[Git][NTPsec/ntpsec][nts.c] 3 commits: include/nts.h: Remove tabs, Single line /* comments to //
Hal Murray (@hal.murray)
gitlab at mg.gitlab.com
Thu Aug 6 17:26:42 UTC 2026
Hal Murray pushed to branch nts.c at NTPsec / ntpsec
Commits:
d9279df1 by Gary E. Miller at 2026-08-06T10:22:00-07:00
include/nts.h: Remove tabs, Single line /* comments to //
- - - - -
e7f2e4ee by Gary E. Miller at 2026-08-06T10:26:33-07:00
ntpd/nts.c: Remove tabs, Single line /* comments to //
No functional changes.
- - - - -
eef2f18d by Gary E. Miller at 2026-08-06T10:26:33-07:00
ntpd/nts.c: restore previous comment indents
No functional changes.
- - - - -
2 changed files:
- include/nts.h
- ntpd/nts.c
Changes:
=====================================
include/nts.h
=====================================
@@ -12,20 +12,20 @@
#include "ntp_fp.h"
-/* default file names */
+// default file names
#define NTS_CERT_FILE "/etc/ntp/cert-chain.pem"
#define NTS_KEY_FILE "/etc/ntp/key.pem"
#define NTS_COOKIE_KEY_FILE "/var/lib/ntp/nts-keys"
-#define NTS_KE_PORT 4460
-#define NTS_KE_PORTA "4460"
+#define NTS_KE_PORT 4460
+#define NTS_KE_PORTA "4460"
-#define NTS_KE_TIMEOUT 3
+#define NTS_KE_TIMEOUT 3
bool nts_server_init(void);
bool nts_client_init(void);
bool nts_cookie_init(void);
-bool nts_server_init2(void); /* after sandbox */
+bool nts_server_init2(void); // after sandbox
bool nts_cookie_init2(void);
void nts_cert_timer(void);
@@ -42,18 +42,18 @@ bool nts_unpack_cookie(uint8_t *cookie, int cookielen,
uint16_t *aead,
uint8_t *c2s, uint8_t *s2c, int *keylen);
-/* working finger into a buffer - updated by append/unpack routines */
+// working finger into a buffer - updated by append/unpack routines
struct BufCtl_t {
- uint8_t *next; /* pointer to next data/space */
- int left; /* data left or space available */
+ uint8_t *next; // pointer to next data/space
+ int left; // data left or space available
};
typedef struct BufCtl_t BufCtl;
-/* Here for test routines */
+// Here for test routines
bool nts_ke_process_receive(struct BufCtl_t *buf, int *aead,
char *errbuf, int errlng, const char **errtxt);
-/***********************************************************/
+// *********************************************************
/* buffer packing/unpacking routines.
* NB: The length field in NTP extensions includes the header
@@ -67,12 +67,12 @@ bool nts_ke_process_receive(struct BufCtl_t *buf, int *aead,
*/
-/* 2 byte type, 2 byte length */
+// 2 byte type, 2 byte length
#define NTS_KE_HDR_LNG 4
#define NTS_KE_U16_LNG 2
-/* xxx_append_record_foo makes whole record with one foo */
-/* append_foo appends foo to existing partial record */
+// xxx_append_record_foo makes whole record with one foo
+// append_foo appends foo to existing partial record
void ke_append_record_null(BufCtl* buf, uint16_t type);
void ke_append_record_uint16(BufCtl* buf, uint16_t type, uint16_t data);
void ke_append_record_bytes(BufCtl* buf, uint16_t type, uint8_t *data, int length);
@@ -87,19 +87,19 @@ void append_uint16(BufCtl* buf, uint16_t data);
void append_bytes(BufCtl* buf, uint8_t *data, int length);
uint16_t ke_next_record(BufCtl* buf, int *length);
-uint16_t ex_next_record(BufCtl* buf, int *length); /* body length */
+uint16_t ex_next_record(BufCtl* buf, int *length); // body length
uint16_t next_uint16(BufCtl* buf);
uint16_t next_bytes(BufCtl* buf, uint8_t *data, int length);
-/***********************************************************/
+// *********************************************************
-#define NTS_MAX_KEYLEN 64 /* used in cookies */
-#define NTS_MAX_COOKIELEN 192 /* see nts_cookie.c */
-#define NTS_MAX_COOKIES 8 /* RFC 4.1.6 */
-#define NTS_UID_LENGTH 32 /* RFC 5.3 */
-#define NTS_UID_MAX_LENGTH 64
+#define NTS_MAX_KEYLEN 64 // used in cookies
+#define NTS_MAX_COOKIELEN 192 // see nts_cookie.c
+#define NTS_MAX_COOKIES 8 // RFC 4.1.6
+#define NTS_UID_LENGTH 32 // RFC 5.3
+#define NTS_UID_MAX_LENGTH 64
-/* Here for tester */
+// Here for tester
struct NTS_Key {
uint8_t K[NTS_MAX_KEYLEN];
uint32_t I;
@@ -108,87 +108,87 @@ struct NTS_Key {
#define NTS_nKEYS 10
#endif
extern struct NTS_Key nts_keys[NTS_nKEYS];
-extern int nts_nKeys; /* for tester */
+extern int nts_nKeys; // for tester
/* Client side configuration data for an NTS association
* All are optional.
