From 69577e72a7a88de96d44dcc30ae1822d92309361 Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Fri, 1 Jun 2018 06:53:14 +0200
Subject: T599: Bind NTP service to specific interface

---
 interface-definitions/ntp.xml | 20 ++++++++++++++++++--
 src/conf_mode/ntp.py          | 14 +++++++++++++-
 2 files changed, 31 insertions(+), 3 deletions(-)

diff --git a/interface-definitions/ntp.xml b/interface-definitions/ntp.xml
index 4688454c3..d324404da 100644
--- a/interface-definitions/ntp.xml
+++ b/interface-definitions/ntp.xml
@@ -1,7 +1,5 @@
 <?xml version="1.0"?>
-
 <!-- NTP configuration -->
-
 <interfaceDefinition>
   <node name="system">
     <children>
@@ -66,6 +64,24 @@
               </leafNode>
             </children>
           </node>
+          <leafNode name="listen-address">
+            <properties>
+              <help>Addresses to listen for NTP queries</help>
+              <valueHelp>
+                <format>ipv4</format>
+                <description>Network Time Protocol (NTP) IPv4 address</description>
+              </valueHelp>
+              <valueHelp>
+                <format>ipv6</format>
+                <description>Network Time Protocol (NTP) IPv6 address</description>
+              </valueHelp>
+              <multi/>
+              <constraint>
+                <validator name="ipv4-address"/>
+                <validator name="ipv6-address"/>
+              </constraint>
+            </properties>
+          </leafNode>
         </children>
       </node>
     </children>
diff --git a/src/conf_mode/ntp.py b/src/conf_mode/ntp.py
index 9a4846bdf..2a6088575 100755
--- a/src/conf_mode/ntp.py
+++ b/src/conf_mode/ntp.py
@@ -62,11 +62,20 @@ restrict {{ n.address }} mask {{ n.netmask }} nomodify notrap nopeer
 {% endfor -%}
 {% endif %}
 
+{% if listen_address -%}
+# NTP should listen on configured addresses only
+interface ignore wildcard
+{% for a in listen_address -%}
+interface listen {{ a }}
+{% endfor -%}
+{% endif %}
+
 """
 
 default_config_data = {
     'servers': [],
-    'allowed_networks': []
+    'allowed_networks': [],
+    'listen_address': []
 }
 
 def get_config():
@@ -89,6 +98,9 @@ def get_config():
 
             ntp['allowed_networks'].append(net)
 
+    if conf.exists('listen-address'):
+        ntp['listen_address'] = conf.return_values('listen-address')
+
     if conf.exists('server'):
         for node in conf.list_nodes('server'):
             options = []
-- 
cgit v1.2.3