a

\��dk
�@s�
dZd
dl
mZmZ
d
dlZd
dlZd
dlZd
dlZd
dlZd
dl	Z	d
dl
Z
d
dlZd
dlZd
dl
Z
d
dlZd
dlZd
dlZd
dlZd
dlZdZdZdZdZdZd	Zd
ZdZdZGd
d�d�ZGdd�de�ZGdd�de�Z Gdd�de�Z!Gdd�d�Z"dZ#dZ$dZ%dZ&dZ'dZ(dZ)dZ*dZ+d Z,d!Z-d"Z.d#Z/d$Z0d%Z1d&Z2d'Z3d(Z4d)Z5d*Z6d+Z7d,Z8d-Z9d.Z:d/Z;ej<f
d0d1�
Z=Gd2d3�d3�Z>Gd4d5�d5�Z?Gd6d7�d7e�Z@Gd8d9�d9�ZAd:d;�ZBd<d=�ZCd>d?�ZDd@dA�ZEdBdC�ZFGdDdE�dE�ZGdS)Fa(
packet.py - definitions and classes for Python querying of NTP

Freely translated from the old C ntpq code by ESR, with comments
preserved.  The idea was to cleanly separate ntpq-that-was into a
thin front-end layer handling mainly command interpretation and a
back-end that presents the take from ntpd as objects that can be
re-used by other front ends. Other reusable pieces live in util.py.

This code should be Python2-vs-Python-3 agnostic.  Keep it that way!

Here are some pictures to help make sense of this code. First, from RFC 5905,
the general structure of an NTP packet (Figure 8):

       0                   1                   2                   3
       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |LI | VN  |Mode |    Stratum    |     Poll      |  Precision    |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                         Root Delay                            |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                         Root Dispersion                       |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                          Reference ID                         |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                                                               |
      +                     Reference Timestamp (64)                  +
      |                                                               |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                                                               |
      +                      Origin Timestamp (64)                    +
      |                                                               |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                                                               |
      +                      Receive Timestamp (64)                   +
      |                                                               |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                                                               |
      +                      Transmit Timestamp (64)                  +
      |                                                               |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                                                               |
      .                                                               .
      .                    Extension Field 1 (variable)               .
      .                                                               .
      |                                                               |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                                                               |
      .                                                               .
      .                    Extension Field 2 (variable)               .
      .                                                               .
      |                                                               |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                          Key Identifier                       |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                                                               |
      |                           digest (128)                        |
      |                                                               |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

The fixed header is 48 bytes long.  The simplest possible case of an
NTP packet is the minimal SNTP request, a mode 3 packet with the
Stratum and all following fields zeroed out to byte 47.

How to interpret these fields:

The modes are as follows:

+-------+--------------------------+
| Value | Meaning                  |
+-------+--------------------------+
| 0     | reserved                 |
| 1     | symmetric active         |
| 2     | symmetric passive        |
| 3     | client                   |
| 4     | server                   |
| 5     | broadcast                |
| 6     | NTP control message      |
| 7     | reserved for private use |
+-------+--------------------------+

While the Stratum field has 8 bytes, only values 0-16 (low 5 bits)
are legal. Value 16 means 'unsynchronized' Values 17-255 are reserved.

LI (Leap Indicator), Version, Poll, and Precision are not described
here; see RFC 5905.

t_1, the origin timestamp, is the time according to the client at
which the request was sent.

t_2, the receive timestamp, is the time according to the server at
which the request was received.

t_3, the transmit timestamp, is the time according to the server at
which the reply was sent.

You also need t_4, the destination timestamp, which is the time according to
the client at which the reply was received.  This is not in the reply packet,
it's the packet receipt time collected by the client.

The 'Reference timestamp' is an unused historical relic.  It's supposed to be
copied unchanged from upstream in the stratum hierarchy. Normal practice
has been for Stratum 1 servers to fill it in with the raw timestamp from the
most recent reference-clock.

Theta is the thing we want to estimate: the offset between the server
clock and the client clock. The sign convention is that theta is
positive if the server is ahead of the client.

Theta is estimated by [(t_2-t_1)+(t_3-t_4)]/2. The accuracy of this
estimate is predicated upon network latency being symmetrical.

Delta is the network round trip time, i.e. (t_4-t_1)-(t_3-t_2). Here's
how the terms work: (t_4-t_1) is the total time that the request was
in flight, and (t_3-t_2) is the time that the server spent processing it;
when you subtract that out you're left with just network delays.

Lambda nominally represents the maximum amount by which theta could be
off. It's computed as delta/2 + epsilon. The delta/2 term usually
dominates and represents the maximum amount by which network asymmetry
could be throwing off the calculation. Epsilon is the sum of three
other sources of error:

rho_r: the (im)precision field from response packet, representing the
server's inherent error in clock measurement.

rho_s: the client's own (im)precision.

PHI*(t_4-t_1): The amount by which the client's clock may plausibly
have drifted while the packet was in flight. PHI is taken to be a
constant of 15ppm.

rho_r and rho_s are estimated by making back-to-back calls to
clock_gettime() (or similar) and taking their difference. They're
encoded on the wire as an eight-bit two's complement integer
representing, to the nearest integer, log_2 of the value in seconds.

If you look at the raw data, there are 3 unknowns:
   * transit time client to server
   * transit time server to client
   * clock offset
but there are only two equations, so you can't solve it.

NTP gets the 3rd equation by assuming the transit times are equal.  That lets
it solve for the clock offset.

If you assume that both clocks are accurate which is reasonable if you have
GPS at both ends, then you can easily solve for the transit times in each
direction.

The RFC 5905 diagram is slightly out of date in that the digest header assumes
a 128-bit (16-octet) MD5 hash, but it is also possible for the field to be a
128-bit AES_CMAC hash or 160-bit (20-octet) SHA-1 hash.  NTPsec will
support any 128- or 160-bit MAC type in libcrypto.

An extension field consists of a 16-bit network-order type field
length, followed by a 16-bit network-order payload length in octets,
followed by the payload (which must be padded to a 4-octet boundary).

       0                   1                   2                   3
       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |         Type field             |      Payload length          |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                                                               |
      |                        Payload (variable)                     |
      |                                                               |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Here's what a Mode 6 packet looks like:

       0                   1                   2                   3
       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |LI | VN  | 6   |R|E|M|  Opcode  |          Sequence            |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |               Status           |       Association ID         |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |               Offset           |            Count             |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                                                               |
      .                                                               .
      .                        Payload (variable)                     .
      .                                                               .
      |                                                               |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                          Key Identifier                       |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                                                               |
      |                           digest (128)                        |
      |                                                               |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

In this case, the fixed header is 24 bytes long.

