Compare commits
4 Commits
imports/c8
...
c8
| Author | SHA1 | Date |
|---|---|---|
 eabdullin
|
c95bd93246 | |
CentOS Sources
|
3132d53a40 | |
|
CentOS Sources
|
ff7d5f3fe0 | |
|
CentOS Sources
|
8751a89929 |
|
|
@ -1,2 +0,0 @@
|
|||
79e9aeace143550300387a99f17bff04b45673f7 SOURCES/chrony-3.5.tar.gz
|
||||
84d41ec6da2317dab5e41d9b73ec028c78325700 SOURCES/clknetsim-3f5ef9.tar.gz
|
||||
|
|
@ -1,2 +1,2 @@
|
|||
SOURCES/chrony-3.5.tar.gz
|
||||
SOURCES/clknetsim-3f5ef9.tar.gz
|
||||
SOURCES/chrony-4.5.tar.gz
|
||||
SOURCES/clknetsim-5d1dc0.tar.gz
|
||||
|
|
|
|||
|
|
@ -0,0 +1,38 @@
|
|||
diff -up chrony-4.1/examples/chrony.conf.example2.defconfig chrony-4.1/examples/chrony.conf.example2
|
||||
--- chrony-4.1/examples/chrony.conf.example2.defconfig 2021-05-12 13:06:15.000000000 +0200
|
||||
+++ chrony-4.1/examples/chrony.conf.example2 2019-05-10 12:22:57.000000000 +0200
|
||||
@@ -1,5 +1,5 @@
|
||||
# Use public servers from the pool.ntp.org project.
|
||||
-# Please consider joining the pool (https://www.pool.ntp.org/join.html).
|
||||
+# Please consider joining the pool (http://www.pool.ntp.org/join.html).
|
||||
pool pool.ntp.org iburst
|
||||
|
||||
# Record the rate at which the system clock gains/losses time.
|
||||
@@ -25,18 +25,9 @@ rtcsync
|
||||
# Serve time even if not synchronized to a time source.
|
||||
#local stratum 10
|
||||
|
||||
-# Require authentication (nts or key option) for all NTP sources.
|
||||
-#authselectmode require
|
||||
-
|
||||
# Specify file containing keys for NTP authentication.
|
||||
#keyfile /etc/chrony.keys
|
||||
|
||||
-# Save NTS keys and cookies.
|
||||
-ntsdumpdir /var/lib/chrony
|
||||
-
|
||||
-# Insert/delete leap seconds by slewing instead of stepping.
|
||||
-#leapsecmode slew
|
||||
-
|
||||
# Get TAI-UTC offset and leap seconds from the system tz database.
|
||||
#leapsectz right/UTC
|
||||
|
||||
diff -up chrony-4.5/examples/chrony.keys.example.keys chrony-4.5/examples/chrony.keys.example
|
||||
--- chrony-4.5/examples/chrony.keys.example.keys 2023-12-05 14:22:10.000000000 +0100
|
||||
+++ chrony-4.5/examples/chrony.keys.example 2023-12-06 09:59:26.089508934 +0100
|
||||
@@ -11,5 +11,3 @@
|
||||
#1 MD5 AVeryLongAndRandomPassword
|
||||
#2 MD5 HEX:12114855C7931009B4049EF3EFC48A139C3F989F
|
||||
#3 SHA1 HEX:B2159C05D6A219673A3B7E896B6DE07F6A440995
|
||||
-#4 AES128 HEX:2DA837C4B6573748CA692B8C828E4891
|
||||
-#5 AES256 HEX:2666B8099BFF2D5BA20876121788ED24D2BE59111B8FFB562F0F56AE6EC7246E
|
||||
|
|
@ -0,0 +1,164 @@
|
|||
First, revert upstream changes since 4.2
|
||||
|
||||
diff --git a/examples/chrony.nm-dispatcher.dhcp b/examples/chrony.nm-dispatcher.dhcp
|
||||
index 547ce83f..6ea4c370 100644
|
||||
--- a/examples/chrony.nm-dispatcher.dhcp
|
||||
+++ b/examples/chrony.nm-dispatcher.dhcp
|
||||
@@ -1,7 +1,8 @@
|
||||
#!/bin/sh
|
||||
# This is a NetworkManager dispatcher script for chronyd to update
|
||||
-# its NTP sources with servers from DHCP options passed by NetworkManager
|
||||
-# in the DHCP4_NTP_SERVERS and DHCP6_DHCP6_NTP_SERVERS environment variables.
|
||||
+# its NTP sources passed from DHCP options. Note that this script is
|
||||
+# specific to NetworkManager-dispatcher due to use of the
|
||||
+# DHCP4_NTP_SERVERS environment variable.
|
||||
|
||||
export LC_ALL=C
|
||||
|
||||
@@ -9,23 +10,17 @@ interface=$1
|
||||
action=$2
|
||||
|
||||
chronyc=/usr/bin/chronyc
|
||||
-server_options=iburst
|
||||
+default_server_options=iburst
|
||||
server_dir=/var/run/chrony-dhcp
|
||||
|
||||
dhcp_server_file=$server_dir/$interface.sources
|
||||
-dhcp_ntp_servers="$DHCP4_NTP_SERVERS $DHCP6_DHCP6_NTP_SERVERS"
|
||||
+# DHCP4_NTP_SERVERS is passed from DHCP options by NetworkManager.
