Fix multiple vulnerabilities of OpenSSL.

Security: FreeBSD-SA-17:11 Approved by: so
Properly bzero kldstat structure to prevent information leak. [SA-17:10]
2026-10-31 04:45:39 +01:00 · 2017-11-29 05:59:12 +00:00 · 2017-11-15 22:50:20 +00:00 · 2017-11-15 22:40:15 +00:00 · 2017-11-02 15:39:49 +00:00 · 2017-10-17 17:56:03 +00:00
1429 changed files with 49582 additions and 89426 deletions
@@ -209,7 +209,8 @@ SUB_MAKE= `test -x ${MYMAKE} && echo ${MYMAKE} || echo ${MAKE}` \
 SUB_MAKE= ${MAKE} -m ${.CURDIR}/share/mk
 .endif

-_MAKE=	PATH=${PATH} ${SUB_MAKE} -f Makefile.inc1 TARGET=${_TARGET} TARGET_ARCH=${_TARGET_ARCH}
+_MAKE=	PATH=${PATH} MAKE_CMD=${MAKE} ${SUB_MAKE} -f Makefile.inc1 \
+	TARGET=${_TARGET} TARGET_ARCH=${_TARGET_ARCH}

 # Only allow meta mode for the whitelisted targets.  See META_TGT_WHITELIST
 # above.
@@ -1579,10 +1579,6 @@ _groff=		gnu/usr.bin/groff \
 _vtfontcvt=	usr.bin/vtfontcvt
 .endif

-.if ${BOOTSTRAPPING} < 900002
-_sed=		usr.bin/sed
-.endif
-
 .if ${BOOTSTRAPPING} < 1000033
 _libopenbsd=	lib/libopenbsd
 _m4=		usr.bin/m4
@@ -1621,10 +1617,6 @@ _crunchide=	usr.sbin/crunch/crunchide
 _crunchgen=	usr.sbin/crunch/crunchgen
 .endif

-.if ${BOOTSTRAPPING} >= 900040 && ${BOOTSTRAPPING} < 900041
-_awk=		usr.bin/awk
-.endif
-
 # r296926 -P keymap search path, MFC to stable/10 in r298297
 .if ${BOOTSTRAPPING} < 1003501 || \
 	(${BOOTSTRAPPING} >= 1100000 && ${BOOTSTRAPPING} < 1100103)
@@ -1692,7 +1684,6 @@ bootstrap-tools: .PHONY
    ${_gperf} \
    ${_groff} \
    ${_dtc} \
-    ${_awk} \
    ${_cat} \
    ${_dd} \
    ${_kbdcontrol} \
@@ -1700,7 +1691,6 @@ bootstrap-tools: .PHONY
    ${_libopenbsd} \
    ${_makewhatis} \
    usr.bin/rpcgen \
-    ${_sed} \
    ${_yacc} \
    ${_m4} \
    ${_lex} \
@@ -2372,11 +2362,11 @@ check-old-dirs: .PHONY
 	done

 delete-old: delete-old-files delete-old-dirs .PHONY
-	@echo "To remove old libraries run '${MAKE} delete-old-libs'."
+	@echo "To remove old libraries run '${MAKE_CMD} delete-old-libs'."

 check-old: check-old-files check-old-libs check-old-dirs .PHONY
-	@echo "To remove old files and directories run '${MAKE} delete-old'."
-	@echo "To remove old libraries run '${MAKE} delete-old-libs'."
+	@echo "To remove old files and directories run '${MAKE_CMD} delete-old'."
+	@echo "To remove old libraries run '${MAKE_CMD} delete-old-libs'."

 .endif

@@ -16,6 +16,104 @@ from older versions of FreeBSD, try WITHOUT_CLANG and WITH_GCC to bootstrap to
 the tip of head, and then rebuild without this option. The bootstrap process
 from older version of current across the gcc/clang cutover is a bit fragile.

+20171129	p16	FreeBSD-SA-17:11.openssl
+
+	Fix multiple vulnerabilities of OpenSSL.
+
+20171115	p15	FreeBSD-SA-17:08.ptrace
+			FreeBSD-SA-17:10.kldstat
+
+	Fix ptrace(2) vulnerability. [SA-17:08.ptrace]
+
+	Fix kldstat(2) vulnerability. [SA-17:10.kldstat]
+
+20171102	p14	FreeBSD-EN-17:09.tzdata
+
+	Update timezone database information. [EN-17:09]
+
+20171017	p13	FreeBSD-SA-17:07.wpa
+
+	Fix WPA2 protocol vulnerability. [SA-17:07]
+
+20170810	p12	FreeBSD-SA-17:06.openssh
+			FreeBSD-EN-17:07.vnet
+
+	Fix OpenSSH Denial of Service vulnerability. [SA-17:06]
+
+	Fix VNET kernel panic with asynchronous I/O. [EN-17:07]
+
+20170712	p11	FreeBSD-SA-17:05.heimdal
+
+	Fix heimdal KDC-REP service name validation vulnerability.
+
+20170427	p10	FreeBSD-SA-17:04.ipfilter
+
+	Fix ipfilter(4) fragment handling panic. [SA-17:04]
+
+20170412	p9	FreeBSD-SA-17:03.ntp
+			FreeBSD-EN-17:05.xen
+
+	Fix multiple vulnerabilities of ntp. [SA-17:03]
+
+	Xen migration enhancements. [EN-17:05]
+
+20170223	p8	FreeBSD-SA-17:02.openssl
+			FreeBSD-EN-17:01.pcie
+			FreeBSD-EN-17:02.yp
+			FreeBSD-EN-17:03.hyperv
+			FreeBSD-EN-17:04.mandoc
+
+	Fix multiple vulnerabilities of OpenSSL. [SA-17:02]
+
+	Fix system hang when booting when PCI-express HotPlug is enabled.
+	[EN-17:01]
+
+	Fix NIS master updates are not pushed to NIS slave. [EN-17:02]
+
+	Fix compatibility with Hyper-V/storage after KB3172614 or
+	KB3179574. [EN-17:03]
+
+	Make makewhatis output reproducible. [EN-17:04]
+
+20170111	p7	FreeBSD-SA-17:01.openssh
+
+	Fix multiple vulnerabilities of OpenSSH.
+
+20161222	p6	FreeBSD-SA-16:39.ntp
+
+	Fix multiple vulnerabilities of ntp.
+
+20161208	p5	FreeBSD-SA-16:37.libc [revised]
+
+	Fix regressions introduced by SA-16:37.libc.
+
+20161206	p4	FreeBSD-SA-16:36.telnetd
+			FreeBSD-SA-16:37.libc
+			FreeBSD-SA-16:38.bhyve
+			FreeBSD-EN-16:19.tzcode
+			FreeBSD-EN-16:20.tzdata
+			FreeBSD-EN-16:21.localedef
+
+	Fix possible login(1) argument injection in telnetd(8). [SA-16:36]
+	Fix link_ntoa(3) buffer overflow in libc. [SA-16:37]
+	Fix possible escape from bhyve(8) virtual machine. [SA-16:38]
+	Fix warnings about valid time zone abbreviations. [EN-16:19]
+	Update timezone database information. [EN-16:20]
+	Fix incorrectly defined unicode character(s). [EN-16:21]
+
+20161102	p3	FreeBSD-SA-16:33.openssh
+
+	Fix Fix OpenSSH remote Denial of Service vulnerability.
+
+20161025	p2	FreeBSD-SA-16:15.sysarch [revised]
+			FreeBSD-SA-16:32.bhyve
+
+	Fix incorrect argument validation in sysarch(2). [SA-16:15]
+	Fix access to host memory from guest in bhyve(8). [SA-16:32]
+
+20160928:
+	11.0-RELEASE.
+
 20160622:
 	The libc stub for the pipe(2) system call has been replaced with
 	a wrapper that calls the pipe2(2) system call and the pipe(2)
@@ -1 +1 @@
-v0.10
+v0.11
@@ -142,7 +142,7 @@ main(int argc, char **argv)
 		logfail(EX_CANTCREAT, "cannot build mbox path for `%s/%s'", _PATH_MAILDIR, user);
 	}

-	f = open(fn, O_RDONLY|O_CREAT, 0600);
+	f = open(fn, O_RDONLY|O_CREAT|O_NOFOLLOW, 0600);
 	if (f < 0)
 		logfail(EX_NOINPUT, "cannt open mbox `%s'", fn);

@@ -321,7 +321,7 @@ deliver(struct qitem *it)
 	snprintf(errmsg, sizeof(errmsg), "unknown bounce reason");

 retry:
-	syslog(LOG_INFO, "trying delivery");
+	syslog(LOG_INFO, "<%s> trying delivery", it->addr);

 	if (it->remote)
 		error = deliver_remote(it);
@@ -331,7 +331,7 @@ retry:
 	switch (error) {
 	case 0:
 		delqueue(it);
-		syslog(LOG_INFO, "delivery successful");
+		syslog(LOG_INFO, "<%s> delivery successful", it->addr);
 		exit(EX_OK);

 	case 1:
@@ -49,7 +49,7 @@
 #define VERSION	"DragonFly Mail Agent " DMA_VERSION

 #define BUF_SIZE	2048
-#define ERRMSG_SIZE	200
+#define ERRMSG_SIZE	1024
 #define USERNAME_SIZE	50
 #define MIN_RETRY	300		/* 5 minutes */
 #define MAX_RETRY	(3*60*60)	/* retry at least every 3 hours */
@@ -34,6 +34,7 @@
 */

 #include <sys/types.h>
+#include <sys/param.h>
 #include <netinet/in.h>
 #include <arpa/inet.h>
 #include <arpa/nameser.h>
@@ -196,7 +196,7 @@ retry:
 		goto out;
 	}

-	error = snprintf(line, sizeof(line), "%sFrom %s\t%s", newline, sender, ctime(&now));
+	error = snprintf(line, sizeof(line), "%sFrom %s %s", newline, sender, ctime(&now));
 	if (error < 0 || (size_t)error >= sizeof(line)) {
 		syslog(LOG_NOTICE, "local delivery deferred: can not write header: %m");
 		goto out;
@@ -372,11 +372,13 @@ deliver_to_host(struct qitem *it, struct mx_hostentry *host)
 		       host->host, host->addr, c, neterr); \
 		snprintf(errmsg, sizeof(errmsg), "%s [%s] did not like our %s:\n%s", \
 			 host->host, host->addr, c, neterr); \
-		return (-1); \
+		error = -1; \
+		goto out; \
 	} else if (res != exp) { \
 		syslog(LOG_NOTICE, "remote delivery deferred: %s [%s] failed after %s: %s", \
 		       host->host, host->addr, c, neterr); \
-		return (1); \
+		error = 1; \
+		goto out; \
 	}

 	/* Check first reply from remote host */
@@ -426,7 +428,8 @@ deliver_to_host(struct qitem *it, struct mx_hostentry *host)
 			syslog(LOG_ERR, "remote delivery failed:"
 					" SMTP login failed: %m");
 			snprintf(errmsg, sizeof(errmsg), "SMTP login to %s failed", host->host);
-			return (-1);
+			error = -1;
+			goto out;
 		}
 		/* SMTP login is not available, so try without */
 		else if (error > 0) {
@@ -1,163 +0,0 @@
-README for libarchive bundle.
-
-Questions?  Issues?
-   * http://www.libarchive.org is the home for ongoing
-     libarchive development, including documentation, and
-     links to the libarchive mailing lists.
-   * To report an issue, use the issue tracker at
-     https://github.com/libarchive/libarchive/issues
-   * To submit an enhancement to libarchive, please submit
-     a pull request via GitHub.
-     https://github.com/libarchive/libarchive/pulls
-
-This distribution bundle includes the following components:
-   * libarchive: a library for reading and writing streaming archives
-   * tar: the 'bsdtar' program is a full-featured 'tar'
-          implementation built on libarchive
-   * cpio: the 'bsdcpio' program is a different interface to
-          essentially the same functionality
-   * cat: the 'bsdcat' program is a simple replacement tool for
-          zcat, bzcat, xzcat, and such
-   * examples: Some small example programs that you may find useful.
-   * examples/minitar: a compact sample demonstrating use of libarchive.
-   * contrib:  Various items sent to me by third parties;
-          please contact the authors with any questions.
-
-The top-level directory contains the following information files:
-   * NEWS - highlights of recent changes
-   * COPYING - what you can do with this
-   * INSTALL - installation instructions
-   * README - this file
-   * configure - configuration script, see INSTALL for details.
-   * CMakeLists.txt - input for "cmake" build tool, see INSTALL
-
-The following files in the top-level directory are used by the
-'configure' script:
-   * Makefile.am, aclocal.m4, configure.ac
-       - used to build this distribution, only needed by maintainers
-   * Makefile.in, config.h.in
-	- templates used by configure script
-
-Guide to Documentation installed by this system:
- * bsdtar.1 explains the use of the bsdtar program
- * bsdcpio.1 explains the use of the bsdcpio program
- * bsdcat.1 explains the use of the bsdcat program
- * libarchive.3 gives an overview of the library as a whole
- * archive_read.3, archive_write.3, archive_write_disk.3, and
-   archive_read_disk.3 provide detailed calling sequences for the read
-   and write APIs
- * archive_entry.3 details the "struct archive_entry" utility class
- * archive_internals.3 provides some insight into libarchive's
-   internal structure and operation.
- * libarchive-formats.5 documents the file formats supported by the library
- * cpio.5, mtree.5, and tar.5 provide detailed information about these
-   popular archive formats, including hard-to-find details about
-   modern cpio and tar variants.
-The manual pages above are provided in the 'doc' directory in
-a number of different formats.
-
-You should also read the copious comments in "archive.h" and the
-source code for the sample programs for more details.  Please let us
-know about any errors or omissions you find.
-
-Currently, the library automatically detects and reads the following fomats:
-  * GNU tar format (including GNU long filenames, long link names, and sparse files)
-  * Solaris 9 extended tar format (including ACLs)
-  * Old V7 tar archives
-  * POSIX ustar
-  * POSIX pax interchange format
-  * POSIX octet-oriented cpio
-  * SVR4 ASCII cpio
-  * POSIX octet-oriented cpio
-  * Binary cpio (big-endian or little-endian)
-  * ISO9660 CD-ROM images (with optional Rockridge or Joliet extensions)
-  * ZIP archives (with uncompressed or "deflate" compressed entries)
-  * GNU and BSD 'ar' archives
-  * 'mtree' format
-  * 7-Zip archives
-  * Microsoft CAB format
-  * LHA and LZH archives
-  * RAR archives
-  * XAR archives
-
-The library also detects and handles any of the following before evaluating the archive:
-  * uuencoded files
-  * files with RPM wrapper
-  * gzip compression
-  * bzip2 compression
-  * compress/LZW compression
-  * lzma, lzip, and xz compression
-  * lz4 compression
-  * lzop compression
-
-The library can create archives in any of the following formats:
-  * POSIX ustar
-  * POSIX pax interchange format
-  * "restricted" pax format, which will create ustar archives except for
-    entries that require pax extensions (for long filenames, ACLs, etc).
-  * Old GNU tar format
-  * Old V7 tar format
-  * POSIX octet-oriented cpio
-  * SVR4 "newc" cpio
-  * shar archives
-  * ZIP archives (with uncompressed or "deflate" compressed entries)
-  * GNU and BSD 'ar' archives
-  * 'mtree' format
-  * ISO9660 format
-  * 7-Zip archives
-  * XAR archives
-
-When creating archives, the result can be filtered with any of the following:
-  * uuencode
-  * gzip compression
-  * bzip2 compression
-  * compress/LZW compression
-  * lzma, lzip, and xz compression
-  * lz4 compression
-  * lzop compression
-
-Notes about the library architecture:
-
- * This is a heavily stream-oriented system.  There is no direct
-   support for in-place modification or random access.
-
- * The library is designed to be extended with new compression and
-   archive formats.  The only requirement is that the format be
-   readable or writable as a stream and that each archive entry be
-   independent.  There are articles on the libarchive Wiki explaining
-   how to extend libarchive.
-
- * On read, compression and format are always detected automatically.
-
- * I've attempted to minimize static link pollution.  If you don't
-   explicitly invoke a particular feature (such as support for a
-   particular compression or format), it won't get pulled in to
-   statically-linked programs.  In particular, if you don't explicitly
-   enable a particular compression or decompression support, you won't
-   need to link against the corresponding compression or decompression
-   libraries.  This also reduces the size of statically-linked
-   binaries in environments where that matters.
-
- * On read, the library accepts whatever blocks you hand it.
-   Your read callback is free to pass the library a byte at a time
-   or mmap the entire archive and give it to the library at once.
-   On write, the library always produces correctly-blocked output.
-
- * The object-style approach allows you to have multiple archive streams
-   open at once.  bsdtar uses this in its "@archive" extension.
-
- * The archive itself is read/written using callback functions.
-   You can read an archive directly from an in-memory buffer or
-   write it to a socket, if you wish.  There are some utility
-   functions to provide easy-to-use "open file," etc, capabilities.
-
- * The read/write APIs are designed to allow individual entries
-   to be read or written to any data source:  You can create
-   a block of data in memory and add it to a tar archive without
-   first writing a temporary file.  You can also read an entry from
-   an archive and write the data directly to a socket.  If you want
-   to read/write entries to disk, there are convenience functions to
-   make this especially easy.
-
- * Note: "pax interchange format" is really an extended tar format,
-   despite what the name says.
@@ -0,0 +1,222 @@
+# Welcome to libarchive!
+
+The libarchive project develops a portable, efficient C library that
+can read and write streaming archives in a variety of formats.  It
+also includes implementations of the common `tar`, `cpio`, and `zcat`
+command-line tools that use the libarchive library.
+
+## Questions?  Issues?
+
+* http://www.libarchive.org is the home for ongoing
+  libarchive development, including documentation,
+  and links to the libarchive mailing lists.
+* To report an issue, use the issue tracker at
+  https://github.com/libarchive/libarchive/issues
+* To submit an enhancement to libarchive, please
+  submit a pull request via GitHub: https://github.com/libarchive/libarchive/pulls
+
+## Contents of the Distribution
+
+This distribution bundle includes the following major components:
+
+* **libarchive**: a library for reading and writing streaming archives
+* **tar**: the 'bsdtar' program is a full-featured 'tar' implementation built on libarchive
+* **cpio**: the 'bsdcpio' program is a different interface to essentially the same functionality
+* **cat**: the 'bsdcat' program is a simple replacement tool for zcat, bzcat, xzcat, and such
+* **examples**: Some small example programs that you may find useful.
+* **examples/minitar**: a compact sample demonstrating use of libarchive.
+* **contrib**:  Various items sent to me by third parties; please contact the authors with any questions.
+
+The top-level directory contains the following information files:
+
+* **NEWS** - highlights of recent changes
+* **COPYING** - what you can do with this
+* **INSTALL** - installation instructions
+* **README** - this file
+* **CMakeLists.txt** - input for "cmake" build tool, see INSTALL
+* **configure** - configuration script, see INSTALL for details.  If your copy of the source lacks a `configure` script, you can try to construct it by running the script in `build/autogen.sh` (or use `cmake`).
+
+The following files in the top-level directory are used by the 'configure' script:
+* `Makefile.am`, `aclocal.m4`, `configure.ac` - used to build this distribution, only needed by maintainers
+* `Makefile.in`, `config.h.in` - templates used by configure script
+
+## Documentation
+
+In addition to the informational articles and documentation
+in the online [libarchive Wiki](https://github.com/libarchive/libarchive/wiki),
+the distribution also includes a number of manual pages:
+
+ * bsdtar.1 explains the use of the bsdtar program
+ * bsdcpio.1 explains the use of the bsdcpio program
+ * bsdcat.1 explains the use of the bsdcat program
+ * libarchive.3 gives an overview of the library as a whole
+ * archive_read.3, archive_write.3, archive_write_disk.3, and
+   archive_read_disk.3 provide detailed calling sequences for the read
+   and write APIs
+ * archive_entry.3 details the "struct archive_entry" utility class
+ * archive_internals.3 provides some insight into libarchive's
+   internal structure and operation.
+ * libarchive-formats.5 documents the file formats supported by the library
+ * cpio.5, mtree.5, and tar.5 provide detailed information about these
+   popular archive formats, including hard-to-find details about
+   modern cpio and tar variants.
+
+The manual pages above are provided in the 'doc' directory in
+a number of different formats.
+
+You should also read the copious comments in `archive.h` and the
+source code for the sample programs for more details.  Please let us
+know about any errors or omissions you find.
+
+## Supported Formats
+
+Currently, the library automatically detects and reads the following fomats:
+  * Old V7 tar archives
+  * POSIX ustar
+  * GNU tar format (including GNU long filenames, long link names, and sparse files)
+  * Solaris 9 extended tar format (including ACLs)
+  * POSIX pax interchange format
+  * POSIX octet-oriented cpio
+  * SVR4 ASCII cpio
+  * POSIX octet-oriented cpio
+  * Binary cpio (big-endian or little-endian)
+  * ISO9660 CD-ROM images (with optional Rockridge or Joliet extensions)
+  * ZIP archives (with uncompressed or "deflate" compressed entries, including support for encrypted Zip archives)
+  * GNU and BSD 'ar' archives
+  * 'mtree' format
+  * 7-Zip archives
+  * Microsoft CAB format
+  * LHA and LZH archives
+  * RAR archives (with some limitations due to RAR's proprietary status)
+  * XAR archives
+
+The library also detects and handles any of the following before evaluating the archive:
+  * uuencoded files
+  * files with RPM wrapper
+  * gzip compression
+  * bzip2 compression
+  * compress/LZW compression
+  * lzma, lzip, and xz compression
+  * lz4 compression
+  * lzop compression
+
+The library can create archives in any of the following formats:
+  * POSIX ustar
+  * POSIX pax interchange format
+  * "restricted" pax format, which will create ustar archives except for
+    entries that require pax extensions (for long filenames, ACLs, etc).
+  * Old GNU tar format
+  * Old V7 tar format
+  * POSIX octet-oriented cpio
+  * SVR4 "newc" cpio
+  * shar archives
+  * ZIP archives (with uncompressed or "deflate" compressed entries)
+  * GNU and BSD 'ar' archives
+  * 'mtree' format
+  * ISO9660 format
+  * 7-Zip archives
+  * XAR archives
+
+When creating archives, the result can be filtered with any of the following:
+  * uuencode
+  * gzip compression
+  * bzip2 compression
+  * compress/LZW compression
+  * lzma, lzip, and xz compression
+  * lz4 compression
+  * lzop compression
+
+## Notes about the Library Design
+
+The following notes address many of the most common
+questions we are asked about libarchive:
+
+* This is a heavily stream-oriented system.  That means that
+  it is optimized to read or write the archive in a single
+  pass from beginning to end.  For example, this allows
+  libarchive to process archives too large to store on disk
+  by processing them on-the-fly as they are read from or
+  written to a network or tape drive.  This also makes
+  libarchive useful for tools that need to produce
+  archives on-the-fly (such as webservers that provide
+  archived contents of a users account).
+
+* In-place modification and random access to the contents
+  of an archive are not directly supported.  For some formats,
+  this is not an issue: For example, tar.gz archives are not
+  designed for random access.  In some other cases, libarchive
+  can re-open an archive and scan it from the beginning quickly
+  enough to provide the needed abilities even without true
+  random access.  Of course, some applications do require true
+  random access; those applications should consider alternatives
+  to libarchive.
+
+* The library is designed to be extended with new compression and
+  archive formats.  The only requirement is that the format be
+  readable or writable as a stream and that each archive entry be
+  independent.  There are articles on the libarchive Wiki explaining
+  how to extend libarchive.
+
+* On read, compression and format are always detected automatically.
+
+* The same API is used for all formats; in particular, it's very
+  easy for software using libarchive to transparently handle
+  any of libarchive's archiving formats.
+
+* Libarchive's automatic support for decompression can be used
+  without archiving by explicitly selecting the "raw" and "empty"
+  formats.
+
+* I've attempted to minimize static link pollution.  If you don't
+  explicitly invoke a particular feature (such as support for a
+  particular compression or format), it won't get pulled in to
+  statically-linked programs.  In particular, if you don't explicitly
+  enable a particular compression or decompression support, you won't
+  need to link against the corresponding compression or decompression
+  libraries.  This also reduces the size of statically-linked
+  binaries in environments where that matters.
+
+* The library is generally _thread safe_ depending on the platform:
+  it does not define any global variables of its own.  However, some
+  platforms do not provide fully thread-safe versions of key C library
+  functions.  On those platforms, libarchive will use the non-thread-safe
+  functions.  Patches to improve this are of great interest to us.
+
+* In particular, libarchive's modules to read or write a directory
+  tree do use `chdir()` to optimize the directory traversals.  This
+  can cause problems for programs that expect to do disk access from
+  multiple threads.  Of course, those modules are completely
+  optional and you can use the rest of libarchive without them.
+
+* The library is _not_ thread aware, however.  It does no locking
+  or thread management of any kind.  If you create a libarchive
+  object and need to access it from multiple threads, you will
+  need to provide your own locking.
+
+* On read, the library accepts whatever blocks you hand it.
+  Your read callback is free to pass the library a byte at a time
+  or mmap the entire archive and give it to the library at once.
+  On write, the library always produces correctly-blocked output.
+
+* The object-style approach allows you to have multiple archive streams
+  open at once.  bsdtar uses this in its "@archive" extension.
+
+* The archive itself is read/written using callback functions.
+  You can read an archive directly from an in-memory buffer or
+  write it to a socket, if you wish.  There are some utility
+  functions to provide easy-to-use "open file," etc, capabilities.
+
+* The read/write APIs are designed to allow individual entries
+  to be read or written to any data source:  You can create
+  a block of data in memory and add it to a tar archive without
+  first writing a temporary file.  You can also read an entry from
+  an archive and write the data directly to a socket.  If you want
+  to read/write entries to disk, there are convenience functions to
+  make this especially easy.
+
+* Note: The "pax interchange format" is a POSIX standard extended tar
+  format that should be used when the older _ustar_ format is not
+  appropriate.  It has many advantages over other tar formats
+  (including the legacy GNU tar format) and is widely supported by
+  current tar implementations.
+
@@ -83,7 +83,7 @@ DEFINE_TEST(test_version)
 	if (*q == 'a' || *q == 'b' || *q == 'c' || *q == 'd')
 		++q;
 	/* Skip arbitrary third-party version numbers. */
-	while (s > 0 && (*q == ' ' || *q == '/' || *q == '.' || isalnum(*q))) {
+	while (s > 0 && (*q == ' ' || *q == '-' || *q == '/' || *q == '.' || isalnum(*q))) {
 		++q;
 		--s;
 	}
@@ -63,6 +63,7 @@ static const struct option {
 } cpio_longopts[] = {
 	{ "b64encode",			0, OPTION_B64ENCODE },
 	{ "create",			0, 'o' },
+	{ "dereference",		0, 'L' },
 	{ "dot",			0, 'V' },
 	{ "extract",			0, 'i' },
 	{ "file",			1, 'F' },
@@ -75,7 +75,7 @@ verify(const char *p, size_t s)
 	if (*q == 'a' || *q == 'b' || *q == 'c' || *q == 'd')
 		++q;
 	/* Skip arbitrary third-party version numbers. */
-	while (s > 0 && (*q == ' ' || *q == '/' || *q == '.' || isalnum(*q))) {
+	while (s > 0 && (*q == ' ' || *q == '-' || *q == '/' || *q == '.' || isalnum(*q))) {
 		++q;
 		--s;
 	}
@@ -707,10 +707,11 @@ archive_acl_text_l(struct archive_acl *acl, int flags,
 			if (r != 0)
 				return (-1);
 			*p++ = separator;
-			if (flags & ARCHIVE_ENTRY_ACL_STYLE_EXTRA_ID)
+			if (name == NULL || (flags & ARCHIVE_ENTRY_ACL_STYLE_EXTRA_ID)) {
 				id = ap->id;
-			else
+			} else {
 				id = -1;
+			}
 			append_entry(&p, NULL, ap->tag, name,
 			    ap->permset, id);
 			count++;
@@ -655,7 +655,7 @@ add_pattern_from_file(struct archive_match *a, struct match_list *mlist,
 		}
 	}

-	/* If something error happend, report it immediately. */ 
+	/* If an error occurred, report it immediately. */
 	if (r < ARCHIVE_OK) {
 		archive_copy_error(&(a->archive), ar);
 		archive_read_free(ar);
@@ -159,6 +159,15 @@
 #define	CAN_RESTORE_METADATA_FD
 #endif

+/*
+ * glibc 2.24 deprecates readdir_r
+ */
+#if defined(HAVE_READDIR_R) && (!defined(__GLIBC__) || !defined(__GLIBC_MINOR__) || __GLIBC__ < 2 || (__GLIBC__ == 2 && __GLIBC_MINOR__ < 24))
+#define	USE_READDIR_R	1
+#else
+#undef	USE_READDIR_R
+#endif
+
 /* Set up defaults for internal error codes. */
 #ifndef ARCHIVE_ERRNO_FILE_FORMAT
 #if HAVE_EFTYPE
@@ -19,7 +19,7 @@ If you need the compatibility with original PPMd var.H, you can use external Ran
 #define PPMD7_MAX_ORDER 64

 #define PPMD7_MIN_MEM_SIZE (1 << 11)
-#define PPMD7_MAX_MEM_SIZE (0xFFFFFFFF - 12 * 3)
+#define PPMD7_MAX_MEM_SIZE (0xFFFFFFFFu - 12 * 3)

 struct CPpmd7_Context_;

@@ -125,7 +125,7 @@ void
 __archive_read_reset_passphrase(struct archive_read *a)
 {

-	a->passphrases.candiate = -1;
+	a->passphrases.candidate = -1;
 }

 /*
@@ -137,31 +137,31 @@ __archive_read_next_passphrase(struct archive_read *a)
 	struct archive_read_passphrase *p;
 	const char *passphrase;

-	if (a->passphrases.candiate < 0) {
+	if (a->passphrases.candidate < 0) {
 		/* Count out how many passphrases we have. */
 		int cnt = 0;

 		for (p = a->passphrases.first; p != NULL; p = p->next)
 			cnt++;
-		a->passphrases.candiate = cnt;
+		a->passphrases.candidate = cnt;
 		p = a->passphrases.first;
-	} else if (a->passphrases.candiate > 1) {
+	} else if (a->passphrases.candidate > 1) {
 		/* Rotate a passphrase list. */
-		a->passphrases.candiate--;
+		a->passphrases.candidate--;
 		p = remove_passphrases_from_head(a);
 		add_passphrase_to_tail(a, p);
-		/* Pick a new passphrase candiate up. */
+		/* Pick a new passphrase candidate up. */
 		p = a->passphrases.first;
-	} else if (a->passphrases.candiate == 1) {
-		/* This case is that all cadiates failed to decryption. */
-		a->passphrases.candiate = 0;
+	} else if (a->passphrases.candidate == 1) {
+		/* This case is that all candidates failed to decrypt. */
+		a->passphrases.candidate = 0;
 		if (a->passphrases.first->next != NULL) {
 			/* Rotate a passphrase list. */
 			p = remove_passphrases_from_head(a);
 			add_passphrase_to_tail(a, p);
 		}
 		p = NULL;
-	} else  /* There is no passphrase candaite. */
+	} else  /* There is no passphrase candidate. */
 		p = NULL;

 	if (p != NULL)
@@ -177,7 +177,7 @@ __archive_read_next_passphrase(struct archive_read *a)
 			if (p == NULL)
 				return (NULL);
 			insert_passphrase_to_head(a, p);
-			a->passphrases.candiate = 1;
+			a->passphrases.candidate = 1;
 		}
 	} else
 		passphrase = NULL;
@@ -411,20 +411,38 @@ setup_acls(struct archive_read_disk *a,
 {
 	const char	*accpath;
 	acl_t		 acl;
-#if HAVE_ACL_IS_TRIVIAL_NP
 	int		r;
-#endif

 	accpath = archive_entry_sourcepath(entry);
 	if (accpath == NULL)
 		accpath = archive_entry_pathname(entry);

+	if (*fd < 0 && a->tree != NULL) {
+		if (a->follow_symlinks ||
+		    archive_entry_filetype(entry) != AE_IFLNK)
+			*fd = a->open_on_current_dir(a->tree,
+			    accpath, O_RDONLY | O_NONBLOCK);
+		if (*fd < 0) {
+			if (a->tree_enter_working_dir(a->tree) != 0) {
+				archive_set_error(&a->archive, errno,
+				    "Couldn't access %s", accpath);
+				return (ARCHIVE_FAILED);
+			}
+		}
+	}
+
 	archive_entry_acl_clear(entry);

+	acl = NULL;
+
 #ifdef ACL_TYPE_NFS4
 	/* Try NFS4 ACL first. */
 	if (*fd >= 0)
+#if HAVE_ACL_GET_FD_NP
+		acl = acl_get_fd_np(*fd, ACL_TYPE_NFS4);
+#else
 		acl = acl_get_fd(*fd);
+#endif
 #if HAVE_ACL_GET_LINK_NP
 	else if (!a->follow_symlinks)
 		acl = acl_get_link_np(accpath, ACL_TYPE_NFS4);
@@ -437,20 +455,31 @@ setup_acls(struct archive_read_disk *a,
 #endif
 	else
 		acl = acl_get_file(accpath, ACL_TYPE_NFS4);
+
 #if HAVE_ACL_IS_TRIVIAL_NP
-	/* Ignore "trivial" ACLs that just mirror the file mode. */
-	acl_is_trivial_np(acl, &r);
-	if (r) {
-		acl_free(acl);
-		acl = NULL;
+	if (acl != NULL && acl_is_trivial_np(acl, &r) == 0) {
+		/* Ignore "trivial" ACLs that just mirror the file mode. */
+		if (r) {
+			acl_free(acl);
+			acl = NULL;
+			/*
+			 * Simultaneous NFSv4 and POSIX.1e ACLs for the same
+			 * entry are not allowed, so we should return here
+			 */
+			return (ARCHIVE_OK);
+		}
 	}
 #endif
 	if (acl != NULL) {
-		translate_acl(a, entry, acl, ARCHIVE_ENTRY_ACL_TYPE_NFS4);
+		r = translate_acl(a, entry, acl, ARCHIVE_ENTRY_ACL_TYPE_NFS4);
 		acl_free(acl);
-		return (ARCHIVE_OK);
+		if (r != ARCHIVE_OK) {
+			archive_set_error(&a->archive, errno,
+			    "Couldn't translate NFSv4 ACLs: %s", accpath);
+		}
+		return (r);
 	}
-#endif
+#endif	/* ACL_TYPE_NFS4 */

 	/* Retrieve access ACL from file. */
 	if (*fd >= 0)
@@ -467,19 +496,42 @@ setup_acls(struct archive_read_disk *a,
 #endif
 	else
 		acl = acl_get_file(accpath, ACL_TYPE_ACCESS);
+
+#if HAVE_ACL_IS_TRIVIAL_NP
+	/* Ignore "trivial" ACLs that just mirror the file mode. */
+	if (acl != NULL && acl_is_trivial_np(acl, &r) == 0) {
+		if (r) {
+			acl_free(acl);
+			acl = NULL;
+		}
+	}
+#endif
+
 	if (acl != NULL) {
-		translate_acl(a, entry, acl,
+		r = translate_acl(a, entry, acl,
 		    ARCHIVE_ENTRY_ACL_TYPE_ACCESS);
 		acl_free(acl);
+		acl = NULL;
+		if (r != ARCHIVE_OK) {
+			archive_set_error(&a->archive, errno,
+			    "Couldn't translate access ACLs: %s", accpath);
+			return (r);
+		}
 	}

 	/* Only directories can have default ACLs. */
 	if (S_ISDIR(archive_entry_mode(entry))) {
 		acl = acl_get_file(accpath, ACL_TYPE_DEFAULT);
 		if (acl != NULL) {
-			translate_acl(a, entry, acl,
+			r = translate_acl(a, entry, acl,
 			    ARCHIVE_ENTRY_ACL_TYPE_DEFAULT);
 			acl_free(acl);
+			if (r != ARCHIVE_OK) {
+				archive_set_error(&a->archive, errno,
+				    "Couldn't translate default ACLs: %s",
+				    accpath);
+				return (r);
+			}
 		}
 	}
 	return (ARCHIVE_OK);
@@ -535,19 +587,23 @@ translate_acl(struct archive_read_disk *a,
 #ifdef ACL_TYPE_NFS4
 	acl_entry_type_t acl_type;
 	acl_flagset_t	 acl_flagset;
-	int brand, r;
+	int brand;
 #endif
 	acl_entry_t	 acl_entry;
 	acl_permset_t	 acl_permset;
 	int		 i, entry_acl_type;
-	int		 s, ae_id, ae_tag, ae_perm;
+	int		 r, s, ae_id, ae_tag, ae_perm;
 	const char	*ae_name;

 #ifdef ACL_TYPE_NFS4
 	// FreeBSD "brands" ACLs as POSIX.1e or NFSv4
 	// Make sure the "brand" on this ACL is consistent
 	// with the default_entry_acl_type bits provided.
-	acl_get_brand_np(acl, &brand);
+	if (acl_get_brand_np(acl, &brand) != 0) {
+		archive_set_error(&a->archive, errno,
+		    "Failed to read ACL brand");
+		return (ARCHIVE_WARN);
+	}
 	switch (brand) {
 	case ACL_BRAND_POSIX:
 		switch (default_entry_acl_type) {
@@ -555,31 +611,43 @@ translate_acl(struct archive_read_disk *a,
 		case ARCHIVE_ENTRY_ACL_TYPE_DEFAULT:
 			break;
 		default:
-			// XXX set warning message?
-			return ARCHIVE_FAILED;
+			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
+			    "Invalid ACL entry type for POSIX.1e ACL");
+			return (ARCHIVE_WARN);
 		}
 		break;
 	case ACL_BRAND_NFS4:
 		if (default_entry_acl_type & ~ARCHIVE_ENTRY_ACL_TYPE_NFS4) {
-			// XXX set warning message?
-			return ARCHIVE_FAILED;
+			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
+			    "Invalid ACL entry type for NFSv4 ACL");
+			return (ARCHIVE_WARN);
 		}
 		break;
 	default:
-		// XXX set warning message?
-		return ARCHIVE_FAILED;
+		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
+		    "Unknown ACL brand");
+		return (ARCHIVE_WARN);
 		break;
 	}
 #endif


 	s = acl_get_entry(acl, ACL_FIRST_ENTRY, &acl_entry);
+	if (s == -1) {
+		archive_set_error(&a->archive, errno,
+		    "Failed to get first ACL entry");
+		return (ARCHIVE_WARN);
+	}
 	while (s == 1) {
 		ae_id = -1;
 		ae_name = NULL;
 		ae_perm = 0;

