Fw: [Git][NTPsec/ntpsec][master] Implement nts ca and cert options in parser.

Sat, 02 Feb 2019 12:31:27 -0800 

Yo Eric!

     char *server;      /* if NUL, use the peer itself (normal case)
*/
+    char *ca;          /* if NUL, use the system default (normal
case) */
+    char *cert;                /* if NUL, use the system default

NULL, not NUL.

RGDS
GARY
---------------------------------------------------------------------------
Gary E. Miller Rellim 109 NW Wilmington Ave., Suite E, Bend, OR 97703
        g...@rellim.com  Tel:+1 541 382 8588

            Veritas liberabit vos. -- Quid est veritas?
    "If you can’t measure it, you can’t improve it." - Lord Kelvin
Title: GitLab

Eric S. Raymond pushed to branch master at NTPsec / ntpsec

Commits:

  • 45a1e3cb
    by Eric S. Raymond at 2019-02-02T20:26:16Z 
    Implement nts ca and cert options in parser.

6 changed files:

Changes:

  • devel/nts.adoc
    ... ... @@ -248,11 +248,6 @@ Eventually, look into how openssl-ciphers does this and autoconfigure.
    248 248 
     Per-server options now implemented in the config parser are now
    249 249 
     described in docs/includes/assoc-options.txt
    250 250
    251 
    -*cert [file]*  Present the certificate in *file* as our client certificate
    252 
    -
    253 
    -*ca [location]*  Use the file, or directory, specified by *location* to
    254 
    -validate the NTS-KE server certificate.  Do not use any other CA.
    255 
    -
    256 251 
     == NTS-KE Server Configuration parameters ==
    257 252
    258 253 
     == TLS Options ==

  • docs/includes/assoc-options.adoc
    ... ... @@ -98,4 +98,12 @@
    98 98 
       How long to use a secured NTP association before rekeying with the
    99 99 
       NTS-KE server.
    100 100
    101 
    ++nts cert +file+::
    102 
    +  Present the certificate in +file+ as our client certificate
    103 
    +
    104 
    ++nts ca+ +location+::
    105 
    +  Use the file, or directory, specified by +location+ to
    106 
    +  validate the NTS-KE server certificate.  Do not use any other CA.
    107 
    +
    108 
    +
    101 109 
     // end

  • include/nts.h
    ... ... @@ -15,6 +15,8 @@
    15 15 
     /* Configuration data for an NTS association */
    16 16 
     struct ntscfg_t {
    17 17 
         char *server;	/* if NUL, use the peer itself (normal case) */
    18 
    +    char *ca;		/* if NUL, use the system default (normal case) */
    19 
    +    char *cert;		/* if NUL, use the system default (normal case) */
    18 20 
         uint32_t flags;
    19 21 
         uint32_t expire;
    20 22 
     };

  • ntpd/keyword-gen.c
    ... ... @@ -201,6 +201,8 @@ struct key_tok ntp_keywords[] = {
    201 201 
     { "require",		T_Require,		FOLLBY_STRING },
    202 202 
     { "noval",		T_Noval,		FOLLBY_TOKEN },
    203 203 
     { "expire",		T_Expire,		FOLLBY_TOKEN },
    204 
    +{ "cert",		T_Cert,			FOLLBY_TOKEN },
    205 
    +{ "ca",			T_Ca,			FOLLBY_TOKEN },
    204 206 
     };
    205 207
    206 208 
     typedef struct big_scan_state_tag {

  • ntpd/ntp_config.c
    ... ... @@ -650,6 +650,14 @@ create_peer_node(
    650 650 
     		    my_node->ctl.nts_cfg.expire = option->value.u;
    651 651 
     		    break;
    652 652
    653 
    +		case T_Ca:
    654 
    +		    my_node->ctl.nts_cfg.ca = option->value.s;
    655 
    +		    break;
    656 
    +
    657 
    +		case T_Cert:
    658 
    +		    my_node->ctl.nts_cfg.cert = option->value.s;
    659 
    +		    break;
    660 
    +
    653 661 
     		case T_Minpoll:
    654 662 
     			if (option->value.i < NTP_MINPOLL ) {
    655 663 
     				msyslog(LOG_INFO,

  • ntpd/ntp_parser.y
    ... ... @@ -61,7 +61,9 @@
    61 61 
     %token	<Integer>	T_Bias
    62 62 
     %token	<Integer>	T_Burst
    63 63 
     %token	<Integer>	T_Calibrate
    64 
    +%token	<Integer>	T_Ca
    64 65 
     %token	<Integer>	T_Ceiling
    66 
    +%token	<Integer>	T_Cert
    65 67 
     %token	<Integer>	T_Clock
    66 68 
     %token	<Integer>	T_Clockstats
    67 69 
     %token	<Integer>	T_Cohort
    ... ... @@ -462,6 +464,10 @@ option_string
    462 464 
     			{ $$ = create_attr_sval($1, $2); }
    463 465 
     	|	T_Require T_String
    464 466 
     			{ $$ = create_attr_sval($1, $2); }
    467 
    +	|	T_Ca T_String
    468 
    +			{ $$ = create_attr_sval($1, $2); }
    469 
    +	|	T_Cert T_String
    470 
    +			{ $$ = create_attr_sval($1, $2); }
    465 471 
     	;
    466 472
    467 473 
     option_double_keyword

    • —
    View it on GitLab.
    You're receiving this email because of your account on gitlab.com. If you'd like to receive fewer emails, you can adjust your notification settings. 

    _______________________________________________
vc mailing list
v...@ntpsec.org
http://lists.ntpsec.org/mailman/listinfo/vc

    Attachment: pgpjy_2obPdAz.pgp
    Description: OpenPGP digital signature

    _______________________________________________
devel mailing list
devel@ntpsec.org
http://lists.ntpsec.org/mailman/listinfo/devel

    Reply via email to