diff options
author | delphij <delphij@FreeBSD.org> | 2016-12-22 16:19:05 +0000 |
---|---|---|
committer | delphij <delphij@FreeBSD.org> | 2016-12-22 16:19:05 +0000 |
commit | d0a626af58b2092996e20b0bcb07067a6f709539 (patch) | |
tree | 7565ae572473ac8f7ef771e6ea2ed0eec9799fb9 /contrib/ntp/include | |
parent | b416700da72fd8eab0a75d60f0634e254cbb9347 (diff) | |
download | FreeBSD-src-d0a626af58b2092996e20b0bcb07067a6f709539.zip FreeBSD-src-d0a626af58b2092996e20b0bcb07067a6f709539.tar.gz |
Fix multiple vulnerabilities of ntp.
Approved by: so
Diffstat (limited to 'contrib/ntp/include')
-rw-r--r-- | contrib/ntp/include/Makefile.am | 1 | ||||
-rw-r--r-- | contrib/ntp/include/Makefile.in | 1 | ||||
-rw-r--r-- | contrib/ntp/include/libssl_compat.h | 100 | ||||
-rw-r--r-- | contrib/ntp/include/ntp.h | 10 | ||||
-rw-r--r-- | contrib/ntp/include/ntp_intres.h | 6 | ||||
-rw-r--r-- | contrib/ntp/include/ntpd.h | 1 |
6 files changed, 114 insertions, 5 deletions
diff --git a/contrib/ntp/include/Makefile.am b/contrib/ntp/include/Makefile.am index 521ac14..749a0c8 100644 --- a/contrib/ntp/include/Makefile.am +++ b/contrib/ntp/include/Makefile.am @@ -16,6 +16,7 @@ noinst_HEADERS = \ intreswork.h \ iosignal.h \ l_stdlib.h \ + libssl_compat.h \ lib_strbuf.h \ libntp.h \ mbg_gps166.h \ diff --git a/contrib/ntp/include/Makefile.in b/contrib/ntp/include/Makefile.in index ef92804..acd3bb5 100644 --- a/contrib/ntp/include/Makefile.in +++ b/contrib/ntp/include/Makefile.in @@ -501,6 +501,7 @@ noinst_HEADERS = \ intreswork.h \ iosignal.h \ l_stdlib.h \ + libssl_compat.h \ lib_strbuf.h \ libntp.h \ mbg_gps166.h \ diff --git a/contrib/ntp/include/libssl_compat.h b/contrib/ntp/include/libssl_compat.h new file mode 100644 index 0000000..a8938a1 --- /dev/null +++ b/contrib/ntp/include/libssl_compat.h @@ -0,0 +1,100 @@ +/* + * libssl_compat.h -- OpenSSL v1.1 compatibility shims + * + * --------------------------------------------------------------------- + * + * Written by Juergen Perlinger <perlinger@ntp.org> for the NTP project + * + * Based on an idea by Kurt Roeckx <kurt@roeckx.be> + * + * --------------------------------------------------------------------- + * This is a clean room implementation of shim functions that have + * counterparts in the OpenSSL v1.1 API but not in earlier versions. + * + * If the OpenSSL version used for compilation needs the shims (that is, + * does not provide the new functions) the names of these functions are + * redirected to our shims. + * --------------------------------------------------------------------- + */ + +#ifndef NTP_LIBSSL_COMPAT_H +#define NTP_LIBSSL_COMPAT_H + +#include "openssl/evp.h" +#include "openssl/dsa.h" +#include "openssl/rsa.h" + +/* ----------------------------------------------------------------- */ +#if OPENSSL_VERSION_NUMBER < 0x10100000L +/* ----------------------------------------------------------------- */ + +# include <openssl/objects.h> +# include <openssl/x509.h> + +/* shim the new-style API on an old-style OpenSSL */ + +extern BN_GENCB* sslshimBN_GENCB_new(void); +extern void