NTP Authenticator still broken
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 12.6k
- Forks
- 2.2k
- Avg merge
- 1d 4h
- Merged PRs (30d)
- 56
Description
Brief description
Issue #2731 does not seem to be fixed.
Environment
- Scapy version:
2.4.4. - Python version:
3.8.0 - Operating System:
Windows
How to reproduce
Use NTP packet capture with NTP Version 4 packets using SHA1, SHA256, SHA512 message authentication (produced by chrony or ntpd NTP server.)
Use show() command to parse packet.
Actual result
###[ UDP ]###
sport= ntp
dport= ntp
len= 80
chksum= 0xdb3b
###[ NTPHeader ]###
leap= unknown (clock unsynchronized)
version= 4
mode= client
stratum= 0
poll= 6
precision= 232
delay= 0.0
dispersion= 0.0
ref_id= b'INIT'
ref= 0.0
orig= 0.0
recv= 0.0
sent= Tue, 02 Jun 2020 23:37:12 +0000
###[ Authenticator ]###
padding= '\x00\x00\x00\x0c'
key_id= 3523582088
dgst= b4a2adc11d2dbd1420a43560bf92c6f9
Expected result
###[ UDP ]###
sport= ntp
dport= ntp
len= 80
chksum= 0xdb3b
###[ NTPHeader ]###
leap= unknown (clock unsynchronized)
version= 4
mode= client
stratum= 0
poll= 6
precision= 232
delay= 0.0
dispersion= 0.0
ref_id= b'INIT'
ref= 0.0
orig= 0.0
recv= 0.0
sent= Tue, 02 Jun 2020 23:37:12 +0000
###[ Authenticator ]###
padding= '\x00\x00\x00'
key_id= 12
dgst= d2059888b4a2adc11d2dbd1420a43560bf92c6f9
key ID was included into the padding and portion of digest was incorrectly identified as key id.
Related resources
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Begin with the NTP Version 4 packet path exercised by the show() command, focusing on how the Authenticator fields are parsed for SHA1, SHA256, and SHA512 captures. Reproduce the Windows/Python 3.8 example and compare the parsed padding, key_id, and dgst with the expected output; done means the key ID is no longer taken from the digest and the authenticator fields match.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- networking
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100