| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: ntpsec-utils | Distribution: openSUSE Tumbleweed |
| Version: 1.2.5 | Vendor: openSUSE |
| Release: 1.1 | Build date: Fri Jul 31 14:18:14 2026 |
| Group: Unspecified | Build host: reproducible |
| Size: 313166 | Source RPM: ntpsec-1.2.5-1.1.src.rpm |
| Packager: https://bugs.opensuse.org | |
| Url: https://www.ntpsec.org/ | |
| Summary: Utilities and commands for ntp | |
The ntpsec utilities relying on the python module of ntp
BSD-2-Clause AND NTP AND BSD-3-Clause AND MIT
* Fri Jul 31 2026 Martin Hauke <mardnh@gmx.de>
- Update to version 1.2.5
* A new ntskelog statistic file has been added to the stats file
collection. NTS-KE transactions are now routed here to reduce
clutter in the main system log.
* Link-Time Optimization (LTO) is now enabled by default on Linux
and FreeBSD when --disable-debug-gdb is configured.
* The pool configuration command now natively supports the nts
security flag (pool <server> nts).
* The server counting logic for maxclock (tos maxclock) has been
corrected to skip dynamic POOL slots as well as any remote
servers configured with the noselect flag.
* The HPGPS reference clock driver received a major update,
featuring a new configuration option for listen mode, a fix for
the Z3801A GPS Week Number Rollover (WNRO) glitch, the removal
of the raw scpi > string from clockstats, and the addition of
several new internal tracking variables to clockstats.
Security Fixes:
* Fixed a buffer overflow in the Zyfer reference clock driver
that could occur when processing continuation chunks
(CVE-2026-18321).
* Fixed a NULL-pointer dereference crash in the NTS-KE client
when SSL_new() fails.
* ntpd now uses a cryptographically strong RNG instead of the
weak libc random() for association IDs, poll-time dispersal,
and mode6 response padding.
* Fixed an off-by-one boundary error in ntp_RAND_bytes() that
could cause an out-of-bounds read.
* Fixed an out-of-bounds read in NTS client extension parsing
caused by unchecked nonce/ciphertext lengths.
* Fixed NTS pool peers losing their NTS-KE hostname and NTS
configuration on cookie renewal, which caused certificate
validation to run against the peer’s bare IP address instead
of its configured hostname.
Administrative and Scripting Changes:
* The ntpleapfetch tool has been hardened with parameter quoting
to prevent potential shell execution vulnerabilities.
* The statistics directory argument (-s PATH) has been fixed and
its default behavior adjusted.
* ntpd now explicitly logs a syslog entry when searching for
supplemental configuration files inside /etc/ntpsec/ntp.d.
* ntpd now logs an explicit message when extra pool servers are
actively dropped.
* ntpleapfetch now correctly parses the leapfile directive with
quoted paths and tab/space-delimited values (NTPsec/ntpsec#883)
* waf has been upgraded to 2.1.9, fixing a bug where libntpc.so
was installed to the default library path instead of the
location given via --libdir (NTPsec/ntpsec#870).
* Added missing i386 time64 and mDNS/DNS-SD syscalls to the
seccomp sandbox allow-list, fixing potential sandbox kills on
i386 and mDNS-enabled builds.
* Added missing clock_nanosleep, readlink, and readlinkat
syscalls to the AMD64 seccomp sandbox allow-list, fixing SIGSYS
crashes.
NTS and NTS-KE Fixes:
* NTS-KE requests and responses split across multiple TCP/TLS
reads are now correctly reassembled instead of failing on the
first partial chunk (NTPsec/ntpsec#858).
* Fixed the NTS client failing to reset cookie length when
switching to a new cookie length from a key-exchange response
(NTPsec/ntpsec#877).
* The NTS-KE client now sets the TLS SNI field during the
handshake, improving compatibility with name-based TLS proxies
and load balancers.
* Fixed NTS-KE hostname parsing to strip brackets from IPv6
literal addresses before certificate hostname validation.
* Fixed an NTS-KE response containing more cookies than the
client can store being misparsed and the entire response
rejected, instead of just discarding the extras.
