used in situations where https constraints cannot be used and we still want
auto settime. Result of discussion with and ok deraadt@

ok deraadt@

are relative to monotime; so they shift when time is being adjusted.
2) Fix a race between SIGCHLD delivery and reading the result imsg.
3) Some cleanup: use a number to distinguish pools internally

ok benno@

larger types really is a range reduction...
Almost any cast to (unsigned) is a bug.
ok millert tb benno

(and other lexers too)
This commit rectifies earlier change:
in the lex... even inside quotes, a \ followed by space or tab should
expand to space or tab, and a \ followed by newline should be ignored
(as a line continuation).  compatible with the needs of hoststated
(which has the most strict quoted string requirements), and ifstated
(where one commonly does line continuations in strings).
OK deraadt@, OK millert@

calloc or strdup), we just need to log that we ran out of memory in a
particular function.
Recommended by florian@ and deraadt@
ok benno@ henning@ tb@

running out of memory.
Next step, be correct *and* consistent.
ok dennis@ tb@ benno@ schwarze@

in "query from"; ok phessler@ job@

address for outgoing ntp queries.
From Job Snijders, thanks!
with feedback and ok henning@

so servers with numeric IP addresses won't be skipped; ok reyk@

non-sensical.  The dns lookups happened in the process routing table
(usually '0'), which is very likely to have different results from the
other routing domains.  If you do depend on having this behaviour,
you'll need to use pf to cross the rtable boundary.
"listen on * rtable X" is still supported.
Users of "server * rtable X" will need to switch to launching ntpd with
"route -T X exec /usr/sbin/ntpd"
OK deraadt@

ok phessler@ deraadt@

addresses and try one after another until the connection succeeded -
based on the existing mechanism of "server".  "constraint" previously
only tried to connect to the first returned address, aborted and
skipped the constraint on failure.  In difference to "constraints"
(plural), it still only connects to one address at a time and not to
all of them at once.
Pointed out by rpe@
OK rpe@ deraadt@

Fixes segfault on configuration load time, as reported by Donovan Watteau.

allows to get constraint addresses even if network/DNS is not
available at startup (or system boot).
thumbs up & OK henning@

time from HTTPS servers, by parsing the Date: header, and use the
median constraint time as a boundary to verify NTP responses.  This
adds some level of authentication and protection against MITM attacks
while preserving the accuracy of the NTP protocol; without relying on
authentication options for NTP that are basically unavailable at
present.  This is an initial implementation and the semantics will be
improved once it is in the tree.
Discussed with deraadt@ and henning@
OK henning@

generations don't try to change any of the values and break the code.
ok deraadt

Reduces the number of log.c snowflakes by a little, and gives ntpd a
variadic fatal() function to be used later.
ok deraadt@

Fixes a pfctl crash with an anchor name containing
an embedded nul found with the afl fuzzer.
pfctl parse.y patch from and ok deraadt@

No yyerror() calls needed to be changed.
ok bluhm@

format string, create a temporary message.
OK claudio@

found by millert@, ok deraadt@

OK claudio@ henning@

OK markus@ henning@ phessler@ jmc@

noticed by zepard at gmail
OK henning@

This basically adds the "rtable %d" keyword to "listen on", "server",
"servers" keywords, to specify which routing table to use.
OK henning@ claudio@ sthen@
manpage reviewed by jmc@

problem reported with the obvious fix for bgpd by Sebastian Benoit
<benoit-lists at fb12.de>, also PR 6432
applied to all the others by yours truly. ok theo
isn't it amazing how far this parser (and more) spread?

allocations fails.
looks right deraadt, krw
ok henning

user-configurable reference ID, eg. "GPS" or "DCF"...
ok mbalmer

but only do the final popfile call after yyparse() is done.
This also fixes config reload on SIGHUP for some daemons.
Spotted by otto@. OK deraadt@

it with a simple filter in the yylex() loop.
The compression in lgetc() didn't happen for quoted strings,
thus creating a regression when tabs were used in variables.
Some testing by todd@ and pyr@
OK deraadt@

ok henning@

Requested and OK deraadt@

expand to space or tab, and a \ followed by newline should be ignored
(as a line continuation).  compatible with the needs of hoststated
(which has the most strict quoted string requirements), and ifstated
(where one commonly does line continuations in strings).
pointed out by mpf, discussed with pyr

yylex implementation and the code which interacts with yylex.  this also
brings the future potential for include support to all of the parsers.
in the future please do not silly modifications to one of these files
without checking if you are de-unifying the code.
checked by developers in all these areas.

as found in hoststated, and make all the code diff as clean as possible. a
few issues remain mostly surrounding include support, which will likely be
added to more of the grammers soon.
ok norby pyr, others

ok beck

negative parameters.  extend lex to spot numbers in the stream.  as well,
make it easier to add parameters on command line in any order later
ok otto ckuethe

ULONG_MAX does not work; the max upper bound is LONG_MAX,
since LONG_MAX == LLONG_MAX on 64bit archs. ok deraadt@ henning@

weight timedelta sensors higher than ntp peers, for example
ok deraadt mbalmer

to use. "sensors *" just uses all. untested due to lack of hardware.
hacked on the road somewhere between vancouver and calgary

other things work.  ok henning