doc: update NEWS

Add a note that three servers is the generally recommended minimum for
an NTP client to be able to detect a falseticker. Mention that the pool
directive uses four servers. Update the links to the pool join page and
list of public servers.

Makefile.in

@@ -33,9 +33,13 @@ CFLAGS = @CFLAGS@
 CPPFLAGS = @CPPFLAGS@
 LDFLAGS = @LDFLAGS@
 
+GETDATE_CFLAGS = @GETDATE_CFLAGS@
+
 EXTRA_OBJS = @EXTRA_OBJS@
 
-OBJS = array.o cmdparse.o conf.o local.o logging.o main.o memory.o quantiles.o \
+OBJS = addrfilt.o array.o clientlog.o cmdparse.o conf.o keys.o leapdb.o \
+       local.o logging.o main.o memory.o nameserv.o nameserv_async.o \
+       ntp_auth.o ntp_core.o ntp_ext.o ntp_io.o ntp_sources.o quantiles.o \
        reference.o regress.o rtc.o samplefilt.o sched.o socket.o sources.o sourcestats.o \
        stubs.o smooth.o sys.o sys_null.o tempcomp.o util.o $(EXTRA_OBJS)
 
@@ -61,6 +65,8 @@ chronyd : $(OBJS)
 chronyc : $(CLI_OBJS)
 	$(CC) $(CFLAGS) -o chronyc $(CLI_OBJS) $(LDFLAGS) $(LIBS) $(EXTRA_CLI_LIBS)
 
+getdate.o: CFLAGS += $(GETDATE_CFLAGS)
+
 distclean : clean
 	$(MAKE) -C doc distclean
 	$(MAKE) -C test/unit distclean

NEWS

@@ -1,3 +1,82 @@
+New in version 4.7
+==================
+
+Enhancements
+------------
+* Add opencommands directive to select remote monitoring commands
+* Add interval option to driftfile directive
+* Add waitsynced and waitunsynced options to local directive
+* Add sanity checks for integer values in configuration
+* Add support for systemd Type=notify service
+* Add RTC refclock driver
+* Allow PHC refclock to be specified with network interface name
+* Don't require multiple refclock samples per poll to simplify
+  filter configuration
+* Keep refclock reachable when dropping samples with large delay
+* Improve quantile-based filtering to adapt faster to larger delay
+* Improve logging of selection failures
+* Detect clock interference from other processes
+* Try to reopen message log (-l option) on cyclelogs command
+
+Bug fixes
+---------
+* Fix sourcedir reloading to not multiply sources
+* Fix tracking offset after failed clock step
+
+Removed features
+----------------
+* Drop support for NTS with Nettle < 3.6 and GnuTLS < 3.6.14
+* Drop support for building without POSIX threads
+
+New in version 4.6.1
+====================
+
+Enhancements
+------------
+* Add ntsaeads directive to enable only selected AEAD algorithms for NTS
+
+Workarounds
+-----------
+* Negotiate use of compliant NTS keys with AES-128-GCM-SIV AEAD algorithm
+  (by default the keys are generated differently than in RFC 8915 for
+  compatibility with chrony server and client versions 4.4, 4.5, and 4.6)
+* Switch to compliant NTS keys if first response from server is NTS NAK
+
+New in version 4.6
+==================
+
+Enhancements
+------------
+* Add activate option to local directive to set activation threshold
+* Add ipv4 and ipv6 options to server/pool/peer directive
+* Add kod option to ratelimit directive for server KoD RATE support
+* Add leapseclist directive to read NIST/IERS leap-seconds.list file
+* Add ptpdomain directive to set PTP domain for NTP over PTP
+* Allow disabling pidfile
+* Improve copy server option to accept unsynchronised status instantly
+* Log one selection failure on start
+* Add offset command to modify source offset correction
+* Add timestamp sources to ntpdata report
+
+Bug fixes
+---------
+* Fix crash on sources reload during initstepslew or RTC initialisation
+* Fix source refreshment to not repeat failed name resolving attempts
+
+New in version 4.5
+==================
+
+Enhancements
+------------
+* Add support for AES-GCM-SIV in GnuTLS
+* Add support for corrections from PTP transparent clocks
+* Add support for systemd socket activation
+
+Bug fixes
+---------
+* Fix presend in interleaved mode
+* Fix reloading of modified sources from sourcedir
+
 New in version 4.4
 ==================
 
@@ -11,9 +90,13 @@ Enhancements
 * Add hwtstimeout directive to configure timeout for late timestamps
 * Handle late hardware transmit timestamps of NTP requests on all sockets
 * Handle mismatched 32/64-bit time_t in SOCK refclock samples
+* Improve source replacement
 * Log important changes made by command requests (chronyc)
+* Refresh address of NTP sources periodically
+* Request nanosecond kernel RX timestamping on FreeBSD
 * Set DSCP for IPv6 packets
 * Shorten NTS-KE retry interval when network is down
+* Update seccomp filter for musl
 * Warn if loading keys from file with unexpected permissions
 * Warn if source selection fails or falseticker is detected
 * Add selectopts command to modify source-specific selection options

README

@@ -12,7 +12,7 @@ a time service to other computers in the network.
 It is designed to perform well in a wide range of conditions, including
 intermittent network connections, heavily congested networks, changing
 temperatures (ordinary computer clocks are sensitive to temperature),
-and systems that do not run continuosly, or run on a virtual machine.
+and systems that do not run continuously, or run on a virtual machine.
 
 Typical accuracy between two machines synchronised over the Internet is
 within a few milliseconds; on a LAN, accuracy is typically in tens of
@@ -47,32 +47,7 @@ Frequently Asked Questions (FAQ).
 The documentation is also available on the chrony web pages, accessible
 through the URL 
 
-    https://chrony.tuxfamily.org/
-
-Where are new versions announced?
-=================================
-
-There is a low volume mailing list where new versions and other
-important news relating to chrony are announced.  You can join this list
-by sending mail with the subject "subscribe" to
-
-chrony-announce-request@chrony.tuxfamily.org
-
-How can I get support for chrony?
-=================================
-
-There are two other mailing lists relating to chrony.  chrony-users is a
-discussion list for users, e.g. for questions about chrony configuration
-and bug reports.  chrony-dev is a more technical list for developers,
-e.g. for submitting patches and discussing how new features should be
-implemented.  To subscribe to either of these lists, send a message with
-the subject "subscribe" to
-
-chrony-users-request@chrony.tuxfamily.org
-or
-chrony-dev-request@chrony.tuxfamily.org
-
-as applicable.
+    https://chrony-project.org/
 
 License
 =======
@@ -100,6 +75,7 @@ Lonnie Abelbeck <lonnie@abelbeck.com>
 Benny Lyne Amorsen <benny@amorsen.dk>
 Andrew Bishop <amb@gedanken.demon.co.uk>
 Vincent Blut <vincent.debian@free.fr>
+Luca Boccassi <bluca@debian.org>
 Stephan I. Boettcher <stephan@nevis1.columbia.edu>
 David Bohman <debohman@gmail.com>
 Goswin Brederlow <brederlo@informatik.uni-tuebingen.de>
@@ -108,13 +84,18 @@ Erik Bryer <ebryer@spots.ab.ca>
 Jonathan Cameron <jic23@cam.ac.uk>
 Bryan Christianson <bryan@whatroute.net>
 Juliusz Chroboczek <jch@pps.jussieu.fr>
+Paul Donald <newtwen+gitlab@gmail.com>
 Dan Drown <dan-ntp@drown.org>
 Kamil Dudka <kdudka@redhat.com>
 Christian Ehrhardt <christian.ehrhardt@canonical.com>
 Paul Elliott <pelliott@io.com>
 Robert Fairley <rfairley@redhat.com>
+Ahmad Fatoum <a.fatoum@pengutronix.de>
+Andreas Fenkart <extern-afe@mission-embedded.com>
 Stefan R. Filipek <srfilipek@gmail.com>
+Andy Fiddaman <illumos@fiddaman.net>
 Mike Fleetwood <mike@rockover.demon.co.uk>
+Rob Gill <rrobgill@protonmail.com>
 Alexander Gretencord <arutha@gmx.de>
 Andrew Griffiths <agriffit@redhat.com>
 Walter Haidinger <walter.haidinger@gmx.at>
@@ -136,19 +117,23 @@ Paul Menzel <paulepanter@users.sourceforge.net>
 Vladimir Michl <vladimir.michl@seznam.cz>
 Victor Moroz <vim@prv.adlum.ru>
 Kalle Olavi Niemitalo  <tosi@stekt.oulu.fi>
+Patrick Oppenlander <patrick.oppenlander@gmail.com>
 Frank Otto <sandwichmacher@web.de>
 Denny Page <dennypage@me.com>
 Rupesh Patel <rupatel@redhat.com>
 Chris Perl <cperl@janestreet.com>
 Gautier PHILIPPON <gautier.philippon@ensimag.grenoble-inp.fr>
 Andreas Piesk <apiesk@virbus.de>
+Shachar Raindel <shacharr@google.com>
 Mike Ryan <msr@hsilop.net>
 Baruch Siach <baruch@tkos.co.il>
+Josef 'Jeff' Sipek <jeffpc@josefsipek.net>
 Foster Snowhill <forst@forstwoof.ru>
 Andreas Steinmetz <ast@domdv.de>
 NAKAMURA Takumi <takumi@ps.sakura.ne.jp>
 Timo Teras <timo.teras@iki.fi>
 Bill Unruh <unruh@physics.ubc.ca>
+Luke Valenta <lvalenta@cloudflare.com>
 Stephen Wadeley <swadeley@redhat.com>
 Bernhard Weiss <lisnablagh@web.de>
 Wolfgang Weisselberg <weissel@netcologne.de>

candm.h

@@ -37,7 +37,6 @@
 #define DEFAULT_CANDM_PORT 323
 
 /* Request codes */
-#define REQ_NULL 0
 #define REQ_ONLINE 1
 #define REQ_OFFLINE 2
 #define REQ_BURST 3
@@ -110,7 +109,9 @@
 #define REQ_RELOAD_SOURCES 70
 #define REQ_DOFFSET2 71
 #define REQ_MODIFY_SELECTOPTS 72
-#define N_REQUEST_TYPES 73
+#define REQ_MODIFY_OFFSET 73
+#define REQ_LOCAL3 74
+#define N_REQUEST_TYPES 75
 
 /* Structure used to exchange timespecs independent of time_t size */
 typedef struct {
@@ -221,11 +222,6 @@ typedef struct {
   int32_t EOR;
 } REQ_Modify_Makestep;
 
-typedef struct {
-  Timespec ts;
-  int32_t EOR;
-} REQ_Logon;
-
 typedef struct {
   Timespec ts;
   int32_t EOR;
@@ -236,6 +232,9 @@ typedef struct {
   int32_t stratum;
   Float distance;
   int32_t orphan;
+  Float activate;
+  Float wait_synced;
+  Float wait_unsynced;
   int32_t EOR;
 } REQ_Local;
 
@@ -277,7 +276,10 @@ typedef struct {
 #define REQ_ADDSRC_BURST 0x100
 #define REQ_ADDSRC_NTS 0x200
 #define REQ_ADDSRC_COPY 0x400
-#define REQ_ADDSRC_EF_EXP1 0x800
+#define REQ_ADDSRC_EF_EXP_MONO_ROOT 0x800
+#define REQ_ADDSRC_EF_EXP_NET_CORRECTION 0x1000
+#define REQ_ADDSRC_IPV4 0x2000
+#define REQ_ADDSRC_IPV6 0x4000
 
 typedef struct {
   uint32_t type;
@@ -387,6 +389,13 @@ typedef struct {
   int32_t EOR;
 } REQ_Modify_SelectOpts;
 
+typedef struct {
+  IPAddr address;
+  uint32_t ref_id;
+  Float new_offset;
+  int32_t EOR;
+} REQ_Modify_Offset;
+
 /* ================================================== */
 
 #define PKT_TYPE_CMD_REQUEST 1
@@ -473,7 +482,6 @@ typedef struct {
     REQ_Modify_Polltarget modify_polltarget;
     REQ_Modify_Maxupdateskew modify_maxupdateskew;
     REQ_Modify_Makestep modify_makestep;
-    REQ_Logon logon;
     REQ_Settime settime;
     REQ_Local local;
     REQ_Manual manual;
@@ -494,6 +502,7 @@ typedef struct {
     REQ_AuthData auth_data;
     REQ_SelectData select_data;
     REQ_Modify_SelectOpts modify_select_opts;
+    REQ_Modify_Offset modify_offset;
   } data; /* Command specific parameters */
 
   /* Padding used to prevent traffic amplification.  It only defines the
@@ -502,13 +511,6 @@ typedef struct {
 
 } CMD_Request;
 
-/* ================================================== */
-/* Authority codes for command types */
-
-#define PERMIT_OPEN 0
-#define PERMIT_LOCAL 1
-#define PERMIT_AUTH 2
-
 /* ================================================== */
 
 /* Reply codes */
@@ -537,7 +539,8 @@ typedef struct {
 #define RPY_SELECT_DATA 23
 #define RPY_SERVER_STATS3 24
 #define RPY_SERVER_STATS4 25
-#define N_REPLY_TYPES 26
+#define RPY_NTP_DATA2 26
+#define N_REPLY_TYPES 27
 
 /* Status codes */
 #define STT_SUCCESS 0
@@ -760,7 +763,11 @@ typedef struct {
   uint32_t total_rx_count;
   uint32_t total_valid_count;
   uint32_t total_good_count;
-  uint32_t reserved[3];
+  uint32_t total_kernel_tx_ts;
+  uint32_t total_kernel_rx_ts;
+  uint32_t total_hw_tx_ts;
+  uint32_t total_hw_rx_ts;
+  uint32_t reserved[4];
   int32_t EOR;
 } RPY_NTPData;
 

client.c

@@ -4,7 +4,7 @@
  **********************************************************************
  * Copyright (C) Richard P. Curnow  1997-2003
  * Copyright (C) Lonnie Abelbeck  2016, 2018
- * Copyright (C) Miroslav Lichvar  2009-2021
+ * Copyright (C) Miroslav Lichvar  2009-2024
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -125,12 +125,11 @@ read_line(void)
       strncpy(line, cmd, sizeof(line) - 1);
       line[sizeof(line) - 1] = '\0';
       add_history(cmd);
-      /* free the buffer allocated by readline */
-      Free(cmd);
     } else {
       /* simulate the user has entered an empty line */
       *line = '\0';
     }
+    Free(cmd);
     return( line );
 #else
     printf("%s", prompt);
@@ -344,6 +343,24 @@ parse_source_address(char *word, IPAddr *address)
 
 /* ================================================== */
 
+static int
+parse_source_address_or_refid(char *s, IPAddr *address, uint32_t *ref_id)
+{
+  address->family = IPADDR_UNSPEC;
+  *ref_id = 0;
+
+  /* Don't allow hostnames to avoid conflicts with reference IDs */
+  if (UTI_StringToIdIP(s, address) || UTI_StringToIP(s, address))
+    return 1;
+
+  if (CPS_ParseRefid(s, ref_id) > 0)
+    return 1;
+
+  return 0;
+}
+
+/* ================================================== */
+
 static int
 read_mask_address(char *line, IPAddr *mask, IPAddr *address)
 {
@@ -736,23 +753,27 @@ process_cmd_burst(CMD_Request *msg, char *line)
 static int
 process_cmd_local(CMD_Request *msg, char *line)
 {
+  double distance = 0.0, activate = 0.0, wait_synced = 0.0, wait_unsynced = 0.0;
   int on_off, stratum = 0, orphan = 0;
-  double distance = 0.0;
 
   if (!strcmp(line, "off")) {
     on_off = 0;
-  } else if (CPS_ParseLocal(line, &stratum, &orphan, &distance)) {
+  } else if (CPS_ParseLocal(line, &stratum, &orphan, &distance, &activate,
+                            &wait_synced, &wait_unsynced) == CPS_Success) {
     on_off = 1;
   } else {
     LOG(LOGS_ERR, "Invalid syntax for local command");
     return 0;
   }
 
-  msg->command = htons(REQ_LOCAL2);
+  msg->command = htons(REQ_LOCAL3);
   msg->data.local.on_off = htonl(on_off);
   msg->data.local.stratum = htonl(stratum);
   msg->data.local.distance = UTI_FloatHostToNetwork(distance);
   msg->data.local.orphan = htonl(orphan);
+  msg->data.local.activate = UTI_FloatHostToNetwork(activate);
+  msg->data.local.wait_synced = UTI_FloatHostToNetwork(wait_synced);
+  msg->data.local.wait_unsynced = UTI_FloatHostToNetwork(wait_unsynced);
 
   return 1;
 }
@@ -886,8 +907,9 @@ static int
 process_cmd_add_source(CMD_Request *msg, char *line)
 {
   CPS_NTP_Source data;
+  CPS_Status status;
   IPAddr ip_addr;
-  int result = 0, status, type;
+  int result = 0, type;
   const char *opt_name, *word;
   
   msg->command = htons(REQ_ADD_SOURCE);
@@ -908,10 +930,7 @@ process_cmd_add_source(CMD_Request *msg, char *line)
 
   status = CPS_ParseNTPSourceAdd(line, &data);
   switch (status) {
-    case 0:
-      LOG(LOGS_ERR, "Invalid syntax for add command");
-      break;
-    default:
+    case CPS_Success:
       /* Verify that the address is resolvable (chronyc and chronyd are
          assumed to be running on the same host) */
       if (strlen(data.name) >= sizeof (msg->data.ntp_source.name) ||
@@ -927,8 +946,7 @@ process_cmd_add_source(CMD_Request *msg, char *line)
       }
 
       msg->data.ntp_source.type = htonl(type);
-      if (strlen(data.name) >= sizeof (msg->data.ntp_source.name))
-        assert(0);
+      BRIEF_ASSERT(strlen(data.name) < sizeof (msg->data.ntp_source.name));
       strncpy((char *)msg->data.ntp_source.name, data.name,
               sizeof (msg->data.ntp_source.name));
       msg->data.ntp_source.port = htonl(data.port);
@@ -958,7 +976,12 @@ process_cmd_add_source(CMD_Request *msg, char *line)
           (data.params.burst ? REQ_ADDSRC_BURST : 0) |
           (data.params.nts ? REQ_ADDSRC_NTS : 0) |
           (data.params.copy ? REQ_ADDSRC_COPY : 0) |
-          (data.params.ext_fields & NTP_EF_FLAG_EXP1 ? REQ_ADDSRC_EF_EXP1 : 0) |
+          (data.params.ext_fields & NTP_EF_FLAG_EXP_MONO_ROOT ?
+           REQ_ADDSRC_EF_EXP_MONO_ROOT : 0) |
+          (data.params.ext_fields & NTP_EF_FLAG_EXP_NET_CORRECTION ?
+           REQ_ADDSRC_EF_EXP_NET_CORRECTION : 0) |
+          (data.family == IPADDR_INET4 ? REQ_ADDSRC_IPV4 : 0) |
+          (data.family == IPADDR_INET6 ? REQ_ADDSRC_IPV6 : 0) |
           convert_addsrc_sel_options(data.params.sel_options));
       msg->data.ntp_source.filter_length = htonl(data.params.filter_length);
       msg->data.ntp_source.cert_set = htonl(data.params.cert_set);
@@ -968,6 +991,15 @@ process_cmd_add_source(CMD_Request *msg, char *line)
 
       result = 1;
 
+      break;
+    case CPS_InvalidOption:
+      LOG(LOGS_ERR, "Invalid %s add command", "option in");
+      break;
+    case CPS_InvalidValue:
+      LOG(LOGS_ERR, "Invalid %s add command", "value in");
+      break;
+    default:
+      LOG(LOGS_ERR, "Invalid %s add command", "syntax for");
       break;
   }
 
@@ -1026,6 +1058,7 @@ give_help(void)
     "selectopts <address|refid> <+|-options>\0Modify selection options\0"
     "reselect\0Force reselecting synchronisation source\0"
     "reselectdist <dist>\0Modify reselection distance\0"
+    "offset <address|refid> <offset>\0Modify offset correction\0"
     "\0\0"
     "NTP sources:\0\0"
     "activity\0Check how many NTP sources are online/offline\0"
@@ -1136,7 +1169,8 @@ command_name_generator(const char *text, int state)
     "clients", "cmdaccheck", "cmdallow", "cmddeny", "cyclelogs", "delete",
     "deny", "dns", "dump", "exit", "help", "keygen", "local", "makestep",
     "manual", "maxdelay", "maxdelaydevratio", "maxdelayratio", "maxpoll",
-    "maxupdateskew", "minpoll", "minstratum", "ntpdata", "offline", "online", "onoffline",
+    "maxupdateskew", "minpoll", "minstratum", "ntpdata",
+    "offline", "offset", "online", "onoffline",
     "polltarget", "quit", "refresh", "rekey", "reload", "reselect", "reselectdist", "reset",
     "retries", "rtcdata", "selectdata", "selectopts", "serverstats", "settime",
     "shutdown", "smoothing", "smoothtime", "sourcename", "sources", "sourcestats",
@@ -1167,7 +1201,7 @@ command_name_generator(const char *text, int state)
 
   while ((name = names[tab_complete_index][list_index++])) {
     if (strncmp(name, text, len) == 0) {
-      return strdup(name);
+      return Strdup(name);
     }
   }
 
@@ -1979,7 +2013,7 @@ process_cmd_sources(char *line)
   IPAddr ip_addr;
   uint32_t i, mode, n_sources;
   char name[256], mode_ch, state_ch;
-  int all, verbose;
+  int all, verbose, ref;
 
   parse_sources_options(line, &all, &verbose);
   
@@ -2016,9 +2050,8 @@ process_cmd_sources(char *line)
     if (!all && ip_addr.family == IPADDR_ID)
       continue;
 
-    format_name(name, sizeof (name), 25,
-                mode == RPY_SD_MD_REF && ip_addr.family == IPADDR_INET4,
-                ip_addr.addr.in4, 1, &ip_addr);
+    ref = mode == RPY_SD_MD_REF && ip_addr.family == IPADDR_INET4;
+    format_name(name, sizeof (name), 25, ref, ref ? ip_addr.addr.in4 : 0, 1, &ip_addr);
 
     switch (mode) {
       case RPY_SD_MD_CLIENT:
@@ -2327,7 +2360,7 @@ process_cmd_ntpdata(char *line)
 
     request.command = htons(REQ_NTP_DATA);
     UTI_IPHostToNetwork(&remote_addr, &request.data.ntp_data.ip_addr);
-    if (!request_reply(&request, &reply, RPY_NTP_DATA, 0))
+    if (!request_reply(&request, &reply, RPY_NTP_DATA2, 0))
       return 0;
 
     UTI_IPNetworkToHost(&reply.data.ntp_data.remote_addr, &remote_addr);
@@ -2363,7 +2396,11 @@ process_cmd_ntpdata(char *line)
                  "Total TX        : %U\n"
                  "Total RX        : %U\n"
                  "Total valid RX  : %U\n"
-                 "Total good RX   : %U\n",
+                 "Total good RX   : %U\n"
+                 "Total kernel TX : %U\n"
+                 "Total kernel RX : %U\n"
+                 "Total HW TX     : %U\n"
+                 "Total HW RX     : %U\n",
                  UTI_IPToString(&remote_addr), UTI_IPToRefid(&remote_addr),
                  ntohs(reply.data.ntp_data.remote_port),
                  UTI_IPToString(&local_addr), UTI_IPToRefid(&local_addr),
@@ -2391,6 +2428,10 @@ process_cmd_ntpdata(char *line)
                  ntohl(reply.data.ntp_data.total_rx_count),
                  ntohl(reply.data.ntp_data.total_valid_count),
                  ntohl(reply.data.ntp_data.total_good_count),
+                 ntohl(reply.data.ntp_data.total_kernel_tx_ts),
+                 ntohl(reply.data.ntp_data.total_kernel_rx_ts),
+                 ntohl(reply.data.ntp_data.total_hw_tx_ts),
+                 ntohl(reply.data.ntp_data.total_hw_rx_ts),
                  REPORT_END);
   }
 
@@ -2846,6 +2887,34 @@ process_cmd_activity(const char *line)
 
 /* ================================================== */
 
+static int
+process_cmd_offset(CMD_Request *msg, char *line)
+{
+  uint32_t ref_id;
+  IPAddr ip_addr;
+  double offset;
+  char *src;
+
+  src = line;
+  line = CPS_SplitWord(line);
+
+  if (!parse_source_address_or_refid(src, &ip_addr, &ref_id) ||
+      sscanf(line, "%lf", &offset) != 1) {
+    LOG(LOGS_ERR, "Invalid syntax for offset command");
+    return 0;
+  }
+
+  UTI_IPHostToNetwork(&ip_addr, &msg->data.modify_offset.address);
+  msg->data.modify_offset.ref_id = htonl(ref_id);
+  msg->data.modify_offset.new_offset = UTI_FloatHostToNetwork(offset);
+
+  msg->command = htons(REQ_MODIFY_OFFSET);
+
+  return 1;
+}
+
+/* ================================================== */
+
 static int
 process_cmd_reselectdist(CMD_Request *msg, char *line)
 {
@@ -2927,15 +2996,10 @@ process_cmd_selectopts(CMD_Request *msg, char *line)
 
   src = line;
   line = CPS_SplitWord(line);
-  ref_id = 0;
 
-  /* Don't allow hostnames to avoid conflicts with reference IDs */
-  if (!UTI_StringToIdIP(src, &ip_addr) && !UTI_StringToIP(src, &ip_addr)) {
-    ip_addr.family = IPADDR_UNSPEC;
-    if (CPS_ParseRefid(src, &ref_id) == 0) {
-      LOG(LOGS_ERR, "Invalid syntax for selectopts command");
-      return 0;
-    }
+  if (!parse_source_address_or_refid(src, &ip_addr, &ref_id)) {
+    LOG(LOGS_ERR, "Invalid syntax for selectopts command");
+    return 0;
   }
 
   mask = options = 0;
@@ -3237,6 +3301,8 @@ process_line(char *line)
     ret = process_cmd_ntpdata(line);
   } else if (!strcmp(command, "offline")) {
     do_normal_submit = process_cmd_offline(&tx_message, line);
+  } else if (!strcmp(command, "offset")) {
+    do_normal_submit = process_cmd_offset(&tx_message, line);
   } else if (!strcmp(command, "online")) {
     do_normal_submit = process_cmd_online(&tx_message, line);
   } else if (!strcmp(command, "onoffline")) {
@@ -3381,7 +3447,7 @@ static void
 display_gpl(void)
 {
     printf("chrony version %s\n"
-           "Copyright (C) 1997-2003, 2007, 2009-2022 Richard P. Curnow and others\n"
+           "Copyright (C) 1997-2003, 2007, 2009-2025 Richard P. Curnow and others\n"
            "chrony comes with ABSOLUTELY NO WARRANTY.  This is free software, and\n"
            "you are welcome to redistribute it under certain conditions.  See the\n"
            "GNU General Public License version 2 for details.\n\n",
@@ -3529,6 +3595,7 @@ main(int argc, char **argv)
   close_io();
   free_addresses(server_addresses);
   SCK_Finalise();
+  UTI_ResetGetRandomFunctions();
 
   return !ret;
 }

clientlog.c

@@ -3,7 +3,7 @@
 
  **********************************************************************
  * Copyright (C) Richard P. Curnow  1997-2003
- * Copyright (C) Miroslav Lichvar  2009, 2015-2017, 2021
+ * Copyright (C) Miroslav Lichvar  2009, 2015-2017, 2021, 2024
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -117,6 +117,14 @@ static int token_shift[MAX_SERVICES];
 
 static int leak_rate[MAX_SERVICES];
 
+/* Rates at which responses requesting clients to reduce their rate
+   (e.g. NTP KoD RATE) are randomly allowed (in log2, but 0 means disabled) */
+
+#define MIN_KOD_RATE 0
+#define MAX_KOD_RATE 4
+
+static int kod_rate[MAX_SERVICES];
+
 /* Limit intervals in log2 */
 static int limit_interval[MAX_SERVICES];
 
@@ -257,16 +265,13 @@ get_record(IPAddr *ip)
   }
 
   record->ip_addr = *ip;
-  for (i = 0; i < MAX_SERVICES; i++)
+  for (i = 0; i < MAX_SERVICES; i++) {
     record->last_hit[i] = INVALID_TS;
-  for (i = 0; i < MAX_SERVICES; i++)
     record->hits[i] = 0;
-  for (i = 0; i < MAX_SERVICES; i++)
     record->drops[i] = 0;
-  for (i = 0; i < MAX_SERVICES; i++)
     record->tokens[i] = max_tokens[i];
-  for (i = 0; i < MAX_SERVICES; i++)
     record->rate[i] = INVALID_RATE;
+  }
   record->ntp_timeout_rate = INVALID_RATE;
   record->drop_flags = 0;
 
@@ -354,18 +359,19 @@ set_bucket_params(int interval, int burst, uint16_t *max_tokens,
 void
 CLG_Initialise(void)
 {
-  int i, interval, burst, lrate, slots2;
+  int i, interval, burst, lrate, krate, slots2;
 
   for (i = 0; i < MAX_SERVICES; i++) {
     max_tokens[i] = 0;
     tokens_per_hit[i] = 0;
     token_shift[i] = 0;
     leak_rate[i] = 0;
+    kod_rate[i] = 0;
     limit_interval[i] = MIN_LIMIT_INTERVAL;
 
     switch (i) {
       case CLG_NTP:
-        if (!CNF_GetNTPRateLimit(&interval, &burst, &lrate))
+        if (!CNF_GetNTPRateLimit(&interval, &burst, &lrate, &krate))
           continue;
         break;
       case CLG_NTSKE:
@@ -382,6 +388,7 @@ CLG_Initialise(void)
 
     set_bucket_params(interval, burst, &max_tokens[i], &tokens_per_hit[i], &token_shift[i]);
     leak_rate[i] = CLAMP(MIN_LEAK_RATE, lrate, MAX_LEAK_RATE);
+    kod_rate[i] = CLAMP(MIN_KOD_RATE, krate, MAX_KOD_RATE);
     limit_interval[i] = CLAMP(MIN_LIMIT_INTERVAL, interval, MAX_LIMIT_INTERVAL);
   }
 
@@ -579,28 +586,28 @@ CLG_LogServiceAccess(CLG_Service service, IPAddr *client, struct timespec *now)
 /* ================================================== */
 
 static int
-limit_response_random(int leak_rate)
+limit_response_random(int rate)
 {
   static uint32_t rnd;
   static int bits_left = 0;
   int r;
 
-  if (bits_left < leak_rate) {
+  if (bits_left < rate) {
     UTI_GetRandomBytes(&rnd, sizeof (rnd));
     bits_left = 8 * sizeof (rnd);
   }
 
-  /* Return zero on average once per 2^leak_rate */
-  r = rnd % (1U << leak_rate) ? 1 : 0;
-  rnd >>= leak_rate;
-  bits_left -= leak_rate;
+  /* Return zero on average once per 2^rate */
+  r = rnd % (1U << rate) ? 1 : 0;
+  rnd >>= rate;
+  bits_left -= rate;
 
   return r;
 }
 
 /* ================================================== */
 
-int
+CLG_Limit
 CLG_LimitServiceRate(CLG_Service service, int index)
 {
   Record *record;
@@ -609,14 +616,14 @@ CLG_LimitServiceRate(CLG_Service service, int index)
   check_service_number(service);
 
   if (tokens_per_hit[service] == 0)
-    return 0;
+    return CLG_PASS;
 
   record = ARR_GetElement(records, index);
   record->drop_flags &= ~(1U << service);
 
   if (record->tokens[service] >= tokens_per_hit[service]) {
     record->tokens[service] -= tokens_per_hit[service];
-    return 0;
+    return CLG_PASS;
   }
 
   drop = limit_response_random(leak_rate[service]);
@@ -632,14 +639,18 @@ CLG_LimitServiceRate(CLG_Service service, int index)
 
   if (!drop) {
     record->tokens[service] = 0;
-    return 0;
+    return CLG_PASS;
+  }
+
+  if (kod_rate[service] > 0 && !limit_response_random(kod_rate[service])) {
+    return CLG_KOD;
   }
 
   record->drop_flags |= 1U << service;
   record->drops[service]++;
   total_drops[service]++;
 
-  return 1;
+  return CLG_DROP;
 }
 
 /* ================================================== */

clientlog.h

@@ -37,11 +37,17 @@ typedef enum {
   CLG_CMDMON,
 } CLG_Service;
 
+typedef enum {
+  CLG_PASS = 0,
+  CLG_DROP,
+  CLG_KOD,
+} CLG_Limit;
+
 extern void CLG_Initialise(void);
 extern void CLG_Finalise(void);
 extern int CLG_GetClientIndex(IPAddr *client);
 extern int CLG_LogServiceAccess(CLG_Service service, IPAddr *client, struct timespec *now);
-extern int CLG_LimitServiceRate(CLG_Service service, int index);
+extern CLG_Limit CLG_LimitServiceRate(CLG_Service service, int index);
 extern void CLG_UpdateNtpStats(int auth, NTP_Timestamp_Source rx_ts_src,
                                NTP_Timestamp_Source tx_ts_src);
 extern int CLG_GetNtpMinPoll(void);

cmdmon.c

@@ -3,7 +3,7 @@
 
  **********************************************************************
  * Copyright (C) Richard P. Curnow  1997-2003
- * Copyright (C) Miroslav Lichvar  2009-2016, 2018-2021
+ * Copyright (C) Miroslav Lichvar  2009-2016, 2018-2025
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -68,85 +68,6 @@ static int bound_sock_fd4;
 /* Flag indicating whether this module has been initialised or not */
 static int initialised = 0;
 
-/* ================================================== */
-/* Array of permission levels for command types */
-
-static const char permissions[] = {
-  PERMIT_OPEN, /* NULL */
-  PERMIT_AUTH, /* ONLINE */
-  PERMIT_AUTH, /* OFFLINE */
-  PERMIT_AUTH, /* BURST */
-  PERMIT_AUTH, /* MODIFY_MINPOLL */
-  PERMIT_AUTH, /* MODIFY_MAXPOLL */
-  PERMIT_AUTH, /* DUMP */
-  PERMIT_AUTH, /* MODIFY_MAXDELAY */
-  PERMIT_AUTH, /* MODIFY_MAXDELAYRATIO */
-  PERMIT_AUTH, /* MODIFY_MAXUPDATESKEW */
-  PERMIT_OPEN, /* LOGON */
-  PERMIT_AUTH, /* SETTIME */
-  PERMIT_AUTH, /* LOCAL */
-  PERMIT_AUTH, /* MANUAL */
-  PERMIT_OPEN, /* N_SOURCES */
-  PERMIT_OPEN, /* SOURCE_DATA */
-  PERMIT_AUTH, /* REKEY */
-  PERMIT_AUTH, /* ALLOW */
-  PERMIT_AUTH, /* ALLOWALL */
-  PERMIT_AUTH, /* DENY */
-  PERMIT_AUTH, /* DENYALL */
-  PERMIT_AUTH, /* CMDALLOW */
-  PERMIT_AUTH, /* CMDALLOWALL */
-  PERMIT_AUTH, /* CMDDENY */
-  PERMIT_AUTH, /* CMDDENYALL */
-  PERMIT_AUTH, /* ACCHECK */
-  PERMIT_AUTH, /* CMDACCHECK */
-  PERMIT_AUTH, /* ADD_SERVER */
-  PERMIT_AUTH, /* ADD_PEER */
-  PERMIT_AUTH, /* DEL_SOURCE */
-  PERMIT_AUTH, /* WRITERTC */
-  PERMIT_AUTH, /* DFREQ */
-  PERMIT_AUTH, /* DOFFSET */
-  PERMIT_OPEN, /* TRACKING */
-  PERMIT_OPEN, /* SOURCESTATS */
-  PERMIT_OPEN, /* RTCREPORT */
-  PERMIT_AUTH, /* TRIMRTC */
-  PERMIT_AUTH, /* CYCLELOGS */
-  PERMIT_AUTH, /* SUBNETS_ACCESSED */
-  PERMIT_AUTH, /* CLIENT_ACCESSES (by subnet) */
-  PERMIT_AUTH, /* CLIENT_ACCESSES_BY_INDEX */
-  PERMIT_OPEN, /* MANUAL_LIST */
-  PERMIT_AUTH, /* MANUAL_DELETE */
-  PERMIT_AUTH, /* MAKESTEP */
-  PERMIT_OPEN, /* ACTIVITY */
-  PERMIT_AUTH, /* MODIFY_MINSTRATUM */
-  PERMIT_AUTH, /* MODIFY_POLLTARGET */
-  PERMIT_AUTH, /* MODIFY_MAXDELAYDEVRATIO */
-  PERMIT_AUTH, /* RESELECT */
-  PERMIT_AUTH, /* RESELECTDISTANCE */
-  PERMIT_AUTH, /* MODIFY_MAKESTEP */
-  PERMIT_OPEN, /* SMOOTHING */
-  PERMIT_AUTH, /* SMOOTHTIME */
-  PERMIT_AUTH, /* REFRESH */
-  PERMIT_AUTH, /* SERVER_STATS */
-  PERMIT_AUTH, /* CLIENT_ACCESSES_BY_INDEX2 */
-  PERMIT_AUTH, /* LOCAL2 */
-  PERMIT_AUTH, /* NTP_DATA */
-  PERMIT_AUTH, /* ADD_SERVER2 */
-  PERMIT_AUTH, /* ADD_PEER2 */
-  PERMIT_AUTH, /* ADD_SERVER3 */
-  PERMIT_AUTH, /* ADD_PEER3 */
-  PERMIT_AUTH, /* SHUTDOWN */
-  PERMIT_AUTH, /* ONOFFLINE */
-  PERMIT_AUTH, /* ADD_SOURCE */
-  PERMIT_OPEN, /* NTP_SOURCE_NAME */
-  PERMIT_AUTH, /* RESET_SOURCES */
-  PERMIT_AUTH, /* AUTH_DATA */
-  PERMIT_AUTH, /* CLIENT_ACCESSES_BY_INDEX3 */
-  PERMIT_AUTH, /* SELECT_DATA */
-  PERMIT_AUTH, /* RELOAD_SOURCES */
-  PERMIT_AUTH, /* DOFFSET2 */
-  PERMIT_AUTH, /* MODIFY_SELECTOPTS */
-};
-
 /* ================================================== */
 
 /* This authorisation table is used for checking whether particular
@@ -225,19 +146,17 @@ do_size_checks(void)
     request.command = htons(i);
     request_length = PKL_CommandLength(&request);
     padding_length = PKL_CommandPaddingLength(&request);
-    if (padding_length > MAX_PADDING_LENGTH || padding_length > request_length ||
-        request_length > sizeof (CMD_Request) ||
-        (request_length && request_length < offsetof(CMD_Request, data)))
-      assert(0);
+    BRIEF_ASSERT(padding_length <= MAX_PADDING_LENGTH && padding_length <= request_length &&
+                 request_length <= sizeof (CMD_Request) &&
+                 (request_length == 0 || request_length >= offsetof(CMD_Request, data)));
   }
 
   for (i = 1; i < N_REPLY_TYPES; i++) {
     reply.reply = htons(i);
     reply.status = STT_SUCCESS;
     reply_length = PKL_ReplyLength(&reply);
-    if ((reply_length && reply_length < offsetof(CMD_Reply, data)) ||
-        reply_length > sizeof (CMD_Reply))
-      assert(0);
+    BRIEF_ASSERT((reply_length == 0 || reply_length >= offsetof(CMD_Reply, data)) &&
+                 reply_length <= sizeof (CMD_Reply));
   }
 }
 
@@ -247,7 +166,6 @@ void
 CAM_Initialise(void)
 {
   assert(!initialised);
-  assert(sizeof (permissions) / sizeof (permissions[0]) == N_REQUEST_TYPES);
   do_size_checks();
 
   initialised = 1;
@@ -530,7 +448,10 @@ handle_local(CMD_Request *rx_message, CMD_Reply *tx_message)
   if (ntohl(rx_message->data.local.on_off)) {
     REF_EnableLocal(ntohl(rx_message->data.local.stratum),
                     UTI_FloatNetworkToHost(rx_message->data.local.distance),
-                    ntohl(rx_message->data.local.orphan));
+                    ntohl(rx_message->data.local.orphan),
+                    UTI_FloatNetworkToHost(rx_message->data.local.activate),
+                    UTI_FloatNetworkToHost(rx_message->data.local.wait_synced),
+                    UTI_FloatNetworkToHost(rx_message->data.local.wait_unsynced));
   } else {
     REF_DisableLocal();
   }
@@ -720,9 +641,10 @@ handle_add_source(CMD_Request *rx_message, CMD_Reply *tx_message)
 {
   NTP_Source_Type type;
   SourceParameters params;
+  int family, pool, port;
   NSR_Status status;
+  uint32_t flags;
   char *name;
-  int pool, port;
   
   switch (ntohl(rx_message->data.ntp_source.type)) {
     case REQ_ADDSRC_SERVER:
@@ -750,6 +672,10 @@ handle_add_source(CMD_Request *rx_message, CMD_Reply *tx_message)
       return;
   }
 
+  flags = ntohl(rx_message->data.ntp_source.flags);
+
+  family = flags & REQ_ADDSRC_IPV4 ? IPADDR_INET4 :
+           flags & REQ_ADDSRC_IPV6 ? IPADDR_INET6 : IPADDR_UNSPEC;
   port = ntohl(rx_message->data.ntp_source.port);
   params.minpoll = ntohl(rx_message->data.ntp_source.minpoll);
   params.maxpoll = ntohl(rx_message->data.ntp_source.maxpoll);
@@ -775,19 +701,19 @@ handle_add_source(CMD_Request *rx_message, CMD_Reply *tx_message)
   params.asymmetry = UTI_FloatNetworkToHost(rx_message->data.ntp_source.asymmetry);
   params.offset = UTI_FloatNetworkToHost(rx_message->data.ntp_source.offset);
 
-  params.connectivity = ntohl(rx_message->data.ntp_source.flags) & REQ_ADDSRC_ONLINE ?
-                        SRC_ONLINE : SRC_OFFLINE;
-  params.auto_offline = ntohl(rx_message->data.ntp_source.flags) & REQ_ADDSRC_AUTOOFFLINE ? 1 : 0;
-  params.iburst = ntohl(rx_message->data.ntp_source.flags) & REQ_ADDSRC_IBURST ? 1 : 0;
-  params.interleaved = ntohl(rx_message->data.ntp_source.flags) & REQ_ADDSRC_INTERLEAVED ? 1 : 0;
-  params.burst = ntohl(rx_message->data.ntp_source.flags) & REQ_ADDSRC_BURST ? 1 : 0;
-  params.nts = ntohl(rx_message->data.ntp_source.flags) & REQ_ADDSRC_NTS ? 1 : 0;
-  params.copy = ntohl(rx_message->data.ntp_source.flags) & REQ_ADDSRC_COPY ? 1 : 0;
-  params.ext_fields =
-    ntohl(rx_message->data.ntp_source.flags) & REQ_ADDSRC_EF_EXP1 ? NTP_EF_FLAG_EXP1 : 0;
+  params.connectivity = flags & REQ_ADDSRC_ONLINE ? SRC_ONLINE : SRC_OFFLINE;
+  params.auto_offline = !!(flags & REQ_ADDSRC_AUTOOFFLINE);
+  params.iburst = !!(flags & REQ_ADDSRC_IBURST);
+  params.interleaved = !!(flags & REQ_ADDSRC_INTERLEAVED);
+  params.burst = !!(flags & REQ_ADDSRC_BURST);
+  params.nts = !!(flags & REQ_ADDSRC_NTS);
+  params.copy = !!(flags & REQ_ADDSRC_COPY);
+  params.ext_fields = (flags & REQ_ADDSRC_EF_EXP_MONO_ROOT ? NTP_EF_FLAG_EXP_MONO_ROOT : 0) |
+                      (flags & REQ_ADDSRC_EF_EXP_NET_CORRECTION ?
+                       NTP_EF_FLAG_EXP_NET_CORRECTION : 0);
   params.sel_options = convert_addsrc_select_options(ntohl(rx_message->data.ntp_source.flags));
 
-  status = NSR_AddSourceByName(name, port, pool, type, &params, NULL);
+  status = NSR_AddSourceByName(name, family, port, pool, type, &params, NULL);
   switch (status) {
     case NSR_Success:
       break;
@@ -805,6 +731,8 @@ handle_add_source(CMD_Request *rx_message, CMD_Reply *tx_message)
       tx_message->status = htons(STT_INVALIDNAME);
       break;
     case NSR_InvalidAF:
+      tx_message->status = htons(STT_INVALIDAF);
+      break;
     case NSR_NoSuchSource:
       assert(0);
       break;
@@ -1223,7 +1151,7 @@ handle_ntp_data(CMD_Request *rx_message, CMD_Reply *tx_message)
     return;
   }
 
-  tx_message->reply = htons(RPY_NTP_DATA);
+  tx_message->reply = htons(RPY_NTP_DATA2);
   UTI_IPHostToNetwork(&report.remote_addr, &tx_message->data.ntp_data.remote_addr);
   UTI_IPHostToNetwork(&report.local_addr, &tx_message->data.ntp_data.local_addr);
   tx_message->data.ntp_data.remote_port = htons(report.remote_port);
@@ -1251,6 +1179,10 @@ handle_ntp_data(CMD_Request *rx_message, CMD_Reply *tx_message)
   tx_message->data.ntp_data.total_rx_count = htonl(report.total_rx_count);
   tx_message->data.ntp_data.total_valid_count = htonl(report.total_valid_count);
   tx_message->data.ntp_data.total_good_count = htonl(report.total_good_count);
+  tx_message->data.ntp_data.total_kernel_tx_ts = htonl(report.total_kernel_tx_ts);
+  tx_message->data.ntp_data.total_kernel_rx_ts = htonl(report.total_kernel_rx_ts);
+  tx_message->data.ntp_data.total_hw_tx_ts = htonl(report.total_hw_tx_ts);
+  tx_message->data.ntp_data.total_hw_rx_ts = htonl(report.total_hw_rx_ts);
   memset(tx_message->data.ntp_data.reserved, 0xff, sizeof (tx_message->data.ntp_data.reserved));
 }
 
@@ -1407,18 +1339,260 @@ handle_modify_selectopts(CMD_Request *rx_message, CMD_Reply *tx_message)
     tx_message->status = htons(STT_NOSUCHSOURCE);
 }
 
+/* ================================================== */
+
+static void
+handle_modify_offset(CMD_Request *rx_message, CMD_Reply *tx_message)
+{
+  uint32_t ref_id;
+  IPAddr ip_addr;
+  double offset;
+
+  UTI_IPNetworkToHost(&rx_message->data.modify_offset.address, &ip_addr);
+  ref_id = ntohl(rx_message->data.modify_offset.ref_id);
+  offset = UTI_FloatNetworkToHost(rx_message->data.modify_offset.new_offset);
+
+  if ((ip_addr.family != IPADDR_UNSPEC && !NSR_ModifyOffset(&ip_addr, offset)) ||
+      (ip_addr.family == IPADDR_UNSPEC && !RCL_ModifyOffset(ref_id, offset)))
+    tx_message->status = htons(STT_NOSUCHSOURCE);
+}
+
+/* ================================================== */
+
+static int
+handle_readwrite_commands(int command, CMD_Request *request, CMD_Reply *reply)
+{
+  switch (command) {
+    case REQ_ADD_SOURCE:
+      handle_add_source(request, reply);
+      break;
+    case REQ_ALLOW:
+      handle_allowdeny(request, reply, 1, 0);
+      break;
+    case REQ_ALLOWALL:
+      handle_allowdeny(request, reply, 1, 1);
+      break;
+    case REQ_BURST:
+      handle_burst(request, reply);
+      break;
+    case REQ_CMDALLOW:
+      handle_cmdallowdeny(request, reply, 1, 0);
+      break;
+    case REQ_CMDALLOWALL:
+      handle_cmdallowdeny(request, reply, 1, 1);
+      break;
+    case REQ_CMDDENY:
+      handle_cmdallowdeny(request, reply, 0, 0);
+      break;
+    case REQ_CMDDENYALL:
+      handle_cmdallowdeny(request, reply, 0, 1);
+      break;
+    case REQ_CYCLELOGS:
+      handle_cyclelogs(request, reply);
+      break;
+    case REQ_DEL_SOURCE:
+      handle_del_source(request, reply);
+      break;
+    case REQ_DENY:
+      handle_allowdeny(request, reply, 0, 0);
+      break;
+    case REQ_DENYALL:
+      handle_allowdeny(request, reply, 0, 1);
+      break;
+    case REQ_DFREQ:
+      handle_dfreq(request, reply);
+      break;
+    case REQ_DOFFSET2:
+      handle_doffset(request, reply);
+      break;
+    case REQ_DUMP:
+      handle_dump(request, reply);
+      break;
+    case REQ_LOCAL3:
+      handle_local(request, reply);
+      break;
+    case REQ_MAKESTEP:
+      handle_make_step(request, reply);
+      break;
+    case REQ_MANUAL:
+      handle_manual(request, reply);
+      break;
+    case REQ_MANUAL_DELETE:
+      handle_manual_delete(request, reply);
+      break;
+    case REQ_MODIFY_MAKESTEP:
+      handle_modify_makestep(request, reply);
+      break;
+    case REQ_MODIFY_MAXDELAY:
+      handle_modify_maxdelay(request, reply);
+      break;
+    case REQ_MODIFY_MAXDELAYDEVRATIO:
+      handle_modify_maxdelaydevratio(request, reply);
+      break;
+    case REQ_MODIFY_MAXDELAYRATIO:
+      handle_modify_maxdelayratio(request, reply);
+      break;
+    case REQ_MODIFY_MAXPOLL:
+      handle_modify_maxpoll(request, reply);
+      break;
+    case REQ_MODIFY_MAXUPDATESKEW:
+      handle_modify_maxupdateskew(request, reply);
+      break;
+    case REQ_MODIFY_MINPOLL:
+      handle_modify_minpoll(request, reply);
+      break;
+    case REQ_MODIFY_MINSTRATUM:
+      handle_modify_minstratum(request, reply);
+      break;
+    case REQ_MODIFY_OFFSET:
+      handle_modify_offset(request, reply);
+      break;
+    case REQ_MODIFY_POLLTARGET:
+      handle_modify_polltarget(request, reply);
+      break;
+    case REQ_MODIFY_SELECTOPTS:
+      handle_modify_selectopts(request, reply);
+      break;
+    case REQ_OFFLINE:
+      handle_offline(request, reply);
+      break;
+    case REQ_ONLINE:
+      handle_online(request, reply);
+      break;
+    case REQ_ONOFFLINE:
+      handle_onoffline(request, reply);
+      break;
+    case REQ_REFRESH:
+      handle_refresh(request, reply);
+      break;
+    case REQ_REKEY:
+      handle_rekey(request, reply);
+      break;
+    case REQ_RELOAD_SOURCES:
+      handle_reload_sources(request, reply);
+      break;
+    case REQ_RESELECT:
+      handle_reselect(request, reply);
+      break;
+    case REQ_RESELECTDISTANCE:
+      handle_reselect_distance(request, reply);
+      break;
+    case REQ_RESET_SOURCES:
+      handle_reset_sources(request, reply);
+      break;
+    case REQ_SETTIME:
+      handle_settime(request, reply);
+      break;
+    case REQ_SHUTDOWN:
+      handle_shutdown(request, reply);
+      break;
+    case REQ_SMOOTHTIME:
+      handle_smoothtime(request, reply);
+      break;
+    case REQ_TRIMRTC:
+      handle_trimrtc(request, reply);
+      break;
+    case REQ_WRITERTC:
+      handle_writertc(request, reply);
+      break;
+    default:
+      return 0;
+  }
+
+  return 1;
+}
+
+/* ================================================== */
+
+static int
+handle_readonly_commands(int command, int full_access, CMD_Request *request, CMD_Reply *reply)
+{
+  ARR_Instance open_commands;
+  int i, allowed = 0;
+
+  if (full_access) {
+    allowed = 1;
+  } else {
+    open_commands = CNF_GetOpenCommands();
+
+    for (i = 0; i < ARR_GetSize(open_commands); i++) {
+      if (*(int *)ARR_GetElement(open_commands, i) == command) {
+        allowed = 1;
+        break;
+      }
+    }
+  }
+
+  if (!allowed)
+    return 0;
+
+  switch (command) {
+    case REQ_ACCHECK:
+      handle_accheck(request, reply);
+      break;
+    case REQ_ACTIVITY:
+      handle_activity(request, reply);
+      break;
+    case REQ_AUTH_DATA:
+      handle_auth_data(request, reply);
+      break;
+    case REQ_CLIENT_ACCESSES_BY_INDEX3:
+      handle_client_accesses_by_index(request, reply);
+      break;
+    case REQ_CMDACCHECK:
+      handle_cmdaccheck(request, reply);
+      break;
+    case REQ_MANUAL_LIST:
+      handle_manual_list(request, reply);
+      break;
+    case REQ_NTP_DATA:
+      handle_ntp_data(request, reply);
+      break;
+    case REQ_NTP_SOURCE_NAME:
+      handle_ntp_source_name(request, reply);
+      break;
+    case REQ_N_SOURCES:
+      handle_n_sources(request, reply);
+      break;
+    case REQ_RTCREPORT:
+      handle_rtcreport(request, reply);
+      break;
+    case REQ_SELECT_DATA:
+      handle_select_data(request, reply);
+      break;
+    case REQ_SERVER_STATS:
+      handle_server_stats(request, reply);
+      break;
+    case REQ_SMOOTHING:
+      handle_smoothing(request, reply);
+      break;
+    case REQ_SOURCESTATS:
+      handle_sourcestats(request, reply);
+      break;
+    case REQ_SOURCE_DATA:
+      handle_source_data(request, reply);
+      break;
+    case REQ_TRACKING:
+      handle_tracking(request, reply);
+      break;
+    default:
+      return 0;
+  }
+
+  return 1;
+}
+
 /* ================================================== */
 /* Read a packet and process it */
 
 static void
 read_from_cmd_socket(int sock_fd, int event, void *anything)
 {
+  int read_length, expected_length, localhost, log_index, full_access, handled;
   SCK_Message *sck_message;
   CMD_Request rx_message;
   CMD_Reply tx_message;
   IPAddr loopback_addr, remote_ip;
-  int read_length, expected_length;
-  int localhost, allowed, log_index;
   uint16_t rx_command;
   struct timespec now, cooked_now;
 
@@ -1431,32 +1605,27 @@ read_from_cmd_socket(int sock_fd, int event, void *anything)
   /* Get current time cheaply */
   SCH_GetLastEventTime(&cooked_now, NULL, &now);
 
-  /* Check if it's from localhost (127.0.0.1, ::1, or Unix domain),
-     or an authorised address */
-  switch (sck_message->addr_type) {
-    case SCK_ADDR_IP:
-      assert(sock_fd == sock_fd4 || sock_fd == sock_fd6);
-      remote_ip = sck_message->remote_addr.ip.ip_addr;
-      SCK_GetLoopbackIPAddress(remote_ip.family, &loopback_addr);
-      localhost = UTI_CompareIPs(&remote_ip, &loopback_addr, NULL) == 0;
+  /* Check if the request came from the Unix domain socket, or network and
+     whether the address is allowed (127.0.0.1 and ::1 is always allowed) */
+  if ((sock_fd == sock_fd4 || sock_fd == sock_fd6) && sck_message->addr_type == SCK_ADDR_IP) {
+    remote_ip = sck_message->remote_addr.ip.ip_addr;
+    SCK_GetLoopbackIPAddress(remote_ip.family, &loopback_addr);
+    localhost = UTI_CompareIPs(&remote_ip, &loopback_addr, NULL) == 0;
 
-      if (!localhost && !ADF_IsAllowed(access_auth_table, &remote_ip)) {
-        DEBUG_LOG("Unauthorised host %s",
-                  UTI_IPSockAddrToString(&sck_message->remote_addr.ip));
-        return;
-      }
-
-      assert(remote_ip.family != IPADDR_UNSPEC);
-
-      break;
-    case SCK_ADDR_UNIX:
-      assert(sock_fd == sock_fdu);
-      remote_ip.family = IPADDR_UNSPEC;
-      localhost = 1;
-      break;
-    default:
-      DEBUG_LOG("Unexpected address type");
+    if (!localhost && !ADF_IsAllowed(access_auth_table, &remote_ip)) {
+      DEBUG_LOG("Unauthorised host %s",
+                UTI_IPSockAddrToString(&sck_message->remote_addr.ip));
       return;
+    }
+
+    full_access = 0;
+  } else if (sock_fd == sock_fdu && sck_message->addr_type == SCK_ADDR_UNIX) {
+    remote_ip.family = IPADDR_UNSPEC;
+    localhost = 1;
+    full_access = 1;
+  } else {
+    DEBUG_LOG("Unexpected socket/address");
+    return;
   }
 
   if (read_length < offsetof(CMD_Request, data) ||
@@ -1481,9 +1650,10 @@ read_from_cmd_socket(int sock_fd, int event, void *anything)
 
