Summary: The NTP daemon and utilities

Name: ntp

Version: 4.2.6p5

Release: 25%{?dist}

# primary license (COPYRIGHT) : MIT

# ElectricFence/ (not used) : GPLv2

# kernel/sys/ppsclock.h (not used) : BSD with advertising

# include/ntif.h (not used) : BSD

# include/rsa_md5.h : BSD with advertising

# include/ntp_rfc2553.h : BSD with advertising

# lib/isc/commandline.c (not used) : BSD with advertising

# lib/isc/inet_aton.c (not used) : BSD with advertising

# lib/isc/strtoul.c (not used) : BSD with advertising

# lib/isc/unix/file.c : BSD with advertising

# lib/isc/inet_aton.c (not used) : BSD with advertising

# libntp/mktime.c : BSD with advertising

# libntp/ntp_random.c : BSD with advertising

# libntp/memmove.c : BSD with advertising

# libntp/ntp_rfc2553.c : BSD with advertising

# libntp/adjtimex.c (not used) : BSD

# libparse/ : BSD

# ntpd/refclock_jjy.c: MIT

# ntpd/refclock_oncore.c : BEERWARE License (aka, Public Domain)

# ntpd/refclock_palisade.c : BSD with advertising

# ntpd/refclock_jupiter.c : BSD with advertising

# ntpd/refclock_mx4200.c : BSD with advertising

# ntpd/refclock_palisade.h : BSD with advertising

# ntpstat-0.2/ : GPLv2

# sntp/libopts/ (not used) : BSD or GPLv3+

# util/ansi2knr.c (not used) : GPL+

License: (MIT and BSD and BSD with advertising) and GPLv2

Group: System Environment/Daemons

Source0: http://www.eecis.udel.edu/~ntp/ntp_spool/ntp4/ntp-4.2/ntp-%{version}.tar.gz

