Commit Graph

215 Commits

Author SHA1 Message Date
Marcin Wojtas
af949c590b Disable stack gap for ntpd during build.
When starting, ntpd calls setrlimit(2) to limit maximum size of its
stack. The stack limit chosen by ntpd is 200K, so when stack gap
is enabled, the stack gap is larger than this limit, which results
in ntpd crashing.

Submitted by: Dawid Gorecki <dgr@semihalf.com>
Reviewed by: cy, imp
Obtained from: Semihalf
Sponsored by: Stormshield
Differential Revision: https://reviews.freebsd.org/D29553
2021-05-21 15:33:06 +02:00
Xin LI
2edcc10cb1 Update leap-seconds to leap-seconds.3676924800.
Obtained from:	ftp://ftp.nist.gov/pub/time/leap-seconds.3676924800
MFC after:	3 days
2020-12-29 22:01:46 -08:00
Brandon Bergren
ab2032371e [PowerPC] Fix multiple ntp configuration issues
* powerpc time_t is 64 bit, not 32 bit.

* Add definition for powerpc64le.

With this, powerpc64le ntpd and ntpdate operate correctly instead of
corrupting the clock and exiting.

Tested on powerpc64, powerpc64le, and powerpc.

No feedback from cy@.

I am a bit confused as to how SIZEOF_TIME_T being wrong ever worked on
powerpc, it being big endian and all.

Sponsored by:	Tag1 Consulting, Inc.
Differential Revision:	https://reviews.freebsd.org/D26379
2020-09-23 02:37:27 +00:00
Ed Maste
7cccb910b2 ntp: whitespace and typo fix in conf file
PR:		248942
Submitted by:	Jose Luis Duran (whitespace), igor (typo)
MFC after:	1 week
2020-09-07 17:19:31 +00:00
Cy Schubert
767173cec2 MFV r362565:
Update 4.2.8p14 --> 4.2.8p15

Summary: Systems that use a CMAC algorithm in ntp.keys will not release
a bit of memory on each packet that uses a CMAC keyid, eventually causing
ntpd to run out of memory and fail. The CMAC cleanup from
https://bugs.ntp.org/3447, part of ntp-4.2.8p11, introduced a bug whereby
the CMAC data structure was no longer completely removed.

MFC after:	3 days
Security:	NTP Bug 3661
2020-06-24 01:51:05 +00:00
Xin LI
a918433b8a Update leap-seconds to leap-seconds.3676924800.
Obtained from:	ftp://ftp.nist.gov/pub/time/leap-seconds.3676924800
MFC after:	3 days
2020-05-19 16:06:03 +00:00
Cy Schubert
b323455767 PACKAGE_STRING should be the same as PACKAGE_VERSION.
MFC after:	3 days
2020-03-18 22:14:25 +00:00
Cy Schubert
2d4e511ca2 MFV r358616:
Update ntp-4.2.8p13 --> 4.2.8p14.

The advisory can be found at:
http://support.ntp.org/bin/view/Main/SecurityNotice#\
March_2020_ntp_4_2_8p14_NTP_Rele

No CVEs have been documented yet.

MFC after:	now
Security:	http://support.ntp.org/bin/view/Main/NtpBug3610
		http://support.ntp.org/bin/view/Main/NtpBug3596
		http://support.ntp.org/bin/view/Main/NtpBug3592
2020-03-04 21:45:12 +00:00
Warner Losh
5b2df92a39 Use __riscv instead of __riscv__
I misread arch(7) when I added this...

Noticed by: jhb@ and mhorne@
2020-02-10 18:28:02 +00:00
Warner Losh
0d3f465b5d Remove ifdefs for ia64 and sparc64.
Reivewed by: cy@, bcr@
Differential Revision: https://reviews.freebsd.org/D23593
2020-02-10 17:17:08 +00:00
Warner Losh
6666787858 Refresh architecture list with latest:
Remove: sparc, sparc64 (twice), ia64, alpha
Add: riscv64

Remove now-useless sparc64 ifdef

Reivewed by: cy@, bcr@
Differential Revision: https://reviews.freebsd.org/D23593
2020-02-10 17:17:03 +00:00
Adrian Chadd
ab95087a0e [ntp] Don't compile in the ssl routines into libevent if MK_OPENSSL is no
Most of ntpd still handles MK_OPENSSL ok, but the libevent import brought
in the SSL bufferevent routines without checking MK_OPENSSL.

This doesn't completely fix WITHOUT_CRYPTO=YES building, but hey, it's one
less broken thing.
2020-01-24 06:24:40 +00:00
Conrad Meyer
15da83398e ntpd(8): Don't use OpenSSL's RAND API
The !USE_OPENSSL_CRYPTO_RAND path uses arc4random_buf() correctly.

