1/*
2 * ntp_leapsec.c - leap second processing for NTPD
3 *
4 * Written by Juergen Perlinger (perlinger@ntp.org) for the NTP project.
5 * The contents of 'html/copyright.html' apply.
6 * ----------------------------------------------------------------------
7 * This is an attempt to get the leap second handling into a dedicated
8 * module to make the somewhat convoluted logic testable.
9 */
10
11#include <config.h>
12#include <sys/types.h>
13#include <sys/stat.h>
14#include <ctype.h>
15
16#include "ntp_types.h"
17#include "ntp_fp.h"
18#include "ntp_stdlib.h"
19#include "ntp_calendar.h"
20#include "ntp_leapsec.h"
21#include "ntp.h"
22#include "vint64ops.h"
23#include "lib_strbuf.h"
24
25#include "isc/sha1.h"
26
27static const char * const logPrefix = "leapsecond file";
28
29/* ---------------------------------------------------------------------
30 * GCC is rather sticky with its 'const' attribute. We have to do it more
31 * explicit than with a cast if we want to get rid of a CONST qualifier.
32 * Greetings from the PASCAL world, where casting was only possible via
33 * untagged unions...
34 */
35static inline void*
36noconst(
37	const void* ptr
38	)
39{
40	union {
41		const void * cp;
42		void *       vp;
43	} tmp;
44	tmp.cp = ptr;
45	return tmp.vp;
46}
47
48/* ---------------------------------------------------------------------
49 * Our internal data structure
50 */
51#define MAX_HIST 10	/* history of leap seconds */
52
53struct leap_info {
54	vint64   ttime;	/* transition time (after the step, ntp scale) */
55	uint32_t stime;	/* schedule limit (a month before transition)  */
56	int16_t  taiof;	/* TAI offset on and after the transition      */
57	uint8_t  dynls; /* dynamic: inserted on peer/clock request     */
58};
59typedef struct leap_info leap_info_t;
60
61struct leap_head {
62	vint64   update; /* time of information update                 */
63	vint64   expire; /* table expiration time                      */
64	uint16_t size;	 /* number of infos in table	               */
65	int16_t  base_tai;	/* total leaps before first entry      */
66	int16_t  this_tai;	/* current TAI offset	               */
67	int16_t  next_tai;	/* TAI offset after 'when'             */
68	vint64   dtime;	 /* due time (current era end)                 */
69	vint64   ttime;	 /* nominal transition time (next era start)   */
70	vint64   stime;	 /* schedule time (when we take notice)        */
71	vint64   ebase;	 /* base time of this leap era                 */
72	uint8_t  dynls;	 /* next leap is dynamic (by peer request)     */
73};
74typedef struct leap_head leap_head_t;
75
76struct leap_table {
77	leap_signature_t lsig;
78	leap_head_t	 head;
79	leap_info_t  	 info[MAX_HIST];
80};
81
82/* Where we store our tables */
83static leap_table_t _ltab[2], *_lptr;
84static int/*BOOL*/  _electric;
85
86/* Forward decls of local helpers */
87static int    add_range(leap_table_t*, const leap_info_t*);
88static char * get_line(leapsec_reader, void*, char*, size_t);
89static char * skipws(const char*);
90static int    parsefail(const char * cp, const char * ep);
91static void   reload_limits(leap_table_t*, const vint64*);
92static void   fetch_leap_era(leap_era_t*, const leap_table_t*,
93			     const vint64*);
94static int    betweenu32(uint32_t, uint32_t, uint32_t);
95static void   reset_times(leap_table_t*);
96static int    leapsec_add(leap_table_t*, const vint64*, int);
97static int    leapsec_raw(leap_table_t*, const vint64 *, int, int);
98static const char * lstostr(const vint64 * ts);
99
100/* =====================================================================
101 * Get & Set the current leap table
102 */
103
104/* ------------------------------------------------------------------ */
105leap_table_t *
106leapsec_get_table(
107	int alternate)
108{
109	leap_table_t *p1, *p2;
110
111	p1 = _lptr;
112	if (p1 == &_ltab[0]) {
113		p2 = &_ltab[1];
114	} else if (p1 == &_ltab[1]) {
115		p2 = &_ltab[0];
116	} else {
117		p1 = &_ltab[0];
118		p2 = &_ltab[1];
119		reset_times(p1);
120		reset_times(p2);
121		_lptr = p1;
122	}
123	if (alternate) {
124		memcpy(p2, p1, sizeof(leap_table_t));
125		p1 = p2;
126	}
127
128	return p1;
129}
130
131/* ------------------------------------------------------------------ */
132int/*BOOL*/
133leapsec_set_table(
134	leap_table_t * pt)
135{
136	if (pt == &_ltab[0] || pt == &_ltab[1])
137		_lptr = pt;
138	return _lptr == pt;
139}
140
141/* ------------------------------------------------------------------ */
142int/*BOOL*/
143leapsec_electric(
144	int/*BOOL*/ on)
145{
146	int res = _electric;
147	if (on < 0)
148		return res;
149
150	_electric = (on != 0);
151	if (_electric == res)
152		return res;
153
154	if (_lptr == &_ltab[0] || _lptr == &_ltab[1])
155		reset_times(_lptr);
156
157	return res;
158}
159
160/* =====================================================================
161 * API functions that operate on tables
162 */
163
164/* ---------------------------------------------------------------------
165 * Clear all leap second data. Use it for init & cleanup
166 */
167void
168leapsec_clear(
169	leap_table_t * pt)
170{
171	memset(&pt->lsig, 0, sizeof(pt->lsig));
172	memset(&pt->head, 0, sizeof(pt->head));
173	reset_times(pt);
174}
175
176/* ---------------------------------------------------------------------
177 * Load a leap second file and check expiration on the go
178 */
179int/*BOOL*/
180leapsec_load(
181	leap_table_t * pt  ,
182	leapsec_reader func,
183	void *         farg,
184	int            use_build_limit)
185{
186	char   *cp, *ep, linebuf[50];
187	vint64 ttime, limit;
188	long   taiof;
189	struct calendar build;
190
191	leapsec_clear(pt);
192	if (use_build_limit && ntpcal_get_build_date(&build)) {
193		/* don't prune everything -- permit the last 10yrs
194		 * before build.
