update copyright years

The commit 5dd288dc0c ("sources: reselect earlier when removing
selected source") didn't cover all paths that can lead to a missing log
message when all sources are removed.

Add a flag to track the loss of selection and postpone the log message
in transient states where no message is logged to avoid spamming in
normal operation. Call SRC_SelectSource() after removing the source
to get a log message if there are no (selectable) sources left.

Reported-by: Thomas Lange <thomas@corelatus.se>

Makefile.in

@@ -33,6 +33,8 @@ CFLAGS = @CFLAGS@
 CPPFLAGS = @CPPFLAGS@
 LDFLAGS = @LDFLAGS@
 
+GETDATE_CFLAGS = @GETDATE_CFLAGS@
+
 EXTRA_OBJS = @EXTRA_OBJS@
 
 OBJS = array.o cmdparse.o conf.o local.o logging.o main.o memory.o quantiles.o \
@@ -61,6 +63,8 @@ chronyd : $(OBJS)
 chronyc : $(CLI_OBJS)
 	$(CC) $(CFLAGS) -o chronyc $(CLI_OBJS) $(LDFLAGS) $(LIBS) $(EXTRA_CLI_LIBS)
 
+getdate.o: CFLAGS += $(GETDATE_CFLAGS)
+
 distclean : clean
 	$(MAKE) -C doc distclean
 	$(MAKE) -C test/unit distclean

NEWS

@@ -1,3 +1,17 @@
+New in version 4.5
+==================
+
+Enhancements
+------------
+* Add support for AES-GCM-SIV in GnuTLS
+* Add support for corrections from PTP transparent clocks
+* Add support for systemd socket activation
+
+Bug fixes
+---------
+* Fix presend in interleaved mode
+* Fix reloading of modified sources from sourcedir
+
 New in version 4.4
 ==================
 
@@ -11,9 +25,13 @@ Enhancements
 * Add hwtstimeout directive to configure timeout for late timestamps
 * Handle late hardware transmit timestamps of NTP requests on all sockets
 * Handle mismatched 32/64-bit time_t in SOCK refclock samples
+* Improve source replacement
 * Log important changes made by command requests (chronyc)
+* Refresh address of NTP sources periodically
+* Request nanosecond kernel RX timestamping on FreeBSD
 * Set DSCP for IPv6 packets
 * Shorten NTS-KE retry interval when network is down
+* Update seccomp filter for musl
 * Warn if loading keys from file with unexpected permissions
 * Warn if source selection fails or falseticker is detected
 * Add selectopts command to modify source-specific selection options

README

@@ -47,32 +47,7 @@ Frequently Asked Questions (FAQ).
 The documentation is also available on the chrony web pages, accessible
 through the URL 
 
-    https://chrony.tuxfamily.org/
+    https://chrony-project.org/
-
-Where are new versions announced?
-=================================
-
-There is a low volume mailing list where new versions and other
-important news relating to chrony are announced.  You can join this list
-by sending mail with the subject "subscribe" to
-
-chrony-announce-request@chrony.tuxfamily.org
-
-How can I get support for chrony?
-=================================
-
-There are two other mailing lists relating to chrony.  chrony-users is a
-discussion list for users, e.g. for questions about chrony configuration
-and bug reports.  chrony-dev is a more technical list for developers,
-e.g. for submitting patches and discussing how new features should be
-implemented.  To subscribe to either of these lists, send a message with
-the subject "subscribe" to
-
-chrony-users-request@chrony.tuxfamily.org
-or
-chrony-dev-request@chrony.tuxfamily.org
-
-as applicable.
 
 License
 =======
@@ -144,11 +119,13 @@ Gautier PHILIPPON <gautier.philippon@ensimag.grenoble-inp.fr>
 Andreas Piesk <apiesk@virbus.de>
 Mike Ryan <msr@hsilop.net>
 Baruch Siach <baruch@tkos.co.il>
+Josef 'Jeff' Sipek <jeffpc@josefsipek.net>
 Foster Snowhill <forst@forstwoof.ru>
 Andreas Steinmetz <ast@domdv.de>
 NAKAMURA Takumi <takumi@ps.sakura.ne.jp>
 Timo Teras <timo.teras@iki.fi>
 Bill Unruh <unruh@physics.ubc.ca>
+Luke Valenta <lvalenta@cloudflare.com>
 Stephen Wadeley <swadeley@redhat.com>
 Bernhard Weiss <lisnablagh@web.de>
 Wolfgang Weisselberg <weissel@netcologne.de>

candm.h

@@ -277,7 +277,8 @@ typedef struct {
 #define REQ_ADDSRC_BURST 0x100
 #define REQ_ADDSRC_NTS 0x200
 #define REQ_ADDSRC_COPY 0x400
-#define REQ_ADDSRC_EF_EXP1 0x800
+#define REQ_ADDSRC_EF_EXP_MONO_ROOT 0x800
+#define REQ_ADDSRC_EF_EXP_NET_CORRECTION 0x1000
 
 typedef struct {
   uint32_t type;

client.c

@@ -4,7 +4,7 @@
  **********************************************************************
  * Copyright (C) Richard P. Curnow  1997-2003
  * Copyright (C) Lonnie Abelbeck  2016, 2018
- * Copyright (C) Miroslav Lichvar  2009-2021
+ * Copyright (C) Miroslav Lichvar  2009-2023
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -958,7 +958,10 @@ process_cmd_add_source(CMD_Request *msg, char *line)
           (data.params.burst ? REQ_ADDSRC_BURST : 0) |
           (data.params.nts ? REQ_ADDSRC_NTS : 0) |
           (data.params.copy ? REQ_ADDSRC_COPY : 0) |
-          (data.params.ext_fields & NTP_EF_FLAG_EXP1 ? REQ_ADDSRC_EF_EXP1 : 0) |
+          (data.params.ext_fields & NTP_EF_FLAG_EXP_MONO_ROOT ?
+           REQ_ADDSRC_EF_EXP_MONO_ROOT : 0) |
+          (data.params.ext_fields & NTP_EF_FLAG_EXP_NET_CORRECTION ?
+           REQ_ADDSRC_EF_EXP_NET_CORRECTION : 0) |
           convert_addsrc_sel_options(data.params.sel_options));
       msg->data.ntp_source.filter_length = htonl(data.params.filter_length);
       msg->data.ntp_source.cert_set = htonl(data.params.cert_set);
@@ -1167,7 +1170,7 @@ command_name_generator(const char *text, int state)
 
   while ((name = names[tab_complete_index][list_index++])) {
     if (strncmp(name, text, len) == 0) {
-      return strdup(name);
+      return Strdup(name);
     }
   }
 
@@ -1979,7 +1982,7 @@ process_cmd_sources(char *line)
   IPAddr ip_addr;
   uint32_t i, mode, n_sources;
   char name[256], mode_ch, state_ch;
-  int all, verbose;
+  int all, verbose, ref;
 
   parse_sources_options(line, &all, &verbose);
   
@@ -2016,9 +2019,8 @@ process_cmd_sources(char *line)
     if (!all && ip_addr.family == IPADDR_ID)
       continue;
 
-    format_name(name, sizeof (name), 25,
+    ref = mode == RPY_SD_MD_REF && ip_addr.family == IPADDR_INET4;
-                mode == RPY_SD_MD_REF && ip_addr.family == IPADDR_INET4,
+    format_name(name, sizeof (name), 25, ref, ref ? ip_addr.addr.in4 : 0, 1, &ip_addr);
-                ip_addr.addr.in4, 1, &ip_addr);
 
     switch (mode) {
       case RPY_SD_MD_CLIENT:
@@ -3381,7 +3383,7 @@ static void
 display_gpl(void)
 {
     printf("chrony version %s\n"
-           "Copyright (C) 1997-2003, 2007, 2009-2022 Richard P. Curnow and others\n"
+           "Copyright (C) 1997-2003, 2007, 2009-2023 Richard P. Curnow and others\n"
            "chrony comes with ABSOLUTELY NO WARRANTY.  This is free software, and\n"
            "you are welcome to redistribute it under certain conditions.  See the\n"
            "GNU General Public License version 2 for details.\n\n",

cmdmon.c

@@ -3,7 +3,7 @@
 
  **********************************************************************
  * Copyright (C) Richard P. Curnow  1997-2003
- * Copyright (C) Miroslav Lichvar  2009-2016, 2018-2021
+ * Copyright (C) Miroslav Lichvar  2009-2016, 2018-2023
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -783,8 +783,10 @@ handle_add_source(CMD_Request *rx_message, CMD_Reply *tx_message)
   params.burst = ntohl(rx_message->data.ntp_source.flags) & REQ_ADDSRC_BURST ? 1 : 0;
   params.nts = ntohl(rx_message->data.ntp_source.flags) & REQ_ADDSRC_NTS ? 1 : 0;
   params.copy = ntohl(rx_message->data.ntp_source.flags) & REQ_ADDSRC_COPY ? 1 : 0;
-  params.ext_fields =
+  params.ext_fields = (ntohl(rx_message->data.ntp_source.flags) & REQ_ADDSRC_EF_EXP_MONO_ROOT ?
-    ntohl(rx_message->data.ntp_source.flags) & REQ_ADDSRC_EF_EXP1 ? NTP_EF_FLAG_EXP1 : 0;
+                      NTP_EF_FLAG_EXP_MONO_ROOT : 0) |
+                      (ntohl(rx_message->data.ntp_source.flags) & REQ_ADDSRC_EF_EXP_NET_CORRECTION ?
+                      NTP_EF_FLAG_EXP_NET_CORRECTION : 0);
   params.sel_options = convert_addsrc_select_options(ntohl(rx_message->data.ntp_source.flags));
 
   status = NSR_AddSourceByName(name, port, pool, type, &params, NULL);

cmdparse.c

@@ -115,8 +115,11 @@ CPS_ParseNTPSourceAdd(char *line, CPS_NTP_Source *src)
       if (sscanf(line, "%"SCNx32"%n", &ef_type, &n) != 1)
         return 0;
       switch (ef_type) {
-        case NTP_EF_EXP1:
+        case NTP_EF_EXP_MONO_ROOT:
-          src->params.ext_fields |= NTP_EF_FLAG_EXP1;
+          src->params.ext_fields |= NTP_EF_FLAG_EXP_MONO_ROOT;
+          break;
+        case NTP_EF_EXP_NET_CORRECTION:
+          src->params.ext_fields |= NTP_EF_FLAG_EXP_NET_CORRECTION;
           break;
         default:
           return 0;

conf.c

@@ -252,6 +252,9 @@ static char *leapsec_tz = NULL;
 /* Name of the user to which will be dropped root privileges. */
 static char *user;
 
+/* Address refresh interval */
+static int refresh = 1209600; /* 2 weeks */
+
 /* NTS server and client configuration */
 static char *nts_dump_dir = NULL;
 static char *nts_ntp_server = NULL;
@@ -702,6 +705,8 @@ CNF_ParseLine(const char *filename, int number, char *line)
                     &ntp_ratelimit_burst, &ntp_ratelimit_leak);
   } else if (!strcasecmp(command, "refclock")) {
     parse_refclock(p);
+  } else if (!strcasecmp(command, "refresh")) {
+    parse_int(p, &refresh);
   } else if (!strcasecmp(command, "reselectdist")) {
     parse_double(p, &reselect_distance);
   } else if (!strcasecmp(command, "rtcautotrim")) {
@@ -1655,11 +1660,11 @@ compare_sources(const void *a, const void *b)
     return 1;
   if ((d = strcmp(sa->params.name, sb->params.name)) != 0)
     return d;
-  if ((d = (int)(sa->type) - (int)(sb->type)) != 0)
+  if ((d = (int)sa->type - (int)sb->type) != 0)
     return d;
-  if ((d = sa->pool - sb->pool) != 0)
+  if ((d = (int)sa->pool - (int)sb->pool) != 0)
     return d;
-  if ((d = sa->params.port - sb->params.port) != 0)
+  if ((d = (int)sa->params.port - (int)sb->params.port) != 0)
     return d;
   return memcmp(&sa->params.params, &sb->params.params, sizeof (sa->params.params));
 }
@@ -1674,7 +1679,7 @@ reload_source_dirs(void)
   uint32_t *prev_ids, *new_ids;
   char buf[MAX_LINE_LENGTH];
   NSR_Status s;
-  int d;
+  int d, pass;
 
   prev_size = ARR_GetSize(ntp_source_ids);
   if (prev_size > 0 && ARR_GetSize(ntp_sources) != prev_size)
@@ -1708,36 +1713,38 @@ reload_source_dirs(void)
 
   qsort(new_sources, new_size, sizeof (new_sources[0]), compare_sources);
 
-  for (i = j = 0; i < prev_size || j < new_size; ) {
+  for (pass = 0; pass < 2; pass++) {
-    if (i < prev_size && j < new_size)
+    for (i = j = 0; i < prev_size || j < new_size; i += d <= 0, j += d >= 0) {
-      d = compare_sources(&prev_sources[i], &new_sources[j]);
+      if (i < prev_size && j < new_size)
-    else
+        d = compare_sources(&prev_sources[i], &new_sources[j]);
-      d = i < prev_size ? -1 : 1;
+      else
+        d = i < prev_size ? -1 : 1;
 
-    if (d < 0) {
+      /* Remove missing sources before adding others to avoid conflicts */
-      /* Remove the missing source */
+      if (pass == 0 && d < 0 && prev_sources[i].params.name[0] != '\0') {
-      if (prev_sources[i].params.name[0] != '\0')
         NSR_RemoveSourcesById(prev_ids[i]);
-      i++;
-    } else if (d > 0) {
-      /* Add a newly configured source */
-      source = &new_sources[j];
-      s = NSR_AddSourceByName(source->params.name, source->params.port, source->pool,
-                              source->type, &source->params.params, &new_ids[j]);
-
-      if (s == NSR_UnresolvedName) {
-        unresolved++;
-      } else if (s != NSR_Success) {
-        LOG(LOGS_ERR, "Could not add source %s", source->params.name);
-
-        /* Mark the source as not present */
-        source->params.name[0] = '\0';
       }
-      j++;
+
-    } else {
+      /* Add new sources */
-      /* Keep the existing source */
+      if (pass == 1 && d > 0) {
-      new_ids[j] = prev_ids[i];
+        source = &new_sources[j];
-      i++, j++;
+        s = NSR_AddSourceByName(source->params.name, source->params.port, source->pool,
+                                source->type, &source->params.params, &new_ids[j]);
+
+        if (s == NSR_UnresolvedName) {
+          unresolved++;
+        } else if (s != NSR_Success) {
+          LOG(LOGS_ERR, "Could not add source %s : %s",
+              source->params.name, NSR_StatusToString(s));
+
+          /* Mark the source as not present */
+          source->params.name[0] = '\0';
+        }
+      }
+
+      /* Keep unchanged sources */
+      if (pass == 1 && d == 0)
+        new_ids[j] = prev_ids[i];
     }
   }
 
@@ -2533,6 +2540,14 @@ CNF_GetPtpPort(void)
 
 /* ================================================== */
 
+int
+CNF_GetRefresh(void)
+{
+  return refresh;
+}
+
+/* ================================================== */
+
 char *
 CNF_GetNtsDumpDir(void)
 {

conf.h

@@ -159,6 +159,8 @@ extern double CNF_GetHwTsTimeout(void);
 
 extern int CNF_GetPtpPort(void);
 
+extern int CNF_GetRefresh(void);
+
 extern char *CNF_GetNtsDumpDir(void);
 extern char *CNF_GetNtsNtpServer(void);
 extern int CNF_GetNtsServerCertAndKeyFiles(const char ***certs, const char ***keys);

configure

@@ -5,7 +5,7 @@
 #
 # Copyright (C) Richard P. Curnow  1997-2003
 # Copyright (C) Bryan Christianson  2016
-# Copyright (C) Miroslav Lichvar  2009, 2012-2021
+# Copyright (C) Miroslav Lichvar  2009, 2012-2022
 # Copyright (C) Stefan R. Filipek  2019
 #
 # =======================================================================
@@ -111,10 +111,10 @@ For better control, use the options below.
   --without-editline     Don't use editline even if it is available
   --disable-sechash      Disable support for hashes other than MD5
   --without-nettle       Don't use nettle even if it is available
+  --without-gnutls       Don't use gnutls even if it is available
   --without-nss          Don't use NSS even if it is available
   --without-tomcrypt     Don't use libtomcrypt even if it is available
   --disable-nts          Disable NTS support
-  --without-gnutls       Don't use gnutls even if it is available
   --disable-cmdmon       Disable command and monitoring support
   --disable-ntp          Disable NTP support
   --disable-refclock     Disable reference clock support
@@ -128,6 +128,7 @@ For better control, use the options below.
   --without-seccomp      Don't use seccomp even if it is available
   --disable-asyncdns     Disable asynchronous name resolving
   --disable-forcednsretry Don't retry on permanent DNS error
+  --without-aes-gcm-siv  Don't use AES-GCM-SIV for NTS even if it is available
   --without-clock-gettime Don't use clock_gettime() even if it is available
   --disable-timestamping Disable support for SW/HW timestamping
   --enable-ntp-signd     Enable support for MS-SNTP authentication in Samba
@@ -244,6 +245,7 @@ try_setsched=0
 try_lockmem=0
 feat_asyncdns=1
 feat_forcednsretry=1
+try_aes_gcm_siv=1
 try_clock_gettime=1
 try_arc4random=1
 try_recvmmsg=1
@@ -345,6 +347,9 @@ do
     --disable-forcednsretry)
       feat_forcednsretry=0
     ;;
+    --without-aes-gcm-siv)
+      try_aes_gcm_siv=0
+    ;;
     --without-clock-gettime)
       try_clock_gettime=0
     ;;
@@ -565,6 +570,13 @@ if [ "x$MYCFLAGS" = "x" ]; then
   fi
 fi
 
+TESTCFLAGS="-fwrapv"
+if test_code '-fwrapv' '' "$TESTCFLAGS" '' ''; then
+  GETDATE_CFLAGS="-fwrapv"
+else
+  GETDATE_CFLAGS=""
+fi
+
 if [ "x$MYCC" = "xgcc" ] || [ "x$MYCC" = "xclang" ]; then
   MYCFLAGS="$MYCFLAGS -Wmissing-prototypes -Wall"
 fi
@@ -914,6 +926,28 @@ if [ $feat_sechash = "1" ] && [ "x$HASH_LINK" = "x" ]  && [ $try_nettle = "1" ];
   fi
 fi
 
+if [ $feat_sechash = "1" ] && [ "x$HASH_LINK" = "x" ] && [ $try_gnutls = "1" ]; then
+  test_cflags="`pkg_config --cflags gnutls`"
+  test_link="`pkg_config --libs gnutls`"
+  if test_code 'gnutls' 'gnutls/crypto.h' \
+    "$test_cflags" "$test_link" '
+      return gnutls_hash((void *)1, (void *)2, 1);'
+  then
+    HASH_OBJ="hash_gnutls.o"
+    HASH_LINK="$test_link"
+    MYCPPFLAGS="$MYCPPFLAGS $test_cflags"
+    add_def FEAT_SECHASH
+
+    if test_code 'CMAC in gnutls' 'gnutls/crypto.h' "$test_cflags" "$test_link" \
+      'return gnutls_hmac_init((void *)1, GNUTLS_MAC_AES_CMAC_128, (void *)2, 0);'
+    then
+      add_def HAVE_CMAC
+      EXTRA_OBJECTS="$EXTRA_OBJECTS cmac_gnutls.o"
+      EXTRA_CLI_OBJECTS="$EXTRA_CLI_OBJECTS cmac_gnutls.o"
+    fi
+  fi
+fi
+
 if [ $feat_sechash = "1" ] && [ "x$HASH_LINK" = "x" ]  && [ $try_nss = "1" ]; then
   test_cflags="`pkg_config --cflags nss`"
   test_link="`pkg_config --libs-only-L nss` -lfreebl3 -lnssutil3"
@@ -939,28 +973,6 @@ if [ $feat_sechash = "1" ] && [ "x$HASH_LINK" = "x" ] && [ $try_tomcrypt = "1" ]
   fi
 fi
 
-if [ $feat_sechash = "1" ] && [ "x$HASH_LINK" = "x" ] && [ $try_gnutls = "1" ]; then
-  test_cflags="`pkg_config --cflags gnutls`"
-  test_link="`pkg_config --libs gnutls`"
-  if test_code 'gnutls' 'gnutls/crypto.h' \
-    "$test_cflags" "$test_link" '
-      return gnutls_hash((void *)1, (void *)2, 1);'
-  then
-    HASH_OBJ="hash_gnutls.o"
-    HASH_LINK="$test_link"
-    MYCPPFLAGS="$MYCPPFLAGS $test_cflags"
-    add_def FEAT_SECHASH
-
-    if test_code 'CMAC in gnutls' 'gnutls/crypto.h' "$test_cflags" "$test_link" \
-      'return gnutls_hmac_init((void *)1, GNUTLS_MAC_AES_CMAC_128, (void *)2, 0);'
-    then
-      add_def HAVE_CMAC
-      EXTRA_OBJECTS="$EXTRA_OBJECTS cmac_gnutls.o"
-      EXTRA_CLI_OBJECTS="$EXTRA_CLI_OBJECTS cmac_gnutls.o"
-    fi
-  fi
-fi
-
 EXTRA_OBJECTS="$EXTRA_OBJECTS $HASH_OBJ"
 EXTRA_CLI_OBJECTS="$EXTRA_CLI_OBJECTS $HASH_OBJ"
 LIBS="$LIBS $HASH_LINK"
@@ -979,14 +991,14 @@ if [ $feat_ntp = "1" ] && [ $feat_nts = "1" ] && [ $try_gnutls = "1" ]; then
         gnutls_priority_init2((void *)1, "", NULL, GNUTLS_PRIORITY_INIT_DEF_APPEND) +
         gnutls_prf_rfc5705((void *)1, 0, "", 0, "", 16, (void *)2);'
   then
-    if test_code 'AES-SIV-CMAC in nettle' \
+    if [ $try_nettle = "1" ] && test_code 'AES-SIV-CMAC in nettle' \
       'nettle/siv-cmac.h' "" "$LIBS" \
       'siv_cmac_aes128_set_key((void *)1, (void *)2);'
     then
       EXTRA_OBJECTS="$EXTRA_OBJECTS siv_nettle.o"
       add_def HAVE_SIV
       add_def HAVE_NETTLE_SIV_CMAC
-      if test_code 'AES-GCM-SIV in nettle' \
+      if [ $try_aes_gcm_siv = "1" ] && test_code 'AES-GCM-SIV in nettle' \
         'nettle/siv-gcm.h' "" "$LIBS" \
         'siv_gcm_aes128_encrypt_message((void *)1, 0, NULL, 0, (void *)2, 16, (void *)3,
                                         (void *)4);'
@@ -1000,6 +1012,13 @@ if [ $feat_ntp = "1" ] && [ $feat_nts = "1" ] && [ $try_gnutls = "1" ]; then
       then
         EXTRA_OBJECTS="$EXTRA_OBJECTS siv_gnutls.o"
         add_def HAVE_SIV
+        if [ $try_aes_gcm_siv = "1" ] && test_code 'AES-GCM-SIV in gnutls' \
+          'gnutls/crypto.h' "$test_cflags" "$test_link $LIBS" '
+            return gnutls_aead_cipher_init((void *)1, GNUTLS_CIPHER_AES_128_SIV_GCM,
+                                           (void *)2);'
+        then
+          add_def HAVE_GNUTLS_SIV_GCM
+        fi
         if test_code 'gnutls_aead_cipher_set_key()' 'gnutls/crypto.h' \
           "$test_cflags" "$test_link $LIBS" '
             return gnutls_aead_cipher_set_key((void *)1, (void *)2);'
@@ -1117,6 +1136,7 @@ do
           s%@CFLAGS@%${MYCFLAGS}%;\
           s%@CPPFLAGS@%${MYCPPFLAGS}%;\
           s%@LDFLAGS@%${MYLDFLAGS}%;\
+          s%@GETDATE_CFLAGS@%${GETDATE_CFLAGS}%;\
           s%@LIBS@%${LIBS}%;\
           s%@EXTRA_LIBS@%${EXTRA_LIBS}%;\
           s%@EXTRA_CLI_LIBS@%${EXTRA_CLI_LIBS}%;\

contrib/bryan_christianson_1/README.txt

@@ -60,8 +60,8 @@ Support files
 Dates and sizes may differ
 -rw-r--r--  1 yourname  staff  2084  4 Aug 22:54 README.txt
 -rwxr-xr-x  1 yourname  staff   676  4 Aug 21:18 chronylogrotate.sh
--rw-r--r--  1 yourname  staff   543 18 Jul 20:10 org.tuxfamily.chronyc.plist
+-rw-r--r--  1 yourname  staff   543 18 Jul 20:10 org.chrony-project.chronyc.plist
--rw-r--r--  1 yourname  staff   511 19 Jun 18:30 org.tuxfamily.chronyd.plist
+-rw-r--r--  1 yourname  staff   511 19 Jun 18:30 org.chrony-project.chronyd.plist
 
 If you have used chrony support directories other than those suggested, you
 will need to edit each file and make the appropriate changes.
@@ -83,21 +83,21 @@ sudo chmod +x /usr/local/bin/chronylogrotate.sh
 sudo chown root:wheel /usr/local/bin/chronylogrotate.sh
 
 
-2. org.tuxfamily.chronyc.plist
+2. org.chrony-project.chronyc.plist
 This file is the launchd plist that runs logrotation each day. You may
 wish to edit this file to change the time of day at which the rotation
 will run, currently 04:05 am
 
-sudo cp org.tuxfamily.chronyc.plist /Library/LaunchDaemons
+sudo cp org.chrony-project.chronyc.plist /Library/LaunchDaemons
-sudo chown root:wheel /Library/LaunchDaemons/org.tuxfamily.chronyc.plist
+sudo chown root:wheel /Library/LaunchDaemons/org.chrony-project.chronyc.plist
-sudo chmod 0644 /Library/LaunchDaemons/org.tuxfamily.chronyc.plist
+sudo chmod 0644 /Library/LaunchDaemons/org.chrony-project.chronyc.plist
-sudo launchctl load -w /Library/LaunchDaemons/org.tuxfamily.chronyc.plist
+sudo launchctl load -w /Library/LaunchDaemons/org.chrony-project.chronyc.plist
 
 
-3. org.tuxfamily.chronyd.plist
+3. org.chrony-project.chronyd.plist
 This file is the launchd plist that runs chronyd when the Macintosh starts.
 