Source1: ntp.conf

Source2: ntp.keys

Source4: ntpd.sysconfig

# http://people.redhat.com/rkeech/#ntpstat

Source5: ntpstat-0.2.tgz

Source6: ntp.step-tickers

Source7: ntpdate.wrapper

Source8: ntp.cryptopw

Source9: ntpdate.sysconfig

Source10: ntp.dhclient

Source12: ntpd.service

Source13: ntpdate.service

Source14: ntp-wait.service

Source15: sntp.service

Source16: sntp.sysconfig

# ntpbz #802

Patch1: ntp-4.2.6p1-sleep.patch

# add support for dropping root to ntpdate

Patch2: ntp-4.2.6p4-droproot.patch

# ntpbz #779

Patch3: ntp-4.2.6p3-bcast.patch

# align buffer for control messages

Patch4: ntp-4.2.6p1-cmsgalign.patch

# link ntpd with -ffast-math on ia64

Patch5: ntp-4.2.6p1-linkfastmath.patch

# ntpbz #2294

Patch6: ntp-4.2.6p5-fipsmd5.patch

# ntpbz #759

Patch7: ntp-4.2.6p1-retcode.patch

# ntpbz #2085

Patch8: ntp-4.2.6p5-rootdisp.patch

# ntpbz #2309

Patch9: ntp-4.2.6p5-hexpw.patch

# ntpbz #898

Patch10: ntp-4.2.6p4-htmldoc.patch

# ntpbz #1402

Patch11: ntp-4.2.6p5-updatebclient.patch

# fix precision calculation on fast CPUs

Patch12: ntp-4.2.4p7-getprecision.patch

# ntpbz #1408

Patch13: ntp-4.2.6p5-logdefault.patch

# add option -m to lock memory

Patch14: ntp-4.2.6p5-mlock.patch

# allow -u and -p options to be used twice (#639101)

Patch15: ntp-4.2.6p5-multiopts.patch

# ntpbz #2040

Patch16: ntp-4.2.6p5-identlen.patch

# ntpbz #1670

Patch17: ntp-4.2.6p3-broadcastdelay.patch

# ntpbz #1671

Patch18: ntp-4.2.6p5-delaycalib.patch

# ntpbz #2019

Patch19: ntp-4.2.6p5-pwcipher.patch

# ntpbz #2320

Patch20: ntp-4.2.6p5-noservres.patch

# ntpbz #2506

Patch21: ntp-4.2.6p5-refreshroute.patch

# ntpbz #2666

Patch22: ntp-4.2.6p5-cve-2014-9294.patch

# ntpbz #2665

Patch23: ntp-4.2.6p5-cve-2014-9293.patch

# ntpbz #2667

Patch24: ntp-4.2.6p5-cve-2014-9295.patch

# ntpbz #2670

Patch25: ntp-4.2.6p5-cve-2014-9296.patch

# ntpbz #2671

Patch26: ntp-4.2.6p5-cve-2014-9297.patch

# ntpbz #2672

Patch27: ntp-4.2.6p5-cve-2014-9298.patch

# ntpbz #2174

Patch28: ntp-4.2.6p5-sourceport.patch

# ntpbz #2612

Patch29: ntp-4.2.6p5-monwarn.patch

# ntpbz #1232

Patch30: ntp-4.2.6p5-nanoshm.patch

# ntpbz #2661

Patch32: ntp-4.2.6p5-mreadvar.patch

# ntpbz #730

Patch33: ntp-4.2.6p5-rsaexp.patch

# ntpbz #2537

Patch34: ntp-4.2.6p5-keylen.patch

# ntpbz #2627

Patch35: ntp-4.2.6p5-shmperm.patch

# ntpbz #2745

Patch36: ntp-4.2.6p5-xleap.patch

# ntpbz #2805

Patch37: ntp-4.2.6p5-mcastjoin.patch

# ntpbz #2763, ntpbz #2811

Patch38: ntp-4.2.6p5-backfwdstep.patch

# ntpbz #2779

Patch39: ntp-4.2.6p5-cve-2015-1798.patch

# ntpbz #2781

Patch40: ntp-4.2.6p5-cve-2015-1799.patch

# ntpbz #2797

Patch41: ntp-4.2.6p5-cve-2015-3405.patch

# ntpbz #2837

Patch42: ntp-4.2.6p5-dscp.patch

# ntpbz #2901

Patch43: ntp-4.2.6p5-cve-2015-7704.patch

# allow only one step larger than panic threshold with -g

Patch44: ntp-4.2.6p5-cve-2015-5300.patch

# ntpbz #2246

Patch45: ntp-4.2.6p5-leapreset.patch

# ntpbz #2081

Patch46: ntp-4.2.6p5-rawstats.patch

# ntpbz #2639, #2880

Patch47: ntp-4.2.6p5-clockstate.patch

# ntpbz #2851

Patch48: ntp-4.2.6p5-restrict46.patch

# ntpbz #1593

Patch49: ntp-4.2.6p5-cve-2015-5194.patch

# fix crash when referencing disabled statistic type

Patch50: ntp-4.2.6p5-cve-2015-5195.patch

# don't hang in sntp with crafted reply

Patch51: ntp-4.2.6p5-cve-2015-5219.patch