195		 */
196		build.year -= 10;
197		limit = ntpcal_date_to_ntp64(&build);
198	} else {
199		memset(&limit, 0, sizeof(limit));
200	}
201
202	while (get_line(func, farg, linebuf, sizeof(linebuf))) {
203		cp = linebuf;
204		if (*cp == '#') {
205			cp++;
206			if (*cp == '@') {
207				cp = skipws(cp+1);
208				pt->head.expire = strtouv64(cp, &ep, 10);
209				if (parsefail(cp, ep))
210					goto fail_read;
211				pt->lsig.etime = pt->head.expire.D_s.lo;
212			} else if (*cp == '$') {
213				cp = skipws(cp+1);
214				pt->head.update = strtouv64(cp, &ep, 10);
215				if (parsefail(cp, ep))
216					goto fail_read;
217			}
218		} else if (isdigit((u_char)*cp)) {
219			ttime = strtouv64(cp, &ep, 10);
220			if (parsefail(cp, ep))
221				goto fail_read;
222			cp = skipws(ep);
223			taiof = strtol(cp, &ep, 10);
224			if (   parsefail(cp, ep)
225			    || taiof > SHRT_MAX || taiof < SHRT_MIN)
226				goto fail_read;
227			if (ucmpv64(&ttime, &limit) >= 0) {
228				if (!leapsec_raw(pt, &ttime,
229						 taiof, FALSE))
230					goto fail_insn;
231			} else {
232				pt->head.base_tai = (int16_t)taiof;
233			}
234			pt->lsig.ttime = ttime.D_s.lo;
235			pt->lsig.taiof = (int16_t)taiof;
236		}
237	}
238	return TRUE;
239
240fail_read:
241	errno = EILSEQ;
242fail_insn:
243	leapsec_clear(pt);
244	return FALSE;
245}
246
247/* ---------------------------------------------------------------------
248 * Dump a table in human-readable format. Use 'fprintf' and a FILE
249 * pointer if you want to get it printed into a stream.
250 */
251void
252leapsec_dump(
253	const leap_table_t * pt  ,
254	leapsec_dumper       func,
255	void *               farg)
256{
257	int             idx;
258	vint64          ts;
259	struct calendar atb, ttb;
260
261	ntpcal_ntp64_to_date(&ttb, &pt->head.expire);
262	(*func)(farg, "leap table (%u entries) expires at %04u-%02u-%02u:\n",
263		pt->head.size,
264		ttb.year, ttb.month, ttb.monthday);
265	idx = pt->head.size;
266	while (idx-- != 0) {
267		ts = pt->info[idx].ttime;
268		ntpcal_ntp64_to_date(&ttb, &ts);
269		ts = subv64u32(&ts, pt->info[idx].stime);
270		ntpcal_ntp64_to_date(&atb, &ts);
271
272		(*func)(farg, "%04u-%02u-%02u [%c] (%04u-%02u-%02u) - %d\n",
273			ttb.year, ttb.month, ttb.monthday,
274			"-*"[pt->info[idx].dynls != 0],
275			atb.year, atb.month, atb.monthday,
276			pt->info[idx].taiof);
277	}
278}
279
280/* =====================================================================
281 * usecase driven API functions
282 */
283
284int/*BOOL*/
285leapsec_query(
286	leap_result_t * qr   ,
287	uint32_t        ts32 ,
288	const time_t *  pivot)
289{
290	leap_table_t *   pt;
291	vint64           ts64, last, next;
292	uint32_t         due32;
293	int              fired;
294
295	/* preset things we use later on... */
296	fired = FALSE;
297	ts64  = ntpcal_ntp_to_ntp(ts32, pivot);
298	pt    = leapsec_get_table(FALSE);
299	memset(qr, 0, sizeof(leap_result_t));
300
301	if (ucmpv64(&ts64, &pt->head.ebase) < 0) {
302		/* Most likely after leap frame reset. Could also be a
303		 * backstep of the system clock. Anyway, get the new
304		 * leap era frame.