-		acl_get_tag_type(acl_entry, &acl_tag);
+		if (acl_get_tag_type(acl_entry, &acl_tag) != 0) {
+			archive_set_error(&a->archive, errno,
+			    "Failed to get ACL tag type");
+			return (ARCHIVE_WARN);
+		}
 		switch (acl_tag) {
 		case ACL_USER:
 			ae_id = (int)*(uid_t *)acl_get_qualifier(acl_entry);
@@ -614,13 +682,18 @@ translate_acl(struct archive_read_disk *a,
 			continue;
 		}

-		// XXX acl type maps to allow/deny/audit/YYYY bits
-		// XXX acl_get_entry_type_np on FreeBSD returns EINVAL for
-		// non-NFSv4 ACLs
+		// XXX acl_type maps to allow/deny/audit/YYYY bits
 		entry_acl_type = default_entry_acl_type;
 #ifdef ACL_TYPE_NFS4
-		r = acl_get_entry_type_np(acl_entry, &acl_type);
-		if (r == 0) {
+		if (default_entry_acl_type & ARCHIVE_ENTRY_ACL_TYPE_NFS4) {
+			/*
+			 * acl_get_entry_type_np() falis with non-NFSv4 ACLs
+			 */
+			if (acl_get_entry_type_np(acl_entry, &acl_type) != 0) {
+				archive_set_error(&a->archive, errno, "Failed "
+				    "to get ACL type from a NFSv4 ACL entry");
+				return (ARCHIVE_WARN);
+			}
 			switch (acl_type) {
 			case ACL_ENTRY_TYPE_ALLOW:
 				entry_acl_type = ARCHIVE_ENTRY_ACL_TYPE_ALLOW;
@@ -634,29 +707,53 @@ translate_acl(struct archive_read_disk *a,
 			case ACL_ENTRY_TYPE_ALARM:
 				entry_acl_type = ARCHIVE_ENTRY_ACL_TYPE_ALARM;
 				break;
+			default:
+				archive_set_error(&a->archive, errno,
+				    "Invalid NFSv4 ACL entry type");
+				return (ARCHIVE_WARN);
 			}
+
+			/*
+			 * Libarchive stores "flag" (NFSv4 inheritance bits)
+			 * in the ae_perm bitmap.
+			 *
+			 * acl_get_flagset_np() fails with non-NFSv4 ACLs
+			 */
+			if (acl_get_flagset_np(acl_entry, &acl_flagset) != 0) {
+				archive_set_error(&a->archive, errno,
+				    "Failed to get flagset from a NFSv4 ACL entry");
+				return (ARCHIVE_WARN);
+			}
+	                for (i = 0; i < (int)(sizeof(acl_inherit_map) / sizeof(acl_inherit_map[0])); ++i) {
+				r = acl_get_flag_np(acl_flagset,
+				    acl_inherit_map[i].platform_inherit);
+				if (r == -1) {
+					archive_set_error(&a->archive, errno,
+					    "Failed to check flag in a NFSv4 "
+					    "ACL flagset");
+					return (ARCHIVE_WARN);
+				} else if (r)
+					ae_perm |= acl_inherit_map[i].archive_inherit;
+                	}
 		}
-
-		/*
-		 * Libarchive stores "flag" (NFSv4 inheritance bits)
-		 * in the ae_perm bitmap.
-		 */
-		acl_get_flagset_np(acl_entry, &acl_flagset);
-                for (i = 0; i < (int)(sizeof(acl_inherit_map) / sizeof(acl_inherit_map[0])); ++i) {
-			if (acl_get_flag_np(acl_flagset,
-					    acl_inherit_map[i].platform_inherit))
-				ae_perm |= acl_inherit_map[i].archive_inherit;
-
-                }
 #endif

-		acl_get_permset(acl_entry, &acl_permset);
+		if (acl_get_permset(acl_entry, &acl_permset) != 0) {
+			archive_set_error(&a->archive, errno,
+			    "Failed to get ACL permission set");
+			return (ARCHIVE_WARN);
+		}
 		for (i = 0; i < (int)(sizeof(acl_perm_map) / sizeof(acl_perm_map[0])); ++i) {
 			/*
 			 * acl_get_perm() is spelled differently on different
 			 * platforms; see above.
 			 */
-			if (ACL_GET_PERM(acl_permset, acl_perm_map[i].platform_perm))
+			r = ACL_GET_PERM(acl_permset, acl_perm_map[i].platform_perm);
+			if (r == -1) {
+				archive_set_error(&a->archive, errno,
+				    "Failed to check permission in an ACL permission set");
+				return (ARCHIVE_WARN);
+			} else if (r)
 				ae_perm |= acl_perm_map[i].archive_perm;
 		}

@@ -665,6 +762,11 @@ translate_acl(struct archive_read_disk *a,
 					    ae_id, ae_name);

 		s = acl_get_entry(acl, ACL_NEXT_ENTRY, &acl_entry);
+		if (s == -1) {
+			archive_set_error(&a->archive, errno,
+			    "Failed to get next ACL entry");
+			return (ARCHIVE_WARN);
+		}
 	}
 	return (ARCHIVE_OK);
 }
@@ -165,7 +165,7 @@ struct filesystem {
 	int		synthetic;
 	int		remote;
 	int		noatime;
-#if defined(HAVE_READDIR_R)
+#if defined(USE_READDIR_R)
 	size_t		name_max;
 #endif
 	long		incr_xfer_size;
@@ -200,7 +200,7 @@ struct tree {
 	DIR			*d;
 #define	INVALID_DIR_HANDLE NULL
 	struct dirent		*de;
-#if defined(HAVE_READDIR_R)
+#if defined(USE_READDIR_R)
 	struct dirent		*dirent;
 	size_t			 dirent_allocated;
 #endif
@@ -938,7 +938,7 @@ next_entry(struct archive_read_disk *a, struct tree *t,
 		r = archive_match_path_excluded(a->matching, entry);
 		if (r < 0) {
 			archive_set_error(&(a->archive), errno,
-			    "Faild : %s", archive_error_string(a->matching));
+			    "Failed : %s", archive_error_string(a->matching));
 			return (r);
 		}
 		if (r) {
@@ -1041,7 +1041,7 @@ next_entry(struct archive_read_disk *a, struct tree *t,
 		r = archive_match_time_excluded(a->matching, entry);
 		if (r < 0) {
 			archive_set_error(&(a->archive), errno,
-			    "Faild : %s", archive_error_string(a->matching));
+			    "Failed : %s", archive_error_string(a->matching));
 			return (r);
 		}
 		if (r) {
@@ -1067,7 +1067,7 @@ next_entry(struct archive_read_disk *a, struct tree *t,
 		r = archive_match_owner_excluded(a->matching, entry);
 		if (r < 0) {
 			archive_set_error(&(a->archive), errno,
-			    "Faild : %s", archive_error_string(a->matching));
+			    "Failed : %s", archive_error_string(a->matching));
 			return (r);
 		}
 		if (r) {
@@ -1504,10 +1504,19 @@ setup_current_filesystem(struct archive_read_disk *a)
 	struct tree *t = a->tree;
 	struct statfs sfs;
 #if defined(HAVE_GETVFSBYNAME) && defined(VFCF_SYNTHETIC)
-#  if defined(HAVE_STRUCT_VFSCONF)
-	struct vfsconf vfc;
-#  else
+/* TODO: configure should set GETVFSBYNAME_ARG_TYPE to make
+ * this accurate; some platforms have both and we need the one that's
+ * used by getvfsbyname()
+ *
+ * Then the following would become:
+ *  #if defined(GETVFSBYNAME_ARG_TYPE)
+ *   GETVFSBYNAME_ARG_TYPE vfc;
+ *  #endif
+ */
+#  if defined(HAVE_STRUCT_XVFSCONF)
 	struct xvfsconf vfc;
+#  else
+	struct vfsconf vfc;
 #  endif
 #endif
 	int r, xr = 0;
@@ -1583,7 +1592,7 @@ setup_current_filesystem(struct archive_read_disk *a)
 #endif
 		t->current_filesystem->noatime = 0;

-#if defined(HAVE_READDIR_R)
+#if defined(USE_READDIR_R)
 	/* Set maximum filename length. */
 #if defined(HAVE_STRUCT_STATFS_F_NAMEMAX)
 	t->current_filesystem->name_max = sfs.f_namemax;
@@ -1606,7 +1615,7 @@ setup_current_filesystem(struct archive_read_disk *a)
 	else
 		t->current_filesystem->name_max = nm;
 #endif
-#endif /* HAVE_READDIR_R */
+#endif /* USE_READDIR_R */
 	return (ARCHIVE_OK);
 }

@@ -1808,7 +1817,7 @@ setup_current_filesystem(struct archive_read_disk *a)
 #endif
 		t->current_filesystem->noatime = 0;

-#if defined(HAVE_READDIR_R)
+#if defined(USE_READDIR_R)
 	/* Set maximum filename length. */
 	t->current_filesystem->name_max = sfs.f_namelen;
 #endif
@@ -1892,7 +1901,7 @@ setup_current_filesystem(struct archive_read_disk *a)
 #endif
 		t->current_filesystem->noatime = 0;

-#if defined(HAVE_READDIR_R)
+#if defined(USE_READDIR_R)
 	/* Set maximum filename length. */
 	t->current_filesystem->name_max = sfs.f_namemax;
 #endif
@@ -1909,7 +1918,7 @@ static int
 setup_current_filesystem(struct archive_read_disk *a)
 {
 	struct tree *t = a->tree;
-#if defined(_PC_NAME_MAX) && defined(HAVE_READDIR_R)
+#if defined(_PC_NAME_MAX) && defined(USE_READDIR_R)
 	long nm;
 #endif
 	t->current_filesystem->synthetic = -1;/* Not supported */
@@ -1921,7 +1930,7 @@ setup_current_filesystem(struct archive_read_disk *a)
 	t->current_filesystem->min_xfer_size = -1;
 	t->current_filesystem->incr_xfer_size = -1;

-#if defined(HAVE_READDIR_R)
+#if defined(USE_READDIR_R)
 	/* Set maximum filename length. */
 #  if defined(_PC_NAME_MAX)
 	if (tree_current_is_symblic_link_target(t)) {
@@ -1949,7 +1958,7 @@ setup_current_filesystem(struct archive_read_disk *a)
 	else
 		t->current_filesystem->name_max = nm;
 #  endif /* _PC_NAME_MAX */
-#endif /* HAVE_READDIR_R */
+#endif /* USE_READDIR_R */
 	return (ARCHIVE_OK);
 }

@@ -2357,7 +2366,7 @@ tree_dir_next_posix(struct tree *t)
 	size_t namelen;

 	if (t->d == NULL) {
-#if defined(HAVE_READDIR_R)
+#if defined(USE_READDIR_R)
 		size_t dirent_size;
 #endif

@@ -2378,7 +2387,7 @@ tree_dir_next_posix(struct tree *t)
 			t->visit_type = r != 0 ? r : TREE_ERROR_DIR;
 			return (t->visit_type);
 		}
-#if defined(HAVE_READDIR_R)
+#if defined(USE_READDIR_R)
 		dirent_size = offsetof(struct dirent, d_name) +
 		  t->filesystem_table[t->current->filesystem_id].name_max + 1;
 		if (t->dirent == NULL || t->dirent_allocated < dirent_size) {
@@ -2395,11 +2404,11 @@ tree_dir_next_posix(struct tree *t)
 			}
 			t->dirent_allocated = dirent_size;
 		}
-#endif /* HAVE_READDIR_R */
+#endif /* USE_READDIR_R */
 	}
 	for (;;) {
 		errno = 0;
-#if defined(HAVE_READDIR_R)
+#if defined(USE_READDIR_R)
 		r = readdir_r(t->d, t->dirent, &t->de);
 #ifdef _AIX
 		/* Note: According to the man page, return value 9 indicates
@@ -2651,7 +2660,7 @@ tree_free(struct tree *t)
 	if (t == NULL)
 		return;
 	archive_string_free(&t->path);
-#if defined(HAVE_READDIR_R)
+#if defined(USE_READDIR_R)
 	free(t->dirent);
 #endif
 	free(t->sparse_list);
@@ -221,7 +221,7 @@ struct archive_read {
 	struct {
 		struct archive_read_passphrase *first;
 		struct archive_read_passphrase **last;
-		int candiate;
+		int candidate;
 		archive_passphrase_callback *callback;
 		void *client_data;
 	}		passphrases;
@@ -595,7 +595,7 @@ lz4_filter_read_data_block(struct archive_read_filter *self, const void **p)
 #endif
 	}

-	/* Check if an error happend in decompression process. */
+	/* Check if an error occurred in the decompression process. */
 	if (uncompressed_size < 0) {
 		archive_set_error(&(self->archive->archive),
 		    ARCHIVE_ERRNO_MISC, "lz4 decompression failed");
@@ -1715,8 +1715,11 @@ lha_crc16(uint16_t crc, const void *pp, size_t len)
 #undef bswap16
 #if defined(_MSC_VER) && _MSC_VER >= 1400  /* Visual Studio */
 #  define bswap16(x) _byteswap_ushort(x)
-#elif (defined(__GNUC__) && __GNUC__ >= 4 && __GNUC_MINOR__ >= 8) \
-      || defined(__clang__)
+#elif defined(__GNUC__) && ((__GNUC__ == 4 && __GNUC_MINOR__ >= 8) || __GNUC__ > 4)
+/* GCC 4.8 and later has __builtin_bswap16() */
+#  define bswap16(x) __builtin_bswap16(x)
+#elif defined(__clang__)
+/* All clang versions have __builtin_bswap16() */
 #  define bswap16(x) __builtin_bswap16(x)
 #else
 #  define bswap16(x) ((((x) >> 8) & 0xff) | ((x) << 8))
@@ -136,6 +136,7 @@ struct tar {
 	int64_t			 entry_padding;
 	int64_t 		 entry_bytes_unconsumed;
 	int64_t			 realsize;
+	int			 sparse_allowed;
 	struct sparse_block	*sparse_list;
 	struct sparse_block	*sparse_last;
 	int64_t			 sparse_offset;
@@ -1128,8 +1129,15 @@ header_common(struct archive_read *a, struct tar *tar,
 	if (tar->entry_bytes_remaining < 0) {
 		tar->entry_bytes_remaining = 0;
 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
-		    "Tar entry has negative size?");
-		err = ARCHIVE_WARN;
+		    "Tar entry has negative size");
+		return (ARCHIVE_FATAL);
+	}
+	if (tar->entry_bytes_remaining == INT64_MAX) {
+		/* Note: tar_atol returns INT64_MAX on overflow */
+		tar->entry_bytes_remaining = 0;
+		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
+		    "Tar entry size overflow");
+		return (ARCHIVE_FATAL);
 	}
 	tar->realsize = tar->entry_bytes_remaining;
 	archive_entry_set_size(entry, tar->entry_bytes_remaining);
@@ -1264,6 +1272,14 @@ header_common(struct archive_read *a, struct tar *tar,
 		 * sparse information in the extended area.
 		 */
 		/* FALLTHROUGH */
+	case '0':
+		/*
+		 * Enable sparse file "read" support only for regular
+		 * files and explicit GNU sparse files.  However, we
+		 * don't allow non-standard file types to be sparse.
+		 */
+		tar->sparse_allowed = 1;
+		/* FALLTHROUGH */
 	default: /* Regular file  and non-standard types */
 		/*
 		 * Per POSIX: non-recognized types should always be
@@ -1723,6 +1739,14 @@ pax_attribute(struct archive_read *a, struct tar *tar,
 #endif
 	switch (key[0]) {
 	case 'G':
+		/* Reject GNU.sparse.* headers on non-regular files. */
+		if (strncmp(key, "GNU.sparse", 10) == 0 &&
+		    !tar->sparse_allowed) {
+			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
+			    "Non-regular file cannot be sparse");
+			return (ARCHIVE_FATAL);
+		}
+
 		/* GNU "0.0" sparse pax format. */
 		if (strcmp(key, "GNU.sparse.numblocks") == 0) {
 			tar->sparse_offset = -1;
@@ -318,7 +318,7 @@ start_over:
 		}
 		memcpy(w->pool.str, fnam.str, fnam.len);
 		w->pool.str[fnam.len] = '\0';
-		/* let noone else know about the pool, it's a secret, shhh */
+		/* let no one else know about the pool, it's a secret, shhh */
 		fnam.str = w->pool.str;

 		/* snarf mtime or deduce from rtime
@@ -418,18 +418,30 @@ zip_time(const char *p)
 *	id1+size1+data1 + id2+size2+data2 ...
 *  triplets.  id and size are 2 bytes each.
 */
-static void
-process_extra(const char *p, size_t extra_length, struct zip_entry* zip_entry)
+static int
+process_extra(struct archive_read *a, const char *p, size_t extra_length, struct zip_entry* zip_entry)
 {
 	unsigned offset = 0;

-	while (offset < extra_length - 4) {
+	if (extra_length == 0) {
+		return ARCHIVE_OK;
+	}
+
+	if (extra_length < 4) {
+		archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
+		    "Too-small extra data: Need at least 4 bytes, but only found %d bytes", (int)extra_length);
+		return ARCHIVE_FAILED;
+	}
+	while (offset <= extra_length - 4) {
 		unsigned short headerid = archive_le16dec(p + offset);
 		unsigned short datasize = archive_le16dec(p + offset + 2);

 		offset += 4;
 		if (offset + datasize > extra_length) {
-			break;
+			archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
+			    "Extra data overflow: Need %d bytes but only found %d bytes",
+			    (int)datasize, (int)(extra_length - offset));
+			return ARCHIVE_FAILED;
 		}
 #ifdef DEBUG
 		fprintf(stderr, "Header id 0x%04x, length %d\n",
@@ -715,13 +727,13 @@ process_extra(const char *p, size_t extra_length, struct zip_entry* zip_entry)
 		}
 		offset += datasize;
 	}
-#ifdef DEBUG
-	if (offset != extra_length)
-	{
-		fprintf(stderr,
-		    "Extra data field contents do not match reported size!\n");
+	if (offset != extra_length) {
+		archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
+		    "Malformed extra data: Consumed %d bytes of %d bytes",
+		    (int)offset, (int)extra_length);
+		return ARCHIVE_FAILED;
 	}
-#endif
+	return ARCHIVE_OK;
 }

 /*
@@ -840,7 +852,9 @@ zip_read_local_file_header(struct archive_read *a, struct archive_entry *entry,
 		return (ARCHIVE_FATAL);
 	}

-	process_extra(h, extra_length, zip_entry);
+	if (ARCHIVE_OK != process_extra(a, h, extra_length, zip_entry)) {
+		return ARCHIVE_FATAL;
+	}
 	__archive_read_consume(a, extra_length);

 	/* Work around a bug in Info-Zip: When reading from a pipe, it
@@ -1293,7 +1307,7 @@ zip_read_data_deflate(struct archive_read *a, const void **buff,
 	    && bytes_avail > zip->entry_bytes_remaining) {
 		bytes_avail = (ssize_t)zip->entry_bytes_remaining;
 	}
-	if (bytes_avail <= 0) {
+	if (bytes_avail < 0) {
 		archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
 		    "Truncated ZIP file body");
 		return (ARCHIVE_FATAL);
@@ -2691,7 +2705,9 @@ slurp_central_directory(struct archive_read *a, struct zip *zip)
 			    "Truncated ZIP file header");
 			return ARCHIVE_FATAL;
 		}
-		process_extra(p + filename_length, extra_length, zip_entry);
+		if (ARCHIVE_OK != process_extra(a, p + filename_length, extra_length, zip_entry)) {
+			return ARCHIVE_FATAL;
+		}

 		/*
 		 * Mac resource fork files are stored under the
@@ -580,7 +580,7 @@ void
 __archive_ensure_cloexec_flag(int fd)
 {
 #if defined(_WIN32) && !defined(__CYGWIN__)
-	(void)fd; /* UNSED */
+	(void)fd; /* UNUSED */
 #else
 	int flags;

@@ -138,6 +138,7 @@ set_acl(struct archive *a, int fd, const char *name,
 	acl_permset_t	 acl_permset;
 #ifdef ACL_TYPE_NFS4
 	acl_flagset_t	 acl_flagset;
+	int		 r;
 #endif
 	int		 ret;
 	int		 ae_type, ae_permset, ae_tag, ae_id;
@@ -152,9 +153,19 @@ set_acl(struct archive *a, int fd, const char *name,
 	if (entries == 0)
 		return (ARCHIVE_OK);
 	acl = acl_init(entries);
+	if (acl == (acl_t)NULL) {
+		archive_set_error(a, errno,
+		    "Failed to initialize ACL working storage");
+		return (ARCHIVE_FAILED);
+	}
 	while (archive_acl_next(a, abstract_acl, ae_requested_type, &ae_type,
 		   &ae_permset, &ae_tag, &ae_id, &ae_name) == ARCHIVE_OK) {
-		acl_create_entry(&acl, &acl_entry);
+		if (acl_create_entry(&acl, &acl_entry) != 0) {
+			archive_set_error(a, errno,
+			    "Failed to create a new ACL entry");
+			ret = ARCHIVE_FAILED;
+			goto exit_free;
+		}

 		switch (ae_tag) {
 		case ARCHIVE_ENTRY_ACL_USER:
@@ -185,50 +196,97 @@ set_acl(struct archive *a, int fd, const char *name,
 			break;
 #endif
 		default:
-			/* XXX */
-			break;
+			archive_set_error(a, ARCHIVE_ERRNO_MISC,
+			    "Unknown ACL tag");
+			ret = ARCHIVE_FAILED;
+			goto exit_free;
 		}

 #ifdef ACL_TYPE_NFS4
+		r = 0;
 		switch (ae_type) {
 		case ARCHIVE_ENTRY_ACL_TYPE_ALLOW:
-			acl_set_entry_type_np(acl_entry, ACL_ENTRY_TYPE_ALLOW);
+			r = acl_set_entry_type_np(acl_entry, ACL_ENTRY_TYPE_ALLOW);
 			break;
 		case ARCHIVE_ENTRY_ACL_TYPE_DENY:
-			acl_set_entry_type_np(acl_entry, ACL_ENTRY_TYPE_DENY);
+			r = acl_set_entry_type_np(acl_entry, ACL_ENTRY_TYPE_DENY);
 			break;
 		case ARCHIVE_ENTRY_ACL_TYPE_AUDIT:
-			acl_set_entry_type_np(acl_entry, ACL_ENTRY_TYPE_AUDIT);
+			r = acl_set_entry_type_np(acl_entry, ACL_ENTRY_TYPE_AUDIT);
 			break;
 		case ARCHIVE_ENTRY_ACL_TYPE_ALARM:
-			acl_set_entry_type_np(acl_entry, ACL_ENTRY_TYPE_ALARM);
+			r = acl_set_entry_type_np(acl_entry, ACL_ENTRY_TYPE_ALARM);
 			break;
 		case ARCHIVE_ENTRY_ACL_TYPE_ACCESS:
 		case ARCHIVE_ENTRY_ACL_TYPE_DEFAULT:
 			// These don't translate directly into the system ACL.
 			break;
 		default:
-			// XXX error handling here.
-			break;
+			archive_set_error(a, ARCHIVE_ERRNO_MISC,
+			    "Unknown ACL entry type");
+			ret = ARCHIVE_FAILED;
+			goto exit_free;
+		}
+		if (r != 0) {
+			archive_set_error(a, errno,
+			    "Failed to set ACL entry type");
+			ret = ARCHIVE_FAILED;
+			goto exit_free;
 		}
 #endif

-		acl_get_permset(acl_entry, &acl_permset);
-		acl_clear_perms(acl_permset);
+		if (acl_get_permset(acl_entry, &acl_permset) != 0) {
+			archive_set_error(a, errno,
+			    "Failed to get ACL permission set");
+			ret = ARCHIVE_FAILED;
+			goto exit_free;
+		}
+		if (acl_clear_perms(acl_permset) != 0) {
+			archive_set_error(a, errno,
+			    "Failed to clear ACL permissions");
+			ret = ARCHIVE_FAILED;
+			goto exit_free;
+		}

 		for (i = 0; i < (int)(sizeof(acl_perm_map) / sizeof(acl_perm_map[0])); ++i) {
 			if (ae_permset & acl_perm_map[i].archive_perm)
-				acl_add_perm(acl_permset,
-					     acl_perm_map[i].platform_perm);
+				if (acl_add_perm(acl_permset,
+				    acl_perm_map[i].platform_perm) != 0) {
+					archive_set_error(a, errno,
+					    "Failed to add ACL permission");
+					ret = ARCHIVE_FAILED;
+					goto exit_free;
+				}
 		}

 #ifdef ACL_TYPE_NFS4
-		acl_get_flagset_np(acl_entry, &acl_flagset);
-		acl_clear_flags_np(acl_flagset);
-		for (i = 0; i < (int)(sizeof(acl_inherit_map) / sizeof(acl_inherit_map[0])); ++i) {
-			if (ae_permset & acl_inherit_map[i].archive_inherit)
-				acl_add_flag_np(acl_flagset,
-						acl_inherit_map[i].platform_inherit);
+		if (acl_type == ACL_TYPE_NFS4) {
+			/*
+			 * acl_get_flagset_np() fails with non-NFSv4 ACLs
+			 */
+			if (acl_get_flagset_np(acl_entry, &acl_flagset) != 0) {
+				archive_set_error(a, errno,
+				    "Failed to get flagset from an NFSv4 ACL entry");
+				ret = ARCHIVE_FAILED;
+				goto exit_free;
+			}
+			if (acl_clear_flags_np(acl_flagset) != 0) {
+				archive_set_error(a, errno,
+				    "Failed to clear flags from an NFSv4 ACL flagset");
+				ret = ARCHIVE_FAILED;
+				goto exit_free;
+			}
+			for (i = 0; i < (int)(sizeof(acl_inherit_map) / sizeof(acl_inherit_map[0])); ++i) {
+				if (ae_permset & acl_inherit_map[i].archive_inherit) {
+					if (acl_add_flag_np(acl_flagset,
+							acl_inherit_map[i].platform_inherit) != 0) {
+						archive_set_error(a, errno,
+						    "Failed to add flag to NFSv4 ACL flagset");
+						ret = ARCHIVE_FAILED;
+						goto exit_free;
+					}
+				}
+			}
 		}
 #endif
 	}
@@ -257,6 +315,7 @@ set_acl(struct archive *a, int fd, const char *name,
 		ret = ARCHIVE_WARN;
 	}
 #endif
+exit_free:
 	acl_free(acl);
 	return (ret);
 }
@@ -140,7 +140,17 @@ __FBSDID("$FreeBSD$");
 #define O_BINARY 0
 #endif
 #ifndef O_CLOEXEC
-#define O_CLOEXEC	0
+#define O_CLOEXEC 0
+#endif
+
+/* Ignore non-int O_NOFOLLOW constant. */
+/* gnulib's fcntl.h does this on AIX, but it seems practical everywhere */
+#if defined O_NOFOLLOW && !(INT_MIN <= O_NOFOLLOW && O_NOFOLLOW <= INT_MAX)
+#undef O_NOFOLLOW
+#endif
+
+#ifndef O_NOFOLLOW
+#define O_NOFOLLOW 0
 #endif

 struct fixup_entry {
@@ -326,12 +336,14 @@ struct archive_write_disk {

 #define HFS_BLOCKS(s)	((s) >> 12)

+static int	check_symlinks_fsobj(char *path, int *error_number, struct archive_string *error_string, int flags);
 static int	check_symlinks(struct archive_write_disk *);
 static int	create_filesystem_object(struct archive_write_disk *);
 static struct fixup_entry *current_fixup(struct archive_write_disk *, const char *pathname);
 #if defined(HAVE_FCHDIR) && defined(PATH_MAX)
 static void	edit_deep_directories(struct archive_write_disk *ad);
 #endif
+static int	cleanup_pathname_fsobj(char *path, int *error_number, struct archive_string *error_string, int flags);
 static int	cleanup_pathname(struct archive_write_disk *);
 static int	create_dir(struct archive_write_disk *, char *);
 static int	create_parent_dir(struct archive_write_disk *, char *);
@@ -1796,7 +1808,7 @@ edit_deep_directories(struct archive_write_disk *a)
 	char *tail = a->name;

 	/* If path is short, avoid the open() below. */
-	if (strlen(tail) <= PATH_MAX)
+	if (strlen(tail) < PATH_MAX)
 		return;

 	/* Try to record our starting dir. */
@@ -1806,7 +1818,7 @@ edit_deep_directories(struct archive_write_disk *a)
 		return;

 	/* As long as the path is too long... */
-	while (strlen(tail) > PATH_MAX) {
+	while (strlen(tail) >= PATH_MAX) {
 		/* Locate a dir prefix shorter than PATH_MAX. */
 		tail += PATH_MAX - 8;
 		while (tail > a->name && *tail != '/')
@@ -2014,6 +2026,10 @@ create_filesystem_object(struct archive_write_disk *a)
 	const char *linkname;
 	mode_t final_mode, mode;
 	int r;
+	/* these for check_symlinks_fsobj */
+	char *linkname_copy;	/* non-const copy of linkname */
+	struct archive_string error_string;
+	int error_number;

 	/* We identify hard/symlinks according to the link names. */
 	/* Since link(2) and symlink(2) don't handle modes, we're done here. */
@@ -2022,6 +2038,27 @@ create_filesystem_object(struct archive_write_disk *a)
 #if !HAVE_LINK
 		return (EPERM);
 #else
+		archive_string_init(&error_string);
+		linkname_copy = strdup(linkname);
+		if (linkname_copy == NULL) {
+		    return (EPERM);
+		}
+		/* TODO: consider using the cleaned-up path as the link target? */
+		r = cleanup_pathname_fsobj(linkname_copy, &error_number, &error_string, a->flags);
+		if (r != ARCHIVE_OK) {
+			archive_set_error(&a->archive, error_number, "%s", error_string.s);
+			free(linkname_copy);
+			/* EPERM is more appropriate than error_number for our callers */
+			return (EPERM);
+		}
+		r = check_symlinks_fsobj(linkname_copy, &error_number, &error_string, a->flags);
+		if (r != ARCHIVE_OK) {
+			archive_set_error(&a->archive, error_number, "%s", error_string.s);
+			free(linkname_copy);
+			/* EPERM is more appropriate than error_number for our callers */
+			return (EPERM);
+		}
+		free(linkname_copy);
 		r = link(linkname, a->name) ? errno : 0;
 		/*
 		 * New cpio and pax formats allow hardlink entries
@@ -2040,7 +2077,7 @@ create_filesystem_object(struct archive_write_disk *a)
 			a->deferred = 0;
 		} else if (r == 0 && a->filesize > 0) {
 			a->fd = open(a->name,
-				     O_WRONLY | O_TRUNC | O_BINARY | O_CLOEXEC);
+				     O_WRONLY | O_TRUNC | O_BINARY | O_CLOEXEC | O_NOFOLLOW);
 			__archive_ensure_cloexec_flag(a->fd);
 			if (a->fd < 0)
 				r = errno;
@@ -2351,116 +2388,233 @@ current_fixup(struct archive_write_disk *a, const char *pathname)
 	return (a->current_fixup);
 }

-/* TODO: Make this work. */
-/*
- * TODO: The deep-directory support bypasses this; disable deep directory
- * support if we're doing symlink checks.
- */
 /*
 * TODO: Someday, integrate this with the deep dir support; they both
 * scan the path and both can be optimized by comparing against other
 * recent paths.
 */
 /* TODO: Extend this to support symlinks on Windows Vista and later. */
+
+/*
+ * Checks the given path to see if any elements along it are symlinks.  Returns
+ * ARCHIVE_OK if there are none, otherwise puts an error in errmsg.
+ */
 static int
-check_symlinks(struct archive_write_disk *a)
+check_symlinks_fsobj(char *path, int *error_number, struct archive_string *error_string, int flags)
 {
 #if !defined(HAVE_LSTAT)
 	/* Platform doesn't have lstat, so we can't look for symlinks. */
-	(void)a; /* UNUSED */
+	(void)path; /* UNUSED */
+	(void)error_number; /* UNUSED */
+	(void)error_string; /* UNUSED */
+	(void)flags; /* UNUSED */
 	return (ARCHIVE_OK);
 #else
-	char *pn;
+	int res = ARCHIVE_OK;
+	char *tail;
+	char *head;
+	int last;
 	char c;
 	int r;
 	struct stat st;
+	int restore_pwd;
+
+	/* Nothing to do here if name is empty */
+	if(path[0] == '\0')
+	    return (ARCHIVE_OK);

 	/*
 	 * Guard against symlink tricks.  Reject any archive entry whose
 	 * destination would be altered by a symlink.
+	 *
+	 * Walk the filename in chunks separated by '/'.  For each segment:
+	 *  - if it doesn't exist, continue
+	 *  - if it's symlink, abort or remove it
+	 *  - if it's a directory and it's not the last chunk, cd into it
+	 * As we go:
+	 *  head points to the current (relative) path
+	 *  tail points to the temporary \0 terminating the segment we're currently examining
+	 *  c holds what used to be in *tail
+	 *  last is 1 if this is the last tail
 	 */
-	/* Whatever we checked last time doesn't need to be re-checked. */
-	pn = a->name;
-	if (archive_strlen(&(a->path_safe)) > 0) {
-		char *p = a->path_safe.s;
-		while ((*pn != '\0') && (*p == *pn))
-			++p, ++pn;
-	}
+	restore_pwd = open(".", O_RDONLY | O_BINARY | O_CLOEXEC);
+	__archive_ensure_cloexec_flag(restore_pwd);
+	if (restore_pwd < 0)
+		return (ARCHIVE_FATAL);
+	head = path;
+	tail = path;
+	last = 0;
+	/* TODO: reintroduce a safe cache here? */
 	/* Skip the root directory if the path is absolute. */
-	if(pn == a->name && pn[0] == '/')
-		++pn;
-	c = pn[0];
-	/* Keep going until we've checked the entire name. */
-	while (pn[0] != '\0' && (pn[0] != '/' || pn[1] != '\0')) {
+	if(tail == path && tail[0] == '/')
+		++tail;
+	/* Keep going until we've checked the entire name.
+	 * head, tail, path all alias the same string, which is
+	 * temporarily zeroed at tail, so be careful restoring the
+	 * stashed (c=tail[0]) for error messages.
+	 * Exiting the loop with break is okay; continue is not.
+	 */
+	while (!last) {
+		/* Skip the separator we just consumed, plus any adjacent ones */
+		while (*tail == '/')
+		    ++tail;
 		/* Skip the next path element. */
-		while (*pn != '\0' && *pn != '/')
-			++pn;
-		c = pn[0];
-		pn[0] = '\0';
+		while (*tail != '\0' && *tail != '/')
+			++tail;
+		/* is this the last path component? */
+		last = (tail[0] == '\0') || (tail[0] == '/' && tail[1] == '\0');
+		/* temporarily truncate the string here */
+		c = tail[0];
+		tail[0] = '\0';
 		/* Check that we haven't hit a symlink. */
-		r = lstat(a->name, &st);
+		r = lstat(head, &st);
 		if (r != 0) {
+			tail[0] = c;
 			/* We've hit a dir that doesn't exist; stop now. */
-			if (errno == ENOENT)
+			if (errno == ENOENT) {
 				break;
+			} else {
+				/* Treat any other error as fatal - best to be paranoid here
+				 * Note: This effectively disables deep directory
+				 * support when security checks are enabled.
+				 * Otherwise, very long pathnames that trigger
+				 * an error here could evade the sandbox.
+				 * TODO: We could do better, but it would probably
+				 * require merging the symlink checks with the
+				 * deep-directory editing. */
+				if (error_number) *error_number = errno;
+				if (error_string)
+					archive_string_sprintf(error_string,
+							"Could not stat %s",
+							path);
+				res = ARCHIVE_FAILED;
+				break;
+			}
+		} else if (S_ISDIR(st.st_mode)) {
+			if (!last) {
+				if (chdir(head) != 0) {
+					tail[0] = c;
+					if (error_number) *error_number = errno;
+					if (error_string)
+						archive_string_sprintf(error_string,
+								"Could not chdir %s",
+								path);
+					res = (ARCHIVE_FATAL);
+					break;
+				}
+				/* Our view is now from inside this dir: */
+				head = tail + 1;
+			}
 		} else if (S_ISLNK(st.st_mode)) {
-			if (c == '\0') {
+			if (last) {
 				/*
 				 * Last element is symlink; remove it
 				 * so we can overwrite it with the
 				 * item being extracted.
 				 */
-				if (unlink(a->name)) {
-					archive_set_error(&a->archive, errno,
-					    "Could not remove symlink %s",
-					    a->name);
-					pn[0] = c;
-					return (ARCHIVE_FAILED);
+				if (unlink(head)) {
+					tail[0] = c;
+					if (error_number) *error_number = errno;
+					if (error_string)
+						archive_string_sprintf(error_string,
+								"Could not remove symlink %s",
+								path);
+					res = ARCHIVE_FAILED;
+					break;
 				}
-				a->pst = NULL;
 				/*
 				 * Even if we did remove it, a warning
 				 * is in order.  The warning is silly,
 				 * though, if we're just replacing one
 				 * symlink with another symlink.
 				 */
-				if (!S_ISLNK(a->mode)) {
-					archive_set_error(&a->archive, 0,
-					    "Removing symlink %s",
-					    a->name);
+				tail[0] = c;
+				/* FIXME:  not sure how important this is to restore
+				if (!S_ISLNK(path)) {
+					if (error_number) *error_number = 0;
+					if (error_string)
+						archive_string_sprintf(error_string,
+								"Removing symlink %s",
+								path);
 				}
+				*/
 				/* Symlink gone.  No more problem! */
-				pn[0] = c;
-				return (0);
-			} else if (a->flags & ARCHIVE_EXTRACT_UNLINK) {
+				res = ARCHIVE_OK;
+				break;
+			} else if (flags & ARCHIVE_EXTRACT_UNLINK) {
 				/* User asked us to remove problems. */
-				if (unlink(a->name) != 0) {
-					archive_set_error(&a->archive, 0,
-					    "Cannot remove intervening symlink %s",
-					    a->name);
-					pn[0] = c;
-					return (ARCHIVE_FAILED);
+				if (unlink(head) != 0) {
+					tail[0] = c;
+					if (error_number) *error_number = 0;
+					if (error_string)
+						archive_string_sprintf(error_string,
+								"Cannot remove intervening symlink %s",
+								path);
+					res = ARCHIVE_FAILED;
+					break;
 				}
-				a->pst = NULL;
+				tail[0] = c;
 			} else {
-				archive_set_error(&a->archive, 0,
-				    "Cannot extract through symlink %s",
-				    a->name);
-				pn[0] = c;
-				return (ARCHIVE_FAILED);
+				tail[0] = c;
+				if (error_number) *error_number = 0;
+				if (error_string)
+					archive_string_sprintf(error_string,
+							"Cannot extract through symlink %s",
+							path);
+				res = ARCHIVE_FAILED;
+				break;
 			}
 		}
-		pn[0] = c;
-		if (pn[0] != '\0')
-			pn++; /* Advance to the next segment. */
+		/* be sure to always maintain this */
+		tail[0] = c;
+		if (tail[0] != '\0')
+			tail++; /* Advance to the next segment. */
 	}
-	pn[0] = c;
-	/* We've checked and/or cleaned the whole path, so remember it. */
-	archive_strcpy(&a->path_safe, a->name);
-	return (ARCHIVE_OK);
+	/* Catches loop exits via break */
+	tail[0] = c;
+#ifdef HAVE_FCHDIR
+	/* If we changed directory above, restore it here. */
+	if (restore_pwd >= 0) {
+		r = fchdir(restore_pwd);
+		if (r != 0) {
+			if(error_number) *error_number = errno;
+			if(error_string)
+				archive_string_sprintf(error_string,
+						"chdir() failure");
+		}
+		close(restore_pwd);
+		restore_pwd = -1;
+		if (r != 0) {
+			res = (ARCHIVE_FATAL);
+		}
+	}
+#endif
+	/* TODO: reintroduce a safe cache here? */
+	return res;
 #endif
 }