   /* Don't reply to all requests from hosts other than localhost if the rate
      is excessive */
-  if (!localhost && log_index >= 0 && CLG_LimitServiceRate(CLG_CMDMON, log_index)) {
-      DEBUG_LOG("Command packet discarded to limit response rate");
-      return;
+  if (!localhost && log_index >= 0 &&
+      CLG_LimitServiceRate(CLG_CMDMON, log_index) != CLG_PASS) {
+    DEBUG_LOG("Command packet discarded to limit response rate");
+    return;
   }
 
   expected_length = PKL_CommandLength(&rx_message);
@@ -1531,293 +1701,20 @@ read_from_cmd_socket(int sock_fd, int event, void *anything)
 
   /* OK, we have a valid message.  Now dispatch on message type and process it. */
 
-  if (rx_command >= N_REQUEST_TYPES) {
-    /* This should be already handled */
-    assert(0);
-  } else {
-    /* Check level of authority required to issue the command.  All commands
-       from the Unix domain socket (which is accessible only by the root and
-       chrony user/group) are allowed. */
-    if (remote_ip.family == IPADDR_UNSPEC) {
-      assert(sock_fd == sock_fdu);
-      allowed = 1;
-    } else {
-      switch (permissions[rx_command]) {
-        case PERMIT_AUTH:
-          allowed = 0;
-          break;
-        case PERMIT_LOCAL:
-          allowed = localhost;
-          break;
-        case PERMIT_OPEN:
-          allowed = 1;
-          break;
-        default:
-          assert(0);
-          allowed = 0;
-      }
-    }
+  LOG_SetContext(LOGC_Command);
 
-    if (allowed) {
-      LOG_SetContext(LOGC_Command);
+  if (full_access)
+    handled = handle_readwrite_commands(rx_command, &rx_message, &tx_message);
+  else
+    handled = 0;
 
-      switch(rx_command) {
-        case REQ_NULL:
-          /* Do nothing */
-          break;
+  if (!handled)
+    handled = handle_readonly_commands(rx_command, full_access, &rx_message, &tx_message);
 
-        case REQ_DUMP:
-          handle_dump(&rx_message, &tx_message);
-          break;
+  if (!handled)
+    tx_message.status = htons(STT_UNAUTH);
 
-        case REQ_ONLINE:
-          handle_online(&rx_message, &tx_message);
-          break;
-
-        case REQ_OFFLINE:
-          handle_offline(&rx_message, &tx_message);
-          break;
-
-        case REQ_BURST:
-          handle_burst(&rx_message, &tx_message);
-          break;
-
-        case REQ_MODIFY_MINPOLL:
-          handle_modify_minpoll(&rx_message, &tx_message);
-          break;
-
-        case REQ_MODIFY_MAXPOLL:
-          handle_modify_maxpoll(&rx_message, &tx_message);
-          break;
-
-        case REQ_MODIFY_MAXDELAY:
-          handle_modify_maxdelay(&rx_message, &tx_message);
-          break;
-
-        case REQ_MODIFY_MAXDELAYRATIO:
-          handle_modify_maxdelayratio(&rx_message, &tx_message);
-          break;
-
-        case REQ_MODIFY_MAXDELAYDEVRATIO:
-          handle_modify_maxdelaydevratio(&rx_message, &tx_message);
-          break;
-
-        case REQ_MODIFY_MAXUPDATESKEW:
-          handle_modify_maxupdateskew(&rx_message, &tx_message);
-          break;
-
-        case REQ_MODIFY_MAKESTEP:
-          handle_modify_makestep(&rx_message, &tx_message);
-          break;
-
-        case REQ_LOGON:
-          /* Authentication is no longer supported, log-on always fails */
-          tx_message.status = htons(STT_FAILED);
-          break;
-
-        case REQ_SETTIME:
-          handle_settime(&rx_message, &tx_message);
-          break;
-        
-        case REQ_LOCAL2:
-          handle_local(&rx_message, &tx_message);
-          break;
-
-        case REQ_MANUAL:
-          handle_manual(&rx_message, &tx_message);
-          break;
-
-        case REQ_N_SOURCES:
-          handle_n_sources(&rx_message, &tx_message);
-          break;
-
-        case REQ_SOURCE_DATA:
-          handle_source_data(&rx_message, &tx_message);
-          break;
-
-        case REQ_REKEY:
-          handle_rekey(&rx_message, &tx_message);
-          break;
-
-        case REQ_ALLOW:
-          handle_allowdeny(&rx_message, &tx_message, 1, 0);
-          break;
-
-        case REQ_ALLOWALL:
-          handle_allowdeny(&rx_message, &tx_message, 1, 1);
-          break;
-
-        case REQ_DENY:
-          handle_allowdeny(&rx_message, &tx_message, 0, 0);
-          break;
-
-        case REQ_DENYALL:
-          handle_allowdeny(&rx_message, &tx_message, 0, 1);
-          break;
-
-        case REQ_CMDALLOW:
-          handle_cmdallowdeny(&rx_message, &tx_message, 1, 0);
-          break;
-
-        case REQ_CMDALLOWALL:
-          handle_cmdallowdeny(&rx_message, &tx_message, 1, 1);
-          break;
-
-        case REQ_CMDDENY:
-          handle_cmdallowdeny(&rx_message, &tx_message, 0, 0);
-          break;
-
-        case REQ_CMDDENYALL:
-          handle_cmdallowdeny(&rx_message, &tx_message, 0, 1);
-          break;
-
-        case REQ_ACCHECK:
-          handle_accheck(&rx_message, &tx_message);
-          break;
-
-        case REQ_CMDACCHECK:
-          handle_cmdaccheck(&rx_message, &tx_message);
-          break;
-
-        case REQ_ADD_SOURCE:
-          handle_add_source(&rx_message, &tx_message);
-          break;
-
-        case REQ_DEL_SOURCE:
-          handle_del_source(&rx_message, &tx_message);
-          break;
-
-        case REQ_WRITERTC:
-          handle_writertc(&rx_message, &tx_message);
-          break;
-          
-        case REQ_DFREQ:
-          handle_dfreq(&rx_message, &tx_message);
-          break;
-
-        case REQ_DOFFSET2:
-          handle_doffset(&rx_message, &tx_message);
-          break;
-
-        case REQ_TRACKING:
-          handle_tracking(&rx_message, &tx_message);
-          break;
-
-        case REQ_SMOOTHING:
-          handle_smoothing(&rx_message, &tx_message);
-          break;
-
-        case REQ_SMOOTHTIME:
-          handle_smoothtime(&rx_message, &tx_message);
-          break;
-
-        case REQ_SOURCESTATS:
-          handle_sourcestats(&rx_message, &tx_message);
-          break;
-
-        case REQ_RTCREPORT:
-          handle_rtcreport(&rx_message, &tx_message);
-          break;
-          
-        case REQ_TRIMRTC:
-          handle_trimrtc(&rx_message, &tx_message);
-          break;
-
-        case REQ_CYCLELOGS:
-          handle_cyclelogs(&rx_message, &tx_message);
-          break;
-
-        case REQ_CLIENT_ACCESSES_BY_INDEX3:
-          handle_client_accesses_by_index(&rx_message, &tx_message);
-          break;
-
-        case REQ_MANUAL_LIST:
-          handle_manual_list(&rx_message, &tx_message);
-          break;
-
-        case REQ_MANUAL_DELETE:
-          handle_manual_delete(&rx_message, &tx_message);
-          break;
-
-        case REQ_MAKESTEP:
-          handle_make_step(&rx_message, &tx_message);
-          break;
-
-        case REQ_ACTIVITY:
-          handle_activity(&rx_message, &tx_message);
-          break;
-
-        case REQ_RESELECTDISTANCE:
-          handle_reselect_distance(&rx_message, &tx_message);
-          break;
-
-        case REQ_RESELECT:
-          handle_reselect(&rx_message, &tx_message);
-          break;
-
-        case REQ_MODIFY_MINSTRATUM:
-          handle_modify_minstratum(&rx_message, &tx_message);
-          break;
-
-        case REQ_MODIFY_POLLTARGET:
-          handle_modify_polltarget(&rx_message, &tx_message);
-          break;
-
-        case REQ_REFRESH:
-          handle_refresh(&rx_message, &tx_message);
-          break;
-
-        case REQ_SERVER_STATS:
-          handle_server_stats(&rx_message, &tx_message);
-          break;
-
-        case REQ_NTP_DATA:
-          handle_ntp_data(&rx_message, &tx_message);
-          break;
-
-        case REQ_SHUTDOWN:
-          handle_shutdown(&rx_message, &tx_message);
-          break;
-
-        case REQ_ONOFFLINE:
-          handle_onoffline(&rx_message, &tx_message);
-          break;
-
-        case REQ_NTP_SOURCE_NAME:
-          handle_ntp_source_name(&rx_message, &tx_message);
-          break;
-
-        case REQ_RESET_SOURCES:
-          handle_reset_sources(&rx_message, &tx_message);
-          break;
-
-        case REQ_AUTH_DATA:
-          handle_auth_data(&rx_message, &tx_message);
-          break;
-
-        case REQ_SELECT_DATA:
-          handle_select_data(&rx_message, &tx_message);
-          break;
-
-        case REQ_RELOAD_SOURCES:
-          handle_reload_sources(&rx_message, &tx_message);
-          break;
-
-        case REQ_MODIFY_SELECTOPTS:
-          handle_modify_selectopts(&rx_message, &tx_message);
-          break;
-
-        default:
-          DEBUG_LOG("Unhandled command %d", rx_command);
-          tx_message.status = htons(STT_FAILED);
-          break;
-      }
-
-      LOG_UnsetContext(LOGC_Command);
-    } else {
-      tx_message.status = htons(STT_UNAUTH);
-    }
-  }
+  LOG_UnsetContext(LOGC_Command);
 
   /* Transmit the response */
   transmit_reply(sock_fd, read_length, sck_message);

cmdparse.c

@@ -39,13 +39,19 @@
 
 /* ================================================== */
 
-int
+#define SSCANF_IN_RANGE(s, f, x, n, min, max) \
+  (sscanf((s), (f), (x), (n)) == 1 && *(x) >= (min) && *(x) <= (max))
+
+/* ================================================== */
+
+CPS_Status
 CPS_ParseNTPSourceAdd(char *line, CPS_NTP_Source *src)
 {
   char *hostname, *cmd;
   uint32_t ef_type;
   int n, sel_option;
   
+  src->family = IPADDR_UNSPEC;
   src->port = SRC_DEFAULT_PORT;
   src->params.minpoll = SRC_DEFAULT_MINPOLL;
   src->params.maxpoll = SRC_DEFAULT_MAXPOLL;
@@ -81,7 +87,7 @@ CPS_ParseNTPSourceAdd(char *line, CPS_NTP_Source *src)
   line = CPS_SplitWord(line);
 
   if (!*hostname)
-    return 0;
+    return CPS_MissingArgument;
 
   src->name = hostname;
 
@@ -103,90 +109,97 @@ CPS_ParseNTPSourceAdd(char *line, CPS_NTP_Source *src)
       src->params.connectivity = SRC_OFFLINE;
     } else if (!strcasecmp(cmd, "certset")) {
       if (sscanf(line, "%"SCNu32"%n", &src->params.cert_set, &n) != 1)
-        return 0;
+        return CPS_InvalidValue;
     } else if (!strcasecmp(cmd, "key")) {
       if (sscanf(line, "%"SCNu32"%n", &src->params.authkey, &n) != 1 ||
           src->params.authkey == INACTIVE_AUTHKEY)
-        return 0;
+        return CPS_InvalidValue;
     } else if (!strcasecmp(cmd, "asymmetry")) {
       if (sscanf(line, "%lf%n", &src->params.asymmetry, &n) != 1)
-        return 0;
+        return CPS_InvalidValue;
     } else if (!strcasecmp(cmd, "extfield")) {
       if (sscanf(line, "%"SCNx32"%n", &ef_type, &n) != 1)
-        return 0;
+        return CPS_InvalidValue;
       switch (ef_type) {
-        case NTP_EF_EXP1:
-          src->params.ext_fields |= NTP_EF_FLAG_EXP1;
+        case NTP_EF_EXP_MONO_ROOT:
+          src->params.ext_fields |= NTP_EF_FLAG_EXP_MONO_ROOT;
+          break;
+        case NTP_EF_EXP_NET_CORRECTION:
+          src->params.ext_fields |= NTP_EF_FLAG_EXP_NET_CORRECTION;
           break;
         default:
-          return 0;
+          return CPS_InvalidValue;
       }
     } else if (!strcasecmp(cmd, "filter")) {
-      if (sscanf(line, "%d%n", &src->params.filter_length, &n) != 1)
-        return 0;
+      if (!SSCANF_IN_RANGE(line, "%d%n", &src->params.filter_length, &n, 0, INT_MAX))
+        return CPS_InvalidValue;
+    } else if (!strcasecmp(cmd, "ipv4")) {
+      src->family = IPADDR_INET4;
+    } else if (!strcasecmp(cmd, "ipv6")) {
+      src->family = IPADDR_INET6;
     } else if (!strcasecmp(cmd, "maxdelay")) {
       if (sscanf(line, "%lf%n", &src->params.max_delay, &n) != 1)
-        return 0;
+        return CPS_InvalidValue;
     } else if (!strcasecmp(cmd, "maxdelayratio")) {
       if (sscanf(line, "%lf%n", &src->params.max_delay_ratio, &n) != 1)
-        return 0;
+        return CPS_InvalidValue;
     } else if (!strcasecmp(cmd, "maxdelaydevratio")) {
       if (sscanf(line, "%lf%n", &src->params.max_delay_dev_ratio, &n) != 1)
-        return 0;
+        return CPS_InvalidValue;
     } else if (!strcasecmp(cmd, "maxdelayquant")) {
       if (sscanf(line, "%lf%n", &src->params.max_delay_quant, &n) != 1)
-        return 0;
+        return CPS_InvalidValue;
     } else if (!strcasecmp(cmd, "maxpoll")) {
-      if (sscanf(line, "%d%n", &src->params.maxpoll, &n) != 1)
-        return 0;
+      if (!SSCANF_IN_RANGE(line, "%d%n", &src->params.maxpoll, &n, -32, 32))
+        return CPS_InvalidValue;
     } else if (!strcasecmp(cmd, "maxsamples")) {
-      if (sscanf(line, "%d%n", &src->params.max_samples, &n) != 1)
-        return 0;
+      if (!SSCANF_IN_RANGE(line, "%d%n", &src->params.max_samples, &n, 0, INT_MAX))
+        return CPS_InvalidValue;
     } else if (!strcasecmp(cmd, "maxsources")) {
-      if (sscanf(line, "%d%n", &src->params.max_sources, &n) != 1)
-        return 0;
+      if (!SSCANF_IN_RANGE(line, "%d%n", &src->params.max_sources, &n, 1, INT_MAX))
+        return CPS_InvalidValue;
     } else if (!strcasecmp(cmd, "mindelay")) {
       if (sscanf(line, "%lf%n", &src->params.min_delay, &n) != 1)
-        return 0;
+        return CPS_InvalidValue;
     } else if (!strcasecmp(cmd, "minpoll")) {
       if (sscanf(line, "%d%n", &src->params.minpoll, &n) != 1)
-        return 0;
+        return CPS_InvalidValue;
     } else if (!strcasecmp(cmd, "minsamples")) {
-      if (sscanf(line, "%d%n", &src->params.min_samples, &n) != 1)
-        return 0;
+      if (!SSCANF_IN_RANGE(line, "%d%n", &src->params.min_samples, &n, 0, INT_MAX))
+        return CPS_InvalidValue;
     } else if (!strcasecmp(cmd, "minstratum")) {
-      if (sscanf(line, "%d%n", &src->params.min_stratum, &n) != 1)
-        return 0;
+      if (!SSCANF_IN_RANGE(line, "%d%n", &src->params.min_stratum, &n, 0, NTP_MAX_STRATUM))
+        return CPS_InvalidValue;
     } else if (!strcasecmp(cmd, "nts")) {
       src->params.nts = 1;
     } else if (!strcasecmp(cmd, "ntsport")) {
-      if (sscanf(line, "%d%n", &src->params.nts_port, &n) != 1)
-        return 0;
+      if (!SSCANF_IN_RANGE(line, "%d%n", &src->params.nts_port, &n, 0, 65535))
+        return CPS_InvalidValue;
     } else if (!strcasecmp(cmd, "offset")) {
       if (sscanf(line, "%lf%n", &src->params.offset, &n) != 1)
-        return 0;
+        return CPS_InvalidValue;
     } else if (!strcasecmp(cmd, "port")) {
-      if (sscanf(line, "%d%n", &src->port, &n) != 1)
-        return 0;
+      if (!SSCANF_IN_RANGE(line, "%d%n", &src->port, &n, 0, 65535))
+        return CPS_InvalidValue;
     } else if (!strcasecmp(cmd, "polltarget")) {
-      if (sscanf(line, "%d%n", &src->params.poll_target, &n) != 1)
-        return 0;
+      if (!SSCANF_IN_RANGE(line, "%d%n", &src->params.poll_target, &n, 1, INT_MAX))
+        return CPS_InvalidValue;
     } else if (!strcasecmp(cmd, "presend")) {
-      if (sscanf(line, "%d%n", &src->params.presend_minpoll, &n) != 1)
-        return 0;
+      if (!SSCANF_IN_RANGE(line, "%d%n", &src->params.presend_minpoll, &n, -32, 32))
+        return CPS_InvalidValue;
     } else if (!strcasecmp(cmd, "version")) {
-      if (sscanf(line, "%d%n", &src->params.version, &n) != 1)
-        return 0;
+      if (!SSCANF_IN_RANGE(line, "%d%n", &src->params.version, &n, 1, NTP_VERSION))
+        return CPS_InvalidValue;
     } else if (!strcasecmp(cmd, "xleave")) {
       src->params.interleaved = 1;
     } else if ((sel_option = CPS_GetSelectOption(cmd)) != 0) {
       src->params.sel_options |= sel_option;
     } else {
-      return 0;
+      return CPS_InvalidOption;
     }
   }
 
-  return 1;
+  return CPS_Success;
 }
 
 /* ================================================== */
@@ -287,38 +300,53 @@ CPS_ParseAllowDeny(char *line, int *all, IPAddr *ip, int *subnet_bits)
 
 /* ================================================== */
 
-int
-CPS_ParseLocal(char *line, int *stratum, int *orphan, double *distance)
+CPS_Status
+CPS_ParseLocal(char *line, int *stratum, int *orphan, double *distance, double *activate,
+               double *wait_synced, double *wait_unsynced)
 {
   int n;
   char *cmd;
 
   *stratum = 10;
   *distance = 1.0;
+  *activate = 0.0;
   *orphan = 0;
+  *wait_synced = 0;
+  *wait_unsynced = -1.0;
 
   while (*line) {
     cmd = line;
     line = CPS_SplitWord(line);
 
     if (!strcasecmp(cmd, "stratum")) {
-      if (sscanf(line, "%d%n", stratum, &n) != 1 ||
-          *stratum >= NTP_MAX_STRATUM || *stratum <= 0)
-        return 0;
+      if (!SSCANF_IN_RANGE(line, "%d%n", stratum, &n, 1, NTP_MAX_STRATUM - 1))
+        return CPS_InvalidValue;
     } else if (!strcasecmp(cmd, "orphan")) {
       *orphan = 1;
       n = 0;
     } else if (!strcasecmp(cmd, "distance")) {
       if (sscanf(line, "%lf%n", distance, &n) != 1)
-        return 0;
+        return CPS_InvalidValue;
+    } else if (!strcasecmp(cmd, "activate")) {
+      if (sscanf(line, "%lf%n", activate, &n) != 1)
+        return CPS_InvalidValue;
+    } else if (!strcasecmp(cmd, "waitsynced")) {
+      if (sscanf(line, "%lf%n", wait_synced, &n) != 1)
+        return CPS_InvalidValue;
+    } else if (!strcasecmp(cmd, "waitunsynced")) {
+      if (sscanf(line, "%lf%n", wait_unsynced, &n) != 1)
+        return CPS_InvalidValue;
     } else {
-      return 0;
+      return CPS_InvalidOption;
     }
 
     line += n;
   }
 
-  return 1;
+  if (*wait_unsynced < 0.0)
+    *wait_unsynced = *orphan ? 300 : 0.0;
+
+  return CPS_Success;
 }
 
 /* ================================================== */

cmdparse.h

@@ -30,14 +30,22 @@
 #include "srcparams.h"
 #include "addressing.h"
 
+typedef enum {
+  CPS_Success,
+  CPS_InvalidValue,
+  CPS_InvalidOption,
+  CPS_MissingArgument,
+} CPS_Status;
+
 typedef struct {
   char *name;
+  int family;
   int port;
   SourceParameters params;
 } CPS_NTP_Source;
 
 /* Parse a command to add an NTP server or peer */
-extern int CPS_ParseNTPSourceAdd(char *line, CPS_NTP_Source *src);
+extern CPS_Status CPS_ParseNTPSourceAdd(char *line, CPS_NTP_Source *src);
   
 /* Get an NTP/refclock select option */
 extern int CPS_GetSelectOption(char *option);
@@ -46,7 +54,8 @@ extern int CPS_GetSelectOption(char *option);
 extern int CPS_ParseAllowDeny(char *line, int *all, IPAddr *ip, int *subnet_bits);
 
 /* Parse a command to enable local reference */
-extern int CPS_ParseLocal(char *line, int *stratum, int *orphan, double *distance);
+extern CPS_Status CPS_ParseLocal(char *line, int *stratum, int *orphan, double *distance,
+                                 double *activate, double *wait_synced, double *wait_unsynced);
 
 /* Remove extra white-space and comments */
 extern void CPS_NormalizeLine(char *line);

conf.c

@@ -3,7 +3,7 @@
 
  **********************************************************************
  * Copyright (C) Richard P. Curnow  1997-2003
- * Copyright (C) Miroslav Lichvar  2009-2017, 2020
+ * Copyright (C) Miroslav Lichvar  2009-2017, 2020, 2024-2025
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -50,13 +50,17 @@
 #define MAX_CONF_DIRS 10
 #define MAX_INCLUDE_LEVEL 10
 
+#define SSCANF_IN_RANGE(s, f, x, n, min, max) \
+  (sscanf((s), (f), (x), (n)) == 1 && *(x) >= (min) && *(x) <= (max))
+
 /* ================================================== */
 /* Forward prototypes */
 
-static int parse_string(char *line, char **result);
-static int parse_int(char *line, int *result);
-static int parse_double(char *line, double *result);
-static int parse_null(char *line);
+static void parse_string(char *line, char **result);
+static void parse_int(char *line, int *result, int min, int max);
+static void parse_double(char *line, double *result);
+static void parse_null(char *line, int *result);
+static void parse_ints(char *line, ARR_Instance array, int min, int max);
 
 static void parse_allow_deny(char *line, ARR_Instance restrictions, int allow);
 static void parse_authselectmode(char *);
@@ -66,6 +70,7 @@ static void parse_bindcmdaddress(char *);
 static void parse_broadcast(char *);
 static void parse_clientloglimit(char *);
 static void parse_confdir(char *);
+static void parse_driftfile(char *);
 static void parse_fallbackdrift(char *);
 static void parse_hwtimestamp(char *);
 static void parse_include(char *);
@@ -78,8 +83,10 @@ static void parse_makestep(char *);
 static void parse_maxchange(char *);
 static void parse_ntsserver(char *, ARR_Instance files);
 static void parse_ntstrustedcerts(char *);
+static void parse_open_commands(char *line);
+static void parse_pidfile(char *line);
 static void parse_ratelimit(char *line, int *enabled, int *interval,
-                            int *burst, int *leak);
+                            int *burst, int *leak, int *kod);
 static void parse_refclock(char *);
 static void parse_smoothtime(char *);
 static void parse_source(char *line, char *type, int fatal);
@@ -96,6 +103,7 @@ static int acquisition_port = -1;
 static int ntp_port = NTP_PORT;
 static char *keys_file = NULL;
 static char *drift_file = NULL;
+static int drift_file_interval = 3600;
 static char *rtc_file = NULL;
 static double max_update_skew = 1000.0;
 static double correction_time_ratio = 3.0;
@@ -129,6 +137,9 @@ static int enable_local=0;
 static int local_stratum;
 static int local_orphan;
 static double local_distance;
+static double local_activate;
+static double local_wait_synced;
+static double local_wait_unsynced;
 
 /* Threshold (in seconds) - if absolute value of initial error is less
    than this, slew instead of stepping */
@@ -220,6 +231,7 @@ static int ntp_ratelimit_enabled = 0;
 static int ntp_ratelimit_interval = 3;
 static int ntp_ratelimit_burst = 8;
 static int ntp_ratelimit_leak = 2;
+static int ntp_ratelimit_kod = 0;
 static int nts_ratelimit_enabled = 0;
 static int nts_ratelimit_interval = 6;
 static int nts_ratelimit_burst = 8;
@@ -249,10 +261,19 @@ static REF_LeapMode leapsec_mode = REF_LeapModeSystem;
 /* Name of a system timezone containing leap seconds occuring at midnight */
 static char *leapsec_tz = NULL;
 
+/* File name of leap seconds list, usually /usr/share/zoneinfo/leap-seconds.list */
+static char *leapsec_list = NULL;
+
 /* Name of the user to which will be dropped root privileges. */
 static char *user;
 
+/* Address refresh interval */
+static int refresh = 1209600; /* 2 weeks */
+
+#define DEFAULT_NTS_AEADS "30 15"
+
 /* NTS server and client configuration */
+static ARR_Instance nts_aeads; /* array of int */
 static char *nts_dump_dir = NULL;
 static char *nts_ntp_server = NULL;
 static ARR_Instance nts_server_cert_files; /* array of (char *) */
@@ -279,19 +300,23 @@ static double hwts_timeout = 0.001;
 
 /* PTP event port (disabled by default) */
 static int ptp_port = 0;
+/* PTP domain number of NTP-over-PTP messages */
+static int ptp_domain = 123;
 
 typedef struct {
   NTP_Source_Type type;
   int pool;
   CPS_NTP_Source params;
+  NSR_Status status;
+  uint32_t conf_id;
 } NTP_Source;
 
 /* Array of NTP_Source */
 static ARR_Instance ntp_sources;
 /* Array of (char *) */
 static ARR_Instance ntp_source_dirs;
-/* Array of uint32_t corresponding to ntp_sources (for sourcedirs reload) */
-static ARR_Instance ntp_source_ids;
+/* Flag indicating ntp_sources is used for sourcedirs after config load */
+static int conf_ntp_sources_added = 0;
 
 /* Array of RefclockParameters */
 static ARR_Instance refclock_sources;
@@ -307,6 +332,11 @@ typedef struct _AllowDeny {
 static ARR_Instance ntp_restrictions;
 static ARR_Instance cmd_restrictions;
 
+#define DEFAULT_OPEN_COMMANDS "activity manual rtcdata smoothing sourcename sources sourcestats tracking"
+
+/* Array of int specifying commands allowed from network */
+static ARR_Instance open_commands;
+
 typedef struct {
   NTP_Remote_Address addr;
   int interval;
@@ -336,12 +366,20 @@ command_parse_error(void)
 
 /* ================================================== */
 
+FORMAT_ATTRIBUTE_PRINTF(1, 2)
 static void
-other_parse_error(const char *message)
+other_parse_error(const char *format, ...)
 {
-    LOG_FATAL("%s at line %d%s%s",
-        message, line_number, processed_file ? " in file " : "",
-        processed_file ? processed_file : "");
+  char buf[256];
+  va_list ap;
+
+  va_start(ap, format);
+  vsnprintf(buf, sizeof (buf), format, ap);
+  va_end(ap);
+
+  LOG_FATAL("%s at line %d%s%s",
+            buf, line_number, processed_file ? " in file " : "",
+            processed_file ? processed_file : "");
 }
 
 /* ================================================== */
@@ -384,6 +422,8 @@ check_number_of_args(char *line, int num)
 void
 CNF_Initialise(int r, int client_only)
 {
+  char buf[128];
+
   restarted = r;
 
   hwts_interfaces = ARR_CreateInstance(sizeof (CNF_HwTsInterface));
@@ -391,13 +431,19 @@ CNF_Initialise(int r, int client_only)
   init_sources = ARR_CreateInstance(sizeof (IPAddr));
   ntp_sources = ARR_CreateInstance(sizeof (NTP_Source));
   ntp_source_dirs = ARR_CreateInstance(sizeof (char *));
-  ntp_source_ids = ARR_CreateInstance(sizeof (uint32_t));
   refclock_sources = ARR_CreateInstance(sizeof (RefclockParameters));
   broadcasts = ARR_CreateInstance(sizeof (NTP_Broadcast_Destination));
 
   ntp_restrictions = ARR_CreateInstance(sizeof (AllowDeny));
   cmd_restrictions = ARR_CreateInstance(sizeof (AllowDeny));
 
+  open_commands = ARR_CreateInstance(sizeof (int));
+  snprintf(buf, sizeof (buf), DEFAULT_OPEN_COMMANDS);
+  parse_open_commands(buf);
+
+  nts_aeads = ARR_CreateInstance(sizeof (int));
+  snprintf(buf, sizeof (buf), DEFAULT_NTS_AEADS);
+  parse_ints(buf, nts_aeads, 0, INT_MAX);
   nts_server_cert_files = ARR_CreateInstance(sizeof (char *));
   nts_server_key_files = ARR_CreateInstance(sizeof (char *));
   nts_trusted_certs_paths = ARR_CreateInstance(sizeof (char *));
@@ -451,13 +497,15 @@ CNF_Finalise(void)
   ARR_DestroyInstance(init_sources);
   ARR_DestroyInstance(ntp_sources);
   ARR_DestroyInstance(ntp_source_dirs);
-  ARR_DestroyInstance(ntp_source_ids);
   ARR_DestroyInstance(refclock_sources);
   ARR_DestroyInstance(broadcasts);
 
+  ARR_DestroyInstance(open_commands);
+
   ARR_DestroyInstance(ntp_restrictions);
   ARR_DestroyInstance(cmd_restrictions);
 
+  ARR_DestroyInstance(nts_aeads);
   ARR_DestroyInstance(nts_server_cert_files);
   ARR_DestroyInstance(nts_server_key_files);
   ARR_DestroyInstance(nts_trusted_certs_paths);
@@ -468,6 +516,7 @@ CNF_Finalise(void)
   Free(hwclock_file);
   Free(keys_file);
   Free(leapsec_tz);
+  Free(leapsec_list);
   Free(logdir);
   Free(bind_ntp_iface);
   Free(bind_acq_iface);
@@ -551,7 +600,7 @@ CNF_ParseLine(const char *filename, int number, char *line)
     printf("%s%s%s\n", command, p[0] != '\0' ? " " : "", p);
 
   if (!strcasecmp(command, "acquisitionport")) {
-    parse_int(p, &acquisition_port);
+    parse_int(p, &acquisition_port, 0, 65535);
   } else if (!strcasecmp(command, "allow")) {
     parse_allow_deny(p, ntp_restrictions, 1);
   } else if (!strcasecmp(command, "authselectmode")) {
@@ -579,10 +628,10 @@ CNF_ParseLine(const char *filename, int number, char *line)
   } else if (!strcasecmp(command, "cmddeny")) {
     parse_allow_deny(p, cmd_restrictions, 0);
   } else if (!strcasecmp(command, "cmdport")) {
-    parse_int(p, &cmd_port);
+    parse_int(p, &cmd_port, 0, 65535);
   } else if (!strcasecmp(command, "cmdratelimit")) {
     parse_ratelimit(p, &cmd_ratelimit_enabled, &cmd_ratelimit_interval,
-                    &cmd_ratelimit_burst, &cmd_ratelimit_leak);
+                    &cmd_ratelimit_burst, &cmd_ratelimit_leak, NULL);
   } else if (!strcasecmp(command, "combinelimit")) {
     parse_double(p, &combine_limit);
   } else if (!strcasecmp(command, "confdir")) {
@@ -592,9 +641,9 @@ CNF_ParseLine(const char *filename, int number, char *line)
   } else if (!strcasecmp(command, "deny")) {
     parse_allow_deny(p, ntp_restrictions, 0);
   } else if (!strcasecmp(command, "driftfile")) {
-    parse_string(p, &drift_file);
+    parse_driftfile(p);
   } else if (!strcasecmp(command, "dscp")) {
-    parse_int(p, &ntp_dscp);
+    parse_int(p, &ntp_dscp, 0, 63);
   } else if (!strcasecmp(command, "dumpdir")) {
     parse_string(p, &dumpdir);
   } else if (!strcasecmp(command, "dumponexit")) {
@@ -617,14 +666,16 @@ CNF_ParseLine(const char *filename, int number, char *line)
     parse_leapsecmode(p);
   } else if (!strcasecmp(command, "leapsectz")) {
     parse_string(p, &leapsec_tz);
+  } else if (!strcasecmp(command, "leapseclist")) {
+    parse_string(p, &leapsec_list);
   } else if (!strcasecmp(command, "local")) {
     parse_local(p);
   } else if (!strcasecmp(command, "lock_all")) {
-    lock_memory = parse_null(p);
+    parse_null(p, &lock_memory);
   } else if (!strcasecmp(command, "log")) {
     parse_log(p);
   } else if (!strcasecmp(command, "logbanner")) {
-    parse_int(p, &log_banner);
+    parse_int(p, &log_banner, 0, INT_MAX);
   } else if (!strcasecmp(command, "logchange")) {
     parse_double(p, &log_change_threshold);
   } else if (!strcasecmp(command, "logdir")) {
@@ -634,7 +685,7 @@ CNF_ParseLine(const char *filename, int number, char *line)
   } else if (!strcasecmp(command, "makestep")) {
     parse_makestep(p);
   } else if (!strcasecmp(command, "manual")) {
-    enable_manual = parse_null(p);
+    parse_null(p, &enable_manual);
   } else if (!strcasecmp(command, "maxchange")) {
     parse_maxchange(p);
   } else if (!strcasecmp(command, "maxclockerror")) {
@@ -646,62 +697,70 @@ CNF_ParseLine(const char *filename, int number, char *line)
   } else if (!strcasecmp(command, "maxjitter")) {
     parse_double(p, &max_jitter);
   } else if (!strcasecmp(command, "maxntsconnections")) {
-    parse_int(p, &nts_server_connections);
+    parse_int(p, &nts_server_connections, 1, INT_MAX);
   } else if (!strcasecmp(command, "maxsamples")) {
-    parse_int(p, &max_samples);
+    parse_int(p, &max_samples, 0, INT_MAX);
   } else if (!strcasecmp(command, "maxslewrate")) {
     parse_double(p, &max_slew_rate);
   } else if (!strcasecmp(command, "maxupdateskew")) {
     parse_double(p, &max_update_skew);
   } else if (!strcasecmp(command, "minsamples")) {
-    parse_int(p, &min_samples);
+    parse_int(p, &min_samples, 0, INT_MAX);
   } else if (!strcasecmp(command, "minsources")) {
-    parse_int(p, &min_sources);
+    parse_int(p, &min_sources, 1, INT_MAX);
   } else if (!strcasecmp(command, "nocerttimecheck")) {
-    parse_int(p, &no_cert_time_check);
+    parse_int(p, &no_cert_time_check, 0, INT_MAX);
   } else if (!strcasecmp(command, "noclientlog")) {
-    no_client_log = parse_null(p);
+    parse_null(p, &no_client_log);
   } else if (!strcasecmp(command, "nosystemcert")) {
-    no_system_cert = parse_null(p);
+    parse_null(p, &no_system_cert);
   } else if (!strcasecmp(command, "ntpsigndsocket")) {
     parse_string(p, &ntp_signd_socket);
+  } else if (!strcasecmp(command, "ntsaeads")) {
+    parse_ints(p, nts_aeads, 0, INT_MAX);
   } else if (!strcasecmp(command, "ntsratelimit")) {
     parse_ratelimit(p, &nts_ratelimit_enabled, &nts_ratelimit_interval,
-                    &nts_ratelimit_burst, &nts_ratelimit_leak);
+                    &nts_ratelimit_burst, &nts_ratelimit_leak, NULL);
   } else if (!strcasecmp(command, "ntscachedir") ||
              !strcasecmp(command, "ntsdumpdir")) {
     parse_string(p, &nts_dump_dir);
   } else if (!strcasecmp(command, "ntsntpserver")) {
     parse_string(p, &nts_ntp_server);
   } else if (!strcasecmp(command, "ntsport")) {
-    parse_int(p, &nts_server_port);
+    parse_int(p, &nts_server_port, 0, 65535);
   } else if (!strcasecmp(command, "ntsprocesses")) {
-    parse_int(p, &nts_server_processes);
+    parse_int(p, &nts_server_processes, 0, 1000);
   } else if (!strcasecmp(command, "ntsrefresh")) {
-    parse_int(p, &nts_refresh);
+    parse_int(p, &nts_refresh, 0, INT_MAX);
   } else if (!strcasecmp(command, "ntsrotate")) {
-    parse_int(p, &nts_rotate);
+    parse_int(p, &nts_rotate, 0, INT_MAX);
   } else if (!strcasecmp(command, "ntsservercert")) {
     parse_ntsserver(p, nts_server_cert_files);
   } else if (!strcasecmp(command, "ntsserverkey")) {
     parse_ntsserver(p, nts_server_key_files);
   } else if (!strcasecmp(command, "ntstrustedcerts")) {
     parse_ntstrustedcerts(p);
+  } else if (!strcasecmp(command, "opencommands")) {
+    parse_open_commands(p);
   } else if (!strcasecmp(command, "peer")) {
     parse_source(p, command, 1);
   } else if (!strcasecmp(command, "pidfile")) {
-    parse_string(p, &pidfile);
+    parse_pidfile(p);
   } else if (!strcasecmp(command, "pool")) {
     parse_source(p, command, 1);
   } else if (!strcasecmp(command, "port")) {
-    parse_int(p, &ntp_port);
+    parse_int(p, &ntp_port, 0, 65535);
+  } else if (!strcasecmp(command, "ptpdomain")) {
+    parse_int(p, &ptp_domain, 0, 255);
   } else if (!strcasecmp(command, "ptpport")) {
-    parse_int(p, &ptp_port);
+    parse_int(p, &ptp_port, 0, 65535);
   } else if (!strcasecmp(command, "ratelimit")) {
     parse_ratelimit(p, &ntp_ratelimit_enabled, &ntp_ratelimit_interval,
-                    &ntp_ratelimit_burst, &ntp_ratelimit_leak);
+                    &ntp_ratelimit_burst, &ntp_ratelimit_leak, &ntp_ratelimit_kod);
   } else if (!strcasecmp(command, "refclock")) {
     parse_refclock(p);
+  } else if (!strcasecmp(command, "refresh")) {
+    parse_int(p, &refresh, 0, INT_MAX);
   } else if (!strcasecmp(command, "reselectdist")) {
     parse_double(p, &reselect_distance);
   } else if (!strcasecmp(command, "rtcautotrim")) {
@@ -711,11 +770,11 @@ CNF_ParseLine(const char *filename, int number, char *line)
   } else if (!strcasecmp(command, "rtcfile")) {
     parse_string(p, &rtc_file);
   } else if (!strcasecmp(command, "rtconutc")) {
-    rtc_on_utc = parse_null(p);
+    parse_null(p, &rtc_on_utc);
   } else if (!strcasecmp(command, "rtcsync")) {
-    rtc_sync = parse_null(p);
+    parse_null(p, &rtc_sync);
   } else if (!strcasecmp(command, "sched_priority")) {
-    parse_int(p, &sched_priority);
+    parse_int(p, &sched_priority, 0, 100);
   } else if (!strcasecmp(command, "server")) {
     parse_source(p, command, 1);
   } else if (!strcasecmp(command, "smoothtime")) {
@@ -734,7 +793,7 @@ CNF_ParseLine(const char *filename, int number, char *line)
              !strcasecmp(command, "linux_hz")) {
     LOG(LOGS_WARN, "%s directive is no longer supported", command);
   } else {
-    other_parse_error("Invalid directive");
+    other_parse_error("Invalid directive %s", command);
   }
 
   processed_file = processed_command = NULL;
@@ -742,48 +801,70 @@ CNF_ParseLine(const char *filename, int number, char *line)
 
 /* ================================================== */
 
-static int
+static void
 parse_string(char *line, char **result)
 {
   check_number_of_args(line, 1);
   Free(*result);
   *result = Strdup(line);
-  return 1;
 }
 
 /* ================================================== */
 
-static int
-parse_int(char *line, int *result)
+static void
+parse_int(char *line, int *result, int min, int max)
 {
+  char *end;
+  long r;
+
   check_number_of_args(line, 1);
-  if (sscanf(line, "%d", result) != 1) {
+
+  errno = 0;
+  r = strtol(line, &end, 10);
+  if (errno != 0 || *end != '\0')
     command_parse_error();
-    return 0;
-  }
-  return 1;
+  if (r < min || r > max)
+    other_parse_error("Invalid value %ld in %s directive (min %d, max %d)",
+                      r, processed_command, min, max);
+  *result = r;
 }
 
 /* ================================================== */
 
-static int
+static void
 parse_double(char *line, double *result)
 {
   check_number_of_args(line, 1);
   if (sscanf(line, "%lf", result) != 1) {
     command_parse_error();
-    return 0;
   }
-  return 1;
 }
 
 /* ================================================== */
 
-static int
-parse_null(char *line)
+static void
+parse_null(char *line, int *result)
 {
   check_number_of_args(line, 0);
-  return 1;
+  *result = 1;
+}
+
+/* ================================================== */
+
+static void
+parse_ints(char *line, ARR_Instance array, int min, int max)
+{
+  char *s;
+  int v;
+
+  ARR_SetSize(array, 0);
+
+  while (*line) {
+    s = line;
+    line = CPS_SplitWord(line);
+    parse_int(s, &v, min, max);
+    ARR_AppendElement(array, &v);
+  }
 }
 
 /* ================================================== */
@@ -791,6 +872,7 @@ parse_null(char *line)
 static void
 parse_source(char *line, char *type, int fatal)
 {
+  CPS_Status status;
   NTP_Source source;
 
   if (strcasecmp(type, "peer") == 0) {
@@ -811,13 +893,20 @@ parse_source(char *line, char *type, int fatal)
   /* Avoid comparing uninitialized data in compare_sources() */
   memset(&source.params, 0, sizeof (source.params));
 
-  if (!CPS_ParseNTPSourceAdd(line, &source.params)) {
-    if (fatal)
-      command_parse_error();
+  status = CPS_ParseNTPSourceAdd(line, &source.params);
+  if (status != CPS_Success) {
+    if (fatal) {
+      other_parse_error("Invalid %s %s directive",
+                        status == CPS_InvalidOption ? "option in" :
+                        status == CPS_InvalidValue ? "value in" : "syntax for", type);
+    }
     return;
   }
 
   source.params.name = Strdup(source.params.name);
+  source.status = NSR_NoSuchSource;
+  source.conf_id = 0;
+
   ARR_AppendElement(ntp_sources, &source);
 }
 
@@ -835,7 +924,7 @@ parse_sourcedir(char *line)
 /* ================================================== */
 
 static void
-parse_ratelimit(char *line, int *enabled, int *interval, int *burst, int *leak)
+parse_ratelimit(char *line, int *enabled, int *interval, int *burst, int *leak, int *kod)
 {
   int n, val;
   char *opt;
@@ -845,7 +934,7 @@ parse_ratelimit(char *line, int *enabled, int *interval, int *burst, int *leak)
   while (*line) {
     opt = line;
     line = CPS_SplitWord(line);
-    if (sscanf(line, "%d%n", &val, &n) != 1) {
+    if (!SSCANF_IN_RANGE(line, "%d%n", &val, &n, -32, 32)) {
       command_parse_error();
       return;
     }
@@ -856,6 +945,8 @@ parse_ratelimit(char *line, int *enabled, int *interval, int *burst, int *leak)
       *burst = val;
     else if (!strcasecmp(opt, "leak"))
       *leak = val;
+    else if (!strcasecmp(opt, "kod") && kod)
+      *kod = val;
     else
       command_parse_error();
   }
@@ -922,31 +1013,28 @@ parse_refclock(char *line)
       if ((n = CPS_ParseRefid(line, &lock_ref_id)) == 0)
         break;
     } else if (!strcasecmp(cmd, "poll")) {
-      if (sscanf(line, "%d%n", &poll, &n) != 1) {
+      if (!SSCANF_IN_RANGE(line, "%d%n", &poll, &n, -32, 32))
         break;
-      }
     } else if (!strcasecmp(cmd, "dpoll")) {
-      if (sscanf(line, "%d%n", &dpoll, &n) != 1) {
+      if (!SSCANF_IN_RANGE(line, "%d%n", &dpoll, &n, -32, 32))
         break;
-      }
     } else if (!strcasecmp(cmd, "filter")) {
-      if (sscanf(line, "%d%n", &filter_length, &n) != 1) {
+      if (!SSCANF_IN_RANGE(line, "%d%n", &filter_length, &n, 0, INT_MAX))
         break;
-      }
     } else if (!strcasecmp(cmd, "local")) {
       n = 0;
       local = 1;
     } else if (!strcasecmp(cmd, "rate")) {
-      if (sscanf(line, "%d%n", &pps_rate, &n) != 1)
+      if (!SSCANF_IN_RANGE(line, "%d%n", &pps_rate, &n, 1, INT_MAX))
         break;
     } else if (!strcasecmp(cmd, "minsamples")) {
-      if (sscanf(line, "%d%n", &min_samples, &n) != 1)
+      if (!SSCANF_IN_RANGE(line, "%d%n", &min_samples, &n, 0, INT_MAX))
         break;
     } else if (!strcasecmp(cmd, "maxlockage")) {
-      if (sscanf(line, "%d%n", &max_lock_age, &n) != 1)
+      if (!SSCANF_IN_RANGE(line, "%d%n", &max_lock_age, &n, 0, INT_MAX))
         break;
     } else if (!strcasecmp(cmd, "maxsamples")) {
-      if (sscanf(line, "%d%n", &max_samples, &n) != 1)
+      if (!SSCANF_IN_RANGE(line, "%d%n", &max_samples, &n, 0, INT_MAX))
         break;
     } else if (!strcasecmp(cmd, "offset")) {
       if (sscanf(line, "%lf%n", &offset, &n) != 1)
@@ -964,8 +1052,7 @@ parse_refclock(char *line)
       if (sscanf(line, "%lf%n", &max_dispersion, &n) != 1)
         break;
     } else if (!strcasecmp(cmd, "stratum")) {
-      if (sscanf(line, "%d%n", &stratum, &n) != 1 ||
-          stratum >= NTP_MAX_STRATUM || stratum < 0)
+      if (!SSCANF_IN_RANGE(line, "%d%n", &stratum, &n, 0, NTP_MAX_STRATUM - 1))
         break;
     } else if (!strcasecmp(cmd, "tai")) {
       n = 0;
@@ -977,13 +1064,13 @@ parse_refclock(char *line)
       n = 0;
       sel_options |= sel_option;
     } else {
-      other_parse_error("Invalid refclock option");
+      other_parse_error("Invalid %s %s directive", "option in", processed_command);
       return;
     }
   }
 
   if (*cmd) {
-    command_parse_error();
+    other_parse_error("Invalid %s %s directive", "value in", processed_command);
     return;
   }
 
@@ -1053,8 +1140,16 @@ parse_log(char *line)
 static void
 parse_local(char *line)
 {
-  if (!CPS_ParseLocal(line, &local_stratum, &local_orphan, &local_distance))
-    command_parse_error();
+  CPS_Status status;
+
+  status = CPS_ParseLocal(line, &local_stratum, &local_orphan, &local_distance,
+                          &local_activate, &local_wait_synced, &local_wait_unsynced);
+  if (status != CPS_Success) {
+    other_parse_error("Invalid %s %s directive",
+                      status == CPS_InvalidOption ? "option in" : "value in",
+                      processed_command);
+  }
+
   enable_local = 1;
 }
 
@@ -1215,6 +1310,72 @@ parse_ntstrustedcerts(char *line)
 
 /* ================================================== */
 
+static void
+add_open_command(int command)
+{
+  int i;
+
+  /* Avoid duplicates */
+  for (i = 0; i < ARR_GetSize(open_commands); i++) {
+    if (*(int *)ARR_GetElement(open_commands, i) == command)
+      return;
+  }
+
+  ARR_AppendElement(open_commands, &command);
+}
+
+/* ================================================== */
+
+static void
+parse_open_commands(char *line)
+{
+  char *s;
+
+  ARR_SetSize(open_commands, 0);
+
+  while (*line) {
+    s = line;
+    line = CPS_SplitWord(line);
+
+    if (strcasecmp(s, "activity") == 0) {
+      add_open_command(REQ_ACTIVITY);
+    } else if (strcasecmp(s, "authdata") == 0) {
+      add_open_command(REQ_N_SOURCES);
+      add_open_command(REQ_AUTH_DATA);
+    } else if (strcasecmp(s, "clients") == 0) {
+      add_open_command(REQ_CLIENT_ACCESSES_BY_INDEX3);
+    } else if (strcasecmp(s, "manual") == 0) {
+      add_open_command(REQ_MANUAL_LIST);
+    } else if (strcasecmp(s, "ntpdata") == 0) {
+      add_open_command(REQ_N_SOURCES);
+      add_open_command(REQ_NTP_DATA);
+    } else if (strcasecmp(s, "rtcdata") == 0) {
+      add_open_command(REQ_RTCREPORT);
+    } else if (strcasecmp(s, "selectdata") == 0) {
+      add_open_command(REQ_N_SOURCES);
+      add_open_command(REQ_SELECT_DATA);
+    } else if (strcasecmp(s, "serverstats") == 0) {
+      add_open_command(REQ_SERVER_STATS);
+    } else if (strcasecmp(s, "smoothing") == 0) {
+      add_open_command(REQ_SMOOTHING);
+    } else if (strcasecmp(s, "sourcename") == 0) {
+      add_open_command(REQ_NTP_SOURCE_NAME);
+    } else if (strcasecmp(s, "sources") == 0) {
+      add_open_command(REQ_N_SOURCES);
+      add_open_command(REQ_SOURCE_DATA);
+    } else if (strcasecmp(s, "sourcestats") == 0) {
+      add_open_command(REQ_N_SOURCES);
+      add_open_command(REQ_SOURCESTATS);
+    } else if (strcasecmp(s, "tracking") == 0) {
+      add_open_command(REQ_TRACKING);
+    } else {
+      command_parse_error();
+    }
+  }
+}
+
+/* ================================================== */
+
 static void
 parse_allow_deny(char *line, ARR_Instance restrictions, int allow)
 {
@@ -1456,17 +1617,17 @@ parse_hwtimestamp(char *line)
     line = CPS_SplitWord(line);
 
     if (!strcasecmp(p, "maxsamples")) {
-      if (sscanf(line, "%d%n", &iface->max_samples, &n) != 1)
+      if (!SSCANF_IN_RANGE(line, "%d%n", &iface->max_samples, &n, 0, INT_MAX))
         break;
     } else if (!strcasecmp(p, "minpoll")) {
-      if (sscanf(line, "%d%n", &iface->minpoll, &n) != 1)
+      if (!SSCANF_IN_RANGE(line, "%d%n", &iface->minpoll, &n, -32, 32))
         break;
     } else if (!strcasecmp(p, "maxpoll")) {
-      if (sscanf(line, "%d%n", &iface->maxpoll, &n) != 1)
+      if (!SSCANF_IN_RANGE(line, "%d%n", &iface->maxpoll, &n, -32, 32))
         break;
       maxpoll_set = 1;
     } else if (!strcasecmp(p, "minsamples")) {
-      if (sscanf(line, "%d%n", &iface->min_samples, &n) != 1)
+      if (!SSCANF_IN_RANGE(line, "%d%n", &iface->min_samples, &n, 0, INT_MAX))
         break;
     } else if (!strcasecmp(p, "precision")) {
       if (sscanf(line, "%lf%n", &iface->precision, &n) != 1)
@@ -1507,6 +1668,20 @@ parse_hwtimestamp(char *line)
 
 /* ================================================== */
 
+static void
+parse_pidfile(char *line)
+{
+  parse_string(line, &pidfile);
+
+  /* / disables the PID file handling */
+  if (strcmp(pidfile, "/") == 0) {
+    Free(pidfile);
+    pidfile = NULL;
+  }
+}
+
+/* ================================================== */
+
 static const char *
 get_basename(const char *path)
 {
@@ -1587,6 +1762,29 @@ parse_confdir(char *line)
 
 /* ================================================== */
 
+static void
+parse_driftfile(char *line)
+{
+  char *path, *opt, *val;
+
+  path = line;
+  opt = CPS_SplitWord(path);
+  val = CPS_SplitWord(opt);
+
+  if (*path == '\0' ||
+      (*opt != '\0' && (strcasecmp(opt, "interval") != 0 ||
+                        sscanf(val, "%d", &drift_file_interval) != 1 ||
+                        *CPS_SplitWord(val) != '\0'))) {
+    command_parse_error();
+    return;
+  }
+
+  Free(drift_file);
+  drift_file = Strdup(path);
+}
+
+/* ================================================== */
+
 static void
 parse_include(char *line)
 {
@@ -1655,11 +1853,13 @@ compare_sources(const void *a, const void *b)
     return 1;
   if ((d = strcmp(sa->params.name, sb->params.name)) != 0)
     return d;
-  if ((d = (int)(sa->type) - (int)(sb->type)) != 0)
+  if ((d = (int)sa->type - (int)sb->type) != 0)
     return d;
-  if ((d = sa->pool - sb->pool) != 0)
+  if ((d = (int)sa->pool - (int)sb->pool) != 0)
     return d;
-  if ((d = sa->params.port - sb->params.port) != 0)
+  if ((d = (int)sa->params.family - (int)sb->params.family) != 0)
+    return d;
+  if ((d = (int)sa->params.port - (int)sb->params.port) != 0)
     return d;
   return memcmp(&sa->params.params, &sb->params.params, sizeof (sa->params.params));
 }
@@ -1671,18 +1871,17 @@ reload_source_dirs(void)
 {
   NTP_Source *prev_sources, *new_sources, *source;
   unsigned int i, j, prev_size, new_size, unresolved;
-  uint32_t *prev_ids, *new_ids;
   char buf[MAX_LINE_LENGTH];
+  int d, pass, was_added;
   NSR_Status s;
-  int d;
 
-  prev_size = ARR_GetSize(ntp_source_ids);
-  if (prev_size > 0 && ARR_GetSize(ntp_sources) != prev_size)
-    assert(0);
+  /* Ignore reload command before adding configured sources */
+  if (!conf_ntp_sources_added)
+    return;
 
-  /* Save the current sources and their configuration IDs */
-  prev_ids = MallocArray(uint32_t, prev_size);
-  memcpy(prev_ids, ARR_GetElements(ntp_source_ids), prev_size * sizeof (prev_ids[0]));
+  prev_size = ARR_GetSize(ntp_sources);
+
+  /* Save the current sources */
   prev_sources = MallocArray(NTP_Source, prev_size);
   memcpy(prev_sources, ARR_GetElements(ntp_sources), prev_size * sizeof (prev_sources[0]));
 
@@ -1700,44 +1899,48 @@ reload_source_dirs(void)
 
   new_size = ARR_GetSize(ntp_sources);
   new_sources = ARR_GetElements(ntp_sources);
-  ARR_SetSize(ntp_source_ids, new_size);
-  new_ids = ARR_GetElements(ntp_source_ids);
   unresolved = 0;
 
   LOG_SetContext(LOGC_SourceFile);
 
   qsort(new_sources, new_size, sizeof (new_sources[0]), compare_sources);
 
-  for (i = j = 0; i < prev_size || j < new_size; ) {
-    if (i < prev_size && j < new_size)
-      d = compare_sources(&prev_sources[i], &new_sources[j]);
-    else
-      d = i < prev_size ? -1 : 1;
+  for (pass = 0; pass < 2; pass++) {
+    for (i = j = 0; i < prev_size || j < new_size; i += d <= 0, j += d >= 0) {
+      if (i < prev_size && j < new_size)
+        d = compare_sources(&prev_sources[i], &new_sources[j]);
+      else
+        d = i < prev_size ? -1 : 1;
 
