summaryrefslogtreecommitdiff
path: root/usr.sbin/ntpd
AgeCommit message (Collapse)Author
2019-11-12tweak previous; ok deraadtJason McIntyre
2019-11-11sensors can als be marked trusted; ok deraadt@Otto Moerbeek
2019-11-11tweak previous: delete stray .PpIngo Schwarze
2019-11-11trusted sub-option works on sensors also now; ok ottoTheo de Raadt
2019-11-11Also implement "trusted" for sensors; do not do constraint validationOtto Moerbeek
for these. ok deraadt@
2019-11-11remove -s and -S documentation, and explain the boot-time startup modeTheo de Raadt
more clearly ok ingo schwarze
2019-11-11Disable -s and -S functionality. -s would force time using NTP packets withoutTheo de Raadt
any MITM protection checks. We've had constraint checks for MITM protection for some time. Recent work changed the default mode to rapidly check NTP packets against constraint validation, as the default mode. In environments where https traffic doesn't work, ethernet-near servers can be labelled as "trusted". trusted sensor support is also coming. We have reasons to immediately move people away from the -s mode. ok otto
2019-11-10document server/servers "trusted" sub-option. Indicates a particularTheo de Raadt
server is wired up such that non MITM attacks are possible, and NTP packets can be trusted. Therefore constraint validity is not required, and during boot ntpd can spin-up correct time faster. with otto, ok jmc schwarze
2019-11-10Introduce a "trusted" modifier, for peers that should be on a local netOtto Moerbeek
used in situations where https constraints cannot be used and we still want auto settime. Result of discussion with and ok deraadt@
2019-11-10alphatically order sub-options for sensors, and make the explanationsTheo de Raadt
more similar ok jmc schwarze
2019-11-10typoTheo de Raadt
2019-11-10- validate sensor values against constraintsOtto Moerbeek
- do not restart settime timeout interval if something happens in the main event loop - apply a tight loop protection; it can be painfull on a single core machine since the process runs at maximum priority. Should only happen when a bug is introduced while developing, but prevents having to machine taken over by ntpd.
2019-11-06Allow the singular constraint clause to list multiple addresses;Otto Moerbeek
ok deraadt@
2019-07-161) Re-resolve and re-get constraints once the clock is synced. ConstraintsOtto Moerbeek
are relative to monotime; so they shift when time is being adjusted. 2) Fix a race between SIGCHLD delivery and reading the result imsg. 3) Some cleanup: use a number to distinguish pools internally
2019-07-10fix printing when the pool is specified as an IP address; reported by andOtto Moerbeek
ok deraadt@
2019-07-07proper level of two messages, prompted by deraadt@Otto Moerbeek
2019-07-07Sometimes ntp peers are unreliable (looking at you pool.ntp.org!)Otto Moerbeek
and net config can change as well. So if a peer does not respond, throw it out of the pool if it's a pool member and re-resolve to find a replacement. Hold on to good peers so we end up with a good set of peers. ok benno@
2019-07-03Forgotten va_copy/va_end; on some archs that is really needed. ok benno@Otto Moerbeek
2019-06-28When system calls indicate an error they return -1, not some arbitraryTheo de Raadt
value < 0. errno is only updated in this case. Change all (most?) callers of syscalls to follow this better, and let's see if this strictness helps us in the future.
2019-06-27Allow logging to both stderr and syslog; don't reset the log level ifOtto Moerbeek
the log destination changes. ok claudio@ benno@
2019-06-20tweaks with help from jmc@Otto Moerbeek
2019-06-20Tell a bit about automatic mode; ok jmc@Otto Moerbeek
2019-06-20Do a quick DNS probe to decide to stay in the forground and attemptOtto Moerbeek
an (auto) settime or give up. 15s timeout is still in effect. ok florian@
2019-06-16Be more aggressive retrying dns while in settime mode. The constraintOtto Moerbeek
engine does not know if we're in startup mode, so use a small interval the first few times there.