|
||||
+nm_dhcp_servers=$DHCP4_NTP_SERVERS
|
||||
|
||||
add_servers_from_dhcp() {
|
||||
rm -f "$dhcp_server_file"
|
||||
- for server in $dhcp_ntp_servers; do
|
||||
- # Check for invalid characters (from the DHCPv6 NTP FQDN suboption)
|
||||
- len1=$(printf '%s' "$server" | wc -c)
|
||||
- len2=$(printf '%s' "$server" | tr -d -c 'A-Za-z0-9:.-' | wc -c)
|
||||
- if [ "$len1" -ne "$len2" ] || [ "$len2" -lt 1 ] || [ "$len2" -gt 255 ]; then
|
||||
- continue
|
||||
- fi
|
||||
-
|
||||
- printf 'server %s %s\n' "$server" "$server_options" >> "$dhcp_server_file"
|
||||
+ for server in $nm_dhcp_servers; do
|
||||
+ echo "server $server $default_server_options" >> "$dhcp_server_file"
|
||||
done
|
||||
$chronyc reload sources > /dev/null 2>&1 || :
|
||||
}
|
||||
@@ -39,11 +34,10 @@ clear_servers_from_dhcp() {
|
||||
|
||||
mkdir -p $server_dir
|
||||
|
||||
-case "$action" in
|
||||
- up|dhcp4-change|dhcp6-change)
|
||||
- add_servers_from_dhcp;;
|
||||
- down)
|
||||
- clear_servers_from_dhcp;;
|
||||
-esac
|
||||
+if [ "$action" = "up" ] || [ "$action" = "dhcp4-change" ]; then
|
||||
+ add_servers_from_dhcp
|
||||
+elif [ "$action" = "down" ]; then
|
||||
+ clear_servers_from_dhcp
|
||||
+fi
|
||||
|
||||
exit 0
|
||||
|
||||
From: Robert Fairley <rfairley@redhat.com>
|
||||
Date: Wed, 17 Jun 2020 10:14:19 -0400
|
||||
Subject: [PATCH] examples/nm-dispatcher.dhcp: use sysconfig
|
||||
|
||||
Use the PEERNTP and NTPSERVERARGS environment variables from
|
||||
/etc/sysconfig/network{-scripts}.
|
||||
|
||||
Co-Authored-By: Christian Glombek <cglombek@redhat.com>
|
||||
|
||||
diff --git a/examples/chrony.nm-dispatcher.dhcp b/examples/chrony.nm-dispatcher.dhcp
|
||||
index 6ea4c37..a6ad35a 100644
|
||||
--- a/examples/chrony.nm-dispatcher.dhcp
|
||||
+++ b/examples/chrony.nm-dispatcher.dhcp
|
||||
@@ -6,16 +6,24 @@
|
||||
|
||||
chronyc=/usr/bin/chronyc
|
||||
default_server_options=iburst
|
||||
-server_dir=/var/run/chrony-dhcp
|
||||
+server_dir=/run/chrony-dhcp
|
||||
|
||||
dhcp_server_file=$server_dir/$interface.sources
|
||||
# DHCP4_NTP_SERVERS is passed from DHCP options by NetworkManager.
|
||||
nm_dhcp_servers=$DHCP4_NTP_SERVERS
|
||||
|
||||
+[ -f /etc/sysconfig/network ] && . /etc/sysconfig/network
|
||||
+[ -f /etc/sysconfig/network-scripts/ifcfg-"${interface}" ] && \
|
||||
+ . /etc/sysconfig/network-scripts/ifcfg-"${interface}"
|
||||
+
|
||||
add_servers_from_dhcp() {
|
||||
rm -f "$dhcp_server_file"
|
||||
+
|
||||
+ # Don't add NTP servers if PEERNTP=no specified; return early.
|
||||
+ [ "$PEERNTP" = "no" ] && return
|
||||
+
|
||||
for server in $nm_dhcp_servers; do
|
||||
- echo "server $server $default_server_options" >> "$dhcp_server_file"
|
||||
+ echo "server $server ${NTPSERVERARGS:-$default_server_options}" >> "$dhcp_server_file"
|
||||
done
|
||||
$chronyc reload sources > /dev/null 2>&1 || :
|
||||
}
|
||||
--
|
||||
2.29.2
|
||||
|
||||
Use chrony-helper instead of chronyc to avoid changes in default chrony.conf
|
||||
|
||||
diff -up chrony-4.1/examples/chrony.nm-dispatcher.dhcp.nm-dispatcher-dhcp chrony-4.1/examples/chrony.nm-dispatcher.dhcp
|
||||
--- chrony-4.1/examples/chrony.nm-dispatcher.dhcp.nm-dispatcher-dhcp 2021-06-09 11:10:30.997416152 +0200
|
||||
+++ chrony-4.1/examples/chrony.nm-dispatcher.dhcp 2021-06-09 11:16:23.598381336 +0200
