/*
* Calendar arithmetic - contributed by G. Healton
*/
#define YEAR_BREAK 500 /* years < this are tm_year values:
* Break < AnyFourDigitYear && Break >
* Anytm_yearYear */
#define YEAR_PIVOT 98 /* 97/98: years < this are year 2000+
* FYI: official UNIX pivot year is
* 68/69 */
/*
* Number of Days since 1 BC Gregorian to 1 January of given year
*/
#define julian0(year) (((year) * 365 ) + ((year) > 0 ? (((year) + 3) \
/ 4 - ((year - 1) / 100) + ((year - 1) / \
400)) : 0))
/*
* Number of days since start of NTP time to 1 January of given year
*/
#define ntp0(year) (julian0(year) - julian0(1900))
/*
* Number of days since start of UNIX time to 1 January of given year
*/
#define unix0(year) (julian0(year) - julian0(1970))
/*
* LEAP YEAR test for full 4-digit years (e.g, 1999, 2010)
*/
#define isleap_4(y) ((y) % 4 == 0 && !((y) % 100 == 0 && !(y % \
400 == 0)))
/*
* LEAP YEAR test for tm_year (struct tm) years (e.g, 99, 110)
*/
#define isleap_tm(y) ((y) % 4 == 0 && !((y) % 100 == 0 && !(((y) \
+ 1900) % 400 == 0)))
/*
* to convert simple two-digit years to tm_year style years:
*
* if (year < YEAR_PIVOT)
* year += 100;
*
* to convert either two-digit OR tm_year years to four-digit years:
*
* if (year < YEAR_PIVOT)
* year += 100;
*
* if (year < YEAR_BREAK)
* year += 1900;
*/
/*
* How to get signed characters. On machines where signed char works,
* use it. On machines where signed char doesn't work, char had better
* be signed.
*/
#ifdef NEED_S_CHAR_TYPEDEF
# if SIZEOF_SIGNED_CHAR
typedef signed char s_char;
# else
typedef char s_char;
# endif
/* XXX: Why is this sequent bit INSIDE this test? */
# ifdef sequent
# undef SO_RCVBUF
# undef SO_SNDBUF
# endif
#endif
/*
* NTP protocol parameters. See section 3.2.6 of the specification.
*/
#define NTP_VERSION ((u_char)4) /* current version number */
#define NTP_OLDVERSION ((u_char)1) /* oldest credible version */
#define NTP_PORT 123 /* included for non-unix machines */
/*
* Poll interval parameters
*/
#define NTP_UNREACH 10 /* poll unreach threshold */
#define NTP_MINPOLL 3 /* log2 min poll interval (8 s) */
#define NTP_MINDPOLL 6 /* log2 default min poll (64 s) */
#define NTP_MAXDPOLL 10 /* log2 default max poll (~17 m) */
#define NTP_MAXPOLL 17 /* log2 max poll interval (~36 h) */
#define NTP_RETRY 3 /* max packet retries */
#define NTP_MINPKT 2 /* guard time (s) */
/*
* Miscellaneous stuff
*/
#define NTP_MAXKEY 65535 /* max authentication key number */
/*
* Limits of things
*/
#define MAXFILENAME 256 /* max length of file name */
#define MAXHOSTNAME 512 /* max length of host/node name */
#define NTP_MAXSTRLEN 256 /* max string length */
/*
* Operations for jitter calculations (these use doubles).
*
* Note that we carefully separate the jitter component from the
* dispersion component (frequency error plus precision). The frequency
* error component is computed as CLOCK_PHI times the difference between
* the epoch of the time measurement and the reference time. The
* precision component is computed as the square root of the mean of the
* squares of a zero-mean, uniform distribution of unit maximum
* amplitude. Whether this makes statistical sense may be arguable.
*/
#define SQUARE(x) ((x) * (x))
#define SQRT(x) (sqrt(x))
#define DIFF(x, y) (SQUARE((x) - (y)))
#define LOGTOD(a) ldexp(1., (int)(a)) /* log2 to double */
#define UNIVAR(x) (SQUARE(.28867513 * LOGTOD(x))) /* std uniform distr */
#define ULOGTOD(a) ldexp(1., (int)(a)) /* ulog2 to double */
#define EVENT_TIMEOUT 0 /* one second, that is */
/*
* The interface structure is used to hold the addresses and socket
* numbers of each of the local network addresses we are using.
* Because "interface" is a reserved word in C++ and has so many
* varied meanings, a change to "endpt" (via typedef) is under way.