In general, we should prefer to avoid things OpenSSL does poorly when a good
alternative exists in libc.
2019-12-13 05:54:38 +00:00
Kyle Evans
5bff36fe81 usr.sbin/ntp: don't emit versions w/ make -s
<sys.mk> defines ECHO=echo when not using make -s, and ECHO=true when using
make -s.

export ECHO for ntp products and use it in the mkver script to echo the
version. This suppresses the output as appropriate. ECHO is given a default
value to make sure things still work as expected for anyone that isn't
redefining ECHO.

Reviewed by:	cy
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D22101
2019-12-12 01:33:45 +00:00
Simon J. Gerraty
2c9a9dfc18 Update Makefile.depend files
Update a bunch of Makefile.depend files as
a result of adding Makefile.depend.options files

Reviewed by:	 bdrewery
MFC after:	1 week
Sponsored by:   Juniper Networks
Differential Revision:  https://reviews.freebsd.org/D22494
2019-12-11 17:37:53 +00:00
Simon J. Gerraty
5ab1c5846f Add Makefile.depend.options
Leaf directories that have dependencies impacted
by options need a Makefile.depend.options file
to avoid churn in Makefile.depend

DIRDEPS for cases such as OPENSSL, TCP_WRAPPERS etc
can be set in local.dirdeps-options.mk
which can add to those set in Makefile.depend.options

See share/mk/dirdeps-options.mk

Reviewed by:	 bdrewery
MFC after:	1 week
Sponsored by:   Juniper Networks
Differential Revision:  https://reviews.freebsd.org/D22469
2019-12-11 17:37:37 +00:00
Cy Schubert
d48778bb2a Chase r352304. The default rlimit memlock is no memory locking.
Reported by:	egypcio@
MFC after:	3 days
2019-12-04 15:04:06 +00:00
Xin LI
1861313623 Update leap-seconds to leap-seconds.3676924800.
Obtained from:	ftp://ftp.nist.gov/pub/time/leap-seconds.3676924800
MFC after:	3 days
2019-11-27 07:51:29 +00:00
Cy Schubert
964c4a37b0 Chase r344883. ntp is 4.2.8p13.
MFC after:	3 days
2019-11-21 20:15:22 +00:00
Cy Schubert
1e8687d261 Reduce calls to close(2) at startup through the use of closefrom(2).
Submitted by:	pawel.biernacki@gmail.com
Reviewed by:	mjg, cy
MFC after:	3 days
Differential Revision:	https://reviews.freebsd.org/D21715
2019-09-19 14:45:04 +00:00
Cy Schubert
854cab511e No longer mlock() ntpd pages by default in memory thus allowing its
pages to page as necessary.

To restore historic BSD behaviour add the following to ntp.conf:
	rlimit memlock 32

Discussed on:	freebsd-current@ between Sept 6-9, 2019
Reported by:	Users using ASLR with stack gap != 0
Reviewed by:	ian, kib, rgrimes (all previous versions)
MFC after:	2 weeks
Differential Revision:	https://reviews.freebsd.org/D21581
2019-09-13 20:20:05 +00:00
Baptiste Daroussin
469ce69391 Get the readline header from the installed header instead of the from the source
location.

With newer import of libedit, the path to be able to access readline/readline.h
will also include header which name will conflict with some expected by ntp in
another path and end up breaking the build.
2019-09-12 15:46:58 +00:00
Baptiste Daroussin
97889d2e15 Remove useless extra definition of libedit flags
Note that all the line editor part is done in the libntp
2019-09-12 15:44:53 +00:00
Warner Losh
91f5df38c9 MK_OPENSSL makes RELEASE_CRUNCH redundant here
Since these things are more completely controlled by the MK_OPENSSL knob, remove
RELEASE_CRUNCH here. It's no longer needed for the release and other users can
use the more proper knob if they so desire.
2019-07-15 07:39:28 +00:00
Xin LI
65ec2ae389 Replace the leap-seconds file in r347488 from USNO with a
leap-seconds file from NIST at ftp://ftp.nist.gov/pub/time.

Future updates should use the NIST version of file, available
at ftp://ftp.nist.gov/pub/time/leap-seconds.list .

