contrib/ntp/ntpd/ntp_io.c

   1 /*
   2  * ntp_io.c - input/output routines for ntpd.   The socket-opening code
   3  *                 was shamelessly stolen from ntpd.
   4  */
   5
   6 #ifdef HAVE_CONFIG_H
   7 # include <config.h>
   8 #endif
   9
  10 #include <stdio.h>
  11 #include <signal.h>
  12 #ifdef HAVE_FNMATCH_H
  13 # include <fnmatch.h>
  14 # if !defined(FNM_CASEFOLD) && defined(FNM_IGNORECASE)
  15 #  define FNM_CASEFOLD FNM_IGNORECASE
  16 # endif
  17 #endif
  18 #ifdef HAVE_SYS_PARAM_H
  19 # include <sys/param.h>
  20 #endif
  21 #ifdef HAVE_SYS_IOCTL_H
  22 # include <sys/ioctl.h>
  23 #endif
  24 #ifdef HAVE_SYS_SOCKIO_H        /* UXPV: SIOC* #defines (Frank Vance <fvance@waii.com>) */
  25 # include <sys/sockio.h>
  26 #endif
  27 #ifdef HAVE_SYS_UIO_H
  28 # include <sys/uio.h>
  29 #endif
  30
  31 #include "ntp_machine.h"
  32 #include "ntpd.h"
  33 #include "ntp_io.h"
  34 #include "iosignal.h"
  35 #include "ntp_lists.h"
  36 #include "ntp_refclock.h"
  37 #include "ntp_stdlib.h"
  38 #include "ntp_worker.h"
  39 #include "ntp_request.h"
  40 #include "ntp_assert.h"
  41 #include "timevalops.h"
  42 #include "timespecops.h"
  43 #include "ntpd-opts.h"
  44
  45 /* Don't include ISC's version of IPv6 variables and structures */
  46 #define ISC_IPV6_H 1
  47 #include <isc/mem.h>
  48 #include <isc/interfaceiter.h>
  49 #include <isc/netaddr.h>
  50 #include <isc/result.h>
  51 #include <isc/sockaddr.h>
  52
  53 #ifdef SIM
  54 #include "ntpsim.h"
  55 #endif
  56
  57 #ifdef HAS_ROUTING_SOCKET
  58 # include <net/route.h>
  59 # ifdef HAVE_RTNETLINK
  60 #  include <linux/rtnetlink.h>
  61 # endif
  62 #endif
  63
  64
  65 /*
  66  * setsockopt does not always have the same arg declaration
  67  * across all platforms. If it's not defined we make it empty
  68  */
  69
  70 #ifndef SETSOCKOPT_ARG_CAST
  71 #define SETSOCKOPT_ARG_CAST
  72 #endif
  73
  74 extern int listen_to_virtual_ips;
  75
  76 #ifndef IPTOS_DSCP_EF
  77 #define IPTOS_DSCP_EF 0xb8
  78 #endif
  79 int qos = IPTOS_DSCP_EF;        /* QoS RFC3246 */
  80
  81 #ifdef LEAP_SMEAR
  82 /* TODO burnicki: This should be moved to ntp_timer.c, but if we do so
  83  * we get a linker error. Since we're running out of time before the leap
  84  * second occurs, we let it here where it just works.
  85  */
  86 int leap_smear_intv;
  87 #endif
  88
  89 /*
  90  * NIC rule entry
  91  */
  92 typedef struct nic_rule_tag nic_rule;
  93
  94 struct nic_rule_tag {
  95         nic_rule *      next;
  96         nic_rule_action action;
  97         nic_rule_match  match_type;
  98         char *          if_name;
  99         sockaddr_u      addr;
 100         int             prefixlen;
 101 };
 102
 103 /*
 104  * NIC rule listhead.  Entries are added at the head so that the first
 105  * match in the list is the last matching rule specified.
 106  */
 107 nic_rule *nic_rule_list;
 108
 109
 110 #if defined(SO_BINTIME) && defined(SCM_BINTIME) && defined(CMSG_FIRSTHDR)
 111 #  define HAVE_PACKET_TIMESTAMP
 112 #  define HAVE_BINTIME
 113 #  ifdef BINTIME_CTLMSGBUF_SIZE
 114 #   define CMSG_BUFSIZE BINTIME_CTLMSGBUF_SIZE
 115 #  else
 116 #   define CMSG_BUFSIZE  1536 /* moderate default */
 117 #  endif
 118 #elif defined(SO_TIMESTAMPNS) && defined(SCM_TIMESTAMPNS) && defined(CMSG_FIRSTHDR)
 119 #  define HAVE_PACKET_TIMESTAMP
 120 #  define HAVE_TIMESTAMPNS
 121 #  ifdef TIMESTAMPNS_CTLMSGBUF_SIZE
 122 #   define CMSG_BUFSIZE TIMESTAMPNS_CTLMSGBUF_SIZE
 123 #  else
 124 #   define CMSG_BUFSIZE  1536 /* moderate default */
 125 #  endif
 126 #elif defined(SO_TIMESTAMP) && defined(SCM_TIMESTAMP) && defined(CMSG_FIRSTHDR)
 127 #  define HAVE_PACKET_TIMESTAMP
 128 #  define HAVE_TIMESTAMP
 129 #  ifdef TIMESTAMP_CTLMSGBUF_SIZE
 130 #   define CMSG_BUFSIZE TIMESTAMP_CTLMSGBUF_SIZE
 131 #  else
 132 #   define CMSG_BUFSIZE  1536 /* moderate default */
 133 #  endif
 134 #else
 135 /* fill in for old/other timestamp interfaces */
 136 #endif
 137
 138 #if defined(SYS_WINNT)
 139 #include "win32_io.h"
 140 #include <isc/win32os.h>
 141 #endif
 142
 143 /*
 144  * We do asynchronous input using the SIGIO facility.  A number of
 145  * recvbuf buffers are preallocated for input.  In the signal
 146  * handler we poll to see which sockets are ready and read the
 147  * packets from them into the recvbuf's along with a time stamp and
 148  * an indication of the source host and the interface it was received
 149  * through.  This allows us to get as accurate receive time stamps
 150  * as possible independent of other processing going on.
 151  *
 152  * We watch the number of recvbufs available to the signal handler
 153  * and allocate more when this number drops below the low water
 154  * mark.  If the signal handler should run out of buffers in the
 155  * interim it will drop incoming frames, the idea being that it is
 156  * better to drop a packet than to be inaccurate.
 157  */
 158
 159
 160 /*
 161  * Other statistics of possible interest
 162  */
 163 volatile u_long packets_dropped;        /* total number of packets dropped on reception */
 164 volatile u_long packets_ignored;        /* packets received on wild card interface */
 165 volatile u_long packets_received;       /* total number of packets received */
 166          u_long packets_sent;           /* total number of packets sent */
 167          u_long packets_notsent;        /* total number of packets which couldn't be sent */
 168
 169 volatile u_long handler_calls;  /* number of calls to interrupt handler */
 170 volatile u_long handler_pkts;   /* number of pkts received by handler */
 171 u_long io_timereset;            /* time counters were reset */
 172
 173 /*
 174  * Interface stuff
 175  */
 176 endpt * any_interface;          /* wildcard ipv4 interface */
 177 endpt * any6_interface;         /* wildcard ipv6 interface */
 178 endpt * loopback_interface;     /* loopback ipv4 interface */
 179
 180 isc_boolean_t broadcast_client_enabled; /* is broadcast client enabled */
 181 u_int sys_ifnum;                        /* next .ifnum to assign */
 182 int ninterfaces;                        /* Total number of interfaces */
 183
 184 int disable_dynamic_updates;            /* scan interfaces once only */
 185
 186 #ifdef REFCLOCK
 187 /*
 188  * Refclock stuff.      We keep a chain of structures with data concerning
 189  * the guys we are doing I/O for.
 190  */
 191 static  struct refclockio *refio;
 192 #endif /* REFCLOCK */
 193
 194 /*
 195  * File descriptor masks etc. for call to select
 196  * Not needed for I/O Completion Ports or anything outside this file
 197  */
 198 static fd_set activefds;
 199 static int maxactivefd;
 200
 201 /*
 202  * bit alternating value to detect verified interfaces during an update cycle
 203  */
 204 static  u_short         sys_interphase = 0;
 205
 206 static endpt *  new_interface(endpt *);
 207 static void     add_interface(endpt *);
 208 static int      update_interfaces(u_short, interface_receiver_t,
 209                                   void *);
 210 static void     remove_interface(endpt *);
 211 static endpt *  create_interface(u_short, endpt *);
 212
 213 static int      is_wildcard_addr        (const sockaddr_u *);
 214
 215 /*
 216  * Multicast functions
 217  */
 218 static  isc_boolean_t   addr_ismulticast        (sockaddr_u *);
 219 static  isc_boolean_t   is_not_bindable         (sockaddr_u *,
 220                                                  const char *);
 221
 222 /*
 223  * Not all platforms support multicast
 224  */
 225 #ifdef MCAST
 226 static  isc_boolean_t   socket_multicast_enable (endpt *, sockaddr_u *);
 227 static  isc_boolean_t   socket_multicast_disable(endpt *, sockaddr_u *);
 228 #endif
 229
 230 #ifdef DEBUG
 231 static void interface_dump      (const endpt *);
 232 static void sockaddr_dump       (const sockaddr_u *);
 233 static void print_interface     (const endpt *, const char *, const char *);
 234 #define DPRINT_INTERFACE(level, args) do { if (debug >= (level)) { print_interface args; } } while (0)
 235 #else
 236 #define DPRINT_INTERFACE(level, args) do {} while (0)
 237 #endif
 238
 239 typedef struct vsock vsock_t;
 240 enum desc_type { FD_TYPE_SOCKET, FD_TYPE_FILE };
 241
 242 struct vsock {
 243         vsock_t *       link;
 244         SOCKET          fd;
 245         enum desc_type  type;
 246 };
 247
 248 vsock_t *fd_list;
 249
 250 #if !defined(HAVE_IO_COMPLETION_PORT) && defined(HAS_ROUTING_SOCKET)
 251 /*
 252  * async notification processing (e. g. routing sockets)
 253  */
 254 /*
 255  * support for receiving data on fd that is not a refclock or a socket
 256  * like e. g. routing sockets
 257  */
 258 struct asyncio_reader {
 259         struct asyncio_reader *link;                /* the list this is being kept in */
 260         SOCKET fd;                                  /* fd to be read */
 261         void  *data;                                /* possibly local data */
 262         void (*receiver)(struct asyncio_reader *);  /* input handler */
 263 };
 264
 265 struct asyncio_reader *asyncio_reader_list;
 266
 267 static void delete_asyncio_reader (struct asyncio_reader *);
 268 static struct asyncio_reader *new_asyncio_reader (void);
 269 static void add_asyncio_reader (struct asyncio_reader *, enum desc_type);
 270 static void remove_asyncio_reader (struct asyncio_reader *);
 271
 272 #endif /* !defined(HAVE_IO_COMPLETION_PORT) && defined(HAS_ROUTING_SOCKET) */
 273
 274 static void init_async_notifications (void);
 275
 276 static  int     addr_eqprefix   (const sockaddr_u *, const sockaddr_u *,
 277                                  int);
 278 static int      addr_samesubnet (const sockaddr_u *, const sockaddr_u *,
 279                                  const sockaddr_u *, const sockaddr_u *);
 280 static  int     create_sockets  (u_short);
 281 static  SOCKET  open_socket     (sockaddr_u *, int, int, endpt *);
 282 static  char *  fdbits          (int, fd_set *);
 283 static  void    set_reuseaddr   (int);
 284 static  isc_boolean_t   socket_broadcast_enable  (struct interface *, SOCKET, sockaddr_u *);
 285 #ifdef  OS_MISSES_SPECIFIC_ROUTE_UPDATES
 286 static  isc_boolean_t   socket_broadcast_disable (struct interface *, sockaddr_u *);
 287 #endif
 288
 289 typedef struct remaddr remaddr_t;
 290
 291 struct remaddr {
 292         remaddr_t *             link;
 293         sockaddr_u              addr;
 294         endpt *                 ep;
 295 };
 296
 297 remaddr_t *     remoteaddr_list;
 298 endpt *         ep_list;        /* complete endpt list */
 299 endpt *         mc4_list;       /* IPv4 mcast-capable unicast endpts */
 300 endpt *         mc6_list;       /* IPv6 mcast-capable unicast endpts */
 301
 302 static endpt *  wildipv4;
 303 static endpt *  wildipv6;
 304
 305 #ifdef SYS_WINNT
 306 int accept_wildcard_if_for_winnt;
 307 #else
 308 const int accept_wildcard_if_for_winnt = FALSE;
 309 #endif
 310
 311 static void     add_fd_to_list          (SOCKET, enum desc_type);
 312 static endpt *  find_addr_in_list       (sockaddr_u *);
 313 static endpt *  find_flagged_addr_in_list(sockaddr_u *, u_int32);
 314 static void     delete_addr_from_list   (sockaddr_u *);
 315 static void     delete_interface_from_list(endpt *);
 316 static void     close_and_delete_fd_from_list(SOCKET);
 317 static void     add_addr_to_list        (sockaddr_u *, endpt *);
 318 static void     create_wildcards        (u_short);
 319 static endpt *  findlocalinterface      (sockaddr_u *, int, int);
 320 static endpt *  findclosestinterface    (sockaddr_u *, int);
 321 #ifdef DEBUG
 322 static const char *     action_text     (nic_rule_action);
 323 #endif
 324 static nic_rule_action  interface_action(char *, sockaddr_u *, u_int32);
 325 static void             convert_isc_if  (isc_interface_t *,
 326                                          endpt *, u_short);
 327 static void             calc_addr_distance(sockaddr_u *,
 328                                            const sockaddr_u *,
 329                                            const sockaddr_u *);
 330 static int              cmp_addr_distance(const sockaddr_u *,
 331                                           const sockaddr_u *);
 332
 333 /*
 334  * Routines to read the ntp packets
 335  */
 336 #if !defined(HAVE_IO_COMPLETION_PORT)
 337 static inline int       read_network_packet     (SOCKET, struct interface *, l_fp);
 338 static void             ntpd_addremove_io_fd    (int, int, int);
 339 static input_handler_t  input_handler;
 340 #ifdef REFCLOCK
 341 static inline int       read_refclock_packet    (SOCKET, struct refclockio *, l_fp);
 342 #endif
 343 #endif
 344
 345
 346
 347 #ifndef HAVE_IO_COMPLETION_PORT
 348 void
 349 maintain_activefds(
 350         int fd,
 351         int closing
 352         )
 353 {
 354         int i;
 355
 356         if (fd < 0 || fd >= FD_SETSIZE) {
 357                 msyslog(LOG_ERR,
 358                         "Too many sockets in use, FD_SETSIZE %d exceeded by fd %d",
 359                         FD_SETSIZE, fd);
 360                 exit(1);
 361         }
 362
 363         if (!closing) {
 364                 FD_SET(fd, &activefds);
 365                 maxactivefd = max(fd, maxactivefd);
 366         } else {
 367                 FD_CLR(fd, &activefds);
 368                 if (maxactivefd && fd == maxactivefd) {
 369                         for (i = maxactivefd - 1; i >= 0; i--)
 370                                 if (FD_ISSET(i, &activefds)) {
 371                                         maxactivefd = i;
 372                                         break;
 373                                 }
 374                         NTP_INSIST(fd != maxactivefd);
 375                 }
 376         }
 377 }
 378 #endif  /* !HAVE_IO_COMPLETION_PORT */
 379
 380
 381 #ifdef DEBUG_TIMING
 382 /*
 383  * collect timing information for various processing
 384  * paths. currently we only pass them on to the file
 385  * for later processing. this could also do histogram
 386  * based analysis in other to reduce the load (and skew)
 387  * dur to the file output
 388  */
 389 void
 390 collect_timing(struct recvbuf *rb, const char *tag, int count, l_fp *dts)
 391 {
 392         char buf[256];
 393
 394         snprintf(buf, sizeof(buf), "%s %d %s %s",
 395                  (rb != NULL)
 396                      ? ((rb->dstadr != NULL)
 397                             ? stoa(&rb->recv_srcadr)
 398                             : "-REFCLOCK-")
 399                      : "-",
 400                  count, lfptoa(dts, 9), tag);
 401         record_timing_stats(buf);
 402 }
 403 #endif
 404
 405 /*
 406  * About dynamic interfaces, sockets, reception and more...
 407  *
 408  * the code solves following tasks:
 409  *
 410  *   - keep a current list of active interfaces in order
 411  *     to bind to to the interface address on NTP_PORT so that
 412  *     all wild and specific bindings for NTP_PORT are taken by ntpd
 413  *     to avoid other daemons messing with the time or sockets.
 414  *   - all interfaces keep a list of peers that are referencing
 415  *     the interface in order to quickly re-assign the peers to
 416  *     new interface in case an interface is deleted (=> gone from system or
 417  *     down)
 418  *   - have a preconfigured socket ready with the right local address
 419  *     for transmission and reception
 420  *   - have an address list for all destination addresses used within ntpd
 421  *     to find the "right" preconfigured socket.
 422  *   - facilitate updating the internal interface list with respect to
 423  *     the current kernel state
 424  *
 425  * special issues:
 426  *
 427  *   - mapping of multicast addresses to the interface affected is not always
 428  *     one to one - especially on hosts with multiple interfaces
 429  *     the code here currently allocates a separate interface entry for those
 430  *     multicast addresses
 431  *     iff it is able to bind to a *new* socket with the multicast address (flags |= MCASTIF)
 432  *     in case of failure the multicast address is bound to an existing interface.
 433  *   - on some systems it is perfectly legal to assign the same address to
 434  *     multiple interfaces. Therefore this code does not keep a list of interfaces
 435  *     but a list of interfaces that represent a unique address as determined by the kernel
 436  *     by the procedure in findlocalinterface. Thus it is perfectly legal to see only
 437  *     one representative of a group of real interfaces if they share the same address.
 438  *
 439  * Frank Kardel 20050910
 440  */
 441
 442 /*
 443  * init_io - initialize I/O module.
 444  */
 445 void
 446 init_io(void)
 447 {
 448         /* Init buffer free list and stat counters */
 449         init_recvbuff(RECV_INIT);
 450         /* update interface every 5 minutes as default */
 451         interface_interval = 300;
 452
 453 #ifdef WORK_PIPE
 454         addremove_io_fd = &ntpd_addremove_io_fd;
 455 #endif
 456
 457 #ifdef SYS_WINNT
 458         init_io_completion_port();
 459 #endif
 460
 461 #if defined(HAVE_SIGNALED_IO)
 462         (void) set_signal(input_handler);
 463 #endif
 464 }
 465
 466
 467 static void
 468 ntpd_addremove_io_fd(
 469         int     fd,
 470         int     is_pipe,
 471         int     remove_it
 472         )
 473 {
 474         UNUSED_ARG(is_pipe);
 475
 476 #ifdef HAVE_SIGNALED_IO
 477         init_socket_sig(fd);
 478 #endif /* not HAVE_SIGNALED_IO */
 479
 480         maintain_activefds(fd, remove_it);
 481 }
 482
 483
 484 /*
 485  * io_open_sockets - call socket creation routine
 486  */
 487 void
 488 io_open_sockets(void)
 489 {
 490         static int already_opened;
 491
 492         if (already_opened || HAVE_OPT( SAVECONFIGQUIT ))
 493                 return;
 494
 495         already_opened = 1;
 496
 497         /*
 498          * Create the sockets
 499          */
 500         BLOCKIO();
 501         create_sockets(NTP_PORT);
 502         UNBLOCKIO();
 503
 504         init_async_notifications();
 505
 506         DPRINTF(3, ("io_open_sockets: maxactivefd %d\n", maxactivefd));
 507 }
 508
 509
 510 #ifdef DEBUG
 511 /*
 512  * function to dump the contents of the interface structure
 513  * for debugging use only.
