ntpd: it's a plugin!

(cherry picked from commit fd987e63)
(cherry picked from commit b30940b5)
(cherry picked from commit d539e535)

plist

@@ -49,6 +49,7 @@
 /usr/local/etc/inc/plugins.inc.d/ipfw.inc
 /usr/local/etc/inc/plugins.inc.d/miniupnpd.inc
 /usr/local/etc/inc/plugins.inc.d/netflow.inc
+/usr/local/etc/inc/plugins.inc.d/ntpd.inc
 /usr/local/etc/inc/plugins.inc.d/pf.inc
 /usr/local/etc/inc/plugins.inc.d/relayd.inc
 /usr/local/etc/inc/plugins.inc.d/relayd/dns.proto

src/etc/inc/plugins.inc.d/ntpd.inc

+<?php
+
+/*
+    Copyright (C) 2016 Franco Fichtner <franco@opnsense.org>
+    Copyright (C) 2004-2007 Scott Ullrich <sullrich@gmail.com>
+    Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>
+    All rights reserved.
+
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+
+    1. Redistributions of source code must retain the above copyright notice,
+       this list of conditions and the following disclaimer.
+
+    2. Redistributions in binary form must reproduce the above copyright
+       notice, this list of conditions and the following disclaimer in the
+       documentation and/or other materials provided with the distribution.
+
+    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+*/
+
+function ntpd_enabled()
+{
+    global $config;
+
+    return isset($config['system']['timeservers']);
+}
+
+function ntpd_services()
+{
+    $services = array();
+
+    if (!ntpd_enabled()) {
+        return $services;
+    }
+
+    $pconfig = array();
+    $pconfig['name'] = 'ntpd';
+    $pconfig['description'] = gettext('Network Time Daemon');
+    $pconfig['php']['restart'] = array('ntpd_configure_start');
+    $pconfig['php']['start'] = array('ntpd_configure_start');
+    $pconfig['pidfile'] = '/var/run/ntpd.pid';
+    $services[] = $pconfig;
+
+    return $services;
+}
+
+function ntpd_syslog()
+{
+    $logfacilities = array();
+
+    $logfacilities['ntpd'] = array('facility' => array('ntp', 'ntpd', 'ntpdate'));
+
+    return $logfacilities;
+}
+
+function ntpd_configure()
+{
+    return array(
+        'bootup' => array('ntpd_configure_defer'),
+        'interface' => array('ntpd_configure_defer'),
+        'local' => array('ntpd_configure_start'),
+    );
+}
+
+function ntpd_configure_gps($serialport)
+{
+    global $config;
+    $gps_device = '/dev/gps0';
+    $serialport = '/dev/'.$serialport;
+
+    if (!file_exists($serialport)) {
+        return false;
+    }
+
+    // Create symlink that ntpd requires
+    @unlink($gps_device);
+    symlink($serialport, $gps_device);
+
+    /* Send the following to the GPS port to initialize the GPS */
+    if (isset($config['ntpd']['gps'])) {
+        $gps_init = base64_decode($config['ntpd']['gps']['initcmd']);
+    } else {
+        $gps_init = base64_decode('JFBVQlgsNDAsR1NWLDAsMCwwLDAqNTkNCiRQVUJYLDQwLEdMTCwwLDAsMCwwKjVDDQokUFVCWCw0MCxaREEsMCwwLDAsMCo0NA0KJFBVQlgsNDAsVlRHLDAsMCwwLDAqNUUNCiRQVUJYLDQwLEdTViwwLDAsMCwwKjU5DQokUFVCWCw0MCxHU0EsMCwwLDAsMCo0RQ0KJFBVQlgsNDAsR0dBLDAsMCwwLDANCiRQVUJYLDQwLFRYVCwwLDAsMCwwDQokUFVCWCw0MCxSTUMsMCwwLDAsMCo0Ng0KJFBVQlgsNDEsMSwwMDA3LDAwMDMsNDgwMCwwDQokUFVCWCw0MCxaREEsMSwxLDEsMQ==');
+    }
+
+    /* XXX: Why not file_put_contents to the device */
+    @file_put_contents('/tmp/gps.init', $gps_init);
+    `cat /tmp/gps.init > $serialport`;
+
+    /* Add /etc/remote entry in case we need to read from the GPS with tip */
+    if (intval(`grep -c '^gps0' /etc/remote`) == 0) {
+        $gpsbaud = '4800';
+        if (is_array($config['ntpd']) && is_array($config['ntpd']['gps']) && !empty($config['ntpd']['gps']['speed'])) {
+            switch($config['ntpd']['gps']['speed']) {
+                case '16':
+                    $gpsbaud = '9600';
+                    break;
+                case '32':
+                    $gpsbaud = '19200';
+                    break;
+                case '48':
+                    $gpsbaud = '38400';
+                    break;
+                case '64':
+                    $gpsbaud = '57600';
+                    break;
+                case '80':
+                    $gpsbaud = '115200';
+                    break;
+            }
+        }
+        @file_put_contents("/etc/remote", "gps0:dv={$serialport}:br#{$gpsbaud}:pa=none:", FILE_APPEND);
+    }
+
+    return true;
+}
+
+function ntpd_configure_pps($serialport)
+{
+    $pps_device = '/dev/pps0';
+    $serialport = "/dev/{$serialport}";
+
+    if (!file_exists($serialport)) {
+        return false;
+    }
+
+    // Create symlink that ntpd requires
+    @unlink($pps_device);
+    @symlink($serialport, $pps_device);
+
+    return true;
+}
+
+function ntpd_configure_start($verbose = false)
+{
+    ntpd_configure_do(true, $verbose);
+}
+
+function ntpd_configure_defer($verbose = false)