|
||||
@@ -9,11 +9,12 @@ export LC_ALL=C
|
||||
interface=$1
|
||||
action=$2
|
||||
|
||||
-chronyc=/usr/bin/chronyc
|
||||
+helper=/usr/libexec/chrony-helper
|
||||
default_server_options=iburst
|
||||
-server_dir=/run/chrony-dhcp
|
||||
+server_dir=/run/chrony-helper
|
||||
|
||||
-dhcp_server_file=$server_dir/$interface.sources
|
||||
+dhcp_server_tmpfile=$server_dir/tmp-nm-dhcp.$interface
|
||||
+dhcp_server_file=$server_dir/nm-dhcp.$interface
|
||||
# DHCP4_NTP_SERVERS is passed from DHCP options by NetworkManager.
|
||||
nm_dhcp_servers=$DHCP4_NTP_SERVERS
|
||||
|
||||
@@ -24,24 +24,30 @@ nm_dhcp_servers=$DHCP4_NTP_SERVERS
|
||||
add_servers_from_dhcp() {
|
||||
rm -f "$dhcp_server_file"
|
||||
|
||||
+ # Remove servers saved by the dhclient script before it detected NM.
|
||||
+ rm -f "/var/lib/dhclient/chrony.servers.$interface"
|
||||
+
|
||||
# Don't add NTP servers if PEERNTP=no specified; return early.
|
||||
[ "$PEERNTP" = "no" ] && return
|
||||
|
||||
+ # Create the directory with correct SELinux context.
|
||||
+ $helper create-helper-directory > /dev/null 2>&1
|
||||
+
|
||||
for server in $nm_dhcp_servers; do
|
||||
- echo "server $server ${NTPSERVERARGS:-$default_server_options}" >> "$dhcp_server_file"
|
||||
+ echo "$server ${NTPSERVERARGS:-$default_server_options}" >> "$dhcp_server_tmpfile"
|
||||
done
|
||||
+ [ -e "$dhcp_server_tmpfile" ] && mv "$dhcp_server_tmpfile" "$dhcp_server_file"
|
||||
- $chronyc reload sources > /dev/null 2>&1 || :
|
||||
+
|
||||
+ $helper update-daemon > /dev/null 2>&1 || :
|
||||
}
|
||||
|
||||
clear_servers_from_dhcp() {
|
||||
if [ -f "$dhcp_server_file" ]; then
|
||||
rm -f "$dhcp_server_file"
|
||||
- $chronyc reload sources > /dev/null 2>&1 || :
|
||||
+ $helper update-daemon > /dev/null 2>&1 || :
|
||||
fi
|
||||
}
|
||||
|
||||
-mkdir -p $server_dir
|
||||
-
|
||||
if [ "$action" = "up" ] || [ "$action" = "dhcp4-change" ]; then
|
||||
add_servers_from_dhcp
|
||||
elif [ "$action" = "down" ]; then
|
||||
|
|
@ -0,0 +1,39 @@
|
|||
commit e11b518a1ffa704986fb1f1835c425844ba248ef
|
||||
Author: Miroslav Lichvar <mlichvar@redhat.com>
|
||||
Date: Mon Jan 8 11:35:56 2024 +0100
|
||||
|
||||
ntp: fix authenticated requests in serverstats
|
||||
|
||||
Fix the CLG_UpdateNtpStats() call to count requests passing the
|
||||
authentication check instead of requests triggering a KoD response
|
||||
(i.e. NTS NAK).
|
||||
|
||||
diff --git a/ntp_core.c b/ntp_core.c
|
||||
index 023e60b2..35801744 100644
|
||||
--- a/ntp_core.c
|
||||
+++ b/ntp_core.c
|
||||
@@ -2736,7 +2736,7 @@ NCR_ProcessRxUnknown(NTP_Remote_Address *remote_addr, NTP_Local_Address *local_a
|
||||
CLG_DisableNtpTimestamps(&ntp_rx);
|
||||
}
|
||||
|
||||
- CLG_UpdateNtpStats(kod != 0 && info.auth.mode != NTP_AUTH_NONE &&
|
||||
+ CLG_UpdateNtpStats(kod == 0 && info.auth.mode != NTP_AUTH_NONE &&
|
||||
info.auth.mode != NTP_AUTH_MSSNTP,
|
||||
rx_ts->source, interleaved ? tx_ts->source : NTP_TS_DAEMON);
|
||||
|
||||
diff --git a/test/system/010-nts b/test/system/010-nts
|
||||
index 8d92bbc8..b215efa3 100755
|
||||
--- a/test/system/010-nts
|
||||
+++ b/test/system/010-nts
|
||||
@@ -45,6 +45,11 @@ check_chronyc_output "^Name/IP address Mode KeyID Type KLen Last Atm
|
||||
=========================================================================
|
||||
127\.0\.0\.1 NTS 1 (30|15) (128|256) [0-9] 0 0 [78] ( 64|100)$" || test_fail
|
||||
|
||||
+run_chronyc "serverstats" || test_fail
|
||||
+check_chronyc_output "NTS-KE connections accepted: 1
|
||||
+NTS-KE connections dropped : 0
|
||||
+Authenticated NTP packets : [1-9][0-9]*" || test_fail
|
||||
+
|
||||
