BACKPORT: tlsdated: support command-line proxy override

This makes a proxy passed on the command line with -x supplant proxies for
configured sources, and makes the 'proxy' stanza in sources optional (in which
case we supply no proxy argument for them).

BUG=chromium-os:38801
TEST=unit

Signed-off-by: Elly Fong-Jones <ellyjones@chromium.org>
(cherry picked from commit 254dc20bbaa68f955b1de8c7da6a02d52c786fd0)

Change-Id: I537037bd15d7c873f87e820a5291fc7a7e0ffca1
Reviewed-on: https://gerrit.chromium.org/gerrit/44075
Reviewed-by: Will Drewry <wad@chromium.org>
Commit-Queue: Elly Jones <ellyjones@chromium.org>
Tested-by: Elly Jones <ellyjones@chromium.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
BACKPORT: tlsdate-helper: fix SAN checking

Right now, SAN checking checks against the host we're opening a socket to
instead of the host we're actually trying to talk to, which is fine... as long
as we don't have a proxy. Note that this problem only manifests for hosts whose
CN is not equal to their hostname (so the default host of www.ptb.de is fine).

To observe the problem:
$ ssh -D 127.0.0.1:30000 somehost
$ tlsdate -H clients3.google.com -x socks5://127.0.0.1:30000
hostname verification failed for host 127.0.0.1!
child process failed in SSL handshake

With this fix, you instead see no output.

BUG=chromium-os:38801
TEST=adhoc
Test steps given above.

Signed-off-by: Elly Fong-Jones <ellyjones@chromium.org>
(cherry picked from commit ceb1fe26c3136fc206101b757bdae298e729acf9)

Change-Id: If57d7cc6a8c12bbbcefa95bb8414a37445434eb4
Reviewed-on: https://gerrit.chromium.org/gerrit/44277
Reviewed-by: Elly Jones <ellyjones@chromium.org>
Tested-by: Elly Jones <ellyjones@chromium.org>
Commit-Queue: Elly Jones <ellyjones@chromium.org>
BACKPORT: tlsdate-dbus-announce: use name and flush connection

Have tlsdate-dbus-announce grab a well-known bus name before it sends its
signal, and have it wait for the signal to actually be sent over the bus before
exiting.

Signed-off-by: Elly Fong-Jones <ellyjones@chromium.org>
(cherry picked from commit f258f78782e362bf26c6cf606f11293d68632780)

Change-Id: Ica80f47d7f2317c9c31e0d34ccbc23873f087c50
Reviewed-on: https://gerrit.chromium.org/gerrit/44534
Reviewed-by: Kees Cook <keescook@chromium.org>
Commit-Queue: Elly Jones <ellyjones@chromium.org>
Tested-by: Elly Jones <ellyjones@chromium.org>
BACKPORT: tlsdate: add optional --showtime support for "raw"

Add support for optional arguments to --showtime, "raw" and "human".

Human readable output is what --showtime and -V do already.  Passing
in --showtime=raw will tell tlsdate-helper to write the raw
unix time directly to stdout in host byte order.

The purpose of this change is to provide easier integration of
privilege isolation for time setting.  If tlsdate is called from
a wrapper, like tlsdated, it should be possible to pass the time back
to a privileged time-setter with the minimum of needed parsing.

TEST=manual
BUG=chromium:262137

Change-Id: I94bde171688fc84f9962d90ddf9ef28e6652eec0
Reviewed-on: https://chromium-review.googlesource.com/169970
Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Will Drewry <wad@chromium.org>
Commit-Queue: Will Drewry <wad@chromium.org>
Tested-by: Will Drewry <wad@chromium.org>
BACKPORT: tlsdate, docs: make -V taken an optional arg to simplify showtime

Update the man pages and simplify the processing of -V
and --showtime to share the optional argument path.

TEST=manual
BUG=chromium:262137

Change-Id: I42eac2d27c0c2b23ff50b4a3d4b52d376d28e450
Reviewed-on: https://chromium-review.googlesource.com/169980
Reviewed-by: Kees Cook <keescook@chromium.org>
Commit-Queue: Will Drewry <wad@chromium.org>
Tested-by: Will Drewry <wad@chromium.org>
CHROMIUM: Initial work eventizing tlsdated

tlsdated provides the daemonized integration of tlsdate and the host
system -- resumable time, DBus announcements, time-sync events, and so
on.

At present, it provides only netlink based wakeups and limited
time synchronization.  On Chromium OS, proxy support and network
changes are integrated through external shell scripts monitoring
DBus.  These scripts lack the robustness required for a production
grade time synchronization system.

