/*

 * nts_client.c - Network Time Security (NTS) client side support

 * Copyright the NTPsec project contributors

 * SPDX-License-Identifier: BSD-2-Clause

 *

 * Section references are to

 * https://tools.ietf.org/html/rfc8915

 *

 */

#include "config.h"

#include <ctype.h>

#include <sys/types.h>

#include <sys/socket.h>

#include <sys/stat.h>

#include <unistd.h>

#include <fcntl.h>

#ifdef HAVE_RES_INIT

#include <netinet/in.h>

#include <arpa/nameser.h>

#include <resolv.h>

#endif

#include <openssl/ssl.h>

#include <openssl/x509.h>

#include <openssl/x509v3.h>

#include "ntp_types.h"

#include "ntpd.h"

#include "nts.h"

#include "nts2.h"

#include "ntp_dns.h"

#include "ntp_stdlib.h"

#include "timespecops.h"

SSL_CTX* make_ssl_client_ctx(const char *filename);

int open_TCP_socket(struct peer *peer, const char *hostname);

struct addrinfo * find_best_addr(struct addrinfo *answer);

bool connect_TCP_socket(int sockfd, struct addrinfo *addr);

bool nts_set_cert_search(SSL_CTX *ctx, const char *filename);

void set_hostname(SSL *ssl, const char *hostname);

bool check_certificate(SSL *ssl, struct peer *peer);

bool check_alpn(SSL *ssl, struct peer *peer, const char *hostname);

bool nts_client_send_request(SSL *ssl, struct peer *peer);

bool nts_client_send_request_core(uint8_t *buff, int buf_size, int *used, struct peer* peer);

bool nts_client_process_response(SSL *ssl, struct peer *peer);

bool nts_client_process_response_core(uint8_t *buff, int transferred, struct peer* peer);

bool nts_server_lookup(char *server, sockaddr_u *addr, int af);

static SSL_CTX *client_ctx = NULL;

/* Ugly global variables passed from worker thread back to main thread. */

static sockaddr_u sockaddr;

static bool addrOK;

bool nts_client_init(void) {

  client_ctx = make_ssl_client_ctx(ntsconfig.ca);

/* Ugly global variables passed from worker thread back to main thread. */

  return true;

}

bool nts_probe(struct peer * peer) {

  struct timeval timeout = {.tv_sec = NTS_KE_TIMEOUT, .tv_usec = 0};

  const char *hostname = peer->hostname;

  char hostbuf[100];

  char errbuf[100];

  SSL     *ssl;

  int      server;

  struct timespec start, finish;

  int      err;

  if (NULL == client_ctx)

    return false;

  addrOK = false;

  clock_gettime(CLOCK_MONOTONIC, &start);

  if (NULL == hostname) {

    /* IP Address case */

    int af = AF(&peer->srcadr);

    switch (af) {

        case AF_INET:

      inet_ntop(af, PSOCK_ADDR4(&peer->srcadr), hostbuf, sizeof(hostbuf));

      break;

        case AF_INET6:

      /* Add [] in case [xxx]:port */

      hostbuf[0] = '[';

      inet_ntop(af, PSOCK_ADDR6(&peer->srcadr), hostbuf+1, sizeof(hostbuf)-1);

      strlcat(hostbuf, "]", sizeof(hostbuf));

      break;

        default:

      return false;

    }

    hostname = hostbuf;

//    msyslog(LOG_INFO, "NTSc: Address Literal: %s", hostbuf);

  }

  server = open_TCP_socket(peer, hostname);

  if (-1 == server) {

    ntske_cnt.probes_bad++;

    return false;

  }

  err = setsockopt(server, SOL_SOCKET, SO_RCVTIMEO, &timeout, sizeof(timeout));

  if (0 > err) {

    ntp_strerror_r(errno, errbuf, sizeof(errbuf));

    msyslog(LOG_ERR, "NTSc: can't set recv timeout: %s", errbuf);

    close(server);

    ntske_cnt.probes_bad++;

    return false;

