doc: update NEWS

Fix the FreeBSD-specific code checking for a bound IPv4 socket to
include the new PTP port. This should fix a multihomed server to respond
to NTP-over-PTP requests from the address which received the request.

Fixes: be3158c4e5 ("ntp: add support for NTP over PTP")

NEWS

@@ -1,3 +1,27 @@
+New in version 4.2
+==================
+
+Enhancements
+------------
+* Add support for NTPv4 extension field improving synchronisation
+  stability and resolution of root delay and dispersion (experimental)
+* Add support for NTP over PTP (experimental)
+* Add support for AES-CMAC and hash functions in GnuTLS
+* Improve server interleaved mode to be more reliable and support
+  multiple clients behind NAT
+* Update seccomp filter
+* Add statistics about interleaved mode to serverstats report
+
+Bug fixes
+---------
+* Fix RTC support with 64-bit time_t on 32-bit Linux
+* Fix seccomp filter to work correctly with bind*device directives
+* Suppress kernel adjustments of system clock (dosynctodr) on illumos
+
+Other changes
+-------------
+* Switch Solaris support to illumos
+
 New in version 4.1
 ==================
 
@@ -12,7 +36,7 @@ Enhancements
 * Increase PPS lock limit to 40% of pulse interval
 * Perform source selection immediately after loading dump files
 * Reload dump files for addresses negotiated by NTS-KE server
-* Update seccomp filter
+* Update seccomp filter and add less restrictive level
 * Restart ongoing name resolution on online command
 
 Bug fixes

README

@@ -28,7 +28,7 @@ What will chrony run on?
 ========================
 
 The software is known to work on Linux, FreeBSD, NetBSD, macOS and
-Solaris.  Closely related systems may work too.  Any other system will
+illumos.  Closely related systems may work too.  Any other system will
 likely require a porting exercise.
 
 How do I set it up?

candm.h

@@ -270,6 +270,7 @@ typedef struct {
 #define REQ_ADDSRC_BURST 0x100
 #define REQ_ADDSRC_NTS 0x200
 #define REQ_ADDSRC_COPY 0x400
+#define REQ_ADDSRC_EF_EXP1 0x800
 
 typedef struct {
   uint32_t type;
@@ -516,7 +517,8 @@ typedef struct {
 #define RPY_CLIENT_ACCESSES_BY_INDEX3 21
 #define RPY_SERVER_STATS2 22
 #define RPY_SELECT_DATA 23
-#define N_REPLY_TYPES 24
+#define RPY_SERVER_STATS3 24
+#define N_REPLY_TYPES 25
 
 /* Status codes */
 #define STT_SUCCESS 0
@@ -529,8 +531,7 @@ typedef struct {
 #define STT_BADSUBNET 7
 #define STT_ACCESSALLOWED 8
 #define STT_ACCESSDENIED 9
-/* Deprecated */
-#define STT_NOHOSTACCESS 10
+#define STT_NOHOSTACCESS 10 /* Deprecated */
 #define STT_SOURCEALREADYKNOWN 11
 #define STT_TOOMANYSOURCES 12
 #define STT_NORTC 13
@@ -660,6 +661,9 @@ typedef struct {
   uint32_t cmd_drops;
   uint32_t log_drops;
   uint32_t ntp_auth_hits;
+  uint32_t ntp_interleaved_hits;
+  uint32_t ntp_timestamps;
+  uint32_t ntp_span_seconds;
   int32_t EOR;
 } RPY_ServerStats;
 

client.c

@@ -4,7 +4,7 @@
  **********************************************************************
  * Copyright (C) Richard P. Curnow  1997-2003
  * Copyright (C) Lonnie Abelbeck  2016, 2018
- * Copyright (C) Miroslav Lichvar  2009-2020
+ * Copyright (C) Miroslav Lichvar  2009-2021
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -779,182 +779,25 @@ process_cmd_manual(CMD_Request *msg, const char *line)
 /* ================================================== */
 
 static int
-parse_allow_deny(CMD_Request *msg, char *line)
+process_cmd_allowdeny(CMD_Request *msg, char *line, int cmd, int allcmd)
 {
-  unsigned long a, b, c, d;
-  int n, specified_subnet_bits;
+  int all, subnet_bits;
   IPAddr ip;
-  char *p;
   
-  p = line;
-  if (!*p) {
-    /* blank line - applies to all addresses */
-    ip.family = IPADDR_UNSPEC;
-    UTI_IPHostToNetwork(&ip, &msg->data.allow_deny.ip);
-    msg->data.allow_deny.subnet_bits = htonl(0);
-  } else {
-    char *slashpos;
-    slashpos = strchr(p, '/');
-    if (slashpos) *slashpos = 0;
-    
-    n = 0;
-    if (!UTI_StringToIP(p, &ip) &&
-        (n = sscanf(p, "%lu.%lu.%lu.%lu", &a, &b, &c, &d)) <= 0) {
-
-      /* Try to parse as the name of a machine */
-      if (slashpos || DNS_Name2IPAddress(p, &ip, 1) != DNS_Success) {
-        LOG(LOGS_ERR, "Could not read address");
-        return 0;
-      } else {
-        UTI_IPHostToNetwork(&ip, &msg->data.allow_deny.ip);
-        if (ip.family == IPADDR_INET6)
-          msg->data.allow_deny.subnet_bits = htonl(128);
-        else
-          msg->data.allow_deny.subnet_bits = htonl(32);
-      }        
-    } else {
-      
-      if (n == 0) {
-        if (ip.family == IPADDR_INET6)
-          msg->data.allow_deny.subnet_bits = htonl(128);
-        else
-          msg->data.allow_deny.subnet_bits = htonl(32);
-      } else {
-        ip.family = IPADDR_INET4;
-
-        a &= 0xff;
-        b &= 0xff;
-        c &= 0xff;
-        d &= 0xff;
-        
-        switch (n) {
-          case 1:
-            ip.addr.in4 = htonl((a<<24));
-            msg->data.allow_deny.subnet_bits = htonl(8);
-            break;
-          case 2:
-            ip.addr.in4 = htonl((a<<24) | (b<<16));
-            msg->data.allow_deny.subnet_bits = htonl(16);
-            break;
-          case 3:
-            ip.addr.in4 = htonl((a<<24) | (b<<16) | (c<<8));
-            msg->data.allow_deny.subnet_bits = htonl(24);
-            break;
-          case 4:
-            ip.addr.in4 = htonl((a<<24) | (b<<16) | (c<<8) | d);
-            msg->data.allow_deny.subnet_bits = htonl(32);
-            break;
-          default:
-            assert(0);
-        }
-      }
-
-      UTI_IPHostToNetwork(&ip, &msg->data.allow_deny.ip);
-
-      if (slashpos) {
-        n = sscanf(slashpos+1, "%d", &specified_subnet_bits);
-        if (n == 1) {
-          msg->data.allow_deny.subnet_bits = htonl(specified_subnet_bits);
-        } else {
-          LOG(LOGS_WARN, "Warning: badly formatted subnet size, using %d",
-              (int)ntohl(msg->data.allow_deny.subnet_bits));
-        }
-      } 
-    }
+  if (!CPS_ParseAllowDeny(line, &all, &ip, &subnet_bits)) {
+    LOG(LOGS_ERR, "Could not read address");
+    return 0;
   }
+
+  msg->command = htons(all ? allcmd : cmd);
+  UTI_IPHostToNetwork(&ip, &msg->data.allow_deny.ip);
+  msg->data.allow_deny.subnet_bits = htonl(subnet_bits);
+
   return 1;
 }
 
 /* ================================================== */
 
-static int
-process_cmd_allow(CMD_Request *msg, char *line)
-{
-  int status;
-  msg->command = htons(REQ_ALLOW);
-  status = parse_allow_deny(msg, line);
-  return status;
-}
-
-/* ================================================== */
-
-static int
-process_cmd_allowall(CMD_Request *msg, char *line)
-{
-  int status;
-  msg->command = htons(REQ_ALLOWALL);
-  status = parse_allow_deny(msg, line);
-  return status;
-}
-
-/* ================================================== */
-
-static int
-process_cmd_deny(CMD_Request *msg, char *line)
-{
-  int status;
-  msg->command = htons(REQ_DENY);
-  status = parse_allow_deny(msg, line);
-  return status;
-}
-
-/* ================================================== */
-
-static int
-process_cmd_denyall(CMD_Request *msg, char *line)
-{
-  int status;
-  msg->command = htons(REQ_DENYALL);
-  status = parse_allow_deny(msg, line);
-  return status;
-}
-
-/* ================================================== */
-
-static int
-process_cmd_cmdallow(CMD_Request *msg, char *line)
-{
-  int status;
-  msg->command = htons(REQ_CMDALLOW);
-  status = parse_allow_deny(msg, line);
-  return status;
-}
-
-/* ================================================== */
-
-static int
-process_cmd_cmdallowall(CMD_Request *msg, char *line)
-{
-  int status;
-  msg->command = htons(REQ_CMDALLOWALL);
-  status = parse_allow_deny(msg, line);
-  return status;
-}
-
-/* ================================================== */
-
-static int
-process_cmd_cmddeny(CMD_Request *msg, char *line)
-{
-  int status;
-  msg->command = htons(REQ_CMDDENY);
-  status = parse_allow_deny(msg, line);
-  return status;
-}
-
-/* ================================================== */
-
-static int
-process_cmd_cmddenyall(CMD_Request *msg, char *line)
-{
-  int status;
-  msg->command = htons(REQ_CMDDENYALL);
-  status = parse_allow_deny(msg, line);
-  return status;
-}
-
-/* ================================================== */
-
 static int
 process_cmd_accheck(CMD_Request *msg, char *line)
 {
@@ -1099,6 +942,7 @@ process_cmd_add_source(CMD_Request *msg, char *line)
           (data.params.burst ? REQ_ADDSRC_BURST : 0) |
           (data.params.nts ? REQ_ADDSRC_NTS : 0) |
           (data.params.copy ? REQ_ADDSRC_COPY : 0) |
+          (data.params.ext_fields & NTP_EF_FLAG_EXP1 ? REQ_ADDSRC_EF_EXP1 : 0) |
           (data.params.sel_options & SRC_SELECT_PREFER ? REQ_ADDSRC_PREFER : 0) |
           (data.params.sel_options & SRC_SELECT_NOSELECT ? REQ_ADDSRC_NOSELECT : 0) |
           (data.params.sel_options & SRC_SELECT_TRUST ? REQ_ADDSRC_TRUST : 0) |
@@ -2616,7 +2460,7 @@ process_cmd_serverstats(char *line)
   CMD_Reply reply;
 
   request.command = htons(REQ_SERVER_STATS);
-  if (!request_reply(&request, &reply, RPY_SERVER_STATS2, 0))
+  if (!request_reply(&request, &reply, RPY_SERVER_STATS3, 0))
     return 0;
 
   print_report("NTP packets received       : %U\n"
@@ -2626,7 +2470,10 @@ process_cmd_serverstats(char *line)
                "Client log records dropped : %U\n"
                "NTS-KE connections accepted: %U\n"
                "NTS-KE connections dropped : %U\n"
-               "Authenticated NTP packets  : %U\n",
+               "Authenticated NTP packets  : %U\n"
+               "Interleaved NTP packets    : %U\n"
+               "NTP timestamps held        : %U\n"
+               "NTP timestamp span         : %U\n",
                (unsigned long)ntohl(reply.data.server_stats.ntp_hits),
                (unsigned long)ntohl(reply.data.server_stats.ntp_drops),
                (unsigned long)ntohl(reply.data.server_stats.cmd_hits),
@@ -2635,6 +2482,9 @@ process_cmd_serverstats(char *line)
                (unsigned long)ntohl(reply.data.server_stats.nke_hits),
                (unsigned long)ntohl(reply.data.server_stats.nke_drops),
                (unsigned long)ntohl(reply.data.server_stats.ntp_auth_hits),
+               (unsigned long)ntohl(reply.data.server_stats.ntp_interleaved_hits),
+               (unsigned long)ntohl(reply.data.server_stats.ntp_timestamps),
+               (unsigned long)ntohl(reply.data.server_stats.ntp_span_seconds),
                REPORT_END);
 
   return 1;
@@ -3232,11 +3082,7 @@ process_line(char *line)
   } else if (!strcmp(command, "add")) {
     do_normal_submit = process_cmd_add_source(&tx_message, line);
   } else if (!strcmp(command, "allow")) {
-    if (!strncmp(line, "all", 3)) {
-      do_normal_submit = process_cmd_allowall(&tx_message, CPS_SplitWord(line));
-    } else {
-      do_normal_submit = process_cmd_allow(&tx_message, line);
-    }
+    do_normal_submit = process_cmd_allowdeny(&tx_message, line, REQ_ALLOW, REQ_ALLOWALL);
   } else if (!strcmp(command, "authdata")) {
     do_normal_submit = 0;
     ret = process_cmd_authdata(line);
@@ -3248,28 +3094,15 @@ process_line(char *line)
   } else if (!strcmp(command, "cmdaccheck")) {
     do_normal_submit = process_cmd_cmdaccheck(&tx_message, line);
   } else if (!strcmp(command, "cmdallow")) {
-    if (!strncmp(line, "all", 3)) {
-      do_normal_submit = process_cmd_cmdallowall(&tx_message, CPS_SplitWord(line));
-    } else {
-      do_normal_submit = process_cmd_cmdallow(&tx_message, line);
-    }
+    do_normal_submit = process_cmd_allowdeny(&tx_message, line, REQ_CMDALLOW, REQ_CMDALLOWALL);
   } else if (!strcmp(command, "cmddeny")) {
-    if (!strncmp(line, "all", 3)) {
-      line = CPS_SplitWord(line);
-      do_normal_submit = process_cmd_cmddenyall(&tx_message, line);
-    } else {
-      do_normal_submit = process_cmd_cmddeny(&tx_message, line);
-    }
+    do_normal_submit = process_cmd_allowdeny(&tx_message, line, REQ_CMDDENY, REQ_CMDDENYALL);
   } else if (!strcmp(command, "cyclelogs")) {
     process_cmd_cyclelogs(&tx_message, line);
   } else if (!strcmp(command, "delete")) {
     do_normal_submit = process_cmd_delete(&tx_message, line);
   } else if (!strcmp(command, "deny")) {
-    if (!strncmp(line, "all", 3)) {
-      do_normal_submit = process_cmd_denyall(&tx_message, CPS_SplitWord(line));
-    } else {
-      do_normal_submit = process_cmd_deny(&tx_message, line);
-    }
+    do_normal_submit = process_cmd_allowdeny(&tx_message, line, REQ_DENY, REQ_DENYALL);
   } else if (!strcmp(command, "dfreq")) {
     do_normal_submit = process_cmd_dfreq(&tx_message, line);
   } else if (!strcmp(command, "dns")) {
@@ -3458,7 +3291,7 @@ static void
 display_gpl(void)
 {
     printf("chrony version %s\n"
-           "Copyright (C) 1997-2003, 2007, 2009-2020 Richard P. Curnow and others\n"
+           "Copyright (C) 1997-2003, 2007, 2009-2021 Richard P. Curnow and others\n"
            "chrony comes with ABSOLUTELY NO WARRANTY.  This is free software, and\n"
            "you are welcome to redistribute it under certain conditions.  See the\n"
            "GNU General Public License version 2 for details.\n\n",

clientlog.c

@@ -3,7 +3,7 @@
 
  **********************************************************************
  * Copyright (C) Richard P. Curnow  1997-2003
- * Copyright (C) Miroslav Lichvar  2009, 2015-2017
+ * Copyright (C) Miroslav Lichvar  2009, 2015-2017, 2021
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -38,6 +38,7 @@
 #include "array.h"
 #include "clientlog.h"
 #include "conf.h"
+#include "local.h"
 #include "memory.h"
 #include "ntp.h"
 #include "reports.h"
@@ -55,8 +56,6 @@ typedef struct {
   int8_t rate[MAX_SERVICES];
   int8_t ntp_timeout_rate;
   uint8_t drop_flags;
-  NTP_int64 ntp_rx_ts;
-  NTP_int64 ntp_tx_ts;
 } Record;
 
 /* Hash table of records, there is a fixed number of records per slot */
@@ -124,10 +123,43 @@ static int limit_interval[MAX_SERVICES];
 /* Flag indicating whether facility is turned on or not */
 static int active;
 
+/* RX and TX timestamp saved for clients using interleaved mode */
+typedef struct {
+  uint64_t rx_ts;
+  uint16_t flags;
+  uint16_t slew_epoch;
+  int32_t tx_ts_offset;
+} NtpTimestamps;
+
+/* Flags for NTP timestamps */
+#define NTPTS_DISABLED 1
+#define NTPTS_VALID_TX 2
+
+/* RX->TX map using a circular buffer with ordered timestamps */
+typedef struct {
+  ARR_Instance timestamps;
+  uint32_t first;
+  uint32_t size;
+  uint32_t max_size;
+  uint32_t cached_index;
+  uint64_t cached_rx_ts;
+  uint16_t slew_epoch;
+  double slew_offset;
+} NtpTimestampMap;
+
+static NtpTimestampMap ntp_ts_map;
+
+/* Maximum interval of NTP timestamps in future after a backward step */
+#define NTPTS_FUTURE_LIMIT (1LL << 32) /* 1 second */
+
+/* Maximum number of timestamps moved in the array to insert a new timestamp */
+#define NTPTS_INSERT_LIMIT 64
+
 /* Global statistics */
 static uint32_t total_hits[MAX_SERVICES];
 static uint32_t total_drops[MAX_SERVICES];
 static uint32_t total_ntp_auth_hits;
+static uint32_t total_ntp_interleaved_hits;
 static uint32_t total_record_drops;
 
 #define NSEC_PER_SEC 1000000000U
@@ -135,6 +167,8 @@ static uint32_t total_record_drops;
 /* ================================================== */
 
 static int expand_hashtable(void);
+static void handle_slew(struct timespec *raw, struct timespec *cooked, double dfreq,
+                        double doffset, LCL_ChangeType change_type, void *anything);
 
 /* ================================================== */
 
@@ -229,8 +263,6 @@ get_record(IPAddr *ip)
     record->rate[i] = INVALID_RATE;
   record->ntp_timeout_rate = INVALID_RATE;
   record->drop_flags = 0;
-  UTI_ZeroNtp64(&record->ntp_rx_ts);
-  UTI_ZeroNtp64(&record->ntp_tx_ts);
 
   return record;
 }
@@ -316,7 +348,7 @@ set_bucket_params(int interval, int burst, uint16_t *max_tokens,
 void
 CLG_Initialise(void)
 {
-  int i, interval, burst, lrate;
+  int i, interval, burst, lrate, slots2;
 
   for (i = 0; i < MAX_SERVICES; i++) {
     max_tokens[i] = 0;
@@ -359,9 +391,13 @@ CLG_Initialise(void)
   /* Calculate the maximum number of slots that can be allocated in the
      configured memory limit.  Take into account expanding of the hash
      table where two copies exist at the same time. */
-  max_slots = CNF_GetClientLogLimit() / (sizeof (Record) * SLOT_SIZE * 3 / 2);
+  max_slots = CNF_GetClientLogLimit() /
+              ((sizeof (Record) + sizeof (NtpTimestamps)) * SLOT_SIZE * 3 / 2);
   max_slots = CLAMP(MIN_SLOTS, max_slots, MAX_SLOTS);
-  DEBUG_LOG("Max records %u", 1U << ((int)round(log(max_slots) / log(2)) + SLOT_BITS));
+  for (slots2 = 0; 1U << (slots2 + 1) <= max_slots; slots2++)
+    ;
+
+  DEBUG_LOG("Max records %u", 1U << (slots2 + SLOT_BITS));
 
   slots = 0;
   records = NULL;
@@ -370,6 +406,17 @@ CLG_Initialise(void)
 
   UTI_GetRandomBytes(&ts_offset, sizeof (ts_offset));
   ts_offset %= NSEC_PER_SEC / (1U << TS_FRAC);
+
+  ntp_ts_map.timestamps = NULL;
+  ntp_ts_map.first = 0;
+  ntp_ts_map.size = 0;
+  ntp_ts_map.max_size = 1U << (slots2 + SLOT_BITS);
+  ntp_ts_map.cached_index = 0;
+  ntp_ts_map.cached_rx_ts = 0ULL;
+  ntp_ts_map.slew_epoch = 0;
+  ntp_ts_map.slew_offset = 0.0;
+
+  LCL_AddParameterChangeHandler(handle_slew, NULL);
 }
 
 /* ================================================== */
@@ -381,6 +428,10 @@ CLG_Finalise(void)
     return;
 
   ARR_DestroyInstance(records);
+  if (ntp_ts_map.timestamps)
+    ARR_DestroyInstance(ntp_ts_map.timestamps);
+
+  LCL_RemoveParameterChangeHandler(handle_slew, NULL);
 }
 
 /* ================================================== */
@@ -595,22 +646,334 @@ CLG_LogAuthNtpRequest(void)
 
 /* ================================================== */
 
-void CLG_GetNtpTimestamps(int index, NTP_int64 **rx_ts, NTP_int64 **tx_ts)
+int
+CLG_GetNtpMinPoll(void)
 {
-  Record *record;
+  return limit_interval[CLG_NTP];
+}
 
-  record = ARR_GetElement(records, index);
+/* ================================================== */
 
-  *rx_ts = &record->ntp_rx_ts;
-  *tx_ts = &record->ntp_tx_ts;
+static NtpTimestamps *
+get_ntp_tss(uint32_t index)
+{
+  return ARR_GetElement(ntp_ts_map.timestamps,
+                        (ntp_ts_map.first + index) & (ntp_ts_map.max_size - 1));
+}
+
+/* ================================================== */
+
+static int
+find_ntp_rx_ts(uint64_t rx_ts, uint32_t *index)
+{
+  uint64_t rx_x, rx_lo, rx_hi, step;
+  uint32_t i, x, lo, hi;
+
+  if (ntp_ts_map.cached_rx_ts == rx_ts && rx_ts != 0ULL) {
+    *index = ntp_ts_map.cached_index;
+    return 1;
+  }
+
+  if (ntp_ts_map.size == 0) {
+    *index = 0;
+    return 0;
+  }
+
+  lo = 0;
+  hi = ntp_ts_map.size - 1;
+  rx_lo = get_ntp_tss(lo)->rx_ts;
+  rx_hi = get_ntp_tss(hi)->rx_ts;
+
+  /* Check for ts < lo before ts > hi to trim timestamps from "future" later
+     if both conditions are true to not break the order of the endpoints.
+     Compare timestamps by their difference to allow adjacent NTP eras. */
+  if ((int64_t)(rx_ts - rx_lo) < 0) {
+    *index = 0;
+    return 0;
+  } else if ((int64_t)(rx_ts - rx_hi) > 0) {
+    *index = ntp_ts_map.size;
+    return 0;
+  }
+
+  /* Perform a combined linear interpolation and binary search */
+
+  for (i = 0; ; i++) {
+    if (rx_ts == rx_hi) {
+      *index = ntp_ts_map.cached_index = hi;
+      ntp_ts_map.cached_rx_ts = rx_ts;
+      return 1;
+    } else if (rx_ts == rx_lo) {
+      *index = ntp_ts_map.cached_index = lo;
+      ntp_ts_map.cached_rx_ts = rx_ts;
+      return 1;
+    } else if (lo + 1 == hi) {
+      *index = hi;
+      return 0;
+    }
+
+    if (hi - lo > 3 && i % 2 == 0) {
+      step = (rx_hi - rx_lo) / (hi - lo);
+      if (step == 0)
+        step = 1;
+      x = lo + (rx_ts - rx_lo) / step;
+    } else {
+      x = lo + (hi - lo) / 2;
+    }
+
+    if (x <= lo)
+      x = lo + 1;
+    else if (x >= hi)
+      x = hi - 1;
+
+    rx_x = get_ntp_tss(x)->rx_ts;
+
+    if ((int64_t)(rx_x - rx_ts) <= 0) {
+      lo = x;
+      rx_lo = rx_x;
+    } else {
+      hi = x;
+      rx_hi = rx_x;
+    }
+  }
+}
+
+/* ================================================== */
+
+static uint64_t
+ntp64_to_int64(NTP_int64 *ts)
+{
+  return (uint64_t)ntohl(ts->hi) << 32 | ntohl(ts->lo);
+}
+
+/* ================================================== */
+
+static void
+int64_to_ntp64(uint64_t ts, NTP_int64 *ntp_ts)
+{
+  ntp_ts->hi = htonl(ts >> 32);
+  ntp_ts->lo = htonl(ts);
+}
+
+/* ================================================== */
+
+static uint32_t
+push_ntp_tss(uint32_t index)
+{
+  if (ntp_ts_map.size < ntp_ts_map.max_size) {
+    ntp_ts_map.size++;
+  } else {
+    ntp_ts_map.first = (ntp_ts_map.first + 1) % (ntp_ts_map.max_size);
+    if (index > 0)
+      index--;
+  }
+
+  return index;
+}
+
+/* ================================================== */
+
+static void
+set_ntp_tx_offset(NtpTimestamps *tss, NTP_int64 *rx_ts, struct timespec *tx_ts)
+{
+  struct timespec ts;
+
+  if (!tx_ts) {
+    tss->flags &= ~NTPTS_VALID_TX;
+    return;
+  }
+
+  UTI_Ntp64ToTimespec(rx_ts, &ts);
+  UTI_DiffTimespecs(&ts, tx_ts, &ts);
+
+  if (ts.tv_sec < -2 || ts.tv_sec > 1) {
+    tss->flags &= ~NTPTS_VALID_TX;
+    return;
+  }
+
+  tss->tx_ts_offset = (int32_t)ts.tv_nsec + (int32_t)ts.tv_sec * (int32_t)NSEC_PER_SEC;
+  tss->flags |= NTPTS_VALID_TX;
+}
+
+/* ================================================== */
+
+static void
+get_ntp_tx(NtpTimestamps *tss, struct timespec *tx_ts)
+{
+  int32_t offset = tss->tx_ts_offset;
+  NTP_int64 ntp_ts;
+
+  if (tss->flags & NTPTS_VALID_TX) {
+    int64_to_ntp64(tss->rx_ts, &ntp_ts);
+    UTI_Ntp64ToTimespec(&ntp_ts, tx_ts);
+    if (offset >= (int32_t)NSEC_PER_SEC) {
+      offset -= NSEC_PER_SEC;
+      tx_ts->tv_sec++;
+    }
+    tx_ts->tv_nsec += offset;
+    UTI_NormaliseTimespec(tx_ts);
+  } else {
+    UTI_ZeroTimespec(tx_ts);
+  }
+}
+
+/* ================================================== */
+
+void
+CLG_SaveNtpTimestamps(NTP_int64 *rx_ts, struct timespec *tx_ts)
+{
+  NtpTimestamps *tss;
+  uint32_t i, index;
+  uint64_t rx;
+
+  if (!active)
+    return;
+
+  /* Allocate the array on first use */
+  if (!ntp_ts_map.timestamps) {
+    ntp_ts_map.timestamps = ARR_CreateInstance(sizeof (NtpTimestamps));
+    ARR_SetSize(ntp_ts_map.timestamps, ntp_ts_map.max_size);
+  }
+
+  rx = ntp64_to_int64(rx_ts);
+
+  if (rx == 0ULL)
+    return;
+
+  /* Disable the RX timestamp if it already exists to avoid responding
+     with a wrong TX timestamp */
+  if (find_ntp_rx_ts(rx, &index)) {
+    get_ntp_tss(index)->flags |= NTPTS_DISABLED;
+    return;
+  }
+
+  assert(index <= ntp_ts_map.size);
+
+  if (index == ntp_ts_map.size) {
+    /* Increase the size or drop the oldest timestamp to make room for
+       the new timestamp */
+    index = push_ntp_tss(index);
+  } else {
+    /* Trim timestamps in distant future after backward step */
+    while (index < ntp_ts_map.size &&
+           get_ntp_tss(ntp_ts_map.size - 1)->rx_ts - rx > NTPTS_FUTURE_LIMIT)
+      ntp_ts_map.size--;
+
+    /* Insert the timestamp if it is close to the latest timestamp.
+       Otherwise, replace the closest older or the oldest timestamp. */
+    if (index + NTPTS_INSERT_LIMIT >= ntp_ts_map.size) {
+      index = push_ntp_tss(index);
+      for (i = ntp_ts_map.size - 1; i > index; i--)
+        *get_ntp_tss(i) = *get_ntp_tss(i - 1);
+    } else {
+      if (index > 0)
+        index--;
+    }
+  }
+
+  ntp_ts_map.cached_index = index;
+  ntp_ts_map.cached_rx_ts = rx;
+
+  tss = get_ntp_tss(index);
+  tss->rx_ts = rx;
+  tss->flags = 0;
+  tss->slew_epoch = ntp_ts_map.slew_epoch;
+  set_ntp_tx_offset(tss, rx_ts, tx_ts);
+
+  DEBUG_LOG("Saved RX+TX index=%"PRIu32" first=%"PRIu32" size=%"PRIu32,
+            index, ntp_ts_map.first, ntp_ts_map.size);
+}
+
+/* ================================================== */
+
+static void
+handle_slew(struct timespec *raw, struct timespec *cooked, double dfreq,
+            double doffset, LCL_ChangeType change_type, void *anything)
+{
+  /* Drop all timestamps on unknown step */
+  if (change_type == LCL_ChangeUnknownStep) {
+    ntp_ts_map.size = 0;
+    ntp_ts_map.cached_rx_ts = 0ULL;
+  }
+
+  ntp_ts_map.slew_epoch++;
+  ntp_ts_map.slew_offset = doffset;
+}
+
+/* ================================================== */
+
+void
+CLG_UndoNtpTxTimestampSlew(NTP_int64 *rx_ts, struct timespec *tx_ts)
+{
+  uint32_t index;
+
+  if (!ntp_ts_map.timestamps)
+    return;
+
+  if (!find_ntp_rx_ts(ntp64_to_int64(rx_ts), &index))
+    return;
+
+  /* If the RX timestamp was captured before the last correction of the clock,
+     remove the adjustment from the TX timestamp */
+  if ((uint16_t)(get_ntp_tss(index)->slew_epoch + 1U) == ntp_ts_map.slew_epoch)
+    UTI_AddDoubleToTimespec(tx_ts, ntp_ts_map.slew_offset, tx_ts);
+}
+
+/* ================================================== */
+
+void
+CLG_UpdateNtpTxTimestamp(NTP_int64 *rx_ts, struct timespec *tx_ts)
+{
+  uint32_t index;
+
+  if (!ntp_ts_map.timestamps)
+    return;
+
+  if (!find_ntp_rx_ts(ntp64_to_int64(rx_ts), &index))
+    return;
+
+  set_ntp_tx_offset(get_ntp_tss(index), rx_ts, tx_ts);
 }
 
 /* ================================================== */
 
 int
-CLG_GetNtpMinPoll(void)
+CLG_GetNtpTxTimestamp(NTP_int64 *rx_ts, struct timespec *tx_ts)
 {
-  return limit_interval[CLG_NTP];
+  NtpTimestamps *tss;
+  uint32_t index;
+
+  if (!ntp_ts_map.timestamps)
+    return 0;
+
+  if (!find_ntp_rx_ts(ntp64_to_int64(rx_ts), &index))
+    return 0;
+
+  tss = get_ntp_tss(index);
+
+  if (tss->flags & NTPTS_DISABLED)
+    return 0;
+
+  get_ntp_tx(tss, tx_ts);
+
+  return 1;
+}
+
+/* ================================================== */
+
+void
+CLG_DisableNtpTimestamps(NTP_int64 *rx_ts)
+{
+  uint32_t index;
+
+  if (!ntp_ts_map.timestamps)
+    return;
+
+  if (find_ntp_rx_ts(ntp64_to_int64(rx_ts), &index))
+    get_ntp_tss(index)->flags |= NTPTS_DISABLED;
+
+  /* This assumes the function is called only to prevent multiple
+     interleaved responses to the same timestamp */
+  total_ntp_interleaved_hits++;
 }
 