stop_chronyd || test_fail
|
||||
check_chronyd_messages || test_fail
|
||||
check_chronyd_files || test_fail
|
||||
|
|
@ -1,11 +1,12 @@
|
|||
diff -up chrony-3.5/examples/chronyd.service.service-helper chrony-3.5/examples/chronyd.service
|
||||
--- chrony-3.5/examples/chronyd.service.service-helper 2019-05-10 12:22:57.000000000 +0200
|
||||
+++ chrony-3.5/examples/chronyd.service 2019-05-14 13:42:38.069516800 +0200
|
||||
@@ -10,6 +10,7 @@ Type=forking
|
||||
diff -up chrony-4.1/examples/chronyd.service.service-helper chrony-4.1/examples/chronyd.service
|
||||
--- chrony-4.1/examples/chronyd.service.service-helper 2021-05-12 13:06:15.000000000 +0200
|
||||
+++ chrony-4.1/examples/chronyd.service 2021-06-15 09:01:56.948968576 +0200
|
||||
@@ -10,6 +10,8 @@ Type=forking
|
||||
PIDFile=/run/chrony/chronyd.pid
|
||||
EnvironmentFile=-/etc/sysconfig/chronyd
|
||||
ExecStart=/usr/sbin/chronyd $OPTIONS
|
||||
+ExecStartPost=/usr/libexec/chrony-helper update-daemon
|
||||
+ExecStopPost=/usr/libexec/chrony-helper remove-daemon-state
|
||||
PrivateTmp=yes
|
||||
ProtectHome=yes
|
||||
ProtectSystem=full
|
||||
|
|
|
|||
|
|
@ -0,0 +1,81 @@
|
|||
diff --git a/examples/chrony-wait.service b/examples/chrony-wait.service
|
||||
index 72b028f2..b3aa7aa2 100644
|
||||
--- a/examples/chrony-wait.service
|
||||
+++ b/examples/chrony-wait.service
|
||||
@@ -16,31 +16,5 @@ TimeoutStartSec=180
|
||||
RemainAfterExit=yes
|
||||
StandardOutput=null
|
||||
|
||||
-CapabilityBoundingSet=
|
||||
-DevicePolicy=closed
|
||||
-DynamicUser=yes
|
||||
-IPAddressAllow=localhost
|
||||
-IPAddressDeny=any
|
||||
-LockPersonality=yes
|
||||
-MemoryDenyWriteExecute=yes
|
||||
-PrivateDevices=yes
|
||||
-PrivateUsers=yes
|
||||
-ProtectClock=yes
|
||||
-ProtectControlGroups=yes
|
||||
-ProtectHome=yes
|
||||
-ProtectHostname=yes
|
||||
-ProtectKernelLogs=yes
|
||||
-ProtectKernelModules=yes
|
||||
-ProtectKernelTunables=yes
|
||||
-ProtectProc=invisible
|
||||
-ProtectSystem=strict
|
||||
-RestrictAddressFamilies=AF_INET AF_INET6
|
||||
-RestrictNamespaces=yes
|
||||
-RestrictRealtime=yes
|
||||
-SystemCallArchitectures=native
|
||||
-SystemCallFilter=@system-service
|
||||
-SystemCallFilter=~@privileged @resources
|
||||
-UMask=0777
|
||||
-
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
diff --git a/examples/chronyd.service b/examples/chronyd.service
|
||||
index 4fb930ef..289548cb 100644
|
||||
--- a/examples/chronyd.service
|
||||
+++ b/examples/chronyd.service
|
||||
@@ -10,39 +10,9 @@ Type=forking
|
||||
PIDFile=/run/chrony/chronyd.pid
|
||||
EnvironmentFile=-/etc/sysconfig/chronyd
|
||||
ExecStart=/usr/sbin/chronyd $OPTIONS
|
||||
-
|
||||
-CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
|
||||
-CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_KILL CAP_LEASE CAP_LINUX_IMMUTABLE
|
||||
-CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE CAP_MKNOD CAP_SYS_ADMIN
|
||||
-CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_CHROOT CAP_SYS_MODULE CAP_SYS_PACCT
|
||||
-CapabilityBoundingSet=~CAP_SYS_PTRACE CAP_SYS_RAWIO CAP_SYS_TTY_CONFIG CAP_WAKE_ALARM
|
||||
-DeviceAllow=char-pps rw
|
||||
-DeviceAllow=char-ptp rw
|
||||
-DeviceAllow=char-rtc rw
|
||||
-DevicePolicy=closed
|
||||
-LockPersonality=yes
|
||||
-MemoryDenyWriteExecute=yes
|
||||
-NoNewPrivileges=yes
|
||||
PrivateTmp=yes
|
||||
-ProtectControlGroups=yes
|
||||
ProtectHome=yes
|
||||
-ProtectHostname=yes
|
||||
-ProtectKernelLogs=yes
|
||||
-ProtectKernelModules=yes
|
||||
-ProtectKernelTunables=yes
|
||||
-ProtectProc=invisible
|
||||
-ProtectSystem=strict
|
||||
-ReadWritePaths=/run /var/lib/chrony -/var/log
|
||||
-RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
|
||||
-RestrictNamespaces=yes
|
||||
-RestrictSUIDSGID=yes
|
||||
-SystemCallArchitectures=native
|
||||
-SystemCallFilter=~@cpu-emulation @debug @module @mount @obsolete @raw-io @reboot @swap
|
||||
-
|
||||
-# Adjust restrictions for /usr/sbin/sendmail (mailonchange directive)
|
||||
-NoNewPrivileges=no
|
||||
-ReadWritePaths=-/var/spool
|
||||
-RestrictAddressFamilies=AF_NETLINK
|
||||
+ProtectSystem=full
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
|
|
@ -3,6 +3,9 @@
|
|||
SERVERFILE=$SAVEDIR/chrony.servers.$interface
|
||||
|
||||
chrony_config() {
|
||||
# Disable modifications if called from a NM dispatcher script
|
||||
[ -n "$NM_DISPATCHER_ACTION" ] && return 0
|
||||
|
||||
rm -f "$SERVERFILE"
|
||||
if [ "$PEERNTP" != "no" ]; then
|
||||
for server in $new_ntp_servers; do
|
||||
|
|
@ -13,6 +16,8 @@ chrony_config() {
|
|||
}
|
||||
|
||||
chrony_restore() {
|
||||
[ -n "$NM_DISPATCHER_ACTION" ] && return 0
|
||||
|
||||
if [ -f "$SERVERFILE" ]; then
|
||||
rm -f "$SERVERFILE"
|
||||
/usr/libexec/chrony-helper update-daemon || :
|
||||
|
|
|
|||
|
|
@ -8,10 +8,11 @@
|
|||
chronyc=/usr/bin/chronyc
|
||||
chrony_conf=/etc/chrony.conf
|
||||
chrony_service=chronyd.service
|
||||
helper_dir=/var/run/chrony-helper
|
||||
helper_dir=/run/chrony-helper
|
||||
added_servers_file=$helper_dir/added_servers
|
||||
|
||||
network_sysconfig_file=/etc/sysconfig/network
|
||||
nm_servers_files="$helper_dir/nm-dhcp.*"
|
||||
dhclient_servers_files="/var/lib/dhclient/chrony.servers.*"
|
||||
dnssrv_servers_files="$helper_dir/dnssrv@*"
|
||||
dnssrv_timer_prefix=chrony-dnssrv@
|
||||
|
|
@ -19,7 +20,7 @@ dnssrv_timer_prefix=chrony-dnssrv@
|
|||
. $network_sysconfig_file &> /dev/null
|
||||
|
||||
chrony_command() {
|
||||
$chronyc -a -n -m "$1"
|
||||
$chronyc -n -m "$@"
|
||||
}
|
||||
|
||||
is_running() {
|
||||
|
|
@ -27,6 +28,7 @@ is_running() {
|
|||
}
|
||||
|
||||
get_servers_files() {
|
||||
[ "$PEERNTP" != "no" ] && echo "$nm_servers_files"
|
||||
[ "$PEERNTP" != "no" ] && echo "$dhclient_servers_files"
|
||||
echo "$dnssrv_servers_files"
|
||||
}
|
||||
|
|
@ -38,11 +40,15 @@ is_update_needed() {
|
|||
return 1
|
||||
}
|
||||
|
||||
remove_daemon_state() {
|
||||
rm -f $added_servers_file
|
||||
}
|
||||
|
||||
update_daemon() {
|
||||
local all_servers_with_args all_servers added_servers
|
||||
|
||||
if ! is_running; then
|
||||
rm -f $added_servers_file
|
||||
remove_daemon_state
|
||||
return 0
|
||||
fi
|
||||
|
||||
|
|
@ -64,7 +70,13 @@ update_daemon() {
|
|||
|
||||
comm -23 <(echo -n "$added_servers") <(echo -n "$all_servers") |
|
||||
while read -r server; do
|
||||
chrony_command "delete $server" &> /dev/null
|
||||
chrony_command -c sources -a 2>/dev/null |
|
||||
while IFS=, read -r type _ address _; do
|
||||
[ "$type" = "^" ] || continue
|
||||
[ "$(chrony_command "sourcename $address")" = "$server" ] || continue
|
||||
chrony_command "delete $address" &> /dev/null
|
||||
break
|
||||
done
|
||||
done
|
||||
|
||||
added_servers=$(comm -12 <(echo -n "$added_servers") <(echo -n "$all_servers"))
|
||||
|
|
@ -217,7 +229,9 @@ print_help() {
|
|||
echo "Usage: $0 COMMAND"
|
||||
echo
|
||||
echo "Commands:"
|
||||
echo " create-helper-directory"
|
||||
echo " update-daemon"
|
||||
echo " remove-daemon-state"
|
||||
echo " update-dnssrv-servers NAME"
|
||||
echo " enable-dnssrv NAME"
|
||||
echo " disable-dnssrv NAME"
|
||||
|
|
@ -229,10 +243,16 @@ print_help() {
|
|||
}
|
||||
|
||||
case "$1" in
|
||||
create-helper-directory)
|
||||
prepare_helper_dir
|
||||
;;
|
||||
