }
+ } else {
+ if (code==SSL_ERROR_SSL) {
+ msg = ERR_reason_error_string(err);
+ err = 0;
+ } else {
+ // Maybe we need to handle other codes
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ snprintf(buff, sizeof(buff), "code %d, errno=>%d, %s, %lx=>%s",
+ code, errno, errbuf, err, ERR_reason_error_string(err));
+ err = 0;
+ msg = buff;
+ }
+ }
+ record_ntske_log(NTSKE_SSL_Failed, hostname, msg,
+ wall, usr, sys, errmsg);
}
void nts_ke_request(SSL *ssl,
char *errbuf, int errlng, const char **errtxt) {
- /* RFC 4: servers must accept 1024
- * Our cookies can be 104, 136, or 168 for AES_SIV_CMAC_xxx
- * 8*168 fits comfortably into 2K.
- */
- uint8_t buff[2048];
- uint8_t c2s[NTS_MAX_KEYLEN], s2c[NTS_MAX_KEYLEN];
- int aead = NO_AEAD, keylen;
- struct BufCtl_t buf;
- int bytes_read, bytes_written;
- int used;
-
- bytes_read = nts_ssl_read(ssl, buff, sizeof(buff), errtxt);
- if (0 >= bytes_read)
- return;
-
- buf.next = buff;
- buf.left = bytes_read;
- if (!nts_ke_process_receive(&buf, &aead, errbuf, errlng, errtxt)) {
- return;
- }
-
- if ((NO_AEAD == aead) && (NULL != ntsconfig.aead))
- aead = nts_string_to_aead(ntsconfig.aead);
- if (NO_AEAD == aead)
- aead = AEAD_AES_SIV_CMAC_256; /* default */
-
- keylen = nts_get_key_length(aead);
- if (!nts_make_keys(ssl, aead, c2s, s2c, keylen)) {
- *errtxt = "Can't make keys";
- return;
- }
-
- buf.next = buff;
- buf.left = sizeof(buff);
- nts_ke_setup_send(&buf, aead, c2s, s2c, keylen);
-
- used = sizeof(buff)-buf.left;
- bytes_written = nts_ssl_write(ssl, buff, used, errtxt);
- if (bytes_written != used)
- return;
-
-/* FIXME: Need counters for AEAD */
-
- return;
+ /* RFC 4: servers must accept 1024
+ * Our cookies can be 104, 136, or 168 for AES_SIV_CMAC_xxx
+ * 8*168 fits comfortably into 2K.
+ */
+ uint8_t buff[2048];
+ uint8_t c2s[NTS_MAX_KEYLEN], s2c[NTS_MAX_KEYLEN];
+ int aead = NO_AEAD, keylen;
+ struct BufCtl_t buf;
+ int bytes_read, bytes_written;
+ int used;
+
+ bytes_read = nts_ssl_read(ssl, buff, sizeof(buff), errtxt);
+ if (0 >= bytes_read)
+ return;
+
+ buf.next = buff;
+ buf.left = bytes_read;
+ if (!nts_ke_process_receive(&buf, &aead, errbuf, errlng, errtxt)) {
+ return;
+ }
+
+ if ((NO_AEAD == aead) && (NULL != ntsconfig.aead))
+ aead = nts_string_to_aead(ntsconfig.aead);
+ if (NO_AEAD == aead)
+ aead = AEAD_AES_SIV_CMAC_256; // default
+
+ keylen = nts_get_key_length(aead);
+ if (!nts_make_keys(ssl, aead, c2s, s2c, keylen)) {
+ *errtxt = "Can't make keys";
+ return;
+ }
+
+ buf.next = buff;
+ buf.left = sizeof(buff);
+ nts_ke_setup_send(&buf, aead, c2s, s2c, keylen);
+
+ used = sizeof(buff)-buf.left;
+ bytes_written = nts_ssl_write(ssl, buff, used, errtxt);
+ if (bytes_written != used)
+ return;
+
+// FIXME: Need counters for AEAD
+
+ return;
}
bool create_listener4(int port) {
- int sock = -1;
- sockaddr_u addr;
- int on = 1;
- int err;
- char errbuf[100];
-
- addr.sa4.sin_family = AF_INET;
- addr.sa4.sin_port = htons(port);
- addr.sa4.sin_addr.s_addr= htonl(INADDR_ANY);
- sock = socket(AF_INET, SOCK_STREAM, 0);
- if (sock < 0) {
- if (EAFNOSUPPORT == errno) {
- msyslog(LOG_ERR, "NTSs: No IPv4 support, disabling NTS-KE listener");
- return true;
- }
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- msyslog(LOG_ERR, "NTSs: Can't create socket4: %s", errbuf);
- return false;
- }
- err = setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
