xref: /openbsd-src/usr.sbin/ntpd/client.c (revision 0b7734b3d77bb9b21afec6f4621cae6c805dbd45)
1 /*	$OpenBSD: client.c,v 1.103 2015/10/23 14:52:20 phessler Exp $ */
2 
3 /*
4  * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org>
5  * Copyright (c) 2004 Alexander Guy <alexander.guy@andern.org>
6  *
7  * Permission to use, copy, modify, and distribute this software for any
8  * purpose with or without fee is hereby granted, provided that the above
9  * copyright notice and this permission notice appear in all copies.
10  *
11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15  * WHATSOEVER RESULTING FROM LOSS OF MIND, USE, DATA OR PROFITS, WHETHER
16  * IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
17  * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18  */
19 
20 #include <sys/types.h>
21 #include <errno.h>
22 #include <md5.h>
23 #include <stdio.h>
24 #include <stdlib.h>
25 #include <string.h>
26 #include <time.h>
27 #include <unistd.h>
28 
29 #include "ntpd.h"
30 
31 int	client_update(struct ntp_peer *);
32 void	set_deadline(struct ntp_peer *, time_t);
33 
34 void
35 set_next(struct ntp_peer *p, time_t t)
36 {
37 	p->next = getmonotime() + t;
38 	p->deadline = 0;
39 	p->poll = t;
40 }
41 
42 void
43 set_deadline(struct ntp_peer *p, time_t t)
44 {
45 	p->deadline = getmonotime() + t;
46 	p->next = 0;
47 }
48 
49 int
50 client_peer_init(struct ntp_peer *p)
51 {
52 	if ((p->query = calloc(1, sizeof(struct ntp_query))) == NULL)
53 		fatal("client_peer_init calloc");
54 	p->query->fd = -1;
55 	p->query->msg.status = MODE_CLIENT | (NTP_VERSION << 3);
56 	p->state = STATE_NONE;
57 	p->shift = 0;
58 	p->trustlevel = TRUSTLEVEL_PATHETIC;
59 	p->lasterror = 0;
60 	p->senderrors = 0;
61 
62 	return (client_addr_init(p));
63 }
64 
65 int
66 client_addr_init(struct ntp_peer *p)
67 {
68 	struct sockaddr_in	*sa_in;
69 	struct sockaddr_in6	*sa_in6;
70 	struct ntp_addr		*h;
71 
72 	for (h = p->addr; h != NULL; h = h->next) {
73 		switch (h->ss.ss_family) {
74 		case AF_INET:
75 			sa_in = (struct sockaddr_in *)&h->ss;
76 			if (ntohs(sa_in->sin_port) == 0)
77 				sa_in->sin_port = htons(123);
78 			p->state = STATE_DNS_DONE;
79 			break;
80 		case AF_INET6:
81 			sa_in6 = (struct sockaddr_in6 *)&h->ss;
82 			if (ntohs(sa_in6->sin6_port) == 0)
83 				sa_in6->sin6_port = htons(123);
84 			p->state = STATE_DNS_DONE;
85 			break;
86 		default:
87 			fatalx("king bula sez: wrong AF in client_addr_init");
88 			/* NOTREACHED */
89 		}
90 	}
91 
92 	p->query->fd = -1;
93 	set_next(p, 0);
94 
95 	return (0);
96 }
97 
98 int
99 client_nextaddr(struct ntp_peer *p)
100 {
101 	if (p->query->fd != -1) {
102 		close(p->query->fd);
103 		p->query->fd = -1;
104 	}
105 
106 	if (p->state == STATE_DNS_INPROGRESS)
107 		return (-1);
108 
109 	if (p->addr_head.a == NULL) {
110 		priv_dns(IMSG_HOST_DNS, p->addr_head.name, p->id);
111 		p->state = STATE_DNS_INPROGRESS;
112 		return (-1);
113 	}
114 
115 	if (p->addr == NULL || (p->addr = p->addr->next) == NULL)
116 		p->addr = p->addr_head.a;
117 
118 	p->shift = 0;
119 	p->trustlevel = TRUSTLEVEL_PATHETIC;
120 
121 	return (0);
122 }
123 
124 int