* part of peer struct */
struct ntscfg_t {
- char *ca; /* root/trusted certificates */
- char *aead; /* AEAD algorithms on wire */
+ char *ca; // root/trusted certificates
+ char *aead; // AEAD algorithms on wire
};
-/* Client-side state per connection to server */
+// Client-side state per connection to server
struct ntsclient_t {
- /* wire connection */
- uint16_t aead; /* AEAD algorithm used on wire */
- int keylen;
- uint8_t c2s[NTS_MAX_KEYLEN], s2c[NTS_MAX_KEYLEN];
- /* UID of last request sent - RFC 5.3 */
- uint8_t UID[NTS_UID_LENGTH];
- /* cookies */
- int readIdx, writeIdx;
- int count; /* -1 if not in NTS mode */
- int cookielen;
- uint8_t cookies[NTS_MAX_COOKIES][NTS_MAX_COOKIELEN];
+ // wire connection
+ uint16_t aead; // AEAD algorithm used on wire
+ int keylen;
+ uint8_t c2s[NTS_MAX_KEYLEN], s2c[NTS_MAX_KEYLEN];
+ // UID of last request sent - RFC 5.3
+ uint8_t UID[NTS_UID_LENGTH];
+ // cookies
+ int readIdx, writeIdx;
+ int count; // -1 if not in NTS mode
+ int cookielen;
+ uint8_t cookies[NTS_MAX_COOKIES][NTS_MAX_COOKIELEN];
};
-/* Server-side state per packet */
+// Server-side state per packet
struct ntspacket_t {
- bool valid;
- int uidlen;
- uint8_t UID[NTS_UID_MAX_LENGTH];
- int needed;
- uint16_t aead;
- int keylen;
- uint8_t c2s[NTS_MAX_KEYLEN], s2c[NTS_MAX_KEYLEN];
+ bool valid;
+ int uidlen;
+ uint8_t UID[NTS_UID_MAX_LENGTH];
+ int needed;
+ uint16_t aead;
+ int keylen;
+ uint8_t c2s[NTS_MAX_KEYLEN], s2c[NTS_MAX_KEYLEN];
};
-/* Configuration data for an NTS server or client instance */
+// Configuration data for an NTS server or client instance
struct ntsconfig_t {
- bool ntsenable; /* enable NTS KE server on this ntpd */
- const char * mintls; /* minimum TLS version allowed */
- const char * maxtls; /* maximum TLS version allowed */
- const char *tlsciphersuites;/* allowed TLS 1.3 ciphersuites */
- const char *tlsecdhcurves; /* allowed ecdhcurves list*/
- const char *cert; /* file holding server certificate key */
- const char *key; /* file holding server private key */
- const char *KI; /* file holding K/I for making cookies */
- const char *ca; /* root cert dir/file */
- const char *aead; /* AEAD algorithms on wire */
- bool tlscipherserverpreference; /* OpenSSL 3.0 default is client */
+ bool ntsenable; // enable NTS KE server on this ntpd
+ const char * mintls; // minimum TLS version allowed
+ const char * maxtls; // maximum TLS version allowed
+ const char *tlsciphersuites; // allowed TLS 1.3 ciphersuites
+ const char *tlsecdhcurves; // allowed ecdhcurves list
+ const char *cert; // file holding server certificate key
+ const char *key; // file holding server private key
+ const char *KI; // file holding K/I for making cookies
+ const char *ca; // root cert dir/file
+ const char *aead; // AEAD algorithms on wire
+ bool tlscipherserverpreference; // OpenSSL 3.0 default is client
};
-/* CMAC length is wired into AEAD_AES_SIV_CMAC_nnn. */
+// CMAC length is wired into AEAD_AES_SIV_CMAC_nnn.
#define CMAC_LENGTH 16
-/* The NONCE length comes from RFC 5116 and/or 5297. */
+// The NONCE length comes from RFC 5116 and/or 5297.
#define NONCE_LENGTH 16
-/* NTS protocol constants */
+// NTS protocol constants
#define NTS_CRITICAL 0x8000
enum nts_record_type {
- nts_end_of_message = 0, /* CRITICAL */
- nts_next_protocol_negotiation = 1, /* CRITICAL */
- nts_error = 2, /* CRITICAL */
- nts_warning = 3,
- nts_algorithm_negotiation = 4,
- nts_new_cookie = 5,
- nts_server_negotiation = 6,
- nts_port_negotiation = 7
+ nts_end_of_message = 0, // CRITICAL
+ nts_next_protocol_negotiation = 1, // CRITICAL
+ nts_error = 2, // CRITICAL
+ nts_warning = 3,
+ nts_algorithm_negotiation = 4,
+ nts_new_cookie = 5,
+ nts_server_negotiation = 6,
+ nts_port_negotiation = 7
};
enum nts_protocol_type {
- nts_protocol_NTP = 0,
+ nts_protocol_NTP = 0,
};
enum nts_errors_type {
