Blame SOURCES/ntp-4.2.6p5-cve-2016-1548.patch

72fc97
diff -up ntp-4.2.6p5/ntpd/ntp_proto.c.cve-2016-1548 ntp-4.2.6p5/ntpd/ntp_proto.c
72fc97
--- ntp-4.2.6p5/ntpd/ntp_proto.c.cve-2016-1548	2016-04-28 08:37:42.513561354 +0200
72fc97
+++ ntp-4.2.6p5/ntpd/ntp_proto.c	2016-04-28 09:30:59.450347729 +0200
72fc97
@@ -306,6 +306,7 @@ receive(
72fc97
 	int	authlen;		/* offset of MAC field */
72fc97
 	int	is_authentic = 0;	/* cryptosum ok */
72fc97
 	int	retcode = AM_NOMATCH;	/* match code */
72fc97
+	int	xleave_mismatch = 0;	/* mismatch in xleave mode */
72fc97
 	keyid_t	skeyid = 0;		/* key IDs */
72fc97
 	u_int32	opcode = 0;		/* extension field opcode */
72fc97
 	sockaddr_u *dstadr_sin; 	/* active runway */
72fc97
@@ -1067,9 +1068,8 @@ receive(
72fc97
 		}
72fc97
 
72fc97
 	/*
72fc97
-	 * Check for bogus packet in basic mode. If found, switch to
72fc97
-	 * interleaved mode and resynchronize, but only after confirming
72fc97
-	 * the packet is not bogus in symmetric interleaved mode.
72fc97
+	 * Check for bogus packet in basic mode. If found, check if it's not
72fc97
+	 * a valid packet in symmetric interleaved mode.
72fc97
 	 */
72fc97
 	} else if (peer->flip == 0) {
72fc97
 		if (L_ISZERO(&p_org) || !L_ISEQU(&p_org, &peer->aorg)) {
72fc97
@@ -1077,8 +1077,7 @@ receive(
72fc97
 			peer->flash |= TEST2;	/* bogus */
72fc97
 			if (!L_ISZERO(&peer->dst) && L_ISEQU(&p_org,
72fc97
 			    &peer->dst)) {
72fc97
-				peer->flip = 1;
72fc97
-				report_event(PEVNT_XLEAVE, peer, NULL);
72fc97
+				xleave_mismatch = 1;
72fc97
 			}
72fc97
 		} else {
72fc97
 			L_CLR(&peer->aorg);
72fc97
@@ -1152,6 +1151,16 @@ receive(
72fc97
 	}
72fc97
 
72fc97
 	/*
72fc97
+	 * If the packet is bogus in basic mode but not in symmetric
72fc97
+	 * interleaved mode and it passed the authentication check,
72fc97
+	 * enable the mode and resynchronize.
72fc97
+	 */
72fc97
+	if (xleave_mismatch && hismode == MODE_ACTIVE) {
72fc97
+		peer->flip = 1;
72fc97
+		report_event(PEVNT_XLEAVE, peer, NULL);
72fc97
+	}
72fc97
+
72fc97
+	/*
72fc97
 	 * Update the state variables.
72fc97
 	 */
72fc97
 	if (peer->flip == 0) {
72fc97
@@ -1715,5 +1723,12 @@ clock_update(
72fc97
 	sys_rootdelay = peer->delay + peer->rootdelay;
72fc97
 	sys_reftime = peer->dst;
72fc97
+	
72fc97
+	/* Randomize the fraction part of the reference time to not reveal
72fc97
+	   peer->dst to NTP clients as it could be used in a DoS attack
72fc97
+	   enabling the symmetric interleaved mode with spoofed packets */
72fc97
+	ntp_crypto_random_buf(&sys_reftime.l_uf, sizeof (sys_reftime.l_uf));
72fc97
+	if (L_ISHIS(&sys_reftime, &peer->dst))
72fc97
+		sys_reftime.l_ui--;
72fc97
 
72fc97
 #ifdef DEBUG
72fc97
 	if (debug)