|
 |
2b78f7 |
2017-02-12 09:49:29+01:00, perlinger@ntp.org
|
|
|
2b78f7 |
[Sec 3389] NTP-01-016: Denial of Service via Malformed Config
|
|
|
2b78f7 |
|
|
|
2b78f7 |
diff -up ntp-4.2.6p5/ntpd/ntp_config.c.cve-2017-6464 ntp-4.2.6p5/ntpd/ntp_config.c
|
|
|
2b78f7 |
--- ntp-4.2.6p5/ntpd/ntp_config.c.cve-2017-6464 2017-03-22 12:54:11.257454635 +0100
|
|
|
2b78f7 |
+++ ntp-4.2.6p5/ntpd/ntp_config.c 2017-03-22 12:57:06.919024166 +0100
|
|
|
2b78f7 |
@@ -311,6 +311,9 @@ void ntpd_set_tod_using(const char *);
|
|
|
2b78f7 |
static u_int32 get_pfxmatch(const char **, struct masks *);
|
|
|
2b78f7 |
static u_int32 get_match(const char *, struct masks *);
|
|
|
2b78f7 |
static u_int32 get_logmask(const char *);
|
|
|
2b78f7 |
+static int/*BOOL*/ is_refclk_addr(const struct address_node * addr);
|
|
|
2b78f7 |
+
|
|
|
2b78f7 |
+
|
|
|
2b78f7 |
static int getnetnum(const char *num,sockaddr_u *addr, int complain,
|
|
|
2b78f7 |
enum gnn_type a_type);
|
|
|
2b78f7 |
static int get_multiple_netnums(const char *num, sockaddr_u *addr,
|
|
|
2b78f7 |
@@ -1342,7 +1344,10 @@ create_peer_node(
|
|
|
2b78f7 |
break;
|
|
|
2b78f7 |
|
|
|
2b78f7 |
case T_Ttl:
|
|
|
2b78f7 |
- if (my_node->ttl >= MAX_TTL) {
|
|
|
2b78f7 |
+ if (is_refclk_addr(addr)) {
|
|
|
2b78f7 |
+ msyslog(LOG_ERR, "'ttl' does not apply for refclocks");
|
|
|
2b78f7 |
+ errflag = 1;
|
|
|
2b78f7 |
+ } else if (option->value.i < 0 || option->value.i >= MAX_TTL) {
|
|
|
2b78f7 |
msyslog(LOG_ERR, "ttl: invalid argument");
|
|
|
2b78f7 |
errflag = 1;
|
|
|
2b78f7 |
}
|
|
|
2b78f7 |
@@ -1351,7 +1355,12 @@ create_peer_node(
|
|
|
2b78f7 |
break;
|
|
|
2b78f7 |
|
|
|
2b78f7 |
case T_Mode:
|
|
|
2b78f7 |
- my_node->ttl = option->value.i;
|
|
|
2b78f7 |
+ if (is_refclk_addr(addr)) {
|
|
|
2b78f7 |
+ my_node->ttl = option->value.i;
|
|
|
2b78f7 |
+ } else {
|
|
|
2b78f7 |
+ msyslog(LOG_ERR, "'mode' does not apply for network peers");
|
|
|
2b78f7 |
+ errflag = 1;
|
|
|
2b78f7 |
+ }
|
|
|
2b78f7 |
break;
|
|
|
2b78f7 |
|
|
|
2b78f7 |
case T_Key:
|
|
|
2b78f7 |
@@ -2674,6 +2685,16 @@ apply_enable_disable(
|
|
|
2b78f7 |
}
|
|
|
2b78f7 |
}
|
|
|
2b78f7 |
|
|
|
2b78f7 |
+/* Hack to disambiguate 'server' statements for refclocks and network peers.
|
|
|
2b78f7 |
+ * Please note the qualification 'hack'. It's just that.
|
|
|
2b78f7 |
+ */
|
|
|
2b78f7 |
+static int/*BOOL*/
|
|
|
2b78f7 |
+is_refclk_addr(
|
|
|
2b78f7 |
+ const struct address_node * addr
|
|
|
2b78f7 |
+ )
|
|
|
2b78f7 |
+{
|
|
|
2b78f7 |
+ return addr && addr->address && !strncmp(addr->address, "127.127.", 8);
|
|
|
2b78f7 |
+}
|
|
|
2b78f7 |
|
|
|
2b78f7 |
static void
|
|
|
2b78f7 |
config_system_opts(
|
|
|
2b78f7 |
@@ -2920,7 +2941,9 @@ config_ttl(
|
|
|
2b78f7 |
|
|
|
2b78f7 |
curr_ttl = next_node(curr_ttl);
|
|
|
2b78f7 |
}
|
|
|
2b78f7 |
- sys_ttlmax = i - 1;
|
|
|
2b78f7 |
+
|
|
|
2b78f7 |
+ if (i)
|
|
|
2b78f7 |
+ sys_ttlmax = i - 1;
|
|
|
2b78f7 |
}
|
|
|
2b78f7 |
|
|
|
2b78f7 |
|
|
|
2b78f7 |
diff -up ntp-4.2.6p5/ntpd/ntp_proto.c.cve-2017-6464 ntp-4.2.6p5/ntpd/ntp_proto.c
|
|
|
2b78f7 |
--- ntp-4.2.6p5/ntpd/ntp_proto.c.cve-2017-6464 2017-03-22 12:54:11.270454677 +0100
|
|
|
2b78f7 |
+++ ntp-4.2.6p5/ntpd/ntp_proto.c 2017-03-22 12:54:11.279454706 +0100
|
|
|
2b78f7 |
@@ -3017,8 +3017,9 @@ peer_xmit(
|
|
|
2b78f7 |
}
|
|
|
2b78f7 |
}
|
|
|
2b78f7 |
peer->t21_bytes = sendlen;
|
|
|
2b78f7 |
- sendpkt(&peer->srcadr, peer->dstadr, sys_ttl[peer->ttl],
|
|
|
2b78f7 |
- &xpkt, sendlen);
|
|
|
2b78f7 |
+ sendpkt(&peer->srcadr, peer->dstadr,
|
|
|
2b78f7 |
+ sys_ttl[(peer->ttl >= sys_ttlmax) ? sys_ttlmax : peer->ttl],
|
|
|
2b78f7 |
+ &xpkt, sendlen);
|
|
|
2b78f7 |
peer->sent++;
|
|
|
2b78f7 |
peer->throttle += (1 << peer->minpoll) - 2;
|
|
|
2b78f7 |
|
|
|
2b78f7 |
@@ -3330,8 +3331,9 @@ peer_xmit(
|
|
|
2b78f7 |
exit (-1);
|
|
|
2b78f7 |
}
|
|
|
2b78f7 |
peer->t21_bytes = sendlen;
|
|
|
2b78f7 |
- sendpkt(&peer->srcadr, peer->dstadr, sys_ttl[peer->ttl], &xpkt,
|
|
|
2b78f7 |
- sendlen);
|
|
|
2b78f7 |
+ sendpkt(&peer->srcadr, peer->dstadr,
|
|
|
2b78f7 |
+ sys_ttl[(peer->ttl >= sys_ttlmax) ? sys_ttlmax : peer->ttl],
|
|
|
2b78f7 |
+ &xpkt, sendlen);
|
|
|
2b78f7 |
peer->sent++;
|
|
|
2b78f7 |
peer->throttle += (1 << peer->minpoll) - 2;
|
|
|
2b78f7 |
|