Fix multiple vulnerabilities in ntp. [SA-18:02.ntp]

[FreeBSD/releng/10.3.git] / contrib / ntp / ntpd / ntp_crypto.c

/*
 * ntp_crypto.c - NTP version 4 public key routines
 */
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif

#ifdef AUTOKEY
#include <stdio.h>
#include <stdlib.h>     /* strtoul */
#include <sys/types.h>
#include <sys/param.h>
#include <unistd.h>
#include <fcntl.h>

#include "ntpd.h"
#include "ntp_stdlib.h"
#include "ntp_unixtime.h"
#include "ntp_string.h"
#include "ntp_random.h"
#include "ntp_assert.h"
#include "ntp_calendar.h"
#include "ntp_leapsec.h"

#include "openssl/asn1.h"
#include "openssl/bn.h"
#include "openssl/crypto.h"
#include "openssl/err.h"
#include "openssl/evp.h"
#include "openssl/opensslv.h"
#include "openssl/pem.h"
#include "openssl/rand.h"
#include "openssl/x509.h"
#include "openssl/x509v3.h"
#include "libssl_compat.h"

#ifdef KERNEL_PLL
#include "ntp_syscall.h"
#endif /* KERNEL_PLL */

/*
 * calcomp - compare two calendar structures, ignoring yearday and weekday; like strcmp
 * No, it's not a plotter.  If you don't understand that, you're too young.
 */
static int calcomp(struct calendar *pjd1, struct calendar *pjd2)
{
        int32_t diff;   /* large enough to hold the signed difference between two uint16_t values */

        diff = pjd1->year - pjd2->year;
        if (diff < 0) return -1; else if (diff > 0) return 1;
        /* same year; compare months */
        diff = pjd1->month - pjd2->month;
        if (diff < 0) return -1; else if (diff > 0) return 1;
        /* same year and month; compare monthday */
        diff = pjd1->monthday - pjd2->monthday;
        if (diff < 0) return -1; else if (diff > 0) return 1;
        /* same year and month and monthday; compare time */
        diff = pjd1->hour - pjd2->hour;
        if (diff < 0) return -1; else if (diff > 0) return 1;
        diff = pjd1->minute - pjd2->minute;
        if (diff < 0) return -1; else if (diff > 0) return 1;
        diff = pjd1->second - pjd2->second;
        if (diff < 0) return -1; else if (diff > 0) return 1;
        /* identical */
        return 0;
}

/*
 * Extension field message format
 *
 * These are always signed and saved before sending in network byte
 * order. They must be converted to and from host byte order for
 * processing.
 *
 * +-------+-------+
 * |   op  |  len  | <- extension pointer
 * +-------+-------+
 * |    associd    |
 * +---------------+
 * |   timestamp   | <- value pointer
 * +---------------+
 * |   filestamp   |
 * +---------------+
 * |   value len   |
 * +---------------+
 * |               |
 * =     value     =
 * |               |
 * +---------------+
 * | signature len |
 * +---------------+
 * |               |
 * =   signature   =
 * |               |
 * +---------------+
 *
 * The CRYPTO_RESP bit is set to 0 for requests, 1 for responses.
 * Requests carry the association ID of the receiver; responses carry
 * the association ID of the sender. Some messages include only the
 * operation/length and association ID words and so have length 8
 * octets. Ohers include the value structure and associated value and
 * signature fields. These messages include the timestamp, filestamp,
 * value and signature words and so have length at least 24 octets. The
 * signature and/or value fields can be empty, in which case the
 * respective length words are zero. An empty value with nonempty
 * signature is syntactically valid, but semantically questionable.
 *
 * The filestamp represents the time when a cryptographic data file such
 * as a public/private key pair is created. It follows every reference
 * depending on that file and serves as a means to obsolete earlier data
 * of the same type. The timestamp represents the time when the
 * cryptographic data of the message were last signed. Creation of a
 * cryptographic data file or signing a message can occur only when the
 * creator or signor is synchronized to an authoritative source and
 * proventicated to a trusted authority.
 *
 * Note there are several conditions required for server trust. First,
 * the public key on the server certificate must be verified, which can
 * involve a hike along the certificate trail to a trusted host. Next,
 * the server trust must be confirmed by one of several identity
 * schemes. Valid cryptographic values are signed with attached
 * timestamp and filestamp. Individual packet trust is confirmed
 * relative to these values by a message digest with keys generated by a
 * reverse-order pseudorandom hash.
 *
 * State decomposition. These flags are lit in the order given. They are
 * dim only when the association is demobilized.
 *
 * CRYPTO_FLAG_ENAB     Lit upon acceptance of a CRYPTO_ASSOC message
 * CRYPTO_FLAG_CERT     Lit when a self-digned trusted certificate is
 *                      accepted.
 * CRYPTO_FLAG_VRFY     Lit when identity is confirmed.
 * CRYPTO_FLAG_PROV     Lit when the first signature is verified.
 * CRYPTO_FLAG_COOK     Lit when a valid cookie is accepted.
 * CRYPTO_FLAG_AUTO     Lit when valid autokey values are accepted.
 * CRYPTO_FLAG_SIGN     Lit when the server signed certificate is
 *                      accepted.
 * CRYPTO_FLAG_LEAP     Lit when the leapsecond values are accepted.
 */
/*
 * Cryptodefines
 */
#define TAI_1972        10      /* initial TAI offset (s) */
#define MAX_LEAP        100     /* max UTC leapseconds (s) */
#define VALUE_LEN       (6 * 4) /* min response field length */
#define MAX_VALLEN      (65535 - VALUE_LEN)
#define YEAR            (60 * 60 * 24 * 365) /* seconds in year */

/*
 * Global cryptodata in host byte order
 */
u_int32 crypto_flags = 0x0;     /* status word */
int     crypto_nid = KEY_TYPE_MD5; /* digest nid */
char    *sys_hostname = NULL;
char    *sys_groupname = NULL;
static char *host_filename = NULL;      /* host file name */
static char *ident_filename = NULL;     /* group file name */

/*
 * Global cryptodata in network byte order
 */
struct cert_info *cinfo = NULL; /* certificate info/value cache */
struct cert_info *cert_host = NULL; /* host certificate */
struct pkey_info *pkinfo = NULL; /* key info/value cache */
struct value hostval;           /* host value */
struct value pubkey;            /* public key */
struct value tai_leap;          /* leapseconds values */
struct pkey_info *iffkey_info = NULL; /* IFF keys */
struct pkey_info *gqkey_info = NULL; /* GQ keys */
struct pkey_info *mvkey_info = NULL; /* MV keys */

/*
 * Private cryptodata in host byte order
 */
static char *passwd = NULL;     /* private key password */
static EVP_PKEY *host_pkey = NULL; /* host key */
static EVP_PKEY *sign_pkey = NULL; /* sign key */
static const EVP_MD *sign_digest = NULL; /* sign digest */
static u_int sign_siglen;       /* sign key length */
static char *rand_file = NULL;  /* random seed file */

/*
 * Cryptotypes
 */
static  int     crypto_verify   (struct exten *, struct value *,
                                    struct peer *);
static  int     crypto_encrypt  (const u_char *, u_int, keyid_t *,
                                    struct value *);
static  int     crypto_alice    (struct peer *, struct value *);
static  int     crypto_alice2   (struct peer *, struct value *);
static  int     crypto_alice3   (struct peer *, struct value *);
static  int     crypto_bob      (struct exten *, struct value *);
static  int     crypto_bob2     (struct exten *, struct value *);
static  int     crypto_bob3     (struct exten *, struct value *);
static  int     crypto_iff      (struct exten *, struct peer *);
static  int     crypto_gq       (struct exten *, struct peer *);
static  int     crypto_mv       (struct exten *, struct peer *);
static  int     crypto_send     (struct exten *, struct value *, int);
static  tstamp_t crypto_time    (void);
static  void    asn_to_calendar         (const ASN1_TIME *, struct calendar*);
static  struct cert_info *cert_parse (const u_char *, long, tstamp_t);
static  int     cert_sign       (struct exten *, struct value *);
static  struct cert_info *cert_install (struct exten *, struct peer *);
static  int     cert_hike       (struct peer *, struct cert_info *);
static  void    cert_free       (struct cert_info *);
static  struct pkey_info *crypto_key (char *, char *, sockaddr_u *);
static  void    bighash         (BIGNUM *, BIGNUM *);
static  struct cert_info *crypto_cert (char *);
static  u_int   exten_payload_size(const struct exten *);

#ifdef SYS_WINNT
int
readlink(char * link, char * file, int len) {
        return (-1);
}
#endif

/*
 * session_key - generate session key
 *
 * This routine generates a session key from the source address,
 * destination address, key ID and private value. The value of the
 * session key is the MD5 hash of these values, while the next key ID is
 * the first four octets of the hash.
 *
 * Returns the next key ID or 0 if there is no destination address.
 */
keyid_t
session_key(
        sockaddr_u *srcadr,     /* source address */
        sockaddr_u *dstadr,     /* destination address */
        keyid_t keyno,          /* key ID */
        keyid_t private,        /* private value */
        u_long  lifetime        /* key lifetime */
        )
{
        EVP_MD_CTX *ctx;        /* message digest context */
        u_char dgst[EVP_MAX_MD_SIZE]; /* message digest */
        keyid_t keyid;          /* key identifer */
        u_int32 header[10];     /* data in network byte order */
        u_int   hdlen, len;

        if (!dstadr)
                return 0;
        
        /*
         * Generate the session key and key ID. If the lifetime is
         * greater than zero, install the key and call it trusted.
         */
        hdlen = 0;
        switch(AF(srcadr)) {
        case AF_INET:
                header[0] = NSRCADR(srcadr);
                header[1] = NSRCADR(dstadr);
                header[2] = htonl(keyno);
                header[3] = htonl(private);
                hdlen = 4 * sizeof(u_int32);
                break;

        case AF_INET6:
                memcpy(&header[0], PSOCK_ADDR6(srcadr),
                    sizeof(struct in6_addr));
                memcpy(&header[4], PSOCK_ADDR6(dstadr),
                    sizeof(struct in6_addr));
                header[8] = htonl(keyno);
                header[9] = htonl(private);
                hdlen = 10 * sizeof(u_int32);
                break;
        }
        ctx = EVP_MD_CTX_new();
#   if defined(OPENSSL) && defined(EVP_MD_CTX_FLAG_NON_FIPS_ALLOW)
        /* [Bug 3457] set flags and don't kill them again */
        EVP_MD_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
        EVP_DigestInit_ex(ctx, EVP_get_digestbynid(crypto_nid), NULL);
#   else
        EVP_DigestInit(ctx, EVP_get_digestbynid(crypto_nid));
#   endif
        EVP_DigestUpdate(ctx, (u_char *)header, hdlen);
        EVP_DigestFinal(ctx, dgst, &len);
        EVP_MD_CTX_free(ctx);
        memcpy(&keyid, dgst, 4);
        keyid = ntohl(keyid);
        if (lifetime != 0) {
                MD5auth_setkey(keyno, crypto_nid, dgst, len, NULL);
                authtrust(keyno, lifetime);
        }
        DPRINTF(2, ("session_key: %s > %s %08x %08x hash %08x life %lu\n",
                    stoa(srcadr), stoa(dstadr), keyno,
                    private, keyid, lifetime));

        return (keyid);
}


/*
 * make_keylist - generate key list
 *
 * Returns
 * XEVNT_OK     success
 * XEVNT_ERR    protocol error
 *
 * This routine constructs a pseudo-random sequence by repeatedly
 * hashing the session key starting from a given source address,
 * destination address, private value and the next key ID of the
 * preceeding session key. The last entry on the list is saved along
 * with its sequence number and public signature.
 */
int
make_keylist(
        struct peer *peer,      /* peer structure pointer */
        struct interface *dstadr /* interface */
        )
{
        EVP_MD_CTX *ctx;        /* signature context */
        tstamp_t tstamp;        /* NTP timestamp */
        struct autokey *ap;     /* autokey pointer */
        struct value *vp;       /* value pointer */
        keyid_t keyid = 0;      /* next key ID */
        keyid_t cookie;         /* private value */
        long    lifetime;
        u_int   len, mpoll;
        int     i;

        if (!dstadr)
                return XEVNT_ERR;
        
        /*
         * Allocate the key list if necessary.
         */
        tstamp = crypto_time();
        if (peer->keylist == NULL)
                peer->keylist = eallocarray(NTP_MAXSESSION,
                                            sizeof(keyid_t));

        /*
         * Generate an initial key ID which is unique and greater than
         * NTP_MAXKEY.
         */
        while (1) {
                keyid = ntp_random() & 0xffffffff;
                if (keyid <= NTP_MAXKEY)
                        continue;

                if (authhavekey(keyid))
                        continue;
                break;
        }

        /*
         * Generate up to NTP_MAXSESSION session keys. Stop if the
         * next one would not be unique or not a session key ID or if
         * it would expire before the next poll. The private value
         * included in the hash is zero if broadcast mode, the peer
         * cookie if client mode or the host cookie if symmetric modes.
         */
        mpoll = 1 << min(peer->ppoll, peer->hpoll);
        lifetime = min(1U << sys_automax, NTP_MAXSESSION * mpoll);
        if (peer->hmode == MODE_BROADCAST)
                cookie = 0;
        else
                cookie = peer->pcookie;
        for (i = 0; i < NTP_MAXSESSION; i++) {
                peer->keylist[i] = keyid;
                peer->keynumber = i;
                keyid = session_key(&dstadr->sin, &peer->srcadr, keyid,
                    cookie, lifetime + mpoll);
                lifetime -= mpoll;
                if (auth_havekey(keyid) || keyid <= NTP_MAXKEY ||
                    lifetime < 0 || tstamp == 0)
                        break;
        }

        /*
         * Save the last session key ID, sequence number and timestamp,
         * then sign these values for later retrieval by the clients. Be
         * careful not to use invalid key media. Use the public values
         * timestamp as filestamp. 
         */
        vp = &peer->sndval;
        if (vp->ptr == NULL)
                vp->ptr = emalloc(sizeof(struct autokey));
        ap = (struct autokey *)vp->ptr;
        ap->seq = htonl(peer->keynumber);
        ap->key = htonl(keyid);
        vp->tstamp = htonl(tstamp);
        vp->fstamp = hostval.tstamp;
        vp->vallen = htonl(sizeof(struct autokey));
        vp->siglen = 0;
        if (tstamp != 0) {
                if (vp->sig == NULL)
                        vp->sig = emalloc(sign_siglen);
                ctx = EVP_MD_CTX_new();
                EVP_SignInit(ctx, sign_digest);
                EVP_SignUpdate(ctx, (u_char *)vp, 12);
                EVP_SignUpdate(ctx, vp->ptr, sizeof(struct autokey));
                if (EVP_SignFinal(ctx, vp->sig, &len, sign_pkey)) {
                        INSIST(len <= sign_siglen);
                        vp->siglen = htonl(len);
                        peer->flags |= FLAG_ASSOC;
                }
                EVP_MD_CTX_free(ctx);
        }
        DPRINTF(1, ("make_keys: %d %08x %08x ts %u fs %u poll %d\n",
                    peer->keynumber, keyid, cookie, ntohl(vp->tstamp),
                    ntohl(vp->fstamp), peer->hpoll));
        return (XEVNT_OK);
}


/*
 * crypto_recv - parse extension fields
 *
 * This routine is called when the packet has been matched to an
 * association and passed sanity, format and MAC checks. We believe the
 * extension field values only if the field has proper format and
 * length, the timestamp and filestamp are valid and the signature has
 * valid length and is verified. There are a few cases where some values
 * are believed even if the signature fails, but only if the proventic
 * bit is not set.
 *
 * Returns
 * XEVNT_OK     success
 * XEVNT_ERR    protocol error
 * XEVNT_LEN    bad field format or length
 */
int
crypto_recv(
        struct peer *peer,      /* peer structure pointer */
        struct recvbuf *rbufp   /* packet buffer pointer */
        )
{
        const EVP_MD *dp;       /* message digest algorithm */
        u_int32 *pkt;           /* receive packet pointer */
        struct autokey *ap, *bp; /* autokey pointer */
        struct exten *ep, *fp;  /* extension pointers */
        struct cert_info *xinfo; /* certificate info pointer */
        int     macbytes;       /* length of MAC field, signed by intention */
        int     authlen;        /* offset of MAC field */
        associd_t associd;      /* association ID */
        tstamp_t fstamp = 0;    /* filestamp */
        u_int   len;            /* extension field length */
        u_int   code;           /* extension field opcode */
        u_int   vallen = 0;     /* value length */
        X509    *cert;          /* X509 certificate */
        char    statstr[NTP_MAXSTRLEN]; /* statistics for filegen */
        keyid_t cookie;         /* crumbles */
        int     hismode;        /* packet mode */
        int     rval = XEVNT_OK;
        const u_char *puch;
        u_int32 temp32;

        /*
         * Initialize. Note that the packet has already been checked for
         * valid format and extension field lengths. First extract the
         * field length, command code and association ID in host byte
         * order. These are used with all commands and modes. Then check
         * the version number, which must be 2, and length, which must
         * be at least 8 for requests and VALUE_LEN (24) for responses.
         * Packets that fail either test sink without a trace. The
         * association ID is saved only if nonzero.
         */
        authlen = LEN_PKT_NOMAC;
        hismode = (int)PKT_MODE((&rbufp->recv_pkt)->li_vn_mode);
        while ((macbytes = rbufp->recv_length - authlen) > (int)MAX_MAC_LEN) {
                /* We can be reasonably sure that we can read at least
                 * the opcode and the size field here. More stringent
                 * checks follow up shortly.
                 */
                pkt = (u_int32 *)&rbufp->recv_pkt + authlen / 4;
                ep = (struct exten *)pkt;
                code = ntohl(ep->opcode) & 0xffff0000;
                len = ntohl(ep->opcode) & 0x0000ffff;
                // HMS: Why pkt[1] instead of ep->associd ?
                associd = (associd_t)ntohl(pkt[1]);
                rval = XEVNT_OK;
                DPRINTF(1, ("crypto_recv: flags 0x%x ext offset %d len %u code 0x%x associd %d\n",
                            peer->crypto, authlen, len, code >> 16,
                            associd));