+{
+    ntpd_configure_do(false, $verbose);
+}
+
+function ntpd_configure_do($start_ntpd = true, $verbose = false)
+{
+    global $config;
+
+    if ($start_ntpd) {
+        killbypid('/var/run/ntpd.pid', 'TERM', true);
+    }
+
+    if (!ntpd_enabled()) {
+        return;
+    }
+
+    if ($verbose) {
+        echo 'Starting NTP service...';
+        flush();
+    }
+
+    $driftfile = '/var/db/ntpd.drift';
+    $statsdir = '/var/log/ntp';
+    $gps_device = '/dev/gps0';
+
+    @mkdir($statsdir, 0755);
+
+    if (!isset($config['ntpd']) || !is_array($config['ntpd'])) {
+        $config['ntpd'] = array();
+    }
+
+    $ntpcfg = "#\n";
+    $ntpcfg .= "# Autogenerated configuration file\n";
+    $ntpcfg .= "#\n\n";
+    $ntpcfg .= "tinker panic 0\n";
+
+    /* Add Orphan mode */
+    $ntpcfg .= "# Orphan mode stratum\n";
+    $ntpcfg .= 'tos orphan ';
+    if (!empty($config['ntpd']['orphan'])) {
+        $ntpcfg .= $config['ntpd']['orphan'];
+    }else{
+        $ntpcfg .= '12';
+    }
+    $ntpcfg .= "\n";
+
+    /* Add PPS configuration */
+    if (!empty($config['ntpd']['pps'])
+      && file_exists('/dev/'.$config['ntpd']['pps']['port'])
+      && ntpd_configure_pps($config['ntpd']['pps']['port'])) {
+        $ntpcfg .= "\n";
+        $ntpcfg .= "# PPS Setup\n";
+        $ntpcfg .= 'server 127.127.22.0';
+        $ntpcfg .= ' minpoll 4 maxpoll 4';
+        if (empty($config['ntpd']['pps']['prefer'])) { /*note: this one works backwards */
+            $ntpcfg .= ' prefer';
+        }
+        if (!empty($config['ntpd']['pps']['noselect'])) {
+            $ntpcfg .= ' noselect ';
+        }
+        $ntpcfg .= "\n";
+        $ntpcfg .= 'fudge 127.127.22.0';
+        if (!empty($config['ntpd']['pps']['fudge1'])) {
+            $ntpcfg .= ' time1 ';
+            $ntpcfg .= $config['ntpd']['pps']['fudge1'];
+        }
+        if (!empty($config['ntpd']['pps']['flag2'])) {
+            $ntpcfg .= ' flag2 1';
+        }
+        if (!empty($config['ntpd']['pps']['flag3'])) {
+            $ntpcfg .= ' flag3 1';
+        } else{
+            $ntpcfg .= ' flag3 0';
+        }
+        if (!empty($config['ntpd']['pps']['flag4'])) {
+            $ntpcfg .= ' flag4 1';
+        }
+        if (!empty($config['ntpd']['pps']['refid'])) {
+            $ntpcfg .= ' refid ';
+            $ntpcfg .= $config['ntpd']['pps']['refid'];
+        }
+        $ntpcfg .= "\n";
+    }
+    /* End PPS configuration */
+
+    /* Add GPS configuration */
+    if (isset($config['ntpd']['gps']['port'])
+      && file_exists('/dev/'.$config['ntpd']['gps']['port'])
+      && ntpd_configure_gps($config['ntpd']['gps']['port'])) {
+        $ntpcfg .= "\n";
+        $ntpcfg .= "# GPS Setup\n";
+        $ntpcfg .= 'server 127.127.20.0 mode ';
+        if (!empty($config['ntpd']['gps']['nmea']) || !empty($config['ntpd']['gps']['speed']) || !empty($config['ntpd']['gps']['subsec'])) {
+            if (!empty($config['ntpd']['gps']['nmea'])) {
+                $ntpmode = (int) $config['ntpd']['gps']['nmea'];
+            }
+            if (!empty($config['ntpd']['gps']['speed'])) {
+                $ntpmode += (int) $config['ntpd']['gps']['speed'];
+            }
+            if (!empty($config['ntpd']['gps']['subsec'])) {
+                $ntpmode += 128;
+            }
+            $ntpcfg .= (string) $ntpmode;
+        } else{
+            $ntpcfg .= '0';
+        }
+        $ntpcfg .= ' minpoll 4 maxpoll 4';
+        if (empty($config['ntpd']['gps']['prefer'])) { /*note: this one works backwards */
+            $ntpcfg .= ' prefer';
+        }
+        if (!empty($config['ntpd']['gps']['noselect'])) {
+            $ntpcfg .= ' noselect ';
+        }
+        $ntpcfg .= "\n";
+        $ntpcfg .= 'fudge 127.127.20.0';
+        if (!empty($config['ntpd']['gps']['fudge1'])) {
+            $ntpcfg .= ' time1 ';
+            $ntpcfg .= $config['ntpd']['gps']['fudge1'];
+        }
+        if (!empty($config['ntpd']['gps']['fudge2'])) {
+            $ntpcfg .= ' time2 ';
+            $ntpcfg .= $config['ntpd']['gps']['fudge2'];
+        }
+        if (!empty($config['ntpd']['gps']['flag1'])) {
+            $ntpcfg .= ' flag1 1';
+        } else{
+            $ntpcfg .= ' flag1 0';
+        }
+        if (!empty($config['ntpd']['gps']['flag2'])) {
+            $ntpcfg .= ' flag2 1';
+        }
+        if (!empty($config['ntpd']['gps']['flag3'])) {
+            $ntpcfg .= ' flag3 1';
+        } else{
+            $ntpcfg .= ' flag3 0';
+        }
+        if (!empty($config['ntpd']['gps']['flag4'])) {
+            $ntpcfg .= ' flag4 1';
+        }
+        if (!empty($config['ntpd']['gps']['refid'])) {
+            $ntpcfg .= ' refid ';
+            $ntpcfg .= $config['ntpd']['gps']['refid'];