 514  */
 515 void
 516 interface_dump(const endpt *itf)
 517 {
 518         printf("Dumping interface: %p\n", itf);
 519         printf("fd = %d\n", itf->fd);
 520         printf("bfd = %d\n", itf->bfd);
 521         printf("sin = %s,\n", stoa(&itf->sin));
 522         sockaddr_dump(&itf->sin);
 523         printf("bcast = %s,\n", stoa(&itf->bcast));
 524         sockaddr_dump(&itf->bcast);
 525         printf("mask = %s,\n", stoa(&itf->mask));
 526         sockaddr_dump(&itf->mask);
 527         printf("name = %s\n", itf->name);
 528         printf("flags = 0x%08x\n", itf->flags);
 529         printf("last_ttl = %d\n", itf->last_ttl);
 530         printf("addr_refid = %08x\n", itf->addr_refid);
 531         printf("num_mcast = %d\n", itf->num_mcast);
 532         printf("received = %ld\n", itf->received);
 533         printf("sent = %ld\n", itf->sent);
 534         printf("notsent = %ld\n", itf->notsent);
 535         printf("ifindex = %u\n", itf->ifindex);
 536         printf("peercnt = %u\n", itf->peercnt);
 537         printf("phase = %u\n", itf->phase);
 538 }
 539
 540 /*
 541  * sockaddr_dump - hex dump the start of a sockaddr_u
 542  */
 543 static void
 544 sockaddr_dump(const sockaddr_u *psau)
 545 {
 546         /* Limit the size of the sockaddr_in6 hex dump */
 547         const int maxsize = min(32, sizeof(psau->sa6));
 548         const u_char *  cp;
 549         int             i;
 550
 551         /* XXX: Should we limit maxsize based on psau->saX.sin_family? */
 552         cp = (const void *)&psau->sa6;
 553
 554         for(i = 0; i < maxsize; i++) {
 555                 printf("%02x", *cp++);
 556                 if (!((i + 1) % 4))
 557                         printf(" ");
 558         }
 559         printf("\n");
 560 }
 561
 562 /*
 563  * print_interface - helper to output debug information
 564  */
 565 static void
 566 print_interface(const endpt *iface, const char *pfx, const char *sfx)
 567 {
 568         printf("%sinterface #%d: fd=%d, bfd=%d, name=%s, flags=0x%x, ifindex=%u, sin=%s",
 569                pfx,
 570                iface->ifnum,
 571                iface->fd,
 572                iface->bfd,
 573                iface->name,
 574                iface->flags,
 575                iface->ifindex,
 576                stoa(&iface->sin));
 577         if (AF_INET == iface->family) {
 578                 if (iface->flags & INT_BROADCAST)
 579                         printf(", bcast=%s", stoa(&iface->bcast));
 580                 printf(", mask=%s", stoa(&iface->mask));
 581         }
 582         printf(", %s:%s",
 583                (iface->ignore_packets)
 584                    ? "Disabled"
 585                    : "Enabled",
 586                sfx);
 587         if (debug > 4)  /* in-depth debugging only */
 588                 interface_dump(iface);
 589 }
 590 #endif
 591
 592 #if !defined(HAVE_IO_COMPLETION_PORT) && defined(HAS_ROUTING_SOCKET)
 593 /*
 594  * create an asyncio_reader structure
 595  */
 596 static struct asyncio_reader *
 597 new_asyncio_reader(void)
 598 {
 599         struct asyncio_reader *reader;
 600
 601         reader = emalloc_zero(sizeof(*reader));
 602         reader->fd = INVALID_SOCKET;
 603
 604         return reader;
 605 }
 606
 607 /*
 608  * delete a reader
 609  */
 610 static void
 611 delete_asyncio_reader(
 612         struct asyncio_reader *reader
 613         )
 614 {
 615         free(reader);
 616 }
 617
 618 /*
 619  * add asynchio_reader
 620  */
 621 static void
 622 add_asyncio_reader(
 623         struct asyncio_reader * reader,
 624         enum desc_type          type)
 625 {
 626         LINK_SLIST(asyncio_reader_list, reader, link);
 627         add_fd_to_list(reader->fd, type);
 628 }
 629
 630 /*
 631  * remove asynchio_reader
 632  */
 633 static void
 634 remove_asyncio_reader(
 635         struct asyncio_reader *reader
 636         )
 637 {
 638         struct asyncio_reader *unlinked;
 639
 640         UNLINK_SLIST(unlinked, asyncio_reader_list, reader, link,
 641             struct asyncio_reader);
 642
 643         if (reader->fd != INVALID_SOCKET)
 644                 close_and_delete_fd_from_list(reader->fd);
 645
 646         reader->fd = INVALID_SOCKET;
 647 }
 648 #endif /* !defined(HAVE_IO_COMPLETION_PORT) && defined(HAS_ROUTING_SOCKET) */
 649
 650
 651 /* compare two sockaddr prefixes */
 652 static int
 653 addr_eqprefix(
 654         const sockaddr_u *      a,
 655         const sockaddr_u *      b,
 656         int                     prefixlen
 657         )
 658 {
 659         isc_netaddr_t           isc_a;
 660         isc_netaddr_t           isc_b;
 661         isc_sockaddr_t          isc_sa;
 662
 663         ZERO(isc_sa);
 664         memcpy(&isc_sa.type, a, min(sizeof(isc_sa.type), sizeof(*a)));
 665         isc_netaddr_fromsockaddr(&isc_a, &isc_sa);
 666
 667         ZERO(isc_sa);
 668         memcpy(&isc_sa.type, b, min(sizeof(isc_sa.type), sizeof(*b)));
 669         isc_netaddr_fromsockaddr(&isc_b, &isc_sa);
 670
 671         return (int)isc_netaddr_eqprefix(&isc_a, &isc_b,
 672                                          (u_int)prefixlen);
 673 }
 674
 675
 676 static int
 677 addr_samesubnet(
 678         const sockaddr_u *      a,
 679         const sockaddr_u *      a_mask,
 680         const sockaddr_u *      b,
 681         const sockaddr_u *      b_mask
 682         )
 683 {
 684         const u_int32 * pa;
 685         const u_int32 * pa_limit;
 686         const u_int32 * pb;
 687         const u_int32 * pm;
 688         size_t          loops;
 689
 690         NTP_REQUIRE(AF(a) == AF(a_mask));
 691         NTP_REQUIRE(AF(b) == AF(b_mask));
 692         /*
 693          * With address and mask families verified to match, comparing
 694          * the masks also validates the address's families match.
 695          */
 696         if (!SOCK_EQ(a_mask, b_mask))
 697                 return FALSE;
 698
 699         if (IS_IPV6(a)) {
 700                 loops = sizeof(NSRCADR6(a)) / sizeof(*pa);
 701                 pa = (const void *)&NSRCADR6(a);
 702                 pb = (const void *)&NSRCADR6(b);
 703                 pm = (const void *)&NSRCADR6(a_mask);
 704         } else {
 705                 loops = sizeof(NSRCADR(a)) / sizeof(*pa);
 706                 pa = (const void *)&NSRCADR(a);
 707                 pb = (const void *)&NSRCADR(b);
 708                 pm = (const void *)&NSRCADR(a_mask);
 709         }
 710         for (pa_limit = pa + loops; pa < pa_limit; pa++, pb++, pm++)
 711                 if ((*pa & *pm) != (*pb & *pm))
 712                         return FALSE;
 713
 714         return TRUE;
 715 }
 716
 717
 718 /*
 719  * Code to tell if we have an IP address
 720  * If we have then return the sockaddr structure
 721  * and set the return value
 722  * see the bind9/getaddresses.c for details
 723  */
 724 int
 725 is_ip_address(
 726         const char *    host,
 727         u_short         af,
 728         sockaddr_u *    addr
 729         )
 730 {
 731         struct in_addr in4;
 732         struct addrinfo hints;
 733         struct addrinfo *result;
 734         struct sockaddr_in6 *resaddr6;
 735         char tmpbuf[128];
 736         char *pch;
 737
 738         NTP_REQUIRE(host != NULL);
 739         NTP_REQUIRE(addr != NULL);
 740
 741         ZERO_SOCK(addr);
 742
 743         /*
 744          * Try IPv4, then IPv6.  In order to handle the extended format
 745          * for IPv6 scoped addresses (address%scope_ID), we'll use a local
 746          * working buffer of 128 bytes.  The length is an ad-hoc value, but
 747          * should be enough for this purpose; the buffer can contain a string
 748          * of at least 80 bytes for scope_ID in addition to any IPv6 numeric
 749          * addresses (up to 46 bytes), the delimiter character and the
 750          * terminating NULL character.
 751          */
 752         if (AF_UNSPEC == af || AF_INET == af)
 753                 if (inet_pton(AF_INET, host, &in4) == 1) {
 754                         AF(addr) = AF_INET;
 755                         SET_ADDR4N(addr, in4.s_addr);
 756
 757                         return TRUE;
 758                 }
 759
 760         if (AF_UNSPEC == af || AF_INET6 == af)
 761                 if (sizeof(tmpbuf) > strlen(host)) {
 762                         if ('[' == host[0]) {
 763                                 strlcpy(tmpbuf, &host[1], sizeof(tmpbuf));
 764                                 pch = strchr(tmpbuf, ']');
 765                                 if (pch != NULL)
 766                                         *pch = '\0';
 767                         } else {
 768                                 strlcpy(tmpbuf, host, sizeof(tmpbuf));
 769                         }
 770                         ZERO(hints);
 771                         hints.ai_family = AF_INET6;
 772                         hints.ai_flags |= AI_NUMERICHOST;
 773                         if (getaddrinfo(tmpbuf, NULL, &hints, &result) == 0) {
 774                                 AF(addr) = AF_INET6;
 775                                 resaddr6 = (struct sockaddr_in6 *)result->ai_addr;
 776                                 SET_ADDR6N(addr, resaddr6->sin6_addr);
 777                                 SET_SCOPE(addr, resaddr6->sin6_scope_id);
 778
 779                                 freeaddrinfo(result);
 780                                 return TRUE;
 781                         }
 782                 }
 783         /*
 784          * If we got here it was not an IP address
 785          */
 786         return FALSE;
 787 }
 788
 789
 790 /*
 791  * interface list enumerator - visitor pattern
 792  */
 793 void
 794 interface_enumerate(
 795         interface_receiver_t    receiver,
 796         void *                  data
 797         )
 798 {
 799         interface_info_t ifi;
 800
 801         ifi.action = IFS_EXISTS;
 802         for (ifi.ep = ep_list; ifi.ep != NULL; ifi.ep = ifi.ep->elink)
 803                 (*receiver)(data, &ifi);
 804 }
 805
 806 /*
 807  * do standard initialization of interface structure
 808  */
 809 static void
 810 init_interface(
 811         endpt *ep
 812         )
 813 {
 814         ZERO(*ep);
 815         ep->fd = INVALID_SOCKET;
 816         ep->bfd = INVALID_SOCKET;
 817         ep->phase = sys_interphase;
 818 }
 819
 820
 821 /*
 822  * create new interface structure initialize from
 823  * template structure or via standard initialization
 824  * function
 825  */
 826 static struct interface *
 827 new_interface(
 828         struct interface *interface
 829         )
 830 {
 831         struct interface *      iface;
 832
 833         iface = emalloc(sizeof(*iface));
 834
 835         if (NULL == interface)
 836                 init_interface(iface);
 837         else                            /* use the template */
 838                 memcpy(iface, interface, sizeof(*iface));
 839
 840         /* count every new instance of an interface in the system */
 841         iface->ifnum = sys_ifnum++;
 842         iface->starttime = current_time;
 843
 844         return iface;
 845 }
 846
 847
 848 /*
 849  * return interface storage into free memory pool
 850  */
 851 static inline void
 852 delete_interface(
 853         endpt *ep
 854         )
 855 {
 856         free(ep);
 857 }
 858
 859
 860 /*
 861  * link interface into list of known interfaces
 862  */
 863 static void
 864 add_interface(
 865         endpt * ep
 866         )
 867 {
 868         endpt **        pmclisthead;
 869         endpt *         scan;
 870         endpt *         scan_next;
 871         endpt *         unlinked;
 872         sockaddr_u *    addr;
 873         int             ep_local;
 874         int             scan_local;
 875         int             same_subnet;
 876         int             ep_univ_iid;    /* iface ID from MAC address */
 877         int             scan_univ_iid;  /* see RFC 4291 */
 878         int             ep_privacy;     /* random local iface ID */
 879         int             scan_privacy;   /* see RFC 4941 */
 880         int             rc;
 881
 882         /* Calculate the refid */
 883         ep->addr_refid = addr2refid(&ep->sin);
 884         /* link at tail so ntpdc -c ifstats index increases each row */
 885         LINK_TAIL_SLIST(ep_list, ep, elink, endpt);
 886         ninterfaces++;
 887 #ifdef MCAST
 888         /* the rest is for enabled multicast-capable addresses only */
 889         if (ep->ignore_packets || !(INT_MULTICAST & ep->flags) ||
 890             INT_LOOPBACK & ep->flags)
 891                 return;
 892 # ifndef INCLUDE_IPV6_MULTICAST_SUPPORT
 893         if (AF_INET6 == ep->family)
 894                 return;
 895 # endif
 896         pmclisthead = (AF_INET == ep->family)
 897                          ? &mc4_list
 898                          : &mc6_list;
 899
 900         if (AF_INET6 == ep->family) {
 901                 ep_local =
 902                     IN6_IS_ADDR_LINKLOCAL(PSOCK_ADDR6(&ep->sin)) ||
 903                     IN6_IS_ADDR_SITELOCAL(PSOCK_ADDR6(&ep->sin));
 904                 ep_univ_iid = IS_IID_UNIV(&ep->sin);
 905                 ep_privacy = !!(INT_PRIVACY & ep->flags);
 906         } else {
 907                 ep_local = FALSE;
 908                 ep_univ_iid = FALSE;
 909                 ep_privacy = FALSE;
 910         }
 911         DPRINTF(4, ("add_interface mcast-capable %s%s%s%s\n",
 912                     stoa(&ep->sin),
 913                     (ep_local) ? " link/scope-local" : "",
 914                     (ep_univ_iid) ? " univ-IID" : "",
 915                     (ep_privacy) ? " privacy" : ""));
 916         /*
 917          * If we have multiple local addresses on the same network
 918          * interface, and some are link- or site-local, do not multicast
 919          * out from the link-/site-local addresses by default, to avoid
 920          * duplicate manycastclient associations between v6 peers using
 921          * link-local and global addresses.  link-local can still be
 922          * chosen using "nic ignore myv6globalprefix::/64".
 923          * Similarly, if we have multiple global addresses from the same
 924          * prefix on the same network interface, multicast from one,
 925          * preferring EUI-64, then static, then least RFC 4941 privacy
 926          * addresses.
 927          */
 928         for (scan = *pmclisthead; scan != NULL; scan = scan_next) {
 929                 scan_next = scan->mclink;
 930                 if (ep->family != scan->family)
 931                         continue;
 932                 if (strcmp(ep->name, scan->name))
 933                         continue;
 934                 same_subnet = addr_samesubnet(&ep->sin, &ep->mask,
 935                                               &scan->sin, &scan->mask);
 936                 if (AF_INET6 == ep->family) {
 937                         addr = &scan->sin;
 938                         scan_local =
 939                             IN6_IS_ADDR_LINKLOCAL(PSOCK_ADDR6(addr)) ||
 940                             IN6_IS_ADDR_SITELOCAL(PSOCK_ADDR6(addr));
 941                         scan_univ_iid = IS_IID_UNIV(addr);
 942                         scan_privacy = !!(INT_PRIVACY & scan->flags);
 943                 } else {
 944                         scan_local = FALSE;
 945                         scan_univ_iid = FALSE;
 946                         scan_privacy = FALSE;
 947                 }
 948                 DPRINTF(4, ("add_interface mcast-capable scan %s%s%s%s\n",
 949                             stoa(&scan->sin),
 950                             (scan_local) ? " link/scope-local" : "",
 951                             (scan_univ_iid) ? " univ-IID" : "",
 952                             (scan_privacy) ? " privacy" : ""));
 953                 if ((ep_local && !scan_local) || (same_subnet &&
 954                     ((ep_privacy && !scan_privacy) ||
 955                      (!ep_univ_iid && scan_univ_iid)))) {
 956                         DPRINTF(4, ("did not add %s to %s of IPv6 multicast-capable list which already has %s\n",
 957                                 stoa(&ep->sin),
 958                                 (ep_local)
 959                                     ? "tail"
 960                                     : "head",
 961                                 stoa(&scan->sin)));
 962                         return;
 963                 }
 964                 if ((scan_local && !ep_local) || (same_subnet &&
 965                     ((scan_privacy && !ep_privacy) ||
 966                      (!scan_univ_iid && ep_univ_iid)))) {
 967                         UNLINK_SLIST(unlinked, *pmclisthead,
 968                                      scan, mclink, endpt);
 969                         DPRINTF(4, ("%s %s from IPv6 multicast-capable list to add %s\n",
 970                                 (unlinked != scan)
 971                                     ? "Failed to remove"
 972                                     : "removed",
 973                                 stoa(&scan->sin), stoa(&ep->sin)));
 974                 }
 975         }
 976         /*
 977          * Add link/site local at the tail of the multicast-
 978          * capable unicast interfaces list, so that ntpd will
 979          * send from global addresses before link-/site-local
 980          * ones.
 981          */
 982         if (ep_local)
 983                 LINK_TAIL_SLIST(*pmclisthead, ep, mclink, endpt);
 984         else
 985                 LINK_SLIST(*pmclisthead, ep, mclink);
 986         DPRINTF(4, ("added %s to %s of IPv%s multicast-capable unicast local address list\n",
 987                 stoa(&ep->sin),
 988                 (ep_local)
 989                     ? "tail"
 990                     : "head",
 991                 (AF_INET == ep->family)
 992                     ? "4"
 993                     : "6"));
 994
 995         if (INVALID_SOCKET == ep->fd)
 996                 return;
 997
 998         /*
 999          * select the local address from which to send to multicast.
1000          */
1001         switch (AF(&ep->sin)) {
1002
1003         case AF_INET :
1004                 rc = setsockopt(ep->fd, IPPROTO_IP,
1005                                 IP_MULTICAST_IF,
1006                                 (void *)&NSRCADR(&ep->sin),
1007                                 sizeof(NSRCADR(&ep->sin)));
1008                 if (rc)
1009                         msyslog(LOG_ERR,
1010                                 "setsockopt IP_MULTICAST_IF %s fails: %m",
1011                                 stoa(&ep->sin));
1012                 break;
1013
1014 # ifdef INCLUDE_IPV6_MULTICAST_SUPPORT
1015         case AF_INET6 :
1016                 rc = setsockopt(ep->fd, IPPROTO_IPV6,
1017                                  IPV6_MULTICAST_IF,
1018                                  (void *)&ep->ifindex,
1019                                  sizeof(ep->ifindex));
1020                 /* do not complain if bound addr scope is ifindex */
1021                 if (rc && ep->ifindex != SCOPE(&ep->sin))
1022                         msyslog(LOG_ERR,
1023                                 "setsockopt IPV6_MULTICAST_IF %u for %s fails: %m",
1024                                 ep->ifindex, stoa(&ep->sin));
1025                 break;
1026 # endif
1027         }
1028 #endif  /* MCAST */
1029 }
1030
1031
1032 /*
1033  * remove interface from known interface list and clean up
1034  * associated resources
1035  */
1036 static void
1037 remove_interface(
1038         endpt * ep
1039         )
1040 {
1041         endpt *         unlinked;
1042         endpt **        pmclisthead;
1043         sockaddr_u      resmask;
1044
1045         UNLINK_SLIST(unlinked, ep_list, ep, elink, endpt);
1046         if (!ep->ignore_packets && INT_MULTICAST & ep->flags) {
1047                 pmclisthead = (AF_INET == ep->family)
1048                                  ? &mc4_list
1049                                  : &mc6_list;
1050                 UNLINK_SLIST(unlinked, *pmclisthead, ep, mclink, endpt);
1051                 DPRINTF(4, ("%s %s IPv%s multicast-capable unicast local address list\n",
1052                         stoa(&ep->sin),
1053                         (unlinked != NULL)
1054                             ? "removed from"
1055                             : "not found on",
1056                         (AF_INET == ep->family)
1057                             ? "4"
1058                             : "6"));
1059         }
1060         delete_interface_from_list(ep);
1061
1062         if (ep->fd != INVALID_SOCKET) {
1063                 msyslog(LOG_INFO,
1064                         "Deleting interface #%d %s, %s#%d, interface stats: received=%ld, sent=%ld, dropped=%ld, active_time=%ld secs",
1065                         ep->ifnum,
1066                         ep->name,
1067                         stoa(&ep->sin),
1068                         SRCPORT(&ep->sin),
1069                         ep->received,
1070                         ep->sent,
1071                         ep->notsent,
1072                         current_time - ep->starttime);
1073                 close_and_delete_fd_from_list(ep->fd);
1074                 ep->fd = INVALID_SOCKET;
1075         }
1076
1077         if (ep->bfd != INVALID_SOCKET) {
1078                 msyslog(LOG_INFO,
1079                         "stop listening for broadcasts to %s on interface #%d %s",
1080                         stoa(&ep->bcast), ep->ifnum, ep->name);
1081                 close_and_delete_fd_from_list(ep->bfd);
1082                 ep->bfd = INVALID_SOCKET;
1083                 ep->flags &= ~INT_BCASTOPEN;
1084         }
1085
1086         ninterfaces--;
1087         mon_clearinterface(ep);
1088
1089         /* remove restrict interface entry */
1090         SET_HOSTMASK(&resmask, AF(&ep->sin));
1091         hack_restrict(RESTRICT_REMOVEIF, &ep->sin, &resmask,
1092                       RESM_NTPONLY | RESM_INTERFACE, RES_IGNORE, 0);
1093 }
1094
1095
1096 static void
1097 log_listen_address(
1098         endpt * ep
1099         )
1100 {
1101         msyslog(LOG_INFO, "%s on %d %s %s",
1102                 (ep->ignore_packets)
1103                     ? "Listen and drop"
1104                     : "Listen normally",
1105                 ep->ifnum,
1106                 ep->name,
1107                 sptoa(&ep->sin));
1108 }
1109
1110
1111 static void
1112 create_wildcards(
1113         u_short port
1114         )
1115 {
1116         int                     v4wild;
1117 #ifdef INCLUDE_IPV6_SUPPORT
1118         int                     v6wild;
1119 #endif
1120         sockaddr_u              wildaddr;
1121         nic_rule_action         action;
1122         struct interface *      wildif;
1123
1124         /*
1125          * silence "potentially uninitialized" warnings from VC9
1126          * failing to follow the logic.  Ideally action could remain
1127          * uninitialized, and the memset be the first statement under
1128          * the first if (v4wild).