-sudo cp org.tuxfamily.chronyd.plist /Library/LaunchDaemons
+sudo cp org.chrony-project.chronyd.plist /Library/LaunchDaemons
-sudo chown root:wheel /Library/LaunchDaemons/org.tuxfamily.chronyd.plist
+sudo chown root:wheel /Library/LaunchDaemons/org.chrony-project.chronyd.plist
-sudo chmod 0644 /Library/LaunchDaemons/org.tuxfamily.chronyd.plist
+sudo chmod 0644 /Library/LaunchDaemons/org.chrony-project.chronyd.plist
-sudo launchctl load -w /Library/LaunchDaemons/org.tuxfamily.chronyd.plist
+sudo launchctl load -w /Library/LaunchDaemons/org.chrony-project.chronyd.plist

contrib/bryan_christianson_1/org.chrony-project.chronyc.plist

@@ -3,7 +3,7 @@
 <plist version="1.0">
 <dict>
 	<key>Label</key>
-	<string>org.tuxfamily.logrotate</string>
+	<string>org.chrony-project.logrotate</string>
 	<key>KeepAlive</key>
 	<false/>
 	<key>ProgramArguments</key>

contrib/bryan_christianson_1/org.chrony-project.chronyd.plist

@@ -3,7 +3,7 @@
 <plist version="1.0">
 <dict>
 	<key>Label</key>
-	<string>org.tuxfamily.chronyd</string>
+	<string>org.chrony-project.chronyd</string>
 	<key>Program</key>
 	<string>/usr/local/sbin/chronyd</string>
 	<key>ProgramArguments</key>

doc/chrony.conf.adoc

@@ -3,7 +3,7 @@
 // Copyright (C) Richard P. Curnow  1997-2003
 // Copyright (C) Stephen Wadeley  2016
 // Copyright (C) Bryan Christianson  2017
-// Copyright (C) Miroslav Lichvar  2009-2022
+// Copyright (C) Miroslav Lichvar  2009-2023
 //
 // This program is free software; you can redistribute it and/or modify
 // it under the terms of version 2 of the GNU General Public License as
@@ -72,9 +72,7 @@ newly resolved address when the server becomes unreachable (i.e. no valid
 response to last 8 requests), unsynchronised, a falseticker (i.e. does not
 agree with a majority of other sources), or the root distance is too large (the
 limit can be configured by the <<maxdistance,*maxdistance*>> directive). The
-automatic replacement happens at most once per 30 minutes. It can also be
+automatic replacement happens at most once per 30 minutes.
-triggered manually for all sources by the <<chronyc.adoc#refresh,*refresh*>>
-command in *chronyc*.
 +
 This directive can be used multiple times to specify multiple servers.
 +
@@ -324,16 +322,27 @@ server implementations do not respond to requests containing an unknown
 extension field (*chronyd* as a server responded to such requests since
 version 2.0).
 +
-The following extension field can be enabled by this option:
+This option can be used multiple times to enable multiple extension fields.
++
+The following extension fields are supported:
 +
 _F323_::::
-This is an experimental extension field for some improvements that were
+An experimental extension field to enable several improvements that were
 proposed for the next version of the NTP protocol (NTPv5). The field contains
 root delay and dispersion in higher resolution and a monotonic receive
-timestamp, which enables a frequency transfer between the server and client. It
+timestamp, which enables a frequency transfer between the server and client to
-can significantly improve stability of the synchronization. Generally, it
+significantly improve stability of the synchronisation. This field should be
-should be expected to work only between servers and clients running the same
+enabled only for servers known to be running *chronyd* version 4.2 or later.
-version of *chronyd*.
+_F324_::::
+An experimental extension field to enable the use of the Precision Time
+Protocol (PTP) correction field in NTP-over-PTP messages updated by one-step
+end-to-end transparent clocks in network switches and routers to significantly
+improve accuracy and stability of the synchronisation. NTP-over-PTP can be
+enabled by the <<ptpport,*ptpport*>> directive and setting the *port* option to
+the PTP port. The corrections are applied only to NTP measurements with HW
+timestamps (enabled by the <<hwtimestamp,*hwtimestamp*>> directive). This
+field should be enabled only for servers known to be running *chronyd* version
+4.5 or later.
 {blank}:::
 
 [[pool]]*pool* _name_ [_option_]...::
@@ -420,7 +429,7 @@ error. *chronyd* then enters its normal operating mode.
 An example of the use of the directive is:
 +
 ----
-initstepslew 30 foo.example.net bar.example.net baz.example.net
+initstepslew 30 ntp1.example.net ntp2.example.net ntp3.example.net
 ----
 +
 where 3 NTP servers are used to make the measurement. The _30_ indicates that
@@ -835,9 +844,10 @@ sources using NTS, otherwise the source with a longer polling interval will
 refresh the keys on each poll and no NTP packets will be exchanged.
 
 [[ntstrustedcerts]]*ntstrustedcerts* [_set-ID_] _file_|_directory_::
-This directive specifies a file or directory containing certificates (in the
+This directive specifies a file or directory containing trusted certificates
-PEM format) of trusted certificate authorities (CA) which can be used to
+(in the PEM format) which are needed to verify certificates of NTS-KE servers,
-verify certificates of NTS servers.
+e.g. certificates of trusted certificate authorities (CA) or self-signed
+certificates of the servers.
 +
 The optional _set-ID_ argument is a number in the range 0 through 2^32-1, which
 selects the set of certificates where certificates from the specified file
@@ -857,10 +867,10 @@ they change (e.g. after a renewal).
 An example is:
 +
 ----
-ntstrustedcerts /etc/pki/nts/foo.crt
+ntstrustedcerts /etc/pki/nts/ca1.example.net.crt
-ntstrustedcerts 1 /etc/pki/nts/bar.crt
+ntstrustedcerts 1 /etc/pki/nts/ca2.example.net.crt
-ntstrustedcerts 1 /etc/pki/nts/baz.crt
+ntstrustedcerts 1 /etc/pki/nts/ca3.example.net.crt
-ntstrustedcerts 2 /etc/pki/nts/qux.crt
+ntstrustedcerts 2 /etc/pki/nts/ntp2.example.net.crt
 ----
 
 [[nosystemcert]]*nosystemcert*::
@@ -886,6 +896,19 @@ This would disable the time checks until the clock is updated for the first
 time, assuming the first update corrects the clock and later checks can work
 with correct time.
 
+[[refresh]]*refresh* _interval_::
+This directive specifies the interval (in seconds) between refreshing IP
+addresses of NTP sources specified by hostname. If the hostname no longer
+resolves to the currently used address, it will be replaced with one of the new
+addresses to avoid using a server which is no longer intended for service, even
+if it is still responding correctly and would not be replaced as unreachable.
+Only one source is refreshed at a time. The default value is 1209600 (2 weeks)
+and the maximum value is 2^31-1 (68 years). A value of 0 disables the periodic
+refreshment.
++
+The <<chronyc.adoc#refresh,*refresh*>> command can be used to refresh all
+sources immediately.
+
 === Source selection
 
 [[authselectmode]]*authselectmode* _mode_::
@@ -944,9 +967,9 @@ before 4.0.
 As an example, the following configuration using the default *mix* mode:
 +
 ----
-server foo.example.net nts
+server ntp1.example.net nts
-server bar.example.net nts
+server ntp2.example.net nts
-server baz.example.net
+server ntp3.example.net
 refclock SOCK /var/run/chrony.ttyS0.sock
 ----
 +
@@ -954,9 +977,9 @@ is equivalent to the following configuration using the *ignore* mode:
 +
 ----
 authselectmode ignore
-server foo.example.net nts require trust
+server ntp1.example.net nts require trust
-server bar.example.net nts require trust
+server ntp2.example.net nts require trust
-server baz.example.net
+server ntp3.example.net
 refclock /var/run/chrony.ttyS0.sock require trust
 ----
 
@@ -1965,8 +1988,9 @@ all* directive.
 [[cmdport]]*cmdport* _port_::
 The *cmdport* directive allows the port that is used for run-time monitoring
 (via the *chronyc* program) to be altered from its default (323). If set to 0,
-*chronyd* will not open the port, this is useful to disable *chronyc*
+*chronyd* will not open the port, which disables remote *chronyc* access (with
-access from the Internet. (It does not disable the Unix domain command socket.)
+a non-default *bindcmdaddress*) and local access for unprivileged users. It
+does not disable the Unix domain command socket.
 +
 An example shows the syntax:
 +
@@ -1975,7 +1999,7 @@ cmdport 257
 ----
 +
 This would make *chronyd* use UDP 257 as its command port. (*chronyc* would
-need to be run with the *-p 257* switch to inter-operate correctly.)
+need to be run with the *-p 257* option to inter-operate correctly.)
 
 [[cmdratelimit]]*cmdratelimit* [_option_]...::
 This directive enables response rate limiting for command packets. It is
@@ -2717,24 +2741,27 @@ pidfile /run/chronyd.pid
 The *ptpport* directive enables *chronyd* to send and receive NTP messages
 contained in PTP event messages (NTP-over-PTP) to enable hardware timestamping
 on NICs which cannot timestamp NTP packets, but can timestamp unicast PTP
-packets. The port recognized by the NICs is 319 (PTP event port). The default
+packets, and also use corrections provided by PTP one-step end-to-end
-value is 0 (disabled).
+transparent clocks in network switches and routers. The port recognized by the
+NICs and PTP transparent clocks is 319 (PTP event port). The default value is 0
+(disabled).
 +
 The NTP-over-PTP support is experimental. The protocol and configuration can
-change in future. It should be used only in local networks and expected to work
+change in future. It should be used only in local networks.
-only between servers and clients running the same version of *chronyd*.
 +
 The PTP port will be open even if *chronyd* is not configured to operate as a
 server or client. The directive does not change the default protocol of
 specified NTP sources. Each NTP source that should use NTP-over-PTP needs to
 be specified with the *port* option set to the PTP port. To actually enable
 hardware timestamping on NICs which can timestamp PTP packets only, the
-*rxfilter* option of the *hwtimestamp* directive needs to be set to _ptp_.
+*rxfilter* option of the *hwtimestamp* directive needs to be set to _ptp_. The
+extension field _F324_ needs to be enabled to use the corrections provided by
+the PTP transparent clocks.
 +
 An example of client configuration is:
 +
 ----
-server foo.example.net minpoll 0 maxpoll 0 xleave port 319
+server ntp1.example.net minpoll 0 maxpoll 0 xleave port 319 extfield F324
 hwtimestamp * rxfilter ptp
 ptpport 319
 ----
@@ -2795,13 +2822,13 @@ the following methods:
   facilities.
 * Use public servers from the https://www.pool.ntp.org/[pool.ntp.org] project.
 
-Assuming that your NTP servers are called _foo.example.net_, _bar.example.net_
+Assuming that your NTP servers are called _ntp1.example.net_, _ntp2.example.net_
-and _baz.example.net_, your _chrony.conf_ file could contain as a minimum:
+and _ntp3.example.net_, your _chrony.conf_ file could contain as a minimum:
 
 ----
-server foo.example.net
+server ntp1.example.net
-server bar.example.net
+server ntp2.example.net
-server baz.example.net
+server ntp3.example.net
 ----
 
 However, you will probably want to include some of the other directives. The
@@ -2812,9 +2839,9 @@ synchronisation. The smallest useful configuration file would look something
 like:
 
 ----
-server foo.example.net iburst
+server ntp1.example.net iburst
-server bar.example.net iburst
+server ntp2.example.net iburst
-server baz.example.net iburst
+server ntp3.example.net iburst
 driftfile @CHRONYVARDIR@/drift
 makestep 1.0 3
 rtcsync
@@ -2838,9 +2865,9 @@ option will enable a secure synchronisation to the servers. The configuration
 file could look like:
 
 ----
-server foo.example.net iburst nts
+server ntp1.example.net iburst nts
-server bar.example.net iburst nts
+server ntp2.example.net iburst nts
-server baz.example.net iburst nts
+server ntp3.example.net iburst nts
 driftfile @CHRONYVARDIR@/drift
 makestep 1.0 3
 rtcsync
@@ -2854,14 +2881,14 @@ additional configuration to tell *chronyd* when the connection goes up and
 down. This saves the program from continuously trying to poll the servers when
 they are inaccessible.
 
-Again, assuming that your NTP servers are called _foo.example.net_,
+Again, assuming that your NTP servers are called _ntp1.example.net_,
-_bar.example.net_ and _baz.example.net_, your _chrony.conf_ file would now
+_ntp2.example.net_ and _ntp3.example.net_, your _chrony.conf_ file would now
 contain:
 
 ----
-server foo.example.net offline
+server ntp1.example.net offline
-server bar.example.net offline
+server ntp2.example.net offline
-server baz.example.net offline
+server ntp3.example.net offline
 driftfile @CHRONYVARDIR@/drift
 makestep 1.0 3
 rtcsync
@@ -3045,9 +3072,9 @@ configuration files are shown.
 For the _chrony.conf_ file, the following can be used as an example.
 
 ----
-server foo.example.net maxdelay 0.4 offline
+server ntp1.example.net maxdelay 0.4 offline
-server bar.example.net maxdelay 0.4 offline
+server ntp2.example.net maxdelay 0.4 offline
-server baz.example.net maxdelay 0.4 offline
+server ntp3.example.net maxdelay 0.4 offline
 logdir /var/log/chrony
 log statistics measurements tracking
 driftfile @CHRONYVARDIR@/drift
@@ -3106,10 +3133,10 @@ configuration).
 The configuration file could look like:
 
 ----
-server foo.example.net iburst
+server ntp1.example.net iburst
-server bar.example.net iburst
+server ntp2.example.net iburst
-server baz.example.net iburst
+server ntp3.example.net iburst
-server qux.example.net iburst
+server ntp4.example.net iburst
 makestep 1.0 3
 rtcsync
 allow
@@ -3126,7 +3153,7 @@ dumpdir @CHRONYRUNDIR@
 == BUGS
 
 For instructions on how to report bugs, please visit
-https://chrony.tuxfamily.org/.
+https://chrony-project.org/.
 
 == AUTHORS
 

doc/chronyc.adoc

@@ -2,7 +2,7 @@
 //
 // Copyright (C) Richard P. Curnow  1997-2003
 // Copyright (C) Stephen Wadeley  2016
-// Copyright (C) Miroslav Lichvar  2009-2017, 2019-2022
+// Copyright (C) Miroslav Lichvar  2009-2017, 2019-2023
 //
 // This program is free software; you can redistribute it and/or modify
 // it under the terms of version 2 of the GNU General Public License as
@@ -144,7 +144,7 @@ The *tracking* command displays parameters about the system's clock
 performance. An example of the output is shown below.
 +
 ----
-Reference ID    : CB00710F (foo.example.net)
+Reference ID    : CB00710F (ntp1.example.net)
 Stratum         : 3
 Ref time (UTC)  : Fri Jan 27 09:49:17 2017
 System time     : 0.000006523 seconds slow of NTP time
@@ -178,7 +178,7 @@ with an IPv4 address.
 *Stratum*:::
 The stratum indicates how many hops away from a computer with an attached
 reference clock we are. Such a computer is a stratum-1 computer, so the
-computer in the example is two hops away (i.e. _foo.example.net_ is a
+computer in the example is two hops away (i.e. _ntp1.example.net_ is a
 stratum-2 and is synchronised from a stratum-1).
 *Ref time*:::
 This is the time (UTC) at which the last measurement from the reference
@@ -321,8 +321,8 @@ extra caption lines are shown as a reminder of the meanings of the columns.
 MS Name/IP address         Stratum Poll Reach LastRx Last sample
 ===============================================================================
 #* GPS0                          0   4   377    11   -479ns[ -621ns] +/-  134ns
-^? foo.example.net               2   6   377    23   -923us[ -924us] +/-   43ms
+^? ntp1.example.net              2   6   377    23   -923us[ -924us] +/-   43ms
-^+ bar.example.net               1   6   377    21  -2629us[-2619us] +/-   86ms
+^+ ntp2.example.net              1   6   377    21  -2629us[-2619us] +/-   86ms
 ----
 +
 The columns are as follows:
@@ -379,9 +379,9 @@ offset. This can be suffixed by _ns_ (indicating nanoseconds), _us_
 (indicating microseconds), _ms_ (indicating milliseconds), or _s_ (indicating
 seconds). The number to the left of the square brackets shows the original
 measurement, adjusted to allow for any slews applied to the local clock
-since. The number following the _+/-_ indicator shows the margin of error in
+since. Positive offsets indicate that the local clock is ahead of the source.
-the measurement. Positive offsets indicate that the local clock is ahead of
+The number following the _+/-_ indicator shows the margin of error in the
-the source.
+measurement (NTP root distance).
 
 [[sourcestats]]*sourcestats* [*-a*] [*-v*]::
 The *sourcestats* command displays information about the drift rate and offset
@@ -400,7 +400,7 @@ An example report is:
 ----
 Name/IP Address            NP  NR  Span  Frequency  Freq Skew  Offset  Std Dev
 ===============================================================================
-foo.example.net            11   5   46m     -0.001      0.045      1us    25us
+ntp1.example.net           11   5   46m     -0.001      0.045      1us    25us
 ----
 +
 The columns are as follows:
@@ -444,9 +444,9 @@ An example of the output is shown below.
 ----
 S Name/IP Address        Auth COpts EOpts Last Score     Interval  Leap
 =======================================================================
-D foo.example.net           Y ----- --TR-    4   1.0   -61ms   +62ms  N
+D ntp1.example.net          Y ----- --TR-    4   1.0   -61ms   +62ms  N
-* bar.example.net           N ----- -----    0   1.0 -6846us +7305us  N
+* ntp2.example.net          N ----- -----    0   1.0 -6846us +7305us  N
-+ baz.example.net           N ----- -----   10   1.0 -7381us +7355us  N
++ ntp3.example.net          N ----- -----   10   1.0 -7381us +7355us  N
 ----
 +
 The columns are as follows:
@@ -592,9 +592,9 @@ shown below.
 ----
 Name/IP address             Mode KeyID Type KLen Last Atmp  NAK Cook CLen
 =========================================================================
-foo.example.net              NTS     1   15  256 135m    0    0    8  100
+ntp1.example.net             NTS     1   15  256 135m    0    0    8  100
-bar.example.net               SK    30   13  128    -    0    0    0    0
+ntp2.example.net              SK    30   13  128    -    0    0    0    0
-baz.example.net                -     0    0    0    -    0    0    0    0
+ntp3.example.net               -     0    0    0    -    0    0    0    0
 ----
 +
 The columns are as follows:
@@ -758,7 +758,7 @@ parameters and options is identical to that for the
 An example of using this command is shown below.
 +
 ----
-add peer foo.example.net minpoll 6 maxpoll 10 key 25
+add peer ntp1.example.net minpoll 6 maxpoll 10 key 25
 ----
 
 [[add_pool]]*add pool* _name_ [_option_]...::
@@ -772,7 +772,7 @@ directive in the configuration file.
 An example of using this command is shown below:
 +
 ----
-add pool foo.example.net maxsources 3 iburst
+add pool ntp1.example.net maxsources 3 iburst
 ----
 
 [[add_server]]*add server* _name_ [_option_]...::
@@ -786,7 +786,7 @@ directive in the configuration file.
 An example of using this command is shown below:
 +
 ----
-add server foo.example.net minpoll 6 maxpoll 10 key 25
+add server ntp1.example.net minpoll 6 maxpoll 10 key 25
 ----
 
 [[delete]]*delete* _address_::
@@ -862,7 +862,7 @@ IPv6 addresses have first 48 bits equal to _2001:db8:789a_.
 Example of the three-argument form of the command is:
 +
 ----
-burst 2/10 foo.example.net
+burst 2/10 ntp1.example.net
 ----
 
 [[maxdelay]]*maxdelay* _address_ _delay_::
@@ -928,7 +928,7 @@ uses an IP address or a hostname. These forms are illustrated below.
 offline
 offline 255.255.255.0/1.2.3.0
 offline 2001:db8:789a::/48
-offline foo.example.net
+offline ntp1.example.net
 ----
 +
 The second form means that the *offline* command is to be applied to any source
@@ -970,17 +970,26 @@ current set of sources. It is equivalent to the *polltarget* option in the
 
 [[refresh]]*refresh*::
 The *refresh* command can be used to force *chronyd* to resolve the names of
-configured sources to IP addresses again, e.g. after suspending and resuming
+configured NTP sources to IP addresses again and replace any addresses missing
-the machine in a different network.
+in the list of resolved addresses.
 +
-Sources that stop responding will be replaced with newly resolved addresses
+Sources that stop responding are replaced with newly resolved addresses
-automatically after 8 polling intervals, but this command can still be useful
+automatically after 8 polling intervals. This command can be used to replace
-to replace them immediately and not wait until they are marked as unreachable.
+them immediately, e.g. after suspending and resuming the machine in a different
+network.
++
+Note that with pools which have more than 16 addresses, or not all IPv4 or IPv6
+addresses are included in a single DNS response (e.g. pool.ntp.org), this
+command might replace the addresses even if they are still in the pool.
 
