MFH

Sponsored by:	The FreeBSD Foundation

Makefile

@@ -206,7 +206,7 @@ _TARGET_ARCH?=	${MACHINE_ARCH}
 # The user can define ALWAYS_CHECK_MAKE to have this check performed
 # for all targets.
 #
-.if defined(ALWAYS_CHECK_MAKE)
+.if defined(ALWAYS_CHECK_MAKE) || !defined(.PARSEDIR)
 ${TGTS}: upgrade_checks
 .else
 buildworld: upgrade_checks

Makefile.inc1

@@ -587,10 +587,9 @@ _worldtmp: .PHONY
 .endif
 .else
 	rm -rf ${WORLDTMP}/legacy/usr/include
-#	XXX - These three can depend on any header file.
+#	XXX - These can depend on any header file.
-	rm -f ${OBJTREE}${.CURDIR}/usr.bin/kdump/ioctl.c
+	rm -f ${OBJTREE}${.CURDIR}/lib/libsysdecode/ioctl.c
 	rm -f ${OBJTREE}${.CURDIR}/usr.bin/kdump/kdump_subr.c
-	rm -f ${OBJTREE}${.CURDIR}/usr.bin/truss/ioctl.c
 .endif
 .for _dir in \
     lib usr legacy/bin legacy/usr
@@ -1547,11 +1546,13 @@ _vtfontcvt=	usr.bin/vtfontcvt
 _sed=		usr.bin/sed
 .endif
 
-.if ${BOOTSTRAPPING} < 1000002
+.if ${BOOTSTRAPPING} < 1000033
 _libopenbsd=	lib/libopenbsd
 _m4=		usr.bin/m4
+_lex=		usr.bin/lex
 
 ${_bt}-usr.bin/m4: ${_bt}-lib/libopenbsd
+${_bt}-usr.bin/lex: ${_bt}-usr.bin/m4
 .endif
 
 .if ${BOOTSTRAPPING} < 1000026
@@ -1565,12 +1566,6 @@ ${_bt}-usr.sbin/nmtree: ${_bt}-lib/libnetbsd
 _cat=		bin/cat
 .endif
 
-.if ${BOOTSTRAPPING} < 1000033
-_lex=		usr.bin/lex
-
-${_bt}-usr.bin/lex: ${_bt}-usr.bin/m4
-.endif
-
 # r277259 crunchide: Correct 64-bit section header offset
 # r281674 crunchide: always include both 32- and 64-bit ELF support
 # r285986 crunchen: use STRIPBIN rather than STRIP

bin/sh/eval.c

@@ -496,10 +496,12 @@ exphere(union node *redir, struct arglist *fn)
 	struct jmploc *savehandler;
 	struct localvar *savelocalvars;
 	int need_longjmp = 0;
+	unsigned char saveoptreset;
 
 	redir->nhere.expdoc = "";
 	savelocalvars = localvars;
 	localvars = NULL;
+	saveoptreset = shellparam.reset;
 	forcelocal++;
 	savehandler = handler;
 	if (setjmp(jmploc.loc))
@@ -514,6 +516,7 @@ exphere(union node *redir, struct arglist *fn)
 	forcelocal--;
 	poplocalvars();
 	localvars = savelocalvars;
+	shellparam.reset = saveoptreset;
 	if (need_longjmp)
 		longjmp(handler->loc, 1);
 	INTON;
@@ -647,6 +650,7 @@ evalbackcmd(union node *n, struct backcmd *result)
 	struct jmploc jmploc;
 	struct jmploc *savehandler;
 	struct localvar *savelocalvars;
+	unsigned char saveoptreset;
 
 	result->fd = -1;
 	result->buf = NULL;
@@ -661,6 +665,7 @@ evalbackcmd(union node *n, struct backcmd *result)
 	if (is_valid_fast_cmdsubst(n)) {
 		savelocalvars = localvars;
 		localvars = NULL;
+		saveoptreset = shellparam.reset;
 		forcelocal++;
 		savehandler = handler;
 		if (setjmp(jmploc.loc)) {
@@ -671,6 +676,7 @@ evalbackcmd(union node *n, struct backcmd *result)
 				forcelocal--;
 				poplocalvars();
 				localvars = savelocalvars;
+				shellparam.reset = saveoptreset;
 				longjmp(handler->loc, 1);
 			}
 		} else {
@@ -681,6 +687,7 @@ evalbackcmd(union node *n, struct backcmd *result)
 		forcelocal--;
 		poplocalvars();
 		localvars = savelocalvars;
+		shellparam.reset = saveoptreset;
 	} else {
 		if (pipe(pip) < 0)
 			error("Pipe call failed: %s", strerror(errno));
@@ -1032,12 +1039,12 @@ evalcommand(union node *cmd, int flags, struct backcmd *backcmd)
 		reffunc(cmdentry.u.func);
 		savehandler = handler;
 		if (setjmp(jmploc.loc)) {
-			freeparam(&shellparam);
-			shellparam = saveparam;
 			popredir();
 			unreffunc(cmdentry.u.func);
 			poplocalvars();
 			localvars = savelocalvars;
+			freeparam(&shellparam);
+			shellparam = saveparam;
 			funcnest--;
 			handler = savehandler;
 			longjmp(handler->loc, 1);

bin/sh/expand.c

@@ -951,8 +951,8 @@ varvalue(const char *name, int quoted, int subtype, int flag,
 	case '-':
 		p = buf;
 		for (i = 0 ; i < NSHORTOPTS ; i++) {
-			if (optlist[i].val)
+			if (optval[i])
-				*p++ = optlist[i].letter;
+				*p++ = optletter[i];
 		}
 		*p = '\0';
 		strtodest(buf, flag, subtype, quoted, dst);

bin/sh/options.c

@@ -91,7 +91,7 @@ procargs(int argc, char **argv)
 	if (argc > 0)
 		argptr++;
 	for (i = 0; i < NOPTS; i++)
-		optlist[i].val = 2;
+		optval[i] = 2;
 	privileged = (getuid() != geteuid() || getgid() != getegid());
 	options(1);
 	if (*argptr == NULL && minusc == NULL)
@@ -104,8 +104,8 @@ procargs(int argc, char **argv)
 	if (mflag == 2)
 		mflag = iflag;
 	for (i = 0; i < NOPTS; i++)
-		if (optlist[i].val == 2)
+		if (optval[i] == 2)
-			optlist[i].val = 0;
+			optval[i] = 0;
 	arg0 = argv[0];
 	if (sflag == 0 && minusc == NULL) {
 		scriptname = *argptr++;
@@ -250,26 +250,29 @@ static void
 minus_o(char *name, int val)
 {
 	int i;
+	const unsigned char *on;
+	size_t len;
 
 	if (name == NULL) {
 		if (val) {
 			/* "Pretty" output. */
 			out1str("Current option settings\n");
-			for (i = 0; i < NOPTS; i++)
+			for (i = 0, on = optname; i < NOPTS; i++, on += *on + 1)
-				out1fmt("%-16s%s\n", optlist[i].name,
+				out1fmt("%-16.*s%s\n", *on, on + 1,
-					optlist[i].val ? "on" : "off");
+					optval[i] ? "on" : "off");
 		} else {
 			/* Output suitable for re-input to shell. */
-			for (i = 0; i < NOPTS; i++)
+			for (i = 0, on = optname; i < NOPTS; i++, on += *on + 1)
-				out1fmt("%s %co %s%s",
+				out1fmt("%s %co %.*s%s",
 				    i % 6 == 0 ? "set" : "",
-				    optlist[i].val ? '-' : '+',
+				    optval[i] ? '-' : '+',
-				    optlist[i].name,
+				    *on, on + 1,
 				    i % 6 == 5 || i == NOPTS - 1 ? "\n" : "");
 		}
 	} else {
-		for (i = 0; i < NOPTS; i++)
+		len = strlen(name);
-			if (equal(name, optlist[i].name)) {
+		for (i = 0, on = optname; i < NOPTS; i++, on += *on + 1)
+			if (*on == len && memcmp(on + 1, name, len) == 0) {
 				setoptionbyindex(i, val);
 				return;
 			}
@@ -281,18 +284,18 @@ minus_o(char *name, int val)
 static void
 setoptionbyindex(int idx, int val)
 {
-	if (optlist[idx].letter == 'p' && !val && privileged) {
+	if (optletter[idx] == 'p' && !val && privileged) {
 		if (setgid(getgid()) == -1)
 			error("setgid");
 		if (setuid(getuid()) == -1)
 			error("setuid");
 	}
-	optlist[idx].val = val;
+	optval[idx] = val;
 	if (val) {
 		/* #%$ hack for ksh semantics */
-		if (optlist[idx].letter == 'V')
+		if (optletter[idx] == 'V')
 			Eflag = 0;
-		else if (optlist[idx].letter == 'E')
+		else if (optletter[idx] == 'E')
 			Vflag = 0;
 	}
 }
@@ -303,7 +306,7 @@ setoption(int flag, int val)
 	int i;
 
 	for (i = 0; i < NSHORTOPTS; i++)
-		if (optlist[i].letter == flag) {
+		if (optletter[i] == flag) {
 			setoptionbyindex(i, val);
 			return;
 		}

bin/sh/options.h

@@ -45,60 +45,57 @@ struct shparam {
 
 
 
-#define eflag optlist[0].val
+#define eflag optval[0]
-#define fflag optlist[1].val
+#define fflag optval[1]
-#define Iflag optlist[2].val
+#define Iflag optval[2]
-#define iflag optlist[3].val
+#define iflag optval[3]
-#define mflag optlist[4].val
+#define mflag optval[4]
-#define nflag optlist[5].val
+#define nflag optval[5]
-#define sflag optlist[6].val
+#define sflag optval[6]
-#define xflag optlist[7].val
+#define xflag optval[7]
-#define vflag optlist[8].val
+#define vflag optval[8]
-#define Vflag optlist[9].val
+#define Vflag optval[9]
-#define	Eflag optlist[10].val
+#define	Eflag optval[10]
-#define	Cflag optlist[11].val
+#define	Cflag optval[11]
-#define	aflag optlist[12].val
+#define	aflag optval[12]
-#define	bflag optlist[13].val
+#define	bflag optval[13]
-#define	uflag optlist[14].val
+#define	uflag optval[14]
-#define	privileged optlist[15].val
+#define	privileged optval[15]
-#define	Tflag optlist[16].val
+#define	Tflag optval[16]
-#define	Pflag optlist[17].val
+#define	Pflag optval[17]
-#define	hflag optlist[18].val
+#define	hflag optval[18]
-#define	nologflag optlist[19].val
+#define	nologflag optval[19]
 
 #define NSHORTOPTS	19
 #define NOPTS		20
 
-struct optent {
+extern char optval[NOPTS];
-	const char *name;
+extern const char optletter[NSHORTOPTS];
-	const char letter;
-	char val;
-};
-
-extern struct optent optlist[NOPTS];
 #ifdef DEFINE_OPTIONS
-struct optent optlist[NOPTS] = {
+char optval[NOPTS];
-	{ "errexit",	'e',	0 },
+const char optletter[NSHORTOPTS] = "efIimnsxvVECabupTPh";
-	{ "noglob",	'f',	0 },
+static const unsigned char optname[] =
-	{ "ignoreeof",	'I',	0 },
+	"\007errexit"
-	{ "interactive",'i',	0 },
+	"\006noglob"
-	{ "monitor",	'm',	0 },
+	"\011ignoreeof"
-	{ "noexec",	'n',	0 },
+	"\013interactive"
-	{ "stdin",	's',	0 },
+	"\007monitor"
-	{ "xtrace",	'x',	0 },
+	"\006noexec"
-	{ "verbose",	'v',	0 },
+	"\005stdin"
-	{ "vi",		'V',	0 },
+	"\006xtrace"
-	{ "emacs",	'E',	0 },
+	"\007verbose"
-	{ "noclobber",	'C',	0 },
+	"\002vi"
-	{ "allexport",	'a',	0 },
+	"\005emacs"
-	{ "notify",	'b',	0 },
+	"\011noclobber"
-	{ "nounset",	'u',	0 },
+	"\011allexport"
-	{ "privileged",	'p',	0 },
+	"\006notify"
-	{ "trapsasync",	'T',	0 },
+	"\007nounset"
-	{ "physical",	'P',	0 },
+	"\012privileged"
-	{ "trackall",	'h',	0 },
+	"\012trapsasync"
-	{ "nolog",	'\0',	0 },
+	"\010physical"
-};
+	"\010trackall"
+	"\005nolog"
+;
 #endif
 
 

bin/sh/tests/builtins/Makefile

@@ -48,6 +48,7 @@ FILES+=		cd5.0
 FILES+=		cd6.0
 FILES+=		cd7.0
 FILES+=		cd8.0
+FILES+=		cd9.0 cd9.0.stdout
 FILES+=		command1.0
 FILES+=		command2.0
 FILES+=		command3.0
@@ -95,6 +96,7 @@ FILES+=		getopts6.0
 FILES+=		getopts7.0
 FILES+=		getopts8.0 getopts8.0.stdout
 FILES+=		getopts9.0 getopts9.0.stdout
+FILES+=		getopts10.0
 FILES+=		hash1.0 hash1.0.stdout
 FILES+=		hash2.0 hash2.0.stdout
 FILES+=		hash3.0 hash3.0.stdout
@@ -109,6 +111,7 @@ FILES+=		local1.0
 FILES+=		local2.0
 FILES+=		local3.0
 FILES+=		local4.0
+FILES+=		local5.0
 .if ${MK_NLS} != "no"
 FILES+=		locale1.0
 .endif

bin/sh/tests/builtins/cd9.0

@@ -0,0 +1,8 @@
+# $FreeBSD$
+
+cd /dev
+cd /bin
+cd - >/dev/null
+pwd
+cd - >/dev/null
+pwd

bin/sh/tests/builtins/cd9.0.stdout

@@ -0,0 +1,2 @@
+/dev
+/bin

bin/sh/tests/builtins/getopts10.0

@@ -0,0 +1,11 @@
+# $FreeBSD$
+
+set -- -x arg
+opt=not
+getopts x opt
+r1=$? OPTIND1=$OPTIND opt1=$opt
+: $(: $((OPTIND = 1)))
+getopts x opt
+r2=$? OPTIND2=$OPTIND
+[ "$r1" = 0 ] && [ "$OPTIND1" = 2 ] && [ "$opt1" = x ] && [ "$r2" != 0 ] &&
+	[ "$OPTIND2" = 2 ]

bin/sh/tests/builtins/local5.0

@@ -0,0 +1,15 @@
+# $FreeBSD$
+
+f() {
+	local PATH IFS elem
+	IFS=:
+	for elem in ''$PATH''; do
+		PATH=/var/empty/$elem:$PATH
+	done
+	ls -d / >/dev/null
+}
+
+p1=$(command -v ls)
+f
+p2=$(command -v ls)
+[ "$p1" = "$p2" ]

bin/sh/var.c

@@ -754,8 +754,8 @@ mklocal(char *name)
 	INTOFF;
 	lvp = ckmalloc(sizeof (struct localvar));
 	if (name[0] == '-' && name[1] == '\0') {
-		lvp->text = ckmalloc(sizeof optlist);
+		lvp->text = ckmalloc(sizeof optval);
-		memcpy(lvp->text, optlist, sizeof optlist);
+		memcpy(lvp->text, optval, sizeof optval);
 		vp = NULL;
 	} else {
 		vp = find_var(name, &vpp, NULL);
@@ -791,22 +791,33 @@ poplocalvars(void)
 {
 	struct localvar *lvp;
 	struct var *vp;
+	int islocalevar;
 
 	INTOFF;
 	while ((lvp = localvars) != NULL) {
 		localvars = lvp->next;
 		vp = lvp->vp;
 		if (vp == NULL) {	/* $- saved */
-			memcpy(optlist, lvp->text, sizeof optlist);
+			memcpy(optval, lvp->text, sizeof optval);
 			ckfree(lvp->text);
 			optschanged();
 		} else if ((lvp->flags & (VUNSET|VSTRFIXED)) == VUNSET) {
 			(void)unsetvar(vp->text);
 		} else {
+			islocalevar = (vp->flags | lvp->flags) & VEXPORT &&
+			    localevar(lvp->text);
 			if ((vp->flags & VTEXTFIXED) == 0)
 				ckfree(vp->text);
 			vp->flags = lvp->flags;
 			vp->text = lvp->text;
+			if (vp->func)
+				(*vp->func)(vp->text + vp->name_len + 1);
+			if (islocalevar) {
+				change_env(vp->text, vp->flags & VEXPORT &&
+				    (vp->flags & VUNSET) == 0);
+				setlocale(LC_ALL, "");
+				updatecharset();
+			}
 		}
 		ckfree(lvp);
 	}

contrib/hyperv/tools/hv_kvp_daemon.c

@@ -1437,7 +1437,7 @@ main(int argc, char *argv[])
 
 
 	for (;;) {
-		r = poll (hv_kvp_poll_fd, 1, 100);
+		r = poll (hv_kvp_poll_fd, 1, INFTIM);
 
 		KVP_LOG(LOG_DEBUG, "poll returned r = %d, revent = 0x%x\n",
 		    r, hv_kvp_poll_fd[0].revents);

contrib/ntp/ChangeLog

@@ -1,4 +1,61 @@
 ---
+(4.2.8p5) 2016/01/07 Released by Harlan Stenn <stenn@ntp.org>
+
+* [Sec 2956] small-step/big-step.  Close the panic gate earlier.  HStenn.
+* CID 1339955: Free allocated memory in caljulian test.  HStenn.
+* CID 1339962: Explicitly initialize variable in caljulian test.  HStenn.
+* CID 1341527: Quiet a CHECKED_RETURN in sntp/tests/t-log.c.  HStenn.
+* CID 1341533: Missing assertion in sntp/tests/t-log.c.  HStenn.
+* CID 1341534: Resource leak in tests/ntpd/t-ntp_signd.c.  HStenn.
+* CID 1341535: Resource leak in tests/ntpd/t-ntp_signd.c.  HStenn.
+* CID 1341536: Resource leak in tests/ntpd/t-ntp_signd.c.  HStenn.
+* CID 1341537: Resource leak in tests/ntpd/t-ntp_signd.c.  HStenn.
+* CID 1341538: Memory leak in tests/ntpd/ntp_prio_q.c:262.  HStenn.
+* CID 1341677: Nits in sntp/tests/keyFile.c.  HStenn.
+* CID 1341678: Nits in sntp/tests/keyFile.c.  HStenn.
+* CID 1341679: Nits in sntp/tests/keyFile.c.  HStenn.
+* CID 1341680: Nits in sntp/tests/keyFile.c.  HStenn.
+* CID 1341681: Nits in sntp/tests/keyFile.c.  HStenn.
+* CID 1341682: Nit in libntp/authreadkeys.c.  HStenn.
+* CID 1341684: Nit in tests/ntpd/t-ntp_signd.c.  HStenn.
+* [Bug 2829] Look at pipe_fds in ntpd.c  (did so. perlinger@ntp.org)
+* [Bug 2887] stratum -1 config results as showing value 99
+  - fudge stratum should only accept values [0..16]. perlinger@ntp.org
+* [Bug 2932] Update leapsecond file info in miscopt.html.  CWoodbury, HStenn.
+* [Bug 2934] tests/ntpd/t-ntp_scanner.c has a magic constant wired in.  HMurray
+* [Bug 2944] errno is not preserved properly in ntpdate after sendto call.
+  - applied patch by Christos Zoulas.  perlinger@ntp.org
+* [Bug 2952] Symmetric active/passive mode is broken.  HStenn.
+* [Bug 2954] Version 4.2.8p4 crashes on startup with sig fault
+  - fixed data race conditions in threaded DNS worker. perlinger@ntp.org
+  - limit threading warm-up to linux; FreeBSD bombs on it. perlinger@ntp.org
+* [Bug 2957] 'unsigned int' vs 'size_t' format clash. perlinger@ntp.org
+  - accept key file only if there are no parsing errors
+  - fixed size_t/u_int format clash
+  - fixed wrong use of 'strlcpy'
+* [Bug 2958] ntpq: fatal error messages need a final newline. Craig Leres.
+* [Bug 2962] truncation of size_t/ptrdiff_t on 64bit targets. perlinger@ntp.org
+  - fixed several other warnings (cast-alignment, missing const, missing prototypes)
+  - promote use of 'size_t' for values that express a size
+  - use ptr-to-const for read-only arguments
+  - make sure SOCKET values are not truncated (win32-specific)
+  - format string fixes
+* [Bug 2965] Local clock didn't work since 4.2.8p4.  Martin Burnicki.
+* [Bug 2967] ntpdate command suffers an assertion failure
+  - fixed ntp_rfc2553.c to return proper address length. perlinger@ntp.org
+* [Bug 2969]  Seg fault from ntpq/mrulist when looking at server with
+              lots of clients. perlinger@ntp.org
+* [Bug 2971] ntpq bails on ^C: select fails: Interrupted system call
+  - changed stacked/nested handling of CTRL-C. perlinger@ntp.org
+* Unity cleanup for FreeBSD-6.4.  Harlan Stenn.
+* Unity test cleanup.  Harlan Stenn.
+* Libevent autoconf pthread fixes for FreeBSD-10.  Harlan Stenn.
+* Header cleanup in tests/sandbox/uglydate.c.  Harlan Stenn.
+* Header cleanup in tests/libntp/sfptostr.c.  Harlan Stenn.
+* Quiet a warning from clang.  Harlan Stenn.
+* Update the NEWS file.  Harlan Stenn.
+* Update scripts/calc_tickadj/Makefile.am.  Harlan Stenn.
+---
 (4.2.8p4) 2015/10/21 Released by Harlan Stenn <stenn@ntp.org>
 (4.2.8p4-RC1) 2015/10/06 Released by Harlan Stenn <stenn@ntp.org>
 

contrib/ntp/NEWS

@@ -1,7 +1,108 @@
+---
+
+NTP 4.2.8p5
+
+Focus: Security, Bug fixes, enhancements.
+
+Severity: MEDIUM
+
+In addition to bug fixes and enhancements, this release fixes the
+following medium-severity vulnerability:
+
+* Small-step/big-step.  Close the panic gate earlier.
+    References: Sec 2956, CVE-2015-5300
+    Affects: All ntp-4 releases up to, but not including 4.2.8p5, and
+	4.3.0 up to, but not including 4.3.78
+    CVSS3: (AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:L) Base Score: 4.0, MEDIUM
+    Summary: If ntpd is always started with the -g option, which is
+	common and against long-standing recommendation, and if at the
+	moment ntpd is restarted an attacker can immediately respond to
+	enough requests from enough sources trusted by the target, which
+	is difficult and not common, there is a window of opportunity
+	where the attacker can cause ntpd to set the time to an
+	arbitrary value. Similarly, if an attacker is able to respond
+	to enough requests from enough sources trusted by the target,
+	the attacker can cause ntpd to abort and restart, at which
+	point it can tell the target to set the time to an arbitrary
+	value if and only if ntpd was re-started against long-standing
+	recommendation with the -g flag, or if ntpd was not given the
+	-g flag, the attacker can move the target system's time by at
+	most 900 seconds' time per attack.
+    Mitigation:
+	Configure ntpd to get time from multiple sources.
+	Upgrade to 4.2.8p5, or later, from the NTP Project Download
+	    Page or the NTP Public Services Project Download Page
+	As we've long documented, only use the -g option to ntpd in
+	    cold-start situations.
+	Monitor your ntpd instances. 
+    Credit: This weakness was discovered by Aanchal Malhotra,
+	Isaac E. Cohen, and Sharon Goldberg at Boston University. 
+
+    NOTE WELL: The -g flag disables the limit check on the panic_gate
+	in ntpd, which is 900 seconds by default. The bug identified by
+	the researchers at Boston University is that the panic_gate
+	check was only re-enabled after the first change to the system
+	clock that was greater than 128 milliseconds, by default. The
+	correct behavior is that the panic_gate check should be
+	re-enabled after any initial time correction.
+
+	If an attacker is able to inject consistent but erroneous time
+	responses to your systems via the network or "over the air",
+	perhaps by spoofing radio, cellphone, or navigation satellite
+	transmissions, they are in a great position to affect your
+	system's clock. There comes a point where your very best
+	defenses include:
+
+	    Configure ntpd to get time from multiple sources.
+	    Monitor your ntpd instances. 
+
+Other fixes:
+
+* Coverity submission process updated from Coverity 5 to Coverity 7.
+  The NTP codebase has been undergoing regular Coverity scans on an
+  ongoing basis since 2006.  As part of our recent upgrade from
+  Coverity 5 to Coverity 7, Coverity identified 16 nits in some of
+  the newly-written Unity test programs.  These were fixed.
+* [Bug 2829] Clean up pipe_fds in ntpd.c  perlinger@ntp.org
+* [Bug 2887] stratum -1 config results as showing value 99
+  - fudge stratum should only accept values [0..16]. perlinger@ntp.org
+* [Bug 2932] Update leapsecond file info in miscopt.html.  CWoodbury, HStenn.
+* [Bug 2934] tests/ntpd/t-ntp_scanner.c has a magic constant wired in.  HMurray
+* [Bug 2944] errno is not preserved properly in ntpdate after sendto call.
+  - applied patch by Christos Zoulas.  perlinger@ntp.org
+* [Bug 2952] Peer associations broken by fix for Bug 2901/CVE-2015-7704.
+* [Bug 2954] Version 4.2.8p4 crashes on startup on some OSes.
+  - fixed data race conditions in threaded DNS worker. perlinger@ntp.org
+  - limit threading warm-up to linux; FreeBSD bombs on it. perlinger@ntp.org
+* [Bug 2957] 'unsigned int' vs 'size_t' format clash. perlinger@ntp.org
+  - accept key file only if there are no parsing errors
+  - fixed size_t/u_int format clash
+  - fixed wrong use of 'strlcpy'
+* [Bug 2958] ntpq: fatal error messages need a final newline. Craig Leres.
+* [Bug 2962] truncation of size_t/ptrdiff_t on 64bit targets. perlinger@ntp.org
+  - fixed several other warnings (cast-alignment, missing const, missing prototypes)
+  - promote use of 'size_t' for values that express a size
+  - use ptr-to-const for read-only arguments
+  - make sure SOCKET values are not truncated (win32-specific)
+  - format string fixes
+* [Bug 2965] Local clock didn't work since 4.2.8p4.  Martin Burnicki.
+* [Bug 2967] ntpdate command suffers an assertion failure
+  - fixed ntp_rfc2553.c to return proper address length. perlinger@ntp.org
+* [Bug 2969]  Seg fault from ntpq/mrulist when looking at server with
+              lots of clients. perlinger@ntp.org
+* [Bug 2971] ntpq bails on ^C: select fails: Interrupted system call
+  - changed stacked/nested handling of CTRL-C. perlinger@ntp.org
+* Unity cleanup for FreeBSD-6.4.  Harlan Stenn.
+* Unity test cleanup.  Harlan Stenn.
+* Libevent autoconf pthread fixes for FreeBSD-10.  Harlan Stenn.
+* Header cleanup in tests/sandbox/uglydate.c.  Harlan Stenn.
+* Header cleanup in tests/libntp/sfptostr.c.  Harlan Stenn.
+* Quiet a warning from clang.  Harlan Stenn.
+
 ---
 NTP 4.2.8p4
 
-Focus: Security, Bug fies, enhancements.
+Focus: Security, Bug fixes, enhancements.
 
