From: Dave Hart
Date: Sat, 30 Sep 2023 03:53:06 +0000 (+0000)
Subject: [Bug 3872] Ignore restrict mask for hostname.
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=46a217c494f0c66a6b232e60c399299b98553f7e;p=thirdparty%2Fntp.git
[Bug 3872] Ignore restrict mask for hostname.
[Bug 3868] Cannot restrict a pool peer.
[Bug 3855] ntpq lacks an equivalent to ntpdc's delrestrict.
Correct handling of not-found or unreadable or corrupt driftfile
to match comments by starting protocol engine in FREQ mode.
Add missing printf-style arg in ntp_util.c.
Update ntp.conf documentation to add "delrestrict" and correct
information about KoD rate limiting.
bk: 65179ba2xy6JnBVUxzObJNPiQuYDyQ
---
diff --git a/ChangeLog b/ChangeLog
index a27b72b5a..552ca4f00 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,10 +1,14 @@
---
+* [Bug 3872] Ignore restrict mask for hostname.
* [Bug 3869] Remove long-gone "calldelay" & "crypto sign" from docs.
Reported by PoolMUC@web.de.
+* [Bug 3868] Cannot restrict a pool peer. Thanks to
+ Edward McGuire for tracking down the deficiency.
* [Bug 3859] Use NotifyIpInterfaceChange on Windows ntpd.
* [Bug 3856] Enable Edit & Continue debugging with Visual Studio.
+* [Bug 3855] ntpq lacks an equivalent to ntpdc's delrestrict.
* [Bug 3854] ntpd 4.2.8p17 corrupts rawstats file with space in refid.
* [Bug 3853] Clean up warnings with modern compilers.
@@ -34,6 +38,8 @@
is disabled.
* [Bug 3825] Don't touch HTML files unless building inside a BK repo.
Fix the script checkHtmlFileDates.
+* Update ntp.conf documentation to add "delrestrict" and correct information
+ about KoD rate limiting.
* html/clockopt.html cleanup.
* Add DSA, DSA-SHA, and SHA to tests/libntp/digests.c.
* Provide ntpd thread names to debugger on Windows.
diff --git a/include/ntp.h b/include/ntp.h
index 402085b21..9ff5a408f 100644
--- a/include/ntp.h
+++ b/include/ntp.h
@@ -841,10 +841,10 @@ typedef struct restrict_u_tag restrict_u;
struct restrict_u_tag {
restrict_u * link; /* link to next entry */
u_int32 count; /* number of packets matched */
+ u_int32 expire; /* valid until current_time */
u_short rflags; /* restrict (accesslist) flags */
- u_short mflags; /* match flags */
+ u_int32 mflags; /* match flags */
short ippeerlimit; /* limit of associations matching */
- u_long expire; /* valid until time */
union { /* variant starting here */
res_addr4 v4;
res_addr6 v6;
@@ -872,10 +872,6 @@ struct r4addr_tag {
#define RES_NOPEER 0x0010 /* new association denied */
#define RES_NOEPEER 0x0020 /* new ephemeral association denied */
#define RES_LIMITED 0x0040 /* packet rate exceeded */
-#define RES_FLAGS (RES_IGNORE | RES_DONTSERVE |\
- RES_DONTTRUST | RES_VERSION |\
- RES_NOPEER | RES_NOEPEER | RES_LIMITED)
-
#define RES_NOQUERY 0x0080 /* mode 6/7 packet denied */
#define RES_NOMODIFY 0x0100 /* mode 6/7 modify denied */
#define RES_NOTRAP 0x0200 /* mode 6/7 set trap denied */
@@ -890,7 +886,10 @@ struct r4addr_tag {
#define RES_UNUSED 0x0000 /* Unused flag bits (none left) */
-#define RES_ALLFLAGS (RES_FLAGS | RES_NOQUERY | \
+#define RES_ALLFLAGS (RES_IGNORE | RES_DONTSERVE | \
+ RES_DONTTRUST | RES_VERSION | \
+ RES_NOPEER | RES_NOEPEER | \
+ RES_LIMITED | RES_NOQUERY | \
RES_NOMODIFY | RES_NOTRAP | \
RES_LPTRAP | RES_KOD | \
RES_MSSNTP | RES_FLAKE | \
diff --git a/include/ntp_config.h b/include/ntp_config.h
index dbb64e3a2..2fce70945 100644