                /*
                 * Check version number and field length. If bad,
                 * quietly ignore the packet.
                 */
                if (((code >> 24) & 0x3f) != CRYPTO_VN || len < 8) {
                        sys_badlength++;
                        code |= CRYPTO_ERROR;
                }

                /* Check if the declared size fits into the remaining
                 * buffer. We *know* 'macbytes' > 0 here!
                 */
                if (len > (u_int)macbytes) {
                        DPRINTF(1, ("crypto_recv: possible attack detected, associd %d\n",
                                    associd));
                        return XEVNT_LEN;
                }

                /* Check if the paylod of the extension fits into the
                 * declared frame.
                 */
                if (len >= VALUE_LEN) {
                        fstamp = ntohl(ep->fstamp);
                        vallen = ntohl(ep->vallen);
                        /*
                         * Bug 2761: I hope this isn't too early...
                         */
                        if (   vallen == 0
                            || len - VALUE_LEN < vallen)
                                return XEVNT_LEN;
                }
                switch (code) {

                /*
                 * Install status word, host name, signature scheme and
                 * association ID. In OpenSSL the signature algorithm is
                 * bound to the digest algorithm, so the NID completely
                 * defines the signature scheme. Note the request and
                 * response are identical, but neither is validated by
                 * signature. The request is processed here only in
                 * symmetric modes. The server name field might be
                 * useful to implement access controls in future.
                 */
                case CRYPTO_ASSOC:

                        /*
                         * If our state machine is running when this
                         * message arrives, the other fellow might have
                         * restarted. However, this could be an
                         * intruder, so just clamp the poll interval and
                         * find out for ourselves. Otherwise, pass the
                         * extension field to the transmit side.
                         */
                        if (peer->crypto & CRYPTO_FLAG_CERT) {
                                rval = XEVNT_ERR;
                                break;
                        }
                        if (peer->cmmd) {
                                if (peer->assoc != associd) {
                                        rval = XEVNT_ERR;
                                        break;
                                }
                                free(peer->cmmd); /* will be set again! */
                        }
                        fp = emalloc(len);
                        memcpy(fp, ep, len);
                        fp->associd = htonl(peer->associd);
                        peer->cmmd = fp;
                        /* fall through */

                case CRYPTO_ASSOC | CRYPTO_RESP:

                        /*
                         * Discard the message if it has already been
                         * stored or the message has been amputated.
                         */
                        if (peer->crypto) {
                                if (peer->assoc != associd)
                                        rval = XEVNT_ERR;
                                break;
                        }
                        INSIST(len >= VALUE_LEN);
                        if (vallen == 0 || vallen > MAXHOSTNAME ||
                            len - VALUE_LEN < vallen) {
                                rval = XEVNT_LEN;
                                break;
                        }
                        DPRINTF(1, ("crypto_recv: ident host 0x%x %d server 0x%x %d\n",
                                    crypto_flags, peer->associd, fstamp,
                                    peer->assoc));
                        temp32 = crypto_flags & CRYPTO_FLAG_MASK;

                        /*
                         * If the client scheme is PC, the server scheme
                         * must be PC. The public key and identity are
                         * presumed valid, so we skip the certificate
                         * and identity exchanges and move immediately
                         * to the cookie exchange which confirms the
                         * server signature.
                         */
                        if (crypto_flags & CRYPTO_FLAG_PRIV) {
                                if (!(fstamp & CRYPTO_FLAG_PRIV)) {
                                        rval = XEVNT_KEY;
                                        break;
                                }
                                fstamp |= CRYPTO_FLAG_CERT |
                                    CRYPTO_FLAG_VRFY | CRYPTO_FLAG_SIGN;

                        /*
                         * It is an error if either peer supports
                         * identity, but the other does not.
                         */
                        } else if (hismode == MODE_ACTIVE || hismode ==
                            MODE_PASSIVE) {
                                if ((temp32 && !(fstamp &
                                    CRYPTO_FLAG_MASK)) ||
                                    (!temp32 && (fstamp &
                                    CRYPTO_FLAG_MASK))) {
                                        rval = XEVNT_KEY;
                                        break;
                                }
                        }

                        /*
                         * Discard the message if the signature digest
                         * NID is not supported.
                         */
                        temp32 = (fstamp >> 16) & 0xffff;
                        dp =
                            (const EVP_MD *)EVP_get_digestbynid(temp32);
                        if (dp == NULL) {
                                rval = XEVNT_MD;
                                break;
                        }

                        /*
                         * Save status word, host name and message
                         * digest/signature type. If this is from a
                         * broadcast and the association ID has changed,
                         * request the autokey values.
                         */
                        peer->assoc = associd;
                        if (hismode == MODE_SERVER)
                                fstamp |= CRYPTO_FLAG_AUTO;
                        if (!(fstamp & CRYPTO_FLAG_TAI))
                                fstamp |= CRYPTO_FLAG_LEAP;
                        RAND_bytes((u_char *)&peer->hcookie, 4);
                        peer->crypto = fstamp;
                        peer->digest = dp;
                        if (peer->subject != NULL)
                                free(peer->subject);
                        peer->subject = emalloc(vallen + 1);
                        memcpy(peer->subject, ep->pkt, vallen);
                        peer->subject[vallen] = '\0';
                        if (peer->issuer != NULL)
                                free(peer->issuer);
                        peer->issuer = estrdup(peer->subject);
                        snprintf(statstr, sizeof(statstr),
                            "assoc %d %d host %s %s", peer->associd,
                            peer->assoc, peer->subject,
                            OBJ_nid2ln(temp32));
                        record_crypto_stats(&peer->srcadr, statstr);
                        DPRINTF(1, ("crypto_recv: %s\n", statstr));
                        break;

                /*
                 * Decode X509 certificate in ASN.1 format and extract
                 * the data containing, among other things, subject
                 * name and public key. In the default identification
                 * scheme, the certificate trail is followed to a self
                 * signed trusted certificate.
                 */
                case CRYPTO_CERT | CRYPTO_RESP:

                        /*
                         * Discard the message if empty or invalid.
                         */
                        if (len < VALUE_LEN)
                                break;

                        if ((rval = crypto_verify(ep, NULL, peer)) !=
                            XEVNT_OK)
                                break;

                        /*
                         * Scan the certificate list to delete old
                         * versions and link the newest version first on
                         * the list. Then, verify the signature. If the
                         * certificate is bad or missing, just ignore
                         * it.
                         */
                        if ((xinfo = cert_install(ep, peer)) == NULL) {
                                rval = XEVNT_CRT;
                                break;
                        }
                        if ((rval = cert_hike(peer, xinfo)) != XEVNT_OK)
                                break;

                        /*
                         * We plug in the public key and lifetime from
                         * the first certificate received. However, note
                         * that this certificate might not be signed by
                         * the server, so we can't check the
                         * signature/digest NID.
                         */
                        if (peer->pkey == NULL) {
                                puch = xinfo->cert.ptr;
                                cert = d2i_X509(NULL, &puch,
                                    ntohl(xinfo->cert.vallen));
                                peer->pkey = X509_get_pubkey(cert);
                                X509_free(cert);
                        }
                        peer->flash &= ~TEST8;
                        temp32 = xinfo->nid;
                        snprintf(statstr, sizeof(statstr),
                            "cert %s %s 0x%x %s (%u) fs %u",
                            xinfo->subject, xinfo->issuer, xinfo->flags,
                            OBJ_nid2ln(temp32), temp32,
                            ntohl(ep->fstamp));
                        record_crypto_stats(&peer->srcadr, statstr);
                        DPRINTF(1, ("crypto_recv: %s\n", statstr));
                        break;

                /*
                 * Schnorr (IFF) identity scheme. This scheme is
                 * designed for use with shared secret server group keys
                 * and where the certificate may be generated by a third
                 * party. The client sends a challenge to the server,
                 * which performs a calculation and returns the result.
                 * A positive result is possible only if both client and
                 * server contain the same secret group key.
                 */
                case CRYPTO_IFF | CRYPTO_RESP:

                        /*
                         * Discard the message if invalid.
                         */
                        if ((rval = crypto_verify(ep, NULL, peer)) !=
                            XEVNT_OK)
                                break;

                        /*
                         * If the challenge matches the response, the
                         * server public key, signature and identity are
                         * all verified at the same time. The server is
                         * declared trusted, so we skip further
                         * certificate exchanges and move immediately to
                         * the cookie exchange.
                         */
                        if ((rval = crypto_iff(ep, peer)) != XEVNT_OK)
                                break;

                        peer->crypto |= CRYPTO_FLAG_VRFY;
                        peer->flash &= ~TEST8;
                        snprintf(statstr, sizeof(statstr), "iff %s fs %u",
                            peer->issuer, ntohl(ep->fstamp));
                        record_crypto_stats(&peer->srcadr, statstr);
                        DPRINTF(1, ("crypto_recv: %s\n", statstr));
                        break;

                /*
                 * Guillou-Quisquater (GQ) identity scheme. This scheme
                 * is designed for use with public certificates carrying
                 * the GQ public key in an extension field. The client
                 * sends a challenge to the server, which performs a
                 * calculation and returns the result. A positive result
                 * is possible only if both client and server contain
                 * the same group key and the server has the matching GQ
                 * private key.
                 */
                case CRYPTO_GQ | CRYPTO_RESP:

                        /*
                         * Discard the message if invalid
                         */
                        if ((rval = crypto_verify(ep, NULL, peer)) !=
                            XEVNT_OK)
                                break;

                        /*
                         * If the challenge matches the response, the
                         * server public key, signature and identity are
                         * all verified at the same time. The server is
                         * declared trusted, so we skip further
                         * certificate exchanges and move immediately to
                         * the cookie exchange.
                         */
                        if ((rval = crypto_gq(ep, peer)) != XEVNT_OK)
                                break;

                        peer->crypto |= CRYPTO_FLAG_VRFY;
                        peer->flash &= ~TEST8;
                        snprintf(statstr, sizeof(statstr), "gq %s fs %u",
                            peer->issuer, ntohl(ep->fstamp));
                        record_crypto_stats(&peer->srcadr, statstr);
                        DPRINTF(1, ("crypto_recv: %s\n", statstr));
                        break;

                /*
                 * Mu-Varadharajan (MV) identity scheme. This scheme is
                 * designed for use with three levels of trust, trusted
                 * host, server and client. The trusted host key is
                 * opaque to servers and clients; the server keys are
                 * opaque to clients and each client key is different.
                 * Client keys can be revoked without requiring new key
                 * generations.
                 */
                case CRYPTO_MV | CRYPTO_RESP:

                        /*
                         * Discard the message if invalid.
                         */
                        if ((rval = crypto_verify(ep, NULL, peer)) !=
                            XEVNT_OK)
                                break;

                        /*
                         * If the challenge matches the response, the
                         * server public key, signature and identity are
                         * all verified at the same time. The server is
                         * declared trusted, so we skip further
                         * certificate exchanges and move immediately to
                         * the cookie exchange.
                         */
                        if ((rval = crypto_mv(ep, peer)) != XEVNT_OK)
                                break;

                        peer->crypto |= CRYPTO_FLAG_VRFY;
                        peer->flash &= ~TEST8;
                        snprintf(statstr, sizeof(statstr), "mv %s fs %u",
                            peer->issuer, ntohl(ep->fstamp));
                        record_crypto_stats(&peer->srcadr, statstr);
                        DPRINTF(1, ("crypto_recv: %s\n", statstr));
                        break;


                /*
                 * Cookie response in client and symmetric modes. If the
                 * cookie bit is set, the working cookie is the EXOR of
                 * the current and new values.
                 */
                case CRYPTO_COOK | CRYPTO_RESP:

                        /*
                         * Discard the message if invalid or signature
                         * not verified with respect to the cookie
                         * values.
                         */
                        if ((rval = crypto_verify(ep, &peer->cookval,
                            peer)) != XEVNT_OK)
                                break;

                        /*
                         * Decrypt the cookie, hunting all the time for
                         * errors.
                         */
                        if (vallen == (u_int)EVP_PKEY_size(host_pkey)) {
                                RSA *rsa = EVP_PKEY_get0_RSA(host_pkey);
                                u_int32 *cookiebuf = malloc(RSA_size(rsa));
                                if (!cookiebuf) {
                                        rval = XEVNT_CKY;
                                        break;
                                }

                                if (RSA_private_decrypt(vallen,
                                    (u_char *)ep->pkt,
                                    (u_char *)cookiebuf,
                                    rsa,
                                    RSA_PKCS1_OAEP_PADDING) != 4) {
                                        rval = XEVNT_CKY;
                                        free(cookiebuf);
                                        break;
                                } else {
                                        cookie = ntohl(*cookiebuf);
                                        free(cookiebuf);
                                }
                        } else {
                                rval = XEVNT_CKY;
                                break;
                        }

                        /*
                         * Install cookie values and light the cookie
                         * bit. If this is not broadcast client mode, we
                         * are done here.
                         */
                        key_expire(peer);
                        if (hismode == MODE_ACTIVE || hismode ==
                            MODE_PASSIVE)
                                peer->pcookie = peer->hcookie ^ cookie;
                        else
                                peer->pcookie = cookie;
                        peer->crypto |= CRYPTO_FLAG_COOK;
                        peer->flash &= ~TEST8;
                        snprintf(statstr, sizeof(statstr),
                            "cook %x ts %u fs %u", peer->pcookie,
                            ntohl(ep->tstamp), ntohl(ep->fstamp));
                        record_crypto_stats(&peer->srcadr, statstr);
                        DPRINTF(1, ("crypto_recv: %s\n", statstr));
                        break;

                /*
                 * Install autokey values in broadcast client and
                 * symmetric modes. We have to do this every time the
                 * sever/peer cookie changes or a new keylist is
                 * rolled. Ordinarily, this is automatic as this message
                 * is piggybacked on the first NTP packet sent upon
                 * either of these events. Note that a broadcast client
                 * or symmetric peer can receive this response without a
                 * matching request.
                 */
                case CRYPTO_AUTO | CRYPTO_RESP:

                        /*
                         * Discard the message if invalid or signature
                         * not verified with respect to the receive
                         * autokey values.
                         */
                        if ((rval = crypto_verify(ep, &peer->recval,
                            peer)) != XEVNT_OK) 
                                break;

                        /*
                         * Discard the message if a broadcast client and
                         * the association ID does not match. This might
                         * happen if a broacast server restarts the
                         * protocol. A protocol restart will occur at
                         * the next ASSOC message.
                         */
                        if ((peer->cast_flags & MDF_BCLNT) &&
                            peer->assoc != associd)
                                break;

                        /*
                         * Install autokey values and light the
                         * autokey bit. This is not hard.
                         */
                        if (ep->tstamp == 0)
                                break;

                        if (peer->recval.ptr == NULL)
                                peer->recval.ptr =
                                    emalloc(sizeof(struct autokey));
                        bp = (struct autokey *)peer->recval.ptr;
                        peer->recval.tstamp = ep->tstamp;
                        peer->recval.fstamp = ep->fstamp;
                        ap = (struct autokey *)ep->pkt;
                        bp->seq = ntohl(ap->seq);
                        bp->key = ntohl(ap->key);
                        peer->pkeyid = bp->key;
                        peer->crypto |= CRYPTO_FLAG_AUTO;
                        peer->flash &= ~TEST8;
                        snprintf(statstr, sizeof(statstr), 
                            "auto seq %d key %x ts %u fs %u", bp->seq,
                            bp->key, ntohl(ep->tstamp),
                            ntohl(ep->fstamp));
                        record_crypto_stats(&peer->srcadr, statstr);
                        DPRINTF(1, ("crypto_recv: %s\n", statstr));
                        break;
        
                /*
                 * X509 certificate sign response. Validate the
                 * certificate signed by the server and install. Later
                 * this can be provided to clients of this server in
                 * lieu of the self signed certificate in order to
                 * validate the public key.
                 */
                case CRYPTO_SIGN | CRYPTO_RESP:

                        /*
                         * Discard the message if invalid.
                         */
                        if ((rval = crypto_verify(ep, NULL, peer)) !=
                            XEVNT_OK)
                                break;

                        /*
                         * Scan the certificate list to delete old
                         * versions and link the newest version first on
                         * the list.
                         */
                        if ((xinfo = cert_install(ep, peer)) == NULL) {
                                rval = XEVNT_CRT;
                                break;
                        }
                        peer->crypto |= CRYPTO_FLAG_SIGN;
                        peer->flash &= ~TEST8;
                        temp32 = xinfo->nid;
                        snprintf(statstr, sizeof(statstr),
                            "sign %s %s 0x%x %s (%u) fs %u",
                            xinfo->subject, xinfo->issuer, xinfo->flags,
                            OBJ_nid2ln(temp32), temp32,
                            ntohl(ep->fstamp));
                        record_crypto_stats(&peer->srcadr, statstr);
                        DPRINTF(1, ("crypto_recv: %s\n", statstr));
                        break;

                /*
                 * Install leapseconds values. While the leapsecond
                 * values epoch, TAI offset and values expiration epoch
                 * are retained, only the current TAI offset is provided
                 * via the kernel to other applications.
                 */
                case CRYPTO_LEAP | CRYPTO_RESP:
                        /*
                         * Discard the message if invalid. We can't
                         * compare the value timestamps here, as they
                         * can be updated by different servers.
                         */
                        rval = crypto_verify(ep, NULL, peer);
                        if ((rval   != XEVNT_OK          ) ||
                            (vallen != 3*sizeof(uint32_t))  )
                                break;

                        /* Check if we can update the basic TAI offset
                         * for our current leap frame. This is a hack
                         * and ignores the time stamps in the autokey
                         * message.
                         */
                        if (sys_leap != LEAP_NOTINSYNC)
                                leapsec_autokey_tai(ntohl(ep->pkt[0]),
                                                    rbufp->recv_time.l_ui, NULL);
                        tai_leap.tstamp = ep->tstamp;
                        tai_leap.fstamp = ep->fstamp;
                        crypto_update();
                        mprintf_event(EVNT_TAI, peer,
                                      "%d seconds", ntohl(ep->pkt[0]));
                        peer->crypto |= CRYPTO_FLAG_LEAP;
                        peer->flash &= ~TEST8;
                        snprintf(statstr, sizeof(statstr),
                                 "leap TAI offset %d at %u expire %u fs %u",
                                 ntohl(ep->pkt[0]), ntohl(ep->pkt[1]),
                                 ntohl(ep->pkt[2]), ntohl(ep->fstamp));
                        record_crypto_stats(&peer->srcadr, statstr);
                        DPRINTF(1, ("crypto_recv: %s\n", statstr));
                        break;

