/*

 * nts_server.c - Network Time Security (NTS) server side support

 * Copyright the NTPsec project contributors

 * SPDX-License-Identifier: BSD-2-Clause

 *

 * Section references are to

 * https://tools.ietf.org/html/rfc8915

 *

 */

#include "config.h"

#include <signal.h>

#include <pthread.h>

#include <unistd.h>

#include <sys/socket.h>

#include <sys/time.h>

#include <sys/resource.h>

#include <openssl/ssl.h>

#include <openssl/err.h>

#include <openssl/x509.h>

#include "ntp.h"

#include "ntpd.h"

#include "ntp_stdlib.h"

#include "nts.h"

#include "nts2.h"

#include "timespecops.h"

/* Beware: bind and accept take type sockaddr, but that's not big

 *         enough for an IPv6 address.

 */

static bool create_listener4(int port);

static bool create_listener6(int port);

static void* nts_ke_listener(void*);

static void nts_ke_request(SSL *ssl,

  char *errbuf, int errlng, const char **errtxt);

static void nts_ke_accept_fail(char* hostname,

    double wall, double usr, double sys, int code);

static void nts_lock_certlock(void);

static void nts_unlock_certlock(void);

static SSL_CTX *server_ctx = NULL;

static int listener4_sock = -1;

static int listener6_sock = -1;

static void nts_ke_setup_send(struct BufCtl_t *buf, int aead,

       uint8_t *c2s, uint8_t *s2c, int keylen);

/* We need a lock to protect reloading our certificate.

 * This seems like overkill, but it doesn't happen often. */

pthread_mutex_t certificate_lock = PTHREAD_MUTEX_INITIALIZER;

static int alpn_select_cb(SSL *ssl,

                          const unsigned char **out,

                          unsigned char *outlen,

                          const unsigned char *in,

                          unsigned int inlen,

                          void *arg)

{

        static const unsigned char alpn[] = {

            'n', 't', 's', 'k', 'e', '/', '1' };

        unsigned i, len;

        UNUSED_ARG(ssl);

        UNUSED_ARG(arg);

        for (i = 0; i < inlen; i += len+1) {

                len = in[i]; // first byte is the length

#if 0

                char foo[256];

                strlcpy(foo, (const char*)in+i+1, len);

                msyslog(LOG_DEBUG, "DEBUG: alpn_select_cb:  %u, %u, %s", inlen-i, len, foo);

#endif

                if (len+1 > inlen-i)

                        // bogus arg: length overlaps end of in buffer

                        return SSL_TLSEXT_ERR_ALERT_FATAL;

                if (len == sizeof(alpn) && !memcmp(in+i+1, alpn, len)) {

                        *out = in+i+1;

                        *outlen = len;

                        return SSL_TLSEXT_ERR_OK;

                }

        }

        return SSL_TLSEXT_ERR_NOACK;

}

bool nts_server_init(void) {

        bool ok = true;

        msyslog(LOG_INFO, "NTSs: starting NTS-KE server listening on port %d",

                NTS_KE_PORT);

        server_ctx = SSL_CTX_new(TLS_server_method());

        if (NULL == server_ctx) {

                // Happens if no ciphers

                msyslog(LOG_INFO, "NTSs: NULL server_ctx");

                nts_log_ssl_error();

                return false;

        }

        SSL_CTX_set_alpn_select_cb(server_ctx, alpn_select_cb, NULL);

        SSL_CTX_set_session_cache_mode(server_ctx, SSL_SESS_CACHE_OFF);

        SSL_CTX_set_timeout(server_ctx, NTS_KE_TIMEOUT);  // session lifetime

        ok &= nts_load_versions(server_ctx);

        ok &= nts_load_ciphers(server_ctx);

        ok &= nts_load_ecdhcurves(server_ctx);

        ok &= nts_set_cipher_order(server_ctx);

        if (!ok) {

                msyslog(LOG_ERR, "NTSs: Disabling NTS-KE server");

                SSL_CTX_free(server_ctx);

                server_ctx = NULL;

                return false;

