[patch] ntpd rejects source UDP ports less than 123 as bogus

Bug #1479652 reported by Richard Laager on 2015-07-30
16
This bug affects 2 people
Affects Status Importance Assigned to Milestone
NTP
Fix Released
High
ntp (Debian)
Fix Released
Unknown
ntp (Ubuntu)
Medium
Kick In
Precise
Medium
Eric Desrochers
Trusty
Medium
Eric Desrochers
Wily
Medium
Eric Desrochers
Xenial
Medium
Kick In

Bug Description

[Impact]

If an NTP client sends a request with a source port less than 123, the packet is silently ignored by ntpd. This is occurring in our environment due to NAT.

[Development Fix]

Fixed by merge of NTP of newer upstream release that includes the fix. Stuck in dep-wait in xenial-proposed due to an unrelated issue (pps-tools MIR or other resolution).

[Test Case]

The problem can easily be reproduced by having an iptable postrouting nat forcing the source port to be under 123 set on the client.

Setup:
 ==> NTP server = y.y.y.y
 ntp.conf configured to be a server.

 ==> NTP client = x.x.x.x
 "ntpdate" used to submmit requests

 #iptable setup to force src port to be lower than 123
 iptables -t nat -A POSTROUTING -p UDP --dport 123 -j SNAT --to-source x.x.x.x:100-122

## On the client, set to force src port < 123 (without patch)

$ ntpdate y.y.y.y
ntpdate[<PID>]: no server suitable for synchronization found

## On the client, set to force src port < 123 (with patch)

$ ntpdate y.y.y.y
ntpdate[<PID>]: adjust time server y.y.y.y offset -0.028483 sec

[Regression Potential]

The patch comes from upstream: http://bugs.ntp.org/show_bug.cgi?id=2174

A testfix[1] package has been provided to the community before the SRU process to bring more confidence for the patch. Positive feedbacks has been given by the community to confirm the patch addressed the bug [comment #7]

[1]- https://launchpad.net/~slashd/+archive/ubuntu/bug1479652

[Original description]

[Title copied from Debian bug, which was not filed by me. Description below is mine.]

If an NTP client sends a request with a source port less than 123, the packet is silently ignored by ntpd. This is occurring in our environment due to NAT.

Attached is the patch already accepted upstream which fixes the issue. I've verified it fixes the problem. Debian has been ignoring this patch for almost 3 years. Can we get this in Ubuntu please?

Per Dave Hart, I'm filing this bug report to track an issue where NTP client packets on the inside of a Cisco IOS NAT box are dropped by ntpd on the outside of the Cisco IOS NAT box. This is due to IOS NAT using a low UDP source port ntp_proto.c tests against and blocks.

This was worked around per David's suggestion in the thread below, but it would be great if this would make it into mainline code.

http://groups.google.com/group/comp.protocols.time.ntp/msg/3024d073b914b278

Ready in ~hart/ntp-dev-2174

In , Stenn (stenn) wrote :

Jason,

Thanks for the report. Please check ntp-4.2.7p274 and mark this bug as VERIFIED or REOPENED, as appropriate.

Dave, thanks for your work on this.

Richard Laager (rlaager) wrote :
description: updated

The attachment "Patch from upstream, made suitable for debian/patches" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]

tags: added: patch
Changed in ntp:
importance: Unknown → High
status: Unknown → Fix Released
Changed in ntp (Debian):
status: Unknown → New
Robie Basak (racb) wrote :

According to the Debian bug, this was fixed upstream in 4.2.8p1 and Debian sid is now on 1:4.2.8p4+dfsg-3 so I think that means this is fixed in Debian. Ubuntu will pick it up on the next merge which I am expecting to be done this cycle.

Eric Desrochers (slashd) on 2016-01-22
Changed in ntp (Ubuntu Precise):
importance: Undecided → Medium
Changed in ntp (Ubuntu Trusty):
importance: Undecided → Medium
Changed in ntp (Ubuntu Wily):
importance: Undecided → Medium
Changed in ntp (Ubuntu Xenial):
importance: Undecided → Medium
Changed in ntp (Ubuntu Precise):
assignee: nobody → Eric Desrochers (slashd)
Changed in ntp (Ubuntu Trusty):
assignee: nobody → Eric Desrochers (slashd)
Changed in ntp (Ubuntu Wily):
assignee: nobody → Eric Desrochers (slashd)
Changed in ntp (Ubuntu Xenial):
assignee: nobody → Kick In (kick-d)
Eric Desrochers (slashd) on 2016-01-23
Changed in ntp (Ubuntu Xenial):
status: New → In Progress
Changed in ntp (Ubuntu Wily):
status: New → In Progress
Changed in ntp (Ubuntu Precise):
status: New → In Progress
Changed in ntp (Ubuntu Trusty):
status: New → In Progress
Eric Desrochers (slashd) wrote :

I have build a test package for the community to validate it solve the bug before starting the SRU process [1].
The goal of this testfix is only to confirm that this solve the bug and it is not a final solution.

Here's what has been brought to my attention about the test package I have provided.

---
I confirm that the proposed testfix package resolved the issue.