 /* ================================================== */
@@ -717,4 +1080,9 @@ CLG_GetServerStatsReport(RPT_ServerStatsReport *report)
   report->cmd_drops = total_drops[CLG_CMDMON];
   report->log_drops = total_record_drops;
   report->ntp_auth_hits = total_ntp_auth_hits;
+  report->ntp_interleaved_hits = total_ntp_interleaved_hits;
+  report->ntp_timestamps = ntp_ts_map.size;
+  report->ntp_span_seconds = ntp_ts_map.size > 1 ?
+                             (get_ntp_tss(ntp_ts_map.size - 1)->rx_ts -
+                              get_ntp_tss(0)->rx_ts) >> 32 : 0;
 }

clientlog.h

@@ -43,9 +43,15 @@ extern int CLG_GetClientIndex(IPAddr *client);
 extern int CLG_LogServiceAccess(CLG_Service service, IPAddr *client, struct timespec *now);
 extern int CLG_LimitServiceRate(CLG_Service service, int index);
 extern void CLG_LogAuthNtpRequest(void);
-extern void CLG_GetNtpTimestamps(int index, NTP_int64 **rx_ts, NTP_int64 **tx_ts);
 extern int CLG_GetNtpMinPoll(void);
 
+/* Functions to save and retrieve timestamps for server interleaved mode */
+extern void CLG_SaveNtpTimestamps(NTP_int64 *rx_ts, struct timespec *tx_ts);
+extern void CLG_UndoNtpTxTimestampSlew(NTP_int64 *rx_ts, struct timespec *tx_ts);
+extern void CLG_UpdateNtpTxTimestamp(NTP_int64 *rx_ts, struct timespec *tx_ts);
+extern int CLG_GetNtpTxTimestamp(NTP_int64 *rx_ts, struct timespec *tx_ts);
+extern void CLG_DisableNtpTimestamps(NTP_int64 *rx_ts);
+
 /* And some reporting functions, for use by chronyc. */
 
 extern int CLG_GetNumberOfIndices(void);

cmac_gnutls.c

@@ -0,0 +1,189 @@
+/*
+  chronyd/chronyc - Programs for keeping computer clocks accurate.
+
+ **********************************************************************
+ * Copyright (C) Miroslav Lichvar  2021
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ *
+ **********************************************************************
+
+  =======================================================================
+
+  CMAC using the GnuTLS library
+  */
+
+#include "config.h"
+
+#include "sysincl.h"
+
+#include <gnutls/crypto.h>
+
+#include "cmac.h"
+#include "hash.h"
+#include "logging.h"
+#include "memory.h"
+
+struct CMC_Instance_Record {
+  gnutls_mac_algorithm_t algorithm;
+  gnutls_hmac_hd_t mac;
+};
+
+/* ================================================== */
+
+static int instance_counter = 0;
+static int gnutls_initialised = 0;
+
+/* ================================================== */
+
+static void
+init_gnutls(void)
+{
+  int r;
+
+  if (gnutls_initialised)
+    return;
+
+  r = gnutls_global_init();
+  if (r < 0)
+    LOG_FATAL("Could not initialise %s : %s", "gnutls", gnutls_strerror(r));
+
+  DEBUG_LOG("Initialised");
+  gnutls_initialised = 1;
+}
+
+/* ================================================== */
+
+static void
+deinit_gnutls(void)
+{
+  assert(gnutls_initialised);
+  gnutls_global_deinit();
+  gnutls_initialised = 0;
+  DEBUG_LOG("Deinitialised");
+}
+
+/* ================================================== */
+
+static gnutls_mac_algorithm_t
+get_mac_algorithm(CMC_Algorithm algorithm)
+{
+  switch (algorithm) {
+    case CMC_AES128:
+      return GNUTLS_MAC_AES_CMAC_128;
+    case CMC_AES256:
+      return GNUTLS_MAC_AES_CMAC_256;
+    default:
+      return GNUTLS_MAC_UNKNOWN;
+  }
+}
+
+/* ================================================== */
+
+int
+CMC_GetKeyLength(CMC_Algorithm algorithm)
+{
+  gnutls_mac_algorithm_t malgo = get_mac_algorithm(algorithm);
+  int len;
+
+  if (malgo == GNUTLS_MAC_UNKNOWN)
+    return 0;
+
+  len = gnutls_hmac_get_key_size(malgo);
+
+  if (len < 0)
+    return 0;
+
+  return len;
+}
+
+/* ================================================== */
+
+CMC_Instance
+CMC_CreateInstance(CMC_Algorithm algorithm, const unsigned char *key, int length)
+{
+  gnutls_hmac_hd_t handle;
+  CMC_Instance inst;
+
+  int r;
+
+  if (instance_counter == 0)
+    init_gnutls();
+
+  if (length <= 0 || length != CMC_GetKeyLength(algorithm))
+    goto error;
+
+  r = gnutls_hmac_init(&handle, get_mac_algorithm(algorithm), key, length);
+  if (r < 0) {
+    DEBUG_LOG("Could not initialise %s : %s", "mac", gnutls_strerror(r));
+    goto error;
+  }
+
+  inst = MallocNew(struct CMC_Instance_Record);
+  inst->algorithm = get_mac_algorithm(algorithm);
+  inst->mac = handle;
+
+  instance_counter++;
+
+  return inst;
+
+error:
+  if (instance_counter == 0)
+    deinit_gnutls();
+  return NULL;
+}
+
+/* ================================================== */
+
+int
+CMC_Hash(CMC_Instance inst, const void *in, int in_len, unsigned char *out, int out_len)
+{
+  unsigned char buf[MAX_HASH_LENGTH];
+  int hash_len;
+
+  if (in_len < 0 || out_len < 0)
+    return 0;
+
+  hash_len = gnutls_hmac_get_len(inst->algorithm);
+
+  if (out_len > hash_len)
+    out_len = hash_len;
+
+  if (hash_len > sizeof (buf))
+    return 0;
+
+  if (gnutls_hmac(inst->mac, in, in_len) < 0) {
+    /* Reset the state */
+    gnutls_hmac_output(inst->mac, buf);
+    return 0;
+  }
+
+  gnutls_hmac_output(inst->mac, buf);
+  memcpy(out, buf, out_len);
+
+  return out_len;
+}
+
+/* ================================================== */
+
+void
+CMC_DestroyInstance(CMC_Instance inst)
+{
+  gnutls_hmac_deinit(inst->mac, NULL);
+  Free(inst);
+
+  instance_counter--;
+  if (instance_counter == 0)
+    deinit_gnutls();
+}

cmdmon.c

@@ -3,7 +3,7 @@
 
  **********************************************************************
  * Copyright (C) Richard P. Curnow  1997-2003
- * Copyright (C) Miroslav Lichvar  2009-2016, 2018-2020
+ * Copyright (C) Miroslav Lichvar  2009-2016, 2018-2021
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -321,7 +321,8 @@ transmit_reply(int sock_fd, int request_length, SCK_Message *message)
 
 #if !defined(HAVE_IN_PKTINFO) && defined(IP_SENDSRCADDR)
   /* On FreeBSD a local IPv4 address cannot be specified on bound socket */
-  if (message->local_addr.ip.family == IPADDR_INET4 && (sock_fd != sock_fd4 || bound_sock_fd4))
+  if (message->addr_type == SCK_ADDR_IP && message->local_addr.ip.family == IPADDR_INET4 &&
+      (sock_fd != sock_fd4 || bound_sock_fd4))
     message->local_addr.ip.family = IPADDR_UNSPEC;
 #endif
 
@@ -768,6 +769,8 @@ handle_add_source(CMD_Request *rx_message, CMD_Reply *tx_message)
   params.burst = ntohl(rx_message->data.ntp_source.flags) & REQ_ADDSRC_BURST ? 1 : 0;
   params.nts = ntohl(rx_message->data.ntp_source.flags) & REQ_ADDSRC_NTS ? 1 : 0;
   params.copy = ntohl(rx_message->data.ntp_source.flags) & REQ_ADDSRC_COPY ? 1 : 0;
+  params.ext_fields =
+    ntohl(rx_message->data.ntp_source.flags) & REQ_ADDSRC_EF_EXP1 ? NTP_EF_FLAG_EXP1 : 0;
   params.sel_options =
     (ntohl(rx_message->data.ntp_source.flags) & REQ_ADDSRC_PREFER ? SRC_SELECT_PREFER : 0) |
     (ntohl(rx_message->data.ntp_source.flags) & REQ_ADDSRC_NOSELECT ? SRC_SELECT_NOSELECT : 0) |
@@ -1164,7 +1167,7 @@ handle_server_stats(CMD_Request *rx_message, CMD_Reply *tx_message)
   RPT_ServerStatsReport report;
 
   CLG_GetServerStatsReport(&report);
-  tx_message->reply = htons(RPY_SERVER_STATS2);
+  tx_message->reply = htons(RPY_SERVER_STATS3);
   tx_message->data.server_stats.ntp_hits = htonl(report.ntp_hits);
   tx_message->data.server_stats.nke_hits = htonl(report.nke_hits);
   tx_message->data.server_stats.cmd_hits = htonl(report.cmd_hits);
@@ -1173,6 +1176,9 @@ handle_server_stats(CMD_Request *rx_message, CMD_Reply *tx_message)
   tx_message->data.server_stats.cmd_drops = htonl(report.cmd_drops);
   tx_message->data.server_stats.log_drops = htonl(report.log_drops);
   tx_message->data.server_stats.ntp_auth_hits = htonl(report.ntp_auth_hits);
+  tx_message->data.server_stats.ntp_interleaved_hits = htonl(report.ntp_interleaved_hits);
+  tx_message->data.server_stats.ntp_timestamps = htonl(report.ntp_timestamps);
+  tx_message->data.server_stats.ntp_span_seconds = htonl(report.ntp_span_seconds);
 }
 
 /* ================================================== */

cmdparse.c

@@ -3,7 +3,7 @@
 
  **********************************************************************
  * Copyright (C) Richard P. Curnow  1997-2003
- * Copyright (C) Miroslav Lichvar  2013-2014, 2016
+ * Copyright (C) Miroslav Lichvar  2013-2014, 2016, 2021
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -43,6 +43,7 @@ int
 CPS_ParseNTPSourceAdd(char *line, CPS_NTP_Source *src)
 {
   char *hostname, *cmd;
+  uint32_t ef_type;
   int n;
   
   src->port = SRC_DEFAULT_PORT;
@@ -65,6 +66,7 @@ CPS_ParseNTPSourceAdd(char *line, CPS_NTP_Source *src)
   src->params.nts = 0;
   src->params.nts_port = SRC_DEFAULT_NTSPORT;
   src->params.copy = 0;
+  src->params.ext_fields = 0;
   src->params.authkey = INACTIVE_AUTHKEY;
   src->params.cert_set = SRC_DEFAULT_CERTSET;
   src->params.max_delay = SRC_DEFAULT_MAXDELAY;
@@ -116,6 +118,16 @@ CPS_ParseNTPSourceAdd(char *line, CPS_NTP_Source *src)
     } else if (!strcasecmp(cmd, "asymmetry")) {
       if (sscanf(line, "%lf%n", &src->params.asymmetry, &n) != 1)
         return 0;
+    } else if (!strcasecmp(cmd, "extfield")) {
+      if (sscanf(line, "%"SCNx32"%n", &ef_type, &n) != 1)
+        return 0;
+      switch (ef_type) {
+        case NTP_EF_EXP1:
+          src->params.ext_fields |= NTP_EF_FLAG_EXP1;
+          break;
+        default:
+          return 0;
+      }
     } else if (!strcasecmp(cmd, "filter")) {
       if (sscanf(line, "%d%n", &src->params.filter_length, &n) != 1)
         return 0;
@@ -181,6 +193,85 @@ CPS_ParseNTPSourceAdd(char *line, CPS_NTP_Source *src)
 
 /* ================================================== */
 
+int
+CPS_ParseAllowDeny(char *line, int *all, IPAddr *ip, int *subnet_bits)
+{
+  char *p, *net, *slash;
+  uint32_t a, b, c;
+  int bits, len, n;
+
+  p = CPS_SplitWord(line);
+
+  if (strcmp(line, "all") == 0) {
+    *all = 1;
+    net = p;
+    p = CPS_SplitWord(p);
+  } else {
+    *all = 0;
+    net = line;
+  }
+
+  /* Make sure there are no other arguments */
+  if (*p)
+    return 0;
+
+  /* No specified address or network means all IPv4 and IPv6 addresses */
+  if (!*net) {
+    ip->family = IPADDR_UNSPEC;
+    *subnet_bits = 0;
+    return 1;
+  }
+
+  slash = strchr(net, '/');
+  if (slash) {
+    if (sscanf(slash + 1, "%d%n", &bits, &len) != 1 || slash[len + 1] || bits < 0)
+      return 0;
+    *slash = '\0';
+  } else {
+    bits = -1;
+  }
+
+  if (UTI_StringToIP(net, ip)) {
+    if (bits >= 0)
+      *subnet_bits = bits;
+    else
+      *subnet_bits = ip->family == IPADDR_INET6 ? 128 : 32;
+    return 1;
+  }
+
+  /* Check for a shortened IPv4 network notation using only 1, 2, or 3 decimal
+     numbers.  This is different than the numbers-and-dots notation accepted
+     by inet_aton()! */
+
+  a = b = c = 0;
+  n = sscanf(net, "%"PRIu32"%n.%"PRIu32"%n.%"PRIu32"%n", &a, &len, &b, &len, &c, &len);
+
+  if (n > 0 && !net[len]) {
+    if (a > 255 || b > 255 || c > 255)
+      return 0;
+
+    ip->family = IPADDR_INET4;
+    ip->addr.in4 = (a << 24) | (b << 16) | (c << 8);
+
+    if (bits >= 0)
+      *subnet_bits = bits;
+    else
+      *subnet_bits = n * 8;
+
+    return 1;
+  }
+
+  /* The last possibility is a hostname */
+  if (bits < 0 && DNS_Name2IPAddress(net, ip, 1) == DNS_Success) {
+    *subnet_bits = ip->family == IPADDR_INET6 ? 128 : 32;
+    return 1;
+  }
+
+  return 0;
+}
+
+/* ================================================== */
+
 int
 CPS_ParseLocal(char *line, int *stratum, int *orphan, double *distance)
 {

cmdparse.h

@@ -39,6 +39,9 @@ typedef struct {
 /* Parse a command to add an NTP server or peer */
 extern int CPS_ParseNTPSourceAdd(char *line, CPS_NTP_Source *src);
   
+/* Parse a command to allow/deny access */
+extern int CPS_ParseAllowDeny(char *line, int *all, IPAddr *ip, int *subnet_bits);
+
 /* Parse a command to enable local reference */
 extern int CPS_ParseLocal(char *line, int *stratum, int *orphan, double *distance);
 

conf.c

@@ -273,6 +273,9 @@ static int no_system_cert = 0;
 /* Array of CNF_HwTsInterface */
 static ARR_Instance hwts_interfaces;
 
+/* PTP event port (disabled by default) */
+static int ptp_port = 0;
+
 typedef struct {
   NTP_Source_Type type;
   int pool;
@@ -686,6 +689,8 @@ CNF_ParseLine(const char *filename, int number, char *line)
     parse_source(p, command, 1);
   } else if (!strcasecmp(command, "port")) {
     parse_int(p, &ntp_port);
+  } else if (!strcasecmp(command, "ptpport")) {
+    parse_int(p, &ptp_port);
   } else if (!strcasecmp(command, "ratelimit")) {
     parse_ratelimit(p, &ntp_ratelimit_enabled, &ntp_ratelimit_interval,
                     &ntp_ratelimit_burst, &ntp_ratelimit_leak);
@@ -1212,100 +1217,18 @@ parse_ntstrustedcerts(char *line)
 static void
 parse_allow_deny(char *line, ARR_Instance restrictions, int allow)
 {
-  char *p;
-  unsigned long a, b, c, d, n;
-  int all = 0;
-  AllowDeny *new_node = NULL;
-  IPAddr ip_addr;
+  int all, subnet_bits;
+  AllowDeny *node;
+  IPAddr ip;
 
-  p = line;
+  if (!CPS_ParseAllowDeny(line, &all, &ip, &subnet_bits))
+    command_parse_error();
 
-  if (!strncmp(p, "all", 3)) {
-    all = 1;
-    p = CPS_SplitWord(line);
-  }
-
-  if (!*p) {
-    /* Empty line applies to all addresses */
-    new_node = (AllowDeny *)ARR_GetNewElement(restrictions);
-    new_node->allow = allow;
-    new_node->all = all;
-    new_node->ip.family = IPADDR_UNSPEC;
-    new_node->subnet_bits = 0;
-  } else {
-    char *slashpos;
-    slashpos = strchr(p, '/');
-    if (slashpos) *slashpos = 0;
-
-    check_number_of_args(p, 1);
-    n = 0;
-    if (UTI_StringToIP(p, &ip_addr) ||
-        (n = sscanf(p, "%lu.%lu.%lu.%lu", &a, &b, &c, &d)) >= 1) {
-      new_node = (AllowDeny *)ARR_GetNewElement(restrictions);
-      new_node->allow = allow;
-      new_node->all = all;
-
-      if (n == 0) {
-        new_node->ip = ip_addr;
-        if (ip_addr.family == IPADDR_INET6)
-          new_node->subnet_bits = 128;
-        else
-          new_node->subnet_bits = 32;
-      } else {
-        new_node->ip.family = IPADDR_INET4;
-
-        a &= 0xff;
-        b &= 0xff;
-        c &= 0xff;
-        d &= 0xff;
-        
-        switch (n) {
-          case 1:
-            new_node->ip.addr.in4 = (a<<24);
-            new_node->subnet_bits = 8;
-            break;
-          case 2:
-            new_node->ip.addr.in4 = (a<<24) | (b<<16);
-            new_node->subnet_bits = 16;
-            break;
-          case 3:
-            new_node->ip.addr.in4 = (a<<24) | (b<<16) | (c<<8);
-            new_node->subnet_bits = 24;
-            break;
-          case 4:
-            new_node->ip.addr.in4 = (a<<24) | (b<<16) | (c<<8) | d;
-            new_node->subnet_bits = 32;
-            break;
-          default:
-            assert(0);
-        }
-      }
-      
-      if (slashpos) {
-        int specified_subnet_bits, n;
-        n = sscanf(slashpos+1, "%d", &specified_subnet_bits);
-        if (n == 1) {
-          new_node->subnet_bits = specified_subnet_bits;
-        } else {
-          command_parse_error();
-        }
-      }
-
-    } else {
-      if (!slashpos && DNS_Name2IPAddress(p, &ip_addr, 1) == DNS_Success) {
-        new_node = (AllowDeny *)ARR_GetNewElement(restrictions);
-        new_node->allow = allow;
-        new_node->all = all;
-        new_node->ip = ip_addr;
-        if (ip_addr.family == IPADDR_INET6)
-          new_node->subnet_bits = 128;
-        else
-          new_node->subnet_bits = 32;
-      } else {
-        command_parse_error();
-      }      
-    }
-  }
+  node = ARR_GetNewElement(restrictions);
+  node->allow = allow;
+  node->all = all;
+  node->ip = ip;
+  node->subnet_bits = subnet_bits;
 }
   
 /* ================================================== */
@@ -1556,6 +1479,8 @@ parse_hwtimestamp(char *line)
         iface->rxfilter = CNF_HWTS_RXFILTER_NONE;
       else if (!strcasecmp(filter, "ntp"))
         iface->rxfilter = CNF_HWTS_RXFILTER_NTP;
+      else if (!strcasecmp(filter, "ptp"))
+        iface->rxfilter = CNF_HWTS_RXFILTER_PTP;
       else if (!strcasecmp(filter, "all"))
         iface->rxfilter = CNF_HWTS_RXFILTER_ALL;
       else
@@ -1793,6 +1718,8 @@ reload_source_dirs(void)
       if (s == NSR_UnresolvedName) {
         unresolved++;
       } else if (s != NSR_Success) {
+        LOG(LOGS_ERR, "Could not add source %s", source->params.name);
+
         /* Mark the source as not present */
         source->params.name[0] = '\0';
       }
@@ -1864,7 +1791,8 @@ CNF_AddInitSources(void)
     ntp_addr.port = cps_source.port;
     cps_source.params.iburst = 1;
 
-    NSR_AddSource(&ntp_addr, NTP_SERVER, &cps_source.params, NULL);
+    if (NSR_AddSource(&ntp_addr, NTP_SERVER, &cps_source.params, NULL) != NSR_Success)
+      LOG(LOGS_ERR, "Could not add source %s", UTI_IPToString(&ntp_addr.ip_addr));
   }
 
   ARR_SetSize(init_sources, 0);
@@ -1877,11 +1805,16 @@ CNF_AddSources(void)
 {
   NTP_Source *source;
   unsigned int i;
+  NSR_Status s;
 
   for (i = 0; i < ARR_GetSize(ntp_sources); i++) {
     source = (NTP_Source *)ARR_GetElement(ntp_sources, i);
-    NSR_AddSourceByName(source->params.name, source->params.port,
-                        source->pool, source->type, &source->params.params, NULL);
+
+    s = NSR_AddSourceByName(source->params.name, source->params.port, source->pool,
+                            source->type, &source->params.params, NULL);
+    if (s != NSR_Success && s != NSR_UnresolvedName)
+      LOG(LOGS_ERR, "Could not add source %s", source->params.name);
+
     Free(source->params.name);
   }
 
@@ -2551,6 +2484,14 @@ CNF_GetHwTsInterface(unsigned int index, CNF_HwTsInterface **iface)
 
 /* ================================================== */
 
+int
+CNF_GetPtpPort(void)
+{
+  return ptp_port;
+}
+
+/* ================================================== */
+
 char *
 CNF_GetNtsDumpDir(void)
 {

conf.h

@@ -134,6 +134,7 @@ typedef enum {
   CNF_HWTS_RXFILTER_ANY,
   CNF_HWTS_RXFILTER_NONE,
   CNF_HWTS_RXFILTER_NTP,
+  CNF_HWTS_RXFILTER_PTP,
   CNF_HWTS_RXFILTER_ALL,
 } CNF_HwTs_RxFilter;
 
@@ -151,6 +152,8 @@ typedef struct {
 
 extern int CNF_GetHwTsInterface(unsigned int index, CNF_HwTsInterface **iface);
 
+extern int CNF_GetPtpPort(void);
+
 extern char *CNF_GetNtsDumpDir(void);
 extern char *CNF_GetNtsNtpServer(void);
 extern int CNF_GetNtsServerCertAndKeyFiles(const char ***certs, const char ***keys);

configure

@@ -5,7 +5,7 @@
 #
 # Copyright (C) Richard P. Curnow  1997-2003
 # Copyright (C) Bryan Christianson  2016
-# Copyright (C) Miroslav Lichvar  2009, 2012-2020
+# Copyright (C) Miroslav Lichvar  2009, 2012-2021
 # Copyright (C) Stefan R. Filipek  2019
 #
 # =======================================================================
@@ -467,7 +467,7 @@ case $OPERATINGSYSTEM in
     ;;
     SunOS)
         EXTRA_OBJECTS="sys_generic.o sys_solaris.o sys_timex.o sys_posix.o"
-        LIBS="$LIBS -lsocket -lnsl -lresolv"
+        LIBS="$LIBS -lsocket -lnsl -lkvm -lelf -lresolv"
         try_setsched=1
         try_lockmem=1
         add_def SOLARIS
@@ -479,7 +479,7 @@ case $OPERATINGSYSTEM in
           add_def FEAT_PRIVDROP
           priv_ops="ADJUSTTIMEX SETTIME BINDSOCKET"
         fi
-        echo "Configuring for Solaris (" $SYSTEM "SunOS version" $VERSION ")" 
+        echo "Configuring for illumos (" $SYSTEM "SunOS version" $VERSION ")"
     ;;                                                                        
     * )
         echo "error: $SYSTEM is not supported (yet?)"
@@ -934,15 +934,42 @@ if [ $feat_sechash = "1" ] && [ "x$HASH_LINK" = "x" ] && [ $try_tomcrypt = "1" ]
   fi
 fi
 
+if [ $feat_sechash = "1" ] && [ "x$HASH_LINK" = "x" ] && [ $try_gnutls = "1" ]; then
+  test_cflags="`pkg_config --cflags gnutls`"
+  test_link="`pkg_config --libs gnutls`"
+  if test_code 'gnutls' 'gnutls/crypto.h' \
+    "$test_cflags" "$test_link" '
+      return gnutls_hash(NULL, NULL, 0);'
+  then
+    HASH_OBJ="hash_gnutls.o"
+    HASH_LINK="$test_link"
+    MYCPPFLAGS="$MYCPPFLAGS $test_cflags"
+    add_def FEAT_SECHASH
+
+    if test_code 'CMAC in gnutls' 'gnutls/crypto.h' "$test_cflags" "$test_link" \
+      'return gnutls_hmac_init(NULL, GNUTLS_MAC_AES_CMAC_128, NULL, 0);'
+    then
+      add_def HAVE_CMAC
+      EXTRA_OBJECTS="$EXTRA_OBJECTS cmac_gnutls.o"
+      EXTRA_CLI_OBJECTS="$EXTRA_CLI_OBJECTS cmac_gnutls.o"
+    fi
+  fi
+fi
+
 EXTRA_OBJECTS="$EXTRA_OBJECTS $HASH_OBJ"
 EXTRA_CLI_OBJECTS="$EXTRA_CLI_OBJECTS $HASH_OBJ"
 LIBS="$LIBS $HASH_LINK"
 
 if [ $feat_ntp = "1" ] && [ $feat_nts = "1" ] && [ $try_gnutls = "1" ]; then
-  test_cflags="`pkg_config --cflags gnutls`"
-  test_link="`pkg_config --libs gnutls`"
-  if test_code 'gnutls' 'gnutls/gnutls.h' \
-    "$test_cflags" "$test_link" '
+  if [ "$HASH_OBJ" = "hash_gnutls.o" ]; then
+    test_cflags=""
+    test_link=""
+  else
+    test_cflags="`pkg_config --cflags gnutls`"
+    test_link="`pkg_config --libs gnutls`"
+  fi
+  if test_code 'TLS1.3 in gnutls' 'gnutls/gnutls.h' \
+    "$test_cflags" "$test_link $LIBS" '
       return gnutls_init(NULL, 0) + GNUTLS_TLS1_3 +
         gnutls_priority_init2(NULL, "", NULL, GNUTLS_PRIORITY_INIT_DEF_APPEND) +
         gnutls_prf_rfc5705(NULL, 0, "", 0, "", 16, NULL);'
@@ -955,8 +982,8 @@ if [ $feat_ntp = "1" ] && [ $feat_nts = "1" ] && [ $try_gnutls = "1" ]; then
       add_def HAVE_SIV
       add_def HAVE_NETTLE_SIV_CMAC
     else
-      if test_code 'SIV in gnutls' 'gnutls/gnutls.h' \
-        "$test_cflags" "$test_link" '
+      if test_code 'SIV in gnutls' 'gnutls/crypto.h' \
+        "$test_cflags" "$test_link $LIBS" '
           return gnutls_aead_cipher_init(NULL, GNUTLS_CIPHER_AES_128_SIV, NULL);'
       then
         EXTRA_OBJECTS="$EXTRA_OBJECTS siv_gnutls.o"

doc/chrony.conf.adoc

@@ -3,7 +3,7 @@
 // Copyright (C) Richard P. Curnow  1997-2003
 // Copyright (C) Stephen Wadeley  2016
 // Copyright (C) Bryan Christianson  2017
-// Copyright (C) Miroslav Lichvar  2009-2020
+// Copyright (C) Miroslav Lichvar  2009-2021
 //
 // This program is free software; you can redistribute it and/or modify
 // it under the terms of version 2 of the GNU General Public License as
@@ -273,10 +273,11 @@ sources are unreachable.
 *version* _version_:::
 This option sets the NTP version of packets sent to the server. This can be
 useful when the server runs an old NTP implementation that does not respond to
-requests using a newer version. The default version depends on whether a key is
-specified by the *key* option and which authentication hash function the key
-is using. If the output size of the hash function is longer than 160 bits, the
-default version is 3 for compatibility with older *chronyd* servers. Otherwise,
+requests using a newer version. The default version depends on other options.
+If the *extfield* or *xleave* option is used, the default version is 4. If
+those options are not used and the *key* option specifies a key using a hash
+function with output size longer than 160 bits (e.g. SHA256), the default
+version is 3 for compatibility with older *chronyd* servers. In other cases,
 the default version is 4.
 *copy*:::
 This option specifies that the server and client are closely related, their
@@ -287,6 +288,25 @@ This is useful when multiple instances of `chronyd` are running on one computer
 to synchronise the system clock and other instances started with the *-x*
 option to operate as NTP servers for other computers with their NTP clocks
 synchronised to the first instance.
+*extfield* _type_:::
+This option enables an NTPv4 extension field specified by its type as a
+hexadecimal number. It will be included in requests sent to the server and
+processed in received responses if the server supports it. Note that some
+server implementations do not respond to requests containing an unknown
+extension field (*chronyd* as a server responded to such requests since
+version 2.0).
++
+The following extension field can be enabled by this option:
++
+_F323_::::
+This is an experimental extension field for some improvements that were
+proposed for the next version of the NTP protocol (NTPv5). The field contains
+root delay and dispersion in higher resolution and a monotonic receive
+timestamp, which enables a frequency transfer between the server and client. It
+can significantly improve stability of the synchronization. Generally, it
+should be expected to work only between servers and clients running the same
+version of *chronyd*.
+{blank}:::
 
 [[pool]]*pool* _name_ [_option_]...::
 The syntax of this directive is similar to that for the <<server,*server*>>
@@ -1079,7 +1099,11 @@ clock will be off for a longer time. On Linux with the default
 *ignore*:::
 No correction is applied to the clock for the leap second. The clock will be
 corrected later in normal operation when new measurements are made and the
-estimated offset includes the one second error.
+estimated offset includes the one second error. This option is particularly
+useful when multiple *chronyd* instances are running on the system, one
+controlling the system clock and others started with the *-x* option, which
+should rely on the first instance to correct the system clock and ignore it for
+the correction of their own NTP clock running on top of the system clock.
 {blank}::
 +
 When serving time to NTP clients that cannot be configured to correct their
@@ -1218,7 +1242,7 @@ This directive specifies the maximum assumed drift (frequency error) of the
 system clock. It limits the frequency adjustment that *chronyd* is allowed to
 use to correct the measured drift. It is an additional limit to the maximum
 adjustment that can be set by the system driver (100000 ppm on Linux, 500 ppm
-on FreeBSD, NetBSD, and macOS 10.13+, 32500 ppm on Solaris).
+on FreeBSD, NetBSD, and macOS 10.13+, 32500 ppm on illumos).
 +
 By default, the maximum assumed drift is 500000 ppm, i.e. the adjustment is
 limited by the system driver rather than this directive.
@@ -1257,14 +1281,10 @@ all supported systems with the exception of macOS 12 or earlier).
 +
 For each system there is a maximum frequency offset of the clock that can be set
 by the driver. On Linux it is 100000 ppm, on FreeBSD, NetBSD and macOS 10.13+ it
-is 5000 ppm, and on Solaris it is 32500 ppm. Also, due to a kernel limitation,
+is 5000 ppm, and on illumos it is 32500 ppm. Also, due to a kernel limitation,
 setting *maxslewrate* on FreeBSD, NetBSD, macOS 10.13+ to a value between 500
 ppm and 5000 ppm will effectively set it to 500 ppm.
 +
-In early beta releases of macOS 13 this capability is disabled because of a
-system kernel bug. When the kernel bug is fixed, chronyd will detect this and
-re-enable the capability (see above limitations) with no recompilation required.
-+
 By default, the maximum slew rate is set to 83333.333 ppm (one twelfth).
 