R = Response bit
E = Error bit
M = More bit.

A Mode 6 packet cannot have extension fields.

�)�print_function�divisionN� i�i�i�������c@sreZ
dZd
Zedd��
Zedd��
Zejj	ejj
dfdd�
Zed	d
��
Z
e
jdd
��
Z
dd
�Zdd�Zdd�ZdS)�PacketzEncapsulate an NTP fragmentcCs|d
@d>|
d
@BS)N���)�
v�
mr
r
�0/usr/lib64/python3.9/site-packages/ntp/packet.py�VN_MODE
szPacket.VN_MODEcCs|d
@d>t�
|
|�BS)Nr�)r
r)�
lrrr
r
r�PKT_LI_VN_MODE
szPacket.PKT_LI_VN_MODENcCs*||_d
|_
d|_t�tjj||
�|_
dS)Nr
�)�session�
li_vn_mode�	extensionr
r�ntp�magicZLEAP_NOTINSYNC)�self�mode�versionrr
r
r�__init__
s



�zPacket.__init__c


Cs|jS�
N)
�_Packet__extension�
rr
r
rr
szPacket.extensioncCstj
�|
�
|_dSr)r�poly�	polybytesr )r�
xr
r
rr"
sc

Csd
tj
�|j�
S)N)zno-leapzadd-leapzdel-leapZunsync)rrZPKT_LEAPrr!r
r
r�leap&
s

�zPacket.leapc

Cs|jd
?d@S)Nrr�
rr!r
r
rr*
s
zPacket.versionc

Cs
|jd
@S)Nrr&r!r
r
rr-
s
zPacket.mode)�__name__�
__module__�__qualname__�__doc__�staticmethodrrrrZMODE_CLIENT�NTP_VERSIONr�propertyr�setterr%rrr
r
r
rr
	
s





�





r
c@seZ
dZddd�
Zdd�ZdS)�
SyncExceptionr
cCs|
|_||_
dSr��message�	errorcode�rr1r2r
r
rr2
s

zSyncException.__init__c


Cs|jSr�
r1r!r
r
r�__str__6
s
zSyncException.__str__N)
r
�r'r(r)rr5r
r
r
rr/1
s

r/c@s�eZ
dZd
ZdZdZdZdZd2dd�
Zd	d
�Z	e
dd��
Ze
d
d��
Zdd�Z
dd�Zdd�Zdd�Zdd�Zdd�Zdd�Zdd�Zdd �Zd!d"�Zd#d$�Zd%d&�Zd'd(�Zd)d*�Zd+d,�Zd-d.�Zd/d0�Zd1S)3�
SyncPacketz5Mode 1-5 time-synchronization packet, including SNTP.z!BBBbIIIQQQQ�0l�~TghUMu�>�cCs�t�
|�

d
|_d
|_d
|_d
|_d
|_d
|_d
|_d
|_	d
|_
d
|_d
|_d|_
g|_d|_d|_d|_t�t���
|_d|_d|_|
r�|�tj�|
�
�

dS)Nr
r9TF)r
r�status�stratum�poll�	precision�
root_delay�root_dispersion�refid�reference_timestamp�origin_timestamp�receive_timestamp�transmit_timestampr�	extfields�mac�hostnameZresolvedr7�posix_to_ntp�time�receivedZtrusted�rescaled�analyzerr"r#)r�datar
r
rrA
s,






















zSyncPacket.__init__cCs,
t|
�
}|t
jks|d
@dkr&td�
�
t�t
j|
dt
j��\|_|_|_	|_
|_|_|_
|_|_|_|_|
t
jd�|_|j}t|�
dkr�t�d|dd��\}}|j�||dd|�f�

|d|d�}q�t|�
dkr�||_nBt|�
dkr�td	�
�
n,t|�
d
v�
rtd�
�
nt|�
dv�
r(||_dS)
Nrr
zimpossible packet length�z!IIrrrzUnsupported DES authentication)rrzPacket is a runt)r	rN)�lenr7�
HEADER_LENr/�struct�unpack�formatrr;r<r=r>r?r@rArBrCrDrrE�appendrF)rrMZdatalen�payloadZftypeZflenr
r
rrLY
s>



��























zSyncPacket.analyzec

Cs|d
tj
S)z!Scale from NTP time to POSIX time�)r7�
UNIX_EPOCH�
�
tr
r
r�ntp_to_posix�
szSyncPacket.ntp_to_posixc

Cst|t
jd
�
S)z!Scale from POSIX time to NTP timerV)�intr7rWrXr
r
rrH�
szSyncPacket.posix_to_ntpc

Csr|jsnd
|_|j
dL_
|jdL_t�|j�
|_t�|j�
|_t�|j�
|_t�|j�
|_t�|j	�
|_	dS)z%Rescale all timestamps to POSIX time.TrN)
rKr>r?r7rZrArBrCrDrJr!r
r
r�posixize�
s"




�
�
�
�zSyncPacket.posixizec


Cs|jSr)
rBr!r
r
r�t1�
s
z
SyncPacket.t1c


Cs|jSr)
rCr!r
r
r�t2�
s
z
SyncPacket.t2c


Cs|jSr)
rDr!r
r
r�t3�
s
z
SyncPacket.t3c


Cs|jSr)
rJr!r
r
r�t4�
s
z
SyncPacket.t4c

Cs |��|�
�|��|��S)
zPacket flight time)r`r]r_r^r!r
r
r�delta�
szSyncPacket.deltac

Cs tj
|��|��d
|jS)z(Residual error due to clock imprecision.�)r7�PHIr`r]r=r!r
r
r�epsilon�
szSyncPacket.epsilonc

Cst|�
�d
|���
S)z?Synchronization distance, estimates worst-case error in secondsrb)�absrardr!r
r
r�synchd�
szSyncPacket.synchdc

Cs$|��|�
�|��|��d
S)z9Adjustment implied by this packet - 'theta' in NTP-speak.rb)r^r]r_r`r!r
r
r�adjust�
szSyncPacket.adjustc
CsBt�
tj|j|j|j|j|j|j	|j
|j|j|j
|j�}
|
|jS�
z*Flatten the packet into an octet sequence.)rQ�packr7rSrr;r<r=r>r?r@rArBrCrDr�r�bodyr
r
r�flatten�
s










