summaryrefslogtreecommitdiffstats
path: root/usr.sbin/ntpd/constraint.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Check for EAGAIN on imsg_flush() return otherwise we might be failingrzalamena2016-10-181-5/+11
| | | | | | to send message to the child process. Do like we learned in httpd(8). ok deraadt@
* Save the constraint process pid by getting the start_child() return value,rzalamena2016-10-181-2/+2
| | | | | | this should fix the problem with random ntpd(8) deaths. ok deraadt@
* Teach ntpd(8) constraint process to use exec*() instead of just forking,rzalamena2016-09-261-37/+76
| | | | | | with this change we get the pledge() ability back to the parent process. some tweaks from and ok reyk@
* Add clarifications ("comments") to three places where it wasn'treyk2016-09-141-2/+19
| | | | | | | obvious why it is implemented this way. The whole idea of constraints is to isolate them as much as possible, in a semi-paranoid way. OK rzalamena@
* Adjust existing tls_config_set_cipher() callers for TLS cipher groupjsing2016-07-131-2/+2
| | | | | | | changes - map the previous configuration to the equivalent in the new groups. This will be revisited post release. Discussed with beck@
* ntpd is too aggressive about retrying constraint connections. Thisderaadt2016-06-011-2/+2
| | | | | | became more visible recently because a log_debug was changed to log_warnx. Change it back for now. ok jsing
* Harden TLS for ntpd constraints - stop disabling server name verification,jsing2016-05-211-11/+13
| | | | | | | | | | | | ensure that we load the CA certificates and use tls_connect_servername() so that we can verify the server we are connecting to (even though we've already resolved the hostname). Also add additional warnings for TLS connect and TLS write failures so that we know what is happening and why. Lack of server name verification also reported by Luis M. Merino <luismiguelmerino at gmail dot com> - thanks! ok deraadt@ reyk@
* Unconfuse things by renaming variables to match their contents.jsing2016-05-061-20/+20
| | | | ok deraadt@ reyk@
* According to RFC7231, section 7.1.1.1, the HTTP date header supportsnaddy2016-03-051-2/+2
| | | | | | no other timezone than the fixed string "GMT". Avoid using strptime %Z, which is nonstandard and can give surprising results on other operating systems. ok deraadt@ giovanni@ bcook@
* Don't attempt to kill() the constraint in the wrong process. Thereyk2016-01-271-6/+30
| | | | | | | | | | | process management of the contraint processes has been moved from ntp to the parent, for better privsep and pledge, but the ntp process still attempted to kill the constraints on timeout directly. Fix this regression by introducing a new imsg from ntp to the parent and the related logic to kill a constraint at the right place. Reported & tested by bcook@ Ok bcook@
* Switch and sync to the log.c variant from httpd/relayd/iked/snmpd/vmd.reyk2015-12-191-2/+3
| | | | OK bcook@ jung@
* EAGAIN handling for imsg_read. OK henning@ benno@claudio2015-12-051-2/+3
|
* Cache values from getpwnam() done at initialization, which need to bederaadt2015-11-241-14/+11
| | | | | | used by the constraint processes setup later (chroot, setuid...) [late getpwnam discovered during a further audit] ok millert
* Simplify all instances of get_string() and get_data() using malloc() andmmcc2015-11-191-7/+2
| | | | | | strndup(). ok millert@
* fix memory leak; from David CARLIERderaadt2015-11-171-1/+2
|
* Move execution of the constraints from the ntp to the parent process.reyk2015-10-121-123/+328
| | | | | | | | | | | | | This helps the ntp process to a) give a better pledge(2) and to b) keep the promise of "saving the world again... on time" by removing the delays that have been introduced by expensive constraint forks. The new design offers better privsep but introduces a few more imsgs and runs a little bit more code in the privileged parent. The privileged code is minimal, carefully checked, and does not attempt to "parse" any contents; the forked constraints instantly drop all privileges and pledge to "stdio inet". OK beck@ deraadt@
* Once the constraint engine process is running, it only needsderaadt2015-10-091-1/+5
| | | | "stdio inet". It took weeks to get to this point...