 [[tempcomp]]
@@ -1498,9 +1518,12 @@ directive.
 This directive specifies the maximum amount of memory that *chronyd* is allowed
 to allocate for logging of client accesses and the state that *chronyd* as an
 NTP server needs to support the interleaved mode for its clients. The default
-limit is 524288 bytes, which is sufficient for monitoring about four thousand
-clients at the same time. The maximum value is 2^32-1 (4 GB) on 32-bit systems
-and 2^35 (32 GB) on 64-bit systems.
+limit is 524288 bytes, which enables monitoring of up to 4096 IP addresses at
+the same time and holding NTP timestamps for up to 4096 clients using the
+interleaved mode (depending on uniformity of their polling interval). The
+number of addresses and timestamps is always a power of 2. The maximum
+effective value is 2147483648 (2 GB), which corresponds to 16777216 addresses
+and timestamps.
 +
 An example of the use of this directive is:
 +
@@ -1604,7 +1627,8 @@ The port will be open only when a certificate and key is specified by the
 This directive specifies a file containing a certificate in the PEM format
 for *chronyd* to operate as an NTS server. The file should also include
 any intermediate certificates that the clients will need to validate the
-server's certificate.
+server's certificate. The file needs to be readable by the user under which
+*chronyd* is running after dropping root privileges.
 +
 This directive can be used multiple times to specify multiple certificates for
 different names of the server.
@@ -1616,7 +1640,9 @@ recommended for a near-seamless server operation.
 
 [[ntsserverkey]]*ntsserverkey* _file_::
 This directive specifies a file containing a private key in the PEM format
-for *chronyd* to operate as an NTS server.
+for *chronyd* to operate as an NTS server. The file needs to be readable by
+the user under which *chronyd* is running after dropping root privileges. For
+security reasons, it should not be readable by other users.
 +
 This directive can be used multiple times to specify multiple keys. The number
 of keys must be the same as the number of certificates and the corresponding
@@ -1710,20 +1736,20 @@ directive.
 The *ratelimit* directive supports a number of options (which can be defined
 in any order):
 +
-*interval*:::
+*interval* _interval_:::
 This option sets the minimum interval between responses. It is defined as a
 power of 2 in seconds. The default value is 3 (8 seconds). The minimum value
 is -19 (524288 packets per second) and the maximum value is 12 (one packet per
 4096 seconds). Note that with values below -4 the rate limiting is coarse
 (responses are allowed in bursts, even if the interval between them is shorter
 than the specified interval).
-*burst*:::
+*burst* _responses_:::
 This option sets the maximum number of responses that can be sent in a burst,
 temporarily exceeding the limit specified by the *interval* option. This is
 useful for clients that make rapid measurements on start (e.g. *chronyd* with
 the *iburst* option). The default value is 8. The minimum value is 1 and the
 maximum value is 255.
-*leak*:::
+*leak* _rate_:::
 This option sets the rate at which responses are randomly allowed even if the
 limits specified by the *interval* and *burst* options are exceeded. This is
 necessary to prevent an attacker who is sending requests with a spoofed
@@ -2362,7 +2388,7 @@ timestamping, which can be verified with the *ethtool -T* command. The list of
 capabilities should include _SOF_TIMESTAMPING_RAW_HARDWARE_,
 _SOF_TIMESTAMPING_TX_HARDWARE_, and _SOF_TIMESTAMPING_RX_HARDWARE_. Receive
 filter _HWTSTAMP_FILTER_ALL_, or _HWTSTAMP_FILTER_NTP_ALL_, is necessary for
-timestamping of received packets. Timestamping of packets received from bridged
+timestamping of received NTP packets. Timestamping of packets received on bridged
 and bonded interfaces is supported on Linux 4.13 and newer. When *chronyd* is
 running, no other process (e.g. a PTP daemon) should be working with the NIC
 clock.
@@ -2413,15 +2439,19 @@ _all_::::
 Enables timestamping of all received packets.
 _ntp_::::
 Enables timestamping of received NTP packets.
+_ptp_::::
+Enables timestamping of received PTP packets.
 _none_::::
 Disables timestamping of received packets.
 {blank}:::
-The most specific filter for timestamping NTP packets which is supported by the
-NIC is selected by default. Some NICs can timestamp only PTP packets, which
-limits the selection to the _none_ filter. Forcing timestamping of all packets
-with the _all_ filter when the NIC supports both _all_ and _ntp_ filters can be
-useful when packets are received from or on a non-standard UDP port (e.g.
-specified by the *port* directive).
+The most specific filter for timestamping of NTP packets supported by the NIC
+is selected by default. Some NICs can timestamp PTP packets only. By default,
+they will be configured with the _none_ filter and expected to provide hardware
+timestamps for transmitted packets only. Timestamping of PTP packets is useful
+with NTP-over-PTP enabled by the <<chrony.conf.adoc#ptpport,*ptpport*>>
+directive. Forcing timestamping of all packets with the _all_ filter could be
+useful if the NIC supported both the _all_ and _ntp_ filters, and it should
+timestamp both NTP and PTP packets, or NTP packets on a different UDP port.
 {blank}::
 +
 Examples of the directive are:
@@ -2496,12 +2526,9 @@ under which *chronyd* is normally running (to allow *chronyd* to re-read the
 file when the <<chronyc.adoc#rekey,*rekey*>> command is issued by *chronyc*).
 
 [[lock_all]]*lock_all*::
-The *lock_all* directive will lock chronyd into RAM so that it will never be
-paged out. This mode is supported on Linux, FreeBSD, NetBSD, and Solaris.  This
-directive uses the POSIX *mlockall()* system call to prevent *chronyd* from
-ever being swapped out. This should result in lower and more consistent
-latency. It should not have significant impact on performance as *chronyd's*
-memory usage is modest. The *mlockall(2)* man page has more details.
+The *lock_all* directive will lock the *chronyd* process into RAM so that it
+will never be paged out. This can result in lower and more consistent latency.
+The directive is supported on Linux, FreeBSD, NetBSD, and illumos.
 
 [[pidfile]]*pidfile* _file_::
 Unless *chronyd* is started with the *-Q* option, it writes its process ID
@@ -2514,8 +2541,34 @@ e.g.:
 pidfile /run/chronyd.pid
 ----
 
+[[ptpport]]*ptpport* _port_::
+The *ptpport* directive enables *chronyd* to send and receive NTP messages
+contained in PTP event messages (NTP-over-PTP) to enable hardware timestamping
+on NICs which cannot timestamp NTP packets, but can timestamp unicast PTP
+packets. The port recognized by the NICs is 319 (PTP event port). The default
+value is 0 (disabled).
++
+The NTP-over-PTP support is experimental. The protocol and configuration can
+change in future. It should be used only in local networks and expected to work
+only between servers and clients running the same version of *chronyd*.
++
+The PTP port will be open even if *chronyd* is not configured to operate as a
+server or client. The directive does not change the default protocol of
+specified NTP sources. Each NTP source that should use NTP-over-PTP needs to
+be specified with the *port* option set to the PTP port. To actually enable
+hardware timestamping on NICs which can timestamp PTP packets only, the
+*rxfilter* option of the *hwtimestamp* directive needs to be set to _ptp_.
++
+An example of client configuration is:
++
+----
+server foo.example.net minpoll 0 maxpoll 0 xleave port 319
+hwtimestamp * rxfilter ptp
+ptpport 319
+----
+
 [[sched_priority]]*sched_priority* _priority_::
-On Linux, FreeBSD, NetBSD, and Solaris, the *sched_priority* directive will
+On Linux, FreeBSD, NetBSD, and illumos, the *sched_priority* directive will
 select the SCHED_FIFO real-time scheduler at the specified priority (which must
 be between 0 and 100). On macOS, this option must have either a value of 0 (the
 default) to disable the thread time constraint policy or 1 for the policy to be
@@ -2541,7 +2594,7 @@ The *user* directive sets the name of the system user to which *chronyd* will
 switch after start in order to drop root privileges.
 +
 On Linux, *chronyd* needs to be compiled with support for the *libcap* library.
-On macOS, FreeBSD, NetBSD and Solaris *chronyd* forks into two processes.
+On macOS, FreeBSD, NetBSD and illumos *chronyd* forks into two processes.
 The child process retains root privileges, but can only perform a very limited
 range of privileged system calls on behalf of the parent.
 +

doc/chronyc.adoc

@@ -1107,13 +1107,9 @@ The columns are as follows:
   received/accepted.
 
 [[serverstats]]*serverstats*::
-The *serverstats* command displays how many valid NTP and command requests, and
-NTS-KE connections, *chronyd* operating as a server received from clients, and
-how many of them were dropped due to rate limiting. It also displays how many
-client log records were dropped due to the memory limit configured by the
-<<chrony.conf.adoc#clientloglimit,*clientloglimit*>> directive and how many of
-the NTP requests (from those which were not dropped) were authenticated. An
-example of the output is shown below.
+The *serverstats* command displays NTP and command server statistics.
++
+An example of the output is shown below.
 +
 ----
 NTP packets received       : 1598
@@ -1124,7 +1120,47 @@ Client log records dropped : 0
 NTS-KE connections accepted: 3
 NTS-KE connections dropped : 0
 Authenticated NTP packets  : 189
+Interleaved NTP packets    : 43
+NTP timestamps held        : 44
+NTP timestamp span         : 120
 ----
++
+The fields have the following meaning:
++
+*NTP packets received*:::
+The number of valid NTP requests received by the server.
+*NTP packets dropped*:::
+The number of NTP requests dropped by the server due to rate limiting
+(configured by the <<chrony.conf.adoc#ratelimit,*ratelimit*>> directive).
+*Command packets received*:::
+The number of command requests received by the server.
+*Command packets dropped*:::
+The number of command requests dropped by the server due to rate limiting
+(configured by the <<chrony.conf.adoc#cmdratelimit,*cmdratelimit*>> directive).
+*Client log records dropped*:::
+The number of client log records dropped by the server to limit the memory use
+(configured by the <<chrony.conf.adoc#clientloglimit,*clientloglimit*>>
+directive).
+*NTS-KE connections accepted*:::
+The number of NTS-KE connections accepted by the server.
+*NTS-KE connections dropped*:::
+The number of NTS-KE connections dropped by the server due to rate limiting
+(configured by the <<chrony.conf.adoc#ntsratelimit,*ntsratelimit*>> directive).
+*Authenticated NTP packets*:::
+The number of received NTP requests that were authenticated (with a symmetric
+key or NTS).
+*Interleaved NTP packets*:::
+The number of received NTP requests that were detected to be in the interleaved
+mode.
+*NTP timestamps held*:::
+The number of pairs of receive and transmit timestamps that the server is
+currently holding in memory for clients using the interleaved mode.
+*NTP timestamp span*:::
+The interval (in seconds) covered by the currently held NTP timestamps.
+{blank}::
++
+Note that the numbers reported by this overflow to zero after 4294967295
+(32-bit values).
 
 [[allow]]*allow* [*all*] [_subnet_]::
 The effect of the allow command is identical to the

doc/chronyd.adoc

@@ -100,7 +100,7 @@ directive in the configuration file. This option is useful if you want to stop
 and restart *chronyd* briefly for any reason, e.g. to install a new version.
 However, it should be used only on systems where the kernel can maintain clock
 compensation whilst not under *chronyd*'s control (i.e. Linux, FreeBSD, NetBSD,
-Solaris, and macOS 10.13 or later).
+illumos, and macOS 10.13 or later).
 
 *-R*::
 When this option is used, the <<chrony.conf.adoc#initstepslew,*initstepslew*>>
@@ -141,7 +141,7 @@ after start in order to drop root privileges. It overrides the
 _@DEFAULT_USER@_.
 +
 On Linux, *chronyd* needs to be compiled with support for the *libcap* library.
-On macOS, FreeBSD, NetBSD and Solaris *chronyd* forks into two processes.
+On macOS, FreeBSD, NetBSD, and illumos *chronyd* forks into two processes.
 The child process retains root privileges, but can only perform a very limited
 range of privileged system calls on behalf of the parent.
 
@@ -156,29 +156,40 @@ not recommended when the configuration is not known, or at least limited to
 specific directives.
 
 *-F* _level_::
-This option configures a system call filter when *chronyd* is compiled with
-support for the Linux secure computing (seccomp) facility. In level 1 the
-process is killed when a forbidden system call is made, in level -1 the SIGSYS
-signal is thrown instead and in level 0 the filter is disabled. The default
-value is 0.
+This option configures system call filters loaded by *chronyd* processes if it
+was compiled with support for the Linux secure computing (seccomp) facility.
+Three levels are defined: 0, 1, 2. The filters are disabled at level 0. At
+levels 1 and 2, *chronyd* will be killed if it makes a system call which is
+blocked by the filters. The level can be specified as a negative number to
+trigger the SIGSYS signal instead of SIGKILL, which can be useful for
+debugging. The default value is 0.
 +
-It is recommended to enable the filter only when it is known to work on the
-version of the system where *chrony* is installed as the filter needs to allow
-also system calls made from libraries that *chronyd* is using (e.g. libc) and
-different versions or implementations of the libraries might make different
-system calls. If the filter is missing some system call, *chronyd* could be
-killed even in normal operation.
+At level 1, the filters allow only selected system calls that are normally
+expected to be made by *chronyd*. Other system calls are blocked. This level is
+recommended only if it is known to work on the version of the system where
+*chrony* is installed. The filters need to allow also system calls made by
+libraries that *chronyd* is using (e.g. libc), but different versions or
+implementations of the libraries might make different system calls. If the
+filters are missing a system call, *chronyd* could be killed even in normal
+operation.
++
+At level 2, the filters block only a small number of specific system calls
+(e.g. fork and exec). This approach should avoid false positives, but the
+protection of the system against a compromised *chronyd* process is much more
+limited.
++
+The filters cannot be enabled with the *mailonchange* directive.
 
 *-P* _priority_::
-On Linux, this option will select the SCHED_FIFO real-time scheduler at the
-specified priority (which must be between 0 and 100). On macOS, this option
-must have either a value of 0 to disable the thread time
-constraint policy or 1 for the policy to be enabled. Other systems do not
+On Linux, FreeBSD, NetBSD, and illumos this option will select the SCHED_FIFO
+real-time scheduler at the specified priority (which must be between 0 and
+100). On macOS, this option must have either a value of 0 to disable the thread
+time constraint policy or 1 for the policy to be enabled. Other systems do not
 support this option. The default value is 0.
 
 *-m*::
 This option will lock *chronyd* into RAM so that it will never be paged out.
-This mode is only supported on Linux.
+This mode is only supported on Linux, FreeBSD, NetBSD, and illumos.
 
 *-x*::
 This option disables the control of the system clock. *chronyd* will not try to

doc/faq.adoc

@@ -1,7 +1,7 @@
 // This file is part of chrony
 //
 // Copyright (C) Richard P. Curnow  1997-2003
-// Copyright (C) Miroslav Lichvar  2014-2016, 2020
+// Copyright (C) Miroslav Lichvar  2014-2016, 2020-2021
 //
 // This program is free software; you can redistribute it and/or modify
 // it under the terms of version 2 of the GNU General Public License as
@@ -345,6 +345,15 @@ server ntp.local minpoll -6 maxpoll -6 filter 15 xleave
 hwtimestamp eth0 minpoll -6
 ----
 
+As an experimental feature added in version 4.2, `chronyd` supports an NTPv4
+extension field containing an additional timestamp to enable frequency transfer
+and significantly improve stability of synchronisation. It can be enabled by
+the `extfield F323` option. For example:
+
+----
+server ntp.local minpoll 0 maxpoll 0 xleave extfield F323
+----
+
 === Does `chronyd` have an ntpdate mode?
 
 Yes. With the `-q` option `chronyd` will set the system clock once and exit.
@@ -468,7 +477,8 @@ leap seconds from other sources (e.g. with the `leapsectz` directive in
 
 === Does `chrony` support PTP?
 
-No, the Precision Time Protocol (PTP) is not supported and there are no plans
+No, the Precision Time Protocol (PTP) is not supported as a protocol for
+synchronisation of clocks and there are no plans
 to support it. It is a complex protocol, which shares some issues with the
 NTP broadcast mode. One of the main differences between NTP and PTP is that PTP
 was designed to be easily supported in hardware (e.g. network switches and
@@ -483,6 +493,11 @@ packets (enabled by the `hwtimestamp` directive) if the NIC can timestamp other
 packets than PTP, which is usually the case at least for transmitted packets.
 The `ethtool -T` command can be used to verify the timestamping support.
 
+As an experimental feature added in version 4.2, `chrony` can use PTP as a
+transport for NTP messages (NTP over PTP) to enable hardware timestamping on
+hardware which can timestamp PTP packets only. It can be enabled by the
+`ptpport` directive.
+
 === What happened to the `commandkey` and `generatecommandkey` directives?
 
 They were removed in version 2.2. Authentication is no longer supported in the

examples/chrony-wait.service

@@ -16,5 +16,32 @@ TimeoutStartSec=180
 RemainAfterExit=yes
 StandardOutput=null
 
+CapabilityBoundingSet=
+DevicePolicy=closed
+DynamicUser=yes
+IPAddressAllow=localhost
+IPAddressDeny=any
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+PrivateDevices=yes
+PrivateUsers=yes
+ProcSubset=pid
+ProtectClock=yes
+ProtectControlGroups=yes
+ProtectHome=yes
+ProtectHostname=yes
+ProtectKernelLogs=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+ProtectProc=invisible
+ProtectSystem=strict
+RestrictAddressFamilies=AF_INET AF_INET6
+RestrictNamespaces=yes
+RestrictRealtime=yes
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallFilter=~@privileged @resources
+UMask=0777
+
 [Install]
 WantedBy=multi-user.target

examples/chronyd.service

@@ -10,9 +10,40 @@ Type=forking
 PIDFile=/run/chrony/chronyd.pid
 EnvironmentFile=-/etc/sysconfig/chronyd
 ExecStart=/usr/sbin/chronyd $OPTIONS
+
+CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
+CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_KILL CAP_LEASE CAP_LINUX_IMMUTABLE
+CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE CAP_MKNOD CAP_SYS_ADMIN
+CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_CHROOT CAP_SYS_MODULE CAP_SYS_PACCT
+CapabilityBoundingSet=~CAP_SYS_PTRACE CAP_SYS_RAWIO CAP_SYS_TTY_CONFIG CAP_WAKE_ALARM
+DeviceAllow=char-pps rw
+DeviceAllow=char-ptp rw
+DeviceAllow=char-rtc rw
+DevicePolicy=closed
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+NoNewPrivileges=yes
 PrivateTmp=yes
+ProcSubset=pid
+ProtectControlGroups=yes
 ProtectHome=yes
-ProtectSystem=full
+ProtectHostname=yes
+ProtectKernelLogs=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+ProtectProc=invisible
+ProtectSystem=strict
+ReadWritePaths=/run /var/lib/chrony -/var/log
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+RestrictNamespaces=yes
+RestrictSUIDSGID=yes
+SystemCallArchitectures=native
+SystemCallFilter=~@cpu-emulation @debug @module @mount @obsolete @raw-io @reboot @swap
+
+# Adjust restrictions for /usr/sbin/sendmail (mailonchange directive)
+NoNewPrivileges=no
+ReadWritePaths=-/var/spool
+RestrictAddressFamilies=AF_NETLINK
 
 [Install]
 WantedBy=multi-user.target

hash.h

@@ -44,6 +44,7 @@ typedef enum {
   HSH_SHA3_512 = 9,
   HSH_TIGER = 10,
   HSH_WHIRLPOOL = 11,
+  HSH_MD5_NONCRYPTO = 10000, /* For NTPv4 reference ID */
 } HSH_Algorithm;
 
 extern int HSH_GetHashId(HSH_Algorithm algorithm);

hash_gnutls.c

@@ -0,0 +1,145 @@
+/*
+  chronyd/chronyc - Programs for keeping computer clocks accurate.
+
+ **********************************************************************
+ * Copyright (C) Miroslav Lichvar  2021
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ *
+ **********************************************************************
+
+  =======================================================================
+
+  Crypto hashing using the GnuTLS library
+  */
+
+#include "config.h"
+
+#include "sysincl.h"
+
+#include <gnutls/crypto.h>
+
+#include "hash.h"
+#include "logging.h"
+
+struct hash {
+  const HSH_Algorithm algorithm;
+  const gnutls_digest_algorithm_t type;
+  gnutls_hash_hd_t handle;
+};
+
+static struct hash hashes[] = {
+  { HSH_MD5_NONCRYPTO, GNUTLS_DIG_MD5, NULL },
+  { HSH_MD5, GNUTLS_DIG_MD5, NULL },
+  { HSH_SHA1, GNUTLS_DIG_SHA1, NULL },
+  { HSH_SHA256, GNUTLS_DIG_SHA256, NULL },
+  { HSH_SHA384, GNUTLS_DIG_SHA384, NULL },
+  { HSH_SHA512, GNUTLS_DIG_SHA512, NULL },
+  { HSH_SHA3_224, GNUTLS_DIG_SHA3_224, NULL },
+  { HSH_SHA3_256, GNUTLS_DIG_SHA3_256, NULL },
+  { HSH_SHA3_384, GNUTLS_DIG_SHA3_384, NULL },
+  { HSH_SHA3_512, GNUTLS_DIG_SHA3_512, NULL },
+  { 0, 0, NULL }
+};
+
+static int gnutls_initialised = 0;
+
+int
+HSH_GetHashId(HSH_Algorithm algorithm)
+{
+  int id, r;
+
+  if (!gnutls_initialised) {
+    r = gnutls_global_init();
+    if (r < 0)
+      LOG_FATAL("Could not initialise %s : %s", "gnutls", gnutls_strerror(r));
+    gnutls_initialised = 1;
+  }
+
+  for (id = 0; hashes[id].algorithm != 0; id++) {
+    if (hashes[id].algorithm == algorithm)
+      break;
+  }
+
+  if (hashes[id].algorithm == 0)
+    return -1;
+
+  if (hashes[id].handle)
+    return id;
+
+  if (algorithm == HSH_MD5_NONCRYPTO)
+    GNUTLS_FIPS140_SET_LAX_MODE();
+
+  r = gnutls_hash_init(&hashes[id].handle, hashes[id].type);
+
+  if (algorithm == HSH_MD5_NONCRYPTO)
+    GNUTLS_FIPS140_SET_STRICT_MODE();
+
+  if (r < 0) {
+    DEBUG_LOG("Could not initialise %s : %s", "hash", gnutls_strerror(r));
+    hashes[id].handle = NULL;
+    return -1;
+  }
+
+  return id;
+}
+
+int
+HSH_Hash(int id, const void *in1, int in1_len, const void *in2, int in2_len,
+         unsigned char *out, int out_len)
+{
+  unsigned char buf[MAX_HASH_LENGTH];
+  gnutls_hash_hd_t handle;
+  int hash_len;
+
+  if (in1_len < 0 || in2_len < 0 || out_len < 0)
+    return 0;
+
+  handle = hashes[id].handle;
+  hash_len = gnutls_hash_get_len(hashes[id].type);
+
+  if (out_len > hash_len)
+    out_len = hash_len;
+
+  if (hash_len > sizeof (buf))
+    return 0;
+
+  if (gnutls_hash(handle, in1, in1_len) < 0 ||
+      (in2 && gnutls_hash(handle, in2, in2_len) < 0)) {
+    /* Reset the state */
+    gnutls_hash_output(handle, buf);
+    return 0;
+  }
+
+  gnutls_hash_output(handle, buf);
+  memcpy(out, buf, out_len);
+
+  return out_len;
+}
+
+void
+HSH_Finalise(void)
+{
+  int i;
+
+  if (!gnutls_initialised)
+    return;
+
+  for (i = 0; hashes[i].algorithm != 0; i++) {
+    if (hashes[i].handle)
+      gnutls_hash_deinit(hashes[i].handle, NULL);
+  }
+
+  gnutls_global_deinit();
+}

hash_intmd5.c

@@ -39,7 +39,7 @@ int
 HSH_GetHashId(HSH_Algorithm algorithm)
 {
   /* only MD5 is supported */
-  if (algorithm != HSH_MD5)
+  if (algorithm != HSH_MD5 && algorithm != HSH_MD5_NONCRYPTO)
     return -1;
 
   return 0;

hash_nettle.c

@@ -59,6 +59,9 @@ HSH_GetHashId(HSH_Algorithm algorithm)
 {
   int id, nid;
 
+  if (algorithm == HSH_MD5_NONCRYPTO)
+    algorithm = HSH_MD5;
+
   for (id = 0; hashes[id].algorithm != 0; id++) {
     if (hashes[id].algorithm == algorithm)
       break;

hash_nss.c

@@ -56,6 +56,9 @@ HSH_GetHashId(HSH_Algorithm algorithm)
 {
   int i;
 
+  if (algorithm == HSH_MD5_NONCRYPTO)
+    algorithm = HSH_MD5;
+
   for (i = 0; hashes[i].algorithm != 0; i++) {
     if (hashes[i].algorithm == algorithm)
       break;

hash_tomcrypt.c

@@ -71,6 +71,9 @@ HSH_GetHashId(HSH_Algorithm algorithm)
 {
   int i, h;
 
+  if (algorithm == HSH_MD5_NONCRYPTO)
+    algorithm = HSH_MD5;
+
   for (i = 0; hashes[i].algorithm != 0; i++) {
     if (hashes[i].algorithm == algorithm)
       break;

main.c

@@ -76,11 +76,18 @@ static REF_Mode ref_mode = REF_ModeNormal;
 static void
 do_platform_checks(void)
 {
+  struct timespec ts;
+
   /* Require at least 32-bit integers, two's complement representation and
      the usual implementation of conversion of unsigned integers */
   assert(sizeof (int) >= 4);
   assert(-1 == ~0);
   assert((int32_t)4294967295U == (int32_t)-1);
+
+  /* Require time_t and tv_nsec in timespec to be signed */
+  ts.tv_sec = -1;
+  ts.tv_nsec = -1;
+  assert(ts.tv_sec < 0 && ts.tv_nsec < 0);
 }
 
 /* ================================================== */
@@ -141,6 +148,8 @@ MAI_CleanupAndExit(void)
   HSH_Finalise();
   LOG_Finalise();
 
+  UTI_ResetGetRandomFunctions();
+
   exit(exit_status);
 }
 

ntp.h

@@ -113,6 +113,30 @@ typedef struct {
 #define NTP_REFID_LOCAL 0x7F7F0101UL /* 127.127.1.1 */
 #define NTP_REFID_SMOOTH 0x7F7F01FFUL /* 127.127.1.255 */
 
+/* Non-authentication extension fields and corresponding internal flags */
+
+#define NTP_EF_EXP1                     0xF323
+
+#define NTP_EF_FLAG_EXP1                0x1
+
+/* Pre-NTPv5 experimental extension field */
+typedef struct {
+  uint32_t magic;
+  NTP_int32 root_delay;
+  NTP_int32 root_dispersion;
+  NTP_int64 mono_receive_ts;
+  uint32_t mono_epoch;
+} NTP_ExtFieldExp1;
+
+#define NTP_EF_EXP1_MAGIC 0xF5BEDD9AU
+
+/* Authentication extension fields */
+
+#define NTP_EF_NTS_UNIQUE_IDENTIFIER    0x0104
+#define NTP_EF_NTS_COOKIE               0x0204
+#define NTP_EF_NTS_COOKIE_PLACEHOLDER   0x0304
+#define NTP_EF_NTS_AUTH_AND_EEF         0x0404
+
 /* Enumeration for authentication modes of NTP packets */
 typedef enum {
   NTP_AUTH_NONE = 0,            /* No authentication */
@@ -130,6 +154,7 @@ typedef struct {
   NTP_Mode mode;
 
   int ext_fields;
+  int ext_field_flags;
 
   struct {
     NTP_AuthMode mode;

ntp_auth.c

@@ -32,7 +32,6 @@
 #include "logging.h"
 #include "memory.h"
 #include "ntp_auth.h"
-#include "ntp_ext.h"
 #include "ntp_signd.h"
 #include "nts_ntp.h"
 #include "nts_ntp_client.h"
@@ -105,19 +104,6 @@ check_symmetric_auth(NTP_Packet *packet, NTP_PacketInfo *info)
 
 /* ================================================== */
 
-static int
-is_zero_data(unsigned char *data, int length)
-{
-  int i;
-
-  for (i = 0; i < length; i++)
-    if (data[i] != 0)
-      return 0;
-  return 1;
-}
-
-/* ================================================== */
-
 static NAU_Instance
 create_instance(NTP_AuthMode mode)
 {
@@ -247,101 +233,6 @@ NAU_GenerateRequestAuth(NAU_Instance instance, NTP_Packet *request, NTP_PacketIn
 
 /* ================================================== */
 
-int
-NAU_ParsePacket(NTP_Packet *packet, NTP_PacketInfo *info)
-{
-  int parsed, remainder, ef_length, ef_type;
-  unsigned char *data;
-
-  data = (void *)packet;
-  parsed = NTP_HEADER_LENGTH;
-  remainder = info->length - parsed;
-
-  info->ext_fields = 0;
-
-  /* Check if this is a plain NTP packet with no extension fields or MAC */
-  if (remainder <= 0)
-    return 1;
-
-  assert(remainder % 4 == 0);
-
-  /* In NTPv3 and older packets don't have extension fields.  Anything after
-     the header is assumed to be a MAC. */
-  if (info->version <= 3) {
-    info->auth.mode = NTP_AUTH_SYMMETRIC;
-    info->auth.mac.start = parsed;
-    info->auth.mac.length = remainder;
-    info->auth.mac.key_id = ntohl(*(uint32_t *)(data + parsed));
-
-    /* Check if it is an MS-SNTP authenticator field or extended authenticator
-       field with zeroes as digest */
-    if (info->version == 3 && info->auth.mac.key_id != 0) {
-      if (remainder == 20 && is_zero_data(data + parsed + 4, remainder - 4))
-        info->auth.mode = NTP_AUTH_MSSNTP;
-      else if (remainder == 72 && is_zero_data(data + parsed + 8, remainder - 8))
-        info->auth.mode = NTP_AUTH_MSSNTP_EXT;
-    }
-
-    return 1;
-  }
-
-  /* Check for a crypto NAK */
-  if (remainder == 4 && ntohl(*(uint32_t *)(data + parsed)) == 0) {
-    info->auth.mode = NTP_AUTH_SYMMETRIC;
-    info->auth.mac.start = parsed;
-    info->auth.mac.length = remainder;
-    info->auth.mac.key_id = 0;
-    return 1;
-  }
-
-  /* Parse the rest of the NTPv4 packet */
-
-  while (remainder > 0) {
-    /* Check if the remaining data is a MAC */
-    if (remainder >= NTP_MIN_MAC_LENGTH && remainder <= NTP_MAX_V4_MAC_LENGTH)
-      break;
-
-    /* Check if this is a valid NTPv4 extension field and skip it */
-    if (!NEF_ParseField(packet, info->length, parsed, &ef_length, &ef_type, NULL, NULL)) {
-      DEBUG_LOG("Invalid format");
-      return 0;
-    }
-
-    assert(ef_length > 0 && ef_length % 4 == 0);
-
-    switch (ef_type) {
-      case NTP_EF_NTS_UNIQUE_IDENTIFIER:
-      case NTP_EF_NTS_COOKIE:
-      case NTP_EF_NTS_COOKIE_PLACEHOLDER:
-      case NTP_EF_NTS_AUTH_AND_EEF:
-        info->auth.mode = NTP_AUTH_NTS;
-        break;
-      default:
-        DEBUG_LOG("Unknown extension field type=%x", (unsigned int)ef_type);
-    }
-
-    info->ext_fields++;
-    parsed += ef_length;
-    remainder = info->length - parsed;
-  }
-
-  if (remainder == 0) {
-    /* No MAC */
-    return 1;
-  } else if (remainder >= NTP_MIN_MAC_LENGTH) {
-    info->auth.mode = NTP_AUTH_SYMMETRIC;
-    info->auth.mac.start = parsed;
-    info->auth.mac.length = remainder;
-    info->auth.mac.key_id = ntohl(*(uint32_t *)(data + parsed));
-    return 1;
-  }
-
-  DEBUG_LOG("Invalid format");
-  return 0;
-}
-
-/* ================================================== */
-
 int
 NAU_CheckRequestAuth(NTP_Packet *request, NTP_PacketInfo *info, uint32_t *kod)
 {

ntp_auth.h

@@ -55,9 +55,6 @@ extern int NAU_PrepareRequestAuth(NAU_Instance instance);
 extern int NAU_GenerateRequestAuth(NAU_Instance instance, NTP_Packet *request,
                                    NTP_PacketInfo *info);
 