Requested by:   ian@
Obtained from:  ftp://ftp.nist.gov/pub/time/leap-seconds.3676924800
MFC after:      3 days
2019-05-15 03:39:27 +00:00
Xin LI
7fa22f746b Update leap-seconds to leap-seconds.3757622400.
As per https://datacenter.iers.org/data/latestVersion/16_BULLETIN_C16.txt:

     INTERNATIONAL EARTH ROTATION AND REFERENCE SYSTEMS SERVICE (IERS)

SERVICE INTERNATIONAL DE LA ROTATION TERRESTRE ET DES SYSTEMES DE REFERENCE

SERVICE DE LA ROTATION TERRESTRE DE L'IERS
OBSERVATOIRE DE PARIS
61, Av. de l'Observatoire 75014 PARIS (France)
Tel.      : +33 1 40 51 23 35
e-mail    : services.iers@obspm.fr
http://hpiers.obspm.fr/eop-pc

                                              Paris, 07 January 2019

                                              Bulletin C 57

                                              To authorities responsible
                                              for the measurement and
                                              distribution of time

                          INFORMATION ON UTC - TAI

 NO leap second will be introduced at the end of June 2019.
 The difference between Coordinated Universal Time UTC and the
 International Atomic Time TAI is :

     from 2017 January 1, 0h UTC, until further notice : UTC-TAI = -37 s

 Leap seconds can be introduced in UTC at the end of the months of December
 or June,  depending on the evolution of UT1-TAI. Bulletin C is mailed every
 six months, either to announce a time step in UTC, or to confirm that there
 will be no time step at the next possible date.

                                            Christian BIZOUARD
                                            Director
                                            Earth Orientation Center of IERS
					    Observatoire de Paris, France

Requested by:	rgrimes
Obtained from:	ftp://tycho.usno.navy.mil/pub/ntp/leap-seconds.3757622400
MFC after:	3 days
2019-05-11 14:22:21 +00:00
Cy Schubert
052d159a8b MFV r344878:
4.2.8p12 --> 4.2.8p13

MFC after:	immediately
Security:	CVE-2019-8936
		VuXML: c2576e14-36e2-11e9-9eda-206a8a720317
Obtained from:	nwtime.org
2019-03-07 13:36:00 +00:00
Renato Botelho
66a12de518 Fix typo introduced in r340439 - s/ETN/ETC/
Reported by:	jhb, yuripv
Approved by:	eugen
MFC after:	3 days
X-MFC-With:	340439
Sponsored by:	Rubicon Communications, LLC (Netgate)
2018-11-14 18:38:27 +00:00
Renato Botelho
f7f458b592 Fix /etc/ntp permissions. According to mtree it must be 0700
Reviewed by:	imp
Approved by:	imp
MFC after:	3 days
Sponsored by:	Rubicon Communications, LLC (Netgate)
Differential Revision:	https://reviews.freebsd.org/D17973
2018-11-14 16:19:15 +00:00
Ed Maste
539a27e105 Switch ntp's embedded libevent to 2.1.18
For OpenSSL 1.1.1 compatibility.

In Makefile.inc1 add (to the existing similar cases) a hack to handle
dependencies across the migration.

Reviewed by:	jhb
Approved by:	re (gjb)
Sponsored by:	The FreeBSD Foundation.
Differential Revision:	https://reviews.freebsd.org/D17481
2018-10-09 18:35:45 +00:00
Xin LI
4e1ef62a36 MFV r338092: ntp 4.2.8p12.
Relnotes:	yes
2018-08-21 02:38:07 +00:00
Brad Davis
9488993b1d Move all NTP related files to usr.sbin/ntp/ntpd.
This helps with pkgbase by using CONFS to tag these as config files.

Approved by:	allanjude (mentor), ian, cy
Sponsored by:	Essen Hackathon
Differential Revision:	https://reviews.freebsd.org/D16661
2018-08-11 17:42:42 +00:00
Ian Lepore
3496c981ac Make it possible to run ntpd as a non-root user, add ntpd uid and gid.
Code analysis and runtime analysis using truss(8) indicate that the only
privileged operations performed by ntpd are adjusting system time, and
(re-)binding to privileged UDP port 123. These changes add a new mac(4)
policy module, mac_ntpd(4), which grants just those privileges to any
process running with uid 123.

This also adds a new user and group, ntpd:ntpd, (uid:gid 123:123), and makes
them the owner of the /var/db/ntp directory, so that it can be used as a
location where the non-privileged daemon can write files such as the
driftfile, and any optional logfile or stats files.

Because there are so many ways to configure ntpd, the question of how to
configure it to run without root privs can be a bit complex, so that will be
addressed in a separate commit. These changes are just what's required to
grant the limited subset of privs to ntpd, and the small change to ntpd to
prevent it from exiting with an error if running as non-root.

Differential Revision:	https://reviews.freebsd.org/D16281
2018-07-19 23:55:29 +00:00
Xin LI
0910025859 MFV r330102: ntp 4.2.8p11 2018-02-28 07:59:55 +00:00
Eitan Adler
837fe32558 Fix a few more speelling errors
Reviewed by:		bjk
Reviewed by:		jilles (incl formal "accept")
Differential Revision:	https://reviews.freebsd.org/D13650
2017-12-28 01:31:28 +00:00
Bryan Drewery
ea825d0274 DIRDEPS_BUILD: Update dependencies.
Sponsored by:	Dell EMC Isilon
2017-10-31 00:07:04 +00:00
Bryan Drewery
c99b67a794 Utilize SYSROOT from r320119 in places where DESTDIR may be wanting WORLDTMP.
Since buildenv exports SYSROOT all of these uses will now look in
WORLDTMP by default.

sys/boot/efi/loader/Makefile
        A LIBSTAND hack is no longer required for buildenv.

