From: Harlan Stenn Date: Fri, 31 Dec 2010 22:34:44 +0000 (-0500) Subject: Autokey multiple identity group improvements from Dave Mills X-Git-Tag: NTP_4_2_7P108~6 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3dbf3cb97481059bb5efe76c6af3d41cb865ff7b;p=thirdparty%2Fntp.git Autokey multiple identity group improvements from Dave Mills bk: 4d1e5a84MxbaY-NQMRLNyw3f0F3qaQ --- diff --git a/ChangeLog b/ChangeLog index 3eb3375bf..e252605bc 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,4 @@ +* Autokey multiple identity group improvements from Dave Mills. * [Bug 1768] TIOCFLUSH undefined in linux for refclock_acts. (4.2.7p107) 2010/12/31 Released by Harlan Stenn * [Bug 1764] Palisade driver doesn't build on Linux. diff --git a/html/authopt.html b/html/authopt.html index 252e363df..c4e4d4992 100644 --- a/html/authopt.html +++ b/html/authopt.html @@ -10,7 +10,9 @@ color: #FF0000; font-weight: bold; } -.style1 {color: #FF0000} +.style1 { + color: #FF0000 +} @@ -18,7 +20,7 @@ color: #FF0000; gif

from Alice's Adventures in Wonderland, Lewis Carroll

Our resident cryptographer; now you see him, now you don't.

Last update: - 22-Dec-2010 21:55 + 31-Dec-2010 6:20 UTC

Related Links

@@ -64,7 +64,7 @@ Walt Kelly

iburst

When the server is unreachable, send a burst of packets instead of the usual one. This option is valid only with the server command and type s addresses. It is a recommended option with this command. Additional information about this option is on the Poll Program page.

ident group

Specify group as the group name for the association. This is used by the identigy scheme described on the Autokey Public-Key Authenticationn page.

Specify the group name for the association. See the Autokey Public-Key Authentication page for further information.

key key

Send and receive packets authenticated by the symmetric key scheme described in the Authentication Support page. The key specifies the key identifier with values from 1 to 65534, inclusive. This option is mutually exclusive with the autokey option.

