ntp: T3008: migrate from ntpd to chrony

* Move CLI from "system ntp" -> "service ntp"
* Drop NTP server option preempt as not supported by chrony

3 files changed, 95 insertions, 26 deletions

diff --git a/src/conf_mode/ntp.py b/src/conf_mode/ntp.py
index 0ecb4d736..92cb73aab 100755
--- a/src/conf_mode/ntp.py
+++ b/src/conf_mode/ntp.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2022 VyOS maintainers and contributors
+# Copyright (C) 2018-2023 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -21,26 +21,29 @@ from vyos.configdict import is_node_changed
 from vyos.configverify import verify_vrf
 from vyos.configverify import verify_interface_exists
 from vyos.util import call
+from vyos.util import chmod_750
 from vyos.util import get_interface_config
 from vyos.template import render
 from vyos import ConfigError
 from vyos import airbag
 airbag.enable()
 
-config_file = r'/run/ntpd/ntpd.conf'
-systemd_override = r'/etc/systemd/system/ntp.service.d/override.conf'
+config_file = r'/run/chrony/chrony.conf'
+systemd_override = r'/run/systemd/system/chrony.service.d/override.conf'
+user_group = '_chrony'
 
 def get_config(config=None):
     if config:
         conf = config
     else:
         conf = Config()
-    base = ['system', 'ntp']
+    base = ['service', 'ntp']
     if not conf.exists(base):
         return None
 
     ntp = conf.get_config_dict(base, key_mangling=('-', '_'), get_first_key=True)
     ntp['config_file'] = config_file
+    ntp['user'] = user_group
 
     tmp = is_node_changed(conf, base + ['vrf'])
     if tmp: ntp.update({'restart_required': {}})
@@ -52,7 +55,7 @@ def verify(ntp):
     if not ntp:
         return None
 
-    if 'allow_clients' in ntp and 'server' not in ntp:
+    if 'server' not in ntp:
         raise ConfigError('NTP server not configured')
 
     verify_vrf(ntp)
@@ -77,13 +80,17 @@ def generate(ntp):
     if not ntp:
         return None
 
-    render(config_file, 'ntp/ntpd.conf.j2', ntp)
-    render(systemd_override, 'ntp/override.conf.j2', ntp)
+    render(config_file, 'chrony/chrony.conf.j2', ntp, user=user_group, group=user_group)
+    render(systemd_override, 'chrony/override.conf.j2', ntp, user=user_group, group=user_group)
+
+    # Ensure proper permission for chrony command socket
+    config_dir = os.path.dirname(config_file)
+    chmod_750(config_dir)
 
     return None
 
 def apply(ntp):
-    systemd_service = 'ntp.service'
+    systemd_service = 'chrony.service'
     # Reload systemd manager configuration
     call('systemctl daemon-reload')
 
diff --git a/src/migration-scripts/ntp/1-to-2 b/src/migration-scripts/ntp/1-to-2
new file mode 100755
index 000000000..1faf0b0e6
--- /dev/null
+++ b/src/migration-scripts/ntp/1-to-2
@@ -0,0 +1,67 @@
+#!/usr/bin/env python3
+
+# Copyright (C) 2023 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# T3008: move from ntpd to chrony and migrate "system ntp" to "service ntp"
+
+import sys
+
+from vyos.configtree import ConfigTree
+
+if (len(sys.argv) < 1):
+    print("Must specify file name!")
+    sys.exit(1)
+
+file_name = sys.argv[1]
+
+with open(file_name, 'r') as f:
+    config_file = f.read()
+
+config = ConfigTree(config_file)
+
+base_path = ['system', 'ntp']
+new_base_path = ['service', 'ntp']
+if not config.exists(base_path):
+    # Nothing to do
+    sys.exit(0)
+
+# copy "system ntp" to "service ntp"
+config.copy(base_path, new_base_path)
+config.delete(base_path)
+
+# chrony does not support the preempt option, drop it
+for server in config.list_nodes(new_base_path + ['server']):
+    server_base =  new_base_path + ['server', server]
+    if config.exists(server_base + ['preempt']):
+        config.delete(server_base + ['preempt'])
+
+# Rename "allow-clients" -> "allow-client"
+if config.exists(new_base_path + ['allow-clients']):
+    config.rename(new_base_path + ['allow-client'])
+
+# By default VyOS 1.3 allowed NTP queries for all networks - in chrony we
+# explicitly disable this behavior and clients need to be specified using the
+# allow-client CLI option. In order to be fully backwards compatible, we specify
+# 0.0.0.0/0 and ::/0 as allow networks if not specified otherwise explicitly.
+if not config.exists(new_base_path + ['allow-client']):
+    config.set(new_base_path + ['allow-client', 'address'], value='0.0.0.0/0', replace=False)
+    config.set(new_base_path + ['allow-client', 'address'], value='::/0', replace=False)
+
+try:
+    with open(file_name, 'w') as f:
+        f.write(config.to_string())
+except OSError as e:
+    print("Failed to save the modified config: {}".format(e))
+    sys.exit(1)
diff --git a/src/op_mode/show_ntp.sh b/src/op_mode/show_ntp.sh
index e9dd6c5c9..85f8eda15 100755
--- a/src/op_mode/show_ntp.sh
+++ b/src/op_mode/show_ntp.sh
@@ -1,39 +1,34 @@
 #!/bin/sh
 
-basic=0
-info=0
+sourcestats=0
+tracking=0
 
 while [[ "$#" -gt 0 ]]; do
     case $1 in
-        --info) info=1 ;;
-        --basic) basic=1 ;;
-        --server) server=$2; shift ;;
+        --sourcestats) sourcestats=1 ;;
+        --tracking) tracking=1 ;;
         *) echo "Unknown parameter passed: $1" ;;
     esac
     shift
 done
 
-if ! ps -C ntpd &>/dev/null; then
+if ! ps -C chronyd &>/dev/null; then
     echo NTP daemon disabled
     exit 1
 fi
 
-PID=$(pgrep ntpd)
-VRF_NAME=$(ip vrf identify ${PID})
+PID=$(pgrep chronyd | head -n1)
+VRF_NAME=$(ip vrf identify )
 
 if [ ! -z ${VRF_NAME} ]; then
     VRF_CMD="sudo ip vrf exec ${VRF_NAME}"
 fi
 
-if [ $basic -eq 1 ]; then
-    $VRF_CMD ntpq -n -c peers
-elif [ $info -eq 1 ]; then
-    echo "=== sysingo ==="
-    $VRF_CMD ntpq -n -c sysinfo
-    echo
-    echo "=== kerninfo ==="
-    $VRF_CMD ntpq -n -c kerninfo
-elif [ ! -z $server ]; then
-    $VRF_CMD /usr/sbin/ntpdate -q $server
+if [ $sourcestats -eq 1 ]; then
+    $VRF_CMD chronyc sourcestats -v
+elif [ $tracking -eq 1 ]; then
+    $VRF_CMD chronyc tracking -v
+else
+    echo "Unknown option"
 fi