introduce log_ntp_addr() and use it where applicable, avoids a null
pointer deref in constraint.c reported by bluhm@; ok millert@

Periodically reset constraint DNS info for constraints that failed
to reply; ok florian@

Once we are synced, we can validate the certificate in the standard way.
ok tb@

If no date could be parsed, bail out early and fix an error return that
leaked; ok florian@

Remove unneeded call to tls_init(3)

As per the manual and lib/libtls/tls.c revision 1.79 from 2018
"Automatically handle library initialisation for libtls." initialisation
is handled automatically b

Remove unneeded call to tls_init(3)

As per the manual and lib/libtls/tls.c revision 1.79 from 2018
"Automatically handle library initialisation for libtls." initialisation
is handled automatically by other tls_*(3) functions.

Remove the tls_init() call to not give the impression of it being needed.

Feedback tb
OK Tests mestre

show more ...

Remove duplicate prototype.

Typo in log message

If constraints are configured but do not work for whatever reason ntpd
does not work. Make that more clear in the log and ntpdctl -s status.
report by and ok benno@

1) Re-resolve and re-get constraints once the clock is synced. Constraints
are relative to monotime; so they shift when time is being adjusted.
2) Fix a race between SIGCHLD delivery and reading the

1) Re-resolve and re-get constraints once the clock is synced. Constraints
are relative to monotime; so they shift when time is being adjusted.
2) Fix a race between SIGCHLD delivery and reading the result imsg.
3) Some cleanup: use a number to distinguish pools internally

show more ...

When system calls indicate an error they return -1, not some arbitrary
value < 0. errno is only updated in this case. Change all (most?)
callers of syscalls to follow this better, and let's see if

When system calls indicate an error they return -1, not some arbitrary
value < 0. errno is only updated in this case. Change all (most?)
callers of syscalls to follow this better, and let's see if this strictness
helps us in the future.

show more ...

Be more aggressive retrying dns while in settime mode. The constraint
engine does not know if we're in startup mode, so use a small interval
the first few times there.

Introducing autmatic settime mode: if some preconditions are met
(booting, constraint(s) defined) set the time but only if the clock
should be moved forward by more than a minute, based on ntp replie

Introducing autmatic settime mode: if some preconditions are met
(booting, constraint(s) defined) set the time but only if the clock
should be moved forward by more than a minute, based on ntp replies
that satisfied the constraints. Tested by many; ok deraadt@

show more ...

Use proper algorithm for median computation; use fabs() for computing
an absolute value and fix poll loop to first generate messages and
then compute poll flags the write cases. This makes the timeou

Use proper algorithm for median computation; use fabs() for computing
an absolute value and fix poll loop to first generate messages and
then compute poll flags the write cases. This makes the timeout
workaround for constraints unneeded. ok reyk@ tb@

show more ...

A step in solving the bootstrap problem in a dnssec environement.
If the time is wrong, we cannot validate dnssec, leading to failed
DNS lookups, so we cannot adjust or set the time. Work around thi

A step in solving the bootstrap problem in a dnssec environement.
If the time is wrong, we cannot validate dnssec, leading to failed
DNS lookups, so we cannot adjust or set the time. Work around this
by repeating a failed DNS lookup with a lookup with the DC (check
disabled) bit set. ok florian@

show more ...

Improve logging for TLS certificate validity checking.

Actually specify whether the certificate is not yet valid or has expired,
and log the actual time values to hopefully save some head scratching

Improve logging for TLS certificate validity checking.

Actually specify whether the certificate is not yet valid or has expired,
and log the actual time values to hopefully save some head scratching.

ok deraadt@ tb@

show more ...

Explicitly check timegm() return value.

Spotted by tb@

ok deraadt@ tb@

Perform manual validity checking of the X.509 certificate for constraints.

Given that we're getting a constraint so that we can validate time, if our
own time is out we can fail the automatic validi

Perform manual validity checking of the X.509 certificate for constraints.

Given that we're getting a constraint so that we can validate time, if our
own time is out we can fail the automatic validity checking since it is
based on the wallclock. Instead, disable the automatic validity checking
and perform manual checks based on the time reported from the server via
the HTTP header.

Discussed at length with and ok deraadt@

show more ...

Don't use *a - *b as compare idiom, it does not work as expected for
anything larger than an int. ok jca@ rsadowski@

update for libtls default cert changes.
bonus: this exposed a few missing const qualifiers.

Use TLS_CA_CERT_FILE instead of a separate define.

ok beck@ bluhm@ tb@

Be stricter with TLS configuration for ntpd constraints.

We already require TLSv1.2 so it does not make sense to be liberal with the
cipher suites that we allow. Additionally, it is potentially dang

Be stricter with TLS configuration for ntpd constraints.

We already require TLSv1.2 so it does not make sense to be liberal with the
cipher suites that we allow. Additionally, it is potentially dangerous to
disable certificate verification when no CA data is available (which is
currently an impossible case to reach).

Also ensure we check the return value from tls_config_set_ca_mem() (as
spotted by tb@).

ok kn@ tb@

show more ...

Use the stack to hold the constraint child process variables instead of
using the heap.

ok bcook@

Check for EAGAIN on imsg_flush() return otherwise we might be failing
to send message to the child process. Do like we learned in httpd(8).

ok deraadt@

Save the constraint process pid by getting the start_child() return value,
this should fix the problem with random ntpd(8) deaths.

ok deraadt@

Teach ntpd(8) constraint process to use exec*() instead of just forking,
with this change we get the pledge() ability back to the parent process.

some tweaks from and ok reyk@