* Eventually the struct tag will change from interface to endpt_tag.
* endpt is unrelated to the select algorithm's struct endpoint.
*/
typedef struct endpt_tag endpt;
struct endpt_tag {
endpt * elink; /* endpt list link */
endpt * mclink; /* per-AF_* multicast list */
void * ioreg_ctx; /* IO registration context */
SOCKET fd; /* socket descriptor */
SOCKET bfd; /* for receiving broadcasts */
u_int32 ifnum; /* endpt instance count */
sockaddr_u sin; /* unicast address */
sockaddr_u mask; /* subnet mask */
sockaddr_u bcast; /* broadcast address */
char name[32]; /* name of interface */
u_short family; /* AF_INET/AF_INET6 */
u_short phase; /* phase in update cycle */
u_int32 flags; /* INT_ flags */
int last_ttl; /* last TTL specified */
u_int32 addr_refid; /* IPv4 addr or IPv6 hash */
# ifdef WORDS_BIGENDIAN
u_int32 old_refid; /* byte-swapped IPv6 refid */
# endif
int num_mcast; /* mcast addrs enabled */
u_long starttime; /* current_time at creation */
volatile long received; /* number of incoming packets */
long sent; /* number of outgoing packets */
long notsent; /* number of send failures */
u_int ifindex; /* for IPV6_MULTICAST_IF */
isc_boolean_t ignore_packets; /* listen-read-drop this? */
struct peer * peers; /* list of peers using endpt */
u_int peercnt; /* count of same */
};
/*
* Flags for network endpoints (interfaces or really addresses)
*/
#define INT_UP 0x001 /* Interface is up */
#define INT_PPP 0x002 /* Point-to-point interface */
#define INT_LOOPBACK 0x004 /* ::1 or 127.0.0.1 */
#define INT_BROADCAST 0x008 /* can broadcast out this interface */
#define INT_MULTICAST 0x010 /* can multicast out this interface */
#define INT_BCASTOPEN 0x020 /* broadcast receive socket is open */
#define INT_MCASTOPEN 0x040 /* multicasting enabled */
#define INT_WILDCARD 0x080 /* wildcard interface - usually skipped */
#define INT_MCASTIF 0x100 /* bound directly to MCAST address */
#define INT_PRIVACY 0x200 /* RFC 4941 IPv6 privacy address */
#define INT_BCASTXMIT 0x400 /* socket setup to allow broadcasts */
#define INT_LL_OF_GLOB 0x800 /* IPv6 link-local duplicate of global */
/*
* Define flasher bits (tests 1 through 11 in packet procedure)
* These reveal the state at the last grumble from the peer and are
* most handy for diagnosing problems, even if not strictly a state
* variable in the spec. These are recorded in the peer structure.
*
* Packet errors
*/
#define TEST1 0X0001 /* duplicate packet */
#define TEST2 0x0002 /* bogus packet */
#define TEST3 0x0004 /* protocol unsynchronized */
#define TEST4 0x0008 /* access denied */
#define TEST5 0x0010 /* bad authentication */
#define TEST6 0x0020 /* bad synch or stratum */
#define TEST7 0x0040 /* bad header */
#define TEST8 0x0080 /* bad autokey */
#define TEST9 0x0100 /* bad crypto */
#define PKT_TEST_MASK (TEST1 | TEST2 | TEST3 | TEST4 | TEST5 |\
TEST6 | TEST7 | TEST8 | TEST9)
/*
* Peer errors
*/
#define TEST10 0x0200 /* peer bad synch or stratum */
#define TEST11 0x0400 /* peer distance exceeded */
#define TEST12 0x0800 /* peer synchronization loop */
#define TEST13 0x1000 /* peer unreacable */
#define PEER_TEST_MASK (TEST10 | TEST11 | TEST12 | TEST13)
/*
* The peer structure. Holds state information relating to the guys
* we are peering with. Most of this stuff is from section 3.2 of the
* spec.
