Project

General

Profile

Actions

Bug #11850

closed

NTP authentication input validation rejects valid keys

Added by Thomas Paetzold about 3 years ago. Updated almost 3 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Viktor Gurov
Category:
NTPD
Target version:
Start date:
04/24/2021
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
21.05
Release Notes:
Default
Affected Version:
2.5.0
Affected Architecture:
All

Description

I run into issues with the "Enable NTPv3 authentication (RFC 1305)" and more precisely whit entering a valit SHA-1 key.

According to "https://github.com/pfsense/pfsense/blob/master/src/usr/local/www/*services_ntpd.php*" following condition is coded:

elseif (($pconfig['serverauthalgo'] == 'sha1') && ((strlen(base64_decode($pconfig['serverauthkey'])) != 40) ||
!ctype_xdigit($pconfig['serverauthkey']))) {
$input_errors[] = gettext("The supplied value for NTP Authentication key for SHA1 digest must be hex-encoded string of 40 characters.");

Thus as soon as either (strlen(base64_decode($pconfig['serverauthkey'])) != 40) OR !ctype_xdigit($pconfig['serverauthkey']) the key is not accepted by pfSense. Obviously a base64 decoded 40 character long hex string will fail such check. And in case it would be base64 encoded string it would fail the !ctype_xdigit($pconfig['serverauthkey']) check. Thus it seems difficult to enter any valid key (?)

Assuming my key is:
$ echo '*094c533b614d9e4bcb6e18a97a7b0e4d459025bd*' | base64
MDk0YzUzM2I2MTRkOWU0YmNiNmUxOGE5N2E3YjBlNGQ0NTkwMjViZAo=

and other try:

$ echo '094c533b614d9e4bcb6e18a97a7b0e4d459025bd' | base64 --decode
���}��^��q���ƽ�������tۖ�

So what ever I insert - it ends up in:

The following input errors were detected:

The supplied value for NTP Authentication key for SHA1 digest must be hex-encoded string of 40 characters.
Actions #1

Updated by Viktor Gurov almost 3 years ago

  • Target version deleted (21.05)
  • Affected Version set to 2.5.0

An MD5 key is a string of 20 random printable ASCII characters,
while a SHA key is a string of 40 random hex digits.
from https://www.freebsd.org/cgi/man.cgi?query=ntp-keygen&apropos=0&sektion=8&manpath=FreeBSD+11-current&format=html

fix:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/224

Actions #2

Updated by Jim Pingle almost 3 years ago

  • Status changed from New to Pull Request Review
  • Target version set to 2.6.0
Actions #3

Updated by Jim Pingle almost 3 years ago

  • Status changed from Pull Request Review to Feedback

PR was merged yesterday.

Actions #4

Updated by Jim Pingle almost 3 years ago

  • Plus Target Version set to 21.05
Actions #5

Updated by Jim Pingle almost 3 years ago

Already in 21.05 branch.

Actions #6

Updated by Jim Pingle almost 3 years ago

  • Subject changed from NTP Authentication key for SHA1 digest to NTP authentication input validation rejects valid keys

Updating subject for release notes.

Actions #7

Updated by Thomas Paetzold almost 3 years ago

Jim Pingle wrote:

Updating subject for release notes.

As I'm still on the 21.02.2-RELEASE (amd64) - when could I expect the 21.05 to be rolled out?

Actions #8

Updated by Jim Pingle almost 3 years ago

  • Target version changed from 2.6.0 to 2.5.2
Actions #9

Updated by Jim Pingle almost 3 years ago

  • Category changed from Authentication to NTPD
Actions #10

Updated by Jim Pingle almost 3 years ago

  • Status changed from Feedback to Closed
Actions #11

Updated by Renato Botelho almost 3 years ago

  • Assignee set to Viktor Gurov
Actions #12

Updated by Thomas Paetzold almost 3 years ago

Thanks the effort made.
Just want to confirm: in 21.05-RELEASE it works now as expected.

Actions

Also available in: Atom PDF