1129          */
1130         action = ACTION_LISTEN;
1131         ZERO(wildaddr);
1132
1133 #ifdef INCLUDE_IPV6_SUPPORT
1134         /*
1135          * create pseudo-interface with wildcard IPv6 address
1136          */
1137         v6wild = ipv6_works;
1138         if (v6wild) {
1139                 /* set wildaddr to the v6 wildcard address :: */
1140                 ZERO(wildaddr);
1141                 AF(&wildaddr) = AF_INET6;
1142                 SET_ADDR6N(&wildaddr, in6addr_any);
1143                 SET_PORT(&wildaddr, port);
1144                 SET_SCOPE(&wildaddr, 0);
1145
1146                 /* check for interface/nic rules affecting the wildcard */
1147                 action = interface_action(NULL, &wildaddr, 0);
1148                 v6wild = (ACTION_IGNORE != action);
1149         }
1150         if (v6wild) {
1151                 wildif = new_interface(NULL);
1152
1153                 strlcpy(wildif->name, "v6wildcard", sizeof(wildif->name));
1154                 memcpy(&wildif->sin, &wildaddr, sizeof(wildif->sin));
1155                 wildif->family = AF_INET6;
1156                 AF(&wildif->mask) = AF_INET6;
1157                 SET_ONESMASK(&wildif->mask);
1158
1159                 wildif->flags = INT_UP | INT_WILDCARD;
1160                 wildif->ignore_packets = (ACTION_DROP == action);
1161
1162                 wildif->fd = open_socket(&wildif->sin, 0, 1, wildif);
1163
1164                 if (wildif->fd != INVALID_SOCKET) {
1165                         wildipv6 = wildif;
1166                         any6_interface = wildif;
1167                         add_addr_to_list(&wildif->sin, wildif);
1168                         add_interface(wildif);
1169                         log_listen_address(wildif);
1170                 } else {
1171                         msyslog(LOG_ERR,
1172                                 "unable to bind to wildcard address %s - another process may be running - EXITING",
1173                                 stoa(&wildif->sin));
1174                         exit(1);
1175                 }
1176                 DPRINT_INTERFACE(2, (wildif, "created ", "\n"));
1177         }
1178 #endif
1179
1180         /*
1181          * create pseudo-interface with wildcard IPv4 address
1182          */
1183         v4wild = ipv4_works;
1184         if (v4wild) {
1185                 /* set wildaddr to the v4 wildcard address 0.0.0.0 */
1186                 AF(&wildaddr) = AF_INET;
1187                 SET_ADDR4N(&wildaddr, INADDR_ANY);
1188                 SET_PORT(&wildaddr, port);
1189
1190                 /* check for interface/nic rules affecting the wildcard */
1191                 action = interface_action(NULL, &wildaddr, 0);
1192                 v4wild = (ACTION_IGNORE != action);
1193         }
1194         if (v4wild) {
1195                 wildif = new_interface(NULL);
1196
1197                 strlcpy(wildif->name, "v4wildcard", sizeof(wildif->name));
1198                 memcpy(&wildif->sin, &wildaddr, sizeof(wildif->sin));
1199                 wildif->family = AF_INET;
1200                 AF(&wildif->mask) = AF_INET;
1201                 SET_ONESMASK(&wildif->mask);
1202
1203                 wildif->flags = INT_BROADCAST | INT_UP | INT_WILDCARD;
1204                 wildif->ignore_packets = (ACTION_DROP == action);
1205 #if defined(MCAST)
1206                 /*
1207                  * enable multicast reception on the broadcast socket
1208                  */
1209                 AF(&wildif->bcast) = AF_INET;
1210                 SET_ADDR4N(&wildif->bcast, INADDR_ANY);
1211                 SET_PORT(&wildif->bcast, port);
1212 #endif /* MCAST */
1213                 wildif->fd = open_socket(&wildif->sin, 0, 1, wildif);
1214
1215                 if (wildif->fd != INVALID_SOCKET) {
1216                         wildipv4 = wildif;
1217                         any_interface = wildif;
1218
1219                         add_addr_to_list(&wildif->sin, wildif);
1220                         add_interface(wildif);
1221                         log_listen_address(wildif);
1222                 } else {
1223                         msyslog(LOG_ERR,
1224                                 "unable to bind to wildcard address %s - another process may be running - EXITING",
1225                                 stoa(&wildif->sin));
1226                         exit(1);
1227                 }
1228                 DPRINT_INTERFACE(2, (wildif, "created ", "\n"));
1229         }
1230 }
1231
1232
1233 /*
1234  * add_nic_rule() -- insert a rule entry at the head of nic_rule_list.
1235  */
1236 void
1237 add_nic_rule(
1238         nic_rule_match  match_type,
1239         const char *    if_name,        /* interface name or numeric address */
1240         int             prefixlen,
1241         nic_rule_action action
1242         )
1243 {
1244         nic_rule *      rule;
1245         isc_boolean_t   is_ip;
1246
1247         rule = emalloc_zero(sizeof(*rule));
1248         rule->match_type = match_type;
1249         rule->prefixlen = prefixlen;
1250         rule->action = action;
1251
1252         if (MATCH_IFNAME == match_type) {
1253                 NTP_REQUIRE(NULL != if_name);
1254                 rule->if_name = estrdup(if_name);
1255         } else if (MATCH_IFADDR == match_type) {
1256                 NTP_REQUIRE(NULL != if_name);
1257                 /* set rule->addr */
1258                 is_ip = is_ip_address(if_name, AF_UNSPEC, &rule->addr);
1259                 NTP_REQUIRE(is_ip);
1260         } else
1261                 NTP_REQUIRE(NULL == if_name);
1262
1263         LINK_SLIST(nic_rule_list, rule, next);
1264 }
1265
1266
1267 #ifdef DEBUG
1268 static const char *
1269 action_text(
1270         nic_rule_action action
1271         )
1272 {
1273         const char *t;
1274
1275         switch (action) {
1276
1277         default:
1278                 t = "ERROR";    /* quiet uninit warning */
1279                 DPRINTF(1, ("fatal: unknown nic_rule_action %d\n",
1280                             action));
1281                 NTP_ENSURE(0);
1282                 break;
1283
1284         case ACTION_LISTEN:
1285                 t = "listen";
1286                 break;
1287
1288         case ACTION_IGNORE:
1289                 t = "ignore";
1290                 break;
1291
1292         case ACTION_DROP:
1293                 t = "drop";
1294                 break;
1295         }
1296
1297         return t;
1298 }
1299 #endif  /* DEBUG */
1300
1301
1302 static nic_rule_action
1303 interface_action(
1304         char *          if_name,
1305         sockaddr_u *    if_addr,
1306         u_int32         if_flags
1307         )
1308 {
1309         nic_rule *      rule;
1310         int             isloopback;
1311         int             iswildcard;
1312
1313         DPRINTF(4, ("interface_action: interface %s ",
1314                     (if_name != NULL) ? if_name : "wildcard"));
1315
1316         iswildcard = is_wildcard_addr(if_addr);
1317         isloopback = !!(INT_LOOPBACK & if_flags);
1318
1319         /*
1320          * Find any matching NIC rule from --interface / -I or ntp.conf
1321          * interface/nic rules.
1322          */
1323         for (rule = nic_rule_list; rule != NULL; rule = rule->next) {
1324
1325                 switch (rule->match_type) {
1326
1327                 case MATCH_ALL:
1328                         /* loopback and wildcard excluded from "all" */
1329                         if (isloopback || iswildcard)
1330                                 break;
1331                         DPRINTF(4, ("nic all %s\n",
1332                             action_text(rule->action)));
1333                         return rule->action;
1334
1335                 case MATCH_IPV4:
1336                         if (IS_IPV4(if_addr)) {
1337                                 DPRINTF(4, ("nic ipv4 %s\n",
1338                                     action_text(rule->action)));
1339                                 return rule->action;
1340                         }
1341                         break;
1342
1343                 case MATCH_IPV6:
1344                         if (IS_IPV6(if_addr)) {
1345                                 DPRINTF(4, ("nic ipv6 %s\n",
1346                                     action_text(rule->action)));
1347                                 return rule->action;
1348                         }
1349                         break;
1350
1351                 case MATCH_WILDCARD:
1352                         if (iswildcard) {
1353                                 DPRINTF(4, ("nic wildcard %s\n",
1354                                     action_text(rule->action)));
1355                                 return rule->action;
1356                         }
1357                         break;
1358
1359                 case MATCH_IFADDR:
1360                         if (rule->prefixlen != -1) {
1361                                 if (addr_eqprefix(if_addr, &rule->addr,
1362                                                   rule->prefixlen)) {
1363
1364                                         DPRINTF(4, ("subnet address match - %s\n",
1365                                             action_text(rule->action)));
1366                                         return rule->action;
1367                                 }
1368                         } else
1369                                 if (SOCK_EQ(if_addr, &rule->addr)) {
1370
1371                                         DPRINTF(4, ("address match - %s\n",
1372                                             action_text(rule->action)));
1373                                         return rule->action;
1374                                 }
1375                         break;
1376
1377                 case MATCH_IFNAME:
1378                         if (if_name != NULL
1379 #if defined(HAVE_FNMATCH) && defined(FNM_CASEFOLD)
1380                             && !fnmatch(rule->if_name, if_name, FNM_CASEFOLD)
1381 #else
1382                             && !strcasecmp(if_name, rule->if_name)
1383 #endif
1384                             ) {
1385
1386                                 DPRINTF(4, ("interface name match - %s\n",
1387                                     action_text(rule->action)));
1388                                 return rule->action;
1389                         }
1390                         break;
1391                 }
1392         }
1393
1394         /*
1395          * Unless explicitly disabled such as with "nic ignore ::1"
1396          * listen on loopback addresses.  Since ntpq and ntpdc query
1397          * "localhost" by default, which typically resolves to ::1 and
1398          * 127.0.0.1, it's useful to default to listening on both.
1399          */
1400         if (isloopback) {
1401                 DPRINTF(4, ("default loopback listen\n"));
1402                 return ACTION_LISTEN;
1403         }
1404
1405         /*
1406          * Treat wildcard addresses specially.  If there is no explicit
1407          * "nic ... wildcard" or "nic ... 0.0.0.0" or "nic ... ::" rule
1408          * default to drop.
1409          */
1410         if (iswildcard) {
1411                 DPRINTF(4, ("default wildcard drop\n"));
1412                 return ACTION_DROP;
1413         }
1414
1415         /*
1416          * Check for "virtual IP" (colon in the interface name) after
1417          * the rules so that "ntpd --interface eth0:1 -novirtualips"
1418          * does indeed listen on eth0:1's addresses.
1419          */
1420         if (!listen_to_virtual_ips && if_name != NULL
1421             && (strchr(if_name, ':') != NULL)) {
1422
1423                 DPRINTF(4, ("virtual ip - ignore\n"));
1424                 return ACTION_IGNORE;
1425         }
1426
1427         /*
1428          * If there are no --interface/-I command-line options and no
1429          * interface/nic rules in ntp.conf, the default action is to
1430          * listen.  In the presence of rules from either, the default
1431          * is to ignore.  This implements ntpd's traditional listen-
1432          * every default with no interface listen configuration, and
1433          * ensures a single -I eth0 or "nic listen eth0" means do not
1434          * listen on any other addresses.
1435          */
1436         if (NULL == nic_rule_list) {
1437                 DPRINTF(4, ("default listen\n"));
1438                 return ACTION_LISTEN;
1439         }
1440
1441         DPRINTF(4, ("implicit ignore\n"));
1442         return ACTION_IGNORE;
1443 }
1444
1445
1446 static void
1447 convert_isc_if(
1448         isc_interface_t *isc_if,
1449         endpt *itf,
1450         u_short port
1451         )
1452 {
1453         const u_char v6loop[16] = {0, 0, 0, 0, 0, 0, 0, 0,
1454                                    0, 0, 0, 0, 0, 0, 0, 1};
1455
1456         strlcpy(itf->name, isc_if->name, sizeof(itf->name));
1457         itf->ifindex = isc_if->ifindex;
1458         itf->family = (u_short)isc_if->af;
1459         AF(&itf->sin) = itf->family;
1460         AF(&itf->mask) = itf->family;
1461         AF(&itf->bcast) = itf->family;
1462         SET_PORT(&itf->sin, port);
1463         SET_PORT(&itf->mask, port);
1464         SET_PORT(&itf->bcast, port);
1465
1466         if (IS_IPV4(&itf->sin)) {
1467                 NSRCADR(&itf->sin) = isc_if->address.type.in.s_addr;
1468                 NSRCADR(&itf->mask) = isc_if->netmask.type.in.s_addr;
1469
1470                 if (isc_if->flags & INTERFACE_F_BROADCAST) {
1471                         itf->flags |= INT_BROADCAST;
1472                         NSRCADR(&itf->bcast) =
1473                             isc_if->broadcast.type.in.s_addr;
1474                 }
1475         }
1476 #ifdef INCLUDE_IPV6_SUPPORT
1477         else if (IS_IPV6(&itf->sin)) {
1478                 SET_ADDR6N(&itf->sin, isc_if->address.type.in6);
1479                 SET_ADDR6N(&itf->mask, isc_if->netmask.type.in6);
1480
1481                 SET_SCOPE(&itf->sin, isc_if->address.zone);
1482         }
1483 #endif /* INCLUDE_IPV6_SUPPORT */
1484
1485
1486         /* Process the rest of the flags */
1487
1488         itf->flags |=
1489                   ((INTERFACE_F_UP & isc_if->flags)
1490                         ? INT_UP : 0)
1491                 | ((INTERFACE_F_LOOPBACK & isc_if->flags)
1492                         ? INT_LOOPBACK : 0)
1493                 | ((INTERFACE_F_POINTTOPOINT & isc_if->flags)
1494                         ? INT_PPP : 0)
1495                 | ((INTERFACE_F_MULTICAST & isc_if->flags)
1496                         ? INT_MULTICAST : 0)
1497                 | ((INTERFACE_F_PRIVACY & isc_if->flags)
1498                         ? INT_PRIVACY : 0)
1499                 ;
1500
1501         /*
1502          * Clear the loopback flag if the address is not localhost.
1503          * http://bugs.ntp.org/1683
1504          */
1505         if (INT_LOOPBACK & itf->flags) {
1506                 if (AF_INET == itf->family) {
1507                         if (127 != (SRCADR(&itf->sin) >> 24))
1508                                 itf->flags &= ~INT_LOOPBACK;
1509                 } else {
1510                         if (memcmp(v6loop, NSRCADR6(&itf->sin),
1511                                    sizeof(NSRCADR6(&itf->sin))))
1512                                 itf->flags &= ~INT_LOOPBACK;
1513                 }
1514         }
1515 }
1516
1517
1518 /*
1519  * refresh_interface
1520  *
1521  * some OSes have been observed to keep
1522  * cached routes even when more specific routes
1523  * become available.
1524  * this can be mitigated by re-binding
1525  * the socket.
1526  */
1527 static int
1528 refresh_interface(
1529         struct interface * interface
1530         )
1531 {
1532 #ifdef  OS_MISSES_SPECIFIC_ROUTE_UPDATES
1533         if (interface->fd != INVALID_SOCKET) {
1534                 int bcast = (interface->flags & INT_BCASTXMIT) != 0;
1535                 /* as we forcibly close() the socket remove the
1536                    broadcast permission indication */
1537                 if (bcast)
1538                         socket_broadcast_disable(interface, &interface->sin);
1539
1540                 close_and_delete_fd_from_list(interface->fd);
1541
1542                 /* create new socket picking up a new first hop binding
1543                    at connect() time */
1544                 interface->fd = open_socket(&interface->sin,
1545                                             bcast, 0, interface);
1546                  /*
1547                   * reset TTL indication so TTL is is set again
1548                   * next time around
1549                   */
1550                 interface->last_ttl = 0;
1551                 return (interface->fd != INVALID_SOCKET);
1552         } else
1553                 return 0;       /* invalid sockets are not refreshable */
1554 #else /* !OS_MISSES_SPECIFIC_ROUTE_UPDATES */
1555         return (interface->fd != INVALID_SOCKET);
1556 #endif /* !OS_MISSES_SPECIFIC_ROUTE_UPDATES */
1557 }
1558
1559 /*
1560  * interface_update - externally callable update function
1561  */
1562 void
1563 interface_update(
1564         interface_receiver_t    receiver,
1565         void *                  data)
1566 {
1567         int new_interface_found;
1568
1569         if (disable_dynamic_updates)
1570                 return;
1571
1572         BLOCKIO();
1573         new_interface_found = update_interfaces(NTP_PORT, receiver, data);
1574         UNBLOCKIO();
1575
1576         if (!new_interface_found)
1577                 return;
1578
1579 #ifdef DEBUG
1580         msyslog(LOG_DEBUG, "new interface(s) found: waking up resolver");
1581 #endif
1582         interrupt_worker_sleep();
1583 }
1584
1585
1586 /*
1587  * sau_from_netaddr() - convert network address on-wire formats.
1588  * Convert from libisc's isc_netaddr_t to NTP's sockaddr_u
1589  */
1590 void
1591 sau_from_netaddr(
1592         sockaddr_u *psau,
1593         const isc_netaddr_t *pna
1594         )
1595 {
1596         ZERO_SOCK(psau);
1597         AF(psau) = (u_short)pna->family;
1598         switch (pna->family) {
1599
1600         case AF_INET:
1601                 memcpy(&psau->sa4.sin_addr, &pna->type.in,
1602                        sizeof(psau->sa4.sin_addr));
1603                 break;
1604
1605         case AF_INET6:
1606                 memcpy(&psau->sa6.sin6_addr, &pna->type.in6,
1607                        sizeof(psau->sa6.sin6_addr));
1608                 break;
1609         }
1610 }
1611
1612
1613 static int
1614 is_wildcard_addr(
1615         const sockaddr_u *psau
1616         )
1617 {
1618         if (IS_IPV4(psau) && !NSRCADR(psau))
1619                 return 1;
1620
1621 #ifdef INCLUDE_IPV6_SUPPORT
1622         if (IS_IPV6(psau) && S_ADDR6_EQ(psau, &in6addr_any))
1623                 return 1;
1624 #endif
1625
1626         return 0;
1627 }
1628
1629
1630 #ifdef OS_NEEDS_REUSEADDR_FOR_IFADDRBIND
1631 /*
1632  * enable/disable re-use of wildcard address socket
1633  */
1634 static void
1635 set_wildcard_reuse(
1636         u_short family,
1637         int     on
1638         )
1639 {
1640         struct interface *any;
1641         SOCKET fd = INVALID_SOCKET;
1642
1643         any = ANY_INTERFACE_BYFAM(family);
1644         if (any != NULL)
1645                 fd = any->fd;
1646
1647         if (fd != INVALID_SOCKET) {
1648                 if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR,
1649                                (char *)&on, sizeof(on)))
1650                         msyslog(LOG_ERR,
1651                                 "set_wildcard_reuse: setsockopt(SO_REUSEADDR, %s) failed: %m",
1652                                 on ? "on" : "off");
1653
1654                 DPRINTF(4, ("set SO_REUSEADDR to %s on %s\n",
1655                             on ? "on" : "off",
1656                             stoa(&any->sin)));
1657         }
1658 }
1659 #endif /* OS_NEEDS_REUSEADDR_FOR_IFADDRBIND */
1660
1661
1662 static isc_boolean_t
1663 check_flags6(
1664         sockaddr_u *psau,
1665         const char *name,
1666         u_int32 flags6
1667         )
1668 {
1669 #if defined(INCLUDE_IPV6_SUPPORT) && defined(SIOCGIFAFLAG_IN6) && \
1670     (defined(IN6_IFF_ANYCAST) || defined(IN6_IFF_NOTREADY))
1671         struct in6_ifreq ifr6;
1672         int fd;
1673         u_int32 exclude = 0;
1674
1675         if (psau->sa.sa_family != AF_INET6)
1676                 return ISC_FALSE;
1677         if ((fd = socket(AF_INET6, SOCK_DGRAM, 0)) < 0)
1678                 return ISC_FALSE;
1679         ZERO(ifr6);
1680         memcpy(&ifr6.ifr_addr, &psau->sa6, sizeof(ifr6.ifr_addr));
1681         strlcpy(ifr6.ifr_name, name, sizeof(ifr6.ifr_name));
1682         if (ioctl(fd, SIOCGIFAFLAG_IN6, &ifr6) < 0) {
1683                 close(fd);
1684                 return ISC_FALSE;
1685         }
1686         close(fd);
1687         flags6 = ifr6.ifr_ifru.ifru_flags6;
1688 #if defined(IN6_IFF_ANYCAST)
1689         exclude |= IN6_IFF_ANYCAST;
1690 #endif /* !IN6_IFF_ANYCAST */
1691 #if defined(IN6_IFF_NOTREADY)
1692         exclude |= IN6_IFF_NOTREADY;
1693 #endif /* !IN6_IFF_NOTREADY */
1694         if ((flags6 & exclude) != 0)
1695                 return ISC_TRUE;
1696 #endif  /* INCLUDE_IPV6_SUPPORT && SIOCGIFAFLAG_IN6 && (IN6_IFF_ANYCAST && IN6_IFF_NOTREADY) */
1697         return ISC_FALSE;
1698 }
1699
1700 static isc_boolean_t
1701 is_not_bindable(
1702         sockaddr_u *psau,
1703         const char *name
1704         )
1705 {
1706 #ifdef IN6_IFF_ANYCAST
1707         return check_flags6(psau, name, IN6_IFF_ANYCAST);
1708 #else
1709         return ISC_FALSE;
1710 #endif
1711 }
1712
1713 static isc_boolean_t
1714 is_valid(
1715         sockaddr_u *psau,
1716         const char *name
1717         )
1718 {
1719         u_int32 flags6;
1720
1721         flags6 = 0;
1722 #ifdef IN6_IFF_DEPARTED
1723         flags6 |= IN6_IFF_DEPARTED;
1724 #endif
1725 #ifdef IN6_IFF_DETACHED
1726         flags6 |= IN6_IFF_DETACHED;
1727 #endif
1728 #ifdef IN6_IFF_TENTATIVE
1729         flags6 |= IN6_IFF_TENTATIVE;
1730 #endif
1731         return check_flags6(psau, name, flags6) ? ISC_FALSE : ISC_TRUE;
1732 }
1733
1734 /*
1735  * update_interface strategy
1736  *
1737  * toggle configuration phase
1738  *
1739  * Phase 1:
1740  * forall currently existing interfaces
1741  *   if address is known:
1742  *      drop socket - rebind again
1743  *
1744  *   if address is NOT known:
1745  *      attempt to create a new interface entry
1746  *
1747  * Phase 2:
1748  * forall currently known non MCAST and WILDCARD interfaces
1749  *   if interface does not match configuration phase (not seen in phase 1):
1750  *      remove interface from known interface list
1751  *      forall peers associated with this interface
1752  *         disconnect peer from this interface
1753  *
1754  * Phase 3:
1755  *   attempt to re-assign interfaces to peers
1756  *
1757  */
1758
1759 static int
1760 update_interfaces(
1761         u_short                 port,
1762         interface_receiver_t    receiver,
1763         void *                  data
1764         )
1765 {
1766         isc_mem_t *             mctx = (void *)-1;
1767         interface_info_t        ifi;
1768         isc_interfaceiter_t *   iter;
1769         isc_result_t            result;
1770         isc_interface_t         isc_if;
1771         int                     new_interface_found;
1772         unsigned int            family;
1773         endpt                   enumep;
1774         endpt *                 ep;
1775         endpt *                 next_ep;
1776
1777         DPRINTF(3, ("update_interfaces(%d)\n", port));
1778
1779         /*
1780          * phase one - scan interfaces
1781          * - create those that are not found
1782          * - update those that are found
1783          */
1784
1785         new_interface_found = FALSE;
1786         iter = NULL;
1787         result = isc_interfaceiter_create(mctx, &iter);
1788
1789         if (result != ISC_R_SUCCESS)
1790                 return 0;
1791
1792         /*
1793          * Toggle system interface scan phase to find untouched
1794          * interfaces to be deleted.