�zSyncPacket.flattenc

Cs0|jd
?d@|jd?d@|jd?d@|jd@fS)zAnalyze refid into octets.rN�rr)
r@r!r
r
r�refid_octets�
s



�zSyncPacket.refid_octetsc

Cstj
�tjd
|����
S)z'Sometimes it's a clock name or KOD type)
ZBBBB)rr"�polystrrQrirnr!r
r
r�refid_as_string�
szSyncPacket.refid_as_stringc

Cstj
�d
|���
S)zSometimes it's an IPV4 address.z%d.%d.%d.%d)rr"rornr!r
r
r�refid_as_address�
szSyncPacket.refid_as_addressc

Cst|j
�
d
kS)Nr�rOrFr!r
r
r�
is_crypto_nak�
s
zSyncPacket.is_crypto_nakc

Cst|j
�
d
kS)Nr	rrr!r
r
r�has_MD5�
s
zSyncPacket.has_MD5c

Cst|j
�
d
kS)NrNrrr!r
r
r�has_SHA1�
s
zSyncPacket.has_SHA1c
Cs
d
|��|�
�|��f}
|
d|j|jf7}
|��}tdd�|D�
�
sP|��}|
d|7}
|
dtj	�
t�|j
�
�
7}
|
dtj	�
t�|j�
�
7}
|
dtj	�
t�|j�
�
7}
|
dtj	�
t�|j�
�
7}
|jr�|
dt|j�
7}
|j�
r|
dt|j�
dd�7}
|
d7}
|
S)	z@Represent a posixized sync packet in an eyeball-friendly format.z<NTP:%s:%d:%d:z%f:%fc
ss|]}
|
tj
vV
qdSr)�stringZ	printable)�.0�
cr
r
r�	<genexpr>�
rz&SyncPacket.__repr__.<locals>.<genexpr>�
:�
����
>)r%rrr>r?rp�allrqr�utilZrfc3339r7rZrArBrCrDrE�reprrF)r�
r�rsr
r
r�__repr__�
s0








�


�


�


�




zSyncPacket.__repr__N)
r9)r'r(r)r*rSrPrWrcrrLr+rZrHr\r]r^r_r`rardrfrgrlrnrprqrsrtrur�r
r
r
rr7:
s8





)



r7c@sreZ
dZd
Zddd�
ZdZdZdd	�Zd
d�Zdd
�Z	dd�Z
dd�Zdd�Zdd�Z
dd�Zdd�Zdd�ZdS)�
ControlPacketzMode 6 request/response.r
r9cCsJtj
|tjj|
j|
d
�
||_d|_d|_||_	d|_
||_t|�
|_
dS)N)rrrr{r
)r
rrr�MODE_CONTROL�
pktversion�r_e_m_op�sequencer:�associd�offsetrrO�count)rr�opcoder��qdatar
r
rrs


�





zControlPacket.__init__z!BBHHHHHrc

Cs|jd
@rdSdS)N�TF�
r�r!r
r
r�is_responses
zControlPacket.is_responsec

Cs|jd
@rdSdS)N�@TFr�r!r
r
r�is_errors
zControlPacket.is_errorc

Cs|jd
@rdSdS)NrTFr�r!r
r
r�mores
zControlPacket.morec

Cs
|jd
@S)N�r�r!r
r
rr�s
zControlPacket.opcodec

Cs|jd
?d@S)Nrrm)
r:r!r
r
r�errcodes
zControlPacket.errcodec

Cs|j|j
Sr)r�r�r!r
r
r�ends
zControlPacket.endc

Csd
|j|�
�|jfS)z Return statistics on a fragment.z%5d %5d	%3d octets
)r�r�r�r!r
r
r�stats szControlPacket.statscCsdtj
�|
�
}
t�tj|
dtj��\|_|_	|_
|_|_|_
|_|
tjd�|_|j
|j|j|j
fSr)rr"r#rQrRr�rSrPrr�r�r:r�r�r�r)r�rawdatar
r
rrL$s

��






zControlPacket.analyzec

Cs2t�
tj|j|j|j|j|j|j	|j
�}
|
|jSrh)rQrir�rSrr�r�r:r�r�r�rrjr
r
rrl1s






�zControlPacket.flattenc

Cs|j�
|���

dSr)r�sendpktrlr!r
r
r�send=s
zControlPacket.sendN)r
r
r9)r'r(r)r*rrSrPr�r�r�r�r�r�r�rLrlr�r
r
r
rr��
s



r�c@s,eZ
dZd
Zdd�Zdd�Zdd�ZeZdS)	�Peerz*The information we have about an NTP peer.cCs|
|_||_
||_i|_dSr)rr�r:�	variables)rrr�r:r
r
rrDs



z
Peer.__init__c

Cs|j�
�|_dSr)r�readvarr�r!r
r
r�readvarsJs
z
Peer.readvarsc

Csd
|j|j
fS)Nz<Peer: associd=%s status=%0x>)r�r:r!r
r
rr5Ms
zPeer.__str__N)r'r(r)r*rr�r5r�r
r
r
rr�As

r�z.***Server reports a bad format request packet
z/***Server disallowed request (authentication?)
z****Server reports a bad opcode in request
z(***Association ID {0} unknown to server
z,***A request variable unknown to the server
z/***Server indicates a request variable was bad
z(***Server returned an unspecified error
z.***Socket error; probably ntpd is not running
z***Request timed out
z'***Response from server was incomplete
z****Buffer size exceeded for returned data
z***Select call failed
z***No host open
z3***Response length should have been a multiple of 4z***Invalid key identifierz***Invalid passwordz***Key not foundz#***Unexpected nonce response formatz***Unknown parameter '%s'z***No credentialsz***Server error code %sz?***No response, probably high-traffic server with low MRU limitz***Bad MRU tag %sz#***Sort order %s is not implementedz%***No trusted keys have been declaredcCs�d
}|r�tj
�||�\}}t|�
}d|}dd�|D�
}|t|�
;}||kr\|d||7}dd�|D�
}|d�|�
d7}|
�|�

qd	S)
z.Dump a packet in hex, in a familiar hex formatrz%02x c
Ssg|]}
tj
�|
�
�qSr
)rr"�polyord�rwr$r
r
r�
<listcomp>wrz&dump_hex_printable.<locals>.<listcomp>z   c
Ss0g|](}
d|
k
rd
kr(n
nt|
�
nd�qS)r��
.)
�chrr�r
r
rr�|rr9�

N)rr�	slicedatarO�tuple�join�write)�xdataZoutfpZrowsizeZlinedataZlinelen�liner
r
r�dump_hex_printablems






r�c@s0eZ
dZd
Zdd�Zdd�Zdd�Zdd	�Zd
S)�MRUEntryz A traffic entry for an MRU list.c

Cs4d|_d|_
d|_d|_d|_d
|_d|_d|_dS)Nr
)�addr�last�first�mvr��ct�sc�drr!r
r
rr�s







zMRUEntry.__init__c
Cs*tj
�|j�
}
tj
�|j�
}|
||jSr)r�ntpc�
lfptofloatr�r�r�)rr�r�r
r
r�avgint�s


zMRUEntry.avgintc
Csx|j}
|
d
dkrP|
d|
�
d�
�}
|
�
d�
}|d
krB|
d|�}
t�tj|
�S|
d|
�
d�
�}
dt�tj|
�SdS)Nr
�
[r{�
]�
%rzs)r��find�socketZ	inet_ptonZAF_INET6ZAF_INET)rr�Zpctr
r
r�sortaddr�s





zMRUEntry.sortaddrc

Csd
t|j
�
dd�dS)Nz<MRUEntry: r{r|r})r��__dict__r!r
r
rr��s
zMRUEntry.__repr__N)r'r(r)r*rr�r�r�r
r
r
rr��s


r�c@s(eZ
dZd
Zdd�Zdd�Zdd�ZdS)	�MRUListzFA sequence of address-timespan pairs returned by ntpd in one response.c

Csg|_d|_
dSr��entries�nowr!r
r
rr�s

zMRUList.__init__c

Cs
|jd
u
S)z2Is the server done shipping entries for this span?N)
r�r!r
r
r�is_complete�szMRUList.is_completec

Csd
|j|j
fS)Nz<MRUList: entries=%s now=%s>r�r!r
r
rr��s
zMRUList.__repr__N)r'r(r)r*rr�r�r
r
r
rr��s
r�c@seZ
dZddd�
Zdd�ZdS)�ControlExceptionr
cCs|
|_||_
dSrr0r3r
r
rr�s

zControlException.__init__c


Cs|jSrr4r!r
r
rr5�s
zControlException.__str__N)
r
r6r
r
r
rr��s
r�c@s2
eZ
dZd
ZdZdZejjdejj	dejj
dejjdejjdejj
d	ejjd
ejjdiZdd
�Zdd�Zdd�Zdd�Zdd�Zejf
dd�
Zdd�Zdd�Zd>dd�
Zdd �Zd!d"�Zd?d%d&�
Zd@d'd(�
ZdAd)d*�
Z d#d+ejj!dfd,d-�
Z"d.d/�Z#d0d1�Z$d2d3�Z%d4d5�Z&dBd6d7�
Z'd8d9�Z(d:d;�Z)d<d=�Z*d+S)C�ControlSessionzA session to a host�
TZUNSPECZ
PERMISSIONZBADFMTZBADOPZBADASSOCZ
UNKNOWNVARZBADVALUEZRESTRICTc

Cs�d
|_t
j|_t|_t|_tj	j
d|_d|_d|_
d|_d|_d|_d|_d|_d|_d
|_d
|_d|_d
|_tj|_tj|_d
|_d
|_d|_ dS)Nr
r{FZMD5r9)!�debugr��	AF_UNSPEC�	ai_family�
DEFTIMEOUT�primary_timeout�DEFSTIMEOUT�secondary_timeoutrr�NTP_OLDVERSIONr��always_auth�keytype�keyid�passwd�authrG�isnum�sock�portr��response�rstatusr��
MRU_ROW_LIMIT�ntpd_row_limit�sys�stdout�logfp�
nonce_xmit�slots�flakeyr!r
r
rr�s,




















zControlSession.__init__cCstj
�|j|
|j|�
dSr�rr�dologr�r�)r�textZ	thresholdr
r
r�warndbg�s
zControlSession.warndbgc

Cs|jr|j�
�
d|_dSr)r��closer!r
r
rr��s



zControlSession.closec

Cs
|jd
u
S)z#Is the session connected to a host?N)
r�r!r
r
r�havehost�szControlSession.havehostc	
s�
��d
�
r�dd����
fdd�}z|dt
jd�WSt
jyz
}
z,tj��
jd�|jf�
j	d	�
WYd
}~n
d
}~00z|ddd�WSt
j�
y�
}
�
z�
jd
u
r��
j�
d�|jf�

t
j}z|t
jO}Wnt
y�


Yn0z�tt
d
��
rt
jt
jf}nt
jf
}|j|v�
r|z|ddd�WWWYd
}~St
j�
yz
}
z*�
jd
u
�
rf�
j�
d|j�

WYd
}~n
d
}~00Wn,t
�
y�


�
jd
u
�
r��
j�
d�

Yn0WYd
}~n
d
}~00d
S)z5Try different ways to interpret an address and familyr�r{r|cst�
�|�
jtjtj|
�Sr)r�Zgetaddrinfor�Z
SOCK_DGRAMZIPPROTO_UDP�r��hints��hnamerr
r�
hinted_lookups




�z2ControlSession.__lookuphost.<locals>.hinted_lookuprr�z*ntpq: numeric-mode lookup of %s failed, %srNr
z,ntpq: standard-mode lookup of %s failed, %s
�
EAI_NODATAzntpq: ndp lookup failed, %s
z+ntpq: API error, missing socket attributes
)�
startswithr�ZAI_NUMERICHOSTZgaierrorrrr�r��strerrorr�r�ZAI_CANONNAMEZ
AI_ADDRCONFIG�AttributeError�hasattrZ
EAI_NONAMEr��errno)	rr��famr��
e�e1Zfallback_hintsZerrlist�e2r
r�rZ__lookuphost�sT







�
�




�













� 


� zControlSession.__lookuphostc

Cs(
|�|
|�}|d
urdS|d\}}}}}|d
urLt
�|d|�|_d|_n|pR|
|_d|_tj�|jd|j|j	d�
|d|_
zt
�
|||�|_Wn<t
jy�
}	
z"t
d|
|	j|	jf�
�
WYd
}	~	n
d
}	~	00z|j�|�

