4.5-1

Resolves: RHEL-9972

.chrony.metadata

@@ -0,0 +1,3 @@
+4661e5df181a9761b73caeaef2f2ab755bbe086a chrony-4.5.tar.gz
+d5bd0be4ef248fa9b9a81695f6b2265c3a24db6f chrony-4.5-tar-gz-asc.txt
+e021461c23fe4e5c46fd53c449587d8f6cc217ae clknetsim-5d1dc0.tar.gz

.gitignore

@@ -1,3 +1,3 @@
-/chrony-4.3.tar.gz
-/chrony-4.3-tar-gz-asc.txt
-/clknetsim-f00531.tar.gz
+/chrony-4.5.tar.gz
+/chrony-4.5-tar-gz-asc.txt
+/clknetsim-5d1dc0.tar.gz

chrony-keys.patch

@@ -0,0 +1,9 @@
+diff -up chrony-4.5/examples/chrony.keys.example.keys chrony-4.5/examples/chrony.keys.example
+--- chrony-4.5/examples/chrony.keys.example.keys	2023-12-05 14:22:10.000000000 +0100
++++ chrony-4.5/examples/chrony.keys.example	2023-12-06 09:59:26.089508934 +0100
+@@ -11,5 +11,3 @@
+ #1 MD5 AVeryLongAndRandomPassword
+ #2 MD5 HEX:12114855C7931009B4049EF3EFC48A139C3F989F
+ #3 SHA1 HEX:B2159C05D6A219673A3B7E896B6DE07F6A440995
+-#4 AES128 HEX:2DA837C4B6573748CA692B8C828E4891
+-#5 AES256 HEX:2666B8099BFF2D5BA20876121788ED24D2BE59111B8FFB562F0F56AE6EC7246E

chrony-serverstats.patch

@@ -0,0 +1,39 @@
+commit e11b518a1ffa704986fb1f1835c425844ba248ef
+Author: Miroslav Lichvar <mlichvar@redhat.com>
+Date:   Mon Jan 8 11:35:56 2024 +0100
+
+    ntp: fix authenticated requests in serverstats
+    
+    Fix the CLG_UpdateNtpStats() call to count requests passing the
+    authentication check instead of requests triggering a KoD response
+    (i.e. NTS NAK).
+
+diff --git a/ntp_core.c b/ntp_core.c
+index 023e60b2..35801744 100644
+--- a/ntp_core.c
++++ b/ntp_core.c
+@@ -2736,7 +2736,7 @@ NCR_ProcessRxUnknown(NTP_Remote_Address *remote_addr, NTP_Local_Address *local_a
+       CLG_DisableNtpTimestamps(&ntp_rx);
+   }
+ 
+-  CLG_UpdateNtpStats(kod != 0 && info.auth.mode != NTP_AUTH_NONE &&
++  CLG_UpdateNtpStats(kod == 0 && info.auth.mode != NTP_AUTH_NONE &&
+                      info.auth.mode != NTP_AUTH_MSSNTP,
+                      rx_ts->source, interleaved ? tx_ts->source : NTP_TS_DAEMON);
+ 
+diff --git a/test/system/010-nts b/test/system/010-nts
+index 8d92bbc8..b215efa3 100755
+--- a/test/system/010-nts
++++ b/test/system/010-nts
+@@ -45,6 +45,11 @@ check_chronyc_output "^Name/IP address             Mode KeyID Type KLen Last Atm
+ =========================================================================
+ 127\.0\.0\.1                    NTS     1   (30|15)  (128|256)    [0-9]    0    0    [78]  ( 64|100)$" || test_fail
+ 
++run_chronyc "serverstats" || test_fail
++check_chronyc_output "NTS-KE connections accepted: 1
++NTS-KE connections dropped : 0
++Authenticated NTP packets  : [1-9][0-9]*" || test_fail
++
+ stop_chronyd || test_fail
+ check_chronyd_messages || test_fail
+ check_chronyd_files || test_fail

chrony.spec

@@ -1,5 +1,5 @@
 %global _hardened_build 1
-%global clknetsim_ver f00531
+%global clknetsim_ver 5d1dc0
 %bcond_without debug
 %bcond_without nts
 
@@ -8,25 +8,29 @@
 %endif
 
 Name:           chrony
-Version:        4.3
+Version:        4.5
 Release:        1%{?dist}
 Summary:        An NTP client/server
 