 [[reload]]*reload* *sources*::
 The *reload sources* command causes *chronyd* to re-read all _*.sources_ files
 from the directories specified by the
 <<chrony.conf.adoc#sourcedir,*sourcedir*>> directive.
++
+Note that modified sources (e.g. specified with a new option) are not modified
+in memory. They are removed and added again, which causes them to lose old
+measurements and reset the selection state.
 
 [[sourcename]]*sourcename* _address_::
 The *sourcename* command prints the original hostname or address that was
@@ -1089,7 +1098,7 @@ particular host.
 Examples of use, showing a named host and a numeric IP address, are as follows:
 +
 ----
-accheck foo.example.net
+accheck ntp1.example.net
 accheck 1.2.3.4
 accheck 2001:db8::1
 ----
@@ -1116,7 +1125,7 @@ An example of the output is:
 Hostname                      NTP   Drop Int IntL Last     Cmd   Drop Int  Last
 ===============================================================================
 localhost                       2      0   2   -   133      15      0  -1     7
-foo.example.net                12      0   6   -    23       0      0   -     -
+ntp1.example.net               12      0   6   -    23       0      0   -     -
 ----
 +
 Each row shows the data for a single host. Only hosts that have passed the host
@@ -1316,7 +1325,7 @@ used to check whether monitoring access is permitted from a named host.
 Examples of use are as follows:
 +
 ----
-cmdaccheck foo.example.net
+cmdaccheck ntp1.example.net
 cmdaccheck 1.2.3.4
 cmdaccheck 2001:db8::1
 ----
@@ -1543,7 +1552,7 @@ The *help* command displays a summary of the commands and their arguments.
 == BUGS
 
 For instructions on how to report bugs, please visit
-https://chrony.tuxfamily.org/.
+https://chrony-project.org/.
 
 == AUTHORS
 

doc/chronyd.adoc

@@ -72,9 +72,9 @@ terminal.
 
 *-L* _level_::
 This option specifies the minimum severity level of messages to be written to
-the log file, syslog, or terminal. The following levels can be specified:
+the log file, syslog, or terminal. The following levels can be specified: -1
-0 (informational), 1 (warning), 2 (non-fatal error), and 3 (fatal error). The
+(debug, if compiled with enabled support for debugging), 0 (informational), 1
-default value is 0.
+(warning), 2 (non-fatal error), and 3 (fatal error). The default value is 0.
 
 *-p*::
 When run in this mode, *chronyd* will print the configuration and exit. It will
@@ -206,6 +206,17 @@ With this option *chronyd* will print version number to the terminal and exit.
 *-h*, *--help*::
 With this option *chronyd* will print a help message to the terminal and exit.
 
+== ENVIRONMENT VARIABLES
+
+*LISTEN_FDS*::
+On Linux systems, the systemd service manager may pass file descriptors for
+pre-initialised sockets to *chronyd*. The service manager allocates and binds
+the file descriptors, and passes a copy to each spawned instance of the
+service. This allows for zero-downtime service restarts as the sockets buffer
+client requests until the service is able to handle them. The service manager
+sets the LISTEN_FDS environment variable to the number of passed file
+descriptors.
+
 == FILES
 
 _@SYSCONFDIR@/chrony.conf_
@@ -217,7 +228,7 @@ _@SYSCONFDIR@/chrony.conf_
 == BUGS
 
 For instructions on how to report bugs, please visit
-https://chrony.tuxfamily.org/.
+https://chrony-project.org/.
 
 == AUTHORS
 

doc/faq.adoc

@@ -1,7 +1,8 @@
 // This file is part of chrony
 //
 // Copyright (C) Richard P. Curnow  1997-2003
-// Copyright (C) Miroslav Lichvar  2014-2016, 2020-2022
+// Copyright (C) Luke Valenta  2023
+// Copyright (C) Miroslav Lichvar  2014-2016, 2020-2023
 //
 // This program is free software; you can redistribute it and/or modify
 // it under the terms of version 2 of the GNU General Public License as
@@ -40,9 +41,36 @@ on an isolated network with no hardware reference clocks in sight, `chrony`
 will probably work better for you.
 
 For a more detailed comparison of features and performance, see the
-https://chrony.tuxfamily.org/comparison.html[comparison page] on the `chrony`
+https://chrony-project.org/comparison.html[comparison page] on the `chrony`
 website.
 
+=== Should I prefer `chrony` over `timesyncd` if I do not need to run a server?
+
+Generally, yes.
+
+`systemd-timesyncd` is a very simple NTP client included in the `systemd`
+suite. It lacks almost all features of `chrony` and other advanced client
+implementations listed on the
+https://chrony-project.org/comparison.html[comparison page]. One of its main
+limitations is that it cannot poll multiple servers at the same time and detect
+servers having incorrect time (falsetickers in the NTP terminology). It should
+be used only with trusted reliable servers, ideally in local network.
+
+Using `timesyncd` with `pool.ntp.org` is problematic. The pool is very
+robust as a whole, but the individual servers run by volunteers cannot be
+relied on. Occasionally, servers drift away or make a step to distant past or
+future due to misconfiguration, problematic implementation, and other bugs
+(e.g. in firmware of a GPS receiver). The pool monitoring system detects such
+servers and quickly removes them from the pool DNS, but clients like
+`timesyncd` cannot recover from that. They follow the server as long as it
+claims to be synchronised. They need to be restarted in order to get a new
+address from the pool DNS.
+
+Note that the complexity of NTP and clock synchronisation is on the client
+side. The amount of code in `chrony` specific to NTP server is very small and
+it is disabled by default. If it was removed, it would not significantly reduce
+the amount of memory or storage needed.
+
 == Configuration issues
 
 === What is the minimum recommended configuration for an NTP client?
@@ -238,11 +266,11 @@ An example of a client configuration limiting the impact of the attacks could
 be
 
 ----
-server foo.example.net iburst nts maxdelay 0.1
+server ntp1.example.net iburst nts maxdelay 0.1
-server bar.example.net iburst nts maxdelay 0.2
+server ntp2.example.net iburst nts maxdelay 0.2
-server baz.example.net iburst nts maxdelay 0.05
+server ntp3.example.net iburst nts maxdelay 0.05
-server qux.example.net iburst nts maxdelay 0.1
+server ntp4.example.net iburst nts maxdelay 0.1
-server quux.example.net iburst nts maxdelay 0.1
+server ntp5.example.net iburst nts maxdelay 0.1
 minsources 3
 maxchange 100 0 0
 makestep 0.001 1
@@ -291,7 +319,7 @@ An example of the directive for an NTP server on the Internet that you are
 allowed to poll frequently could be
 
 ----
-server foo.example.net minpoll 4 maxpoll 6 polltarget 16
+server ntp.example.net minpoll 4 maxpoll 6 polltarget 16
 ----
 
 An example using shorter polling intervals with a server located in the same
@@ -354,7 +382,7 @@ outliers corrupting the minimum delay. For example:
 server ntp.local minpoll -7 maxpoll -7 filter 31 maxdelayquant 0.3 xleave
 ----
 
-As an experimental feature added in version 4.2, `chronyd` supports an NTPv4
+Since version 4.2, `chronyd` supports an NTPv4
 extension field containing an additional timestamp to enable frequency transfer
 and significantly improve stability of synchronisation. It can be enabled by
 the `extfield F323` option. For example:
@@ -363,6 +391,18 @@ the `extfield F323` option. For example:
 server ntp.local minpoll 0 maxpoll 0 xleave extfield F323
 ----
 
+Since version 4.5, `chronyd` can apply corrections from PTP one-step end-to-end
+transparent clocks (e.g. network switches) to significantly improve accuracy of
+synchronisation in local networks. It requires the PTP transport to be enabled
+by the `ptpport` directive, HW timestamping, and the `extfield F324` option.
+For example:
+
+----
+server ntp.local minpoll -4 maxpoll -4 xleave extfield F323 extfield F324 port 319
+ptpport 319
+hwtimestamp eth0 minpoll -4
+----
+
 === Does `chronyd` have an ntpdate mode?
 
 Yes. With the `-q` option `chronyd` will set the system clock once and exit.
@@ -470,6 +510,59 @@ pidfile /var/run/chronyd-server1.pid
 driftfile /var/lib/chrony/drift-server1
 ----
 
+=== How can `chronyd` be configured to minimise downtime during restarts?
+
+The `dumpdir` directive in _chrony.conf_ provides `chronyd` a location to save
+a measurement history of the sources it uses when the service exits. The `-r`
+option then enables `chronyd` to load state from the dump files, reducing the
+synchronisation time after a restart.
+
+Similarly, the `ntsdumpdir` directive provides a location for `chronyd` to save
+NTS cookies received from the server to avoid making a NTS-KE request when
+`chronyd` is started. When operating as an NTS server, `chronyd` also saves
+cookies keys to this directory to allow clients to continue to use the old keys
+after a server restart for a more seamless experience.
+
+On Linux systems,
+https://www.freedesktop.org/software/systemd/man/latest/sd_listen_fds.html[systemd
+socket activation] provides a mechanism to reuse server sockets across
+`chronyd` restarts, so that client requests will be buffered until the service
+is again able to handle the requests. This allows for zero-downtime service
+restarts, simplified dependency logic at boot, and on-demand service spawning
+(for instance, for separated server `chronyd` instances run with the `-x`
+flag).
+
+Socket activation is supported since `chrony` version 4.5.
+The service manager (systemd) creates sockets and
+passes file descriptors to them to the process via the `LISTEN_FDS` environment
+variable. Before opening new sockets, `chronyd` first checks for and attempts
+to reuse matching sockets passed from the service manager. For instance, if an
+IPv4 datagram socket bound on `bindaddress` and `port` is available, it will be
+used by the NTP server to accept incoming IPv4 requests.
+
+An example systemd socket unit is below, where `chronyd` is configured with
+`bindaddress 0.0.0.0`, `bindaddress ::`, `port 123`, and `ntsport 4460`.
+
+----
+[Unit]
+Description=chronyd server sockets
+
+[Socket]
+Service=chronyd.service
+# IPv4 NTP server
+ListenDatagram=0.0.0.0:123
+# IPv6 NTP server
+ListenDatagram=[::]:123
+# IPv4 NTS-KE server
+ListenStream=0.0.0.0:4460
+# IPv6 NTS-KE server
+ListenStream=[::]:4460
+BindIPv6Only=ipv6-only
+
+[Install]
+WantedBy=sockets.target
+----
+
 === Should be a leap smear enabled on NTP server?
 
 With the `smoothtime` and `leapsecmode` directives it is possible to enable a
@@ -484,7 +577,7 @@ identically configured leap-smearing servers. Note that some clients can get
 leap seconds from other sources (e.g. with the `leapsectz` directive in
 `chrony`) and they will not work correctly with a leap smearing server.
 
-=== How should `chronyd` be configuration with `gpsd`?
+=== How should `chronyd` be configured with `gpsd`?
 
 A GPS or other GNSS receiver can be used as a reference clock with `gpsd`. It
 can work as one or two separate time sources for each connected receiver. The
@@ -571,7 +664,28 @@ The `ethtool -T` command can be used to verify the timestamping support.
 As an experimental feature added in version 4.2, `chrony` can use PTP as a
 transport for NTP messages (NTP over PTP) to enable hardware timestamping on
 hardware which can timestamp PTP packets only. It can be enabled by the
-`ptpport` directive.
+`ptpport` directive. Since version 4.5, `chrony` can also apply corrections
+provided by PTP one-step end-to-end transparent clocks to reach the accuracy of
+ordinary PTP clocks. The application of PTP corrections can be enabled by the
+`extfield F324` option.
+
+=== How can I avoid using wrong PHC refclock?
+
+If your system has multiple PHC devices, normally named by `udev` as
+_/dev/ptp0_, _/dev/ptp1_, and so on, their order can change randomly across
+reboots depending on the order of initialisation of their drivers. If a PHC
+refclock is specified by this name, `chronyd` could be using a wrong refclock
+after reboot. To prevent that, you can configure `udev` to create a stable
+symlink for `chronyd` with a rule like this (e.g. written to
+_/etc/udev/rules.d/80-phc.rules_):
+
+----
+KERNEL=="ptp[0-9]*", DEVPATH=="/devices/pci0000:00/0000:00:01.2/0000:02:00.0/ptp/*", SYMLINK+="ptp-i350-1"
+----
+
+You can get the full _DEVPATH_ of an existing PHC device with the `udevadm
+info` command. You will need to execute the `udevadm trigger` command, or
+reboot the system, for these changes to take effect.
 
 === Why are client log records dropped before reaching `clientloglimit`?
 
@@ -624,9 +738,9 @@ this:
 ----
 MS Name/IP address         Stratum Poll Reach LastRx Last sample
 ===============================================================================
-^* foo.example.net               2   6   377    34   +484us[ -157us] +/-   30ms
+^* ntp1.example.net              2   6   377    34   +484us[ -157us] +/-   30ms
-^- bar.example.net               2   6   377    34    +33ms[  +32ms] +/-   47ms
+^- ntp2.example.net              2   6   377    34    +33ms[  +32ms] +/-   47ms
-^+ baz.example.net               3   6   377    35  -1397us[-2033us] +/-   60ms
+^+ ntp3.example.net              3   6   377    35  -1397us[-2033us] +/-   60ms
 ----
 
 === Are NTP servers specified with the `offline` option?
@@ -696,9 +810,9 @@ successful:
 # chronyc -N authdata
 Name/IP address             Mode KeyID Type KLen Last Atmp  NAK Cook CLen
 =========================================================================
-foo.example.net              NTS     1   15  256  33m    0    0    8  100
+ntp1.example.net             NTS     1   15  256  33m    0    0    8  100
-bar.example.net              NTS     1   15  256  33m    0    0    8  100
+ntp2.example.net             NTS     1   15  256  33m    0    0    8  100
-baz.example.net              NTS     1   15  256  33m    0    0    8  100
+ntp3.example.net             NTS     1   15  256  33m    0    0    8  100
 ----
 
 The KeyID, Type, and KLen columns should have non-zero values. If they are
@@ -822,7 +936,7 @@ Name/IP Address            NP  NR  Span  Frequency  Freq Skew  Offset  Std Dev
 ==============================================================================
 PPS0                        0   0     0     +0.000   2000.000     +0ns  4000ms
 NMEA                       58  30   231    -96.494     38.406   +504ms  6080us
-foo.example.net             7   3   200     -2.991     16.141   -107us   492us
+ntp1.example.net            7   3   200     -2.991     16.141   -107us   492us
 ----
 
 the offset of the NMEA source would need to be increased by about 0.504

examples/chrony-wait.service

@@ -25,7 +25,6 @@ LockPersonality=yes
 MemoryDenyWriteExecute=yes
 PrivateDevices=yes
 PrivateUsers=yes
-ProcSubset=pid
 ProtectClock=yes
 ProtectControlGroups=yes
 ProtectHome=yes

examples/chrony.conf.example3

@@ -27,9 +27,9 @@
 # you can access at http://support.ntp.org/bin/view/Servers/WebHome or
 # you can use servers from the pool.ntp.org project.
 
-! server foo.example.net iburst
+! server ntp1.example.net iburst
-! server bar.example.net iburst
+! server ntp2.example.net iburst
-! server baz.example.net iburst
+! server ntp3.example.net iburst
 
 ! pool pool.ntp.org iburst
  
@@ -99,8 +99,8 @@ ntsdumpdir /var/lib/chrony
 # and edit the following lines to specify the locations of the certificate and
 # key.
 
-! ntsservercert /etc/.../foo.example.net.crt
+! ntsservercert /etc/.../nts-server.crt
-! ntsserverkey /etc/.../foo.example.net.key
+! ntsserverkey /etc/.../nts-server.key
 
 # chronyd can save the measurement history for the servers to files when
 # it exits.  This is useful in 2 situations:
@@ -238,7 +238,7 @@ ntsdumpdir /var/lib/chrony
 # several people, you need to set up a mailing list or sendmail alias
 # for them and use the address of that.)
 
-! mailonchange wibble@foo.example.net 0.5
+! mailonchange wibble@example.net 0.5
 
 #######################################################################
 ### COMMAND ACCESS

examples/chronyd-restricted.service

@@ -36,7 +36,6 @@ PrivateDevices=yes
 PrivateTmp=yes
 # This breaks adjtimex()
 #PrivateUsers=yes
-ProcSubset=pid
 ProtectControlGroups=yes
 ProtectHome=yes
 ProtectHostname=yes

examples/chronyd.service

@@ -24,7 +24,6 @@ LockPersonality=yes
 MemoryDenyWriteExecute=yes
 NoNewPrivileges=yes
 PrivateTmp=yes
-ProcSubset=pid
 ProtectControlGroups=yes
 ProtectHome=yes
 ProtectHostname=yes

logging.c

@@ -145,6 +145,7 @@ void LOG_Message(LOG_Severity severity,
   struct tm *tm;
 
   assert(initialised);
+  severity = CLAMP(LOGS_DEBUG, severity, LOGS_FATAL);
 
   if (!system_log && file_log && severity >= log_min_severity) {
     /* Don't clutter up syslog with timestamps and internal debugging info */
@@ -155,8 +156,13 @@ void LOG_Message(LOG_Severity severity,
       fprintf(file_log, "%s ", buf);
     }
 #if DEBUG > 0
-    if (log_min_severity <= LOGS_DEBUG)
+    if (log_min_severity <= LOGS_DEBUG) {
-      fprintf(file_log, "%s%s:%d:(%s) ", debug_prefix, filename, line_number, function_name);
+      /* Log severity to character mapping (debug, info, warn, err, fatal) */
+      const char severity_chars[LOGS_FATAL - LOGS_DEBUG + 1] = {'D', 'I', 'W', 'E', 'F'};
+
+      fprintf(file_log, "%c:%s%s:%d:(%s) ", severity_chars[severity - LOGS_DEBUG],
+              debug_prefix, filename, line_number, function_name);
+    }
 #endif
   }
 

main.c

@@ -331,6 +331,9 @@ go_daemon(void)
     char message[1024];
     int r;
 
+    /* Don't exit before the 'parent' */
+    waitpid(pid, NULL, 0);
+
     close(pipefd[1]);
     r = read(pipefd[0], message, sizeof (message));
     if (r) {
@@ -353,7 +356,9 @@ go_daemon(void)
     if (pid < 0) {
       LOG_FATAL("fork() failed : %s", strerror(errno));
     } else if (pid > 0) {
-      exit(0); /* In the 'parent' */
+      /* In the 'parent' */
+      close(pipefd[1]);
+      exit(0);
     } else {
       /* In the child we want to leave running as the daemon */
 
@@ -363,9 +368,9 @@ go_daemon(void)
       }
 
       /* Don't keep stdin/out/err from before. But don't close
-         the parent pipe yet. */
+         the parent pipe yet, or reusable file descriptors. */
       for (fd=0; fd<1024; fd++) {
-        if (fd != pipefd[1])
+        if (fd != pipefd[1] && !SCK_IsReusable(fd))
           close(fd);
       }
 
@@ -555,6 +560,9 @@ int main
   if (user_check && getuid() != 0)
     LOG_FATAL("Not superuser");
 
+  /* Initialise reusable file descriptors before fork */
+  SCK_PreInitialise();
+
   /* Turn into a daemon */
   if (!nofork) {
     go_daemon();

memory.c

@@ -47,8 +47,13 @@ Realloc(void *ptr, size_t size)
 {
   void *r;
 
+  if (size == 0) {
+    Free(ptr);
+    return NULL;
+  }
+
   r = realloc(ptr, size);
-  if (!r && size)
+  if (!r)
     LOG_FATAL("Could not allocate memory");
 
   return r;

ntp.h

@@ -115,9 +115,11 @@ typedef struct {
 
 /* Non-authentication extension fields and corresponding internal flags */
 
-#define NTP_EF_EXP1                     0xF323
+#define NTP_EF_EXP_MONO_ROOT            0xF323
+#define NTP_EF_EXP_NET_CORRECTION       0xF324
 
-#define NTP_EF_FLAG_EXP1                0x1
+#define NTP_EF_FLAG_EXP_MONO_ROOT       0x1
+#define NTP_EF_FLAG_EXP_NET_CORRECTION  0x2
 
 /* Pre-NTPv5 experimental extension field */
 typedef struct {
@@ -126,9 +128,18 @@ typedef struct {
   NTP_int32 root_dispersion;
   NTP_int64 mono_receive_ts;
   uint32_t mono_epoch;
-} NTP_ExtFieldExp1;
+} NTP_EFExpMonoRoot;
 
-#define NTP_EF_EXP1_MAGIC 0xF5BEDD9AU
+#define NTP_EF_EXP_MONO_ROOT_MAGIC      0xF5BEDD9AU
+
+/* Experimental extension field to provide PTP corrections */
+typedef struct {
+  uint32_t magic;
+  NTP_int64 correction;
+  uint32_t reserved[3];
+} NTP_EFExpNetCorrection;
+
+#define NTP_EF_EXP_NET_CORRECTION_MAGIC 0x07AC2CEBU
 
 /* Authentication extension fields */
 

ntp_core.c

@@ -3,7 +3,7 @@
 
  **********************************************************************
  * Copyright (C) Richard P. Curnow  1997-2003
- * Copyright (C) Miroslav Lichvar  2009-2022
+ * Copyright (C) Miroslav Lichvar  2009-2023
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -215,9 +215,6 @@ struct NCR_Instance_Record {
   SPF_Instance filter;
   int filter_count;
 
-  /* Flag indicating HW transmit timestamps are expected */
-  int had_hw_tx_timestamp;
-
   /* Response waiting for a HW transmit timestamp of the request */
   struct SavedResponse *saved_response;
 
@@ -317,6 +314,9 @@ static ARR_Instance broadcasts;
 /* Maximum acceptable change in server mono<->real offset */
 #define MAX_MONO_DOFFSET 16.0
 
+/* Maximum assumed frequency error in network corrections */
+#define MAX_NET_CORRECTION_FREQ 100.0e-6
+
 /* Invalid socket, different from the one in ntp_io.c */
 #define INVALID_SOCK_FD -2
 
@@ -376,6 +376,9 @@ do_size_checks(void)
   assert(offsetof(NTP_Packet, originate_ts)    == 24);
   assert(offsetof(NTP_Packet, receive_ts)      == 32);
   assert(offsetof(NTP_Packet, transmit_ts)     == 40);
+
+  assert(sizeof (NTP_EFExpMonoRoot) == 24);
+  assert(sizeof (NTP_EFExpNetCorrection) == 24);
 }
 
 /* ================================================== */
@@ -421,6 +424,8 @@ zero_local_timestamp(NTP_Local_Timestamp *ts)
   UTI_ZeroTimespec(&ts->ts);
   ts->err = 0.0;
   ts->source = NTP_TS_DAEMON;
+  ts->rx_duration = 0.0;
+  ts->net_correction = 0.0;
 }
 
 /* ================================================== */
@@ -647,7 +652,7 @@ NCR_CreateInstance(NTP_Remote_Address *remote_addr, NTP_Source_Type type,
   result->auto_burst = params->burst;
   result->auto_offline = params->auto_offline;
   result->copy = params->copy && result->mode == MODE_CLIENT;
-  result->poll_target = params->poll_target;
+  result->poll_target = MAX(1, params->poll_target);
   result->ext_field_flags = params->ext_fields;
 
   if (params->nts) {
@@ -794,8 +799,6 @@ NCR_ResetInstance(NCR_Instance instance)
   if (instance->filter)
     SPF_DropSamples(instance->filter);
   instance->filter_count = 0;
-
-  instance->had_hw_tx_timestamp = 0;
 }
 