-    if (d < 0) {
-      /* Remove the missing source */
-      if (prev_sources[i].params.name[0] != '\0')
-        NSR_RemoveSourcesById(prev_ids[i]);
-      i++;
-    } else if (d > 0) {
-      /* Add a newly configured source */
-      source = &new_sources[j];
-      s = NSR_AddSourceByName(source->params.name, source->params.port, source->pool,
-                              source->type, &source->params.params, &new_ids[j]);
+      was_added = d <= 0 && (prev_sources[i].status == NSR_Success ||
+                             prev_sources[i].status == NSR_UnresolvedName);
 
-      if (s == NSR_UnresolvedName) {
-        unresolved++;
-      } else if (s != NSR_Success) {
-        LOG(LOGS_ERR, "Could not add source %s", source->params.name);
-
-        /* Mark the source as not present */
-        source->params.name[0] = '\0';
+      /* Remove missing sources before adding others to avoid conflicts */
+      if (pass == 0 && d < 0 && was_added) {
+        NSR_RemoveSourcesById(prev_sources[i].conf_id);
+      }
+
+      /* Add new sources and sources that could not be added before */
+      if (pass == 1 && (d > 0 || (d == 0 && !was_added))) {
+        source = &new_sources[j];
+        s = NSR_AddSourceByName(source->params.name, source->params.family, source->params.port,
+                                source->pool, source->type, &source->params.params,
+                                &source->conf_id);
+        source->status = s;
+
+        if (s == NSR_UnresolvedName) {
+          unresolved++;
+        } else if (s != NSR_Success && (d > 0 || s != prev_sources[i].status)) {
+          LOG(LOGS_ERR, "Could not add source %s : %s",
+              source->params.name, NSR_StatusToString(s));
+        }
+      }
+
+      /* Keep unchanged sources */
+      if (pass == 1 && d == 0) {
+        new_sources[j].status = prev_sources[i].status;
+        new_sources[j].conf_id = prev_sources[i].conf_id;
       }
-      j++;
-    } else {
-      /* Keep the existing source */
-      new_ids[j] = prev_ids[i];
-      i++, j++;
     }
   }
 
@@ -1746,7 +1949,6 @@ reload_source_dirs(void)
   for (i = 0; i < prev_size; i++)
     Free(prev_sources[i].params.name);
   Free(prev_sources);
-  Free(prev_ids);
 
   if (unresolved > 0)
     NSR_ResolveSources();
@@ -1835,15 +2037,17 @@ CNF_AddSources(void)
   for (i = 0; i < ARR_GetSize(ntp_sources); i++) {
     source = (NTP_Source *)ARR_GetElement(ntp_sources, i);
 
-    s = NSR_AddSourceByName(source->params.name, source->params.port, source->pool,
-                            source->type, &source->params.params, NULL);
+    s = NSR_AddSourceByName(source->params.name, source->params.family, source->params.port,
+                            source->pool, source->type, &source->params.params, NULL);
     if (s != NSR_Success && s != NSR_UnresolvedName)
       LOG(LOGS_ERR, "Could not add source %s", source->params.name);
 
     Free(source->params.name);
   }
 
+  /* The arrays will be used for sourcedir (re)loading */
   ARR_SetSize(ntp_sources, 0);
+  conf_ntp_sources_added = 1;
 
   reload_source_dirs();
 }
@@ -1909,8 +2113,9 @@ CNF_GetAcquisitionPort(void)
 /* ================================================== */
 
 char *
-CNF_GetDriftFile(void)
+CNF_GetDriftFile(int *interval)
 {
+  *interval = drift_file_interval;
   return drift_file;
 }
 
@@ -2133,6 +2338,14 @@ CNF_GetManualEnabled(void)
 
 /* ================================================== */
 
+ARR_Instance
+CNF_GetOpenCommands(void)
+{
+  return open_commands;
+}
+
+/* ================================================== */
+
 int
 CNF_GetCommandPort(void) {
   return cmd_port;
@@ -2141,12 +2354,16 @@ CNF_GetCommandPort(void) {
 /* ================================================== */
 
 int
-CNF_AllowLocalReference(int *stratum, int *orphan, double *distance)
+CNF_AllowLocalReference(int *stratum, int *orphan, double *distance, double *activate,
+                        double *wait_synced, double *wait_unsynced)
 {
   if (enable_local) {
     *stratum = local_stratum;
     *orphan = local_orphan;
     *distance = local_distance;
+    *activate = local_activate;
+    *wait_synced = local_wait_synced;
+    *wait_unsynced = local_wait_unsynced;
     return 1;
   } else {
     return 0;
@@ -2379,6 +2596,14 @@ CNF_GetLeapSecTimezone(void)
 
 /* ================================================== */
 
+char *
+CNF_GetLeapSecList(void)
+{
+  return leapsec_list;
+}
+
+/* ================================================== */
+
 int
 CNF_GetSchedPriority(void)
 {
@@ -2395,11 +2620,12 @@ CNF_GetLockMemory(void)
 
 /* ================================================== */
 
-int CNF_GetNTPRateLimit(int *interval, int *burst, int *leak)
+int CNF_GetNTPRateLimit(int *interval, int *burst, int *leak, int *kod)
 {
   *interval = ntp_ratelimit_interval;
   *burst = ntp_ratelimit_burst;
   *leak = ntp_ratelimit_leak;
+  *kod = ntp_ratelimit_kod;
   return ntp_ratelimit_enabled;
 }
 
@@ -2533,6 +2759,30 @@ CNF_GetPtpPort(void)
 
 /* ================================================== */
 
+int
+CNF_GetPtpDomain(void)
+{
+  return ptp_domain;
+}
+
+/* ================================================== */
+
+int
+CNF_GetRefresh(void)
+{
+  return refresh;
+}
+
+/* ================================================== */
+
+ARR_Instance
+CNF_GetNtsAeads(void)
+{
+  return nts_aeads;
+}
+
+/* ================================================== */
+
 char *
 CNF_GetNtsDumpDir(void)
 {
@@ -2609,8 +2859,7 @@ CNF_GetNtsTrustedCertsPaths(const char ***paths, uint32_t **ids)
   *paths = ARR_GetElements(nts_trusted_certs_paths);
   *ids = ARR_GetElements(nts_trusted_certs_ids);
 
-  if (ARR_GetSize(nts_trusted_certs_paths) != ARR_GetSize(nts_trusted_certs_ids))
-    assert(0);
+  BRIEF_ASSERT(ARR_GetSize(nts_trusted_certs_paths) == ARR_GetSize(nts_trusted_certs_ids));
 
   return ARR_GetSize(nts_trusted_certs_paths);
 }

conf.h

@@ -29,6 +29,7 @@
 #define GOT_CONF_H
 
 #include "addressing.h"
+#include "array.h"
 #include "reference.h"
 #include "sources.h"
 
@@ -55,7 +56,7 @@ extern void CNF_ReloadSources(void);
 
 extern int CNF_GetAcquisitionPort(void);
 extern int CNF_GetNTPPort(void);
-extern char *CNF_GetDriftFile(void);
+extern char *CNF_GetDriftFile(int *interval);
 extern char *CNF_GetLogDir(void);
 extern char *CNF_GetDumpDir(void);
 extern int CNF_GetLogBanner(void);
@@ -69,6 +70,7 @@ extern int CNF_GetLogTempComp(void);
 extern char *CNF_GetKeysFile(void);
 extern char *CNF_GetRtcFile(void);
 extern int CNF_GetManualEnabled(void);
+extern ARR_Instance CNF_GetOpenCommands(void);
 extern int CNF_GetCommandPort(void);
 extern int CNF_GetRtcOnUtc(void);
 extern int CNF_GetRtcSync(void);
@@ -91,6 +93,7 @@ extern char *CNF_GetNtpSigndSocket(void);
 extern char *CNF_GetPidFile(void);
 extern REF_LeapMode CNF_GetLeapSecMode(void);
 extern char *CNF_GetLeapSecTimezone(void);
+extern char *CNF_GetLeapSecList(void);
 
 /* Value returned in ppm, as read from file */
 extern double CNF_GetMaxUpdateSkew(void);
@@ -107,14 +110,15 @@ extern double CNF_GetReselectDistance(void);
 extern double CNF_GetStratumWeight(void);
 extern double CNF_GetCombineLimit(void);
 
-extern int CNF_AllowLocalReference(int *stratum, int *orphan, double *distance);
+extern int CNF_AllowLocalReference(int *stratum, int *orphan, double *distance, double *activate,
+                                   double *wait_synced, double *wait_unsynced);
 
 extern void CNF_SetupAccessRestrictions(void);
 
 extern int CNF_GetSchedPriority(void);
 extern int CNF_GetLockMemory(void);
 
-extern int CNF_GetNTPRateLimit(int *interval, int *burst, int *leak);
+extern int CNF_GetNTPRateLimit(int *interval, int *burst, int *leak, int *kod);
 extern int CNF_GetNtsRateLimit(int *interval, int *burst, int *leak);
 extern int CNF_GetCommandRateLimit(int *interval, int *burst, int *leak);
 extern void CNF_GetSmooth(double *max_freq, double *max_wander, int *leap_only);
@@ -158,7 +162,11 @@ extern int CNF_GetHwTsInterface(unsigned int index, CNF_HwTsInterface **iface);
 extern double CNF_GetHwTsTimeout(void);
 
 extern int CNF_GetPtpPort(void);
+extern int CNF_GetPtpDomain(void);
 
+extern int CNF_GetRefresh(void);
+
+extern ARR_Instance CNF_GetNtsAeads(void);
 extern char *CNF_GetNtsDumpDir(void);
 extern char *CNF_GetNtsNtpServer(void);
 extern int CNF_GetNtsServerCertAndKeyFiles(const char ***certs, const char ***keys);

configure

@@ -5,7 +5,7 @@
 #
 # Copyright (C) Richard P. Curnow  1997-2003
 # Copyright (C) Bryan Christianson  2016
-# Copyright (C) Miroslav Lichvar  2009, 2012-2021
+# Copyright (C) Miroslav Lichvar  2009, 2012-2022
 # Copyright (C) Stefan R. Filipek  2019
 #
 # =======================================================================
@@ -111,12 +111,11 @@ For better control, use the options below.
   --without-editline     Don't use editline even if it is available
   --disable-sechash      Disable support for hashes other than MD5
   --without-nettle       Don't use nettle even if it is available
+  --without-gnutls       Don't use gnutls even if it is available
   --without-nss          Don't use NSS even if it is available
   --without-tomcrypt     Don't use libtomcrypt even if it is available
   --disable-nts          Disable NTS support
-  --without-gnutls       Don't use gnutls even if it is available
   --disable-cmdmon       Disable command and monitoring support
-  --disable-ntp          Disable NTP support
   --disable-refclock     Disable reference clock support
   --disable-phc          Disable PHC refclock driver
   --disable-pps          Disable PPS refclock driver
@@ -126,8 +125,8 @@ For better control, use the options below.
   --without-libcap       Don't use libcap even if it is available
   --enable-scfilter      Enable support for system call filtering
   --without-seccomp      Don't use seccomp even if it is available
-  --disable-asyncdns     Disable asynchronous name resolving
   --disable-forcednsretry Don't retry on permanent DNS error
+  --without-aes-gcm-siv  Don't use AES-GCM-SIV for NTS even if it is available
   --without-clock-gettime Don't use clock_gettime() even if it is available
   --disable-timestamping Disable support for SW/HW timestamping
   --enable-ntp-signd     Enable support for MS-SNTP authentication in Samba
@@ -218,7 +217,6 @@ EXTRA_CLI_OBJECTS=""
 
 feat_debug=0
 feat_cmdmon=1
-feat_ntp=1
 feat_refclock=1
 feat_readline=1
 try_editline=1
@@ -242,8 +240,8 @@ try_phc=0
 feat_pps=1
 try_setsched=0
 try_lockmem=0
-feat_asyncdns=1
 feat_forcednsretry=1
+try_aes_gcm_siv=1
 try_clock_gettime=1
 try_arc4random=1
 try_recvmmsg=1
@@ -251,7 +249,6 @@ feat_timestamping=1
 try_timestamping=0
 feat_ntp_signd=0
 ntp_era_split=""
-use_pthread=0
 default_user="root"
 default_hwclockfile=""
 default_pidfile="/var/run/chrony/chronyd.pid"
@@ -306,9 +303,6 @@ do
     --disable-cmdmon)
       feat_cmdmon=0
     ;;
-    --disable-ntp)
-      feat_ntp=0
-    ;;
     --disable-refclock)
       feat_refclock=0
     ;;
@@ -339,12 +333,12 @@ do
     --without-seccomp)
       try_seccomp=0
     ;;
-    --disable-asyncdns)
-      feat_asyncdns=0
-    ;;
     --disable-forcednsretry)
       feat_forcednsretry=0
     ;;
+    --without-aes-gcm-siv)
+      try_aes_gcm_siv=0
+    ;;
     --without-clock-gettime)
       try_clock_gettime=0
     ;;
@@ -499,27 +493,15 @@ if [ $feat_cmdmon = "1" ]; then
   EXTRA_OBJECTS="$EXTRA_OBJECTS cmdmon.o manual.o pktlength.o"
 fi
 
-if [ $feat_ntp = "1" ]; then
-  add_def FEAT_NTP
-  EXTRA_OBJECTS="$EXTRA_OBJECTS ntp_auth.o ntp_core.o ntp_ext.o ntp_io.o ntp_sources.o"
-  if [ $feat_ntp_signd = "1" ]; then
-    add_def FEAT_SIGND
-    EXTRA_OBJECTS="$EXTRA_OBJECTS ntp_signd.o"
-  fi
-else
-  feat_asyncdns=0
-  feat_timestamping=0
-fi
-
-if [ "$feat_cmdmon" = "1" ] || [ $feat_ntp = "1" ]; then
-  EXTRA_OBJECTS="$EXTRA_OBJECTS addrfilt.o clientlog.o keys.o nameserv.o"
-else
-  feat_ipv6=0
+if [ $feat_ntp_signd = "1" ]; then
+  add_def FEAT_SIGND
+  EXTRA_OBJECTS="$EXTRA_OBJECTS ntp_signd.o"
 fi
 
 if [ $feat_refclock = "1" ]; then
   add_def FEAT_REFCLOCK
-  EXTRA_OBJECTS="$EXTRA_OBJECTS refclock.o refclock_phc.o refclock_pps.o refclock_shm.o refclock_sock.o"
+  EXTRA_OBJECTS="$EXTRA_OBJECTS refclock.o refclock_phc.o refclock_pps.o \
+    refclock_rtc.o refclock_shm.o refclock_sock.o"
 fi
 
 MYCC="$CC"
@@ -565,6 +547,13 @@ if [ "x$MYCFLAGS" = "x" ]; then
   fi
 fi
 
+TESTCFLAGS="-fwrapv"
+if test_code '-fwrapv' '' "$TESTCFLAGS" '' ''; then
+  GETDATE_CFLAGS="-fwrapv"
+else
+  GETDATE_CFLAGS=""
+fi
+
 if [ "x$MYCC" = "xgcc" ] || [ "x$MYCC" = "xclang" ]; then
   MYCFLAGS="$MYCFLAGS -Wmissing-prototypes -Wall"
 fi
@@ -693,15 +682,15 @@ then
   exit 1
 fi
 
-if [ $feat_asyncdns = "1" ] && \
-  test_code 'pthread' 'pthread.h' '-pthread' '' '
-    pthread_t thread;
-    return (int)pthread_create(&thread, NULL, (void *)1, NULL);'
+if test_code 'pthread' 'pthread.h' '-pthread' '' '
+  pthread_t thread;
+  return (int)pthread_create(&thread, NULL, (void *)1, NULL);'
 then
-  add_def FEAT_ASYNCDNS
   add_def USE_PTHREAD_ASYNCDNS
-  EXTRA_OBJECTS="$EXTRA_OBJECTS nameserv_async.o"
-  use_pthread=1
+  MYCFLAGS="$MYCFLAGS -pthread"
+else
+  echo "error: pthread_create() not found"
+  exit 1
 fi
 
 if [ $try_arc4random = "1" ] && \
@@ -804,12 +793,10 @@ if [ $feat_scfilter = "1" ] && [ $try_seccomp = "1" ] && \
     'seccomp_init(SCMP_ACT_KILL);'
 then
   add_def FEAT_SCFILTER
-  if [ $feat_ntp = "1" ]; then
-    # NAME2IPADDRESS shouldn't be enabled together with a privops operation
-    # used by the main thread as the helper process works on one request at
-    # a time and the async resolver would block the main thread
-    priv_ops="NAME2IPADDRESS RELOADDNS"
-  fi
+  # NAME2IPADDRESS shouldn't be enabled together with a privops operation
+  # used by the main thread as the helper process works on one request at
+  # a time and the async resolver would block the main thread
+  priv_ops="NAME2IPADDRESS RELOADDNS"
   EXTRA_LIBS="$EXTRA_LIBS -lseccomp"
 fi
 
@@ -848,7 +835,6 @@ if [ $try_setsched = "1" ] && \
      pthread_setschedparam(pthread_self(), SCHED_FIFO, &sched);'
 then
   add_def HAVE_PTHREAD_SETSCHEDPARAM
-  use_pthread=1
 fi
 
 if [ $try_lockmem = "1" ] && \
@@ -902,6 +888,7 @@ if [ $feat_sechash = "1" ] && [ "x$HASH_LINK" = "x" ]  && [ $try_nettle = "1" ];
     HASH_OBJ="hash_nettle.o"
     HASH_LINK="$test_link"
     MYCPPFLAGS="$MYCPPFLAGS $test_cflags"
+    add_def HAVE_NETTLE
     add_def FEAT_SECHASH
 
     if test_code 'CMAC in nettle' 'nettle/cmac.h' "$test_cflags" "$test_link" \
@@ -911,6 +898,36 @@ if [ $feat_sechash = "1" ] && [ "x$HASH_LINK" = "x" ]  && [ $try_nettle = "1" ];
       EXTRA_OBJECTS="$EXTRA_OBJECTS cmac_nettle.o"
       EXTRA_CLI_OBJECTS="$EXTRA_CLI_OBJECTS cmac_nettle.o"
     fi
+
+    if test_code 'nettle_memeql_sec()' 'nettle/memops.h' \
+      "$test_cflags" "$test_link" \
+      'return nettle_memeql_sec("", "", 0);'
+    then
+      add_def HAVE_NETTLE_MEMEQL
+    fi
+  fi
+fi
+
+if [ $feat_sechash = "1" ] && [ "x$HASH_LINK" = "x" ] && [ $try_gnutls = "1" ]; then
+  test_cflags="`pkg_config --cflags gnutls`"
+  test_link="`pkg_config --libs gnutls`"
+  if test_code 'gnutls' 'gnutls/crypto.h' \
+    "$test_cflags" "$test_link" '
+      return gnutls_hash((void *)1, (void *)2, 1);'
+  then
+    HASH_OBJ="hash_gnutls.o"
+    HASH_LINK="$test_link"
+    MYCPPFLAGS="$MYCPPFLAGS $test_cflags"
+    add_def HAVE_GNUTLS
+    add_def FEAT_SECHASH
+
+    if test_code 'CMAC in gnutls' 'gnutls/crypto.h' "$test_cflags" "$test_link" \
+      'return gnutls_hmac_init((void *)1, GNUTLS_MAC_AES_CMAC_128, (void *)2, 0);'
+    then
+      add_def HAVE_CMAC
+      EXTRA_OBJECTS="$EXTRA_OBJECTS cmac_gnutls.o"
+      EXTRA_CLI_OBJECTS="$EXTRA_CLI_OBJECTS cmac_gnutls.o"
+    fi
   fi
 fi
 
@@ -939,33 +956,11 @@ if [ $feat_sechash = "1" ] && [ "x$HASH_LINK" = "x" ] && [ $try_tomcrypt = "1" ]
   fi
 fi
 
-if [ $feat_sechash = "1" ] && [ "x$HASH_LINK" = "x" ] && [ $try_gnutls = "1" ]; then
-  test_cflags="`pkg_config --cflags gnutls`"
-  test_link="`pkg_config --libs gnutls`"
-  if test_code 'gnutls' 'gnutls/crypto.h' \
-    "$test_cflags" "$test_link" '
-      return gnutls_hash((void *)1, (void *)2, 1);'
-  then
-    HASH_OBJ="hash_gnutls.o"
-    HASH_LINK="$test_link"
-    MYCPPFLAGS="$MYCPPFLAGS $test_cflags"
-    add_def FEAT_SECHASH
-
-    if test_code 'CMAC in gnutls' 'gnutls/crypto.h' "$test_cflags" "$test_link" \
-      'return gnutls_hmac_init((void *)1, GNUTLS_MAC_AES_CMAC_128, (void *)2, 0);'
-    then
-      add_def HAVE_CMAC
-      EXTRA_OBJECTS="$EXTRA_OBJECTS cmac_gnutls.o"
-      EXTRA_CLI_OBJECTS="$EXTRA_CLI_OBJECTS cmac_gnutls.o"
-    fi
-  fi
-fi
-
 EXTRA_OBJECTS="$EXTRA_OBJECTS $HASH_OBJ"
 EXTRA_CLI_OBJECTS="$EXTRA_CLI_OBJECTS $HASH_OBJ"
 LIBS="$LIBS $HASH_LINK"
 
-if [ $feat_ntp = "1" ] && [ $feat_nts = "1" ] && [ $try_gnutls = "1" ]; then
+if [ $feat_nts = "1" ] && [ $try_gnutls = "1" ]; then
   if [ "$HASH_OBJ" = "hash_gnutls.o" ]; then
     test_cflags=""
     test_link=""
@@ -979,14 +974,13 @@ if [ $feat_ntp = "1" ] && [ $feat_nts = "1" ] && [ $try_gnutls = "1" ]; then
         gnutls_priority_init2((void *)1, "", NULL, GNUTLS_PRIORITY_INIT_DEF_APPEND) +
         gnutls_prf_rfc5705((void *)1, 0, "", 0, "", 16, (void *)2);'
   then
-    if test_code 'AES-SIV-CMAC in nettle' \
+    if [ $try_nettle = "1" ] && test_code 'AES-SIV-CMAC in nettle' \
       'nettle/siv-cmac.h' "" "$LIBS" \
       'siv_cmac_aes128_set_key((void *)1, (void *)2);'
     then
       EXTRA_OBJECTS="$EXTRA_OBJECTS siv_nettle.o"
       add_def HAVE_SIV
-      add_def HAVE_NETTLE_SIV_CMAC
-      if test_code 'AES-GCM-SIV in nettle' \
+      if [ $try_aes_gcm_siv = "1" ] && test_code 'AES-GCM-SIV in nettle' \
         'nettle/siv-gcm.h' "" "$LIBS" \
         'siv_gcm_aes128_encrypt_message((void *)1, 0, NULL, 0, (void *)2, 16, (void *)3,
                                         (void *)4);'
@@ -1000,19 +994,19 @@ if [ $feat_ntp = "1" ] && [ $feat_nts = "1" ] && [ $try_gnutls = "1" ]; then
       then
         EXTRA_OBJECTS="$EXTRA_OBJECTS siv_gnutls.o"
         add_def HAVE_SIV
+        if [ $try_aes_gcm_siv = "1" ] && test_code 'AES-GCM-SIV in gnutls' \
+          'gnutls/crypto.h' "$test_cflags" "$test_link $LIBS" '
+            return gnutls_aead_cipher_init((void *)1, GNUTLS_CIPHER_AES_128_SIV_GCM,
+                                           (void *)2);'
+        then
+          add_def HAVE_GNUTLS_SIV_GCM
+        fi
         if test_code 'gnutls_aead_cipher_set_key()' 'gnutls/crypto.h' \
           "$test_cflags" "$test_link $LIBS" '
             return gnutls_aead_cipher_set_key((void *)1, (void *)2);'
         then
           add_def HAVE_GNUTLS_AEAD_CIPHER_SET_KEY
         fi
-      else
-        if test_code 'AES128 in nettle' 'nettle/aes.h' '' "$LIBS" \
-          'aes128_set_encrypt_key((void *)1, (void *)2);'
-        then
-          EXTRA_OBJECTS="$EXTRA_OBJECTS siv_nettle.o"
-          add_def HAVE_SIV
-        fi
       fi
     fi
 
@@ -1026,10 +1020,6 @@ if [ $feat_ntp = "1" ] && [ $feat_nts = "1" ] && [ $try_gnutls = "1" ]; then
   fi
 fi
 
-if [ $use_pthread = "1" ]; then
-  MYCFLAGS="$MYCFLAGS -pthread"
-fi
-
 SYSCONFDIR=/etc
 if [ "x$SETSYSCONFDIR" != "x" ]; then
   SYSCONFDIR=$SETSYSCONFDIR
@@ -1095,7 +1085,7 @@ add_def MAIL_PROGRAM "\"$mail_program\""
 
 common_features="`get_features SECHASH IPV6 DEBUG`"
 chronyc_features="`get_features READLINE`"
-chronyd_features="`get_features CMDMON NTP REFCLOCK RTC PRIVDROP SCFILTER SIGND ASYNCDNS NTS`"
+chronyd_features="`get_features CMDMON REFCLOCK RTC PRIVDROP SCFILTER SIGND NTS`"
 add_def CHRONYC_FEATURES "\"$chronyc_features $common_features\""
 add_def CHRONYD_FEATURES "\"$chronyd_features $common_features\""
 echo "Features : $chronyd_features $chronyc_features $common_features"
@@ -1117,6 +1107,7 @@ do
           s%@CFLAGS@%${MYCFLAGS}%;\
           s%@CPPFLAGS@%${MYCPPFLAGS}%;\
           s%@LDFLAGS@%${MYLDFLAGS}%;\
+          s%@GETDATE_CFLAGS@%${GETDATE_CFLAGS}%;\
           s%@LIBS@%${LIBS}%;\
           s%@EXTRA_LIBS@%${EXTRA_LIBS}%;\
           s%@EXTRA_CLI_LIBS@%${EXTRA_CLI_LIBS}%;\

contrib/bryan_christianson_1/README.txt

@@ -60,8 +60,8 @@ Support files
 Dates and sizes may differ
 -rw-r--r--  1 yourname  staff  2084  4 Aug 22:54 README.txt
 -rwxr-xr-x  1 yourname  staff   676  4 Aug 21:18 chronylogrotate.sh
--rw-r--r--  1 yourname  staff   543 18 Jul 20:10 org.tuxfamily.chronyc.plist
--rw-r--r--  1 yourname  staff   511 19 Jun 18:30 org.tuxfamily.chronyd.plist
+-rw-r--r--  1 yourname  staff   543 18 Jul 20:10 org.chrony-project.chronyc.plist
+-rw-r--r--  1 yourname  staff   511 19 Jun 18:30 org.chrony-project.chronyd.plist
 
 If you have used chrony support directories other than those suggested, you
 will need to edit each file and make the appropriate changes.
@@ -83,21 +83,21 @@ sudo chmod +x /usr/local/bin/chronylogrotate.sh
 sudo chown root:wheel /usr/local/bin/chronylogrotate.sh
 
 
-2. org.tuxfamily.chronyc.plist
+2. org.chrony-project.chronyc.plist
 This file is the launchd plist that runs logrotation each day. You may
 wish to edit this file to change the time of day at which the rotation
 will run, currently 04:05 am
 
-sudo cp org.tuxfamily.chronyc.plist /Library/LaunchDaemons
-sudo chown root:wheel /Library/LaunchDaemons/org.tuxfamily.chronyc.plist
-sudo chmod 0644 /Library/LaunchDaemons/org.tuxfamily.chronyc.plist
-sudo launchctl load -w /Library/LaunchDaemons/org.tuxfamily.chronyc.plist
+sudo cp org.chrony-project.chronyc.plist /Library/LaunchDaemons
+sudo chown root:wheel /Library/LaunchDaemons/org.chrony-project.chronyc.plist
+sudo chmod 0644 /Library/LaunchDaemons/org.chrony-project.chronyc.plist
+sudo launchctl load -w /Library/LaunchDaemons/org.chrony-project.chronyc.plist
 
 
-3. org.tuxfamily.chronyd.plist
+3. org.chrony-project.chronyd.plist
 This file is the launchd plist that runs chronyd when the Macintosh starts.
 
-sudo cp org.tuxfamily.chronyd.plist /Library/LaunchDaemons
-sudo chown root:wheel /Library/LaunchDaemons/org.tuxfamily.chronyd.plist
-sudo chmod 0644 /Library/LaunchDaemons/org.tuxfamily.chronyd.plist
-sudo launchctl load -w /Library/LaunchDaemons/org.tuxfamily.chronyd.plist
+sudo cp org.chrony-project.chronyd.plist /Library/LaunchDaemons
+sudo chown root:wheel /Library/LaunchDaemons/org.chrony-project.chronyd.plist
+sudo chmod 0644 /Library/LaunchDaemons/org.chrony-project.chronyd.plist
+sudo launchctl load -w /Library/LaunchDaemons/org.chrony-project.chronyd.plist

contrib/bryan_christianson_1/org.chrony-project.chronyc.plist

@@ -3,7 +3,7 @@
 <plist version="1.0">
 <dict>
 	<key>Label</key>
-	<string>org.tuxfamily.logrotate</string>
+	<string>org.chrony-project.logrotate</string>
 	<key>KeepAlive</key>
 	<false/>
 	<key>ProgramArguments</key>

contrib/bryan_christianson_1/org.chrony-project.chronyd.plist

@@ -3,7 +3,7 @@
 <plist version="1.0">
 <dict>
 	<key>Label</key>
-	<string>org.tuxfamily.chronyd</string>
+	<string>org.chrony-project.chronyd</string>
 	<key>Program</key>
 	<string>/usr/local/sbin/chronyd</string>
 	<key>ProgramArguments</key>

doc/chronyc.adoc

@@ -2,7 +2,7 @@
 //
 // Copyright (C) Richard P. Curnow  1997-2003
 // Copyright (C) Stephen Wadeley  2016
-// Copyright (C) Miroslav Lichvar  2009-2017, 2019-2022
+// Copyright (C) Miroslav Lichvar  2009-2017, 2019-2024
 //
 // This program is free software; you can redistribute it and/or modify
 // it under the terms of version 2 of the GNU General Public License as
@@ -50,7 +50,7 @@ running under a non-root user), it will try to connect to 127.0.0.1 and then
 ::1.
 
 Only the following monitoring commands, which do not affect the behaviour of
-*chronyd*, are allowed from the network: *activity*, *manual list*,
+*chronyd*, are allowed from the network by default: *activity*, *manual list*,
 *rtcdata*, *smoothing*, *sourcename*, *sources*, *sourcestats*, *tracking*,
 *waitsync*. The
 set of hosts from which *chronyd* will accept these commands can be configured
@@ -58,7 +58,10 @@ with the <<chrony.conf.adoc#cmdallow,*cmdallow*>> directive in the *chronyd*'s
 configuration file or the <<cmdallow,*cmdallow*>> command in *chronyc*. By
 default, the commands are accepted only from localhost (127.0.0.1 or ::1).
 
-All other commands are allowed only through the Unix domain socket. When sent
+Other monitoring commands can be enabled for network access by the
+<<chrony.conf.adoc#opencommands,*opencommands*>> directive. Monitoring commands
+with disabled network access and commands that affect the behaviour of
+*chronyd* are allowed only through the Unix domain socket. If they are sent
 over the network, *chronyd* will respond with a '`Not authorised`' error, even
 if it is from localhost.
 
@@ -144,7 +147,7 @@ The *tracking* command displays parameters about the system's clock
 performance. An example of the output is shown below.
 +
 ----
-Reference ID    : CB00710F (foo.example.net)
+Reference ID    : CB00710F (ntp1.example.net)
 Stratum         : 3
 Ref time (UTC)  : Fri Jan 27 09:49:17 2017
 System time     : 0.000006523 seconds slow of NTP time
@@ -178,7 +181,7 @@ with an IPv4 address.
 *Stratum*:::
 The stratum indicates how many hops away from a computer with an attached
 reference clock we are. Such a computer is a stratum-1 computer, so the
-computer in the example is two hops away (i.e. _foo.example.net_ is a
+computer in the example is two hops away (i.e. _ntp1.example.net_ is a
 stratum-2 and is synchronised from a stratum-1).
 *Ref time*:::
 This is the time (UTC) at which the last measurement from the reference
@@ -321,8 +324,8 @@ extra caption lines are shown as a reminder of the meanings of the columns.
 MS Name/IP address         Stratum Poll Reach LastRx Last sample
 ===============================================================================
 #* GPS0                          0   4   377    11   -479ns[ -621ns] +/-  134ns
-^? foo.example.net               2   6   377    23   -923us[ -924us] +/-   43ms
-^+ bar.example.net               1   6   377    21  -2629us[-2619us] +/-   86ms
+^? ntp1.example.net              2   6   377    23   -923us[ -924us] +/-   43ms
+^+ ntp2.example.net              1   6   377    21  -2629us[-2619us] +/-   86ms
 ----
 +
 The columns are as follows:
@@ -364,9 +367,12 @@ a measurement is being made every 64 seconds. *chronyd* automatically varies
 the polling rate in response to prevailing conditions.
 *Reach*:::
 This shows the source's reachability register printed as an octal number. The
-register has 8 bits and is updated on every received or missed packet from
-the source. A value of 377 indicates that a valid reply was received for all
-from the last eight transmissions.
+register has 8 bits. It is shifted to left by one bit with each poll and it is
+updated by 1 when a valid NTP response, or just a sample in case of a reference
+clock, is received from the source. A value of 377 indicates that a valid
+response or sample was received for all of the last 8 polls. Note that samples
+can be dropped if they are not considered good enough for synchronisation, but
+the reachability register will still have 1s for their polls.
 *LastRx*:::
 This column shows how long ago the last good sample (which is shown in the next
 column) was received from the source. Measurements that failed some tests are
@@ -379,9 +385,9 @@ offset. This can be suffixed by _ns_ (indicating nanoseconds), _us_
 (indicating microseconds), _ms_ (indicating milliseconds), or _s_ (indicating
 seconds). The number to the left of the square brackets shows the original
 measurement, adjusted to allow for any slews applied to the local clock
-since. The number following the _+/-_ indicator shows the margin of error in
-the measurement. Positive offsets indicate that the local clock is ahead of
-the source.
+since. Positive offsets indicate that the local clock is ahead of the source.
+The number following the _+/-_ indicator shows the margin of error in the
+measurement (NTP root distance).
 
 [[sourcestats]]*sourcestats* [*-a*] [*-v*]::
 The *sourcestats* command displays information about the drift rate and offset
@@ -400,7 +406,7 @@ An example report is:
 ----
 Name/IP Address            NP  NR  Span  Frequency  Freq Skew  Offset  Std Dev
 ===============================================================================
-foo.example.net            11   5   46m     -0.001      0.045      1us    25us
+ntp1.example.net           11   5   46m     -0.001      0.045      1us    25us
 ----
 +
 The columns are as follows:
@@ -444,9 +450,9 @@ An example of the output is shown below.
 ----
 S Name/IP Address        Auth COpts EOpts Last Score     Interval  Leap
 =======================================================================
-D foo.example.net           Y ----- --TR-    4   1.0   -61ms   +62ms  N
-* bar.example.net           N ----- -----    0   1.0 -6846us +7305us  N
-+ baz.example.net           N ----- -----   10   1.0 -7381us +7355us  N
+D ntp1.example.net          Y ----- --TR-    4   1.0   -61ms   +62ms  N
+* ntp2.example.net          N ----- -----    0   1.0 -6846us +7305us  N
++ ntp3.example.net          N ----- -----   10   1.0 -7381us +7355us  N
 ----
 +
 The columns are as follows:
@@ -459,8 +465,8 @@ states are reported.
 The following states indicate the source is not considered selectable for
 synchronisation:
 * _N_ - has the *noselect* option.
-* _s_ - is not synchronised.
 * _M_ - does not have enough measurements.
+* _s_ - is not synchronised.
 * _d_ - has a root distance larger than the maximum distance (configured by the
         <<chrony.conf.adoc#maxdistance,*maxdistance*>> directive).
 * _~_ - has a jitter larger than the maximum jitter (configured by the
@@ -492,7 +498,7 @@ local clock:
 This column shows the name or IP address of the source if it is an NTP server,
 or the reference ID if it is a reference clock.
 *Auth*:::
-This column indicites whether an authentication mechanism is enabled for the
+This column indicates whether an authentication mechanism is enabled for the
 source. _Y_ means yes and _N_ means no.
 *COpts*:::
 This column displays the configured selection options of the source.
@@ -556,6 +562,13 @@ The *reselectdist* command sets the reselection distance. It is equivalent to
 the <<chrony.conf.adoc#reselectdist,*reselectdist*>> directive in the
 configuration file.
 
+[[offset]]*offset* _address|refid_ _offset_::
+The *offset* command modifies the offset correction of an NTP source specified
+by IP address (or the _ID#XXXXXXXXXX_ identifier used for unknown addresses),
+or a reference clock specified by reference ID as a string. It is equivalent to
+the *offset* option in the <<chrony.conf.adoc#server,*server*>> or
+<<chrony.conf.adoc#refclock,*refclock*>> directive respectively.
+
 === NTP sources
 
 [[activity]]*activity*::
@@ -592,9 +605,9 @@ shown below.
 ----
 Name/IP address             Mode KeyID Type KLen Last Atmp  NAK Cook CLen
 =========================================================================
-foo.example.net              NTS     1   15  256 135m    0    0    8  100
-bar.example.net               SK    30   13  128    -    0    0    0    0
-baz.example.net                -     0    0    0    -    0    0    0    0
+ntp1.example.net             NTS     1   15  256 135m    0    0    8  100
+ntp2.example.net              SK    30   13  128    -    0    0    0    0
+ntp3.example.net               -     0    0    0    -    0    0    0    0
 ----
 +
 The columns are as follows:
@@ -689,6 +702,10 @@ Total TX        : 24
 Total RX        : 24
 Total valid RX  : 24
 Total good RX   : 22
+Total kernel TX : 24
+Total kernel RX : 24
+Total HW TX     : 0
+Total HW RX     : 0
 ----
 +
 The fields are explained as follows:
@@ -746,6 +763,18 @@ The number of packets which passed the first two groups of NTP tests.
 *Total good RX*:::
 The number of packets which passed all three groups of NTP tests, i.e. the NTP
 measurement was accepted.
+*Total kernel TX*:::
+The number of packets sent to the source for which a timestamp was captured by
+the kernel.
+*Total kernel RX*:::
+The number of packets received from the source for which a timestamp was
+captured by the kernel.
+*Total HW TX*:::
+The number of packets sent to the source for which a timestamp was captured by
+the NIC.
+*Total HW RX*:::
+The number of packets received from the source for which a timestamp was
+captured by the NIC.
 
 [[add_peer]]*add peer* _name_ [_option_]...::
 The *add peer* command allows a new NTP peer to be added whilst
@@ -758,7 +787,7 @@ parameters and options is identical to that for the
 An example of using this command is shown below.
 +
 ----
-add peer foo.example.net minpoll 6 maxpoll 10 key 25
+add peer ntp1.example.net minpoll 6 maxpoll 10 key 25
 ----
 
 [[add_pool]]*add pool* _name_ [_option_]...::
@@ -772,7 +801,7 @@ directive in the configuration file.
 An example of using this command is shown below:
 +
 ----
-add pool foo.example.net maxsources 3 iburst
+add pool ntp1.example.net maxsources 3 iburst
 ----
 
 [[add_server]]*add server* _name_ [_option_]...::
@@ -786,7 +815,7 @@ directive in the configuration file.
 An example of using this command is shown below:
 +
 ----
-add server foo.example.net minpoll 6 maxpoll 10 key 25
+add server ntp1.example.net minpoll 6 maxpoll 10 key 25
 ----
 
 [[delete]]*delete* _address_::
@@ -862,7 +891,7 @@ IPv6 addresses have first 48 bits equal to _2001:db8:789a_.
 Example of the three-argument form of the command is:
 +
 ----
-burst 2/10 foo.example.net
+burst 2/10 ntp1.example.net
 ----
 
 [[maxdelay]]*maxdelay* _address_ _delay_::
@@ -928,7 +957,7 @@ uses an IP address or a hostname. These forms are illustrated below.
 offline
 offline 255.255.255.0/1.2.3.0
 offline 2001:db8:789a::/48
-offline foo.example.net
+offline ntp1.example.net
 ----
 +
 The second form means that the *offline* command is to be applied to any source
@@ -970,17 +999,26 @@ current set of sources. It is equivalent to the *polltarget* option in the
 
 [[refresh]]*refresh*::
 The *refresh* command can be used to force *chronyd* to resolve the names of
-configured sources to IP addresses again, e.g. after suspending and resuming
-the machine in a different network.
+configured NTP sources to IP addresses again and replace any addresses missing
+in the list of resolved addresses.
 +
-Sources that stop responding will be replaced with newly resolved addresses
-automatically after 8 polling intervals, but this command can still be useful
-to replace them immediately and not wait until they are marked as unreachable.
+Sources that stop responding are replaced with newly resolved addresses
+automatically after 8 polling intervals. This command can be used to replace
+them immediately, e.g. after suspending and resuming the machine in a different
+network.
++
+Note that with pools which have more than 16 addresses, or not all IPv4 or IPv6
+addresses are included in a single DNS response (e.g. pool.ntp.org), this
+command might replace the addresses even if they are still in the pool.
 
 [[reload]]*reload* *sources*::
 The *reload sources* command causes *chronyd* to re-read all _*.sources_ files
 from the directories specified by the
 <<chrony.conf.adoc#sourcedir,*sourcedir*>> directive.
++
+Note that modified sources (e.g. specified with a new option) are not modified
+in memory. They are removed and added again, which causes them to lose old
+measurements and reset the selection state.
 
 [[sourcename]]*sourcename* _address_::
 The *sourcename* command prints the original hostname or address that was
@@ -1089,7 +1127,7 @@ particular host.
 Examples of use, showing a named host and a numeric IP address, are as follows:
 +
 ----
-accheck foo.example.net
+accheck ntp1.example.net
 accheck 1.2.3.4
 accheck 2001:db8::1
 ----
@@ -1116,7 +1154,7 @@ An example of the output is:
 Hostname                      NTP   Drop Int IntL Last     Cmd   Drop Int  Last
 ===============================================================================
 localhost                       2      0   2   -   133      15      0  -1     7
-foo.example.net                12      0   6   -    23       0      0   -     -
+ntp1.example.net               12      0   6   -    23       0      0   -     -
 ----
 +
 Each row shows the data for a single host. Only hosts that have passed the host
@@ -1316,7 +1354,7 @@ used to check whether monitoring access is permitted from a named host.
 Examples of use are as follows:
 +
 ----
-cmdaccheck foo.example.net
+cmdaccheck ntp1.example.net
 cmdaccheck 1.2.3.4
 cmdaccheck 2001:db8::1
 ----
@@ -1429,6 +1467,13 @@ purged. An example of how to do this is shown below.
 # chronyc cyclelogs
 # rm /var/log/chrony/measurements1.log
 ----
++
+Note that log files enabled by the *log* directive are opened when the first
+entry is made. The message log file specified by the *chronyd*'s *-l* option is
+opened early on start and closed on the *cyclelogs* command only if opening of
+the new file succeeds to avoid losing messages. If *chronyd* is configured to
+drop root privileges and the directory containing the log file is not writable
+for the specified user, *chronyd* will not be able to open the file again.
 
 [[dump]]*dump*::
 The *dump* command causes *chronyd* to write its current history of
@@ -1543,7 +1588,7 @@ The *help* command displays a summary of the commands and their arguments.
 == BUGS
 
 For instructions on how to report bugs, please visit
-https://chrony.tuxfamily.org/.
+https://chrony-project.org/.
 
 == AUTHORS
 

doc/chronyd.adoc

@@ -72,9 +72,9 @@ terminal.
 
 *-L* _level_::
 This option specifies the minimum severity level of messages to be written to
-the log file, syslog, or terminal. The following levels can be specified:
-0 (informational), 1 (warning), 2 (non-fatal error), and 3 (fatal error). The
-default value is 0.
+the log file, syslog, or terminal. The following levels can be specified: -1
+(debug, if compiled with enabled support for debugging), 0 (informational), 1
+(warning), 2 (non-fatal error), and 3 (fatal error). The default value is 0.
 
 *-p*::
 When run in this mode, *chronyd* will print the configuration and exit. It will
@@ -206,6 +206,25 @@ With this option *chronyd* will print version number to the terminal and exit.
 *-h*, *--help*::
 With this option *chronyd* will print a help message to the terminal and exit.
 
+== ENVIRONMENT VARIABLES
+
+*LISTEN_FDS*::
+On Linux systems, the systemd service manager may pass file descriptors for
+pre-initialised sockets to *chronyd*. The service manager allocates and binds
+the file descriptors, and passes a copy to each spawned instance of the
+service. This allows for zero-downtime service restarts as the sockets buffer
+client requests until the service is able to handle them. The service manager
+sets the LISTEN_FDS environment variable to the number of passed file
+descriptors.
+
+*NOTIFY_SOCKET*::
+The systemd service manager sets this variable for services of the *notify*
+type. *chronyd* sends a message to this socket when it it is fully initialised
+and ready to accept commands (e.g. from *chronyc*), with the clock already set
+if using the *-s* option or *initstepslew* directive. It is an alternative to
+the *forking* service type, which does not need the PID file. *chronyd* needs
+to be started with the *-n* or *-d* option to not fork.
+
 == FILES
 
 _@SYSCONFDIR@/chrony.conf_
@@ -217,7 +236,7 @@ _@SYSCONFDIR@/chrony.conf_
 == BUGS
 
 For instructions on how to report bugs, please visit
-https://chrony.tuxfamily.org/.
+https://chrony-project.org/.
 
 == AUTHORS
 

doc/contributing.adoc

@@ -0,0 +1,74 @@
+// This file is part of chrony
+//
+// Copyright (C) Miroslav Lichvar  2024
+//
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of version 2 of the GNU General Public License as
+// published by the Free Software Foundation.
+//
+// This program is distributed in the hope that it will be useful, but
+// WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+// General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+= Contributing
+
+== Patches
+
+The source code of `chrony` is maintained in a git repository at
+https://gitlab.com/chrony/chrony. Patches can be submitted to the `chrony-dev`
+mailing list, or as a merge request on gitlab. Before spending a lot of time
+implementing a new major feature, it is recommended to ask on the mailing list
+for comments about its design and whether such feature fits the goals of the
+project.
+
+Each commit should be a self-contained logical change, which does not break
+the build or tests. New functionality and fixed bugs should be covered by a new
+test or an extended existing test in the test suite. The test can be included
+in the same commit or added as a separate commit. The same rule applies to
+documentation. All command-line options, configuration directives, and
+`chronyc` commands should be documented.
+
+The most important tests can be executed by running `make check` or `make
+quickcheck`. The unit and system tests run on all supported systems. The system
+tests require root privileges. The simulation tests run only on Linux and
+require https://gitlab.com/chrony/clknetsim[clknetsim] to be compiled in the
+directory containing the tests, but they are executed with a merge request on
+gitlab.
+
+The commit message should explain any non-trivial changes, e.g. what problem is
+the commit solving and how. The commit subject (first line of the message)
+should be written in an imperative form, prefixed with the component name if it
+is not a more general change, starting in lower case, and no period at the end.
+See the git log for examples.
+
+Simpler code is better. Less code is better. Security is a top priority.
+
+Assertions should catch only bugs in the `chrony` code. Unexpected values in
+external input (e.g. anything received from network) must be handled correctly
+without crashing and memory corruption. Fuzzing support is available at
+https://gitlab.com/chrony/chrony-fuzz. The fuzzing coverage is checked by the
+project maintainer before each release.
+
+The code should mostly be self-documenting. Comments should explain the
+less obvious things.
+
+== Coding style
+
+The code uses two spaces for indentation. No tabs. The line length should
+normally not exceed 95 characters. Too much indentation indicates the code will
+not be very readable.
+
+Function names are in an imperative form. Names of static functions use
+lowercase characters and underscores. Public functions, structures, typedefs
+are in CamelCase with a prefix specific to the module (e.g. LCL - local, NCR
+- NTP core, NKS - NTS-KE server, SST - sourcestats).
+
+Function names are not followed by space, but keywords of the language (e.g.
+`if`, `for`, `while`, `sizeof`) are followed by space.
+
+Have a look at the existing code to get a better idea what is expected.

doc/faq.adoc

@@ -1,7 +1,8 @@
 // This file is part of chrony
 //
 // Copyright (C) Richard P. Curnow  1997-2003
-// Copyright (C) Miroslav Lichvar  2014-2016, 2020-2022
+// Copyright (C) Luke Valenta  2023
+// Copyright (C) Miroslav Lichvar  2014-2016, 2020-2024
 //
 // This program is free software; you can redistribute it and/or modify
 // it under the terms of version 2 of the GNU General Public License as
@@ -40,9 +41,36 @@ on an isolated network with no hardware reference clocks in sight, `chrony`
 will probably work better for you.
 
 For a more detailed comparison of features and performance, see the
-https://chrony.tuxfamily.org/comparison.html[comparison page] on the `chrony`
+https://chrony-project.org/comparison.html[comparison page] on the `chrony`
 website.
 
+=== Should I prefer `chrony` over `timesyncd` if I do not need to run a server?
+
+Generally, yes.
+
+`systemd-timesyncd` is a very simple NTP client included in the `systemd`
+suite. It lacks almost all features of `chrony` and other advanced client
+implementations listed on the
+https://chrony-project.org/comparison.html[comparison page]. One of its main
+limitations is that it cannot poll multiple servers at the same time and detect
+servers having incorrect time (falsetickers in the NTP terminology). It should
+be used only with trusted reliable servers, ideally in local network.
+
+Using `timesyncd` with `pool.ntp.org` is problematic. The pool is very
+robust as a whole, but the individual servers run by volunteers cannot be
+relied on. Occasionally, servers drift away or make a step to distant past or
+future due to misconfiguration, problematic implementation, and other bugs
+(e.g. in firmware of a GPS receiver). The pool monitoring system detects such
+servers and quickly removes them from the pool DNS, but clients like
+`timesyncd` cannot recover from that. They follow the server as long as it
+claims to be synchronised. They need to be restarted in order to get a new
+address from the pool DNS.
+
+Note that the complexity of NTP and clock synchronisation is on the client
+side. The amount of code in `chrony` specific to NTP server is very small and
+it is disabled by default. If it was removed, it would not significantly reduce
+the amount of memory or storage needed.
+
 == Configuration issues
 
 === What is the minimum recommended configuration for an NTP client?
@@ -238,11 +266,11 @@ An example of a client configuration limiting the impact of the attacks could
 be
 
 ----
-server foo.example.net iburst nts maxdelay 0.1
-server bar.example.net iburst nts maxdelay 0.2
-server baz.example.net iburst nts maxdelay 0.05
-server qux.example.net iburst nts maxdelay 0.1
-server quux.example.net iburst nts maxdelay 0.1
+server ntp1.example.net iburst nts maxdelay 0.1
+server ntp2.example.net iburst nts maxdelay 0.2
+server ntp3.example.net iburst nts maxdelay 0.05
+server ntp4.example.net iburst nts maxdelay 0.1
+server ntp5.example.net iburst nts maxdelay 0.1
 minsources 3
 maxchange 100 0 0
 makestep 0.001 1
@@ -291,7 +319,7 @@ An example of the directive for an NTP server on the Internet that you are
 allowed to poll frequently could be
 
 ----
-server foo.example.net minpoll 4 maxpoll 6 polltarget 16
+server ntp.example.net minpoll 4 maxpoll 6 polltarget 16
 ----
 
 An example using shorter polling intervals with a server located in the same
@@ -310,10 +338,10 @@ with local NTP server
 server ntp.local minpoll 2 maxpoll 4 polltarget 30 maxdelaydevratio 2
 ----
 
-If your server supports the interleaved mode (e.g. it is running `chronyd`),
-the `xleave` option should be added to the `server` directive to enable the
-server to provide the client with more accurate transmit timestamps (kernel or
-preferably hardware). For example:
+If your server supports the interleaved mode (RFC 9769), e.g. it is running
+`chronyd` version 3.0 or later, the `xleave` option should be added to the
+`server` directive to enable the server to provide the client with more
+accurate transmit timestamps (kernel or preferably hardware). For example:
 
 ----
 server ntp.local minpoll 2 maxpoll 4 xleave
@@ -354,7 +382,7 @@ outliers corrupting the minimum delay. For example:
 server ntp.local minpoll -7 maxpoll -7 filter 31 maxdelayquant 0.3 xleave
 ----
 
-As an experimental feature added in version 4.2, `chronyd` supports an NTPv4
+Since version 4.2, `chronyd` supports an NTPv4
 extension field containing an additional timestamp to enable frequency transfer
 and significantly improve stability of synchronisation. It can be enabled by
 the `extfield F323` option. For example:
@@ -363,6 +391,18 @@ the `extfield F323` option. For example:
 server ntp.local minpoll 0 maxpoll 0 xleave extfield F323
 ----
 
+Since version 4.5, `chronyd` can apply corrections from PTP one-step end-to-end
+transparent clocks (e.g. network switches) to significantly improve accuracy of
+synchronisation in local networks. It requires the PTP transport to be enabled
+by the `ptpport` directive, HW timestamping, and the `extfield F324` option.
+For example:
+
+----
+server ntp.local minpoll -4 maxpoll -4 xleave extfield F323 extfield F324 port 319
+ptpport 319
+hwtimestamp eth0 minpoll -4
+----
+
 === Does `chronyd` have an ntpdate mode?
 
 Yes. With the `-q` option `chronyd` will set the system clock once and exit.
@@ -470,6 +510,59 @@ pidfile /var/run/chronyd-server1.pid
 driftfile /var/lib/chrony/drift-server1
 ----
 
+=== How can `chronyd` be configured to minimise downtime during restarts?
+
+The `dumpdir` directive in _chrony.conf_ provides `chronyd` a location to save
+a measurement history of the sources it uses when the service exits. The `-r`
+option then enables `chronyd` to load state from the dump files, reducing the
+synchronisation time after a restart.
+
+Similarly, the `ntsdumpdir` directive provides a location for `chronyd` to save
+NTS cookies received from the server to avoid making a NTS-KE request when
+`chronyd` is started. When operating as an NTS server, `chronyd` also saves
+cookies keys to this directory to allow clients to continue to use the old keys
+after a server restart for a more seamless experience.
+
+On Linux systems,
+https://www.freedesktop.org/software/systemd/man/latest/sd_listen_fds.html[systemd
+socket activation] provides a mechanism to reuse server sockets across
+`chronyd` restarts, so that client requests will be buffered until the service
+is again able to handle the requests. This allows for zero-downtime service
+restarts, simplified dependency logic at boot, and on-demand service spawning
+(for instance, for separated server `chronyd` instances run with the `-x`
+flag).
+
+Socket activation is supported since `chrony` version 4.5.
+The service manager (systemd) creates sockets and
+passes file descriptors to them to the process via the `LISTEN_FDS` environment
+variable. Before opening new sockets, `chronyd` first checks for and attempts
+to reuse matching sockets passed from the service manager. For instance, if an
+IPv4 datagram socket bound on `bindaddress` and `port` is available, it will be
+used by the NTP server to accept incoming IPv4 requests.
+
+An example systemd socket unit is below, where `chronyd` is configured with
+`bindaddress 0.0.0.0`, `bindaddress ::`, `port 123`, and `ntsport 4460`.
+
+----
+[Unit]
+Description=chronyd server sockets
+
+[Socket]
+Service=chronyd.service
+# IPv4 NTP server
+ListenDatagram=0.0.0.0:123
+# IPv6 NTP server
+ListenDatagram=[::]:123
+# IPv4 NTS-KE server
+ListenStream=0.0.0.0:4460
+# IPv6 NTS-KE server
+ListenStream=[::]:4460
+BindIPv6Only=ipv6-only
+
+[Install]
+WantedBy=sockets.target
+----
+
 === Should be a leap smear enabled on NTP server?
 
 With the `smoothtime` and `leapsecmode` directives it is possible to enable a
@@ -484,7 +577,7 @@ identically configured leap-smearing servers. Note that some clients can get
 leap seconds from other sources (e.g. with the `leapsectz` directive in
 `chrony`) and they will not work correctly with a leap smearing server.
 
