FreeBSD/contrib/ntp/ntpd/ntp_crypto.c
/*
 * cert_hike - verify the signature using the issuer public key
 *
 * Returns
 * XEVNT_OK	success
 * XEVNT_CRT	bad or missing certificate
 * XEVNT_PER	host certificate expired
 * XEVNT_VFY	certificate not verified
 */
verify the signature using the issuer public key
Returns
XEVNT_OK     success
XEVNT_CRT    bad or missing certificate
XEVNT_PER    host certificate expired
XEVNT_VFY    certificate not verified
verify the signature using the issuer public key Returns XEVNT_OK success XEVNT_CRT bad or missing certificate XEVNT_PER host certificate expired XEVNT_VFY certificate not verified
int
cert_hike(
	struct peer *peer,	
	struct cert_info *yp	
	)
{
	struct cert_info *xp;	
	X509	*cert;		
	const u_char *ptr;
	if (peer->issuer != NULL)
		free(peer->issuer);
	peer->issuer = estrdup(yp->issuer);
	xp = peer->xinfo;
	peer->xinfo = yp;
	if (strcmp(yp->subject, yp->issuer) == 0) {
		if (!(yp->flags & CERT_TRUST))
			return (XEVNT_OK);
		peer->crypto |= CRYPTO_FLAG_CERT;
		peer->grpkey = yp->grpkey;
		if (peer->ident == NULL || !(peer->crypto &
		    CRYPTO_FLAG_MASK))
			peer->crypto |= CRYPTO_FLAG_VRFY;
	}
	if (xp == NULL)
		return (XEVNT_OK);
	ptr = (u_char *)xp->cert.ptr;
	cert = d2i_X509(NULL, &ptr, ntohl(xp->cert.vallen));
	if (cert == NULL) {
		xp->flags |= CERT_ERROR;
		return (XEVNT_CRT);
	}
	if (X509_verify(cert, yp->pkey) <= 0) {
		X509_free(cert);
		xp->flags |= CERT_ERROR;
		return (XEVNT_VFY);
	}
	X509_free(cert);
	if ((calcomp(&(xp->first), &(yp->first)) < 0)
	|| (calcomp(&(xp->first), &(yp->last)) > 0)) {
		xp->flags |= CERT_ERROR;
		return (XEVNT_PER);
	}
	xp->flags |= CERT_SIGN;
	return (XEVNT_OK);
}
int cert_hike ( struct peer * peer , struct cert_info * yp ) { struct cert_info * xp ; X509 * cert ; const u_char * ptr ; if ( peer -> issuer != NULL ) free ( peer -> issuer ) ; peer -> issuer = estrdup ( yp -> issuer ) ; xp = peer -> xinfo ; peer -> xinfo = yp ; if ( strcmp ( yp -> subject , yp -> issuer ) == 0 ) { if ( ! ( yp -> flags & CERT_TRUST ) ) return ( XEVNT_OK ) ; peer -> crypto |= CRYPTO_FLAG_CERT ; peer -> grpkey = yp -> grpkey ; if ( peer -> ident == NULL || ! ( peer -> crypto & CRYPTO_FLAG_MASK ) ) peer -> crypto |= CRYPTO_FLAG_VRFY ; } if ( xp == NULL ) return ( XEVNT_OK ) ; ptr = ( u_char * ) xp -> cert . ptr ; cert = d2i_X509 ( NULL , & ptr , ntohl ( xp -> cert . vallen ) ) ; if ( cert == NULL ) { xp -> flags |= CERT_ERROR ; return ( XEVNT_CRT ) ; } if ( X509_verify ( cert , yp -> pkey ) <= 0 ) { X509_free ( cert ) ; xp -> flags |= CERT_ERROR ; return ( XEVNT_VFY ) ; } X509_free ( cert ) ; if ( ( calcomp ( & ( xp -> first ) , & ( yp -> first ) ) < 0 ) || ( calcomp ( & ( xp -> first ) , & ( yp -> last ) ) > 0 ) ) { xp -> flags |= CERT_ERROR ; return ( XEVNT_PER ) ; } xp -> flags |= CERT_SIGN ; return ( XEVNT_OK ) ; }
cert_hike - verify the signature using the issuer public key
 Returns
 XEVNT_OK     success
 XEVNT_CRT    bad or missing certificate
 XEVNT_PER    host certificate expired
 XEVNT_VFY    certificate not verified
cert_hike - verify the signature using the issuer public key Returns XEVNT_OK success XEVNT_CRT bad or missing certificate XEVNT_PER host certificate expired XEVNT_VFY certificate not verified
/* peer structure pointer */ /* issuer certificate */ /* subject certificate */ /* X509 certificate */ /*
	 * Save the issuer on the new certificate, but remember the old
	 * one.
	 */ /*
	 * If subject Y matches issuer Y, then the certificate trail is
	 * complete. If Y is not trusted, the server certificate has yet
	 * been signed, so keep trying. Otherwise, save the group key
	 * and light the valid bit. If the host certificate is trusted,
	 * do not execute a sign exchange. If no identity scheme is in
	 * use, light the identity and proventic bits.
	 */ /*
		 * If the server has an an identity scheme, fetch the
		 * identity credentials. If not, the identity is
		 * verified only by the trusted certificate. The next
		 * signature will set the server proventic.
		 */ /*
	 * If X exists, verify signature X using public key Y.
	 */ /*
	 * Signature X is valid only if it begins during the
	 * lifetime of Y. 
	 */