125 client_query(struct ntp_peer *p)
126 {
127 	int	val;
128 
129 	if (p->addr == NULL && client_nextaddr(p) == -1) {
130 		set_next(p, MAXIMUM(SETTIME_TIMEOUT,
131 		    scale_interval(INTERVAL_QUERY_AGGRESSIVE)));
132 		return (0);
133 	}
134 
135 	if (p->state < STATE_DNS_DONE || p->addr == NULL)
136 		return (-1);
137 
138 	if (p->query->fd == -1) {
139 		struct sockaddr *sa = (struct sockaddr *)&p->addr->ss;
140 
141 		if ((p->query->fd = socket(p->addr->ss.ss_family, SOCK_DGRAM,
142 		    0)) == -1)
143 			fatal("client_query socket");
144 
145 		if (connect(p->query->fd, sa, SA_LEN(sa)) == -1) {
146 			if (errno == ECONNREFUSED || errno == ENETUNREACH ||
147 			    errno == EHOSTUNREACH || errno == EADDRNOTAVAIL) {
148 				client_nextaddr(p);
149 				set_next(p, MAXIMUM(SETTIME_TIMEOUT,
150 				    scale_interval(INTERVAL_QUERY_AGGRESSIVE)));
151 				return (-1);
152 			} else
153 				fatal("client_query connect");
154 		}
155 		val = IPTOS_LOWDELAY;
156 		if (p->addr->ss.ss_family == AF_INET && setsockopt(p->query->fd,
157 		    IPPROTO_IP, IP_TOS, &val, sizeof(val)) == -1)
158 			log_warn("setsockopt IPTOS_LOWDELAY");
159 		val = 1;
160 		if (setsockopt(p->query->fd, SOL_SOCKET, SO_TIMESTAMP,
161 		    &val, sizeof(val)) == -1)
162 			fatal("setsockopt SO_TIMESTAMP");
163 	}
164 
165 	/*
166 	 * Send out a random 64-bit number as our transmit time.  The NTP
167 	 * server will copy said number into the originate field on the
168 	 * response that it sends us.  This is totally legal per the SNTP spec.
169 	 *
170 	 * The impact of this is two fold: we no longer send out the current
171 	 * system time for the world to see (which may aid an attacker), and
172 	 * it gives us a (not very secure) way of knowing that we're not
173 	 * getting spoofed by an attacker that can't capture our traffic
174 	 * but can spoof packets from the NTP server we're communicating with.
175 	 *
176 	 * Save the real transmit timestamp locally.
177 	 */
178 
179 	p->query->msg.xmttime.int_partl = arc4random();
180 	p->query->msg.xmttime.fractionl = arc4random();
181 	p->query->xmttime = gettime_corrected();
182 
183 	if (ntp_sendmsg(p->query->fd, NULL, &p->query->msg) == -1) {
184 		p->senderrors++;
185 		set_next(p, INTERVAL_QUERY_PATHETIC);
186 		p->trustlevel = TRUSTLEVEL_PATHETIC;
187 		return (-1);
188 	}
189 
190 	p->senderrors = 0;
191 	p->state = STATE_QUERY_SENT;
192 	set_deadline(p, QUERYTIME_MAX);
193 
194 	return (0);
195 }
196 
197 int
198 client_dispatch(struct ntp_peer *p, u_int8_t settime)
199 {
200 	struct ntp_msg		 msg;
201 	struct msghdr		 somsg;
202 	struct iovec		 iov[1];
203 	struct timeval		 tv;
204 	char			 buf[NTP_MSGSIZE];
205 	union {
206 		struct cmsghdr	hdr;
207 		char		buf[CMSG_SPACE(sizeof(tv))];
208 	} cmsgbuf;
209 	struct cmsghdr		*cmsg;
210 	ssize_t			 size;
211 	double			 T1, T2, T3, T4;
212 	time_t			 interval;
213 
214 	memset(&somsg, 0, sizeof(somsg));
215 	iov[0].iov_base = buf;
216 	iov[0].iov_len = sizeof(buf);
217 	somsg.msg_iov = iov;
218 	somsg.msg_iovlen = 1;
219 	somsg.msg_control = cmsgbuf.buf;
220 	somsg.msg_controllen = sizeof(cmsgbuf.buf);
221 