-=== How should `chronyd` be configuration with `gpsd`?
+=== How should `chronyd` be configured with `gpsd`?
 
 A GPS or other GNSS receiver can be used as a reference clock with `gpsd`. It
 can work as one or two separate time sources for each connected receiver. The
@@ -571,7 +664,28 @@ The `ethtool -T` command can be used to verify the timestamping support.
 As an experimental feature added in version 4.2, `chrony` can use PTP as a
 transport for NTP messages (NTP over PTP) to enable hardware timestamping on
 hardware which can timestamp PTP packets only. It can be enabled by the
-`ptpport` directive.
+`ptpport` directive. Since version 4.5, `chrony` can also apply corrections
+provided by PTP one-step end-to-end transparent clocks to reach the accuracy of
+ordinary PTP clocks. The application of PTP corrections can be enabled by the
+`extfield F324` option.
+
+=== How can I avoid using wrong PHC refclock?
+
+If your system has multiple PHC devices, normally named by `udev` as
+_/dev/ptp0_, _/dev/ptp1_, and so on, their order can change randomly across
+reboots depending on the order of initialisation of their drivers. If a PHC
+refclock is specified by this name, `chronyd` could be using a wrong refclock
+after reboot. To prevent that, you can configure `udev` to create a stable
+symlink for `chronyd` with a rule like this (e.g. written to
+_/etc/udev/rules.d/80-phc.rules_):
+
+----
+KERNEL=="ptp[0-9]*", DEVPATH=="/devices/pci0000:00/0000:00:01.2/0000:02:00.0/ptp/*", SYMLINK+="ptp-i350-1"
+----
+
+You can get the full _DEVPATH_ of an existing PHC device with the `udevadm
+info` command. You will need to execute the `udevadm trigger` command, or
+reboot the system, for these changes to take effect.
 
 === Why are client log records dropped before reaching `clientloglimit`?
 
@@ -624,9 +738,9 @@ this:
 ----
 MS Name/IP address         Stratum Poll Reach LastRx Last sample
 ===============================================================================
-^* foo.example.net               2   6   377    34   +484us[ -157us] +/-   30ms
-^- bar.example.net               2   6   377    34    +33ms[  +32ms] +/-   47ms
-^+ baz.example.net               3   6   377    35  -1397us[-2033us] +/-   60ms
+^* ntp1.example.net              2   6   377    34   +484us[ -157us] +/-   30ms
+^- ntp2.example.net              2   6   377    34    +33ms[  +32ms] +/-   47ms
+^+ ntp3.example.net              3   6   377    35  -1397us[-2033us] +/-   60ms
 ----
 
 === Are NTP servers specified with the `offline` option?
@@ -658,6 +772,17 @@ print all sources, even those that do not have a known address yet, with their
 names as they were specified in the configuration. This can be useful to verify
 that the names specified in the configuration are used as expected.
 
+When DNSSEC is enabled, it will not work until the time is synchronized, as it
+requires validating a signature timestamp and its expiration date, so if the
+system time is too far in the future or the past DNSSEC validation will fail and
+`chronyd` will be unable to resolve the address of the NTP server. In such cases,
+if hostnames are the only options and bare IP addresses cannot be used, DNSSEC
+can be disabled for `chronyd` using resolver-specific mechanisms, if available,
+although of course that means losing the protection afforded by DNSSEC.
+For example, when using systemd-resolved, the `SYSTEMD_NSS_RESOLVE_VALIDATE=0`
+environment variable can be set, for example in the `chronyd` systemd unit via
+`Environment=SYSTEMD_NSS_RESOLVE_VALIDATE=0`.
+
 === Is `chronyd` allowed to step the system clock?
 
 By default, `chronyd` adjusts the clock gradually by slowing it down or
@@ -696,9 +821,9 @@ successful:
 # chronyc -N authdata
 Name/IP address             Mode KeyID Type KLen Last Atmp  NAK Cook CLen
 =========================================================================
-foo.example.net              NTS     1   15  256  33m    0    0    8  100
-bar.example.net              NTS     1   15  256  33m    0    0    8  100
-baz.example.net              NTS     1   15  256  33m    0    0    8  100
+ntp1.example.net             NTS     1   15  256  33m    0    0    8  100
+ntp2.example.net             NTS     1   15  256  33m    0    0    8  100
+ntp3.example.net             NTS     1   15  256  33m    0    0    8  100
 ----
 
 The KeyID, Type, and KLen columns should have non-zero values. If they are
@@ -822,7 +947,7 @@ Name/IP Address            NP  NR  Span  Frequency  Freq Skew  Offset  Std Dev
 ==============================================================================
 PPS0                        0   0     0     +0.000   2000.000     +0ns  4000ms
 NMEA                       58  30   231    -96.494     38.406   +504ms  6080us
-foo.example.net             7   3   200     -2.991     16.141   -107us   492us
+ntp1.example.net            7   3   200     -2.991     16.141   -107us   492us
 ----
 
 the offset of the NMEA source would need to be increased by about 0.504
@@ -1041,6 +1166,53 @@ There are several different clocks used by `chronyd`:
   synchronised by `chronyd`. Its offset is tracked relative to the NTP clock in
   order to convert the hardware timestamps.
 
+=== How accurate is my system clock?
+
+`chronyd` does not know how accurate really is the clock it is synchronizing.
+Even if the measured offset of the clock is stable to nanoseconds, it could be
+off by milliseconds due to asymmetric network delay, e.g. caused by asymmetric
+routing or queuing delays in network switches. NTP provides root delay and root
+dispersion to enable clients to estimate the maximum error of their clock.
+
+Root delay measures the sum of round-trip times between all NTP servers on the
+path from the client to the primary time source (e.g. a GPS receiver). Half of
+the root delay is the maximum error due to asymmetric delays, assuming one
+direction (e.g. from the client to the server) has a zero delay and the other
+direction (from the server to the client) takes all of the measured delay. The
+root delay also covers timestamping errors if the server implementation and
+hardware meet the NTP requirement for transmit timestamps to never be late and
+receive timestamps to never be early.
+
+If you have additional information about the hardware and network between the
+client and primary time source, you could modify the root delay to get a better
+estimate of the maximum error. For example, from the physical distance of the
+server and signal propagation speed in the cables a minimum symmetric
+round-trip delay can be calculated and subtracted from the root delay measured
+by NTP.
+
+Root dispersion estimates errors due to instability of clocks and NTP
+measurements. `chronyd` adjusts the rate at which root dispersion grows between
+updates of the clock according to the stability of its NTP measurements. The
+minimum rate is set by the the `maxclockerror` directive. By default it is 1
+ppm (1 microsecond per second).
+
+The estimated maximum error of the NTP clock is the sum of the root dispersion
+and half of the root delay. This value is called root distance. The current
+values of root dispersion and delay are included in the `tracking` report.
+
+The estimated maximum error of the system clock, which is synchronized to the
+NTP clock, is the sum of the root distance and remaining correction of the
+system clock provided as `System time` in the `tracking` report. A maximum
+value of this estimate between updates of the clock is included in the
+`tracking` log.
+
+Note that the resolution of the root delay and root dispersion fields in NTP
+messages is about 15 microseconds and `chronyd` rounds the values up, i.e. the
+minimum root distance an NTP client can normally observe is about 22.5
+microseconds. An NTP extension field containing root delay and dispersion in a
+better resolution of about 4 nanoseconds can be enabled by the `extfield F323`
+option.
+
 == Operating systems
 
 === Does `chrony` support Windows?

doc/installation.adoc

@@ -85,13 +85,6 @@ will be built with support for dropping root privileges. On other systems no
 extra library is needed. The default user which `chronyd` should run as can be
 specified with the `--with-user` option of the `configure` script.
 
-If development files for the POSIX threads library are available, `chronyd`
-will be built with support for asynchronous resolving of hostnames specified in
-the `server`, `peer`, and `pool` directives. This allows `chronyd` operating as
-a server to respond to client requests when resolving a hostname. If you don't
-want to enable the support, specify the `--disable-asyncdns` flag to
-`configure`.
-
 If development files for the https://www.lysator.liu.se/~nisse/nettle/[Nettle],
 https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS[NSS], or
 https://www.libtom.net/LibTomCrypt/[libtomcrypt] library are available,

examples/chrony-wait.service

@@ -25,7 +25,6 @@ LockPersonality=yes
 MemoryDenyWriteExecute=yes
 PrivateDevices=yes
 PrivateUsers=yes
-ProcSubset=pid
 ProtectClock=yes
 ProtectControlGroups=yes
 ProtectHome=yes

examples/chrony.conf.example1

@@ -1,4 +1,4 @@
-# Use public NTP servers from the pool.ntp.org project.
+# Use four public NTP servers from the pool.ntp.org project.
 pool pool.ntp.org iburst
 
 # Record the rate at which the system clock gains/losses time.

examples/chrony.conf.example2

@@ -1,5 +1,10 @@
-# Use public servers from the pool.ntp.org project.
-# Please consider joining the pool (https://www.pool.ntp.org/join.html).
+# Note: The general recommendation for an NTP client is to have at least
+# three NTP servers to be able to detect one server providing incorrect
+# time (falseticker).
+
+# Use four public NTP servers from the pool.ntp.org project. If this
+# host has a static public IP address, please consider joining the pool:
+# https://www.ntppool.org/join.html
 pool pool.ntp.org iburst
 
 # Record the rate at which the system clock gains/losses time.
@@ -37,8 +42,8 @@ ntsdumpdir /var/lib/chrony
 # Insert/delete leap seconds by slewing instead of stepping.
 #leapsecmode slew
 
-# Get TAI-UTC offset and leap seconds from the system tz database.
-#leapsectz right/UTC
+# Set the TAI-UTC offset of the system clock.
+#leapseclist /usr/share/zoneinfo/leap-seconds.list
 
 # Specify directory for log files.
 logdir /var/log/chrony

examples/chrony.conf.example3

@@ -21,15 +21,17 @@
 #######################################################################
 ### SPECIFY YOUR NTP SERVERS
 # Most computers using chrony will send measurement requests to one or
-# more 'NTP servers'.  You will probably find that your Internet Service
+# more NTP servers.  The general recommendation is to have at least
+# three NTP servers to be able to detect one server providing incorrect
+# time (falseticker).  You will probably find that your Internet Service
 # Provider or company have one or more NTP servers that you can specify.
 # Failing that, there are a lot of public NTP servers.  There is a list
-# you can access at http://support.ntp.org/bin/view/Servers/WebHome or
+# you can access at https://support.ntp.org/bin/view/Servers/WebHome or
 # you can use servers from the pool.ntp.org project.
 
-! server foo.example.net iburst
-! server bar.example.net iburst
-! server baz.example.net iburst
+! server ntp1.example.net iburst
+! server ntp2.example.net iburst
+! server ntp3.example.net iburst
 
 ! pool pool.ntp.org iburst
  
@@ -99,8 +101,8 @@ ntsdumpdir /var/lib/chrony
 # and edit the following lines to specify the locations of the certificate and
 # key.
 
-! ntsservercert /etc/.../foo.example.net.crt
-! ntsserverkey /etc/.../foo.example.net.key
+! ntsservercert /etc/.../nts-server.crt
+! ntsserverkey /etc/.../nts-server.key
 
 # chronyd can save the measurement history for the servers to files when
 # it exits.  This is useful in 2 situations:
@@ -126,11 +128,11 @@ ntsdumpdir /var/lib/chrony
 
 ! pidfile /var/run/chrony/chronyd.pid
 
-# If the system timezone database is kept up to date and includes the
-# right/UTC timezone, chronyd can use it to determine the current
-# TAI-UTC offset and when will the next leap second occur.
+# The system timezone database usually comes with a list of leap seconds and
+# corresponding TAI-UTC offsets.  chronyd can use it to set the offset of the
+# system TAI clock and have an additional source of leap seconds.
 
-! leapsectz right/UTC
+! leapseclist /usr/share/zoneinfo/leap-seconds.list
 
 #######################################################################
 ### INITIAL CLOCK CORRECTION
@@ -238,7 +240,7 @@ ntsdumpdir /var/lib/chrony
 # several people, you need to set up a mailing list or sendmail alias
 # for them and use the address of that.)
 
-! mailonchange wibble@foo.example.net 0.5
+! mailonchange wibble@example.net 0.5
 
 #######################################################################
 ### COMMAND ACCESS

examples/chronyd-restricted.service

@@ -12,10 +12,11 @@ Conflicts=chronyd.service ntpd.service systemd-timesyncd.service
 ConditionCapability=CAP_SYS_TIME
 
 [Service]
-Type=forking
+Type=notify
 PIDFile=/run/chrony/chronyd.pid
+Environment="OPTIONS="
 EnvironmentFile=-/etc/sysconfig/chronyd
-ExecStart=/usr/sbin/chronyd -U $OPTIONS
+ExecStart=/usr/sbin/chronyd -n -U $OPTIONS
 
 User=chrony
 LogsDirectory=chrony
@@ -36,7 +37,6 @@ PrivateDevices=yes
 PrivateTmp=yes
 # This breaks adjtimex()
 #PrivateUsers=yes
-ProcSubset=pid
 ProtectControlGroups=yes
 ProtectHome=yes
 ProtectHostname=yes

examples/chronyd.service

@@ -6,10 +6,11 @@ Conflicts=ntpd.service systemd-timesyncd.service
 ConditionCapability=CAP_SYS_TIME
 
 [Service]
-Type=forking
+Type=notify
 PIDFile=/run/chrony/chronyd.pid
+Environment="OPTIONS="
 EnvironmentFile=-/etc/sysconfig/chronyd
-ExecStart=/usr/sbin/chronyd $OPTIONS
+ExecStart=/usr/sbin/chronyd -n $OPTIONS
 
 CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
 CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_KILL CAP_LEASE CAP_LINUX_IMMUTABLE
@@ -24,7 +25,6 @@ LockPersonality=yes
 MemoryDenyWriteExecute=yes
 NoNewPrivileges=yes
 PrivateTmp=yes
-ProcSubset=pid
 ProtectControlGroups=yes
 ProtectHome=yes
 ProtectHostname=yes

getdate.y

@@ -907,6 +907,7 @@ get_date (const char *p, const time_t *now)
   yyHour = tmp->tm_hour;
   yyMinutes = tmp->tm_min;
   yySeconds = tmp->tm_sec;
+  memset(&tm, 0, sizeof (tm));
   tm.tm_isdst = tmp->tm_isdst;
   yyMeridian = MER24;
   yyRelSeconds = 0;

hwclock.c

@@ -49,6 +49,7 @@
 #define DELAY_QUANT_MAX_K 2
 #define DELAY_QUANT_Q 10
 #define DELAY_QUANT_REPEAT 7
+#define DELAY_QUANT_LARGE_STEP_DELAY 1000
 #define DELAY_QUANT_MIN_STEP 1.0e-9
 
 struct HCL_Instance_Record {
@@ -127,6 +128,7 @@ HCL_CreateInstance(int min_samples, int max_samples, double min_separation, doub
   clock->precision = precision;
   clock->delay_quants = QNT_CreateInstance(DELAY_QUANT_MIN_K, DELAY_QUANT_MAX_K,
                                            DELAY_QUANT_Q, DELAY_QUANT_REPEAT,
+                                           DELAY_QUANT_LARGE_STEP_DELAY,
                                            DELAY_QUANT_MIN_STEP);
 
   LCL_AddParameterChangeHandler(handle_slew, clock);
@@ -199,8 +201,10 @@ HCL_ProcessReadings(HCL_Instance clock, int n_readings, struct timespec tss[][3]
 
   local_prec = LCL_GetSysPrecisionAsQuantum();
 
-  low_delay = QNT_GetQuantile(clock->delay_quants, DELAY_QUANT_MIN_K);
-  high_delay = QNT_GetQuantile(clock->delay_quants, DELAY_QUANT_MAX_K);
+  low_delay = QNT_GetQuantile(clock->delay_quants, QNT_GetMinK(clock->delay_quants)) -
+              QNT_GetMinStep(clock->delay_quants) / 2.0;
+  high_delay = QNT_GetQuantile(clock->delay_quants, QNT_GetMaxK(clock->delay_quants)) +
+               QNT_GetMinStep(clock->delay_quants) / 2.0;
   low_delay = MIN(low_delay, high_delay);
   high_delay = MAX(high_delay, low_delay + local_prec);
 

keys.c

@@ -405,7 +405,7 @@ check_auth(Key *key, const void *data, int data_len,
 
   hash_len = generate_auth(key, data, data_len, buf, sizeof (buf));
 
-  return MIN(hash_len, trunc_len) == auth_len && !memcmp(buf, auth, auth_len);
+  return MIN(hash_len, trunc_len) == auth_len && UTI_IsMemoryEqual(buf, auth, auth_len);
 }
 
 /* ================================================== */

leapdb.c

@@ -0,0 +1,272 @@
+/*
+  chronyd/chronyc - Programs for keeping computer clocks accurate.
+
+ **********************************************************************
+ * Copyright (C) Miroslav Lichvar  2009-2018, 2020, 2022
+ * Copyright (C) Patrick Oppenlander 2023, 2024
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ *
+ **********************************************************************
+
+  =======================================================================
+
+  This module provides leap second information. */
+
+#include "config.h"
+
+#include "sysincl.h"
+
+#include "conf.h"
+#include "leapdb.h"
+#include "logging.h"
+#include "util.h"
+
+/* ================================================== */
+
+/* Source of leap second data */
+enum {
+  SRC_NONE,
+  SRC_TIMEZONE,
+  SRC_LIST,
+} leap_src;
+
+/* Offset between leap-seconds.list timestamp epoch and Unix epoch.
+   leap-seconds.list epoch is 1 Jan 1900, 00:00:00 */
+#define LEAP_SEC_LIST_OFFSET 2208988800
+
+/* ================================================== */
+
+static NTP_Leap
+get_tz_leap(time_t when, int *tai_offset)
+{
+  struct tm stm, *tm;
+  time_t t;
+  char *tz_env, tz_orig[128];
+  NTP_Leap tz_leap = LEAP_Normal;
+
+  tm = gmtime(&when);
+  if (!tm)
+    return tz_leap;
+
+  stm = *tm;
+
+  /* Temporarily switch to the timezone containing leap seconds */
+  tz_env = getenv("TZ");
+  if (tz_env) {
+    if (strlen(tz_env) >= sizeof (tz_orig))
+      return tz_leap;
+    strcpy(tz_orig, tz_env);
+  }
+  setenv("TZ", CNF_GetLeapSecTimezone(), 1);
+  tzset();
+
+  /* Get the TAI-UTC offset, which started at the epoch at 10 seconds */
+  t = mktime(&stm);
+  if (t != -1)
+    *tai_offset = t - when + 10;
+
+  /* Set the time to 23:59:60 and see how it overflows in mktime() */
+  stm.tm_sec = 60;
+  stm.tm_min = 59;
+  stm.tm_hour = 23;
+
+  t = mktime(&stm);
+
+  if (tz_env)
+    setenv("TZ", tz_orig, 1);
+  else
+    unsetenv("TZ");
+  tzset();
+
+  if (t == -1)
+    return tz_leap;
+
+  if (stm.tm_sec == 60)
+    tz_leap = LEAP_InsertSecond;
+  else if (stm.tm_sec == 1)
+    tz_leap = LEAP_DeleteSecond;
+
+  return tz_leap;
+}
+
+/* ================================================== */
+
+static NTP_Leap
+get_list_leap(time_t when, int *tai_offset)
+{
+  FILE *f;
+  char line[1024];
+  NTP_Leap ret_leap = LEAP_Normal;
+  int ret_tai_offset = 0, prev_lsl_tai_offset = 10;
+  int64_t when1900, lsl_updated = 0, lsl_expiry = 0;
+  const char *leap_sec_list = CNF_GetLeapSecList();
+
+  if (!(f = UTI_OpenFile(NULL, leap_sec_list, NULL, 'r', 0))) {
+    LOG(LOGS_ERR, "Failed to open leap seconds list %s", leap_sec_list);
+    goto out;
+  }
+
+  /* Leap second happens at midnight */
+  when = (when / (24 * 3600) + 1) * (24 * 3600);
+
+  /* leap-seconds.list timestamps are relative to 1 Jan 1900, 00:00:00 */
+  when1900 = (int64_t)when + LEAP_SEC_LIST_OFFSET;
+
+  while (fgets(line, sizeof line, f) > 0) {
+    int64_t lsl_when;
+    int lsl_tai_offset;
+    char *p;
+
+    /* Ignore blank lines */
+    for (p = line; *p && isspace(*p); ++p)
+      ;
+    if (!*p)
+      continue;
+
+    if (*line == '#') {
+      /* Update time line starts with #$ */
+      if (line[1] == '$' && sscanf(line + 2, "%"SCNd64, &lsl_updated) != 1)
+        goto error;
+      /* Expiration time line starts with #@ */
+      if (line[1] == '@' && sscanf(line + 2, "%"SCNd64, &lsl_expiry) != 1)
+        goto error;
+      /* Comment or a special comment we don't care about */
+      continue;
+    }
+
+    /* Leap entry */
+    if (sscanf(line, "%"SCNd64" %d", &lsl_when, &lsl_tai_offset) != 2)
+      goto error;
+
+    if (when1900 == lsl_when) {
+      if (lsl_tai_offset > prev_lsl_tai_offset)
+        ret_leap = LEAP_InsertSecond;
+      else if (lsl_tai_offset < prev_lsl_tai_offset)
+        ret_leap = LEAP_DeleteSecond;
+      /* When is rounded to the end of the day, so offset hasn't changed yet! */
+      ret_tai_offset = prev_lsl_tai_offset;
+    } else if (when1900 > lsl_when) {
+      ret_tai_offset = lsl_tai_offset;
+    }
+
+    prev_lsl_tai_offset = lsl_tai_offset;
+  }
+
+  /* Make sure the file looks sensible */
+  if (!feof(f) || !lsl_updated || !lsl_expiry)
+    goto error;
+
+  if (when1900 >= lsl_expiry)
+    LOG(LOGS_WARN, "Leap second list %s needs update", leap_sec_list);
+
+  goto out;
+
+error:
+  if (f)
+    fclose(f);
+  LOG(LOGS_ERR, "Failed to parse leap seconds list %s", leap_sec_list);
+  return LEAP_Normal;
+
+out:
+  if (f)
+    fclose(f);
+  *tai_offset = ret_tai_offset;
+  return ret_leap;
+}
+
+/* ================================================== */
+
+static int
+check_leap_source(NTP_Leap (*src)(time_t when, int *tai_offset))
+{
+  int tai_offset = 0;
+
+  /* Check that the leap second source has good data for Jun 30 2012 and Dec 31 2012 */
+  if (src(1341014400, &tai_offset) == LEAP_InsertSecond && tai_offset == 34 &&
+      src(1356912000, &tai_offset) == LEAP_Normal && tai_offset == 35)
+    return 1;
+
+  return 0;
+}
+
+/* ================================================== */
+
+void
+LDB_Initialise(void)
+{
+  const char *leap_tzname, *leap_sec_list;
+
+  leap_tzname = CNF_GetLeapSecTimezone();
+  if (leap_tzname && !check_leap_source(get_tz_leap)) {
+    LOG(LOGS_WARN, "Timezone %s failed leap second check, ignoring", leap_tzname);
+    leap_tzname = NULL;
+  }
+
+  leap_sec_list = CNF_GetLeapSecList();
+  if (leap_sec_list && !check_leap_source(get_list_leap)) {
+    LOG(LOGS_WARN, "Leap second list %s failed check, ignoring", leap_sec_list);
+    leap_sec_list = NULL;
+  }
+
+  if (leap_sec_list) {
+    LOG(LOGS_INFO, "Using leap second list %s", leap_sec_list);
+    leap_src = SRC_LIST;
+  } else if (leap_tzname) {
+    LOG(LOGS_INFO, "Using %s timezone to obtain leap second data", leap_tzname);
+    leap_src = SRC_TIMEZONE;
+  }
+}
+
+/* ================================================== */
+
+NTP_Leap
+LDB_GetLeap(time_t when, int *tai_offset)
+{
+  static time_t last_ldb_leap_check;
+  static NTP_Leap ldb_leap;
+  static int ldb_tai_offset;
+
+  /* Do this check at most twice a day */
+  when = when / (12 * 3600) * (12 * 3600);
+  if (last_ldb_leap_check == when)
+    goto out;
+
+  last_ldb_leap_check = when;
+  ldb_leap = LEAP_Normal;
+  ldb_tai_offset = 0;
+
+  switch (leap_src) {
+  case SRC_NONE:
+    break;
+  case SRC_TIMEZONE:
+    ldb_leap = get_tz_leap(when, &ldb_tai_offset);
+    break;
+  case SRC_LIST:
+    ldb_leap = get_list_leap(when, &ldb_tai_offset);
+    break;
+  }
+
+out:
+  *tai_offset = ldb_tai_offset;
+  return ldb_leap;
+}
+
+/* ================================================== */
+
+void
+LDB_Finalise(void)
+{
+  /* Nothing to do */
+}

leapdb.h

@@ -0,0 +1,37 @@
+/*
+  chronyd/chronyc - Programs for keeping computer clocks accurate.
+
+ **********************************************************************
+ * Copyright (C) Patrick Oppenlander 2024
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ *
+ **********************************************************************
+
+  =======================================================================
+
+  This module provides leap second information.
+
+  */
+
+#ifndef GOT_LEAPDB_H
+#define GOT_LEAPDB_H
+
+#include "ntp.h"
+
+extern void LDB_Initialise(void);
+extern NTP_Leap LDB_GetLeap(time_t when, int *tai_offset);
+extern void LDB_Finalise(void);
+
+#endif /* GOT_LEAPDB_H */

local.c

@@ -184,10 +184,8 @@ void
 LCL_Finalise(void)
 {
   /* Make sure all handlers have been removed */
-  if (change_list.next != &change_list)
-    assert(0);
-  if (dispersion_notify_list.next != &dispersion_notify_list)
-    assert(0);
+  BRIEF_ASSERT(change_list.next == &change_list);
+  BRIEF_ASSERT(dispersion_notify_list.next == &dispersion_notify_list);
 }
 
 /* ================================================== */
@@ -225,9 +223,7 @@ LCL_AddParameterChangeHandler(LCL_ParameterChangeHandler handler, void *anything
 
   /* Check that the handler is not already registered */
   for (ptr = change_list.next; ptr != &change_list; ptr = ptr->next) {
-    if (!(ptr->handler != handler || ptr->anything != anything)) {
-      assert(0);
-    }
+    BRIEF_ASSERT(ptr->handler != handler || ptr->anything != anything);
   }
 
   new_entry = MallocNew(ChangeListEntry);
@@ -301,9 +297,7 @@ LCL_AddDispersionNotifyHandler(LCL_DispersionNotifyHandler handler, void *anythi
 
   /* Check that the handler is not already registered */
   for (ptr = dispersion_notify_list.next; ptr != &dispersion_notify_list; ptr = ptr->next) {
-    if (!(ptr->handler != handler || ptr->anything != anything)) {
-      assert(0);
-    }
+    BRIEF_ASSERT(ptr->handler != handler || ptr->anything != anything);
   }
 
   new_entry = MallocNew(DispersionNotifyListEntry);
@@ -701,8 +695,11 @@ LCL_MakeStep(void)
 
   /* Cancel remaining slew and make the step */
   LCL_AccumulateOffset(correction, 0.0);
-  if (!LCL_ApplyStepOffset(-correction))
+  if (!LCL_ApplyStepOffset(-correction)) {
+    /* Revert the correction */
+    LCL_AccumulateOffset(-correction, 0.0);
     return 0;
+  }
 
   LOG(LOGS_WARN, "System clock was stepped by %.6f seconds", correction);
 

logging.c

@@ -46,6 +46,7 @@ static LOG_Context log_contexts;
 /* Flag indicating we have initialised */
 static int initialised = 0;
 
+static char *file_log_path = NULL;
 static FILE *file_log = NULL;
 static int system_log = 0;
 
@@ -90,8 +91,11 @@ LOG_Finalise(void)
   if (system_log)
     closelog();
 
-  if (file_log)
+  if (file_log && file_log != stderr)
     fclose(file_log);
+  file_log = NULL;
+  Free(file_log_path);
+  file_log_path = NULL;
 
   LOG_CycleLogFiles();
 
@@ -145,6 +149,7 @@ void LOG_Message(LOG_Severity severity,
   struct tm *tm;
 
   assert(initialised);
+  severity = CLAMP(LOGS_DEBUG, severity, LOGS_FATAL);
 
   if (!system_log && file_log && severity >= log_min_severity) {
     /* Don't clutter up syslog with timestamps and internal debugging info */
@@ -155,8 +160,13 @@ void LOG_Message(LOG_Severity severity,
       fprintf(file_log, "%s ", buf);
     }
 #if DEBUG > 0
-    if (log_min_severity <= LOGS_DEBUG)
-      fprintf(file_log, "%s%s:%d:(%s) ", debug_prefix, filename, line_number, function_name);
+    if (log_min_severity <= LOGS_DEBUG) {
+      /* Log severity to character mapping (debug, info, warn, err, fatal) */
+      const char severity_chars[LOGS_FATAL - LOGS_DEBUG + 1] = {'D', 'I', 'W', 'E', 'F'};
+
+      fprintf(file_log, "%c:%s%s:%d:(%s) ", severity_chars[severity - LOGS_DEBUG],
+              debug_prefix, filename, line_number, function_name);
+    }
 #endif
   }
 
@@ -179,7 +189,7 @@ void LOG_Message(LOG_Severity severity,
       /* Send the message also to the foreground process if it is
          still running, or stderr if it is still open */
       if (parent_fd > 0) {
-        if (write(parent_fd, buf, strlen(buf) + 1) < 0)
+        if (!LOG_NotifyParent(buf))
           ; /* Not much we can do here */
       } else if (system_log && parent_fd == 0) {
         system_log = 0;
@@ -194,27 +204,42 @@ void LOG_Message(LOG_Severity severity,
 
 /* ================================================== */
 
-void
-LOG_OpenFileLog(const char *log_file)
+static FILE *
+open_file_log(const char *log_file, char mode)
 {
   FILE *f;
 
   if (log_file) {
-    f = UTI_OpenFile(NULL, log_file, NULL, 'A', 0640);
+    f = UTI_OpenFile(NULL, log_file, NULL, mode, 0640);
   } else {
     f = stderr;
   }
 
   /* Enable line buffering */
-  setvbuf(f, NULL, _IOLBF, BUFSIZ);
+  if (f)
+    setvbuf(f, NULL, _IOLBF, BUFSIZ);
+
+  return f;
+}
+
+/* ================================================== */
+
+void
+LOG_OpenFileLog(const char *log_file)
+{
+  if (file_log_path)
+    Free(file_log_path);
+  if (log_file)
+    file_log_path = Strdup(log_file);
+  else
+    file_log_path = NULL;
 
   if (file_log && file_log != stderr)
     fclose(file_log);
 
-  file_log = f;
+  file_log = open_file_log(file_log_path, 'A');
 }
 
-
 /* ================================================== */
 
 void
@@ -285,6 +310,17 @@ LOG_SetParentFd(int fd)
 
 /* ================================================== */
 
+int
+LOG_NotifyParent(const char *message)
+{
+  if (parent_fd <= 0)
+    return 1;
+
+  return write(parent_fd, message, strlen(message) + 1) > 0;
+}
+
+/* ================================================== */
+
 void
 LOG_CloseParentFd()
 {
@@ -368,14 +404,29 @@ LOG_FileWrite(LOG_FileID id, const char *format, ...)
 void
 LOG_CycleLogFiles(void)
 {
+  struct stat st;
   LOG_FileID i;
+  FILE *f;
 
+  /* The log will be opened later when an entry is logged */
   for (i = 0; i < n_filelogs; i++) {
     if (logfiles[i].file)
       fclose(logfiles[i].file);
     logfiles[i].file = NULL;
     logfiles[i].writes = 0;
   }
+
+  /* Try to open the log specified by the -l option, but only if nothing is
+     present at its path to avoid unnecessary error messages.  Keep the
+     original file if that fails (the process might no longer have the
+     necessary privileges to write in the directory). */
+  if (file_log && file_log != stderr && stat(file_log_path, &st) < 0 && errno == ENOENT) {
+    f = open_file_log(file_log_path, 'a');
+    if (f) {
+      fclose(file_log);
+      file_log = f;
+    }
+  }
 }
 
 /* ================================================== */

logging.h

@@ -126,7 +126,10 @@ extern void LOG_OpenSystemLog(void);
 /* Stop using stderr and send fatal message to the foreground process */
 extern void LOG_SetParentFd(int fd);
 
-/* Close the pipe to the foreground process so it can exit */
+/* Send a message to the foreground process */
+extern int LOG_NotifyParent(const char *message);
+
+/* Close the pipe to the foreground process */
 extern void LOG_CloseParentFd(void);
 
 /* File logging functions */

main.c

@@ -32,6 +32,7 @@
 
 #include "main.h"
 #include "sched.h"
+#include "leapdb.h"
 #include "local.h"
 #include "sys.h"
 #include "ntp_io.h"
@@ -106,11 +107,40 @@ delete_pidfile(void)
 
 /* ================================================== */
 
+static void
+notify_system_manager(int start)
+{
+#ifdef LINUX
+  /* The systemd protocol is documented in the sd_notify(3) man page */
+  const char *message, *path = getenv("NOTIFY_SOCKET");
+  int sock_fd;
+
+  if (!path)
+    return;
+
+  if (path[0] != '/')
+    LOG_FATAL("Unsupported notification socket");
+
+  message = start ? "READY=1" : "STOPPING=1";
+
+  sock_fd = SCK_OpenUnixDatagramSocket(path, NULL, 0);
+
+  if (sock_fd < 0 || SCK_Send(sock_fd, message, strlen(message), 0) != strlen(message))
+    LOG_FATAL("Could not send notification to $NOTIFY_SOCKET");
+
+  SCK_CloseSocket(sock_fd);
+#endif
+}
+
+/* ================================================== */
+
 void
 MAI_CleanupAndExit(void)
 {
   if (!initialised) exit(exit_status);
   
+  notify_system_manager(0);
+
   LCL_CancelOffsetCorrection();
   SRC_DumpSources();
 
@@ -134,6 +164,7 @@ MAI_CleanupAndExit(void)
   RCL_Finalise();
   SRC_Finalise();
   REF_Finalise();
+  LDB_Finalise();
   RTC_Finalise();
   SYS_Finalise();
 
@@ -213,7 +244,12 @@ post_init_ntp_hook(void *anything)
     REF_SetMode(ref_mode);
   }
 
-  /* Close the pipe to the foreground process so it can exit */
+  notify_system_manager(1);
+
+  /* Send an empty message to the foreground process so it can exit.
+     If that fails, indicating the process was killed, exit too. */
+  if (!LOG_NotifyParent(""))
+    SCH_QuitProgram();
   LOG_CloseParentFd();
 
   CNF_AddSources();
@@ -331,10 +367,16 @@ go_daemon(void)
     char message[1024];
     int r;
 
-    close(pipefd[1]);
+    /* Don't exit before the 'parent' */
+    waitpid(pid, NULL, 0);
+
     r = read(pipefd[0], message, sizeof (message));
-    if (r) {
-      if (r > 0) {
+
+    close(pipefd[0]);
+    close(pipefd[1]);
+
+    if (r != 1 || message[0] != '\0') {
+      if (r > 1) {
         /* Print the error message from the child */
         message[sizeof (message) - 1] = '\0';
         fprintf(stderr, "%s\n", message);
@@ -343,8 +385,6 @@ go_daemon(void)
     } else
       exit(0);
   } else {
-    close(pipefd[0]);
-
     setsid();
 
     /* Do 2nd fork, as-per recommended practice for launching daemons. */
@@ -353,7 +393,10 @@ go_daemon(void)
     if (pid < 0) {
       LOG_FATAL("fork() failed : %s", strerror(errno));
     } else if (pid > 0) {
-      exit(0); /* In the 'parent' */
+      /* In the 'parent' */
+      close(pipefd[0]);
+      close(pipefd[1]);
+      exit(0);
     } else {
       /* In the child we want to leave running as the daemon */
 
@@ -363,9 +406,9 @@ go_daemon(void)
       }
 
       /* Don't keep stdin/out/err from before. But don't close
-         the parent pipe yet. */
+         the parent pipe yet, or reusable file descriptors. */
       for (fd=0; fd<1024; fd++) {
-        if (fd != pipefd[1])
+        if (fd != pipefd[1] && !SCK_IsReusable(fd))
           close(fd);
       }
 
@@ -555,6 +598,9 @@ int main
   if (user_check && getuid() != 0)
     LOG_FATAL("Not superuser");
 
+  /* Initialise reusable file descriptors before fork */
+  SCK_PreInitialise();
+
   /* Turn into a daemon */
   if (!nofork) {
     go_daemon();
@@ -647,6 +693,7 @@ int main
   if (!geteuid())
     LOG(LOGS_WARN, "Running with root privileges");
 
+  LDB_Initialise();
   REF_Initialise();
   SST_Initialise();
   NSR_Initialise();

memory.c

@@ -47,8 +47,13 @@ Realloc(void *ptr, size_t size)
 {
   void *r;
 
+  if (size == 0) {
+    Free(ptr);
+    return NULL;
+  }
+
   r = realloc(ptr, size);
-  if (!r && size)
+  if (!r)
     LOG_FATAL("Could not allocate memory");
 
   return r;

ntp.h

@@ -115,9 +115,11 @@ typedef struct {
 
 /* Non-authentication extension fields and corresponding internal flags */
 
-#define NTP_EF_EXP1                     0xF323
+#define NTP_EF_EXP_MONO_ROOT            0xF323
+#define NTP_EF_EXP_NET_CORRECTION       0xF324
 
-#define NTP_EF_FLAG_EXP1                0x1
+#define NTP_EF_FLAG_EXP_MONO_ROOT       0x1
+#define NTP_EF_FLAG_EXP_NET_CORRECTION  0x2
 
 /* Pre-NTPv5 experimental extension field */
 typedef struct {
@@ -126,9 +128,18 @@ typedef struct {
   NTP_int32 root_dispersion;
   NTP_int64 mono_receive_ts;
   uint32_t mono_epoch;
-} NTP_ExtFieldExp1;
+} NTP_EFExpMonoRoot;
 
-#define NTP_EF_EXP1_MAGIC 0xF5BEDD9AU
+#define NTP_EF_EXP_MONO_ROOT_MAGIC      0xF5BEDD9AU
+
+/* Experimental extension field to provide PTP corrections */
+typedef struct {
+  uint32_t magic;
+  NTP_int64 correction;
+  uint32_t reserved[3];
+} NTP_EFExpNetCorrection;
+
+#define NTP_EF_EXP_NET_CORRECTION_MAGIC 0x07AC2CEBU
 
 /* Authentication extension fields */
 

ntp_core.c

@@ -3,7 +3,7 @@
 
  **********************************************************************
  * Copyright (C) Richard P. Curnow  1997-2003
- * Copyright (C) Miroslav Lichvar  2009-2022
+ * Copyright (C) Miroslav Lichvar  2009-2024
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -215,16 +215,13 @@ struct NCR_Instance_Record {
   SPF_Instance filter;
   int filter_count;
 
-  /* Flag indicating HW transmit timestamps are expected */
-  int had_hw_tx_timestamp;
-
   /* Response waiting for a HW transmit timestamp of the request */
   struct SavedResponse *saved_response;
 
   int burst_good_samples_to_go;
   int burst_total_samples_to_go;
 
-  /* Report from last valid response */
+  /* Report from last valid response and packet/timestamp statistics */
   RPT_NTPReport report;
 };
 
@@ -289,6 +286,7 @@ static ARR_Instance broadcasts;
 
 /* Parameters for the peer delay quantile */
 #define DELAY_QUANT_Q 100
+#define DELAY_QUANT_LARGE_STEP_DELAY 100
 #define DELAY_QUANT_REPEAT 7
 
 /* Minimum and maximum allowed poll interval */
@@ -317,6 +315,9 @@ static ARR_Instance broadcasts;
 /* Maximum acceptable change in server mono<->real offset */
 #define MAX_MONO_DOFFSET 16.0
 
+/* Maximum assumed frequency error in network corrections */
+#define MAX_NET_CORRECTION_FREQ 100.0e-6
+
 /* Invalid socket, different from the one in ntp_io.c */
 #define INVALID_SOCK_FD -2
 
@@ -376,6 +377,9 @@ do_size_checks(void)
   assert(offsetof(NTP_Packet, originate_ts)    == 24);
   assert(offsetof(NTP_Packet, receive_ts)      == 32);
   assert(offsetof(NTP_Packet, transmit_ts)     == 40);
+
+  assert(sizeof (NTP_EFExpMonoRoot) == 24);
+  assert(sizeof (NTP_EFExpNetCorrection) == 24);
 }
 
 /* ================================================== */
@@ -421,6 +425,8 @@ zero_local_timestamp(NTP_Local_Timestamp *ts)
   UTI_ZeroTimespec(&ts->ts);
   ts->err = 0.0;
   ts->source = NTP_TS_DAEMON;
+  ts->rx_duration = 0.0;
+  ts->net_correction = 0.0;
 }
 
 /* ================================================== */
@@ -647,7 +653,7 @@ NCR_CreateInstance(NTP_Remote_Address *remote_addr, NTP_Source_Type type,
   result->auto_burst = params->burst;
   result->auto_offline = params->auto_offline;
   result->copy = params->copy && result->mode == MODE_CLIENT;
-  result->poll_target = params->poll_target;
+  result->poll_target = MAX(1, params->poll_target);
   result->ext_field_flags = params->ext_fields;
 
   if (params->nts) {
@@ -685,6 +691,7 @@ NCR_CreateInstance(NTP_Remote_Address *remote_addr, NTP_Source_Type type,
   if (params->max_delay_quant > 0.0) {
     int k = round(CLAMP(0.05, params->max_delay_quant, 0.95) * DELAY_QUANT_Q);
     result->delay_quant = QNT_CreateInstance(k, k, DELAY_QUANT_Q, DELAY_QUANT_REPEAT,
+                                             DELAY_QUANT_LARGE_STEP_DELAY,
                                              LCL_GetSysPrecisionAsQuantum() / 2.0);
   } else {
     result->delay_quant = NULL;
@@ -794,8 +801,6 @@ NCR_ResetInstance(NCR_Instance instance)
   if (instance->filter)
     SPF_DropSamples(instance->filter);
   instance->filter_count = 0;
-
-  instance->had_hw_tx_timestamp = 0;
 }
 
 /* ================================================== */
@@ -803,6 +808,8 @@ NCR_ResetInstance(NCR_Instance instance)
 void
 NCR_ResetPoll(NCR_Instance instance)
 {
+  instance->poll_score = 0.0;
+
   if (instance->local_poll != instance->minpoll) {
     instance->local_poll = instance->minpoll;
 
@@ -833,6 +840,12 @@ NCR_ChangeRemoteAddress(NCR_Instance inst, NTP_Remote_Address *remote_addr, int
     inst->local_addr.sock_fd = NIO_OpenServerSocket(remote_addr);
   }
 
+  /* Reset the polling interval only if the source wasn't unreachable to
+     avoid increasing server/network load in case that is what caused
+     the source to be unreachable */
+  if (SRC_IsReachable(inst->source))
+    NCR_ResetPoll(inst);
+
   /* Update the reference ID and reset the source/sourcestats instances */
   SRC_SetRefid(inst->source, UTI_IPToRefid(&remote_addr->ip_addr),
                &inst->remote_addr.ip_addr);
@@ -1042,34 +1055,64 @@ receive_timeout(void *arg)
 /* ================================================== */
 
 static int
-add_ext_exp1(NTP_Packet *message, NTP_PacketInfo *info, struct timespec *rx,
-             double root_delay, double root_dispersion)
+add_ef_mono_root(NTP_Packet *message, NTP_PacketInfo *info, struct timespec *rx,
+                 double root_delay, double root_dispersion)
 {
   struct timespec mono_rx;
-  NTP_ExtFieldExp1 exp1;
+  NTP_EFExpMonoRoot ef;
   NTP_int64 ts_fuzz;
 
-  memset(&exp1, 0, sizeof (exp1));
-  exp1.magic = htonl(NTP_EF_EXP1_MAGIC);
+  memset(&ef, 0, sizeof (ef));
+  ef.magic = htonl(NTP_EF_EXP_MONO_ROOT_MAGIC);
 
   if (info->mode != MODE_CLIENT) {
-    exp1.root_delay = UTI_DoubleToNtp32f28(root_delay);
-    exp1.root_dispersion = UTI_DoubleToNtp32f28(root_dispersion);
+    ef.root_delay = UTI_DoubleToNtp32f28(root_delay);
+    ef.root_dispersion = UTI_DoubleToNtp32f28(root_dispersion);
     if (rx)
       UTI_AddDoubleToTimespec(rx, server_mono_offset, &mono_rx);
     else
       UTI_ZeroTimespec(&mono_rx);
     UTI_GetNtp64Fuzz(&ts_fuzz, message->precision);
-    UTI_TimespecToNtp64(&mono_rx, &exp1.mono_receive_ts, &ts_fuzz);
-    exp1.mono_epoch = htonl(server_mono_epoch);
+    UTI_TimespecToNtp64(&mono_rx, &ef.mono_receive_ts, &ts_fuzz);
+    ef.mono_epoch = htonl(server_mono_epoch);
   }
 
-  if (!NEF_AddField(message, info, NTP_EF_EXP1, &exp1, sizeof (exp1))) {
+  if (!NEF_AddField(message, info, NTP_EF_EXP_MONO_ROOT, &ef, sizeof (ef))) {
     DEBUG_LOG("Could not add EF");
     return 0;
   }
 
-  info->ext_field_flags |= NTP_EF_FLAG_EXP1;
+  info->ext_field_flags |= NTP_EF_FLAG_EXP_MONO_ROOT;
+
+  return 1;
+}
+
+/* ================================================== */
+
+static int
+add_ef_net_correction(NTP_Packet *message, NTP_PacketInfo *info,
+                      NTP_Local_Timestamp *local_rx)
+{
+  NTP_EFExpNetCorrection ef;
+
+  if (CNF_GetPtpPort() == 0) {
+    DEBUG_LOG("ptpport disabled");
+    return 1;
+  }
+
+  memset(&ef, 0, sizeof (ef));
+  ef.magic = htonl(NTP_EF_EXP_NET_CORRECTION_MAGIC);
+
+  if (info->mode != MODE_CLIENT && local_rx->net_correction > local_rx->rx_duration) {
+    UTI_DoubleToNtp64(local_rx->net_correction, &ef.correction);
+  }
+
+  if (!NEF_AddField(message, info, NTP_EF_EXP_NET_CORRECTION, &ef, sizeof (ef))) {
+    DEBUG_LOG("Could not add EF");
+    return 0;
+  }
+
+  info->ext_field_flags |= NTP_EF_FLAG_EXP_NET_CORRECTION;
 
   return 1;
 }
@@ -1221,9 +1264,13 @@ transmit_packet(NTP_Mode my_mode, /* The mode this machine wants to be */
     return 0;
 
   if (ext_field_flags) {
-    if (ext_field_flags & NTP_EF_FLAG_EXP1) {
-      if (!add_ext_exp1(&message, &info, smooth_time ? NULL : &local_receive,
-                        our_root_delay, our_root_dispersion))
+    if (ext_field_flags & NTP_EF_FLAG_EXP_MONO_ROOT) {
+      if (!add_ef_mono_root(&message, &info, smooth_time ? NULL : &local_receive,
+                            our_root_delay, our_root_dispersion))
+        return 0;
+    }
+    if (ext_field_flags & NTP_EF_FLAG_EXP_NET_CORRECTION) {
+      if (!add_ef_net_correction(&message, &info, local_rx))
         return 0;
     }
   }
@@ -1294,6 +1341,8 @@ transmit_packet(NTP_Mode my_mode, /* The mode this machine wants to be */
     local_tx->ts = local_transmit;
     local_tx->err = local_transmit_err;
     local_tx->source = NTP_TS_DAEMON;
+    local_tx->rx_duration = 0.0;
+    local_tx->net_correction = 0.0;
   }
 
   if (local_ntp_rx)
@@ -1487,6 +1536,14 @@ is_zero_data(unsigned char *data, int length)
 
 /* ================================================== */
 
+static int
+is_exp_ef(void *body, int body_length, int expected_body_length, uint32_t magic)
+{
+  return body_length == expected_body_length && *(uint32_t *)body == htonl(magic);
+}
+
+/* ================================================== */
+
 static int
 parse_packet(NTP_Packet *packet, int length, NTP_PacketInfo *info)
 {
@@ -1573,10 +1630,15 @@ parse_packet(NTP_Packet *packet, int length, NTP_PacketInfo *info)
       case NTP_EF_NTS_AUTH_AND_EEF:
         info->auth.mode = NTP_AUTH_NTS;
         break;
-      case NTP_EF_EXP1:
-        if (ef_body_length == sizeof (NTP_ExtFieldExp1) &&
-            ntohl(((NTP_ExtFieldExp1 *)ef_body)->magic) == NTP_EF_EXP1_MAGIC)
-          info->ext_field_flags |= NTP_EF_FLAG_EXP1;
+      case NTP_EF_EXP_MONO_ROOT:
+        if (is_exp_ef(ef_body, ef_body_length, sizeof (NTP_EFExpMonoRoot),
+                      NTP_EF_EXP_MONO_ROOT_MAGIC))
+          info->ext_field_flags |= NTP_EF_FLAG_EXP_MONO_ROOT;
+        break;
+      case NTP_EF_EXP_NET_CORRECTION:
+        if (is_exp_ef(ef_body, ef_body_length, sizeof (NTP_EFExpNetCorrection),
+                      NTP_EF_EXP_NET_CORRECTION_MAGIC))
+          info->ext_field_flags |= NTP_EF_FLAG_EXP_NET_CORRECTION;
         break;
       default:
         DEBUG_LOG("Unknown extension field type=%x", (unsigned int)ef_type);
@@ -1604,6 +1666,53 @@ parse_packet(NTP_Packet *packet, int length, NTP_PacketInfo *info)
 
 /* ================================================== */
 
+static void
+apply_net_correction(NTP_Sample *sample, NTP_Local_Timestamp *rx, NTP_Local_Timestamp *tx,
+                     double precision)
+{
+  double rx_correction, tx_correction, low_delay_correction;
+
+  /* Require some correction from transparent clocks to be present
+     in both directions (not just the local RX timestamp correction) */
+  if (rx->net_correction <= rx->rx_duration || tx->net_correction <= 0.0)
+    return;
+
+  /* With perfect corrections from PTP transparent clocks and short cables
+     the peer delay would be close to zero, or even negative if the server or
+     transparent clocks were running faster than client, which would invert the
+     sample weighting.  Adjust the correction to get a delay corresponding to
+     a direct connection to the server.  For simplicity, assume the TX and RX
+     link speeds are equal.  If not, the reported delay will be wrong, but it
+     will not cause an error in the offset. */
+  rx_correction = rx->net_correction - rx->rx_duration;
+  tx_correction = tx->net_correction - rx->rx_duration;
+
+  /* Use a slightly smaller value in the correction of delay to not overcorrect
+     if the transparent clocks run up to 100 ppm fast and keep a part of the
+     uncorrected delay for the sample weighting */
+  low_delay_correction = (rx_correction + tx_correction) *
+                         (1.0 - MAX_NET_CORRECTION_FREQ);
+
+  /* Make sure the correction is sane.  The values are not authenticated! */
+  if (low_delay_correction < 0.0 || low_delay_correction > sample->peer_delay) {
+    DEBUG_LOG("Invalid correction %.9f peer_delay=%.9f",
+              low_delay_correction, sample->peer_delay);
+    return;
+  }
+
+  /* Correct the offset and peer delay, but not the root delay to not
+     change the estimated maximum error */
+  sample->offset += (rx_correction - tx_correction) / 2.0;
+  sample->peer_delay -= low_delay_correction;
+  if (sample->peer_delay < precision)
+    sample->peer_delay = precision;
+
+  DEBUG_LOG("Applied correction rx=%.9f tx=%.9f dur=%.9f",
+            rx->net_correction, tx->net_correction, rx->rx_duration);
+}
+
+/* ================================================== */
+
 static int
 check_delay_ratio(NCR_Instance inst, SST_Stats stats,
                 struct timespec *sample_time, double delay)
@@ -1635,7 +1744,7 @@ check_delay_quant(NCR_Instance inst, double delay)
 
   quant = QNT_GetQuantile(inst->delay_quant, QNT_GetMinK(inst->delay_quant));
 
-  if (delay <= quant)
+  if (delay <= quant + QNT_GetMinStep(inst->delay_quant) / 2.0)
     return 1;
 
   DEBUG_LOG("maxdelayquant: delay=%e quant=%e", delay, quant);
@@ -1851,7 +1960,7 @@ process_response(NCR_Instance inst, int saved, NTP_Local_Address *local_addr,
   /* The skew and estimated frequency offset relative to the remote source */
   double skew, source_freq_lo, source_freq_hi;
 
-  /* RFC 5905 packet tests */
+  /* RFC 5905 and RFC 9769 packet tests */
   int test1, test2n, test2i, test2, test3, test5, test6, test7;
   int interleaved_packet, valid_packet, synced_packet;
 
@@ -1865,18 +1974,20 @@ process_response(NCR_Instance inst, int saved, NTP_Local_Address *local_addr,
   /* Extension fields */
   int parsed, ef_length, ef_type, ef_body_length;
   void *ef_body;
-  NTP_ExtFieldExp1 *ef_exp1;
+  NTP_EFExpMonoRoot *ef_mono_root;
+  NTP_EFExpNetCorrection *ef_net_correction;
 
   NTP_Local_Timestamp local_receive, local_transmit;
   double remote_interval, local_interval, response_time;
-  double delay_time, precision, mono_doffset;
+  double delay_time, precision, mono_doffset, net_correction;
   int updated_timestamps;
 
   /* ==================== */
 
   stats = SRC_GetSourcestats(inst->source);
 
-  ef_exp1 = NULL;
+  ef_mono_root = NULL;
+  ef_net_correction = NULL;
 
   /* Find requested non-authentication extension fields */
   if (inst->ext_field_flags & info->ext_field_flags) {
@@ -1886,11 +1997,17 @@ process_response(NCR_Instance inst, int saved, NTP_Local_Address *local_addr,
         break;
 
       switch (ef_type) {
-        case NTP_EF_EXP1:
-          if (inst->ext_field_flags & NTP_EF_FLAG_EXP1 &&
-              ef_body_length == sizeof (*ef_exp1) &&
-              ntohl(((NTP_ExtFieldExp1 *)ef_body)->magic) == NTP_EF_EXP1_MAGIC)
-            ef_exp1 = ef_body;
+        case NTP_EF_EXP_MONO_ROOT:
+          if (inst->ext_field_flags & NTP_EF_FLAG_EXP_MONO_ROOT &&
+              is_exp_ef(ef_body, ef_body_length, sizeof (*ef_mono_root),
+                        NTP_EF_EXP_MONO_ROOT_MAGIC))
+            ef_mono_root = ef_body;
+          break;
+        case NTP_EF_EXP_NET_CORRECTION:
+          if (inst->ext_field_flags & NTP_EF_FLAG_EXP_NET_CORRECTION &&
+              is_exp_ef(ef_body, ef_body_length, sizeof (*ef_net_correction),
+                        NTP_EF_EXP_NET_CORRECTION_MAGIC))
+            ef_net_correction = ef_body;
           break;
       }
     }
@@ -1899,15 +2016,15 @@ process_response(NCR_Instance inst, int saved, NTP_Local_Address *local_addr,
   pkt_leap = NTP_LVM_TO_LEAP(message->lvm);
   pkt_version = NTP_LVM_TO_VERSION(message->lvm);
   pkt_refid = ntohl(message->reference_id);
-  if (ef_exp1) {
-    pkt_root_delay = UTI_Ntp32f28ToDouble(ef_exp1->root_delay);
-    pkt_root_dispersion = UTI_Ntp32f28ToDouble(ef_exp1->root_dispersion);
+  if (ef_mono_root) {
+    pkt_root_delay = UTI_Ntp32f28ToDouble(ef_mono_root->root_delay);
+    pkt_root_dispersion = UTI_Ntp32f28ToDouble(ef_mono_root->root_dispersion);
   } else {
     pkt_root_delay = UTI_Ntp32ToDouble(message->root_delay);
     pkt_root_dispersion = UTI_Ntp32ToDouble(message->root_dispersion);
   }
 