-/* Parse a request or response to detect the authentication mode */
-extern int NAU_ParsePacket(NTP_Packet *packet, NTP_PacketInfo *info);
-
 /* Verify that a request is authentic.  If it is not authentic and a non-zero
    kod code is returned, a KoD response should be sent back. */
 extern int NAU_CheckRequestAuth(NTP_Packet *request, NTP_PacketInfo *info, uint32_t *kod);

ntp_core.c

@@ -3,7 +3,7 @@
 
  **********************************************************************
  * Copyright (C) Richard P. Curnow  1997-2003
- * Copyright (C) Miroslav Lichvar  2009-2020
+ * Copyright (C) Miroslav Lichvar  2009-2021
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -32,6 +32,7 @@
 #include "array.h"
 #include "ntp_auth.h"
 #include "ntp_core.h"
+#include "ntp_ext.h"
 #include "ntp_io.h"
 #include "memory.h"
 #include "sched.h"
@@ -88,6 +89,8 @@ struct NCR_Instance_Record {
                                    from received packets) */
   int remote_stratum;           /* Stratum of the server/peer (recovered from
                                    received packets) */
+  double remote_root_delay;     /* Root delay from last valid packet */
+  double remote_root_dispersion;/* Root dispersion from last valid packet */
 
   int presend_minpoll;           /* If the current polling interval is
                                     at least this, an extra client packet
@@ -129,6 +132,12 @@ struct NCR_Instance_Record {
   double offset_correction;     /* Correction applied to measured offset
                                    (e.g. for asymmetry in network delay) */
 
+  int ext_field_flags;          /* Enabled extension fields */
+
+  uint32_t remote_mono_epoch;   /* ID of the source's monotonic scale */
+  double mono_doffset;          /* Accumulated offset between source's
+                                   real-time and monotonic scales */
+
   NAU_Instance auth;            /* Authentication */
 
   /* Count of transmitted packets since last valid response */
@@ -142,6 +151,7 @@ struct NCR_Instance_Record {
   int valid_timestamps;
 
   /* Receive and transmit timestamps from the last valid response */
+  NTP_int64 remote_ntp_monorx;
   NTP_int64 remote_ntp_rx;
   NTP_int64 remote_ntp_tx;
 
@@ -278,6 +288,9 @@ static ARR_Instance broadcasts;
    interleaved mode to prefer a sample using previous timestamps */
 #define MAX_INTERLEAVED_L2L_RATIO 0.1
 
+/* Maximum acceptable change in server mono<->real offset */
+#define MAX_MONO_DOFFSET 16.0
+
 /* Invalid socket, different from the one in ntp_io.c */
 #define INVALID_SOCK_FD -2
 
@@ -289,6 +302,11 @@ static int server_sock_fd6;
 
 static ADF_AuthTable access_auth_table;
 
+/* Current offset between monotonic and cooked time, and its epoch ID
+   which is reset on clock steps */
+static double server_mono_offset;
+static uint32_t server_mono_epoch;
+
 /* Characters for printing synchronisation status and timestamping source */
 static const char leap_chars[4] = {'N', '+', '-', '?'};
 static const char tss_chars[3] = {'D', 'K', 'H'};
@@ -375,6 +393,20 @@ zero_local_timestamp(NTP_Local_Timestamp *ts)
 
 /* ================================================== */
 
+static void
+handle_slew(struct timespec *raw, struct timespec *cooked, double dfreq,
+            double doffset, LCL_ChangeType change_type, void *anything)
+{
+  if (change_type == LCL_ChangeAdjust) {
+    server_mono_offset += doffset;
+  } else {
+    UTI_GetRandomBytes(&server_mono_epoch, sizeof (server_mono_epoch));
+    server_mono_offset = 0.0;
+  }
+}
+
+/* ================================================== */
+
 void
 NCR_Initialise(void)
 {
@@ -391,6 +423,9 @@ NCR_Initialise(void)
   /* Server socket will be opened when access is allowed */
   server_sock_fd4 = INVALID_SOCK_FD;
   server_sock_fd6 = INVALID_SOCK_FD;
+
+  LCL_AddParameterChangeHandler(handle_slew, NULL);
+  handle_slew(NULL, NULL, 0.0, 0.0, LCL_ChangeUnknownStep, NULL);
 }
 
 /* ================================================== */
@@ -400,6 +435,8 @@ NCR_Finalise(void)
 {
   unsigned int i;
 
+  LCL_RemoveParameterChangeHandler(handle_slew, NULL);
+
   if (server_sock_fd4 != INVALID_SOCK_FD)
     NIO_CloseServerSocket(server_sock_fd4);
   if (server_sock_fd6 != INVALID_SOCK_FD)
@@ -456,11 +493,16 @@ start_initial_timeout(NCR_Instance inst)
   /* In case the offline period was too short, adjust the delay to keep
      the interval between packets at least as long as the current polling
      interval */
-  SCH_GetLastEventTime(&now, NULL, NULL);
-  last_tx = UTI_DiffTimespecsToDouble(&now, &inst->local_tx.ts);
-  if (last_tx < 0.0)
-    last_tx = 0.0;
-  delay = get_transmit_delay(inst, 0, 0.0) - last_tx;
+  if (!UTI_IsZeroTimespec(&inst->local_tx.ts)) {
+    SCH_GetLastEventTime(&now, NULL, NULL);
+    last_tx = UTI_DiffTimespecsToDouble(&now, &inst->local_tx.ts);
+    if (last_tx < 0.0)
+      last_tx = 0.0;
+    delay = get_transmit_delay(inst, 0, 0.0) - last_tx;
+  } else {
+    delay = 0.0;
+  }
+
   if (delay < INITIAL_DELAY)
     delay = INITIAL_DELAY;
 
@@ -564,6 +606,7 @@ NCR_CreateInstance(NTP_Remote_Address *remote_addr, NTP_Source_Type type,
   result->auto_offline = params->auto_offline;
   result->copy = params->copy && result->mode == MODE_CLIENT;
   result->poll_target = params->poll_target;
+  result->ext_field_flags = params->ext_fields;
 
   if (params->nts) {
     IPSockAddr nts_address;
@@ -582,7 +625,10 @@ NCR_CreateInstance(NTP_Remote_Address *remote_addr, NTP_Source_Type type,
     result->auth = NAU_CreateNoneInstance();
   }
 
-  result->version = NAU_GetSuggestedNtpVersion(result->auth);
+  if (result->ext_field_flags || result->interleaved)
+    result->version = NTP_VERSION;
+  else
+    result->version = NAU_GetSuggestedNtpVersion(result->auth);
 
   if (params->version)
     result->version = CLAMP(NTP_MIN_COMPAT_VERSION, params->version, NTP_VERSION);
@@ -664,9 +710,14 @@ NCR_ResetInstance(NCR_Instance instance)
 
   instance->remote_poll = 0;
   instance->remote_stratum = 0;
+  instance->remote_root_delay = 0.0;
+  instance->remote_root_dispersion = 0.0;
+  instance->remote_mono_epoch = 0;
+  instance->mono_doffset = 0.0;
 
   instance->valid_rx = 0;
   instance->valid_timestamps = 0;
+  UTI_ZeroNtp64(&instance->remote_ntp_monorx);
   UTI_ZeroNtp64(&instance->remote_ntp_rx);
   UTI_ZeroNtp64(&instance->remote_ntp_tx);
   UTI_ZeroNtp64(&instance->local_ntp_rx);
@@ -914,12 +965,48 @@ receive_timeout(void *arg)
 
 /* ================================================== */
 
+static int
+add_ext_exp1(NTP_Packet *message, NTP_PacketInfo *info, struct timespec *rx,
+             double root_delay, double root_dispersion)
+{
+  struct timespec mono_rx;
+  NTP_ExtFieldExp1 exp1;
+  NTP_int64 ts_fuzz;
+
+  memset(&exp1, 0, sizeof (exp1));
+  exp1.magic = htonl(NTP_EF_EXP1_MAGIC);
+
+  if (info->mode != MODE_CLIENT) {
+    exp1.root_delay = UTI_DoubleToNtp32f28(root_delay);
+    exp1.root_dispersion = UTI_DoubleToNtp32f28(root_dispersion);
+    if (rx)
+      UTI_AddDoubleToTimespec(rx, server_mono_offset, &mono_rx);
+    else
+      UTI_ZeroTimespec(&mono_rx);
+    UTI_GetNtp64Fuzz(&ts_fuzz, message->precision);
+    UTI_TimespecToNtp64(&mono_rx, &exp1.mono_receive_ts, &ts_fuzz);
+    exp1.mono_epoch = htonl(server_mono_epoch);
+  }
+
+  if (!NEF_AddField(message, info, NTP_EF_EXP1, &exp1, sizeof (exp1))) {
+    DEBUG_LOG("Could not add EF");
+    return 0;
+  }
+
+  info->ext_field_flags |= NTP_EF_FLAG_EXP1;
+
+  return 1;
+}
+
+/* ================================================== */
+
 static int
 transmit_packet(NTP_Mode my_mode, /* The mode this machine wants to be */
                 int interleaved, /* Flag enabling interleaved mode */
                 int my_poll, /* The log2 of the local poll interval */
                 int version, /* The NTP version to be set in the packet */
                 uint32_t kod, /* KoD code - 0 disabled */
+                int ext_field_flags, /* Extension fields to be included in the packet */
                 NAU_Instance auth, /* The authentication to be used for the packet */
                 NTP_int64 *remote_ntp_rx, /* The receive timestamp from received packet */
                 NTP_int64 *remote_ntp_tx, /* The transmit timestamp from received packet */
@@ -1054,10 +1141,18 @@ transmit_packet(NTP_Mode my_mode, /* The mode this machine wants to be */
     UTI_ZeroNtp64(&message.receive_ts);
   }
 
-  do {
-    if (!parse_packet(&message, NTP_HEADER_LENGTH, &info))
-      return 0;
+  if (!parse_packet(&message, NTP_HEADER_LENGTH, &info))
+    return 0;
 
+  if (ext_field_flags) {
+    if (ext_field_flags & NTP_EF_FLAG_EXP1) {
+      if (!add_ext_exp1(&message, &info, smooth_time ? NULL : &local_receive,
+                        our_root_delay, our_root_dispersion))
+        return 0;
+    }
+  }
+
+  do {
     /* Prepare random bits which will be added to the transmit timestamp */
     UTI_GetNtp64Fuzz(&ts_fuzz, precision);
 
@@ -1072,20 +1167,6 @@ transmit_packet(NTP_Mode my_mode, /* The mode this machine wants to be */
     UTI_TimespecToNtp64(interleaved ? &local_tx->ts : &local_transmit,
                         &message.transmit_ts, &ts_fuzz);
 
-    /* Generate the authentication data */
-    if (auth) {
-      if (!NAU_GenerateRequestAuth(auth, &message, &info)) {
-        DEBUG_LOG("Could not generate request auth");
-        return 0;
-      }
-    } else {
-      if (!NAU_GenerateResponseAuth(request, request_info, &message, &info,
-                                    where_to, from, kod)) {
-        DEBUG_LOG("Could not generate response auth");
-        return 0;
-      }
-    }
-
     /* Do not send a packet with a non-zero transmit timestamp which is
        equal to any of the following timestamps:
        - receive (to allow reliable detection of the interleaved mode)
@@ -1097,6 +1178,27 @@ transmit_packet(NTP_Mode my_mode, /* The mode this machine wants to be */
            UTI_IsEqualAnyNtp64(&message.transmit_ts, &message.receive_ts,
                                &message.originate_ts, local_ntp_tx));
 
+  /* Encode in server timestamps a flag indicating RX timestamp to avoid
+     saving all RX timestamps for detection of interleaved requests */
+  if (my_mode == MODE_SERVER || my_mode == MODE_PASSIVE) {
+    message.receive_ts.lo |= htonl(1);
+    message.transmit_ts.lo &= ~htonl(1);
+  }
+
+  /* Generate the authentication data */
+  if (auth) {
+    if (!NAU_GenerateRequestAuth(auth, &message, &info)) {
+      DEBUG_LOG("Could not generate request auth");
+      return 0;
+    }
+  } else {
+    if (!NAU_GenerateResponseAuth(request, request_info, &message, &info,
+                                  where_to, from, kod)) {
+      DEBUG_LOG("Could not generate response auth");
+      return 0;
+    }
+  }
+
   if (request_info && request_info->length < info.length) {
     DEBUG_LOG("Response longer than request req_len=%d res_len=%d",
               request_info->length, info.length);
@@ -1228,7 +1330,7 @@ transmit_timeout(void *arg)
 
   /* Send the request (which may also be a response in the symmetric mode) */
   sent = transmit_packet(inst->mode, interleaved, inst->local_poll, inst->version, 0,
-                         inst->auth,
+                         inst->ext_field_flags, inst->auth,
                          initial ? NULL : &inst->remote_ntp_rx,
                          initial ? &inst->init_remote_ntp_tx : &inst->remote_ntp_tx,
                          initial ? &inst->init_local_rx : &inst->local_rx,
@@ -1285,9 +1387,26 @@ transmit_timeout(void *arg)
 
 /* ================================================== */
 
+static int
+is_zero_data(unsigned char *data, int length)
+{
+  int i;
+
+  for (i = 0; i < length; i++)
+    if (data[i] != 0)
+      return 0;
+  return 1;
+}
+
+/* ================================================== */
+
 static int
 parse_packet(NTP_Packet *packet, int length, NTP_PacketInfo *info)
 {
+  int parsed, remainder, ef_length, ef_type, ef_body_length;
+  unsigned char *data;
+  void *ef_body;
+
   if (length < NTP_HEADER_LENGTH || length % 4U != 0) {
     DEBUG_LOG("NTP packet has invalid length %d", length);
     return 0;
@@ -1297,6 +1416,7 @@ parse_packet(NTP_Packet *packet, int length, NTP_PacketInfo *info)
   info->version = NTP_LVM_TO_VERSION(packet->lvm);
   info->mode = NTP_LVM_TO_MODE(packet->lvm);
   info->ext_fields = 0;
+  info->ext_field_flags = 0;
   info->auth.mode = NTP_AUTH_NONE;
 
   if (info->version < NTP_MIN_COMPAT_VERSION || info->version > NTP_MAX_COMPAT_VERSION) {
@@ -1304,11 +1424,95 @@ parse_packet(NTP_Packet *packet, int length, NTP_PacketInfo *info)
     return 0;
   }
 
-  /* Parse authentication extension fields or MAC */
-  if (!NAU_ParsePacket(packet, info))
-    return 0;
+  data = (void *)packet;
+  parsed = NTP_HEADER_LENGTH;
+  remainder = info->length - parsed;
 
-  return 1;
+  /* Check if this is a plain NTP packet with no extension fields or MAC */
+  if (remainder <= 0)
+    return 1;
+
+  assert(remainder % 4 == 0);
+
+  /* In NTPv3 and older packets don't have extension fields.  Anything after
+     the header is assumed to be a MAC. */
+  if (info->version <= 3) {
+    info->auth.mode = NTP_AUTH_SYMMETRIC;
+    info->auth.mac.start = parsed;
+    info->auth.mac.length = remainder;
+    info->auth.mac.key_id = ntohl(*(uint32_t *)(data + parsed));
+
+    /* Check if it is an MS-SNTP authenticator field or extended authenticator
+       field with zeroes as digest */
+    if (info->version == 3 && info->auth.mac.key_id != 0) {
+      if (remainder == 20 && is_zero_data(data + parsed + 4, remainder - 4))
+        info->auth.mode = NTP_AUTH_MSSNTP;
+      else if (remainder == 72 && is_zero_data(data + parsed + 8, remainder - 8))
+        info->auth.mode = NTP_AUTH_MSSNTP_EXT;
+    }
+
+    return 1;
+  }
+
+  /* Check for a crypto NAK */
+  if (remainder == 4 && ntohl(*(uint32_t *)(data + parsed)) == 0) {
+    info->auth.mode = NTP_AUTH_SYMMETRIC;
+    info->auth.mac.start = parsed;
+    info->auth.mac.length = remainder;
+    info->auth.mac.key_id = 0;
+    return 1;
+  }
+
+  /* Parse the rest of the NTPv4 packet */
+
+  while (remainder > 0) {
+    /* Check if the remaining data is a MAC */
+    if (remainder >= NTP_MIN_MAC_LENGTH && remainder <= NTP_MAX_V4_MAC_LENGTH)
+      break;
+
+    /* Check if this is a valid NTPv4 extension field and skip it */
+    if (!NEF_ParseField(packet, info->length, parsed,
+                        &ef_length, &ef_type, &ef_body, &ef_body_length)) {
+      DEBUG_LOG("Invalid format");
+      return 0;
+    }
+
+    assert(ef_length > 0 && ef_length % 4 == 0);
+
+    switch (ef_type) {
+      case NTP_EF_NTS_UNIQUE_IDENTIFIER:
+      case NTP_EF_NTS_COOKIE:
+      case NTP_EF_NTS_COOKIE_PLACEHOLDER:
+      case NTP_EF_NTS_AUTH_AND_EEF:
+        info->auth.mode = NTP_AUTH_NTS;
+        break;
+      case NTP_EF_EXP1:
+        if (ef_body_length == sizeof (NTP_ExtFieldExp1) &&
+            ntohl(((NTP_ExtFieldExp1 *)ef_body)->magic) == NTP_EF_EXP1_MAGIC)
+          info->ext_field_flags |= NTP_EF_FLAG_EXP1;
+        break;
+      default:
+        DEBUG_LOG("Unknown extension field type=%x", (unsigned int)ef_type);
+    }
+
+    info->ext_fields++;
+    parsed += ef_length;
+    remainder = info->length - parsed;
+  }
+
+  if (remainder == 0) {
+    /* No MAC */
+    return 1;
+  } else if (remainder >= NTP_MIN_MAC_LENGTH) {
+    info->auth.mode = NTP_AUTH_SYMMETRIC;
+    info->auth.mac.start = parsed;
+    info->auth.mac.length = remainder;
+    info->auth.mac.key_id = ntohl(*(uint32_t *)(data + parsed));
+    return 1;
+  }
+
+  DEBUG_LOG("Invalid format");
+  return 0;
 }
 
 /* ================================================== */
@@ -1456,6 +1660,12 @@ process_sample(NCR_Instance inst, NTP_Sample *sample)
 
   error_in_estimate = fabs(-sample->offset - estimated_offset);
 
+  if (inst->mono_doffset != 0.0 && fabs(inst->mono_doffset) <= MAX_MONO_DOFFSET) {
+    DEBUG_LOG("Monotonic correction offset=%.9f", inst->mono_doffset);
+    SST_CorrectOffset(SRC_GetSourcestats(inst->source), inst->mono_doffset);
+  }
+  inst->mono_doffset = 0.0;
+
   SRC_AccumulateSample(inst->source, sample);
   SRC_SelectSource(inst->source);
 
@@ -1491,20 +1701,50 @@ process_response(NCR_Instance inst, NTP_Local_Address *local_addr,
   /* Kiss-o'-Death codes */
   int kod_rate;
 
+  /* Extension fields */
+  int parsed, ef_length, ef_type, ef_body_length;
+  void *ef_body;
+  NTP_ExtFieldExp1 *ef_exp1;
+
   NTP_Local_Timestamp local_receive, local_transmit;
   double remote_interval, local_interval, response_time;
-  double delay_time, precision;
+  double delay_time, precision, mono_doffset;
   int updated_timestamps;
 
   /* ==================== */
 
   stats = SRC_GetSourcestats(inst->source);
 
+  ef_exp1 = NULL;
+
+  /* Find requested non-authentication extension fields */
+  if (inst->ext_field_flags & info->ext_field_flags) {
+    for (parsed = NTP_HEADER_LENGTH; parsed < info->length; parsed += ef_length) {
+      if (!NEF_ParseField(message, info->length, parsed,
+                          &ef_length, &ef_type, &ef_body, &ef_body_length))
+        break;
+
+      switch (ef_type) {
+        case NTP_EF_EXP1:
+          if (inst->ext_field_flags & NTP_EF_FLAG_EXP1 &&
+              ef_body_length == sizeof (*ef_exp1) &&
+              ntohl(((NTP_ExtFieldExp1 *)ef_body)->magic) == NTP_EF_EXP1_MAGIC)
+            ef_exp1 = ef_body;
+          break;
+      }
+    }
+  }
+
   pkt_leap = NTP_LVM_TO_LEAP(message->lvm);
   pkt_version = NTP_LVM_TO_VERSION(message->lvm);
   pkt_refid = ntohl(message->reference_id);
-  pkt_root_delay = UTI_Ntp32ToDouble(message->root_delay);
-  pkt_root_dispersion = UTI_Ntp32ToDouble(message->root_dispersion);
+  if (ef_exp1) {
+    pkt_root_delay = UTI_Ntp32f28ToDouble(ef_exp1->root_delay);
+    pkt_root_dispersion = UTI_Ntp32f28ToDouble(ef_exp1->root_dispersion);
+  } else {
+    pkt_root_delay = UTI_Ntp32ToDouble(message->root_delay);
+    pkt_root_dispersion = UTI_Ntp32ToDouble(message->root_dispersion);
+  }
 
   /* Check if the packet is valid per RFC 5905, section 8.
      The test values are 1 when passed and 0 when failed. */
@@ -1559,7 +1799,27 @@ process_response(NCR_Instance inst, NTP_Local_Address *local_addr,
     /* These are the timespec equivalents of the remote and local epochs */
     struct timespec remote_receive, remote_transmit, remote_request_receive;
     struct timespec local_average, remote_average, prev_remote_transmit;
-    double prev_remote_poll_interval;
+    double prev_remote_poll_interval, root_delay, root_dispersion;
+
+    /* If the remote monotonic timestamps are available and are from the same
+       epoch, calculate the change in the offset between the monotonic and
+       real-time clocks, i.e. separate the source's time corrections from
+       frequency corrections.  The offset is accumulated between measurements.
+       It will correct old measurements kept in sourcestats before accumulating
+       the new sample.  In the interleaved mode, cancel the correction out in
+       remote timestamps of the previous request and response, which were
+       captured before the source accumulated the new time corrections. */
+    if (ef_exp1 && inst->remote_mono_epoch == ntohl(ef_exp1->mono_epoch) &&
+        !UTI_IsZeroNtp64(&ef_exp1->mono_receive_ts) &&
+        !UTI_IsZeroNtp64(&inst->remote_ntp_monorx)) {
+      mono_doffset =
+          UTI_DiffNtp64ToDouble(&ef_exp1->mono_receive_ts, &inst->remote_ntp_monorx) -
+          UTI_DiffNtp64ToDouble(&message->receive_ts, &inst->remote_ntp_rx);
+      if (fabs(mono_doffset) > MAX_MONO_DOFFSET)
+        mono_doffset = 0.0;
+    } else {
+      mono_doffset = 0.0;
+    }
 
     /* Select remote and local timestamps for the new sample */
     if (interleaved_packet) {
@@ -1571,14 +1831,20 @@ process_response(NCR_Instance inst, NTP_Local_Address *local_addr,
             UTI_DiffTimespecsToDouble(&inst->local_tx.ts, &inst->local_rx.ts) >
           UTI_DiffTimespecsToDouble(&inst->local_rx.ts, &inst->prev_local_tx.ts)) {
         UTI_Ntp64ToTimespec(&inst->remote_ntp_rx, &remote_receive);
+        UTI_AddDoubleToTimespec(&remote_receive, -mono_doffset, &remote_receive);
         remote_request_receive = remote_receive;
         local_transmit = inst->prev_local_tx;
+        root_delay = inst->remote_root_delay;
+        root_dispersion = inst->remote_root_dispersion;
       } else {
         UTI_Ntp64ToTimespec(&message->receive_ts, &remote_receive);
         UTI_Ntp64ToTimespec(&inst->remote_ntp_rx, &remote_request_receive);
         local_transmit = inst->local_tx;
+        root_delay = MAX(pkt_root_delay, inst->remote_root_delay);
+        root_dispersion = MAX(pkt_root_dispersion, inst->remote_root_dispersion);
       }
       UTI_Ntp64ToTimespec(&message->transmit_ts, &remote_transmit);
+      UTI_AddDoubleToTimespec(&remote_transmit, -mono_doffset, &remote_transmit);
       UTI_Ntp64ToTimespec(&inst->remote_ntp_tx, &prev_remote_transmit);
       local_receive = inst->local_rx;
     } else {
@@ -1588,6 +1854,8 @@ process_response(NCR_Instance inst, NTP_Local_Address *local_addr,
       remote_request_receive = remote_receive;
       local_receive = *rx_ts;
       local_transmit = inst->local_tx;
+      root_delay = pkt_root_delay;
+      root_dispersion = pkt_root_dispersion;
     }
 
     /* Calculate intervals between remote and local timestamps */
@@ -1624,9 +1892,11 @@ process_response(NCR_Instance inst, NTP_Local_Address *local_addr,
     /* Calculate skew */
     skew = (source_freq_hi - source_freq_lo) / 2.0;
     
-    /* and then calculate peer dispersion */
+    /* and then calculate peer dispersion and the rest of the sample */
     sample.peer_dispersion = MAX(precision, MAX(local_transmit.err, local_receive.err)) +
                              skew * fabs(local_interval);
+    sample.root_delay = root_delay + sample.peer_delay;
+    sample.root_dispersion = root_dispersion + sample.peer_dispersion;
     
     /* If the source is an active peer, this is the minimum assumed interval
        between previous two transmissions (if not constrained by minpoll) */
@@ -1668,7 +1938,9 @@ process_response(NCR_Instance inst, NTP_Local_Address *local_addr,
   } else {
     remote_interval = local_interval = response_time = 0.0;
     sample.offset = sample.peer_delay = sample.peer_dispersion = 0.0;
+    sample.root_delay = sample.root_dispersion = 0.0;
     sample.time = rx_ts->ts;
+    mono_doffset = 0.0;
     local_receive = *rx_ts;
     local_transmit = inst->local_tx;
     testA = testB = testC = testD = 0;
@@ -1678,9 +1950,6 @@ process_response(NCR_Instance inst, NTP_Local_Address *local_addr,
      the additional tests passed */
   good_packet = testA && testB && testC && testD;
 
-  sample.root_delay = pkt_root_delay + sample.peer_delay;
-  sample.root_dispersion = pkt_root_dispersion + sample.peer_dispersion;
-
   /* Update the NTP timestamps.  If it's a valid packet from a synchronised
      source, the timestamps may be used later when processing a packet in the
      interleaved mode.  Protect the timestamps against replay attacks in client
@@ -1702,6 +1971,19 @@ process_response(NCR_Instance inst, NTP_Local_Address *local_addr,
     inst->updated_init_timestamps = 0;
     updated_timestamps = 2;
 
+    /* If available, update the monotonic timestamp and accumulate the offset.
+       This needs to be done here to not lose changes in remote_ntp_rx in
+       symmetric mode when there are multiple responses per request. */
+    if (ef_exp1 && !UTI_IsZeroNtp64(&ef_exp1->mono_receive_ts)) {
+      inst->remote_mono_epoch = ntohl(ef_exp1->mono_epoch);
+      inst->remote_ntp_monorx = ef_exp1->mono_receive_ts;
+      inst->mono_doffset += mono_doffset;
+    } else {
+      inst->remote_mono_epoch = 0;
+      UTI_ZeroNtp64(&inst->remote_ntp_monorx);
+      inst->mono_doffset = 0.0;
+    }
+
     /* Don't use the same set of timestamps for the next sample */
     if (interleaved_packet)
       inst->prev_local_tx = inst->local_tx;
@@ -1738,10 +2020,11 @@ process_response(NCR_Instance inst, NTP_Local_Address *local_addr,
       (unsigned int)local_transmit.source >= sizeof (tss_chars))
     assert(0);
 
-  DEBUG_LOG("NTP packet lvm=%o stratum=%d poll=%d prec=%d root_delay=%f root_disp=%f refid=%"PRIx32" [%s]",
+  DEBUG_LOG("NTP packet lvm=%o stratum=%d poll=%d prec=%d root_delay=%.9f root_disp=%.9f refid=%"PRIx32" [%s]",
             message->lvm, message->stratum, message->poll, message->precision,
             pkt_root_delay, pkt_root_dispersion, pkt_refid,
-            message->stratum == NTP_INVALID_STRATUM ? UTI_RefidToString(pkt_refid) : "");
+            message->stratum == NTP_INVALID_STRATUM || message->stratum == 1 ?
+              UTI_RefidToString(pkt_refid) : "");
   DEBUG_LOG("reference=%s origin=%s receive=%s transmit=%s",
             UTI_Ntp64ToString(&message->reference_ts),
             UTI_Ntp64ToString(&message->originate_ts),
@@ -1750,8 +2033,8 @@ process_response(NCR_Instance inst, NTP_Local_Address *local_addr,
   DEBUG_LOG("offset=%.9f delay=%.9f dispersion=%f root_delay=%f root_dispersion=%f",
             sample.offset, sample.peer_delay, sample.peer_dispersion,
             sample.root_delay, sample.root_dispersion);
-  DEBUG_LOG("remote_interval=%.9f local_interval=%.9f response_time=%.9f txs=%c rxs=%c",
-            remote_interval, local_interval, response_time,
+  DEBUG_LOG("remote_interval=%.9f local_interval=%.9f response_time=%.9f mono_doffset=%.9f txs=%c rxs=%c",
+            remote_interval, local_interval, response_time, mono_doffset,
             tss_chars[local_transmit.source], tss_chars[local_receive.source]);
   DEBUG_LOG("test123=%d%d%d test567=%d%d%d testABCD=%d%d%d%d kod_rate=%d interleaved=%d"
             " presend=%d valid=%d good=%d updated=%d",
@@ -1763,6 +2046,8 @@ process_response(NCR_Instance inst, NTP_Local_Address *local_addr,
     inst->remote_poll = message->poll;
     inst->remote_stratum = message->stratum != NTP_INVALID_STRATUM ?
                            MIN(message->stratum, NTP_MAX_STRATUM) : NTP_MAX_STRATUM;
+    inst->remote_root_delay = pkt_root_delay;
+    inst->remote_root_dispersion = pkt_root_dispersion;
 
     inst->prev_local_poll = inst->local_poll;
     inst->prev_tx_count = inst->tx_count;
@@ -2041,8 +2326,8 @@ NCR_ProcessRxUnknown(NTP_Remote_Address *remote_addr, NTP_Local_Address *local_a
 {
   NTP_PacketInfo info;
   NTP_Mode my_mode;
-  NTP_int64 *local_ntp_rx, *local_ntp_tx;
   NTP_Local_Timestamp local_tx, *tx_ts;
+  NTP_int64 ntp_rx, *local_ntp_rx;
   int log_index, interleaved, poll, version;
   uint32_t kod;
 
@@ -2105,28 +2390,29 @@ NCR_ProcessRxUnknown(NTP_Remote_Address *remote_addr, NTP_Local_Address *local_a
     CLG_LogAuthNtpRequest();
   }
 
-  local_ntp_rx = local_ntp_tx = NULL;
+  local_ntp_rx = NULL;
   tx_ts = NULL;
   interleaved = 0;
 
