summaryrefslogtreecommitdiff
path: root/usr.sbin/ntpd/ntpd.c
AgeCommit message (Collapse)Author
2019-11-11Also implement "trusted" for sensors; do not do constraint validationOtto Moerbeek
for these. ok deraadt@
2019-11-11Disable -s and -S functionality. -s would force time using NTP packets withoutTheo de Raadt
any MITM protection checks. We've had constraint checks for MITM protection for some time. Recent work changed the default mode to rapidly check NTP packets against constraint validation, as the default mode. In environments where https traffic doesn't work, ethernet-near servers can be labelled as "trusted". trusted sensor support is also coming. We have reasons to immediately move people away from the -s mode. ok otto
2019-11-10Introduce a "trusted" modifier, for peers that should be on a local netOtto Moerbeek
used in situations where https constraints cannot be used and we still want auto settime. Result of discussion with and ok deraadt@
2019-11-10- validate sensor values against constraintsOtto Moerbeek
- do not restart settime timeout interval if something happens in the main event loop - apply a tight loop protection; it can be painfull on a single core machine since the process runs at maximum priority. Should only happen when a bug is introduced while developing, but prevents having to machine taken over by ntpd.
2019-06-28When system calls indicate an error they return -1, not some arbitraryTheo de Raadt
value < 0. errno is only updated in this case. Change all (most?) callers of syscalls to follow this better, and let's see if this strictness helps us in the future.
2019-06-27Allow logging to both stderr and syslog; don't reset the log level ifOtto Moerbeek
the log destination changes. ok claudio@ benno@
2019-06-12Fix init of syslog for childs and teach dns process about synced state.Otto Moerbeek
ok benno@
2019-06-09Introducing autmatic settime mode: if some preconditions are metOtto Moerbeek
(booting, constraint(s) defined) set the time but only if the clock should be moved forward by more than a minute, based on ntp replies that satisfied the constraints. Tested by many; ok deraadt@
2019-01-14Prevent multiple ntpds from tripping over each other.Florian Obser
This brings over the logic from bgpd & ospfd. Input & OK deraadt
2018-11-29update for libtls default cert changes.Ted Unangst
bonus: this exposed a few missing const qualifiers.
2018-11-06Use TLS_CA_CERT_FILE instead of a separate define.Joel Sing
ok beck@ bluhm@ tb@
2018-08-31the main process must chdir to /, since it cannot have daemon() do theTheo de Raadt
job at startup. After much anguish I accept dlg's solution of chdir for the problem ("starting ntpd on a filesystem I want to unmount"), but we cannot change the main-process daemon() call. Why? Because the ntpd privsep design predates more modern designs where the config file is parsed once, and configuration marshalled to the fork+exec children. Instead each ntpd process re-parses the config, and if we chdir before fork+exec startup, it will move the basedir causing -f "relativepath" to fail. discussed with florian
2018-08-08ntpd unveils the cert.pem "r" file (which is passed-over-socket to theTheo de Raadt
constraints process), and /usr/sbin/ntpd "x" to perform fork+exec operations.
2018-08-04Revert back previous commit, we have decided that socket files don't cause anyRicardo Mestre
harm if not deleted after the daemon is shutdown and at the same time we also tackle another attack surface by not allowing the program to create/delete any more files (by removing "cpath" promise from pledge(2)). Discussion initiated by a question from deraadt@ OK florian@
2018-08-02ntpd(8) has logic in place to delete its control socket on shutdown, but itRicardo Mestre
currently doesn't call the function control_cleanup to do so. The solution is to simply call that function just before the program quits. "sure" henning@
2017-01-09Stop accessing verbose and debug variables from log.c directly.Reyk Floeter
This replaces log_verbose() and "extern int verbose" with the two functions log_setverbose() and log_getverbose(). Pointed out by benno@ OK krw@ eric@ gilles@ (OK gilles@ for the snmpd bits as well)
2016-12-01Remove unused variable which was leaking memory, and while here remove 2 otherRicardo Mestre
variables that were also never used OK otto@
2016-09-26Teach ntpd(8) constraint process to use exec*() instead of just forking,Rafael Zalamena
with this change we get the pledge() ability back to the parent process. some tweaks from and ok reyk@
2016-09-26Teach ntpd(8) how to use socket status to shutdown the daemon. While atRafael Zalamena
it, remove some verbose shutdown messages that we had before with pipe close. ok reyk@
2016-09-14Teach ntpd(8) how to fork+exec.Rafael Zalamena
ok reyk@, bcook@
2016-09-03Remove the oh so funny "LOSS OF MIND" from the diclaimer that was notReyk Floeter
part of the original ISC license that we use in OpenBSD. Done for files were Henning is the original author. OK henning@ deraadt@
2016-05-02prepare userland for removing chroot(2) from allowed syscalls under pledge(2).Sebastien Marie
for ntpd(8), removing the pledge call is a first step: futher redesign will occurs later. ok reyk@ benno@
2016-02-02Remove setproctitle() for the parent process. Because rc.d(8) uses processStuart Henderson
titles (including flags) to distinguish between daemons, this makes it possible to manage multiple copies of a daemon using the normal infrastructure by symlinking rc.d scripts to a new name. ok jung@ ajacoutot@, smtpd ok gilles@
2016-01-27Don't attempt to kill() the constraint in the wrong process. TheReyk Floeter