# ntpbz #2909

Patch52: ntp-4.2.6p5-cve-2015-7701.patch

# ntpbz #2899

Patch53: ntp-4.2.6p5-cve-2015-7691_7692_7702.patch

# ntpbz #2919

Patch54: ntp-4.2.6p5-cve-2015-7852.patch

# ntpbz #2902

Patch55: ntp-4.2.6p5-cve-2015-7703.patch

# ntpbz #2945

Patch56: ntp-4.2.6p5-cve-2015-8138.patch

# ntpbz #2939, #2940

Patch57: ntp-4.2.6p5-cve-2015-7977_7978.patch

# ntpbz #2948

Patch58: ntp-4.2.6p5-cve-2015-8158.patch

# ntpbz #2936

Patch59: ntp-4.2.6p5-cve-2015-7974.patch

# ntpbz #2942, ntpbz #3007

Patch60: ntp-4.2.6p5-cve-2015-7979.patch

# ntpbz #2978

Patch61: ntp-4.2.6p5-cve-2016-1548.patch

# ntpbz #3009

Patch62: ntp-4.2.6p5-cve-2016-2518.patch

# ntpbz #2879

Patch63: ntp-4.2.6p5-cve-2016-1550.patch

# handle unknown clock types

Patch100: ntpstat-0.2-clksrc.patch

# process first packet in multipacket response

Patch101: ntpstat-0.2-multipacket.patch

# use current system variable names

Patch102: ntpstat-0.2-sysvars.patch

# print synchronization distance instead of dispersion

Patch103: ntpstat-0.2-maxerror.patch

# fix error bit checking

Patch104: ntpstat-0.2-errorbit.patch

# improve man page

Patch105: ntpstat-0.2-manual.patch

URL: http://www.ntp.org

Requires(post): systemd-units

Requires(preun): systemd-units

Requires(postun): systemd-units

Requires: ntpdate = %{version}-%{release}

BuildRequires: libcap-devel openssl-devel libedit-devel perl-HTML-Parser

BuildRequires: pps-tools-devel autogen autogen-libopts-devel systemd-units

BuildRequires: bison

%description

The Network Time Protocol (NTP) is used to synchronize a computer's

time with another reference time source. This package includes ntpd

(a daemon which continuously adjusts system time) and utilities used

to query and configure the ntpd daemon.

Perl scripts ntp-wait and ntptrace are in the ntp-perl package,

ntpdate is in the ntpdate package and sntp is in the sntp package.

The documentation is in the ntp-doc package.

%package perl

Summary: NTP utilities written in Perl

Group: Applications/System

Requires: %{name} = %{version}-%{release}

Requires(post): systemd-units

Requires(preun): systemd-units

Requires(postun): systemd-units

# perl introduced in 4.2.4p4-7

Obsoletes: %{name} < 4.2.4p4-7

BuildArch: noarch

%description perl

This package contains Perl scripts ntp-wait and ntptrace.

%package -n ntpdate

Summary: Utility to set the date and time via NTP

Group: Applications/System

Requires(pre): shadow-utils

Requires(post): systemd-units

Requires(preun): systemd-units

Requires(postun): systemd-units

%description -n ntpdate

ntpdate is a program for retrieving the date and time from

NTP servers.

%package -n sntp

Summary: Standard Simple Network Time Protocol program

Group: Applications/System

Requires(post): systemd-units

Requires(preun): systemd-units

Requires(postun): systemd-units

%description -n sntp

sntp can be used as a SNTP client to query a NTP or SNTP server and either

display the time or set the local system's time (given suitable privilege).

It can be run as an interactive command or in a cron job.

%package doc

Summary: NTP documentation

Group: Documentation

Requires: %{name} = %{version}-%{release}

BuildArch: noarch

%description doc

This package contains NTP documentation in HTML format.

