000

#! /usr/bin/python3
# -*- coding: utf-8 -*-
"""
ntpdig - simple SNTP client

"""
# SPDX-License-Identifier: BSD-2-Clause
# This code runs identically under Python 2 and Python 3. Keep it that way!
from __future__ import print_function, division
import getopt
import math
import select
import socket
import sys
import time

try:
    import ntp.magic
    import ntp.packet
    import ntp.util
except ImportError as e:
    sys.stderr.write(
        "ntpdig: can't find Python NTP library -- check PYTHONPATH.\n")
    sys.stderr.write("%s\n" % e)
    sys.exit(1)
# This code is somewhat stripped down from the legacy C version.  It
# does however have one additional major feature; it can filter
# out falsetickers from multiple samples, like the ntpdate of old,
# rather than just taking the first reply it gets.
#
# Listening to broadcast addresses is not implemented because that is
# impossible to secure. KOD recording is also not implemented, as it
# can too easily be spammed.  Thus, the options -b and -K are not
# implemented.
#
# There are no version 3 NTP servers left, so the -o version for setting
# NTP version has been omitted.
#
# Because ntpdig doesn't use symmetric-peer mode (it never did, and NTPsec has
# abolished that mode because it was a security hazard), there's no need to
# set the packet source port, so -r/--usereservedport has been dropped.
# If this option ever needs to be reinstated, the magic is described here:
# http://stackoverflow.com/questions/2694212/socket-set-source-port-number
# and would be s.bind(('', 123)) right after the socket creation.
#
# The -w/--wait and -W/--nowait options only made sense with asynchronous
# DNS.  Asynchronous DNS was absurd overkill for this application, we are
# not looking up 20,000 hosts here.  It has not been implemented, so neither
# have these options.
#
# Finally, logging to syslog by default was a design error, violating
# Unix principles, that has been fixed. To get this behavior when
# running in a script, redirect standard error to logger(1).
#
# The one new option in this version is -p, borrowed from ntpdate.

def read_append(s, packets, packet, sockaddr):
    d, a = s.recvfrom(1024)
    if debug >= 2:
        ntp.packet.dump_hex_printable(d)
    if credentials:
        if not ntp.packet.Authenticator.have_mac(d):
            if debug:
                log("no MAC on reply from %s" % packet.hostname)
        if not credentials.verify_mac(d, packet_end=48, mac_begin=48):
            packet.trusted = False
            log("MAC verification on reply from %s failed"
                % sockaddr[0])
        elif debug:
            log("MAC verification on reply from %s succeeded"
                % sockaddr[0])
    pkt = ntp.packet.SyncPacket(d)
    pkt.hostname = server
    pkt.resolved = sockaddr[0]
    packets.append(pkt)
    return packets

def queryhost(server, concurrent, timeout=5, port=123):
    "Query IP addresses associated with a specified host."
    try:
        iptuples = socket.getaddrinfo(server, port,
                                      af, socket.SOCK_DGRAM,
                                      socket.IPPROTO_UDP)
    except socket.gaierror as e:
        log("lookup of %s failed, errno %d = %s" % (server, e.args[0], e.args[1]))
        return []
    sockets = []
    packets = []
    request = ntp.packet.SyncPacket()
    request.transmit_timestamp = ntp.packet.SyncPacket.posix_to_ntp(
        time.time())
    packet = request.flatten()
    needgap = (len(iptuples) > 1) and (gap > 0)
    firstloop = True
    for (family, socktype, proto, canonname, sockaddr) in iptuples:
        if needgap and not firstloop:
            time.sleep(gap)
        if firstloop:
            firstloop = False
        if debug:
            log("querying %s (%s)" % (sockaddr[0], server))
        s = socket.socket(family, socktype)
        if keyid and keytype and passwd:
            if debug:
                log("authenticating with %s key %d" % (keytype, keyid))
            mac = ntp.packet.Authenticator.compute_mac(packet,
                                                       keyid, keytype, passwd)
            if mac is None:
                log("MAC generation failed while querying %s" % server)
                raise SystemExit(1)
            else:
                packet += mac
        try:
            s.sendto(packet, sockaddr)
        except socket.error as e:
            if debug:
                log("socket error on transmission: %s" % e)
            continue
        if debug >= 2:
            log("Sent to %s:" % (sockaddr[0],))
            ntp.packet.dump_hex_printable(packet)
        if concurrent:
            sockets.append(s)
        else:
            r, _, _ = select.select([s], [], [], timeout)
            if r:
                read_append(s, packets, packet, sockaddr)
        while sockets:
            r, _, _ = select.select(sockets, [], [], timeout)
            if not r:
                return packets
            for s in sockets:
                read_append(s, packets, packet, sockaddr)
                sockets.remove(s)
    return packets

