summaryrefslogtreecommitdiffstats
path: root/usr.sbin/ntpd/constraint.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Remove duplicate prototype.bluhm2021-03-181-2/+1
|
* Typo in log messageotto2020-02-201-2/+2
|
* If constraints are configured but do not work for whatever reason ntpdotto2020-02-121-3/+13
| | | | | does not work. Make that more clear in the log and ntpdctl -s status. report by and ok benno@
* 1) Re-resolve and re-get constraints once the clock is synced. Constraintsotto2019-07-161-4/+30
| | | | | | are relative to monotime; so they shift when time is being adjusted. 2) Fix a race between SIGCHLD delivery and reading the result imsg. 3) Some cleanup: use a number to distinguish pools internally
* When system calls indicate an error they return -1, not some arbitraryderaadt2019-06-281-3/+3
| | | | | | value < 0. errno is only updated in this case. Change all (most?) callers of syscalls to follow this better, and let's see if this strictness helps us in the future.
* Be more aggressive retrying dns while in settime mode. The constraintotto2019-06-161-2/+4
| | | | | engine does not know if we're in startup mode, so use a small interval the first few times there.
* Introducing autmatic settime mode: if some preconditions are metotto2019-06-091-3/+6
| | | | | | (booting, constraint(s) defined) set the time but only if the clock should be moved forward by more than a minute, based on ntp replies that satisfied the constraints. Tested by many; ok deraadt@
* Use proper algorithm for median computation; use fabs() for computingotto2019-05-301-13/+15
| | | | | | an absolute value and fix poll loop to first generate messages and then compute poll flags the write cases. This makes the timeout workaround for constraints unneeded. ok reyk@ tb@
* A step in solving the bootstrap problem in a dnssec environement.otto2019-05-281-2/+5
| | | | | | | If the time is wrong, we cannot validate dnssec, leading to failed DNS lookups, so we cannot adjust or set the time. Work around this by repeating a failed DNS lookup with a lookup with the DC (check disabled) bit set. ok florian@
* Improve logging for TLS certificate validity checking.jsing2019-01-211-7/+34
| | | | | | | Actually specify whether the certificate is not yet valid or has expired, and log the actual time values to hopefully save some head scratching. ok deraadt@ tb@
* Explicitly check timegm() return value.jsing2019-01-211-2/+3
| | | | | | Spotted by tb@ ok deraadt@ tb@
* Perform manual validity checking of the X.509 certificate for constraints.jsing2019-01-211-1/+22
| | | | | | | | | | Given that we're getting a constraint so that we can validate time, if our own time is out we can fail the automatic validity checking since it is based on the wallclock. Instead, disable the automatic validity checking and perform manual checks based on the time reported from the server via the HTTP header. Discussed at length with and ok deraadt@
* Don't use *a - *b as compare idiom, it does not work as expected forotto2019-01-201-2/+4
| | | | anything larger than an int. ok jca@ rsadowski@
* update for libtls default cert changes.tedu2018-11-291-2/+2
| | | | bonus: this exposed a few missing const qualifiers.
* Use TLS_CA_CERT_FILE instead of a separate define.jsing2018-11-061-2/+2
| | | | ok beck@ bluhm@ tb@
* Be stricter with TLS configuration for ntpd constraints.jsing2018-11-051-8/+2
| | | | | | | | | | | | We already require TLSv1.2 so it does not make sense to be liberal with the cipher suites that we allow. Additionally, it is potentially dangerous to disable certificate verification when no CA data is available (which is currently an impossible case to reach). Also ensure we check the return value from tls_config_set_ca_mem() (as spotted by tb@). ok kn@ tb@
* Use the stack to hold the constraint child process variables instead ofrzalamena2016-12-051-22/+18
| | | | | | using the heap. ok bcook@
* Check for EAGAIN on imsg_flush() return otherwise we might be failingrzalamena2016-10-181-5/+11
| | | | | | to send message to the child process. Do like we learned in httpd(8). ok deraadt@
* Save the constraint process pid by getting the start_child() return value,rzalamena2016-10-181-2/+2
| | | | | | this should fix the problem with random ntpd(8) deaths. ok deraadt@
* Teach ntpd(8) constraint process to use exec*() instead of just forking,rzalamena2016-09-261-37/+76
| | | | | | with this change we get the pledge() ability back to the parent process. some tweaks from and ok reyk@
* Add clarifications ("comments") to three places where it wasn'treyk2016-09-141-2/+19
| | | | | | | obvious why it is implemented this way. The whole idea of constraints is to isolate them as much as possible, in a semi-paranoid way. OK rzalamena@
* Adjust existing tls_config_set_cipher() callers for TLS cipher groupjsing2016-07-131-2/+2
| | | | | | | changes - map the previous configuration to the equivalent in the new groups. This will be revisited post release. Discussed with beck@
* ntpd is too aggressive about retrying constraint connections. Thisderaadt2016-06-011-2/+2
| | | | | | became more visible recently because a log_debug was changed to log_warnx. Change it back for now. ok jsing
* Harden TLS for ntpd constraints - stop disabling server name verification,jsing2016-05-211-11/+13
| | | | | | | | | | | | ensure that we load the CA certificates and use tls_connect_servername() so that we can verify the server we are connecting to (even though we've already resolved the hostname). Also add additional warnings for TLS connect and TLS write failures so that we know what is happening and why. Lack of server name verification also reported by Luis M. Merino <luismiguelmerino at gmail dot com> - thanks! ok deraadt@ reyk@