+        }
+        $ntpcfg .= "\n";
+    }
+    /* End GPS configuration */
+
+    $noselect = isset($config['ntpd']['noselect']) ? explode(' ', $config['ntpd']['noselect']) : array();
+    $prefer = isset($config['ntpd']['prefer']) ? explode(' ', $config['ntpd']['prefer']) : array();
+
+    $ntpcfg .= "\n\n# Upstream Servers\n";
+    /* foreach through ntp servers and write out to ntpd.conf */
+    foreach (explode(' ', $config['system']['timeservers']) as $ts) {
+        $ntpcfg .= "server {$ts} iburst maxpoll 9";
+        if (in_array($ts, $prefer)) {
+            $ntpcfg .= ' prefer';
+        }
+        if (in_array($ts, $noselect)) {
+            $ntpcfg .= ' noselect';
+        }
+        $ntpcfg .= "\n";
+    }
+    unset($ts);
+
+    $ntpcfg .= "\n\n";
+    $ntpcfg .= "disable monitor\n"; //prevent NTP reflection attack, see https://ics-cert.us-cert.gov/advisories/ICSA-14-051-04
+    if (!empty($config['ntpd']['clockstats']) || !empty($config['ntpd']['loopstats']) || !empty($config['ntpd']['peerstats'])) {
+        $ntpcfg .= "enable stats\n";
+        $ntpcfg .= 'statistics';
+        if (!empty($config['ntpd']['clockstats'])) {
+            $ntpcfg .= ' clockstats';
+        }
+        if (!empty($config['ntpd']['loopstats'])) {
+            $ntpcfg .= ' loopstats';
+        }
+        if (!empty($config['ntpd']['peerstats'])) {
+            $ntpcfg .= ' peerstats';
+        }
+        $ntpcfg .= "\n";
+    }
+    $ntpcfg .= "statsdir {$statsdir}\n";
+    $ntpcfg .= 'logconfig =syncall +clockall';
+    if (!empty($config['ntpd']['logpeer'])) {
+        $ntpcfg .= ' +peerall';
+    }
+    if (!empty($config['ntpd']['logsys'])) {
+        $ntpcfg .= ' +sysall';
+    }
+    $ntpcfg .= "\n";
+    $ntpcfg .= "driftfile {$driftfile}\n";
+    /* Access restrictions */
+    $ntpcfg .= 'restrict default';
+    if (empty($config['ntpd']['kod'])) { /*note: this one works backwards */
+        $ntpcfg .= ' kod limited';
+    }
+    if (empty($config['ntpd']['nomodify'])) { /*note: this one works backwards */
+        $ntpcfg .= ' nomodify';
+    }
+    if (!empty($config['ntpd']['noquery'])) {
+        $ntpcfg .= ' noquery';
+    }
+    if (empty($config['ntpd']['nopeer'])) { /*note: this one works backwards */
+        $ntpcfg .= ' nopeer';
+    }
+    if (empty($config['ntpd']['notrap'])) { /*note: this one works backwards */
+        $ntpcfg .= ' notrap';
+    }
+    if (!empty($config['ntpd']['noserve'])) {
+        $ntpcfg .= ' noserve';
+    }
+    $ntpcfg .= "\nrestrict -6 default";
+    if (empty($config['ntpd']['kod'])) { /*note: this one works backwards */
+        $ntpcfg .= ' kod limited';
+    }
+    if (empty($config['ntpd']['nomodify'])) { /*note: this one works backwards */
+        $ntpcfg .= ' nomodify';
+    }
+    if (!empty($config['ntpd']['noquery'])) {
+        $ntpcfg .= ' noquery';
+    }
+    if (empty($config['ntpd']['nopeer'])) { /*note: this one works backwards */
+        $ntpcfg .= ' nopeer';
+    }
+    if (!empty($config['ntpd']['noserve'])) {
+        $ntpcfg .= ' noserve';
+    }
+    if (empty($config['ntpd']['notrap'])) { /*note: this one works backwards */
+        $ntpcfg .= ' notrap';
+    }
+    $ntpcfg .= "\n";
+
+    /* A leapseconds file is really only useful if this clock is stratum 1 */
+    $ntpcfg .= "\n";
+    if (!empty($config['ntpd']['leapsec'])) {
+        $leapsec .= base64_decode($config['ntpd']['leapsec']);
+        file_put_contents('/var/db/leap-seconds', $leapsec);
+        $ntpcfg .= "leapfile /var/db/leap-seconds\n";
+    }
+
+
+    $interfaces = array();
+    if (isset($config['ntpd']['interface'])) {
+        $interfaces = explode(',', $config['ntpd']['interface']);
+    }
+
+    if (is_array($interfaces) && count($interfaces)) {
+        $ntpcfg .= "interface ignore all\n";
+        foreach ($interfaces as $interface) {
+            if (!is_ipaddr($interface)) {
+                $interface = get_real_interface($interface);
+            }
+            if (!empty($interface)) {
+                $ntpcfg .= "interface listen {$interface}\n";
+            }
+        }
+    }
+
+    file_put_contents('/var/etc/ntpd.conf', $ntpcfg);
+
+    if (!$start_ntpd) {
+        /* write out the config and delay startup */
+        mwexec_bg('/usr/local/sbin/ntpdate_sync_once.sh');
+        if ($verbose) {
+            echo "deferred.\n";
+        }
+        return;
+    }
+
+    /* if /var/empty does not exist, create it */
+    @mkdir('/var/empty', 0775, true);
+
+    /* start opentpd, set time now and use new config */
+    mwexecf(
+      '/usr/local/sbin/ntpd -g -c %s -p %s',
+      array('/var/etc/ntpd.conf', '/var/run/ntpd.pid')
+    );
+
+    if ($verbose) {
+        echo "done.\n";
+    }
+}
+