The test were made on test machines where the client had an iptable postrouting nat forcing the source port to be under 123.
- ntpdate command performed on the client machine was successful
- tcpdump on the server side confirmed that the source port was under 123.

Please advise for the next steps

Thank-you
---

[1] - https://launchpad.net/~slashd/+archive/ubuntu/bug1479652

Eric Desrochers (slashd) on 2016-01-25
description: updated
description: updated
description: updated
description: updated
Eric Desrochers (slashd) on 2016-01-25
tags: added: sts
Eric Desrochers (slashd) wrote :

Patch
--
Distribution : Trusty (14.04)
Package version : ntp_4.2.6.p5+dfsg-3ubuntu2.14.04.8
--

Note: kick-d is currently working on a merge for Xenial, including this patch.
I'm including the .debdiffs for the other distributions (W/T/P) for once the merge for Xenial will be completed.

Eric Desrochers (slashd) wrote :

Patch
--
Distribution : Wily (15.10)
Package version : 4.2.6.p5+dfsg-3ubuntu8.2
--

Eric Desrochers (slashd) wrote :

Patch
--
Distribution : Precise (12.04)
Package version : 4.2.6.p3+dfsg-1ubuntu3.9
--

Eric Desrochers (slashd) on 2016-01-25
description: updated
description: updated
Eric Desrochers (slashd) on 2016-01-25
description: updated
description: updated
Robie Basak (racb) wrote :

Thanks Eric, the debdiffs look good to me. I added Origin and Bug-Ubuntu dep3 headers as discussed on IRC. Apart from that I've uploaded all three unmodified. Now awaiting SRU team review.

description: updated
Changed in ntp (Ubuntu Xenial):
status: In Progress → Fix Committed

Hello Richard, or anyone else affected,

Accepted ntp into wily-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ntp/1:4.2.6.p5+dfsg-3ubuntu8.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in ntp (Ubuntu Wily):
status: In Progress → Fix Committed
tags: added: verification-needed
Changed in ntp (Ubuntu Trusty):
status: In Progress → Fix Committed
Brian Murray (brian-murray) wrote :

Hello Richard, or anyone else affected,

Accepted ntp into trusty-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ntp/1:4.2.6.p5+dfsg-3ubuntu2.14.04.8 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in ntp (Ubuntu Precise):
status: In Progress → Fix Committed
Brian Murray (brian-murray) wrote :

Hello Richard, or anyone else affected,

Accepted ntp into precise-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ntp/1:4.2.6.p3+dfsg-1ubuntu3.9 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Eric Desrochers (slashd) wrote :

It has been brought to my attention ...

--
I confirm that the proposed testfix package resolved the issue on Trusty.

The test were made on test machines where the client had an iptable postrouting nat forcing the source port to be under 123.
- ntpdate command performed on the client machine was successful
- tcpdump on the server side confirmed that the source port was under 123.
--

tags: added: verification-done
removed: verification-needed
tags: added: verification-done-trusty
removed: verification-done
tags: added: verification-done
removed: verification-done-trusty
Eric Desrochers (slashd) on 2016-02-11
tags: added: verification-done-trusty
removed: verification-done
Eric Desrochers (slashd) wrote :

I confirmed the package"4.2.6.p3+dfsg-1ubuntu3.9" solved the problem in Ubuntu Precise

NTP Version : 1:4.2.6.p3+dfsg-1ubuntu3.1

With no IPTABLES rule ==> Working
$ ntpdate x.x.x.x
11 Feb 16:15:19 ntpdate[1243]: adjust time server x.x.x.x offset 0.190571 sec

With IPTABLES rule ==> Not working
$ iptables -t nat -A POSTROUTING -p UDP --dport 123 -j SNAT --to-source y.y.y.y:100-122

$ntpdate x.x.x.x
11 Feb 16:15:36 ntpdate[1253]: no server suitable for synchronization found

With ntp (precise-proposed) + IPTABLE rules ==> Now working

NTP version: 1:4.2.6.p3+dfsg-1ubuntu3.9

$ iptables -t nat -A POSTROUTING -p UDP --dport 123 -j SNAT --to-source y.y.y.y:100-122

$ ntpdate x.x.x.x
11 Feb 16:21:26 ntpdate[1986]: adjust time server x.x.x.x offset 0.005394 sec

Eric

tags: added: verification-done-precise
Eric Desrochers (slashd) wrote :

I confirmed the package "4.2.6.p5+dfsg-3ubuntu8.2" solve the bug in Ubuntu Wily

# With port <123 using ntpdate (without patch)
11 Feb 20:30:09 ntpdate[2348]: no server suitable for synchronization found

# With port <123 using ntpdate (including patch)
11 Feb 20:32:18 ntpdate[3243]: adjust time server 10.10.10.107 offset 0.002017 sec

Eric

tags: added: verification-done-wily
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package ntp - 1:4.2.6.p5+dfsg-3ubuntu2.14.04.8

---------------
ntp (1:4.2.6.p5+dfsg-3ubuntu2.14.04.8) trusty; urgency=medium

  * ntpd rejects source UDP ports less than 123 as bogus (closes: #691412)
    - d/p/reject-UDP-ports-less-than-123-as-bogus.patch (LP: #1479652)