* Fixed an NTS-KE connection that completes synchronously (rather
than asynchronously) being wrongly treated as a connection
failure.
* NTS-KE certificate hostname/IP validation now uses the
non-deprecated OpenSSL 4.0 APIs
(SSL_set1_ipaddr/SSL_set1_dnsname).
* The NTS-KE client no longer rejects a server response solely
for an unrecognized non-critical record type.
* ntpd now validates the aead parameter in both per-server and
global NTS configuration and logs an error instead of silently
accepting an invalid value (NTPsec/ntpsec#880).
* NTS-KE client logging has been improved to emit one detailed
message per connection attempt; the client now parses bracketed
IPv6 literal addresses, applies a send timeout in addition to
the existing receive timeout, and skips already-tried addresses
from multi-homed NTS-KE servers.
* Fixed a bug where a failed DNS-lookup thread creation or join
could leave a peer’s DNS/NTS resolution permanently stuck,
blocking further lookups.
Bug Fixes and Protocol Refinements:
* Fixed a critical issue where NTPsec failed to declare itself
out of sync under specific error and drift conditions.
* Fixed a state machine bug (NTPsec/ntpsec#848) where the
STA_UNSYNC flag was prematurely cleared at system startup.
* Fixed an interactive interface crash in ntpmon triggered by
hitting the minus (-) key.
* Added native .webp image encoding support to the ntpviz
graphing tool.
* Fixed ntpd silently ignoring mode 1 (symmetric active)
requests, e.g. from Windows clients; they are now answered
like ordinary client requests.
* Fixed a regression where ntpd failed to clear peer state on
interface change, delaying resynchronization after network
changes.
* Fixed NTP extension-field parsing to stop treating
unrecognized non-critical fields as fatal; they are now
ignored instead of causing packet rejection.
* socktoa() no longer formats AF_UNSPEC addresses as IPv4,
correcting address display in ntpq and ntpmon.
* mode6 control protocol responses now omit peer addresses that
are empty or otherwise unprintable instead of emitting
malformed data.
* Fixed ntpdig to build a fresh request packet (timestamp/MAC)
for each destination address tried, instead of resending the
same packet.
* Fixed ntpdig crashing with an unhandled UnicodeError when a
configured server name with non-ASCII characters fails DNS
resolution.
* Fixed a crash in ntpq’s interactive `noflake command
(NTPsec/ntpsec#863).
* Fixed a crash (NameError) in ntpq under Python 2 caused by
referencing the Python-3-only BrokenPipeError.
* Fixed a crash in ntpq and ntpmon when a peer’s source address
is empty, e.g. NXDOMAIN or a POOL association.
* sys_var_list is no longer marked as a default variable, so it
is excluded from ntpq’s default `rv (readvar) output.
Removed:
* Removed the undocumented -s/--srcname and -S/--srcnumber
display options, and the hostname/hostnum arguments to ntpq's
hostnames command, from ntpq and ntpmon. This shipped in 1.2.4
but was never documented in NEWS and has now been fully
reverted.
- Use ldconfig_scriptlets macro.
* Fri Nov 21 2025 Martin Hauke <mardnh@gmx.de>
- Update to version 1.2.4
* Python 2.7 is now the minimum supported version.
* waf has been upgraded to version 2.1.4
* waf install now tests the installed binaries
* waf configure --enable-Werror will turn warnings into errors
* Fix ntpviz's skewness and kurtosis formulas.
* ntpd now runs on FIPS mode systems.
* Clock fuzzing is gone. --disable-fuzz is now standard.
* Fix distinct rpeers mode in PeerSummary.summary.
* Fix addr2refid to work with FIPS-140-2 mode.
* Update the leap-seconds.list source in ntpleapfetch.
* Remove obsolete nopeer and notrap mentions from the Access
Control List documentation.
* ntpd can now listen on a second port.Add either "nts port
xxxx" or "extra port xxxx" in your config file. If either is
specified, the NTS-KE server will tell the client to use that
port. This might help get around some of the blocking or
filtering that ISPs are doing to port 123.
* Client requests will also be sent from that port.Again, that
will bypass some port 123 filtering.
* NTPsec now builds on Linux armhf.
* Remove some remnant broadcast/multicast cruft.
