MFC r335595-r335596

r335595:
Modernize usage of "restrict" keyword in ntp.conf

It is no longer necessary to specify a -4/-6 flag on any ntp.conf
keyword. The address type is inferred from the address itself as
necessary. "restrict default" statements always apply to both address
families regardless of any -4/-6 flag that may be present.

So this change just tidies up our default config by removing the redundant
restrict -6 statement and comment, and by removing the -6 flag from the
restrict keyword that allows access from localhost.

This change was inspired by the patches provided in PRs 201803 and 210245,
and included some contrib/ntp code inspection to verify that the -4/-6
keywords are basically no-ops in all contexts now.

PR: 201803 210245
Differential Revision: https://reviews.freebsd.org/D15974

r335596:
Fix a comment; the ntp leaplist file is updated periodically, but not weekly
(it's only updated when a check shows it's within 30 days of expiring).

PR: 207138

MFC r311103 (ian):

Update ntp.conf to use the ntpd pool feature.

Our previous ntp.conf file configured 3 servers from freebsd.pool.ntp.org
using 3 separate 'server' config lines. That is now replaced with a single
'pool' line which causes ntpd to add multiple servers from the pool.

More than just making the config smaller, the pool feature in ntpd has one
major advantage over configuring 3 separate servers from a pool: if a server
that was added using a 'pool' statement provides bad time (initially or at
some later date), ntpd automatically discards it and configures a new
different server from the pool without needing to be restarted.

These changes also add a 'tos' line to control how many pool servers get
added, a 'restrict source' line that is required to allow ntpd to add new
peers from the pool, and it deletes a 'restrict 127.127.1.0' line that does
nothing and should never have been there (127.127.1.0 is not a valid IP
address, it's a refclock identifier).

Reviewed by: cy
MFC requested by: ache
Differential Revision: https://reviews.freebsd.org/D9011

MFC r289421, r293037, r294773, and r294884.

ntp leap-leapseconds support.

r289421:

Add default leap-seconds file. This should help ntp networks get the
leap second date correct

Updates to the file can be obtained from ftp://time.nist.gov/pub/ or
ftp://tycho.usno.navy.mil/pub/ntp/.

r293037:

Update leap-seconds to latest. This will satisfy the ntpd leap-second
version check.

r294773:

Add support for automatic leap-second file updates.

The working copy of leapfile resides in /var/dbntpd.leap-seconds.list.
/etc/ntp/leap-seconds (periodically updated from ftp://time.nist.gov/pub/
or ftp://tycho.usno.navy.mil/pub/ntp/) contains the master copy should
automatic leapfile updates be disabled (default).

Automatic leapfile updates are fetched from $ntp_leapfile_sources,
defaulting to https://www.ietf.org/timezones/data/leap-seconds.list,
within $ntp_leapfile_expiry_days (default 30 days) from leap-seconds
file expiry. Automatic updates can be enabled by setting
$daily_ntpd_leapfile_enable="YES" in periodic.conf. To avoid congesting
the ntp leapfile source the automatic update randomized by default but
can be disabled through daily_ntpd_avoid_congestion="NO" in
periodic.conf.

r294884:

Allow specification of fetch options for ntp leap-seconds fetch.

Approved by: re (gjb)

MFC r280849,280915-280916,281015-281016,282097,282408,282415,283542,
284864,285169-285170,285435:

ntp 4.2.8p3.

Relnotes: yes
Approved by: re (?)

MFC r259973:

Tighten default restrictions for ntpd(8) server and provide a link
to NTP access restriction documentation.

MFC r280849,280915-280916,281015-281016,282097,282408,282415,283542,
284864,285169-285170,285435:

ntp 4.2.8p3.

Relnotes: yes
Approved by: re (?)

MFC r259973:

Tighten default restrictions for ntpd(8) server and provide a link
to NTP access restriction documentation.