[Git][NTPsec/ntpsec][client] 8 commits: ntpd/refclock_jjy.c: Just remove tabs. Weird comments...
Hal Murray (@hal.murray)
gitlab at mg.gitlab.com
Thu Aug 6 17:23:48 UTC 2026
Hal Murray pushed to branch client at NTPsec / ntpsec
Commits:
676d82c4 by Gary E. Miller at 2026-08-04T22:13:07-07:00
ntpd/refclock_jjy.c: Just remove tabs. Weird comments...
- - - - -
b2ca71a7 by Gary E. Miller at 2026-08-06T10:14:33-07:00
ntpd/nts_server.c: Remove tabs, Single line /* comments to //
- - - - -
4d7554c9 by Gary E. Miller at 2026-08-06T10:15:46-07:00
attic/aes-siv-timing.c: Remove tabs, Single line /* comments to //
No functional changes.
- - - - -
d73d3498 by Gary E. Miller at 2026-08-06T10:16:50-07:00
tests/ntpd/nts_cookie.c: Remove tabs, Single line /* comments to //
No functional changes.
- - - - -
2255add0 by Gary E. Miller at 2026-08-06T10:16:50-07:00
tests/ntpd/nts_cookie.c: restore previous comment indents
No functional changes.
- - - - -
e69a219e by Gary E. Miller at 2026-08-06T10:17:37-07:00
tests/ntpd/nts.c: Remove tabs, Single line /* comments to //
No functional changes.
- - - - -
81112e68 by Gary E. Miller at 2026-08-06T10:23:01-07:00
ntpd/nts_client.c: Remove tabs, Single line /* comments to //
No functional changes.
- - - - -
a59a1d2b by Gary E. Miller at 2026-08-06T10:23:01-07:00
ntpd/nts_client.c: restore previous comment indents
No functional changes.
- - - - -
6 changed files:
- attic/aes-siv-timing.c
- ntpd/nts_client.c
- ntpd/nts_server.c
- ntpd/refclock_jjy.c
- tests/ntpd/nts.c
- tests/ntpd/nts_cookie.c
Changes:
=====================================
attic/aes-siv-timing.c
=====================================
@@ -4,7 +4,7 @@
* SPDX-License-Identifier: BSD-2-Clause
*/
-/* Last modified on Sat Aug 28 14:30:11 PDT 1999 by murray */
+// Last modified on Sat Aug 28 14:30:11 PDT 1999 by murray
/*
* Hack to time aead routines from libaes_siv
@@ -44,7 +44,7 @@ int key_K_length;
pthread_mutex_t cookie_lock = PTHREAD_MUTEX_INITIALIZER;
-/* sizeof(key_I) + sizeof(NONCE) */
+// sizeof(key_I) + sizeof(NONCE)
#define AD_LENGTH 20
static void ssl_init(void)
@@ -85,44 +85,44 @@ static void ntp_RAND_bytes(unsigned char *buf, int num) {
static void DoLock(void)
{
- struct timespec start, stop;
- double fast;
- int samplesize = SAMPLESIZE;
+ struct timespec start, stop;
+ double fast;
+ int samplesize = SAMPLESIZE;
- clock_gettime(CLOCK_MONOTONIC, &start);
- for (int i = 0; i < samplesize; i++) {
+ clock_gettime(CLOCK_MONOTONIC, &start);
+ for (int i = 0; i < samplesize; i++) {
nts_lock_cookielock();
nts_unlock_cookielock();
- }
- clock_gettime(CLOCK_MONOTONIC, &stop);
- fast = (stop.tv_sec-start.tv_sec)*1E9 + (stop.tv_nsec-start.tv_nsec);
- printf("LocK %6.0f %7.3f",
- fast/samplesize, fast/1E9);
- printf("\n");
+ }
+ clock_gettime(CLOCK_MONOTONIC, &stop);
+ fast = (stop.tv_sec-start.tv_sec)*1E9 + (stop.tv_nsec-start.tv_nsec);
+ printf("LocK %6.0f %7.3f",
+ fast/samplesize, fast/1E9);
+ printf("\n");
}
static void DoNonce(void)
{
uint8_t nonce[NONCE_LENGTH];
- struct timespec start, stop;
- double fast;
- int samplesize = SAMPLESIZE;
+ struct timespec start, stop;
+ double fast;
+ int samplesize = SAMPLESIZE;
- clock_gettime(CLOCK_MONOTONIC, &start);
- for (int i = 0; i < samplesize; i++) {
+ clock_gettime(CLOCK_MONOTONIC, &start);
+ for (int i = 0; i < samplesize; i++) {
ntp_RAND_bytes(nonce, NONCE_LENGTH);
- }
- clock_gettime(CLOCK_MONOTONIC, &stop);
- fast = (stop.tv_sec-start.tv_sec)*1E9 + (stop.tv_nsec-start.tv_nsec);
- printf("Nonce %3d %6.0f %7.3f",
- NONCE_LENGTH, fast/samplesize, fast/1E9);
- printf("\n");
+ }
+ clock_gettime(CLOCK_MONOTONIC, &stop);
+ fast = (stop.tv_sec-start.tv_sec)*1E9 + (stop.tv_nsec-start.tv_nsec);
+ printf("Nonce %3d %6.0f %7.3f",
+ NONCE_LENGTH, fast/samplesize, fast/1E9);
+ printf("\n");
}
-/* Clone of nts_make_cookie() from ntpd/nts_cookie.c */
-/* returns actual length */
+// Clone of nts_make_cookie() from ntpd/nts_cookie.c
+// returns actual length
int nts_make_cookie(uint8_t *cookie,
uint16_t aead,
uint8_t *c2s, uint8_t *s2c, int keylen) {
@@ -131,11 +131,11 @@ int nts_make_cookie(uint8_t *cookie,
int used, plainlength;
bool ok;
uint8_t * finger;
- uint32_t temp; /* keep 4 byte alignment */
+ uint32_t temp; // keep 4 byte alignment
size_t left;
if (NULL == cookie_ctx)
- return 0; /* We aren't initialized yet. */
+ return 0; // We aren't initialized yet.
// nts_cookie_make++;
@@ -151,7 +151,7 @@ int nts_make_cookie(uint8_t *cookie,
finger += keylen;
plainlength = finger-plaintext;
- /* collect associated data */
+ // collect associated data
finger = cookie;
memcpy(finger, &key_I, sizeof(key_I));
@@ -166,7 +166,7 @@ int nts_make_cookie(uint8_t *cookie,
nts_lock_cookielock();
ok = AES_SIV_Encrypt(cookie_ctx,
- finger, &left, /* left: in: max out length, out: length used */
+ finger, &left, // left: in: max out length, out: length used
key_K, key_K_length,
nonce, NONCE_LENGTH,
plaintext, plainlength,
@@ -186,84 +186,84 @@ int nts_make_cookie(uint8_t *cookie,
static void DoMakeCookie(
- const char *name, /* name of aead */
- int aead, /* algorithm used to make cookie */
- int keylength /* length of c2s and s2c */
+ const char *name, // name of aead
+ int aead, // algorithm used to make cookie
+ int keylength // length of c2s and s2c
)
{
- uint8_t cookie[NTS_MAX_COOKIELEN];
- uint8_t c2s[NTS_MAX_KEYLEN], s2c[NTS_MAX_KEYLEN];
- struct timespec start, stop;
- double fast;
- int cookielength = 0;
- int samplesize = SAMPLESIZE;
-
- switch (aead) {
- case AEAD_AES_SIV_CMAC_256:
- key_K_length = AEAD_AES_SIV_CMAC_256_KEYLEN;
- break;
- case AEAD_AES_SIV_CMAC_384:
- key_K_length = AEAD_AES_SIV_CMAC_384_KEYLEN;
- break;
- case AEAD_AES_SIV_CMAC_512:
- key_K_length = AEAD_AES_SIV_CMAC_512_KEYLEN;
- break;
- default:
- printf("Bogus aead\n");
- exit(1);
- }
+ uint8_t cookie[NTS_MAX_COOKIELEN];
+ uint8_t c2s[NTS_MAX_KEYLEN], s2c[NTS_MAX_KEYLEN];
+ struct timespec start, stop;
+ double fast;
+ int cookielength = 0;
+ int samplesize = SAMPLESIZE;
+
+ switch (aead) {
+ case AEAD_AES_SIV_CMAC_256:
+ key_K_length = AEAD_AES_SIV_CMAC_256_KEYLEN;
+ break;
+ case AEAD_AES_SIV_CMAC_384:
+ key_K_length = AEAD_AES_SIV_CMAC_384_KEYLEN;
+ break;
+ case AEAD_AES_SIV_CMAC_512:
+ key_K_length = AEAD_AES_SIV_CMAC_512_KEYLEN;
+ break;
+ default:
+ printf("Bogus aead\n");
+ exit(1);
+ }
ntp_RAND_bytes(c2s, NTS_MAX_KEYLEN);
ntp_RAND_bytes(s2c, NTS_MAX_KEYLEN);
- clock_gettime(CLOCK_MONOTONIC, &start);
- for (int i = 0; i < samplesize; i++) {
- cookielength = nts_make_cookie(
- cookie, aead, c2s, s2c, keylength);
- }
- clock_gettime(CLOCK_MONOTONIC, &stop);
- fast = (stop.tv_sec-start.tv_sec)*1E9 + (stop.tv_nsec-start.tv_nsec);
- printf("%12s %2d %4d %6.0f %7.3f",
- name, keylength, cookielength, fast/samplesize, fast/1E9);
- printf("\n");
+ clock_gettime(CLOCK_MONOTONIC, &start);
+ for (int i = 0; i < samplesize; i++) {
+ cookielength = nts_make_cookie(
+ cookie, aead, c2s, s2c, keylength);
+ }
+ clock_gettime(CLOCK_MONOTONIC, &stop);
+ fast = (stop.tv_sec-start.tv_sec)*1E9 + (stop.tv_nsec-start.tv_nsec);
+ printf("%12s %2d %4d %6.0f %7.3f",
+ name, keylength, cookielength, fast/samplesize, fast/1E9);
+ printf("\n");
}
static void DoMakeCrypto(
- const char *name, /* name of aead */
- int aead, /* algorithm used to make cookie */
- int keylen /* length of c2s and s2c */
+ const char *name, // name of aead
+ int aead, // algorithm used to make cookie
+ int keylen // length of c2s and s2c
)
{
- uint8_t cookie[NTS_MAX_COOKIELEN];
- uint8_t c2s[NTS_MAX_KEYLEN], s2c[NTS_MAX_KEYLEN];
- struct timespec start, stop;
- double fast;
- int cookielength = 0;
- int samplesize = SAMPLESIZE;
+ uint8_t cookie[NTS_MAX_COOKIELEN];
+ uint8_t c2s[NTS_MAX_KEYLEN], s2c[NTS_MAX_KEYLEN];
+ struct timespec start, stop;
+ double fast;
+ int cookielength = 0;
+ int samplesize = SAMPLESIZE;
uint8_t plaintext[NTS_MAX_COOKIELEN];
uint8_t *nonce;
int used, plainlength;
int ok = 0;
uint8_t * finger;
- uint32_t temp; /* keep 4 byte alignment */
+ uint32_t temp; // keep 4 byte alignment
size_t left;
- switch (aead) {
- case AEAD_AES_SIV_CMAC_256:
- key_K_length = AEAD_AES_SIV_CMAC_256_KEYLEN;
- break;
- case AEAD_AES_SIV_CMAC_384:
- key_K_length = AEAD_AES_SIV_CMAC_384_KEYLEN;
- break;
- case AEAD_AES_SIV_CMAC_512:
- key_K_length = AEAD_AES_SIV_CMAC_512_KEYLEN;
- break;
- default:
- printf("Bogus aead\n");
- exit(1);
- }
+ switch (aead) {
+ case AEAD_AES_SIV_CMAC_256:
+ key_K_length = AEAD_AES_SIV_CMAC_256_KEYLEN;
+ break;
+ case AEAD_AES_SIV_CMAC_384:
+ key_K_length = AEAD_AES_SIV_CMAC_384_KEYLEN;
+ break;
+ case AEAD_AES_SIV_CMAC_512:
+ key_K_length = AEAD_AES_SIV_CMAC_512_KEYLEN;
+ break;
+ default:
+ printf("Bogus aead\n");
+ exit(1);
+ }
ntp_RAND_bytes(c2s, NTS_MAX_KEYLEN);
ntp_RAND_bytes(s2c, NTS_MAX_KEYLEN);
@@ -278,7 +278,7 @@ static void DoMakeCrypto(
finger += keylen;
plainlength = finger-plaintext;
- /* collect associated data */
+ // collect associated data
finger = cookie;
memcpy(finger, &key_I, sizeof(key_I));
@@ -291,16 +291,16 @@ static void DoMakeCrypto(
used = finger-cookie;
left = NTS_MAX_COOKIELEN-used;
- clock_gettime(CLOCK_MONOTONIC, &start);
- for (int i = 0; i < samplesize; i++) {
+ clock_gettime(CLOCK_MONOTONIC, &start);
+ for (int i = 0; i < samplesize; i++) {
ok += AES_SIV_Encrypt(cookie_ctx,
- finger, &left, /* left: in: max out length, out: length used */
+ finger, &left, // left: in: max out length, out: length used
key_K, key_K_length,
nonce, NONCE_LENGTH,
plaintext, plainlength,
cookie, AD_LENGTH);
- }
- clock_gettime(CLOCK_MONOTONIC, &stop);
+ }
+ clock_gettime(CLOCK_MONOTONIC, &stop);
if (samplesize != ok) {
printf("NTS: nts_make_cookie - Error from AES_SIV_Encrypt\n");
@@ -310,69 +310,69 @@ static void DoMakeCrypto(
used += left;
INSIST(used <= NTS_MAX_COOKIELEN);
- cookielength = used;
+ cookielength = used;
- fast = (stop.tv_sec-start.tv_sec)*1E9 + (stop.tv_nsec-start.tv_nsec);
- printf("%12s %2d %4d %6.0f %7.3f",
- name, keylen, cookielength, fast/samplesize, fast/1E9);
- printf("\n");
+ fast = (stop.tv_sec-start.tv_sec)*1E9 + (stop.tv_nsec-start.tv_nsec);
+ printf("%12s %2d %4d %6.0f %7.3f",
+ name, keylen, cookielength, fast/samplesize, fast/1E9);
+ printf("\n");
}
int main(int argc, char *argv[])
{
- char *ctimetxt;
- time_t now;
- char buff[256];
+ char *ctimetxt;
+ time_t now;
+ char buff[256];
- UNUSED_ARG(argc);
- UNUSED_ARG(argv);
+ UNUSED_ARG(argc);
+ UNUSED_ARG(argv);
- setlinebuf(stdout);
+ setlinebuf(stdout);
- ssl_init();
+ ssl_init();
ntp_RAND_bytes(key_K, NTS_MAX_KEYLEN);
- now = time(NULL);
- ctimetxt = ctime(&now);
- ctimetxt[24] = 0; /* Hack: smash return */
- gethostname(buff, sizeof(buff));
- printf("# %s on %s\n", ctimetxt, buff);
- printf("# %s\n", OPENSSL_VERSION_TEXT);
+ now = time(NULL);
+ ctimetxt = ctime(&now);
+ ctimetxt[24] = 0; // Hack: smash return
+ gethostname(buff, sizeof(buff));
+ printf("# %s on %s\n", ctimetxt, buff);
+ printf("# %s\n", OPENSSL_VERSION_TEXT);
- printf("\n");
- printf("# bytes ns/op sec/run\n");
- DoLock();
- DoNonce();
+ printf("\n");
+ printf("# bytes ns/op sec/run\n");
+ DoLock();
+ DoNonce();
- printf("\n");
- printf("# wKL=sizeof(c2s), CL=sizeof(cookie)\n");
- printf("# Make cookie wKL CL ns/op sec/run\n");
+ printf("\n");
+ printf("# wKL=sizeof(c2s), CL=sizeof(cookie)\n");
+ printf("# Make cookie wKL CL ns/op sec/run\n");
// Sample numbers using old cmac.h
// run on a Dell 9020/MT with Intel i7-4790 @ 3.60GHz
- /* 3rd arg is length of c2s and s2c */
- DoMakeCookie("AES_SIV_CMAC_256", AEAD_AES_SIV_CMAC_256, 32);
- DoMakeCookie("AES_SIV_CMAC_256", AEAD_AES_SIV_CMAC_256, 48);
- DoMakeCookie("AES_SIV_CMAC_256", AEAD_AES_SIV_CMAC_256, 64);
+ // 3rd arg is length of c2s and s2c
+ DoMakeCookie("AES_SIV_CMAC_256", AEAD_AES_SIV_CMAC_256, 32);
+ DoMakeCookie("AES_SIV_CMAC_256", AEAD_AES_SIV_CMAC_256, 48);
+ DoMakeCookie("AES_SIV_CMAC_256", AEAD_AES_SIV_CMAC_256, 64);
// AES_SIV_CMAC_256 32 104 3127 3.127
// AES_SIV_CMAC_256 48 136 3186 3.186
// AES_SIV_CMAC_256 64 168 3220 3.220
- DoMakeCookie("AES_SIV_CMAC_512", AEAD_AES_SIV_CMAC_512, 32);
- DoMakeCookie("AES_SIV_CMAC_512", AEAD_AES_SIV_CMAC_512, 48);
- DoMakeCookie("AES_SIV_CMAC_512", AEAD_AES_SIV_CMAC_512, 64);
+ DoMakeCookie("AES_SIV_CMAC_512", AEAD_AES_SIV_CMAC_512, 32);
+ DoMakeCookie("AES_SIV_CMAC_512", AEAD_AES_SIV_CMAC_512, 48);
+ DoMakeCookie("AES_SIV_CMAC_512", AEAD_AES_SIV_CMAC_512, 64);
// AES_SIV_CMAC_512 32 104 3183 3.183
// AES_SIV_CMAC_512 48 136 3247 3.247
// AES_SIV_CMAC_512 64 168 3303 3.303
- printf("\n");
+ printf("\n");
- printf("# Cookie Crypto wKL CL ns/op sec/run\n");
- DoMakeCrypto("AES_SIV_CMAC_256", AEAD_AES_SIV_CMAC_256, 32);
- DoMakeCrypto("AES_SIV_CMAC_256", AEAD_AES_SIV_CMAC_256, 48);
- DoMakeCrypto("AES_SIV_CMAC_256", AEAD_AES_SIV_CMAC_256, 64);
+ printf("# Cookie Crypto wKL CL ns/op sec/run\n");
+ DoMakeCrypto("AES_SIV_CMAC_256", AEAD_AES_SIV_CMAC_256, 32);
+ DoMakeCrypto("AES_SIV_CMAC_256", AEAD_AES_SIV_CMAC_256, 48);
+ DoMakeCrypto("AES_SIV_CMAC_256", AEAD_AES_SIV_CMAC_256, 64);
// AES_SIV_CMAC_256 32 104 2066 2.066
// AES_SIV_CMAC_256 48 136 2119 2.119
// AES_SIV_CMAC_256 64 168 2157 2.157
- return 0;
+ return 0;
}
=====================================
ntpd/nts_client.c
=====================================
@@ -52,218 +52,218 @@ bool nts_server_lookup(char *server, sockaddr_u *addr, int af);
static SSL_CTX *client_ctx = NULL;
-/* Ugly global variables passed from worker thread back to main thread. */
+// Ugly global variables passed from worker thread back to main thread.
static sockaddr_u sockaddr;
static bool addrOK;
bool nts_client_init(void) {
- client_ctx = make_ssl_client_ctx(ntsconfig.ca);
+ client_ctx = make_ssl_client_ctx(ntsconfig.ca);
-/* Ugly global variables passed from worker thread back to main thread. */
- return true;
+// Ugly global variables passed from worker thread back to main thread.