 /* ================================================== */
@@ -803,6 +806,8 @@ NCR_ResetInstance(NCR_Instance instance)
 void
 NCR_ResetPoll(NCR_Instance instance)
 {
+  instance->poll_score = 0.0;
+
   if (instance->local_poll != instance->minpoll) {
     instance->local_poll = instance->minpoll;
 
@@ -833,6 +838,12 @@ NCR_ChangeRemoteAddress(NCR_Instance inst, NTP_Remote_Address *remote_addr, int
     inst->local_addr.sock_fd = NIO_OpenServerSocket(remote_addr);
   }
 
+  /* Reset the polling interval only if the source wasn't unreachable to
+     avoid increasing server/network load in case that is what caused
+     the source to be unreachable */
+  if (SRC_IsReachable(inst->source))
+    NCR_ResetPoll(inst);
+
   /* Update the reference ID and reset the source/sourcestats instances */
   SRC_SetRefid(inst->source, UTI_IPToRefid(&remote_addr->ip_addr),
                &inst->remote_addr.ip_addr);
@@ -1042,34 +1053,64 @@ receive_timeout(void *arg)
 /* ================================================== */
 
 static int
-add_ext_exp1(NTP_Packet *message, NTP_PacketInfo *info, struct timespec *rx,
+add_ef_mono_root(NTP_Packet *message, NTP_PacketInfo *info, struct timespec *rx,
-             double root_delay, double root_dispersion)
+                 double root_delay, double root_dispersion)
 {
   struct timespec mono_rx;
-  NTP_ExtFieldExp1 exp1;
+  NTP_EFExpMonoRoot ef;
   NTP_int64 ts_fuzz;
 
-  memset(&exp1, 0, sizeof (exp1));
+  memset(&ef, 0, sizeof (ef));
-  exp1.magic = htonl(NTP_EF_EXP1_MAGIC);
+  ef.magic = htonl(NTP_EF_EXP_MONO_ROOT_MAGIC);
 
   if (info->mode != MODE_CLIENT) {
-    exp1.root_delay = UTI_DoubleToNtp32f28(root_delay);
+    ef.root_delay = UTI_DoubleToNtp32f28(root_delay);
-    exp1.root_dispersion = UTI_DoubleToNtp32f28(root_dispersion);
+    ef.root_dispersion = UTI_DoubleToNtp32f28(root_dispersion);
     if (rx)
       UTI_AddDoubleToTimespec(rx, server_mono_offset, &mono_rx);
     else
       UTI_ZeroTimespec(&mono_rx);
     UTI_GetNtp64Fuzz(&ts_fuzz, message->precision);
-    UTI_TimespecToNtp64(&mono_rx, &exp1.mono_receive_ts, &ts_fuzz);
+    UTI_TimespecToNtp64(&mono_rx, &ef.mono_receive_ts, &ts_fuzz);
-    exp1.mono_epoch = htonl(server_mono_epoch);
+    ef.mono_epoch = htonl(server_mono_epoch);
   }
 
-  if (!NEF_AddField(message, info, NTP_EF_EXP1, &exp1, sizeof (exp1))) {
+  if (!NEF_AddField(message, info, NTP_EF_EXP_MONO_ROOT, &ef, sizeof (ef))) {
     DEBUG_LOG("Could not add EF");
     return 0;
   }
 
-  info->ext_field_flags |= NTP_EF_FLAG_EXP1;
+  info->ext_field_flags |= NTP_EF_FLAG_EXP_MONO_ROOT;
+
+  return 1;
+}
+
+/* ================================================== */
+
+static int
+add_ef_net_correction(NTP_Packet *message, NTP_PacketInfo *info,
+                      NTP_Local_Timestamp *local_rx)
+{
+  NTP_EFExpNetCorrection ef;
+
+  if (CNF_GetPtpPort() == 0) {
+    DEBUG_LOG("ptpport disabled");
+    return 1;
+  }
+
+  memset(&ef, 0, sizeof (ef));
+  ef.magic = htonl(NTP_EF_EXP_NET_CORRECTION_MAGIC);
+
+  if (info->mode != MODE_CLIENT && local_rx->net_correction > local_rx->rx_duration) {
+    UTI_DoubleToNtp64(local_rx->net_correction, &ef.correction);
+  }
+
+  if (!NEF_AddField(message, info, NTP_EF_EXP_NET_CORRECTION, &ef, sizeof (ef))) {
+    DEBUG_LOG("Could not add EF");
+    return 0;
+  }
+
+  info->ext_field_flags |= NTP_EF_FLAG_EXP_NET_CORRECTION;
 
   return 1;
 }
@@ -1221,9 +1262,13 @@ transmit_packet(NTP_Mode my_mode, /* The mode this machine wants to be */
     return 0;
 
   if (ext_field_flags) {
-    if (ext_field_flags & NTP_EF_FLAG_EXP1) {
+    if (ext_field_flags & NTP_EF_FLAG_EXP_MONO_ROOT) {
-      if (!add_ext_exp1(&message, &info, smooth_time ? NULL : &local_receive,
+      if (!add_ef_mono_root(&message, &info, smooth_time ? NULL : &local_receive,
-                        our_root_delay, our_root_dispersion))
+                            our_root_delay, our_root_dispersion))
+        return 0;
+    }
+    if (ext_field_flags & NTP_EF_FLAG_EXP_NET_CORRECTION) {
+      if (!add_ef_net_correction(&message, &info, local_rx))
         return 0;
     }
   }
@@ -1294,6 +1339,8 @@ transmit_packet(NTP_Mode my_mode, /* The mode this machine wants to be */
     local_tx->ts = local_transmit;
     local_tx->err = local_transmit_err;
     local_tx->source = NTP_TS_DAEMON;
+    local_tx->rx_duration = 0.0;
+    local_tx->net_correction = 0.0;
   }
 
   if (local_ntp_rx)
@@ -1487,6 +1534,14 @@ is_zero_data(unsigned char *data, int length)
 
 /* ================================================== */
 
+static int
+is_exp_ef(void *body, int body_length, int expected_body_length, uint32_t magic)
+{
+  return body_length == expected_body_length && *(uint32_t *)body == htonl(magic);
+}
+
+/* ================================================== */
+
 static int
 parse_packet(NTP_Packet *packet, int length, NTP_PacketInfo *info)
 {
@@ -1573,10 +1628,15 @@ parse_packet(NTP_Packet *packet, int length, NTP_PacketInfo *info)
       case NTP_EF_NTS_AUTH_AND_EEF:
         info->auth.mode = NTP_AUTH_NTS;
         break;
-      case NTP_EF_EXP1:
+      case NTP_EF_EXP_MONO_ROOT:
-        if (ef_body_length == sizeof (NTP_ExtFieldExp1) &&
+        if (is_exp_ef(ef_body, ef_body_length, sizeof (NTP_EFExpMonoRoot),
-            ntohl(((NTP_ExtFieldExp1 *)ef_body)->magic) == NTP_EF_EXP1_MAGIC)
+                      NTP_EF_EXP_MONO_ROOT_MAGIC))
-          info->ext_field_flags |= NTP_EF_FLAG_EXP1;
+          info->ext_field_flags |= NTP_EF_FLAG_EXP_MONO_ROOT;
+        break;
+      case NTP_EF_EXP_NET_CORRECTION:
+        if (is_exp_ef(ef_body, ef_body_length, sizeof (NTP_EFExpNetCorrection),
+                      NTP_EF_EXP_NET_CORRECTION_MAGIC))
+          info->ext_field_flags |= NTP_EF_FLAG_EXP_NET_CORRECTION;
         break;
       default:
         DEBUG_LOG("Unknown extension field type=%x", (unsigned int)ef_type);
@@ -1604,6 +1664,53 @@ parse_packet(NTP_Packet *packet, int length, NTP_PacketInfo *info)
 
 /* ================================================== */
 
+static void
+apply_net_correction(NTP_Sample *sample, NTP_Local_Timestamp *rx, NTP_Local_Timestamp *tx,
+                     double precision)
+{
+  double rx_correction, tx_correction, low_delay_correction;
+
+  /* Require some correction from transparent clocks to be present
+     in both directions (not just the local RX timestamp correction) */
+  if (rx->net_correction <= rx->rx_duration || tx->net_correction <= 0.0)
+    return;
+
+  /* With perfect corrections from PTP transparent clocks and short cables
+     the peer delay would be close to zero, or even negative if the server or
+     transparent clocks were running faster than client, which would invert the
+     sample weighting.  Adjust the correction to get a delay corresponding to
+     a direct connection to the server.  For simplicity, assume the TX and RX
+     link speeds are equal.  If not, the reported delay will be wrong, but it
+     will not cause an error in the offset. */
+  rx_correction = rx->net_correction - rx->rx_duration;
+  tx_correction = tx->net_correction - rx->rx_duration;
+
+  /* Use a slightly smaller value in the correction of delay to not overcorrect
+     if the transparent clocks run up to 100 ppm fast and keep a part of the
+     uncorrected delay for the sample weighting */
+  low_delay_correction = (rx_correction + tx_correction) *
+                         (1.0 - MAX_NET_CORRECTION_FREQ);
+
+  /* Make sure the correction is sane.  The values are not authenticated! */
+  if (low_delay_correction < 0.0 || low_delay_correction > sample->peer_delay) {
+    DEBUG_LOG("Invalid correction %.9f peer_delay=%.9f",
+              low_delay_correction, sample->peer_delay);
+    return;
+  }
+
+  /* Correct the offset and peer delay, but not the root delay to not
+     change the estimated maximum error */
+  sample->offset += (rx_correction - tx_correction) / 2.0;
+  sample->peer_delay -= low_delay_correction;
+  if (sample->peer_delay < precision)
+    sample->peer_delay = precision;
+
+  DEBUG_LOG("Applied correction rx=%.9f tx=%.9f dur=%.9f",
+            rx->net_correction, tx->net_correction, rx->rx_duration);
+}
+
+/* ================================================== */
+
 static int
 check_delay_ratio(NCR_Instance inst, SST_Stats stats,
                 struct timespec *sample_time, double delay)
@@ -1865,18 +1972,20 @@ process_response(NCR_Instance inst, int saved, NTP_Local_Address *local_addr,
   /* Extension fields */
   int parsed, ef_length, ef_type, ef_body_length;
   void *ef_body;
-  NTP_ExtFieldExp1 *ef_exp1;
+  NTP_EFExpMonoRoot *ef_mono_root;
+  NTP_EFExpNetCorrection *ef_net_correction;
 
   NTP_Local_Timestamp local_receive, local_transmit;
   double remote_interval, local_interval, response_time;
-  double delay_time, precision, mono_doffset;
+  double delay_time, precision, mono_doffset, net_correction;
   int updated_timestamps;
 
   /* ==================== */
 
   stats = SRC_GetSourcestats(inst->source);
 
-  ef_exp1 = NULL;
+  ef_mono_root = NULL;
+  ef_net_correction = NULL;
 
   /* Find requested non-authentication extension fields */
   if (inst->ext_field_flags & info->ext_field_flags) {
@@ -1886,11 +1995,17 @@ process_response(NCR_Instance inst, int saved, NTP_Local_Address *local_addr,
         break;
 
       switch (ef_type) {
-        case NTP_EF_EXP1:
+        case NTP_EF_EXP_MONO_ROOT:
-          if (inst->ext_field_flags & NTP_EF_FLAG_EXP1 &&
+          if (inst->ext_field_flags & NTP_EF_FLAG_EXP_MONO_ROOT &&
-              ef_body_length == sizeof (*ef_exp1) &&
+              is_exp_ef(ef_body, ef_body_length, sizeof (*ef_mono_root),
-              ntohl(((NTP_ExtFieldExp1 *)ef_body)->magic) == NTP_EF_EXP1_MAGIC)
+                        NTP_EF_EXP_MONO_ROOT_MAGIC))
-            ef_exp1 = ef_body;
+            ef_mono_root = ef_body;
+          break;
+        case NTP_EF_EXP_NET_CORRECTION:
+          if (inst->ext_field_flags & NTP_EF_FLAG_EXP_NET_CORRECTION &&
+              is_exp_ef(ef_body, ef_body_length, sizeof (*ef_net_correction),
+                        NTP_EF_EXP_NET_CORRECTION_MAGIC))
+            ef_net_correction = ef_body;
           break;
       }
     }
@@ -1899,9 +2014,9 @@ process_response(NCR_Instance inst, int saved, NTP_Local_Address *local_addr,
   pkt_leap = NTP_LVM_TO_LEAP(message->lvm);
   pkt_version = NTP_LVM_TO_VERSION(message->lvm);
   pkt_refid = ntohl(message->reference_id);
-  if (ef_exp1) {
+  if (ef_mono_root) {
-    pkt_root_delay = UTI_Ntp32f28ToDouble(ef_exp1->root_delay);
+    pkt_root_delay = UTI_Ntp32f28ToDouble(ef_mono_root->root_delay);
-    pkt_root_dispersion = UTI_Ntp32f28ToDouble(ef_exp1->root_dispersion);
+    pkt_root_dispersion = UTI_Ntp32f28ToDouble(ef_mono_root->root_dispersion);
   } else {
     pkt_root_delay = UTI_Ntp32ToDouble(message->root_delay);
     pkt_root_dispersion = UTI_Ntp32ToDouble(message->root_dispersion);
@@ -1958,7 +2073,7 @@ process_response(NCR_Instance inst, int saved, NTP_Local_Address *local_addr,
      response to the request, when at least one good response has already been
      accepted to avoid incorrectly confirming a tentative source. */
   if (valid_packet && synced_packet && !saved && !inst->valid_rx &&
-      inst->had_hw_tx_timestamp && inst->local_tx.source != NTP_TS_HARDWARE &&
+      NIO_IsHwTsEnabled() && inst->local_tx.source != NTP_TS_HARDWARE &&
       inst->report.total_good_count > 0) {
     if (save_response(inst, local_addr, rx_ts, message, info))
       return 1;
@@ -1986,11 +2101,11 @@ process_response(NCR_Instance inst, int saved, NTP_Local_Address *local_addr,
        the new sample.  In the interleaved mode, cancel the correction out in
        remote timestamps of the previous request and response, which were
        captured before the source accumulated the new time corrections. */
-    if (ef_exp1 && inst->remote_mono_epoch == ntohl(ef_exp1->mono_epoch) &&
+    if (ef_mono_root && inst->remote_mono_epoch == ntohl(ef_mono_root->mono_epoch) &&
-        !UTI_IsZeroNtp64(&ef_exp1->mono_receive_ts) &&
+        !UTI_IsZeroNtp64(&ef_mono_root->mono_receive_ts) &&
         !UTI_IsZeroNtp64(&inst->remote_ntp_monorx)) {
       mono_doffset =
-          UTI_DiffNtp64ToDouble(&ef_exp1->mono_receive_ts, &inst->remote_ntp_monorx) -
+          UTI_DiffNtp64ToDouble(&ef_mono_root->mono_receive_ts, &inst->remote_ntp_monorx) -
           UTI_DiffNtp64ToDouble(&message->receive_ts, &inst->remote_ntp_rx);
       if (fabs(mono_doffset) > MAX_MONO_DOFFSET)
         mono_doffset = 0.0;
@@ -1998,6 +2113,12 @@ process_response(NCR_Instance inst, int saved, NTP_Local_Address *local_addr,
       mono_doffset = 0.0;
     }
 
+    if (ef_net_correction) {
+      net_correction = UTI_Ntp64ToDouble(&ef_net_correction->correction);
+    } else {
+      net_correction = 0.0;
+    }
+
     /* Select remote and local timestamps for the new sample */
     if (interleaved_packet) {
       /* Prefer previous local TX and remote RX timestamps if it will make
@@ -2017,6 +2138,7 @@ process_response(NCR_Instance inst, int saved, NTP_Local_Address *local_addr,
         UTI_Ntp64ToTimespec(&message->receive_ts, &remote_receive);
         UTI_Ntp64ToTimespec(&inst->remote_ntp_rx, &remote_request_receive);
         local_transmit = inst->local_tx;
+        local_transmit.net_correction = net_correction;
         root_delay = MAX(pkt_root_delay, inst->remote_root_delay);
         root_dispersion = MAX(pkt_root_dispersion, inst->remote_root_dispersion);
       }
@@ -2031,6 +2153,7 @@ process_response(NCR_Instance inst, int saved, NTP_Local_Address *local_addr,
       remote_request_receive = remote_receive;
       local_receive = *rx_ts;
       local_transmit = inst->local_tx;
+      local_transmit.net_correction = net_correction;
       root_delay = pkt_root_delay;
       root_dispersion = pkt_root_dispersion;
     }
@@ -2075,6 +2198,9 @@ process_response(NCR_Instance inst, int saved, NTP_Local_Address *local_addr,
     sample.root_delay = root_delay + sample.peer_delay;
     sample.root_dispersion = root_dispersion + sample.peer_dispersion;
 
+    /* Apply corrections from PTP transparent clocks if available and sane */
+    apply_net_correction(&sample, &local_receive, &local_transmit, precision);
+    
     /* If the source is an active peer, this is the minimum assumed interval
        between previous two transmissions (if not constrained by minpoll) */
     prev_remote_poll_interval = UTI_Log2ToDouble(MIN(inst->remote_poll,
@@ -2082,8 +2208,10 @@ process_response(NCR_Instance inst, int saved, NTP_Local_Address *local_addr,
 
     /* Additional tests required to pass before accumulating the sample */
 
-    /* Test A requires that the minimum estimate of the peer delay is not
+    /* Test A combines multiple tests to avoid changing the measurements log
-       larger than the configured maximum, in both client modes that the server
+       format and ntpdata report.  It requires that the minimum estimate of the
+       peer delay is not larger than the configured maximum, it is not a
+       response in the 'warm up' exchange, in both client modes that the server
        processing time is sane, in interleaved client/server mode that the
        previous response was not in basic mode (which prevents using timestamps
        that minimise delay error), and in interleaved symmetric mode that the
@@ -2091,6 +2219,7 @@ process_response(NCR_Instance inst, int saved, NTP_Local_Address *local_addr,
        a missed response */
     testA = sample.peer_delay - sample.peer_dispersion <= inst->max_delay &&
             precision <= inst->max_delay &&
+            inst->presend_done <= 0 &&
             !(inst->mode == MODE_CLIENT && response_time > MAX_SERVER_INTERVAL) &&
             !(inst->mode == MODE_CLIENT && interleaved_packet &&
               UTI_IsZeroTimespec(&inst->prev_local_tx.ts) &&
@@ -2129,6 +2258,7 @@ process_response(NCR_Instance inst, int saved, NTP_Local_Address *local_addr,
     sample.root_delay = sample.root_dispersion = 0.0;
     sample.time = rx_ts->ts;
     mono_doffset = 0.0;
+    net_correction = 0.0;
     local_receive = *rx_ts;
     local_transmit = inst->local_tx;
     testA = testB = testC = testD = 0;
@@ -2162,9 +2292,9 @@ process_response(NCR_Instance inst, int saved, NTP_Local_Address *local_addr,
     /* If available, update the monotonic timestamp and accumulate the offset.
        This needs to be done here to not lose changes in remote_ntp_rx in
        symmetric mode when there are multiple responses per request. */
-    if (ef_exp1 && !UTI_IsZeroNtp64(&ef_exp1->mono_receive_ts)) {
+    if (ef_mono_root && !UTI_IsZeroNtp64(&ef_mono_root->mono_receive_ts)) {
-      inst->remote_mono_epoch = ntohl(ef_exp1->mono_epoch);
+      inst->remote_mono_epoch = ntohl(ef_mono_root->mono_epoch);
-      inst->remote_ntp_monorx = ef_exp1->mono_receive_ts;
+      inst->remote_ntp_monorx = ef_mono_root->mono_receive_ts;
       inst->mono_doffset += mono_doffset;
     } else {
       inst->remote_mono_epoch = 0;
@@ -2172,8 +2302,11 @@ process_response(NCR_Instance inst, int saved, NTP_Local_Address *local_addr,
       inst->mono_doffset = 0.0;
     }
 
-    /* Don't use the same set of timestamps for the next sample */
+    inst->local_tx.net_correction = net_correction;
-    if (interleaved_packet)
+
+    /* Avoid reusing timestamps of an accumulated sample when switching
+       from basic mode to interleaved mode */
+    if (interleaved_packet || !good_packet)
       inst->prev_local_tx = inst->local_tx;
     else
       zero_local_timestamp(&inst->prev_local_tx);
@@ -2192,15 +2325,11 @@ process_response(NCR_Instance inst, int saved, NTP_Local_Address *local_addr,
   /* Accept at most one response per request.  The NTP specification recommends
      resetting local_ntp_tx to make the following packets fail test2 or test3,
      but that would not allow the code above to make multiple updates of the
-     timestamps in symmetric mode.  Also, ignore presend responses. */
+     timestamps in symmetric mode. */
   if (inst->valid_rx) {
     test2 = test3 = 0;
     valid_packet = synced_packet = good_packet = 0;
   } else if (valid_packet) {
-    if (inst->presend_done) {
-      testA = 0;
-      good_packet = 0;
-    }
     inst->valid_rx = 1;
   }
 
@@ -2599,8 +2728,7 @@ NCR_ProcessRxUnknown(NTP_Remote_Address *remote_addr, NTP_Local_Address *local_a
       UTI_CompareNtp64(&message->receive_ts, &message->transmit_ts) != 0) {
     ntp_rx = message->originate_ts;
     local_ntp_rx = &ntp_rx;
-    UTI_ZeroTimespec(&local_tx.ts);
+    zero_local_timestamp(&local_tx);
-    local_tx.source = NTP_TS_DAEMON;
     interleaved = CLG_GetNtpTxTimestamp(&ntp_rx, &local_tx.ts, &local_tx.source);
 
     tx_ts = &local_tx;
@@ -2684,8 +2812,6 @@ NCR_ProcessTxKnown(NCR_Instance inst, NTP_Local_Address *local_addr,
                       message);
 
   if (tx_ts->source == NTP_TS_HARDWARE) {
-    inst->had_hw_tx_timestamp = 1;
-
     if (has_saved_response(inst))
       process_saved_response(inst);
   }
@@ -2894,7 +3020,7 @@ NCR_ModifyMinstratum(NCR_Instance inst, int new_min_stratum)
 void
 NCR_ModifyPolltarget(NCR_Instance inst, int new_poll_target)
 {
-  inst->poll_target = new_poll_target;
+  inst->poll_target = MAX(1, new_poll_target);
   LOG(LOGS_INFO, "Source %s new polltarget %d",
       UTI_IPToString(&inst->remote_addr.ip_addr), new_poll_target);
 }

ntp_core.h

@@ -42,6 +42,8 @@ typedef struct {
   struct timespec ts;
   double err;
   NTP_Timestamp_Source source;
+  double rx_duration;
+  double net_correction;
 } NTP_Local_Timestamp;
 
 /* This is a private data type used for storing the instance record for

ntp_io.c

@@ -278,6 +278,18 @@ NIO_Finalise(void)
 
 /* ================================================== */
 
+int
+NIO_IsHwTsEnabled(void)
+{
+#ifdef HAVE_LINUX_TIMESTAMPING
+  return NIO_Linux_IsHwTsEnabled();
+#else
+  return 0;
+#endif
+}
+
+/* ================================================== */
+
 int
 NIO_OpenClientSocket(NTP_Remote_Address *remote_addr)
 {
@@ -419,6 +431,9 @@ process_message(SCK_Message *message, int sock_fd, int event)
 
   SCH_GetLastEventTime(&local_ts.ts, &local_ts.err, NULL);
   local_ts.source = NTP_TS_DAEMON;
+  local_ts.rx_duration = 0.0;
+  local_ts.net_correction = 0.0;
+
   sched_ts = local_ts.ts;
 
   if (message->addr_type != SCK_ADDR_IP) {
@@ -444,7 +459,7 @@ process_message(SCK_Message *message, int sock_fd, int event)
     DEBUG_LOG("Updated RX timestamp delay=%.9f tss=%u",
               UTI_DiffTimespecsToDouble(&sched_ts, &local_ts.ts), local_ts.source);
 
-  if (!NIO_UnwrapMessage(message, sock_fd))
+  if (!NIO_UnwrapMessage(message, sock_fd, &local_ts.net_correction))
     return;
 
   /* Just ignore the packet if it's not of a recognized length */
@@ -483,8 +498,9 @@ read_from_socket(int sock_fd, int event, void *anything)
 /* ================================================== */
 
 int
-NIO_UnwrapMessage(SCK_Message *message, int sock_fd)
+NIO_UnwrapMessage(SCK_Message *message, int sock_fd, double *net_correction)
 {
+  double ptp_correction;
   PTP_NtpMessage *msg;
 
   if (!is_ptp_socket(sock_fd))
@@ -510,7 +526,14 @@ NIO_UnwrapMessage(SCK_Message *message, int sock_fd)
   message->data = (char *)message->data + PTP_NTP_PREFIX_LENGTH;
   message->length -= PTP_NTP_PREFIX_LENGTH;
 
-  DEBUG_LOG("Unwrapped PTP->NTP len=%d", message->length);
+  ptp_correction = UTI_Integer64NetworkToHost(*(Integer64 *)msg->header.correction) /
+                   ((1 << 16) * 1.0e9);
+
+  /* Use the correction only if the RX duration is known (i.e. HW timestamp) */
+  if (*net_correction > 0.0)
+    *net_correction += ptp_correction;
+
+  DEBUG_LOG("Unwrapped PTP->NTP len=%d corr=%.9f", message->length, ptp_correction);
 
   return 1;
 }

ntp_io.h

@@ -39,6 +39,9 @@ extern void NIO_Initialise(void);
 /* Function to finalise the module */
 extern void NIO_Finalise(void);
 
+/* Function to check if HW timestamping is enabled on any interface */
+extern int NIO_IsHwTsEnabled(void);
+
 /* Function to obtain a socket for sending client packets */
 extern int NIO_OpenClientSocket(NTP_Remote_Address *remote_addr);
 
@@ -61,7 +64,7 @@ extern int NIO_IsServerSocketOpen(void);
 extern int NIO_IsServerConnectable(NTP_Remote_Address *remote_addr);
 
 /* Function to unwrap an NTP message from non-native transport (e.g. PTP) */
-extern int NIO_UnwrapMessage(SCK_Message *message, int sock_fd);
+extern int NIO_UnwrapMessage(SCK_Message *message, int sock_fd, double *net_correction);
 
 /* Function to transmit a packet */
 extern int NIO_SendPacket(NTP_Packet *packet, NTP_Remote_Address *remote_addr,

ntp_io_linux.c

@@ -2,7 +2,7 @@
   chronyd/chronyc - Programs for keeping computer clocks accurate.
 