  }

  err = setsockopt(server, SOL_SOCKET, SO_SNDTIMEO, &timeout, sizeof(timeout));

  if (0 > err) {

    ntp_strerror_r(errno, errbuf, sizeof(errbuf));

    msyslog(LOG_ERR, "NTSc: can't set send timeout: %s", errbuf);

    close(server);

    ntske_cnt.probes_bad++;

    return false;

  }

  if (NULL == peer->cfg.nts_cfg.ca)

    ssl = SSL_new(client_ctx);

  else {

    SSL_CTX *ctx;

    ctx = make_ssl_client_ctx(peer->cfg.nts_cfg.ca);

    if (NULL == ctx) {

      close(server);

      return false;

    }

    ssl = SSL_new(ctx);

    SSL_CTX_free(ctx);

  }

  set_hostname(ssl, hostname);

  SSL_set_fd(ssl, server);

  if (1 != SSL_connect(ssl)) {

    msyslog(LOG_INFO, "NTSc: SSL_connect failed");

    nts_log_ssl_error();

    goto bail;

  }

  if (1 != SSL_do_handshake(ssl)) {

    msyslog(LOG_INFO, "NTSc: SSL_do_handshake failed");

    nts_log_ssl_error();

    goto bail;

  }

  /* This may be clutter, but this is how to do it. */

  msyslog(LOG_INFO, "NTSc: Using %s, %s (%d)",

    SSL_get_version(ssl),

    SSL_get_cipher_name(ssl),

    SSL_get_cipher_bits(ssl, NULL));

  if (!check_certificate(ssl, peer))

    goto bail;

  if (!check_alpn(ssl, peer, hostname))

    goto bail;

  if (!nts_client_send_request(ssl, peer))

    goto bail;

  if (!nts_client_process_response(ssl, peer))

    goto bail;

  /* We are using AEAD_AES_SIV_CMAC_xxx, from RFC 5297

   * key length depends upon which key is selected */

  peer->nts_state.keylen = nts_get_key_length(peer->nts_state.aead);

  if (0 == peer->nts_state.keylen) {

    msyslog(LOG_ERR, "NTSc: Unknown AEAD code: %d", peer->nts_state.aead);

    goto bail;

  }

  if (!nts_make_keys(ssl,

         peer->nts_state.aead,

         peer->nts_state.c2s,

         peer->nts_state.s2c,

         peer->nts_state.keylen))

    goto bail;

  addrOK = true;

  ntske_cnt.probes_good++;

  bail:

  if (!addrOK) {

    ntske_cnt.probes_bad++;

    peer->nts_state.count = -1;

  }

  SSL_shutdown(ssl);

  SSL_free(ssl);

  close(server);

  clock_gettime(CLOCK_MONOTONIC, &finish);

  finish = sub_tspec(finish, start);

  msyslog(LOG_INFO, "NTSc: NTS-KE req to %s took %.3f sec, %s",

    hostname, tspec_to_d(finish),

    addrOK? "OK" : "fail");

  return addrOK;

}

bool nts_check(struct peer *peer) {

  if (0) {

    char errbuf[100];

    sockporttoa_r(&sockaddr, errbuf, sizeof(errbuf));

    msyslog(LOG_INFO, "NTSc: nts_check %s, %d", errbuf, addrOK);

  }

  if (addrOK) {

    dns_take_server(peer, &sockaddr);

    dns_take_status(peer, DNS_good);

  } else

    dns_take_status(peer, DNS_error);

  return addrOK;

}

SSL_CTX* make_ssl_client_ctx(const char * filename) {

  bool ok = true;

  SSL_CTX *ctx;

  ctx = SSL_CTX_new(TLS_client_method());

  if (NULL == ctx) {

    /* Happens if no ciphers */

    msyslog(LOG_ERR, "NTSc: NULL ctx");

    nts_log_ssl_error();

    return NULL;

  }

  {

    // 4., ALPN, RFC 7301

    static unsigned char alpn [] = { 7, 'n', 't', 's', 'k', 'e', '/', '1' };

    SSL_CTX_set_alpn_protos(ctx, alpn, sizeof(alpn));

  }

  SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);

  SSL_CTX_set_timeout(ctx, NTS_KE_TIMEOUT);   /* session lifetime */

  ok &= nts_load_versions(ctx);

  ok &= nts_load_ciphers(ctx);

  ok &= nts_load_ecdhcurves(ctx);

  ok &= nts_set_cert_search(ctx, filename);

  if (!ok) {

    msyslog(LOG_ERR, "NTSc: Troubles setting up client SSL CTX");

    SSL_CTX_free(ctx);

    return NULL;

  };

  return ctx;

}

/* FIXME - split out DNS work. */

/* Note that there are 2 DNS lookups.