sslshimBN_GENCB_free(BN_GENCB*); + +extern EVP_MD_CTX* sslshim_EVP_MD_CTX_new(void); +extern void sslshim_EVP_MD_CTX_free(EVP_MD_CTX *ctx); + +extern int sslshim_EVP_PKEY_id(const EVP_PKEY * pkey); +extern int sslshim_EVP_PKEY_base_id(const EVP_PKEY * pkey); +extern RSA* sslshim_EVP_PKEY_get0_RSA(EVP_PKEY * pkey); +extern DSA* sslshim_EVP_PKEY_get0_DSA(EVP_PKEY * pkey); + +extern void sslshim_RSA_get0_key(const RSA *prsa, const BIGNUM **pn, + const BIGNUM **pe, const BIGNUM **pd); +extern int sslshim_RSA_set0_key(RSA *prsa, BIGNUM *n, + BIGNUM *e, BIGNUM *d); +extern void sslshim_RSA_get0_factors(const RSA *prsa, const BIGNUM **pp, + const BIGNUM **pq); +extern int sslshim_RSA_set0_factors(RSA *prsar, BIGNUM *p, BIGNUM *q); +extern int sslshim_RSA_set0_crt_params(RSA *prsa, BIGNUM *dmp1, + BIGNUM *dmq1, BIGNUM *iqmp); + +extern void sslshim_DSA_SIG_get0(const DSA_SIG *psig, const BIGNUM **pr, + const BIGNUM **ps); +extern int sslshim_DSA_SIG_set0(DSA_SIG *psig, BIGNUM *r, BIGNUM *s); +extern void sslshim_DSA_get0_pqg(const DSA *pdsa, const BIGNUM **pp, + const BIGNUM **pq, const BIGNUM **pg); +extern int sslshim_DSA_set0_pqg(DSA *pdsa, BIGNUM *p, BIGNUM *q, BIGNUM *g); +extern void sslshim_DSA_get0_key(const DSA *pdsa, const BIGNUM **ppub_key, + const BIGNUM **ppriv_key); +extern int sslshim_DSA_set0_key(DSA *pdsa, BIGNUM *pub_key, + BIGNUM *priv_key); + +extern int sslshim_X509_get_signature_nid(const X509 *x); + +#define BN_GENCB_new sslshimBN_GENCB_new +#define BN_GENCB_free sslshimBN_GENCB_free + +#define EVP_MD_CTX_new sslshim_EVP_MD_CTX_new +#define EVP_MD_CTX_free sslshim_EVP_MD_CTX_free + +#define EVP_PKEY_id sslshim_EVP_PKEY_id +#define EVP_PKEY_base_id sslshim_EVP_PKEY_base_id +#define EVP_PKEY_get0_RSA sslshim_EVP_PKEY_get0_RSA +#define EVP_PKEY_get0_DSA sslshim_EVP_PKEY_get0_DSA + +#define RSA_get0_key sslshim_RSA_get0_key +#define RSA_set0_key sslshim_RSA_set0_key +#define RSA_get0_factors sslshim_RSA_get0_factors +#define RSA_set0_factors sslshim_RSA_set0_factors +#define RSA_set0_crt_params sslshim_RSA_set0_crt_params + +#define DSA_SIG_get0 sslshim_DSA_SIG_get0 +#define DSA_SIG_set0 sslshim_DSA_SIG_set0 +#define DSA_get0_pqg sslshim_DSA_get0_pqg +#define DSA_set0_pqg sslshim_DSA_set0_pqg +#define DSA_get0_key sslshim_DSA_get0_key +#define DSA_set0_key sslshim_DSA_set0_key + +#define X509_get_signature_nid sslshim_X509_get_signature_nid + +/* ----------------------------------------------------------------- */ +#endif /* OPENSSL_VERSION_NUMBER < v1.1.0 */ +/* ----------------------------------------------------------------- */ + +#endif /* NTP_LIBSSL_COMPAT_H */ diff --git a/contrib/ntp/include/ntp.h b/contrib/ntp/include/ntp.h index 84c30d9..323135d 100644 --- a/contrib/ntp/include/ntp.h +++ b/contrib/ntp/include/ntp.h @@ -391,7 +391,7 @@ struct peer { * Statistic counters */ u_long timereset; /* time stat counters were reset */ - u_long timelastrec; /* last packet received time */ + u_long timelastrec; /* last packet received time, incl. trash */ u_long timereceived; /* last (clean) packet received