MFC after:	2 weeks
Sponsored by:	Dell EMC Isilon
2017-06-19 20:47:24 +00:00
Brooks Davis
5477372324 Use the approved syntax to build no man pages.
MFC after:	1 week
Sponsored by:	DARPA, AFRL
2017-04-24 21:55:59 +00:00
Xin LI
f0574f5cf6 MFV r315791: ntp 4.2.8p10. 2017-03-23 22:06:06 +00:00
Cy Schubert
6a1588c0a4 Configure leap-second smearing (always).
Leap-second smearing is an experimental option that may be specified in
ntp.conf(5) and the -x option on the command line to spread the effect
of a leap-second over an interval as specified by the leapsmearinterval
config file statement. Recommended values are between 7200 (2 hours) and
86400 (24 hours).

It is advised that leap-second smearing not be used for public NTP
servers (https://www.meinbergglobal.com/download/burnicki/Leap\
%20Second%20Smearing%20With%20NTP.pdf). It is also advised that NTP
clients not use a mix of NTP servers using leap-second smearing with
NTP servers not using leap-second smearing as that could cause
undefined client behaviour.

Leap-second smearing was committed to ports net/ntp and net/ntp-devel
by r426825 on 2016-11-22.

Suggested by:	des
MFC after:	4 weeks
2017-03-09 05:29:24 +00:00
Cy Schubert
3779ab7a36 Remove extraneous arguments and options, which don't make sense for
a file documented in volume 5.

MFC after:	3 days
2017-03-08 07:02:39 +00:00
Cy Schubert
dae3dadc43 Fix mismerge of r280849.
Reported by:	des
MFC after:	3 days
2017-03-06 07:11:23 +00:00
Enji Cooper
982a915f13 Simplify idioms in Makefiles further
- Use SRCTOP-relative paths instead of .CURDIR-relative ones where possible
- Use :H to manipulate .CURDIR in areas instead of ..-relative paths.

MFC after:	1 week
Sponsored by:	Dell EMC Isilon
2017-03-01 05:19:35 +00:00
Enji Cooper
af6a5351a1 Simplify/improve idioms in usr.sbin/ntp Makefiles
- Use SRCTOP-relative paths to other directories instead of
  .CURDIR-relative ones. This simplifies pathing in make/displayed output.
- Also, use :H where possible/sensical to manipulate .CURDIR-relative
  paths
- Remove superfluous bsd.own.mk .includes which are already handled via
  src.opts.mk .includes

MFC after:	1 week
Sponsored by:	Dell EMC Isilon
2017-03-01 04:54:06 +00:00
Cy Schubert
d2aa1af629 Fix up grammar.
MFC after:	3 days
2017-01-01 10:37:10 +00:00
Xin LI
f391d6bc1d MFV r308954:
ntp 4.2.8p9.

Approved by:	so
2016-11-22 08:27:49 +00:00
Cy Schubert
41a68a79bb Fixup man page formatting.
Submitted by:	Steve Kargl <sgk@troutmask.apl.washington.edu>
Discussed with:	bjk@
MFC after:	3 days
2016-08-24 02:41:24 +00:00
Xin LI
e27abb6689 MFV r301238:
ntp 4.2.8p8.

Security:	CVE-2016-4957, CVE-2016-4953, CVE-2016-4954
Security:	CVE-2016-4955, CVE-2016-4956
Security:	FreeBSD-SA-16:24.ntp
With hat:	so
2016-06-03 08:00:22 +00:00
Xin LI
4990d495fc MFV r298691:
ntp 4.2.8p7.

Security:	CVE-2016-1547, CVE-2016-1548, CVE-2016-1549, CVE-2016-1550
Security:	CVE-2016-1551, CVE-2016-2516, CVE-2016-2517, CVE-2016-2518
Security:	CVE-2016-2519
Security:	FreeBSD-SA-16:16.ntp
With hat:	so
2016-04-27 07:46:38 +00:00
Bryan Drewery
bd18fd57db DIRDEPS_BUILD: Regenerate without local dependencies.
These are no longer needed after the recent 'beforebuild: depend' changes
and hooking DIRDEPS_BUILD into a subset of FAST_DEPEND which supports
skipping 'make depend'.

Sponsored by:	EMC / Isilon Storage Division
2016-02-24 17:20:11 +00:00