src/etc/inc/services.inc

@@ -2074,16 +2074,6 @@ function services_get()
         $services[] = $pconfig;
     }
 
-    if (isset($config['system']['timeservers'])) {
-        $pconfig = array();
-        $pconfig['name'] = "ntpd";
-        $pconfig['description'] = gettext("NTP clock sync");
-        $pconfig['php']['restart'] = array('system_ntp_configure');
-        $pconfig['php']['start'] = array('system_ntp_configure');
-        $pconfig['pidfile'] = '/var/run/ntpd.pid';
-        $services[] = $pconfig;
-    }
-
     if (isset($config['dhcrelay']['enable'])) {
         $pconfig = array();
         $pconfig['name'] = "dhcrelay";

src/etc/inc/system.inc

@@ -812,7 +812,6 @@ function system_syslogd_start($verbose = false)
         $syslogconfs['dhcpd'] = array('facility' => array('dhcpd', 'dhcrelay', 'dhclient', 'dhcp6c'), 'local' => "{$g['dhcpd_chroot_path']}/var/run/log", 'remote' => 'dhcp');
         $syslogconfs['filter'] = array('facility' => array('filterlog'), 'remote' => 'filter');
         $syslogconfs['gateways'] = array('facility' => array('apinger'), 'remote' => 'apinger');
-        $syslogconfs['ntpd'] = array('facility' => array('ntp', 'ntpd', 'ntpdate'));
         $syslogconfs['portalauth'] = array('facility' => array('captiveportal'), 'remote' => 'portalauth');
         $syslogconfs['ppps'] = array('facility' => array('ppp'));
         $syslogconfs['resolver'] = array('facility' => array('dnsmasq', 'filterdns', 'unbound'));
@@ -1425,349 +1424,6 @@ function system_timezone_configure($verbose = false)
     }
 }
 
