ntpdc options update

bk: 43fe6ab48BNRqsoA2vz_lWpmUEA5Sw

diff --git a/html/ntpdc.html b/html/ntpdc.html
index 800127eefe741b26f400b9492035af0b0f6f3682..d6b7ab9e9934ce07660fd091626a629f7f9a8d20 100644 (file)
--- a/html/ntpdc.html
+++ b/html/ntpdc.html
@@ -60,7 +60,19 @@
                        <dt><tt>hostnames [ yes | no ]</tt>
                        <dd>If <tt>yes</tt> is specified, host names are printed in information displays. If <tt>no</tt> is specified, numeric addresses are printed instead. The default is <tt>yes</tt>, unless modified using the command line <tt>-n</tt> switch.
                        <dt><tt>keyid <i>keyid</i></tt>
-                       <dd>This command allows the specification of a key number to be used to authenticate configuration requests. This must correspond to a key number the server has been configured to use for this purpose.
+                       <dd>This command allows the specification of a
+               key number to be used to authenticate configuration
+               requests from ntpdc to the <NOBR>host(s).</NOBR> This must
+               correspond to a key number which the host/server has
+               been configured to use for this purpose (server
+               options: <tt>trustedkey</tt>, and
+               <tt>requestkey</tt>).  If authentication is not
+               enabled on the <NOBR>host(s)</NOBR> for ntpdc
+               commands, the command
+               <tt>"keyid 0"</tt> should be given; otherwise the
+               <i>keyid</i> of the next subsequent <tt>addpeer/addserver/broadcast
+                       </tt> command will
+                       be used.  
                        <dt><tt>quit</tt>
                        <dd>Exit <tt>ntpdc</tt>.
                        <dt><tt>passwd</tt>
@@ -115,34 +127,53 @@
                <p>Authenticated requests always include a timestamp in the packet data, which is included in the computation of the authentication code. This timestamp is compared by the server to its receive time stamp. If they differ by more than a small amount the request is rejected. This is done for two reasons. First, it makes simple replay attacks on the server, by someone who might be able to overhear traffic on your LAN, much more difficult. Second, it makes it more difficult to request configuration changes to your server from topologically remote hosts. While the reconfiguration facility will work well with a server on the local host, and may work adequately between time-synchronized hosts on the same LAN, it will work very poorly for more distant hosts. As such, if reasonable passwords are chosen, care is taken in the distribution and protection of keys and appropriate source address restrictions are applied, the run time reconfiguration facility should provide an adequate level of security.</p>
                <p>The following commands all make authenticated requests.</p>
                <dl>
-                       <dt><tt>addpeer <i>peer_address</i> [
+               <dt><tt>addpeer <i>peer_address</i> [
                <i>keyid</i> ] [ <i>version</i> ] [
-               <i>minpoll|prefer|iburst|burst</i> [...] ]</tt>
+               <tt>minpoll# | prefer | iburst  | burst | minpoll
+               <i>N</i> | <tt>maxpoll</tt> <i>N</i> [...] ]</tt>
+               <dt><tt>addpeer <i>peer_address</i> [
+               <tt>prefer | iburst | burst | minpoll
+               <i>N</i> | <tt>maxpoll</tt> <i>N</i> | <tt>keyid</tt>
+                       <i>N</i> | <tt>version</tt> <i>N</i> [...] ]</tt>
                        <dd>Add a configured peer association at the
                        given address and operating in symmetric
                        active mode. Note that an existing association
                        with the same peer may be deleted when this
                        command is executed, or may simply be
                        converted to conform to the new configuration,
-                       as appropriate. If the optional <tt>keyid</tt>
-                       is a nonzero integer, all outgoing packets to
+                       as appropriate. If the <tt>keyid</tt>
+                       is nonzero, all outgoing packets to
                        the remote server will have an authentication
                        field attached encrypted with this key. If the
                        value is 0 (or not given) no authentication
-                       will be done. The <tt>version#</tt> can be 1,
-                       2 or 3 and defaults to 3.  The remaining
+                       will be done. If ntpdc's key number has not
+                       yet been set (<i>e.g.,</i> by the keyid
+                       command), it will be set to this value.
+                       The <tt>version#</tt> can be 1 through 4 and defaults to 3.  The remaining
                        options are either a numeric value for <tt>minpoll</tt> or
-                       a literal string <tt>prefer</tt>, <tt>iburst</tt>, or
-                       <tt>burst</tt>, and have the action as specified in the
+                       literals <tt>prefer</tt>, <tt>iburst</tt>, 
+                       <tt>burst</tt>, <tt>minpoll  </tt><i>N</i>,
+                       <tt>keyid </tt><i>N</i>, <tt>version </tt> <i>N</i>, or
+                       <tt>maxpoll  </tt><i>N</i> (where <i>N</i> is a numeric value), and have the action as specified in the
                        <tt>peer</tt> configuration file command of
                        ntpd.  See the <a href="confopt.html">Server Options</a> page for further information.
                        Each flag (or its absence) replaces the
                        previous setting. The <tt>prefer</tt> keyword indicates a preferred peer (and thus will be used primarily for clock synchronisation if possible). The preferred peer also determines the validity of the PPS signal - if the preferred peer is suitable for synchronisation so is the PPS signal.
-                       <dt><tt>addserver <i>peer_address</i> [ <i>keyid</i> ] [ <i>version</i> ] [ [ <i>minpoll|prefer|iburst|burst</i> [...] ]</tt>
+                       <dt><tt>addserver <i>peer_address</i> [
+               <i>keyid</i> ] [ <i>version</i> ] [
+               <tt>minpoll# | prefer | iburst  | burst | minpoll
+               <i>N</i> | <tt>maxpoll</tt> <i>N</i> [...] ]</tt>
+               <dt><tt>addserver <i>peer_address</i> [
+               <tt>prefer | iburst | burst | minpoll
+               <i>N</i> | <tt>maxpoll</tt> <i>N</i> | <tt>keyid</tt>
+                       <i>N</i> | <tt>version</tt> <i>N</i> [...] ]</tt>
+
                        <dd>Identical to the addpeer command, except that the operating mode is client.
                        <dt><tt>broadcast <i>peer_address</i> [
                        <i>keyid</i> ] [ <i>version</i> ] [ <i>prefer</i> ]</tt>
-                       <dd>Identical to the addpeer command, except that the operating mode is broadcast. In this case a valid key identifier and key are required. The <tt>peer_address</tt> parameter can be the broadcast address of the local network or a multicast group address assigned to NTP. If a multicast address, a multicast-capable kernel is required.
+                       <dd>Identical to the addpeer command, except
+                       that the operating mode is broadcast. In this
+                       case a valid non-zero key identifier and key are required. The <tt>peer_address</tt> parameter can be the broadcast address of the local network or a multicast group address assigned to NTP. If a multicast address, a multicast-capable kernel is required.
                        <dt><tt>unconfig <i>peer_address</i> [...]</tt>
                        <dd>This command causes the configured bit to be removed from the specified peer(s). In many cases this will cause the peer association to be deleted. When appropriate, however, the association may persist in an unconfigured mode if the remote peer is willing to continue on in this fashion.
                        <dt><tt>fudge <i>peer_address</i> [ <i>time1</i> ] [ <i>time2</i> ] [ <i>stratum</i> ] [ <i>refid</i> ]</tt>