*/
struct peer {
struct peer *p_link; /* link pointer in free & peer lists */
struct peer *adr_link; /* link pointer in address hash */
struct peer *aid_link; /* link pointer in associd hash */
struct peer *ilink; /* list of peers for interface */
sockaddr_u srcadr; /* address of remote host */
char * hostname; /* if non-NULL, remote name */
struct addrinfo *addrs; /* hostname query result */
struct addrinfo *ai; /* position within addrs */
endpt * dstadr; /* local address */
associd_t associd; /* association ID */
u_char version; /* version number */
u_char hmode; /* local association mode */
u_char hpoll; /* local poll interval */
u_char minpoll; /* min poll interval */
u_char maxpoll; /* max poll interval */
u_int flags; /* association flags */
u_char cast_flags; /* additional flags */
u_char last_event; /* last peer error code */
u_char num_events; /* number of error events */
u_int32 ttl; /* ttl/refclock mode */
char *ident; /* group identifier name */
/*
* Variables used by reference clock support
*/
#ifdef REFCLOCK
struct refclockproc *procptr; /* refclock structure pointer */
u_char refclktype; /* reference clock type */
u_char refclkunit; /* reference clock unit number */
u_char sstclktype; /* clock type for system status word */
#endif /* REFCLOCK */
/*
* Variables set by received packet
*/
u_char leap; /* local leap indicator */
u_char pmode; /* remote association mode */
u_char stratum; /* remote stratum */
u_char ppoll; /* remote poll interval */
s_char precision; /* remote clock precision */
double rootdelay; /* roundtrip delay to primary source */
double rootdisp; /* dispersion to primary source */
u_int32 refid; /* remote reference ID */
l_fp reftime; /* update epoch */
/*
* Variables used by authenticated client
*/
keyid_t keyid; /* current key ID */
#ifdef AUTOKEY
#define clear_to_zero opcode
u_int32 opcode; /* last request opcode */
associd_t assoc; /* peer association ID */
u_int32 crypto; /* peer status word */
EVP_PKEY *pkey; /* public key */
const EVP_MD *digest; /* message digest algorithm */
char *subject; /* certificate subject name */
char *issuer; /* certificate issuer name */
struct cert_info *xinfo; /* issuer certificate */
keyid_t pkeyid; /* previous key ID */
keyid_t hcookie; /* host cookie */
keyid_t pcookie; /* peer cookie */
const struct pkey_info *ident_pkey; /* identity key */
BIGNUM *iffval; /* identity challenge (IFF, GQ, MV) */
const BIGNUM *grpkey; /* identity challenge key (GQ) */
struct value cookval; /* receive cookie values */
struct value recval; /* receive autokey values */
struct exten *cmmd; /* extension pointer */
u_long refresh; /* next refresh epoch */
/*
* Variables used by authenticated server
*/
keyid_t *keylist; /* session key ID list */
int keynumber; /* current key number */
struct value encrypt; /* send encrypt values */
struct value sndval; /* send autokey values */
#else /* !AUTOKEY follows */
#define clear_to_zero status
#endif /* !AUTOKEY */
/*
* Ephemeral state variables
*/
u_char status; /* peer status */
u_char new_status; /* under-construction status */
u_char reach; /* reachability register */
u_char filter_nextpt; /* index into filter shift register */
int flash; /* protocol error test tally bits */
u_long epoch; /* reference epoch */
int burst; /* packets remaining in burst */
int retry; /* retry counter */
int flip; /* interleave mode control */
double filter_delay[NTP_SHIFT]; /* delay shift register */
double filter_offset[NTP_SHIFT]; /* offset shift register */
double filter_disp[NTP_SHIFT]; /* dispersion shift register */
u_long filter_epoch[NTP_SHIFT]; /* epoch shift register */
u_char filter_order[NTP_SHIFT]; /* filter sort index */
l_fp rec; /* receive time stamp */
l_fp xmt; /* transmit time stamp */
l_fp dst; /* destination timestamp */
l_fp aorg; /* origin timestamp */
l_fp borg; /* alternate origin timestamp */
l_fp bxmt; /* most recent broadcast transmit timestamp */
l_fp nonce; /* Value of nonce we sent as the xmt stamp */
double offset; /* peer clock offset */
double delay; /* peer roundtrip delay */
double jitter; /* peer jitter (squares) */
double disp; /* peer dispersion */
double xleave; /* interleave delay */
double bias; /* programmed offset bias */
/*
* Variables used to correct for packet length and asymmetry.