-function system_ntp_setup_gps($serialport)
-{
-    global $config;
-    $gps_device = '/dev/gps0';
-    $serialport = '/dev/'.$serialport;
-
-    if (!file_exists($serialport)) {
-        return false;
-    }
-
-    // Create symlink that ntpd requires
-    @unlink($gps_device);
-    symlink($serialport, $gps_device);
-
-    /* Send the following to the GPS port to initialize the GPS */
-    if (isset($config['ntpd']['gps'])) {
-        $gps_init = base64_decode($config['ntpd']['gps']['initcmd']);
-    } else {
-        $gps_init = base64_decode('JFBVQlgsNDAsR1NWLDAsMCwwLDAqNTkNCiRQVUJYLDQwLEdMTCwwLDAsMCwwKjVDDQokUFVCWCw0MCxaREEsMCwwLDAsMCo0NA0KJFBVQlgsNDAsVlRHLDAsMCwwLDAqNUUNCiRQVUJYLDQwLEdTViwwLDAsMCwwKjU5DQokUFVCWCw0MCxHU0EsMCwwLDAsMCo0RQ0KJFBVQlgsNDAsR0dBLDAsMCwwLDANCiRQVUJYLDQwLFRYVCwwLDAsMCwwDQokUFVCWCw0MCxSTUMsMCwwLDAsMCo0Ng0KJFBVQlgsNDEsMSwwMDA3LDAwMDMsNDgwMCwwDQokUFVCWCw0MCxaREEsMSwxLDEsMQ==');
-    }
-
-    /* XXX: Why not file_put_contents to the device */
-    @file_put_contents('/tmp/gps.init', $gps_init);
-    `cat /tmp/gps.init > $serialport`;
-
-    /* Add /etc/remote entry in case we need to read from the GPS with tip */
-    if (intval(`grep -c '^gps0' /etc/remote`) == 0) {
-        $gpsbaud = '4800';
-        if (is_array($config['ntpd']) && is_array($config['ntpd']['gps']) && !empty($config['ntpd']['gps']['speed'])) {
-            switch($config['ntpd']['gps']['speed']) {
-                case '16':
-                    $gpsbaud = '9600';
-                    break;
-                case '32':
-                    $gpsbaud = '19200';
-                    break;
-                case '48':
-                    $gpsbaud = '38400';
-                    break;
-                case '64':
-                    $gpsbaud = '57600';
-                    break;
-                case '80':
-                    $gpsbaud = '115200';
-                    break;
-            }
-        }
-        @file_put_contents("/etc/remote", "gps0:dv={$serialport}:br#{$gpsbaud}:pa=none:", FILE_APPEND);
-    }
-
-    return true;
-}
-
-function system_ntp_setup_pps($serialport)
-{
-    $pps_device = '/dev/pps0';
-    $serialport = "/dev/{$serialport}";
-
-    if (!file_exists($serialport)) {
-        return false;
-    }
-
-    // Create symlink that ntpd requires
-    @unlink($pps_device);
-    @symlink($serialport, $pps_device);
-
-    return true;
-}
-
-function system_ntp_configure($start_ntpd = true)
-{
-    global $config;
-
-    if ($start_ntpd) {
-        killbypid('/var/run/ntpd.pid', 'TERM', true);
-    }
-
-    if (!isset($config['system']['timeservers'])) {
-        /* use this field for on/off toggle */
-        return;
-    }
-
-    $driftfile = '/var/db/ntpd.drift';
-    $statsdir = '/var/log/ntp';
-    $gps_device = '/dev/gps0';
-
-    @mkdir($statsdir, 0755);
-
-    if (!isset($config['ntpd']) || !is_array($config['ntpd'])) {
-        $config['ntpd'] = array();
-    }
-
-    $ntpcfg = "# \n";
-    $ntpcfg .= "# OPNsense ntp configuration file \n";
-    $ntpcfg .= "# \n\n";
-    $ntpcfg .= "tinker panic 0 \n";
-
-    /* Add Orphan mode */
-    $ntpcfg .= "# Orphan mode stratum\n";
-    $ntpcfg .= 'tos orphan ';
-    if (!empty($config['ntpd']['orphan'])) {
-        $ntpcfg .= $config['ntpd']['orphan'];
-    }else{
-        $ntpcfg .= '12';
-    }
-    $ntpcfg .= "\n";
-
-    /* Add PPS configuration */
-    if (!empty($config['ntpd']['pps'])
-      && file_exists('/dev/'.$config['ntpd']['pps']['port'])
-      && system_ntp_setup_pps($config['ntpd']['pps']['port'])) {
-        $ntpcfg .= "\n";
-        $ntpcfg .= "# PPS Setup\n";
-        $ntpcfg .= 'server 127.127.22.0';
-        $ntpcfg .= ' minpoll 4 maxpoll 4';
-        if (empty($config['ntpd']['pps']['prefer'])) { /*note: this one works backwards */
-            $ntpcfg .= ' prefer';
-        }
-        if (!empty($config['ntpd']['pps']['noselect'])) {
-            $ntpcfg .= ' noselect ';
-        }
-        $ntpcfg .= "\n";
-        $ntpcfg .= 'fudge 127.127.22.0';
