48ea54
#!/bin/bash
48ea54
# This script configures running chronyd to use NTP servers obtained from
48ea54
# DHCP and _ntp._udp DNS SRV records. Files with servers from DHCP are managed
48ea54
# externally (e.g. by a dhclient script). Files with servers from DNS SRV
48ea54
# records are updated here using the dig utility. The script can also list
48ea54
# and set static sources in the chronyd configuration file.
48ea54
48ea54
chronyc=/usr/bin/chronyc
48ea54
chrony_conf=/etc/chrony.conf
48ea54
chrony_service=chronyd.service
48ea54
helper_dir=/var/run/chrony-helper
48ea54
added_servers_file=$helper_dir/added_servers
48ea54
48ea54
network_sysconfig_file=/etc/sysconfig/network
48ea54
dhclient_servers_files=/var/lib/dhclient/chrony.servers.*
48ea54
dnssrv_servers_files=$helper_dir/dnssrv@*
48ea54
dnssrv_timer_prefix=chrony-dnssrv@
48ea54
48ea54
chrony_command() {
48ea54
    $chronyc -a -n -m "$1"
48ea54
}
48ea54
48ea54
is_running() {
48ea54
    chrony_command "tracking" &> /dev/null
48ea54
}
48ea54
48ea54
is_update_needed() {
48ea54
    for file in $dhclient_servers_files $dnssrv_servers_files \
48ea54
            $added_servers_file; do
48ea54
        [ -e "$file" ] && return 0
48ea54
    done
48ea54
    return 1
48ea54
}
48ea54
48ea54
update_daemon() {
48ea54
    local all_servers_with_args all_servers added_servers
48ea54
48ea54
    if ! is_running; then
48ea54
        rm -f $added_servers_file
48ea54
        return 0
48ea54
    fi
48ea54
48ea54
    all_servers_with_args=$(
48ea54
        cat $dhclient_servers_files $dnssrv_servers_files 2> /dev/null)
48ea54
48ea54
    all_servers=$(
48ea54
        echo "$all_servers_with_args" |
48ea54
            while read server serverargs; do
48ea54
                echo "$server"
48ea54
            done | sort -u)
48ea54
    added_servers=$( (
48ea54
        cat $added_servers_file 2> /dev/null
48ea54
        echo "$all_servers_with_args" |
48ea54
            while read server serverargs; do
48ea54
                [ -z "$server" ] && continue
48ea54
                chrony_command "add server $server $serverargs" &> /dev/null &&
48ea54
                    echo "$server"
48ea54
            done) | sort -u)
48ea54
48ea54
    comm -23 <(echo -n "$added_servers") <(echo -n "$all_servers") |
48ea54
        while read server; do
48ea54
            chrony_command "delete $server" &> /dev/null
48ea54
        done
48ea54
48ea54
    added_servers=$(comm -12 <(echo -n "$added_servers") <(echo -n "$all_servers"))
48ea54
48ea54
    [ -n "$added_servers" ] && echo "$added_servers" > $added_servers_file ||
48ea54
        rm -f $added_servers_file
48ea54
}
48ea54
48ea54
get_dnssrv_servers() {
48ea54
    local name=$1
48ea54
48ea54
    if ! command -v dig &> /dev/null; then
48ea54
        echo "Missing dig (DNS lookup utility)" >&2
48ea54
        return 1
48ea54
    fi
48ea54
48ea54
    (
48ea54
        . $network_sysconfig_file &> /dev/null
48ea54
48ea54
        output=$(dig "$name" srv +short +ndots=2 +search 2> /dev/null)
48ea54
        [ $? -ne 0 ] && return 0
48ea54
48ea54
        echo "$output" | while read prio weight port target; do
48ea54
            server=${target%.}
48ea54
            [ -z "$server" ] && continue
48ea54
            echo "$server port $port ${NTPSERVERARGS:-iburst}"
48ea54
        done
48ea54
    )
48ea54
}
48ea54
48ea54
check_dnssrv_name() {
48ea54
    local name=$1
48ea54
48ea54
    if [ -z "$name" ]; then
48ea54
        echo "No DNS SRV name specified" >&2
48ea54
        return 1
48ea54
    fi
48ea54
48ea54
    if [ "${name:0:9}" != _ntp._udp ]; then
48ea54
        echo "DNS SRV name $name doesn't start with _ntp._udp" >&2
48ea54
        return 1
48ea54
    fi
48ea54
}
48ea54
48ea54
update_dnssrv_servers() {
48ea54
    local name=$1
48ea54
    local srv_file=$helper_dir/dnssrv@$name servers
48ea54
48ea54
    check_dnssrv_name "$name" || return 1
48ea54
48ea54
    servers=$(get_dnssrv_servers "$name")
48ea54
    [ -n "$servers" ] && echo "$servers" > "$srv_file" || rm -f "$srv_file"
48ea54
}
48ea54
48ea54
set_dnssrv_timer() {
48ea54
    local state=$1 name=$2
48ea54
    local srv_file=$helper_dir/dnssrv@$name servers
