ntp: Vendor import of ntp-4.2.8p18

Merge commit '1f833b3fc9968c3dd7ed79ccf0525ebf16c891ad' into main (cherry picked from commit f5f40dd63b)
2024-07-08 20:26:31 +00:00 · 2024-05-26 18:41:22 -07:00 · 2024-05-26 18:41:22 -07:00 · 6f3fd5d45e
commit 6f3fd5d45e
parent 4010c267a5
351 changed files with 19273 additions and 9829 deletions
--- a/contrib/ntp/COPYRIGHT
+++ b/contrib/ntp/COPYRIGHT
@ -3,7 +3,7 @@ This file is automatically generated from html/copyright.html

   jpg "Clone me," says Dolly sheepishly.

-   Last update: 2-Mar-2023 05:21 UTC
+   Last update: 7-Jan-2024 00:29 UTC
     __________________________________________________________________

   The following copyright notice applies to all files collectively called
@ -32,7 +32,7 @@ This file is automatically generated from html/copyright.html
   Hart, Danny Mayer, Martin Burnicki, and possibly others is:
 ***********************************************************************
 *                                                                     *
-* Copyright (c) Network Time Foundation 2011-2023                     *
+* Copyright (c) Network Time Foundation 2011-2024                     *
 *                                                                     *
 * All Rights Reserved                                                 *
 *                                                                     *
--- a/contrib/ntp/ChangeLog
+++ b/contrib/ntp/ChangeLog
@ -1,3 +1,121 @@
+---
+(4.2.8p18) 2024/05/25 Released by Harlan Stenn <stenn@ntp.org>
+
+* [Bug 3918] Tweak openssl header/library handling. <stenn@ntp.org>
+* [Bug 3914] Spurious "Unexpected origin timestamp" logged after time
+             stepped. <hart@ntp.org>
+* [Bug 3913] Avoid duplicate IPv6 link-local manycast associations.
+             <hart@ntp.org>
+* [Bug 3912] Avoid rare math errors in ntptrace.  <brian.utterback@oracle.com>
+* [Bug 3910] Memory leak using openssl-3 <hart@ntp.org>
+* [Bug 3909] Do not select multicast local address for unicast peer.
+             <hart@ntp.org>
+* [Bug 3903] lib/isc/win32/strerror.c NTstrerror() is not thread-safe.
+             <hart@ntp.org>
+* [Bug 3901] LIB_GETBUF isn't thread-safe. <hart@ntp.org>
+* [Bug 3900] fast_xmit() selects wrong local addr responding to mcast on
+             Windows. <hart@ntp.org>
+* [Bug 3888] ntpd with multiple same-subnet IPs using manycastclient creates
+             duplicate associations. <hart@ntp.org>
+* [Bug 3872] Ignore restrict mask for hostname. <hart@ntp.org>
+* [Bug 3871] 4.2.8p17 build without hopf6021 refclock enabled fails.
+             Reported by Hans Mayer.  Moved NONEMPTY_TRANSLATION_UNIT
+             declaration from ntp_types.h to config.h.  <hart@ntp.org>
+* [Bug 3870] Server drops client packets with ppoll < 4.  <stenn@ntp.org>
+* [Bug 3869] Remove long-gone "calldelay" & "crypto sign" from docs.
+             Reported by PoolMUC@web.de. <hart@ntp.org>
+* [Bug 3868] Cannot restrict a pool peer. <hart@ntp.org>  Thanks to
+             Edward McGuire for tracking down the deficiency.
+* [Bug 3864] ntpd IPv6 refid different for big-endian and little-endian.
+             <hart@ntp.org>
+* [Bug 3859] Use NotifyIpInterfaceChange on Windows ntpd. <hart@ntp.org>
+* [Bug 3856] Enable Edit & Continue debugging with Visual Studio.
+             <hart@ntp.org>
+* [Bug 3855] ntpq lacks an equivalent to ntpdc's delrestrict. <hart@ntp.org>
+* [Bug 3854] ntpd 4.2.8p17 corrupts rawstats file with space in refid.
+             <hart@ntp.org>
+* [Bug 3853] Clean up warnings with modern compilers. <hart@ntp.org>
+* [Bug 3852] check-libntp.mf and friends are not triggering rebuilds as
+             intended. <hart@ntp.org>
+* [Bug 3851] Drop pool server when no local address can reach it.
+             <hart@ntp.org>
+* [Bug 3850] ntpq -c apeers breaks column formatting s2 w/refclock refid.
+             <hart@ntp.org>
+* [Bug 3849] ntpd --wait-sync times out. <hart@ntp.org>
+* [Bug 3847] SSL detection in configure should run-test if runpath is needed.
+             <hart@ntp.org>
+* [Bug 3846] Use -Wno-format-truncation by default. <hart@ntp.org>
+* [Bug 3845] accelerate pool clock_sync when IPv6 has only link-local access.
+             <hart@ntp.org>
+* [Bug 3842] Windows ntpd PPSAPI DLL load failure crashes. <hart@ntp.org>
+* [Bug 3841] 4.2.8p17 build break w/ gcc 12 -Wformat-security without -Wformat
+             Need to remove --Wformat-security when removing -Wformat to
+             silence numerous libopts warnings.  <hart@ntp.org>
+* [Bug 3837] NULL pointer deref crash when ntpd deletes last interface.
+             Reported by renmingshuai.  Correct UNLINK_EXPR_SLIST() when the
+             list is empty. <hart@ntp.org>
+* [Bug 3835] NTP_HARD_*FLAGS not used by libevent tearoff. <hart@ntp.org>
+* [Bug 3831] pollskewlist zeroed on runtime configuration. <hart@ntp.org>
+* [Bug 3830] configure libevent check intersperses output with answer. <stenn@>
+* [Bug 3828] BK should ignore a git repo in the same directory.
+             <burnicki@ntp.org>
+* [Bug 3827] Fix build in case CLOCK_HOPF6021 or CLOCK_WHARTON_400A
+             is disabled.  <burnicki@ntp.org>
+* [Bug 3825] Don't touch HTML files unless building inside a BK repo.
+             Fix the script checkHtmlFileDates.  <burnicki@ntp.org>
+* [Bug 3756] Improve OpenSSL library/header detection.
+* [Bug 3753] ntpd fails to start with FIPS-enabled OpenSSL 3. <hart@ntp.org>
+* [Bug 2734] TEST3 prevents initial interleave sync.  Fix from <PoolMUC@web.de>
+* Log failures to allocate receive buffers.  <hart@ntp.org>
+* Remove extraneous */ from libparse/ieee754io.c
+* Fix .datecheck target line in Makefile.am.  <stenn@ntp.org>
+* Update the copyright year.  <stenn@ntp.org>
+* Update ntp.conf documentation to add "delrestrict" and correct information
+  about KoD rate limiting.  <hart@ntp.org>
+* html/clockopt.html cleanup.  <stenn@ntp.org>
+* util/lsf-times - added.  <stenn@ntp.org>
+* Add DSA, DSA-SHA, and SHA to tests/libntp/digests.c. <hart@ntp.org>
+* Provide ntpd thread names to debugger on Windows. <hart@ntp.org>
+* Remove dead code libntp/numtohost.c and its unit tests. <hart@ntp.org>
+* Remove class A, B, C IPv4 distinctions in netof(). <hart@ntp.org>
+* Use @configure_input@ in various *.in files to include a comment that
+  the file is generated from another pointing to the *.in. <hart@ntp.org>
+* Correct underquoting, indents in ntp_facilitynames.m4. <hart@ntp.org>
+* Clean up a few warnings seen building with older gcc. <hart@ntp.org>
+* Fix build on older FreeBSD lacking sys/procctl.h. <hart@ntp.org>
+* Disable [Bug 3627] workaround on newer FreeBSD which has the kernel fix
+  that makes it unnecessary, re-enabling ASLR stack gap. <hart@ntp.org>
+* Use NONEMPTY_COMPILATION_UNIT in more conditionally-compiled files.
+* Remove useless pointer to Windows Help from system error messages.
+* Avoid newlines within Windows error messages. <hart@ntp.org>
+* Ensure unique association IDs if wrapped. <hart@ntp.org>
+* Simplify calc_addr_distance(). <hart@ntp.org>
+* Clamp min/maxpoll in edge cases in newpeer(). <hart@ntp.org>
+* Quiet local addr change logging when unpeering. <hart@ntp.org>
+* Correct missing arg for %s printf specifier in 
+  send_blocking_resp_internal(). <hart@ntp.org>
+* Suppress OpenSSL 3 deprecation warning clutter. <hart@ntp.org>
+* Correct OpenSSL usage in Autokey code to avoid warnings about
+  discarding const qualifiers with OpenSSL 3. <hart@ntp.org>
+* Display KoD refid as text in recently added message. <hart@ntp.org>
+* Avoid running checkHtmlFileDates script repeatedly when no html/*.html
+    files have changed. <hart@ntp.org>
+* Abort configure if --enable-crypto-rand given & unavailable. <hart@ntp.org>
+* Add configure --enable-verbose-ssl to trace SSL detection. <hart@ntp.org>
+* Add build test coverage for --disable-saveconfig to flock-build script.
+  <hart@ntp.org>
+* Remove deprecated configure --with-arlib option. <hart@ntp.org>
+* Remove configure support for ISC UNIX ca. 1998. <hart@ntp.org>
+* Move NTP_OPENSSL and NTP_CRYPTO_RAND invocations from configure.ac files
+  to NTP_LIBNTP. <hart@ntp.org>
+* Remove dead code: HAVE_U_INT32_ONLY_WITH_DNS. <hart@ntp.org>
+* Eliminate [v]snprintf redefinition warnings on macOS. <hart@ntp.org>
+* Fix clang 14 cast increases alignment warning on Linux. <hart@ntp.org>
+* Move ENABLE_CMAC to ntp_openssl.m4, reviving sntp/tests CMAC unit tests.
+  <hart@ntp.org>
+* Use NTP_HARD_CPPFLAGS in libopts tearoff. <hart@ntp.org>
+* wire in --enable-build-framework-help
+
 ---
 (4.2.8p17) 2023/06/06 Released by Harlan Stenn <stenn@ntp.org>

@ -10,7 +128,7 @@
 	     Miroslav Lichvar and Matt for rapid testing and identifying the
 	     problem. <hart@ntp.org>
 * Add tests/libntp/digests.c to catch regressions reading keys file or with
-  symmetric authentication digest output.
+  symmetric authentication digest output. <hart@ntp.org>

 ---
 (4.2.8p16) 2023/05/31 Released by Harlan Stenn <stenn@ntp.org>
--- a/contrib/ntp/CommitLog
+++ b/contrib/ntp/CommitLog
--- a/contrib/ntp/Makefile.am
+++ b/contrib/ntp/Makefile.am
@ -66,7 +66,7 @@ DISTCLEANFILES = .gcc-warning
 BUILT_SOURCES =				\
 	.gcc-warning			\
 	libtool				\
-	html/.datecheck			\
+	$(srcdir)/html/.datecheck	\
 	$(srcdir)/COPYRIGHT		\
 	$(srcdir)/.checkChangeLog	\
 	$(NULL)
@ -83,7 +83,7 @@ BUILT_SOURCES =				\
 	@sleep 1
 	@touch $@

-html/.datecheck: FRC.html
+$(srcdir)/html/.datecheck: $(srcdir)/html/*.html
 	cd $(srcdir)/html && \
 	../scripts/build/checkHtmlFileDates

@ -128,7 +128,7 @@ uninstall-local:
 CommitLog: FRC.CommitLog
 	cd $(srcdir)					\
 	&& $(PATH_TEST) -e CommitLog			\
-		-a SCCS/s.ChangeSet -ot CommitLog	\
+		-a .bk/SCCS/ChangeSet,s -ot CommitLog	\
 	|| scripts/build/genCommitLog

 # HMS: The following seems to be a work-in-progress...
--- a/contrib/ntp/Makefile.in
+++ b/contrib/ntp/Makefile.in
@ -420,6 +420,7 @@ PACKAGE_TARNAME = @PACKAGE_TARNAME@
 PACKAGE_URL = @PACKAGE_URL@
 PACKAGE_VERSION = @PACKAGE_VERSION@
 PATH_NET_SNMP_CONFIG = @PATH_NET_SNMP_CONFIG@
+PATH_OPENSSL = @PATH_OPENSSL@
 PATH_PERL = @PATH_PERL@
 PATH_RUBY = @PATH_RUBY@
 PATH_SEPARATOR = @PATH_SEPARATOR@
@ -583,7 +584,7 @@ DISTCLEANFILES = .gcc-warning
 BUILT_SOURCES = \
 	.gcc-warning			\
 	libtool				\
-	html/.datecheck			\
+	$(srcdir)/html/.datecheck	\
 	$(srcdir)/COPYRIGHT		\
 	$(srcdir)/.checkChangeLog	\
 	$(NULL)
@ -1105,7 +1106,7 @@ uninstall-am: uninstall-local
 	@sleep 1
 	@touch $@

-html/.datecheck: FRC.html
+$(srcdir)/html/.datecheck: $(srcdir)/html/*.html
 	cd $(srcdir)/html && \
 	../scripts/build/checkHtmlFileDates

@ -1150,7 +1151,7 @@ uninstall-local:
 CommitLog: FRC.CommitLog
 	cd $(srcdir)					\
 	&& $(PATH_TEST) -e CommitLog			\
-		-a SCCS/s.ChangeSet -ot CommitLog	\
+		-a .bk/SCCS/ChangeSet,s -ot CommitLog	\
 	|| scripts/build/genCommitLog

 .buildcvo:
--- a/contrib/ntp/NEWS
+++ b/contrib/ntp/NEWS
--- a/contrib/ntp/adjtimed/Makefile.in
+++ b/contrib/ntp/adjtimed/Makefile.in
@ -96,6 +96,7 @@ bin_PROGRAMS =
 libexec_PROGRAMS =
 sbin_PROGRAMS =
 EXTRA_PROGRAMS = adjtimed$(EXEEXT)
+@LIBNTP_SUBMAKES_TRUE@am__append_1 = check-libntp
 subdir = adjtimed
 ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
 am__aclocal_m4_deps = $(top_srcdir)/sntp/libopts/m4/libopts.m4 \
@ -389,6 +390,7 @@ PACKAGE_TARNAME = @PACKAGE_TARNAME@
 PACKAGE_URL = @PACKAGE_URL@
 PACKAGE_VERSION = @PACKAGE_VERSION@
 PATH_NET_SNMP_CONFIG = @PATH_NET_SNMP_CONFIG@
+PATH_OPENSSL = @PATH_OPENSSL@
 PATH_PERL = @PATH_PERL@
 PATH_RUBY = @PATH_RUBY@
 PATH_SEPARATOR = @PATH_SEPARATOR@
@ -487,8 +489,8 @@ target_alias = @target_alias@
 top_build_prefix = @top_build_prefix@
 top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
-BUILT_SOURCES = check-libntp .deps-ver
-CLEANFILES = check-libntp .deps-ver
+BUILT_SOURCES = $(am__append_1) .deps-ver
+CLEANFILES = .deps-ver
 DISTCLEANFILES = $(DEPDIR)/deps-ver
 AM_CFLAGS = $(CFLAGS_NTP) $(NTP_HARD_CFLAGS)
 AM_CPPFLAGS = $(NTP_INCS) $(CPPFLAGS_NTP) $(NTP_HARD_CPPFLAGS)
@ -967,11 +969,10 @@ install-exec-hook:

 #

-check-libntp: $(top_builddir)/libntp/libntp.a
-	@: avoid default SCCS get by some make implementations
+.PHONY: check-libntp

-$(top_builddir)/libntp/libntp.a:
-	cd $(top_builddir)/libntp && $(MAKE) $(AM_MAKEFLAGS) libntp.a
+@LIBNTP_SUBMAKES_TRUE@check-libntp:
+@LIBNTP_SUBMAKES_TRUE@	cd $(top_builddir)/libntp && $(MAKE) $(AM_MAKEFLAGS) libntp.a
 $(DEPDIR)/deps-ver: $(top_srcdir)/deps-ver
 	@[ -f $@ ] ||							\
 		cp $(top_srcdir)/deps-ver $@
--- a/contrib/ntp/check-libntp.mf
+++ b/contrib/ntp/check-libntp.mf
@ -3,12 +3,12 @@
 ## sntp/check-libntp.mf
 ## The above file has a version of this for the sntp tree.

+.PHONY: check-libntp
+
+if LIBNTP_SUBMAKES
 BUILT_SOURCES	+= check-libntp
-CLEANFILES	+= check-libntp

-check-libntp: $(top_builddir)/libntp/libntp.a
-	@: avoid default SCCS get by some make implementations
-
-$(top_builddir)/libntp/libntp.a:
+check-libntp:
 	cd $(top_builddir)/libntp && $(MAKE) $(AM_MAKEFLAGS) libntp.a

+endif
--- a/contrib/ntp/check-libntpd.mf
+++ b/contrib/ntp/check-libntpd.mf
@ -4,16 +4,7 @@

 BUILT_SOURCES	+= check-libntpd

-# CLEANFILES addition below won't be needed after a while.
-# Leave it in for now for folks tracking the source repo
-# who have the file from a former version of the rule.
-# DLH Jan 2023
-
-CLEANFILES	+= check-libntpd
-
-check-libntpd: $(top_builddir)/ntpd/libntpd.a
-	 @: avoid default SCCS get by some make implementations
-
-$(top_builddir)/ntpd/libntpd.a:
+.PHONY: check-libntpd
+check-libntpd:
 	cd $(top_builddir)/ntpd && $(MAKE) $(AM_MAKEFLAGS) libntpd.a

--- a/contrib/ntp/check-libunity.mf
+++ b/contrib/ntp/check-libunity.mf
@ -4,10 +4,10 @@
 ## The above file has a version of this for the sntp tree.

