From 4cf98f2633565c5894948a10e61cbc24ab829828 Mon Sep 17 00:00:00 2001
From: naddy <>
Date: Sat, 5 Mar 2016 16:09:20 +0000
Subject: [PATCH] According to RFC7231, section 7.1.1.1, the HTTP date header
 supports no other timezone than the fixed string "GMT".  Avoid using strptime
 %Z, which is nonstandard and can give surprising results on other operating
 systems.  ok deraadt@ giovanni@ bcook@

---
 src/usr.sbin/ntpd/constraint.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/usr.sbin/ntpd/constraint.c b/src/usr.sbin/ntpd/constraint.c
index 169007e4..e09c654d 100644
--- a/src/usr.sbin/ntpd/constraint.c
+++ b/src/usr.sbin/ntpd/constraint.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: constraint.c,v 1.25 2016/01/27 21:48:34 reyk Exp $	*/
+/*	$OpenBSD: constraint.c,v 1.26 2016/03/05 16:09:20 naddy Exp $	*/
 
 /*
  * Copyright (c) 2015 Reyk Floeter <reyk@openbsd.org>
@@ -903,7 +903,7 @@ httpsdate_request(struct httpsdate *httpsdate, struct timeval *when)
 		 * or ANSI C's asctime() - the latter doesn't include
 		 * the timezone which is required here.
 		 */
-		if (strptime(p, "%a, %d %h %Y %T %Z",
+		if (strptime(p, "%a, %d %h %Y %T GMT",
 		    &httpsdate->tls_tm) == NULL) {
 			log_warnx("unsupported date format");
 			free(line);