-        if (!empty($config['ntpd']['pps']['fudge1'])) {
-            $ntpcfg .= ' time1 ';
-            $ntpcfg .= $config['ntpd']['pps']['fudge1'];
-        }
-        if (!empty($config['ntpd']['pps']['flag2'])) {
-            $ntpcfg .= ' flag2 1';
-        }
-        if (!empty($config['ntpd']['pps']['flag3'])) {
-            $ntpcfg .= ' flag3 1';
-        } else{
-            $ntpcfg .= ' flag3 0';
-        }
-        if (!empty($config['ntpd']['pps']['flag4'])) {
-            $ntpcfg .= ' flag4 1';
-        }
-        if (!empty($config['ntpd']['pps']['refid'])) {
-            $ntpcfg .= ' refid ';
-            $ntpcfg .= $config['ntpd']['pps']['refid'];
-        }
-        $ntpcfg .= "\n";
-    }
-    /* End PPS configuration */
-
-    /* Add GPS configuration */
-    if (isset($config['ntpd']['gps']['port'])
-      && file_exists('/dev/'.$config['ntpd']['gps']['port'])
-      && system_ntp_setup_gps($config['ntpd']['gps']['port'])) {
-        $ntpcfg .= "\n";
-        $ntpcfg .= "# GPS Setup\n";
-        $ntpcfg .= 'server 127.127.20.0 mode ';
-        if (!empty($config['ntpd']['gps']['nmea']) || !empty($config['ntpd']['gps']['speed']) || !empty($config['ntpd']['gps']['subsec'])) {
-            if (!empty($config['ntpd']['gps']['nmea'])) {
-                $ntpmode = (int) $config['ntpd']['gps']['nmea'];
-            }
-            if (!empty($config['ntpd']['gps']['speed'])) {
-                $ntpmode += (int) $config['ntpd']['gps']['speed'];
-            }
-            if (!empty($config['ntpd']['gps']['subsec'])) {
-                $ntpmode += 128;
-            }
-            $ntpcfg .= (string) $ntpmode;
-        } else{
-            $ntpcfg .= '0';
-        }
-        $ntpcfg .= ' minpoll 4 maxpoll 4';
-        if (empty($config['ntpd']['gps']['prefer'])) { /*note: this one works backwards */
-            $ntpcfg .= ' prefer';
-        }
-        if (!empty($config['ntpd']['gps']['noselect'])) {
-            $ntpcfg .= ' noselect ';
-        }
-        $ntpcfg .= "\n";
-        $ntpcfg .= 'fudge 127.127.20.0';
-        if (!empty($config['ntpd']['gps']['fudge1'])) {
-            $ntpcfg .= ' time1 ';
-            $ntpcfg .= $config['ntpd']['gps']['fudge1'];
-        }
-        if (!empty($config['ntpd']['gps']['fudge2'])) {
-            $ntpcfg .= ' time2 ';
-            $ntpcfg .= $config['ntpd']['gps']['fudge2'];
-        }
-        if (!empty($config['ntpd']['gps']['flag1'])) {
-            $ntpcfg .= ' flag1 1';
-        } else{
-            $ntpcfg .= ' flag1 0';
-        }
-        if (!empty($config['ntpd']['gps']['flag2'])) {
-            $ntpcfg .= ' flag2 1';
-        }
-        if (!empty($config['ntpd']['gps']['flag3'])) {
-            $ntpcfg .= ' flag3 1';
-        } else{
-            $ntpcfg .= ' flag3 0';
-        }
-        if (!empty($config['ntpd']['gps']['flag4'])) {
-            $ntpcfg .= ' flag4 1';
-        }
-        if (!empty($config['ntpd']['gps']['refid'])) {
-            $ntpcfg .= ' refid ';
-            $ntpcfg .= $config['ntpd']['gps']['refid'];
-        }
-        $ntpcfg .= "\n";
-    }
-    /* End GPS configuration */
-
-    $noselect = isset($config['ntpd']['noselect']) ? explode(' ', $config['ntpd']['noselect']) : array();
-    $prefer = isset($config['ntpd']['prefer']) ? explode(' ', $config['ntpd']['prefer']) : array();
-
-    $ntpcfg .= "\n\n# Upstream Servers\n";
-    /* foreach through ntp servers and write out to ntpd.conf */
-    foreach (explode(' ', $config['system']['timeservers']) as $ts) {
-        $ntpcfg .= "server {$ts} iburst maxpoll 9";
-        if (in_array($ts, $prefer)) {
-            $ntpcfg .= ' prefer';
-        }
-        if (in_array($ts, $noselect)) {
-            $ntpcfg .= ' noselect';
-        }
-        $ntpcfg .= "\n";
-    }
-    unset($ts);
-
-    $ntpcfg .= "\n\n";
-    $ntpcfg .= "disable monitor\n"; //prevent NTP reflection attack, see https://ics-cert.us-cert.gov/advisories/ICSA-14-051-04