%global ntpdocdir %{_datadir}/doc/%{name}-%{version}

# pool.ntp.org vendor zone which will be used in ntp.conf

%if 0%{!?vendorzone:1}

%{?fedora: %global vendorzone fedora.}

%{?rhel: %global vendorzone centos.}

%endif

%prep

%setup -q -a 5

%patch1 -p1 -b .sleep

%patch2 -p1 -b .droproot

%patch3 -p1 -b .bcast

%patch4 -p1 -b .cmsgalign

%ifarch ia64

%patch5 -p1 -b .linkfastmath

%endif

%patch6 -p1 -b .fipsmd5

%patch7 -p1 -b .retcode

%patch8 -p1 -b .rootdisp

%patch9 -p1 -b .hexpw

%patch10 -p1 -b .htmldoc

%patch11 -p1 -b .updatebclient

%patch12 -p1 -b .getprecision

%patch13 -p1 -b .logdefault

%patch14 -p1 -b .mlock

%patch15 -p1 -b .multiopts

%patch16 -p1 -b .identlen

%patch17 -p1 -b .broadcastdelay

%patch18 -p1 -b .delaycalib

%patch19 -p1 -b .pwcipher

%patch20 -p1 -b .noservres

%patch21 -p1 -b .refreshroute

%patch22 -p1 -b .cve-2014-9294

%patch23 -p1 -b .cve-2014-9293

%patch24 -p1 -b .cve-2014-9295

%patch25 -p1 -b .cve-2014-9296

%patch26 -p1 -b .cve-2014-9297

%patch27 -p1 -b .cve-2014-9298

%patch28 -p1 -b .sourceport

%patch29 -p1 -b .monwarn

%patch30 -p1 -b .nanoshm

%patch32 -p1 -b .mreadvar

%patch33 -p1 -b .rsaexp

%patch34 -p1 -b .keylen

%patch35 -p1 -b .shmperm

%patch36 -p1 -b .xleap

%patch37 -p1 -b .mcastjoin

%patch38 -p1 -b .backfwdstep

%patch39 -p1 -b .cve-2015-1798

%patch40 -p1 -b .cve-2015-1799

%patch41 -p1 -b .cve-2015-3405

%patch42 -p1 -b .dscp

%patch43 -p1 -b .cve-2015-7704

%patch44 -p1 -b .cve-2015-5300

%patch45 -p1 -b .leapreset

%patch46 -p1 -b .rawstats

%patch47 -p1 -b .clockstate

%patch48 -p1 -b .restrict46

%patch49 -p1 -b .cve-2015-5194

%patch50 -p1 -b .cve-2015-5195

%patch51 -p1 -b .cve-2015-5219

%patch52 -p1 -b .cve-2015-7701

%patch53 -p1 -b .cve-2015-7691_7692_7702

%patch54 -p1 -b .cve-2015-7852

%patch55 -p1 -b .cve-2015-7703

%patch56 -p1 -b .cve-2015-8138

%patch57 -p1 -b .cve-2015-7977_7978

%patch58 -p1 -b .cve-2015-8158

%patch59 -p1 -b .cve-2015-7974

%patch60 -p1 -b .cve-2015-7979

%patch61 -p1 -b .cve-2016-1548

%patch62 -p1 -b .cve-2016-2518

%patch63 -p1 -b .cve-2016-1550

# ntpstat patches

%patch100 -p1 -b .clksrc

%patch101 -p1 -b .multipacket

%patch102 -p1 -b .sysvars

%patch103 -p1 -b .maxerror

%patch104 -p1 -b .errorbit

%patch105 -p1 -b .manual

# set default path to sntp KoD database

sed -i 's|/var/db/ntp-kod|%{_localstatedir}/lib/sntp/kod|' sntp/{sntp.1,main.c}

# fix line terminators

sed -i 's|\r||g' html/scripts/{footer.txt,style.css}

for f in COPYRIGHT ChangeLog; do

	iconv -f iso8859-1 -t utf8 -o ${f}{_,} && touch -r ${f}{,_} && mv -f ${f}{_,}

done

# don't regenerate texinfo files as it breaks build with _smp_mflags

touch ntpd/ntpd-opts.texi util/ntp-keygen-opts.texi

# autogen fails to regenerate man pages (#958908), but they won't be used anyway

touch ntpd/ntpd.1 util/ntp-keygen.1

# make the build fail if the parsers are not regenerated

rm ntpd/ntp_parser.{c,h}

echo > ntpd/ntp_keyword.h

%build

sed -i 's|$CFLAGS -Wstrict-overflow|$CFLAGS|' configure sntp/configure

export CFLAGS="$RPM_OPT_FLAGS -fPIE -fno-strict-aliasing -fno-strict-overflow"

export LDFLAGS="-pie -Wl,-z,relro,-z,now"