305		 */
306		reload_limits(pt, &ts64);
307	} else if (ucmpv64(&ts64, &pt->head.dtime) >= 0) {
308		/* Boundary crossed in forward direction. This might
309		 * indicate a leap transition, so we prepare for that
310		 * case.
311		 *
312		 * Some operations below are actually NOPs in electric
313		 * mode, but having only one code path that works for
314		 * both modes is easier to maintain.
315		 *
316		 * There's another quirk we must keep looking out for:
317		 * If we just stepped the clock, the step might have
318		 * crossed a leap boundary. As with backward steps, we
319		 * do not want to raise the 'fired' event in that case.
320		 * So we raise the 'fired' event only if we're close to
321		 * the transition and just reload the limits otherwise.
322		 */
323		last = addv64i32(&pt->head.dtime, 3); /* get boundary */
324		if (ucmpv64(&ts64, &last) >= 0) {
325			/* that was likely a query after a step */
326			reload_limits(pt, &ts64);
327		} else {
328			/* close enough for deeper examination */
329			last = pt->head.ttime;
330			qr->warped = (int16_t)(last.D_s.lo -
331					       pt->head.dtime.D_s.lo);
332			next = addv64i32(&ts64, qr->warped);
333			reload_limits(pt, &next);
334			fired = ucmpv64(&pt->head.ebase, &last) == 0;
335			if (fired) {
336				ts64 = next;
337				ts32 = next.D_s.lo;
338			} else {
339				qr->warped = 0;
340			}
341		}
342	}
343
344	qr->tai_offs = pt->head.this_tai;
345	qr->ebase    = pt->head.ebase;
346	qr->ttime    = pt->head.ttime;
347
348	/* If before the next scheduling alert, we're done. */
349	if (ucmpv64(&ts64, &pt->head.stime) < 0)
350		return fired;
351
352	/* now start to collect the remaining data */
353	due32 = pt->head.dtime.D_s.lo;
354
355	qr->tai_diff  = pt->head.next_tai - pt->head.this_tai;
356	qr->ddist     = due32 - ts32;
357	qr->dynamic   = pt->head.dynls;
358	qr->proximity = LSPROX_SCHEDULE;
359
360	/* if not in the last day before transition, we're done. */
361	if (!betweenu32(due32 - SECSPERDAY, ts32, due32))
362		return fired;
363
364	qr->proximity = LSPROX_ANNOUNCE;
365	if (!betweenu32(due32 - 10, ts32, due32))
366		return fired;
367
368	/* The last 10s before the transition. Prepare for action! */
369	qr->proximity = LSPROX_ALERT;
370	return fired;
371}
372
373/* ------------------------------------------------------------------ */
374int/*BOOL*/
375leapsec_query_era(
376	leap_era_t *   qr   ,
377	uint32_t       ntpts,
378	const time_t * pivot)
379{
380	const leap_table_t * pt;
381	vint64               ts64;
382
383	pt   = leapsec_get_table(FALSE);
384	ts64 = ntpcal_ntp_to_ntp(ntpts, pivot);
385	fetch_leap_era(qr, pt, &ts64);
386	return TRUE;
387}
388
389/* ------------------------------------------------------------------ */
390int/*BOOL*/
391leapsec_frame(
392        leap_result_t *qr)
393{
394	const leap_table_t * pt;
395
396        memset(qr, 0, sizeof(leap_result_t));
397	pt = leapsec_get_table(FALSE);
398
399	qr->tai_offs = pt->head.this_tai;
400	qr->tai_diff = pt->head.next_tai - pt->head.this_tai;
401	qr->ebase    = pt->head.ebase;
402	qr->ttime    = pt->head.ttime;
403	qr->dynamic  = pt->head.dynls;
404
405	return ucmpv64(&pt->head.ttime, &pt->head.stime) >= 0;
406}
407
408/* ------------------------------------------------------------------ */
409/* Reset the current leap frame */
410void
411leapsec_reset_frame(void)
412{
413	reset_times(leapsec_get_table(FALSE));
414}
415
416/* ------------------------------------------------------------------ */
417/* load a file from a FILE pointer. Note: If hcheck is true, load
418 * only after successful signature check. The stream must be seekable
419 * or this will fail.
