summaryrefslogtreecommitdiff
path: root/usr.sbin/ntpd
AgeCommit message (Collapse)Author
2018-08-31the main process must chdir to /, since it cannot have daemon() do theTheo de Raadt
job at startup. After much anguish I accept dlg's solution of chdir for the problem ("starting ntpd on a filesystem I want to unmount"), but we cannot change the main-process daemon() call. Why? Because the ntpd privsep design predates more modern designs where the config file is parsed once, and configuration marshalled to the fork+exec children. Instead each ntpd process re-parses the config, and if we chdir before fork+exec startup, it will move the basedir causing -f "relativepath" to fail. discussed with florian
2018-08-08ntpd unveils the cert.pem "r" file (which is passed-over-socket to theTheo de Raadt
constraints process), and /usr/sbin/ntpd "x" to perform fork+exec operations.
2018-08-04Revert back previous commit, we have decided that socket files don't cause anyRicardo Mestre
harm if not deleted after the daemon is shutdown and at the same time we also tackle another attack surface by not allowing the program to create/delete any more files (by removing "cpath" promise from pledge(2)). Discussion initiated by a question from deraadt@ OK florian@
2018-08-02ntpd(8) has logic in place to delete its control socket on shutdown, but itRicardo Mestre
currently doesn't call the function control_cleanup to do so. The solution is to simply call that function just before the program quits. "sure" henning@
2018-07-19revert previous, something isn't quite right as clients see ntpdStuart Henderson
as unsynced. reported by naddy, also seen by me (I noticed because monitoring-plugins check_ntp complained). ok claudio henning
2018-07-12if we couldn't update the clock for ~1h due to lack of data from peers andHenning Brauer
sensors, mark us unsynced again. ok reyk krw, pt out / discussion / help naddy
2018-07-09No need to mention which memory allocation entry point failed (malloc,Kenneth R Westerback
calloc or strdup), we just need to log that we ran out of memory in a particular function. Recommended by florian@ and deraadt@ ok benno@ henning@ tb@
2018-07-08Be consistent in warn() and log_warn() usage whenKenneth R Westerback
running out of memory. Next step, be correct *and* consistent. ok dennis@ tb@ benno@ schwarze@
2017-09-06ntpd has been on by default for over two years now, so reworkJason McIntyre
the text about enabling it; ok deraadt
2017-08-11zero out sockaddr_in before use; fixes use of stack garbage as port numberChristian Weisgerber
in "query from"; ok phessler@ job@
2017-08-10naddy@ reported confusion on why "query from" seemed to be ignored injob
some cases. OK naddy@ henning@
2017-05-31tweak previous;Jason McIntyre
2017-05-30add option "query from <ip>" to ntpd.conf, to specify a local IPSebastian Benoit
address for outgoing ntp queries. From Job Snijders, thanks! with feedback and ok henning@
2017-04-17don't manipulate hdr.len, it's used internally by libutil now; ok florian@Otto Moerbeek
2017-03-21From a syslog perspective it does not make sense to log fatal andAlexander Bluhm
warn with the same severity. Switch log_warn() to LOG_ERR and keep fatal() at LOG_CRIT. OK reyk@ florian@
2017-03-01*nargv[] holds an array of pointers, so it should beGleydson Soares
terminated by a null pointer. ok rzalamena@ reyk@
2017-01-20add logging messages to distinguish which safty check failedPeter Hessler
2017-01-09Stop accessing verbose and debug variables from log.c directly.Reyk Floeter
This replaces log_verbose() and "extern int verbose" with the two functions log_setverbose() and log_getverbose(). Pointed out by benno@ OK krw@ eric@ gilles@ (OK gilles@ for the snmpd bits as well)
2017-01-09Replace hand-rolled for(;;) traversal of ctl_conns TAILQ withKenneth R Westerback
TAILQ_FOREACH(). No intentional functional change. ok reyk@
2017-01-08Sync log.c with the latest version from vmd/log.c that preserves errnoReyk Floeter
so it is safe calling log_* after an error without loosing the it.