 Severity: MEDIUM
 
@@ -339,8 +440,8 @@ Credit: This weakness was discovered by Aleksandar Nikolic of Cisco Talos.
 
 Backward-Incompatible changes:
 * [Bug 2817] Default on Linux is now "rlimit memlock -1".
-While the general default of 32M is still the case, under Linux
+  While the general default of 32M is still the case, under Linux
-the default value has been changed to -1 (do not lock ntpd into
+  the default value has been changed to -1 (do not lock ntpd into
   memory).  A value of 0 means "lock ntpd into memory with whatever
   memory it needs." If your ntp.conf file has an explicit "rlimit memlock"
   value in it, that value will continue to be used.

contrib/ntp/configure

@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for ntp 4.2.8p4.
+# Generated by GNU Autoconf 2.69 for ntp 4.2.8p5.
 #
 # Report bugs to <http://bugs.ntp.org./>.
 #
@@ -590,8 +590,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='ntp'
 PACKAGE_TARNAME='ntp'
-PACKAGE_VERSION='4.2.8p4'
+PACKAGE_VERSION='4.2.8p5'
-PACKAGE_STRING='ntp 4.2.8p4'
+PACKAGE_STRING='ntp 4.2.8p5'
 PACKAGE_BUGREPORT='http://bugs.ntp.org./'
 PACKAGE_URL='http://www.ntp.org./'
 
@@ -1616,7 +1616,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures ntp 4.2.8p4 to adapt to many kinds of systems.
+\`configure' configures ntp 4.2.8p5 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1686,7 +1686,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of ntp 4.2.8p4:";;
+     short | recursive ) echo "Configuration of ntp 4.2.8p5:";;
    esac
   cat <<\_ACEOF
 
@@ -1919,7 +1919,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-ntp configure 4.2.8p4
+ntp configure 4.2.8p5
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -2749,7 +2749,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by ntp $as_me 4.2.8p4, which was
+It was created by ntp $as_me 4.2.8p5, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
@@ -3750,7 +3750,7 @@ fi
 
 # Define the identity of the package.
  PACKAGE='ntp'
- VERSION='4.2.8p4'
+ VERSION='4.2.8p5'
 
 
 cat >>confdefs.h <<_ACEOF
@@ -20018,9 +20018,10 @@ $as_echo "$as_me: Using the installed libevent" >&6;}
 	    # LDADD_LIBEVENT=`$PKG_CONFIG --libs libevent | sed 's:-levent::'`
 	    # So now we dance...
 	    LDADD_LIBEVENT=
-	    for i in `$PKG_CONFIG --libs libevent`
+	    for i in `$PKG_CONFIG --libs libevent` `$PKG_CONFIG --cflags-only-other libevent_pthreads`
 	    do
 		case "$i" in
+		 -D*) ;;
 		 -levent*) ;;
 		 *) case "$LDADD_LIBEVENT" in
 		     '') LDADD_LIBEVENT="$i" ;;
@@ -37035,8 +37036,9 @@ $as_echo "$ntp_ept" >&6; }
 $as_echo_n "checking if we can run test-ntp_restrict... " >&6; }
 ntp_test_ntp_restrict="no"
 case "$ntp_ept:$cross:$host" in
+ no:0:*-*-freebsd6.4) ;;
+ no:0:*-*-hpux11.23*) ;;
  no:0:*-*-solaris*) ;;
- no:0:*-*-hpux-11.23*) ;;
  *) ntp_test_ntp_restrict="yes" ;;
 esac
 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ntp_test_ntp_restrict" >&5
@@ -37054,6 +37056,7 @@ fi
 $as_echo_n "checking if we can run test-ntp_scanner... " >&6; }
 ntp_test_ntp_scanner="no"
 case "$ntp_ept:$cross:$host" in
+ no:0:*-*-freebsd6.4) ;;
  no:0:*-*-solaris*) ;;
  *) ntp_test_ntp_scanner="yes" ;;
 esac
@@ -37072,6 +37075,7 @@ fi
 $as_echo_n "checking if we can run test-ntp_signd... " >&6; }
 ntp_test_ntp_signd="no"
 case "$ntp_ept:$cross:$host" in
+ no:0:*-*-freebsd6.4) ;;
  no:0:*-*-solaris*) ;;
  *) ntp_test_ntp_signd="yes" ;;
 esac
@@ -37836,7 +37840,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by ntp $as_me 4.2.8p4, which was
+This file was extended by ntp $as_me 4.2.8p5, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -37903,7 +37907,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-ntp config.status 4.2.8p4
+ntp config.status 4.2.8p5
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 

contrib/ntp/html/miscopt.html

@@ -3,7 +3,7 @@
 <head>
 <meta http-equiv="content-type" content="text/html;charset=iso-8859-1">
 <title>Miscellaneous Commands and Options</title>
-<!-- Changed by: Harlan Stenn, 29-Jun-2015 -->
+<!-- Changed by: Harlan Stenn, 17-Nov-2015 -->
 <link href="scripts/style.css" type="text/css" rel="stylesheet">
 </head>
 <body>
@@ -11,7 +11,7 @@
 <img src="pic/boom3.gif" alt="gif" align="left"><a href="http://www.eecis.udel.edu/~mills/pictures.html">from <i>Pogo</i>, Walt Kelly</a>
 <p>We have three, now looking for more.</p>
 <p>Last update:
-  <!-- #BeginDate format:En2m -->23-Sep-2015  10:20<!-- #EndDate -->
+  <!-- #BeginDate format:En2m -->17-Nov-2015  11:06<!-- #EndDate -->
     UTC</p>
 <br clear="left">
 <h4>Related Links</h4>
@@ -57,7 +57,7 @@
   <dt id="interface"><tt>interface [listen | ignore | drop] [all | ipv4 | ipv6 | wildcard | <i>name</i> | <i>address</i>[/<i>prefixlen</i>]]</tt></dt>
   <dd>This command controls which network addresses <tt>ntpd</tt> opens, and whether input is dropped without processing. The first parameter determines the action for addresses which match the second parameter. That parameter specifies a class of addresses, or a specific interface name, or an address. In the address case, <tt><i>prefixlen</i></tt> determines how many bits must match for this rule to apply. <tt>ignore</tt> prevents opening matching addresses, <tt>drop</tt> causes <tt>ntpd</tt> to open the address and drop all received packets without examination. Multiple <tt>interface</tt> commands can be used. The last rule which matches a particular address determines the action for it. <tt>interface</tt> commands are disabled if any <a href="ntpd.html#--interface"><tt>-I</tt></a>, <a href="ntpd.html#--interface"><tt>--interface</tt></a>, <a href="ntpd.html#--novirtualips"><tt>-L</tt></a>, or <a href="ntpd.html#--novirtualips"><tt>--novirtualips</tt></a> command-line options are used.  If none of those options are used and no <tt>interface</tt> actions are specified in the configuration file, all available network addresses are opened. The <tt>nic</tt> command is an alias for <tt>interface</tt>.</dd>
   <dt id="leapfile"><tt>leapfile <i>leapfile</i></tt></dt>
-  <dd>This command loads the NIST leapseconds file and initializes the leapsecond values for the next leapsecond time, expiration time and TAI offset. The file can be obtained directly from NIST national time servers using <tt>ftp</tt> as the ASCII file <tt>pub/leap-seconds</tt>.</dd>
+  <dd>This command loads the IERS leapseconds file and initializes the leapsecond values for the next leapsecond time, expiration time and TAI offset. The file can be obtained directly from the IERS at <a href="https://hpiers.obspm.fr/iers/bul/bulc/ntp/leap-seconds.list">https://hpiers.obspm.fr/iers/bul/bulc/ntp/leap-seconds.list</a> or <a href="ftp://hpiers.obspm.fr/iers/bul/bulc/ntp/leap-seconds.list">ftp://hpiers.obspm.fr/iers/bul/bulc/ntp/leap-seconds.list</a>.</dd>
   <dd>The <i>leapfile</i> is scanned when <tt>ntpd</tt> processes the <tt>leapfile</tt> directive or when <tt>ntpd</tt> detects that <i>leapfile</i> has changed.  <tt>ntpd</tt> checks once a day to see if the <i>leapfile</i> has changed.</dd>
   <dd>While not strictly a security function, the Autokey protocol provides means to securely retrieve the current or updated leapsecond values from a server.</dd>
   <dt id="leapsmearinterval"><tt>leapsmearinterval <i>seconds</i></tt></dt>

contrib/ntp/include/Makefile.am

@@ -66,6 +66,7 @@ noinst_HEADERS =	\
 	recvbuff.h	\
 	refclock_atom.h	\
 	refidsmear.h	\
+	safecast.h	\
 	ssl_applink.c	\
 	timepps-SCO.h	\
 	timepps-Solaris.h	\

contrib/ntp/include/Makefile.in

@@ -551,6 +551,7 @@ noinst_HEADERS = \
 	recvbuff.h	\
 	refclock_atom.h	\
 	refidsmear.h	\
+	safecast.h	\
 	ssl_applink.c	\
 	timepps-SCO.h	\
 	timepps-Solaris.h	\

contrib/ntp/include/ntp_refclock.h

@@ -220,7 +220,7 @@ extern	void	refclock_buginfo(sockaddr_u *,
 extern	void	refclock_control(sockaddr_u *,
 				 const struct refclockstat *,
 				 struct refclockstat *);
-extern	int	refclock_open	(char *, u_int, u_int);
+extern	int	refclock_open	(const char *, u_int, u_int);
 extern	int	refclock_setup	(int, u_int, u_int);
 extern	void	refclock_timer	(struct peer *);
 extern	void	refclock_transmit(struct peer *);

contrib/ntp/include/ntp_stdlib.h

@@ -65,8 +65,8 @@ typedef void (*ctrl_c_fn)(void);
 /* authkeys.c */
 extern	void	auth_delkeys	(void);
 extern	int	auth_havekey	(keyid_t);
-extern	int	authdecrypt	(keyid_t, u_int32 *, int, int);
+extern	int	authdecrypt	(keyid_t, u_int32 *, size_t, size_t);
-extern	int	authencrypt	(keyid_t, u_int32 *, int);
+extern	size_t	authencrypt	(keyid_t, u_int32 *, size_t);
 extern	int	authhavekey	(keyid_t);
 extern	int	authistrusted	(keyid_t);
 extern	int	authreadkeys	(const char *);
@@ -95,8 +95,8 @@ extern	void	auth_prealloc_symkeys(int);
 extern	int	ymd2yd		(int, int, int);
 
 /* a_md5encrypt.c */
-extern	int	MD5authdecrypt	(int, u_char *, u_int32 *, int, int);
+extern	int	MD5authdecrypt	(int, const u_char *, u_int32 *, size_t, size_t);
-extern	int	MD5authencrypt	(int, u_char *, u_int32 *, int);
+extern	size_t	MD5authencrypt	(int, const u_char *, u_int32 *, size_t);
 extern	void	MD5auth_setkey	(keyid_t, int, const u_char *, size_t);
 extern	u_int32	addr2refid	(sockaddr_u *);
 

contrib/ntp/include/ntp_worker.h

@@ -43,19 +43,22 @@ typedef struct blocking_pipe_header_tag {
 } blocking_pipe_header;
 
 # ifdef WORK_THREAD
-#  ifdef WORK_PIPE
+#  ifdef SYS_WINNT
-typedef pthread_t *	thr_ref;
+typedef struct { HANDLE thnd; } thread_type;
-typedef sem_t *		sem_ref;
+typedef struct { HANDLE shnd; } sema_type;
 #  else
-typedef HANDLE		thr_ref;
+typedef pthread_t	thread_type;
-typedef HANDLE		sem_ref;
+typedef sem_t		sema_type;
 #  endif
+typedef thread_type	*thr_ref;
+typedef sema_type	*sem_ref;
 # endif
 
 /*
  *
  */
-#ifdef WORK_FORK
+#if defined(WORK_FORK)
+
 typedef struct blocking_child_tag {
 	int	reusable;
 	int	pid;
@@ -66,38 +69,59 @@ typedef struct blocking_child_tag {
 	int	resp_write_pipe;
 	int	ispipe;
 } blocking_child;
+
 #elif defined(WORK_THREAD)
+
 typedef struct blocking_child_tag {
 /*
  * blocking workitems and blocking_responses are dynamically-sized
  * one-dimensional arrays of pointers to blocking worker requests and
  * responses.
+ *
+ * IMPORTANT: This structure is shared between threads, and all access
+ * that is not atomic (especially queue operations) must hold the
+ * 'accesslock' semaphore to avoid data races.
+ *
+ * The resource management (thread/semaphore creation/destruction)
+ * functions and functions just testing a handle are safe because these
+ * are only changed by the main thread when no worker is running on the
+ * same data structure.
  */
 	int			reusable;
-	thr_ref			thread_ref;
+	sem_ref			accesslock;	/* shared access lock */
-	u_int			thread_id;
+	thr_ref			thread_ref;	/* thread 'handle' */
-	blocking_pipe_header * volatile * volatile 
+
+	/* the reuest queue */
+	blocking_pipe_header ** volatile
 				workitems;
 	volatile size_t		workitems_alloc;
-	size_t			next_workitem;	 /* parent */
+	size_t			head_workitem;		/* parent */
-	size_t			next_workeritem; /* child */
+	size_t			tail_workitem;		/* child */
-	blocking_pipe_header * volatile * volatile 
+	sem_ref			workitems_pending;	/* signalling */
+
+	/* the response queue */
+	blocking_pipe_header ** volatile
 				responses;
 	volatile size_t		responses_alloc;
-	size_t			next_response;	/* child */
+	size_t			head_response;		/* child */
-	size_t			next_workresp;	/* parent */
+	size_t			tail_response;		/* parent */
+
 	/* event handles / sem_t pointers */
-	/* sem_ref		child_is_blocking; */
-	sem_ref			blocking_req_ready;
 	sem_ref			wake_scheduled_sleep;
+
+	/* some systems use a pipe for notification, others a semaphore.
+	 * Both employ the queue above for the actual data transfer.
+	 */
 #ifdef WORK_PIPE
-	int			resp_read_pipe;	/* parent */
+	int			resp_read_pipe;		/* parent */
-	int			resp_write_pipe;/* child */
+	int			resp_write_pipe;	/* child */
 	int			ispipe;
-	void *			resp_read_ctx;	/* child */
+	void *			resp_read_ctx;		/* child */
 #else
-	sem_ref			blocking_response_ready;
+	sem_ref			responses_pending;	/* signalling */
 #endif
+	sema_type		sem_table[4];
+	thread_type		thr_table[1];
 } blocking_child;
 
 #endif	/* WORK_THREAD */

contrib/ntp/include/ntpd.h

@@ -156,7 +156,7 @@ extern	u_int	sys_tai;
 extern 	int	freq_cnt;
 
 /* ntp_monitor.c */
-#define MON_HASH_SIZE		(1U << mon_hash_bits)
+#define MON_HASH_SIZE		((size_t)1U << mon_hash_bits)
 #define MON_HASH_MASK		(MON_HASH_SIZE - 1)
 #define	MON_HASH(addr)		(sock_hash(addr) & MON_HASH_MASK)
 extern	void	init_mon	(void);
@@ -408,6 +408,7 @@ extern int	hardpps_enable;		/* kernel PPS discipline enabled */
 extern int	ext_enable;		/* external clock enabled */
 extern int	cal_enable;		/* refclock calibrate enable */
 extern int	allow_panic;		/* allow panic correction (-g) */
+extern int	enable_panic_check;	/* Can we check allow_panic's state? */
 extern int	force_step_once;	/* always step time once at startup (-G) */
 extern int	mode_ntpdate;		/* exit on first clock set (-q) */
 extern int	peer_ntpdate;		/* count of ntpdate peers */

contrib/ntp/include/safecast.h

@@ -0,0 +1,34 @@
+#ifndef SAFECAST_H
+#define SAFECAST_H
+
+#include <limits.h>
+static inline int size2int_chk(size_t v)
+{
+	if (v > INT_MAX)
+		abort();
+	return (int)(v);
+}
+
+static inline int size2int_sat(size_t v)
+{
+	return (v > INT_MAX) ? INT_MAX : (int)v;
+}
+
+/* Compilers can emit warning about increased alignment requirements
+ * when casting pointers. The impact is tricky: on machines where
+ * alignment is just a performance issue (x86,x64,...) this might just
+ * cause a performance penalty. On others, an address error can occur
+ * and the process dies...
+ *
+ * Still, there are many cases where the pointer arithmetic and the
+ * buffer alignment make sure this does not happen. OTOH, the compiler
+ * doesn't know this and still emits warnings.
+ *
+ * The following cast macros are going through void pointers to tell
+ * the compiler that there is no alignment requirement to watch.
+ */
+#define UA_PTR(ptype,pval) ((ptype *)(void*)(pval))
+#define UAC_PTR(ptype,pval) ((const ptype *)(const void*)(pval))
+#define UAV_PTR(ptype,pval) ((volatile ptype *)(volatile void*)(pval))
+
+#endif

contrib/ntp/lib/isc/backtrace.c

@@ -278,7 +278,7 @@ isc_backtrace_getsymbol(const void *addr, const char **symbolp,
 		result = ISC_R_NOTFOUND;
 	else {
 		*symbolp = found->symbol;
-		*offsetp = (const char *)addr - (char *)found->addr;
+		*offsetp = (u_long)((const char *)addr - (char *)found->addr);
 	}
 
 	return (result);

contrib/ntp/lib/isc/buffer.c

@@ -406,7 +406,7 @@ isc__buffer_putmem(isc_buffer_t *b, const unsigned char *base,
 
 void
 isc__buffer_putstr(isc_buffer_t *b, const char *source) {
-	unsigned int l;
+	size_t l;
 	unsigned char *cp;
 
 	REQUIRE(ISC_BUFFER_VALID(b));
@@ -421,7 +421,7 @@ isc__buffer_putstr(isc_buffer_t *b, const char *source) {
 
 	cp = isc_buffer_used(b);
 	memcpy(cp, source, l);
-	b->used += l;
+	b->used += (u_int)l; /* checked above - no overflow here */
 }
 
 isc_result_t

contrib/ntp/lib/isc/inet_aton.c

@@ -92,7 +92,7 @@ static char rcsid[] = "$Id: inet_aton.c,v 1.23 2008/12/01 23:47:45 tbox Exp $";
 int
 isc_net_aton(const char *cp, struct in_addr *addr) {
 	unsigned long val;
-	int base, n;
+	int base;
 	unsigned char c;
 	isc_uint8_t parts[4];
 	isc_uint8_t *pp = parts;
@@ -166,8 +166,7 @@ isc_net_aton(const char *cp, struct in_addr *addr) {
 	 * Concoct the address according to
 	 * the number of parts specified.
 	 */
-	n = pp - parts + 1;
+	switch (pp - parts + 1) {
-	switch (n) {
 	case 1:				/* a -- 32 bits */
 		break;
 

contrib/ntp/lib/isc/inet_pton.c

@@ -92,7 +92,7 @@ inet_pton4(const char *src, unsigned char *dst) {
 		const char *pch;
 
 		if ((pch = strchr(digits, ch)) != NULL) {
-			unsigned int newv = *tp * 10 + (pch - digits);
+			size_t newv = *tp * 10 + (pch - digits);
 
 			if (saw_digit && *tp == 0)
 				return (0);
@@ -197,12 +197,12 @@ inet_pton6(const char *src, unsigned char *dst) {
 		 * Since some memmove()'s erroneously fail to handle
 		 * overlapping regions, we'll do the shift by hand.
 		 */
-		const int n = tp - colonp;
+		const size_t n = tp - colonp;
 		int i;
 
 		if (tp == endp)
 			return (0);
-		for (i = 1; i <= n; i++) {
+		for (i = 1; (size_t)i <= n; i++) {
 			endp[- i] = colonp[n - i];
 			colonp[n - i] = 0;
 		}

contrib/ntp/lib/isc/log.c

@@ -1146,7 +1146,7 @@ greatest_version(isc_logchannel_t *channel, int *greatestp) {
 	char *basenam, *digit_end;
 	const char *dirname;
 	int version, greatest = -1;
-	unsigned int basenamelen;
+	size_t basenamelen;
 	isc_dir_t dir;
 	isc_result_t result;
 	char sep = '/';

contrib/ntp/lib/isc/netaddr.c

@@ -159,7 +159,7 @@ isc_netaddr_totext(const isc_netaddr_t *netaddr, isc_buffer_t *target) {
 	if (r == NULL)
 		return (ISC_R_FAILURE);
 
-	alen = strlen(abuf);
+	alen = (unsigned int)strlen(abuf); /* no overflow possible */
 	INSIST(alen < sizeof(abuf));
 
 	zlen = 0;

contrib/ntp/lib/isc/sockaddr.c

@@ -134,7 +134,7 @@ isc_sockaddr_totext(const isc_sockaddr_t *sockaddr, isc_buffer_t *target) {
 		break;
 #ifdef ISC_PLAFORM_HAVESYSUNH
 	case AF_UNIX:
-		plen = strlen(sockaddr->type.sunix.sun_path);
+		plen = (unsigned int)strlen(sockaddr->type.sunix.sun_path);
 		if (plen >= isc_buffer_availablelength(target))
 			return (ISC_R_NOSPACE);
 
@@ -153,7 +153,7 @@ isc_sockaddr_totext(const isc_sockaddr_t *sockaddr, isc_buffer_t *target) {
 		return (ISC_R_FAILURE);
 	}
 
-	plen = strlen(pbuf);
+	plen = (unsigned int)strlen(pbuf);
 	INSIST(plen < sizeof(pbuf));
 
 	isc_netaddr_fromsockaddr(&netaddr, sockaddr);

contrib/ntp/lib/isc/task.c

@@ -329,7 +329,7 @@ ISC_TASKFUNC_SCOPE isc_result_t
 isc__task_create(isc_taskmgr_t *manager0, unsigned int quantum,
 		 isc_task_t **taskp)
 {
-	isc__taskmgr_t *manager = (isc__taskmgr_t *)manager0;
+	isc__taskmgr_t *manager = (void*)manager0;
 	isc__task_t *task;
 	isc_boolean_t exiting;
 	isc_result_t result;
@@ -1463,7 +1463,7 @@ isc__taskmgr_destroy(isc_taskmgr_t **managerp) {
 	 */
 