 BUILT_SOURCES	+= check-libunity
+CLEANFILES	+= check-libunity

 check-libunity: $(top_builddir)/sntp/unity/libunity.a
-	 @: avoid default SCCS get by some make implementations
+	@echo stamp > $@

 $(top_builddir)/sntp/unity/libunity.a:
 	cd $(top_builddir)/sntp/unity && $(MAKE) $(AM_MAKEFLAGS) libunity.a
-
--- a/contrib/ntp/check-scm-rev.mf
+++ b/contrib/ntp/check-scm-rev.mf
@ -1,8 +1,6 @@
 $(top_srcdir)/sntp/scm-rev: FRC.scm-rev
 	$(AM_V_GEN)cd $(top_builddir)/sntp && $(MAKE) $(AM_MAKEFLAGS) check-scm-rev

+.PHONY: FRC.scm-rev
 FRC.scm-rev:
-	@: FRC.scm-rev "force" depends on nothing and is not a file, so is	\
-	   always out-of-date causing targets which depend on it to also		\
-	   be outdated so their rules to fire each time they are built.
-
+	@: FRC.scm-rev is always out of date, triggering the check every make invocation.
--- a/contrib/ntp/clockstuff/Makefile.in
+++ b/contrib/ntp/clockstuff/Makefile.in
@ -89,6 +89,7 @@ POST_UNINSTALL = :
 build_triplet = @build@
 host_triplet = @host@
 EXTRA_PROGRAMS = propdelay$(EXEEXT) chutest$(EXEEXT)
+@LIBNTP_SUBMAKES_TRUE@am__append_1 = check-libntp
 subdir = clockstuff
 ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
 am__aclocal_m4_deps = $(top_srcdir)/sntp/libopts/m4/libopts.m4 \
@ -384,6 +385,7 @@ PACKAGE_TARNAME = @PACKAGE_TARNAME@
 PACKAGE_URL = @PACKAGE_URL@
 PACKAGE_VERSION = @PACKAGE_VERSION@
 PATH_NET_SNMP_CONFIG = @PATH_NET_SNMP_CONFIG@
+PATH_OPENSSL = @PATH_OPENSSL@
 PATH_PERL = @PATH_PERL@
 PATH_RUBY = @PATH_RUBY@
 PATH_SEPARATOR = @PATH_SEPARATOR@
@ -488,8 +490,8 @@ AM_CPPFLAGS = $(NTP_INCS) $(CPPFLAGS_NTP) $(NTP_HARD_CPPFLAGS)
 LDADD = ../libntp/libntp.a $(LDADD_LIBNTP) $(LIBM) $(PTHREAD_LIBS)
 AM_LDFLAGS = $(NTP_HARD_LDFLAGS)
 propdelay_LDADD = $(LDADD)
-BUILT_SOURCES = check-libntp .deps-ver
-CLEANFILES = check-libntp .deps-ver
+BUILT_SOURCES = $(am__append_1) .deps-ver
+CLEANFILES = .deps-ver
 DISTCLEANFILES = $(DEPDIR)/deps-ver
 NTP_INCS = -I$(top_srcdir)/include \
 	-I$(top_srcdir)/libntp/lib/isc/include \
@ -809,11 +811,10 @@ uninstall-am:
 .PRECIOUS: Makefile


-check-libntp: $(top_builddir)/libntp/libntp.a
-	@: avoid default SCCS get by some make implementations
+.PHONY: check-libntp

-$(top_builddir)/libntp/libntp.a:
-	cd $(top_builddir)/libntp && $(MAKE) $(AM_MAKEFLAGS) libntp.a
+@LIBNTP_SUBMAKES_TRUE@check-libntp:
+@LIBNTP_SUBMAKES_TRUE@	cd $(top_builddir)/libntp && $(MAKE) $(AM_MAKEFLAGS) libntp.a
 $(DEPDIR)/deps-ver: $(top_srcdir)/deps-ver
 	@[ -f $@ ] ||							\
 		cp $(top_srcdir)/deps-ver $@
--- a/contrib/ntp/config.h.in
+++ b/contrib/ntp/config.h.in
@ -496,9 +496,6 @@
 /* Define to 1 if the system has the type `int32'. */
 #undef HAVE_INT32

-/* int32 type in DNS headers, not others. */
-#undef HAVE_INT32_ONLY_WITH_DNS
-
 /* Define to 1 if the system has the type `int32_t'. */
 #undef HAVE_INT32_T

@ -691,9 +688,6 @@
 /* Define to 1 if you have the <openssl/cmac.h> header file. */
 #undef HAVE_OPENSSL_CMAC_H

-/* Define to 1 if you have the <openssl/hmac.h> header file. */
-#undef HAVE_OPENSSL_HMAC_H
-
 /* Define to 1 if the system has the type `pid_t'. */
 #undef HAVE_PID_T

@ -970,7 +964,7 @@
 /* Define to 1 if you have the <sysexits.h> header file. */
 #undef HAVE_SYSEXITS_H

-/* */
+/* syslog.h provides facilitynames */
 #undef HAVE_SYSLOG_FACILITYNAMES

 /* Define to 1 if you have the <sys/audioio.h> header file. */
@ -1035,6 +1029,9 @@
 /* Define to 1 if you have the <sys/prctl.h> header file. */
 #undef HAVE_SYS_PRCTL_H

+/* Define to 1 if you have the <sys/procctl.h> header file. */
+#undef HAVE_SYS_PROCCTL_H
+
 /* Define to 1 if you have the <sys/procset.h> header file. */
 #undef HAVE_SYS_PROCSET_H

@ -1221,9 +1218,6 @@
 /* Define to 1 if the system has the type `u_int32'. */
 #undef HAVE_U_INT32

-/* u_int32 type in DNS headers, not others. */
-#undef HAVE_U_INT32_ONLY_WITH_DNS
-
 /* Define to 1 if you have the <values.h> header file. */
 #undef HAVE_VALUES_H

@ -1477,6 +1471,9 @@
 /* Use OpenSSL? */
 #undef OPENSSL

+/* Suppress OpenSSL 3 deprecation warnings */
+#undef OPENSSL_SUPPRESS_DEPRECATED
+
 /* Should we open the broadcast socket? */
 #undef OPEN_BCAST_SOCKET

@ -1619,10 +1616,6 @@
 /* Is K_TICK_NAME in nanoseconds? */
 #undef TICK_NANO

-/* Define to 1 if you can safely include both <sys/time.h> and <time.h>. This
-   macro is obsolete. */
-#undef TIME_WITH_SYS_TIME
-
 /* Define to 1 if your <sys/time.h> declares `struct tm'. */
 #undef TM_IN_SYS_TIME

@ -1820,15 +1813,8 @@ typedef unsigned int	uintptr_t;
 /* Define to `unsigned int' if <sys/types.h> does not define. */
 #undef size_t

-	
-	    #if !defined(_KERNEL) && !defined(PARSESTREAM)
-	    /*
-	     * stdio.h must be included after _GNU_SOURCE is defined
-	     * but before #define snprintf rpl_snprintf
-	     */
-	    # include <stdio.h>	
-	    #endif
-	
+	#include "c99_snprintf.h"
+    

 /* Define to rpl_snprintf if the replacement function should be used. */
 #undef snprintf
@ -1887,3 +1873,15 @@ typedef union mpinfou {
 	# endif
 	#endif	/* !defined(_KERNEL) && !defined(PARSESTREAM) */
 	
+
+
+	/*
+	 * Macro to use in otherwise-empty source files to comply with ANSI C
+	 * requirement that each translation unit (source file) contain some
+	 * declaration.  This has commonly been done by declaring an unused
+	 * global variable of type int or char.  An extern reference to abs()
+	 * serves the same purpose without bloat.  We once used exit() but
+	 * that can produce warnings on systems that declare exit() noreturn.
+	 */
+	#define	NONEMPTY_TRANSLATION_UNIT	extern int abs(int);
+
--- a/contrib/ntp/configure
+++ b/contrib/ntp/configure
--- a/contrib/ntp/configure.ac
+++ b/contrib/ntp/configure.ac
@ -35,7 +35,7 @@ AC_PRESERVE_HELP_ORDER
 # the date YYYYMMDD optionally with -HHMM if there is more than one
 # bump in a day.

-ntp_configure_cache_version=20230326
+ntp_configure_cache_version=20240218

 # When the cache version of config.cache and configure do not
 # match, NTP_CACHEVERSION will flush the cache.
@ -55,6 +55,23 @@ AC_DEFINE_UNQUOTED([STR_SYSTEM], ["$host"],
 AC_CONFIG_HEADERS([config.h])
 dnl AC_ARG_PROGRAM

+AC_MSG_CHECKING([if we should enable build framework help])
+AC_ARG_ENABLE(
+    [build-framework-help],
+    [AS_HELP_STRING(
+	[--enable-build-framework-help],
+	[+ enable build framework help]
+    )],
+    [ntp_ok=$enableval],
+    [ntp_ok=yes]
+)
+case "$ntp_ok" in
+ yes)
+    ntp_cv_build_framework_help=yes ;;
+ *) ntp_cv_build_framework_help=no ;;
+esac
+AC_MSG_RESULT([$ntp_ok])
+
 ntp_atom_ok=${ntp_atom_ok=no}
 ntp_oncore_ok=${ntp_oncore_ok=no}
 ntp_parse_ok=${ntp_parse_ok=no}
@ -70,7 +87,7 @@ AX_C99_STRUCT_INIT

 NTP_HARDEN([sntp])

-NTP_VPATH_HACK		dnl used only by ntpd/Makefile.am
+NTP_VPATH_HACK		dnl used by ntpd/Makefile.am libparse/Makefile.am

 NTP_LOCINFO([sntp])	dnl takes over from NTP_BINDIR, in NTP_LIBNTP

@ -78,8 +95,7 @@ AM_PROG_AR

 # So far, the only shared library we might use is libopts.
 # It's a small library - we might as well use a static version of it.
-AC_DISABLE_SHARED
-AC_PROG_LIBTOOL
+LT_INIT([disable-shared])
 AC_SUBST([LIBTOOL_DEPS])

 # NTP has (so far) been relying on leading-edge autogen, which
@ -87,7 +103,7 @@ AC_SUBST([LIBTOOL_DEPS])
 # Therefore, by default:
 # - use the version of libopts we ship with
 # - do not install it
-# - build a static copy (AC_DISABLE_SHARED - done earlier)
+# - build a static copy (disable-shared - done earlier)
 case "${enable_local_libopts+set}" in
 set) ;;
 *) enable_local_libopts=yes ;;
@ -103,29 +119,13 @@ NTP_LIBEVENT_CHECK_NOBUILD([2], [sntp/libevent])

 NTP_LIBNTP

-AC_MSG_CHECKING([for deprecated --with-arlib])
-AC_ARG_WITH([arlib],
-	AS_HELP_STRING([--with-arlib], [- deprecated, arlib not distributed]),
-	[ans=$withval], [ans=no])
-AC_MSG_RESULT([$ans])
-
-case "$ans" in
- yes)
-    AC_MSG_WARN([Please do not use --with-arlib, arlib is no longer included.  In the future, --with-arlib will not be recognized.])
-    ;;
-esac
-
 dnl  we need to check for cross compile tools for vxWorks here
 AC_PROG_AWK
 AS_UNSET([ac_cv_prog_AWK])
 AC_SUBST([AWK])				dnl scripts/ntpver.in
 AC_PROG_MAKE_SET

-AC_SUBST([CFLAGS])
-AC_SUBST([LDFLAGS])
-
 AC_PROG_LN_S
-AC_ISC_POSIX


 AC_PATH_PROG([PATH_PERL], [perl])
@ -277,13 +277,13 @@ case "$host" in
 *)
    # HMS: Make sure we check for -lrt for clock_* before this...
    case "$ac_cv_search_clock_gettime" in
-     '') AC_MSG_ERROR([Internal Error: Haven't looked for clock_gettime() yet!]) ;;
+     '') AC_MSG_FAILURE([Internal Error: Haven't looked for clock_gettime() yet!]) ;;
    esac
    AC_SEARCH_LIBS([sched_setscheduler], [rt posix4])
    ;;
 esac

-AC_CHECK_HEADERS([bstring.h])
+AC_CHECK_HEADERS([bstring.h sys/procctl.h])
 AC_CHECK_HEADER(
    [dns_sd.h],
    [AC_SEARCH_LIBS(
@ -3008,23 +3008,7 @@ case "$ntp_libparse" in
 esac
 AC_MSG_RESULT([$ans])

-NTP_OPENSSL
-
-AC_MSG_CHECKING([if we want to enable CMAC support])
-case "$ac_cv_header_openssl_cmac_h" in
- yes)
-    AC_DEFINE([ENABLE_CMAC], [1], [Enable CMAC support?])
-    ans="yes"
-    ;;
- *) ans="no"
-    ;;
-esac
-AC_MSG_RESULT([$ans])
-
-NTP_CRYPTO_RAND
-
-# if we are using OpenSSL (--with-crypto), by default Autokey is enabled
-AC_MSG_CHECKING([if we want to include NTP Autokey protocol support])
+# if we have crypto, by default Autokey is enabled
 AC_ARG_ENABLE(
    [autokey],
    AS_HELP_STRING(
@ -3040,7 +3024,7 @@ case "$ntp_autokey" in
 *)
    case "$ntp_openssl" in
     no)
-	AC_MSG_WARN([Disabling Autokey, --enable-autokey requires --with-crypto.])
+	AC_MSG_WARN([Disabling Autokey, crypto unavailable.])
 	ntp_autokey=no
 	;;
     *)
@ -3050,6 +3034,7 @@ case "$ntp_autokey" in
    esac
    ;;
 esac
+AC_MSG_CHECKING([if NTP Autokey protocol will be supported])
 AC_MSG_RESULT([$ntp_autokey])

 AC_SUBST([MAKE_CHECK_LAYOUT])
@ -4432,6 +4417,18 @@ AC_DEFINE_UNQUOTED([DYNAMIC_INTERLEAVE], [$ntp_dynamic_interleave],
    [support dynamic interleave?])
 AC_MSG_RESULT([$ntp_ok])

+AH_BOTTOM([
+	/*
+	 * Macro to use in otherwise-empty source files to comply with ANSI C
+	 * requirement that each translation unit (source file) contain some
+	 * declaration.  This has commonly been done by declaring an unused
+	 * global variable of type int or char.  An extern reference to abs()
+	 * serves the same purpose without bloat.  We once used exit() but
+	 * that can produce warnings on systems that declare exit() noreturn.
+	 */
+	#define	NONEMPTY_TRANSLATION_UNIT	extern int abs(int);
+])
+
 NTP_UNITYBUILD

 NTP_PROBLEM_TESTS
@ -4455,7 +4452,7 @@ AC_CONFIG_FILES([kernel/sys/Makefile])
 AC_CONFIG_FILES([libntp/Makefile])
 AC_CONFIG_FILES([libparse/Makefile])
 AC_CONFIG_FILES([ntpd/Makefile])
-AC_CONFIG_FILES([ntpd/complete.conf],	[sed -e '/^rlimit$/d' -e '/^$/d' < ntpd/complete.conf > ntpd/complete.conf.new && mv ntpd/complete.conf.new ntpd/complete.conf])
+AC_CONFIG_FILES([ntpd/complete.conf],	[$SED -e '/^rlimit$/d' -e '/^$/d' < ntpd/complete.conf > ntpd/complete.conf.new && mv ntpd/complete.conf.new ntpd/complete.conf])
 AC_CONFIG_FILES([ntpdate/Makefile])
 AC_CONFIG_FILES([ntpdc/Makefile])
 AC_CONFIG_FILES([ntpdc/nl.pl],		[chmod +x ntpdc/nl.pl])
--- a/contrib/ntp/flock-build
+++ b/contrib/ntp/flock-build
@ -34,23 +34,11 @@ case "$PARALLEL_BUILDS" in
 *)  echo Launching $PARALLEL_BUILDS parallel builds on each machine
 esac

-# Backroom:
-#   barnstable	   freebsd-6.1
-#   beauregard	   freebsd-6.0
-# X churchy	   alpha-dec-osf5.1
-#   deacon	   sparc-sun-solaris2.10
-#   grundoon	   freebsd-6.2
-#   howland	   freebsd-6.1
-# o macabre	   freebsd-6.1-STABLE
-# o mort	   freebsd-6.1
-#   whimsy	   sparc-sun-solaris2.10
-
 # Campus:
 # * baldwin	   sparc-sun-solaris2.10
 # * bridgeport	   sparc-sun-solaris2.10
-# * malarky	   sparc-sun-solaris2.10
 # * pogo	   sparc-sun-solaris2.10
-# * rackety	   freebsd-6.1
+# * rackety	   sparc-sun-solaris2.10

 if [ ! -r sntp/libevent/build-aux/config.guess ] ; then
 	echo "Error: bootstrap required." 1>&2 && exit 1
@ -80,8 +68,8 @@ do
 	case "1" in
 	 0)
 	    ssh $i "cd $c_d ; ./build $SIG $PARSE $STD $BUILD_ARGS" &
-	    ssh $i "cd $c_d ; ./build $SIG $PARSE $STD --disable-debugging $BUILD_ARGS" &
-	    ssh $i "cd $c_d ; ./build $SIG $PARSE $STD --without-crypto --enable-c99-snprintf $BUILD_ARGS" &
+	    ssh $i "cd $c_d ; ./build $SIG $PARSE $STD --disable-debugging --disable-saveconfig $BUILD_ARGS" &
+	    ssh $i "cd $c_d ; ./build $SIG $PARSE $STD --without-crypto --enable-c99-snprintf --enable-leap-smear $BUILD_ARGS" &
 	    ssh $i "cd $c_d ; ./build $SIG        $STD --disable-all-clocks --disable-autokey --without-sntp --disable-thread-support $BUILD_ARGS" &
 	    ;;
 	 1)
@ -103,13 +91,13 @@ do

 		case $FB_FIRSTONLY in
 		 '0')
-			./build $SIG $PARSE $STD --disable-debugging $BUILD_ARGS &
+			./build $SIG $PARSE $STD --disable-debugging --disable-saveconfig $BUILD_ARGS &

 			COUNT=\`expr \$COUNT + 1\`
 			echo \`date -u '+%H:%M:%S'\` $i started build \$COUNT of 4
 			[ 0 -lt \`expr \$COUNT % $PARALLEL_BUILDS\` ] || wait

-			./build $SIG $PARSE $STD --without-crypto --enable-c99-snprintf $BUILD_ARGS &
+			./build $SIG $PARSE $STD --without-crypto --enable-c99-snprintf --enable-leap-smear $BUILD_ARGS &