 *   One for the NTS-KE server and another for the NTP server.

 *   The latter is optional.

 *   The default is to use the same IP Address as NTS-KE server.

 *

 * In the non-NTS case, when a server name returns multiple addresses,

 * we skip the ones that are already in use.

 *

 * If the NTS-KE server has multiple addresses, we also skip the ones

 * that are already in use for NTP.  That works great if the NTS-KE server

 * is running on the same system as the NTP server which is true

 * for most servers.

 */

/* return -1 on error */

int open_TCP_socket(struct peer *peer, const char *hostname) {

  char host[256], port[32];

  char errbuf[100];

  char *tmp;

  struct addrinfo hints;

  struct addrinfo *answer, *worker;

  int gai_rc;

  int sockfd;

  struct timespec start, finish;

  /* FIXME -- const bug in OpenSSL */

  strlcpy(host, hostname, sizeof(host));

  /* handle xxx:port case */

  if ('[' == host[0]) {

    /* IPv6 case, drop [], start search after ] */

    SET_AF(&peer->srcadr, AF_INET6);

    strlcpy(host, hostname+1, sizeof(host));

    tmp = strchr(host, ']');

    if (NULL == tmp) {

      msyslog(LOG_ERR, "NTSc: open_TCP_socket: missing ']': %s",

        hostname);

      return -1;

    }

    *tmp++ = 0;

    /* We have chopped off the [] around the host literal.

     * There should be nothing left or :<port> */

    if ((0 != *tmp) && (':' != *tmp)) {

      msyslog(LOG_ERR, "NTSc: open_TCP_socket: missing ':': %s",

        hostname);

      return -1;

    }

    if (0 == *tmp) tmp = NULL; /* no : */

  } else {

    tmp = strchr(host, ':');

  }

  if (NULL == tmp) {

    /* simple case, no : */

    strlcpy(port, NTS_KE_PORTA, sizeof(port));

  } else {

    /* Complicated case, found a : */

    *tmp++ = 0;

    strlcpy(port, tmp, sizeof(port));

    msyslog(LOG_INFO, "NTSc: open_TCP_socket: found port %s", port);

  }

  ZERO(hints);

  hints.ai_protocol = IPPROTO_TCP;

  hints.ai_socktype = SOCK_STREAM;

  hints.ai_family = AF(&peer->srcadr);  /* -4, -6 switch */

  clock_gettime(CLOCK_MONOTONIC, &start);

  gai_rc = getaddrinfo(host, port, &hints, &answer);

  if (0 != gai_rc) {

    msyslog(LOG_INFO, "NTSc: open_TCP_socket: DNS error trying to contact %s, %d, %s",

      hostname, gai_rc, gai_strerror(gai_rc));

    return -1;

  }

  clock_gettime(CLOCK_MONOTONIC, &finish);

  finish = sub_tspec(finish, start);

  msyslog(LOG_INFO, "NTSc: DNS lookup of %s (%d) took %.3f sec",

    hostname, hints.ai_family, tspec_to_d(finish));

  /* sockaddr is global for NTP address

   * also use as temp for printing here */

  if (NULL == peer->hostname) {

    /* Address literal case, use first/only answer */

    worker = answer;

  } else {

    worker = find_best_addr(answer);

    if (NULL == worker) {

      msyslog(LOG_INFO, "NTSc: All addresses in use.");

      freeaddrinfo(answer);

      return -1;

    }

  }

  memcpy(&sockaddr, worker->ai_addr, worker->ai_addrlen);

  sockporttoa_r(&sockaddr, errbuf, sizeof(errbuf));

  msyslog(LOG_INFO, "NTSc: connecting to %s+%s => %s",

    host, port, errbuf);

