ntp: limit offset correction to supported NTP interval

When an NTP source is specified with the offset option, the corrected
offset may get outside of the supported NTP interval (by default -50..86
years around the build date). If the source passed the source selection,
the offset would be rejected only later in the adjustment of the local
clock.

Check the offset validity as part of the NTP test A to make the source
unselectable and make it visible in the measurements log and ntpdata
report.

doc/chrony.conf.adoc

@@ -2179,8 +2179,8 @@ from the example line above):
 . Results of the *maxdelay*, *maxdelayratio*, and *maxdelaydevratio* (or
   *maxdelayquant*) tests, and a test for synchronisation loop (1=pass,
   0=fail). The first test from these four also checks the server precision,
-  response time, and whether an interleaved response is acceptable for
-  synchronisation. [1111]
+  response time, validity of the measured offset, and whether an interleaved
+  response is acceptable for synchronisation. [1111]
 . Local poll [10]
 . Remote poll [10]
 . '`Score`' (an internal score within each polling level used to decide when to

ntp_core.c

@@ -2211,7 +2211,8 @@ process_response(NCR_Instance inst, int saved, NTP_Local_Address *local_addr,
     /* Test A combines multiple tests to avoid changing the measurements log
        format and ntpdata report.  It requires that the minimum estimate of the
        peer delay is not larger than the configured maximum, it is not a
-       response in the 'warm up' exchange, in both client modes that the server
+       response in the 'warm up' exchange, the configured offset correction is
+       within the supported NTP interval, both client modes that the server
        processing time is sane, in interleaved client/server mode that the
        previous response was not in basic mode (which prevents using timestamps
        that minimise delay error), and in interleaved symmetric mode that the
@@ -2220,6 +2221,7 @@ process_response(NCR_Instance inst, int saved, NTP_Local_Address *local_addr,
     testA = sample.peer_delay - sample.peer_dispersion <= inst->max_delay &&
             precision <= inst->max_delay &&
             inst->presend_done <= 0 &&
+            UTI_IsTimeOffsetSane(&sample.time, sample.offset) &&
             !(inst->mode == MODE_CLIENT && response_time > MAX_SERVER_INTERVAL) &&
             !(inst->mode == MODE_CLIENT && interleaved_packet &&
               UTI_IsZeroTimespec(&inst->prev_local_tx.ts) &&

test/simulation/008-ntpera

@@ -41,7 +41,6 @@ for time_offset in -1e-1 1e-1; do
 		export CLKNETSIM_START_DATE=$(awk "BEGIN {printf \"%.0f\", $ntp_start + $start_offset}")
 		run_test || test_fail
 		check_chronyd_exit || test_fail
-		check_source_selection || test_fail
 		check_packet_interval || test_fail
 		check_sync && test_fail
 	done