Wn>t
j�
y"
}	
z"t
d	|
|	j|	jf�
�
WYd
}	~	n
d
}	~	00dS)
z"openhost - open a socket to a hostNFr
TzOpening host %srr{zError opening %s: %s [%d]zError connecting to %s: %s [%d])�_ControlSession__lookuphostr�Z	inet_ntoprGr�rrr�r�r�r�r��errorr�r�r�Zconnect)
rr�r��resZfamilyZsocktypeZprotocolZ	canonnameZsockaddrr�r
r
r�openhost.s4








�





�



�zControlSession.openhostc
	Csd
|jd
ur�|j
d
ur8zt�|_
Wnttfy6


Yn0|j
r�|jdkr�z|j
��\|_|_|_Wd
St	y~


t
t�
�
Yn0z<t�
d�
r�ttj�d�
�
}
nd}
|
dks�|
tkr�t
t�
�
Wntt	fy�


t
t�
�
Yn0|
|_|jd
u�
r`z|j
|j\|_}WnTttf�
yX


t�d|j�
}|d
u�
r:t
t�
�
t|�
dk�
rTtj�|�
}Yn0||_d
S)z2Get a keyid and the password if we don't have one.NZ	localhostr
zKeyid: z
%s Password: r	)r�r��
Authenticator�OSError�IOErrorrG�controlr�r��
ValueErrorr��SERR_NOTRUST�os�isattyr[rr"Z	polyinput�	MAX_KEYID�SERR_BADKEY�SyntaxError�
IndexError�	TypeError�getpass�SERR_INVPASSrOr�
hexstr2octets)rZkey_idr�r
r
r�passwordJs@








�


















zControlSession.passwordcCs�t|
�
d
r|
d7}
qt
j�|jdt|
�
|jf|jd�
z|j�t
j	�
|
�
�

Wn2tjy�


|jdu
r~|j�
d|j�

YdS0|jdkr�|jdu
r�|j�
d	�

t|
|j�
d
S)zSend a packet to the host.r�
zSending %d octets.  seq=%drNzWrite to %s failed
r|�zRequest packet:
r
)rOrrr�r�r�r�r�Zsendallr"r#r�r�r�rGr�)rr�r
r
rr�ss$





�
�







zControlSession.sendpktFcCs�
|jd
kr@|j
du
r@|jdkr*|j
�d�

|j
�d|
||f�

t|�
tjjkrr|j
du
rn|j
�dt|�
�

dSt||
||�}|jd
7_|jd;_|j|_|j	r�tj
�|j	�
|_	tjt|j	�
d@r�|j	d	7_	q�|s�|j
s�|��S|jdu�
s|jdu�
rtt�
�
tjt|j	�
d
@�
r8|j	d	7_	�
qt�|��|j|j|j�}|du�
rftt�
�
n|j	tj
�|�
7_	|��S)z(Ship an ntpq request packet to a server.r{Nrr�z-sendrequest: opcode=%d, associd=%d, qdata=%s
z'***Internal error! Data too large (%d)
r|i
r
r)r�r�r�rOrr��CTL_MAX_DATA_LENr�r�rr"r#rPr�r�r�r�r��SERR_NOCREDr��compute_macrlr��
SERR_NOKEY)rr�r�r�r�ZpktrFr
r
r�sendrequest�sB



�



�










�



zControlSession.sendrequestcsPg}d
�
_d}d}�
j
du
r&�
j
j}ndd�}�
f
dd�}|dd	�
|d	7}|d
tkr`tt�
�
|sp�
jd}	n
�
jd}	|dt�	�|	fd
�
zt
�
�
jg
gg|	�\}
}}Wnt
jy�


tt
�
�
Yn0|dt�	�|	fd
�
|
�
sn|s�|r�tt�
�
|�
rf�
jd	k�
rf�
j
du
�
rf�
j
�d�

t|�
D]&\}}
�
j
�d|d	|
��f�

�
q*�
j
�dd|�

tt�
�
|dt�	�d�
ztj��
j�d�
�
}Wntj�
y�


tt�
�
Yn0�
j�
rވ
jt��k�
r�|dd	�
d}|dt|�
d�
t�
�
�z��|�

Wntj�y$


tt�
�
Yn0�
� �||
|�}|�s>qD�
j!�r��
j"�r��j#t$}||t%7}t|�
|t&t'k�r��
j
�dt|�
|t&t'f�

d�
_!n�
j"j(|||d��s�d�
_!�j)d�j#��_)�j#dk�r��*��r�|d�

qD|�r
��*��r
|d�

qD�f
dd�|D�
}|�rV|d}|j+�j+k�rV|d�j#�j+|j#|j+f�

qD|�r�|d }|�,��j+k�r�|d!�j+|j#|j+f�

qD|�r���,�|j+k�r�|d"�j#�j+|j+f�

qD|d#t|�
d	�j#�j+��,���*�fd�
|�-��

|j.d$d�d%�

��*��sd&}�j/�
_0|rD|dj+dkrDt1d	t|�
�D]>}||d	�,�||j+k�r:|d'|t|�
fd	�

�q<�q:d(d�|D�
}tj�d
�2|�
�
�
_|d)t�
j�
t|�
fd	�
�
jd
k�r�|d*�

t3�
j�
j
�
nV�
jdk�r�|d+t4�
j�
�

n6�
jd
k�r2�
j�5d,�
}�
jd|�}|d-t4|�
�

dS�q<qD�
j!�sL|d.�

dS)/z<Get a response expected to match a given opcode and associd.r9Fr
Nc


Ss|Srr
�
r$r
r
r�<lambda>�rz,ControlSession.getresponse.<locals>.<lambda>cstj
��j|�j|
�Srr��Ztxt�thr!r
rr
�s
�zFragment collection beginsr{rbi�z$At %s, select with timeout %d beginsr
z"At %s, select with timeout %d endsz$ERR_INCOMPLETE: Received fragments:
z%d: %szlast fragment %sreceived
)znot r9zAt %s, socket read beginsriz'Flaky: I deliberately dropped a packet.zReceived %d octetsrz(AUTH - packet too short for MAC %d < %d
)�
packet_end�	mac_beginz*Received count of 0 in non-final fragment
zReceived second last fragment
c
sg|]}
|
j�jkr|
�qSr
�
r�)rw�frag)
�rpktr
rr�*s
�z.ControlSession.getresponse.<locals>.<listcomp>z3duplicate %d octets at %d ignored, prior  %d at %d
r|z6received frag at %d overlaps with %d octet frag at %d
z6received %d octet frag at %d overlaps with frag at %d
z@Recording fragment %d, size = %d offset = %d,  end = %d, more=%sc