+/*
+ * Check a->name for symlinks, returning ARCHIVE_OK if its clean, otherwise
+ * calls archive_set_error and returns ARCHIVE_{FATAL,FAILED}
+ */
+static int
+check_symlinks(struct archive_write_disk *a)
+{
+	struct archive_string error_string;
+	int error_number;
+	int rc;
+	archive_string_init(&error_string);
+	rc = check_symlinks_fsobj(a->name, &error_number, &error_string, a->flags);
+	if (rc != ARCHIVE_OK) {
+		archive_set_error(&a->archive, error_number, "%s", error_string.s);
+	}
+	archive_string_free(&error_string);
+	a->pst = NULL;	/* to be safe */
+	return rc;
+}
+
+
 #if defined(__CYGWIN__)
 /*
 * 1. Convert a path separator from '\' to '/' .
@@ -2534,15 +2688,17 @@ cleanup_pathname_win(struct archive_write_disk *a)
 * is set) if the path is absolute.
 */
 static int
-cleanup_pathname(struct archive_write_disk *a)
+cleanup_pathname_fsobj(char *path, int *error_number, struct archive_string *error_string, int flags)
 {
 	char *dest, *src;
 	char separator = '\0';

-	dest = src = a->name;
+	dest = src = path;
 	if (*src == '\0') {
-		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
-		    "Invalid empty pathname");
+		if (error_number) *error_number = ARCHIVE_ERRNO_MISC;
+		if (error_string)
+		    archive_string_sprintf(error_string,
+			    "Invalid empty pathname");
 		return (ARCHIVE_FAILED);
 	}

@@ -2551,9 +2707,11 @@ cleanup_pathname(struct archive_write_disk *a)
 #endif
 	/* Skip leading '/'. */
 	if (*src == '/') {
-		if (a->flags & ARCHIVE_EXTRACT_SECURE_NOABSOLUTEPATHS) {
-			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
-			                  "Path is absolute");
+		if (flags & ARCHIVE_EXTRACT_SECURE_NOABSOLUTEPATHS) {
+			if (error_number) *error_number = ARCHIVE_ERRNO_MISC;
+			if (error_string)
+			    archive_string_sprintf(error_string,
+				    "Path is absolute");
 			return (ARCHIVE_FAILED);
 		}

@@ -2580,10 +2738,11 @@ cleanup_pathname(struct archive_write_disk *a)
 			} else if (src[1] == '.') {
 				if (src[2] == '/' || src[2] == '\0') {
 					/* Conditionally warn about '..' */
-					if (a->flags & ARCHIVE_EXTRACT_SECURE_NODOTDOT) {
-						archive_set_error(&a->archive,
-						    ARCHIVE_ERRNO_MISC,
-						    "Path contains '..'");
+					if (flags & ARCHIVE_EXTRACT_SECURE_NODOTDOT) {
+						if (error_number) *error_number = ARCHIVE_ERRNO_MISC;
+						if (error_string)
+						    archive_string_sprintf(error_string,
+							    "Path contains '..'");
 						return (ARCHIVE_FAILED);
 					}
 				}
@@ -2614,7 +2773,7 @@ cleanup_pathname(struct archive_write_disk *a)
 	 * We've just copied zero or more path elements, not including the
 	 * final '/'.
 	 */
-	if (dest == a->name) {
+	if (dest == path) {
 		/*
 		 * Nothing got copied.  The path must have been something
 		 * like '.' or '/' or './' or '/././././/./'.
@@ -2629,6 +2788,21 @@ cleanup_pathname(struct archive_write_disk *a)
 	return (ARCHIVE_OK);
 }

+static int
+cleanup_pathname(struct archive_write_disk *a)
+{
+	struct archive_string error_string;
+	int error_number;
+	int rc;
+	archive_string_init(&error_string);
+	rc = cleanup_pathname_fsobj(a->name, &error_number, &error_string, a->flags);
+	if (rc != ARCHIVE_OK) {
+		archive_set_error(&a->archive, error_number, "%s", error_string.s);
+	}
+	archive_string_free(&error_string);
+	return rc;
+}
+
 /*
 * Create the parent directory of the specified path, assuming path
 * is already in mutable storage.
@@ -436,7 +436,7 @@ struct iso_option {
 	 * Type   : string
 	 * Default: Auto detect
 	 *        : We check a size of boot image;
-	 *        : If ths size is just 1.22M/1.44M/2.88M,
+	 *        : If the size is just 1.22M/1.44M/2.88M,
 	 *        : we assume boot_type is 'fd';
 	 *        : otherwise boot_type is 'no-emulation'.
 	 * COMPAT :
@@ -307,7 +307,7 @@ archive_write_ustar_header(struct archive_write *a, struct archive_entry *entry)
 		 * case getting WCS failed. On POSIX, this is a
 		 * normal operation.
 		 */
-		if (p != NULL && p[strlen(p) - 1] != '/') {
+		if (p != NULL && p[0] != '\0' && p[strlen(p) - 1] != '/') {
 			struct archive_string as;

 			archive_string_init(&as);
@@ -1440,6 +1440,31 @@ assertion_file_size(const char *file, int line, const char *pathname, long size)
 	return (0);
 }

+/* Verify mode of 'pathname'. */
+int
+assertion_file_mode(const char *file, int line, const char *pathname, int expected_mode)
+{
+	int mode;
+	int r;
+
+	assertion_count(file, line);
+#if defined(_WIN32) && !defined(__CYGWIN__)
+	failure_start(file, line, "assertFileMode not yet implemented for Windows");
+#else
+	{
+		struct stat st;
+		r = lstat(pathname, &st);
+		mode = (int)(st.st_mode & 0777);
+	}
+	if (r == 0 && mode == expected_mode)
+			return (1);
+	failure_start(file, line, "File %s has mode %o, expected %o",
+	    pathname, mode, expected_mode);
+#endif
+	failure_finish(NULL);
+	return (0);
+}
+
 /* Assert that 'pathname' is a dir.  If mode >= 0, verify that too. */
 int
 assertion_is_dir(const char *file, int line, const char *pathname, int mode)
@@ -182,6 +182,8 @@
  assertion_file_nlinks(__FILE__, __LINE__, pathname, nlinks)
 #define assertFileSize(pathname, size)  \
  assertion_file_size(__FILE__, __LINE__, pathname, size)
+#define assertFileMode(pathname, mode)  \
+  assertion_file_mode(__FILE__, __LINE__, pathname, mode)
 #define assertTextFileContents(text, pathname) \
  assertion_text_file_contents(__FILE__, __LINE__, text, pathname)
 #define assertFileContainsLinesAnyOrder(pathname, lines)	\
@@ -246,6 +248,7 @@ int assertion_file_mtime_recent(const char *, int, const char *);
 int assertion_file_nlinks(const char *, int, const char *, int);
 int assertion_file_not_exists(const char *, int, const char *);
 int assertion_file_size(const char *, int, const char *, long);
+int assertion_file_mode(const char *, int, const char *, int);
 int assertion_is_dir(const char *, int, const char *, int);
 int assertion_is_hardlink(const char *, int, const char *, const char *);
 int assertion_is_not_hardlink(const char *, int, const char *, const char *);
@@ -70,15 +70,9 @@ set_acls(struct archive_entry *ae, struct myacl_t *acls)
 }

 static int
-acl_match(acl_entry_t aclent, struct myacl_t *myacl)
-{
-	gid_t g, *gp;
-	uid_t u, *up;
-	acl_tag_t tag_type;
-	acl_permset_t opaque_ps;
+acl_entry_get_perm(acl_entry_t aclent) {
 	int permset = 0;
-
-	acl_get_tag_type(aclent, &tag_type);
+	acl_permset_t opaque_ps;

 	/* translate the silly opaque permset to a bitmap */
 	acl_get_permset(aclent, &opaque_ps);
@@ -88,10 +82,61 @@ acl_match(acl_entry_t aclent, struct myacl_t *myacl)
 		permset |= ARCHIVE_ENTRY_ACL_WRITE;
 	if (acl_get_perm_np(opaque_ps, ACL_READ))
 		permset |= ARCHIVE_ENTRY_ACL_READ;
+	return permset;
+}

-	if (permset != myacl->permset)
+#if 0
+static int
+acl_get_specific_entry(acl_t acl, acl_tag_t requested_tag_type, int requested_tag) {
+	int entry_id = ACL_FIRST_ENTRY;
+	acl_entry_t acl_entry;
+	acl_tag_t acl_tag_type;
+	
+	while (1 == acl_get_entry(acl, entry_id, &acl_entry)) {
+		/* After the first time... */
+		entry_id = ACL_NEXT_ENTRY;
+
+		/* If this matches, return perm mask */
+		acl_get_tag_type(acl_entry, &acl_tag_type);
+		if (acl_tag_type == requested_tag_type) {
+			switch (acl_tag_type) {
+			case ACL_USER_OBJ:
+				if ((uid_t)requested_tag == *(uid_t *)(acl_get_qualifier(acl_entry))) {
+					return acl_entry_get_perm(acl_entry);
+				}
+				break;
+			case ACL_GROUP_OBJ:
+				if ((gid_t)requested_tag == *(gid_t *)(acl_get_qualifier(acl_entry))) {
+					return acl_entry_get_perm(acl_entry);
+				}
+				break;
+			case ACL_USER:
+			case ACL_GROUP:
+			case ACL_OTHER:
+				return acl_entry_get_perm(acl_entry);
+			default:
+				failure("Unexpected ACL tag type");
+				assert(0);
+			}
+		}
+
+
+	}
+	return -1;
+}
+#endif
+
+static int
+acl_match(acl_entry_t aclent, struct myacl_t *myacl)
+{
+	gid_t g, *gp;
+	uid_t u, *up;
+	acl_tag_t tag_type;
+
+	if (myacl->permset != acl_entry_get_perm(aclent))
 		return (0);

+	acl_get_tag_type(aclent, &tag_type);
 	switch (tag_type) {
 	case ACL_USER_OBJ:
 		if (myacl->tag != ARCHIVE_ENTRY_ACL_USER_OBJ) return (0);
@@ -190,7 +235,7 @@ compare_acls(acl_t acl, struct myacl_t *myacls)
 * Verify ACL restore-to-disk.  This test is FreeBSD-specific.
 */

-DEFINE_TEST(test_acl_freebsd_posix1e)
+DEFINE_TEST(test_acl_freebsd_posix1e_restore)
 {
 #if !defined(__FreeBSD__)
 	skipping("FreeBSD-specific ACL restore test");
@@ -263,3 +308,111 @@ DEFINE_TEST(test_acl_freebsd_posix1e)
 	acl_free(acl);
 #endif
 }
+
+/*
+ * Verify ACL reaed-from-disk.  This test is FreeBSD-specific.
+ */
+DEFINE_TEST(test_acl_freebsd_posix1e_read)
+{
+#if !defined(__FreeBSD__)
+	skipping("FreeBSD-specific ACL read test");
+#elif __FreeBSD__ < 5
+	skipping("ACL read supported only on FreeBSD 5.0 and later");
+#else
+	struct archive *a;
+	struct archive_entry *ae;
+	int n, fd;
+	const char *acl1_text, *acl2_text;
+	acl_t acl1, acl2;
+
+	/*
+	 * Manually construct a directory and two files with
+	 * different ACLs.  This also serves to verify that ACLs
+	 * are supported on the local filesystem.
+	 */
+
+	/* Create a test file f1 with acl1 */
+	acl1_text = "user::rwx,group::rwx,other::rwx,user:1:rw-,group:15:r-x,mask::rwx";
+	acl1 = acl_from_text(acl1_text);
+	assert((void *)acl1 != NULL);
+	fd = open("f1", O_WRONLY | O_CREAT | O_EXCL, 0777);
+	failure("Could not create test file?!");
+	if (!assert(fd >= 0)) {
+		acl_free(acl1);
+		return;
+	}
+	n = acl_set_fd(fd, acl1);
+	acl_free(acl1);
+	if (n != 0 && errno == EOPNOTSUPP) {
+		close(fd);
+		skipping("ACL tests require that ACL support be enabled on the filesystem");
+		return;
+	}
+	if (n != 0 && errno == EINVAL) {
+		close(fd);
+		skipping("This filesystem does not support POSIX.1e ACLs");
+		return;
+	}
+	failure("acl_set_fd(): errno = %d (%s)",
+	    errno, strerror(errno));
+	assertEqualInt(0, n);
+	close(fd);
+
+	assertMakeDir("d", 0700);
+
+	/*
+	 * Create file d/f1 with acl2
+	 *
+	 * This differs from acl1 in the u:1: and g:15: permissions.
+	 *
+	 * This file deliberately has the same name but a different ACL.
+	 * Github Issue #777 explains how libarchive's directory traversal
+	 * did not always correctly enter directories before attempting
+	 * to read ACLs, resulting in reading the ACL from a like-named
+	 * file in the wrong directory.
+	 */
+	acl2_text = "user::rwx,group::rwx,other::---,user:1:r--,group:15:r--,mask::rwx";
+	acl2 = acl_from_text(acl2_text);
+	assert((void *)acl2 != NULL);
+	fd = open("d/f1", O_WRONLY | O_CREAT | O_EXCL, 0777);
+	failure("Could not create test file?!");
+	if (!assert(fd >= 0)) {
+		acl_free(acl2);
+		return;
+	}
+	n = acl_set_fd(fd, acl2);
+	acl_free(acl2);
+	if (n != 0 && errno == EOPNOTSUPP) {
+		close(fd);
+		skipping("ACL tests require that ACL support be enabled on the filesystem");
+		return;
+	}
+	if (n != 0 && errno == EINVAL) {
+		close(fd);
+		skipping("This filesystem does not support POSIX.1e ACLs");
+		return;
+	}
+	failure("acl_set_fd(): errno = %d (%s)",
+	    errno, strerror(errno));
+	assertEqualInt(0, n);
+	close(fd);
+
+	/* Create a read-from-disk object. */
+	assert(NULL != (a = archive_read_disk_new()));
+	assertEqualIntA(a, ARCHIVE_OK, archive_read_disk_open(a, "."));
+	assert(NULL != (ae = archive_entry_new()));
+
+	/* Walk the dir until we see both of the files */
+	while (ARCHIVE_OK == archive_read_next_header2(a, ae)) {
+		archive_read_disk_descend(a);
+		if (strcmp(archive_entry_pathname(ae), "./f1") == 0) {
+			assertEqualString(archive_entry_acl_text(ae, ARCHIVE_ENTRY_ACL_TYPE_ACCESS), acl1_text);
+			    
+		} else if (strcmp(archive_entry_pathname(ae), "./d/f1") == 0) {
+			assertEqualString(archive_entry_acl_text(ae, ARCHIVE_ENTRY_ACL_TYPE_ACCESS), acl2_text);
+		}
+	}
+
+	archive_free(a);
+#endif
+}
@@ -800,8 +800,8 @@ DEFINE_TEST(test_archive_string_conversion)
 	assertEqualIntA(a, ARCHIVE_OK, archive_read_next_header(a, &ae));
 	assert((fp = fopen(testdata, "w")) != NULL);
 	while ((size = archive_read_data(a, buff, 512)) > 0)
-		fwrite(buff, 1, size, fp);
-	fclose(fp);
+		assertEqualInt(size, fwrite(buff, 1, size, fp));
+	assertEqualInt(0, fclose(fp));
 	assertEqualInt(ARCHIVE_OK, archive_read_free(a));

 	test_archive_string_normalization_nfc(testdata);
@@ -110,13 +110,17 @@ test_fuzz(const struct files *filesets)
 			for (i = 0; filesets[n].names[i] != NULL; ++i)
 			{
 				tmp = slurpfile(&size, filesets[n].names[i]);
-				rawimage = (char *)realloc(rawimage, oldsize + size);
+				char *newraw = (char *)realloc(rawimage, oldsize + size);
+				if (!assert(newraw != NULL))
+				{
+					free(rawimage);
+					continue;
+				}
+				rawimage = newraw;
 				memcpy(rawimage + oldsize, tmp, size);
 				oldsize += size;
 				size = oldsize;
 				free(tmp);
-				if (!assert(rawimage != NULL))
-					continue;
 			}
 		}
 		if (size == 0)
@@ -3603,7 +3603,7 @@ DEFINE_TEST(test_read_format_rar_multivolume_uncompressed_files)
  assertEqualIntA(a, 0, archive_read_data(a, buff, sizeof(buff)));

  /*
-   * Eigth header.
+   * Eighth header.
   */
  assertA(0 == archive_read_next_header(a, &ae));
  assertEqualString("testdir/testsymlink6", archive_entry_pathname(ae));
@@ -0,0 +1,143 @@
+/*-
+ * Copyright (c) 2016 Tim Kientzle
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#include "test.h"
+__FBSDID("$FreeBSD");
+
+#include <locale.h>
+
+
+/*
+ * Github Issue 748 reported problems with end-of-entry handling
+ * with highly-compressible data.  This resulted in the end of the
+ * data being truncated (extracted as zero bytes).
+ */
+
+/*
+ * Extract the specific test archive that was used to diagnose
+ * Issue 748:
+ */
+DEFINE_TEST(test_read_format_zip_high_compression)
+{
+	const char *refname = "test_read_format_zip_high_compression.zip";
+	char *p;
+	size_t archive_size;
+	struct archive *a;
+	struct archive_entry *entry;
+
+	const void *pv;
+	size_t s;
+	int64_t o;
+
+	extract_reference_file(refname);
+	p = slurpfile(&archive_size, refname);
+
+	assert((a = archive_read_new()) != NULL);
+        assertEqualIntA(a, ARCHIVE_OK, archive_read_support_format_zip(a));
+        assertEqualIntA(a, ARCHIVE_OK, read_open_memory_seek(a, p, archive_size, 16 * 1024));
+	assertEqualInt(ARCHIVE_OK, archive_read_next_header(a, &entry));
+
+	assertEqualInt(ARCHIVE_OK, archive_read_data_block(a, &pv, &s, &o));
+	assertEqualInt(262144, s);
+	assertEqualInt(0, o);
+
+	assertEqualInt(ARCHIVE_OK, archive_read_data_block(a, &pv, &s, &o));
+	assertEqualInt(160, s);
+	assertEqualInt(262144, o);
+
+	assertEqualInt(ARCHIVE_EOF, archive_read_data_block(a, &pv, &s, &o));
+
+	assertEqualInt(ARCHIVE_OK, archive_free(a));
+	free(p);
+}
+
+/*
+ * Synthesize a lot of varying inputs that are highly compressible.
+ */
+DEFINE_TEST(test_read_format_zip_high_compression2)
+{
+	const size_t body_size = 1024 * 1024;
+	const size_t buff_size = 2 * 1024 * 1024;
+	char *body, *body_read, *buff;
+	int n;
+
+	assert((body = malloc(body_size)) != NULL);
+	assert((body_read = malloc(body_size)) != NULL);
+	assert((buff = malloc(buff_size)) != NULL);
+
+	/* Highly-compressible data: all bytes 255, except for a
+	 * single 1 byte.
+	 * The body is always 256k + 6 bytes long (the internal deflation
+	 * buffer is exactly 256k).
+	 */
+
+	for(n = 1024; n < (int)body_size; n += 1024) {
+		struct archive *a;
+		struct archive_entry *entry;
+		size_t used = 0;
+		const void *pv;
+		size_t s;
+		int64_t o;
+
+		memset(body, 255, body_size);
+		body[n] = 1;
+
+		/* Write an archive with a single entry of n bytes. */
+		assert((a = archive_write_new()) != NULL);
+		assertEqualInt(ARCHIVE_OK, archive_write_set_format_zip(a));
+		assertEqualInt(ARCHIVE_OK, archive_write_open_memory(a, buff, buff_size, &used));
+
+		entry = archive_entry_new2(a);
+		archive_entry_set_pathname(entry, "test");
+		archive_entry_set_filetype(entry, AE_IFREG);
+		archive_entry_set_size(entry, 262150);
+		assertEqualInt(ARCHIVE_OK, archive_write_header(a, entry));
+		archive_entry_free(entry);
+		assertEqualInt(262150, archive_write_data(a, body, 262150));
+		assertEqualInt(ARCHIVE_OK, archive_write_free(a));
+
+		/* Read back the entry and verify the contents. */
+		assert((a = archive_read_new()) != NULL);
+		assertEqualIntA(a, ARCHIVE_OK, archive_read_support_format_all(a));
+		assertEqualIntA(a, ARCHIVE_OK, archive_read_support_filter_all(a));
+		assertEqualIntA(a, ARCHIVE_OK, read_open_memory(a, buff, used, 17));
+		assertEqualInt(ARCHIVE_OK, archive_read_next_header(a, &entry));
+
+		assertEqualInt(ARCHIVE_OK, archive_read_data_block(a, &pv, &s, &o));
+		assertEqualInt(262144, s);
+		assertEqualInt(0, o);
+
+		assertEqualInt(ARCHIVE_OK, archive_read_data_block(a, &pv, &s, &o));
+		assertEqualInt(6, s);
+		assertEqualInt(262144, o);
+
+		assertEqualInt(ARCHIVE_EOF, archive_read_data_block(a, &pv, &s, &o));
+
+		assertEqualInt(ARCHIVE_OK, archive_free(a));
+	}
+
+	free(body);
+	free(body_read);
+	free(buff);
+}
@@ -0,0 +1,18 @@
+begin 644 test_read_format_zip_high_compression.zip
+M4$L#!!0`"``(`*=Y]4@``````````*``!``(`"``8VAA<BYB:6Y55`T`!\L>
+MD5>>))%7GB215W5X"P`!!/8!```$%````.W=06K#,!`%T&E)P8LL?*2XC@N%
+M)#5QO>AM<K0<+2=0:!OBP>@9WDJ6!%\6$K/Q6T3LAX]N/GQ'Z9G&KA^*K1'S
+M.`[GOIM*[TP_Q_>O0[G_:3X.Y\^^V/X2<<GT&IM=$]OK?[71_LJ],3;1+*(T
+M_U)99\T+````````````````````````````````````````L`:E?]*S#FVT
+MJY:='SPB>_]DR\X?`("_R:X_U"Y[_:F;;Q``ZN+L!P"H3W;]$_5G`&!9V?</
+M````X/FRZP_9LO,'@`S9YR^0P_Z'NF7?/P``````````````````````````
+M````````````````````````````````````````````````````````````
+M````````````````````````````````````````````````````````````
+M````````````````````````````````````````````````````````````
+M````````````````````````````````````````````````````````````
+MJ%L3VVM-LO,&8/UN4$L'"!<='%^U`0``H``$`%!+`0(4`Q0`"``(`*=Y]4@7
+M'1Q?M0$``*``!``(`"````````````"D@0````!C:&%R+F)I;E54#0`'RQZ1
+M5YXDD5>>))%7=7@+``$$]@$```04````4$L%!@`````!``$`5@````L"````
+!````
+`
+end
@@ -0,0 +1,95 @@
+/*-
+ * Copyright (c) 2003-2007,2016 Tim Kientzle
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#include "test.h"
+__FBSDID("$FreeBSD$");
+
+#define UMASK 022
+
+/*
+ * Github Issue #744 describes a bug in the sandboxing code that
+ * causes very long pathnames to not get checked for symlinks.
+ */
+
+DEFINE_TEST(test_write_disk_secure744)
+{
+#if defined(_WIN32) && !defined(__CYGWIN__)
+	skipping("archive_write_disk security checks not supported on Windows");
+#else
+	struct archive *a;
+	struct archive_entry *ae;
+	size_t buff_size = 8192;
+	char *buff = malloc(buff_size);
+	char *p = buff;
+	int n = 0;
+	int t;
+
+	assert(buff != NULL);
+
+	/* Start with a known umask. */
+	assertUmask(UMASK);
+
+	/* Create an archive_write_disk object. */
+	assert((a = archive_write_disk_new()) != NULL);
+	archive_write_disk_set_options(a, ARCHIVE_EXTRACT_SECURE_SYMLINKS);
+
+	while (p + 500 < buff + buff_size) {
+		memset(p, 'x', 100);
+		p += 100;
+		p[0] = '\0';
+
+		buff[0] = ((n / 1000) % 10) + '0';
+		buff[1] = ((n / 100) % 10)+ '0';
+		buff[2] = ((n / 10) % 10)+ '0';
+		buff[3] = ((n / 1) % 10)+ '0';
+		buff[4] = '_';
+		++n;
+
+		/* Create a symlink pointing to the testworkdir */
+		assert((ae = archive_entry_new()) != NULL);
+		archive_entry_copy_pathname(ae, buff);
+		archive_entry_set_mode(ae, S_IFREG | 0777);
+		archive_entry_copy_symlink(ae, testworkdir);
+		assertEqualIntA(a, ARCHIVE_OK, archive_write_header(a, ae));
+		archive_entry_free(ae);
+
+		*p++ = '/';
+		sprintf(p, "target%d", n);
+
+		/* Try to create a file through the symlink, should fail. */
+		assert((ae = archive_entry_new()) != NULL);
+		archive_entry_copy_pathname(ae, buff);
+		archive_entry_set_mode(ae, S_IFDIR | 0777);
+
+		t = archive_write_header(a, ae);
+		archive_entry_free(ae);
+		failure("Attempt to create target%d via %d-character symlink should have failed", n, (int)strlen(buff));
+		if(!assertEqualInt(ARCHIVE_FAILED, t)) {
+			break;
+		}
+	}
+	archive_free(a);
+	free(buff);
+#endif
+}
@@ -0,0 +1,79 @@
+/*-
+ * Copyright (c) 2003-2007,2016 Tim Kientzle
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#include "test.h"
+__FBSDID("$FreeBSD$");
+
+#define UMASK 022
+
+/*
+ * Github Issue #745 describes a bug in the sandboxing code that
+ * allows one to use a symlink to edit the permissions on a file or
+ * directory outside of the sandbox.
+ */
+
+DEFINE_TEST(test_write_disk_secure745)
+{
+#if defined(_WIN32) && !defined(__CYGWIN__)
+	skipping("archive_write_disk security checks not supported on Windows");
+#else
+	struct archive *a;
+	struct archive_entry *ae;
+
+	/* Start with a known umask. */
+	assertUmask(UMASK);
+
+	/* Create an archive_write_disk object. */
+	assert((a = archive_write_disk_new()) != NULL);
+	archive_write_disk_set_options(a, ARCHIVE_EXTRACT_SECURE_SYMLINKS);
+
+	/* The target dir:  The one we're going to try to change permission on */
+	assertMakeDir("target", 0700);
+
+	/* The sandbox dir we're going to run inside of. */
+	assertMakeDir("sandbox", 0700);
+	assertChdir("sandbox");
+
+	/* Create a symlink pointing to the target directory */
+	assert((ae = archive_entry_new()) != NULL);
+	archive_entry_copy_pathname(ae, "sym");
+	archive_entry_set_mode(ae, AE_IFLNK | 0777);
+	archive_entry_copy_symlink(ae, "../target");
+	assert(0 == archive_write_header(a, ae));
+	archive_entry_free(ae);
+
+	/* Try to alter the target dir through the symlink; this should fail. */
+	assert((ae = archive_entry_new()) != NULL);
+	archive_entry_copy_pathname(ae, "sym");
+	archive_entry_set_mode(ae, S_IFDIR | 0777);
+	assert(0 == archive_write_header(a, ae));
+	archive_entry_free(ae);
+
+	/* Permission of target dir should not have changed. */
+	assertFileMode("../target", 0700);
+
+	assert(0 == archive_write_close(a));
+	archive_write_free(a);
+#endif
+}
@@ -0,0 +1,129 @@
+/*-
+ * Copyright (c) 2003-2007,2016 Tim Kientzle
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#include "test.h"
+__FBSDID("$FreeBSD$");
+
+#define UMASK 022
+
+/*
+ * Github Issue #746 describes a problem in which hardlink targets are
+ * not adequately checked and can be used to modify entries outside of
+ * the sandbox.
+ */
+
+/*
+ * Verify that ARCHIVE_EXTRACT_SECURE_NODOTDOT disallows '..' in hardlink
+ * targets.
+ */
+DEFINE_TEST(test_write_disk_secure746a)
+{
+#if defined(_WIN32) && !defined(__CYGWIN__)
+	skipping("archive_write_disk security checks not supported on Windows");
+#else
+	struct archive *a;
+	struct archive_entry *ae;
+
+	/* Start with a known umask. */
+	assertUmask(UMASK);
+
+	/* The target directory we're going to try to affect. */
+	assertMakeDir("target", 0700);
+	assertMakeFile("target/foo", 0700, "unmodified");
+
+	/* The sandbox dir we're going to work within. */
+	assertMakeDir("sandbox", 0700);
+	assertChdir("sandbox");
+
+	/* Create an archive_write_disk object. */
+	assert((a = archive_write_disk_new()) != NULL);
+	archive_write_disk_set_options(a, ARCHIVE_EXTRACT_SECURE_NODOTDOT);
+
+	/* Attempt to hardlink to the target directory. */
+	assert((ae = archive_entry_new()) != NULL);
+	archive_entry_copy_pathname(ae, "bar");
+	archive_entry_set_mode(ae, AE_IFREG | 0777);
+	archive_entry_set_size(ae, 8);
+	archive_entry_copy_hardlink(ae, "../target/foo");
+	assertEqualInt(ARCHIVE_FAILED, archive_write_header(a, ae));
+	assertEqualInt(ARCHIVE_FATAL, archive_write_data(a, "modified", 8));
+	archive_entry_free(ae);
+
+	/* Verify that target file contents are unchanged. */
+	assertTextFileContents("unmodified", "../target/foo");
+#endif
+}
+
+/*
+ * Verify that ARCHIVE_EXTRACT_SECURE_NOSYMLINK disallows symlinks in hardlink
+ * targets.
+ */
+DEFINE_TEST(test_write_disk_secure746b)
+{
+#if defined(_WIN32) && !defined(__CYGWIN__)
+	skipping("archive_write_disk security checks not supported on Windows");
+#else
+	struct archive *a;
+	struct archive_entry *ae;
+
+	/* Start with a known umask. */
+	assertUmask(UMASK);
+
+	/* The target directory we're going to try to affect. */
+	assertMakeDir("target", 0700);
+	assertMakeFile("target/foo", 0700, "unmodified");
+
+	/* The sandbox dir we're going to work within. */
+	assertMakeDir("sandbox", 0700);
+	assertChdir("sandbox");
+
+	/* Create an archive_write_disk object. */
+	assert((a = archive_write_disk_new()) != NULL);
+	archive_write_disk_set_options(a, ARCHIVE_EXTRACT_SECURE_SYMLINKS);
+
+	/* Create a symlink to the target directory. */
+	assert((ae = archive_entry_new()) != NULL);
+	archive_entry_copy_pathname(ae, "symlink");
+	archive_entry_set_mode(ae, AE_IFLNK | 0777);
+	archive_entry_copy_symlink(ae, "../target");
+	assertEqualIntA(a, ARCHIVE_OK, archive_write_header(a, ae));
+	archive_entry_free(ae);
+
+	/* Attempt to hardlink to the target directory via the symlink. */
+	assert((ae = archive_entry_new()) != NULL);
+	archive_entry_copy_pathname(ae, "bar");
+	archive_entry_set_mode(ae, AE_IFREG | 0777);
+	archive_entry_set_size(ae, 8);
+	archive_entry_copy_hardlink(ae, "symlink/foo");
+	assertEqualIntA(a, ARCHIVE_FAILED, archive_write_header(a, ae));
+	assertEqualIntA(a, ARCHIVE_FATAL, archive_write_data(a, "modified", 8));
+	archive_entry_free(ae);
+
+	/* Verify that target file contents are unchanged. */
+	assertTextFileContents("unmodified", "../target/foo");
+
+	assertEqualIntA(a, ARCHIVE_FATAL, archive_write_close(a));
+	archive_write_free(a);
+#endif
+}
@@ -100,6 +100,10 @@ DEFINE_TEST(test_write_format_gnutar_linknames)
 	size_t used;
 	int i;

+#ifdef S_IFLNK
+	assertEqualInt(S_IFLNK, AE_IFLNK);
+#endif
+
 	buff = malloc(buffsize); /* million bytes of work area */
 	assert(buff != NULL);

@@ -109,7 +113,7 @@ DEFINE_TEST(test_write_format_gnutar_linknames)
 	archive_entry_set_birthtime(template, 3, 30);
 	archive_entry_set_ctime(template, 4, 40);
 	archive_entry_set_mtime(template, 5, 50);
-	archive_entry_set_mode(template, S_IFLNK | 0755);
+	archive_entry_set_mode(template, AE_IFLNK | 0755);
 	archive_entry_copy_pathname(template, "link");

 	for (i = 0; i < 2000; ++i) {
@@ -68,6 +68,7 @@ static const struct bsdtar_option {
 	{ "auto-compress",        0, 'a' },
 	{ "b64encode",            0, OPTION_B64ENCODE },
 	{ "block-size",           1, 'b' },
+	{ "blocking-factor",	  1, 'b' },
 	{ "bunzip2",              0, 'j' },
 	{ "bzip",                 0, 'j' },
 	{ "bzip2",                0, 'j' },
@@ -88,7 +88,7 @@ DEFINE_TEST(test_version)
 	if (*q == 'a' || *q == 'b' || *q == 'c' || *q == 'd')
 		++q;
 	/* Skip arbitrary third-party version numbers. */
-	while (s > 0 && (*q == ' ' || *q == '/' || *q == '.' || isalnum(*q))) {
+	while (s > 0 && (*q == ' ' || *q == '-' || *q == '/' || *q == '.' || isalnum(*q))) {
 		++q;
 		--s;
 	}
@@ -182,7 +182,7 @@ safe_fprintf(FILE *f, const char *fmt, ...)
 		}

 		/* If our output buffer is full, dump it and keep going. */
-		if (i > (sizeof(outbuff) - 20)) {
+		if (i > (sizeof(outbuff) - 128)) {
 			outbuff[i] = '\0';
 			fprintf(f, "%s", outbuff);
 			i = 0;
@@ -90,6 +90,7 @@ const MCFixupKindInfo &ARMAsmBackend::getFixupKindInfo(MCFixupKind Kind) const {
      {"fixup_arm_movw_lo16", 0, 20, 0},
      {"fixup_t2_movt_hi16", 0, 20, 0},
      {"fixup_t2_movw_lo16", 0, 20, 0},
+      {"fixup_arm_mod_imm", 0, 12, 0},
  };
  const static MCFixupKindInfo InfosBE[ARM::NumTargetFixupKinds] = {
      // This table *must* be in the order that the fixup_* kinds are defined in
@@ -133,6 +134,7 @@ const MCFixupKindInfo &ARMAsmBackend::getFixupKindInfo(MCFixupKind Kind) const {
      {"fixup_arm_movw_lo16", 12, 20, 0},
      {"fixup_t2_movt_hi16", 12, 20, 0},
      {"fixup_t2_movw_lo16", 12, 20, 0},
+      {"fixup_arm_mod_imm", 20, 12, 0},
  };

  if (Kind < FirstTargetFixupKind)
@@ -624,6 +626,13 @@ unsigned ARMAsmBackend::adjustFixupValue(const MCFixup &Fixup, uint64_t Value,

    return Value;
  }
+  case ARM::fixup_arm_mod_imm:
+    Value = ARM_AM::getSOImmVal(Value);
+    if (Ctx && Value >> 12) {
+      Ctx->reportError(Fixup.getLoc(), "out of range immediate fixup value");
+      return 0;
+    }
+    return Value;
  }
 }