- if (0 > err) {
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- msyslog(LOG_ERR, "NTSs: can't setsockopt4: %s", errbuf);
- close(sock);
- return false;
- }
- err = bind(sock, &addr.sa, sizeof(addr.sa4));
- if (0 > err) {
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- msyslog(LOG_ERR, "NTSs: can't bind4: %s", errbuf);
- close(sock);
- return false;
- }
- if (listen(sock, 6) < 0) {
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- msyslog(LOG_ERR, "NTSs: can't listen4: %s", errbuf);
- close(sock);
- return false;
- }
- msyslog(LOG_INFO, "NTSs: listen4 worked");
-
- listener4_sock = sock;
- return true;
+ int sock = -1;
+ sockaddr_u addr;
+ int on = 1;
+ int err;
+ char errbuf[100];
+
+ addr.sa4.sin_family = AF_INET;
+ addr.sa4.sin_port = htons(port);
+ addr.sa4.sin_addr.s_addr= htonl(INADDR_ANY);
+ sock = socket(AF_INET, SOCK_STREAM, 0);
+ if (sock < 0) {
+ if (EAFNOSUPPORT == errno) {
+ msyslog(LOG_ERR, "NTSs: No IPv4 support, disabling NTS-KE listener");
+ return true;
+ }
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ msyslog(LOG_ERR, "NTSs: Can't create socket4: %s", errbuf);
+ return false;
+ }
+ err = setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
+ if (0 > err) {
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ msyslog(LOG_ERR, "NTSs: can't setsockopt4: %s", errbuf);
+ close(sock);
+ return false;
+ }
+ err = bind(sock, &addr.sa, sizeof(addr.sa4));
+ if (0 > err) {
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ msyslog(LOG_ERR, "NTSs: can't bind4: %s", errbuf);
+ close(sock);
+ return false;
+ }
+ if (listen(sock, 6) < 0) {
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ msyslog(LOG_ERR, "NTSs: can't listen4: %s", errbuf);
+ close(sock);
+ return false;
+ }
+ msyslog(LOG_INFO, "NTSs: listen4 worked");
+
+ listener4_sock = sock;
+ return true;
}
bool create_listener6(int port) {
- int sock = -1;
- sockaddr_u addr;
- int on = 1;
- int err;
- char errbuf[100];
-
- addr.sa6.sin6_family = AF_INET6;
- addr.sa6.sin6_port = htons(port);
- addr.sa6.sin6_addr = in6addr_any;
- sock = socket(AF_INET6, SOCK_STREAM, 0);
- if (sock < 0) {
- if (EAFNOSUPPORT == errno) {
- msyslog(LOG_ERR, "NTSs: No IPv6 support, disabling NTS-KE listener");
- return true;
- }
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- msyslog(LOG_ERR, "NTSs: Can't create socket6: %s", errbuf);
- return false;
- }
- /* Hack to keep IPV6 from listening on IPV4 too */
- err = setsockopt(sock, IPPROTO_IPV6, IPV6_V6ONLY, &on, sizeof(on));
- if (0 > err) {
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- msyslog(LOG_ERR, "NTSs: can't setsockopt6only: %s", errbuf);
- close(sock);
- return false;
- }
- err = setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
- if (0 > err) {
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- msyslog(LOG_ERR, "NTSs: can't setsockopt6: %s", errbuf);
- close(sock);
- return false;
- }
- err = bind(sock, &addr.sa, sizeof(addr.sa6));
- if (0 > err) {
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- msyslog(LOG_ERR, "NTSs: can't bind6: %s", errbuf);
- close(sock);
- return false;
- }
- if (listen(sock, 6) < 0) {
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- msyslog(LOG_ERR, "NTSs: can't listen6: %s", errbuf);
- close(sock);
- return false;
- }
- msyslog(LOG_INFO, "NTSs: listen6 worked");
-