-  /* Check if the client is using the interleaved mode.  If it is, save the
-     new transmit timestamp and if the old transmit timestamp is valid, respond
-     in the interleaved mode.  This means the third reply to a new client is
-     the earliest one that can be interleaved.  We don't want to waste time
-     on clients that are not using the interleaved mode. */
-  if (kod == 0 && log_index >= 0) {
-    CLG_GetNtpTimestamps(log_index, &local_ntp_rx, &local_ntp_tx);
-    interleaved = !UTI_IsZeroNtp64(local_ntp_rx) &&
-                  !UTI_CompareNtp64(&message->originate_ts, local_ntp_rx) &&
-                  UTI_CompareNtp64(&message->receive_ts, &message->transmit_ts);
+  /* Handle requests formed in the interleaved mode.  As an optimisation to
+     avoid saving all receive timestamps, require that the origin timestamp
+     has the lowest bit equal to 1, which indicates it was set to one of our
+     receive timestamps instead of transmit timestamps or zero.  Respond in the
+     interleaved mode if the receive timestamp is found and it has a non-zero
+     transmit timestamp (this is verified in transmit_packet()).  For a new
+     client starting with a zero origin timestamp, the third response is the
+     earliest one that can be interleaved. */
+  if (kod == 0 && log_index >= 0 && info.version == 4 &&
+      message->originate_ts.lo & htonl(1) &&
+      UTI_CompareNtp64(&message->receive_ts, &message->transmit_ts) != 0) {
+    ntp_rx = message->originate_ts;
+    local_ntp_rx = &ntp_rx;
+    UTI_ZeroTimespec(&local_tx.ts);
+    interleaved = CLG_GetNtpTxTimestamp(&ntp_rx, &local_tx.ts);
 
-    if (interleaved) {
-      UTI_Ntp64ToTimespec(local_ntp_tx, &local_tx.ts);
-      tx_ts = &local_tx;
-    } else {
-      UTI_ZeroNtp64(local_ntp_tx);
-      local_ntp_tx = NULL;
-    }
+    tx_ts = &local_tx;
+    if (interleaved)
+      CLG_DisableNtpTimestamps(&ntp_rx);
   }
 
   /* Suggest the client to increase its polling interval if it indicates
@@ -2138,14 +2424,14 @@ NCR_ProcessRxUnknown(NTP_Remote_Address *remote_addr, NTP_Local_Address *local_a
   version = info.version;
 
   /* Send a reply */
-  transmit_packet(my_mode, interleaved, poll, version, kod, NULL,
-                  &message->receive_ts, &message->transmit_ts,
-                  rx_ts, tx_ts, local_ntp_rx, NULL, remote_addr, local_addr,
-                  message, &info);
+  if (!transmit_packet(my_mode, interleaved, poll, version, kod, info.ext_field_flags, NULL,
+                       &message->receive_ts, &message->transmit_ts,
+                       rx_ts, tx_ts, local_ntp_rx, NULL, remote_addr, local_addr,
+                       message, &info))
+    return;
 
-  /* Save the transmit timestamp */
-  if (tx_ts)
-    UTI_TimespecToNtp64(&tx_ts->ts, local_ntp_tx, NULL);
+  if (local_ntp_rx)
+    CLG_SaveNtpTimestamps(local_ntp_rx, tx_ts ? &tx_ts->ts : NULL);
 }
 
 /* ================================================== */
@@ -2207,10 +2493,9 @@ void
 NCR_ProcessTxUnknown(NTP_Remote_Address *remote_addr, NTP_Local_Address *local_addr,
                      NTP_Local_Timestamp *tx_ts, NTP_Packet *message, int length)
 {
-  NTP_int64 *local_ntp_rx, *local_ntp_tx;
-  NTP_Local_Timestamp local_tx;
+  NTP_Local_Timestamp old_tx, new_tx;
+  NTP_int64 *local_ntp_rx;
   NTP_PacketInfo info;
-  int log_index;
 
   if (!parse_packet(message, length, &info))
     return;
@@ -2218,18 +2503,22 @@ NCR_ProcessTxUnknown(NTP_Remote_Address *remote_addr, NTP_Local_Address *local_a
   if (info.mode == MODE_BROADCAST)
     return;
 
-  log_index = CLG_GetClientIndex(&remote_addr->ip_addr);
-  if (log_index < 0)
-    return;
-
   if (SMT_IsEnabled() && info.mode == MODE_SERVER)
     UTI_AddDoubleToTimespec(&tx_ts->ts, SMT_GetOffset(&tx_ts->ts), &tx_ts->ts);
 
-  CLG_GetNtpTimestamps(log_index, &local_ntp_rx, &local_ntp_tx);
+  local_ntp_rx = &message->receive_ts;
+  new_tx = *tx_ts;
 
-  UTI_Ntp64ToTimespec(local_ntp_tx, &local_tx.ts);
-  update_tx_timestamp(&local_tx, tx_ts, local_ntp_rx, NULL, message);
-  UTI_TimespecToNtp64(&local_tx.ts, local_ntp_tx, NULL);
+  if (!CLG_GetNtpTxTimestamp(local_ntp_rx, &old_tx.ts))
+    return;
+
+  /* Undo a clock adjustment between the RX and TX timestamps to minimise error
+     in the delay measured by the client */
+  CLG_UndoNtpTxTimestampSlew(local_ntp_rx, &new_tx.ts);
+
+  update_tx_timestamp(&old_tx, &new_tx, local_ntp_rx, NULL, message);
+
+  CLG_UpdateNtpTxTimestamp(local_ntp_rx, &new_tx.ts);
 }
 
 /* ================================================== */
@@ -2504,11 +2793,13 @@ NCR_AddAccessRestriction(IPAddr *ip_addr, int subnet_bits, int allow, int all)
     if (server_sock_fd4 == INVALID_SOCK_FD &&
         ADF_IsAnyAllowed(access_auth_table, IPADDR_INET4)) {
       remote_addr.ip_addr.family = IPADDR_INET4;
+      remote_addr.port = 0;
       server_sock_fd4 = NIO_OpenServerSocket(&remote_addr);
     }
     if (server_sock_fd6 == INVALID_SOCK_FD &&
         ADF_IsAnyAllowed(access_auth_table, IPADDR_INET6)) {
       remote_addr.ip_addr.family = IPADDR_INET6;
+      remote_addr.port = 0;
       server_sock_fd6 = NIO_OpenServerSocket(&remote_addr);
     }
   } else {
@@ -2602,12 +2893,12 @@ broadcast_timeout(void *arg)
   int poll;
 
   destination = ARR_GetElement(broadcasts, (long)arg);
-  poll = log(destination->interval) / log(2.0) + 0.5;
+  poll = round(log(destination->interval) / log(2.0));
 
   UTI_ZeroNtp64(&orig_ts);
   zero_local_timestamp(&recv_ts);
 
-  transmit_packet(MODE_BROADCAST, 0, poll, NTP_VERSION, 0, destination->auth,
+  transmit_packet(MODE_BROADCAST, 0, poll, NTP_VERSION, 0, 0, destination->auth,
                   &orig_ts, &orig_ts, &recv_ts, NULL, NULL, NULL,
                   &destination->addr, &destination->local_addr, NULL, NULL);
 

ntp_io.c

@@ -4,7 +4,7 @@
  **********************************************************************
  * Copyright (C) Richard P. Curnow  1997-2003
  * Copyright (C) Timo Teras  2009
- * Copyright (C) Miroslav Lichvar  2009, 2013-2016, 2018-2020
+ * Copyright (C) Miroslav Lichvar  2009, 2013-2016, 2018-2021
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,9 +30,11 @@
 
 #include "sysincl.h"
 
+#include "memory.h"
 #include "ntp_io.h"
 #include "ntp_core.h"
 #include "ntp_sources.h"
+#include "ptp.h"
 #include "sched.h"
 #include "socket.h"
 #include "local.h"
@@ -70,6 +72,16 @@ static int permanent_server_sockets;
 /* Flag indicating the server IPv4 socket is bound to an address */
 static int bound_server_sock_fd4;
 
+/* PTP event port, or 0 if disabled */
+static int ptp_port;
+
+/* Shared server/client sockets for NTP-over-PTP */
+static int ptp_sock_fd4;
+static int ptp_sock_fd6;
+
+/* Buffer for transmitted NTP-over-PTP messages */
+static PTP_NtpMessage *ptp_message;
+
 /* Flag indicating that we have been initialised */
 static int initialised=0;
 
@@ -221,6 +233,17 @@ NIO_Initialise(void)
        client_sock_fd4 == INVALID_SOCK_FD && client_sock_fd6 == INVALID_SOCK_FD)) {
     LOG_FATAL("Could not open NTP sockets");
   }
+
+  ptp_port = CNF_GetPtpPort();
+  ptp_sock_fd4 = INVALID_SOCK_FD;
+  ptp_sock_fd6 = INVALID_SOCK_FD;
+  ptp_message = NULL;
+
+  if (ptp_port > 0) {
+    ptp_sock_fd4 = open_socket(IPADDR_INET4, ptp_port, 0, NULL);
+    ptp_sock_fd6 = open_socket(IPADDR_INET6, ptp_port, 0, NULL);
+    ptp_message = MallocNew(PTP_NtpMessage);
+  }
 }
 
 /* ================================================== */
@@ -238,6 +261,11 @@ NIO_Finalise(void)
   close_socket(server_sock_fd6);
   server_sock_fd6 = client_sock_fd6 = INVALID_SOCK_FD;
 
+  close_socket(ptp_sock_fd4);
+  close_socket(ptp_sock_fd6);
+  ptp_sock_fd4 = ptp_sock_fd6 = INVALID_SOCK_FD;
+  Free(ptp_message);
+
 #ifdef HAVE_LINUX_TIMESTAMPING
   NIO_Linux_Finalise();
 #endif
@@ -250,17 +278,21 @@ NIO_Finalise(void)
 int
 NIO_OpenClientSocket(NTP_Remote_Address *remote_addr)
 {
-  if (separate_client_sockets) {
-    return open_separate_client_socket(remote_addr);
-  } else {
-    switch (remote_addr->ip_addr.family) {
-      case IPADDR_INET4:
-        return client_sock_fd4;
-      case IPADDR_INET6:
-        return client_sock_fd6;
-      default:
-        return INVALID_SOCK_FD;
-    }
+  switch (remote_addr->ip_addr.family) {
+    case IPADDR_INET4:
+      if (ptp_port > 0 && remote_addr->port == ptp_port)
+        return ptp_sock_fd4;
+      if (separate_client_sockets)
+        return open_separate_client_socket(remote_addr);
+      return client_sock_fd4;
+    case IPADDR_INET6:
+      if (ptp_port > 0 && remote_addr->port == ptp_port)
+        return ptp_sock_fd6;
+      if (separate_client_sockets)
+        return open_separate_client_socket(remote_addr);
+      return client_sock_fd6;
+    default:
+      return INVALID_SOCK_FD;
   }
 }
 
@@ -271,6 +303,8 @@ NIO_OpenServerSocket(NTP_Remote_Address *remote_addr)
 {
   switch (remote_addr->ip_addr.family) {
     case IPADDR_INET4:
+      if (ptp_port > 0 && remote_addr->port == ptp_port)
+        return ptp_sock_fd4;
       if (permanent_server_sockets)
         return server_sock_fd4;
       if (server_sock_fd4 == INVALID_SOCK_FD)
@@ -279,6 +313,8 @@ NIO_OpenServerSocket(NTP_Remote_Address *remote_addr)
         server_sock_ref4++;
       return server_sock_fd4;
     case IPADDR_INET6:
+      if (ptp_port > 0 && remote_addr->port == ptp_port)
+        return ptp_sock_fd6;
       if (permanent_server_sockets)
         return server_sock_fd6;
       if (server_sock_fd6 == INVALID_SOCK_FD)
@@ -293,9 +329,21 @@ NIO_OpenServerSocket(NTP_Remote_Address *remote_addr)
 
 /* ================================================== */
 
+static int
+is_ptp_socket(int sock_fd)
+{
+  return ptp_port > 0 && sock_fd != INVALID_SOCK_FD &&
+    (sock_fd == ptp_sock_fd4 || sock_fd == ptp_sock_fd6);
+}
+
+/* ================================================== */
+
 void
 NIO_CloseClientSocket(int sock_fd)
 {
+  if (is_ptp_socket(sock_fd))
+    return;
+
   if (separate_client_sockets)
     close_socket(sock_fd);
 }
@@ -305,7 +353,7 @@ NIO_CloseClientSocket(int sock_fd)
 void
 NIO_CloseServerSocket(int sock_fd)
 {
-  if (permanent_server_sockets || sock_fd == INVALID_SOCK_FD)
+  if (permanent_server_sockets || sock_fd == INVALID_SOCK_FD || is_ptp_socket(sock_fd))
     return;
 
   if (sock_fd == server_sock_fd4) {
@@ -329,7 +377,7 @@ int
 NIO_IsServerSocket(int sock_fd)
 {
   return sock_fd != INVALID_SOCK_FD &&
-    (sock_fd == server_sock_fd4 || sock_fd == server_sock_fd6);
+    (sock_fd == server_sock_fd4 || sock_fd == server_sock_fd6 || is_ptp_socket(sock_fd));
 }
 
 /* ================================================== */
@@ -337,7 +385,8 @@ NIO_IsServerSocket(int sock_fd)
 int
 NIO_IsServerSocketOpen(void)
 {
-  return server_sock_fd4 != INVALID_SOCK_FD || server_sock_fd6 != INVALID_SOCK_FD;
+  return server_sock_fd4 != INVALID_SOCK_FD || server_sock_fd6 != INVALID_SOCK_FD ||
+    ptp_sock_fd4 != INVALID_SOCK_FD || ptp_sock_fd6 != INVALID_SOCK_FD;
 }
 
 /* ================================================== */
@@ -392,6 +441,9 @@ process_message(SCK_Message *message, int sock_fd, int event)
     DEBUG_LOG("Updated RX timestamp delay=%.9f tss=%u",
               UTI_DiffTimespecsToDouble(&sched_ts, &local_ts.ts), local_ts.source);
 
+  if (!NIO_UnwrapMessage(message, sock_fd))
+    return;
+
   /* Just ignore the packet if it's not of a recognized length */
   if (message->length < NTP_HEADER_LENGTH || message->length > sizeof (NTP_Packet)) {
     DEBUG_LOG("Unexpected length");
@@ -430,6 +482,78 @@ read_from_socket(int sock_fd, int event, void *anything)
     process_message(&messages[i], sock_fd, event);
 }
 
+/* ================================================== */
+
+int
+NIO_UnwrapMessage(SCK_Message *message, int sock_fd)
+{
+  PTP_NtpMessage *msg;
+
+  if (!is_ptp_socket(sock_fd))
+    return 1;
+
+  if (message->length <= PTP_NTP_PREFIX_LENGTH) {
+    DEBUG_LOG("Unexpected length");
+    return 0;
+  }
+
+  msg = message->data;
+
+  if (msg->header.type != PTP_TYPE_DELAY_REQ || msg->header.version != PTP_VERSION ||
+      ntohs(msg->header.length) != message->length ||
+      msg->header.domain != PTP_DOMAIN_NTP ||
+      ntohs(msg->header.flags) != PTP_FLAG_UNICAST ||
+      ntohs(msg->tlv_header.type) != PTP_TLV_NTP ||
+      ntohs(msg->tlv_header.length) != message->length - PTP_NTP_PREFIX_LENGTH) {
+    DEBUG_LOG("Unexpected PTP message");
+    return 0;
+  }
+
+  message->data = (char *)message->data + PTP_NTP_PREFIX_LENGTH;
+  message->length -= PTP_NTP_PREFIX_LENGTH;
+
+  DEBUG_LOG("Unwrapped PTP->NTP len=%d", message->length);
+
+  return 1;
+}
+
+/* ================================================== */
+
+static int
+wrap_message(SCK_Message *message, int sock_fd)
+{
+  assert(PTP_NTP_PREFIX_LENGTH == 48);
+
+  if (!is_ptp_socket(sock_fd))
+    return 1;
+
+  if (!ptp_message)
+    return 0;
+
+  if (message->length < NTP_HEADER_LENGTH ||
+      message->length + PTP_NTP_PREFIX_LENGTH > sizeof (*ptp_message)) {
+    DEBUG_LOG("Unexpected length");
+    return 0;
+  }
+
+  memset(ptp_message, 0, PTP_NTP_PREFIX_LENGTH);
+  ptp_message->header.type = PTP_TYPE_DELAY_REQ;
+  ptp_message->header.version = PTP_VERSION;
+  ptp_message->header.length = htons(PTP_NTP_PREFIX_LENGTH + message->length);
+  ptp_message->header.domain = PTP_DOMAIN_NTP;
+  ptp_message->header.flags = htons(PTP_FLAG_UNICAST);
+  ptp_message->tlv_header.type = htons(PTP_TLV_NTP);
+  ptp_message->tlv_header.length = htons(message->length);
+  memcpy((char *)ptp_message + PTP_NTP_PREFIX_LENGTH, message->data, message->length);
+
+  message->data = ptp_message;
+  message->length += PTP_NTP_PREFIX_LENGTH;
+
+  DEBUG_LOG("Wrapped NTP->PTP len=%d", message->length - PTP_NTP_PREFIX_LENGTH);
+
+  return 1;
+}
+
 /* ================================================== */
 /* Send a packet to remote address from local address */
 
@@ -451,6 +575,9 @@ NIO_SendPacket(NTP_Packet *packet, NTP_Remote_Address *remote_addr,
   message.data = packet;
   message.length = length;
 
+  if (!wrap_message(&message, local_addr->sock_fd))
+    return 0;
+
   /* Specify remote address if the socket is not connected */
   if (NIO_IsServerSocket(local_addr->sock_fd) || !separate_client_sockets) {
     message.remote_addr.ip.ip_addr = remote_addr->ip_addr;
@@ -467,7 +594,7 @@ NIO_SendPacket(NTP_Packet *packet, NTP_Remote_Address *remote_addr,
 #if !defined(HAVE_IN_PKTINFO) && defined(IP_SENDSRCADDR)
   /* On FreeBSD a local IPv4 address cannot be specified on bound socket */
   if (message.local_addr.ip.family == IPADDR_INET4 &&
-      (local_addr->sock_fd != server_sock_fd4 || bound_server_sock_fd4))
+      (bound_server_sock_fd4 || !NIO_IsServerSocket(local_addr->sock_fd)))
     message.local_addr.ip.family = IPADDR_UNSPEC;
 #endif
 

ntp_io.h

@@ -31,6 +31,7 @@
 
 #include "ntp.h"
 #include "addressing.h"
+#include "socket.h"
 
 /* Function to initialise the module. */
 extern void NIO_Initialise(void);
@@ -59,6 +60,9 @@ extern int NIO_IsServerSocketOpen(void);
 /* Function to check if client packets can be sent to a server */
 extern int NIO_IsServerConnectable(NTP_Remote_Address *remote_addr);
 
+/* Function to unwrap an NTP message from non-native transport (e.g. PTP) */
+extern int NIO_UnwrapMessage(SCK_Message *message, int sock_fd);
+
 /* Function to transmit a packet */
 extern int NIO_SendPacket(NTP_Packet *packet, NTP_Remote_Address *remote_addr,
                           NTP_Local_Address *local_addr, int length, int process_tx);

ntp_io_linux.c

@@ -73,7 +73,7 @@ struct Interface {
 /* Minimum interval between PHC readings */
 #define MIN_PHC_POLL -6
 
-/* Maximum acceptable offset between HW and daemon/kernel timestamp */
+/* Maximum acceptable offset between SW/HW and daemon timestamp */
 #define MAX_TS_DELAY 1.0
 
 /* Array of Interfaces */
@@ -189,6 +189,14 @@ add_interface(CNF_HwTsInterface *conf_iface)
       rx_filter = HWTSTAMP_FILTER_NTP_ALL;
       break;
 #endif
+    case CNF_HWTS_RXFILTER_PTP:
+      if (ts_info.rx_filters & (1 << HWTSTAMP_FILTER_PTP_V2_L4_EVENT))
+        rx_filter = HWTSTAMP_FILTER_PTP_V2_L4_EVENT;
+      else if (ts_info.rx_filters & (1 << HWTSTAMP_FILTER_PTP_V2_EVENT))
+        rx_filter = HWTSTAMP_FILTER_PTP_V2_EVENT;
+      else
+        rx_filter = HWTSTAMP_FILTER_NONE;
+      break;
     default:
       rx_filter = HWTSTAMP_FILTER_ALL;
       break;
@@ -611,6 +619,28 @@ process_hw_timestamp(struct Interface *iface, struct timespec *hw_ts,
   local_ts->source = NTP_TS_HARDWARE;
 }
 
+/* ================================================== */
+
+static void
+process_sw_timestamp(struct timespec *sw_ts, NTP_Local_Timestamp *local_ts)
+{
+  double ts_delay, local_err;
+  struct timespec ts;
+
+  LCL_CookTime(sw_ts, &ts, &local_err);
+
+  ts_delay = UTI_DiffTimespecsToDouble(&local_ts->ts, &ts);
+
+  if (fabs(ts_delay) > MAX_TS_DELAY) {
+    DEBUG_LOG("Unacceptable timestamp delay %.9f", ts_delay);
+    return;
+  }
+
+  local_ts->ts = ts;
+  local_ts->err = local_err;
+  local_ts->source = NTP_TS_KERNEL;
+}
+
 /* ================================================== */
 /* Extract UDP data from a layer 2 message.  Supported is Ethernet
    with optional VLAN tags. */
@@ -736,8 +766,7 @@ NIO_Linux_ProcessMessage(SCK_Message *message, NTP_Local_Address *local_addr,
 
   if (local_ts->source == NTP_TS_DAEMON && !UTI_IsZeroTimespec(&message->timestamp.kernel) &&
       (!is_tx || UTI_IsZeroTimespec(&message->timestamp.hw))) {
-    LCL_CookTime(&message->timestamp.kernel, &local_ts->ts, &local_ts->err);
-    local_ts->source = NTP_TS_KERNEL;
+    process_sw_timestamp(&message->timestamp.kernel, local_ts);
   }
 
   /* If the kernel is slow with enabling RX timestamping, open a dummy
@@ -776,7 +805,10 @@ NIO_Linux_ProcessMessage(SCK_Message *message, NTP_Local_Address *local_addr,
     return 1;
   }
 
-  if (message->length < NTP_HEADER_LENGTH)
+  if (!NIO_UnwrapMessage(message, local_addr->sock_fd))
+    return 1;
+
+  if (message->length < NTP_HEADER_LENGTH || message->length > sizeof (NTP_Packet))
     return 1;
 
   NSR_ProcessTx(&message->remote_addr.ip, local_addr, local_ts, message->data, message->length);

ntp_sources.c

@@ -3,7 +3,7 @@
 
  **********************************************************************
  * Copyright (C) Richard P. Curnow  1997-2003
- * Copyright (C) Miroslav Lichvar  2011-2012, 2014, 2016, 2020
+ * Copyright (C) Miroslav Lichvar  2011-2012, 2014, 2016, 2020-2021
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -1100,8 +1100,10 @@ NSR_ProcessRx(NTP_Remote_Address *remote_addr, NTP_Local_Address *local_addr,
 
   assert(initialised);
 
-  /* Must match IP address AND port number */
-  if (find_slot2(remote_addr, &slot) == 2) {
+  /* Avoid unnecessary lookup if the packet cannot be a response from our
+     source.  Otherwise, it must match both IP address and port number. */
+  if (NTP_LVM_TO_MODE(message->lvm) != MODE_CLIENT &&
+      find_slot2(remote_addr, &slot) == 2) {
     record = get_record(slot);
 
     if (!NCR_ProcessRxKnown(record->data, local_addr, rx_ts, message, length))
@@ -1137,8 +1139,10 @@ NSR_ProcessTx(NTP_Remote_Address *remote_addr, NTP_Local_Address *local_addr,
   SourceRecord *record;
   int slot;
 
-  /* Must match IP address AND port number */
-  if (find_slot2(remote_addr, &slot) == 2) {
+  /* Avoid unnecessary lookup if the packet cannot be a request to our
+     source.  Otherwise, it must match both IP address and port number. */
+  if (NTP_LVM_TO_MODE(message->lvm) != MODE_SERVER &&
+      find_slot2(remote_addr, &slot) == 2) {
     record = get_record(slot);
     NCR_ProcessTxKnown(record->data, local_addr, tx_ts, message, length);
   } else {

nts_ke_client.c

@@ -2,7 +2,7 @@
   chronyd/chronyc - Programs for keeping computer clocks accurate.
 
  **********************************************************************
- * Copyright (C) Miroslav Lichvar  2020
+ * Copyright (C) Miroslav Lichvar  2020-2021
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -127,9 +127,10 @@ process_response(NKC_Instance inst)
 {
   int next_protocol = -1, aead_algorithm = -1, error = 0;
   int i, critical, type, length;
-  uint16_t data[NKE_MAX_COOKIE_LENGTH / sizeof (uint16_t)];
+  uint16_t data[NKE_MAX_RECORD_BODY_LENGTH / sizeof (uint16_t)];
 
-  assert(NKE_MAX_COOKIE_LENGTH % sizeof (uint16_t) == 0);
+  assert(NKE_MAX_COOKIE_LENGTH <= NKE_MAX_RECORD_BODY_LENGTH);
+  assert(sizeof (data) % sizeof (uint16_t) == 0);
   assert(sizeof (uint16_t) == 2);
 
   inst->num_cookies = 0;
@@ -141,6 +142,13 @@ process_response(NKC_Instance inst)
     if (!NKSN_GetRecord(inst->session, &critical, &type, &length, &data, sizeof (data)))
       break;
 
+    if (length > sizeof (data)) {
+      DEBUG_LOG("Record too long type=%d length=%d critical=%d", type, length, critical);
+      if (critical)
+        error = 1;
+      continue;
+    }
+
     switch (type) {
       case NKE_RECORD_NEXT_PROTOCOL:
         if (!critical || length != 2 || ntohs(data[0]) != NKE_NEXT_PROTOCOL_NTPV4) {

nts_ke_server.c

@@ -669,6 +669,8 @@ run_helper(uid_t uid, gid_t gid, int scfilter_level)
   CNF_Finalise();
   LOG_Finalise();
 
+  UTI_ResetGetRandomFunctions();
+
   exit(0);
 }
 
@@ -710,6 +712,8 @@ NKS_PreInitialise(uid_t uid, gid_t gid, int scfilter_level)
 
     is_helper = 1;
 
+    UTI_ResetGetRandomFunctions();
+
     snprintf(prefix, sizeof (prefix), "nks#%d:", i + 1);
     LOG_SetDebugPrefix(prefix);
     LOG_CloseParentFd();

nts_ke_session.c

@@ -2,7 +2,7 @@
   chronyd/chronyc - Programs for keeping computer clocks accurate.
 
  **********************************************************************
- * Copyright (C) Miroslav Lichvar  2020
+ * Copyright (C) Miroslav Lichvar  2020-2021
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as

nts_ntp.h

@@ -27,11 +27,6 @@
 #ifndef GOT_NTS_NTP_H
 #define GOT_NTS_NTP_H
 
-#define NTP_EF_NTS_UNIQUE_IDENTIFIER    0x0104
-#define NTP_EF_NTS_COOKIE               0x0204
-#define NTP_EF_NTS_COOKIE_PLACEHOLDER   0x0304
-#define NTP_EF_NTS_AUTH_AND_EEF         0x0404
-
 #define NTP_KOD_NTS_NAK                 0x4e54534e
 
 #define NTS_MIN_UNIQ_ID_LENGTH          32

nts_ntp_client.c

@@ -457,7 +457,7 @@ NNC_CheckResponseAuth(NNC_Instance inst, NTP_Packet *packet,
   for (parsed = NTP_HEADER_LENGTH; parsed < info->length; parsed += ef_length) {
     if (!NEF_ParseField(packet, info->length, parsed,
                         &ef_length, &ef_type, &ef_body, &ef_body_length))
-      /* This is not expected as the packet already passed NAU_ParsePacket() */
+      /* This is not expected as the packet already passed parsing */
       return 0;
 
     switch (ef_type) {
@@ -669,6 +669,8 @@ load_cookies(NNC_Instance inst)
   inst->last_nke_success = context_time + SCH_GetLastEventMonoTime();
   inst->context_id = context_id;
 
+  fclose(f);
+
   DEBUG_LOG("Loaded %d cookies for %s", i, filename);
   return;
 

nts_ntp_server.c

@@ -242,7 +242,7 @@ NNS_GenerateResponseAuth(NTP_Packet *request, NTP_PacketInfo *req_info,
   for (parsed = NTP_HEADER_LENGTH; parsed < req_info->length; parsed += ef_length) {
     if (!NEF_ParseField(request, req_info->length, parsed,
                         &ef_length, &ef_type, &ef_body, &ef_body_length))
-      /* This is not expected as the packet already passed NAU_ParsePacket() */
+      /* This is not expected as the packet already passed parsing */
       return 0;
 
     switch (ef_type) {

pktlength.c

@@ -154,8 +154,9 @@ static const uint16_t reply_lengths[] = {
   RPY_LENGTH_ENTRY(ntp_source_name),            /* NTP_SOURCE_NAME */
   RPY_LENGTH_ENTRY(auth_data),                  /* AUTH_DATA */
   RPY_LENGTH_ENTRY(client_accesses_by_index),   /* CLIENT_ACCESSES_BY_INDEX3 */
-  RPY_LENGTH_ENTRY(server_stats),               /* SERVER_STATS2 */
+  0,                                            /* SERVER_STATS2 - not supported */
   RPY_LENGTH_ENTRY(select_data),                /* SELECT_DATA */
+  RPY_LENGTH_ENTRY(server_stats),               /* SERVER_STATS3 */
 };
 
 /* ================================================== */

privops.c

@@ -255,7 +255,7 @@ do_bind_socket(ReqBindSocket *req, PrvResponse *res)
 
   SCK_SockaddrToIPSockAddr(sa, sa_len, &ip_saddr);
   if (ip_saddr.port != 0 && ip_saddr.port != CNF_GetNTPPort() &&
-      ip_saddr.port != CNF_GetAcquisitionPort()) {
+      ip_saddr.port != CNF_GetAcquisitionPort() && ip_saddr.port != CNF_GetPtpPort()) {
     SCK_CloseSocket(sock_fd);
     res_fatal(res, "Invalid port %d", ip_saddr.port);
     return;
@@ -547,7 +547,7 @@ PRV_BindSocket(int sock, struct sockaddr *address, socklen_t address_len)
 
   SCK_SockaddrToIPSockAddr(address, address_len, &ip_saddr);
   if (ip_saddr.port != 0 && ip_saddr.port != CNF_GetNTPPort() &&
-      ip_saddr.port != CNF_GetAcquisitionPort())
+      ip_saddr.port != CNF_GetAcquisitionPort() && ip_saddr.port != CNF_GetPtpPort())
     assert(0);
 
   if (!have_helper())
@@ -662,6 +662,8 @@ PRV_StartHelper(void)
         close(fd);
     }
 