*/
double t21; /* outbound packet delay */
int t21_bytes; /* outbound packet length */
int t21_last; /* last outbound packet length */
double r21; /* outbound data rate */
double t34; /* inbound packet delay */
int t34_bytes; /* inbound packet length */
double r34; /* inbound data rate */
/*
* End of clear-to-zero area
*/
u_long update; /* receive epoch */
#define end_clear_to_zero update
int unreach; /* watchdog counter */
int throttle; /* rate control */
u_long outdate; /* send time last packet */
u_long nextdate; /* send time next packet */
/*
* Statistic counters
*/
u_long timereset; /* time stat counters were reset */
u_long timelastrec; /* last packet received time, incl. trash */
u_long timereceived; /* last (clean) packet received time */
u_long timereachable; /* last reachable/unreachable time */
u_long sent; /* packets sent */
u_long received; /* packets received */
u_long processed; /* packets processed */
u_long badauth; /* bad authentication (TEST5) */
u_long badNAK; /* invalid crypto-NAK */
u_long bogusorg; /* bogus origin (TEST2, TEST3) */
u_long oldpkt; /* old duplicate (TEST1) */
u_long seldisptoolarge; /* bad header (TEST6, TEST7) */
u_long selbroken; /* KoD received */
};
/*
* Values for peer.leap, sys_leap
*/
#define LEAP_NOWARNING 0x0 /* normal, no leap second warning */
#define LEAP_ADDSECOND 0x1 /* last minute of day has 61 seconds */
#define LEAP_DELSECOND 0x2 /* last minute of day has 59 seconds */
#define LEAP_NOTINSYNC 0x3 /* overload, clock is free running */
/*
* Values for peer mode and packet mode. Only the modes through
* MODE_BROADCAST and MODE_BCLIENT appear in the transition
* function. MODE_CONTROL and MODE_PRIVATE can appear in packets,
* but those never survive to the transition function.
*/
#define MODE_UNSPEC 0 /* unspecified (old version) */
#define MODE_ACTIVE 1 /* symmetric active mode */
#define MODE_PASSIVE 2 /* symmetric passive mode */
#define MODE_CLIENT 3 /* client mode */
#define MODE_SERVER 4 /* server mode */
#define MODE_BROADCAST 5 /* broadcast mode */
/*
* These can appear in packets
*/
#define MODE_CONTROL 6 /* control mode */
#define MODE_PRIVATE 7 /* private mode */
/*
* This is a made-up mode for broadcast client.
*/
#define MODE_BCLIENT 6 /* broadcast client mode */
/*
* Values for peer.stratum, sys_stratum
*/
#define STRATUM_REFCLOCK ((u_char)0) /* default stratum */
/* A stratum of 0 in the packet is mapped to 16 internally */
#define STRATUM_PKT_UNSPEC ((u_char)0) /* unspecified in packet */
#define STRATUM_UNSPEC ((u_char)16) /* unspecified */
/*
* Values for peer.flags (u_int)
*/
#define FLAG_CONFIG 0x0001 /* association was configured */
#define FLAG_PREEMPT 0x0002 /* preemptable association */
#define FLAG_AUTHENTIC 0x0004 /* last message was authentic */
#define FLAG_REFCLOCK 0x0008 /* this is actually a reference clock */
#define FLAG_BC_VOL 0x0010 /* broadcast client volleying */
#define FLAG_PREFER 0x0020 /* prefer peer */
#define FLAG_BURST 0x0040 /* burst mode */
#define FLAG_PPS 0x0080 /* steered by PPS */
#define FLAG_IBURST 0x0100 /* initial burst mode */
#define FLAG_NOSELECT 0x0200 /* never select */
#define FLAG_TRUE 0x0400 /* force truechimer */
#define FLAG_SKEY 0x0800 /* autokey authentication */
#define FLAG_XLEAVE 0x1000 /* interleaved protocol */
#define FLAG_XB 0x2000 /* interleaved broadcast */
#define FLAG_XBOGUS 0x4000 /* interleaved bogus packet */
#ifdef AUTOKEY
# define FLAG_ASSOC 0x8000 /* autokey request */
#endif
#define FLAG_TSTAMP_PPS 0x10000 /* PPS source provides absolute timestamp */
#define FLAG_LOOPNONCE 0x20000 /* Use a nonce for the loopback test */
#define FLAG_DISABLED 0x40000 /* peer is being torn down */
/*
* Definitions for the clear() routine. We use memset() to clear
* the parts of the peer structure which go to zero. These are
* used to calculate the start address and length of the area.