- listener6_sock = sock;
- return true;
+ int sock = -1;
+ sockaddr_u addr;
+ int on = 1;
+ int err;
+ char errbuf[100];
+
+ addr.sa6.sin6_family = AF_INET6;
+ addr.sa6.sin6_port = htons(port);
+ addr.sa6.sin6_addr = in6addr_any;
+ sock = socket(AF_INET6, SOCK_STREAM, 0);
+ if (sock < 0) {
+ if (EAFNOSUPPORT == errno) {
+ msyslog(LOG_ERR, "NTSs: No IPv6 support, disabling NTS-KE listener");
+ return true;
+ }
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ msyslog(LOG_ERR, "NTSs: Can't create socket6: %s", errbuf);
+ return false;
+ }
+ // Hack to keep IPV6 from listening on IPV4 too
+ err = setsockopt(sock, IPPROTO_IPV6, IPV6_V6ONLY, &on, sizeof(on));
+ if (0 > err) {
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ msyslog(LOG_ERR, "NTSs: can't setsockopt6only: %s", errbuf);
+ close(sock);
+ return false;
+ }
+ err = setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
+ if (0 > err) {
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ msyslog(LOG_ERR, "NTSs: can't setsockopt6: %s", errbuf);
+ close(sock);
+ return false;
+ }
+ err = bind(sock, &addr.sa, sizeof(addr.sa6));
+ if (0 > err) {
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ msyslog(LOG_ERR, "NTSs: can't bind6: %s", errbuf);
+ close(sock);
+ return false;
+ }
+ if (listen(sock, 6) < 0) {
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ msyslog(LOG_ERR, "NTSs: can't listen6: %s", errbuf);
+ close(sock);
+ return false;
+ }
+ msyslog(LOG_INFO, "NTSs: listen6 worked");
+
+ listener6_sock = sock;
+ return true;
}
bool nts_ke_process_receive(struct BufCtl_t *buf, int *aead,
char *errbuf, int errlng, const char **errtxt) {
- while (buf->left >= NTS_KE_HDR_LNG) {
- uint16_t type, data;
- int length;
- bool critical = false;
- type = ke_next_record(buf, &length);
+ while (buf->left >= NTS_KE_HDR_LNG) {
+ uint16_t type, data;
+ int length;
+ bool critical = false;
+ type = ke_next_record(buf, &length);
if (length > buf->left) {
- snprintf(errbuf, errlng,
- "Chunk too big: 0x%x, %d, %d",
+ snprintf(errbuf, errlng,
+ "Chunk too big: 0x%x, %d, %d",
type, buf->left, length);
- *errtxt = errbuf;
+ *errtxt = errbuf;
return false;
}
- if (NTS_CRITICAL & type) {
- critical = true;
- type &= ~NTS_CRITICAL;
- }
- if (0) // Handy for debugging but very verbose
- msyslog(LOG_INFO, "NTSs: Record: T=%d, L=%d, C=%d", type, length, critical);
- switch (type) {
- case nts_error:
- if (sizeof(data) != length) {
- snprintf(errbuf, errlng,
- "Wrong length on error: %d", length);
- *errtxt = errbuf;
- return false;
- }
- data = next_uint16(buf);
- snprintf(errbuf, errlng,
- "Received error: %d", data);
- *errtxt = errbuf;
- return false;
- case nts_next_protocol_negotiation:
- if (sizeof(data) != length) {
- snprintf(errbuf, errlng,
- "NPN-Wrong length: %d", length);
- *errtxt = errbuf;
- return false;
- }
- data = next_uint16(buf);
- if (data != nts_protocol_NTP) {
- snprintf(errbuf, errlng,
- "NPN-Bad data: %d", data);
- *errtxt = errbuf;
- return false;
- }
- break;
- case nts_algorithm_negotiation:
- if (length % sizeof(uint16_t) > 0) {
- snprintf(errbuf, errlng,
- "AN-Wrong length: %d", length);
- *errtxt = errbuf;
- return false;
- }
- for (int i=0; i<length; i+=sizeof(uint16_t)) {
- data = next_uint16(buf);
- if (0 == nts_get_key_length(data)) {
- if (0) /* for debugging */
- msyslog(LOG_ERR, "NTSs: AN-Unsupported AEAN type: %d", data);
