[ntp:security] [Bug 2672] ::1 can be spoofed. ACLs based on source IP can be bypassed

bugzilla-daemon at ntp.org bugzilla-daemon at ntp.org
Tue Dec 16 15:35:18 UTC 2014


http://bugs.ntp.org/show_bug.cgi?id=2672

Danny Mayer <mayer at ntp.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |mayer at ntp.org

--- Comment #2 from Danny Mayer <mayer at ntp.org> 2014-12-16 15:35:18 UTC ---
(In reply to comment #1)
> Will it work to make sure that if we get a srcaddr/sockaddr of ::1 that the
> corresponding XXX.ifr_flags & IFF_LOOPBACK is "true"?

There's actually a simpler way to check. The packet cannot come in on the
loopback address since it has to come in from the outside. So the compare is to
check if the source address and the destination address are the same. I
wouldn't want to depend on the flags.

-- 
Configure bugmail: http://bugs.ntp.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.


More information about the security mailing list