  **********************************************************************
- * Copyright (C) Miroslav Lichvar  2016-2019, 2021-2022
+ * Copyright (C) Miroslav Lichvar  2016-2019, 2021-2023
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -439,6 +439,14 @@ NIO_Linux_Finalise(void)
 
 /* ================================================== */
 
+int
+NIO_Linux_IsHwTsEnabled(void)
+{
+  return ARR_GetSize(interfaces) > 0;
+}
+
+/* ================================================== */
+
 int
 NIO_Linux_SetTimestampSocketOptions(int sock_fd, int client_only, int *events)
 {
@@ -551,7 +559,7 @@ process_hw_timestamp(struct Interface *iface, struct timespec *hw_ts,
                      NTP_Local_Timestamp *local_ts, int rx_ntp_length, int family,
                      int l2_length)
 {
-  double rx_correction, ts_delay, local_err;
+  double rx_correction = 0.0, ts_delay, local_err;
   struct timespec ts;
 
   poll_phc(iface, &local_ts->ts);
@@ -592,6 +600,10 @@ process_hw_timestamp(struct Interface *iface, struct timespec *hw_ts,
   local_ts->ts = ts;
   local_ts->err = local_err;
   local_ts->source = NTP_TS_HARDWARE;
+  local_ts->rx_duration = rx_correction;
+  /* Network correction needs to include the RX duration to avoid
+     asymmetric correction with asymmetric link speeds */
+  local_ts->net_correction = rx_correction;
 }
 
 /* ================================================== */
@@ -715,6 +727,7 @@ NIO_Linux_ProcessMessage(SCK_Message *message, NTP_Local_Address *local_addr,
 {
   struct Interface *iface;
   int is_tx, ts_if_index, l2_length;
+  double c = 0.0;
 
   is_tx = event == SCH_FILE_EXCEPTION;
   iface = NULL;
@@ -775,7 +788,7 @@ NIO_Linux_ProcessMessage(SCK_Message *message, NTP_Local_Address *local_addr,
     return 1;
   }
 
-  if (!NIO_UnwrapMessage(message, local_addr->sock_fd))
+  if (!NIO_UnwrapMessage(message, local_addr->sock_fd, &c))
     return 1;
 
   if (message->length < NTP_HEADER_LENGTH || message->length > sizeof (NTP_Packet))

ntp_io_linux.h

@@ -33,6 +33,8 @@ extern void NIO_Linux_Initialise(void);
 
 extern void NIO_Linux_Finalise(void);
 
+extern int NIO_Linux_IsHwTsEnabled(void);
+
 extern int NIO_Linux_SetTimestampSocketOptions(int sock_fd, int client_only, int *events);
 
 extern int NIO_Linux_ProcessMessage(SCK_Message *message, NTP_Local_Address *local_addr,

ntp_sources.c

@@ -3,7 +3,7 @@
 
  **********************************************************************
  * Copyright (C) Richard P. Curnow  1997-2003
- * Copyright (C) Miroslav Lichvar  2011-2012, 2014, 2016, 2020-2021
+ * Copyright (C) Miroslav Lichvar  2011-2012, 2014, 2016, 2020-2023
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -32,6 +32,7 @@
 #include "sysincl.h"
 
 #include "array.h"
+#include "conf.h"
 #include "ntp_sources.h"
 #include "ntp_core.h"
 #include "ntp_io.h"
@@ -58,12 +59,15 @@ typedef struct {
   NCR_Instance data;            /* Data for the protocol engine for this source */
   char *name;                   /* Name of the source as it was specified
                                    (may be an IP address) */
+  IPAddr resolved_addr;         /* Address resolved from the name, which can be
+                                   different from remote_addr (e.g. NTS-KE) */
   int pool_id;                  /* ID of the pool from which was this source
                                    added or INVALID_POOL */
   int tentative;                /* Flag indicating there was no valid response
                                    received from the source yet */
   uint32_t conf_id;             /* Configuration ID, which can be shared with
                                    different sources in case of a pool */
+  double last_resolving;        /* Time of last name resolving (monotonic) */
 } SourceRecord;
 
 /* Hash table of SourceRecord, its size is a power of two and it's never
@@ -96,6 +100,9 @@ struct UnresolvedSource {
   char *name;
   /* Flag indicating addresses should be used in a random order */
   int random_order;
+  /* Flag indicating current address should be replaced only if it is
+     no longer returned by the resolver */
+  int refreshment;
   /* Next unresolved source in the list */
   struct UnresolvedSource *next;
 };
@@ -103,7 +110,7 @@ struct UnresolvedSource {
 #define RESOLVE_INTERVAL_UNIT 7
 #define MIN_RESOLVE_INTERVAL 2
 #define MAX_RESOLVE_INTERVAL 9
-#define MIN_REPLACEMENT_INTERVAL 8
+#define MAX_REPLACEMENT_INTERVAL 9
 
 static struct UnresolvedSource *unresolved_sources = NULL;
 static int resolving_interval = 0;
@@ -184,6 +191,7 @@ void
 NSR_Initialise(void)
 {
   n_sources = 0;
+  resolving_id = 0;
   initialised = 1;
 
   records = ARR_CreateInstance(sizeof (SourceRecord));
@@ -206,6 +214,7 @@ NSR_Finalise(void)
   ARR_DestroyInstance(records);
   ARR_DestroyInstance(pools);
 
+  SCH_RemoveTimeout(resolving_id);
   while (unresolved_sources)
     remove_unresolved_source(unresolved_sources);
 
@@ -381,9 +390,11 @@ add_source(NTP_Remote_Address *remote_addr, char *name, NTP_Source_Type type,
       record->name = Strdup(name ? name : UTI_IPToString(&remote_addr->ip_addr));
       record->data = NCR_CreateInstance(remote_addr, type, params, record->name);
       record->remote_addr = NCR_GetRemoteAddress(record->data);
+      record->resolved_addr = remote_addr->ip_addr;
       record->pool_id = pool_id;
       record->tentative = 1;
       record->conf_id = conf_id;
+      record->last_resolving = SCH_GetLastEventMonoTime();
 
       record_lock = 0;
 
@@ -432,6 +443,8 @@ change_source_address(NTP_Remote_Address *old_addr, NTP_Remote_Address *new_addr
 
   record = get_record(slot1);
   NCR_ChangeRemoteAddress(record->data, new_addr, !replacement);
+  if (replacement)
+    record->resolved_addr = new_addr->ip_addr;
 
   if (record->remote_addr != NCR_GetRemoteAddress(record->data) ||
       UTI_CompareIPs(&record->remote_addr->ip_addr, &new_addr->ip_addr, NULL) != 0)
@@ -515,7 +528,21 @@ process_resolved_name(struct UnresolvedSource *us, IPAddr *ip_addrs, int n_addrs
   NTP_Remote_Address old_addr, new_addr;
   SourceRecord *record;
   unsigned short first = 0;
-  int i, j;
+  int i, j, slot;
+
+  /* Keep using the current address if it is being refreshed and it is
+     still included in the resolved addresses */
+  if (us->refreshment) {
+    assert(us->pool_id == INVALID_POOL);
+
+    for (i = 0; i < n_addrs; i++) {
+      if (find_slot2(&us->address, &slot) == 2 &&
+          UTI_CompareIPs(&get_record(slot)->resolved_addr, &ip_addrs[i], NULL) == 0) {
+        DEBUG_LOG("%s still fresh", UTI_IPToString(&us->address.ip_addr));
+        return;
+      }
+    }
+  }
 
   if (us->random_order)
     UTI_GetRandomBytes(&first, sizeof (first));
@@ -773,6 +800,7 @@ NSR_AddSourceByName(char *name, int port, int pool, NTP_Source_Type type,
   us = MallocNew(struct UnresolvedSource);
   us->name = Strdup(name);
   us->random_order = 0;
+  us->refreshment = 0;
 
   remote_addr.ip_addr.family = IPADDR_ID;
   remote_addr.ip_addr.addr.id = ++last_address_id;
@@ -816,6 +844,31 @@ NSR_AddSourceByName(char *name, int port, int pool, NTP_Source_Type type,
 
 /* ================================================== */
 
+const char *
+NSR_StatusToString(NSR_Status status)
+{
+  switch (status) {
+    case NSR_Success:
+      return "Success";
+    case NSR_NoSuchSource:
+      return "No such source";
+    case NSR_AlreadyInUse:
+      return "Already in use";
+    case NSR_TooManySources:
+      return "Too many sources";
+    case NSR_InvalidAF:
+      return "Invalid address";
+    case NSR_InvalidName:
+      return "Invalid name";
+    case NSR_UnresolvedName:
+      return "Unresolved name";
+    default:
+      return "?";
+  }
+}
+
+/* ================================================== */
+
 void
 NSR_SetSourceResolvingEndHandler(NSR_SourceResolvingEndHandler handler)
 {
@@ -962,20 +1015,23 @@ NSR_RemoveAllSources(void)
 /* ================================================== */
 
 static void
-resolve_source_replacement(SourceRecord *record)
+resolve_source_replacement(SourceRecord *record, int refreshment)
 {
   struct UnresolvedSource *us;
 
-  DEBUG_LOG("trying to replace %s (%s)",
+  DEBUG_LOG("%s %s (%s)", refreshment ? "refreshing" : "trying to replace",
             UTI_IPToString(&record->remote_addr->ip_addr), record->name);
 
+  record->last_resolving = SCH_GetLastEventMonoTime();
+
   us = MallocNew(struct UnresolvedSource);
   us->name = Strdup(record->name);
-  /* If there never was a valid reply from this source (e.g. it was a bad
+  /* Ignore the order of addresses from the resolver to not get
-     replacement), ignore the order of addresses from the resolver to not get
+     stuck with a pair of unreachable or otherwise unusable servers
-     stuck to a pair of addresses if the order doesn't change, or a group of
+     (e.g. falsetickers) in case the order doesn't change, or a group
-     IPv4/IPv6 addresses if the resolver prefers inaccessible IP family */
+     of servers if they are ordered by IP family */
-  us->random_order = record->tentative;
+  us->random_order = 1;
+  us->refreshment = refreshment;
   us->pool_id = INVALID_POOL;
   us->address = *record->remote_addr;
 
@@ -988,11 +1044,11 @@ resolve_source_replacement(SourceRecord *record)
 void
 NSR_HandleBadSource(IPAddr *address)
 {
-  static struct timespec last_replacement;
+  static double next_replacement = 0.0;
-  struct timespec now;
   SourceRecord *record;
   IPAddr ip_addr;
-  double diff;
+  uint32_t rnd;
+  double now;
   int slot;
 
   if (!find_slot(address, &slot))
@@ -1007,15 +1063,56 @@ NSR_HandleBadSource(IPAddr *address)
     return;
 
   /* Don't resolve names too frequently */
-  SCH_GetLastEventTime(NULL, NULL, &now);
+  now = SCH_GetLastEventMonoTime();
-  diff = UTI_DiffTimespecsToDouble(&now, &last_replacement);
+  if (now < next_replacement) {
-  if (fabs(diff) < RESOLVE_INTERVAL_UNIT * (1 << MIN_REPLACEMENT_INTERVAL)) {
     DEBUG_LOG("replacement postponed");
     return;
   }
-  last_replacement = now;
 
-  resolve_source_replacement(record);
+  UTI_GetRandomBytes(&rnd, sizeof (rnd));
+  next_replacement = now + ((double)rnd / (uint32_t)-1) *
+                     (RESOLVE_INTERVAL_UNIT * (1 << MAX_REPLACEMENT_INTERVAL));
+
+  resolve_source_replacement(record, 0);
+}
+
+/* ================================================== */
+
+static void
+maybe_refresh_source(void)
+{
+  static double last_refreshment = 0.0;
+  SourceRecord *record, *oldest_record;
+  int i, min_interval;
+  double now;
+
+  min_interval = CNF_GetRefresh();
+
+  now = SCH_GetLastEventMonoTime();
+  if (min_interval <= 0 || now < last_refreshment + min_interval)
+    return;
+
+  last_refreshment = now;
+
+  for (i = 0, oldest_record = NULL; i < ARR_GetSize(records); i++) {
+    record = get_record(i);
+    if (!record->remote_addr || UTI_IsStringIP(record->name))
+      continue;
+
+    if (!oldest_record || oldest_record->last_resolving > record->last_resolving)
+      oldest_record = record;
+  }
+
+  if (!oldest_record)
+    return;
+
+  /* Check if the name wasn't already resolved in the last interval */
+  if (now < oldest_record->last_resolving + min_interval) {
+    last_refreshment = oldest_record->last_resolving;
+    return;
+  }
+
+  resolve_source_replacement(oldest_record, 1);
 }
 
 /* ================================================== */
@@ -1031,7 +1128,7 @@ NSR_RefreshAddresses(void)
     if (!record->remote_addr)
       continue;
 
-    resolve_source_replacement(record);
+    resolve_source_replacement(record, 1);
   }
 }
 
@@ -1157,6 +1254,8 @@ NSR_ProcessRx(NTP_Remote_Address *remote_addr, NTP_Local_Address *local_addr,
           remove_pool_sources(record->pool_id, 1, 0);
       }
     }
+
+    maybe_refresh_source();
   } else {
     NCR_ProcessRxUnknown(remote_addr, local_addr, rx_ts, message, length);
   }

ntp_sources.h

@@ -60,6 +60,8 @@ extern NSR_Status NSR_AddSource(NTP_Remote_Address *remote_addr, NTP_Source_Type
 extern NSR_Status NSR_AddSourceByName(char *name, int port, int pool, NTP_Source_Type type,
                                       SourceParameters *params, uint32_t *conf_id);
 
+extern const char *NSR_StatusToString(NSR_Status status);
+
 /* Function type for handlers to be called back when an attempt
  * (possibly unsuccessful) to resolve unresolved sources ends */
 typedef void (*NSR_SourceResolvingEndHandler)(void);

nts_ke_server.c

@@ -2,7 +2,7 @@
   chronyd/chronyc - Programs for keeping computer clocks accurate.
 
  **********************************************************************
- * Copyright (C) Miroslav Lichvar  2020
+ * Copyright (C) Miroslav Lichvar  2020, 2022
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -448,7 +448,7 @@ process_request(NKSN_Instance session)
           aead_algorithm_values++;
           /* Use the first supported algorithm */
           if (aead_algorithm < 0 && SIV_GetKeyLength(ntohs(data[i])) > 0)
-            aead_algorithm = ntohs(data[i]);;
+            aead_algorithm = ntohs(data[i]);
         }
         break;
       case NKE_RECORD_ERROR:
@@ -512,6 +512,7 @@ generate_key(int index)
     assert(0);
 
   UTI_GetRandomBytesUrandom(key->key, key_length);
+  memset(key->key + key_length, 0, sizeof (key->key) - key_length);
   UTI_GetRandomBytes(&key->id, sizeof (key->id));
 
   /* Encode the index in the lowest bits of the ID */
@@ -628,6 +629,7 @@ load_keys(void)
         key_length <= 0 ||
         UTI_HexToBytes(words[1], new_keys[i].key, sizeof (new_keys[i].key)) != key_length)
       goto error;
+    memset(new_keys[i].key + key_length, 0, sizeof (new_keys[i].key) - key_length);
   }
 
   if (i < MAX_SERVER_KEYS)
@@ -649,7 +651,7 @@ load_keys(void)
 
   fclose(f);
 
-  LOG(LOGS_ERR, "Loaded %s", "server NTS keys");
+  LOG(LOGS_INFO, "Loaded %s", "server NTS keys");
   return 1;
 
 error:
@@ -683,6 +685,8 @@ run_helper(uid_t uid, gid_t gid, int scfilter_level)
 
   DEBUG_LOG("Helper started");
 
+  SCK_CloseReusableSockets();
+
   /* Suppress a log message about disabled clock control */
   log_severity = LOG_GetMinSeverity();
   LOG_SetMinSeverity(LOGS_ERR);

nts_ntp_client.c

@@ -650,6 +650,7 @@ load_cookies(NNC_Instance inst)
                                             sizeof (inst->context.c2s.key));
 
   if (inst->context.s2c.length != SIV_GetKeyLength(algorithm) ||
+      inst->context.s2c.length <= 0 ||
       inst->context.c2s.length != inst->context.s2c.length)
     goto error;
 

nts_ntp_server.c

@@ -2,7 +2,7 @@
   chronyd/chronyc - Programs for keeping computer clocks accurate.
 
  **********************************************************************
- * Copyright (C) Miroslav Lichvar  2020
+ * Copyright (C) Miroslav Lichvar  2020, 2022
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as

refclock_phc.c

@@ -2,7 +2,7 @@
   chronyd/chronyc - Programs for keeping computer clocks accurate.
 
  **********************************************************************
- * Copyright (C) Miroslav Lichvar  2013, 2017
+ * Copyright (C) Miroslav Lichvar  2013, 2017, 2023
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as

sched.c

@@ -163,6 +163,8 @@ SCH_Finalise(void) {
 
   ARR_DestroyInstance(file_handlers);
 
+  timer_queue.next = &timer_queue;
+  timer_queue.prev = &timer_queue;
   for (i = 0; i < ARR_GetSize(tqe_blocks); i++)
     Free(*(TimerQueueEntry **)ARR_GetElement(tqe_blocks, i));
   ARR_DestroyInstance(tqe_blocks);

siv_gnutls.c

@@ -2,7 +2,7 @@
   chronyd/chronyc - Programs for keeping computer clocks accurate.
 
  **********************************************************************
- * Copyright (C) Miroslav Lichvar  2020
+ * Copyright (C) Miroslav Lichvar  2020, 2023
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -37,6 +37,8 @@
 struct SIV_Instance_Record {
   gnutls_cipher_algorithm_t algorithm;
   gnutls_aead_cipher_hd_t cipher;
+  int min_nonce_length;
+  int max_nonce_length;
 };
 
 /* ================================================== */
@@ -81,6 +83,10 @@ get_cipher_algorithm(SIV_Algorithm algorithm)
   switch (algorithm) {
     case AEAD_AES_SIV_CMAC_256:
       return GNUTLS_CIPHER_AES_128_SIV;
+#if HAVE_GNUTLS_SIV_GCM
+    case AEAD_AES_128_GCM_SIV:
+      return GNUTLS_CIPHER_AES_128_SIV_GCM;
+#endif
     default:
       return 0;
   }
@@ -112,6 +118,19 @@ SIV_CreateInstance(SIV_Algorithm algorithm)
   instance->algorithm = calgo;
   instance->cipher = NULL;
 
+  switch (algorithm) {
+    case AEAD_AES_SIV_CMAC_256:
+      instance->min_nonce_length = 1;
+      instance->max_nonce_length = INT_MAX;
+      break;
+    case AEAD_AES_128_GCM_SIV:
+      instance->min_nonce_length = 12;
+      instance->max_nonce_length = 12;
+      break;
+    default:
+      assert(0);
+  }
+
   instance_counter++;
 
   return instance;
@@ -143,6 +162,8 @@ SIV_GetKeyLength(SIV_Algorithm algorithm)
     return 0;
 
   len = gnutls_cipher_get_key_size(calgo);
+  if (len == 0)
+    return 0;
 
   if (len < 1 || len > SIV_MAX_KEY_LENGTH)
     LOG_FATAL("Invalid key length");
@@ -198,7 +219,7 @@ SIV_SetKey(SIV_Instance instance, const unsigned char *key, int length)
 int
 SIV_GetMinNonceLength(SIV_Instance instance)
 {
-  return 1;
+  return instance->min_nonce_length;
 }
 
 /* ================================================== */
@@ -206,7 +227,7 @@ SIV_GetMinNonceLength(SIV_Instance instance)
 int
 SIV_GetMaxNonceLength(SIV_Instance instance)
 {
-  return INT_MAX;
+  return instance->max_nonce_length;
 }
 
 /* ================================================== */
@@ -238,7 +259,8 @@ SIV_Encrypt(SIV_Instance instance,
   if (!instance->cipher)
     return 0;
 
-  if (nonce_length < 1 || assoc_length < 0 ||
+  if (nonce_length < instance->min_nonce_length ||
+      nonce_length > instance->max_nonce_length || assoc_length < 0 ||
       plaintext_length < 0 || ciphertext_length < 0)
     return 0;
 
@@ -269,7 +291,8 @@ SIV_Decrypt(SIV_Instance instance,
   if (!instance->cipher)
     return 0;
 
-  if (nonce_length < 1 || assoc_length < 0 ||
+  if (nonce_length < instance->min_nonce_length ||
+      nonce_length > instance->max_nonce_length || assoc_length < 0 ||
       plaintext_length < 0 || ciphertext_length < 0)
     return 0;
 

siv_nettle.c

@@ -2,7 +2,7 @@
   chronyd/chronyc - Programs for keeping computer clocks accurate.
 
