ntp_crypto.h revision 316069
1241519Sattilio/* 2241519Sattilio * ntp_crypto.h - definitions for cryptographic operations 3241519Sattilio */ 4241519Sattilio#ifndef NTP_CRYPTO_H 5241519Sattilio#define NTP_CRYPTO_H 6241519Sattilio 7241519Sattilio/* 8241519Sattilio * Configuration codes (also needed for parser without AUTOKEY) 9241519Sattilio */ 10241519Sattilio#define CRYPTO_CONF_NONE 0 /* nothing doing */ 11241519Sattilio#define CRYPTO_CONF_PRIV 1 /* host name */ 12241519Sattilio#define CRYPTO_CONF_IDENT 2 /* group name */ 13241519Sattilio#define CRYPTO_CONF_CERT 3 /* certificate file name */ 14241519Sattilio#define CRYPTO_CONF_RAND 4 /* random seed file name */ 15241519Sattilio#define CRYPTO_CONF_IFFPAR 5 /* IFF parameters file name */ 16241519Sattilio#define CRYPTO_CONF_GQPAR 6 /* GQ parameters file name */ 17241519Sattilio#define CRYPTO_CONF_MVPAR 7 /* MV parameters file name */ 18241519Sattilio#define CRYPTO_CONF_PW 8 /* private key password */ 19241519Sattilio#define CRYPTO_CONF_NID 9 /* specify digest name */ 20241519Sattilio 21241519Sattilio#ifdef AUTOKEY 22241519Sattilio#ifndef OPENSSL 23241519Sattilio#error AUTOKEY should be defined only if OPENSSL is. 24241519Sattilioinvalidsyntax: AUTOKEY should be defined only if OPENSSL is. 25241519Sattilio#endif 26241519Sattilio 27241519Sattilio#include "openssl/bn.h" 28241519Sattilio#include "openssl/evp.h" 29241519Sattilio#include "ntp_calendar.h" /* for fields in the cert_info structure */ 30241519Sattilio 31241519Sattilio 32241519Sattilio/* 33241519Sattilio * The following bits are set by the CRYPTO_ASSOC message from 34241519Sattilio * the server and are not modified by the client. 35241519Sattilio */ 36241519Sattilio#define CRYPTO_FLAG_ENAB 0x0001 /* crypto enable */ 37241519Sattilio#define CRYPTO_FLAG_TAI 0x0002 /* leapseconds table */ 38241519Sattilio 39241519Sattilio#define CRYPTO_FLAG_PRIV 0x0010 /* PC identity scheme */ 40241519Sattilio#define CRYPTO_FLAG_IFF 0x0020 /* IFF identity scheme */ 41241519Sattilio#define CRYPTO_FLAG_GQ 0x0040 /* GQ identity scheme */ 42241519Sattilio#define CRYPTO_FLAG_MV 0x0080 /* MV identity scheme */ 43241519Sattilio#define CRYPTO_FLAG_MASK 0x00f0 /* identity scheme mask */ 44241519Sattilio 45241519Sattilio/* 46241519Sattilio * The following bits are used by the client during the protocol 47241519Sattilio * exchange. 48241519Sattilio */ 49241519Sattilio#define CRYPTO_FLAG_CERT 0x0100 /* public key verified */ 50241519Sattilio#define CRYPTO_FLAG_VRFY 0x0200 /* identity verified */ 51241519Sattilio#define CRYPTO_FLAG_PROV 0x0400 /* signature verified */ 52241519Sattilio#define CRYPTO_FLAG_COOK 0x0800 /* cookie verifed */ 53241519Sattilio#define CRYPTO_FLAG_AUTO 0x1000 /* autokey verified */ 54241519Sattilio#define CRYPTO_FLAG_SIGN 0x2000 /* certificate signed */ 55241519Sattilio#define CRYPTO_FLAG_LEAP 0x4000 /* leapsecond values verified */ 56241519Sattilio#define CRYPTO_FLAG_ALL 0x7f00 /* all mask */ 57241519Sattilio 58241519Sattilio/* 59241519Sattilio * Flags used for certificate management 60241519Sattilio */ 61241519Sattilio#define CERT_TRUST 0x01 /* certificate is trusted */ 62241519Sattilio#define CERT_SIGN 0x02 /* certificate is signed */ 63241519Sattilio#define CERT_VALID 0x04 /* certificate is valid */ 64241519Sattilio#define CERT_PRIV 0x08 /* certificate is private */ 65241519Sattilio#define CERT_ERROR 0x80 /* certificate has errors */ 66241519Sattilio 67241519Sattilio/* 68241519Sattilio * Extension field definitions 69241519Sattilio */ 70241519Sattilio#define CRYPTO_MAXLEN 1024 /* max extension field length */ 71241519Sattilio#define CRYPTO_VN 2 /* current protocol version number */ 72241519Sattilio#define CRYPTO_CMD(x) (((CRYPTO_VN << 8) | (x)) << 16) 73241519Sattilio#define CRYPTO_NULL CRYPTO_CMD(0) /* no operation */ 74241519Sattilio#define CRYPTO_ASSOC CRYPTO_CMD(1) /* association */ 75241519Sattilio#define CRYPTO_CERT CRYPTO_CMD(2) /* certificate */ 76241519Sattilio#define CRYPTO_COOK CRYPTO_CMD(3) /* cookie value */ 77241519Sattilio#define CRYPTO_AUTO CRYPTO_CMD(4) /* autokey values */ 78241519Sattilio#define CRYPTO_LEAP CRYPTO_CMD(5) /* leapsecond values */ 79241519Sattilio#define CRYPTO_SIGN CRYPTO_CMD(6) /* certificate sign */ 80241519Sattilio#define CRYPTO_IFF CRYPTO_CMD(7) /* IFF identity scheme */ 81241519Sattilio#define CRYPTO_GQ CRYPTO_CMD(8) /* GQ identity scheme */ 82241519Sattilio#define CRYPTO_MV CRYPTO_CMD(9) /* MV identity scheme */ 83241519Sattilio#define CRYPTO_RESP 0x80000000 /* response */ 84241519Sattilio#define CRYPTO_ERROR 0x40000000 /* error */ 85241519Sattilio 86241519Sattilio/* 87241519Sattilio * Autokey event codes 88241519Sattilio */ 89241519Sattilio#define XEVNT_CMD(x) (CRPT_EVENT | (x)) 90241519Sattilio#define XEVNT_OK XEVNT_CMD(0) /* success */ 91241519Sattilio#define XEVNT_LEN XEVNT_CMD(1) /* bad field format or length */ 92241519Sattilio#define XEVNT_TSP XEVNT_CMD(2) /* bad timestamp */ 93241519Sattilio#define XEVNT_FSP XEVNT_CMD(3) /* bad filestamp */ 94241519Sattilio#define XEVNT_PUB XEVNT_CMD(4) /* bad or missing public key */ 95241519Sattilio#define XEVNT_MD XEVNT_CMD(5) /* unsupported digest type */ 96241519Sattilio#define XEVNT_KEY XEVNT_CMD(6) /* unsupported identity type */ 97241519Sattilio#define XEVNT_SGL XEVNT_CMD(7) /* bad signature length */ 98241519Sattilio#define XEVNT_SIG XEVNT_CMD(8) /* signature not verified */ 99241519Sattilio#define XEVNT_VFY XEVNT_CMD(9) /* certificate not verified */ 100241519Sattilio#define XEVNT_PER XEVNT_CMD(10) /* host certificate expired */ 101241519Sattilio#define XEVNT_CKY XEVNT_CMD(11) /* bad or missing cookie */ 102241519Sattilio#define XEVNT_DAT XEVNT_CMD(12) /* bad or missing leapseconds */ 103241519Sattilio#define XEVNT_CRT XEVNT_CMD(13) /* bad or missing certificate */ 104241519Sattilio#define XEVNT_ID XEVNT_CMD(14) /* bad or missing group key */ 105241519Sattilio#define XEVNT_ERR XEVNT_CMD(15) /* protocol error */ 106241519Sattilio 107241519Sattilio/* 108241519Sattilio * Miscellaneous crypto stuff 109241519Sattilio */ 110241519Sattilio#define NTP_MAXSESSION 100 /* maximum session key list entries */ 111241519Sattilio#define NTP_MAXEXTEN 2048 /* maximum extension field size */ 112241519Sattilio#define NTP_AUTOMAX 12 /* default key list timeout (log2 s) */ 113241519Sattilio#define KEY_REVOKE 17 /* default key revoke timeout (log2 s) */ 114241519Sattilio#define NTP_REFRESH 19 /* default restart timeout (log2 s) */ 115241519Sattilio#define NTP_MAXKEY 65535 /* maximum symmetric key ID */ 116241519Sattilio 117241519Sattilio/* 118241519Sattilio * The autokey structure holds the values used to authenticate key IDs. 119241519Sattilio */ 120241519Sattiliostruct autokey { /* network byte order */ 121241519Sattilio keyid_t key; /* key ID */ 122241519Sattilio int32 seq; /* key number */ 123241519Sattilio}; 124241519Sattilio 125241519Sattilio/* 126241519Sattilio * The value structure holds variable length data such as public 127241519Sattilio * key, agreement parameters, public valule and leapsecond table. 