  /* setup default NTP port now

   *   in case of server-name:port later on

   */

  SET_PORT(&sockaddr, NTP_PORT);

  sockfd = socket(worker->ai_family, SOCK_STREAM, 0);

  if (-1 == sockfd) {

    ntp_strerror_r(errno, errbuf, sizeof(errbuf));

    msyslog(LOG_INFO, "NTSc: open_TCP_socket: no socket: %s", errbuf);

  } else {

    if (!connect_TCP_socket(sockfd, worker)) {

      close(sockfd);

      sockfd = -1;

    }

  }

  freeaddrinfo(answer);

  return sockfd;

}

struct addrinfo *find_best_addr(struct addrinfo *answer) {

  for ( ; NULL != answer; answer = answer->ai_next) {

    sockaddr_u addr;

    struct peer *pp;

    if (sizeof(sockaddr_u) < answer->ai_addrlen)

      continue;  /* Weird */

    memcpy(&addr, answer->ai_addr, answer->ai_addrlen);

    /* findexistingpeer checks port too */

    for (pp = peer_list; NULL != pp; pp = pp->p_link) {

      if (MDF_POOL & pp->cast_flags) continue;

      if (FLAG_LOOKUP & pp->cfg.flags) continue;

      if (SOCK_EQ(&addr, &pp->srcadr)) break;

    }

    if (NULL != pp) {

      char errbuf[200];

      socktoa_r(&addr, errbuf, sizeof(errbuf));

      msyslog(LOG_INFO, "NTSc: Skipping %s", errbuf);

      continue;  /* already in use */

    }

    break; 

  }

  return(answer);

}

/* This kludgery is needed to get a sane timeout.

 * The default is unspecified but long.

 * On Linux, man connect gets man 2 which doesn't mention O_NONBLOCK

 * Use man 3 connect.

 */

bool connect_TCP_socket(int sockfd, struct addrinfo *addr) {

  char errbuf[100];

  int err;

  fd_set fdset;

  struct timeval timeout;

  int so_error;

  socklen_t so_len = sizeof(so_error);

  err = fcntl(sockfd, F_SETFL, O_NONBLOCK);

  if (-1 == err) {

    ntp_strerror_r(errno, errbuf, sizeof(errbuf));

    msyslog(LOG_INFO, "NTSc: can't set O_NONBLOCK %s", errbuf);

    return false;

  }

  err = connect(sockfd, addr->ai_addr, addr->ai_addrlen);

  /* The normal case is -1 and errno == EINPROGRESS

   * Getting connected should be possible if the scheduler

   * avoids us for long enough.

   * Other errors may be possible.  No route?

   * I haven't seen that yet.  HGM, 2020 Jan 19

   */

  if (-1 != err || EINPROGRESS != errno) {

    ntp_strerror_r(errno, errbuf, sizeof(errbuf));

    msyslog(LOG_INFO, "NTSc: connect_TCP_socket: connect failed: %s", errbuf);

    return false;

  }

  FD_ZERO(&fdset);

  FD_SET(sockfd, &fdset);

  timeout.tv_sec = NTS_KE_TIMEOUT;

  timeout.tv_usec = 0;

  if (0 == select(sockfd + 1, NULL, &fdset, NULL, &timeout)) {

    msyslog(LOG_INFO, "NTSc: connect_TCP_socket: timeout");

    return false;

  }

  /* It's ready, either connected or error. */

  if (-1 == getsockopt(sockfd, SOL_SOCKET, SO_ERROR, &so_error, &so_len)) {

    ntp_strerror_r(errno, errbuf, sizeof(errbuf));

    msyslog(LOG_INFO, "NTSc: connect_TCP_socket: getsockopt failed: %s", errbuf);

    return false;

  }

  if (0 != so_error) {

    ntp_strerror_r(so_error, errbuf, sizeof(errbuf));

    msyslog(LOG_INFO, "NTSc: connect_TCP_socket: connect failed: %s", errbuf);

    return false;