+ return true;
}
bool nts_probe(struct peer * peer) {
- struct timeval timeout = {.tv_sec = NTS_KE_TIMEOUT, .tv_usec = 0};
- const char *hostname = peer->hostname;
- char hostbuf[100];
- char errbuf[100];
- SSL *ssl;
- int server;
- struct timespec start, finish;
- int err;
-
- if (NULL == client_ctx)
- return false;
-
- addrOK = false;
- clock_gettime(CLOCK_MONOTONIC, &start);
-
- if (NULL == hostname) {
- /* IP Address case */
- int af = AF(&peer->srcadr);
- switch (af) {
- case AF_INET:
- inet_ntop(af, PSOCK_ADDR4(&peer->srcadr), hostbuf, sizeof(hostbuf));
- break;
- case AF_INET6:
- /* Add [] in case [xxx]:port */
- hostbuf[0] = '[';
- inet_ntop(af, PSOCK_ADDR6(&peer->srcadr), hostbuf+1, sizeof(hostbuf)-1);
- strlcat(hostbuf, "]", sizeof(hostbuf));
- break;
- default:
- return false;
- }
- hostname = hostbuf;
-// msyslog(LOG_INFO, "NTSc: Address Literal: %s", hostbuf);
- }
-
- server = open_TCP_socket(peer, hostname);
- if (-1 == server) {
- ntske_cnt.probes_bad++;
- return false;
- }
-
- err = setsockopt(server, SOL_SOCKET, SO_RCVTIMEO, &timeout, sizeof(timeout));
- if (0 > err) {
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- msyslog(LOG_ERR, "NTSc: can't set recv timeout: %s", errbuf);
- close(server);
- ntske_cnt.probes_bad++;
- return false;
- }
- err = setsockopt(server, SOL_SOCKET, SO_SNDTIMEO, &timeout, sizeof(timeout));
- if (0 > err) {
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- msyslog(LOG_ERR, "NTSc: can't set send timeout: %s", errbuf);
- close(server);
- ntske_cnt.probes_bad++;
- return false;
- }
-
- if (NULL == peer->cfg.nts_cfg.ca)
- ssl = SSL_new(client_ctx);
- else {
- SSL_CTX *ctx;
- ctx = make_ssl_client_ctx(peer->cfg.nts_cfg.ca);
- if (NULL == ctx) {
- close(server);
- return false;
- }
- ssl = SSL_new(ctx);
- SSL_CTX_free(ctx);
- }
- if (NULL == ssl) {
- msyslog(LOG_ERR, "NTSc: SSL_new failed");
- nts_log_ssl_error();
- close(server);
- ntske_cnt.probes_bad++;
- return false;
- }
- set_hostname(ssl, hostname);
- SSL_set_fd(ssl, server);
-
- if (1 != SSL_connect(ssl)) {
- msyslog(LOG_INFO, "NTSc: SSL_connect failed");
- nts_log_ssl_error();
- goto bail;
- }
- if (1 != SSL_do_handshake(ssl)) {
- msyslog(LOG_INFO, "NTSc: SSL_do_handshake failed");
- nts_log_ssl_error();
- goto bail;
- }
-
- /* This may be clutter, but this is how to do it. */
- msyslog(LOG_INFO, "NTSc: Using %s, %s (%d)",
- SSL_get_version(ssl),
- SSL_get_cipher_name(ssl),
- SSL_get_cipher_bits(ssl, NULL));
-
- if (!check_certificate(ssl, peer))
- goto bail;
- if (!check_alpn(ssl, peer, hostname))
- goto bail;
-
- if (!nts_client_send_request(ssl, peer))
- goto bail;
- if (!nts_client_process_response(ssl, peer))
- goto bail;
-
- /* We are using AEAD_AES_SIV_CMAC_xxx, from RFC 5297
- * key length depends upon which key is selected */
- peer->nts_state.keylen = nts_get_key_length(peer->nts_state.aead);
- if (0 == peer->nts_state.keylen) {
- msyslog(LOG_ERR, "NTSc: Unknown AEAD code: %d", peer->nts_state.aead);
- goto bail;
- }
- if (!nts_make_keys(ssl,
- peer->nts_state.aead,
- peer->nts_state.c2s,
- peer->nts_state.s2c,
- peer->nts_state.keylen))
- goto bail;
-
- addrOK = true;
- ntske_cnt.probes_good++;
+ struct timeval timeout = {.tv_sec = NTS_KE_TIMEOUT, .tv_usec = 0};
+ const char *hostname = peer->hostname;
+ char hostbuf[100];
+ char errbuf[100];
+ SSL *ssl;
+ int server;
+ struct timespec start, finish;
+ int err;
+
+ if (NULL == client_ctx)
+ return false;
+
+ addrOK = false;
+ clock_gettime(CLOCK_MONOTONIC, &start);
+
+ if (NULL == hostname) {
+ // IP Address case
+ int af = AF(&peer->srcadr);
+ switch (af) {
+ case AF_INET:
+ inet_ntop(af, PSOCK_ADDR4(&peer->srcadr), hostbuf, sizeof(hostbuf));
+ break;
+ case AF_INET6:
+ // Add [] in case [xxx]:port
+ hostbuf[0] = '[';
+ inet_ntop(af, PSOCK_ADDR6(&peer->srcadr), hostbuf+1, sizeof(hostbuf)-1);
+ strlcat(hostbuf, "]", sizeof(hostbuf));
+ break;
+ default:
+ return false;
+ }
+ hostname = hostbuf;
+// msyslog(LOG_INFO, "NTSc: Address Literal: %s", hostbuf);
+ }
+
+ server = open_TCP_socket(peer, hostname);
+ if (-1 == server) {
+ ntske_cnt.probes_bad++;
+ return false;
+ }
+
+ err = setsockopt(server, SOL_SOCKET, SO_RCVTIMEO, &timeout, sizeof(timeout));
+ if (0 > err) {
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ msyslog(LOG_ERR, "NTSc: can't set recv timeout: %s", errbuf);
+ close(server);
+ ntske_cnt.probes_bad++;
+ return false;
+ }
+ err = setsockopt(server, SOL_SOCKET, SO_SNDTIMEO, &timeout, sizeof(timeout));
+ if (0 > err) {
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ msyslog(LOG_ERR, "NTSc: can't set send timeout: %s", errbuf);
+ close(server);
+ ntske_cnt.probes_bad++;
+ return false;
+ }
+
+ if (NULL == peer->cfg.nts_cfg.ca)
+ ssl = SSL_new(client_ctx);
+ else {
+ SSL_CTX *ctx;
+ ctx = make_ssl_client_ctx(peer->cfg.nts_cfg.ca);
+ if (NULL == ctx) {
+ close(server);
+ return false;
+ }
+ ssl = SSL_new(ctx);
+ SSL_CTX_free(ctx);
+ }
+ if (NULL == ssl) {
+ msyslog(LOG_ERR, "NTSc: SSL_new failed");
+ nts_log_ssl_error();
+ close(server);
+ ntske_cnt.probes_bad++;
+ return false;
+ }
+ set_hostname(ssl, hostname);
+ SSL_set_fd(ssl, server);
+
+ if (1 != SSL_connect(ssl)) {
+ msyslog(LOG_INFO, "NTSc: SSL_connect failed");
+ nts_log_ssl_error();
+ goto bail;
+ }
+ if (1 != SSL_do_handshake(ssl)) {
+ msyslog(LOG_INFO, "NTSc: SSL_do_handshake failed");
+ nts_log_ssl_error();
+ goto bail;
+ }
+
+ // This may be clutter, but this is how to do it.
+ msyslog(LOG_INFO, "NTSc: Using %s, %s (%d)",
+ SSL_get_version(ssl),
+ SSL_get_cipher_name(ssl),
+ SSL_get_cipher_bits(ssl, NULL));
+
+ if (!check_certificate(ssl, peer))
+ goto bail;
+ if (!check_alpn(ssl, peer, hostname))
+ goto bail;
+
+ if (!nts_client_send_request(ssl, peer))
+ goto bail;
+ if (!nts_client_process_response(ssl, peer))
+ goto bail;
+
+ /* We are using AEAD_AES_SIV_CMAC_xxx, from RFC 5297
+ * key length depends upon which key is selected */
+ peer->nts_state.keylen = nts_get_key_length(peer->nts_state.aead);
+ if (0 == peer->nts_state.keylen) {
+ msyslog(LOG_ERR, "NTSc: Unknown AEAD code: %d", peer->nts_state.aead);
+ goto bail;
+ }
+ if (!nts_make_keys(ssl,
+ peer->nts_state.aead,
+ peer->nts_state.c2s,
+ peer->nts_state.s2c,
+ peer->nts_state.keylen))
+ goto bail;
+
+ addrOK = true;
+ ntske_cnt.probes_good++;
bail:
- if (!addrOK) {
- ntske_cnt.probes_bad++;
- peer->nts_state.count = -1;
- }
- SSL_shutdown(ssl);
- SSL_free(ssl);
- close(server);
-
- clock_gettime(CLOCK_MONOTONIC, &finish);
- finish = sub_tspec(finish, start);
- msyslog(LOG_INFO, "NTSc: NTS-KE req to %s took %.3f sec, %s",
- hostname, tspec_to_d(finish),
- addrOK? "OK" : "fail");
-
- return addrOK;
+ if (!addrOK) {
+ ntske_cnt.probes_bad++;
+ peer->nts_state.count = -1;
+ }
+ SSL_shutdown(ssl);
+ SSL_free(ssl);
+ close(server);
+
+ clock_gettime(CLOCK_MONOTONIC, &finish);
+ finish = sub_tspec(finish, start);
+ msyslog(LOG_INFO, "NTSc: NTS-KE req to %s took %.3f sec, %s",
+ hostname, tspec_to_d(finish),
+ addrOK? "OK" : "fail");
+
+ return addrOK;
}
bool nts_check(struct peer *peer) {
- if (0) {
- char errbuf[100];
- sockporttoa_r(&sockaddr, errbuf, sizeof(errbuf));
- msyslog(LOG_INFO, "NTSc: nts_check %s, %d", errbuf, addrOK);
- }
- if (addrOK) {
- if (peer->cast_flags & MDF_POOL) {
- dns_take_pool(peer, &sockaddr);
- dns_take_status(peer, DNS_NTS_pool);
- } else {
- dns_take_server(peer, &sockaddr);
- dns_take_status(peer, DNS_good);
- }
- } else
- dns_take_status(peer, DNS_error);
- return addrOK;
+ if (0) {
+ char errbuf[100];
+ sockporttoa_r(&sockaddr, errbuf, sizeof(errbuf));
+ msyslog(LOG_INFO, "NTSc: nts_check %s, %d", errbuf, addrOK);
+ }
+ if (addrOK) {
+ if (peer->cast_flags & MDF_POOL) {
+ dns_take_pool(peer, &sockaddr);
+ dns_take_status(peer, DNS_NTS_pool);
+ } else {
+ dns_take_server(peer, &sockaddr);
+ dns_take_status(peer, DNS_good);
+ }
+ } else
+ dns_take_status(peer, DNS_error);
+ return addrOK;
}
SSL_CTX* make_ssl_client_ctx(const char * filename) {
- bool ok = true;
- SSL_CTX *ctx;
-
- ctx = SSL_CTX_new(TLS_client_method());
- if (NULL == ctx) {
- /* Happens if no ciphers */
- msyslog(LOG_ERR, "NTSc: NULL ctx");
- nts_log_ssl_error();
- return NULL;
- }
-
- {
- // 4., ALPN, RFC 7301
- static unsigned char alpn [] = { 7, 'n', 't', 's', 'k', 'e', '/', '1' };
- SSL_CTX_set_alpn_protos(ctx, alpn, sizeof(alpn));
- }
-
- SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);
- SSL_CTX_set_timeout(ctx, NTS_KE_TIMEOUT); /* session lifetime */
-
- ok &= nts_load_versions(ctx);
- ok &= nts_load_ciphers(ctx);
- ok &= nts_load_ecdhcurves(ctx);
- ok &= nts_set_cert_search(ctx, filename);
-
- if (!ok) {
- msyslog(LOG_ERR, "NTSc: Troubles setting up client SSL CTX");
- SSL_CTX_free(ctx);
- return NULL;
- };
-
- return ctx;
+ bool ok = true;
+ SSL_CTX *ctx;
+
+ ctx = SSL_CTX_new(TLS_client_method());
+ if (NULL == ctx) {
+ // Happens if no ciphers
+ msyslog(LOG_ERR, "NTSc: NULL ctx");
+ nts_log_ssl_error();
+ return NULL;
+ }
+
+ {
+ // 4., ALPN, RFC 7301
+ static unsigned char alpn [] = { 7, 'n', 't', 's', 'k', 'e', '/', '1' };
+ SSL_CTX_set_alpn_protos(ctx, alpn, sizeof(alpn));
+ }
+
+ SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);
+ SSL_CTX_set_timeout(ctx, NTS_KE_TIMEOUT); // session lifetime
+
+ ok &= nts_load_versions(ctx);
+ ok &= nts_load_ciphers(ctx);
+ ok &= nts_load_ecdhcurves(ctx);
+ ok &= nts_set_cert_search(ctx, filename);
+
+ if (!ok) {
+ msyslog(LOG_ERR, "NTSc: Troubles setting up client SSL CTX");
+ SSL_CTX_free(ctx);
+ return NULL;
+ };
+
+ return ctx;
}
-/* FIXME - split out DNS work. */
+// FIXME - split out DNS work.
/* Note that there are 2 DNS lookups.
* One for the NTS-KE server and another for the NTP server.
@@ -279,129 +279,129 @@ SSL_CTX* make_ssl_client_ctx(const char * filename) {
* for most servers.
*/
-/* return -1 on error */
+// return -1 on error
int open_TCP_socket(struct peer *peer, const char *hostname) {
- char host[256], port[32];
- char errbuf[100];
- char *tmp;
- struct addrinfo hints;
- struct addrinfo *answer, *worker;
- int gai_rc;
- int sockfd;
- struct timespec start, finish;
-
- /* FIXME -- const bug in OpenSSL */
- strlcpy(host, hostname, sizeof(host));
-
- /* handle xxx:port case */
- if ('[' == host[0]) {
- /* IPv6 case, drop [], start search after ] */
- SET_AF(&peer->srcadr, AF_INET6);
- strlcpy(host, hostname+1, sizeof(host));
- tmp = strchr(host, ']');
- if (NULL == tmp) {
- msyslog(LOG_ERR, "NTSc: open_TCP_socket: missing ']': %s",
- hostname);
- return -1;
- }
- *tmp++ = 0;
- /* We have chopped off the [] around the host literal.
- * There should be nothing left or :<port> */
- if ((0 != *tmp) && (':' != *tmp)) {
- msyslog(LOG_ERR, "NTSc: open_TCP_socket: missing ':': %s",
- hostname);
- return -1;
- }
- if (0 == *tmp) tmp = NULL; /* no : */
- } else {
- tmp = strchr(host, ':');
- }
- if (NULL == tmp) {
- /* simple case, no : */
- strlcpy(port, NTS_KE_PORTA, sizeof(port));
- } else {
- /* Complicated case, found a : */
- *tmp++ = 0;
- strlcpy(port, tmp, sizeof(port));
- msyslog(LOG_INFO, "NTSc: open_TCP_socket: found port %s", port);
- }
-
- ZERO(hints);
- hints.ai_protocol = IPPROTO_TCP;
- hints.ai_socktype = SOCK_STREAM;
- hints.ai_family = AF(&peer->srcadr); /* -4, -6 switch */
- clock_gettime(CLOCK_MONOTONIC, &start);
- gai_rc = getaddrinfo(host, port, &hints, &answer);
- if (0 != gai_rc) {
- msyslog(LOG_INFO, "NTSc: open_TCP_socket: DNS error trying to contact %s, %d, %s",
- hostname, gai_rc, gai_strerror(gai_rc));
- return -1;
- }
- clock_gettime(CLOCK_MONOTONIC, &finish);
- finish = sub_tspec(finish, start);
- msyslog(LOG_INFO, "NTSc: DNS lookup of %s (%d) took %.3f sec",
- hostname, hints.ai_family, tspec_to_d(finish));
-
- /* sockaddr is global for NTP address
- * also use as temp for printing here */
- if (NULL == peer->hostname) {
- /* Address literal case, use first/only answer */
- worker = answer;
- } else {
- worker = find_best_addr(answer);
- if (NULL == worker) {
- msyslog(LOG_INFO, "NTSc: All addresses in use.");
- freeaddrinfo(answer);
- return -1;
- }
- }
- memcpy(&sockaddr, worker->ai_addr, worker->ai_addrlen);
- sockporttoa_r(&sockaddr, errbuf, sizeof(errbuf));
- msyslog(LOG_INFO, "NTSc: connecting to %s+%s => %s",
- host, port, errbuf);
-
- /* setup default NTP port now
- * in case of server-name:port later on
- */
- SET_PORT(&sockaddr, NTP_PORT);
- sockfd = socket(worker->ai_family, SOCK_STREAM, 0);
- if (-1 == sockfd) {
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- msyslog(LOG_INFO, "NTSc: open_TCP_socket: no socket: %s", errbuf);
- } else {
- if (!connect_TCP_socket(sockfd, worker)) {
- close(sockfd);
- sockfd = -1;
- }
- }
-
- freeaddrinfo(answer);
- return sockfd;
+ char host[256], port[32];
+ char errbuf[100];
+ char *tmp;
+ struct addrinfo hints;
+ struct addrinfo *answer, *worker;
+ int gai_rc;
+ int sockfd;
+ struct timespec start, finish;
+
+ // FIXME -- const bug in OpenSSL
+ strlcpy(host, hostname, sizeof(host));
+
+ // handle xxx:port case
+ if ('[' == host[0]) {
+ // IPv6 case, drop [], start search after ]
+ SET_AF(&peer->srcadr, AF_INET6);
+ strlcpy(host, hostname+1, sizeof(host));
+ tmp = strchr(host, ']');
+ if (NULL == tmp) {
+ msyslog(LOG_ERR, "NTSc: open_TCP_socket: missing ']': %s",
+ hostname);
+ return -1;
+ }
+ *tmp++ = 0;
+ /* We have chopped off the [] around the host literal.
+ * There should be nothing left or :<port> */
+ if ((0 != *tmp) && (':' != *tmp)) {
+ msyslog(LOG_ERR, "NTSc: open_TCP_socket: missing ':': %s",
+ hostname);
+ return -1;
+ }
+ if (0 == *tmp) tmp = NULL; // no :
+ } else {
+ tmp = strchr(host, ':');
+ }
+ if (NULL == tmp) {
+ // simple case, no :
+ strlcpy(port, NTS_KE_PORTA, sizeof(port));
+ } else {
+ // Complicated case, found a :
+ *tmp++ = 0;
+ strlcpy(port, tmp, sizeof(port));
+ msyslog(LOG_INFO, "NTSc: open_TCP_socket: found port %s", port);
+ }
+
+ ZERO(hints);
+ hints.ai_protocol = IPPROTO_TCP;
+ hints.ai_socktype = SOCK_STREAM;
+ hints.ai_family = AF(&peer->srcadr); // -4, -6 switch
+ clock_gettime(CLOCK_MONOTONIC, &start);
+ gai_rc = getaddrinfo(host, port, &hints, &answer);
+ if (0 != gai_rc) {
+ msyslog(LOG_INFO, "NTSc: open_TCP_socket: DNS error trying to contact %s, %d, %s",
+ hostname, gai_rc, gai_strerror(gai_rc));
+ return -1;
+ }
+ clock_gettime(CLOCK_MONOTONIC, &finish);
+ finish = sub_tspec(finish, start);
+ msyslog(LOG_INFO, "NTSc: DNS lookup of %s (%d) took %.3f sec",
+ hostname, hints.ai_family, tspec_to_d(finish));
+
+ /* sockaddr is global for NTP address
+ * also use as temp for printing here */
+ if (NULL == peer->hostname) {
+ // Address literal case, use first/only answer
+ worker = answer;
+ } else {
+ worker = find_best_addr(answer);
+ if (NULL == worker) {
+ msyslog(LOG_INFO, "NTSc: All addresses in use.");
+ freeaddrinfo(answer);
+ return -1;
+ }
+ }
+ memcpy(&sockaddr, worker->ai_addr, worker->ai_addrlen);
+ sockporttoa_r(&sockaddr, errbuf, sizeof(errbuf));
+ msyslog(LOG_INFO, "NTSc: connecting to %s+%s => %s",
+ host, port, errbuf);
+
+ /* setup default NTP port now
+ * in case of server-name:port later on
+ */
+ SET_PORT(&sockaddr, NTP_PORT);
+ sockfd = socket(worker->ai_family, SOCK_STREAM, 0);
+ if (-1 == sockfd) {
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ msyslog(LOG_INFO, "NTSc: open_TCP_socket: no socket: %s", errbuf);
+ } else {
+ if (!connect_TCP_socket(sockfd, worker)) {
+ close(sockfd);
+ sockfd = -1;
+ }
+ }
+
+ freeaddrinfo(answer);
+ return sockfd;
}
struct addrinfo *find_best_addr(struct addrinfo *answer) {
- for ( ; NULL != answer; answer = answer->ai_next) {
- sockaddr_u addr;
- struct peer *pp;
- if (sizeof(sockaddr_u) < answer->ai_addrlen)
- continue; /* Weird */
- memcpy(&addr, answer->ai_addr, answer->ai_addrlen);
- /* findexistingpeer checks port too */
- for (pp = peer_list; NULL != pp; pp = pp->p_link) {
- if (MDF_POOL & pp->cast_flags) continue;
- if (FLAG_LOOKUP & pp->cfg.flags) continue;
- if (SOCK_EQ(&addr, &pp->srcadr)) break;
- }
- if (NULL != pp) {
- char errbuf[200];
- socktoa_r(&addr, errbuf, sizeof(errbuf));
- msyslog(LOG_INFO, "NTSc: Skipping %s", errbuf);
- continue; /* already in use */
- }
- break;
- }
- return(answer);
+ for ( ; NULL != answer; answer = answer->ai_next) {
+ sockaddr_u addr;
+ struct peer *pp;
+ if (sizeof(sockaddr_u) < answer->ai_addrlen)
+ continue; // Weird
+ memcpy(&addr, answer->ai_addr, answer->ai_addrlen);
+ // findexistingpeer checks port too
+ for (pp = peer_list; NULL != pp; pp = pp->p_link) {
+ if (MDF_POOL & pp->cast_flags) continue;
+ if (FLAG_LOOKUP & pp->cfg.flags) continue;
+ if (SOCK_EQ(&addr, &pp->srcadr)) break;
+ }
+ if (NULL != pp) {
+ char errbuf[200];
+ socktoa_r(&addr, errbuf, sizeof(errbuf));
+ msyslog(LOG_INFO, "NTSc: Skipping %s", errbuf);
+ continue; // already in use
+ }
+ break;
+ }
+ return(answer);
}
@@ -411,108 +411,108 @@ struct addrinfo *find_best_addr(struct addrinfo *answer) {
* Use man 3 connect.