--- a/include/ntp_config.h
+++ b/include/ntp_config.h
@@ -113,7 +113,9 @@ struct restrict_node_tag {
address_node * addr;
address_node * mask;
attr_val_fifo * flag_tok_fifo;
+ int/*BOOL*/ remove;
int line_no;
+ int column;
short ippeerlimit;
short srvfuzrft;
};
@@ -317,10 +319,13 @@ void destroy_attr_val(attr_val *node);
filegen_node *create_filegen_node(int filegen_token,
attr_val_fifo *options);
string_node *create_string_node(char *str);
-restrict_node *create_restrict_node(address_node *addr,
- address_node *mask,
- short ippeerlimit,
- attr_val_fifo *flags, int line_no);
+restrict_node *create_restrict_node(address_node * addr,
+ address_node * mask,
+ short ippeerlimit,
+ attr_val_fifo * flag_tok_fifo,
+ int/*BOOL*/ remove,
+ int nline,
+ int ncol);
int_node *create_int_node(int val);
addr_opts_node *create_addr_opts_node(address_node *addr,
attr_val_fifo *options);
diff --git a/include/ntpd.h b/include/ntpd.h
index c3ed6684e..28e2d05cd 100644
--- a/include/ntpd.h
+++ b/include/ntpd.h
@@ -277,13 +277,14 @@ extern void reset_auth_stats(void);
/* ntp_restrict.c */
extern void init_restrict (void);
extern void restrictions (sockaddr_u *, r4addr *);
-extern void hack_restrict (restrict_op op, sockaddr_u *resaddr,
- sockaddr_u* resmask, short ippeerlimit,
+extern int/*BOOL*/hack_restrict(restrict_op op, sockaddr_u *resaddr,
+ sockaddr_u *resmask, short ippeerlimit,
u_short mflags, u_short rflags,
- u_long expire);
-extern void restrict_source (sockaddr_u *, int, u_long);
-extern void dump_restricts (void);
+ u_int32 expire);
+extern void restrict_source (sockaddr_u *addr, int/*BOOL*/ remove,
+ u_int32 lifetime);
#ifdef DEBUG
+extern void dump_restricts (void);
extern const char *resop_str (restrict_op op);
extern const char *rflags_str (u_short rflags);
extern const char *mflags_str (u_short mflags);
diff --git a/include/vint64ops.h b/include/vint64ops.h
index 888d34278..50a8c4016 100644
--- a/include/vint64ops.h
+++ b/include/vint64ops.h
@@ -23,6 +23,6 @@ extern vint64 subv64i32(const vint64 * lhs, int32_t rhs);
extern vint64 subv64u32(const vint64 * lhs, uint32_t rhs);
/* parsing. works like strtoul() or strtoull() */
-extern vint64 strtouv64(char const * begp, char const ** const endp, int base);
+extern vint64 strtouv64(char * begp, char ** endp, int base);
#endif /*!defined(VINT64OPS_H)*/
diff --git a/libntp/vint64ops.c b/libntp/vint64ops.c
index 1d5087d95..23c9f26dc 100644
--- a/libntp/vint64ops.c
+++ b/libntp/vint64ops.c
@@ -15,24 +15,25 @@
#include "ntp_types.h"
#include "ntp_fp.h"
+#include "ntp_malloc.h"
#include "vint64ops.h"
/* -------------------------------------------------------------------------*/
vint64
strtouv64(
- char const * begp,
- char const ** const endp,
- int base
+ char * begp,
+ char ** endp,
+ int base
)
{
- vint64 res;
- u_char digit;
- int sig, num;
- const u_char *src;
+ vint64 res;
+ u_char digit;
+ int sig, num;
+ u_char *src;
num = sig = 0;
- src = (const u_char*)begp;
+ src = (u_char *)begp;
while (isspace(*src))
src++;
@@ -61,7 +62,7 @@ strtouv64(
return res;
}
- memset(&res, 0, sizeof(res));
+ ZERO(res);
while (*src) {
if (isdigit(*src))
digit = *src - '0';
@@ -97,7 +98,7 @@ strtouv64(
if (!num)
errno = EINVAL;
if (endp)
- *endp = (const char *)src;
+ *endp = (char *)src;
if (sig)
M_NEG(res.D_s.hi, res.D_s.lo);
return res;
diff --git a/ntpd/complete.conf.in b/ntpd/complete.conf.in