  }

  err = fcntl(sockfd, F_SETFL, 0); /* turn off O_NONBLOCK */

  if (-1 == err) {

    ntp_strerror_r(errno, errbuf, sizeof(errbuf));

    msyslog(LOG_INFO, "NTSc: can't unset O_NONBLOCK %s", errbuf);

    return false;

  }

  return true;

}

void set_hostname(SSL *ssl, const char *hostname) {

  char host[256], *tmp;

  /* chop off trailing :port */

  strlcpy(host, hostname, sizeof(host));

  tmp = strchr(host, ']');

  if (NULL == tmp) {

    tmp = host;     /* not IPv6 [...] format */

  }

  tmp = strchr(tmp, ':');

  if (NULL != tmp) {

    *tmp = 0;

  }

/* https://wiki.openssl.org/index.php/Hostname_validation

 * draft-ietf-uta-rfc6125bis section 3 relaxes the restrictions around the use

 * of wildcards to make it clear that they're permitted unless specifically

 * prohibited in an RFC

 */

  SSL_set_hostflags(ssl, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);

  SSL_set1_host(ssl, host);

  msyslog(LOG_DEBUG, "NTSc: set cert host: %s", host);

}

// X509v3 Subject Alternative Name:

//    DNS:*.time.nl, DNS:time.nl

bool check_certificate(SSL *ssl, struct peer* peer) {

  X509 *cert = SSL_get_peer_certificate(ssl);

  X509_NAME *certname;

  GENERAL_NAMES *gens;

  char name[200];

  int certok;

  int numgens = 0;

  if (NULL == cert) {

    msyslog(LOG_INFO, "NTSc: No certificate");

    if (!(FLAG_NTS_NOVAL & peer->cfg.flags))

      return false;

    return true;

  }

  certname = X509_get_subject_name(cert);

  X509_NAME_oneline(certname, name, sizeof(name));

  msyslog(LOG_INFO, "NTSc: certificate subject name: %s", name);

  certname = X509_get_issuer_name(cert);

  X509_NAME_oneline(certname, name, sizeof(name));

  msyslog(LOG_INFO, "NTSc: certificate issuer name: %s", name);

  /* print SAN:DNS strings */

  gens = X509_get_ext_d2i(cert, NID_subject_alt_name, 0, 0);

  if (gens) {

    char buff[150];

    numgens = sk_GENERAL_NAME_num(gens);

    buff[0] = 0;

    for (int i = 0; i<numgens; i++) {

      const GENERAL_NAME *gen;

      const char *dnsname;

      unsigned int len;

      gen = sk_GENERAL_NAME_value(gens, i);

      if (gen->type != GEN_DNS)

        continue;

      // string is NUL terminated but may have internal NULs

      len = (unsigned int)ASN1_STRING_length(gen->d.ia5);

      dnsname = (const char *)ASN1_STRING_get0_data(gen->d.ia5);

      if (0 != buff[0])

        strlcat(buff, ", ", sizeof(buff));

      strlcat(buff, dnsname, sizeof(buff));

      if (len != strlen(dnsname))

        strlcat(buff, "??", sizeof(buff));

    }

    msyslog(LOG_INFO, "NTSc: SAN:DNS %s", buff);

    GENERAL_NAMES_free(gens);

  }

  if (0 == numgens) {

    const char *peername = SSL_get0_peername(ssl);

    msyslog(LOG_INFO, "NTSc: matching with subject:CN %s", peername);

  } else if (1 > numgens) {

    const char *peername = SSL_get0_peername(ssl);

    msyslog(LOG_INFO, "NTSc: matching with SAN:DNS: %s", peername);

  }

  X509_free(cert);

  certok = SSL_get_verify_result(ssl);

  if (X509_V_OK == certok) {

    msyslog(LOG_INFO, "NTSc: certificate is valid.");

  } else {

    msyslog(LOG_ERR, "NTSc: certificate invalid: %d=>%s",

      certok, X509_verify_cert_error_string(certok));

    if (FLAG_NTS_NOVAL & peer->cfg.flags) {

      msyslog(LOG_INFO, "NTSc: noval - accepting invalid cert.");

      return true;

    }

    return false;

  }

  return true;

}

bool check_alpn(SSL *ssl, struct peer* peer, const char *hostname) {

  UNUSED_ARG(peer);

  const unsigned char *data;

  unsigned int len;

  SSL_get0_alpn_selected(ssl, &data, &len);

  if (0 == len) {

    msyslog(LOG_DEBUG, "NTSc: No ALPN from %s (%s)",

      hostname, SSL_get_version(ssl));

    return false;

  }

  /* For now, we only support one version.

