Deleted Added
sdiff udiff text old ( 56749 ) new ( 82505 )
full compact
ntp_proto.c (56749) ntp_proto.c (82505)
1/*
2 * ntp_proto.c - NTP version 4 protocol machinery
3 *
1/*
2 * ntp_proto.c - NTP version 4 protocol machinery
3 *
4 * $FreeBSD: head/contrib/ntp/ntpd/ntp_proto.c 56749 2000-01-28 15:02:35Z roberto $
4 * $FreeBSD: head/contrib/ntp/ntpd/ntp_proto.c 82505 2001-08-29 15:15:59Z roberto $
5 */
6#ifdef HAVE_CONFIG_H
7#include <config.h>
8#endif
9
5 */
6#ifdef HAVE_CONFIG_H
7#include <config.h>
8#endif
9
10#include <stdio.h>
11#include <sys/types.h>
12#include <sys/time.h>
13
14#include "ntpd.h"
15#include "ntp_stdlib.h"
16#include "ntp_unixtime.h"
17#include "ntp_control.h"
18#include "ntp_string.h"
10#include "ntpd.h"
11#include "ntp_stdlib.h"
12#include "ntp_unixtime.h"
13#include "ntp_control.h"
14#include "ntp_string.h"
15#include "ntp_crypto.h"
19
16
17#include <stdio.h>
18
20#if defined(VMS) && defined(VMS_LOCALUNIT) /*wjm*/
21#include "ntp_refclock.h"
22#endif
23
24#if defined(__FreeBSD__) && __FreeBSD__ >= 3
25#include <sys/sysctl.h>
26#endif
27
28/*
19#if defined(VMS) && defined(VMS_LOCALUNIT) /*wjm*/
20#include "ntp_refclock.h"
21#endif
22
23#if defined(__FreeBSD__) && __FreeBSD__ >= 3
24#include <sys/sysctl.h>
25#endif
26
27/*
29 * System variables are declared here. See Section 3.2 of the
28 * System variables are declared here. See Section 3.2 of the
30 * specification.
31 */
32u_char sys_leap; /* system leap indicator */
33u_char sys_stratum; /* stratum of system */
34s_char sys_precision; /* local clock precision */
29 * specification.
30 */
31u_char sys_leap; /* system leap indicator */
32u_char sys_stratum; /* stratum of system */
33s_char sys_precision; /* local clock precision */
35double sys_rootdelay; /* distance to current sync source */
36double sys_rootdispersion; /* dispersion of system clock */
34double sys_rootdelay; /* roundtrip delay to primary source */
35double sys_rootdispersion; /* dispersion to primary source */
37u_int32 sys_refid; /* reference source for local clock */
38static double sys_offset; /* current local clock offset */
39l_fp sys_reftime; /* time we were last updated */
40struct peer *sys_peer; /* our current peer */
36u_int32 sys_refid; /* reference source for local clock */
37static double sys_offset; /* current local clock offset */
38l_fp sys_reftime; /* time we were last updated */
39struct peer *sys_peer; /* our current peer */
40struct peer *sys_prefer; /* our cherished peer */
41#ifdef AUTOKEY
41u_long sys_automax; /* maximum session key lifetime */
42u_long sys_automax; /* maximum session key lifetime */
43#endif /* AUTOKEY */
42
43/*
44 * Nonspecified system state variables.
45 */
46int sys_bclient; /* we set our time to broadcasts */
47double sys_bdelay; /* broadcast client default delay */
48int sys_authenticate; /* requre authentication for config */
49l_fp sys_authdelay; /* authentication delay */
50static u_long sys_authdly[2]; /* authentication delay shift reg */
51static u_char leap_consensus; /* consensus of survivor leap bits */
44
45/*
46 * Nonspecified system state variables.
47 */
48int sys_bclient; /* we set our time to broadcasts */
49double sys_bdelay; /* broadcast client default delay */
50int sys_authenticate; /* requre authentication for config */
51l_fp sys_authdelay; /* authentication delay */
52static u_long sys_authdly[2]; /* authentication delay shift reg */
53static u_char leap_consensus; /* consensus of survivor leap bits */
52static double sys_maxd; /* select error (squares) */
53static double sys_epsil; /* system error (squares) */
54u_long sys_private; /* private value for session seed */
55int sys_manycastserver; /* 1 => respond to manycast client pkts */
54static double sys_selerr; /* select error (squares) */
55static double sys_syserr; /* system error (squares) */
56keyid_t sys_private; /* private value for session seed */
57int sys_manycastserver; /* respond to manycast client pkts */
58u_int sys_survivors; /* truest of the truechimers */
59int peer_ntpdate; /* active peers in ntpdate mode */
60#ifdef AUTOKEY
61char *sys_hostname; /* gethostname() name */
62#endif /* AUTOKEY */
56
57/*
58 * Statistics counters
59 */
60u_long sys_stattime; /* time when we started recording */
61u_long sys_badstratum; /* packets with invalid stratum */
62u_long sys_oldversionpkt; /* old version packets received */
63u_long sys_newversionpkt; /* new version packets received */
64u_long sys_unknownversion; /* don't know version packets */
65u_long sys_badlength; /* packets with bad length */
66u_long sys_processed; /* packets processed */
67u_long sys_badauth; /* packets dropped because of auth */
68u_long sys_limitrejected; /* pkts rejected due to client count per net */
69
70static double root_distance P((struct peer *));
71static double clock_combine P((struct peer **, int));
72static void peer_xmit P((struct peer *));
63
64/*
65 * Statistics counters
66 */
67u_long sys_stattime; /* time when we started recording */
68u_long sys_badstratum; /* packets with invalid stratum */
69u_long sys_oldversionpkt; /* old version packets received */
70u_long sys_newversionpkt; /* new version packets received */
71u_long sys_unknownversion; /* don't know version packets */
72u_long sys_badlength; /* packets with bad length */
73u_long sys_processed; /* packets processed */
74u_long sys_badauth; /* packets dropped because of auth */
75u_long sys_limitrejected; /* pkts rejected due to client count per net */
76
77static double root_distance P((struct peer *));
78static double clock_combine P((struct peer **, int));
79static void peer_xmit P((struct peer *));
73static void fast_xmit P((struct recvbuf *, int, u_long));
80static void fast_xmit P((struct recvbuf *, int, keyid_t, int));
74static void clock_update P((void));
75int default_get_precision P((void));
81static void clock_update P((void));
82int default_get_precision P((void));
76#ifdef MD5
77static void make_keylist P((struct peer *));
78#endif /* MD5 */
79
83
84
80/*
81 * transmit - Transmit Procedure. See Section 3.4.2 of the
82 * specification.
83 */
84void
85transmit(
86 struct peer *peer /* peer structure pointer */
87 )
88{
89 int hpoll;
90
91 hpoll = peer->hpoll;
92 if (peer->burst == 0) {
93 u_char oreach;
94
95 /*
85/*
86 * transmit - Transmit Procedure. See Section 3.4.2 of the
87 * specification.
88 */
89void
90transmit(
91 struct peer *peer /* peer structure pointer */
92 )
93{
94 int hpoll;
95
96 hpoll = peer->hpoll;
97 if (peer->burst == 0) {
98 u_char oreach;
99
100 /*
96 * Determine reachability and diddle things if we
97 * haven't heard from the host for a while. If the peer
98 * is not configured and not likely to stay around,
99 * we exhaust it.
101 * The polling state machine. There are two kinds of
102 * machines, those that never expect a reply (broadcast
103 * and manycast server modes) and those that do (all
104 * other modes). The dance is intricate...
100 */
105 */
106 if (peer->cast_flags & (MDF_BCAST | MDF_MCAST)) {
107
108 /*
109 * In broadcast mode the poll interval is fixed
110 * at minpoll and the ttl at ttlmax.
111 */
112 hpoll = peer->minpoll;
113 peer->ttl = peer->ttlmax;
114#ifdef AUTOKEY
115 } else if (peer->cast_flags & MDF_ACAST) {
116
117 /*
118 * In manycast mode we start with the minpoll
119 * interval and ttl. However, the actual poll
120 * interval is eight times the nominal poll
121 * interval shown here. If fewer than three
122 * servers are found, the ttl is increased by
123 * one and we try again. If this continues to
124 * the max ttl, the poll interval is bumped by
125 * one and we try again. If at least three
126 * servers are found, the poll interval
127 * increases with the system poll interval to
128 * the max and we continue indefinately.
129 * However, about once per day when the
130 * agreement parameters are refreshed, the
131 * manycast clients are reset and we start from
132 * the beginning. This is to catch and clamp the
133 * ttl to the lowest practical value and avoid
134 * knocking on spurious doors.
135 */
136 if (sys_survivors < NTP_MINCLOCK && peer->ttl <
137 peer->ttlmax)
138 peer->ttl++;
139 hpoll = sys_poll;
140#endif /* AUTOKEY */
141 } else {
142
143 /*
144 * For associations expecting a reply, the
145 * watchdog counter is bumped by one if the peer
146 * has not been heard since the previous poll.
147 * If the counter reaches the max, the peer is
148 * demobilized if not configured and just
149 * cleared if it is, but in this case the poll
150 * interval is bumped by one.
151 */
152 if (peer->unreach < NTP_UNREACH) {
153 peer->unreach++;
154 } else if (!(peer->flags & FLAG_CONFIG)) {
155 unpeer(peer);
156 clock_select();
157 return;
158
159 } else {
160 peer_clear(peer);
161 hpoll++;
162 }
163 }
101 oreach = peer->reach;
164 oreach = peer->reach;
102 if (oreach & 0x01)
103 peer->valid++;
104 if (oreach & 0x80)
105 peer->valid--;
106 if (!(peer->flags & FLAG_CONFIG) && peer->valid >
107 NTP_SHIFT / 2 && (peer->reach & 0x80) &&
108 peer->status < CTL_PST_SEL_SYNCCAND)
109 peer->reach = 0;
110 peer->reach <<= 1;
111 if (peer->reach == 0) {
112
113 /*
165 peer->reach <<= 1;
166 if (peer->reach == 0) {
167
168 /*
114 * If this is an uncofigured association and
115 * has become unreachable, demobilize it.
169 * If this association has become unreachable,
170 * clear it and raise a trap.
116 */
117 if (oreach != 0) {
118 report_event(EVNT_UNREACH, peer);
119 peer->timereachable = current_time;
171 */
172 if (oreach != 0) {
173 report_event(EVNT_UNREACH, peer);
174 peer->timereachable = current_time;
120 peer_clear(peer);
121 if (!(peer->flags & FLAG_CONFIG)) {
122 unpeer(peer);
175 if (!(peer->flags & FLAG_CONFIG)) {
176 unpeer(peer);
177 clock_select();
123 return;
178 return;
179 } else {
180 peer_clear(peer);
181 hpoll = peer->minpoll;
124 }
125 }
182 }
183 }
126
127 /*
128 * We would like to respond quickly when the
129 * peer comes back to life. If the probes since
130 * becoming unreachable are less than
131 * NTP_UNREACH, clamp the poll interval to the
132 * minimum. In order to minimize the network
133 * traffic, the interval gradually ramps up the
134 * the maximum after that.
135 */
136 peer->ppoll = peer->maxpoll;
137 if (peer->unreach < NTP_UNREACH) {
138 if (peer->hmode == MODE_CLIENT)
139 peer->unreach++;
140 hpoll = peer->minpoll;
141 } else {
142 hpoll++;
143 }
144 if (peer->flags & FLAG_BURST)
145 peer->burst = 2;
146
184 if (peer->flags & FLAG_IBURST)
185 peer->burst = NTP_SHIFT;
147 } else {
148
149 /*
186 } else {
187
188 /*
150 * Here the peer is reachable. If there is no
151 * system peer or if the stratum of the system
152 * peer is greater than this peer, clamp the
153 * poll interval to the minimum. If less than
154 * two samples are in the reachability register,
155 * reduce the interval; if more than six samples
156 * are in the register, increase the interval.
189 * Here the peer is reachable. If it has not
190 * been heard for three consecutive polls, stuff
191 * the clock filter. Next, determine the poll
192 * interval. If the peer is a synchronization
193 * candidate, use the system poll interval. If
194 * the peer is not sane, increase it by one. If
195 * the number of valid updates is not greater
196 * than half the register size, clamp it to the
197 * minimum. This is to quickly recover the time
198 * variables when a noisy peer shows life.
157 */
199 */
158 peer->unreach = 0;
159 if (sys_peer == 0)
160 hpoll = peer->minpoll;
161 else if (sys_peer->stratum > peer->stratum)
162 hpoll = peer->minpoll;
163 if ((peer->reach & 0x03) == 0) {
200 if (!(peer->reach & 0x07)) {
164 clock_filter(peer, 0., 0., MAXDISPERSE);
165 clock_select();
166 }
201 clock_filter(peer, 0., 0., MAXDISPERSE);
202 clock_select();
203 }
167 if (peer->valid <= 2)
168 hpoll--;
169 else if (peer->valid >= NTP_SHIFT - 2)
204 if ((peer->stratum > 1 && peer->refid ==
205 peer->dstadr->sin.sin_addr.s_addr) ||
206 peer->stratum >= STRATUM_UNSPEC)
170 hpoll++;
207 hpoll++;
208 else
209 hpoll = sys_poll;
171 if (peer->flags & FLAG_BURST)
172 peer->burst = NTP_SHIFT;
173 }
174 } else {
175 peer->burst--;
176 if (peer->burst == 0) {
210 if (peer->flags & FLAG_BURST)
211 peer->burst = NTP_SHIFT;
212 }
213 } else {
214 peer->burst--;
215 if (peer->burst == 0) {
177 if (peer->flags & FLAG_MCAST2) {
178 peer->flags &= ~FLAG_BURST;
216
217 /*
218 * If a broadcast client at this point, the
219 * burst has concluded, so we switch to client
220 * mode and purge the keylist, since no further
221 * transmissions will be made.
222 */
223 if (peer->cast_flags & MDF_BCLNT) {
179 peer->hmode = MODE_BCLIENT;
224 peer->hmode = MODE_BCLIENT;
225#ifdef AUTOKEY
226 key_expire(peer);
227#endif /* AUTOKEY */
180 }
228 }
181 clock_select();
182 poll_update(peer, hpoll);
229 poll_update(peer, hpoll);
230 clock_select();
231
232 /*
233 * If ntpdate mode and the clock has not been
234 * set and all peers have completed the burst,
235 * we declare a successful failure.
236 */
237 if (mode_ntpdate) {
238 peer_ntpdate--;
239 if (peer_ntpdate > 0)
240 return;
241 NLOG(NLOG_SYNCEVENT | NLOG_SYSEVENT)
242 msyslog(LOG_NOTICE,
243 "no reply; clock not set");
244 printf(
245 "ntpd: no reply; clock not set\n");
246 exit(0);
247 }
183 return;
248 return;
249
184 }
185 }
250 }
251 }
252 peer->outdate = current_time;
253 poll_update(peer, hpoll);
186
187 /*
254
255 /*
188 * We need to be very careful about honking uncivilized time. If
189 * not operating in broadcast mode, honk in all except broadcast
190 * client mode. If operating in broadcast mode and synchronized
191 * to a real source, honk except when the peer is the local-
192 * clock driver and the prefer flag is not set. In other words,
193 * in broadcast mode we never honk unless known to be
194 * synchronized to real time.
256 * We need to be very careful about honking uncivilized time.
257 * Never transmit if in broadcast client mode or access denied.
258 * If in broadcast mode, transmit only if synchronized to a
259 * valid source.
195 */
260 */
196 if (peer->hmode != MODE_BROADCAST) {
197 if (peer->hmode != MODE_BCLIENT)
198 peer_xmit(peer);
199 } else if (sys_peer != 0 && sys_leap != LEAP_NOTINSYNC) {
200 if (!(sys_peer->refclktype == REFCLK_LOCALCLOCK &&
201 !(sys_peer->flags & FLAG_PREFER)))
202 peer_xmit(peer);
261 if (peer->hmode == MODE_BCLIENT || peer->flash & TEST4) {
262 return;
263 } else if (peer->hmode == MODE_BROADCAST) {
264 if (sys_peer == NULL)
265 return;
203 }
266 }
204 peer->outdate = current_time;
205 poll_update(peer, hpoll);
267 peer_xmit(peer);
206}
207
208/*
209 * receive - Receive Procedure. See section 3.4.3 in the specification.
210 */
211void
212receive(
213 struct recvbuf *rbufp
214 )
215{
216 register struct peer *peer;
217 register struct pkt *pkt;
218 int hismode;
219 int oflags;
220 int restrict_mask;
268}
269
270/*
271 * receive - Receive Procedure. See section 3.4.3 in the specification.
272 */
273void
274receive(
275 struct recvbuf *rbufp
276 )
277{
278 register struct peer *peer;
279 register struct pkt *pkt;
280 int hismode;
281 int oflags;
282 int restrict_mask;
221 int has_mac; /* has MAC field */
222 int authlen; /* length of MAC field */
283 int has_mac; /* length of MAC field */
284 int authlen; /* offset of MAC field */
223 int is_authentic; /* cryptosum ok */
285 int is_authentic; /* cryptosum ok */
224 int is_mystic; /* session key exists */
225 int is_error; /* parse error */
226/* u_long pkeyid; */
227 u_long skeyid, tkeyid;
286 keyid_t skeyid; /* cryptographic keys */
287 struct sockaddr_in *dstadr_sin; /* active runway */
288#ifdef AUTOKEY
289 keyid_t pkeyid, tkeyid; /* cryptographic keys */
290#endif /* AUTOKEY */
228 struct peer *peer2;
229 int retcode = AM_NOMATCH;
230
231 /*
291 struct peer *peer2;
292 int retcode = AM_NOMATCH;
293
294 /*
232 * Monitor the packet and get restrictions
295 * Monitor the packet and get restrictions. Note that the packet
296 * length for control and private mode packets must be checked
297 * by the service routines. Note that no statistics counters are
298 * recorded for restrict violations, since these counters are in
299 * the restriction routine. Note the careful distinctions here
300 * between a packet with a format error and a packet that is
301 * simply discarded without prejudice. Some restrictions have to
302 * be handled later in order to generate a kiss-of-death packet.
233 */
234 ntp_monitor(rbufp);
235 restrict_mask = restrictions(&rbufp->recv_srcadr);
236#ifdef DEBUG
303 */
304 ntp_monitor(rbufp);
305 restrict_mask = restrictions(&rbufp->recv_srcadr);
306#ifdef DEBUG
237 if (debug > 1)
238 printf("receive: from %s restrict %02x\n",
307 if (debug > 2)
308 printf("receive: at %ld %s<-%s restrict %02x\n",
309 current_time, ntoa(&rbufp->dstadr->sin),
239 ntoa(&rbufp->recv_srcadr), restrict_mask);
240#endif
241 if (restrict_mask & RES_IGNORE)
310 ntoa(&rbufp->recv_srcadr), restrict_mask);
311#endif
312 if (restrict_mask & RES_IGNORE)
242 return;
243
244 /*
245 * Discard packets with invalid version number.
246 */
313 return; /* no anything */
314 if (!(SRCPORT(&rbufp->recv_srcadr) == NTP_PORT ||
315 SRCPORT(&rbufp->recv_srcadr) >= IPPORT_RESERVED)) {
316 sys_badlength++;
317 return; /* invalid port */
318 }
247 pkt = &rbufp->recv_pkt;
319 pkt = &rbufp->recv_pkt;
248 if (PKT_VERSION(pkt->li_vn_mode) >= NTP_VERSION)
249 sys_newversionpkt++;
250 else if (PKT_VERSION(pkt->li_vn_mode) >= NTP_OLDVERSION)
251 sys_oldversionpkt++;
252 else {
320 if (PKT_VERSION(pkt->li_vn_mode) == NTP_VERSION) {
321 sys_newversionpkt++; /* new version */
322 } else if (!(restrict_mask & RES_VERSION) &&
323 PKT_VERSION(pkt->li_vn_mode) >= NTP_OLDVERSION) {
324 sys_oldversionpkt++; /* old version */
325 } else {
253 sys_unknownversion++;
326 sys_unknownversion++;
254 return;
327 return; /* invalid version */
255 }
328 }
256
257 /*
258 * Restrict control/private mode packets. Note that packet
259 * length has to be checked in the control/private mode protocol
260 * module.
261 */
262 if (PKT_MODE(pkt->li_vn_mode) == MODE_PRIVATE) {