index 77b619773..117e84b6f 100644
--- a/ntpd/complete.conf.in
+++ b/ntpd/complete.conf.in
@@ -37,26 +37,31 @@ pool 0.north-america.pool.ntp.org. iburst preempt
server 1.north-america.pool.ntp.org. iburst
server -4 2.north-america.pool.ntp.org. minpoll 6 maxpoll 10 iburst
server -6 ntp.davehart.net. minpoll 6 maxpoll 10 version 5 burst iburst
-peer -6 davehart.broker.freenet6.net. ident "autokey-group" xleave autokey
+peer -6 example.com. ident "autokey-group" xleave autokey
peer -4 192.168.192.168 key 1 noselect
server [fe80::123%1] xmtnonce
broadcast 192.168.192.255
-manycastclient 224.0.1.1
-manycastclient ff05::101
+manycastclient 224.0.1.1 key 14 iburst
+manycastclient ff05::101 maxpoll 6 key 1
manycastserver 224.0.1.1 ff05::101
multicastclient 224.0.1.1 ff05::101
mru maxage 64 mindepth 600 initalloc 600 initmem 16 incalloc 99 incmem 4 maxdepth 1024 maxmem 4096
discard minimum 1 average 3 monitor 3000
pollskewlist 3 1|2 4 3|4 default 6|7
-restrict default ippeerlimit -1
-restrict default ippeerlimit 0 nomodify limited kod noserve nomrulist
+restrict default
+restrict default ippeerlimit 0 nomodify limited kod nopeer noserve nomrulist
restrict source ippeerlimit 1
restrict source ippeerlimit 2 nomodify limited kod
-restrict trusted.host.name.example.com. ippeerlimit -1 nomodify
-restrict [fe80::1] mask [ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff] ippeerlimit -1
-restrict 127.0.0.1 mask 255.255.255.255 ippeerlimit -1
-restrict 127.0.0.2 ippeerlimit -1 serverresponse fuzz
-restrict ::1 ippeerlimit -1
+restrict trusted.host.name.example.com. nomodify
+delrestrict trusted.host.name.example.com.
+restrict 192.0.2.66 epeer flake lowpriotrap mssntp noepeer noquery notrap notrust ntpport version
+delrestrict source 192.0.2.123
+delrestrict source [2001:db8::123]
+restrict fe80::1
+restrict 127.0.0.1
+restrict ::1
+restrict 192.0.2.2 serverresponse fuzz
+restrict fec0:: mask [ffff::] ignore
interface drop ipv6
interface ignore ipv4
interface drop wildcard
@@ -68,5 +73,5 @@ phone "ATDT13034944774" "ATDT12027621594"
setvar varnondef = "this variable does not have default after the value"
setvar vanity = "name plate" default
trap 127.0.0.1 interface 127.0.0.1 port 1234
-trap 127.0.0.2
+trap 192.0.2.2
reset allpeers auth ctl io mem sys timer
diff --git a/ntpd/invoke-ntp.conf.texi b/ntpd/invoke-ntp.conf.texi
index 6279bb2fa..89f85287c 100644
--- a/ntpd/invoke-ntp.conf.texi
+++ b/ntpd/invoke-ntp.conf.texi
@@ -6,7 +6,7 @@
#
# EDIT THIS FILE WITH CAUTION (invoke-ntp.conf.texi)
#
-# It has been AutoGen-ed September 5, 2023 at 07:46:41 PM by AutoGen 5.18.16
+# It has been AutoGen-ed September 30, 2023 at 03:20:45 AM by AutoGen 5.18.16
# From the definitions ntp.conf.def
# and the template file agtexi-file.tpl
@end ignore
@@ -1457,25 +1457,26 @@ by default the probability of replacing it with an
entry representing the client request being processed
now is 10%. Conversely, if the oldest entry is more
than 3000 seconds old, the probability is 100%.
-@item @code{restrict} @code{address} @code{[@code{mask} @kbd{mask}]} @code{[@code{ippeerlimit} @kbd{int}]} @code{[@kbd{flag} @kbd{...}]}
+@item @code{restrict} @kbd{address} @code{[@code{mask} @kbd{mask}]} @code{[@code{ippeerlimit} @kbd{int}]} @code{[@kbd{flag} @kbd{...}]}
The
@kbd{address}
argument expressed in
-dotted-quad form is the address of a host or network.
