ntp: security bump to version 4.2.8p1
authorBaruch Siach <baruch@tkos.co.il>
Tue, 10 Feb 2015 12:46:37 +0000 (14:46 +0200)
committerPeter Korsgaard <peter@korsgaard.com>
Tue, 10 Feb 2015 23:35:18 +0000 (00:35 +0100)
Fixes:

CVE-2014-9297 - vallen is not validated in several places in ntp_crypto.c,
leading to a potential information leak or possibly a crash

CVE-2014-9298 - ::1 can be spoofed on some OSes (including "some versions" of
Linux), so ACLs based on IPv6 ::1 addresses can be bypassed

Drop a patch applied upstream, along with its accompanied AUTORECONF.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
package/ntp/0001-fix-ntp-keygen-without-openssl.patch [deleted file]
package/ntp/0001-nano.patch [new file with mode: 0644]
package/ntp/0002-nano.patch [deleted file]
package/ntp/ntp.hash
package/ntp/ntp.mk

diff --git a/package/ntp/0001-fix-ntp-keygen-without-openssl.patch b/package/ntp/0001-fix-ntp-keygen-without-openssl.patch
deleted file mode 100644 (file)
index b9883be..0000000
+++ /dev/null
@@ -1,153 +0,0 @@
-Fix build breakage without openssl.
-From upstream: http://bk1.ntp.org/ntp-stable/?PAGE=patch&REV=5497b345z5MNTuNvJWuqPSje25NQTg
-
-Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
-
-diff -Nura ntp-4.2.8.orig/configure.ac ntp-4.2.8/configure.ac
---- ntp-4.2.8.orig/configure.ac        2014-12-22 10:16:10.449311393 -0300
-+++ ntp-4.2.8/configure.ac     2014-12-22 10:17:30.757215905 -0300
-@@ -102,7 +102,7 @@
- enable_nls=no
- LIBOPTS_CHECK_NOBUILD([sntp/libopts])
--NTP_ENABLE_LOCAL_LIBEVENT
-+NTP_LIBEVENT_CHECK_NOBUILD([2], [sntp/libevent])
- NTP_LIBNTP
-@@ -771,6 +771,10 @@
- #### 
-+AC_CHECK_FUNCS([arc4random_buf])
-+
-+####
-+
- saved_LIBS="$LIBS"
- LIBS="$LIBS $LDADD_LIBNTP"
- AC_CHECK_FUNCS([daemon])
-diff -Nura ntp-4.2.8.orig/libntp/ntp_crypto_rnd.c ntp-4.2.8/libntp/ntp_crypto_rnd.c
---- ntp-4.2.8.orig/libntp/ntp_crypto_rnd.c     2014-12-22 10:16:10.430301237 -0300
-+++ ntp-4.2.8/libntp/ntp_crypto_rnd.c  2014-12-22 10:18:04.921468163 -0300
-@@ -24,6 +24,21 @@
- int crypto_rand_init = 0;
- #endif
-+#ifndef HAVE_ARC4RANDOM_BUF
-+static void
-+arc4random_buf(void *buf, size_t nbytes);
-+
-+void
-+evutil_secure_rng_get_bytes(void *buf, size_t nbytes);
-+
-+static void
-+arc4random_buf(void *buf, size_t nbytes)
-+{
-+      evutil_secure_rng_get_bytes(buf, nbytes);
-+      return;
-+}
-+#endif
-+
- /*
-  * As of late 2014, here's how we plan to provide cryptographic-quality
-  * random numbers:
-diff -Nura ntp-4.2.8.orig/Makefile.am ntp-4.2.8/Makefile.am
---- ntp-4.2.8.orig/Makefile.am 2014-12-22 10:16:10.441307117 -0300
-+++ ntp-4.2.8/Makefile.am      2014-12-22 10:16:49.403122474 -0300
-@@ -3,6 +3,7 @@
- NULL =
- SUBDIRS =             \
-+      sntp            \
-       scripts         \
-       include         \
-       libntp          \
-@@ -17,7 +18,6 @@
-       clockstuff      \