        };

        msyslog(LOG_INFO, "NTSs: OpenSSL security level is %d",

                SSL_CTX_get_security_level(server_ctx));

        msyslog(LOG_INFO, "NTSs: starting NTS-KE server listening on port %d",

                NTS_KE_PORT);

        ok &= create_listener4(NTS_KE_PORT);

        ok &= create_listener6(NTS_KE_PORT);

        return ok;

}

bool nts_server_init2(void) {

        pthread_t worker;

        sigset_t block_mask, saved_sig_mask;

        int rc;

        char errbuf[100];

        if (!nts_load_certificate(server_ctx)) {

                return false;

        }

        sigfillset(&block_mask);

        pthread_sigmask(SIG_BLOCK, &block_mask, &saved_sig_mask);

        if (listener4_sock != -1) {

                rc = pthread_create(&worker, NULL, nts_ke_listener, &listener4_sock);

                if (rc) {

                        ntp_strerror_r(errno, errbuf, sizeof(errbuf));

                        msyslog(LOG_ERR, "NTSs: nts_start_server4: error from pthread_create: %s", errbuf);

                }

        }

        if (listener6_sock != -1) {

                rc = pthread_create(&worker, NULL, nts_ke_listener, &listener6_sock);

                if (rc) {

                        ntp_strerror_r(errno, errbuf, sizeof(errbuf));

                        msyslog(LOG_ERR, "NTSs: nts_start_server6: error from pthread_create: %s", errbuf);

                }

        }

        pthread_sigmask(SIG_SETMASK, &saved_sig_mask, NULL);

        return true;

}

// called every hour

void nts_cert_timer(void) {

        check_cert_file();

}

// call hourly and by SIGHUP

void check_cert_file(void) {

        if (NULL == server_ctx)

                return;

        nts_lock_certlock();

        nts_reload_certificate(server_ctx);

        nts_unlock_certlock();

}

void nts_lock_certlock(void) {

        int err = pthread_mutex_lock(&certificate_lock);

        if (0 != err) {

                msyslog(LOG_ERR, "ERR: Can't lock certificate_lock: %d", err);

                exit(2);

        }

}

void nts_unlock_certlock(void) {

        int err = pthread_mutex_unlock(&certificate_lock);

        if (0 != err) {

                msyslog(LOG_ERR, "ERR: Can't unlock certificate_lock: %d", err);

                exit(2);

        }

}

// lfptod goes to long double

static inline double lfptox(l_fp r) {

// l_fp to double

        return ldexp((double)((int64_t)r), -32);

}

void* nts_ke_listener(void* arg) {

        struct timeval timeout = {.tv_sec = NTS_KE_TIMEOUT, .tv_usec = 0};

        int sock = *(int*)arg;

        char errbuf[100];

        char addrbuf[100];

        char usingbuf[100];

        struct timespec start, finish;          // wall clock

        l_fp wall, usr, sys;

        const char *errtxt;     // not NULL if error

#ifdef RUSAGE_THREAD

        // Not in NetBSD 10.1, 2026-Apr-05

        struct timespec start_u, finish_u;      // CPU user

        struct timespec start_s, finish_s;      // CPU system

        struct rusage usage;

#endif

#ifdef HAVE_SECCOMP_H

        setup_SIGSYS_trap();   // enable trap for this thread

#endif

#ifdef RUSAGE_THREAD

        /* NB: start_u and start_s are from near the end of the previous cycle.

         * Thus usage timing includes the TCP accept and

         * writing the previous msyslog message.

         */

        getrusage(RUSAGE_THREAD, &usage);

        start_u = tval_to_tspec(usage.ru_utime);

        start_s = tval_to_tspec(usage.ru_stime);

#else

        usr = 0;

        sys = 0;

#endif

        while(1) {

                NTSKE_Status status = NTSKE_SSL_Failed;

                sockaddr_u addr;

                socklen_t len = sizeof(addr);

                SSL *ssl;

                int client, err;

                sleep(1);                       // FIXME: log clutter/DoS

                errtxt = NULL;

                client = accept(sock, &addr.sa, &len);

                if (client < 0) {

                        ntp_strerror_r(errno, errbuf, sizeof(errbuf));

                        msyslog(LOG_ERR, "NTSs: TCP accept failed: %s", errbuf);

                        if (EBADF == errno)

                                return NULL;

                        continue;

                }

                clock_gettime(CLOCK_MONOTONIC, &start);

                sockporttoa_r(&addr, addrbuf, sizeof(addrbuf));

/* This is disabled in order to reduce clutter in the log file.