-  /* Check if the packet is valid per RFC 5905, section 8.
+  /* Check if the packet is valid per RFC 5905 (section 8) and RFC 9769.
      The test values are 1 when passed and 0 when failed. */
   
   /* Test 1 checks for duplicate packet */
@@ -1958,7 +2075,7 @@ process_response(NCR_Instance inst, int saved, NTP_Local_Address *local_addr,
      response to the request, when at least one good response has already been
      accepted to avoid incorrectly confirming a tentative source. */
   if (valid_packet && synced_packet && !saved && !inst->valid_rx &&
-      inst->had_hw_tx_timestamp && inst->local_tx.source != NTP_TS_HARDWARE &&
+      NIO_IsHwTsEnabled() && inst->local_tx.source != NTP_TS_HARDWARE &&
       inst->report.total_good_count > 0) {
     if (save_response(inst, local_addr, rx_ts, message, info))
       return 1;
@@ -1986,11 +2103,11 @@ process_response(NCR_Instance inst, int saved, NTP_Local_Address *local_addr,
        the new sample.  In the interleaved mode, cancel the correction out in
        remote timestamps of the previous request and response, which were
        captured before the source accumulated the new time corrections. */
-    if (ef_exp1 && inst->remote_mono_epoch == ntohl(ef_exp1->mono_epoch) &&
-        !UTI_IsZeroNtp64(&ef_exp1->mono_receive_ts) &&
+    if (ef_mono_root && inst->remote_mono_epoch == ntohl(ef_mono_root->mono_epoch) &&
+        !UTI_IsZeroNtp64(&ef_mono_root->mono_receive_ts) &&
         !UTI_IsZeroNtp64(&inst->remote_ntp_monorx)) {
       mono_doffset =
-          UTI_DiffNtp64ToDouble(&ef_exp1->mono_receive_ts, &inst->remote_ntp_monorx) -
+          UTI_DiffNtp64ToDouble(&ef_mono_root->mono_receive_ts, &inst->remote_ntp_monorx) -
           UTI_DiffNtp64ToDouble(&message->receive_ts, &inst->remote_ntp_rx);
       if (fabs(mono_doffset) > MAX_MONO_DOFFSET)
         mono_doffset = 0.0;
@@ -1998,6 +2115,12 @@ process_response(NCR_Instance inst, int saved, NTP_Local_Address *local_addr,
       mono_doffset = 0.0;
     }
 
+    if (ef_net_correction) {
+      net_correction = UTI_Ntp64ToDouble(&ef_net_correction->correction);
+    } else {
+      net_correction = 0.0;
+    }
+
     /* Select remote and local timestamps for the new sample */
     if (interleaved_packet) {
       /* Prefer previous local TX and remote RX timestamps if it will make
@@ -2017,6 +2140,7 @@ process_response(NCR_Instance inst, int saved, NTP_Local_Address *local_addr,
         UTI_Ntp64ToTimespec(&message->receive_ts, &remote_receive);
         UTI_Ntp64ToTimespec(&inst->remote_ntp_rx, &remote_request_receive);
         local_transmit = inst->local_tx;
+        local_transmit.net_correction = net_correction;
         root_delay = MAX(pkt_root_delay, inst->remote_root_delay);
         root_dispersion = MAX(pkt_root_dispersion, inst->remote_root_dispersion);
       }
@@ -2031,6 +2155,7 @@ process_response(NCR_Instance inst, int saved, NTP_Local_Address *local_addr,
       remote_request_receive = remote_receive;
       local_receive = *rx_ts;
       local_transmit = inst->local_tx;
+      local_transmit.net_correction = net_correction;
       root_delay = pkt_root_delay;
       root_dispersion = pkt_root_dispersion;
     }
@@ -2074,6 +2199,9 @@ process_response(NCR_Instance inst, int saved, NTP_Local_Address *local_addr,
                              skew * fabs(local_interval);
     sample.root_delay = root_delay + sample.peer_delay;
     sample.root_dispersion = root_dispersion + sample.peer_dispersion;
+
+    /* Apply corrections from PTP transparent clocks if available and sane */
+    apply_net_correction(&sample, &local_receive, &local_transmit, precision);
     
     /* If the source is an active peer, this is the minimum assumed interval
        between previous two transmissions (if not constrained by minpoll) */
@@ -2082,8 +2210,11 @@ process_response(NCR_Instance inst, int saved, NTP_Local_Address *local_addr,
 
     /* Additional tests required to pass before accumulating the sample */
 
-    /* Test A requires that the minimum estimate of the peer delay is not
-       larger than the configured maximum, in both client modes that the server
+    /* Test A combines multiple tests to avoid changing the measurements log
+       format and ntpdata report.  It requires that the minimum estimate of the
+       peer delay is not larger than the configured maximum, it is not a
+       response in the 'warm up' exchange, the configured offset correction is
+       within the supported NTP interval, both client modes that the server
        processing time is sane, in interleaved client/server mode that the
        previous response was not in basic mode (which prevents using timestamps
        that minimise delay error), and in interleaved symmetric mode that the
@@ -2091,6 +2222,8 @@ process_response(NCR_Instance inst, int saved, NTP_Local_Address *local_addr,
        a missed response */
     testA = sample.peer_delay - sample.peer_dispersion <= inst->max_delay &&
             precision <= inst->max_delay &&
+            inst->presend_done <= 0 &&
+            UTI_IsTimeOffsetSane(&sample.time, sample.offset) &&
             !(inst->mode == MODE_CLIENT && response_time > MAX_SERVER_INTERVAL) &&
             !(inst->mode == MODE_CLIENT && interleaved_packet &&
               UTI_IsZeroTimespec(&inst->prev_local_tx.ts) &&
@@ -2129,6 +2262,7 @@ process_response(NCR_Instance inst, int saved, NTP_Local_Address *local_addr,
     sample.root_delay = sample.root_dispersion = 0.0;
     sample.time = rx_ts->ts;
     mono_doffset = 0.0;
+    net_correction = 0.0;
     local_receive = *rx_ts;
     local_transmit = inst->local_tx;
     testA = testB = testC = testD = 0;
@@ -2162,9 +2296,9 @@ process_response(NCR_Instance inst, int saved, NTP_Local_Address *local_addr,
     /* If available, update the monotonic timestamp and accumulate the offset.
        This needs to be done here to not lose changes in remote_ntp_rx in
        symmetric mode when there are multiple responses per request. */
-    if (ef_exp1 && !UTI_IsZeroNtp64(&ef_exp1->mono_receive_ts)) {
-      inst->remote_mono_epoch = ntohl(ef_exp1->mono_epoch);
-      inst->remote_ntp_monorx = ef_exp1->mono_receive_ts;
+    if (ef_mono_root && !UTI_IsZeroNtp64(&ef_mono_root->mono_receive_ts)) {
+      inst->remote_mono_epoch = ntohl(ef_mono_root->mono_epoch);
+      inst->remote_ntp_monorx = ef_mono_root->mono_receive_ts;
       inst->mono_doffset += mono_doffset;
     } else {
       inst->remote_mono_epoch = 0;
@@ -2172,8 +2306,11 @@ process_response(NCR_Instance inst, int saved, NTP_Local_Address *local_addr,
       inst->mono_doffset = 0.0;
     }
 
-    /* Don't use the same set of timestamps for the next sample */
-    if (interleaved_packet)
+    inst->local_tx.net_correction = net_correction;
+
+    /* Avoid reusing timestamps of an accumulated sample when switching
+       from basic mode to interleaved mode */
+    if (interleaved_packet || !good_packet)
       inst->prev_local_tx = inst->local_tx;
     else
       zero_local_timestamp(&inst->prev_local_tx);
@@ -2192,21 +2329,16 @@ process_response(NCR_Instance inst, int saved, NTP_Local_Address *local_addr,
   /* Accept at most one response per request.  The NTP specification recommends
      resetting local_ntp_tx to make the following packets fail test2 or test3,
      but that would not allow the code above to make multiple updates of the
-     timestamps in symmetric mode.  Also, ignore presend responses. */
+     timestamps in symmetric mode. */
   if (inst->valid_rx) {
     test2 = test3 = 0;
     valid_packet = synced_packet = good_packet = 0;
   } else if (valid_packet) {
-    if (inst->presend_done) {
-      testA = 0;
-      good_packet = 0;
-    }
     inst->valid_rx = 1;
   }
 
-  if ((unsigned int)local_receive.source >= sizeof (tss_chars) ||
-      (unsigned int)local_transmit.source >= sizeof (tss_chars))
-    assert(0);
+  BRIEF_ASSERT((unsigned int)local_receive.source < sizeof (tss_chars) &&
+               (unsigned int)local_transmit.source < sizeof (tss_chars));
 
   DEBUG_LOG("NTP packet lvm=%o stratum=%d poll=%d prec=%d root_delay=%.9f root_disp=%.9f refid=%"PRIx32" [%s]",
             message->lvm, message->stratum, message->poll, message->precision,
@@ -2243,13 +2375,17 @@ process_response(NCR_Instance inst, int saved, NTP_Local_Address *local_addr,
 
     SRC_UpdateReachability(inst->source, synced_packet);
 
-    if (synced_packet) {
-      if (inst->copy && inst->remote_stratum > 0) {
-        /* Assume the reference ID and stratum of the server */
+    if (inst->copy) {
+      /* Assume the reference ID and stratum of the server */
+      if (synced_packet && inst->remote_stratum > 0) {
         inst->remote_stratum--;
         SRC_SetRefid(inst->source, ntohl(message->reference_id), &inst->remote_addr.ip_addr);
+      } else {
+        SRC_ResetInstance(inst->source);
       }
+    }
 
+    if (synced_packet) {
       SRC_UpdateStatus(inst->source, MAX(inst->remote_stratum, inst->min_stratum), pkt_leap);
 
       if (inst->delay_quant)
@@ -2401,6 +2537,10 @@ NCR_ProcessRxKnown(NCR_Instance inst, NTP_Local_Address *local_addr,
   NTP_PacketInfo info;
 
   inst->report.total_rx_count++;
+  if (rx_ts->source == NTP_TS_KERNEL)
+    inst->report.total_kernel_rx_ts++;
+  else if (rx_ts->source == NTP_TS_HARDWARE)
+    inst->report.total_hw_rx_ts++;
 
   if (!parse_packet(message, length, &info))
     return 0;
@@ -2523,6 +2663,7 @@ NCR_ProcessRxUnknown(NTP_Remote_Address *remote_addr, NTP_Local_Address *local_a
   NTP_Local_Timestamp local_tx, *tx_ts;
   NTP_int64 ntp_rx, *local_ntp_rx;
   int log_index, interleaved, poll, version;
+  CLG_Limit limit;
   uint32_t kod;
 
   /* Ignore the packet if it wasn't received by server socket */
@@ -2568,7 +2709,8 @@ NCR_ProcessRxUnknown(NTP_Remote_Address *remote_addr, NTP_Local_Address *local_a
   log_index = CLG_LogServiceAccess(CLG_NTP, &remote_addr->ip_addr, &rx_ts->ts);
 
   /* Don't reply to all requests if the rate is excessive */
-  if (log_index >= 0 && CLG_LimitServiceRate(CLG_NTP, log_index)) {
+  limit = log_index >= 0 ? CLG_LimitServiceRate(CLG_NTP, log_index) : CLG_PASS;
+  if (limit == CLG_DROP) {
       DEBUG_LOG("NTP packet discarded to limit response rate");
       return;
   }
@@ -2582,6 +2724,13 @@ NCR_ProcessRxUnknown(NTP_Remote_Address *remote_addr, NTP_Local_Address *local_a
       return;
   }
 
+  if (limit == CLG_KOD) {
+    /* Don't respond if there is a conflict with the NTS NAK */
+    if (kod != 0)
+      return;
+    kod = KOD_RATE;
+  }
+
   local_ntp_rx = NULL;
   tx_ts = NULL;
   interleaved = 0;
@@ -2599,8 +2748,7 @@ NCR_ProcessRxUnknown(NTP_Remote_Address *remote_addr, NTP_Local_Address *local_a
       UTI_CompareNtp64(&message->receive_ts, &message->transmit_ts) != 0) {
     ntp_rx = message->originate_ts;
     local_ntp_rx = &ntp_rx;
-    UTI_ZeroTimespec(&local_tx.ts);
-    local_tx.source = NTP_TS_DAEMON;
+    zero_local_timestamp(&local_tx);
     interleaved = CLG_GetNtpTxTimestamp(&ntp_rx, &local_tx.ts, &local_tx.source);
 
     tx_ts = &local_tx;
@@ -2608,7 +2756,7 @@ NCR_ProcessRxUnknown(NTP_Remote_Address *remote_addr, NTP_Local_Address *local_a
       CLG_DisableNtpTimestamps(&ntp_rx);
   }
 
-  CLG_UpdateNtpStats(kod != 0 && info.auth.mode != NTP_AUTH_NONE &&
+  CLG_UpdateNtpStats(kod == 0 && info.auth.mode != NTP_AUTH_NONE &&
                      info.auth.mode != NTP_AUTH_MSSNTP,
                      rx_ts->source, interleaved ? tx_ts->source : NTP_TS_DAEMON);
 
@@ -2684,10 +2832,11 @@ NCR_ProcessTxKnown(NCR_Instance inst, NTP_Local_Address *local_addr,
                       message);
 
   if (tx_ts->source == NTP_TS_HARDWARE) {
-    inst->had_hw_tx_timestamp = 1;
-
+    inst->report.total_hw_tx_ts++;
     if (has_saved_response(inst))
       process_saved_response(inst);
+  } else if (tx_ts->source == NTP_TS_KERNEL) {
+    inst->report.total_kernel_tx_ts++;
   }
 }
 
@@ -2891,10 +3040,20 @@ NCR_ModifyMinstratum(NCR_Instance inst, int new_min_stratum)
 
 /* ================================================== */
 
+void
+NCR_ModifyOffset(NCR_Instance inst, double new_offset)
+{
+  inst->offset_correction = new_offset;
+  LOG(LOGS_INFO, "Source %s new offset %f",
+      UTI_IPToString(&inst->remote_addr.ip_addr), new_offset);
+}
+
+/* ================================================== */
+
 void
 NCR_ModifyPolltarget(NCR_Instance inst, int new_poll_target)
 {
-  inst->poll_target = new_poll_target;
+  inst->poll_target = MAX(1, new_poll_target);
   LOG(LOGS_INFO, "Source %s new polltarget %d",
       UTI_IPToString(&inst->remote_addr.ip_addr), new_poll_target);
 }

ntp_core.h

@@ -42,6 +42,8 @@ typedef struct {
   struct timespec ts;
   double err;
   NTP_Timestamp_Source source;
+  double rx_duration;
+  double net_correction;
 } NTP_Local_Timestamp;
 
 /* This is a private data type used for storing the instance record for
@@ -111,6 +113,8 @@ extern void NCR_ModifyMaxdelaydevratio(NCR_Instance inst, double new_max_delay_d
 
 extern void NCR_ModifyMinstratum(NCR_Instance inst, int new_min_stratum);
 
+extern void NCR_ModifyOffset(NCR_Instance inst, double new_offset);
+
 extern void NCR_ModifyPolltarget(NCR_Instance inst, int new_poll_target);
 
 extern void NCR_InitiateSampleBurst(NCR_Instance inst, int n_good_samples, int n_total_samples);

ntp_io.c

@@ -278,6 +278,18 @@ NIO_Finalise(void)
 
 /* ================================================== */
 
+int
+NIO_IsHwTsEnabled(void)
+{
+#ifdef HAVE_LINUX_TIMESTAMPING
+  return NIO_Linux_IsHwTsEnabled();
+#else
+  return 0;
+#endif
+}
+
+/* ================================================== */
+
 int
 NIO_OpenClientSocket(NTP_Remote_Address *remote_addr)
 {
@@ -419,6 +431,9 @@ process_message(SCK_Message *message, int sock_fd, int event)
 
   SCH_GetLastEventTime(&local_ts.ts, &local_ts.err, NULL);
   local_ts.source = NTP_TS_DAEMON;
+  local_ts.rx_duration = 0.0;
+  local_ts.net_correction = 0.0;
+
   sched_ts = local_ts.ts;
 
   if (message->addr_type != SCK_ADDR_IP) {
@@ -444,7 +459,7 @@ process_message(SCK_Message *message, int sock_fd, int event)
     DEBUG_LOG("Updated RX timestamp delay=%.9f tss=%u",
               UTI_DiffTimespecsToDouble(&sched_ts, &local_ts.ts), local_ts.source);
 
-  if (!NIO_UnwrapMessage(message, sock_fd))
+  if (!NIO_UnwrapMessage(message, sock_fd, &local_ts.net_correction))
     return;
 
   /* Just ignore the packet if it's not of a recognized length */
@@ -483,8 +498,9 @@ read_from_socket(int sock_fd, int event, void *anything)
 /* ================================================== */
 
 int
-NIO_UnwrapMessage(SCK_Message *message, int sock_fd)
+NIO_UnwrapMessage(SCK_Message *message, int sock_fd, double *net_correction)
 {
+  double ptp_correction;
   PTP_NtpMessage *msg;
 
   if (!is_ptp_socket(sock_fd))
@@ -497,9 +513,11 @@ NIO_UnwrapMessage(SCK_Message *message, int sock_fd)
 
   msg = message->data;
 
-  if (msg->header.type != PTP_TYPE_DELAY_REQ || msg->header.version != PTP_VERSION ||
+  if ((msg->header.type != PTP_TYPE_DELAY_REQ && msg->header.type != PTP_TYPE_SYNC) ||
+      (msg->header.version != PTP_VERSION_2 &&
+       (msg->header.version != PTP_VERSION_2_1 || msg->header.min_sdoid != 0)) ||
       ntohs(msg->header.length) != message->length ||
-      msg->header.domain != PTP_DOMAIN_NTP ||
+      msg->header.domain != CNF_GetPtpDomain() ||
       ntohs(msg->header.flags) != PTP_FLAG_UNICAST ||
       ntohs(msg->tlv_header.type) != PTP_TLV_NTP ||
       ntohs(msg->tlv_header.length) != message->length - PTP_NTP_PREFIX_LENGTH) {
@@ -510,7 +528,14 @@ NIO_UnwrapMessage(SCK_Message *message, int sock_fd)
   message->data = (char *)message->data + PTP_NTP_PREFIX_LENGTH;
   message->length -= PTP_NTP_PREFIX_LENGTH;
 
-  DEBUG_LOG("Unwrapped PTP->NTP len=%d", message->length);
+  ptp_correction = UTI_Integer64NetworkToHost(*(Integer64 *)msg->header.correction) /
+                   ((1 << 16) * 1.0e9);
+
+  /* Use the correction only if the RX duration is known (i.e. HW timestamp) */
+  if (*net_correction > 0.0)
+    *net_correction += ptp_correction;
+
+  DEBUG_LOG("Unwrapped PTP->NTP len=%d corr=%.9f", message->length, ptp_correction);
 
   return 1;
 }
@@ -538,9 +563,9 @@ wrap_message(SCK_Message *message, int sock_fd)
 
   memset(ptp_message, 0, PTP_NTP_PREFIX_LENGTH);
   ptp_message->header.type = PTP_TYPE_DELAY_REQ;
-  ptp_message->header.version = PTP_VERSION;
+  ptp_message->header.version = PTP_VERSION_2;
   ptp_message->header.length = htons(PTP_NTP_PREFIX_LENGTH + message->length);
-  ptp_message->header.domain = PTP_DOMAIN_NTP;
+  ptp_message->header.domain = CNF_GetPtpDomain();
   ptp_message->header.flags = htons(PTP_FLAG_UNICAST);
   ptp_message->header.sequence_id = htons(sequence_id++);
   ptp_message->tlv_header.type = htons(PTP_TLV_NTP);

ntp_io.h

@@ -39,6 +39,9 @@ extern void NIO_Initialise(void);
 /* Function to finalise the module */
 extern void NIO_Finalise(void);
 
+/* Function to check if HW timestamping is enabled on any interface */
+extern int NIO_IsHwTsEnabled(void);
+
 /* Function to obtain a socket for sending client packets */
 extern int NIO_OpenClientSocket(NTP_Remote_Address *remote_addr);
 
@@ -61,7 +64,7 @@ extern int NIO_IsServerSocketOpen(void);
 extern int NIO_IsServerConnectable(NTP_Remote_Address *remote_addr);
 
 /* Function to unwrap an NTP message from non-native transport (e.g. PTP) */
-extern int NIO_UnwrapMessage(SCK_Message *message, int sock_fd);
+extern int NIO_UnwrapMessage(SCK_Message *message, int sock_fd, double *net_correction);
 
 /* Function to transmit a packet */
 extern int NIO_SendPacket(NTP_Packet *packet, NTP_Remote_Address *remote_addr,

ntp_io_linux.c

@@ -2,7 +2,7 @@
   chronyd/chronyc - Programs for keeping computer clocks accurate.
 
  **********************************************************************
- * Copyright (C) Miroslav Lichvar  2016-2019, 2021-2022
+ * Copyright (C) Miroslav Lichvar  2016-2019, 2021-2023
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -220,7 +220,7 @@ add_interface(CNF_HwTsInterface *conf_iface)
 
   SCK_CloseSocket(sock_fd);
 
-  phc_fd = SYS_Linux_OpenPHC(NULL, ts_info.phc_index);
+  phc_fd = SYS_Linux_OpenPHC(req.ifr_name);
   if (phc_fd < 0)
     return 0;
 
@@ -439,6 +439,14 @@ NIO_Linux_Finalise(void)
 
 /* ================================================== */
 
+int
+NIO_Linux_IsHwTsEnabled(void)
+{
+  return ARR_GetSize(interfaces) > 0;
+}
+
+/* ================================================== */
+
 int
 NIO_Linux_SetTimestampSocketOptions(int sock_fd, int client_only, int *events)
 {
@@ -551,7 +559,7 @@ process_hw_timestamp(struct Interface *iface, struct timespec *hw_ts,
                      NTP_Local_Timestamp *local_ts, int rx_ntp_length, int family,
                      int l2_length)
 {
-  double rx_correction, ts_delay, local_err;
+  double rx_correction = 0.0, ts_delay, local_err;
   struct timespec ts;
 
   poll_phc(iface, &local_ts->ts);
@@ -592,6 +600,10 @@ process_hw_timestamp(struct Interface *iface, struct timespec *hw_ts,
   local_ts->ts = ts;
   local_ts->err = local_err;
   local_ts->source = NTP_TS_HARDWARE;
+  local_ts->rx_duration = rx_correction;
+  /* Network correction needs to include the RX duration to avoid
+     asymmetric correction with asymmetric link speeds */
+  local_ts->net_correction = rx_correction;
 }
 
 /* ================================================== */
@@ -715,6 +727,7 @@ NIO_Linux_ProcessMessage(SCK_Message *message, NTP_Local_Address *local_addr,
 {
   struct Interface *iface;
   int is_tx, ts_if_index, l2_length;
+  double c = 0.0;
 
   is_tx = event == SCH_FILE_EXCEPTION;
   iface = NULL;
@@ -775,7 +788,7 @@ NIO_Linux_ProcessMessage(SCK_Message *message, NTP_Local_Address *local_addr,
     return 1;
   }
 
-  if (!NIO_UnwrapMessage(message, local_addr->sock_fd))
+  if (!NIO_UnwrapMessage(message, local_addr->sock_fd, &c))
     return 1;
 
   if (message->length < NTP_HEADER_LENGTH || message->length > sizeof (NTP_Packet))

ntp_io_linux.h

@@ -33,6 +33,8 @@ extern void NIO_Linux_Initialise(void);
 
 extern void NIO_Linux_Finalise(void);
 
+extern int NIO_Linux_IsHwTsEnabled(void);
+
 extern int NIO_Linux_SetTimestampSocketOptions(int sock_fd, int client_only, int *events);
 
 extern int NIO_Linux_ProcessMessage(SCK_Message *message, NTP_Local_Address *local_addr,

ntp_signd.c

@@ -99,6 +99,9 @@ static int sock_fd;
 /* Flag indicating if the MS-SNTP authentication is enabled */
 static int enabled;
 
+/* Flag limiting logging of connection error messages */
+static int logged_connection_error;
+
 /* ================================================== */
 
 static void read_write_socket(int sock_fd, int event, void *anything);
@@ -134,6 +137,14 @@ open_socket(void)
   sock_fd = SCK_OpenUnixStreamSocket(path, NULL, 0);
   if (sock_fd < 0) {
     sock_fd = INVALID_SOCK_FD;
+
+    /* Log an error only once before a successful exchange to avoid
+       flooding the system log */
+    if (!logged_connection_error) {
+      LOG(LOGS_ERR, "Could not connect to signd socket %s : %s", path, strerror(errno));
+      logged_connection_error = 1;
+    }
+
     return 0;
   }
 
@@ -160,6 +171,8 @@ process_response(SignInstance *inst)
     return;
   }
 
+  logged_connection_error = 0;
+
   /* Check if the file descriptor is still valid */
   if (!NIO_IsServerSocket(inst->local_addr.sock_fd)) {
     DEBUG_LOG("Invalid NTP socket");

ntp_sources.c

@@ -3,7 +3,7 @@
 
  **********************************************************************
  * Copyright (C) Richard P. Curnow  1997-2003
- * Copyright (C) Miroslav Lichvar  2011-2012, 2014, 2016, 2020-2021
+ * Copyright (C) Miroslav Lichvar  2011-2012, 2014, 2016, 2020-2024
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -32,6 +32,7 @@
 #include "sysincl.h"
 
 #include "array.h"
+#include "conf.h"
 #include "ntp_sources.h"
 #include "ntp_core.h"
 #include "ntp_io.h"
@@ -58,12 +59,17 @@ typedef struct {
   NCR_Instance data;            /* Data for the protocol engine for this source */
   char *name;                   /* Name of the source as it was specified
                                    (may be an IP address) */
+  IPAddr resolved_addr;         /* Address resolved from the name, which can be
+                                   different from remote_addr (e.g. NTS-KE) */
+  int family;                   /* IP family of acceptable resolved addresses
+                                   (IPADDR_UNSPEC if any) */
   int pool_id;                  /* ID of the pool from which was this source
                                    added or INVALID_POOL */
   int tentative;                /* Flag indicating there was no valid response
                                    received from the source yet */
   uint32_t conf_id;             /* Configuration ID, which can be shared with
                                    different sources in case of a pool */
+  double last_resolving;        /* Time of last name resolving (monotonic) */
 } SourceRecord;
 
 /* Hash table of SourceRecord, its size is a power of two and it's never
@@ -94,8 +100,13 @@ struct UnresolvedSource {
   int pool_id;
   /* Name to be resolved */
   char *name;
+  /* Address family to filter resolved addresses */
+  int family;
   /* Flag indicating addresses should be used in a random order */
   int random_order;
+  /* Flag indicating current address should be replaced only if it is
+     no longer returned by the resolver */
+  int refreshment;
   /* Next unresolved source in the list */
   struct UnresolvedSource *next;
 };
@@ -103,7 +114,7 @@ struct UnresolvedSource {
 #define RESOLVE_INTERVAL_UNIT 7
 #define MIN_RESOLVE_INTERVAL 2
 #define MAX_RESOLVE_INTERVAL 9
-#define MIN_REPLACEMENT_INTERVAL 8
+#define MAX_REPLACEMENT_INTERVAL 9
 
 static struct UnresolvedSource *unresolved_sources = NULL;
 static int resolving_interval = 0;
@@ -184,6 +195,7 @@ void
 NSR_Initialise(void)
 {
   n_sources = 0;
+  resolving_id = 0;
   initialised = 1;
 
   records = ARR_CreateInstance(sizeof (SourceRecord));
@@ -206,8 +218,15 @@ NSR_Finalise(void)
   ARR_DestroyInstance(records);
   ARR_DestroyInstance(pools);
 
-  while (unresolved_sources)
-    remove_unresolved_source(unresolved_sources);
+  SCH_RemoveTimeout(resolving_id);
+
+  /* Leave the unresolved sources allocated if the async resolver is running
+     to avoid reading the name from freed memory.  The handler will not be
+     called as the scheduler should no longer be running at this point. */
+  if (!resolving_source) {
+    while (unresolved_sources)
+      remove_unresolved_source(unresolved_sources);
+  }
 
   initialised = 0;
 }
@@ -344,7 +363,7 @@ log_source(SourceRecord *record, int addition, int once_per_pool)
 
 /* Procedure to add a new source */
 static NSR_Status
-add_source(NTP_Remote_Address *remote_addr, char *name, NTP_Source_Type type,
+add_source(NTP_Remote_Address *remote_addr, char *name, int family, NTP_Source_Type type,
            SourceParameters *params, int pool_id, uint32_t conf_id)
 {
   SourceRecord *record;
@@ -381,9 +400,12 @@ add_source(NTP_Remote_Address *remote_addr, char *name, NTP_Source_Type type,
       record->name = Strdup(name ? name : UTI_IPToString(&remote_addr->ip_addr));
       record->data = NCR_CreateInstance(remote_addr, type, params, record->name);
       record->remote_addr = NCR_GetRemoteAddress(record->data);
+      record->resolved_addr = remote_addr->ip_addr;
+      record->family = family;
       record->pool_id = pool_id;
       record->tentative = 1;
       record->conf_id = conf_id;
+      record->last_resolving = SCH_GetLastEventMonoTime();
 
       record_lock = 0;
 
@@ -432,10 +454,11 @@ change_source_address(NTP_Remote_Address *old_addr, NTP_Remote_Address *new_addr
 
   record = get_record(slot1);
   NCR_ChangeRemoteAddress(record->data, new_addr, !replacement);
+  if (replacement)
+    record->resolved_addr = new_addr->ip_addr;
 
-  if (record->remote_addr != NCR_GetRemoteAddress(record->data) ||
-      UTI_CompareIPs(&record->remote_addr->ip_addr, &new_addr->ip_addr, NULL) != 0)
-    assert(0);
+  BRIEF_ASSERT(record->remote_addr == NCR_GetRemoteAddress(record->data) &&
+               UTI_CompareIPs(&record->remote_addr->ip_addr, &new_addr->ip_addr, NULL) == 0);
 
   if (!UTI_IsIPReal(&old_addr->ip_addr) && UTI_IsIPReal(&new_addr->ip_addr)) {
     if (auto_start_sources)
@@ -515,7 +538,21 @@ process_resolved_name(struct UnresolvedSource *us, IPAddr *ip_addrs, int n_addrs
   NTP_Remote_Address old_addr, new_addr;
   SourceRecord *record;
   unsigned short first = 0;
-  int i, j;
+  int i, j, slot;
+
+  /* Keep using the current address if it is being refreshed and it is
+     still included in the resolved addresses */
+  if (us->refreshment) {
+    assert(us->pool_id == INVALID_POOL);
+
+    for (i = 0; i < n_addrs; i++) {
+      if (find_slot2(&us->address, &slot) == 2 &&
+          UTI_CompareIPs(&get_record(slot)->resolved_addr, &ip_addrs[i], NULL) == 0) {
+        DEBUG_LOG("%s still fresh", UTI_IPToString(&us->address.ip_addr));
+        return;
+      }
+    }
+  }
 
   if (us->random_order)
     UTI_GetRandomBytes(&first, sizeof (first));
@@ -525,6 +562,10 @@ process_resolved_name(struct UnresolvedSource *us, IPAddr *ip_addrs, int n_addrs
 
     DEBUG_LOG("(%d) %s", i + 1, UTI_IPToString(&new_addr.ip_addr));
 
+    /* Skip addresses not from the requested family */
+    if (us->family != IPADDR_UNSPEC && us->family != new_addr.ip_addr.family)
+      continue;
+
     if (us->pool_id != INVALID_POOL) {
       /* In the pool resolving mode, try to replace a source from
          the pool which does not have a real address yet */
@@ -602,13 +643,16 @@ name_resolve_handler(DNS_Status status, int n_addrs, IPAddr *ip_addrs, void *any
   next = us->next;
 
   /* Don't repeat the resolving if it (permanently) failed, it was a
-     replacement of a real address, or all addresses are already resolved */
-  if (status == DNS_Failure || UTI_IsIPReal(&us->address.ip_addr) || is_resolved(us))
+     replacement of a real address, a refreshment, or all addresses are
+     already resolved */
+  if (status == DNS_Failure || UTI_IsIPReal(&us->address.ip_addr) ||
+      us->refreshment || is_resolved(us))
     remove_unresolved_source(us);
 
   /* If a restart was requested and this was the last source in the list,
      start with the first source again (if there still is one) */
   if (!next && resolving_restart) {
+    DEBUG_LOG("Restarting");
     next = unresolved_sources;
     resolving_restart = 0;
   }
@@ -673,11 +717,15 @@ static void
 append_unresolved_source(struct UnresolvedSource *us)
 {
   struct UnresolvedSource **i;
+  int n;
 
-  for (i = &unresolved_sources; *i; i = &(*i)->next)
+  for (i = &unresolved_sources, n = 0; *i; i = &(*i)->next, n++)
     ;
   *i = us;
   us->next = NULL;
+
+  DEBUG_LOG("Added unresolved source #%d pool_id=%d random=%d refresh=%d",
+            n + 1, us->pool_id, us->random_order, us->refreshment);
 }
 
 /* ================================================== */
@@ -727,8 +775,19 @@ static int get_unused_pool_id(void)
 static uint32_t
 get_next_conf_id(uint32_t *conf_id)
 {
+  SourceRecord *record;
+  unsigned int i;
+
+again:
   last_conf_id++;
 
+  /* Make sure the ID is not already used (after 32-bit wraparound) */
+  for (i = 0; i < ARR_GetSize(records); i++) {
+    record = get_record(i);
+    if (record->remote_addr && record->conf_id == last_conf_id)
+      goto again;
+  }
+
   if (conf_id)
     *conf_id = last_conf_id;
 
@@ -741,14 +800,14 @@ NSR_Status
 NSR_AddSource(NTP_Remote_Address *remote_addr, NTP_Source_Type type,
               SourceParameters *params, uint32_t *conf_id)
 {
-  return add_source(remote_addr, NULL, type, params, INVALID_POOL,
+  return add_source(remote_addr, NULL, IPADDR_UNSPEC, type, params, INVALID_POOL,
                     get_next_conf_id(conf_id));
 }
 
 /* ================================================== */
 
 NSR_Status
-NSR_AddSourceByName(char *name, int port, int pool, NTP_Source_Type type,
+NSR_AddSourceByName(char *name, int family, int port, int pool, NTP_Source_Type type,
                     SourceParameters *params, uint32_t *conf_id)
 {
   struct UnresolvedSource *us;
@@ -760,7 +819,9 @@ NSR_AddSourceByName(char *name, int port, int pool, NTP_Source_Type type,
   /* If the name is an IP address, add the source with the address directly */
   if (UTI_StringToIP(name, &remote_addr.ip_addr)) {
     remote_addr.port = port;
-    return add_source(&remote_addr, name, type, params, INVALID_POOL,
+    if (family != IPADDR_UNSPEC && family != remote_addr.ip_addr.family)
+      return NSR_InvalidAF;
+    return add_source(&remote_addr, name, IPADDR_UNSPEC, type, params, INVALID_POOL,
                       get_next_conf_id(conf_id));
   }
 
@@ -772,7 +833,9 @@ NSR_AddSourceByName(char *name, int port, int pool, NTP_Source_Type type,
 
   us = MallocNew(struct UnresolvedSource);
   us->name = Strdup(name);
+  us->family = family;
   us->random_order = 0;
+  us->refreshment = 0;
 
   remote_addr.ip_addr.family = IPADDR_ID;
   remote_addr.ip_addr.addr.id = ++last_address_id;
@@ -807,7 +870,7 @@ NSR_AddSourceByName(char *name, int port, int pool, NTP_Source_Type type,
   for (i = 0; i < new_sources; i++) {
     if (i > 0)
       remote_addr.ip_addr.addr.id = ++last_address_id;
-    if (add_source(&remote_addr, name, type, params, us->pool_id, cid) != NSR_Success)
+    if (add_source(&remote_addr, name, family, type, params, us->pool_id, cid) != NSR_Success)
       return NSR_TooManySources;
   }
 
@@ -816,6 +879,31 @@ NSR_AddSourceByName(char *name, int port, int pool, NTP_Source_Type type,
 
 /* ================================================== */
 
+const char *
+NSR_StatusToString(NSR_Status status)
+{
+  switch (status) {
+    case NSR_Success:
+      return "Success";
+    case NSR_NoSuchSource:
+      return "No such source";
+    case NSR_AlreadyInUse:
+      return "Already in use";
+    case NSR_TooManySources:
+      return "Too many sources";
+    case NSR_InvalidAF:
+      return "Invalid address";
+    case NSR_InvalidName:
+      return "Invalid name";
+    case NSR_UnresolvedName:
+      return "Unresolved name";
+    default:
+      return "?";
+  }
+}
+
+/* ================================================== */
+
 void
 NSR_SetSourceResolvingEndHandler(NSR_SourceResolvingEndHandler handler)
 {
@@ -962,25 +1050,32 @@ NSR_RemoveAllSources(void)
 /* ================================================== */
 
 static void
-resolve_source_replacement(SourceRecord *record)
+resolve_source_replacement(SourceRecord *record, int refreshment)
 {
   struct UnresolvedSource *us;
 
-  DEBUG_LOG("trying to replace %s (%s)",
+  DEBUG_LOG("%s %s (%s)", refreshment ? "refreshing" : "trying to replace",
             UTI_IPToString(&record->remote_addr->ip_addr), record->name);
 
+  record->last_resolving = SCH_GetLastEventMonoTime();
+
   us = MallocNew(struct UnresolvedSource);
   us->name = Strdup(record->name);
-  /* If there never was a valid reply from this source (e.g. it was a bad
-     replacement), ignore the order of addresses from the resolver to not get
-     stuck to a pair of addresses if the order doesn't change, or a group of
-     IPv4/IPv6 addresses if the resolver prefers inaccessible IP family */
-  us->random_order = record->tentative;
+  us->family = record->family;
+  /* Ignore the order of addresses from the resolver to not get
+     stuck with a pair of unreachable or otherwise unusable servers
+     (e.g. falsetickers) in case the order doesn't change, or a group
+     of servers if they are ordered by IP family */
+  us->random_order = 1;
+  us->refreshment = refreshment;
   us->pool_id = INVALID_POOL;
   us->address = *record->remote_addr;
 
   append_unresolved_source(us);
-  NSR_ResolveSources();
+
+  /* Don't restart resolving round if already running */
+  if (!resolving_source)
+    NSR_ResolveSources();
 }
 
 /* ================================================== */
@@ -988,11 +1083,11 @@ resolve_source_replacement(SourceRecord *record)
 void
 NSR_HandleBadSource(IPAddr *address)
 {
-  static struct timespec last_replacement;
-  struct timespec now;
+  static double next_replacement = 0.0;
   SourceRecord *record;
   IPAddr ip_addr;
-  double diff;
+  uint32_t rnd;
+  double now;
   int slot;
 
   if (!find_slot(address, &slot))
@@ -1007,15 +1102,56 @@ NSR_HandleBadSource(IPAddr *address)
     return;
 
   /* Don't resolve names too frequently */
-  SCH_GetLastEventTime(NULL, NULL, &now);
-  diff = UTI_DiffTimespecsToDouble(&now, &last_replacement);
-  if (fabs(diff) < RESOLVE_INTERVAL_UNIT * (1 << MIN_REPLACEMENT_INTERVAL)) {
+  now = SCH_GetLastEventMonoTime();
+  if (now < next_replacement) {
     DEBUG_LOG("replacement postponed");
     return;
   }
-  last_replacement = now;
 
-  resolve_source_replacement(record);
+  UTI_GetRandomBytes(&rnd, sizeof (rnd));
+  next_replacement = now + ((double)rnd / (uint32_t)-1) *
+                     (RESOLVE_INTERVAL_UNIT * (1 << MAX_REPLACEMENT_INTERVAL));
+
+  resolve_source_replacement(record, 0);
+}
+
+/* ================================================== */
+
+static void
+maybe_refresh_source(void)
+{
+  static double last_refreshment = 0.0;
+  SourceRecord *record, *oldest_record;
+  int i, min_interval;
+  double now;
+
+  min_interval = CNF_GetRefresh();
+
+  now = SCH_GetLastEventMonoTime();
+  if (min_interval <= 0 || now < last_refreshment + min_interval)
+    return;
+
+  last_refreshment = now;
+
+  for (i = 0, oldest_record = NULL; i < ARR_GetSize(records); i++) {
+    record = get_record(i);
+    if (!record->remote_addr || UTI_IsStringIP(record->name))
+      continue;
+
+    if (!oldest_record || oldest_record->last_resolving > record->last_resolving)
+      oldest_record = record;
+  }
+
+  if (!oldest_record)
+    return;
+
+  /* Check if the name wasn't already resolved in the last interval */
+  if (now < oldest_record->last_resolving + min_interval) {
+    last_refreshment = oldest_record->last_resolving;
+    return;
+  }
+
+  resolve_source_replacement(oldest_record, 1);
 }
 
 /* ================================================== */
@@ -1031,7 +1167,7 @@ NSR_RefreshAddresses(void)
     if (!record->remote_addr)
       continue;
 
-    resolve_source_replacement(record);
+    resolve_source_replacement(record, 1);
   }
 }
 
@@ -1157,6 +1293,8 @@ NSR_ProcessRx(NTP_Remote_Address *remote_addr, NTP_Local_Address *local_addr,
           remove_pool_sources(record->pool_id, 1, 0);
       }
     }
+
+    maybe_refresh_source();
   } else {
     NCR_ProcessRxUnknown(remote_addr, local_addr, rx_ts, message, length);
   }
@@ -1332,6 +1470,20 @@ NSR_ModifyMinstratum(IPAddr *address, int new_min_stratum)
 
 /* ================================================== */
 
+int
+NSR_ModifyOffset(IPAddr *address, double new_offset)
+{
+  int slot;
+
+  if (!find_slot(address, &slot))
+    return 0;
+
+  NCR_ModifyOffset(get_record(slot)->data, new_offset);
+  return 1;
+}
+
+/* ================================================== */
+
 int
 NSR_ModifyPolltarget(IPAddr *address, int new_poll_target)
 {

ntp_sources.h

@@ -55,11 +55,16 @@ extern NSR_Status NSR_AddSource(NTP_Remote_Address *remote_addr, NTP_Source_Type
 
 /* Procedure to add a new server, peer source, or pool of servers specified by
    name instead of address.  The name is resolved in exponentially increasing
-   intervals until it succeeds or fails with a non-temporary error.  If the
-   name is an address, it is equivalent to NSR_AddSource(). */
-extern NSR_Status NSR_AddSourceByName(char *name, int port, int pool, NTP_Source_Type type,
+   intervals until it succeeds or fails with a non-temporary error.  The
+   specified family filters resolved addresses.  If the name is an address
+   and its family does not conflict with the specified family, it is equivalent
+   to NSR_AddSource(). */
+extern NSR_Status NSR_AddSourceByName(char *name, int family, int port, int pool,
+                                      NTP_Source_Type type,
                                       SourceParameters *params, uint32_t *conf_id);
 
+extern const char *NSR_StatusToString(NSR_Status status);
+
 /* Function type for handlers to be called back when an attempt
  * (possibly unsuccessful) to resolve unresolved sources ends */
 typedef void (*NSR_SourceResolvingEndHandler)(void);
@@ -135,6 +140,8 @@ extern int NSR_ModifyMaxdelaydevratio(IPAddr *address, double new_max_delay_rati
 
 extern int NSR_ModifyMinstratum(IPAddr *address, int new_min_stratum);
 
+extern int NSR_ModifyOffset(IPAddr *address, double new_offset);
+
 extern int NSR_ModifyPolltarget(IPAddr *address, int new_poll_target);
 
 extern int NSR_InitiateSampleBurst(int n_good_samples, int n_total_samples, IPAddr *mask, IPAddr *address);

nts_ke.h

@@ -40,6 +40,7 @@
 #define NKE_RECORD_COOKIE               5
 #define NKE_RECORD_NTPV4_SERVER_NEGOTIATION 6
 #define NKE_RECORD_NTPV4_PORT_NEGOTIATION 7
+#define NKE_RECORD_COMPLIANT_128GCM_EXPORT 1024
 
 #define NKE_NEXT_PROTOCOL_NTPV4         0
 
@@ -49,8 +50,6 @@
 
 #define NKE_ALPN_NAME                   "ntske/1"
 #define NKE_EXPORTER_LABEL              "EXPORTER-network-time-security"
-#define NKE_EXPORTER_CONTEXT_C2S        "\x0\x0\x0\xf\x0"
-#define NKE_EXPORTER_CONTEXT_S2C        "\x0\x0\x0\xf\x1"
 
 #define NKE_MAX_MESSAGE_LENGTH          16384
 #define NKE_MAX_RECORD_BODY_LENGTH      256

nts_ke_client.c

@@ -2,7 +2,7 @@
   chronyd/chronyc - Programs for keeping computer clocks accurate.
 
  **********************************************************************
- * Copyright (C) Miroslav Lichvar  2020-2021
+ * Copyright (C) Miroslav Lichvar  2020-2021, 2024
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -50,7 +50,9 @@ struct NKC_Instance_Record {
   int got_response;
   int resolving_name;
 
+  int compliant_128gcm;
   NKE_Context context;
+  NKE_Context alt_context;
   NKE_Cookie cookies[NKE_MAX_COOKIES];
   int num_cookies;
   char server_name[NKE_MAX_RECORD_BODY_LENGTH + 2];
@@ -98,12 +100,14 @@ name_resolve_handler(DNS_Status status, int n_addrs, IPAddr *ip_addrs, void *arg
 
 /* ================================================== */
 
+#define MAX_AEAD_ALGORITHMS 4
+
 static int
 prepare_request(NKC_Instance inst)
 {
   NKSN_Instance session = inst->session;
-  uint16_t data[2];
-  int length;
+  uint16_t data[MAX_AEAD_ALGORITHMS];
+  int i, aead_algorithm, length;
 
   NKSN_BeginMessage(session);
 
@@ -111,15 +115,24 @@ prepare_request(NKC_Instance inst)
   if (!NKSN_AddRecord(session, 1, NKE_RECORD_NEXT_PROTOCOL, data, sizeof (data[0])))
     return 0;
 
-  length = 0;
-  if (SIV_GetKeyLength(AEAD_AES_128_GCM_SIV) > 0)
-    data[length++] = htons(AEAD_AES_128_GCM_SIV);
-  if (SIV_GetKeyLength(AEAD_AES_SIV_CMAC_256) > 0)
-    data[length++] = htons(AEAD_AES_SIV_CMAC_256);
+  for (i = length = 0; i < ARR_GetSize(CNF_GetNtsAeads()) && length < MAX_AEAD_ALGORITHMS;
+       i++) {
+    aead_algorithm = *(int *)ARR_GetElement(CNF_GetNtsAeads(), i);
+    if (SIV_GetKeyLength(aead_algorithm) > 0)
+      data[length++] = htons(aead_algorithm);
+  }
   if (!NKSN_AddRecord(session, 1, NKE_RECORD_AEAD_ALGORITHM, data,
                       length * sizeof (data[0])))
     return 0;
 
+  for (i = 0; i < length; i++) {
+    if (data[i] == htons(AEAD_AES_128_GCM_SIV)) {
+      if (!NKSN_AddRecord(session, 0, NKE_RECORD_COMPLIANT_128GCM_EXPORT, NULL, 0))
+        return 0;
+      break;
+    }
+  }
+
   if (!NKSN_EndMessage(session))
     return 0;
 
@@ -139,6 +152,8 @@ process_response(NKC_Instance inst)
   assert(sizeof (data) % sizeof (uint16_t) == 0);
   assert(sizeof (uint16_t) == 2);
 
+  inst->compliant_128gcm = 0;
+  inst->alt_context.algorithm = AEAD_SIV_INVALID;
   inst->num_cookies = 0;
   inst->ntp_address.ip_addr.family = IPADDR_UNSPEC;
   inst->ntp_address.port = 0;
@@ -165,15 +180,31 @@ process_response(NKC_Instance inst)
         next_protocol = NKE_NEXT_PROTOCOL_NTPV4;
         break;
       case NKE_RECORD_AEAD_ALGORITHM:
-        if (length != 2 || (ntohs(data[0]) != AEAD_AES_SIV_CMAC_256 &&
-                            ntohs(data[0]) != AEAD_AES_128_GCM_SIV) ||
-            SIV_GetKeyLength(ntohs(data[0])) <= 0) {
-          DEBUG_LOG("Unexpected NTS-KE AEAD algorithm");
+        if (length != 2) {
+          DEBUG_LOG("Unexpected AEAD algorithm");
           error = 1;
           break;
         }
-        aead_algorithm = ntohs(data[0]);
-        inst->context.algorithm = aead_algorithm;
+        for (i = 0; i < ARR_GetSize(CNF_GetNtsAeads()); i++) {
+          if (ntohs(data[0]) == *(int *)ARR_GetElement(CNF_GetNtsAeads(), i) &&
+              SIV_GetKeyLength(ntohs(data[0])) > 0) {
+            aead_algorithm = ntohs(data[0]);
+            inst->context.algorithm = aead_algorithm;
+          }
+        }
+        if (aead_algorithm < 0) {
+          DEBUG_LOG("Unexpected AEAD algorithm");
+          error = 1;
+        }
+        break;
+      case NKE_RECORD_COMPLIANT_128GCM_EXPORT:
+        if (length != 0) {
+          DEBUG_LOG("Non-empty compliant-128gcm record");
+          error = 1;
+          break;
+        }
+        DEBUG_LOG("Compliant AES-128-GCM-SIV export");
+        inst->compliant_128gcm = 1;
         break;
       case NKE_RECORD_ERROR:
         if (length == 2)
@@ -255,6 +286,7 @@ process_response(NKC_Instance inst)
 static int
 handle_message(void *arg)
 {
+  SIV_Algorithm exporter_algorithm;
   NKC_Instance inst = arg;
 
   if (!process_response(inst)) {
@@ -262,8 +294,25 @@ handle_message(void *arg)
     return 0;
   }
 
-  if (!NKSN_GetKeys(inst->session, inst->context.algorithm,
-                    &inst->context.c2s, &inst->context.s2c))
+  exporter_algorithm = inst->context.algorithm;
+
+  /* With AES-128-GCM-SIV, set the algorithm ID in the RFC5705 key exporter
+     context incorrectly for compatibility with older chrony servers unless
+     the server confirmed support for the compliant context.  Generate both
+     sets of keys in case the server uses the compliant context, but does not
+     support the negotiation record, assuming it will respond with an NTS NAK
+     to a request authenticated with the noncompliant key. */
+  if (exporter_algorithm == AEAD_AES_128_GCM_SIV && !inst->compliant_128gcm) {
+    inst->alt_context.algorithm = inst->context.algorithm;
+    if (!NKSN_GetKeys(inst->session, inst->alt_context.algorithm, exporter_algorithm,
+                      NKE_NEXT_PROTOCOL_NTPV4, &inst->alt_context.c2s, &inst->alt_context.s2c))
+      return 0;
+
+    exporter_algorithm = AEAD_AES_SIV_CMAC_256;
+  }
+
+  if (!NKSN_GetKeys(inst->session, inst->context.algorithm, exporter_algorithm,
+                    NKE_NEXT_PROTOCOL_NTPV4, &inst->context.c2s, &inst->context.s2c))
     return 0;
 
   if (inst->server_name[0] != '\0') {
@@ -428,7 +477,7 @@ NKC_IsActive(NKC_Instance inst)
 /* ================================================== */
 
 int
-NKC_GetNtsData(NKC_Instance inst, NKE_Context *context,
+NKC_GetNtsData(NKC_Instance inst, NKE_Context *context, NKE_Context *alt_context,
                NKE_Cookie *cookies, int *num_cookies, int max_cookies,
                IPSockAddr *ntp_address)
 {
@@ -438,6 +487,7 @@ NKC_GetNtsData(NKC_Instance inst, NKE_Context *context,
     return 0;
 
   *context = inst->context;
+  *alt_context = inst->alt_context;
 
   for (i = 0; i < inst->num_cookies && i < max_cookies; i++)
     cookies[i] = inst->cookies[i];

nts_ke_client.h

@@ -46,7 +46,7 @@ extern int NKC_Start(NKC_Instance inst);
 extern int NKC_IsActive(NKC_Instance inst);
 
 /* Get the NTS data if the session was successful */
-extern int NKC_GetNtsData(NKC_Instance inst, NKE_Context *context,
+extern int NKC_GetNtsData(NKC_Instance inst, NKE_Context *context, NKE_Context *alt_context,
                           NKE_Cookie *cookies, int *num_cookies, int max_cookies,
                           IPSockAddr *ntp_address);
 

nts_ke_server.c

@@ -2,7 +2,7 @@
   chronyd/chronyc - Programs for keeping computer clocks accurate.
 
