[Bug 2941] NAK to the Future: Symmetric association authentication bypass via crypto-NAK

bk: 5619fd4cu9-bPDW4AmV40Xqs7k1I-A

diff --git a/ChangeLog b/ChangeLog
index b022ef6f6a86c267d69a5ae3c8fa64474ef83859..1e85bae598d473a269460f0f931db186997ad19f 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,4 +1,7 @@
 ---
+* [Bug 2941] NAK to the Future: Symmetric association authentication
+  bypass via crypto-NAK. Patch applied. perlinger@ntp.org
+---
 (4.2.8p4-RC1) 2015/10/06 Released by Harlan Stenn <stenn@ntp.org>
 
 * [Bug 2332] (reopened) Exercise thread cancellation once before dropping

diff --git a/ntpd/ntp_proto.c b/ntpd/ntp_proto.c
index 44f66ef6d4a13b29ab46217523f28326551b30dd..c8ee280b9d1de08fb6ded9da2a1aed37f4f4bb1f 100644 (file)
--- a/ntpd/ntp_proto.c
+++ b/ntpd/ntp_proto.c
@@ -1133,6 +1133,24 @@ receive(
                                sys_restricted++;
                                return;
                        }
+                       /* [Bug 2941]
+                        * If we got here, the packet isn't part of an
+                        * existing association, it isn't correctly
+                        * authenticated, and it didn't meet either of
+                        * the previous two special cases so we should
+                        * just drop it on the floor.  For example,
+                        * crypto-NAKs (is_authentic == AUTH_CRYPTO)
+                        * will make it this far.  This is just
+                        * debug-printed and not logged to avoid log
+                        * flooding.
+                        */
+                       DPRINTF(1, ("receive: at %ld refusing to mobilize passive association"
+                                   " with unknown peer %s mode %d keyid %08x len %d auth %d\n",
+                                   current_time, stoa(&rbufp->recv_srcadr),
+                                   hismode, skeyid, (authlen + has_mac),
+                                   is_authentic));
+                       sys_declined++;
+                       return;
                }
 
                /*