From cdde2bded89371f46824432975586c6022c5a96f Mon Sep 17 00:00:00 2001 From: CentOS Buildsys Date: Feb 11 2014 17:20:55 +0000 Subject: import ntp-4.2.6p5-18.el7.src.rpm --- diff --git a/SOURCES/ntp-4.2.6p1-logdefault.patch b/SOURCES/ntp-4.2.6p1-logdefault.patch deleted file mode 100644 index ae816b7..0000000 --- a/SOURCES/ntp-4.2.6p1-logdefault.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -up ntp-4.2.6p1/ntpd/ntp_config.c.logdefault ntp-4.2.6p1/ntpd/ntp_config.c ---- ntp-4.2.6p1/ntpd/ntp_config.c.logdefault 2010-01-24 11:01:45.000000000 +0100 -+++ ntp-4.2.6p1/ntpd/ntp_config.c 2010-03-09 17:44:09.000000000 +0100 -@@ -3794,7 +3794,7 @@ getconfig( - - #endif /* SYS_WINNT */ - res_fp = NULL; -- ntp_syslogmask = NLOG_SYNCMASK; /* set more via logconfig */ -+ ntp_syslogmask = NLOG_SYNCMASK | NLOG_EVENT | NLOG_STATUS; /* set more via logconfig */ - - /* - * install a non default variable with this daemon version diff --git a/SOURCES/ntp-4.2.6p4-rtnetlink.patch b/SOURCES/ntp-4.2.6p4-rtnetlink.patch deleted file mode 100644 index 06d2e87..0000000 --- a/SOURCES/ntp-4.2.6p4-rtnetlink.patch +++ /dev/null @@ -1,15 +0,0 @@ -diff -up ntp-4.2.6p4/ntpd/ntp_io.c.rtnetlink ntp-4.2.6p4/ntpd/ntp_io.c ---- ntp-4.2.6p4/ntpd/ntp_io.c.rtnetlink 2011-10-05 15:49:17.061711033 +0200 -+++ ntp-4.2.6p4/ntpd/ntp_io.c 2011-10-05 15:49:17.074711042 +0200 -@@ -4549,10 +4549,7 @@ init_async_notifications() - #ifdef HAVE_RTNETLINK - memset(&sa, 0, sizeof(sa)); - sa.nl_family = PF_NETLINK; -- sa.nl_groups = RTMGRP_LINK | RTMGRP_IPV4_IFADDR -- | RTMGRP_IPV6_IFADDR | RTMGRP_IPV4_ROUTE -- | RTMGRP_IPV4_MROUTE | RTMGRP_IPV6_ROUTE -- | RTMGRP_IPV6_MROUTE; -+ sa.nl_groups = RTMGRP_IPV4_IFADDR | RTMGRP_IPV6_IFADDR; - if (bind(fd, (struct sockaddr *)&sa, sizeof(sa)) < 0) { - msyslog(LOG_ERR, - "bind failed on routing socket (%m) - using polled interface update"); diff --git a/SOURCES/ntp-4.2.6p5-logdefault.patch b/SOURCES/ntp-4.2.6p5-logdefault.patch new file mode 100644 index 0000000..177a59b --- /dev/null +++ b/SOURCES/ntp-4.2.6p5-logdefault.patch @@ -0,0 +1,30 @@ +diff -up ntp-4.2.6p5/html/miscopt.html.logdefault ntp-4.2.6p5/html/miscopt.html +--- ntp-4.2.6p5/html/miscopt.html.logdefault 2009-12-09 08:36:36.000000000 +0100 ++++ ntp-4.2.6p5/html/miscopt.html 2014-01-03 15:08:11.947681966 +0100 +@@ -56,11 +56,11 @@ +
While not strictly a security function, the Autokey protocol provides means to securely retrieve the current or updated leapsecond values from a server.
+
logconfig configkeyword
+
This command controls the amount and type of output written to the system syslog facility or the alternate logfile log file. All configkeyword keywords can be prefixed with =, + and -, where = sets the syslogmask, + adds and - removes messages. syslog messages can be controlled in four classes (clock, peer, sys and sync). Within these classes four types of messages can be controlled: informational messages (info), event messages (events), statistics messages (statistics) and status messages (status).
+-
Configuration keywords are formed by concatenating the message class with the event class. The all prefix can be used instead of a message class. A message class may also be followed by the all keyword to enable/disable all messages of the respective message class. By default, logconfig output is set to allsync.
++
Configuration keywords are formed by concatenating the message class with the event class. The all prefix can be used instead of a message class. A message class may also be followed by the all keyword to enable/disable all messages of the respective message class. By default, logconfig output is set to =syncall +sysevents +sysstatus.