                /*
                 * We come here in symmetric modes for miscellaneous
                 * commands that have value fields but are processed on
                 * the transmit side. All we need do here is check for
                 * valid field length. Note that ASSOC is handled
                 * separately.
                 */
                case CRYPTO_CERT:
                case CRYPTO_IFF:
                case CRYPTO_GQ:
                case CRYPTO_MV:
                case CRYPTO_COOK:
                case CRYPTO_SIGN:
                        if (len < VALUE_LEN) {
                                rval = XEVNT_LEN;
                                break;
                        }
                        /* fall through */

                /*
                 * We come here in symmetric modes for requests
                 * requiring a response (above plus AUTO and LEAP) and
                 * for responses. If a request, save the extension field
                 * for later; invalid requests will be caught on the
                 * transmit side. If an error or invalid response,
                 * declare a protocol error.
                 */
                default:
                        if (code & (CRYPTO_RESP | CRYPTO_ERROR)) {
                                rval = XEVNT_ERR;
                        } else if (peer->cmmd == NULL) {
                                fp = emalloc(len);
                                memcpy(fp, ep, len);
                                peer->cmmd = fp;
                        }
                }

                /*
                 * The first error found terminates the extension field
                 * scan and we return the laundry to the caller.
                 */
                if (rval != XEVNT_OK) {
                        snprintf(statstr, sizeof(statstr),
                            "%04x %d %02x %s", htonl(ep->opcode),
                            associd, rval, eventstr(rval));
                        record_crypto_stats(&peer->srcadr, statstr);
                        DPRINTF(1, ("crypto_recv: %s\n", statstr));
                        return (rval);
                }
                authlen += (len + 3) / 4 * 4;
        }
        return (rval);
}


/*
 * crypto_xmit - construct extension fields
 *
 * This routine is called both when an association is configured and
 * when one is not. The only case where this matters is to retrieve the
 * autokey information, in which case the caller has to provide the
 * association ID to match the association.
 *
 * Side effect: update the packet offset.
 *
 * Errors
 * XEVNT_OK     success
 * XEVNT_CRT    bad or missing certificate
 * XEVNT_ERR    protocol error
 * XEVNT_LEN    bad field format or length
 * XEVNT_PER    host certificate expired
 */
int
crypto_xmit(
        struct peer *peer,      /* peer structure pointer */
        struct pkt *xpkt,       /* transmit packet pointer */
        struct recvbuf *rbufp,  /* receive buffer pointer */
        int     start,          /* offset to extension field */
        struct exten *ep,       /* extension pointer */
        keyid_t cookie          /* session cookie */
        )
{
        struct exten *fp;       /* extension pointers */
        struct cert_info *cp, *xp, *yp; /* cert info/value pointer */
        sockaddr_u *srcadr_sin; /* source address */
        u_int32 *pkt;           /* packet pointer */
        u_int   opcode;         /* extension field opcode */
        char    certname[MAXHOSTNAME + 1]; /* subject name buffer */
        char    statstr[NTP_MAXSTRLEN]; /* statistics for filegen */
        tstamp_t tstamp;
        struct calendar tscal;
        u_int   vallen;
        struct value vtemp;
        associd_t associd;
        int     rval;
        int     len;
        keyid_t tcookie;

        /*
         * Generate the requested extension field request code, length
         * and association ID. If this is a response and the host is not
         * synchronized, light the error bit and go home.
         */
        pkt = (u_int32 *)xpkt + start / 4;
        fp = (struct exten *)pkt;
        opcode = ntohl(ep->opcode);
        if (peer != NULL) {
                srcadr_sin = &peer->srcadr;
                if (!(opcode & CRYPTO_RESP))
                        peer->opcode = ep->opcode;
        } else {
                srcadr_sin = &rbufp->recv_srcadr;
        }
        associd = (associd_t) ntohl(ep->associd);
        len = 8;
        fp->opcode = htonl((opcode & 0xffff0000) | len);
        fp->associd = ep->associd;
        rval = XEVNT_OK;
        tstamp = crypto_time();
        switch (opcode & 0xffff0000) {

        /*
         * Send association request and response with status word and
         * host name. Note, this message is not signed and the filestamp
         * contains only the status word.
         */
        case CRYPTO_ASSOC:
        case CRYPTO_ASSOC | CRYPTO_RESP:
                len = crypto_send(fp, &hostval, start);
                fp->fstamp = htonl(crypto_flags);
                break;

        /*
         * Send certificate request. Use the values from the extension
         * field.
         */
        case CRYPTO_CERT:
                memset(&vtemp, 0, sizeof(vtemp));
                vtemp.tstamp = ep->tstamp;
                vtemp.fstamp = ep->fstamp;
                vtemp.vallen = ep->vallen;
                vtemp.ptr = (u_char *)ep->pkt;
                len = crypto_send(fp, &vtemp, start);
                break;

        /*
         * Send sign request. Use the host certificate, which is self-
         * signed and may or may not be trusted.
         */
        case CRYPTO_SIGN:
                (void)ntpcal_ntp_to_date(&tscal, tstamp, NULL);
                if ((calcomp(&tscal, &(cert_host->first)) < 0)
                || (calcomp(&tscal, &(cert_host->last)) > 0))
                        rval = XEVNT_PER;
                else
                        len = crypto_send(fp, &cert_host->cert, start);
                break;

        /*
         * Send certificate response. Use the name in the extension
         * field to find the certificate in the cache. If the request
         * contains no subject name, assume the name of this host. This
         * is for backwards compatibility. Private certificates are
         * never sent.
         *
         * There may be several certificates matching the request. First
         * choice is a self-signed trusted certificate; second choice is
         * any certificate signed by another host. There is no third
         * choice. 
         */
        case CRYPTO_CERT | CRYPTO_RESP:
                vallen = exten_payload_size(ep); /* Must be <64k */
                if (vallen == 0 || vallen >= sizeof(certname) ) {
                        rval = XEVNT_LEN;
                        break;
                }

                /*
                 * Find all public valid certificates with matching
                 * subject. If a self-signed, trusted certificate is
                 * found, use that certificate. If not, use the last non
                 * self-signed certificate.
                 */
                memcpy(certname, ep->pkt, vallen);
                certname[vallen] = '\0';
                xp = yp = NULL;
                for (cp = cinfo; cp != NULL; cp = cp->link) {
                        if (cp->flags & (CERT_PRIV | CERT_ERROR))
                                continue;

                        if (strcmp(certname, cp->subject) != 0)
                                continue;

                        if (strcmp(certname, cp->issuer) != 0)
                                yp = cp;
                        else if (cp ->flags & CERT_TRUST)
                                xp = cp;
                        continue;
                }

                /*
                 * Be careful who you trust. If the certificate is not
                 * found, return an empty response. Note that we dont
                 * enforce lifetimes here.
                 *
                 * The timestamp and filestamp are taken from the
                 * certificate value structure. For all certificates the
                 * timestamp is the latest signature update time. For
                 * host and imported certificates the filestamp is the
                 * creation epoch. For signed certificates the filestamp
                 * is the creation epoch of the trusted certificate at
                 * the root of the certificate trail. In principle, this
                 * allows strong checking for signature masquerade.
                 */
                if (xp == NULL)
                        xp = yp;
                if (xp == NULL)
                        break;

                if (tstamp == 0)
                        break;

                len = crypto_send(fp, &xp->cert, start);
                break;

        /*
         * Send challenge in Schnorr (IFF) identity scheme.
         */
        case CRYPTO_IFF:
                if (peer == NULL)
                        break;          /* hack attack */

                if ((rval = crypto_alice(peer, &vtemp)) == XEVNT_OK) {
                        len = crypto_send(fp, &vtemp, start);
                        value_free(&vtemp);
                }
                break;

        /*
         * Send response in Schnorr (IFF) identity scheme.
         */
        case CRYPTO_IFF | CRYPTO_RESP:
                if ((rval = crypto_bob(ep, &vtemp)) == XEVNT_OK) {
                        len = crypto_send(fp, &vtemp, start);
                        value_free(&vtemp);
                }
                break;

        /*
         * Send challenge in Guillou-Quisquater (GQ) identity scheme.
         */
        case CRYPTO_GQ:
                if (peer == NULL)
                        break;          /* hack attack */

                if ((rval = crypto_alice2(peer, &vtemp)) == XEVNT_OK) {
                        len = crypto_send(fp, &vtemp, start);
                        value_free(&vtemp);
                }
                break;

        /*
         * Send response in Guillou-Quisquater (GQ) identity scheme.
         */
        case CRYPTO_GQ | CRYPTO_RESP:
                if ((rval = crypto_bob2(ep, &vtemp)) == XEVNT_OK) {
                        len = crypto_send(fp, &vtemp, start);
                        value_free(&vtemp);
                }
                break;

        /*
         * Send challenge in MV identity scheme.
         */
        case CRYPTO_MV:
                if (peer == NULL)
                        break;          /* hack attack */

                if ((rval = crypto_alice3(peer, &vtemp)) == XEVNT_OK) {
                        len = crypto_send(fp, &vtemp, start);
                        value_free(&vtemp);
                }
                break;

        /*
         * Send response in MV identity scheme.
         */
        case CRYPTO_MV | CRYPTO_RESP:
                if ((rval = crypto_bob3(ep, &vtemp)) == XEVNT_OK) {
                        len = crypto_send(fp, &vtemp, start);
                        value_free(&vtemp);
                }
                break;

        /*
         * Send certificate sign response. The integrity of the request
         * certificate has already been verified on the receive side.
         * Sign the response using the local server key. Use the
         * filestamp from the request and use the timestamp as the
         * current time. Light the error bit if the certificate is
         * invalid or contains an unverified signature.
         */
        case CRYPTO_SIGN | CRYPTO_RESP:
                if ((rval = cert_sign(ep, &vtemp)) == XEVNT_OK) {
                        len = crypto_send(fp, &vtemp, start);
                        value_free(&vtemp);
                }
                break;

        /*
         * Send public key and signature. Use the values from the public
         * key.
         */
        case CRYPTO_COOK:
                len = crypto_send(fp, &pubkey, start);
                break;

        /*
         * Encrypt and send cookie and signature. Light the error bit if
         * anything goes wrong.
         */
        case CRYPTO_COOK | CRYPTO_RESP:
                vallen = ntohl(ep->vallen);     /* Must be <64k */
                if (   vallen == 0
                    || (vallen >= MAX_VALLEN)
                    || (opcode & 0x0000ffff)  < VALUE_LEN + vallen) {
                        rval = XEVNT_LEN;
                        break;
                }
                if (peer == NULL)
                        tcookie = cookie;
                else
                        tcookie = peer->hcookie;
                if ((rval = crypto_encrypt((const u_char *)ep->pkt, vallen, &tcookie, &vtemp))
                    == XEVNT_OK) {
                        len = crypto_send(fp, &vtemp, start);
                        value_free(&vtemp);
                }
                break;

        /*
         * Find peer and send autokey data and signature in broadcast
         * server and symmetric modes. Use the values in the autokey
         * structure. If no association is found, either the server has
         * restarted with new associations or some perp has replayed an
         * old message, in which case light the error bit.
         */
        case CRYPTO_AUTO | CRYPTO_RESP:
                if (peer == NULL) {
                        if ((peer = findpeerbyassoc(associd)) == NULL) {
                                rval = XEVNT_ERR;
                                break;
                        }
                }
                peer->flags &= ~FLAG_ASSOC;
                len = crypto_send(fp, &peer->sndval, start);
                break;

        /*
         * Send leapseconds values and signature. Use the values from
         * the tai structure. If no table has been loaded, just send an
         * empty request.
         */
        case CRYPTO_LEAP | CRYPTO_RESP:
                len = crypto_send(fp, &tai_leap, start);
                break;

        /*
         * Default - Send a valid command for unknown requests; send
         * an error response for unknown resonses.
         */
        default:
                if (opcode & CRYPTO_RESP)
                        rval = XEVNT_ERR;
        }

        /*
         * In case of error, flame the log. If a request, toss the
         * puppy; if a response, return so the sender can flame, too.
         */
        if (rval != XEVNT_OK) {
                u_int32 uint32;

                uint32 = CRYPTO_ERROR;
                opcode |= uint32;
                fp->opcode |= htonl(uint32);
                snprintf(statstr, sizeof(statstr),
                    "%04x %d %02x %s", opcode, associd, rval,
                    eventstr(rval));
                record_crypto_stats(srcadr_sin, statstr);
                DPRINTF(1, ("crypto_xmit: %s\n", statstr));
                if (!(opcode & CRYPTO_RESP))
                        return (0);
        }
        DPRINTF(1, ("crypto_xmit: flags 0x%x offset %d len %d code 0x%x associd %d\n",
                    crypto_flags, start, len, opcode >> 16, associd));
        return (len);
}


/*
 * crypto_verify - verify the extension field value and signature
 *
 * Returns
 * XEVNT_OK     success
 * XEVNT_ERR    protocol error
 * XEVNT_FSP    bad filestamp
 * XEVNT_LEN    bad field format or length
 * XEVNT_PUB    bad or missing public key
 * XEVNT_SGL    bad signature length
 * XEVNT_SIG    signature not verified
 * XEVNT_TSP    bad timestamp
 */
static int
crypto_verify(
        struct exten *ep,       /* extension pointer */
        struct value *vp,       /* value pointer */
        struct peer *peer       /* peer structure pointer */
        )
{
        EVP_PKEY *pkey;         /* server public key */
        EVP_MD_CTX *ctx;        /* signature context */
        tstamp_t tstamp, tstamp1 = 0; /* timestamp */
        tstamp_t fstamp, fstamp1 = 0; /* filestamp */
        u_int   vallen;         /* value length */
        u_int   siglen;         /* signature length */
        u_int   opcode, len;
        int     i;

        /*
         * We are extremely parannoyed. We require valid opcode, length,
         * association ID, timestamp, filestamp, public key, digest,
         * signature length and signature, where relevant. Note that
         * preliminary length checks are done in the main loop.
         */
        len = ntohl(ep->opcode) & 0x0000ffff;
        opcode = ntohl(ep->opcode) & 0xffff0000;

        /*
         * Check for valid value header, association ID and extension
         * field length. Remember, it is not an error to receive an
         * unsolicited response; however, the response ID must match
         * the association ID.
         */
        if (opcode & CRYPTO_ERROR)
                return (XEVNT_ERR);

        if (len < VALUE_LEN)
                return (XEVNT_LEN);

        if (opcode == (CRYPTO_AUTO | CRYPTO_RESP) && (peer->pmode ==
            MODE_BROADCAST || (peer->cast_flags & MDF_BCLNT))) {
                if (ntohl(ep->associd) != peer->assoc)
                        return (XEVNT_ERR);
        } else {
                if (ntohl(ep->associd) != peer->associd)
                        return (XEVNT_ERR);
        }

        /*
         * We have a valid value header. Check for valid value and
         * signature field lengths. The extension field length must be
         * long enough to contain the value header, value and signature.
         * Note both the value and signature field lengths are rounded
         * up to the next word (4 octets).
         */
        vallen = ntohl(ep->vallen);
        if (   vallen == 0
            || vallen > MAX_VALLEN)
                return (XEVNT_LEN);

        i = (vallen + 3) / 4;
        siglen = ntohl(ep->pkt[i++]);
        if (   siglen > MAX_VALLEN
            || len - VALUE_LEN < ((vallen + 3) / 4) * 4
            || len - VALUE_LEN - ((vallen + 3) / 4) * 4
              < ((siglen + 3) / 4) * 4)
                return (XEVNT_LEN);

        /*
         * Check for valid timestamp and filestamp. If the timestamp is
         * zero, the sender is not synchronized and signatures are
         * not possible. If nonzero the timestamp must not precede the
         * filestamp. The timestamp and filestamp must not precede the
         * corresponding values in the value structure, if present.
         */
        tstamp = ntohl(ep->tstamp);
        fstamp = ntohl(ep->fstamp);
        if (tstamp == 0)
                return (XEVNT_TSP);

        if (tstamp < fstamp)
                return (XEVNT_TSP);

        if (vp != NULL) {
                tstamp1 = ntohl(vp->tstamp);
                fstamp1 = ntohl(vp->fstamp);
                if (tstamp1 != 0 && fstamp1 != 0) {
                        if (tstamp < tstamp1)
                                return (XEVNT_TSP);

                        if ((tstamp < fstamp1 || fstamp < fstamp1))
                                return (XEVNT_FSP);
                }
        }

        /*
         * At the time the certificate message is validated, the public
         * key in the message is not available. Thus, don't try to
         * verify the signature.
         */
        if (opcode == (CRYPTO_CERT | CRYPTO_RESP))
                return (XEVNT_OK);

        /*
         * Check for valid signature length, public key and digest
         * algorithm.
         */
        if (crypto_flags & peer->crypto & CRYPTO_FLAG_PRIV)
                pkey = sign_pkey;
        else
                pkey = peer->pkey;
        if (siglen == 0 || pkey == NULL || peer->digest == NULL)
                return (XEVNT_ERR);

        if (siglen != (u_int)EVP_PKEY_size(pkey))
                return (XEVNT_SGL);

        /*
         * Darn, I thought we would never get here. Verify the
         * signature. If the identity exchange is verified, light the
         * proventic bit. What a relief.
         */
        ctx = EVP_MD_CTX_new();
        EVP_VerifyInit(ctx, peer->digest);
        /* XXX: the "+ 12" needs to be at least documented... */
        EVP_VerifyUpdate(ctx, (u_char *)&ep->tstamp, vallen + 12);
        if (EVP_VerifyFinal(ctx, (u_char *)&ep->pkt[i], siglen,
            pkey) <= 0) {
                EVP_MD_CTX_free(ctx);
                return (XEVNT_SIG);
        }
        EVP_MD_CTX_free(ctx);

        if (peer->crypto & CRYPTO_FLAG_VRFY)
                peer->crypto |= CRYPTO_FLAG_PROV;
        return (XEVNT_OK);
}


