faraphel/chrony
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

nts: reset NAK indicator with new request

Browse source 
Don't restart NTS-KE if a spoofed NAK response was received and no valid
response is received for a subsequent request.
This commit is contained in:
Miroslav Lichvar 2020-07-20 16:31:49 +02:00
parent fd8fbcd090
commit cc20ead3dc
3 changed files with 7 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
doc/chronyc.adoc
View file

@ -599,8 +599,8 @@ This column shows the number of attempts to perform the key establishment since
the last successful key establishment. A number larger than 1 indicates a the last successful key establishment. A number larger than 1 indicates a
problem with the network or server. problem with the network or server.
*NAK*::: *NAK*:::
This column shows whether an NTS NAK was received since the last authenticated This column shows whether an NTS NAK was received since the last request.
response. A NAK indicates that authentication failed on the server side due to A NAK indicates that authentication failed on the server side due to
*chronyd* using a cookie which is no longer valid and that it needs to perform *chronyd* using a cookie which is no longer valid and that it needs to perform
the key establishment again in order to get new cookies. the key establishment again in order to get new cookies.
*Cook*::: *Cook*:::

1
nts_ntp_client.c
View file

@ -335,6 +335,7 @@ NNC_GenerateRequestAuth(NNC_Instance inst, NTP_Packet *packet,
inst->num_cookies--; inst->num_cookies--;
inst->cookie_index = (inst->cookie_index + 1) % NTS_MAX_COOKIES; inst->cookie_index = (inst->cookie_index + 1) % NTS_MAX_COOKIES;
inst->nak_response = 0;
inst->ok_response = 0; inst->ok_response = 0;
return 1; return 1;

6
test/unit/nts_ntp_client.c
View file

@ -82,9 +82,11 @@ get_request(NNC_Instance inst)
info.mode = MODE_CLIENT; info.mode = MODE_CLIENT;
info.length = random() % (sizeof (packet) + 1); info.length = random() % (sizeof (packet) + 1);
inst->num_cookies = 0; if (inst->num_cookies > 0 && random() % 2) {
inst->num_cookies = 0;
TEST_CHECK(!NNC_GenerateRequestAuth(inst, &packet, &info)); TEST_CHECK(!NNC_GenerateRequestAuth(inst, &packet, &info));
}
while (!NNC_PrepareForAuth(inst)) { while (!NNC_PrepareForAuth(inst)) {
inst->next_nke_attempt = SCH_GetLastEventMonoTime() + random() % 10 - 7; inst->next_nke_attempt = SCH_GetLastEventMonoTime() + random() % 10 - 7;