+
Thus, a minimal log configuration could look like this:
+-
logconfig=syncstatus +sysevents
++
logconfig =syncstatus +sysevents
+
This would just list the synchronizations state of ntpd and the major system events. For a simple reference server, the following minimum message configuration could be useful:
+-
logconfig allsync +allclock
++
logconfig =syncall +clockall
+
This configuration will list all clock information and synchronization information. All other events and messages about peers, system events and so on is suppressed.
+
logfile logfile
+
This command specifies the location of an alternate log file to be used instead of the default system syslog facility. This is the same operation as the -l command line option.
+diff -up ntp-4.2.6p5/ntpd/ntp_config.c.logdefault ntp-4.2.6p5/ntpd/ntp_config.c +--- ntp-4.2.6p5/ntpd/ntp_config.c.logdefault 2011-12-01 03:55:17.000000000 +0100 ++++ ntp-4.2.6p5/ntpd/ntp_config.c 2014-01-03 15:05:44.293553494 +0100 +@@ -3835,7 +3835,7 @@ getconfig( + + #endif /* SYS_WINNT */ + res_fp = NULL; +- ntp_syslogmask = NLOG_SYNCMASK; /* set more via logconfig */ ++ ntp_syslogmask = NLOG_SYNCMASK | NLOG_SYSEVENT | NLOG_SYSSTATUS; /* set more via logconfig */ + + /* + * install a non default variable with this daemon version diff --git a/SOURCES/ntp-4.2.6p5-refreshroute.patch b/SOURCES/ntp-4.2.6p5-refreshroute.patch new file mode 100644 index 0000000..d8737e2 --- /dev/null +++ b/SOURCES/ntp-4.2.6p5-refreshroute.patch @@ -0,0 +1,111 @@ +Backported from ntp-dev-4.2.7p399 + +diff -up ntp-4.2.6p5/ntpd/ntp_io.c.refreshroute ntp-4.2.6p5/ntpd/ntp_io.c +--- ntp-4.2.6p5/ntpd/ntp_io.c.refreshroute 2013-10-17 13:48:34.808727175 +0200 ++++ ntp-4.2.6p5/ntpd/ntp_io.c 2013-12-09 14:02:28.076249785 +0100 +@@ -1785,7 +1785,6 @@ update_interfaces( + isc_result_t result; + isc_interface_t isc_if; + int new_interface_found; +- int refresh_peers; + unsigned int family; + endpt enumep; + endpt * ep; +@@ -1800,7 +1799,6 @@ update_interfaces( + */ + + new_interface_found = FALSE; +- refresh_peers = FALSE; + iter = NULL; + result = isc_interfaceiter_create(mctx, &iter); + +@@ -1836,6 +1834,8 @@ update_interfaces( + + convert_isc_if(&isc_if, &enumep, port); + ++ DPRINT_INTERFACE(4, (&enumep, "examining ", "\n")); ++ + /* + * Check if and how we are going to use the interface. + */ +@@ -1843,19 +1843,23 @@ update_interfaces( + enumep.flags)) { + + case ACTION_IGNORE: ++ DPRINTF(4, ("ignoring interface %s (%s) - by nic rules\n", ++ enumep.name, stoa(&enumep.sin))); + continue; + + case ACTION_LISTEN: ++ DPRINTF(4, ("listen interface %s (%s) - by nic rules\n", ++ enumep.name, stoa(&enumep.sin))); + enumep.ignore_packets = ISC_FALSE; + break; + + case ACTION_DROP: ++ DPRINTF(4, ("drop on interface %s (%s) - by nic rules\n", ++ enumep.name, stoa(&enumep.sin))); + enumep.ignore_packets = ISC_TRUE; + break; + } + +- DPRINT_INTERFACE(4, (&enumep, "examining ", "\n")); +- + /* interfaces must be UP to be usable */ + if (!(enumep.flags & INT_UP)) { + DPRINTF(4, ("skipping interface %s (%s) - DOWN\n", +@@ -1898,15 +1902,8 @@ update_interfaces( + */ + strncpy(ep->name, enumep.name, + sizeof(ep->name)); +- if (ep->ignore_packets != +- enumep.ignore_packets) { +- ep->ignore_packets = ++ ep->ignore_packets = + enumep.ignore_packets; +- refresh_peers = TRUE; +- DPRINTF(4, ("refreshing peers due to %s ignore_packets change to %d\n", +- stoa(&ep->sin), +- ep->ignore_packets)); +- } + } else { + /* name collision - rename interface */ + strncpy(ep->name, "*multiple*", +@@ -1971,9 +1968,6 @@ update_interfaces( + (*receiver)(data, &ifi); + + new_interface_found = TRUE; +- refresh_peers = TRUE; +- DPRINTF(4, ("refreshing peers due to new addr %s\n", +- stoa(&ep->sin))); + DPRINT_INTERFACE(3, + (ep, "updating ", + " new - created\n")); +@@ -2013,9 +2007,6 @@ update_interfaces( + DPRINT_INTERFACE(3, (ep, "updating ", + "GONE - deleting\n")); + remove_interface(ep); +- refresh_peers = TRUE; +- DPRINTF(4, ("refreshing peers due to deleted addr %s", +- stoa(&ep->sin))); + + ifi.action = IFS_DELETED; + ifi.ep = ep; +@@ -2037,12 +2028,12 @@ update_interfaces( + } + + /* +- * phase 3 - re-configure as the world has changed if necessary ++ * phase 3 - re-configure as the world has possibly changed ++ * ++ * never ever make this conditional again - it is needed to track ++ * routing updates. see bug #2506 + */ +- if (refresh_peers) { +- refresh_all_peerinterfaces(); +- msyslog(LOG_INFO, "peers refreshed"); +- } ++ refresh_all_peerinterfaces(); + + if (sys_bclient) + io_setbclient(); diff --git a/SOURCES/ntp-4.2.6p5-rootdisp.patch b/SOURCES/ntp-4.2.6p5-rootdisp.patch new file mode 100644 index 0000000..9d90359 --- /dev/null +++ b/SOURCES/ntp-4.2.6p5-rootdisp.patch @@ -0,0 +1,84 @@ +Backported from ntp-dev-4.2.7p385 + +diff -up ntp-4.2.6p5/ntpd/ntp_proto.c.rootdisp ntp-4.2.6p5/ntpd/ntp_proto.c +--- ntp-4.2.6p5/ntpd/ntp_proto.c.rootdisp 2013-12-09 15:02:58.394459288 +0100 ++++ ntp-4.2.6p5/ntpd/ntp_proto.c 2013-12-09 15:10:05.770954848 +0100 +@@ -1667,10 +1667,34 @@ clock_update( + sys_refid = peer->refid; + else + sys_refid = addr2refid(&peer->srcadr); +- dtemp = sys_jitter + fabs(sys_offset) + peer->disp + +- (peer->delay + peer->rootdelay) / 2 + clock_phi * +- (current_time - peer->update); +- sys_rootdisp = dtemp + peer->rootdisp; ++ /* ++ * Root Dispersion (E) is defined (in RFC 5905) as: ++ * ++ * E = p.epsilon_r + p.epsilon + p.psi + PHI*(s.t - p.t) + |THETA| ++ * ++ * where: ++ * p.epsilon_r is the PollProc's root dispersion ++ * p.epsilon is the PollProc's dispersion ++ * p.psi is the PollProc's jitter ++ * THETA is the combined offset ++ * ++ * NB: Think Hard about where these numbers come from and ++ * what they mean. When did peer->update happen? Has anything ++ * interesting happened since then? What values are the most ++ * defensible? Why? ++ * ++ * DLM thinks this equation is probably the best of all worse choices. ++ */ ++ dtemp = peer->rootdisp ++ + peer->disp ++ + sys_jitter ++ + clock_phi * (current_time - peer->update) ++ + fabs(sys_offset); ++ ++ if (dtemp > sys_mindisp) ++ sys_rootdisp = dtemp; ++ else ++ sys_rootdisp = sys_mindisp; + sys_rootdelay = peer->delay + peer->rootdelay; + sys_reftime = peer->dst; + +@@ -2810,15 +2834,36 @@ root_distance( + double dtemp; + + /* ++ * Root Distance (LAMBDA) is defined as: ++ * (delta + DELTA)/2 + epsilon + EPSILON + phi ++ * ++ * where: ++ * delta is the round-trip delay ++ * DELTA is the root delay ++ * epsilon is the remote server precision + local precision ++ * + (15 usec each second) ++ * EPSILON is the root dispersion ++ * phi is the peer jitter statistic ++ * ++ * NB: Think hard about why we are using these values, and what ++ * the alternatives are, and the various pros/cons. ++ * ++ * DLM thinks these are probably the best choices from any of the ++ * other worse choices. ++ */ ++ dtemp = (peer->delay + peer->rootdelay) / 2 ++ + LOGTOD(peer->precision) ++ + LOGTOD(sys_precision) ++ + clock_phi * (current_time - peer->update) ++ + peer->rootdisp ++ + peer->jitter; ++ /* + * Careful squeak here. The value returned must be greater than + * the minimum root dispersion in order to avoid clockhop with + * highly precise reference clocks. Note that the root distance + * cannot exceed the sys_maxdist, as this is the cutoff by the + * selection algorithm. + */ +- dtemp = (peer->delay + peer->rootdelay) / 2 + peer->disp + +- peer->rootdisp + clock_phi * (current_time - peer->update) + +- peer->jitter; + if (dtemp < sys_mindisp) + dtemp = sys_mindisp; + return (dtemp); diff --git a/SOURCES/ntp.conf b/SOURCES/ntp.conf index baa57b3..5ce2137 100644 --- a/SOURCES/ntp.conf +++ b/SOURCES/ntp.conf @@ -5,14 +5,13 @@ driftfile VARNTP/drift # Permit time synchronization with our time source, but do not # permit the source to query or modify the service on this system. -restrict default kod nomodify notrap nopeer noquery -restrict -6 default kod nomodify notrap nopeer noquery +restrict default nomodify notrap nopeer noquery # Permit all access over the loopback interface. This could # be tightened as well, but to do so would effect some of # the administrative functions. restrict 127.0.0.1 -restrict -6 ::1 +restrict ::1 # Hosts on local network are less restricted. #restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap @@ -51,3 +50,9 @@ keys ETCNTP/keys # Enable writing of statistics records. #statistics clockstats cryptostats loopstats peerstats + +# Disable the monitoring facility to prevent amplification attacks using ntpdc +# monlist command when default restrict does not include the noquery flag. See +# CVE-2013-5211 for more details. +# Note: Monitoring will not be disabled with the limited restriction flag. +disable monitor diff --git a/SPECS/ntp.spec b/SPECS/ntp.spec index 57276a6..8a45f0f 100644 --- a/SPECS/ntp.spec +++ b/SPECS/ntp.spec @@ -1,7 +1,7 @@ Summary: The NTP daemon and utilities Name: ntp Version: 4.2.6p5 -Release: 14%{?dist} +Release: 18%{?dist} # primary license (COPYRIGHT) : MIT # ElectricFence/ (not used) : GPLv2 # kernel/sys/ppsclock.h (not used) : BSD with advertising @@ -61,8 +61,8 @@ Patch5: ntp-4.2.6p1-linkfastmath.patch Patch6: ntp-4.2.6p5-fipsmd5.patch # ntpbz #759 Patch7: ntp-4.2.6p1-retcode.patch -# ntpbz #992 -Patch8: ntp-4.2.6p4-rtnetlink.patch +# ntpbz #2085 +Patch8: ntp-4.2.6p5-rootdisp.patch # ntpbz #2309 Patch9: ntp-4.2.6p5-hexpw.patch # ntpbz #898 @@ -72,7 +72,7 @@ Patch11: ntp-4.2.6p5-updatebclient.patch # fix precision calculation on fast CPUs Patch12: ntp-4.2.4p7-getprecision.patch # ntpbz #1408 -Patch13: ntp-4.2.6p1-logdefault.patch +Patch13: ntp-4.2.6p5-logdefault.patch # add option -m to lock memory Patch14: ntp-4.2.6p5-mlock.patch # allow -u and -p options to be used twice (#639101) @@ -87,6 +87,8 @@ Patch18: ntp-4.2.6p5-delaycalib.patch Patch19: ntp-4.2.6p5-pwcipher.patch # ntpbz #2320 Patch20: ntp-4.2.6p5-noservres.patch +# ntpbz #2506 +Patch21: ntp-4.2.6p5-refreshroute.patch # handle unknown clock types Patch50: ntpstat-0.2-clksrc.patch @@ -182,7 +184,7 @@ This package contains NTP documentation in HTML format. %endif %patch6 -p1 -b .fipsmd5 %patch7 -p1 -b .retcode -%patch8 -p1 -b .rtnetlink +%patch8 -p1 -b .rootdisp %patch9 -p1 -b .hexpw %patch10 -p1 -b .htmldoc %patch11 -p1 -b .updatebclient @@ -195,6 +197,7 @@ This package contains NTP documentation in HTML format. %patch18 -p1 -b .delaycalib %patch19 -p1 -b .pwcipher %patch20 -p1 -b .noservres +%patch21 -p1 -b .refreshroute # ntpstat patches %patch50 -p1 -b .clksrc @@ -406,6 +409,22 @@ popd %{ntpdocdir}/html %changelog +* Tue Feb 11 2014 Miroslav Lichvar 4.2.6p5-18 +- disable monitor in default ntp.conf (#1047856) + +* Fri Jan 24 2014 Daniel Mach - 4.2.6p5-17 +- Mass rebuild 2014-01-24 + +* Fri Jan 03 2014 Miroslav Lichvar 4.2.6p5-16 +- refresh peers on routing updates (#1048132) +- fix calculation of root dispersion (#1045377) +- remove unnecessary IPv6 restrict line from default ntp.conf (#1048255) +- remove kod from default restrict in ntp.conf (#1048255) +- update logconfig documentation for patched default (#1048252) + +* Fri Dec 27 2013 Daniel Mach - 4.2.6p5-15 +- Mass rebuild 2013-12-27 + * Fri Oct 04 2013 Miroslav Lichvar 4.2.6p5-14 - remove ControlGroup in ntpd service (#999980) - don't build ntpsnmpd (#1015435)