time */ u_long timereachable; /* last reachable/unreachable time */ @@ -419,8 +419,7 @@ struct peer { * MODE_BROADCAST and MODE_BCLIENT appear in the transition * function. MODE_CONTROL and MODE_PRIVATE can appear in packets, * but those never survive to the transition function. - * is a -/ */ + */ #define MODE_UNSPEC 0 /* unspecified (old version) */ #define MODE_ACTIVE 1 /* symmetric active mode */ #define MODE_PASSIVE 2 /* symmetric passive mode */ @@ -433,7 +432,7 @@ struct peer { #define MODE_CONTROL 6 /* control mode */ #define MODE_PRIVATE 7 /* private mode */ /* - * This is a madeup mode for broadcast client. + * This is a made-up mode for broadcast client. */ #define MODE_BCLIENT 6 /* broadcast client mode */ @@ -724,6 +723,7 @@ struct pkt { #define PROTO_UECRYPTONAK 30 #define PROTO_UEDIGEST 31 #define PROTO_PCEDIGEST 32 +#define PROTO_BCPOLLBSTEP 33 /* * Configuration items for the loop filter @@ -731,7 +731,7 @@ struct pkt { #define LOOP_DRIFTINIT 1 /* iniitialize frequency */ #define LOOP_KERN_CLEAR 2 /* set initial frequency offset */ #define LOOP_MAX 3 /* set both step offsets */ -#define LOOP_MAX_BACK 4 /* set bacward-step offset */ +#define LOOP_MAX_BACK 4 /* set backward-step offset */ #define LOOP_MAX_FWD 5 /* set forward-step offset */ #define LOOP_PANIC 6 /* set panic offseet */ #define LOOP_PHI 7 /* set dispersion rate */ diff --git a/contrib/ntp/include/ntp_intres.h b/contrib/ntp/include/ntp_intres.h index 1b6bd66..1109130 100644 --- a/contrib/ntp/include/ntp_intres.h +++ b/contrib/ntp/include/ntp_intres.h @@ -9,6 +9,9 @@ #ifdef WORKER #define INITIAL_DNS_RETRY 2 /* seconds between queries */ +/* flags for extended addrinfo version */ +#define GAIR_F_IGNDNSERR 0x0001 /* ignore DNS errors */ + /* * you call getaddrinfo_sometime(name, service, &hints, retry, callback_func, context); * later (*callback_func)(rescode, gai_errno, context, name, service, hints, ai_result) is called. @@ -19,6 +22,9 @@ typedef void (*gai_sometime_callback) extern int getaddrinfo_sometime(const char *, const char *, const struct addrinfo *, int, gai_sometime_callback, void *); +extern int getaddrinfo_sometime_ex(const char *, const char *, + const struct addrinfo *, int, + gai_sometime_callback, void *, u_int); /* * In gai_sometime_callback routines, the resulting addrinfo list is * only available until the callback returns. To hold on to the list diff --git a/contrib/ntp/include/ntpd.h b/contrib/ntp/include/ntpd.h index 362068c..1f33bf4 100644 --- a/contrib/ntp/include/ntpd.h +++ b/contrib/ntp/include/ntpd.h @@ -483,6 +483,7 @@ extern int sys_bclient; /* we set our time to broadcasts */ extern double sys_bdelay; /* broadcast client default delay */ extern int sys_authenticate; /* requre authentication for config */ extern l_fp sys_authdelay; /* authentication delay */ +extern u_char sys_bcpollbstep; /* broadcast poll backstep gate */ extern u_long sys_epoch; /* last clock update time */ extern keyid_t sys_private; /* private value for session seed */ extern int sys_manycastserver; /* respond to manycast client pkts */ |