1795          */
1796         sys_interphase ^= 0x1;
1797
1798         for (result = isc_interfaceiter_first(iter);
1799              ISC_R_SUCCESS == result;
1800              result = isc_interfaceiter_next(iter)) {
1801
1802                 result = isc_interfaceiter_current(iter, &isc_if);
1803
1804                 if (result != ISC_R_SUCCESS)
1805                         break;
1806
1807                 /* See if we have a valid family to use */
1808                 family = isc_if.address.family;
1809                 if (AF_INET != family && AF_INET6 != family)
1810                         continue;
1811                 if (AF_INET == family && !ipv4_works)
1812                         continue;
1813                 if (AF_INET6 == family && !ipv6_works)
1814                         continue;
1815
1816                 /* create prototype */
1817                 init_interface(&enumep);
1818
1819                 convert_isc_if(&isc_if, &enumep, port);
1820
1821                 DPRINT_INTERFACE(4, (&enumep, "examining ", "\n"));
1822
1823                 /*
1824                  * Check if and how we are going to use the interface.
1825                  */
1826                 switch (interface_action(enumep.name, &enumep.sin,
1827                                          enumep.flags)) {
1828
1829                 case ACTION_IGNORE:
1830                         DPRINTF(4, ("ignoring interface %s (%s) - by nic rules\n",
1831                                     enumep.name, stoa(&enumep.sin)));
1832                         continue;
1833
1834                 case ACTION_LISTEN:
1835                         DPRINTF(4, ("listen interface %s (%s) - by nic rules\n",
1836                                     enumep.name, stoa(&enumep.sin)));
1837                         enumep.ignore_packets = ISC_FALSE;
1838                         break;
1839
1840                 case ACTION_DROP:
1841                         DPRINTF(4, ("drop on interface %s (%s) - by nic rules\n",
1842                                     enumep.name, stoa(&enumep.sin)));
1843                         enumep.ignore_packets = ISC_TRUE;
1844                         break;
1845                 }
1846
1847                  /* interfaces must be UP to be usable */
1848                 if (!(enumep.flags & INT_UP)) {
1849                         DPRINTF(4, ("skipping interface %s (%s) - DOWN\n",
1850                                     enumep.name, stoa(&enumep.sin)));
1851                         continue;
1852                 }
1853
1854                 /*
1855                  * skip any interfaces UP and bound to a wildcard
1856                  * address - some dhcp clients produce that in the
1857                  * wild
1858                  */
1859                 if (is_wildcard_addr(&enumep.sin))
1860                         continue;
1861
1862                 if (is_not_bindable(&enumep.sin, isc_if.name))
1863                         continue;
1864
1865                 /*
1866                  * skip any address that is an invalid state to be used
1867                  */
1868                 if (!is_valid(&enumep.sin, isc_if.name))
1869                         continue;
1870
1871                 /*
1872                  * map to local *address* in order to map all duplicate
1873                  * interfaces to an endpt structure with the appropriate
1874                  * socket.  Our name space is (ip-address), NOT
1875                  * (interface name, ip-address).
1876                  */
1877                 ep = getinterface(&enumep.sin, INT_WILDCARD);
1878
1879                 if (ep != NULL && refresh_interface(ep)) {
1880                         /*
1881                          * found existing and up to date interface -
1882                          * mark present.
1883                          */
1884                         if (ep->phase != sys_interphase) {
1885                                 /*
1886                                  * On a new round we reset the name so
1887                                  * the interface name shows up again if
1888                                  * this address is no longer shared.
1889                                  * We reset ignore_packets from the
1890                                  * new prototype to respect any runtime
1891                                  * changes to the nic rules.
1892                                  */
1893                                 strlcpy(ep->name, enumep.name,
1894                                         sizeof(ep->name));
1895                                 ep->ignore_packets =
1896                                             enumep.ignore_packets;
1897                         } else {
1898                                 /* name collision - rename interface */
1899                                 strlcpy(ep->name, "*multiple*",
1900                                         sizeof(ep->name));
1901                         }
1902
1903                         DPRINT_INTERFACE(4, (ep, "updating ",
1904                                              " present\n"));
1905
1906                         if (ep->ignore_packets !=
1907                             enumep.ignore_packets) {
1908                                 /*
1909                                  * We have conflicting configurations
1910                                  * for the interface address. This is
1911                                  * caused by using -I <interfacename>
1912                                  * for an interface that shares its
1913                                  * address with other interfaces. We
1914                                  * can not disambiguate incoming
1915                                  * packets delivered to this socket
1916                                  * without extra syscalls/features.
1917                                  * These are not (commonly) available.
1918                                  * Note this is a more unusual
1919                                  * configuration where several
1920                                  * interfaces share an address but
1921                                  * filtering via interface name is
1922                                  * attempted.  We resolve the
1923                                  * configuration conflict by disabling
1924                                  * the processing of received packets.
1925                                  * This leads to no service on the
1926                                  * interface address where the conflict
1927                                  * occurs.
1928                                  */
1929                                 msyslog(LOG_ERR,
1930                                         "WARNING: conflicting enable configuration for interfaces %s and %s for address %s - unsupported configuration - address DISABLED",
1931                                         enumep.name, ep->name,
1932                                         stoa(&enumep.sin));
1933
1934                                 ep->ignore_packets = ISC_TRUE;
1935                         }
1936
1937                         ep->phase = sys_interphase;
1938
1939                         ifi.action = IFS_EXISTS;
1940                         ifi.ep = ep;
1941                         if (receiver != NULL)
1942                                 (*receiver)(data, &ifi);
1943                 } else {
1944                         /*
1945                          * This is new or refreshing failed - add to
1946                          * our interface list.  If refreshing failed we
1947                          * will delete the interface structure in phase
1948                          * 2 as the interface was not marked current.
1949                          * We can bind to the address as the refresh
1950                          * code already closed the offending socket
1951                          */
1952                         ep = create_interface(port, &enumep);
1953
1954                         if (ep != NULL) {
1955                                 ifi.action = IFS_CREATED;
1956                                 ifi.ep = ep;
1957                                 if (receiver != NULL)
1958                                         (*receiver)(data, &ifi);
1959
1960                                 new_interface_found = TRUE;
1961                                 DPRINT_INTERFACE(3,
1962                                         (ep, "updating ",
1963                                          " new - created\n"));
1964                         } else {
1965                                 DPRINT_INTERFACE(3,
1966                                         (&enumep, "updating ",
1967                                          " new - creation FAILED"));
1968
1969                                 msyslog(LOG_INFO,
1970                                         "failed to init interface for address %s",
1971                                         stoa(&enumep.sin));
1972                                 continue;
1973                         }
1974                 }
1975         }
1976
1977         isc_interfaceiter_destroy(&iter);
1978
1979         /*
1980          * phase 2 - delete gone interfaces - reassigning peers to
1981          * other interfaces
1982          */
1983         for (ep = ep_list; ep != NULL; ep = next_ep) {
1984                 next_ep = ep->elink;
1985
1986                 /*
1987                  * if phase does not match sys_phase this interface was
1988                  * not enumerated during the last interface scan - so it
1989                  * is gone and will be deleted here unless it did not
1990                  * originate from interface enumeration (INT_WILDCARD,
1991                  * INT_MCASTIF).
1992                  */
1993                 if (((INT_WILDCARD | INT_MCASTIF) & ep->flags) ||
1994                     ep->phase == sys_interphase)
1995                         continue;
1996
1997                 DPRINT_INTERFACE(3, (ep, "updating ",
1998                                      "GONE - deleting\n"));
1999                 remove_interface(ep);
2000
2001                 ifi.action = IFS_DELETED;
2002                 ifi.ep = ep;
2003                 if (receiver != NULL)
2004                         (*receiver)(data, &ifi);
2005
2006                 /* disconnect peers from deleted endpt. */
2007                 while (ep->peers != NULL)
2008                         set_peerdstadr(ep->peers, NULL);
2009
2010                 /*
2011                  * update globals in case we lose
2012                  * a loopback interface
2013                  */
2014                 if (ep == loopback_interface)
2015                         loopback_interface = NULL;
2016
2017                 delete_interface(ep);
2018         }
2019
2020         /*
2021          * phase 3 - re-configure as the world has possibly changed
2022          *
2023          * never ever make this conditional again - it is needed to track
2024          * routing updates. see bug #2506
2025          */
2026         refresh_all_peerinterfaces();
2027
2028         if (broadcast_client_enabled)
2029                 io_setbclient();
2030
2031         if (sys_bclient)
2032                 io_setbclient();
2033
2034         /*
2035          * Check multicast interfaces and try to join multicast groups if
2036          * not joined yet.
2037          */
2038         for (ep = ep_list; ep != NULL; ep = ep->elink) {
2039                 remaddr_t *entry;
2040
2041                 if (!(INT_MCASTIF & ep->flags) || (INT_MCASTOPEN & ep->flags))
2042                         continue;
2043
2044                 /* Find remote address that was linked to this interface */
2045                 for (entry = remoteaddr_list;
2046                      entry != NULL;
2047                      entry = entry->link) {
2048                         if (entry->ep == ep) {
2049                                 if (socket_multicast_enable(ep, &entry->addr)) {
2050                                         msyslog(LOG_INFO,
2051                                                 "Joined %s socket to multicast group %s",
2052                                                 stoa(&ep->sin),
2053                                                 stoa(&entry->addr));
2054                                 }
2055                                 break;
2056                         }
2057                 }
2058         }
2059
2060         return new_interface_found;
2061 }
2062
2063
2064 /*
2065  * create_sockets - create a socket for each interface plus a default
2066  *                      socket for when we don't know where to send
2067  */
2068 static int
2069 create_sockets(
2070         u_short port
2071         )
2072 {
2073 #ifndef HAVE_IO_COMPLETION_PORT
2074         /*
2075          * I/O Completion Ports don't care about the select and FD_SET
2076          */
2077         maxactivefd = 0;
2078         FD_ZERO(&activefds);
2079 #endif
2080
2081         DPRINTF(2, ("create_sockets(%d)\n", port));
2082
2083         create_wildcards(port);
2084
2085         update_interfaces(port, NULL, NULL);
2086
2087         /*
2088          * Now that we have opened all the sockets, turn off the reuse
2089          * flag for security.
2090          */
2091         set_reuseaddr(0);
2092
2093         DPRINTF(2, ("create_sockets: Total interfaces = %d\n", ninterfaces));
2094
2095         return ninterfaces;
2096 }
2097
2098 /*
2099  * create_interface - create a new interface for a given prototype
2100  *                    binding the socket.
2101  */
2102 static struct interface *
2103 create_interface(
2104         u_short                 port,
2105         struct interface *      protot
2106         )
2107 {
2108         sockaddr_u      resmask;
2109         endpt *         iface;
2110 #if defined(MCAST) && defined(MULTICAST_NONEWSOCKET)
2111         remaddr_t *     entry;
2112         remaddr_t *     next_entry;
2113 #endif
2114         DPRINTF(2, ("create_interface(%s#%d)\n", stoa(&protot->sin),
2115                     port));
2116
2117         /* build an interface */
2118         iface = new_interface(protot);
2119
2120         /*
2121          * create socket
2122          */
2123         iface->fd = open_socket(&iface->sin, 0, 0, iface);
2124
2125         if (iface->fd != INVALID_SOCKET)
2126                 log_listen_address(iface);
2127
2128         if ((INT_BROADCAST & iface->flags)
2129             && iface->bfd != INVALID_SOCKET)
2130                 msyslog(LOG_INFO, "Listening on broadcast address %s#%d",
2131                         stoa((&iface->bcast)), port);
2132
2133         if (INVALID_SOCKET == iface->fd
2134             && INVALID_SOCKET == iface->bfd) {
2135                 msyslog(LOG_ERR, "unable to create socket on %s (%d) for %s#%d",
2136                         iface->name,
2137                         iface->ifnum,
2138                         stoa((&iface->sin)),
2139                         port);
2140                 delete_interface(iface);
2141                 return NULL;
2142         }
2143
2144         /*
2145          * Blacklist our own addresses, no use talking to ourself
2146          */
2147         SET_HOSTMASK(&resmask, AF(&iface->sin));
2148         hack_restrict(RESTRICT_FLAGS, &iface->sin, &resmask,
2149                       RESM_NTPONLY | RESM_INTERFACE, RES_IGNORE, 0);
2150
2151         /*
2152          * set globals with the first found
2153          * loopback interface of the appropriate class
2154          */
2155         if (NULL == loopback_interface && AF_INET == iface->family
2156             && (INT_LOOPBACK & iface->flags))
2157                 loopback_interface = iface;
2158
2159         /*
2160          * put into our interface list
2161          */
2162         add_addr_to_list(&iface->sin, iface);
2163         add_interface(iface);
2164
2165 #if defined(MCAST) && defined(MULTICAST_NONEWSOCKET)
2166         /*
2167          * Join any previously-configured compatible multicast groups.
2168          */
2169         if (INT_MULTICAST & iface->flags &&
2170             !((INT_LOOPBACK | INT_WILDCARD) & iface->flags) &&
2171             !iface->ignore_packets) {
2172                 for (entry = remoteaddr_list;
2173                      entry != NULL;
2174                      entry = next_entry) {
2175                         next_entry = entry->link;
2176                         if (AF(&iface->sin) != AF(&entry->addr) ||
2177                             !IS_MCAST(&entry->addr))
2178                                 continue;
2179                         if (socket_multicast_enable(iface,
2180                                                     &entry->addr))
2181                                 msyslog(LOG_INFO,
2182                                         "Joined %s socket to multicast group %s",
2183                                         stoa(&iface->sin),
2184                                         stoa(&entry->addr));
2185                         else
2186                                 msyslog(LOG_ERR,
2187                                         "Failed to join %s socket to multicast group %s",
2188                                         stoa(&iface->sin),
2189                                         stoa(&entry->addr));
2190                 }
2191         }
2192 #endif  /* MCAST && MCAST_NONEWSOCKET */
2193
2194         DPRINT_INTERFACE(2, (iface, "created ", "\n"));
2195         return iface;
2196 }
2197
2198
2199 #ifdef SO_EXCLUSIVEADDRUSE
2200 static void
2201 set_excladdruse(
2202         SOCKET fd
2203         )
2204 {
2205         int one = 1;
2206         int failed;
2207 #ifdef SYS_WINNT
2208         DWORD err;
2209 #endif
2210
2211         failed = setsockopt(fd, SOL_SOCKET, SO_EXCLUSIVEADDRUSE,
2212                             (char *)&one, sizeof(one));
2213
2214         if (!failed)
2215                 return;
2216
2217 #ifdef SYS_WINNT
2218         /*
2219          * Prior to Windows XP setting SO_EXCLUSIVEADDRUSE can fail with
2220          * error WSAINVAL depending on service pack level and whether
2221          * the user account is in the Administrators group.  Do not
2222          * complain if it fails that way on versions prior to XP (5.1).
2223          */
2224         err = GetLastError();
2225
2226         if (isc_win32os_versioncheck(5, 1, 0, 0) < 0    /* < 5.1/XP */
2227             && WSAEINVAL == err)
2228                 return;
2229
2230         SetLastError(err);
2231 #endif
2232         msyslog(LOG_ERR,
2233                 "setsockopt(%d, SO_EXCLUSIVEADDRUSE, on): %m",
2234                 (int)fd);
2235 }
2236 #endif  /* SO_EXCLUSIVEADDRUSE */
2237
2238
2239 /*
2240  * set_reuseaddr() - set/clear REUSEADDR on all sockets
2241  *                      NB possible hole - should we be doing this on broadcast
2242  *                      fd's also?
2243  */
2244 static void
2245 set_reuseaddr(
2246         int flag
2247         )
2248 {
2249 #ifndef SO_EXCLUSIVEADDRUSE
2250         endpt *ep;
2251
2252         for (ep = ep_list; ep != NULL; ep = ep->elink) {
2253                 if (ep->flags & INT_WILDCARD)
2254                         continue;
2255
2256                 /*
2257                  * if ep->fd  is INVALID_SOCKET, we might have a adapter
2258                  * configured but not present
2259                  */
2260                 DPRINTF(4, ("setting SO_REUSEADDR on %.16s@%s to %s\n",
2261                             ep->name, stoa(&ep->sin),
2262                             flag ? "on" : "off"));
2263
2264                 if (ep->fd != INVALID_SOCKET) {
2265                         if (setsockopt(ep->fd, SOL_SOCKET, SO_REUSEADDR,
2266                                        (char *)&flag, sizeof(flag))) {
2267                                 msyslog(LOG_ERR, "set_reuseaddr: setsockopt(%s, SO_REUSEADDR, %s) failed: %m",
2268                                         stoa(&ep->sin), flag ? "on" : "off");
2269                         }
2270                 }
2271         }
2272 #endif /* ! SO_EXCLUSIVEADDRUSE */
2273 }
2274
2275 /*
2276  * This is just a wrapper around an internal function so we can
2277  * make other changes as necessary later on
2278  */
2279 void
2280 enable_broadcast(
2281         struct interface *      iface,
2282         sockaddr_u *            baddr
2283         )
2284 {
2285 #ifdef OPEN_BCAST_SOCKET
2286         socket_broadcast_enable(iface, iface->fd, baddr);
2287 #endif
2288 }
2289
2290 #ifdef OPEN_BCAST_SOCKET
2291 /*
2292  * Enable a broadcast address to a given socket
2293  * The socket is in the ep_list all we need to do is enable
2294  * broadcasting. It is not this function's job to select the socket
2295  */
2296 static isc_boolean_t
2297 socket_broadcast_enable(
2298         struct interface *      iface,
2299         SOCKET                  fd,
2300         sockaddr_u *            baddr
2301         )
2302 {
2303 #ifdef SO_BROADCAST
2304         int on = 1;
2305
2306         if (IS_IPV4(baddr)) {
2307                 /* if this interface can support broadcast, set SO_BROADCAST */
2308                 if (setsockopt(fd, SOL_SOCKET, SO_BROADCAST,
2309                                (char *)&on, sizeof(on)))
2310                         msyslog(LOG_ERR,
2311                                 "setsockopt(SO_BROADCAST) enable failure on address %s: %m",
2312                                 stoa(baddr));
2313                 else
2314                         DPRINTF(2, ("Broadcast enabled on socket %d for address %s\n",
2315                                     fd, stoa(baddr)));
2316         }
2317         iface->flags |= INT_BCASTXMIT;
2318         return ISC_TRUE;
2319 #else
2320         return ISC_FALSE;
2321 #endif /* SO_BROADCAST */
2322 }
2323
2324 #ifdef  OS_MISSES_SPECIFIC_ROUTE_UPDATES
2325 /*
2326  * Remove a broadcast address from a given socket
2327  * The socket is in the ep_list all we need to do is disable
2328  * broadcasting. It is not this function's job to select the socket
2329  */
2330 static isc_boolean_t
2331 socket_broadcast_disable(
2332         struct interface *      iface,
2333         sockaddr_u *            baddr
2334         )
2335 {
2336 #ifdef SO_BROADCAST
2337         int off = 0;    /* This seems to be OK as an int */
2338
2339         if (IS_IPV4(baddr) && setsockopt(iface->fd, SOL_SOCKET,
2340             SO_BROADCAST, (char *)&off, sizeof(off)))
2341                 msyslog(LOG_ERR,
2342                         "setsockopt(SO_BROADCAST) disable failure on address %s: %m",
2343                         stoa(baddr));
2344
2345         iface->flags &= ~INT_BCASTXMIT;
2346         return ISC_TRUE;
2347 #else
2348         return ISC_FALSE;
2349 #endif /* SO_BROADCAST */
2350 }
2351 #endif /* OS_MISSES_SPECIFIC_ROUTE_UPDATES */
2352
2353 #endif /* OPEN_BCAST_SOCKET */
2354
2355 /*
2356  * return the broadcast client flag value
2357  */
2358 isc_boolean_t
2359 get_broadcastclient_flag(void)
2360 {
2361         return (broadcast_client_enabled);
2362 }
2363 /*
2364  * Check to see if the address is a multicast address
2365  */
2366 static isc_boolean_t
2367 addr_ismulticast(
2368         sockaddr_u *maddr
2369         )
2370 {
2371         isc_boolean_t result;
2372
2373 #ifndef INCLUDE_IPV6_MULTICAST_SUPPORT
2374         /*
2375          * If we don't have IPV6 support any IPV6 addr is not multicast
2376          */
2377         if (IS_IPV6(maddr))
2378                 result = ISC_FALSE;
2379         else
2380 #endif
2381                 result = IS_MCAST(maddr);
2382
2383         if (!result)
2384                 DPRINTF(4, ("address %s is not multicast\n",
2385                             stoa(maddr)));
2386
2387         return result;
2388 }
2389
2390 /*
2391  * Multicast servers need to set the appropriate Multicast interface
2392  * socket option in order for it to know which interface to use for
2393  * send the multicast packet.