263 if (restrict_mask & RES_NOQUERY)
329 if (PKT_MODE(pkt->li_vn_mode) == MODE_PRIVATE) {
330 if (restrict_mask & RES_NOQUERY)
264 return;
331 return; /* no query private */
265 process_private(rbufp, ((restrict_mask &
266 RES_NOMODIFY) == 0));
267 return;
268 }
269 if (PKT_MODE(pkt->li_vn_mode) == MODE_CONTROL) {
270 if (restrict_mask & RES_NOQUERY)
332 process_private(rbufp, ((restrict_mask &
333 RES_NOMODIFY) == 0));
334 return;
335 }
336 if (PKT_MODE(pkt->li_vn_mode) == MODE_CONTROL) {
337 if (restrict_mask & RES_NOQUERY)
271 return;
338 return; /* no query control */
272 process_control(rbufp, restrict_mask);
273 return;
274 }
339 process_control(rbufp, restrict_mask);
340 return;
341 }
342 if (rbufp->recv_length < LEN_PKT_NOMAC) {
343 sys_badlength++;
344 return; /* runt packet */
345 }
275
276 /*
346
347 /*
277 * Restrict revenue packets.
348 * Validate mode. Note that NTPv1 is no longer supported.
278 */
349 */
279 if (restrict_mask & RES_DONTSERVE)
280 return;
350 hismode = (int)PKT_MODE(pkt->li_vn_mode);
351 if (hismode == MODE_UNSPEC) {
352 sys_badlength++;
353 return; /* invalid mode */
354 }
281
355
282 /*
283 * See if we only accept limited number of clients from the net
284 * this guy is from. Note: the flag is determined dynamically
285 * within restrictions()
286 */
287 if (restrict_mask & RES_LIMITED) {
288 sys_limitrejected++;
289 return;
290 }
291
292 /*
356 /*
293 * If we are not a broadcast client, ignore broadcast packets.
357 * Discard broadcast packets received on the wildcard interface
358 * or if not enabled as broadcast client.
294 */
359 */
295 if ((PKT_MODE(pkt->li_vn_mode) == MODE_BROADCAST &&
296 !sys_bclient))
360 if (PKT_MODE(pkt->li_vn_mode) == MODE_BROADCAST &&
361 (rbufp->dstadr == any_interface || !sys_bclient))
297 return;
298
299 /*
362 return;
363
364 /*
300 * This is really awful ugly. We figure out whether an extension
301 * field is present and then measure the MAC size. If the number
302 * of words following the packet header is less than or equal to
303 * 5, no extension field is present and these words constitute
304 * the MAC. If the number of words is greater than 5, an
305 * extension field is present and the first word contains the
306 * length of the extension field and the MAC follows that.
365 * Parse the extension field if present. We figure out whether
366 * an extension field is present by measuring the MAC size. If
367 * the number of words following the packet header is 0 or 1, no
368 * MAC is present and the packet is not authenticated. If 1, the
369 * packet is a reply to a previous request that failed to
370 * authenticate. If 3, the packet is authenticated with DES; if
371 * 5, the packet is authenticated with MD5. If greater than 5,
372 * an extension field is present. If 2 or 4, the packet is a
373 * runt and goes poof! with a brilliant flash.
307 */
374 */
308 has_mac = 0;
309/* pkeyid = 0; */
310 skeyid = tkeyid = 0;
375 skeyid = 0;
376#ifdef AUTOKEY
377 pkeyid = tkeyid = 0;
378#endif /* AUTOKEY */
311 authlen = LEN_PKT_NOMAC;
379 authlen = LEN_PKT_NOMAC;
312 has_mac = rbufp->recv_length - authlen;
313 if (has_mac <= 5 * sizeof(u_int32)) {
314 skeyid = (u_long)ntohl(pkt->keyid1) & 0xffffffff;
315 } else {
316 authlen += (u_long)ntohl(pkt->keyid1) & 0xffffffff;
317 has_mac = rbufp->recv_length - authlen;
318 if (authlen <= 0) {
380 while ((has_mac = rbufp->recv_length - authlen) > 0) {
381 int temp;
382
383 if (has_mac % 4 != 0 || has_mac < 0) {
319 sys_badlength++;
320 return;
321 }
384 sys_badlength++;
385 return;
386 }
387 if (has_mac == 1 * 4 || has_mac == 3 * 4 || has_mac ==
388 MAX_MAC_LEN) {
389 skeyid = ntohl(((u_int32 *)pkt)[authlen / 4]);
390 break;
322
391
323 /*
324 * Note that keyid3 is actually the key ident of the
325 * MAC itself.
326 */
327/* pkeyid = (u_long)ntohl(pkt->keyid2) & 0xffffffff; */
328 skeyid = tkeyid = (u_long)ntohl(pkt->keyid3) &
329 0xffffffff;
330 }
331
332 /*
333 * Figure out his mode and validate it.
334 */
335 hismode = (int)PKT_MODE(pkt->li_vn_mode);
336 if (PKT_VERSION(pkt->li_vn_mode) == NTP_OLDVERSION && hismode ==
337 0) {
338 /*
339 * Easy. If it is from the NTP port it is
340 * a sym act, else client.
341 */
342 if (SRCPORT(&rbufp->recv_srcadr) == NTP_PORT)
343 hismode = MODE_ACTIVE;
344 else
345 hismode = MODE_CLIENT;
346 } else {
347 if (hismode != MODE_ACTIVE && hismode != MODE_PASSIVE &&
348 hismode != MODE_SERVER && hismode != MODE_CLIENT &&
349 hismode != MODE_BROADCAST)
392 } else if (has_mac > MAX_MAC_LEN) {
393 temp = ntohl(((u_int32 *)pkt)[authlen / 4]) &
394 0xffff;
395 if (temp < 4 || temp % 4 != 0) {
396 sys_badlength++;
397 return;
398 }
399 authlen += temp;
400 } else {
401 sys_badlength++;
350 return;
402 return;
403 }
351 }
352
353 /*
404 }
405
406 /*
354 * If he included a mac field, decrypt it to see if it is
355 * authentic.
407 * We have tossed out as many buggy packets as possible early in
408 * the game to reduce the exposure to a clogging attack. Now we
409 * have to burn some cycles to find the association and
410 * authenticate the packet if required. Note that we burn only
411 * MD5 or DES cycles, again to reduce exposure. There may be no
412 * matching association and that's okay.
413 *
414 * More on the autokey mambo. Normally the local interface is
415 * found when the association was mobilized with respect to a
416 * designated remote address. We assume packets arriving from
417 * the remote address arrive via this interface and the local
418 * address used to construct the autokey is the unicast address
419 * of the interface. However, if the sender is a broadcaster,
420 * the interface broadcast address is used instead.
421 * Notwithstanding this technobabble, if the sender is a
422 * multicaster, the broadcast address is null, so we use the
423 * unicast address anyway. Don't ask.
356 */
424 */
357 is_authentic = is_mystic = 0;
425 peer = findpeer(&rbufp->recv_srcadr, rbufp->dstadr, rbufp->fd,
426 hismode, &retcode);
427 is_authentic = 0;
428 dstadr_sin = &rbufp->dstadr->sin;
358 if (has_mac == 0) {
359#ifdef DEBUG
360 if (debug)
429 if (has_mac == 0) {
430#ifdef DEBUG
431 if (debug)
361 printf("receive: at %ld from %s mode %d\n",
362 current_time, ntoa(&rbufp->recv_srcadr),
363 hismode);
432 printf("receive: at %ld %s<-%s mode %d code %d\n",
433 current_time, ntoa(&rbufp->dstadr->sin),
434 ntoa(&rbufp->recv_srcadr), hismode, retcode);
364#endif
365 } else {
435#endif
436 } else {
366 is_mystic = authistrusted(skeyid);
367#ifdef MD5
368 if (skeyid > NTP_MAXKEY && !is_mystic) {
369
437#ifdef AUTOKEY
438 /*
439 * For autokey modes, generate the session key
440 * and install in the key cache. Use the socket
441 * broadcast or unicast address as appropriate.
442 */
443 if (skeyid > NTP_MAXKEY) {
444
370 /*
445 /*
371 * For multicast mode, generate the session key
372 * and install in the key cache. For client
373 * mode, generate the session key for the
374 * unicast address. For server mode, the session
375 * key should already be in the key cache, since
376 * it was generated when the last request was
377 * sent.
446 * More on the autokey dance (AKD). A cookie is
447 * constructed from public and private values.
448 * For broadcast packets, the cookie is public
449 * (zero). For packets that match no
450 * association, the cookie is hashed from the
451 * addresses and private value. For server
452 * packets, the cookie was previously obtained
453 * from the server. For symmetric modes, the
454 * cookie was previously constructed using an
455 * agreement protocol; however, should PKI be
456 * unavailable, we construct a fake agreement as
457 * the EXOR of the peer and host cookies.
458 *
459 * hismode ephemeral persistent
460 * =======================================
461 * active 0 cookie#
462 * passive 0% cookie#
463 * client sys cookie 0%
464 * server 0% sys cookie
465 * broadcast 0 0
466 *
467 * # if unsync, 0
468 * % can't happen
378 */
379 if (hismode == MODE_BROADCAST) {
469 */
470 if (hismode == MODE_BROADCAST) {
471
472 /*
473 * For broadcaster, use the interface
474 * broadcast address when available;
475 * otherwise, use the unicast address
476 * found when the association was
477 * mobilized.
478 */
479 pkeyid = 0;
480 if (rbufp->dstadr->bcast.sin_addr.s_addr
481 != 0)
482 dstadr_sin =
483 &rbufp->dstadr->bcast;
484 } else if (peer == NULL) {
485 pkeyid = session_key(
486 &rbufp->recv_srcadr, dstadr_sin, 0,
487 sys_private, 0);
488 } else {
489 pkeyid = peer->pcookie.key;
490 }
491
492 /*
493 * The session key includes both the public
494 * values and cookie. In case of an extension
495 * field, the cookie used for authentication
496 * purposes is zero. Note the hash is saved for
497 * use later in the autokey mambo.
498 */
499 if (authlen > LEN_PKT_NOMAC && pkeyid != 0) {
500 session_key(&rbufp->recv_srcadr,
501 dstadr_sin, skeyid, 0, 2);
380 tkeyid = session_key(
502 tkeyid = session_key(
381 ntohl((&rbufp->recv_srcadr)->sin_addr.s_addr),
382 ntohl(rbufp->dstadr->bcast.sin_addr.s_addr),
383 skeyid, (u_long)(4 * (1 << pkt->ppoll)));
384 } else if (hismode != MODE_SERVER) {
503 &rbufp->recv_srcadr, dstadr_sin,
504 skeyid, pkeyid, 0);
505 } else {
385 tkeyid = session_key(
506 tkeyid = session_key(
386 ntohl((&rbufp->recv_srcadr)->sin_addr.s_addr),
387 ntohl(rbufp->dstadr->sin.sin_addr.s_addr),
388 skeyid, (u_long)(4 * (1 << pkt->ppoll)));
507 &rbufp->recv_srcadr, dstadr_sin,
508 skeyid, pkeyid, 2);
389 }
390
391 }
509 }
510
511 }
392#endif /* MD5 */
512#endif /* AUTOKEY */
393
394 /*
395 * Compute the cryptosum. Note a clogging attack may
513
514 /*
515 * Compute the cryptosum. Note a clogging attack may
396 * succceed in bloating the key cache.
516 * succeed in bloating the key cache. If an autokey,
517 * purge it immediately, since we won't be needing it
518 * again.
397 */
398 if (authdecrypt(skeyid, (u_int32 *)pkt, authlen,
399 has_mac))
400 is_authentic = 1;
401 else
402 sys_badauth++;
519 */
520 if (authdecrypt(skeyid, (u_int32 *)pkt, authlen,
521 has_mac))
522 is_authentic = 1;
523 else
524 sys_badauth++;
525#ifdef AUTOKEY
526 if (skeyid > NTP_MAXKEY)
527 authtrust(skeyid, 0);
528#endif /* AUTOKEY */
403#ifdef DEBUG
404 if (debug)
405 printf(
529#ifdef DEBUG
530 if (debug)
531 printf(
406 "receive: at %ld %s mode %d keyid %08lx mac %d auth %d\n",
407 current_time, ntoa(&rbufp->recv_srcadr),
408 hismode, skeyid, has_mac, is_authentic);
532 "receive: at %ld %s<-%s mode %d code %d keyid %08x len %d mac %d auth %d\n",
533 current_time, ntoa(dstadr_sin),
534 ntoa(&rbufp->recv_srcadr), hismode, retcode,
535 skeyid, authlen, has_mac,
536 is_authentic);
409#endif
410 }
411
412 /*
537#endif
538 }
539
540 /*
413 * Find the peer. This will return a null if this guy isn't in
414 * the database.
541 * The association matching rules are implemented by a set of
542 * routines and a table in ntp_peer.c. A packet matching an
543 * association is processed by that association. If not and
544 * certain conditions prevail, then an ephemeral association is
545 * mobilized: a broadcast packet mobilizes a broadcast client
546 * aassociation; a server packet mobilizes a client association;
547 * a symmetric active packet mobilizes a symmetric passive
548 * association. And, the adventure continues...
415 */
549 */
416 peer = findpeer(&rbufp->recv_srcadr, rbufp->dstadr, rbufp->fd,
417 hismode, &retcode);
418 /*
419 * The new association matching rules are driven by a table
420 * specified in ntp.h. We have replaced the *default* behaviour
421 * of replying to bogus packets in server mode in this version.
422 * A packet must now match an association in order to be
423 * processed. In the event that no association exists, then an
424 * association is mobilized if need be. Two different
425 * associations can be mobilized a) passive associations b)
426 * client associations due to broadcasts or manycasts.
427 */
428 is_error = 0;
429 switch (retcode) {
430 case AM_FXMIT:
431
432 /*
550 switch (retcode) {
551 case AM_FXMIT:
552
553 /*
433 * If the client is configured purely as a broadcast
434 * client and not as an manycast server, it has no
435 * business being a server. Simply go home. Otherwise,
436 * send a MODE_SERVER response and go home. Note that we
437 * don't do a authentication check here, since we can't
438 * set the system clock; but, we do set the key ID to
439 * zero to tell the caller about this.
554 * This is a client mode packet not matching a known
555 * association. If from a manycast client we run a few
556 * sanity checks before deciding to send a unicast
557 * server response. Otherwise, it must be a client
558 * request, so send a server response and go home.
440 */
559 */
441 if (!sys_bclient || sys_manycastserver) {
442 if (is_authentic)
443 fast_xmit(rbufp, MODE_SERVER, skeyid);
444 else
445 fast_xmit(rbufp, MODE_SERVER, 0);
560 if (sys_manycastserver && (rbufp->dstadr->flags &
561 INT_MULTICAST)) {
562
563 /*
564 * We are picky about responding to a
565 * manycaster. There is no reason to respond to
566 * a request if our time is worse than the
567 * manycaster. We certainly don't reply if not
568 * synchronized to proventic time.
569 */
570 if (sys_peer == NULL)
571 return;
572
573 /*
574 * We don't reply if the our stratum is greater
575 * than the manycaster.
576 */
577 if (PKT_TO_STRATUM(pkt->stratum) < sys_stratum)
578 return;
446 }
447
448 /*
579 }
580
581 /*
449 * We can't get here if an association is mobilized, so
450 * just toss the key, if appropriate.
582 * Note that we don't require an authentication check
583 * here, since we can't set the system clock; but, we do
584 * set the key ID to zero to tell the caller about this.
451 */
585 */
452 if (!is_mystic && skeyid > NTP_MAXKEY)
453 authtrust(skeyid, 0);
454 return;
586 if (is_authentic)
587 fast_xmit(rbufp, MODE_SERVER, skeyid,
588 restrict_mask);
589 else
590 fast_xmit(rbufp, MODE_SERVER, 0, restrict_mask);
591 return;
455
456 case AM_MANYCAST:
457
458 /*
592
593 case AM_MANYCAST:
594
595 /*
459 * This could be in response to a multicast packet sent
460 * by the "manycast" mode association. Find peer based
461 * on the originate timestamp in the packet. Note that
462 * we don't mobilize a new association, unless the
463 * packet is properly authenticated. The response must
464 * be properly authenticated and it's darn funny of the
465 * manycaster isn't around now.
596 * This is a server mode packet returned in response to
597 * a client mode packet sent to a multicast group
598 * address. The originate timestamp is a good nonce to
599 * reliably associate the reply with what was sent. If
600 * there is no match, that's curious and could be an
601 * intruder attempting to clog, so we just ignore it.
602 *
603 * First, make sure the packet is authentic. If so and
604 * the manycast association is found, we mobilize a
605 * client mode association, copy pertinent variables
606 * from the manycast to the client mode association and
607 * wind up the spring.
608 *
609 * There is an implosion hazard at the manycast client,
610 * since the manycast servers send the server packet
611 * immediately.
466 */
612 */
467 if ((sys_authenticate && !is_authentic)) {
468 is_error = 1;
469 break;
470 }
471 peer2 = (struct peer *)findmanycastpeer(&pkt->org);
472 if (peer2 == 0) {
473 is_error = 1;
474 break;
475 }
613 if ((restrict_mask & (RES_DONTSERVE | RES_LIMITED |
614 RES_NOPEER)) || (sys_authenticate &&
615 !is_authentic))
616 return;
476
617
477 /*
478 * Create a new association and copy the peer variables
479 * to it. If something goes wrong, carefully pry the new
480 * association away and return its marbles to the candy
481 * store.
482 */
618 peer2 = findmanycastpeer(rbufp);
619 if (peer2 == 0)
620 return;
621
483 peer = newpeer(&rbufp->recv_srcadr, rbufp->dstadr,
484 MODE_CLIENT, PKT_VERSION(pkt->li_vn_mode),
622 peer = newpeer(&rbufp->recv_srcadr, rbufp->dstadr,
623 MODE_CLIENT, PKT_VERSION(pkt->li_vn_mode),
485 NTP_MINDPOLL, NTP_MAXDPOLL, 0, skeyid);
486 if (peer == 0) {
487 is_error = 1;
488 break;
489 }
490 peer_config_manycast(peer2, peer);
624 sys_minpoll, NTP_MAXDPOLL, FLAG_IBURST |
625 (peer2->flags & (FLAG_AUTHENABLE | FLAG_SKEY)),
626 MDF_UCAST, 0, skeyid);
627 if (peer == NULL)
628 return;
491 break;
492
629 break;
630
493 case AM_ERR:
494
495 /*
496 * Something bad happened. Dirty floor will be mopped by
497 * the code at the end of this adventure.
498 */
499 is_error = 1;
500 break;
501
502 case AM_NEWPASS:
503
504 /*
631 case AM_NEWPASS:
632
633 /*
505 * Okay, we're going to keep him around. Allocate him
506 * some memory. But, don't do that unless the packet is
507 * properly authenticated.
634 * This is the first packet received from a symmetric
635 * active peer. First, make sure the packet is
636 * authentic. If so, mobilize a symmetric passive
637 * association.
508 */
638 */
509 if ((sys_authenticate && !is_authentic)) {
510 is_error = 1;
511 break;
639 if ((restrict_mask & (RES_DONTSERVE | RES_LIMITED |
640 RES_NOPEER)) || (sys_authenticate &&
641 !is_authentic)) {
642 fast_xmit(rbufp, MODE_PASSIVE, 0,
643 restrict_mask);
644 return;
512 }
513 peer = newpeer(&rbufp->recv_srcadr, rbufp->dstadr,
514 MODE_PASSIVE, PKT_VERSION(pkt->li_vn_mode),
645 }
646 peer = newpeer(&rbufp->recv_srcadr, rbufp->dstadr,
647 MODE_PASSIVE, PKT_VERSION(pkt->li_vn_mode),
515 NTP_MINDPOLL, NTP_MAXDPOLL, 0, skeyid);
648 sys_minpoll, NTP_MAXDPOLL, sys_authenticate ?
649 FLAG_AUTHENABLE : 0, MDF_UCAST, 0, skeyid);
650 if (peer == NULL)
651 return;
516 break;
517
518 case AM_NEWBCL:
519
520 /*
652 break;
653
654 case AM_NEWBCL:
655
656 /*
521 * Broadcast client being set up now. Do this only if
522 * the packet is properly authenticated.
657 * This is the first packet received from a broadcast
658 * server. First, make sure the packet is authentic, not
659 * restricted and that we are a broadcast or multicast
660 * client. If so, mobilize a broadcast client
661 * association.
523 */
662 */
524 if ((restrict_mask & RES_NOPEER) || !sys_bclient ||