 License:        GPLv2
-URL:            https://chrony.tuxfamily.org
-Source0:        https://download.tuxfamily.org/chrony/chrony-%{version}%{?prerelease}.tar.gz
-Source1:        https://download.tuxfamily.org/chrony/chrony-%{version}%{?prerelease}-tar-gz-asc.txt
-Source2:        https://chrony.tuxfamily.org/gpgkey-8F375C7E8D0EE125A3D3BD51537E2B76F7680DAC.asc
+URL:            https://chrony-project.org
+Source0:        https://chrony-project.org/releases/chrony-%{version}%{?prerelease}.tar.gz
+Source1:        https://chrony-project.org/releases/chrony-%{version}%{?prerelease}-tar-gz-asc.txt
+Source2:        https://chrony-project.org/gpgkey-8F375C7E8D0EE125A3D3BD51537E2B76F7680DAC.asc
 Source3:        chrony.dhclient
 Source4:        chrony.sysusers
 # simulator for test suite
-Source10:       https://github.com/mlichvar/clknetsim/archive/%{clknetsim_ver}/clknetsim-%{clknetsim_ver}.tar.gz
+Source10:       https://gitlab.com/chrony/clknetsim/-/archive/master/clknetsim-%{clknetsim_ver}.tar.gz
 %{?gitpatch:Patch0: chrony-%{version}%{?prerelease}-%{gitpatch}.patch.gz}
 
 # add distribution-specific bits to DHCP dispatcher
 Patch1:         chrony-nm-dispatcher-dhcp.patch
+# revert changes in packaged chrony.keys example
+Patch2:         chrony-keys.patch
 # revert some hardening options in service files
 Patch3:         chrony-services.patch
+# fix serverstats to correctly count authenticated packets
+Patch4:         chrony-serverstats.patch
 
 BuildRequires:  gnutls-devel libcap-devel libedit-devel pps-tools-devel
 BuildRequires:  gcc gcc-c++ make bison systemd gnupg2
@@ -58,19 +62,22 @@ service to other computers in the network.
 %setup -q -n %{name}-%{version}%{?prerelease} -a 10
 %{?gitpatch:%patch0 -p1}
 %patch1 -p1 -b .nm-dispatcher-dhcp
+%patch2 -p1 -b .keys
 %patch3 -p1 -b .services
+%patch4 -p1 -b .serverstats
 
 %{?gitpatch: echo %{version}-%{gitpatch} > version.txt}
 
 # review changes in packaged configuration files and scripts
 md5sum -c <<-EOF | (! grep -v 'OK$')
-        222e652b95027289877fa77146d3b9b1  examples/chrony-wait.service
+        d1e59feabc7847d30cfd09fd3c569f21  examples/chrony-wait.service
         2d01b94bc1a7b7fb70cbee831488d121  examples/chrony.conf.example2
         96999221eeef476bd49fe97b97503126  examples/chrony.keys.example
         6a3178c4670de7de393d9365e2793740  examples/chrony.logrotate
         c3992e2f985550739cd1cd95f98c9548  examples/chrony.nm-dispatcher.dhcp
-        2b81c60c020626165ac655b2633608eb  examples/chrony.nm-dispatcher.onoffline
-        619dd00009ea312c7201beefde10341a  examples/chronyd.service
+        4e85d36595727318535af3387411070c  examples/chrony.nm-dispatcher.onoffline
+        60447a26dce93b3a61f488a364ac46cd  examples/chronyd.service
+        46fa3e2d42c8eb9c42e71095686c90ed  examples/chronyd-restricted.service
 EOF
 
 # don't allow packaging without vendor zone
@@ -89,10 +96,14 @@ sed -e 's|^\(pool \)\(pool.ntp.org\)|\12.%{vendorzone}\2|' \
 
 touch -r examples/chrony.conf.example2 chrony.conf
 
+# set selinux context in chronyd-restricted service
+sed -i '/^ExecStart/a SELinuxContext=system_u:system_r:chronyd_restricted_t:s0' \
+	examples/chronyd-restricted.service
+
 # regenerate the file from getdate.y
 rm -f getdate.c
 
-mv clknetsim-%{clknetsim_ver}* test/simulation/clknetsim
+mv clknetsim-*-%{clknetsim_ver}* test/simulation/clknetsim
 