 			COUNT=\`expr \$COUNT + 1\`
 			echo \`date -u '+%H:%M:%S'\` $i started build \$COUNT of 4
--- a/contrib/ntp/html/.datecheck
+++ b/contrib/ntp/html/.datecheck
--- a/contrib/ntp/html/clockopt.html
+++ b/contrib/ntp/html/clockopt.html
@ -29,8 +29,8 @@
      <dd>Marks the reference clock as preferred. All other things being equal, this host will be chosen for synchronization among a set of correctly operating hosts. See the <a href="prefer.html">Mitigation Rules and the <tt>prefer</tt> Keyword</a> page for further information.</dd>
      <dt><tt>mode <i>int</i></tt></dt>
      <dd>Specifies a mode number which is interpreted in a device-specific fashion. For instance, it selects a dialing protocol in the ACTS driver and a device subtype in the <tt>parse</tt> drivers.</dd>
-      <dt><tt>minpoll <i>int</i></tt><br>
-        <tt>maxpoll <i>int</i></tt></dt>
+      <dt><tt>minpoll <i>int</i></tt></dt>
+      <dt><tt>maxpoll <i>int</i></tt></dt>
      <dd>These options specify the minimum and maximum polling interval for reference clock messages in log<sub>2</sub> seconds. For most directly connected reference clocks, both <tt>minpoll</tt> and <tt>maxpoll</tt> default to 6 (64 s). For modem reference clocks, <tt>minpoll</tt> is ordinarily set to 10 (about 17 m) and <tt>maxpoll</tt> to  15 (about 9 h). The allowable range is 4 (16 s) to 17 (36 h) inclusive.</dd>
    </dl>
  </dd>
@ -48,7 +48,10 @@
      <dd>Specifies the stratum number assigned to the driver in the range 0 to 15, inclusive. This number overrides the default stratum number ordinarily assigned by the driver itself, usually zero.</dd>
      <dt><tt>refid <i>string</i></tt></dt>
      <dd>Specifies an ASCII string of from one to four characters which defines the reference identifier used by the driver. This string overrides the default identifier ordinarily assigned by the driver itself.</dd>
-      <dt><tt>flag1 flag2 flag3 flag4</tt></dt>
+      <dt><tt>flag1 0|1</tt></dt>
+      <dt><tt>flag2 0|1</tt></dt>
+      <dt><tt>flag3 0|1</tt></dt>
+      <dt><tt>flag4 0|1</tt></dt>
      <dd>These four flags are used for customizing the clock driver. The interpretation of these values, and whether they are used at all, is a function of the particular  driver. However, by convention <tt>flag4</tt> is used to enable recording monitoring data to the <tt>clockstats</tt> file configured with the <tt>filegen</tt> command. Additional information on the <tt>filegen</tt> command is on the <a href="monopt.html">Monitoring Options</a> page.</dd>
      <dt><tt>minjitter <i>secs</i></tt></dt>
      <dd>If the source has a jitter that cannot be sensibly estimated, because
--- a/contrib/ntp/html/copyright.html
+++ b/contrib/ntp/html/copyright.html
@ -9,7 +9,7 @@
 <h3>Copyright Notice</h3>
 <img src="pic/sheepb.jpg" alt="jpg" align="left"> "Clone me," says Dolly sheepishly.
 <p>Last update:
-  <!-- #BeginDate format:En2m -->2-Mar-2023  05:21<!-- #EndDate -->
+  <!-- #BeginDate format:En2m -->7-Jan-2024  00:29<!-- #EndDate -->
    UTC</p>
 <br clear="left">
 </p>
@ -38,7 +38,7 @@
 <pre>
 ***********************************************************************
 *                                                                     *
-* Copyright (c) Network Time Foundation 2011-2023                     *
+* Copyright (c) Network Time Foundation 2011-2024                     *
 *                                                                     *
 * All Rights Reserved                                                 *
 *                                                                     *
--- a/contrib/ntp/html/release.html
+++ b/contrib/ntp/html/release.html
@ -37,7 +37,7 @@
  <li>There are two new burst mode features available where special conditions apply. One of these is enabled by the <tt>iburst</tt> keyword in the <tt>server</tt> configuration command. It is intended for cases where it is important to set the clock quickly when an association is first mobilized. The other is enabled by the <tt>burst</tt> keyword in the <tt>server</tt> configuration command. It is intended for cases where the network attachment requires an initial calling or training procedure. See the <a href="assoc.html">Association Management</a> page for further information.</li>
  <li>The OpenSSL cryptographic library has replaced the library formerly available from RSA Laboratories. All cryptographic routines except a version of the MD5 message digest algorithm have been removed from the base distribution. All 128-bit and 160-bit message digests algorithms are now supported for both symmetric key and public key cryptosystems. See the <a href="authentic.html">Authentication Support</a> page for further information and the <a href="authopt.html">Authentication Options</a> page for a list of supported digest algorithms.</li>
  <li>This release includes  support for  Autokey public-key cryptography for authenticating public servers to clients, as described in RFC 5906. This support requires the --enable-autokey option when building the distribution, which is the default is OpenSSL is available. The deployment of Autokey subnets is now considerably simpler than in earlier versions. A subnet naming scheme is now available to filter manycast and pool configurations. Additional information about Autokey  is on the <a href="autokey.html">Autokey Public Key Authentication</a> page and links from there.</li>
-  <li>The NTP descrete even simulator has been substantially upgraded, now including scenarios with multiple servers and time-sensitive scripts. This allows  the NTP&nbsp;algorithms to be tested in an embedded environment with systematic and pseudo-random network delay and oscillator wander distributions. This has been used to verify correct operation under conditions of extreme error and misconfiguration. See the <a href="ntpdsim.html"><tt>ntpdsim</tt> - Network Time Protocol (NTP) simulator</a> page. A technical description and performance analysis is given in the white papers at the <a href="http://www.eecis.udel.edu/~mills/ntp.html">NTP Project Page</a>.</li>
+  <li>The NTP descrete event simulator has been substantially upgraded, now including scenarios with multiple servers and time-sensitive scripts. This allows  the NTP&nbsp;algorithms to be tested in an embedded environment with systematic and pseudo-random network delay and oscillator wander distributions. This has been used to verify correct operation under conditions of extreme error and misconfiguration. See the <a href="ntpdsim.html"><tt>ntpdsim</tt> - Network Time Protocol (NTP) simulator</a> page. A technical description and performance analysis is given in the white papers at the <a href="http://www.eecis.udel.edu/~mills/ntp.html">NTP Project Page</a>.</li>
  <li>NTPv4 includes three new server discovery schemes, which in most applications can avoid per-host configuration altogether. Two of these are based on IP multicast technology, while the remaining one is based on crafted DNS lookups. See the <a href="discover.html">Automatic NTP Configuration Schemes</a> page for further information.</li>
  <li>The status display and event report monitoring functions have been considerably expanded, including new statistics files and  event reporting to files and the system log. See the <a href="decode.html">Event Messages and Status Words</a> page for further information.</li>
  <li>Several new options have been added for the <tt>ntpd</tt> command line. For the inveterate knob twiddlers several of the more important performance variables can be changed to fit actual or perceived special conditions. In particular, the <tt>tinker</tt> and <tt>tos</tt> commands can be used to adjust thresholds, throw switches and change limits.</li>
--- a/contrib/ntp/include/Makefile.am
+++ b/contrib/ntp/include/Makefile.am
@ -8,6 +8,7 @@ noinst_HEADERS =	\
 	ascii.h		\
 	audio.h		\
 	binio.h		\
+	c99_snprintf.h	\
 	declcond.h	\
 	gps.h		\
 	hopf6039.h	\
--- a/contrib/ntp/include/Makefile.in
+++ b/contrib/ntp/include/Makefile.in
@ -386,6 +386,7 @@ PACKAGE_TARNAME = @PACKAGE_TARNAME@
 PACKAGE_URL = @PACKAGE_URL@
 PACKAGE_VERSION = @PACKAGE_VERSION@
 PATH_NET_SNMP_CONFIG = @PATH_NET_SNMP_CONFIG@
+PATH_OPENSSL = @PATH_OPENSSL@
 PATH_PERL = @PATH_PERL@
 PATH_RUBY = @PATH_RUBY@
 PATH_SEPARATOR = @PATH_SEPARATOR@
@ -492,6 +493,7 @@ noinst_HEADERS = \
 	ascii.h		\
 	audio.h		\
 	binio.h		\
+	c99_snprintf.h	\
 	declcond.h	\
 	gps.h		\
 	hopf6039.h	\
--- a/contrib/ntp/include/c99_snprintf.h
+++ b/contrib/ntp/include/c99_snprintf.h
@ -0,0 +1,28 @@
+/*
+ * ntp_c99_snprintf.h
+ *
+ * Included from config.h to deal with replacing [v]snprintf() on older
+ * systems.  The #undef lines below cannot be directly in config.h as
+ * config.status modifies each #undef in config.h.in to either be a
+ * commented-out #undef or a functional #define.  Here they are used
+ * to avoid redefinition warnings on systems such as macos ca. 2024
+ * where system headers define [v]snprintf as preprocessor macros.
+ *
+ * Do not include this file directly, leave it to config.h.
+ */
+
+#if !defined(_KERNEL) && !defined(PARSESTREAM)
+/*
+ * stdio.h must be included in config.h after _GNU_SOURCE is defined
+ * but before #define snprintf rpl_snprintf
+ */
+# include <stdio.h>
+#endif
+
+#ifdef HW_WANT_RPL_SNPRINTF
+# undef snprintf
+#endif
+#ifdef HW_WANT_RPL_VSNPRINTF
+# undef vsnprintf
+#endif
+
--- a/contrib/ntp/include/isc/Makefile.in
+++ b/contrib/ntp/include/isc/Makefile.in
@ -344,6 +344,7 @@ PACKAGE_TARNAME = @PACKAGE_TARNAME@
 PACKAGE_URL = @PACKAGE_URL@
 PACKAGE_VERSION = @PACKAGE_VERSION@
 PATH_NET_SNMP_CONFIG = @PATH_NET_SNMP_CONFIG@
+PATH_OPENSSL = @PATH_OPENSSL@
 PATH_PERL = @PATH_PERL@
 PATH_RUBY = @PATH_RUBY@
 PATH_SEPARATOR = @PATH_SEPARATOR@
--- a/contrib/ntp/include/lib_strbuf.h
+++ b/contrib/ntp/include/lib_strbuf.h
@ -5,28 +5,28 @@
 #define LIB_STRBUF_H

 #include <ntp_types.h>
-#include <ntp_malloc.h>			/* for ZERO() */
+#include <ntp_malloc.h>			/* for zero_mem() */

-/*
- * Sizes of things
- */
-#define LIB_NUMBUF	16
 #define	LIB_BUFLENGTH	128

-typedef char libbufstr[LIB_BUFLENGTH];
-extern libbufstr lib_stringbuf[LIB_NUMBUF];
-extern int lib_nextbuf;
-extern int lib_inited;
+extern int	lib_inited;
+extern int	ipv4_works;
+extern int	ipv6_works;

+extern	void	init_lib(void);

 /*
- * Macro to get a pointer to the next buffer
+ * Get a pointer to the next string buffer of LIB_BUFLENGTH octets.
+ * New and modified code should use buf = lib_getbuf() directly to
+ * provide clarity for folks familiar with common C style, but there's
+ * no need to churn the history with a mechanical switch away from
+ * LIB_GETBUF(buf).
 */
-#define	LIB_GETBUF(bufp)					\
-	do {							\
-		ZERO(lib_stringbuf[lib_nextbuf]);		\
-		(bufp) = &lib_stringbuf[lib_nextbuf++][0];	\
-		lib_nextbuf %= COUNTOF(lib_stringbuf);		\
+extern	char* lib_getbuf(void);
+
+#define	LIB_GETBUF(bufp)		\
+	do {				\
+		(bufp) = lib_getbuf();	\
 	} while (FALSE)

 #endif	/* LIB_STRBUF_H */
--- a/contrib/ntp/include/ntp.h
+++ b/contrib/ntp/include/ntp.h
@ -171,8 +171,8 @@ typedef char s_char;
 * Eventually the struct tag will change from interface to endpt_tag.
 * endpt is unrelated to the select algorithm's struct endpoint.
 */
-typedef struct interface endpt;
-struct interface {
+typedef struct endpt_tag endpt;
+struct endpt_tag {
 	endpt *		elink;		/* endpt list link */
 	endpt *		mclink;		/* per-AF_* multicast list */
 	void *		ioreg_ctx;	/* IO registration context */
@ -185,9 +185,12 @@ struct interface {
 	char		name[32];	/* name of interface */
 	u_short		family;		/* AF_INET/AF_INET6 */
 	u_short		phase;		/* phase in update cycle */
-	u_int32		flags;		/* interface flags */
+	u_int32		flags;		/* INT_ flags */
 	int		last_ttl;	/* last TTL specified */
 	u_int32		addr_refid;	/* IPv4 addr or IPv6 hash */
+#    ifdef WORDS_BIGENDIAN
+	u_int32		old_refid;	/* byte-swapped IPv6 refid */
+#    endif
 	int		num_mcast;	/* mcast addrs enabled */
 	u_long		starttime;	/* current_time at creation */
 	volatile long	received;	/* number of incoming packets */
@ -200,11 +203,11 @@ struct interface {
 };

 /*
- * Flags for interfaces
+ * Flags for network endpoints (interfaces or really addresses)
 */
 #define INT_UP		0x001	/* Interface is up */
 #define	INT_PPP		0x002	/* Point-to-point interface */
-#define	INT_LOOPBACK	0x004	/* the loopback interface */
+#define	INT_LOOPBACK	0x004	/* ::1 or 127.0.0.1 */
 #define	INT_BROADCAST	0x008	/* can broadcast out this interface */
 #define INT_MULTICAST	0x010	/* can multicast out this interface */
 #define	INT_BCASTOPEN	0x020	/* broadcast receive socket is open */
@ -212,7 +215,8 @@ struct interface {
 #define INT_WILDCARD	0x080	/* wildcard interface - usually skipped */
 #define INT_MCASTIF	0x100	/* bound directly to MCAST address */
 #define INT_PRIVACY	0x200	/* RFC 4941 IPv6 privacy address */
-#define INT_BCASTXMIT	0x400   /* socket setup to allow broadcasts */
+#define INT_BCASTXMIT	0x400	/* socket setup to allow broadcasts */
+#define INT_LL_OF_GLOB	0x800	/* IPv6 link-local duplicate of global */

 /*
 * Define flasher bits (tests 1 through 11 in packet procedure)
@ -342,12 +346,12 @@ struct peer {
 	u_char	status;		/* peer status */
 	u_char	new_status;	/* under-construction status */
 	u_char	reach;		/* reachability register */
+	u_char	filter_nextpt;	/* index into filter shift register */
 	int	flash;		/* protocol error test tally bits */
 	u_long	epoch;		/* reference epoch */
 	int	burst;		/* packets remaining in burst */
 	int	retry;		/* retry counter */
 	int	flip;		/* interleave mode control */
-	int	filter_nextpt;	/* index into filter shift register */
 	double	filter_delay[NTP_SHIFT]; /* delay shift register */
 	double	filter_offset[NTP_SHIFT]; /* offset shift register */
 	double	filter_disp[NTP_SHIFT]; /* dispersion shift register */
@ -463,11 +467,12 @@ struct peer {
 #define	FLAG_XLEAVE	0x1000	/* interleaved protocol */
 #define	FLAG_XB		0x2000	/* interleaved broadcast */
 #define	FLAG_XBOGUS	0x4000	/* interleaved bogus packet */
-#ifdef	OPENSSL
+#ifdef	AUTOKEY
 # define FLAG_ASSOC	0x8000	/* autokey request */
-#endif /* OPENSSL */
+#endif
 #define FLAG_TSTAMP_PPS	0x10000	/* PPS source provides absolute timestamp */
 #define FLAG_LOOPNONCE	0x20000	/* Use a nonce for the loopback test */
+#define FLAG_DISABLED	0x40000	/* peer is being torn down */

 /*
 * Definitions for the clear() routine.  We use memset() to clear
@ -558,9 +563,15 @@ struct pkt {
 #define	MIN_V4_PKT_LEN	(12 * sizeof(u_int32))	/* min header length */
 #define	LEN_PKT_NOMAC	(12 * sizeof(u_int32))	/* min header length */
 #define	MIN_MAC_LEN	(1 * sizeof(u_int32))	/* crypto_NAK */
-#define	MAX_MD5_LEN	(5 * sizeof(u_int32))	/* MD5 */
-#define	MAX_MAC_LEN	(6 * sizeof(u_int32))	/* SHA */
+#define	MD5_LENGTH	16
+#define	SHAKE128_LENGTH	16
+#define	CMAC_LENGTH	16
+#define	SHA1_LENGTH	20
 #define	KEY_MAC_LEN	sizeof(u_int32)		/* key ID in MAC */
+#define	MAX_MD5_LEN	(KEY_MAC_LEN + MD5_LENGTH)
+#define	MAX_SHAKE128_LEN (KEY_MAC_LEN + SHAKE128_LENGTH)
+#define	MAX_SHA1_LEN	(KEY_MAC_LEN + SHA1_LENGTH)
+#define	MAX_MAC_LEN	(6 * sizeof(u_int32))	/* any MAC */
 #define	MAX_MDG_LEN	(MAX_MAC_LEN-KEY_MAC_LEN) /* max. digest len */

 	/*
@ -703,6 +714,10 @@ struct pkt {
 #define	max(a,b)	(((a) > (b)) ? (a) : (b))
 #define	min3(a,b,c)	min(min((a),(b)), (c))

+/* clamp a value within a range */
+#define CLAMP(val, minval, maxval)				\
+			max((minval), min((val), (maxval)))
+

 /*
 * Configuration items.  These are for the protocol module (proto_config())
@ -783,7 +798,7 @@ typedef struct mon_data	mon_entry;
 struct mon_data {
 	mon_entry *	hash_next;	/* next structure in hash list */
 	DECL_DLIST_LINK(mon_entry, mru);/* MRU list link pointers */
-	struct interface * lcladr;	/* address on which this arrived */
+	endpt *		lcladr;	/* address on which this arrived */
 	l_fp		first;		/* first time seen */
 	l_fp		last;		/* last time seen */
 	int		leak;		/* leaky bucket accumulator */
@ -804,7 +819,7 @@ struct mon_data {
 #define	MDF_POOL	0x08	/* pool client solicitor */
 #define MDF_ACAST	0x10	/* manycast client solicitor */
 #define	MDF_BCLNT	0x20	/* eph. broadcast/multicast client */
-#define MDF_UCLNT	0x40	/* preemptible manycast or pool client */
+#define MDF_PCLNT	0x40	/* preemptible pool client */
 /*
 * In the context of struct peer in ntpd, three of the cast_flags bits
 * represent configured associations which never receive packets, and
@ -841,11 +856,10 @@ typedef struct restrict_u_tag	restrict_u;
 struct restrict_u_tag {
 	restrict_u *	link;		/* link to next entry */
 	u_int32		count;		/* number of packets matched */
+	u_int32		expire;		/* valid until current_time */
 	u_short		rflags;		/* restrict (accesslist) flags */
-	u_short		mflags;		/* match flags */
-	short		ippeerlimit;	/* IP peer limit */
-	int		srvfuzrftpoll;	/* server response: fuzz reftime */
-	u_long		expire;		/* valid until time */
+	u_int32		mflags;		/* match flags */
+	short		ippeerlimit;	/* limit of associations matching */
 	union {				/* variant starting here */
 		res_addr4 v4;
 		res_addr6 v6;
@ -856,16 +870,13 @@ struct restrict_u_tag {
 #define	V6_SIZEOF_RESTRICT_U	(offsetof(restrict_u, u)	\
 				 + sizeof(res_addr6))

+/* restrictions for (4) a given address */
 typedef struct r4addr_tag	r4addr;
 struct r4addr_tag {
 	u_short		rflags;		/* match flags */
 	short		ippeerlimit;	/* IP peer limit */
 };

-char *build_iflags(u_int32 flags);
-char *build_mflags(u_short mflags);
-char *build_rflags(u_short rflags);
-
 /*
 * Restrict (Access) flags (rflags)
 */
@ -876,10 +887,6 @@ char *build_rflags(u_short rflags);
 #define	RES_NOPEER		0x0010	/* new association denied */
 #define	RES_NOEPEER		0x0020	/* new ephemeral association denied */
 #define RES_LIMITED		0x0040	/* packet rate exceeded */
-#define RES_FLAGS		(RES_IGNORE | RES_DONTSERVE |\
-				    RES_DONTTRUST | RES_VERSION |\
-				    RES_NOPEER | RES_NOEPEER | RES_LIMITED)
-
 #define	RES_NOQUERY		0x0080	/* mode 6/7 packet denied */
 #define	RES_NOMODIFY		0x0100	/* mode 6/7 modify denied */
 #define	RES_NOTRAP		0x0200	/* mode 6/7 set trap denied */
@ -894,7 +901,10 @@ char *build_rflags(u_short rflags);

 #define RES_UNUSED		0x0000	/* Unused flag bits (none left) */

-#define	RES_ALLFLAGS		(RES_FLAGS | RES_NOQUERY |	\
+#define	RES_ALLFLAGS		(RES_IGNORE | RES_DONTSERVE |	\
+				 RES_DONTTRUST | RES_VERSION |	\
+				 RES_NOPEER | RES_NOEPEER |	\
+				 RES_LIMITED | RES_NOQUERY |	\
 				 RES_NOMODIFY | RES_NOTRAP |	\
 				 RES_LPTRAP | RES_KOD |		\
 				 RES_MSSNTP | RES_FLAKE |	\
@ -948,4 +958,15 @@ struct endpoint {
 #define MRU_ROW_LIMIT	256
 /* similar datagrams per response limit for ntpd */
 #define MRU_FRAGS_LIMIT	128
+
+/* found on POSIX systems in sysexit.h */
+#ifndef EX_SOFTWARE
+# define EX_SOFTWARE	70	/* internal software error */
+#endif
+
+#define BYTESWAP32(u32)							\
+			(((u_int32)(u32) & 0xff000000) >> 24 |		\
+			 ((u_int32)(u32) &   0xff0000) >>  8 |		\
+			 ((u_int32)(u32) &     0xff00) <<  8 |		\
+			 ((u_int32)(u32) &       0xff) << 24)
 #endif /* NTP_H */
--- a/contrib/ntp/include/ntp_config.h
+++ b/contrib/ntp/include/ntp_config.h
@ -113,7 +113,9 @@ struct restrict_node_tag {
 	address_node *	addr;
 	address_node *	mask;
 	attr_val_fifo *	flag_tok_fifo;
+	int/*BOOL*/	remove;
 	int		line_no;
+	int		column;
 	short		ippeerlimit;
 	short		srvfuzrft;
 };
@ -317,10 +319,13 @@ void	  destroy_attr_val(attr_val *node);
 filegen_node *create_filegen_node(int filegen_token,
 				  attr_val_fifo *options);
 string_node *create_string_node(char *str);
-restrict_node *create_restrict_node(address_node *addr,
-				    address_node *mask,
-				    short ippeerlimit,
-				    attr_val_fifo *flags, int line_no);
+restrict_node *create_restrict_node(address_node *	addr,
+				    address_node *	mask,
+				    short		ippeerlimit,
+				    attr_val_fifo *	flag_tok_fifo,
+				    int/*BOOL*/		remove,
+				    int			nline,
+				    int			ncol);
 int_node *create_int_node(int val);
 addr_opts_node *create_addr_opts_node(address_node *addr,
 				      attr_val_fifo *options);
--- a/contrib/ntp/include/ntp_control.h
+++ b/contrib/ntp/include/ntp_control.h
@ -159,7 +159,7 @@ struct ntp_control {
 */
 struct ctl_trap {
 	sockaddr_u tr_addr;		/* address of trap recipient */
-	struct interface *tr_localaddr;	/* interface to send this through */
+	endpt *tr_localaddr;		/* interface to send this through */
 	u_long tr_settime;		/* time trap was set */
 	u_long tr_count;		/* async messages sent to this guy */
 	u_long tr_origtime;		/* time trap was originally set */
--- a/contrib/ntp/include/ntp_lists.h
+++ b/contrib/ntp/include/ntp_lists.h
@ -181,7 +181,7 @@ do {								\