diff --git a/include/ntp.h b/include/ntp.h
index e01f8508a424e1f0bede01ea685ca084661fbcb9..74b910eb1a64b93426add473d360d573e933611b 100644 (file)
--- a/include/ntp.h
+++ b/include/ntp.h
@@ -754,6 +754,7 @@ struct pkt {
 #define LOOP_ALLAN             8       /* set minimum Allan intercept */
 #define LOOP_HUFFPUFF          9       /* set huff-n'-puff filter length */
 #define LOOP_FREQ              10      /* set initial frequency */
+#define LOOP_KERN_CLEAR                11      /* reset kernel pll parameters */
 
 /*
  * Configuration items for the stats printer

diff --git a/include/ntp_request.h b/include/ntp_request.h
index 1b75f70deae58e5ccf8485c95a363ef06d43e0c4..497dbc2f213aca89c24e076c3247a68b41477a19 100644 (file)
--- a/include/ntp_request.h
+++ b/include/ntp_request.h
@@ -290,6 +290,7 @@ struct resp_pkt {
 #define        INFO_FLAG_AUTHENABLE    0x20
 #define        INFO_FLAG_SEL_CANDIDATE 0x40
 #define        INFO_FLAG_SHORTLIST     0x80
+#define        INFO_FLAG_IBURST        0x100
 