 * The client's address is now included in the final message.

 * That works fine in the normal successful case.  There is one line

 * per connection.

 * The failed cases are more complicated.

 * The common fail case is bad guys probing which fails in SSL_accept.

 * That branch has its own error handling.  Again, the common cases

 * have one line per connection and include the client address.

 * Uncommon cases will include two (or more) lines.

 * There are many possible error messages after SSL_accept works.

 * In practice, they don't happen, at least not often enough to notice.

 * They currently get logged without the client's address.  Then they

 * fall into the normal (non-error) path which does include the address.

 * Enabling this might make strange cases easier to understand.

 */

// msyslog(LOG_INFO, "NTSs: TCP accept-ed from %s", addrbuf);

                err = setsockopt(client, SOL_SOCKET, SO_RCVTIMEO,

                        &timeout, sizeof(timeout));

                if (0 > err) {

                        ntp_strerror_r(errno, errbuf, sizeof(errbuf));

                        msyslog(LOG_ERR, "NTSs: can't set recv timeout: %s", errbuf);

                        close(client);

                        ntske_cnt.serves_bad++;

                        continue;

                }

                err = setsockopt(client, SOL_SOCKET, SO_SNDTIMEO,

                        &timeout, sizeof(timeout));

                if (0 > err) {

                        ntp_strerror_r(errno, errbuf, sizeof(errbuf));

                        msyslog(LOG_ERR, "NTSs: can't set send timeout: %s", errbuf);

                        close(client);

                        ntske_cnt.serves_bad++;

                        continue;

                }

                // WARN: For high volume servers, this should go in a new thread.

                nts_lock_certlock();

                ssl = SSL_new(server_ctx);

                nts_unlock_certlock();

                SSL_set_fd(ssl, client);

                err = SSL_accept(ssl);

                if (0 >= err) {

                        int code = SSL_get_error(ssl, err);

                        SSL_free(ssl);

                        close(client);

                        clock_gettime(CLOCK_MONOTONIC, &finish);

                        wall = tspec_intv_to_lfp(sub_tspec(finish, start));

#ifdef RUSAGE_THREAD

                        getrusage(RUSAGE_THREAD, &usage);

                        finish_u = tval_to_tspec(usage.ru_utime);

                        finish_s = tval_to_tspec(usage.ru_stime);

                        usr = tspec_intv_to_lfp(sub_tspec(finish_u, start_u));

                        sys = tspec_intv_to_lfp(sub_tspec(finish_s, start_s));

                        start_u = finish_u;

                        start_s = finish_s;

#endif

                        nts_ke_accept_fail(addrbuf,

                          lfptox(wall), lfptox(usr), lfptox(sys), code);

                        continue;

                }

                // Save info for final message.

                snprintf(usingbuf, sizeof(usingbuf), "%s:%s(%d)",

                        SSL_get_version(ssl),

                        SSL_get_cipher_name(ssl),

                        SSL_get_cipher_bits(ssl, NULL));

                status = NTSKE_Failed;

                nts_ke_request(ssl, errbuf, sizeof(errbuf), &errtxt);

                if (NULL==errtxt) status = NTSKE_OK;

                SSL_shutdown(ssl);

                SSL_free(ssl);

                close(client);

                clock_gettime(CLOCK_MONOTONIC, &finish);

                wall = tspec_intv_to_lfp(sub_tspec(finish, start));

#ifdef RUSAGE_THREAD

                getrusage(RUSAGE_THREAD, &usage);

                finish_u = tval_to_tspec(usage.ru_utime);

                finish_s = tval_to_tspec(usage.ru_stime);

                usr = tspec_intv_to_lfp(sub_tspec(finish_u, start_u));

                sys = tspec_intv_to_lfp(sub_tspec(finish_s, start_s));

                start_u = finish_u;

                start_s = finish_s;

#endif

                record_ntske_log(status, addrbuf, usingbuf,

                  lfptox(wall), lfptox(usr), lfptox(sys),

                  errtxt);

        }

        return NULL;

}

/* Analyze failure from SSL_accept

 * print single error message for common cases.