 #define UNLINK_EXPR_SLIST(punlinked, listhead, expr, nextlink,	\
 			  entrytype)				\
-do {								\
+if (NULL != (listhead)) {					\
 	entrytype **ppentry;					\
 								\
 	ppentry = &(listhead);					\
@ -202,6 +202,8 @@ do {								\
 	} else {						\
 		(punlinked) = NULL;				\
 	}							\
+} else do {							\
+	(punlinked) = NULL;					\
 } while (FALSE)

 #define UNLINK_SLIST(punlinked, listhead, ptounlink, nextlink,	\
--- a/contrib/ntp/include/ntp_md5.h
+++ b/contrib/ntp/include/ntp_md5.h
@ -6,6 +6,18 @@
 #ifndef NTP_MD5_H
 #define NTP_MD5_H

+/* Use the system MD5 or fall back on libisc's */
+# if defined HAVE_MD5_H && defined HAVE_MD5INIT
+#  include <md5.h>
+# else
+#  include "isc/md5.h"
+   typedef isc_md5_t		MD5_CTX;
+#  define MD5_DIGEST_LENGTH	ISC_MD5_DIGESTLENGTH
+#  define MD5Init(c)		isc_md5_init(c)
+#  define MD5Update(c, p, s)	isc_md5_update(c, (const void *)p, s)
+#  define MD5Final(d, c)	isc_md5_final((c), (d))	/* swapped */
+# endif
+
 # define KEY_TYPE_MD5			NID_md5

 #ifdef OPENSSL
@ -20,20 +32,11 @@
 /*
 * Provide OpenSSL-alike MD5 API if we're not using OpenSSL
 */
-# if defined HAVE_MD5_H && defined HAVE_MD5INIT
-#  include <md5.h>
-# else
-#  include "isc/md5.h"
-   typedef isc_md5_t		MD5_CTX;
-#  define MD5Init(c)		isc_md5_init(c)
-#  define MD5Update(c, p, s)	isc_md5_update(c, p, s)
-#  define MD5Final(d, c)	isc_md5_final((c), (d))	/* swapped */
-# endif

  typedef MD5_CTX			EVP_MD_CTX;

 # define NID_md5			4	/* from openssl/objects.h */
-# define EVP_MAX_MD_SIZE		64	/* from openssl/evp.h */
+# define EVP_MAX_MD_SIZE		MD5_DIGEST_LENGTH
 # define EVP_MD_CTX_free(c)		free(c)
 # define EVP_MD_CTX_new()		calloc(1, sizeof(MD5_CTX))
 # define EVP_get_digestbynid(t)		NULL
@ -47,7 +50,7 @@
 # define EVP_DigestFinal(c, d, pdl)	\
 	do {				\
 		MD5Final((d), (c));	\
-		*(pdl) = 16;		\
+		*(pdl) = MD5_LENGTH;	\
 	} while (0)
 # endif	/* !OPENSSL */
 #endif	/* NTP_MD5_H */
--- a/contrib/ntp/include/ntp_net.h
+++ b/contrib/ntp/include/ntp_net.h
@ -195,7 +195,7 @@ typedef union {
 #define SOCK_UNSPEC_S(psau)					\
 	(SOCK_UNSPEC(psau) && !SCOPE(psau))

-/* choose a default net interface (struct interface) for v4 or v6 */
+/* choose a default net interface (endpt) for v4 or v6 */
 #define ANY_INTERFACE_BYFAM(family)				\
 	((AF_INET == family)					\
 	     ? any_interface					\
@ -227,6 +227,12 @@ typedef union {
 */
 #define	LOOPBACKADR	0x7f000001
 #define	LOOPNETMASK	0xff000000
+#ifdef WORDS_BIGENDIAN
+# define LOOPBACKADR_N	LOOPBACKADR
+#else 
+# define LOOPBACKADR_N	0x0100007f
+#endif
+

 #define	ISBADADR(srcadr)					\
 	(IS_IPV4(srcadr)					\
@ -234,5 +240,10 @@ typedef union {
 	     == (LOOPBACKADR & LOOPNETMASK))			\
 	 && SRCADR(srcadr) != LOOPBACKADR)

+#define IS_LOOPBACK_ADDR(psau)					\
+		(IS_IPV4(psau)					\
+		    ? LOOPBACKADR == SRCADR(psau)		\
+		    : IN6_IS_ADDR_LOOPBACK(PSOCK_ADDR6(psau))	\
+		)

 #endif /* NTP_NET_H */
--- a/contrib/ntp/include/ntp_psl.h
+++ b/contrib/ntp/include/ntp_psl.h
@ -4,12 +4,15 @@

 /*
 * Poll Skew List Item
+ * u_in32 is large enough for sub and qty so long as NTP_MAXPOLL < 31
 */
-
+#if NTP_MAXPOLL >= 31
+#include "psl_item structure needs larger type"
+#endif
 typedef struct psl_item_tag {
-	int		sub;	/* int or short?  unsigned is OK, but why? */
-	int		qty;	/* int or short?  unsigned is OK, but why? */
-	int		msk;	/* int or short?  unsigned is OK */
+	u_int32	sub;
+	u_int32	qty;
+	u_int32	msk;
 } psl_item;

 int get_pollskew(int, psl_item *);
--- a/contrib/ntp/include/ntp_stdlib.h
+++ b/contrib/ntp/include/ntp_stdlib.h
@ -11,10 +11,12 @@

 #include "declcond.h"	/* ntpd uses ntpd/declcond.h, others include/ */
 #include "l_stdlib.h"
+#include "lib_strbuf.h"
 #include "ntp_md5.h"
 #include "ntp_net.h"
 #include "ntp_debug.h"
 #include "ntp_malloc.h"
+#include "lib_strbuf.h"
 #include "ntp_string.h"
 #include "ntp_syslog.h"
 #include "ntp_keyacc.h"
@ -113,7 +115,7 @@ extern	size_t	MD5authencrypt	(int type, const u_char *key, size_t klen,
 extern	int	MD5authdecrypt	(int type, const u_char *key, size_t klen,
 				 u_int32 *pkt, size_t length, size_t size,
 				 keyid_t keyno);
-extern	u_int32	addr2refid(sockaddr_u *);
+extern	u_int32	addr2refid	(sockaddr_u *);

 /* authkeys.c */
 extern	void	MD5auth_setkey	(keyid_t, int, const u_char *, size_t,
@ -180,7 +182,6 @@ extern	const char * k_st_flags	(u_int32);
 extern	char *	statustoa	(int, int);
 extern	sockaddr_u * netof	(sockaddr_u *);
 extern	char *	numtoa		(u_int32);
-extern	char *	numtohost	(u_int32);
 extern	const char * socktoa	(const sockaddr_u *);
 extern	const char * sockporttoa(const sockaddr_u *);
 extern	u_short	sock_hash	(const sockaddr_u *);
@ -242,18 +243,21 @@ extern pset_tod_using	set_tod_using;
 #ifdef OPENSSL
 extern	void	ssl_init		(void);
 extern	void	ssl_check_version	(void);
-extern	int	ssl_init_done;
+extern	EVP_MD_CTX* digest_ctx;		/* also ssl_init_done */
 #define	INIT_SSL()				\
 	do {					\
-		if (!ssl_init_done)		\
+		if (NULL == digest_ctx)	{	\
 			ssl_init();		\
-	} while (0)
+		}				\
+	} while (FALSE)
 #else	/* !OPENSSL follows */
+#define ssl_check_version()	do {} while (0)
 #define	INIT_SSL()		do {} while (0)
 #endif
-extern	int	keytype_from_text	(const char *,	size_t *);
-extern	const char *keytype_name	(int);
-extern	char *	getpass_keytype		(int);
+extern	int	keytype_from_text	(const char *text,
+					 size_t *pdigest_len);
+extern	const char *keytype_name	(int type);
+extern	char *	getpass_keytype		(int type);

 /* strl-obsd.c */
 #ifndef HAVE_STRLCPY		/* + */
--- a/contrib/ntp/include/ntp_tty.h
+++ b/contrib/ntp/include/ntp_tty.h
@ -100,4 +100,9 @@ extern	int	ntp_tty_ioctl(int, u_int);
 # endif
 #endif

+extern	int	symBaud2numBaud(int symBaud);
+# if 0
+extern	int	numBaud2symBaud(int numBaud);
+#endif
+
 #endif /* NTP_TTY_H */
--- a/contrib/ntp/include/ntp_types.h
+++ b/contrib/ntp/include/ntp_types.h
@ -254,16 +254,6 @@ aligned_ptr(
 	return base + ALIGN_UNITS((minsize < 1) ? 1 : minsize);
 }

-/*
- * Macro to use in otherwise-empty source files to comply with ANSI C
- * requirement that each translation unit (source file) contain some
- * declaration.  This has commonly been done by declaring an unused
- * global variable of type int or char.  An extern reference to abs()
- * serves the same purpose without bloat.  We once used exit() but
- * that can produce warnings on systems that declare exit() noreturn.
- */
-#define	NONEMPTY_TRANSLATION_UNIT	extern int abs(int);
-
 /*
 * On Unix struct sock_timeval is equivalent to struct timeval.
 * On Windows built with 64-bit time_t, sock_timeval.tv_sec is a long
--- a/contrib/ntp/include/ntpd.h
+++ b/contrib/ntp/include/ntpd.h
@ -47,6 +47,17 @@
 # define DPRINTF(lvl, arg)	do {} while (0)
 #endif

+/* clear bitflag only on DEBUG builds */
+#ifdef DEBUG
+# define CLEAR_BIT_IF_DEBUG(bit, flags)			\
+	do {						\
+		(flags) &= ~(bit);			\
+	} while (FALSE)
+#else
+# define CLEAR_BIT_IF_DEBUG(bit, flags)			\
+	do {} while (FALSE)
+#endif
+

 /* nt_clockstuff.c */
 #ifdef SYS_WINNT
@ -60,15 +71,15 @@ extern	char *	saveconfigdir;	/* ntpq saveconfig output directory */

 extern	void	getconfig	(int, char **);
 extern	void	ctl_clr_stats	(void);
-extern	int	ctlclrtrap	(sockaddr_u *, struct interface *, int);
+extern	int	ctlclrtrap	(sockaddr_u *, endpt *, int);
 extern	u_short ctlpeerstatus	(struct peer *);
-extern	int	ctlsettrap	(sockaddr_u *, struct interface *, int, int);
+extern	int	ctlsettrap	(sockaddr_u *, endpt *, int, int);
 extern	u_short ctlsysstatus	(void);
 extern	void	init_control	(void);
 extern	void	process_control (struct recvbuf *, int);
 extern	void	report_event	(int, struct peer *, const char *);
-extern	int	mprintf_event	(int, struct peer *, const char *, ...)
-			NTP_PRINTF(3, 4);
+extern	int	mprintf_event	(int evcode, struct peer *p,
+				 const char *fmt, ...) NTP_PRINTF(3, 4);

 /* ntp_control.c */
 /*
@ -118,7 +129,9 @@ extern	void	enable_broadcast	(endpt *, sockaddr_u *);
 extern	void	enable_multicast_if	(endpt *, sockaddr_u *);
 extern	void	interface_update	(interface_receiver_t, void *);
 #ifndef HAVE_IO_COMPLETION_PORT
-extern  void    io_handler              (void);
+extern	void	io_handler		(void);
+#else
+extern	void WINAPI ip_interface_changed(ULONG_PTR ctx);
 #endif
 extern	void	init_io 	(void);
 extern	void	io_open_sockets	(void);
@ -127,8 +140,10 @@ extern	void	io_setbclient	(void);
 extern	void	io_unsetbclient	(void);
 extern	void	io_multicast_add(sockaddr_u *);
 extern	void	io_multicast_del(sockaddr_u *);
-extern	void	sendpkt 	(sockaddr_u *, struct interface *, int, struct pkt *, int);
-#ifdef DEBUG
+extern	void	sendpkt		(sockaddr_u *dest, endpt * ep, int ttl,
+				 struct pkt *pkt, int len);
+extern	isc_boolean_t	is_linklocal(sockaddr_u *psau);
+#ifdef DEBUG_TIMING
 extern	void	collect_timing  (struct recvbuf *, const char *, int, l_fp *);
 #endif
 #ifdef HAVE_SIGNALED_IO
@ -141,8 +156,13 @@ extern	void	block_io_and_alarm	(void);
 # define	UNBLOCK_IO_AND_ALARM()	do {} while (0)
 # define	BLOCK_IO_AND_ALARM()	do {} while (0)
 #endif
-#define		latoa(pif)	localaddrtoa(pif)
+#define		eptoa(pif)	localaddrtoa(pif)
+#define		latoa(pif)	eptoa(pif)
 extern const char * localaddrtoa(endpt *);
+#ifdef DEBUG
+extern const char * iflags_str(u_int32 iflags);
+#endif
+

 /* ntp_loopfilter.c */
 extern	void	init_loopfilter(void);
@ -198,7 +218,7 @@ extern	int	crypto_xmit	(struct peer *, struct pkt *,
 				    struct exten *, keyid_t);
 extern	keyid_t	session_key	(sockaddr_u *, sockaddr_u *, keyid_t,
 				    keyid_t, u_long);
-extern	int	make_keylist	(struct peer *, struct interface *);
+extern	int	make_keylist	(struct peer *, endpt *);
 extern	void	key_expire	(struct peer *);
 extern	void	crypto_update	(void);
 extern	void	crypto_update_taichange(void);
@ -226,7 +246,7 @@ extern	void	clock_select	(void);
 extern	void	set_sys_leap	(u_char);

 extern	u_long	leapsec;	/* seconds to next leap (proximity class) */
-extern  int     leapdif;        /* TAI difference step at next leap second*/
+extern  int	leapdif;	/* TAI difference step at next leap second */
 extern	int	sys_orphan;
 extern	double	sys_mindisp;
 extern	double	sys_maxdist;
@ -258,18 +278,27 @@ extern	void	reset_auth_stats(void);
 /* ntp_restrict.c */
 extern	void	init_restrict	(void);
 extern	void	restrictions	(sockaddr_u *, r4addr *);
-extern	void	hack_restrict	(restrict_op, sockaddr_u *, sockaddr_u *,
-				 short, u_short, u_short, u_long);
-extern	void	restrict_source	(sockaddr_u *, int, u_long);
+extern	int/*BOOL*/hack_restrict(restrict_op op, sockaddr_u *resaddr,
+				 sockaddr_u *resmask, short ippeerlimit,
+				 u_short mflags, u_short rflags,
+				 u_int32 expire);
+extern	void	restrict_source	(sockaddr_u *addr, int/*BOOL*/ remove,
+				 u_int32 lifetime);
+#ifdef DEBUG
 extern	void	dump_restricts	(void);
+extern	const char *resop_str	(restrict_op op);
+extern	const char *rflags_str	(u_short rflags);
+extern	const char *mflags_str	(u_short mflags);
+#endif
+

 /* ntp_timer.c */
 extern	void	init_timer	(void);
 extern	void	reinit_timer	(void);
 extern	void	timer		(void);
 extern	void	timer_clr_stats (void);
-extern	void	timer_interfacetimeout (u_long);
-extern	volatile int interface_interval;
+extern	int	endpt_scan_period;	/* -U option default 301s */
+extern	u_long	endpt_scan_timer;	/* next scan current_time */
 extern	u_long	orphwait;		/* orphan wait time */
 #ifdef AUTOKEY
 extern	char	*sys_hostname;	/* host name */
@ -288,17 +317,29 @@ extern	void	record_proto_stats (char *);
 extern	void	record_loop_stats (double, double, double, double, int);
 extern	void	record_clock_stats (sockaddr_u *, const char *);
 extern	int	mprintf_clock_stats(sockaddr_u *, const char *, ...)
-			NTP_PRINTF(2, 3);
-extern	void	record_raw_stats (sockaddr_u *srcadr, sockaddr_u *dstadr, l_fp *t1, l_fp *t2, l_fp *t3, l_fp *t4, int leap, int version, int mode, int stratum, int ppoll, int precision, double root_delay, double root_dispersion, u_int32 refid, int len, u_char *extra);
+					NTP_PRINTF(2, 3);
+extern	void	record_raw_stats (sockaddr_u *srcadr, sockaddr_u *dstadr,
+				  l_fp *t1, l_fp *t2, l_fp *t3, l_fp *t4,
+				  int leap, int version, int mode,
+				  int stratum, int ppoll, int precision,
+				  double root_delay, double root_dispersion,
+				  u_int32 refid, int len, u_char *extra);
 extern	void	check_leap_file	(int is_daily_check, u_int32 ntptime, const time_t * systime);
 extern	void	record_crypto_stats (sockaddr_u *, const char *);
 #ifdef DEBUG
 extern	void	record_timing_stats (const char *);
+extern	void	append_flagstr(char *flagstr, size_t sz, const char *text);
 #endif
 extern	char *	fstostr(time_t);	/* NTP timescale seconds */

 /* ntpd.c */
 extern	void	parse_cmdline_opts(int *, char ***);
+
+/* ntservice.c */
+#ifndef SYS_WINNT
+# define	ntservice_isup()	do {} while (FALSE)
+#endif
+
 /*
 * Signals we catch for debugging.
 */
@ -381,7 +422,10 @@ extern volatile u_long handler_pkts;	/* number of pkts received by handler */
 extern u_long	io_timereset;		/* time counters were reset */

 /* ntp_io.c */
-extern  int	disable_dynamic_updates;
+extern int	no_periodic_scan;	/* no periodic net addr scans */
+extern int	scan_addrs_once;	/* no net addr rescans */
+extern int	nonlocal_v4_addr_up;	/* should we try IPv4 pool? */
+extern int	nonlocal_v6_addr_up;	/* should we try IPv6 pool? */
 extern u_int	sys_ifnum;		/* next .ifnum to assign */
 extern endpt *	any_interface;		/* IPv4 wildcard */
 extern endpt *	any6_interface;		/* IPv6 wildcard */
--- a/contrib/ntp/include/vint64ops.h
+++ b/contrib/ntp/include/vint64ops.h
@ -23,6 +23,6 @@ extern vint64 subv64i32(const vint64 * lhs, int32_t rhs);
 extern vint64 subv64u32(const vint64 * lhs, uint32_t rhs);

 /* parsing. works like strtoul() or strtoull() */
-extern vint64 strtouv64(char const * begp, char const ** const endp, int base);
+extern vint64 strtouv64(char * begp, char ** endp, int base);