update-daemon|add-dhclient-servers|remove-dhclient-servers)
|
||||
is_update_needed || exit 0
|
||||
prepare_helper_dir && update_daemon
|
||||
;;
|
||||
remove-daemon-state)
|
||||
remove_daemon_state
|
||||
;;
|
||||
update-dnssrv-servers)
|
||||
prepare_helper_dir && update_dnssrv_servers "$2" && update_daemon
|
||||
;;
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
#!/usr/bin/python
|
||||
#!/usr/bin/python3
|
||||
#
|
||||
# Convert ntp configuration to chrony
|
||||
#
|
||||
|
|
@ -28,7 +28,6 @@ import argparse
|
|||
import ipaddress
|
||||
import logging
|
||||
import os
|
||||
import os.path
|
||||
import re
|
||||
import subprocess
|
||||
import sys
|
||||
|
|
@ -39,6 +38,7 @@ if sys.version_info[0] < 3:
|
|||
reload(sys)
|
||||
sys.setdefaultencoding("utf-8")
|
||||
|
||||
|
||||
class NtpConfiguration(object):
|
||||
def __init__(self, root_dir, ntp_conf, step_tickers):
|
||||
self.root_dir = root_dir if root_dir != "/" else ""
|
||||
|
|
@ -66,14 +66,15 @@ class NtpConfiguration(object):
|
|||
self.ignored_directives = set()
|
||||
self.ignored_lines = []
|
||||
|
||||
#self.detect_enabled_services()
|
||||
# self.detect_enabled_services()
|
||||
self.parse_step_tickers()
|
||||
self.parse_ntp_conf()
|
||||
|
||||
def detect_enabled_services(self):
|
||||
for service in ["ntpdate", "ntpd", "ntp-wait"]:
|
||||
if os.path.islink("{}/etc/systemd/system/multi-user.target.wants/{}.service"
|
||||
.format(self.root_dir, service)):
|
||||
service_path = os.path.join(self.root_dir,
|
||||
"etc/systemd/system/multi-user.target.wants/{}.service".format(service))
|
||||
if os.path.islink(service_path):
|
||||
self.enabled_services.add(service)
|
||||
logging.info("Enabled services found in /etc/systemd/system: %s",
|
||||
" ".join(self.enabled_services))
|
||||
|
|
@ -255,7 +256,12 @@ class NtpConfiguration(object):
|
|||
else:
|
||||
try:
|
||||
if mask:
|
||||
networks.append(ipaddress.ip_network(u"{}/{}".format(address, mask)))
|
||||
# Count bits in the mask (ipaddress does not support
|
||||
# expanded IPv6 netmasks)
|
||||
mask_ip = ipaddress.ip_address(mask)
|
||||
mask_str = "{0:0{1}b}".format(int(mask_ip), mask_ip.max_prefixlen)
|
||||
networks.append(ipaddress.ip_network(
|
||||
u"{}/{}".format(address, len(mask_str.rstrip('0')))))
|
||||
else:
|
||||
networks.append(ipaddress.ip_network(address))
|
||||
except ValueError:
|
||||
|
|
@ -490,11 +496,11 @@ class NtpConfiguration(object):
|
|||
orphan_stratum = self.tos_options["orphan"]
|
||||
|
||||
if "clockstats" in self.statistics:
|
||||
logs.append("refclocks");
|
||||
logs.append("refclocks")
|
||||
if "loopstats" in self.statistics:
|
||||
logs.append("tracking")
|
||||
if "peerstats" in self.statistics:
|
||||
logs.append("statistics");
|
||||
logs.append("statistics")
|
||||
if "rawstats" in self.statistics:
|
||||
logs.append("measurements")
|
||||
|
||||
|
|
@ -593,6 +599,8 @@ class NtpConfiguration(object):
|
|||
|
||||
if key_type in ["m", "M"]:
|
||||
key_type = "MD5"
|
||||
elif key_type == "AES128CMAC":
|
||||
key_type = "AES128"
|
||||
elif key_type not in ["MD5", "SHA1", "SHA256", "SHA384", "SHA512"]:
|
||||
continue
|
||||
|
||||
|
|
@ -667,5 +675,6 @@ def main():
|
|||
|
||||
conf.write_chrony_configuration(args.chrony_conf, args.chrony_keys, args.dry_run, args.backup)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
|
|
|
|||
|
|
@ -1,36 +1,47 @@
|
|||
%global _hardened_build 1
|
||||
%global clknetsim_ver 3f5ef9
|
||||
%global ntp2chrony_ver 2a0512
|
||||
%global clknetsim_ver 5d1dc0
|
||||
%global ntp2chrony_ver 233b75
|
||||
%bcond_without debug
|
||||
%bcond_without nts
|
||||
|
||||
Name: chrony
|
||||
