dba458d50c
To prevent an attacker using chronyd in an amplification attack, change the protocol to include padding in request packets so that the largest possible reply is not larger than the request. Request packets that don't include this padding are ignored as invalid. This is an incompatible change in the protocol. Clients from chrony 1.27, 1.28 and 1.29 will receive NULL reply with STT_BADPKTVERSION and print "Protocol version mismatch". Clients from 1.26 and older will not receive a reply as it would be larger than the request if it was padded to be compatible with their protocol.
40 lines
1.3 KiB
C
40 lines
1.3 KiB
C
/*
|
|
chronyd/chronyc - Programs for keeping computer clocks accurate.
|
|
|
|
**********************************************************************
|
|
* Copyright (C) Richard P. Curnow 1997-2002
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of version 2 of the GNU General Public License as
|
|
* published by the Free Software Foundation.
|
|
*
|
|
* This program is distributed in the hope that it will be useful, but
|
|
* WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
* General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License along
|
|
* with this program; if not, write to the Free Software Foundation, Inc.,
|
|
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
|
|
*
|
|
**********************************************************************
|
|
|
|
=======================================================================
|
|
|
|
Header for pktlength.c, routines for working out the expected length
|
|
of a network command/reply packet.
|
|
|
|
*/
|
|
|
|
#ifndef GOT_PKTLENGTH_H
|
|
#define GOT_PKTLENGTH_H
|
|
|
|
#include "candm.h"
|
|
|
|
extern int PKL_CommandLength(CMD_Request *r);
|
|
|
|
extern int PKL_CommandPaddingLength(CMD_Request *r);
|
|
|
|
extern int PKL_ReplyLength(CMD_Reply *r);
|
|
|
|
#endif /* GOT_PKTLENGTH_H */
|