*/
bool connect_TCP_socket(int sockfd, struct addrinfo *addr) {
- char errbuf[100];
- int err;
- fd_set fdset;
- struct timeval timeout;
- int so_error;
- socklen_t so_len = sizeof(so_error);
-
- err = fcntl(sockfd, F_SETFL, O_NONBLOCK);
- if (-1 == err) {
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- msyslog(LOG_INFO, "NTSc: can't set O_NONBLOCK %s", errbuf);
- return false;
- }
- err = connect(sockfd, addr->ai_addr, addr->ai_addrlen);
- /* The usual nonblocking case is -1 and errno == EINPROGRESS.
- * A fast local connection can also succeed immediately.
- * Getting connected should be possible if the scheduler
- * avoids us for long enough.
- * Other errors may be possible. No route?
- * I haven't seen that yet. HGM, 2020 Jan 19
- */
- if (-1 == err && EINPROGRESS != errno) {
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- msyslog(LOG_INFO, "NTSc: connect_TCP_socket: connect failed: %s", errbuf);
- return false;
- }
-
- if (-1 == err) {
- FD_ZERO(&fdset);
- FD_SET(sockfd, &fdset);
- timeout.tv_sec = NTS_KE_TIMEOUT;
- timeout.tv_usec = 0;
-
- if (0 == select(sockfd + 1, NULL, &fdset, NULL, &timeout)) {
- msyslog(LOG_INFO, "NTSc: connect_TCP_socket: timeout");
- return false;
- }
-
- /* It's ready, either connected or error. */
- if (-1 == getsockopt(sockfd, SOL_SOCKET, SO_ERROR, &so_error, &so_len)) {
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- msyslog(LOG_INFO, "NTSc: connect_TCP_socket: getsockopt failed: %s", errbuf);
- return false;
- }
-
- if (0 != so_error) {
- ntp_strerror_r(so_error, errbuf, sizeof(errbuf));
- msyslog(LOG_INFO, "NTSc: connect_TCP_socket: connect failed: %s", errbuf);
- return false;
- }
- }
-
- err = fcntl(sockfd, F_SETFL, 0); /* turn off O_NONBLOCK */
- if (-1 == err) {
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- msyslog(LOG_INFO, "NTSc: can't unset O_NONBLOCK %s", errbuf);
- return false;
- }
-
- return true;
+ char errbuf[100];
+ int err;
+ fd_set fdset;
+ struct timeval timeout;
+ int so_error;
+ socklen_t so_len = sizeof(so_error);
+
+ err = fcntl(sockfd, F_SETFL, O_NONBLOCK);
+ if (-1 == err) {
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ msyslog(LOG_INFO, "NTSc: can't set O_NONBLOCK %s", errbuf);
+ return false;
+ }
+ err = connect(sockfd, addr->ai_addr, addr->ai_addrlen);
+ /* The usual nonblocking case is -1 and errno == EINPROGRESS.
+ * A fast local connection can also succeed immediately.
+ * Getting connected should be possible if the scheduler
+ * avoids us for long enough.
+ * Other errors may be possible. No route?
+ * I haven't seen that yet. HGM, 2020 Jan 19
+ */
+ if (-1 == err && EINPROGRESS != errno) {
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ msyslog(LOG_INFO, "NTSc: connect_TCP_socket: connect failed: %s", errbuf);
+ return false;
+ }
+
+ if (-1 == err) {
+ FD_ZERO(&fdset);
+ FD_SET(sockfd, &fdset);
+ timeout.tv_sec = NTS_KE_TIMEOUT;
+ timeout.tv_usec = 0;
+
+ if (0 == select(sockfd + 1, NULL, &fdset, NULL, &timeout)) {
+ msyslog(LOG_INFO, "NTSc: connect_TCP_socket: timeout");
+ return false;
+ }
+
+ // It's ready, either connected or error.
+ if (-1 == getsockopt(sockfd, SOL_SOCKET, SO_ERROR, &so_error, &so_len)) {
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ msyslog(LOG_INFO, "NTSc: connect_TCP_socket: getsockopt failed: %s", errbuf);
+ return false;
+ }
+
+ if (0 != so_error) {
+ ntp_strerror_r(so_error, errbuf, sizeof(errbuf));
+ msyslog(LOG_INFO, "NTSc: connect_TCP_socket: connect failed: %s", errbuf);
+ return false;
+ }
+ }
+
+ err = fcntl(sockfd, F_SETFL, 0); // turn off O_NONBLOCK
+ if (-1 == err) {
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ msyslog(LOG_INFO, "NTSc: can't unset O_NONBLOCK %s", errbuf);
+ return false;
+ }
+
+ return true;
}
void set_hostname(SSL *ssl, const char *hostname) {
- char host[256], *tmp;
-
- /* chop off [] and trailing :port */
- strlcpy(host, hostname, sizeof(host));
- if ('[' == host[0]) {
- /* IPv6 literal, [...] format */
- strlcpy(host, hostname+1, sizeof(host));
- tmp = strchr(host, ']');
- if (NULL != tmp) *tmp = 0;
- } else {
- /* not IPv6 [...] format */
- tmp = strchr(host, ':');
- if (NULL != tmp) {
- *tmp = 0;
- }
- }
+ char host[256], *tmp;
+
+ // chop off [] and trailing :port
+ strlcpy(host, hostname, sizeof(host));
+ if ('[' == host[0]) {
+ // IPv6 literal, [...] format
+ strlcpy(host, hostname+1, sizeof(host));
+ tmp = strchr(host, ']');
+ if (NULL != tmp) *tmp = 0;
+ } else {
+ // not IPv6 [...] format
+ tmp = strchr(host, ':');
+ if (NULL != tmp) {
+ *tmp = 0;
+ }
+ }
/* https://wiki.openssl.org/index.php/Hostname_validation
* draft-ietf-uta-rfc6125bis section 3 relaxes the restrictions around the use
* of wildcards to make it clear that they're permitted unless specifically
* prohibited in an RFC
*/
- SSL_set_hostflags(ssl, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
+ SSL_set_hostflags(ssl, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
#if OPENSSL_VERSION_NUMBER >= 0x40000000L
{
- sockaddr_u addr;
- if (is_ip_address(host, AF_UNSPEC, &addr))
- SSL_set1_ipaddr(ssl, host);
- else {
- SSL_set1_dnsname(ssl, host);
- SSL_set_tlsext_host_name(ssl, host);
- }
+ sockaddr_u addr;
+ if (is_ip_address(host, AF_UNSPEC, &addr))
+ SSL_set1_ipaddr(ssl, host);
+ else {
+ SSL_set1_dnsname(ssl, host);
+ SSL_set_tlsext_host_name(ssl, host);
+ }
}
#else
- SSL_set1_host(ssl, host); /* DEPRECATED in OpenSSL 4.0 */
- SSL_set_tlsext_host_name(ssl, host);
+ SSL_set1_host(ssl, host); // DEPRECATED in OpenSSL 4.0
+ SSL_set_tlsext_host_name(ssl, host);
#endif
- msyslog(LOG_DEBUG, "NTSc: set cert host: %s", host);
+ msyslog(LOG_DEBUG, "NTSc: set cert host: %s", host);
}
@@ -521,394 +521,394 @@ void set_hostname(SSL *ssl, const char *hostname) {
// DNS:*.time.nl, DNS:time.nl
bool check_certificate(SSL *ssl, struct peer* peer) {
- X509 *cert = SSL_get_peer_certificate(ssl);
- const X509_NAME *certname;
- GENERAL_NAMES *gens;
- char name[200];
- int certok;
- int numgens = 0;
-
- if (NULL == cert) {
- msyslog(LOG_INFO, "NTSc: No certificate");
- if (!(FLAG_NTS_NOVAL & peer->cfg.flags))
- return false;
- return true;
- }
-
- certname = X509_get_subject_name(cert);
- X509_NAME_oneline(certname, name, sizeof(name));
- msyslog(LOG_INFO, "NTSc: certificate subject name: %s", name);
- certname = X509_get_issuer_name(cert);
- X509_NAME_oneline(certname, name, sizeof(name));
- msyslog(LOG_INFO, "NTSc: certificate issuer name: %s", name);
- /* print SAN:DNS strings */
- gens = X509_get_ext_d2i(cert, NID_subject_alt_name, 0, 0);
- if (gens) {
- char buff[150];
- numgens = sk_GENERAL_NAME_num(gens);
- buff[0] = 0;
- for (int i = 0; i<numgens; i++) {
- const GENERAL_NAME *gen;
- const char *dnsname;
- unsigned int len;
- gen = sk_GENERAL_NAME_value(gens, i);
- if (gen->type != GEN_DNS)
- continue;
- // string is NUL terminated but may have internal NULs
- len = (unsigned int)ASN1_STRING_length(gen->d.ia5);
- dnsname = (const char *)ASN1_STRING_get0_data(gen->d.ia5);
- if (0 != buff[0])
- strlcat(buff, ", ", sizeof(buff));
- strlcat(buff, dnsname, sizeof(buff));
- if (len != strlen(dnsname))
- strlcat(buff, "??", sizeof(buff));
- }
- msyslog(LOG_INFO, "NTSc: SAN:DNS %s", buff);
- GENERAL_NAMES_free(gens);
- }
- if (0 == numgens) {
- const char *peername = SSL_get0_peername(ssl);
- msyslog(LOG_INFO, "NTSc: matching with subject:CN %s", peername);
- } else if (1 > numgens) {
- const char *peername = SSL_get0_peername(ssl);
- msyslog(LOG_INFO, "NTSc: matching with SAN:DNS: %s", peername);
- }
- X509_free(cert);
- certok = SSL_get_verify_result(ssl);
- if (X509_V_OK == certok) {
- msyslog(LOG_INFO, "NTSc: certificate is valid.");
- } else {
- msyslog(LOG_ERR, "NTSc: certificate invalid: %d=>%s",
- certok, X509_verify_cert_error_string(certok));
- if (FLAG_NTS_NOVAL & peer->cfg.flags) {
- msyslog(LOG_INFO, "NTSc: noval - accepting invalid cert.");
- return true;
- }
- return false;
- }
- return true;
+ X509 *cert = SSL_get_peer_certificate(ssl);
+ const X509_NAME *certname;
+ GENERAL_NAMES *gens;
+ char name[200];
+ int certok;
+ int numgens = 0;
+
+ if (NULL == cert) {
+ msyslog(LOG_INFO, "NTSc: No certificate");
+ if (!(FLAG_NTS_NOVAL & peer->cfg.flags))
+ return false;
+ return true;
+ }
+
+ certname = X509_get_subject_name(cert);
+ X509_NAME_oneline(certname, name, sizeof(name));
+ msyslog(LOG_INFO, "NTSc: certificate subject name: %s", name);
+ certname = X509_get_issuer_name(cert);
+ X509_NAME_oneline(certname, name, sizeof(name));
+ msyslog(LOG_INFO, "NTSc: certificate issuer name: %s", name);
+ // print SAN:DNS strings
+ gens = X509_get_ext_d2i(cert, NID_subject_alt_name, 0, 0);
+ if (gens) {
+ char buff[150];
+ numgens = sk_GENERAL_NAME_num(gens);
+ buff[0] = 0;
+ for (int i = 0; i<numgens; i++) {
+ const GENERAL_NAME *gen;
+ const char *dnsname;
+ unsigned int len;
+ gen = sk_GENERAL_NAME_value(gens, i);
+ if (gen->type != GEN_DNS)
+ continue;
+ // string is NUL terminated but may have internal NULs
+ len = (unsigned int)ASN1_STRING_length(gen->d.ia5);
+ dnsname = (const char *)ASN1_STRING_get0_data(gen->d.ia5);
+ if (0 != buff[0])
+ strlcat(buff, ", ", sizeof(buff));
+ strlcat(buff, dnsname, sizeof(buff));
+ if (len != strlen(dnsname))
+ strlcat(buff, "??", sizeof(buff));
+ }
+ msyslog(LOG_INFO, "NTSc: SAN:DNS %s", buff);
+ GENERAL_NAMES_free(gens);
+ }
+ if (0 == numgens) {
+ const char *peername = SSL_get0_peername(ssl);
+ msyslog(LOG_INFO, "NTSc: matching with subject:CN %s", peername);
+ } else if (1 > numgens) {
+ const char *peername = SSL_get0_peername(ssl);
+ msyslog(LOG_INFO, "NTSc: matching with SAN:DNS: %s", peername);
+ }
+ X509_free(cert);
+ certok = SSL_get_verify_result(ssl);
+ if (X509_V_OK == certok) {
+ msyslog(LOG_INFO, "NTSc: certificate is valid.");
+ } else {
+ msyslog(LOG_ERR, "NTSc: certificate invalid: %d=>%s",
+ certok, X509_verify_cert_error_string(certok));
+ if (FLAG_NTS_NOVAL & peer->cfg.flags) {
+ msyslog(LOG_INFO, "NTSc: noval - accepting invalid cert.");
+ return true;
+ }
+ return false;
+ }
+ return true;
}
bool check_alpn(SSL *ssl, struct peer* peer, const char *hostname) {
- UNUSED_ARG(peer);
- const unsigned char *data;
- unsigned int len;
- SSL_get0_alpn_selected(ssl, &data, &len);
- if (0 == len) {
- msyslog(LOG_DEBUG, "NTSc: No ALPN from %s (%s)",
- hostname, SSL_get_version(ssl));
- return false;
- }
- /* For now, we only support one version.
- * This will get more complicated when version 2 arrives. */
- if (len != 7 ||
- 0 != memcmp(data, "ntske/1", len)) {
- /* copy data over so we can print it. */
- /* don't read past end of data */
- unsigned int i, l;
- char buff [16];
- l = min(len, sizeof(buff)-1);
- memcpy(buff, data, l);
- buff[l] = '\0';
- for (i=0; i<l; i++) {
- if (!isgraph((int)buff[i])) {
- buff[i] = '*'; /* fix non-printing crap */
- }
- }
- msyslog(LOG_DEBUG, "NTSc: Strange ALPN %s (%u) from %s",
- buff, len, hostname);
- return false;
- }
- msyslog(LOG_DEBUG, "NTSc: Good ALPN from %s", hostname);
-
- return true;
+ UNUSED_ARG(peer);
+ const unsigned char *data;
+ unsigned int len;
+ SSL_get0_alpn_selected(ssl, &data, &len);
+ if (0 == len) {
+ msyslog(LOG_DEBUG, "NTSc: No ALPN from %s (%s)",
+ hostname, SSL_get_version(ssl));
+ return false;
+ }
+ /* For now, we only support one version.
+ * This will get more complicated when version 2 arrives. */
+ if (len != 7 ||
+ 0 != memcmp(data, "ntske/1", len)) {
+ // copy data over so we can print it.
+ // don't read past end of data
+ unsigned int i, l;
+ char buff [16];
+ l = min(len, sizeof(buff)-1);
+ memcpy(buff, data, l);
+ buff[l] = '\0';
+ for (i=0; i<l; i++) {
+ if (!isgraph((int)buff[i])) {
+ buff[i] = '*'; // fix non-printing crap
+ }
+ }
+ msyslog(LOG_DEBUG, "NTSc: Strange ALPN %s (%u) from %s",
+ buff, len, hostname);
+ return false;
+ }
+ msyslog(LOG_DEBUG, "NTSc: Good ALPN from %s", hostname);
+
+ return true;
}
bool nts_make_keys(SSL *ssl, uint16_t aead, uint8_t *c2s, uint8_t *s2c, int keylen) {
- const char *label = "EXPORTER-network-time-security";
- unsigned char context[5];
- context[0] = (nts_protocol_NTP >> 8) & 0xFF;
- context[1] = nts_protocol_NTP & 0xFF;
- context[2] = (aead >> 8) & 0xFF;
- context[3] = aead & 0xFF;
- context[4] = 0x00;
- if (1 != SSL_export_keying_material(ssl, c2s, keylen,
- label, strlen(label),
- context, 5, 1)) {
- msyslog(LOG_ERR, "NTS: Error making c2s\n");
- nts_log_ssl_error();
- return false;
- }
- context[4] = 0x01;
- if (1 != SSL_export_keying_material(ssl, s2c, keylen,
- label, strlen(label),
- context, 5, 1)) {
- msyslog(LOG_ERR, "NTS: Error making s2c\n");
- nts_log_ssl_error();
- return false;
- }
- return true;
+ const char *label = "EXPORTER-network-time-security";
+ unsigned char context[5];
+ context[0] = (nts_protocol_NTP >> 8) & 0xFF;
+ context[1] = nts_protocol_NTP & 0xFF;
+ context[2] = (aead >> 8) & 0xFF;
+ context[3] = aead & 0xFF;
+ context[4] = 0x00;
+ if (1 != SSL_export_keying_material(ssl, c2s, keylen,
+ label, strlen(label),
+ context, 5, 1)) {
+ msyslog(LOG_ERR, "NTS: Error making c2s\n");
+ nts_log_ssl_error();
+ return false;
+ }
+ context[4] = 0x01;
+ if (1 != SSL_export_keying_material(ssl, s2c, keylen,
+ label, strlen(label),
+ context, 5, 1)) {
+ msyslog(LOG_ERR, "NTS: Error making s2c\n");
+ nts_log_ssl_error();
+ return false;
+ }
+ return true;
}
bool nts_client_send_request(SSL *ssl, struct peer* peer) {
- uint8_t buff[1000];
- int used, transferred;
- bool success;
- const char *errtxt = NULL;
+ uint8_t buff[1000];
+ int used, transferred;
+ bool success;
+ const char *errtxt = NULL;
- success = nts_client_send_request_core(buff, sizeof(buff), &used, peer);
- if (!success) {
- return false;
- }
+ success = nts_client_send_request_core(buff, sizeof(buff), &used, peer);
+ if (!success) {
+ return false;
+ }
- transferred = nts_ssl_write(ssl, buff, used, &errtxt);
- if (used != transferred)
- return false;
+ transferred = nts_ssl_write(ssl, buff, used, &errtxt);
+ if (used != transferred)
+ return false;
- return true;
+ return true;
}
bool nts_client_send_request_core(uint8_t *buff, int buf_size, int *used, struct peer* peer) {
- struct BufCtl_t buf;
- uint16_t aead = NO_AEAD;
-
- buf.next = buff;
- buf.left = buf_size;
-
- /* 4.1.2 Next Protocol, 0 for NTP */
- ke_append_record_uint16(&buf,
- NTS_CRITICAL+nts_next_protocol_negotiation, nts_protocol_NTP);
-
- /* 4.1.5 AEAD Algorithm List */
- // FIXME should be : separated list
-
- if ((NO_AEAD == aead) && (NULL != peer->cfg.nts_cfg.aead))
- aead = nts_string_to_aead(peer->cfg.nts_cfg.aead);
- if ((NO_AEAD == aead) && (NULL != ntsconfig.aead))
- aead = nts_string_to_aead(ntsconfig.aead);
- if (NO_AEAD == aead)
- aead = AEAD_AES_SIV_CMAC_256;
- ke_append_record_uint16(&buf, nts_algorithm_negotiation, aead);
-
- /* 4.1.1: End, Critical */
- ke_append_record_null(&buf, NTS_CRITICAL+nts_end_of_message);
-
- *used = buf_size-buf.left;
- if (*used >= (int)(buf_size - 10)) {
- msyslog(LOG_ERR, "ERR-NTSc: buffer overflow: %d, %ld",
- *used, (long)buf_size);
- exit(2);
- }
- return true;
+ struct BufCtl_t buf;
+ uint16_t aead = NO_AEAD;
+
+ buf.next = buff;
+ buf.left = buf_size;
+
+ // 4.1.2 Next Protocol, 0 for NTP
+ ke_append_record_uint16(&buf,
+ NTS_CRITICAL+nts_next_protocol_negotiation, nts_protocol_NTP);
+
+ // 4.1.5 AEAD Algorithm List
+ // FIXME should be : separated list
+
+ if ((NO_AEAD == aead) && (NULL != peer->cfg.nts_cfg.aead))
+ aead = nts_string_to_aead(peer->cfg.nts_cfg.aead);
+ if ((NO_AEAD == aead) && (NULL != ntsconfig.aead))
+ aead = nts_string_to_aead(ntsconfig.aead);
+ if (NO_AEAD == aead)
+ aead = AEAD_AES_SIV_CMAC_256;
+ ke_append_record_uint16(&buf, nts_algorithm_negotiation, aead);
+
+ // 4.1.1: End, Critical
+ ke_append_record_null(&buf, NTS_CRITICAL+nts_end_of_message);
+
+ *used = buf_size-buf.left;
+ if (*used >= (int)(buf_size - 10)) {
+ msyslog(LOG_ERR, "ERR-NTSc: buffer overflow: %d, %ld",
+ *used, (long)buf_size);
+ exit(2);
+ }
+ return true;
}
bool nts_client_process_response(SSL *ssl, struct peer* peer) {
- uint8_t buff[2048]; /* RFC 4. says SHOULD be 65K */
- int transferred;
- const char *errtxt = NULL;
+ uint8_t buff[2048]; // RFC 4. says SHOULD be 65K
+ int transferred;
+ const char *errtxt = NULL;
- transferred = nts_ssl_read(ssl, buff, sizeof(buff), &errtxt);
- if (0 >= transferred)
- return false;
- msyslog(LOG_ERR, "NTSc: read %d bytes", transferred);
+ transferred = nts_ssl_read(ssl, buff, sizeof(buff), &errtxt);
+ if (0 >= transferred)
+ return false;
+ msyslog(LOG_ERR, "NTSc: read %d bytes", transferred);
- return nts_client_process_response_core(buff, transferred, peer);
+ return nts_client_process_response_core(buff, transferred, peer);
}
bool nts_client_process_response_core(uint8_t *buff, int transferred, struct peer* peer) {
- int idx;
- struct BufCtl_t buf;
-
- peer->nts_state.cookielen = 0;
- peer->nts_state.aead = NO_AEAD;
- peer->nts_state.keylen = 0;
- peer->nts_state.writeIdx = 0;
- peer->nts_state.readIdx = 0;
- peer->nts_state.count = 0;
-
- buf.next = buff;
- buf.left = transferred;
- while (buf.left >= NTS_KE_HDR_LNG) {
- uint16_t type, data, port;
- bool critical = false;
- int length, keylength;
- char errbuf[100];
+ int idx;
+ struct BufCtl_t buf;
+
+ peer->nts_state.cookielen = 0;
+ peer->nts_state.aead = NO_AEAD;
+ peer->nts_state.keylen = 0;
+ peer->nts_state.writeIdx = 0;
+ peer->nts_state.readIdx = 0;
+ peer->nts_state.count = 0;
+
+ buf.next = buff;
+ buf.left = transferred;
+ while (buf.left >= NTS_KE_HDR_LNG) {
+ uint16_t type, data, port;
+ bool critical = false;
+ int length, keylength;
+ char errbuf[100];
#define MAX_SERVER 100
- char server[MAX_SERVER];
-
- type = ke_next_record(&buf, &length);
- if (length > buf.left){
- msyslog(LOG_ERR, "NTSc: Chunk too big: 0x%x, %d, %d",
- type, buf.left, length);
- return false;
- }
- if (NTS_CRITICAL & type) {
- critical = true;
- type &= ~NTS_CRITICAL;
- }
- if (0) // Handy for debugging but very verbose
- msyslog(LOG_ERR, "NTSc: Record: T=%d, L=%d, C=%d", type, length, critical);
- switch (type) {
- case nts_error:
- if (sizeof(data) != length) {
- msyslog(LOG_ERR, "NTSc: wrong length on error: %d", length);
- return false;
- }
- data = next_uint16(&buf);
- msyslog(LOG_ERR, "NTSc: error: %d", data);
- return false;
- case nts_next_protocol_negotiation:
- if (sizeof(data) != length) {
- msyslog(LOG_ERR, "NTSc: NPN-Wrong length: %d", length);
- return false;
- }
- data = next_uint16(&buf);
- if (data != nts_protocol_NTP) {
- msyslog(LOG_ERR, "NTSc: NPN-Bad data: %d", data);
- return false;
- }
- break;
- case nts_algorithm_negotiation:
- if (sizeof(data) != length) {
- msyslog(LOG_ERR, "NTSc: AN-Wrong length: %d", length);
- return false;
- }
- data = next_uint16(&buf);
- keylength = nts_get_key_length(data);
- if (0 == keylength) {
- msyslog(LOG_ERR, "NTSc: AN-Unsupported AEAN type: %d", data);
- return false;
- }
- peer->nts_state.aead = data;
- break;
- case nts_new_cookie:
- if (NTS_MAX_COOKIELEN < length) {
- msyslog(LOG_ERR, "NTSc: NC cookie too big: %d", length);
- return false;
- }
- if (0 == peer->nts_state.cookielen)
- peer->nts_state.cookielen = length;
- if (length != peer->nts_state.cookielen) {
- msyslog(LOG_ERR, "NTSc: Cookie length mismatch %d, %d.",
- length, peer->nts_state.cookielen);
- return false;
- }
- idx = peer->nts_state.writeIdx;
- if (NTS_MAX_COOKIES <= peer->nts_state.count) {
- msyslog(LOG_ERR, "NTSc: Extra cookie ignored.");
- buf.next += length;
- buf.left -= length;
- break;
- }
- next_bytes(&buf, (uint8_t*)&peer->nts_state.cookies[idx], length);
- peer->nts_state.writeIdx++;
- peer->nts_state.writeIdx = peer->nts_state.writeIdx % NTS_MAX_COOKIES;
- peer->nts_state.count++;
- break;
- case nts_server_negotiation:
- if (MAX_SERVER < (length+1)) {
- msyslog(LOG_ERR, "NTSc: server string too long %d.", length);
- return false;
- }
- next_bytes(&buf, (uint8_t *)server, length);
- server[length] = '\0';
- /* save port in case port specified before server */
- port = SRCPORT(&sockaddr);
- if (!nts_server_lookup(server, &sockaddr, AF(&peer->srcadr)))
- return false;
- SET_PORT(&sockaddr, port);
- socktoa_r(&sockaddr, errbuf, sizeof(errbuf));
- msyslog(LOG_ERR, "NTSc: Using server %s=>%s", server, errbuf);
- break;
- case nts_port_negotiation:
- if (sizeof(port) != length) {
- msyslog(LOG_ERR, "NTSc: PN-Wrong length: %d, %d",
- length, critical);
- return false;
- }
- port = next_uint16(&buf);
- SET_PORT(&sockaddr, port);
- msyslog(LOG_ERR, "NTSc: Using port %d", port);
- break;
- case nts_end_of_message:
- if ((0 != length) || !critical) {
- msyslog(LOG_ERR, "NTSc: EOM-Wrong length or not Critical: %d, %d",
- length, critical);
- return false;
- }
- if (0 != buf.left) {
- msyslog(LOG_ERR, "NTSc: EOM not at end: %d", buf.left);
- return false;
- }
- break;
- default:
- msyslog(LOG_ERR, "NTSc: received strange type: T=%d, C=%d, L=%d",
- type, critical, length);
- if (critical) {
- return false;
- }
- buf.next += length;
- buf.left -= length;
- break;
- } /* case */
- } /* while */
-
-// FIXME: Need to check for EOM -- read more??