222 	T4 = getoffset();
223 	if ((size = recvmsg(p->query->fd, &somsg, 0)) == -1) {
224 		if (errno == EHOSTUNREACH || errno == EHOSTDOWN ||
225 		    errno == ENETUNREACH || errno == ENETDOWN ||
226 		    errno == ECONNREFUSED || errno == EADDRNOTAVAIL ||
227 		    errno == ENOPROTOOPT || errno == ENOENT) {
228 			client_log_error(p, "recvmsg", errno);
229 			set_next(p, error_interval());
230 			return (0);
231 		} else
232 			fatal("recvfrom");
233 	}
234 
235 	if (somsg.msg_flags & MSG_TRUNC) {
236 		client_log_error(p, "recvmsg packet", EMSGSIZE);
237 		set_next(p, error_interval());
238 		return (0);
239 	}
240 
241 	if (somsg.msg_flags & MSG_CTRUNC) {
242 		client_log_error(p, "recvmsg control data", E2BIG);
243 		set_next(p, error_interval());
244 		return (0);
245 	}
246 
247 	for (cmsg = CMSG_FIRSTHDR(&somsg); cmsg != NULL;
248 	    cmsg = CMSG_NXTHDR(&somsg, cmsg)) {
249 		if (cmsg->cmsg_level == SOL_SOCKET &&
250 		    cmsg->cmsg_type == SCM_TIMESTAMP) {
251 			memcpy(&tv, CMSG_DATA(cmsg), sizeof(tv));
252 			T4 += gettime_from_timeval(&tv);
253 			break;
254 		}
255 	}
256 
257 	if (T4 < JAN_1970) {
258 		client_log_error(p, "recvmsg control format", EBADF);
259 		set_next(p, error_interval());
260 		return (0);
261 	}
262 
263 	ntp_getmsg((struct sockaddr *)&p->addr->ss, buf, size, &msg);
264 
265 	if (msg.orgtime.int_partl != p->query->msg.xmttime.int_partl ||
266 	    msg.orgtime.fractionl != p->query->msg.xmttime.fractionl)
267 		return (0);
268 
269 	if ((msg.status & LI_ALARM) == LI_ALARM || msg.stratum == 0 ||
270 	    msg.stratum > NTP_MAXSTRATUM) {
271 		char s[16];
272 
273 		if ((msg.status & LI_ALARM) == LI_ALARM) {
274 			strlcpy(s, "alarm", sizeof(s));
275 		} else if (msg.stratum == 0) {
276 			/* Kiss-o'-Death (KoD) packet */
277 			strlcpy(s, "KoD", sizeof(s));
278 		} else if (msg.stratum > NTP_MAXSTRATUM) {
279 			snprintf(s, sizeof(s), "stratum %d", msg.stratum);
280 		}
281 		interval = error_interval();
282 		set_next(p, interval);
283 		log_info("reply from %s: not synced (%s), next query %llds",
284 		    log_sockaddr((struct sockaddr *)&p->addr->ss), s,
285 			(long long)interval);
286 		return (0);
287 	}
288 
289 	/*
290 	 * From RFC 2030 (with a correction to the delay math):
291 	 *
292 	 *     Timestamp Name          ID   When Generated
293 	 *     ------------------------------------------------------------
294 	 *     Originate Timestamp     T1   time request sent by client
295 	 *     Receive Timestamp       T2   time request received by server
296 	 *     Transmit Timestamp      T3   time reply sent by server
297 	 *     Destination Timestamp   T4   time reply received by client
298 	 *
299 	 *  The roundtrip delay d and local clock offset t are defined as
300 	 *
301 	 *    d = (T4 - T1) - (T3 - T2)     t = ((T2 - T1) + (T3 - T4)) / 2.
302 	 */
303 
304 	T1 = p->query->xmttime;
305 	T2 = lfp_to_d(msg.rectime);
306 	T3 = lfp_to_d(msg.xmttime);
307 
308 	/*
309 	 * XXX workaround: time_t / tv_sec must never wrap.
310 	 * around 2020 we will need a solution (64bit time_t / tv_sec).
311 	 * consider every answer with a timestamp beyond january 2030 bogus.