@@ -690,6 +699,7 @@ static unsigned getFixupKindNumBytes(unsigned Kind) {
  case FK_Data_2:
  case ARM::fixup_arm_thumb_br:
  case ARM::fixup_arm_thumb_cb:
+  case ARM::fixup_arm_mod_imm:
    return 2;

  case ARM::fixup_arm_pcrel_10_unscaled:
@@ -766,6 +776,7 @@ static unsigned getFixupKindContainerSizeBytes(unsigned Kind) {
  case ARM::fixup_arm_movw_lo16:
  case ARM::fixup_t2_movt_hi16:
  case ARM::fixup_t2_movw_lo16:
+  case ARM::fixup_arm_mod_imm:
    // Instruction size is 4 bytes.
    return 4;
  }
@@ -100,6 +100,9 @@ enum Fixups {
  fixup_t2_movt_hi16, // :upper16:
  fixup_t2_movw_lo16, // :lower16:

+  // fixup_arm_mod_imm - Fixup for mod_imm
+  fixup_arm_mod_imm,
+
  // Marker
  LastTargetFixupKind,
  NumTargetFixupKinds = LastTargetFixupKind - FirstTargetFixupKind
@@ -312,12 +312,8 @@ public:
    // Support for fixups (MCFixup)
    if (MO.isExpr()) {
      const MCExpr *Expr = MO.getExpr();
-      // In instruction code this value always encoded as lowest 12 bits,
-      // so we don't have to perform any specific adjustments.
-      // Due to requirements of relocatable records we have to use FK_Data_4.
-      // See ARMELFObjectWriter::ExplicitRelSym and
-      //     ARMELFObjectWriter::GetRelocTypeInner for more details.
-      MCFixupKind Kind = MCFixupKind(FK_Data_4);
+      // Fixups resolve to plain values that need to be encoded.
+      MCFixupKind Kind = MCFixupKind(ARM::fixup_arm_mod_imm);
      Fixups.push_back(MCFixup::create(0, Expr, Kind, MI.getLoc()));
      return 0;
    }
@@ -576,7 +576,6 @@ def : Proc<"btver1", [
  FeaturePRFCHW,
  FeatureLZCNT,
  FeaturePOPCNT,
-  FeatureXSAVE,
  FeatureSlowSHLD,
  FeatureLAHFSAHF
 ]>;
@@ -2731,7 +2731,6 @@ bool X86TargetInfo::initFeatureMap(
    setFeatureEnabledImpl(Features, "prfchw", true);
    setFeatureEnabledImpl(Features, "cx16", true);
    setFeatureEnabledImpl(Features, "fxsr", true);
-    setFeatureEnabledImpl(Features, "xsave", true);
    break;
  case CK_BDVER4:
    setFeatureEnabledImpl(Features, "avx2", true);
@@ -101,6 +101,7 @@ struct	mpage {
 	char		*arch;    /* architecture from file content */
 	char		*title;   /* title from file content */
 	char		*desc;    /* description from file content */
+	struct mpage	*next;    /* singly linked list */
 	struct mlink	*mlinks;  /* singly linked list */
 	int		 form;    /* format from file content */
 	int		 name_head_done;
@@ -144,6 +145,7 @@ static	void	 dbadd_mlink_name(const struct mlink *mlink);
 static	int	 dbopen(int);
 static	void	 dbprune(void);
 static	void	 filescan(const char *);
+static	int	 fts_compare(const FTSENT *const *, const FTSENT *const *);
 static	void	 mlink_add(struct mlink *, const struct stat *);
 static	void	 mlink_check(struct mpage *, struct mlink *);
 static	void	 mlink_free(struct mlink *);
@@ -202,6 +204,7 @@ static	struct ohash	 strings; /* table of all strings */
 static	sqlite3		*db = NULL; /* current database */
 static	sqlite3_stmt	*stmts[STMT__MAX]; /* current statements */
 static	uint64_t	 name_mask;
+static	struct mpage	*mpage_head;

 static	const struct mdoc_handler mdocs[MDOC_MAX] = {
 	{ NULL, 0 },  /* Ap */
@@ -562,6 +565,20 @@ usage:
 	return (int)MANDOCLEVEL_BADARG;
 }

+static int
+fts_compare(const FTSENT *const *a, const FTSENT *const *b)
+{
+
+	/*
+	 * The mpage list is processed in the opposite order to which pages are
+	 * added, so traverse the hierarchy in reverse alpha order, resulting
+	 * in database inserts in alpha order. This is not required for correct
+	 * operation, but is helpful when inspecting the database during
+	 * development.
+	 */
+	return -strcmp((*a)->fts_name, (*b)->fts_name);
+}
+
 /*
 * Scan a directory tree rooted at "basedir" for manpages.
 * We use fts(), scanning directory parts along the way for clues to our
@@ -591,8 +608,8 @@ treescan(void)
 	argv[0] = ".";
 	argv[1] = (char *)NULL;

-	f = fts_open((char * const *)argv,
-	    FTS_PHYSICAL | FTS_NOCHDIR, NULL);
+	f = fts_open((char * const *)argv, FTS_PHYSICAL | FTS_NOCHDIR,
+	    fts_compare);
 	if (f == NULL) {
 		exitcode = (int)MANDOCLEVEL_SYSERR;
 		say("", "&fts_open");
@@ -957,6 +974,8 @@ mlink_add(struct mlink *mlink, const struct stat *st)
 		mpage = mandoc_calloc(1, sizeof(struct mpage));
 		mpage->inodev.st_ino = inodev.st_ino;
 		mpage->inodev.st_dev = inodev.st_dev;
+		mpage->next = mpage_head;
+		mpage_head = mpage;
 		ohash_insert(&mpages, slot, mpage);
 	} else
 		mlink->next = mpage->mlinks;
@@ -980,20 +999,18 @@ mpages_free(void)
 {
 	struct mpage	*mpage;
 	struct mlink	*mlink;
-	unsigned int	 slot;

-	mpage = ohash_first(&mpages, &slot);
-	while (NULL != mpage) {
+	while (NULL != (mpage = mpage_head)) {
 		while (NULL != (mlink = mpage->mlinks)) {
 			mpage->mlinks = mlink->next;
 			mlink_free(mlink);
 		}
+		mpage_head = mpage->next;
 		free(mpage->sec);
 		free(mpage->arch);
 		free(mpage->title);
 		free(mpage->desc);
 		free(mpage);
-		mpage = ohash_next(&mpages, &slot);
 	}
 }

@@ -1114,18 +1131,14 @@ mpages_merge(struct mparse *mp)
 	char			*sodest;
 	char			*cp;
 	int			 fd;
-	unsigned int		 pslot;

 	if ( ! nodb)
 		SQL_EXEC("BEGIN TRANSACTION");

-	mpage = ohash_first(&mpages, &pslot);
-	while (mpage != NULL) {
+	for (mpage = mpage_head; mpage != NULL; mpage = mpage->next) {
 		mlinks_undupe(mpage);
-		if ((mlink = mpage->mlinks) == NULL) {
-			mpage = ohash_next(&mpages, &pslot);
+		if ((mlink = mpage->mlinks) == NULL)
 			continue;
-		}

 		name_mask = NAME_MASK;
 		mandoc_ohash_init(&names, 4, offsetof(struct str, key));
@@ -1247,7 +1260,6 @@ mpages_merge(struct mparse *mp)
 nextpage:
 		ohash_delete(&strings);
 		ohash_delete(&names);
-		mpage = ohash_next(&mpages, &pslot);
 	}

 	if (0 == nodb)
@@ -88,7 +88,7 @@ static struct test {
 		0xFFFF, 0x5D, 0x5B, 0x10000, 0x10FFFF, 0x5D, 0x0A
 	},
 #ifdef __FreeBSD__
-	{	 1, -1, -1,  1,  1, -1, 1,  1,  1, 1, -1,  1,  1, -1, -1,
+	{	 1, -1, -1,  1,  1, -1, -1,  1,  1, 1, -1,  1,  1, -1, -1,
 #else
 	{	 1, -1, -1,  1,  1, -1, -1,  1,  1, -1, -1,  1,  1, -1, -1,
 #endif
@@ -4,7 +4,7 @@ This file is automatically generated from html/copyright.html
  
   jpg "Clone me," says Dolly sheepishly.
   
-   Last update: 17-Jan-2015 00:16 UTC
+   Last update: 2-Jan-2017 11:58 UTC
     _________________________________________________________________
   
   The following copyright notice applies to all files collectively
@@ -33,7 +33,7 @@ This file is automatically generated from html/copyright.html
   Burnicki is:
 ***********************************************************************
 *                                                                     *
-* Copyright (c) Network Time Foundation 2011-2015                     *
+* Copyright (c) Network Time Foundation 2011-2017                     *
 *                                                                     *
 * All Rights Reserved                                                 *
 *                                                                     *
@@ -1,3 +1,143 @@
+---
+(4.2.8p10-win-beta1) 2017/03/21 Released by Harlan Stenn <[email protected]>
+(4.2.8p10)
+
+* [Sec 3389] NTP-01-016: Denial of Service via Malformed Config
+  (Pentest report 01.2017) <[email protected]>
+* [Sec 3388] NTP-01-014: Buffer Overflow in DPTS Clock
+  (Pentest report 01.2017) <[email protected]>
+* [Sec 3387] NTP-01-012: Authenticated DoS via Malicious Config Option
+  (Pentest report 01.2017) <[email protected]>
+* [Sec 3386] NTP-01-011: ntpq_stripquotes() returns incorrect Value
+  (Pentest report 01.2017) <[email protected]>
+* [Sec 3385] NTP-01-010: ereallocarray()/eallocarray() underused. HStenn
+* [Sec 3384] NTP-01-009: Privileged execution of User Library code
+  (Pentest report 01.2017) <[email protected]>
+* [Sec 3383] NTP-01-008: Stack Buffer Overflow from Command Line
+  (Pentest report 01.2017) <[email protected]>
+* [Sec 3382] NTP-01-007: Data Structure terminated insufficiently
+  (Pentest report 01.2017) <[email protected]>
+* [Sec 3380] NTP-01-005: Off-by-one in Oncore GPS Receiver
+  (Pentest report 01.2017) <[email protected]>
+* [Sec 3379] NTP-01-004: Potential Overflows in ctl_put() functions
+  (Pentest report 01.2017) <[email protected]>
+* [Sec 3378] NTP-01-003: Improper use of snprintf() in mx4200_send()
+  (Pentest report 01.2017) <[email protected]>
+* [Sec 3377] NTP-01-002: Buffer Overflow in ntpq when fetching reslist
+  (Pentest report 01.2017) <[email protected]
+* [Sec 3376] Support build "hardening" flags.  [email protected]
+* [Sec 3361] 0rigin (zero origin) DoS.  HStenn.
+* [Bug 3393] clang scan-build findings <[email protected]>
+* [Bug 3363] Support for openssl-1.1.0 without compatibility modes
+  - rework of patch set from <[email protected]>. <[email protected]>
+* [Bug 3356] Bugfix 3072 breaks multicastclient <[email protected]>
+* [Bug 3216] libntp audio ioctl() args incorrectly cast to int
+  on 4.4BSD-Lite derived platforms <[email protected]>
+  - original patch by Majdi S. Abbas
+* [Bug 3215] 'make distcheck' fails with new BK repo format <[email protected]>
+* [Bug 3173] forking async worker: interrupted pipe I/O <[email protected]>
+  - initial patch by Christos Zoulas
+* [Bug 3139] (...) time_pps_create: Exec format error <[email protected]>
+  - move loader API from 'inline' to proper source
+  - augment pathless dlls with absolute path to NTPD
+  - use 'msyslog()' instead of 'printf() 'for reporting trouble
+* [Bug 3107] Incorrect Logic for Peer Event Limiting <[email protected]>
+  - applied patch by Matthew Van Gundy
+* [Bug 3065] Quiet warnings on NetBSD <[email protected]>
+  - applied some of the patches provided by Havard. Not all of them
+    still match the current code base, and I did not touch libopt.
+* [Bug 3062] Change the process name of forked DNS worker <[email protected]>
+  - applied patch by Reinhard Max. See bugzilla for limitations.
+* [Bug 2923] Trap Configuration Fail <[email protected]>
+  - fixed dependency inversion from [Bug 2837]
+* [Bug 2896] Nothing happens if minsane < maxclock < minclock
+  - produce ERROR log message about dysfunctional daemon. <[email protected]>
+* [Bug 2851] allow -4/-6 on restrict line with mask <[email protected]>
+  - applied patch by Miroslav Lichvar for ntp4.2.6 compat
+* [Bug 2645] out-of-bound pointers in ctl_putsys and decode_bitflags
+  - Fixed these and some more locations of this pattern.
+    Probably din't get them all, though. <[email protected]>
+* Update copyright year.
+* bk-7 trigger updates
+
+---
+(4.2.8p9-win) 2017/02/01 Released by Harlan Stenn <[email protected]>
+
+* [Bug 3144] NTP does not build without openSSL. <[email protected]>
+  - added missed changeset for automatic openssl lib detection
+  - fixed some minor warning issues
+* [Bug 3095]  More compatibility with openssl 1.1. <[email protected]>
+* configure.ac cleanup.  [email protected]
+* openssl configure cleanup.  [email protected]
+
+---
+(4.2.8p9) 2016/11/21 Released by Harlan Stenn <[email protected]>
+
+* [Sec 3119] Trap crash <[email protected]>
+* [Sec 3118] Mode 6 information disclosure and DDoS vector <[email protected]>
+  - TRAP config via mode 6 packet requires AUTH now.
+* [Sec 3114] Broadcast Mode Replay Prevention DoS
+  - applied patches by Matthew Van Gundy. <[email protected]>
+  - with bcpollbstep, tweaks and cleanup by [email protected]
+* [Sec 3113] Broadcast Mode Poll Interval Enforcement DoS <[email protected]>
+  - applied fix as suggested by Matthew Van Gundy
+* [Sec 3110] Windows: ntpd DoS by oversized UDP packet
+  - fixed error handling for truncated UDP packets. <[email protected]>
+* [Sec 3102] Zero origin issues.  HStenn.
+* [Sec 3082] null pointer dereference in _IO_str_init_static_internal()
+  - more hardening to read_mru_list(). [email protected]
+* [Sec 3072] Attack on interface selection <[email protected]>
+  - implemented Miroslav Lichvars <[email protected]> suggestion
+    to skip interface updates based on incoming packets
+* [Bug 3142] bug in netmask prefix length detection <[email protected]>
+* [Bug 3138] gpsdjson refclock should honor fudgetime1. [email protected]
+* [Bug 3129] Unknown hosts can put resolver thread into a hard loop
+  - moved retry decision where it belongs. <[email protected]>
+* [Bug 3125] NTPD doesn't fully start when ntp.conf entries are out of order
+  using the loopback-ppsapi-provider.dll <[email protected]>
+* [Bug 3116] unit tests for NTP time stamp expansion. <[email protected]>
+* [Bug 3100] ntpq can't retrieve daemon_version <[email protected]>
+  - fixed extended sysvar lookup (bug introduced with bug 3008 fix)
+* [Bug 3095] Compatibility with openssl 1.1 <[email protected]>
+  - applied patches by Kurt Roeckx <[email protected]> to source
+  - added shim layer for SSL API calls with issues (both directions)
+* [Bug 3089] Serial Parser does not work anymore for hopfser like device
+  - simplified / refactored hex-decoding in driver. <[email protected]>
+* [Bug 3084] update-leap mis-parses the leapfile name.  HStenn.
+* [Bug 3068] Linker warnings when building on Solaris. [email protected]
+  - applied patch thanks to Andrew Stormont <[email protected]>
+* [Bug 3067] Root distance calculation needs improvement.  HStenn.
+* [Bug 3066] NMEA clock ignores pps. [email protected]
+  - PPS-HACK works again.
+* [Bug 3059] Potential buffer overrun from oversized hash <[email protected]>
+  - applied patch by Brian Utterback <[email protected]>
+* [Bug 3053] ntp_loopfilter.c frequency calc precedence error.  Sarah White.
+* [Bug 3050]  Fix for bug #2960 causes [...] spurious error message.
+  <[email protected]>
+  - patches by Reinhard Max <[email protected]> and Havard Eidnes <[email protected]>
+* [Bug 3047] Fix refclock_jjy C-DEX JST2000. [email protected]
+  - Patch provided by Kuramatsu.
+* [Bug 3021] unity_fixture.c needs pragma weak <[email protected]>
+  - removed unnecessary & harmful decls of 'setUp()' & 'tearDown()'
+* [Bug 3019] Windows: ERROR_HOST_UNREACHABLE block packet processing.
+  DMayer and JPerlinger.
+* [Bug 2998] sntp/tests/packetProcessing.c broken without openssl. JPerlinger
+* [Bug 2961] sntp/tests/packetProcessing.c assumes AUTOKEY.  HStenn.
+* [Bug 2959] refclock_jupiter: gps week correction <[email protected]>
+  - fixed GPS week expansion to work based on build date. Special thanks
+    to Craig Leres for initial patch and testing.
+* [Bug 2951] ntpd tests fail: multiple definition of `send_via_ntp_signd'
+  - fixed Makefile.am <[email protected]>
+* [Bug 2689] ATOM driver processes last PPS pulse at startup,
+             even if it is very old <[email protected]>
+  - make sure PPS source is alive before processing samples
+  - improve stability close to the 500ms phase jump (phase gate)
+* Fix typos in include/ntp.h.
+* Shim X509_get_signature_nid() if needed.
+* git author attribution cleanup
+* bk ignore file cleanup
+* remove locks in Windows IO, use rpc-like thread synchronisation instead
+
 ---
 (4.2.8p8) 2016/06/02 Released by Harlan Stenn <[email protected]>

@@ -19,7 +159,7 @@
 * Fix typo in ntp-wait and plot_summary.  HStenn.
 * Make sure we have an "author" file for git imports.  HStenn.
 * Update the sntp problem tests for MacOS.  HStenn.
-  
+
 ---
 (4.2.8p7) 2016/04/26 Released by Harlan Stenn <[email protected]>

