Log incoming packets that fail TEST2. Harlan Stenn.

bk: 5613800fTrOavQElDsHywDtM6FR3zQ

diff --git a/ChangeLog b/ChangeLog
index 89bd387b2aad8fb41c8d25bc2394464cae80cd17..93d35a7fdf470071b66cf56f7524fd6a727d45b5 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,7 +1,7 @@
 ---
 * [Sec 2899] CVE-2014-9297  perlinger@ntp.org
 * [Sec 2901] Drop invalid packet before checking KoD. Check for all KoD's.
-  Danny Mayer.
+  Danny Mayer.  Log incoming packets that fail TEST2.  Harlan Stenn.
 * [Sec 2902] configuration directives "pidfile" and "driftfile"
   should be local-only. perlinger@ntp.org (patch by Miroslav Lichvar)
 * [Sec 2909] added missing call to 'free()' in ntp_crypto.c. perlinger@ntp.org

diff --git a/ntpd/ntp_proto.c b/ntpd/ntp_proto.c
index 7f47f8dbecf66e8ba5e7f75968d18779d754c2f1..3dc71376422ae2b12fd671d4ab83b9eec7fafdf1 100644 (file)
--- a/ntpd/ntp_proto.c
+++ b/ntpd/ntp_proto.c
@@ -1306,11 +1306,17 @@ receive(
         * Check for bogus packet in basic mode. If found, switch to
         * interleaved mode and resynchronize, but only after confirming
         * the packet is not bogus in symmetric interleaved mode.
+        *
+        * This could also mean somebody is forging packets claiming to
+        * be from us, attempting to cause our server to KoD us.
         */
        } else if (peer->flip == 0) {
                if (!L_ISEQU(&p_org, &peer->aorg)) {
                        peer->bogusorg++;
                        peer->flash |= TEST2;   /* bogus */
+                       msyslog(LOG_INFO,
+                               "receive: Unexpected origin timestamp from %s",
+                               ntoa(&peer->srcadr));
                        if (  !L_ISZERO(&peer->dst)
                            && L_ISEQU(&p_org, &peer->dst)) {
                                peer->flip = 1;
@@ -3768,7 +3774,7 @@ pool_xmit(
                                pool->hostname));
                else
                        msyslog(LOG_ERR,
-                               "unable to start pool DNS %s %m",
+                               "unable to start pool DNS %s: %m",
                                pool->hostname);
                return;
        }