%configure \

	--sysconfdir=%{_sysconfdir}/ntp/crypto \

	--with-openssl-libdir=%{_libdir} \

	--without-ntpsnmpd \

	--enable-all-clocks --enable-parse-clocks \

	--enable-ntp-signd=%{_localstatedir}/run/ntp_signd \

	--disable-local-libopts

echo '#define KEYFILE "%{_sysconfdir}/ntp/keys"' >> ntpdate/ntpdate.h

echo '#define NTP_VAR "%{_localstatedir}/log/ntpstats/"' >> config.h

make -C ntpd ntp_keyword.h

make %{?_smp_mflags}

sed -i 's|$ntpq = "ntpq"|$ntpq = "%{_sbindir}/ntpq"|' scripts/ntptrace

sed -i 's|ntpq -c |%{_sbindir}/ntpq -c |' scripts/ntp-wait

pushd html

../scripts/html2man

# remove adjacent blank lines

sed -i 's/^[\t\ ]*$//;/./,/^$/!d' man/man*/*.[58]

popd 

make -C ntpstat-0.2 CFLAGS="$CFLAGS"

%install

make DESTDIR=$RPM_BUILD_ROOT bindir=%{_sbindir} install

mkdir -p $RPM_BUILD_ROOT%{_mandir}/man{5,8}

sed -i 's/sntp\.1/sntp\.8/' $RPM_BUILD_ROOT%{_mandir}/man1/sntp.1

mv $RPM_BUILD_ROOT%{_mandir}/man{1/sntp.1,8/sntp.8}

rm -rf $RPM_BUILD_ROOT%{_mandir}/man1

pushd ntpstat-0.2

mkdir -p $RPM_BUILD_ROOT%{_bindir}

install -m 755 ntpstat $RPM_BUILD_ROOT%{_bindir}

install -m 644 ntpstat.1 $RPM_BUILD_ROOT%{_mandir}/man8/ntpstat.8

popd

# fix section numbers

sed -i 's/\(\.TH[a-zA-Z ]*\)[1-9]\(.*\)/\18\2/' $RPM_BUILD_ROOT%{_mandir}/man8/*.8