Version: 3.5
|
||||
Version: 4.5
|
||||
Release: 1%{?dist}
|
||||
Summary: An NTP client/server
|
||||
|
||||
Group: System Environment/Daemons
|
||||
License: GPLv2
|
||||
URL: https://chrony.tuxfamily.org
|
||||
Source0: https://download.tuxfamily.org/chrony/chrony-%{version}%{?prerelease}.tar.gz
|
||||
URL: https://chrony-project.org
|
||||
Source0: https://chrony-project.org/releases/chrony-%{version}%{?prerelease}.tar.gz
|
||||
Source1: chrony.dhclient
|
||||
Source2: chrony.helper
|
||||
Source3: chrony-dnssrv@.service
|
||||
Source4: chrony-dnssrv@.timer
|
||||
# simulator for test suite
|
||||
Source10: https://github.com/mlichvar/clknetsim/archive/%{clknetsim_ver}/clknetsim-%{clknetsim_ver}.tar.gz
|
||||
Source10: https://gitlab.com/chrony/clknetsim/-/archive/master/clknetsim-%{clknetsim_ver}.tar.gz
|
||||
# script for converting ntp configuration to chrony
|
||||
Source11: https://github.com/mlichvar/ntp2chrony/raw/%{ntp2chrony_ver}/ntp2chrony/ntp2chrony.py
|
||||
%{?gitpatch:Patch0: chrony-%{version}%{?prerelease}-%{gitpatch}.patch.gz}
|
||||
|
||||
# revert upstream changes in packaged service files
|
||||
Patch0: chrony-services.patch
|
||||
# modify NetworkManager DHCP dispatcher to work with chrony-helper and
|
||||
# follow distribution-specific configuration
|
||||
Patch1: chrony-nm-dispatcher-dhcp.patch
|
||||
# add NTP servers from DHCP when starting service
|
||||
Patch2: chrony-service-helper.patch
|
||||
# revert upstream changes in packaged configuration examples
|
||||
Patch3: chrony-defconfig.patch
|
||||
# fix serverstats to correctly count authenticated packets
|
||||
Patch4: chrony-serverstats.patch
|
||||
|
||||
BuildRequires: libcap-devel libedit-devel nettle-devel pps-tools-devel
|
||||
%ifarch %{ix86} x86_64 %{arm} aarch64 mipsel mips64el ppc64 ppc64le s390 s390x
|
||||
BuildRequires: libseccomp-devel
|
||||
%endif
|
||||
BuildRequires: gcc bison systemd
|
||||
BuildRequires: gcc gcc-c++ make bison systemd
|
||||
BuildRequires: kernel-headers > 4.18.0-87
|
||||
%{?with_nts:BuildRequires: gnutls-devel gnutls-utils}
|
||||
|
||||
Requires(pre): shadow-utils
|
||||
%{?systemd_requires}
|
||||
|
|
@ -55,18 +66,23 @@ service to other computers in the network.
|
|||
%prep
|
||||
%setup -q -n %{name}-%{version}%{?prerelease} -a 10
|
||||
%{?gitpatch:%patch0 -p1}
|
||||
%patch0 -p1 -b .services
|
||||
%patch1 -p1 -b .nm-dispatcher-dhcp
|
||||
%patch2 -p1 -b .service-helper
|
||||
%patch3 -p1 -b .defconfig
|
||||
%patch4 -p1 -b .serverstats
|
||||
|
||||
%{?gitpatch: echo %{version}-%{gitpatch} > version.txt}
|
||||
|
||||
# review changes in packaged configuration files and scripts
|
||||
md5sum -c <<-EOF | (! grep -v 'OK$')
|
||||
47ad7eccc410b981d2f2101cf5682616 examples/chrony-wait.service
|
||||
bc563c1bcf67b2da774bd8c2aef55a06 examples/chrony-wait.service
|
||||
e473a9fab7fe200cacce3dca8b66290b examples/chrony.conf.example2
|
||||
96999221eeef476bd49fe97b97503126 examples/chrony.keys.example
|
||||
6a3178c4670de7de393d9365e2793740 examples/chrony.logrotate
|
||||
8748a663f0b1943ea491858f414a6b26 examples/chrony.nm-dispatcher
|
||||
b23bcc3bd78e195ca2849459e459f3ed examples/chronyd.service
|
||||
fabb5b3f127b802c27c82837feff0fe6 examples/chrony.nm-dispatcher.dhcp
|
||||
4e85d36595727318535af3387411070c examples/chrony.nm-dispatcher.onoffline
|
||||
56d221eba8ce8a2e03d3e0dd87999a81 examples/chronyd.service
|
||||
EOF
|
||||
|
||||
# don't allow packaging without vendor zone
|
||||
|
|
@ -86,7 +102,7 @@ touch -r examples/chrony.conf.example2 chrony.conf
|
|||
# regenerate the file from getdate.y
|
||||
rm -f getdate.c
|
||||
|
||||