* fix type and return check for tls_read/write.beck2015-09-101-4/+4
| | | | jontly with jsing@
* fix after libtls api changesbeck2015-09-101-8/+8
| | | | ok jsing@
* Fix memory leak in error path when max length exceeded.millert2015-09-091-1/+2
| | | | From Michael McConville
* Handle short writes and TLS_{READ,WRITE}_AGAIN around tls_write().bluhm2015-07-181-7/+15
| | | | input doug@; OK beck@
* prevent the tls constraint state machine from getting hung on STATE_INVALIDbcook2015-07-181-3/+3
| | | | | patch from Mikolaj Kucharski ok deraadt@
* detect crashes from constraint sub-processes, instead of ignoring them.deraadt2015-05-281-4/+8
| | | | | | if this happens, we want to tear down all of ntpd, so that people will report it, any such bug can be found, and fixed. ok bcook
* No need to call tzset() and log_init() in the forked constraintreyk2015-05-211-4/+1
| | | | | | | handler. It is run in a chroot, so tzset() wouldn't even succeed to open the zone file. Found with tame. OK deraadt@
* Currently, after 4 failed constraint checks, we suspect the constraintreyk2015-05-181-2/+4
| | | | | | | | | | | | | | of being wrong, not the NTP responses, reset it and query it from all the constraint servers all over again. This is turned out to be a bit aggressive because it could get triggered with just a few bad NTP peers in a larger pool. To avoid constant reconnections, scale the error margin with the number of resolved NTP peers using peer_cnt * 4. This way a single or a few outliers in a NTP pool cannot trigger reconnecting to the constraint servers immediately. More NTP peers, less reason to mistrust the constraint. Found by dtucker@ OK deraadt@
* When resolving the "constraint" (singular), store all returned IPreyk2015-05-171-24/+35
| | | | | | | | | | | | addresses and try one after another until the connection succeeded - based on the existing mechanism of "server". "constraint" previously only tried to connect to the first returned address, aborted and skipped the constraint on failure. In difference to "constraints" (plural), it still only connects to one address at a time and not to all of them at once. Pointed out by rpe@ OK rpe@ deraadt@
* fix a memory leak if tls_read() fails. ok henning@jsg2015-04-211-1/+2
|
* remove unused 'cause' string when checking child statusbcook2015-03-141-10/+3
| | | | ok deraadt@
* Rename tls_config_insecure_noverifyhost() tojsing2015-02-221-2/+2
| | | | | | | tls_config_insecure_noverifyname(), so that it is more accurate and keeps inline with the distinction between DNS hostname and server name. Requested by tedu@ during s2k15.
* Set the TLS ciphers to "compat" mode, restoring the previous behaviour.jsing2015-02-221-1/+4
|
* Use ntpd's deferred DNS resolving for constraints as well. Thisreyk2015-02-121-24/+118
| | | | | | | allows to get constraint addresses even if network/DNS is not available at startup (or system boot). thumbs up & OK henning@
* Be less chatty on constraint errors.reyk2015-02-101-3/+3
| | | | OK deraadt@
* After successfully getting a constraint from an HTTPS server, there isreyk2015-02-101-11/+21
| | | | | | | | | no need to request it ever again. The only exception is the escalation of failed constraint checks that might lead into re-requesting the constraint time from all servers. Adjust the states accordingly. OK henning@
* Add support for "constraints": when configured, ntpd(8) will query thereyk2015-02-101-0/+659
time from HTTPS servers, by parsing the Date: header, and use the median constraint time as a boundary to verify NTP responses. This adds some level of authentication and protection against MITM attacks while preserving the accuracy of the NTP protocol; without relying on authentication options for NTP that are basically unavailable at present. This is an initial implementation and the semantics will be improved once it is in the tree. Discussed with deraadt@ and henning@ OK henning@
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.