* Add a ntpdig option to bind to a specific address.
* Add an ntpd config file option for the NTS-KE server's
preferred TLS ciphers.
* Use ntp_gettime not than ntp_adjtime for local refclcock. Set
the lockclock member of loop_data while the config parses,
making ntp_adjtiime unusable. Don't write a drift file while
in lockclock mode and claim to slew time so that clients will
listen to us,
* Remove unused holdover, LOOP_KERN_CLEAR and timetoa from ntpd.
* Move toward AES-128 rather than MD5 for mac tests.
* Add and revise exponential timing decay and MS-SNTP testing
tools.
* Wed Apr 17 2024 Martin Hauke <mardnh@gmx.de>
- Updat to version 1.2.3
* Change mode6 alignment to four, which may break some
compatibility with classic NTP.
* Seccomp should now also yield invalid syscall names when dying.
* Make ntpq stop dropping output timestamp leading zeroes.
* Update documents in quite a few places.
* Reset some stats hourly, even when not logged into files.
* Add error logging, and stats for ms-sntp.
* Add spacing between multiple peer views in ntpq.
* We think we have fixed ms-sntp but we can’t test it.
* ntpd and ntpq both treat SHA-1 as an alias for SHA1 NIST
uses SHA-1. The crypto package from OpenSSL uses SHA1.
* The default crypto type for ntpq is now AES. RFC 8573
deprecated MD5.
* There are now log files with hourly statistics for NTS and
NTS-KE traffic: filegen ntsstats and filegen ntskestats,
* Update ntpsnmpd to use python built-in to get uname information.
* Update license file names for REUSE compliance.
* Fix ntploggps issue where count_used_satellites checked before
it is initialized.
* Print out OpenSSL version at configure time.
* Enable debug symbols by default, with only an option to disable.
* Add support for ecdhcurves list.
* Fix ntpdig crash when using 2.ntp.pool.org with a host without
IPv6 support.
* Do not install libaes_siv test anymore.
* Add update option to buildprep.
* ntpdig shows packet delay in JSON output.
* Thu Feb 22 2024 Dominique Leuenberger <dimstar@opensuse.org>
- Use %patch -P N instead of deprecated %patchN.
* Sat Nov 25 2023 Dirk Müller <dmueller@suse.com>
- update to 1.2.2a (bsc#1214024, CVE-2023-4012):
* Fix a crash in ntpd if NTS is disabled and an NTS-enabled
client request (mode 3) is received. (CVE-2023-4012)
* Mon Feb 06 2023 Marcus Meissner <meissner@suse.com>
- Updated to version 1.2.2
- Restore/cleanup NTPv1 support
- ntpq sysstats now shows NTPv1 traffic.
- NTPv1 counter added to sysstats log file.
- NTS supports partial wildcards, for example *.example.com
- Work on documentation, ntpdate, ntpheat, ntploggpg, ntpq's sysstats, ntpviz, and seccomp.
- NTP auth no longer breaks on NULs.
- The NTS server now saves 10 days worth of cookie keys. This will allow clients that only poll once a day to use NTS without using NTS-KE to keep cookies up to date.
- rawstats now logs dropped packets and their BOGON code
- Only one per request to avoid DoSing the log file
- This lets you see packets that take too long.
- Add 4 or 6 to DNS/NTS RefID tags to indicate that the DNS or NTS-KE has succeeded but NTP has not worked yet.
- Build improvements
- Restore Python 2.6 support
- Restore LibreSSL support
- Add support for OpenSSL 3.0
- Fix hash validation in ntpleapfetch again.
- FreeBSD now gets nanosecond resolution on receive time stamps.
- added ntpsec.keyring
* Tue Oct 12 2021 Johannes Segitz <jsegitz@suse.com>
- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
* harden_ntp-wait.service.patch
* harden_ntpd.service.patch
* harden_ntplogtemp.service.patch
* harden_ntpviz-daily.service.patch
* harden_ntpviz-weekly.service.patch
* Wed Jun 09 2021 Martin Hauke <mardnh@gmx.de>
- Update to version 1.2.1
* Update ntpkeygen/keygone to properly filter # characters.
