[Git][NTPsec/ntpsec][master] 4 commits: Improve a header comment.
Eric S. Raymond
gitlab at mg.gitlab.com
Fri Jun 24 01:59:54 UTC 2016
Eric S. Raymond pushed to branch master at NTPsec / ntpsec
Commits:
8e586d05 by Eric S. Raymond at 2016-06-22T19:36:28-04:00
Improve a header comment.
- - - - -
798a173e by Eric S. Raymond at 2016-06-22T20:42:57-04:00
Remove a magic-address check already done up the call stack.
- - - - -
dd4dc289 by Eric S. Raymond at 2016-06-23T04:32:09-04:00
Allow network packets from any address that doesn't match an active clock.
Thart is, as opposed to rejecting any 127.127.t.u address. We're trying to
get rid of that address-format assumption.
Note, such addresses will mislead ntpq until we fix the peer variables
response(s) to include clockname when appropriate.
- - - - -
bf6b51d1 by Eric S. Raymond at 2016-06-23T21:57:31-04:00
Move a magic address test up the call stack, preparatory to ditching it.
This is a provably correct transformation.
- - - - -
6 changed files:
- etc/use-gpsd-shm
- include/ntpd.h
- ntpd/ntp_io.c
- ntpd/ntp_peer.c
- ntpd/ntp_proto.c
- ntpd/ntp_refclock.c
Changes:
=====================================
etc/use-gpsd-shm
=====================================
--- a/etc/use-gpsd-shm
+++ b/etc/use-gpsd-shm
@@ -1,7 +1,9 @@
# Simplest possible refclock configuration for sites with a GPS primary source.
#
-# Delivers in-band GPS time (not very good, likely to have jitter in the 100s of
-# miliseconds) on one unit, and PPS time (probaly good to 1 ms or less( on
+# Uses the shared-memory driver, accepting fixes from a running gpsd
+# instance watching one PPS-capable GPS. Accepts in-band GPS time (not
+# very good, likely to have jitter in the 100s of milliseconds) on one
+# unit, and PPS time (almost certainly good to 1 ms or less) on
# another. Prefers the latter.
# GPS Serial data reference (NTP0)
=====================================
include/ntpd.h
=====================================
--- a/include/ntpd.h
+++ b/include/ntpd.h
@@ -174,7 +174,7 @@ extern void set_peerdstadr (struct peer *, endpt *);
extern struct peer *newpeer (sockaddr_u *, const char *,
endpt *, uint8_t, uint8_t,
uint8_t, uint8_t, u_int, uint8_t, uint32_t,
- keyid_t);
+ keyid_t, bool);
extern void peer_all_reset (void);
extern void peer_clr_stats (void);
extern struct peer *peer_config(sockaddr_u *, const char *,
=====================================
ntpd/ntp_io.c
=====================================
--- a/ntpd/ntp_io.c
+++ b/ntpd/ntp_io.c
@@ -3517,16 +3517,11 @@ read_network_packet(
DPRINTF(3, ("read_network_packet: fd=%d length %d from %s\n",
fd, buflen, stoa(&rb->recv_srcadr)));
- if (ISREFCLOCKADR(&rb->recv_srcadr)) {
- msyslog(LOG_ERR, "recvfrom(%s) fd=%d: refclock srcadr on a network interface!",
- stoa(&rb->recv_srcadr), fd);
- DPRINTF(1, ("read_network_packet: fd=%d dropped (refclock srcadr))\n",
- fd));
- packets_dropped++;
- freerecvbuf(rb);
- return (buflen);
- }
-
+ /*
+ * We used to drop network packets with addresses matching the magic
+ * refclock format here. Now we do the check in the protocol machine,
+ * rejecting any source address that matches an active clock.
+ */
/*
** Bug 2672: Some OSes (MacOSX and Linux) don't block spoofed ::1
=====================================
ntpd/ntp_peer.c
=====================================
--- a/ntpd/ntp_peer.c
+++ b/ntpd/ntp_peer.c
@@ -601,7 +601,8 @@ peer_config(
if ((MDF_ACAST | MDF_POOL) & cast_flags)
flags &= ~FLAG_PREEMPT;
return newpeer(srcadr, hostname, dstadr, hmode, version,
- minpoll, maxpoll, flags, cast_flags, ttl, key);
+ minpoll, maxpoll, flags, cast_flags, ttl, key,
+ ISREFCLOCKADR(srcadr));
}
/*
@@ -738,7 +739,8 @@ newpeer(
u_int flags,
uint8_t cast_flags,
uint32_t ttl,
- keyid_t key
+ keyid_t key,
+ bool is_refclock_packet
)
{
struct peer * peer;
@@ -884,7 +886,7 @@ newpeer(
peer->timereachable = current_time;
peer->timereceived = current_time;
- if (ISREFCLOCKADR(&peer->srcadr)) {
+ if (is_refclock_packet) {
#ifdef REFCLOCK
/*
* We let the reference clock support do clock
=====================================
ntpd/ntp_proto.c
=====================================
--- a/ntpd/ntp_proto.c
+++ b/ntpd/ntp_proto.c
@@ -581,6 +581,19 @@ receive(
* matching association and that's okay.