+numeric form is the address of a host or network.
Alternatively, the
@kbd{address}
-argument can be a valid host DNS name.
+argument can be a valid hostname. When a hostname
+is provided, a restriction entry is created for each
+address the hostname resolves to, and any provided
+@kbd{mask}
+is ignored and an individual host mask is
+used for each entry.
The
@kbd{mask}
-argument expressed in dotted-quad form defaults to
-@code{255.255.255.255},
-meaning that the
+argument expressed in numeric form defaults to
+all bits lit, meaning that the
@kbd{address}
is treated as the address of an individual host.
-A default entry (address
-@code{0.0.0.0},
-mask
-@code{0.0.0.0})
+A default entry with address and mask all zeroes
is always included and is always the first entry in the list.
Note that text string
@code{default},
@@ -1512,12 +1513,12 @@ and
@code{ntpdc(1ntpdcmdoc)}
queries.
@item @code{kod}
-If this flag is set when an access violation occurs, a kiss-o'-death
-(KoD) packet is sent.
-KoD packets are rate limited to no more than one
-per second.
-If another KoD packet occurs within one second after the
-last one, the packet is dropped.
+If this flag is set when a rate violation occurs, a kiss-o'-death
+(KoD) packet is sometimes sent.
+KoD packets are rate limited to no more than one per minimum
+average interpacket spacing, set by
+@code{discard} @code{average}
+defaulting to 8s. Otherwise, no response is sent.
@item @code{limited}
Deny service if the packet spacing violates the lower limits specified
in the
@@ -1607,15 +1608,13 @@ restriction flag.
Its presence causes the restriction entry to be
matched only if the source port in the packet is the standard NTP
UDP port (123).
-Both
+There can be two restriction entries with the same IP address if
+one specifies
@code{ntpport}
-and
-@code{non-ntpport}
-may
-be specified.
+and the other does not.
The
@code{ntpport}
-is considered more specific and
+entry is considered more specific and
is sorted later in the list.
@item @code{serverresponse fuzz}
When reponding to server requests,
@@ -1627,12 +1626,28 @@ Deny packets that do not match the current NTP version.
Default restriction list entries with the flags ignore, interface,
ntpport, for each of the local host's interface addresses are
-inserted into the table at startup to prevent the server
-from attempting to synchronize to its own time.
+inserted into the table at startup to prevent ntpd
+from attempting to synchronize to itself, such as with
+@code{manycastclient}
+when
+@code{manycast}
+is also specified with the same multicast address.
A default entry is also always present, though if it is
otherwise unconfigured; no flags are associated
with the default entry (i.e., everything besides your own
NTP server is unrestricted).
+@item @code{delrestrict} @code{[source]} @kbd{address}
+Remove a previously-set restriction. This is useful for
+runtime configuration via
+@code{ntpq(1ntpqmdoc)}
+. If
+@code{source}
+is specified, a dynamic restriction created from the
+@code{restrict} @code{source}
+template at the time
+an association was added is removed. Without
+@code{source}
+a static restriction is removed.
@end table
@node Automatic NTP Configuration Options
@subsection Automatic NTP Configuration Options
diff --git a/ntpd/keyword-gen-utd b/ntpd/keyword-gen-utd
index 0eb94005b..60bc132ce 100644
--- a/ntpd/keyword-gen-utd
+++ b/ntpd/keyword-gen-utd
@@ -1 +1 @@
- * Generated 2022-03-27 14:17:11 UTC diff_ignore_line
+ * Generated 2023-09-25 05:34:02 UTC diff_ignore_line
diff --git a/ntpd/keyword-gen.c b/ntpd/keyword-gen.c
index 7c498b2f5..014227a2b 100644
--- a/ntpd/keyword-gen.c
+++ b/ntpd/keyword-gen.c
@@ -44,6 +44,7 @@ struct key_tok ntp_keywords[] = {
{ "broadcastdelay", T_Broadcastdelay, FOLLBY_TOKEN },
{ "checkhash", T_Checkhash, FOLLBY_TOKEN },
{ "ctl", T_Ctl, FOLLBY_TOKEN },
+{ "delrestrict", T_Delrestrict, FOLLBY_TOKEN },
{ "device", T_Device, FOLLBY_STRING },
{ "disable", T_Disable, FOLLBY_TOKEN },
{ "driftfile", T_Driftfile, FOLLBY_STRING },
diff --git a/ntpd/ntp.conf.5man b/ntpd/ntp.conf.5man
index 8b436000f..edbbc4230 100644
--- a/ntpd/ntp.conf.5man
+++ b/ntpd/ntp.conf.5man
@@ -10,11 +10,11 @@
.ds B-Font B
.ds I-Font I
.ds R-Font R
-.TH ntp.conf 5man "05 Sep 2023" "4.2.8p17" "File Formats"
+.TH ntp.conf 5man "30 Sep 2023" "4.2.8p17" "File Formats"
.\"
.\" EDIT THIS FILE WITH CAUTION (in-mem file)
.\"
-.\" It has been AutoGen-ed September 5, 2023 at 07:46:44 PM by AutoGen 5.18.16
+.\" It has been AutoGen-ed September 30, 2023 at 03:20:48 AM by AutoGen 5.18.16
.\" From the definitions ntp.conf.def
.\" and the template file agman-cmd.tpl
.SH NAME
@@ -1658,25 +1658,26 @@ entry representing the client request being processed
now is 10%. Conversely, if the oldest entry is more
than 3000 seconds old, the probability is 100%.