-       kernel          \
-       util            \
--      sntp            \
-       tests           \
-       $(NULL)
-@@ -64,7 +64,6 @@
-       .gcc-warning                    \
-       libtool                         \
-       html/.datecheck                 \
--      sntp/built-sources-only         \
-       $(srcdir)/COPYRIGHT             \
-       $(srcdir)/.checkChangeLog       \
-       $(NULL)
-diff -Nura ntp-4.2.8.orig/sntp/configure.ac ntp-4.2.8/sntp/configure.ac
---- ntp-4.2.8.orig/sntp/configure.ac   2014-12-22 10:16:10.428300168 -0300
-+++ ntp-4.2.8/sntp/configure.ac        2014-12-22 10:24:11.238172928 -0300
-@@ -97,11 +97,14 @@
- enable_nls=no
- LIBOPTS_CHECK
--AM_COND_IF(
--    [BUILD_SNTP],
--    [NTP_LIBEVENT_CHECK],
--    [NTP_LIBEVENT_CHECK_NOBUILD]
--)
-+# From when we only used libevent for sntp:
-+#AM_COND_IF(
-+#    [BUILD_SNTP],
-+#    [NTP_LIBEVENT_CHECK],
-+#    [NTP_LIBEVENT_CHECK_NOBUILD]
-+#)
-+
-+NTP_LIBEVENT_CHECK([2])
- # Checks for libraries.
-diff -Nura ntp-4.2.8.orig/sntp/m4/ntp_libevent.m4 ntp-4.2.8/sntp/m4/ntp_libevent.m4
---- ntp-4.2.8.orig/sntp/m4/ntp_libevent.m4     2014-12-22 10:16:10.417294288 -0300
-+++ ntp-4.2.8/sntp/m4/ntp_libevent.m4  2014-12-22 10:20:31.757915561 -0300
-@@ -1,4 +1,25 @@
--dnl NTP_ENABLE_LOCAL_LIBEVENT                              -*- Autoconf -*-
-+# SYNOPSIS                                            -*- Autoconf -*-
-+#
-+#  NTP_ENABLE_LOCAL_LIBEVENT
-+#  NTP_LIBEVENT_CHECK([MINVERSION [, DIR]])
-+#  NTP_LIBEVENT_CHECK_NOBUILD([MINVERSION [, DIR]])
-+#
-+# DESCRIPTION
-+#
-+# AUTHOR
-+#
-+#  Harlan Stenn
-+#
-+# LICENSE
-+#
-+#  This file is Copyright (c) 2014 Network Time Foundation
-+# 
-+#  Copying and distribution of this file, with or without modification, are
-+#  permitted in any medium without royalty provided the copyright notice,
-+#  author attribution and this notice are preserved.  This file is offered
-+#  as-is, without any warranty.
-+
-+dnl NTP_ENABLE_LOCAL_LIBEVENT
- dnl
- dnl Provide only the --enable-local-libevent command-line option.
- dnl
-@@ -29,7 +50,7 @@
- dnl but DO NOT invoke DIR/configure if we are going to use our bundled
- dnl version.  This may be the case for nested packages.
- dnl
--dnl provide --enable-local-libevent .
-+dnl provides --enable-local-libevent .
- dnl
- dnl Examples:
- dnl
-diff -Nura ntp-4.2.8.orig/util/Makefile.am ntp-4.2.8/util/Makefile.am
---- ntp-4.2.8.orig/util/Makefile.am    2014-12-22 10:16:10.435303910 -0300
-+++ ntp-4.2.8/util/Makefile.am 2014-12-22 10:21:02.500339706 -0300
-@@ -19,6 +19,7 @@
- LDADD=                ../libntp/libntp.a $(LDADD_LIBNTP) $(LIBM) $(PTHREAD_LIBS)
- tg2_LDADD=    ../libntp/libntp.a $(LDADD_LIBNTP) $(LIBM)
- ntp_keygen_LDADD  = version.o $(LIBOPTS_LDADD) ../libntp/libntp.a
-+ntp_keygen_LDADD += $(LDADD_LIBEVENT)
- ntp_keygen_LDADD += $(LDADD_LIBNTP) $(PTHREAD_LIBS) $(LDADD_NTP) $(LIBM)
