Merge ~barryprice/ntp-charm/+git/ntp-charm:lp1982517 into ntp-charm:master

[Barry Price]

Addressing LP:1982517 - when using chrony (on bionic and later), allow the operator to specify network ranges from which we will allow or deny NTP traffic accordingly.

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

This merge proposal is being monitored by mergebot. Change the status to Approved to merge.

[Haw Loeung (hloeung)]

LGTM

review: Approve (+1)

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Change successfully merged at revision 2c0b1be5e54399c13736c9b3000fed222117a38c

diff --git a/config.yaml b/config.yaml
index 33919f6..08c29a6 100644
--- a/config.yaml
+++ b/config.yaml
@@ -16,6 +16,19 @@ options:
     description: >
         Space-separated list of NTP servers to use as peers.  Under ntpd,
         peers are allowed to query the local NTP server via ntpq.
+  restrict_allow:
+    default: ""
+    type: string
+    description: >
+        Space-separated list of CIDR subnets for which we will allow queries
+        via chrony.conf's "allow x.x.x.x/x" directive. Default is a bare
+        "allow" to accept traffic from all networks.
+  restrict_deny:
+    default: ""
+    type: string
+    description: >
+        Space-separated list of subnets for which we will deny queries
+        via chrony.conf's "deny" directive. Default is no "deny" directive.
   unlimited_clients:
     default: ""
     type: string
diff --git a/reactive/ntp.py b/reactive/ntp.py
index 5bf3482..9403e97 100755
--- a/reactive/ntp.py
+++ b/reactive/ntp.py
@@ -205,6 +205,8 @@ def write_config():
     peers = hookenv.config('peers')
     auto_peers = hookenv.config('auto_peers')
     unlimited_clients = hookenv.config('unlimited_clients')
+    restrict_allow = hookenv.config('restrict_allow')
+    restrict_deny = hookenv.config('restrict_deny')
     if os.path.exists("/dev/ptp0") and machine_type == 'vm':
         use_phc = True
     else:
@@ -260,6 +262,8 @@ def write_config():
             'pools': remote_pools,
             'servers': remote_sources,
             'unlimited_clients': unlimited_clients.split(','),
+            'restrict_allow': restrict_allow.split(),
+            'restrict_deny': restrict_deny.split(),
         })
 
     # /etc/nagios/nrpe.d doesn't exist, which means nagios has the config
diff --git a/templates/chrony.conf b/templates/chrony.conf
index bbcf765..e17ebc1 100644
--- a/templates/chrony.conf
+++ b/templates/chrony.conf
@@ -37,9 +37,23 @@ dumpdir /var/lib/chrony
 local stratum {{ orphan_stratum }} orphan
 {%- endif %}
 
+{%- if restrict_allow %}
+# allow defined networks to use us as an NTP server
+{%- for allow in restrict_allow %}
+allow {{ allow }}
+{%- endfor %}
+{%- else %}
 # allow any host to use us as an NTP server
 # (use juju unexpose to prevent access)
 allow
+{%- endif %}
+
+{%- if restrict_deny %}
+# restrict defined networks from using us as an NTP server
+{%- for deny in restrict_deny %}
+deny {{ deny }}
+{%- endfor %}
+{%- endif %}
 
 # PEERS
 {%- for peer in peers %}