.TP 7
-.NOP \f\*[B-Font]restrict\f[] \f\*[B-Font]address\f[] [\f\*[B-Font]mask\f[] \f\*[I-Font]mask\f[]] [\f\*[B-Font]ippeerlimit\f[] \f\*[I-Font]int\f[]] [\f\*[I-Font]flag\f[] \f\*[I-Font]...\f[]]
+.NOP \f\*[B-Font]restrict\f[] \f\*[I-Font]address\f[] [\f\*[B-Font]mask\f[] \f\*[I-Font]mask\f[]] [\f\*[B-Font]ippeerlimit\f[] \f\*[I-Font]int\f[]] [\f\*[I-Font]flag\f[] \f\*[I-Font]...\f[]]
The
\f\*[I-Font]address\f[]
argument expressed in
-dotted-quad form is the address of a host or network.
+numeric form is the address of a host or network.
Alternatively, the
\f\*[I-Font]address\f[]
-argument can be a valid host DNS name.
+argument can be a valid hostname. When a hostname
+is provided, a restriction entry is created for each
+address the hostname resolves to, and any provided
+\f\*[I-Font]mask\f[]
+is ignored and an individual host mask is
+used for each entry.
The
\f\*[I-Font]mask\f[]
-argument expressed in dotted-quad form defaults to
-\f\*[B-Font]255.255.255.255\f[],
-meaning that the
+argument expressed in numeric form defaults to
+all bits lit, meaning that the
\f\*[I-Font]address\f[]
is treated as the address of an individual host.
-A default entry (address
-\f\*[B-Font]0.0.0.0\f[],
-mask
-\f\*[B-Font]0.0.0.0\f[])
+A default entry with address and mask all zeroes
is always included and is always the first entry in the list.
Note that text string
\f\*[B-Font]default\f[],
@@ -1715,12 +1716,12 @@ and
queries.
.TP 7
.NOP \f\*[B-Font]kod\f[]
-If this flag is set when an access violation occurs, a kiss-o'-death
-(KoD) packet is sent.
-KoD packets are rate limited to no more than one
-per second.
-If another KoD packet occurs within one second after the
-last one, the packet is dropped.
+If this flag is set when a rate violation occurs, a kiss-o'-death
+(KoD) packet is sometimes sent.
+KoD packets are rate limited to no more than one per minimum
+average interpacket spacing, set by
+\f\*[B-Font]discard\f[] \f\*[B-Font]average\f[]
+defaulting to 8s. Otherwise, no response is sent.
.TP 7
.NOP \f\*[B-Font]limited\f[]
Deny service if the packet spacing violates the lower limits specified
@@ -1820,15 +1821,13 @@ restriction flag.
Its presence causes the restriction entry to be
matched only if the source port in the packet is the standard NTP
UDP port (123).
-Both
+There can be two restriction entries with the same IP address if
+one specifies
\f\*[B-Font]ntpport\f[]
-and
-\f\*[B-Font]non-ntpport\f[]
-may
-be specified.
+and the other does not.
The
\f\*[B-Font]ntpport\f[]
-is considered more specific and
+entry is considered more specific and
is sorted later in the list.