- ntp_keygen_SOURCES = ntp-keygen.c ntp-keygen-opts.c ntp-keygen-opts.h
diff --git a/package/ntp/0001-nano.patch b/package/ntp/0001-nano.patch
new file mode 100644 (file)
index 0000000..d16046c
--- /dev/null
@@ -0,0 +1,23 @@
+Fixes issues with glibc header files, see
+http://bugs.gentoo.org/show_bug.cgi?id=270483
+
+Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
+
+diff -Nura ntp-4.2.6p2.orig/include/ntp_syscall.h ntp-4.2.6p2/include/ntp_syscall.h
+--- ntp-4.2.6p2.orig/include/ntp_syscall.h     2009-12-09 04:36:37.000000000 -0300
++++ ntp-4.2.6p2/include/ntp_syscall.h  2011-01-27 13:09:05.072336628 -0300
+@@ -14,6 +14,14 @@
+ # include <sys/timex.h>
+ #endif
++#if defined(ADJ_NANO) && !defined(MOD_NANO)
++#define MOD_NANO ADJ_NANO
++#endif
++
++#if defined(ADJ_TAI) && !defined(MOD_TAI)
++#define MOD_TAI ADJ_TAI
++#endif
++
+ #ifndef NTP_SYSCALLS_LIBC
+ #ifdef NTP_SYSCALLS_STD
+ # define ntp_adjtime(t)               syscall(SYS_ntp_adjtime, (t))
diff --git a/package/ntp/0002-nano.patch b/package/ntp/0002-nano.patch
deleted file mode 100644 (file)
index d16046c..0000000
+++ /dev/null
@@ -1,23 +0,0 @@
-Fixes issues with glibc header files, see
-http://bugs.gentoo.org/show_bug.cgi?id=270483
-
-Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
-
-diff -Nura ntp-4.2.6p2.orig/include/ntp_syscall.h ntp-4.2.6p2/include/ntp_syscall.h
---- ntp-4.2.6p2.orig/include/ntp_syscall.h     2009-12-09 04:36:37.000000000 -0300
-+++ ntp-4.2.6p2/include/ntp_syscall.h  2011-01-27 13:09:05.072336628 -0300
-@@ -14,6 +14,14 @@
- # include <sys/timex.h>
- #endif
-+#if defined(ADJ_NANO) && !defined(MOD_NANO)
-+#define MOD_NANO ADJ_NANO
-+#endif
-+
-+#if defined(ADJ_TAI) && !defined(MOD_TAI)
-+#define MOD_TAI ADJ_TAI
-+#endif
-+
- #ifndef NTP_SYSCALLS_LIBC
- #ifdef NTP_SYSCALLS_STD
- # define ntp_adjtime(t)               syscall(SYS_ntp_adjtime, (t))
index 1d1b907adbc8a2bd101fcc6c933cb87937dc0a7b..8336be8dc2e85c100133e2504c1079ef546a7642 100644 (file)
@@ -1,2 +1,2 @@
-# From http://www.eecis.udel.edu/~ntp/ntp_spool/ntp4/ntp-4.2/ntp-4.2.8.tar.gz.md5
-md5    6972a626be6150db8cfbd0b63d8719e7 ntp-4.2.8.tar.gz
+# From http://www.eecis.udel.edu/~ntp/ntp_spool/ntp4/ntp-4.2/ntp-4.2.8p1.tar.gz.md5
+md5    65d8cdfae4722226fbe29863477641ed ntp-4.2.8p1.tar.gz
index 3a1a91757540de91f93e484e05883c1b052eedad..7d5644a90226827b98c4db3317181f378e631b04 100644 (file)
@@ -5,11 +5,9 @@
 ################################################################################
 
 NTP_VERSION_MAJOR = 4.2
-NTP_VERSION = $(NTP_VERSION_MAJOR).8
+NTP_VERSION = $(NTP_VERSION_MAJOR).8p1
 NTP_SITE = http://www.eecis.udel.edu/~ntp/ntp_spool/ntp4/ntp-$(NTP_VERSION_MAJOR)
 NTP_DEPENDENCIES = host-pkgconf libevent
-# For 0001-fix-ntp-keygen-without-openssl.patch
-NTP_AUTORECONF = YES
 NTP_LICENSE = ntp license
 NTP_LICENSE_FILES = COPYRIGHT
 NTP_CONF_ENV = ac_cv_lib_md5_MD5Init=no