minpoll minpollmaxpoll maxpoll

diff --git a/ntpd/ntp_control.c b/ntpd/ntp_control.c index 2b3e1ae86..aca356675 100644 --- a/ntpd/ntp_control.c +++ b/ntpd/ntp_control.c @@ -2292,8 +2292,8 @@ ctl_putsys( case CS_HOST: if (sys_hostname != NULL) - ctl_putstr(sys_var[CS_HOST].text, sys_hostname, - strlen(sys_hostname)); + ctl_putstr(sys_var[CS_HOST].text, hostval.ptr, + strlen(hostval.ptr)); break; case CS_IDENT: diff --git a/ntpd/ntp_crypto.c b/ntpd/ntp_crypto.c index 2d616a968..21bb6f37d 100644 --- a/ntpd/ntp_crypto.c +++ b/ntpd/ntp_crypto.c @@ -3647,7 +3647,8 @@ crypto_setup(void) { struct pkey_info *pinfo; /* private/public key */ char filename[MAXFILENAME]; /* file name buffer */ - char * randfile; + char hostname[MAXFILENAME]; /* host name buffer */ + char *randfile; char statstr[NTP_MAXSTRLEN]; /* statistics for filegen */ l_fp seed; /* crypto PRNG seed as NTP timestamp */ u_int len; @@ -3703,13 +3704,12 @@ crypto_setup(void) /* * Initialize structures. */ - if (sys_hostname == NULL) { - gethostname(filename, MAXFILENAME); - sys_hostname = emalloc(strlen(filename) + 1); - strcpy(sys_hostname, filename); - } + gethostname(hostname, MAXFILENAME); + if (sys_hostname == NULL) + sys_hostname = strdup(hostname); if (passwd == NULL) passwd = sys_hostname; + memset(&hostval, 0, sizeof(hostval)); memset(&pubkey, 0, sizeof(pubkey)); memset(&tai_leap, 0, sizeof(tai_leap)); @@ -3720,7 +3720,7 @@ crypto_setup(void) * as we know it ends. The host key also becomes the default * sign key. */ - snprintf(filename, MAXFILENAME, "ntpkey_host_%s", sys_hostname); + snprintf(filename, MAXFILENAME, "ntpkey_host_%s", hostname); pinfo = crypto_key(filename, passwd, NULL); if (pinfo == NULL) { msyslog(LOG_ERR, @@ -3751,14 +3751,14 @@ crypto_setup(void) * Load optional sign key from file "ntpkey_sign_". If * available, it becomes the sign key. */ - snprintf(filename, MAXFILENAME, "ntpkey_sign_%s", sys_hostname); + snprintf(filename, MAXFILENAME, "ntpkey_sign_%s", hostname); pinfo = crypto_key(filename, passwd, NULL); if (pinfo != NULL) sign_pkey = pinfo->pkey; /* * Load required certificate from file "ntpkey_cert_". */ - snprintf(filename, MAXFILENAME, "ntpkey_cert_%s", sys_hostname); + snprintf(filename, MAXFILENAME, "ntpkey_cert_%s", hostname); cinfo = crypto_cert(filename); if (cinfo == NULL) { msyslog(LOG_ERR, @@ -3781,37 +3781,42 @@ crypto_setup(void) filename); exit (-1); } - hostval.vallen = htonl(strlen(cinfo->subject)); - hostval.ptr = cinfo->subject; +printf("xxx %s %s\n", sys_hostname, sys_groupname); + if (sys_groupname == NULL) - sys_groupname = sys_hostname; + snprintf(filename, MAXFILENAME, "%s", sys_hostname); + else + snprintf(filename, MAXFILENAME, "%s@%s", sys_hostname, + sys_groupname); + hostval.vallen = htonl(strlen(filename)); + hostval.ptr = strdup(filename); /* * Load optional IFF parameters from file - * "ntpkey_iffkey_". + * "ntpkey_iffkey_". */ snprintf(filename, MAXFILENAME, "ntpkey_iffkey_%s", - sys_groupname); + hostname); iffkey_info = crypto_key(filename, passwd, NULL); if (iffkey_info != NULL) crypto_flags |= CRYPTO_FLAG_IFF; /* * Load optional GQ parameters from file - * "ntpkey_gqkey_". + * "ntpkey_gqkey_". */ snprintf(filename, MAXFILENAME, "ntpkey_gqkey_%s", - sys_groupname); + hostname); gqkey_info = crypto_key(filename, passwd, NULL); if (gqkey_info != NULL) crypto_flags |= CRYPTO_FLAG_GQ; /* * Load optional MV parameters from file - * "ntpkey_mvkey_". + * "ntpkey_mvkey_". */ snprintf(filename, MAXFILENAME, "ntpkey_mvkey_%s", - sys_groupname); + hostname); mvkey_info = crypto_key(filename, passwd, NULL); if (mvkey_info != NULL) crypto_flags |= CRYPTO_FLAG_MV; @@ -3821,7 +3826,7 @@ crypto_setup(void) */ crypto_flags |= CRYPTO_FLAG_ENAB | (cinfo->nid << 16); snprintf(statstr, NTP_MAXSTRLEN, - "setup 0x%x host %s %s", crypto_flags, sys_hostname, + "setup 0x%x host %s %s", crypto_flags, hostname, OBJ_nid2ln(cinfo->nid)); record_crypto_stats(NULL, statstr); #ifdef DEBUG diff --git a/util/ntp-keygen.c b/util/ntp-keygen.c index a08872ab6..6375ce01c 100644 --- a/util/ntp-keygen.c +++ b/util/ntp-keygen.c @@ -416,21 +416,16 @@ main( else if (strcmp(pathbuf, "Private") == 0) exten = EXT_KEY_PRIVATE; - if (groupname == NULL) - groupname = ptr + 3; + if (certname == NULL) + certname = ptr + 3; } } } } if (scheme == NULL) scheme = "RSA-MD5"; - if (groupname == NULL) - groupname = hostname; fprintf(stderr, "Using host %s group %s\n", hostname, groupname); - if ((iffkey || gqkey || mvkey) && exten == NULL) - fprintf(stderr, - "Warning: identity files may not be useful with a nontrusted certificate.\n"); #endif /* AUTOKEY */ /* @@ -2054,7 +2049,7 @@ fheader ( perror("Write"); exit (-1); } - sprintf(linkname, "ntpkey_%s_%s", ulink, owner); + sprintf(linkname, "ntpkey_%s_%s", ulink, hostname); remove(linkname); temp = symlink(filename, linkname); if (temp < 0)