@@ -107,6 +107,7 @@ am__aclocal_m4_deps = $(top_srcdir)/sntp/libopts/m4/libopts.m4 \
 	$(top_srcdir)/sntp/m4/ntp_dir_sep.m4 \
 	$(top_srcdir)/sntp/m4/ntp_facilitynames.m4 \
 	$(top_srcdir)/sntp/m4/ntp_googletest.m4 \
+	$(top_srcdir)/sntp/m4/ntp_harden.m4 \
 	$(top_srcdir)/sntp/m4/ntp_ipv6.m4 \
 	$(top_srcdir)/sntp/m4/ntp_lib_m.m4 \
 	$(top_srcdir)/sntp/m4/ntp_libevent.m4 \
@@ -202,16 +203,14 @@ am__DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/config.h.in \
 	$(top_srcdir)/sntp/libevent/build-aux/install-sh \
 	$(top_srcdir)/sntp/libevent/build-aux/ltmain.sh \
 	$(top_srcdir)/sntp/libevent/build-aux/missing ChangeLog \
-	INSTALL NEWS README TODO compile config.guess config.sub \
-	depcomp install-sh ltmain.sh missing \
-	sntp/libevent/build-aux/ar-lib sntp/libevent/build-aux/compile \
+	INSTALL NEWS README TODO sntp/libevent/build-aux/ar-lib \
+	sntp/libevent/build-aux/compile \
 	sntp/libevent/build-aux/config.guess \
 	sntp/libevent/build-aux/config.sub \
 	sntp/libevent/build-aux/depcomp \
 	sntp/libevent/build-aux/install-sh \
 	sntp/libevent/build-aux/ltmain.sh \
-	sntp/libevent/build-aux/missing sntp/libevent/build-aux/ylwrap \
-	ylwrap
+	sntp/libevent/build-aux/missing sntp/libevent/build-aux/ylwrap
 DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
 distdir = $(PACKAGE)-$(VERSION)
 top_distdir = $(distdir)
@@ -280,10 +279,6 @@ CPP = @CPP@
 CPPFLAGS = @CPPFLAGS@
 CPPFLAGS_LIBEVENT = @CPPFLAGS_LIBEVENT@
 CPPFLAGS_NTP = @CPPFLAGS_NTP@
-CXX = @CXX@
-CXXCPP = @CXXCPP@
-CXXDEPMODE = @CXXDEPMODE@
-CXXFLAGS = @CXXFLAGS@
 CYGPATH_W = @CYGPATH_W@
 DCFD = @DCFD@
 DEFS = @DEFS@
@@ -336,6 +331,7 @@ LN_S = @LN_S@
 LSCF = @LSCF@
 LTHREAD_LIBS = @LTHREAD_LIBS@
 LTLIBOBJS = @LTLIBOBJS@
+LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
 MAKEINFO = @MAKEINFO@
 MAKE_ADJTIMED = @MAKE_ADJTIMED@
 MAKE_CHECK_LAYOUT = @MAKE_CHECK_LAYOUT@
@@ -399,6 +395,9 @@ NTPTRACE_DL = @NTPTRACE_DL@
 NTPTRACE_DS = @NTPTRACE_DS@
 NTPTRACE_MS = @NTPTRACE_MS@
 NTPTRACE_NI = @NTPTRACE_NI@
+NTP_HARD_CFLAGS = @NTP_HARD_CFLAGS@
+NTP_HARD_CPPFLAGS = @NTP_HARD_CPPFLAGS@
+NTP_HARD_LDFLAGS = @NTP_HARD_LDFLAGS@
 NTP_KEYGEN_DB = @NTP_KEYGEN_DB@
 NTP_KEYGEN_DL = @NTP_KEYGEN_DL@
 NTP_KEYGEN_DS = @NTP_KEYGEN_DS@
@@ -472,7 +471,6 @@ abs_top_builddir = @abs_top_builddir@
 abs_top_srcdir = @abs_top_srcdir@
 ac_ct_AR = @ac_ct_AR@
 ac_ct_CC = @ac_ct_CC@
-ac_ct_CXX = @ac_ct_CXX@
 ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
 am__include = @am__include@
 am__leading_dot = @am__leading_dot@
@@ -1,3 +1,765 @@
+--
+NTP 4.2.8p10 (Harlan Stenn <[email protected]>, 2017/03/21) 
+
+Focus: Security, Bug fixes, enhancements.
+
+Severity: MEDIUM
+
+This release fixes 5 medium-, 6 low-, and 4 informational-severity
+vulnerabilities, and provides 15 other non-security fixes and improvements:
+
+* NTP-01-016 NTP: Denial of Service via Malformed Config (Medium)
+   Date Resolved: 21 Mar 2017
+   References: Sec 3389 / CVE-2017-6464 / VU#325339
+   Affects: All versions of NTP-4, up to but not including ntp-4.2.8p10, and
+	ntp-4.3.0 up to, but not including ntp-4.3.94.
+   CVSS2: MED 4.6 (AV:N/AC:H/Au:M/C:N/I:N/A:C)
+   CVSS3: MED 4.2 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H
+   Summary:
+	A vulnerability found in the NTP server makes it possible for an
+	authenticated remote user to crash ntpd via a malformed mode
+	configuration directive.
+   Mitigation:
+	Implement BCP-38.
+	Upgrade to 4.2.8p10, or later, from the NTP Project Download Page or
+	    the NTP Public Services Project Download Page
+	Properly monitor your ntpd instances, and auto-restart
+	    ntpd (without -g) if it stops running. 
+   Credit:
+	This weakness was discovered by Cure53. 
+
+* NTP-01-014 NTP: Buffer Overflow in DPTS Clock (Low)
+    Date Resolved: 21 Mar 2017
+    References: Sec 3388 / CVE-2017-6462 / VU#325339
+    Affects: All versions of NTP, up to but not including ntp-4.2.8p10, and ntp-4.3.0 up to, but not including ntp-4.3.94.
+    CVSS2: Low 1.0 (AV:L/AC:H/Au:S/C:N/I:N/A:P)
+    CVSS3: Low 1.6 CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:L
+    Summary:
+	There is a potential for a buffer overflow in the legacy Datum
+	Programmable Time Server refclock driver.  Here the packets are
+	processed from the /dev/datum device and handled in
+	datum_pts_receive().  Since an attacker would be required to
+	somehow control a malicious /dev/datum device, this does not
+	appear to be a practical attack and renders this issue "Low" in
+	terms of severity.
+   Mitigation:
+	If you have a Datum reference clock installed and think somebody
+	    may maliciously change the device, upgrade to 4.2.8p10, or
+	    later, from the NTP Project Download Page or the NTP Public
+	    Services Project Download Page
+	Properly monitor your ntpd instances, and auto-restart
+	    ntpd (without -g) if it stops running. 
+   Credit:
+	This weakness was discovered by Cure53. 
+
+* NTP-01-012 NTP: Authenticated DoS via Malicious Config Option (Medium)
+   Date Resolved: 21 Mar 2017
+   References: Sec 3387 / CVE-2017-6463 / VU#325339
+   Affects: All versions of ntp, up to but not including ntp-4.2.8p10, and
+	ntp-4.3.0 up to, but not including ntp-4.3.94.
+   CVSS2: MED 4.6 (AV:N/AC:H/Au:M/C:N/I:N/A:C)
+   CVSS3: MED 4.2 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H
+   Summary:
+	A vulnerability found in the NTP server allows an authenticated
+	remote attacker to crash the daemon by sending an invalid setting
+	via the :config directive.  The unpeer option expects a number or
+	an address as an argument.  In case the value is "0", a
+	segmentation fault occurs.
+   Mitigation:
+	Implement BCP-38.
+	Upgrade to 4.2.8p10, or later, from the NTP Project Download Page
+	    or the NTP Public Services Project Download Page 
+	Properly monitor your ntpd instances, and auto-restart
+	    ntpd (without -g) if it stops running. 
+   Credit:
+	This weakness was discovered by Cure53. 
+
+* NTP-01-011 NTP: ntpq_stripquotes() returns incorrect value (Informational)
+   Date Resolved: 21 Mar 2017
+   References: Sec 3386
+   Affects: All versions of NTP, up to but not including ntp-4.2.8p10, and
+	ntp-4.3.0 up to, but not including ntp-4.3.94.
+   CVSS2: None 0.0 (AV:N/AC:H/Au:N/C:N/I:N/A:N)
+   CVSS3: None 0.0 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:N
+   Summary:
+	The NTP Mode 6 monitoring and control client, ntpq, uses the
+	function ntpq_stripquotes() to remove quotes and escape characters
+	from a given string.  According to the documentation, the function
+	is supposed to return the number of copied bytes but due to
+	incorrect pointer usage this value is always zero.  Although the
+	return value of this function is never used in the code, this
+	flaw could lead to a vulnerability in the future.  Since relying
+	on wrong return values when performing memory operations is a
+	dangerous practice, it is recommended to return the correct value
+	in accordance with the documentation pertinent to the code.
+   Mitigation:
+	Implement BCP-38.
+	Upgrade to 4.2.8p10, or later, from the NTP Project Download Page
+	    or the NTP Public Services Project Download Page
+	Properly monitor your ntpd instances, and auto-restart
+	    ntpd (without -g) if it stops running. 
+   Credit:
+	This weakness was discovered by Cure53. 
+
+* NTP-01-010 NTP: ereallocarray()/eallocarray() underused (Info)
+   Date Resolved: 21 Mar 2017
+   References: Sec 3385
+   Affects: All versions of NTP, up to but not including ntp-4.2.8p10, and
+	ntp-4.3.0 up to, but not including ntp-4.3.94.
+   Summary:
+	NTP makes use of several wrappers around the standard heap memory
+	allocation functions that are provided by libc.  This is mainly
+	done to introduce additional safety checks concentrated on
+	several goals.  First, they seek to ensure that memory is not
+	accidentally freed, secondly they verify that a correct amount
+	is always allocated and, thirdly, that allocation failures are
+	correctly handled.  There is an additional implementation for
+	scenarios where memory for a specific amount of items of the
+	same size needs to be allocated.  The handling can be found in
+	the oreallocarray() function for which a further number-of-elements
+	parameter needs to be provided.  Although no considerable threat
+	was identified as tied to a lack of use of this function, it is
+	recommended to correctly apply oreallocarray() as a preferred
+	option across all of the locations where it is possible.
+   Mitigation:
+	Upgrade to 4.2.8p10, or later, from the NTP Project Download Page
+	    or the NTP Public Services Project Download Page 
+   Credit:
+	This weakness was discovered by Cure53. 
+
+* NTP-01-009 NTP: Privileged execution of User Library code (WINDOWS
+	PPSAPI ONLY) (Low)
+   Date Resolved: 21 Mar 2017
+   References: Sec 3384 / CVE-2017-6455 / VU#325339
+   Affects: All Windows versions of ntp-4 that use the PPSAPI, up to but
+	not including ntp-4.2.8p10, and ntp-4.3.0 up to, but not
+	including ntp-4.3.94.
+   CVSS2: MED 3.8 (AV:L/AC:H/Au:S/C:N/I:N/A:C)
+   CVSS3: MED 4.0 CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H
+   Summary:
+	The Windows NT port has the added capability to preload DLLs
+	defined in the inherited global local environment variable
+	PPSAPI_DLLS.  The code contained within those libraries is then
+	called from the NTPD service, usually running with elevated
+	privileges. Depending on how securely the machine is setup and
+	configured, if ntpd is configured to use the PPSAPI under Windows
+	this can easily lead to a code injection.
+   Mitigation:
+	Implement BCP-38.
+	Upgrade to 4.2.8p10, or later, from the NTP Project Download Page
+	    or the NTP Public Services Project Download Page 
+   Credit:
+   This weakness was discovered by Cure53. 
+
+* NTP-01-008 NTP: Stack Buffer Overflow from Command Line (WINDOWS
+	installer ONLY) (Low)
+   Date Resolved: 21 Mar 2017
+   References: Sec 3383 / CVE-2017-6452 / VU#325339
+   Affects: WINDOWS installer ONLY: All versions of the ntp-4 Windows
+	installer, up to but not including ntp-4.2.8p10, and ntp-4.3.0 up
+	to, but not including ntp-4.3.94.
+   CVSS2: Low 1.0 (AV:L/AC:H/Au:S/C:N/I:N/A:P)
+   CVSS3: Low 1.8 CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:L
+   Summary:
+	The Windows installer for NTP calls strcat(), blindly appending
+	the string passed to the stack buffer in the addSourceToRegistry()
+	function.  The stack buffer is 70 bytes smaller than the buffer
+	in the calling main() function.  Together with the initially
+	copied Registry path, the combination causes a stack buffer
+	overflow and effectively overwrites the stack frame.  The
+	passed application path is actually limited to 256 bytes by the
+	operating system, but this is not sufficient to assure that the
+	affected stack buffer is consistently protected against
+	overflowing at all times.
+   Mitigation:
+	Upgrade to 4.2.8p10, or later, from the NTP Project Download Page
+	or the NTP Public Services Project Download Page 
+   Credit:
+	This weakness was discovered by Cure53. 
+
+* NTP-01-007 NTP: Data Structure terminated insufficiently (WINDOWS
+	installer ONLY) (Low)
+   Date Resolved: 21 Mar 2017
+   References: Sec 3382 / CVE-2017-6459 / VU#325339
+   Affects: WINDOWS installer ONLY: All ntp-4 versions of the Windows
+	installer, up to but not including ntp-4.2.8p10, and ntp-4.3.0
+	up to, but not including ntp-4.3.94.
+   CVSS2: Low 1.0 (AV:L/AC:H/Au:S/C:N/I:N/A:P)
+   CVSS3: Low 1.8 CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:L
+   Summary:
+	The Windows installer for NTP calls strcpy() with an argument
+	that specifically contains multiple null bytes.  strcpy() only
+	copies a single terminating null character into the target
+	buffer instead of copying the required double null bytes in the
+	addKeysToRegistry() function.  As a consequence, a garbage
+	registry entry can be created.  The additional arsize parameter
+	is erroneously set to contain two null bytes and the following
+	call to RegSetValueEx() claims to be passing in a multi-string
+	value, though this may not be true.
+   Mitigation:
+	Upgrade to 4.2.8p10, or later, from the NTP Project Download Page
+	    or the NTP Public Services Project Download Page 
+   Credit:
+	This weakness was discovered by Cure53. 
+
+* NTP-01-006 NTP: Copious amounts of Unused Code (Informational)
+   References: Sec 3381
+   Summary:
+	The report says: Statically included external projects
+	potentially introduce several problems and the issue of having
+	extensive amounts of code that is "dead" in the resulting binary
+	must clearly be pointed out.  The unnecessary unused code may or
+	may not contain bugs and, quite possibly, might be leveraged for
+	code-gadget-based branch-flow redirection exploits.  Analogically,
+	having source trees statically included as well means a failure
+	in taking advantage of the free feature for periodical updates.
+	This solution is offered by the system's Package Manager. The
+	three libraries identified are libisc, libevent, and libopts.
+   Resolution:
+	For libisc, we already only use a portion of the original library.
+	We've found and fixed bugs in the original implementation (and
+	offered the patches to ISC), and plan to see what has changed
+	since we last upgraded the code.  libisc is generally not
+	installed, and when it it we usually only see the static libisc.a
+	file installed.  Until we know for sure that the bugs we've found
+	and fixed are fixed upstream, we're better off with the copy we
+	are using.
+
+        Version 1 of libevent was the only production version available
+	until recently, and we've been requiring version 2 for a long time.
+	But if the build system has at least version 2 of libevent
+	installed, we'll use the version that is installed on the system.
+	Otherwise, we provide a copy of libevent that we know works.
+
+        libopts is provided by GNU AutoGen, and that library and package
+	undergoes frequent API version updates.  The version of autogen
+	used to generate the tables for the code must match the API
+	version in libopts.  AutoGen can be ... difficult to build and
+	install, and very few developers really need it.  So we have it
+	on our build and development machines, and we provide the
+	specific version of the libopts code in the distribution to make
+	sure that the proper API version of libopts is available.
+
+        As for the point about there being code in these libraries that
+	NTP doesn't use, OK.  But other packages used these libraries as
+	well, and it is reasonable to assume that other people are paying
+	attention to security and code quality issues for the overall
+	libraries.  It takes significant resources to analyze and
+	customize these libraries to only include what we need, and to
+	date we believe the cost of this effort does not justify the benefit. 
+   Credit:
+	This issue was discovered by Cure53. 
+
+* NTP-01-005 NTP: Off-by-one in Oncore GPS Receiver (Low)
+   Date Resolved: 21 Mar 2017
+   References: Sec 3380
+   Affects: All versions of NTP, up to but not including ntp-4.2.8p10, and
+   	ntp-4.3.0 up to, but not including ntp-4.3.94.
+   CVSS2: None 0.0 (AV:L/AC:H/Au:N/C:N/I:N/A:N)
+   CVSS3: None 0.0 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N
+   Summary:
+	There is a fencepost error in a "recovery branch" of the code for
+	the Oncore GPS receiver if the communication link to the ONCORE
+	is weak / distorted and the decoding doesn't work.
+   Mitigation:
+        Upgrade to 4.2.8p10, or later, from the NTP Project Download Page or
+	    the NTP Public Services Project Download Page
+        Properly monitor your ntpd instances, and auto-restart
+	    ntpd (without -g) if it stops running. 
+   Credit:
+	This weakness was discovered by Cure53. 
+
+* NTP-01-004 NTP: Potential Overflows in ctl_put() functions (Medium)
+   Date Resolved: 21 Mar 2017
+   References: Sec 3379 / CVE-2017-6458 / VU#325339
+   Affects: All versions of NTP, up to but not including ntp-4.2.8p10, and
+	ntp-4.3.0 up to, but not including ntp-4.3.94.
+   CVSS2: MED 4.6 (AV:N/AC:H/Au:M/C:N/I:N/A:C)
+   CVSS3: MED 4.2 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H
+   Summary:
+	ntpd makes use of different wrappers around ctl_putdata() to
+	create name/value ntpq (mode 6) response strings.  For example,
+	ctl_putstr() is usually used to send string data (variable names
+	or string data).  The formatting code was missing a length check
+	for variable names.  If somebody explicitly created any unusually
+	long variable names in ntpd (longer than 200-512 bytes, depending
+	on the type of variable), then if any of these variables are
+	added to the response list it would overflow a buffer.
+   Mitigation:
+	Implement BCP-38.
+	Upgrade to 4.2.8p10, or later, from the NTP Project Download Page
+	    or the NTP Public Services Project Download Page
+	If you don't want to upgrade, then don't setvar variable names
+	    longer than 200-512 bytes in your ntp.conf file.
+	Properly monitor your ntpd instances, and auto-restart
+	    ntpd (without -g) if it stops running. 
+   Credit:
+	This weakness was discovered by Cure53. 
+
+* NTP-01-003 NTP: Improper use of snprintf() in mx4200_send() (Low)
+   Date Resolved: 21 Mar 2017
+   References: Sec 3378 / CVE-2017-6451 / VU#325339
+   Affects: All versions of NTP, up to but not including ntp-4.2.8p10, and
+	ntp-4.3.0 up to, but not including ntp-4.3.94.
+   CVSS2: LOW 0.8 (AV:L/AC:H/Au:M/C:N/I:N/A:P)
+   CVSS3: LOW 1.8 CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N
+   Summary:
+	The legacy MX4200 refclock is only built if is specifically
+	enabled, and furthermore additional code changes are required to
+	compile and use it.  But it uses the libc functions snprintf()
+	and vsnprintf() incorrectly, which can lead to an out-of-bounds
+	memory write due to an improper handling of the return value of
+	snprintf()/vsnprintf().  Since the return value is used as an
+	iterator and it can be larger than the buffer's size, it is
+	possible for the iterator to point somewhere outside of the
+	allocated buffer space.  This results in an out-of-bound memory
+	write.  This behavior can be leveraged to overwrite a saved
+	instruction pointer on the stack and gain control over the
+	execution flow.  During testing it was not possible to identify
+	any malicious usage for this vulnerability.  Specifically, no
+	way for an attacker to exploit this vulnerability was ultimately
+	unveiled.  However, it has the potential to be exploited, so the
+	code should be fixed.
+   Mitigation, if you have a Magnavox MX4200 refclock:
+	Upgrade to 4.2.8p10, or later, from the NTP Project Download Page
+	    or the NTP Public Services Project Download Page.
+	Properly monitor your ntpd instances, and auto-restart
+	    ntpd (without -g) if it stops running. 
+   Credit:
+	This weakness was discovered by Cure53. 
+
+* NTP-01-002 NTP: Buffer Overflow in ntpq when fetching reslist from a
+	malicious ntpd (Medium)
+   Date Resolved: 21 Mar 2017
+   References: Sec 3377 / CVE-2017-6460 / VU#325339
+   Affects: All versions of ntpq, up to but not including ntp-4.2.8p10, and
+	ntp-4.3.0 up to, but not including ntp-4.3.94.
+   CVSS2: MED 4.9 (AV:N/AC:H/Au:S/C:N/I:N/A:C)
+   CVSS3: MED 4.2 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H
+   Summary:
+	A stack buffer overflow in ntpq can be triggered by a malicious
+	ntpd server when ntpq requests the restriction list from the server.
+	This is due to a missing length check in the reslist() function.
+	It occurs whenever the function parses the server's response and
+	encounters a flagstr variable of an excessive length.  The string
+	will be copied into a fixed-size buffer, leading to an overflow on
+	the function's stack-frame.  Note well that this problem requires
+	a malicious server, and affects ntpq, not ntpd.
+   Mitigation:
+	Upgrade to 4.2.8p10, or later, from the NTP Project Download Page
+	    or the NTP Public Services Project Download Page
+	If you can't upgrade your version of ntpq then if you want to know
+	    the reslist of an instance of ntpd that you do not control,
+	    know that if the target ntpd is malicious that it can send back
+	    a response that intends to crash your ntpq process. 
+   Credit:
+	This weakness was discovered by Cure53. 
+
+* NTP-01-001 NTP: Makefile does not enforce Security Flags (Informational)
+   Date Resolved: 21 Mar 2017
+   References: Sec 3376
+   Affects: All versions of NTP, up to but not including ntp-4.2.8p10, and
+	ntp-4.3.0 up to, but not including ntp-4.3.94.
+   CVSS2: N/A
+   CVSS3: N/A
+   Summary:
+	The build process for NTP has not, by default, provided compile
+	or link flags to offer "hardened" security options.  Package
+	maintainers have always been able to provide hardening security
+	flags for their builds.  As of ntp-4.2.8p10, the NTP build
+	system has a way to provide OS-specific hardening flags.  Please
+	note that this is still not a really great solution because it
+	is specific to NTP builds.  It's inefficient to have every
+	package supply, track and maintain this information for every
+	target build.  It would be much better if there was a common way
+	for OSes to provide this information in a way that arbitrary
+	packages could benefit from it.
+   Mitigation:
+	Implement BCP-38.
+	Upgrade to 4.2.8p10, or later, from the NTP Project Download Page
+	    or the NTP Public Services Project Download Page
+	Properly monitor your ntpd instances, and auto-restart
+	    ntpd (without -g) if it stops running. 
+   Credit:
+	This weakness was reported by Cure53. 
+
+* 0rigin DoS (Medium)
+   Date Resolved: 21 Mar 2017
+   References: Sec 3361 / CVE-2016-9042 / VU#325339
+   Affects: ntp-4.2.8p9 (21 Nov 2016), up to but not including ntp-4.2.8p10
+   CVSS2: MED 4.9 (AV:N/AC:H/Au:N/C:N/I:N/A:C) (worst case)
+   CVSS3: MED 4.4 CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H (worst case)
+   Summary:
+	An exploitable denial of service vulnerability exists in the
+	origin timestamp check functionality of ntpd 4.2.8p9.  A specially
+	crafted unauthenticated network packet can be used to reset the
+	expected origin timestamp for target peers.  Legitimate replies
+	from targeted peers will fail the origin timestamp check (TEST2)
+	causing the reply to be dropped and creating a denial of service
+	condition.  This vulnerability can only be exploited if the
+	attacker can spoof all of the servers.
+   Mitigation:
+	Implement BCP-38.
+	Configure enough servers/peers that an attacker cannot target
+	    all of your time sources.
+	Upgrade to 4.2.8p10, or later, from the NTP Project Download Page
+	    or the NTP Public Services Project Download Page
+	Properly monitor your ntpd instances, and auto-restart
+	    ntpd (without -g) if it stops running. 
+   Credit:
+	This weakness was discovered by Matthew Van Gundy of Cisco. 
+
+Other fixes:
+
+* [Bug 3393] clang scan-build findings <[email protected]>
+* [Bug 3363] Support for openssl-1.1.0 without compatibility modes
+  - rework of patch set from <[email protected]>. <[email protected]>
+* [Bug 3356] Bugfix 3072 breaks multicastclient <[email protected]>
+* [Bug 3216] libntp audio ioctl() args incorrectly cast to int
+  on 4.4BSD-Lite derived platforms <[email protected]>
+  - original patch by Majdi S. Abbas
+* [Bug 3215] 'make distcheck' fails with new BK repo format <[email protected]>
+* [Bug 3173] forking async worker: interrupted pipe I/O <[email protected]>
+  - initial patch by Christos Zoulas
+* [Bug 3139] (...) time_pps_create: Exec format error <[email protected]>
+  - move loader API from 'inline' to proper source
+  - augment pathless dlls with absolute path to NTPD
+  - use 'msyslog()' instead of 'printf() 'for reporting trouble
+* [Bug 3107] Incorrect Logic for Peer Event Limiting <[email protected]>
+  - applied patch by Matthew Van Gundy
+* [Bug 3065] Quiet warnings on NetBSD <[email protected]>
+  - applied some of the patches provided by Havard. Not all of them
+    still match the current code base, and I did not touch libopt.
+* [Bug 3062] Change the process name of forked DNS worker <[email protected]>
+  - applied patch by Reinhard Max. See bugzilla for limitations.
+* [Bug 2923] Trap Configuration Fail <[email protected]>
+  - fixed dependency inversion from [Bug 2837]
+* [Bug 2896] Nothing happens if minsane < maxclock < minclock
+  - produce ERROR log message about dysfunctional daemon. <[email protected]>
+* [Bug 2851] allow -4/-6 on restrict line with mask <[email protected]>
+  - applied patch by Miroslav Lichvar for ntp4.2.6 compat
+* [Bug 2645] out-of-bound pointers in ctl_putsys and decode_bitflags
+  - Fixed these and some more locations of this pattern.
+    Probably din't get them all, though. <[email protected]>
+* Update copyright year.
+
+--
+(4.2.8p9-win) 2017/02/01 Released by Harlan Stenn <[email protected]>
+
+* [Bug 3144] NTP does not build without openSSL. <[email protected]>
+  - added missed changeset for automatic openssl lib detection
+  - fixed some minor warning issues
+* [Bug 3095]  More compatibility with openssl 1.1. <[email protected]>
+* configure.ac cleanup.  [email protected]
+* openssl configure cleanup.  [email protected]
+
+--
+NTP 4.2.8p9 (Harlan Stenn <[email protected]>, 2016/11/21) 
+
+Focus: Security, Bug fixes, enhancements.
+
+Severity: HIGH
+
+In addition to bug fixes and enhancements, this release fixes the
+following 1 high- (Windows only), 2 medium-, 2 medium-/low, and
+5 low-severity vulnerabilities, and provides 28 other non-security
+fixes and improvements:
+
+* Trap crash
+   Date Resolved: 21 November 2016; Dev (4.3.94) 21 November 2016
+   References: Sec 3119 / CVE-2016-9311 / VU#633847
+   Affects: ntp-4.0.90 (21 July 1999), possibly earlier, up to but not
+   	including 4.2.8p9, and ntp-4.3.0 up to but not including ntp-4.3.94.
+   CVSS2: MED 4.9 (AV:N/AC:H/Au:N/C:N/I:N/A:C)
+   CVSS3: MED 4.4 CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
+   Summary: 
+	ntpd does not enable trap service by default. If trap service
+	has been explicitly enabled, an attacker can send a specially
+	crafted packet to cause a null pointer dereference that will
+	crash ntpd, resulting in a denial of service. 
+   Mitigation:
+        Implement BCP-38.
+	Use "restrict default noquery ..." in your ntp.conf file. Only
+	    allow mode 6 queries from trusted networks and hosts. 
+        Upgrade to 4.2.8p9, or later, from the NTP Project Download Page
+	    or the NTP Public Services Project Download Page
+        Properly monitor your ntpd instances, and auto-restart ntpd
+	    (without -g) if it stops running. 
+   Credit: This weakness was discovered by Matthew Van Gundy of Cisco.
+
+* Mode 6 information disclosure and DDoS vector
+   Date Resolved: 21 November 2016; Dev (4.3.94) 21 November 2016
+   References: Sec 3118 / CVE-2016-9310 / VU#633847
+   Affects: ntp-4.0.90 (21 July 1999), possibly earlier, up to but not
+	including 4.2.8p9, and ntp-4.3.0 up to but not including ntp-4.3.94.
+   CVSS2: MED 6.4 (AV:A/AC:L/Au:N/C:N/I:N/A:P)
+   CVSS3: MED 6.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
+   Summary: 
+	An exploitable configuration modification vulnerability exists
+	in the control mode (mode 6) functionality of ntpd. If, against
+	long-standing BCP recommendations, "restrict default noquery ..."
+	is not specified, a specially crafted control mode packet can set
+	ntpd traps, providing information disclosure and DDoS
+	amplification, and unset ntpd traps, disabling legitimate
+	monitoring. A remote, unauthenticated, network attacker can
+	trigger this vulnerability. 
+   Mitigation:
+        Implement BCP-38.
+	Use "restrict default noquery ..." in your ntp.conf file.
+        Upgrade to 4.2.8p9, or later, from the NTP Project Download Page
+	    or the NTP Public Services Project Download Page
+        Properly monitor your ntpd instances, and auto-restart ntpd
+	    (without -g) if it stops running. 
+   Credit: This weakness was discovered by Matthew Van Gundy of Cisco.
+
+* Broadcast Mode Replay Prevention DoS
+   Date Resolved: 21 November 2016; Dev (4.3.94) 21 November 2016
+   References: Sec 3114 / CVE-2016-7427 / VU#633847
+   Affects: ntp-4.2.8p6, up to but not including ntp-4.2.8p9, and 
+	ntp-4.3.90 up to, but not including ntp-4.3.94.
+   CVSS2: LOW 3.3 (AV:A/AC:L/Au:N/C:N/I:N/A:P)
+   CVSS3: MED 4.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
+   Summary: 
+	The broadcast mode of NTP is expected to only be used in a
+	trusted network. If the broadcast network is accessible to an
+	attacker, a potentially exploitable denial of service
+	vulnerability in ntpd's broadcast mode replay prevention
+	functionality can be abused. An attacker with access to the NTP
+	broadcast domain can periodically inject specially crafted
+	broadcast mode NTP packets into the broadcast domain which,
+	while being logged by ntpd, can cause ntpd to reject broadcast
+	mode packets from legitimate NTP broadcast servers. 
+   Mitigation:
+        Implement BCP-38.
+        Upgrade to 4.2.8p9, or later, from the NTP Project Download Page
+	    or the NTP Public Services Project Download Page
+        Properly monitor your ntpd instances, and auto-restart ntpd
+	    (without -g) if it stops running. 
+   Credit: This weakness was discovered by Matthew Van Gundy of Cisco.
+
+* Broadcast Mode Poll Interval Enforcement DoS
+   Date Resolved: 21 November 2016; Dev (4.3.94) 21 November 2016
+   References: Sec 3113 / CVE-2016-7428 / VU#633847
+   Affects: ntp-4.2.8p6, up to but not including ntp-4.2.8p9, and
+	ntp-4.3.90 up to, but not including ntp-4.3.94
+   CVSS2: LOW 3.3 (AV:A/AC:L/Au:N/C:N/I:N/A:P)
+   CVSS3: MED 4.3 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
+   Summary: 
+	The broadcast mode of NTP is expected to only be used in a
+	trusted network. If the broadcast network is accessible to an
+	attacker, a potentially exploitable denial of service
+	vulnerability in ntpd's broadcast mode poll interval enforcement
+	functionality can be abused. To limit abuse, ntpd restricts the
+	rate at which each broadcast association will process incoming
+	packets. ntpd will reject broadcast mode packets that arrive
+	before the poll interval specified in the preceding broadcast
+	packet expires. An attacker with access to the NTP broadcast
+	domain can send specially crafted broadcast mode NTP packets to
+	the broadcast domain which, while being logged by ntpd, will
+	cause ntpd to reject broadcast mode packets from legitimate NTP
+	broadcast servers. 
+   Mitigation:
+        Implement BCP-38.
+        Upgrade to 4.2.8p9, or later, from the NTP Project Download Page
+	    or the NTP Public Services Project Download Page
+        Properly monitor your ntpd instances, and auto-restart ntpd
+	    (without -g) if it stops running. 
+   Credit: This weakness was discovered by Matthew Van Gundy of Cisco.
+
+* Windows: ntpd DoS by oversized UDP packet
+   Date Resolved: 21 November 2016; Dev (4.3.94) 21 November 2016
+   References: Sec 3110 / CVE-2016-9312 / VU#633847
+   Affects Windows only: ntp-4.?.?, up to but not including ntp-4.2.8p9,
+	and ntp-4.3.0 up to, but not including ntp-4.3.94. 
+   CVSS2: HIGH 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)
+   CVSS3: HIGH 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+   Summary: 
+	If a vulnerable instance of ntpd on Windows receives a crafted
+	malicious packet that is "too big", ntpd will stop working. 
+   Mitigation:
+        Implement BCP-38.
+        Upgrade to 4.2.8p9, or later, from the NTP Project Download Page
+	    or the NTP Public Services Project Download Page
+        Properly monitor your ntpd instances, and auto-restart ntpd
+	    (without -g) if it stops running. 
+   Credit: This weakness was discovered by Robert Pajak of ABB.
+
+* 0rigin (zero origin) issues
+   Date Resolved: 21 November 2016; Dev (4.3.94) 21 November 2016
+   References: Sec 3102 / CVE-2016-7431 / VU#633847
+   Affects: ntp-4.2.8p8, and ntp-4.3.93.
+   CVSS2: MED 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
+   CVSS3: MED 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
+   Summary: 
+	Zero Origin timestamp problems were fixed by Bug 2945 in
+	ntp-4.2.8p6. However, subsequent timestamp validation checks
+	introduced a regression in the handling of some Zero origin
+	timestamp checks.
+   Mitigation:
+        Implement BCP-38.
+        Upgrade to 4.2.8p9, or later, from the NTP Project Download Page
+	    or the NTP Public Services Project Download Page
+        Properly monitor your ntpd instances, and auto-restart ntpd
+	    (without -g) if it stops running. 
+   Credit: This weakness was discovered by Sharon Goldberg and Aanchal
+	Malhotra of Boston University.
+
+* read_mru_list() does inadequate incoming packet checks
+   Date Resolved: 21 November 2016; Dev (4.3.94) 21 November 2016
+   References: Sec 3082 / CVE-2016-7434 / VU#633847
+   Affects: ntp-4.2.7p22, up to but not including ntp-4.2.8p9, and
+	ntp-4.3.0 up to, but not including ntp-4.3.94.
+   CVSS2: LOW 3.8 (AV:L/AC:H/Au:S/C:N/I:N/A:C)
+   CVSS3: LOW 3.8 CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H
+   Summary: 
+	If ntpd is configured to allow mrulist query requests from a
+	server that sends a crafted malicious packet, ntpd will crash
+	on receipt of that crafted malicious mrulist query packet.
+   Mitigation:
+	Only allow mrulist query packets from trusted hosts.
+        Implement BCP-38.
+        Upgrade to 4.2.8p9, or later, from the NTP Project Download Page
+	    or the NTP Public Services Project Download Page
+        Properly monitor your ntpd instances, and auto-restart ntpd
+	    (without -g) if it stops running. 
+   Credit: This weakness was discovered by Magnus Stubman.
+
+* Attack on interface selection
+   Date Resolved: 21 November 2016; Dev (4.3.94) 21 November 2016
+   References: Sec 3072 / CVE-2016-7429 / VU#633847
+   Affects: ntp-4.2.7p385, up to but not including ntp-4.2.8p9, and
+	ntp-4.3.0 up to, but not including ntp-4.3.94
+   CVSS2: LOW 1.0 (AV:L/AC:H/Au:S/C:N/I:N/A:P)
+   CVSS3: LOW 1.6 CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:L
+   Summary: 
+	When ntpd receives a server response on a socket that corresponds
+	to a different interface than was used for the request, the peer
+	structure is updated to use the interface for new requests. If
+	ntpd is running on a host with multiple interfaces in separate
+	networks and the operating system doesn't check source address in
+	received packets (e.g. rp_filter on Linux is set to 0), an
+	attacker that knows the address of the source can send a packet
+	with spoofed source address which will cause ntpd to select wrong
+	interface for the source and prevent it from sending new requests
+	until the list of interfaces is refreshed, which happens on
+	routing changes or every 5 minutes by default. If the attack is
+	repeated often enough (once per second), ntpd will not be able to
+	synchronize with the source.
+   Mitigation:
+        Implement BCP-38.
+        Upgrade to 4.2.8p9, or later, from the NTP Project Download Page
+	    or the NTP Public Services Project Download Page
+	If you are going to configure your OS to disable source address
+	    checks, also configure your firewall configuration to control
+	    what interfaces can receive packets from what networks.
+        Properly monitor your ntpd instances, and auto-restart ntpd
+	    (without -g) if it stops running. 
+   Credit: This weakness was discovered by Miroslav Lichvar of Red Hat.
+
+* Client rate limiting and server responses
+   Date Resolved: 21 November 2016; Dev (4.3.94) 21 November 2016
+   References: Sec 3071 / CVE-2016-7426 / VU#633847
+   Affects: ntp-4.2.5p203, up to but not including ntp-4.2.8p9, and
+	ntp-4.3.0 up to, but not including ntp-4.3.94
+   CVSS2: LOW 1.0 (AV:L/AC:H/Au:S/C:N/I:N/A:P)
+   CVSS3: LOW 1.6 CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:L
+   Summary: 
+	When ntpd is configured with rate limiting for all associations
+	(restrict default limited in ntp.conf), the limits are applied
+	also to responses received from its configured sources. An
+	attacker who knows the sources (e.g., from an IPv4 refid in
+	server response) and knows the system is (mis)configured in this
+	way can periodically send packets with spoofed source address to
+	keep the rate limiting activated and prevent ntpd from accepting
+	valid responses from its sources. 
+
+	While this blanket rate limiting can be useful to prevent
+	brute-force attacks on the origin timestamp, it allows this DoS
+	attack. Similarly, it allows the attacker to prevent mobilization
+	of ephemeral associations.  
+   Mitigation:
+        Implement BCP-38.
+        Upgrade to 4.2.8p9, or later, from the NTP Project Download Page
+	    or the NTP Public Services Project Download Page
+        Properly monitor your ntpd instances, and auto-restart ntpd
+	    (without -g) if it stops running. 
+   Credit: This weakness was discovered by Miroslav Lichvar of Red Hat.
+
+* Fix for bug 2085 broke initial sync calculations 
+   Date Resolved: 21 November 2016; Dev (4.3.94) 21 November 2016
+   References: Sec 3067 / CVE-2016-7433 / VU#633847
+   Affects: ntp-4.2.7p385, up to but not including ntp-4.2.8p9, and
+	ntp-4.3.0 up to, but not including ntp-4.3.94. But the
+	root-distance calculation in general is incorrect in all versions
+	of ntp-4 until this release. 
+   CVSS2: LOW 1.2 (AV:L/AC:H/Au:N/C:N/I:N/A:P)
+   CVSS3: LOW 1.6 CVSS:3.0/AV:P/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L
+   Summary: 
+	Bug 2085 described a condition where the root delay was included
+	twice, causing the jitter value to be higher than expected. Due
+	to a misinterpretation of a small-print variable in The Book, the
+	fix for this problem was incorrect, resulting in a root distance
+	that did not include the peer dispersion. The calculations and
+	formulae have been reviewed and reconciled, and the code has been
+	updated accordingly. 
+   Mitigation:
+        Upgrade to 4.2.8p9, or later, from the NTP Project Download Page
+	    or the NTP Public Services Project Download Page
+        Properly monitor your ntpd instances, and auto-restart ntpd
+	    (without -g) if it stops running. 
+   Credit: This weakness was discovered independently by Brian Utterback of
+	Oracle, and Sharon Goldberg and Aanchal Malhotra of Boston University. 
+
+Other fixes:
+
+* [Bug 3142] bug in netmask prefix length detection <[email protected]>
+* [Bug 3138] gpsdjson refclock should honor fudgetime1. [email protected]
+* [Bug 3129] Unknown hosts can put resolver thread into a hard loop
+  - moved retry decision where it belongs. <[email protected]>
+* [Bug 3125] NTPD doesn't fully start when ntp.conf entries are out of order
+  using the loopback-ppsapi-provider.dll <[email protected]>
+* [Bug 3116] unit tests for NTP time stamp expansion. <[email protected]>
+* [Bug 3100] ntpq can't retrieve daemon_version <[email protected]>
+  - fixed extended sysvar lookup (bug introduced with bug 3008 fix)
+* [Bug 3095] Compatibility with openssl 1.1 <[email protected]>
+  - applied patches by Kurt Roeckx <[email protected]> to source
+  - added shim layer for SSL API calls with issues (both directions)
+* [Bug 3089] Serial Parser does not work anymore for hopfser like device
+  - simplified / refactored hex-decoding in driver. <[email protected]>
+* [Bug 3084] update-leap mis-parses the leapfile name.  HStenn.
+* [Bug 3068] Linker warnings when building on Solaris. [email protected]
+  - applied patch thanks to Andrew Stormont <[email protected]>
+* [Bug 3067] Root distance calculation needs improvement.  HStenn
+* [Bug 3066] NMEA clock ignores pps. [email protected]
+  - PPS-HACK works again.
+* [Bug 3059] Potential buffer overrun from oversized hash <[email protected]>
+  - applied patch by Brian Utterback <[email protected]>
+* [Bug 3053] ntp_loopfilter.c frequency calc precedence error.  Sarah White.
+* [Bug 3050] Fix for bug #2960 causes [...] spurious error message.
+  <[email protected]>
+  - patches by Reinhard Max <[email protected]> and Havard Eidnes <[email protected]>
+* [Bug 3047] Fix refclock_jjy C-DEX JST2000. [email protected]
+  - Patch provided by Kuramatsu.
+* [Bug 3021] unity_fixture.c needs pragma weak <[email protected]>
+  - removed unnecessary & harmful decls of 'setUp()' & 'tearDown()'
+* [Bug 3019] Windows: ERROR_HOST_UNREACHABLE block packet processing. DMayer
+* [Bug 2998] sntp/tests/packetProcessing.c broken without openssl. JPerlinger
+* [Bug 2961] sntp/tests/packetProcessing.c assumes AUTOKEY.  HStenn.
+* [Bug 2959] refclock_jupiter: gps week correction <[email protected]>
+  - fixed GPS week expansion to work based on build date. Special thanks
+    to Craig Leres for initial patch and testing.
+* [Bug 2951] ntpd tests fail: multiple definition of `send_via_ntp_signd'
+  - fixed Makefile.am <[email protected]>
+* [Bug 2689] ATOM driver processes last PPS pulse at startup,
+             even if it is very old <[email protected]>
+  - make sure PPS source is alive before processing samples
+  - improve stability close to the 500ms phase jump (phase gate)
+* Fix typos in include/ntp.h.
+* Shim X509_get_signature_nid() if needed
+* git author attribution cleanup
+* bk ignore file cleanup
+* remove locks in Windows IO, use rpc-like thread synchronisation instead
+
 ---
 NTP 4.2.8p8 (Harlan Stenn <[email protected]>, 2016/06/02) 

@@ -1347,6 +1347,7 @@ m4_include([sntp/m4/ntp_debug.m4])
 m4_include([sntp/m4/ntp_dir_sep.m4])
 m4_include([sntp/m4/ntp_facilitynames.m4])
 m4_include([sntp/m4/ntp_googletest.m4])
+m4_include([sntp/m4/ntp_harden.m4])
 m4_include([sntp/m4/ntp_ipv6.m4])
 m4_include([sntp/m4/ntp_lib_m.m4])
 m4_include([sntp/m4/ntp_libevent.m4])
@@ -8,12 +8,15 @@ BUILT_SOURCES =
 CLEANFILES =
 EXTRA_PROGRAMS = adjtimed

-AM_CFLAGS = $(CFLAGS_NTP)
+AM_CFLAGS  = $(CFLAGS_NTP)
+AM_CFLAGS += $(NTP_HARD_CFLAGS)

 AM_CPPFLAGS  = $(NTP_INCS)
 AM_CPPFLAGS += $(CPPFLAGS_NTP)
+AM_CPPFLAGS += $(NTP_HARD_CPPFLAGS)

 LDADD = ../libntp/libntp.a $(LDADD_LIBNTP) $(LIBM) $(PTHREAD_LIBS)
+AM_LDFLAGS = $(NTP_HARD_LDFLAGS)

 include $(top_srcdir)/bincheck.mf
 include $(top_srcdir)/sntp/check-libntp.mf
@@ -116,6 +116,7 @@ am__aclocal_m4_deps = $(top_srcdir)/sntp/libopts/m4/libopts.m4 \
 	$(top_srcdir)/sntp/m4/ntp_dir_sep.m4 \
 	$(top_srcdir)/sntp/m4/ntp_facilitynames.m4 \
 	$(top_srcdir)/sntp/m4/ntp_googletest.m4 \
+	$(top_srcdir)/sntp/m4/ntp_harden.m4 \
 	$(top_srcdir)/sntp/m4/ntp_ipv6.m4 \
 	$(top_srcdir)/sntp/m4/ntp_lib_m.m4 \
 	$(top_srcdir)/sntp/m4/ntp_libevent.m4 \
@@ -247,10 +248,6 @@ CPP = @CPP@
 CPPFLAGS = @CPPFLAGS@
 CPPFLAGS_LIBEVENT = @CPPFLAGS_LIBEVENT@
 CPPFLAGS_NTP = @CPPFLAGS_NTP@
-CXX = @CXX@
-CXXCPP = @CXXCPP@
-CXXDEPMODE = @CXXDEPMODE@
-CXXFLAGS = @CXXFLAGS@
 CYGPATH_W = @CYGPATH_W@
 DCFD = @DCFD@
 DEFS = @DEFS@
@@ -303,6 +300,7 @@ LN_S = @LN_S@
 LSCF = @LSCF@
 LTHREAD_LIBS = @LTHREAD_LIBS@
 LTLIBOBJS = @LTLIBOBJS@
+LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
 MAKEINFO = @MAKEINFO@
 MAKE_ADJTIMED = @MAKE_ADJTIMED@
 MAKE_CHECK_LAYOUT = @MAKE_CHECK_LAYOUT@
@@ -366,6 +364,9 @@ NTPTRACE_DL = @NTPTRACE_DL@
 NTPTRACE_DS = @NTPTRACE_DS@
 NTPTRACE_MS = @NTPTRACE_MS@
 NTPTRACE_NI = @NTPTRACE_NI@
+NTP_HARD_CFLAGS = @NTP_HARD_CFLAGS@
+NTP_HARD_CPPFLAGS = @NTP_HARD_CPPFLAGS@
+NTP_HARD_LDFLAGS = @NTP_HARD_LDFLAGS@
 NTP_KEYGEN_DB = @NTP_KEYGEN_DB@
 NTP_KEYGEN_DL = @NTP_KEYGEN_DL@
 NTP_KEYGEN_DS = @NTP_KEYGEN_DS@
@@ -439,7 +440,6 @@ abs_top_builddir = @abs_top_builddir@
 abs_top_srcdir = @abs_top_srcdir@
 ac_ct_AR = @ac_ct_AR@
 ac_ct_CC = @ac_ct_CC@
-ac_ct_CXX = @ac_ct_CXX@
 ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
 am__include = @am__include@
 am__leading_dot = @am__leading_dot@
@@ -489,9 +489,10 @@ top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
 BUILT_SOURCES = check-libntp .deps-ver
 CLEANFILES = check-libntp .deps-ver
-AM_CFLAGS = $(CFLAGS_NTP)
-AM_CPPFLAGS = $(NTP_INCS) $(CPPFLAGS_NTP)
+AM_CFLAGS = $(CFLAGS_NTP) $(NTP_HARD_CFLAGS)
+AM_CPPFLAGS = $(NTP_INCS) $(CPPFLAGS_NTP) $(NTP_HARD_CPPFLAGS)
 LDADD = ../libntp/libntp.a $(LDADD_LIBNTP) $(LIBM) $(PTHREAD_LIBS)
+AM_LDFLAGS = $(NTP_HARD_LDFLAGS)
 NTP_INCS = -I$(top_srcdir)/include -I$(top_srcdir)/lib/isc/include \
 	-I$(top_srcdir)/lib/isc/$(LIBISC_PTHREADS_NOTHREADS)/include \
 	-I$(top_srcdir)/lib/isc/unix/include
@@ -2,11 +2,14 @@ noinst_PROGRAMS = @PROPDELAY@ @CHUTEST@
 EXTRA_PROGRAMS = propdelay chutest

 AM_CFLAGS = $(CFLAGS_NTP)
+AM_CFLAGS += $(NTP_HARD_CFLAGS)

 AM_CPPFLAGS  = $(NTP_INCS)
 AM_CPPFLAGS += $(CPPFLAGS_NTP)
+AM_CPPFLAGS += $(NTP_HARD_CPPFLAGS)

 LDADD = ../libntp/libntp.a $(LDADD_LIBNTP) $(LIBM) $(PTHREAD_LIBS)
+AM_LDFLAGS = $(NTP_HARD_LDFLAGS)
 propdelay_LDADD = $(LDADD)

 BUILT_SOURCES =
@@ -109,6 +109,7 @@ am__aclocal_m4_deps = $(top_srcdir)/sntp/libopts/m4/libopts.m4 \
 	$(top_srcdir)/sntp/m4/ntp_dir_sep.m4 \
 	$(top_srcdir)/sntp/m4/ntp_facilitynames.m4 \
 	$(top_srcdir)/sntp/m4/ntp_googletest.m4 \
+	$(top_srcdir)/sntp/m4/ntp_harden.m4 \
 	$(top_srcdir)/sntp/m4/ntp_ipv6.m4 \
 	$(top_srcdir)/sntp/m4/ntp_lib_m.m4 \
 	$(top_srcdir)/sntp/m4/ntp_libevent.m4 \
@@ -242,10 +243,6 @@ CPP = @CPP@
 CPPFLAGS = @CPPFLAGS@
 CPPFLAGS_LIBEVENT = @CPPFLAGS_LIBEVENT@
 CPPFLAGS_NTP = @CPPFLAGS_NTP@
-CXX = @CXX@
-CXXCPP = @CXXCPP@
-CXXDEPMODE = @CXXDEPMODE@
-CXXFLAGS = @CXXFLAGS@
 CYGPATH_W = @CYGPATH_W@
 DCFD = @DCFD@
 DEFS = @DEFS@
@@ -298,6 +295,7 @@ LN_S = @LN_S@
 LSCF = @LSCF@
 LTHREAD_LIBS = @LTHREAD_LIBS@
 LTLIBOBJS = @LTLIBOBJS@
+LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
 MAKEINFO = @MAKEINFO@
 MAKE_ADJTIMED = @MAKE_ADJTIMED@
 MAKE_CHECK_LAYOUT = @MAKE_CHECK_LAYOUT@
@@ -361,6 +359,9 @@ NTPTRACE_DL = @NTPTRACE_DL@
 NTPTRACE_DS = @NTPTRACE_DS@
 NTPTRACE_MS = @NTPTRACE_MS@
 NTPTRACE_NI = @NTPTRACE_NI@
+NTP_HARD_CFLAGS = @NTP_HARD_CFLAGS@
+NTP_HARD_CPPFLAGS = @NTP_HARD_CPPFLAGS@
+NTP_HARD_LDFLAGS = @NTP_HARD_LDFLAGS@
 NTP_KEYGEN_DB = @NTP_KEYGEN_DB@
 NTP_KEYGEN_DL = @NTP_KEYGEN_DL@
 NTP_KEYGEN_DS = @NTP_KEYGEN_DS@
@@ -434,7 +435,6 @@ abs_top_builddir = @abs_top_builddir@
 abs_top_srcdir = @abs_top_srcdir@
 ac_ct_AR = @ac_ct_AR@
 ac_ct_CC = @ac_ct_CC@
-ac_ct_CXX = @ac_ct_CXX@
 ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
 am__include = @am__include@
 am__leading_dot = @am__leading_dot@
@@ -483,9 +483,10 @@ top_build_prefix = @top_build_prefix@
 top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
 noinst_PROGRAMS = @PROPDELAY@ @CHUTEST@
-AM_CFLAGS = $(CFLAGS_NTP)
-AM_CPPFLAGS = $(NTP_INCS) $(CPPFLAGS_NTP)
+AM_CFLAGS = $(CFLAGS_NTP) $(NTP_HARD_CFLAGS)
+AM_CPPFLAGS = $(NTP_INCS) $(CPPFLAGS_NTP) $(NTP_HARD_CPPFLAGS)
 LDADD = ../libntp/libntp.a $(LDADD_LIBNTP) $(LIBM) $(PTHREAD_LIBS)
+AM_LDFLAGS = $(NTP_HARD_LDFLAGS)
 propdelay_LDADD = $(LDADD)
 BUILT_SOURCES = check-libntp .deps-ver
 CLEANFILES = check-libntp .deps-ver
@@ -1,142 +0,0 @@
-#! /bin/sh
-# Wrapper for compilers which do not understand `-c -o'.
-
-scriptversion=2005-05-14.22
-
-# Copyright (C) 1999, 2000, 2003, 2004, 2005 Free Software Foundation, Inc.
-# Written by Tom Tromey <[email protected]>.
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2, or (at your option)
-# any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-
-# As a special exception to the GNU General Public License, if you
-# distribute this file as part of a program that contains a
-# configuration script generated by Autoconf, you may include it under
-# the same distribution terms that you use for the rest of that program.
-
-# This file is maintained in Automake, please report
-# bugs to <[email protected]> or send patches to
-# <[email protected]>.
-
-case $1 in
-  '')
-     echo "$0: No command.  Try \`$0 --help' for more information." 1>&2
-     exit 1;
-     ;;
-  -h | --h*)
-    cat <<\EOF
-Usage: compile [--help] [--version] PROGRAM [ARGS]
-
-Wrapper for compilers which do not understand `-c -o'.
-Remove `-o dest.o' from ARGS, run PROGRAM with the remaining
-arguments, and rename the output as expected.
-
-If you are trying to build a whole package this is not the
-right script to run: please start by reading the file `INSTALL'.
-
-Report bugs to <[email protected]>.
-EOF
-    exit $?
-    ;;
-  -v | --v*)
-    echo "compile $scriptversion"
-    exit $?
-    ;;
-esac
-
-ofile=
-cfile=
-eat=
-
-for arg
-do
-  if test -n "$eat"; then
-    eat=
-  else
-    case $1 in
-      -o)
-	# configure might choose to run compile as `compile cc -o foo foo.c'.
-	# So we strip `-o arg' only if arg is an object.
-	eat=1
-	case $2 in
-	  *.o | *.obj)
-	    ofile=$2
-	    ;;
-	  *)
-	    set x "$@" -o "$2"
-	    shift
-	    ;;
-	esac
-	;;
-      *.c)
-	cfile=$1
-	set x "$@" "$1"
-	shift
-	;;
-      *)
-	set x "$@" "$1"
-	shift
-	;;
-    esac
-  fi
-  shift
-done
-
-if test -z "$ofile" || test -z "$cfile"; then
-  # If no `-o' option was seen then we might have been invoked from a
-  # pattern rule where we don't need one.  That is ok -- this is a
-  # normal compilation that the losing compiler can handle.  If no
-  # `.c' file was seen then we are probably linking.  That is also
-  # ok.
-  exec "$@"
-fi
-
-# Name of file we expect compiler to create.
-cofile=`echo "$cfile" | sed -e 's|^.*/||' -e 's/\.c$/.o/'`
-
-# Create the lock directory.
-# Note: use `[/.-]' here to ensure that we don't use the same name
-# that we are using for the .o file.  Also, base the name on the expected
-# object file name, since that is what matters with a parallel build.
-lockdir=`echo "$cofile" | sed -e 's|[/.-]|_|g'`.d
-while true; do
-  if mkdir "$lockdir" >/dev/null 2>&1; then
-    break
-  fi
-  sleep 1
-done
-# FIXME: race condition here if user kills between mkdir and trap.
-trap "rmdir '$lockdir'; exit 1" 1 2 15
-
-# Run the compile.
-"$@"
-ret=$?
-
-if test -f "$cofile"; then
-  mv "$cofile" "$ofile"
-elif test -f "${cofile}bj"; then
-  mv "${cofile}bj" "$ofile"
-fi
-
-rmdir "$lockdir"
-exit $ret
-
-# Local Variables:
-# mode: shell-script
-# sh-indentation: 2
-# eval: (add-hook 'write-file-hooks 'time-stamp)
-# time-stamp-start: "scriptversion="
-# time-stamp-format: "%:y-%02m-%02d.%02H"
-# time-stamp-end: "$"
-# End:
@@ -1342,8 +1342,7 @@
 /* Should we align with the NIST lockclock scheme? */
 #undef LOCKCLOCK

-/* Define to the sub-directory in which libtool stores uninstalled libraries.
-   */
+/* Define to the sub-directory where libtool stores uninstalled libraries. */
 #undef LT_OBJDIR

 /* Does the target support multicast IP? */
@@ -1395,9 +1394,6 @@
 /* Should we NOT read /dev/kmem? */
 #undef NOKMEM