   * This will get more complicated when version 2 arrives. */

  if (len != 7 ||

      0 != memcmp(data, "ntske/1", len)) {

    /* copy data over so we can print it. */

    /* don't read past end of data */

    unsigned int i, l;

    char buff [16];

    l = min(len, sizeof(buff)-1);

    memcpy(buff, data, l);

    buff[l] = '\0';

    for (i=0; i<l; i++) {

      if (!isgraph((int)buff[i])) {

        buff[i] = '*'; /* fix non-printing crap */

      }

    }

    msyslog(LOG_DEBUG, "NTSc: Strange ALPN %s (%u) from %s",

      buff, len, hostname);

    return false;

  }

  msyslog(LOG_DEBUG, "NTSc: Good ALPN from %s", hostname);

  return true;

}

bool nts_make_keys(SSL *ssl, uint16_t aead, uint8_t *c2s, uint8_t *s2c, int keylen) {

  const char *label = "EXPORTER-network-time-security";

  unsigned char context[5];

  context[0] = (nts_protocol_NTP >> 8) & 0xFF;

  context[1] = nts_protocol_NTP & 0xFF;

  context[2] = (aead >> 8) & 0xFF;

  context[3] = aead & 0xFF;

  context[4] = 0x00;

  if (1 != SSL_export_keying_material(ssl, c2s, keylen,

              label, strlen(label),

              context, 5, 1)) {

    msyslog(LOG_ERR, "NTS: Error making c2s\n");

    nts_log_ssl_error();

    return false;

  }

  context[4] = 0x01;

  if (1 != SSL_export_keying_material(ssl, s2c, keylen,

              label, strlen(label),

              context, 5, 1)) {

    msyslog(LOG_ERR, "NTS: Error making s2c\n");

    nts_log_ssl_error();

    return false;

  }

  return true;

}

bool nts_client_send_request(SSL *ssl, struct peer* peer) {

  uint8_t buff[1000];

  int     used, transferred;

  bool    success;

  const char *errtxt = NULL;

  success = nts_client_send_request_core(buff, sizeof(buff), &used, peer);

  if (!success) {

    return false;

  }

  transferred = nts_ssl_write(ssl, buff, used, &errtxt);

  if (used != transferred)

    return false;

  return true;

}

bool nts_client_send_request_core(uint8_t *buff, int buf_size, int *used, struct peer* peer) {

  struct  BufCtl_t buf;

  uint16_t aead = NO_AEAD;

  buf.next = buff;

  buf.left = buf_size;

  /* 4.1.2 Next Protocol, 0 for NTP */

  ke_append_record_uint16(&buf,

        NTS_CRITICAL+nts_next_protocol_negotiation, nts_protocol_NTP);

  /* 4.1.5 AEAD Algorithm List */

  // FIXME should be : separated list

  if ((NO_AEAD == aead) && (NULL != peer->cfg.nts_cfg.aead))

    aead = nts_string_to_aead(peer->cfg.nts_cfg.aead);

  if ((NO_AEAD == aead) && (NULL != ntsconfig.aead))

    aead = nts_string_to_aead(ntsconfig.aead);

  if (NO_AEAD == aead)

    aead = AEAD_AES_SIV_CMAC_256;

  ke_append_record_uint16(&buf, nts_algorithm_negotiation, aead);

  /* 4.1.1: End, Critical */

  ke_append_record_null(&buf, NTS_CRITICAL+nts_end_of_message);

  *used = buf_size-buf.left;

  if (*used >= (int)(buf_size - 10)) {

    msyslog(LOG_ERR, "ERR-NTSc: buffer overflow: %d, %ld",

      *used, (long)buf_size);

    exit(2);