Ss|jSrr
)
r
r
r
rr
Jr�
�keyTz#Hole in fragment sequence, %d of %dc
Ssg|]}
tj
�|
j�
�qSr
)rr"ror)rw�
fr
r
rr�[s
�z3Fragment collection ends. %d bytes  in %d fragmentszResponse packet:
zResponse packet:
%s
�

zFirst line:
%s
z7AUTH: Content untrusted due to authentication failure!
)6r�r�r��MAXFRAGSr��SERR_TOOMUCHr�r�rI�asctime�selectr�r��SERR_SELECT�SERR_TIMEOUTr��	enumerater��SERR_INCOMPLETErr"r#Zrecvr��SERR_SOCKETr��randomrOr�rLrQ�SERR_UNSPEC� _ControlSession__validate_packet�	_authpassr�r��MODE_SIX_HEADER_LENGTH�MODE_SIX_ALIGNMENT�KEYID_LENGTH�MINIMUM_MAC_LENGTH�
verify_macrr�r�r�rT�sortr:r��ranger�r�r�r�)rr�r�ZtimeoZ	fragmentsZseenlastfragZbail�warnr�ZtvoZrd�
_�
ir
r�ZvalidZ_pendZnot_earlierr�r
ZtempfraglistZeol�	firstliner
)r
rr�getresponse�s&














�
�





�
�




�
�
 

�


















�


�






��


�
�
���









�
�

�
��









zControlSession.getresponsecs�
�jdu
r�jj
}nd
d�}�f
dd�}|
��tjjksH|
��tjjkr^|d|
��d�
dS|
��tjjkr�|d|
��d�
dS|
�	�s�|dd�
dS|
j
�j
kr�|d	|
j
�j
fd�
dS|
��|kr�|d
|
��|fd�
dS|
���
r2|
�
��
r
|d|
���

d�_�_tttj|
��|
����
|
j|k�
rP|d|
j|f�

t|�
d
@�
rr|dt|�
�

dStj|
jd
d@}t|�
|k�
r�|d|
jt|�
tjf�

tt�
�
dS)Nc


Ss|Srr
r
r
r
rr
wrz2ControlSession.__validate_packet.<locals>.<lambda>cstj
��j|�j|
�Srr�r
r!r
rr
xs
�z!Fragment received with version %dr{FzFragment received with mode %dz!Received request, wanted responsez&Received sequence number %d, wanted %dzReceived opcode %d, wanted %dz(Error %d received on non-final fragment
z,Association ID %d doesn't match expected %d
rz(Response fragment not padded, size = %d
���z>Response fragment claims %u octets payload, above %d received
T)r�r�rrrr,r�rr�r�r�r�r�r�r�r�r�r��SERR_SERVERr��
server_errorsr�rOr�rPr�r&
)rr
r�r�r�r3
r�Zshouldbesizer
r!rZ__validate_packetrsz




�
�
�









�
�



�
�




�


��

�

�

�z ControlSession.__validate_packetr
r9c
Cs�|��st
t�
�
d
}|�|
|||�
z|�|
||�}Wq�t
y�
}
z4|rl|jttfvrld}WYd}~qn|�
WYd}~q�d}~00q�q|S)z$send a request and save the responseTFN)r�r��SERR_NOHOSTr
r7
r1r$
r&
)rr�r�r�r�Zretryr�r�r
r
r�doquery�s







zControlSession.doquerycCs�|jt
jj|
d
�
t|j�
dr(tt�
�
g}|
dkr�tt|j�
d�
D]@}|jd|d|d�}t	�
d|�\}
}|�t||
|��

qF|j
dd�d�

|S)z(Read peer status, or throw an exception.)r�r�rr
z!HHc


Ss|jSr)
r�)
�
ar
r
rr
�rz)ControlSession.readstat.<locals>.<lambda>r
)r<
rr�ZCTL_OP_READSTATrOr�r��SERR_BADLENGTHr2
rQrRrTr�r1
)rr�Zidlistr5
rMr:r
r
r�readstat�s









zControlSession.readstatcCs�
g}d
}d}tj
�|j�
|_|jD]h}tj
�|�
}|dkrJ||7}|}q"|sj|dkrj|�|���

d}q"d|kr~dkr"n
q"||7}q"|r�|�|���

g}|D�
]}d|vr�tj�||�	d�
�\}	}
|
dd	�}
n
|d}	}
|	��|
��}	}
|
�
r�zt
|
d�}Wn�t�
y�


z*t|
�
}|	d
k�
rB|
�
sB|�d|
f�

Wn@t�
y�


|
ddk�
r||
ddk�
r||
dd�}
|
}Yn0Yn0n|
}|
�
r�|�|	||
ff�

q�|�|	|f�

q�tj�
|�
S)
z&Parse a response as a textual varlist.Fr9�
"�
,r
r��
=r{NZdelayzdelay-sr|)rr"ror�r�rT�striprr��indexr[r��float�OrderedDict)r�rawZkvpairsZinstringr�rxZcord�itemsZpairr
�valueZcastedvaluer
r
rZ__parse_varlist�sP



































zControlSession.__parse_varlistNcCs2|d
urd}n
d�|�
}|j
||
|d�
|�|�
S)z@Read system vars from the host as a dict, or throw an exception.Nr9rA
)r�r�)r�r<
�_ControlSession__parse_varlist)rr�Zvarlistr�rG
r�r
r
rr�
s




zControlSession.readvarcCsd|jt
jj|
d
d�
|js$tt�
�
n"d|jvrF|jd|j�d�
�|_|j��|_|jt
j	�
d�
kS)z?Send configuration text to the daemon. Return True if accepted.T�r�r�r�r
NzConfig Succeeded)r<
rr�ZCTL_OP_CONFIGUREr�r��SERR_PERMISSIONrD
�rstripr"r#)rZ
configtextr
r
r�configs