420 */
421int/*BOOL*/
422leapsec_load_stream(
423	FILE       * ifp  ,
424	const char * fname,
425	int/*BOOL*/  logall)
426{
427	leap_table_t *pt;
428	int           rcheck;
429
430	if (NULL == fname)
431		fname = "<unknown>";
432
433	rcheck = leapsec_validate((leapsec_reader)getc, ifp);
434	if (logall)
435		switch (rcheck)
436		{
437		case LSVALID_GOODHASH:
438			msyslog(LOG_NOTICE, "%s ('%s'): good hash signature",
439				logPrefix, fname);
440			break;
441
442		case LSVALID_NOHASH:
443			msyslog(LOG_ERR, "%s ('%s'): no hash signature",
444				logPrefix, fname);
445			break;
446		case LSVALID_BADHASH:
447			msyslog(LOG_ERR, "%s ('%s'): signature mismatch",
448				logPrefix, fname);
449			break;
450		case LSVALID_BADFORMAT:
451			msyslog(LOG_ERR, "%s ('%s'): malformed hash signature",
452				logPrefix, fname);
453			break;
454		default:
455			msyslog(LOG_ERR, "%s ('%s'): unknown error code %d",
456				logPrefix, fname, rcheck);
457			break;
458		}
459	if (rcheck < 0)
460		return FALSE;
461
462	rewind(ifp);
463	pt = leapsec_get_table(TRUE);
464	if (!leapsec_load(pt, (leapsec_reader)getc, ifp, TRUE)) {
465		switch (errno) {
466		case EINVAL:
467			msyslog(LOG_ERR, "%s ('%s'): bad transition time",
468				logPrefix, fname);
469			break;
470		case ERANGE:
471			msyslog(LOG_ERR, "%s ('%s'): times not ascending",
472				logPrefix, fname);
473			break;
474		default:
475			msyslog(LOG_ERR, "%s ('%s'): parsing error",
476				logPrefix, fname);
477			break;
478		}
479		return FALSE;
480	}
481
482	if (pt->head.size)
483		msyslog(LOG_NOTICE, "%s ('%s'): loaded, expire=%s last=%s ofs=%d",
484			logPrefix, fname, lstostr(&pt->head.expire),
485			lstostr(&pt->info[0].ttime), pt->info[0].taiof);
486	else
487		msyslog(LOG_NOTICE,
488			"%s ('%s'): loaded, expire=%s ofs=%d (no entries after build date)",
489			logPrefix, fname, lstostr(&pt->head.expire),
490			pt->head.base_tai);
491
492	return leapsec_set_table(pt);
493}
494
495/* ------------------------------------------------------------------ */
496int/*BOOL*/
497leapsec_load_file(
498	const char  * fname,
499	struct stat * sb_old,
500	int/*BOOL*/   force,
501	int/*BOOL*/   logall)
502{
503	FILE       * fp;
504	struct stat  sb_new;
505	int          rc;
506
507	/* just do nothing if there is no leap file */
508	if ( !(fname && *fname) )
509		return FALSE;
510
511	/* try to stat the leapfile */
512	if (0 != stat(fname, &sb_new)) {
513		if (logall)
514			msyslog(LOG_ERR, "%s ('%s'): stat failed: %m",
515				logPrefix, fname);
516		return FALSE;
517	}
518
519	/* silently skip to postcheck if no new file found */
520	if (NULL != sb_old) {
521		if (!force
522		 && sb_old->st_mtime == sb_new.st_mtime
523		 && sb_old->st_ctime == sb_new.st_ctime
524		   )
525			return FALSE;
526		*sb_old = sb_new;
527	}
528
529	/* try to open the leap file, complain if that fails
530	 *
531	 * [perlinger@ntp.org]
532	 * coverity raises a TOCTOU (time-of-check/time-of-use) issue
533	 * here, which is not entirely helpful: While there is indeed a
534	 * possible race condition between the 'stat()' call above and
535	 * the 'fopen)' call below, I intentionally want to omit the
536	 * overhead of opening the file and calling 'fstat()', because
537	 * in most cases the file would have be to closed anyway without
538	 * reading the contents.  I chose to disable the coverity
539	 * warning instead.
540	 *
541	 * So unless someone comes up with a reasonable argument why
542	 * this could be a real issue, I'll just try to silence coverity
543	 * on that topic.
544	 */
545	/* coverity[toctou] */
546	if ((fp = fopen(fname, "r")) == NULL) {
547		if (logall)
548			msyslog(LOG_ERR,
549				"%s ('%s'): open failed: %m",
550				logPrefix, fname);
551		return FALSE;
552	}
553
554	rc = leapsec_load_stream(fp, fname, logall);
555	fclose(fp);
556	return rc;
557}
558
559/* ------------------------------------------------------------------ */
560void
561leapsec_getsig(
562	leap_signature_t * psig)
563{
564	const leap_table_t * pt;
565
566	pt = leapsec_get_table(FALSE);
567	memcpy(psig, &pt->lsig, sizeof(leap_signature_t));
568}
569
570/* ------------------------------------------------------------------ */
571int/*BOOL*/
572leapsec_expired(
573	uint32_t       when,
574	const time_t * tpiv)
575{
576	const leap_table_t * pt;
577	vint64 limit;
578
579	pt = leapsec_get_table(FALSE);
580	limit = ntpcal_ntp_to_ntp(when, tpiv);
581	return ucmpv64(&limit, &pt->head.expire) >= 0;
582}
583
584/* ------------------------------------------------------------------ */
585int32_t
586leapsec_daystolive(
587	uint32_t       when,
588	const time_t * tpiv)
589{
590	const leap_table_t * pt;
591	vint64 limit;
592
593	pt = leapsec_get_table(FALSE);
594	limit = ntpcal_ntp_to_ntp(when, tpiv);