  **********************************************************************
- * Copyright (C) Miroslav Lichvar  2020
+ * Copyright (C) Miroslav Lichvar  2020, 2022, 2024
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -242,7 +242,7 @@ accept_connection(int listening_fd, int event, void *arg)
   SCH_GetLastEventTime(&now, NULL, NULL);
 
   log_index = CLG_LogServiceAccess(CLG_NTSKE, &addr.ip_addr, &now);
-  if (log_index >= 0 && CLG_LimitServiceRate(CLG_NTSKE, log_index)) {
+  if (log_index >= 0 && CLG_LimitServiceRate(CLG_NTSKE, log_index) != CLG_PASS) {
     DEBUG_LOG("Rejected connection from %s (%s)",
               UTI_IPSockAddrToString(&addr), "rate limit");
     SCK_CloseSocket(sock_fd);
@@ -337,8 +337,10 @@ helper_signal(int x)
 /* ================================================== */
 
 static int
-prepare_response(NKSN_Instance session, int error, int next_protocol, int aead_algorithm)
+prepare_response(NKSN_Instance session, int error, int next_protocol, int aead_algorithm,
+                 int compliant_128gcm)
 {
+  SIV_Algorithm exporter_algorithm;
   NKE_Context context;
   NKE_Cookie cookie;
   char *ntp_server;
@@ -371,6 +373,11 @@ prepare_response(NKSN_Instance session, int error, int next_protocol, int aead_a
     if (!NKSN_AddRecord(session, 1, NKE_RECORD_AEAD_ALGORITHM, &datum, sizeof (datum)))
       return 0;
 
+    if (aead_algorithm == AEAD_AES_128_GCM_SIV && compliant_128gcm) {
+      if (!NKSN_AddRecord(session, 0, NKE_RECORD_COMPLIANT_128GCM_EXPORT, NULL, 0))
+        return 0;
+    }
+
     if (CNF_GetNTPPort() != NTP_PORT) {
       datum = htons(CNF_GetNTPPort());
       if (!NKSN_AddRecord(session, 1, NKE_RECORD_NTPV4_PORT_NEGOTIATION, &datum, sizeof (datum)))
@@ -385,8 +392,16 @@ prepare_response(NKSN_Instance session, int error, int next_protocol, int aead_a
     }
 
     context.algorithm = aead_algorithm;
+    exporter_algorithm = aead_algorithm;
 
-    if (!NKSN_GetKeys(session, aead_algorithm, &context.c2s, &context.s2c))
+    /* With AES-128-GCM-SIV, set the algorithm ID in the RFC5705 key exporter
+       context incorrectly for compatibility with older chrony clients unless
+       the client requested the compliant context */
+    if (exporter_algorithm == AEAD_AES_128_GCM_SIV && !compliant_128gcm)
+      exporter_algorithm = AEAD_AES_SIV_CMAC_256;
+
+    if (!NKSN_GetKeys(session, aead_algorithm, exporter_algorithm,
+                      NKE_NEXT_PROTOCOL_NTPV4, &context.c2s, &context.s2c))
       return 0;
 
     for (i = 0; i < NKE_MAX_COOKIES; i++) {
@@ -411,7 +426,8 @@ process_request(NKSN_Instance session)
   int next_protocol_records = 0, aead_algorithm_records = 0;
   int next_protocol_values = 0, aead_algorithm_values = 0;
   int next_protocol = -1, aead_algorithm = -1, error = -1;
-  int i, critical, type, length;
+  int i, j, critical, type, length;
+  int compliant_128gcm = 0;
   uint16_t data[NKE_MAX_RECORD_BODY_LENGTH / sizeof (uint16_t)];
 
   assert(NKE_MAX_RECORD_BODY_LENGTH % sizeof (uint16_t) == 0);
@@ -446,11 +462,21 @@ process_request(NKSN_Instance session)
 
         for (i = 0; i < MIN(length, sizeof (data)) / 2; i++) {
           aead_algorithm_values++;
-          /* Use the first supported algorithm */
-          if (aead_algorithm < 0 && SIV_GetKeyLength(ntohs(data[i])) > 0)
-            aead_algorithm = ntohs(data[i]);;
+          /* Use the first enabled and supported algorithm */
+          for (j = 0; j < ARR_GetSize(CNF_GetNtsAeads()); j++) {
+            if (ntohs(data[i]) == *(int *)ARR_GetElement(CNF_GetNtsAeads(), j) &&
+                aead_algorithm < 0 && SIV_GetKeyLength(ntohs(data[i])) > 0)
+              aead_algorithm = ntohs(data[i]);
+          }
         }
         break;
+      case NKE_RECORD_COMPLIANT_128GCM_EXPORT:
+        if (length != 0) {
+          error = NKE_ERROR_BAD_REQUEST;
+          break;
+        }
+        compliant_128gcm = 1;
+        break;
       case NKE_RECORD_ERROR:
       case NKE_RECORD_WARNING:
       case NKE_RECORD_COOKIE:
@@ -469,7 +495,7 @@ process_request(NKSN_Instance session)
       error = NKE_ERROR_BAD_REQUEST;
   }
 
-  if (!prepare_response(session, error, next_protocol, aead_algorithm))
+  if (!prepare_response(session, error, next_protocol, aead_algorithm, compliant_128gcm))
     return 0;
 
   return 1;
@@ -494,8 +520,7 @@ generate_key(int index)
   ServerKey *key;
   int key_length;
 
-  if (index < 0 || index >= MAX_SERVER_KEYS)
-    assert(0);
+  BRIEF_ASSERT(index >= 0 && index < MAX_SERVER_KEYS);
 
   /* Prefer AES-128-GCM-SIV if available.  Note that if older keys loaded
      from ntsdumpdir use a different algorithm, responding to NTP requests
@@ -508,10 +533,11 @@ generate_key(int index)
   key = &server_keys[index];
 
   key_length = SIV_GetKeyLength(algorithm);
-  if (key_length > sizeof (key->key))
-    assert(0);
+  BRIEF_ASSERT(key_length <= sizeof (key->key));
 
   UTI_GetRandomBytesUrandom(key->key, key_length);
+  if (key_length < sizeof (key->key))
+    memset(key->key + key_length, 0, sizeof (key->key) - key_length);
   UTI_GetRandomBytes(&key->id, sizeof (key->id));
 
   /* Encode the index in the lowest bits of the ID */
@@ -628,6 +654,7 @@ load_keys(void)
         key_length <= 0 ||
         UTI_HexToBytes(words[1], new_keys[i].key, sizeof (new_keys[i].key)) != key_length)
       goto error;
+    memset(new_keys[i].key + key_length, 0, sizeof (new_keys[i].key) - key_length);
   }
 
   if (i < MAX_SERVER_KEYS)
@@ -649,7 +676,7 @@ load_keys(void)
 
   fclose(f);
 
-  LOG(LOGS_ERR, "Loaded %s", "server NTS keys");
+  LOG(LOGS_INFO, "Loaded %s", "server NTS keys");
   return 1;
 
 error:
@@ -674,7 +701,7 @@ key_timeout(void *arg)
 /* ================================================== */
 
 static void
-run_helper(uid_t uid, gid_t gid, int scfilter_level)
+run_helper(uid_t uid, gid_t gid, int scfilter_level, int sock_fd)
 {
   LOG_Severity log_severity;
 
@@ -683,6 +710,8 @@ run_helper(uid_t uid, gid_t gid, int scfilter_level)
 
   DEBUG_LOG("Helper started");
 
+  SCK_CloseReusableSockets();
+
   /* Suppress a log message about disabled clock control */
   log_severity = LOG_GetMinSeverity();
   LOG_SetMinSeverity(LOGS_ERR);
@@ -699,10 +728,15 @@ run_helper(uid_t uid, gid_t gid, int scfilter_level)
   if (scfilter_level != 0)
     SYS_EnableSystemCallFilter(scfilter_level, SYS_NTSKE_HELPER);
 
+  SCH_AddFileHandler(sock_fd, SCH_FILE_INPUT, handle_helper_request, NULL);
+
   SCH_MainLoop();
 
   DEBUG_LOG("Helper exiting");
 
+  SCH_RemoveFileHandler(sock_fd);
+  close(sock_fd);
+
   NKS_Finalise();
   SCK_Finalise();
   SYS_Finalise();
@@ -762,9 +796,8 @@ NKS_PreInitialise(uid_t uid, gid_t gid, int scfilter_level)
     LOG_CloseParentFd();
 
     SCK_CloseSocket(sock_fd1);
-    SCH_AddFileHandler(sock_fd2, SCH_FILE_INPUT, handle_helper_request, NULL);
 
-    run_helper(uid, gid, scfilter_level);
+    run_helper(uid, gid, scfilter_level, sock_fd2);
   }
 
   SCK_CloseSocket(sock_fd2);
@@ -927,8 +960,7 @@ NKS_GenerateCookie(NKE_Context *context, NKE_Cookie *cookie)
   header->key_id = htonl(key->id);
 
   nonce = cookie->cookie + sizeof (*header);
-  if (key->nonce_length > sizeof (cookie->cookie) - sizeof (*header))
-    assert(0);
+  BRIEF_ASSERT(key->nonce_length <= sizeof (cookie->cookie) - sizeof (*header));
   UTI_GetRandomBytes(nonce, key->nonce_length);
 
   plaintext_length = context->c2s.length + context->s2c.length;

nts_ke_session.c

@@ -663,8 +663,7 @@ create_credentials(const char **certs, const char **keys, int n_certs_keys,
     goto error;
 
   if (certs && keys) {
-    if (trusted_certs || trusted_certs_ids)
-      assert(0);
+    BRIEF_ASSERT(!trusted_certs && !trusted_certs_ids);
 
     for (i = 0; i < n_certs_keys; i++) {
       if (!UTI_CheckFilePermissions(keys[i], 0771))
@@ -675,8 +674,7 @@ create_credentials(const char **certs, const char **keys, int n_certs_keys,
         goto error;
     }
   } else {
-    if (certs || keys || n_certs_keys > 0)
-      assert(0);
+    BRIEF_ASSERT(!certs && !keys && n_certs_keys <= 0);
 
     if (trusted_cert_set == 0 && !CNF_GetNoSystemCert()) {
       r = gnutls_certificate_set_x509_system_trust(credentials);
@@ -877,22 +875,42 @@ NKSN_GetRecord(NKSN_Instance inst, int *critical, int *type, int *body_length,
 /* ================================================== */
 
 int
-NKSN_GetKeys(NKSN_Instance inst, SIV_Algorithm siv, NKE_Key *c2s, NKE_Key *s2c)
+NKSN_GetKeys(NKSN_Instance inst, SIV_Algorithm algorithm, SIV_Algorithm exporter_algorithm,
+             int next_protocol, NKE_Key *c2s, NKE_Key *s2c)
 {
-  int length = SIV_GetKeyLength(siv);
+  int length = SIV_GetKeyLength(algorithm);
+  struct {
+    uint16_t next_protocol;
+    uint16_t algorithm;
+    uint8_t is_s2c;
+    uint8_t _pad;
+  } context;
+
+  if (!inst->tls_session)
+    return 0;
 
   if (length <= 0 || length > sizeof (c2s->key) || length > sizeof (s2c->key)) {
     DEBUG_LOG("Invalid algorithm");
     return 0;
   }
 
+  assert(sizeof (context) == 6);
+  context.next_protocol = htons(next_protocol);
+  context.algorithm = htons(exporter_algorithm);
+
+  context.is_s2c = 0;
   if (gnutls_prf_rfc5705(inst->tls_session,
                          sizeof (NKE_EXPORTER_LABEL) - 1, NKE_EXPORTER_LABEL,
-                         sizeof (NKE_EXPORTER_CONTEXT_C2S) - 1, NKE_EXPORTER_CONTEXT_C2S,
-                         length, (char *)c2s->key) < 0 ||
-      gnutls_prf_rfc5705(inst->tls_session,
+                         sizeof (context) - 1, (char *)&context,
+                         length, (char *)c2s->key) < 0) {
+    DEBUG_LOG("Could not export key");
+    return 0;
+  }
+
+  context.is_s2c = 1;
+  if (gnutls_prf_rfc5705(inst->tls_session,
                          sizeof (NKE_EXPORTER_LABEL) - 1, NKE_EXPORTER_LABEL,
-                         sizeof (NKE_EXPORTER_CONTEXT_S2C) - 1, NKE_EXPORTER_CONTEXT_S2C,
+                         sizeof (context) - 1, (char *)&context,
                          length, (char *)s2c->key) < 0) {
     DEBUG_LOG("Could not export key");
     return 0;

nts_ke_session.h

@@ -77,8 +77,11 @@ extern int NKSN_EndMessage(NKSN_Instance inst);
 extern int NKSN_GetRecord(NKSN_Instance inst, int *critical, int *type, int *body_length,
                           void *body, int buffer_length);
 
-/* Export NTS keys for a specified algorithm */
-extern int NKSN_GetKeys(NKSN_Instance inst, SIV_Algorithm siv, NKE_Key *c2s, NKE_Key *s2c);
+/* Export NTS keys for a specified algorithm (for compatibility reasons the
+   RFC5705 exporter context is allowed to have a different algorithm) */
+extern int NKSN_GetKeys(NKSN_Instance inst, SIV_Algorithm algorithm,
+                        SIV_Algorithm exporter_algorithm,
+                        int next_protocol, NKE_Key *c2s, NKE_Key *s2c);
 
 /* Check if the session has stopped */
 extern int NKSN_IsStopped(NKSN_Instance inst);

nts_ntp_auth.c

@@ -104,9 +104,8 @@ NNA_GenerateAuthEF(NTP_Packet *packet, NTP_PacketInfo *info, SIV_Instance siv,
   body = (unsigned char *)(header + 1);
   ciphertext = body + nonce_length + nonce_padding;
 
-  if ((unsigned char *)header + auth_length !=
-      ciphertext + ciphertext_length + ciphertext_padding + additional_padding)
-    assert(0);
+  BRIEF_ASSERT((unsigned char *)header + auth_length ==
+               ciphertext + ciphertext_length + ciphertext_padding + additional_padding);
 
   memcpy(body, nonce, nonce_length);
   memset(body + nonce_length, 0, nonce_padding);

nts_ntp_client.c

@@ -72,6 +72,7 @@ struct NNC_Instance_Record {
   double last_nke_success;
 
   NKE_Context context;
+  NKE_Context alt_context;
   unsigned int context_id;
   NKE_Cookie cookies[NTS_MAX_COOKIES];
   int num_cookies;
@@ -105,6 +106,7 @@ reset_instance(NNC_Instance inst)
   inst->last_nke_success = 0.0;
 
   memset(&inst->context, 0, sizeof (inst->context));
+  memset(&inst->alt_context, 0, sizeof (inst->alt_context));
   inst->context_id = 0;
   memset(inst->cookies, 0, sizeof (inst->cookies));
   inst->num_cookies = 0;
@@ -165,6 +167,21 @@ check_cookies(NNC_Instance inst)
   if (inst->num_cookies > 0 &&
       ((inst->nak_response && !inst->ok_response) ||
        SCH_GetLastEventMonoTime() - inst->last_nke_success > CNF_GetNtsRefresh())) {
+
+    /* Before dropping the cookies, check whether there is an alternate set of
+       keys available (exported with the compliant context for AES-128-GCM-SIV)
+       and the NAK was the only valid response after the last NTS-KE session,
+       indicating we use incorrect keys and switching to the other set of keys
+       for the following NTP requests might work */
+    if (inst->alt_context.algorithm != AEAD_SIV_INVALID &&
+        inst->alt_context.algorithm == inst->context.algorithm &&
+        inst->nke_attempts > 0 && inst->nak_response && !inst->ok_response) {
+      inst->context = inst->alt_context;
+      inst->alt_context.algorithm = AEAD_SIV_INVALID;
+      DEBUG_LOG("Switched to compliant keys");
+      return 1;
+    }
+
     inst->num_cookies = 0;
     DEBUG_LOG("Dropped cookies");
   }
@@ -261,7 +278,7 @@ get_cookies(NNC_Instance inst)
   assert(sizeof (inst->cookies) / sizeof (inst->cookies[0]) == NTS_MAX_COOKIES);
 
   /* Get the new keys, cookies and NTP address if the session was successful */
-  got_data = NKC_GetNtsData(inst->nke, &inst->context,
+  got_data = NKC_GetNtsData(inst->nke, &inst->context, &inst->alt_context,
                             inst->cookies, &inst->num_cookies, NTS_MAX_COOKIES,
                             &ntp_address);
 
@@ -520,6 +537,7 @@ NNC_CheckResponseAuth(NNC_Instance inst, NTP_Packet *packet,
      new NTS-KE session to be started as soon as the cookies run out. */
   inst->nke_attempts = 0;
   inst->next_nke_attempt = 0.0;
+  inst->alt_context.algorithm = AEAD_SIV_INVALID;
 
   return 1;
 }
@@ -643,6 +661,7 @@ load_cookies(NNC_Instance inst)
         sscanf(words[0], "%u", &context_id) != 1 || sscanf(words[1], "%d", &algorithm) != 1)
     goto error;
 
+  inst->alt_context.algorithm = AEAD_SIV_INVALID;
   inst->context.algorithm = algorithm;
   inst->context.s2c.length = UTI_HexToBytes(words[2], inst->context.s2c.key,
                                             sizeof (inst->context.s2c.key));
@@ -650,6 +669,7 @@ load_cookies(NNC_Instance inst)
                                             sizeof (inst->context.c2s.key));
 
   if (inst->context.s2c.length != SIV_GetKeyLength(algorithm) ||
+      inst->context.s2c.length <= 0 ||
       inst->context.c2s.length != inst->context.s2c.length)
     goto error;
 
@@ -686,6 +706,7 @@ error:
   fclose(f);
 
   memset(&inst->context, 0, sizeof (inst->context));
+  memset(&inst->alt_context, 0, sizeof (inst->alt_context));
   inst->num_cookies = 0;
 }
 

nts_ntp_server.c

@@ -2,7 +2,7 @@
   chronyd/chronyc - Programs for keeping computer clocks accurate.
 
  **********************************************************************
- * Copyright (C) Miroslav Lichvar  2020
+ * Copyright (C) Miroslav Lichvar  2020, 2022
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -259,8 +259,7 @@ NNS_GenerateResponseAuth(NTP_Packet *request, NTP_PacketInfo *req_info,
 
   /* Make sure this is a response to the request from the last call
      of NNS_CheckRequestAuth() */
-  if (UTI_CompareNtp64(&server->req_tx, &request->transmit_ts) != 0)
-    assert(0);
+  BRIEF_ASSERT(UTI_CompareNtp64(&server->req_tx, &request->transmit_ts) == 0);
 
   for (parsed = NTP_HEADER_LENGTH; parsed < req_info->length; parsed += ef_length) {
     if (!NEF_ParseField(request, req_info->length, parsed,
@@ -279,7 +278,7 @@ NNS_GenerateResponseAuth(NTP_Packet *request, NTP_PacketInfo *req_info,
   }
 
   /* NTS NAK response does not have any other fields */
-  if (kod)
+  if (kod == NTP_KOD_NTS_NAK)
     return 1;
 
   for (i = 0, plaintext_length = 0; i < server->num_cookies; i++) {

pktlength.c

@@ -55,7 +55,7 @@ struct request_length {
 };
 
 static const struct request_length request_lengths[] = {
-  REQ_LENGTH_ENTRY(null, null),                 /* NULL */
+  { 0, 0 },                                     /* NULL - not supported */
   REQ_LENGTH_ENTRY(online, null),               /* ONLINE */
   REQ_LENGTH_ENTRY(offline, null),              /* OFFLINE */
   REQ_LENGTH_ENTRY(burst, null),                /* BURST */
@@ -65,7 +65,7 @@ static const struct request_length request_lengths[] = {
   REQ_LENGTH_ENTRY(modify_maxdelay, null),      /* MODIFY_MAXDELAY */
   REQ_LENGTH_ENTRY(modify_maxdelayratio, null), /* MODIFY_MAXDELAYRATIO */
   REQ_LENGTH_ENTRY(modify_maxupdateskew, null), /* MODIFY_MAXUPDATESKEW */
-  REQ_LENGTH_ENTRY(logon, null),                /* LOGON */
+  { 0, 0 },                                     /* LOGON - not supported */
   REQ_LENGTH_ENTRY(settime, manual_timestamp),  /* SETTIME */
   { 0, 0 },                                     /* LOCAL */
   REQ_LENGTH_ENTRY(manual, null),               /* MANUAL */
@@ -111,7 +111,7 @@ static const struct request_length request_lengths[] = {
   REQ_LENGTH_ENTRY(null, null),                 /* REFRESH */
   REQ_LENGTH_ENTRY(null, server_stats),         /* SERVER_STATS */
   { 0, 0 },                                     /* CLIENT_ACCESSES_BY_INDEX2 - not supported */
-  REQ_LENGTH_ENTRY(local, null),                /* LOCAL2 */
+  { 0, 0 },                                     /* LOCAL2 - not supported */
   REQ_LENGTH_ENTRY(ntp_data, ntp_data),         /* NTP_DATA */
   { 0, 0 },                                     /* ADD_SERVER2 */
   { 0, 0 },                                     /* ADD_PEER2 */
@@ -130,6 +130,8 @@ static const struct request_length request_lengths[] = {
   REQ_LENGTH_ENTRY(null, null),                 /* RELOAD_SOURCES */
   REQ_LENGTH_ENTRY(doffset, null),              /* DOFFSET2 */
   REQ_LENGTH_ENTRY(modify_select_opts, null),   /* MODIFY_SELECTOPTS */
+  REQ_LENGTH_ENTRY(modify_offset, null),        /* MODIFY_OFFSET */
+  REQ_LENGTH_ENTRY(local, null),                /* LOCAL3 */
 };
 
 static const uint16_t reply_lengths[] = {
@@ -149,7 +151,7 @@ static const uint16_t reply_lengths[] = {
   RPY_LENGTH_ENTRY(smoothing),                  /* SMOOTHING */
   0,                                            /* SERVER_STATS - not supported */
   0,                                            /* CLIENT_ACCESSES_BY_INDEX2 - not supported */
-  RPY_LENGTH_ENTRY(ntp_data),                   /* NTP_DATA */
+  0,                                            /* NTP_DATA - not supported */
   RPY_LENGTH_ENTRY(manual_timestamp),           /* MANUAL_TIMESTAMP2 */
   RPY_LENGTH_ENTRY(manual_list),                /* MANUAL_LIST2 */
   RPY_LENGTH_ENTRY(ntp_source_name),            /* NTP_SOURCE_NAME */
@@ -159,6 +161,7 @@ static const uint16_t reply_lengths[] = {
   RPY_LENGTH_ENTRY(select_data),                /* SELECT_DATA */
   0,                                            /* SERVER_STATS3 - not supported */
   RPY_LENGTH_ENTRY(server_stats),               /* SERVER_STATS4 */
+  RPY_LENGTH_ENTRY(ntp_data),                   /* NTP_DATA2 */
 };
 
 /* ================================================== */

privops.c

@@ -141,6 +141,7 @@ have_helper(void)
 /* ======================================================================= */
 
 /* HELPER - prepare fatal error for daemon */
+FORMAT_ATTRIBUTE_PRINTF(2, 3)
 static void
 res_fatal(PrvResponse *res, const char *fmt, ...)
 {
@@ -546,9 +547,9 @@ PRV_BindSocket(int sock, struct sockaddr *address, socklen_t address_len)
   PrvResponse res;
 
   SCK_SockaddrToIPSockAddr(address, address_len, &ip_saddr);
-  if (ip_saddr.port != 0 && ip_saddr.port != CNF_GetNTPPort() &&
-      ip_saddr.port != CNF_GetAcquisitionPort() && ip_saddr.port != CNF_GetPtpPort())
-    assert(0);
+  BRIEF_ASSERT(ip_saddr.port == 0 || ip_saddr.port == CNF_GetNTPPort() ||
+               ip_saddr.port == CNF_GetAcquisitionPort() ||
+               ip_saddr.port == CNF_GetPtpPort());
 
   if (!have_helper())
     return bind(sock, address, address_len);

ptp.h

@@ -31,9 +31,10 @@
 
 #include "ntp.h"
 
-#define PTP_VERSION 2
+#define PTP_VERSION_2 2
+#define PTP_VERSION_2_1 (2 | 1 << 4)
+#define PTP_TYPE_SYNC 0
 #define PTP_TYPE_DELAY_REQ 1
-#define PTP_DOMAIN_NTP 123
 #define PTP_FLAG_UNICAST (1 << (2 + 8))
 #define PTP_TLV_NTP 0x2023
 

quantiles.c

@@ -49,20 +49,21 @@ struct QNT_Instance_Record {
   int q;
   int min_k;
   double min_step;
+  double neg_step_limit;
   int n_set;
 };
 
 /* ================================================== */
 
 QNT_Instance
-QNT_CreateInstance(int min_k, int max_k, int q, int repeat, double min_step)
+QNT_CreateInstance(int min_k, int max_k, int q, int repeat,
+                   int large_step_delay, double min_step)
 {
   QNT_Instance inst;
   long seed;
 
-  if (q < 2 || min_k > max_k || min_k < 1 || max_k >= q ||
-      repeat < 1 || repeat > MAX_REPEAT || min_step <= 0.0)
-    assert(0);
+  BRIEF_ASSERT(q >= 2 && min_k <= max_k && min_k >= 1 && max_k < q && repeat >= 1 &&
+               repeat <= MAX_REPEAT && min_step > 0.0 && large_step_delay >= 0);
 
   inst = MallocNew(struct QNT_Instance_Record);
   inst->n_quants = (max_k - min_k + 1) * repeat;
@@ -71,6 +72,7 @@ QNT_CreateInstance(int min_k, int max_k, int q, int repeat, double min_step)
   inst->q = q;
   inst->min_k = min_k;
   inst->min_step = min_step;
+  inst->neg_step_limit = -large_step_delay * min_step;
 
   QNT_Reset(inst);
 
@@ -114,8 +116,7 @@ insert_initial_value(QNT_Instance inst, double value)
 {
   int i, j, r = inst->repeat;
 
-  if (inst->n_set * r >= inst->n_quants)
-    assert(0);
+  BRIEF_ASSERT(inst->n_set * r < inst->n_quants);
 
   /* Keep the initial estimates repeated and ordered */
   for (i = inst->n_set; i > 0 && inst->quants[(i - 1) * r].est > value; i--) {
@@ -136,29 +137,36 @@ insert_initial_value(QNT_Instance inst, double value)
 
 static void
 update_estimate(struct Quantile *quantile, double value, double p, double rand,
-                double min_step)
+                double min_step, double neg_step_limit)
 {
-  if (value > quantile->est && rand > (1.0 - p)) {
+  if (value >= quantile->est) {
+    if (rand < (1.0 - p))
+        return;
     quantile->step += quantile->sign > 0 ? min_step : -min_step;
-    quantile->est += quantile->step > 0.0 ? fabs(quantile->step) : min_step;
+    quantile->est += quantile->step > min_step ? quantile->step : min_step;
     if (quantile->est > value) {
       quantile->step += value - quantile->est;
-      quantile->est = value;
+      quantile->est = value + min_step / 4.0;
     }
     if (quantile->sign < 0 && quantile->step > min_step)
       quantile->step = min_step;
     quantile->sign = 1;
-  } else if (value < quantile->est && rand > p) {
+  } else {
+    if (rand < p)
+      return;
     quantile->step += quantile->sign < 0 ? min_step : -min_step;
-    quantile->est -= quantile->step > 0.0 ? fabs(quantile->step) : min_step;
+    quantile->est -= quantile->step > min_step ? quantile->step : min_step;
     if (quantile->est < value) {
       quantile->step += quantile->est - value;
-      quantile->est = value;
+      quantile->est = value - min_step / 4.0;
     }
     if (quantile->sign > 0 && quantile->step > min_step)
       quantile->step = min_step;
     quantile->sign = -1;
   }
+
+  if (quantile->step < neg_step_limit)
+    quantile->step = neg_step_limit;
 }
 
 /* ================================================== */
@@ -179,7 +187,7 @@ QNT_Accumulate(QNT_Instance inst, double value)
     p = (double)(i / inst->repeat + inst->min_k) / inst->q;
     rand = (double)random() / ((1U << 31) - 1);
 
-    update_estimate(&inst->quants[i], value, p, rand, inst->min_step);
+    update_estimate(&inst->quants[i], value, p, rand, inst->min_step, inst->neg_step_limit);
   }
 }
 
@@ -193,14 +201,29 @@ QNT_GetMinK(QNT_Instance inst)
 
 /* ================================================== */
 
+int
+QNT_GetMaxK(QNT_Instance inst)
+{
+  return inst->min_k + (inst->n_quants / inst->repeat) - 1;
+}
+
+/* ================================================== */
+
+double
+QNT_GetMinStep(QNT_Instance inst)
+{
+  return inst->min_step;
+}
+
+/* ================================================== */
+
 double
 QNT_GetQuantile(QNT_Instance inst, int k)
 {
   double estimates[MAX_REPEAT];
   int i;
 
-  if (k < inst->min_k || k - inst->min_k >= inst->n_quants)
-    assert(0);
+  BRIEF_ASSERT(k >= inst->min_k && (k - inst->min_k) * inst->repeat < inst->n_quants);
 
   for (i = 0; i < inst->repeat; i++)
     estimates[i] = inst->quants[(k - inst->min_k) * inst->repeat + i].est;

quantiles.h

@@ -30,12 +30,15 @@
 
 typedef struct QNT_Instance_Record *QNT_Instance;
 
-extern QNT_Instance QNT_CreateInstance(int min_k, int max_k, int q, int repeat, double min_step);
+extern QNT_Instance QNT_CreateInstance(int min_k, int max_k, int q, int repeat,
+                                       int large_step_delay, double min_step);
 extern void QNT_DestroyInstance(QNT_Instance inst);
 
 extern void QNT_Reset(QNT_Instance inst);
 extern void QNT_Accumulate(QNT_Instance inst, double value);
 extern int QNT_GetMinK(QNT_Instance inst);
+extern int QNT_GetMaxK(QNT_Instance inst);
+extern double QNT_GetMinStep(QNT_Instance inst);
 extern double QNT_GetQuantile(QNT_Instance inst, int k);
 
 #endif

refclock.c

@@ -48,6 +48,7 @@ extern RefclockDriver RCL_SHM_driver;
 extern RefclockDriver RCL_SOCK_driver;
 extern RefclockDriver RCL_PPS_driver;
 extern RefclockDriver RCL_PHC_driver;
+extern RefclockDriver RCL_RTC_driver;
 
 struct FilterSample {
   double offset;
@@ -63,6 +64,7 @@ struct RCL_Instance_Record {
   int driver_poll;
   int driver_polled;
   int poll;
+  int reached;
   int leap_status;
   int local;
   int pps_forced;
@@ -159,6 +161,8 @@ RCL_AddRefclock(RefclockParameters *params)
     inst->driver = &RCL_PPS_driver;
   } else if (strcmp(params->driver_name, "PHC") == 0) {
     inst->driver = &RCL_PHC_driver;
+  } else if (strcmp(params->driver_name, "RTC") == 0) {
+    inst->driver = &RCL_RTC_driver;
   } else {
     LOG_FATAL("unknown refclock driver %s", params->driver_name);
   }
@@ -166,8 +170,8 @@ RCL_AddRefclock(RefclockParameters *params)
   if (!inst->driver->init && !inst->driver->poll)
     LOG_FATAL("refclock driver %s is not compiled in", params->driver_name);
 
-  if (params->tai && !CNF_GetLeapSecTimezone())
-    LOG_FATAL("refclock tai option requires leapsectz");
+  if (params->tai && !CNF_GetLeapSecList() && !CNF_GetLeapSecTimezone())
+    LOG_FATAL("refclock tai option requires leapseclist or leapsectz");
 
   inst->data = NULL;
   inst->driver_parameter = Strdup(params->driver_parameter);
@@ -175,6 +179,7 @@ RCL_AddRefclock(RefclockParameters *params)
   inst->driver_poll = params->driver_poll;
   inst->poll = params->poll;
   inst->driver_polled = 0;
+  inst->reached = 0;
   inst->leap_status = LEAP_Normal;
   inst->local = params->local;
   inst->pps_forced = params->pps_forced;
@@ -226,29 +231,16 @@ RCL_AddRefclock(RefclockParameters *params)
   }
 
   if (inst->driver->poll) {
-    int max_samples;
-
     if (inst->driver_poll > inst->poll)
       inst->driver_poll = inst->poll;
-
-    max_samples = 1 << (inst->poll - inst->driver_poll);
-    if (max_samples < params->filter_length) {
-      if (max_samples < 4) {
-        LOG(LOGS_WARN, "Setting filter length for %s to %d",
-            UTI_RefidToString(inst->ref_id), max_samples);
-      }
-      params->filter_length = max_samples;
-    }
   }
 
   if (inst->driver->init && !inst->driver->init(inst))
     LOG_FATAL("refclock %s initialisation failed", params->driver_name);
 
-  /* Require the filter to have at least 4 samples to produce a filtered
-     sample, or be full for shorter lengths, and combine 60% of samples
-     closest to the median */
-  inst->filter = SPF_CreateInstance(MIN(params->filter_length, 4), params->filter_length,
-                                    params->max_dispersion, 0.6);
+  /* Don't require more than one sample per poll and combine 60% of the
+     samples closest to the median offset */
+  inst->filter = SPF_CreateInstance(1, params->filter_length, params->max_dispersion, 0.6);
 
   inst->source = SRC_CreateNewInstance(inst->ref_id, SRC_REFCLOCK, 0, params->sel_options,
                                        NULL, params->min_samples, params->max_samples,
@@ -321,6 +313,22 @@ RCL_ReportSource(RPT_SourceReport *report, struct timespec *now)
   }
 }
 
+int
+RCL_ModifyOffset(uint32_t ref_id, double offset)
+{
+  unsigned int i;
+
+  for (i = 0; i < ARR_GetSize(refclocks); i++) {
+    RCL_Instance inst = get_refclock(i);
+    if (inst->ref_id == ref_id) {
+      inst->offset = offset;
+      LOG(LOGS_INFO, "Source %s new offset %f", UTI_RefidToString(ref_id), offset);
+      return 1;
+    }
+  }
+  return 0;
+}
+
 void
 RCL_SetDriverData(RCL_Instance instance, void *data)
 {
@@ -649,6 +657,12 @@ RCL_AddCookedPulse(RCL_Instance instance, struct timespec *cooked_time,
   return 1;
 }
 
+void
+RCL_UpdateReachability(RCL_Instance instance)
+{
+  instance->reached++;
+}
+
 double
 RCL_GetPrecision(RCL_Instance instance)
 {
@@ -776,6 +790,9 @@ poll_timeout(void *arg)
   if (!(inst->driver->poll && inst->driver_polled < (1 << (inst->poll - inst->driver_poll)))) {
     inst->driver_polled = 0;
 
+    SRC_UpdateReachability(inst->source, inst->reached > 0);
+    inst->reached = 0;
+
     if (SPF_GetFilteredSample(inst->filter, &sample)) {
       double local_freq, local_offset;
       struct timespec local_ref_time;
@@ -791,7 +808,6 @@ poll_timeout(void *arg)
         inst->leap_status = LEAP_Unsynchronised;
       }
 
-      SRC_UpdateReachability(inst->source, 1);
       SRC_UpdateStatus(inst->source, stratum, inst->leap_status);
       SRC_AccumulateSample(inst->source, &sample);
       SRC_SelectSource(inst->source);
@@ -800,8 +816,6 @@ poll_timeout(void *arg)
         follow_local(inst, &local_ref_time, local_freq, local_offset);
 
       log_sample(inst, &sample.time, 1, 0, 0.0, sample.offset, sample.peer_dispersion);
-    } else {
-      SRC_UpdateReachability(inst->source, 0);
     }
   }
 

refclock.h

@@ -68,6 +68,7 @@ extern void RCL_Finalise(void);
 extern int RCL_AddRefclock(RefclockParameters *params);
 extern void RCL_StartRefclocks(void);
 extern void RCL_ReportSource(RPT_SourceReport *report, struct timespec *now);
+extern int RCL_ModifyOffset(uint32_t ref_id, double offset);
 
 /* functions used by drivers */
 extern void RCL_SetDriverData(RCL_Instance instance, void *data);
@@ -80,6 +81,7 @@ extern int RCL_AddSample(RCL_Instance instance, struct timespec *sample_time,
 extern int RCL_AddPulse(RCL_Instance instance, struct timespec *pulse_time, double second);
 extern int RCL_AddCookedPulse(RCL_Instance instance, struct timespec *cooked_time,
                               double second, double dispersion, double raw_correction);
+extern void RCL_UpdateReachability(RCL_Instance instance);
 extern double RCL_GetPrecision(RCL_Instance instance);
 extern int RCL_GetDriverPoll(RCL_Instance instance);
 

refclock_phc.c

@@ -2,7 +2,7 @@
   chronyd/chronyc - Programs for keeping computer clocks accurate.
 
  **********************************************************************
- * Copyright (C) Miroslav Lichvar  2013, 2017
+ * Copyright (C) Miroslav Lichvar  2013, 2017, 2023
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -74,7 +74,7 @@ static int phc_initialise(RCL_Instance instance)
 
   path = RCL_GetDriverParameter(instance);
  
-  phc_fd = SYS_Linux_OpenPHC(path, 0);
+  phc_fd = SYS_Linux_OpenPHC(path);
   if (phc_fd < 0)
     LOG_FATAL("Could not open PHC");
 
@@ -154,6 +154,8 @@ static void process_ext_pulse(RCL_Instance instance, struct timespec *phc_ts)
   }
   phc->last_extts = *phc_ts;
 
+  RCL_UpdateReachability(instance);
+
   if (!HCL_CookTime(phc->clock, phc_ts, &local_ts, &local_err))
     return;
 
@@ -175,7 +177,7 @@ static void read_ext_pulse(int fd, int event, void *anything)
   instance = anything;
   phc1 = RCL_GetDriverData(instance);
 
-  /* The Linux kernel (as of 6.2) has one shared queue of timestamps for all
+  /* Linux versions before 6.7 had one shared queue of timestamps for all
      descriptors of the same PHC.  Search for all refclocks that expect
      the timestamp. */
 
@@ -204,6 +206,9 @@ static int phc_poll(RCL_Instance instance)
   if (n_readings < 1)
     return 0;
 
+  if (!phc->extpps)
+    RCL_UpdateReachability(instance);
+
   if (!HCL_ProcessReadings(phc->clock, n_readings, readings, &phc_ts, &sys_ts, &phc_err))
     return 0;
 

refclock_pps.c

@@ -143,6 +143,8 @@ static int pps_poll(RCL_Instance instance)
 
   pps->last_seq = seq;
 
+  RCL_UpdateReachability(instance);
+
   return RCL_AddPulse(instance, &ts, 1.0e-9 * ts.tv_nsec);
 }
 

refclock_rtc.c

@@ -0,0 +1,182 @@
+/*
+  chronyd/chronyc - Programs for keeping computer clocks accurate.
+
+ **********************************************************************
+ * Copyright (C) Uwe Kleine-König, Pengutronix  2021
+ * Copyright (C) Ahmad Fatoum, Pengutronix  2024
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ *
+ **********************************************************************
+
+  =======================================================================
+
+  RTC refclock driver.
+
+  */
+
+#include "config.h"
+
+#include "refclock.h"
+
+#ifdef FEAT_RTC
+
+#include <linux/rtc.h>
+
+#include "conf.h"
+#include "local.h"
+
+#include "logging.h"
+#include "memory.h"
+#include "sched.h"
+#include "util.h"
+#include "rtc_linux.h"
+
+struct refrtc_instance {
+  int fd;
+  int polling;
+  int utc;
+};
+
+static int refrtc_add_sample(RCL_Instance instance, struct timespec *now,
+                             time_t rtc_sec, long rtc_nsec)
+{
+  struct timespec rtc_ts;
+  int status;
+
+  rtc_ts.tv_sec = rtc_sec;
+  rtc_ts.tv_nsec = rtc_nsec;
+
+  RCL_UpdateReachability(instance);
+
+  status = RCL_AddSample(instance, now, &rtc_ts, LEAP_Normal);
+
+  return status;
+}
+
+static void refrtc_read_after_uie(int rtcfd, int event, void *data)
+{
+  RCL_Instance instance = (RCL_Instance)data;
+  struct refrtc_instance *rtc = RCL_GetDriverData(instance);
+  struct timespec now;
+  time_t rtc_sec;
+  int status;
+
+  status = RTC_Linux_CheckInterrupt(rtcfd);
+  if (status < 0) {
+    SCH_RemoveFileHandler(rtcfd);
+    RTC_Linux_SwitchInterrupt(rtcfd, 0); /* Likely to raise error too, but just to be sure... */
+    close(rtcfd);
+    rtc->fd = -1;
+    return;
+  } else if (status == 0) {
+    /* Wait for the next interrupt, this one may be bogus */
+    return;
+  }
+
+  rtc_sec = RTC_Linux_ReadTimeAfterInterrupt(rtcfd, rtc->utc, NULL, &now);
+  if (rtc_sec == (time_t)-1)
+    return;
+
+  refrtc_add_sample(instance, &now, rtc_sec, 0);
+}
+
+static int refrtc_initialise(RCL_Instance instance)
+{
+  const char *options[] = {"utc", NULL};
+  struct refrtc_instance *rtc;
+  int rtcfd, status;
+  const char *path;
+
+  RCL_CheckDriverOptions(instance, options);
+
+  if (CNF_GetRtcSync() || CNF_GetRtcFile())
+    LOG_FATAL("RTC refclock cannot be used together with rtcsync or rtcfile");
+
+  path = RCL_GetDriverParameter(instance);
+
+  rtcfd = open(path, O_RDONLY);
+  if (rtcfd < 0)
+    LOG_FATAL("Could not open RTC device %s : %s", path, strerror(errno));
+
+  /* Close on exec */
+  UTI_FdSetCloexec(rtcfd);
+
+  rtc = MallocNew(struct refrtc_instance);
+  rtc->fd = rtcfd;
+  rtc->utc = RCL_GetDriverOption(instance, "utc") ? 1 : 0;
+
+  RCL_SetDriverData(instance, rtc);
+
+  /* Try to enable update interrupts */
+  status = RTC_Linux_SwitchInterrupt(rtcfd, 1);
+  if (status) {
+    SCH_AddFileHandler(rtcfd, SCH_FILE_INPUT, refrtc_read_after_uie, instance);
+    rtc->polling = 0;
+  } else {
+    LOG(LOGS_INFO, "Falling back to polling for %s", path);
+    rtc->polling = 1;
+  }
+
+  return 1;
+}
+
+static void refrtc_finalise(RCL_Instance instance)
+{
+  struct refrtc_instance *rtc;
+
+  rtc = RCL_GetDriverData(instance);
+
+  if (rtc->fd >= 0) {
+    if (!rtc->polling) {
+      SCH_RemoveFileHandler(rtc->fd);
+      RTC_Linux_SwitchInterrupt(rtc->fd, 0);
+    }
+
+    close(rtc->fd);
+  }
+
+  Free(rtc);
+}
+
+static int refrtc_poll(RCL_Instance instance)
+{
+  struct refrtc_instance *rtc;
+  struct timespec now;
+  time_t rtc_sec;
+
+  rtc = RCL_GetDriverData(instance);
+
+  if (!rtc->polling)
+    return 0;
+
+  rtc_sec = RTC_Linux_ReadTimeNow(rtc->fd, rtc->utc, NULL, &now);
+  if (rtc_sec == (time_t)-1)
+    return 0;
+
+  /* As the rtc has a resolution of 1s, only add half a second */
+  return refrtc_add_sample(instance, &now, rtc_sec, 500000000);
+}
+
+RefclockDriver RCL_RTC_driver = {
+  refrtc_initialise,
+  refrtc_finalise,
+  refrtc_poll
+};
+
+#else
+
+RefclockDriver RCL_RTC_driver = { NULL, NULL, NULL };
+
+#endif

refclock_shm.c

@@ -109,6 +109,8 @@ static int shm_poll(RCL_Instance instance)
 
   shm->valid = 0;
 
+  RCL_UpdateReachability(instance);
+
   receive_ts.tv_sec = t.receiveTimeStampSec;
   clock_ts.tv_sec = t.clockTimeStampSec;
 

refclock_sock.c

@@ -129,6 +129,8 @@ static void read_sample(int sockfd, int event, void *anything)
   UTI_TimevalToTimespec(&sample.tv, &sys_ts);
   UTI_NormaliseTimespec(&sys_ts);
 
+  RCL_UpdateReachability(instance);
+
   if (!UTI_IsTimeOffsetSane(&sys_ts, sample.offset))
     return;
 

reference.c

@@ -4,6 +4,7 @@
  **********************************************************************
  * Copyright (C) Richard P. Curnow  1997-2003
  * Copyright (C) Miroslav Lichvar  2009-2018, 2020, 2022
+ * Copyright (C) Andy Fiddaman  2024
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -33,6 +34,7 @@
 #include "reference.h"
 #include "util.h"
 #include "conf.h"
+#include "leapdb.h"
 #include "logging.h"
 #include "local.h"
 #include "sched.h"
@@ -45,14 +47,15 @@
 /* The update interval of the reference in the local reference mode */
 #define LOCAL_REF_UPDATE_INTERVAL 64.0
 
-/* Interval between updates of the drift file */
-#define MAX_DRIFTFILE_AGE 3600.0
-
 static int are_we_synchronised;
 static int enable_local_stratum;
 static int local_stratum;
 static int local_orphan;
 static double local_distance;
+static int local_activate_ok;
+static double local_activate;
+static double local_wait_synced;
+static double local_wait_unsynced;
 static struct timespec local_ref_time;
 static NTP_Leap our_leap_status;
 static int our_leap_sec;
@@ -61,6 +64,7 @@ static int our_stratum;
 static uint32_t our_ref_id;
 static IPAddr our_ref_ip;
 static struct timespec our_ref_time;
+static double unsynchronised_since;
 static double our_skew;
 static double our_residual_freq;
 static double our_root_delay;
@@ -106,6 +110,7 @@ static REF_ModeEndHandler mode_end_handler = NULL;
 /* Filename of the drift file. */
 static char *drift_file=NULL;
 static double drift_file_age;
+static int drift_file_interval;
 
 static void update_drift_file(double, double);
 
@@ -122,9 +127,6 @@ static int leap_in_progress;
 /* Timer for the leap second handler */
 static SCH_TimeoutID leap_timeout_id;
 
-/* Name of a system timezone containing leap seconds occuring at midnight */
-static char *leap_tzname;
-
 /* ================================================== */
 
 static LOG_FileID logfileid;
@@ -155,7 +157,6 @@ static int ref_adjustments;
 
 /* ================================================== */
 
-static NTP_Leap get_tz_leap(time_t when, int *tai_offset);
 static void update_leap_status(NTP_Leap leap, time_t now, int reset);
 
 /* ================================================== */
@@ -195,7 +196,6 @@ REF_Initialise(void)
   FILE *in;
   double file_freq_ppm, file_skew_ppm;
   double our_frequency_ppm;
-  int tai_offset;
 
   mode = REF_ModeNormal;
   are_we_synchronised = 0;
@@ -211,9 +211,10 @@ REF_Initialise(void)
   our_frequency_sd = 0.0;
   our_offset_sd = 0.0;
   drift_file_age = 0.0;
+  local_activate_ok = 0;
 
   /* Now see if we can get the drift file opened */
-  drift_file = CNF_GetDriftFile();
+  drift_file = CNF_GetDriftFile(&drift_file_interval);
   if (drift_file) {
     in = UTI_OpenFile(NULL, drift_file, NULL, 'r', 0);
     if (in) {
@@ -249,8 +250,12 @@ REF_Initialise(void)
 
   correction_time_ratio = CNF_GetCorrectionTimeRatio();
 
-  enable_local_stratum = CNF_AllowLocalReference(&local_stratum, &local_orphan, &local_distance);
+  enable_local_stratum = CNF_AllowLocalReference(&local_stratum, &local_orphan,
+                                                 &local_distance, &local_activate,
+                                                 &local_wait_synced,
+                                                 &local_wait_unsynced);
   UTI_ZeroTimespec(&local_ref_time);
+  unsynchronised_since = SCH_GetLastEventMonoTime();
 
   leap_when = 0;
   leap_timeout_id = 0;
@@ -260,18 +265,6 @@ REF_Initialise(void)
   if (leap_mode == REF_LeapModeSystem && !LCL_CanSystemLeap())
     leap_mode = REF_LeapModeStep;
 
-  leap_tzname = CNF_GetLeapSecTimezone();
-  if (leap_tzname) {
-    /* Check that the timezone has good data for Jun 30 2012 and Dec 31 2012 */
-    if (get_tz_leap(1341014400, &tai_offset) == LEAP_InsertSecond && tai_offset == 34 &&
-        get_tz_leap(1356912000, &tai_offset) == LEAP_Normal && tai_offset == 35) {
-      LOG(LOGS_INFO, "Using %s timezone to obtain leap second data", leap_tzname);
-    } else {
-      LOG(LOGS_WARN, "Timezone %s failed leap second check, ignoring", leap_tzname);
-      leap_tzname = NULL;
-    }
-  }
-
   CNF_GetMakeStep(&make_step_limit, &make_step_threshold);
   CNF_GetMaxChange(&max_offset_delay, &max_offset_ignore, &max_offset);
   CNF_GetMailOnChange(&do_mail_change, &mail_change_threshold, &mail_change_user);
@@ -593,77 +586,6 @@ is_leap_second_day(time_t when)
 
 /* ================================================== */
 
-static NTP_Leap
-get_tz_leap(time_t when, int *tai_offset)
-{
-  static time_t last_tz_leap_check;
-  static NTP_Leap tz_leap;
-  static int tz_tai_offset;
-
-  struct tm stm, *tm;
-  time_t t;
-  char *tz_env, tz_orig[128];
-
-  *tai_offset = tz_tai_offset;
-
-  /* Do this check at most twice a day */
-  when = when / (12 * 3600) * (12 * 3600);
-  if (last_tz_leap_check == when)
-      return tz_leap;
-
-  last_tz_leap_check = when;
-  tz_leap = LEAP_Normal;
-  tz_tai_offset = 0;
-
-  tm = gmtime(&when);
-  if (!tm)
-    return tz_leap;
-
-  stm = *tm;
-
-  /* Temporarily switch to the timezone containing leap seconds */
-  tz_env = getenv("TZ");
-  if (tz_env) {
-    if (strlen(tz_env) >= sizeof (tz_orig))
-      return tz_leap;
-    strcpy(tz_orig, tz_env);
-  }
-  setenv("TZ", leap_tzname, 1);
-  tzset();
-
-  /* Get the TAI-UTC offset, which started at the epoch at 10 seconds */
-  t = mktime(&stm);
-  if (t != -1)
-    tz_tai_offset = t - when + 10;
-
-  /* Set the time to 23:59:60 and see how it overflows in mktime() */
-  stm.tm_sec = 60;
-  stm.tm_min = 59;
-  stm.tm_hour = 23;
-
-  t = mktime(&stm);
-
-  if (tz_env)
-    setenv("TZ", tz_orig, 1);
-  else
-    unsetenv("TZ");
-  tzset();
-
-  if (t == -1)
-    return tz_leap;
-
-  if (stm.tm_sec == 60)
-    tz_leap = LEAP_InsertSecond;
-  else if (stm.tm_sec == 1)
-    tz_leap = LEAP_DeleteSecond;
-
-  *tai_offset = tz_tai_offset;
-
-  return tz_leap;
-}
-
-/* ================================================== */
-
 static void
 leap_end_timeout(void *arg)
 {
@@ -751,16 +673,16 @@ set_leap_timeout(time_t now)
 static void
 update_leap_status(NTP_Leap leap, time_t now, int reset)
 {
-  NTP_Leap tz_leap;
+  NTP_Leap ldb_leap;
   int leap_sec, tai_offset;
 
   leap_sec = 0;
   tai_offset = 0;
 
-  if (leap_tzname && now) {
-    tz_leap = get_tz_leap(now, &tai_offset);
+  if (now) {
+    ldb_leap = LDB_GetLeap(now, &tai_offset);
     if (leap == LEAP_Normal)
-      leap = tz_leap;
+      leap = ldb_leap;
   }
 
   if (leap == LEAP_InsertSecond || leap == LEAP_DeleteSecond) {
@@ -1069,6 +991,8 @@ REF_SetReference(int stratum, NTP_Leap leap, int combined_sources,
   if (step_offset != 0.0) {
     if (LCL_ApplyStepOffset(step_offset))
       LOG(LOGS_WARN, "System clock was stepped by %.6f seconds", -step_offset);
+    else
+      LCL_AccumulateOffset(step_offset, 0.0);
   }
 
   update_leap_status(leap, raw_now.tv_sec, 0);
@@ -1087,7 +1011,7 @@ REF_SetReference(int stratum, NTP_Leap leap, int combined_sources,
   if (drift_file) {
     /* Update drift file at most once per hour */
     drift_file_age += update_interval;
-    if (drift_file_age >= MAX_DRIFTFILE_AGE) {
+    if (drift_file_age >= drift_file_interval) {
       update_drift_file(local_abs_frequency, our_skew);
       drift_file_age = 0.0;
     }
@@ -1177,6 +1101,9 @@ REF_SetUnsynchronised(void)
   our_ref_ip.family = IPADDR_INET4;
   our_ref_ip.addr.in4 = 0;
   our_stratum = 0;
+
+  if (are_we_synchronised)
+    unsynchronised_since = SCH_GetLastEventMonoTime();
   are_we_synchronised = 0;
 
   LCL_SetSyncStatus(0, 0.0, 0.0);
@@ -1219,21 +1146,30 @@ REF_GetReferenceParams
  double *root_dispersion
 )
 {
-  double dispersion, delta;
+  double dispersion, delta, distance;
+  int wait_local_ok;
 
   assert(initialised);
 
   if (are_we_synchronised) {
     dispersion = get_root_dispersion(local_time);
+    wait_local_ok = UTI_DiffTimespecsToDouble(local_time, &our_ref_time) >= local_wait_synced;
   } else {
     dispersion = 0.0;
+    wait_local_ok = SCH_GetLastEventMonoTime() - unsynchronised_since >= local_wait_unsynced;
   }
 
+  distance = our_root_delay / 2 + dispersion;
+
+  if (local_activate == 0.0 || (are_we_synchronised && distance < local_activate))
+    local_activate_ok = 1;
+
   /* Local reference is active when enabled and the clock is not synchronised
      or the root distance exceeds the threshold */
 
   if (are_we_synchronised &&
-      !(enable_local_stratum && our_root_delay / 2 + dispersion > local_distance)) {
+      !(enable_local_stratum && local_activate_ok && wait_local_ok &&
+        distance > local_distance)) {
 
     *is_synchronised = 1;
 
@@ -1245,7 +1181,7 @@ REF_GetReferenceParams
     *root_delay = our_root_delay;
     *root_dispersion = dispersion;
 
-  } else if (enable_local_stratum) {
+  } else if (enable_local_stratum && local_activate_ok && wait_local_ok) {
 
     *is_synchronised = 0;
 
@@ -1345,12 +1281,16 @@ REF_ModifyMakestep(int limit, double threshold)
 /* ================================================== */
 
 void
-REF_EnableLocal(int stratum, double distance, int orphan)
+REF_EnableLocal(int stratum, double distance, int orphan, double activate,
+                double wait_synced, double wait_unsynced)
 {
   enable_local_stratum = 1;
   local_stratum = CLAMP(1, stratum, NTP_MAX_STRATUM - 1);
   local_distance = distance;
   local_orphan = !!orphan;
+  local_activate = activate;
+  local_wait_synced = wait_synced;
+  local_wait_unsynced = wait_unsynced;
   LOG(LOGS_INFO, "%s local reference mode", "Enabled");
 }
 
@@ -1368,7 +1308,7 @@ REF_DisableLocal(void)
 #define LEAP_SECOND_CLOSE 5
 
 static int
-is_leap_close(time_t t)
+is_leap_close(double t)
 {
   return leap_when != 0 &&
          t >= leap_when - LEAP_SECOND_CLOSE && t < leap_when + LEAP_SECOND_CLOSE;
@@ -1398,7 +1338,7 @@ REF_GetTaiOffset(struct timespec *ts)
 {
   int tai_offset;
 
-  get_tz_leap(ts->tv_sec, &tai_offset);
+  LDB_GetLeap(ts->tv_sec, &tai_offset);
 
   return tai_offset;
 }

reference.h

@@ -185,7 +185,8 @@ extern void REF_ModifyMaxupdateskew(double new_max_update_skew);
 /* Modify makestep settings */
 extern void REF_ModifyMakestep(int limit, double threshold);
 
-extern void REF_EnableLocal(int stratum, double distance, int orphan);
+extern void REF_EnableLocal(int stratum, double distance, int orphan, double activate,
+                            double wait_synced, double wait_unsynced);
 extern void REF_DisableLocal(void);
 
 /* Check if either of the current raw and cooked time, and optionally a

regress.c

@@ -377,7 +377,7 @@ find_ordered_entry_with_flags(double *x, int n, int index, char *flags)
       r = v;
       do {
         while (l < v && x[l] < piv) l++;
-        while (x[r] > piv) r--;
+        while (r > 0 && x[r] > piv) r--;
         if (r <= l) break;
         EXCH(x[l], x[r]);
         l++;

reports.h

@@ -181,6 +181,10 @@ typedef struct {
   uint32_t total_rx_count;
   uint32_t total_valid_count;
   uint32_t total_good_count;
+  uint32_t total_kernel_tx_ts;
+  uint32_t total_kernel_rx_ts;
+  uint32_t total_hw_tx_ts;
+  uint32_t total_hw_rx_ts;
 } RPT_NTPReport;
 
 typedef struct {

rtc.c

@@ -81,8 +81,9 @@ get_driftfile_time(void)
 {
   struct stat buf;
   char *drift_file;
+  int interval;
 
-  drift_file = CNF_GetDriftFile();
+  drift_file = CNF_GetDriftFile(&interval);
   if (!drift_file)
     return 0;
 

rtc_linux.c

@@ -4,6 +4,7 @@
  **********************************************************************
  * Copyright (C) Richard P. Curnow  1997-2003
  * Copyright (C) Miroslav Lichvar  2012-2014
+ * Copyright (C) Ahmad Fatoum, Pengutronix  2024
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -296,14 +297,25 @@ slew_samples
    corresponding real time clock 'DMY HMS' form, taking account of
    whether the user runs his RTC on the local time zone or UTC */
 
-static struct tm *
-rtc_from_t(const time_t *t)
+static void
+rtc_from_t(const time_t *t, struct rtc_time *rtc_raw, int utc)
 {
-  if (rtc_on_utc) {
-    return gmtime(t);
+  struct tm *rtc_tm;
+  if (utc) {
+    rtc_tm = gmtime(t);
   } else {
-    return localtime(t);
+    rtc_tm = localtime(t);
   }
+
+  rtc_raw->tm_sec = rtc_tm->tm_sec;
+  rtc_raw->tm_min = rtc_tm->tm_min;
+  rtc_raw->tm_hour = rtc_tm->tm_hour;
+  rtc_raw->tm_mday = rtc_tm->tm_mday;
+  rtc_raw->tm_mon = rtc_tm->tm_mon;
+  rtc_raw->tm_year = rtc_tm->tm_year;
+  rtc_raw->tm_wday = rtc_tm->tm_wday;
+  rtc_raw->tm_yday = rtc_tm->tm_yday;
+  rtc_raw->tm_isdst = rtc_tm->tm_isdst;
 }
 
 /* ================================================== */
@@ -341,17 +353,27 @@ rtc_from_t(const time_t *t)
 */
 
 static time_t
-t_from_rtc(struct tm *stm) {
-  struct tm temp1, temp2, *tm;
+t_from_rtc(struct rtc_time *rtc_raw, int utc)
+{
+  struct tm rtc_tm, temp1, temp2, *tm;
   long diff;
   time_t t1, t2;
 