48ea54
    local timer=$dnssrv_timer_prefix$(systemd-escape "$name").timer
48ea54
48ea54
    check_dnssrv_name "$name" || return 1
48ea54
48ea54
    if [ "$state" = enable ]; then
48ea54
        systemctl enable "$timer"
48ea54
        systemctl start "$timer"
48ea54
    elif [ "$state" = disable ]; then
48ea54
        systemctl stop "$timer"
48ea54
        systemctl disable "$timer"
48ea54
        rm -f "$srv_file"
48ea54
    fi
48ea54
}
48ea54
48ea54
list_dnssrv_timers() {
48ea54
    systemctl --all --full -t timer list-units | grep "^$dnssrv_timer_prefix" | \
48ea54
            sed "s|^$dnssrv_timer_prefix\(.*\)\.timer.*|\1|" |
48ea54
        while read -r name; do
48ea54
            systemd-escape --unescape "$name"
48ea54
        done
48ea54
}
48ea54
48ea54
prepare_helper_dir() {
48ea54
    mkdir -p $helper_dir
48ea54
    exec 100> $helper_dir/lock
48ea54
    if ! flock -w 20 100; then
48ea54
        echo "Failed to lock $helper_dir" >&2
48ea54
        return 1
48ea54
    fi
48ea54
}
48ea54
48ea54
is_source_line() {
48ea54
    local pattern="^[ \t]*(server|pool|peer|refclock)[ \t]+[^ \t]+"
48ea54
    [[ "$1" =~ $pattern ]]
48ea54
}
48ea54
48ea54
list_static_sources() {
48ea54
    while read line; do
48ea54
        is_source_line "$line" && echo "$line" || :
48ea54
    done < $chrony_conf
48ea54
}
48ea54
48ea54
set_static_sources() {
48ea54
    local new_config tmp_conf
48ea54
48ea54
    new_config=$(
48ea54
        sources=$(
48ea54
            while read line; do
48ea54
                is_source_line "$line" && echo "$line"
48ea54
            done)
48ea54
48ea54
        while read line; do
48ea54
            if ! is_source_line "$line"; then
48ea54
                echo "$line"
48ea54
                continue
48ea54
            fi
48ea54
48ea54
            tmp_sources=$(
48ea54
                local removed=0
48ea54
48ea54
                echo "$sources" | while read line2; do
48ea54
                    [ "$removed" -ne 0 -o "$line" != "$line2" ] && \
48ea54
                        echo "$line2" || removed=1
48ea54
                done)
48ea54
48ea54
            [ "$sources" == "$tmp_sources" ] && continue
48ea54
            sources=$tmp_sources
48ea54
            echo "$line"
48ea54
        done < $chrony_conf
48ea54
48ea54
        echo "$sources"
48ea54
    )
48ea54
48ea54
    tmp_conf=${chrony_conf}.tmp
48ea54
48ea54
    cp -a $chrony_conf $tmp_conf &&
48ea54
        echo "$new_config" > $tmp_conf &&
48ea54
        mv $tmp_conf $chrony_conf || return 1
48ea54
48ea54
    systemctl try-restart $chrony_service
48ea54
}
48ea54
48ea54
print_help() {
48ea54
    echo "Usage: $0 COMMAND"
48ea54
    echo
48ea54
    echo "Commands:"
48ea54
    echo "	update-daemon"
48ea54
    echo "	update-dnssrv-servers NAME"
48ea54
    echo "	enable-dnssrv NAME"
48ea54
    echo "	disable-dnssrv NAME"
48ea54
    echo "	list-dnssrv"
48ea54
    echo "	list-static-sources"
48ea54
    echo "	set-static-sources < sources.list"
48ea54
    echo "	is-running"
48ea54
    echo "	command CHRONYC-COMMAND"
48ea54
}
48ea54
48ea54
case "$1" in
48ea54
    update-daemon|add-dhclient-servers|remove-dhclient-servers)
48ea54
        is_update_needed || exit 0
48ea54
        prepare_helper_dir && update_daemon
48ea54
        ;;
48ea54
    update-dnssrv-servers)
48ea54
        prepare_helper_dir && update_dnssrv_servers "$2" && update_daemon
48ea54
        ;;
48ea54
    enable-dnssrv)
48ea54
        set_dnssrv_timer enable "$2"
48ea54
        ;;
48ea54
    disable-dnssrv)
48ea54
        set_dnssrv_timer disable "$2" && prepare_helper_dir && update_daemon
48ea54
        ;;
48ea54
    list-dnssrv)
48ea54
        list_dnssrv_timers
48ea54
        ;;
48ea54
    list-static-sources)
48ea54
        list_static_sources
48ea54
        ;;
48ea54
    set-static-sources)
48ea54
        set_static_sources
48ea54
        ;;
48ea54
    is-running)
48ea54
        is_running
48ea54
        ;;
48ea54
    command|forced-command)
48ea54
        chrony_command "$2"
48ea54
        ;;
48ea54
    *)
48ea54
        print_help
48ea54
        exit 2
48ea54
esac
48ea54
48ea54
exit $?