*/
#define CLEAR_TO_ZERO(p) ((char *)&((p)->clear_to_zero))
#define END_CLEAR_TO_ZERO(p) ((char *)&((p)->end_clear_to_zero))
#define LEN_CLEAR_TO_ZERO(p) (END_CLEAR_TO_ZERO(p) - CLEAR_TO_ZERO(p))
#define CRYPTO_TO_ZERO(p) ((char *)&((p)->clear_to_zero))
#define END_CRYPTO_TO_ZERO(p) ((char *)&((p)->end_clear_to_zero))
#define LEN_CRYPTO_TO_ZERO (END_CRYPTO_TO_ZERO((struct peer *)0) \
- CRYPTO_TO_ZERO((struct peer *)0))
/*
* NTP packet format. The mac field is optional. It isn't really
* an l_fp either, but for now declaring it that way is convenient.
* See Appendix A in the specification.
*
* Note that all u_fp and l_fp values arrive in network byte order
* and must be converted (except the mac, which isn't, really).
*/
struct pkt {
u_char li_vn_mode; /* peer leap indicator */
u_char stratum; /* peer stratum */
u_char ppoll; /* peer poll interval */
s_char precision; /* peer clock precision */
u_fp rootdelay; /* roundtrip delay to primary source */
u_fp rootdisp; /* dispersion to primary source*/
u_int32 refid; /* reference id */
l_fp reftime; /* last update time */
l_fp org; /* originate time stamp */
l_fp rec; /* receive time stamp */
l_fp xmt; /* transmit time stamp */
/*
* The length of the packet less MAC must be a multiple of 64
* with an RSA modulus and Diffie-Hellman prime of 256 octets
* and maximum host name of 128 octets, the maximum autokey
* command is 152 octets and maximum autokey response is 460
* octets. A packet can contain no more than one command and one
* response, so the maximum total extension field length is 864
* octets. But, to handle humungus certificates, the bank must
* be broke.
*
* The different definitions of the 'exten' field are here for
* the benefit of applications that want to send a packet from
* an auto variable in the stack - not using the AUTOKEY version
* saves 2KB of stack space. The receive buffer should ALWAYS be
* big enough to hold a full extended packet if the extension
* fields have to be parsed or skipped.
*/
#ifdef AUTOKEY
u_int32 exten[(NTP_MAXEXTEN + MAX_MAC_LEN) / sizeof(u_int32)];
#else /* !AUTOKEY follows */
u_int32 exten[(MAX_MAC_LEN) / sizeof(u_int32)];
#endif /* !AUTOKEY */
};
/*
* Stuff for extracting things from li_vn_mode
*/
#define PKT_MODE(li_vn_mode) ((u_char)((li_vn_mode) & 0x7))
#define PKT_VERSION(li_vn_mode) ((u_char)(((li_vn_mode) >> 3) & 0x7))
#define PKT_LEAP(li_vn_mode) ((u_char)(((li_vn_mode) >> 6) & 0x3))
/*
* Stuff for putting things back into li_vn_mode in packets and vn_mode
* in ntp_monitor.c's mon_entry.
*/
#define VN_MODE(v, m) ((((v) & 7) << 3) | ((m) & 0x7))
#define PKT_LI_VN_MODE(l, v, m) ((((l) & 3) << 6) | VN_MODE((v), (m)))
/*
* Dealing with stratum. 0 gets mapped to 16 incoming, and back to 0
* on output.
*/
#define PKT_TO_STRATUM(s) ((u_char)(((s) == (STRATUM_PKT_UNSPEC)) ?\
(STRATUM_UNSPEC) : (s)))
/*
* A test to determine if the refid should be interpreted as text string.
* This is usually the case for a refclock, which has stratum 0 internally,
* which results in sys_stratum 1 if the refclock becomes system peer, or
* in case of a kiss-of-death (KoD) packet that has STRATUM_PKT_UNSPEC (==0)
* in the packet which is converted to STRATUM_UNSPEC when the packet
* is evaluated.
*/
#define REFID_ISTEXT(s) (((s) <= 1) || ((s) >= STRATUM_UNSPEC))
/*
* Event codes. Used for reporting errors/events to the control module
*/
#define PEER_EVENT 0x080 /* this is a peer event */
#define CRPT_EVENT 0x100 /* this is a crypto event */
/*
* Clock event codes
*/
#define CEVNT_NOMINAL 0 /* unspecified */
#define CEVNT_TIMEOUT 1 /* no reply */
#define CEVNT_BADREPLY 2 /* bad format */
#define CEVNT_FAULT 3 /* fault */
#define CEVNT_PROP 4 /* bad signal */
#define CEVNT_BADDATE 5 /* bad date */
#define CEVNT_BADTIME 6 /* bad time */
#define CEVNT_MAX CEVNT_BADTIME
/*
* Very misplaced value. Default port through which we send traps.