 * Similar code in nts.c, nts_ssl_read() and nts_ssl_write()

 */

void nts_ke_accept_fail(char* hostname,

    double wall, double usr, double sys, int code) {

        unsigned long err = ERR_peek_error();

        char errbuf[100];

        char buff[200];

        const char *msg = NULL;

        const char *errmsg = NULL;

        if (0 == err) {

          switch (code) {

            case SSL_ERROR_WANT_READ:

              msg = "Timeout";

              break;

            case SSL_ERROR_SYSCALL:

              if (ECONNRESET==errno) {

                msg = "Connection reset";

                break;

              }

              // fall through

            default:

              ntp_strerror_r(errno, errbuf, sizeof(errbuf));

              snprintf(buff, sizeof(buff), "code %d, errno=>%d, %s",

                code, errno, errbuf);

              msg = buff;

              break;

          }

        } else {

          if (code==SSL_ERROR_SSL) {

            msg = ERR_reason_error_string(err);

            err = 0;

          } else {

            // Maybe we need to handle other codes

            ntp_strerror_r(errno, errbuf, sizeof(errbuf));

            snprintf(buff, sizeof(buff), "code %d, errno=>%d, %s, %lx=>%s",

              code, errno, errbuf, err, ERR_reason_error_string(err));

            err = 0;

            msg = buff;

          }

        }

        record_ntske_log(NTSKE_SSL_Failed, hostname, msg,

                wall, usr, sys, errmsg);

}

void nts_ke_request(SSL *ssl,

  char *errbuf, int errlng, const char **errtxt) {

        /* RFC 4: servers must accept 1024

         * Our cookies can be 104, 136, or 168 for AES_SIV_CMAC_xxx

         * 8*168 fits comfortably into 2K.

         */

        uint8_t buff[2048];

        uint8_t c2s[NTS_MAX_KEYLEN], s2c[NTS_MAX_KEYLEN];

        int aead = NO_AEAD, keylen;

        struct BufCtl_t buf;

        int bytes_read, bytes_written;

        int used;

        bytes_read = nts_ssl_read(ssl, buff, sizeof(buff), errtxt);

        if (0 >= bytes_read)

                return;

        buf.next = buff;

        buf.left = bytes_read;

        if (!nts_ke_process_receive(&buf, &aead, errbuf, errlng, errtxt)) {

                return;

        }

        if ((NO_AEAD == aead) && (NULL != ntsconfig.aead))

                aead = nts_string_to_aead(ntsconfig.aead);

        if (NO_AEAD == aead)

                aead = AEAD_AES_SIV_CMAC_256;    // default

        keylen = nts_get_key_length(aead);

        if (!nts_make_keys(ssl, aead, c2s, s2c, keylen)) {

                *errtxt = "Can't make keys";

                return;

        }

        buf.next = buff;

        buf.left = sizeof(buff);

        nts_ke_setup_send(&buf, aead, c2s, s2c, keylen);

        used = sizeof(buff)-buf.left;

        bytes_written = nts_ssl_write(ssl, buff, used, errtxt);

        if (bytes_written != used)

                return;

// FIXME: Need counters for AEAD

        return;

}

bool create_listener4(int port) {

        int sock = -1;

        sockaddr_u addr;

        int on = 1;

        int err;

        char errbuf[100];

        addr.sa4.sin_family = AF_INET;

        addr.sa4.sin_port = htons(port);

        addr.sa4.sin_addr.s_addr= htonl(INADDR_ANY);

        sock = socket(AF_INET, SOCK_STREAM, 0);

        if (sock < 0) {

                if (EAFNOSUPPORT == errno) {

                        msyslog(LOG_ERR, "NTSs: No IPv4 support, disabling NTS-KE listener");