.TP 7
.NOP \f\*[B-Font]serverresponse fuzz\f[]
@@ -1844,12 +1843,29 @@ Deny packets that do not match the current NTP version.
Default restriction list entries with the flags ignore, interface,
ntpport, for each of the local host's interface addresses are
-inserted into the table at startup to prevent the server
-from attempting to synchronize to its own time.
+inserted into the table at startup to prevent ntpd
+from attempting to synchronize to itself, such as with
+\f\*[B-Font]manycastclient\f[]
+when
+\f\*[B-Font]manycast\f[]
+is also specified with the same multicast address.
A default entry is also always present, though if it is
otherwise unconfigured; no flags are associated
with the default entry (i.e., everything besides your own
NTP server is unrestricted).
+.TP 7
+.NOP \f\*[B-Font]delrestrict\f[] [source] \f\*[I-Font]address\f[]
+Remove a previously-set restriction. This is useful for
+runtime configuration via
+\fCntpq\f[]\fR(1ntpqmdoc)\f[]
+. If
+\f\*[B-Font]source\f[]
+is specified, a dynamic restriction created from the
+\f\*[B-Font]restrict\f[] \f\*[B-Font]source\f[]
+template at the time
+an association was added is removed. Without
+\f\*[B-Font]source\f[]
+a static restriction is removed.
.PP
.SH Automatic NTP Configuration Options
.SS Manycasting
diff --git a/ntpd/ntp.conf.5mdoc b/ntpd/ntp.conf.5mdoc
index fec5218b4..a92096496 100644
--- a/ntpd/ntp.conf.5mdoc
+++ b/ntpd/ntp.conf.5mdoc
@@ -1,9 +1,9 @@
-.Dd September 5 2023
+.Dd September 30 2023
.Dt NTP_CONF 5mdoc File Formats
.Os
.\" EDIT THIS FILE WITH CAUTION (ntp.mdoc)
.\"
-.\" It has been AutoGen-ed September 5, 2023 at 07:46:38 PM by AutoGen 5.18.16
+.\" It has been AutoGen-ed September 30, 2023 at 03:20:43 AM by AutoGen 5.18.16
.\" From the definitions ntp.conf.def
.\" and the template file agmdoc-cmd.tpl
.Sh NAME
@@ -1525,7 +1525,8 @@ by default the probability of replacing it with an
entry representing the client request being processed
now is 10%. Conversely, if the oldest entry is more
than 3000 seconds old, the probability is 100%.
-.It Xo Ic restrict address
+.It Xo Ic restrict
+.Ar address
.Op Cm mask Ar mask
.Op Cm ippeerlimit Ar int
.Op Ar flag ...
@@ -1533,21 +1534,22 @@ than 3000 seconds old, the probability is 100%.
The
.Ar address
argument expressed in
-dotted\-quad form is the address of a host or network.
+numeric form is the address of a host or network.
Alternatively, the
.Ar address
-argument can be a valid host DNS name.
+argument can be a valid hostname. When a hostname
+is provided, a restriction entry is created for each
+address the hostname resolves to, and any provided
+.Ar mask
+is ignored and an individual host mask is
+used for each entry.
The
.Ar mask
-argument expressed in dotted\-quad form defaults to
-.Cm 255.255.255.255 ,
-meaning that the
+argument expressed in numeric form defaults to
+all bits lit, meaning that the
.Ar address
is treated as the address of an individual host.
-A default entry (address
-.Cm 0.0.0.0 ,
-mask
-.Cm 0.0.0.0 )
+A default entry with address and mask all zeroes
is always included and is always the first entry in the list.
Note that text string
.Cm default ,
@@ -1584,12 +1586,12 @@ and
.Xr ntpdc 1ntpdcmdoc
queries.
.It Cm kod
-If this flag is set when an access violation occurs, a kiss\-o'\-death
-(KoD) packet is sent.
-KoD packets are rate limited to no more than one
-per second.
-If another KoD packet occurs within one second after the
-last one, the packet is dropped.
+If this flag is set when a rate violation occurs, a kiss\-o'\-death
+(KoD) packet is sometimes sent.
+KoD packets are rate limited to no more than one per minimum
+average interpacket spacing, set by
+.Cm discard average
+defaulting to 8s. Otherwise, no response is sent.
.It Cm limited
Deny service if the packet spacing violates the lower limits specified
in the
@@ -1679,15 +1681,13 @@ restriction flag.