cp -r html/man/man[58] $RPM_BUILD_ROOT%{_mandir}

mkdir -p $RPM_BUILD_ROOT%{ntpdocdir}

cp -p COPYRIGHT ChangeLog NEWS $RPM_BUILD_ROOT%{ntpdocdir}

# prepare html documentation

find html | grep -E '\.(html|css|txt|jpg|gif)$' | grep -v '/build/\|sntp' | \

	cpio -pmd $RPM_BUILD_ROOT%{ntpdocdir}

find $RPM_BUILD_ROOT%{ntpdocdir} -type f | xargs chmod 644

find $RPM_BUILD_ROOT%{ntpdocdir} -type d | xargs chmod 755

pushd $RPM_BUILD_ROOT

mkdir -p .%{_sysconfdir}/{ntp/crypto,sysconfig,dhcp/dhclient.d} .%{_libexecdir}

mkdir -p .%{_localstatedir}/{lib/{s,}ntp,log/ntpstats} .%{_unitdir}

touch .%{_localstatedir}/lib/{ntp/drift,sntp/kod}

sed -e 's|VENDORZONE\.|%{vendorzone}|' \

	-e 's|ETCNTP|%{_sysconfdir}/ntp|' \

	-e 's|VARNTP|%{_localstatedir}/lib/ntp|' \

	< %{SOURCE1} > .%{_sysconfdir}/ntp.conf

touch -r %{SOURCE1} .%{_sysconfdir}/ntp.conf

install -p -m600 %{SOURCE2} .%{_sysconfdir}/ntp/keys

install -p -m755 %{SOURCE7} .%{_libexecdir}/ntpdate-wrapper

install -p -m644 %{SOURCE4} .%{_sysconfdir}/sysconfig/ntpd

install -p -m644 %{SOURCE9} .%{_sysconfdir}/sysconfig/ntpdate

sed -e 's|VENDORZONE\.|%{vendorzone}|' \

	< %{SOURCE6} > .%{_sysconfdir}/ntp/step-tickers

touch -r %{SOURCE6} .%{_sysconfdir}/ntp/step-tickers

sed -e 's|VENDORZONE\.|%{vendorzone}|' \

	< %{SOURCE16} > .%{_sysconfdir}/sysconfig/sntp

touch -r %{SOURCE16} .%{_sysconfdir}/sysconfig/sntp

install -p -m600 %{SOURCE8} .%{_sysconfdir}/ntp/crypto/pw

install -p -m755 %{SOURCE10} .%{_sysconfdir}/dhcp/dhclient.d/ntp.sh

install -p -m644 %{SOURCE12} .%{_unitdir}/ntpd.service

install -p -m644 %{SOURCE13} .%{_unitdir}/ntpdate.service

install -p -m644 %{SOURCE14} .%{_unitdir}/ntp-wait.service

install -p -m644 %{SOURCE15} .%{_unitdir}/sntp.service

mkdir .%{_prefix}/lib/systemd/ntp-units.d

echo 'ntpd.service' > .%{_prefix}/lib/systemd/ntp-units.d/60-ntpd.list

popd

%pre -n ntpdate

/usr/sbin/groupadd -g 38 ntp  2> /dev/null || :

/usr/sbin/useradd -u 38 -g 38 -s /sbin/nologin -M -r -d %{_sysconfdir}/ntp ntp 2>/dev/null || :