- nts_unrecognized_critical_section = 0,
- nts_bad_request = 1
+ nts_unrecognized_critical_section = 0,
+ nts_bad_request = 1
};
@@ -197,50 +197,50 @@ enum nts_errors_type {
*/
enum aead_ciphers {
#define NO_AEAD 0xffff
- AEAD_AES_128_GCM = 1,
- AEAD_AES_256_GCM = 2,
- AEAD_AES_128_CCM = 3,
- AEAD_AES_256_CCM = 4,
-
- AEAD_AES_128_GCM_8 = 5,
- AEAD_AES_256_GCM_8 = 6,
- AEAD_AES_128_GCM_12 = 7,
- AEAD_AES_256_GCM_12 = 8,
-
- AEAD_AES_128_CCM_SHORT = 9,
- AEAD_AES_256_CCM_SHORT = 10,
- AEAD_AES_128_CCM_SHORT_8 = 11,
- AEAD_AES_256_CCM_SHORT_8 = 12,
- AEAD_AES_128_CCM_SHORT_12 = 13,
- AEAD_AES_256_CCM_SHORT_12 = 14,
-
- AEAD_AES_SIV_CMAC_256 = 15, /* RFC 5297 */
- AEAD_AES_SIV_CMAC_384 = 16, /* These 3 are the ones we use */
- AEAD_AES_SIV_CMAC_512 = 17,
+ AEAD_AES_128_GCM = 1,
+ AEAD_AES_256_GCM = 2,
+ AEAD_AES_128_CCM = 3,
+ AEAD_AES_256_CCM = 4,
+
+ AEAD_AES_128_GCM_8 = 5,
+ AEAD_AES_256_GCM_8 = 6,
+ AEAD_AES_128_GCM_12 = 7,
+ AEAD_AES_256_GCM_12 = 8,
+
+ AEAD_AES_128_CCM_SHORT = 9,
+ AEAD_AES_256_CCM_SHORT = 10,
+ AEAD_AES_128_CCM_SHORT_8 = 11,
+ AEAD_AES_256_CCM_SHORT_8 = 12,
+ AEAD_AES_128_CCM_SHORT_12 = 13,
+ AEAD_AES_256_CCM_SHORT_12 = 14,
+
+ AEAD_AES_SIV_CMAC_256 = 15, // RFC 5297
+ AEAD_AES_SIV_CMAC_384 = 16, // These 3 are the ones we use
+ AEAD_AES_SIV_CMAC_512 = 17,
#define AEAD_AES_SIV_CMAC_256_KEYLEN 32
#define AEAD_AES_SIV_CMAC_384_KEYLEN 48
#define AEAD_AES_SIV_CMAC_512_KEYLEN 64
- AEAD_AES_128_CCM_8 = 18,
- AEAD_AES_256_CCM_8 = 19,
+ AEAD_AES_128_CCM_8 = 18,
+ AEAD_AES_256_CCM_8 = 19,
- AEAD_AES_128_OCB_TAGLEN128 = 20,
- AEAD_AES_128_OCB_TAGLEN96 = 21,
- AEAD_AES_128_OCB_TAGLEN64 = 22,
- AEAD_AES_192_OCB_TAGLEN128 = 23,
- AEAD_AES_192_OCB_TAGLEN96 = 24,
- AEAD_AES_192_OCB_TAGLEN64 = 25,
- AEAD_AES_256_OCB_TAGLEN128 = 26,
- AEAD_AES_256_OCB_TAGLEN96 = 27,
- AEAD_AES_256_OCB_TAGLEN64 = 28,
+ AEAD_AES_128_OCB_TAGLEN128 = 20,
+ AEAD_AES_128_OCB_TAGLEN96 = 21,
+ AEAD_AES_128_OCB_TAGLEN64 = 22,
+ AEAD_AES_192_OCB_TAGLEN128 = 23,
+ AEAD_AES_192_OCB_TAGLEN96 = 24,
+ AEAD_AES_192_OCB_TAGLEN64 = 25,
+ AEAD_AES_256_OCB_TAGLEN128 = 26,
+ AEAD_AES_256_OCB_TAGLEN96 = 27,
+ AEAD_AES_256_OCB_TAGLEN64 = 28,
- AEAD_CHACHA20_POLY1305 = 29,
+ AEAD_CHACHA20_POLY1305 = 29,
- AEAD_AES_128_GCM_SIV = 30,
- AEAD_AES_256_GCM_SIV = 31,
+ AEAD_AES_128_GCM_SIV = 30,
+ AEAD_AES_256_GCM_SIV = 31,
- AEAD_AEGIS128L = 32,
- AEAD_AEGIS256 = 33
+ AEAD_AEGIS128L = 32,
+ AEAD_AEGIS256 = 33
};
@@ -249,7 +249,7 @@ extern struct ntsconfig_t ntsconfig;
-/* NTS-related statistics visible via ntpq -c nts */
+// NTS-related statistics visible via ntpq -c nts
struct nts_counters {
uint64_t client_send;
uint64_t client_recv_good;
@@ -258,17 +258,17 @@ struct nts_counters {
uint64_t server_recv_good;
uint64_t server_recv_bad;
uint64_t cookie_make;
- uint64_t cookie_not_server; /* we are not a NTS server */
- uint64_t cookie_decode_total; /* total attempts, includes too old */
+ uint64_t cookie_not_server; // we are not a NTS server
+ uint64_t cookie_decode_total; // total attempts, includes too old
uint64_t cookie_decode_current;
uint64_t cookie_decode_old;
uint64_t cookie_decode_old2;
uint64_t cookie_decode_older;
- uint64_t cookie_decode_too_old; /* or garbage */
+ uint64_t cookie_decode_too_old; // or garbage
uint64_t cookie_decode_error;
};
struct ntske_counters {
- /* Server */
+ // Server
uint64_t serves_nossl;
l_fp serves_nossl_wall;
l_fp serves_nossl_cpu;
@@ -278,7 +278,7 @@ struct ntske_counters {
uint64_t serves_good;
l_fp serves_good_wall;
l_fp serves_good_cpu;
- /* Client */
+ // Client
uint64_t probes_good;
uint64_t probes_bad;
};
@@ -286,4 +286,4 @@ extern struct nts_counters nts_cnt, old_nts_cnt;
extern struct ntske_counters ntske_cnt, old_ntske_cnt;
-#endif /* GUARD_NTS_H */
+#endif // GUARD_NTS_H
=====================================
ntpd/nts.c
=====================================
