BACKPORT: tlsdated: support command-line proxy override

This makes a proxy passed on the command line with -x supplant proxies for
configured sources, and makes the 'proxy' stanza in sources optional (in which
case we supply no proxy argument for them).

BUG=chromium-os:38801
TEST=unit

Signed-off-by: Elly Fong-Jones <ellyjones@chromium.org>
(cherry picked from commit 254dc20bbaa68f955b1de8c7da6a02d52c786fd0)

Change-Id: I537037bd15d7c873f87e820a5291fc7a7e0ffca1
Reviewed-on: https://gerrit.chromium.org/gerrit/44075
Reviewed-by: Will Drewry <wad@chromium.org>
Commit-Queue: Elly Jones <ellyjones@chromium.org>
Tested-by: Elly Jones <ellyjones@chromium.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
BACKPORT: tlsdate-helper: fix SAN checking

Right now, SAN checking checks against the host we're opening a socket to
instead of the host we're actually trying to talk to, which is fine... as long
as we don't have a proxy. Note that this problem only manifests for hosts whose
CN is not equal to their hostname (so the default host of www.ptb.de is fine).

To observe the problem:
$ ssh -D 127.0.0.1:30000 somehost
$ tlsdate -H clients3.google.com -x socks5://127.0.0.1:30000
hostname verification failed for host 127.0.0.1!
child process failed in SSL handshake

With this fix, you instead see no output.

BUG=chromium-os:38801
TEST=adhoc
Test steps given above.

Signed-off-by: Elly Fong-Jones <ellyjones@chromium.org>
(cherry picked from commit ceb1fe26c3136fc206101b757bdae298e729acf9)

Change-Id: If57d7cc6a8c12bbbcefa95bb8414a37445434eb4
Reviewed-on: https://gerrit.chromium.org/gerrit/44277
Reviewed-by: Elly Jones <ellyjones@chromium.org>
Tested-by: Elly Jones <ellyjones@chromium.org>
Commit-Queue: Elly Jones <ellyjones@chromium.org>
BACKPORT: tlsdate-dbus-announce: use name and flush connection

Have tlsdate-dbus-announce grab a well-known bus name before it sends its
signal, and have it wait for the signal to actually be sent over the bus before
exiting.

Signed-off-by: Elly Fong-Jones <ellyjones@chromium.org>
(cherry picked from commit f258f78782e362bf26c6cf606f11293d68632780)

Change-Id: Ica80f47d7f2317c9c31e0d34ccbc23873f087c50
Reviewed-on: https://gerrit.chromium.org/gerrit/44534
Reviewed-by: Kees Cook <keescook@chromium.org>
Commit-Queue: Elly Jones <ellyjones@chromium.org>
Tested-by: Elly Jones <ellyjones@chromium.org>
BACKPORT: tlsdate: add optional --showtime support for "raw"

Add support for optional arguments to --showtime, "raw" and "human".

Human readable output is what --showtime and -V do already.  Passing
in --showtime=raw will tell tlsdate-helper to write the raw
unix time directly to stdout in host byte order.

The purpose of this change is to provide easier integration of
privilege isolation for time setting.  If tlsdate is called from
a wrapper, like tlsdated, it should be possible to pass the time back
to a privileged time-setter with the minimum of needed parsing.

TEST=manual
BUG=chromium:262137

Change-Id: I94bde171688fc84f9962d90ddf9ef28e6652eec0
Reviewed-on: https://chromium-review.googlesource.com/169970
Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Will Drewry <wad@chromium.org>
Commit-Queue: Will Drewry <wad@chromium.org>
Tested-by: Will Drewry <wad@chromium.org>
BACKPORT: tlsdate, docs: make -V taken an optional arg to simplify showtime

Update the man pages and simplify the processing of -V
and --showtime to share the optional argument path.