- if (buf.left > 0)
- return false;
-
- if (NO_AEAD == peer->nts_state.aead) {
- msyslog(LOG_ERR, "NTSc: No AEAD algorithm.");
- return false;
- }
- if (0 == peer->nts_state.count) {
- msyslog(LOG_ERR, "NTSc: No cookies.");
- return false;
- }
-
- msyslog(LOG_ERR, "NTSc: Got %d cookies, length %d, aead=%d.",
- peer->nts_state.count, peer->nts_state.cookielen, peer->nts_state.aead);
- return true;
+ char server[MAX_SERVER];
+
+ type = ke_next_record(&buf, &length);
+ if (length > buf.left){
+ msyslog(LOG_ERR, "NTSc: Chunk too big: 0x%x, %d, %d",
+ type, buf.left, length);
+ return false;
+ }
+ if (NTS_CRITICAL & type) {
+ critical = true;
+ type &= ~NTS_CRITICAL;
+ }
+ if (0) // Handy for debugging but very verbose
+ msyslog(LOG_ERR, "NTSc: Record: T=%d, L=%d, C=%d", type, length, critical);
+ switch (type) {
+ case nts_error:
+ if (sizeof(data) != length) {
+ msyslog(LOG_ERR, "NTSc: wrong length on error: %d", length);
+ return false;
+ }
+ data = next_uint16(&buf);
+ msyslog(LOG_ERR, "NTSc: error: %d", data);
+ return false;
+ case nts_next_protocol_negotiation:
+ if (sizeof(data) != length) {
+ msyslog(LOG_ERR, "NTSc: NPN-Wrong length: %d", length);
+ return false;
+ }
+ data = next_uint16(&buf);
+ if (data != nts_protocol_NTP) {
+ msyslog(LOG_ERR, "NTSc: NPN-Bad data: %d", data);
+ return false;
+ }
+ break;
+ case nts_algorithm_negotiation:
+ if (sizeof(data) != length) {
+ msyslog(LOG_ERR, "NTSc: AN-Wrong length: %d", length);
+ return false;
+ }
+ data = next_uint16(&buf);
+ keylength = nts_get_key_length(data);
+ if (0 == keylength) {
+ msyslog(LOG_ERR, "NTSc: AN-Unsupported AEAN type: %d", data);
+ return false;
+ }
+ peer->nts_state.aead = data;
+ break;
+ case nts_new_cookie:
+ if (NTS_MAX_COOKIELEN < length) {
+ msyslog(LOG_ERR, "NTSc: NC cookie too big: %d", length);
+ return false;
+ }
+ if (0 == peer->nts_state.cookielen)
+ peer->nts_state.cookielen = length;
+ if (length != peer->nts_state.cookielen) {
+ msyslog(LOG_ERR, "NTSc: Cookie length mismatch %d, %d.",
+ length, peer->nts_state.cookielen);
+ return false;
+ }
+ idx = peer->nts_state.writeIdx;
+ if (NTS_MAX_COOKIES <= peer->nts_state.count) {
+ msyslog(LOG_ERR, "NTSc: Extra cookie ignored.");
+ buf.next += length;
+ buf.left -= length;
+ break;
+ }
+ next_bytes(&buf, (uint8_t*)&peer->nts_state.cookies[idx], length);
+ peer->nts_state.writeIdx++;
+ peer->nts_state.writeIdx = peer->nts_state.writeIdx % NTS_MAX_COOKIES;
+ peer->nts_state.count++;
+ break;
+ case nts_server_negotiation:
+ if (MAX_SERVER < (length+1)) {
+ msyslog(LOG_ERR, "NTSc: server string too long %d.", length);
+ return false;
+ }
+ next_bytes(&buf, (uint8_t *)server, length);
+ server[length] = '\0';
+ // save port in case port specified before server
+ port = SRCPORT(&sockaddr);
+ if (!nts_server_lookup(server, &sockaddr, AF(&peer->srcadr)))
+ return false;
+ SET_PORT(&sockaddr, port);
+ socktoa_r(&sockaddr, errbuf, sizeof(errbuf));
+ msyslog(LOG_ERR, "NTSc: Using server %s=>%s", server, errbuf);
+ break;
+ case nts_port_negotiation:
+ if (sizeof(port) != length) {
+ msyslog(LOG_ERR, "NTSc: PN-Wrong length: %d, %d",
+ length, critical);
+ return false;
+ }
+ port = next_uint16(&buf);
+ SET_PORT(&sockaddr, port);
+ msyslog(LOG_ERR, "NTSc: Using port %d", port);
+ break;
+ case nts_end_of_message:
+ if ((0 != length) || !critical) {
+ msyslog(LOG_ERR, "NTSc: EOM-Wrong length or not Critical: %d, %d",
+ length, critical);
+ return false;
+ }
+ if (0 != buf.left) {
+ msyslog(LOG_ERR, "NTSc: EOM not at end: %d", buf.left);
+ return false;
+ }
+ break;
+ default:
+ msyslog(LOG_ERR, "NTSc: received strange type: T=%d, C=%d, L=%d",
+ type, critical, length);
+ if (critical) {
+ return false;
+ }
+ buf.next += length;
+ buf.left -= length;
+ break;
+ } // case
+ } // while
+
+// FIXME: Need to check for EOM -- read more??
+ if (buf.left > 0)
+ return false;
+
+ if (NO_AEAD == peer->nts_state.aead) {
+ msyslog(LOG_ERR, "NTSc: No AEAD algorithm.");
+ return false;
+ }
+ if (0 == peer->nts_state.count) {
+ msyslog(LOG_ERR, "NTSc: No cookies.");
+ return false;
+ }
+
+ msyslog(LOG_ERR, "NTSc: Got %d cookies, length %d, aead=%d.",
+ peer->nts_state.count, peer->nts_state.cookielen, peer->nts_state.aead);
+ return true;
}
bool nts_set_cert_search(SSL_CTX *ctx, const char *filename) {
- struct stat statbuf;
- char errbuf[100];
- if (NULL == filename) {
- msyslog(LOG_INFO, "NTSc: Using system default root certificates.");
- SSL_CTX_set_default_verify_paths(ctx); // Use system root certs
- return true;
- }
- if (0 == stat(filename, &statbuf)) {
- if (S_ISDIR(statbuf.st_mode)) {
- if (1 != SSL_CTX_load_verify_locations(
- ctx, NULL, filename)) {
- msyslog(LOG_INFO, "NTSc: Can't use %s as dir for root certificates.", filename);
- nts_log_ssl_error();
- return false;
- }
- msyslog(LOG_INFO, "NTSc: Using dir %s for root certificates.", filename);
- return true;
- }
- if (S_ISREG(statbuf.st_mode)) {
- if (1 != SSL_CTX_load_verify_locations(
- ctx, filename, NULL)) {
- msyslog(LOG_INFO, "NTSc: Can't use %s as file for root certificates.", filename);
- nts_log_ssl_error();
- return false;
- }
- msyslog(LOG_INFO, "NTSc: Using file %s for root certificates.", filename);
- return true;
- }
- msyslog(LOG_ERR, "NTSc: cert dir/file isn't dir or file: %s. mode 0x%x",
- filename, statbuf.st_mode);
- return false;
- }
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- msyslog(LOG_ERR, "NTSc: can't stat cert dir/file: %s, %s",
- filename, errbuf);
- return false;
+ struct stat statbuf;
+ char errbuf[100];
+ if (NULL == filename) {
+ msyslog(LOG_INFO, "NTSc: Using system default root certificates.");
+ SSL_CTX_set_default_verify_paths(ctx); // Use system root certs
+ return true;
+ }
+ if (0 == stat(filename, &statbuf)) {
+ if (S_ISDIR(statbuf.st_mode)) {
+ if (1 != SSL_CTX_load_verify_locations(
+ ctx, NULL, filename)) {
+ msyslog(LOG_INFO, "NTSc: Can't use %s as dir for root certificates.", filename);
+ nts_log_ssl_error();
+ return false;
+ }
+ msyslog(LOG_INFO, "NTSc: Using dir %s for root certificates.", filename);
+ return true;
+ }
+ if (S_ISREG(statbuf.st_mode)) {
+ if (1 != SSL_CTX_load_verify_locations(
+ ctx, filename, NULL)) {
+ msyslog(LOG_INFO, "NTSc: Can't use %s as file for root certificates.", filename);
+ nts_log_ssl_error();
+ return false;
+ }
+ msyslog(LOG_INFO, "NTSc: Using file %s for root certificates.", filename);
+ return true;
+ }
+ msyslog(LOG_ERR, "NTSc: cert dir/file isn't dir or file: %s. mode 0x%x",
+ filename, statbuf.st_mode);
+ return false;
+ }
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ msyslog(LOG_ERR, "NTSc: can't stat cert dir/file: %s, %s",
+ filename, errbuf);
+ return false;
}
/* The -4/-6 option is used for both the NTS-KE server and the NTP server.
* That will break if the KE server returns a name that returns only an
@@ -916,31 +916,31 @@ bool nts_set_cert_search(SSL_CTX *ctx, const char *filename) {
* We could fix that by trying again with AF_UNSPEC.
*/
bool nts_server_lookup(char *server, sockaddr_u *addr, int af) {
- struct addrinfo hints;
- struct addrinfo *answer = NULL; /* init to keep oss-fuzz happy */
- int gai_rc;
+ struct addrinfo hints;
+ struct addrinfo *answer = NULL; // init to keep oss-fuzz happy
+ int gai_rc;
- ZERO(hints);
- hints.ai_protocol = IPPROTO_UDP;
- hints.ai_socktype = SOCK_DGRAM;
- hints.ai_family = af;
+ ZERO(hints);
+ hints.ai_protocol = IPPROTO_UDP;
+ hints.ai_socktype = SOCK_DGRAM;
+ hints.ai_family = af;
- gai_rc = getaddrinfo(server, NTS_KE_PORTA, &hints, &answer);
- if (0 != gai_rc) {
- msyslog(LOG_INFO, "NTSc: DNS error trying to lookup %s: %d, %s",
- server, gai_rc, gai_strerror(gai_rc));
- return false;
- }
+ gai_rc = getaddrinfo(server, NTS_KE_PORTA, &hints, &answer);
+ if (0 != gai_rc) {
+ msyslog(LOG_INFO, "NTSc: DNS error trying to lookup %s: %d, %s",
+ server, gai_rc, gai_strerror(gai_rc));
+ return false;
+ }
- if (NULL == answer)
- return false;
+ if (NULL == answer)
+ return false;
- if (sizeof(sockaddr_u) >= answer->ai_addrlen)
- memcpy(addr, answer->ai_addr, answer->ai_addrlen);
+ if (sizeof(sockaddr_u) >= answer->ai_addrlen)
+ memcpy(addr, answer->ai_addr, answer->ai_addrlen);
- freeaddrinfo(answer);
+ freeaddrinfo(answer);
- return true;
+ return true;
}
-/* end */
+// end
=====================================
ntpd/nts_server.c
=====================================
@@ -56,200 +56,200 @@ static void nts_ke_setup_send(struct BufCtl_t *buf, int aead,
pthread_mutex_t certificate_lock = PTHREAD_MUTEX_INITIALIZER;
static int alpn_select_cb(SSL *ssl,
- const unsigned char **out,
- unsigned char *outlen,
- const unsigned char *in,
- unsigned int inlen,
- void *arg)
+ const unsigned char **out,
+ unsigned char *outlen,
+ const unsigned char *in,
+ unsigned int inlen,
+ void *arg)
{
- static const unsigned char alpn[] = {
+ static const unsigned char alpn[] = {
'n', 't', 's', 'k', 'e', '/', '1' };
- unsigned i, len;
+ unsigned i, len;
- UNUSED_ARG(ssl);
- UNUSED_ARG(arg);
+ UNUSED_ARG(ssl);
+ UNUSED_ARG(arg);
- for (i = 0; i < inlen; i += len+1) {
- len = in[i]; // first byte is the length
+ for (i = 0; i < inlen; i += len+1) {
+ len = in[i]; // first byte is the length
#if 0
- char foo[256];
- strlcpy(foo, (const char*)in+i+1, len);
- msyslog(LOG_DEBUG, "DEBUG: alpn_select_cb: %u, %u, %s", inlen-i, len, foo);
+ char foo[256];
+ strlcpy(foo, (const char*)in+i+1, len);
+ msyslog(LOG_DEBUG, "DEBUG: alpn_select_cb: %u, %u, %s", inlen-i, len, foo);
#endif
- if (len+1 > inlen-i)
- /* bogus arg: length overlaps end of in buffer */
- return SSL_TLSEXT_ERR_ALERT_FATAL;
- if (len == sizeof(alpn) && !memcmp(in+i+1, alpn, len)) {
- *out = in+i+1;
- *outlen = len;
- return SSL_TLSEXT_ERR_OK;
- }
- }
-
- return SSL_TLSEXT_ERR_NOACK;
+ if (len+1 > inlen-i)
+ // bogus arg: length overlaps end of in buffer
+ return SSL_TLSEXT_ERR_ALERT_FATAL;
+ if (len == sizeof(alpn) && !memcmp(in+i+1, alpn, len)) {
+ *out = in+i+1;
+ *outlen = len;
+ return SSL_TLSEXT_ERR_OK;
+ }
+ }
+
+ return SSL_TLSEXT_ERR_NOACK;
}
bool nts_server_init(void) {
- bool ok = true;
-
- msyslog(LOG_INFO, "NTSs: starting NTS-KE server listening on port %d",
- NTS_KE_PORT);
-
- server_ctx = SSL_CTX_new(TLS_server_method());
- if (NULL == server_ctx) {
- /* Happens if no ciphers */
- msyslog(LOG_INFO, "NTSs: NULL server_ctx");
- nts_log_ssl_error();
- return false;
- }
-
- SSL_CTX_set_alpn_select_cb(server_ctx, alpn_select_cb, NULL);
- SSL_CTX_set_session_cache_mode(server_ctx, SSL_SESS_CACHE_OFF);
- SSL_CTX_set_timeout(server_ctx, NTS_KE_TIMEOUT); /* session lifetime */
-
- ok &= nts_load_versions(server_ctx);
- ok &= nts_load_ciphers(server_ctx);
- ok &= nts_load_ecdhcurves(server_ctx);
- ok &= nts_set_cipher_order(server_ctx);
-
- if (!ok) {
- msyslog(LOG_ERR, "NTSs: Disabling NTS-KE server");
- SSL_CTX_free(server_ctx);
- server_ctx = NULL;
- return false;
- };
-
- msyslog(LOG_INFO, "NTSs: OpenSSL security level is %d",
- SSL_CTX_get_security_level(server_ctx));
-
- msyslog(LOG_INFO, "NTSs: starting NTS-KE server listening on port %d",
- NTS_KE_PORT);
- ok &= create_listener4(NTS_KE_PORT);
- ok &= create_listener6(NTS_KE_PORT);
-
- return ok;
+ bool ok = true;
+
+ msyslog(LOG_INFO, "NTSs: starting NTS-KE server listening on port %d",
+ NTS_KE_PORT);
+
+ server_ctx = SSL_CTX_new(TLS_server_method());
+ if (NULL == server_ctx) {
+ // Happens if no ciphers
+ msyslog(LOG_INFO, "NTSs: NULL server_ctx");
+ nts_log_ssl_error();
+ return false;
+ }
+
+ SSL_CTX_set_alpn_select_cb(server_ctx, alpn_select_cb, NULL);
+ SSL_CTX_set_session_cache_mode(server_ctx, SSL_SESS_CACHE_OFF);
+ SSL_CTX_set_timeout(server_ctx, NTS_KE_TIMEOUT); // session lifetime
+
+ ok &= nts_load_versions(server_ctx);
+ ok &= nts_load_ciphers(server_ctx);
+ ok &= nts_load_ecdhcurves(server_ctx);
+ ok &= nts_set_cipher_order(server_ctx);
+
+ if (!ok) {
+ msyslog(LOG_ERR, "NTSs: Disabling NTS-KE server");
+ SSL_CTX_free(server_ctx);
+ server_ctx = NULL;
+ return false;
+ };
+
+ msyslog(LOG_INFO, "NTSs: OpenSSL security level is %d",
+ SSL_CTX_get_security_level(server_ctx));
+
+ msyslog(LOG_INFO, "NTSs: starting NTS-KE server listening on port %d",
+ NTS_KE_PORT);
+ ok &= create_listener4(NTS_KE_PORT);
+ ok &= create_listener6(NTS_KE_PORT);
+
+ return ok;
}
bool nts_server_init2(void) {
- pthread_t worker;
- sigset_t block_mask, saved_sig_mask;
- int rc;
- char errbuf[100];
-
- if (!nts_load_certificate(server_ctx)) {
- return false;
- }
-
- sigfillset(&block_mask);
- pthread_sigmask(SIG_BLOCK, &block_mask, &saved_sig_mask);
- if (listener4_sock != -1) {
- rc = pthread_create(&worker, NULL, nts_ke_listener, &listener4_sock);
- if (rc) {
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- msyslog(LOG_ERR, "NTSs: nts_start_server4: error from pthread_create: %s", errbuf);
- }
- }
- if (listener6_sock != -1) {
- rc = pthread_create(&worker, NULL, nts_ke_listener, &listener6_sock);
- if (rc) {
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- msyslog(LOG_ERR, "NTSs: nts_start_server6: error from pthread_create: %s", errbuf);
- }
- }
- pthread_sigmask(SIG_SETMASK, &saved_sig_mask, NULL);
-
- return true;
+ pthread_t worker;
+ sigset_t block_mask, saved_sig_mask;
+ int rc;
+ char errbuf[100];
+
+ if (!nts_load_certificate(server_ctx)) {
+ return false;
+ }
+
+ sigfillset(&block_mask);
+ pthread_sigmask(SIG_BLOCK, &block_mask, &saved_sig_mask);
+ if (listener4_sock != -1) {
+ rc = pthread_create(&worker, NULL, nts_ke_listener, &listener4_sock);
+ if (rc) {
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ msyslog(LOG_ERR, "NTSs: nts_start_server4: error from pthread_create: %s", errbuf);
+ }
+ }
+ if (listener6_sock != -1) {
+ rc = pthread_create(&worker, NULL, nts_ke_listener, &listener6_sock);
+ if (rc) {
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ msyslog(LOG_ERR, "NTSs: nts_start_server6: error from pthread_create: %s", errbuf);
+ }
+ }
+ pthread_sigmask(SIG_SETMASK, &saved_sig_mask, NULL);
+
+ return true;
}
-/* called every hour */
+// called every hour
void nts_cert_timer(void) {
- check_cert_file();
+ check_cert_file();
}
-/* call hourly and by SIGHUP */
+// call hourly and by SIGHUP
void check_cert_file(void) {
- if (NULL == server_ctx)
- return;
- nts_lock_certlock();
- nts_reload_certificate(server_ctx);
- nts_unlock_certlock();
+ if (NULL == server_ctx)
+ return;
+ nts_lock_certlock();
+ nts_reload_certificate(server_ctx);
+ nts_unlock_certlock();
}
void nts_lock_certlock(void) {
- int err = pthread_mutex_lock(&certificate_lock);
- if (0 != err) {
- msyslog(LOG_ERR, "ERR: Can't lock certificate_lock: %d", err);
- exit(2);
- }
+ int err = pthread_mutex_lock(&certificate_lock);
+ if (0 != err) {
+ msyslog(LOG_ERR, "ERR: Can't lock certificate_lock: %d", err);
+ exit(2);
+ }
}
void nts_unlock_certlock(void) {
- int err = pthread_mutex_unlock(&certificate_lock);
- if (0 != err) {
- msyslog(LOG_ERR, "ERR: Can't unlock certificate_lock: %d", err);
- exit(2);
- }
+ int err = pthread_mutex_unlock(&certificate_lock);
+ if (0 != err) {
+ msyslog(LOG_ERR, "ERR: Can't unlock certificate_lock: %d", err);
+ exit(2);
+ }
}
-/* lfptod goes to long double */
+// lfptod goes to long double
static inline double lfptox(l_fp r) {
-/* l_fp to double */
+// l_fp to double
return ldexp((double)((int64_t)r), -32);
}
void* nts_ke_listener(void* arg) {
- struct timeval timeout = {.tv_sec = NTS_KE_TIMEOUT, .tv_usec = 0};
- int sock = *(int*)arg;
- char errbuf[100];
- char addrbuf[100];
- char usingbuf[100];
- struct timespec start, finish; /* wall clock */
- l_fp wall, usr, sys;
- const char *errtxt; /* not NULL if error */
+ struct timeval timeout = {.tv_sec = NTS_KE_TIMEOUT, .tv_usec = 0};
+ int sock = *(int*)arg;
+ char errbuf[100];
+ char addrbuf[100];
+ char usingbuf[100];
+ struct timespec start, finish; // wall clock
+ l_fp wall, usr, sys;
+ const char *errtxt; // not NULL if error
#ifdef RUSAGE_THREAD
- /* Not in NetBSD 10.1, 2026-Apr-05 */
- struct timespec start_u, finish_u; /* CPU user */
- struct timespec start_s, finish_s; /* CPU system */
- struct rusage usage;
+ // Not in NetBSD 10.1, 2026-Apr-05
+ struct timespec start_u, finish_u; // CPU user
+ struct timespec start_s, finish_s; // CPU system
+ struct rusage usage;
#endif
#ifdef HAVE_SECCOMP_H
- setup_SIGSYS_trap(); /* enable trap for this thread */
+ setup_SIGSYS_trap(); // enable trap for this thread
#endif
#ifdef RUSAGE_THREAD
- /* NB: start_u and start_s are from near the end of the previous cycle.