* Unconfuse things by renaming variables to match their contents.jsing2016-05-061-20/+20
| | | | ok deraadt@ reyk@
* According to RFC7231, section 7.1.1.1, the HTTP date header supportsnaddy2016-03-051-2/+2
| | | | | | no other timezone than the fixed string "GMT". Avoid using strptime %Z, which is nonstandard and can give surprising results on other operating systems. ok deraadt@ giovanni@ bcook@
* Don't attempt to kill() the constraint in the wrong process. Thereyk2016-01-271-6/+30
| | | | | | | | | | | process management of the contraint processes has been moved from ntp to the parent, for better privsep and pledge, but the ntp process still attempted to kill the constraints on timeout directly. Fix this regression by introducing a new imsg from ntp to the parent and the related logic to kill a constraint at the right place. Reported & tested by bcook@ Ok bcook@
* Switch and sync to the log.c variant from httpd/relayd/iked/snmpd/vmd.reyk2015-12-191-2/+3
| | | | OK bcook@ jung@
* EAGAIN handling for imsg_read. OK henning@ benno@claudio2015-12-051-2/+3
|
* Cache values from getpwnam() done at initialization, which need to bederaadt2015-11-241-14/+11
| | | | | | used by the constraint processes setup later (chroot, setuid...) [late getpwnam discovered during a further audit] ok millert
* Simplify all instances of get_string() and get_data() using malloc() andmmcc2015-11-191-7/+2
| | | | | | strndup(). ok millert@
* fix memory leak; from David CARLIERderaadt2015-11-171-1/+2
|
* Move execution of the constraints from the ntp to the parent process.reyk2015-10-121-123/+328
| | | | | | | | | | | | | This helps the ntp process to a) give a better pledge(2) and to b) keep the promise of "saving the world again... on time" by removing the delays that have been introduced by expensive constraint forks. The new design offers better privsep but introduces a few more imsgs and runs a little bit more code in the privileged parent. The privileged code is minimal, carefully checked, and does not attempt to "parse" any contents; the forked constraints instantly drop all privileges and pledge to "stdio inet". OK beck@ deraadt@
* Once the constraint engine process is running, it only needsderaadt2015-10-091-1/+5
| | | | "stdio inet". It took weeks to get to this point...
* fix type and return check for tls_read/write.beck2015-09-101-4/+4
| | | | jontly with jsing@
* fix after libtls api changesbeck2015-09-101-8/+8
| | | | ok jsing@
* Fix memory leak in error path when max length exceeded.millert2015-09-091-1/+2
| | | | From Michael McConville
* Handle short writes and TLS_{READ,WRITE}_AGAIN around tls_write().bluhm2015-07-181-7/+15
| | | | input doug@; OK beck@
* prevent the tls constraint state machine from getting hung on STATE_INVALIDbcook2015-07-181-3/+3
| | | | | patch from Mikolaj Kucharski ok deraadt@
* detect crashes from constraint sub-processes, instead of ignoring them.deraadt2015-05-281-4/+8
| | | | | | if this happens, we want to tear down all of ntpd, so that people will report it, any such bug can be found, and fixed. ok bcook
* No need to call tzset() and log_init() in the forked constraintreyk2015-05-211-4/+1
| | | | | | | handler. It is run in a chroot, so tzset() wouldn't even succeed to open the zone file. Found with tame. OK deraadt@
* Currently, after 4 failed constraint checks, we suspect the constraintreyk2015-05-181-2/+4
| | | | | | | | | | | | | | of being wrong, not the NTP responses, reset it and query it from all the constraint servers all over again. This is turned out to be a bit aggressive because it could get triggered with just a few bad NTP peers in a larger pool. To avoid constant reconnections, scale the error margin with the number of resolved NTP peers using peer_cnt * 4. This way a single or a few outliers in a NTP pool cannot trigger reconnecting to the constraint servers immediately. More NTP peers, less reason to mistrust the constraint. Found by dtucker@ OK deraadt@
* When resolving the "constraint" (singular), store all returned IPreyk2015-05-171-24/+35
| | | | | | | | | | | | addresses and try one after another until the connection succeeded - based on the existing mechanism of "server". "constraint" previously only tried to connect to the first returned address, aborted and skipped the constraint on failure. In difference to "constraints" (plural), it still only connects to one address at a time and not to all of them at once. Pointed out by rpe@ OK rpe@ deraadt@
* fix a memory leak if tls_read() fails. ok henning@jsg2015-04-211-1/+2
|
* remove unused 'cause' string when checking child statusbcook2015-03-141-10/+3
| | | | ok deraadt@
* Rename tls_config_insecure_noverifyhost() tojsing2015-02-221-2/+2
| | | | | | | tls_config_insecure_noverifyname(), so that it is more accurate and keeps inline with the distinction between DNS hostname and server name. Requested by tedu@ during s2k15.
* Set the TLS ciphers to "compat" mode, restoring the previous behaviour.jsing2015-02-221-1/+4
|
* Use ntpd's deferred DNS resolving for constraints as well. Thisreyk2015-02-121-24/+118
| | | | | | | allows to get constraint addresses even if network/DNS is not available at startup (or system boot). thumbs up & OK henning@
* Be less chatty on constraint errors.reyk2015-02-101-3/+3
| | | | OK deraadt@
* After successfully getting a constraint from an HTTPS server, there isreyk2015-02-101-11/+21
| | | | | | | | | no need to request it ever again. The only exception is the escalation of failed constraint checks that might lead into re-requesting the constraint time from all servers. Adjust the states accordingly. OK henning@
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.