@@ -33,50 +33,50 @@ struct nts_counters nts_cnt, old_nts_cnt;
struct ntske_counters ntske_cnt, old_ntske_cnt;
struct ntsconfig_t ntsconfig = {
- .ntsenable = false,
- .mintls = NULL,
- .maxtls = NULL,
- .tlsciphersuites = NULL,
- .tlsecdhcurves = NULL,
- .cert = NULL,
- .key = NULL,
- .KI = NULL,
- .ca = NULL,
- .aead = NULL,
- .tlscipherserverpreference = false,
+ .ntsenable = false,
+ .mintls = NULL,
+ .maxtls = NULL,
+ .tlsciphersuites = NULL,
+ .tlsecdhcurves = NULL,
+ .cert = NULL,
+ .key = NULL,
+ .KI = NULL,
+ .ca = NULL,
+ .aead = NULL,
+ .tlscipherserverpreference = false,
};
void nts_log_version(void);
-/*****************************************************/
+// ***************************************************
-/* More SSL initialization in ssl_init() from libntp/ssl_init.c */
+// More SSL initialization in ssl_init() from libntp/ssl_init.c
void nts_init(void) {
- bool ok = true;
- nts_log_version();
- if (ntsconfig.ntsenable) {
- ok &= nts_server_init();
- }
- ok &= nts_client_init();
- ok &= nts_cookie_init();
- ok &= extens_init();
- if (!ok) {
- msyslog(LOG_ERR, "NTS: troubles during init. Bailing.");
- exit(1);
- }
+ bool ok = true;
+ nts_log_version();
+ if (ntsconfig.ntsenable) {
+ ok &= nts_server_init();
+ }
+ ok &= nts_client_init();
+ ok &= nts_cookie_init();
+ ok &= extens_init();
+ if (!ok) {
+ msyslog(LOG_ERR, "NTS: troubles during init. Bailing.");
+ exit(1);
+ }
}
void nts_init2(void) {
- bool ok = true;
- if (ntsconfig.ntsenable) {
- ok &= nts_server_init2();
- ok &= nts_cookie_init2();
- }
- if (!ok) {
- msyslog(LOG_ERR, "NTS: troubles during init2. Bailing.");
- exit(1);
- }
+ bool ok = true;
+ if (ntsconfig.ntsenable) {
+ ok &= nts_server_init2();
+ ok &= nts_cookie_init2();
+ }
+ if (!ok) {
+ msyslog(LOG_ERR, "NTS: troubles during init2. Bailing.");
+ exit(1);
+ }
}
/* There are 2 cases:
@@ -84,212 +84,212 @@ void nts_init2(void) {
* 2: mismatch, log both build and run
*/
void nts_log_version(void) {
- unsigned long buildVersion = OPENSSL_VERSION_NUMBER;
- const char * text = OpenSSL_version(OPENSSL_VERSION);
- bool match = (buildVersion == OpenSSL_version_num()) &&
- (0 == strcmp(OPENSSL_VERSION_TEXT, text));
- if (match) {
- /* Case 1 */
- msyslog(LOG_INFO, "INIT: %s, %lx",
- OPENSSL_VERSION_TEXT, buildVersion);
- } else {
- /* Case 2 */
- msyslog(LOG_INFO, "INIT: Built with %s, %lx",
- OPENSSL_VERSION_TEXT, buildVersion);
- msyslog(LOG_INFO, "INIT: Running with %s, %lx",
- OpenSSL_version(OPENSSL_VERSION),
- OpenSSL_version_num());
- if (buildVersion > OpenSSL_version_num()) {
- msyslog(LOG_ERR, "INIT: Old OpenSSL library, bailing");
- exit(1);
- }
- }
- /*
- * If the runtime OpenSSL is 1.1.1a, then bail, since we'll run into errors with the
- * TLSv1.3 maximum label length
- */
- if (OpenSSL_version_num() == 0x1010101fL) {
- msyslog(LOG_ERR, "INIT: OpenSSL 1.1.1a has a maximum label length bug, bailing");
- exit(1);
- }
-}
-
-/*****************************************************/
+ unsigned long buildVersion = OPENSSL_VERSION_NUMBER;
+ const char * text = OpenSSL_version(OPENSSL_VERSION);
+ bool match = (buildVersion == OpenSSL_version_num()) &&
+ (0 == strcmp(OPENSSL_VERSION_TEXT, text));
+ if (match) {
+ // Case 1
+ msyslog(LOG_INFO, "INIT: %s, %lx",
+ OPENSSL_VERSION_TEXT, buildVersion);
+ } else {
+ // Case 2
+ msyslog(LOG_INFO, "INIT: Built with %s, %lx",
+ OPENSSL_VERSION_TEXT, buildVersion);
+ msyslog(LOG_INFO, "INIT: Running with %s, %lx",
+ OpenSSL_version(OPENSSL_VERSION),
+ OpenSSL_version_num());
+ if (buildVersion > OpenSSL_version_num()) {
+ msyslog(LOG_ERR, "INIT: Old OpenSSL library, bailing");
+ exit(1);
+ }
+ }
+ /*
+ * If the runtime OpenSSL is 1.1.1a, then bail, since we'll run into errors with the
+ * TLSv1.3 maximum label length
+ */
+ if (OpenSSL_version_num() == 0x1010101fL) {