+    UTI_ResetGetRandomFunctions();
+
     /* ignore signals, the process will exit on OP_QUIT request */
     UTI_SetQuitSignalsHandler(SIG_IGN, 1);
 

ptp.h

@@ -0,0 +1,64 @@
+/*
+  chronyd/chronyc - Programs for keeping computer clocks accurate.
+
+ **********************************************************************
+ * Copyright (C) Miroslav Lichvar  2021
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ *
+ **********************************************************************
+
+  =======================================================================
+
+  This is the header file for the Precision Time Protocol (PTP).
+
+  */
+#ifndef GOT_PTP_H
+#define GOT_PTP_H
+
+#include "sysincl.h"
+
+#include "ntp.h"
+
+#define PTP_VERSION 2
+#define PTP_TYPE_DELAY_REQ 1
+#define PTP_DOMAIN_NTP 123
+#define PTP_FLAG_UNICAST (1 << (2 + 8))
+#define PTP_TLV_NTP 0x2023
+
+typedef struct {
+  uint8_t type;
+  uint8_t version;
+  uint16_t length;
+  uint8_t domain;
+  uint8_t min_sdoid;
+  uint16_t flags;
+  uint8_t rest[26];
+} PTP_Header;
+
+typedef struct {
+  uint16_t type;
+  uint16_t length;
+} PTP_TlvHeader;
+
+typedef struct {
+  PTP_Header header;
+  uint8_t origin_ts[10];
+  PTP_TlvHeader tlv_header;
+  NTP_Packet ntp_msg;
+} PTP_NtpMessage;
+
+#define PTP_NTP_PREFIX_LENGTH (int)offsetof(PTP_NtpMessage, ntp_msg)
+
+#endif

refclock.c

@@ -572,10 +572,7 @@ RCL_AddCookedPulse(RCL_Instance instance, struct timespec *cooked_time,
     }
 
     /* Align the offset to the reference sample */
-    if ((ref_sample.offset - offset) >= 0.0)
-      shift = (long)((ref_sample.offset - offset) * rate + 0.5) / (double)rate;
-    else
-      shift = (long)((ref_sample.offset - offset) * rate - 0.5) / (double)rate;
+    shift = round((ref_sample.offset - offset) * rate) / rate;
 
     offset += shift;
 

reference.c

@@ -1333,7 +1333,8 @@ REF_DisableLocal(void)
 static int
 is_leap_close(time_t t)
 {
-  return t >= leap_when - LEAP_SECOND_CLOSE && t < leap_when + LEAP_SECOND_CLOSE;
+  return leap_when != 0 &&
+         t >= leap_when - LEAP_SECOND_CLOSE && t < leap_when + LEAP_SECOND_CLOSE;
 }
 
 /* ================================================== */

reports.h

@@ -117,6 +117,9 @@ typedef struct {
   uint32_t cmd_drops;
   uint32_t log_drops;
   uint32_t ntp_auth_hits;
+  uint32_t ntp_interleaved_hits;
+  uint32_t ntp_timestamps;
+  uint32_t ntp_span_seconds;
 } RPT_ServerStatsReport;
 
 typedef struct {

rtc_linux.c

@@ -64,7 +64,7 @@ static OperatingMode operating_mode = OM_NORMAL;
 
 /* ================================================== */
 
-static int fd = -1;
+static int fd;
 
 #define LOWEST_MEASUREMENT_PERIOD 15
 #define HIGHEST_MEASUREMENT_PERIOD 480
@@ -82,16 +82,12 @@ static int skip_interrupts;
 #define MAX_SAMPLES 64
 
 /* Real time clock samples.  We store the seconds count as originally
-   measured, together with a 'trim' that compensates these values for
-   any steps made to the RTC to bring it back into line
-   occasionally.  The trim is in seconds. */
+   measured. */
 static time_t *rtc_sec = NULL;
-static double *rtc_trim = NULL;
 
 /* Reference time, against which delta times on the RTC scale are measured */
 static time_t rtc_ref;
 
-
 /* System clock samples associated with the above samples. */
 static struct timespec *system_times = NULL;
 
@@ -145,7 +141,7 @@ static double file_ref_offset, file_rate_ppm;
 /* ================================================== */
 
 /* Flag to remember whether to assume the RTC is running on UTC */
-static int rtc_on_utc = 1;
+static int rtc_on_utc;
 
 /* ================================================== */
 
@@ -168,7 +164,6 @@ discard_samples(int new_first)
   n_to_save = n_samples - new_first;
 
   memmove(rtc_sec, rtc_sec + new_first, n_to_save * sizeof(time_t));
-  memmove(rtc_trim, rtc_trim + new_first, n_to_save * sizeof(double));
   memmove(system_times, system_times + new_first, n_to_save * sizeof(struct timespec));
 
   n_samples = n_to_save;
@@ -188,21 +183,16 @@ accumulate_sample(time_t rtc, struct timespec *sys)
   }
 
   /* Discard all samples if the RTC was stepped back (not our trim) */
-  if (n_samples > 0 && rtc_sec[n_samples - 1] - rtc >= rtc_trim[n_samples - 1]) {
+  if (n_samples > 0 && rtc_sec[n_samples - 1] >= rtc) {
     DEBUG_LOG("RTC samples discarded");
     n_samples = 0;
   }
 
   /* Always use most recent sample as reference */
-  /* use sample only if n_sample is not negative*/
-  if(n_samples >=0)
-  {
   rtc_ref = rtc;
   rtc_sec[n_samples] = rtc;
-  rtc_trim[n_samples] = 0.0;
   system_times[n_samples] = *sys;
   ++n_samples_since_regression;
-  }
   ++n_samples;
 }
 
@@ -227,7 +217,7 @@ run_regression(int new_sample,
   if (n_samples > 0) {
 
     for (i=0; i<n_samples; i++) {
-      rtc_rel[i] = rtc_trim[i] + (double)(rtc_sec[i] - rtc_ref);
+      rtc_rel[i] = (double)(rtc_sec[i] - rtc_ref);
       offsets[i] = ((double) (rtc_ref - system_times[i].tv_sec) -
                     (1.0e-9 * system_times[i].tv_nsec) +
                     rtc_rel[i]);
@@ -434,6 +424,7 @@ setup_config(void)
 static void
 read_coefs_from_file(void)
 {
+  double ref_time;
   FILE *in;
 
   if (!tried_to_load_coefs) {
@@ -444,11 +435,12 @@ read_coefs_from_file(void)
 
     if (coefs_file_name &&
         (in = UTI_OpenFile(NULL, coefs_file_name, NULL, 'r', 0))) {
-      if (fscanf(in, "%d%ld%lf%lf",
+      if (fscanf(in, "%d%lf%lf%lf",
                  &valid_coefs_from_file,
-                 &file_ref_time,
+                 &ref_time,
                  &file_ref_offset,
                  &file_rate_ppm) == 4) {
+        file_ref_time = ref_time;
       } else {
         LOG(LOGS_WARN, "Could not read coefficients from %s", coefs_file_name);
       }
@@ -472,7 +464,7 @@ write_coefs_to_file(int valid,time_t ref_time,double offset,double rate)
     return RTC_ST_BADFILE;
 
   /* Gain rate is written out in ppm */
-  fprintf(out, "%1d %ld %.6f %.3f\n", valid, ref_time, offset, 1.0e6 * rate);
+  fprintf(out, "%1d %.0f %.6f %.3f\n", valid, (double)ref_time, offset, 1.0e6 * rate);
   fclose(out);
 
   /* Rename the temporary file to the correct location */
@@ -525,7 +517,6 @@ RTC_Linux_Initialise(void)
   UTI_FdSetCloexec(fd);
 
   rtc_sec = MallocArray(time_t, MAX_SAMPLES);
-  rtc_trim = MallocArray(double, MAX_SAMPLES);
   system_times = MallocArray(struct timespec, MAX_SAMPLES);
 
   /* Setup details depending on configuration options */
@@ -578,7 +569,6 @@ RTC_Linux_Finalise(void)
     LCL_RemoveParameterChangeHandler(slew_samples, NULL);
 
   Free(rtc_sec);
-  Free(rtc_trim);
   Free(system_times);
 }
 
@@ -639,11 +629,7 @@ handle_initial_trim(void)
   run_regression(1, &coefs_valid, &coef_ref_time, &coef_seconds_fast, &coef_gain_rate);
 
   n_samples_since_regression = 0;
-
-  /* Set sample number to -1 so the next sample is not used, as it will not yet be corrected for System Trim*/
-
-  n_samples = -1;
-
+  n_samples = 0;
 
   read_coefs_from_file();
 
@@ -1028,8 +1014,7 @@ RTC_Linux_GetReport(RPT_RTC_Report *report)
   report->n_samples = n_samples;
   report->n_runs = n_runs;
   if (n_samples > 1) {
-    report->span_seconds = ((rtc_sec[n_samples-1] - rtc_sec[0]) +
-                            (long)(rtc_trim[n_samples-1] - rtc_trim[0]));
+    report->span_seconds = rtc_sec[n_samples - 1] - rtc_sec[0];
   } else {
     report->span_seconds = 0;
   }

siv_gnutls.c

@@ -102,8 +102,11 @@ SIV_CreateInstance(SIV_Algorithm algorithm)
     init_gnutls();
 
   /* Check if the cipher is actually supported */
-  if (gnutls_cipher_get_tag_size(calgo) == 0)
+  if (gnutls_cipher_get_tag_size(calgo) == 0) {
+    if (instance_counter == 0)
+      deinit_gnutls();
     return NULL;
+  }
 
   instance = MallocNew(struct SIV_Instance_Record);
   instance->algorithm = calgo;

socket.c

@@ -40,6 +40,7 @@
 #include "array.h"
 #include "logging.h"
 #include "privops.h"
+#include "ptp.h"
 #include "util.h"
 
 #define INVALID_SOCK_FD (-4)
@@ -58,10 +59,16 @@ struct Message {
   union sockaddr_all name;
   struct iovec iov;
   /* Buffer of sufficient length for all expected messages */
-  union {
-    NTP_Packet ntp_msg;
-    CMD_Request cmd_request;
-    CMD_Reply cmd_reply;
+  struct {
+    /* Extra space for Ethernet, IPv4/IPv6, and UDP headers in
+       timestamped messages received from the Linux error queue */
+    uint8_t l234_headers[64];
+    union {
+      NTP_Packet ntp_msg;
+      PTP_NtpMessage ptp_msg;
+      CMD_Request cmd_request;
+      CMD_Reply cmd_reply;
+    } msg;
   } msg_buf;
   /* Aligned buffer for control messages */
   struct cmsghdr cmsg_buf[CMSG_BUF_SIZE / sizeof (struct cmsghdr)];
@@ -498,6 +505,8 @@ bind_unix_address(int sock_fd, const char *addr, int flags)
 {
   union sockaddr_all saddr;
 
+  memset(&saddr, 0, sizeof (saddr));
+
   if (snprintf(saddr.un.sun_path, sizeof (saddr.un.sun_path), "%s", addr) >=
       sizeof (saddr.un.sun_path)) {
     DEBUG_LOG("Unix socket path %s too long", addr);
@@ -530,6 +539,8 @@ connect_unix_address(int sock_fd, const char *addr)
 {
   union sockaddr_all saddr;
 
+  memset(&saddr, 0, sizeof (saddr));
+
   if (snprintf(saddr.un.sun_path, sizeof (saddr.un.sun_path), "%s", addr) >=
       sizeof (saddr.un.sun_path)) {
     DEBUG_LOG("Unix socket path %s too long", addr);

sources.c

@@ -3,7 +3,7 @@
 
  **********************************************************************
  * Copyright (C) Richard P. Curnow  1997-2003
- * Copyright (C) Miroslav Lichvar  2011-2016, 2018, 2020
+ * Copyright (C) Miroslav Lichvar  2011-2016, 2018, 2020-2021
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -589,7 +589,7 @@ log_selection_source(const char *format, SRC_Instance inst)
   name = source_to_string(inst);
   ntp_name = inst->type == SRC_NTP ? NSR_GetName(inst->ip_addr) : NULL;
 
-  if (ntp_name)
+  if (ntp_name && strcmp(name, ntp_name) != 0)
     snprintf(buf, sizeof (buf), "%s (%s)", name, ntp_name);
   else
     snprintf(buf, sizeof (buf), "%s", name);

sourcestats.c

@@ -3,7 +3,7 @@
 
  **********************************************************************
  * Copyright (C) Richard P. Curnow  1997-2003
- * Copyright (C) Miroslav Lichvar  2011-2014, 2016-2018
+ * Copyright (C) Miroslav Lichvar  2011-2014, 2016-2018, 2021
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -779,6 +779,22 @@ SST_SlewSamples(SST_Stats inst, struct timespec *when, double dfreq, double doff
 
 /* ================================================== */
 
+void
+SST_CorrectOffset(SST_Stats inst, double doffset)
+{
+  int i;
+
+  if (!inst->n_samples)
+    return;
+
+  for (i = -inst->runs_samples; i < inst->n_samples; i++)
+    inst->offsets[get_runsbuf_index(inst, i)] += doffset;
+
+  inst->estimated_offset += doffset;
+}
+
+/* ================================================== */
+
 void 
 SST_AddDispersion(SST_Stats inst, double dispersion)
 {
@@ -885,6 +901,7 @@ int
 SST_LoadFromFile(SST_Stats inst, FILE *in)
 {
   int i, n_samples, arun;
+  struct timespec now;
   double sample_time;
   char line[256];
 
@@ -895,6 +912,8 @@ SST_LoadFromFile(SST_Stats inst, FILE *in)
 
   SST_ResetInstance(inst);
 
+  LCL_ReadCookedTime(&now, NULL);
+
   for (i = 0; i < n_samples; i++) {
     if (!fgets(line, sizeof (line), in) ||
         sscanf(line, "%lf %lf %lf %lf %lf %lf %lf",
@@ -903,8 +922,19 @@ SST_LoadFromFile(SST_Stats inst, FILE *in)
                &inst->root_delays[i], &inst->root_dispersions[i]) != 7)
       return 0;
 
+    if (!UTI_IsTimeOffsetSane(&now, sample_time - UTI_TimespecToDouble(&now)))
+      return 0;
+
     /* Some resolution is lost in the double format, but that's ok */
     UTI_DoubleToTimespec(sample_time, &inst->sample_times[i]);
+
+    /* Make sure the samples are sane and they are in order */
+    if (!UTI_IsTimeOffsetSane(&inst->sample_times[i], -inst->offsets[i]) ||
+        !(fabs(inst->peer_delays[i]) < 1.0e6 && fabs(inst->peer_dispersions[i]) < 1.0e6 &&
+          fabs(inst->root_delays[i]) < 1.0e6 && fabs(inst->root_dispersions[i]) < 1.0e6) ||
+        (i > 0 && UTI_CompareTimespecs(&inst->sample_times[i],
+                                       &inst->sample_times[i - 1]) <= 0))
+      return 0;
   }
 
   inst->n_samples = n_samples;

sourcestats.h

@@ -102,6 +102,10 @@ SST_GetTrackingData(SST_Stats inst, struct timespec *ref_time,
 
 extern void SST_SlewSamples(SST_Stats inst, struct timespec *when, double dfreq, double doffset);
 
+/* This routine corrects already accumulated samples to improve the
+   frequency estimate when a new sample is accumulated */
+extern void SST_CorrectOffset(SST_Stats inst, double doffset);
+
 /* This routine is called when an indeterminate offset is introduced
    into the local time. */
 extern void SST_AddDispersion(SST_Stats inst, double dispersion);

srcparams.h

@@ -55,6 +55,7 @@ typedef struct {
   int nts;
   int nts_port;
   int copy;
+  int ext_fields;
   uint32_t authkey;
   uint32_t cert_set;
   double max_delay;

sys_linux.c

@@ -97,21 +97,6 @@ static int have_setoffset;
    updated in the kernel */
 static int tick_update_hz;
 
-/* ================================================== */
-
-inline static long
-our_round(double x)
-{
-  long y;
-
-  if (x > 0.0)
-    y = x + 0.5;
-  else
-    y = x - 0.5;
-
-  return y;
-}
-
 /* ================================================== */
 /* Positive means currently fast of true time, i.e. jump backwards */
 
@@ -149,7 +134,7 @@ set_frequency(double freq_ppm)
   double required_freq;
   int required_delta_tick;
 
-  required_delta_tick = our_round(freq_ppm / dhz);
+  required_delta_tick = round(freq_ppm / dhz);
 
   /* Older kernels (pre-2.6.18) don't apply the frequency offset exactly as
      set by adjtimex() and a scaling constant (that depends on the internal
@@ -486,7 +471,7 @@ void check_seccomp_applicability(void)
 void
 SYS_Linux_EnableSystemCallFilter(int level, SYS_ProcessContext context)
 {
-  const int syscalls[] = {
+  const int allowed[] = {
     /* Clock */
     SCMP_SYS(adjtimex),
     SCMP_SYS(clock_adjtime),
@@ -503,11 +488,15 @@ SYS_Linux_EnableSystemCallFilter(int level, SYS_ProcessContext context)
 
     /* Process */
     SCMP_SYS(clone),
+#ifdef __NR_clone3
+    SCMP_SYS(clone3),
+#endif
     SCMP_SYS(exit),
     SCMP_SYS(exit_group),
     SCMP_SYS(getpid),
     SCMP_SYS(getrlimit),
     SCMP_SYS(getuid),
+    SCMP_SYS(getuid32),
     SCMP_SYS(rt_sigaction),
     SCMP_SYS(rt_sigreturn),
     SCMP_SYS(rt_sigprocmask),
@@ -594,6 +583,7 @@ SYS_Linux_EnableSystemCallFilter(int level, SYS_ProcessContext context)
 #ifdef __NR_ppoll_time64
     SCMP_SYS(ppoll_time64),
 #endif
+    SCMP_SYS(pread64),
     SCMP_SYS(pselect6),
 #ifdef __NR_pselect6_time64
     SCMP_SYS(pselect6_time64),
@@ -613,6 +603,22 @@ SYS_Linux_EnableSystemCallFilter(int level, SYS_ProcessContext context)
     SCMP_SYS(uname),
   };
 
+  const int denied_any[] = {
+    SCMP_SYS(execve),
+#ifdef __NR_execveat
+    SCMP_SYS(execveat),
+#endif
+    SCMP_SYS(fork),
+    SCMP_SYS(ptrace),
+    SCMP_SYS(vfork),
+  };
+
+  const int denied_ntske[] = {
+    SCMP_SYS(ioctl),
+    SCMP_SYS(setsockopt),
+    SCMP_SYS(socket),
+  };
+
   const int socket_domains[] = {
     AF_NETLINK, AF_UNIX, AF_INET,
 #ifdef FEAT_IPV6
@@ -624,6 +630,9 @@ SYS_Linux_EnableSystemCallFilter(int level, SYS_ProcessContext context)
     { SOL_IP, IP_PKTINFO }, { SOL_IP, IP_FREEBIND }, { SOL_IP, IP_TOS },
 #ifdef FEAT_IPV6
     { SOL_IPV6, IPV6_V6ONLY }, { SOL_IPV6, IPV6_RECVPKTINFO },
+#endif
+#ifdef SO_BINDTODEVICE
+    { SOL_SOCKET, SO_BINDTODEVICE },
 #endif
     { SOL_SOCKET, SO_BROADCAST }, { SOL_SOCKET, SO_REUSEADDR },
 #ifdef SO_REUSEPORT
@@ -662,31 +671,65 @@ SYS_Linux_EnableSystemCallFilter(int level, SYS_ProcessContext context)
 #endif
   };
 
+  unsigned int default_action, deny_action;
   scmp_filter_ctx *ctx;
   int i;
 
+  /* Sign of the level determines the deny action (kill or SIGSYS).
+     At level 1, selected syscalls are allowed, others are denied.
+     At level 2, selected syscalls are denied, others are allowed. */
+
+  deny_action = level > 0 ? SCMP_ACT_KILL : SCMP_ACT_TRAP;
+  if (level < 0)
+    level = -level;
+
+  switch (level) {
+    case 1:
+      default_action = deny_action;
+      break;
+    case 2:
+      default_action = SCMP_ACT_ALLOW;
+      break;
+    default:
+      LOG_FATAL("Unsupported filter level");
+  }
+
   if (context == SYS_MAIN_PROCESS) {
     /* Check if the chronyd configuration is supported */
     check_seccomp_applicability();
 
-    /* Start the helper process, which will run without any seccomp filter.  It
-       will be used for getaddrinfo(), for which it's difficult to maintain a
-       list of required system calls (with glibc it depends on what NSS modules
-       are installed and enabled on the system). */
-    PRV_StartHelper();
+    /* At level 1, start a helper process which will not have a seccomp filter.
+       It will be used for getaddrinfo(), for which it is difficult to maintain
+       a list of required system calls (with glibc it depends on what NSS
+       modules are installed and enabled on the system). */
+    if (default_action != SCMP_ACT_ALLOW)
+      PRV_StartHelper();
   }
 
-  ctx = seccomp_init(level > 0 ? SCMP_ACT_KILL : SCMP_ACT_TRAP);
+  ctx = seccomp_init(default_action);
   if (ctx == NULL)
       LOG_FATAL("Failed to initialize seccomp");
 
-  /* Add system calls that are always allowed */
-  for (i = 0; i < (sizeof (syscalls) / sizeof (*syscalls)); i++) {
-    if (seccomp_rule_add(ctx, SCMP_ACT_ALLOW, syscalls[i], 0) < 0)
-      goto add_failed;
+  if (default_action != SCMP_ACT_ALLOW) {
+    for (i = 0; i < sizeof (allowed) / sizeof (*allowed); i++) {
+      if (seccomp_rule_add(ctx, SCMP_ACT_ALLOW, allowed[i], 0) < 0)
+        goto add_failed;
+    }
+  } else {
+    for (i = 0; i < sizeof (denied_any) / sizeof (*denied_any); i++) {
+      if (seccomp_rule_add(ctx, deny_action, denied_any[i], 0) < 0)
+        goto add_failed;
+    }
+
+    if (context == SYS_NTSKE_HELPER) {
+      for (i = 0; i < sizeof (denied_ntske) / sizeof (*denied_ntske); i++) {
+        if (seccomp_rule_add(ctx, deny_action, denied_ntske[i], 0) < 0)
+          goto add_failed;
+      }
+    }
   }
 
-  if (context == SYS_MAIN_PROCESS) {
+  if (default_action != SCMP_ACT_ALLOW && context == SYS_MAIN_PROCESS) {
     /* Allow opening sockets in selected domains */
     for (i = 0; i < sizeof (socket_domains) / sizeof (*socket_domains); i++) {
       if (seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), 1,
@@ -696,10 +739,9 @@ SYS_Linux_EnableSystemCallFilter(int level, SYS_ProcessContext context)
 
     /* Allow selected socket options */
     for (i = 0; i < sizeof (socket_options) / sizeof (*socket_options); i++) {
-      if (seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(setsockopt), 3,
+      if (seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(setsockopt), 2,
                            SCMP_A1(SCMP_CMP_EQ, socket_options[i][0]),
-                           SCMP_A2(SCMP_CMP_EQ, socket_options[i][1]),
-                           SCMP_A4(SCMP_CMP_LE, sizeof (int))) < 0)
+                           SCMP_A2(SCMP_CMP_EQ, socket_options[i][1])))
         goto add_failed;
     }
 
@@ -723,7 +765,8 @@ SYS_Linux_EnableSystemCallFilter(int level, SYS_ProcessContext context)
   if (seccomp_load(ctx) < 0)
     LOG_FATAL("Failed to load seccomp rules");
 
-  LOG(context == SYS_MAIN_PROCESS ? LOGS_INFO : LOGS_DEBUG, "Loaded seccomp filter");
+  LOG(context == SYS_MAIN_PROCESS ? LOGS_INFO : LOGS_DEBUG,
+      "Loaded seccomp filter (level %d)", level);
   seccomp_release(ctx);
   return;
 

sys_solaris.c

@@ -21,23 +21,54 @@
 
   =======================================================================
 
-  Driver file for Solaris operating system
+  Driver file for illumos operating system (previously Solaris)
   */
 
 #include "config.h"
 
 #include "sysincl.h"
 
+#include "logging.h"
 #include "privops.h"
 #include "sys_solaris.h"
 #include "sys_timex.h"
 #include "util.h"
 
+#include <kvm.h>
+#include <nlist.h>
+
+/* ================================================== */
+
+static void
+set_dosynctodr(int on_off)
+{
+  struct nlist nl[] = { {"dosynctodr"}, {NULL} };
+  kvm_t *kt;
+
+  kt = kvm_open(NULL, NULL, NULL, O_RDWR, NULL);
+  if (!kt)
+    LOG_FATAL("Could not open kvm");
+
+  if (kvm_nlist(kt, nl) < 0 || !nl[0].n_value)
+    LOG_FATAL("Could not get dosynctodr address");
+
+  if (kvm_kwrite(kt, nl[0].n_value, &on_off, sizeof (on_off)) < 0)
+    LOG_FATAL("Could not write to dosynctodr");
+
+  kvm_close(kt);
+}
+
 /* ================================================== */
 
 void
 SYS_Solaris_Initialise(void)
 {
+  /* The kernel keeps the system clock and hardware clock synchronised to each
+     other.  The dosynctodr variable needs to be set to zero to prevent the
+     the system clock from following the hardware clock when the system clock
+     is not adjusted by adjtime() or ntp_adjtime(modes=MOD_OFFSET). */
+  set_dosynctodr(0);
+
   /* The kernel allows the frequency to be set in the full range off int32_t */
   SYS_Timex_InitialiseWithFunctions(32500, 1.0 / 100, NULL, NULL, NULL,
                                     0.0, 0.0, NULL, NULL);

test/compilation/002-scanbuild

@@ -8,7 +8,8 @@ for opts in \
 	"--host-system=FreeBSD" \
 	"--without-nettle" \
 	"--without-nettle --without-nss" \
-	"--without-nettle --without-nss --without-tomcrypt"
+	"--without-nettle --without-nss --without-tomcrypt" \
+	"--without-nettle --without-nss --without-tomcrypt --without-gnutls"
 do
 	./configure $opts
 	scan-build make "$@" || exit 1

test/compilation/003-sanitizers

@@ -13,16 +13,23 @@ fi
 
 if [ "$ID" = "fedora" ]; then
   echo Checking test dependencies:
-  rpm -q {valgrind,gcc,clang}.x86_64 {libgcc,clang-libs}.{x86_64,i686} || exit 1
+  rpm -q {gcc,clang}.x86_64 {valgrind,libgcc,clang-libs}.{x86_64,i686} || exit 1
   rpm -q {libseccomp,nettle,nss-softokn-freebl,libtomcrypt,gnutls}-devel.{x86_64,i686} || exit 1
   echo
 fi
 
 touch Makefile
 
-for CC in gcc clang; do
-  export CC
-
+for extra_config_opts in \
+  "--all-privops" \
+  "--disable-ipv6" \
+  "--disable-scfilter" \
+  "--without-gnutls" \
+  "--without-nettle" \
+  "--without-nettle --without-nss" \
+  "--without-nettle --without-nss --without-tomcrypt" \
+  "--without-nettle --without-nss --without-tomcrypt --without-gnutls"; \
+do
   for arch_opts in "-m32" ""; do
     pushd test/simulation/clknetsim || exit 1
     make clean > /dev/null 2>&1
@@ -31,26 +38,21 @@ for CC in gcc clang; do
 
     popd
 
-    for extra_config_opts in \
-      "--all-privops" \
-      "--disable-scfilter" \
-      "--without-gnutls" \
-      "--without-nettle" \
-      "--without-nettle --without-nss" \
-      "--without-nettle --without-nss --without-tomcrypt"; \
-    do
+    for CC in gcc clang; do
+      export CC
+
       for san_options in "" "-fsanitize=address" "-fsanitize=memory"; do
         export CFLAGS="-O2 -g -fsanitize=undefined -fsanitize=float-divide-by-zero -fno-sanitize-recover=undefined,float-divide-by-zero $san_options $arch_opts"
 
         # clang msan doesn't work on i686 and otherwise requires patches
         echo $CFLAGS | grep -q 'sanitize=memory' && continue
 
-        # build fails with clang ubsan on i686 (Fedora only?)
-        [ "$arch_opts" = "-m32" -a "$CC" = "clang" ] && continue
+        [ -n "$TEST_NO_M32_CLANG" -a "$arch_opts" = "-m32" -a "$CC" = "clang" ] && continue
 
-        [ "$CC" = "gcc" ] && echo $CFLAGS | grep -q 'sanitize=address' && CFLAGS="$CFLAGS -static-libasan"
+        [ -n "$TEST_GCC_STATIC_ASAN" -a "$CC" = "gcc" ] &&
+                echo $CFLAGS | grep -q 'sanitize=address' && CFLAGS="$CFLAGS -static-libasan"
 
-        config_opts="--with-user=chrony --enable-debug --enable-scfilter --enable-ntp-signd $extra_config_opts"
+        config_opts="--with-user=chrony --with-ntp-era=1000000000 --enable-debug --enable-scfilter --enable-ntp-signd $extra_config_opts"
 
         echo -----------------------------------------------------------------------------
         echo CC=\"$CC\" CFLAGS=\"$CFLAGS\" ./configure $config_opts
@@ -67,10 +69,11 @@ for CC in gcc clang; do
 
         make "$@" || exit 1
 
-        [ -n "$BUILD_TEST_ONLY" ] && continue
+        [ -n "$TEST_BUILD_ONLY" ] && continue
 
         echo
         pushd test/unit || exit 1
+        make "$@" || exit 1
         if [ "$san_options" = "" ]; then
           make check TEST_WRAPPER="valgrind --error-exitcode=1" || exit 1
         else
@@ -78,11 +81,16 @@ for CC in gcc clang; do
         fi
         popd
 
+        [ -n "$TEST_UNIT_ONLY" ] && continue
+
         echo
         pushd test/simulation || exit 1
         export CLKNETSIM_RANDOM_SEED=101
         if [ "$arch_opts" = "" -a "$san_options" = "" ]; then
           CLKNETSIM_CLIENT_WRAPPER=valgrind ./run -i 1 || exit 1
+        elif [ "$CC" = "gcc" ] && ! echo $CFLAGS | grep -q "-static-libasan"; then
+          libasan=$(ldd ../../chronyd | grep -o '/.*lib.*/libasan.so.[0-9]')
+          CLKNETSIM_PRELOAD=$libasan ./run -i 1 || exit 1
         else
           ./run -i 1 || exit 1
         fi

test/simulation/008-ntpera

@@ -3,38 +3,48 @@
 . ./test.common
 test_start "NTP eras"
 
-# Assume NTP_ERA_SPLIT is between years 1960 and 1990
+if check_config_h 'HAVE_LONG_TIME_T 1'; then
+	ntp_start=$(awk "BEGIN {print $(grep NTP_ERA_SPLIT ../../config.h | tr -dc '0-9*+-')}")
+else
+	ntp_start="-2147483648"
+fi
 
-# Set date to 500 seconds before NTP second overflows, this should
-# work correctly with both 32-bit and 64-bit time_t
+# Set the starting test date to 500 seconds before the second NTP era.
+# This should work with 32-bit time_t and also with 64-bit time_t if the
+# configured NTP interval covers the test interval.
 export CLKNETSIM_START_DATE=$(date -d 'Feb  7 06:19:56 UTC 2036' +'%s')
 
-run_test || test_fail
-check_chronyd_exit || test_fail
-check_source_selection || test_fail
-check_packet_interval || test_fail
-check_sync || test_fail
-
-# The following tests need 64-bit time_t
-check_config_h 'HAVE_LONG_TIME_T 1' || test_skip
-
-for year in 1990 2090; do
-	export CLKNETSIM_START_DATE=$(date -d "Jan  1 00:00:00 UTC $year" +'%s')
+if awk "BEGIN {exit !($ntp_start <= $CLKNETSIM_START_DATE && \
+		$CLKNETSIM_START_DATE + $limit < $ntp_start + 2^32)}"; then
 	run_test || test_fail
 	check_chronyd_exit || test_fail
 	check_source_selection || test_fail
 	check_packet_interval || test_fail
 	check_sync || test_fail
-done
+fi
 