%post

%systemd_post ntpd.service

%post -n ntpdate

%systemd_post ntpdate.service

%post -n sntp

%systemd_post sntp.service

%post perl

%systemd_post ntp-wait.service

%preun

%systemd_preun ntpd.service

%preun -n ntpdate

%systemd_preun ntpdate.service

%preun -n sntp

%systemd_preun sntp.service

%preun perl

%systemd_preun ntp-wait.service

%postun

%systemd_postun_with_restart ntpd.service

%postun -n ntpdate

%systemd_postun

%postun -n sntp

%systemd_postun

%postun perl

%systemd_postun

%files

%dir %{ntpdocdir}

%{ntpdocdir}/COPYRIGHT

%{ntpdocdir}/ChangeLog

%{ntpdocdir}/NEWS

%{_sbindir}/ntp-keygen

%{_sbindir}/ntpd

%{_sbindir}/ntpdc

%{_sbindir}/ntpq

%{_sbindir}/ntptime

%{_sbindir}/tickadj

%config(noreplace) %{_sysconfdir}/sysconfig/ntpd

%config(noreplace) %verify(not md5 size mtime) %{_sysconfdir}/ntp.conf

%dir %attr(750,root,ntp) %{_sysconfdir}/ntp/crypto

%config(noreplace) %{_sysconfdir}/ntp/crypto/pw

%dir %{_sysconfdir}/dhcp/dhclient.d

%{_sysconfdir}/dhcp/dhclient.d/ntp.sh

%dir %attr(-,ntp,ntp) %{_localstatedir}/lib/ntp

%ghost %attr(644,ntp,ntp) %{_localstatedir}/lib/ntp/drift

%dir %attr(-,ntp,ntp) %{_localstatedir}/log/ntpstats

%{_bindir}/ntpstat

%{_mandir}/man5/*.5*

%{_mandir}/man8/ntp-keygen.8*

%{_mandir}/man8/ntpd.8*

%{_mandir}/man8/ntpdc.8*

%{_mandir}/man8/ntpq.8*

%{_mandir}/man8/ntpstat.8*

%{_mandir}/man8/ntptime.8*

%{_mandir}/man8/tickadj.8*

%{_prefix}/lib/systemd/ntp-units.d/*.list

%{_unitdir}/ntpd.service

%files perl

%{_sbindir}/ntp-wait

%{_sbindir}/ntptrace

%{_mandir}/man8/ntp-wait.8*

%{_mandir}/man8/ntptrace.8*

%{_unitdir}/ntp-wait.service

%files -n ntpdate

%doc COPYRIGHT

%config(noreplace) %{_sysconfdir}/sysconfig/ntpdate

%dir %{_sysconfdir}/ntp

%config(noreplace) %{_sysconfdir}/ntp/keys

%config(noreplace) %verify(not md5 size mtime) %{_sysconfdir}/ntp/step-tickers

%{_libexecdir}/ntpdate-wrapper

%{_sbindir}/ntpdate

%{_mandir}/man8/ntpdate.8*

%{_unitdir}/ntpdate.service

%files -n sntp

%doc sntp/COPYRIGHT

%config(noreplace) %{_sysconfdir}/sysconfig/sntp

%{_sbindir}/sntp

%{_mandir}/man8/sntp.8*

%dir %{_localstatedir}/lib/sntp

%ghost %{_localstatedir}/lib/sntp/kod

%{_unitdir}/sntp.service

%files doc

%{ntpdocdir}/html

%changelog

* Thu Nov 03 2016 CentOS Sources <bugs@centos.org> - 4.2.6p5-25.el7.centos

- rebrand vendorzone

* Tue May 03 2016 Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-25

- don't allow spoofed packet to enable symmetric interleaved mode

  (CVE-2016-1548)

- check mode of new source in config command (CVE-2016-2518)

- make MAC check resilient against timing attack (CVE-2016-1550)

* Tue Mar 15 2016 Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-24

- fix crash with invalid logconfig command (CVE-2015-5194)

- fix crash when referencing disabled statistic type (CVE-2015-5195)

- don't hang in sntp with crafted reply (CVE-2015-5219)

- don't crash with crafted autokey packet (CVE-2015-7691, CVE-2015-7692,

  CVE-2015-7702)

- fix memory leak with autokey (CVE-2015-7701)

- don't allow setting driftfile and pidfile remotely (CVE-2015-7703)

- don't crash in ntpq with crafted packet (CVE-2015-7852)

- check key ID in packets authenticated with symmetric key (CVE-2015-7974)

- fix crash with reslist command (CVE-2015-7977, CVE-2015-7978)

- don't allow spoofed packets to demobilize associations (CVE-2015-7979,

  CVE-2016-1547)

- don't accept server/peer packets with zero origin timestamp (CVE-2015-8138)

- fix infinite loop in ntpq/ntpdc (CVE-2015-8158)

- fix resetting of leap status (#1242553)

- extend rawstats log (#1242877)

- report clock state changes related to leap seconds (#1242935)

- allow -4/-6 on restrict lines with mask (#1304492)

- explain synchronised state in ntpstat man page (#1309594)

* Fri Oct 16 2015 Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-22

- check origin timestamp before accepting KoD RATE packet (CVE-2015-7704)

- allow only one step larger than panic threshold with -g (CVE-2015-5300)

* Thu Jun 04 2015 Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-20

- validate lengths of values in extension fields (CVE-2014-9297)

- drop packets with spoofed source address ::1 (CVE-2014-9298)

- reject packets without MAC when authentication is enabled (CVE-2015-1798)

- protect symmetric associations with symmetric key against DoS attack (CVE-2015-1799)

- fix generation of MD5 keys with ntp-keygen on big-endian systems (CVE-2015-3405)

- add option to set Differentiated Services Code Point (DSCP) (#1202828)

- add nanosecond support to SHM refclock (#1117702)

- allow creating all SHM segments with owner-only access (#1122012)

- allow different thresholds for forward and backward step (#1193154)

- allow symmetric keys up to 32 bytes again (#1191111)

- don't step clock for leap second with -x option (#1191122)

- don't drop packets with source port below 123 (#1171640)

- retry joining multicast groups (#1207014)

- increase memlock limit again (#1053569)

- warn when monitor can't be disabled due to limited restrict (#1191108)

- use larger RSA exponent in ntp-keygen (#1191116)

- fix crash in ntpq mreadvar command (#1180721)

- move sntp kod database to allow SELinux labeling (#1082934)

- fix typos in ntpd man page (#1195211)

- improve documentation of restrict command (#1213953)

* Fri Dec 19 2014 Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-19

- don't generate weak control key for resolver (CVE-2014-9293)

- don't generate weak MD5 keys in ntp-keygen (CVE-2014-9294)

- fix buffer overflows via specially-crafted packets (CVE-2014-9295)

- don't mobilize passive association when authentication fails (CVE-2014-9296)