TEST=manual
BUG=chromium:262137

Change-Id: I42eac2d27c0c2b23ff50b4a3d4b52d376d28e450
Reviewed-on: https://chromium-review.googlesource.com/169980
Reviewed-by: Kees Cook <keescook@chromium.org>
Commit-Queue: Will Drewry <wad@chromium.org>
Tested-by: Will Drewry <wad@chromium.org>
CHROMIUM: Initial work eventizing tlsdated

tlsdated provides the daemonized integration of tlsdate and the host
system -- resumable time, DBus announcements, time-sync events, and so
on.

At present, it provides only netlink based wakeups and limited
time synchronization.  On Chromium OS, proxy support and network
changes are integrated through external shell scripts monitoring
DBus.  These scripts lack the robustness required for a production
grade time synchronization system.

This change is manyfold:
- Convert tlsdated "wakeup" input into events
- Convert tlsdate execution and status collection into a event-friendly technique
- Integrate libevent into the tlsdated design
- Integrate support for platform specific wake up events
- Integrate support for dynamic proxy resolution on each tlsdate call
- Integrate CrOS wakeup events: proxy changes, default network service change, power state/resume, etc
- Integrate time continuity checking using MONOTONIC clocks versus REALTIME for all wake events
- Integrate DBus support directly into the event loop to allow for message sending
  and signal receipt (e.g., dbus_announce)
- Addition of DOT file for laying out event flows
- Split off time setting to a privileged helper by having tlsdate pass back time_t
- Added configure support for --enable-cros and libevent2 checking
- Support dynamic proxy resolution for multiple sources
- Fixed a NULL deref in source traversal
- Added "sync type" and priority
- Added DBus interface for SetTime, CanSetTime, LastSyncInfo methods.
- Added "sync source" to the TimeUpdated signal
- Updated existing unittests
- Add seccomp filter for priv'd time setter
- Added dynamic proxy per source so we can add a final source with no proxy.
- Style consistency: "find ./ -name '*.[ch]' -exec astyle --style=gnu -xd \{\} \;"
  Followed by the same with sed -i -e 's/) )/))/g'
- Added DBus policy and interface files and a new dbus-client-group configure argument.

Design: https://docs.google.com/a/google.com/document/d/1U1y7KBMo-BgWPspzoyeO5gSmU6dMwEJBc2HNNkGMJzY/view

- Outstanding work: new unit and integration tests

BUG=chromium:271644
TEST=manually tested on x86_64, arm, and x86-32.
     end-to-end autotest: https://chromium-review.googlesource.com/#/c/169141/
     fixed up existing autotests: https://chromium-review.googlesource.com/174782

Change-Id: I0d24951182a768532d6d04eea2224ac70cf04052
Reviewed-on: https://chromium-review.googlesource.com/169131
Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Jorge Lucangeli Obes <jorgelo@chromium.org>
Tested-by: Will Drewry <wad@chromium.org>
Commit-Queue: Will Drewry <wad@chromium.org>
CHROMIUM: Allow larger continuity time jumps

Clock continuity is checked by maintaining a delta between
what is read from CLOCK_REALTIME and CLOCK_MONOTONIC_RAW.
This is very effective for a continuously powered machine.
For machines that are suspended and resumed, time jumps
occur frequently and will be the length of time that the
system was suspended.

The recently added CLOCK_BOOTTIME is meant to help applications
keep track of the time since boot, inclusive of suspend, but the
calculations that go into CLOCK_BOOTTIME may be subject to being
corrupted by RTC misbehavior, such as corruption upon return from
resume.

To limit the impact of time jumps from clock corruption upon resumption
without requiring a re-sync after every suspend, we set a more
reasonable upper limit.

To avoid expected time jumps from triggering simultaneous queries in
homogeneous environments, a jitter is introduced whenever the time
is being reset because of a desynchronization during an event.
(The jitter should match the maximum time of a check_continuity event.)