  }

  return true;

}

bool nts_client_process_response(SSL *ssl, struct peer* peer) {

  uint8_t  buff[2048];  /* RFC 4. says SHOULD be 65K */

  int transferred;

  const char *errtxt = NULL;

  transferred = nts_ssl_read(ssl, buff, sizeof(buff), &errtxt);

  if (0 >= transferred)

    return false;

  msyslog(LOG_ERR, "NTSc: read %d bytes", transferred);

  return nts_client_process_response_core(buff, transferred, peer);

}

bool nts_client_process_response_core(uint8_t *buff, int transferred, struct peer* peer) {

  int idx;

  struct BufCtl_t buf;

  peer->nts_state.cookielen = 0;

  peer->nts_state.aead = NO_AEAD;

  peer->nts_state.keylen = 0;

  peer->nts_state.writeIdx = 0;

  peer->nts_state.readIdx = 0;

  peer->nts_state.count = 0;

  buf.next = buff;

  buf.left = transferred;

  while (buf.left >= NTS_KE_HDR_LNG) {

    uint16_t type, data, port;

    bool critical = false;

    int length, keylength;

    char errbuf[100];

#define MAX_SERVER 100

    char server[MAX_SERVER];

    type = ke_next_record(&buf, &length);

    if (length > buf.left){

      msyslog(LOG_ERR, "NTSc: Chunk too big: 0x%x, %d, %d", 

        type, buf.left, length);

      return false;

    }

    if (NTS_CRITICAL & type) {

      critical = true;

      type &= ~NTS_CRITICAL;

    }

    if (0) // Handy for debugging but very verbose

      msyslog(LOG_ERR, "NTSc: Record: T=%d, L=%d, C=%d", type, length, critical);

    switch (type) {

        case nts_error:

      if (sizeof(data) != length) {

        msyslog(LOG_ERR, "NTSc: wrong length on error: %d", length);

        return false;

      }

      data = next_uint16(&buf);

      msyslog(LOG_ERR, "NTSc: error: %d", data);

      return false;

        case nts_next_protocol_negotiation:

      if (sizeof(data) != length) {

        msyslog(LOG_ERR, "NTSc: NPN-Wrong length: %d", length);

        return false;

      }

      data = next_uint16(&buf);

      if (data != nts_protocol_NTP) {

        msyslog(LOG_ERR, "NTSc: NPN-Bad data: %d", data);

        return false;

      }

      break;

        case nts_algorithm_negotiation:

      if (sizeof(data) != length) {

        msyslog(LOG_ERR, "NTSc: AN-Wrong length: %d", length);

        return false;

      }

      data = next_uint16(&buf);

      keylength = nts_get_key_length(data);

      if (0 == keylength) {

        msyslog(LOG_ERR, "NTSc: AN-Unsupported AEAN type: %d", data);

        return false;

      }

      peer->nts_state.aead = data;

      break;

        case nts_new_cookie:

      if (NTS_MAX_COOKIELEN < length) {

        msyslog(LOG_ERR, "NTSc: NC cookie too big: %d", length);

        return false;

      }

      if (0 == peer->nts_state.cookielen)

        peer->nts_state.cookielen = length;

      if (length != peer->nts_state.cookielen) {

        msyslog(LOG_ERR, "NTSc: Cookie length mismatch %d, %d.",

          length, peer->nts_state.cookielen);

        return false;

      }

      idx = peer->nts_state.writeIdx;

      if (NTS_MAX_COOKIES <= peer->nts_state.count) {

        msyslog(LOG_ERR, "NTSc: Extra cookie ignored.");

        break;

      }

      next_bytes(&buf, (uint8_t*)&peer->nts_state.cookies[idx], length);

      peer->nts_state.writeIdx++;

      peer->nts_state.writeIdx = peer->nts_state.writeIdx % NTS_MAX_COOKIES;

      peer->nts_state.count++;

      break;

        case nts_server_negotiation:

      if (MAX_SERVER < (length+1)) {

        msyslog(LOG_ERR, "NTSc: server string too long %d.", length);

        return false;

