Commit Graph

186 Commits

Author SHA1 Message Date
Ed Maste
539a27e105 Switch ntp's embedded libevent to 2.1.18
For OpenSSL 1.1.1 compatibility.

In Makefile.inc1 add (to the existing similar cases) a hack to handle
dependencies across the migration.

Reviewed by:	jhb
Approved by:	re (gjb)
Sponsored by:	The FreeBSD Foundation.
Differential Revision:	https://reviews.freebsd.org/D17481
2018-10-09 18:35:45 +00:00
Xin LI
4e1ef62a36 MFV r338092: ntp 4.2.8p12.
Relnotes:	yes
2018-08-21 02:38:07 +00:00
Brad Davis
9488993b1d Move all NTP related files to usr.sbin/ntp/ntpd.
This helps with pkgbase by using CONFS to tag these as config files.

Approved by:	allanjude (mentor), ian, cy
Sponsored by:	Essen Hackathon
Differential Revision:	https://reviews.freebsd.org/D16661
2018-08-11 17:42:42 +00:00
Ian Lepore
3496c981ac Make it possible to run ntpd as a non-root user, add ntpd uid and gid.
Code analysis and runtime analysis using truss(8) indicate that the only
privileged operations performed by ntpd are adjusting system time, and
(re-)binding to privileged UDP port 123. These changes add a new mac(4)
policy module, mac_ntpd(4), which grants just those privileges to any
process running with uid 123.

This also adds a new user and group, ntpd:ntpd, (uid:gid 123:123), and makes
them the owner of the /var/db/ntp directory, so that it can be used as a
location where the non-privileged daemon can write files such as the
driftfile, and any optional logfile or stats files.

Because there are so many ways to configure ntpd, the question of how to
configure it to run without root privs can be a bit complex, so that will be
addressed in a separate commit. These changes are just what's required to
grant the limited subset of privs to ntpd, and the small change to ntpd to
prevent it from exiting with an error if running as non-root.

Differential Revision:	https://reviews.freebsd.org/D16281
2018-07-19 23:55:29 +00:00
Xin LI
0910025859 MFV r330102: ntp 4.2.8p11 2018-02-28 07:59:55 +00:00
Eitan Adler
837fe32558 Fix a few more speelling errors
Reviewed by:		bjk
Reviewed by:		jilles (incl formal "accept")
Differential Revision:	https://reviews.freebsd.org/D13650
2017-12-28 01:31:28 +00:00
Bryan Drewery
ea825d0274 DIRDEPS_BUILD: Update dependencies.
Sponsored by:	Dell EMC Isilon
2017-10-31 00:07:04 +00:00
Bryan Drewery
c99b67a794 Utilize SYSROOT from r320119 in places where DESTDIR may be wanting WORLDTMP.
Since buildenv exports SYSROOT all of these uses will now look in
WORLDTMP by default.

sys/boot/efi/loader/Makefile
        A LIBSTAND hack is no longer required for buildenv.

MFC after:	2 weeks
Sponsored by:	Dell EMC Isilon
2017-06-19 20:47:24 +00:00
Brooks Davis
5477372324 Use the approved syntax to build no man pages.
MFC after:	1 week
Sponsored by:	DARPA, AFRL
2017-04-24 21:55:59 +00:00
Xin LI
f0574f5cf6 MFV r315791: ntp 4.2.8p10. 2017-03-23 22:06:06 +00:00
Cy Schubert
6a1588c0a4 Configure leap-second smearing (always).
Leap-second smearing is an experimental option that may be specified in
ntp.conf(5) and the -x option on the command line to spread the effect
of a leap-second over an interval as specified by the leapsmearinterval
config file statement. Recommended values are between 7200 (2 hours) and
86400 (24 hours).

It is advised that leap-second smearing not be used for public NTP
servers (https://www.meinbergglobal.com/download/burnicki/Leap\
%20Second%20Smearing%20With%20NTP.pdf). It is also advised that NTP
clients not use a mix of NTP servers using leap-second smearing with
NTP servers not using leap-second smearing as that could cause
undefined client behaviour.