-/* Define to 1 if your C compiler doesn't accept -c and -o together. */
-#undef NO_MINUS_C_MINUS_O
-
 /* Should we avoid #warning on option name collisions? */
 #undef NO_OPTION_NAME_WARNINGS

@@ -65,13 +65,16 @@ ntp_ripe_ncc_ok=${ntp_parse_ok=no}
 ntp_jupiter_ok=${ntp_jupiter_ok=no}

 NTP_PROG_CC
-AC_PROG_CPP
-# Do we need CXX for anything besides google test?
-AC_PROG_CXX
+NTP_COMPILER
+
+dnl # Do we need CXX for anything besides google test?
+dnl AC_PROG_CXX
 AC_PROG_YACC
-AC_PROG_CC_C_O
+dnl AC_PROG_CC_C_O 	# called by NTP_COMPILER
 AX_C99_STRUCT_INIT

+NTP_HARDEN([sntp])
+
 NTP_VPATH_HACK		dnl used only by ntpd/Makefile.am

 NTP_LOCINFO([sntp])	dnl takes over from NTP_BINDIR, in NTP_LIBNTP
@@ -169,7 +172,6 @@ case "$ans" in
    ;;
 esac
 PROG_NET_SNMP_CONFIG=$ans
-AC_MSG_CHECKING([for net-snmp-config path])
 case "$PROG_NET_SNMP_CONFIG" in
 no) ;;
 /*)
@@ -180,6 +182,7 @@ case "$PROG_NET_SNMP_CONFIG" in
    AS_UNSET([ac_cv_path_PATH_NET_SNMP_CONFIG])
 ;;
 esac
+AC_MSG_CHECKING([for net-snmp-config path])
 AC_MSG_RESULT([$PATH_NET_SNMP_CONFIG])

 case "$PATH_NET_SNMP_CONFIG" in
@@ -1,530 +0,0 @@
-#! /bin/sh
-# depcomp - compile a program generating dependencies as side-effects
-
-scriptversion=2005-07-09.11
-
-# Copyright (C) 1999, 2000, 2003, 2004, 2005 Free Software Foundation, Inc.
-
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2, or (at your option)
-# any later version.
-
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-
-# You should have received a copy of the GNU General Public License
-# along with this program; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
-# 02110-1301, USA.
-
-# As a special exception to the GNU General Public License, if you
-# distribute this file as part of a program that contains a
-# configuration script generated by Autoconf, you may include it under
-# the same distribution terms that you use for the rest of that program.
-
-# Originally written by Alexandre Oliva <[email protected]>.
-
-case $1 in
-  '')
-     echo "$0: No command.  Try \`$0 --help' for more information." 1>&2
-     exit 1;
-     ;;
-  -h | --h*)
-    cat <<\EOF
-Usage: depcomp [--help] [--version] PROGRAM [ARGS]
-
-Run PROGRAMS ARGS to compile a file, generating dependencies
-as side-effects.
-
-Environment variables:
-  depmode     Dependency tracking mode.
-  source      Source file read by `PROGRAMS ARGS'.
-  object      Object file output by `PROGRAMS ARGS'.
-  DEPDIR      directory where to store dependencies.
-  depfile     Dependency file to output.
-  tmpdepfile  Temporary file to use when outputing dependencies.
-  libtool     Whether libtool is used (yes/no).
-
-Report bugs to <[email protected]>.
-EOF
-    exit $?
-    ;;
-  -v | --v*)
-    echo "depcomp $scriptversion"
-    exit $?
-    ;;
-esac
-
-if test -z "$depmode" || test -z "$source" || test -z "$object"; then
-  echo "depcomp: Variables source, object and depmode must be set" 1>&2
-  exit 1
-fi
-
-# Dependencies for sub/bar.o or sub/bar.obj go into sub/.deps/bar.Po.
-depfile=${depfile-`echo "$object" |
-  sed 's|[^\\/]*$|'${DEPDIR-.deps}'/&|;s|\.\([^.]*\)$|.P\1|;s|Pobj$|Po|'`}
-tmpdepfile=${tmpdepfile-`echo "$depfile" | sed 's/\.\([^.]*\)$/.T\1/'`}
-
-rm -f "$tmpdepfile"
-
-# Some modes work just like other modes, but use different flags.  We
-# parameterize here, but still list the modes in the big case below,
-# to make depend.m4 easier to write.  Note that we *cannot* use a case
-# here, because this file can only contain one case statement.
-if test "$depmode" = hp; then
-  # HP compiler uses -M and no extra arg.
-  gccflag=-M
-  depmode=gcc
-fi
-
-if test "$depmode" = dashXmstdout; then
-   # This is just like dashmstdout with a different argument.
-   dashmflag=-xM
-   depmode=dashmstdout
-fi
-
-case "$depmode" in
-gcc3)
-## gcc 3 implements dependency tracking that does exactly what
-## we want.  Yay!  Note: for some reason libtool 1.4 doesn't like
-## it if -MD -MP comes after the -MF stuff.  Hmm.
-  "$@" -MT "$object" -MD -MP -MF "$tmpdepfile"
-  stat=$?
-  if test $stat -eq 0; then :
-  else
-    rm -f "$tmpdepfile"
-    exit $stat
-  fi
-  mv "$tmpdepfile" "$depfile"
-  ;;
-
-gcc)
-## There are various ways to get dependency output from gcc.  Here's
-## why we pick this rather obscure method:
-## - Don't want to use -MD because we'd like the dependencies to end
-##   up in a subdir.  Having to rename by hand is ugly.
-##   (We might end up doing this anyway to support other compilers.)
-## - The DEPENDENCIES_OUTPUT environment variable makes gcc act like
-##   -MM, not -M (despite what the docs say).
-## - Using -M directly means running the compiler twice (even worse
-##   than renaming).
-  if test -z "$gccflag"; then
-    gccflag=-MD,
-  fi
-  "$@" -Wp,"$gccflag$tmpdepfile"
-  stat=$?
-  if test $stat -eq 0; then :
-  else
-    rm -f "$tmpdepfile"
-    exit $stat
-  fi
-  rm -f "$depfile"
-  echo "$object : \\" > "$depfile"
-  alpha=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
-## The second -e expression handles DOS-style file names with drive letters.
-  sed -e 's/^[^:]*: / /' \
-      -e 's/^['$alpha']:\/[^:]*: / /' < "$tmpdepfile" >> "$depfile"
-## This next piece of magic avoids the `deleted header file' problem.
-## The problem is that when a header file which appears in a .P file
-## is deleted, the dependency causes make to die (because there is
-## typically no way to rebuild the header).  We avoid this by adding
-## dummy dependencies for each header file.  Too bad gcc doesn't do
-## this for us directly.
-  tr ' ' '
-' < "$tmpdepfile" |
-## Some versions of gcc put a space before the `:'.  On the theory
-## that the space means something, we add a space to the output as
-## well.
-## Some versions of the HPUX 10.20 sed can't process this invocation
-## correctly.  Breaking it into two sed invocations is a workaround.
-    sed -e 's/^\\$//' -e '/^$/d' -e '/:$/d' | sed -e 's/$/ :/' >> "$depfile"
-  rm -f "$tmpdepfile"
-  ;;
-
-hp)
-  # This case exists only to let depend.m4 do its work.  It works by
-  # looking at the text of this script.  This case will never be run,
-  # since it is checked for above.
-  exit 1
-  ;;
-
-sgi)
-  if test "$libtool" = yes; then
-    "$@" "-Wp,-MDupdate,$tmpdepfile"
-  else
-    "$@" -MDupdate "$tmpdepfile"
-  fi
-  stat=$?
-  if test $stat -eq 0; then :
-  else
-    rm -f "$tmpdepfile"
-    exit $stat
-  fi
-  rm -f "$depfile"
-
-  if test -f "$tmpdepfile"; then  # yes, the sourcefile depend on other files
-    echo "$object : \\" > "$depfile"
-
-    # Clip off the initial element (the dependent).  Don't try to be
-    # clever and replace this with sed code, as IRIX sed won't handle
-    # lines with more than a fixed number of characters (4096 in
-    # IRIX 6.2 sed, 8192 in IRIX 6.5).  We also remove comment lines;
-    # the IRIX cc adds comments like `#:fec' to the end of the
-    # dependency line.
-    tr ' ' '
-' < "$tmpdepfile" \
-    | sed -e 's/^.*\.o://' -e 's/#.*$//' -e '/^$/ d' | \
-    tr '
-' ' ' >> $depfile
-    echo >> $depfile
-
-    # The second pass generates a dummy entry for each header file.
-    tr ' ' '
-' < "$tmpdepfile" \
-   | sed -e 's/^.*\.o://' -e 's/#.*$//' -e '/^$/ d' -e 's/$/:/' \
-   >> $depfile
-  else
-    # The sourcefile does not contain any dependencies, so just
-    # store a dummy comment line, to avoid errors with the Makefile
-    # "include basename.Plo" scheme.
-    echo "#dummy" > "$depfile"
-  fi
-  rm -f "$tmpdepfile"
-  ;;
-
-aix)
-  # The C for AIX Compiler uses -M and outputs the dependencies
-  # in a .u file.  In older versions, this file always lives in the
-  # current directory.  Also, the AIX compiler puts `$object:' at the
-  # start of each line; $object doesn't have directory information.
-  # Version 6 uses the directory in both cases.
-  stripped=`echo "$object" | sed 's/\(.*\)\..*$/\1/'`
-  tmpdepfile="$stripped.u"
-  if test "$libtool" = yes; then
-    "$@" -Wc,-M
-  else
-    "$@" -M
-  fi
-  stat=$?
-
-  if test -f "$tmpdepfile"; then :
-  else
-    stripped=`echo "$stripped" | sed 's,^.*/,,'`
-    tmpdepfile="$stripped.u"
-  fi
-
-  if test $stat -eq 0; then :
-  else
-    rm -f "$tmpdepfile"
-    exit $stat
-  fi
-
-  if test -f "$tmpdepfile"; then
-    outname="$stripped.o"
-    # Each line is of the form `foo.o: dependent.h'.
-    # Do two passes, one to just change these to
-    # `$object: dependent.h' and one to simply `dependent.h:'.
-    sed -e "s,^$outname:,$object :," < "$tmpdepfile" > "$depfile"
-    sed -e "s,^$outname: \(.*\)$,\1:," < "$tmpdepfile" >> "$depfile"
-  else
-    # The sourcefile does not contain any dependencies, so just
-    # store a dummy comment line, to avoid errors with the Makefile
-    # "include basename.Plo" scheme.
-    echo "#dummy" > "$depfile"
-  fi
-  rm -f "$tmpdepfile"
-  ;;
-
-icc)
-  # Intel's C compiler understands `-MD -MF file'.  However on
-  #    icc -MD -MF foo.d -c -o sub/foo.o sub/foo.c
-  # ICC 7.0 will fill foo.d with something like
-  #    foo.o: sub/foo.c
-  #    foo.o: sub/foo.h
-  # which is wrong.  We want:
-  #    sub/foo.o: sub/foo.c
-  #    sub/foo.o: sub/foo.h
-  #    sub/foo.c:
-  #    sub/foo.h:
-  # ICC 7.1 will output
-  #    foo.o: sub/foo.c sub/foo.h
-  # and will wrap long lines using \ :
-  #    foo.o: sub/foo.c ... \
-  #     sub/foo.h ... \
-  #     ...
-
-  "$@" -MD -MF "$tmpdepfile"
-  stat=$?
-  if test $stat -eq 0; then :
-  else
-    rm -f "$tmpdepfile"
-    exit $stat
-  fi
-  rm -f "$depfile"
-  # Each line is of the form `foo.o: dependent.h',
-  # or `foo.o: dep1.h dep2.h \', or ` dep3.h dep4.h \'.
-  # Do two passes, one to just change these to
-  # `$object: dependent.h' and one to simply `dependent.h:'.
-  sed "s,^[^:]*:,$object :," < "$tmpdepfile" > "$depfile"
-  # Some versions of the HPUX 10.20 sed can't process this invocation
-  # correctly.  Breaking it into two sed invocations is a workaround.
-  sed 's,^[^:]*: \(.*\)$,\1,;s/^\\$//;/^$/d;/:$/d' < "$tmpdepfile" |
-    sed -e 's/$/ :/' >> "$depfile"
-  rm -f "$tmpdepfile"
-  ;;
-
-tru64)
-   # The Tru64 compiler uses -MD to generate dependencies as a side
-   # effect.  `cc -MD -o foo.o ...' puts the dependencies into `foo.o.d'.
-   # At least on Alpha/Redhat 6.1, Compaq CCC V6.2-504 seems to put
-   # dependencies in `foo.d' instead, so we check for that too.
-   # Subdirectories are respected.
-   dir=`echo "$object" | sed -e 's|/[^/]*$|/|'`
-   test "x$dir" = "x$object" && dir=
-   base=`echo "$object" | sed -e 's|^.*/||' -e 's/\.o$//' -e 's/\.lo$//'`
-
-   if test "$libtool" = yes; then
-      # With Tru64 cc, shared objects can also be used to make a
-      # static library.  This mecanism is used in libtool 1.4 series to
-      # handle both shared and static libraries in a single compilation.
-      # With libtool 1.4, dependencies were output in $dir.libs/$base.lo.d.
-      #
-      # With libtool 1.5 this exception was removed, and libtool now
-      # generates 2 separate objects for the 2 libraries.  These two
-      # compilations output dependencies in in $dir.libs/$base.o.d and
-      # in $dir$base.o.d.  We have to check for both files, because
-      # one of the two compilations can be disabled.  We should prefer
-      # $dir$base.o.d over $dir.libs/$base.o.d because the latter is
-      # automatically cleaned when .libs/ is deleted, while ignoring
-      # the former would cause a distcleancheck panic.
-      tmpdepfile1=$dir.libs/$base.lo.d   # libtool 1.4
-      tmpdepfile2=$dir$base.o.d          # libtool 1.5
-      tmpdepfile3=$dir.libs/$base.o.d    # libtool 1.5
-      tmpdepfile4=$dir.libs/$base.d      # Compaq CCC V6.2-504
-      "$@" -Wc,-MD
-   else
-      tmpdepfile1=$dir$base.o.d
-      tmpdepfile2=$dir$base.d
-      tmpdepfile3=$dir$base.d
-      tmpdepfile4=$dir$base.d
-      "$@" -MD
-   fi
-
-   stat=$?
-   if test $stat -eq 0; then :
-   else
-      rm -f "$tmpdepfile1" "$tmpdepfile2" "$tmpdepfile3" "$tmpdepfile4"
-      exit $stat
-   fi
-
-   for tmpdepfile in "$tmpdepfile1" "$tmpdepfile2" "$tmpdepfile3" "$tmpdepfile4"
-   do
-     test -f "$tmpdepfile" && break
-   done
-   if test -f "$tmpdepfile"; then
-      sed -e "s,^.*\.[a-z]*:,$object:," < "$tmpdepfile" > "$depfile"
-      # That's a tab and a space in the [].
-      sed -e 's,^.*\.[a-z]*:[	 ]*,,' -e 's,$,:,' < "$tmpdepfile" >> "$depfile"
-   else
-      echo "#dummy" > "$depfile"
-   fi
-   rm -f "$tmpdepfile"
-   ;;
-
-#nosideeffect)
-  # This comment above is used by automake to tell side-effect
-  # dependency tracking mechanisms from slower ones.
-
-dashmstdout)
-  # Important note: in order to support this mode, a compiler *must*
-  # always write the preprocessed file to stdout, regardless of -o.
-  "$@" || exit $?
-
-  # Remove the call to Libtool.
-  if test "$libtool" = yes; then
-    while test $1 != '--mode=compile'; do
-      shift
-    done
-    shift
-  fi
-
-  # Remove `-o $object'.
-  IFS=" "
-  for arg
-  do
-    case $arg in
-    -o)
-      shift
-      ;;
-    $object)
-      shift
-      ;;
-    *)
-      set fnord "$@" "$arg"
-      shift # fnord
-      shift # $arg
-      ;;
-    esac
-  done
-
-  test -z "$dashmflag" && dashmflag=-M
-  # Require at least two characters before searching for `:'
-  # in the target name.  This is to cope with DOS-style filenames:
-  # a dependency such as `c:/foo/bar' could be seen as target `c' otherwise.
-  "$@" $dashmflag |
-    sed 's:^[  ]*[^: ][^:][^:]*\:[    ]*:'"$object"'\: :' > "$tmpdepfile"
-  rm -f "$depfile"
-  cat < "$tmpdepfile" > "$depfile"
-  tr ' ' '
-' < "$tmpdepfile" | \
-## Some versions of the HPUX 10.20 sed can't process this invocation
-## correctly.  Breaking it into two sed invocations is a workaround.
-    sed -e 's/^\\$//' -e '/^$/d' -e '/:$/d' | sed -e 's/$/ :/' >> "$depfile"
-  rm -f "$tmpdepfile"
-  ;;
-
-dashXmstdout)
-  # This case only exists to satisfy depend.m4.  It is never actually
-  # run, as this mode is specially recognized in the preamble.
-  exit 1
-  ;;
-
-makedepend)
-  "$@" || exit $?
-  # Remove any Libtool call
-  if test "$libtool" = yes; then
-    while test $1 != '--mode=compile'; do
-      shift
-    done
-    shift
-  fi
-  # X makedepend
-  shift
-  cleared=no
-  for arg in "$@"; do
-    case $cleared in
-    no)
-      set ""; shift
-      cleared=yes ;;
-    esac
-    case "$arg" in
-    -D*|-I*)
-      set fnord "$@" "$arg"; shift ;;
-    # Strip any option that makedepend may not understand.  Remove
-    # the object too, otherwise makedepend will parse it as a source file.
-    -*|$object)
-      ;;
-    *)
-      set fnord "$@" "$arg"; shift ;;
-    esac
-  done
-  obj_suffix="`echo $object | sed 's/^.*\././'`"
-  touch "$tmpdepfile"
-  ${MAKEDEPEND-makedepend} -o"$obj_suffix" -f"$tmpdepfile" "$@"
-  rm -f "$depfile"
-  cat < "$tmpdepfile" > "$depfile"
-  sed '1,2d' "$tmpdepfile" | tr ' ' '
-' | \
-## Some versions of the HPUX 10.20 sed can't process this invocation
-## correctly.  Breaking it into two sed invocations is a workaround.
-    sed -e 's/^\\$//' -e '/^$/d' -e '/:$/d' | sed -e 's/$/ :/' >> "$depfile"
-  rm -f "$tmpdepfile" "$tmpdepfile".bak
-  ;;
-
-cpp)
-  # Important note: in order to support this mode, a compiler *must*
-  # always write the preprocessed file to stdout.
-  "$@" || exit $?
-
-  # Remove the call to Libtool.
-  if test "$libtool" = yes; then
-    while test $1 != '--mode=compile'; do
-      shift
-    done
-    shift
-  fi
-
-  # Remove `-o $object'.
-  IFS=" "
-  for arg
-  do
-    case $arg in
-    -o)
-      shift
-      ;;
-    $object)
-      shift
-      ;;
-    *)
-      set fnord "$@" "$arg"
-      shift # fnord
-      shift # $arg
-      ;;
-    esac
-  done
-
-  "$@" -E |
-    sed -n -e '/^# [0-9][0-9]* "\([^"]*\)".*/ s:: \1 \\:p' \
-       -e '/^#line [0-9][0-9]* "\([^"]*\)".*/ s:: \1 \\:p' |
-    sed '$ s: \\$::' > "$tmpdepfile"
-  rm -f "$depfile"
-  echo "$object : \\" > "$depfile"
-  cat < "$tmpdepfile" >> "$depfile"
-  sed < "$tmpdepfile" '/^$/d;s/^ //;s/ \\$//;s/$/ :/' >> "$depfile"
-  rm -f "$tmpdepfile"
-  ;;
-
-msvisualcpp)
-  # Important note: in order to support this mode, a compiler *must*
-  # always write the preprocessed file to stdout, regardless of -o,
-  # because we must use -o when running libtool.
-  "$@" || exit $?
-  IFS=" "
-  for arg
-  do
-    case "$arg" in
-    "-Gm"|"/Gm"|"-Gi"|"/Gi"|"-ZI"|"/ZI")
-	set fnord "$@"
-	shift
-	shift
-	;;
-    *)
-	set fnord "$@" "$arg"
-	shift
-	shift
-	;;
-    esac
-  done
-  "$@" -E |
-  sed -n '/^#line [0-9][0-9]* "\([^"]*\)"/ s::echo "`cygpath -u \\"\1\\"`":p' | sort | uniq > "$tmpdepfile"
-  rm -f "$depfile"
-  echo "$object : \\" > "$depfile"
-  . "$tmpdepfile" | sed 's% %\\ %g' | sed -n '/^\(.*\)$/ s::	\1 \\:p' >> "$depfile"
-  echo "	" >> "$depfile"
-  . "$tmpdepfile" | sed 's% %\\ %g' | sed -n '/^\(.*\)$/ s::\1\::p' >> "$depfile"
-  rm -f "$tmpdepfile"
-  ;;
-
-none)
-  exec "$@"
-  ;;
-
-*)
-  echo "Unknown depmode $depmode" 1>&2
-  exit 1
-  ;;
-esac
-
-exit 0
-
-# Local Variables:
-# mode: shell-script
-# sh-indentation: 2
-# eval: (add-hook 'write-file-hooks 'time-stamp)
-# time-stamp-start: "scriptversion="
-# time-stamp-format: "%:y-%02m-%02d.%02H"
-# time-stamp-end: "$"
-# End:
@@ -10,12 +10,12 @@
 <h3>Copyright Notice</h3>
 <img src="pic/sheepb.jpg" alt="jpg" align="left"> "Clone me," says Dolly sheepishly.
 <p>Last update:
-  <!-- #BeginDate format:En2m -->17-Jan-2015  00:16<!-- #EndDate -->
+  <!-- #BeginDate format:En2m -->2-Jan-2017  11:58<!-- #EndDate -->
    UTC</p>
 <br clear="left">
 </p>
 <hr>
-<p>The following copyright notice applies to all files collectively  called the Network Time Protocol Version 4 Distribution. Unless  specifically declared otherwise in an individual file, this entire notice  applies as if the text was explicitly included in the file.</p>
+<p>The following copyright notice applies to all files collectively called the Network Time Protocol Version 4 Distribution. Unless specifically declared otherwise in an individual file, this entire notice applies as if the text was explicitly included in the file.</p>
 <pre>
 ***********************************************************************
 *                                                                     *
@@ -39,7 +39,7 @@
 <pre>
 ***********************************************************************
 *                                                                     *
-* Copyright (c) Network Time Foundation 2011-2015                     *
+* Copyright (c) Network Time Foundation 2011-2017                     *
 *                                                                     *
 * All Rights Reserved                                                 *
 *                                                                     *
@@ -67,7 +67,7 @@
 * DAMAGE.                                                             *
 ***********************************************************************
 </pre>
-<p>The following individuals contributed in part to the Network Time  Protocol Distribution Version 4 and are acknowledged as authors of this  work.</p>
+<p>The following individuals contributed in part to the Network Time Protocol Distribution Version 4 and are acknowledged as authors of this work.</p>
 <ol>
  <li><a href="mailto:%[email protected]">Takao Abe &lt;[email protected]&gt;</a> Clock driver for JJY receivers</li>
  <li><a href="mailto:%[email protected]">Mark Andrews &lt;[email protected]&gt;</a> Leitch atomic clock controller</li>
@@ -96,7 +96,7 @@
  <li><a href="mailto:%[email protected]">Jeff Johnson &lt;[email protected]&gt;</a> massive prototyping overhaul</li>
  <li><a href="mailto:%[email protected]">Hans Lambermont &lt;[email protected]&gt;</a> or <a href="mailto:[email protected]">&lt;[email protected]&gt;</a> ntpsweep</li>
  <li><a href="mailto:%[email protected]">Poul-Henning Kamp &lt;[email protected]&gt;</a> Oncore driver (Original author)</li>
-  <li><a href="http://www4.informatik.uni-erlangen.de/%7ekardel">Frank Kardel</a> <a href="mailto:%20kardel%20%28at%29%20ntp%20%28dot%29%20org">&lt;kardel (at) ntp (dot) org&gt;</a> PARSE &lt;GENERIC&gt; (driver 14 reference clocks), STREAMS modules for  PARSE, support scripts, syslog cleanup, dynamic interface handling</li>
+  <li><a href="http://www4.informatik.uni-erlangen.de/%7ekardel">Frank Kardel</a> <a href="mailto:%20kardel%20%28at%29%20ntp%20%28dot%29%20org">&lt;kardel (at) ntp (dot) org&gt;</a> PARSE &lt;GENERIC&gt; (driver 14 reference clocks), STREAMS modules for PARSE, support scripts, syslog cleanup, dynamic interface handling</li>
  <li><a href="mailto:[email protected]">Johannes Maximilian Kuehn &lt;[email protected]&gt;</a> Rewrote <tt>sntp</tt> to comply with NTPv4 specification, <tt>ntpq saveconfig</tt></li>
  <li><a href="mailto:%[email protected]">William L. Jones &lt;[email protected]&gt;</a> RS/6000 AIX modifications, HPUX modifications</li>
  <li><a href="mailto:%[email protected]">Dave Katz &lt;[email protected]&gt;</a> RS/6000 AIX port</li>
@@ -16,7 +16,7 @@
 	<body>
 		<h3>JJY Receivers</h3>
 <p>Last update:
-  <!-- #BeginDate format:En2m -->15-May-2015  00:00<!-- #EndDate -->
+  <!-- #BeginDate format:En2m -->08-May-2016  00:00<!-- #EndDate -->
  UTC &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<a href="driver40.html">ENGLISH</a> &nbsp; <a href="driver40-ja.html">JAPANESE</a></p>
 		<hr>
 		<h4>Synopsis</h4>
@@ -136,7 +136,7 @@
 							<tr>
 								<td><code>{ENQ}1J{ETX}</code></td>
 								<td>&nbsp;--&gt;&nbsp;</td>
-								<td><code>{STX}JYYMMDD HHMMSSS{ETX}</code></td>
+								<td><code>{STX}JYYMMDDWHHMMSSS{ETX}</code></td>
 							</tr>
 						</table>
 						<br>
@@ -11,7 +11,7 @@
 <img src="pic/boom3.gif" alt="gif" align="left"><a href="http://www.eecis.udel.edu/~mills/pictures.html">from <i>Pogo</i>, Walt Kelly</a>
 <p>We have three, now looking for more.</p>
 <p>Last update:
-  <!-- #BeginDate format:En2m -->17-May-2016  06:26<!-- #EndDate -->
+  <!-- #BeginDate format:En2m -->9-Nov-2016  12:26<!-- #EndDate -->
    UTC</p>
 <br clear="left">
 <h4>Related Links</h4>
@@ -145,10 +145,12 @@
      <dd>Specifies the stepout threshold in seconds. The default without this command is 300 s. Since this option also affects the training and startup intervals, it should not be set less than the default. Further details are on the <a href="clock.html">Clock State Machine</a> page.</dd>
    </dl>
  </dd>
-  <dt id="tos"><tt>tos [beacon <i>beacon</i> | ceiling <i>ceiling</i> | cohort {0 | 1} | floor <i>floor</i> | maxclock <i>maxclock </i>| maxdist <i>maxdist</i> | minclock <i>minclock</i> | mindist <i>mindist </i>| minsane <i>minsane</i> | orphan <i>stratum</i> | orphanwait <em>delay</em>]</tt></dt>
+  <dt id="tos"><tt>tos [bcpollbstep <i>poll-gate</i> | beacon <i>beacon</i> | ceiling <i>ceiling</i> | cohort {0 | 1} | floor <i>floor</i> | maxclock <i>maxclock </i>| maxdist <i>maxdist</i> | minclock <i>minclock</i> | mindist <i>mindist </i>| minsane <i>minsane</i> | orphan <i>stratum</i> | orphanwait <em>delay</em>]</tt></dt>
  <dd>This command alters certain system variables used by the the clock selection and clustering algorithms. The default values of these variables have been carefully optimized for a wide range of network speeds and reliability expectations. Very rarely is it necessary to change the default values; but, some folks can't resist twisting the knobs. It can be used to select the quality and quantity of peers used to synchronize the system clock and is most useful in dynamic server discovery schemes. The options are as follows:</dd>
  <dd>
    <dl>
+      <dt><tt>bcpollbstep <i>poll-gate</i></tt></dt>
+      <dd>This option will cause the client to delay believing backward time steps from a broadcast server for <tt>bcpollbstep</tt> poll intervals.  NTP Broadcast networks are expected to be trusted, and if the server's time gets stepped backwards then it's desireable that the clients follow this change as soon as possible.  However, in spite of various protections built-in to the broadcast protocol, it is possible that an attacker could perform a carefully-constructed replay attack and cause clients to erroneously step their clocks backward.  If the risk of a successful broadcast replay attack is greater than the risk of the clients being out of sync in the event that there is a backward step on the broadcast time servers, this option may be used to cause the clients to delay beliveving backward time steps until <i>poll-gate</i> consecutive polls have been received.  The default is 0, which means the client will accept these steps upon receipt.  Any value from 0 to 4 can be specified.</dd>
      <dt><tt>beacon <i>beacon</i></tt></dt>
      <dd>The manycast server sends packets at intervals of 64 s if less than <tt>maxclock</tt> servers are available. Otherwise, it sends packets at the <i><tt>beacon</tt></i> interval in seconds. The default is 3600 s. See the <a href="discover.html">Automatic Server Discovery</a> page for further details.</dd>
      <dt><tt>ceiling <i>ceiling</i></tt></dt>
@@ -16,6 +16,7 @@ noinst_HEADERS =	\
 	intreswork.h	\
 	iosignal.h	\
 	l_stdlib.h	\
+	libssl_compat.h	\
 	lib_strbuf.h	\
 	libntp.h	\
 	mbg_gps166.h	\
@@ -108,6 +108,7 @@ am__aclocal_m4_deps = $(top_srcdir)/sntp/libopts/m4/libopts.m4 \
 	$(top_srcdir)/sntp/m4/ntp_dir_sep.m4 \
 	$(top_srcdir)/sntp/m4/ntp_facilitynames.m4 \
 	$(top_srcdir)/sntp/m4/ntp_googletest.m4 \
+	$(top_srcdir)/sntp/m4/ntp_harden.m4 \
 	$(top_srcdir)/sntp/m4/ntp_ipv6.m4 \
 	$(top_srcdir)/sntp/m4/ntp_lib_m.m4 \
 	$(top_srcdir)/sntp/m4/ntp_libevent.m4 \
@@ -245,10 +246,6 @@ CPP = @CPP@
 CPPFLAGS = @CPPFLAGS@
 CPPFLAGS_LIBEVENT = @CPPFLAGS_LIBEVENT@
 CPPFLAGS_NTP = @CPPFLAGS_NTP@
-CXX = @CXX@
-CXXCPP = @CXXCPP@
-CXXDEPMODE = @CXXDEPMODE@
-CXXFLAGS = @CXXFLAGS@
 CYGPATH_W = @CYGPATH_W@
 DCFD = @DCFD@
 DEFS = @DEFS@
@@ -301,6 +298,7 @@ LN_S = @LN_S@
 LSCF = @LSCF@
 LTHREAD_LIBS = @LTHREAD_LIBS@
 LTLIBOBJS = @LTLIBOBJS@
+LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
 MAKEINFO = @MAKEINFO@
 MAKE_ADJTIMED = @MAKE_ADJTIMED@
 MAKE_CHECK_LAYOUT = @MAKE_CHECK_LAYOUT@
@@ -364,6 +362,9 @@ NTPTRACE_DL = @NTPTRACE_DL@
 NTPTRACE_DS = @NTPTRACE_DS@
 NTPTRACE_MS = @NTPTRACE_MS@
 NTPTRACE_NI = @NTPTRACE_NI@
+NTP_HARD_CFLAGS = @NTP_HARD_CFLAGS@
+NTP_HARD_CPPFLAGS = @NTP_HARD_CPPFLAGS@
+NTP_HARD_LDFLAGS = @NTP_HARD_LDFLAGS@
 NTP_KEYGEN_DB = @NTP_KEYGEN_DB@
 NTP_KEYGEN_DL = @NTP_KEYGEN_DL@
 NTP_KEYGEN_DS = @NTP_KEYGEN_DS@
@@ -437,7 +438,6 @@ abs_top_builddir = @abs_top_builddir@
 abs_top_srcdir = @abs_top_srcdir@
 ac_ct_AR = @ac_ct_AR@
 ac_ct_CC = @ac_ct_CC@
-ac_ct_CXX = @ac_ct_CXX@
 ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
 am__include = @am__include@
 am__leading_dot = @am__leading_dot@
@@ -501,6 +501,7 @@ noinst_HEADERS = \
 	intreswork.h	\
 	iosignal.h	\
 	l_stdlib.h	\
+	libssl_compat.h	\
 	lib_strbuf.h	\
 	libntp.h	\
 	mbg_gps166.h	\
@@ -108,6 +108,7 @@ am__aclocal_m4_deps = $(top_srcdir)/sntp/libopts/m4/libopts.m4 \
 	$(top_srcdir)/sntp/m4/ntp_dir_sep.m4 \
 	$(top_srcdir)/sntp/m4/ntp_facilitynames.m4 \
 	$(top_srcdir)/sntp/m4/ntp_googletest.m4 \
+	$(top_srcdir)/sntp/m4/ntp_harden.m4 \
 	$(top_srcdir)/sntp/m4/ntp_ipv6.m4 \
 	$(top_srcdir)/sntp/m4/ntp_lib_m.m4 \
 	$(top_srcdir)/sntp/m4/ntp_libevent.m4 \
@@ -203,10 +204,6 @@ CPP = @CPP@
 CPPFLAGS = @CPPFLAGS@
 CPPFLAGS_LIBEVENT = @CPPFLAGS_LIBEVENT@
 CPPFLAGS_NTP = @CPPFLAGS_NTP@
-CXX = @CXX@
-CXXCPP = @CXXCPP@
-CXXDEPMODE = @CXXDEPMODE@
-CXXFLAGS = @CXXFLAGS@
 CYGPATH_W = @CYGPATH_W@
 DCFD = @DCFD@
 DEFS = @DEFS@
@@ -259,6 +256,7 @@ LN_S = @LN_S@
 LSCF = @LSCF@
 LTHREAD_LIBS = @LTHREAD_LIBS@
 LTLIBOBJS = @LTLIBOBJS@
+LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
 MAKEINFO = @MAKEINFO@
 MAKE_ADJTIMED = @MAKE_ADJTIMED@
 MAKE_CHECK_LAYOUT = @MAKE_CHECK_LAYOUT@
@@ -322,6 +320,9 @@ NTPTRACE_DL = @NTPTRACE_DL@
 NTPTRACE_DS = @NTPTRACE_DS@
 NTPTRACE_MS = @NTPTRACE_MS@
 NTPTRACE_NI = @NTPTRACE_NI@
+NTP_HARD_CFLAGS = @NTP_HARD_CFLAGS@
+NTP_HARD_CPPFLAGS = @NTP_HARD_CPPFLAGS@
+NTP_HARD_LDFLAGS = @NTP_HARD_LDFLAGS@
 NTP_KEYGEN_DB = @NTP_KEYGEN_DB@
 NTP_KEYGEN_DL = @NTP_KEYGEN_DL@
 NTP_KEYGEN_DS = @NTP_KEYGEN_DS@
@@ -395,7 +396,6 @@ abs_top_builddir = @abs_top_builddir@
 abs_top_srcdir = @abs_top_srcdir@
 ac_ct_AR = @ac_ct_AR@
 ac_ct_CC = @ac_ct_CC@
-ac_ct_CXX = @ac_ct_CXX@
 ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
 am__include = @am__include@
 am__leading_dot = @am__leading_dot@
@@ -0,0 +1,119 @@
+/*
+ * libssl_compat.h -- OpenSSL v1.1 compatibility shims
+ *
+ * ---------------------------------------------------------------------
+ *
+ * Written by Juergen Perlinger <perlinger@ntp.org> for the NTP project
+ *
+ * Based on an idea by Kurt Roeckx <kurt@roeckx.be>
+ *
+ * ---------------------------------------------------------------------
+ * This is a clean room implementation of shim functions that have
+ * counterparts in the OpenSSL v1.1 API but not in earlier versions.
+ *
+ * If the OpenSSL version used for compilation needs the shims (that is,
+ * does not provide the new functions) the names of these functions are
+ * redirected to our shims.
+ * ---------------------------------------------------------------------
+ */
+
+#ifndef NTP_LIBSSL_COMPAT_H
+#define NTP_LIBSSL_COMPAT_H
+
+#include "openssl/evp.h"
+#include "openssl/dsa.h"
+#include "openssl/rsa.h"
+
+#ifndef OPENSSL_VERSION_NUMBER
+#define OPENSSL_VERSION_NUMBER SSLEAY_VERSION_NUMBER
+#endif
+
+#ifndef OPENSSL_VERSION_TEXT
+#define OPENSSL_VERSION_TEXT SSLEAY_VERSION_TEXT
+#endif
+
+#ifndef OPENSSL_VERSION
+#define OPENSSL_VERSION SSLEAY_VERSION
+#endif
+
+/* ----------------------------------------------------------------- */
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+/* ----------------------------------------------------------------- */
+
+# include <openssl/objects.h>
+# include <openssl/x509.h>
+
+/* shim the new-style API on an old-style OpenSSL */
+
+extern BN_GENCB*	sslshimBN_GENCB_new(void);
+extern void		sslshimBN_GENCB_free(BN_GENCB*);
+
+extern EVP_MD_CTX*	sslshim_EVP_MD_CTX_new(void);
+extern void		sslshim_EVP_MD_CTX_free(EVP_MD_CTX *ctx);
+
+extern int	sslshim_EVP_PKEY_id(const EVP_PKEY * pkey);
+extern int	sslshim_EVP_PKEY_base_id(const EVP_PKEY * pkey);
+extern RSA*	sslshim_EVP_PKEY_get0_RSA(EVP_PKEY * pkey);
+extern DSA*	sslshim_EVP_PKEY_get0_DSA(EVP_PKEY * pkey);
+
+extern void	sslshim_RSA_get0_key(const RSA *prsa, const BIGNUM **pn,
+				     const BIGNUM **pe, const BIGNUM **pd);
+extern int	sslshim_RSA_set0_key(RSA *prsa, BIGNUM *n,
+				     BIGNUM *e, BIGNUM *d);
+extern void	sslshim_RSA_get0_factors(const RSA *prsa, const BIGNUM **pp,
+					 const BIGNUM **pq);
+extern int 	sslshim_RSA_set0_factors(RSA *prsar, BIGNUM *p, BIGNUM *q);
+extern int	sslshim_RSA_set0_crt_params(RSA *prsa, BIGNUM *dmp1,
+					BIGNUM *dmq1, BIGNUM *iqmp);
+
+extern void	sslshim_DSA_SIG_get0(const DSA_SIG *psig, const BIGNUM **pr,
+				     const BIGNUM **ps);
+extern int	sslshim_DSA_SIG_set0(DSA_SIG *psig, BIGNUM *r, BIGNUM *s);
+extern void	sslshim_DSA_get0_pqg(const DSA *pdsa, const BIGNUM **pp,
+				 const BIGNUM **pq, const BIGNUM **pg);
+extern int	sslshim_DSA_set0_pqg(DSA *pdsa, BIGNUM *p, BIGNUM *q, BIGNUM *g);
+extern void	sslshim_DSA_get0_key(const DSA *pdsa, const BIGNUM **ppub_key,
+				 const BIGNUM **ppriv_key);
+extern int	sslshim_DSA_set0_key(DSA *pdsa, BIGNUM *pub_key,
+				     BIGNUM *priv_key);
+
+extern int	sslshim_X509_get_signature_nid(const X509 *x);
+
+#define	BN_GENCB_new		sslshimBN_GENCB_new
+#define	BN_GENCB_free		sslshimBN_GENCB_free
+
+#define EVP_MD_CTX_new		sslshim_EVP_MD_CTX_new
+#define EVP_MD_CTX_free		sslshim_EVP_MD_CTX_free
+
+#define EVP_PKEY_id		sslshim_EVP_PKEY_id
+#define EVP_PKEY_base_id	sslshim_EVP_PKEY_base_id
+#define EVP_PKEY_get0_RSA	sslshim_EVP_PKEY_get0_RSA
+#define EVP_PKEY_get0_DSA	sslshim_EVP_PKEY_get0_DSA
+
+#define RSA_get0_key		sslshim_RSA_get0_key
+#define RSA_set0_key		sslshim_RSA_set0_key
+#define RSA_get0_factors	sslshim_RSA_get0_factors
+#define RSA_set0_factors	sslshim_RSA_set0_factors
+#define RSA_set0_crt_params	sslshim_RSA_set0_crt_params
+
+#define DSA_SIG_get0		sslshim_DSA_SIG_get0
+#define DSA_SIG_set0		sslshim_DSA_SIG_set0
+#define DSA_get0_pqg		sslshim_DSA_get0_pqg
+#define DSA_set0_pqg		sslshim_DSA_set0_pqg
+#define DSA_get0_key		sslshim_DSA_get0_key
+#define DSA_set0_key		sslshim_DSA_set0_key
+
+#define X509_get_signature_nid	sslshim_X509_get_signature_nid
+
+#define OpenSSL_version_num	SSLeay
+#define OpenSSL_version		SSLeay_version
+#define X509_get0_notBefore	X509_get_notBefore
+#define X509_getm_notBefore	X509_get_notBefore
+#define X509_get0_notAfter	X509_get_notAfter
+#define X509_getm_notAfter	X509_get_notAfter
+
+/* ----------------------------------------------------------------- */
+#endif /* OPENSSL_VERSION_NUMBER < v1.1.0 */
+/* ----------------------------------------------------------------- */
+
+#endif /* NTP_LIBSSL_COMPAT_H */
@@ -391,7 +391,7 @@ struct peer {
 	 * Statistic counters
 	 */
 	u_long	timereset;	/* time stat counters were reset */
-	u_long	timelastrec;	/* last packet received time */
+	u_long	timelastrec;	/* last packet received time, incl. trash */
 	u_long	timereceived;	/* last (clean) packet received time */
 	u_long	timereachable;	/* last reachable/unreachable time */

