ignore replies with timestamps after 2030 to prevent time_t / tv_sec wraps

input & ok theo

src/usr.sbin/ntpd/client.c

@@ -1,4 +1,4 @@
-/*	$OpenBSD: client.c,v 1.84 2009/03/04 19:17:36 stevesk Exp $ */
+/*	$OpenBSD: client.c,v 1.85 2009/04/22 07:42:17 henning Exp $ */
 
 /*
  * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org>
@@ -256,6 +256,16 @@ client_dispatch(struct ntp_peer *p, u_int8_t settime)
 	T2 = lfp_to_d(msg.rectime);
 	T3 = lfp_to_d(msg.xmttime);
 
+	/*
+	 * XXX workaround: time_t / tv_sec must never wrap.
+	 * around 2020 we will need a solution (64bit time_t / tv_sec).
+	 * consider every answer with a timestamp beyond january 2030 bogus.
+	 */
+	if (T2 > JAN_2030 || T3 > JAN_2030) {
+		set_next(p, error_interval());
+		return (0);
+	}
+
 	p->reply[p->shift].offset = ((T2 - T1) + (T3 - T4)) / 2;
 	p->reply[p->shift].delay = (T4 - T1) - (T3 - T2);
 	if (p->reply[p->shift].delay < 0) {

src/usr.sbin/ntpd/ntp.h

@@ -1,4 +1,4 @@
-/*	$OpenBSD: ntp.h,v 1.12 2007/05/26 21:20:35 henning Exp $ */
+/*	$OpenBSD: ntp.h,v 1.13 2009/04/22 07:42:17 henning Exp $ */
 
 /*
  * Copyright (c) 2004 Henning Brauer <henning@openbsd.org>
@@ -141,6 +141,7 @@ struct ntp_query {
 #define	MODE_RES2	7	/* reserved for private use */
 
 #define	JAN_1970	2208988800UL	/* 1970 - 1900 in seconds */
+#define	JAN_2030	1893456000UL + JAN_1970	/* 1. 1. 2030 00:00:00 */
 
 #define	NTP_VERSION	4
 #define	NTP_MAXSTRATUM	15