[ntp:security] NOEPEER patch

Martin Burnicki martin.burnicki at meinberg.de
Fri Aug 3 09:28:32 UTC 2018


Harlan,

Harlan Stenn wrote:
> On 8/3/2018 12:51 AM, Martin Burnicki wrote:
>> bk annotate says the FLAG_SKEY check has been introduced by Pearly,
>> probably with autokey in mind. Pearly, do you think it's OK to remove
>> this check, like I did?
> 
> I don't think that's what we want.
> 
> Before Pearly's change, the code was:
> 
>   if (   peer
>       && (peer->keyid > 0 || peer->flags & FLAG_SKEY))
> 	return VALIDNAK;
> 
> and now it is:
> 
>   if (!peer || !peer->keyid || !(peer->flags & FLAG_SKEY)
> 	return INVALIDNAK;
> 
> and I think we want:
> 
>   if (!peer || (!peer->keyid && !(peer->flags & FLAG_SKEY))
> 	return INVALIDNAK;

The fact that the FLAG_SKEY test has been in the code before Pearly's
change doesn't necessarily mean that the test is correct, and required.

Similar to the MODE_ACTIVE reply in this case instead of a MODE_PASSIVE
reply that would be expected, even according to Dave.

So *why* is FLAG_SKEY tested here? If a packet with an invalid/unknown
key was received then it should make no difference if the *key* was a
symmetric one, or an autokey one.

Martin
-- 
Martin Burnicki

Senior Software Engineer

MEINBERG Funkuhren GmbH & Co. KG
Email: martin.burnicki at meinberg.de
Phone: +49 5281 9309-414
Linkedin: https://www.linkedin.com/in/martinburnicki/

Lange Wand 9, 31812 Bad Pyrmont, Germany
Amtsgericht Hannover 17HRA 100322
Geschäftsführer/Managing Directors: Günter Meinberg, Werner Meinberg,
Andre Hartmann, Heiko Gerstung
Websites: https://www.meinberg.de  https://www.meinbergglobal.com
Training: https://www.meinberg.academy



More information about the security mailing list