If the time is wrong, we cannot validate dnssec, leading to failed
DNS lookups, so we cannot adjust or set the time.  Work around this
by repeating a failed DNS lookup with a lookup with the DC (check
disabled) bit set. ok florian@

larger types really is a range reduction...
Almost any cast to (unsigned) is a bug.
ok millert tb benno

Actually specify whether the certificate is not yet valid or has expired,
and log the actual time values to hopefully save some head scratching.
ok deraadt@ tb@

Spotted by tb@
ok deraadt@ tb@

Given that we're getting a constraint so that we can validate time, if our
own time is out we can fail the automatic validity checking since it is
based on the wallclock. Instead, disable the automatic validity checking
and perform manual checks based on the time reported from the server via
the HTTP header.
Discussed at length with and ok deraadt@

anything larger than an int. ok jca@ rsadowski@

This brings over the logic from bgpd & ospfd.
Input & OK deraadt

bonus: this exposed a few missing const qualifiers.

ok beck@ bluhm@ tb@

We already require TLSv1.2 so it does not make sense to be liberal with the
cipher suites that we allow. Additionally, it is potentially dangerous to
disable certificate verification when no CA data is available (which is
currently an impossible case to reach).
Also ensure we check the return value from tls_config_set_ca_mem() (as
spotted by tb@).
ok kn@ tb@

(and other lexers too)
This commit rectifies earlier change:
in the lex... even inside quotes, a \ followed by space or tab should
expand to space or tab, and a \ followed by newline should be ignored
(as a line continuation).  compatible with the needs of hoststated
(which has the most strict quoted string requirements), and ifstated
(where one commonly does line continuations in strings).
OK deraadt@, OK millert@

Merge host_v{4,6}() into much simpler host_ip() using just getaddrinfo().
host_dns() uses the same procedure.
OK naddy

job at startup.  After much anguish I accept dlg's solution of chdir
for the problem ("starting ntpd on a filesystem I want to unmount"),
but we cannot change the main-process daemon() call.  Why?  Because
the ntpd privsep design predates more modern designs where the config
file is parsed once, and configuration marshalled to the fork+exec
children.  Instead each ntpd process re-parses the config, and if
we chdir before fork+exec startup, it will move the basedir causing
-f "relativepath" to fail.
discussed with florian

constraints process), and /usr/sbin/ntpd "x" to perform fork+exec operations.

harm if not deleted after the daemon is shutdown and at the same time we also
tackle another attack surface by not allowing the program to create/delete
any more files (by removing "cpath" promise from pledge(2)).
Discussion initiated by a question from deraadt@ OK florian@

currently doesn't call the function control_cleanup to do so. The solution is
to simply call that function just before the program quits.
"sure" henning@

as unsynced. reported by naddy, also seen by me (I noticed because
monitoring-plugins check_ntp complained). ok claudio henning

sensors, mark us unsynced again. ok reyk krw, pt out / discussion / help naddy

calloc or strdup), we just need to log that we ran out of memory in a
particular function.
Recommended by florian@ and deraadt@
ok benno@ henning@ tb@

running out of memory.
Next step, be correct *and* consistent.
ok dennis@ tb@ benno@ schwarze@

the text about enabling it;
ok deraadt

in "query from"; ok phessler@ job@

some cases.
OK naddy@ henning@

address for outgoing ntp queries.
From Job Snijders, thanks!
with feedback and ok henning@

warn with the same severity.  Switch log_warn() to LOG_ERR and keep
fatal() at LOG_CRIT.
OK reyk@ florian@

terminated by a null pointer.
ok rzalamena@ reyk@

This replaces log_verbose() and "extern int verbose" with the two functions
log_setverbose() and log_getverbose().
Pointed out by benno@
OK krw@ eric@ gilles@ (OK gilles@ for the snmpd bits as well)

TAILQ_FOREACH().
No intentional functional change.
ok reyk@

so it is safe calling log_* after an error without loosing the it.

using the heap.
ok bcook@

variables that were also never used
OK otto@

to send message to the child process. Do like we learned in httpd(8).
ok deraadt@

this should fix the problem with random ntpd(8) deaths.
ok deraadt@

additional actions before printing it.  OK rzalamena@

case the dup2() would fail silently and the descriptor would remain with
the CLOEXEC flag causing the exec*()d child process to have unexpected
behavior.
ok guenther@

with this change we get the pledge() ability back to the parent process.
some tweaks from and ok reyk@

it, remove some verbose shutdown messages that we had before with pipe
close.
ok reyk@

ok reyk@, bcook@

obvious why it is implemented this way.  The whole idea of constraints
is to isolate them as much as possible, in a semi-paranoid way.
OK rzalamena@

OK from the original author Alexander Guy

part of the original ISC license that we use in OpenBSD.  Done for
files were Henning is the original author.
OK henning@ deraadt@

ok deraadt@

changes - map the previous configuration to the equivalent in the new
groups. This will be revisited post release.
Discussed with beck@

became more visible recently because a log_debug was changed to
log_warnx.  Change it back for now.
ok jsing

ensure that we load the CA certificates and use tls_connect_servername()
so that we can verify the server we are connecting to (even though we've
already resolved the hostname). Also add additional warnings for TLS
connect and TLS write failures so that we know what is happening and why.
Lack of server name verification also reported by Luis M. Merino
<luismiguelmerino at gmail dot com> - thanks!
ok deraadt@ reyk@