-for year in 1950 2130; do
-	export CLKNETSIM_START_DATE=$(date -d "Jan  1 00:00:00 UTC $year" +'%s')
-	run_test || test_fail
-	check_chronyd_exit || test_fail
-	check_source_selection || test_fail
-	check_packet_interval || test_fail
-	# This check is expected to fail
-	check_sync && test_fail
+# The following tests need 64-bit time_t and ntp_start not before 1970
+check_config_h 'HAVE_LONG_TIME_T 1' || test_skip
+echo "$ntp_start" | grep -q '-' && test_skip
+
+for time_offset in -1e-1 1e-1; do
+	for start_offset in 0 "2^32 - $limit"; do
+		export CLKNETSIM_START_DATE=$(awk "BEGIN {print $ntp_start + $start_offset}")
+		run_test || test_fail
+		check_chronyd_exit || test_fail
+		check_source_selection || test_fail
+		check_packet_interval || test_fail
+		check_sync || test_fail
+	done
+
+	for start_offset in -$limit "2^32"; do
+		export CLKNETSIM_START_DATE=$(awk "BEGIN {print $ntp_start + $start_offset}")
+		run_test || test_fail
+		check_chronyd_exit || test_fail
+		check_source_selection || test_fail
+		check_packet_interval || test_fail
+		check_sync && test_fail
+	done
 done
 
 test_pass

test/simulation/110-chronyc

@@ -14,6 +14,7 @@ server 192.168.123.2"
 client_conf="
 refclock SHM 0 noselect
 smoothtime 400 0.001 leaponly"
+cmdmon_unix=0
 
 chronyc_conf="activity
 tracking
@@ -92,7 +93,7 @@ check_chronyc_output "^C0A87B01,192\.168\.123\.1,2,12623049..\..........,-?0\.00
 
 chronyc_options=""
 server_strata=0
-chronyc_start=0
+chronyc_start=0.5
 client_server_conf=""
 client_conf=""
 server_conf="server 192.168.123.1"
@@ -101,16 +102,14 @@ limit=1
 for chronyc_conf in \
 	"accheck 1.2.3.4" \
 	"add peer 10.0.0.0 minpoll 2 maxpoll 6" \
-	"add server 10.0.0.0 minpoll 6 maxpoll 10 iburst burst key 1 certset 2 maxdelay 1e-3 maxdelayratio 10.0 maxdelaydevratio 10.0 mindelay 1e-4 asymmetry 0.5 offset 1e-5 minsamples 6 maxsamples 6 filter 3 offline auto_offline prefer noselect trust require xleave polltarget 20 port 123 presend 7 minstratum 3 version 4 nts ntsport 4460 copy" \
+	"add server 10.0.0.0 minpoll 6 maxpoll 10 iburst burst key 1 certset 2 maxdelay 1e-3 maxdelayratio 10.0 maxdelaydevratio 10.0 mindelay 1e-4 asymmetry 0.5 offset 1e-5 minsamples 6 maxsamples 6 filter 3 offline auto_offline prefer noselect trust require xleave polltarget 20 port 123 presend 7 minstratum 3 version 4 nts ntsport 4460 copy extfield F323" \
 	"add server node1.net1.clk" \
 	"allow 1.2.3.4" \
 	"allow 1.2" \
 	"allow 3.4.5" \
 	"allow 6.7.8/22" \
 	"allow 6.7.8.9/22" \
-	"allow 2001:db8::/32" \
 	"allow 0/0" \
-	"allow ::/0" \
 	"allow" \
 	"allow all 10/24" \
 	"authdata" \
@@ -180,6 +179,257 @@ do
 	check_chronyc_output "501 Not authorised$" || test_fail
 done
 
+cmdmon_unix=1
+
+chronyc_conf="
+authdata
+clients -k -p 2
+clients -r
+clients
+ntpdata
+selectdata
+serverstats"
+
+run_test || test_fail
+check_chronyd_exit || test_fail
+
+check_chronyc_output "^Name/IP address             Mode KeyID Type KLen Last Atmp  NAK Cook CLen
+=========================================================================
+node1\.net1\.clk                 -     0    0    0    -    0    0    0    0
+Hostname                      NTP   Drop Int IntL Last  NTS-KE   Drop Int  Last
+===============================================================================
+Hostname                      NTP   Drop Int IntL Last     Cmd   Drop Int  Last
+===============================================================================
+node1\.net1\.clk                  1      0   -   -     0       0      0   -     -
+Hostname                      NTP   Drop Int IntL Last     Cmd   Drop Int  Last
+===============================================================================
+node1\.net1\.clk                  0      0   -   -     0       0      0   -     -
+
+Remote address  : 192\.168\.123\.1 \(C0A87B01\)
+Remote port     : 123
+Local address   : 192\.168\.123\.1 \(C0A87B01\)
+Leap status     : Normal
+Version         : 4
+Mode            : Server
+Stratum         : 1
+Poll interval   : 6 \(64 seconds\)
+Precision       : -23 \(0\.000000119 seconds\)
+Root delay      : 0\.000000 seconds
+Root dispersion : 0\.000000 seconds
+Reference ID    : 7F7F0101 \(\)
+Reference time  : Thu Dec 31 23:59:5[89] 2009
+Offset          : [-+]0\.000...... seconds
+Peer delay      : 0\.00....... seconds
+Peer dispersion : 0\.00000.... seconds
+Response time   : 0\.000000... seconds
+Jitter asymmetry: \+0\.00
+NTP tests       : 111 111 1110
+Interleaved     : No
+Authenticated   : No
+TX timestamping : Kernel
+RX timestamping : Kernel
+Total TX        : 1
+Total RX        : 1
+Total valid RX  : 1
+S Name/IP Address        Auth COpts EOpts Last Score     Interval  Leap
+=======================================================================
+M node1\.net1\.clk            N ----- -----    0   1\.0    \+0ns    \+0ns  N
+NTP packets received       : 1
+NTP packets dropped        : 0
+Command packets received   : 12
+Command packets dropped    : 0
+Client log records dropped : 0
+NTS-KE connections accepted: 0
+NTS-KE connections dropped : 0
+Authenticated NTP packets  : 0
+Interleaved NTP packets    : 0
+NTP timestamps held        : 0
+NTP timestamp span         : 0$" || test_fail
+
+chronyc_conf="
+deny all
+cmdallow all
+allow 1.2.3.4
+allow 1.2.3.0/28
+deny 1.2.3.0/27
+allow 1.2.4.5
+deny all 1.2.4.0/27
+cmddeny 5.6.7.8
+cmdallow all 5.6.7.0/28
+accheck 1.2.3.4
+accheck 1.2.3.5
+accheck 1.2.4.5
+cmdaccheck 5.6.7.8"
+
+run_test || test_fail
+check_chronyd_exit || test_fail
+
+check_chronyc_output "^200 OK
+200 OK
+200 OK
+200 OK
+200 OK
+200 OK
+200 OK
+200 OK
+200 OK
+208 Access allowed
+209 Access denied
+209 Access denied
+208 Access allowed$" || test_fail
+
+if check_config_h 'FEAT_IPV6 1'; then
+	chronyc_conf="
+	deny all
+	cmdallow all
+	allow 2001:db8::1
+	allow 2001:db8::/64
+	deny 2001:db8::/63
+	allow 2001:db8:1::1
+	deny all 2001:db8:1::/63
+	cmddeny 2001:db9::1
+	cmdallow all 2001:db9::/64
+	accheck 2001:db8::1
+	accheck 2001:db8::2
+	accheck 2001:db8:1::1
+	cmdaccheck 2001:db9::1"
+
+	run_test || test_fail
+	check_chronyd_exit || test_fail
+
+	check_chronyc_output "^200 OK
+200 OK
+200 OK
+200 OK
+200 OK
+200 OK
+200 OK
+200 OK
+200 OK
+208 Access allowed
+209 Access denied
+209 Access denied
+208 Access allowed$" || test_fail
+fi
+
+chronyc_conf="
+delete 192.168.123.1
+add server node1.net1.clk minpoll 6 maxpoll 10 iburst
+offline 192.168.123.1
+burst 1/1 192.168.123.1
+online 192.168.123.1
+maxdelay 192.168.123.1 1e-2
+maxdelaydevratio 192.168.123.1 5.0
+maxdelayratio 192.168.123.1 3.0
+maxpoll 192.168.123.1 5
+maxupdateskew 192.168.123.1 10.0
+minpoll 192.168.123.1 3
+minstratum 192.168.123.1 1
+polltarget 192.168.123.1 10
+delete 192.168.123.1"
+
+run_test || test_fail
+check_chronyd_exit || test_fail
+
+check_chronyc_output "^200 OK
+200 OK
+200 OK
+200 OK
+200 OK
+200 OK
+200 OK
+200 OK
+200 OK
+200 OK
+200 OK
+200 OK
+200 OK
+200 OK$" || test_fail
+
+chronyc_conf="
+cyclelogs
+dump
+dfreq 1.0e-3
+doffset -0.01
+local stratum 5 distance 1.0 orphan
+local off
+makestep 10.0 3
+makestep
+manual on
+settime now
+manual delete 0
+manual reset
+manual off
+onoffline
+refresh
+rekey
+reload sources
+reselect
+reselectdist 1e-3
+reset sources
+shutdown"
+
+run_test || test_fail
+check_chronyd_exit || test_fail
+
+check_chronyc_output "^200 OK
+200 OK
+200 OK
+200 OK
+200 OK
+200 OK
+200 OK
+200 OK
+200 OK
+200 OK
+Clock was .\... seconds fast.  Frequency change = 0.00ppm, new frequency = 0.00ppm
+200 OK
+200 OK
+200 OK
+200 OK
+200 OK
+200 OK
+200 OK
+200 OK
+200 OK
+200 OK
+200 OK$" || test_fail
+
+server_conf="
+server 192.168.123.1
+noclientlog"
+
+commands=(
+	"add server nosuchnode.net1.clk" "^Invalid host/IP address$"
+	"allow nosuchnode.net1.clk" "^Could not read address$"
+	"allow 192.168.123.0/2 4" "^Could not read address$"
+	"allow 192.168.123.0/2e" "^Could not read address$"
+	"allow 192.168.12e" "^Could not read address$"
+	"allow 192.168123" "^Could not read address$"
+	"allow 192.168.123.2/33" "^507 Bad subnet$"
+	"clients" "Hostname.*519 Client logging is not active in the daemon$"
+	"delete 192.168.123.2" "^503 No such source$"
+	"minpoll 192.168.123.2 5" "^503 No such source$"
+	"ntpdata 192.168.123.2" "^503 No such source$"
+	"settime now" "^505 Facility not enabled in daemon$"
+	"smoothing" "^505 Facility not enabled in daemon$"
+	"smoothtime activate" "^505 Facility not enabled in daemon$"
+	"smoothtime reset" "^505 Facility not enabled in daemon$"
+	"sourcename 192.168.123.2" "^503 No such source$"
+	"trimrtc" "^513 RTC driver not running$"
+	"writertc" "^513 RTC driver not running$"
+)
+
+for i in $(seq 0 $[${#commands[*]} / 2]); do
+	chronyc_conf=${commands[$[i * 2]]}
+	run_test || test_fail
+	check_chronyd_exit || test_fail
+	check_chronyc_output "${commands[$[i * 2 + 1]]}" || test_fail
+done
+
+cmdmon_unix=0
+server_conf="server 192.168.123.1"
+
 chronyc_conf="dns -n
 dns +n
 dns -4

test/simulation/122-xleave

@@ -8,6 +8,18 @@ client_conf="
 logdir tmp
 log rawmeasurements"
 
+server_conf="noclientlog"
+
+run_test || test_fail
+check_chronyd_exit || test_fail
+check_source_selection || test_fail
+check_sync || test_fail
+
+check_file_messages "111 111 1111.* 4I [DKH] [DKH]\$" 0 0 measurements.log || test_fail
+rm -f tmp/measurements.log
+
+server_conf=""
+
 run_test || test_fail
 check_chronyd_exit || test_fail
 check_source_selection || test_fail
@@ -52,4 +64,26 @@ for rpoll in 4 5 6; do
 	rm -f tmp/measurements.log
 done
 
+if check_config_h 'FEAT_CMDMON 1'; then
+	# test client timestamp selection and server timestamp correction
+	base_delay="(+ 1.25e-6 (* -1 (equal 0.1 from 5)))"
+	jitter=1e-9
+	wander=1e-12
+	client_lpeer_options="xleave minpoll 5 maxpoll 5 noselect"
+	client_rpeer_options="xleave minpoll 5 maxpoll 5 noselect"
+	chronyc_conf="doffset -0.1"
+	chronyc_start=7200
+
+	run_test || test_fail
+	check_chronyd_exit || test_fail
+	check_source_selection || test_fail
+	check_sync && test_fail
+
+	check_file_messages "\.2   N  2 111 111 ....   5  5 .\... ..\....e-..  2\....e-06" \
+		290 310 measurements.log || test_fail
+	check_file_messages "\.2   N  2 111 111 ....   5  5 .\... ..\....e-..  .\....e-0[0123]" \
+		0 0 measurements.log || test_fail
+	rm -f tmp/measurements.log
+fi
+
 test_pass

test/simulation/142-ptpport

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+
+. ./test.common
+
+test_start "PTP port"
+
+# Block communication between 3 and 1
+base_delay="(+ 1e-4 (* -1 (equal 0.1 from 3) (equal 0.1 to 1)))"
+
+cat > tmp/peer.keys <<-EOF
+1 MD5 1234567890
+EOF
+
+clients=2
+peers=2
+max_sync_time=420
+
+server_conf="
+ptpport 319"
+client_conf="
+ptpport 319
+authselectmode ignore
+keyfile tmp/peer.keys"
+client_server_options="minpoll 6 maxpoll 6 port 319"
+client_peer_options="minpoll 6 maxpoll 6 port 319 key 1"
+
+run_test || test_fail
+check_chronyd_exit || test_fail
+check_source_selection || test_fail
+check_sync || test_fail
+
+check_file_messages "	2	1	.*	319	319	1	96	" 150 160 \
+	log.packets || test_fail
+check_file_messages "	1	2	.*	319	319	1	96	" 150 160 \
+	log.packets || test_fail
+check_file_messages "	2	3	.*	319	319	1	116	" 150 160 \
+	log.packets || test_fail
+check_file_messages "	3	2	.*	319	319	1	116	" 150 160 \
+	log.packets || test_fail
+
+test_pass

test/simulation/143-manual

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+
+. ./test.common
+
+export TZ=UTC
+
+test_start "manual input"
+
+check_config_h 'FEAT_CMDMON 1' || test_skip
+
+limit=$[12 * 3600]
+client_server_conf=" "
+client_conf="manual"
+chronyc_conf="timeout 4000000
+settime 1:00:00
+settime 2:00:00
+settime 3:00:00
+settime 4:00:00
+manual delete 2
+settime 6:00:00
+manual list
+settime 8:00:00
+manual reset
+settime 10:00:00
+manual list"
+chronyc_start=1800
+base_delay=1800
+jitter=1e-6
+
+time_max_limit=4e-3
+freq_max_limit=4e-3
+time_rms_limit=2e-3
+freq_rms_limit=2e-5
+min_sync_time=7204
+max_sync_time=7206
+
+run_test || test_fail
+check_chronyd_exit || test_fail
+check_sync || test_fail
+
+check_chronyc_output "^200 OK
+Clock was 0\.4. seconds fast\.  Frequency change = 0\.00ppm, new frequency = 0\.00ppm
+200 OK
+Clock was 0\.3. seconds fast\.  Frequency change = (99|100)\...ppm, new frequency = (99|100)\...ppm
+200 OK
+Clock was \-?0\.0. seconds fast\.  Frequency change = \-?0\.[01].ppm, new frequency = (99|100)\...ppm
+200 OK
+Clock was \-?0\.0. seconds fast\.  Frequency change = \-?0\.[01].ppm, new frequency = (99|100)\...ppm
+200 OK
+200 OK
+Clock was \-?0\.0. seconds fast\.  Frequency change = \-?0\.[012].ppm, new frequency = (99|100)\...ppm
+210 n_samples = 4
+#    Date     Time\(UTC\)    Slewed   Original   Residual
+=======================================================
+ 0 2010-01-01 (00:59:59|01:00:00)      [- ]0\.00       0\.46      [- ]0\.00
+ 1 2010-01-01 (01:59:59|02:00:00)      [- ]0\.00       0\.36      [- ]0\.00
+ 2 2010-01-01 (03:59:59|04:00:00)      [- ]0\.00      [- ]0\.00      [- ]0\.00
+ 3 2010-01-01 (05:59:59|06:00:00)      [- ]0\.00      [- ]0\.00      [- ]0\.00
+200 OK
+Clock was \-?0\.0. seconds fast\.  Frequency change = \-?0\.[012].ppm, new frequency = (99|100)\...ppm
+200 OK
+200 OK
+Clock was \-?0\.0. seconds fast\.  Frequency change = \-?0\.00ppm, new frequency = (99|100)\...ppm
+210 n_samples = 1
+#    Date     Time\(UTC\)    Slewed   Original   Residual
+=======================================================
+ 0 2010-01-01 (09:59:59|10:00:00)      [- ]0\.00      [- ]0\.00      [- ]0\.00$" \
+	|| test_fail
+
+test_pass

test/simulation/144-exp1

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+
+. ./test.common
+
+test_start "experimental extension field"
+
+check_config_h 'FEAT_CMDMON 1' || test_skip
+
+primary_time_offset=0.1
+server_strata=4
+min_sync_time=2000
+max_sync_time=2300
+chronyc_conf="doffset 0.1"
+chronyc_options="-h /clknetsim/unix/1:1"
+chronyc_start=2000
+
+for options in "extfield F323" "xleave extfield F323"; do
+	client_server_options="minpoll 6 maxpoll 6 $options"
+	server_server_options="$client_server_options"
+
+	run_test || test_fail
+	check_chronyd_exit || test_fail
+	check_source_selection || test_fail
+	check_sync || test_fail
+done
+
+server_server_options=""
+server_strata=1
+clients=4
+peers=4
+max_sync_time=2400
+# chain of peers and one enabled chronyc
+base_delay=$(cat <<-EOF | tr -d '\n'
+  (+ 1e-4 -1
+     (equal 0.1 from (+ to 1))
+     (equal 0.1 from (+ to -1))
+     (equal 0.1 from 6)
+     (equal 0.1 to 6))
+EOF
+)
+
+for lpoll in 5 6 7; do
+	for options in "minsamples 16 extfield F323" "minsamples 16 xleave extfield F323"; do
+		client_lpeer_options="minpoll $lpoll maxpoll $lpoll $options"
+		client_rpeer_options="minpoll 6 maxpoll 6 $options"
+		client_server_options="$client_rpeer_options"
+
+		run_test || test_fail
+		check_chronyd_exit || test_fail
+		check_source_selection || test_fail
+		check_sync || test_fail
+	done
+done
+
+test_pass

test/simulation/test.common

@@ -27,6 +27,7 @@ fi
 # Default test testings
 
 default_limit=10000
+default_primary_time_offset=0.0
 default_time_offset=1e-1
 default_freq_offset=1e-4
 default_base_delay=1e-4
@@ -76,6 +77,7 @@ default_max_sync_time=210
 default_client_min_mean_out_interval=0.0
 default_client_max_min_out_interval=inf
 
+default_cmdmon_unix=1
 default_dns=0
 
 # Initialize test settings from their defaults
@@ -434,6 +436,7 @@ run_simulation() {
 	test_message 2 0 "running simulation:"
 
 	start_server $nodes \
+		-n 2 \
 		-o tmp/log.offset -f tmp/log.freq -p tmp/log.packets \
 		-R $(awk "BEGIN {print $update_interval < 0 ? 2^-($update_interval) : 1}") \
 		-r $(awk "BEGIN {print $max_sync_time * 2^$update_interval}") \
@@ -449,6 +452,8 @@ run_test() {
 	nodes=$(get_chronyd_nodes)
 	[ -n "$chronyc_conf" ] && nodes=$[$nodes + $clients]
 
+	export CLKNETSIM_UNIX_SUBNET=$[$cmdmon_unix != 0 ? 2 : 0]
+
 	for i in $(seq 1 $nodes); do
 		echo "node${i}_shift_pll = $shift_pll"
 		for j in $(seq 1 $nodes); do
@@ -468,7 +473,8 @@ run_test() {
 				step=$server_step
 				start=$server_start
 				freq=""
-				[ $i -le $falsetickers ] && offset=$i.0 || offset=0.0
+				[ $i -le $falsetickers ] &&
+					offset=$i.0 || offset=$primary_time_offset
 				options=$server_chronyd_options
 			elif [ $stratum -le $server_strata ]; then
 				step=$server_step
@@ -503,9 +509,15 @@ run_test() {
 	for i in $(seq 1 $[$nodes - $node + 1]); do
 		test_message 2 0 "starting node $node:"
 
+		options=$([ $dns -eq 0 ] && printf "%s" "-n")
+		if [ $cmdmon_unix -ne 0 ]; then
+			options+=" -h /clknetsim/unix/$[$node - $clients]:1"
+		else
+			options+=" -h $(get_node_name $[$node - $clients])"
+		fi
+
 		echo "node${node}_start = $chronyc_start" >> tmp/conf
-		start_client $node chronyc "$chronyc_conf" "" \
-			"$([ $dns -eq 0 ] && printf "%s" "-n") -h $(get_node_name $[$node - $clients]) $chronyc_options" && \
+		start_client $node chronyc "$chronyc_conf" "" "$options $chronyc_options" && \
 			test_ok || test_error
 
 		[ $? -ne 0 ] && return 1

test/system/005-scfilter

@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-
-. ./test.common
-
-check_chronyd_features SCFILTER || test_skip "SCFILTER support disabled"
-
-test_start "system call filter"
-
-for extra_chronyd_options in "-F -1" "-F 1"; do
-	start_chronyd || test_fail
-	wait_for_sync || test_fail
-	stop_chronyd || test_fail
-	check_chronyd_messages || test_fail
-	check_chronyd_files || test_fail
-done
-
-test_pass

test/system/007-cmdmon

@@ -23,8 +23,11 @@ for command in \
 	"dfreq 1.0e-3" \
 	"doffset -0.1" \
 	"dump" \
+	"offline" \
 	"local off" \
 	"local" \
+	"online" \
+	"onoffline" \
 	"maxdelay $server 1e-1" \
 	"maxdelaydevratio $server 5.0" \
 	"maxdelayratio $server 3.0" \
@@ -32,9 +35,6 @@ for command in \
 	"maxupdateskew $server 10.0" \
 	"minpoll $server 10" \
 	"minstratum $server 1" \
-	"offline" \
-	"online" \
-	"onoffline" \
 	"polltarget $server 10" \
 	"refresh" \
 	"rekey" \
@@ -110,7 +110,10 @@ Command packets dropped    : 0
 Client log records dropped : 0
 NTS-KE connections accepted: 0
 NTS-KE connections dropped : 0
-Authenticated NTP packets  : 0$" || test_fail
+Authenticated NTP packets  : 0
+Interleaved NTP packets    : 0
+NTP timestamps held        : 0
+NTP timestamp span         : 0$"|| test_fail
 
 run_chronyc "manual on" || test_fail
 check_chronyc_output "^200 OK$" || test_fail

test/system/010-nts

@@ -5,8 +5,6 @@
 check_chronyd_features NTS || test_skip "NTS support disabled"
 certtool --help &> /dev/null || test_skip "certtool missing"
 
-check_chronyd_features PRIVDROP && user="nobody"
-
 test_start "NTS authentication"
 
 cat > $TEST_DIR/cert.cfg <<EOF
@@ -14,8 +12,8 @@ cn = "chrony-nts-test"
 dns_name = "chrony-nts-test"
 ip_address = "$server"
 serial = 001
-activation_date = "$(date -d '1 year ago' +'%Y-%m-%d') 00:00:00 UTC"
-expiration_date = "$(date -d '1 year' +'%Y-%m-%d') 00:00:00 UTC"
+activation_date = "$[$(date '+%Y') - 1]-01-01 00:00:00 UTC"
+expiration_date = "$[$(date '+%Y') + 2]-01-01 00:00:00 UTC"
 signing_key
 encryption_key
 EOF
@@ -51,8 +49,6 @@ stop_chronyd || test_fail
 check_chronyd_messages || test_fail
 check_chronyd_files || test_fail
 
-rm -f $TEST_LOGDIR/measurements.log
-
 server_options="port $ntpport nts ntsport $((ntsport + 1))"
 
 start_chronyd || test_fail

test/system/099-scfilter

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+
+. ./test.common
+
+check_chronyd_features SCFILTER || test_skip "SCFILTER support disabled"
+
+test_start "system call filter in non-destructive tests"
+
+for level in "-1" "1" "-2" "2"; do
+	test_message 1 1 "level $level:"
+	for test in 0[0-8][0-9]-*[^_]; do
+		test_message 2 0 "$test"
+		TEST_SCFILTER=$level "./$test" > /dev/null 2> /dev/null
+		result=$?
+
+		if [ $result != 0 ] && [ $result != 9 ] ; then
+			test_bad
+			test_fail
+		fi
+		test_ok
+	done
+done
+
+test_pass

test/system/199-scfilter

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+
+. ./test.common
+
+check_chronyd_features SCFILTER || test_skip "SCFILTER support disabled"
+
+test_start "system call filter in destructive tests"
+
+for level in "-1" "1" "-2" "2"; do
+	test_message 1 1 "level $level:"
+	for test in 1[0-8][0-9]-*[^_]; do
+		test_message 2 0 "$test"
+		TEST_SCFILTER=$level "./$test" > /dev/null 2> /dev/null
+		result=$?
+
+		if [ $result != 0 ] && [ $result != 9 ] ; then
+			test_bad
+			test_fail
+		fi
+		test_ok
+	done
+done
+
+test_pass

test/system/test.common

@@ -20,6 +20,7 @@ TEST_DIR=${TEST_DIR:-$(pwd)/tmp}
 TEST_LIBDIR=${TEST_LIBDIR:-$TEST_DIR}
 TEST_LOGDIR=${TEST_LOGDIR:-$TEST_DIR}
 TEST_RUNDIR=${TEST_RUNDIR:-$TEST_DIR}
+TEST_SCFILTER=${TEST_SCFILTER:-0}
 
 test_start() {
 	check_chronyd_features NTP CMDMON || test_skip "NTP/CMDMON support disabled"
@@ -228,6 +229,8 @@ generate_chrony_conf() {
 		echo "log tempcomp rawmeasurements refclocks statistics tracking rtc"
 		echo "logbanner 0"
 		echo "smoothtime 100.0 0.001"
+		echo "leapsectz right/UTC"
+		echo "dscp 46"
 
 		echo "include /dev/null"
 		echo "keyfile $TEST_DIR/keys"
@@ -242,6 +245,7 @@ get_chronyd_options() {
 	echo "-l $(get_logfile)"
 	echo "-f $(get_conffile)"
 	echo "-u $user"
+	echo "-F $TEST_SCFILTER"
 	echo "$extra_chronyd_options"
 }
 
@@ -256,6 +260,8 @@ start_chronyd() {
 
 	trap stop_chronyd EXIT
 
+	rm -f "$TEST_LOGDIR"/*.log
+
 	$CHRONYD_WRAPPER "$chronyd" $(get_chronyd_options) > "$TEST_DIR/chronyd.out" 2>&1
 
 	[ $? -eq 0 ] && [ -f "$pidfile" ] && ps -p "$(cat "$pidfile")" > /dev/null && test_ok || test_error

test/unit/clientlog.c

@@ -1,6 +1,6 @@
 /*
  **********************************************************************
- * Copyright (C) Miroslav Lichvar  2016
+ * Copyright (C) Miroslav Lichvar  2016, 2021
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -25,15 +25,24 @@
 
 #include <clientlog.c>
 
+static uint64_t
+get_random64(void)
+{
+  return ((uint64_t)random() << 40) ^ ((uint64_t)random() << 20) ^ random();
+}
+
 void
 test_unit(void)
 {
-  int i, j, index;
+  uint64_t ts64, prev_first_ts64, prev_last_ts64, max_step;
+  uint32_t index2, prev_first, prev_size;
+  struct timespec ts, ts2;
+  int i, j, k, index, shift;
   CLG_Service s;
-  struct timespec ts;
+  NTP_int64 ntp_ts;
   IPAddr ip;
   char conf[][100] = {
-    "clientloglimit 10000",
+    "clientloglimit 20000",
     "ratelimit interval 3 burst 4 leak 3",
     "cmdratelimit interval 3 burst 4 leak 3",
     "ntsratelimit interval 6 burst 8 leak 3",
@@ -43,6 +52,7 @@ test_unit(void)
   for (i = 0; i < sizeof conf / sizeof conf[0]; i++)
     CNF_ParseLine(NULL, i + 1, conf[i]);
 
+  LCL_Initialise();
   CLG_Initialise();
 
   TEST_CHECK(ARR_GetSize(records) == 16);
@@ -67,7 +77,7 @@ test_unit(void)
   }
 
   DEBUG_LOG("records %u", ARR_GetSize(records));
-  TEST_CHECK(ARR_GetSize(records) == 64);
+  TEST_CHECK(ARR_GetSize(records) == 128);
 
   s = CLG_NTP;
 
@@ -82,7 +92,195 @@ test_unit(void)
   DEBUG_LOG("requests %d responses %d", i, j);
   TEST_CHECK(j * 4 < i && j * 6 > i);
 
