689605b6a2
Implement a fallback for the NTS-NTP client to switch to the compliant AES-128-GCM-SIV exporter context when the server is using the compliant context, but does not support the new NTS-KE record negotiating its use, assuming it can respond with an NTS NAK to the request authenticated with the incorrect key. Export both sets of keys when processing the NTS-KE response. If an NTS NAK is the only valid response from the server after the last NTS-KE session, switch to the keys exported with the compliant context for the following requests instead of dropping all cookies and restarting NTS-KE. Don't switch back to the original keys if an NTS NAK is received again.
56 lines
2 KiB
C
56 lines
2 KiB
C
/*
|
|
chronyd/chronyc - Programs for keeping computer clocks accurate.
|
|
|
|
**********************************************************************
|
|
* Copyright (C) Miroslav Lichvar 2020
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of version 2 of the GNU General Public License as
|
|
* published by the Free Software Foundation.
|
|
*
|
|
* This program is distributed in the hope that it will be useful, but
|
|
* WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
* General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License along
|
|
* with this program; if not, write to the Free Software Foundation, Inc.,
|
|
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
|
|
*
|
|
**********************************************************************
|
|
|
|
=======================================================================
|
|
|
|
Header file for the NTS-KE client
|
|
*/
|
|
|
|
#ifndef GOT_NTS_KE_CLIENT_H
|
|
#define GOT_NTS_KE_CLIENT_H
|
|
|
|
#include "addressing.h"
|
|
#include "nts_ke.h"
|
|
|
|
typedef struct NKC_Instance_Record *NKC_Instance;
|
|
|
|
/* Create a client NTS-KE instance */
|
|
extern NKC_Instance NKC_CreateInstance(IPSockAddr *address, const char *name, uint32_t cert_set);
|
|
|
|
/* Destroy an instance */
|
|
extern void NKC_DestroyInstance(NKC_Instance inst);
|
|
|
|
/* Connect to the server, start an NTS-KE session, send an NTS-KE request, and
|
|
process the response (asynchronously) */
|
|
extern int NKC_Start(NKC_Instance inst);
|
|
|
|
/* Check if the client is still running */
|
|
extern int NKC_IsActive(NKC_Instance inst);
|
|
|
|
/* Get the NTS data if the session was successful */
|
|
extern int NKC_GetNtsData(NKC_Instance inst, NKE_Context *context, NKE_Context *alt_context,
|
|
NKE_Cookie *cookies, int *num_cookies, int max_cookies,
|
|
IPSockAddr *ntp_address);
|
|
|
|
/* Get a factor to calculate retry interval (in log2 seconds) */
|
|
extern int NKC_GetRetryFactor(NKC_Instance inst);
|
|
|
|
#endif
|