- * Thus usage timing includes the TCP accept and
- * writing the previous msyslog message.
- */
- getrusage(RUSAGE_THREAD, &usage);
- start_u = tval_to_tspec(usage.ru_utime);
- start_s = tval_to_tspec(usage.ru_stime);
+ /* NB: start_u and start_s are from near the end of the previous cycle.
+ * Thus usage timing includes the TCP accept and
+ * writing the previous msyslog message.
+ */
+ getrusage(RUSAGE_THREAD, &usage);
+ start_u = tval_to_tspec(usage.ru_utime);
+ start_s = tval_to_tspec(usage.ru_stime);
#else
- usr = 0;
- sys = 0;
+ usr = 0;
+ sys = 0;
#endif
- while(1) {
- NTSKE_Status status = NTSKE_SSL_Failed;
- sockaddr_u addr;
- socklen_t len = sizeof(addr);
- SSL *ssl;
- int client, err;
-
- sleep(1); /* FIXME: log clutter/DoS */
- errtxt = NULL;
- client = accept(sock, &addr.sa, &len);
- if (client < 0) {
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- msyslog(LOG_ERR, "NTSs: TCP accept failed: %s", errbuf);
- if (EBADF == errno)
- return NULL;
- continue;
- }
- clock_gettime(CLOCK_MONOTONIC, &start);
- sockporttoa_r(&addr, addrbuf, sizeof(addrbuf));
+ while(1) {
+ NTSKE_Status status = NTSKE_SSL_Failed;
+ sockaddr_u addr;
+ socklen_t len = sizeof(addr);
+ SSL *ssl;
+ int client, err;
+
+ sleep(1); // FIXME: log clutter/DoS
+ errtxt = NULL;
+ client = accept(sock, &addr.sa, &len);
+ if (client < 0) {
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ msyslog(LOG_ERR, "NTSs: TCP accept failed: %s", errbuf);
+ if (EBADF == errno)
+ return NULL;
+ continue;
+ }
+ clock_gettime(CLOCK_MONOTONIC, &start);
+ sockporttoa_r(&addr, addrbuf, sizeof(addrbuf));
/* This is disabled in order to reduce clutter in the log file.
* The client's address is now included in the final message.
@@ -266,85 +266,85 @@ void* nts_ke_listener(void* arg) {
* fall into the normal (non-error) path which does include the address.
* Enabling this might make strange cases easier to understand.
*/
-/* msyslog(LOG_INFO, "NTSs: TCP accept-ed from %s", addrbuf); */
-
- err = setsockopt(client, SOL_SOCKET, SO_RCVTIMEO,
- &timeout, sizeof(timeout));
- if (0 > err) {
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- msyslog(LOG_ERR, "NTSs: can't set recv timeout: %s", errbuf);
- close(client);
- ntske_cnt.serves_bad++;
- continue;
- }
- err = setsockopt(client, SOL_SOCKET, SO_SNDTIMEO,
- &timeout, sizeof(timeout));
- if (0 > err) {
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- msyslog(LOG_ERR, "NTSs: can't set send timeout: %s", errbuf);
- close(client);
- ntske_cnt.serves_bad++;
- continue;
- }
-
- /* WARN: For high volume servers, this should go in a new thread. */
- nts_lock_certlock();
- ssl = SSL_new(server_ctx);
- nts_unlock_certlock();
- SSL_set_fd(ssl, client);
-
- err = SSL_accept(ssl);
- if (0 >= err) {
- int code = SSL_get_error(ssl, err);
- SSL_free(ssl);
- close(client);
- clock_gettime(CLOCK_MONOTONIC, &finish);
- wall = tspec_intv_to_lfp(sub_tspec(finish, start));
+// msyslog(LOG_INFO, "NTSs: TCP accept-ed from %s", addrbuf);
+
+ err = setsockopt(client, SOL_SOCKET, SO_RCVTIMEO,
+ &timeout, sizeof(timeout));
+ if (0 > err) {
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ msyslog(LOG_ERR, "NTSs: can't set recv timeout: %s", errbuf);
+ close(client);
+ ntske_cnt.serves_bad++;
+ continue;
+ }
+ err = setsockopt(client, SOL_SOCKET, SO_SNDTIMEO,
+ &timeout, sizeof(timeout));
+ if (0 > err) {
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ msyslog(LOG_ERR, "NTSs: can't set send timeout: %s", errbuf);
+ close(client);
+ ntske_cnt.serves_bad++;
+ continue;
+ }
+
+ // WARN: For high volume servers, this should go in a new thread.
+ nts_lock_certlock();
+ ssl = SSL_new(server_ctx);
+ nts_unlock_certlock();
+ SSL_set_fd(ssl, client);
+
+ err = SSL_accept(ssl);
+ if (0 >= err) {
+ int code = SSL_get_error(ssl, err);
+ SSL_free(ssl);
+ close(client);
+ clock_gettime(CLOCK_MONOTONIC, &finish);
+ wall = tspec_intv_to_lfp(sub_tspec(finish, start));
#ifdef RUSAGE_THREAD
- getrusage(RUSAGE_THREAD, &usage);
- finish_u = tval_to_tspec(usage.ru_utime);
- finish_s = tval_to_tspec(usage.ru_stime);
- usr = tspec_intv_to_lfp(sub_tspec(finish_u, start_u));
- sys = tspec_intv_to_lfp(sub_tspec(finish_s, start_s));
- start_u = finish_u;
- start_s = finish_s;
+ getrusage(RUSAGE_THREAD, &usage);
+ finish_u = tval_to_tspec(usage.ru_utime);
+ finish_s = tval_to_tspec(usage.ru_stime);
+ usr = tspec_intv_to_lfp(sub_tspec(finish_u, start_u));
+ sys = tspec_intv_to_lfp(sub_tspec(finish_s, start_s));
+ start_u = finish_u;
+ start_s = finish_s;
#endif
- nts_ke_accept_fail(addrbuf,
- lfptox(wall), lfptox(usr), lfptox(sys), code);
- continue;
- }
-
- /* Save info for final message. */
- snprintf(usingbuf, sizeof(usingbuf), "%s:%s(%d)",
- SSL_get_version(ssl),
- SSL_get_cipher_name(ssl),
- SSL_get_cipher_bits(ssl, NULL));
-
- status = NTSKE_Failed;
- nts_ke_request(ssl, errbuf, sizeof(errbuf), &errtxt);
- if (NULL==errtxt) status = NTSKE_OK;
-
- SSL_shutdown(ssl);
- SSL_free(ssl);
- close(client);
-
- clock_gettime(CLOCK_MONOTONIC, &finish);
- wall = tspec_intv_to_lfp(sub_tspec(finish, start));
+ nts_ke_accept_fail(addrbuf,
+ lfptox(wall), lfptox(usr), lfptox(sys), code);
+ continue;
+ }
+
+ // Save info for final message.
+ snprintf(usingbuf, sizeof(usingbuf), "%s:%s(%d)",
+ SSL_get_version(ssl),
+ SSL_get_cipher_name(ssl),
+ SSL_get_cipher_bits(ssl, NULL));
+
+ status = NTSKE_Failed;
+ nts_ke_request(ssl, errbuf, sizeof(errbuf), &errtxt);
+ if (NULL==errtxt) status = NTSKE_OK;
+
+ SSL_shutdown(ssl);
+ SSL_free(ssl);
+ close(client);
+
+ clock_gettime(CLOCK_MONOTONIC, &finish);
+ wall = tspec_intv_to_lfp(sub_tspec(finish, start));
#ifdef RUSAGE_THREAD
- getrusage(RUSAGE_THREAD, &usage);
- finish_u = tval_to_tspec(usage.ru_utime);
- finish_s = tval_to_tspec(usage.ru_stime);
- usr = tspec_intv_to_lfp(sub_tspec(finish_u, start_u));
- sys = tspec_intv_to_lfp(sub_tspec(finish_s, start_s));
- start_u = finish_u;
- start_s = finish_s;
+ getrusage(RUSAGE_THREAD, &usage);
+ finish_u = tval_to_tspec(usage.ru_utime);
+ finish_s = tval_to_tspec(usage.ru_stime);
+ usr = tspec_intv_to_lfp(sub_tspec(finish_u, start_u));
+ sys = tspec_intv_to_lfp(sub_tspec(finish_s, start_s));
+ start_u = finish_u;
+ start_s = finish_s;
#endif
- record_ntske_log(status, addrbuf, usingbuf,
- lfptox(wall), lfptox(usr), lfptox(sys),
- errtxt);
- }
+ record_ntske_log(status, addrbuf, usingbuf,
+ lfptox(wall), lfptox(usr), lfptox(sys),
+ errtxt);
+ }
- return NULL;
+ return NULL;
}
/* Analyze failure from SSL_accept
@@ -353,329 +353,329 @@ void* nts_ke_listener(void* arg) {
*/
void nts_ke_accept_fail(char* hostname,
double wall, double usr, double sys, int code) {
- unsigned long err = ERR_peek_error();
- char errbuf[100];
- char buff[200];
- const char *msg = NULL;
- const char *errmsg = NULL;
- if (0 == err) {
- switch (code) {
- case SSL_ERROR_WANT_READ:
- msg = "Timeout";
- break;
- case SSL_ERROR_SYSCALL:
- if (ECONNRESET==errno) {
- msg = "Connection reset";
- break;
- }
- /* fall through */
- default:
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- snprintf(buff, sizeof(buff), "code %d, errno=>%d, %s",
- code, errno, errbuf);
- msg = buff;
- break;
- }
- } else {
- if (code==SSL_ERROR_SSL) {
- msg = ERR_reason_error_string(err);
- err = 0;
- } else {
- // Maybe we need to handle other codes
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- snprintf(buff, sizeof(buff), "code %d, errno=>%d, %s, %lx=>%s",
- code, errno, errbuf, err, ERR_reason_error_string(err));
- err = 0;
- msg = buff;
- }
- }
- record_ntske_log(NTSKE_SSL_Failed, hostname, msg,
- wall, usr, sys, errmsg);
+ unsigned long err = ERR_peek_error();
+ char errbuf[100];
+ char buff[200];
+ const char *msg = NULL;
+ const char *errmsg = NULL;
+ if (0 == err) {
+ switch (code) {
+ case SSL_ERROR_WANT_READ:
+ msg = "Timeout";
+ break;
+ case SSL_ERROR_SYSCALL:
+ if (ECONNRESET==errno) {
+ msg = "Connection reset";
+ break;
+ }
+ // fall through
+ default:
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ snprintf(buff, sizeof(buff), "code %d, errno=>%d, %s",
+ code, errno, errbuf);
+ msg = buff;
+ break;
+ }
+ } else {
+ if (code==SSL_ERROR_SSL) {
+ msg = ERR_reason_error_string(err);
+ err = 0;
+ } else {
+ // Maybe we need to handle other codes
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ snprintf(buff, sizeof(buff), "code %d, errno=>%d, %s, %lx=>%s",
+ code, errno, errbuf, err, ERR_reason_error_string(err));
+ err = 0;
+ msg = buff;
+ }
+ }
+ record_ntske_log(NTSKE_SSL_Failed, hostname, msg,
+ wall, usr, sys, errmsg);
}
void nts_ke_request(SSL *ssl,
char *errbuf, int errlng, const char **errtxt) {
- /* RFC 4: servers must accept 1024
- * Our cookies can be 104, 136, or 168 for AES_SIV_CMAC_xxx
- * 8*168 fits comfortably into 2K.
- */
- uint8_t buff[2048];
- uint8_t c2s[NTS_MAX_KEYLEN], s2c[NTS_MAX_KEYLEN];
- int aead = NO_AEAD, keylen;
- struct BufCtl_t buf;
- int bytes_read, bytes_written;
- int used;
-
- bytes_read = nts_ssl_read(ssl, buff, sizeof(buff), errtxt);
- if (0 >= bytes_read)
- return;
-
- buf.next = buff;
- buf.left = bytes_read;
- if (!nts_ke_process_receive(&buf, &aead, errbuf, errlng, errtxt)) {
- return;
- }
-
- if ((NO_AEAD == aead) && (NULL != ntsconfig.aead))
- aead = nts_string_to_aead(ntsconfig.aead);
- if (NO_AEAD == aead)
- aead = AEAD_AES_SIV_CMAC_256; /* default */
-
- keylen = nts_get_key_length(aead);
- if (!nts_make_keys(ssl, aead, c2s, s2c, keylen)) {
- *errtxt = "Can't make keys";
- return;
- }
-
- buf.next = buff;
- buf.left = sizeof(buff);
- nts_ke_setup_send(&buf, aead, c2s, s2c, keylen);
-
- used = sizeof(buff)-buf.left;
- bytes_written = nts_ssl_write(ssl, buff, used, errtxt);
- if (bytes_written != used)
- return;
-
-/* FIXME: Need counters for AEAD */
-
- return;
+ /* RFC 4: servers must accept 1024
+ * Our cookies can be 104, 136, or 168 for AES_SIV_CMAC_xxx
+ * 8*168 fits comfortably into 2K.