 	REQUIRE(managerp != NULL);
-	manager = (isc__taskmgr_t *)*managerp;
+	manager = (void*)(*managerp);
 	REQUIRE(VALID_MANAGER(manager));
 
 #ifndef USE_WORKER_THREADS
@@ -1559,7 +1559,7 @@ isc__taskmgr_destroy(isc_taskmgr_t **managerp) {
 
 ISC_TASKFUNC_SCOPE void
 isc__taskmgr_setmode(isc_taskmgr_t *manager0, isc_taskmgrmode_t mode) {
-	isc__taskmgr_t *manager = (isc__taskmgr_t *)manager0;
+	isc__taskmgr_t *manager = (void*)manager0;
 
 	LOCK(&manager->lock);
 	manager->mode = mode;
@@ -1568,7 +1568,7 @@ isc__taskmgr_setmode(isc_taskmgr_t *manager0, isc_taskmgrmode_t mode) {
 
 ISC_TASKFUNC_SCOPE isc_taskmgrmode_t
 isc__taskmgr_mode(isc_taskmgr_t *manager0) {
-	isc__taskmgr_t *manager = (isc__taskmgr_t *)manager0;
+	isc__taskmgr_t *manager = (void*)manager0;
 	isc_taskmgrmode_t mode;
 	LOCK(&manager->lock);
 	mode = manager->mode;
@@ -1579,7 +1579,7 @@ isc__taskmgr_mode(isc_taskmgr_t *manager0) {
 #ifndef USE_WORKER_THREADS
 isc_boolean_t
 isc__taskmgr_ready(isc_taskmgr_t *manager0) {
-	isc__taskmgr_t *manager = (isc__taskmgr_t *)manager0;
+	isc__taskmgr_t *manager = (void*)manager0;
 	isc_boolean_t is_ready;
 
 #ifdef USE_SHARED_MANAGER
@@ -1598,7 +1598,7 @@ isc__taskmgr_ready(isc_taskmgr_t *manager0) {
 
 isc_result_t
 isc__taskmgr_dispatch(isc_taskmgr_t *manager0) {
-	isc__taskmgr_t *manager = (isc__taskmgr_t *)manager0;
+	isc__taskmgr_t *manager = (void*)manager0;
 
 #ifdef USE_SHARED_MANAGER
 	if (manager == NULL)
@@ -1615,7 +1615,7 @@ isc__taskmgr_dispatch(isc_taskmgr_t *manager0) {
 #else
 ISC_TASKFUNC_SCOPE void
 isc__taskmgr_pause(isc_taskmgr_t *manager0) {
-	isc__taskmgr_t *manager = (isc__taskmgr_t *)manager0;
+	isc__taskmgr_t *manager = (void*)manager0;
 	LOCK(&manager->lock);
 	while (manager->tasks_running > 0) {
 		WAIT(&manager->paused, &manager->lock);
@@ -1626,7 +1626,7 @@ isc__taskmgr_pause(isc_taskmgr_t *manager0) {
 
 ISC_TASKFUNC_SCOPE void
 isc__taskmgr_resume(isc_taskmgr_t *manager0) {
-	isc__taskmgr_t *manager = (isc__taskmgr_t *)manager0;
+	isc__taskmgr_t *manager = (void*)manager0;
 
 	LOCK(&manager->lock);
 	if (manager->pause_requested) {

contrib/ntp/lib/isc/win32/interfaceiter.c

@@ -54,7 +54,7 @@ struct isc_interfaceiter {
 	IP_ADAPTER_ADDRESSES *	ipaaCur;	/* enumeration position */
 	IP_ADAPTER_UNICAST_ADDRESS *ipuaCur;	/* enumeration subposition */
 	/* fields used for the older address enumeration ioctls */
-	int			socket;
+	SOCKET			socket;
 	INTERFACE_INFO		IFData;		/* Current Interface Info */
 	int			numIF;		/* Current Interface count */
 	int			v4IF;		/* Number of IPv4 Interfaces */

contrib/ntp/lib/isc/win32/net.c

@@ -216,7 +216,8 @@ initialize_ipv6only(void) {
 
 static void
 try_ipv6pktinfo(void) {
-	int s, on;
+	SOCKET s;
+	int on;
 	char strbuf[ISC_STRERRORSIZE];
 	isc_result_t result;
 	int optname;

contrib/ntp/libntp/a_md5encrypt.c

@@ -16,12 +16,12 @@
  *
  * Returns length of MAC including key ID and digest.
  */
-int
+size_t
 MD5authencrypt(
-	int	type,		/* hash algorithm */
+	int		type,	/* hash algorithm */
-	u_char	*key,		/* key pointer */
+	const u_char *	key,	/* key pointer */
-	u_int32 *pkt,		/* packet pointer */
+	u_int32 *	pkt,	/* packet pointer */
-	int	length		/* packet length */
+	size_t		length	/* packet length */
 	)
 {
 	u_char	digest[EVP_MAX_MD_SIZE];
@@ -44,7 +44,7 @@ MD5authencrypt(
 	EVP_DigestInit(&ctx, EVP_get_digestbynid(type));
 #endif
 	EVP_DigestUpdate(&ctx, key, cache_secretsize);
-	EVP_DigestUpdate(&ctx, (u_char *)pkt, (u_int)length);
+	EVP_DigestUpdate(&ctx, (u_char *)pkt, length);
 	EVP_DigestFinal(&ctx, digest, &len);
 	memmove((u_char *)pkt + length + 4, digest, len);
 	return (len + 4);
@@ -58,11 +58,11 @@ MD5authencrypt(
  */
 int
 MD5authdecrypt(
-	int	type,		/* hash algorithm */
+	int		type,	/* hash algorithm */
-	u_char	*key,		/* key pointer */
+	const u_char *	key,	/* key pointer */
-	u_int32	*pkt,		/* packet pointer */
+	u_int32	*	pkt,	/* packet pointer */
-	int	length,	 	/* packet length */
+	size_t		length,	/* packet length */
-	int	size		/* MAC size */
+	size_t		size	/* MAC size */
 	)
 {
 	u_char	digest[EVP_MAX_MD_SIZE];
@@ -85,14 +85,14 @@ MD5authdecrypt(
 	EVP_DigestInit(&ctx, EVP_get_digestbynid(type));
 #endif
 	EVP_DigestUpdate(&ctx, key, cache_secretsize);
-	EVP_DigestUpdate(&ctx, (u_char *)pkt, (u_int)length);
+	EVP_DigestUpdate(&ctx, (u_char *)pkt, length);
 	EVP_DigestFinal(&ctx, digest, &len);
-	if ((u_int)size != len + 4) {
+	if (size != (size_t)len + 4) {
 		msyslog(LOG_ERR,
 		    "MAC decrypt: MAC length error");
 		return (0);
 	}
-	return !memcmp(digest, (char *)pkt + length + 4, len);
+	return !memcmp(digest, (const char *)pkt + length + 4, len);
 }
 
 /*

contrib/ntp/libntp/atolfp.c

@@ -68,7 +68,7 @@ atolfp(
 
 	while (*cp != '\0' && (ind = strchr(digits, *cp)) != NULL) {
 		dec_i = (dec_i << 3) + (dec_i << 1);	/* multiply by 10 */
-		dec_i += (ind - digits);
+		dec_i += (u_long)(ind - digits);
 		cp++;
 	}
 
@@ -80,7 +80,7 @@ atolfp(
 		       && (ind = strchr(digits, *cp)) != NULL) {
 			ndec++;
 			dec_f = (dec_f << 3) + (dec_f << 1);	/* *10 */
-			dec_f += (ind - digits);
+			dec_f += (u_long)(ind - digits);
 			cp++;
 		}
 

contrib/ntp/libntp/authkeys.c

@@ -63,7 +63,7 @@ symkey	key_listhead;		/* list of all in-use keys */;
  * keyid. We make this fairly big for potentially busy servers.
  */
 #define	DEF_AUTHHASHSIZE	64
-//#define	HASHMASK	((HASHSIZE)-1)
+/*#define	HASHMASK	((HASHSIZE)-1)*/
 #define	KEYHASH(keyid)	((keyid) & authhashmask)
 
 int	authhashdisabled;
@@ -511,7 +511,17 @@ authistrusted(
 	return TRUE;
 }
 
-
+/* Note: There are two locations below where 'strncpy()' is used. While
+ * this function is a hazard by itself, it's essential that it is used
+ * here. Bug 1243 involved that the secret was filled with NUL bytes
+ * after the first NUL encountered, and 'strlcpy()' simply does NOT have
+ * this behaviour. So disabling the fix and reverting to the buggy
+ * behaviour due to compatibility issues MUST also fill with NUL and
+ * this needs 'strncpy'. Also, the secret is managed as a byte blob of a
+ * given size, and eventually truncating it and replacing the last byte
+ * with a NUL would be a bug.
+ * perlinger@ntp.org 2015-10-10
+ */
 void
 MD5auth_setkey(
 	keyid_t keyno,
@@ -546,7 +556,8 @@ MD5auth_setkey(
 #ifndef DISABLE_BUG1243_FIX
 			memcpy(sk->secret, key, secretsize);
 #else
-			strlcpy((char *)sk->secret, (const char *)key,
+			/* >MUST< use 'strncpy()' here! See above! */
+			strncpy((char *)sk->secret, (const char *)key,
 				secretsize);
 #endif
 			if (cache_keyid == keyno) {
@@ -565,7 +576,8 @@ MD5auth_setkey(
 #ifndef DISABLE_BUG1243_FIX
 	memcpy(secret, key, secretsize);
 #else
-	strlcpy((char *)secret, (const char *)key, secretsize);
+	/* >MUST< use 'strncpy()' here! See above! */
+	strncpy((char *)secret, (const char *)key, secretsize);
 #endif
 	allocsymkey(bucket, keyno, 0, (u_short)keytype, 0,
 		    (u_short)secretsize, secret);
@@ -641,13 +653,13 @@ auth_agekeys(void)
  *
  * Returns length of authenticator field, zero if key not found.
  */
-int
+size_t
 authencrypt(
 	keyid_t		keyno,
 	u_int32 *	pkt,
-	int		length
+	size_t		length
 	)
-{\
+{
 	/*
 	 * A zero key identifier means the sender has not verified
 	 * the last message was correctly authenticated. The MAC
@@ -675,8 +687,8 @@ int
 authdecrypt(
 	keyid_t		keyno,
 	u_int32 *	pkt,
-	int		length,
+	size_t		length,
-	int		size
+	size_t		size
 	)
 {
 	/*

contrib/ntp/libntp/authreadkeys.c

@@ -77,14 +77,23 @@ nexttok(
  * data on global/static level.
  */
 
-static const size_t nerr_loglimit = 5u;
+static const u_int nerr_loglimit = 5u;
-static const size_t nerr_maxlimit = 15;
+static const u_int nerr_maxlimit = 15;
 
-static void log_maybe(size_t*, const char*, ...) NTP_PRINTF(2, 3);
+static void log_maybe(u_int*, const char*, ...) NTP_PRINTF(2, 3);
+
+typedef struct keydata KeyDataT;
+struct keydata {
+	KeyDataT *next;		/* queue/stack link		*/
+	keyid_t   keyid;	/* stored key ID		*/
+	u_short   keytype;	/* stored key type		*/
+	u_short   seclen;	/* length of secret		*/
+	u_char    secbuf[1];	/* begin of secret (formal only)*/
+};
 
 static void
 log_maybe(
-	size_t     *pnerr,
+	u_int      *pnerr,
 	const char *fmt  ,
 	...)
 {
@@ -113,25 +122,24 @@ authreadkeys(
 	u_char	keystr[32];		/* Bug 2537 */
 	size_t	len;
 	size_t	j;
-	size_t  nerr;
+	u_int   nerr;
+	KeyDataT *list = NULL;
+	KeyDataT *next = NULL;
 	/*
 	 * Open file.  Complain and return if it can't be opened.
 	 */
 	fp = fopen(file, "r");
 	if (fp == NULL) {
-		msyslog(LOG_ERR, "authreadkeys: file %s: %m",
+		msyslog(LOG_ERR, "authreadkeys: file '%s': %m",
 		    file);
-		return (0);
+		goto onerror;
 	}
 	INIT_SSL();
 
 	/*
-	 * Remove all existing keys
+	 * Now read lines from the file, looking for key entries. Put
-	 */
+	 * the data into temporary store for later propagation to avoid
-	auth_delkeys();
+	 * two-pass processing.
-
-	/*
-	 * Now read lines from the file, looking for key entries
 	 */
 	nerr = 0;
 	while ((line = fgets(buf, sizeof buf, fp)) != NULL) {
@@ -216,11 +224,16 @@ authreadkeys(
 				  "authreadkeys: no key for key %d", keyno);
 			continue;
 		}
+		next = NULL;
 		len = strlen(token);
 		if (len <= 20) {	/* Bug 2537 */
-			MD5auth_setkey(keyno, keytype, (u_char *)token, len);
+			next = emalloc(sizeof(KeyDataT) + len);
+			next->keyid   = keyno;
+			next->keytype = keytype;
+			next->seclen  = len;
+			memcpy(next->secbuf, token, len);
 		} else {
-			char	hex[] = "0123456789abcdef";
+			static const char hex[] = "0123456789abcdef";
 			u_char	temp;
 			char	*ptr;
 			size_t	jlim;
@@ -242,19 +255,51 @@ authreadkeys(
 					  keyno);
 				continue;
 			}
-			MD5auth_setkey(keyno, keytype, keystr, jlim / 2);
+			len = jlim/2; /* hmmmm.... what about odd length?!? */
+			next = emalloc(sizeof(KeyDataT) + len);
+			next->keyid   = keyno;
+			next->keytype = keytype;
+			next->seclen  = len;
+			memcpy(next->secbuf, keystr, len);
 		}
+		INSIST(NULL != next);
+		next->next = list;
+		list = next;
 	}
 	fclose(fp);
 	if (nerr > nerr_maxlimit) {
 		msyslog(LOG_ERR,
-			"authreadkeys: emergency break after %u errors",
+			"authreadkeys: rejecting file '%s' after %u errors (emergency break)",
-			nerr);
+			file, nerr);
-		return (0);
+		goto onerror;
-	} else if (nerr > nerr_loglimit) {
+	}
+	if (nerr > 0) {
 		msyslog(LOG_ERR,
-			"authreadkeys: found %u more error(s)",
+			"authreadkeys: rejecting file '%s' after %u error(s)",
-			nerr - nerr_loglimit);
+			file, nerr);
+		goto onerror;
+	}
+
+	/* first remove old file-based keys */
+	auth_delkeys();
+	/* insert the new key material */
+	while (NULL != (next = list)) {
+		list = next->next;
+		MD5auth_setkey(next->keyid, next->keytype,
+			       next->secbuf, next->seclen);
+		/* purge secrets from memory before free()ing it */
+		memset(next, 0, sizeof(*next) + next->seclen);
+		free(next);
 	}
 	return (1);
+
+  onerror:
+	/* Mop up temporary storage before bailing out. */
+	while (NULL != (next = list)) {
+		list = next->next;
+		/* purge secrets from memory before free()ing it */
+		memset(next, 0, sizeof(*next) + next->seclen);
+		free(next);
+	}
+	return (0);
 }

contrib/ntp/libntp/authusekey.c

@@ -23,7 +23,7 @@ authusekey(
 	const u_char *str
 	)
 {
-	int len;
+	size_t	len;
 
 	len = strlen((const char *)str);
 	if (0 == len)

contrib/ntp/libntp/dolfptoa.c

@@ -40,7 +40,7 @@ dolfptoa(
 	 * including a possible rounding from the fractional part.
 	 */
 	cp = cpend = cpdec = &cbuf[10];
-	for (dec = cp - cbuf; dec > 0 && fpi != 0; dec--) {
+	for (dec = (int)(cp - cbuf); dec > 0 && fpi != 0; dec--) {
 		/* can add another digit */
 		u_int32 digit;
 		
@@ -62,7 +62,7 @@ dolfptoa(
 		cpdec += 3;
 	}
 	if ((size_t)dec > sizeof(cbuf) - (cpend - cbuf))
-		dec = sizeof(cbuf) - (cpend - cbuf);
+		dec = (int)(sizeof(cbuf) - (cpend - cbuf));
 	
 	/*
 	 * If there's a fraction to deal with, do so.
@@ -95,7 +95,7 @@ dolfptoa(
 		u_char *tp    = cpend;
 		int     carry = ((fpv & 0x80000000) != 0);
 
-		for (dec = tp - cbuf;  carry && dec > 0;  dec--) {
+		for (dec = (int)(tp - cbuf);  carry && dec > 0;  dec--) {
 			*--tp += 1;
 			if (*tp == 10)
 				*tp = 0;

contrib/ntp/libntp/hextolfp.c

@@ -37,8 +37,9 @@ hextolfp(
 	while (*cp != '\0' && (cp - cpstart) < 8 &&
 	       (ind = strchr(digits, *cp)) != NULL) {
 		dec_i = dec_i << 4;	/* multiply by 16 */
-		dec_i += ((ind - digits) > 15) ? (ind - digits) - 6
+		dec_i += ((ind - digits) > 15)
-			: (ind - digits);
+			? (u_long)(ind - digits - 6)
+			: (u_long)(ind - digits);
 		cp++;
 	}
 
@@ -51,8 +52,9 @@ hextolfp(
 	while (*cp != '\0' && (cp - cpstart) < 8 &&
 	       (ind = strchr(digits, *cp)) != NULL) {
 		dec_f = dec_f << 4;	/* multiply by 16 */
-		dec_f += ((ind - digits) > 15) ? (ind - digits) - 6
+		dec_f += ((ind - digits) > 15)
-			: (ind - digits);
+			? (u_long)(ind - digits - 6)
+			: (u_long)(ind - digits);
 		cp++;
 	}
 

contrib/ntp/libntp/mstolfp.c

@@ -70,8 +70,7 @@ mstolfp(
 	 */
 	*bp++ = '.';
 	if ((cpdec - cp) < 3) {
-		register int i = 3 - (cpdec - cp);
+		size_t i = 3 - (cpdec - cp);
-
 		do {
 			*bp++ = '0';
 		} while (--i > 0);

contrib/ntp/libntp/msyslog.c

@@ -331,7 +331,7 @@ msnprintf(
 	)
 {
 	va_list	ap;
-	size_t	rc;
+	int	rc;
 
 	va_start(ap, fmt);
 	rc = mvsnprintf(buf, bufsiz, fmt, ap);

contrib/ntp/libntp/ntp_crypto_rnd.c

@@ -16,6 +16,7 @@
 
 #include <l_stdlib.h>
 #include <ntp_random.h>
+#include "safecast.h"
 
 #ifdef USE_OPENSSL_CRYPTO_RAND
 #include <openssl/err.h>
@@ -93,7 +94,7 @@ ntp_crypto_random_buf(
 #ifdef USE_OPENSSL_CRYPTO_RAND
 	int rc;
 
-	rc = RAND_bytes(buf, nbytes);
+	rc = RAND_bytes(buf, size2int_chk(nbytes));
 	if (1 != rc) {
 		unsigned long err;
 		char *err_str;

contrib/ntp/libntp/ntp_lineedit.c

@@ -29,6 +29,7 @@
 #include "ntp.h"
 #include "ntp_stdlib.h"
 #include "ntp_lineedit.h"
+#include "safecast.h"
 
 #define MAXEDITLINE	512
 
@@ -213,7 +214,7 @@ ntp_readline(
 
 	line = fgets(line_buf, sizeof(line_buf), stdin);
 	if (NULL != line && *line) {
-		*pcount = strlen(line);
+		*pcount = (int)strlen(line); /* cannot overflow here */
 		line = estrdup(line);
 	} else
 		line = NULL;

contrib/ntp/libntp/ntp_rfc2553.c

@@ -203,11 +203,12 @@ copy_addrinfo_common(
 		else
 			ai_nxt = ai_src->ai_next;
 		*ai_cpy = *ai_src;
-		REQUIRE(ai_src->ai_addrlen <= sizeof(sockaddr_u));
+		DEBUG_INSIST(ai_cpy->ai_canonname == ai_src->ai_canonname);
+		INSIST(ai_src->ai_addrlen <= sizeof(sockaddr_u));
 		memcpy(psau, ai_src->ai_addr, ai_src->ai_addrlen);
 		ai_cpy->ai_addr = &psau->sa;
 		++psau;
-		if (NULL != ai_cpy->ai_canonname) {
+		if (NULL != ai_src->ai_canonname) {
 			ai_cpy->ai_canonname = pcanon;
 			str_octets = 1 + strlen(ai_src->ai_canonname);
 			memcpy(pcanon, ai_src->ai_canonname, str_octets);
@@ -480,15 +481,16 @@ do_nodename(
 	 * set elsewhere so that we can set the appropriate wildcard
 	 */
 	if (nodename == NULL) {
-		ai->ai_addrlen = sizeof(struct sockaddr_storage);
 		if (ai->ai_family == AF_INET)
 		{
+			ai->ai_addrlen = sizeof(struct sockaddr_in);
 			sockin = (struct sockaddr_in *)ai->ai_addr;
 			sockin->sin_family = (short) ai->ai_family;
 			sockin->sin_addr.s_addr = htonl(INADDR_ANY);
 		}
 		else
 		{
+			ai->ai_addrlen = sizeof(struct sockaddr_in6);
 			sockin6 = (struct sockaddr_in6 *)ai->ai_addr;
 			sockin6->sin6_family = (short) ai->ai_family;
 			/*

contrib/ntp/libntp/ntp_worker.c

@@ -150,7 +150,8 @@ available_blocking_child_slot(void)
 					  prev_octets);
 	blocking_children_alloc = new_alloc;
 
-	return prev_alloc;
+	/* assume we'll never have enough workers to overflow u_int */
+	return (u_int)prev_alloc;
 }
 
 

contrib/ntp/libntp/snprintf.c

@@ -889,19 +889,19 @@ rpl_vsnprintf(char *str, size_t size, const char *format, va_list args)
 				switch (cflags) {
 				case PRINT_C_CHAR:
 					charptr = va_arg(args, signed char *);
-					*charptr = len;
+					*charptr = (signed char)len;
 					break;
 				case PRINT_C_SHORT:
 					shortptr = va_arg(args, short int *);
-					*shortptr = len;
+					*shortptr = (short int)len;
 					break;
 				case PRINT_C_LONG:
 					longptr = va_arg(args, long int *);
-					*longptr = len;
+					*longptr = (long int)len;
 					break;
 				case PRINT_C_LLONG:
 					llongptr = va_arg(args, LLONG *);
-					*llongptr = len;
+					*llongptr = (LLONG)len;
 					break;
 				case PRINT_C_SIZE:
 					/*
@@ -912,19 +912,19 @@ rpl_vsnprintf(char *str, size_t size, const char *format, va_list args)
 					 * size_t argument." (7.19.6.1, 7)
 					 */
 					sizeptr = va_arg(args, SSIZE_T *);
-					*sizeptr = len;
+					*sizeptr = (SSIZE_T)len;
 					break;
 				case PRINT_C_INTMAX:
 					intmaxptr = va_arg(args, INTMAX_T *);
-					*intmaxptr = len;
+					*intmaxptr = (INTMAX_T)len;
 					break;
 				case PRINT_C_PTRDIFF:
 					ptrdiffptr = va_arg(args, PTRDIFF_T *);
-					*ptrdiffptr = len;
+					*ptrdiffptr = (PTRDIFF_T)len;
 					break;
 				default:
 					intptr = va_arg(args, int *);
-					*intptr = len;
+					*intptr = (int)len;
 					break;
 				}
 				break;
@@ -1209,7 +1209,7 @@ fmtflt(char *str, size_t *len, size_t size, LDOUBLE fvalue, int width,
 	 * Factor of ten with the number of digits needed for the fractional
 	 * part.  For example, if the precision is 3, the mask will be 1000.
 	 */
-	mask = mypow10(precision);
+	mask = (UINTMAX_T)mypow10(precision);
 	/*
 	 * We "cheat" by converting the fractional part to integer by
 	 * multiplying by a factor of ten.
@@ -1461,7 +1461,7 @@ cast(LDOUBLE value)
 	if (value >= UINTMAX_MAX)
 		return UINTMAX_MAX;
 