2019-06-12Fix init of syslog for childs and teach dns process about synced state.Otto Moerbeek
ok benno@
2019-06-09Introducing autmatic settime mode: if some preconditions are metOtto Moerbeek
(booting, constraint(s) defined) set the time but only if the clock should be moved forward by more than a minute, based on ntp replies that satisfied the constraints. Tested by many; ok deraadt@
2019-05-30Use proper algorithm for median computation; use fabs() for computingOtto Moerbeek
an absolute value and fix poll loop to first generate messages and then compute poll flags the write cases. This makes the timeout workaround for constraints unneeded. ok reyk@ tb@
2019-05-29If a DBS resolve was done with the Checking Disabled flag, re-resolveOtto Moerbeek
with once the clock is synced. ok deraadt@ florian@
2019-05-28A step in solving the bootstrap problem in a dnssec environement.Otto Moerbeek
If the time is wrong, we cannot validate dnssec, leading to failed DNS lookups, so we cannot adjust or set the time. Work around this by repeating a failed DNS lookup with a lookup with the DC (check disabled) bit set. ok florian@
2019-02-13(unsigned) means (unsigned int) which on ptrdiff_t or size_t or otherTheo de Raadt
larger types really is a range reduction... Almost any cast to (unsigned) is a bug. ok millert tb benno
2019-01-21Improve logging for TLS certificate validity checking.Joel Sing
Actually specify whether the certificate is not yet valid or has expired, and log the actual time values to hopefully save some head scratching. ok deraadt@ tb@
2019-01-21Explicitly check timegm() return value.Joel Sing
Spotted by tb@ ok deraadt@ tb@
2019-01-21Perform manual validity checking of the X.509 certificate for constraints.Joel Sing
Given that we're getting a constraint so that we can validate time, if our own time is out we can fail the automatic validity checking since it is based on the wallclock. Instead, disable the automatic validity checking and perform manual checks based on the time reported from the server via the HTTP header. Discussed at length with and ok deraadt@
2019-01-20Don't use *a - *b as compare idiom, it does not work as expected forOtto Moerbeek
anything larger than an int. ok jca@ rsadowski@
2019-01-14Prevent multiple ntpds from tripping over each other.Florian Obser
This brings over the logic from bgpd & ospfd. Input & OK deraadt
2019-01-07log dns failures, even if temporary. ok bennoTed Unangst
2018-11-29update for libtls default cert changes.Ted Unangst
bonus: this exposed a few missing const qualifiers.
2018-11-06Use TLS_CA_CERT_FILE instead of a separate define.Joel Sing
ok beck@ bluhm@ tb@
2018-11-05Be stricter with TLS configuration for ntpd constraints.Joel Sing
We already require TLSv1.2 so it does not make sense to be liberal with the cipher suites that we allow. Additionally, it is potentially dangerous to disable certificate verification when no CA data is available (which is currently an impossible case to reach). Also ensure we check the return value from tls_config_set_ca_mem() (as spotted by tb@). ok kn@ tb@
2018-11-01- odd condition/test in PF lexerAlexandr Nedvedicky
(and other lexers too) This commit rectifies earlier change: in the lex... even inside quotes, a \ followed by space or tab should expand to space or tab, and a \ followed by newline should be ignored (as a line continuation). compatible with the needs of hoststated (which has the most strict quoted string requirements), and ifstated (where one commonly does line continuations in strings). OK deraadt@, OK millert@
2018-09-07Make host_*() AF-agnostickn
Merge host_v{4,6}() into much simpler host_ip() using just getaddrinfo(). host_dns() uses the same procedure. OK naddy
2018-08-31the main process must chdir to /, since it cannot have daemon() do theTheo de Raadt
job at startup. After much anguish I accept dlg's solution of chdir for the problem ("starting ntpd on a filesystem I want to unmount"), but we cannot change the main-process daemon() call. Why? Because the ntpd privsep design predates more modern designs where the config file is parsed once, and configuration marshalled to the fork+exec children. Instead each ntpd process re-parses the config, and if we chdir before fork+exec startup, it will move the basedir causing -f "relativepath" to fail. discussed with florian
2018-08-08ntpd unveils the cert.pem "r" file (which is passed-over-socket to theTheo de Raadt
constraints process), and /usr/sbin/ntpd "x" to perform fork+exec operations.
2018-08-04Revert back previous commit, we have decided that socket files don't cause anyRicardo Mestre
harm if not deleted after the daemon is shutdown and at the same time we also tackle another attack surface by not allowing the program to create/delete any more files (by removing "cpath" promise from pledge(2)). Discussion initiated by a question from deraadt@ OK florian@
2018-08-02ntpd(8) has logic in place to delete its control socket on shutdown, but itRicardo Mestre
currently doesn't call the function control_cleanup to do so. The solution is to simply call that function just before the program quits. "sure" henning@
2018-07-19revert previous, something isn't quite right as clients see ntpdStuart Henderson
as unsynced. reported by naddy, also seen by me (I noticed because monitoring-plugins check_ntp complained). ok claudio henning
2018-07-12if we couldn't update the clock for ~1h due to lack of data from peers andHenning Brauer
sensors, mark us unsynced again. ok reyk krw, pt out / discussion / help naddy
2018-07-09No need to mention which memory allocation entry point failed (malloc,Kenneth R Westerback
calloc or strdup), we just need to log that we ran out of memory in a particular function. Recommended by florian@ and deraadt@ ok benno@ henning@ tb@
2018-07-08Be consistent in warn() and log_warn() usage whenKenneth R Westerback
running out of memory. Next step, be correct *and* consistent. ok dennis@ tb@ benno@ schwarze@
2017-09-06ntpd has been on by default for over two years now, so reworkJason McIntyre
the text about enabling it; ok deraadt
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-25 03:56:54 +0000