                        return true;

                }

                ntp_strerror_r(errno, errbuf, sizeof(errbuf));

                msyslog(LOG_ERR, "NTSs: Can't create socket4: %s", errbuf);

                return false;

        }

        err = setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));

        if (0 > err) {

                ntp_strerror_r(errno, errbuf, sizeof(errbuf));

                msyslog(LOG_ERR, "NTSs: can't setsockopt4: %s", errbuf);

                close(sock);

                return false;

        }

        err = bind(sock, &addr.sa, sizeof(addr.sa4));

        if (0 > err) {

                ntp_strerror_r(errno, errbuf, sizeof(errbuf));

                msyslog(LOG_ERR, "NTSs: can't bind4: %s", errbuf);

                close(sock);

                return false;

        }

        if (listen(sock, 6) < 0) {

                ntp_strerror_r(errno, errbuf, sizeof(errbuf));

                msyslog(LOG_ERR, "NTSs: can't listen4: %s", errbuf);

                close(sock);

                return false;

        }

        msyslog(LOG_INFO, "NTSs: listen4 worked");

        listener4_sock = sock;

        return true;

}

bool create_listener6(int port) {

        int sock = -1;

        sockaddr_u addr;

        int on = 1;

        int err;

        char errbuf[100];

        addr.sa6.sin6_family = AF_INET6;

        addr.sa6.sin6_port = htons(port);

        addr.sa6.sin6_addr = in6addr_any;

        sock = socket(AF_INET6, SOCK_STREAM, 0);

        if (sock < 0) {

                if (EAFNOSUPPORT == errno) {

                        msyslog(LOG_ERR, "NTSs: No IPv6 support, disabling NTS-KE listener");

                        return true;

                }

                ntp_strerror_r(errno, errbuf, sizeof(errbuf));

                msyslog(LOG_ERR, "NTSs: Can't create socket6: %s", errbuf);

                return false;

        }

        // Hack to keep IPV6 from listening on IPV4 too

        err = setsockopt(sock, IPPROTO_IPV6, IPV6_V6ONLY, &on, sizeof(on));

        if (0 > err) {

                ntp_strerror_r(errno, errbuf, sizeof(errbuf));

                msyslog(LOG_ERR, "NTSs: can't setsockopt6only: %s", errbuf);

                close(sock);

                return false;

        }

        err = setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));

        if (0 > err) {

                ntp_strerror_r(errno, errbuf, sizeof(errbuf));

                msyslog(LOG_ERR, "NTSs: can't setsockopt6: %s", errbuf);

                close(sock);

                return false;

        }

        err = bind(sock, &addr.sa, sizeof(addr.sa6));

        if (0 > err) {

                ntp_strerror_r(errno, errbuf, sizeof(errbuf));

                msyslog(LOG_ERR, "NTSs: can't bind6: %s", errbuf);

                close(sock);

                return false;

        }

        if (listen(sock, 6) < 0) {

                ntp_strerror_r(errno, errbuf, sizeof(errbuf));

                msyslog(LOG_ERR, "NTSs: can't listen6: %s", errbuf);

                close(sock);

                return false;

        }

        msyslog(LOG_INFO, "NTSs: listen6 worked");

        listener6_sock = sock;

        return true;

}

bool nts_ke_process_receive(struct BufCtl_t *buf, int *aead,

  char *errbuf, int errlng, const char **errtxt) {

        while (buf->left >= NTS_KE_HDR_LNG) {

                uint16_t type, data;

                int length;

                bool critical = false;

                type = ke_next_record(buf, &length);

                if (length > buf->left) {

                        snprintf(errbuf, errlng,

                                "Chunk too big: 0x%x, %d, %d",

                                type, buf->left, length);

                        *errtxt = errbuf;

                        return false;

                }

                if (NTS_CRITICAL & type) {

                        critical = true;

