[chrony-dev] 'Bug/Implementation' fix for v3 NTP client using 'authentication' with key id == 0

[Jan Vanhercke <jan.vanhercke@xxxxxxxx>]

Hi,

Since we switched from ntpd to chrony 4.6.1, some of our appliances 
could no longer sync.

After some debugging we discovered that these clients are using v3 NTP 
with authentication, but using a key id == 0, although the RFC specifies 
that the key id must be greater than 1.

I could not find a clear stipulation of what must be done with a packet 
having key id == 0. The pseudo seems to imply it must be calculated and 
the hash verified, but since the key id should not exist, what should 
the output of the hash then be?

Anyhow the appliances we use expect no authentication occur. Since we 
really wanted to switch to chrony we implemented a patch that reverts to 
no authentication when the keyid == 0 to cover this gray zone.

The fix works and has been put in production. Hopefully this can be 
incorporated in the mainline.

Below is de diff of our code against git tag 4.6.1:

diff --git a/ntp_core.c b/ntp_core.c
index 2965413..2cc98e7 100644
--- a/ntp_core.c
+++ b/ntp_core.c
@@ -1586,11 +1586,11 @@ parse_packet(NTP_Packet *packet, int length, 
NTP_PacketInfo *info)

     /* Check if it is an MS-SNTP authenticator field or extended 
authenticator
        field with zeroes as digest */
-    if (info->version == 3 && info->auth.mac.key_id != 0) {
+    if (info->version == 3) {
       if (remainder == 20 && is_zero_data(data + parsed + 4, remainder 
- 4))
-        info->auth.mode = NTP_AUTH_MSSNTP;
+        info->auth.mode = (info->auth.mac.key_id != 0) ? 
NTP_AUTH_MSSNTP : NTP_AUTH_NONE;
       else if (remainder == 72 && is_zero_data(data + parsed + 8, 
remainder - 8))
-        info->auth.mode = NTP_AUTH_MSSNTP_EXT;
+        info->auth.mode = (info->auth.mac.key_id != 0) ? 
NTP_AUTH_MSSNTP_EXT : NTP_AUTH_NONE;
     }

     return 1;


--
To unsubscribe email chrony-dev-request@xxxxxxxxxxxxxxxxxxxx with "unsubscribe" in the subject.
For help email chrony-dev-request@xxxxxxxxxxxxxxxxxxxx with "help" in the subject.
Trouble?  Email listmaster@xxxxxxxxxxxxxxxxxxxx.