- continue; /* ignore types we don't support */
- }
- if (*aead != NO_AEAD)
- continue; /* already got one */
- *aead = data; /* take this one */
- }
- break;
- case nts_end_of_message:
- if ((0 != length) || !critical) {
- snprintf(errbuf, errlng,
- "EOM-Wrong length or not Critical: %d, %d",
- length, critical);
- *errtxt = errbuf;
- return false;
- }
- if (0 != buf->left) {
- snprintf(errbuf, errlng,
- "EOM not at end: %d", buf->left);
- *errtxt = errbuf;
- return false;
- }
- return true;
- default:
- if (critical) {
- // This only logs the first one from a connection
- snprintf(errbuf, errlng,
- "Received strange type: T=%d, C=%d, L=%d",
- type, critical, length);
- // There is an error code for this
- return false;
- }
- // It might be interesting to log non-critical
- // but that needs rate limiting
- buf->next += length;
- buf->left -= length;
- break;
- } /* case */
- } /* while */
-
- /* If we get here, we ran off the end without finding an EOM.
- * nts_ssl_read() should have complained, so this check
- * should never happen.
- */
- if (buf->left > 0) {
- *errtxt = "*** Leftovers";
- return false;
- }
-
- *errtxt = "*** Missing EOM";
- return false;
+ if (NTS_CRITICAL & type) {
+ critical = true;
+ type &= ~NTS_CRITICAL;
+ }
+ if (0) // Handy for debugging but very verbose
+ msyslog(LOG_INFO, "NTSs: Record: T=%d, L=%d, C=%d", type, length, critical);
+ switch (type) {
+ case nts_error:
+ if (sizeof(data) != length) {
+ snprintf(errbuf, errlng,
+ "Wrong length on error: %d", length);
+ *errtxt = errbuf;
+ return false;
+ }
+ data = next_uint16(buf);
+ snprintf(errbuf, errlng,
+ "Received error: %d", data);
+ *errtxt = errbuf;
+ return false;
+ case nts_next_protocol_negotiation:
+ if (sizeof(data) != length) {
+ snprintf(errbuf, errlng,
+ "NPN-Wrong length: %d", length);
+ *errtxt = errbuf;
+ return false;
+ }
+ data = next_uint16(buf);
+ if (data != nts_protocol_NTP) {
+ snprintf(errbuf, errlng,
+ "NPN-Bad data: %d", data);
+ *errtxt = errbuf;
+ return false;
+ }
+ break;
+ case nts_algorithm_negotiation:
+ if (length % sizeof(uint16_t) > 0) {
+ snprintf(errbuf, errlng,
+ "AN-Wrong length: %d", length);
+ *errtxt = errbuf;
+ return false;
+ }
+ for (int i=0; i<length; i+=sizeof(uint16_t)) {
+ data = next_uint16(buf);
+ if (0 == nts_get_key_length(data)) {
+ if (0) // for debugging
+ msyslog(LOG_ERR, "NTSs: AN-Unsupported AEAN type: %d", data);
+ continue; // ignore types we don't support
+ }
+ if (*aead != NO_AEAD)
+ continue; // already got one
+ *aead = data; // take this one
+ }
+ break;
+ case nts_end_of_message:
+ if ((0 != length) || !critical) {
+ snprintf(errbuf, errlng,
+ "EOM-Wrong length or not Critical: %d, %d",
+ length, critical);
+ *errtxt = errbuf;
+ return false;
+ }
+ if (0 != buf->left) {
+ snprintf(errbuf, errlng,
+ "EOM not at end: %d", buf->left);
+ *errtxt = errbuf;
+ return false;
+ }
+ return true;
+ default:
+ if (critical) {
+ // This only logs the first one from a connection
+ snprintf(errbuf, errlng,
+ "Received strange type: T=%d, C=%d, L=%d",
+ type, critical, length);
+ // There is an error code for this
+ return false;
+ }
+ // It might be interesting to log non-critical
+ // but that needs rate limiting
+ buf->next += length;
+ buf->left -= length;
+ break;
+ } // case
+ } // while
+
+ /* If we get here, we ran off the end without finding an EOM.
