ok reyk@, bcook@

part of the original ISC license that we use in OpenBSD.  Done for
files were Henning is the original author.
OK henning@ deraadt@

for ntpd(8), removing the pledge call is a first step: futher redesign will occurs later.
ok reyk@ benno@

titles (including flags) to distinguish between daemons, this makes it
possible to manage multiple copies of a daemon using the normal infrastructure
by symlinking rc.d scripts to a new name. ok jung@ ajacoutot@, smtpd ok gilles@

process management of the contraint processes has been moved from ntp
to the parent, for better privsep and pledge, but the ntp process
still attempted to kill the constraints on timeout directly.  Fix this
regression by introducing a new imsg from ntp to the parent and the
related logic to kill a constraint at the right place.
Reported & tested by bcook@
Ok bcook@

ok reyk@

Instead, check the return value of fprintf() and fflush()
and call clearerr() before returning on error.  OK jca@

OK bcook@ jung@

used by the constraint processes setup later (chroot, setuid...)
[late getpwnam discovered during a further audit]
ok millert

and coping with error conditions... that lets us avoid a pledge "wpath".
Putting it all together, this lets the master ntpd pledge "stdio rpath
inet settime proc id".  It works like this: "rpath" to load the
certificates, "proc" to create constraint processes, "id" to chroot
and lock the constraint processes into a jail, then "inet" to open a
https session.  "settime" is used by the master to manage the system
time when the ntp-speaking engine instructs the master.
with help from naddy

This helps the ntp process to a) give a better pledge(2) and to b)
keep the promise of "saving the world again... on time" by removing
the delays that have been introduced by expensive constraint forks.
The new design offers better privsep but introduces a few more imsgs
and runs a little bit more code in the privileged parent.  The
privileged code is minimal, carefully checked, and does not attempt to
"parse" any contents; the forked constraints instantly drop all
privileges and pledge to "stdio inet".
OK beck@ deraadt@

since that is all it will do till termination.

ok phessler@ deraadt@

while here i've reformatted the page to stop kidding that -s is 4 options;
original issue kind of spotted by adam thompson, though note i am not fixing the
issue he complained about (i'll address that mail in a minute);

ntp_dns some years ago).
OK henning@

OK henning@ deraadt@

time from HTTPS servers, by parsing the Date: header, and use the
median constraint time as a boundary to verify NTP responses.  This
adds some level of authentication and protection against MITM attacks
while preserving the accuracy of the NTP protocol; without relying on
authentication options for NTP that are basically unavailable at
present.  This is an initial implementation and the semantics will be
improved once it is in the tree.
Discussed with deraadt@ and henning@
OK henning@

If the network is unreachable when ntpd starts and host_dns fails, be sure
that we still close the HOST_DNS imsg.
Thanks to Paul de Weerd <weerd at weirdnet dot nl> for reporting this.
ok beck@

This simplifies things and make action = -1 no longer a dead store.
Also, spell FALLTHROUGH consistently.
reported by fritjof@alokat.org

daemon.
Old drift files will be interpreted as a minuscule adjustment and
ntpd will proceed to rediscover the drift, like starting from zero
on a newly installed machine.
ok deraadt@

from Paul B. Henson, ok phessler@

- Nothing seems to free the result of host_dns(), so add host_dns_free() and
call after each query.
- If imsg_add() fails, it frees buf. Avoid subsequently dereferencing the
freed buf in imsg_close().
ok millert@ deraadt@

peanuts -- but all work has to start somewhere.

Reduces the number of log.c snowflakes by a little, and gives ntpd a
variadic fatal() function to be used later.
ok deraadt@

This avoids a namespace conflict with Solaris build environments.
discussed with deraadt@ and kettenis@

ok jsing@ phessler@ naddy@

dns process at normal priority.  Should improve latency on loaded machines.
ok henning@

all the other tools do. changes option 'sensors' to 'Sensors'.
ok henning@, and grudgingly phessler@

every time
ok jmc

ok krw

NB: this utility has only one option, and it's not optional! i haven;t
marked -s as being mandatory, since hopefully someone will make
ntpctl run without arguments do something useful;

* For time_t values, use the printf("%lld", (long long)t) idiom.
* Don't print "Invalid program name" in usage() when main() just runs ntpd.
* Make "Show/Shows" consistent in the manual, sort .Xr and correct .Ox.
OK phessler@

diff from Mike Miller <mmiller mgm51 com> (many thanks!)
OK phessler@, henning@, todd@

ok henning@

by the dns engine.
ok henning@

ibuf, buf_read to ibuf_read, READ_BUF_SIZE to IBUF_READ_SIZE.
ok henning gilles claudio jacekm deraadt

behavior change.
ok eric@

i remember we already had the confusion and bgpd doesn't have the endpwent

ok henning@, 'I think I agree' otto@

ok henning@

corrupt contents. ok henning@

Diff from Gleydson Soares gsoares (at) gmail (dot) com
OK henning@

offset. The 180s limit doesn't help very much these days.
ok otto@ mbalmer@