-	result = value;
+	result = (UINTMAX_T)value;
 	/*
 	 * At least on NetBSD/sparc64 3.0.2 and 4.99.30, casting long double to
 	 * an integer type converts e.g. 1.9 to 2 instead of 1 (which violates

contrib/ntp/libntp/socktohost.c

@@ -36,13 +36,18 @@ socktohost(
 	sockaddr_u		addr;
 	size_t			octets;
 	int			a_info;
+	int			saved_errno;
+
+	saved_errno = socket_errno();
 
 	/* reverse the address to purported DNS name */
 	LIB_GETBUF(pbuf);
 	gni_flags = NI_DGRAM | NI_NAMEREQD;
 	if (getnameinfo(&sock->sa, SOCKLEN(sock), pbuf, LIB_BUFLENGTH,
-			NULL, 0, gni_flags))
+			NULL, 0, gni_flags)) {
+		errno = saved_errno;
 		return stoa(sock);	/* use address */
+	}
 
 	TRACE(1, ("%s reversed to %s\n", stoa(sock), pbuf));
 
@@ -97,8 +102,10 @@ socktohost(
 	}
 	freeaddrinfo(alist);
 
-	if (ai != NULL)
+	if (ai != NULL) {
+		errno = saved_errno;
 		return pbuf;	/* forward check passed */
+	}
 
     forward_fail:
 	TRACE(1, ("%s forward check lookup fail: %s\n", pbuf,
@@ -106,5 +113,6 @@ socktohost(
 	LIB_GETBUF(pliar);
 	snprintf(pliar, LIB_BUFLENGTH, "%s (%s)", stoa(sock), pbuf);
 
+	errno = saved_errno;
 	return pliar;
 }

contrib/ntp/libntp/systime.c

@@ -25,6 +25,8 @@
 # include <utmpx.h>
 #endif /* HAVE_UTMPX_H */
 
+int	allow_panic = FALSE;		/* allow panic correction (-g) */
+int	enable_panic_check = TRUE;	/* Can we check allow_panic's state? */
 
 #ifndef USE_COMPILETIME_PIVOT
 # define USE_COMPILETIME_PIVOT 1
@@ -295,8 +297,13 @@ adj_systime(
 	 * EVNT_NSET adjtime() can be aborted by a tiny adjtime()
 	 * triggered by sys_residual.
 	 */
-	if (0. == now)
+	if (0. == now) {
+		if (enable_panic_check && allow_panic) {
+			msyslog(LOG_ERR, "adj_systime: allow_panic is TRUE!");
+			INSIST(!allow_panic);
+		}
 		return TRUE;
+	}
 
 	/*
 	 * Most Unix adjtime() implementations adjust the system clock
@@ -333,9 +340,15 @@ adj_systime(
 	if (adjtv.tv_sec != 0 || adjtv.tv_usec != 0) {
 		if (adjtime(&adjtv, &oadjtv) < 0) {
 			msyslog(LOG_ERR, "adj_systime: %m");
+			if (enable_panic_check && allow_panic) {
+				msyslog(LOG_ERR, "adj_systime: allow_panic is TRUE!");
+			}
 			return FALSE;
 		}
 	}
+	if (enable_panic_check && allow_panic) {
+		msyslog(LOG_ERR, "adj_systime: allow_panic is TRUE!");
+	}
 	return TRUE;
 }
 #endif
@@ -419,6 +432,9 @@ step_systime(
 	/* now set new system time */
 	if (ntp_set_tod(&timetv, NULL) != 0) {
 		msyslog(LOG_ERR, "step-systime: %m");
+		if (enable_panic_check && allow_panic) {
+			msyslog(LOG_ERR, "step_systime: allow_panic is TRUE!");
+		}
 		return FALSE;
 	}
 
@@ -445,7 +461,7 @@ step_systime(
 	 *	   long    ut_time;
 	 * };
 	 * and appends line="|", name="date", host="", time for the OLD
-	 * and appends line="{", name="date", host="", time for the NEW
+	 * and appends line="{", name="date", host="", time for the NEW // }
 	 * to _PATH_WTMP .
 	 *
 	 * Some OSes have utmp, some have utmpx.
@@ -564,6 +580,10 @@ step_systime(
 #endif /* UPDATE_WTMPX */
 
 	}
+	if (enable_panic_check && allow_panic) {
+		msyslog(LOG_ERR, "step_systime: allow_panic is TRUE!");
+		INSIST(!allow_panic);
+	}
 	return TRUE;
 }
 

contrib/ntp/libntp/work_thread.c

@@ -32,16 +32,20 @@
 #define THREAD_MINSTACKSIZE	(64U * 1024)
 #endif
 
-#ifndef DEVOLATILE
-#define DEVOLATILE(type, var) ((type)(uintptr_t)(volatile void *)(var))
-#endif
-
 #ifdef SYS_WINNT
+
 # define thread_exit(c)	_endthreadex(c)
-# define tickle_sem	SetEvent
+# define tickle_sem(sh) ReleaseSemaphore((sh->shnd), 1, NULL)
+u_int	WINAPI	blocking_thread(void *);
+static BOOL	same_os_sema(const sem_ref obj, void * osobj);
+
 #else
+
 # define thread_exit(c)	pthread_exit((void*)(size_t)(c))
 # define tickle_sem	sem_post
+void *		blocking_thread(void *);
+static	void	block_thread_signals(sigset_t *);
+
 #endif
 
 #ifdef WORK_PIPE
@@ -54,18 +58,10 @@ static	void	start_blocking_thread(blocking_child *);
 static	void	start_blocking_thread_internal(blocking_child *);
 static	void	prepare_child_sems(blocking_child *);
 static	int	wait_for_sem(sem_ref, struct timespec *);
-static	void	ensure_workitems_empty_slot(blocking_child *);
+static	int	ensure_workitems_empty_slot(blocking_child *);
-static	void	ensure_workresp_empty_slot(blocking_child *);
+static	int	ensure_workresp_empty_slot(blocking_child *);
 static	int	queue_req_pointer(blocking_child *, blocking_pipe_header *);
 static	void	cleanup_after_child(blocking_child *);
-#ifdef SYS_WINNT
-u_int	WINAPI	blocking_thread(void *);
-#else
-void *		blocking_thread(void *);
-#endif
-#ifndef SYS_WINNT
-static	void	block_thread_signals(sigset_t *);
-#endif
 
 
 void
@@ -76,7 +72,9 @@ exit_worker(
 	thread_exit(exitcode);	/* see #define thread_exit */
 }
 
-
+/* --------------------------------------------------------------------
+ * sleep for a given time or until the wakup semaphore is tickled.
+ */
 int
 worker_sleep(
 	blocking_child *	c,
@@ -98,9 +96,7 @@ worker_sleep(
 	}
 # endif
 	until.tv_sec += seconds;
-	do {
+	rc = wait_for_sem(c->wake_scheduled_sleep, &until);
-		rc = wait_for_sem(c->wake_scheduled_sleep, &until);
-	} while (-1 == rc && EINTR == errno);
 	if (0 == rc)
 		return -1;
 	if (-1 == rc && ETIMEDOUT == errno)
@@ -110,6 +106,9 @@ worker_sleep(
 }
 
 
+/* --------------------------------------------------------------------
+ * Wake up a worker that takes a nap.
+ */
 void
 interrupt_worker_sleep(void)
 {
@@ -124,65 +123,79 @@ interrupt_worker_sleep(void)
 	}
 }
 
-
+/* --------------------------------------------------------------------
-static void
+ * Make sure there is an empty slot at the head of the request
+ * queue. Tell if the queue is currently empty.
+ */
+static int
 ensure_workitems_empty_slot(
 	blocking_child *c
 	)
 {
-	const size_t	each = sizeof(blocking_children[0]->workitems[0]);
+	/*
-	size_t		new_alloc;
+	** !!! PRECONDITION: caller holds access lock!
-	size_t		old_octets;
+	**
-	size_t		new_octets;
+	** This simply tries to increase the size of the buffer if it
-	void *		nonvol_workitems;
+	** becomes full. The resize operation does *not* maintain the
+	** order of requests, but that should be irrelevant since the
+	** processing is considered asynchronous anyway.
+	**
+	** Return if the buffer is currently empty.
+	*/
 	
+	static const size_t each =
+	    sizeof(blocking_children[0]->workitems[0]);
 
-	if (c->workitems != NULL &&
+	size_t	new_alloc;
-	    NULL == c->workitems[c->next_workitem])
+	size_t  slots_used;
-		return;
 
-	new_alloc = c->workitems_alloc + WORKITEMS_ALLOC_INC;
+	slots_used = c->head_workitem - c->tail_workitem;
-	old_octets = c->workitems_alloc * each;
+	if (slots_used >= c->workitems_alloc) {
-	new_octets = new_alloc * each;
+		new_alloc  = c->workitems_alloc + WORKITEMS_ALLOC_INC;
-	nonvol_workitems = DEVOLATILE(void *, c->workitems);
+		c->workitems = erealloc(c->workitems, new_alloc * each);
-	c->workitems = erealloc_zero(nonvol_workitems, new_octets,
+		c->tail_workitem   = 0;
-				     old_octets);
+		c->head_workitem   = c->workitems_alloc;
-	if (0 == c->next_workitem)
+		c->workitems_alloc = new_alloc;
-		c->next_workitem = c->workitems_alloc;
+	}
-	c->workitems_alloc = new_alloc;
+	return (0 == slots_used);
 }
 
-
+/* --------------------------------------------------------------------
-static void
+ * Make sure there is an empty slot at the head of the response
+ * queue. Tell if the queue is currently empty.
+ */
+static int
 ensure_workresp_empty_slot(
 	blocking_child *c
 	)
 {
-	const size_t	each = sizeof(blocking_children[0]->responses[0]);
+	/*
-	size_t		new_alloc;
+	** !!! PRECONDITION: caller holds access lock!
-	size_t		old_octets;
+	**
-	size_t		new_octets;
+	** Works like the companion function above.
-	void *		nonvol_responses;
+	*/
 	
-	if (c->responses != NULL &&
+	static const size_t each =
-	    NULL == c->responses[c->next_response])
+	    sizeof(blocking_children[0]->responses[0]);
-		return;
 
-	new_alloc = c->responses_alloc + RESPONSES_ALLOC_INC;
+	size_t	new_alloc;
-	old_octets = c->responses_alloc * each;
+	size_t  slots_used;
-	new_octets = new_alloc * each;
+
-	nonvol_responses = DEVOLATILE(void *, c->responses);
+	slots_used = c->head_response - c->tail_response;
-	c->responses = erealloc_zero(nonvol_responses, new_octets,
+	if (slots_used >= c->responses_alloc) {
-				     old_octets);
+		new_alloc  = c->responses_alloc + RESPONSES_ALLOC_INC;
-	if (0 == c->next_response)
+		c->responses = erealloc(c->responses, new_alloc * each);
-		c->next_response = c->responses_alloc;
+		c->tail_response   = 0;
-	c->responses_alloc = new_alloc;
+		c->head_response   = c->responses_alloc;
+		c->responses_alloc = new_alloc;
+	}
+	return (0 == slots_used);
 }
 
 
-/*
+/* --------------------------------------------------------------------
  * queue_req_pointer() - append a work item or idle exit request to
- *			 blocking_workitems[].
+ *			 blocking_workitems[]. Employ proper locking.
  */
 static int
 queue_req_pointer(
@@ -190,21 +203,28 @@ queue_req_pointer(
 	blocking_pipe_header *	hdr
 	)
 {
-	c->workitems[c->next_workitem] = hdr;
+	size_t qhead;
-	c->next_workitem = (1 + c->next_workitem) % c->workitems_alloc;
 	
-	/*
+	/* >>>> ACCESS LOCKING STARTS >>>> */
-	 * We only want to signal the wakeup event if the child is
+	wait_for_sem(c->accesslock, NULL);
-	 * blocking on it, which is indicated by setting the blocking
+	ensure_workitems_empty_slot(c);
-	 * event.  Wait with zero timeout to test.
+	qhead = c->head_workitem;
-	 */
+	c->workitems[qhead % c->workitems_alloc] = hdr;
-	/* !!!! if (WAIT_OBJECT_0 == WaitForSingleObject(c->child_is_blocking, 0)) */
+	c->head_workitem = 1 + qhead;
-		tickle_sem(c->blocking_req_ready);
+	tickle_sem(c->accesslock);
+	/* <<<< ACCESS LOCKING ENDS <<<< */
+
+	/* queue consumer wake-up notification */
+	tickle_sem(c->workitems_pending);
 
 	return 0;
 }
 
-
+/* --------------------------------------------------------------------
+ * API function to make sure a worker is running, a proper private copy
+ * of the data is made, the data eneterd into the queue and the worker
+ * is signalled.
+ */
 int
 send_blocking_req_internal(
 	blocking_child *	c,
@@ -223,12 +243,8 @@ send_blocking_req_internal(
 		return 1;	/* failure */
 	payload_octets = hdr->octets - sizeof(*hdr);
 
-	ensure_workitems_empty_slot(c);
+	if (NULL == c->thread_ref)
-	if (NULL == c->thread_ref) {
-		ensure_workresp_empty_slot(c);
 		start_blocking_thread(c);
-	}
-
 	threadcopy = emalloc(hdr->octets);
 	memcpy(threadcopy, hdr, sizeof(*hdr));
 	memcpy((char *)threadcopy + sizeof(*hdr), data, payload_octets);
@@ -236,43 +252,41 @@ send_blocking_req_internal(
 	return queue_req_pointer(c, threadcopy);
 }
 
-
+/* --------------------------------------------------------------------
+ * Wait for the 'incoming queue no longer empty' signal, lock the shared
+ * structure and dequeue an item.
+ */
 blocking_pipe_header *
 receive_blocking_req_internal(
 	blocking_child *	c
 	)
 {
 	blocking_pipe_header *	req;
-	int			rc;
+	size_t			qhead, qtail;
 
-	/*
+	req = NULL;
-	 * Child blocks here when idle.  SysV semaphores maintain a
-	 * count and release from sem_wait() only when it reaches 0.
-	 * Windows auto-reset events are simpler, and multiple SetEvent
-	 * calls before any thread waits result in a single wakeup.
-	 * On Windows, the child drains all workitems each wakeup, while
-	 * with SysV semaphores wait_sem() is used before each item.
-	 */
-#ifdef SYS_WINNT
-	while (NULL == c->workitems[c->next_workeritem]) {
-		/* !!!! SetEvent(c->child_is_blocking); */
-		rc = wait_for_sem(c->blocking_req_ready, NULL);
-		INSIST(0 == rc);
-		/* !!!! ResetEvent(c->child_is_blocking); */
-	}
-#else
 	do {
-		rc = wait_for_sem(c->blocking_req_ready, NULL);
+		/* wait for tickle from the producer side */
-	} while (-1 == rc && EINTR == errno);
+		wait_for_sem(c->workitems_pending, NULL);
-	INSIST(0 == rc);
+
-#endif
+		/* >>>> ACCESS LOCKING STARTS >>>> */
+		wait_for_sem(c->accesslock, NULL);
+		qhead = c->head_workitem;
+		do {
+			qtail = c->tail_workitem;
+			if (qhead == qtail)
+				break;
+			c->tail_workitem = qtail + 1;
+			qtail %= c->workitems_alloc;
+			req = c->workitems[qtail];
+			c->workitems[qtail] = NULL;
+		} while (NULL == req);
+		tickle_sem(c->accesslock);
+		/* <<<< ACCESS LOCKING ENDS <<<< */
+
+	} while (NULL == req);
 
-	req = c->workitems[c->next_workeritem];
 	INSIST(NULL != req);
-	c->workitems[c->next_workeritem] = NULL;
-	c->next_workeritem = (1 + c->next_workeritem) %
-				c->workitems_alloc;
-
 	if (CHILD_EXIT_REQ == req) {	/* idled out */
 		send_blocking_resp_internal(c, CHILD_GONE_RESP);
 		req = NULL;
@@ -281,44 +295,74 @@ receive_blocking_req_internal(
 	return req;
 }
 
-
+/* --------------------------------------------------------------------
+ * Push a response into the return queue and eventually tickle the
+ * receiver.
+ */
 int
 send_blocking_resp_internal(
 	blocking_child *	c,
 	blocking_pipe_header *	resp
 	)
 {
-	ensure_workresp_empty_slot(c);
+	size_t	qhead;
+	int	empty;
 	
-	c->responses[c->next_response] = resp;
+	/* >>>> ACCESS LOCKING STARTS >>>> */
-	c->next_response = (1 + c->next_response) % c->responses_alloc;
+	wait_for_sem(c->accesslock, NULL);
-
+	empty = ensure_workresp_empty_slot(c);
-#ifdef WORK_PIPE
+	qhead = c->head_response;
-	write(c->resp_write_pipe, "", 1);
+	c->responses[qhead % c->responses_alloc] = resp;
-#else
+	c->head_response = 1 + qhead;
-	tickle_sem(c->blocking_response_ready);
+	tickle_sem(c->accesslock);
-#endif
+	/* <<<< ACCESS LOCKING ENDS <<<< */
 
+	/* queue consumer wake-up notification */
+	if (empty)
+	{
+#	    ifdef WORK_PIPE
+		write(c->resp_write_pipe, "", 1);
+#	    else
+		tickle_sem(c->responses_pending);
+#	    endif
+	}
 	return 0;
 }
 
 
 #ifndef WORK_PIPE
+
+/* --------------------------------------------------------------------
+ * Check if a (Windows-)hanndle to a semaphore is actually the same we
+ * are using inside the sema wrapper.
+ */
+static BOOL
+same_os_sema(
+	const sem_ref	obj,
+	void*		osh
+	)
+{
+	return obj && osh && (obj->shnd == (HANDLE)osh);
+}
+
+/* --------------------------------------------------------------------
+ * Find the shared context that associates to an OS handle and make sure
+ * the data is dequeued and processed.
+ */
 void
 handle_blocking_resp_sem(
 	void *	context
 	)
 {
-	HANDLE			ready;
 	blocking_child *	c;
 	u_int			idx;
 
-	ready = (HANDLE)context;
 	c = NULL;
 	for (idx = 0; idx < blocking_children_alloc; idx++) {
 		c = blocking_children[idx];
-		if (c != NULL && c->thread_ref != NULL &&
+		if (c != NULL &&
-		    ready == c->blocking_response_ready)
+			c->thread_ref != NULL &&
+			same_os_sema(c->responses_pending, context))
 			break;
 	}
 	if (idx < blocking_children_alloc)
@@ -326,26 +370,41 @@ handle_blocking_resp_sem(
 }
 #endif	/* !WORK_PIPE */
 
-
+/* --------------------------------------------------------------------
+ * Fetch the next response from the return queue. In case of signalling
+ * via pipe, make sure the pipe is flushed, too.
+ */
 blocking_pipe_header *
 receive_blocking_resp_internal(
 	blocking_child *	c
 	)
 {
 	blocking_pipe_header *	removed;
+	size_t			qhead, qtail, slot;
+
 #ifdef WORK_PIPE
 	int			rc;
 	char			scratch[32];
 
-	do {
+	do
 		rc = read(c->resp_read_pipe, scratch, sizeof(scratch));
-	} while (-1 == rc && EINTR == errno);
+	while (-1 == rc && EINTR == errno);
 #endif
-	removed = c->responses[c->next_workresp];
+
+	/* >>>> ACCESS LOCKING STARTS >>>> */
+	wait_for_sem(c->accesslock, NULL);
+	qhead = c->head_response;
+	qtail = c->tail_response;
+	for (removed = NULL; !removed && (qhead != qtail); ++qtail) {
+		slot = qtail % c->responses_alloc;
+		removed = c->responses[slot];
+		c->responses[slot] = NULL;
+	}
+	c->tail_response = qtail;
+	tickle_sem(c->accesslock);
+	/* <<<< ACCESS LOCKING ENDS <<<< */
+
 	if (NULL != removed) {
-		c->responses[c->next_workresp] = NULL;
-		c->next_workresp = (1 + c->next_workresp) %
-				   c->responses_alloc;
 		DEBUG_ENSURE(CHILD_GONE_RESP == removed ||
 			     BLOCKING_RESP_MAGIC == removed->magic_sig);
 	}
@@ -357,7 +416,9 @@ receive_blocking_resp_internal(
 	return removed;
 }
 
-
+/* --------------------------------------------------------------------
+ * Light up a new worker.
+ */
 static void
 start_blocking_thread(
 	blocking_child *	c
@@ -370,40 +431,45 @@ start_blocking_thread(
 	start_blocking_thread_internal(c);
 }
 
-
+/* --------------------------------------------------------------------
+ * Create a worker thread. There are several differences between POSIX
+ * and Windows, of course -- most notably the Windows thread is no
+ * detached thread, and we keep the handle around until we want to get
+ * rid of the thread. The notification scheme also differs: Windows
+ * makes use of semaphores in both directions, POSIX uses a pipe for
+ * integration with 'select()' or alike.
+ */
 static void
 start_blocking_thread_internal(
 	blocking_child *	c
 	)
 #ifdef SYS_WINNT
 {
-	thr_ref	blocking_child_thread;
-	u_int	blocking_thread_id;
 	BOOL	resumed;
 
-	(*addremove_io_semaphore)(c->blocking_response_ready, FALSE);
+	c->thread_ref = NULL;
-	blocking_child_thread =
+	(*addremove_io_semaphore)(c->responses_pending->shnd, FALSE);
+	c->thr_table[0].thnd =
 		(HANDLE)_beginthreadex(
 			NULL,
 			0,
 			&blocking_thread,
 			c,
 			CREATE_SUSPENDED,
-			&blocking_thread_id);
+			NULL);
 
-	if (NULL == blocking_child_thread) {
+	if (NULL == c->thr_table[0].thnd) {
 		msyslog(LOG_ERR, "start blocking thread failed: %m");
 		exit(-1);
 	}
-	c->thread_id = blocking_thread_id;
-	c->thread_ref = blocking_child_thread;
 	/* remember the thread priority is only within the process class */
-	if (!SetThreadPriority(blocking_child_thread,
+	if (!SetThreadPriority(c->thr_table[0].thnd,
 			       THREAD_PRIORITY_BELOW_NORMAL))
 		msyslog(LOG_ERR, "Error lowering blocking thread priority: %m");
 
-	resumed = ResumeThread(blocking_child_thread);
+	resumed = ResumeThread(c->thr_table[0].thnd);
 	DEBUG_INSIST(resumed);
+	c->thread_ref = &c->thr_table[0];
 }
 #else	/* pthreads start_blocking_thread_internal() follows */
 {
@@ -419,6 +485,8 @@ start_blocking_thread_internal(
 	size_t		stacksize;
 	sigset_t	saved_sig_mask;
 
+	c->thread_ref = NULL;
+
 # ifdef NEED_PTHREAD_INIT
 	/*
 	 * from lib/isc/unix/app.c:
@@ -475,7 +543,7 @@ start_blocking_thread_internal(
 #endif
 	c->thread_ref = emalloc_zero(sizeof(*c->thread_ref));
 	block_thread_signals(&saved_sig_mask);
-	rc = pthread_create(c->thread_ref, &thr_attr,
+	rc = pthread_create(&c->thr_table[0], &thr_attr,
 			    &blocking_thread, c);
 	saved_errno = errno;
 	pthread_sigmask(SIG_SETMASK, &saved_sig_mask, NULL);
@@ -485,11 +553,11 @@ start_blocking_thread_internal(
 		msyslog(LOG_ERR, "pthread_create() blocking child: %m");
 		exit(1);
 	}
+	c->thread_ref = &c->thr_table[0];
 }
 #endif
 
-
+/* --------------------------------------------------------------------
-/*
  * block_thread_signals()
  *
  * Temporarily block signals used by ntpd main thread, so that signal
@@ -538,61 +606,101 @@ block_thread_signals(
 #endif	/* !SYS_WINNT */
 