2394  */
2395 void
2396 enable_multicast_if(
2397         struct interface *      iface,
2398         sockaddr_u *            maddr
2399         )
2400 {
2401 #ifdef MCAST
2402 #ifdef IP_MULTICAST_LOOP
2403         TYPEOF_IP_MULTICAST_LOOP off = 0;
2404 #endif
2405 #if defined(INCLUDE_IPV6_MULTICAST_SUPPORT) && defined(IPV6_MULTICAST_LOOP)
2406         u_int off6 = 0;
2407 #endif
2408
2409         NTP_REQUIRE(AF(maddr) == AF(&iface->sin));
2410
2411         switch (AF(&iface->sin)) {
2412
2413         case AF_INET:
2414 #ifdef IP_MULTICAST_LOOP
2415                 /*
2416                  * Don't send back to itself, but allow failure to set
2417                  */
2418                 if (setsockopt(iface->fd, IPPROTO_IP,
2419                                IP_MULTICAST_LOOP,
2420                                SETSOCKOPT_ARG_CAST &off,
2421                                sizeof(off))) {
2422
2423                         msyslog(LOG_ERR,
2424                                 "setsockopt IP_MULTICAST_LOOP failed: %m on socket %d, addr %s for multicast address %s",
2425                                 iface->fd, stoa(&iface->sin),
2426                                 stoa(maddr));
2427                 }
2428 #endif
2429                 break;
2430
2431         case AF_INET6:
2432 #ifdef INCLUDE_IPV6_MULTICAST_SUPPORT
2433 #ifdef IPV6_MULTICAST_LOOP
2434                 /*
2435                  * Don't send back to itself, but allow failure to set
2436                  */
2437                 if (setsockopt(iface->fd, IPPROTO_IPV6,
2438                                IPV6_MULTICAST_LOOP,
2439                                (char *) &off6, sizeof(off6))) {
2440
2441                         msyslog(LOG_ERR,
2442                                 "setsockopt IPV6_MULTICAST_LOOP failed: %m on socket %d, addr %s for multicast address %s",
2443                                 iface->fd, stoa(&iface->sin),
2444                                 stoa(maddr));
2445                 }
2446 #endif
2447                 break;
2448 #else
2449                 return;
2450 #endif  /* INCLUDE_IPV6_MULTICAST_SUPPORT */
2451         }
2452         return;
2453 #endif
2454 }
2455
2456 /*
2457  * Add a multicast address to a given socket
2458  * The socket is in the ep_list all we need to do is enable
2459  * multicasting. It is not this function's job to select the socket
2460  */
2461 #if defined(MCAST)
2462 static isc_boolean_t
2463 socket_multicast_enable(
2464         endpt *         iface,
2465         sockaddr_u *    maddr
2466         )
2467 {
2468         struct ip_mreq          mreq;
2469 #ifdef INCLUDE_IPV6_MULTICAST_SUPPORT
2470         struct ipv6_mreq        mreq6;
2471 #endif
2472         switch (AF(maddr)) {
2473
2474         case AF_INET:
2475                 ZERO(mreq);
2476                 mreq.imr_multiaddr = SOCK_ADDR4(maddr);
2477                 mreq.imr_interface.s_addr = htonl(INADDR_ANY);
2478                 if (setsockopt(iface->fd,
2479                                IPPROTO_IP,
2480                                IP_ADD_MEMBERSHIP,
2481                                (char *)&mreq,
2482                                sizeof(mreq))) {
2483                         DPRINTF(2, (
2484                                 "setsockopt IP_ADD_MEMBERSHIP failed: %m on socket %d, addr %s for %x / %x (%s)",
2485                                 iface->fd, stoa(&iface->sin),
2486                                 mreq.imr_multiaddr.s_addr,
2487                                 mreq.imr_interface.s_addr,
2488                                 stoa(maddr)));
2489                         return ISC_FALSE;
2490                 }
2491                 DPRINTF(4, ("Added IPv4 multicast membership on socket %d, addr %s for %x / %x (%s)\n",
2492                             iface->fd, stoa(&iface->sin),
2493                             mreq.imr_multiaddr.s_addr,
2494                             mreq.imr_interface.s_addr, stoa(maddr)));
2495                 break;
2496
2497         case AF_INET6:
2498 #ifdef INCLUDE_IPV6_MULTICAST_SUPPORT
2499                 /*
2500                  * Enable reception of multicast packets.
2501                  * If the address is link-local we can get the
2502                  * interface index from the scope id. Don't do this
2503                  * for other types of multicast addresses. For now let
2504                  * the kernel figure it out.
2505                  */
2506                 ZERO(mreq6);
2507                 mreq6.ipv6mr_multiaddr = SOCK_ADDR6(maddr);
2508                 mreq6.ipv6mr_interface = iface->ifindex;
2509
2510                 if (setsockopt(iface->fd, IPPROTO_IPV6,
2511                                IPV6_JOIN_GROUP, (char *)&mreq6,
2512                                sizeof(mreq6))) {
2513                         DPRINTF(2, (
2514                                 "setsockopt IPV6_JOIN_GROUP failed: %m on socket %d, addr %s for interface %u (%s)",
2515                                 iface->fd, stoa(&iface->sin),
2516                                 mreq6.ipv6mr_interface, stoa(maddr)));
2517                         return ISC_FALSE;
2518                 }
2519                 DPRINTF(4, ("Added IPv6 multicast group on socket %d, addr %s for interface %u (%s)\n",
2520                             iface->fd, stoa(&iface->sin),
2521                             mreq6.ipv6mr_interface, stoa(maddr)));
2522 #else
2523                 return ISC_FALSE;
2524 #endif  /* INCLUDE_IPV6_MULTICAST_SUPPORT */
2525         }
2526         iface->flags |= INT_MCASTOPEN;
2527         iface->num_mcast++;
2528
2529         return ISC_TRUE;
2530 }
2531 #endif  /* MCAST */
2532
2533
2534 /*
2535  * Remove a multicast address from a given socket
2536  * The socket is in the ep_list all we need to do is disable
2537  * multicasting. It is not this function's job to select the socket
2538  */
2539 #ifdef MCAST
2540 static isc_boolean_t
2541 socket_multicast_disable(
2542         struct interface *      iface,
2543         sockaddr_u *            maddr
2544         )
2545 {
2546 #ifdef INCLUDE_IPV6_MULTICAST_SUPPORT
2547         struct ipv6_mreq mreq6;
2548 #endif
2549         struct ip_mreq mreq;
2550
2551         ZERO(mreq);
2552
2553         if (find_addr_in_list(maddr) == NULL) {
2554                 DPRINTF(4, ("socket_multicast_disable(%s): not found\n",
2555                             stoa(maddr)));
2556                 return ISC_TRUE;
2557         }
2558
2559         switch (AF(maddr)) {
2560
2561         case AF_INET:
2562                 mreq.imr_multiaddr = SOCK_ADDR4(maddr);
2563                 mreq.imr_interface = SOCK_ADDR4(&iface->sin);
2564                 if (setsockopt(iface->fd, IPPROTO_IP,
2565                                IP_DROP_MEMBERSHIP, (char *)&mreq,
2566                                sizeof(mreq))) {
2567
2568                         msyslog(LOG_ERR,
2569                                 "setsockopt IP_DROP_MEMBERSHIP failed: %m on socket %d, addr %s for %x / %x (%s)",
2570                                 iface->fd, stoa(&iface->sin),
2571                                 SRCADR(maddr), SRCADR(&iface->sin),
2572                                 stoa(maddr));
2573                         return ISC_FALSE;
2574                 }
2575                 break;
2576         case AF_INET6:
2577 #ifdef INCLUDE_IPV6_MULTICAST_SUPPORT
2578                 /*
2579                  * Disable reception of multicast packets
2580                  * If the address is link-local we can get the
2581                  * interface index from the scope id.  Don't do this
2582                  * for other types of multicast addresses. For now let
2583                  * the kernel figure it out.
2584                  */
2585                 mreq6.ipv6mr_multiaddr = SOCK_ADDR6(maddr);
2586                 mreq6.ipv6mr_interface = iface->ifindex;
2587
2588                 if (setsockopt(iface->fd, IPPROTO_IPV6,
2589                                IPV6_LEAVE_GROUP, (char *)&mreq6,
2590                                sizeof(mreq6))) {
2591
2592                         msyslog(LOG_ERR,
2593                                 "setsockopt IPV6_LEAVE_GROUP failure: %m on socket %d, addr %s for %d (%s)",
2594                                 iface->fd, stoa(&iface->sin),
2595                                 iface->ifindex, stoa(maddr));
2596                         return ISC_FALSE;
2597                 }
2598                 break;
2599 #else
2600                 return ISC_FALSE;
2601 #endif  /* INCLUDE_IPV6_MULTICAST_SUPPORT */
2602         }
2603
2604         iface->num_mcast--;
2605         if (!iface->num_mcast)
2606                 iface->flags &= ~INT_MCASTOPEN;
2607
2608         return ISC_TRUE;
2609 }
2610 #endif  /* MCAST */
2611
2612 /*
2613  * io_setbclient - open the broadcast client sockets
2614  */
2615 void
2616 io_setbclient(void)
2617 {
2618 #ifdef OPEN_BCAST_SOCKET
2619         struct interface *      interf;
2620         int                     nif;
2621
2622         nif = 0;
2623         set_reuseaddr(1);
2624
2625         for (interf = ep_list;
2626              interf != NULL;
2627              interf = interf->elink) {
2628
2629                 if (interf->flags & (INT_WILDCARD | INT_LOOPBACK))
2630                         continue;
2631
2632                 /* use only allowed addresses */
2633                 if (interf->ignore_packets)
2634                         continue;
2635
2636                 /* Need a broadcast-capable interface */
2637                 if (!(interf->flags & INT_BROADCAST))
2638                         continue;
2639
2640                 /* Only IPv4 addresses are valid for broadcast */
2641                 NTP_REQUIRE(IS_IPV4(&interf->sin));
2642
2643                 /* Do we already have the broadcast address open? */
2644                 if (interf->flags & INT_BCASTOPEN) {
2645                         /*
2646                          * account for already open interfaces to avoid
2647                          * misleading warning below
2648                          */
2649                         nif++;
2650                         continue;
2651                 }
2652
2653                 /*
2654                  * Try to open the broadcast address
2655                  */
2656                 interf->family = AF_INET;
2657                 interf->bfd = open_socket(&interf->bcast, 1, 0, interf);
2658
2659                 /*
2660                  * If we succeeded then we use it otherwise enable
2661                  * broadcast on the interface address
2662                  */
2663                 if (interf->bfd != INVALID_SOCKET) {
2664                         nif++;
2665                         interf->flags |= INT_BCASTOPEN;
2666                         msyslog(LOG_INFO,
2667                                 "Listen for broadcasts to %s on interface #%d %s",
2668                                 stoa(&interf->bcast), interf->ifnum, interf->name);
2669                 } else {
2670                         /* silently ignore EADDRINUSE as we probably opened
2671                            the socket already for an address in the same network */
2672                         if (errno != EADDRINUSE)
2673                                 msyslog(LOG_INFO,
2674                                         "failed to listen for broadcasts to %s on interface #%d %s",
2675                                         stoa(&interf->bcast), interf->ifnum, interf->name);
2676                 }
2677         }
2678         set_reuseaddr(0);
2679         if (nif > 0) {
2680                 broadcast_client_enabled = ISC_TRUE;
2681                 DPRINTF(1, ("io_setbclient: listening to %d broadcast addresses\n", nif));
2682         }
2683         else if (!nif) {
2684                 broadcast_client_enabled = ISC_FALSE;
2685                 msyslog(LOG_ERR,
2686                         "Unable to listen for broadcasts, no broadcast interfaces available");
2687         }
2688 #else
2689         msyslog(LOG_ERR,
2690                 "io_setbclient: Broadcast Client disabled by build");
2691 #endif  /* OPEN_BCAST_SOCKET */
2692 }
2693
2694 /*
2695  * io_unsetbclient - close the broadcast client sockets
2696  */
2697 void
2698 io_unsetbclient(void)
2699 {
2700         endpt *ep;
2701
2702         for (ep = ep_list; ep != NULL; ep = ep->elink) {
2703                 if (INT_WILDCARD & ep->flags)
2704                         continue;
2705                 if (!(INT_BCASTOPEN & ep->flags))
2706                         continue;
2707
2708                 if (ep->bfd != INVALID_SOCKET) {
2709                         /* destroy broadcast listening socket */
2710                         msyslog(LOG_INFO,
2711                                 "stop listening for broadcasts to %s on interface #%d %s",
2712                                 stoa(&ep->bcast), ep->ifnum, ep->name);
2713                         close_and_delete_fd_from_list(ep->bfd);
2714                         ep->bfd = INVALID_SOCKET;
2715                         ep->flags &= ~INT_BCASTOPEN;
2716                 }
2717         }
2718         broadcast_client_enabled = ISC_FALSE;
2719 }
2720
2721 /*
2722  * io_multicast_add() - add multicast group address
2723  */
2724 void
2725 io_multicast_add(
2726         sockaddr_u *addr
2727         )
2728 {
2729 #ifdef MCAST
2730         endpt * ep;
2731         endpt * one_ep;
2732
2733         /*
2734          * Check to see if this is a multicast address
2735          */
2736         if (!addr_ismulticast(addr))
2737                 return;
2738
2739         /* If we already have it we can just return */
2740         if (NULL != find_flagged_addr_in_list(addr, INT_MCASTOPEN)) {
2741                 msyslog(LOG_INFO,
2742                         "Duplicate request found for multicast address %s",
2743                         stoa(addr));
2744                 return;
2745         }
2746
2747 #ifndef MULTICAST_NONEWSOCKET
2748         ep = new_interface(NULL);
2749
2750         /*
2751          * Open a new socket for the multicast address
2752          */
2753         ep->sin = *addr;
2754         SET_PORT(&ep->sin, NTP_PORT);
2755         ep->family = AF(&ep->sin);
2756         AF(&ep->mask) = ep->family;
2757         SET_ONESMASK(&ep->mask);
2758
2759         set_reuseaddr(1);
2760         ep->bfd = INVALID_SOCKET;
2761         ep->fd = open_socket(&ep->sin, 0, 0, ep);
2762         if (ep->fd != INVALID_SOCKET) {
2763                 ep->ignore_packets = ISC_FALSE;
2764                 ep->flags |= INT_MCASTIF;
2765
2766                 strlcpy(ep->name, "multicast", sizeof(ep->name));
2767                 DPRINT_INTERFACE(2, (ep, "multicast add ", "\n"));
2768                 add_interface(ep);
2769                 log_listen_address(ep);
2770         } else {
2771                 /* bind failed, re-use wildcard interface */
2772                 delete_interface(ep);
2773
2774                 if (IS_IPV4(addr))
2775                         ep = wildipv4;
2776                 else if (IS_IPV6(addr))
2777                         ep = wildipv6;
2778                 else
2779                         ep = NULL;
2780
2781                 if (ep != NULL) {
2782                         /* HACK ! -- stuff in an address */
2783                         /* because we don't bind addr? DH */
2784                         ep->bcast = *addr;
2785                         msyslog(LOG_ERR,
2786                                 "multicast address %s using wildcard interface #%d %s",
2787                                 stoa(addr), ep->ifnum, ep->name);
2788                 } else {
2789                         msyslog(LOG_ERR,
2790                                 "No multicast socket available to use for address %s",
2791                                 stoa(addr));
2792                         return;
2793                 }
2794         }
2795         {       /* in place of the { following for in #else clause */
2796                 one_ep = ep;
2797 #else   /* MULTICAST_NONEWSOCKET follows */
2798         /*
2799          * For the case where we can't use a separate socket (Windows)
2800          * join each applicable endpoint socket to the group address.
2801          */
2802         if (IS_IPV4(addr))
2803                 one_ep = wildipv4;
2804         else
2805                 one_ep = wildipv6;
2806         for (ep = ep_list; ep != NULL; ep = ep->elink) {
2807                 if (ep->ignore_packets || AF(&ep->sin) != AF(addr) ||
2808                     !(INT_MULTICAST & ep->flags) ||
2809                     (INT_LOOPBACK | INT_WILDCARD) & ep->flags)
2810                         continue;
2811                 one_ep = ep;
2812 #endif  /* MULTICAST_NONEWSOCKET */
2813                 if (socket_multicast_enable(ep, addr))
2814                         msyslog(LOG_INFO,
2815                                 "Joined %s socket to multicast group %s",
2816                                 stoa(&ep->sin),
2817                                 stoa(addr));
2818         }
2819
2820         add_addr_to_list(addr, one_ep);
2821 #else   /* !MCAST  follows*/
2822         msyslog(LOG_ERR,
2823                 "Can not add multicast address %s: no multicast support",
2824                 stoa(addr));
2825 #endif
2826         return;
2827 }
2828
2829
2830 /*
2831  * io_multicast_del() - delete multicast group address
2832  */
2833 void
2834 io_multicast_del(
2835         sockaddr_u *    addr
2836         )
2837 {
2838 #ifdef MCAST
2839         endpt *iface;
2840
2841         /*
2842          * Check to see if this is a multicast address
2843          */
2844         if (!addr_ismulticast(addr)) {
2845                 msyslog(LOG_ERR, "invalid multicast address %s",
2846                         stoa(addr));
2847                 return;
2848         }
2849
2850         /*
2851          * Disable reception of multicast packets
2852          */
2853         while ((iface = find_flagged_addr_in_list(addr, INT_MCASTOPEN))
2854                != NULL)
2855                 socket_multicast_disable(iface, addr);
2856
2857         delete_addr_from_list(addr);
2858
2859 #else /* not MCAST */
2860         msyslog(LOG_ERR,
2861                 "Can not delete multicast address %s: no multicast support",
2862                 stoa(addr));
2863 #endif /* not MCAST */
2864 }
2865
2866
2867 /*
2868  * open_socket - open a socket, returning the file descriptor
2869  */
2870
2871 static SOCKET
2872 open_socket(
2873         sockaddr_u *    addr,
2874         int             bcast,
2875         int             turn_off_reuse,
2876         endpt *         interf
2877         )
2878 {
2879         SOCKET  fd;
2880         int     errval;
2881         /*
2882          * int is OK for REUSEADR per
2883          * http://www.kohala.com/start/mcast.api.txt
2884          */
2885         int     on = 1;
2886         int     off = 0;
2887
2888         if (IS_IPV6(addr) && !ipv6_works)
2889                 return INVALID_SOCKET;
2890
2891         /* create a datagram (UDP) socket */
2892         fd = socket(AF(addr), SOCK_DGRAM, 0);
2893         if (INVALID_SOCKET == fd) {
2894                 errval = socket_errno();
2895                 msyslog(LOG_ERR,
2896                         "socket(AF_INET%s, SOCK_DGRAM, 0) failed on address %s: %m",
2897                         IS_IPV6(addr) ? "6" : "", stoa(addr));
2898
2899                 if (errval == EPROTONOSUPPORT ||
2900                     errval == EAFNOSUPPORT ||
2901                     errval == EPFNOSUPPORT)
2902                         return (INVALID_SOCKET);
2903
2904                 errno = errval;
2905                 msyslog(LOG_ERR,
2906                         "unexpected socket() error %m code %d (not EPROTONOSUPPORT nor EAFNOSUPPORT nor EPFNOSUPPORT) - exiting",
2907                         errno);
2908                 exit(1);
2909         }
2910
2911 #ifdef SYS_WINNT
2912         connection_reset_fix(fd, addr);
2913 #endif
2914         /*
2915          * Fixup the file descriptor for some systems
2916          * See bug #530 for details of the issue.
2917          */
2918         fd = move_fd(fd);
2919
2920         /*
2921          * set SO_REUSEADDR since we will be binding the same port
2922          * number on each interface according to turn_off_reuse.
2923          * This is undesirable on Windows versions starting with
2924          * Windows XP (numeric version 5.1).
2925          */
2926 #ifdef SYS_WINNT
2927         if (isc_win32os_versioncheck(5, 1, 0, 0) < 0)  /* before 5.1 */
2928 #endif
2929                 if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR,
2930                                (char *)((turn_off_reuse)
2931                                             ? &off
2932                                             : &on),
2933                                sizeof(on))) {
2934
2935                         msyslog(LOG_ERR,
2936                                 "setsockopt SO_REUSEADDR %s fails for address %s: %m",
2937                                 (turn_off_reuse)
2938                                     ? "off"
2939                                     : "on",
2940                                 stoa(addr));
2941                         closesocket(fd);
2942                         return INVALID_SOCKET;
2943                 }
2944 #ifdef SO_EXCLUSIVEADDRUSE
2945         /*
2946          * setting SO_EXCLUSIVEADDRUSE on the wildcard we open
2947          * first will cause more specific binds to fail.