@@ -419,8 +419,7 @@ struct peer {
 * MODE_BROADCAST and MODE_BCLIENT appear in the transition
 * function. MODE_CONTROL and MODE_PRIVATE can appear in packets,
 * but those never survive to the transition function.
- * is a
-/ */
+ */
 #define	MODE_UNSPEC	0	/* unspecified (old version) */
 #define	MODE_ACTIVE	1	/* symmetric active mode */
 #define	MODE_PASSIVE	2	/* symmetric passive mode */
@@ -433,7 +432,7 @@ struct peer {
 #define	MODE_CONTROL	6	/* control mode */
 #define	MODE_PRIVATE	7	/* private mode */
 /*
- * This is a madeup mode for broadcast client.
+ * This is a made-up mode for broadcast client.
 */
 #define	MODE_BCLIENT	6	/* broadcast client mode */

@@ -724,6 +723,7 @@ struct pkt {
 #define	PROTO_UECRYPTONAK	30
 #define	PROTO_UEDIGEST		31
 #define	PROTO_PCEDIGEST		32
+#define	PROTO_BCPOLLBSTEP	33

 /*
 * Configuration items for the loop filter
@@ -731,7 +731,7 @@ struct pkt {
 #define	LOOP_DRIFTINIT		1	/* iniitialize frequency */
 #define	LOOP_KERN_CLEAR		2	/* set initial frequency offset */
 #define LOOP_MAX		3	/* set both step offsets */
-#define LOOP_MAX_BACK		4	/* set bacward-step offset */
+#define LOOP_MAX_BACK		4	/* set backward-step offset */
 #define LOOP_MAX_FWD		5	/* set forward-step offset */
 #define LOOP_PANIC		6	/* set panic offseet */
 #define LOOP_PHI		7	/* set dispersion rate */
@@ -24,6 +24,7 @@
 invalidsyntax: AUTOKEY should be defined only if OPENSSL is.
 #endif

+#include "openssl/bn.h"
 #include "openssl/evp.h"
 #include "ntp_calendar.h"	/* for fields in the cert_info structure */

@@ -352,7 +352,7 @@ extern	int	buftvtots	(const char *, l_fp *);
 extern	char *	fptoa		(s_fp, short);
 extern	char *	fptoms		(s_fp, short);
 extern	int	hextolfp	(const char *, l_fp *);
-extern  void	gpstolfp	(int, int, unsigned long, l_fp *);
+extern  void	gpstolfp	(u_int, u_int, unsigned long, l_fp *);
 extern	int	mstolfp		(const char *, l_fp *);
 extern	char *	prettydate	(l_fp *);
 extern	char *	gmprettydate	(l_fp *);
@@ -9,6 +9,9 @@
 #ifdef WORKER
 #define	INITIAL_DNS_RETRY	2	/* seconds between queries */

+/* flags for extended addrinfo version */
+#define GAIR_F_IGNDNSERR	0x0001	/* ignore DNS errors */
+
 /*
 * you call getaddrinfo_sometime(name, service, &hints, retry, callback_func, context);
 * later (*callback_func)(rescode, gai_errno, context, name, service, hints, ai_result) is called.
@@ -19,6 +22,9 @@ typedef void	(*gai_sometime_callback)
 extern int	getaddrinfo_sometime(const char *, const char *,
 				     const struct addrinfo *, int,
 				     gai_sometime_callback, void *);
+extern int	getaddrinfo_sometime_ex(const char *, const char *,
+				     const struct addrinfo *, int,
+				     gai_sometime_callback, void *, u_int);
 /*
 * In gai_sometime_callback routines, the resulting addrinfo list is
 * only available until the callback returns.  To hold on to the list
@@ -8,6 +8,7 @@

 #ifdef OPENSSL
 # include "openssl/evp.h"
+# include "libssl_compat.h"
 #else	/* !OPENSSL follows */
 /*
 * Provide OpenSSL-alike MD5 API if we're not using OpenSSL
@@ -23,6 +24,9 @@
 # endif

  typedef MD5_CTX			EVP_MD_CTX;
+
+# define EVP_MD_CTX_free(c)		free(c)
+# define EVP_MD_CTX_new()		calloc(1, sizeof(MD5_CTX))
 # define EVP_get_digestbynid(t)		NULL
 # define EVP_md5()			NULL
 # define EVP_MD_CTX_init(c)
@@ -105,21 +105,23 @@ extern	u_int32	addr2refid	(sockaddr_u *);
 /* emalloc.c */
 #ifndef EREALLOC_CALLSITE	/* ntp_malloc.h defines */
 extern	void *	ereallocz	(void *, size_t, size_t, int);
-extern	void *	oreallocarray	(void *optr, size_t nmemb, size_t size);
+extern	void *	oreallocarrayxz	(void *optr, size_t nmemb, size_t size, size_t extra);
 #define	erealloczsite(p, n, o, z, f, l) ereallocz((p), (n), (o), (z))
 #define	emalloc(n)		ereallocz(NULL, (n), 0, FALSE)
 #define	emalloc_zero(c)		ereallocz(NULL, (c), 0, TRUE)
 #define	erealloc(p, c)		ereallocz((p), (c), 0, FALSE)
 #define erealloc_zero(p, n, o)	ereallocz((p), (n), (o), TRUE)
-#define ereallocarray(p, n, s)	oreallocarray((p), (n), (s))
-#define eallocarray(n, s)	oreallocarray(NULL, (n), (s))
+#define ereallocarray(p, n, s)	oreallocarrayxz((p), (n), (s), 0)
+#define eallocarray(n, s)	oreallocarrayxz(NULL, (n), (s), 0)
+#define ereallocarrayxz(p, n, s, x)	oreallocarrayxz((p), (n), (s), (x))
+#define eallocarrayxz(n, s, x)	oreallocarrayxz(NULL, (n), (s), (x))
 extern	char *	estrdup_impl(const char *);
 #define	estrdup(s)		estrdup_impl(s)
 #else
 extern	void *	ereallocz	(void *, size_t, size_t, int,
 				 const char *, int);
-extern	void *	oreallocarray	(void *optr, size_t nmemb, size_t size,
-				 const char *, int);
+extern	void *	oreallocarrayxz	(void *optr, size_t nmemb, size_t size,
+				 size_t extra, const char *, int);
 #define erealloczsite		ereallocz
 #define	emalloc(c)		ereallocz(NULL, (c), 0, FALSE, \
 					  __FILE__, __LINE__)
@@ -129,9 +131,13 @@ extern	void *	oreallocarray	(void *optr, size_t nmemb, size_t size,
 					  __FILE__, __LINE__)
 #define	erealloc_zero(p, n, o)	ereallocz((p), (n), (o), TRUE, \
 					  __FILE__, __LINE__)
-#define ereallocarray(p, n, s)	oreallocarray((p), (n), (s), \
+#define ereallocarray(p, n, s)	oreallocarrayxz((p), (n), (s), 0, \
 					  __FILE__, __LINE__)
-#define eallocarray(n, s)	oreallocarray(NULL, (n), (s), \
+#define eallocarray(n, s)	oreallocarrayxz(NULL, (n), (s), 0, \
+					  __FILE__, __LINE__)
+#define ereallocarrayxz(p, n, s, x)	oreallocarrayxz((p), (n), (s), (x), \
+					  __FILE__, __LINE__)
+#define eallocarrayxz(n, s, x)	oreallocarrayxz(NULL, (n), (s), (x), \
 					  __FILE__, __LINE__)
 extern	char *	estrdup_impl(const char *, const char *, int);
 #define	estrdup(s) estrdup_impl((s), __FILE__, __LINE__)
@@ -321,6 +321,8 @@ extern	void	parse_cmdline_opts(int *, char ***);

 /* ntp_config.c */
 extern char const *	progname;
+extern int saved_argc;
+extern char **saved_argv;
 extern char	*sys_phone[];		/* ACTS phone numbers */
 #if defined(HAVE_SCHED_SETSCHEDULER)
 extern int	config_priority_override;
@@ -483,15 +485,17 @@ extern int	sys_bclient;		/* we set our time to broadcasts */
 extern double	sys_bdelay; 		/* broadcast client default delay */
 extern int	sys_authenticate;	/* requre authentication for config */
 extern l_fp	sys_authdelay;		/* authentication delay */
+extern u_char	sys_bcpollbstep;	/* broadcast poll backstep gate */
 extern u_long 	sys_epoch;		/* last clock update time */
 extern keyid_t	sys_private;		/* private value for session seed */
 extern int	sys_manycastserver;	/* respond to manycast client pkts */
+extern int	sys_maxclock;		/* maximum survivors */
 extern int	sys_minclock;		/* minimum survivors */
 extern int	sys_minsane;		/* minimum candidates */
 extern int	sys_floor;		/* cluster stratum floor */
 extern int	sys_ceiling;		/* cluster stratum ceiling */
 extern u_char	sys_ttl[MAX_TTL];	/* ttl mapping vector */
-extern int	sys_ttlmax;		/* max ttl mapping vector index */
+extern u_int	sys_ttlmax;		/* max ttl mapping vector index */

 /*
 * Statistics counters
@@ -10,8 +10,13 @@
 # ifdef _MSC_VER
 #  pragma warning(push)
 #  pragma warning(disable: 4152)
+#  ifndef OPENSSL_NO_AUTOLINK
+#   include "msvc_ssl_autolib.h"
+#  endif
+# endif
+# if OPENSSL_VERSION_NUMBER < 0x10100000L
+#  include <openssl/applink.c>
 # endif
-# include <openssl/applink.c>
 # ifdef _MSC_VER
 #  pragma warning(pop)
 # endif
@@ -25,20 +30,30 @@
 void *wrap_dbg_malloc(size_t s, const char *f, int l);
 void *wrap_dbg_realloc(void *p, size_t s, const char *f, int l);
 void wrap_dbg_free(void *p);
+void wrap_dbg_free_ex(void *p, const char *f, int l);
 #endif


 #if defined(OPENSSL) && defined(SYS_WINNT)
+
 void ssl_applink(void);

 void
 ssl_applink(void)
 {
-#ifdef WRAP_DBG_MALLOC
-	CRYPTO_set_mem_ex_functions(wrap_dbg_malloc, wrap_dbg_realloc, wrap_dbg_free);
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+#   ifdef WRAP_DBG_MALLOC
+	CRYPTO_set_mem_functions(wrap_dbg_malloc, wrap_dbg_realloc, wrap_dbg_free_ex);
+#   else
+	OPENSSL_malloc_init();
+#   endif
 #else
+#   ifdef WRAP_DBG_MALLOC
+	CRYPTO_set_mem_ex_functions(wrap_dbg_malloc, wrap_dbg_realloc, wrap_dbg_free);
+#   else
 	CRYPTO_malloc_init();
-#endif
+#   endif
+#endif /* OpenSSL version cascade */
 }
 #else	/* !OPENSSL || !SYS_WINNT */
 #define ssl_applink()	do {} while (0)
@@ -71,4 +86,11 @@ void wrap_dbg_free(void *p)
 {
 	_free_dbg(p, _NORMAL_BLOCK);
 }
+
+void wrap_dbg_free_ex(void *p, const char *f, int l)
+{
+	(void)f;
+	(void)l;
+	_free_dbg(p, _NORMAL_BLOCK);
+}
 #endif	/* WRAP_DBG_MALLOC */
@@ -1,323 +0,0 @@
-#!/bin/sh
-# install - install a program, script, or datafile
-
-scriptversion=2005-05-14.22
-
-# This originates from X11R5 (mit/util/scripts/install.sh), which was
-# later released in X11R6 (xc/config/util/install.sh) with the
-# following copyright and license.
-#
-# Copyright (C) 1994 X Consortium
-#
-# Permission is hereby granted, free of charge, to any person obtaining a copy
-# of this software and associated documentation files (the "Software"), to
-# deal in the Software without restriction, including without limitation the
-# rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
-# sell copies of the Software, and to permit persons to whom the Software is
-# furnished to do so, subject to the following conditions:
-#
-# The above copyright notice and this permission notice shall be included in
-# all copies or substantial portions of the Software.
-#
-# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
-# X CONSORTIUM BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
-# AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNEC-
-# TION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-#
-# Except as contained in this notice, the name of the X Consortium shall not
-# be used in advertising or otherwise to promote the sale, use or other deal-
-# ings in this Software without prior written authorization from the X Consor-
-# tium.
-#
-#
-# FSF changes to this file are in the public domain.
-#
-# Calling this script install-sh is preferred over install.sh, to prevent
-# `make' implicit rules from creating a file called install from it
-# when there is no Makefile.
-#
-# This script is compatible with the BSD install script, but was written
-# from scratch.  It can only install one file at a time, a restriction
-# shared with many OS's install programs.
-
-# set DOITPROG to echo to test this script
-
-# Don't use :- since 4.3BSD and earlier shells don't like it.
-doit="${DOITPROG-}"
-
-# put in absolute paths if you don't have them in your path; or use env. vars.
-
-mvprog="${MVPROG-mv}"
-cpprog="${CPPROG-cp}"
-chmodprog="${CHMODPROG-chmod}"
-chownprog="${CHOWNPROG-chown}"
-chgrpprog="${CHGRPPROG-chgrp}"
-stripprog="${STRIPPROG-strip}"
-rmprog="${RMPROG-rm}"
-mkdirprog="${MKDIRPROG-mkdir}"
-
-chmodcmd="$chmodprog 0755"
-chowncmd=
-chgrpcmd=
-stripcmd=
-rmcmd="$rmprog -f"
-mvcmd="$mvprog"
-src=
-dst=
-dir_arg=
-dstarg=
-no_target_directory=
-
-usage="Usage: $0 [OPTION]... [-T] SRCFILE DSTFILE
-   or: $0 [OPTION]... SRCFILES... DIRECTORY
-   or: $0 [OPTION]... -t DIRECTORY SRCFILES...
-   or: $0 [OPTION]... -d DIRECTORIES...
-
-In the 1st form, copy SRCFILE to DSTFILE.
-In the 2nd and 3rd, copy all SRCFILES to DIRECTORY.
-In the 4th, create DIRECTORIES.
-
-Options:
-c         (ignored)
-d         create directories instead of installing files.
-g GROUP   $chgrpprog installed files to GROUP.
-m MODE    $chmodprog installed files to MODE.
-o USER    $chownprog installed files to USER.
-s         $stripprog installed files.
-t DIRECTORY  install into DIRECTORY.
-T         report an error if DSTFILE is a directory.
--help     display this help and exit.
--version  display version info and exit.
-
-Environment variables override the default commands:
-  CHGRPPROG CHMODPROG CHOWNPROG CPPROG MKDIRPROG MVPROG RMPROG STRIPPROG
-"
-
-while test -n "$1"; do
-  case $1 in
-    -c) shift
-        continue;;
-
-    -d) dir_arg=true
-        shift
-        continue;;
-
-    -g) chgrpcmd="$chgrpprog $2"
-        shift
-        shift
-        continue;;
-
-    --help) echo "$usage"; exit $?;;
-
-    -m) chmodcmd="$chmodprog $2"
-        shift
-        shift
-        continue;;
-
-    -o) chowncmd="$chownprog $2"
-        shift
-        shift
-        continue;;
-
-    -s) stripcmd=$stripprog
-        shift
-        continue;;
-
-    -t) dstarg=$2
-	shift
-	shift
-	continue;;
-
-    -T) no_target_directory=true
-	shift
-	continue;;
-
-    --version) echo "$0 $scriptversion"; exit $?;;
-
-    *)  # When -d is used, all remaining arguments are directories to create.
-	# When -t is used, the destination is already specified.
-	test -n "$dir_arg$dstarg" && break
-        # Otherwise, the last argument is the destination.  Remove it from $@.
-	for arg
-	do
-          if test -n "$dstarg"; then
-	    # $@ is not empty: it contains at least $arg.
-	    set fnord "$@" "$dstarg"
-	    shift # fnord
-	  fi
-	  shift # arg
-	  dstarg=$arg
-	done
-	break;;
-  esac
-done
-
-if test -z "$1"; then
-  if test -z "$dir_arg"; then
-    echo "$0: no input file specified." >&2
-    exit 1
-  fi
-  # It's OK to call `install-sh -d' without argument.
-  # This can happen when creating conditional directories.
-  exit 0
-fi
-
-for src
-do
-  # Protect names starting with `-'.
-  case $src in
-    -*) src=./$src ;;
-  esac
-
-  if test -n "$dir_arg"; then
-    dst=$src
-    src=
-
-    if test -d "$dst"; then
-      mkdircmd=:
-      chmodcmd=
-    else
-      mkdircmd=$mkdirprog
-    fi
-  else
-    # Waiting for this to be detected by the "$cpprog $src $dsttmp" command
-    # might cause directories to be created, which would be especially bad
-    # if $src (and thus $dsttmp) contains '*'.
-    if test ! -f "$src" && test ! -d "$src"; then
-      echo "$0: $src does not exist." >&2
-      exit 1
-    fi
-
-    if test -z "$dstarg"; then
-      echo "$0: no destination specified." >&2
-      exit 1
-    fi
-
-    dst=$dstarg
-    # Protect names starting with `-'.
-    case $dst in
-      -*) dst=./$dst ;;
-    esac
-
-    # If destination is a directory, append the input filename; won't work
-    # if double slashes aren't ignored.
-    if test -d "$dst"; then
-      if test -n "$no_target_directory"; then
-	echo "$0: $dstarg: Is a directory" >&2
-	exit 1
-      fi
-      dst=$dst/`basename "$src"`
-    fi
-  fi
-
-  # This sed command emulates the dirname command.
-  dstdir=`echo "$dst" | sed -e 's,/*$,,;s,[^/]*$,,;s,/*$,,;s,^$,.,'`
-
-  # Make sure that the destination directory exists.
-
-  # Skip lots of stat calls in the usual case.
-  if test ! -d "$dstdir"; then
-    defaultIFS='
-	 '
-    IFS="${IFS-$defaultIFS}"
-
-    oIFS=$IFS
-    # Some sh's can't handle IFS=/ for some reason.
-    IFS='%'
-    set x `echo "$dstdir" | sed -e 's@/@%@g' -e 's@^%@/@'`
-    shift
-    IFS=$oIFS
-
-    pathcomp=
-
-    while test $# -ne 0 ; do
-      pathcomp=$pathcomp$1
-      shift
-      if test ! -d "$pathcomp"; then
-        $mkdirprog "$pathcomp"
-	# mkdir can fail with a `File exist' error in case several
-	# install-sh are creating the directory concurrently.  This
-	# is OK.
-	test -d "$pathcomp" || exit
-      fi
-      pathcomp=$pathcomp/
-    done
-  fi
-
-  if test -n "$dir_arg"; then
-    $doit $mkdircmd "$dst" \
-      && { test -z "$chowncmd" || $doit $chowncmd "$dst"; } \
-      && { test -z "$chgrpcmd" || $doit $chgrpcmd "$dst"; } \
-      && { test -z "$stripcmd" || $doit $stripcmd "$dst"; } \
-      && { test -z "$chmodcmd" || $doit $chmodcmd "$dst"; }
-
-  else
-    dstfile=`basename "$dst"`
-
-    # Make a couple of temp file names in the proper directory.
-    dsttmp=$dstdir/_inst.$$_
-    rmtmp=$dstdir/_rm.$$_
-
-    # Trap to clean up those temp files at exit.
-    trap 'ret=$?; rm -f "$dsttmp" "$rmtmp" && exit $ret' 0
-    trap '(exit $?); exit' 1 2 13 15
-
-    # Copy the file name to the temp name.
-    $doit $cpprog "$src" "$dsttmp" &&
-
-    # and set any options; do chmod last to preserve setuid bits.
-    #
-    # If any of these fail, we abort the whole thing.  If we want to
-    # ignore errors from any of these, just make sure not to ignore
-    # errors from the above "$doit $cpprog $src $dsttmp" command.
-    #
-    { test -z "$chowncmd" || $doit $chowncmd "$dsttmp"; } \
-      && { test -z "$chgrpcmd" || $doit $chgrpcmd "$dsttmp"; } \
-      && { test -z "$stripcmd" || $doit $stripcmd "$dsttmp"; } \
-      && { test -z "$chmodcmd" || $doit $chmodcmd "$dsttmp"; } &&
-
-    # Now rename the file to the real destination.
-    { $doit $mvcmd -f "$dsttmp" "$dstdir/$dstfile" 2>/dev/null \
-      || {
-	   # The rename failed, perhaps because mv can't rename something else
-	   # to itself, or perhaps because mv is so ancient that it does not
-	   # support -f.
-
-	   # Now remove or move aside any old file at destination location.
-	   # We try this two ways since rm can't unlink itself on some
-	   # systems and the destination file might be busy for other
-	   # reasons.  In this case, the final cleanup might fail but the new
-	   # file should still install successfully.
-	   {
-	     if test -f "$dstdir/$dstfile"; then
-	       $doit $rmcmd -f "$dstdir/$dstfile" 2>/dev/null \
-	       || $doit $mvcmd -f "$dstdir/$dstfile" "$rmtmp" 2>/dev/null \
-	       || {
-		 echo "$0: cannot unlink or rename $dstdir/$dstfile" >&2
-		 (exit 1); exit 1
-	       }
-	     else
-	       :
-	     fi
-	   } &&
-
-	   # Now rename the file to the real destination.
-	   $doit $mvcmd "$dsttmp" "$dstdir/$dstfile"
-	 }
-    }
-  fi || { (exit 1); exit 1; }
-done
-
-# The final little trick to "correctly" pass the exit status to the exit trap.
-{
-  (exit 0); exit 0
-}
-
-# Local variables:
-# eval: (add-hook 'write-file-hooks 'time-stamp)
-# time-stamp-start: "scriptversion="
-# time-stamp-format: "%:y-%02m-%02d.%02H"
-# time-stamp-end: "$"
-# End:
@@ -107,6 +107,7 @@ am__aclocal_m4_deps = $(top_srcdir)/sntp/libopts/m4/libopts.m4 \
 	$(top_srcdir)/sntp/m4/ntp_dir_sep.m4 \
 	$(top_srcdir)/sntp/m4/ntp_facilitynames.m4 \
 	$(top_srcdir)/sntp/m4/ntp_googletest.m4 \
+	$(top_srcdir)/sntp/m4/ntp_harden.m4 \
 	$(top_srcdir)/sntp/m4/ntp_ipv6.m4 \
 	$(top_srcdir)/sntp/m4/ntp_lib_m.m4 \
 	$(top_srcdir)/sntp/m4/ntp_libevent.m4 \
@@ -242,10 +243,6 @@ CPP = @CPP@
 CPPFLAGS = @CPPFLAGS@
 CPPFLAGS_LIBEVENT = @CPPFLAGS_LIBEVENT@
 CPPFLAGS_NTP = @CPPFLAGS_NTP@
-CXX = @CXX@
-CXXCPP = @CXXCPP@
-CXXDEPMODE = @CXXDEPMODE@
-CXXFLAGS = @CXXFLAGS@
 CYGPATH_W = @CYGPATH_W@
 DCFD = @DCFD@
 DEFS = @DEFS@
@@ -298,6 +295,7 @@ LN_S = @LN_S@
 LSCF = @LSCF@
 LTHREAD_LIBS = @LTHREAD_LIBS@
 LTLIBOBJS = @LTLIBOBJS@
+LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
 MAKEINFO = @MAKEINFO@
 MAKE_ADJTIMED = @MAKE_ADJTIMED@
 MAKE_CHECK_LAYOUT = @MAKE_CHECK_LAYOUT@
@@ -361,6 +359,9 @@ NTPTRACE_DL = @NTPTRACE_DL@
 NTPTRACE_DS = @NTPTRACE_DS@
 NTPTRACE_MS = @NTPTRACE_MS@
 NTPTRACE_NI = @NTPTRACE_NI@
+NTP_HARD_CFLAGS = @NTP_HARD_CFLAGS@
+NTP_HARD_CPPFLAGS = @NTP_HARD_CPPFLAGS@
+NTP_HARD_LDFLAGS = @NTP_HARD_LDFLAGS@
 NTP_KEYGEN_DB = @NTP_KEYGEN_DB@
 NTP_KEYGEN_DL = @NTP_KEYGEN_DL@
 NTP_KEYGEN_DS = @NTP_KEYGEN_DS@
@@ -434,7 +435,6 @@ abs_top_builddir = @abs_top_builddir@
 abs_top_srcdir = @abs_top_srcdir@
 ac_ct_AR = @ac_ct_AR@
 ac_ct_CC = @ac_ct_CC@
-ac_ct_CXX = @ac_ct_CXX@
 ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
 am__include = @am__include@
 am__leading_dot = @am__leading_dot@
@@ -108,6 +108,7 @@ am__aclocal_m4_deps = $(top_srcdir)/sntp/libopts/m4/libopts.m4 \
 	$(top_srcdir)/sntp/m4/ntp_dir_sep.m4 \
 	$(top_srcdir)/sntp/m4/ntp_facilitynames.m4 \
 	$(top_srcdir)/sntp/m4/ntp_googletest.m4 \
+	$(top_srcdir)/sntp/m4/ntp_harden.m4 \
 	$(top_srcdir)/sntp/m4/ntp_ipv6.m4 \
 	$(top_srcdir)/sntp/m4/ntp_lib_m.m4 \
 	$(top_srcdir)/sntp/m4/ntp_libevent.m4 \
@@ -203,10 +204,6 @@ CPP = @CPP@
 CPPFLAGS = @CPPFLAGS@
 CPPFLAGS_LIBEVENT = @CPPFLAGS_LIBEVENT@
 CPPFLAGS_NTP = @CPPFLAGS_NTP@
-CXX = @CXX@
-CXXCPP = @CXXCPP@
-CXXDEPMODE = @CXXDEPMODE@
-CXXFLAGS = @CXXFLAGS@
 CYGPATH_W = @CYGPATH_W@
 DCFD = @DCFD@
 DEFS = @DEFS@
@@ -259,6 +256,7 @@ LN_S = @LN_S@
 LSCF = @LSCF@
 LTHREAD_LIBS = @LTHREAD_LIBS@
 LTLIBOBJS = @LTLIBOBJS@
+LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
 MAKEINFO = @MAKEINFO@
 MAKE_ADJTIMED = @MAKE_ADJTIMED@
 MAKE_CHECK_LAYOUT = @MAKE_CHECK_LAYOUT@
@@ -322,6 +320,9 @@ NTPTRACE_DL = @NTPTRACE_DL@
 NTPTRACE_DS = @NTPTRACE_DS@
 NTPTRACE_MS = @NTPTRACE_MS@
 NTPTRACE_NI = @NTPTRACE_NI@
+NTP_HARD_CFLAGS = @NTP_HARD_CFLAGS@
+NTP_HARD_CPPFLAGS = @NTP_HARD_CPPFLAGS@
+NTP_HARD_LDFLAGS = @NTP_HARD_LDFLAGS@
 NTP_KEYGEN_DB = @NTP_KEYGEN_DB@
 NTP_KEYGEN_DL = @NTP_KEYGEN_DL@
 NTP_KEYGEN_DS = @NTP_KEYGEN_DS@
@@ -395,7 +396,6 @@ abs_top_builddir = @abs_top_builddir@
 abs_top_srcdir = @abs_top_srcdir@
 ac_ct_AR = @ac_ct_AR@
 ac_ct_CC = @ac_ct_CC@
-ac_ct_CXX = @ac_ct_CXX@
 ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
 am__include = @am__include@
 am__leading_dot = @am__leading_dot@
@@ -170,7 +170,7 @@ inet_pton6(const char *src, unsigned char *dst) {
 				colonp = tp;
 				continue;
 			}
-			if (tp + NS_INT16SZ > endp)
+			if (NS_INT16SZ > endp - tp)
 				return (0);
 			*tp++ = (unsigned char) (val >> 8) & 0xff;
 			*tp++ = (unsigned char) val & 0xff;
@@ -178,7 +178,7 @@ inet_pton6(const char *src, unsigned char *dst) {
 			val = 0;
 			continue;
 		}
-		if (ch == '.' && ((tp + NS_INADDRSZ) <= endp) &&
+		if (ch == '.' && (NS_INADDRSZ <= endp - tp) &&
 		    inet_pton4(curtok, tp) > 0) {
 			tp += NS_INADDRSZ;
 			seen_xdigits = 0;
@@ -187,7 +187,7 @@ inet_pton6(const char *src, unsigned char *dst) {
 		return (0);
 	}
 	if (seen_xdigits) {
-		if (tp + NS_INT16SZ > endp)
+		if (NS_INT16SZ > endp - tp)
 			return (0);
 		*tp++ = (unsigned char) (val >> 8) & 0xff;
 		*tp++ = (unsigned char) val & 0xff;
@@ -280,7 +280,6 @@ isc_netaddr_masktoprefixlen(const isc_netaddr_t *s, unsigned int *lenp) {
 	for (; i < ipbytes; i++) {
 		if (p[i] != 0)
 			return (ISC_R_MASKNONCONTIG);
-		i++;
 	}
 	*lenp = nbytes * 8 + nbits;
 	return (ISC_R_SUCCESS);
@@ -73,6 +73,7 @@ libntp_a_SRCS =						\
 	iosignal.c					\
 	is_ip_address.c					\
 	lib_strbuf.c					\
+	libssl_compat.c					\
 	machines.c					\
 	mktime.c					\
 	modetoa.c					\
@@ -118,10 +119,14 @@ libntpsim_a_SOURCES = systime_s.c $(libntp_a_SRCS)
 EXTRA_libntp_a_SOURCES = adjtimex.c

 AM_CFLAGS = $(CFLAGS_NTP)
+AM_CFLAGS += $(NTP_HARD_CFLAGS)

 AM_CPPFLAGS  = $(NTP_INCS)
 AM_CPPFLAGS += $(LIBOPTS_CFLAGS)
 AM_CPPFLAGS += $(CPPFLAGS_NTP)
+AM_CPPFLAGS += $(NTP_HARD_CPPFLAGS)
+
+AM_LDFLAGS = $(NTP_HARD_LDFLAGS)