      }

      next_bytes(&buf, (uint8_t *)server, length);

      server[length] = '\0';

      /* save port in case port specified before server */

      port = SRCPORT(&sockaddr);

      if (!nts_server_lookup(server, &sockaddr, AF(&peer->srcadr)))

        return false;

      SET_PORT(&sockaddr, port);

      socktoa_r(&sockaddr, errbuf, sizeof(errbuf));

      msyslog(LOG_ERR, "NTSc: Using server %s=>%s", server, errbuf);

      break;

        case nts_port_negotiation:

      if (sizeof(port) != length) {

        msyslog(LOG_ERR, "NTSc: PN-Wrong length: %d, %d",

          length, critical);

        return false;

      }

      port = next_uint16(&buf);

      SET_PORT(&sockaddr, port);

      msyslog(LOG_ERR, "NTSc: Using port %d", port);

      break;

        case nts_end_of_message:

      if ((0 != length) || !critical) {

        msyslog(LOG_ERR, "NTSc: EOM-Wrong length or not Critical: %d, %d",

          length, critical);

        return false;

      }

      if (0 != buf.left) {

        msyslog(LOG_ERR, "NTSc: EOM not at end: %d", buf.left);

        return false;

      }

      break;

        default:

      msyslog(LOG_ERR, "NTSc: received strange type: T=%d, C=%d, L=%d",

        type, critical, length);

      if (critical) {

        return false;

      }

      buf.next += length;

      buf.left -= length;

      break;

    } /* case */

  }   /* while */

//  FIXME: Need to check for EOM -- read more??

  if (buf.left > 0)

    return false;

  if (NO_AEAD == peer->nts_state.aead) {

    msyslog(LOG_ERR, "NTSc: No AEAD algorithm.");

    return false;

  }

  if (0 == peer->nts_state.count) {

    msyslog(LOG_ERR, "NTSc: No cookies.");

    return false;

  }

  msyslog(LOG_ERR, "NTSc: Got %d cookies, length %d, aead=%d.",

    peer->nts_state.count, peer->nts_state.cookielen, peer->nts_state.aead);

  return true;

}

bool nts_set_cert_search(SSL_CTX *ctx, const char *filename) {

  struct stat statbuf;

  char errbuf[100];

  if (NULL == filename) {

    msyslog(LOG_INFO, "NTSc: Using system default root certificates.");

    SSL_CTX_set_default_verify_paths(ctx);   // Use system root certs

    return true;

  }

  if (0 == stat(filename, &statbuf)) {

    if (S_ISDIR(statbuf.st_mode)) {

      if (1 != SSL_CTX_load_verify_locations(

        ctx, NULL, filename)) {

      msyslog(LOG_INFO, "NTSc: Can't use %s as dir for root certificates.", filename);

          nts_log_ssl_error();

          return false;

      }

      msyslog(LOG_INFO, "NTSc: Using dir %s for root certificates.", filename);

      return true;

    }

    if (S_ISREG(statbuf.st_mode)) {

      if (1 != SSL_CTX_load_verify_locations(

        ctx, filename, NULL)) {

          msyslog(LOG_INFO, "NTSc: Can't use %s as file for root certificates.", filename);

          nts_log_ssl_error();

          return false;

      }

      msyslog(LOG_INFO, "NTSc: Using file %s for root certificates.", filename);

      return true;

    }

    msyslog(LOG_ERR, "NTSc: cert dir/file isn't dir or file: %s. mode 0x%x",

      filename, statbuf.st_mode);

    return false;

  }

  ntp_strerror_r(errno, errbuf, sizeof(errbuf));

  msyslog(LOG_ERR, "NTSc: can't stat cert dir/file: %s, %s",

    filename, errbuf);

  return false;

}

/* The -4/-6 option is used for both the NTS-KE server and the NTP server.

 * That will break if the KE server returns a name that returns only an

 * address of the other type.

 * We could fix that by trying again with AF_UNSPEC.

 */

bool nts_server_lookup(char *server, sockaddr_u *addr, int af) {

  struct addrinfo hints;

  struct addrinfo *answer = NULL;  /* init to keep oss-fuzz happy */