+ */
+ uint8_t buff[2048];
+ uint8_t c2s[NTS_MAX_KEYLEN], s2c[NTS_MAX_KEYLEN];
+ int aead = NO_AEAD, keylen;
+ struct BufCtl_t buf;
+ int bytes_read, bytes_written;
+ int used;
+
+ bytes_read = nts_ssl_read(ssl, buff, sizeof(buff), errtxt);
+ if (0 >= bytes_read)
+ return;
+
+ buf.next = buff;
+ buf.left = bytes_read;
+ if (!nts_ke_process_receive(&buf, &aead, errbuf, errlng, errtxt)) {
+ return;
+ }
+
+ if ((NO_AEAD == aead) && (NULL != ntsconfig.aead))
+ aead = nts_string_to_aead(ntsconfig.aead);
+ if (NO_AEAD == aead)
+ aead = AEAD_AES_SIV_CMAC_256; // default
+
+ keylen = nts_get_key_length(aead);
+ if (!nts_make_keys(ssl, aead, c2s, s2c, keylen)) {
+ *errtxt = "Can't make keys";
+ return;
+ }
+
+ buf.next = buff;
+ buf.left = sizeof(buff);
+ nts_ke_setup_send(&buf, aead, c2s, s2c, keylen);
+
+ used = sizeof(buff)-buf.left;
+ bytes_written = nts_ssl_write(ssl, buff, used, errtxt);
+ if (bytes_written != used)
+ return;
+
+// FIXME: Need counters for AEAD
+
+ return;
}
bool create_listener4(int port) {
- int sock = -1;
- sockaddr_u addr;
- int on = 1;
- int err;
- char errbuf[100];
-
- addr.sa4.sin_family = AF_INET;
- addr.sa4.sin_port = htons(port);
- addr.sa4.sin_addr.s_addr= htonl(INADDR_ANY);
- sock = socket(AF_INET, SOCK_STREAM, 0);
- if (sock < 0) {
- if (EAFNOSUPPORT == errno) {
- msyslog(LOG_ERR, "NTSs: No IPv4 support, disabling NTS-KE listener");
- return true;
- }
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- msyslog(LOG_ERR, "NTSs: Can't create socket4: %s", errbuf);
- return false;
- }
- err = setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
- if (0 > err) {
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- msyslog(LOG_ERR, "NTSs: can't setsockopt4: %s", errbuf);
- close(sock);
- return false;
- }
- err = bind(sock, &addr.sa, sizeof(addr.sa4));
- if (0 > err) {
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- msyslog(LOG_ERR, "NTSs: can't bind4: %s", errbuf);
- close(sock);
- return false;
- }
- if (listen(sock, 6) < 0) {
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- msyslog(LOG_ERR, "NTSs: can't listen4: %s", errbuf);
- close(sock);
- return false;
- }
- msyslog(LOG_INFO, "NTSs: listen4 worked");
-
- listener4_sock = sock;
- return true;
+ int sock = -1;
+ sockaddr_u addr;
+ int on = 1;
+ int err;
+ char errbuf[100];
+
+ addr.sa4.sin_family = AF_INET;
+ addr.sa4.sin_port = htons(port);
+ addr.sa4.sin_addr.s_addr= htonl(INADDR_ANY);
+ sock = socket(AF_INET, SOCK_STREAM, 0);
+ if (sock < 0) {
+ if (EAFNOSUPPORT == errno) {
+ msyslog(LOG_ERR, "NTSs: No IPv4 support, disabling NTS-KE listener");
+ return true;
+ }
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ msyslog(LOG_ERR, "NTSs: Can't create socket4: %s", errbuf);
+ return false;
+ }
+ err = setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
+ if (0 > err) {
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ msyslog(LOG_ERR, "NTSs: can't setsockopt4: %s", errbuf);
+ close(sock);
+ return false;
+ }
+ err = bind(sock, &addr.sa, sizeof(addr.sa4));
+ if (0 > err) {
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ msyslog(LOG_ERR, "NTSs: can't bind4: %s", errbuf);
+ close(sock);
+ return false;
+ }
+ if (listen(sock, 6) < 0) {
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ msyslog(LOG_ERR, "NTSs: can't listen4: %s", errbuf);
+ close(sock);
+ return false;
+ }
+ msyslog(LOG_INFO, "NTSs: listen4 worked");
+
+ listener4_sock = sock;
+ return true;
}
bool create_listener6(int port) {
- int sock = -1;
- sockaddr_u addr;
- int on = 1;
- int err;
- char errbuf[100];
-
- addr.sa6.sin6_family = AF_INET6;
- addr.sa6.sin6_port = htons(port);
- addr.sa6.sin6_addr = in6addr_any;
- sock = socket(AF_INET6, SOCK_STREAM, 0);
- if (sock < 0) {
- if (EAFNOSUPPORT == errno) {
- msyslog(LOG_ERR, "NTSs: No IPv6 support, disabling NTS-KE listener");
- return true;
- }
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- msyslog(LOG_ERR, "NTSs: Can't create socket6: %s", errbuf);
- return false;
- }
- /* Hack to keep IPV6 from listening on IPV4 too */
- err = setsockopt(sock, IPPROTO_IPV6, IPV6_V6ONLY, &on, sizeof(on));
- if (0 > err) {
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- msyslog(LOG_ERR, "NTSs: can't setsockopt6only: %s", errbuf);
- close(sock);
- return false;
- }
- err = setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
- if (0 > err) {
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- msyslog(LOG_ERR, "NTSs: can't setsockopt6: %s", errbuf);
- close(sock);
- return false;
- }
- err = bind(sock, &addr.sa, sizeof(addr.sa6));
- if (0 > err) {
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- msyslog(LOG_ERR, "NTSs: can't bind6: %s", errbuf);
- close(sock);
- return false;
- }
- if (listen(sock, 6) < 0) {
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- msyslog(LOG_ERR, "NTSs: can't listen6: %s", errbuf);
- close(sock);
- return false;
- }
- msyslog(LOG_INFO, "NTSs: listen6 worked");
-
- listener6_sock = sock;
- return true;
+ int sock = -1;
+ sockaddr_u addr;
+ int on = 1;
+ int err;
+ char errbuf[100];
+
+ addr.sa6.sin6_family = AF_INET6;
+ addr.sa6.sin6_port = htons(port);
+ addr.sa6.sin6_addr = in6addr_any;
+ sock = socket(AF_INET6, SOCK_STREAM, 0);
+ if (sock < 0) {
+ if (EAFNOSUPPORT == errno) {
+ msyslog(LOG_ERR, "NTSs: No IPv6 support, disabling NTS-KE listener");
+ return true;
+ }
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ msyslog(LOG_ERR, "NTSs: Can't create socket6: %s", errbuf);
+ return false;
+ }
+ // Hack to keep IPV6 from listening on IPV4 too
+ err = setsockopt(sock, IPPROTO_IPV6, IPV6_V6ONLY, &on, sizeof(on));
+ if (0 > err) {
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ msyslog(LOG_ERR, "NTSs: can't setsockopt6only: %s", errbuf);
+ close(sock);
+ return false;
+ }
+ err = setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
+ if (0 > err) {
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ msyslog(LOG_ERR, "NTSs: can't setsockopt6: %s", errbuf);
+ close(sock);
+ return false;
+ }
+ err = bind(sock, &addr.sa, sizeof(addr.sa6));
+ if (0 > err) {
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ msyslog(LOG_ERR, "NTSs: can't bind6: %s", errbuf);
+ close(sock);
+ return false;
+ }
+ if (listen(sock, 6) < 0) {
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ msyslog(LOG_ERR, "NTSs: can't listen6: %s", errbuf);
+ close(sock);
+ return false;
+ }
+ msyslog(LOG_INFO, "NTSs: listen6 worked");
+
+ listener6_sock = sock;
+ return true;
}
bool nts_ke_process_receive(struct BufCtl_t *buf, int *aead,
char *errbuf, int errlng, const char **errtxt) {
- while (buf->left >= NTS_KE_HDR_LNG) {
- uint16_t type, data;
- int length;
- bool critical = false;
- type = ke_next_record(buf, &length);
+ while (buf->left >= NTS_KE_HDR_LNG) {
+ uint16_t type, data;
+ int length;
+ bool critical = false;
+ type = ke_next_record(buf, &length);
if (length > buf->left) {
- snprintf(errbuf, errlng,
- "Chunk too big: 0x%x, %d, %d",
+ snprintf(errbuf, errlng,
+ "Chunk too big: 0x%x, %d, %d",
type, buf->left, length);
- *errtxt = errbuf;
+ *errtxt = errbuf;
return false;
}
- if (NTS_CRITICAL & type) {
- critical = true;
- type &= ~NTS_CRITICAL;
- }
- if (0) // Handy for debugging but very verbose
- msyslog(LOG_INFO, "NTSs: Record: T=%d, L=%d, C=%d", type, length, critical);
- switch (type) {
- case nts_error:
- if (sizeof(data) != length) {
- snprintf(errbuf, errlng,
- "Wrong length on error: %d", length);
- *errtxt = errbuf;
- return false;
- }
- data = next_uint16(buf);
- snprintf(errbuf, errlng,
- "Received error: %d", data);
- *errtxt = errbuf;
- return false;
- case nts_next_protocol_negotiation:
- if (sizeof(data) != length) {
- snprintf(errbuf, errlng,
- "NPN-Wrong length: %d", length);
- *errtxt = errbuf;
- return false;
- }
- data = next_uint16(buf);
- if (data != nts_protocol_NTP) {
- snprintf(errbuf, errlng,
- "NPN-Bad data: %d", data);
- *errtxt = errbuf;
- return false;
- }
- break;
- case nts_algorithm_negotiation:
- if (length % sizeof(uint16_t) > 0) {
- snprintf(errbuf, errlng,
- "AN-Wrong length: %d", length);
- *errtxt = errbuf;
- return false;
- }
- for (int i=0; i<length; i+=sizeof(uint16_t)) {
- data = next_uint16(buf);
- if (0 == nts_get_key_length(data)) {
- if (0) /* for debugging */
- msyslog(LOG_ERR, "NTSs: AN-Unsupported AEAN type: %d", data);
- continue; /* ignore types we don't support */
- }
- if (*aead != NO_AEAD)
- continue; /* already got one */
- *aead = data; /* take this one */
- }
- break;
- case nts_end_of_message:
- if ((0 != length) || !critical) {
- snprintf(errbuf, errlng,
- "EOM-Wrong length or not Critical: %d, %d",
- length, critical);
- *errtxt = errbuf;
- return false;
- }
- if (0 != buf->left) {
- snprintf(errbuf, errlng,
- "EOM not at end: %d", buf->left);
- *errtxt = errbuf;
- return false;
- }
- return true;
- default:
- if (critical) {
- // This only logs the first one from a connection
- snprintf(errbuf, errlng,
- "Received strange type: T=%d, C=%d, L=%d",
- type, critical, length);
- // There is an error code for this
- return false;
- }
- // It might be interesting to log non-critical
- // but that needs rate limiting
- buf->next += length;
- buf->left -= length;
- break;
- } /* case */
- } /* while */
-
- /* If we get here, we ran off the end without finding an EOM.
- * nts_ssl_read() should have complained, so this check
- * should never happen.
- */
- if (buf->left > 0) {
- *errtxt = "*** Leftovers";
- return false;
- }
-
- *errtxt = "*** Missing EOM";
- return false;
+ if (NTS_CRITICAL & type) {
+ critical = true;
+ type &= ~NTS_CRITICAL;
+ }
+ if (0) // Handy for debugging but very verbose
+ msyslog(LOG_INFO, "NTSs: Record: T=%d, L=%d, C=%d", type, length, critical);
+ switch (type) {
+ case nts_error:
+ if (sizeof(data) != length) {
+ snprintf(errbuf, errlng,
+ "Wrong length on error: %d", length);
+ *errtxt = errbuf;
+ return false;
+ }
+ data = next_uint16(buf);
+ snprintf(errbuf, errlng,
+ "Received error: %d", data);
+ *errtxt = errbuf;
+ return false;
+ case nts_next_protocol_negotiation:
+ if (sizeof(data) != length) {
+ snprintf(errbuf, errlng,
+ "NPN-Wrong length: %d", length);
+ *errtxt = errbuf;
+ return false;
+ }
+ data = next_uint16(buf);
+ if (data != nts_protocol_NTP) {
+ snprintf(errbuf, errlng,
+ "NPN-Bad data: %d", data);
+ *errtxt = errbuf;
+ return false;
+ }
+ break;
+ case nts_algorithm_negotiation:
+ if (length % sizeof(uint16_t) > 0) {
+ snprintf(errbuf, errlng,
+ "AN-Wrong length: %d", length);
+ *errtxt = errbuf;
+ return false;
+ }
+ for (int i=0; i<length; i+=sizeof(uint16_t)) {
+ data = next_uint16(buf);
+ if (0 == nts_get_key_length(data)) {
+ if (0) // for debugging
+ msyslog(LOG_ERR, "NTSs: AN-Unsupported AEAN type: %d", data);
+ continue; // ignore types we don't support
+ }
+ if (*aead != NO_AEAD)
+ continue; // already got one
+ *aead = data; // take this one
+ }
+ break;
+ case nts_end_of_message:
+ if ((0 != length) || !critical) {
+ snprintf(errbuf, errlng,
+ "EOM-Wrong length or not Critical: %d, %d",
+ length, critical);
+ *errtxt = errbuf;
+ return false;
+ }
+ if (0 != buf->left) {
+ snprintf(errbuf, errlng,
+ "EOM not at end: %d", buf->left);
+ *errtxt = errbuf;
+ return false;
+ }
+ return true;
+ default:
+ if (critical) {
+ // This only logs the first one from a connection
+ snprintf(errbuf, errlng,
+ "Received strange type: T=%d, C=%d, L=%d",
+ type, critical, length);
+ // There is an error code for this
+ return false;
+ }
+ // It might be interesting to log non-critical
+ // but that needs rate limiting
+ buf->next += length;
+ buf->left -= length;
+ break;
+ } // case
+ } // while
+
+ /* If we get here, we ran off the end without finding an EOM.
+ * nts_ssl_read() should have complained, so this check
+ * should never happen.
+ */
+ if (buf->left > 0) {
+ *errtxt = "*** Leftovers";
+ return false;
+ }
+
+ *errtxt = "*** Missing EOM";
+ return false;
}
void nts_ke_setup_send(struct BufCtl_t *buf, int aead,
uint8_t *c2s, uint8_t *s2c, int keylen) {
- /* 4.1.2 Next Protocol */
- ke_append_record_uint16(buf,
- NTS_CRITICAL+nts_next_protocol_negotiation, nts_protocol_NTP);
- /* 4.1.5 AEAD Algorithm List */
- ke_append_record_uint16(buf, nts_algorithm_negotiation, aead);
+ // 4.1.2 Next Protocol
+ ke_append_record_uint16(buf,
+ NTS_CRITICAL+nts_next_protocol_negotiation, nts_protocol_NTP);
+ // 4.1.5 AEAD Algorithm List
+ ke_append_record_uint16(buf, nts_algorithm_negotiation, aead);
- if (extra_port)
- ke_append_record_uint16(buf, nts_port_negotiation, extra_port);
+ if (extra_port)
+ ke_append_record_uint16(buf, nts_port_negotiation, extra_port);
- for (int i=0; i<NTS_MAX_COOKIES; i++) {
- uint8_t cookie[NTS_MAX_COOKIELEN];
- int cookielen = nts_make_cookie(cookie, aead, c2s, s2c, keylen);
- ke_append_record_bytes(buf, nts_new_cookie, cookie, cookielen);
- }
+ for (int i=0; i<NTS_MAX_COOKIES; i++) {
+ uint8_t cookie[NTS_MAX_COOKIELEN];
+ int cookielen = nts_make_cookie(cookie, aead, c2s, s2c, keylen);
+ ke_append_record_bytes(buf, nts_new_cookie, cookie, cookielen);
+ }
- /* 4.1.1: End, Critical */
- ke_append_record_null(buf, NTS_CRITICAL+nts_end_of_message);
+ // 4.1.1: End, Critical
+ ke_append_record_null(buf, NTS_CRITICAL+nts_end_of_message);
}
-/* end */
+// end
=====================================
ntpd/refclock_jjy.c
=====================================
The diff for this file was not included because it is too large.
=====================================
tests/ntpd/nts.c
=====================================
@@ -15,405 +15,405 @@ TEST_SETUP(nts) {}
TEST_TEAR_DOWN(nts) {}
TEST(nts, nts_translate_version) {
- TEST_ASSERT_EQUAL_INT32(0, nts_translate_version(NULL));
- TEST_ASSERT_EQUAL_INT32(TLS1_3_VERSION, nts_translate_version("TLS1.3"));
- TEST_ASSERT_EQUAL_INT32(-1, nts_translate_version("blah"));
+ TEST_ASSERT_EQUAL_INT32(0, nts_translate_version(NULL));
+ TEST_ASSERT_EQUAL_INT32(TLS1_3_VERSION, nts_translate_version("TLS1.3"));
+ TEST_ASSERT_EQUAL_INT32(-1, nts_translate_version("blah"));
}
TEST(nts, nts_string_to_aead) {
- TEST_ASSERT_EQUAL_INT16(AEAD_AES_SIV_CMAC_256,
- nts_string_to_aead("AES_SIV_CMAC_256"));
- TEST_ASSERT_EQUAL_INT16(AEAD_AES_SIV_CMAC_384,
- nts_string_to_aead("AES_SIV_CMAC_384"));
- TEST_ASSERT_EQUAL_INT16(AEAD_AES_SIV_CMAC_512,
- nts_string_to_aead("AES_SIV_CMAC_512"));
- TEST_ASSERT_EQUAL_INT16(NO_AEAD, nts_string_to_aead("blah"));
+ TEST_ASSERT_EQUAL_INT16(AEAD_AES_SIV_CMAC_256,
+ nts_string_to_aead("AES_SIV_CMAC_256"));
+ TEST_ASSERT_EQUAL_INT16(AEAD_AES_SIV_CMAC_384,
+ nts_string_to_aead("AES_SIV_CMAC_384"));
+ TEST_ASSERT_EQUAL_INT16(AEAD_AES_SIV_CMAC_512,
+ nts_string_to_aead("AES_SIV_CMAC_512"));
