[Sec 2901] Additional KoD packet checks. HStenn.

bk: 56a3780fR8INkXDPyHYS7AsXrccLQw

diff --git a/ChangeLog b/ChangeLog
index 23f0ad45e4ec96d8983d3536af99ce37924a23fd..656f42a80c4220d26fb12904c7f1e06bbeb806de 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,6 +1,7 @@
 ---
 
 * [Sec 2901] KoD packets must have non-zero transmit timestamps.  HStenn.
+* [Sec 2901] Additional KoD packet checks.  HStenn.
 * [Sec 2936] Skeleton Key: Any system knowing the trusted key can serve
   time. Include passive servers in this check. HStenn.
 * [Bug 2879] Improve NTP security against timing attacks. perlinger@ntp.org

diff --git a/ntpd/ntp_proto.c b/ntpd/ntp_proto.c
index 02efb18b34f23c2caea50ef92f85ab82e05eb0a3..43a47af31e845209b971089ba2a43bbbdc0d358c 100644 (file)
--- a/ntpd/ntp_proto.c
+++ b/ntpd/ntp_proto.c
@@ -1451,6 +1451,58 @@ receive(
                        return;
                }
 
+       /*
+        * Basic KoD validation checking:
+        *
+        * KoD packets are a mixed-blessing.  Forged KoD packets
+        * are DoS attacks.  There are rare situations where we might
+        * get a valid KoD response, though.  Since KoD packets are
+        * a special case that can easily complicate the checks we do
+        * next, we handle the special KoD cases here.
+        *
+        * Note that we expect the incoming KoD packet to have its
+        * (nonzero) org, rec, and xmt timestamps set to the xmt timestamp
+        * that we have previously sent out.  Watch interleave mode.
+        */
+       } else if (0 == hisstratum) {
+               if (   L_ISZERO(&p_xmt)
+                   || L_ISZERO(&p_org)
+                   || L_ISZERO(&p_rec)) {
+                       peer->bogusorg++;
+                       msyslog(LOG_INFO,
+                               "receive: KoD packet from %s has a zero xmt, org, or rec timestamp.  Ignoring.",
+                               ntoa(&peer->srcadr));
+                       return;
+               }
+
+               if (   !L_ISEQU(&p_xmt, &p_org)
+                   || !L_ISEQU(&p_xmt, &p_rec)) {
+                       peer->bogusorg++;
+                       msyslog(LOG_INFO,
+                               "receive: KoD packet from %s has inconsistent xmt/org/rec timestamps.  Ignoring.",
+                               ntoa(&peer->srcadr));
+                       return;
+               }
+
+               /* Be conservative */
+               if (peer->flip == 0 && !L_ISEQU(&p_org, &peer->aorg)) {
+                       peer->bogusorg++;
+                       msyslog(LOG_INFO,
+                               "receive: Unexpected KoD origin timestamp %#010x.%08x from %s does not match %#010x.%08x",
+                               p_org.l_ui, p_org.l_uf,
+                               ntoa(&peer->srcadr),
+                               peer->aorg.l_ui, peer->aorg.l_uf);
+                       return;
+               } else if (peer->flip == 1 && !L_ISEQU(&p_org, &peer->borg)) {
+                       peer->bogusorg++;
+                       msyslog(LOG_INFO,
+                               "receive: Unexpected KoD origin timestamp %#010x.%08x from %s does not match interleave %#010x.%08x",
+                               p_org.l_ui, p_org.l_uf,
+                               ntoa(&peer->srcadr),
+                               peer->borg.l_ui, peer->borg.l_uf);
+                       return;
+               }
+       
        /*
         * Basic mode checks:
         *
@@ -1470,6 +1522,7 @@ receive(
         * be from us, attempting to cause our server to KoD us.
         */
        } else if (peer->flip == 0) {
+               /* HMS: we can simplify this now that we do KoD checks above */
                if (0 < hisstratum && L_ISZERO(&p_org)) {
                        L_CLR(&peer->aorg);
                } else if (    L_ISZERO(&peer->aorg)