525 (sys_authenticate && !is_authentic)) {
526 is_error = 1;
527 break;
528 }
663 if ((restrict_mask & (RES_DONTSERVE | RES_LIMITED |
664 RES_NOPEER)) || (sys_authenticate &&
665 !is_authentic) || !sys_bclient)
666 return;
667
529 peer = newpeer(&rbufp->recv_srcadr, rbufp->dstadr,
668 peer = newpeer(&rbufp->recv_srcadr, rbufp->dstadr,
530 MODE_MCLIENT, PKT_VERSION(pkt->li_vn_mode),
531 NTP_MINDPOLL, NTP_MAXDPOLL, 0, skeyid);
532 if (peer == 0)
533 break;
534 peer->flags |= FLAG_MCAST1 | FLAG_MCAST2 | FLAG_BURST;
535 peer->hmode = MODE_CLIENT;
536 break;
669 MODE_CLIENT, PKT_VERSION(pkt->li_vn_mode),
670 sys_minpoll, NTP_MAXDPOLL, FLAG_MCAST |
671 FLAG_IBURST | (sys_authenticate ?
672 FLAG_AUTHENABLE : 0), MDF_BCLNT, 0, skeyid);
673#ifdef AUTOKEY
674#ifdef PUBKEY
675 if (peer == NULL)
676 return;
677 if (peer->flags & FLAG_SKEY)
678 crypto_recv(peer, rbufp);
679#endif /* PUBKEY */
680#endif /* AUTOKEY */
681 return;
537
538 case AM_POSSBCL:
539 case AM_PROCPKT:
540
541 /*
682
683 case AM_POSSBCL:
684 case AM_PROCPKT:
685
686 /*
542 * It seems like it is okay to process the packet now
687 * Happiness and nothing broke. Earn some revenue.
543 */
544 break;
545
546 default:
547
548 /*
688 */
689 break;
690
691 default:
692
693 /*
549 * shouldn't be getting here, but simply return anyway!
694 * Invalid mode combination. Leave the island
695 * immediately.
550 */
696 */
551 is_error = 1;
552 }
553 if (is_error) {
554
555 /*
556 * Error stub. If we get here, something broke. We
557 * scuttle the autokey if necessary and sink the ship.
558 * This can occur only upon mobilization, so we can
559 * throw the structure away without fear of breaking
560 * anything.
561 */
562 if (!is_mystic && skeyid > NTP_MAXKEY)
563 authtrust(skeyid, 0);
564 if (peer != 0)
565 if (!(peer->flags & FLAG_CONFIG))
566 unpeer(peer);
567#ifdef DEBUG
568 if (debug)
697#ifdef DEBUG
698 if (debug)
569 printf("match error code %d assoc %d\n",
570 retcode, peer_associations);
699 printf("receive: bad protocol %d\n", retcode);
571#endif
572 return;
573 }
574
575 /*
700#endif
701 return;
702 }
703
704 /*
576 * If the peer isn't configured, set his keyid and authenable
577 * status based on the packet.
705 * If the peer isn't configured, set his authenable and autokey
706 * status based on the packet. Once the status is set, it can't
707 * be unset. It seems like a silly idea to do this here, rather
708 * in the configuration routine, but in some goofy cases the
709 * first packet sent cannot be authenticated and we need a way
710 * for the dude to change his mind.
578 */
579 oflags = peer->flags;
580 peer->timereceived = current_time;
711 */
712 oflags = peer->flags;
713 peer->timereceived = current_time;
714 peer->received++;
581 if (!(peer->flags & FLAG_CONFIG) && has_mac) {
582 peer->flags |= FLAG_AUTHENABLE;
715 if (!(peer->flags & FLAG_CONFIG) && has_mac) {
716 peer->flags |= FLAG_AUTHENABLE;
583 if (skeyid > NTP_MAXKEY) {
584 if (peer->flags & FLAG_MCAST2)
585 peer->keyid = skeyid;
586 else
587 peer->flags |= FLAG_SKEY;
588 }
717#ifdef AUTOKEY
718 if (skeyid > NTP_MAXKEY)
719 peer->flags |= FLAG_SKEY;
720#endif /* AUTOKEY */
589 }
590
591 /*
721 }
722
723 /*
592 * Determine if this guy is basically trustable. If not, flush
593 * the bugger. If this is the first packet that is
594 * authenticated, flush the clock filter. This is to foil
595 * clogging attacks that might starve the poor dear.
724 * A valid packet must be from an authentic and allowed source.
725 * All packets must pass the authentication allowed tests.
726 * Autokey authenticated packets must pass additional tests and
727 * public-key authenticated packets must have the credentials
728 * verified. If all tests are passed, the packet is forwarded
729 * for processing. If not, the packet is discarded and the
730 * association demobilized if appropriate.
596 */
597 peer->flash = 0;
731 */
732 peer->flash = 0;
598 if (is_authentic)
733 if (is_authentic) {
599 peer->flags |= FLAG_AUTHENTIC;
734 peer->flags |= FLAG_AUTHENTIC;
600 else
735 } else {
601 peer->flags &= ~FLAG_AUTHENTIC;
736 peer->flags &= ~FLAG_AUTHENTIC;
602 if (peer->hmode == MODE_BROADCAST && (restrict_mask &
603 RES_DONTTRUST))
604 peer->flash |= TEST10; /* access denied */
737 }
738 if (peer->hmode == MODE_BROADCAST &&
739 (restrict_mask & RES_DONTTRUST)) /* test 4 */
740 peer->flash |= TEST4; /* access denied */
605 if (peer->flags & FLAG_AUTHENABLE) {
741 if (peer->flags & FLAG_AUTHENABLE) {
606 if (!(peer->flags & FLAG_AUTHENTIC))
742 if (!(peer->flags & FLAG_AUTHENTIC)) /* test 5 */
607 peer->flash |= TEST5; /* auth failed */
743 peer->flash |= TEST5; /* auth failed */
608 else if (skeyid == 0)
609 peer->flash |= TEST9; /* peer not auth */
610 else if (!(oflags & FLAG_AUTHENABLE)) {
611 peer_clear(peer);
744 else if (!(oflags & FLAG_AUTHENABLE))
612 report_event(EVNT_PEERAUTH, peer);
745 report_event(EVNT_PEERAUTH, peer);
613 }
614 }
746 }
615 if ((peer->flash & ~(u_int)TEST9) != 0) {
616
617 /*
618 * The packet is bogus, so we throw it away before
619 * becoming a denial-of-service hazard. We don't throw
620 * the current association away if it is configured or
621 * if it has prior reachable friends.
622 */
623 if (!is_mystic && skeyid > NTP_MAXKEY)
624 authtrust(skeyid, 0);
625 if (!(peer->flags & FLAG_CONFIG) && peer->reach == 0)
626 unpeer(peer);
747 if (peer->flash) {
627#ifdef DEBUG
628 if (debug)
748#ifdef DEBUG
749 if (debug)
629 printf(
630 "invalid packet 0x%02x code %d assoc %d\n",
631 peer->flash, retcode, peer_associations);
750 printf("receive: bad auth %03x\n", peer->flash);
632#endif
633 return;
634 }
635
751#endif
752 return;
753 }
754
636#ifdef MD5
755#ifdef AUTOKEY
637 /*
756 /*
638 * The autokey dance. The cha-cha requires that the hash of the
639 * current session key matches the previous key identifier.
640 * Heaps of trouble if the steps falter.
757 * More autokey dance. The rules of the cha-cha are as follows:
758 *
759 * 1. If there is no key or the key is not auto, do nothing.
760 *
761 * 2. If an extension field contains a verified signature, it is
762 * self-authenticated and we sit the dance.
763 *
764 * 3. If this is a server reply, check only to see that the
765 * transmitted key ID matches the received key ID.
766 *
767 * 4. Check to see that one or more hashes of the current key ID
768 * matches the previous key ID or ultimate original key ID
769 * obtained from the broadcaster or symmetric peer. If no
770 * match, sit the dance and wait for timeout.
641 */
771 */
642 if (skeyid > NTP_MAXKEY) {
643 int i;
644
645 /*
646 * In the case of a new autokey, verify the hash matches
647 * one of the previous four hashes. If not, raise the
648 * authentication flasher and hope the next one works.
649 */
772 if (peer->flags & FLAG_SKEY) {
773 peer->flash |= TEST10;
774 crypto_recv(peer, rbufp);
775 poll_update(peer, peer->hpoll);
650 if (hismode == MODE_SERVER) {
776 if (hismode == MODE_SERVER) {
651 peer->pkeyid = peer->keyid;
652 } else if (peer->flags & FLAG_MCAST2) {
653 if (peer->pkeyid > NTP_MAXKEY)
654 authtrust(peer->pkeyid, 0);
655 for (i = 0; i < 4 && tkeyid != peer->pkeyid;
656 i++) {
657 tkeyid = session_key(
658 ntohl((&rbufp->recv_srcadr)->sin_addr.s_addr),
659 ntohl(rbufp->dstadr->bcast.sin_addr.s_addr),
660 tkeyid, 0);
661 }
777 if (skeyid == peer->keyid)
778 peer->flash &= ~TEST10;
779 } else if (!peer->flash & TEST10) {
780 peer->pkeyid = skeyid;
662 } else {
781 } else {
663 if (peer->pkeyid > NTP_MAXKEY)
664 authtrust(peer->pkeyid, 0);
665 for (i = 0; i < 4 && tkeyid != peer->pkeyid;
666 i++) {
782 int i;
783
784 for (i = 0; ; i++) {
785 if (tkeyid == peer->pkeyid ||
786 tkeyid == peer->recauto.key) {
787 peer->flash &= ~TEST10;
788 peer->pkeyid = skeyid;
789 break;
790 }
791 if (i > peer->recauto.seq)
792 break;
667 tkeyid = session_key(
793 tkeyid = session_key(
668 ntohl((&rbufp->recv_srcadr)->sin_addr.s_addr),
669 ntohl(rbufp->dstadr->sin.sin_addr.s_addr),
670 tkeyid, 0);
794 &rbufp->recv_srcadr, dstadr_sin,
795 tkeyid, pkeyid, 0);
671 }
672 }
796 }
797 }
673#ifdef XXX /* temp until certificate code is mplemented */
674 if (tkeyid != peer->pkeyid)
675 peer->flash |= TEST9; /* peer not authentic */
798#ifdef PUBKEY
799
800 /*
801 * This is delicious. Ordinarily, we kick out all errors
802 * at this point; however, in symmetric mode and just
803 * warming up, an unsynchronized peer must inject the
804 * timestamps, even if it fails further up the road. So,
805 * let the dude by here, but only if the jerk is not yet
806 * reachable. After that, he's on his own.
807 */
808 if (!(peer->flags & FLAG_PROVEN))
809 peer->flash |= TEST11;
810 if (peer->flash && peer->reach) {
811#ifdef DEBUG
812 if (debug)
813 printf("packet: bad autokey %03x\n",
814 peer->flash);
676#endif
815#endif
677 peer->pkeyid = skeyid;
816 return;
817 }
818#endif /* PUBKEY */
678 }
819 }
679#endif /* MD5 */
820#endif /* AUTOKEY */
680
681 /*
821
822 /*
682 * Gawdz, it's come to this. Process the dang packet. If
683 * something breaks and the association doesn't deserve to live,
684 * toss it. Be careful in active mode and return a packet
685 * anyway.
823 * We have survived the gaunt. Forward to the packet routine. If
824 * a symmetric passive association has been mobilized and the
825 * association doesn't deserve to live, it will die in the
826 * transmit routine if not reachable after timeout.
686 */
827 */
687 process_packet(peer, pkt, &(rbufp->recv_time));
688 if (!(peer->flags & FLAG_CONFIG) && peer->reach == 0) {
689 if (peer->hmode == MODE_PASSIVE) {
690 if (is_authentic)
691 fast_xmit(rbufp, MODE_PASSIVE, skeyid);
692 else
693 fast_xmit(rbufp, MODE_PASSIVE, 0);
694 }
695 unpeer(peer);
696 }
828 process_packet(peer, pkt, &rbufp->recv_time);
697}
698
699
700/*
701 * process_packet - Packet Procedure, a la Section 3.4.4 of the
702 * specification. Or almost, at least. If we're in here we have a
703 * reasonable expectation that we will be having a long term
704 * relationship with this host.
705 */
829}
830
831
832/*
833 * process_packet - Packet Procedure, a la Section 3.4.4 of the
834 * specification. Or almost, at least. If we're in here we have a
835 * reasonable expectation that we will be having a long term
836 * relationship with this host.
837 */
706int
838void
707process_packet(
708 register struct peer *peer,
709 register struct pkt *pkt,
710 l_fp *recv_ts
711 )
712{
713 l_fp t10, t23;
714 double p_offset, p_del, p_disp;
715 double dtemp;
716 l_fp p_rec, p_xmt, p_org, p_reftime;
717 l_fp ci;
839process_packet(
840 register struct peer *peer,
841 register struct pkt *pkt,
842 l_fp *recv_ts
843 )
844{
845 l_fp t10, t23;
846 double p_offset, p_del, p_disp;
847 double dtemp;
848 l_fp p_rec, p_xmt, p_org, p_reftime;
849 l_fp ci;
718 int pmode;
850 int pmode, pleap, pstratum;
719
720 /*
851
852 /*
721 * Swap header fields and keep the books.
853 * Swap header fields and keep the books. The books amount to
854 * the receive timestamp and poll interval in the header. We
855 * need these even if there are other problems in order to crank
856 * up the state machine.
722 */
723 sys_processed++;
724 peer->processed++;
725 p_del = FPTOD(NTOHS_FP(pkt->rootdelay));
726 p_disp = FPTOD(NTOHS_FP(pkt->rootdispersion));
727 NTOHL_FP(&pkt->reftime, &p_reftime);
728 NTOHL_FP(&pkt->rec, &p_rec);
729 NTOHL_FP(&pkt->xmt, &p_xmt);
730 if (PKT_MODE(pkt->li_vn_mode) != MODE_BROADCAST)
731 NTOHL_FP(&pkt->org, &p_org);
732 else
733 p_org = peer->rec;
857 */
858 sys_processed++;
859 peer->processed++;
860 p_del = FPTOD(NTOHS_FP(pkt->rootdelay));
861 p_disp = FPTOD(NTOHS_FP(pkt->rootdispersion));
862 NTOHL_FP(&pkt->reftime, &p_reftime);
863 NTOHL_FP(&pkt->rec, &p_rec);
864 NTOHL_FP(&pkt->xmt, &p_xmt);
865 if (PKT_MODE(pkt->li_vn_mode) != MODE_BROADCAST)
866 NTOHL_FP(&pkt->org, &p_org);
867 else
868 p_org = peer->rec;
734 peer->rec = *recv_ts;
735 peer->ppoll = pkt->ppoll;
736 pmode = PKT_MODE(pkt->li_vn_mode);
737
738 /*
869
870 /*
739 * Test for old or duplicate packets (tests 1 through 3).
871 * Test for old, duplicate or unsynch packets (tests 1-3).
740 */
872 */
873 peer->rec = *recv_ts;
874 pmode = PKT_MODE(pkt->li_vn_mode);
875 pleap = PKT_LEAP(pkt->li_vn_mode);
876 pstratum = PKT_TO_STRATUM(pkt->stratum);
741 if (L_ISHIS(&peer->org, &p_xmt)) /* count old packets */
742 peer->oldpkt++;
877 if (L_ISHIS(&peer->org, &p_xmt)) /* count old packets */
878 peer->oldpkt++;
743 if (L_ISEQU(&peer->org, &p_xmt)) /* test 1 */
744 peer->flash |= TEST1; /* duplicate packet */
745 if (PKT_MODE(pkt->li_vn_mode) != MODE_BROADCAST) {
746 if (!L_ISEQU(&peer->xmt, &p_org)) { /* test 2 */
747 peer->bogusorg++;
748 peer->flash |= TEST2; /* bogus packet */
749 }
750 if (L_ISZERO(&p_rec) || L_ISZERO(&p_org))
751 peer->flash |= TEST3; /* unsynchronized */
752 } else {
753 if (L_ISZERO(&p_org))
754 peer->flash |= TEST3; /* unsynchronized */
879 if (L_ISEQU(&peer->org, &p_xmt)) /* 1 */
880 peer->flash |= TEST1; /* dupe */
881 if (pmode != MODE_BROADCAST) {
882 if (!L_ISEQU(&peer->xmt, &p_org)) /* 2 */
883 peer->flash |= TEST2; /* bogus */
884 if (L_ISZERO(&p_rec) || L_ISZERO(&p_org)) /* test 3 */
885 peer->flash |= TEST3; /* unsynch */
755 }
886 }
887 if (L_ISZERO(&p_xmt)) /* 3 */
888 peer->flash |= TEST3; /* unsynch */
756 peer->org = p_xmt;
757
758 /*
889 peer->org = p_xmt;
890
891 /*
759 * Test for valid header (tests 5 through 10)
892 * If tests 1-3 fail, the packet is discarded leaving only the
893 * receive and origin timestamps and poll interval, which is
894 * enough to get the protocol started.
760 */
895 */
896 if (peer->flash) {
897#ifdef DEBUG
898 if (debug)
899 printf("packet: bad data %03x\n",
900 peer->flash);
901#endif
902 return;
903 }
904
905 /*
906 * A kiss-of-death (kod) packet is returned by a server in case
907 * the client is denied access. It consists of the client
908 * request packet with the leap bits indicating never
909 * synchronized, stratum zero and reference ID field the ASCII
910 * string "DENY". If the packet originate timestamp matches the
911 * association transmit timestamp the kod is legitimate. If the
912 * peer leap bits indicate never synchronized, this must be
913 * access deny and the association is disabled; otherwise this
914 * must be a limit reject. In either case a naughty message is
915 * forced to the system log.
916 */
917 if (pleap == LEAP_NOTINSYNC && pstratum >= STRATUM_UNSPEC &&
918 memcmp(&pkt->refid, "DENY", 4) == 0) {
919 if (peer->leap == LEAP_NOTINSYNC) {
920 peer->stratum = STRATUM_UNSPEC;
921 peer->flash |= TEST4;
922 memcpy(&peer->refid, &pkt->refid, 4);
923 msyslog(LOG_INFO, "access denied");
924 } else {
925 msyslog(LOG_INFO, "limit reject");
926 }
927 return;
928 }
929
930 /*
931 * Test for valid peer data (tests 6-8)
932 */
761 ci = p_xmt;
762 L_SUB(&ci, &p_reftime);
763 LFPTOD(&ci, dtemp);
933 ci = p_xmt;
934 L_SUB(&ci, &p_reftime);
935 LFPTOD(&ci, dtemp);
764 if (PKT_LEAP(pkt->li_vn_mode) == LEAP_NOTINSYNC || /* test 6 */
765 PKT_TO_STRATUM(pkt->stratum) >= NTP_MAXSTRATUM ||
766 dtemp < 0)
767 peer->flash |= TEST6; /* peer clock unsynchronized */
768 if (!(peer->flags & FLAG_CONFIG) && sys_peer != 0) { /* test 7 */
769 if (PKT_TO_STRATUM(pkt->stratum) > sys_stratum) {
770 peer->flash |= TEST7; /* peer stratum too high */
936 if (pleap == LEAP_NOTINSYNC || /* 6 */
937 pstratum >= STRATUM_UNSPEC || dtemp < 0)
938 peer->flash |= TEST6; /* bad synch */
939 if (!(peer->flags & FLAG_CONFIG) && sys_peer != NULL) { /* 7 */
940 if (pstratum > sys_stratum && pmode != MODE_ACTIVE) {
941 peer->flash |= TEST7; /* bad stratum */
771 sys_badstratum++;
772 }
773 }
942 sys_badstratum++;
943 }
944 }
774 if (fabs(p_del) >= MAXDISPERSE /* test 8 */
775 || p_disp >= MAXDISPERSE)
776 peer->flash |= TEST8; /* delay/dispersion too high */
777
778 /*
779 * If the packet header is invalid (tests 5 through 10), exit.
780 * XXX we let TEST9 sneak by until the certificate code is
781 * implemented, but only to mobilize the association.
782 */
783 if (peer->flash & (TEST5 | TEST6 | TEST7 | TEST8 | TEST10)) {
945 if (p_del < 0 || p_disp < 0 || p_del / /* 8 */
946 2 + p_disp >= MAXDISPERSE)
947 peer->flash |= TEST8; /* bad peer distance */
948 if (peer->flash) {
784#ifdef DEBUG
785 if (debug)
949#ifdef DEBUG
950 if (debug)
786 printf(
787 "invalid packet header 0x%02x mode %d\n",
788 peer->flash, pmode);
951 printf("packet: bad header %03x\n",
952 peer->flash);
789#endif
953#endif
790 return (0);
954 return;
791 }
792
793 /*
955 }
956
957 /*
794 * Valid header; update our state.
958 * The header is valid. Capture the remaining header values and
959 * mark as reachable.
795 */
960 */
796 record_raw_stats(&peer->srcadr, &peer->dstadr->sin,
797 &p_org, &p_rec, &p_xmt, &peer->rec);
798
799 peer->leap = PKT_LEAP(pkt->li_vn_mode);
800 peer->pmode = pmode; /* unspec */
801 peer->stratum = PKT_TO_STRATUM(pkt->stratum);
961 record_raw_stats(&peer->srcadr, &peer->dstadr->sin, &p_org,
962 &p_rec, &p_xmt, &peer->rec);
963 peer->leap = pleap;
964 peer->pmode = pmode;
965 peer->stratum = pstratum;
966 peer->ppoll = pkt->ppoll;
802 peer->precision = pkt->precision;
803 peer->rootdelay = p_del;
804 peer->rootdispersion = p_disp;
805 peer->refid = pkt->refid;
806 peer->reftime = p_reftime;
967 peer->precision = pkt->precision;
968 peer->rootdelay = p_del;
969 peer->rootdispersion = p_disp;
970 peer->refid = pkt->refid;
971 peer->reftime = p_reftime;
807 if (peer->reach == 0) {
972 if (!(peer->reach)) {
808 report_event(EVNT_REACH, peer);
809 peer->timereachable = current_time;
810 }
811 peer->reach |= 1;
973 report_event(EVNT_REACH, peer);
974 peer->timereachable = current_time;
975 }
976 peer->reach |= 1;
977 peer->unreach = 0;
812 poll_update(peer, peer->hpoll);
813
814 /*
815 * If running in a client/server association, calculate the
816 * clock offset c, roundtrip delay d and dispersion e. We use
817 * the equations (reordered from those in the spec). Note that,
818 * in a broadcast association, org has been set to the time of
819 * last reception. Note the computation of dispersion includes