Its presence causes the restriction entry to be
matched only if the source port in the packet is the standard NTP
UDP port (123).
-Both
+There can be two restriction entries with the same IP address if
+one specifies
.Cm ntpport
-and
-.Cm non\-ntpport
-may
-be specified.
+and the other does not.
The
.Cm ntpport
-is considered more specific and
+entry is considered more specific and
is sorted later in the list.
.It Ic "serverresponse fuzz"
When reponding to server requests,
@@ -1699,12 +1699,31 @@ Deny packets that do not match the current NTP version.
.Pp
Default restriction list entries with the flags ignore, interface,
ntpport, for each of the local host's interface addresses are
-inserted into the table at startup to prevent the server
-from attempting to synchronize to its own time.
+inserted into the table at startup to prevent ntpd
+from attempting to synchronize to itself, such as with
+.Cm manycastclient
+when
+.Cm manycast
+is also specified with the same multicast address.
A default entry is also always present, though if it is
otherwise unconfigured; no flags are associated
with the default entry (i.e., everything besides your own
NTP server is unrestricted).
+.It Xo Ic delrestrict
+.Op source
+.Ar address
+.Xc
+Remove a previously\-set restriction. This is useful for
+runtime configuration via
+.Xr ntpq 1ntpqmdoc
+. If
+.Cm source
+is specified, a dynamic restriction created from the
+.Cm restrict source
+template at the time
+an association was added is removed. Without
+.Cm source
+a static restriction is removed.
.El
.Sh Automatic NTP Configuration Options
.Ss Manycasting
diff --git a/ntpd/ntp.conf.def b/ntpd/ntp.conf.def
index 73a6993fe..444e3b35e 100644
--- a/ntpd/ntp.conf.def
+++ b/ntpd/ntp.conf.def
@@ -1528,7 +1528,8 @@ by default the probability of replacing it with an
entry representing the client request being processed
now is 10%. Conversely, if the oldest entry is more
than 3000 seconds old, the probability is 100%.
-.It Xo Ic restrict address
+.It Xo Ic restrict
+.Ar address
.Op Cm mask Ar mask
.Op Cm ippeerlimit Ar int
.Op Ar flag ...
@@ -1536,21 +1537,22 @@ than 3000 seconds old, the probability is 100%.
The
.Ar address
argument expressed in
-dotted-quad form is the address of a host or network.
+numeric form is the address of a host or network.
Alternatively, the
.Ar address
-argument can be a valid host DNS name.
+argument can be a valid hostname. When a hostname
+is provided, a restriction entry is created for each
+address the hostname resolves to, and any provided
+.Ar mask
+is ignored and an individual host mask is
+used for each entry.
The
.Ar mask
-argument expressed in dotted-quad form defaults to
-.Cm 255.255.255.255 ,
-meaning that the
+argument expressed in numeric form defaults to
+all bits lit, meaning that the
.Ar address
is treated as the address of an individual host.
-A default entry (address
-.Cm 0.0.0.0 ,
-mask
-.Cm 0.0.0.0 )
+A default entry with address and mask all zeroes
is always included and is always the first entry in the list.
Note that text string
.Cm default ,
@@ -1587,12 +1589,12 @@ and
.Xr ntpdc 1ntpdcmdoc
queries.
.It Cm kod
-If this flag is set when an access violation occurs, a kiss-o'-death
-(KoD) packet is sent.
-KoD packets are rate limited to no more than one
-per second.
-If another KoD packet occurs within one second after the
-last one, the packet is dropped.
+If this flag is set when a rate violation occurs, a kiss-o'-death
+(KoD) packet is sometimes sent.
+KoD packets are rate limited to no more than one per minimum
+average interpacket spacing, set by
+.Cm discard average
+defaulting to 8s. Otherwise, no response is sent.
.It Cm limited
Deny service if the packet spacing violates the lower limits specified
in the
@@ -1682,15 +1684,13 @@ restriction flag.
Its presence causes the restriction entry to be
matched only if the source port in the packet is the standard NTP
UDP port (123).
-Both
+There can be two restriction entries with the same IP address if
+one specifies
.Cm ntpport
-and
-.Cm non-ntpport
-may
-be specified.
+and the other does not.
The
.Cm ntpport
-is considered more specific and
+entry is considered more specific and
is sorted later in the list.