  **********************************************************************
- * Copyright (C) Miroslav Lichvar  2019
+ * Copyright (C) Miroslav Lichvar  2019, 2022
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as

socket.c

@@ -5,6 +5,7 @@
  * Copyright (C) Richard P. Curnow  1997-2003
  * Copyright (C) Timo Teras  2009
  * Copyright (C) Miroslav Lichvar  2009, 2013-2020
+ * Copyright (C) Luke Valenta  2023
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -89,6 +90,9 @@ struct MessageHeader {
 
 static int initialised;
 
+static int first_reusable_fd;
+static int reusable_fds;
+
 /* Flags indicating in which IP families sockets can be requested */
 static int ip4_enabled;
 static int ip6_enabled;
@@ -155,6 +159,59 @@ domain_to_string(int domain)
 
 /* ================================================== */
 
+static int
+get_reusable_socket(int type, IPSockAddr *spec)
+{
+#ifdef LINUX
+  union sockaddr_all sa;
+  IPSockAddr ip_sa;
+  int sock_fd, opt;
+  socklen_t l;
+
+  /* Abort early if not an IPv4/IPv6 server socket */
+  if (!spec || spec->ip_addr.family == IPADDR_UNSPEC || spec->port == 0)
+    return INVALID_SOCK_FD;
+
+  /* Loop over available reusable sockets */
+  for (sock_fd = first_reusable_fd; sock_fd < first_reusable_fd + reusable_fds; sock_fd++) {
+
+    /* Check that types match */
+    l = sizeof (opt);
+    if (getsockopt(sock_fd, SOL_SOCKET, SO_TYPE, &opt, &l) < 0 ||
+        l != sizeof (opt) || opt != type)
+      continue;
+
+    /* Get sockaddr for reusable socket */
+    l = sizeof (sa);
+    if (getsockname(sock_fd, &sa.sa, &l) < 0 || l < sizeof (sa_family_t))
+      continue;
+    SCK_SockaddrToIPSockAddr(&sa.sa, l, &ip_sa);
+
+    /* Check that reusable socket matches specification */
+    if (ip_sa.port != spec->port || UTI_CompareIPs(&ip_sa.ip_addr, &spec->ip_addr, NULL) != 0)
+      continue;
+
+    /* Check that STREAM socket is listening */
+    l = sizeof (opt);
+    if (type == SOCK_STREAM && (getsockopt(sock_fd, SOL_SOCKET, SO_ACCEPTCONN, &opt, &l) < 0 ||
+                                l != sizeof (opt) || opt == 0))
+      continue;
+
+#if defined(FEAT_IPV6) && defined(IPV6_V6ONLY)
+    if (spec->ip_addr.family == IPADDR_INET6 &&
+        (!SCK_GetIntOption(sock_fd, IPPROTO_IPV6, IPV6_V6ONLY, &opt) || opt != 1))
+      LOG(LOGS_WARN, "Reusable IPv6 socket missing IPV6_V6ONLY option");
+#endif
+
+    return sock_fd;
+  }
+#endif
+
+  return INVALID_SOCK_FD;
+}
+
+/* ================================================== */
+
 #if defined(SOCK_CLOEXEC) || defined(SOCK_NONBLOCK)
 static int
 check_socket_flag(int sock_flag, int fd_flag, int fs_flag)
@@ -212,7 +269,7 @@ static int
 set_socket_flags(int sock_fd, int flags)
 {
   /* Close the socket automatically on exec */
-  if (
+  if (!SCK_IsReusable(sock_fd) &&
 #ifdef SOCK_CLOEXEC
       (supported_socket_flags & SOCK_CLOEXEC) == 0 &&
 #endif
@@ -222,7 +279,7 @@ set_socket_flags(int sock_fd, int flags)
   /* Enable non-blocking mode */
   if ((flags & SCK_FLAG_BLOCK) == 0 &&
 #ifdef SOCK_NONBLOCK
-      (supported_socket_flags & SOCK_NONBLOCK) == 0 &&
+      (SCK_IsReusable(sock_fd) || (supported_socket_flags & SOCK_NONBLOCK) == 0) &&
 #endif
       !set_socket_nonblock(sock_fd))
     return 0;
@@ -279,6 +336,32 @@ open_socket_pair(int domain, int type, int flags, int *other_fd)
 
 /* ================================================== */
 
+static int
+get_ip_socket(int domain, int type, int flags, IPSockAddr *ip_sa)
+{
+  int sock_fd;
+
+  /* Check if there is a matching reusable socket */
+  sock_fd = get_reusable_socket(type, ip_sa);
+
+  if (sock_fd < 0) {
+    sock_fd = open_socket(domain, type, flags);
+
+    /* Unexpected, but make sure the new socket is not in the reusable range */
+    if (SCK_IsReusable(sock_fd))
+      LOG_FATAL("Could not open %s socket : file descriptor in reusable range",
+                domain_to_string(domain));
+  } else {
+    /* Set socket flags on reusable socket */
+    if (!set_socket_flags(sock_fd, flags))
+      return INVALID_SOCK_FD;
+  }
+
+  return sock_fd;
+}
+
+/* ================================================== */
+
 static int
 set_socket_options(int sock_fd, int flags)
 {
@@ -295,8 +378,10 @@ static int
 set_ip_options(int sock_fd, int family, int flags)
 {
 #if defined(FEAT_IPV6) && defined(IPV6_V6ONLY)
-  /* Receive only IPv6 packets on an IPv6 socket */
+  /* Receive only IPv6 packets on an IPv6 socket, but do not attempt
-  if (family == IPADDR_INET6 && !SCK_SetIntOption(sock_fd, IPPROTO_IPV6, IPV6_V6ONLY, 1))
+     to set this option on pre-initialised reuseable sockets */
+  if (family == IPADDR_INET6 && !SCK_IsReusable(sock_fd) &&
+      !SCK_SetIntOption(sock_fd, IPPROTO_IPV6, IPV6_V6ONLY, 1))
     return 0;
 #endif
 
@@ -385,6 +470,10 @@ bind_ip_address(int sock_fd, IPSockAddr *addr, int flags)
     ;
 #endif
 
+  /* Do not attempt to bind pre-initialised reusable socket */
+  if (SCK_IsReusable(sock_fd))
+    return 1;
+
   saddr_len = SCK_IPSockAddrToSockaddr(addr, (struct sockaddr *)&saddr, sizeof (saddr));
   if (saddr_len == 0)
     return 0;
@@ -457,7 +546,7 @@ open_ip_socket(IPSockAddr *remote_addr, IPSockAddr *local_addr, const char *ifac
       return INVALID_SOCK_FD;
   }
 
-  sock_fd = open_socket(domain, type, flags);
+  sock_fd = get_ip_socket(domain, type, flags, local_addr);
   if (sock_fd < 0)
     return INVALID_SOCK_FD;
 
@@ -482,7 +571,8 @@ open_ip_socket(IPSockAddr *remote_addr, IPSockAddr *local_addr, const char *ifac
     goto error;
 
   if (remote_addr || local_addr)
-    DEBUG_LOG("Opened %s%s socket fd=%d%s%s%s%s",
+    DEBUG_LOG("%s %s%s socket fd=%d%s%s%s%s",
+              SCK_IsReusable(sock_fd) ? "Reusing" : "Opened",
               type == SOCK_DGRAM ? "UDP" : type == SOCK_STREAM ? "TCP" : "?",
               family == IPADDR_INET4 ? "v4" : "v6",
               sock_fd,
@@ -869,6 +959,11 @@ process_header(struct msghdr *msg, int msg_length, int sock_fd, int flags,
       memcpy(&message->timestamp.kernel, CMSG_DATA(cmsg), sizeof (message->timestamp.kernel));
     }
 #endif
+#ifdef SCM_REALTIME
+    else if (match_cmsg(cmsg, SOL_SOCKET, SCM_REALTIME, sizeof (message->timestamp.kernel))) {
+      memcpy(&message->timestamp.kernel, CMSG_DATA(cmsg), sizeof (message->timestamp.kernel));
+    }
+#endif
 #ifdef HAVE_LINUX_TIMESTAMPING
 #ifdef HAVE_LINUX_TIMESTAMPING_OPT_PKTINFO
     else if (match_cmsg(cmsg, SOL_SOCKET, SCM_TIMESTAMPING_PKTINFO,
@@ -1165,9 +1260,44 @@ send_message(int sock_fd, SCK_Message *message, int flags)
 
 /* ================================================== */
 
+void
+SCK_PreInitialise(void)
+{
+#ifdef LINUX
+  char *s, *ptr;
+
+  /* On Linux systems, the systemd service manager may pass file descriptors
+     for pre-initialised sockets to the chronyd daemon.  The service manager
+     allocates and binds the file descriptors, and passes a copy to each
+     spawned instance of the service.  This allows for zero-downtime service
+     restarts as the sockets buffer client requests until the service is able
+     to handle them.  The service manager sets the LISTEN_FDS environment
+     variable to the number of passed file descriptors, and the integer file
+     descriptors start at 3 (see SD_LISTEN_FDS_START in
+     https://www.freedesktop.org/software/systemd/man/latest/sd_listen_fds.html). */
+  first_reusable_fd = 3;
+  reusable_fds = 0;
+
+  s = getenv("LISTEN_FDS");
+  if (s) {
+    errno = 0;
+    reusable_fds = strtol(s, &ptr, 10);
+    if (errno != 0 || *ptr != '\0' || reusable_fds < 0)
+      reusable_fds = 0;
+  }
+#else
+  first_reusable_fd = 0;
+  reusable_fds = 0;
+#endif
+}
+
+/* ================================================== */
+
 void
 SCK_Initialise(int family)
 {
+  int fd;
+
   ip4_enabled = family == IPADDR_INET4 || family == IPADDR_UNSPEC;
 #ifdef FEAT_IPV6
   ip6_enabled = family == IPADDR_INET6 || family == IPADDR_UNSPEC;
@@ -1196,6 +1326,9 @@ SCK_Initialise(int family)
     supported_socket_flags |= SOCK_NONBLOCK;
 #endif
 
+  for (fd = first_reusable_fd; fd < first_reusable_fd + reusable_fds; fd++)
+    UTI_FdSetCloexec(fd);
+
   initialised = 1;
 }
 
@@ -1208,6 +1341,8 @@ SCK_Finalise(void)
   ARR_DestroyInstance(recv_headers);
   ARR_DestroyInstance(recv_messages);
 
+  SCK_CloseReusableSockets();
+
   initialised = 0;
 }
 
@@ -1348,6 +1483,27 @@ SCK_OpenUnixSocketPair(int flags, int *other_fd)
 
 /* ================================================== */
 
+int
+SCK_IsReusable(int fd)
+{
+  return fd >= first_reusable_fd && fd < first_reusable_fd + reusable_fds;
+}
+
+/* ================================================== */
+
+void
+SCK_CloseReusableSockets(void)
+{
+  int fd;
+
+  for (fd = first_reusable_fd; fd < first_reusable_fd + reusable_fds; fd++)
+    close(fd);
+  reusable_fds = 0;
+  first_reusable_fd = 0;
+}
+
+/* ================================================== */
+
 int
 SCK_SetIntOption(int sock_fd, int level, int name, int value)
 {
@@ -1386,8 +1542,15 @@ SCK_EnableKernelRxTimestamping(int sock_fd)
     return 1;
 #endif
 #ifdef SO_TIMESTAMP
-  if (SCK_SetIntOption(sock_fd, SOL_SOCKET, SO_TIMESTAMP, 1))
+  if (SCK_SetIntOption(sock_fd, SOL_SOCKET, SO_TIMESTAMP, 1)) {
+#if defined(SO_TS_CLOCK) && defined(SO_TS_REALTIME)
+    /* We don't care about the return value - we'll get either a
+       SCM_REALTIME (if we succeded) or a SCM_TIMESTAMP (if we failed) */
+    if (!SCK_SetIntOption(sock_fd, SOL_SOCKET, SO_TS_CLOCK, SO_TS_REALTIME))
+      ;
+#endif
     return 1;
+  }
 #endif
 
   return 0;
@@ -1398,7 +1561,7 @@ SCK_EnableKernelRxTimestamping(int sock_fd)
 int
 SCK_ListenOnSocket(int sock_fd, int backlog)
 {
-  if (listen(sock_fd, backlog) < 0) {
+  if (!SCK_IsReusable(sock_fd) && listen(sock_fd, backlog) < 0) {
     DEBUG_LOG("listen() failed : %s", strerror(errno));
     return 0;
   }
@@ -1561,6 +1724,10 @@ SCK_RemoveSocket(int sock_fd)
 void
 SCK_CloseSocket(int sock_fd)
 {
+  /* Reusable sockets are closed in finalisation */
+  if (SCK_IsReusable(sock_fd))
+    return;
+
   close(sock_fd);
 }
 

socket.h

@@ -73,6 +73,9 @@ typedef struct {
   int descriptor;
 } SCK_Message;
 
+/* Pre-initialisation function */
+extern void SCK_PreInitialise(void);
+
 /* Initialisation function (the specified IP family is enabled,
    or all if IPADDR_UNSPEC) */
 extern void SCK_Initialise(int family);
@@ -106,6 +109,12 @@ extern int SCK_OpenUnixStreamSocket(const char *remote_addr, const char *local_a
                                     int flags);
 extern int SCK_OpenUnixSocketPair(int flags, int *other_fd);
 
+/* Check if a file descriptor was passed from the service manager */
+extern int SCK_IsReusable(int sock_fd);
+
+/* Close all reusable sockets before finalisation (e.g. in a helper process) */
+extern void SCK_CloseReusableSockets(void);
+
 /* Set and get a socket option of int size */
 extern int SCK_SetIntOption(int sock_fd, int level, int name, int value);
 extern int SCK_GetIntOption(int sock_fd, int level, int name, int *value);

sources.c

@@ -3,7 +3,7 @@
 
  **********************************************************************
  * Copyright (C) Richard P. Curnow  1997-2003
- * Copyright (C) Miroslav Lichvar  2011-2016, 2018, 2020-2021
+ * Copyright (C) Miroslav Lichvar  2011-2016, 2018, 2020-2023
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -112,6 +112,9 @@ struct SRC_Instance_Record {
   /* Updates left before allowing combining */
   int distant;
 
+  /* Updates with a status requiring source replacement */
+  int bad;
+
   /* Flag indicating the status of the source */
   SRC_Status status;
 
@@ -171,6 +174,9 @@ static int selected_source_index; /* Which source index is currently
                                      if no current valid reference) */
 static int reported_no_majority;  /* Flag to avoid repeated log message
                                      about no majority */
+static int report_selection_loss; /* Flag to force logging a message if
+                                     selection is lost in a transient state
+                                     (SRC_WAITS_STATS, SRC_WAITS_UPDATE) */
 
 /* Score needed to replace the currently selected source */
 #define SCORE_LIMIT 10.0
@@ -178,12 +184,17 @@ static int reported_no_majority;  /* Flag to avoid repeated log message
 /* Number of updates needed to reset the distant status */
 #define DISTANT_PENALTY 32
 
+/* Number of updates needed to trigger handling of bad sources */
+#define BAD_HANDLE_THRESHOLD 4
+
 static double max_distance;
 static double max_jitter;
 static double reselect_distance;
 static double stratum_weight;
 static double combine_limit;
 
+static SRC_Instance last_updated_inst;
+
 static LOG_FileID logfileid;
 
 /* Identifier of the dump file */
@@ -193,6 +204,8 @@ static LOG_FileID logfileid;
 /* Forward prototype */
 
 static void update_sel_options(void);
+static void unselect_selected_source(LOG_Severity severity, const char *format,
+                                     const char *arg);
 static void slew_sources(struct timespec *raw, struct timespec *cooked, double dfreq,
                          double doffset, LCL_ChangeType change_type, void *anything);
 static void add_dispersion(double dispersion, void *anything);
@@ -218,6 +231,8 @@ void SRC_Initialise(void) {
   LCL_AddParameterChangeHandler(slew_sources, NULL);
   LCL_AddDispersionNotifyHandler(add_dispersion, NULL);
 
+  last_updated_inst = NULL;
+
   logfileid = CNF_GetLogSelection() ? LOG_FileOpen("selection",
               "   Date (UTC) Time     IP Address   S EOpts Reach Score Last sample  Low end   High end")
               : -1;
@@ -301,6 +316,9 @@ void SRC_DestroyInstance(SRC_Instance instance)
 {
   int dead_index, i;
 
+  if (last_updated_inst == instance)
+    last_updated_inst = NULL;
+
   assert(initialised);
   if (instance->index < 0 || instance->index >= n_sources ||
       instance != sources[instance->index])
@@ -317,11 +335,12 @@ void SRC_DestroyInstance(SRC_Instance instance)
 
   update_sel_options();
 
-  /* If this was the previous reference source, we have to reselect! */
+  if (selected_source_index > dead_index)
-  if (selected_source_index == dead_index)
-    SRC_ReselectSource();
-  else if (selected_source_index > dead_index)
     --selected_source_index;
+  else if (selected_source_index == dead_index)
+    unselect_selected_source(LOGS_INFO, NULL, NULL);
+
+  SRC_SelectSource(NULL);
 }
 
 /* ================================================== */
@@ -333,6 +352,7 @@ SRC_ResetInstance(SRC_Instance instance)
   instance->reachability = 0;
   instance->reachability_size = 0;
   instance->distant = 0;
+  instance->bad = 0;
   instance->status = SRC_BAD_STATS;
   instance->sel_score = 1.0;
   instance->stratum = 0;
@@ -343,6 +363,9 @@ SRC_ResetInstance(SRC_Instance instance)
   memset(&instance->sel_info, 0, sizeof (instance->sel_info));
 
   SST_ResetInstance(instance->stats);
+
+  if (selected_source_index == instance->index)
+    SRC_SelectSource(NULL);
 }
 
 /* ================================================== */
@@ -478,6 +501,19 @@ special_mode_end(void)
     return 1;
 }
 
+/* ================================================== */
+
+static void
+handle_bad_source(SRC_Instance inst)
+{
+  if (inst->type == SRC_NTP) {
+    DEBUG_LOG("Bad source status=%c", get_status_char(inst->status));
+    NSR_HandleBadSource(inst->ip_addr);
+  }
+}
+
+/* ================================================== */
+
 void
 SRC_UpdateReachability(SRC_Instance inst, int reachable)
 {
@@ -498,14 +534,9 @@ SRC_UpdateReachability(SRC_Instance inst, int reachable)
     REF_SetUnsynchronised();
   }
 
-  /* Try to replace NTP sources that are unreachable, falsetickers, or
+  /* Try to replace unreachable NTP sources */
-     have root distance or jitter larger than the allowed maximums */
+  if (inst->reachability == 0 && inst->reachability_size == SOURCE_REACH_BITS)
-  if (inst->type == SRC_NTP &&
+    handle_bad_source(inst);
-      ((!inst->reachability && inst->reachability_size == SOURCE_REACH_BITS) ||
-       inst->status == SRC_BAD_DISTANCE || inst->status == SRC_JITTERY ||
-       inst->status == SRC_FALSETICKER)) {
-    NSR_HandleBadSource(inst->ip_addr);
-  }
 }
 
 /* ================================================== */
@@ -565,18 +596,17 @@ update_sel_options(void)
   for (i = 0; i < n_sources; i++) {
     options = sources[i]->conf_sel_options;
 
-    if (options & SRC_SELECT_NOSELECT)
+    if (!(options & SRC_SELECT_NOSELECT)) {
-      continue;
+      switch (sources[i]->type) {
-
+        case SRC_NTP:
-    switch (sources[i]->type) {
+          options |= sources[i]->authenticated ? auth_ntp_options : unauth_ntp_options;
-      case SRC_NTP:
+          break;
-        options |= sources[i]->authenticated ? auth_ntp_options : unauth_ntp_options;
+        case SRC_REFCLOCK:
-        break;
+          options |= refclk_options;
-      case SRC_REFCLOCK:
+          break;
-        options |= refclk_options;
+        default:
-        break;
+          assert(0);
-      default:
+      }
-        assert(0);
     }
 
     if (sources[i]->sel_options != options) {
@@ -661,11 +691,23 @@ mark_source(SRC_Instance inst, SRC_Status status)
 
   inst->status = status;
 
-  DEBUG_LOG("%s status=%c options=%x reach=%o/%d updates=%d distant=%d leap=%d vote=%d lo=%f hi=%f",
+  /* Try to replace NTP sources that are falsetickers, or have a root
+     distance or jitter larger than the allowed maximums */
+  if (inst == last_updated_inst) {
+    if (inst->bad < INT_MAX &&
+        (status == SRC_FALSETICKER || status == SRC_BAD_DISTANCE || status == SRC_JITTERY))
+      inst->bad++;
+    else
+      inst->bad = 0;
+    if (inst->bad >= BAD_HANDLE_THRESHOLD)
+      handle_bad_source(inst);
+  }
+
+  DEBUG_LOG("%s status=%c options=%x reach=%o/%d updates=%d distant=%d bad=%d leap=%d vote=%d lo=%f hi=%f",
             source_to_string(inst), get_status_char(inst->status),
             (unsigned int)inst->sel_options, (unsigned int)inst->reachability,
             inst->reachability_size, inst->updates,
-            inst->distant, (int)inst->leap, inst->leap_vote,
+            inst->distant, inst->bad, (int)inst->leap, inst->leap_vote,
             inst->sel_info.lo_limit, inst->sel_info.hi_limit);
 
   if (logfileid == -1)
@@ -700,6 +742,26 @@ mark_ok_sources(SRC_Status status)
   }
 }
 
+/* ================================================== */
+/* Reset the index of selected source and report the selection loss.  If no
+   message is provided, assume it is a transient state and wait for another
+   call providing a message or selection of another source, which resets the
+   report_selection_loss flag. */
+
+static void
+unselect_selected_source(LOG_Severity severity, const char *format, const char *arg)
+{
+  if (selected_source_index != INVALID_SOURCE) {
+    selected_source_index = INVALID_SOURCE;
+    report_selection_loss = 1;
+  }
+
+  if (report_selection_loss && format) {
+    log_selection_message(severity, format, arg);
+    report_selection_loss = 0;
+  }
+}
+
 /* ================================================== */
 
 static int
@@ -811,15 +873,13 @@ SRC_SelectSource(SRC_Instance updated_inst)
   double first_sample_ago, max_reach_sample_ago;
   NTP_Leap leap_status;
 
-  if (updated_inst)
+  if (updated_inst) {
     updated_inst->updates++;
+    last_updated_inst = updated_inst;
+  }
 
   if (n_sources == 0) {
-    /* In this case, we clearly cannot synchronise to anything */
+    unselect_selected_source(LOGS_INFO, "Can't synchronise: no sources", NULL);
-    if (selected_source_index != INVALID_SOURCE) {
-      log_selection_message(LOGS_INFO, "Can't synchronise: no sources", NULL);
-      selected_source_index = INVALID_SOURCE;
-    }
     return;
   }
 