process management of the contraint processes has been moved from ntp to the parent, for better privsep and pledge, but the ntp process still attempted to kill the constraints on timeout directly. Fix this regression by introducing a new imsg from ntp to the parent and the related logic to kill a constraint at the right place. Reported & tested by bcook@ Ok bcook@
2016-01-27update ntpd log initialization to work like relayd, fix debug log levelsBrent Cook
ok reyk@
2016-01-11sneaky whitespace snuck in againTheo de Raadt
2015-12-29Don't assume fprintf() will set the FILE * error condition.Todd C. Miller
Instead, check the return value of fprintf() and fflush() and call clearerr() before returning on error. OK jca@
2015-12-19Switch and sync to the log.c variant from httpd/relayd/iked/snmpd/vmd.Reyk Floeter
OK bcook@ jung@
2015-12-05EAGAIN handling for imsg_read. OK henning@ benno@Claudio Jeker
2015-11-24Cache values from getpwnam() done at initialization, which need to beTheo de Raadt
used by the constraint processes setup later (chroot, setuid...) [late getpwnam discovered during a further audit] ok millert
2015-10-23Rather than re-opening the driftfile to write, keep it open; rewindingTheo de Raadt
and coping with error conditions... that lets us avoid a pledge "wpath". Putting it all together, this lets the master ntpd pledge "stdio rpath inet settime proc id". It works like this: "rpath" to load the certificates, "proc" to create constraint processes, "id" to chroot and lock the constraint processes into a jail, then "inet" to open a https session. "settime" is used by the master to manage the system time when the ntp-speaking engine instructs the master. with help from naddy
2015-10-12Move execution of the constraints from the ntp to the parent process.Reyk Floeter
This helps the ntp process to a) give a better pledge(2) and to b) keep the promise of "saving the world again... on time" by removing the delays that have been introduced by expensive constraint forks. The new design offers better privsep but introduces a few more imsgs and runs a little bit more code in the privileged parent. The privileged code is minimal, carefully checked, and does not attempt to "parse" any contents; the forked constraints instantly drop all privileges and pledge to "stdio inet". OK beck@ deraadt@
2015-10-09Change all tame callers to namechange to pledge(2).Theo de Raadt
2015-10-03In the ntpctl(1) case, after it has connect()'d to ntpd we can tame "stdio"Theo de Raadt
since that is all it will do till termination.
2015-07-18replace bzero with memsetBrent Cook
ok phessler@ deraadt@
2015-03-11-s is not optional, sadly;Jason McIntyre
while here i've reformatted the page to stop kidding that -s is 4 options; original issue kind of spotted by adam thompson, though note i am not fixing the issue he complained about (i'll address that mail in a minute);
2015-02-11Remove dead code (IMSG_HOST_DNS has been moved from the parent toReyk Floeter
ntp_dns some years ago). OK henning@
2015-02-10spacingReyk Floeter
2015-02-10Don't show the subseconds when displaying the constraint offset.Reyk Floeter
OK henning@ deraadt@
2015-02-10Add support for "constraints": when configured, ntpd(8) will query theReyk Floeter
time from HTTPS servers, by parsing the Date: header, and use the median constraint time as a boundary to verify NTP responses. This adds some level of authentication and protection against MITM attacks while preserving the accuracy of the NTP protocol; without relying on authentication options for NTP that are basically unavailable at present. This is an initial implementation and the semantics will be improved once it is in the tree. Discussed with deraadt@ and henning@ OK henning@
2015-01-21Fix deferred host DNS lookups.Brent Cook
If the network is unreachable when ntpd starts and host_dns fails, be sure that we still close the HOST_DNS imsg. Thanks to Paul de Weerd <weerd at weirdnet dot nl> for reporting this. ok beck@
2015-01-19Use initial assignment of action to check for errors.Brent Cook
This simplifies things and make action = -1 no longer a dead store. Also, spell FALLTHROUGH consistently. reported by fritjof@alokat.org
2015-01-14Switch drift file format to ppm for compatibility with the ntp.orgChristian Weisgerber
daemon. Old drift files will be interpreted as a minuscule adjustment and ntpd will proceed to rediscover the drift, like starting from zero on a newly installed machine. ok deraadt@
2015-01-13bump failure to set the initial time from debug to warningBrent Cook
from Paul B. Henson, ok phessler@
2015-01-13fix some memory leaks in dns handling.Brent Cook
- Nothing seems to free the result of host_dns(), so add host_dns_free() and call after each query. - If imsg_add() fails, it frees buf. Avoid subsequently dereferencing the freed buf in imsg_close(). ok millert@ deraadt@
2015-01-09remove excessive/wrong use of sys/param.hTheo de Raadt
peanuts -- but all work has to start somewhere.
2015-01-08sync log.c from smtpd.Brent Cook
Reduces the number of log.c snowflakes by a little, and gives ntpd a variadic fatal() function to be used later. ok deraadt@
2015-01-04rename sockaddr_un variables from 'sun' to the more common 'sa'.Brent Cook
This avoids a namespace conflict with Solaris build environments. discussed with deraadt@ and kettenis@
2015-01-04Add a missing include for time.h to get the definitions of clock_gettime and ↵Brent Cook
strftime. ok jsing@ phessler@ naddy@
2014-02-10Run the serving and privileged ntpd processes at high priority and theDarren Tucker
dns process at normal priority. Should improve latency on loaded machines. ok henning@
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-02 09:22:46 +0000