+ TEST_ASSERT_EQUAL_INT16(NO_AEAD, nts_string_to_aead("blah"));
}
TEST(nts, nts_get_key_length) {
- TEST_ASSERT_EQUAL_INT32(AEAD_AES_SIV_CMAC_256_KEYLEN,
- nts_get_key_length(AEAD_AES_SIV_CMAC_256));
- TEST_ASSERT_EQUAL_INT32(AEAD_AES_SIV_CMAC_384_KEYLEN,
- nts_get_key_length(AEAD_AES_SIV_CMAC_384));
- TEST_ASSERT_EQUAL_INT32(AEAD_AES_SIV_CMAC_512_KEYLEN,
- nts_get_key_length(AEAD_AES_SIV_CMAC_512));
- TEST_ASSERT_EQUAL_INT32(0, nts_get_key_length(-23));
+ TEST_ASSERT_EQUAL_INT32(AEAD_AES_SIV_CMAC_256_KEYLEN,
+ nts_get_key_length(AEAD_AES_SIV_CMAC_256));
+ TEST_ASSERT_EQUAL_INT32(AEAD_AES_SIV_CMAC_384_KEYLEN,
+ nts_get_key_length(AEAD_AES_SIV_CMAC_384));
+ TEST_ASSERT_EQUAL_INT32(AEAD_AES_SIV_CMAC_512_KEYLEN,
+ nts_get_key_length(AEAD_AES_SIV_CMAC_512));
+ TEST_ASSERT_EQUAL_INT32(0, nts_get_key_length(-23));
}
TEST(nts, ke_append_record_null) {
- /* Setup */
- uint8_t buf[128];
- BufCtl cursor;
- cursor.next = buf;
- cursor.left = 128;
- /* Run test */
- ke_append_record_null(&cursor, 0xFA7E);
- /* Check */
- TEST_ASSERT_EQUAL_UINT8(0xFA, buf[0]);
- TEST_ASSERT_EQUAL_UINT8(0x7E, buf[1]);
- TEST_ASSERT_EQUAL_UINT8(0, buf[2]);
- TEST_ASSERT_EQUAL_UINT8(0, buf[3]);
- TEST_ASSERT_POINTERS_EQUAL(&buf[4], cursor.next);
- TEST_ASSERT_EQUAL_INT(124, cursor.left);
+ // Setup
+ uint8_t buf[128];
+ BufCtl cursor;
+ cursor.next = buf;
+ cursor.left = 128;
+ // Run test
+ ke_append_record_null(&cursor, 0xFA7E);
+ // Check
+ TEST_ASSERT_EQUAL_UINT8(0xFA, buf[0]);
+ TEST_ASSERT_EQUAL_UINT8(0x7E, buf[1]);
+ TEST_ASSERT_EQUAL_UINT8(0, buf[2]);
+ TEST_ASSERT_EQUAL_UINT8(0, buf[3]);
+ TEST_ASSERT_POINTERS_EQUAL(&buf[4], cursor.next);
+ TEST_ASSERT_EQUAL_INT(124, cursor.left);
}
TEST(nts, ke_append_record_uint16) {
- /* Test change */
- /* Setup */
- uint8_t buf[16] = {0, 0, 0, 0, 0, 0, 0, 0,
- 0, 0, 0, 0, 0, 0, 0, 0};
- BufCtl cursor;
- cursor.next = buf;
- cursor.left = 16;
- /* Run test */
- ke_append_record_uint16(&cursor, 0xCAFE, 0x1234);
- /* Check */
- TEST_ASSERT_EQUAL_UINT8(0xCA, buf[0]);
- TEST_ASSERT_EQUAL_UINT8(0xFE, buf[1]);
- TEST_ASSERT_EQUAL_UINT8(0x00, buf[2]);
- TEST_ASSERT_EQUAL_UINT8(0x02, buf[3]);
- TEST_ASSERT_EQUAL_UINT8(0x12, buf[4]);
- TEST_ASSERT_EQUAL_UINT8(0x34, buf[5]);
- TEST_ASSERT_POINTERS_EQUAL(&buf[6], cursor.next);
- TEST_ASSERT_EQUAL_INT(10, cursor.left);
- /* Test no change */
- /* Setup */
- cursor.left = 0;
- /* Run test */
- ke_append_record_uint16(&cursor, 0xCAFE, 0x1234);
- /* Check */
- TEST_ASSERT_EQUAL_UINT8(0, buf[6]);
- TEST_ASSERT_POINTERS_EQUAL(&buf[6], cursor.next);
- TEST_ASSERT_EQUAL_INT(0, cursor.left);
+ // Test change
+ // Setup
+ uint8_t buf[16] = {0, 0, 0, 0, 0, 0, 0, 0,
+ 0, 0, 0, 0, 0, 0, 0, 0};
+ BufCtl cursor;
+ cursor.next = buf;
+ cursor.left = 16;
+ // Run test
+ ke_append_record_uint16(&cursor, 0xCAFE, 0x1234);
+ // Check
+ TEST_ASSERT_EQUAL_UINT8(0xCA, buf[0]);
+ TEST_ASSERT_EQUAL_UINT8(0xFE, buf[1]);
+ TEST_ASSERT_EQUAL_UINT8(0x00, buf[2]);
+ TEST_ASSERT_EQUAL_UINT8(0x02, buf[3]);
+ TEST_ASSERT_EQUAL_UINT8(0x12, buf[4]);
+ TEST_ASSERT_EQUAL_UINT8(0x34, buf[5]);
+ TEST_ASSERT_POINTERS_EQUAL(&buf[6], cursor.next);
+ TEST_ASSERT_EQUAL_INT(10, cursor.left);
+ // Test no change
+ // Setup
+ cursor.left = 0;
+ // Run test
+ ke_append_record_uint16(&cursor, 0xCAFE, 0x1234);
+ // Check
+ TEST_ASSERT_EQUAL_UINT8(0, buf[6]);
+ TEST_ASSERT_POINTERS_EQUAL(&buf[6], cursor.next);
+ TEST_ASSERT_EQUAL_INT(0, cursor.left);
}
TEST(nts, ke_append_record_bytes) {
- /* Test change */
- /* Setup */
- uint8_t buf[16] = {0, 0, 0, 0, 0, 0, 0, 0,
- 0, 0, 0, 0, 0, 0, 0, 0};
- BufCtl cursor;
- cursor.next = buf;
- cursor.left = 16;
- uint8_t data[6] = {0, 1, 2, 3, 4, 5};
- /* Run test */
- ke_append_record_bytes(&cursor, 0xCAFE, data, 6);
- /* Check */
- TEST_ASSERT_EQUAL_UINT8(0xCA, buf[0]);
- TEST_ASSERT_EQUAL_UINT8(0xFE, buf[1]);
- TEST_ASSERT_EQUAL_UINT8(0x00, buf[2]);
- TEST_ASSERT_EQUAL_UINT8(0x06, buf[3]);
- TEST_ASSERT_EQUAL_UINT8(0, buf[4]);
- TEST_ASSERT_EQUAL_UINT8(1, buf[5]);
- TEST_ASSERT_EQUAL_UINT8(2, buf[6]);
- TEST_ASSERT_EQUAL_UINT8(3, buf[7]);
- TEST_ASSERT_EQUAL_UINT8(4, buf[8]);
- TEST_ASSERT_EQUAL_UINT8(5, buf[9]);
- TEST_ASSERT_POINTERS_EQUAL(&buf[10], cursor.next);
- TEST_ASSERT_EQUAL_INT(6, cursor.left);
- /* Test no change */
- /* Setup */
- cursor.left = 0;
- /* Run test */
- ke_append_record_bytes(&cursor, 0xCAFE, data, 6);
- /* Check */
- TEST_ASSERT_EQUAL_UINT8(0, buf[10]);
- TEST_ASSERT_POINTERS_EQUAL(&buf[10], cursor.next);
- TEST_ASSERT_EQUAL_INT(0, cursor.left);
+ // Test change
+ // Setup
+ uint8_t buf[16] = {0, 0, 0, 0, 0, 0, 0, 0,
+ 0, 0, 0, 0, 0, 0, 0, 0};
+ BufCtl cursor;
+ cursor.next = buf;
+ cursor.left = 16;
+ uint8_t data[6] = {0, 1, 2, 3, 4, 5};
+ // Run test
+ ke_append_record_bytes(&cursor, 0xCAFE, data, 6);
+ // Check
+ TEST_ASSERT_EQUAL_UINT8(0xCA, buf[0]);
+ TEST_ASSERT_EQUAL_UINT8(0xFE, buf[1]);
+ TEST_ASSERT_EQUAL_UINT8(0x00, buf[2]);
+ TEST_ASSERT_EQUAL_UINT8(0x06, buf[3]);
+ TEST_ASSERT_EQUAL_UINT8(0, buf[4]);
+ TEST_ASSERT_EQUAL_UINT8(1, buf[5]);
+ TEST_ASSERT_EQUAL_UINT8(2, buf[6]);
+ TEST_ASSERT_EQUAL_UINT8(3, buf[7]);
+ TEST_ASSERT_EQUAL_UINT8(4, buf[8]);
+ TEST_ASSERT_EQUAL_UINT8(5, buf[9]);
+ TEST_ASSERT_POINTERS_EQUAL(&buf[10], cursor.next);
+ TEST_ASSERT_EQUAL_INT(6, cursor.left);
+ // Test no change
+ // Setup
+ cursor.left = 0;
+ // Run test
+ ke_append_record_bytes(&cursor, 0xCAFE, data, 6);
+ // Check
+ TEST_ASSERT_EQUAL_UINT8(0, buf[10]);
+ TEST_ASSERT_POINTERS_EQUAL(&buf[10], cursor.next);
+ TEST_ASSERT_EQUAL_INT(0, cursor.left);
}
TEST(nts, ex_append_record_null) {
- /* Setup */
- uint8_t buf[16] = {0, 0, 0, 0, 0, 0, 0, 0,
- 0, 0, 0, 0, 0, 0, 0, 0};
- BufCtl cursor;
- cursor.next = buf;
- cursor.left = 16;
- /* Run test */
- ex_append_record_null(&cursor, 0xFADE);
- /* Check */
- TEST_ASSERT_EQUAL_UINT8(0xFA, buf[0]);
- TEST_ASSERT_EQUAL_UINT8(0xDE, buf[1]);
- TEST_ASSERT_EQUAL_UINT8(0, buf[2]);
- TEST_ASSERT_EQUAL_UINT8(4, buf[3]);
- TEST_ASSERT_EQUAL_UINT8(0, buf[4]);
- TEST_ASSERT_POINTERS_EQUAL(&buf[4], cursor.next);
- TEST_ASSERT_EQUAL_INT(12, cursor.left);
+ // Setup
+ uint8_t buf[16] = {0, 0, 0, 0, 0, 0, 0, 0,
+ 0, 0, 0, 0, 0, 0, 0, 0};
+ BufCtl cursor;
+ cursor.next = buf;
+ cursor.left = 16;
+ // Run test
+ ex_append_record_null(&cursor, 0xFADE);
+ // Check
+ TEST_ASSERT_EQUAL_UINT8(0xFA, buf[0]);
+ TEST_ASSERT_EQUAL_UINT8(0xDE, buf[1]);
+ TEST_ASSERT_EQUAL_UINT8(0, buf[2]);
+ TEST_ASSERT_EQUAL_UINT8(4, buf[3]);
+ TEST_ASSERT_EQUAL_UINT8(0, buf[4]);
+ TEST_ASSERT_POINTERS_EQUAL(&buf[4], cursor.next);
+ TEST_ASSERT_EQUAL_INT(12, cursor.left);
}
TEST(nts, ex_append_record_uint16) {
- /* Setup */
- uint8_t buf[16] = {0, 0, 0, 0, 0, 0, 0, 0,
- 0, 0, 0, 0, 0, 0, 0, 0};
- BufCtl cursor;
- cursor.next = buf;
- cursor.left = 16;
- /* Run test */
- ex_append_record_uint16(&cursor, 0xFADE, 0x1234);
- /* Check */
- TEST_ASSERT_EQUAL_UINT8(0xFA, buf[0]);
- TEST_ASSERT_EQUAL_UINT8(0xDE, buf[1]);
- TEST_ASSERT_EQUAL_UINT8(0x00, buf[2]);
- TEST_ASSERT_EQUAL_UINT8(0x06, buf[3]);
- TEST_ASSERT_EQUAL_UINT8(0x12, buf[4]);
- TEST_ASSERT_EQUAL_UINT8(0x34, buf[5]);
- TEST_ASSERT_EQUAL_UINT8(0, buf[6]);
- TEST_ASSERT_POINTERS_EQUAL(&buf[6], cursor.next);
- TEST_ASSERT_EQUAL_INT(10, cursor.left);
- /* Test no change */
- /* Setup */
- cursor.left = 0;
- /* Run test */
- ke_append_record_uint16(&cursor, 0xCAFE, 0x1234);
- /* Check */
- TEST_ASSERT_EQUAL_UINT8(0, buf[6]);
- TEST_ASSERT_POINTERS_EQUAL(&buf[6], cursor.next);
- TEST_ASSERT_EQUAL_INT(0, cursor.left);
+ // Setup
+ uint8_t buf[16] = {0, 0, 0, 0, 0, 0, 0, 0,
+ 0, 0, 0, 0, 0, 0, 0, 0};
+ BufCtl cursor;
+ cursor.next = buf;
+ cursor.left = 16;
+ // Run test
+ ex_append_record_uint16(&cursor, 0xFADE, 0x1234);
+ // Check
+ TEST_ASSERT_EQUAL_UINT8(0xFA, buf[0]);
+ TEST_ASSERT_EQUAL_UINT8(0xDE, buf[1]);
+ TEST_ASSERT_EQUAL_UINT8(0x00, buf[2]);
+ TEST_ASSERT_EQUAL_UINT8(0x06, buf[3]);
+ TEST_ASSERT_EQUAL_UINT8(0x12, buf[4]);
+ TEST_ASSERT_EQUAL_UINT8(0x34, buf[5]);
+ TEST_ASSERT_EQUAL_UINT8(0, buf[6]);
+ TEST_ASSERT_POINTERS_EQUAL(&buf[6], cursor.next);
+ TEST_ASSERT_EQUAL_INT(10, cursor.left);
+ // Test no change
+ // Setup
+ cursor.left = 0;
+ // Run test
+ ke_append_record_uint16(&cursor, 0xCAFE, 0x1234);
+ // Check
+ TEST_ASSERT_EQUAL_UINT8(0, buf[6]);
+ TEST_ASSERT_POINTERS_EQUAL(&buf[6], cursor.next);
+ TEST_ASSERT_EQUAL_INT(0, cursor.left);
}
TEST(nts, ex_append_record_bytes) {
- /* Test change */
- /* Setup */
- uint8_t buf[16] = {0, 0, 0, 0, 0, 0, 0, 0,
- 0, 0, 0, 0, 0, 0, 0, 0};
- BufCtl cursor;
- cursor.next = buf;
- cursor.left = 16;
- uint8_t data[6] = {0, 1, 2, 3, 4, 5};
- /* Run test */
- ex_append_record_bytes(&cursor, 0xCAFE, data, 6);
- /* Check */
- TEST_ASSERT_EQUAL_UINT8(0xCA, buf[0]);
- TEST_ASSERT_EQUAL_UINT8(0xFE, buf[1]);
- TEST_ASSERT_EQUAL_UINT8(0x00, buf[2]);
- TEST_ASSERT_EQUAL_UINT8(0x0A, buf[3]);
- TEST_ASSERT_EQUAL_UINT8(0, buf[4]);
- TEST_ASSERT_EQUAL_UINT8(1, buf[5]);
- TEST_ASSERT_EQUAL_UINT8(2, buf[6]);
- TEST_ASSERT_EQUAL_UINT8(3, buf[7]);
- TEST_ASSERT_EQUAL_UINT8(4, buf[8]);
- TEST_ASSERT_EQUAL_UINT8(5, buf[9]);
- TEST_ASSERT_POINTERS_EQUAL(&buf[10], cursor.next);
- TEST_ASSERT_EQUAL_INT(6, cursor.left);
- /* Test no change */
- /* Setup */
- cursor.left = 0;
- /* Run test */
- ex_append_record_bytes(&cursor, 0xCAFE, data, 6);
- /* Check */
- TEST_ASSERT_EQUAL_UINT8(0, buf[10]);
- TEST_ASSERT_POINTERS_EQUAL(&buf[10], cursor.next);
- TEST_ASSERT_EQUAL_INT(0, cursor.left);
+ // Test change
+ // Setup
+ uint8_t buf[16] = {0, 0, 0, 0, 0, 0, 0, 0,
+ 0, 0, 0, 0, 0, 0, 0, 0};
+ BufCtl cursor;
+ cursor.next = buf;
+ cursor.left = 16;
+ uint8_t data[6] = {0, 1, 2, 3, 4, 5};
+ // Run test
+ ex_append_record_bytes(&cursor, 0xCAFE, data, 6);
+ // Check
+ TEST_ASSERT_EQUAL_UINT8(0xCA, buf[0]);
+ TEST_ASSERT_EQUAL_UINT8(0xFE, buf[1]);
+ TEST_ASSERT_EQUAL_UINT8(0x00, buf[2]);
+ TEST_ASSERT_EQUAL_UINT8(0x0A, buf[3]);
+ TEST_ASSERT_EQUAL_UINT8(0, buf[4]);
+ TEST_ASSERT_EQUAL_UINT8(1, buf[5]);
+ TEST_ASSERT_EQUAL_UINT8(2, buf[6]);
+ TEST_ASSERT_EQUAL_UINT8(3, buf[7]);
+ TEST_ASSERT_EQUAL_UINT8(4, buf[8]);
+ TEST_ASSERT_EQUAL_UINT8(5, buf[9]);
+ TEST_ASSERT_POINTERS_EQUAL(&buf[10], cursor.next);
+ TEST_ASSERT_EQUAL_INT(6, cursor.left);
+ // Test no change
+ // Setup
+ cursor.left = 0;
+ // Run test
+ ex_append_record_bytes(&cursor, 0xCAFE, data, 6);
+ // Check
+ TEST_ASSERT_EQUAL_UINT8(0, buf[10]);
+ TEST_ASSERT_POINTERS_EQUAL(&buf[10], cursor.next);
+ TEST_ASSERT_EQUAL_INT(0, cursor.left);
}
TEST(nts, ex_append_header) {
- /* Test change */
- /* Setup */
- uint8_t buf[16] = {0, 0, 0, 0, 0, 0, 0, 0,
- 0, 0, 0, 0, 0, 0, 0, 0};
- BufCtl cursor;
- cursor.next = buf;
- cursor.left = 16;
- /* Run test */
- ex_append_header(&cursor, 0xFADE, 0x1234);
- /* Check */
- TEST_ASSERT_EQUAL_UINT8(0xFA, buf[0]);
- TEST_ASSERT_EQUAL_UINT8(0xDE, buf[1]);
- TEST_ASSERT_EQUAL_UINT8(0x12, buf[2]);
- TEST_ASSERT_EQUAL_UINT8(0x38, buf[3]);
- TEST_ASSERT_EQUAL_UINT8(0, buf[4]);
- TEST_ASSERT_POINTERS_EQUAL(&buf[4], cursor.next);
- TEST_ASSERT_EQUAL_INT(12, cursor.left);
- /* Test no change */
- /* Setup */
- cursor.left = 0;
- /* Run test */
- ex_append_header(&cursor, 0xFEED, 0xABCD);
- /* Check */
- TEST_ASSERT_EQUAL_UINT8(0, buf[4]);
- TEST_ASSERT_POINTERS_EQUAL(&buf[4], cursor.next);
- TEST_ASSERT_EQUAL_INT(0, cursor.left);
+ // Test change
+ // Setup
+ uint8_t buf[16] = {0, 0, 0, 0, 0, 0, 0, 0,
+ 0, 0, 0, 0, 0, 0, 0, 0};
+ BufCtl cursor;
+ cursor.next = buf;
+ cursor.left = 16;
+ // Run test
+ ex_append_header(&cursor, 0xFADE, 0x1234);
+ // Check
+ TEST_ASSERT_EQUAL_UINT8(0xFA, buf[0]);
+ TEST_ASSERT_EQUAL_UINT8(0xDE, buf[1]);
+ TEST_ASSERT_EQUAL_UINT8(0x12, buf[2]);
+ TEST_ASSERT_EQUAL_UINT8(0x38, buf[3]);
+ TEST_ASSERT_EQUAL_UINT8(0, buf[4]);
+ TEST_ASSERT_POINTERS_EQUAL(&buf[4], cursor.next);
+ TEST_ASSERT_EQUAL_INT(12, cursor.left);
+ // Test no change
+ // Setup
+ cursor.left = 0;
+ // Run test
+ ex_append_header(&cursor, 0xFEED, 0xABCD);
+ // Check
+ TEST_ASSERT_EQUAL_UINT8(0, buf[4]);
+ TEST_ASSERT_POINTERS_EQUAL(&buf[4], cursor.next);
+ TEST_ASSERT_EQUAL_INT(0, cursor.left);
}
TEST(nts, append_header) {
- /* Test change */
- /* Setup */
- uint8_t buf[16] = {0, 0, 0, 0, 0, 0, 0, 0,
- 0, 0, 0, 0, 0, 0, 0, 0};
- BufCtl cursor;
- cursor.next = buf;
- cursor.left = 16;
- /* Run test */
- append_header(&cursor, 0xFADE, 0x1234);
- /* Check */
- TEST_ASSERT_EQUAL_UINT8(0xFA, buf[0]);
- TEST_ASSERT_EQUAL_UINT8(0xDE, buf[1]);
- TEST_ASSERT_EQUAL_UINT8(0x12, buf[2]);
- TEST_ASSERT_EQUAL_UINT8(0x34, buf[3]);
- TEST_ASSERT_EQUAL_UINT8(0, buf[4]);
- TEST_ASSERT_POINTERS_EQUAL(&buf[4], cursor.next);
- TEST_ASSERT_EQUAL_INT(12, cursor.left);
- /* Test no change */
- /* Setup */
- cursor.left = 0;
- /* Run test */
- append_header(&cursor, 0xFEED, 0xABCD);
- /* Check */
- TEST_ASSERT_EQUAL_UINT8(0, buf[4]);
- TEST_ASSERT_POINTERS_EQUAL(&buf[4], cursor.next);
- TEST_ASSERT_EQUAL_INT(0, cursor.left);
+ // Test change
+ // Setup
+ uint8_t buf[16] = {0, 0, 0, 0, 0, 0, 0, 0,
+ 0, 0, 0, 0, 0, 0, 0, 0};
+ BufCtl cursor;
+ cursor.next = buf;
+ cursor.left = 16;
+ // Run test
+ append_header(&cursor, 0xFADE, 0x1234);
+ // Check
+ TEST_ASSERT_EQUAL_UINT8(0xFA, buf[0]);
+ TEST_ASSERT_EQUAL_UINT8(0xDE, buf[1]);
+ TEST_ASSERT_EQUAL_UINT8(0x12, buf[2]);
+ TEST_ASSERT_EQUAL_UINT8(0x34, buf[3]);
+ TEST_ASSERT_EQUAL_UINT8(0, buf[4]);
+ TEST_ASSERT_POINTERS_EQUAL(&buf[4], cursor.next);
+ TEST_ASSERT_EQUAL_INT(12, cursor.left);
+ // Test no change
+ // Setup
+ cursor.left = 0;
+ // Run test
+ append_header(&cursor, 0xFEED, 0xABCD);
+ // Check
+ TEST_ASSERT_EQUAL_UINT8(0, buf[4]);
+ TEST_ASSERT_POINTERS_EQUAL(&buf[4], cursor.next);
+ TEST_ASSERT_EQUAL_INT(0, cursor.left);
}
TEST(nts, append_uint16) {
- /* Test change */
- /* Setup */
- uint8_t buf[16] = {0, 0, 0, 0, 0, 0, 0, 0,
- 0, 0, 0, 0, 0, 0, 0, 0};
- BufCtl cursor;
- cursor.next = buf;
- cursor.left = 16;
- /* Run test */
- append_uint16(&cursor, 0x1234);
- /* Check */
- TEST_ASSERT_EQUAL_UINT8(0x12, buf[0]);
- TEST_ASSERT_EQUAL_UINT8(0x34, buf[1]);
- TEST_ASSERT_POINTERS_EQUAL(&buf[2], cursor.next);
- TEST_ASSERT_EQUAL_INT(14, cursor.left);
- /* Test no change */
- /* Setup */
- cursor.left = 0;
- /* Run test */
- append_uint16(&cursor, 0x5678);
- /* Check */
- TEST_ASSERT_EQUAL_UINT8(0, buf[2]);
- TEST_ASSERT_POINTERS_EQUAL(&buf[2], cursor.next);
- TEST_ASSERT_EQUAL_INT(0, cursor.left);
+ // Test change
+ // Setup
+ uint8_t buf[16] = {0, 0, 0, 0, 0, 0, 0, 0,
+ 0, 0, 0, 0, 0, 0, 0, 0};
+ BufCtl cursor;
+ cursor.next = buf;
+ cursor.left = 16;
+ // Run test
+ append_uint16(&cursor, 0x1234);
+ // Check
+ TEST_ASSERT_EQUAL_UINT8(0x12, buf[0]);
+ TEST_ASSERT_EQUAL_UINT8(0x34, buf[1]);