/*
 * crypto_encrypt - construct vp (encrypted cookie and signature) from
 * the public key and cookie.
 *
 * Returns:
 * XEVNT_OK     success
 * XEVNT_CKY    bad or missing cookie
 * XEVNT_PUB    bad or missing public key
 */
static int
crypto_encrypt(
        const u_char *ptr,      /* Public Key */
        u_int   vallen,         /* Length of Public Key */
        keyid_t *cookie,        /* server cookie */
        struct value *vp        /* value pointer */
        )
{
        EVP_PKEY *pkey;         /* public key */
        EVP_MD_CTX *ctx;        /* signature context */
        tstamp_t tstamp;        /* NTP timestamp */
        u_int32 temp32;
        u_char *puch;

        /*
         * Extract the public key from the request.
         */
        pkey = d2i_PublicKey(EVP_PKEY_RSA, NULL, &ptr, vallen);
        if (pkey == NULL) {
                msyslog(LOG_ERR, "crypto_encrypt: %s",
                    ERR_error_string(ERR_get_error(), NULL));
                return (XEVNT_PUB);
        }

        /*
         * Encrypt the cookie, encode in ASN.1 and sign.
         */
        memset(vp, 0, sizeof(struct value));
        tstamp = crypto_time();
        vp->tstamp = htonl(tstamp);
        vp->fstamp = hostval.tstamp;
        vallen = EVP_PKEY_size(pkey);
        vp->vallen = htonl(vallen);
        vp->ptr = emalloc(vallen);
        puch = vp->ptr;
        temp32 = htonl(*cookie);
        if (RSA_public_encrypt(4, (u_char *)&temp32, puch,
            EVP_PKEY_get0_RSA(pkey), RSA_PKCS1_OAEP_PADDING) <= 0) {
                msyslog(LOG_ERR, "crypto_encrypt: %s",
                    ERR_error_string(ERR_get_error(), NULL));
                free(vp->ptr);
                EVP_PKEY_free(pkey);
                return (XEVNT_CKY);
        }
        EVP_PKEY_free(pkey);
        if (tstamp == 0)
                return (XEVNT_OK);

        vp->sig = emalloc(sign_siglen);
        ctx = EVP_MD_CTX_new();
        EVP_SignInit(ctx, sign_digest);
        EVP_SignUpdate(ctx, (u_char *)&vp->tstamp, 12);
        EVP_SignUpdate(ctx, vp->ptr, vallen);
        if (EVP_SignFinal(ctx, vp->sig, &vallen, sign_pkey)) {
                INSIST(vallen <= sign_siglen);
                vp->siglen = htonl(vallen);
        }
        EVP_MD_CTX_free(ctx);
        return (XEVNT_OK);
}


/*
 * crypto_ident - construct extension field for identity scheme
 *
 * This routine determines which identity scheme is in use and
 * constructs an extension field for that scheme.
 *
 * Returns
 * CRYTPO_IFF   IFF scheme
 * CRYPTO_GQ    GQ scheme
 * CRYPTO_MV    MV scheme
 * CRYPTO_NULL  no available scheme
 */
u_int
crypto_ident(
        struct peer *peer       /* peer structure pointer */
        )
{
        char            filename[MAXFILENAME];
        const char *    scheme_name;
        u_int           scheme_id;

        /*
         * We come here after the group trusted host has been found; its
         * name defines the group name. Search the key cache for all
         * keys matching the same group name in order IFF, GQ and MV.
         * Use the first one available.
         */
        scheme_name = NULL;
        if (peer->crypto & CRYPTO_FLAG_IFF) {
                scheme_name = "iff";
                scheme_id = CRYPTO_IFF;
        } else if (peer->crypto & CRYPTO_FLAG_GQ) {
                scheme_name = "gq";
                scheme_id = CRYPTO_GQ;
        } else if (peer->crypto & CRYPTO_FLAG_MV) {
                scheme_name = "mv";
                scheme_id = CRYPTO_MV;
        }

        if (scheme_name != NULL) {
                snprintf(filename, sizeof(filename), "ntpkey_%spar_%s",
                    scheme_name, peer->ident);
                peer->ident_pkey = crypto_key(filename, NULL,
                    &peer->srcadr);
                if (peer->ident_pkey != NULL)
                        return scheme_id;
        }

        msyslog(LOG_NOTICE,
            "crypto_ident: no identity parameters found for group %s",
            peer->ident);

        return CRYPTO_NULL;
}


/*
 * crypto_args - construct extension field from arguments
 *
 * This routine creates an extension field with current timestamps and
 * specified opcode, association ID and optional string. Note that the
 * extension field is created here, but freed after the crypto_xmit()
 * call in the protocol module.
 *
 * Returns extension field pointer (no errors)
 *
 * XXX: opcode and len should really be 32-bit quantities and
 * we should make sure that str is not too big.
 */
struct exten *
crypto_args(
        struct peer *peer,      /* peer structure pointer */
        u_int   opcode,         /* operation code */
        associd_t associd,      /* association ID */
        char    *str            /* argument string */
        )
{
        tstamp_t tstamp;        /* NTP timestamp */
        struct exten *ep;       /* extension field pointer */
        u_int   len;            /* extension field length */
        size_t  slen = 0;

        tstamp = crypto_time();
        len = sizeof(struct exten);
        if (str != NULL) {
                slen = strlen(str);
                INSIST(slen < MAX_VALLEN);
                len += slen;
        }
        ep = emalloc_zero(len);
        if (opcode == 0)
                return (ep);

        REQUIRE(0 == (len    & ~0x0000ffff));
        REQUIRE(0 == (opcode & ~0xffff0000));

        ep->opcode = htonl(opcode + len);
        ep->associd = htonl(associd);
        ep->tstamp = htonl(tstamp);
        ep->fstamp = hostval.tstamp;
        ep->vallen = 0;
        if (str != NULL) {
                ep->vallen = htonl(slen);
                memcpy((char *)ep->pkt, str, slen);
        }
        return (ep);
}


/*
 * crypto_send - construct extension field from value components
 *
 * The value and signature fields are zero-padded to a word boundary.
 * Note: it is not polite to send a nonempty signature with zero
 * timestamp or a nonzero timestamp with an empty signature, but those
 * rules are not enforced here.
 *
 * XXX This code won't work on a box with 16-bit ints.
 */
int
crypto_send(
        struct exten *ep,       /* extension field pointer */
        struct value *vp,       /* value pointer */
        int     start           /* buffer offset */
        )
{
        u_int   len, vallen, siglen, opcode;
        u_int   i, j;

        /*
         * Calculate extension field length and check for buffer
         * overflow. Leave room for the MAC.
         */
        len = 16;                               /* XXX Document! */
        vallen = ntohl(vp->vallen);
        INSIST(vallen <= MAX_VALLEN);
        len += ((vallen + 3) / 4 + 1) * 4; 
        siglen = ntohl(vp->siglen);
        len += ((siglen + 3) / 4 + 1) * 4; 
        if (start + len > sizeof(struct pkt) - MAX_MAC_LEN)
                return (0);

        /*
         * Copy timestamps.
         */
        ep->tstamp = vp->tstamp;
        ep->fstamp = vp->fstamp;
        ep->vallen = vp->vallen;

        /*
         * Copy value. If the data field is empty or zero length,
         * encode an empty value with length zero.
         */
        i = 0;
        if (vallen > 0 && vp->ptr != NULL) {
                j = vallen / 4;
                if (j * 4 < vallen)
                        ep->pkt[i + j++] = 0;
                memcpy(&ep->pkt[i], vp->ptr, vallen);
                i += j;
        }

        /*
         * Copy signature. If the signature field is empty or zero
         * length, encode an empty signature with length zero.
         */
        ep->pkt[i++] = vp->siglen;
        if (siglen > 0 && vp->sig != NULL) {
                j = siglen / 4;
                if (j * 4 < siglen)
                        ep->pkt[i + j++] = 0;
                memcpy(&ep->pkt[i], vp->sig, siglen);
                /* i += j; */   /* We don't use i after this */
        }
        opcode = ntohl(ep->opcode);
        ep->opcode = htonl((opcode & 0xffff0000) | len); 
        ENSURE(len <= MAX_VALLEN);
        return (len);
}


/*
 * crypto_update - compute new public value and sign extension fields
 *
 * This routine runs periodically, like once a day, and when something
 * changes. It updates the timestamps on three value structures and one
 * value structure list, then signs all the structures:
 *
 * hostval      host name (not signed)
 * pubkey       public key
 * cinfo        certificate info/value list
 * tai_leap     leap values
 *
 * Filestamps are proventic data, so this routine runs only when the
 * host is synchronized to a proventicated source. Thus, the timestamp
 * is proventic and can be used to deflect clogging attacks.
 *
 * Returns void (no errors)
 */
void
crypto_update(void)
{
        EVP_MD_CTX *ctx;        /* message digest context */
        struct cert_info *cp;   /* certificate info/value */
        char    statstr[NTP_MAXSTRLEN]; /* statistics for filegen */
        u_int32 *ptr;
        u_int   len;
        leap_result_t leap_data;

        hostval.tstamp = htonl(crypto_time());
        if (hostval.tstamp == 0)
                return;

        ctx = EVP_MD_CTX_new();

        /*
         * Sign public key and timestamps. The filestamp is derived from
         * the host key file extension from wherever the file was
         * generated. 
         */
        if (pubkey.vallen != 0) {
                pubkey.tstamp = hostval.tstamp;
                pubkey.siglen = 0;
                if (pubkey.sig == NULL)
                        pubkey.sig = emalloc(sign_siglen);
                EVP_SignInit(ctx, sign_digest);
                EVP_SignUpdate(ctx, (u_char *)&pubkey, 12);
                EVP_SignUpdate(ctx, pubkey.ptr, ntohl(pubkey.vallen));
                if (EVP_SignFinal(ctx, pubkey.sig, &len, sign_pkey)) {
                        INSIST(len <= sign_siglen);
                        pubkey.siglen = htonl(len);
                }
        }

        /*
         * Sign certificates and timestamps. The filestamp is derived
         * from the certificate file extension from wherever the file
         * was generated. Note we do not throw expired certificates
         * away; they may have signed younger ones.
         */
        for (cp = cinfo; cp != NULL; cp = cp->link) {
                cp->cert.tstamp = hostval.tstamp;
                cp->cert.siglen = 0;
                if (cp->cert.sig == NULL)
                        cp->cert.sig = emalloc(sign_siglen);
                EVP_SignInit(ctx, sign_digest);
                EVP_SignUpdate(ctx, (u_char *)&cp->cert, 12);
                EVP_SignUpdate(ctx, cp->cert.ptr,
                    ntohl(cp->cert.vallen));
                if (EVP_SignFinal(ctx, cp->cert.sig, &len, sign_pkey)) {
                        INSIST(len <= sign_siglen);
                        cp->cert.siglen = htonl(len);
                }
        }

        /*
         * Sign leapseconds values and timestamps. Note it is not an
         * error to return null values.
         */
        tai_leap.tstamp = hostval.tstamp;
        tai_leap.fstamp = hostval.fstamp;

        /* Get the leap second era. We might need a full lookup early
         * after start, when the cache is not yet loaded.
         */
        leapsec_frame(&leap_data);
        if ( ! memcmp(&leap_data.ebase, &leap_data.ttime, sizeof(vint64))) {
                time_t   now    = time(NULL);
                uint32_t nowntp = (uint32_t)now + JAN_1970;
                leapsec_query(&leap_data, nowntp, &now);
        }

        /* Create the data block. The protocol does not work without. */
        len = 3 * sizeof(u_int32);
        if (tai_leap.ptr == NULL || ntohl(tai_leap.vallen) != len) {
                free(tai_leap.ptr);
                tai_leap.ptr = emalloc(len);
                tai_leap.vallen = htonl(len);
        }
        ptr = (u_int32 *)tai_leap.ptr;
        if (leap_data.tai_offs > 10) {
                /* create a TAI / leap era block. The end time is a
                 * fake -- maybe we can do better.
                 */
                ptr[0] = htonl(leap_data.tai_offs);
                ptr[1] = htonl(leap_data.ebase.d_s.lo);
                if (leap_data.ttime.d_s.hi >= 0)
                        ptr[2] = htonl(leap_data.ttime.D_s.lo +  7*86400);
                else
                        ptr[2] = htonl(leap_data.ebase.D_s.lo + 25*86400);
        } else {
                /* no leap era available */
                memset(ptr, 0, len);
        }
        if (tai_leap.sig == NULL)
                tai_leap.sig = emalloc(sign_siglen);
        EVP_SignInit(ctx, sign_digest);
        EVP_SignUpdate(ctx, (u_char *)&tai_leap, 12);
        EVP_SignUpdate(ctx, tai_leap.ptr, len);
        if (EVP_SignFinal(ctx, tai_leap.sig, &len, sign_pkey)) {
                INSIST(len <= sign_siglen);
                tai_leap.siglen = htonl(len);
        }
        crypto_flags |= CRYPTO_FLAG_TAI;

        snprintf(statstr, sizeof(statstr), "signature update ts %u",
            ntohl(hostval.tstamp)); 
        record_crypto_stats(NULL, statstr);
        DPRINTF(1, ("crypto_update: %s\n", statstr));
        EVP_MD_CTX_free(ctx);
}

/*
 * crypto_update_taichange - eventually trigger crypto_update
 *
 * This is called when a change in 'sys_tai' is detected. This will
 * happen shortly after a leap second is detected, but unhappily also
 * early after system start; also, the crypto stuff might be unused and
 * an unguarded call to crypto_update() causes a crash.
 *
 * This function makes sure that there already *is* a valid crypto block
 * for the use with autokey, and only calls 'crypto_update()' if it can
 * succeed.
 *
 * Returns void (no errors)
 */
void
crypto_update_taichange(void)
{
        static const u_int len = 3 * sizeof(u_int32);

        /* check if the signing digest algo is available */
        if (sign_digest == NULL || sign_pkey == NULL)
                return;

        /* check size of TAI extension block */
        if (tai_leap.ptr == NULL || ntohl(tai_leap.vallen) != len)
                return;

        /* crypto_update should at least not crash here! */
        crypto_update();
}

/*
 * value_free - free value structure components.
 *
 * Returns void (no errors)
 */
void
value_free(
        struct value *vp        /* value structure */
        )
{
        if (vp->ptr != NULL)
                free(vp->ptr);
        if (vp->sig != NULL)
                free(vp->sig);
        memset(vp, 0, sizeof(struct value));
}


/*
 * crypto_time - returns current NTP time.
 *
 * Returns NTP seconds if in synch, 0 otherwise
 */
tstamp_t
crypto_time()
{
        l_fp    tstamp;         /* NTP time */

        L_CLR(&tstamp);
        if (sys_leap != LEAP_NOTINSYNC)
                get_systime(&tstamp);
        return (tstamp.l_ui);
}


/*
 * asn_to_calendar - convert ASN1_TIME time structure to struct calendar.
 *
 */
static
void
asn_to_calendar (
        const ASN1_TIME *asn1time,      /* pointer to ASN1_TIME structure */
        struct calendar *pjd    /* pointer to result */
        )
{
        size_t  len;            /* length of ASN1_TIME string */
        char    v[24];          /* writable copy of ASN1_TIME string */
        unsigned long   temp;   /* result from strtoul */

        /*
         * Extract time string YYMMDDHHMMSSZ from ASN1 time structure.
         * Or YYYYMMDDHHMMSSZ.
         * Note that the YY, MM, DD fields start with one, the HH, MM,
         * SS fields start with zero and the Z character is ignored.
         * Also note that two-digit years less than 50 map to years greater than
         * 100. Dontcha love ASN.1? Better than MIL-188.
         */
        len = asn1time->length;
        REQUIRE(len < sizeof(v));
        (void)strncpy(v, (char *)(asn1time->data), len);
        REQUIRE(len >= 13);
        temp = strtoul(v+len-3, NULL, 10);
        pjd->second = temp;
        v[len-3] = '\0';

        temp = strtoul(v+len-5, NULL, 10);
        pjd->minute = temp;
        v[len-5] = '\0';

        temp = strtoul(v+len-7, NULL, 10);
        pjd->hour = temp;
        v[len-7] = '\0';

        temp = strtoul(v+len-9, NULL, 10);
        pjd->monthday = temp;
        v[len-9] = '\0';

        temp = strtoul(v+len-11, NULL, 10);
        pjd->month = temp;
        v[len-11] = '\0';

        temp = strtoul(v, NULL, 10);
        /* handle two-digit years */
        if (temp < 50UL)
            temp += 100UL;
        if (temp < 150UL)
            temp += 1900UL;
        pjd->year = temp;

        pjd->yearday = pjd->weekday = 0;
        return;
}


/*
 * bigdig() - compute a BIGNUM MD5 hash of a BIGNUM number.
 *
 * Returns void (no errors)
 */
static void
bighash(
        BIGNUM  *bn,            /* BIGNUM * from */
        BIGNUM  *bk             /* BIGNUM * to */
        )
{
        EVP_MD_CTX *ctx;        /* message digest context */
        u_char dgst[EVP_MAX_MD_SIZE]; /* message digest */
        u_char  *ptr;           /* a BIGNUM as binary string */
        u_int   len;

        len = BN_num_bytes(bn);
        ptr = emalloc(len);
        BN_bn2bin(bn, ptr);
        ctx = EVP_MD_CTX_new();
#   if defined(OPENSSL) && defined(EVP_MD_CTX_FLAG_NON_FIPS_ALLOW)
        /* [Bug 3457] set flags and don't kill them again */
        EVP_MD_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
        EVP_DigestInit_ex(ctx, EVP_md5(), NULL);
#   else
        EVP_DigestInit(ctx, EVP_md5());
#   endif
        EVP_DigestUpdate(ctx, ptr, len);
        EVP_DigestFinal(ctx, dgst, &len);
        EVP_MD_CTX_free(ctx);
        BN_bin2bn(dgst, len, bk);
        free(ptr);
}