Leap-second smearing was committed to ports net/ntp and net/ntp-devel
by r426825 on 2016-11-22.

Suggested by:	des
MFC after:	4 weeks
2017-03-09 05:29:24 +00:00
Cy Schubert
3779ab7a36 Remove extraneous arguments and options, which don't make sense for
a file documented in volume 5.

MFC after:	3 days
2017-03-08 07:02:39 +00:00
Cy Schubert
dae3dadc43 Fix mismerge of r280849.
Reported by:	des
MFC after:	3 days
2017-03-06 07:11:23 +00:00
Enji Cooper
982a915f13 Simplify idioms in Makefiles further
- Use SRCTOP-relative paths instead of .CURDIR-relative ones where possible
- Use :H to manipulate .CURDIR in areas instead of ..-relative paths.

MFC after:	1 week
Sponsored by:	Dell EMC Isilon
2017-03-01 05:19:35 +00:00
Enji Cooper
af6a5351a1 Simplify/improve idioms in usr.sbin/ntp Makefiles
- Use SRCTOP-relative paths to other directories instead of
  .CURDIR-relative ones. This simplifies pathing in make/displayed output.
- Also, use :H where possible/sensical to manipulate .CURDIR-relative
  paths
- Remove superfluous bsd.own.mk .includes which are already handled via
  src.opts.mk .includes

MFC after:	1 week
Sponsored by:	Dell EMC Isilon
2017-03-01 04:54:06 +00:00
Cy Schubert
d2aa1af629 Fix up grammar.
MFC after:	3 days
2017-01-01 10:37:10 +00:00
Xin LI
f391d6bc1d MFV r308954:
ntp 4.2.8p9.

Approved by:	so
2016-11-22 08:27:49 +00:00
Cy Schubert
41a68a79bb Fixup man page formatting.
Submitted by:	Steve Kargl <sgk@troutmask.apl.washington.edu>
Discussed with:	bjk@
MFC after:	3 days
2016-08-24 02:41:24 +00:00
Xin LI
e27abb6689 MFV r301238:
ntp 4.2.8p8.

Security:	CVE-2016-4957, CVE-2016-4953, CVE-2016-4954
Security:	CVE-2016-4955, CVE-2016-4956
Security:	FreeBSD-SA-16:24.ntp
With hat:	so
2016-06-03 08:00:22 +00:00
Xin LI
4990d495fc MFV r298691:
ntp 4.2.8p7.

Security:	CVE-2016-1547, CVE-2016-1548, CVE-2016-1549, CVE-2016-1550
Security:	CVE-2016-1551, CVE-2016-2516, CVE-2016-2517, CVE-2016-2518
Security:	CVE-2016-2519
Security:	FreeBSD-SA-16:16.ntp
With hat:	so
2016-04-27 07:46:38 +00:00
Bryan Drewery
bd18fd57db DIRDEPS_BUILD: Regenerate without local dependencies.
These are no longer needed after the recent 'beforebuild: depend' changes
and hooking DIRDEPS_BUILD into a subset of FAST_DEPEND which supports
skipping 'make depend'.

Sponsored by:	EMC / Isilon Storage Division
2016-02-24 17:20:11 +00:00
Xin LI
68ba7e87e7 MFV r294491: ntp 4.2.8p6.
Security:	CVE-2015-7973, CVE-2015-7974, CVE-2015-7975
Security:	CVE-2015-7976, CVE-2015-7977, CVE-2015-7978
Security:	CVE-2015-7979, CVE-2015-8138, CVE-2015-8139
Security:	CVE-2015-8140, CVE-2015-8158
With hat:	so
2016-01-22 07:32:39 +00:00
Xin LI
1c2b1cecf1 Fix version number. 2016-01-09 09:33:24 +00:00
Xin LI
3311ff84ea MFV r293415:
ntp 4.2.8p5