def clock_select(packets):
    "Select the pick-of-the-litter clock from the samples we've got."
    # This is a slightly simplified version of the filter ntpdate used
    NTP_INFIN = 15          # max stratum, infinity a la Bellman-Ford

# This first chunk of code is supposed to go through all
    # servers we know about to find the servers that
    # are most likely to succeed. We run through the list
    # doing the sanity checks and trying to insert anyone who
    # looks okay. We are at all times aware that we should
    # only keep samples from the top two strata.
    #
    filtered = []
    for response in packets:
        def drop(msg):
            log("%s: Response dropped: %s" % (response.hostname, msg))
        if response.stratum > NTP_INFIN:
            drop("stratum too high")
            continue
        if response.version() < ntp.magic.NTP_OLDVERSION:
            drop("response version %d is too old" % response.version())
            continue
        if response.mode() != ntp.magic.MODE_SERVER:
            drop("unexpected response mode %d" % response.mode())
            continue
        if response.version() > ntp.magic.NTP_VERSION:
            drop("response version %d is too new" % response.version())
            continue
        if response.stratum == 0:
            # FIXME: Do some kind of semi-useful diagnostic dump here
            drop("stratum 0, probable KOD packet")
            continue
        if response.leap() == "unsync":
            drop("leap not in sync")
            continue
        if not response.trusted:
            drop("request was authenticated but server is untrusted")
            continue
        # Bypass this test if we ever support broadcast-client mode again
        if response.origin_timestamp == 0:
            drop("unexpected response timestamp")
            continue
        filtered.append(response)

if len(filtered) <= 1:
        return filtered

# Sort by stratum and other figures of merit
    filtered.sort(key=lambda s: (s.stratum, s.synchd(), s.root_delay))

# Return the best
    return filtered[:1]

def report(packet, json):
    "Report on the SNTP packet selected for display, and its adjustment."
    say = sys.stdout.write

packet.posixize()

# The server's idea of the time
    t = time.localtime(int(packet.transmit_timestamp))
    ms = int(packet.transmit_timestamp * 1000000) % 1000000

if t.tm_isdst:
        tmoffset = -time.altzone // 60  # In minutes
    else:
        tmoffset = -time.timezone // 60  # In minutes

# Number of decimal digits of precision indicated by the precision field
    digits = min(6, -int(math.log10(2**packet.precision)))

date = time.strftime("%Y-%m-%d", t)
    tod = time.strftime("%T", t) + (".%-*d" % (digits, ms)).rstrip()
    sgn = ("%+d" % tmoffset)[0]
    tz = "%s%02d%02d" % (sgn, abs(tmoffset) // 60, tmoffset % 60)

if json:
        say('{"time":"%sT%s%s","offset":%f,"precision":%f,"host":"%s",'
            '"ip":"%s","stratum":%s,"leap":"%s","adjusted":%s}\n'
            % (date, tod, tz,
               packet.adjust(), packet.synchd(),
               packet.hostname, packet.resolved or packet.hostname,
               packet.stratum, packet.leap(),
               "true" if adjusted else "false"))
    else:
        say("%s %s (%s) %+f +/- %f %s"
            % (date, tod, tz,
               packet.adjust(), packet.synchd(),
               packet.hostname))
        if packet.resolved and packet.resolved != packet.hostname:
            say(" " + packet.resolved)
        say(" s%d %s\n" % (packet.stratum, packet.leap()))