/*
 ***********************************************************************
 *                                                                     *
 * The following routines implement the Schnorr (IFF) identity scheme  *
 *                                                                     *
 ***********************************************************************
 *
 * The Schnorr (IFF) identity scheme is intended for use when
 * certificates are generated by some other trusted certificate
 * authority and the certificate cannot be used to convey public
 * parameters. There are two kinds of files: encrypted server files that
 * contain private and public values and nonencrypted client files that
 * contain only public values. New generations of server files must be
 * securely transmitted to all servers of the group; client files can be
 * distributed by any means. The scheme is self contained and
 * independent of new generations of host keys, sign keys and
 * certificates.
 *
 * The IFF values hide in a DSA cuckoo structure which uses the same
 * parameters. The values are used by an identity scheme based on DSA
 * cryptography and described in Stimson p. 285. The p is a 512-bit
 * prime, g a generator of Zp* and q a 160-bit prime that divides p - 1
 * and is a qth root of 1 mod p; that is, g^q = 1 mod p. The TA rolls a
 * private random group key b (0 < b < q) and public key v = g^b, then
 * sends (p, q, g, b) to the servers and (p, q, g, v) to the clients.
 * Alice challenges Bob to confirm identity using the protocol described
 * below.
 *
 * How it works
 *
 * The scheme goes like this. Both Alice and Bob have the public primes
 * p, q and generator g. The TA gives private key b to Bob and public
 * key v to Alice.
 *
 * Alice rolls new random challenge r (o < r < q) and sends to Bob in
 * the IFF request message. Bob rolls new random k (0 < k < q), then
 * computes y = k + b r mod q and x = g^k mod p and sends (y, hash(x))
 * to Alice in the response message. Besides making the response
 * shorter, the hash makes it effectivey impossible for an intruder to
 * solve for b by observing a number of these messages.
 * 
 * Alice receives the response and computes g^y v^r mod p. After a bit
 * of algebra, this simplifies to g^k. If the hash of this result
 * matches hash(x), Alice knows that Bob has the group key b. The signed
 * response binds this knowledge to Bob's private key and the public key
 * previously received in his certificate.
 *
 * crypto_alice - construct Alice's challenge in IFF scheme
 *
 * Returns
 * XEVNT_OK     success
 * XEVNT_ID     bad or missing group key
 * XEVNT_PUB    bad or missing public key
 */
static int
crypto_alice(
        struct peer *peer,      /* peer pointer */
        struct value *vp        /* value pointer */
        )
{
        DSA     *dsa;           /* IFF parameters */
        BN_CTX  *bctx;          /* BIGNUM context */
        EVP_MD_CTX *ctx;        /* signature context */
        tstamp_t tstamp;
        u_int   len;
        const BIGNUM *q;

        /*
         * The identity parameters must have correct format and content.
         */
        if (peer->ident_pkey == NULL) {
                msyslog(LOG_NOTICE, "crypto_alice: scheme unavailable");
                return (XEVNT_ID);
        }

        if ((dsa = EVP_PKEY_get0_DSA(peer->ident_pkey->pkey)) == NULL) {
                msyslog(LOG_NOTICE, "crypto_alice: defective key");
                return (XEVNT_PUB);
        }

        /*
         * Roll new random r (0 < r < q).
         */
        if (peer->iffval != NULL)
                BN_free(peer->iffval);
        peer->iffval = BN_new();
        DSA_get0_pqg(dsa, NULL, &q, NULL);
        len = BN_num_bytes(q);
        BN_rand(peer->iffval, len * 8, -1, 1);  /* r mod q*/
        bctx = BN_CTX_new();
        BN_mod(peer->iffval, peer->iffval, q, bctx);
        BN_CTX_free(bctx);

        /*
         * Sign and send to Bob. The filestamp is from the local file.
         */
        memset(vp, 0, sizeof(struct value));
        tstamp = crypto_time();
        vp->tstamp = htonl(tstamp);
        vp->fstamp = htonl(peer->ident_pkey->fstamp);
        vp->vallen = htonl(len);
        vp->ptr = emalloc(len);
        BN_bn2bin(peer->iffval, vp->ptr);
        if (tstamp == 0)
                return (XEVNT_OK);

        vp->sig = emalloc(sign_siglen);
        ctx = EVP_MD_CTX_new();
        EVP_SignInit(ctx, sign_digest);
        EVP_SignUpdate(ctx, (u_char *)&vp->tstamp, 12);
        EVP_SignUpdate(ctx, vp->ptr, len);
        if (EVP_SignFinal(ctx, vp->sig, &len, sign_pkey)) {
                INSIST(len <= sign_siglen);
                vp->siglen = htonl(len);
        }
        EVP_MD_CTX_free(ctx);
        return (XEVNT_OK);
}


/*
 * crypto_bob - construct Bob's response to Alice's challenge
 *
 * Returns
 * XEVNT_OK     success
 * XEVNT_ERR    protocol error
 * XEVNT_ID     bad or missing group key
 */
static int
crypto_bob(
        struct exten *ep,       /* extension pointer */
        struct value *vp        /* value pointer */
        )
{
        DSA     *dsa;           /* IFF parameters */
        DSA_SIG *sdsa;          /* DSA signature context fake */
        BN_CTX  *bctx;          /* BIGNUM context */
        EVP_MD_CTX *ctx;        /* signature context */
        tstamp_t tstamp;        /* NTP timestamp */
        BIGNUM  *bn, *bk, *r;
        u_char  *ptr;
        u_int   len;            /* extension field value length */
        const BIGNUM *p, *q, *g;
        const BIGNUM *priv_key;

        /*
         * If the IFF parameters are not valid, something awful
         * happened or we are being tormented.
         */
        if (iffkey_info == NULL) {
                msyslog(LOG_NOTICE, "crypto_bob: scheme unavailable");
                return (XEVNT_ID);
        }
        dsa = EVP_PKEY_get0_DSA(iffkey_info->pkey);
        DSA_get0_pqg(dsa, &p, &q, &g);
        DSA_get0_key(dsa, NULL, &priv_key);

        /*
         * Extract r from the challenge.
         */
        len = exten_payload_size(ep);
        if (len == 0 || len > MAX_VALLEN)
                return (XEVNT_LEN);
        if ((r = BN_bin2bn((u_char *)ep->pkt, len, NULL)) == NULL) {
                msyslog(LOG_ERR, "crypto_bob: %s",
                    ERR_error_string(ERR_get_error(), NULL));
                return (XEVNT_ERR);
        }

        /*
         * Bob rolls random k (0 < k < q), computes y = k + b r mod q
         * and x = g^k mod p, then sends (y, hash(x)) to Alice.
         */
        bctx = BN_CTX_new(); bk = BN_new(); bn = BN_new();
        sdsa = DSA_SIG_new();
        BN_rand(bk, len * 8, -1, 1);            /* k */
        BN_mod_mul(bn, priv_key, r, q, bctx); /* b r mod q */
        BN_add(bn, bn, bk);
        BN_mod(bn, bn, q, bctx);                /* k + b r mod q */
        BN_mod_exp(bk, g, bk, p, bctx); /* g^k mod p */
        bighash(bk, bk);
        DSA_SIG_set0(sdsa, bn, bk);
        BN_CTX_free(bctx);
        BN_free(r);
#ifdef DEBUG
        if (debug > 1)
                DSA_print_fp(stdout, dsa, 0);
#endif

        /*
         * Encode the values in ASN.1 and sign. The filestamp is from
         * the local file.
         */
        len = i2d_DSA_SIG(sdsa, NULL);
        if (len == 0) {
                msyslog(LOG_ERR, "crypto_bob: %s",
                    ERR_error_string(ERR_get_error(), NULL));
                DSA_SIG_free(sdsa);
                return (XEVNT_ERR);
        }
        if (len > MAX_VALLEN) {
                msyslog(LOG_ERR, "crypto_bob: signature is too big: %u",
                    len);
                DSA_SIG_free(sdsa);
                return (XEVNT_LEN);
        }
        memset(vp, 0, sizeof(struct value));
        tstamp = crypto_time();
        vp->tstamp = htonl(tstamp);
        vp->fstamp = htonl(iffkey_info->fstamp);
        vp->vallen = htonl(len);
        ptr = emalloc(len);
        vp->ptr = ptr;
        i2d_DSA_SIG(sdsa, &ptr);
        DSA_SIG_free(sdsa);
        if (tstamp == 0)
                return (XEVNT_OK);

        /* XXX: more validation to make sure the sign fits... */
        vp->sig = emalloc(sign_siglen);
        ctx = EVP_MD_CTX_new();
        EVP_SignInit(ctx, sign_digest);
        EVP_SignUpdate(ctx, (u_char *)&vp->tstamp, 12);
        EVP_SignUpdate(ctx, vp->ptr, len);
        if (EVP_SignFinal(ctx, vp->sig, &len, sign_pkey)) {
                INSIST(len <= sign_siglen);
                vp->siglen = htonl(len);
        }
        EVP_MD_CTX_free(ctx);
        return (XEVNT_OK);
}


/*
 * crypto_iff - verify Bob's response to Alice's challenge
 *
 * Returns
 * XEVNT_OK     success
 * XEVNT_FSP    bad filestamp
 * XEVNT_ID     bad or missing group key
 * XEVNT_PUB    bad or missing public key
 */
int
crypto_iff(
        struct exten *ep,       /* extension pointer */
        struct peer *peer       /* peer structure pointer */
        )
{
        DSA     *dsa;           /* IFF parameters */
        BN_CTX  *bctx;          /* BIGNUM context */
        DSA_SIG *sdsa;          /* DSA parameters */
        BIGNUM  *bn, *bk;
        u_int   len;
        const u_char *ptr;
        int     temp;
        const BIGNUM *p, *g;
        const BIGNUM *r, *s;
        const BIGNUM *pub_key;

        /*
         * If the IFF parameters are not valid or no challenge was sent,
         * something awful happened or we are being tormented.
         */
        if (peer->ident_pkey == NULL) {
                msyslog(LOG_NOTICE, "crypto_iff: scheme unavailable");
                return (XEVNT_ID);
        }
        if (ntohl(ep->fstamp) != peer->ident_pkey->fstamp) {
                msyslog(LOG_NOTICE, "crypto_iff: invalid filestamp %u",
                    ntohl(ep->fstamp));
                return (XEVNT_FSP);
        }
        if ((dsa = EVP_PKEY_get0_DSA(peer->ident_pkey->pkey)) == NULL) {
                msyslog(LOG_NOTICE, "crypto_iff: defective key");
                return (XEVNT_PUB);
        }
        if (peer->iffval == NULL) {
                msyslog(LOG_NOTICE, "crypto_iff: missing challenge");
                return (XEVNT_ID);
        }

        /*
         * Extract the k + b r and g^k values from the response.
         */
        bctx = BN_CTX_new(); bk = BN_new(); bn = BN_new();
        len = ntohl(ep->vallen);
        ptr = (u_char *)ep->pkt;
        if ((sdsa = d2i_DSA_SIG(NULL, &ptr, len)) == NULL) {
                BN_free(bn); BN_free(bk); BN_CTX_free(bctx);
                msyslog(LOG_ERR, "crypto_iff: %s",
                    ERR_error_string(ERR_get_error(), NULL));
                return (XEVNT_ERR);
        }

        /*
         * Compute g^(k + b r) g^(q - b)r mod p.
         */
        DSA_get0_key(dsa, &pub_key, NULL);
        DSA_get0_pqg(dsa, &p, NULL, &g);
        DSA_SIG_get0(sdsa, &r, &s);
        BN_mod_exp(bn, pub_key, peer->iffval, p, bctx);
        BN_mod_exp(bk, g, r, p, bctx);
        BN_mod_mul(bn, bn, bk, p, bctx);

        /*
         * Verify the hash of the result matches hash(x).
         */
        bighash(bn, bn);
        temp = BN_cmp(bn, s);
        BN_free(bn); BN_free(bk); BN_CTX_free(bctx);
        BN_free(peer->iffval);
        peer->iffval = NULL;
        DSA_SIG_free(sdsa);
        if (temp == 0)
                return (XEVNT_OK);

        msyslog(LOG_NOTICE, "crypto_iff: identity not verified");
        return (XEVNT_ID);
}


/*
 ***********************************************************************
 *                                                                     *
 * The following routines implement the Guillou-Quisquater (GQ)        *
 * identity scheme                                                     *
 *                                                                     *
 ***********************************************************************
 *
 * The Guillou-Quisquater (GQ) identity scheme is intended for use when
 * the certificate can be used to convey public parameters. The scheme
 * uses a X509v3 certificate extension field do convey the public key of
 * a private key known only to servers. There are two kinds of files:
 * encrypted server files that contain private and public values and
 * nonencrypted client files that contain only public values. New
 * generations of server files must be securely transmitted to all
 * servers of the group; client files can be distributed by any means.
 * The scheme is self contained and independent of new generations of
 * host keys and sign keys. The scheme is self contained and independent
 * of new generations of host keys and sign keys.
 *
 * The GQ parameters hide in a RSA cuckoo structure which uses the same
 * parameters. The values are used by an identity scheme based on RSA
 * cryptography and described in Stimson p. 300 (with errors). The 512-
 * bit public modulus is n = p q, where p and q are secret large primes.
 * The TA rolls private random group key b as RSA exponent. These values
 * are known to all group members.
 *
 * When rolling new certificates, a server recomputes the private and
 * public keys. The private key u is a random roll, while the public key
 * is the inverse obscured by the group key v = (u^-1)^b. These values
 * replace the private and public keys normally generated by the RSA
 * scheme. Alice challenges Bob to confirm identity using the protocol
 * described below.
 *
 * How it works
 *
 * The scheme goes like this. Both Alice and Bob have the same modulus n
 * and some random b as the group key. These values are computed and
 * distributed in advance via secret means, although only the group key
 * b is truly secret. Each has a private random private key u and public
 * key (u^-1)^b, although not necessarily the same ones. Bob and Alice
 * can regenerate the key pair from time to time without affecting
 * operations. The public key is conveyed on the certificate in an
 * extension field; the private key is never revealed.
 *
 * Alice rolls new random challenge r and sends to Bob in the GQ
 * request message. Bob rolls new random k, then computes y = k u^r mod
 * n and x = k^b mod n and sends (y, hash(x)) to Alice in the response
 * message. Besides making the response shorter, the hash makes it
 * effectivey impossible for an intruder to solve for b by observing
 * a number of these messages.
 * 
 * Alice receives the response and computes y^b v^r mod n. After a bit
 * of algebra, this simplifies to k^b. If the hash of this result
 * matches hash(x), Alice knows that Bob has the group key b. The signed
 * response binds this knowledge to Bob's private key and the public key
 * previously received in his certificate.
 *
 * crypto_alice2 - construct Alice's challenge in GQ scheme
 *
 * Returns
 * XEVNT_OK     success
 * XEVNT_ID     bad or missing group key
 * XEVNT_PUB    bad or missing public key
 */
static int
crypto_alice2(
        struct peer *peer,      /* peer pointer */
        struct value *vp        /* value pointer */
        )
{
        RSA     *rsa;           /* GQ parameters */
        BN_CTX  *bctx;          /* BIGNUM context */
        EVP_MD_CTX *ctx;        /* signature context */
        tstamp_t tstamp;
        u_int   len;
        const BIGNUM *n;

        /*
         * The identity parameters must have correct format and content.
         */
        if (peer->ident_pkey == NULL)
                return (XEVNT_ID);

        if ((rsa = EVP_PKEY_get0_RSA(peer->ident_pkey->pkey)) == NULL) {
                msyslog(LOG_NOTICE, "crypto_alice2: defective key");
                return (XEVNT_PUB);
        }

        /*
         * Roll new random r (0 < r < n).
         */
        if (peer->iffval != NULL)
                BN_free(peer->iffval);
        peer->iffval = BN_new();
        RSA_get0_key(rsa, &n, NULL, NULL);
        len = BN_num_bytes(n);
        BN_rand(peer->iffval, len * 8, -1, 1);  /* r mod n */
        bctx = BN_CTX_new();
        BN_mod(peer->iffval, peer->iffval, n, bctx);
        BN_CTX_free(bctx);

        /*
         * Sign and send to Bob. The filestamp is from the local file.
         */
        memset(vp, 0, sizeof(struct value));
        tstamp = crypto_time();
        vp->tstamp = htonl(tstamp);
        vp->fstamp = htonl(peer->ident_pkey->fstamp);
        vp->vallen = htonl(len);
        vp->ptr = emalloc(len);
        BN_bn2bin(peer->iffval, vp->ptr);
        if (tstamp == 0)
                return (XEVNT_OK);

        vp->sig = emalloc(sign_siglen);
        ctx = EVP_MD_CTX_new();
        EVP_SignInit(ctx, sign_digest);
        EVP_SignUpdate(ctx, (u_char *)&vp->tstamp, 12);
        EVP_SignUpdate(ctx, vp->ptr, len);
        if (EVP_SignFinal(ctx, vp->sig, &len, sign_pkey)) {
                INSIST(len <= sign_siglen);
                vp->siglen = htonl(len);
        }
        EVP_MD_CTX_free(ctx);
        return (XEVNT_OK);
}


/*
 * crypto_bob2 - construct Bob's response to Alice's challenge
 *
 * Returns
 * XEVNT_OK     success
 * XEVNT_ERR    protocol error
 * XEVNT_ID     bad or missing group key
 */
static int
crypto_bob2(
        struct exten *ep,       /* extension pointer */
        struct value *vp        /* value pointer */
        )
{
        RSA     *rsa;           /* GQ parameters */
        DSA_SIG *sdsa;          /* DSA parameters */
        BN_CTX  *bctx;          /* BIGNUM context */
        EVP_MD_CTX *ctx;        /* signature context */
        tstamp_t tstamp;        /* NTP timestamp */
        BIGNUM  *r, *k, *g, *y;
        u_char  *ptr;
        u_int   len;
        int     s_len;
        const BIGNUM *n, *p, *e;

        /*
         * If the GQ parameters are not valid, something awful
         * happened or we are being tormented.
         */
        if (gqkey_info == NULL) {
                msyslog(LOG_NOTICE, "crypto_bob2: scheme unavailable");
                return (XEVNT_ID);
        }
        rsa = EVP_PKEY_get0_RSA(gqkey_info->pkey);
        RSA_get0_key(rsa, &n, &p, &e);

        /*
         * Extract r from the challenge.
         */
        len = exten_payload_size(ep);
        if (len == 0 || len > MAX_VALLEN)
                return (XEVNT_LEN);
        if ((r = BN_bin2bn((u_char *)ep->pkt, len, NULL)) == NULL) {
                msyslog(LOG_ERR, "crypto_bob2: %s",
                    ERR_error_string(ERR_get_error(), NULL));
                return (XEVNT_ERR);
        }