2016-12-30markup from jan stary;Jason McIntyre
2016-12-05Use the stack to hold the constraint child process variables instead ofRafael Zalamena
using the heap. ok bcook@
2016-12-01Remove unused variable which was leaking memory, and while here remove 2 otherRicardo Mestre
variables that were also never used OK otto@
2016-10-18Check for EAGAIN on imsg_flush() return otherwise we might be failingRafael Zalamena
to send message to the child process. Do like we learned in httpd(8). ok deraadt@
2016-10-18Save the constraint process pid by getting the start_child() return value,Rafael Zalamena
this should fix the problem with random ntpd(8) deaths. ok deraadt@
2016-10-12copy updated log.c from vmd: for correctness, save errno when doingReyk Floeter
additional actions before printing it. OK rzalamena@
2016-10-03Fix a possible bug that will happen with dup2() when oldd == newd. In thatRafael Zalamena
case the dup2() would fail silently and the descriptor would remain with the CLOEXEC flag causing the exec*()d child process to have unexpected behavior. ok guenther@
2016-09-26Teach ntpd(8) constraint process to use exec*() instead of just forking,Rafael Zalamena
with this change we get the pledge() ability back to the parent process. some tweaks from and ok reyk@
2016-09-26Teach ntpd(8) how to use socket status to shutdown the daemon. While atRafael Zalamena
it, remove some verbose shutdown messages that we had before with pipe close. ok reyk@
2016-09-14Teach ntpd(8) how to fork+exec.Rafael Zalamena
ok reyk@, bcook@
2016-09-14Add clarifications ("comments") to three places where it wasn'tReyk Floeter
obvious why it is implemented this way. The whole idea of constraints is to isolate them as much as possible, in a semi-paranoid way. OK rzalamena@
2016-09-14Fix copyright disclaimer in util.c.Reyk Floeter
OK from the original author Alexander Guy
2016-09-03Remove the oh so funny "LOSS OF MIND" from the diclaimer that was notReyk Floeter
part of the original ISC license that we use in OpenBSD. Done for files were Henning is the original author. OK henning@ deraadt@
2016-08-27Pull in <sys/time.h> for struct timespec, timeval, or clockratePhilip Guenther
ok deraadt@
2016-07-13Adjust existing tls_config_set_cipher() callers for TLS cipher groupJoel Sing
changes - map the previous configuration to the equivalent in the new groups. This will be revisited post release. Discussed with beck@
2016-06-01ntpd is too aggressive about retrying constraint connections. ThisTheo de Raadt
became more visible recently because a log_debug was changed to log_warnx. Change it back for now. ok jsing
2016-05-21Harden TLS for ntpd constraints - stop disabling server name verification,Joel Sing
ensure that we load the CA certificates and use tls_connect_servername() so that we can verify the server we are connecting to (even though we've already resolved the hostname). Also add additional warnings for TLS connect and TLS write failures so that we know what is happening and why. Lack of server name verification also reported by Luis M. Merino <luismiguelmerino at gmail dot com> - thanks! ok deraadt@ reyk@
2016-05-06Unconfuse things by renaming variables to match their contents.Joel Sing
ok deraadt@ reyk@
2016-05-02prepare userland for removing chroot(2) from allowed syscalls under pledge(2).Sebastien Marie
for ntpd(8), removing the pledge call is a first step: futher redesign will occurs later. ok reyk@ benno@
2016-03-27Rename session_socket_blockmode() to session_socket_nonblockmode(),Kenneth R Westerback
removing its second parameter and the enum() that provided the values for said parameter. The function was only called with the second parameter set to one value (BM_NONBLOCKING) from the enum(). So just do the right thing. Similar to changes made in smtpd. While here remove the pointless third parameter from the fcntl(F_GETFL) call. No functional change. ok guenther@ bcook@ deraadt@
2016-03-05According to RFC7231, section 7.1.1.1, the HTTP date header supportsChristian Weisgerber
no other timezone than the fixed string "GMT". Avoid using strptime %Z, which is nonstandard and can give surprising results on other operating systems. ok deraadt@ giovanni@ bcook@
2016-02-02Remove setproctitle() for the parent process. Because rc.d(8) uses processStuart Henderson
titles (including flags) to distinguish between daemons, this makes it possible to manage multiple copies of a daemon using the normal infrastructure by symlinking rc.d scripts to a new name. ok jung@ ajacoutot@, smtpd ok gilles@
2016-01-27Don't attempt to kill() the constraint in the wrong process. TheReyk Floeter
process management of the contraint processes has been moved from ntp to the parent, for better privsep and pledge, but the ntp process still attempted to kill the constraints on timeout directly. Fix this regression by introducing a new imsg from ntp to the parent and the related logic to kill a constraint at the right place. Reported & tested by bcook@ Ok bcook@
2016-01-27update ntpd log initialization to work like relayd, fix debug log levelsBrent Cook
ok reyk@
2016-01-11sneaky whitespace snuck in againTheo de Raadt
2015-12-29Don't assume fprintf() will set the FILE * error condition.Todd C. Miller
Instead, check the return value of fprintf() and fflush() and call clearerr() before returning on error. OK jca@
2015-12-19No need for an extra log.hReyk Floeter
OK bcook@
2015-12-19Switch and sync to the log.c variant from httpd/relayd/iked/snmpd/vmd.Reyk Floeter
OK bcook@ jung@
2015-12-19Move log_sockaddr() to from log.c to util.c as it is a local additionReyk Floeter
and actually not a "logging" function. No functional change.
2015-12-05EAGAIN handling for imsg_read. OK henning@ benno@Claudio Jeker
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-02 18:08:28 +0000