 -- Eric Desrochers <email address hidden> Mon, 25 Jan 2016 11:39:44 -0500

Changed in ntp (Ubuntu Trusty):
status: Fix Committed → Fix Released

The verification of the Stable Release Update for ntp has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

Launchpad Janitor (janitor) wrote :

This bug was fixed in the package ntp - 1:4.2.6.p5+dfsg-3ubuntu8.2

---------------
ntp (1:4.2.6.p5+dfsg-3ubuntu8.2) wily; urgency=medium

  * ntpd rejects source UDP ports less than 123 as bogus (closes: #691412)
    - d/p/reject-UDP-ports-less-than-123-as-bogus.patch (LP: #1479652)

 -- Eric Desrochers <email address hidden> Mon, 25 Jan 2016 12:05:25 -0500

Changed in ntp (Ubuntu Wily):
status: Fix Committed → Fix Released
Launchpad Janitor (janitor) wrote :
Download full text (4.1 KiB)

This bug was fixed in the package ntp - 1:4.2.8p4+dfsg-3ubuntu1

---------------
ntp (1:4.2.8p4+dfsg-3ubuntu1) xenial; urgency=medium

  * Merge from Debian testing. Remaining changes:
    + debian/rules: enable debugging. Ask debian to add this.
    + debian/rules, debian/ntp.dirs, debian/source_ntp.py: Add apport hook.
    + Add enforcing AppArmor profile:
      - debian/control: Add Conflicts/Replaces on apparmor-profiles.
      - debian/control: Add Suggests on apparmor.
      - debian/control: Build-Depends on dh-apparmor.
      - add debian/apparmor-profile*.
      - debian/ntp.dirs: Add apparmor directories.
      - debian/rules: Install apparmor-profile and apparmor-profile.tunable.
      - debian/source_ntp.py: Add filter on AppArmor profile names to prevent
        false positives from denials originating in other packages.
      - debian/README.Debian: Add note on AppArmor.
    + debian/ntpdate.if-up: Fix interaction with openntpd. Stop ntp before
      running ntpdate when an interface comes up, then start again afterwards.
    + debian/ntp.init, debian/rules: Only stop when entering single user mode,
      don't use /var/lib/ntp/ntp.conf.dhcp if /etc/ntp.conf is newer - it can
      get stale. Patch by Simon Déziel.
    + debian/ntp.conf, debian/ntpdate.default: Change default server to
      ntp.ubuntu.com.
    + debian/control: Add bison to Build-Depends (for ntpd/ntp_parser.y).
  * Includes fix for requests with source ports < 123, fixed upstream in
    4.2.8p1 (LP: #1479652).
  * Add PPS support (LP: #1512980):
    + debian/README.Debian: Add a PPS section to the README.Debian,
      removed all PPSkit one.
    + debian/ntp.conf: Add some configuration examples from the offical
      documentation.
    + debian/control: Add Build-Depends on pps-tools
  * Drop Changes:
    + debian/rules: Update config.{guess,sub} for AArch64, because upstream use
      dh_autoreconf now.
    + debian/{control,rules}: Add and enable hardened build for PIE.
      Upstream use fPIC. Options -fPIC and -fPIE are uncompatible, thus this is
      never applied, (cf. dpkg-buildflags manual), checked with Marc
      Deslauriers on freenode #ubuntu-hardened, 2016-01-20~13:11 UTC.
    + debian/rules: Remove update-rcd-params in dh_installinit command. When
      setting up ntp package, the following message is presented to the user
      due to deprecated use:
      "update-rc.d: warning: start and stop actions are no longer
      supported; falling back to defaults". The defaults are taken from the
      init.d script LSB comment header, which contain what we need anyway.
    + debian/rules: Remove ntp/ntp_parser.{c,h} or they don't get properly
      regenerated for some reason. Seems to have been due to ntpd/ntp_parser.y
      patches from CVE-2015-5194 and CVE-2015-5196, already upstreamed.
    + debian/ntpdate.if-up: Drop lockfile mechanism as upstream is using flock
      now.
    + Remove natty timeframe old deltas (transitional code not needed since
      Trusty): Those patches were for an incorrect behaviour of
      system-tools-backend, around natty time
      (https://bugs.launchpad.net/ubuntu/+source/ntp/+bug/83604/comments/23)
      - debi...

Read more...

Changed in ntp (Ubuntu Xenial):
status: Fix Committed → Fix Released
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package ntp - 1:4.2.6.p3+dfsg-1ubuntu3.9

---------------
ntp (1:4.2.6.p3+dfsg-1ubuntu3.9) precise; urgency=medium

  * ntpd rejects source UDP ports less than 123 as bogus (closes: #691412)
    - d/p/reject-UDP-ports-less-than-123-as-bogus.patch (LP: #1479652)

 -- Eric Desrochers <email address hidden> Mon, 25 Jan 2016 12:28:25 -0500

Changed in ntp (Ubuntu Precise):
status: Fix Committed → Fix Released
Changed in ntp (Debian):
status: New → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.