2948          */
2949         if (!(interf->flags & INT_WILDCARD))
2950                 set_excladdruse(fd);
2951 #endif
2952
2953         /*
2954          * IPv4 specific options go here
2955          */
2956         if (IS_IPV4(addr)) {
2957 #if defined(IPPROTO_IP) && defined(IP_TOS)
2958                 if (setsockopt(fd, IPPROTO_IP, IP_TOS, (char*)&qos,
2959                                sizeof(qos)))
2960                         msyslog(LOG_ERR,
2961                                 "setsockopt IP_TOS (%02x) fails on address %s: %m",
2962                                 qos, stoa(addr));
2963 #endif /* IPPROTO_IP && IP_TOS */
2964                 if (bcast)
2965                         socket_broadcast_enable(interf, fd, addr);
2966         }
2967
2968         /*
2969          * IPv6 specific options go here
2970          */
2971         if (IS_IPV6(addr)) {
2972 #if defined(IPPROTO_IPV6) && defined(IPV6_TCLASS)
2973                 if (setsockopt(fd, IPPROTO_IPV6, IPV6_TCLASS, (char*)&qos,
2974                                sizeof(qos)))
2975                         msyslog(LOG_ERR,
2976                                 "setsockopt IPV6_TCLASS (%02x) fails on address %s: %m",
2977                                 qos, stoa(addr));
2978 #endif /* IPPROTO_IPV6 && IPV6_TCLASS */
2979 #ifdef IPV6_V6ONLY
2980                 if (isc_net_probe_ipv6only() == ISC_R_SUCCESS
2981                     && setsockopt(fd, IPPROTO_IPV6, IPV6_V6ONLY,
2982                     (char*)&on, sizeof(on)))
2983                         msyslog(LOG_ERR,
2984                                 "setsockopt IPV6_V6ONLY on fails on address %s: %m",
2985                                 stoa(addr));
2986 #endif
2987 #ifdef IPV6_BINDV6ONLY
2988                 if (setsockopt(fd, IPPROTO_IPV6, IPV6_BINDV6ONLY,
2989                     (char*)&on, sizeof(on)))
2990                         msyslog(LOG_ERR,
2991                                 "setsockopt IPV6_BINDV6ONLY on fails on address %s: %m",
2992                                 stoa(addr));
2993 #endif
2994         }
2995
2996 #ifdef OS_NEEDS_REUSEADDR_FOR_IFADDRBIND
2997         /*
2998          * some OSes don't allow binding to more specific
2999          * addresses if a wildcard address already bound
3000          * to the port and SO_REUSEADDR is not set
3001          */
3002         if (!is_wildcard_addr(addr))
3003                 set_wildcard_reuse(AF(addr), 1);
3004 #endif
3005
3006         /*
3007          * bind the local address.
3008          */
3009         errval = bind(fd, &addr->sa, SOCKLEN(addr));
3010
3011 #ifdef OS_NEEDS_REUSEADDR_FOR_IFADDRBIND
3012         if (!is_wildcard_addr(addr))
3013                 set_wildcard_reuse(AF(addr), 0);
3014 #endif
3015
3016         if (errval < 0) {
3017                 /*
3018                  * Don't log this under all conditions
3019                  */
3020                 if (turn_off_reuse == 0
3021 #ifdef DEBUG
3022                     || debug > 1
3023 #endif
3024                     ) {
3025                         msyslog(LOG_ERR,
3026                                 "bind(%d) AF_INET%s %s#%d%s flags 0x%x failed: %m",
3027                                 fd, IS_IPV6(addr) ? "6" : "",
3028                                 stoa(addr), SRCPORT(addr),
3029                                 IS_MCAST(addr) ? " (multicast)" : "",
3030                                 interf->flags);
3031                 }
3032
3033                 closesocket(fd);
3034
3035                 return INVALID_SOCKET;
3036         }
3037
3038 #ifdef HAVE_TIMESTAMP
3039         {
3040                 if (setsockopt(fd, SOL_SOCKET, SO_TIMESTAMP,
3041                                (char*)&on, sizeof(on)))
3042                         msyslog(LOG_DEBUG,
3043                                 "setsockopt SO_TIMESTAMP on fails on address %s: %m",
3044                                 stoa(addr));
3045                 else
3046                         DPRINTF(4, ("setsockopt SO_TIMESTAMP enabled on fd %d address %s\n",
3047                                     fd, stoa(addr)));
3048         }
3049 #endif
3050 #ifdef HAVE_TIMESTAMPNS
3051         {
3052                 if (setsockopt(fd, SOL_SOCKET, SO_TIMESTAMPNS,
3053                                (char*)&on, sizeof(on)))
3054                         msyslog(LOG_DEBUG,
3055                                 "setsockopt SO_TIMESTAMPNS on fails on address %s: %m",
3056                                 stoa(addr));
3057                 else
3058                         DPRINTF(4, ("setsockopt SO_TIMESTAMPNS enabled on fd %d address %s\n",
3059                                     fd, stoa(addr)));
3060         }
3061 #endif
3062 #ifdef HAVE_BINTIME
3063         {
3064                 if (setsockopt(fd, SOL_SOCKET, SO_BINTIME,
3065                                (char*)&on, sizeof(on)))
3066                         msyslog(LOG_DEBUG,
3067                                 "setsockopt SO_BINTIME on fails on address %s: %m",
3068                                 stoa(addr));
3069                 else
3070                         DPRINTF(4, ("setsockopt SO_BINTIME enabled on fd %d address %s\n",
3071                                     fd, stoa(addr)));
3072         }
3073 #endif
3074
3075         DPRINTF(4, ("bind(%d) AF_INET%s, addr %s%%%d#%d, flags 0x%x\n",
3076                    fd, IS_IPV6(addr) ? "6" : "", stoa(addr),
3077                    SCOPE(addr), SRCPORT(addr), interf->flags));
3078
3079         make_socket_nonblocking(fd);
3080
3081 #ifdef HAVE_SIGNALED_IO
3082         init_socket_sig(fd);
3083 #endif /* not HAVE_SIGNALED_IO */
3084
3085         add_fd_to_list(fd, FD_TYPE_SOCKET);
3086
3087 #if !defined(SYS_WINNT) && !defined(VMS)
3088         DPRINTF(4, ("flags for fd %d: 0x%x\n", fd,
3089                     fcntl(fd, F_GETFL, 0)));
3090 #endif /* SYS_WINNT || VMS */
3091
3092 #if defined (HAVE_IO_COMPLETION_PORT)
3093 /*
3094  * Add the socket to the completion port
3095  */
3096         if (io_completion_port_add_socket(fd, interf)) {
3097                 msyslog(LOG_ERR, "unable to set up io completion port - EXITING");
3098                 exit(1);
3099         }
3100 #endif
3101         return fd;
3102 }
3103
3104
3105 #ifdef SYS_WINNT
3106 #define sendto(fd, buf, len, flags, dest, destsz)       \
3107         io_completion_port_sendto(fd, buf, len, (sockaddr_u *)(dest))
3108 #endif
3109
3110 /* XXX ELIMINATE sendpkt similar in ntpq.c, ntpdc.c, ntp_io.c, ntptrace.c */
3111 /*
3112  * sendpkt - send a packet to the specified destination. Maintain a
3113  * send error cache so that only the first consecutive error for a
3114  * destination is logged.
3115  */
3116 void
3117 sendpkt(
3118         sockaddr_u *            dest,
3119         struct interface *      ep,
3120         int                     ttl,
3121         struct pkt *            pkt,
3122         int                     len
3123         )
3124 {
3125         endpt * src;
3126         int     ismcast;
3127         int     cc;
3128         int     rc;
3129         u_char  cttl;
3130
3131         ismcast = IS_MCAST(dest);
3132         if (!ismcast)
3133                 src = ep;
3134         else
3135                 src = (IS_IPV4(dest))
3136                           ? mc4_list
3137                           : mc6_list;
3138
3139         if (NULL == src) {
3140                 /*
3141                  * unbound peer - drop request and wait for better
3142                  * network conditions
3143                  */
3144                 DPRINTF(2, ("%ssendpkt(dst=%s, ttl=%d, len=%d): no interface - IGNORED\n",
3145                             ismcast ? "\tMCAST\t***** " : "",
3146                             stoa(dest), ttl, len));
3147                 return;
3148         }
3149
3150         do {
3151                 DPRINTF(2, ("%ssendpkt(%d, dst=%s, src=%s, ttl=%d, len=%d)\n",
3152                             ismcast ? "\tMCAST\t***** " : "", src->fd,
3153                             stoa(dest), stoa(&src->sin), ttl, len));
3154 #ifdef MCAST
3155                 /*
3156                  * for the moment we use the bcast option to set multicast ttl
3157                  */
3158                 if (ismcast && ttl > 0 && ttl != src->last_ttl) {
3159                         /*
3160                          * set the multicast ttl for outgoing packets
3161                          */
3162                         switch (AF(&src->sin)) {
3163
3164                         case AF_INET :
3165                                 cttl = (u_char)ttl;
3166                                 rc = setsockopt(src->fd, IPPROTO_IP,
3167                                                 IP_MULTICAST_TTL,
3168                                                 (void *)&cttl,
3169                                                 sizeof(cttl));
3170                                 break;
3171
3172 # ifdef INCLUDE_IPV6_SUPPORT
3173                         case AF_INET6 :
3174                                 rc = setsockopt(src->fd, IPPROTO_IPV6,
3175                                                  IPV6_MULTICAST_HOPS,
3176                                                  (void *)&ttl,
3177                                                  sizeof(ttl));
3178                                 break;
3179 # endif /* INCLUDE_IPV6_SUPPORT */
3180
3181                         default:
3182                                 rc = 0;
3183                         }
3184
3185                         if (!rc)
3186                                 src->last_ttl = ttl;
3187                         else
3188                                 msyslog(LOG_ERR,
3189                                         "setsockopt IP_MULTICAST_TTL/IPV6_MULTICAST_HOPS fails on address %s: %m",
3190                                         stoa(&src->sin));
3191                 }
3192 #endif  /* MCAST */
3193
3194 #ifdef SIM
3195                 cc = simulate_server(dest, src, pkt);
3196 #else
3197                 cc = sendto(src->fd, (char *)pkt, (u_int)len, 0,
3198                             &dest->sa, SOCKLEN(dest));
3199 #endif
3200                 if (cc == -1) {
3201                         src->notsent++;
3202                         packets_notsent++;
3203                 } else  {
3204                         src->sent++;
3205                         packets_sent++;
3206                 }
3207                 if (ismcast)
3208                         src = src->mclink;
3209         } while (ismcast && src != NULL);
3210 }
3211
3212
3213 #if !defined(HAVE_IO_COMPLETION_PORT)
3214 /*
3215  * fdbits - generate ascii representation of fd_set (FAU debug support)
3216  * HFDF format - highest fd first.
3217  */
3218 static char *
3219 fdbits(
3220         int count,
3221         fd_set *set
3222         )
3223 {
3224         static char buffer[256];
3225         char * buf = buffer;
3226
3227         count = min(count,  255);
3228
3229         while (count >= 0) {
3230                 *buf++ = FD_ISSET(count, set) ? '#' : '-';
3231                 count--;
3232         }
3233         *buf = '\0';
3234
3235         return buffer;
3236 }
3237
3238
3239 #ifdef REFCLOCK
3240 /*
3241  * Routine to read the refclock packets for a specific interface
3242  * Return the number of bytes read. That way we know if we should
3243  * read it again or go on to the next one if no bytes returned
3244  */
3245 static inline int
3246 read_refclock_packet(
3247         SOCKET                  fd,
3248         struct refclockio *     rp,
3249         l_fp                    ts
3250         )
3251 {
3252         int                     i;
3253         int                     buflen;
3254         int                     saved_errno;
3255         int                     consumed;
3256         struct recvbuf *        rb;
3257
3258         rb = get_free_recv_buffer();
3259
3260         if (NULL == rb) {
3261                 /*
3262                  * No buffer space available - just drop the packet
3263                  */
3264                 char buf[RX_BUFF_SIZE];
3265
3266                 buflen = read(fd, buf, sizeof buf);
3267                 packets_dropped++;
3268                 return (buflen);
3269         }
3270
3271         i = (rp->datalen == 0
3272              || rp->datalen > (int)sizeof(rb->recv_space))
3273                 ? (int)sizeof(rb->recv_space)
3274                 : rp->datalen;
3275         do {
3276                 buflen = read(fd, (char *)&rb->recv_space, (u_int)i);
3277         } while (buflen < 0 && EINTR == errno);
3278
3279         if (buflen <= 0) {
3280                 saved_errno = errno;
3281                 freerecvbuf(rb);
3282                 errno = saved_errno;
3283                 return buflen;
3284         }
3285
3286         /*
3287          * Got one. Mark how and when it got here,
3288          * put it on the full list and do bookkeeping.
3289          */
3290         rb->recv_length = buflen;
3291         rb->recv_peer = rp->srcclock;
3292         rb->dstadr = 0;
3293         rb->fd = fd;
3294         rb->recv_time = ts;
3295         rb->receiver = rp->clock_recv;
3296
3297         consumed = indicate_refclock_packet(rp, rb);
3298         if (!consumed) {
3299                 rp->recvcount++;
3300                 packets_received++;
3301         }
3302
3303         return buflen;
3304 }
3305 #endif  /* REFCLOCK */
3306
3307
3308 #ifdef HAVE_PACKET_TIMESTAMP
3309 /*
3310  * extract timestamps from control message buffer
3311  */
3312 static l_fp
3313 fetch_timestamp(
3314         struct recvbuf *        rb,
3315         struct msghdr *         msghdr,
3316         l_fp                    ts
3317         )
3318 {
3319         struct cmsghdr *        cmsghdr;
3320 #ifdef HAVE_BINTIME
3321         struct bintime *        btp;
3322 #endif
3323 #ifdef HAVE_TIMESTAMPNS
3324         struct timespec *       tsp;
3325 #endif
3326 #ifdef HAVE_TIMESTAMP
3327         struct timeval *        tvp;
3328 #endif
3329         unsigned long           ticks;
3330         double                  fuzz;
3331         l_fp                    lfpfuzz;
3332         l_fp                    nts;
3333 #ifdef DEBUG_TIMING
3334         l_fp                    dts;
3335 #endif
3336
3337         cmsghdr = CMSG_FIRSTHDR(msghdr);
3338         while (cmsghdr != NULL) {
3339                 switch (cmsghdr->cmsg_type)
3340                 {
3341 #ifdef HAVE_BINTIME
3342                 case SCM_BINTIME:
3343 #endif  /* HAVE_BINTIME */
3344 #ifdef HAVE_TIMESTAMPNS
3345                 case SCM_TIMESTAMPNS:
3346 #endif  /* HAVE_TIMESTAMPNS */
3347 #ifdef HAVE_TIMESTAMP
3348                 case SCM_TIMESTAMP:
3349 #endif  /* HAVE_TIMESTAMP */
3350 #if defined(HAVE_BINTIME) || defined (HAVE_TIMESTAMPNS) || defined(HAVE_TIMESTAMP)
3351                         switch (cmsghdr->cmsg_type)
3352                         {
3353 #ifdef HAVE_BINTIME
3354                         case SCM_BINTIME:
3355                                 btp = (struct bintime *)CMSG_DATA(cmsghdr);
3356                                 /*
3357                                  * bintime documentation is at http://phk.freebsd.dk/pubs/timecounter.pdf
3358                                  */
3359                                 nts.l_i = btp->sec + JAN_1970;
3360                                 nts.l_uf = (u_int32)(btp->frac >> 32);
3361                                 if (sys_tick > measured_tick &&
3362                                     sys_tick > 1e-9) {
3363                                         ticks = (unsigned long)(nts.l_uf / (unsigned long)(sys_tick * FRAC));
3364                                         nts.l_uf = (unsigned long)(ticks * (unsigned long)(sys_tick * FRAC));
3365                                 }
3366                                 DPRINTF(4, ("fetch_timestamp: system bintime network time stamp: %ld.%09lu\n",
3367                                             btp->sec, (unsigned long)((nts.l_uf / FRAC) * 1e9)));
3368                                 break;
3369 #endif  /* HAVE_BINTIME */
3370 #ifdef HAVE_TIMESTAMPNS
3371                         case SCM_TIMESTAMPNS:
3372                                 tsp = (struct timespec *)CMSG_DATA(cmsghdr);
3373                                 if (sys_tick > measured_tick &&
3374                                     sys_tick > 1e-9) {
3375                                         ticks = (unsigned long)((tsp->tv_nsec * 1e-9) /
3376                                                        sys_tick);
3377                                         tsp->tv_nsec = (long)(ticks * 1e9 *
3378                                                               sys_tick);
3379                                 }
3380                                 DPRINTF(4, ("fetch_timestamp: system nsec network time stamp: %ld.%09ld\n",
3381                                             tsp->tv_sec, tsp->tv_nsec));
3382                                 nts = tspec_stamp_to_lfp(*tsp);
3383                                 break;
3384 #endif  /* HAVE_TIMESTAMPNS */
3385 #ifdef HAVE_TIMESTAMP
3386                         case SCM_TIMESTAMP:
3387                                 tvp = (struct timeval *)CMSG_DATA(cmsghdr);
3388                                 if (sys_tick > measured_tick &&
3389                                     sys_tick > 1e-6) {
3390                                         ticks = (unsigned long)((tvp->tv_usec * 1e-6) /
3391                                                        sys_tick);
3392                                         tvp->tv_usec = (long)(ticks * 1e6 *
3393                                                               sys_tick);
3394                                 }
3395                                 DPRINTF(4, ("fetch_timestamp: system usec network time stamp: %jd.%06ld\n",
3396                                             (intmax_t)tvp->tv_sec, (long)tvp->tv_usec));
3397                                 nts = tval_stamp_to_lfp(*tvp);
3398                                 break;
3399 #endif  /* HAVE_TIMESTAMP */
3400                         }
3401                         fuzz = ntp_random() * 2. / FRAC * sys_fuzz;
3402                         DTOLFP(fuzz, &lfpfuzz);
3403                         L_ADD(&nts, &lfpfuzz);
3404 #ifdef DEBUG_TIMING
3405                         dts = ts;
3406                         L_SUB(&dts, &nts);
3407                         collect_timing(rb, "input processing delay", 1,
3408                                        &dts);
3409                         DPRINTF(4, ("fetch_timestamp: timestamp delta: %s (incl. fuzz)\n",
3410                                     lfptoa(&dts, 9)));
3411 #endif  /* DEBUG_TIMING */
3412                         ts = nts;  /* network time stamp */
3413                         break;
3414 #endif  /* HAVE_BINTIME || HAVE_TIMESTAMPNS || HAVE_TIMESTAMP */
3415
3416                 default:
3417                         DPRINTF(4, ("fetch_timestamp: skipping control message 0x%x\n",
3418                                     cmsghdr->cmsg_type));
3419                 }
3420                 cmsghdr = CMSG_NXTHDR(msghdr, cmsghdr);
3421         }
3422         return ts;
3423 }
3424 #endif  /* HAVE_PACKET_TIMESTAMP */
3425
3426
3427 /*
3428  * Routine to read the network NTP packets for a specific interface
3429  * Return the number of bytes read. That way we know if we should
3430  * read it again or go on to the next one if no bytes returned
3431  */
3432 static inline int
3433 read_network_packet(
3434         SOCKET                  fd,
3435         struct interface *      itf,
3436         l_fp                    ts
3437         )
3438 {
3439         GETSOCKNAME_SOCKLEN_TYPE fromlen;
3440         int buflen;
3441         register struct recvbuf *rb;
3442 #ifdef HAVE_PACKET_TIMESTAMP
3443         struct msghdr msghdr;
3444         struct iovec iovec;
3445         char control[CMSG_BUFSIZE];
3446 #endif
3447
3448         /*
3449          * Get a buffer and read the frame.  If we
3450          * haven't got a buffer, or this is received
3451          * on a disallowed socket, just dump the
3452          * packet.