This change is manyfold:
- Convert tlsdated "wakeup" input into events
- Convert tlsdate execution and status collection into a event-friendly technique
- Integrate libevent into the tlsdated design
- Integrate support for platform specific wake up events
- Integrate support for dynamic proxy resolution on each tlsdate call
- Integrate CrOS wakeup events: proxy changes, default network service change, power state/resume, etc
- Integrate time continuity checking using MONOTONIC clocks versus REALTIME for all wake events
- Integrate DBus support directly into the event loop to allow for message sending
  and signal receipt (e.g., dbus_announce)
- Addition of DOT file for laying out event flows
- Split off time setting to a privileged helper by having tlsdate pass back time_t
- Added configure support for --enable-cros and libevent2 checking
- Support dynamic proxy resolution for multiple sources
- Fixed a NULL deref in source traversal
- Added "sync type" and priority
- Added DBus interface for SetTime, CanSetTime, LastSyncInfo methods.
- Added "sync source" to the TimeUpdated signal
- Updated existing unittests
- Add seccomp filter for priv'd time setter
- Added dynamic proxy per source so we can add a final source with no proxy.
- Style consistency: "find ./ -name '*.[ch]' -exec astyle --style=gnu -xd \{\} \;"
  Followed by the same with sed -i -e 's/) )/))/g'
- Added DBus policy and interface files and a new dbus-client-group configure argument.

Design: https://docs.google.com/a/google.com/document/d/1U1y7KBMo-BgWPspzoyeO5gSmU6dMwEJBc2HNNkGMJzY/view

- Outstanding work: new unit and integration tests

BUG=chromium:271644
TEST=manually tested on x86_64, arm, and x86-32.
     end-to-end autotest: https://chromium-review.googlesource.com/#/c/169141/
     fixed up existing autotests: https://chromium-review.googlesource.com/174782

Change-Id: I0d24951182a768532d6d04eea2224ac70cf04052
Reviewed-on: https://chromium-review.googlesource.com/169131
Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Jorge Lucangeli Obes <jorgelo@chromium.org>
Tested-by: Will Drewry <wad@chromium.org>
Commit-Queue: Will Drewry <wad@chromium.org>
Add verb_debug and give -vv meaning
Update README to make it timeless, so to speak
Add verbose change to CHANGELOG
Bump to version 0.0.7
remove unused code; valgrind complained about this lazy slop
CHROMIUM: Allow larger continuity time jumps

Clock continuity is checked by maintaining a delta between
what is read from CLOCK_REALTIME and CLOCK_MONOTONIC_RAW.
This is very effective for a continuously powered machine.
For machines that are suspended and resumed, time jumps
occur frequently and will be the length of time that the
system was suspended.

The recently added CLOCK_BOOTTIME is meant to help applications
keep track of the time since boot, inclusive of suspend, but the
calculations that go into CLOCK_BOOTTIME may be subject to being
corrupted by RTC misbehavior, such as corruption upon return from
resume.

To limit the impact of time jumps from clock corruption upon resumption
without requiring a re-sync after every suspend, we set a more
reasonable upper limit.

To avoid expected time jumps from triggering simultaneous queries in
homogeneous environments, a jitter is introduced whenever the time
is being reset because of a desynchronization during an event.
(The jitter should match the maximum time of a check_continuity event.)

BUG=chromium:314679
TEST=doesn't immediately re-sync when returning from suspend (x86-alex)
     after time sync, date -s "5 hours", suspend, resume, see it note the de-sync.

Change-Id: I2d04fd46a63c420c4cd9a1e9ab5f09f148a1b027
Reviewed-on: https://chromium-review.googlesource.com/175431
Reviewed-by: Jorge Lucangeli Obes <jorgelo@chromium.org>
Commit-Queue: Will Drewry <wad@chromium.org>
Tested-by: Will Drewry <wad@chromium.org>
Add note about servers with weak DH group parameters
Include <unistd.h> in src/util.h

On FreeBSD 11-CURRENT this fixes the compilation failure:

In file included from ./src/proxy-bio.h:16,
                 from src/proxy-bio.c:38:
./src/util.h:46: error: expected '=', ',', ';', 'asm' or '__attribute__' before 'wait_with_timeout'
./src/util.h:50: warning: 'struct timeval' declared inside parameter list
./src/util.h:50: warning: its scope is only this definition or declaration, which is probably not what you want
./src/util.h:51: warning: 'struct timeval' declared inside parameter list
./src/util.h:57: warning: 'struct timeval' declared inside parameter list
*** Error code 1
Include <sys/stat.h> in src/util.c

On FreeBSD 11-CURRENT this fixes the compilation failure:

src/util.c: In function 'file_write':
src/util.c:256: error: 'S_IRUSR' undeclared (first use in this function)
src/util.c:256: error: (Each undeclared identifier is reported only once
src/util.c:256: error: for each function it appears in.)
src/util.c:256: error: 'S_IWUSR' undeclared (first use in this function)
*** Error code 1
Use the strchrnul() replacement on FreeBSD versions that need it

This gets tlsdate and tlsdate-helper working on FreeBSD 9.2-RELEASE.
Mention the recent FreeBSD-specific changes in the CHANGELOG
Mention in INSTALL that tlsdate is expected to work on FreeBSD 9.2 and 11 as well
time() is declared in time.h not sys/time.h
Merge pull request #125 from BrianAker/master

time() is declared in time.h not sys/time.h