        /*
         * Bob rolls random k (0 < k < n), computes y = k u^r mod n and
         * x = k^b mod n, then sends (y, hash(x)) to Alice. 
         */
        bctx = BN_CTX_new(); k = BN_new(); g = BN_new(); y = BN_new();
        sdsa = DSA_SIG_new();
        BN_rand(k, len * 8, -1, 1);             /* k */
        BN_mod(k, k, n, bctx);
        BN_mod_exp(y, p, r, n, bctx); /* u^r mod n */
        BN_mod_mul(y, k, y, n, bctx);   /* k u^r mod n */
        BN_mod_exp(g, k, e, n, bctx); /* k^b mod n */
        bighash(g, g);
        DSA_SIG_set0(sdsa, y, g);
        BN_CTX_free(bctx);
        BN_free(r); BN_free(k);
#ifdef DEBUG
        if (debug > 1)
                RSA_print_fp(stdout, rsa, 0);
#endif
 
        /*
         * Encode the values in ASN.1 and sign. The filestamp is from
         * the local file.
         */
        len = s_len = i2d_DSA_SIG(sdsa, NULL);
        if (s_len <= 0) {
                msyslog(LOG_ERR, "crypto_bob2: %s",
                    ERR_error_string(ERR_get_error(), NULL));
                DSA_SIG_free(sdsa);
                return (XEVNT_ERR);
        }
        memset(vp, 0, sizeof(struct value));
        tstamp = crypto_time();
        vp->tstamp = htonl(tstamp);
        vp->fstamp = htonl(gqkey_info->fstamp);
        vp->vallen = htonl(len);
        ptr = emalloc(len);
        vp->ptr = ptr;
        i2d_DSA_SIG(sdsa, &ptr);
        DSA_SIG_free(sdsa);
        if (tstamp == 0)
                return (XEVNT_OK);

        vp->sig = emalloc(sign_siglen);
        ctx = EVP_MD_CTX_new();
        EVP_SignInit(ctx, sign_digest);
        EVP_SignUpdate(ctx, (u_char *)&vp->tstamp, 12);
        EVP_SignUpdate(ctx, vp->ptr, len);
        if (EVP_SignFinal(ctx, vp->sig, &len, sign_pkey)) {
                INSIST(len <= sign_siglen);
                vp->siglen = htonl(len);
        }
        EVP_MD_CTX_free(ctx);
        return (XEVNT_OK);
}


/*
 * crypto_gq - verify Bob's response to Alice's challenge
 *
 * Returns
 * XEVNT_OK     success
 * XEVNT_ERR    protocol error
 * XEVNT_FSP    bad filestamp
 * XEVNT_ID     bad or missing group keys
 * XEVNT_PUB    bad or missing public key
 */
int
crypto_gq(
        struct exten *ep,       /* extension pointer */
        struct peer *peer       /* peer structure pointer */
        )
{
        RSA     *rsa;           /* GQ parameters */
        BN_CTX  *bctx;          /* BIGNUM context */
        DSA_SIG *sdsa;          /* RSA signature context fake */
        BIGNUM  *y, *v;
        const u_char *ptr;
        long    len;
        u_int   temp;
        const BIGNUM *n, *e;
        const BIGNUM *r, *s;

        /*
         * If the GQ parameters are not valid or no challenge was sent,
         * something awful happened or we are being tormented. Note that
         * the filestamp on the local key file can be greater than on
         * the remote parameter file if the keys have been refreshed.
         */
        if (peer->ident_pkey == NULL) {
                msyslog(LOG_NOTICE, "crypto_gq: scheme unavailable");
                return (XEVNT_ID);
        }
        if (ntohl(ep->fstamp) < peer->ident_pkey->fstamp) {
                msyslog(LOG_NOTICE, "crypto_gq: invalid filestamp %u",
                    ntohl(ep->fstamp));
                return (XEVNT_FSP);
        }
        if ((rsa = EVP_PKEY_get0_RSA(peer->ident_pkey->pkey)) == NULL) {
                msyslog(LOG_NOTICE, "crypto_gq: defective key");
                return (XEVNT_PUB);
        }
        RSA_get0_key(rsa, &n, NULL, &e);
        if (peer->iffval == NULL) {
                msyslog(LOG_NOTICE, "crypto_gq: missing challenge");
                return (XEVNT_ID);
        }

        /*
         * Extract the y = k u^r and hash(x = k^b) values from the
         * response.
         */
        bctx = BN_CTX_new(); y = BN_new(); v = BN_new();
        len = ntohl(ep->vallen);
        ptr = (u_char *)ep->pkt;
        if ((sdsa = d2i_DSA_SIG(NULL, &ptr, len)) == NULL) {
                BN_CTX_free(bctx); BN_free(y); BN_free(v);
                msyslog(LOG_ERR, "crypto_gq: %s",
                    ERR_error_string(ERR_get_error(), NULL));
                return (XEVNT_ERR);
        }
        DSA_SIG_get0(sdsa, &r, &s);

        /*
         * Compute v^r y^b mod n.
         */
        if (peer->grpkey == NULL) {
                msyslog(LOG_NOTICE, "crypto_gq: missing group key");
                return (XEVNT_ID);
        }
        BN_mod_exp(v, peer->grpkey, peer->iffval, n, bctx);
                                                /* v^r mod n */
        BN_mod_exp(y, r, e, n, bctx); /* y^b mod n */
        BN_mod_mul(y, v, y, n, bctx);   /* v^r y^b mod n */

        /*
         * Verify the hash of the result matches hash(x).
         */
        bighash(y, y);
        temp = BN_cmp(y, s);
        BN_CTX_free(bctx); BN_free(y); BN_free(v);
        BN_free(peer->iffval);
        peer->iffval = NULL;
        DSA_SIG_free(sdsa);
        if (temp == 0)
                return (XEVNT_OK);

        msyslog(LOG_NOTICE, "crypto_gq: identity not verified");
        return (XEVNT_ID);
}


/*
 ***********************************************************************
 *                                                                     *
 * The following routines implement the Mu-Varadharajan (MV) identity  *
 * scheme                                                              *
 *                                                                     *
 ***********************************************************************
 *
 * The Mu-Varadharajan (MV) cryptosystem was originally intended when
 * servers broadcast messages to clients, but clients never send
 * messages to servers. There is one encryption key for the server and a
 * separate decryption key for each client. It operated something like a
 * pay-per-view satellite broadcasting system where the session key is
 * encrypted by the broadcaster and the decryption keys are held in a
 * tamperproof set-top box.
 *
 * The MV parameters and private encryption key hide in a DSA cuckoo
 * structure which uses the same parameters, but generated in a
 * different way. The values are used in an encryption scheme similar to
 * El Gamal cryptography and a polynomial formed from the expansion of
 * product terms (x - x[j]), as described in Mu, Y., and V.
 * Varadharajan: Robust and Secure Broadcasting, Proc. Indocrypt 2001,
 * 223-231. The paper has significant errors and serious omissions.
 *
 * Let q be the product of n distinct primes s1[j] (j = 1...n), where
 * each s1[j] has m significant bits. Let p be a prime p = 2 * q + 1, so
 * that q and each s1[j] divide p - 1 and p has M = n * m + 1
 * significant bits. Let g be a generator of Zp; that is, gcd(g, p - 1)
 * = 1 and g^q = 1 mod p. We do modular arithmetic over Zq and then
 * project into Zp* as exponents of g. Sometimes we have to compute an
 * inverse b^-1 of random b in Zq, but for that purpose we require
 * gcd(b, q) = 1. We expect M to be in the 500-bit range and n
 * relatively small, like 30. These are the parameters of the scheme and
 * they are expensive to compute.
 *
 * We set up an instance of the scheme as follows. A set of random
 * values x[j] mod q (j = 1...n), are generated as the zeros of a
 * polynomial of order n. The product terms (x - x[j]) are expanded to
 * form coefficients a[i] mod q (i = 0...n) in powers of x. These are
 * used as exponents of the generator g mod p to generate the private
 * encryption key A. The pair (gbar, ghat) of public server keys and the
 * pairs (xbar[j], xhat[j]) (j = 1...n) of private client keys are used
 * to construct the decryption keys. The devil is in the details.
 *
 * This routine generates a private server encryption file including the
 * private encryption key E and partial decryption keys gbar and ghat.
 * It then generates public client decryption files including the public
 * keys xbar[j] and xhat[j] for each client j. The partial decryption
 * files are used to compute the inverse of E. These values are suitably
 * blinded so secrets are not revealed.
 *
 * The distinguishing characteristic of this scheme is the capability to
 * revoke keys. Included in the calculation of E, gbar and ghat is the
 * product s = prod(s1[j]) (j = 1...n) above. If the factor s1[j] is
 * subsequently removed from the product and E, gbar and ghat
 * recomputed, the jth client will no longer be able to compute E^-1 and
 * thus unable to decrypt the messageblock.
 *
 * How it works
 *
 * The scheme goes like this. Bob has the server values (p, E, q, gbar,
 * ghat) and Alice has the client values (p, xbar, xhat).
 *
 * Alice rolls new random nonce r mod p and sends to Bob in the MV
 * request message. Bob rolls random nonce k mod q, encrypts y = r E^k
 * mod p and sends (y, gbar^k, ghat^k) to Alice.
 * 
 * Alice receives the response and computes the inverse (E^k)^-1 from
 * the partial decryption keys gbar^k, ghat^k, xbar and xhat. She then
 * decrypts y and verifies it matches the original r. The signed
 * response binds this knowledge to Bob's private key and the public key
 * previously received in his certificate.
 *
 * crypto_alice3 - construct Alice's challenge in MV scheme
 *
 * Returns
 * XEVNT_OK     success
 * XEVNT_ID     bad or missing group key
 * XEVNT_PUB    bad or missing public key
 */
static int
crypto_alice3(
        struct peer *peer,      /* peer pointer */
        struct value *vp        /* value pointer */
        )
{
        DSA     *dsa;           /* MV parameters */
        BN_CTX  *bctx;          /* BIGNUM context */
        EVP_MD_CTX *ctx;        /* signature context */
        tstamp_t tstamp;
        u_int   len;
        const BIGNUM *p;

        /*
         * The identity parameters must have correct format and content.
         */
        if (peer->ident_pkey == NULL)
                return (XEVNT_ID);

        if ((dsa = EVP_PKEY_get0_DSA(peer->ident_pkey->pkey)) == NULL) {
                msyslog(LOG_NOTICE, "crypto_alice3: defective key");
                return (XEVNT_PUB);
        }
        DSA_get0_pqg(dsa, &p, NULL, NULL);

        /*
         * Roll new random r (0 < r < q).
         */
        if (peer->iffval != NULL)
                BN_free(peer->iffval);
        peer->iffval = BN_new();
        len = BN_num_bytes(p);
        BN_rand(peer->iffval, len * 8, -1, 1);  /* r mod p */
        bctx = BN_CTX_new();
        BN_mod(peer->iffval, peer->iffval, p, bctx);
        BN_CTX_free(bctx);

        /*
         * Sign and send to Bob. The filestamp is from the local file.
         */
        memset(vp, 0, sizeof(struct value));
        tstamp = crypto_time();
        vp->tstamp = htonl(tstamp);
        vp->fstamp = htonl(peer->ident_pkey->fstamp);
        vp->vallen = htonl(len);
        vp->ptr = emalloc(len);
        BN_bn2bin(peer->iffval, vp->ptr);
        if (tstamp == 0)
                return (XEVNT_OK);

        vp->sig = emalloc(sign_siglen);
        ctx = EVP_MD_CTX_new();
        EVP_SignInit(ctx, sign_digest);
        EVP_SignUpdate(ctx, (u_char *)&vp->tstamp, 12);
        EVP_SignUpdate(ctx, vp->ptr, len);
        if (EVP_SignFinal(ctx, vp->sig, &len, sign_pkey)) {
                INSIST(len <= sign_siglen);
                vp->siglen = htonl(len);
        }
        EVP_MD_CTX_free(ctx);
        return (XEVNT_OK);
}


/*
 * crypto_bob3 - construct Bob's response to Alice's challenge
 *
 * Returns
 * XEVNT_OK     success
 * XEVNT_ERR    protocol error
 */
static int
crypto_bob3(
        struct exten *ep,       /* extension pointer */
        struct value *vp        /* value pointer */
        )
{
        DSA     *dsa;           /* MV parameters */
        DSA     *sdsa;          /* DSA signature context fake */
        BN_CTX  *bctx;          /* BIGNUM context */
        EVP_MD_CTX *ctx;        /* signature context */
        tstamp_t tstamp;        /* NTP timestamp */
        BIGNUM  *r, *k, *u;
        u_char  *ptr;
        u_int   len;
        const BIGNUM *p, *q, *g;
        const BIGNUM *pub_key, *priv_key;
        BIGNUM *sp, *sq, *sg;

        /*
         * If the MV parameters are not valid, something awful
         * happened or we are being tormented.
         */
        if (mvkey_info == NULL) {
                msyslog(LOG_NOTICE, "crypto_bob3: scheme unavailable");
                return (XEVNT_ID);
        }
        dsa = EVP_PKEY_get0_DSA(mvkey_info->pkey);
        DSA_get0_pqg(dsa, &p, &q, &g);
        DSA_get0_key(dsa, &pub_key, &priv_key);

        /*
         * Extract r from the challenge.
         */
        len = exten_payload_size(ep);
        if (len == 0 || len > MAX_VALLEN)
                return (XEVNT_LEN);
        if ((r = BN_bin2bn((u_char *)ep->pkt, len, NULL)) == NULL) {
                msyslog(LOG_ERR, "crypto_bob3: %s",
                    ERR_error_string(ERR_get_error(), NULL));
                return (XEVNT_ERR);
        }

        /*
         * Bob rolls random k (0 < k < q), making sure it is not a
         * factor of q. He then computes y = r A^k and sends (y, gbar^k,
         * and ghat^k) to Alice.
         */
        bctx = BN_CTX_new(); k = BN_new(); u = BN_new();
        sdsa = DSA_new();
        sp = BN_new(); sq = BN_new(); sg = BN_new();
        while (1) {
                BN_rand(k, BN_num_bits(q), 0, 0);
                BN_mod(k, k, q, bctx);
                BN_gcd(u, k, q, bctx);
                if (BN_is_one(u))
                        break;
        }
        BN_mod_exp(u, g, k, p, bctx); /* A^k r */
        BN_mod_mul(sp, u, r, p, bctx);
        BN_mod_exp(sq, priv_key, k, p, bctx); /* gbar */
        BN_mod_exp(sg, pub_key, k, p, bctx); /* ghat */
        DSA_set0_key(sdsa, BN_dup(pub_key), NULL);
        DSA_set0_pqg(sdsa, sp, sq, sg);
        BN_CTX_free(bctx); BN_free(k); BN_free(r); BN_free(u);
#ifdef DEBUG
        if (debug > 1)
                DSA_print_fp(stdout, sdsa, 0);
#endif

        /*
         * Encode the values in ASN.1 and sign. The filestamp is from
         * the local file.
         */
        memset(vp, 0, sizeof(struct value));
        tstamp = crypto_time();
        vp->tstamp = htonl(tstamp);
        vp->fstamp = htonl(mvkey_info->fstamp);
        len = i2d_DSAparams(sdsa, NULL);
        if (len == 0) {
                msyslog(LOG_ERR, "crypto_bob3: %s",
                    ERR_error_string(ERR_get_error(), NULL));
                DSA_free(sdsa);
                return (XEVNT_ERR);
        }
        vp->vallen = htonl(len);
        ptr = emalloc(len);
        vp->ptr = ptr;
        i2d_DSAparams(sdsa, &ptr);
        DSA_free(sdsa);
        if (tstamp == 0)
                return (XEVNT_OK);

        vp->sig = emalloc(sign_siglen);
        ctx = EVP_MD_CTX_new();
        EVP_SignInit(ctx, sign_digest);
        EVP_SignUpdate(ctx, (u_char *)&vp->tstamp, 12);
        EVP_SignUpdate(ctx, vp->ptr, len);
        if (EVP_SignFinal(ctx, vp->sig, &len, sign_pkey)) {
                INSIST(len <= sign_siglen);
                vp->siglen = htonl(len);
        }
        EVP_MD_CTX_free(ctx);
        return (XEVNT_OK);
}


/*
 * crypto_mv - verify Bob's response to Alice's challenge
 *
 * Returns
 * XEVNT_OK     success
 * XEVNT_ERR    protocol error
 * XEVNT_FSP    bad filestamp
 * XEVNT_ID     bad or missing group key
 * XEVNT_PUB    bad or missing public key
 */
int
crypto_mv(
        struct exten *ep,       /* extension pointer */
        struct peer *peer       /* peer structure pointer */
        )
{
        DSA     *dsa;           /* MV parameters */
        DSA     *sdsa;          /* DSA parameters */
        BN_CTX  *bctx;          /* BIGNUM context */
        BIGNUM  *k, *u, *v;
        u_int   len;
        const u_char *ptr;
        int     temp;
        const BIGNUM *p;
        const BIGNUM *pub_key, *priv_key;
        const BIGNUM *sp, *sq, *sg;

        /*
         * If the MV parameters are not valid or no challenge was sent,
         * something awful happened or we are being tormented.
         */
        if (peer->ident_pkey == NULL) {
                msyslog(LOG_NOTICE, "crypto_mv: scheme unavailable");
                return (XEVNT_ID);
        }
        if (ntohl(ep->fstamp) != peer->ident_pkey->fstamp) {
                msyslog(LOG_NOTICE, "crypto_mv: invalid filestamp %u",
                    ntohl(ep->fstamp));
                return (XEVNT_FSP);
        }
        if ((dsa = EVP_PKEY_get0_DSA(peer->ident_pkey->pkey)) == NULL) {
                msyslog(LOG_NOTICE, "crypto_mv: defective key");
                return (XEVNT_PUB);
        }
        DSA_get0_pqg(dsa, &p, NULL, NULL);
        DSA_get0_key(dsa, &pub_key, &priv_key);
        if (peer->iffval == NULL) {
                msyslog(LOG_NOTICE, "crypto_mv: missing challenge");
                return (XEVNT_ID);
        }