-    if (!empty($config['ntpd']['clockstats']) || !empty($config['ntpd']['loopstats']) || !empty($config['ntpd']['peerstats'])) {
-        $ntpcfg .= "enable stats\n";
-        $ntpcfg .= 'statistics';
-        if (!empty($config['ntpd']['clockstats'])) {
-            $ntpcfg .= ' clockstats';
-        }
-        if (!empty($config['ntpd']['loopstats'])) {
-            $ntpcfg .= ' loopstats';
-        }
-        if (!empty($config['ntpd']['peerstats'])) {
-            $ntpcfg .= ' peerstats';
-        }
-        $ntpcfg .= "\n";
-    }
-    $ntpcfg .= "statsdir {$statsdir}\n";
-    $ntpcfg .= 'logconfig =syncall +clockall';
-    if (!empty($config['ntpd']['logpeer'])) {
-        $ntpcfg .= ' +peerall';
-    }
-    if (!empty($config['ntpd']['logsys'])) {
-        $ntpcfg .= ' +sysall';
-    }
-    $ntpcfg .= "\n";
-    $ntpcfg .= "driftfile {$driftfile}\n";
-    /* Access restrictions */
-    $ntpcfg .= 'restrict default';
-    if (empty($config['ntpd']['kod'])) { /*note: this one works backwards */
-        $ntpcfg .= ' kod limited';
-    }
-    if (empty($config['ntpd']['nomodify'])) { /*note: this one works backwards */
-        $ntpcfg .= ' nomodify';
-    }
-    if (!empty($config['ntpd']['noquery'])) {
-        $ntpcfg .= ' noquery';
-    }
-    if (empty($config['ntpd']['nopeer'])) { /*note: this one works backwards */
-        $ntpcfg .= ' nopeer';
-    }
-    if (empty($config['ntpd']['notrap'])) { /*note: this one works backwards */
-        $ntpcfg .= ' notrap';
-    }
-    if (!empty($config['ntpd']['noserve'])) {
-        $ntpcfg .= ' noserve';
-    }
-    $ntpcfg .= "\nrestrict -6 default";
-    if (empty($config['ntpd']['kod'])) { /*note: this one works backwards */
-        $ntpcfg .= ' kod limited';
-    }
-    if (empty($config['ntpd']['nomodify'])) { /*note: this one works backwards */
-        $ntpcfg .= ' nomodify';
-    }
-    if (!empty($config['ntpd']['noquery'])) {
-        $ntpcfg .= ' noquery';
-    }
-    if (empty($config['ntpd']['nopeer'])) { /*note: this one works backwards */
-        $ntpcfg .= ' nopeer';
-    }
-    if (!empty($config['ntpd']['noserve'])) {
-        $ntpcfg .= ' noserve';
-    }
-    if (empty($config['ntpd']['notrap'])) { /*note: this one works backwards */
-        $ntpcfg .= ' notrap';
-    }
-    $ntpcfg .= "\n";
-
-    /* A leapseconds file is really only useful if this clock is stratum 1 */
-    $ntpcfg .= "\n";
-    if (!empty($config['ntpd']['leapsec'])) {
-        $leapsec .= base64_decode($config['ntpd']['leapsec']);
-        file_put_contents('/var/db/leap-seconds', $leapsec);
-        $ntpcfg .= "leapfile /var/db/leap-seconds\n";
-    }
-
-
-    $interfaces = array();
-    if (isset($config['ntpd']['interface'])) {
-        $interfaces = explode(',', $config['ntpd']['interface']);
-    }
-
-    if (is_array($interfaces) && count($interfaces)) {
-        $ntpcfg .= "interface ignore all\n";
-        foreach ($interfaces as $interface) {
-            if (!is_ipaddr($interface)) {
-                $interface = get_real_interface($interface);
-            }
-            if (!empty($interface)) {
-                $ntpcfg .= "interface listen {$interface}\n";
-            }
-        }
-    }
-
-    /* open configuration for wrting or bail */
-    if (!@file_put_contents('/var/etc/ntpd.conf', $ntpcfg)) {
-        log_error("Could not open /var/etc/ntpd.conf for writing");
-        return;
-    }
-
-    if (!$start_ntpd) {
-        /* write out the config and delay startup */
-        mwexec_bg('/usr/local/sbin/ntpdate_sync_once.sh');
-        return;
-    }
-
-    /* if /var/empty does not exist, create it */
-    @mkdir('/var/empty', 0775, true);
-
-    /* start opentpd, set time now and use new config */
-    mwexecf(
-      '/usr/local/sbin/ntpd -g -c %s -p %s',
-      array('/var/etc/ntpd.conf', '/var/run/ntpd.pid')
-    );
-
-    // Note that we are starting up
-    log_error("NTPD is starting up.");
-}
-
 function system_halt($sync = false)
 {
     $cmd ='/usr/local/etc/rc.halt';