@@ -1004,15 +1064,13 @@ SRC_SelectSource(SRC_Instance updated_inst)
   if (n_badstats_sources && n_sel_sources && selected_source_index == INVALID_SOURCE &&
       max_sel_reach_size < SOURCE_REACH_BITS && max_sel_reach >> 1 == max_badstat_reach) {
     mark_ok_sources(SRC_WAITS_STATS);
+    unselect_selected_source(LOGS_INFO, NULL, NULL);
     return;
   }
 
   if (n_endpoints == 0) {
     /* No sources provided valid endpoints */
-    if (selected_source_index != INVALID_SOURCE) {
+    unselect_selected_source(LOGS_INFO, "Can't synchronise: no selectable sources", NULL);
-      log_selection_message(LOGS_INFO, "Can't synchronise: no selectable sources", NULL);
-      selected_source_index = INVALID_SOURCE;
-    }
     return;
   }
 
@@ -1093,6 +1151,7 @@ SRC_SelectSource(SRC_Instance updated_inst)
     if (!reported_no_majority) {
       log_selection_message(LOGS_WARN, "Can't synchronise: no majority", NULL);
       reported_no_majority = 1;
+      report_selection_loss = 0;
     }
 
     if (selected_source_index != INVALID_SOURCE) {
@@ -1149,12 +1208,9 @@ SRC_SelectSource(SRC_Instance updated_inst)
   }
 
   if (!n_sel_sources || sel_req_source || n_sel_sources < CNF_GetMinSources()) {
-    if (selected_source_index != INVALID_SOURCE) {
+    unselect_selected_source(LOGS_INFO, "Can't synchronise: %s selectable sources",
-      log_selection_message(LOGS_INFO, "Can't synchronise: %s selectable sources",
+                             !n_sel_sources ? "no" :
-                            !n_sel_sources ? "no" :
+                             sel_req_source ? "no required source in" : "not enough");
-                            sel_req_source ? "no required source in" : "not enough");
-      selected_source_index = INVALID_SOURCE;
-    }
     mark_ok_sources(SRC_WAITS_SOURCES);
     return;
   }
@@ -1261,7 +1317,7 @@ SRC_SelectSource(SRC_Instance updated_inst)
     /* Before selecting the new synchronisation source wait until the reference
        can be updated */
     if (sources[max_score_index]->updates == 0) {
-      selected_source_index = INVALID_SOURCE;
+      unselect_selected_source(LOGS_INFO, NULL, NULL);
       mark_ok_sources(SRC_WAITS_UPDATE);
       return;
     }
@@ -1277,6 +1333,7 @@ SRC_SelectSource(SRC_Instance updated_inst)
     }
 
     reported_no_majority = 0;
+    report_selection_loss = 0;
   }
 
   mark_source(sources[selected_source_index], SRC_SELECTED);

stubs.c

@@ -207,6 +207,12 @@ NSR_AddSourceByName(char *name, int port, int pool, NTP_Source_Type type,
   return NSR_TooManySources;
 }
 
+const char *
+NSR_StatusToString(NSR_Status status)
+{
+  return "NTP not supported";
+}
+
 NSR_Status
 NSR_RemoveSource(IPAddr *address)
 {

sys_linux.c

@@ -498,6 +498,9 @@ SYS_Linux_EnableSystemCallFilter(int level, SYS_ProcessContext context)
     SCMP_SYS(getrlimit),
     SCMP_SYS(getuid),
     SCMP_SYS(getuid32),
+#ifdef __NR_membarrier
+    SCMP_SYS(membarrier),
+#endif
 #ifdef __NR_rseq
     SCMP_SYS(rseq),
 #endif
@@ -600,6 +603,7 @@ SYS_Linux_EnableSystemCallFilter(int level, SYS_ProcessContext context)
     SCMP_SYS(select),
     SCMP_SYS(set_robust_list),
     SCMP_SYS(write),
+    SCMP_SYS(writev),
 
     /* Miscellaneous */
     SCMP_SYS(getrandom),
@@ -654,7 +658,7 @@ SYS_Linux_EnableSystemCallFilter(int level, SYS_ProcessContext context)
   const static int fcntls[] = { F_GETFD, F_SETFD, F_GETFL, F_SETFL };
 
   const static unsigned long ioctls[] = {
-    FIONREAD, TCGETS,
+    FIONREAD, TCGETS, TIOCGWINSZ,
 #if defined(FEAT_PHC) || defined(HAVE_LINUX_TIMESTAMPING)
     PTP_EXTTS_REQUEST, PTP_SYS_OFFSET,
 #ifdef PTP_PIN_SETFUNC

test/compilation/002-scanbuild

@@ -7,9 +7,9 @@ for opts in \
 	"--host-system=NetBSD" \
 	"--host-system=FreeBSD" \
 	"--without-nettle" \
-	"--without-nettle --without-nss" \
+	"--without-nettle --without-gnutls" \
-	"--without-nettle --without-nss --without-tomcrypt" \
+	"--without-nettle --without-gnutls --without-nss" \
-	"--without-nettle --without-nss --without-tomcrypt --without-gnutls"
+	"--without-nettle --without-gnutls --without-nss --without-tomcrypt"
 do
 	./configure $opts
 	scan-build make "$@" || exit 1

test/compilation/003-sanitizers

@@ -25,12 +25,13 @@ touch Makefile
 for extra_config_opts in \
   "--all-privops" \
   "--disable-ipv6" \
+  "--disable-nts" \
   "--disable-scfilter" \
-  "--without-gnutls" \
+  "--without-aes-gcm-siv" \
   "--without-nettle" \
-  "--without-nettle --without-nss" \
+  "--without-nettle --without-gnutls" \
-  "--without-nettle --without-nss --without-tomcrypt" \
+  "--without-nettle --without-gnutls --without-nss" \
-  "--without-nettle --without-nss --without-tomcrypt --without-gnutls"; \
+  "--without-nettle --without-gnutls --without-nss --without-tomcrypt"; \
 do
   for arch_opts in "-m32" ""; do
     pushd test/simulation/clknetsim || exit 1

test/simulation/110-chronyc

@@ -114,7 +114,7 @@ limit=1
 for chronyc_conf in \
 	"accheck 1.2.3.4" \
 	"add peer 10.0.0.0 minpoll 2 maxpoll 6" \
-	"add server 10.0.0.0 minpoll 6 maxpoll 10 iburst burst key 1 certset 2 maxdelay 1e-3 maxdelayratio 10.0 maxdelaydevratio 10.0 maxdelayquant 0.5 mindelay 1e-4 asymmetry 0.5 offset 1e-5 minsamples 6 maxsamples 6 filter 3 offline auto_offline prefer noselect trust require xleave polltarget 20 port 123 presend 7 minstratum 3 version 4 nts ntsport 4460 copy extfield F323" \
+	"add server 10.0.0.0 minpoll 6 maxpoll 10 iburst burst key 1 certset 2 maxdelay 1e-3 maxdelayratio 10.0 maxdelaydevratio 10.0 maxdelayquant 0.5 mindelay 1e-4 asymmetry 0.5 offset 1e-5 minsamples 6 maxsamples 6 filter 3 offline auto_offline prefer noselect trust require xleave polltarget 20 port 123 presend 7 minstratum 3 version 4 nts ntsport 4460 copy extfield F323 extfield F324" \
 	"add server node1.net1.clk" \
 	"allow 1.2.3.4" \
 	"allow 1.2" \
@@ -350,6 +350,8 @@ minstratum 192.168.123.1 1
 polltarget 192.168.123.1 10
 selectopts 192.168.123.1 +trust +prefer -require
 selectdata
+selectopts 192.168.123.1 +noselect -prefer -trust +require
+selectdata
 delete 192.168.123.1"
 
 run_test || test_fail
@@ -372,6 +374,10 @@ check_chronyc_output "^200 OK
 S Name/IP Address        Auth COpts EOpts Last Score     Interval  Leap
 =======================================================================
 M node1\.net1\.clk            N \-PT\-\- \-PT\-\-    0   1\.0    \+0ns    \+0ns  \?
+200 OK
+S Name/IP Address        Auth COpts EOpts Last Score     Interval  Leap
+=======================================================================
+M node1\.net1\.clk            N N\-\-R\- N\-\-R\-    0   1\.0    \+0ns    \+0ns  \?
 200 OK$" || test_fail
 
 chronyc_conf="

test/simulation/114-presend

@@ -3,6 +3,7 @@
 . ./test.common
 test_start "presend option"
 
+limit=9900
 min_sync_time=136
 max_sync_time=260
 client_server_options="presend 6 maxdelay 16"
@@ -22,4 +23,29 @@ check_source_selection || test_fail
 check_packet_interval || test_fail
 check_sync || test_fail
 
+limit=10
+base_delay=$default_base_delay
+client_conf="logdir tmp
+log measurements"
+
+client_server_options="presend 5"
+
+run_test || test_fail
+check_chronyd_exit || test_fail
+check_packet_interval || test_fail
+
+check_file_messages "20.*123\.1.* 111 111 0111" 1 1 measurements.log || test_fail
+check_file_messages "20.*123\.1.* 111 111 1111" 1 1 measurements.log || test_fail
+rm -f tmp/measurements.log
+
+client_server_options="presend 5 xleave"
+
+run_test || test_fail
+check_chronyd_exit || test_fail
+check_packet_interval || test_fail
+
+check_file_messages "20.*123\.1.* 111 111 0111" 2 2 measurements.log || test_fail
+check_file_messages "20.*123\.1.* 111 111 1111" 1 1 measurements.log || test_fail
+rm -f tmp/measurements.log
+
 test_pass

test/simulation/132-logchange

@@ -16,6 +16,6 @@ check_chronyd_exit || test_fail
 check_source_selection || test_fail
 check_packet_interval || test_fail
 check_sync || test_fail
-check_log_messages "clock wrong by" 4 8 || test_fail
+check_log_messages "clock wrong by" 3 8 || test_fail
 
 test_pass

test/simulation/139-nts

@@ -158,10 +158,10 @@ for dns in 1 0; do
 	check_source_selection && test_fail
 	check_sync && test_fail
 
-	check_file_messages "	2	1	.*	4460	" 50 100 log.packets || test_fail
+	check_file_messages "	2	1	.*	4460	" 45 100 log.packets || test_fail
 	check_file_messages "	2	2	.*	4460	" 0 0 log.packets || test_fail
-	check_log_messages "Source 192.168.123.1 changed to 192.168.123.2" 6 8 || test_fail
+	check_log_messages "Source 192.168.123.1 changed to 192.168.123.2" 4 10 || test_fail
-	check_log_messages "Source 192.168.123.2 replaced with 192.168.123.1" 6 8 || test_fail
+	check_log_messages "Source 192.168.123.2 replaced with 192.168.123.1" 3 10 || test_fail
 
 	servers=2
 
@@ -225,6 +225,8 @@ for dns in 1 0; do
 	check_file_messages "	3	2	.*	4460	" 0 0 log.packets || test_fail
 done
 
+min_sync_time=$[default_min_sync_time + 200]
+max_sync_time=600
 server_conf="
 ntsserverkey tmp/server1.key
 ntsservercert tmp/server1.crt
@@ -248,6 +250,8 @@ check_file_messages "	3	2	.*	123	" 0 0 log.packets || test_fail
 check_file_messages "	3	2	.*	11123	" 3 3 log.packets || test_fail
 
 dns=1
+min_sync_time=$default_min_sync_time
+max_sync_time=400
 server_conf="
 ntsserverkey tmp/server1.key
 ntsservercert tmp/server1.crt

test/simulation/142-ntpoverptp

@@ -0,0 +1,106 @@
+#!/usr/bin/env bash
+
+. ./test.common
+
+test_start "NTP over PTP"
+
+# Block communication between 3 and 1
+base_delay="(+ 1e-4 (* -1 (equal 0.1 from 3) (equal 0.1 to 1)))"
+
+cat > tmp/peer.keys <<-EOF
+1 MD5 1234567890
+EOF
+
+clients=2
+peers=2
+max_sync_time=420
+
+server_conf="
+ptpport 319"
+client_conf="
+ptpport 319
+authselectmode ignore
+keyfile tmp/peer.keys"
+client_server_options="minpoll 6 maxpoll 6 port 319"
+client_peer_options="minpoll 6 maxpoll 6 port 319 key 1"
+
+run_test || test_fail
+check_chronyd_exit || test_fail
+check_source_selection || test_fail
+check_sync || test_fail
+
+check_file_messages "	2	1	.*	319	319	1	96	" 150 160 \
+	log.packets || test_fail
+check_file_messages "	1	2	.*	319	319	1	96	" 150 160 \
+	log.packets || test_fail
+check_file_messages "	2	3	.*	319	319	1	116	" 150 160 \
+	log.packets || test_fail
+check_file_messages "	3	2	.*	319	319	1	116	" 150 160 \
+	log.packets || test_fail
+
+check_config_h 'HAVE_LINUX_TIMESTAMPING 1' || test_skip
+
+export CLKNETSIM_TIMESTAMPING=2
+export CLKNETSIM_LINK_SPEED=100
+
+client_server_options+=" extfield F324 minpoll 0 maxpoll 0"
+client_peer_options+=" extfield F324 minpoll 0 maxpoll 0 maxdelaydevratio 1e6"
+server_conf+="
+clockprecision 1e-9
+hwtimestamp eth0"
+client_conf+="
+clockprecision 1e-9
+hwtimestamp eth0"
+delay_correction="(+ delay (* -8e-8 (+ length 46)))"
+wander=1e-9
+limit=1000
+freq_offset=-1e-4
+min_sync_time=5
+max_sync_time=20
+time_max_limit=1e-7
+time_rms_limit=2e-8
+freq_max_limit=1e-7
+freq_rms_limit=5e-8
+client_chronyd_options="-d"
+
+run_test || test_fail
+check_chronyd_exit || test_fail
+check_source_selection || test_fail
+check_sync || test_fail
+
+if check_config_h 'FEAT_DEBUG 1'; then
+	check_log_messages "apply_net_correction.*Applied" 900 2100 || test_fail
+	check_log_messages "apply_net_correction.*Invalid" 0 4 || test_fail
+fi
+
+client_server_options+=" xleave"
+client_peer_options+=" xleave"
+
+run_test || test_fail
+check_chronyd_exit || test_fail
+check_source_selection || test_fail
+check_sync || test_fail
+
+if check_config_h 'FEAT_DEBUG 1'; then
+	check_log_messages "apply_net_correction.*Applied" 900 2100 || test_fail
+	check_log_messages "apply_net_correction.*Invalid" 0 4 || test_fail
+
+	freq_offset=0.0
+	delay_correction="(+ -1.0e-9 (* 1.0001 delay))"
+
+	run_test || test_fail
+	check_chronyd_exit || test_fail
+
+	check_log_messages "apply_net_correction.*Applied" 350 1400 || test_fail
+	check_log_messages "apply_net_correction.*Invalid" 350 1400 || test_fail
+
+	server_conf="ptpport 319"
+	client_conf="ptpport 319"
+
+	run_test || test_fail
+	check_chronyd_exit || test_fail
+
+	check_log_messages "apply_net_correction.*Applied" 0 0 || test_fail
+fi
+
+test_pass

test/simulation/142-ptpport

@@ -1,41 +0,0 @@
-#!/usr/bin/env bash
-
-. ./test.common
-
-test_start "PTP port"
-
-# Block communication between 3 and 1
-base_delay="(+ 1e-4 (* -1 (equal 0.1 from 3) (equal 0.1 to 1)))"
-
-cat > tmp/peer.keys <<-EOF
-1 MD5 1234567890
-EOF
-
-clients=2
-peers=2
-max_sync_time=420
-
-server_conf="
-ptpport 319"
-client_conf="
-ptpport 319
-authselectmode ignore
-keyfile tmp/peer.keys"
-client_server_options="minpoll 6 maxpoll 6 port 319"
-client_peer_options="minpoll 6 maxpoll 6 port 319 key 1"
-
-run_test || test_fail
-check_chronyd_exit || test_fail
-check_source_selection || test_fail
-check_sync || test_fail
-
-check_file_messages "	2	1	.*	319	319	1	96	" 150 160 \
-	log.packets || test_fail
-check_file_messages "	1	2	.*	319	319	1	96	" 150 160 \
-	log.packets || test_fail
-check_file_messages "	2	3	.*	319	319	1	116	" 150 160 \
-	log.packets || test_fail
-check_file_messages "	3	2	.*	319	319	1	116	" 150 160 \
-	log.packets || test_fail
-
-test_pass

test/simulation/144-monoroot

@@ -2,7 +2,7 @@
 
 . ./test.common
 
-test_start "experimental extension field"
+test_start "mono+root extension field"
 
 check_config_h 'FEAT_CMDMON 1' || test_skip
 

test/simulation/147-refresh

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+
+. ./test.common
+
+test_start "address refreshment"
+
+limit=1000
+servers=5
+client_conf="logdir tmp
+log measurements"
+client_server_conf="server nodes-1-2.net1.clk maxpoll 6
+pool nodes-3-4-5.net1.clk maxpoll 6 maxsources 2"
+client_chronyd_options="-d"
+chronyc_conf="refresh"
+chronyc_start=500
+
+run_test || test_fail
+check_chronyd_exit || test_fail
+check_source_selection || test_fail
+check_packet_interval || test_fail
+check_sync || test_fail
+
+check_file_messages "20.*192.168.123.1" 0 0 measurements.log || test_fail
+check_file_messages "20.*192.168.123.2" 15 17 measurements.log || test_fail
+check_file_messages "20.*192.168.123.[345]" 31 33 measurements.log || test_fail
+rm -f tmp/measurements.log
+if check_config_h 'FEAT_DEBUG 1'; then
+	check_log_messages "refreshing 192.168.123" 3 3 || test_fail
+	check_log_messages "resolved_name.*still fresh" 3 3 || test_fail
+fi
+
+limit=1100
+client_server_conf="
+server nodes-1-2.net1.clk maxpoll 6
+pool nodes-3-4-5.net1.clk maxpoll 6 maxsources 3"
+client_conf+="
+refresh 128"
+chronyc_conf=""
+
+run_test || test_fail
+check_chronyd_exit || test_fail
+check_source_selection || test_fail
+check_packet_interval || test_fail
+check_sync || test_fail
+
+check_file_messages "20.*192.168.123.1" 0 0 measurements.log || test_fail
+check_file_messages "20.*192.168.123.2" 16 18 measurements.log || test_fail
+check_file_messages "20.*192.168.123.[345]" 50 55 measurements.log || test_fail
+rm -f tmp/measurements.log
+if check_config_h 'FEAT_DEBUG 1'; then
+	check_log_messages "refreshing 192.168.123" 8 8 || test_fail
+	check_log_messages "resolved_name.*still fresh" 8 8 || test_fail
+	check_log_messages "refreshing 192.168.123.2" 2 2 || test_fail
+	check_log_messages "refreshing 192.168.123.3" 2 2 || test_fail
+	check_log_messages "refreshing 192.168.123.4" 2 2 || test_fail
+	check_log_messages "refreshing 192.168.123.5" 2 2 || test_fail
+fi
+
+test_pass

test/simulation/148-replacement

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+
+. ./test.common
+
+test_start "source replacement"
+
+limit=5000
+client_conf="logdir tmp
+log measurements"
+
+servers=6
+falsetickers=2
+client_server_conf="pool nodes-1-2-3-4-5-6.net1.clk maxsources 5 polltarget 1 iburst"
+wander=1e-12
+jitter=1e-6
+min_sync_time=7
+
+run_test || test_fail
+check_chronyd_exit || test_fail
+check_source_selection || test_fail
+check_packet_interval || test_fail
+check_sync || test_fail
+
+check_log_messages "Detected falseticker" 2 10 || test_fail
+check_log_messages "Source 192.168.123.. replaced with" 1 3 || test_fail
+check_file_messages "20.*192.168.123.* 11.1   6  6 " 15 18 measurements.log || test_fail
+check_file_messages "20.*00:[1-5].:.. 192.168.123.* 11.1   6  6 " 1 4 measurements.log || test_fail
+rm -f tmp/measurements.log
+
+# 1 unreplaceable falseticker against 2 replaceable unreachable servers
+servers=5
+falsetickers=1
+limit=200000
+base_delay="(+ 1e-4 (* -1 (equal 0.6 to 4.5)))"
+client_conf+="
+minsources 2"
+client_server_conf="
+server 192.168.123.1
+server nodes-2-4.net1.clk
+server nodes-3-5.net1.clk"
+max_sync_time=150000
+
+run_test || test_fail
+check_chronyd_exit || test_fail
+check_source_selection && test_fail
+check_packet_interval || test_fail
+check_sync || test_fail
+
+check_log_messages "Detected falseticker" 2 10 || test_fail
+check_log_messages "Source 192.168.123.. replaced with" 2 70 || test_fail
+check_log_messages "2010-01-01T0[0-4]:.*Source 192.168.123.. replaced with" 2 15 || test_fail
+check_log_messages "2010-01-01T0[5-9]:.*Source 192.168.123.. replaced with" 0 15 || test_fail
+check_file_messages "20.*192.168.123.* 11.1   6  6 " 20 500 measurements.log || test_fail
+rm -f tmp/measurements.log
+
+test_pass

test/simulation/test.common

@@ -31,6 +31,7 @@ default_primary_time_offset=0.0
 default_time_offset=1e-1
 default_freq_offset=1e-4
 default_base_delay=1e-4
+default_delay_correction=""
 default_jitter=1e-4
 default_jitter_asymmetry=0.0
 default_wander=1e-9
@@ -460,6 +461,10 @@ run_test() {
 		for j in $(seq 1 $nodes); do
 			echo "node${i}_delay${j} = $(get_delay_expr up)"
 			echo "node${j}_delay${i} = $(get_delay_expr down)"
+			if [ -n "$delay_correction" ]; then
+				echo "node${i}_delay_correction${j} = $delay_correction"
+				echo "node${j}_delay_correction${i} = $delay_correction"
+			fi
 		done
 	done > tmp/conf
 

test/system/008-confload

@@ -30,6 +30,8 @@ echo "server 127.123.4.4" > $TEST_DIR/conf4.d/4.conf
 echo "server 127.123.5.1" > $TEST_DIR/conf5.d/1.sources
 echo "server 127.123.5.2" > $TEST_DIR/conf5.d/2.sources
 echo "server 127.123.5.3" > $TEST_DIR/conf5.d/3.sources
+echo "server 127.123.5.4" > $TEST_DIR/conf5.d/4.sources
+echo "server 127.123.5.5" > $TEST_DIR/conf5.d/5.sources
 
 start_chronyd || test_fail
 
@@ -46,12 +48,16 @@ check_chronyc_output "^[^=]*
 .. 127\.123\.1\.2 [^^]*
 .. 127\.123\.5\.1 [^^]*
 .. 127\.123\.5\.2 [^^]*
-.. 127\.123\.5\.3 [^^]*$" || test_fail
+.. 127\.123\.5\.3 [^^]*
+.. 127\.123\.5\.4 [^^]*
+.. 127\.123\.5\.5 [^^]*$" || test_fail
 
 rm $TEST_DIR/conf5.d/1.sources
-echo "server 127.123.5.2 minpoll 7" > $TEST_DIR/conf5.d/2.sources
+echo "server 127.123.5.2 minpoll 5" > $TEST_DIR/conf5.d/2.sources
-echo > $TEST_DIR/conf5.d/3.sources
+echo "server 127.123.5.3 minpoll 7" > $TEST_DIR/conf5.d/3.sources
-echo "server 127.123.5.4" > $TEST_DIR/conf5.d/4.sources
+echo > $TEST_DIR/conf5.d/4.sources
+echo "server 127.123.5.5" >> $TEST_DIR/conf5.d/5.sources
+echo "server 127.123.5.6" > $TEST_DIR/conf5.d/6.sources
 