+ msyslog(LOG_ERR, "INIT: OpenSSL 1.1.1a has a maximum label length bug, bailing");
+ exit(1);
+ }
+}
+
+// ***************************************************
void nts_timer(void) {
- nts_cert_timer();
- nts_cookie_timer();
+ nts_cert_timer();
+ nts_cookie_timer();
}
-/*****************************************************/
+// ***************************************************
-/* 0 is default, -1 is error */
+// 0 is default, -1 is error
int nts_translate_version(const char *arg) {
- if (NULL == arg) {
- return 0;
- }
- if (0 == strcmp(arg, "TLS1.3")) {
- return TLS1_3_VERSION;
- }
- msyslog(LOG_ERR, "NTS: TLS unrecognized version string: %s.", arg);
- return -1;
+ if (NULL == arg) {
+ return 0;
+ }
+ if (0 == strcmp(arg, "TLS1.3")) {
+ return TLS1_3_VERSION;
+ }
+ msyslog(LOG_ERR, "NTS: TLS unrecognized version string: %s.", arg);
+ return -1;
}
-/* Translate text to AEAD code. NO_AEAD for none/error */
+// Translate text to AEAD code. NO_AEAD for none/error
uint16_t nts_string_to_aead(const char* text) {
- if (false) {
- } else if (0 == strcmp(text, "AES_SIV_CMAC_256")) {
- return AEAD_AES_SIV_CMAC_256;
- } else if (0 == strcmp(text, "AES_SIV_CMAC_384")) {
- return AEAD_AES_SIV_CMAC_384;
- } else if (0 == strcmp(text, "AES_SIV_CMAC_512")) {
- return AEAD_AES_SIV_CMAC_512;
- } else {
- return NO_AEAD;
- }
-}
-
-/* returns key length, 0 if unknown arg */
+ if (false) {
+ } else if (0 == strcmp(text, "AES_SIV_CMAC_256")) {
+ return AEAD_AES_SIV_CMAC_256;
+ } else if (0 == strcmp(text, "AES_SIV_CMAC_384")) {
+ return AEAD_AES_SIV_CMAC_384;
+ } else if (0 == strcmp(text, "AES_SIV_CMAC_512")) {
+ return AEAD_AES_SIV_CMAC_512;
+ } else {
+ return NO_AEAD;
+ }
+}
+
+// returns key length, 0 if unknown arg
int nts_get_key_length(uint16_t aead) {
- switch (aead) {
- case AEAD_AES_SIV_CMAC_256:
- return AEAD_AES_SIV_CMAC_256_KEYLEN;
- case AEAD_AES_SIV_CMAC_384:
- return AEAD_AES_SIV_CMAC_384_KEYLEN;
- case AEAD_AES_SIV_CMAC_512:
- return AEAD_AES_SIV_CMAC_512_KEYLEN;
- default:
- return 0;
- }
+ switch (aead) {
+ case AEAD_AES_SIV_CMAC_256:
+ return AEAD_AES_SIV_CMAC_256_KEYLEN;
+ case AEAD_AES_SIV_CMAC_384:
+ return AEAD_AES_SIV_CMAC_384_KEYLEN;
+ case AEAD_AES_SIV_CMAC_512:
+ return AEAD_AES_SIV_CMAC_512_KEYLEN;
+ default:
+ return 0;
+ }
}
-/*****************************************************/
+// ***************************************************
bool nts_load_versions(SSL_CTX *ctx) {
- int minver, maxver;
- minver = nts_translate_version(ntsconfig.mintls);
- maxver = nts_translate_version(ntsconfig.maxtls);
- if ((-1 == minver) || (-1 == maxver))
- return false;
- if(0 == minver) minver = TLS1_3_VERSION; // 3.
- SSL_CTX_set_min_proto_version(ctx, minver);
- SSL_CTX_set_max_proto_version(ctx, maxver);
- return true;
+ int minver, maxver;
+ minver = nts_translate_version(ntsconfig.mintls);
+ maxver = nts_translate_version(ntsconfig.maxtls);
+ if ((-1 == minver) || (-1 == maxver))
+ return false;
+ if(0 == minver) minver = TLS1_3_VERSION; // 3.
+ SSL_CTX_set_min_proto_version(ctx, minver);
+ SSL_CTX_set_max_proto_version(ctx, maxver);
+ return true;
}
bool nts_load_ciphers(SSL_CTX *ctx) {
- /* SSL set_ciphers(uites) ignores typos or ciphers it doesn't support.
- * There is no SSL_CTX_get_cipher_list, so we can't easily read back
- * the ciphers to see what it took.
- * We could make a dummy SSL, read the list, then free it.
- * man SSL_CTX_set_ciphersuites() has info.
- */
- if (NULL == ntsconfig.tlsciphersuites) {
- return true;
- }
- /* This used to set server-preference See #797 */
- if (1 != SSL_CTX_set_ciphersuites(ctx, ntsconfig.tlsciphersuites)) {
- msyslog(LOG_ERR, "NTS: troubles setting ciphersuites.");
- return false;
- } else {
- msyslog(LOG_INFO, "NTS: set ciphersuites %s.", ntsconfig.tlsciphersuites);
- }
- return true;
+ /* SSL set_ciphers(uites) ignores typos or ciphers it doesn't support.