�






zControlSession.configc
Cs�td
�
D]H}
|j
tjjd�

t��|_|j�tj	�
d�
�
rtj	�|j���

Sqt
turb|j}n
|j��}|j�d|�

tt�
�
dS)zV
Ask for, and get, a nonce that can be replayed.
This combats source address spoofing
r)
r�znonce=z## Nonce expected: %sN)r2
r<
rr�ZCTL_OP_REQ_NONCErIr�r�r�r"r#rorC
�str�bytes�decoder�r�r��
SERR_BADNONCE)rr5
Zrespr
r
r�fetch_nonce!s







zControlSession.fetch_noncec
Cs�
d
}d
}t|
�
��
}g}i}|r,|jtd�

|D]�\}	}
|�d|	|
fd�
|	dkrbd|	|
f}n|	dkrnq0n
|	dkrxq0|	d	kr�tj�|
�
|_q0n
|	d
kr�q0dD]|}|	�	|d�
r�|	�
d�
\}}
zt|
�
}
Wnty�


t
t|	�
�
Yn0|
|v
�
ri|t|
�
<|�|
�

|
|t|
�
|<q�q0|��
|D]\}
t�}|jd
7_dD]0}||t|
�
v�
rHt|||t|
�
|�
�
qH|j�|�

�
q,|d
u
�
r�||j�

|S)z=Extracts data from the key/value list into a more useful formNr
ztag=%s, val=%sr�nonce�%s=%sz
last.olderz
addr.olderr�zlast.newest)r�r�r�r�r�r�r�r�r�r{)�listrH
r1
�
mru_kv_keyr�rr�r�r�r��splitr[r�r��SERR_BADTAGrO
rTr�r��setattrr�)rr��span�directZmrurT
rH
Z	fake_listZ	fake_dict�tag�val�prefix�member�idxr
r
rZ
__mru_analyze7sT








































zControlSession.__mru_analyzecCs
|
jdur|
�
n�|
jt
jjkrT|�d
d�
|d7}|dkrBtt�
�
|�d|d�
n�|
jt
jjkr�|rxd}|�dd�
n*|jd8_t	||j�}|�d|d�
n^|
jt
tfvr�|r�td|d�}|�d	|d�
ntd|d�}|�d
|d�
n|
j�
r|
�
||||fS)Nz4no overlap between prior entries and server MRU listr{rz/--->   Restarting from the beginning, retry #%uFz+Reverted to row limit from fragments limit.z0Row limit reduced to %d following CERR_BADVALUE.rbz7Frag limit reduced to %d following incomplete response.z7Row limit reduced to %d following  incomplete response.)
r2rr��CERR_UNKNOWNVARr�r��
SERR_STALL�
CERR_BADVALUEr��minr&
r$
�max)rr��restarted_count�	cap_frags�limit�fragsr
r
rZ__mru_query_errorjsX




�



�
�



�


�
�


�
�

�
�

z ControlSession.__mru_query_errorc
Csd
}d}d}d}t}|
dur i}
|
r2t
|
�
\}}}|��}	t�}
�
z�tdt|j�}d|	|f}|
r�d|
vr|t|
d�
|
d<d|
vr�t|
d�
|
d<t|
�
\}
}||7}z|jt	j
j|d�
d	}WnHt�
y

}
z.d}|�
|||||�}|\}}}}WYd}~n
d}~00|��}
|�
r"||
�

|�|
|
|�}|�
r:|}	|
���
rH�
q�|�
s�|�
rdtt|d
�}n$tdt|jt|d
|dd��}t��|jt	j
jk�
r�|��}	d
|	|�
r�dnd|�
r�|n||
f}|t|
t|�
�7}|du
r�g|
_q�Wnt�y


Yn0t|
||�
|
S)zRetrieve MRU list datar
TNrz%s, frags=%d�resall�resany)r�r�Fr{�!rz%s, %s=%d%srj
ri
)r
�parse_mru_variablesrS
r�re
r��hex�generate_mru_parmsr<
rr�ZCTL_OP_READ_MRUr�� _ControlSession__mru_query_errorrJ
�_ControlSession__mru_analyzer�rf
rIr�Z
NONCE_TIMEOUT�generate_mru_lastseenrOr��KeyboardInterrupt�
stitch_mru)rr�Zrawhookr\
rg
rh
�sorter�sortkeyrj
rT
r[
ri
Zreq_buf�parms�
firstParmsZrecoverable_read_errorsr�r�ZnewNoncer
r
r�mrulist�s�


















�



�"











��





��




zControlSession.mrulistcCs�|jt
jj|
d
d�
g}|����D]v\}}|d��r$d|vr$|�d�
\}}t|�
}|t	|�
dkr�t
t	|�
|d�D]}|�t
j�
��

qx||||<q$|S)zRetrieve ordered-list data.TrK
r|r�r{)r<
rr�ZCTL_OP_READ_ORDLIST_ArJ
rH
�isdigitrX
r[rOr2
rTrrF
)rZlisttypeZstanzasr
rI
�stemZstanzar5
r
r
rZ	__ordlist�s

�








zControlSession.__ordlistc

Cs
|�d
�
S)zRetrieve reslist data.Zaddr_restrictions�
�_ControlSession__ordlistr!r
r
r�reslist
szControlSession.reslistc

Cs
|�d
�
S)zRetrieve ifstats data.�ifstatsr}
r!r
r
rr�
szControlSession.ifstats)
F)r
r9F)
r
)
F)NNN)+r'r(r)r*r�r+
rr�ZCERR_UNSPECZCERR_PERMISSIONZCERR_BADFMTZ
CERR_BADOPZ
CERR_BADASSOCrb
rd
Z
CERR_RESTRICTr:
rr�r�r�r�r�r�r�r

r�r
r7
r*
r<
r?
rJ
ZCTL_OP_READVARr�rN
rS
rr
rq
rz
r~
r
r�
r
r
r
rr��sL









�8)
57@


5
�


3'
jr�c

Cs�
d}
d}t}d
|vr�|d
}|d
=dd�dd�dd�dd�dd�dd�d	d�d
d�dd�dd�d
d�dd�d�}|dkr|d}|du
r�|�
|�
}
|
dur�tt|�
�
t|���
D]t}|dvr�q�q�|�d�
s�|�d�
�
r|�d�
}t|�
dk�
s|dt	t
ttd�
�
�v
r�tt|�
�
q�q�tt|�
�
q�d|v�
rBt
|�
d�
�
}|d=d|v�
rj|�
dd�tjjB|d<|d=d|v�
r�|�
dd�tjjB|d<|d=|
||fS)Nr1
c