 /*
  * Flags in the system information returns

diff --git a/ntpd/ntp_loopfilter.c b/ntpd/ntp_loopfilter.c
index 33a328d428134d2277e7fa65a201120dd9e841fc..85dde2a20b6f02769dacb791ddf2c5aec9c759e7 100644 (file)
--- a/ntpd/ntp_loopfilter.c
+++ b/ntpd/ntp_loopfilter.c
@@ -994,6 +994,24 @@ loop_config(
                        ntp_adjtime(&ntv);
                }
 #endif /* KERNEL_PLL */
+#endif /* LOCKCLOCK */
+               break;
+
+       case LOOP_KERN_CLEAR:
+#ifndef LOCKCLOCK
+#ifdef KERNEL_PLL
+               /* Completely turn off the kernel time adjustments. */
+               if (pll_control) {
+                       memset((char *)&ntv, 0, sizeof(ntv));
+                       ntv.modes = MOD_BITS | MOD_FREQUENCY;
+                       ntv.status = STA_UNSYNC;
+                       ntp_adjtime(&ntv);
+                       NLOG(NLOG_SYNCEVENT | NLOG_SYSEVENT)
+                           msyslog(LOG_INFO,
+                           "kernel time sync disabled %04x",
+                           ntv.status);
+                  }
+#endif /* KERNEL_PLL */
 #endif /* LOCKCLOCK */
                break;
 

diff --git a/ntpd/ntp_peer.c b/ntpd/ntp_peer.c
index e24a645e805e91fdafb682ad3d776f81e714fc45..8947ea6ae21f0a3210de1e82f94c8725b09b1316 100644 (file)
--- a/ntpd/ntp_peer.c
+++ b/ntpd/ntp_peer.c
@@ -426,13 +426,18 @@ peer_config(
         * First search from the beginning for an association with given
         * remote address and mode. If an interface is given, search
         * from there to find the association which matches that
-        * destination.
+        * destination.  If the given interface is "any", track down
+        * the actual interface, because that's what gets put into the
+        * peer structure.
         */
        peer = findexistingpeer(srcadr, (struct peer *)0, hmode);
        if (dstadr != 0) {
                while (peer != 0) {
                        if (peer->dstadr == dstadr)
                                break;
+                       if (dstadr == ANY_INTERFACE_CHOOSE(srcadr) &&
+                           peer->dstadr == findinterface(srcadr))
+                            break;
                        peer = findexistingpeer(srcadr, peer, hmode);
                }
        }

diff --git a/ntpdc/ntpdc.c b/ntpdc/ntpdc.c
index 4c73b001b31e2031d72ebaa2025aa62c26e4a4f0..5ac496e9df9a4b9fee73d8ec5d5f491cab13b51a 100644 (file)
--- a/ntpdc/ntpdc.c
+++ b/ntpdc/ntpdc.c
@@ -47,6 +47,7 @@ static        const char *    prompt = "ntpdc> ";     /* prompt to ask him about */
  * Keyid used for authenticated requests.  Obtained on the fly.
  */
 static u_long  info_auth_keyid;
+static int keyid_entered = 0;
 
 /*
  * Type of key md5
@@ -154,7 +155,7 @@ static      struct xcmd builtins[] = {
 #define        MAXCMDS         100             /* maximum commands on cmd line */
 #define        MAXHOSTS        200             /* maximum hosts on cmd line */
 #define        MAXLINE         512             /* maximum line length */
-#define        MAXTOKENS       (1+1+MAXARGS+2) /* maximum number of usable tokens */
+#define        MAXTOKENS       (1+1+MAXARGS+MOREARGS+2)        /* maximum number of usable tokens */
 #define        SCREENWIDTH     78              /* nominal screen width in columns */
 
 /*
@@ -860,7 +861,7 @@ sendrequest(
                qpkt.mbz_itemsize = MBZ_ITEMSIZE(0);
        }
 
-       if (!auth) {
+       if (!auth || (keyid_entered && info_auth_keyid == 0)) {
                qpkt.auth_seq = AUTH_SEQ(0, 0);
                return sendpkt((char *)&qpkt, req_pkt_size);
        } else {
@@ -1106,7 +1107,7 @@ docmd(
        const char *cmdline
        )
 {
-       char *tokens[1+MAXARGS+2];
+       char *tokens[1+MAXARGS+MOREARGS+2];
        struct parse pcmd;
        int ntok;
        int i, ti;
@@ -1696,12 +1697,15 @@ keyid(
        )
 {
        if (pcmd->nargs == 0) {
-               if (info_auth_keyid == 0)
+               if (info_auth_keyid == 0 && !keyid_entered)
                    (void) fprintf(fp, "no keyid defined\n");
+               else if (info_auth_keyid == 0 && keyid_entered)
+                   (void) fprintf(fp, "no keyid will be sent\n");
                else
                    (void) fprintf(fp, "keyid is %lu\n", (u_long)info_auth_keyid);
        } else {
                info_auth_keyid = pcmd->argval[0].uval;
+               keyid_entered = 1;
        }
 }