 #endif /*!defined(VINT64OPS_H)*/
--- a/contrib/ntp/kernel/Makefile.in
+++ b/contrib/ntp/kernel/Makefile.in
@ -383,6 +383,7 @@ PACKAGE_TARNAME = @PACKAGE_TARNAME@
 PACKAGE_URL = @PACKAGE_URL@
 PACKAGE_VERSION = @PACKAGE_VERSION@
 PATH_NET_SNMP_CONFIG = @PATH_NET_SNMP_CONFIG@
+PATH_OPENSSL = @PATH_OPENSSL@
 PATH_PERL = @PATH_PERL@
 PATH_RUBY = @PATH_RUBY@
 PATH_SEPARATOR = @PATH_SEPARATOR@
--- a/contrib/ntp/kernel/sys/Makefile.in
+++ b/contrib/ntp/kernel/sys/Makefile.in
@ -344,6 +344,7 @@ PACKAGE_TARNAME = @PACKAGE_TARNAME@
 PACKAGE_URL = @PACKAGE_URL@
 PACKAGE_VERSION = @PACKAGE_VERSION@
 PATH_NET_SNMP_CONFIG = @PATH_NET_SNMP_CONFIG@
+PATH_OPENSSL = @PATH_OPENSSL@
 PATH_PERL = @PATH_PERL@
 PATH_RUBY = @PATH_RUBY@
 PATH_SEPARATOR = @PATH_SEPARATOR@
--- a/contrib/ntp/libntp/Makefile.am
+++ b/contrib/ntp/libntp/Makefile.am
@ -192,7 +192,6 @@ libntp_a_SRCS =						\
 	ntp_rfc2553.c					\
 	ntp_worker.c					\
 	numtoa.c					\
-	numtohost.c					\
 	octtoint.c					\
 	prettydate.c					\
 	refidsmear.c					\
--- a/contrib/ntp/libntp/Makefile.in
+++ b/contrib/ntp/libntp/Makefile.in
@ -175,12 +175,12 @@ am__libntp_a_SOURCES_DIST = systime.c a_md5encrypt.c adjtime.c \
 	mktime.c modetoa.c mstolfp.c msyslog.c netof.c ntp_calendar.c \
 	ntp_calgps.c ntp_crypto_rnd.c ntp_intres.c ntp_libopts.c \
 	ntp_lineedit.c ntp_random.c ntp_realpath.c ntp_rfc2553.c \
-	ntp_worker.c numtoa.c numtohost.c octtoint.c prettydate.c \
-	refidsmear.c recvbuff.c refnumtoa.c snprintf.c socket.c \
-	socktoa.c socktohost.c ssl_init.c statestr.c strdup.c \
-	strl_obsd.c syssignal.c timespecops.c timetoa.c timevalops.c \
-	timexsup.c uglydate.c vint64ops.c work_fork.c work_thread.c \
-	xsbprintf.c ymd2yd.c lib/isc/assertions.c lib/isc/buffer.c \
+	ntp_worker.c numtoa.c octtoint.c prettydate.c refidsmear.c \
+	recvbuff.c refnumtoa.c snprintf.c socket.c socktoa.c \
+	socktohost.c ssl_init.c statestr.c strdup.c strl_obsd.c \
+	syssignal.c timespecops.c timetoa.c timevalops.c timexsup.c \
+	uglydate.c vint64ops.c work_fork.c work_thread.c xsbprintf.c \
+	ymd2yd.c lib/isc/assertions.c lib/isc/buffer.c \
 	lib/isc/backtrace-emptytbl.c lib/isc/backtrace.c \
 	lib/isc/unix/dir.c lib/isc/error.c lib/isc/unix/errno2result.c \
 	lib/isc/event.c lib/isc/unix/file.c lib/isc/inet_ntop.c \
@ -238,15 +238,15 @@ am__objects_5 = a_md5encrypt.$(OBJEXT) adjtime.$(OBJEXT) \
 	ntp_libopts.$(OBJEXT) ntp_lineedit.$(OBJEXT) \
 	ntp_random.$(OBJEXT) ntp_realpath.$(OBJEXT) \
 	ntp_rfc2553.$(OBJEXT) ntp_worker.$(OBJEXT) numtoa.$(OBJEXT) \
-	numtohost.$(OBJEXT) octtoint.$(OBJEXT) prettydate.$(OBJEXT) \
-	refidsmear.$(OBJEXT) recvbuff.$(OBJEXT) refnumtoa.$(OBJEXT) \
-	snprintf.$(OBJEXT) socket.$(OBJEXT) socktoa.$(OBJEXT) \
-	socktohost.$(OBJEXT) ssl_init.$(OBJEXT) statestr.$(OBJEXT) \
-	strdup.$(OBJEXT) strl_obsd.$(OBJEXT) syssignal.$(OBJEXT) \
-	timespecops.$(OBJEXT) timetoa.$(OBJEXT) timevalops.$(OBJEXT) \
-	timexsup.$(OBJEXT) uglydate.$(OBJEXT) vint64ops.$(OBJEXT) \
-	work_fork.$(OBJEXT) work_thread.$(OBJEXT) xsbprintf.$(OBJEXT) \
-	ymd2yd.$(OBJEXT) $(am__objects_4) $(am__objects_1)
+	octtoint.$(OBJEXT) prettydate.$(OBJEXT) refidsmear.$(OBJEXT) \
+	recvbuff.$(OBJEXT) refnumtoa.$(OBJEXT) snprintf.$(OBJEXT) \
+	socket.$(OBJEXT) socktoa.$(OBJEXT) socktohost.$(OBJEXT) \
+	ssl_init.$(OBJEXT) statestr.$(OBJEXT) strdup.$(OBJEXT) \
+	strl_obsd.$(OBJEXT) syssignal.$(OBJEXT) timespecops.$(OBJEXT) \
+	timetoa.$(OBJEXT) timevalops.$(OBJEXT) timexsup.$(OBJEXT) \
+	uglydate.$(OBJEXT) vint64ops.$(OBJEXT) work_fork.$(OBJEXT) \
+	work_thread.$(OBJEXT) xsbprintf.$(OBJEXT) ymd2yd.$(OBJEXT) \
+	$(am__objects_4) $(am__objects_1)
 am_libntp_a_OBJECTS = systime.$(OBJEXT) $(am__objects_5)
 libntp_a_OBJECTS = $(am_libntp_a_OBJECTS)
 libntpsim_a_AR = $(AR) $(ARFLAGS)
@ -261,12 +261,12 @@ am__libntpsim_a_SOURCES_DIST = systime_s.c a_md5encrypt.c adjtime.c \
 	mktime.c modetoa.c mstolfp.c msyslog.c netof.c ntp_calendar.c \
 	ntp_calgps.c ntp_crypto_rnd.c ntp_intres.c ntp_libopts.c \
 	ntp_lineedit.c ntp_random.c ntp_realpath.c ntp_rfc2553.c \
-	ntp_worker.c numtoa.c numtohost.c octtoint.c prettydate.c \
-	refidsmear.c recvbuff.c refnumtoa.c snprintf.c socket.c \
-	socktoa.c socktohost.c ssl_init.c statestr.c strdup.c \
-	strl_obsd.c syssignal.c timespecops.c timetoa.c timevalops.c \
-	timexsup.c uglydate.c vint64ops.c work_fork.c work_thread.c \
-	xsbprintf.c ymd2yd.c lib/isc/assertions.c lib/isc/buffer.c \
+	ntp_worker.c numtoa.c octtoint.c prettydate.c refidsmear.c \
+	recvbuff.c refnumtoa.c snprintf.c socket.c socktoa.c \
+	socktohost.c ssl_init.c statestr.c strdup.c strl_obsd.c \
+	syssignal.c timespecops.c timetoa.c timevalops.c timexsup.c \
+	uglydate.c vint64ops.c work_fork.c work_thread.c xsbprintf.c \
+	ymd2yd.c lib/isc/assertions.c lib/isc/buffer.c \
 	lib/isc/backtrace-emptytbl.c lib/isc/backtrace.c \
 	lib/isc/unix/dir.c lib/isc/error.c lib/isc/unix/errno2result.c \
 	lib/isc/event.c lib/isc/unix/file.c lib/isc/inet_ntop.c \
@ -321,21 +321,20 @@ am__depfiles_remade = ./$(DEPDIR)/a_md5encrypt.Po \
 	./$(DEPDIR)/ntp_libopts.Po ./$(DEPDIR)/ntp_lineedit.Po \
 	./$(DEPDIR)/ntp_random.Po ./$(DEPDIR)/ntp_realpath.Po \
 	./$(DEPDIR)/ntp_rfc2553.Po ./$(DEPDIR)/ntp_worker.Po \
-	./$(DEPDIR)/numtoa.Po ./$(DEPDIR)/numtohost.Po \
-	./$(DEPDIR)/octtoint.Po ./$(DEPDIR)/prettydate.Po \
-	./$(DEPDIR)/recvbuff.Po ./$(DEPDIR)/refidsmear.Po \
-	./$(DEPDIR)/refnumtoa.Po ./$(DEPDIR)/snprintf.Po \
-	./$(DEPDIR)/socket.Po ./$(DEPDIR)/socktoa.Po \
-	./$(DEPDIR)/socktohost.Po ./$(DEPDIR)/ssl_init.Po \
-	./$(DEPDIR)/statestr.Po ./$(DEPDIR)/strdup.Po \
-	./$(DEPDIR)/strl_obsd.Po ./$(DEPDIR)/syssignal.Po \
-	./$(DEPDIR)/systime.Po ./$(DEPDIR)/systime_s.Po \
-	./$(DEPDIR)/timespecops.Po ./$(DEPDIR)/timetoa.Po \
-	./$(DEPDIR)/timevalops.Po ./$(DEPDIR)/timexsup.Po \
-	./$(DEPDIR)/uglydate.Po ./$(DEPDIR)/vint64ops.Po \
-	./$(DEPDIR)/work_fork.Po ./$(DEPDIR)/work_thread.Po \
-	./$(DEPDIR)/xsbprintf.Po ./$(DEPDIR)/ymd2yd.Po \
-	lib/isc/$(DEPDIR)/assertions.Po \
+	./$(DEPDIR)/numtoa.Po ./$(DEPDIR)/octtoint.Po \
+	./$(DEPDIR)/prettydate.Po ./$(DEPDIR)/recvbuff.Po \
+	./$(DEPDIR)/refidsmear.Po ./$(DEPDIR)/refnumtoa.Po \
+	./$(DEPDIR)/snprintf.Po ./$(DEPDIR)/socket.Po \
+	./$(DEPDIR)/socktoa.Po ./$(DEPDIR)/socktohost.Po \
+	./$(DEPDIR)/ssl_init.Po ./$(DEPDIR)/statestr.Po \
+	./$(DEPDIR)/strdup.Po ./$(DEPDIR)/strl_obsd.Po \
+	./$(DEPDIR)/syssignal.Po ./$(DEPDIR)/systime.Po \
+	./$(DEPDIR)/systime_s.Po ./$(DEPDIR)/timespecops.Po \
+	./$(DEPDIR)/timetoa.Po ./$(DEPDIR)/timevalops.Po \
+	./$(DEPDIR)/timexsup.Po ./$(DEPDIR)/uglydate.Po \
+	./$(DEPDIR)/vint64ops.Po ./$(DEPDIR)/work_fork.Po \
+	./$(DEPDIR)/work_thread.Po ./$(DEPDIR)/xsbprintf.Po \
+	./$(DEPDIR)/ymd2yd.Po lib/isc/$(DEPDIR)/assertions.Po \
 	lib/isc/$(DEPDIR)/backtrace-emptytbl.Po \
 	lib/isc/$(DEPDIR)/backtrace.Po lib/isc/$(DEPDIR)/buffer.Po \
 	lib/isc/$(DEPDIR)/error.Po lib/isc/$(DEPDIR)/event.Po \
@ -581,6 +580,7 @@ PACKAGE_TARNAME = @PACKAGE_TARNAME@
 PACKAGE_URL = @PACKAGE_URL@
 PACKAGE_VERSION = @PACKAGE_VERSION@
 PATH_NET_SNMP_CONFIG = @PATH_NET_SNMP_CONFIG@
+PATH_OPENSSL = @PATH_OPENSSL@
 PATH_PERL = @PATH_PERL@
 PATH_RUBY = @PATH_RUBY@
 PATH_SEPARATOR = @PATH_SEPARATOR@
@ -822,7 +822,6 @@ libntp_a_SRCS = \
 	ntp_rfc2553.c					\
 	ntp_worker.c					\
 	numtoa.c					\
-	numtohost.c					\
 	octtoint.c					\
 	prettydate.c					\
 	refidsmear.c					\
@ -1093,7 +1092,6 @@ distclean-compile:
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ntp_rfc2553.Po@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ntp_worker.Po@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/numtoa.Po@am__quote@ # am--include-marker
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/numtohost.Po@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/octtoint.Po@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/prettydate.Po@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/recvbuff.Po@am__quote@ # am--include-marker
@ -1380,7 +1378,6 @@ distclean: distclean-am
 	-rm -f ./$(DEPDIR)/ntp_rfc2553.Po
 	-rm -f ./$(DEPDIR)/ntp_worker.Po
 	-rm -f ./$(DEPDIR)/numtoa.Po
-	-rm -f ./$(DEPDIR)/numtohost.Po
 	-rm -f ./$(DEPDIR)/octtoint.Po
 	-rm -f ./$(DEPDIR)/prettydate.Po
 	-rm -f ./$(DEPDIR)/recvbuff.Po
@ -1535,7 +1532,6 @@ maintainer-clean: maintainer-clean-am
 	-rm -f ./$(DEPDIR)/ntp_rfc2553.Po
 	-rm -f ./$(DEPDIR)/ntp_worker.Po
 	-rm -f ./$(DEPDIR)/numtoa.Po
-	-rm -f ./$(DEPDIR)/numtohost.Po
 	-rm -f ./$(DEPDIR)/octtoint.Po
 	-rm -f ./$(DEPDIR)/prettydate.Po
 	-rm -f ./$(DEPDIR)/recvbuff.Po
--- a/contrib/ntp/libntp/a_md5encrypt.c
+++ b/contrib/ntp/libntp/a_md5encrypt.c
@ -21,7 +21,6 @@ typedef struct {
 	size_t		len;
 } rwbuffT;

-
 #if defined(OPENSSL) && defined(ENABLE_CMAC)
 static size_t
 cmac_ctx_size(
@ -40,6 +39,37 @@ cmac_ctx_size(
 #endif	/* OPENSSL && ENABLE_CMAC */


+/*
+ * Allocate and initialize a digest context.  As a speed optimization,
+ * take an idea from ntpsec and cache the context to avoid malloc/free
+ * overhead in time-critical paths.  ntpsec also caches the algorithms
+ * with each key.
+ * This is not thread-safe, but that is
+ * not a problem at present.
+ */
+static EVP_MD_CTX *
+get_md_ctx(
+	int		nid
+	)
+{
+#ifndef OPENSSL
+	static MD5_CTX	md5_ctx;
+
+	DEBUG_INSIST(NID_md5 == nid);
+	MD5Init(&md5_ctx);
+
+	return &md5_ctx;
+#else
+	if (!EVP_DigestInit(digest_ctx, EVP_get_digestbynid(nid))) {
+		msyslog(LOG_ERR, "%s init failed", OBJ_nid2sn(nid));
+		return NULL;
+	}
+
+	return digest_ctx;
+#endif	/* OPENSSL */
+}
+
+
 static size_t
 make_mac(
 	const rwbuffT *	digest,
@ -99,26 +129,13 @@ make_mac(
 			CMAC_CTX_free(ctx);
 	}
 	else
-#   endif /*ENABLE_CMAC*/
+#   endif /* ENABLE_CMAC */
 	{	/* generic MAC handling */
-		EVP_MD_CTX *	ctx   = EVP_MD_CTX_new();
+		EVP_MD_CTX *	ctx;
 		u_int		uilen = 0;

-		if ( ! ctx) {
-			msyslog(LOG_ERR, "MAC encrypt: MAC %s Digest CTX new failed.",
-				OBJ_nid2sn(ktype));
-			goto mac_fail;
-		}
-
-	   #ifdef EVP_MD_CTX_FLAG_NON_FIPS_ALLOW
-		/* make sure MD5 is allowd */
-		EVP_MD_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
-	   #endif
-		/* [Bug 3457] DON'T use plain EVP_DigestInit! It would
-		 * kill the flags! */
-		if (!EVP_DigestInit_ex(ctx, EVP_get_digestbynid(ktype), NULL)) {
-			msyslog(LOG_ERR, "MAC encrypt: MAC %s Digest Init failed.",
-				OBJ_nid2sn(ktype));
+		ctx = get_md_ctx(ktype);
+		if (NULL == ctx) {
 			goto mac_fail;
 		}
 		if ((size_t)EVP_MD_CTX_size(ctx) > digest->len) {
@ -143,39 +160,25 @@ make_mac(
 		}
 	  mac_fail:
 		retlen = (size_t)uilen;
-
-		if (ctx)
-			EVP_MD_CTX_free(ctx);
 	}

 #else /* !OPENSSL follows */

-	if (ktype == NID_md5)
-	{
-		EVP_MD_CTX *	ctx   = EVP_MD_CTX_new();
-		u_int		uilen = 0;
+	if (NID_md5 == ktype) {
+		EVP_MD_CTX *	ctx;

-		if (digest->len < 16) {
+		ctx = get_md_ctx(ktype);
+		if (digest->len < MD5_LENGTH) {
 			msyslog(LOG_ERR, "%s", "MAC encrypt: MAC md5 buf too small.");
+		} else {
+			MD5Init(ctx);
+			MD5Update(ctx, (const void *)key->buf, key->len);
+			MD5Update(ctx, (const void *)msg->buf, msg->len);
+			MD5Final(digest->buf, ctx);
+			retlen = MD5_LENGTH;
 		}
-		else if ( ! ctx) {
-			msyslog(LOG_ERR, "%s", "MAC encrypt: MAC md5 Digest CTX new failed.");
-		}
-		else if (!EVP_DigestInit(ctx, EVP_get_digestbynid(ktype))) {
-			msyslog(LOG_ERR, "%s", "MAC encrypt: MAC md5 Digest INIT failed.");
-		}
-		else {
-			EVP_DigestUpdate(ctx, key->buf, key->len);
-			EVP_DigestUpdate(ctx, msg->buf, msg->len);
-			EVP_DigestFinal(ctx, digest->buf, &uilen);
-		}
-		if (ctx)
-			EVP_MD_CTX_free(ctx);
-		retlen = (size_t)uilen;
-	}
-	else
-	{
-		msyslog(LOG_ERR, "MAC encrypt: invalid key type %d"  , ktype);
+	} else {
+		msyslog(LOG_ERR, "MAC encrypt: invalid key type %d", ktype);
 	}

 #endif /* !OPENSSL */
@ -187,7 +190,7 @@ make_mac(
 /*
 * MD5authencrypt - generate message digest
 *
- * Returns length of MAC including key ID and digest.
+ * Returns 0 on failure or length of MAC including key ID.
 */
 size_t
 MD5authencrypt(
@ -202,13 +205,14 @@ MD5authencrypt(
 	rwbuffT digb = { digest, sizeof(digest) };
 	robuffT keyb = { key, klen };
 	robuffT msgb = { pkt, length };
-	size_t	dlen = 0;
+	size_t	dlen;

 	dlen = make_mac(&digb, type, &keyb, &msgb);
-	/* If the MAC is longer than the MAX then truncate it. */
-	if (dlen > MAX_MDG_LEN)
-		dlen = MAX_MDG_LEN;
-	memcpy((u_char *)pkt + length + KEY_MAC_LEN, digest, dlen);
+	if (0 == dlen) {
+		return 0;
+	}
+	memcpy((u_char *)pkt + length + KEY_MAC_LEN, digest,
+	       min(dlen, MAX_MDG_LEN));
 	return (dlen + KEY_MAC_LEN);
 }