 
-/*
+/* --------------------------------------------------------------------
+ * Create & destroy semaphores. This is sufficiently different between
+ * POSIX and Windows to warrant wrapper functions and close enough to
+ * use the concept of synchronization via semaphore for all platforms.
+ */
+static sem_ref
+create_sema(
+	sema_type*	semptr,
+	u_int		inival,
+	u_int		maxval)
+{
+#ifdef SYS_WINNT
+	
+	long svini, svmax;
+	if (NULL != semptr) {
+		svini = (inival < LONG_MAX)
+		    ? (long)inival : LONG_MAX;
+		svmax = (maxval < LONG_MAX && maxval > 0)
+		    ? (long)maxval : LONG_MAX;
+		semptr->shnd = CreateSemaphore(NULL, svini, svmax, NULL);
+		if (NULL == semptr->shnd)
+			semptr = NULL;
+	}
+	
+#else
+	
+	(void)maxval;
+	if (semptr && sem_init(semptr, FALSE, inival))
+		semptr = NULL;
+	
+#endif
+
+	return semptr;
+}
+
+/* ------------------------------------------------------------------ */
+static sem_ref
+delete_sema(
+	sem_ref obj)
+{
+		
+#   ifdef SYS_WINNT
+		
+	if (obj) {
+		if (obj->shnd)
+			CloseHandle(obj->shnd);
+		obj->shnd = NULL;
+	}
+	
+#   else
+		
+	if (obj)
+		sem_destroy(obj);
+		
+#   endif
+
+	return NULL;
+}
+
+/* --------------------------------------------------------------------
  * prepare_child_sems()
  *
- * create sync events (semaphores)
+ * create sync & access semaphores
- * child_is_blocking initially unset
- * blocking_req_ready initially unset
  *
- * Child waits for blocking_req_ready to be set after
+ * All semaphores are cleared, only the access semaphore has 1 unit.
- * setting child_is_blocking.  blocking_req_ready and
+ * Childs wait on 'workitems_pending', then grabs 'sema_access'
- * blocking_response_ready are auto-reset, so wake one
+ * and dequeues jobs. When done, 'sema_access' is given one unit back.
- * waiter and become unset (unsignalled) in one operation.
+ *
+ * The producer grabs 'sema_access', manages the queue, restores
+ * 'sema_access' and puts one unit into 'workitems_pending'.
+ *
+ * The story goes the same for the response queue.
  */
 static void
 prepare_child_sems(
 	blocking_child *c
 	)
-#ifdef SYS_WINNT
 {
-	if (NULL == c->blocking_req_ready) {
+	c->accesslock           = create_sema(&c->sem_table[0], 1, 1);
-		/* manual reset using ResetEvent() */
+	c->workitems_pending    = create_sema(&c->sem_table[1], 0, 0);
-		/* !!!! c->child_is_blocking = CreateEvent(NULL, TRUE, FALSE, NULL); */
+	c->wake_scheduled_sleep = create_sema(&c->sem_table[2], 0, 1);
-		/* auto reset - one thread released from wait each set */
+#   ifndef WORK_PIPE
-		c->blocking_req_ready = CreateEvent(NULL, FALSE, FALSE, NULL);
+	c->responses_pending    = create_sema(&c->sem_table[3], 0, 0);
-		c->blocking_response_ready = CreateEvent(NULL, FALSE, FALSE, NULL);
+#   endif
-		c->wake_scheduled_sleep = CreateEvent(NULL, FALSE, FALSE, NULL);
-	} else {
-		/* !!!! ResetEvent(c->child_is_blocking); */
-		/* ResetEvent(c->blocking_req_ready); */
-		/* ResetEvent(c->blocking_response_ready); */
-		/* ResetEvent(c->wake_scheduled_sleep); */
-	}
 }
-#else	/* pthreads prepare_child_sems() follows */
-{
-	size_t	octets;
-
-	if (NULL == c->blocking_req_ready) {
-		octets = sizeof(*c->blocking_req_ready);
-		octets += sizeof(*c->wake_scheduled_sleep);
-		/* !!!! octets += sizeof(*c->child_is_blocking); */
-		c->blocking_req_ready = emalloc_zero(octets);;
-		c->wake_scheduled_sleep = 1 + c->blocking_req_ready;
-		/* !!!! c->child_is_blocking = 1 + c->wake_scheduled_sleep; */
-	} else {
-		sem_destroy(c->blocking_req_ready);
-		sem_destroy(c->wake_scheduled_sleep);
-		/* !!!! sem_destroy(c->child_is_blocking); */
-	}
-	sem_init(c->blocking_req_ready, FALSE, 0);
-	sem_init(c->wake_scheduled_sleep, FALSE, 0);
-	/* !!!! sem_init(c->child_is_blocking, FALSE, 0); */
-}
-#endif
-
 
+/* --------------------------------------------------------------------
+ * wait for semaphore. Where the wait can be interrupted, it will
+ * internally resume -- When this function returns, there is either no
+ * semaphore at all, a timeout occurred, or the caller could
+ * successfully take a token from the semaphore.
+ *
+ * For untimed wait, not checking the result of this function at all is
+ * definitely an option.
+ */
 static int
 wait_for_sem(
 	sem_ref			sem,
@@ -605,6 +713,11 @@ wait_for_sem(
 	DWORD		msec;
 	DWORD		rc;
 
+	if (!(sem && sem->shnd)) {
+		errno = EINVAL;
+		return -1;
+	}
+	
 	if (NULL == timeout) {
 		msec = INFINITE;
 	} else {
@@ -619,7 +732,7 @@ wait_for_sem(
 			msec += delta.tv_nsec / (1000 * 1000);
 		}
 	}
-	rc = WaitForSingleObject(sem, msec);
+	rc = WaitForSingleObject(sem->shnd, msec);
 	if (WAIT_OBJECT_0 == rc)
 		return 0;
 	if (WAIT_TIMEOUT == rc) {
@@ -632,24 +745,28 @@ wait_for_sem(
 }
 #else	/* pthreads wait_for_sem() follows */
 {
-	int rc;
+	int rc = -1;
 
-	if (NULL == timeout)
+	if (sem) do {
-		rc = sem_wait(sem);
+			if (NULL == timeout)
+				rc = sem_wait(sem);
+			else
+				rc = sem_timedwait(sem, timeout);
+		} while (rc == -1 && errno == EINTR);
 	else
-		rc = sem_timedwait(sem, timeout);
+		errno = EINVAL;
 		
 	return rc;
 }
 #endif
 
-
+/* --------------------------------------------------------------------
-/*
+ * blocking_thread - thread functions have WINAPI (aka 'stdcall')
- * blocking_thread - thread functions have WINAPI calling convention
+ * calling conventions under Windows and POSIX-defined signature
+ * otherwise.
  */
 #ifdef SYS_WINNT
-u_int
+u_int WINAPI
-WINAPI
 #else
 void *
 #endif
@@ -666,20 +783,28 @@ blocking_thread(
 	return 0;
 }
 
-
+/* --------------------------------------------------------------------
-/*
  * req_child_exit() runs in the parent.
+ *
+ * This function is called from from the idle timer, too, and possibly
+ * without a thread being there any longer. Since we have folded up our
+ * tent in that case and all the semaphores are already gone, we simply
+ * ignore this request in this case.
+ *
+ * Since the existence of the semaphores is controlled exclusively by
+ * the parent, there's no risk of data race here.
  */
 int
 req_child_exit(
 	blocking_child *c
 	)
 {
-	return queue_req_pointer(c, CHILD_EXIT_REQ);
+	return (c->accesslock)
+	    ? queue_req_pointer(c, CHILD_EXIT_REQ)
+	    : 0;
 }
 
-
+/* --------------------------------------------------------------------
-/*
  * cleanup_after_child() runs in parent.
  */
 static void
@@ -687,17 +812,27 @@ cleanup_after_child(
 	blocking_child *	c
 	)
 {
-	u_int	idx;
-
 	DEBUG_INSIST(!c->reusable);
-#ifdef SYS_WINNT
+	
-	INSIST(CloseHandle(c->thread_ref));
+#   ifdef SYS_WINNT
-#else
+	/* The thread was not created in detached state, so we better
-	free(c->thread_ref);
+	 * clean up.
-#endif
+	 */
+	if (c->thread_ref && c->thread_ref->thnd) {
+		WaitForSingleObject(c->thread_ref->thnd, INFINITE);
+		INSIST(CloseHandle(c->thread_ref->thnd));
+		c->thread_ref->thnd = NULL;
+	}
+#   endif
 	c->thread_ref = NULL;
-	c->thread_id = 0;
+
-#ifdef WORK_PIPE
+	/* remove semaphores and (if signalling vi IO) pipes */
+	
+	c->accesslock           = delete_sema(c->accesslock);
+	c->workitems_pending    = delete_sema(c->workitems_pending);
+	c->wake_scheduled_sleep = delete_sema(c->wake_scheduled_sleep);
+
+#   ifdef WORK_PIPE
 	DEBUG_INSIST(-1 != c->resp_read_pipe);
 	DEBUG_INSIST(-1 != c->resp_write_pipe);
 	(*addremove_io_fd)(c->resp_read_pipe, c->ispipe, TRUE);
@@ -705,18 +840,22 @@ cleanup_after_child(
 	close(c->resp_read_pipe);
 	c->resp_write_pipe = -1;
 	c->resp_read_pipe = -1;
-#else
+#   else
-	DEBUG_INSIST(NULL != c->blocking_response_ready);
+	DEBUG_INSIST(NULL != c->responses_pending);
-	(*addremove_io_semaphore)(c->blocking_response_ready, TRUE);
+	(*addremove_io_semaphore)(c->responses_pending->shnd, TRUE);
-#endif
+	c->responses_pending = delete_sema(c->responses_pending);
-	for (idx = 0; idx < c->workitems_alloc; idx++)
+#   endif
-		c->workitems[idx] = NULL;
+
-	c->next_workitem = 0;
+	/* Is it necessary to check if there are pending requests and
-	c->next_workeritem = 0;
+	 * responses? If so, and if there are, what to do with them?
-	for (idx = 0; idx < c->responses_alloc; idx++)
+	 */
-		c->responses[idx] = NULL;
+	
-	c->next_response = 0;
+	/* re-init buffer index sequencers */
-	c->next_workresp = 0;
+	c->head_workitem = 0;
+	c->tail_workitem = 0;
+	c->head_response = 0;
+	c->tail_response = 0;
+
 	c->reusable = TRUE;
 }
 

contrib/ntp/libparse/clk_computime.c

@@ -157,7 +157,7 @@ inp_computime(
 {
 	unsigned int rtc;
 
-	parseprintf(DD_PARSE, ("inp_computime(0x%lx, 0x%x, ...)\n", (long)parseio, ch));
+	parseprintf(DD_PARSE, ("inp_computime(0x%p, 0x%x, ...)\n", (void*)parseio, ch));
 
 	switch (ch)
 	{

contrib/ntp/libparse/clk_dcf7000.c

@@ -158,7 +158,7 @@ inp_dcf7000(
 {
 	unsigned int rtc;
 
-	parseprintf(DD_PARSE, ("inp_dcf7000(0x%lx, 0x%x, ...)\n", (long)parseio, ch));
+	parseprintf(DD_PARSE, ("inp_dcf7000(0x%p, 0x%x, ...)\n", (void*)parseio, ch));
 
 	switch (ch)
 	{

contrib/ntp/libparse/clk_hopf6021.c

@@ -227,7 +227,7 @@ inp_hopf6021(
 {
 	unsigned int rtc;
 
-	parseprintf(DD_PARSE, ("inp_hopf6021(0x%lx, 0x%x, ...)\n", (long)parseio, ch));
+	parseprintf(DD_PARSE, ("inp_hopf6021(0x%p, 0x%x, ...)\n", (void*)parseio, ch));
 
 	switch (ch)
 	{

contrib/ntp/libparse/clk_meinberg.c

@@ -434,7 +434,7 @@ mbg_input(
 {
 	unsigned int rtc;
 
-	parseprintf(DD_PARSE, ("mbg_input(0x%lx, 0x%x, ...)\n", (long)parseio, ch));
+	parseprintf(DD_PARSE, ("mbg_input(0x%p, 0x%x, ...)\n", (void*)parseio, ch));
 
 	switch (ch)
 	{
@@ -602,7 +602,7 @@ gps_input(
 
   msg_buf = (struct msg_buf *)parseio->parse_pdata;
 
-  parseprintf(DD_PARSE, ("gps_input(0x%lx, 0x%x, ...)\n", (long)parseio, ch));
+  parseprintf(DD_PARSE, ("gps_input(0x%p, 0x%x, ...)\n", (void*)parseio, ch));
 
   if (!msg_buf)
     return PARSE_INP_SKIP;

contrib/ntp/libparse/clk_rawdcf.c

@@ -627,7 +627,7 @@ inp_rawdcf(
 {
 	static struct timeval timeout = { 1, 500000 }; /* 1.5 secongs denote second #60 */
 
-	parseprintf(DD_PARSE, ("inp_rawdcf(0x%lx, 0x%x, ...)\n", (long)parseio, ch));
+	parseprintf(DD_PARSE, ("inp_rawdcf(0x%p, 0x%x, ...)\n", (void*)parseio, ch));
 
 	parseio->parse_dtime.parse_stime = *tstamp; /* collect timestamp */
 

contrib/ntp/libparse/clk_rcc8000.c

@@ -141,7 +141,7 @@ inp_rcc8000(
 {
 	unsigned int rtc;
 
-	parseprintf(DD_PARSE, ("inp_rcc8000(0x%lx, 0x%x, ...)\n", (long)parseio, ch));
+	parseprintf(DD_PARSE, ("inp_rcc8000(0x%p, 0x%x, ...)\n", (void*)parseio, ch));
 
 	switch (ch)
 	{

contrib/ntp/libparse/clk_schmid.c

@@ -205,7 +205,7 @@ inp_schmid(
 {
 	unsigned int rtc;
 
-	parseprintf(DD_PARSE, ("inp_schmid(0x%lx, 0x%x, ...)\n", (long)parseio, ch));
+	parseprintf(DD_PARSE, ("inp_schmid(0x%p, 0x%x, ...)\n", (void*)parseio, ch));
 
 	switch ((uint8_t)ch)
 	{

contrib/ntp/libparse/clk_trimtaip.c

@@ -155,7 +155,7 @@ inp_trimtaip(
 {
 	unsigned int rtc;
 
-	parseprintf(DD_PARSE, ("inp_trimtaip(0x%lx, 0x%x, ...)\n", (long)parseio, ch));
+	parseprintf(DD_PARSE, ("inp_trimtaip(0x%p, 0x%x, ...)\n", (void*)parseio, ch));
 
 	switch (ch)
 	{

contrib/ntp/libparse/clk_varitext.c

@@ -58,12 +58,12 @@
 extern int printf (const char *, ...);
 #endif
 
-static const u_char VT_INITIALISED      = 0x01;
+/* static const u_char VT_INITIALISED      = 0x01; */
-static const u_char VT_SYNCHRONISED     = 0x02;
+/* static const u_char VT_SYNCHRONISED     = 0x02; */
-static const u_char VT_ALARM_STATE      = 0x04;
+/* static const u_char VT_ALARM_STATE      = 0x04; */
 static const u_char VT_BST              = 0x08;
-static const u_char VT_SEASON_CHANGE    = 0x10;
+/* static const u_char VT_SEASON_CHANGE    = 0x10; */
-static const u_char VT_LAST_TELEGRAM_OK = 0x20;
+/* static const u_char VT_LAST_TELEGRAM_OK = 0x20; */
 
 /*
  * The Varitext receiver sends a datagram in the following format every minute
@@ -195,7 +195,7 @@ inp_varitext(
   struct varitext *t = (struct varitext *)parseio->parse_pdata;
   int    rtc;
 
-  parseprintf(DD_PARSE, ("inp_varitext(0x%lx, 0x%x, ...)\n", (long)parseio, ch));
+  parseprintf(DD_PARSE, ("inp_varitext(0x%p, 0x%x, ...)\n", (void*)parseio, ch));
 
   if (!t)
     return PARSE_INP_SKIP;	/* local data not allocated - sigh! */

contrib/ntp/libparse/clk_wharton.c

@@ -137,7 +137,7 @@ inp_wharton_400a(
 {
 	unsigned int rtc;
 	
-	parseprintf(DD_PARSE, ("inp_wharton_400a(0x%lx, 0x%x, ...)\n", (long)parseio, ch));
+	parseprintf(DD_PARSE, ("inp_wharton_400a(0x%p, 0x%x, ...)\n", (void*)parseio, ch));
 	
 	switch (ch)
 	{

contrib/ntp/libparse/parse.c

@@ -288,7 +288,7 @@ parse_ioread(
 		break;
 	}
 
-	parseprintf(DD_PARSE, ("parse_ioread(0x%lx, char=0x%x, ..., ...)\n", (unsigned long)parseio, ch & 0xFF));
+	parseprintf(DD_PARSE, ("parse_ioread(0x%p, char=0x%x, ..., ...)\n", (void*)parseio, ch & 0xFF));
 
 	if (!clockformats[parseio->parse_lformat]->convert)
 	{

contrib/ntp/ntpd/invoke-ntp.conf.texi

@@ -6,7 +6,7 @@
 #
 # EDIT THIS FILE WITH CAUTION  (invoke-ntp.conf.texi)
 #
-# It has been AutoGen-ed  October 21, 2015 at 12:38:16 PM by AutoGen 5.18.5
+# It has been AutoGen-ed  January  7, 2016 at 11:30:49 PM by AutoGen 5.18.5
 # From the definitions    ntp.conf.def
 # and the template file   agtexi-file.tpl
 @end ignore

contrib/ntp/ntpd/invoke-ntp.keys.texi

@@ -6,7 +6,7 @@
 #
 # EDIT THIS FILE WITH CAUTION  (invoke-ntp.keys.texi)
 #
-# It has been AutoGen-ed  October 21, 2015 at 12:38:19 PM by AutoGen 5.18.5
+# It has been AutoGen-ed  January  7, 2016 at 11:30:52 PM by AutoGen 5.18.5
 # From the definitions    ntp.keys.def
 # and the template file   agtexi-file.tpl
 @end ignore

contrib/ntp/ntpd/invoke-ntpd.texi

@@ -6,7 +6,7 @@
 #
 # EDIT THIS FILE WITH CAUTION  (invoke-ntpd.texi)
 #
-# It has been AutoGen-ed  October 21, 2015 at 12:38:21 PM by AutoGen 5.18.5
+# It has been AutoGen-ed  January  7, 2016 at 11:30:54 PM by AutoGen 5.18.5
 # From the definitions    ntpd-opts.def
 # and the template file   agtexi-cmd.tpl
 @end ignore
@@ -142,7 +142,7 @@ with a status code of 0.
 
 @exampleindent 0
 @example
-ntpd - NTP daemon program - Ver. 4.2.8p4
+ntpd - NTP daemon program - Ver. 4.2.8p5
 Usage:  ntpd [ -<flag> [<val>] | --<name>[@{=| @}<val>] ]... \
                 [ <server1> ... <serverN> ]
   Flg Arg Option-Name    Description

contrib/ntp/ntpd/ntp.conf.5man

@@ -10,11 +10,11 @@
 .ds B-Font B
 .ds I-Font I
 .ds R-Font R
-.TH ntp.conf 5man "21 Oct 2015" "4.2.8p4" "File Formats"
+.TH ntp.conf 5man "07 Jan 2016" "4.2.8p5" "File Formats"
 .\"
-.\" EDIT THIS FILE WITH CAUTION (/tmp/.ag-9oaqYI/ag-OpaiXI)
+.\" EDIT THIS FILE WITH CAUTION (/tmp/.ag-8qayqp/ag-Vraqpp)
 .\"
-.\" It has been AutoGen-ed October 21, 2015 at 12:38:01 PM by AutoGen 5.18.5
+.\" It has been AutoGen-ed January 7, 2016 at 11:30:35 PM by AutoGen 5.18.5
 .\" From the definitions ntp.conf.def
 .\" and the template file agman-cmd.tpl
 .SH NAME

contrib/ntp/ntpd/ntp.conf.5mdoc

@@ -1,9 +1,9 @@
-.Dd October 21 2015
+.Dd January 7 2016
 .Dt NTP_CONF 5mdoc File Formats
 .Os
 .\"  EDIT THIS FILE WITH CAUTION  (ntp.mdoc)
 .\"
-.\"  It has been AutoGen-ed  October 21, 2015 at 12:38:24 PM by AutoGen 5.18.5
+.\"  It has been AutoGen-ed  January  7, 2016 at 11:30:57 PM by AutoGen 5.18.5
 .\"  From the definitions    ntp.conf.def
 .\"  and the template file   agmdoc-cmd.tpl
 .Sh NAME

contrib/ntp/ntpd/ntp.conf.html

@@ -33,7 +33,7 @@ Up:&nbsp;<a rel="up" accesskey="u" href="#dir">(dir)</a>
 <p>This document describes the configuration file for the NTP Project's
 <code>ntpd</code> program.
 
-  <p>This document applies to version 4.2.8p4 of <code>ntp.conf</code>.
+  <p>This document applies to version 4.2.8p5 of <code>ntp.conf</code>.
 
   <div class="shortcontents">
 <h2>Short Contents</h2>

contrib/ntp/ntpd/ntp.conf.man.in

@@ -10,11 +10,11 @@
 .ds B-Font B
 .ds I-Font I
 .ds R-Font R
-.TH ntp.conf 5 "21 Oct 2015" "4.2.8p4" "File Formats"
+.TH ntp.conf 5 "07 Jan 2016" "4.2.8p5" "File Formats"
 .\"
-.\" EDIT THIS FILE WITH CAUTION (/tmp/.ag-9oaqYI/ag-OpaiXI)
+.\" EDIT THIS FILE WITH CAUTION (/tmp/.ag-8qayqp/ag-Vraqpp)
 .\"
-.\" It has been AutoGen-ed October 21, 2015 at 12:38:01 PM by AutoGen 5.18.5
+.\" It has been AutoGen-ed January 7, 2016 at 11:30:35 PM by AutoGen 5.18.5
 .\" From the definitions ntp.conf.def
 .\" and the template file agman-cmd.tpl
 .SH NAME

contrib/ntp/ntpd/ntp.conf.mdoc.in

@@ -1,9 +1,9 @@
-.Dd October 21 2015
+.Dd January 7 2016
 .Dt NTP_CONF 5 File Formats
 .Os
 .\"  EDIT THIS FILE WITH CAUTION  (ntp.mdoc)
 .\"
-.\"  It has been AutoGen-ed  October 21, 2015 at 12:38:24 PM by AutoGen 5.18.5
+.\"  It has been AutoGen-ed  January  7, 2016 at 11:30:57 PM by AutoGen 5.18.5
 .\"  From the definitions    ntp.conf.def
 .\"  and the template file   agmdoc-cmd.tpl
 .Sh NAME

contrib/ntp/ntpd/ntp.keys.5man

@@ -1,8 +1,8 @@
-.TH ntp.keys 5man "21 Oct 2015" "4.2.8p4" "File Formats"
+.TH ntp.keys 5man "07 Jan 2016" "4.2.8p5" "File Formats"
 .\"
 .\"  EDIT THIS FILE WITH CAUTION  (ntp.man)
 .\"
-.\"  It has been AutoGen-ed  October 21, 2015 at 12:38:08 PM by AutoGen 5.18.5
+.\"  It has been AutoGen-ed  January  7, 2016 at 11:30:41 PM by AutoGen 5.18.5
 .\"  From the definitions    ntp.keys.def
 .\"  and the template file   agman-file.tpl
 .Sh NAME

contrib/ntp/ntpd/ntp.keys.5mdoc

@@ -1,9 +1,9 @@
-.Dd October 21 2015
+.Dd January 7 2016
 .Dt NTP_KEYS 5mdoc File Formats
 .Os SunOS 5.10
 .\"  EDIT THIS FILE WITH CAUTION  (ntp.mdoc)
 .\"
-.\"  It has been AutoGen-ed  October 21, 2015 at 12:38:28 PM by AutoGen 5.18.5
+.\"  It has been AutoGen-ed  January  7, 2016 at 11:31:00 PM by AutoGen 5.18.5
 .\"  From the definitions    ntp.keys.def
 .\"  and the template file   agmdoc-file.tpl
 .Sh NAME

contrib/ntp/ntpd/ntp.keys.html

@@ -33,7 +33,7 @@ Up:&nbsp;<a rel="up" accesskey="u" href="#dir">(dir)</a>
 <p>This document describes the symmetric key file for the NTP Project's
 <code>ntpd</code> program.
 
-  <p>This document applies to version 4.2.8p4 of <code>ntp.keys</code>.
+  <p>This document applies to version 4.2.8p5 of <code>ntp.keys</code>.
 