+  TEST_CHECK(!ntp_ts_map.timestamps);
+
+  UTI_ZeroNtp64(&ntp_ts);
+  CLG_SaveNtpTimestamps(&ntp_ts, NULL);
+  TEST_CHECK(ntp_ts_map.timestamps);
+  TEST_CHECK(ntp_ts_map.first == 0);
+  TEST_CHECK(ntp_ts_map.size == 0);
+  TEST_CHECK(ntp_ts_map.max_size == 128);
+  TEST_CHECK(ARR_GetSize(ntp_ts_map.timestamps) == ntp_ts_map.max_size);
+
+  TEST_CHECK(ntp_ts_map.max_size > NTPTS_INSERT_LIMIT);
+
+  for (i = 0; i < 200; i++) {
+    DEBUG_LOG("iteration %d", i);
+
+    max_step = (1ULL << (i % 50));
+    ts64 = 0ULL - 100 * max_step;
+
+    if (i > 150)
+      ntp_ts_map.max_size = 1U << (i % 8);
+    assert(ntp_ts_map.max_size <= 128);
+    ntp_ts_map.first = i % ntp_ts_map.max_size;
+    ntp_ts_map.size = 0;
+    ntp_ts_map.cached_rx_ts = 0ULL;
+    ntp_ts_map.slew_epoch = i * 400;
+
+    for (j = 0; j < 500; j++) {
+      do {
+        ts64 += get_random64() % max_step + 1;
+      } while (ts64 == 0ULL);
+
+      int64_to_ntp64(ts64, &ntp_ts);
+
+      if (random() % 10) {
+        UTI_Ntp64ToTimespec(&ntp_ts, &ts);
+        UTI_AddDoubleToTimespec(&ts, TST_GetRandomDouble(-1.999, 1.999), &ts);
+      } else {
+        UTI_ZeroTimespec(&ts);
+      }
+
+      CLG_SaveNtpTimestamps(&ntp_ts,
+                            UTI_IsZeroTimespec(&ts) ? (random() % 2 ? &ts : NULL) : &ts);
+
+      if (j < ntp_ts_map.max_size) {
+        TEST_CHECK(ntp_ts_map.size == j + 1);
+        TEST_CHECK(ntp_ts_map.first == i % ntp_ts_map.max_size);
+      } else {
+        TEST_CHECK(ntp_ts_map.size == ntp_ts_map.max_size);
+        TEST_CHECK(ntp_ts_map.first == (i + j + ntp_ts_map.size + 1) % ntp_ts_map.max_size);
+      }
+      TEST_CHECK(ntp_ts_map.cached_index == ntp_ts_map.size - 1);
+      TEST_CHECK(get_ntp_tss(ntp_ts_map.size - 1)->slew_epoch == ntp_ts_map.slew_epoch);
+      TEST_CHECK(CLG_GetNtpTxTimestamp(&ntp_ts, &ts2));
+      TEST_CHECK(UTI_CompareTimespecs(&ts, &ts2) == 0);
+
+      for (k = random() % 4; k > 0; k--) {
+        index2 = random() % ntp_ts_map.size;
+        int64_to_ntp64(get_ntp_tss(index2)->rx_ts, &ntp_ts);
+        if (random() % 2)
+          TEST_CHECK(CLG_GetNtpTxTimestamp(&ntp_ts, &ts));
+
+        UTI_Ntp64ToTimespec(&ntp_ts, &ts);
+        UTI_AddDoubleToTimespec(&ts, TST_GetRandomDouble(-1.999, 1.999), &ts);
+
+        ts2 = ts;
+        CLG_UndoNtpTxTimestampSlew(&ntp_ts, &ts);
+        if ((get_ntp_tss(index2)->slew_epoch + 1) % (1U << 16) != ntp_ts_map.slew_epoch) {
+          TEST_CHECK(UTI_CompareTimespecs(&ts, &ts2) == 0);
+        } else {
+          TEST_CHECK(fabs(UTI_DiffTimespecsToDouble(&ts, &ts2) - ntp_ts_map.slew_offset) <
+                     1.0e-9);
+        }
+
+        CLG_UpdateNtpTxTimestamp(&ntp_ts, &ts);
+
+        TEST_CHECK(CLG_GetNtpTxTimestamp(&ntp_ts, &ts2));
+        TEST_CHECK(UTI_CompareTimespecs(&ts, &ts2) == 0);
+
+        if (random() % 2) {
+          uint16_t prev_epoch = ntp_ts_map.slew_epoch;
+          handle_slew(NULL, NULL, 0.0, TST_GetRandomDouble(-1.0e-5, 1.0e-5),
+                      LCL_ChangeAdjust, NULL);
+          TEST_CHECK((prev_epoch + 1) % (1U << 16) == ntp_ts_map.slew_epoch);
+        }
+
+        if (ntp_ts_map.size > 1) {
+          index = random() % (ntp_ts_map.size - 1);
+          if (get_ntp_tss(index)->rx_ts + 1 != get_ntp_tss(index + 1)->rx_ts) {
+            int64_to_ntp64(get_ntp_tss(index)->rx_ts + 1, &ntp_ts);
+            TEST_CHECK(!CLG_GetNtpTxTimestamp(&ntp_ts, &ts));
+            int64_to_ntp64(get_ntp_tss(index + 1)->rx_ts - 1, &ntp_ts);
+            TEST_CHECK(!CLG_GetNtpTxTimestamp(&ntp_ts, &ts));
+            CLG_UpdateNtpTxTimestamp(&ntp_ts, &ts);
+            CLG_UndoNtpTxTimestampSlew(&ntp_ts, &ts);
+          }
+        }
+
+        if (random() % 2) {
+          int64_to_ntp64(get_ntp_tss(0)->rx_ts - 1, &ntp_ts);
+          TEST_CHECK(!CLG_GetNtpTxTimestamp(&ntp_ts, &ts));
+          int64_to_ntp64(get_ntp_tss(ntp_ts_map.size - 1)->rx_ts + 1, &ntp_ts);
+          TEST_CHECK(!CLG_GetNtpTxTimestamp(&ntp_ts, &ts));
+          CLG_UpdateNtpTxTimestamp(&ntp_ts, &ts);
+          CLG_UndoNtpTxTimestampSlew(&ntp_ts, &ts);
+        }
+      }
+    }
+
+    for (j = 0; j < 500; j++) {
+      shift = (i % 3) * 26;
+
+      if (i % 7 == 0) {
+        while (ntp_ts_map.size < ntp_ts_map.max_size) {
+          ts64 += get_random64() >> (shift + 8);
+          int64_to_ntp64(ts64, &ntp_ts);
+          CLG_SaveNtpTimestamps(&ntp_ts, NULL);
+          if (ntp_ts_map.cached_index + NTPTS_INSERT_LIMIT < ntp_ts_map.size)
+            ts64 = get_ntp_tss(ntp_ts_map.size - 1)->rx_ts;
+        }
+      }
+      do {
+        if (ntp_ts_map.size > 1 && random() % 2) {
+          k = random() % (ntp_ts_map.size - 1);
+          ts64 = get_ntp_tss(k)->rx_ts +
+                 (get_ntp_tss(k + 1)->rx_ts - get_ntp_tss(k)->rx_ts) / 2;
+        } else {
+          ts64 = get_random64() >> shift;
+        }
+      } while (ts64 == 0ULL);
+
+      int64_to_ntp64(ts64, &ntp_ts);
+
+      prev_first = ntp_ts_map.first;
+      prev_size = ntp_ts_map.size;
+      prev_first_ts64 = get_ntp_tss(0)->rx_ts;
+      prev_last_ts64 = get_ntp_tss(prev_size - 1)->rx_ts;
+      CLG_SaveNtpTimestamps(&ntp_ts, NULL);
+
+      TEST_CHECK(find_ntp_rx_ts(ts64, &index2));
+
+      if (ntp_ts_map.size > 1) {
+        TEST_CHECK(ntp_ts_map.size > 0 && ntp_ts_map.size <= ntp_ts_map.max_size);
+        if (get_ntp_tss(index2)->flags & NTPTS_DISABLED)
+          continue;
+
+        TEST_CHECK(get_ntp_tss(ntp_ts_map.size - 1)->rx_ts - ts64 <= NTPTS_FUTURE_LIMIT);
+
+        if ((int64_t)(prev_last_ts64 - ts64) <= NTPTS_FUTURE_LIMIT) {
+          TEST_CHECK(prev_size + 1 >= ntp_ts_map.size);
+          if (index2 + NTPTS_INSERT_LIMIT + 1 >= ntp_ts_map.size &&
+              !(index2 == 0 && NTPTS_INSERT_LIMIT < ntp_ts_map.max_size &&
+                ((NTPTS_INSERT_LIMIT == prev_size && (int64_t)(ts64 - prev_first_ts64) > 0) ||
+                 (NTPTS_INSERT_LIMIT + 1 == prev_size && (int64_t)(ts64 - prev_first_ts64) < 0))))
+            TEST_CHECK((prev_first + prev_size + 1) % ntp_ts_map.max_size ==
+                       (ntp_ts_map.first + ntp_ts_map.size) % ntp_ts_map.max_size);
+          else
+            TEST_CHECK(prev_first + prev_size == ntp_ts_map.first + ntp_ts_map.size);
+        }
+
+        TEST_CHECK((int64_t)(get_ntp_tss(ntp_ts_map.size - 1)->rx_ts -
+                             get_ntp_tss(0)->rx_ts) > 0);
+        for (k = 0; k + 1 < ntp_ts_map.size; k++)
+          TEST_CHECK((int64_t)(get_ntp_tss(k + 1)->rx_ts - get_ntp_tss(k)->rx_ts) > 0);
+      }
+
+      if (random() % 10 == 0) {
+        CLG_DisableNtpTimestamps(&ntp_ts);
+        TEST_CHECK(!CLG_GetNtpTxTimestamp(&ntp_ts, &ts));
+      }
+
+      for (k = random() % 10; k > 0; k--) {
+        ts64 = get_random64() >> shift;
+        int64_to_ntp64(ts64, &ntp_ts);
+        CLG_GetNtpTxTimestamp(&ntp_ts, &ts);
+      }
+    }
+
+    if (random() % 2) {
+      handle_slew(NULL, NULL, 0.0, TST_GetRandomDouble(-1.0e9, 1.0e9),
+                  LCL_ChangeUnknownStep, NULL);
+      TEST_CHECK(ntp_ts_map.size == 0);
+      TEST_CHECK(ntp_ts_map.cached_rx_ts == 0ULL);
+      TEST_CHECK(!CLG_GetNtpTxTimestamp(&ntp_ts, &ts));
+      CLG_UpdateNtpTxTimestamp(&ntp_ts, &ts);
+    }
+  }
+
   CLG_Finalise();
+  LCL_Finalise();
   CNF_Finalise();
 }
 #else

test/unit/hash.c

@@ -38,6 +38,7 @@ test_unit(void)
   unsigned char data2[] = "12345678910";
   unsigned char out[MAX_HASH_LENGTH];
   struct hash_test tests[] = {
+    { "MD5-NC",    "\xfc\x24\x97\x1b\x52\x66\xdc\x46\xef\xe0\xe8\x08\x46\x89\xb6\x88", 16 },
     { "MD5",       "\xfc\x24\x97\x1b\x52\x66\xdc\x46\xef\xe0\xe8\x08\x46\x89\xb6\x88", 16 },
     { "SHA1",      "\xd8\x85\xb3\x86\xce\xea\x93\xeb\x92\xcd\x7b\x94\xb9\x8d\xc2\x8e"
                    "\x3e\x31\x13\xdd", 20},
@@ -77,9 +78,15 @@ test_unit(void)
 
   for (i = 0; tests[i].name[0] != '\0'; i++) {
     algorithm = UTI_HashNameToAlgorithm(tests[i].name);
-    TEST_CHECK(algorithm != 0);
+    if (strcmp(tests[i].name, "MD5-NC") == 0) {
+      TEST_CHECK(algorithm == 0);
+      algorithm = HSH_MD5_NONCRYPTO;
+    } else {
+      TEST_CHECK(algorithm != 0);
+    }
     hash_id = HSH_GetHashId(algorithm);
     if (hash_id < 0) {
+      TEST_CHECK(algorithm != HSH_MD5_NONCRYPTO);
       TEST_CHECK(algorithm != HSH_MD5);
 #ifdef FEAT_SECHASH
       TEST_CHECK(algorithm != HSH_SHA1);

test/unit/ntp_auth.c

@@ -229,12 +229,8 @@ test_unit(void)
     if (!inst || !can_auth_req)
       add_dummy_auth(mode, key_id, &req, &req_info);
 
-    TEST_CHECK(req_info.auth.mode == mode);
-
-    memset(&req_info.auth, 0, sizeof (req_info.auth));
-    TEST_CHECK(NAU_ParsePacket(&req, &req_info));
-    TEST_CHECK(req_info.auth.mode == mode);
-    TEST_CHECK(req_info.auth.mac.key_id == key_id);
+    assert(req_info.auth.mode == mode);
+    assert(req_info.auth.mac.key_id == key_id);
 
     kod = 1;
     TEST_CHECK(NAU_CheckRequestAuth(&req, &req_info, &kod) == can_auth_req);
@@ -259,10 +255,8 @@ test_unit(void)
     if (!can_auth_res)
       add_dummy_auth(mode, key_id, &res, &res_info);
 
-    memset(&res_info.auth, 0, sizeof (res_info.auth));
-    TEST_CHECK(NAU_ParsePacket(&res, &res_info));
-    TEST_CHECK(res_info.auth.mode == mode);
-    TEST_CHECK(res_info.auth.mac.key_id == key_id);
+    assert(res_info.auth.mode == mode);
+    assert(res_info.auth.mac.key_id == key_id);
 
     if (inst) {
       if (mode == NTP_AUTH_SYMMETRIC) {

test/unit/ntp_core.c

@@ -331,6 +331,55 @@ process_replay(NCR_Instance inst, NTP_Packet *packet_queue,
   advance_time(1e-6);
 }
 
+static void
+add_dummy_auth(NTP_AuthMode auth_mode, uint32_t key_id, NTP_Packet *packet, NTP_PacketInfo *info)
+{
+  unsigned char buf[64];
+  int len, fill;
+
+  info->auth.mode = auth_mode;
+
+  switch (auth_mode) {
+    case NTP_AUTH_NONE:
+      break;
+    case NTP_AUTH_SYMMETRIC:
+    case NTP_AUTH_MSSNTP:
+    case NTP_AUTH_MSSNTP_EXT:
+      switch (auth_mode) {
+        case NTP_AUTH_SYMMETRIC:
+          len = 16 + random() % 2 * 4;
+          fill = 1 + random() % 255;
+          break;
+        case NTP_AUTH_MSSNTP:
+          len = 16;
+          fill = 0;
+          break;
+        case NTP_AUTH_MSSNTP_EXT:
+          len = 68;
+          fill = 0;
+          break;
+        default:
+          assert(0);
+      }
+
+      assert(info->length + 4 + len <= sizeof (*packet));
+
+      *(uint32_t *)((unsigned char *)packet + info->length) = htonl(key_id);
+      info->auth.mac.key_id = key_id;
+      info->length += 4;
+
+      memset((unsigned char *)packet + info->length, fill, len);
+      info->length += len;
+      break;
+    case NTP_AUTH_NTS:
+      memset(buf, 0, sizeof (buf));
+      TEST_CHECK(NEF_AddField(packet, info, NTP_EF_NTS_AUTH_AND_EEF, buf, sizeof (buf)));
+      break;
+    default:
+      assert(0);
+  }
+}
+
 #define PACKET_QUEUE_LENGTH 10
 
 void
@@ -347,7 +396,8 @@ test_unit(void)
   CPS_NTP_Source source;
   NTP_Remote_Address remote_addr;
   NCR_Instance inst1, inst2;
-  NTP_Packet packet_queue[PACKET_QUEUE_LENGTH];
+  NTP_Packet packet_queue[PACKET_QUEUE_LENGTH], packet;
+  NTP_PacketInfo info;
 
   CNF_Initialise(0, 0);
   for (i = 0; i < sizeof conf / sizeof conf[0]; i++)
@@ -504,6 +554,47 @@ test_unit(void)
     NCR_DestroyInstance(inst2);
   }
 
+  memset(&packet, 0, sizeof (packet));
+  packet.lvm = NTP_LVM(LEAP_Normal, NTP_VERSION, MODE_CLIENT);
+
+  TEST_CHECK(parse_packet(&packet, NTP_HEADER_LENGTH, &info));
+  TEST_CHECK(info.auth.mode == NTP_AUTH_NONE);
+
+  TEST_CHECK(parse_packet(&packet, NTP_HEADER_LENGTH, &info));
+  add_dummy_auth(NTP_AUTH_SYMMETRIC, 100, &packet, &info);
+  memset(&info.auth, 0, sizeof (info.auth));
+  TEST_CHECK(parse_packet(&packet, info.length, &info));
+  TEST_CHECK(info.auth.mode == NTP_AUTH_SYMMETRIC);
+  TEST_CHECK(info.auth.mac.start == NTP_HEADER_LENGTH);
+  TEST_CHECK(info.auth.mac.length == info.length - NTP_HEADER_LENGTH);
+  TEST_CHECK(info.auth.mac.key_id == 100);
+
+  TEST_CHECK(parse_packet(&packet, NTP_HEADER_LENGTH, &info));
+  add_dummy_auth(NTP_AUTH_NTS, 0, &packet, &info);
+  memset(&info.auth, 0, sizeof (info.auth));
+  TEST_CHECK(parse_packet(&packet, info.length, &info));
+  TEST_CHECK(info.auth.mode == NTP_AUTH_NTS);
+
+  packet.lvm = NTP_LVM(LEAP_Normal, 3, MODE_CLIENT);
+
+  TEST_CHECK(parse_packet(&packet, NTP_HEADER_LENGTH, &info));
+  add_dummy_auth(NTP_AUTH_MSSNTP, 200, &packet, &info);
+  memset(&info.auth, 0, sizeof (info.auth));
+  TEST_CHECK(parse_packet(&packet, info.length, &info));
+  TEST_CHECK(info.auth.mode == NTP_AUTH_MSSNTP);
+  TEST_CHECK(info.auth.mac.start == NTP_HEADER_LENGTH);
+  TEST_CHECK(info.auth.mac.length == 20);
+  TEST_CHECK(info.auth.mac.key_id == 200);
+
+  TEST_CHECK(parse_packet(&packet, NTP_HEADER_LENGTH, &info));
+  add_dummy_auth(NTP_AUTH_MSSNTP_EXT, 300, &packet, &info);
+  memset(&info.auth, 0, sizeof (info.auth));
+  TEST_CHECK(parse_packet(&packet, info.length, &info));
+  TEST_CHECK(info.auth.mode == NTP_AUTH_MSSNTP_EXT);
+  TEST_CHECK(info.auth.mac.start == NTP_HEADER_LENGTH);
+  TEST_CHECK(info.auth.mac.length == 72);
+  TEST_CHECK(info.auth.mac.key_id == 300);
+
   KEY_Finalise();
   REF_Finalise();
   NCR_Finalise();

test/unit/ntp_sources.c

@@ -1,6 +1,6 @@
 /*
  **********************************************************************
- * Copyright (C) Miroslav Lichvar  2016
+ * Copyright (C) Miroslav Lichvar  2016, 2021
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -110,7 +110,7 @@ change_remote_address(NCR_Instance inst, NTP_Remote_Address *remote_addr, int nt
 void
 test_unit(void)
 {
-  char source_line[] = "127.0.0.1 offline", conf[] = "port 0", name[64], msg[1];
+  char source_line[] = "127.0.0.1 offline", conf[] = "port 0", name[64];
   int i, j, k, slot, found, pool, prev_n;
   uint32_t hash = 0, conf_id;
   NTP_Remote_Address addrs[256], addr;
@@ -120,6 +120,7 @@ test_unit(void)
   RPT_ActivityReport report;
   CPS_NTP_Source source;
   NSR_Status status;
+  NTP_Packet msg;
 
   CNF_Initialise(0, 0);
   CNF_ParseLine(NULL, 1, conf);
@@ -272,12 +273,14 @@ test_unit(void)
 
         switch (random() % 5) {
           case 0:
+            msg.lvm = NTP_LVM(0, NTP_VERSION, random() % 2 ? MODE_CLIENT : MODE_SERVER);
             NSR_ProcessTx(get_record(slot)->remote_addr, &local_addr,
-                          &local_ts, (NTP_Packet *)msg, 0);
+                          &local_ts, &msg, 0);
             break;
           case 1:
+            msg.lvm = NTP_LVM(0, NTP_VERSION, random() % 2 ? MODE_CLIENT : MODE_SERVER);
             NSR_ProcessRx(get_record(slot)->remote_addr, &local_addr,
-                          &local_ts, (NTP_Packet *)msg, 0);
+                          &local_ts, &msg, 0);
             break;
           case 2:
             NSR_HandleBadSource(&get_record(slot)->remote_addr->ip_addr);

test/unit/test.c

@@ -90,7 +90,7 @@ main(int argc, char **argv)
 double
 TST_GetRandomDouble(double min, double max)
 {
-  return min + (double)random() / RAND_MAX * (max - min);
+  return min + random() / 2147483647.0 * (max - min);
 }
 
 void

test/unit/util.c

@@ -1,6 +1,6 @@
 /*
  **********************************************************************
- * Copyright (C) Miroslav Lichvar  2017-2018
+ * Copyright (C) Miroslav Lichvar  2017-2018, 2021
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -34,7 +34,7 @@ test_unit(void)
 {
   struct timespec ts, ts2, ts3, ts4;
   char buf[16], *s, *s2, *words[3];
-  NTP_int64 ntp_ts, ntp_fuzz;
+  NTP_int64 ntp_ts, ntp_ts2, ntp_fuzz;
   NTP_int32 ntp32_ts;
   struct timeval tv;
   double x, y, nan, inf;
@@ -114,6 +114,13 @@ test_unit(void)
 #endif
   TEST_CHECK(ts.tv_nsec == 999999999);
 
+  ntp_ts.hi = htonl(JAN_1970 - 1);
+  ntp_ts.lo = htonl(0xffffffff);
+  ntp_ts2.hi = htonl(JAN_1970 + 1);
+  ntp_ts2.lo = htonl(0x80000000);
+  TEST_CHECK(fabs(UTI_DiffNtp64ToDouble(&ntp_ts, &ntp_ts2) + 1.5) < 1e-9);
+  TEST_CHECK(fabs(UTI_DiffNtp64ToDouble(&ntp_ts2, &ntp_ts) - 1.5) < 1e-9);
+
   UTI_AddDoubleToTimespec(&ts, 1e-9, &ts);
 #if defined(HAVE_LONG_TIME_T) && NTP_ERA_SPLIT > 0
   TEST_CHECK(ts.tv_sec == 1 + 0x100000000LL * (1 + (NTP_ERA_SPLIT - 1) / 0x100000000LL));
@@ -151,7 +158,7 @@ test_unit(void)
 
   ts.tv_sec = 1;
   ts.tv_nsec = 500000000;
-  TEST_CHECK(UTI_TimespecToDouble(&ts) == 1.5);
+  TEST_CHECK(fabs(UTI_TimespecToDouble(&ts) - 1.5) < 1.0e-15);
 
   UTI_DoubleToTimespec(2.75, &ts);
   TEST_CHECK(ts.tv_sec == 2);
@@ -171,7 +178,7 @@ test_unit(void)
 
   tv.tv_sec = 1;
   tv.tv_usec = 500000;
-  TEST_CHECK(UTI_TimevalToDouble(&tv) == 1.5);
+  TEST_CHECK(fabs(UTI_TimevalToDouble(&tv) - 1.5) < 1.0e-15);
 
   UTI_DoubleToTimeval(2.75, &tv);
   TEST_CHECK(tv.tv_sec == 2);
@@ -267,7 +274,7 @@ test_unit(void)
   UTI_DiffTimespecs(&ts3, &ts, &ts2);
   TEST_CHECK(ts3.tv_sec == 0);
   TEST_CHECK(ts3.tv_nsec == 500000000);
-  TEST_CHECK(UTI_DiffTimespecsToDouble(&ts, &ts2) == 0.5);
+  TEST_CHECK(fabs(UTI_DiffTimespecsToDouble(&ts, &ts2) - 0.5) < 1.0e-15);
 
   ts.tv_sec = 2;
   ts.tv_nsec = 250000000;
@@ -276,7 +283,7 @@ test_unit(void)
   UTI_DiffTimespecs(&ts3, &ts, &ts2);
   TEST_CHECK(ts3.tv_sec == -2);
   TEST_CHECK(ts3.tv_nsec == 500000000);
-  TEST_CHECK(UTI_DiffTimespecsToDouble(&ts, &ts2) == -1.5);
+  TEST_CHECK(fabs(UTI_DiffTimespecsToDouble(&ts, &ts2) - -1.5) < 1.0e-15);
 
   ts.tv_sec = 2;
   ts.tv_nsec = 250000000;
@@ -471,9 +478,9 @@ test_unit(void)
   ts2.tv_sec = 4;
   ts2.tv_nsec = 250000000;
   UTI_AdjustTimespec(&ts, &ts2, &ts3, &x, 2.0, -5.0);
-  TEST_CHECK(x == 6.5);
-  TEST_CHECK(ts3.tv_sec == 10);
-  TEST_CHECK(ts3.tv_nsec == 0);
+  TEST_CHECK(fabs(x - 6.5) < 1.0e-15);
+  TEST_CHECK((ts3.tv_sec == 10 && ts3.tv_nsec == 0) ||
+             (ts3.tv_sec == 9 && ts3.tv_nsec == 999999999));
 
   for (i = -32; i <= 32; i++) {
     for (j = c = 0; j < 1000; j++) {
@@ -501,9 +508,20 @@ test_unit(void)
   TEST_CHECK(UTI_DoubleToNtp32(65536.0) == htonl(0xffffffff));
   TEST_CHECK(UTI_DoubleToNtp32(65537.0) == htonl(0xffffffff));
 
+  TEST_CHECK(UTI_DoubleToNtp32f28(-1.0) == htonl(0));
+  TEST_CHECK(UTI_DoubleToNtp32f28(0.0) == htonl(0));
+  TEST_CHECK(UTI_DoubleToNtp32f28(1e-9) == htonl(1));
+  TEST_CHECK(UTI_DoubleToNtp32f28(4e-9) == htonl(2));
+  TEST_CHECK(UTI_DoubleToNtp32f28(8.0) == htonl(0x80000000));
+  TEST_CHECK(UTI_DoubleToNtp32f28(16.0) == htonl(0xffffffff));
+  TEST_CHECK(UTI_DoubleToNtp32f28(16.1) == htonl(0xffffffff));
+  TEST_CHECK(UTI_DoubleToNtp32f28(16.1) == htonl(0xffffffff));
+
+  TEST_CHECK(UTI_Ntp32f28ToDouble(htonl(0xffffffff)) >= 65535.999);
   for (i = 0; i < 100000; i++) {
     UTI_GetRandomBytes(&ntp32_ts, sizeof (ntp32_ts));
     TEST_CHECK(UTI_DoubleToNtp32(UTI_Ntp32ToDouble(ntp32_ts)) == ntp32_ts);
+    TEST_CHECK(UTI_DoubleToNtp32f28(UTI_Ntp32f28ToDouble(ntp32_ts)) == ntp32_ts);
   }
 
   ts.tv_nsec = 0;
@@ -652,6 +670,10 @@ test_unit(void)
     UTI_GetRandomBytesUrandom(buf, j);
     if (j && buf[j - 1] % 2)
       c++;
+    if (random() % 10000 == 0) {
+      UTI_ResetGetRandomFunctions();
+      TEST_CHECK(!urandom_file);
+    }
   }
   TEST_CHECK(c > 46000 && c < 48000);
 
@@ -660,6 +682,12 @@ test_unit(void)
     UTI_GetRandomBytes(buf, j);
     if (j && buf[j - 1] % 2)
       c++;
+    if (random() % 10000 == 0) {
+      UTI_ResetGetRandomFunctions();
+#if HAVE_GETRANDOM
+      TEST_CHECK(getrandom_buf_available == 0);
+#endif
+    }
   }
   TEST_CHECK(c > 46000 && c < 48000);
 

util.c

@@ -3,7 +3,7 @@
 
  **********************************************************************
  * Copyright (C) Richard P. Curnow  1997-2003
- * Copyright (C) Miroslav Lichvar  2009, 2012-2020
+ * Copyright (C) Miroslav Lichvar  2009, 2012-2021
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -123,7 +123,7 @@ UTI_DoubleToTimeval(double a, struct timeval *b)
 
   b->tv_sec = a;
   frac_part = 1.0e6 * (a - b->tv_sec);
-  b->tv_usec = frac_part > 0 ? frac_part + 0.5 : frac_part - 0.5;
+  b->tv_usec = round(frac_part);
   UTI_NormaliseTimeval(b);
 }
 
@@ -400,7 +400,7 @@ UTI_IPToRefid(const IPAddr *ip)
       return ip->addr.in4;
     case IPADDR_INET6:
       if (MD5_hash < 0)
-        MD5_hash = HSH_GetHashId(HSH_MD5);
+        MD5_hash = HSH_GetHashId(HSH_MD5_NONCRYPTO);
 
       if (MD5_hash < 0 ||
           HSH_Hash(MD5_hash, (const unsigned char *)ip->addr.in6, sizeof (ip->addr.in6),
@@ -637,6 +637,43 @@ UTI_DoubleToNtp32(double x)
 
 /* ================================================== */
 
+double
+UTI_Ntp32f28ToDouble(NTP_int32 x)
+{
+  uint32_t r = ntohl(x);
+
+  /* Maximum value is special */
+  if (r == 0xffffffff)
+    return MAX_NTP_INT32;
+
+  return r / (double)(1U << 28);
+}
+
+/* ================================================== */
+
+NTP_int32
+UTI_DoubleToNtp32f28(double x)
+{
+  NTP_int32 r;
+
+  if (x >= 4294967295.0 / (1U << 28)) {
+    r = 0xffffffff;
+  } else if (x <= 0.0) {
+    r = 0;
+  } else {
+    x *= 1U << 28;
+    r = x;
+
+    /* Round up */
+    if (r < x)
+      r++;
+  }
+
+  return htonl(r);
+}
+
+/* ================================================== */
+
 void
 UTI_ZeroNtp64(NTP_int64 *ts)
 {
@@ -751,6 +788,16 @@ UTI_Ntp64ToTimespec(const NTP_int64 *src, struct timespec *dest)
 
 /* ================================================== */
 
+double
+UTI_DiffNtp64ToDouble(const NTP_int64 *a, const NTP_int64 *b)
+{
+  /* Don't convert to timespec to allow any epoch */
+  return (int32_t)(ntohl(a->hi) - ntohl(b->hi)) +
+         ((double)ntohl(a->lo) - (double)ntohl(b->lo)) / (1.0e9 * NSEC_PER_NTP64);
+}
+
+/* ================================================== */
+
 /* Maximum offset between two sane times */
 #define MAX_OFFSET 4294967296.0
 
@@ -1355,29 +1402,32 @@ UTI_DropRoot(uid_t uid, gid_t gid)
 
 #define DEV_URANDOM "/dev/urandom"
 
+static FILE *urandom_file = NULL;
+
 void
 UTI_GetRandomBytesUrandom(void *buf, unsigned int len)
 {
-  static FILE *f = NULL;
-
-  if (!f)
-    f = UTI_OpenFile(NULL, DEV_URANDOM, NULL, 'R', 0);
-  if (fread(buf, 1, len, f) != len)
+  if (!urandom_file)
+    urandom_file = UTI_OpenFile(NULL, DEV_URANDOM, NULL, 'R', 0);
+  if (fread(buf, 1, len, urandom_file) != len)
     LOG_FATAL("Can't read from %s", DEV_URANDOM);
 }
 
 /* ================================================== */
 
 #ifdef HAVE_GETRANDOM
+
+static unsigned int getrandom_buf_available = 0;
+
 static void
 get_random_bytes_getrandom(char *buf, unsigned int len)
 {
   static char rand_buf[256];
-  static unsigned int available = 0, disabled = 0;
+  static unsigned int disabled = 0;
   unsigned int i;
 
   for (i = 0; i < len; i++) {
-    if (!available) {
+    if (getrandom_buf_available == 0) {
       if (disabled)
         break;
 
@@ -1386,10 +1436,10 @@ get_random_bytes_getrandom(char *buf, unsigned int len)
         break;
       }
 
-      available = sizeof (rand_buf);
+      getrandom_buf_available = sizeof (rand_buf);
     }
 
-    buf[i] = rand_buf[--available];
+    buf[i] = rand_buf[--getrandom_buf_available];
   }
 
   if (i < len)
@@ -1413,6 +1463,20 @@ UTI_GetRandomBytes(void *buf, unsigned int len)
 
 /* ================================================== */
 
+void
+UTI_ResetGetRandomFunctions(void)
+{
+  if (urandom_file) {
+    fclose(urandom_file);
+    urandom_file = NULL;
+  }
+#ifdef HAVE_GETRANDOM
+  getrandom_buf_available = 0;
+#endif
+}
+
+/* ================================================== */
+
 int
 UTI_BytesToHex(const void *buf, unsigned int buf_len, char *hex, unsigned int hex_len)
 {

util.h

@@ -133,6 +133,9 @@ extern void UTI_GetNtp64Fuzz(NTP_int64 *ts, int precision);
 extern double UTI_Ntp32ToDouble(NTP_int32 x);
 extern NTP_int32 UTI_DoubleToNtp32(double x);
 
+extern double UTI_Ntp32f28ToDouble(NTP_int32 x);
+extern NTP_int32 UTI_DoubleToNtp32f28(double x);
+
 /* Zero an NTP timestamp */
 extern void UTI_ZeroNtp64(NTP_int64 *ts);
 
@@ -155,6 +158,9 @@ extern void UTI_TimespecToNtp64(const struct timespec *src, NTP_int64 *dest,
 /* Convert an NTP timestamp into a timespec */
 extern void UTI_Ntp64ToTimespec(const NTP_int64 *src, struct timespec *dest);
 
+/* Calculate a - b in any epoch */
+extern double UTI_DiffNtp64ToDouble(const NTP_int64 *a, const NTP_int64 *b);
+
 /* Check if time + offset is sane */
 extern int UTI_IsTimeOffsetSane(const struct timespec *ts, double offset);
 
@@ -218,6 +224,10 @@ extern void UTI_GetRandomBytesUrandom(void *buf, unsigned int len);
    generating long-term keys */
 extern void UTI_GetRandomBytes(void *buf, unsigned int len);
 
+/* Close /dev/urandom and drop any cached data used by the GetRandom functions
+   to prevent forked processes getting the same sequence of random numbers */
+extern void UTI_ResetGetRandomFunctions(void);
+
 /* Print data in hexadecimal format */
 extern int UTI_BytesToHex(const void *buf, unsigned int buf_len, char *hex, unsigned int hex_len);