ntp: limit offset correction to supported NTP interval

When an NTP source is specified with the offset option, the corrected
offset may get outside of the supported NTP interval (by default -50..86
years around the build date). If the source passed the source selection,
the offset would be rejected only later in the adjustment of the local
clock.

Check the offset validity as part of the NTP test A to make the source
unselectable and make it visible in the measurements log and ntpdata
report.

diff --git a/doc/chrony.conf.adoc b/doc/chrony.conf.adoc
index 88d46c9d7dc9e75b8999f7057c6cb423c65151ca..cdae2734cfa60a2a4b5804aa2cbf3eb55e171e90 100644 (file)
--- a/doc/chrony.conf.adoc
+++ b/doc/chrony.conf.adoc
@@ -2179,8 +2179,8 @@ from the example line above):
 . Results of the *maxdelay*, *maxdelayratio*, and *maxdelaydevratio* (or
   *maxdelayquant*) tests, and a test for synchronisation loop (1=pass,
   0=fail). The first test from these four also checks the server precision,
-  response time, and whether an interleaved response is acceptable for
-  synchronisation. [1111]
+  response time, validity of the measured offset, and whether an interleaved
+  response is acceptable for synchronisation. [1111]
 . Local poll [10]
 . Remote poll [10]
 . '`Score`' (an internal score within each polling level used to decide when to

diff --git a/ntp_core.c b/ntp_core.c
index 214a989edd469340f34e1d61100eae675f025469..9ae1432c96b0d819ea0f26861d46100cc256cf70 100644 (file)
--- a/ntp_core.c
+++ b/ntp_core.c
@@ -2211,7 +2211,8 @@ process_response(NCR_Instance inst, int saved, NTP_Local_Address *local_addr,
     /* Test A combines multiple tests to avoid changing the measurements log
        format and ntpdata report.  It requires that the minimum estimate of the
        peer delay is not larger than the configured maximum, it is not a
-       response in the 'warm up' exchange, in both client modes that the server
+       response in the 'warm up' exchange, the configured offset correction is
+       within the supported NTP interval, both client modes that the server
        processing time is sane, in interleaved client/server mode that the
        previous response was not in basic mode (which prevents using timestamps
        that minimise delay error), and in interleaved symmetric mode that the
@@ -2220,6 +2221,7 @@ process_response(NCR_Instance inst, int saved, NTP_Local_Address *local_addr,
     testA = sample.peer_delay - sample.peer_dispersion <= inst->max_delay &&
             precision <= inst->max_delay &&
             inst->presend_done <= 0 &&
+            UTI_IsTimeOffsetSane(&sample.time, sample.offset) &&
             !(inst->mode == MODE_CLIENT && response_time > MAX_SERVER_INTERVAL) &&
             !(inst->mode == MODE_CLIENT && interleaved_packet &&
               UTI_IsZeroTimespec(&inst->prev_local_tx.ts) &&

diff --git a/test/simulation/008-ntpera b/test/simulation/008-ntpera
index 2eea63b5be01744f7da76e8816058bcb51f35635..ab11819f7b1dac6ffbed9b6bd31c07afc02c7686 100755 (executable)
--- a/test/simulation/008-ntpera
+++ b/test/simulation/008-ntpera
@@ -41,7 +41,6 @@ for time_offset in -1e-1 1e-1; do
                export CLKNETSIM_START_DATE=$(awk "BEGIN {printf \"%.0f\", $ntp_start + $start_offset}")
                run_test || test_fail
                check_chronyd_exit || test_fail
-               check_source_selection || test_fail
                check_packet_interval || test_fail
                check_sync && test_fail
        done