usage = """
USAGE:  ntpdig [-<flag> [<val>] | --<name>[{=| }<val>]]...
                [ hostname-or-IP ...]
  Flg Arg Option-Name     Description
   -4 no  ipv4           Force IPv4 DNS name resolution
                                - prohibits the option 'ipv6'
   -6 no  ipv6           Force IPv6 DNS name resolution
                                - prohibits the option 'ipv4'
   -a Num authentication  Enable authentication with the numbered key
   -c yes concurrent      Hosts to be queried concurrently
   -d no  debug           Increase debug verbosity
   -D yes set-debug-level Set debug verbosity
   -g yes gap             Set gap between requests in milliseconds
   -j no  json            Use JSON output format
   -l Str logfile         Log to specified logfile
                                 - prohibits the option 'syslog'
   -p yes samples         Number of samples to take (default 1)
   -S no  step            Set (step) the time with clock_settime()
                                 - prohibits the option 'step'
   -s no  slew            Set (slew) the time with adjtime()
                                 - prohibits the option 'slew'
   -t Num timeout         Request timeout in seconds (default 5)
   -k Str keyfile         Specify a keyfile. ntpdig will look in this file
                          for the key specified with -a
   -V no version          Output version information and exit
   -h no  help            Display extended usage information and exit
"""

if __name__ == '__main__':
    bin_ver = "ntpsec-1.2.2"
    if ntp.util.stdversion() != bin_ver:
        sys.stderr.write("Module/Binary version mismatch\n")
        sys.stderr.write("Binary: %s\n" % bin_ver)
        sys.stderr.write("Module: %s\n" % ntp.util.stdversion())
    try:
        try:
            (options, arguments) = getopt.getopt(
                sys.argv[1:],
                "46a:c:dD:g:hjk:l:M:o:p:r:Sst:wWV",
                ["ipv4", "ipv6",
                 "authentication=",
                 "concurrent=",
                 "gap=", "help", "json",
                 "keyfile=", "logfile=",
                 "replay=",
                 "samples=", "steplimit=",
                 "step", "slew",
                 "timeout=",
                 "debug", "set-debug-level=",
                 "version"])
        except getopt.GetoptError as e:
            print(e)
            raise SystemExit(1)
        progname = sys.argv[0]

logfp = sys.stderr
        log = lambda m: logfp.write("ntpdig: %s\n" % m)

af = socket.AF_UNSPEC
        authkey = None
        concurrent_hosts = []
        debug = 0
        gap = .05
        json = False
        keyfile = None
        steplimit = 0       # Default is intentionally zero
        samples = 1
        step = False
        slew = False
        timeout = 5
        replay = None
        try:
            for (switch, val) in options:
                if switch in ("-4", "--ipv4"):
                    af = socket.AF_INET
                elif switch in ("-6", "--ipv6"):
                    af = socket.AF_INET6
                elif switch in ("-a", "--authentication"):
                    errmsg = "Error: -a parameter '%s' not a number\n"
                    authkey = ntp.util.safeargcast(val, int, errmsg, usage)
                elif switch in ("-c", "--concurrent"):
                    concurrent_hosts.append(val)
                elif switch in ("-d", "--debug"):
                    debug += 1
                elif switch in ("-D", "--set-debug-level"):
                    errmsg = "Error: -D parameter '%s' not a number\n"
                    debug = ntp.util.safeargcast(val, int, errmsg, usage)
                elif switch in ("-g", "--gap"):
                    errmsg = "Error: -g parameter '%s' not a number\n"
                    gap = ntp.util.safeargcast(val, int, errmsg, usage)
                elif switch in ("-j", "--json"):
                    json = True
                elif switch in ("-k", "--keyfile"):
                    keyfile = val
                elif switch in ("-l", "--logfile"):
                    try:
                        logfp = open(val, "w")
                    except OSError:
                        sys.stderr.write("logfile open of %s failed.\n" % val)
                        raise SystemExit(1)
                elif switch in ("-M", "--steplimit"):
                    errmsg = "Error: -M parameter '%s' not a number\n"
                    steplimit = ntp.util.safeargcast(val, int, errmsg, usage)
                    steplimit /= 1000.0
                elif switch in ("-p", "--samples"):
                    errmsg = "Error: -p parameter '%s' not a number\n"
                    samples = ntp.util.safeargcast(val, int, errmsg, usage)
                    if samples < 1:  # If <1 it won't run at all
                        samples = 1
                elif switch in ('-r', "--replay"):
                    replay = val
                elif switch in ("-S", "--step"):
                    step = True
                elif switch in ("-s", "--slew"):
                    slew = True
                elif switch in ("-t", "--timeout"):
                    errmsg = "Error: -t parameter '%s' not a number\n"
                    timeout = ntp.util.safeargcast(val, int, errmsg, usage)
                elif switch in ("-h", "--help"):
                    print(usage)
                    raise SystemExit(0)
                elif switch in ("-V", "--version"):
                    print("ntpdig %s" % bin_ver)
                    raise SystemExit(0)
                else:
                    sys.stderr.write(
                        "Unknown command line switch or missing argument.\n")
                    sys.stderr.write(usage)
                    raise SystemExit(1)
        except ValueError:
            sys.stderr.write("Invalid argument.\n")
            sys.stderr.write(usage)
            raise SystemExit(1)