.It Ic "serverresponse fuzz"
When reponding to server requests,
@@ -1702,12 +1702,31 @@ Deny packets that do not match the current NTP version.
.Pp
Default restriction list entries with the flags ignore, interface,
ntpport, for each of the local host's interface addresses are
-inserted into the table at startup to prevent the server
-from attempting to synchronize to its own time.
+inserted into the table at startup to prevent ntpd
+from attempting to synchronize to itself, such as with
+.Cm manycastclient
+when
+.Cm manycast
+is also specified with the same multicast address.
A default entry is also always present, though if it is
otherwise unconfigured; no flags are associated
with the default entry (i.e., everything besides your own
NTP server is unrestricted).
+.It Xo Ic delrestrict
+.Op source
+.Ar address
+.Xc
+Remove a previously-set restriction. This is useful for
+runtime configuration via
+.Xr ntpq 1ntpqmdoc
+. If
+.Cm source
+is specified, a dynamic restriction created from the
+.Cm restrict source
+template at the time
+an association was added is removed. Without
+.Cm source
+a static restriction is removed.
.El
.Sh Automatic NTP Configuration Options
.Ss Manycasting
diff --git a/ntpd/ntp.conf.html b/ntpd/ntp.conf.html
index 3785a5c25..e084fcf90 100644
--- a/ntpd/ntp.conf.html
+++ b/ntpd/ntp.conf.html
@@ -1649,25 +1649,26 @@ entry representing the client request being processed
now is 10%. Conversely, if the oldest entry is more
than 3000 seconds old, the probability is 100%.
-restrict address [mask mask] [ippeerlimit int] [flag ...]
+restrict address [mask mask] [ippeerlimit int] [flag ...]
The
address
argument expressed in
-dotted-quad form is the address of a host or network.
+numeric form is the address of a host or network.
Alternatively, the
address
-argument can be a valid host DNS name.
+argument can be a valid hostname. When a hostname
+is provided, a restriction entry is created for each
+address the hostname resolves to, and any provided
+mask
+is ignored and an individual host mask is
+used for each entry.
The
mask
-argument expressed in dotted-quad form defaults to
-255.255.255.255,
-meaning that the
+argument expressed in numeric form defaults to
+all bits lit, meaning that the
address
is treated as the address of an individual host.
-A default entry (address
-0.0.0.0,
-mask
-0.0.0.0)
+A default entry with address and mask all zeroes
is always included and is always the first entry in the list.
Note that text string
default,
@@ -1705,12 +1706,12 @@ and
queries.
kod
-If this flag is set when an access violation occurs, a kiss-o’-death
-(KoD) packet is sent.
-KoD packets are rate limited to no more than one
-per second.
-If another KoD packet occurs within one second after the
-last one, the packet is dropped.
+
If this flag is set when a rate violation occurs, a kiss-o’-death
+(KoD) packet is sometimes sent.
+KoD packets are rate limited to no more than one per minimum
+average interpacket spacing, set by
+discard average
+defaulting to 8s. Otherwise, no response is sent.
limited
Deny service if the packet spacing violates the lower limits specified
@@ -1810,15 +1811,13 @@ restriction flag.
Its presence causes the restriction entry to be
matched only if the source port in the packet is the standard NTP
UDP port (123).
-Both
+There can be two restriction entries with the same IP address if
+one specifies
ntpport
-and
-non-ntpport
-may
-be specified.
+and the other does not.
The
ntpport
-is considered more specific and
+entry is considered more specific and
is sorted later in the list.
serverresponse fuzz
@@ -1833,13 +1832,30 @@ fuzz the low order bits of the
Default restriction list entries with the flags ignore, interface,
ntpport, for each of the local host’s interface addresses are
-inserted into the table at startup to prevent the server
-from attempting to synchronize to its own time.
+inserted into the table at startup to prevent ntpd
+from attempting to synchronize to itself, such as with
+manycastclient
+when
+manycast
+is also specified with the same multicast address.
A default entry is also always present, though if it is
otherwise unconfigured; no flags are associated
with the default entry (i.e., everything besides your own
NTP server is unrestricted).
+delrestrict [source] address
+Remove a previously-set restriction. This is useful for
+runtime configuration via
+ntpq(1ntpqmdoc)
+. If
+source
+is specified, a dynamic restriction created from the
+restrict source
+template at the time
+an association was added is removed. Without
+source
+a static restriction is removed.
+