   <div class="shortcontents">
 <h2>Short Contents</h2>

contrib/ntp/ntpd/ntp.keys.man.in

@@ -1,8 +1,8 @@
-.TH ntp.keys 5 "21 Oct 2015" "4.2.8p4" "File Formats"
+.TH ntp.keys 5 "07 Jan 2016" "4.2.8p5" "File Formats"
 .\"
 .\"  EDIT THIS FILE WITH CAUTION  (ntp.man)
 .\"
-.\"  It has been AutoGen-ed  October 21, 2015 at 12:38:08 PM by AutoGen 5.18.5
+.\"  It has been AutoGen-ed  January  7, 2016 at 11:30:41 PM by AutoGen 5.18.5
 .\"  From the definitions    ntp.keys.def
 .\"  and the template file   agman-file.tpl
 .Sh NAME

contrib/ntp/ntpd/ntp.keys.mdoc.in

@@ -1,9 +1,9 @@
-.Dd October 21 2015
+.Dd January 7 2016
 .Dt NTP_KEYS 5 File Formats
 .Os SunOS 5.10
 .\"  EDIT THIS FILE WITH CAUTION  (ntp.mdoc)
 .\"
-.\"  It has been AutoGen-ed  October 21, 2015 at 12:38:28 PM by AutoGen 5.18.5
+.\"  It has been AutoGen-ed  January  7, 2016 at 11:31:00 PM by AutoGen 5.18.5
 .\"  From the definitions    ntp.keys.def
 .\"  and the template file   agmdoc-file.tpl
 .Sh NAME

contrib/ntp/ntpd/ntp_control.c

@@ -850,7 +850,7 @@ ctl_error(
 	u_char errcode
 	)
 {
-	int		maclen;
+	size_t		maclen;
 
 	numctlerrors++;
 	DPRINTF(3, ("sending control error %u\n", errcode));
@@ -1252,10 +1252,10 @@ ctl_flushpkt(
 	)
 {
 	size_t i;
-	int dlen;
+	size_t dlen;
-	int sendlen;
+	size_t sendlen;
-	int maclen;
+	size_t maclen;
-	int totlen;
+	size_t totlen;
 	keyid_t keyid;
 
 	dlen = datapt - rpkt.u.data;

contrib/ntp/ntpd/ntp_crypto.c

@@ -473,9 +473,9 @@ crypto_recv(
 		}
 
 		/* Check if the declared size fits into the remaining
-		 * buffer.
+		 * buffer. We *know* 'macbytes' > 0 here!
 		 */
-		if (len > macbytes) {
+		if (len > (u_int)macbytes) {
 			DPRINTF(1, ("crypto_recv: possible attack detected, associd %d\n",
 				    associd));
 			return XEVNT_LEN;

contrib/ntp/ntpd/ntp_io.c

@@ -41,6 +41,7 @@
 #include "timevalops.h"
 #include "timespecops.h"
 #include "ntpd-opts.h"
+#include "safecast.h"
 
 /* Don't include ISC's version of IPv6 variables and structures */
 #define ISC_IPV6_H 1
@@ -772,7 +773,7 @@ is_ip_address(
 			hints.ai_flags |= AI_NUMERICHOST;
 			if (getaddrinfo(tmpbuf, NULL, &hints, &result) == 0) {
 				AF(addr) = AF_INET6;
-				resaddr6 = (struct sockaddr_in6 *)result->ai_addr;
+				resaddr6 = UA_PTR(struct sockaddr_in6, result->ai_addr);
 				SET_ADDR6N(addr, resaddr6->sin6_addr);
 				SET_SCOPE(addr, resaddr6->sin6_scope_id);
 
@@ -3365,7 +3366,7 @@ fetch_timestamp(
 #endif  /* HAVE_BINTIME */
 #ifdef HAVE_TIMESTAMPNS
 			case SCM_TIMESTAMPNS:
-				tsp = (struct timespec *)CMSG_DATA(cmsghdr);
+				tsp = UA_PTR(struct timespec, CMSG_DATA(cmsghdr));
 				if (sys_tick > measured_tick &&
 				    sys_tick > 1e-9) {
 					ticks = (unsigned long)((tsp->tv_nsec * 1e-9) /
@@ -3666,8 +3667,7 @@ input_handler(
 	fds = activefds;
 	tvzero.tv_sec = tvzero.tv_usec = 0;
 
-	n = select(maxactivefd + 1, &fds, (fd_set *)0, (fd_set *)0,
+	n = select(maxactivefd + 1, &fds, NULL, NULL, &tvzero);
-		   &tvzero);
 
 	/*
 	 * If there are no packets waiting just return
@@ -4447,7 +4447,7 @@ close_and_delete_fd_from_list(
 		break;
 
 	case FD_TYPE_FILE:
-		closeserial(lsock->fd);
+		closeserial((int)lsock->fd);
 		break;
 
 	default:
@@ -4643,7 +4643,7 @@ process_routing_msgs(struct asyncio_reader *reader)
 	 * process routing message
 	 */
 #ifdef HAVE_RTNETLINK
-	for (nh = (struct nlmsghdr *)buffer;
+	for (nh = UA_PTR(struct nlmsghdr, buffer);
 	     NLMSG_OK(nh, cnt);
 	     nh = NLMSG_NEXT(nh, cnt)) {
 		msg_type = nh->nlmsg_type;

contrib/ntp/ntpd/ntp_loopfilter.c

@@ -154,7 +154,6 @@ int	hardpps_enable;		/* kernel PPS discipline enabled */
 int	ext_enable;		/* external clock enabled */
 int	pps_stratum;		/* pps stratum */
 int	kernel_status;		/* from ntp_adjtime */
-int	allow_panic = FALSE;	/* allow panic correction (-g) */
 int	force_step_once = FALSE; /* always step time once at startup (-G) */
 int	mode_ntpdate = FALSE;	/* exit on first clock set (-q) */
 int	freq_cnt;		/* initial frequency clamp */
@@ -459,16 +458,16 @@ local_clock(
 	double	dtemp, etemp;	/* double temps */
 	char	tbuf[80];	/* report buffer */
 
+	(void)ntp_adj_ret; /* not always used below... */
 	/*
 	 * If the loop is opened or the NIST LOCKCLOCK is in use,
 	 * monitor and record the offsets anyway in order to determine
 	 * the open-loop response and then go home.
 	 */
-#ifdef LOCKCLOCK
+#ifndef LOCKCLOCK
+	if (!ntp_enable)
+#endif /* not LOCKCLOCK */
 	{
-#else
-	if (!ntp_enable) {
-#endif /* LOCKCLOCK */
 		record_loop_stats(fp_offset, drift_comp, clock_jitter,
 		    clock_stability, sys_poll);
 		return (0);
@@ -493,6 +492,8 @@ local_clock(
 		return (-1);
 	}
 
+	allow_panic = FALSE;
+
 	/*
 	 * This section simulates ntpdate. If the offset exceeds the
 	 * step threshold (128 ms), step the clock to that time and
@@ -538,12 +539,8 @@ local_clock(
 		else
 			dtemp = (peer->delay - sys_mindly) / 2;
 		fp_offset += dtemp;
-#ifdef DEBUG
+		DPRINTF(1, ("local_clock: size %d mindly %.6f huffpuff %.6f\n",
-		if (debug)
+			    sys_hufflen, sys_mindly, dtemp));
-			printf(
-		    "local_clock: size %d mindly %.6f huffpuff %.6f\n",
-			    sys_hufflen, sys_mindly, dtemp);
-#endif
 	}
 
 	/*
@@ -694,7 +691,6 @@ local_clock(
 		 * startup until the initial transient has subsided.
 		 */
 		default:
-			allow_panic = FALSE;
 			if (freq_cnt == 0) {
 
 				/*
@@ -921,15 +917,11 @@ local_clock(
 	 */
 	record_loop_stats(clock_offset, drift_comp, clock_jitter,
 	    clock_stability, sys_poll);
-#ifdef DEBUG
+	DPRINTF(1, ("local_clock: offset %.9f jit %.9f freq %.3f stab %.3f poll %d\n",
-	if (debug)
-		printf(
-		    "local_clock: offset %.9f jit %.9f freq %.3f stab %.3f poll %d\n",
 		    clock_offset, clock_jitter, drift_comp * 1e6,
-		    clock_stability * 1e6, sys_poll);
+		    clock_stability * 1e6, sys_poll));
-#endif /* DEBUG */
 	return (rval);
-#endif /* LOCKCLOCK */
+#endif /* not LOCKCLOCK */
 }
 
 
@@ -1005,7 +997,10 @@ adj_host_clock(
 	 * but does not automatically stop slewing when an offset
 	 * has decayed to zero.
 	 */
+	DEBUG_INSIST(enable_panic_check == TRUE);
+	enable_panic_check = FALSE;
 	adj_systime(offset_adj + freq_adj);
+	enable_panic_check = TRUE;
 #endif /* LOCKCLOCK */
 }
 
@@ -1019,12 +1014,9 @@ rstclock(
 	double	offset		/* new offset */
 	)
 {
-#ifdef DEBUG
+	DPRINTF(2, ("rstclock: mu %lu state %d poll %d count %d\n",
-	if (debug > 1)
-		printf("local_clock: mu %lu state %d poll %d count %d\n",
 		    current_time - clock_epoch, trans, sys_poll,
-		    tc_counter);
+		    tc_counter));
-#endif
 	if (trans != state && trans != EVNT_FSET)
 		report_event(trans, NULL, NULL);
 	state = trans;
@@ -1075,6 +1067,7 @@ set_freq(
 	const char *	loop_desc;
 	int ntp_adj_ret;
 
+	(void)ntp_adj_ret; /* not always used below... */
 	drift_comp = freq;
 	loop_desc = "ntpd";
 #ifdef KERNEL_PLL
@@ -1236,10 +1229,7 @@ loop_config(
 	int	i;
 	double	ftemp;
 
-#ifdef DEBUG
+	DPRINTF(2, ("loop_config: item %d freq %f\n", item, freq));
-	if (debug > 1)
-		printf("loop_config: item %d freq %f\n", item, freq);
-#endif
 	switch (item) {
 
 	/*

contrib/ntp/ntpd/ntp_parser.c

@@ -889,21 +889,21 @@ static const yytype_uint16 yyrline[] =
      872,   873,   874,   875,   876,   877,   878,   879,   880,   881,
      882,   886,   891,   899,   904,   905,   906,   910,   915,   923,
      928,   929,   930,   931,   932,   933,   934,   935,   943,   953,
-     958,   966,   968,   970,   972,   974,   979,   980,   984,   985,
+     958,   966,   968,   970,   979,   981,   986,   987,   991,   992,
-     986,   987,   995,  1000,  1005,  1013,  1018,  1019,  1020,  1029,
+     993,   994,  1002,  1007,  1012,  1020,  1025,  1026,  1027,  1036,
-    1031,  1036,  1041,  1049,  1051,  1068,  1069,  1070,  1071,  1072,
+    1038,  1043,  1048,  1056,  1058,  1075,  1076,  1077,  1078,  1079,
-    1073,  1077,  1078,  1086,  1091,  1096,  1104,  1109,  1110,  1111,
+    1080,  1084,  1085,  1093,  1098,  1103,  1111,  1116,  1117,  1118,
-    1112,  1113,  1114,  1115,  1116,  1117,  1118,  1127,  1128,  1129,
+    1119,  1120,  1121,  1122,  1123,  1124,  1125,  1134,  1135,  1136,
-    1136,  1143,  1150,  1166,  1185,  1187,  1189,  1191,  1193,  1195,
+    1143,  1150,  1157,  1173,  1192,  1194,  1196,  1198,  1200,  1202,
-    1202,  1207,  1208,  1209,  1213,  1217,  1226,  1227,  1231,  1232,
+    1209,  1214,  1215,  1216,  1220,  1224,  1233,  1234,  1238,  1239,
-    1233,  1237,  1248,  1262,  1274,  1279,  1281,  1286,  1287,  1295,
+    1240,  1244,  1255,  1269,  1281,  1286,  1288,  1293,  1294,  1302,
-    1297,  1305,  1310,  1318,  1343,  1350,  1360,  1361,  1365,  1366,
+    1304,  1312,  1317,  1325,  1350,  1357,  1367,  1368,  1372,  1373,
-    1367,  1368,  1372,  1373,  1374,  1378,  1383,  1388,  1396,  1397,
+    1374,  1375,  1379,  1380,  1381,  1385,  1390,  1395,  1403,  1404,
-    1398,  1399,  1400,  1401,  1402,  1412,  1417,  1425,  1430,  1438,
+    1405,  1406,  1407,  1408,  1409,  1419,  1424,  1432,  1437,  1445,
-    1440,  1444,  1449,  1454,  1462,  1467,  1475,  1484,  1485,  1489,
+    1447,  1451,  1456,  1461,  1469,  1474,  1482,  1491,  1492,  1496,
-    1490,  1499,  1517,  1521,  1526,  1534,  1539,  1540,  1544,  1549,
+    1497,  1506,  1524,  1528,  1533,  1541,  1546,  1547,  1551,  1556,
-    1557,  1562,  1567,  1572,  1577,  1585,  1590,  1595,  1603,  1608,
+    1564,  1569,  1574,  1579,  1584,  1592,  1597,  1602,  1610,  1615,
-    1609,  1610,  1611,  1612
+    1616,  1617,  1618,  1619
 };
 #endif
 
@@ -2684,90 +2684,97 @@ yyparse (void)
 
   case 173:
 #line 971 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
-    { (yyval.Attr_val) = create_attr_ival((yyvsp[-1].Integer), (yyvsp[0].Integer)); }
+    {
-#line 2689 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+			if ((yyvsp[0].Integer) >= 0 && (yyvsp[0].Integer) <= 16) {
+				(yyval.Attr_val) = create_attr_ival((yyvsp[-1].Integer), (yyvsp[0].Integer));
+			} else {
+				(yyval.Attr_val) = NULL;
+				yyerror("fudge factor: stratum value not in [0..16], ignored");
+			}
+		}
+#line 2696 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 174:
-#line 973 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 980 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     { (yyval.Attr_val) = create_attr_sval((yyvsp[-1].Integer), (yyvsp[0].String)); }
-#line 2695 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 2702 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 175:
-#line 975 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 982 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     { (yyval.Attr_val) = create_attr_sval((yyvsp[-1].Integer), (yyvsp[0].String)); }
-#line 2701 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 2708 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 182:
-#line 996 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1003 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     { CONCAT_G_FIFOS(cfgt.rlimit, (yyvsp[0].Attr_val_fifo)); }
-#line 2707 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 2714 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 183:
-#line 1001 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1008 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			(yyval.Attr_val_fifo) = (yyvsp[-1].Attr_val_fifo);
 			APPEND_G_FIFO((yyval.Attr_val_fifo), (yyvsp[0].Attr_val));
 		}
-#line 2716 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 2723 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 184:
-#line 1006 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1013 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			(yyval.Attr_val_fifo) = NULL;
 			APPEND_G_FIFO((yyval.Attr_val_fifo), (yyvsp[0].Attr_val));
 		}
-#line 2725 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 2732 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 185:
-#line 1014 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1021 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     { (yyval.Attr_val) = create_attr_ival((yyvsp[-1].Integer), (yyvsp[0].Integer)); }
-#line 2731 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 2738 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 189:
-#line 1030 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1037 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     { CONCAT_G_FIFOS(cfgt.enable_opts, (yyvsp[0].Attr_val_fifo)); }
-#line 2737 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 2744 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 190:
-#line 1032 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1039 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     { CONCAT_G_FIFOS(cfgt.disable_opts, (yyvsp[0].Attr_val_fifo)); }
-#line 2743 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 2750 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 191:
-#line 1037 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1044 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			(yyval.Attr_val_fifo) = (yyvsp[-1].Attr_val_fifo);
 			APPEND_G_FIFO((yyval.Attr_val_fifo), (yyvsp[0].Attr_val));
 		}
-#line 2752 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 2759 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 192:
-#line 1042 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1049 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			(yyval.Attr_val_fifo) = NULL;
 			APPEND_G_FIFO((yyval.Attr_val_fifo), (yyvsp[0].Attr_val));
 		}
-#line 2761 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 2768 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 193:
-#line 1050 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1057 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     { (yyval.Attr_val) = create_attr_ival(T_Flag, (yyvsp[0].Integer)); }
-#line 2767 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 2774 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 194:
-#line 1052 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1059 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			if (lex_from_file()) {
 				(yyval.Attr_val) = create_attr_ival(T_Flag, (yyvsp[0].Integer));
@@ -2781,74 +2788,74 @@ yyparse (void)
 				yyerror(err_str);
 			}
 		}
-#line 2785 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 2792 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 203:
-#line 1087 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1094 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     { CONCAT_G_FIFOS(cfgt.tinker, (yyvsp[0].Attr_val_fifo)); }
-#line 2791 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 2798 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 204:
-#line 1092 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1099 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			(yyval.Attr_val_fifo) = (yyvsp[-1].Attr_val_fifo);
 			APPEND_G_FIFO((yyval.Attr_val_fifo), (yyvsp[0].Attr_val));
 		}
-#line 2800 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 2807 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 205:
-#line 1097 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1104 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			(yyval.Attr_val_fifo) = NULL;
 			APPEND_G_FIFO((yyval.Attr_val_fifo), (yyvsp[0].Attr_val));
 		}
-#line 2809 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 2816 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 206:
-#line 1105 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1112 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     { (yyval.Attr_val) = create_attr_dval((yyvsp[-1].Integer), (yyvsp[0].Double)); }
-#line 2815 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 2822 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 219:
-#line 1130 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1137 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			attr_val *av;
 
 			av = create_attr_dval((yyvsp[-1].Integer), (yyvsp[0].Double));
 			APPEND_G_FIFO(cfgt.vars, av);
 		}
-#line 2826 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 2833 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 220:
-#line 1137 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1144 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			attr_val *av;
 
 			av = create_attr_ival((yyvsp[-1].Integer), (yyvsp[0].Integer));
 			APPEND_G_FIFO(cfgt.vars, av);
 		}
-#line 2837 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 2844 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 221:
-#line 1144 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1151 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			attr_val *av;
 
 			av = create_attr_sval((yyvsp[-1].Integer), (yyvsp[0].String));
 			APPEND_G_FIFO(cfgt.vars, av);
 		}
-#line 2848 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 2855 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 222:
-#line 1151 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1158 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			char error_text[64];
 			attr_val *av;
@@ -2864,11 +2871,11 @@ yyparse (void)
 				yyerror(error_text);
 			}
 		}
-#line 2868 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 2875 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 223:
-#line 1167 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1174 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			if (!lex_from_file()) {
 				YYFREE((yyvsp[-1].String)); /* avoid leak */
@@ -2887,68 +2894,68 @@ yyparse (void)
 			}
 			YYFREE((yyvsp[-1].String)); /* avoid leak */
 		}
-#line 2891 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 2898 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 224:
-#line 1186 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1193 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     { lex_flush_stack(); }
-#line 2897 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 2904 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 225:
-#line 1188 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1195 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     { /* see drift_parm below for actions */ }
-#line 2903 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 2910 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 226:
-#line 1190 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1197 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     { CONCAT_G_FIFOS(cfgt.logconfig, (yyvsp[0].Attr_val_fifo)); }
-#line 2909 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 2916 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 227:
-#line 1192 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1199 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     { CONCAT_G_FIFOS(cfgt.phone, (yyvsp[0].String_fifo)); }
-#line 2915 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 2922 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 228:
-#line 1194 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1201 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     { APPEND_G_FIFO(cfgt.setvar, (yyvsp[0].Set_var)); }
-#line 2921 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 2928 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 229:
-#line 1196 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1203 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			addr_opts_node *aon;
 
 			aon = create_addr_opts_node((yyvsp[-1].Address_node), (yyvsp[0].Attr_val_fifo));
 			APPEND_G_FIFO(cfgt.trap, aon);
 		}
-#line 2932 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 2939 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 230:
-#line 1203 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1210 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     { CONCAT_G_FIFOS(cfgt.ttl, (yyvsp[0].Attr_val_fifo)); }
-#line 2938 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 2945 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 235:
-#line 1218 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1225 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 #ifndef LEAP_SMEAR
 			yyerror("Built without LEAP_SMEAR support.");
 #endif
 		}
-#line 2948 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 2955 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 241:
-#line 1238 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1245 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			if (lex_from_file()) {
 				attr_val *av;
@@ -2959,11 +2966,11 @@ yyparse (void)
 				yyerror("driftfile remote configuration ignored");
 			}
 		}
-#line 2963 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 2970 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 242:
-#line 1249 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1256 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			if (lex_from_file()) {
 				attr_val *av;
@@ -2976,11 +2983,11 @@ yyparse (void)
 				yyerror("driftfile remote configuration ignored");
 			}
 		}
-#line 2980 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 2987 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 243:
-#line 1262 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1269 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			if (lex_from_file()) {
 				attr_val *av;
@@ -2990,71 +2997,71 @@ yyparse (void)
 				yyerror("driftfile remote configuration ignored");
 			}
 		}
-#line 2994 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3001 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 244:
-#line 1275 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1282 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     { (yyval.Set_var) = create_setvar_node((yyvsp[-3].String), (yyvsp[-1].String), (yyvsp[0].Integer)); }
-#line 3000 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3007 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 246:
-#line 1281 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1288 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     { (yyval.Integer) = 0; }
-#line 3006 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3013 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 247:
-#line 1286 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1293 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     { (yyval.Attr_val_fifo) = NULL; }
-#line 3012 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3019 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 248:
-#line 1288 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1295 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			(yyval.Attr_val_fifo) = (yyvsp[-1].Attr_val_fifo);
 			APPEND_G_FIFO((yyval.Attr_val_fifo), (yyvsp[0].Attr_val));
 		}
-#line 3021 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3028 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 249:
-#line 1296 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1303 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     { (yyval.Attr_val) = create_attr_ival((yyvsp[-1].Integer), (yyvsp[0].Integer)); }
-#line 3027 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3034 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 250:
-#line 1298 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1305 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			(yyval.Attr_val) = create_attr_sval((yyvsp[-1].Integer), estrdup((yyvsp[0].Address_node)->address));
 			destroy_address_node((yyvsp[0].Address_node));
 		}
-#line 3036 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3043 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 251:
-#line 1306 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1313 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			(yyval.Attr_val_fifo) = (yyvsp[-1].Attr_val_fifo);
 			APPEND_G_FIFO((yyval.Attr_val_fifo), (yyvsp[0].Attr_val));
 		}
-#line 3045 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3052 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 252:
-#line 1311 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1318 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			(yyval.Attr_val_fifo) = NULL;
 			APPEND_G_FIFO((yyval.Attr_val_fifo), (yyvsp[0].Attr_val));
 		}
-#line 3054 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3061 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 253:
-#line 1319 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1326 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			char	prefix;
 			char *	type;
@@ -3076,141 +3083,141 @@ yyparse (void)
 			(yyval.Attr_val) = create_attr_sval(prefix, estrdup(type));
 			YYFREE((yyvsp[0].String));
 		}
-#line 3080 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3087 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 254:
-#line 1344 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1351 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			nic_rule_node *nrn;
 
 			nrn = create_nic_rule_node((yyvsp[0].Integer), NULL, (yyvsp[-1].Integer));
 			APPEND_G_FIFO(cfgt.nic_rules, nrn);
 		}
-#line 3091 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3098 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 255:
-#line 1351 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1358 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			nic_rule_node *nrn;
 
 			nrn = create_nic_rule_node(0, (yyvsp[0].String), (yyvsp[-1].Integer));
 			APPEND_G_FIFO(cfgt.nic_rules, nrn);
 		}
-#line 3102 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3109 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 265:
-#line 1379 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1386 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     { CONCAT_G_FIFOS(cfgt.reset_counters, (yyvsp[0].Int_fifo)); }
-#line 3108 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3115 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 266:
-#line 1384 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1391 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			(yyval.Int_fifo) = (yyvsp[-1].Int_fifo);
 			APPEND_G_FIFO((yyval.Int_fifo), create_int_node((yyvsp[0].Integer)));
 		}
-#line 3117 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3124 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 267:
-#line 1389 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1396 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			(yyval.Int_fifo) = NULL;
 			APPEND_G_FIFO((yyval.Int_fifo), create_int_node((yyvsp[0].Integer)));
 		}
-#line 3126 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3133 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 275:
-#line 1413 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1420 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			(yyval.Attr_val_fifo) = (yyvsp[-1].Attr_val_fifo);
 			APPEND_G_FIFO((yyval.Attr_val_fifo), create_int_node((yyvsp[0].Integer)));
 		}
-#line 3135 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3142 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 276:
-#line 1418 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1425 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			(yyval.Attr_val_fifo) = NULL;
 			APPEND_G_FIFO((yyval.Attr_val_fifo), create_int_node((yyvsp[0].Integer)));
 		}
-#line 3144 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3151 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 277:
-#line 1426 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1433 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			(yyval.Attr_val_fifo) = (yyvsp[-1].Attr_val_fifo);
 			APPEND_G_FIFO((yyval.Attr_val_fifo), (yyvsp[0].Attr_val));
 		}
-#line 3153 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3160 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 278:
-#line 1431 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1438 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			(yyval.Attr_val_fifo) = NULL;
 			APPEND_G_FIFO((yyval.Attr_val_fifo), (yyvsp[0].Attr_val));
 		}
-#line 3162 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3169 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 279:
-#line 1439 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1446 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     { (yyval.Attr_val) = create_attr_ival('i', (yyvsp[0].Integer)); }
-#line 3168 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3175 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 281:
-#line 1445 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1452 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     { (yyval.Attr_val) = create_attr_rangeval('-', (yyvsp[-3].Integer), (yyvsp[-1].Integer)); }
-#line 3174 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3181 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 282:
-#line 1450 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1457 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			(yyval.String_fifo) = (yyvsp[-1].String_fifo);
 			APPEND_G_FIFO((yyval.String_fifo), create_string_node((yyvsp[0].String)));
 		}
-#line 3183 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3190 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 283:
-#line 1455 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1462 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			(yyval.String_fifo) = NULL;
 			APPEND_G_FIFO((yyval.String_fifo), create_string_node((yyvsp[0].String)));
 		}
-#line 3192 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3199 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 284:
-#line 1463 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1470 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			(yyval.Address_fifo) = (yyvsp[-1].Address_fifo);
 			APPEND_G_FIFO((yyval.Address_fifo), (yyvsp[0].Address_node));
 		}
-#line 3201 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3208 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 285:
-#line 1468 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1475 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			(yyval.Address_fifo) = NULL;
 			APPEND_G_FIFO((yyval.Address_fifo), (yyvsp[0].Address_node));
 		}
-#line 3210 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3217 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 286:
-#line 1476 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1483 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			if ((yyvsp[0].Integer) != 0 && (yyvsp[0].Integer) != 1) {
 				yyerror("Integer value is not boolean (0 or 1). Assuming 1");
@@ -3219,29 +3226,29 @@ yyparse (void)
 				(yyval.Integer) = (yyvsp[0].Integer);
 			}
 		}
-#line 3223 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3230 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 287:
-#line 1484 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1491 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     { (yyval.Integer) = 1; }
-#line 3229 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3236 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 288:
-#line 1485 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1492 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     { (yyval.Integer) = 0; }
-#line 3235 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3242 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 289:
-#line 1489 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1496 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     { (yyval.Double) = (double)(yyvsp[0].Integer); }
-#line 3241 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3248 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 291:
-#line 1500 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1507 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			sim_node *sn;
 