595	limit = subv64(&pt->head.expire, &limit);
596	return ntpcal_daysplit(&limit).hi;
597}
598
599/* ------------------------------------------------------------------ */
600#if 0 /* currently unused -- possibly revived later */
601int/*BOOL*/
602leapsec_add_fix(
603	int            total,
604	uint32_t       ttime,
605	uint32_t       etime,
606	const time_t * pivot)
607{
608	time_t         tpiv;
609	leap_table_t * pt;
610	vint64         tt64, et64;
611
612	if (pivot == NULL) {
613		time(&tpiv);
614		pivot = &tpiv;
615	}
616
617	et64 = ntpcal_ntp_to_ntp(etime, pivot);
618	tt64 = ntpcal_ntp_to_ntp(ttime, pivot);
619	pt   = leapsec_get_table(TRUE);
620
621	if (   ucmpv64(&et64, &pt->head.expire) <= 0
622	   || !leapsec_raw(pt, &tt64, total, FALSE) )
623		return FALSE;
624
625	pt->lsig.etime = etime;
626	pt->lsig.ttime = ttime;
627	pt->lsig.taiof = (int16_t)total;
628
629	pt->head.expire = et64;
630
631	return leapsec_set_table(pt);
632}
633#endif
634
635/* ------------------------------------------------------------------ */
636int/*BOOL*/
637leapsec_add_dyn(
638	int            insert,
639	uint32_t       ntpnow,
640	const time_t * pivot )
641{
642	leap_table_t * pt;
643	vint64         now64;
644
645	pt = leapsec_get_table(TRUE);
646	now64 = ntpcal_ntp_to_ntp(ntpnow, pivot);
647	return (   leapsec_add(pt, &now64, (insert != 0))
648		&& leapsec_set_table(pt));
649}
650
651/* ------------------------------------------------------------------ */
652int/*BOOL*/
653leapsec_autokey_tai(
654	int            tai_offset,
655	uint32_t       ntpnow    ,
656	const time_t * pivot     )
657{
658	leap_table_t * pt;
659	leap_era_t     era;
660	vint64         now64;
661	int            idx;
662
663	(void)tai_offset;
664	pt = leapsec_get_table(FALSE);
665
666	/* Bail out if the basic offset is not zero and the putative
667	 * offset is bigger than 10s. That was in 1972 -- we don't want
668	 * to go back that far!
669	 */
670	if (pt->head.base_tai != 0 || tai_offset < 10)
671		return FALSE;
672
673	/* If there's already data in the table, check if an update is
674	 * possible. Update is impossible if there are static entries
675	 * (since this indicates a valid leapsecond file) or if we're
676	 * too close to a leapsecond transition: We do not know on what
677	 * side the transition the sender might have been, so we use a
678	 * dead zone around the transition.
679	 */
680
681	/* Check for static entries */
682	for (idx = 0; idx != pt->head.size; idx++)
683		if ( ! pt->info[idx].dynls)
684			return FALSE;
685
686	/* get the fulll time stamp and leap era for it */
687	now64 = ntpcal_ntp_to_ntp(ntpnow, pivot);
688	fetch_leap_era(&era, pt, &now64);
689
690	/* check the limits with 20s dead band */
691	era.ebase = addv64i32(&era.ebase,  20);
692	if (ucmpv64(&now64, &era.ebase) < 0)
693		return FALSE;
694
695	era.ttime = addv64i32(&era.ttime, -20);
696	if (ucmpv64(&now64, &era.ttime) > 0)
697		return FALSE;
698
699	/* Here we can proceed. Calculate the delta update. */
700	tai_offset -= era.taiof;
701
702	/* Shift the header info offsets. */
703	pt->head.base_tai += tai_offset;
704	pt->head.this_tai += tai_offset;
705	pt->head.next_tai += tai_offset;
706
707	/* Shift table entry offsets (if any) */
708	for (idx = 0; idx != pt->head.size; idx++)
709		pt->info[idx].taiof += tai_offset;
710
711	/* claim success... */
712	return TRUE;
713}
714
715
716/* =====================================================================
717 * internal helpers
718 */
719
720/* [internal] Reset / init the time window in the leap processor to
721 * force reload on next query. Since a leap transition cannot take place
722 * at an odd second, the value chosen avoids spurious leap transition
723 * triggers. Making all three times equal forces a reload. Using the
724 * maximum value for unsigned 64 bits makes finding the next leap frame
725 * a bit easier.
726 */
727static void
728reset_times(
729	leap_table_t * pt)
730{
731	memset(&pt->head.ebase, 0xFF, sizeof(vint64));
732	pt->head.stime = pt->head.ebase;
733	pt->head.ttime = pt->head.ebase;
734	pt->head.dtime = pt->head.ebase;
735}
736
737/* [internal] Add raw data to the table, removing old entries on the
738 * fly. This cannot fail currently.
739 */
740static int/*BOOL*/
741add_range(
742	leap_table_t *      pt,
743	const leap_info_t * pi)
744{
745	/* If the table is full, make room by throwing out the oldest
746	 * entry. But remember the accumulated leap seconds! Likewise,
747	 * assume a positive leap insertion if this is the first entry
748	 * in the table. This is not necessarily the best of all ideas,
749	 * but it helps a great deal if a system does not have a leap
750	 * table and gets updated from an upstream server.