                        type &= ~NTS_CRITICAL;

                }

                if (0) // Handy for debugging but very verbose

                        msyslog(LOG_INFO, "NTSs: Record: T=%d, L=%d, C=%d", type, length, critical);

                switch (type) {

                    case nts_error:

                        if (sizeof(data) != length) {

                                snprintf(errbuf, errlng,

                                        "Wrong length on error: %d", length);

                                *errtxt = errbuf;

                                return false;

                        }

                        data = next_uint16(buf);

                        snprintf(errbuf, errlng,

                                "Received error: %d", data);

                        *errtxt = errbuf;

                        return false;

                    case nts_next_protocol_negotiation:

                        if (sizeof(data) != length) {

                                snprintf(errbuf, errlng,

                                        "NPN-Wrong length: %d", length);

                                *errtxt = errbuf;

                                return false;

                        }

                        data = next_uint16(buf);

                        if (data != nts_protocol_NTP) {

                                snprintf(errbuf, errlng,

                                        "NPN-Bad data: %d", data);

                                *errtxt = errbuf;

                                return false;

                        }

                        break;

                    case nts_algorithm_negotiation:

                        if (length % sizeof(uint16_t) > 0) {

                                snprintf(errbuf, errlng,

                                        "AN-Wrong length: %d", length);

                                *errtxt = errbuf;

                                return false;

                        }

                        for (int i=0; i<length; i+=sizeof(uint16_t)) {

                                data = next_uint16(buf);

                                if (0 == nts_get_key_length(data)) {

                                        if (0)  // for debugging

                                                msyslog(LOG_ERR, "NTSs: AN-Unsupported AEAN type: %d", data);

                                        continue;     // ignore types we don't support

                                }

                                if (*aead != NO_AEAD)

                                        continue;     // already got one

                                *aead = data;   // take this one

                        }

                        break;

                    case nts_end_of_message:

                        if ((0 != length) || !critical) {

                                snprintf(errbuf, errlng,

                                        "EOM-Wrong length or not Critical: %d, %d",

                                        length, critical);

                                *errtxt = errbuf;

                                return false;

                        }

                        if (0 != buf->left) {

                                snprintf(errbuf, errlng,

                                        "EOM not at end: %d", buf->left);

                                *errtxt = errbuf;

                                return false;

                        }

                        return true;

                    default:

                        if (critical) {

                          // This only logs the first one from a connection

                          snprintf(errbuf, errlng,

                                "Received strange type: T=%d, C=%d, L=%d",

                                type, critical, length);

                          // There is an error code for this

                          return false;

                        }

                        // It might be interesting to log non-critical

                        // but that needs rate limiting

                        buf->next += length;

                        buf->left -= length;

                        break;

                }  // case

        }   // while

        /* If we get here, we ran off the end without finding an EOM.

         * nts_ssl_read() should have complained, so this check

         * should never happen.

         */

        if (buf->left > 0) {

                *errtxt = "*** Leftovers";

                return false;

        }

        *errtxt = "*** Missing EOM";

        return false;

}

void nts_ke_setup_send(struct BufCtl_t *buf, int aead,

       uint8_t *c2s, uint8_t *s2c, int keylen) {

        // 4.1.2 Next Protocol

        ke_append_record_uint16(buf,

                                NTS_CRITICAL+nts_next_protocol_negotiation, nts_protocol_NTP);

        // 4.1.5 AEAD Algorithm List

        ke_append_record_uint16(buf, nts_algorithm_negotiation, aead);

        if (extra_port)

                ke_append_record_uint16(buf, nts_port_negotiation, extra_port);

        for (int i=0; i<NTS_MAX_COOKIES; i++) {

                uint8_t cookie[NTS_MAX_COOKIELEN];

                int cookielen = nts_make_cookie(cookie, aead, c2s, s2c, keylen);

                ke_append_record_bytes(buf, nts_new_cookie, cookie, cookielen);

        }

        // 4.1.1: End, Critical

        ke_append_record_null(buf, NTS_CRITICAL+nts_end_of_message);

}

// end