The timed protocol is not implemented in a compatible way by all vendors;

the size of the tsp_name field is OS-dependent.  4.3BSD used a 32-byte
field, FreeBSD uses MAXHOSTNAMELEN and RedHat apparently uses a 64-byte
field.  As a result, sanity checking code added a few months ago to detect
short packets will fail when interoperating with one of these other vendors.

Change the short packet detection code to expect a minimum packet size
corresponding to the 4.3BSD implementation, which should be a safe minimum
size.

Submitted by:	Stephen Whiteley <stevew@best.com> (based on)
PR:		misc/29867

2 files changed, 23 insertions, 7 deletions

diff --git a/usr.sbin/timed/timed/readmsg.c b/usr.sbin/timed/timed/readmsg.c
index cca415e..3af91f5 100644
--- a/usr.sbin/timed/timed/readmsg.c
+++ b/usr.sbin/timed/timed/readmsg.c
@@ -212,10 +212,15 @@ again:
 			syslog(LOG_ERR, "recvfrom: %m");
 			exit(1);
 		}
-		if (n < (ssize_t)sizeof(struct tsp)) {
+		/*
+		 * The 4.3BSD protocol spec had a 32-byte tsp_name field, and
+		 * this is still OS-dependent.  Demand that the packet is at
+		 * least long enough to hold a 4.3BSD packet.
+		 */
+		if (n < (ssize_t)(sizeof(struct tsp) - MAXHOSTNAMELEN + 32)) {
 			syslog(LOG_NOTICE,
 			    "short packet (%u/%u bytes) from %s",
-			      n, sizeof(struct tsp),
+			      n, sizeof(struct tsp) - MAXHOSTNAMELEN + 32,
 			      inet_ntoa(from.sin_addr));
 			continue;
 		}
diff --git a/usr.sbin/timed/timedc/cmds.c b/usr.sbin/timed/timedc/cmds.c
index 21a5a04..b1c9c7c 100644
--- a/usr.sbin/timed/timedc/cmds.c
+++ b/usr.sbin/timed/timedc/cmds.c
@@ -332,10 +332,15 @@ msite(argc, argv)
 				warn("recvfrom");
 				continue;
 			}
-			if (cc < sizeof(struct tsp)) {
+			/*
+			 * The 4.3BSD protocol spec had a 32-byte tsp_name field, and
+			 * this is still OS-dependent.  Demand that the packet is at
+			 * least long enough to hold a 4.3BSD packet.
+			 */
+			if (cc < (sizeof(struct tsp) - MAXHOSTNAMELEN + 32)) {
 				fprintf(stderr, 
 				   "short packet (%u/%u bytes) from %s\n",
-				   cc, sizeof(struct tsp),
+				   cc, sizeof(struct tsp) - MAXHOSTNAMELEN + 32,
 				   inet_ntoa(from.sin_addr));
 				continue;
 			}
@@ -484,9 +489,15 @@ tracing(argc, argv)
 			warn("recvfrom");
 			return;
 		}
-		if (cc < sizeof(struct tsp)) {
-			fprintf(stderr, "short pack (%u/%u bytes) from %s\n",
-			   cc, sizeof(struct tsp), inet_ntoa(from.sin_addr));
+		/*
+		 * The 4.3BSD protocol spec had a 32-byte tsp_name field, and
+		 * this is still OS-dependent.  Demand that the packet is at
+		 * least long enough to hold a 4.3BSD packet.
+		 */
+		if (cc < (sizeof(struct tsp) - MAXHOSTNAMELEN + 32)) {
+			fprintf(stderr, "short packet (%u/%u bytes) from %s\n",
+			    cc, sizeof(struct tsp) - MAXHOSTNAMELEN + 32,
+			    inet_ntoa(from.sin_addr));
 			return;
 		}
 		bytehostorder(&msg);