@ -236,15 +240,11 @@ MD5authdecrypt(
 	size_t	dlen = 0;

 	dlen = make_mac(&digb, type, &keyb, &msgb);
-
-	/* If the MAC is longer than the MAX then truncate it. */
-	if (dlen > MAX_MDG_LEN)
-		dlen = MAX_MDG_LEN;
-	if (size != (size_t)dlen + KEY_MAC_LEN) {
+	if (0 == dlen || size != dlen + KEY_MAC_LEN) {
 		msyslog(LOG_ERR,
-			"MAC decrypt: MAC length error: len=%u key=%d",
-			(u_int)size, keyno);
-		return (0);
+			"MAC decrypt: MAC length error: %u not %u for key %u",
+			(u_int)size, (u_int)(dlen + KEY_MAC_LEN), keyno);
+		return FALSE;
 	}
 	return !isc_tsmemcmp(digest,
 		 (u_char *)pkt + length + KEY_MAC_LEN, dlen);
@ -254,39 +254,36 @@ MD5authdecrypt(
 * Calculate the reference id from the address. If it is an IPv4
 * address, use it as is. If it is an IPv6 address, do a md5 on
 * it and use the bottom 4 bytes.
- * The result is in network byte order.
+ * The result is in network byte order for IPv4 addreseses.  For
+ * IPv6, ntpd long differed in the hash calculated on big-endian
+ * vs. little-endian because the first four bytes of the MD5 hash
+ * were used as a u_int32 without any byte swapping.  This broke
+ * the refid-based loop detection between mixed-endian systems.
+ * In order to preserve behavior on the more-common little-endian
+ * systems, the hash is now byte-swapped on big-endian systems to
+ * match the little-endian hash.  This is ugly but it seems better
+ * than changing the IPv6 refid calculation on the more-common
+ * systems.
+ * This is not thread safe, not a problem so far.
 */
 u_int32
 addr2refid(sockaddr_u *addr)
 {
-	u_char		digest[EVP_MAX_MD_SIZE];
-	u_int32		addr_refid;
-	EVP_MD_CTX	*ctx;
-	u_int		len;
+	static MD5_CTX	md5_ctx;
+	union u_tag {
+		u_char		digest[MD5_DIGEST_LENGTH];
+		u_int32		addr_refid;
+	} u;

-	if (IS_IPV4(addr))
+	if (IS_IPV4(addr)) {
 		return (NSRCADR(addr));
-
-	INIT_SSL();
-
-	ctx = EVP_MD_CTX_new();
-#   ifdef EVP_MD_CTX_FLAG_NON_FIPS_ALLOW
-	/* MD5 is not used as a crypto hash here. */
-	EVP_MD_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
-#   endif
-	/* [Bug 3457] DON'T use plain EVP_DigestInit! It would kill the
-	 * flags! */
-	if (!EVP_DigestInit_ex(ctx, EVP_md5(), NULL)) {
-		msyslog(LOG_ERR,
-		    "MD5 init failed");
-		EVP_MD_CTX_free(ctx);	/* pedantic... but safe */
-		exit(1);
 	}
-
-	EVP_DigestUpdate(ctx, (u_char *)PSOCK_ADDR6(addr),
-	    sizeof(struct in6_addr));
-	EVP_DigestFinal(ctx, digest, &len);
-	EVP_MD_CTX_free(ctx);
-	memcpy(&addr_refid, digest, sizeof(addr_refid));
-	return (addr_refid);
+	/* MD5 is not used for authentication here. */
+	MD5Init(&md5_ctx);
+	MD5Update(&md5_ctx, (void *)&SOCK_ADDR6(addr), sizeof(SOCK_ADDR6(addr)));
+	MD5Final(u.digest, &md5_ctx);
+#ifdef WORDS_BIGENDIAN
+	u.addr_refid = BYTESWAP32(u.addr_refid);
+#endif
+	return u.addr_refid;
 }
--- a/contrib/ntp/libntp/adjtime.c
+++ b/contrib/ntp/libntp/adjtime.c
@ -381,6 +381,6 @@ adjtime (struct timeval *delta, struct timeval *olddelta)
    return 0;
 }
 # else /* no special adjtime() needed */
-int adjtime_bs;
+NONEMPTY_TRANSLATION_UNIT
 # endif
 #endif
--- a/contrib/ntp/libntp/audio.c
+++ b/contrib/ntp/libntp/audio.c
@ -517,5 +517,5 @@ audio_show(void)
 #endif /* not PCM_STYLE_SOUND */
 }
 #else
-int audio_bs;
+NONEMPTY_TRANSLATION_UNIT
 #endif /* HAVE_{SYS_AUDIOIO,SUN_AUDIOIO,MACHINE_SOUNDCARD,SYS_SOUNDCARD}_H */
--- a/contrib/ntp/libntp/authkeys.c
+++ b/contrib/ntp/libntp/authkeys.c
@ -611,6 +611,9 @@ authhavekey(

 	/*
 	 * The key is found and trusted. Initialize the key cache.
+	 * The cache really should be a struct savekey to streamline
+	 * this code.  Using a sk pointer would be even faster but more
+	 * fragile around pointing to freed memory.
 	 */
 	cache_keyid = sk->keyid;
 	cache_type = sk->type;
@ -927,6 +930,7 @@ authdecrypt(
 			      pkt, length, size, keyno);
 }

+
 /* password decoding helpers */
 static size_t
 pwdecode_plain(
--- a/contrib/ntp/libntp/authreadkeys.c
+++ b/contrib/ntp/libntp/authreadkeys.c
@ -218,14 +218,14 @@ authreadkeys(
 		keytype = keytype_from_text(token, NULL);
 		if (keytype == 0) {
 			log_maybe(NULL,
-				  "authreadkeys: invalid type for key %d",
-				  keyno);
+				  "authreadkeys: unsupported type %s for key %d",
+				  token, keyno);
 #  ifdef ENABLE_CMAC
 		} else if (NID_cmac != keytype &&
 				EVP_get_digestbynid(keytype) == NULL) {
 			log_maybe(NULL,
-				  "authreadkeys: no algorithm for key %d",
-				  keyno);
+				  "authreadkeys: no algorithm for %s key %d",
+				  token, keyno);
 			keytype = 0;
 #  endif /* ENABLE_CMAC */
 		}
@ -270,11 +270,13 @@ authreadkeys(
 					  "authreadkeys: passwd has bad char for key %d",
 					  keyno);
 				break;
+#ifdef DEBUG
 			default:
 				log_maybe(&nerr,
-					  "authreadkeys: unknown errno %d for key %d",
+					  "authreadkeys: unexpected errno %d for key %d: %m",
 					  errno, keyno);
 				break;
+#endif
 			}
 			continue;
 		}
--- a/contrib/ntp/libntp/bsd_strerror.c
+++ b/contrib/ntp/libntp/bsd_strerror.c
@ -45,5 +45,5 @@ strerror(
 	return ebuf;
 }
 #else
-int strerror_bs;
+NONEMPTY_TRANSLATION_UNIT
 #endif
--- a/contrib/ntp/libntp/clocktypes.c
+++ b/contrib/ntp/libntp/clocktypes.c
@ -6,7 +6,6 @@

 #include "ntp_fp.h"
 #include "ntp.h"
-#include "lib_strbuf.h"
 #include "ntp_refclock.h"
 #include "ntp_stdlib.h"

--- a/contrib/ntp/libntp/dofptoa.c
+++ b/contrib/ntp/libntp/dofptoa.c
@ -5,8 +5,6 @@
 #include <stdio.h>

 #include "ntp_fp.h"
-#include "lib_strbuf.h"
-#include "ntp_string.h"
 #include "ntp_stdlib.h"

 char *
--- a/contrib/ntp/libntp/dolfptoa.c
+++ b/contrib/ntp/libntp/dolfptoa.c
@ -5,8 +5,6 @@
 #include <stdio.h>

 #include "ntp_fp.h"
-#include "lib_strbuf.h"
-#include "ntp_string.h"
 #include "ntp_stdlib.h"

 char *
--- a/contrib/ntp/libntp/humandate.c
+++ b/contrib/ntp/libntp/humandate.c
@ -6,7 +6,6 @@

 #include "ntp_fp.h"
 #include "ntp_unixtime.h"	/* includes <sys/time.h> and <time.h> */
-#include "lib_strbuf.h"
 #include "ntp_stdlib.h"


--- a/contrib/ntp/libntp/lib/isc/win32/strerror.c
+++ b/contrib/ntp/libntp/lib/isc/win32/strerror.c
@ -29,6 +29,8 @@
 #include <isc/strerror.h>
 #include <isc/util.h>

+#include "lib_strbuf.h"
+
 /*
 * Forward declarations
 */
@ -88,19 +90,47 @@ isc__strerror(int num, char *buf, size_t size) {
 */
 char *
 FormatError(int error) {
-	LPVOID lpMsgBuf = NULL;
+	char *lpMsgBuf = NULL;
+	char *pch;
+	const char boiler[] =
+		" For information about network troubleshooting, see Windows Help.";
+	size_t last;
+
 	FormatMessage( 
 		FORMAT_MESSAGE_ALLOCATE_BUFFER | 
 		FORMAT_MESSAGE_FROM_SYSTEM | 
-		FORMAT_MESSAGE_IGNORE_INSERTS,
+		(FORMAT_MESSAGE_MAX_WIDTH_MASK - 1),
 		NULL,
 		error,
 		/* Default language */
 		MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
-		(LPTSTR) &lpMsgBuf,
+		(LPTSTR)(PVOID)&lpMsgBuf,
 		0,
 		NULL); 

+	/* remove useless boilerplate */
+	pch = strstr(lpMsgBuf, boiler);
+	if (pch != NULL) {
+		*pch = '\0';
+	}
+
+	/* strip any trailing CR/LF and spaces */
+	if (lpMsgBuf != NULL) {
+		last = strlen(lpMsgBuf);
+		if (last > 0) {
+			--last;
+		}
+		while ('\n' == lpMsgBuf[last] ||
+		       '\r' == lpMsgBuf[last] ||
+		       ' '  == lpMsgBuf[last]) {
+
+			lpMsgBuf[last] = '\0';
+			if (last > 0) {
+				--last;
+			}
+		}
+	}
+
 	return (lpMsgBuf);
 }

@ -113,27 +143,31 @@ char *
 NTstrerror(int err, BOOL *bfreebuf) {
 	char *retmsg = NULL;

-	/* Copy the error value first in case of other errors */	
-	DWORD errval = err; 
-
 	*bfreebuf = FALSE;

 	/* Get the Winsock2 error messages */
-	if (errval >= WSABASEERR && errval <= (WSABASEERR + 1999)) {
-		retmsg = GetWSAErrorMessage(errval);
-		if (retmsg != NULL)
-			return (retmsg);
+	/* DLH this may not be needed, FormatError/FormatMessage may handle Winsock error codes */
+	if (err >= WSABASEERR && err <= (WSABASEERR + 1999)) {
+		retmsg = GetWSAErrorMessage(err);
 	}
 	/*
 	 * If it's not one of the standard Unix error codes,
 	 * try a system error message
 	 */
-	if (errval > (DWORD) _sys_nerr) {
-		*bfreebuf = TRUE;
-		return (FormatError(errval));
-	} else {
-		return (strerror(errval));
+	if (NULL == retmsg) {
+		if (err > _sys_nerr) {
+			*bfreebuf = TRUE;
+			retmsg = FormatError(err);
+		} else {
+			retmsg = lib_getbuf();
+			if (0 != strerror_s(retmsg, LIB_BUFLENGTH, err)) {
+				snprintf(retmsg, LIB_BUFLENGTH,
+					 "Unknown error number %d/0x%x",
+					 err, err);
+			}
+		}
 	}
+	return retmsg;
 }

 /*
--- a/contrib/ntp/libntp/lib_strbuf.c
+++ b/contrib/ntp/libntp/lib_strbuf.c
@ -1,10 +1,11 @@
 /*
- * lib_strbuf - library string storage
+ * lib_strbuf.c - init_lib() and library string storage
 */
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 #endif

+#include <isc/mutex.h>
 #include <isc/net.h>
 #include <isc/result.h>

@ -12,17 +13,18 @@
 #include "ntp_stdlib.h"
 #include "lib_strbuf.h"

+#define LIB_NUMBUF	10

 /*
 * Storage declarations
 */
-int		debug;
-libbufstr	lib_stringbuf[LIB_NUMBUF];
-int		lib_nextbuf;
-int		ipv4_works;
-int		ipv6_works;
-int		lib_inited;
-
+static char		lib_stringbuf_storage[LIB_NUMBUF][LIB_BUFLENGTH];
+static char *		lib_stringbuf[LIB_NUMBUF];
+int			lib_inited;
+static isc_mutex_t	lib_mutex;
+int			ipv4_works;
+int			ipv6_works;
+int			debug;

 /*
 * initialization routine.  Might be needed if the code is ROMized.
@ -30,10 +32,41 @@ int		lib_inited;
 void
 init_lib(void)
 {
-	if (lib_inited)
+	u_int	u;
+
+	if (lib_inited) {
 		return;
+	}
 	ipv4_works = (ISC_R_SUCCESS == isc_net_probeipv4());
 	ipv6_works = (ISC_R_SUCCESS == isc_net_probeipv6());
 	init_systime();
+	/*
+	 * Avoid -Wrestrict warnings by keeping a pointer to each buffer
+	 * so the compiler can see copying from one buffer to another is
+	 * not violating restrict qualifiers on, e.g. memcpy() args.
+	 */
+	for (u = 0; u < COUNTOF(lib_stringbuf); u++) {
+		lib_stringbuf[u] = lib_stringbuf_storage[u];
+	}
+	isc_mutex_init(&lib_mutex);
 	lib_inited = TRUE;
 }
+
+
+char *
+lib_getbuf(void)
+{
+	static int	lib_nextbuf;
+	int		mybuf;
+
+	if (!lib_inited) {
+		init_lib();
+	}
+	isc_mutex_lock(&lib_mutex);
+	mybuf = lib_nextbuf;
+	lib_nextbuf = (1 + mybuf) % COUNTOF(lib_stringbuf);
+	isc_mutex_unlock(&lib_mutex);
+	zero_mem(lib_stringbuf[mybuf], LIB_BUFLENGTH);
+
+	return lib_stringbuf[mybuf];
+}
--- a/contrib/ntp/libntp/machines.c
+++ b/contrib/ntp/libntp/machines.c
@ -13,17 +13,16 @@
 #include "ntp_syslog.h"
 #include "ntp_stdlib.h"
 #include "ntp_unixtime.h"
-#include "lib_strbuf.h"
 #include "ntp_debug.h"
+#include "ntp_tty.h"

 #ifdef HAVE_UNISTD_H
 #include <unistd.h>
 #endif

 #ifdef SYS_WINNT
-int _getch(void);	/* Declare the one function rather than include conio.h */
+#include <conio.h>
 #else
-
 #ifdef SYS_VXWORKS
 #include "taskLib.h"
 #include "sysLib.h"
@ -531,3 +530,58 @@ getpass(const char * prompt)
 	return password;
 }
 #endif /* SYS_WINNT */
+
+
+static const int baudTable[][2] = {
+	{B0, 0},
+	{B50, 50},
+	{B75, 75},
+	{B110, 110},
+	{B134, 134},
+	{B150, 150},
+	{B200, 200},
+	{B300, 300},
+	{B600, 600},
+	{B1200, 1200},
+	{B1800, 1800},
+	{B2400, 2400},
+	{B4800, 4800},
+	{B9600, 9600},
+	{B19200, 19200},
+	{B38400, 38400},
+#   ifdef B57600
+	{B57600, 57600 },
+#   endif
+#   ifdef B115200
+	{B115200, 115200},
+#   endif
+	{-1, -1}
+};
+
+
+int  symBaud2numBaud(int symBaud)
+{
+	int i;
+
+	for (i = 0; baudTable[i][1] >= 0; ++i) {
+		if (baudTable[i][0] == symBaud) {
+			break;
+		}
+	}
+	return baudTable[i][1];
+}
+
+
+#if 0	/* unused */
+int  numBaud2symBaud(int numBaud)
+{
+	int i;
+
+	for (i = 0; baudTable[i][1] >= 0; ++i) {
+		if (baudTable[i][1] == numBaud) {
+			break;
+		}
+	}
+	return baudTable[i][0];
+}
+#endif	/* unused fn */
--- a/contrib/ntp/libntp/modetoa.c
+++ b/contrib/ntp/libntp/modetoa.c
@ -4,7 +4,6 @@
 #include <config.h>
 #include <stdio.h>

-#include "lib_strbuf.h"
 #include "ntp_stdlib.h"

 const char *
--- a/contrib/ntp/libntp/msyslog.c
+++ b/contrib/ntp/libntp/msyslog.c
@ -348,15 +348,14 @@ msyslog(
 	...
 	)
 {
-	char	buf[1024];
 	va_list	ap;

 	va_start(ap, fmt);
-	mvsnprintf(buf, sizeof(buf), fmt, ap);
+	mvsyslog(level, fmt, ap);
 	va_end(ap);
-	addto_syslog(level, buf);
 }

+
 void
 mvsyslog(
 	int		level,
@ -365,6 +364,7 @@ mvsyslog(
 	)
 {
 	char	buf[1024];
+
 	mvsnprintf(buf, sizeof(buf), fmt, ap);
 	addto_syslog(level, buf);
 }
--- a/contrib/ntp/libntp/netof.c
+++ b/contrib/ntp/libntp/netof.c
@ -1,5 +1,5 @@
 /* 
- * netof - return the net address part of an ip address in a sockaddr_storage structure
+ * netof - return the net address part of an ip address in a sockaddr_u structure
 *         (zero out host part)
 */
 #include <config.h>
@ -11,12 +11,19 @@
 #include "ntp_stdlib.h"
 #include "ntp.h"

+/* 
+ * Return the network portion of a host address.  Used by ntp_io.c
+ * findbcastinter() to find a multicast/broadcast interface for
+ * a given remote address.  Note static storage is used, with room
+ * for only two addresses, which is all that is needed at present.
+ * 
+ */
 sockaddr_u *
 netof(
 	sockaddr_u *hostaddr
 	)
 {
-	static sockaddr_u	netofbuf[8];
+	static sockaddr_u	netofbuf[2];
 	static int		next_netofbuf;
 	u_int32			netnum;
 	sockaddr_u *		netaddr;
@ -27,20 +34,11 @@ netof(
 	memcpy(netaddr, hostaddr, sizeof(*netaddr));

 	if (IS_IPV4(netaddr)) {
-		netnum = SRCADR(netaddr);
-
 		/*
-		 * We live in a modern CIDR world where the basement nets, which
-		 * used to be class A, are now probably associated with each
-		 * host address. So, for class-A nets, all bits are significant.
+		 * We live in a modern classless IPv4 world.  Assume /24.
 		 */
-		if (IN_CLASSC(netnum))
-			netnum &= IN_CLASSC_NET;
-		else if (IN_CLASSB(netnum))
-			netnum &= IN_CLASSB_NET;
-
+		netnum = SRCADR(netaddr) & IN_CLASSC_NET;
 		SET_ADDR4(netaddr, netnum);
-
 	} else if (IS_IPV6(netaddr))
 		/* assume the typical /64 subnet size */
 		zero_mem(&NSRCADR6(netaddr)[8], 8);
--- a/contrib/ntp/libntp/ntp_calendar.c
+++ b/contrib/ntp/libntp/ntp_calendar.c
@ -56,7 +56,6 @@
 #include "ntp_unixtime.h"

 #include "ntpd.h"
-#include "lib_strbuf.h"