+ * There is no SSL_CTX_get_cipher_list, so we can't easily read back
+ * the ciphers to see what it took.
+ * We could make a dummy SSL, read the list, then free it.
+ * man SSL_CTX_set_ciphersuites() has info.
+ */
+ if (NULL == ntsconfig.tlsciphersuites) {
+ return true;
+ }
+ // This used to set server-preference See #797
+ if (1 != SSL_CTX_set_ciphersuites(ctx, ntsconfig.tlsciphersuites)) {
+ msyslog(LOG_ERR, "NTS: troubles setting ciphersuites.");
+ return false;
+ } else {
+ msyslog(LOG_INFO, "NTS: set ciphersuites %s.", ntsconfig.tlsciphersuites);
+ }
+ return true;
}
bool nts_load_ecdhcurves(SSL_CTX *ctx) {
- /* SSL_CTX_set1_groups_list ignores typos or curves it doesn't support.
- * There is no SSL_CTX_get_groups_list, so we can't easily read back
- * the ecdhcurves to see what it took.
- * We could make a dummy SSL, read the list, then free it.
- */
- if (NULL != ntsconfig.tlsecdhcurves) {
- /* FIXME -- const bug in OpenSSL */
- char *copy = estrdup(ntsconfig.tlsecdhcurves);
- if (1 != SSL_CTX_set1_groups_list(ctx, copy)) {
- msyslog(LOG_ERR, "NTS: troubles setting ecdhcurves.");
- free(copy);
- return false;
- } else {
- msyslog(LOG_INFO, "NTS: set ecdhcurves %s.", ntsconfig.tlsecdhcurves);
- }
- free(copy);
- }
- return true;
+ /* SSL_CTX_set1_groups_list ignores typos or curves it doesn't support.
+ * There is no SSL_CTX_get_groups_list, so we can't easily read back
+ * the ecdhcurves to see what it took.
+ * We could make a dummy SSL, read the list, then free it.
+ */
+ if (NULL != ntsconfig.tlsecdhcurves) {
+ // FIXME -- const bug in OpenSSL
+ char *copy = estrdup(ntsconfig.tlsecdhcurves);
+ if (1 != SSL_CTX_set1_groups_list(ctx, copy)) {
+ msyslog(LOG_ERR, "NTS: troubles setting ecdhcurves.");
+ free(copy);
+ return false;
+ } else {
+ msyslog(LOG_INFO, "NTS: set ecdhcurves %s.", ntsconfig.tlsecdhcurves);
+ }
+ free(copy);
+ }
+ return true;
}
bool nts_set_cipher_order(SSL_CTX *ctx) {
- if (ntsconfig.tlscipherserverpreference)
- SSL_CTX_set_options(ctx, SSL_OP_CIPHER_SERVER_PREFERENCE);
- return true;
+ if (ntsconfig.tlscipherserverpreference)
+ SSL_CTX_set_options(ctx, SSL_OP_CIPHER_SERVER_PREFERENCE);
+ return true;
}
static struct stat certfile_stat;
void nts_reload_certificate(SSL_CTX *ctx) {
- struct stat temp_stat;
- const char *cert = NTS_CERT_FILE;
+ struct stat temp_stat;
+ const char *cert = NTS_CERT_FILE;
- if (NULL != ntsconfig.cert)
- cert = ntsconfig.cert;
+ if (NULL != ntsconfig.cert)
+ cert = ntsconfig.cert;
- if (0 != stat(cert, &temp_stat)) {
- return;
- }
+ if (0 != stat(cert, &temp_stat)) {
+ return;
+ }
- if ((certfile_stat.st_mtime == temp_stat.st_mtime)
+ if ((certfile_stat.st_mtime == temp_stat.st_mtime)
&& (certfile_stat.st_ctime == temp_stat.st_ctime)) {
- return; /* avoid clutter in log file */
- }
+ return; // avoid clutter in log file
+ }
- nts_load_certificate(ctx);
+ nts_load_certificate(ctx);
}
bool nts_load_certificate(SSL_CTX *ctx) {
- const char *cert = NTS_CERT_FILE;
- const char *key = NTS_KEY_FILE;
+ const char *cert = NTS_CERT_FILE;
+ const char *key = NTS_KEY_FILE;
char errbuf[100];
- if (NULL != ntsconfig.cert)
- cert = ntsconfig.cert;
- if (NULL != ntsconfig.key)
- key = ntsconfig.key;
-
- /* for reload checking */
- if (0 != stat(cert, &certfile_stat)) {
- ntp_strerror_r(errno, errbuf, sizeof(errbuf));
- msyslog(LOG_ERR, "NTSs: can't stat certificate (chain) from %s: %s", cert, errbuf);
- return false;
- }
-
- if (1 != SSL_CTX_use_certificate_chain_file(ctx, cert)) {
- msyslog(LOG_ERR, "NTSs: can't load certificate (chain) from %s", cert);
- nts_log_ssl_error();
- return false;
- } else {
- msyslog(LOG_ERR, "NTSs: loaded certificate (chain) from %s", cert);
- }
- if (1 != SSL_CTX_use_PrivateKey_file(ctx, key, SSL_FILETYPE_PEM)) {
- msyslog(LOG_ERR, "NTSs: can't load private key from %s", key);
- nts_log_ssl_error();
- return false;
- } else {
- msyslog(LOG_ERR, "NTSs: loaded private key from %s", key);
- }
-
- if (1 != SSL_CTX_check_private_key(ctx)) {
- msyslog(LOG_ERR, "NTSs: Private Key doesn't work ******");