--- 4 unchanged lines hidden (view full) ---

824 * d = (t2 - t3) - (t1 - t0)
825 * e = (org - rec) (seconds only)
826 */
827 t10 = p_xmt; /* compute t1 - t0 */
828 L_SUB(&t10, &peer->rec);
829 t23 = p_rec; /* compute t2 - t3 */
830 L_SUB(&t23, &p_org);
831 ci = t10;
978 poll_update(peer, peer->hpoll);
979
980 /*
981 * If running in a client/server association, calculate the
982 * clock offset c, roundtrip delay d and dispersion e. We use
983 * the equations (reordered from those in the spec). Note that,
984 * in a broadcast association, org has been set to the time of
985 * last reception. Note the computation of dispersion includes

--- 4 unchanged lines hidden (view full) ---

990 * d = (t2 - t3) - (t1 - t0)
991 * e = (org - rec) (seconds only)
992 */
993 t10 = p_xmt; /* compute t1 - t0 */
994 L_SUB(&t10, &peer->rec);
995 t23 = p_rec; /* compute t2 - t3 */
996 L_SUB(&t23, &p_org);
997 ci = t10;
832 p_disp = CLOCK_PHI * (peer->rec.l_ui - p_org.l_ui);
998 p_disp = clock_phi * (peer->rec.l_ui - p_org.l_ui);
833
834 /*
835 * If running in a broadcast association, the clock offset is
836 * (t1 - t0) corrected by the one-way delay, but we can't
999
1000 /*
1001 * If running in a broadcast association, the clock offset is
1002 * (t1 - t0) corrected by the one-way delay, but we can't
837 * measure that directly; therefore, we start up in
838 * client/server mode, calculate the clock offset, using the
839 * engineered refinement algorithms, while also receiving
840 * broadcasts. When a broadcast is received in client/server
841 * mode, we calculate a correction factor to use after switching
842 * back to broadcast mode. We know NTP_SKEWFACTOR == 16, which
843 * accounts for the simplified ei calculation.
844 *
845 * If FLAG_MCAST2 is set, we are a broadcast/multicast client.
846 * If FLAG_MCAST1 is set, we haven't calculated the propagation
847 * delay. If hmode is MODE_CLIENT, we haven't set the local
848 * clock in client/server mode. Initially, we come up
849 * MODE_CLIENT. When the clock is first updated and FLAG_MCAST2
850 * is set, we switch from MODE_CLIENT to MODE_BCLIENT.
1003 * measure that directly. Therefore, we start up in MODE_CLIENT
1004 * mode, set FLAG_MCAST and exchange eight messages to determine
1005 * the clock offset. When the last message is sent, we switch to
1006 * MODE_BCLIENT mode. The next broadcast message after that
1007 * computes the broadcast offset and clears FLAG_MCAST.
851 */
852 if (pmode == MODE_BROADCAST) {
1008 */
1009 if (pmode == MODE_BROADCAST) {
853 if (peer->flags & FLAG_MCAST1) {
854 if (peer->hmode == MODE_BCLIENT)
855 peer->flags &= ~FLAG_MCAST1;
1010 if (peer->flags & FLAG_MCAST) {
856 LFPTOD(&ci, p_offset);
857 peer->estbdelay = peer->offset - p_offset;
1011 LFPTOD(&ci, p_offset);
1012 peer->estbdelay = peer->offset - p_offset;
858 return (1);
1013 if (peer->hmode == MODE_CLIENT)
1014 return;
859
1015
1016 peer->flags &= ~FLAG_MCAST;
860 }
861 DTOLFP(peer->estbdelay, &t10);
862 L_ADD(&ci, &t10);
863 p_del = peer->delay;
864 } else {
865 L_ADD(&ci, &t23);
866 L_RSHIFT(&ci);
867 L_SUB(&t23, &t10);
868 LFPTOD(&t23, p_del);
869 }
1017 }
1018 DTOLFP(peer->estbdelay, &t10);
1019 L_ADD(&ci, &t10);
1020 p_del = peer->delay;
1021 } else {
1022 L_ADD(&ci, &t23);
1023 L_RSHIFT(&ci);
1024 L_SUB(&t23, &t10);
1025 LFPTOD(&t23, p_del);
1026 }
1027 p_del = max(p_del, LOGTOD(sys_precision));
870 LFPTOD(&ci, p_offset);
1028 LFPTOD(&ci, p_offset);
871 if (fabs(p_del) >= MAXDISPERSE || p_disp >= MAXDISPERSE) /* test 4 */
872 peer->flash |= TEST4; /* delay/dispersion too big */
1029 if ((peer->rootdelay + p_del) / 2. + peer->rootdispersion +
1030 p_disp >= MAXDISPERSE) /* 9 */
1031 peer->flash |= TEST9; /* bad peer distance */
873
874 /*
1032
1033 /*
875 * If the packet data are invalid (tests 1 through 4), exit.
1034 * If any flasher bits remain set at this point, abandon ship.
1035 * Otherwise, forward to the clock filter.
876 */
877 if (peer->flash) {
878#ifdef DEBUG
879 if (debug)
1036 */
1037 if (peer->flash) {
1038#ifdef DEBUG
1039 if (debug)
880 printf("invalid packet data 0x%02x mode %d\n",
881 peer->flash, pmode);
1040 printf("packet: bad packet data %03x\n",
1041 peer->flash);
882#endif
1042#endif
883 return(1);
1043 return;
884 }
1044 }
885
886
887 /*
888 * This one is valid. Mark it so, give it to clock_filter().
889 */
890 clock_filter(peer, p_offset, p_del, fabs(p_disp));
1045 clock_filter(peer, p_offset, p_del, p_disp);
891 clock_select();
892 record_peer_stats(&peer->srcadr, ctlpeerstatus(peer),
893 peer->offset, peer->delay, peer->disp,
1046 clock_select();
1047 record_peer_stats(&peer->srcadr, ctlpeerstatus(peer),
1048 peer->offset, peer->delay, peer->disp,
894 SQRT(peer->variance));
895 return(1);
1049 SQRT(peer->jitter));
896}
897
898
899/*
900 * clock_update - Called at system process update intervals.
901 */
902static void
903clock_update(void)
904{
905 u_char oleap;
906 u_char ostratum;
1050}
1051
1052
1053/*
1054 * clock_update - Called at system process update intervals.
1055 */
1056static void
1057clock_update(void)
1058{
1059 u_char oleap;
1060 u_char ostratum;
907 int i;
908 struct peer *peer;
909
910 /*
911 * Reset/adjust the system clock. Do this only if there is a
912 * system peer and we haven't seen that peer lately. Watch for
913 * timewarps here.
914 */
1061
1062 /*
1063 * Reset/adjust the system clock. Do this only if there is a
1064 * system peer and we haven't seen that peer lately. Watch for
1065 * timewarps here.
1066 */
915 if (sys_peer == 0)
1067 if (sys_peer == NULL)
916 return;
917 if (sys_peer->pollsw == FALSE || sys_peer->burst > 0)
918 return;
919 sys_peer->pollsw = FALSE;
920#ifdef DEBUG
921 if (debug)
922 printf("clock_update: at %ld assoc %d \n", current_time,
923 peer_associations);
924#endif
925 oleap = sys_leap;
926 ostratum = sys_stratum;
1068 return;
1069 if (sys_peer->pollsw == FALSE || sys_peer->burst > 0)
1070 return;
1071 sys_peer->pollsw = FALSE;
1072#ifdef DEBUG
1073 if (debug)
1074 printf("clock_update: at %ld assoc %d \n", current_time,
1075 peer_associations);
1076#endif
1077 oleap = sys_leap;
1078 ostratum = sys_stratum;
927 switch (local_clock(sys_peer, sys_offset, sys_epsil)) {
1079 switch (local_clock(sys_peer, sys_offset, sys_syserr)) {
928
1080
929 case -1:
930 /*
931 * Clock is too screwed up. Just exit for now.
932 */
1081 /*
1082 * Clock is too screwed up. Just exit for now.
1083 */
1084 case -1:
933 report_event(EVNT_SYSFAULT, (struct peer *)0);
934 exit(1);
935 /*NOTREACHED*/
936
1085 report_event(EVNT_SYSFAULT, (struct peer *)0);
1086 exit(1);
1087 /*NOTREACHED*/
1088
937 case 1:
938 /*
939 * Clock was stepped. Clear filter registers
940 * of all peers.
941 */
942 for (i = 0; i < HASH_SIZE; i++) {
943 for (peer = peer_hash[i]; peer != 0;
944 peer =peer->next)
945 peer_clear(peer);
946 }
947 NLOG(NLOG_SYNCSTATUS)
948 msyslog(LOG_INFO, "synchronisation lost");
949 sys_peer = 0;
1089 /*
1090 * Clock was stepped. Flush all time values of all peers.
1091 */
1092 case 1:
1093 clear_all();
1094 sys_peer = NULL;
950 sys_stratum = STRATUM_UNSPEC;
1095 sys_stratum = STRATUM_UNSPEC;
1096 sys_poll = NTP_MINPOLL;
1097 NLOG(NLOG_SYNCSTATUS)
1098 msyslog(LOG_INFO, "synchronisation lost");
951 report_event(EVNT_CLOCKRESET, (struct peer *)0);
952 break;
953
1099 report_event(EVNT_CLOCKRESET, (struct peer *)0);
1100 break;
1101
954 default:
955 /*
956 * Update the system stratum, leap bits, root delay,
957 * root dispersion, reference ID and reference time. We
958 * also update select dispersion and max frequency
959 * error.
960 */
1102 /*
1103 * Update the system stratum, leap bits, root delay, root
1104 * dispersion, reference ID and reference time. We also update
1105 * select dispersion and max frequency error. If the leap
1106 * changes, we gotta reroll the keys.
1107 */
1108 default:
961 sys_stratum = sys_peer->stratum + 1;
962 if (sys_stratum == 1)
963 sys_refid = sys_peer->refid;
964 else
965 sys_refid = sys_peer->srcadr.sin_addr.s_addr;
966 sys_reftime = sys_peer->rec;
1109 sys_stratum = sys_peer->stratum + 1;
1110 if (sys_stratum == 1)
1111 sys_refid = sys_peer->refid;
1112 else
1113 sys_refid = sys_peer->srcadr.sin_addr.s_addr;
1114 sys_reftime = sys_peer->rec;
967 sys_rootdelay = sys_peer->rootdelay +
968 fabs(sys_peer->delay);
1115 sys_rootdelay = sys_peer->rootdelay + sys_peer->delay;
969 sys_leap = leap_consensus;
970 }
1116 sys_leap = leap_consensus;
1117 }
971 if (oleap != sys_leap)
1118 if (oleap == LEAP_NOTINSYNC) {
972 report_event(EVNT_SYNCCHG, (struct peer *)0);
1119 report_event(EVNT_SYNCCHG, (struct peer *)0);
1120#ifdef AUTOKEY
1121 expire_all();
1122#endif /* AUTOKEY */
1123 }
973 if (ostratum != sys_stratum)
974 report_event(EVNT_PEERSTCHG, (struct peer *)0);
975}
976
977
978/*
1124 if (ostratum != sys_stratum)
1125 report_event(EVNT_PEERSTCHG, (struct peer *)0);
1126}
1127
1128
1129/*
979 * poll_update - update peer poll interval. See Section 3.4.9 of the
980 * spec.
1130 * poll_update - update peer poll interval
981 */
982void
983poll_update(
984 struct peer *peer,
985 int hpoll
986 )
987{
1131 */
1132void
1133poll_update(
1134 struct peer *peer,
1135 int hpoll
1136 )
1137{
988 long update;
1138#ifdef AUTOKEY
1139 int oldpoll;
1140#endif /* AUTOKEY */
989
990 /*
1141
1142 /*
991 * The wiggle-the-poll-interval dance. Broadcasters dance only
992 * the minpoll beat. Reference clock partners sit this one out.
993 * Dancers surviving the clustering algorithm beat to the system
994 * clock. Broadcast clients are usually lead by their broadcast
995 * partner, but faster in the initial mating dance.
1143 * A little foxtrot to determine what controls the poll
1144 * interval. If the peer is reachable, but the last four polls
1145 * have not been answered, use the minimum. If declared
1146 * truechimer, use the system poll interval. This allows each
1147 * association to ramp up the poll interval for useless sources
1148 * and to clamp it to the minimum when first starting up.
996 */
1149 */
997 if (peer->hmode == MODE_BROADCAST) {
1150#ifdef AUTOKEY
1151 oldpoll = peer->kpoll;
1152#endif /* AUTOKEY */
1153 if (hpoll > peer->maxpoll)
1154 peer->hpoll = peer->maxpoll;
1155 else if (hpoll < peer->minpoll)
998 peer->hpoll = peer->minpoll;
1156 peer->hpoll = peer->minpoll;
999 } else if (peer->flags & FLAG_SYSPEER) {
1000 peer->hpoll = sys_poll;
1001 } else {
1002 if (hpoll > peer->maxpoll)
1003 peer->hpoll = peer->maxpoll;
1004 else if (hpoll < peer->minpoll)
1005 peer->hpoll = peer->minpoll;
1006 else
1007 peer->hpoll = hpoll;
1008 }
1157 else
1158 peer->hpoll = hpoll;
1159
1160 /*
1161 * Bit of adventure here. If during a burst and not timeout,
1162 * just slink away. If timeout, figure what the next timeout
1163 * should be. If IBURST or a reference clock, use one second. If
1164 * not and the dude was reachable during the previous poll
1165 * interval, randomize over 1-4 seconds; otherwise, randomize
1166 * over 15-18 seconds. This is to give time for a modem to
1167 * complete the call, for example. If not during a burst,
1168 * randomize over the poll interval -1 to +2 seconds.
1169 *
1170 * In case of manycast server, make the poll interval, which is
1171 * axtually the manycast beacon interval, eight times the system
1172 * poll interval. Normally when the host poll interval settles
1173 * up to 17.1 s, the beacon interval settles up to 2.3 hours.
1174 */
1009 if (peer->burst > 0) {
1010 if (peer->nextdate != current_time)
1011 return;
1175 if (peer->burst > 0) {
1176 if (peer->nextdate != current_time)
1177 return;
1012 if (peer->flags & FLAG_REFCLOCK)
1178#ifdef REFCLOCK
1179 else if (peer->flags & FLAG_REFCLOCK)
1013 peer->nextdate++;
1180 peer->nextdate++;
1181#endif
1014 else if (peer->reach & 0x1)
1015 peer->nextdate += RANDPOLL(BURST_INTERVAL2);
1016 else
1017 peer->nextdate += RANDPOLL(BURST_INTERVAL1);
1182 else if (peer->reach & 0x1)
1183 peer->nextdate += RANDPOLL(BURST_INTERVAL2);
1184 else
1185 peer->nextdate += RANDPOLL(BURST_INTERVAL1);
1186 } else if (peer->cast_flags & MDF_ACAST) {
1187 if (sys_survivors < NTP_MINCLOCK)
1188 peer->kpoll = peer->hpoll;
1189 else
1190 peer->kpoll = peer->hpoll + 3;
1191 peer->nextdate = peer->outdate + RANDPOLL(peer->kpoll);
1018 } else {
1192 } else {
1019 update = max(min(peer->ppoll, peer->hpoll),
1193 peer->kpoll = max(min(peer->ppoll, peer->hpoll),
1020 peer->minpoll);
1194 peer->minpoll);
1021 peer->nextdate = peer->outdate + RANDPOLL(update);
1195 peer->nextdate = peer->outdate + RANDPOLL(peer->kpoll);
1022 }
1196 }
1197 if (peer->nextdate < current_time)
1198 peer->nextdate = current_time;
1199#ifdef AUTOKEY
1200 /*
1201 * Bit of crass arrogance at this point. If the poll interval
1202 * has changed and we have a keylist, the lifetimes in the
1203 * keylist are probably bogus. In this case purge the keylist
1204 * and regenerate it later.
1205 */
1206 if (peer->kpoll != oldpoll)
1207 key_expire(peer);
1208#endif /* AUTOKEY */
1023#ifdef DEBUG
1024 if (debug > 1)
1209#ifdef DEBUG
1210 if (debug > 1)
1025 printf("poll_update: at %lu %s poll %d burst %d last %lu next %lu\n",
1026 current_time, ntoa(&peer->srcadr), hpoll,
1027 peer->burst, peer->outdate, peer->nextdate);
1211 printf("poll_update: at %lu %s flags %04x poll %d burst %d last %lu next %lu\n",
1212 current_time, ntoa(&peer->srcadr), peer->flags,
1213 peer->kpoll, peer->burst, peer->outdate,
1214 peer->nextdate);
1028#endif
1029}
1030
1031
1032/*
1033 * clear - clear peer filter registers. See Section 3.4.8 of the spec.
1034 */
1035void
1036peer_clear(
1037 register struct peer *peer
1038 )
1039{
1040 register int i;
1215#endif
1216}
1217
1218
1219/*
1220 * clear - clear peer filter registers. See Section 3.4.8 of the spec.
1221 */
1222void
1223peer_clear(
1224 register struct peer *peer
1225 )
1226{
1227 register int i;
1228 u_long u_rand;
1041
1229
1230 /*
1231 * If cryptographic credentials have been acquired, toss them to
1232 * Valhalla. Note that autokeys are ephemeral, in that they are
1233 * tossed immediately upon use. Therefore, the keylist can be
1234 * purged anytime without needing to preserve random keys. Note
1235 * that, if the peer is purged, the cryptographic variables are
1236 * purged, too. This makes it much harder to sneak in some
1237 * unauthenticated data in the clock filter.
1238 */
1239#ifdef DEBUG
1240 if (debug)
1241 printf("peer_clear: at %ld assoc ID %d\n", current_time,
1242 peer->associd);
1243#endif
1244#ifdef AUTOKEY
1245 key_expire(peer);
1246#ifdef PUBKEY
1247 if (peer->keystr != NULL)
1248 free(peer->keystr);
1249 if (peer->pubkey.ptr != NULL)
1250 free(peer->pubkey.ptr);
1251 if (peer->certif.ptr != NULL)
1252 free(peer->certif.ptr);
1253#endif /* PUBKEY */
1254#endif /* AUTOKEY */
1042 memset(CLEAR_TO_ZERO(peer), 0, LEN_CLEAR_TO_ZERO);
1255 memset(CLEAR_TO_ZERO(peer), 0, LEN_CLEAR_TO_ZERO);
1256
1257 /*
1258 * If he dies as a broadcast client, he comes back to life as
1259 * a broadcast client in client mode in order to recover the
1260 * initial autokey values. Note that there is no need to call
1261 * clock_select(), since the perp has already been voted off
1262 * the island at this point.
1263 */
1264 if (peer->cast_flags & MDF_BCLNT) {
1265 peer->flags |= FLAG_MCAST;
1266 peer->hmode = MODE_CLIENT;
1267 }
1268 peer->flags &= ~(FLAG_AUTOKEY | FLAG_ASSOC);
1043 peer->estbdelay = sys_bdelay;
1269 peer->estbdelay = sys_bdelay;
1044 peer->hpoll = peer->minpoll;
1270 peer->hpoll = peer->kpoll = peer->minpoll;
1271 peer->ppoll = peer->maxpoll;
1045 peer->pollsw = FALSE;
1272 peer->pollsw = FALSE;
1046 peer->variance = MAXDISPERSE;
1273 peer->jitter = MAXDISPERSE;
1047 peer->epoch = current_time;
1274 peer->epoch = current_time;
1275#ifdef REFCLOCK
1276 if (!(peer->flags & FLAG_REFCLOCK)) {
1277 peer->leap = LEAP_NOTINSYNC;
1278 peer->stratum = STRATUM_UNSPEC;
1279 }
1280#endif
1048 for (i = 0; i < NTP_SHIFT; i++) {
1049 peer->filter_order[i] = i;
1050 peer->filter_disp[i] = MAXDISPERSE;
1051 peer->filter_epoch[i] = current_time;
1052 }
1281 for (i = 0; i < NTP_SHIFT; i++) {
1282 peer->filter_order[i] = i;
1283 peer->filter_disp[i] = MAXDISPERSE;
1284 peer->filter_epoch[i] = current_time;
1285 }
1053 poll_update(peer, peer->minpoll);
1054
1055 /*
1286
1287 /*
1056 * Since we have a chance to correct possible funniness in
1057 * our selection of interfaces on a multihomed host, do so
1058 * by setting us to no particular interface.
1059 * WARNING: do so only in non-broadcast mode!
1288 * Randomize the first poll over 1-16s to avoid bunching.
1060 */
1289 */
1061 if (peer->hmode != MODE_BROADCAST)
1062 peer->dstadr = any_interface;
1290 peer->update = peer->outdate = current_time;
1291 u_rand = RANDOM;
1292 peer->nextdate = current_time + (u_rand & ((1 <<
1293 BURST_INTERVAL1) - 1)) + 1;
1063}
1064
1065
1066/*
1067 * clock_filter - add incoming clock sample to filter register and run
1068 * the filter procedure to find the best sample.
1069 */
1070void
1071clock_filter(
1294}
1295
1296
1297/*
1298 * clock_filter - add incoming clock sample to filter register and run
1299 * the filter procedure to find the best sample.
1300 */
1301void
1302clock_filter(
1072 register struct peer *peer,
1073 double sample_offset,
1074 double sample_delay,