Reviewed by:	cy, roberto
Relnotes:	yes
Differential Revision:	https://reviews.freebsd.org/D4828
2016-01-08 15:53:48 +00:00
Bryan Drewery
b1f92fa229 META MODE: Update dependencies with 'the-lot' and add missing directories.
This is not properly respecting WITHOUT or ARCH dependencies in target/.
Doing so requires a massive effort to rework targets/ to do so.  A
better approach will be to either include the SUBDIR Makefiles directly
and map to DIRDEPS or just dynamically lookup the SUBDIR.  These lose
the benefit of having a userland/lib, userland/libexec, etc, though and
results in a massive package.  The current implementation of targets/ is
very unmaintainable.

Currently rescue/rescue and sys/modules are still not connected.

Sponsored by:	EMC / Isilon Storage Division
2015-12-01 05:23:19 +00:00
Gleb Smirnoff
01ddbee86b A miss from r289764. 2015-10-23 05:03:34 +00:00
Gleb Smirnoff
9034852c84 MFV ntp-4.2.8p4 (r289715)
Security:       VuXML: c4a18a12-77fc-11e5-a687-206a8a720317
Security:	CVE-2015-7871
Security:	CVE-2015-7855
Security:	CVE-2015-7854
Security:	CVE-2015-7853
Security:	CVE-2015-7852
Security:	CVE-2015-7851
Security:	CVE-2015-7850
Security:	CVE-2015-7849
Security:	CVE-2015-7848
Security:	CVE-2015-7701
Security:	CVE-2015-7703
Security:	CVE-2015-7704, CVE-2015-7705
Security:	CVE-2015-7691, CVE-2015-7692, CVE-2015-7702
Security:	http://support.ntp.org/bin/view/Main/SecurityNotice#October_2015_NTP_Security_Vulner
Sponsored by:	Nginx, Inc.
2015-10-22 19:42:57 +00:00
Bryan Drewery
b6ad36706d Replace afterinstall: hack from r54681 with 'make delete-old' functionality.
Sponsored by:	EMC / Isilon Storage Division
2015-09-19 03:51:19 +00:00
Enji Cooper
949b0d9970 Parallelize the usr.sbin/ntp subdirectory build
Articulate all needed dependencies for the subdirectories

MFC after: 1 week
2015-09-06 18:58:33 +00:00
Cy Schubert
9bf168600c Turn on RAWDCF by default.
Suggested by:	ian
Approved by:	roberto
MFC after:	1 week
2015-09-04 16:59:01 +00:00
Xin LI
788aa07e34 Use fixed date/time (the time choosen was the time the import was done on
-HEAD) in libntp so we can make reproducible build.

PR:		bin/201661
Reviewed by:	gjb, cy, roberto
MFC after:	3 days
Differential Revision:	https://reviews.freebsd.org/D3122
2015-07-19 19:23:38 +00:00
Xin LI
8c377b430c Bump version after 4.2.8p3 import.
Note: currently 'mkver' script is using hardcoded knowledge and always
emits -a in the version string, a more through solution would be to generate
the script with something that we own.
2015-07-12 23:32:23 +00:00
Cy Schubert
21e17e1fc8 Update ntp version number. (This is a manual update that was missed.) 2015-07-05 16:48:40 +00:00
Cy Schubert
276da39af9 MFV ntp-4.2.8p3 (r284990).
Approved by:	roberto, delphij
Security:	VuXML: 0d0f3050-1f69-11e5-9ba9-d050996490d0
Security:	http://bugs.ntp.org/show_bug.cgi?id=2853
Security:	https://www.kb.cert.org/vuls/id/668167
Security:	http://support.ntp.org/bin/view/Main/SecurityNotice#June_2015_NTP_Security_Vulnerabi
2015-07-05 15:42:16 +00:00
Cy Schubert
b1cf398e01 Add support for additional architectures in ntp.
Differential Revision:	D2720
Reviewed by:	jmg, reoberto, andrew, ian, imp
2015-06-26 03:29:23 +00:00
Simon J. Gerraty
2ef6d5a7b9 new depends 2015-06-16 23:37:19 +00:00
Simon J. Gerraty
ccfb965433 Add META_MODE support.
Off by default, build behaves normally.
WITH_META_MODE we get auto objdir creation, the ability to
start build from anywhere in the tree.

