From: Dave Hart Date: Fri, 9 Jun 2023 19:11:34 +0000 (+0000) Subject: Add DSA, DSA-SHA, and SHA to tests/libntp/digests.c regression test. X-Git-Tag: NTP_4_2_8P18_RC1~49^2~1 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b02b4fafcb5781d42753f91d0a035d137bbd8271;p=thirdparty%2Fntp.git Add DSA, DSA-SHA, and SHA to tests/libntp/digests.c regression test. bk: 648379666uNUjOBJTYXrXisSm-MFhA --- diff --git a/ChangeLog b/ChangeLog index 93cdab8b9..3a41cecc9 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,6 @@ +--- +* Add DSA, DSA-SHA, and SHA to tests/libntp/digests.c. + --- (4.2.8p17) 2023/06/06 Released by Harlan Stenn diff --git a/libntp/authkeys.c b/libntp/authkeys.c index d28b4b932..69652cd03 100644 --- a/libntp/authkeys.c +++ b/libntp/authkeys.c @@ -927,6 +927,7 @@ authdecrypt( pkt, length, size, keyno); } + /* password decoding helpers */ static size_t pwdecode_plain( diff --git a/libntp/authreadkeys.c b/libntp/authreadkeys.c index fa2f5b540..d62a91ab6 100644 --- a/libntp/authreadkeys.c +++ b/libntp/authreadkeys.c @@ -218,14 +218,14 @@ authreadkeys( keytype = keytype_from_text(token, NULL); if (keytype == 0) { log_maybe(NULL, - "authreadkeys: invalid type for key %d", - keyno); + "authreadkeys: unsupported type %s for key %d", + token, keyno); # ifdef ENABLE_CMAC } else if (NID_cmac != keytype && EVP_get_digestbynid(keytype) == NULL) { log_maybe(NULL, - "authreadkeys: no algorithm for key %d", - keyno); + "authreadkeys: no algorithm for %s key %d", + token, keyno); keytype = 0; # endif /* ENABLE_CMAC */ } @@ -270,12 +270,14 @@ authreadkeys( "authreadkeys: passwd has bad char for key %d", keyno); break; +#ifdef DEBUG default: log_maybe(&nerr, - "authreadkeys: unknown errno %d for key %d", + "authreadkeys: unexpected errno %d for key %d: %m", errno, keyno); break; } +#endif continue; } next = emalloc(sizeof(KeyDataT) + len); diff --git a/libntp/ssl_init.c b/libntp/ssl_init.c index 925893257..dd66c78db 100644 --- a/libntp/ssl_init.c +++ b/libntp/ssl_init.c @@ -102,7 +102,7 @@ keytype_from_text( int key_type; u_int digest_len; #ifdef OPENSSL /* --*-- OpenSSL code --*-- */ - const u_long max_digest_len = MAX_MAC_LEN - sizeof(keyid_t); + const u_long max_digest_len = MAX_MDG_LEN; char * upcased; char * pch; EVP_MD const * md; @@ -217,11 +217,6 @@ keytype_name( # ifdef ENABLE_CMAC if (NID_cmac == nid) { name = CMAC; - - if (debug) { - fprintf(stderr, "%s:%d:%s():%s:nid\n", - __FILE__, __LINE__, __func__, CMAC); - } } else # endif /*ENABLE_CMAC*/ if (NULL == name) { diff --git a/ntpq/ntpq.c b/ntpq/ntpq.c index 1a0e9b1a6..4ac41b567 100644 --- a/ntpq/ntpq.c +++ b/ntpq/ntpq.c @@ -3941,31 +3941,25 @@ list_md_fn(const EVP_MD *m, const char *from, const char *to, void *arg) size_t len, n; const char *name, **seen; struct hstate *hstate = arg; - const char *cp; /* m is MD obj, from is name or alias, to is base name for alias */ - if (!m || !from || to) + if (!m || !from || to) { return; /* Ignore aliases */ + } /* Discard MACs that NTP won't accept. */ /* Keep this consistent with keytype_from_text() in ssl_init.c. */ - if (EVP_MD_size(m) > (MAX_MAC_LEN - sizeof(keyid_t))) + if (EVP_MD_size(m) > MAX_MDG_LEN) { return; + } name = EVP_MD_name(m); - - /* Lowercase names aren't accepted by keytype_from_text in ssl_init.c */ - - for (cp = name; *cp; cp++) - if (islower((unsigned char)*cp)) - return; - - len = (cp - name) + 1; + len = strlen(name) + 1; /* There are duplicates. Discard if name has been seen. */ for (seen = hstate->seen; *seen; seen++) - if (!strcmp(*seen, name)) + if (!strcasecmp(*seen, name)) return; n = (seen - hstate->seen) + 2; @@ -4057,11 +4051,12 @@ insert_cmac(char *list) /* No - end of list */ if (!delim && !last_nl) { delim = list + len; - } else + } else { /* New line and no delim or before delim? */ if (last_nl && (!delim || last_nl < delim)) { delim = last_nl; } + } /* Found insertion point where CMAC before entry? */ if (strncmp(CMAC, point, delim - point) < 0) { diff --git a/tests/libntp/data/ntp.keys b/tests/libntp/data/ntp.keys index 6c8c743fd..ef634dd00 100644 --- a/tests/libntp/data/ntp.keys +++ b/tests/libntp/data/ntp.keys @@ -1,15 +1,16 @@ -# This unit test ntp.keys file has hard-coded the current set -# of OpenSSL-supported digest algorithms. It needs to be updated -# after newer algorithms are available. The current list can be +# This unit test ntp.keys file has hard-coded the union of sets +# of OpenSSL-supported digest algorithms we've come across. It +# needs to be updated as algorithms are observed. A list can be # obtained with: # # ntpq -c "help keytype" # -# tests/libntp/digest.c similarly hardcodes the list of digests -# to test. +# tests/libntp/digests.c similarly hardcodes the list of digests +# to test. This file must be kept in sync with it. # # Each digest is tested twice with keyids separated by 50 for # plaintext and hex-encoded keys. +# 1 AES128CMAC X~A=%NWlo]p$dGq,S3M9 2 MD4 oV'8?f+J5`_EOvW!B,R` @@ -18,9 +19,9 @@ 5 RIPEMD160 I89p}f6QopwC\LwHBm;e 6 SHA1 A;H=E;.m4N%t%EeJ90[d 7 SHAKE128 |HxLoa,mzG<"y>^TI_(1 - 8 MD5 306+^SHLV5{"v7W`U3aY # unused so far - 9 MD5 lGyKZgsI_Pi"y"8JAT98 # unused -10 MD5 2:VO]Q5u%/b&}.