1075 double sample_disp
1303 register struct peer *peer, /* peer structure pointer */
1304 double sample_offset, /* clock offset */
1305 double sample_delay, /* roundtrip delay */
1306 double sample_disp /* dispersion */
1076 )
1077{
1307 )
1308{
1078 register int i, j, k, n = 0;
1079 register u_char *ord;
1080 double distance[NTP_SHIFT];
1081 double x, y, z, off;
1309 double dst[NTP_SHIFT]; /* distance vector */
1310 int ord[NTP_SHIFT]; /* index vector */
1311 register int i, j, k, m;
1312 double dsp, jit, dtemp, etemp;
1082
1083 /*
1313
1314 /*
1084 * Update error bounds and calculate distances. Also initialize
1085 * sort index vector.
1315 * Shift the new sample into the register and discard the oldest
1316 * one. The new offset and delay come directly from the
1317 * timestamp calculations. The dispersion grows from the last
1318 * outbound packet or reference clock update to the present time
1319 * and increased by the sum of the peer precision and the system
1320 * precision. The delay can sometimes swing negative due to
1321 * frequency skew, so it is clamped non-negative.
1086 */
1322 */
1087 x = CLOCK_PHI * (current_time - peer->update);
1088 peer->update = current_time;
1089 ord = peer->filter_order;
1323 dsp = min(LOGTOD(peer->precision) + LOGTOD(sys_precision) +
1324 sample_disp, MAXDISPERSE);
1090 j = peer->filter_nextpt;
1325 j = peer->filter_nextpt;
1091 for (i = 0; i < NTP_SHIFT; i++) {
1092 peer->filter_disp[j] += x;
1093 if (peer->filter_disp[j] > MAXDISPERSE)
1094 peer->filter_disp[j] = MAXDISPERSE;
1095 distance[i] = fabs(peer->filter_delay[j]) / 2 +
1096 peer->filter_disp[j];
1097 ord[i] = j;
1098 if (--j < 0)
1099 j += NTP_SHIFT;
1100 }
1326 peer->filter_offset[j] = sample_offset;
1327 peer->filter_delay[j] = max(0, sample_delay);
1328 peer->filter_disp[j] = dsp;
1329 peer->filter_epoch[j] = current_time;
1330 j++; j %=NTP_SHIFT;
1331 peer->filter_nextpt = j;
1101
1102 /*
1332
1333 /*
1103 * Insert the new sample at the beginning of the register.
1334 * Update dispersions since the last update and at the same
1335 * time initialize the distance and index lists. The distance
1336 * list uses a compound metric. If the sample is valid and
1337 * younger than the minimum Allan intercept, use delay;
1338 * otherwise, use biased dispersion.
1104 */
1339 */
1105 peer->filter_offset[peer->filter_nextpt] = sample_offset;
1106 peer->filter_delay[peer->filter_nextpt] = sample_delay;
1107 x = LOGTOD(peer->precision) + LOGTOD(sys_precision) +
1108 sample_disp;
1109 peer->filter_disp[peer->filter_nextpt] = min(x, MAXDISPERSE);
1110 peer->filter_epoch[peer->filter_nextpt] = current_time;
1111 distance[0] = min(x + fabs(sample_delay) / 2, MAXDISTANCE);
1112 peer->filter_nextpt++;
1113 if (peer->filter_nextpt >= NTP_SHIFT)
1114 peer->filter_nextpt = 0;
1340 dtemp = clock_phi * (current_time - peer->update);
1341 peer->update = current_time;
1342 for (i = NTP_SHIFT - 1; i >= 0; i--) {
1343 if (i != 0) {
1344 peer->filter_disp[j] += dtemp;
1345 if (peer->filter_disp[j] > MAXDISPERSE)
1346 peer->filter_disp[j] = MAXDISPERSE;
1347 }
1348 if (peer->filter_disp[j] >= MAXDISPERSE)
1349 dst[i] = MAXDISPERSE;
1350 else if (peer->update - peer->filter_epoch[j] >
1351 allan_xpt)
1352 dst[i] = MAXDISTANCE + peer->filter_disp[j];
1353 else
1354 dst[i] = peer->filter_delay[j];
1355 ord[i] = j;
1356 j++; j %= NTP_SHIFT;
1357 }
1115
1358
1116 /*
1117 * Sort the samples in the register by distance. The winning
1118 * sample will be in ord[0]. Sort the samples only if they
1119 * are younger than the Allen intercept.
1359 /*
1360 * Sort the samples in both lists by distance.
1120 */
1361 */
1121 y = min(allan_xpt, NTP_SHIFT * ULOGTOD(sys_poll));
1122 for (n = 0; n < NTP_SHIFT && current_time -
1123 peer->filter_epoch[ord[n]] <= y; n++) {
1124 for (j = 0; j < n; j++) {
1125 if (distance[j] > distance[n]) {
1126 x = distance[j];
1362 for (i = 1; i < NTP_SHIFT; i++) {
1363 for (j = 0; j < i; j++) {
1364 if (dst[j] > dst[i]) {
1127 k = ord[j];
1365 k = ord[j];
1128 distance[j] = distance[n];
1129 ord[j] = ord[n];
1130 distance[n] = x;
1131 ord[n] = k;
1366 ord[j] = ord[i];
1367 ord[i] = k;
1368 etemp = dst[j];
1369 dst[j] = dst[i];
1370 dst[i] = etemp;
1132 }
1133 }
1371 }
1372 }
1134 }
1373 }
1374
1375 /*
1376 * Copy the index list to the association structure so ntpq
1377 * can see it later. Prune the distance list to samples less
1378 * than MAXDISTANCE, but keep at least two valid samples for
1379 * jitter calculation.
1380 */
1381 m = 0;
1382 for (i = 0; i < NTP_SHIFT; i++) {
1383 peer->filter_order[i] = ord[i];
1384 if (dst[i] >= MAXDISPERSE || (m >= 2 && dst[i] >=
1385 MAXDISTANCE))
1386 continue;
1387 m++;
1388 }
1135
1136 /*
1389
1390 /*
1137 * Compute the error bound and standard error.
1391 * Compute the dispersion and jitter squares. The dispersion
1392 * is weighted exponentially by NTP_FWEIGHT (0.5) so it is
1393 * normalized close to 1.0. The jitter is the mean of the square
1394 * differences relative to the lowest delay sample. If no
1395 * acceptable samples remain in the shift register, quietly
1396 * tiptoe home leaving only the
1397 * dispersion.
1138 */
1398 */
1139 x = y = z = off = 0.;
1399 jit = 0;
1400 peer->disp = 0;
1401 k = ord[0];
1140 for (i = NTP_SHIFT - 1; i >= 0; i--) {
1402 for (i = NTP_SHIFT - 1; i >= 0; i--) {
1141 x = NTP_FWEIGHT * (x + peer->filter_disp[ord[i]]);
1142 if (i < n) {
1143 z += 1. / distance[i];
1144 off += peer->filter_offset[ord[i]] /
1145 distance[i];
1146 y += DIFF(peer->filter_offset[ord[i]],
1147 peer->filter_offset[ord[0]]);
1148 }
1403
1404 j = ord[i];
1405 peer->disp = NTP_FWEIGHT * (peer->disp +
1406 peer->filter_disp[j]);
1407 if (i < m)
1408 jit += DIFF(peer->filter_offset[j],
1409 peer->filter_offset[k]);
1149 }
1410 }
1150 peer->delay = peer->filter_delay[ord[0]];
1151 peer->variance = min(y / n, MAXDISPERSE);
1152 peer->disp = min(x, MAXDISPERSE);
1153 peer->epoch = current_time;
1154 x = peer->offset;
1155 if (peer->flags & FLAG_BURST)
1156 peer->offset = off / z;
1157 else
1158 peer->offset = peer->filter_offset[ord[0]];
1159
1160 /*
1411
1412 /*
1413 * If no acceptable samples remain in the shift register,
1414 * quietly tiptoe home leaving only the dispersion. Otherwise,
1415 * save the offset, delay and jitter average. Note the jitter
1416 * must not be less than the system precision.
1417 */
1418 if (m == 0)
1419 return;
1420 etemp = peer->offset;
1421 peer->offset = peer->filter_offset[k];
1422 peer->delay = peer->filter_delay[k];
1423 if (m > 1)
1424 jit /= m - 1;
1425 peer->jitter = max(jit, SQUARE(LOGTOD(sys_precision)));
1426
1427 /*
1161 * A new sample is useful only if it is younger than the last
1162 * one used.
1163 */
1428 * A new sample is useful only if it is younger than the last
1429 * one used.
1430 */
1164 if (peer->filter_epoch[ord[0]] > peer->epoch) {
1431 if (peer->filter_epoch[k] <= peer->epoch) {
1165#ifdef DEBUG
1166 if (debug)
1167 printf("clock_filter: discard %lu\n",
1432#ifdef DEBUG
1433 if (debug)
1434 printf("clock_filter: discard %lu\n",
1168 peer->filter_epoch[ord[0]] - peer->epoch);
1435 peer->epoch - peer->filter_epoch[k]);
1169#endif
1170 return;
1171 }
1172
1173 /*
1436#endif
1437 return;
1438 }
1439
1440 /*
1174 * If the offset exceeds the dispersion by CLOCK_SGATE and the
1175 * interval since the last update is less than twice the system
1176 * poll interval, consider the update a popcorn spike and ignore
1177 * it.
1441 * If the difference between the last offset and the current one
1442 * exceeds the jitter by CLOCK_SGATE (4) and the interval since
1443 * the last update is less than twice the system poll interval,
1444 * consider the update a popcorn spike and ignore it.
1178 */
1445 */
1179 if (fabs(x - peer->offset) > CLOCK_SGATE &&
1180 peer->filter_epoch[ord[0]] - peer->epoch < (1 <<
1181 (sys_poll + 1))) {
1446 if (m > 1 && fabs(peer->offset - etemp) > SQRT(peer->jitter) *
1447 CLOCK_SGATE && peer->filter_epoch[k] - peer->epoch <
1448 (1 << (sys_poll + 1))) {
1182#ifdef DEBUG
1183 if (debug)
1449#ifdef DEBUG
1450 if (debug)
1184 printf("clock_filter: popcorn spike %.6f\n", x);
1451 printf("clock_filter: n %d popcorn spike %.6f jitter %.6f\n",
1452 m, peer->offset, SQRT(peer->jitter));
1185#endif
1186 return;
1187 }
1453#endif
1454 return;
1455 }
1188 peer->epoch = peer->filter_epoch[ord[0]];
1456
1457 /*
1458 * The mitigated sample statistics are saved for later
1459 * processing, but can be processed only once.
1460 */
1461 peer->epoch = peer->filter_epoch[k];
1189 peer->pollsw = TRUE;
1190#ifdef DEBUG
1191 if (debug)
1192 printf(
1462 peer->pollsw = TRUE;
1463#ifdef DEBUG
1464 if (debug)
1465 printf(
1193 "clock_filter: offset %.6f delay %.6f disp %.6f std %.6f, age %lu\n",
1194 peer->offset, peer->delay, peer->disp,
1195 SQRT(peer->variance), current_time - peer->epoch);
1466 "clock_filter: n %d off %.6f del %.6f dsp %.6f jit %.6f, age %lu\n",
1467 m, peer->offset, peer->delay, peer->disp,
1468 SQRT(peer->jitter), peer->update - peer->epoch);
1196#endif
1197}
1198
1199
1200/*
1201 * clock_select - find the pick-of-the-litter clock
1202 */
1203void
1204clock_select(void)
1205{
1206 register struct peer *peer;
1469#endif
1470}
1471
1472
1473/*
1474 * clock_select - find the pick-of-the-litter clock
1475 */
1476void
1477clock_select(void)
1478{
1479 register struct peer *peer;
1207 int i;
1208 int nlist, nl3;
1480 int i, j, k, n;
1481 int nreach, nlist, nl3;
1209 double d, e, f;
1482 double d, e, f;
1210 int j;
1211 int n;
1212 int allow, found, k;
1483 int allow, found, sw;
1213 double high, low;
1214 double synch[NTP_MAXCLOCK], error[NTP_MAXCLOCK];
1215 struct peer *osys_peer;
1484 double high, low;
1485 double synch[NTP_MAXCLOCK], error[NTP_MAXCLOCK];
1486 struct peer *osys_peer;
1216 struct peer *typeacts = 0;
1217 struct peer *typelocal = 0;
1218 struct peer *typepps = 0;
1219 struct peer *typeprefer = 0;
1220 struct peer *typesystem = 0;
1487 struct peer *typeacts = NULL;
1488 struct peer *typelocal = NULL;
1489 struct peer *typepps = NULL;
1490 struct peer *typesystem = NULL;
1221
1222 static int list_alloc = 0;
1223 static struct endpoint *endpoint = NULL;
1491
1492 static int list_alloc = 0;
1493 static struct endpoint *endpoint = NULL;
1224 static int *index = NULL;
1494 static int *indx = NULL;
1225 static struct peer **peer_list = NULL;
1226 static u_int endpoint_size = 0;
1495 static struct peer **peer_list = NULL;
1496 static u_int endpoint_size = 0;
1227 static u_int index_size = 0;
1497 static u_int indx_size = 0;
1228 static u_int peer_list_size = 0;
1229
1230 /*
1498 static u_int peer_list_size = 0;
1499
1500 /*
1231 * Initialize. If a prefer peer does not survive this thing,
1232 * the pps_update switch will remain zero.
1501 * Initialize and create endpoint, index and peer lists big
1502 * enough to handle all associations.
1233 */
1503 */
1234 pps_update = 0;
1235 nlist = 0;
1504 osys_peer = sys_peer;
1505 sys_peer = NULL;
1506 sys_prefer = NULL;
1507 nreach = nlist = 0;
1236 low = 1e9;
1237 high = -1e9;
1238 for (n = 0; n < HASH_SIZE; n++)
1239 nlist += peer_hash_count[n];
1240 if (nlist > list_alloc) {
1241 if (list_alloc > 0) {
1242 free(endpoint);
1508 low = 1e9;
1509 high = -1e9;
1510 for (n = 0; n < HASH_SIZE; n++)
1511 nlist += peer_hash_count[n];
1512 if (nlist > list_alloc) {
1513 if (list_alloc > 0) {
1514 free(endpoint);
1243 free(index);
1515 free(indx);
1244 free(peer_list);
1245 }
1246 while (list_alloc < nlist) {
1247 list_alloc += 5;
1516 free(peer_list);
1517 }
1518 while (list_alloc < nlist) {
1519 list_alloc += 5;
1248 endpoint_size += 5 * 3 * sizeof *endpoint;
1249 index_size += 5 * 3 * sizeof *index;
1250 peer_list_size += 5 * sizeof *peer_list;
1520 endpoint_size += 5 * 3 * sizeof(*endpoint);
1521 indx_size += 5 * 3 * sizeof(*indx);
1522 peer_list_size += 5 * sizeof(*peer_list);
1251 }
1252 endpoint = (struct endpoint *)emalloc(endpoint_size);
1523 }
1524 endpoint = (struct endpoint *)emalloc(endpoint_size);
1253 index = (int *)emalloc(index_size);
1525 indx = (int *)emalloc(indx_size);
1254 peer_list = (struct peer **)emalloc(peer_list_size);
1255 }
1256
1257 /*
1526 peer_list = (struct peer **)emalloc(peer_list_size);
1527 }
1528
1529 /*
1258 * This first chunk of code is supposed to go through all
1259 * peers we know about to find the peers which are most likely
1260 * to succeed. We run through the list doing the sanity checks
1261 * and trying to insert anyone who looks okay.
1530 * Initially, we populate the island with all the rifraff peers
1531 * that happen to be lying around. Those with seriously
1532 * defective clocks are immediately booted off the island. Then,
1533 * the falsetickers are culled and put to sea. The truechimers
1534 * remaining are subject to repeated rounds where the most
1535 * unpopular at each round is kicked off. When the population
1536 * has dwindled to NTP_MINCLOCK (3), the survivors split a
1537 * million bucks and collectively crank the chimes.
1262 */
1263 nlist = nl3 = 0; /* none yet */
1264 for (n = 0; n < HASH_SIZE; n++) {
1538 */
1539 nlist = nl3 = 0; /* none yet */
1540 for (n = 0; n < HASH_SIZE; n++) {
1265 for (peer = peer_hash[n]; peer != 0; peer = peer->next) {
1541 for (peer = peer_hash[n]; peer != NULL; peer =
1542 peer->next) {
1266 peer->flags &= ~FLAG_SYSPEER;
1267 peer->status = CTL_PST_SEL_REJECT;
1543 peer->flags &= ~FLAG_SYSPEER;
1544 peer->status = CTL_PST_SEL_REJECT;
1268 if (peer->flags & FLAG_NOSELECT)
1269 continue; /* noselect (survey) */
1270 if (peer->reach == 0)
1271 continue; /* unreachable */
1272 if (peer->stratum > 1 && peer->refid ==
1273 peer->dstadr->sin.sin_addr.s_addr)
1274 continue; /* sync loop */
1275 if (root_distance(peer) >= MAXDISTANCE + 2 *
1276 CLOCK_PHI * ULOGTOD(sys_poll)) {
1277 peer->seldisptoolarge++;
1278 continue; /* noisy or broken */
1279 }
1280
1281 /*
1545
1546 /*
1282 * Don't allow the local-clock or acts drivers
1547 * A peer leaves the island immediately if
1548 * unreachable, synchronized to us or suffers
1549 * excessive root distance. Careful with the
1550 * root distance, since the poll interval can
1551 * increase to a day and a half.
1552 */
1553 if (!peer->reach || (peer->stratum > 1 &&
1554 peer->refid ==
1555 peer->dstadr->sin.sin_addr.s_addr) ||
1556 peer->stratum >= STRATUM_UNSPEC ||
1557 (root_distance(peer) >= MAXDISTANCE + 2 *
1558 clock_phi * ULOGTOD(sys_poll)))
1559 continue;
1560
1561 /*
1562 * Don't allow the local clock or modem drivers
1283 * in the kitchen at this point, unless the
1284 * prefer peer. Do that later, but only if
1563 * in the kitchen at this point, unless the
1564 * prefer peer. Do that later, but only if
1285 * nobody else is around.
1565 * nobody else is around. These guys are all
1566 * configured, so we never throw them away.
1286 */
1287 if (peer->refclktype == REFCLK_LOCALCLOCK
1288#if defined(VMS) && defined(VMS_LOCALUNIT)
1289 /* wjm: local unit VMS_LOCALUNIT taken seriously */
1290 && REFCLOCKUNIT(&peer->srcadr) != VMS_LOCALUNIT
1291#endif /* VMS && VMS_LOCALUNIT */
1292 ) {
1293 typelocal = peer;
1294 if (!(peer->flags & FLAG_PREFER))
1295 continue; /* no local clock */
1296 }
1297 if (peer->sstclktype == CTL_SST_TS_TELEPHONE) {
1298 typeacts = peer;
1299 if (!(peer->flags & FLAG_PREFER))
1300 continue; /* no acts */
1301 }
1302
1303 /*
1567 */
1568 if (peer->refclktype == REFCLK_LOCALCLOCK
1569#if defined(VMS) && defined(VMS_LOCALUNIT)
1570 /* wjm: local unit VMS_LOCALUNIT taken seriously */
1571 && REFCLOCKUNIT(&peer->srcadr) != VMS_LOCALUNIT
1572#endif /* VMS && VMS_LOCALUNIT */
1573 ) {
1574 typelocal = peer;
1575 if (!(peer->flags & FLAG_PREFER))
1576 continue; /* no local clock */
1577 }
1578 if (peer->sstclktype == CTL_SST_TS_TELEPHONE) {
1579 typeacts = peer;
1580 if (!(peer->flags & FLAG_PREFER))
1581 continue; /* no acts */
1582 }
1583
1584 /*
1304 * If we get this far, we assume the peer is
1305 * acceptable.
1585 * If we get this far, the peer can stay on the
1586 * island, but does not yet have the immunity
1587 * idol.
1306 */
1588 */
1589 nreach++;
1307 peer->status = CTL_PST_SEL_SANE;
1308 peer_list[nlist++] = peer;
1309
1310 /*
1311 * Insert each interval endpoint on the sorted
1312 * list.
1313 */
1314 e = peer->offset; /* Upper end */
1315 f = root_distance(peer);
1316 e = e + f;
1317 for (i = nl3 - 1; i >= 0; i--) {
1590 peer->status = CTL_PST_SEL_SANE;
1591 peer_list[nlist++] = peer;
1592
1593 /*
1594 * Insert each interval endpoint on the sorted
1595 * list.
1596 */
1597 e = peer->offset; /* Upper end */
1598 f = root_distance(peer);
1599 e = e + f;
1600 for (i = nl3 - 1; i >= 0; i--) {
1318 if (e >= endpoint[index[i]].val)
1601 if (e >= endpoint[indx[i]].val)
1319 break;
1602 break;
1320 index[i + 3] = index[i];
1603 indx[i + 3] = indx[i];
1321 }
1604 }
1322 index[i + 3] = nl3;
1605 indx[i + 3] = nl3;
1323 endpoint[nl3].type = 1;
1324 endpoint[nl3++].val = e;
1325
1326 e = e - f; /* Center point */
1327 for ( ; i >= 0; i--) {
1606 endpoint[nl3].type = 1;
1607 endpoint[nl3++].val = e;
1608
1609 e = e - f; /* Center point */
1610 for ( ; i >= 0; i--) {
1328 if (e >= endpoint[index[i]].val)
1611 if (e >= endpoint[indx[i]].val)
1329 break;
1612 break;
1330 index[i + 2] = index[i];
1613 indx[i + 2] = indx[i];