Sstj
�|j�
Sr�rr�r�r��
r�r
r
rr
"rz%parse_mru_variables.<locals>.<lambda>c

Sstj
�|j�
Srr�
r�
r
r
rr
$rc

Ss
|��Sr�
r�r�
r
r
rr
&rc

Ss|��Srr�
r�
r
r
rr
(rc

Ss|��Sr�
r�r�
r
r
rr
*rc

Ss|��Srr�
r�
r
r
rr
,rc


Ss|jSr�
r�r�
r
r
rr
.rc


Ss|jSrr�
r�
r
r
rr
0rc


Ss|jSr�
r�r�
r
r
rr
2rc


Ss|jSrr�
r�
r
r
rr
4rc


Ss|jSr�
r�r�
r
r
rr
6rc


Ss|jSrr�
r�
r
r
rr
8r)�lstintz-lstintr�z-avgintr�z-addrr�z-countZscorez-scoreZdropz-dropr�
)ZmincountZmindropZminscorerk
rl
�kod�limitedZ	maxlstintZ	minlstintZladdr�recentr1
rj
ri
zaddr.zlast.r�rbr{rrj
r�
rl
r
r�
)r
�getr��SERR_BADSORTrV
�keysr�rX
rO�maprO
r2
�
SERR_BADPARAMr[rrZRES_KODZRES_LIMITED)r�rv
rw
rj
Zsortdict�
k�knr
r
rrn
s`





	�











(










�




�
rn
cCs�i}g}t|j
�
D]2\}}|j|v
r.g||j<||j�||jf�

q|D]$}|t||d
d�d�dd�7}qJdd�|D�
}|jdd�

|D]}|j
�|�

q�|
r�|j
j|
d�

|d	kr�|j
��
dS)
Nc

Ss|d
S)Nr{r
r
r
r
rr
irzstitch_mru.<locals>.<lambda>r
r|c
Ssg|]}
|
d�qS)
r
r
r�r
r
rr�jrzstitch_mru.<locals>.<listcomp>T)
�reverser�)	r%
r�r�rTr��sortedr1
�popr�
)r[
rv
rw
ZaddrdictZdeletiar5
�entryr�r
r
rru
[s 








"





ru
c
CsV|sd
Sdd�t|�
��
D�
}
dd�|
�
}d|vrJd|d}||7}n|}||fS)N)r9r9c
Ss g|]}
|
dd
krd|
�qS)r
r�
rU
r
)rw�itr
r
rr�{s
�z&generate_mru_parms.<locals>.<listcomp>z, r�
z, recent=%s)rV
rH
r�)r�ZparmStrsrx
ry
r
r
rrp
ws



�



rp
cCsrd
}tt
|j�
�
D]Z}|jt
|j�
|d}d||j||jf}|
t
|�
t
|�
tjjkrd
qnq||7}q|S)Nr9r{z, addr.%d=%s, last.%d=%s)r2
rOr�r�r�rr�r

)r[
ZexistingBufferSize�bufr5
r�Zincrr
r
rrs
�s





�

rs
c
CsF|d
�d�
}
t
|
�
dkrdSzt|
d�
WSty@


YdS0dS)Nr
r�r{���r|)rX
rOr[r�)�token�bitsr
r
rrW
�s






rW
c@sVeZ
dZd
Zddd�
Zdd�Zdd�Zdd	d
�
Zedd��
Z	ed
d��
Z
ddd�
ZdS)r�z+MAC authentication manager for NTP packets.NcCs�i|_|
du
r�t
|
�
D]|}d
|vr4|d|�d
�
�}|��}|sBq|��\}}}|��dvr`d}t|�
dkr�tj�	|dd��
}||f|jt
|�
<qdS)N�
#)ZAESZ
AES128CMACzAES-128r	r�)�	passwords�openrD
rC
rX
�upperrOrrr	
r[)rZkeyfiler�r�r�r�r
r
rr�s











zAuthenticator.__init__c

Cs
t|j
�
S)
z1return the number of keytype/passwd tuples stored)rOr�
r!r
r
r�__len__�szAuthenticator.__len__cCs|j�
|
�
S)
z#get a keytype/passwd tuple by keyid)r�
r�
)rr�r
r
r�__getitem__�szAuthenticator.__getitem__cCs�|
d
u
r,|
|jvr"|
f
|j|
S|
d
d
fSt
d�
D]^}|�d�
r4t|��d�
}
|j|
\}}|d
urlt�
t|�
dkr�tj�	|�
}|
||f
Sq4t�
d
S)z?Get the keytype/passwd tuple that controls localhost and its idNz
/etc/ntp.confr�r{r	)
r�
r�
r�r[rX
r�rOrrr	
)rr�r�r�r�r
r
rr��s












zAuthenticator.controlcCsTtj
�|�
sd
Stj
�tj�|�
tj�|�
|�}|r@t|�
dkrDdSt�d|
�|S)z)Create the authentication payload to sendFr
r�!I)	rr��	checknamerFr"r#rOrQri)rUr�r�r��mac2r
r
rr
�s


�

zAuthenticator.compute_macc

Cst|�
t
jjkS)
zDoes this packet have a MAC?)rOrrZ
LEN_PKT_NOMAC)
�packetr
r
r�have_mac�szAuthenticator.have_macr8c
Cs�|
d
|�}|
||t�}|
|td
�}t
�d|�\
}||jv
rHdS|j|\}}tj�|�
sfdStj�tj�	|�
tj�	|�
|�}	|	s�dSzt
�||	�WSty�


||	kYS0d
S)zDDoes the MAC on this packet verify according to credentials we have?Nr�
F)
r.
rQrRr�
rr�r�
rFr"r#�hmac�compare_digestr�)
rr�
r
r
rUr�rFr�r�r�
r
r
rr0
�s$









�



zAuthenticator.verify_mac)
N)
N)r8r8)r'r(r)r*rr�
r�
r�r+r
r�
r0
r
r
r
rr��s







r�)Hr*Z
__future__rrr
r�
r
r(
r"
r�rvrQr�rIZntp.controlrZ	ntp.magicZntp.ntpcZntp.utilZntp.polyr
r�r�r
r,
r/
r.
r-
ZMAX_BARE_MAC_LENGTHr
�
BaseExceptionr/r7r�r�ZSERR_BADFMTrL
Z
SERR_BADOPZ
SERR_BADASSOCZSERR_UNKNOWNVARZ
SERR_BADVALUEr)
r'
r$
r&
r 
r#
r;
r>
r
r
r
rR
r�
r
r9
rc
rY
r�
r�r�r�r�r�r�r�rn
ru
rp
rs
rW
r�r
r
r
r�<module>s�L




















(	DD























(
WH