2 * ssl_init.c Common OpenSSL initialization code for the various
3 * programs which use it.
5 * Moved from ntpd/ntp_crypto.c crypto_setup()
12 #include <ntp_debug.h>
13 #include <lib_strbuf.h>
16 #include "openssl/err.h"
17 #include "openssl/evp.h"
19 void atexit_ssl_cleanup(void);
31 ERR_load_crypto_strings();
32 OpenSSL_add_all_algorithms();
33 atexit(&atexit_ssl_cleanup);
40 atexit_ssl_cleanup(void)
45 ssl_init_done = FALSE;
52 ssl_check_version(void)
54 if ((SSLeay() ^ OPENSSL_VERSION_NUMBER) & ~0xff0L) {
56 "OpenSSL version mismatch. Built against %lx, you have %lx",
57 (u_long)OPENSSL_VERSION_NUMBER, SSLeay());
59 "OpenSSL version mismatch. Built against %lx, you have %lx\n",
60 (u_long)OPENSSL_VERSION_NUMBER, SSLeay());
69 * keytype_from_text returns OpenSSL NID for digest by name, and
70 * optionally the associated digest length.
72 * Used by ntpd authreadkeys(), ntpq and ntpdc keytype()
83 const u_long max_digest_len = MAX_MAC_LEN - sizeof(keyid_t);
84 u_char digest[EVP_MAX_MD_SIZE];
90 * OpenSSL digest short names are capitalized, so uppercase the
91 * digest name before passing to OBJ_sn2nid(). If it is not
92 * recognized but begins with 'M' use NID_md5 to be consistent
97 strlcpy(upcased, text, LIB_BUFLENGTH);
98 for (pch = upcased; '\0' != *pch; pch++)
99 *pch = (char)toupper((unsigned char)*pch);
100 key_type = OBJ_sn2nid(upcased);
105 if (!key_type && 'm' == tolower((unsigned char)text[0]))
111 if (NULL != pdigest_len) {
113 EVP_DigestInit(&ctx, EVP_get_digestbynid(key_type));
114 EVP_DigestFinal(&ctx, digest, &digest_len);
115 if (digest_len > max_digest_len) {
117 "key type %s %u octet digests are too big, max %lu\n",
118 keytype_name(key_type), digest_len,
121 "key type %s %u octet digests are too big, max %lu",
122 keytype_name(key_type), digest_len,
129 *pdigest_len = digest_len;
137 * keytype_name returns OpenSSL short name for digest by NID.
139 * Used by ntpq and ntpdc keytype()
146 static const char unknown_type[] = "(unknown key type)";
151 name = OBJ_nid2sn(nid);
154 #else /* !OPENSSL follows */
165 * Use getpassphrase() if configure.ac detected it, as Suns that
166 * have it truncate the password in getpass() to 8 characters.
168 #ifdef HAVE_GETPASSPHRASE
169 # define getpass(str) getpassphrase(str)
173 * getpass_keytype() -- shared between ntpq and ntpdc, only vaguely
174 * related to the rest of ssl_init.c.
181 char pass_prompt[64 + 11 + 1]; /* 11 for " Password: " */
183 snprintf(pass_prompt, sizeof(pass_prompt),
184 "%.64s Password: ", keytype_name(keytype));
186 return getpass(pass_prompt);