1331 }
1614 }
1332 index[i + 2] = nl3;
1615 indx[i + 2] = nl3;
1333 endpoint[nl3].type = 0;
1334 endpoint[nl3++].val = e;
1335
1336 e = e - f; /* Lower end */
1337 for ( ; i >= 0; i--) {
1616 endpoint[nl3].type = 0;
1617 endpoint[nl3++].val = e;
1618
1619 e = e - f; /* Lower end */
1620 for ( ; i >= 0; i--) {
1338 if (e >= endpoint[index[i]].val)
1621 if (e >= endpoint[indx[i]].val)
1339 break;
1622 break;
1340 index[i + 1] = index[i];
1623 indx[i + 1] = indx[i];
1341 }
1624 }
1342 index[i + 1] = nl3;
1625 indx[i + 1] = nl3;
1343 endpoint[nl3].type = -1;
1344 endpoint[nl3++].val = e;
1345 }
1346 }
1347#ifdef DEBUG
1626 endpoint[nl3].type = -1;
1627 endpoint[nl3++].val = e;
1628 }
1629 }
1630#ifdef DEBUG
1348 if (debug > 1)
1631 if (debug > 2)
1349 for (i = 0; i < nl3; i++)
1632 for (i = 0; i < nl3; i++)
1350 printf("select: endpoint %2d %.6f\n",
1351 endpoint[index[i]].type, endpoint[index[i]].val);
1633 printf("select: endpoint %2d %.6f\n",
1634 endpoint[indx[i]].type,
1635 endpoint[indx[i]].val);
1352#endif
1353 i = 0;
1354 j = nl3 - 1;
1355 allow = nlist; /* falsetickers assumed */
1356 found = 0;
1357 while (allow > 0) {
1358 allow--;
1359 for (n = 0; i <= j; i++) {
1636#endif
1637 i = 0;
1638 j = nl3 - 1;
1639 allow = nlist; /* falsetickers assumed */
1640 found = 0;
1641 while (allow > 0) {
1642 allow--;
1643 for (n = 0; i <= j; i++) {
1360 n += endpoint[index[i]].type;
1644 n += endpoint[indx[i]].type;
1361 if (n < 0)
1362 break;
1645 if (n < 0)
1646 break;
1363 if (endpoint[index[i]].type == 0)
1647 if (endpoint[indx[i]].type == 0)
1364 found++;
1365 }
1366 for (n = 0; i <= j; j--) {
1648 found++;
1649 }
1650 for (n = 0; i <= j; j--) {
1367 n += endpoint[index[j]].type;
1651 n += endpoint[indx[j]].type;
1368 if (n > 0)
1369 break;
1652 if (n > 0)
1653 break;
1370 if (endpoint[index[j]].type == 0)
1654 if (endpoint[indx[j]].type == 0)
1371 found++;
1372 }
1373 if (found > allow)
1374 break;
1655 found++;
1656 }
1657 if (found > allow)
1658 break;
1375 low = endpoint[index[i++]].val;
1376 high = endpoint[index[j--]].val;
1659 low = endpoint[indx[i++]].val;
1660 high = endpoint[indx[j--]].val;
1377 }
1378
1379 /*
1661 }
1662
1663 /*
1380 * If no survivors remain at this point, check if the acts or
1381 * local clock drivers have been found. If so, nominate one of
1382 * them as the only survivor. Otherwise, give up and declare us
1383 * unsynchronized.
1664 * If no survivors remain at this point, check if the local
1665 * clock or modem drivers have been found. If so, nominate one
1666 * of them as the only survivor. Otherwise, give up and declare
1667 * us unsynchronized.
1384 */
1385 if ((allow << 1) >= nlist) {
1386 if (typeacts != 0) {
1387 typeacts->status = CTL_PST_SEL_SANE;
1388 peer_list[0] = typeacts;
1389 nlist = 1;
1390 } else if (typelocal != 0) {
1391 typelocal->status = CTL_PST_SEL_SANE;
1392 peer_list[0] = typelocal;
1393 nlist = 1;
1394 } else {
1668 */
1669 if ((allow << 1) >= nlist) {
1670 if (typeacts != 0) {
1671 typeacts->status = CTL_PST_SEL_SANE;
1672 peer_list[0] = typeacts;
1673 nlist = 1;
1674 } else if (typelocal != 0) {
1675 typelocal->status = CTL_PST_SEL_SANE;
1676 peer_list[0] = typelocal;
1677 nlist = 1;
1678 } else {
1395 if (sys_peer != 0) {
1396 report_event(EVNT_PEERSTCHG,
1397 (struct peer *)0);
1679 if (osys_peer != NULL) {
1680 sys_poll = NTP_MINPOLL;
1398 NLOG(NLOG_SYNCSTATUS)
1681 NLOG(NLOG_SYNCSTATUS)
1399 msyslog(LOG_INFO,
1682 msyslog(LOG_INFO,
1400 "synchronisation lost");
1683 "synchronisation lost");
1684 report_event(EVNT_PEERSTCHG,
1685 (struct peer *)0);
1401 }
1686 }
1402 sys_peer = 0;
1687 sys_survivors = 0;
1688#ifdef AUTOKEY
1689 resetmanycast();
1690#endif /* AUTOKEY */
1403 return;
1404 }
1405 }
1406#ifdef DEBUG
1691 return;
1692 }
1693 }
1694#ifdef DEBUG
1407 if (debug > 1)
1695 if (debug > 2)
1408 printf("select: low %.6f high %.6f\n", low, high);
1409#endif
1410
1411 /*
1696 printf("select: low %.6f high %.6f\n", low, high);
1697#endif
1698
1699 /*
1412 * Clustering algorithm. Process intersection list to discard
1413 * outlyers. Construct candidate list in cluster order
1414 * determined by the sum of peer synchronization distance plus
1415 * scaled stratum. We must find at least one peer.
1700 * Clustering algorithm. Construct candidate list in order first
1701 * by stratum then by root distance. If we have more than
1702 * MAXCLOCK peers, keep only the best MAXCLOCK of them. Scan the
1703 * list to find falsetickers, who leave the island immediately.
1704 * If a falseticker is not configured, his association raft is
1705 * drowned as well. We must leave at least one peer to collect
1706 * the million bucks.
1416 */
1417 j = 0;
1418 for (i = 0; i < nlist; i++) {
1419 peer = peer_list[i];
1707 */
1708 j = 0;
1709 for (i = 0; i < nlist; i++) {
1710 peer = peer_list[i];
1420 if (nlist > 1 && (low >= peer->offset ||
1421 peer->offset >= high))
1711 if (nlist > 1 && (low >= peer->offset || peer->offset >=
1712 high)) {
1713 if (!(peer->flags & FLAG_CONFIG))
1714 unpeer(peer);
1422 continue;
1715 continue;
1423 peer->status = CTL_PST_SEL_CORRECT;
1716 }
1717 peer->status = CTL_PST_SEL_DISTSYSPEER;
1424 d = root_distance(peer) + peer->stratum * MAXDISPERSE;
1425 if (j >= NTP_MAXCLOCK) {
1426 if (d >= synch[j - 1])
1427 continue;
1428 else
1429 j--;
1430 }
1431 for (k = j; k > 0; k--) {
1432 if (d >= synch[k - 1])
1433 break;
1718 d = root_distance(peer) + peer->stratum * MAXDISPERSE;
1719 if (j >= NTP_MAXCLOCK) {
1720 if (d >= synch[j - 1])
1721 continue;
1722 else
1723 j--;
1724 }
1725 for (k = j; k > 0; k--) {
1726 if (d >= synch[k - 1])
1727 break;
1434 synch[k] = synch[k - 1];
1435 peer_list[k] = peer_list[k - 1];
1728 peer_list[k] = peer_list[k - 1];
1729 error[k] = error[k - 1];
1730 synch[k] = synch[k - 1];
1436 }
1437 peer_list[k] = peer;
1731 }
1732 peer_list[k] = peer;
1733 error[k] = peer->jitter;
1438 synch[k] = d;
1439 j++;
1440 }
1441 nlist = j;
1734 synch[k] = d;
1735 j++;
1736 }
1737 nlist = j;
1738 for (i = 0; i < nlist; i++) {
1739 peer_list[i]->status = CTL_PST_SEL_SELCAND;
1442
1443#ifdef DEBUG
1740
1741#ifdef DEBUG
1444 if (debug > 1)
1445 for (i = 0; i < nlist; i++)
1742 if (debug > 2)
1446 printf("select: %s distance %.6f\n",
1447 ntoa(&peer_list[i]->srcadr), synch[i]);
1448#endif
1743 printf("select: %s distance %.6f\n",
1744 ntoa(&peer_list[i]->srcadr), synch[i]);
1745#endif
1746 }
1449
1450 /*
1747
1748 /*
1451 * Now, prune outlyers by root dispersion. Continue as long as
1452 * there are more than NTP_MINCLOCK survivors and the minimum
1453 * select dispersion is greater than the maximum peer
1454 * dispersion. Stop if we are about to discard a prefer peer.
1749 * Now, vote outlyers off the island by select jitter weighted
1750 * by root dispersion. Continue voting as long as there are more
1751 * than NTP_MINCLOCK survivors and the minimum select jitter
1752 * squared is greater than the maximum peer jitter squared. Stop
1753 * if we are about to discard a prefer peer, who of course has
1754 * the immunity idol.
1455 */
1755 */
1456 for (i = 0; i < nlist; i++) {
1457 peer = peer_list[i];
1458 error[i] = peer->variance;
1459 if (i < NTP_CANCLOCK)
1460 peer->status = CTL_PST_SEL_SELCAND;
1461 else
1462 peer->status = CTL_PST_SEL_DISTSYSPEER;
1463 }
1464 while (1) {
1756 while (1) {
1465 sys_maxd = 0;
1466 d = error[0];
1467 for (k = i = nlist - 1; i >= 0; i--) {
1468 double sdisp = 0;
1757 d = 1e9;
1758 e = -1e9;
1759 k = 0;
1760 for (i = 0; i < nlist; i++) {
1469
1761
1470 for (j = nlist - 1; j > 0; j--) {
1471 sdisp = NTP_SWEIGHT * (sdisp +
1472 DIFF(peer_list[i]->offset,
1473 peer_list[j]->offset));
1762 if (error[i] < d)
1763 d = error[i];
1764 f = 0;
1765 if (nlist > 1) {
1766 for (j = 0; j < nlist; j++)
1767 f += DIFF(peer_list[j]->offset,
1768 peer_list[i]->offset);
1769 f /= nlist - 1;
1474 }
1770 }
1475 if (sdisp > sys_maxd) {
1476 sys_maxd = sdisp;
1771 f = max(f, SQUARE(LOGTOD(sys_precision)));
1772 if (f * synch[i] > e) {
1773 sys_selerr = f;
1774 e = f * synch[i];
1477 k = i;
1478 }
1775 k = i;
1776 }
1479 if (error[i] < d)
1480 d = error[i];
1481 }
1482
1483#ifdef DEBUG
1777 }
1778
1779#ifdef DEBUG
1484 if (debug > 1)
1780 if (debug > 2)
1485 printf(
1486 "select: survivors %d select %.6f peer %.6f\n",
1781 printf(
1782 "select: survivors %d select %.6f peer %.6f\n",
1487 nlist, SQRT(sys_maxd), SQRT(d));
1783 k, SQRT(sys_selerr), SQRT(d));
1488#endif
1784#endif
1489 if (nlist <= NTP_MINCLOCK || sys_maxd <= d ||
1490 peer_list[k]->flags & FLAG_PREFER)
1785 if (nlist <= NTP_MINCLOCK || sys_selerr <= d ||
1786 peer_list[k]->flags & FLAG_PREFER)
1491 break;
1787 break;
1788 if (!(peer_list[k]->flags & FLAG_CONFIG))
1789 unpeer(peer_list[k]);
1492 for (j = k + 1; j < nlist; j++) {
1493 peer_list[j - 1] = peer_list[j];
1494 error[j - 1] = error[j];
1495 }
1496 nlist--;
1497 }
1790 for (j = k + 1; j < nlist; j++) {
1791 peer_list[j - 1] = peer_list[j];
1792 error[j - 1] = error[j];
1793 }
1794 nlist--;
1795 }
1796
1797#ifdef AUTOKEY
1798 /*
1799 * In manycast client mode we may have spooked a sizeable number
1800 * of servers that we don't need. If there are at least
1801 * NTP_MINCLOCK of them, the manycast message will be turned
1802 * off. By the time we get here we nay be ready to prune some of
1803 * them back, but we want to make sure all the candicates have
1804 * had a chance. If they didn't pass the sanity and intersection
1805 * tests, they have already been voted off the island.
1806 */
1807 if (sys_survivors >= NTP_MINCLOCK && nlist < NTP_MINCLOCK)
1808 resetmanycast();
1809#endif /* AUTOKEY */
1810 sys_survivors = nlist;
1811
1498#ifdef DEBUG
1812#ifdef DEBUG
1499 if (debug > 1) {
1813 if (debug > 2) {
1500 for (i = 0; i < nlist; i++)
1501 printf(
1502 "select: %s offset %.6f, distance %.6f poll %d\n",
1814 for (i = 0; i < nlist; i++)
1815 printf(
1816 "select: %s offset %.6f, distance %.6f poll %d\n",
1503 ntoa(&peer_list[i]->srcadr), peer_list[i]->offset,
1504 synch[i], peer_list[i]->pollsw);
1817 ntoa(&peer_list[i]->srcadr),
1818 peer_list[i]->offset, synch[i],
1819 peer_list[i]->pollsw);
1505 }
1506#endif
1507
1508 /*
1509 * What remains is a list of not greater than NTP_MINCLOCK
1510 * peers. We want only a peer at the lowest stratum to become
1511 * the system peer, although all survivors are eligible for the
1512 * combining algorithm. First record their order, diddle the
1513 * flags and clamp the poll intervals. Then, consider the peers
1514 * at the lowest stratum. Of these, OR the leap bits on the
1515 * assumption that, if some of them honk nonzero bits, they must
1516 * know what they are doing. Also, check for prefer and pps
1517 * peers. If a prefer peer is found within clock_max, update the
1518 * pps switch. Of the other peers not at the lowest stratum,
1519 * check if the system peer is among them and, if found, zap
1520 * him. We note that the head of the list is at the lowest
1521 * stratum and that unsynchronized peers cannot survive this
1522 * far.
1820 }
1821#endif
1822
1823 /*
1824 * What remains is a list of not greater than NTP_MINCLOCK
1825 * peers. We want only a peer at the lowest stratum to become
1826 * the system peer, although all survivors are eligible for the
1827 * combining algorithm. First record their order, diddle the
1828 * flags and clamp the poll intervals. Then, consider the peers
1829 * at the lowest stratum. Of these, OR the leap bits on the
1830 * assumption that, if some of them honk nonzero bits, they must
1831 * know what they are doing. Also, check for prefer and pps
1832 * peers. If a prefer peer is found within clock_max, update the
1833 * pps switch. Of the other peers not at the lowest stratum,
1834 * check if the system peer is among them and, if found, zap
1835 * him. We note that the head of the list is at the lowest
1836 * stratum and that unsynchronized peers cannot survive this
1837 * far.
1838 *
1839 * Note that we go no further, unless the number of survivors is
1840 * a majority of the suckers that have been found reachable and
1841 * no prior source is available. This avoids the transient when
1842 * one of a flock of sources is out to lunch and just happens
1843 * to be the first survivor.
1523 */
1844 */
1845 if (osys_peer == NULL && 2 * nlist < min(nreach, NTP_MINCLOCK))
1846 return;
1524 leap_consensus = 0;
1525 for (i = nlist - 1; i >= 0; i--) {
1847 leap_consensus = 0;
1848 for (i = nlist - 1; i >= 0; i--) {
1526 peer_list[i]->status = CTL_PST_SEL_SYNCCAND;
1527 peer_list[i]->flags |= FLAG_SYSPEER;
1528 poll_update(peer_list[i], peer_list[i]->hpoll);
1529 if (peer_list[i]->stratum == peer_list[0]->stratum) {
1530 leap_consensus |= peer_list[i]->leap;
1531 if (peer_list[i]->refclktype == REFCLK_ATOM_PPS)
1532 typepps = peer_list[i];
1533 if (peer_list[i] == sys_peer)
1534 typesystem = peer_list[i];
1535 if (peer_list[i]->flags & FLAG_PREFER) {
1536 typeprefer = peer_list[i];
1537 if (fabs(typeprefer->offset) <
1538 clock_max)
1539 pps_update = 1;
1540 }
1541 } else {
1542 if (peer_list[i] == sys_peer)
1543 sys_peer = 0;
1849 peer = peer_list[i];
1850 peer->status = CTL_PST_SEL_SYNCCAND;
1851 peer->flags |= FLAG_SYSPEER;
1852 poll_update(peer, peer->hpoll);
1853 if (peer->stratum == peer_list[0]->stratum) {
1854 leap_consensus |= peer->leap;
1855 if (peer->refclktype == REFCLK_ATOM_PPS &&
1856 peer->stratum < STRATUM_UNSPEC)
1857 typepps = peer;
1858 if (peer == osys_peer)
1859 typesystem = peer;
1860 if (peer->flags & FLAG_PREFER)
1861 sys_prefer = peer;
1544 }
1545 }
1546
1547 /*
1548 * Mitigation rules of the game. There are several types of
1549 * peers that make a difference here: (1) prefer local peers
1550 * (type REFCLK_LOCALCLOCK with FLAG_PREFER) or prefer modem
1551 * peers (type REFCLK_NIST_ATOM etc with FLAG_PREFER), (2) pps
1552 * peers (type REFCLK_ATOM_PPS), (3) remaining prefer peers
1553 * (flag FLAG_PREFER), (4) the existing system peer, if any, (5)
1554 * the head of the survivor list. Note that only one peer can be
1555 * declared prefer. The order of preference is in the order
1556 * stated. Note that all of these must be at the lowest stratum,
1557 * i.e., the stratum of the head of the survivor list.
1558 */
1862 }
1863 }
1864
1865 /*
1866 * Mitigation rules of the game. There are several types of
1867 * peers that make a difference here: (1) prefer local peers
1868 * (type REFCLK_LOCALCLOCK with FLAG_PREFER) or prefer modem
1869 * peers (type REFCLK_NIST_ATOM etc with FLAG_PREFER), (2) pps
1870 * peers (type REFCLK_ATOM_PPS), (3) remaining prefer peers
1871 * (flag FLAG_PREFER), (4) the existing system peer, if any, (5)
1872 * the head of the survivor list. Note that only one peer can be
1873 * declared prefer. The order of preference is in the order
1874 * stated. Note that all of these must be at the lowest stratum,
1875 * i.e., the stratum of the head of the survivor list.
1876 */
1559 osys_peer = sys_peer;
1560 if (typeprefer && (typeprefer->refclktype == REFCLK_LOCALCLOCK
1561 || typeprefer->sstclktype == CTL_SST_TS_TELEPHONE ||
1562 !typepps)) {
1563 sys_peer = typeprefer;
1877 if (sys_prefer)
1878 sw = sys_prefer->refclktype == REFCLK_LOCALCLOCK ||
1879 sys_prefer->sstclktype == CTL_SST_TS_TELEPHONE ||
1880 !typepps;
1881 else
1882 sw = 0;
1883 if (sw) {
1884 sys_peer = sys_prefer;
1564 sys_peer->status = CTL_PST_SEL_SYSPEER;
1565 sys_offset = sys_peer->offset;
1885 sys_peer->status = CTL_PST_SEL_SYSPEER;
1886 sys_offset = sys_peer->offset;
1566 sys_epsil = sys_peer->variance;
1887 sys_syserr = sys_peer->jitter;
1567#ifdef DEBUG
1568 if (debug > 1)
1569 printf("select: prefer offset %.6f\n",
1570 sys_offset);
1571#endif
1888#ifdef DEBUG
1889 if (debug > 1)
1890 printf("select: prefer offset %.6f\n",
1891 sys_offset);
1892#endif
1572 } else if (typepps && pps_update) {
1893 } else if (typepps) {
1573 sys_peer = typepps;
1574 sys_peer->status = CTL_PST_SEL_PPS;
1575 sys_offset = sys_peer->offset;
1894 sys_peer = typepps;
1895 sys_peer->status = CTL_PST_SEL_PPS;
1896 sys_offset = sys_peer->offset;
1576 sys_epsil = sys_peer->variance;
1897 sys_syserr = sys_peer->jitter;
1577 if (!pps_control)
1898 if (!pps_control)
1578 NLOG(NLOG_SYSEVENT) /* conditional syslog */
1579 msyslog(LOG_INFO, "pps sync enabled");
1899 NLOG(NLOG_SYSEVENT)
1900 msyslog(LOG_INFO,
1901 "pps sync enabled");
1580 pps_control = current_time;
1581#ifdef DEBUG
1582 if (debug > 1)
1902 pps_control = current_time;
1903#ifdef DEBUG
1904 if (debug > 1)
1583 printf("select: pps offset %.6f\n", sys_offset);
1905 printf("select: pps offset %.6f\n",
1906 sys_offset);
1584#endif
1585 } else {
1907#endif
1908 } else {
1586 if (!typesystem)
1909 if (typesystem)
1910 sys_peer = osys_peer;
1911 else
1587 sys_peer = peer_list[0];
1588 sys_peer->status = CTL_PST_SEL_SYSPEER;
1589 sys_offset = clock_combine(peer_list, nlist);
1912 sys_peer = peer_list[0];
1913 sys_peer->status = CTL_PST_SEL_SYSPEER;
1914 sys_offset = clock_combine(peer_list, nlist);
1590 sys_epsil = sys_peer->variance + sys_maxd;
1915 sys_syserr = sys_peer->jitter + sys_selerr;
1591#ifdef DEBUG
1592 if (debug > 1)
1593 printf("select: combine offset %.6f\n",
1594 sys_offset);
1595#endif
1596 }
1597 if (osys_peer != sys_peer)
1598 report_event(EVNT_PEERSTCHG, (struct peer *)0);