3453          */
3454
3455         rb = get_free_recv_buffer();
3456         if (NULL == rb || itf->ignore_packets) {
3457                 char buf[RX_BUFF_SIZE];
3458                 sockaddr_u from;
3459
3460                 if (rb != NULL)
3461                         freerecvbuf(rb);
3462
3463                 fromlen = sizeof(from);
3464                 buflen = recvfrom(fd, buf, sizeof(buf), 0,
3465                                   &from.sa, &fromlen);
3466                 DPRINTF(4, ("%s on (%lu) fd=%d from %s\n",
3467                         (itf->ignore_packets)
3468                             ? "ignore"
3469                             : "drop",
3470                         free_recvbuffs(), fd, stoa(&from)));
3471                 if (itf->ignore_packets)
3472                         packets_ignored++;
3473                 else
3474                         packets_dropped++;
3475                 return (buflen);
3476         }
3477
3478         fromlen = sizeof(rb->recv_srcadr);
3479
3480 #ifndef HAVE_PACKET_TIMESTAMP
3481         rb->recv_length = recvfrom(fd, (char *)&rb->recv_space,
3482                                    sizeof(rb->recv_space), 0,
3483                                    &rb->recv_srcadr.sa, &fromlen);
3484 #else
3485         iovec.iov_base        = &rb->recv_space;
3486         iovec.iov_len         = sizeof(rb->recv_space);
3487         msghdr.msg_name       = &rb->recv_srcadr;
3488         msghdr.msg_namelen    = fromlen;
3489         msghdr.msg_iov        = &iovec;
3490         msghdr.msg_iovlen     = 1;
3491         msghdr.msg_control    = (void *)&control;
3492         msghdr.msg_controllen = sizeof(control);
3493         msghdr.msg_flags      = 0;
3494         rb->recv_length       = recvmsg(fd, &msghdr, 0);
3495 #endif
3496
3497         buflen = rb->recv_length;
3498
3499         if (buflen == 0 || (buflen == -1 &&
3500             (EWOULDBLOCK == errno
3501 #ifdef EAGAIN
3502              || EAGAIN == errno
3503 #endif
3504              ))) {
3505                 freerecvbuf(rb);
3506                 return (buflen);
3507         } else if (buflen < 0) {
3508                 msyslog(LOG_ERR, "recvfrom(%s) fd=%d: %m",
3509                         stoa(&rb->recv_srcadr), fd);
3510                 DPRINTF(5, ("read_network_packet: fd=%d dropped (bad recvfrom)\n",
3511                             fd));
3512                 freerecvbuf(rb);
3513                 return (buflen);
3514         }
3515
3516         DPRINTF(3, ("read_network_packet: fd=%d length %d from %s\n",
3517                     fd, buflen, stoa(&rb->recv_srcadr)));
3518
3519         /*
3520         ** Bug 2672: Some OSes (MacOSX and Linux) don't block spoofed ::1
3521         */
3522
3523         if (AF_INET6 == itf->family) {
3524                 DPRINTF(2, ("Got an IPv6 packet, from <%s> (%d) to <%s> (%d)\n",
3525                         stoa(&rb->recv_srcadr),
3526                         IN6_IS_ADDR_LOOPBACK(PSOCK_ADDR6(&rb->recv_srcadr)),
3527                         stoa(&itf->sin),
3528                         !IN6_IS_ADDR_LOOPBACK(PSOCK_ADDR6(&itf->sin))
3529                         ));
3530
3531                 if (   IN6_IS_ADDR_LOOPBACK(PSOCK_ADDR6(&rb->recv_srcadr))
3532                     && !IN6_IS_ADDR_LOOPBACK(PSOCK_ADDR6(&itf->sin))
3533                    ) {
3534                         packets_dropped++;
3535                         DPRINTF(2, ("DROPPING that packet\n"));
3536                         freerecvbuf(rb);
3537                         return buflen;
3538                 }
3539                 DPRINTF(2, ("processing that packet\n"));
3540         }
3541
3542         /*
3543          * Got one.  Mark how and when it got here,
3544          * put it on the full list and do bookkeeping.
3545          */
3546         rb->dstadr = itf;
3547         rb->fd = fd;
3548 #ifdef HAVE_PACKET_TIMESTAMP
3549         /* pick up a network time stamp if possible */
3550         ts = fetch_timestamp(rb, &msghdr, ts);
3551 #endif
3552         rb->recv_time = ts;
3553         rb->receiver = receive;
3554
3555         add_full_recv_buffer(rb);
3556
3557         itf->received++;
3558         packets_received++;
3559         return (buflen);
3560 }
3561
3562 /*
3563  * attempt to handle io (select()/signaled IO)
3564  */
3565 void
3566 io_handler(void)
3567 {
3568 #  ifndef HAVE_SIGNALED_IO
3569         fd_set rdfdes;
3570         int nfound;
3571
3572         /*
3573          * Use select() on all on all input fd's for unlimited
3574          * time.  select() will terminate on SIGALARM or on the
3575          * reception of input.  Using select() means we can't do
3576          * robust signal handling and we get a potential race
3577          * between checking for alarms and doing the select().
3578          * Mostly harmless, I think.
3579          */
3580         /*
3581          * On VMS, I suspect that select() can't be interrupted
3582          * by a "signal" either, so I take the easy way out and
3583          * have select() time out after one second.
3584          * System clock updates really aren't time-critical,
3585          * and - lacking a hardware reference clock - I have
3586          * yet to learn about anything else that is.
3587          */
3588         rdfdes = activefds;
3589 #   if !defined(VMS) && !defined(SYS_VXWORKS)
3590         nfound = select(maxactivefd + 1, &rdfdes, NULL,
3591                         NULL, NULL);
3592 #   else        /* VMS, VxWorks */
3593         /* make select() wake up after one second */
3594         {
3595                 struct timeval t1;
3596
3597                 t1.tv_sec = 1;
3598                 t1.tv_usec = 0;
3599                 nfound = select(maxactivefd + 1,
3600                                 &rdfdes, NULL, NULL,
3601                                 &t1);
3602         }
3603 #   endif       /* VMS, VxWorks */
3604         if (nfound > 0) {
3605                 l_fp ts;
3606
3607                 get_systime(&ts);
3608
3609                 input_handler(&ts);
3610         } else if (nfound == -1 && errno != EINTR) {
3611                 msyslog(LOG_ERR, "select() error: %m");
3612         }
3613 #   ifdef DEBUG
3614         else if (debug > 4) {
3615                 msyslog(LOG_DEBUG, "select(): nfound=%d, error: %m", nfound);
3616         } else {
3617                 DPRINTF(3, ("select() returned %d: %m\n", nfound));
3618         }
3619 #   endif /* DEBUG */
3620 #  else /* HAVE_SIGNALED_IO */
3621         wait_for_signal();
3622 #  endif /* HAVE_SIGNALED_IO */
3623 }
3624
3625 /*
3626  * input_handler - receive packets asynchronously
3627  */
3628 static void
3629 input_handler(
3630         l_fp *  cts
3631         )
3632 {
3633         int             buflen;
3634         int             n;
3635         u_int           idx;
3636         int             doing;
3637         SOCKET          fd;
3638         blocking_child *c;
3639         struct timeval  tvzero;
3640         l_fp            ts;     /* Timestamp at BOselect() gob */
3641 #ifdef DEBUG_TIMING
3642         l_fp            ts_e;   /* Timestamp at EOselect() gob */
3643 #endif
3644         fd_set          fds;
3645         size_t          select_count;
3646         endpt *         ep;
3647 #ifdef REFCLOCK
3648         struct refclockio *rp;
3649         int             saved_errno;
3650         const char *    clk;
3651 #endif
3652 #ifdef HAS_ROUTING_SOCKET
3653         struct asyncio_reader * asyncio_reader;
3654         struct asyncio_reader * next_asyncio_reader;
3655 #endif
3656
3657         handler_calls++;
3658         select_count = 0;
3659
3660         /*
3661          * If we have something to do, freeze a timestamp.
3662          * See below for the other cases (nothing left to do or error)
3663          */
3664         ts = *cts;
3665
3666         /*
3667          * Do a poll to see who has data
3668          */
3669
3670         fds = activefds;
3671         tvzero.tv_sec = tvzero.tv_usec = 0;
3672
3673         n = select(maxactivefd + 1, &fds, (fd_set *)0, (fd_set *)0,
3674                    &tvzero);
3675
3676         /*
3677          * If there are no packets waiting just return
3678          */
3679         if (n < 0) {
3680                 int err = errno;
3681                 int j, b, prior;
3682                 /*
3683                  * extended FAU debugging output
3684                  */
3685                 if (err != EINTR)
3686                         msyslog(LOG_ERR,
3687                                 "select(%d, %s, 0L, 0L, &0.0) error: %m",
3688                                 maxactivefd + 1,
3689                                 fdbits(maxactivefd, &activefds));
3690                 if (err != EBADF)
3691                         goto ih_return;
3692                 for (j = 0, prior = 0; j <= maxactivefd; j++) {
3693                         if (FD_ISSET(j, &activefds)) {
3694                                 if (-1 != read(j, &b, 0)) {
3695                                         prior = j;
3696                                         continue;
3697                                 }
3698                                 msyslog(LOG_ERR,
3699                                         "Removing bad file descriptor %d from select set",
3700                                         j);
3701                                 FD_CLR(j, &activefds);
3702                                 if (j == maxactivefd)
3703                                         maxactivefd = prior;
3704                         }
3705                 }
3706                 goto ih_return;
3707         }
3708         else if (n == 0)
3709                 goto ih_return;
3710
3711         ++handler_pkts;
3712
3713 #ifdef REFCLOCK
3714         /*
3715          * Check out the reference clocks first, if any
3716          */
3717
3718         if (refio != NULL) {
3719                 for (rp = refio; rp != NULL; rp = rp->next) {
3720                         fd = rp->fd;
3721
3722                         if (!FD_ISSET(fd, &fds))
3723                                 continue;
3724                         ++select_count;
3725                         buflen = read_refclock_packet(fd, rp, ts);
3726                         /*
3727                          * The first read must succeed after select()
3728                          * indicates readability, or we've reached
3729                          * a permanent EOF.  http://bugs.ntp.org/1732
3730                          * reported ntpd munching CPU after a USB GPS
3731                          * was unplugged because select was indicating
3732                          * EOF but ntpd didn't remove the descriptor
3733                          * from the activefds set.
3734                          */
3735                         if (buflen < 0 && EAGAIN != errno) {
3736                                 saved_errno = errno;
3737                                 clk = refnumtoa(&rp->srcclock->srcadr);
3738                                 errno = saved_errno;
3739                                 msyslog(LOG_ERR, "%s read: %m", clk);
3740                                 maintain_activefds(fd, TRUE);
3741                         } else if (0 == buflen) {
3742                                 clk = refnumtoa(&rp->srcclock->srcadr);
3743                                 msyslog(LOG_ERR, "%s read EOF", clk);
3744                                 maintain_activefds(fd, TRUE);
3745                         } else {
3746                                 /* drain any remaining refclock input */
3747                                 do {
3748                                         buflen = read_refclock_packet(fd, rp, ts);
3749                                 } while (buflen > 0);
3750                         }
3751                 }
3752         }
3753 #endif /* REFCLOCK */
3754
3755         /*
3756          * Loop through the interfaces looking for data to read.
3757          */
3758         for (ep = ep_list; ep != NULL; ep = ep->elink) {
3759                 for (doing = 0; doing < 2; doing++) {
3760                         if (!doing) {
3761                                 fd = ep->fd;
3762                         } else {
3763                                 if (!(ep->flags & INT_BCASTOPEN))
3764                                         break;
3765                                 fd = ep->bfd;
3766                         }
3767                         if (fd < 0)
3768                                 continue;
3769                         if (FD_ISSET(fd, &fds))
3770                                 do {
3771                                         ++select_count;
3772                                         buflen = read_network_packet(
3773                                                         fd, ep, ts);
3774                                 } while (buflen > 0);
3775                         /* Check more interfaces */
3776                 }
3777         }
3778
3779 #ifdef HAS_ROUTING_SOCKET
3780         /*
3781          * scan list of asyncio readers - currently only used for routing sockets
3782          */
3783         asyncio_reader = asyncio_reader_list;
3784
3785         while (asyncio_reader != NULL) {
3786                 /* callback may unlink and free asyncio_reader */
3787                 next_asyncio_reader = asyncio_reader->link;
3788                 if (FD_ISSET(asyncio_reader->fd, &fds)) {
3789                         ++select_count;
3790                         (*asyncio_reader->receiver)(asyncio_reader);
3791                 }
3792                 asyncio_reader = next_asyncio_reader;
3793         }
3794 #endif /* HAS_ROUTING_SOCKET */
3795
3796         /*
3797          * Check for a response from a blocking child
3798          */
3799         for (idx = 0; idx < blocking_children_alloc; idx++) {
3800                 c = blocking_children[idx];
3801                 if (NULL == c || -1 == c->resp_read_pipe)
3802                         continue;
3803                 if (FD_ISSET(c->resp_read_pipe, &fds)) {
3804                         select_count++;
3805                         process_blocking_resp(c);
3806                 }
3807         }
3808
3809         /*
3810          * Done everything from that select.
3811          * If nothing to do, just return.
3812          * If an error occurred, complain and return.
3813          */
3814         if (select_count == 0) { /* We really had nothing to do */
3815 #ifdef DEBUG
3816                 if (debug)
3817                         msyslog(LOG_DEBUG, "input_handler: select() returned 0");
3818 #endif /* DEBUG */
3819                 goto ih_return;
3820         }
3821         /* We've done our work */
3822 #ifdef DEBUG_TIMING
3823         get_systime(&ts_e);
3824         /*
3825          * (ts_e - ts) is the amount of time we spent
3826          * processing this gob of file descriptors.  Log
3827          * it.
3828          */
3829         L_SUB(&ts_e, &ts);
3830         collect_timing(NULL, "input handler", 1, &ts_e);
3831         if (debug > 3)
3832                 msyslog(LOG_DEBUG,
3833                         "input_handler: Processed a gob of fd's in %s msec",
3834                         lfptoms(&ts_e, 6));
3835 #endif /* DEBUG_TIMING */
3836         /* We're done... */
3837     ih_return:
3838         return;
3839 }
3840 #endif /* !HAVE_IO_COMPLETION_PORT */
3841
3842
3843 /*
3844  * find an interface suitable for the src address
3845  */
3846 endpt *
3847 select_peerinterface(
3848         struct peer *   peer,
3849         sockaddr_u *    srcadr,
3850         endpt *         dstadr
3851         )
3852 {
3853         endpt *ep;
3854 #ifndef SIM
3855         endpt *wild;
3856
3857         wild = ANY_INTERFACE_CHOOSE(srcadr);
3858
3859         /*
3860          * Initialize the peer structure and dance the interface jig.
3861          * Reference clocks step the loopback waltz, the others
3862          * squaredance around the interface list looking for a buddy. If
3863          * the dance peters out, there is always the wildcard interface.
3864          * This might happen in some systems and would preclude proper
3865          * operation with public key cryptography.
3866          */
3867         if (ISREFCLOCKADR(srcadr)) {
3868                 ep = loopback_interface;
3869         } else if (peer->cast_flags &
3870                    (MDF_BCLNT | MDF_ACAST | MDF_MCAST | MDF_BCAST)) {
3871                 ep = findbcastinter(srcadr);
3872                 if (ep != NULL)
3873                         DPRINTF(4, ("Found *-cast interface %s for address %s\n",
3874                                 stoa(&ep->sin), stoa(srcadr)));
3875                 else
3876                         DPRINTF(4, ("No *-cast local address found for address %s\n",
3877                                 stoa(srcadr)));
3878         } else {
3879                 ep = dstadr;
3880                 if (NULL == ep)
3881                         ep = wild;
3882         }
3883         /*
3884          * If it is a multicast address, findbcastinter() may not find
3885          * it.  For unicast, we get to find the interface when dstadr is
3886          * given to us as the wildcard (ANY_INTERFACE_CHOOSE).  Either
3887          * way, try a little harder.
3888          */
3889         if (wild == ep)
3890                 ep = findinterface(srcadr);
3891         /*
3892          * we do not bind to the wildcard interfaces for output
3893          * as our (network) source address would be undefined and
3894          * crypto will not work without knowing the own transmit address
3895          */
3896         if (ep != NULL && INT_WILDCARD & ep->flags)
3897                 if (!accept_wildcard_if_for_winnt)
3898                         ep = NULL;
3899 #else   /* SIM follows */
3900         ep = loopback_interface;
3901 #endif
3902
3903         return ep;
3904 }
3905
3906
3907 /*
3908  * findinterface - find local interface corresponding to address
3909  */
3910 endpt *
3911 findinterface(
3912         sockaddr_u *addr
3913         )
3914 {
3915         endpt *iface;
3916
3917         iface = findlocalinterface(addr, INT_WILDCARD, 0);
3918
3919         if (NULL == iface) {
3920                 DPRINTF(4, ("Found no interface for address %s - returning wildcard\n",
3921                             stoa(addr)));
3922
3923                 iface = ANY_INTERFACE_CHOOSE(addr);
3924         } else
3925                 DPRINTF(4, ("Found interface #%d %s for address %s\n",
3926                             iface->ifnum, iface->name, stoa(addr)));
3927
3928         return iface;
3929 }
3930
3931 /*
3932  * findlocalinterface - find local interface corresponding to addr,
3933  * which does not have any of flags set.  If bast is nonzero, addr is
3934  * a broadcast address.
3935  *
3936  * This code attempts to find the local sending address for an outgoing
3937  * address by connecting a new socket to destinationaddress:NTP_PORT
3938  * and reading the sockname of the resulting connect.
3939  * the complicated sequence simulates the routing table lookup
3940  * for to first hop without duplicating any of the routing logic into
3941  * ntpd. preferably we would have used an API call - but its not there -
3942  * so this is the best we can do here short of duplicating to entire routing
3943  * logic in ntpd which would be a silly and really unportable thing to do.
3944  *
3945  */
3946 static endpt *
3947 findlocalinterface(
3948         sockaddr_u *    addr,
3949         int             flags,
3950         int             bcast
3951         )
3952 {
3953         GETSOCKNAME_SOCKLEN_TYPE        sockaddrlen;
3954         endpt *                         iface;
3955         sockaddr_u                      saddr;
3956         SOCKET                          s;
3957         int                             rtn;
3958         int                             on;
3959
3960         DPRINTF(4, ("Finding interface for addr %s in list of addresses\n",
3961                     stoa(addr)));
3962
3963         s = socket(AF(addr), SOCK_DGRAM, 0);
3964         if (INVALID_SOCKET == s)
3965                 return NULL;
3966
3967         /*
3968          * If we are looking for broadcast interface we need to set this
3969          * socket to allow broadcast
3970          */
3971         if (bcast) {
3972                 on = 1;
3973                 if (SOCKET_ERROR == setsockopt(s, SOL_SOCKET,
3974                                                 SO_BROADCAST,
3975                                                 (char *)&on,
3976                                                 sizeof(on))) {
3977                         closesocket(s);
3978                         return NULL;
3979                 }
3980         }
3981
3982         rtn = connect(s, &addr->sa, SOCKLEN(addr));
3983         if (SOCKET_ERROR == rtn) {
3984                 closesocket(s);
3985                 return NULL;
3986         }
3987
3988         sockaddrlen = sizeof(saddr);
3989         rtn = getsockname(s, &saddr.sa, &sockaddrlen);
3990         closesocket(s);
3991         if (SOCKET_ERROR == rtn)
3992                 return NULL;
3993
3994         DPRINTF(4, ("findlocalinterface: kernel maps %s to %s\n",
3995                     stoa(addr), stoa(&saddr)));
3996
3997         iface = getinterface(&saddr, flags);
3998
3999         /*
4000          * if we didn't find an exact match on saddr, find the closest
4001          * available local address.  This handles the case of the
4002          * address suggested by the kernel being excluded by nic rules
4003          * or the user's -I and -L options to ntpd.
4004          * See http://bugs.ntp.org/1184 and http://bugs.ntp.org/1683
4005          * for more background.
4006          */
4007         if (NULL == iface || iface->ignore_packets)
4008                 iface = findclosestinterface(&saddr,
4009                                              flags | INT_LOOPBACK);
4010
4011         /* Don't use an interface which will ignore replies */
4012         if (iface != NULL && iface->ignore_packets)
4013                 iface = NULL;
4014
4015         return iface;
4016 }
4017
4018
4019 /*
4020  * findclosestinterface
4021  *
4022  * If there are -I/--interface or -L/novirtualips command-line options,
4023  * or "nic" or "interface" rules in ntp.conf, findlocalinterface() may
4024  * find the kernel's preferred local address for a given peer address is
4025  * administratively unavailable to ntpd, and punt to this routine's more
4026  * expensive search.
4027  *
4028  * Find the numerically closest local address to the one connect()
4029  * suggested.  This matches an address on the same subnet first, as
4030  * needed by Bug 1184, and provides a consistent choice if there are
4031  * multiple feasible local addresses, regardless of the order ntpd
4032  * enumerated them.
4033  */
4034 endpt *
4035 findclosestinterface(
4036         sockaddr_u *    addr,
4037         int             flags
4038         )
4039 {
4040         endpt *         ep;
4041         endpt *         winner;
4042         sockaddr_u      addr_dist;
4043         sockaddr_u      min_dist;
4044
4045         ZERO_SOCK(&min_dist);
4046         winner = NULL;
4047
4048         for (ep = ep_list; ep != NULL; ep = ep->elink) {
4049                 if (ep->ignore_packets ||
4050                     AF(addr) != ep->family ||
4051                     flags & ep->flags)
4052                         continue;
4053
4054                 calc_addr_distance(&addr_dist, addr, &ep->sin);
4055                 if (NULL == winner ||
4056                     -1 == cmp_addr_distance(&addr_dist, &min_dist)) {
4057                         min_dist = addr_dist;
4058                         winner = ep;
4059                 }
4060         }
4061         if (NULL == winner)
4062                 DPRINTF(4, ("findclosestinterface(%s) failed\n",
4063                             stoa(addr)));
4064         else
4065                 DPRINTF(4, ("findclosestinterface(%s) -> %s\n",
4066                             stoa(addr), stoa(&winner->sin)));
4067
4068         return winner;
4069 }
4070
4071
4072 /*
4073  * calc_addr_distance - calculate the distance between two addresses,
4074  *                      the absolute value of the difference between
4075  *                      the addresses numerically, stored as an address.