751	 */
752	if (pt->head.size == 0) {
753		pt->head.base_tai = pi->taiof - 1;
754	} else if (pt->head.size >= MAX_HIST) {
755		pt->head.size     = MAX_HIST - 1;
756		pt->head.base_tai = pt->info[pt->head.size].taiof;
757	}
758
759	/* make room in lower end and insert item */
760	memmove(pt->info+1, pt->info, pt->head.size*sizeof(*pt->info));
761	pt->info[0] = *pi;
762	pt->head.size++;
763
764	/* invalidate the cached limit data -- we might have news ;-)
765	 *
766	 * This blocks a spurious transition detection. OTOH, if you add
767	 * a value after the last query before a leap transition was
768	 * expected to occur, this transition trigger is lost. But we
769	 * can probably live with that.
770	 */
771	reset_times(pt);
772	return TRUE;
773}
774
775/* [internal] given a reader function, read characters into a buffer
776 * until either EOL or EOF is reached. Makes sure that the buffer is
777 * always NUL terminated, but silently truncates excessive data. The
778 * EOL-marker ('\n') is *not* stored in the buffer.
779 *
780 * Returns the pointer to the buffer, unless EOF was reached when trying
781 * to read the first character of a line.
782 */
783static char *
784get_line(
785	leapsec_reader func,
786	void *         farg,
787	char *         buff,
788	size_t         size)
789{
790	int   ch;
791	char *ptr;
792
793	/* if we cannot even store the delimiter, declare failure */
794	if (buff == NULL || size == 0)
795		return NULL;
796
797	ptr = buff;
798	while (EOF != (ch = (*func)(farg)) && '\n' != ch)
799		if (size > 1) {
800			size--;
801			*ptr++ = (char)ch;
802		}
803	/* discard trailing whitespace */
804	while (ptr != buff && isspace((u_char)ptr[-1]))
805		ptr--;
806	*ptr = '\0';
807	return (ptr == buff && ch == EOF) ? NULL : buff;
808}
809
810/* [internal] skips whitespace characters from a character buffer. */
811static char *
812skipws(
813	const char *ptr)
814{
815	while (isspace((u_char)*ptr))
816		ptr++;
817	return (char*)noconst(ptr);
818}
819
820/* [internal] check if a strtoXYZ ended at EOL or whitespace and
821 * converted something at all. Return TRUE if something went wrong.
822 */
823static int/*BOOL*/
824parsefail(
825	const char * cp,
826	const char * ep)
827{
828	return (cp == ep)
829	    || (*ep && *ep != '#' && !isspace((u_char)*ep));
830}
831
832/* [internal] reload the table limits around the given time stamp. This
833 * is where the real work is done when it comes to table lookup and
834 * evaluation. Some care has been taken to have correct code for dealing
835 * with boundary conditions and empty tables.
836 *
837 * In electric mode, transition and trip time are the same. In dumb
838 * mode, the difference of the TAI offsets must be taken into account
839 * and trip time and transition time become different. The difference
840 * becomes the warping distance when the trip time is reached.
841 */
842static void
843reload_limits(
844	leap_table_t * pt,
845	const vint64 * ts)
846{
847	int idx;
848
849	/* Get full time and search the true lower bound. Use a
850	 * simple loop here, since the number of entries does
851	 * not warrant a binary search. This also works for an empty
852	 * table, so there is no shortcut for that case.
853	 */
854	for (idx = 0; idx != pt->head.size; idx++)
855		if (ucmpv64(ts, &pt->info[idx].ttime) >= 0)
856			break;
857
858	/* get time limits with proper bound conditions. Note that the
859	 * bounds of the table will be observed even if the table is
860	 * empty -- no undefined condition must arise from this code.
861	 */
862	if (idx >= pt->head.size) {
863		memset(&pt->head.ebase, 0x00, sizeof(vint64));
864		pt->head.this_tai = pt->head.base_tai;
865	} else {
866		pt->head.ebase    = pt->info[idx].ttime;
867		pt->head.this_tai = pt->info[idx].taiof;
868	}
869	if (--idx >= 0) {
870		pt->head.next_tai = pt->info[idx].taiof;
871		pt->head.dynls    = pt->info[idx].dynls;
872		pt->head.ttime    = pt->info[idx].ttime;
873
874		if (_electric)
875			pt->head.dtime = pt->head.ttime;
876                else
877			pt->head.dtime = addv64i32(
878				&pt->head.ttime,
879				pt->head.next_tai - pt->head.this_tai);
880
881		pt->head.stime = subv64u32(
882			&pt->head.ttime, pt->info[idx].stime);
883
884	} else {
885		memset(&pt->head.ttime, 0xFF, sizeof(vint64));
886		pt->head.stime    = pt->head.ttime;
887		pt->head.dtime    = pt->head.ttime;
888		pt->head.next_tai = pt->head.this_tai;
889		pt->head.dynls    = 0;
890	}
891}
892
893/* [internal] fetch the leap era for a given time stamp.
894 * This is a cut-down version the algorithm used to reload the table
895 * limits, but it does not update any global state and provides just the
896 * era information for a given time stamp.