gap /= 1000  # convert to milliseconds

credentials = keyid = keytype = passwd = None
        try:
            credentials = ntp.packet.Authenticator(keyfile)
        except (OSError, IOError):
            sys.stderr.write("ntpdig: %s nonexistent or unreadable\n" %
                             keyfile)
            raise SystemExit(1)
        if credentials:
            try:
                (keyid, keytype, passwd) = credentials.control(authkey)
            except ValueError:
                # There are no trusted keys.  Barf.
                log("cannot get authentication key")
                raise SystemExit(1)

if not credentials and authkey and keyfile is None:
            sys.stderr.write("-a option requires -k.\n")
            raise SystemExit(1)

if not arguments:
            arguments = ["localhost"]

if replay:
            (pkt, dst) = replay.split(":")
            packet = ntp.packet.SyncPacket(pkt.decode("hex"))
            packet.received = ntp.packet.SyncPacket.posix_to_ntp(float(dst))
            returned = [packet]
        else:
            returned = []
            needgap = (samples > 1) and (gap > 0)
            firstloop = True
            for s in range(samples):
                if needgap and not firstloop:
                    time.sleep(gap)
                if firstloop:
                    firstloop = False
                for server in concurrent_hosts:
                    try:
                        returned += queryhost(server=server,
                                              concurrent=True,
                                              timeout=timeout)
                    except ntp.packet.SyncException as e:
                        log(str(e))
                        continue
                for server in arguments:
                    try:
                        returned += queryhost(server=server,
                                              concurrent=False,
                                              timeout=timeout)
                    except ntp.packet.SyncException as e:
                        log(str(e))
                        continue

returned = clock_select(returned)

if returned:
            pkt = returned[0]
            if debug:
                # print(repr(pkt))
                def hexstamp(n):
                    return "%08x.%08x" % (n >> 32, n & 0x00000000ffffffff)
                print("org t1: %s rec t2: %s"
                      % (hexstamp(pkt.t1()), hexstamp(pkt.t2())))
                print("xmt t3: %s dst t4: %s"
                      % (hexstamp(pkt.t3()), hexstamp(pkt.t4())))
            pkt.posixize()
            if debug:
                print("org t1: %f rec t2: %f" % (pkt.t1(), pkt.t2()))
                print("xmt t3: %f dst t4: %f" % (pkt.t3(), pkt.t4()))
                print("rec-org t21: %f  xmt-dst t34: %f"
                      % (pkt.t2() - pkt.t1(), pkt.t3() - pkt.t4()))
            offset = pkt.adjust()
            adjusted = (step and
                        (not slew or (slew and (abs(offset) > steplimit))))
            report(pkt, json)
            # If we can step but we cannot slew, then step.
            # If we can step or slew and |offset| > steplimit, then step.
            rc = True
            ntp.ntpc.setprogname("ntpdig")
            if adjusted:
                rc = ntp.ntpc.step_systime(offset)
            elif slew:
                rc = ntp.ntpc.adj_systime(offset)
            if rc:
                raise SystemExit(0)
            else:
                raise SystemExit(1)
        else:
            log("no eligible servers")
            raise SystemExit(1)
    except KeyboardInterrupt:
        print("")

# end