4076  */
4077 static void
4078 calc_addr_distance(
4079         sockaddr_u *            dist,
4080         const sockaddr_u *      a1,
4081         const sockaddr_u *      a2
4082         )
4083 {
4084         u_int32 a1val;
4085         u_int32 a2val;
4086         u_int32 v4dist;
4087         int     found_greater;
4088         int     a1_greater;
4089         int     i;
4090
4091         NTP_REQUIRE(AF(a1) == AF(a2));
4092
4093         ZERO_SOCK(dist);
4094         AF(dist) = AF(a1);
4095
4096         /* v4 can be done a bit simpler */
4097         if (IS_IPV4(a1)) {
4098                 a1val = SRCADR(a1);
4099                 a2val = SRCADR(a2);
4100                 v4dist = (a1val > a2val)
4101                              ? a1val - a2val
4102                              : a2val - a1val;
4103                 SET_ADDR4(dist, v4dist);
4104
4105                 return;
4106         }
4107
4108         found_greater = FALSE;
4109         a1_greater = FALSE;     /* suppress pot. uninit. warning */
4110         for (i = 0; i < (int)sizeof(NSRCADR6(a1)); i++) {
4111                 if (!found_greater &&
4112                     NSRCADR6(a1)[i] != NSRCADR6(a2)[i]) {
4113                         found_greater = TRUE;
4114                         a1_greater = (NSRCADR6(a1)[i] > NSRCADR6(a2)[i]);
4115                 }
4116                 if (!found_greater) {
4117                         NSRCADR6(dist)[i] = 0;
4118                 } else {
4119                         if (a1_greater)
4120                                 NSRCADR6(dist)[i] = NSRCADR6(a1)[i] -
4121                                                     NSRCADR6(a2)[i];
4122                         else
4123                                 NSRCADR6(dist)[i] = NSRCADR6(a2)[i] -
4124                                                     NSRCADR6(a1)[i];
4125                 }
4126         }
4127 }
4128
4129
4130 /*
4131  * cmp_addr_distance - compare two address distances, returning -1, 0,
4132  *                     1 to indicate their relationship.
4133  */
4134 static int
4135 cmp_addr_distance(
4136         const sockaddr_u *      d1,
4137         const sockaddr_u *      d2
4138         )
4139 {
4140         int     i;
4141
4142         NTP_REQUIRE(AF(d1) == AF(d2));
4143
4144         if (IS_IPV4(d1)) {
4145                 if (SRCADR(d1) < SRCADR(d2))
4146                         return -1;
4147                 else if (SRCADR(d1) == SRCADR(d2))
4148                         return 0;
4149                 else
4150                         return 1;
4151         }
4152
4153         for (i = 0; i < (int)sizeof(NSRCADR6(d1)); i++) {
4154                 if (NSRCADR6(d1)[i] < NSRCADR6(d2)[i])
4155                         return -1;
4156                 else if (NSRCADR6(d1)[i] > NSRCADR6(d2)[i])
4157                         return 1;
4158         }
4159
4160         return 0;
4161 }
4162
4163
4164
4165 /*
4166  * fetch an interface structure the matches the
4167  * address and has the given flags NOT set
4168  */
4169 endpt *
4170 getinterface(
4171         sockaddr_u *    addr,
4172         u_int32         flags
4173         )
4174 {
4175         endpt *iface;
4176
4177         iface = find_addr_in_list(addr);
4178
4179         if (iface != NULL && (iface->flags & flags))
4180                 iface = NULL;
4181
4182         return iface;
4183 }
4184
4185
4186 /*
4187  * findbcastinter - find broadcast interface corresponding to address
4188  */
4189 endpt *
4190 findbcastinter(
4191         sockaddr_u *addr
4192         )
4193 {
4194         endpt * iface;
4195
4196         iface = NULL;
4197 #if !defined(MPE) && (defined(SIOCGIFCONF) || defined(SYS_WINNT))
4198         DPRINTF(4, ("Finding broadcast/multicast interface for addr %s in list of addresses\n",
4199                     stoa(addr)));
4200
4201         iface = findlocalinterface(addr, INT_LOOPBACK | INT_WILDCARD,
4202                                    1);
4203         if (iface != NULL) {
4204                 DPRINTF(4, ("Easily found bcast-/mcast- interface index #%d %s\n",
4205                             iface->ifnum, iface->name));
4206                 return iface;
4207         }
4208
4209         /*
4210          * plan B - try to find something reasonable in our lists in
4211          * case kernel lookup doesn't help
4212          */
4213         for (iface = ep_list; iface != NULL; iface = iface->elink) {
4214                 if (iface->flags & INT_WILDCARD)
4215                         continue;
4216
4217                 /* Don't bother with ignored interfaces */
4218                 if (iface->ignore_packets)
4219                         continue;
4220
4221                 /*
4222                  * First look if this is the correct family
4223                  */
4224                 if(AF(&iface->sin) != AF(addr))
4225                         continue;
4226
4227                 /* Skip the loopback addresses */
4228                 if (iface->flags & INT_LOOPBACK)
4229                         continue;
4230
4231                 /*
4232                  * If we are looking to match a multicast address and
4233                  * this interface is one...
4234                  */
4235                 if (addr_ismulticast(addr)
4236                     && (iface->flags & INT_MULTICAST)) {
4237 #ifdef INCLUDE_IPV6_SUPPORT
4238                         /*
4239                          * ...it is the winner unless we're looking for
4240                          * an interface to use for link-local multicast
4241                          * and its address is not link-local.
4242                          */
4243                         if (IS_IPV6(addr)
4244                             && IN6_IS_ADDR_MC_LINKLOCAL(PSOCK_ADDR6(addr))
4245                             && !IN6_IS_ADDR_LINKLOCAL(PSOCK_ADDR6(&iface->sin)))
4246                                 continue;
4247 #endif
4248                         break;
4249                 }
4250
4251                 /*
4252                  * We match only those interfaces marked as
4253                  * broadcastable and either the explicit broadcast
4254                  * address or the network portion of the IP address.
4255                  * Sloppy.
4256                  */
4257                 if (IS_IPV4(addr)) {
4258                         if (SOCK_EQ(&iface->bcast, addr))
4259                                 break;
4260
4261                         if ((NSRCADR(&iface->sin) & NSRCADR(&iface->mask))
4262                             == (NSRCADR(addr)     & NSRCADR(&iface->mask)))
4263                                 break;
4264                 }
4265 #ifdef INCLUDE_IPV6_SUPPORT
4266                 else if (IS_IPV6(addr)) {
4267                         if (SOCK_EQ(&iface->bcast, addr))
4268                                 break;
4269
4270                         if (SOCK_EQ(netof(&iface->sin), netof(addr)))
4271                                 break;
4272                 }
4273 #endif
4274         }
4275 #endif /* SIOCGIFCONF */
4276         if (NULL == iface) {
4277                 DPRINTF(4, ("No bcast interface found for %s\n",
4278                             stoa(addr)));
4279                 iface = ANY_INTERFACE_CHOOSE(addr);
4280         } else {
4281                 DPRINTF(4, ("Found bcast-/mcast- interface index #%d %s\n",
4282                             iface->ifnum, iface->name));
4283         }
4284
4285         return iface;
4286 }
4287
4288
4289 /*
4290  * io_clr_stats - clear I/O module statistics
4291  */
4292 void
4293 io_clr_stats(void)
4294 {
4295         packets_dropped = 0;
4296         packets_ignored = 0;
4297         packets_received = 0;
4298         packets_sent = 0;
4299         packets_notsent = 0;
4300
4301         handler_calls = 0;
4302         handler_pkts = 0;
4303         io_timereset = current_time;
4304 }
4305
4306
4307 #ifdef REFCLOCK
4308 /*
4309  * io_addclock - add a reference clock to the list and arrange that we
4310  *                               get SIGIO interrupts from it.
4311  */
4312 int
4313 io_addclock(
4314         struct refclockio *rio
4315         )
4316 {
4317         BLOCKIO();
4318
4319         /*
4320          * Stuff the I/O structure in the list and mark the descriptor
4321          * in use.  There is a harmless (I hope) race condition here.
4322          */
4323         rio->active = TRUE;
4324
4325 # ifdef HAVE_SIGNALED_IO
4326         if (init_clock_sig(rio)) {
4327                 UNBLOCKIO();
4328                 return 0;
4329         }
4330 # elif defined(HAVE_IO_COMPLETION_PORT)
4331         if (io_completion_port_add_clock_io(rio)) {
4332                 UNBLOCKIO();
4333                 return 0;
4334         }
4335 # endif
4336
4337         /*
4338          * enqueue
4339          */
4340         LINK_SLIST(refio, rio, next);
4341
4342         /*
4343          * register fd
4344          */
4345         add_fd_to_list(rio->fd, FD_TYPE_FILE);
4346
4347         UNBLOCKIO();
4348         return 1;
4349 }
4350
4351
4352 /*
4353  * io_closeclock - close the clock in the I/O structure given
4354  */
4355 void
4356 io_closeclock(
4357         struct refclockio *rio
4358         )
4359 {
4360         struct refclockio *unlinked;
4361
4362         BLOCKIO();
4363
4364         /*
4365          * Remove structure from the list
4366          */
4367         rio->active = FALSE;
4368         UNLINK_SLIST(unlinked, refio, rio, next, struct refclockio);
4369         if (NULL != unlinked) {
4370                 purge_recv_buffers_for_fd(rio->fd);
4371                 /*
4372                  * Close the descriptor.
4373                  */
4374                 close_and_delete_fd_from_list(rio->fd);
4375         }
4376         rio->fd = -1;
4377
4378         UNBLOCKIO();
4379 }
4380 #endif  /* REFCLOCK */
4381
4382
4383 /*
4384  * On NT a SOCKET is an unsigned int so we cannot possibly keep it in
4385  * an array. So we use one of the ISC_LIST functions to hold the
4386  * socket value and use that when we want to enumerate it.
4387  *
4388  * This routine is called by the forked intres child process to close
4389  * all open sockets.  On Windows there's no need as intres runs in
4390  * the same process as a thread.
4391  */
4392 #ifndef SYS_WINNT
4393 void
4394 kill_asyncio(
4395         int     startfd
4396         )
4397 {
4398         BLOCKIO();
4399
4400         /*
4401          * In the child process we do not maintain activefds and
4402          * maxactivefd.  Zeroing maxactivefd disables code which
4403          * maintains it in close_and_delete_fd_from_list().
4404          */
4405         maxactivefd = 0;
4406
4407         while (fd_list != NULL)
4408                 close_and_delete_fd_from_list(fd_list->fd);
4409
4410         UNBLOCKIO();
4411 }
4412 #endif  /* !SYS_WINNT */
4413
4414
4415 /*
4416  * Add and delete functions for the list of open sockets
4417  */
4418 static void
4419 add_fd_to_list(
4420         SOCKET fd,
4421         enum desc_type type
4422         )
4423 {
4424         vsock_t *lsock = emalloc(sizeof(*lsock));
4425
4426         lsock->fd = fd;
4427         lsock->type = type;
4428
4429         LINK_SLIST(fd_list, lsock, link);
4430         maintain_activefds(fd, 0);
4431 }
4432
4433
4434 static void
4435 close_and_delete_fd_from_list(
4436         SOCKET fd
4437         )
4438 {
4439         vsock_t *lsock;
4440
4441         UNLINK_EXPR_SLIST(lsock, fd_list, fd ==
4442             UNLINK_EXPR_SLIST_CURRENT()->fd, link, vsock_t);
4443
4444         if (NULL == lsock)
4445                 return;
4446
4447         switch (lsock->type) {
4448
4449         case FD_TYPE_SOCKET:
4450                 closesocket(lsock->fd);
4451                 break;
4452
4453         case FD_TYPE_FILE:
4454                 closeserial(lsock->fd);
4455                 break;
4456
4457         default:
4458                 msyslog(LOG_ERR,
4459                         "internal error - illegal descriptor type %d - EXITING",
4460                         (int)lsock->type);
4461                 exit(1);
4462         }
4463
4464         free(lsock);
4465         /*
4466          * remove from activefds
4467          */
4468         maintain_activefds(fd, 1);
4469 }
4470
4471
4472 static void
4473 add_addr_to_list(
4474         sockaddr_u *    addr,
4475         endpt *         ep
4476         )
4477 {
4478         remaddr_t *laddr;
4479
4480 #ifdef DEBUG
4481         if (find_addr_in_list(addr) == NULL) {
4482 #endif
4483                 /* not there yet - add to list */
4484                 laddr = emalloc(sizeof(*laddr));
4485                 laddr->addr = *addr;
4486                 laddr->ep = ep;
4487
4488                 LINK_SLIST(remoteaddr_list, laddr, link);
4489
4490                 DPRINTF(4, ("Added addr %s to list of addresses\n",
4491                             stoa(addr)));
4492 #ifdef DEBUG
4493         } else
4494                 DPRINTF(4, ("WARNING: Attempt to add duplicate addr %s to address list\n",
4495                             stoa(addr)));
4496 #endif
4497 }
4498
4499
4500 static void
4501 delete_addr_from_list(
4502         sockaddr_u *addr
4503         )
4504 {
4505         remaddr_t *unlinked;
4506
4507         UNLINK_EXPR_SLIST(unlinked, remoteaddr_list, SOCK_EQ(addr,
4508                 &(UNLINK_EXPR_SLIST_CURRENT()->addr)), link, remaddr_t);
4509
4510         if (unlinked != NULL) {
4511                 DPRINTF(4, ("Deleted addr %s from list of addresses\n",
4512                         stoa(addr)));
4513                 free(unlinked);
4514         }
4515 }
4516
4517
4518 static void
4519 delete_interface_from_list(
4520         endpt *iface
4521         )
4522 {
4523         remaddr_t *unlinked;
4524
4525         for (;;) {
4526                 UNLINK_EXPR_SLIST(unlinked, remoteaddr_list, iface ==
4527                     UNLINK_EXPR_SLIST_CURRENT()->ep, link,
4528                     remaddr_t);
4529
4530                 if (unlinked == NULL)
4531                         break;
4532                 DPRINTF(4, ("Deleted addr %s for interface #%d %s from list of addresses\n",
4533                             stoa(&unlinked->addr), iface->ifnum,
4534                             iface->name));
4535                 free(unlinked);
4536         }
4537 }
4538
4539
4540 static struct interface *
4541 find_addr_in_list(
4542         sockaddr_u *addr
4543         )
4544 {
4545         remaddr_t *entry;
4546
4547         DPRINTF(4, ("Searching for addr %s in list of addresses - ",
4548                     stoa(addr)));
4549
4550         for (entry = remoteaddr_list;
4551              entry != NULL;
4552              entry = entry->link)
4553                 if (SOCK_EQ(&entry->addr, addr)) {
4554                         DPRINTF(4, ("FOUND\n"));
4555                         return entry->ep;
4556                 }
4557
4558         DPRINTF(4, ("NOT FOUND\n"));
4559         return NULL;
4560 }
4561
4562
4563 /*
4564  * Find the given address with the all given flags set in the list
4565  */
4566 static endpt *
4567 find_flagged_addr_in_list(
4568         sockaddr_u *    addr,
4569         u_int32         flags
4570         )
4571 {
4572         remaddr_t *entry;
4573
4574         DPRINTF(4, ("Finding addr %s with flags %d in list: ",
4575                     stoa(addr), flags));
4576
4577         for (entry = remoteaddr_list;
4578              entry != NULL;
4579              entry = entry->link)
4580
4581                 if (SOCK_EQ(&entry->addr, addr)
4582                     && (entry->ep->flags & flags) == flags) {
4583
4584                         DPRINTF(4, ("FOUND\n"));
4585                         return entry->ep;
4586                 }
4587
4588         DPRINTF(4, ("NOT FOUND\n"));
4589         return NULL;
4590 }
4591
4592
4593 const char *
4594 localaddrtoa(
4595         endpt *la
4596         )
4597 {
4598         return (NULL == la)
4599                    ? "<null>"
4600                    : stoa(&la->sin);
4601 }
4602
4603
4604 #ifdef HAS_ROUTING_SOCKET
4605 # ifndef UPDATE_GRACE
4606 #  define UPDATE_GRACE  2       /* wait UPDATE_GRACE seconds before scanning */
4607 # endif
4608
4609 static void
4610 process_routing_msgs(struct asyncio_reader *reader)
4611 {
4612         char buffer[5120];
4613         int cnt, msg_type;
4614 #ifdef HAVE_RTNETLINK
4615         struct nlmsghdr *nh;
4616 #else
4617         struct rt_msghdr rtm;
4618         char *p;
4619 #endif
4620
4621         if (disable_dynamic_updates) {
4622                 /*
4623                  * discard ourselves if we are not needed any more
4624                  * usually happens when running unprivileged
4625                  */
4626                 remove_asyncio_reader(reader);
4627                 delete_asyncio_reader(reader);
4628                 return;
4629         }
4630
4631         cnt = read(reader->fd, buffer, sizeof(buffer));
4632
4633         if (cnt < 0) {
4634                 msyslog(LOG_ERR,
4635                         "i/o error on routing socket %m - disabling");
4636                 remove_asyncio_reader(reader);
4637                 delete_asyncio_reader(reader);
4638                 return;
4639         }
4640
4641         /*
4642          * process routing message
4643          */
4644 #ifdef HAVE_RTNETLINK
4645         for (nh = (struct nlmsghdr *)buffer;
4646              NLMSG_OK(nh, cnt);
4647              nh = NLMSG_NEXT(nh, cnt)) {
4648                 msg_type = nh->nlmsg_type;
4649 #else
4650         for (p = buffer;
4651              (p + sizeof(struct rt_msghdr)) <= (buffer + cnt);
4652              p += rtm.rtm_msglen) {
4653                 memcpy(&rtm, p, sizeof(rtm));
4654                 if (rtm.rtm_version != RTM_VERSION) {
4655                         msyslog(LOG_ERR,
4656                                 "version mismatch (got %d - expected %d) on routing socket - disabling",
4657                                 rtm.rtm_version, RTM_VERSION);
4658
4659                         remove_asyncio_reader(reader);
4660                         delete_asyncio_reader(reader);
4661                         return;
4662                 }
4663                 msg_type = rtm.rtm_type;
4664 #endif
4665                 switch (msg_type) {
4666 #ifdef RTM_NEWADDR
4667                 case RTM_NEWADDR:
4668 #endif
4669 #ifdef RTM_DELADDR
4670                 case RTM_DELADDR:
4671 #endif
4672 #ifdef RTM_ADD
4673                 case RTM_ADD:
4674 #endif
4675 #ifdef RTM_DELETE
4676                 case RTM_DELETE:
4677 #endif
4678 #ifdef RTM_REDIRECT
4679                 case RTM_REDIRECT:
4680 #endif
4681 #ifdef RTM_CHANGE
4682                 case RTM_CHANGE:
4683 #endif
4684 #ifdef RTM_LOSING
4685                 case RTM_LOSING:
4686 #endif
4687 #ifdef RTM_IFINFO
4688                 case RTM_IFINFO:
4689 #endif
4690 #ifdef RTM_IFANNOUNCE
4691                 case RTM_IFANNOUNCE:
4692 #endif
4693 #ifdef RTM_NEWLINK
4694                 case RTM_NEWLINK:
4695 #endif
4696 #ifdef RTM_DELLINK
4697                 case RTM_DELLINK:
4698 #endif
4699 #ifdef RTM_NEWROUTE
4700                 case RTM_NEWROUTE:
4701 #endif
4702 #ifdef RTM_DELROUTE
4703                 case RTM_DELROUTE:
4704 #endif
4705                         /*
4706                          * we are keen on new and deleted addresses and
4707                          * if an interface goes up and down or routing
4708                          * changes
4709                          */
4710                         DPRINTF(3, ("routing message op = %d: scheduling interface update\n",
4711                                     msg_type));
4712                         timer_interfacetimeout(current_time + UPDATE_GRACE);
4713                         break;
4714 #ifdef HAVE_RTNETLINK
4715                 case NLMSG_DONE:
4716                         /* end of multipart message */
4717                         return;
4718 #endif
4719                 default:
4720                         /*
4721                          * the rest doesn't bother us.
4722                          */
4723                         DPRINTF(4, ("routing message op = %d: ignored\n",
4724                                     msg_type));
4725                         break;
4726                 }
4727         }
4728 }
4729
4730 /*
4731  * set up routing notifications
4732  */
4733 static void
4734 init_async_notifications()
4735 {
4736         struct asyncio_reader *reader;
4737 #ifdef HAVE_RTNETLINK
4738         int fd = socket(PF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
4739         struct sockaddr_nl sa;
4740 #else
4741         int fd = socket(PF_ROUTE, SOCK_RAW, 0);
4742 #endif
4743         if (fd < 0) {
4744                 msyslog(LOG_ERR,
4745                         "unable to open routing socket (%m) - using polled interface update");
4746                 return;
4747         }
4748
4749         fd = move_fd(fd);
4750 #ifdef HAVE_RTNETLINK
4751         ZERO(sa);
4752         sa.nl_family = PF_NETLINK;
4753         sa.nl_groups = RTMGRP_LINK | RTMGRP_IPV4_IFADDR
4754                        | RTMGRP_IPV6_IFADDR | RTMGRP_IPV4_ROUTE
4755                        | RTMGRP_IPV4_MROUTE | RTMGRP_IPV6_ROUTE
4756                        | RTMGRP_IPV6_MROUTE;
4757         if (bind(fd, (struct sockaddr *)&sa, sizeof(sa)) < 0) {
4758                 msyslog(LOG_ERR,
4759                         "bind failed on routing socket (%m) - using polled interface update");
4760                 return;
4761         }
4762 #endif
4763         make_socket_nonblocking(fd);
4764 #if defined(HAVE_SIGNALED_IO)
4765         init_socket_sig(fd);
4766 #endif /* HAVE_SIGNALED_IO */
4767
4768         reader = new_asyncio_reader();
4769
4770         reader->fd = fd;
4771         reader->receiver = process_routing_msgs;
4772
4773         add_asyncio_reader(reader, FD_TYPE_SOCKET);
4774         msyslog(LOG_INFO,
4775                 "Listening on routing socket on fd #%d for interface updates",
4776                 fd);
4777 }
4778 #else
4779 /* HAS_ROUTING_SOCKET not defined */
4780 static void
4781 init_async_notifications(void)
4782 {
4783 }
4784 #endif
4785