        /*
         * Extract the y, gbar and ghat values from the response.
         */
        bctx = BN_CTX_new(); k = BN_new(); u = BN_new(); v = BN_new();
        len = ntohl(ep->vallen);
        ptr = (u_char *)ep->pkt;
        if ((sdsa = d2i_DSAparams(NULL, &ptr, len)) == NULL) {
                msyslog(LOG_ERR, "crypto_mv: %s",
                    ERR_error_string(ERR_get_error(), NULL));
                return (XEVNT_ERR);
        }
        DSA_get0_pqg(sdsa, &sp, &sq, &sg);

        /*
         * Compute (gbar^xhat ghat^xbar) mod p.
         */
        BN_mod_exp(u, sq, pub_key, p, bctx);
        BN_mod_exp(v, sg, priv_key, p, bctx);
        BN_mod_mul(u, u, v, p, bctx);
        BN_mod_mul(u, u, sp, p, bctx);

        /*
         * The result should match r.
         */
        temp = BN_cmp(u, peer->iffval);
        BN_CTX_free(bctx); BN_free(k); BN_free(u); BN_free(v);
        BN_free(peer->iffval);
        peer->iffval = NULL;
        DSA_free(sdsa);
        if (temp == 0)
                return (XEVNT_OK);

        msyslog(LOG_NOTICE, "crypto_mv: identity not verified");
        return (XEVNT_ID);
}


/*
 ***********************************************************************
 *                                                                     *
 * The following routines are used to manipulate certificates          *
 *                                                                     *
 ***********************************************************************
 */
/*
 * cert_sign - sign x509 certificate equest and update value structure.
 *
 * The certificate request includes a copy of the host certificate,
 * which includes the version number, subject name and public key of the
 * host. The resulting certificate includes these values plus the
 * serial number, issuer name and valid interval of the server. The
 * valid interval extends from the current time to the same time one
 * year hence. This may extend the life of the signed certificate beyond
 * that of the signer certificate.
 *
 * It is convenient to use the NTP seconds of the current time as the
 * serial number. In the value structure the timestamp is the current
 * time and the filestamp is taken from the extension field. Note this
 * routine is called only when the client clock is synchronized to a
 * proventic source, so timestamp comparisons are valid.
 *
 * The host certificate is valid from the time it was generated for a
 * period of one year. A signed certificate is valid from the time of
 * signature for a period of one year, but only the host certificate (or
 * sign certificate if used) is actually used to encrypt and decrypt
 * signatures. The signature trail is built from the client via the
 * intermediate servers to the trusted server. Each signature on the
 * trail must be valid at the time of signature, but it could happen
 * that a signer certificate expire before the signed certificate, which
 * remains valid until its expiration. 
 *
 * Returns
 * XEVNT_OK     success
 * XEVNT_CRT    bad or missing certificate
 * XEVNT_PER    host certificate expired
 * XEVNT_PUB    bad or missing public key
 * XEVNT_VFY    certificate not verified
 */
static int
cert_sign(
        struct exten *ep,       /* extension field pointer */
        struct value *vp        /* value pointer */
        )
{
        X509    *req;           /* X509 certificate request */
        X509    *cert;          /* X509 certificate */
        X509_EXTENSION *ext;    /* certificate extension */
        ASN1_INTEGER *serial;   /* serial number */
        X509_NAME *subj;        /* distinguished (common) name */
        EVP_PKEY *pkey;         /* public key */
        EVP_MD_CTX *ctx;        /* message digest context */
        tstamp_t tstamp;        /* NTP timestamp */
        struct calendar tscal;
        u_int   len;
        const u_char *cptr;
        u_char *ptr;
        int     i, temp;

        /*
         * Decode ASN.1 objects and construct certificate structure.
         * Make sure the system clock is synchronized to a proventic
         * source.
         */
        tstamp = crypto_time();
        if (tstamp == 0)
                return (XEVNT_TSP);

        len = exten_payload_size(ep);
        if (len == 0 || len > MAX_VALLEN)
                return (XEVNT_LEN);
        cptr = (void *)ep->pkt;
        if ((req = d2i_X509(NULL, &cptr, len)) == NULL) {
                msyslog(LOG_ERR, "cert_sign: %s",
                    ERR_error_string(ERR_get_error(), NULL));
                return (XEVNT_CRT);
        }
        /*
         * Extract public key and check for errors.
         */
        if ((pkey = X509_get_pubkey(req)) == NULL) {
                msyslog(LOG_ERR, "cert_sign: %s",
                    ERR_error_string(ERR_get_error(), NULL));
                X509_free(req);
                return (XEVNT_PUB);
        }

        /*
         * Generate X509 certificate signed by this server. If this is a
         * trusted host, the issuer name is the group name; otherwise,
         * it is the host name. Also copy any extensions that might be
         * present.
         */
        cert = X509_new();
        X509_set_version(cert, X509_get_version(req));
        serial = ASN1_INTEGER_new();
        ASN1_INTEGER_set(serial, tstamp);
        X509_set_serialNumber(cert, serial);
        X509_gmtime_adj(X509_getm_notBefore(cert), 0L);
        X509_gmtime_adj(X509_getm_notAfter(cert), YEAR);
        subj = X509_get_issuer_name(cert);
        X509_NAME_add_entry_by_txt(subj, "commonName", MBSTRING_ASC,
            hostval.ptr, strlen((const char *)hostval.ptr), -1, 0);
        subj = X509_get_subject_name(req);
        X509_set_subject_name(cert, subj);
        X509_set_pubkey(cert, pkey);
        temp = X509_get_ext_count(req);
        for (i = 0; i < temp; i++) {
                ext = X509_get_ext(req, i);
                INSIST(X509_add_ext(cert, ext, -1));
        }
        X509_free(req);

        /*
         * Sign and verify the client certificate, but only if the host
         * certificate has not expired.
         */
        (void)ntpcal_ntp_to_date(&tscal, tstamp, NULL);
        if ((calcomp(&tscal, &(cert_host->first)) < 0)
        || (calcomp(&tscal, &(cert_host->last)) > 0)) {
                X509_free(cert);
                return (XEVNT_PER);
        }
        X509_sign(cert, sign_pkey, sign_digest);
        if (X509_verify(cert, sign_pkey) <= 0) {
                msyslog(LOG_ERR, "cert_sign: %s",
                    ERR_error_string(ERR_get_error(), NULL));
                X509_free(cert);
                return (XEVNT_VFY);
        }
        len = i2d_X509(cert, NULL);

        /*
         * Build and sign the value structure. We have to sign it here,
         * since the response has to be returned right away. This is a
         * clogging hazard.
         */
        memset(vp, 0, sizeof(struct value));
        vp->tstamp = htonl(tstamp);
        vp->fstamp = ep->fstamp;
        vp->vallen = htonl(len);
        vp->ptr = emalloc(len);
        ptr = vp->ptr;
        i2d_X509(cert, (unsigned char **)(intptr_t)&ptr);
        vp->siglen = 0;
        if (tstamp != 0) {
                vp->sig = emalloc(sign_siglen);
                ctx = EVP_MD_CTX_new();
                EVP_SignInit(ctx, sign_digest);
                EVP_SignUpdate(ctx, (u_char *)vp, 12);
                EVP_SignUpdate(ctx, vp->ptr, len);
                if (EVP_SignFinal(ctx, vp->sig, &len, sign_pkey)) {
                        INSIST(len <= sign_siglen);
                        vp->siglen = htonl(len);
                }
                EVP_MD_CTX_free(ctx);
        }
#ifdef DEBUG
        if (debug > 1)
                X509_print_fp(stdout, cert);
#endif
        X509_free(cert);
        return (XEVNT_OK);
}


/*
 * cert_install - install certificate in certificate cache
 *
 * This routine encodes an extension field into a certificate info/value
 * structure. It searches the certificate list for duplicates and
 * expunges whichever is older. Finally, it inserts this certificate
 * first on the list.
 *
 * Returns certificate info pointer if valid, NULL if not.
 */
struct cert_info *
cert_install(
        struct exten *ep,       /* cert info/value */
        struct peer *peer       /* peer structure */
        )
{
        struct cert_info *cp, *xp, **zp;

        /*
         * Parse and validate the signed certificate. If valid,
         * construct the info/value structure; otherwise, scamper home
         * empty handed.
         */
        if ((cp = cert_parse((u_char *)ep->pkt, (long)ntohl(ep->vallen),
            (tstamp_t)ntohl(ep->fstamp))) == NULL)
                return (NULL);

        /*
         * Scan certificate list looking for another certificate with
         * the same subject and issuer. If another is found with the
         * same or older filestamp, unlink it and return the goodies to
         * the heap. If another is found with a later filestamp, discard
         * the new one and leave the building with the old one.
         *
         * Make a note to study this issue again. An earlier certificate
         * with a long lifetime might be overtaken by a later
         * certificate with a short lifetime, thus invalidating the
         * earlier signature. However, we gotta find a way to leak old
         * stuff from the cache, so we do it anyway. 
         */
        zp = &cinfo;
        for (xp = cinfo; xp != NULL; xp = xp->link) {
                if (strcmp(cp->subject, xp->subject) == 0 &&
                    strcmp(cp->issuer, xp->issuer) == 0) {
                        if (ntohl(cp->cert.fstamp) <=
                            ntohl(xp->cert.fstamp)) {
                                cert_free(cp);
                                cp = xp;
                        } else {
                                *zp = xp->link;
                                cert_free(xp);
                                xp = NULL;
                        }
                        break;
                }
                zp = &xp->link;
        }
        if (xp == NULL) {
                cp->link = cinfo;
                cinfo = cp;
        }
        cp->flags |= CERT_VALID;
        crypto_update();
        return (cp);
}


/*
 * cert_hike - verify the signature using the issuer public key
 *
 * Returns
 * XEVNT_OK     success
 * XEVNT_CRT    bad or missing certificate
 * XEVNT_PER    host certificate expired
 * XEVNT_VFY    certificate not verified
 */
int
cert_hike(
        struct peer *peer,      /* peer structure pointer */
        struct cert_info *yp    /* issuer certificate */
        )
{
        struct cert_info *xp;   /* subject certificate */
        X509    *cert;          /* X509 certificate */
        const u_char *ptr;

        /*
         * Save the issuer on the new certificate, but remember the old
         * one.
         */
        if (peer->issuer != NULL)
                free(peer->issuer);
        peer->issuer = estrdup(yp->issuer);
        xp = peer->xinfo;
        peer->xinfo = yp;

        /*
         * If subject Y matches issuer Y, then the certificate trail is
         * complete. If Y is not trusted, the server certificate has yet
         * been signed, so keep trying. Otherwise, save the group key
         * and light the valid bit. If the host certificate is trusted,
         * do not execute a sign exchange. If no identity scheme is in
         * use, light the identity and proventic bits.
         */
        if (strcmp(yp->subject, yp->issuer) == 0) {
                if (!(yp->flags & CERT_TRUST))
                        return (XEVNT_OK);

                /*
                 * If the server has an an identity scheme, fetch the
                 * identity credentials. If not, the identity is
                 * verified only by the trusted certificate. The next
                 * signature will set the server proventic.
                 */
                peer->crypto |= CRYPTO_FLAG_CERT;
                peer->grpkey = yp->grpkey;
                if (peer->ident == NULL || !(peer->crypto &
                    CRYPTO_FLAG_MASK))
                        peer->crypto |= CRYPTO_FLAG_VRFY;
        }

        /*
         * If X exists, verify signature X using public key Y.
         */
        if (xp == NULL)
                return (XEVNT_OK);

        ptr = (u_char *)xp->cert.ptr;
        cert = d2i_X509(NULL, &ptr, ntohl(xp->cert.vallen));
        if (cert == NULL) {
                xp->flags |= CERT_ERROR;
                return (XEVNT_CRT);
        }
        if (X509_verify(cert, yp->pkey) <= 0) {
                X509_free(cert);
                xp->flags |= CERT_ERROR;
                return (XEVNT_VFY);
        }
        X509_free(cert);

        /*
         * Signature X is valid only if it begins during the
         * lifetime of Y. 
         */
        if ((calcomp(&(xp->first), &(yp->first)) < 0)
        || (calcomp(&(xp->first), &(yp->last)) > 0)) {
                xp->flags |= CERT_ERROR;
                return (XEVNT_PER);
        }
        xp->flags |= CERT_SIGN;
        return (XEVNT_OK);
}


/*
 * cert_parse - parse x509 certificate and create info/value structures.
 *
 * The server certificate includes the version number, issuer name,
 * subject name, public key and valid date interval. If the issuer name
 * is the same as the subject name, the certificate is self signed and
 * valid only if the server is configured as trustable. If the names are
 * different, another issuer has signed the server certificate and
 * vouched for it. In this case the server certificate is valid if
 * verified by the issuer public key.
 *
 * Returns certificate info/value pointer if valid, NULL if not.
 */
struct cert_info *              /* certificate information structure */
cert_parse(
        const u_char *asn1cert, /* X509 certificate */
        long    len,            /* certificate length */
        tstamp_t fstamp         /* filestamp */
        )
{
        X509    *cert;          /* X509 certificate */
        struct cert_info *ret;  /* certificate info/value */
        BIO     *bp;
        char    pathbuf[MAXFILENAME];
        const u_char *ptr;
        char    *pch;
        int     cnt, i;
        struct calendar fscal;

        /*
         * Decode ASN.1 objects and construct certificate structure.
         */
        ptr = asn1cert;
        if ((cert = d2i_X509(NULL, &ptr, len)) == NULL) {
                msyslog(LOG_ERR, "cert_parse: %s",
                    ERR_error_string(ERR_get_error(), NULL));
                return (NULL);
        }
#ifdef DEBUG
        if (debug > 1)
                X509_print_fp(stdout, cert);
#endif

        /*
         * Extract version, subject name and public key.
         */
        ret = emalloc_zero(sizeof(*ret));
        if ((ret->pkey = X509_get_pubkey(cert)) == NULL) {
                msyslog(LOG_ERR, "cert_parse: %s",
                    ERR_error_string(ERR_get_error(), NULL));
                cert_free(ret);
                X509_free(cert);
                return (NULL);
        }
        ret->version = X509_get_version(cert);
        X509_NAME_oneline(X509_get_subject_name(cert), pathbuf,
            sizeof(pathbuf));
        pch = strstr(pathbuf, "CN=");
        if (NULL == pch) {
                msyslog(LOG_NOTICE, "cert_parse: invalid subject %s",
                    pathbuf);
                cert_free(ret);
                X509_free(cert);
                return (NULL);
        }
        ret->subject = estrdup(pch + 3);

        /*
         * Extract remaining objects. Note that the NTP serial number is
         * the NTP seconds at the time of signing, but this might not be
         * the case for other authority. We don't bother to check the
         * objects at this time, since the real crunch can happen only
         * when the time is valid but not yet certificated.
         */
        ret->nid = X509_get_signature_nid(cert);
        ret->digest = (const EVP_MD *)EVP_get_digestbynid(ret->nid);
        ret->serial =
            (u_long)ASN1_INTEGER_get(X509_get_serialNumber(cert));
        X509_NAME_oneline(X509_get_issuer_name(cert), pathbuf,
            sizeof(pathbuf));
        if ((pch = strstr(pathbuf, "CN=")) == NULL) {
                msyslog(LOG_NOTICE, "cert_parse: invalid issuer %s",
                    pathbuf);
                cert_free(ret);
                X509_free(cert);
                return (NULL);
        }
        ret->issuer = estrdup(pch + 3);
        asn_to_calendar(X509_get0_notBefore(cert), &(ret->first));
        asn_to_calendar(X509_get0_notAfter(cert), &(ret->last));

        /*
         * Extract extension fields. These are ad hoc ripoffs of
         * currently assigned functions and will certainly be changed
         * before prime time.
         */
        cnt = X509_get_ext_count(cert);
        for (i = 0; i < cnt; i++) {
                X509_EXTENSION *ext;
                ASN1_OBJECT *obj;
                int nid;
                ASN1_OCTET_STRING *data;

                ext = X509_get_ext(cert, i);
                obj = X509_EXTENSION_get_object(ext);
                nid = OBJ_obj2nid(obj);

                switch (nid) {

                /*
                 * If a key_usage field is present, we decode whether
                 * this is a trusted or private certificate. This is
                 * dorky; all we want is to compare NIDs, but OpenSSL
                 * insists on BIO text strings.
                 */
                case NID_ext_key_usage:
                        bp = BIO_new(BIO_s_mem());
                        X509V3_EXT_print(bp, ext, 0, 0);
                        BIO_gets(bp, pathbuf, sizeof(pathbuf));
                        BIO_free(bp);
                        if (strcmp(pathbuf, "Trust Root") == 0)
                                ret->flags |= CERT_TRUST;
                        else if (strcmp(pathbuf, "Private") == 0)
                                ret->flags |= CERT_PRIV;
                        DPRINTF(1, ("cert_parse: %s: %s\n",
                                    OBJ_nid2ln(nid), pathbuf));
                        break;

                /*
                 * If a NID_subject_key_identifier field is present, it
                 * contains the GQ public key.
                 */
                case NID_subject_key_identifier:
                        data = X509_EXTENSION_get_data(ext);
                        ret->grpkey = BN_bin2bn(&data->data[2],
                            data->length - 2, NULL);
                        /* fall through */
                default:
                        DPRINTF(1, ("cert_parse: %s\n",
                                    OBJ_nid2ln(nid)));
                        break;
                }
        }
        if (strcmp(ret->subject, ret->issuer) == 0) {

                /*
                 * If certificate is self signed, verify signature.
                 */
                if (X509_verify(cert, ret->pkey) <= 0) {
                        msyslog(LOG_NOTICE,
                            "cert_parse: signature not verified %s",
                            ret->subject);
                        cert_free(ret);
                        X509_free(cert);
                        return (NULL);
                }
        } else {

                /*
                 * Check for a certificate loop.
                 */
                if (strcmp((const char *)hostval.ptr, ret->issuer) == 0) {
                        msyslog(LOG_NOTICE,
                            "cert_parse: certificate trail loop %s",
                            ret->subject);
                        cert_free(ret);
                        X509_free(cert);
                        return (NULL);
                }
        }