 /* For now, let's take the conservative approach: if the target property
 * macros are not defined, check a few well-known compiler/architecture
--- a/contrib/ntp/libntp/ntp_intres.c
+++ b/contrib/ntp/libntp/ntp_intres.c
@ -84,12 +84,6 @@
 #  include <netdb.h>
 # endif
 # include <resolv.h>
-# ifdef HAVE_INT32_ONLY_WITH_DNS
-#  define HAVE_INT32
-# endif
-# ifdef HAVE_U_INT32_ONLY_WITH_DNS
-#  define HAVE_U_INT32
-# endif
 #endif

 #include "ntp.h"
--- a/contrib/ntp/libntp/ntp_realpath.c
+++ b/contrib/ntp/libntp/ntp_realpath.c
@ -103,7 +103,7 @@ realpath1(const char *path, char *resolved)
 	size_t left_len, resolved_len, next_token_len;
 	unsigned symlinks;
 	ssize_t slen;
-	char left[NTP_PATH_MAX], next_token[NTP_PATH_MAX], symlink[NTP_PATH_MAX];
+	char left[NTP_PATH_MAX], next_token[NTP_PATH_MAX], link_tgt[NTP_PATH_MAX];

 	symlinks = 0;
 	if (path[0] == '/') {
@ -157,7 +157,7 @@ realpath1(const char *path, char *resolved)
 			resolved[resolved_len++] = '/';
 			resolved[resolved_len] = '\0';
 		}
-		if (next_token[0] == '\0') {
+		if ('\0' == next_token[0]) {
 			/* Handle consequential slashes. */
 			continue;
 		} else if (strcmp(next_token, ".") == 0) {
@ -187,23 +187,24 @@ realpath1(const char *path, char *resolved)
 		if (lstat(resolved, &sb) != 0)
 			return (NULL);
 		if (S_ISLNK(sb.st_mode)) {
-			if (symlinks++ > NTP_MAXSYMLINKS) {
+			if (++symlinks > NTP_MAXSYMLINKS) {
 				errno = ELOOP;
 				return (NULL);
 			}
-			slen = readlink(resolved, symlink, sizeof(symlink));
-			if (slen <= 0 || slen >= (ssize_t)sizeof(symlink)) {
-				if (slen < 0)
-					; /* keep errno from readlink(2) call */
-				else if (slen == 0)
+			slen = readlink(resolved, link_tgt, sizeof(link_tgt));
+			if (slen <= 0 || slen >= (ssize_t)sizeof(link_tgt)) {
+				if (slen < 0) {
+					/* keep errno from readlink(2) call */
+				} else if (slen == 0) {
 					errno = ENOENT;
-				else
+				} else {
 					errno = ENAMETOOLONG;
+				}
 				return (NULL);
 			}
-			symlink[slen] = '\0';
-			if (symlink[0] == '/') {
-				resolved[1] = 0;
+			link_tgt[slen] = '\0';
+			if (link_tgt[0] == '/') {
+				resolved[1] = '\0';
 				resolved_len = 1;
 			} else {
 				/* Strip the last path component. */
@ -214,26 +215,26 @@ realpath1(const char *path, char *resolved)

 			/*
 			 * If there are any path components left, then
-			 * append them to symlink. The result is placed
+			 * append them to link_tgt. The result is placed
 			 * in `left'.
 			 */
 			if (p != NULL) {
-				if (symlink[slen - 1] != '/') {
-					if (slen + 1 >= (ssize_t)sizeof(symlink)) {
+				if (link_tgt[slen - 1] != '/') {
+					if (slen + 1 >= (ssize_t)sizeof(link_tgt)) {
 						errno = ENAMETOOLONG;
 						return (NULL);
 					}
-					symlink[slen] = '/';
-					symlink[slen + 1] = 0;
+					link_tgt[slen] = '/';
+					link_tgt[slen + 1] = 0;
 				}
-				left_len = strlcat(symlink, left,
-				    sizeof(symlink));
-				if (left_len >= sizeof(symlink)) {
+				left_len = strlcat(link_tgt, left,
+						   sizeof(link_tgt));
+				if (left_len >= sizeof(link_tgt)) {
 					errno = ENAMETOOLONG;
 					return (NULL);
 				}
 			}
-			left_len = strlcpy(left, symlink, sizeof(left));
+			left_len = strlcpy(left, link_tgt, sizeof(left));
 		} else if (!S_ISDIR(sb.st_mode) && p != NULL) {
 			errno = ENOTDIR;
 			return (NULL);
--- a/contrib/ntp/libntp/numtoa.c
+++ b/contrib/ntp/libntp/numtoa.c
@ -12,7 +12,6 @@
 #include <ctype.h>

 #include "ntp_fp.h"
-#include "lib_strbuf.h"
 #include "ntp_stdlib.h"

 char *
@ -34,7 +33,11 @@ numtoa(
 }


-/* Convert a refid & stratum to a string */
+/* 
+ * Convert a refid & stratum to a string.  If stratum is negative and the
+ * refid consists entirely of graphic chars, up to an optional
+ * terminating zero, display as text similar to stratum 0 & 1.
+ */
 const char *
 refid_str(
 	u_int32	refid,
@ -43,33 +46,44 @@ refid_str(
 {
 	char *	text;
 	size_t	tlen;
-	char *  cp;
-
-	if (stratum > 1)
-		return numtoa(refid);
-
-	LIB_GETBUF(text);
-	text[0] = '.';
-	/* What if any non-NUL char is not printable? */
-	memcpy(&text[1], &refid, sizeof(refid));
-	text[1 + sizeof(refid)] = '\0';
-	tlen = strlen(text);
-	text[tlen] = '.';
-	text[tlen + 1] = '\0';
+	char *	cp;
+	int	printable;

 	/*
-	 * Now make sure the contents are 'graphic'.
-	 *
-	 * This refid is expected to be up to 4 ascii graphics.
-	 * If any character is not a graphic, replace it with a space.
-	 * This will at least alert the viewer of a problem.
+	 * ntpd can have stratum = 0 and refid 127.0.0.1 in orphan mode.
+	 * https://bugs.ntp.org/3854.  Mirror the refid logic in timer().
 	 */
-	for (cp = text + 1; *cp; ++cp) {
-		if (!isgraph((int)*cp)) {
-			*cp = ' ';
+	if (0 == stratum && LOOPBACKADR_N == refid) {
+		return ".ORPH.";
+	}
+	printable = FALSE;
+	if (stratum < 2) {
+		text = lib_getbuf();
+		text[0] = '.';
+		memcpy(&text[1], &refid, sizeof(refid));
+		text[1 + sizeof(refid)] = '\0';
+		tlen = strlen(text);
+		text[tlen] = '.';
+		text[tlen + 1] = '\0';
+		/*
+		 * Now make sure the contents are 'graphic'.
+		 *
+		 * This refid is expected to be up to 4 printable ASCII.
+		 * isgraph() is similar to isprint() but excludes space.
+		 * If any character is not graphic, replace it with a '?'.
+		 * This will at least alert the viewer of a problem.
+		 */
+		for (cp = text + 1; '\0' != *cp; ++cp) {
+			if (!isgraph((int)*cp)) {
+				printable = FALSE;
+				*cp = '?';
+			}
+		}
+		if (   (stratum < 0 && printable)
+		    || stratum < 2) {
+			return text;
 		}
 	}
-
-	return text;
+	return numtoa(refid);
 }

--- a/contrib/ntp/libntp/numtohost.c
+++ b/contrib/ntp/libntp/numtohost.c
@ -1,43 +0,0 @@
-/*
- * numtohost - convert network number to host name.
- */
-#include <config.h>
-
-#include <sys/types.h>
-#ifdef HAVE_NETINET_IN_H
-#include <netinet/in.h>		/* ntohl */
-#endif
-
-#include "ntp_fp.h"
-#include "ntp_stdlib.h"
-#include "lib_strbuf.h"
-
-#define	LOOPBACKNET	0x7f000000
-#define	LOOPBACKHOST	0x7f000001
-#define	LOOPBACKNETMASK	0xff000000
-
-char *
-numtohost(
-	u_int32 netnum
-	)
-{
-	char *bp;
-	struct hostent *hp;
-
-	/*
-	 * This is really gross, but saves lots of hanging looking for
-	 * hostnames for the radio clocks.  Don't bother looking up
-	 * addresses on the loopback network except for the loopback
-	 * host itself.
-	 */
-	if ((((ntohl(netnum) & LOOPBACKNETMASK) == LOOPBACKNET)
-	     && (ntohl(netnum) != LOOPBACKHOST))
-	    || ((hp = gethostbyaddr((char *)&netnum, sizeof netnum, AF_INET))
-		== 0))
-	    return numtoa(netnum);
-	
-	LIB_GETBUF(bp);
-	strlcpy(bp, hp->h_name, LIB_BUFLENGTH);
-
-	return bp;
-}
--- a/contrib/ntp/libntp/prettydate.c
+++ b/contrib/ntp/libntp/prettydate.c
@ -6,7 +6,6 @@

 #include "ntp_fp.h"
 #include "ntp_unixtime.h"	/* includes <sys/time.h> */
-#include "lib_strbuf.h"
 #include "ntp_stdlib.h"
 #include "ntp_assert.h"
 #include "ntp_calendar.h"
--- a/contrib/ntp/libntp/recvbuff.c
+++ b/contrib/ntp/libntp/recvbuff.c
@ -93,41 +93,54 @@ initialise_buffer(recvbuf_t *buff)

 static void
 create_buffers(
-	size_t		nbufs)
+	size_t			nbufs
+)
 {
+	static const u_int	chunk =
 #   ifndef DEBUG
-	static const u_int chunk = RECV_INC;
+					RECV_INC;
 #   else
 	/* Allocate each buffer individually so they can be free()d
 	 * during ntpd shutdown on DEBUG builds to keep them out of heap
 	 * leak reports.
 	 */
-	static const u_int chunk = 1;
+					1;
 #   endif
-
-	register recvbuf_t *bufp;
-	u_int i;
-	size_t abuf;
+	static int/*BOOL*/	doneonce;
+	recvbuf_t *		bufp;
+	u_int			i;
+	size_t			abuf;

 	/*[bug 3666]: followup -- reset shortfalls in all cases */
 	abuf = nbufs + buffer_shortfall;
 	buffer_shortfall = 0;

-	if (limit_recvbufs <= total_recvbufs)
+	if (limit_recvbufs <= total_recvbufs) {
+		if (!doneonce) {
+			msyslog(LOG_CRIT, "Unable to allocate receive"
+					  " buffer, %lu/%lu",
+				total_recvbufs, limit_recvbufs);
+			doneonce = TRUE;
+		}
 		return;
-	
-	if (abuf < nbufs || abuf > RECV_BATCH)
+	}
+
+	if (abuf < nbufs || abuf > RECV_BATCH) {
 		abuf = RECV_BATCH;	/* clamp on overflow */
-	else
+	} else {
 		abuf += (~abuf + 1) & (RECV_INC - 1);	/* round up */
-	
-	if (abuf > (limit_recvbufs - total_recvbufs))
+	}
+	if (abuf > (limit_recvbufs - total_recvbufs)) {
 		abuf = limit_recvbufs - total_recvbufs;
+	}
 	abuf += (~abuf + 1) & (chunk - 1);		/* round up */
 	
 	while (abuf) {
 		bufp = calloc(chunk, sizeof(*bufp));
 		if (!bufp) {
+			msyslog(LOG_CRIT, "Out of memory, allocating "
+					  "%u recvbufs, %lu bytes",
+				chunk, (u_long)sizeof(*bufp) * chunk);
 			limit_recvbufs = total_recvbufs;
 			break;
 		}
--- a/contrib/ntp/libntp/refnumtoa.c
+++ b/contrib/ntp/libntp/refnumtoa.c
@ -5,7 +5,6 @@
 #include <stdio.h>

 #include "ntp_net.h"
-#include "lib_strbuf.h"
 #include "ntp_stdlib.h"

 const char *
--- a/contrib/ntp/libntp/snprintf.c
+++ b/contrib/ntp/libntp/snprintf.c
@ -1587,7 +1587,7 @@ rpl_asprintf(va_alist) va_dcl
 }
 #endif	/* HW_WANT_RPL_ASPRINTF */
 #else	/* Dummy declaration to avoid empty translation unit warnings. */
-int main(void);
+NONEMPTY_TRANSLATION_UNIT
 #endif	/* HW_WANT_RPL_SNPRINTF || HW_WANT_RPL_VSNPRINTF || HW_WANT_RPL_ASPRINTF || [...] */

 #if TEST_SNPRINTF
--- a/contrib/ntp/libntp/socket.c
+++ b/contrib/ntp/libntp/socket.c
@ -195,11 +195,11 @@ open_socket(
 	)
 void
 sendpkt(
-	sockaddr_u *		dest,
-	struct interface *	ep,
-	int			ttl,
-	struct pkt *		pkt,
-	int			len
+	sockaddr_u *	dest,
+	endpt *		ep,
+	int		ttl,
+	struct pkt *	pkt,
+	int		len
 	)

 static inline int
@ -207,9 +207,9 @@ read_refclock_packet(SOCKET fd, struct refclockio *rp, l_fp ts)

 static inline int
 read_network_packet(
-	SOCKET			fd,
-	struct interface *	itf,
-	l_fp			ts
+	SOCKET	fd,
+	endpt *	itf,
+	l_fp	ts
 	)

 void
--- a/contrib/ntp/libntp/socktoa.c
+++ b/contrib/ntp/libntp/socktoa.c
@ -21,7 +21,6 @@
 #include <isc/sockaddr.h>

 #include "ntp_fp.h"
-#include "lib_strbuf.h"
 #include "ntp_stdlib.h"
 #include "ntp.h"

--- a/contrib/ntp/libntp/socktohost.c
+++ b/contrib/ntp/libntp/socktohost.c
@ -15,7 +15,6 @@
 #include <stdio.h>

 #include "ntp_fp.h"
-#include "lib_strbuf.h"
 #include "ntp_stdlib.h"
 #include "ntp.h"
 #include "ntp_debug.h"
--- a/contrib/ntp/libntp/ssl_init.c
+++ b/contrib/ntp/libntp/ssl_init.c
@ -23,67 +23,60 @@
 #  define CMAC_LENGTH	16
 #  define CMAC		"AES128CMAC"
 # endif /*HAVE_OPENSSL_CMAC_H*/
-int ssl_init_done;

-#if OPENSSL_VERSION_NUMBER < 0x10100000L
+EVP_MD_CTX *digest_ctx;
+

 static void
 atexit_ssl_cleanup(void)
 {
-	if (!ssl_init_done) {
+	if (NULL == digest_ctx) {
 		return;
 	}
-
-	ssl_init_done = FALSE;
+	EVP_MD_CTX_free(digest_ctx);
+	digest_ctx = NULL;
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
 	EVP_cleanup();
 	ERR_free_strings();
+#endif	/* OpenSSL < 1.1 */
 }

+
 void
 ssl_init(void)
 {
 	init_lib();

-	if ( ! ssl_init_done) {
-	    ERR_load_crypto_strings();
-	    OpenSSL_add_all_algorithms();
-	    atexit(&atexit_ssl_cleanup);
-	    ssl_init_done = TRUE;
+	if (NULL == digest_ctx) {
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+		ERR_load_crypto_strings();
+		OpenSSL_add_all_algorithms();
+#endif	/* OpenSSL < 1.1 */
+		digest_ctx = EVP_MD_CTX_new();
+		INSIST(digest_ctx != NULL);
+		atexit(&atexit_ssl_cleanup);
 	}
 }

-#else /* OPENSSL_VERSION_NUMBER >= 0x10100000L */
-
-void
-ssl_init(void)
-{
-	init_lib();
-	ssl_init_done = TRUE;
-}
-
-#endif /* OPENSSL_VERSION_NUMBER */
-

 void
 ssl_check_version(void)
 {
 	u_long	v;
+	char *  buf;

 	v = OpenSSL_version_num();
 	if ((v ^ OPENSSL_VERSION_NUMBER) & ~0xff0L) {
-		msyslog(LOG_WARNING,
-		    "OpenSSL version mismatch. Built against %lx, you have %lx",
-		    (u_long)OPENSSL_VERSION_NUMBER, v);
-		fprintf(stderr,
-		    "OpenSSL version mismatch. Built against %lx, you have %lx\n",
-		    (u_long)OPENSSL_VERSION_NUMBER, v);
+		LIB_GETBUF(buf);
+		snprintf(buf, LIB_BUFLENGTH, 
+			 "OpenSSL version mismatch."
+			 "Built against %lx, you have %lx\n",
+			 (u_long)OPENSSL_VERSION_NUMBER, v);
+		msyslog(LOG_WARNING, "%s", buf);
+		fputs(buf, stderr);
 	}
-
 	INIT_SSL();
 }
-
-#else	/* !OPENSSL */
-# define MD5_LENGTH	16
 #endif	/* OPENSSL */


@ -102,7 +95,7 @@ keytype_from_text(
 	int		key_type;
 	u_int		digest_len;
 #ifdef OPENSSL	/* --*-- OpenSSL code --*-- */
-	const u_long	max_digest_len = MAX_MAC_LEN - sizeof(keyid_t);
+	const u_long	max_digest_len = MAX_MDG_LEN;
 	char *		upcased;
 	char *		pch;
 	EVP_MD const *	md;
@ -204,7 +197,7 @@ keytype_from_text(
 */
 const char *
 keytype_name(
-	int nid
+	int type
 	)
 {
 	static const char unknown_type[] = "(unknown key type)";
@ -212,23 +205,18 @@ keytype_name(

 #ifdef OPENSSL
 	INIT_SSL();
-	name = OBJ_nid2sn(nid);
+	name = OBJ_nid2sn(type);

 #   ifdef ENABLE_CMAC
-	if (NID_cmac == nid) {
+	if (NID_cmac == type) {
 		name = CMAC;
-
-		if (debug) {
-			fprintf(stderr, "%s:%d:%s():%s:nid\n",
-				__FILE__, __LINE__, __func__, CMAC);
-		}
 	} else
 #   endif /*ENABLE_CMAC*/
 	if (NULL == name) {
 		name = unknown_type;
 	}
 #else	/* !OPENSSL follows */
-	if (NID_md5 == nid)
+	if (NID_md5 == type)
 		name = "MD5";
 	else
 		name = unknown_type;
@ -251,13 +239,13 @@ keytype_name(
 */
 char *
 getpass_keytype(
-	int	keytype
+	int	type
 	)
 {
 	char	pass_prompt[64 + 11 + 1]; /* 11 for " Password: " */

 	snprintf(pass_prompt, sizeof(pass_prompt),
-		 "%.64s Password: ", keytype_name(keytype));
+		 "%.64s Password: ", keytype_name(type));

 	return getpass(pass_prompt);
 }
--- a/contrib/ntp/libntp/statestr.c
+++ b/contrib/ntp/libntp/statestr.c
@ -8,7 +8,6 @@
 #include "ntp_stdlib.h"
 #include "ntp_fp.h"
 #include "ntp.h"
-#include "lib_strbuf.h"
 #include "ntp_refclock.h"
 #include "ntp_control.h"
 #include "ntp_string.h"
--- a/contrib/ntp/libntp/systime.c
+++ b/contrib/ntp/libntp/systime.c
@ -16,7 +16,6 @@
 #include "timevalops.h"
 #include "timespecops.h"
 #include "ntp_calendar.h"
-#include "lib_strbuf.h"

 #ifdef HAVE_SYS_PARAM_H
 # include <sys/param.h>
--- a/contrib/ntp/libntp/timexsup.c
+++ b/contrib/ntp/libntp/timexsup.c
@ -6,14 +6,27 @@
 */

 #include "config.h"
-#include "timexsup.h"
 #include <limits.h>
 #include <math.h>

