You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

160 lines
3.8 KiB

ntpd: update to 4.2.8p7 Fixes the following CVEs: Bug 3020 / CVE-2016-1551: Refclock impersonation vulnerability, AKA: refclock-peering Reported by Matt Street and others of Cisco ASIG Bug 3012 / CVE-2016-1549: Sybil vulnerability: ephemeral association attack, AKA: ntp-sybil - MITIGATION ONLY Reported by Matthew Van Gundy of Cisco ASIG Bug 3011 / CVE-2016-2516: Duplicate IPs on unconfig directives will cause an assertion botch Reported by Yihan Lian of the Cloud Security Team, Qihoo 360 Bug 3010 / CVE-2016-2517: Remote configuration trustedkey/requestkey values are not properly validated Reported by Yihan Lian of the Cloud Security Team, Qihoo 360 Bug 3009 / CVE-2016-2518: Crafted addpeer with hmode > 7 causes array wraparound with MATCH_ASSOC Reported by Yihan Lian of the Cloud Security Team, Qihoo 360 Bug 3008 / CVE-2016-2519: ctl_getitem() return value not always checked Reported by Yihan Lian of the Cloud Security Team, Qihoo 360 Bug 3007 / CVE-2016-1547: Validate crypto-NAKs, AKA: nak-dos Reported by Stephen Gray and Matthew Van Gundy of Cisco ASIG Bug 2978 / CVE-2016-1548: Interleave-pivot - MITIGATION ONLY Reported by Miroslav Lichvar of RedHat and separately by Jonathan Gardner of Cisco ASIG Bug 2952 / CVE-2015-7704: KoD fix: peer associations were broken by the fix for NtpBug2901, AKA: Symmetric active/passive mode is broken Reported by Michael Tatarinov, NTP Project Developer Volunteer Bug 2945 / Bug 2901 / CVE-2015-8138: Zero Origin Timestamp Bypass, AKA: Additional KoD Checks Reported by Jonathan Gardner of Cisco ASIG Bug 2879 / CVE-2016-1550: Improve NTP security against buffer comparison timing attacks, authdecrypt-timing, AKA: authdecrypt-timing Reported independently by Loganaden Velvindron, and Matthew Van Gundy and Stephen Gray of Cisco ASIG. Signed-off-by: Peter Wagner <tripolar@gmx.at>
8 years ago
ntpd: update to 4.2.8p7 Fixes the following CVEs: Bug 3020 / CVE-2016-1551: Refclock impersonation vulnerability, AKA: refclock-peering Reported by Matt Street and others of Cisco ASIG Bug 3012 / CVE-2016-1549: Sybil vulnerability: ephemeral association attack, AKA: ntp-sybil - MITIGATION ONLY Reported by Matthew Van Gundy of Cisco ASIG Bug 3011 / CVE-2016-2516: Duplicate IPs on unconfig directives will cause an assertion botch Reported by Yihan Lian of the Cloud Security Team, Qihoo 360 Bug 3010 / CVE-2016-2517: Remote configuration trustedkey/requestkey values are not properly validated Reported by Yihan Lian of the Cloud Security Team, Qihoo 360 Bug 3009 / CVE-2016-2518: Crafted addpeer with hmode > 7 causes array wraparound with MATCH_ASSOC Reported by Yihan Lian of the Cloud Security Team, Qihoo 360 Bug 3008 / CVE-2016-2519: ctl_getitem() return value not always checked Reported by Yihan Lian of the Cloud Security Team, Qihoo 360 Bug 3007 / CVE-2016-1547: Validate crypto-NAKs, AKA: nak-dos Reported by Stephen Gray and Matthew Van Gundy of Cisco ASIG Bug 2978 / CVE-2016-1548: Interleave-pivot - MITIGATION ONLY Reported by Miroslav Lichvar of RedHat and separately by Jonathan Gardner of Cisco ASIG Bug 2952 / CVE-2015-7704: KoD fix: peer associations were broken by the fix for NtpBug2901, AKA: Symmetric active/passive mode is broken Reported by Michael Tatarinov, NTP Project Developer Volunteer Bug 2945 / Bug 2901 / CVE-2015-8138: Zero Origin Timestamp Bypass, AKA: Additional KoD Checks Reported by Jonathan Gardner of Cisco ASIG Bug 2879 / CVE-2016-1550: Improve NTP security against buffer comparison timing attacks, authdecrypt-timing, AKA: authdecrypt-timing Reported independently by Loganaden Velvindron, and Matthew Van Gundy and Stephen Gray of Cisco ASIG. Signed-off-by: Peter Wagner <tripolar@gmx.at>
8 years ago
  1. #
  2. # Copyright (C) 2006-2016 OpenWrt.org
  3. #
  4. # This is free software, licensed under the GNU General Public License v2.
  5. # See /LICENSE for more information.
  6. #
  7. include $(TOPDIR)/rules.mk
  8. PKG_NAME:=ntp
  9. PKG_VERSION:=4.2.8p7
  10. PKG_RELEASE:=1
  11. PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
  12. PKG_SOURCE_URL:=http://www.eecis.udel.edu/~ntp/ntp_spool/ntp4/ntp-4.2/
  13. PKG_MD5SUM:=46dfba933c3e4bc924d8e55068797578
  14. PKG_LICENSE:=Unique
  15. PKG_LICENSE_FILES:=COPYRIGHT html/copyright.html
  16. PKG_FIXUP:=autoreconf
  17. PKG_LIBTOOL_PATHS:=. sntp
  18. PKG_CHECK_FORMAT_SECURITY:=0
  19. include $(INCLUDE_DIR)/package.mk
  20. define Package/ntpd/Default
  21. SUBMENU:=Time Synchronization
  22. SECTION:=net
  23. CATEGORY:=Network
  24. TITLE:=ISC ntp
  25. MAINTAINER:=Peter Wagner <tripolar@gmx.at>
  26. URL:=http://www.ntp.org/
  27. DEPENDS:=+libopenssl +libpthread +libcap
  28. endef
  29. define Package/ntpd/Default/description
  30. The ISC ntp suite is a collection of tools used to synchronize the
  31. system clock with remote NTP time servers and run/monitor local NTP
  32. servers.