897 */
898static void
899fetch_leap_era(
900	leap_era_t         * into,
901	const leap_table_t * pt  ,
902	const vint64       * ts  )
903{
904	int idx;
905
906	/* Simple search loop, also works with empty table. */
907	for (idx = 0; idx != pt->head.size; idx++)
908		if (ucmpv64(ts, &pt->info[idx].ttime) >= 0)
909			break;
910	/* fetch era data, keeping an eye on boundary conditions */
911	if (idx >= pt->head.size) {
912		memset(&into->ebase, 0x00, sizeof(vint64));
913		into->taiof = pt->head.base_tai;
914	} else {
915		into->ebase = pt->info[idx].ttime;
916		into->taiof = pt->info[idx].taiof;
917	}
918	if (--idx >= 0)
919		into->ttime = pt->info[idx].ttime;
920	else
921		memset(&into->ttime, 0xFF, sizeof(vint64));
922}
923
924/* [internal] Take a time stamp and create a leap second frame for
925 * it. This will schedule a leap second for the beginning of the next
926 * month, midnight UTC. The 'insert' argument tells if a leap second is
927 * added (!=0) or removed (==0). We do not handle multiple inserts
928 * (yet?)
929 *
930 * Returns 1 if the insert worked, 0 otherwise. (It's not possible to
931 * insert a leap second into the current history -- only appending
932 * towards the future is allowed!)
933 */
934static int/*BOOL*/
935leapsec_add(
936	leap_table_t*  pt    ,
937	const vint64 * now64 ,
938	int            insert)
939{
940	vint64		ttime, starttime;
941	struct calendar	fts;
942	leap_info_t	li;
943
944	/* Check against the table expiration and the latest available
945	 * leap entry. Do not permit inserts, only appends, and only if
946	 * the extend the table beyond the expiration!
947	 */
948	if (   ucmpv64(now64, &pt->head.expire) < 0
949	    || (pt->head.size && ucmpv64(now64, &pt->info[0].ttime) <= 0)) {
950		errno = ERANGE;
951		return FALSE;
952	}
953
954	ntpcal_ntp64_to_date(&fts, now64);
955	/* To guard against dangling leap flags: do not accept leap
956	 * second request on the 1st hour of the 1st day of the month.
957	 */
958	if (fts.monthday == 1 && fts.hour == 0) {
959		errno = EINVAL;
960		return FALSE;
961	}
962
963	/* Ok, do the remaining calculations */
964	fts.monthday = 1;
965	fts.hour     = 0;
966	fts.minute   = 0;
967	fts.second   = 0;
968	starttime = ntpcal_date_to_ntp64(&fts);
969	fts.month++;
970	ttime = ntpcal_date_to_ntp64(&fts);
971
972	li.ttime = ttime;
973	li.stime = ttime.D_s.lo - starttime.D_s.lo;
974	li.taiof = (pt->head.size ? pt->info[0].taiof : pt->head.base_tai)
975	         + (insert ? 1 : -1);
976	li.dynls = 1;
977	return add_range(pt, &li);
978}
979
980/* [internal] Given a time stamp for a leap insertion (the exact begin
981 * of the new leap era), create new leap frame and put it into the
982 * table. This is the work horse for reading a leap file and getting a
983 * leap second update via authenticated network packet.
984 */
985int/*BOOL*/
986leapsec_raw(
987	leap_table_t * pt,
988	const vint64 * ttime,
989	int            taiof,
990	int            dynls)
991{
992	vint64		starttime;
993	struct calendar	fts;
994	leap_info_t	li;
995
996	/* Check that we either extend the table or get a duplicate of
997	 * the latest entry. The latter is a benevolent overwrite with
998	 * identical data and could happen if we get an autokey message
999	 * that extends the lifetime of the current leapsecond table.
1000	 * Otherwise paranoia rulez!
1001	 */
1002	if (pt->head.size) {
1003		int cmp = ucmpv64(ttime, &pt->info[0].ttime);
1004		if (cmp == 0)
1005			cmp -= (taiof != pt->info[0].taiof);
1006		if (cmp < 0) {
1007			errno = ERANGE;
1008			return FALSE;
1009		}
1010		if (cmp == 0)
1011			return TRUE;
1012	}
1013
1014	ntpcal_ntp64_to_date(&fts, ttime);
1015	/* If this does not match the exact month start, bail out. */
1016	if (fts.monthday != 1 || fts.hour || fts.minute || fts.second) {
1017		errno = EINVAL;
1018		return FALSE;
1019	}
1020	fts.month--; /* was in range 1..12, no overflow here! */
1021	starttime = ntpcal_date_to_ntp64(&fts);
1022	li.ttime = *ttime;
1023	li.stime = ttime->D_s.lo - starttime.D_s.lo;
1024	li.taiof = (int16_t)taiof;
1025	li.dynls = (dynls != 0);
1026	return add_range(pt, &li);
1027}
1028
1029/* [internal] Do a wrap-around save range inclusion check.
1030 * Returns TRUE if x in [lo,hi[ (intervall open on right side) with full
1031 * handling of an overflow / wrap-around.