@@ -3251,125 +3258,125 @@ yyparse (void)
 			/* Revert from ; to \n for end-of-command */
 			old_config_style = 1;
 		}
-#line 3255 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3262 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 292:
-#line 1517 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1524 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     { old_config_style = 0; }
-#line 3261 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3268 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 293:
-#line 1522 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1529 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			(yyval.Attr_val_fifo) = (yyvsp[-2].Attr_val_fifo);
 			APPEND_G_FIFO((yyval.Attr_val_fifo), (yyvsp[-1].Attr_val));
 		}
-#line 3270 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3277 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 294:
-#line 1527 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1534 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			(yyval.Attr_val_fifo) = NULL;
 			APPEND_G_FIFO((yyval.Attr_val_fifo), (yyvsp[-1].Attr_val));
 		}
-#line 3279 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3286 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 295:
-#line 1535 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1542 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     { (yyval.Attr_val) = create_attr_dval((yyvsp[-2].Integer), (yyvsp[0].Double)); }
-#line 3285 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3292 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 298:
-#line 1545 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1552 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			(yyval.Sim_server_fifo) = (yyvsp[-1].Sim_server_fifo);
 			APPEND_G_FIFO((yyval.Sim_server_fifo), (yyvsp[0].Sim_server));
 		}
-#line 3294 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3301 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 299:
-#line 1550 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1557 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			(yyval.Sim_server_fifo) = NULL;
 			APPEND_G_FIFO((yyval.Sim_server_fifo), (yyvsp[0].Sim_server));
 		}
-#line 3303 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3310 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 300:
-#line 1558 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1565 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     { (yyval.Sim_server) = ONLY_SIM(create_sim_server((yyvsp[-4].Address_node), (yyvsp[-2].Double), (yyvsp[-1].Sim_script_fifo))); }
-#line 3309 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3316 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 301:
-#line 1563 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1570 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     { (yyval.Double) = (yyvsp[-1].Double); }
-#line 3315 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3322 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 302:
-#line 1568 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1575 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     { (yyval.Address_node) = (yyvsp[0].Address_node); }
-#line 3321 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3328 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 303:
-#line 1573 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1580 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			(yyval.Sim_script_fifo) = (yyvsp[-1].Sim_script_fifo);
 			APPEND_G_FIFO((yyval.Sim_script_fifo), (yyvsp[0].Sim_script));
 		}
-#line 3330 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3337 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 304:
-#line 1578 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1585 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			(yyval.Sim_script_fifo) = NULL;
 			APPEND_G_FIFO((yyval.Sim_script_fifo), (yyvsp[0].Sim_script));
 		}
-#line 3339 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3346 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 305:
-#line 1586 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1593 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     { (yyval.Sim_script) = ONLY_SIM(create_sim_script_info((yyvsp[-3].Double), (yyvsp[-1].Attr_val_fifo))); }
-#line 3345 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3352 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 306:
-#line 1591 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1598 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			(yyval.Attr_val_fifo) = (yyvsp[-2].Attr_val_fifo);
 			APPEND_G_FIFO((yyval.Attr_val_fifo), (yyvsp[-1].Attr_val));
 		}
-#line 3354 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3361 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 307:
-#line 1596 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1603 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     {
 			(yyval.Attr_val_fifo) = NULL;
 			APPEND_G_FIFO((yyval.Attr_val_fifo), (yyvsp[-1].Attr_val));
 		}
-#line 3363 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3370 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
   case 308:
-#line 1604 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
+#line 1611 "../../ntpd/ntp_parser.y" /* yacc.c:1646  */
     { (yyval.Attr_val) = create_attr_dval((yyvsp[-2].Integer), (yyvsp[0].Double)); }
-#line 3369 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3376 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
     break;
 
 
-#line 3373 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
+#line 3380 "../../ntpd/ntp_parser.c" /* yacc.c:1646  */
       default: break;
     }
   /* User semantic actions sometimes alter yychar, and that requires
@@ -3597,7 +3604,7 @@ yyparse (void)
 #endif
   return yyresult;
 }
-#line 1615 "../../ntpd/ntp_parser.y" /* yacc.c:1906  */
+#line 1622 "../../ntpd/ntp_parser.y" /* yacc.c:1906  */
 
 
 void

contrib/ntp/ntpd/ntp_proto.c

@@ -15,6 +15,7 @@
 #include "ntp_string.h"
 #include "ntp_leapsec.h"
 #include "refidsmear.h"
+#include "lib_strbuf.h"
 
 #include <stdio.h>
 #ifdef HAVE_LIBSCF_H
@@ -172,8 +173,14 @@ void	pool_name_resolved	(int, int, void *, const char *,
 				 const struct addrinfo *);
 #endif /* WORKER */
 
+const char *	amtoa		(int am);
+
+
 void
-set_sys_leap(u_char new_sys_leap) {
+set_sys_leap(
+	u_char new_sys_leap
+	)
+{
 	sys_leap = new_sys_leap;
 	xmt_leap = sys_leap;
 
@@ -189,8 +196,9 @@ set_sys_leap(u_char new_sys_leap) {
 #ifdef LEAP_SMEAR
 		else {
 			/*
-			 * If leap smear is enabled in general we must never send a leap second warning
+			 * If leap smear is enabled in general we must
-			 * to clients, so make sure we only send "in sync".
+			 * never send a leap second warning to clients,
+			 * so make sure we only send "in sync".
 			 */
 			if (leap_smear.enabled)
 				xmt_leap = LEAP_NOWARNING;
@@ -199,34 +207,39 @@ set_sys_leap(u_char new_sys_leap) {
 	}
 }
 
+
 /*
  * Kiss Code check
  */
-int kiss_code_check(u_char hisleap, u_char hisstratum, u_char hismode, u_int32 refid) {
+int
+kiss_code_check(
+	u_char hisleap,
+	u_char hisstratum,
+	u_char hismode,
+	u_int32 refid
+	)
+{
 
-		if (   hismode == MODE_SERVER
+	if (   hismode == MODE_SERVER
-		    && hisleap == LEAP_NOTINSYNC
+	    && hisleap == LEAP_NOTINSYNC
-		    && hisstratum == STRATUM_UNSPEC) {
+	    && hisstratum == STRATUM_UNSPEC) {
-				if(memcmp(&refid,"RATE", 4) == 0) {
+		if(memcmp(&refid,"RATE", 4) == 0) {
-					return (RATEKISS);	
+			return (RATEKISS);
-				}
+		} else if(memcmp(&refid,"DENY", 4) == 0) {
-				else if(memcmp(&refid,"DENY", 4) == 0) {
+			return (DENYKISS);
-					return (DENYKISS);	
+		} else if(memcmp(&refid,"RSTR", 4) == 0) {
-				}
+			return (RSTRKISS);
-				else if(memcmp(&refid,"RSTR", 4) == 0) {
+		} else if(memcmp(&refid,"X", 1) == 0) {
-					return (RSTRKISS);	
+			return (XKISS);
-				}
+		} else {
-				else if(memcmp(&refid,"X", 1) == 0) {
+			return (UNKNOWNKISS);
-					return (XKISS);	
-				}
-				else {
-					return (UNKNOWNKISS);
-				}
-		}
-		else {
-			return (NOKISS);
 		}
+	} else {
+		return (NOKISS);
+	}
 }
+
+
 /*
  * transmit - transmit procedure called by poll timeout
  */
@@ -303,7 +316,7 @@ transmit(
 		peer->outdate = current_time;
 		if (   (peer_associations <= 2 * sys_maxclock)
 		    && (   peer_associations < sys_maxclock
-		    	|| sys_survivors < sys_minclock))
+			|| sys_survivors < sys_minclock))
 			pool_xmit(peer);
 		poll_update(peer, hpoll);
 		return;
@@ -416,6 +429,33 @@ transmit(
 	if (peer->hmode != MODE_BCLIENT)
 		peer_xmit(peer);
 	poll_update(peer, hpoll);
+
+	return;
+}
+
+
+const char *
+amtoa(
+	int am
+	)
+{
+	char *bp;
+
+	switch(am) {
+	    case AM_ERR:	return "AM_ERR";
+	    case AM_NOMATCH:	return "AM_NOMATCH";
+	    case AM_PROCPKT:	return "AM_PROCPKT";
+	    case AM_BCST:	return "AM_BCST";
+	    case AM_FXMIT:	return "AM_FXMIT";
+	    case AM_MANYCAST:	return "AM_MANYCAST";
+	    case AM_NEWPASS:	return "AM_NEWPASS";
+	    case AM_NEWBCL:	return "AM_NEWBCL";
+	    case AM_POSSBCL:	return "AM_POSSBCL";
+	    default:
+		LIB_GETBUF(bp);
+		snprintf(bp, LIB_BUFLENGTH, "AM_#%d", am);
+		return bp;
+	}
 }
 
 
@@ -434,16 +474,18 @@ receive(
 	u_char	hismode;		/* packet mode */
 	u_char	hisstratum;		/* packet stratum */
 	u_short	restrict_mask;		/* restrict bits */
-	int kissCode = NOKISS;	/* Kiss Code */
+	const char *hm_str;		/* hismode string */
+	const char *am_str;		/* association match string */
+	int	kissCode = NOKISS;	/* Kiss Code */
 	int	has_mac;		/* length of MAC field */
 	int	authlen;		/* offset of MAC field */
 	int	is_authentic = 0;	/* cryptosum ok */
 	int	retcode = AM_NOMATCH;	/* match code */
 	keyid_t	skeyid = 0;		/* key IDs */
 	u_int32	opcode = 0;		/* extension field opcode */
-	sockaddr_u *dstadr_sin; 	/* active runway */
+	sockaddr_u *dstadr_sin;		/* active runway */
 	struct peer *peer2;		/* aux peer structure pointer */
-	endpt *	match_ep;		/* newpeer() local address */
+	endpt	*match_ep;		/* newpeer() local address */
 	l_fp	p_org;			/* origin timestamp */
 	l_fp	p_rec;			/* receive timestamp */
 	l_fp	p_xmt;			/* transmit timestamp */
@@ -474,11 +516,12 @@ receive(
 		return;				/* bogus port */
 	}
 	restrict_mask = restrictions(&rbufp->recv_srcadr);
-	DPRINTF(2, ("receive: at %ld %s<-%s flags %x restrict %03x\n",
-		    current_time, stoa(&rbufp->dstadr->sin),
-		    stoa(&rbufp->recv_srcadr),
-		    rbufp->dstadr->flags, restrict_mask));
 	pkt = &rbufp->recv_pkt;
+	DPRINTF(2, ("receive: at %ld %s<-%s flags %x restrict %03x org %#010x.%08x xmt %#010x.%08x\n",
+		    current_time, stoa(&rbufp->dstadr->sin),
+		    stoa(&rbufp->recv_srcadr), rbufp->dstadr->flags,
+		    restrict_mask, ntohl(pkt->org.l_ui), ntohl(pkt->org.l_uf),
+		    ntohl(pkt->xmt.l_ui), ntohl(pkt->xmt.l_uf)));
 	hisversion = PKT_VERSION(pkt->li_vn_mode);
 	hisleap = PKT_LEAP(pkt->li_vn_mode);
 	hismode = (int)PKT_MODE(pkt->li_vn_mode);
@@ -685,6 +728,8 @@ receive(
 	NTOHL_FP(&pkt->org, &p_org);
 	NTOHL_FP(&pkt->rec, &p_rec);
 	NTOHL_FP(&pkt->xmt, &p_xmt);
+	hm_str = modetoa(hismode);
+	am_str = amtoa(retcode);
 
 	/*
 	 * Authentication is conditioned by three switches:
@@ -713,25 +758,21 @@ receive(
 	if (has_mac == 0) {
 		restrict_mask &= ~RES_MSSNTP;
 		is_authentic = AUTH_NONE; /* not required */
-#ifdef DEBUG
+		DPRINTF(2, ("receive: at %ld %s<-%s mode %d/%s:%s len %d org %#010x.%08x xmt %#010x.%08x NOMAC\n",
-		if (debug)
-			printf(
-			    "receive: at %ld %s<-%s mode %d len %d\n",
 			    current_time, stoa(dstadr_sin),
-			    stoa(&rbufp->recv_srcadr), hismode,
+			    stoa(&rbufp->recv_srcadr), hismode, hm_str, am_str,
-			    authlen);
+			    authlen,
-#endif
+			    ntohl(pkt->org.l_ui), ntohl(pkt->org.l_uf),
+			    ntohl(pkt->xmt.l_ui), ntohl(pkt->xmt.l_uf)));
 	} else if (has_mac == 4) {
 		restrict_mask &= ~RES_MSSNTP;
 		is_authentic = AUTH_CRYPTO; /* crypto-NAK */
-#ifdef DEBUG
+		DPRINTF(2, ("receive: at %ld %s<-%s mode %d/%s:%s keyid %08x len %d auth %d org %#010x.%08x xmt %#010x.%08x MAC4\n",
-		if (debug)
-			printf(
-			    "receive: at %ld %s<-%s mode %d keyid %08x len %d auth %d\n",
 			    current_time, stoa(dstadr_sin),
-			    stoa(&rbufp->recv_srcadr), hismode, skeyid,
+			    stoa(&rbufp->recv_srcadr), hismode, hm_str, am_str,
-			    authlen + has_mac, is_authentic);
+			    skeyid, authlen + has_mac, is_authentic,
-#endif
+			    ntohl(pkt->org.l_ui), ntohl(pkt->org.l_uf),
+			    ntohl(pkt->xmt.l_ui), ntohl(pkt->xmt.l_uf)));
 
 #ifdef HAVE_NTP_SIGND
 		/*
@@ -747,7 +788,7 @@ receive(
 		   && (restrict_mask & RES_MSSNTP)
 		   && (retcode == AM_FXMIT || retcode == AM_NEWPASS)
 		   && (memcmp(zero_key, (char *)pkt + authlen + 4,
-		   	      MAX_MD5_LEN - 4) == 0)) {
+			      MAX_MD5_LEN - 4) == 0)) {
 		is_authentic = AUTH_NONE;
 #endif /* HAVE_NTP_SIGND */
 
@@ -856,14 +897,12 @@ receive(
 		if (crypto_flags && skeyid > NTP_MAXKEY)
 			authtrust(skeyid, 0);
 #endif	/* AUTOKEY */
-#ifdef DEBUG
+		DPRINTF(2, ("receive: at %ld %s<-%s mode %d/%s:%s keyid %08x len %d auth %d org %#010x.%08x xmt %#010x.%08x\n",
-		if (debug)
-			printf(
-			    "receive: at %ld %s<-%s mode %d keyid %08x len %d auth %d\n",
 			    current_time, stoa(dstadr_sin),
-			    stoa(&rbufp->recv_srcadr), hismode, skeyid,
+			    stoa(&rbufp->recv_srcadr), hismode, hm_str, am_str,
-			    authlen + has_mac, is_authentic);
+			    skeyid, authlen + has_mac, is_authentic,
-#endif
+			    ntohl(pkt->org.l_ui), ntohl(pkt->org.l_uf),
+			    ntohl(pkt->xmt.l_ui), ntohl(pkt->xmt.l_uf)));
 	}
 
 	/*
@@ -1194,11 +1233,11 @@ receive(
 			 * debug-printed and not logged to avoid log
 			 * flooding.
 			 */
-			DPRINTF(1, ("receive: at %ld refusing to mobilize passive association"
+			DPRINTF(2, ("receive: at %ld refusing to mobilize passive association"
-				    " with unknown peer %s mode %d keyid %08x len %d auth %d\n",
+				    " with unknown peer %s mode %d/%s:%s keyid %08x len %d auth %d\n",
 				    current_time, stoa(&rbufp->recv_srcadr),
-				    hismode, skeyid, (authlen + has_mac),
+				    hismode, hm_str, am_str, skeyid,
-				    is_authentic));
+				    (authlen + has_mac), is_authentic));
 			sys_declined++;
 			return;
 		}
@@ -1321,26 +1360,36 @@ receive(
 		}
 
 	/*
-	 * Check for bogus packet in basic mode. If found, switch to
+	 * Basic mode checks:
-	 * interleaved mode and resynchronize, but only after confirming
+	 *
-	 * the packet is not bogus in symmetric interleaved mode.
+	 * If there is no origin timestamp, it's an initial packet.
+	 *
+	 * Otherwise, check for bogus packet in basic mode.
+	 * If it is bogus, switch to interleaved mode and resynchronize,
+	 * but only after confirming the packet is not bogus in
+	 * symmetric interleaved mode.
 	 *
 	 * This could also mean somebody is forging packets claiming to
 	 * be from us, attempting to cause our server to KoD us.
 	 */
 	} else if (peer->flip == 0) {
-		if (!L_ISEQU(&p_org, &peer->aorg)) {
+		if (0 < hisstratum && L_ISZERO(&p_org)) {
+			L_CLR(&peer->aorg);
+		} else if (!L_ISEQU(&p_org, &peer->aorg)) {
 			peer->bogusorg++;
 			peer->flash |= TEST2;	/* bogus */
 			msyslog(LOG_INFO,
-				"receive: Unexpected origin timestamp from %s",
+				"receive: Unexpected origin timestamp %#010x.%08x from %s xmt %#010x.%08x",
-				ntoa(&peer->srcadr));
+				ntohl(pkt->org.l_ui), ntohl(pkt->org.l_uf),
+				ntoa(&peer->srcadr),
+				ntohl(pkt->xmt.l_ui), ntohl(pkt->xmt.l_uf));
 			if (  !L_ISZERO(&peer->dst)
 			    && L_ISEQU(&p_org, &peer->dst)) {
+				/* Might be the start of an interleave */
 				peer->flip = 1;
 				report_event(PEVNT_XLEAVE, peer, NULL);
 			}
-			return; /* Bogus packet, we are done */
+			return; /* Bogus or possible interleave packet */
 		} else {
 			L_CLR(&peer->aorg);
 		}
@@ -1694,11 +1743,8 @@ process_packet(
 	 */
 	if (peer->flash & PKT_TEST_MASK) {
 		peer->seldisptoolarge++;
-#ifdef DEBUG
+		DPRINTF(1, ("packet: flash header %04x\n",
-		if (debug)
+			    peer->flash));
-			printf("packet: flash header %04x\n",
-			    peer->flash);
-#endif
 		return;
 	}
 
@@ -1871,15 +1917,12 @@ process_packet(
 	 * the roundtrip delay. Then it calculates the correction as a
 	 * fraction of d.
 	 */
- 	peer->t21 = t21;
+	peer->t21 = t21;
 	peer->t21_last = peer->t21_bytes;
 	peer->t34 = -t34;
 	peer->t34_bytes = len;
-#ifdef DEBUG
+	DPRINTF(2, ("packet: t21 %.9lf %d t34 %.9lf %d\n", peer->t21,
-	if (debug > 1)
+		    peer->t21_bytes, peer->t34, peer->t34_bytes));
-		printf("packet: t21 %.9lf %d t34 %.9lf %d\n", peer->t21,
-		    peer->t21_bytes, peer->t34, peer->t34_bytes);
-#endif
 	if (peer->r21 > 0 && peer->r34 > 0 && p_del > 0) {
 		if (peer->pmode != MODE_BROADCAST)
 			td = (peer->r34 / (peer->r21 + peer->r34) -
@@ -1888,7 +1931,7 @@ process_packet(
 			td = 0;
 
 		/*
- 		 * Unfortunately, in many cases the errors are
+		 * Unfortunately, in many cases the errors are
 		 * unacceptable, so for the present the rates are not
 		 * used. In future, we might find conditions where the
 		 * calculations are useful, so this should be considered
@@ -1896,12 +1939,9 @@ process_packet(
 		 */
 		t21 -= td;
 		t34 -= td;
-#ifdef DEBUG
+		DPRINTF(2, ("packet: del %.6lf r21 %.1lf r34 %.1lf %.6lf\n",
-		if (debug > 1)
-			printf("packet: del %.6lf r21 %.1lf r34 %.1lf %.6lf\n",
 			    p_del, peer->r21 / 1e3, peer->r34 / 1e3,
-			    td);
+			    td));
-#endif
 	}
 #endif /* ASSYM */
 
@@ -1994,12 +2034,8 @@ clock_update(
 	sys_rootdelay = peer->delay + peer->rootdelay;
 	sys_reftime = peer->dst;
 
-#ifdef DEBUG
+	DPRINTF(1, ("clock_update: at %lu sample %lu associd %d\n",
-	if (debug)
+		    current_time, peer->epoch, peer->associd));
-		printf(
-		    "clock_update: at %lu sample %lu associd %d\n",
-		    current_time, peer->epoch, peer->associd);
-#endif
 
 	/*
 	 * Comes now the moment of truth. Crank the clock discipline and
@@ -2308,13 +2344,9 @@ peer_clear(
 #ifdef AUTOKEY
 	peer->refresh = current_time + (1 << NTP_REFRESH);
 #endif	/* AUTOKEY */
-#ifdef DEBUG
+	DPRINTF(1, ("peer_clear: at %ld next %ld associd %d refid %s\n",
-	if (debug)
-		printf(
-		    "peer_clear: at %ld next %ld associd %d refid %s\n",
 		    current_time, peer->nextdate, peer->associd,
-		    ident);
+		    ident));
-#endif
 }
 
 
@@ -2478,11 +2510,8 @@ clock_filter(
 	 * packets.
 	 */
 	if (peer->filter_epoch[k] <= peer->epoch) {
-#if DEBUG
+	DPRINTF(2, ("clock_filter: old sample %lu\n", current_time -
-	if (debug > 1)
+		    peer->filter_epoch[k]));
-		printf("clock_filter: old sample %lu\n", current_time -
-		    peer->filter_epoch[k]);
-#endif
 		return;
 	}
 	peer->epoch = peer->filter_epoch[k];
@@ -2494,13 +2523,9 @@ clock_filter(
 	 */
 	record_peer_stats(&peer->srcadr, ctlpeerstatus(peer),
 	    peer->offset, peer->delay, peer->disp, peer->jitter);
-#ifdef DEBUG
+	DPRINTF(1, ("clock_filter: n %d off %.6f del %.6f dsp %.6f jit %.6f\n",
-	if (debug)
-		printf(
-		    "clock_filter: n %d off %.6f del %.6f dsp %.6f jit %.6f\n",
 		    m, peer->offset, peer->delay, peer->disp,
-		    peer->jitter);
+		    peer->jitter));
-#endif
 	if (peer->burst == 0 || sys_leap == LEAP_NOTINSYNC)
 		clock_select();
 }
@@ -3004,7 +3029,7 @@ clock_select(void)
 		typesystem = typepps;
 		sys_clockhop = 0;
 		typesystem->new_status = CTL_PST_SEL_PPS;
- 		sys_offset = typesystem->offset;
+		sys_offset = typesystem->offset;
 		sys_jitter = typesystem->jitter;
 		DPRINTF(1, ("select: pps offset %.9f jitter %.9f\n",
 			sys_offset, sys_jitter));
@@ -3157,11 +3182,11 @@ peer_xmit(
 	 * might not be usable.
 	 */
 	sendlen = LEN_PKT_NOMAC;
+	if (
 #ifdef AUTOKEY
-	if (!(peer->flags & FLAG_SKEY) && peer->keyid == 0) {
+	    !(peer->flags & FLAG_SKEY) &&
-#else	/* !AUTOKEY follows */
-	if (peer->keyid == 0) {
 #endif	/* !AUTOKEY */
+	    peer->keyid == 0) {
 