312 	 */
313 	if (T2 > JAN_2030 || T3 > JAN_2030) {
314 		set_next(p, error_interval());
315 		return (0);
316 	}
317 
318 	/* Detect liars */
319 	if (conf->constraint_median != 0 &&
320 	    (constraint_check(T2) != 0 || constraint_check(T3) != 0)) {
321 		log_info("reply from %s: constraint check failed",
322 		    log_sockaddr((struct sockaddr *)&p->addr->ss));
323 		set_next(p, error_interval());
324 		return (0);
325 	}
326 
327 	p->reply[p->shift].offset = ((T2 - T1) + (T3 - T4)) / 2;
328 	p->reply[p->shift].delay = (T4 - T1) - (T3 - T2);
329 	p->reply[p->shift].status.stratum = msg.stratum;
330 	if (p->reply[p->shift].delay < 0) {
331 		interval = error_interval();
332 		set_next(p, interval);
333 		log_info("reply from %s: negative delay %fs, "
334 		    "next query %llds",
335 		    log_sockaddr((struct sockaddr *)&p->addr->ss),
336 		    p->reply[p->shift].delay, (long long)interval);
337 		return (0);
338 	}
339 	p->reply[p->shift].error = (T2 - T1) - (T3 - T4);
340 	p->reply[p->shift].rcvd = getmonotime();
341 	p->reply[p->shift].good = 1;
342 
343 	p->reply[p->shift].status.leap = (msg.status & LIMASK);
344 	p->reply[p->shift].status.precision = msg.precision;
345 	p->reply[p->shift].status.rootdelay = sfp_to_d(msg.rootdelay);
346 	p->reply[p->shift].status.rootdispersion = sfp_to_d(msg.dispersion);
347 	p->reply[p->shift].status.refid = msg.refid;
348 	p->reply[p->shift].status.reftime = lfp_to_d(msg.reftime);
349 	p->reply[p->shift].status.poll = msg.ppoll;
350 
351 	if (p->addr->ss.ss_family == AF_INET) {
352 		p->reply[p->shift].status.send_refid =
353 		    ((struct sockaddr_in *)&p->addr->ss)->sin_addr.s_addr;
354 	} else if (p->addr->ss.ss_family == AF_INET6) {
355 		MD5_CTX		context;
356 		u_int8_t	digest[MD5_DIGEST_LENGTH];
357 
358 		MD5Init(&context);
359 		MD5Update(&context, ((struct sockaddr_in6 *)&p->addr->ss)->
360 		    sin6_addr.s6_addr, sizeof(struct in6_addr));
361 		MD5Final(digest, &context);
362 		memcpy((char *)&p->reply[p->shift].status.send_refid, digest,
363 		    sizeof(u_int32_t));
364 	} else
365 		p->reply[p->shift].status.send_refid = msg.xmttime.fractionl;
366 
367 	if (p->trustlevel < TRUSTLEVEL_PATHETIC)
368 		interval = scale_interval(INTERVAL_QUERY_PATHETIC);
369 	else if (p->trustlevel < TRUSTLEVEL_AGGRESSIVE)
370 		interval = scale_interval(INTERVAL_QUERY_AGGRESSIVE);
371 	else
372 		interval = scale_interval(INTERVAL_QUERY_NORMAL);
373 
374 	set_next(p, interval);
375 	p->state = STATE_REPLY_RECEIVED;
376 
377 	/* every received reply which we do not discard increases trust */
378 	if (p->trustlevel < TRUSTLEVEL_MAX) {
379 		if (p->trustlevel < TRUSTLEVEL_BADPEER &&
380 		    p->trustlevel + 1 >= TRUSTLEVEL_BADPEER)
381 			log_info("peer %s now valid",
382 			    log_sockaddr((struct sockaddr *)&p->addr->ss));
383 		p->trustlevel++;
384 	}
385 
386 	log_debug("reply from %s: offset %f delay %f, "
387 	    "next query %llds",
388 	    log_sockaddr((struct sockaddr *)&p->addr->ss),
389 	    p->reply[p->shift].offset, p->reply[p->shift].delay,
390 	    (long long)interval);
391 
392 	client_update(p);
393 	if (settime)
394 		priv_settime(p->reply[p->shift].offset);
395 
396 	if (++p->shift >= OFFSET_ARRAY_SIZE)
397 		p->shift = 0;
398 
399 	return (0);
400 }
401 
402 int
403 client_update(struct ntp_peer *p)
404 {
405 	int	i, best = 0, good = 0;
406 
407 	/*
408 	 * clock filter
409 	 * find the offset which arrived with the lowest delay
410 	 * use that as the peer update
411 	 * invalidate it and all older ones
412 	 */
413 
414 	for (i = 0; good == 0 && i < OFFSET_ARRAY_SIZE; i++)
415 		if (p->reply[i].good) {
416 			good++;
417 			best = i;
418 		}
419 
420 	for (; i < OFFSET_ARRAY_SIZE; i++)
421 		if (p->reply[i].good) {
422 			good++;
423 			if (p->reply[i].delay < p->reply[best].delay)
424 				best = i;
425 		}
426 
427 	if (good < 8)
428 		return (-1);
429 
430 	memcpy(&p->update, &p->reply[best], sizeof(p->update));
431 	if (priv_adjtime() == 0) {
432 		for (i = 0; i < OFFSET_ARRAY_SIZE; i++)
433 			if (p->reply[i].rcvd <= p->reply[best].rcvd)
434 				p->reply[i].good = 0;
435 	}
436 	return (0);
437 }
438 
439 void
440 client_log_error(struct ntp_peer *peer, const char *operation, int error)
441 {
442 	const char *address;
443 
444 	address = log_sockaddr((struct sockaddr *)&peer->addr->ss);
445 	if (peer->lasterror == error) {
446 		log_debug("%s %s: %s", operation, address, strerror(error));
447 		return;
448 	}
449 	peer->lasterror = error;
450 	log_warn("%s %s", operation, address);
451 }
452