+ TEST_ASSERT_POINTERS_EQUAL(&buf[2], cursor.next);
+ TEST_ASSERT_EQUAL_INT(14, cursor.left);
+ // Test no change
+ // Setup
+ cursor.left = 0;
+ // Run test
+ append_uint16(&cursor, 0x5678);
+ // Check
+ TEST_ASSERT_EQUAL_UINT8(0, buf[2]);
+ TEST_ASSERT_POINTERS_EQUAL(&buf[2], cursor.next);
+ TEST_ASSERT_EQUAL_INT(0, cursor.left);
}
TEST(nts, append_bytes) {
- /* Test change */
- /* Setup */
- uint8_t buf[16] = {0, 0, 0, 0, 0, 0, 0, 0,
- 0, 0, 0, 0, 0, 0, 0, 0};
- BufCtl cursor;
- cursor.next = buf;
- cursor.left = 16;
- uint8_t data[6] = {0, 1, 2, 3, 4, 5};
- /* Run test */
- append_bytes(&cursor, data, 6);
- /* Check */
- TEST_ASSERT_EQUAL_UINT8(0, buf[0]);
- TEST_ASSERT_EQUAL_UINT8(1, buf[1]);
- TEST_ASSERT_EQUAL_UINT8(2, buf[2]);
- TEST_ASSERT_EQUAL_UINT8(3, buf[3]);
- TEST_ASSERT_EQUAL_UINT8(4, buf[4]);
- TEST_ASSERT_EQUAL_UINT8(5, buf[5]);
- TEST_ASSERT_POINTERS_EQUAL(&buf[6], cursor.next);
- TEST_ASSERT_EQUAL_INT(10, cursor.left);
- /* Test no change */
- /* Setup */
- cursor.left = 0;
- /* Run test */
- append_bytes(&cursor, data, 6);
- /* Check */
- TEST_ASSERT_EQUAL_UINT8(0, buf[6]);
- TEST_ASSERT_POINTERS_EQUAL(&buf[6], cursor.next);
- TEST_ASSERT_EQUAL_INT(0, cursor.left);
+ // Test change
+ // Setup
+ uint8_t buf[16] = {0, 0, 0, 0, 0, 0, 0, 0,
+ 0, 0, 0, 0, 0, 0, 0, 0};
+ BufCtl cursor;
+ cursor.next = buf;
+ cursor.left = 16;
+ uint8_t data[6] = {0, 1, 2, 3, 4, 5};
+ // Run test
+ append_bytes(&cursor, data, 6);
+ // Check
+ TEST_ASSERT_EQUAL_UINT8(0, buf[0]);
+ TEST_ASSERT_EQUAL_UINT8(1, buf[1]);
+ TEST_ASSERT_EQUAL_UINT8(2, buf[2]);
+ TEST_ASSERT_EQUAL_UINT8(3, buf[3]);
+ TEST_ASSERT_EQUAL_UINT8(4, buf[4]);
+ TEST_ASSERT_EQUAL_UINT8(5, buf[5]);
+ TEST_ASSERT_POINTERS_EQUAL(&buf[6], cursor.next);
+ TEST_ASSERT_EQUAL_INT(10, cursor.left);
+ // Test no change
+ // Setup
+ cursor.left = 0;
+ // Run test
+ append_bytes(&cursor, data, 6);
+ // Check
+ TEST_ASSERT_EQUAL_UINT8(0, buf[6]);
+ TEST_ASSERT_POINTERS_EQUAL(&buf[6], cursor.next);
+ TEST_ASSERT_EQUAL_INT(0, cursor.left);
}
TEST(nts, ke_next_record) {
- /* Setup */
- uint8_t buf[16] = {0xFA, 0xCE, 0, 4, 0xFF, 0xEE, 0xDD, 0xCC,
- 0, 0, 0, 0, 0, 0, 0, 0};
- BufCtl cursor;
- cursor.next = buf;
- cursor.left = 16;
- int length;
- uint16_t type;
- /* Run test */
- type = ke_next_record(&cursor, &length);
- /* Check */
- TEST_ASSERT_EQUAL_INT(4, length);
- TEST_ASSERT_EQUAL_INT(0xFACE, type);
- TEST_ASSERT_POINTERS_EQUAL(&buf[4], cursor.next);
- TEST_ASSERT_EQUAL_INT(12, cursor.left);
+ // Setup
+ uint8_t buf[16] = {0xFA, 0xCE, 0, 4, 0xFF, 0xEE, 0xDD, 0xCC,
+ 0, 0, 0, 0, 0, 0, 0, 0};
+ BufCtl cursor;
+ cursor.next = buf;
+ cursor.left = 16;
+ int length;
+ uint16_t type;
+ // Run test
+ type = ke_next_record(&cursor, &length);
+ // Check
+ TEST_ASSERT_EQUAL_INT(4, length);
+ TEST_ASSERT_EQUAL_INT(0xFACE, type);
+ TEST_ASSERT_POINTERS_EQUAL(&buf[4], cursor.next);
+ TEST_ASSERT_EQUAL_INT(12, cursor.left);
}
TEST(nts, ex_next_record) {
- /* Setup */
- uint8_t buf[16] = {0xFA, 0xCE, 0, 8, 0xFF, 0xEE, 0xDD, 0xCC,
- 0, 0, 0, 0, 0, 0, 0, 0};
- BufCtl cursor;
- cursor.next = buf;
- cursor.left = 16;
- int length;
- uint16_t type;
- /* Run test */
- type = ex_next_record(&cursor, &length);
- /* Check */
- TEST_ASSERT_EQUAL_INT(4, length);
- TEST_ASSERT_EQUAL_INT(0xFACE, type);
- TEST_ASSERT_POINTERS_EQUAL(&buf[4], cursor.next);
- TEST_ASSERT_EQUAL_INT(12, cursor.left);
+ // Setup
+ uint8_t buf[16] = {0xFA, 0xCE, 0, 8, 0xFF, 0xEE, 0xDD, 0xCC,
+ 0, 0, 0, 0, 0, 0, 0, 0};
+ BufCtl cursor;
+ cursor.next = buf;
+ cursor.left = 16;
+ int length;
+ uint16_t type;
+ // Run test
+ type = ex_next_record(&cursor, &length);
+ // Check
+ TEST_ASSERT_EQUAL_INT(4, length);
+ TEST_ASSERT_EQUAL_INT(0xFACE, type);
+ TEST_ASSERT_POINTERS_EQUAL(&buf[4], cursor.next);
+ TEST_ASSERT_EQUAL_INT(12, cursor.left);
}
TEST(nts, next_uint16) {
- /* Setup */
- uint8_t buf[16] = {0xFA, 0xCE, 0, 4, 0xFF, 0xEE, 0xDD, 0xCC,
- 0, 0, 0, 0, 0, 0, 0, 0};
- BufCtl cursor;
- cursor.next = buf;
- cursor.left = 16;
- uint16_t data;
- /* Run test */
- data = next_uint16(&cursor);
- /* Check */
- TEST_ASSERT_EQUAL_UINT8(0xFACE, data);
- TEST_ASSERT_POINTERS_EQUAL(&buf[2], cursor.next);
- TEST_ASSERT_EQUAL_INT(14, cursor.left);
+ // Setup
+ uint8_t buf[16] = {0xFA, 0xCE, 0, 4, 0xFF, 0xEE, 0xDD, 0xCC,
+ 0, 0, 0, 0, 0, 0, 0, 0};
+ BufCtl cursor;
+ cursor.next = buf;
+ cursor.left = 16;
+ uint16_t data;
+ // Run test
+ data = next_uint16(&cursor);
+ // Check
+ TEST_ASSERT_EQUAL_UINT8(0xFACE, data);
+ TEST_ASSERT_POINTERS_EQUAL(&buf[2], cursor.next);
+ TEST_ASSERT_EQUAL_INT(14, cursor.left);
}
TEST(nts, next_bytes) {
- /* Setup */
- uint8_t buf[16] = {0xFA, 0xCE, 0, 4, 0xFF, 0xEE, 0xDD, 0xCC,
- 0, 0, 0, 0, 0, 0, 0, 0};
- BufCtl cursor;
- cursor.next = buf;
- cursor.left = 16;
- uint8_t data[8];
- uint16_t length;
- /* Run test */
- length = next_bytes(&cursor, data, 8);
- /* Check */
- TEST_ASSERT_EQUAL_INT(8, length);
- TEST_ASSERT_EQUAL_UINT8(0xFA, data[0]);
- TEST_ASSERT_EQUAL_UINT8(0xCE, data[1]);
- TEST_ASSERT_EQUAL_UINT8(0, data[2]);
- TEST_ASSERT_EQUAL_UINT8(4, data[3]);
- TEST_ASSERT_EQUAL_UINT8(0xFF, data[4]);
- TEST_ASSERT_EQUAL_UINT8(0xEE, data[5]);
- TEST_ASSERT_EQUAL_UINT8(0xDD, data[6]);
- TEST_ASSERT_EQUAL_UINT8(0xCC, data[7]);
- TEST_ASSERT_POINTERS_EQUAL(&buf[8], cursor.next);
- TEST_ASSERT_EQUAL_INT(8, cursor.left);
+ // Setup
+ uint8_t buf[16] = {0xFA, 0xCE, 0, 4, 0xFF, 0xEE, 0xDD, 0xCC,
+ 0, 0, 0, 0, 0, 0, 0, 0};
+ BufCtl cursor;
+ cursor.next = buf;
+ cursor.left = 16;
+ uint8_t data[8];
+ uint16_t length;
+ // Run test
+ length = next_bytes(&cursor, data, 8);
+ // Check
+ TEST_ASSERT_EQUAL_INT(8, length);
+ TEST_ASSERT_EQUAL_UINT8(0xFA, data[0]);
+ TEST_ASSERT_EQUAL_UINT8(0xCE, data[1]);
+ TEST_ASSERT_EQUAL_UINT8(0, data[2]);
+ TEST_ASSERT_EQUAL_UINT8(4, data[3]);
+ TEST_ASSERT_EQUAL_UINT8(0xFF, data[4]);
+ TEST_ASSERT_EQUAL_UINT8(0xEE, data[5]);
+ TEST_ASSERT_EQUAL_UINT8(0xDD, data[6]);
+ TEST_ASSERT_EQUAL_UINT8(0xCC, data[7]);
+ TEST_ASSERT_POINTERS_EQUAL(&buf[8], cursor.next);
+ TEST_ASSERT_EQUAL_INT(8, cursor.left);
}
TEST_GROUP_RUNNER(nts) {
- RUN_TEST_CASE(nts, nts_translate_version);
- RUN_TEST_CASE(nts, nts_string_to_aead);
- RUN_TEST_CASE(nts, nts_get_key_length);
- RUN_TEST_CASE(nts, ke_append_record_null);
- RUN_TEST_CASE(nts, ke_append_record_uint16);
- RUN_TEST_CASE(nts, ke_append_record_bytes);
- RUN_TEST_CASE(nts, ex_append_record_null);
- RUN_TEST_CASE(nts, ex_append_record_uint16);
- RUN_TEST_CASE(nts, ex_append_record_bytes);
- RUN_TEST_CASE(nts, ex_append_header);
- RUN_TEST_CASE(nts, append_header);
- RUN_TEST_CASE(nts, append_uint16);
- RUN_TEST_CASE(nts, append_bytes);
- RUN_TEST_CASE(nts, ke_next_record);
- RUN_TEST_CASE(nts, ex_next_record);
- RUN_TEST_CASE(nts, next_uint16);
- RUN_TEST_CASE(nts, next_bytes);
+ RUN_TEST_CASE(nts, nts_translate_version);
+ RUN_TEST_CASE(nts, nts_string_to_aead);
+ RUN_TEST_CASE(nts, nts_get_key_length);
+ RUN_TEST_CASE(nts, ke_append_record_null);
+ RUN_TEST_CASE(nts, ke_append_record_uint16);
+ RUN_TEST_CASE(nts, ke_append_record_bytes);
+ RUN_TEST_CASE(nts, ex_append_record_null);
+ RUN_TEST_CASE(nts, ex_append_record_uint16);
+ RUN_TEST_CASE(nts, ex_append_record_bytes);
+ RUN_TEST_CASE(nts, ex_append_header);
+ RUN_TEST_CASE(nts, append_header);
+ RUN_TEST_CASE(nts, append_uint16);
+ RUN_TEST_CASE(nts, append_bytes);
+ RUN_TEST_CASE(nts, ke_next_record);
+ RUN_TEST_CASE(nts, ex_next_record);
+ RUN_TEST_CASE(nts, next_uint16);
+ RUN_TEST_CASE(nts, next_bytes);
}
=====================================
tests/ntpd/nts_cookie.c
=====================================
@@ -22,99 +22,99 @@ TEST_SETUP(nts_cookie) {}
TEST_TEAR_DOWN(nts_cookie) {}
TEST(nts_cookie, nts_make_cookie_key) {
- /* init */
- struct NTS_Key k0 = {.K={1, 2, 3, 4, 5}, .I=123};
- struct NTS_Key k1 = {.K={10, 20, 30, 40, 50}, .I=456};
- /* copy to key variables */
- nts_keys[0] = k0;
- nts_keys[1] = k1;
- /* run test */
- nts_nKeys = 2;
- nts_make_cookie_key(); /* push k0 to k1 */
- /* check that K[1] now equals former-K[0] */
- TEST_ASSERT_EQUAL_UINT8_ARRAY(nts_keys[1].K, k0.K, NTS_MAX_KEYLEN);
- TEST_ASSERT_EQUAL(nts_keys[1].I, k0.I);
- /* check that K[0] does not equal former-K[0] */
- /* There is no "TEST UNEQUAL", do it manually */
- bool equal = true;
- for (unsigned int i = 0; i < NTS_MAX_KEYLEN; i++) {
- if (nts_keys[0].K[i] != k0.K[i]) {
- equal = false;
- break;
- }
- }
- TEST_ASSERT_EQUAL(false, equal);
- /* Check that I[0] does not equal former-I[0] */
- TEST_ASSERT_NOT_EQUAL(nts_keys[0].I, k0.I);
+ // init
+ struct NTS_Key k0 = {.K={1, 2, 3, 4, 5}, .I=123};
+ struct NTS_Key k1 = {.K={10, 20, 30, 40, 50}, .I=456};
+ // copy to key variables
+ nts_keys[0] = k0;
+ nts_keys[1] = k1;
+ // run test
+ nts_nKeys = 2;
+ nts_make_cookie_key(); // push k0 to k1
+ // check that K[1] now equals former-K[0]
+ TEST_ASSERT_EQUAL_UINT8_ARRAY(nts_keys[1].K, k0.K, NTS_MAX_KEYLEN);
+ TEST_ASSERT_EQUAL(nts_keys[1].I, k0.I);
+ // check that K[0] does not equal former-K[0]
+ // There is no "TEST UNEQUAL", do it manually
+ bool equal = true;
+ for (unsigned int i = 0; i < NTS_MAX_KEYLEN; i++) {
+ if (nts_keys[0].K[i] != k0.K[i]) {
+ equal = false;
+ break;
+ }
+ }
+ TEST_ASSERT_EQUAL(false, equal);
+ // Check that I[0] does not equal former-I[0]
+ TEST_ASSERT_NOT_EQUAL(nts_keys[0].I, k0.I);
}
TEST(nts_cookie, nts_make_unpack_cookie) {
- /* init */
- uint8_t cookie[NTS_MAX_COOKIELEN];
- /* Using 16 bytes in test for ease of handling */
- uint8_t c2s[16] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16};
- uint8_t s2c[16] = {16, 15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1};
- uint8_t c2s_2[16] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
- uint8_t s2c_2[16] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
- int len;
- int keylen;
- bool ok;
- uint16_t aead; /* retrieved on unpack */
- /* Init for cookie_ctx */
- nts_cookie_init();
- nts_nKeys = 0;
- nts_make_cookie_key();
- /* Test */
- len = nts_make_cookie(cookie, AEAD_AES_SIV_CMAC_256, c2s, s2c, sizeof(c2s));
- TEST_ASSERT_EQUAL(72, len);
- /* Very limited in what data can be directly checked here */
- /* Reverse the test */
- ok = nts_unpack_cookie(cookie, len, &aead, c2s_2, s2c_2, &keylen);
- TEST_ASSERT_EQUAL(true, ok);
- TEST_ASSERT_EQUAL(AEAD_AES_SIV_CMAC_256, aead);
- TEST_ASSERT_EQUAL(16, keylen);
- TEST_ASSERT_EQUAL_UINT8_ARRAY(c2s, c2s_2, 16);
- TEST_ASSERT_EQUAL_UINT8_ARRAY(s2c, s2c_2, 16);
+ // init
+ uint8_t cookie[NTS_MAX_COOKIELEN];
+ // Using 16 bytes in test for ease of handling
+ uint8_t c2s[16] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16};
+ uint8_t s2c[16] = {16, 15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1};
+ uint8_t c2s_2[16] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
+ uint8_t s2c_2[16] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
+ int len;
+ int keylen;
+ bool ok;
+ uint16_t aead; // retrieved on unpack
+ // Init for cookie_ctx
+ nts_cookie_init();
+ nts_nKeys = 0;
+ nts_make_cookie_key();
+ // Test
+ len = nts_make_cookie(cookie, AEAD_AES_SIV_CMAC_256, c2s, s2c, sizeof(c2s));
+ TEST_ASSERT_EQUAL(72, len);
+ // Very limited in what data can be directly checked here
+ // Reverse the test
+ ok = nts_unpack_cookie(cookie, len, &aead, c2s_2, s2c_2, &keylen);
+ TEST_ASSERT_EQUAL(true, ok);
+ TEST_ASSERT_EQUAL(AEAD_AES_SIV_CMAC_256, aead);
+ TEST_ASSERT_EQUAL(16, keylen);
+ TEST_ASSERT_EQUAL_UINT8_ARRAY(c2s, c2s_2, 16);
+ TEST_ASSERT_EQUAL_UINT8_ARRAY(s2c, s2c_2, 16);
}
const char *cookie_file_name = "test-cookie-keys";
TEST(nts_cookie, nts_read_write_cookies) {
- struct NTS_Key k0, k1, k2;
- bool ok;
- ntsconfig.KI = cookie_file_name;
- nts_nKeys = 0;
- nts_make_cookie_key();
- nts_make_cookie_key();
- nts_make_cookie_key();
- k0 = nts_keys[0];
- k1 = nts_keys[1];
- k2 = nts_keys[2];
- TEST_ASSERT_EQUAL(nts_nKeys, 3);
- ok = nts_write_cookie_keys();
- TEST_ASSERT_EQUAL(true, ok);
- nts_make_cookie_key(); /* scramble things */
- ZERO(nts_keys);
- nts_nKeys = 377;
- ok = nts_read_cookie_keys();
- TEST_ASSERT_EQUAL(true, ok);
- TEST_ASSERT_EQUAL(nts_nKeys, 3);
- TEST_ASSERT_EQUAL_UINT8_ARRAY(nts_keys[0].K, k0.K, NTS_MAX_KEYLEN);
- TEST_ASSERT_EQUAL(nts_keys[0].I, k0.I);
- TEST_ASSERT_EQUAL_UINT8_ARRAY(nts_keys[1].K, k1.K, NTS_MAX_KEYLEN);
- TEST_ASSERT_EQUAL(nts_keys[1].I, k1.I);
- TEST_ASSERT_EQUAL_UINT8_ARRAY(nts_keys[2].K, k2.K, NTS_MAX_KEYLEN);
- TEST_ASSERT_EQUAL(nts_keys[2].I, k2.I);
+ struct NTS_Key k0, k1, k2;
+ bool ok;
+ ntsconfig.KI = cookie_file_name;
+ nts_nKeys = 0;
+ nts_make_cookie_key();
+ nts_make_cookie_key();
+ nts_make_cookie_key();
+ k0 = nts_keys[0];
+ k1 = nts_keys[1];
+ k2 = nts_keys[2];
+ TEST_ASSERT_EQUAL(nts_nKeys, 3);
+ ok = nts_write_cookie_keys();
+ TEST_ASSERT_EQUAL(true, ok);
+ nts_make_cookie_key(); // scramble things
+ ZERO(nts_keys);
+ nts_nKeys = 377;
+ ok = nts_read_cookie_keys();
+ TEST_ASSERT_EQUAL(true, ok);
+ TEST_ASSERT_EQUAL(nts_nKeys, 3);
+ TEST_ASSERT_EQUAL_UINT8_ARRAY(nts_keys[0].K, k0.K, NTS_MAX_KEYLEN);
+ TEST_ASSERT_EQUAL(nts_keys[0].I, k0.I);
+ TEST_ASSERT_EQUAL_UINT8_ARRAY(nts_keys[1].K, k1.K, NTS_MAX_KEYLEN);
+ TEST_ASSERT_EQUAL(nts_keys[1].I, k1.I);
+ TEST_ASSERT_EQUAL_UINT8_ARRAY(nts_keys[2].K, k2.K, NTS_MAX_KEYLEN);
+ TEST_ASSERT_EQUAL(nts_keys[2].I, k2.I);
}
TEST_GROUP_RUNNER(nts_cookie) {
- RUN_TEST_CASE(nts_cookie, nts_make_unpack_cookie);
- RUN_TEST_CASE(nts_cookie, nts_make_cookie_key);
- RUN_TEST_CASE(nts_cookie, nts_read_write_cookies);
- /* This test gets run as root during install
- * that leaves the cookie file that we can't read/write
- * so clean it up now.
- * If we crash, we don't get here so the evidence is still
- * left around in case it helps debugging. */
- unlink(cookie_file_name);
+ RUN_TEST_CASE(nts_cookie, nts_make_unpack_cookie);
+ RUN_TEST_CASE(nts_cookie, nts_make_cookie_key);
+ RUN_TEST_CASE(nts_cookie, nts_read_write_cookies);
+ /* This test gets run as root during install
+ * that leaves the cookie file that we can't read/write
+ * so clean it up now.
+ * If we crash, we don't get here so the evidence is still
+ * left around in case it helps debugging. */
+ unlink(cookie_file_name);
}
View it on GitLab: https://gitlab.com/NTPsec/ntpsec/-/compare/a4239181ea7bae3869b91637ca4c49f76417923d...a59a1d2be44fbdccf4fcdbd91fdae2da38e8f64e
--
View it on GitLab: https://gitlab.com/NTPsec/ntpsec/-/compare/a4239181ea7bae3869b91637ca4c49f76417923d...a59a1d2be44fbdccf4fcdbd91fdae2da38e8f64e
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ntpsec.org/pipermail/vc/attachments/20260806/343772d5/attachment-0001.htm>
More information about the vc
mailing list