BUG=chromium:314679
TEST=doesn't immediately re-sync when returning from suspend (x86-alex)
     after time sync, date -s "5 hours", suspend, resume, see it note the de-sync.

Change-Id: I2d04fd46a63c420c4cd9a1e9ab5f09f148a1b027
Reviewed-on: https://chromium-review.googlesource.com/175431
Reviewed-by: Jorge Lucangeli Obes <jorgelo@chromium.org>
Commit-Queue: Will Drewry <wad@chromium.org>
Tested-by: Will Drewry <wad@chromium.org>
Add tlsdated.conf to this package

We are moving init scripts out of chromeos-init.
tlsdate's init script will now be installed by tlsdate instead of chromeos-init.

BUG=chromium:347336
TEST=trybot
TEST=built an image without tlsdate and check that tlsdated.conf is no longer
installed
TEST=install chromeos-init and tlsdate on a machine and check that tlsdate is
running and there is no tlsdate related error in /var/log/messages.

CQ-DEPEND=Ib8029ab9642b9b852cbd3e34de5c89b649305309
CQ-DEPEND=Ieaea926653b6baf7f35ce6777c200c8a3698c69a

Change-Id: I0578395a84d5e0a12fdc3dc272985bd28e466a14
Reviewed-on: https://chromium-review.googlesource.com/188123
Reviewed-by: Mike Frysinger <vapier@chromium.org>
Commit-Queue: Bertrand Simonnet <bsimonnet@chromium.org>
Tested-by: Bertrand Simonnet <bsimonnet@chromium.org>
Fixed section for tlsdated manpage
routeup: don't forget to flush stdout.

Otherwise, when stdout is to a pipe, it won't actually flush until many,
many routes have come up.
tlsdate: Allow explicitly disabling seccomp support

Allow building without seccomp filter support if requested. This is
currently not the case when cross-compiling, where seccomp support
is default assumed.

BUG=chromium:358444
TEST='USE=-seccomp emerge-mipsel-o32-generic tlsdate' now builds.

CQ-DEPEND=CL:194323

Change-Id: I105d9a7238f49c87ee4c060ca5ef160239628410
Reviewed-on: https://chromium-review.googlesource.com/194289
Reviewed-by: Mike Frysinger <vapier@chromium.org>
Reviewed-by: Will Drewry <wad@chromium.org>
Tested-by: Gaurav Shah <gauravsh@chromium.org>
Commit-Queue: Gaurav Shah <gauravsh@chromium.org>
CHROMIUM: Listen for SuspendDone D-Bus signal

Listen for powerd's new SuspendDone signal instead of the
old PowerStateChanged signal.

BUG=chromium:359619
TEST=manual: saw event:cros:handle_suspend_done
     in /var/log/tlsdate.log after suspending and resuming
CQ-DEPEND=I111a68e1903d940c8f06bafa820576fcc71c7f2c

Change-Id: Idc0ad3f178b78876eb4e93485bbf349e023da144
Reviewed-on: https://chromium-review.googlesource.com/194802
Tested-by: Daniel Erat <derat@chromium.org>
Reviewed-by: Jorge Lucangeli Obes <jorgelo@chromium.org>
Commit-Queue: Daniel Erat <derat@chromium.org>
tlsdate-helper: abort if time delay is too large.

Such a large timeout could indicate tampering, but at the very least,
it means we didn't set the time accurately.  So exit with an error code and
let the caller try again later.
tlsdated manpage belongs in section 8
Merge pull request #137 from h01ger/master

tlsdated manpage belongs in section 8
correct path to tlsdated binary in systemd service file - might need changes to Makefile.am too
Merge pull request #139 from h01ger/master

correct path to tlsdated binary in systemd service file - might need cha...
Merge pull request #138 from h01ger/debian-master

Debian master
Merge pull request #133 from apenwarr/max-delay

tlsdate-helper: abort if time delay is too large.
Merge pull request #129 from kartikm/manpage-section-fix

Fixed section for tlsdated manpage