-  temp1 = *stm;
+  /* Convert to seconds since 1970 */
+  memset(&rtc_tm, 0, sizeof (rtc_tm));
+  rtc_tm.tm_sec = rtc_raw->tm_sec;
+  rtc_tm.tm_min = rtc_raw->tm_min;
+  rtc_tm.tm_hour = rtc_raw->tm_hour;
+  rtc_tm.tm_mday = rtc_raw->tm_mday;
+  rtc_tm.tm_mon = rtc_raw->tm_mon;
+  rtc_tm.tm_year = rtc_raw->tm_year;
+
+  temp1 = rtc_tm;
   temp1.tm_isdst = 0;
-  
+
   t1 = mktime(&temp1);
 
-  tm = rtc_on_utc ? gmtime(&t1) : localtime(&t1);
+  tm = utc ? gmtime(&t1) : localtime(&t1);
   if (!tm) {
     DEBUG_LOG("gmtime()/localtime() failed");
     return -1;
@@ -476,8 +498,8 @@ write_coefs_to_file(int valid,time_t ref_time,double offset,double rate)
 
 /* ================================================== */
 
-static int
-switch_interrupts(int on_off)
+int
+RTC_Linux_SwitchInterrupt(int fd, int on_off)
 {
   if (ioctl(fd, on_off ? RTC_UIE_ON : RTC_UIE_OFF, 0) < 0) {
     LOG(LOGS_ERR, "Could not %s RTC interrupt : %s",
@@ -508,7 +530,7 @@ RTC_Linux_Initialise(void)
   }
 
   /* Make sure the RTC supports interrupts */
-  if (!switch_interrupts(1) || !switch_interrupts(0)) {
+  if (!RTC_Linux_SwitchInterrupt(fd, 1) || !RTC_Linux_SwitchInterrupt(fd, 0)) {
     close(fd);
     return 0;
   }
@@ -557,7 +579,7 @@ RTC_Linux_Finalise(void)
   /* Remove input file handler */
   if (fd >= 0) {
     SCH_RemoveFileHandler(fd);
-    switch_interrupts(0);
+    RTC_Linux_SwitchInterrupt(fd, 0);
     close(fd);
 
     /* Save the RTC data */
@@ -578,7 +600,7 @@ static void
 measurement_timeout(void *any)
 {
   timeout_id = 0;
-  switch_interrupts(1);
+  RTC_Linux_SwitchInterrupt(fd, 1);
 }
 
 /* ================================================== */
@@ -586,21 +608,10 @@ measurement_timeout(void *any)
 static void
 set_rtc(time_t new_rtc_time)
 {
-  struct tm rtc_tm;
   struct rtc_time rtc_raw;
   int status;
 
-  rtc_tm = *rtc_from_t(&new_rtc_time);
-
-  rtc_raw.tm_sec = rtc_tm.tm_sec;
-  rtc_raw.tm_min = rtc_tm.tm_min;
-  rtc_raw.tm_hour = rtc_tm.tm_hour;
-  rtc_raw.tm_mday = rtc_tm.tm_mday;
-  rtc_raw.tm_mon = rtc_tm.tm_mon;
-  rtc_raw.tm_year = rtc_tm.tm_year;
-  rtc_raw.tm_wday = rtc_tm.tm_wday;
-  rtc_raw.tm_yday = rtc_tm.tm_yday;
-  rtc_raw.tm_isdst = rtc_tm.tm_isdst;
+  rtc_from_t(&new_rtc_time, &rtc_raw, rtc_on_utc);
 
   status = ioctl(fd, RTC_SET_TIME, &rtc_raw);
   if (status < 0) {
@@ -750,16 +761,11 @@ process_reading(time_t rtc_time, struct timespec *system_time)
 
 /* ================================================== */
 
-static void
-read_from_device(int fd_, int event, void *any)
+int
+RTC_Linux_CheckInterrupt(int fd)
 {
   int status;
   unsigned long data;
-  struct timespec sys_time;
-  struct rtc_time rtc_raw;
-  struct tm rtc_tm;
-  time_t rtc_t;
-  int error = 0;
 
   status = read(fd, &data, sizeof(data));
 
@@ -767,63 +773,79 @@ read_from_device(int fd_, int event, void *any)
     /* This looks like a bad error : the file descriptor was indicating it was
      * ready to read but we couldn't read anything.  Give up. */
     LOG(LOGS_ERR, "Could not read flags %s : %s", CNF_GetRtcDevice(), strerror(errno));
-    SCH_RemoveFileHandler(fd);
-    switch_interrupts(0); /* Likely to raise error too, but just to be sure... */
-    close(fd);
-    fd = -1;
-    return;
-  }    
+    return -1;
+  }
 
   if (skip_interrupts > 0) {
     /* Wait for the next interrupt, this one may be bogus */
     skip_interrupts--;
+    return 0;
+  }
+
+  /* Update interrupt detected? */
+  return (data & RTC_UF) == RTC_UF;
+}
+
+time_t
+RTC_Linux_ReadTimeAfterInterrupt(int fd, int utc,
+                                 struct timespec *sys_time_cooked,
+                                 struct timespec *sys_time_raw)
+{
+  int status;
+  struct rtc_time rtc_raw;
+
+  /* Read RTC time, sandwiched between two polls of the system clock
+     so we can bound any error */
+
+  SCH_GetLastEventTime(sys_time_cooked, NULL, sys_time_raw);
+
+  status = ioctl(fd, RTC_RD_TIME, &rtc_raw);
+  if (status < 0) {
+    LOG(LOGS_ERR, "Could not read time from %s : %s", CNF_GetRtcDevice(), strerror(errno));
+    return -1;
+  }
+
+  /* Convert RTC time into a struct timespec */
+  return t_from_rtc(&rtc_raw, utc);
+}
+
+static void
+read_from_device(int fd_, int event, void *any)
+{
+  struct timespec sys_time;
+  int status, error = 0;
+  time_t rtc_t;
+
+  status = RTC_Linux_CheckInterrupt(fd);
+  if (status < 0) {
+    SCH_RemoveFileHandler(fd);
+    RTC_Linux_SwitchInterrupt(fd, 0); /* Likely to raise error too, but just to be sure... */
+    close(fd);
+    fd = -1;
+    return;
+  } else if (status == 0) {
+    /* Wait for the next interrupt, this one may be bogus */
     return;
   }
 
-  if ((data & RTC_UF) == RTC_UF) {
-    /* Update interrupt detected */
-    
-    /* Read RTC time, sandwiched between two polls of the system clock
-       so we can bound any error. */
+  rtc_t = RTC_Linux_ReadTimeAfterInterrupt(fd, rtc_on_utc, &sys_time, NULL);
+  if (rtc_t == (time_t)-1) {
+    error = 1;
+    goto turn_off_interrupt;
+  }
 
-    SCH_GetLastEventTime(&sys_time, NULL, NULL);
-
-    status = ioctl(fd, RTC_RD_TIME, &rtc_raw);
-    if (status < 0) {
-      LOG(LOGS_ERR, "Could not read time from %s : %s", CNF_GetRtcDevice(), strerror(errno));
-      error = 1;
-      goto turn_off_interrupt;
-    }
-
-    /* Convert RTC time into a struct timespec */
-    rtc_tm.tm_sec = rtc_raw.tm_sec;
-    rtc_tm.tm_min = rtc_raw.tm_min;
-    rtc_tm.tm_hour = rtc_raw.tm_hour;
-    rtc_tm.tm_mday = rtc_raw.tm_mday;
-    rtc_tm.tm_mon = rtc_raw.tm_mon;
-    rtc_tm.tm_year = rtc_raw.tm_year;
-
-    rtc_t = t_from_rtc(&rtc_tm);
-
-    if (rtc_t == (time_t)(-1)) {
-      error = 1;
-      goto turn_off_interrupt;
-    }      
-
-    process_reading(rtc_t, &sys_time);
-
-    if (n_samples < 4) {
-      measurement_period = LOWEST_MEASUREMENT_PERIOD;
-    } else if (n_samples < 6) {
-      measurement_period = LOWEST_MEASUREMENT_PERIOD << 1;
-    } else if (n_samples < 10) {
-      measurement_period = LOWEST_MEASUREMENT_PERIOD << 2;
-    } else if (n_samples < 14) {
-      measurement_period = LOWEST_MEASUREMENT_PERIOD << 3;
-    } else {
-      measurement_period = LOWEST_MEASUREMENT_PERIOD << 4;
-    }
+  process_reading(rtc_t, &sys_time);
 
+  if (n_samples < 4) {
+    measurement_period = LOWEST_MEASUREMENT_PERIOD;
+  } else if (n_samples < 6) {
+    measurement_period = LOWEST_MEASUREMENT_PERIOD << 1;
+  } else if (n_samples < 10) {
+    measurement_period = LOWEST_MEASUREMENT_PERIOD << 2;
+  } else if (n_samples < 14) {
+    measurement_period = LOWEST_MEASUREMENT_PERIOD << 3;
+  } else {
+    measurement_period = LOWEST_MEASUREMENT_PERIOD << 4;
   }
 
 turn_off_interrupt:
@@ -835,7 +857,7 @@ turn_off_interrupt:
         operating_mode = OM_NORMAL;
         (after_init_hook)(after_init_hook_arg);
 
-        switch_interrupts(0);
+        RTC_Linux_SwitchInterrupt(fd, 0);
     
         timeout_id = SCH_AddTimeoutByDelay((double) measurement_period, measurement_timeout, NULL);
       }
@@ -847,7 +869,7 @@ turn_off_interrupt:
         DEBUG_LOG("Could not complete after trim relock due to errors");
         operating_mode = OM_NORMAL;
 
-        switch_interrupts(0);
+        RTC_Linux_SwitchInterrupt(fd, 0);
     
         timeout_id = SCH_AddTimeoutByDelay((double) measurement_period, measurement_timeout, NULL);
       }
@@ -855,7 +877,7 @@ turn_off_interrupt:
       break;
 
     case OM_NORMAL:
-      switch_interrupts(0);
+      RTC_Linux_SwitchInterrupt(fd, 0);
     
       timeout_id = SCH_AddTimeoutByDelay((double) measurement_period, measurement_timeout, NULL);
 
@@ -877,7 +899,7 @@ RTC_Linux_TimeInit(void (*after_hook)(void *), void *anything)
 
   operating_mode = OM_INITIAL;
   timeout_id = 0;
-  switch_interrupts(1);
+  RTC_Linux_SwitchInterrupt(fd, 1);
 }
 
 /* ================================================== */
@@ -910,6 +932,33 @@ RTC_Linux_WriteParameters(void)
   return(retval);
 }
 
+time_t
+RTC_Linux_ReadTimeNow(int fd, int utc,
+                      struct timespec *old_sys_cooked,
+                      struct timespec *old_sys_raw)
+{
+  struct rtc_time rtc_raw, rtc_raw_retry;
+  int status;
+
+  /* Retry reading the RTC until both read attempts give the same sec value.
+     This way the race condition is prevented that the RTC has updated itself
+     during the first read operation. */
+  do {
+    status = ioctl(fd, RTC_RD_TIME, &rtc_raw);
+    if (status >= 0) {
+      status = ioctl(fd, RTC_RD_TIME, &rtc_raw_retry);
+    }
+  } while (status >= 0 && rtc_raw.tm_sec != rtc_raw_retry.tm_sec);
+
+  /* Read system clock */
+  if (old_sys_raw)
+    LCL_ReadRawTime(old_sys_raw);
+  if (old_sys_cooked)
+    LCL_ReadCookedTime(old_sys_cooked, NULL);
+
+  return status >= 0 ? t_from_rtc(&rtc_raw, utc) : -1;
+}
+
 /* ================================================== */
 /* Try to set the system clock from the RTC, in the same manner as
    /sbin/hwclock -s would do.  We're not as picky about OS version
@@ -919,12 +968,10 @@ RTC_Linux_WriteParameters(void)
 int
 RTC_Linux_TimePreInit(time_t driftfile_time)
 {
-  int fd, status;
-  struct rtc_time rtc_raw, rtc_raw_retry;
-  struct tm rtc_tm;
   time_t rtc_t;
   double accumulated_error, sys_offset;
   struct timespec new_sys_time, old_sys_time;
+  int fd;
 
   coefs_file_name = CNF_GetRtcFile();
 
@@ -937,66 +984,41 @@ RTC_Linux_TimePreInit(time_t driftfile_time)
     return 0; /* Can't open it, and won't be able to later */
   }
 
-  /* Retry reading the rtc until both read attempts give the same sec value.
-     This way the race condition is prevented that the RTC has updated itself
-     during the first read operation. */
-  do {
-    status = ioctl(fd, RTC_RD_TIME, &rtc_raw);
-    if (status >= 0) {
-      status = ioctl(fd, RTC_RD_TIME, &rtc_raw_retry);
-    }
-  } while (status >= 0 && rtc_raw.tm_sec != rtc_raw_retry.tm_sec);
-
-  /* Read system clock */
-  LCL_ReadCookedTime(&old_sys_time, NULL);
+  rtc_t = RTC_Linux_ReadTimeNow(fd, rtc_on_utc, &old_sys_time, NULL);
 
   close(fd);
 
-  if (status >= 0) {
-    /* Convert to seconds since 1970 */
-    rtc_tm.tm_sec = rtc_raw.tm_sec;
-    rtc_tm.tm_min = rtc_raw.tm_min;
-    rtc_tm.tm_hour = rtc_raw.tm_hour;
-    rtc_tm.tm_mday = rtc_raw.tm_mday;
-    rtc_tm.tm_mon = rtc_raw.tm_mon;
-    rtc_tm.tm_year = rtc_raw.tm_year;
-    
-    rtc_t = t_from_rtc(&rtc_tm);
+  if (rtc_t != (time_t)(-1)) {
 
-    if (rtc_t != (time_t)(-1)) {
-
-      /* Work out approximatation to correct time (to about the
-         nearest second) */
-      if (valid_coefs_from_file) {
-        accumulated_error = file_ref_offset +
-          (rtc_t - file_ref_time) * 1.0e-6 * file_rate_ppm;
-      } else {
-        accumulated_error = 0.0;
-      }
-
-      /* Correct time */
-
-      new_sys_time.tv_sec = rtc_t;
-      /* Average error in the RTC reading */
-      new_sys_time.tv_nsec = 500000000;
-
-      UTI_AddDoubleToTimespec(&new_sys_time, -accumulated_error, &new_sys_time);
-
-      if (new_sys_time.tv_sec < driftfile_time) {
-        LOG(LOGS_WARN, "RTC time before last driftfile modification (ignored)");
-        return 0;
-      }
-
-      sys_offset = UTI_DiffTimespecsToDouble(&old_sys_time, &new_sys_time);
-
-      /* Set system time only if the step is larger than 1 second */
-      if (fabs(sys_offset) >= 1.0) {
-        if (LCL_ApplyStepOffset(sys_offset))
-          LOG(LOGS_INFO, "System time set from RTC");
-      }
+    /* Work out approximation to correct time (to about the
+       nearest second) */
+    if (valid_coefs_from_file) {
+      accumulated_error = file_ref_offset +
+        (rtc_t - file_ref_time) * 1.0e-6 * file_rate_ppm;
     } else {
+      accumulated_error = 0.0;
+    }
+
+    /* Correct time */
+
+    new_sys_time.tv_sec = rtc_t;
+    /* Average error in the RTC reading */
+    new_sys_time.tv_nsec = 500000000;
+
+    UTI_AddDoubleToTimespec(&new_sys_time, -accumulated_error, &new_sys_time);
+
+    if (new_sys_time.tv_sec < driftfile_time) {
+      LOG(LOGS_WARN, "RTC time before last driftfile modification (ignored)");
       return 0;
     }
+
+    sys_offset = UTI_DiffTimespecsToDouble(&old_sys_time, &new_sys_time);
+
+    /* Set system time only if the step is larger than 1 second */
+    if (fabs(sys_offset) >= 1.0) {
+      if (LCL_ApplyStepOffset(sys_offset))
+        LOG(LOGS_INFO, "System time set from RTC");
+    }
   } else {
     return 0;
   }
@@ -1064,7 +1086,7 @@ RTC_Linux_Trim(void)
     /* And start rapid sampling, interrupts on now */
     SCH_RemoveTimeout(timeout_id);
     timeout_id = 0;
-    switch_interrupts(1);
+    RTC_Linux_SwitchInterrupt(fd, 1);
   }
 
   return 1;

rtc_linux.h

@@ -42,4 +42,13 @@ extern int RTC_Linux_Trim(void);
 
 extern void RTC_Linux_CycleLogFile(void);
 
+extern int RTC_Linux_SwitchInterrupt(int fd, int on_off);
+extern int RTC_Linux_CheckInterrupt(int fd);
+extern time_t RTC_Linux_ReadTimeAfterInterrupt(int fd, int utc,
+                                               struct timespec *sys_time_cooked,
+                                               struct timespec *sys_time_raw);
+extern time_t RTC_Linux_ReadTimeNow(int fd, int utc,
+                                    struct timespec *sys_time_cooked,
+                                    struct timespec *sys_time_raw);
+
 #endif /* _GOT_RTC_LINUX_H */

sched.c

@@ -47,12 +47,6 @@ static int initialised = 0;
 /* One more than the highest file descriptor that is registered */
 static unsigned int one_highest_fd;
 
-#ifndef FD_SETSIZE
-/* If FD_SETSIZE is not defined, assume that fd_set is implemented
-   as a fixed size array of bits, possibly embedded inside a record */
-#define FD_SETSIZE (sizeof(fd_set) * 8)
-#endif
-
 typedef struct {
   SCH_FileHandler       handler;
   SCH_ArbitraryArgument arg;
@@ -163,6 +157,8 @@ SCH_Finalise(void) {
 
   ARR_DestroyInstance(file_handlers);
 
+  timer_queue.next = &timer_queue;
+  timer_queue.prev = &timer_queue;
   for (i = 0; i < ARR_GetSize(tqe_blocks); i++)
     Free(*(TimerQueueEntry **)ARR_GetElement(tqe_blocks, i));
   ARR_DestroyInstance(tqe_blocks);

siv.h

@@ -36,6 +36,7 @@
 
 /* Identifiers of SIV algorithms following the IANA AEAD registry */
 typedef enum {
+  AEAD_SIV_INVALID = 0,
   AEAD_AES_SIV_CMAC_256 = 15,
   AEAD_AES_SIV_CMAC_384 = 16,
   AEAD_AES_SIV_CMAC_512 = 17,

siv_gnutls.c

@@ -2,7 +2,7 @@
   chronyd/chronyc - Programs for keeping computer clocks accurate.
 
  **********************************************************************
- * Copyright (C) Miroslav Lichvar  2020
+ * Copyright (C) Miroslav Lichvar  2020, 2023
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -37,6 +37,8 @@
 struct SIV_Instance_Record {
   gnutls_cipher_algorithm_t algorithm;
   gnutls_aead_cipher_hd_t cipher;
+  int min_nonce_length;
+  int max_nonce_length;
 };
 
 /* ================================================== */
@@ -81,6 +83,10 @@ get_cipher_algorithm(SIV_Algorithm algorithm)
   switch (algorithm) {
     case AEAD_AES_SIV_CMAC_256:
       return GNUTLS_CIPHER_AES_128_SIV;
+#if HAVE_GNUTLS_SIV_GCM
+    case AEAD_AES_128_GCM_SIV:
+      return GNUTLS_CIPHER_AES_128_SIV_GCM;
+#endif
     default:
       return 0;
   }
@@ -112,6 +118,19 @@ SIV_CreateInstance(SIV_Algorithm algorithm)
   instance->algorithm = calgo;
   instance->cipher = NULL;
 
+  switch (algorithm) {
+    case AEAD_AES_SIV_CMAC_256:
+      instance->min_nonce_length = 1;
+      instance->max_nonce_length = INT_MAX;
+      break;
+    case AEAD_AES_128_GCM_SIV:
+      instance->min_nonce_length = 12;
+      instance->max_nonce_length = 12;
+      break;
+    default:
+      assert(0);
+  }
+
   instance_counter++;
 
   return instance;
@@ -143,6 +162,8 @@ SIV_GetKeyLength(SIV_Algorithm algorithm)
     return 0;
 
   len = gnutls_cipher_get_key_size(calgo);
+  if (len == 0)
+    return 0;
 
   if (len < 1 || len > SIV_MAX_KEY_LENGTH)
     LOG_FATAL("Invalid key length");
@@ -198,7 +219,7 @@ SIV_SetKey(SIV_Instance instance, const unsigned char *key, int length)
 int
 SIV_GetMinNonceLength(SIV_Instance instance)
 {
-  return 1;
+  return instance->min_nonce_length;
 }
 
 /* ================================================== */
@@ -206,7 +227,7 @@ SIV_GetMinNonceLength(SIV_Instance instance)
 int
 SIV_GetMaxNonceLength(SIV_Instance instance)
 {
-  return INT_MAX;
+  return instance->max_nonce_length;
 }
 
 /* ================================================== */
@@ -238,7 +259,8 @@ SIV_Encrypt(SIV_Instance instance,
   if (!instance->cipher)
     return 0;
 
-  if (nonce_length < 1 || assoc_length < 0 ||
+  if (nonce_length < instance->min_nonce_length ||
+      nonce_length > instance->max_nonce_length || assoc_length < 0 ||
       plaintext_length < 0 || ciphertext_length < 0)
     return 0;
 
@@ -269,7 +291,8 @@ SIV_Decrypt(SIV_Instance instance,
   if (!instance->cipher)
     return 0;
 
-  if (nonce_length < 1 || assoc_length < 0 ||
+  if (nonce_length < instance->min_nonce_length ||
+      nonce_length > instance->max_nonce_length || assoc_length < 0 ||
       plaintext_length < 0 || ciphertext_length < 0)
     return 0;
 

siv_nettle.c

@@ -2,7 +2,7 @@
   chronyd/chronyc - Programs for keeping computer clocks accurate.
 
  **********************************************************************
- * Copyright (C) Miroslav Lichvar  2019
+ * Copyright (C) Miroslav Lichvar  2019, 2022
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -28,18 +28,14 @@
 
 #include "sysincl.h"
 
-#ifdef HAVE_NETTLE_SIV_CMAC
 #include <nettle/siv-cmac.h>
-#else
-#include "siv_nettle_int.c"
-#endif
-
 #ifdef HAVE_NETTLE_SIV_GCM
 #include <nettle/siv-gcm.h>
 #endif
 
 #include "memory.h"
 #include "siv.h"
+#include "util.h"
 
 struct SIV_Instance_Record {
   SIV_Algorithm algorithm;
@@ -163,8 +159,7 @@ SIV_GetMaxNonceLength(SIV_Instance instance)
 int
 SIV_GetTagLength(SIV_Instance instance)
 {
-  if (instance->tag_length < 1 || instance->tag_length > SIV_MAX_TAG_LENGTH)
-    assert(0);
+  BRIEF_ASSERT(instance->tag_length >= 1 && instance->tag_length <= SIV_MAX_TAG_LENGTH);
   return instance->tag_length;
 }
 

siv_nettle_int.c

@@ -1,452 +0,0 @@
-/* This is a single-file implementation of AES-SIV-CMAC-256 based on
-   a patch for GNU Nettle by Nikos Mavrogiannopoulos */
-
-/*
-   AES-CMAC-128 (rfc 4493)
-   Copyright (C) Stefan Metzmacher 2012
-   Copyright (C) Jeremy Allison 2012
-   Copyright (C) Michael Adam 2012
-   Copyright (C) 2017, Red Hat Inc.
-
-   This file is part of GNU Nettle.
-
-   GNU Nettle is free software: you can redistribute it and/or
-   modify it under the terms of either:
-
-     * the GNU Lesser General Public License as published by the Free
-       Software Foundation; either version 3 of the License, or (at your
-       option) any later version.
-
-   or
-
-     * the GNU General Public License as published by the Free
-       Software Foundation; either version 2 of the License, or (at your
-       option) any later version.
-
-   or both in parallel, as here.
-
-   GNU Nettle is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   General Public License for more details.
-
-   You should have received copies of the GNU General Public License and
-   the GNU Lesser General Public License along with this program.  If
-   not, see http://www.gnu.org/licenses/.
-*/
-/* siv-aes128.c, siv-cmac.c, siv.h
-
-   AES-SIV, RFC5297
-   SIV-CMAC, RFC5297
-
-   Copyright (C) 2017 Nikos Mavrogiannopoulos
-
-   This file is part of GNU Nettle.
-
-   GNU Nettle is free software: you can redistribute it and/or
-   modify it under the terms of either:
-
-     * the GNU Lesser General Public License as published by the Free
-       Software Foundation; either version 3 of the License, or (at your
-       option) any later version.
-
-   or
-
-     * the GNU General Public License as published by the Free
-       Software Foundation; either version 2 of the License, or (at your
-       option) any later version.
-
-   or both in parallel, as here.
-
-   GNU Nettle is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   General Public License for more details.
-
-   You should have received copies of the GNU General Public License and
-   the GNU Lesser General Public License along with this program.  If
-   not, see http://www.gnu.org/licenses/.
-*/
-/* cmac.h, siv-cmac.h, cmac-aes128.c
-
-   CMAC mode, as specified in RFC4493
-   SIV-CMAC mode, as specified in RFC5297
-   CMAC using AES128 as the underlying cipher.
-
-   Copyright (C) 2017 Red Hat, Inc.
-
-   Contributed by Nikos Mavrogiannopoulos
-
-   This file is part of GNU Nettle.
-
-   GNU Nettle is free software: you can redistribute it and/or
-   modify it under the terms of either:
-
-     * the GNU Lesser General Public License as published by the Free
-       Software Foundation; either version 3 of the License, or (at your
-       option) any later version.
-
-   or
-
-     * the GNU General Public License as published by the Free
-       Software Foundation; either version 2 of the License, or (at your
-       option) any later version.
-
-   or both in parallel, as here.
-
-   GNU Nettle is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   General Public License for more details.
-
-   You should have received copies of the GNU General Public License and
-   the GNU Lesser General Public License along with this program.  If
-   not, see http://www.gnu.org/licenses/.
-*/
-
-# include "config.h"
-
-#include <assert.h>
-#include <string.h>
-
-#include "nettle/aes.h"
-#include "nettle/ctr.h"
-#include "nettle/macros.h"
-#include "nettle/memxor.h"
-#include "nettle/memops.h"
-
-#include "nettle/nettle-types.h"
-
-/* For SIV, the block size of the block cipher shall be 128 bits. */
-#define SIV_BLOCK_SIZE  16
-#define SIV_DIGEST_SIZE 16
-#define SIV_MIN_NONCE_SIZE 1
-
-/*
- * SIV mode requires the aad and plaintext when building the IV, which
- * prevents streaming processing and it incompatible with the AEAD API.
- */
-
-/* AES_SIV_CMAC_256 */
-struct siv_cmac_aes128_ctx {
-    struct aes128_ctx         cipher;
-    uint8_t s2vk[AES128_KEY_SIZE];
-};
-
-struct cmac128_ctx
-{
-  /* Key */
-  union nettle_block16 K1;
-  union nettle_block16 K2;
-
-  /* MAC state */
-  union nettle_block16 X;
-
-  /* Block buffer */
-  union nettle_block16 block;
-  size_t index;
-};
-
-/* shift one and XOR with 0x87. */
-static void
-_cmac128_block_mulx(union nettle_block16 *dst,
-	   const union nettle_block16 *src)
-{
-  uint64_t b1 = READ_UINT64(src->b);
-  uint64_t b2 = READ_UINT64(src->b+8);
-
-  b1 = (b1 << 1) | (b2 >> 63);
-  b2 <<= 1;
-
-  if (src->b[0] & 0x80)
-    b2 ^= 0x87;
-
-  WRITE_UINT64(dst->b, b1);
-  WRITE_UINT64(dst->b+8, b2);
-}
-
-static void
-cmac128_set_key(struct cmac128_ctx *ctx, const void *cipher,
-		nettle_cipher_func *encrypt)
-{
-  static const uint8_t const_zero[] = {
-    0x00, 0x00, 0x00, 0x00,  0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00,  0x00, 0x00, 0x00, 0x00
-  };
-  union nettle_block16 *L = &ctx->block;
-  memset(ctx, 0, sizeof(*ctx));
-
-  /* step 1 - generate subkeys k1 and k2 */
-  encrypt(cipher, 16, L->b, const_zero);
-
-  _cmac128_block_mulx(&ctx->K1, L);
-  _cmac128_block_mulx(&ctx->K2, &ctx->K1);
-}
-
-#define MIN(x,y) ((x)<(y)?(x):(y))
-
-static void
-cmac128_update(struct cmac128_ctx *ctx, const void *cipher,
-	       nettle_cipher_func *encrypt,
-	       size_t msg_len, const uint8_t *msg)
-{
-  union nettle_block16 Y;
-  /*
-   * check if we expand the block
-   */
-  if (ctx->index < 16)
-    {
-      size_t len = MIN(16 - ctx->index, msg_len);
-      memcpy(&ctx->block.b[ctx->index], msg, len);
-      msg += len;
-      msg_len -= len;
-      ctx->index += len;
-    }
-
-  if (msg_len == 0) {
-    /* if it is still the last block, we are done */
-    return;
-  }
-
-  /*
-   * now checksum everything but the last block
-   */
-  memxor3(Y.b, ctx->X.b, ctx->block.b, 16);
-  encrypt(cipher, 16, ctx->X.b, Y.b);
-
-  while (msg_len > 16)
-    {
-      memxor3(Y.b, ctx->X.b, msg, 16);
-      encrypt(cipher, 16, ctx->X.b, Y.b);
-      msg += 16;
-      msg_len -= 16;
-    }
-
-  /*
-   * copy the last block, it will be processed in
-   * cmac128_digest().
-   */
-  memcpy(ctx->block.b, msg, msg_len);
-  ctx->index = msg_len;
-}
-
-static void
-cmac128_digest(struct cmac128_ctx *ctx, const void *cipher,
-	       nettle_cipher_func *encrypt,
-	       unsigned length,
-	       uint8_t *dst)
-{
-  union nettle_block16 Y;
-
-  memset(ctx->block.b+ctx->index, 0, sizeof(ctx->block.b)-ctx->index);
-
-  /* re-use ctx->block for memxor output */
-  if (ctx->index < 16)
-    {
-      ctx->block.b[ctx->index] = 0x80;
-      memxor(ctx->block.b, ctx->K2.b, 16);
-    }
-  else
-    {
-      memxor(ctx->block.b, ctx->K1.b, 16);
-    }
-
-  memxor3(Y.b, ctx->block.b, ctx->X.b, 16);
-
-  assert(length <= 16);
-  if (length == 16)
-    {
-      encrypt(cipher, 16, dst, Y.b);
-    }
-  else
-    {
-      encrypt(cipher, 16, ctx->block.b, Y.b);
-      memcpy(dst, ctx->block.b, length);
-    }
-
-  /* reset state for re-use */
-  memset(&ctx->X, 0, sizeof(ctx->X));
-  ctx->index = 0;
-}
-
-
-#define CMAC128_CTX(type) \
-  { struct cmac128_ctx ctx; type cipher; }
-
-/* NOTE: Avoid using NULL, as we don't include anything defining it. */
-#define CMAC128_SET_KEY(self, set_key, encrypt, cmac_key)	\
-  do {								\
-    (set_key)(&(self)->cipher, (cmac_key));			\
-    if (0) (encrypt)(&(self)->cipher, ~(size_t) 0,		\
-		     (uint8_t *) 0, (const uint8_t *) 0);	\
-    cmac128_set_key(&(self)->ctx, &(self)->cipher,		\
-		(nettle_cipher_func *) (encrypt));		\
-  } while (0)
-
-#define CMAC128_UPDATE(self, encrypt, length, src)		\
-  cmac128_update(&(self)->ctx, &(self)->cipher,			\
-	      (nettle_cipher_func *)encrypt, (length), (src))
-
-#define CMAC128_DIGEST(self, encrypt, length, digest)		\
-  (0 ? (encrypt)(&(self)->cipher, ~(size_t) 0,			\
-		 (uint8_t *) 0, (const uint8_t *) 0)		\
-     : cmac128_digest(&(self)->ctx, &(self)->cipher,		\
-		  (nettle_cipher_func *) (encrypt),		\
-		  (length), (digest)))
-
-struct cmac_aes128_ctx CMAC128_CTX(struct aes128_ctx);
-
-static void
-cmac_aes128_set_key(struct cmac_aes128_ctx *ctx, const uint8_t *key)
-{
-  CMAC128_SET_KEY(ctx, aes128_set_encrypt_key, aes128_encrypt, key);
-}
-
-static void
-cmac_aes128_update (struct cmac_aes128_ctx *ctx,
-		   size_t length, const uint8_t *data)
-{
-  CMAC128_UPDATE (ctx, aes128_encrypt, length, data);
-}
-
-static void
-cmac_aes128_digest(struct cmac_aes128_ctx *ctx,
-		  size_t length, uint8_t *digest)
-{
-  CMAC128_DIGEST(ctx, aes128_encrypt, length, digest);
-}
-
-static const uint8_t const_one[] = {
-	0x00, 0x00, 0x00, 0x00,  0x00, 0x00, 0x00, 0x00,
-	0x00, 0x00, 0x00, 0x00,  0x00, 0x00, 0x00, 0x01
-};
-
-static const uint8_t const_zero[] = {
-	0x00, 0x00, 0x00, 0x00,  0x00, 0x00, 0x00, 0x00,
-	0x00, 0x00, 0x00, 0x00,  0x00, 0x00, 0x00, 0x00
-};
-
-static
-void _siv_s2v(nettle_set_key_func *cmac_set_key,
-	      nettle_hash_update_func *cmac_update,
-	      nettle_hash_digest_func *cmac_digest,
-	      size_t cmac_ctx_size,
-	      const uint8_t *s2vk, size_t alength, const uint8_t *adata,
-              size_t nlength, const uint8_t *nonce,
-              size_t plength, const uint8_t *pdata,
-              uint8_t *v)
-{
-  uint8_t ctx[sizeof(struct cmac128_ctx)+sizeof(struct aes_ctx)];
-  union nettle_block16 D, S, T;
-
-  assert(cmac_ctx_size <= sizeof (ctx));
-
-  cmac_set_key(ctx, s2vk);
-
-  if (nlength == 0 && alength == 0) {
-    cmac_update(ctx, 16, const_one);
-    cmac_digest(ctx, 16, v);
-    return;
-  }
-
-  cmac_update(ctx, 16, const_zero);
-  cmac_digest(ctx, 16, D.b);
-
-  if (1) {
-    _cmac128_block_mulx(&D, &D);
-    cmac_update(ctx, alength, adata);
-    cmac_digest(ctx, 16, S.b);
-
-    memxor(D.b, S.b, 16);
-  }
-
-  if (nlength > 0) {
-    _cmac128_block_mulx(&D, &D);
-    cmac_update(ctx, nlength, nonce);
-    cmac_digest(ctx, 16, S.b);
-
-    memxor(D.b, S.b, 16);
-  }
-
-  /* Sn */
-  if (plength >= 16) {
-    cmac_update(ctx, plength-16, pdata);
-
-    pdata += plength-16;
-
-    memxor3(T.b, pdata, D.b, 16);
-  } else {
-    union nettle_block16 pad;
-
-    _cmac128_block_mulx(&T, &D);
-    memcpy(pad.b, pdata, plength);
-    pad.b[plength] = 0x80;
-    if (plength+1 < 16)
-      memset(&pad.b[plength+1], 0, 16-plength-1);
-
-    memxor(T.b, pad.b, 16);
-  }
-
-  cmac_update(ctx, 16, T.b);
-  cmac_digest(ctx, 16, v);
-}
-
-static void
-siv_cmac_aes128_set_key(struct siv_cmac_aes128_ctx *ctx, const uint8_t *key)
-{
-  memcpy(ctx->s2vk, key, 16);
-  aes128_set_encrypt_key(&ctx->cipher, key+16);
-}
-
-static void
-siv_cmac_aes128_encrypt_message(struct siv_cmac_aes128_ctx *ctx,
-				size_t nlength, const uint8_t *nonce,
-				size_t alength, const uint8_t *adata,
-				size_t clength, uint8_t *dst, const uint8_t *src)
-{
-  union nettle_block16 siv;
-  size_t slength;
-
-  assert (clength >= SIV_DIGEST_SIZE);
-  slength = clength - SIV_DIGEST_SIZE;
-
-  /* create CTR nonce */
-  _siv_s2v((nettle_set_key_func*)cmac_aes128_set_key,
-	   (nettle_hash_update_func*)cmac_aes128_update,
-	   (nettle_hash_digest_func*)cmac_aes128_digest,
-	   sizeof(struct cmac_aes128_ctx), ctx->s2vk, alength, adata,
-	   nlength, nonce, slength, src, siv.b);
-  memcpy(dst, siv.b, SIV_DIGEST_SIZE);
-  siv.b[8] &= ~0x80;
-  siv.b[12] &= ~0x80;
-
-  ctr_crypt(&ctx->cipher, (nettle_cipher_func *)aes128_encrypt, AES_BLOCK_SIZE,
-            siv.b, slength, dst+SIV_DIGEST_SIZE, src);
-}
-
-static int
-siv_cmac_aes128_decrypt_message(struct siv_cmac_aes128_ctx *ctx,
-				size_t nlength, const uint8_t *nonce,
-				size_t alength, const uint8_t *adata,
-				size_t mlength, uint8_t *dst, const uint8_t *src)
-{
-  union nettle_block16 siv;
-  union nettle_block16 ctr;
-
-  memcpy(ctr.b, src, SIV_DIGEST_SIZE);
-  ctr.b[8] &= ~0x80;
-  ctr.b[12] &= ~0x80;
-
-  ctr_crypt(&ctx->cipher, (nettle_cipher_func *)aes128_encrypt, AES_BLOCK_SIZE,
-            ctr.b, mlength, dst, src+SIV_DIGEST_SIZE);
-
-  /* create CTR nonce */
-  _siv_s2v((nettle_set_key_func*)cmac_aes128_set_key,
-	   (nettle_hash_update_func*)cmac_aes128_update,
-	   (nettle_hash_digest_func*)cmac_aes128_digest,
-	   sizeof(struct cmac_aes128_ctx), ctx->s2vk, alength, adata,
-	   nlength, nonce, mlength, dst, siv.b);
-
-  return memeql_sec(siv.b, src, SIV_DIGEST_SIZE);
-}
-

socket.c

@@ -5,6 +5,7 @@
  * Copyright (C) Richard P. Curnow  1997-2003
  * Copyright (C) Timo Teras  2009
  * Copyright (C) Miroslav Lichvar  2009, 2013-2020
+ * Copyright (C) Luke Valenta  2023
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -89,6 +90,9 @@ struct MessageHeader {
 
 static int initialised;
 
+static int first_reusable_fd;
+static int reusable_fds;
+
 /* Flags indicating in which IP families sockets can be requested */
 static int ip4_enabled;
 static int ip6_enabled;
@@ -155,13 +159,79 @@ domain_to_string(int domain)
 
 /* ================================================== */
 
+static int
+get_reusable_socket(int type, IPSockAddr *spec)
+{
+#ifdef LINUX
+  union sockaddr_all sa;
+  IPSockAddr ip_sa;
+  int sock_fd, opt;
+  socklen_t l;
+
+  /* Abort early if not an IPv4/IPv6 server socket */
+  if (!spec || spec->ip_addr.family == IPADDR_UNSPEC || spec->port == 0)
+    return INVALID_SOCK_FD;
+
+  /* Loop over available reusable sockets */
+  for (sock_fd = first_reusable_fd; sock_fd < first_reusable_fd + reusable_fds; sock_fd++) {
+
+    /* Check that types match */
+    l = sizeof (opt);
+    if (getsockopt(sock_fd, SOL_SOCKET, SO_TYPE, &opt, &l) < 0 ||
+        l != sizeof (opt) || opt != type)
+      continue;
+
+    /* Get sockaddr for reusable socket */
+    l = sizeof (sa);
+    if (getsockname(sock_fd, &sa.sa, &l) < 0 || l < sizeof (sa_family_t))
+      continue;
+    SCK_SockaddrToIPSockAddr(&sa.sa, l, &ip_sa);
+
+    /* Check that reusable socket matches specification */
+    if (ip_sa.port != spec->port || UTI_CompareIPs(&ip_sa.ip_addr, &spec->ip_addr, NULL) != 0)
+      continue;
+
+    /* Check that STREAM socket is listening */
+    l = sizeof (opt);
+    if (type == SOCK_STREAM && (getsockopt(sock_fd, SOL_SOCKET, SO_ACCEPTCONN, &opt, &l) < 0 ||
+                                l != sizeof (opt) || opt == 0))
+      continue;
+
+#if defined(FEAT_IPV6) && defined(IPV6_V6ONLY)
+    if (spec->ip_addr.family == IPADDR_INET6 &&
+        (!SCK_GetIntOption(sock_fd, IPPROTO_IPV6, IPV6_V6ONLY, &opt) || opt != 1))
+      LOG(LOGS_WARN, "Reusable IPv6 socket missing IPV6_V6ONLY option");
+#endif
+
+    return sock_fd;
+  }
+#endif
+
+  return INVALID_SOCK_FD;
+}
+
+/* ================================================== */
+
 #if defined(SOCK_CLOEXEC) || defined(SOCK_NONBLOCK)
+
+static int
+get_default_inet_domain(void)
+{
+#ifdef FEAT_IPV6
+  if (!ip4_enabled && ip6_enabled)
+    return AF_INET6;
+#endif
+  return AF_INET;
+}
+
+/* ================================================== */
+
 static int
 check_socket_flag(int sock_flag, int fd_flag, int fs_flag)
 {
   int sock_fd, fd_flags, fs_flags;
 
-  sock_fd = socket(AF_INET, SOCK_DGRAM | sock_flag, 0);
+  sock_fd = socket(get_default_inet_domain(), SOCK_DGRAM | sock_flag, 0);
   if (sock_fd < 0)
     return 0;
 
@@ -212,7 +282,7 @@ static int
 set_socket_flags(int sock_fd, int flags)
 {
   /* Close the socket automatically on exec */
-  if (
+  if (!SCK_IsReusable(sock_fd) &&
 #ifdef SOCK_CLOEXEC
       (supported_socket_flags & SOCK_CLOEXEC) == 0 &&
 #endif
@@ -222,7 +292,7 @@ set_socket_flags(int sock_fd, int flags)
   /* Enable non-blocking mode */
   if ((flags & SCK_FLAG_BLOCK) == 0 &&
 #ifdef SOCK_NONBLOCK
-      (supported_socket_flags & SOCK_NONBLOCK) == 0 &&
+      (SCK_IsReusable(sock_fd) || (supported_socket_flags & SOCK_NONBLOCK) == 0) &&
 #endif
       !set_socket_nonblock(sock_fd))
     return 0;
@@ -279,6 +349,32 @@ open_socket_pair(int domain, int type, int flags, int *other_fd)
 
 /* ================================================== */
 
+static int
+get_ip_socket(int domain, int type, int flags, IPSockAddr *ip_sa)
+{
+  int sock_fd;
+
+  /* Check if there is a matching reusable socket */
+  sock_fd = get_reusable_socket(type, ip_sa);
+
+  if (sock_fd < 0) {
+    sock_fd = open_socket(domain, type, flags);
+
+    /* Unexpected, but make sure the new socket is not in the reusable range */
+    if (SCK_IsReusable(sock_fd))
+      LOG_FATAL("Could not open %s socket : file descriptor in reusable range",
+                domain_to_string(domain));
+  } else {
+    /* Set socket flags on reusable socket */
+    if (!set_socket_flags(sock_fd, flags))
+      return INVALID_SOCK_FD;
+  }
+
+  return sock_fd;
+}
+
+/* ================================================== */
+
 static int
 set_socket_options(int sock_fd, int flags)
 {
@@ -295,8 +391,10 @@ static int
 set_ip_options(int sock_fd, int family, int flags)
 {
 #if defined(FEAT_IPV6) && defined(IPV6_V6ONLY)
-  /* Receive only IPv6 packets on an IPv6 socket */
-  if (family == IPADDR_INET6 && !SCK_SetIntOption(sock_fd, IPPROTO_IPV6, IPV6_V6ONLY, 1))
+  /* Receive only IPv6 packets on an IPv6 socket, but do not attempt
+     to set this option on pre-initialised reuseable sockets */
+  if (family == IPADDR_INET6 && !SCK_IsReusable(sock_fd) &&
+      !SCK_SetIntOption(sock_fd, IPPROTO_IPV6, IPV6_V6ONLY, 1))
     return 0;
 #endif
 
@@ -385,6 +483,10 @@ bind_ip_address(int sock_fd, IPSockAddr *addr, int flags)
     ;
 #endif
 
+  /* Do not attempt to bind pre-initialised reusable socket */
+  if (SCK_IsReusable(sock_fd))
+    return 1;
+
   saddr_len = SCK_IPSockAddrToSockaddr(addr, (struct sockaddr *)&saddr, sizeof (saddr));
   if (saddr_len == 0)
     return 0;
@@ -437,7 +539,7 @@ open_ip_socket(IPSockAddr *remote_addr, IPSockAddr *local_addr, const char *ifac
   else if (remote_addr)
     family = remote_addr->ip_addr.family;
   else
-    family = IPADDR_INET4;
+    family = !ip4_enabled && ip6_enabled ? IPADDR_INET6 : IPADDR_INET4;
 
   switch (family) {
     case IPADDR_INET4:
@@ -457,7 +559,7 @@ open_ip_socket(IPSockAddr *remote_addr, IPSockAddr *local_addr, const char *ifac
       return INVALID_SOCK_FD;
   }
 
-  sock_fd = open_socket(domain, type, flags);
+  sock_fd = get_ip_socket(domain, type, flags, local_addr);
   if (sock_fd < 0)
     return INVALID_SOCK_FD;
 
@@ -482,7 +584,8 @@ open_ip_socket(IPSockAddr *remote_addr, IPSockAddr *local_addr, const char *ifac
     goto error;
 
   if (remote_addr || local_addr)
-    DEBUG_LOG("Opened %s%s socket fd=%d%s%s%s%s",
+    DEBUG_LOG("%s %s%s socket fd=%d%s%s%s%s",
+              SCK_IsReusable(sock_fd) ? "Reusing" : "Opened",
               type == SOCK_DGRAM ? "UDP" : type == SOCK_STREAM ? "TCP" : "?",
               family == IPADDR_INET4 ? "v4" : "v6",
               sock_fd,
@@ -500,25 +603,40 @@ error:
 
 /* ================================================== */
 
+static socklen_t
+set_unix_sockaddr(struct sockaddr_un *sun, const char *addr)
+{
+  size_t len = strlen(addr);
+
+  if (len + 1 > sizeof (sun->sun_path)) {
+    DEBUG_LOG("Unix socket path %s too long", addr);
+    return 0;
+  }
+
+  memset(sun, 0, sizeof (*sun));
+  sun->sun_family = AF_UNIX;
+  memcpy(sun->sun_path, addr, len);
+
+  return offsetof(struct sockaddr_un, sun_path) + len + 1;
+}
+
+/* ================================================== */
+
 static int
 bind_unix_address(int sock_fd, const char *addr, int flags)
 {
   union sockaddr_all saddr;
+  socklen_t saddr_len;
 
-  memset(&saddr, 0, sizeof (saddr));
-
-  if (snprintf(saddr.un.sun_path, sizeof (saddr.un.sun_path), "%s", addr) >=
-      sizeof (saddr.un.sun_path)) {
-    DEBUG_LOG("Unix socket path %s too long", addr);
+  saddr_len = set_unix_sockaddr(&saddr.un, addr);
+  if (saddr_len == 0)
     return 0;
-  }
-  saddr.un.sun_family = AF_UNIX;
 
   if (unlink(addr) < 0)
     DEBUG_LOG("Could not remove %s : %s", addr, strerror(errno));
 
   /* PRV_BindSocket() doesn't support Unix sockets yet */
-  if (bind(sock_fd, &saddr.sa, sizeof (saddr.un)) < 0) {
+  if (bind(sock_fd, &saddr.sa, saddr_len) < 0) {
     DEBUG_LOG("Could not bind Unix socket to %s : %s", addr, strerror(errno));
     return 0;
   }
@@ -538,17 +656,13 @@ static int
 connect_unix_address(int sock_fd, const char *addr)
 {
   union sockaddr_all saddr;
+  socklen_t saddr_len;
 
-  memset(&saddr, 0, sizeof (saddr));
-
-  if (snprintf(saddr.un.sun_path, sizeof (saddr.un.sun_path), "%s", addr) >=
-      sizeof (saddr.un.sun_path)) {
-    DEBUG_LOG("Unix socket path %s too long", addr);
+  saddr_len = set_unix_sockaddr(&saddr.un, addr);
+  if (saddr_len == 0)
     return 0;
-  }
-  saddr.un.sun_family = AF_UNIX;
 
-  if (connect(sock_fd, &saddr.sa, sizeof (saddr.un)) < 0) {
+  if (connect(sock_fd, &saddr.sa, saddr_len) < 0) {
     DEBUG_LOG("Could not connect Unix socket to %s : %s", addr, strerror(errno));
     return 0;
   }
@@ -763,8 +877,10 @@ static int
 process_header(struct msghdr *msg, int msg_length, int sock_fd, int flags,
                SCK_Message *message)
 {
+  int r = 1, path_len, max_path_len;
   struct cmsghdr *cmsg;
-  int r = 1;
+
+  init_message_addresses(message, SCK_ADDR_UNSPEC);
 
   if (msg->msg_namelen <= sizeof (union sockaddr_all) &&
       msg->msg_namelen > sizeof (((struct sockaddr *)msg->msg_name)->sa_family)) {
@@ -777,18 +893,23 @@ process_header(struct msghdr *msg, int msg_length, int sock_fd, int flags,
         SCK_SockaddrToIPSockAddr(msg->msg_name, msg->msg_namelen, &message->remote_addr.ip);
         break;
       case AF_UNIX:
+        /* Make sure the path is terminated by '\0' */
+        max_path_len = sizeof (((struct sockaddr_un *)msg->msg_name)->sun_path);
+        path_len = strnlen(((struct sockaddr_un *)msg->msg_name)->sun_path, max_path_len);
+        if (path_len >= max_path_len) {
+          DEBUG_LOG("Unterminated path");
+          r = 0;
+          break;
+        }
         init_message_addresses(message, SCK_ADDR_UNIX);
         message->remote_addr.path = ((struct sockaddr_un *)msg->msg_name)->sun_path;
         break;
       default:
-        init_message_addresses(message, SCK_ADDR_UNSPEC);
         DEBUG_LOG("Unexpected address");
         r = 0;
         break;
     }
   } else {
-    init_message_addresses(message, SCK_ADDR_UNSPEC);
-
     if (msg->msg_namelen > sizeof (union sockaddr_all)) {
       DEBUG_LOG("Truncated source address");
       r = 0;
@@ -869,6 +990,11 @@ process_header(struct msghdr *msg, int msg_length, int sock_fd, int flags,
       memcpy(&message->timestamp.kernel, CMSG_DATA(cmsg), sizeof (message->timestamp.kernel));
     }
 #endif
+#ifdef SCM_REALTIME
+    else if (match_cmsg(cmsg, SOL_SOCKET, SCM_REALTIME, sizeof (message->timestamp.kernel))) {
+      memcpy(&message->timestamp.kernel, CMSG_DATA(cmsg), sizeof (message->timestamp.kernel));
+    }
+#endif
 #ifdef HAVE_LINUX_TIMESTAMPING
 #ifdef HAVE_LINUX_TIMESTAMPING_OPT_PKTINFO
     else if (match_cmsg(cmsg, SOL_SOCKET, SCM_TIMESTAMPING_PKTINFO,
@@ -955,9 +1081,8 @@ receive_messages(int sock_fd, int flags, int max_messages, int *num_messages)
   n = ARR_GetSize(recv_headers);
   n = MIN(n, max_messages);
 
-  if (n < 1 || n > MAX_RECV_MESSAGES ||
-      n > ARR_GetSize(recv_messages) || n > ARR_GetSize(recv_sck_messages))
-    assert(0);
+  BRIEF_ASSERT(n >= 1 && n <= MAX_RECV_MESSAGES &&
+               n <= ARR_GetSize(recv_messages) && n <= ARR_GetSize(recv_sck_messages));
 
   recv_flags = get_recv_flags(flags);
 
@@ -1047,14 +1172,9 @@ send_message(int sock_fd, SCK_Message *message, int flags)
                                            (struct sockaddr *)&saddr, sizeof (saddr));
       break;
     case SCK_ADDR_UNIX:
-      memset(&saddr, 0, sizeof (saddr));
-      if (snprintf(saddr.un.sun_path, sizeof (saddr.un.sun_path), "%s",
-                   message->remote_addr.path) >= sizeof (saddr.un.sun_path)) {
-        DEBUG_LOG("Unix socket path %s too long", message->remote_addr.path);
+      saddr_len = set_unix_sockaddr(&saddr.un, message->remote_addr.path);
+      if (saddr_len == 0)
         return 0;
-      }
-      saddr.un.sun_family = AF_UNIX;
-      saddr_len = sizeof (saddr.un);
       break;
     default:
       assert(0);
@@ -1165,9 +1285,44 @@ send_message(int sock_fd, SCK_Message *message, int flags)
 
 /* ================================================== */
 
+void
+SCK_PreInitialise(void)
+{
+#ifdef LINUX
+  char *s, *ptr;
+
+  /* On Linux systems, the systemd service manager may pass file descriptors
+     for pre-initialised sockets to the chronyd daemon.  The service manager
+     allocates and binds the file descriptors, and passes a copy to each
+     spawned instance of the service.  This allows for zero-downtime service
+     restarts as the sockets buffer client requests until the service is able
+     to handle them.  The service manager sets the LISTEN_FDS environment
+     variable to the number of passed file descriptors, and the integer file
+     descriptors start at 3 (see SD_LISTEN_FDS_START in
+     https://www.freedesktop.org/software/systemd/man/latest/sd_listen_fds.html). */
+  first_reusable_fd = 3;
+  reusable_fds = 0;
+
+  s = getenv("LISTEN_FDS");
+  if (s) {
+    errno = 0;
+    reusable_fds = strtol(s, &ptr, 10);
+    if (errno != 0 || *ptr != '\0' || reusable_fds < 0)
+      reusable_fds = 0;
+  }
+#else
+  first_reusable_fd = 0;
+  reusable_fds = 0;
+#endif
+}
+
+/* ================================================== */
+
 void
 SCK_Initialise(int family)
 {
+  int fd;
+
   ip4_enabled = family == IPADDR_INET4 || family == IPADDR_UNSPEC;
 #ifdef FEAT_IPV6
   ip6_enabled = family == IPADDR_INET6 || family == IPADDR_UNSPEC;
@@ -1196,6 +1351,9 @@ SCK_Initialise(int family)
     supported_socket_flags |= SOCK_NONBLOCK;
 #endif
 
+  for (fd = first_reusable_fd; fd < first_reusable_fd + reusable_fds; fd++)
+    UTI_FdSetCloexec(fd);
+
   initialised = 1;
 }
 
@@ -1208,6 +1366,8 @@ SCK_Finalise(void)
   ARR_DestroyInstance(recv_headers);
   ARR_DestroyInstance(recv_messages);
 
+  SCK_CloseReusableSockets();
+
   initialised = 0;
 }
 
@@ -1348,6 +1508,27 @@ SCK_OpenUnixSocketPair(int flags, int *other_fd)
 
 /* ================================================== */
 
+int
+SCK_IsReusable(int fd)
+{
+  return fd >= first_reusable_fd && fd < first_reusable_fd + reusable_fds;
+}
+
+/* ================================================== */
+
+void
+SCK_CloseReusableSockets(void)
+{
+  int fd;
+
+  for (fd = first_reusable_fd; fd < first_reusable_fd + reusable_fds; fd++)
+    close(fd);
+  reusable_fds = 0;
+  first_reusable_fd = 0;
+}
+
+/* ================================================== */
+
 int
 SCK_SetIntOption(int sock_fd, int level, int name, int value)
 {
@@ -1386,8 +1567,15 @@ SCK_EnableKernelRxTimestamping(int sock_fd)
     return 1;
 #endif
 #ifdef SO_TIMESTAMP
-  if (SCK_SetIntOption(sock_fd, SOL_SOCKET, SO_TIMESTAMP, 1))
+  if (SCK_SetIntOption(sock_fd, SOL_SOCKET, SO_TIMESTAMP, 1)) {
+#if defined(SO_TS_CLOCK) && defined(SO_TS_REALTIME)
+    /* We don't care about the return value - we'll get either a
+       SCM_REALTIME (if we succeded) or a SCM_TIMESTAMP (if we failed) */
+    if (!SCK_SetIntOption(sock_fd, SOL_SOCKET, SO_TS_CLOCK, SO_TS_REALTIME))
+      ;
+#endif
     return 1;
+  }
 #endif
 
   return 0;
@@ -1398,7 +1586,7 @@ SCK_EnableKernelRxTimestamping(int sock_fd)
 int
 SCK_ListenOnSocket(int sock_fd, int backlog)
 {
-  if (listen(sock_fd, backlog) < 0) {
+  if (!SCK_IsReusable(sock_fd) && listen(sock_fd, backlog) < 0) {
     DEBUG_LOG("listen() failed : %s", strerror(errno));
     return 0;
   }
@@ -1561,6 +1749,10 @@ SCK_RemoveSocket(int sock_fd)
 void
 SCK_CloseSocket(int sock_fd)
 {
+  /* Reusable sockets are closed in finalisation */
+  if (SCK_IsReusable(sock_fd))
+    return;
+
   close(sock_fd);
 }
 

socket.h

@@ -73,6 +73,9 @@ typedef struct {
   int descriptor;
 } SCK_Message;
 