        /*
         * Verify certificate valid times. Note that certificates cannot
         * be retroactive.
         */
        (void)ntpcal_ntp_to_date(&fscal, fstamp, NULL);
        if ((calcomp(&(ret->first), &(ret->last)) > 0)
        || (calcomp(&(ret->first), &fscal) < 0)) {
                msyslog(LOG_NOTICE,
                    "cert_parse: invalid times %s first %u-%02u-%02uT%02u:%02u:%02u last %u-%02u-%02uT%02u:%02u:%02u fstamp %u-%02u-%02uT%02u:%02u:%02u",
                    ret->subject,
                    ret->first.year, ret->first.month, ret->first.monthday,
                    ret->first.hour, ret->first.minute, ret->first.second,
                    ret->last.year, ret->last.month, ret->last.monthday,
                    ret->last.hour, ret->last.minute, ret->last.second,
                    fscal.year, fscal.month, fscal.monthday,
                    fscal.hour, fscal.minute, fscal.second);
                cert_free(ret);
                X509_free(cert);
                return (NULL);
        }

        /*
         * Build the value structure to sign and send later.
         */
        ret->cert.fstamp = htonl(fstamp);
        ret->cert.vallen = htonl(len);
        ret->cert.ptr = emalloc(len);
        memcpy(ret->cert.ptr, asn1cert, len);
        X509_free(cert);
        return (ret);
}


/*
 * cert_free - free certificate information structure
 */
void
cert_free(
        struct cert_info *cinf  /* certificate info/value structure */ 
        )
{
        if (cinf->pkey != NULL)
                EVP_PKEY_free(cinf->pkey);
        if (cinf->subject != NULL)
                free(cinf->subject);
        if (cinf->issuer != NULL)
                free(cinf->issuer);
        if (cinf->grpkey != NULL)
                BN_free(cinf->grpkey);
        value_free(&cinf->cert);
        free(cinf);
}


/*
 * crypto_key - load cryptographic parameters and keys
 *
 * This routine searches the key cache for matching name in the form
 * ntpkey_<key>_<name>, where <key> is one of host, sign, iff, gq, mv,
 * and <name> is the host/group name. If not found, it tries to load a
 * PEM-encoded file of the same name and extracts the filestamp from
 * the first line of the file name. It returns the key pointer if valid,
 * NULL if not.
 */
static struct pkey_info *
crypto_key(
        char    *cp,            /* file name */
        char    *passwd1,       /* password */
        sockaddr_u *addr        /* IP address */
        )
{
        FILE    *str;           /* file handle */
        struct pkey_info *pkp;  /* generic key */
        EVP_PKEY *pkey = NULL;  /* public/private key */
        tstamp_t fstamp;
        char    filename[MAXFILENAME]; /* name of key file */
        char    linkname[MAXFILENAME]; /* filestamp buffer) */
        char    statstr[NTP_MAXSTRLEN]; /* statistics for filegen */
        char    *ptr;

        /*
         * Search the key cache for matching key and name.
         */
        for (pkp = pkinfo; pkp != NULL; pkp = pkp->link) {
                if (strcmp(cp, pkp->name) == 0)
                        return (pkp);
        }  

        /*
         * Open the key file. If the first character of the file name is
         * not '/', prepend the keys directory string. If something goes
         * wrong, abandon ship.
         */
        if (*cp == '/')
                strlcpy(filename, cp, sizeof(filename));
        else
                snprintf(filename, sizeof(filename), "%s/%s", keysdir,
                    cp);
        str = fopen(filename, "r");
        if (str == NULL)
                return (NULL);

        /*
         * Read the filestamp, which is contained in the first line.
         */
        if ((ptr = fgets(linkname, sizeof(linkname), str)) == NULL) {
                msyslog(LOG_ERR, "crypto_key: empty file %s",
                    filename);
                fclose(str);
                return (NULL);
        }
        if ((ptr = strrchr(ptr, '.')) == NULL) {
                msyslog(LOG_ERR, "crypto_key: no filestamp %s",
                    filename);
                fclose(str);
                return (NULL);
        }
        if (sscanf(++ptr, "%u", &fstamp) != 1) {
                msyslog(LOG_ERR, "crypto_key: invalid filestamp %s",
                    filename);
                fclose(str);
                return (NULL);
        }

        /*
         * Read and decrypt PEM-encoded private key. If it fails to
         * decrypt, game over.
         */
        pkey = PEM_read_PrivateKey(str, NULL, NULL, passwd1);
        fclose(str);
        if (pkey == NULL) {
                msyslog(LOG_ERR, "crypto_key: %s",
                    ERR_error_string(ERR_get_error(), NULL));
                exit (-1);
        }

        /*
         * Make a new entry in the key cache.
         */
        pkp = emalloc(sizeof(struct pkey_info));
        pkp->link = pkinfo;
        pkinfo = pkp;
        pkp->pkey = pkey;
        pkp->name = estrdup(cp);
        pkp->fstamp = fstamp;

        /*
         * Leave tracks in the cryptostats.
         */
        if ((ptr = strrchr(linkname, '\n')) != NULL)
                *ptr = '\0'; 
        snprintf(statstr, sizeof(statstr), "%s mod %d", &linkname[2],
            EVP_PKEY_size(pkey) * 8);
        record_crypto_stats(addr, statstr);
        
        DPRINTF(1, ("crypto_key: %s\n", statstr));
#ifdef DEBUG
        if (debug > 1) {
                if (EVP_PKEY_base_id(pkey) == EVP_PKEY_DSA)
                        DSA_print_fp(stdout, EVP_PKEY_get0_DSA(pkey), 0);
                else if (EVP_PKEY_base_id(pkey) == EVP_PKEY_RSA)
                        RSA_print_fp(stdout, EVP_PKEY_get0_RSA(pkey), 0);
        }
#endif
        return (pkp);
}


/*
 ***********************************************************************
 *                                                                     *
 * The following routines are used only at initialization time         *
 *                                                                     *
 ***********************************************************************
 */
/*
 * crypto_cert - load certificate from file
 *
 * This routine loads an X.509 RSA or DSA certificate from a file and
 * constructs a info/cert value structure for this machine. The
 * structure includes a filestamp extracted from the file name. Later
 * the certificate can be sent to another machine on request.
 *
 * Returns certificate info/value pointer if valid, NULL if not.
 */
static struct cert_info *       /* certificate information */
crypto_cert(
        char    *cp             /* file name */
        )
{
        struct cert_info *ret; /* certificate information */
        FILE    *str;           /* file handle */
        char    filename[MAXFILENAME]; /* name of certificate file */
        char    linkname[MAXFILENAME]; /* filestamp buffer */
        char    statstr[NTP_MAXSTRLEN]; /* statistics for filegen */
        tstamp_t fstamp;        /* filestamp */
        long    len;
        char    *ptr;
        char    *name, *header;
        u_char  *data;

        /*
         * Open the certificate file. If the first character of the file
         * name is not '/', prepend the keys directory string. If
         * something goes wrong, abandon ship.
         */
        if (*cp == '/')
                strlcpy(filename, cp, sizeof(filename));
        else
                snprintf(filename, sizeof(filename), "%s/%s", keysdir,
                    cp);
        str = fopen(filename, "r");
        if (str == NULL)
                return (NULL);

        /*
         * Read the filestamp, which is contained in the first line.
         */
        if ((ptr = fgets(linkname, sizeof(linkname), str)) == NULL) {
                msyslog(LOG_ERR, "crypto_cert: empty file %s",
                    filename);
                fclose(str);
                return (NULL);
        }
        if ((ptr = strrchr(ptr, '.')) == NULL) {
                msyslog(LOG_ERR, "crypto_cert: no filestamp %s",
                    filename);
                fclose(str);
                return (NULL);
        }
        if (sscanf(++ptr, "%u", &fstamp) != 1) {
                msyslog(LOG_ERR, "crypto_cert: invalid filestamp %s",
                    filename);
                fclose(str);
                return (NULL);
        }

        /*
         * Read PEM-encoded certificate and install.
         */
        if (!PEM_read(str, &name, &header, &data, &len)) {
                msyslog(LOG_ERR, "crypto_cert: %s",
                    ERR_error_string(ERR_get_error(), NULL));
                fclose(str);
                return (NULL);
        }
        fclose(str);
        free(header);
        if (strcmp(name, "CERTIFICATE") != 0) {
                msyslog(LOG_NOTICE, "crypto_cert: wrong PEM type %s",
                    name);
                free(name);
                free(data);
                return (NULL);
        }
        free(name);

        /*
         * Parse certificate and generate info/value structure. The
         * pointer and copy nonsense is due something broken in Solaris.
         */
        ret = cert_parse(data, len, fstamp);
        free(data);
        if (ret == NULL)
                return (NULL);

        if ((ptr = strrchr(linkname, '\n')) != NULL)
                *ptr = '\0'; 
        snprintf(statstr, sizeof(statstr), "%s 0x%x len %lu",
            &linkname[2], ret->flags, len);
        record_crypto_stats(NULL, statstr);
        DPRINTF(1, ("crypto_cert: %s\n", statstr));
        return (ret);
}


/*
 * crypto_setup - load keys, certificate and identity parameters
 *
 * This routine loads the public/private host key and certificate. If
 * available, it loads the public/private sign key, which defaults to
 * the host key. The host key must be RSA, but the sign key can be
 * either RSA or DSA. If a trusted certificate, it loads the identity
 * parameters. In either case, the public key on the certificate must
 * agree with the sign key.
 *
 * Required but missing files and inconsistent data and errors are
 * fatal. Allowing configuration to continue would be hazardous and
 * require really messy error checks.
 */
void
crypto_setup(void)
{
        struct pkey_info *pinfo; /* private/public key */
        char    filename[MAXFILENAME]; /* file name buffer */
        char    hostname[MAXFILENAME]; /* host name buffer */
        char    *randfile;
        char    statstr[NTP_MAXSTRLEN]; /* statistics for filegen */
        l_fp    seed;           /* crypto PRNG seed as NTP timestamp */
        u_int   len;
        int     bytes;
        u_char  *ptr;

        /*
         * Check for correct OpenSSL version and avoid initialization in
         * the case of multiple crypto commands.
         */
        if (crypto_flags & CRYPTO_FLAG_ENAB) {
                msyslog(LOG_NOTICE,
                    "crypto_setup: spurious crypto command");
                return;
        }
        ssl_check_version();

        /*
         * Load required random seed file and seed the random number
         * generator. Be default, it is found as .rnd in the user home
         * directory. The root home directory may be / or /root,
         * depending on the system. Wiggle the contents a bit and write
         * it back so the sequence does not repeat when we next restart.
         */
        if (!RAND_status()) {
                if (rand_file == NULL) {
                        RAND_file_name(filename, sizeof(filename));
                        randfile = filename;
                } else if (*rand_file != '/') {
                        snprintf(filename, sizeof(filename), "%s/%s",
                            keysdir, rand_file);
                        randfile = filename;
                } else
                        randfile = rand_file;

                if ((bytes = RAND_load_file(randfile, -1)) == 0) {
                        msyslog(LOG_ERR,
                            "crypto_setup: random seed file %s missing",
                            randfile);
                        exit (-1);
                }
                arc4random_buf(&seed, sizeof(l_fp));
                RAND_seed(&seed, sizeof(l_fp));
                RAND_write_file(randfile);
                DPRINTF(1, ("crypto_setup: OpenSSL version %lx random seed file %s bytes read %d\n",
                            OpenSSL_version_num(), randfile, bytes));

        }

        /*
         * Initialize structures.
         */
        gethostname(hostname, sizeof(hostname));
        if (host_filename != NULL)
                strlcpy(hostname, host_filename, sizeof(hostname));
        if (passwd == NULL)
                passwd = estrdup(hostname);
        memset(&hostval, 0, sizeof(hostval));
        memset(&pubkey, 0, sizeof(pubkey));
        memset(&tai_leap, 0, sizeof(tai_leap));

        /*
         * Load required host key from file "ntpkey_host_<hostname>". If
         * no host key file is not found or has invalid password, life
         * as we know it ends. The host key also becomes the default
         * sign key. 
         */
        snprintf(filename, sizeof(filename), "ntpkey_host_%s", hostname);
        pinfo = crypto_key(filename, passwd, NULL);
        if (pinfo == NULL) {
                msyslog(LOG_ERR,
                    "crypto_setup: host key file %s not found or corrupt",
                    filename);
                exit (-1);
        }
        if (EVP_PKEY_base_id(pinfo->pkey) != EVP_PKEY_RSA) {
                msyslog(LOG_ERR,
                    "crypto_setup: host key is not RSA key type");
                exit (-1);
        }
        host_pkey = pinfo->pkey;
        sign_pkey = host_pkey;
        hostval.fstamp = htonl(pinfo->fstamp);
        
        /*
         * Construct public key extension field for agreement scheme.
         */
        len = i2d_PublicKey(host_pkey, NULL);
        ptr = emalloc(len);
        pubkey.ptr = ptr;
        i2d_PublicKey(host_pkey, &ptr);
        pubkey.fstamp = hostval.fstamp;
        pubkey.vallen = htonl(len);

        /*
         * Load optional sign key from file "ntpkey_sign_<hostname>". If
         * available, it becomes the sign key.
         */
        snprintf(filename, sizeof(filename), "ntpkey_sign_%s", hostname);
        pinfo = crypto_key(filename, passwd, NULL);
        if (pinfo != NULL)
                sign_pkey = pinfo->pkey;

        /*
         * Load required certificate from file "ntpkey_cert_<hostname>".
         */
        snprintf(filename, sizeof(filename), "ntpkey_cert_%s", hostname);
        cinfo = crypto_cert(filename);
        if (cinfo == NULL) {
                msyslog(LOG_ERR,
                    "crypto_setup: certificate file %s not found or corrupt",
                    filename);
                exit (-1);
        }
        cert_host = cinfo;
        sign_digest = cinfo->digest;
        sign_siglen = EVP_PKEY_size(sign_pkey);
        if (cinfo->flags & CERT_PRIV)
                crypto_flags |= CRYPTO_FLAG_PRIV;

        /*
         * The certificate must be self-signed.
         */
        if (strcmp(cinfo->subject, cinfo->issuer) != 0) {
                msyslog(LOG_ERR,
                    "crypto_setup: certificate %s is not self-signed",
                    filename);
                exit (-1);
        }
        hostval.ptr = estrdup(cinfo->subject);
        hostval.vallen = htonl(strlen(cinfo->subject));
        sys_hostname = hostval.ptr;
        ptr = (u_char *)strchr(sys_hostname, '@');
        if (ptr != NULL)
                sys_groupname = estrdup((char *)++ptr);
        if (ident_filename != NULL)
                strlcpy(hostname, ident_filename, sizeof(hostname));

        /*
         * Load optional IFF parameters from file
         * "ntpkey_iffkey_<hostname>".
         */
        snprintf(filename, sizeof(filename), "ntpkey_iffkey_%s",
            hostname);
        iffkey_info = crypto_key(filename, passwd, NULL);
        if (iffkey_info != NULL)
                crypto_flags |= CRYPTO_FLAG_IFF;

        /*
         * Load optional GQ parameters from file
         * "ntpkey_gqkey_<hostname>".
         */
        snprintf(filename, sizeof(filename), "ntpkey_gqkey_%s",
            hostname);
        gqkey_info = crypto_key(filename, passwd, NULL);
        if (gqkey_info != NULL)
                crypto_flags |= CRYPTO_FLAG_GQ;

        /*
         * Load optional MV parameters from file
         * "ntpkey_mvkey_<hostname>".
         */
        snprintf(filename, sizeof(filename), "ntpkey_mvkey_%s",
            hostname);
        mvkey_info = crypto_key(filename, passwd, NULL);
        if (mvkey_info != NULL)
                crypto_flags |= CRYPTO_FLAG_MV;

        /*
         * We met the enemy and he is us. Now strike up the dance.
         */
        crypto_flags |= CRYPTO_FLAG_ENAB | (cinfo->nid << 16);
        snprintf(statstr, sizeof(statstr), "setup 0x%x host %s %s",
            crypto_flags, hostname, OBJ_nid2ln(cinfo->nid));
        record_crypto_stats(NULL, statstr);
        DPRINTF(1, ("crypto_setup: %s\n", statstr));
}


/*
 * crypto_config - configure data from the crypto command.
 */
void
crypto_config(
        int     item,           /* configuration item */
        char    *cp             /* item name */
        )
{
        int     nid;

        DPRINTF(1, ("crypto_config: item %d %s\n", item, cp));

        switch (item) {

        /*
         * Set host name (host).
         */
        case CRYPTO_CONF_PRIV:
                if (NULL != host_filename)
                        free(host_filename);
                host_filename = estrdup(cp);
                break;

        /*
         * Set group name (ident).
         */
        case CRYPTO_CONF_IDENT:
                if (NULL != ident_filename)
                        free(ident_filename);
                ident_filename = estrdup(cp);
                break;

        /*
         * Set private key password (pw).
         */
        case CRYPTO_CONF_PW:
                if (NULL != passwd)
                        free(passwd);
                passwd = estrdup(cp);
                break;

        /*
         * Set random seed file name (randfile).
         */
        case CRYPTO_CONF_RAND:
                if (NULL != rand_file)
                        free(rand_file);
                rand_file = estrdup(cp);
                break;

        /*
         * Set message digest NID.
         */
        case CRYPTO_CONF_NID:
                nid = OBJ_sn2nid(cp);
                if (nid == 0)
                        msyslog(LOG_ERR,
                            "crypto_config: invalid digest name %s", cp);
                else
                        crypto_nid = nid;
                break;
        }
}

/*
 * Get the  payload size (internal value length) of an extension packet.
 * If the inner value size does not match the outer packet size (that
 * is, the value would end behind the frame given by the opcode/size
 * field) the function will effectively return UINT_MAX. If the frame is
 * too short to hold a variable-sized value, the return value is zero.
 */
static u_int
exten_payload_size(
        const struct exten * ep)
{
        typedef const u_char *BPTR;
        
        size_t extn_size;
        size_t data_size;
        size_t head_size;

        data_size = 0;
        if (NULL != ep) {
                head_size = (BPTR)(&ep->vallen + 1) - (BPTR)ep;
                extn_size = (uint16_t)(ntohl(ep->opcode) & 0x0000ffff);
                if (extn_size >= head_size) {
                        data_size = (uint32_t)ntohl(ep->vallen);
                        if (data_size > extn_size - head_size)
                                data_size = ~(size_t)0u;
                }
        }
        return (u_int)data_size;
}
# else  /* !AUTOKEY follows */
int ntp_crypto_bs_pubkey;
# endif /* !AUTOKEY */