--- 23 unchanged lines hidden (view full) ---

1622/*
1623 * root_distance - compute synchronization distance from peer to root
1624 */
1625static double
1626root_distance(
1627 struct peer *peer
1628 )
1629{
1916#ifdef DEBUG
1917 if (debug > 1)
1918 printf("select: combine offset %.6f\n",
1919 sys_offset);
1920#endif
1921 }
1922 if (osys_peer != sys_peer)
1923 report_event(EVNT_PEERSTCHG, (struct peer *)0);

--- 23 unchanged lines hidden (view full) ---

1947/*
1948 * root_distance - compute synchronization distance from peer to root
1949 */
1950static double
1951root_distance(
1952 struct peer *peer
1953 )
1954{
1630 return ((fabs(peer->delay) + peer->rootdelay) / 2 +
1631 peer->rootdispersion + peer->disp +
1632 SQRT(peer->variance) + CLOCK_PHI * (current_time -
1633 peer->update));
1955 /*
1956 * Careful squeak here. The value returned must be greater than
1957 * zero blamed on the peer jitter, which must be at least the
1958 * square of sys_precision.
1959 */
1960 return ((peer->rootdelay + peer->delay) / 2 +
1961 peer->rootdispersion + peer->disp + clock_phi *
1962 (current_time - peer->update) + SQRT(peer->jitter));
1634}
1635
1636/*
1637 * peer_xmit - send packet for persistent association.
1638 */
1639static void
1640peer_xmit(
1641 struct peer *peer /* peer structure pointer */
1642 )
1643{
1963}
1964
1965/*
1966 * peer_xmit - send packet for persistent association.
1967 */
1968static void
1969peer_xmit(
1970 struct peer *peer /* peer structure pointer */
1971 )
1972{
1644 struct pkt xpkt;
1645 int find_rtt = (peer->cast_flags & MDF_MCAST) &&
1646 peer->hmode != MODE_BROADCAST;
1647 int sendlen;
1973 struct pkt xpkt; /* transmit packet */
1974 int sendlen, authlen;
1975 keyid_t xkeyid; /* transmit key ID */
1976 l_fp xmt_tx;
1648
1649 /*
1977
1978 /*
1650 * Initialize protocol fields.
1979 * Initialize transmit packet header fields.
1651 */
1980 */
1652 xpkt.li_vn_mode = PKT_LI_VN_MODE(sys_leap,
1653 peer->version, peer->hmode);
1981 xpkt.li_vn_mode = PKT_LI_VN_MODE(sys_leap, peer->version,
1982 peer->hmode);
1654 xpkt.stratum = STRATUM_TO_PKT(sys_stratum);
1655 xpkt.ppoll = peer->hpoll;
1656 xpkt.precision = sys_precision;
1657 xpkt.rootdelay = HTONS_FP(DTOFP(sys_rootdelay));
1983 xpkt.stratum = STRATUM_TO_PKT(sys_stratum);
1984 xpkt.ppoll = peer->hpoll;
1985 xpkt.precision = sys_precision;
1986 xpkt.rootdelay = HTONS_FP(DTOFP(sys_rootdelay));
1658 xpkt.rootdispersion = HTONS_FP(DTOUFP(sys_rootdispersion +
1659 LOGTOD(sys_precision)));
1987 xpkt.rootdispersion = HTONS_FP(DTOUFP(sys_rootdispersion));
1660 xpkt.refid = sys_refid;
1661 HTONL_FP(&sys_reftime, &xpkt.reftime);
1662 HTONL_FP(&peer->org, &xpkt.org);
1663 HTONL_FP(&peer->rec, &xpkt.rec);
1664
1665 /*
1988 xpkt.refid = sys_refid;
1989 HTONL_FP(&sys_reftime, &xpkt.reftime);
1990 HTONL_FP(&peer->org, &xpkt.org);
1991 HTONL_FP(&peer->rec, &xpkt.rec);
1992
1993 /*
1666 * Authenticate the packet if enabled and either configured or
1667 * the previous packet was authenticated. If for some reason the
1668 * key associated with the key identifier is not in the key
1669 * cache, then honk key zero.
1994 * If the received packet contains a MAC, the transmitted packet
1995 * is authenticated and contains a MAC. If not, the transmitted
1996 * packet is not authenticated.
1997 *
1998 * In the current I/O semantics the default interface is set
1999 * until after receiving a packet and setting the right
2000 * interface. So, the first packet goes out unauthenticated.
2001 * That's why the really icky test next is here.
1670 */
1671 sendlen = LEN_PKT_NOMAC;
2002 */
2003 sendlen = LEN_PKT_NOMAC;
1672 if (peer->flags & FLAG_AUTHENABLE) {
1673 u_long xkeyid;
1674 l_fp xmt_tx;
2004 if (!(peer->flags & FLAG_AUTHENABLE)) {
2005 get_systime(&peer->xmt);
2006 HTONL_FP(&peer->xmt, &xpkt.xmt);
2007 sendpkt(&peer->srcadr, peer->dstadr, peer->ttl, &xpkt,
2008 sendlen);
2009 peer->sent++;
2010#ifdef DEBUG
2011 if (debug)
2012 printf("transmit: at %ld %s->%s mode %d\n",
2013 current_time, ntoa(&peer->dstadr->sin),
2014 ntoa(&peer->srcadr), peer->hmode);
2015#endif
2016 return;
2017 }
1675
2018
2019 /*
2020 * The received packet contains a MAC, so the transmitted packet
2021 * must be authenticated. If autokey is enabled, fuss with the
2022 * various modes; otherwise, private key cryptography is used.
2023 */
2024#ifdef AUTOKEY
2025 if ((peer->flags & FLAG_SKEY)) {
2026 u_int cmmd;
2027
1676 /*
2028 /*
1677 * Transmit encrypted packet compensated for the
1678 * encryption delay.
2029 * The Public Key Dance (PKD): Cryptographic credentials
2030 * are contained in extension fields, each including a
2031 * 4-octet length/code word followed by a 4-octet
2032 * association ID and optional additional data. Optional
2033 * data includes a 4-octet data length field followed by
2034 * the data itself. Request messages are sent from a
2035 * configured association; response messages can be sent
2036 * from a configured association or can take the fast
2037 * path without ever matching an association. Response
2038 * messages have the same code as the request, but have
2039 * a response bit and possibly an error bit set. In this
2040 * implementation, a message may contain no more than
2041 * one command and no more than one response.
2042 *
2043 * Cryptographic session keys include both a public and
2044 * a private componet. Request and response messages
2045 * using extension fields are always sent with the
2046 * private component set to zero. Packets without
2047 * extension fields indlude the private component when
2048 * the session key is generated.
1679 */
2049 */
1680#ifdef MD5
1681 if (peer->flags & FLAG_SKEY) {
1682
2050 while (1) {
2051
1683 /*
2052 /*
1684 * In autokey mode, allocate and initialize a
1685 * key list if not already done. Then, use the
1686 * list in inverse order, discarding keys once
1687 * used. Keep the latest key around until the
1688 * next one, so clients can use client/server
1689 * packets to compute propagation delay. Note we
1690 * have to wait until the receive side of the
1691 * socket is bound and the server address
1692 * confirmed.
2053 * Allocate and initialize a keylist if not
2054 * already done. Then, use the list in inverse
2055 * order, discarding keys once used. Keep the
2056 * latest key around until the next one, so
2057 * clients can use client/server packets to
2058 * compute propagation delay.
2059 *
2060 * Note that once a key is used from the list,
2061 * it is retained in the key cache until the
2062 * next key is used. This is to allow a client
2063 * to retrieve the encrypted session key
2064 * identifier to verify authenticity.
2065 *
2066 * If for some reason a key is no longer in the
2067 * key cache, a birthday has happened and the
2068 * pseudo-random sequence is probably broken. In
2069 * that case, purge the keylist and regenerate
2070 * it.
1693 */
2071 */
1694 if (ntohl(peer->dstadr->sin.sin_addr.s_addr) ==
1695 0 &&
1696 ntohl(peer->dstadr->bcast.sin_addr.s_addr) == 0)
1697 peer->keyid = 0;
1698 else {
1699 if (peer->keylist == 0) {
1700 make_keylist(peer);
1701 } else {
1702 authtrust(peer->keylist[peer->keynumber], 0);
1703 if (peer->keynumber == 0)
1704 make_keylist(peer);
1705 else {
1706 peer->keynumber--;
1707 xkeyid = peer->keylist[peer->keynumber];
1708 if (!authistrusted(xkeyid))
1709 make_keylist(peer);
1710 }
1711 }
1712 peer->keyid = peer->keylist[peer->keynumber];
1713 xpkt.keyid1 = htonl(2 * sizeof(u_int32));
1714 xpkt.keyid2 = htonl(sys_private);
1715 sendlen += 2 * sizeof(u_int32);
1716 }
2072 if (peer->keynumber == 0)
2073 make_keylist(peer, peer->dstadr);
2074 else
2075 peer->keynumber--;
2076 xkeyid = peer->keylist[peer->keynumber];
2077 if (authistrusted(xkeyid))
2078 break;
2079 else
2080 key_expire(peer);
1717 }
2081 }
1718#endif /* MD5 */
1719 xkeyid = peer->keyid;
1720 get_systime(&peer->xmt);
1721 L_ADD(&peer->xmt, &sys_authdelay);
1722 HTONL_FP(&peer->xmt, &xpkt.xmt);
1723 sendlen += authencrypt(xkeyid, (u_int32 *)&xpkt,
1724 sendlen);
1725 get_systime(&xmt_tx);
1726 sendpkt(&peer->srcadr, find_rtt ? any_interface :
1727 peer->dstadr, ((peer->cast_flags & MDF_MCAST) &&
1728 !find_rtt) ? ((peer->cast_flags & MDF_ACAST) ? -7 :
1729 peer->ttl) : -7, &xpkt, sendlen);
2082 peer->keyid = xkeyid;
2083 switch (peer->hmode) {
1730
1731 /*
2084
2085 /*
1732 * Calculate the encryption delay. Keep the minimum over
1733 * the latest two samples.
2086 * In broadcast mode the autokey values are required.
2087 * Send them when a new keylist is generated; otherwise,
2088 * send the association ID so the client can request
2089 * them at other times.
1734 */
2090 */
1735 L_SUB(&xmt_tx, &peer->xmt);
1736 L_ADD(&xmt_tx, &sys_authdelay);
1737 sys_authdly[1] = sys_authdly[0];
1738 sys_authdly[0] = xmt_tx.l_uf;
1739 if (sys_authdly[0] < sys_authdly[1])
1740 sys_authdelay.l_uf = sys_authdly[0];
1741 else
1742 sys_authdelay.l_uf = sys_authdly[1];
1743 peer->sent++;
1744#ifdef DEBUG
1745 if (debug)
1746 printf(
1747 "transmit: at %ld to %s mode %d keyid %08lx index %d\n",
1748 current_time, ntoa(&peer->srcadr),
1749 peer->hmode, xkeyid, peer->keynumber);
1750#endif
1751 } else {
2091 case MODE_BROADCAST:
2092 if (peer->flags & FLAG_ASSOC)
2093 cmmd = CRYPTO_AUTO | CRYPTO_RESP;
2094 else
2095 cmmd = CRYPTO_ASSOC | CRYPTO_RESP;
2096 sendlen += crypto_xmit((u_int32 *)&xpkt,
2097 sendlen, cmmd, 0, peer->associd);
2098 break;
2099
1752 /*
2100 /*
1753 * Transmit non-authenticated packet.
2101 * In symmetric modes the public key, leapsecond table,
2102 * agreement parameters and autokey values are required.
2103 *
2104 * 1. If a response is pending, always send it first.
2105 *
2106 * 2. Don't send anything except a public-key request
2107 * until the public key has been stored.
2108 *
2109 * 3. Once the public key has been stored, don't send
2110 * anything except an agreement parameter request
2111 * until the agreement parameters have been stored.
2112 *
2113 * 4. Once the argeement parameters have been stored,
2114 * don't send anything except a public value request
2115 * until the agreed key has been stored.
2116 *
2117 * 5. When the agreed key has been stored and the key
2118 * list is regenerated, send the autokey values
2119 * gratis unless they have already been sent.
1754 */
2120 */
1755 get_systime(&(peer->xmt));
1756 HTONL_FP(&peer->xmt, &xpkt.xmt);
1757 sendpkt(&(peer->srcadr), find_rtt ? any_interface :
1758 peer->dstadr, ((peer->cast_flags & MDF_MCAST) &&
1759 !find_rtt) ? ((peer->cast_flags & MDF_ACAST) ? -7 :
1760 peer->ttl) : -8, &xpkt, sendlen);
1761 peer->sent++;
2121 case MODE_ACTIVE:
2122 case MODE_PASSIVE:
2123#ifdef PUBKEY
2124 if (peer->cmmd != 0)
2125 sendlen += crypto_xmit((u_int32 *)&xpkt,
2126 sendlen, (peer->cmmd >> 16) |
2127 CRYPTO_RESP, peer->hcookie,
2128 peer->associd);
2129 if (!peer->crypto)
2130 sendlen += crypto_xmit((u_int32 *)&xpkt,
2131 sendlen, CRYPTO_ASSOC,
2132 peer->hcookie, peer->assoc);
2133 else if (!crypto_flags &&
2134 peer->pcookie.tstamp == 0 && sys_leap !=
2135 LEAP_NOTINSYNC)
2136 sendlen += crypto_xmit((u_int32 *)&xpkt,
2137 sendlen, CRYPTO_PRIV, peer->hcookie,
2138 peer->assoc);
2139 else if (crypto_flags && peer->pubkey.ptr ==
2140 NULL)
2141 sendlen += crypto_xmit((u_int32 *)&xpkt,
2142 sendlen, CRYPTO_NAME, peer->hcookie,
2143 peer->assoc);
2144 else if (peer->crypto & CRYPTO_FLAG_CERT)
2145 sendlen += crypto_xmit((u_int32 *)&xpkt,
2146 sendlen, CRYPTO_CERT, peer->hcookie,
2147 peer->assoc);
2148 else if (crypto_flags && peer->crypto &
2149 CRYPTO_FLAG_DH && sys_leap !=
2150 LEAP_NOTINSYNC)
2151 sendlen += crypto_xmit((u_int32 *)&xpkt,
2152 sendlen, CRYPTO_DHPAR,
2153 peer->hcookie, peer->assoc);
2154 else if (crypto_flags && peer->pcookie.tstamp ==
2155 0 && sys_leap != LEAP_NOTINSYNC)
2156 sendlen += crypto_xmit((u_int32 *)&xpkt,
2157 sendlen, CRYPTO_DH, peer->hcookie,
2158 peer->assoc);
2159#else
2160 if (peer->cmmd != 0)
2161 sendlen += crypto_xmit((u_int32 *)&xpkt,
2162 sendlen, (peer->cmmd >> 16) |
2163 CRYPTO_RESP, peer->hcookie,
2164 peer->associd);
2165 if (peer->pcookie.tstamp == 0 && sys_leap !=
2166 LEAP_NOTINSYNC)
2167 sendlen += crypto_xmit((u_int32 *)&xpkt,
2168 sendlen, CRYPTO_PRIV, peer->hcookie,
2169 peer->assoc);
2170#endif /* PUBKEY */
2171 else if (!(peer->flags & FLAG_AUTOKEY))
2172 sendlen += crypto_xmit((u_int32 *)&xpkt,
2173 sendlen, CRYPTO_AUTO, peer->hcookie,
2174 peer->assoc);
2175 else if ((peer->flags & FLAG_ASSOC) &&
2176 (peer->cmmd >> 16) != CRYPTO_AUTO)
2177 sendlen += crypto_xmit((u_int32 *)&xpkt,
2178 sendlen, CRYPTO_AUTO | CRYPTO_RESP,
2179 peer->hcookie, peer->associd);
2180#ifdef PUBKEY
2181 else if (peer->crypto & CRYPTO_FLAG_TAI)
2182 sendlen += crypto_xmit((u_int32 *)&xpkt,
2183 sendlen, CRYPTO_TAI, peer->hcookie,
2184 peer->assoc);
2185#endif /* PUBKEY */
2186 peer->cmmd = 0;
2187 break;
2188
2189 /*
2190 * In client mode, the public key, host cookie and
2191 * autokey values are required. In broadcast client
2192 * mode, these values must be acquired during the
2193 * client/server exchange to avoid having to wait until
2194 * the next key list regeneration. Otherwise, the poor
2195 * dude may die a lingering death until becoming
2196 * unreachable and attempting rebirth. Note that we ask
2197 * for the cookie at each key list regeneration anyway.
2198 */
2199 case MODE_CLIENT:
2200 if (peer->cmmd != 0)
2201 sendlen += crypto_xmit((u_int32 *)&xpkt,
2202 sendlen, (peer->cmmd >> 16) |
2203 CRYPTO_RESP, peer->hcookie,
2204 peer->associd);
2205 if (!peer->crypto)
2206 sendlen += crypto_xmit((u_int32 *)&xpkt,
2207 sendlen, CRYPTO_ASSOC,
2208 peer->hcookie, peer->assoc);
2209#ifdef PUBKEY
2210 else if (crypto_flags && peer->pubkey.ptr ==
2211 NULL)
2212 sendlen += crypto_xmit((u_int32 *)&xpkt,
2213 sendlen, CRYPTO_NAME, peer->hcookie,
2214 peer->assoc);
2215 else if (peer->crypto & CRYPTO_FLAG_CERT)
2216 sendlen += crypto_xmit((u_int32 *)&xpkt,
2217 sendlen, CRYPTO_CERT, peer->hcookie,
2218 peer->assoc);
2219#endif /* PUBKEY */
2220 else if (peer->pcookie.tstamp == 0)
2221 sendlen += crypto_xmit((u_int32 *)&xpkt,
2222 sendlen, CRYPTO_PRIV, peer->hcookie,
2223 peer->assoc);
2224 else if (!(peer->flags & FLAG_AUTOKEY) &&
2225 (peer->cast_flags & MDF_BCLNT))
2226 sendlen += crypto_xmit((u_int32 *)&xpkt,
2227 sendlen, CRYPTO_AUTO, peer->hcookie,
2228 peer->assoc);
2229#ifdef PUBKEY
2230 else if (peer->crypto & CRYPTO_FLAG_TAI)
2231 sendlen += crypto_xmit((u_int32 *)&xpkt,
2232 sendlen, CRYPTO_TAI, peer->hcookie,
2233 peer->assoc);
2234#endif /* PUBKEY */
2235 peer->cmmd = 0;
2236 break;
2237 }
2238
2239 /*
2240 * If extension fields are present, we must use a
2241 * private value of zero and force min poll interval.
2242 * Most intricate.
2243 */
2244 if (sendlen > LEN_PKT_NOMAC)
2245 session_key(&peer->dstadr->sin, &peer->srcadr,
2246 xkeyid, 0, 2);
2247 }
2248#endif /* AUTOKEY */
2249 xkeyid = peer->keyid;
2250 get_systime(&peer->xmt);
2251 L_ADD(&peer->xmt, &sys_authdelay);
2252 HTONL_FP(&peer->xmt, &xpkt.xmt);
2253 authlen = authencrypt(xkeyid, (u_int32 *)&xpkt, sendlen);
2254 if (authlen == 0) {
2255 msyslog(LOG_NOTICE,
2256 "transmit: no encryption key found");
2257 peer->flash |= TEST4 | TEST5;
2258 return;
2259 }
2260 sendlen += authlen;
2261#ifdef AUTOKEY
2262 if (xkeyid > NTP_MAXKEY)
2263 authtrust(xkeyid, 0);
2264#endif /* AUTOKEY */
2265 get_systime(&xmt_tx);
2266 if (sendlen > sizeof(xpkt)) {
2267 msyslog(LOG_ERR, "buffer overflow %u", sendlen);
2268 exit(-1);
2269 }
2270 sendpkt(&peer->srcadr, peer->dstadr, peer->ttl, &xpkt, sendlen);
2271
2272 /*
2273 * Calculate the encryption delay. Keep the minimum over
2274 * the latest two samples.
2275 */
2276 L_SUB(&xmt_tx, &peer->xmt);
2277 L_ADD(&xmt_tx, &sys_authdelay);
2278 sys_authdly[1] = sys_authdly[0];
2279 sys_authdly[0] = xmt_tx.l_uf;
2280 if (sys_authdly[0] < sys_authdly[1])
2281 sys_authdelay.l_uf = sys_authdly[0];
2282 else
2283 sys_authdelay.l_uf = sys_authdly[1];
2284 peer->sent++;
2285#ifdef AUTOKEY
1762#ifdef DEBUG
2286#ifdef DEBUG
1763 if (debug)
1764 printf("transmit: at %ld to %s mode %d\n",
1765 current_time, ntoa(&peer->srcadr),
1766 peer->hmode);
2287 if (debug)
2288 printf(
2289 "transmit: at %ld %s->%s mode %d keyid %08x len %d mac %d index %d\n",
2290 current_time, ntoa(&peer->dstadr->sin),
2291 ntoa(&peer->srcadr), peer->hmode, xkeyid, sendlen,
2292 authlen, peer->keynumber);
1767#endif
2293#endif
1768 }
2294#else
2295#ifdef DEBUG
2296 if (debug)
2297 printf(
2298 "transmit: at %ld %s->%s mode %d keyid %08x len %d mac %d\n",
2299 current_time, ntoa(&peer->dstadr->sin),
2300 ntoa(&peer->srcadr), peer->hmode, xkeyid, sendlen,
2301 authlen);
2302#endif
2303#endif /* AUTOKEY */
1769}
1770
2304}
2305
2306
1771/*
2307/*
1772 * fast_xmit - Send packet for nonpersistent association.
2308 * fast_xmit - Send packet for nonpersistent association. Note that
2309 * neither the source or destination can be a broadcast address.
1773 */
1774static void
1775fast_xmit(
1776 struct recvbuf *rbufp, /* receive packet pointer */
1777 int xmode, /* transmit mode */
2310 */
2311static void
2312fast_xmit(
2313 struct recvbuf *rbufp, /* receive packet pointer */
2314 int xmode, /* transmit mode */
1778 u_long xkeyid /* transmit key ID */
2315 keyid_t xkeyid, /* transmit key ID */
2316 int mask /* restrict mask */
1779 )
1780{
2317 )
2318{
1781 struct pkt xpkt;
1782 struct pkt *rpkt;
1783 int sendlen;
1784 l_fp xmt_ts;
2319 struct pkt xpkt; /* transmit packet structure */
2320 struct pkt *rpkt; /* receive packet structure */
2321 l_fp xmt_ts; /* transmit timestamp */
2322 l_fp xmt_tx; /* transmit timestamp after authent */
2323 int sendlen, authlen;
1785
1786 /*
2324
2325 /*
1787 * Initialize transmit packet header fields in the receive
1788 * buffer provided. We leave some fields intact as received.
2326 * Initialize transmit packet header fields from the receive
2327 * buffer provided. We leave some fields intact as received. If
2328 * the gazinta was from a multicast address, the gazouta must go
2329 * out another way.
1789 */
1790 rpkt = &rbufp->recv_pkt;
2330 */
2331 rpkt = &rbufp->recv_pkt;
1791 xpkt.li_vn_mode = PKT_LI_VN_MODE(sys_leap,
1792 PKT_VERSION(rpkt->li_vn_mode), xmode);
1793 xpkt.stratum = STRATUM_TO_PKT(sys_stratum);
2332 if (rbufp->dstadr->flags & INT_MULTICAST)
2333 rbufp->dstadr = findinterface(&rbufp->recv_srcadr);
2334
2335 /*
2336 * If the caller is restricted, return a kiss-of-death packet;
2337 * otherwise, smooch politely.
2338 */
2339 if (mask & (RES_DONTSERVE | RES_LIMITED)) {
2340 if (!(mask & RES_DEMOBILIZE)) {
2341 return;
2342 } else {
2343 xpkt.li_vn_mode =
2344 PKT_LI_VN_MODE(LEAP_NOTINSYNC,
2345 PKT_VERSION(rpkt->li_vn_mode), xmode);
2346 xpkt.stratum = STRATUM_UNSPEC;
2347 memcpy(&xpkt.refid, "DENY", 4);
2348 }
2349 } else {
2350 xpkt.li_vn_mode = PKT_LI_VN_MODE(sys_leap,
2351 PKT_VERSION(rpkt->li_vn_mode), xmode);
2352 xpkt.stratum = STRATUM_TO_PKT(sys_stratum);
2353 xpkt.refid = sys_refid;
2354 }
1794 xpkt.ppoll = rpkt->ppoll;
1795 xpkt.precision = sys_precision;
1796 xpkt.rootdelay = HTONS_FP(DTOFP(sys_rootdelay));
2355 xpkt.ppoll = rpkt->ppoll;
2356 xpkt.precision = sys_precision;
2357 xpkt.rootdelay = HTONS_FP(DTOFP(sys_rootdelay));
1797 xpkt.rootdispersion = HTONS_FP(DTOUFP(sys_rootdispersion +
1798 LOGTOD(sys_precision)));
1799 xpkt.refid = sys_refid;
2358 xpkt.rootdispersion =
2359 HTONS_FP(DTOUFP(sys_rootdispersion));
1800 HTONL_FP(&sys_reftime, &xpkt.reftime);
1801 xpkt.org = rpkt->xmt;
1802 HTONL_FP(&rbufp->recv_time, &xpkt.rec);
2360 HTONL_FP(&sys_reftime, &xpkt.reftime);
2361 xpkt.org = rpkt->xmt;
2362 HTONL_FP(&rbufp->recv_time, &xpkt.rec);
1803 sendlen = LEN_PKT_NOMAC;
1804 if (rbufp->recv_length > sendlen) {
1805 l_fp xmt_tx;
1806
2363
1807 /*
1808 * Transmit encrypted packet compensated for the
1809 * encryption delay.
1810 */
1811 if (xkeyid > NTP_MAXKEY) {
1812 xpkt.keyid1 = htonl(2 * sizeof(u_int32));
1813 xpkt.keyid2 = htonl(sys_private);
1814 sendlen += 2 * sizeof(u_int32);
1815 }
2364 /*
2365 * If the received packet contains a MAC, the transmitted packet
2366 * is authenticated and contains a MAC. If not, the transmitted
2367 * packet is not authenticated.
2368 */
2369 sendlen = LEN_PKT_NOMAC;
2370 if (rbufp->recv_length == sendlen) {
1816 get_systime(&xmt_ts);
2371 get_systime(&xmt_ts);
1817 L_ADD(&xmt_ts, &sys_authdelay);
1818 HTONL_FP(&xmt_ts, &xpkt.xmt);
2372 HTONL_FP(&xmt_ts, &xpkt.xmt);
1819 sendlen += authencrypt(xkeyid, (u_int32 *)&xpkt,
2373 sendpkt(&rbufp->recv_srcadr, rbufp->dstadr, 0, &xpkt,
1820 sendlen);
2374 sendlen);
1821 get_systime(&xmt_tx);
1822 sendpkt(&rbufp->recv_srcadr, rbufp->dstadr, -9, &xpkt,
1823 sendlen);
1824
1825 /*
1826 * Calculate the encryption delay. Keep the minimum over
1827 * the latest two samples.
1828 */
1829 L_SUB(&xmt_tx, &xmt_ts);
1830 L_ADD(&xmt_tx, &sys_authdelay);
1831 sys_authdly[1] = sys_authdly[0];
1832 sys_authdly[0] = xmt_tx.l_uf;
1833 if (sys_authdly[0] < sys_authdly[1])
1834 sys_authdelay.l_uf = sys_authdly[0];
1835 else
1836 sys_authdelay.l_uf = sys_authdly[1];
1837#ifdef DEBUG
1838 if (debug)
2375#ifdef DEBUG
2376 if (debug)
1839 printf(
1840 "transmit: at %ld to %s mode %d keyid %08lx\n",
1841 current_time, ntoa(&rbufp->recv_srcadr),
1842 xmode, xkeyid);
2377 printf("transmit: at %ld %s->%s mode %d\n",
2378 current_time, ntoa(&rbufp->dstadr->sin),
2379 ntoa(&rbufp->recv_srcadr), xmode);
1843#endif
2380#endif
1844 } else {
2381 return;
2382 }
1845
2383
2384 /*
2385 * The received packet contains a MAC, so the transmitted packet
2386 * must be authenticated. For private-key cryptography, use the
2387 * predefined private keys to generate the cryptosum. For
2388 * autokey cryptography, use the server private value to
2389 * generate the cookie, which is unique for every source-
2390 * destination-key ID combination.
2391 */
2392#ifdef AUTOKEY
2393 if (xkeyid > NTP_MAXKEY) {
2394 keyid_t cookie;
2395 u_int code, associd;
2396
1846 /*
2397 /*
1847 * Transmit non-authenticated packet.
2398 * The only way to get here is a reply to a legitimate
2399 * client request message, so the mode must be
2400 * MODE_SERVER. If an extension field is present, there
2401 * can be only one and that must be a command. Do what
2402 * needs, but with private value of zero so the poor
2403 * jerk can decode it. If no extension field is present,
2404 * use the cookie to generate the session key.
1848 */
2405 */
1849 get_systime(&xmt_ts);
1850 HTONL_FP(&xmt_ts, &xpkt.xmt);
1851 sendpkt(&rbufp->recv_srcadr, rbufp->dstadr, -10, &xpkt,
1852 sendlen);
2406 code = (htonl(rpkt->exten[0]) >> 16) | CRYPTO_RESP;
2407 cookie = session_key(&rbufp->recv_srcadr,
2408 &rbufp->dstadr->sin, 0, sys_private, 0);
2409 associd = htonl(rpkt->exten[1]);
2410 if (rbufp->recv_length >= sendlen + MAX_MAC_LEN + 2 *
2411 sizeof(u_int32)) {
2412 session_key(&rbufp->dstadr->sin,
2413 &rbufp->recv_srcadr, xkeyid, 0, 2);
2414 sendlen += crypto_xmit((u_int32 *)&xpkt,
2415 sendlen, code, cookie, associd);
2416 } else {
2417 session_key(&rbufp->dstadr->sin,
2418 &rbufp->recv_srcadr, xkeyid, cookie, 2);
2419 }
2420 }
2421#endif /* AUTOKEY */
2422 get_systime(&xmt_ts);
2423 L_ADD(&xmt_ts, &sys_authdelay);
2424 HTONL_FP(&xmt_ts, &xpkt.xmt);
2425 authlen = authencrypt(xkeyid, (u_int32 *)&xpkt, sendlen);
2426 sendlen += authlen;
2427#ifdef AUTOKEY
2428 if (xkeyid > NTP_MAXKEY)
2429 authtrust(xkeyid, 0);
2430#endif /* AUTOKEY */
2431 get_systime(&xmt_tx);
2432 if (sendlen > sizeof(xpkt)) {
2433 msyslog(LOG_ERR, "buffer overflow %u", sendlen);
2434 exit(-1);
2435 }
2436 sendpkt(&rbufp->recv_srcadr, rbufp->dstadr, 0, &xpkt, sendlen);
2437
2438 /*
2439 * Calculate the encryption delay. Keep the minimum over the
2440 * latest two samples.
2441 */
2442 L_SUB(&xmt_tx, &xmt_ts);
2443 L_ADD(&xmt_tx, &sys_authdelay);
2444 sys_authdly[1] = sys_authdly[0];
2445 sys_authdly[0] = xmt_tx.l_uf;
2446 if (sys_authdly[0] < sys_authdly[1])
2447 sys_authdelay.l_uf = sys_authdly[0];
2448 else
2449 sys_authdelay.l_uf = sys_authdly[1];
1853#ifdef DEBUG
2450#ifdef DEBUG
1854 if (debug)
1855 printf("transmit: at %ld to %s mode %d\n",
1856 current_time, ntoa(&rbufp->recv_srcadr),
1857 xmode);
2451 if (debug)
2452 printf(
2453 "transmit: at %ld %s->%s mode %d keyid %08x len %d mac %d\n",
2454 current_time, ntoa(&rbufp->dstadr->sin),
2455 ntoa(&rbufp->recv_srcadr), xmode, xkeyid, sendlen,
2456 authlen);
1858#endif
2457#endif
1859 }
1860}
1861
2458}
2459
1862#ifdef MD5
2460
2461#ifdef AUTOKEY
1863/*
2462/*
1864 * Compute key list
2463 * key_expire - purge the key list
1865 */
2464 */
1866static void
1867make_keylist(
1868 struct peer *peer
2465void
2466key_expire(
2467 struct peer *peer /* peer structure pointer */
1869 )
1870{
1871 int i;
2468 )
2469{
2470 int i;
1872 u_long keyid;
1873 u_long ltemp;
1874
2471
1875 /*
1876 * Allocate the key list if necessary.
1877 */
1878 if (peer->keylist == 0)
1879 peer->keylist = (u_long *)emalloc(sizeof(u_long) *
1880 NTP_MAXSESSION);
1881
1882 /*
1883 * Generate an initial key ID which is unique and greater than
1884 * NTP_MAXKEY.
1885 */
1886 while (1) {
1887 keyid = (u_long)RANDOM & 0xffffffff;
1888 if (keyid <= NTP_MAXKEY)
1889 continue;
1890 if (authhavekey(keyid))
1891 continue;
1892 break;
2472 if (peer->keylist != NULL) {
2473 for (i = 0; i <= peer->keynumber; i++)
2474 authtrust(peer->keylist[i], 0);
2475 free(peer->keylist);
2476 peer->keylist = NULL;
1893 }
2477 }
1894
1895 /*
1896 * Generate up to NTP_MAXSESSION session keys. Stop if the
1897 * next one would not be unique or not a session key ID or if
1898 * it would expire before the next poll.
1899 */
1900 ltemp = sys_automax;
1901 for (i = 0; i < NTP_MAXSESSION; i++) {
1902 peer->keylist[i] = keyid;
1903 peer->keynumber = i;
1904 keyid = session_key(
1905 ntohl(peer->dstadr->sin.sin_addr.s_addr),
1906 (peer->hmode == MODE_BROADCAST || (peer->flags &
1907 FLAG_MCAST2)) ?
1908 ntohl(peer->dstadr->bcast.sin_addr.s_addr):
1909 ntohl(peer->srcadr.sin_addr.s_addr), keyid, ltemp);
1910 ltemp -= 1 << peer->hpoll;
1911 if (auth_havekey(keyid) || keyid <= NTP_MAXKEY ||
1912 ltemp <= (1 << (peer->hpoll + 1)))
1913 break;
1914 }
2478 peer->keynumber = peer->sndauto.seq = 0;
2479#ifdef DEBUG
2480 if (debug)
2481 printf("key_expire: at %lu\n", current_time);
2482#endif
1915}
2483}
1916#endif /* MD5 */
2484#endif /* AUTOKEY */
1917
1918/*
1919 * Find the precision of this particular machine
1920 */
1921#define DUSECS 1000000 /* us in a s */
1922#define HUSECS (1 << 20) /* approx DUSECS for shifting etc */
1923#define MINSTEP 5 /* minimum clock increment (us) */
1924#define MAXSTEP 20000 /* maximum clock increment (us) */