Fix security issue: CVE-2021-22212
* Add dextral peers mode in ntpq and ntpmon.
* Drop NTPv1 as the support was not RFC compliant, maybe v2
except mode 6 next.
* Fix argument P for ntpd parsing fixed and ntpdate improvements.
* Fix crash for raw ntpq readvar.
* Add processor usage to NTS-KE logging except on NetBSD.
* Remove --build-epoch and replace it with arbitrary
- -build-desc text. Passing
'--build-desc=$(date -u +%Y-%m-%dT%H:%M:%Sz)' restores the
previous default extended version.
* The build epoch has been replaced with a hardcoded timestamp
which will be manually updated every nine years or so
(approx 512w). This makes the binaries reproducible by default.
* Compare versions of ntp.ntpc and libntpc printing a warning
if mismatched. Fix libntpc install path if using it.
* Reduce maxclocks default to 5 to reduce the NTP pool load.
* Print LIBDIR during ./waf configure.
* Add documentation, new GPG key, and other cleanups.
- Update to version 1.2.0
* The minor version bump is to indicate official official support
of RFC8915 "Network Time Security for the Network Time
Protocol" which was released 2020-09-30.
* NTS-KE client now defaults to port 4460.
* NTS-KE server now listens on port 4460. (Listening on port 123
has been removed.)
* The shebang of installed Python scripts can now be customized
with: waf configure --pyshebang="…" This has multiple uses, but
one example is for distros (like CentOS 8 or Ubuntu 20.04) with
no python executable: python3 waf configure
- -pyshebang="/usr/bin/env python3"
* NTP clients now use a shared library with Python instead of an
extension.
* Add flakiness option to ntpq and fixed limit=1 in mrulist.
* Fixed a minor formatting issue in rate page.
- Create subpackages for libntpc and ntpsec-devel
* Fri Jan 08 2021 Martin Hauke <mardnh@gmx.de>
- Let system-user-ntp handle the user/group generation
* Fri May 29 2020 Christophe Giboudeaux <christophe@krop.fr>
- Update to 1.1.9. See the NEWS.adoc file for the full list
of changes.
* Correctly parse ntpq :config output on Python 3 and check
return MACs.
* Add AES and other algorithm support to ntpq and ntpdig,
from OpenSSL.
* Remove support for NetInfo.
* The default restrictions now start with noquery and limited
to reduce the opportunities for being used for DDoS-ing.
* NTS client now requires ALPN on TLSv1.3.
* asciidoctor (1.5.8 or newer) is now supported and is the
preferred AsciiDoc processor.
/usr/bin/ntpdig /usr/bin/ntpkeygen /usr/bin/ntploggps /usr/bin/ntplogtemp /usr/bin/ntpmon /usr/bin/ntpq /usr/bin/ntpsnmpd /usr/bin/ntpsweep /usr/bin/ntptrace /usr/bin/ntpviz /usr/bin/ntpwait /usr/lib/systemd/system/ntp-wait.service /usr/lib/systemd/system/ntplogtemp.service /usr/lib/systemd/system/ntplogtemp.timer /usr/lib/systemd/system/ntpviz-daily.service /usr/lib/systemd/system/ntpviz-daily.timer /usr/lib/systemd/system/ntpviz-weekly.service /usr/lib/systemd/system/ntpviz-weekly.timer /usr/sbin/rcntp-wait /usr/sbin/rcntplogtemp /usr/sbin/rcntpviz-daily /usr/sbin/rcntpviz-weekly /usr/share/man/man1/ntpdig.1.gz /usr/share/man/man1/ntploggps.1.gz /usr/share/man/man1/ntplogtemp.1.gz /usr/share/man/man1/ntpmon.1.gz /usr/share/man/man1/ntpq.1.gz /usr/share/man/man1/ntpsweep.1.gz /usr/share/man/man1/ntptrace.1.gz /usr/share/man/man1/ntpviz.1.gz /usr/share/man/man8/ntpkeygen.8.gz /usr/share/man/man8/ntpsnmpd.8.gz /usr/share/man/man8/ntpwait.8.gz
Generated by rpm2html 1.8.1
Fabrice Bellet, Fri Aug 7 23:55:33 2026