From: Juergen Perlinger <perlinger@ntp.org>
Date: Sun, 2 Dec 2018 07:17:05 +0000 (+0100)
Subject: [Bug 3554] config revoke stores incorrect value
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a0d5cde14b6027e8747744af588af83c125634ba;p=thirdparty%2Fntp.git

[Bug 3554] config revoke stores incorrect value
 - plus some additional cleanup

bk: 5c0386f1vg3ZfWBwKlgFX4yX_As4hA
---

diff --git a/ChangeLog b/ChangeLog
index f381a093c..906f38f25 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+---
+* [Bug 3554] config revoke stores incorrect value <perlinger@ntp.org>
+  - original finding by Gerry Garvey, additional cleanup needed
+
 ---
 (4.2.8p12) 2018/08/14 Released by Harlan Stenn <stenn@ntp.org>
 
diff --git a/include/ntpd.h b/include/ntpd.h
index 6a5128ce0..ead0c2cf8 100644
--- a/include/ntpd.h
+++ b/include/ntpd.h
@@ -275,8 +275,8 @@ extern	u_long	orphwait;		/* orphan wait time */
 extern	char	*sys_hostname;	/* host name */
 extern	char	*sys_groupname;	/* group name */
 extern	char	*group_name;	/* group name */
-extern	u_long	sys_revoke;	/* keys revoke timeout */
-extern	u_long	sys_automax;	/* session key timeout */
+extern	u_char	sys_revoke;	/* keys revoke timeout */
+extern	u_char	sys_automax;	/* session key timeout */
 #endif	/* AUTOKEY */
 
 /* ntp_util.c */
diff --git a/ntpd/ntp_config.c b/ntpd/ntp_config.c
index 89c920c1e..be0b46e72 100644
--- a/ntpd/ntp_config.c
+++ b/ntpd/ntp_config.c
@@ -2065,8 +2065,12 @@ config_auth(
 
 #ifdef AUTOKEY
 	/* crypto revoke command */
-	if (ptree->auth.revoke)
-		sys_revoke = 1UL << ptree->auth.revoke;
+	if (ptree->auth.revoke > 2 && ptree->auth.revoke < 32)
+		sys_revoke = (u_char)ptree->auth.revoke;
+	else if (ptree->auth.revoke)
+		msyslog(LOG_ERR,
+			"'revoke' value %d ignored",
+			ptree->auth.revoke);
 #endif	/* AUTOKEY */
 }
 #endif	/* !SIM */
@@ -3813,7 +3817,12 @@ config_vars(
 
 		case T_Automax:
 #ifdef AUTOKEY
-			sys_automax = curr_var->value.i;
+			if (curr_var->value.i > 2 && curr_var->value.i < 32)
+				sys_automax = (u_char)curr_var->value.i;
+			else
+				msyslog(LOG_ERR,
+					"'automax' value %d ignored",
+					curr_var->value.i);
 #endif
 			break;
 
diff --git a/ntpd/ntp_crypto.c b/ntpd/ntp_crypto.c
index f2df4da8f..37f74c01e 100644
--- a/ntpd/ntp_crypto.c
+++ b/ntpd/ntp_crypto.c
@@ -353,8 +353,8 @@ make_keylist(
 	 * included in the hash is zero if broadcast mode, the peer
 	 * cookie if client mode or the host cookie if symmetric modes.
 	 */
-	mpoll = 1 << min(peer->ppoll, peer->hpoll);
-	lifetime = min(1U << sys_automax, NTP_MAXSESSION * mpoll);
+	mpoll = 1U << min(peer->ppoll, peer->hpoll);
+	lifetime = min((1UL << sys_automax), NTP_MAXSESSION * mpoll);
 	if (peer->hmode == MODE_BROADCAST)
 		cookie = 0;
 	else
diff --git a/ntpd/ntp_timer.c b/ntpd/ntp_timer.c
index 9ee35f812..9725b5bda 100644
--- a/ntpd/ntp_timer.c
+++ b/ntpd/ntp_timer.c
@@ -82,8 +82,8 @@ u_long	orphwait; 		/* orphan wait time */
 #ifdef AUTOKEY
 static	u_long revoke_timer;	/* keys revoke timer */
 static	u_long keys_timer;	/* session key timer */
-u_long	sys_revoke = KEY_REVOKE; /* keys revoke timeout (log2 s) */
-u_long	sys_automax = NTP_AUTOMAX; /* key list timeout (log2 s) */
+u_char	sys_revoke = KEY_REVOKE; /* keys revoke timeout (log2 s) */
+u_char	sys_automax = NTP_AUTOMAX; /* key list timeout (log2 s) */
 #endif	/* AUTOKEY */
 
 /*
@@ -404,7 +404,7 @@ timer(void)
 	 * Garbage collect expired keys.
 	 */
 	if (keys_timer <= current_time) {
-		keys_timer += 1 << sys_automax;
+		keys_timer += (1UL << sys_automax);
 		auth_agekeys();
 	}
 
@@ -413,7 +413,7 @@ timer(void)
 	 * to regenerate cookies.
 	 */
 	if (revoke_timer && revoke_timer <= current_time) {
-		revoke_timer += 1 << sys_revoke;
+		revoke_timer += (1UL << sys_revoke);
 		RAND_bytes((u_char *)&sys_private, 4);
 	}
 #endif	/* AUTOKEY */