ntp: T6080: T6123: restrict config.boot.default NTP settings to RFC1918 and fe80::/10, fc00::/7 only

[Giggum]

Change Summary

Adds ipv4/ipv6 localhost, link-local and private address as allowed-clients to NTP service.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Code style update (formatting, renaming)
• Refactoring (no functional changes)
• Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
• Other (please describe): Enhancement to produce a stronger default install configuration

Related Task(s)

https://vyos.dev/T5694
https://vyos.dev/T6123
https://vyos.dev/T6080

Component(s) name

Proposed changes

How to test

Checklist:

• I have read the CONTRIBUTING document
• I have linked this PR to one or more Phabricator Task(s)
• My commit headlines contain a valid Task id
• My change requires a change to the documentation
• I have updated the documentation accordingly

[c-po]

default configuration is translated to:

set service ntp allow-client address '10.0.0.0/8'
set service ntp allow-client address '127.0.0.0/8'
set service ntp allow-client address '169.254.0.0/16'
set service ntp allow-client address '172.16.0.0/12'
set service ntp allow-client address '192.168.0.0/16'
set service ntp allow-client address '::1/128'
set service ntp allow-client address 'fc00::/7'
set service ntp allow-client address 'fe80::/10'
set service ntp server time1.vyos.net
set service ntp server time2.vyos.net
set service ntp server time3.vyos.net

While walking up through all migration scripts.

Commit message can be adjusted during squash

[c-po]

@Mergifyio backport sagitta

[mergify]

backport sagitta

✅ Backports have been created

• #567 ntp: T6080: T6123: restrict config.boot.default NTP settings to RFC1918 and fe80::/10, fc00::/7 only (backport #559) has been created for branch sagitta

[dmbaturin]

I kept thinking about including those defaults implicitly in the template, but explicit config options are probably better indeed.