src/etc/rc.bootup

@@ -184,11 +184,6 @@ services_dnsmasq_configure(true);
 /* start unbound service */
 services_unbound_configure(true);
 
-/* Do an initial time sync */
-echo "Starting NTP time client...";
-system_ntp_configure(false);
-echo "done.\n";
-
 /* start DHCP service */
 services_dhcpd_configure();
 

src/etc/rc.newwanip

@@ -215,9 +215,6 @@ if (!is_ipaddr($oldip) || $curwanip != $oldip || !is_ipaddrv4($config['interface
     if (function_exists('plugins_configure')) {
         plugins_configure('interface');
     }
-
-    /* reconfigure ntpd */
-    system_ntp_configure(false);
 }
 
 /* reload filter, don't try to sync to carp slave */

src/etc/rc.newwanipv6

@@ -152,8 +152,9 @@ if (ipsec_configured_on_interface($interface)) {
 }
 
 /* start OpenVPN server & clients */
-if (substr($interface_real, 0, 4) != "ovpn")
+if (substr($interface_real, 0, 4) != 'ovpn') {
 	openvpn_resync_all($interface);
+}
 
 /* reload graphing functions */
 enable_rrd_graphing();
@@ -162,6 +163,3 @@ enable_rrd_graphing();
 if (function_exists('plugins_configure')) {
     plugins_configure('interface');
 }
-
-/* reconfigure ntpd */
-system_ntp_configure(false);

src/etc/rc.reload_all

@@ -54,9 +54,12 @@ system_routing_enable();
 interfaces_configure();
 services_dyndns_configure();
 system_cron_configure();
-system_ntp_configure();
 mwexec_bg('/usr/local/etc/rc.sshd');
 mwexec_bg('/usr/local/etc/rc.restart_webgui');
 
+if (function_exists('plugins_configure')) {
+    plugins_configure('local');
+}
+
 log_error("rc.reload_all: Reloading filter configuration.");
 filter_configure_sync();

src/www/services_ntpd.php

@@ -33,6 +33,7 @@ require_once("rrd.inc");
 require_once("services.inc");
 require_once("system.inc");
 require_once("interfaces.inc");
+require_once("plugins.inc.d/ntpd.inc");
 
 if (!isset($config['ntpd']) || !is_array($config['ntpd'])) {
     $config['ntpd'] = array();
@@ -113,7 +114,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
             $a_ntpd['leapsec'] = base64_encode(file_get_contents($_FILES['leapfile']['tmp_name']));
         }
         write_config("Updated NTP Server Settings");
-        system_ntp_configure();
+        ntpd_configure_start();
         header(url_safe('Location: /services_ntpd.php'));
         exit;
     }

src/www/services_ntpd_gps.php

@@ -32,6 +32,7 @@ require_once("guiconfig.inc");
 require_once("services.inc");
 require_once("system.inc");
 require_once("interfaces.inc");
+require_once("plugins.inc.d/ntpd.inc");
 
 if (!isset($config['ntpd']['gps'])) {
     $config['ntpd']['gps'] = array();
@@ -67,7 +68,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
         $gps['initcmd']= base64_encode($gps['initcmd']);
         $config['ntpd']['gps'] = $gps;
         write_config("Updated NTP GPS Settings");
-        system_ntp_configure();
+        ntpd_configure_start();
         header(url_safe('Location: /services_ntpd_gps.php'));
         exit;
     }

src/www/services_ntpd_pps.php

@@ -31,6 +31,7 @@ require_once("guiconfig.inc");
 require_once("services.inc");
 require_once("system.inc");
 require_once("interfaces.inc");
+require_once("plugins.inc.d/ntpd.inc");
 
 if (!isset($config['ntpd']) || !is_array($config['ntpd'])) {
     $config['ntpd'] = array();
@@ -39,7 +40,6 @@ if (!isset($config['ntpd']['pps'])) {
     $config['ntpd']['pps'] = array();
 }
 
-
 $copy_fields = array('port', 'fudge1', 'stratum', 'flag2', 'flag3', 'flag4', 'refid');
 if ($_SERVER['REQUEST_METHOD'] === 'GET') {
     $pconfig = array();
@@ -66,7 +66,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
         }
         $config['ntpd']['pps'] = $pps;
         write_config("Updated NTP PPS Settings");
-        system_ntp_configure();
+        ntpd_configure_start();
         header(url_safe('Location: /services_ntpd_pps.php'));
         exit;
     }