 EXTRA_DIST = README

@@ -109,6 +109,7 @@ am__aclocal_m4_deps = $(top_srcdir)/sntp/libopts/m4/libopts.m4 \
 	$(top_srcdir)/sntp/m4/ntp_dir_sep.m4 \
 	$(top_srcdir)/sntp/m4/ntp_facilitynames.m4 \
 	$(top_srcdir)/sntp/m4/ntp_googletest.m4 \
+	$(top_srcdir)/sntp/m4/ntp_harden.m4 \
 	$(top_srcdir)/sntp/m4/ntp_ipv6.m4 \
 	$(top_srcdir)/sntp/m4/ntp_lib_m.m4 \
 	$(top_srcdir)/sntp/m4/ntp_libevent.m4 \
@@ -150,15 +151,15 @@ am__libntp_a_SOURCES_DIST = systime.c a_md5encrypt.c adjtime.c \
 	calyearstart.c clocktime.c clocktypes.c decodenetnum.c \
 	dofptoa.c dolfptoa.c emalloc.c findconfig.c getopt.c \
 	hextoint.c hextolfp.c humandate.c icom.c iosignal.c \
-	is_ip_address.c lib_strbuf.c machines.c mktime.c modetoa.c \
-	mstolfp.c msyslog.c netof.c ntp_calendar.c ntp_crypto_rnd.c \
-	ntp_intres.c ntp_libopts.c ntp_lineedit.c ntp_random.c \
-	ntp_rfc2553.c ntp_worker.c numtoa.c numtohost.c octtoint.c \
-	prettydate.c refidsmear.c recvbuff.c refnumtoa.c snprintf.c \
-	socket.c socktoa.c socktohost.c ssl_init.c statestr.c strdup.c \
-	strl_obsd.c syssignal.c timetoa.c timevalops.c uglydate.c \
-	vint64ops.c work_fork.c work_thread.c ymd2yd.c \
-	$(srcdir)/../lib/isc/assertions.c \
+	is_ip_address.c lib_strbuf.c libssl_compat.c machines.c \
+	mktime.c modetoa.c mstolfp.c msyslog.c netof.c ntp_calendar.c \
+	ntp_crypto_rnd.c ntp_intres.c ntp_libopts.c ntp_lineedit.c \
+	ntp_random.c ntp_rfc2553.c ntp_worker.c numtoa.c numtohost.c \
+	octtoint.c prettydate.c refidsmear.c recvbuff.c refnumtoa.c \
+	snprintf.c socket.c socktoa.c socktohost.c ssl_init.c \
+	statestr.c strdup.c strl_obsd.c syssignal.c timetoa.c \
+	timevalops.c uglydate.c vint64ops.c work_fork.c work_thread.c \
+	ymd2yd.c $(srcdir)/../lib/isc/assertions.c \
 	$(srcdir)/../lib/isc/buffer.c \
 	$(srcdir)/../lib/isc/backtrace-emptytbl.c \
 	$(srcdir)/../lib/isc/backtrace.c \
@@ -209,20 +210,21 @@ am__objects_4 = a_md5encrypt.$(OBJEXT) adjtime.$(OBJEXT) \
 	getopt.$(OBJEXT) hextoint.$(OBJEXT) hextolfp.$(OBJEXT) \
 	humandate.$(OBJEXT) icom.$(OBJEXT) iosignal.$(OBJEXT) \
 	is_ip_address.$(OBJEXT) lib_strbuf.$(OBJEXT) \
-	machines.$(OBJEXT) mktime.$(OBJEXT) modetoa.$(OBJEXT) \
-	mstolfp.$(OBJEXT) msyslog.$(OBJEXT) netof.$(OBJEXT) \
-	ntp_calendar.$(OBJEXT) ntp_crypto_rnd.$(OBJEXT) \
-	ntp_intres.$(OBJEXT) ntp_libopts.$(OBJEXT) \
-	ntp_lineedit.$(OBJEXT) ntp_random.$(OBJEXT) \
-	ntp_rfc2553.$(OBJEXT) ntp_worker.$(OBJEXT) numtoa.$(OBJEXT) \
-	numtohost.$(OBJEXT) octtoint.$(OBJEXT) prettydate.$(OBJEXT) \
-	refidsmear.$(OBJEXT) recvbuff.$(OBJEXT) refnumtoa.$(OBJEXT) \
-	snprintf.$(OBJEXT) socket.$(OBJEXT) socktoa.$(OBJEXT) \
-	socktohost.$(OBJEXT) ssl_init.$(OBJEXT) statestr.$(OBJEXT) \
-	strdup.$(OBJEXT) strl_obsd.$(OBJEXT) syssignal.$(OBJEXT) \
-	timetoa.$(OBJEXT) timevalops.$(OBJEXT) uglydate.$(OBJEXT) \
-	vint64ops.$(OBJEXT) work_fork.$(OBJEXT) work_thread.$(OBJEXT) \
-	ymd2yd.$(OBJEXT) $(am__objects_3) $(am__objects_1)
+	libssl_compat.$(OBJEXT) machines.$(OBJEXT) mktime.$(OBJEXT) \
+	modetoa.$(OBJEXT) mstolfp.$(OBJEXT) msyslog.$(OBJEXT) \
+	netof.$(OBJEXT) ntp_calendar.$(OBJEXT) \
+	ntp_crypto_rnd.$(OBJEXT) ntp_intres.$(OBJEXT) \
+	ntp_libopts.$(OBJEXT) ntp_lineedit.$(OBJEXT) \
+	ntp_random.$(OBJEXT) ntp_rfc2553.$(OBJEXT) \
+	ntp_worker.$(OBJEXT) numtoa.$(OBJEXT) numtohost.$(OBJEXT) \
+	octtoint.$(OBJEXT) prettydate.$(OBJEXT) refidsmear.$(OBJEXT) \
+	recvbuff.$(OBJEXT) refnumtoa.$(OBJEXT) snprintf.$(OBJEXT) \
+	socket.$(OBJEXT) socktoa.$(OBJEXT) socktohost.$(OBJEXT) \
+	ssl_init.$(OBJEXT) statestr.$(OBJEXT) strdup.$(OBJEXT) \
+	strl_obsd.$(OBJEXT) syssignal.$(OBJEXT) timetoa.$(OBJEXT) \
+	timevalops.$(OBJEXT) uglydate.$(OBJEXT) vint64ops.$(OBJEXT) \
+	work_fork.$(OBJEXT) work_thread.$(OBJEXT) ymd2yd.$(OBJEXT) \
+	$(am__objects_3) $(am__objects_1)
 am_libntp_a_OBJECTS = systime.$(OBJEXT) $(am__objects_4)
 libntp_a_OBJECTS = $(am_libntp_a_OBJECTS)
 libntpsim_a_AR = $(AR) $(ARFLAGS)
@@ -233,15 +235,15 @@ am__libntpsim_a_SOURCES_DIST = systime_s.c a_md5encrypt.c adjtime.c \
 	calyearstart.c clocktime.c clocktypes.c decodenetnum.c \
 	dofptoa.c dolfptoa.c emalloc.c findconfig.c getopt.c \
 	hextoint.c hextolfp.c humandate.c icom.c iosignal.c \
-	is_ip_address.c lib_strbuf.c machines.c mktime.c modetoa.c \
-	mstolfp.c msyslog.c netof.c ntp_calendar.c ntp_crypto_rnd.c \
-	ntp_intres.c ntp_libopts.c ntp_lineedit.c ntp_random.c \
-	ntp_rfc2553.c ntp_worker.c numtoa.c numtohost.c octtoint.c \
-	prettydate.c refidsmear.c recvbuff.c refnumtoa.c snprintf.c \
-	socket.c socktoa.c socktohost.c ssl_init.c statestr.c strdup.c \
-	strl_obsd.c syssignal.c timetoa.c timevalops.c uglydate.c \
-	vint64ops.c work_fork.c work_thread.c ymd2yd.c \
-	$(srcdir)/../lib/isc/assertions.c \
+	is_ip_address.c lib_strbuf.c libssl_compat.c machines.c \
+	mktime.c modetoa.c mstolfp.c msyslog.c netof.c ntp_calendar.c \
+	ntp_crypto_rnd.c ntp_intres.c ntp_libopts.c ntp_lineedit.c \
+	ntp_random.c ntp_rfc2553.c ntp_worker.c numtoa.c numtohost.c \
+	octtoint.c prettydate.c refidsmear.c recvbuff.c refnumtoa.c \
+	snprintf.c socket.c socktoa.c socktohost.c ssl_init.c \
+	statestr.c strdup.c strl_obsd.c syssignal.c timetoa.c \
+	timevalops.c uglydate.c vint64ops.c work_fork.c work_thread.c \
+	ymd2yd.c $(srcdir)/../lib/isc/assertions.c \
 	$(srcdir)/../lib/isc/buffer.c \
 	$(srcdir)/../lib/isc/backtrace-emptytbl.c \
 	$(srcdir)/../lib/isc/backtrace.c \
@@ -365,10 +367,6 @@ CPP = @CPP@
 CPPFLAGS = @CPPFLAGS@
 CPPFLAGS_LIBEVENT = @CPPFLAGS_LIBEVENT@
 CPPFLAGS_NTP = @CPPFLAGS_NTP@
-CXX = @CXX@
-CXXCPP = @CXXCPP@
-CXXDEPMODE = @CXXDEPMODE@
-CXXFLAGS = @CXXFLAGS@
 CYGPATH_W = @CYGPATH_W@
 DCFD = @DCFD@
 DEFS = @DEFS@
@@ -421,6 +419,7 @@ LN_S = @LN_S@
 LSCF = @LSCF@
 LTHREAD_LIBS = @LTHREAD_LIBS@
 LTLIBOBJS = @LTLIBOBJS@
+LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
 MAKEINFO = @MAKEINFO@
 MAKE_ADJTIMED = @MAKE_ADJTIMED@
 MAKE_CHECK_LAYOUT = @MAKE_CHECK_LAYOUT@
@@ -484,6 +483,9 @@ NTPTRACE_DL = @NTPTRACE_DL@
 NTPTRACE_DS = @NTPTRACE_DS@
 NTPTRACE_MS = @NTPTRACE_MS@
 NTPTRACE_NI = @NTPTRACE_NI@
+NTP_HARD_CFLAGS = @NTP_HARD_CFLAGS@
+NTP_HARD_CPPFLAGS = @NTP_HARD_CPPFLAGS@
+NTP_HARD_LDFLAGS = @NTP_HARD_LDFLAGS@
 NTP_KEYGEN_DB = @NTP_KEYGEN_DB@
 NTP_KEYGEN_DL = @NTP_KEYGEN_DL@
 NTP_KEYGEN_DS = @NTP_KEYGEN_DS@
@@ -557,7 +559,6 @@ abs_top_builddir = @abs_top_builddir@
 abs_top_srcdir = @abs_top_srcdir@
 ac_ct_AR = @ac_ct_AR@
 ac_ct_CC = @ac_ct_CC@
-ac_ct_CXX = @ac_ct_CXX@
 ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
 am__include = @am__include@
 am__leading_dot = @am__leading_dot@
@@ -665,6 +666,7 @@ libntp_a_SRCS = \
 	iosignal.c					\
 	is_ip_address.c					\
 	lib_strbuf.c					\
+	libssl_compat.c					\
 	machines.c					\
 	mktime.c					\
 	modetoa.c					\
@@ -708,8 +710,10 @@ libntp_a_SRCS = \
 libntp_a_SOURCES = systime.c $(libntp_a_SRCS)
 libntpsim_a_SOURCES = systime_s.c $(libntp_a_SRCS)
 EXTRA_libntp_a_SOURCES = adjtimex.c
-AM_CFLAGS = $(CFLAGS_NTP)
-AM_CPPFLAGS = $(NTP_INCS) $(LIBOPTS_CFLAGS) $(CPPFLAGS_NTP)
+AM_CFLAGS = $(CFLAGS_NTP) $(NTP_HARD_CFLAGS)
+AM_CPPFLAGS = $(NTP_INCS) $(LIBOPTS_CFLAGS) $(CPPFLAGS_NTP) \
+	$(NTP_HARD_CPPFLAGS)
+AM_LDFLAGS = $(NTP_HARD_LDFLAGS)
 EXTRA_DIST = README
 NTP_INCS = -I$(top_srcdir)/include -I$(top_srcdir)/lib/isc/include \
 	-I$(top_srcdir)/lib/isc/$(LIBISC_PTHREADS_NOTHREADS)/include \
@@ -813,6 +817,7 @@ distclean-compile:
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/is_ip_address.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/lib.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/lib_strbuf.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libssl_compat.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/log.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/machines.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/md5.Po@am__quote@
@@ -26,7 +26,7 @@ MD5authencrypt(
 {
 	u_char	digest[EVP_MAX_MD_SIZE];
 	u_int	len;
-	EVP_MD_CTX ctx;
+	EVP_MD_CTX *ctx;

 	/*
 	 * Compute digest of key concatenated with packet. Note: the
@@ -34,18 +34,20 @@ MD5authencrypt(
 	 * was creaded.
 	 */
 	INIT_SSL();
-#if defined(OPENSSL) && OPENSSL_VERSION_NUMBER >= 0x0090700fL
-	if (!EVP_DigestInit(&ctx, EVP_get_digestbynid(type))) {
+	ctx = EVP_MD_CTX_new();
+	if (!(ctx && EVP_DigestInit(ctx, EVP_get_digestbynid(type)))) {
 		msyslog(LOG_ERR,
 		    "MAC encrypt: digest init failed");
+		EVP_MD_CTX_free(ctx);
 		return (0);
 	}
-#else
-	EVP_DigestInit(&ctx, EVP_get_digestbynid(type));
-#endif
-	EVP_DigestUpdate(&ctx, key, cache_secretsize);
-	EVP_DigestUpdate(&ctx, (u_char *)pkt, length);
-	EVP_DigestFinal(&ctx, digest, &len);
+	EVP_DigestUpdate(ctx, key, cache_secretsize);
+	EVP_DigestUpdate(ctx, (u_char *)pkt, length);
+	EVP_DigestFinal(ctx, digest, &len);
+	EVP_MD_CTX_free(ctx);
+	/* If the MAC is longer than the MAX then truncate it. */
+	if (len > MAX_MAC_LEN - 4)
+	    len = MAX_MAC_LEN - 4;
 	memmove((u_char *)pkt + length + 4, digest, len);
 	return (len + 4);
 }
@@ -67,7 +69,7 @@ MD5authdecrypt(
 {
 	u_char	digest[EVP_MAX_MD_SIZE];
 	u_int	len;
-	EVP_MD_CTX ctx;
+	EVP_MD_CTX *ctx;

 	/*
 	 * Compute digest of key concatenated with packet. Note: the
@@ -75,24 +77,26 @@ MD5authdecrypt(
 	 * was created.
 	 */
 	INIT_SSL();
-#if defined(OPENSSL) && OPENSSL_VERSION_NUMBER >= 0x0090700fL
-	if (!EVP_DigestInit(&ctx, EVP_get_digestbynid(type))) {
+	ctx = EVP_MD_CTX_new();
+	if (!(ctx && EVP_DigestInit(ctx, EVP_get_digestbynid(type)))) {
 		msyslog(LOG_ERR,
 		    "MAC decrypt: digest init failed");
+		EVP_MD_CTX_free(ctx);
 		return (0);
 	}
-#else
-	EVP_DigestInit(&ctx, EVP_get_digestbynid(type));
-#endif
-	EVP_DigestUpdate(&ctx, key, cache_secretsize);
-	EVP_DigestUpdate(&ctx, (u_char *)pkt, length);
-	EVP_DigestFinal(&ctx, digest, &len);
+	EVP_DigestUpdate(ctx, key, cache_secretsize);
+	EVP_DigestUpdate(ctx, (u_char *)pkt, length);
+	EVP_DigestFinal(ctx, digest, &len);
+	EVP_MD_CTX_free(ctx);
+	/* If the MAC is longer than the MAX then truncate it. */
+	if (len > MAX_MAC_LEN - 4)
+	    len = MAX_MAC_LEN - 4;
 	if (size != (size_t)len + 4) {
 		msyslog(LOG_ERR,
 		    "MAC decrypt: MAC length error");
 		return (0);
 	}
-	return !isc_tsmemcmp(digest, (const char *)pkt + length + 4, len);
+	return !isc_tsmemcmp(digest, (u_char *)pkt + length + 4, len);
 }

 /*
@@ -106,7 +110,7 @@ addr2refid(sockaddr_u *addr)
 {
 	u_char		digest[20];
 	u_int32		addr_refid;
-	EVP_MD_CTX	ctx;
+	EVP_MD_CTX	*ctx;
 	u_int		len;

 	if (IS_IPV4(addr))
@@ -114,24 +118,23 @@ addr2refid(sockaddr_u *addr)

 	INIT_SSL();

-#if defined(OPENSSL) && OPENSSL_VERSION_NUMBER >= 0x0090700fL
-	EVP_MD_CTX_init(&ctx);
+	ctx = EVP_MD_CTX_new();
+	EVP_MD_CTX_init(ctx);
 #ifdef EVP_MD_CTX_FLAG_NON_FIPS_ALLOW
 	/* MD5 is not used as a crypto hash here. */
-	EVP_MD_CTX_set_flags(&ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
+	EVP_MD_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
 #endif
-	if (!EVP_DigestInit_ex(&ctx, EVP_md5(), NULL)) {
+	if (!EVP_DigestInit_ex(ctx, EVP_md5(), NULL)) {
 		msyslog(LOG_ERR,
 		    "MD5 init failed");
+		EVP_MD_CTX_free(ctx);	/* pedantic... but safe */
 		exit(1);
 	}
-#else
-	EVP_DigestInit(&ctx, EVP_md5());
-#endif

-	EVP_DigestUpdate(&ctx, (u_char *)PSOCK_ADDR6(addr),
+	EVP_DigestUpdate(ctx, (u_char *)PSOCK_ADDR6(addr),
 	    sizeof(struct in6_addr));
-	EVP_DigestFinal(&ctx, digest, &len);
+	EVP_DigestFinal(ctx, digest, &len);
+	EVP_MD_CTX_free(ctx);
 	memcpy(&addr_refid, digest, sizeof(addr_refid));
 	return (addr_refid);
 }
@@ -46,6 +46,19 @@
 # include <ctype.h>
 #endif

+
+/* 
+ * 4.4BSD-Lite switched to an unsigned long ioctl arg.  Detect common
+ * derivatives here, and apply that type. To make the following code
+ * less verbose we make a proper typedef.
+ * The joy of IOCTL programming...
+ */
+# if defined(__FreeBSD__) || defined(__APPLE__) || defined(__NetBSD__) || defined __OpenBSD__
+typedef unsigned long ioctl_arg_T;
+#else
+typedef int ioctl_arg_T;
+#endif
+
 /*
 * Global variables
 */
@@ -54,13 +67,14 @@ static struct audio_device device; /* audio device ident */
 #endif /* HAVE_SYS_AUDIOIO_H */
 #ifdef PCM_STYLE_SOUND
 # define INIT_FILE "/etc/ntp.audio"
-int agc =	SOUND_MIXER_WRITE_RECLEV; /* or IGAIN or LINE */
-int monitor =	SOUND_MIXER_WRITE_VOLUME; /* or OGAIN */
-int devmask = 0;
-int recmask = 0;
-char cf_c_dev[100], cf_i_dev[100], cf_agc[100], cf_monitor[100];

-const char *m_names[SOUND_MIXER_NRDEVICES] = SOUND_DEVICE_NAMES;
+static ioctl_arg_T agc		= SOUND_MIXER_WRITE_RECLEV; /* or IGAIN or LINE */
+static ioctl_arg_T audiomonitor	= SOUND_MIXER_WRITE_VOLUME; /* or OGAIN */
+static int devmask = 0;
+static int recmask = 0;
+static char cf_c_dev[100], cf_i_dev[100], cf_agc[100], cf_monitor[100];
+
+static const char *m_names[SOUND_MIXER_NRDEVICES] = SOUND_DEVICE_NAMES;
 #else /* not PCM_STYLE_SOUND */
 static struct audio_info info;	/* audio device info */
 #endif /* not PCM_STYLE_SOUND */
@@ -334,7 +348,7 @@ audio_init(
 		/* devmask */
 		i = mixer_name(cf_monitor, devmask);
 		if (i >= 0)
-			monitor = MIXER_WRITE(i);
+                       audiomonitor = MIXER_WRITE(i);
 		else
 			printf("monitor %s not in devmask %#x\n",
 			       cf_monitor, devmask);
@@ -347,7 +361,7 @@ audio_init(
 # ifdef HAVE_SYS_AUDIOIO_H
 	info.record.buffer_size = bufsiz;
 # endif /* HAVE_SYS_AUDIOIO_H */
-	rval = ioctl(ctl_fd, (int)AUDIO_SETINFO, (char *)&info);
+	rval = ioctl(ctl_fd, AUDIO_SETINFO, (char *)&info);
 	if (rval < 0) {
 		msyslog(LOG_ERR, "audio: invalid control device parameters");
 		close(ctl_fd);
@@ -412,7 +426,7 @@ audio_gain(
 # endif
 		l |= r << 8;
 		if (cf_monitor[0] != '\0')
-			rval = ioctl(ctl_fd, monitor, &l );
+                       rval = ioctl(ctl_fd, audiomonitor, &l );
 		else 
 			rval = ioctl(ctl_fd, SOUND_MIXER_WRITE_VOLUME,
 				     &l);
@@ -448,7 +462,7 @@ audio_gain(
 		o_port = port;
 	}
 #else /* not PCM_STYLE_SOUND */
-	ioctl(ctl_fd, (int)AUDIO_GETINFO, (char *)&info);
+	ioctl(ctl_fd, AUDIO_GETINFO, (char *)&info);
 	info.record.encoding = AUDIO_ENCODING_ULAW;
 	info.record.error = 0;
 	info.record.gain = gain;
@@ -456,7 +470,7 @@ audio_gain(
 		o_mongain = info.monitor_gain = mongain;
 	if (o_port != port)
 		o_port = info.record.port = port;
-	rval = ioctl(ctl_fd, (int)AUDIO_SETINFO, (char *)&info);
+	rval = ioctl(ctl_fd, AUDIO_SETINFO, (char *)&info);
 	if (rval < 0) {
 		msyslog(LOG_ERR, "audio_gain: %m");
 		return (rval);
@@ -485,11 +499,11 @@ audio_show(void)

 #else /* not PCM_STYLE_SOUND */
 # ifdef HAVE_SYS_AUDIOIO_H
-	ioctl(ctl_fd, (int)AUDIO_GETDEV, &device);
+	ioctl(ctl_fd, AUDIO_GETDEV, &device);
 	printf("audio: name %s, version %s, config %s\n",
 	    device.name, device.version, device.config);
 # endif /* HAVE_SYS_AUDIOIO_H */
-	ioctl(ctl_fd, (int)AUDIO_GETINFO, (char *)&info);
+	ioctl(ctl_fd, AUDIO_GETINFO, (char *)&info);
 	printf(
 	    "audio: rate %d, chan %d, prec %d, code %d, gain %d, mon %d, port %d\n",
 	    info.record.sample_rate, info.record.channels,
@@ -250,7 +250,7 @@ auth_moremem(
 	i = (keycount > 0)
 		? keycount
 		: MEMINC;
-	sk = emalloc_zero(i * sizeof(*sk) + MOREMEM_EXTRA_ALLOC);
+	sk = eallocarrayxz(i, sizeof(*sk), MOREMEM_EXTRA_ALLOC);
 #ifdef DEBUG
 	base = sk;
 #endif
@@ -83,10 +83,11 @@ ereallocz(
 #define MUL_NO_OVERFLOW	((size_t)1 << (sizeof(size_t) * 4))

 void *
-oreallocarray(
+oreallocarrayxz(
 	void *optr,
 	size_t nmemb,
-	size_t size
+	size_t size,
+	size_t extra
 #ifdef EREALLOC_CALLSITE		/* ntp_malloc.h */
 	,
 	const char *	file,
@@ -106,9 +107,9 @@ oreallocarray(
 		exit(1);
 	}
 #ifndef EREALLOC_CALLSITE
-	return ereallocz(optr, (size * nmemb), 0, FALSE);
+	return ereallocz(optr, extra + (size * nmemb), 0, TRUE);
 #else
-	return ereallocz(optr, (size * nmemb), 0, FALSE, file, line);
+	return ereallocz(optr, extra + (size * nmemb), 0, TRUE, file, line);
 #endif
 }

@@ -0,0 +1,338 @@
+/*
+ * libssl_compat.c -- OpenSSL v1.1 compatibility functions
+ *
+ * ---------------------------------------------------------------------
+ * Written by Juergen Perlinger <perlinger@ntp.org> for the NTP project
+ *
+ * Based on an idea by Kurt Roeckx <kurt@roeckx.be>
+ *
+ * ---------------------------------------------------------------------
+ * This is a clean room implementation of shim functions that have
+ * counterparts in the OpenSSL v1.1 API but not in earlier versions. So
+ * while OpenSSL broke binary compatibility with v1.1, this shim module
+ * should provide the necessary source code compatibility with older
+ * versions of OpenSSL.
+ * ---------------------------------------------------------------------
+ */
+#include "config.h"
+#include "ntp_types.h"
+
+/* ----------------------------------------------------------------- */
+#ifdef OPENSSL
+# include <string.h>
+# include <openssl/bn.h>
+# include <openssl/evp.h>
+#endif
+/* ----------------------------------------------------------------- */
+
+/* ----------------------------------------------------------------- */
+#if defined(OPENSSL) && OPENSSL_VERSION_NUMBER < 0x10100000L
+/* ----------------------------------------------------------------- */
+
+#include "libssl_compat.h"
+#include "ntp_assert.h"
+
+/* --------------------------------------------------------------------
+ * replace a BIGNUM owned by the caller with another one if it's not
+ * NULL, taking over the ownership of the new value. This clears & frees
+ * the old value -- the clear might be overkill, but it's better to err
+ * on the side of paranoia here.
+ */
+static void
+replace_bn_nn(
+	BIGNUM **	ps,
+	BIGNUM *	n
+	)
+{
+	if (n) {
+		REQUIRE(*ps != n);
+		BN_clear_free(*ps);
+		*ps = n;
+	}
+}
+
+/* --------------------------------------------------------------------
+ * allocation and deallocation of prime number callbacks
+ */
+BN_GENCB*
+sslshimBN_GENCB_new(void)
+{
+	return calloc(1,sizeof(BN_GENCB));
+}
+
+void
+sslshimBN_GENCB_free(
+	BN_GENCB	*cb
+	)
+{
+	free(cb);
+}
+
+/* --------------------------------------------------------------------
+ * allocation and deallocation of message digests
+ */
+EVP_MD_CTX*
+sslshim_EVP_MD_CTX_new(void)
+{
+	return calloc(1, sizeof(EVP_MD_CTX));
+}
+
+void
+sslshim_EVP_MD_CTX_free(
+	EVP_MD_CTX *	pctx
+	)
+{
+	free(pctx);
+}
+
+/* --------------------------------------------------------------------
+ * get EVP keys and key type
+ */
+int
+sslshim_EVP_PKEY_id(
+	const EVP_PKEY *pkey
+	)
+{
+	return (pkey) ? pkey->type : EVP_PKEY_NONE;
+}
+
+int
+sslshim_EVP_PKEY_base_id(
+	const EVP_PKEY *pkey
+	)
+{
+	return (pkey) ? EVP_PKEY_type(pkey->type) : EVP_PKEY_NONE;
+}
+
+RSA*
+sslshim_EVP_PKEY_get0_RSA(
+	EVP_PKEY *	pkey
+	)
+{
+	return (pkey) ? pkey->pkey.rsa : NULL;
+}
+
+DSA*
+sslshim_EVP_PKEY_get0_DSA(
+	EVP_PKEY *	pkey
+	)
+{
+	return (pkey) ? pkey->pkey.dsa : NULL;
+}
+
+/* --------------------------------------------------------------------
+ * set/get RSA params
+ */
+void
+sslshim_RSA_get0_key(
+	const RSA *	prsa,
+	const BIGNUM **	pn,
+	const BIGNUM **	pe,
+	const BIGNUM **	pd
+	)
+{
+	REQUIRE(prsa != NULL);
+
+	if (pn)
+		*pn = prsa->n;
+	if (pe)
+		*pe = prsa->e;
+	if (pd)
+		*pd = prsa->d;
+}
+
+int
+sslshim_RSA_set0_key(
+	RSA *		prsa,
+	BIGNUM *	n,
+	BIGNUM *	e,
+	BIGNUM *	d
+	)
+{
+	REQUIRE(prsa != NULL);
+	if (!((prsa->n || n) && (prsa->e || e)))
+		return 0;
+
+	replace_bn_nn(&prsa->n, n);
+	replace_bn_nn(&prsa->e, e);
+	replace_bn_nn(&prsa->d, d);
+	
+	return 1;
+}
+
+void
+sslshim_RSA_get0_factors(
+	const RSA *	prsa,
+	const BIGNUM **	pp,
+	const BIGNUM **	pq
+	)
+{
+	REQUIRE(prsa != NULL);
+
+	if (pp)
+		*pp = prsa->p;
+	if (pq)
+		*pq = prsa->q;
+}
+
+int
+sslshim_RSA_set0_factors(
+	RSA    *	prsa,
+	BIGNUM *	p,
+	BIGNUM *	q
+	)
+{
+	REQUIRE(prsa != NULL);
+	if (!((prsa->p || p) && (prsa->q || q)))
+		return 0;
+
+	replace_bn_nn(&prsa->p, p);
+	replace_bn_nn(&prsa->q, q);
+
+	return 1;
+}
+
+int
+sslshim_RSA_set0_crt_params(
+	RSA    *	prsa,
+	BIGNUM *	dmp1,
+	BIGNUM *	dmq1,
+	BIGNUM *	iqmp
+	)
+{
+	REQUIRE(prsa != NULL);
+	if (!((prsa->dmp1 || dmp1) &&
+	      (prsa->dmq1 || dmq1) &&
+	      (prsa->iqmp || iqmp) ))
+		return 0;
+
+	replace_bn_nn(&prsa->dmp1, dmp1);
+	replace_bn_nn(&prsa->dmq1, dmq1);
+	replace_bn_nn(&prsa->iqmp, iqmp);
+	
+	return 1;
+}
+
+/* --------------------------------------------------------------------
+ * set/get DSA signature parameters
+ */
+void
+sslshim_DSA_SIG_get0(
+	const DSA_SIG *	psig,
+	const BIGNUM **	pr,
+	const BIGNUM **	ps
+	)
+{
+	REQUIRE(psig != NULL);
+
+	if (pr != NULL)
+		*pr = psig->r;
+	if (ps != NULL)
+		*ps = psig->s;
+}
+
+int
+sslshim_DSA_SIG_set0(
+	DSA_SIG *	psig,
+	BIGNUM *	r,
+	BIGNUM *	s
+	)
+{
+	REQUIRE(psig != NULL);
+	if (!(r && s))
+		return 0;
+
+	replace_bn_nn(&psig->r, r);
+	replace_bn_nn(&psig->s, s);
+	
+	return 1;
+}
+
+/* --------------------------------------------------------------------
+ * get/set DSA parameters
+ */
+void
+sslshim_DSA_get0_pqg(
+	const DSA *	pdsa,
+	const BIGNUM **	pp,
+	const BIGNUM **	pq,
+	const BIGNUM **	pg
+	)
+{
+	REQUIRE(pdsa != NULL);
+
+	if (pp != NULL)
+		*pp = pdsa->p;
+	if (pq != NULL)
+		*pq = pdsa->q;
+	if (pg != NULL)
+		*pg = pdsa->g;
+}
+
+int
+sslshim_DSA_set0_pqg(
+	DSA *		pdsa,
+	BIGNUM *	p,
+	BIGNUM *	q,
+	BIGNUM *	g
+	)
+{
+	if (!((pdsa->p || p) && (pdsa->q || q) && (pdsa->g || g)))
+		return 0;
+
+	replace_bn_nn(&pdsa->p, p);
+	replace_bn_nn(&pdsa->q, q);
+	replace_bn_nn(&pdsa->g, g);
+
+	return 1;
+}
+
+void
+sslshim_DSA_get0_key(
+	const DSA *	pdsa,
+	const BIGNUM **	ppub_key,
+	const BIGNUM **	ppriv_key
+	)
+{
+	REQUIRE(pdsa != NULL);
+
+	if (ppub_key != NULL)
+		*ppub_key = pdsa->pub_key;
+	if (ppriv_key != NULL)
+		*ppriv_key = pdsa->priv_key;
+}
+
+int
+sslshim_DSA_set0_key(
+	DSA *		pdsa,
+	BIGNUM *	pub_key,
+	BIGNUM *	priv_key
+	)
+{
+	REQUIRE(pdsa != NULL);
+	if (!(pdsa->pub_key || pub_key))
+		return 0;
+
+	replace_bn_nn(&pdsa->pub_key, pub_key);
+	replace_bn_nn(&pdsa->priv_key, priv_key);
+
+	return 1;
+}
+
+int
+sslshim_X509_get_signature_nid(
+	const X509 *x
+	)
+{
+	return OBJ_obj2nid(x->sig_alg->algorithm);
+}
+
+/* ----------------------------------------------------------------- */
+#else /* OPENSSL && OPENSSL_VERSION_NUMBER >= v1.1.0 */
+/* ----------------------------------------------------------------- */
+
+NONEMPTY_TRANSLATION_UNIT
+
+/* ----------------------------------------------------------------- */
+#endif
+/* ----------------------------------------------------------------- */
@@ -91,7 +91,7 @@
 /*
 *---------------------------------------------------------------------
 * replacing the 'time()' function
- * --------------------------------------------------------------------
+ *---------------------------------------------------------------------
 */

 static systime_func_ptr systime_func = &time;
@@ -395,7 +395,7 @@ ntpcal_get_build_date(
 /*
 *---------------------------------------------------------------------
 * basic calendar stuff
- * --------------------------------------------------------------------
+ *---------------------------------------------------------------------
 */

 /* month table for a year starting with March,1st */
@@ -443,11 +443,11 @@ static const uint16_t real_month_table[2][13] = {
 */

 /*
- * ==================================================================
+ * ====================================================================
 *
 * General algorithmic stuff
 *
- * ==================================================================
+ * ====================================================================
 */

 /*
@@ -495,7 +495,7 @@ static const uint16_t real_month_table[2][13] = {
 * 32/16bit divisions and is still performant is a bit more
 * difficult. Since most usecases can be coded in a way that does only
 * require the 32-bit version a 64bit version is NOT provided here.
- * ---------------------------------------------------------------------
+ *---------------------------------------------------------------------
 */
 int32_t
 ntpcal_periodic_extend(
@@ -542,8 +542,35 @@ ntpcal_periodic_extend(
 	return pivot;
 }

+/*---------------------------------------------------------------------
+ * Note to the casual reader
+ *
+ * In the next two functions you will find (or would have found...)
+ * the expression
+ *
+ *   res.Q_s -= 0x80000000;
+ *
+ * There was some ruckus about a possible programming error due to
+ * integer overflow and sign propagation.
+ *
+ * This assumption is based on a lack of understanding of the C
+ * standard. (Though this is admittedly not one of the most 'natural'
+ * aspects of the 'C' language and easily to get wrong.)
+ *
+ * see 
+ *	http://www.open-std.org/jtc1/sc22/wg14/www/docs/n1570.pdf
+ *	"ISO/IEC 9899:201x Committee Draft — April 12, 2011"
+ *	6.4.4.1 Integer constants, clause 5
+ *
+ * why there is no sign extension/overflow problem here.
+ *
+ * But to ease the minds of the doubtful, I added back the 'u' qualifiers
+ * that somehow got lost over the last years. 
+ */
+
+
 /*
- *-------------------------------------------------------------------
+ *---------------------------------------------------------------------
 * Convert a timestamp in NTP scale to a 64bit seconds value in the UN*X
 * scale with proper epoch unfolding around a given pivot or the current
 * system time. This function happily accepts negative pivot values as
@@ -553,7 +580,7 @@ ntpcal_periodic_extend(
 * This is also a periodic extension, but since the cycle is 2^32 and
 * the shift is 2^31, we can do some *very* fast math without explicit
 * divisions.
- *-------------------------------------------------------------------
+ *---------------------------------------------------------------------
 */
 vint64
 ntpcal_ntp_to_time(
@@ -568,7 +595,7 @@ ntpcal_ntp_to_time(
 	res.q_s = (pivot != NULL)
 		      ? *pivot
 		      : now();
-	res.Q_s -= 0x80000000;		/* unshift of half range */
+	res.Q_s -= 0x80000000u;		/* unshift of half range */
 	ntp	-= (uint32_t)JAN_1970;	/* warp into UN*X domain */
 	ntp	-= res.D_s.lo;		/* cycle difference	 */
 	res.Q_s += (uint64_t)ntp;	/* get expanded time	 */
@@ -581,7 +608,7 @@ ntpcal_ntp_to_time(
 		  ? *pivot
 		  : now();
 	res = time_to_vint64(&tmp);
-	M_SUB(res.D_s.hi, res.D_s.lo, 0, 0x80000000);
+	M_SUB(res.D_s.hi, res.D_s.lo, 0, 0x80000000u);
 	ntp -= (uint32_t)JAN_1970;	/* warp into UN*X domain */
 	ntp -= res.D_s.lo;		/* cycle difference	 */
 	M_ADD(res.D_s.hi, res.D_s.lo, 0, ntp);
@@ -592,7 +619,7 @@ ntpcal_ntp_to_time(
 }

 /*
- *-------------------------------------------------------------------
+ *---------------------------------------------------------------------
 * Convert a timestamp in NTP scale to a 64bit seconds value in the NTP
 * scale with proper epoch unfolding around a given pivot or the current
 * system time.
@@ -602,7 +629,7 @@ ntpcal_ntp_to_time(
 * This is also a periodic extension, but since the cycle is 2^32 and
 * the shift is 2^31, we can do some *very* fast math without explicit
 * divisions.
- *-------------------------------------------------------------------
+ *---------------------------------------------------------------------
 */
 vint64
 ntpcal_ntp_to_ntp(
@@ -617,7 +644,7 @@ ntpcal_ntp_to_ntp(
 	res.q_s = (pivot)
 		      ? *pivot
 		      : now();
-	res.Q_s -= 0x80000000;		/* unshift of half range */
+	res.Q_s -= 0x80000000u;		/* unshift of half range */
 	res.Q_s += (uint32_t)JAN_1970;	/* warp into NTP domain	 */
 	ntp	-= res.D_s.lo;		/* cycle difference	 */
 	res.Q_s += (uint64_t)ntp;	/* get expanded time	 */
@@ -642,20 +669,20 @@ ntpcal_ntp_to_ntp(


 /*
- * ==================================================================
+ * ====================================================================
 *
 * Splitting values to composite entities
 *
- * ==================================================================
+ * ====================================================================
 */

 /*
- *-------------------------------------------------------------------
+ *---------------------------------------------------------------------
 * Split a 64bit seconds value into elapsed days in 'res.hi' and
 * elapsed seconds since midnight in 'res.lo' using explicit floor
 * division. This function happily accepts negative time values as
 * timestamps before the respective epoch start.
- * -------------------------------------------------------------------
+ *---------------------------------------------------------------------
 */
 ntpcal_split
 ntpcal_daysplit(
@@ -736,11 +763,11 @@ ntpcal_daysplit(
 }

 /*
- *-------------------------------------------------------------------
+ *---------------------------------------------------------------------
 * Split a 32bit seconds value into h/m/s and excessive days.  This
 * function happily accepts negative time values as timestamps before
 * midnight.
- * -------------------------------------------------------------------
+ *---------------------------------------------------------------------
 */
 static int32_t
 priv_timesplit(
@@ -773,7 +800,7 @@ priv_timesplit(
 }

 /*
- * ---------------------------------------------------------------------
+ *---------------------------------------------------------------------
 * Given the number of elapsed days in the calendar era, split this
 * number into the number of elapsed years in 'res.hi' and the number
 * of elapsed days of that year in 'res.lo'.
@@ -1053,11 +1080,11 @@ ntpcal_time_to_date(


 /*
- * ==================================================================
+ * ====================================================================
 *
 * merging composite entities
 *
- * ==================================================================
+ * ====================================================================
 */

 /*
@@ -1251,8 +1278,8 @@ ntpcal_edate_to_eradays(
 * Convert ELAPSED years/months/days of gregorian calendar to elapsed
 * days in year.
 *
- * Note: This will give the true difference to the start of the given year,
- * even if months & days are off-scale.
+ * Note: This will give the true difference to the start of the given
+ * year, even if months & days are off-scale.
 *---------------------------------------------------------------------
 */
 int32_t
@@ -1434,11 +1461,11 @@ ntpcal_date_to_time(


 /*
- * ==================================================================
+ * ====================================================================
 *
 * extended and unchecked variants of caljulian/caltontp
 *
- * ==================================================================
+ * ====================================================================
 */
 int
 ntpcal_ntp64_to_date(
@@ -1500,11 +1527,11 @@ ntpcal_date_to_ntp(


 /*
- * ==================================================================
+ * ====================================================================
 *
 * day-of-week calculations
 *
- * ==================================================================
+ * ====================================================================
 */
 /*
 * Given a RataDie and a day-of-week, calculate a RDN that is reater-than,
@@ -1557,7 +1584,7 @@ ntpcal_weekday_lt(
 }

 /*
- * ==================================================================
+ * ====================================================================
 *
 * ISO week-calendar conversions
 *
@@ -1601,7 +1628,7 @@ ntpcal_weekday_lt(
 * smallest possible powers of two, so the division can be implemented
 * as shifts if the optimiser chooses to do so.
 *
- * ==================================================================
+ * ====================================================================
 */

 /*