- return false;
- } else {
- msyslog(LOG_INFO, "NTSs: Private Key OK");
- }
- return true;
-}
-
-/* scan partial(?) buffer for end marker */
+ if (NULL != ntsconfig.cert)
+ cert = ntsconfig.cert;
+ if (NULL != ntsconfig.key)
+ key = ntsconfig.key;
+
+ // for reload checking
+ if (0 != stat(cert, &certfile_stat)) {
+ ntp_strerror_r(errno, errbuf, sizeof(errbuf));
+ msyslog(LOG_ERR, "NTSs: can't stat certificate (chain) from %s: %s", cert, errbuf);
+ return false;
+ }
+
+ if (1 != SSL_CTX_use_certificate_chain_file(ctx, cert)) {
+ msyslog(LOG_ERR, "NTSs: can't load certificate (chain) from %s", cert);
+ nts_log_ssl_error();
+ return false;
+ } else {
+ msyslog(LOG_ERR, "NTSs: loaded certificate (chain) from %s", cert);
+ }
+ if (1 != SSL_CTX_use_PrivateKey_file(ctx, key, SSL_FILETYPE_PEM)) {
+ msyslog(LOG_ERR, "NTSs: can't load private key from %s", key);
+ nts_log_ssl_error();
+ return false;
+ } else {
+ msyslog(LOG_ERR, "NTSs: loaded private key from %s", key);
+ }
+
+ if (1 != SSL_CTX_check_private_key(ctx)) {
+ msyslog(LOG_ERR, "NTSs: Private Key doesn't work ******");
+ return false;
+ } else {
+ msyslog(LOG_INFO, "NTSs: Private Key OK");
+ }
+ return true;
+}
+
+// scan partial(?) buffer for end marker
static bool find_end_marker(uint8_t *buff, int bytes) {
while (NTS_KE_HDR_LNG<=bytes) {
uint16_t *buff16 = (uint16_t *)buff;
@@ -381,131 +381,131 @@ int nts_ssl_write(SSL *ssl, uint8_t *buff, int buff_length, const char** errtxt)
return bytes_written;
}
-/* Each thread has it's own queue of errors */
+// Each thread has it's own queue of errors
void nts_get_ssl_error(char *errbuf, int errlng) {
int err = ERR_get_error();
ERR_error_string_n(err, errbuf, errlng);
}
void nts_log_ssl_error(void) {
- char buff[256];
- int err = ERR_get_error();
- SSL_load_error_strings(); /* Needed on NetBSD */
- while (0 != err) {
- ERR_error_string_n(err, buff, sizeof(buff));
- msyslog(LOG_INFO, "NTS: %s", buff);
- err = ERR_get_error();
- }
+ char buff[256];
+ int err = ERR_get_error();
+ SSL_load_error_strings(); // Needed on NetBSD
+ while (0 != err) {
+ ERR_error_string_n(err, buff, sizeof(buff));
+ msyslog(LOG_INFO, "NTS: %s", buff);
+ err = ERR_get_error();
+ }
}
-/*****************************************************/
+// ***************************************************
-/* NB: KE length is body length, Extension length includes header. */
+// NB: KE length is body length, Extension length includes header.
-/* Troubles with signed/unsigned compares when using sizeof() */
+// Troubles with signed/unsigned compares when using sizeof()
void ke_append_record_null(BufCtl* buf, uint16_t type) {
- append_header(buf, type, 0);
+ append_header(buf, type, 0);
}
void ke_append_record_uint16(BufCtl* buf, uint16_t type, uint16_t data) {
- if (NTS_KE_HDR_LNG+NTS_KE_U16_LNG > buf->left)
- return;
- append_header(buf, type, NTS_KE_U16_LNG);
- append_uint16(buf, data);
+ if (NTS_KE_HDR_LNG+NTS_KE_U16_LNG > buf->left)
+ return;
+ append_header(buf, type, NTS_KE_U16_LNG);
+ append_uint16(buf, data);
}
void ke_append_record_bytes(BufCtl* buf, uint16_t type, uint8_t *data, int length) {
- if (NTS_KE_HDR_LNG+length > buf->left)
- return;
- append_header(buf, type, length);
- append_bytes(buf, data, length);
+ if (NTS_KE_HDR_LNG+length > buf->left)
+ return;
+ append_header(buf, type, length);
+ append_bytes(buf, data, length);
}
void ex_append_record_null(BufCtl* buf, uint16_t type) {
- append_header(buf, type, NTS_KE_HDR_LNG);
+ append_header(buf, type, NTS_KE_HDR_LNG);
}
void ex_append_record_uint16(BufCtl* buf, uint16_t type, uint16_t data) {
- if (NTS_KE_HDR_LNG+NTS_KE_U16_LNG > buf->left)
- return;
- append_header(buf, type, NTS_KE_HDR_LNG+NTS_KE_U16_LNG);
- append_uint16(buf, data);
+ if (NTS_KE_HDR_LNG+NTS_KE_U16_LNG > buf->left)
+ return;
+ append_header(buf, type, NTS_KE_HDR_LNG+NTS_KE_U16_LNG);
+ append_uint16(buf, data);
}
void ex_append_record_bytes(BufCtl* buf, uint16_t type, uint8_t *data, int length) {
- if (NTS_KE_HDR_LNG+length > buf->left)
