[Sec 3020] Refclock impersonation. HStenn.

bk: 56d4cdadyjbEtsWIuGaFIpsC0XrP2A

diff --git a/ChangeLog b/ChangeLog
index 1276ffaf5ab0fb1889e9ed05dd1ec47071ae278c..7ab704f2f157d006c8186989e04a46b02e8ea431 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -7,6 +7,7 @@
 * [Sec 3008] Always check the return value of ctl_getitem().
   - initial work by HStenn
   - Additional cleanup of ctl_getitem by perlinger@ntp.org
+* [Sec 3020] Refclock impersonation.  HStenn.
 * [Bug 2858] bool support.  Use stdbool.h when available.  HStenn.
 * [Bug 2879] Improve NTP security against timing attacks. perlinger@ntp.org
   - integrated patches by Loganaden Velvidron <logan@ntp.org>

diff --git a/configure.ac b/configure.ac
index 9624f9aee6b3b167f02eed63d4751126884e5831..2a0c1a0d8e9e2192b9fdd3930b882fe8cae1c91b 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -4160,6 +4160,24 @@ case "$ans" in
 esac
 
 
+AC_MSG_CHECKING([if we want the explicit 127.0.0.0/8 martian filter])
+AC_ARG_ENABLE(
+    [bug3020-fix],
+    [AS_HELP_STRING(
+       [--enable-bug3020-fix],
+       [+ Provide the explicit 127.0.0.0/8 martian filter]
+    )],
+    [ans=$enableval],
+    [ans=yes]
+)
+AC_MSG_RESULT([$ans])
+case "$ans" in
+ yes)
+    AC_DEFINE([ENABLE_BUG3020_FIX], [1],
+       [Provide the explicit 127.0.0.0/8 martian filter?])
+esac
+
+
 AC_MSG_CHECKING([if we should use the IRIG sawtooth filter])
 
 case "$host" in

diff --git a/ntpd/ntp_io.c b/ntpd/ntp_io.c
index 95229d6a7f022d0cd6b9b8939f4985434c5e4982..5f5b721b6cedd920f79a5b77fb6796690e0737ea 100644 (file)
--- a/ntpd/ntp_io.c
+++ b/ntpd/ntp_io.c
@@ -3447,6 +3447,18 @@ read_network_packet(
        DPRINTF(3, ("read_network_packet: fd=%d length %d from %s\n",
                    fd, buflen, stoa(&rb->recv_srcadr)));
 
+#ifdef ENABLE_BUG3020_FIX
+       if (ISREFCLOCKADR(&rb->recv_srcadr)) {
+               msyslog(LOG_ERR, "recvfrom(%s) fd=%d: refclock srcadr on a network interface!",
+                       stoa(&rb->recv_srcadr), fd);
+               DPRINTF(1, ("read_network_packet: fd=%d dropped (refclock srcadr))\n",
+                           fd));
+               packets_dropped++;
+               freerecvbuf(rb);
+               return (buflen);
+       }
+#endif
+
        /*
        ** Bug 2672: Some OSes (MacOSX and Linux) don't block spoofed ::1
        */