*/
peer = findpeer(rbufp, hismode, &retcode);
+
+ /*
+ * If a network packet (nonzero dstadr) source-matched an
+ * active refclock node, drop it. This replaces the old style of
+ * looking for a magic address prefix.
+ */
+ if (peer && IS_PEER_REFCLOCK(peer) && rbufp->dstadr != 0)
+ {
+ msyslog(LOG_ERR, "refclock srcadr on a network interface (%s)!",
+ stoa(&peer->srcadr));
+ return;
+ }
+
#ifdef DEBUG
dstadr_sin = &rbufp->dstadr->sin;
#endif
@@ -791,7 +804,8 @@ receive(
MODE_CLIENT, hisversion, peer2->minpoll,
peer2->maxpoll, FLAG_PREEMPT |
(FLAG_IBURST & peer2->flags), MDF_UCAST |
- MDF_UCLNT, 0, skeyid);
+ MDF_UCLNT, 0, skeyid,
+ ISREFCLOCKADR(&rbufp->recv_srcadr));
if (NULL == peer) {
sys_declined++;
return; /* ignore duplicate */
@@ -868,7 +882,8 @@ receive(
peer = newpeer(&rbufp->recv_srcadr, NULL,
match_ep, MODE_BCLIENT, hisversion,
pkt->ppoll, pkt->ppoll, FLAG_PREEMPT,
- MDF_BCLNT, 0, skeyid);
+ MDF_BCLNT, 0, skeyid,
+ ISREFCLOCKADR(&rbufp->recv_srcadr));
if (NULL == peer) {
sys_restricted++;
return; /* ignore duplicate */
@@ -891,7 +906,7 @@ receive(
peer = newpeer(&rbufp->recv_srcadr, NULL, match_ep,
MODE_CLIENT, hisversion, pkt->ppoll, pkt->ppoll,
FLAG_BC_VOL | FLAG_IBURST | FLAG_PREEMPT, MDF_BCLNT,
- 0, skeyid);
+ 0, skeyid, ISREFCLOCKADR(&rbufp->recv_srcadr));
if (NULL == peer) {
sys_restricted++;
return; /* ignore duplicate */
@@ -974,7 +989,8 @@ receive(
*/
if ((peer = newpeer(&rbufp->recv_srcadr, NULL,
rbufp->dstadr, MODE_PASSIVE, hisversion, pkt->ppoll,
- NTP_MAXDPOLL, 0, MDF_UCAST, 0, skeyid)) == NULL) {
+ NTP_MAXDPOLL, 0, MDF_UCAST, 0, skeyid,
+ ISREFCLOCKADR(&rbufp->recv_srcadr))) == NULL) {
sys_declined++;
return; /* ignore duplicate */
}
=====================================
ntpd/ntp_refclock.c
=====================================
--- a/ntpd/ntp_refclock.c
+++ b/ntpd/ntp_refclock.c
@@ -167,9 +167,8 @@ init_refclock(void)
* driver-specific support routine completes the initialization, if
* used. Default peer variables which identify the clock and establish
* its reference ID and stratum are set here. It returns true if success
- * and false if the clock address is invalid or already running,
- * insufficient resources are available or the driver declares a bum
- * rap.
+ * and false if the clock already running, insufficient resources are
+ * available or the driver declares a bum rap.
*/
bool
refclock_newpeer(
@@ -181,15 +180,8 @@ refclock_newpeer(
int unit;
/*
- * Check for valid clock address. If already running, shut it
- * down first.
+ * If already running, shut it down.
*/
- if (!ISREFCLOCKADR(&peer->srcadr)) {
- msyslog(LOG_ERR,
- "refclock_newpeer: clock address %s invalid",
- stoa(&peer->srcadr));
- return false;
- }
clktype = (uint8_t)REFCLOCKTYPE(&peer->srcadr);
unit = REFCLOCKUNIT(&peer->srcadr);
if (clktype >= num_refclock_conf ||
View it on GitLab: https://gitlab.com/NTPsec/ntpsec/compare/f3704cda18fb1a51bdf39bdc0b24847612b94e1c...bf6b51d136e6f908058627a37519ab08999aa0ee
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ntpsec.org/pipermail/vc/attachments/20160624/819f0176/attachment.html>
More information about the vc
mailing list