128241519Sattilio * They are in network byte order. 129241519Sattilio */ 130241519Sattiliostruct value { /* network byte order */ 131241519Sattilio tstamp_t tstamp; /* timestamp */ 132241519Sattilio tstamp_t fstamp; /* filestamp */ 133241519Sattilio u_int32 vallen; /* value length */ 134241519Sattilio void *ptr; /* data pointer (various) */ 135241519Sattilio u_int32 siglen; /* signature length */ 136241519Sattilio u_char *sig; /* signature */ 137241519Sattilio}; 138241519Sattilio 139241519Sattilio/* 140241519Sattilio * The packet extension field structures are used to hold values 141241519Sattilio * and signatures in network byte order. 142241519Sattilio */ 143241519Sattiliostruct exten { 144241519Sattilio u_int32 opcode; /* opcode */ 145241519Sattilio u_int32 associd; /* association ID */ 146241519Sattilio u_int32 tstamp; /* timestamp */ 147241519Sattilio u_int32 fstamp; /* filestamp */ 148241519Sattilio u_int32 vallen; /* value length */ 149241519Sattilio u_int32 pkt[1]; /* start of value field */ 150241519Sattilio}; 151241519Sattilio 152241519Sattilio 153241519Sattilio/* 154241519Sattilio * The certificate info/value structure 155241519Sattilio */ 156241519Sattiliostruct cert_info { 157241519Sattilio struct cert_info *link; /* forward link */ 158241519Sattilio u_int flags; /* flags that wave */ 159241519Sattilio EVP_PKEY *pkey; /* generic key */ 160241519Sattilio long version; /* X509 version */ 161241519Sattilio int nid; /* signature/digest ID */ 162241519Sattilio const EVP_MD *digest; /* message digest algorithm */ 163241519Sattilio u_long serial; /* serial number */ 164241519Sattilio struct calendar first; /* not valid before */ 165241519Sattilio struct calendar last; /* not valid after */ 166241519Sattilio char *subject; /* subject common name */ 167241519Sattilio char *issuer; /* issuer common name */ 168241519Sattilio BIGNUM *grpkey; /* GQ group key */ 169241519Sattilio struct value cert; /* certificate/value */ 170241519Sattilio}; 171241519Sattilio 172241519Sattilio/* 173241519Sattilio * The keys info/value structure 174241519Sattilio */ 175241519Sattiliostruct pkey_info { 176241519Sattilio struct pkey_info *link; /* forward link */ 177241519Sattilio EVP_PKEY *pkey; /* generic key */ 178241519Sattilio char *name; /* file name */ 179241519Sattilio tstamp_t fstamp; /* filestamp */ 180241519Sattilio}; 181241519Sattilio 182241519Sattilio/* 183241519Sattilio * Cryptographic values 184241519Sattilio */ 185241519Sattilioextern u_int crypto_flags; /* status word */ 186241519Sattilioextern int crypto_nid; /* digest nid */ 187241519Sattilioextern struct value hostval; /* host name/value */ 188241519Sattilioextern struct cert_info *cinfo; /* host certificate information */ 189241519Sattilioextern struct value tai_leap; /* leapseconds table */ 190241519Sattilio#endif /* AUTOKEY */ 191241519Sattilio#endif /* NTP_CRYPTO_H */ 192241519Sattilio