* Tue Feb 11 2014 Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-18

- disable monitor in default ntp.conf (#1047856)

* Fri Jan 24 2014 Daniel Mach <dmach@redhat.com> - 4.2.6p5-17

- Mass rebuild 2014-01-24

* Fri Jan 03 2014 Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-16

- refresh peers on routing updates (#1048132)

- fix calculation of root dispersion (#1045377)

- remove unnecessary IPv6 restrict line from default ntp.conf (#1048255)

- remove kod from default restrict in ntp.conf (#1048255)

- update logconfig documentation for patched default (#1048252)

* Fri Dec 27 2013 Daniel Mach <dmach@redhat.com> - 4.2.6p5-15

- Mass rebuild 2013-12-27

* Fri Oct 04 2013 Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-14

- remove ControlGroup in ntpd service (#999980)

- don't build ntpsnmpd (#1015435)

* Mon Jul 15 2013 Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-13

- ignore duplicate servers from dhclient

- don't use -Wstrict-overflow with -fno-strict-overflow

- buildrequire systemd-units

- remove pie test

* Thu May 02 2013 Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-12

- workaround failing autogen

- move files from /lib

- don't own ntp-units.d directory

- drop old systemd scriptlets

- fix dates in changelog

* Tue Apr 02 2013 Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-11

- avoid rereading /etc/services (#768804)

- remove ntp-wait dependency from ntpd service (#906753)

- add missing and remove unrecognized options in documentation

- update comments in some config files

* Thu Feb 14 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 4.2.6p5-10

- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild

* Fri Jan 04 2013 Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-9

- compile with -fno-strict-overflow

* Wed Dec 05 2012 Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-8

- add option to set identity modulus size in ntp-keygen

* Fri Nov 23 2012 Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-7

- allow selection of cipher for private key files

- set identity modulus size in ntp-keygen

- create sntp subpackage

- add sntp service

- use system libopts

- add Wants=ntp-wait.service to ntpd service

- don't fail when /etc/sysconfig/ntpd is missing

- modify mlock and multiopts patches to use autogen

- make perl subpackage noarch

* Tue Nov 20 2012 Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-6

- bind broadcast client to new interfaces (#722690)

- decode hex encoded passwords in ntpq/ntpdc

- remove sample MD5 keys from default keys config

* Wed Oct 24 2012 Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-5

- fix crash in FIPS mode (#839280)

- use systemd macros if available (#850235)

- remove obsolete macros

* Tue Aug 07 2012 Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-4

- start ntpdate service after nss-lookup.target (#837486)

- update systemd-timedated integration (#846077)

* Fri Jul 20 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 4.2.6p5-3

- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild

* Fri Apr 27 2012 Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-2

- update service file for systemd-timedated-ntp target (#816495)

- allow service to set realtime scheduler (#810801)

- drop comment enabling local driver in default config

* Tue Feb 28 2012 Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-1

- update to 4.2.6p5

- switch service type to forking

* Tue Feb 07 2012 Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p4-3

- add default servers to step-tickers (#772389)

- enable PrivateTmp in ntpd service (#782520)

* Fri Jan 13 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 4.2.6p4-2

- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild

* Thu Oct 06 2011 Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p4-1

- update to 4.2.6p4

- buildrequire pps-tools-devel

- fix errors in ntpstat found by coverity

* Sun Aug 14 2011 Rex Dieter <rdieter@fedoraproject.org> - 4.2.6p3-5.1

- Rebuilt for rpm (#728707)

* Wed Jul 20 2011 Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p3-5

- drop SysV init scripts (#697526, #714705)

- add ntp-wait service

* Fri May 06 2011 Bill Nottingham <notting@redhat.com> 4.2.6p3-4

- fix systemd scriplets to properly handle upgrades

* Wed Apr 06 2011 Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p3-3

- pull in time-sync.target from ntpdate.service (Lennart Poettering)

- link with -Wl,-z,relro,-z,now options

- fix typo in ntpq man page (#664525)

* Tue Feb 08 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 4.2.6p3-2