--- 103 unchanged lines hidden (view full) ---

2028
2029 /*
2030 * Fill in the sys_* stuff. Default is don't listen to
2031 * broadcasting, authenticate.
2032 */
2033 sys_leap = LEAP_NOTINSYNC;
2034 sys_stratum = STRATUM_UNSPEC;
2035 sys_precision = (s_char)default_get_precision();
2485
2486/*
2487 * Find the precision of this particular machine
2488 */
2489#define DUSECS 1000000 /* us in a s */
2490#define HUSECS (1 << 20) /* approx DUSECS for shifting etc */
2491#define MINSTEP 5 /* minimum clock increment (us) */
2492#define MAXSTEP 20000 /* maximum clock increment (us) */

--- 103 unchanged lines hidden (view full) ---

2596
2597 /*
2598 * Fill in the sys_* stuff. Default is don't listen to
2599 * broadcasting, authenticate.
2600 */
2601 sys_leap = LEAP_NOTINSYNC;
2602 sys_stratum = STRATUM_UNSPEC;
2603 sys_precision = (s_char)default_get_precision();
2604 sys_jitter = LOGTOD(sys_precision);
2036 sys_rootdelay = 0;
2037 sys_rootdispersion = 0;
2038 sys_refid = 0;
2039 L_CLR(&sys_reftime);
2605 sys_rootdelay = 0;
2606 sys_rootdispersion = 0;
2607 sys_refid = 0;
2608 L_CLR(&sys_reftime);
2040 sys_peer = 0;
2609 sys_peer = NULL;
2610 sys_survivors = 0;
2041 get_systime(&dummy);
2042 sys_bclient = 0;
2043 sys_bdelay = DEFBROADDELAY;
2611 get_systime(&dummy);
2612 sys_bclient = 0;
2613 sys_bdelay = DEFBROADDELAY;
2044#if defined(DES) || defined(MD5)
2045 sys_authenticate = 1;
2614 sys_authenticate = 1;
2046#else
2047 sys_authenticate = 0;
2048#endif
2049 L_CLR(&sys_authdelay);
2050 sys_authdly[0] = sys_authdly[1] = 0;
2051 sys_stattime = 0;
2052 sys_badstratum = 0;
2053 sys_oldversionpkt = 0;
2054 sys_newversionpkt = 0;
2055 sys_badlength = 0;
2056 sys_unknownversion = 0;
2057 sys_processed = 0;
2058 sys_badauth = 0;
2059 sys_manycastserver = 0;
2615 L_CLR(&sys_authdelay);
2616 sys_authdly[0] = sys_authdly[1] = 0;
2617 sys_stattime = 0;
2618 sys_badstratum = 0;
2619 sys_oldversionpkt = 0;
2620 sys_newversionpkt = 0;
2621 sys_badlength = 0;
2622 sys_unknownversion = 0;
2623 sys_processed = 0;
2624 sys_badauth = 0;
2625 sys_manycastserver = 0;
2626#ifdef AUTOKEY
2060 sys_automax = 1 << NTP_AUTOMAX;
2627 sys_automax = 1 << NTP_AUTOMAX;
2628#endif /* AUTOKEY */
2061
2062 /*
2063 * Default these to enable
2064 */
2065 ntp_enable = 1;
2066#ifndef KERNEL_FLL_BUG
2067 kern_enable = 1;
2068#endif
2629
2630 /*
2631 * Default these to enable
2632 */
2633 ntp_enable = 1;
2634#ifndef KERNEL_FLL_BUG
2635 kern_enable = 1;
2636#endif
2069 msyslog(LOG_DEBUG, "kern_enable is %d", kern_enable);
2637 pps_enable = 0;
2070 stats_control = 1;
2071
2072 /*
2638 stats_control = 1;
2639
2640 /*
2073 * Some system clocks should only be adjusted in 10ms increments.
2641 * Some system clocks should only be adjusted in 10ms
2642 * increments.
2074 */
2075#if defined RELIANTUNIX_CLOCK
2076 systime_10ms_ticks = 1; /* Reliant UNIX */
2077#elif defined SCO5_CLOCK
2078 if (sys_precision >= (s_char)-10) /* pre-SCO OpenServer 5.0.6 */
2079 systime_10ms_ticks = 1;
2080#endif
2081 if (systime_10ms_ticks)

--- 89 unchanged lines hidden (view full) ---

2171 case PROTO_AUTHENTICATE:
2172
2173 /*
2174 * Specify the use of authenticated data
2175 */
2176 sys_authenticate = (int)value;
2177 break;
2178
2643 */
2644#if defined RELIANTUNIX_CLOCK
2645 systime_10ms_ticks = 1; /* Reliant UNIX */
2646#elif defined SCO5_CLOCK
2647 if (sys_precision >= (s_char)-10) /* pre-SCO OpenServer 5.0.6 */
2648 systime_10ms_ticks = 1;
2649#endif
2650 if (systime_10ms_ticks)

--- 89 unchanged lines hidden (view full) ---

2740 case PROTO_AUTHENTICATE:
2741
2742 /*
2743 * Specify the use of authenticated data
2744 */
2745 sys_authenticate = (int)value;
2746 break;
2747
2748 case PROTO_PPS:
2749
2750 /*
2751 * Turn on/off PPS discipline
2752 */
2753 pps_enable = (int)value;
2754 break;
2755
2756#ifdef REFCLOCK
2757 case PROTO_CAL:
2758
2759 /*
2760 * Turn on/off refclock calibrate
2761 */
2762 cal_enable = (int)value;
2763 break;
2764#endif
2765
2179 default:
2180
2181 /*
2182 * Log this error
2183 */
2184 msyslog(LOG_ERR,
2185 "proto_config: illegal item %d, value %ld",
2186 item, value);

--- 21 unchanged lines hidden --- 		2766 default:
2767
2768 /*
2769 * Log this error
2770 */
2771 msyslog(LOG_ERR,
2772 "proto_config: illegal item %d, value %ld",
2773 item, value);

--- 21 unchanged lines hidden ---