Attachment 206377 Details for Bug 239724 – ping(8) patch

[patch] ping(8) patch

0001-ping-8-Randomize-the-ICMP-timestamps-to-prevent-a-po.patch (text/plain), 2.56 KB, created by Gordon Bergling on 2019-08-08 19:13:30 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Gordon Bergling

Created: 2019-08-08 19:13:30 UTC

Size: 2.56 KB

patch

obsolete

>From 4c16e59cd89dd9dea43e8e3b37e76f94afe18f8e Mon Sep 17 00:00:00 2001
>From: Gordon Bergling <gbergling@googlemail.com>
>Date: Thu, 1 Aug 2019 10:50:25 +0200
>Subject: [PATCH] ping(8): Randomize the ICMP timestamps to prevent a possible
> information leak
>
>Inspired from: OpenBSD
>---
> sbin/ping/ping.c | 17 ++++++++++-------
> 1 file changed, 10 insertions(+), 7 deletions(-)
>
>diff --git a/sbin/ping/ping.c b/sbin/ping/ping.c
>index bca3f6ec9d5..c9a0d8588f8 100644
>--- a/sbin/ping/ping.c
>+++ b/sbin/ping/ping.c
>@@ -200,6 +200,7 @@ static double tmin = 999999999.0;	/* minimum round trip time */
> static double tmax = 0.0;	/* maximum round trip time */
> static double tsum = 0.0;	/* sum of all times, for doing average */
> static double tsumsq = 0.0;	/* sum of all times squared, for std. dev. */
>+struct tv32 tv32_offset;
> 
> /* nonzero if we've been told to finish up */
> static volatile sig_atomic_t finish_up;
>@@ -638,7 +639,7 @@ main(int argc, char *const *argv)
> 		for (i = TIMEVAL_LEN; i < datalen; ++i)
> 			*datap++ = i;
> 
>-	ident = getpid() & 0xFFFF;
>+	ident = arc4random() & 0xFFFF;
> 
> 	hold = 1;
> 	if (options & F_SO_DEBUG) {
>@@ -829,6 +830,8 @@ main(int argc, char *const *argv)
> 			(void)printf("PING %s: %d data bytes\n", hostname, datalen);
> 	}
> 
>+	arc4random_buf(&tv32_offset, sizeof(tv32_offset));
>+
> 	/*
> 	 * Use sigaction() instead of signal() to get unambiguous semantics,
> 	 * in particular with SA_RESTART not set.
>@@ -1029,11 +1032,11 @@ pinger(void)
> 	if ((options & F_TIME) || timing) {
> 		(void)gettimeofday(&now, NULL);
> 
>-		tv32.tv32_sec = htonl(now.tv_sec);
>-		tv32.tv32_usec = htonl(now.tv_usec);
>+		tv32.tv32_sec = htonl(now.tv_sec + tv32_offset.tv32_sec);
>+		tv32.tv32_usec = htonl(now.tv_usec + tv32_offset.tv32_usec);
> 		if (options & F_TIME)
>-			icp->icmp_otime = htonl((now.tv_sec % (24*60*60))
>-				* 1000 + now.tv_usec / 1000);
>+			icp->icmp_otime = htonl((now.tv_sec + tv32_offset.tv32_sec % (24*60*60))
>+				* 1000 + now.tv_usec + tv32_offset.tv32_usec / 1000);
> 		if (timing)
> 			bcopy((void *)&tv32,
> 			    (void *)&outpack[ICMP_MINLEN + phdr_len],
>@@ -1124,8 +1127,8 @@ pr_pack(char *buf, int cc, struct sockaddr_in *from, struct timeval *tv)
> 			    sizeof(tv1)) {
> 				/* Copy to avoid alignment problems: */
> 				memcpy(&tv32, tp, sizeof(tv32));
>-				tv1.tv_sec = ntohl(tv32.tv32_sec);
>-				tv1.tv_usec = ntohl(tv32.tv32_usec);
>+				tv1.tv_sec = ntohl(tv32.tv32_sec) - tv32_offset.tv32_sec;
>+				tv1.tv_usec = ntohl(tv32.tv32_usec) - tv32_offset.tv32_usec;
> 				tvsub(tv, &tv1);
>  				triptime = ((double)tv->tv_sec) * 1000.0 +
>  				    ((double)tv->tv_usec) / 1000.0;
>-- 
>2.22.0
>

Actions: View | Diff

Attachments on bug 239724: 206377