*/
#define TRAPPORT 18447
/*
* To speed lookups, peers are hashed by the low order bits of the
* remote IP address. These definitions relate to that.
*/
#define NTP_HASH_SIZE 128
#define NTP_HASH_MASK (NTP_HASH_SIZE-1)
#define NTP_HASH_ADDR(src) (sock_hash(src) & NTP_HASH_MASK)
/*
* min, min3 and max. Makes it easier to transliterate the spec without
* thinking about it.
*/
#define min(a,b) (((a) < (b)) ? (a) : (b))
#define max(a,b) (((a) > (b)) ? (a) : (b))
#define min3(a,b,c) min(min((a),(b)), (c))
/* clamp a value within a range */
#define CLAMP(val, minval, maxval) \
max((minval), min((val), (maxval)))
/*
* Default parameters. We use these in the absence of something better.
*/
#define INADDR_NTP 0xe0000101 /* NTP multicast address 224.0.1.1 */
/*
* Structure used optionally for monitoring when this is turned on.
*/
typedef struct mon_data mon_entry;
struct mon_data {
mon_entry * hash_next; /* next structure in hash list */
DECL_DLIST_LINK(mon_entry, mru);/* MRU list link pointers */
endpt * lcladr; /* address on which this arrived */
l_fp first; /* first time seen */
l_fp last; /* last time seen */
int leak; /* leaky bucket accumulator */
int count; /* total packet count */
u_short flags; /* restrict flags */
u_char vn_mode; /* packet mode & version */
u_char cast_flags; /* flags MDF_?CAST */
sockaddr_u rmtadr; /* address of remote host */
};
/*
* Values for cast_flags in mon_entry and struct peer. mon_entry uses
* only the first three, MDF_UCAST, MDF_MCAST, and MDF_BCAST.
*/
#define MDF_UCAST 0x01 /* unicast client */
#define MDF_MCAST 0x02 /* multicast server */
#define MDF_BCAST 0x04 /* broadcast server */
#define MDF_POOL 0x08 /* pool client solicitor */
#define MDF_ACAST 0x10 /* manycast client solicitor */
#define MDF_BCLNT 0x20 /* eph. broadcast/multicast client */
#define MDF_PCLNT 0x40 /* preemptible pool client */
/*
* In the context of struct peer in ntpd, three of the cast_flags bits
* represent configured associations which never receive packets, and
* whose reach is always 0: MDF_BCAST, MDF_MCAST, and MDF_ACAST. The
* last can be argued as responses are received, but those responses do
* not affect the MDF_ACAST association's reach register, rather they
* (may) result in mobilizing ephemeral MDF_ACLNT associations.
*/
#define MDF_TXONLY_MASK (MDF_BCAST | MDF_MCAST | MDF_ACAST | MDF_POOL)
/*
* manycastclient-like solicitor association cast_flags bits
*/
#define MDF_SOLICIT_MASK (MDF_ACAST | MDF_POOL)
/*
* Values used with mon_enabled to indicate reason for enabling monitoring
*/
#define MON_OFF 0x00 /* no monitoring */
#define MON_ON 0x01 /* monitoring explicitly enabled */
#define MON_RES 0x02 /* implicit monitoring for RES_LIMITED */
/*
* Structure used for restrictlist entries
*/
typedef struct res_addr4_tag {
u_int32 addr; /* IPv4 addr (host order) */
u_int32 mask; /* IPv4 mask (host order) */
} res_addr4;
struct restrict_info {
u_int32 count; /* number of packets matched */
u_int32 expire; /* valid until current_time */
u_int32 mflags; /* match flags */
u_short rflags; /* restrict (accesslist) flags */
short ippeerlimit; /* limit of associations matching */
};
struct restrict_4 {
struct restrict_4 *link; /* link to next entry */
struct restrict_info ri;
res_addr4 v4;
};
struct restrict_6 {
struct restrict_6 *link; /* link to next entry */
struct restrict_info ri;
res_addr6 v6;
};
/* restrictions for (4) a given address */
typedef struct r4addr_tag r4addr;
struct r4addr_tag {
u_short rflags; /* match flags */
short ippeerlimit; /* IP peer limit */
};
/*
* Match flags (mflags)
*/
#define RESM_INTERFACE 0x1000 /* this is an interface */
#define RESM_NTPONLY 0x2000 /* match source port 123 */
#define RESM_SOURCE 0x4000 /* from "restrict source" */