mv clknetsim-%{clknetsim_ver}* test/simulation/clknetsim
|
||||
mv clknetsim-*-%{clknetsim_ver}* test/simulation/clknetsim
|
||||
|
||||
install -m 644 -p %{SOURCE11} ntp2chrony.py
|
||||
|
||||
|
|
@ -95,10 +111,13 @@ install -m 644 -p %{SOURCE11} ntp2chrony.py
|
|||
%{?with_debug: --enable-debug} \
|
||||
--enable-ntp-signd \
|
||||
--enable-scfilter \
|
||||
%{!?with_nts: --disable-nts} \
|
||||
--chronyrundir=/run/chrony \
|
||||
--docdir=%{_docdir} \
|
||||
--with-ntp-era=$(date -d '1970-01-01 00:00:00+00:00' +'%s') \
|
||||
--with-user=chrony \
|
||||
--with-hwclockfile=%{_sysconfdir}/adjtime \
|
||||
--with-pidfile=/run/chrony/chronyd.pid \
|
||||
--with-sendmail=%{_sbindir}/sendmail
|
||||
make %{?_smp_mflags}
|
||||
|
||||
|
|
@ -118,8 +137,10 @@ install -m 644 -p chrony.conf $RPM_BUILD_ROOT%{_sysconfdir}/chrony.conf
|
|||
|
||||
install -m 640 -p examples/chrony.keys.example \
|
||||
$RPM_BUILD_ROOT%{_sysconfdir}/chrony.keys
|
||||
install -m 755 -p examples/chrony.nm-dispatcher \
|
||||
$RPM_BUILD_ROOT%{_sysconfdir}/NetworkManager/dispatcher.d/20-chrony
|
||||
install -m 755 -p examples/chrony.nm-dispatcher.onoffline \
|
||||
$RPM_BUILD_ROOT%{_sysconfdir}/NetworkManager/dispatcher.d/20-chrony-onoffline
|
||||
install -m 755 -p examples/chrony.nm-dispatcher.dhcp \
|
||||
$RPM_BUILD_ROOT%{_sysconfdir}/NetworkManager/dispatcher.d/20-chrony-dhcp
|
||||
install -m 755 -p %{SOURCE1} \
|
||||
$RPM_BUILD_ROOT%{_sysconfdir}/dhcp/dhclient.d/chrony.sh
|
||||
install -m 644 -p examples/chrony.logrotate \
|
||||
|
|
@ -183,7 +204,7 @@ fi
|
|||
%config(noreplace) %verify(not md5 size mtime) %attr(640,root,chrony) %{_sysconfdir}/chrony.keys
|
||||
%config(noreplace) %{_sysconfdir}/logrotate.d/chrony
|
||||
%config(noreplace) %{_sysconfdir}/sysconfig/chronyd
|
||||
%{_sysconfdir}/NetworkManager/dispatcher.d/20-chrony
|
||||
%{_sysconfdir}/NetworkManager/dispatcher.d/20-chrony*
|
||||
%{_sysconfdir}/dhcp/dhclient.d/chrony.sh
|
||||
%{_bindir}/chronyc
|
||||
%{_sbindir}/chronyd
|
||||
|
|
@ -192,12 +213,29 @@ fi
|
|||
%{_unitdir}/chrony*.service
|
||||
%{_unitdir}/chrony*.timer
|
||||
%{_mandir}/man[158]/%{name}*.[158]*
|
||||
%dir %attr(-,chrony,chrony) %{_localstatedir}/lib/chrony
|
||||
%dir %attr(750,chrony,chrony) %{_localstatedir}/lib/chrony
|
||||
%ghost %attr(-,chrony,chrony) %{_localstatedir}/lib/chrony/drift
|
||||
%ghost %attr(-,chrony,chrony) %{_localstatedir}/lib/chrony/rtc
|
||||
%dir %attr(-,chrony,chrony) %{_localstatedir}/log/chrony
|
||||
%dir %attr(750,chrony,chrony) %{_localstatedir}/log/chrony
|
||||
|
||||
%changelog
|
||||
* Wed Jan 10 2024 Miroslav Lichvar <mlichvar@redhat.com> 4.5-1
|
||||
- update to 4.5 (RHEL-21069 RHEL-10701)
|
||||
|
||||
* Thu Jul 14 2022 Miroslav Lichvar <mlichvar@redhat.com> 4.2-1
|
||||
- update to 4.2 (#2062356)
|
||||
- fix chrony-helper to delete sources by their original name (#2061660)
|
||||
- update ntp2chrony script (#2018045 #2063766)
|
||||
|
||||
* Tue Jun 15 2021 Miroslav Lichvar <mlichvar@redhat.com> 4.1-1
|
||||
- update to 4.1 (#1895003 #1847853 #1929157)
|
||||
- add NetworkManager dispatcher script to add servers from DHCP even without
|
||||
dhclient (#1933139)
|
||||
- restrict permissions of /var/lib/chrony and /var/log/chrony (#1939295)
|
||||
- reset chrony-helper state after stopping chronyd (#1971697)
|
||||
- add gcc-c++ and make to build requirements
|
||||
- move default paths in /var/run to /run
|
||||
|
||||
* Tue May 21 2019 Miroslav Lichvar <mlichvar@redhat.com> 3.5-1
|
||||
- update to 3.5 (#1685469 #1677218)
|
||||
- fix shellcheck warnings in helper scripts (#1711948)
|
||||
|
|
|
|||
Loading…
Reference in New Issue