  33. endef
  34. define Package/ntpd
  35. $(call Package/ntpd/Default)
  36. TITLE+= server
  37. USERID:=ntp=123:ntp=123
  38. endef
  39. define Package/ntpd/description
  40. $(call Package/ntpd/Default/description)
  41. .
  42. This package contains the ntpd server.
  43. endef
  44. define Package/ntpdate
  45. $(call Package/ntpd/Default)
  46. TITLE+=date
  47. endef
  48. define Package/ntpdate/description
  49. $(call Package/ntpd/Default/description)
  50. .
  51. This package contains ntpdate.
  52. endef
  53. define Package/ntp-utils
  54. $(call Package/ntpd/Default)
  55. TITLE+= utilities
  56. endef
  57. define Package/ntp-utils/description
  58. $(call Package/ntpd/Default/description)
  59. .
  60. This package contains ntpdc, ntpq and ntptime.
  61. endef
  62. define Package/ntp-keygen
  63. $(call Package/ntpd/Default)
  64. TITLE+=keygen
  65. DEPENDS+= +libevent2-core
  66. endef
  67. define Package/ntp-keygen/description
  68. $(call Package/ntpd/Default/description)
  69. .
  70. This package contains the ntp-keygen.
  71. endef
  72. define Package/ntpd/conffiles
  73. /etc/ntp.conf
  74. endef
  75. CONFIGURE_VARS += \
  76. ac_cv_header_md5_h=no \
  77. ac_cv_lib_rt_sched_setscheduler=no \
  78. ac_cv_header_dns_sd_h=no \
  79. hw_cv_func_snprintf_c99=yes \
  80. hw_cv_func_vsnprintf_c99=yes \
  81. CONFIGURE_ARGS += \
  82. --disable-all-clocks \
  83. --disable-parse-clocks \
  84. --without-ntpsnmpd \
  85. --without-lineeditlibs \
  86. --enable-NMEA \
  87. --enable-LOCAL-CLOCK \
  88. --enable-SHM \
  89. --enable-ATOM \
  90. --enable-linuxcaps \
  91. --with-yielding-select=yes \
  92. --with-crypto \
  93. --with-openssl-incdir="$(STAGING_DIR)/usr/include" \
  94. --with-openssl-libdir="$(STAGING_DIR)/usr/lib"
  95. define Package/ntpd/install
  96. $(INSTALL_DIR) $(1)/sbin
  97. $(INSTALL_BIN) $(PKG_BUILD_DIR)/ntpd/ntpd $(1)/sbin/
  98. $(INSTALL_DIR) $(1)/etc
  99. $(INSTALL_CONF) ./files/ntp.conf $(1)/etc/
  100. $(INSTALL_DIR) $(1)/etc/init.d
  101. $(INSTALL_BIN) ./files/ntpd.init $(1)/etc/init.d/ntpd
  102. $(INSTALL_DIR) $(1)/etc/hotplug.d/iface
  103. $(INSTALL_BIN) ./files/ntpd.hotplug $(1)/etc/hotplug.d/iface/20-ntpd
  104. endef
  105. define Package/ntpd/postinst
  106. #!/bin/sh
  107. [ -L "$${IPKG_INSTROOT}/usr/sbin/ntpd" ] && rm -f "$${IPKG_INSTROOT}/usr/sbin/ntpd"
  108. exit 0
  109. endef
  110. define Package/ntpd/postrm
  111. #!/bin/sh
  112. /bin/busybox ntpd -h 2>&1 | grep -q BusyBox && ln -sf ../../bin/busybox /usr/sbin/ntpd
  113. exit 0
  114. endef
  115. define Package/ntpdate/install
  116. $(INSTALL_DIR) $(1)/usr/sbin
  117. $(INSTALL_BIN) $(PKG_BUILD_DIR)/ntpdate/ntpdate $(1)/usr/sbin/
  118. $(INSTALL_DIR) $(1)/etc/init.d
  119. $(INSTALL_BIN) ./files/ntpdate.init $(1)/etc/init.d/ntpdate
  120. endef
  121. define Package/ntp-utils/install
  122. $(INSTALL_DIR) $(1)/usr/sbin
  123. $(INSTALL_BIN) $(PKG_BUILD_DIR)/ntpdc/ntpdc $(1)/usr/sbin/
  124. $(INSTALL_BIN) $(PKG_BUILD_DIR)/ntpq/ntpq $(1)/usr/sbin/
  125. $(INSTALL_BIN) $(PKG_BUILD_DIR)/util/ntptime $(1)/usr/sbin/
  126. endef
  127. define Package/ntp-keygen/install
  128. $(INSTALL_DIR) $(1)/usr/sbin
  129. $(INSTALL_BIN) $(PKG_BUILD_DIR)/util/ntp-keygen $(1)/usr/sbin/
  130. endef
  131. $(eval $(call BuildPackage,ntpd))
  132. $(eval $(call BuildPackage,ntpdate))
  133. $(eval $(call BuildPackage,ntp-utils))
  134. $(eval $(call BuildPackage,ntp-keygen))