+ * nts_ssl_read() should have complained, so this check
+ * should never happen.
+ */
+ if (buf->left > 0) {
+ *errtxt = "*** Leftovers";
+ return false;
+ }
+
+ *errtxt = "*** Missing EOM";
+ return false;
}
void nts_ke_setup_send(struct BufCtl_t *buf, int aead,
uint8_t *c2s, uint8_t *s2c, int keylen) {
- /* 4.1.2 Next Protocol */
- ke_append_record_uint16(buf,
- NTS_CRITICAL+nts_next_protocol_negotiation, nts_protocol_NTP);
- /* 4.1.5 AEAD Algorithm List */
- ke_append_record_uint16(buf, nts_algorithm_negotiation, aead);
+ // 4.1.2 Next Protocol
+ ke_append_record_uint16(buf,
+ NTS_CRITICAL+nts_next_protocol_negotiation, nts_protocol_NTP);
+ // 4.1.5 AEAD Algorithm List
+ ke_append_record_uint16(buf, nts_algorithm_negotiation, aead);
- if (extra_port)
- ke_append_record_uint16(buf, nts_port_negotiation, extra_port);
+ if (extra_port)
+ ke_append_record_uint16(buf, nts_port_negotiation, extra_port);
- for (int i=0; i<NTS_MAX_COOKIES; i++) {
- uint8_t cookie[NTS_MAX_COOKIELEN];
- int cookielen = nts_make_cookie(cookie, aead, c2s, s2c, keylen);
- ke_append_record_bytes(buf, nts_new_cookie, cookie, cookielen);
- }
+ for (int i=0; i<NTS_MAX_COOKIES; i++) {
+ uint8_t cookie[NTS_MAX_COOKIELEN];
+ int cookielen = nts_make_cookie(cookie, aead, c2s, s2c, keylen);
+ ke_append_record_bytes(buf, nts_new_cookie, cookie, cookielen);
+ }
- /* 4.1.1: End, Critical */
- ke_append_record_null(buf, NTS_CRITICAL+nts_end_of_message);
+ // 4.1.1: End, Critical
+ ke_append_record_null(buf, NTS_CRITICAL+nts_end_of_message);
}
-/* end */
+// end
=====================================
ntpd/refclock_jjy.c
=====================================
The diff for this file was not included because it is too large.
View it on GitLab: https://gitlab.com/NTPsec/ntpsec/-/compare/bd2ece42247f5f64d1951770db667bcaa0cdec59...96061e0b48cc180d182041c659661a1115aa589d
--
View it on GitLab: https://gitlab.com/NTPsec/ntpsec/-/compare/bd2ece42247f5f64d1951770db667bcaa0cdec59...96061e0b48cc180d182041c659661a1115aa589d
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ntpsec.org/pipermail/vc/attachments/20260806/e439ff5e/attachment-0001.htm>
More information about the vc
mailing list