+/* Pre-initialisation function */
+extern void SCK_PreInitialise(void);
+
 /* Initialisation function (the specified IP family is enabled,
    or all if IPADDR_UNSPEC) */
 extern void SCK_Initialise(int family);
@@ -106,6 +109,12 @@ extern int SCK_OpenUnixStreamSocket(const char *remote_addr, const char *local_a
                                     int flags);
 extern int SCK_OpenUnixSocketPair(int flags, int *other_fd);
 
+/* Check if a file descriptor was passed from the service manager */
+extern int SCK_IsReusable(int sock_fd);
+
+/* Close all reusable sockets before finalisation (e.g. in a helper process) */
+extern void SCK_CloseReusableSockets(void);
+
 /* Set and get a socket option of int size */
 extern int SCK_SetIntOption(int sock_fd, int level, int name, int value);
 extern int SCK_GetIntOption(int sock_fd, int level, int name, int *value);

sources.c

@@ -3,7 +3,7 @@
 
  **********************************************************************
  * Copyright (C) Richard P. Curnow  1997-2003
- * Copyright (C) Miroslav Lichvar  2011-2016, 2018, 2020-2021
+ * Copyright (C) Miroslav Lichvar  2011-2016, 2018, 2020-2025
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -66,10 +66,10 @@ struct SelectInfo {
 /* This enum contains the flag values that are used to label
    each source */
 typedef enum {
-  SRC_OK,               /* OK so far, not a final status! */
+  SRC_OK = 0,           /* OK so far, not a final status! */
   SRC_UNSELECTABLE,     /* Has noselect option set */
-  SRC_UNSYNCHRONISED,   /* Provides samples but not unsynchronised */
   SRC_BAD_STATS,        /* Doesn't have valid stats data */
+  SRC_UNSYNCHRONISED,   /* Provides samples, but not synchronised */
   SRC_BAD_DISTANCE,     /* Has root distance longer than allowed maximum */
   SRC_JITTERY,          /* Had std dev larger than allowed maximum */
   SRC_WAITS_STATS,      /* Others have bad stats, selection postponed */
@@ -112,6 +112,9 @@ struct SRC_Instance_Record {
   /* Updates left before allowing combining */
   int distant;
 
+  /* Updates with a status requiring source replacement */
+  int bad;
+
   /* Flag indicating the status of the source */
   SRC_Status status;
 
@@ -141,9 +144,9 @@ struct SRC_Instance_Record {
   /* Flag indicating the source has a leap second vote */
   int leap_vote;
 
-  /* Flag indicating the source was already reported as
-     a falseticker since the last selection change */
-  int reported_falseticker;
+  /* Flags indicating which status was already reported for
+     the source since the last change of the system peer */
+  char reported_status[SRC_SELECTED + 1];
 };
 
 /* ================================================== */
@@ -171,6 +174,11 @@ static int selected_source_index; /* Which source index is currently
                                      if no current valid reference) */
 static int reported_no_majority;  /* Flag to avoid repeated log message
                                      about no majority */
+static int report_selection_loss; /* Flag to force logging a message if
+                                     selection is lost in a transient state
+                                     (SRC_WAITS_STATS, SRC_WAITS_UPDATE) */
+static int forced_first_report;   /* Flag to allow one failed selection to be
+                                     logged before a successful selection */
 
 /* Score needed to replace the currently selected source */
 #define SCORE_LIMIT 10.0
@@ -178,12 +186,17 @@ static int reported_no_majority;  /* Flag to avoid repeated log message
 /* Number of updates needed to reset the distant status */
 #define DISTANT_PENALTY 32
 
+/* Number of updates needed to trigger handling of bad sources */
+#define BAD_HANDLE_THRESHOLD 4
+
 static double max_distance;
 static double max_jitter;
 static double reselect_distance;
 static double stratum_weight;
 static double combine_limit;
 
+static SRC_Instance last_updated_inst;
+
 static LOG_FileID logfileid;
 
 /* Identifier of the dump file */
@@ -193,6 +206,7 @@ static LOG_FileID logfileid;
 /* Forward prototype */
 
 static void update_sel_options(void);
+static void unselect_selected_source(LOG_Severity severity, const char *format, ...);
 static void slew_sources(struct timespec *raw, struct timespec *cooked, double dfreq,
                          double doffset, LCL_ChangeType change_type, void *anything);
 static void add_dispersion(double dispersion, void *anything);
@@ -218,6 +232,8 @@ void SRC_Initialise(void) {
   LCL_AddParameterChangeHandler(slew_sources, NULL);
   LCL_AddDispersionNotifyHandler(add_dispersion, NULL);
 
+  last_updated_inst = NULL;
+
   logfileid = CNF_GetLogSelection() ? LOG_FileOpen("selection",
               "   Date (UTC) Time     IP Address   S EOpts Reach Score Last sample  Low end   High end")
               : -1;
@@ -301,10 +317,12 @@ void SRC_DestroyInstance(SRC_Instance instance)
 {
   int dead_index, i;
 
+  if (last_updated_inst == instance)
+    last_updated_inst = NULL;
+
   assert(initialised);
-  if (instance->index < 0 || instance->index >= n_sources ||
-      instance != sources[instance->index])
-    assert(0);
+  BRIEF_ASSERT(instance->index >= 0 && instance->index < n_sources &&
+               instance == sources[instance->index]);
 
   SST_DeleteInstance(instance->stats);
   dead_index = instance->index;
@@ -317,11 +335,12 @@ void SRC_DestroyInstance(SRC_Instance instance)
 
   update_sel_options();
 
-  /* If this was the previous reference source, we have to reselect! */
-  if (selected_source_index == dead_index)
-    SRC_ReselectSource();
-  else if (selected_source_index > dead_index)
+  if (selected_source_index > dead_index)
     --selected_source_index;
+  else if (selected_source_index == dead_index)
+    unselect_selected_source(LOGS_INFO, NULL);
+
+  SRC_SelectSource(NULL);
 }
 
 /* ================================================== */
@@ -333,16 +352,20 @@ SRC_ResetInstance(SRC_Instance instance)
   instance->reachability = 0;
   instance->reachability_size = 0;
   instance->distant = 0;
+  instance->bad = 0;
   instance->status = SRC_BAD_STATS;
   instance->sel_score = 1.0;
   instance->stratum = 0;
   instance->leap = LEAP_Unsynchronised;
   instance->leap_vote = 0;
-  instance->reported_falseticker = 0;
 
+  memset(instance->reported_status, 0, sizeof (instance->reported_status));
   memset(&instance->sel_info, 0, sizeof (instance->sel_info));
 
   SST_ResetInstance(instance->stats);
+
+  if (selected_source_index == instance->index)
+    SRC_SelectSource(NULL);
 }
 
 /* ================================================== */
@@ -478,6 +501,19 @@ special_mode_end(void)
     return 1;
 }
 
+/* ================================================== */
+
+static void
+handle_bad_source(SRC_Instance inst)
+{
+  if (inst->type == SRC_NTP) {
+    DEBUG_LOG("Bad source status=%c", get_status_char(inst->status));
+    NSR_HandleBadSource(inst->ip_addr);
+  }
+}
+
+/* ================================================== */
+
 void
 SRC_UpdateReachability(SRC_Instance inst, int reachable)
 {
@@ -488,24 +524,18 @@ SRC_UpdateReachability(SRC_Instance inst, int reachable)
   if (inst->reachability_size < SOURCE_REACH_BITS)
       inst->reachability_size++;
 
-  if (!reachable && inst->index == selected_source_index) {
-    /* Try to select a better source */
-    SRC_SelectSource(NULL);
-  }
-
   /* Check if special reference update mode failed */
   if (REF_GetMode() != REF_ModeNormal && special_mode_end()) {
     REF_SetUnsynchronised();
   }
 
-  /* Try to replace NTP sources that are unreachable, falsetickers, or
-     have root distance or jitter larger than the allowed maximums */
-  if (inst->type == SRC_NTP &&
-      ((!inst->reachability && inst->reachability_size == SOURCE_REACH_BITS) ||
-       inst->status == SRC_BAD_DISTANCE || inst->status == SRC_JITTERY ||
-       inst->status == SRC_FALSETICKER)) {
-    NSR_HandleBadSource(inst->ip_addr);
-  }
+  /* Try to replace unreachable NTP sources */
+  if (inst->reachability == 0 && inst->reachability_size == SOURCE_REACH_BITS)
+    handle_bad_source(inst);
+
+  /* Source selection can change with unreachable sources */
+  if (inst->reachability == 0)
+    SRC_SelectSource(NULL);
 }
 
 /* ================================================== */
@@ -565,18 +595,17 @@ update_sel_options(void)
   for (i = 0; i < n_sources; i++) {
     options = sources[i]->conf_sel_options;
 
-    if (options & SRC_SELECT_NOSELECT)
-      continue;
-
-    switch (sources[i]->type) {
-      case SRC_NTP:
-        options |= sources[i]->authenticated ? auth_ntp_options : unauth_ntp_options;
-        break;
-      case SRC_REFCLOCK:
-        options |= refclk_options;
-        break;
-      default:
-        assert(0);
+    if (!(options & SRC_SELECT_NOSELECT)) {
+      switch (sources[i]->type) {
+        case SRC_NTP:
+          options |= sources[i]->authenticated ? auth_ntp_options : unauth_ntp_options;
+          break;
+        case SRC_REFCLOCK:
+          options |= refclk_options;
+          break;
+        default:
+          assert(0);
+      }
     }
 
     if (sources[i]->sel_options != options) {
@@ -589,20 +618,45 @@ update_sel_options(void)
 
 /* ================================================== */
 
+FORMAT_ATTRIBUTE_PRINTF(2, 3)
 static void
-log_selection_message(LOG_Severity severity, const char *format, const char *arg)
+log_selection_message(LOG_Severity severity, const char *format, ...)
 {
+  char buf[256];
+  va_list ap;
+
   if (REF_GetMode() != REF_ModeNormal)
     return;
-  LOG(severity, format, arg);
+
+  va_start(ap, format);
+  vsnprintf(buf, sizeof (buf), format, ap);
+  va_end(ap);
+
+  LOG(severity, "%s", buf);
 }
 
 /* ================================================== */
 
+FORMAT_ATTRIBUTE_PRINTF(3, 4)
 static void
-log_selection_source(LOG_Severity severity, const char *format, SRC_Instance inst)
+log_selection_source(LOG_Severity severity, SRC_Instance inst, const char *format, ...)
 {
-  char buf[320], *name, *ntp_name;
+  char buf[320], buf2[256], *name, *ntp_name, *s;
+  va_list ap;
+
+  if (REF_GetMode() != REF_ModeNormal)
+    return;
+
+  va_start(ap, format);
+  vsnprintf(buf2, sizeof (buf2), format, ap);
+  va_end(ap);
+
+  /* Replace ## with %s in the formatted string to be the source name */
+  s = strstr(buf2, "##");
+  if (!s || strchr(buf2, '%'))
+    return;
+  s[0] = '%';
+  s[1] = 's';
 
   name = source_to_string(inst);
   ntp_name = inst->type == SRC_NTP ? NSR_GetName(inst->ip_addr) : NULL;
@@ -612,7 +666,9 @@ log_selection_source(LOG_Severity severity, const char *format, SRC_Instance ins
   else
     snprintf(buf, sizeof (buf), "%s", name);
 
-  log_selection_message(severity, format, buf);
+  LOG(severity, buf2, buf);
+
+  inst->reported_status[inst->status] = 1;
 }
 
 /* ================================================== */
@@ -655,17 +711,29 @@ source_to_string(SRC_Instance inst)
 /* ================================================== */
 
 static void
-mark_source(SRC_Instance inst, SRC_Status status)
+set_source_status(SRC_Instance inst, SRC_Status status)
 {
   struct timespec now;
 
   inst->status = status;
 
-  DEBUG_LOG("%s status=%c options=%x reach=%o/%d updates=%d distant=%d leap=%d vote=%d lo=%f hi=%f",
+  /* Try to replace NTP sources that are falsetickers, or have a root
+     distance or jitter larger than the allowed maximums */
+  if (inst == last_updated_inst) {
+    if (inst->bad < INT_MAX &&
+        (status == SRC_FALSETICKER || status == SRC_BAD_DISTANCE || status == SRC_JITTERY))
+      inst->bad++;
+    else
+      inst->bad = 0;
+    if (inst->bad >= BAD_HANDLE_THRESHOLD)
+      handle_bad_source(inst);
+  }
+
+  DEBUG_LOG("%s status=%c options=%x reach=%o/%d updates=%d distant=%d bad=%d leap=%d vote=%d lo=%f hi=%f",
             source_to_string(inst), get_status_char(inst->status),
             (unsigned int)inst->sel_options, (unsigned int)inst->reachability,
             inst->reachability_size, inst->updates,
-            inst->distant, (int)inst->leap, inst->leap_vote,
+            inst->distant, inst->bad, (int)inst->leap, inst->leap_vote,
             inst->sel_info.lo_limit, inst->sel_info.hi_limit);
 
   if (logfileid == -1)
@@ -688,6 +756,43 @@ mark_source(SRC_Instance inst, SRC_Status status)
 
 /* ================================================== */
 
+static void
+mark_source(SRC_Instance inst, SRC_Status status)
+{
+  set_source_status(inst, status);
+
+  BRIEF_ASSERT(status >= SRC_OK && status < sizeof (inst->reported_status));
+
+  if (!inst->reported_status[status]) {
+    switch (status) {
+      case SRC_BAD_DISTANCE:
+        if (inst->bad < BAD_HANDLE_THRESHOLD)
+          break;
+        log_selection_source(LOGS_WARN, inst,
+                             "Root distance of ## exceeds maxdistance of %.3f seconds",
+                             max_distance);
+        break;
+      case SRC_JITTERY:
+        if (inst->bad < BAD_HANDLE_THRESHOLD)
+          break;
+        log_selection_source(LOGS_WARN, inst,
+                             "Jitter of ## exceeds maxjitter of %.3f seconds",
+                             max_jitter);
+        break;
+      case SRC_FALSETICKER:
+        log_selection_source(LOGS_WARN, inst, "Detected falseticker ##");
+        break;
+      case SRC_SELECTED:
+        log_selection_source(LOGS_INFO, inst, "Selected source ##");
+        break;
+      default:
+        break;
+    }
+  }
+}
+
+/* ================================================== */
+
 static void
 mark_ok_sources(SRC_Status status)
 {
@@ -696,7 +801,36 @@ mark_ok_sources(SRC_Status status)
   for (i = 0; i < n_sources; i++) {
     if (sources[i]->status != SRC_OK)
       continue;
-    mark_source(sources[i], status);
+    /* Don't log the status in this case (multiple sources at once) */
+    set_source_status(sources[i], status);
+  }
+}
+
+/* ================================================== */
+/* Reset the index of selected source and report the selection loss.  If no
+   message is provided, assume it is a transient state and wait for another
+   call providing a message or selection of another source, which resets the
+   report_selection_loss flag. */
+
+FORMAT_ATTRIBUTE_PRINTF(2, 3)
+static void
+unselect_selected_source(LOG_Severity severity, const char *format, ...)
+{
+  char buf[256];
+  va_list ap;
+
+  if (selected_source_index != INVALID_SOURCE) {
+    selected_source_index = INVALID_SOURCE;
+    report_selection_loss = 1;
+  }
+
+  if (report_selection_loss && format) {
+    va_start(ap, format);
+    vsnprintf(buf, sizeof (buf), format, ap);
+    va_end(ap);
+
+    log_selection_message(severity, "%s", buf);
+    report_selection_loss = 0;
   }
 }
 
@@ -800,7 +934,8 @@ SRC_SelectSource(SRC_Instance updated_inst)
   struct SelectInfo *si;
   struct timespec now, ref_time;
   int i, j, j1, j2, index, sel_prefer, n_endpoints, n_sel_sources, sel_req_source;
-  int n_badstats_sources, max_sel_reach, max_sel_reach_size, max_badstat_reach;
+  int max_badstat_reach, max_badstat_reach_size, n_badstats_sources;
+  int max_sel_reach, max_sel_reach_size, n_unreach_sources;
   int depth, best_depth, trust_depth, best_trust_depth, n_sel_trust_sources;
   int combined, stratum, min_stratum, max_score_index;
   int orphan_stratum, orphan_source;
@@ -811,15 +946,13 @@ SRC_SelectSource(SRC_Instance updated_inst)
   double first_sample_ago, max_reach_sample_ago;
   NTP_Leap leap_status;
 
-  if (updated_inst)
+  if (updated_inst) {
     updated_inst->updates++;
+    last_updated_inst = updated_inst;
+  }
 
   if (n_sources == 0) {
-    /* In this case, we clearly cannot synchronise to anything */
-    if (selected_source_index != INVALID_SOURCE) {
-      log_selection_message(LOGS_INFO, "Can't synchronise: no sources", NULL);
-      selected_source_index = INVALID_SOURCE;
-    }
+    unselect_selected_source(LOGS_WARN, "Can't synchronise: no sources");
     return;
   }
 
@@ -831,9 +964,10 @@ SRC_SelectSource(SRC_Instance updated_inst)
   n_endpoints = 0;
   n_sel_sources = n_sel_trust_sources = 0;
   n_badstats_sources = 0;
+  n_unreach_sources = 0;
   sel_req_source = 0;
   max_sel_reach = max_badstat_reach = 0;
-  max_sel_reach_size = 0;
+  max_sel_reach_size = max_badstat_reach_size = 0;
   max_reach_sample_ago = 0.0;
 
   for (i = 0; i < n_sources; i++) {
@@ -853,11 +987,9 @@ SRC_SelectSource(SRC_Instance updated_inst)
       continue;
     }
 
-    /* Ignore sources which are not synchronised */
-    if (sources[i]->leap == LEAP_Unsynchronised) {
-      mark_source(sources[i], SRC_UNSYNCHRONISED);
-      continue;
-    }
+    /* Count unreachable sources for a warning message */
+    if (sources[i]->reachability == 0)
+      n_unreach_sources++;
 
     si = &sources[i]->sel_info;
     SST_GetSelectionData(sources[i]->stats, &now,
@@ -870,6 +1002,14 @@ SRC_SelectSource(SRC_Instance updated_inst)
       mark_source(sources[i], SRC_BAD_STATS);
       if (max_badstat_reach < sources[i]->reachability)
         max_badstat_reach = sources[i]->reachability;
+      if (max_badstat_reach_size < sources[i]->reachability_size)
+        max_badstat_reach_size = sources[i]->reachability_size;
+      continue;
+    }
+
+    /* Ignore sources which are not synchronised */
+    if (sources[i]->leap == LEAP_Unsynchronised) {
+      mark_source(sources[i], SRC_UNSYNCHRONISED);
       continue;
     }
 
@@ -1004,15 +1144,22 @@ SRC_SelectSource(SRC_Instance updated_inst)
   if (n_badstats_sources && n_sel_sources && selected_source_index == INVALID_SOURCE &&
       max_sel_reach_size < SOURCE_REACH_BITS && max_sel_reach >> 1 == max_badstat_reach) {
     mark_ok_sources(SRC_WAITS_STATS);
+    unselect_selected_source(LOGS_INFO, NULL);
     return;
   }
 
+  /* Wait for a source to have full reachability register to allow one
+     failed selection to be logged before first successful selection */
+  if (!forced_first_report &&
+      MAX(max_sel_reach_size, max_badstat_reach_size) == SOURCE_REACH_BITS) {
+    report_selection_loss = 1;
+    forced_first_report = 1;
+  }
+
   if (n_endpoints == 0) {
     /* No sources provided valid endpoints */
-    if (selected_source_index != INVALID_SOURCE) {
-      log_selection_message(LOGS_INFO, "Can't synchronise: no selectable sources", NULL);
-      selected_source_index = INVALID_SOURCE;
-    }
+    unselect_selected_source(LOGS_WARN, "Can't synchronise: no selectable sources"
+                                        " (%d unreachable sources)", n_unreach_sources);
     return;
   }
 
@@ -1086,13 +1233,25 @@ SRC_SelectSource(SRC_Instance updated_inst)
   assert(depth == 0 && trust_depth == 0);
   assert(2 * n_sel_sources == n_endpoints);
 
-  if ((best_trust_depth == 0 && best_depth <= n_sel_sources / 2) ||
-      (best_trust_depth > 0 && best_trust_depth <= n_sel_trust_sources / 2)) {
+  if (best_trust_depth > 0) {
+    best_depth = best_trust_depth;
+    n_sel_sources = n_sel_trust_sources;
+  }
+
+  if (best_depth <= n_sel_sources / 2) {
     /* Could not even get half the reachable (trusted) sources to agree */
 
     if (!reported_no_majority) {
-      log_selection_message(LOGS_WARN, "Can't synchronise: no majority", NULL);
+      if (best_depth < 2)
+        log_selection_message(LOGS_WARN, "%s (no agreement among %d %ssources)",
+                              "Can't synchronise: no majority", n_sel_sources,
+                              best_trust_depth > 0 ? "trusted " : "");
+      else
+        log_selection_message(LOGS_WARN, "%s (only %d of %d %ssources agree)",
+                              "Can't synchronise: no majority", best_depth,
+                              n_sel_sources, best_trust_depth > 0 ? "trusted " : "");
       reported_no_majority = 1;
+      report_selection_loss = 0;
     }
 
     if (selected_source_index != INVALID_SOURCE) {
@@ -1141,20 +1300,13 @@ SRC_SelectSource(SRC_Instance updated_inst)
         sel_req_source = 0;
     } else {
       mark_source(sources[i], SRC_FALSETICKER);
-      if (!sources[i]->reported_falseticker) {
-        log_selection_source(LOGS_WARN, "Detected falseticker %s", sources[i]);
-        sources[i]->reported_falseticker = 1;
-      }
     }
   }
 
   if (!n_sel_sources || sel_req_source || n_sel_sources < CNF_GetMinSources()) {
-    if (selected_source_index != INVALID_SOURCE) {
-      log_selection_message(LOGS_INFO, "Can't synchronise: %s selectable sources",
-                            !n_sel_sources ? "no" :
-                            sel_req_source ? "no required source in" : "not enough");
-      selected_source_index = INVALID_SOURCE;
-    }
+    unselect_selected_source(LOGS_WARN, "Can't synchronise: %s selectable sources",
+                             !n_sel_sources ? "no" :
+                             sel_req_source ? "no required source in" : "not enough");
     mark_ok_sources(SRC_WAITS_SOURCES);
     return;
   }
@@ -1261,22 +1413,23 @@ SRC_SelectSource(SRC_Instance updated_inst)
     /* Before selecting the new synchronisation source wait until the reference
        can be updated */
     if (sources[max_score_index]->updates == 0) {
-      selected_source_index = INVALID_SOURCE;
+      unselect_selected_source(LOGS_INFO, NULL);
       mark_ok_sources(SRC_WAITS_UPDATE);
       return;
     }
 
     selected_source_index = max_score_index;
-    log_selection_source(LOGS_INFO, "Selected source %s", sources[selected_source_index]);
 
     /* New source has been selected, reset all scores */
     for (i = 0; i < n_sources; i++) {
       sources[i]->sel_score = 1.0;
       sources[i]->distant = 0;
-      sources[i]->reported_falseticker = 0;
+      memset(sources[i]->reported_status, 0, sizeof (sources[i]->reported_status));
     }
 
     reported_no_majority = 0;
+    report_selection_loss = 0;
+    forced_first_report = 1;
   }
 
   mark_source(sources[selected_source_index], SRC_SELECTED);
@@ -1739,10 +1892,10 @@ get_status_char(SRC_Status status)
   switch (status) {
     case SRC_UNSELECTABLE:
       return 'N';
-    case SRC_UNSYNCHRONISED:
-      return 's';
     case SRC_BAD_STATS:
       return 'M';
+    case SRC_UNSYNCHRONISED:
+      return 's';
     case SRC_BAD_DISTANCE:
       return 'd';
     case SRC_JITTERY:

sourcestats.c

@@ -549,9 +549,9 @@ SST_DoNewRegression(SST_Stats inst)
         sd_weight += (peer_distances[i] - min_distance) / sd;
       weights[i] = SQUARE(sd_weight);
     }
-  }
 
-  correct_asymmetry(inst, times_back, offsets);
+    correct_asymmetry(inst, times_back, offsets);
+  }
 
   inst->regression_ok = RGR_FindBestRegression(times_back + inst->runs_samples,
                                          offsets + inst->runs_samples, weights,

stubs.c

@@ -49,66 +49,6 @@
 #include "sched.h"
 #include "util.h"
 
-#if defined(FEAT_NTP) && !defined(FEAT_ASYNCDNS)
-
-/* This is a blocking implementation used when asynchronous resolving is not available */
-
-struct DNS_Async_Instance {
-  const char *name;
-  DNS_NameResolveHandler handler;
-  void *arg;
-  int pipe[2];
-};
-
-static void
-resolve_name(int fd, int event, void *anything)
-{
-  struct DNS_Async_Instance *inst;
-  IPAddr addrs[DNS_MAX_ADDRESSES];
-  DNS_Status status;
-  int i;
-
-  inst = (struct DNS_Async_Instance *)anything;
-
-  SCH_RemoveFileHandler(inst->pipe[0]);
-  close(inst->pipe[0]);
-  close(inst->pipe[1]);
-
-  status = PRV_Name2IPAddress(inst->name, addrs, DNS_MAX_ADDRESSES);
-
-  for (i = 0; status == DNS_Success && i < DNS_MAX_ADDRESSES &&
-       addrs[i].family != IPADDR_UNSPEC; i++)
-    ;
-
-  (inst->handler)(status, i, addrs, inst->arg);
-
-  Free(inst);
-}
-
-void
-DNS_Name2IPAddressAsync(const char *name, DNS_NameResolveHandler handler, void *anything)
-{
-  struct DNS_Async_Instance *inst;
-
-  inst = MallocNew(struct DNS_Async_Instance);
-  inst->name = name;
-  inst->handler = handler;
-  inst->arg = anything;
-
-  if (pipe(inst->pipe))
-    LOG_FATAL("pipe() failed");
-
-  UTI_FdSetCloexec(inst->pipe[0]);
-  UTI_FdSetCloexec(inst->pipe[1]);
-
-  SCH_AddFileHandler(inst->pipe[0], SCH_FILE_INPUT, resolve_name, inst);
-
-  if (write(inst->pipe[1], "", 1) < 0)
-    ;
-}
-
-#endif /* !FEAT_ASYNCDNS */
-
 #ifndef FEAT_CMDMON
 
 void
@@ -144,247 +84,6 @@ MNL_Finalise(void)
 
 #endif /* !FEAT_CMDMON */
 
-#ifndef FEAT_NTP
-
-void
-NCR_AddBroadcastDestination(NTP_Remote_Address *addr, int interval)
-{
-}
-
-void
-NCR_Initialise(void)
-{
-}
-
-void
-NCR_Finalise(void)
-{
-}
-
-int
-NCR_AddAccessRestriction(IPAddr *ip_addr, int subnet_bits, int allow, int all)
-{
-  return 1;
-}
-
-int
-NCR_CheckAccessRestriction(IPAddr *ip_addr)
-{
-  return 0;
-}
-
-void
-NIO_Initialise(void)
-{
-}
-
-void
-NIO_Finalise(void)
-{
-}
-
-void
-NSR_Initialise(void)
-{
-}
-
-void
-NSR_Finalise(void)
-{
-}
-
-NSR_Status
-NSR_AddSource(NTP_Remote_Address *remote_addr, NTP_Source_Type type,
-              SourceParameters *params, uint32_t *conf_id)
-{
-  return NSR_TooManySources;
-}
-
-NSR_Status
-NSR_AddSourceByName(char *name, int port, int pool, NTP_Source_Type type,
-                    SourceParameters *params, uint32_t *conf_id)
-{
-  return NSR_TooManySources;
-}
-
-NSR_Status
-NSR_RemoveSource(IPAddr *address)
-{
-  return NSR_NoSuchSource;
-}
-
-void
-NSR_RemoveSourcesById(uint32_t conf_id)
-{
-}
-
-void
-NSR_RemoveAllSources(void)
-{
-}
-
-void
-NSR_HandleBadSource(IPAddr *address)
-{
-}
-
-void
-NSR_RefreshAddresses(void)
-{
-}
-
-char *
-NSR_GetName(IPAddr *address)
-{
-  return NULL;
-}
-
-void
-NSR_SetSourceResolvingEndHandler(NSR_SourceResolvingEndHandler handler)
-{
-  if (handler)
-    (handler)();
-}
-
-void
-NSR_ResolveSources(void)
-{
-}
-
-void NSR_StartSources(void)
-{
-}
-
-void NSR_AutoStartSources(void)
-{
-}
-
-int
-NSR_InitiateSampleBurst(int n_good_samples, int n_total_samples,
-                        IPAddr *mask, IPAddr *address)
-{
-  return 0;
-}
-
-uint32_t
-NSR_GetLocalRefid(IPAddr *address)
-{
-  return 0;
-}
-
-int
-NSR_SetConnectivity(IPAddr *mask, IPAddr *address, SRC_Connectivity connectivity)
-{
-  return 0;
-}
-
-int
-NSR_ModifyMinpoll(IPAddr *address, int new_minpoll)
-{
-  return 0;
-}
-
-int
-NSR_ModifyMaxpoll(IPAddr *address, int new_maxpoll)
-{
-  return 0;
-}
-
-int
-NSR_ModifyMaxdelay(IPAddr *address, double new_max_delay)
-{
-  return 0;
-}
-
-int
-NSR_ModifyMaxdelayratio(IPAddr *address, double new_max_delay_ratio)
-{
-  return 0;
-}
-
-int
-NSR_ModifyMaxdelaydevratio(IPAddr *address, double new_max_delay_dev_ratio)
-{
-  return 0;
-}
-
-int
-NSR_ModifyMinstratum(IPAddr *address, int new_min_stratum)
-{
-  return 0;
-}
-
-int
-NSR_ModifyPolltarget(IPAddr *address, int new_poll_target)
-{
-  return 0;
-}
-
-void
-NSR_ReportSource(RPT_SourceReport *report, struct timespec *now)
-{
-  memset(report, 0, sizeof (*report));
-}
-  
-int
-NSR_GetAuthReport(IPAddr *address, RPT_AuthReport *report)
-{
-  return 0;
-}
-
-int
-NSR_GetNTPReport(RPT_NTPReport *report)
-{
-  return 0;
-}
-
-void
-NSR_GetActivityReport(RPT_ActivityReport *report)
-{
-  memset(report, 0, sizeof (*report));
-}
-
-void
-NSR_DumpAuthData(void)
-{
-}
-
-#ifndef FEAT_CMDMON
-
-void
-CLG_Initialise(void)
-{
-}
-
-void
-CLG_Finalise(void)
-{
-}
-
-void
-DNS_SetAddressFamily(int family)
-{
-}
-
-DNS_Status
-DNS_Name2IPAddress(const char *name, IPAddr *ip_addrs, int max_addrs)
-{
-  return DNS_Failure;
-}
-
-void
-KEY_Initialise(void)
-{
-}
-
-void
-KEY_Finalise(void)
-{
-}
-
-#endif /* !FEAT_CMDMON */
-#endif /* !FEAT_NTP */
-
 #ifndef FEAT_REFCLOCK
 void
 RCL_Initialise(void)
@@ -413,6 +112,12 @@ RCL_ReportSource(RPT_SourceReport *report, struct timespec *now)
   memset(report, 0, sizeof (*report));
 }
 
+int
+RCL_ModifyOffset(uint32_t ref_id, double offset)
+{
+  return 0;
+}
+
 #endif /* !FEAT_REFCLOCK */
 
 #ifndef FEAT_SIGND

sys_linux.c

@@ -5,6 +5,7 @@
  * Copyright (C) Richard P. Curnow  1997-2003
  * Copyright (C) John G. Hasler  2009
  * Copyright (C) Miroslav Lichvar  2009-2012, 2014-2018
+ * Copyright (C) Shachar Raindel  2025
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -38,6 +39,12 @@
 #include <poll.h>
 #endif
 
+#ifdef HAVE_LINUX_TIMESTAMPING
+#include <linux/sockios.h>
+#include <linux/ethtool.h>
+#include <net/if.h>
+#endif
+
 #ifdef FEAT_SCFILTER
 #include <sys/prctl.h>
 #include <seccomp.h>
@@ -48,9 +55,6 @@
 #ifdef FEAT_RTC
 #include <linux/rtc.h>
 #endif
-#ifdef HAVE_LINUX_TIMESTAMPING
-#include <linux/sockios.h>
-#endif
 #endif
 
 #ifdef FEAT_PRIVDROP
@@ -64,6 +68,7 @@
 #include "local.h"
 #include "logging.h"
 #include "privops.h"
+#include "socket.h"
 #include "util.h"
 
 /* Frequency scale to convert from ppm to the timex freq */
@@ -498,6 +503,9 @@ SYS_Linux_EnableSystemCallFilter(int level, SYS_ProcessContext context)
     SCMP_SYS(getrlimit),
     SCMP_SYS(getuid),
     SCMP_SYS(getuid32),
+#ifdef __NR_membarrier
+    SCMP_SYS(membarrier),
+#endif
 #ifdef __NR_rseq
     SCMP_SYS(rseq),
 #endif
@@ -600,6 +608,7 @@ SYS_Linux_EnableSystemCallFilter(int level, SYS_ProcessContext context)
     SCMP_SYS(select),
     SCMP_SYS(set_robust_list),
     SCMP_SYS(write),
+    SCMP_SYS(writev),
 
     /* Miscellaneous */
     SCMP_SYS(getrandom),
@@ -654,7 +663,7 @@ SYS_Linux_EnableSystemCallFilter(int level, SYS_ProcessContext context)
   const static int fcntls[] = { F_GETFD, F_SETFD, F_GETFL, F_SETFL };
 
   const static unsigned long ioctls[] = {
-    FIONREAD, TCGETS,
+    FIONREAD, TCGETS, TIOCGWINSZ,
 #if defined(FEAT_PHC) || defined(HAVE_LINUX_TIMESTAMPING)
     PTP_EXTTS_REQUEST, PTP_SYS_OFFSET,
 #ifdef PTP_PIN_SETFUNC
@@ -898,33 +907,100 @@ get_precise_phc_readings(int phc_fd, int max_samples, struct timespec ts[][3])
 
 /* ================================================== */
 
-int
-SYS_Linux_OpenPHC(const char *path, int phc_index)
+/* Make sure an FD is a PHC.  Return the FD if it is, or close the FD
+   and return -1 if it is not. */
+
+static int
+verify_fd_is_phc(int phc_fd)
 {
   struct ptp_clock_caps caps;
-  char phc_path[64];
-  int phc_fd;
 
-  if (!path) {
-    if (snprintf(phc_path, sizeof (phc_path), "/dev/ptp%d", phc_index) >= sizeof (phc_path))
-      return -1;
-    path = phc_path;
-  }
-
-  phc_fd = open(path, O_RDONLY);
-  if (phc_fd < 0) {
-    LOG(LOGS_ERR, "Could not open %s : %s", path, strerror(errno));
-    return -1;
-  }
-
-  /* Make sure it is a PHC */
   if (ioctl(phc_fd, PTP_CLOCK_GETCAPS, &caps)) {
     LOG(LOGS_ERR, "ioctl(%s) failed : %s", "PTP_CLOCK_GETCAPS", strerror(errno));
     close(phc_fd);
     return -1;
   }
 
-  UTI_FdSetCloexec(phc_fd);
+  return phc_fd;
+}
+
+/* ================================================== */
+
+static int
+open_phc_by_iface_name(const char *iface)
+{
+#ifdef HAVE_LINUX_TIMESTAMPING
+  struct ethtool_ts_info ts_info;
+  char phc_device[PATH_MAX];
+  struct ifreq req;
+  int sock_fd;
+
+  sock_fd = SCK_OpenUdpSocket(NULL, NULL, NULL, 0);
+  if (sock_fd < 0)
+    return -1;
+
+  memset(&req, 0, sizeof (req));
+  memset(&ts_info, 0, sizeof (ts_info));
+
+  if (snprintf(req.ifr_name, sizeof (req.ifr_name), "%s", iface) >=
+      sizeof (req.ifr_name)) {
+    SCK_CloseSocket(sock_fd);
+    return -1;
+  }
+
+  ts_info.cmd = ETHTOOL_GET_TS_INFO;
+  req.ifr_data = (char *)&ts_info;
+
+  if (ioctl(sock_fd, SIOCETHTOOL, &req)) {
+    DEBUG_LOG("ioctl(%s) failed : %s", "SIOCETHTOOL", strerror(errno));
+    SCK_CloseSocket(sock_fd);
+    return -1;
+  }
+
+  /* Simplify failure paths by closing the socket as early as possible */
+  SCK_CloseSocket(sock_fd);
+  sock_fd = -1;
+
+  if (ts_info.phc_index < 0) {
+    DEBUG_LOG("PHC missing on %s", req.ifr_name);
+    return -1;
+  }
+
+  if (snprintf(phc_device, sizeof (phc_device),
+               "/dev/ptp%d", ts_info.phc_index) >= sizeof (phc_device))
+    return -1;
+
+  return open(phc_device, O_RDONLY);
+#else
+  return -1;
+#endif
+}
+
+/* ================================================== */
+
+int
+SYS_Linux_OpenPHC(const char *device)
+{
+  int phc_fd = -1;
+
+  if (device[0] == '/') {
+    phc_fd = open(device, O_RDONLY);
+    if (phc_fd >= 0)
+      phc_fd = verify_fd_is_phc(phc_fd);
+  }
+
+  if (phc_fd < 0) {
+    phc_fd = open_phc_by_iface_name(device);
+    if (phc_fd < 0) {
+      LOG(LOGS_ERR, "Could not open PHC of iface %s : %s",
+          device, strerror(errno));
+      return -1;
+    }
+    phc_fd = verify_fd_is_phc(phc_fd);
+  }
+
+  if (phc_fd >= 0)
+    UTI_FdSetCloexec(phc_fd);
 
   return phc_fd;
 }
@@ -986,6 +1062,14 @@ SYS_Linux_SetPHCExtTimestamping(int fd, int pin, int channel,
     return 0;
   }
 
+#if defined(PTP_MASK_CLEAR_ALL) && defined(PTP_MASK_EN_SINGLE)
+  /* Disable events from other channels on this descriptor */
+  if (ioctl(fd, PTP_MASK_CLEAR_ALL))
+    DEBUG_LOG("ioctl(%s) failed : %s", "PTP_MASK_CLEAR_ALL", strerror(errno));
+  else if (ioctl(fd, PTP_MASK_EN_SINGLE, &channel))
+    DEBUG_LOG("ioctl(%s) failed : %s", "PTP_MASK_EN_SINGLE", strerror(errno));
+#endif
+
   return 1;
 }
 

sys_linux.h

@@ -39,7 +39,7 @@ extern void SYS_Linux_EnableSystemCallFilter(int level, SYS_ProcessContext conte
 
 extern int SYS_Linux_CheckKernelVersion(int req_major, int req_minor);
 
-extern int SYS_Linux_OpenPHC(const char *path, int phc_index);
+extern int SYS_Linux_OpenPHC(const char *device);
 
 extern int SYS_Linux_GetPHCReadings(int fd, int nocrossts, int *reading_mode, int max_readings,
                                     struct timespec tss[][3]);

sys_timex.c

@@ -3,7 +3,7 @@
 
  **********************************************************************
  * Copyright (C) Richard P. Curnow  1997-2003
- * Copyright (C) Miroslav Lichvar  2009-2012, 2014-2015, 2017
+ * Copyright (C) Miroslav Lichvar  2009-2012, 2014-2015, 2017, 2025
  * 
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -257,6 +257,8 @@ SYS_Timex_Finalise(void)
 int
 SYS_Timex_Adjust(struct timex *txc, int ignore_error)
 {
+  static long last_constant, last_freq;
+  static int last_status = -1;
   int state;
 
 #ifdef SOLARIS
@@ -270,7 +272,24 @@ SYS_Timex_Adjust(struct timex *txc, int ignore_error)
   if (state < 0) {
     LOG(ignore_error ? LOGS_DEBUG : LOGS_FATAL,
         NTP_ADJTIME_NAME"(0x%x) failed : %s", txc->modes, strerror(errno));
+    return state;
   }
 
+  /* This a good place to verify that nothing else is touching the clock,
+     without making an additional timex call.  A clock update is normally
+     expected to have four driver calls:
+     - set_sync_status - primarily updating leap status
+     - set_frequency - correcting frequency error
+     - set_frequency - correcting phase error
+     - set_sync_status - updating leap and estimated/maximum error */
+  if (last_status != -1 &&
+      (((last_status ^ txc->status) & STA_PLL && !(txc->modes & MOD_STATUS)) ||
+       (last_constant != txc->constant && !(txc->modes & MOD_TIMECONST)) ||
+       (last_freq != txc->freq && !(txc->modes & MOD_FREQUENCY))))
+    LOG(LOGS_WARN, "System clock interference detected (another NTP client?)");
+  last_status = txc->status;
+  last_constant = txc->constant;
+  last_freq = txc->freq;
+
   return state;
 }

tempcomp.c

@@ -66,10 +66,9 @@ get_tempcomp(double temp)
     return k0 + (temp - T0) * k1 + (temp - T0) * (temp - T0) * k2;
 
   /* Otherwise interpolate/extrapolate between two nearest points */
-
-  for (i = 1; i < ARR_GetSize(points); i++) {
-    p2 = (struct Point *)ARR_GetElement(points, i);
-    if (p2->temp >= temp)
+  for (i = 1; ; i++) {
+    p2 = ARR_GetElement(points, i);
+    if (p2->temp >= temp || i + 1 >= ARR_GetSize(points))
       break;
   }
   p1 = p2 - 1;

test/compilation/001-features

@@ -10,7 +10,6 @@ for opts in \
 	"--enable-debug" \
 	"--enable-ntp-signd" \
 	"--enable-scfilter" \
-	"--disable-asyncdns" \
 	"--disable-ipv6" \
 	"--disable-privdrop" \
 	"--disable-readline" \
@@ -18,19 +17,13 @@ for opts in \
 	"--disable-sechash" \
 	"--disable-cmdmon" \
 	"--disable-cmdmon --enable-scfilter" \
-	"--disable-ntp" \
-	"--disable-ntp --enable-scfilter" \
 	"--disable-nts" \
 	"--disable-refclock" \
 	"--disable-timestamping" \
-	"--disable-timestamping --disable-ntp" \
-	"--disable-cmdmon --disable-ntp" \
-	"--disable-cmdmon --disable-ntp --enable-scfilter" \
-	"--disable-cmdmon --disable-refclock" \
-	"--disable-cmdmon --disable-ntp --disable-refclock"
+	"--disable-cmdmon --disable-refclock"
 do
 	./configure $opts || exit 1
 	make clean
 	make "$@" || exit 1
-	make -C test/unit check || exit 1
+	make -C test/unit "$@" check || exit 1
 done

test/compilation/002-scanbuild

@@ -3,13 +3,14 @@
 cd ../..
 
 for opts in \
+	"--enable-debug" \
 	"--host-system=Linux" \
 	"--host-system=NetBSD" \
 	"--host-system=FreeBSD" \
 	"--without-nettle" \
-	"--without-nettle --without-nss" \
-	"--without-nettle --without-nss --without-tomcrypt" \
-	"--without-nettle --without-nss --without-tomcrypt --without-gnutls"
+	"--without-nettle --without-gnutls" \
+	"--without-nettle --without-gnutls --without-nss" \
+	"--without-nettle --without-gnutls --without-nss --without-tomcrypt"
 do
 	./configure $opts
 	scan-build make "$@" || exit 1

test/compilation/003-sanitizers

@@ -2,7 +2,7 @@
 # Run the unit and simulation tests with different compiler sanitizers
 # and under valgrind
 
-valgrind_opts="--leak-check=full --errors-for-leak-kinds=definite"
+valgrind_opts="--leak-check=full --errors-for-leak-kinds=definite --track-fds=yes"
 
 cd ../..
 
@@ -25,12 +25,14 @@ touch Makefile
 for extra_config_opts in \
   "--all-privops" \
   "--disable-ipv6" \
+  "--disable-cmdmon" \
+  "--disable-nts" \
   "--disable-scfilter" \
-  "--without-gnutls" \
+  "--without-aes-gcm-siv" \
   "--without-nettle" \
-  "--without-nettle --without-nss" \
-  "--without-nettle --without-nss --without-tomcrypt" \
-  "--without-nettle --without-nss --without-tomcrypt --without-gnutls"; \
+  "--without-nettle --without-gnutls" \
+  "--without-nettle --without-gnutls --without-nss" \
+  "--without-nettle --without-gnutls --without-nss --without-tomcrypt"; \
 do
   for arch_opts in "-m32" ""; do
     pushd test/simulation/clknetsim || exit 1

test/simulation/008-ntpera

@@ -41,7 +41,6 @@ for time_offset in -1e-1 1e-1; do
 		export CLKNETSIM_START_DATE=$(awk "BEGIN {printf \"%.0f\", $ntp_start + $start_offset}")
 		run_test || test_fail
 		check_chronyd_exit || test_fail
-		check_source_selection || test_fail
 		check_packet_interval || test_fail
 		check_sync && test_fail
 	done

test/simulation/009-sourceselection

@@ -24,6 +24,12 @@ for falsetickers in 3 4; do
 	# These check are expected to fail
 	check_source_selection && test_fail
 	check_sync && test_fail
+
+	if [ $falsetickers = 3 ]; then
+		check_log_messages "Can't synchronise: no majority (only 2 of 5 sources agree)" 1 1 || test_fail
+	else
+		check_log_messages "Can't synchronise: no majority (no agreement among 5 sources)" 1 1 || test_fail
+	fi
 done
 
 # Sources with large asymmetric delay should be excluded
@@ -37,4 +43,35 @@ check_chronyd_exit || test_fail
 check_source_selection || test_fail
 check_sync || test_fail
 
+# Sources with large distance should be ignored
+
+servers=1
+server_strata=2
+server_conf="maxclockerror 1000"
+jitter=1e-7
+base_delay="(* -1.0 (equal 0.1 (min time 600) 600) (equal 0.1 from 2) (equal 0.1 to 1))"
+
+run_test || test_fail
+check_chronyd_exit || test_fail
+check_packet_interval || test_fail
+check_source_selection && test_fail
+check_sync && test_fail
+
+check_log_messages "Root distance of 192\.168\.123\.2 exceeds maxdistance of 3\." 1 1 || test_fail
+
+# Sources with large jitter should be ignored
+
+server_strata=1
+server_conf=$default_server_conf
+server_step="(pulse 64 64)"
+base_delay=$default_base_delay
+
+run_test || test_fail
+check_chronyd_exit || test_fail
+check_packet_interval || test_fail
+check_source_selection && test_fail
+check_sync && test_fail
+
+check_log_messages "Jitter of 192\.168\.123\.1 exceeds maxjitter of 1\." 1 1 || test_fail
+
 test_pass

test/simulation/014-intermittent

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+
+. ./test.common
+
+test_start "intermittent connection"
+
+# Pass packets only for 1200 seconds every 10000 seconds
+base_delay=$(cat <<-EOF | tr -d '\n'
+  (+ 1e-4
+     (* -1
+        (equal 0.1 (min (% time 10000) 1200) 1200)))
+EOF
+)
+
+time_max_limit=1e-1
+freq_max_limit=1e-2
+time_rms_limit=2e-3
+freq_rms_limit=2e-5
+limit=100000
+
+run_test || test_fail
+check_chronyd_exit || test_fail
+check_sync || test_fail
+
+check_log_messages "Can't.*no selectable sources (1 unreachable" 9 10 || test_fail
+check_log_messages "Selected source 192.168.123.1" 9 10 || test_fail
+
+# Pass every 20th request
+base_delay=$(cat <<-EOF | tr -d '\n'
+  (+ 1e-4
+     (* -1
+        (equal 0.1 from 2)
+        (equal 0.1 (min (% (sum 1) 20) 1) 1)))
+EOF
+)
+
+time_max_limit=1e-2
+freq_max_limit=1e-4
+time_rms_limit=5e-3
+max_sync_time=22000
+
+run_test || test_fail
+check_chronyd_exit || test_fail
+check_sync || test_fail
+
+check_log_messages "Can't.*no selectable sources (1 unreachable" 5 15 || test_fail
+check_log_messages "Selected source 192.168.123.1" 5 15 || test_fail
+
+test_pass

test/simulation/015-ipv6

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+
+. ./test.common
+
+test_start "IPv6 addressing"
+
+check_config_h 'FEAT_IPV6 1' || test_skip
+
+ip_family=6
+
+run_test || test_fail
+check_chronyd_exit || test_fail
+check_source_selection || test_fail
+check_packet_interval || test_fail
+check_sync || test_fail
+
+test_pass

test/simulation/103-initstepslew

@@ -52,7 +52,7 @@ client_conf="initstepslew 5 192.168.123.1 192.168.123.2"
 
 min_sync_time=1
 max_sync_time=500
-server_conf="deny all"
+server_conf="deny 192.168.0.0/16"
 
 run_test || test_fail
 check_chronyd_exit || test_fail

test/simulation/106-refclock

@@ -18,15 +18,30 @@ max_sync_time=70
 chronyc_start=70
 chronyc_conf="tracking"
 
-for refclock in "SHM 0" "PHC /dev/ptp0" "PHC /dev/ptp0:nocrossts"; do
+for refclock in "SHM 0" "RTC /dev/rtc:utc" "PHC /dev/ptp0" "PHC /dev/ptp0:nocrossts"; do
 	client_conf="refclock $refclock stratum 3 delay 1e-3 refid GPS
 logdir tmp
 log refclocks"
 
+	if [[ $refclock =~ RTC ]]; then
+		check_config_h 'FEAT_RTC 1' || continue
+		wander=0.0
+		freq_offset=0.0
+		client_chronyd_options="-x"
+	else
+		wander=$default_wander
+		freq_offset=$default_freq_offset
+		client_chronyd_options=$default_client_chronyd_options
+	fi
+
 	run_test || test_fail
 	check_chronyd_exit || test_fail
 	check_source_selection || test_fail
-	check_sync || test_fail
+	if [[ $refclock =~ RTC ]]; then
+		check_chronyc_output "System time *: 0\.10000.... seconds fast" || test_fail
+	else
+		check_sync || test_fail
+	fi
 	check_chronyc_output "^Reference ID.*47505300 \(GPS\)
 Stratum.*: 4
 .*
@@ -35,11 +50,7 @@ Root delay      : 0.001000000 seconds
 Update interval : 16\.. seconds
 .*$" || test_fail
 
-	if echo "$refclock" | grep -q 'PHC.*nocrossts'; then
-		check_file_messages "20.* GPS.*[0-9] N " 650 750 refclocks.log || test_fail
-	else
-		check_file_messages "20.* GPS.*[0-9] N " 997 1001 refclocks.log || test_fail
-	fi
+	check_file_messages "20.* GPS.*[0-9] N " 997 1001 refclocks.log || test_fail
 	check_file_messages "20.* GPS.*- N " 61 63 refclocks.log || test_fail
 	rm -f tmp/refclocks.log
 done
@@ -64,7 +75,7 @@ Stratum.*: 1
 Root delay      : 0\.000000001 seconds
 .*$" || test_fail
 
-	check_file_messages "20.* PPS1.*[0-9] N " 620 740 refclocks.log || test_fail
+	check_file_messages "20.* PPS1.*[0-9] N " 610 740 refclocks.log || test_fail
 	check_file_messages "20.* PPS1.*- N " 60 63 refclocks.log || test_fail
 	rm -f tmp/refclocks.log
 
@@ -89,14 +100,15 @@ Root delay      : 0\.000000001 seconds
 	check_file_messages "20.* PPS1.*- N " 60 63 refclocks.log || test_fail
 	rm -f tmp/refclocks.log
 
-	min_sync_time=100
-	max_sync_time=220
-	chronyc_start=220
+	min_sync_time=180
+	max_sync_time=260
+	chronyc_start=270
 	client_conf="
 refclock SHM 0 refid NMEA offset 0.35 delay 0.1
 refclock PPS /dev/pps0
 logdir tmp
-log refclocks"
+log refclocks
+maxupdateskew 10000"
 
 	run_test || test_fail
 	check_chronyd_exit || test_fail
@@ -108,11 +120,63 @@ Stratum.*: 1
 Root delay      : 0\.000000001 seconds
 .*$" || test_fail
 
-	check_file_messages "20.* PPS1.*[0-9] N " 800 940  refclocks.log || test_fail
+	check_file_messages "20.* PPS1.*[0-9] N " 800 960  refclocks.log || test_fail
 	check_file_messages "20.* PPS1.*- N " 50 63 refclocks.log || test_fail
 	rm -f tmp/refclocks.log
+
+	min_sync_time=80
+	max_sync_time=180
+	chronyc_start=220
+	# Swapped order of SHM and PPS impacts first accepted sample
+	client_conf="
+refclock PPS /dev/pps0
+refclock SHM 0 refid NMEA offset 0.35 delay 0.1
+logdir tmp
+log refclocks
+maxupdateskew 10000"
+
+	run_test || test_fail
+	check_chronyd_exit || test_fail
+	check_source_selection || test_fail
+	check_sync || test_fail
+	check_chronyc_output "^Reference ID.*50505330 \(PPS0\)
+Stratum.*: 1
+.*
+Root delay      : 0\.000000001 seconds
+.*$" || test_fail
+
+	check_file_messages "20.* PPS0.*[0-9] N " 800 960  refclocks.log || test_fail
+	check_file_messages "20.* PPS0.*- N " 50 63 refclocks.log || test_fail
+	rm -f tmp/refclocks.log
 fi
 
+export CLKNETSIM_PHC_JITTER_OFF=$[2 * 25 * 492]
+export CLKNETSIM_PHC_JITTER_ON=$[2 * 25 * 8]
+export CLKNETSIM_PHC_JITTER=1e-6
+refclock_offset=0.0
+refclock_jitter=1e-9
+min_sync_time=5
+max_sync_time=7
+time_max_limit=1e-7
+time_rms_limit=1e-8
+client_conf="refclock PHC /dev/ptp0:nocrossts poll 0
+logdir tmp
+log refclocks"
+chronyc_start=500
+chronyc_conf="sources"
+
+run_test || test_fail
+check_chronyd_exit || test_fail
+check_source_selection || test_fail
+check_sync || test_fail
+check_chronyc_output "^MS.*
+=*
+#\* PHC0                          0   0   377     8 .*$" || test_fail
+rm -f tmp/refclocks.log
+
+unset CLKNETSIM_PHC_JITTER_OFF
+unset CLKNETSIM_PHC_JITTER_ON
+export CLKNETSIM_PHC_JITTER=1e-7
 refclock_offset="(+ 0.399 (sum 1e-3))"
 refclock_jitter=1e-6
 servers=1

test/simulation/108-peer

@@ -21,6 +21,7 @@ EOF
 
 clients=2
 peers=2
+freq_max_limit=1e-3
 max_sync_time=1000
 client_server_options="minpoll 6 maxpoll 6"
 client_peer_options="minpoll 6 maxpoll 6"
@@ -30,6 +31,18 @@ check_chronyd_exit || test_fail
 check_source_selection || test_fail
 check_sync || test_fail
 
+if check_config_h 'FEAT_IPV6 1'; then
+	ip_family=6
+
+	run_test || test_fail
+	check_chronyd_exit || test_fail
+	check_source_selection || test_fail
+	check_sync || test_fail
+
+	ip_family=$default_ip_family
+fi
+
+freq_max_limit=$default_freq_max_limit
 base_delay="(+ 1e-4 (* -1 (equal 0.1 from 3) (equal 0.1 to 1)))"
 client_peer_options=""