Still need to add real targets under targets/ to build packages.

Differential Revision:       D2796
Reviewed by: brooks imp
2015-06-13 19:20:56 +00:00
Simon J. Gerraty
44d314f704 dirdeps.mk now sets DEP_RELDIR 2015-06-08 23:35:17 +00:00
Simon J. Gerraty
98e0ffaefb Merge sync of head 2015-05-27 01:19:58 +00:00
Baptiste Daroussin
ef0cb5db0a Fix overlinking again after recent ntp updates
Fix building WITHOUT_OPENSSL
2015-05-25 20:27:46 +00:00
Cy Schubert
36428b7e17 Restore CPU dependent compile time conditionals.
MFC after:	1 month (with r281143 and r282408)
2015-05-04 12:42:52 +00:00
Cy Schubert
a25439b686 MFV ntp 4.2.8p2 (r281348)
Reviewed by:    delphij (suggested MFC)
Approved by:	roberto
Security:       CVE-2015-1798, CVE-2015-1799
Security:       VuXML ebd84c96-dd7e-11e4-854e-3c970e169bc2
MFC after:	1 month
2015-05-04 04:45:59 +00:00
Jason Helfman
b09403abf8 - remove -l option from ntpdate manpage, as it is no longer an option
Differential Revision:	https://reviews.freebsd.org/D2358
Submitted by:	gnn@
Approved by:	wblock (mentor)
MFC after:	after 1 week
2015-04-27 15:22:57 +00:00
Gleb Smirnoff
56d5e0967c Stop including if_var.h from userland.
Sponsored by:	Nginx, Inc.
2015-04-06 09:42:23 +00:00
Cy Schubert
2b15cb3d09 MFV ntp 4.2.8p1 (r258945, r275970, r276091, r276092, r276093, r278284)
Thanks to roberto for providing pointers to wedge this into HEAD.

Approved by:	roberto
2015-03-30 13:30:15 +00:00
Baptiste Daroussin
c6db8143ed Convert usr.sbin to LIBADD
Reduce overlinking
2014-11-25 16:57:27 +00:00
Simon J. Gerraty
9268022b74 Merge from head@274682 2014-11-19 01:07:58 +00:00
Baptiste Daroussin
4465557ac2 Backout 274170 it breaks for mips 2014-11-06 18:50:59 +00:00
Baptiste Daroussin
0e97acdf58 sntp does not depend on libm 2014-11-06 10:16:05 +00:00
Bryan Drewery
5608fd23c2 Revert r267233 for now. PIE support needs to be reworked.
1. 50+% of NO_PIE use is fixed by adding -fPIC to INTERNALLIB and other
   build-only utility libraries.
2. Another 40% is fixed by generating _pic.a variants of various libraries.
3. Some of the NO_PIE use is a bit absurd as it is disabling PIE (and ASLR)
   where it never would work anyhow, such as csu or loader. This suggests
   there may be better ways of adding support to the tree. Many of these
   cases can be fixed such that -fPIE will work but there is really no
   reason to have it in those cases.
4. Some of the uses are working around hacks done to some Makefiles that are
   really building libraries but have been using bsd.prog.mk because the code
   is cleaner. Had they been using bsd.lib.mk then NO_PIE would not have
   been needed.

We likely do want to enable PIE by default (opt-out) for non-tree consumers
(such as ports). For in-tree though we probably want to only enable PIE
(opt-in) for common attack targets such as remote service daemons and setuid
utilities. This is also a great performance compromise since ASLR is expected
to reduce performance. As such it does not make sense to enable it in all
utilities such as ls(1) that have little benefit to having it enabled.

Reported by:	kib
2014-08-19 15:04:32 +00:00