 run_chronyc "reload sources" || test_fail
 
@@ -66,9 +72,12 @@ check_chronyc_output "^[^=]*
 .. 127\.123\.2\.3 [^^]*
 .. 127\.123\.4\.4 [^^]*
 .. 127\.123\.1\.2 *[05]   6 [^^]*
-.. 127\.123\.5\.2 *[05]   7 [^^]*
+.. 127\.123\.5\.5 [^^]*
-.. 127\.123\.5\.4 [^^]*$" || test_fail
+.. 127\.123\.5\.2 *[05]   5 [^^]*
+.. 127\.123\.5\.3 *[05]   7 [^^]*
+.. 127\.123\.5\.6 [^^]*$" || test_fail
 
 stop_chronyd || test_fail
+check_chronyd_message_count "Could not add source" 1 1 || test_fail
 
 test_pass

test/system/010-nts

@@ -43,7 +43,7 @@ wait_for_sync || test_fail
 run_chronyc "authdata" || test_fail
 check_chronyc_output "^Name/IP address             Mode KeyID Type KLen Last Atmp  NAK Cook CLen
 =========================================================================
-127\.0\.0\.1                    NTS     1   15  256    [0-9]    0    0    [78]  100$" || test_fail
+127\.0\.0\.1                    NTS     1   (30|15)  (128|256)    [0-9]    0    0    [78]  ( 64|100)$" || test_fail
 
 stop_chronyd || test_fail
 check_chronyd_messages || test_fail
@@ -57,7 +57,7 @@ wait_for_sync || test_fail
 run_chronyc "authdata" || test_fail
 check_chronyc_output "^Name/IP address             Mode KeyID Type KLen Last Atmp  NAK Cook CLen
 =========================================================================
-127\.0\.0\.1                    NTS     1   15  256    [0-9]    0    0    [78]  100$" || test_fail
+127\.0\.0\.1                    NTS     1   (30|15)  (128|256)    [0-9]    0    0    [78]  ( 64|100)$" || test_fail
 
 stop_chronyd || test_fail
 check_chronyd_messages || test_fail

test/system/011-systemd

@@ -0,0 +1,140 @@
+#!/usr/bin/env bash
+
+. ./test.common
+
+check_chronyd_features NTS || test_skip "NTS support disabled"
+certtool --help &> /dev/null || test_skip "certtool missing"
+check_chronyd_features DEBUG || test_skip "DEBUG support disabled"
+systemd-socket-activate -h &> /dev/null || test_skip "systemd-socket-activate missing"
+has_ipv6=$(check_chronyd_features IPV6 && ping6 -c 1 ::1 > /dev/null 2>&1 && echo 1 || echo 0)
+
+test_start "systemd socket activation"
+
+cat > $TEST_DIR/cert.cfg <<EOF
+cn = "chrony-nts-test"
+dns_name = "chrony-nts-test"
+ip_address = "$server"
+$([ "$has_ipv6" = "1" ] && echo 'ip_address = "::1"')
+serial = 001
+activation_date = "$[$(date '+%Y') - 1]-01-01 00:00:00 UTC"
+expiration_date = "$[$(date '+%Y') + 2]-01-01 00:00:00 UTC"
+signing_key
+encryption_key
+EOF
+
+certtool --generate-privkey --key-type=ed25519 --outfile $TEST_DIR/server.key \
+	&> $TEST_DIR/certtool.log
+certtool --generate-self-signed --load-privkey $TEST_DIR/server.key \
+	--template $TEST_DIR/cert.cfg --outfile $TEST_DIR/server.crt &>> $TEST_DIR/certtool.log
+chown $user $TEST_DIR/server.*
+
+ntpport=$(get_free_port)
+ntsport=$(get_free_port)
+
+server_options="port $ntpport nts ntsport $ntsport"
+extra_chronyd_directives="
+port $ntpport
+ntsport $ntsport
+ntsserverkey $TEST_DIR/server.key
+ntsservercert $TEST_DIR/server.crt
+ntstrustedcerts $TEST_DIR/server.crt
+ntsdumpdir $TEST_LIBDIR
+ntsprocesses 3"
+
+if [ "$has_ipv6" = "1" ]; then
+  extra_chronyd_directives="$extra_chronyd_directives
+  bindaddress ::1
+  server ::1 minpoll -6 maxpoll -6 $server_options"
+fi
+
+# enable debug logging
+extra_chronyd_options="-L -1"
+# Hack to trigger systemd-socket-activate to activate the service.  Normally,
+# chronyd.service would be configured with the WantedBy= directive so it starts
+# without waiting for socket activation.
+# (https://0pointer.de/blog/projects/socket-activation.html).
+for i in $(seq 10); do
+  sleep 1
+  (echo "wake up" > /dev/udp/127.0.0.1/$ntpport) 2>/dev/null
+  (echo "wake up" > /dev/tcp/127.0.0.1/$ntsport) 2>/dev/null
+done &
+
+# Test with UDP sockets (unfortunately systemd-socket-activate doesn't support
+# both datagram and stream sockets in the same invocation:
+# https://github.com/systemd/systemd/issues/9983).
+CHRONYD_WRAPPER="systemd-socket-activate \
+  --datagram \
+  --listen 127.0.0.1:$ntpport \
+  --listen 127.0.0.1:$ntsport"
+if [ "$has_ipv6" = "1" ]; then
+  CHRONYD_WRAPPER="$CHRONYD_WRAPPER \
+    --listen [::1]:$ntpport \
+    --listen [::1]:$ntsport"
+fi
+
+start_chronyd || test_fail
+wait_for_sync || test_fail
+
+if [ "$has_ipv6" = "1" ]; then
+  run_chronyc "ntpdata ::1" || test_fail
+  check_chronyc_output "Total RX +: [1-9]" || test_fail
+fi
+run_chronyc "authdata" || test_fail
+check_chronyc_output "^Name/IP address             Mode KeyID Type KLen Last Atmp  NAK Cook CLen
+=========================================================================\
+$([ "$has_ipv6" = "1" ] && printf "\n%s\n" '::1                          NTS     1   (30|15)  (128|256)    [0-9]    0    0    [78]  ( 64|100)')
+127\.0\.0\.1                    NTS     1   (30|15)  (128|256)    [0-9]    0    0    [78]  ( 64|100)$" || test_fail
+
+stop_chronyd || test_fail
+# DGRAM ntpport socket should be used
+check_chronyd_message_count "Reusing UDPv4 socket fd=3 local=127.0.0.1:$ntpport" 1 1 || test_fail
+# DGRAM ntsport socket should be ignored
+check_chronyd_message_count "Reusing TCPv4 socket fd=4 local=127.0.0.1:$ntsport" 0 0 || test_fail
+if [ "$has_ipv6" = "1" ]; then
+  # DGRAM ntpport socket should be used
+  check_chronyd_message_count "Reusing UDPv6 socket fd=5 local=\[::1\]:$ntpport" 1 1 || test_fail
+  # DGRAM ntsport socket should be ignored
+  check_chronyd_message_count "Reusing TCPv6 socket fd=6 local=\[::1\]:$ntsport" 0 0 || test_fail
+fi
+
+check_chronyd_messages || test_fail
+check_chronyd_files || test_fail
+
+# Test with TCP sockets
+CHRONYD_WRAPPER="systemd-socket-activate \
+  --listen 127.0.0.1:$ntpport \
+  --listen 127.0.0.1:$ntsport"
+if [ "$has_ipv6" = "1" ]; then
+  CHRONYD_WRAPPER="$CHRONYD_WRAPPER \
+    --listen [::1]:$ntpport \
+    --listen [::1]:$ntsport"
+fi
+
+start_chronyd || test_fail
+wait_for_sync || test_fail
+
+if [ "$has_ipv6" = "1" ]; then
+  run_chronyc "ntpdata ::1" || test_fail
+  check_chronyc_output "Total RX +: [1-9]" || test_fail
+fi
+run_chronyc "authdata" || test_fail
+check_chronyc_output "^Name/IP address             Mode KeyID Type KLen Last Atmp  NAK Cook CLen
+=========================================================================\
+$([ "$has_ipv6" = "1" ] && printf "\n%s\n" '::1                          NTS     1   (30|15)  (128|256)    [0-9]    0    0    [78]  ( 64|100)')
+127\.0\.0\.1                    NTS     1   (30|15)  (128|256)    [0-9]    0    0    [78]  ( 64|100)$" || test_fail
+
+stop_chronyd || test_fail
+# STREAM ntpport should be ignored
+check_chronyd_message_count "Reusing TCPv4 socket fd=3 local=127.0.0.1:$ntpport" 0 0 || test_fail
+# STREAM ntsport should be used
+check_chronyd_message_count "Reusing TCPv4 socket fd=4 local=127.0.0.1:$ntsport" 1 1 || test_fail
+if [ "$has_ipv6" = "1" ]; then
+  # STREAM ntpport should be ignored
+  check_chronyd_message_count "Reusing TCPv6 socket fd=5 local=\[::1\]:$ntpport" 0 0 || test_fail
+  # STREAM ntsport should be used
+  check_chronyd_message_count "Reusing TCPv6 socket fd=6 local=\[::1\]:$ntsport" 1 1 || test_fail
+fi
+check_chronyd_messages || test_fail
+check_chronyd_files || test_fail
+
+test_pass

test/system/099-scfilter

@@ -6,7 +6,7 @@ check_chronyd_features SCFILTER || test_skip "SCFILTER support disabled"
 
 test_start "system call filter in non-destructive tests"
 
-for level in "-1" "1" "-2" "2"; do
+for level in 1 2 -1 -2; do
 	test_message 1 1 "level $level:"
 	for test in 0[0-8][0-9]-*[^_]; do
 		test_message 2 0 "$test"

test/system/199-scfilter

@@ -6,7 +6,7 @@ check_chronyd_features SCFILTER || test_skip "SCFILTER support disabled"
 
 test_start "system call filter in destructive tests"
 
-for level in "-1" "1" "-2" "2"; do
+for level in 1 2 -1 -2; do
 	test_message 1 1 "level $level:"
 	for test in 1[0-8][0-9]-*[^_]; do
 		test_message 2 0 "$test"

test/system/test.common

@@ -42,6 +42,8 @@ test_start() {
 		su "$user" -s /bin/sh -c "touch $TEST_DIR/test" 2> /dev/null || \
 			test_skip "$user cannot access $TEST_DIR"
 		rm "$TEST_DIR/test"
+	else
+		chown 0:0 "$TEST_DIR" || test_skip "could not chown $TEST_DIR"
 	fi
 
 	echo "Testing $*:"
@@ -322,7 +324,7 @@ check_chronyd_messages() {
 		([ "$clock_control" -ne 0 ] || grep -q 'Disabled control of system clock' "$logfile") && \
 		([ "$minimal_config" -ne 0 ] || grep -q 'Frequency .* read from' "$logfile") && \
 		grep -q 'chronyd exiting' "$logfile" && \
-		! grep -q 'Could not' "$logfile" && \
+		! (grep -v '^.\{19\}Z D:' "$logfile" | grep -q 'Could not') && \
 		! grep -q 'Disabled command socket' "$logfile" && \
 		test_ok || test_bad
 }

test/unit/ntp_core.c

@@ -1,6 +1,6 @@
 /*
  **********************************************************************
- * Copyright (C) Miroslav Lichvar  2017-2018
+ * Copyright (C) Miroslav Lichvar  2017-2018, 2023
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -35,6 +35,7 @@ static struct timespec current_time;
 static NTP_Packet req_buffer, res_buffer;
 static int req_length, res_length;
 
+#define NIO_IsHwTsEnabled() 1
 #define NIO_OpenServerSocket(addr) ((addr)->ip_addr.family != IPADDR_UNSPEC ? 100 : 0)
 #define NIO_CloseServerSocket(fd) assert(fd == 100)
 #define NIO_OpenClientSocket(addr) ((addr)->ip_addr.family != IPADDR_UNSPEC ? 101 : 0)
@@ -98,21 +99,17 @@ send_request(NCR_Instance inst, int late_hwts)
     local_addr.ip_addr.family = IPADDR_UNSPEC;
     local_addr.if_index = INVALID_IF_INDEX;
     local_addr.sock_fd = 101;
+    zero_local_timestamp(&local_ts);
     local_ts.ts = current_time;
-    local_ts.err = 0.0;
     local_ts.source = NTP_TS_KERNEL;
 
     NCR_ProcessTxKnown(inst, &local_addr, &local_ts, &req_buffer, req_length);
   }
 
   if (late_hwts) {
-    inst->had_hw_tx_timestamp = 1;
     inst->report.total_good_count++;
   } else {
-    if (random() % 2)
+    inst->report.total_good_count = 0;
-      inst->had_hw_tx_timestamp = 0;
-    else
-      inst->report.total_good_count = 0;
   }
 }
 
@@ -125,8 +122,8 @@ process_request(NTP_Remote_Address *remote_addr)
   local_addr.ip_addr.family = IPADDR_UNSPEC;
   local_addr.if_index = INVALID_IF_INDEX;
   local_addr.sock_fd = 100;
+  zero_local_timestamp(&local_ts);
   local_ts.ts = current_time;
-  local_ts.err = 0.0;
   local_ts.source = NTP_TS_KERNEL;
 
   res_length = 0;
@@ -292,8 +289,8 @@ proc_response(NCR_Instance inst, int good, int valid, int updated_sync,
   local_addr.ip_addr.family = IPADDR_UNSPEC;
   local_addr.if_index = INVALID_IF_INDEX;
   local_addr.sock_fd = NTP_LVM_TO_MODE(res->lvm) != MODE_SERVER ? 100 : 101;
+  zero_local_timestamp(&local_ts);
   local_ts.ts = current_time;
-  local_ts.err = 0.0;
   local_ts.source = NTP_TS_KERNEL;
 
   prev_rx_count = inst->report.total_rx_count;

test/unit/ntp_sources.c

@@ -28,6 +28,7 @@
 #include <nameserv_async.h>
 #include <ntp_core.h>
 #include <ntp_io.h>
+#include <sched.h>
 
 static char *requested_name = NULL;
 static DNS_NameResolveHandler resolve_handler = NULL;
@@ -41,9 +42,11 @@ static void *resolve_handler_arg = NULL;
   change_remote_address(inst, remote_addr, ntp_only)
 #define NCR_ProcessRxKnown(remote_addr, local_addr, ts, msg, len) (random() % 2)
 #define NIO_IsServerConnectable(addr) (random() % 2)
+#define SCH_GetLastEventMonoTime() get_mono_time()
 
 static void change_remote_address(NCR_Instance inst, NTP_Remote_Address *remote_addr,
                                   int ntp_only);
+static double get_mono_time(void);
 
 #include <ntp_sources.c>
 
@@ -85,6 +88,8 @@ update_random_address(NTP_Remote_Address *addr, int rand_bits)
     TEST_CHECK(status == NSR_Success || status == NSR_AlreadyInUse);
   }
 
+  TEST_CHECK(strlen(NSR_StatusToString(status)) > 0);
+
   return status == NSR_Success;
 }
 
@@ -96,17 +101,26 @@ change_remote_address(NCR_Instance inst, NTP_Remote_Address *remote_addr, int nt
   TEST_CHECK(record_lock);
 
   if (update && update_pos == 0)
-    r = update_random_address(remote_addr, 4);
+    r = update_random_address(random() % 2 ? remote_addr : NCR_GetRemoteAddress(inst), 4);
 
   NCR_ChangeRemoteAddress(inst, remote_addr, ntp_only);
 
   if (update && update_pos == 1)
-    r = update_random_address(remote_addr, 4);
+    r = update_random_address(random() % 2 ? remote_addr : NCR_GetRemoteAddress(inst), 4);
 
   if (r)
     TEST_CHECK(UTI_IsIPReal(&saved_address_update.old_address.ip_addr));
 }
 
+static double get_mono_time(void) {
+  static double t = 0.0;
+
+  if (random() % 2)
+    t += TST_GetRandomDouble(0.0, 100.0);
+
+  return t;
+}
+
 void
 test_unit(void)
 {

test/unit/nts_ke_server.c

@@ -139,7 +139,7 @@ test_unit(void)
   NKSN_Instance session;
   NKE_Context context, context2;
   NKE_Cookie cookie;
-  int i, valid, l;
+  int i, j, valid, l;
   uint32_t sum, sum2;
 
   char conf[][100] = {
@@ -200,7 +200,9 @@ test_unit(void)
   save_keys();
 
   for (i = 0, sum = 0; i < MAX_SERVER_KEYS; i++) {
-    sum += server_keys[i].id + server_keys[i].key[0];
+    sum += server_keys[i].id;
+    for (j = 0; j < sizeof (server_keys[i].key); j++)
+      sum += server_keys[i].key[j];
     generate_key(i);
   }
 
@@ -208,7 +210,9 @@ test_unit(void)
   TEST_CHECK(unlink("ntskeys") == 0);
 
   for (i = 0, sum2 = 0; i < MAX_SERVER_KEYS; i++) {
-    sum2 += server_keys[i].id + server_keys[i].key[0];
+    sum2 += server_keys[i].id;
+    for (j = 0; j < sizeof (server_keys[i].key); j++)
+      sum2 += server_keys[i].key[j];
   }
 
   TEST_CHECK(sum == sum2);

test/unit/socket.c

@@ -0,0 +1,61 @@
+/*
+ **********************************************************************
+ * Copyright (C) Luke Valenta  2023
+ * 
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ * 
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ * 
+ **********************************************************************
+ */
+
+#include <socket.c>
+#include "test.h"
+
+static void
+test_preinitialise(void)
+{
+#ifdef LINUX
+  /* Test LISTEN_FDS environment variable parsing */
+
+  /* normal */
+  putenv("LISTEN_FDS=2");
+  SCK_PreInitialise();
+  TEST_CHECK(reusable_fds == 2);
+
+  /* negative */
+  putenv("LISTEN_FDS=-2");
+  SCK_PreInitialise();
+  TEST_CHECK(reusable_fds == 0);
+
+  /* trailing characters */
+  putenv("LISTEN_FDS=2a");
+  SCK_PreInitialise();
+  TEST_CHECK(reusable_fds == 0);
+
+  /* non-integer */
+  putenv("LISTEN_FDS=a2");
+  SCK_PreInitialise();
+  TEST_CHECK(reusable_fds == 0);
+
+  /* not set */
+  unsetenv("LISTEN_FDS");
+  SCK_PreInitialise();
+  TEST_CHECK(reusable_fds == 0);
+#endif
+}
+
+void
+test_unit(void)
+{
+  test_preinitialise();
+}

test/unit/util.c

@@ -1,6 +1,6 @@
 /*
  **********************************************************************
- * Copyright (C) Miroslav Lichvar  2017-2018, 2021
+ * Copyright (C) Miroslav Lichvar  2017-2018, 2021, 2023
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -253,6 +253,47 @@ test_unit(void)
   TEST_CHECK(UTI_IsEqualAnyNtp64(&ntp_ts, NULL, NULL, &ntp_ts));
   TEST_CHECK(!UTI_IsEqualAnyNtp64(&ntp_ts, &ntp_fuzz, &ntp_fuzz, &ntp_fuzz));
 
+  ntp_ts.hi = htonl(0);
+  ntp_ts.lo = htonl(0);
+  x = UTI_Ntp64ToDouble(&ntp_ts);
+  TEST_CHECK(fabs(x) < 1e-10);
+  UTI_DoubleToNtp64(x, &ntp_ts2);
+  TEST_CHECK(UTI_CompareNtp64(&ntp_ts, &ntp_ts2) == 0);
+
+  ntp_ts.hi = htonl(0);
+  ntp_ts.lo = htonl(0xffffffff);
+  x = UTI_Ntp64ToDouble(&ntp_ts);
+  TEST_CHECK(fabs(x - 1.0 + 0.23e-9) < 1e-10);
+  UTI_DoubleToNtp64(x, &ntp_ts2);
+  TEST_CHECK(fabs(UTI_DiffNtp64ToDouble(&ntp_ts, &ntp_ts2)) < 0.3e-9);
+
+  ntp_ts.hi = htonl(0xffffffff);
+  ntp_ts.lo = htonl(0xffffffff);
+  x = UTI_Ntp64ToDouble(&ntp_ts);
+  TEST_CHECK(fabs(x + 0.23e-9) < 1e-10);
+  UTI_DoubleToNtp64(x, &ntp_ts2);
+  TEST_CHECK(fabs(UTI_DiffNtp64ToDouble(&ntp_ts, &ntp_ts2)) < 0.3e-9);
+
+  ntp_ts.hi = htonl(0x80000000);
+  ntp_ts.lo = htonl(0);
+  x = UTI_Ntp64ToDouble(&ntp_ts);
+  TEST_CHECK(fabs(x + 0x80000000) < 1e-10);
+  UTI_DoubleToNtp64(x, &ntp_ts2);
+  TEST_CHECK(fabs(UTI_DiffNtp64ToDouble(&ntp_ts, &ntp_ts2)) < 0.3e-9);
+
+  ntp_ts.hi = htonl(0x7fffffff);
+  ntp_ts.lo = htonl(0xffffffff);
+  x = UTI_Ntp64ToDouble(&ntp_ts);
+  TEST_CHECK(fabs(x - 2147483648) < 1.0);
+
+  ntp_ts.lo = htonl(0);
+  ntp_ts.hi = htonl(0x7fffffff);
+  UTI_DoubleToNtp64(0x7fffffff + 0.1, &ntp_ts2);
+  TEST_CHECK(UTI_CompareNtp64(&ntp_ts, &ntp_ts2) == 0);
+  ntp_ts.hi = htonl(0x80000000);
+  UTI_DoubleToNtp64(0x80000000 - 0.1, &ntp_ts);
+  TEST_CHECK(UTI_CompareNtp64(&ntp_ts, &ntp_ts2) == 0);
+
   ts.tv_sec = 1;
   ts.tv_nsec = 2;
   ts2.tv_sec = 1;

util.c

@@ -3,7 +3,7 @@
 
  **********************************************************************
  * Copyright (C) Richard P. Curnow  1997-2003
- * Copyright (C) Miroslav Lichvar  2009, 2012-2021
+ * Copyright (C) Miroslav Lichvar  2009, 2012-2023
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -818,6 +818,33 @@ UTI_DiffNtp64ToDouble(const NTP_int64 *a, const NTP_int64 *b)
 
 /* ================================================== */
 
+double
+UTI_Ntp64ToDouble(NTP_int64 *src)
+{
+  NTP_int64 zero;
+
+  UTI_ZeroNtp64(&zero);
+  return UTI_DiffNtp64ToDouble(src, &zero);
+}
+
+/* ================================================== */
+
+void
+UTI_DoubleToNtp64(double src, NTP_int64 *dest)
+{
+  int32_t hi;
+
+  src = CLAMP(INT32_MIN, src, INT32_MAX);
+  hi = round(src);
+  if (hi > src)
+    hi -= 1;
+
+  dest->hi = htonl(hi);
+  dest->lo = htonl((src - hi) * (1.0e9 * NSEC_PER_NTP64));
+}
+
+/* ================================================== */
+
 /* Maximum offset between two sane times */
 #define MAX_OFFSET 4294967296.0
 

util.h

@@ -163,6 +163,10 @@ extern void UTI_Ntp64ToTimespec(const NTP_int64 *src, struct timespec *dest);
 /* Calculate a - b in any epoch */
 extern double UTI_DiffNtp64ToDouble(const NTP_int64 *a, const NTP_int64 *b);
 
+/* Convert a difference in double (not a timestamp) from and to NTP format */
+extern double UTI_Ntp64ToDouble(NTP_int64 *src);
+extern void UTI_DoubleToNtp64(double src, NTP_int64 *dest);
+
 /* Check if time + offset is sane */
 extern int UTI_IsTimeOffsetSane(const struct timespec *ts, double offset);