 		/*
 		 * Transmit a-priori timestamps
@@ -3207,13 +3232,11 @@ peer_xmit(
 		}
 		L_SUB(&xmt_ty, &xmt_tx);
 		LFPTOD(&xmt_ty, peer->xleave);
-#ifdef DEBUG
+		DPRINTF(1, ("peer_xmit: at %ld %s->%s mode %d len %zu xmt %#010x.%08x\n",
-		if (debug)
+			    current_time,
-			printf("transmit: at %ld %s->%s mode %d len %zu\n",
+			    peer->dstadr ? stoa(&peer->dstadr->sin) : "-",
-		    	    current_time, peer->dstadr ?
+		            stoa(&peer->srcadr), peer->hmode, sendlen,
-			    stoa(&peer->dstadr->sin) : "-",
+			    xmt_tx.l_ui, xmt_tx.l_uf));
-		            stoa(&peer->srcadr), peer->hmode, sendlen);
-#endif
 		return;
 	}
 
@@ -3498,7 +3521,7 @@ peer_xmit(
 		authtrust(xkeyid, 0);
 #endif	/* AUTOKEY */
 	if (sendlen > sizeof(xpkt)) {
-		msyslog(LOG_ERR, "proto: buffer overflow %zu", sendlen);
+		msyslog(LOG_ERR, "peer_xmit: buffer overflow %zu", sendlen);
 		exit (-1);
 	}
 	peer->t21_bytes = sendlen;
@@ -3521,30 +3544,33 @@ peer_xmit(
 	L_SUB(&xmt_ty, &xmt_tx);
 	LFPTOD(&xmt_ty, peer->xleave);
 #ifdef AUTOKEY
-#ifdef DEBUG
+	DPRINTF(1, ("peer_xmit: at %ld %s->%s mode %d keyid %08x len %zu index %d\n",
-	if (debug)
-		printf("transmit: at %ld %s->%s mode %d keyid %08x len %zu index %d\n",
 		    current_time, latoa(peer->dstadr),
 		    ntoa(&peer->srcadr), peer->hmode, xkeyid, sendlen,
-		    peer->keynumber);
+		    peer->keynumber));
-#endif
 #else	/* !AUTOKEY follows */
-#ifdef DEBUG
+	DPRINTF(1, ("peer_xmit: at %ld %s->%s mode %d keyid %08x len %d\n",
-	if (debug)
-		printf("transmit: at %ld %s->%s mode %d keyid %08x len %d\n",
 		    current_time, peer->dstadr ?
 		    ntoa(&peer->dstadr->sin) : "-",
-		    ntoa(&peer->srcadr), peer->hmode, xkeyid, sendlen);
+		    ntoa(&peer->srcadr), peer->hmode, xkeyid, sendlen));
-#endif
 #endif	/* !AUTOKEY */
+
+	return;
 }
 
 
 #ifdef LEAP_SMEAR
 
 static void
-leap_smear_add_offs(l_fp *t, l_fp *t_recv) {
+leap_smear_add_offs(
+	l_fp *t,
+	l_fp *t_recv
+	)
+{
+
 	L_ADD(t, &leap_smear.offset);
+
+	return;
 }
 
 #endif  /* LEAP_SMEAR */
@@ -3565,7 +3591,7 @@ fast_xmit(
 	struct pkt xpkt;	/* transmit packet structure */
 	struct pkt *rpkt;	/* receive packet structure */
 	l_fp	xmt_tx, xmt_ty;
-	int	sendlen;
+	size_t	sendlen;
 #ifdef AUTOKEY
 	u_int32	temp32;
 #endif
@@ -3684,13 +3710,10 @@ fast_xmit(
 	if (rbufp->recv_length == sendlen) {
 		sendpkt(&rbufp->recv_srcadr, rbufp->dstadr, 0, &xpkt,
 		    sendlen);
-#ifdef DEBUG
+		DPRINTF(1, ("fast_xmit: at %ld %s->%s mode %d len %lu\n",
-		if (debug)
-			printf(
-			    "transmit: at %ld %s->%s mode %d len %d\n",
 			    current_time, stoa(&rbufp->dstadr->sin),
-			    stoa(&rbufp->recv_srcadr), xmode, sendlen);
+			    stoa(&rbufp->recv_srcadr), xmode,
-#endif
+			    (u_long)sendlen));
 		return;
 	}
 
@@ -3717,7 +3740,7 @@ fast_xmit(
 		 */
 		cookie = session_key(&rbufp->recv_srcadr,
 		    &rbufp->dstadr->sin, 0, sys_private, 0);
-		if (rbufp->recv_length > sendlen + (int)MAX_MAC_LEN) {
+		if ((size_t)rbufp->recv_length > sendlen + MAX_MAC_LEN) {
 			session_key(&rbufp->dstadr->sin,
 			    &rbufp->recv_srcadr, xkeyid, 0, 2);
 			temp32 = CRYPTO_RESP;
@@ -3741,13 +3764,10 @@ fast_xmit(
 	get_systime(&xmt_ty);
 	L_SUB(&xmt_ty, &xmt_tx);
 	sys_authdelay = xmt_ty;
-#ifdef DEBUG
+	DPRINTF(1, ("fast_xmit: at %ld %s->%s mode %d keyid %08x len %lu\n",
-	if (debug)
-		printf(
-		    "transmit: at %ld %s->%s mode %d keyid %08x len %d\n",
 		    current_time, ntoa(&rbufp->dstadr->sin),
-		    ntoa(&rbufp->recv_srcadr), xmode, xkeyid, sendlen);
+		    ntoa(&rbufp->recv_srcadr), xmode, xkeyid,
-#endif
+		    (u_long)sendlen));
 }
 
 
@@ -3827,11 +3847,8 @@ pool_xmit(
 		LEN_PKT_NOMAC);
 	pool->sent++;
 	pool->throttle += (1 << pool->minpoll) - 2;
-#ifdef DEBUG
+	DPRINTF(1, ("pool_xmit: at %ld %s->%s pool\n",
-	if (debug)
+		    current_time, latoa(lcladr), stoa(rmtadr)));
-		printf("transmit: at %ld %s->%s pool\n",
-		    current_time, latoa(lcladr), stoa(rmtadr));
-#endif
 	msyslog(LOG_INFO, "Soliciting pool server %s", stoa(rmtadr));
 #endif	/* WORKER */
 }
@@ -3849,7 +3866,8 @@ pool_xmit(
 	 * group	different	1		ignore
 	 * * ignore if notrust
 	 */
-int group_test(
+int
+group_test(
 	char	*grp,
 	char	*ident
 	)
@@ -3929,11 +3947,8 @@ key_expire(
 	value_free(&peer->sndval);
 	peer->keynumber = 0;
 	peer->flags &= ~FLAG_ASSOC;
-#ifdef DEBUG
+	DPRINTF(1, ("key_expire: at %lu associd %d\n", current_time,
-	if (debug)
+		    peer->associd));
-		printf("key_expire: at %lu associd %d\n", current_time,
-		    peer->associd);
-#endif
 }
 #endif	/* AUTOKEY */
 

contrib/ntp/ntpd/ntp_refclock.c

@@ -732,9 +732,9 @@ process_refclock_packet(
  */
 int
 refclock_open(
-	char	*dev,		/* device name pointer */
+	const char	*dev,	/* device name pointer */
-	u_int	speed,		/* serial port speed (code) */
+	u_int		speed,	/* serial port speed (code) */
-	u_int	lflags		/* line discipline flags */
+	u_int		lflags	/* line discipline flags */
 	)
 {
 	int	fd;

contrib/ntp/ntpd/ntp_request.c

@@ -2006,11 +2006,11 @@ do_trustkey(
 	u_long trust
 	)
 {
-	register u_long *kp;
+	register uint32_t *kp;
 	register int items;
 
 	items = INFO_NITEMS(inpkt->err_nitems);
-	kp = (u_long *)&inpkt->u;
+	kp = (uint32_t*)&inpkt->u;
 	while (items-- > 0) {
 		authtrust(*kp, trust);
 		kp++;

contrib/ntp/ntpd/ntp_restrict.c

@@ -160,7 +160,7 @@ alloc_res4(void)
 	const size_t	count = INC_RESLIST4;
 	restrict_u *	rl;
 	restrict_u *	res;
-	int		i;
+	size_t		i;
 
 	UNLINK_HEAD_SLIST(res, resfree4, link);
 	if (res != NULL)
@@ -186,7 +186,7 @@ alloc_res6(void)
 	const size_t	count = INC_RESLIST6;
 	restrict_u *	rl;
 	restrict_u *	res;
-	int		i;
+	size_t		i;
 
 	UNLINK_HEAD_SLIST(res, resfree6, link);
 	if (res != NULL)

contrib/ntp/ntpd/ntp_signd.c

@@ -66,7 +66,7 @@ write_all(int fd, const void *buf, size_t len)
 	while (len) {
 		int n = write(fd, buf, len);
 		if (n <= 0) return total;
-		buf = n + (char *)buf;
+		buf = n + (const char *)buf;
 		len -= n;
 		total += n;
 	}
@@ -110,9 +110,10 @@ recv_packet(int fd, char **buf, uint32_t *len)
 {
 	if (read_all(fd, len, sizeof(*len)) != sizeof(*len)) return -1;
 	*len = ntohl(*len);
-	(*buf) = emalloc(*len);
+	*buf = emalloc(*len);
 	if (read_all(fd, *buf, *len) != *len) {
 		free(*buf);
+		*buf = NULL;
 		return -1;
 	}
 	return 0;

contrib/ntp/ntpd/ntp_timer.c

@@ -626,18 +626,19 @@ check_leapsec(
 		 * announce the leap event has happened.
 		 */
 		const char *leapmsg = NULL;
-		if (lsdata.warped < 0) {
+		double      lswarp  = lsdata.warped;
+		if (lswarp < 0.0) {
 			if (clock_max_back > 0.0 &&
-			    clock_max_back < fabs(lsdata.warped)) {
+			    clock_max_back < -lswarp) {
-				step_systime(lsdata.warped);
+				step_systime(lswarp);
 				leapmsg = leapmsg_p_step;
 			} else {
 				leapmsg = leapmsg_p_slew;
 			}
-		} else 	if (lsdata.warped > 0) {
+		} else 	if (lswarp > 0.0) {
 			if (clock_max_fwd > 0.0 &&
-			    clock_max_fwd < fabs(lsdata.warped)) {
+			    clock_max_fwd < lswarp) {
-				step_systime(lsdata.warped);
+				step_systime(lswarp);
 				leapmsg = leapmsg_n_step;
 			} else {
 				leapmsg = leapmsg_n_slew;

contrib/ntp/ntpd/ntp_util.c

@@ -334,7 +334,7 @@ stats_config(
 {
 	FILE	*fp;
 	const char *value;
-	int	len;
+	size_t	len;
 	double	old_drift;
 	l_fp	now;
 	time_t  ttnow;
@@ -437,7 +437,7 @@ stats_config(
 			    (int)sizeof(statsdir) - 2);
 		} else {
 			int add_dir_sep;
-			int value_l;
+			size_t value_l;
 
 			/* Add a DIR_SEP unless we already have one. */
 			value_l = strlen(value);
@@ -933,7 +933,7 @@ getauthkeys(
 	const char *keyfile
 	)
 {
-	int len;
+	size_t len;
 
 	len = strlen(keyfile);
 	if (!len)

contrib/ntp/ntpd/ntpd-opts.c

@@ -1,7 +1,7 @@
 /*
  *  EDIT THIS FILE WITH CAUTION  (ntpd-opts.c)
  *
- *  It has been AutoGen-ed  October 21, 2015 at 12:36:00 PM by AutoGen 5.18.5
+ *  It has been AutoGen-ed  January  7, 2016 at 11:28:29 PM by AutoGen 5.18.5
  *  From the definitions    ntpd-opts.def
  *  and the template file   options
  *
@@ -75,7 +75,7 @@ extern FILE * option_usage_fp;
  *  static const strings for ntpd options
  */
 static char const ntpd_opt_strs[3129] =
-/*     0 */ "ntpd 4.2.8p4\n"
+/*     0 */ "ntpd 4.2.8p5\n"
             "Copyright (C) 1992-2015 The University of Delaware and Network Time Foundation, all rights reserved.\n"
             "This is free software. It is licensed for use, modification and\n"
             "redistribution under the terms of the NTP License, copies of which\n"
@@ -205,12 +205,12 @@ static char const ntpd_opt_strs[3129] =
 /*  2900 */ "output version information and exit\0"
 /*  2936 */ "version\0"
 /*  2944 */ "NTPD\0"
-/*  2949 */ "ntpd - NTP daemon program - Ver. 4.2.8p4\n"
+/*  2949 */ "ntpd - NTP daemon program - Ver. 4.2.8p5\n"
             "Usage:  %s [ -<flag> [<val>] | --<name>[{=| }<val>] ]... \\\n"
             "\t\t[ <server1> ... <serverN> ]\n\0"
 /*  3080 */ "http://bugs.ntp.org, bugs@ntp.org\0"
 /*  3114 */ "\n\0"
-/*  3116 */ "ntpd 4.2.8p4";
+/*  3116 */ "ntpd 4.2.8p5";
 
 /**
  *  ipv4 option description with
@@ -1529,7 +1529,7 @@ static void bogus_function(void) {
      translate option names.
    */
   /* referenced via ntpdOptions.pzCopyright */
-  puts(_("ntpd 4.2.8p4\n\
+  puts(_("ntpd 4.2.8p5\n\
 Copyright (C) 1992-2015 The University of Delaware and Network Time Foundation, all rights reserved.\n\
 This is free software. It is licensed for use, modification and\n\
 redistribution under the terms of the NTP License, copies of which\n\
@@ -1670,7 +1670,7 @@ implied warranty.\n"));
   puts(_("output version information and exit"));
 
   /* referenced via ntpdOptions.pzUsageTitle */
-  puts(_("ntpd - NTP daemon program - Ver. 4.2.8p4\n\
+  puts(_("ntpd - NTP daemon program - Ver. 4.2.8p5\n\
 Usage:  %s [ -<flag> [<val>] | --<name>[{=| }<val>] ]... \\\n\
 \t\t[ <server1> ... <serverN> ]\n"));
 
@@ -1678,7 +1678,7 @@ Usage:  %s [ -<flag> [<val>] | --<name>[{=| }<val>] ]... \\\n\
   puts(_("\n"));
 
   /* referenced via ntpdOptions.pzFullVersion */
-  puts(_("ntpd 4.2.8p4"));
+  puts(_("ntpd 4.2.8p5"));
 
   /* referenced via ntpdOptions.pzFullUsage */
   puts(_("<<<NOT-FOUND>>>"));

contrib/ntp/ntpd/ntpd-opts.h

@@ -1,7 +1,7 @@
 /*
  *  EDIT THIS FILE WITH CAUTION  (ntpd-opts.h)
  *
- *  It has been AutoGen-ed  October 21, 2015 at 12:35:59 PM by AutoGen 5.18.5
+ *  It has been AutoGen-ed  January  7, 2016 at 11:28:28 PM by AutoGen 5.18.5
  *  From the definitions    ntpd-opts.def
  *  and the template file   options
  *
@@ -106,9 +106,9 @@ typedef enum {
 /** count of all options for ntpd */
 #define OPTION_CT    38
 /** ntpd version */
-#define NTPD_VERSION       "4.2.8p4"
+#define NTPD_VERSION       "4.2.8p5"
 /** Full ntpd version text */
-#define NTPD_FULL_VERSION  "ntpd 4.2.8p4"
+#define NTPD_FULL_VERSION  "ntpd 4.2.8p5"
 
 /**
  *  Interface defines for all options.  Replace "n" with the UPPER_CASED

contrib/ntp/ntpd/ntpd.1ntpdman

@@ -10,11 +10,11 @@
 .ds B-Font B
 .ds I-Font I
 .ds R-Font R
-.TH ntpd 1ntpdman "21 Oct 2015" "4.2.8p4" "User Commands"
+.TH ntpd 1ntpdman "07 Jan 2016" "4.2.8p5" "User Commands"
 .\"
-.\" EDIT THIS FILE WITH CAUTION (/tmp/.ag-dUaOfK/ag-qUaGeK)
+.\" EDIT THIS FILE WITH CAUTION (/tmp/.ag-KDaWJq/ag-WDaOIq)
 .\"
-.\" It has been AutoGen-ed October 21, 2015 at 12:38:11 PM by AutoGen 5.18.5
+.\" It has been AutoGen-ed January 7, 2016 at 11:30:44 PM by AutoGen 5.18.5
 .\" From the definitions ntpd-opts.def
 .\" and the template file agman-cmd.tpl
 .SH NAME

contrib/ntp/ntpd/ntpd.1ntpdmdoc

@@ -1,9 +1,9 @@
-.Dd October 21 2015
+.Dd January 7 2016
 .Dt NTPD 1ntpdmdoc User Commands
 .Os
 .\"  EDIT THIS FILE WITH CAUTION  (ntpd-opts.mdoc)
 .\"
-.\"  It has been AutoGen-ed  October 21, 2015 at 12:38:30 PM by AutoGen 5.18.5
+.\"  It has been AutoGen-ed  January  7, 2016 at 11:31:02 PM by AutoGen 5.18.5
 .\"  From the definitions    ntpd-opts.def
 .\"  and the template file   agmdoc-cmd.tpl
 .Sh NAME

contrib/ntp/ntpd/ntpd.c

@@ -27,12 +27,16 @@
 #include "ntp_libopts.h"
 #include "ntpd-opts.h"
 
-/* there's a short treatise below what the thread stuff is for */
+/* there's a short treatise below what the thread stuff is for.
+ * [Bug 2954] enable the threading warm-up only for Linux.
+ */
 #if defined(HAVE_PTHREADS) && HAVE_PTHREADS && !defined(NO_THREADS)
 # ifdef HAVE_PTHREAD_H
 #  include <pthread.h>
 # endif
-# define NEED_PTHREAD_WARMUP
+# if defined(linux)
+#  define NEED_PTHREAD_WARMUP
+# endif
 #endif
 
 #ifdef HAVE_UNISTD_H
@@ -269,6 +273,9 @@ static void	library_unexpected_error(const char *, int,
  * This uses only the standard pthread API and should work with all
  * implementations of pthreads. It is not necessary everywhere, but it's
  * cheap enough to go on nearly unnoticed.
+ *
+ * Addendum: Bug 2954 showed that the assumption that this should work
+ * with all OS is wrong -- at least FreeBSD bombs heavily.
  */
 #ifdef NEED_PTHREAD_WARMUP
 
@@ -646,6 +653,9 @@ ntpdmain(
 # endif
 
 # ifdef HAVE_WORKING_FORK
+	/* make sure the FDs are initialised */
+	pipe_fds[0] = -1;
+	pipe_fds[1] = -1;
 	do {					/* 'loop' once */
 		if (!HAVE_OPT( WAIT_SYNC ))
 			break;

contrib/ntp/ntpd/ntpd.html

@@ -39,7 +39,7 @@ The program can operate in any of several modes, including client/server,
 symmetric and broadcast modes, and with both symmetric-key and public-key
 cryptography.
 
-  <p>This document applies to version 4.2.8p4 of <code>ntpd</code>.
+  <p>This document applies to version 4.2.8p5 of <code>ntpd</code>.
 
 <ul class="menu">
 <li><a accesskey="1" href="#ntpd-Description">ntpd Description</a>:             Description
@@ -220,7 +220,7 @@ the usage text by passing it through a pager program.
 used to select the program, defaulting to <span class="file">more</span>.  Both will exit
 with a status code of 0.
 
-<pre class="example">ntpd - NTP daemon program - Ver. 4.2.8p4-sec-RC2
+<pre class="example">ntpd - NTP daemon program - Ver. 4.2.8p4
 Usage:  ntpd [ -&lt;flag&gt; [&lt;val&gt;] | --&lt;name&gt;[{=| }&lt;val&gt;] ]... \
                 [ &lt;server1&gt; ... &lt;serverN&gt; ]
   Flg Arg Option-Name    Description

contrib/ntp/ntpd/ntpd.man.in

@@ -10,11 +10,11 @@
 .ds B-Font B
 .ds I-Font I
 .ds R-Font R
-.TH ntpd @NTPD_MS@ "21 Oct 2015" "4.2.8p4" "User Commands"
+.TH ntpd @NTPD_MS@ "07 Jan 2016" "4.2.8p5" "User Commands"
 .\"
-.\" EDIT THIS FILE WITH CAUTION (/tmp/.ag-dUaOfK/ag-qUaGeK)
+.\" EDIT THIS FILE WITH CAUTION (/tmp/.ag-KDaWJq/ag-WDaOIq)
 .\"
-.\" It has been AutoGen-ed October 21, 2015 at 12:38:11 PM by AutoGen 5.18.5
+.\" It has been AutoGen-ed January 7, 2016 at 11:30:44 PM by AutoGen 5.18.5
 .\" From the definitions ntpd-opts.def
 .\" and the template file agman-cmd.tpl
 .SH NAME

contrib/ntp/ntpd/ntpd.mdoc.in

@@ -1,9 +1,9 @@
-.Dd October 21 2015
+.Dd January 7 2016
 .Dt NTPD @NTPD_MS@ User Commands
 .Os
 .\"  EDIT THIS FILE WITH CAUTION  (ntpd-opts.mdoc)
 .\"
-.\"  It has been AutoGen-ed  October 21, 2015 at 12:38:30 PM by AutoGen 5.18.5
+.\"  It has been AutoGen-ed  January  7, 2016 at 11:31:02 PM by AutoGen 5.18.5
 .\"  From the definitions    ntpd-opts.def
 .\"  and the template file   agmdoc-cmd.tpl
 .Sh NAME

contrib/ntp/ntpd/refclock_local.c

@@ -205,6 +205,7 @@ local_poll(
 	pp->disp = 0;
 	pp->jitter = 0;
 #else /* KERNEL_PLL LOCKCLOCK */
+	pp->leap = LEAP_NOWARNING;
 	pp->disp = DISPERSION;
 	pp->jitter = 0;
 #endif /* KERNEL_PLL LOCKCLOCK */

contrib/ntp/ntpd/refclock_parse.c

@@ -1630,9 +1630,9 @@ list_err(
 static char *
 mkreadable(
 	char  *buffer,
-	long  blen,
+	size_t blen,
 	const char  *src,
-	u_long  srclen,
+	size_t srclen,
 	int hex
 	)
 {

contrib/ntp/ntpd/refclock_shm.c

@@ -381,7 +381,8 @@ static inline void memory_barrier(void)
 static enum segstat_t shm_query(volatile struct shmTime *shm_in, struct shm_stat_t *shm_stat)
 /* try to grab a sample from the specified SHM segment */
 {
-    volatile struct shmTime shmcopy, *shm = shm_in;
+    struct shmTime shmcopy;
+    volatile struct shmTime *shm = shm_in;
     volatile int cnt;
 
     unsigned int cns_new, rns_new;
@@ -418,7 +419,7 @@ static enum segstat_t shm_query(volatile struct shmTime *shm_in, struct shm_stat
      * (b) memset compiles to an uninterruptible single-instruction bitblt.
      */
     memory_barrier();
-    memcpy((void *)&shmcopy, (void *)shm, sizeof(struct shmTime));
+    memcpy(&shmcopy, (void*)(uintptr_t)shm, sizeof(struct shmTime));
     shm->valid = 0;
     memory_barrier();
 

contrib/ntp/ntpd/refclock_true.c

@@ -637,7 +637,7 @@ true_send(
 
 	pp = peer->procptr;
 	if (!(pp->sloppyclockflag & CLK_FLAG1)) {
-		int len = strlen(cmd);
+		size_t len = strlen(cmd);
 
 		true_debug(peer, "Send '%s'\n", cmd);
 		if (write(pp->io.fd, cmd, (unsigned)len) != len)