 %build
 %configure \
@@ -107,9 +118,7 @@ mv clknetsim-%{clknetsim_ver}* test/simulation/clknetsim
         --with-hwclockfile=%{_sysconfdir}/adjtime \
         --with-pidfile=/run/chrony/chronyd.pid \
         --with-sendmail=%{_sbindir}/sendmail \
-        --without-nettle \
-        --without-nss \
-        --without-tomcrypt
+        --without-nettle
 %make_build
 
 %install
@@ -136,6 +145,8 @@ install -m 644 -p examples/chrony.logrotate \
 
 install -m 644 -p examples/chronyd.service \
         $RPM_BUILD_ROOT%{_unitdir}/chronyd.service
+install -m 644 -p examples/chronyd-restricted.service \
+        $RPM_BUILD_ROOT%{_unitdir}/chronyd-restricted.service
 install -m 755 -p examples/chrony.nm-dispatcher.onoffline \
         $RPM_BUILD_ROOT%{_prefix}/lib/NetworkManager/dispatcher.d/20-chrony-onoffline
 install -m 755 -p examples/chrony.nm-dispatcher.dhcp \
@@ -176,13 +187,13 @@ if test -a %{_libexecdir}/chrony-helper; then
                 sed 's|.*|server &|' < $f > /run/chrony-dhcp/"${f##*servers.}.sources"
         done 2> /dev/null
 fi
-%systemd_post chronyd.service chrony-wait.service
+%systemd_post chronyd.service chronyd-restricted.service chrony-wait.service
 
 %preun
-%systemd_preun chronyd.service chrony-wait.service
+%systemd_preun chronyd.service chronyd-restricted.service chrony-wait.service
 
 %postun
-%systemd_postun_with_restart chronyd.service
+%systemd_postun_with_restart chronyd.service chronyd-restricted.service
 
 %files
 %{!?_licensedir:%global license %%doc}
@@ -206,6 +217,15 @@ fi
 %dir %attr(750,chrony,chrony) %{_localstatedir}/log/chrony
 
 %changelog
+* Tue Jan 09 2024 Miroslav Lichvar <mlichvar@redhat.com> 4.5-1
+- update to 4.5 (RHEL-6522 RHEL-6520 RHEL-9969 RHEL-9971 RHEL-9973 RHEL-9975
+  RHEL-12411)
+- add chronyd-restricted service (RHEL-9972)
+
+* Wed Oct 12 2022 Miroslav Lichvar <mlichvar@redhat.com> 4.3-1
+- update to 4.3 (#2133754)
+- add sysusers.d fragment for chrony user/group (#2095374)
+
 * Wed Mar 23 2022 Miroslav Lichvar <mlichvar@redhat.com> 4.2-1
 - update to 4.2 (#2051441)
 - fully switch from nettle to gnutls (#1953463 #1954483)

sources

@@ -1,3 +1,3 @@
-SHA512 (chrony-4.3.tar.gz) = 1394bac3ed684352fe89b7fef7da50e61f9f522abee807627ae1fc4c2dde891017bc8e5b13759fced028f3a1e875d5e4e5a4f85de65c63b5f83d0ca03bb4c5df
-SHA512 (chrony-4.3-tar-gz-asc.txt) = 300b06f253ac3727edb86a1b7c337f9529ee752bbb471b266217b6a8ac5183e827264177a3210d436425d746673bf11fbdc41da145673213e28165197c6c76b7
-SHA512 (clknetsim-f00531.tar.gz) = a44f543574519d1d5b5778f91b88fc73a976de511b97011c8ff3bc61a7ebff868fe9c6b46947ff4b58b29bd45520ffa68147934b1d289b1ffada4a329c048df5
+SHA512 (chrony-4.5.tar.gz) = 58a449e23186da799064b16ab16f799c1673296984b152b43e87c620d86e272c55365e83439d410fc89e4e0ba0befd7d5c625eac78a6665813b7ea75444f71b5
+SHA512 (chrony-4.5-tar-gz-asc.txt) = 05470e6cc34524fdab494f70cee71d46172b38bdd4acd8173ac79fdec12178239248880db474437690094aae7909002113289ac7f9305130c5e0a1d9364122cb
+SHA512 (clknetsim-5d1dc0.tar.gz) = 7d542443d7d9334d900cee821207fab1ee87e57fda6580a9d894f65fb36d265fdc4a72022b4293134d54cdeffba7e84d2f68f732f4b228b84d846d8668b314b2