1032 */
1033static int/*BOOL*/
1034betweenu32(
1035	uint32_t lo,
1036	uint32_t x,
1037	uint32_t hi)
1038{
1039	int rc;
1040
1041	if (lo <= hi)
1042		rc = (lo <= x) && (x < hi);
1043	else
1044		rc = (lo <= x) || (x < hi);
1045	return rc;
1046}
1047
1048/* =====================================================================
1049 * validation stuff
1050 */
1051
1052typedef struct {
1053	unsigned char hv[ISC_SHA1_DIGESTLENGTH];
1054} sha1_digest;
1055
1056/* [internal] parse a digest line to get the hash signature
1057 * The NIST code creating the hash writes them out as 5 hex integers
1058 * without leading zeros. This makes reading them back as hex-encoded
1059 * BLOB impossible, because there might be less than 40 hex digits.
1060 *
1061 * The solution is to read the values back as integers, and then do the
1062 * byte twiddle necessary to get it into an array of 20 chars. The
1063 * drawback is that it permits any acceptable number syntax provided by
1064 * 'scanf()' and 'strtoul()', including optional signs and '0x'
1065 * prefixes.
1066 */
1067static int/*BOOL*/
1068do_leap_hash(
1069	sha1_digest * mac,
1070	char const  * cp )
1071{
1072	int wi, di, num, len;
1073	unsigned long tmp[5];
1074
1075	memset(mac, 0, sizeof(*mac));
1076	num = sscanf(cp, " %lx %lx %lx %lx %lx%n",
1077		     &tmp[0], &tmp[1], &tmp[2], &tmp[3], &tmp[4],
1078		     &len);
1079	if (num != 5 || cp[len] > ' ')
1080		return FALSE;
1081
1082	/* now do the byte twiddle */
1083	for (wi=0; wi < 5; ++wi)
1084		for (di=3; di >= 0; --di) {
1085			mac->hv[wi*4 + di] =
1086				(unsigned char)(tmp[wi] & 0x0FF);
1087			tmp[wi] >>= 8;
1088		}
1089	return TRUE;
1090}
1091
1092/* [internal] add the digits of a data line to the hash, stopping at the
1093 * next hash ('#') character.
1094 */
1095static void
1096do_hash_data(
1097	isc_sha1_t * mdctx,
1098	char const * cp   )
1099{
1100	unsigned char  text[32]; // must be power of two!
1101	unsigned int   tlen =  0;
1102	unsigned char  ch;
1103
1104	while ('\0' != (ch = *cp++) && '#' != ch)
1105		if (isdigit(ch)) {
1106			text[tlen++] = ch;
1107			tlen &= (sizeof(text)-1);
1108			if (0 == tlen)
1109				isc_sha1_update(
1110					mdctx, text, sizeof(text));
1111		}
1112
1113	if (0 < tlen)
1114		isc_sha1_update(mdctx, text, tlen);
1115}
1116
1117/* given a reader and a reader arg, calculate and validate the the hash
1118 * signature of a NIST leap second file.
1119 */
1120int
1121leapsec_validate(
1122	leapsec_reader func,
1123	void *         farg)
1124{
1125	isc_sha1_t     mdctx;
1126	sha1_digest    rdig, ldig; /* remote / local digests */
1127	char           line[50];
1128	int            hlseen = -1;
1129
1130	isc_sha1_init(&mdctx);
1131	while (get_line(func, farg, line, sizeof(line))) {
1132		if (!strncmp(line, "#h", 2))
1133			hlseen = do_leap_hash(&rdig, line+2);
1134		else if (!strncmp(line, "#@", 2))
1135			do_hash_data(&mdctx, line+2);
1136		else if (!strncmp(line, "#$", 2))
1137			do_hash_data(&mdctx, line+2);
1138		else if (isdigit((unsigned char)line[0]))
1139			do_hash_data(&mdctx, line);
1140	}
1141	isc_sha1_final(&mdctx, ldig.hv);
1142	isc_sha1_invalidate(&mdctx);
1143
1144	if (0 > hlseen)
1145		return LSVALID_NOHASH;
1146	if (0 == hlseen)
1147		return LSVALID_BADFORMAT;
1148	if (0 != memcmp(&rdig, &ldig, sizeof(sha1_digest)))
1149		return LSVALID_BADHASH;
1150	return LSVALID_GOODHASH;
1151}
1152
1153/*
1154 * lstostr - prettyprint NTP seconds
1155 */
1156static const char *
1157lstostr(
1158	const vint64 * ts)
1159{
1160	char *		buf;
1161	struct calendar tm;
1162
1163	LIB_GETBUF(buf);
1164
1165	if ( ! (ts->d_s.hi >= 0 && ntpcal_ntp64_to_date(&tm, ts) >= 0))
1166		snprintf(buf, LIB_BUFLENGTH, "%s", "9999-12-31T23:59:59Z");
1167	else
1168		snprintf(buf, LIB_BUFLENGTH, "%04d-%02d-%02dT%02d:%02d:%02dZ",
1169			tm.year, tm.month, tm.monthday,
1170			tm.hour, tm.minute, tm.second);
1171
1172	return buf;
1173}
1174
1175/* reset the global state for unit tests */
1176void
1177leapsec_ut_pristine(void)
1178{
1179	memset(_ltab, 0, sizeof(_ltab));
1180	_lptr     = NULL;
1181	_electric = 0;
1182}
1183
1184
1185
1186/* -*- that's all folks! -*- */
1187