- return;
- append_header(buf, type, NTS_KE_HDR_LNG+length);
- append_bytes(buf, data, length);
+ if (NTS_KE_HDR_LNG+length > buf->left)
+ return;
+ append_header(buf, type, NTS_KE_HDR_LNG+length);
+ append_bytes(buf, data, length);
}
void ex_append_header(BufCtl* buf, uint16_t type, uint16_t length) {
- append_header(buf, type, NTS_KE_HDR_LNG+length);
+ append_header(buf, type, NTS_KE_HDR_LNG+length);
}
void append_header(BufCtl* buf, uint16_t type, uint16_t length) {
- uint16_t * ptr = (uint16_t *)buf->next;
- if (NTS_KE_HDR_LNG > buf->left)
- return;
- *ptr++ = htons(type);
- *ptr++ = htons(length);
- buf->next += NTS_KE_HDR_LNG;
- buf->left -= NTS_KE_HDR_LNG;
- /* leaves buf pointing to where data will go */
+ uint16_t * ptr = (uint16_t *)buf->next;
+ if (NTS_KE_HDR_LNG > buf->left)
+ return;
+ *ptr++ = htons(type);
+ *ptr++ = htons(length);
+ buf->next += NTS_KE_HDR_LNG;
+ buf->left -= NTS_KE_HDR_LNG;
+ // leaves buf pointing to where data will go
}
void append_uint16(BufCtl* buf, uint16_t data) {
- uint16_t * ptr = (uint16_t *)buf->next;
- if (NTS_KE_U16_LNG > buf->left)
- return;
- *ptr++ = htons(data);
- buf->next += NTS_KE_U16_LNG;
- buf->left -= NTS_KE_U16_LNG;
+ uint16_t * ptr = (uint16_t *)buf->next;
+ if (NTS_KE_U16_LNG > buf->left)
+ return;
+ *ptr++ = htons(data);
+ buf->next += NTS_KE_U16_LNG;
+ buf->left -= NTS_KE_U16_LNG;
}
void append_bytes(BufCtl* buf, uint8_t *data, int length) {
- if (length > buf->left)
- return;
- memcpy(buf->next, data, length);
- buf->next += length;
- buf->left -= length;
+ if (length > buf->left)
+ return;
+ memcpy(buf->next, data, length);
+ buf->next += length;
+ buf->left -= length;
}
-/* Reads type and length of the next record, and moves cursor to the data */
+// Reads type and length of the next record, and moves cursor to the data
uint16_t ke_next_record(BufCtl* buf, int *length) {
- uint16_t *ptr = (uint16_t *)buf->next;
- uint16_t type = ntohs(*ptr++);
- *length = ntohs(*ptr++);
- buf->next += NTS_KE_HDR_LNG;
- buf->left -= NTS_KE_HDR_LNG;
- return type;
+ uint16_t *ptr = (uint16_t *)buf->next;
+ uint16_t type = ntohs(*ptr++);
+ *length = ntohs(*ptr++);
+ buf->next += NTS_KE_HDR_LNG;
+ buf->left -= NTS_KE_HDR_LNG;
+ return type;
}
uint16_t ex_next_record(BufCtl* buf, int *length) {
- uint16_t *ptr = (uint16_t *)buf->next;
- uint16_t type = ntohs(*ptr++);
- *length = ntohs(*ptr++)-NTS_KE_HDR_LNG;
- buf->next += NTS_KE_HDR_LNG;
- buf->left -= NTS_KE_HDR_LNG;
- return type;
+ uint16_t *ptr = (uint16_t *)buf->next;
+ uint16_t type = ntohs(*ptr++);
+ *length = ntohs(*ptr++)-NTS_KE_HDR_LNG;
+ buf->next += NTS_KE_HDR_LNG;
+ buf->left -= NTS_KE_HDR_LNG;
+ return type;
}
-/* Reads a uint16 from the record and advances to the next data */
+// Reads a uint16 from the record and advances to the next data
uint16_t next_uint16(BufCtl* buf) {
- uint16_t *ptr = (uint16_t *)buf->next;
- uint16_t data = ntohs(*ptr++);
- buf->next += NTS_KE_U16_LNG;
- buf->left -= NTS_KE_U16_LNG;
- return data;
+ uint16_t *ptr = (uint16_t *)buf->next;
+ uint16_t data = ntohs(*ptr++);
+ buf->next += NTS_KE_U16_LNG;
+ buf->left -= NTS_KE_U16_LNG;
+ return data;
}
-/* Reads a string of bytes from the record and advances to the next data */
+// Reads a string of bytes from the record and advances to the next data
uint16_t next_bytes(BufCtl* buf, uint8_t *data, int length) {
- memcpy(data, buf->next, length);
- buf->next += length;
- buf->left -= length;
- return length;
+ memcpy(data, buf->next, length);
+ buf->next += length;
+ buf->left -= length;
+ return length;
}
-/* end */
+// end
View it on GitLab: https://gitlab.com/NTPsec/ntpsec/-/compare/99d799e723b5c4c06c966e06332372a24a983cfe...eef2f18defca39254e253d0981f89592c39191e1
--
View it on GitLab: https://gitlab.com/NTPsec/ntpsec/-/compare/99d799e723b5c4c06c966e06332372a24a983cfe...eef2f18defca39254e253d0981f89592c39191e1
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ntpsec.org/pipermail/vc/attachments/20260806/3331a317/attachment-0001.htm>
More information about the vc
mailing list