+#ifdef HAVE_SYS_TIME_H
+# include <sys/time.h>
+#else
+# ifdef HAVE_TIME_H
+#  include <time.h>
+# endif
+#endif
 #ifdef HAVE_SYS_TIMEX_H
 # include <sys/timex.h>
+#else
+# ifdef HAVE_TIMEX_H
+#  include <timex.h>
+# endif
 #endif

+#include "ntp_types.h"
+#include "timexsup.h"
+
 #if defined(MOD_NANO) != defined(STA_NANO)
 # warning inconsistent definitions of MOD_NANO vs STA_NANO
 #endif
@ -41,10 +54,11 @@ dbl_from_var_long(
 	)
 {
 #ifdef STA_NANO
-	if (status & STA_NANO)
+	if (STA_NANO & status) {
 		return (double)lval * 1e-9;
+	}
 #else
-	(void)status;
+	UNUSED_ARG(status);
 #endif
 	return (double)lval * 1e-6;
 }
@ -67,7 +81,7 @@ var_long_from_dbl(
 	*modes |= MOD_NANO;
 	dval *= 1e+9;
 #else
-	(void)modes;
+	UNUSED_ARG(modes);
 	dval *= 1e+6;
 #endif
 	return clamp_rounded(dval);
--- a/contrib/ntp/libntp/uglydate.c
+++ b/contrib/ntp/libntp/uglydate.c
@ -7,7 +7,6 @@

 #include "ntp_fp.h"
 #include "ntp_unixtime.h"
-#include "lib_strbuf.h"
 #include "ntp_stdlib.h"


--- a/contrib/ntp/libntp/vint64ops.c
+++ b/contrib/ntp/libntp/vint64ops.c
@ -15,24 +15,25 @@

 #include "ntp_types.h"
 #include "ntp_fp.h"
+#include "ntp_malloc.h"
 #include "vint64ops.h"

 /* -------------------------------------------------------------------------*/

 vint64
 strtouv64(
-	char const *		begp,
-	char const ** const	endp,
-	int			base
+	char *	begp,
+	char ** endp,
+	int	base
 	)
 {
-	vint64  res;
-	u_char  digit;
-	int     sig, num;
-	const u_char *src;
+	vint64	res;
+	u_char	digit;
+	int	sig, num;
+	u_char *src;
 	
 	num = sig = 0;
-	src = (const u_char*)begp;
+	src = (u_char *)begp;
 	while (isspace(*src))
 		src++;

@ -61,7 +62,7 @@ strtouv64(
 		return res;
 	}
 	
-	memset(&res, 0, sizeof(res));
+	ZERO(res);
 	while (*src) {
 		if (isdigit(*src))
 			digit = *src - '0';
@ -97,7 +98,7 @@ strtouv64(
 	if (!num)
 		errno = EINVAL;
 	if (endp)
-		*endp = (const char *)src;
+		*endp = (char *)src;
 	if (sig)
 		M_NEG(res.D_s.hi, res.D_s.lo);
 	return res;
--- a/contrib/ntp/libntp/work_thread.c
+++ b/contrib/ntp/libntp/work_thread.c
@ -376,8 +376,12 @@ send_blocking_resp_internal(
 	{
 #	    ifdef WORK_PIPE
 		if (1 != write(c->resp_write_pipe, "", 1))
-			msyslog(LOG_WARNING, "async resolver: %s",
-				"failed to notify main thread!");
+			msyslog(LOG_WARNING, "async resolver: blocking_get%sinfo"
+				" failed to notify main thread!",
+				(BLOCKING_GETNAMEINFO == resp->rtype)
+				    ? "name"
+				    : "addr"
+				);
 #	    else
 		tickle_sem(c->responses_pending);
 #	    endif
@ -489,7 +493,7 @@ start_blocking_thread(

 /* --------------------------------------------------------------------
 * Create a worker thread. There are several differences between POSIX
- * and Windows, of course -- most notably the Windows thread is no
+ * and Windows, of course -- most notably the Windows thread is a
 * detached thread, and we keep the handle around until we want to get
 * rid of the thread. The notification scheme also differs: Windows
 * makes use of semaphores in both directions, POSIX uses a pipe for
@ -520,9 +524,12 @@ start_blocking_thread_internal(
 	}
 	/* remember the thread priority is only within the process class */
 	if (!SetThreadPriority(c->thr_table[0].thnd,
-			       THREAD_PRIORITY_BELOW_NORMAL))
+			       THREAD_PRIORITY_BELOW_NORMAL)) {
 		msyslog(LOG_ERR, "Error lowering blocking thread priority: %m");
-
+	}
+	if (NULL != pSetThreadDescription) {
+		(*pSetThreadDescription)(c->thr_table[0].thnd, L"ntp_worker");
+	}
 	resumed = ResumeThread(c->thr_table[0].thnd);
 	DEBUG_INSIST(resumed);
 	c->thread_ref = &c->thr_table[0];
--- a/contrib/ntp/libparse/Makefile.am
+++ b/contrib/ntp/libparse/Makefile.am
@ -94,14 +94,9 @@ AM_LDFLAGS = $(NTP_HARD_LDFLAGS)
 EXTRA_DIST = parsesolaris.c parsestreams.c mkinfo_scmd.sed mkinfo_rcmd.sed info_trimble.c

 info_trimble.c: $(top_srcdir)/include/trimble.h $(srcdir)/Makefile.am $(srcdir)/mkinfo_scmd.sed $(srcdir)/mkinfo_rcmd.sed
-	sed -n -f $(srcdir)/mkinfo_scmd.sed $(top_srcdir)/include/trimble.h  > info_trimble.new
-	sed -n -f $(srcdir)/mkinfo_rcmd.sed $(top_srcdir)/include/trimble.h >> info_trimble.new
-	mv -f info_trimble.new $@
-
-#$(srcdir)/info_trimble.c: $(top_srcdir)/include/trimble.h $(srcdir)/Makefile.am $(srcdir)/mkinfo_scmd.sed $(srcdir)/mkinfo_rcmd.sed
-#	sed -n -f $(srcdir)/mkinfo_scmd.sed $(top_srcdir)/include/trimble.h  > info_trimble.new
-#	sed -n -f $(srcdir)/mkinfo_rcmd.sed $(top_srcdir)/include/trimble.h >> info_trimble.new
-#	mv -f info_trimble.new $@
+	$(AM_V_at)$(SED) -n -f $(srcdir)/mkinfo_scmd.sed $(top_srcdir)/include/trimble.h  > info_trimble.new
+	$(AM_V_at)$(SED) -n -f $(srcdir)/mkinfo_rcmd.sed $(top_srcdir)/include/trimble.h >> info_trimble.new
+	$(AM_V_at)mv -f info_trimble.new $@

 kieee754io.o: $(srcdir)/ieee754io.c
 	 $(COMPILE) $(K_CFLAGS) -c $(srcdir)/ieee754io.c -o $@
@ -165,11 +160,11 @@ parse: $(parsesolaris_OBJECTS) libparse_kernel.a ../libntp/libntp.a

 parsesolaris.o: sys/systm.h

-# [Bug3608] Solaris has inconsistent definitions of ffs() and fls(). Drop the
+# [Bug 3608] Solaris has inconsistent definitions of ffs() and fls(). Drop the
 # ones from 'systm.h'.
 sys/systm.h:
 	-mkdir sys
-	sed -e '/f[fl]s(.*)/d' < /usr/include/sys/systm.h > sys/systm.h
+	$(SED) -e '/f[fl]s(.*)/d' < /usr/include/sys/systm.h > sys/systm.h

 ## check-libparse is invoked by ntpd/Makefile.am
 check-libparse: $(noinst_LIBRARIES)
--- a/contrib/ntp/libparse/Makefile.in
+++ b/contrib/ntp/libparse/Makefile.in
@ -90,6 +90,7 @@ POST_UNINSTALL = :
 build_triplet = @build@
 host_triplet = @host@
 EXTRA_PROGRAMS = parsestreams$(EXEEXT) parsesolaris$(EXEEXT)
+@LIBNTP_SUBMAKES_TRUE@am__append_1 = check-libntp
 subdir = libparse
 ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
 am__aclocal_m4_deps = $(top_srcdir)/sntp/libopts/m4/libopts.m4 \
@ -423,6 +424,7 @@ PACKAGE_TARNAME = @PACKAGE_TARNAME@
 PACKAGE_URL = @PACKAGE_URL@
 PACKAGE_VERSION = @PACKAGE_VERSION@
 PATH_NET_SNMP_CONFIG = @PATH_NET_SNMP_CONFIG@
+PATH_OPENSSL = @PATH_OPENSSL@
 PATH_PERL = @PATH_PERL@
 PATH_RUBY = @PATH_RUBY@
 PATH_SEPARATOR = @PATH_SEPARATOR@
@ -522,9 +524,9 @@ top_build_prefix = @top_build_prefix@
 top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
 NULL = 
-BUILT_SOURCES = $(VPHACK) info_trimble.c $(VPHACK_AFTER) check-libntp \
-	.deps-ver
-CLEANFILES = check-libntp .deps-ver
+BUILT_SOURCES = $(VPHACK) info_trimble.c $(VPHACK_AFTER) \
+	$(am__append_1) .deps-ver
+CLEANFILES = .deps-ver
 DISTCLEANFILES = $(DEPDIR)/deps-ver
 noinst_LIBRARIES = @MAKE_LIBPARSE@ @MAKE_LIBPARSE_KERNEL@
 EXTRA_LIBRARIES = libparse.a libparse_kernel.a
@ -998,14 +1000,9 @@ vphack_after:
 		)

 info_trimble.c: $(top_srcdir)/include/trimble.h $(srcdir)/Makefile.am $(srcdir)/mkinfo_scmd.sed $(srcdir)/mkinfo_rcmd.sed
-	sed -n -f $(srcdir)/mkinfo_scmd.sed $(top_srcdir)/include/trimble.h  > info_trimble.new
-	sed -n -f $(srcdir)/mkinfo_rcmd.sed $(top_srcdir)/include/trimble.h >> info_trimble.new
-	mv -f info_trimble.new $@
-
-#$(srcdir)/info_trimble.c: $(top_srcdir)/include/trimble.h $(srcdir)/Makefile.am $(srcdir)/mkinfo_scmd.sed $(srcdir)/mkinfo_rcmd.sed
-#	sed -n -f $(srcdir)/mkinfo_scmd.sed $(top_srcdir)/include/trimble.h  > info_trimble.new
-#	sed -n -f $(srcdir)/mkinfo_rcmd.sed $(top_srcdir)/include/trimble.h >> info_trimble.new
-#	mv -f info_trimble.new $@
+	$(AM_V_at)$(SED) -n -f $(srcdir)/mkinfo_scmd.sed $(top_srcdir)/include/trimble.h  > info_trimble.new
+	$(AM_V_at)$(SED) -n -f $(srcdir)/mkinfo_rcmd.sed $(top_srcdir)/include/trimble.h >> info_trimble.new
+	$(AM_V_at)mv -f info_trimble.new $@

 kieee754io.o: $(srcdir)/ieee754io.c
 	 $(COMPILE) $(K_CFLAGS) -c $(srcdir)/ieee754io.c -o $@
@ -1069,20 +1066,19 @@ parse: $(parsesolaris_OBJECTS) libparse_kernel.a ../libntp/libntp.a

 parsesolaris.o: sys/systm.h

-# [Bug3608] Solaris has inconsistent definitions of ffs() and fls(). Drop the
+# [Bug 3608] Solaris has inconsistent definitions of ffs() and fls(). Drop the
 # ones from 'systm.h'.
 sys/systm.h:
 	-mkdir sys
-	sed -e '/f[fl]s(.*)/d' < /usr/include/sys/systm.h > sys/systm.h
+	$(SED) -e '/f[fl]s(.*)/d' < /usr/include/sys/systm.h > sys/systm.h

 check-libparse: $(noinst_LIBRARIES)
 	@: do-nothing action to avoid default SCCS get

-check-libntp: $(top_builddir)/libntp/libntp.a
-	@: avoid default SCCS get by some make implementations
+.PHONY: check-libntp

-$(top_builddir)/libntp/libntp.a:
-	cd $(top_builddir)/libntp && $(MAKE) $(AM_MAKEFLAGS) libntp.a
+@LIBNTP_SUBMAKES_TRUE@check-libntp:
+@LIBNTP_SUBMAKES_TRUE@	cd $(top_builddir)/libntp && $(MAKE) $(AM_MAKEFLAGS) libntp.a
 $(DEPDIR)/deps-ver: $(top_srcdir)/deps-ver
 	@[ -f $@ ] ||							\
 		cp $(top_srcdir)/deps-ver $@
--- a/contrib/ntp/libparse/clk_computime.c
+++ b/contrib/ntp/libparse/clk_computime.c
@ -182,7 +182,7 @@ inp_computime(
 }

 #else /* not (REFCLOCK && CLOCK_PARSE && CLOCK_COMPUTIME) */
-int clk_computime_bs;
+NONEMPTY_TRANSLATION_UNIT
 #endif /* not (REFCLOCK && CLOCK_PARSE && CLOCK_COMPUTIME) */

 /*
--- a/contrib/ntp/libparse/clk_dcf7000.c
+++ b/contrib/ntp/libparse/clk_dcf7000.c
@ -176,7 +176,7 @@ inp_dcf7000(
 }

 #else /* not (REFCLOCK && CLOCK_PARSE && CLOCK_DCF7000) */
-int clk_dcf7000_bs;
+NONEMPTY_TRANSLATION_UNIT
 #endif /* not (REFCLOCK && CLOCK_PARSE && CLOCK_DCF7000) */

 /*
--- a/contrib/ntp/libparse/clk_hopf6021.c
+++ b/contrib/ntp/libparse/clk_hopf6021.c
@ -20,7 +20,7 @@
 # include <config.h>
 #endif

-#include <ntp_types.h>
+#include "ntp_types.h"

 #if defined(REFCLOCK) && defined(CLOCK_PARSE) && defined(CLOCK_HOPF6021)

--- a/contrib/ntp/libparse/clk_meinberg.c
+++ b/contrib/ntp/libparse/clk_meinberg.c
@ -733,7 +733,7 @@ gps_input(
 }

 #else /* not (REFCLOCK && CLOCK_PARSE && CLOCK_MEINBERG) */
-int clk_meinberg_bs;
+NONEMPTY_TRANSLATION_UNIT
 #endif /* not (REFCLOCK && CLOCK_PARSE && CLOCK_MEINBERG) */

 /*
--- a/contrib/ntp/libparse/clk_rawdcf.c
+++ b/contrib/ntp/libparse/clk_rawdcf.c
@ -742,7 +742,7 @@ inp_rawdcf(
 }

 #else /* not (REFCLOCK && CLOCK_PARSE && CLOCK_RAWDCF) */
-int clk_rawdcf_bs;
+NONEMPTY_TRANSLATION_UNIT
 #endif /* not (REFCLOCK && CLOCK_PARSE && CLOCK_RAWDCF) */

 /*
--- a/contrib/ntp/libparse/clk_rcc8000.c
+++ b/contrib/ntp/libparse/clk_rcc8000.c
@ -163,7 +163,7 @@ inp_rcc8000(
 }

 #else  /* not (REFCLOCK && CLOCK_PARSE && CLOCK_RCC8000) */
-int clk_rcc8000_bs;
+NONEMPTY_TRANSLATION_UNIT
 #endif  /* not (REFCLOCK && CLOCK_PARSE && CLOCK_RCC8000) */

 /*
--- a/contrib/ntp/libparse/clk_schmid.c
+++ b/contrib/ntp/libparse/clk_schmid.c
@ -222,7 +222,7 @@ inp_schmid(
 }

 #else /* not (REFCLOCK && CLOCK_PARSE && CLOCK_SCHMID) */
-int clk_schmid_bs;
+NONEMPTY_TRANSLATION_UNIT
 #endif /* not (REFCLOCK && CLOCK_PARSE && CLOCK_SCHMID) */

 /*
--- a/contrib/ntp/libparse/clk_sel240x.c
+++ b/contrib/ntp/libparse/clk_sel240x.c
@ -168,5 +168,5 @@ cvt_sel240x( unsigned char *buffer,
 }

 #else  /* not (REFCLOCK && CLOCK_PARSE && CLOCK_SEL240X) */
-int clk_sel240x_bs;
+NONEMPTY_TRANSLATION_UNIT
 #endif /* not (REFCLOCK && CLOCK_PARSE && CLOCK_SEL240X) */
--- a/contrib/ntp/libparse/clk_trimtaip.c
+++ b/contrib/ntp/libparse/clk_trimtaip.c
@ -181,7 +181,7 @@ inp_trimtaip(
 }

 #else /* not (REFCLOCK && CLOCK_PARSE && CLOCK_TRIMTAIP) */
-int clk_trimtaip_bs;
+NONEMPTY_TRANSLATION_UNIT
 #endif /* not (REFCLOCK && CLOCK_PARSE && CLOCK_TRIMTAIP) */

 /*
--- a/contrib/ntp/libparse/clk_trimtsip.c
+++ b/contrib/ntp/libparse/clk_trimtsip.c
@ -388,7 +388,7 @@ cvt_trimtsip(
 }

 #else /* not (REFCLOCK && CLOCK_PARSE && CLOCK_TRIMTSIP && !PARSESTREAM) */
-int clk_trimtsip_bs;
+NONEMPTY_TRANSLATION_UNIT
 #endif /* not (REFCLOCK && CLOCK_PARSE && CLOCK_TRIMTSIP && !PARSESTREAM) */

 /*
--- a/contrib/ntp/libparse/clk_varitext.c
+++ b/contrib/ntp/libparse/clk_varitext.c
@ -252,7 +252,7 @@ inp_varitext(
 }

 #else /* not (REFCLOCK && CLOCK_PARSE && CLOCK_VARITEXT) */
-int clk_varitext_bs;
+NONEMPTY_TRANSLATION_UNIT
 #endif /* not (REFCLOCK && CLOCK_PARSE && CLOCK_VARITEXT) */

 /*
--- a/contrib/ntp/libparse/clk_wharton.c
+++ b/contrib/ntp/libparse/clk_wharton.c
@ -9,7 +9,7 @@
 #include <config.h>
 #endif

-#include <ntp_types.h>
+#include "ntp_types.h"

 #if defined(REFCLOCK) && defined(CLOCK_PARSE) && defined(CLOCK_WHARTON_400A)
 /*
--- a/contrib/ntp/libparse/ieee754io.c
+++ b/contrib/ntp/libparse/ieee754io.c
@ -50,8 +50,6 @@ static void put_byte (unsigned char *, offsets_t, int *, unsigned char);

 #ifdef LIBDEBUG

-#include "lib_strbuf.h"
-
 static char *
 fmt_blong(
 	  unsigned long val,
@ -396,7 +394,22 @@ fetch_ieee754(
 	}
    }
 }
-  
+
+/*
+ * DLH: This function is currently unused in ntpd.  If you think about
+ * using it, be sure it does what you intend.  I notice the bufpp arg
+ * is never referenced, and the calculated mantissa_high & mantissa_low
+ * are only referenced in debug output.  It seems they're supposed to
+ * be composed into an ieee754-format float and stored at *bufpp or
+ * possibly **bufpp.  Brought to my attention by this:
+ *
+ * ieee754io.c:414:10: warning: variable 'mantissa_low' set but not used
+ * [-Wunused-but-set-variable]
+ *
+ * To quiet it I'm #ifdef'ing the function away for now, here and below
+ * the call to it in main().
+ */
+#ifdef PUT_IEEE754_UNUSED_FUNC
 int
 put_ieee754(
 	    unsigned char **bufpp,
@ -536,6 +549,7 @@ put_ieee754(
    }
  return IEEE_OK;
 }
+#endif	/* PUT_IEEE754_UNUSED_FUNC */


 #if defined(DEBUG) && defined(LIBDEBUG)
@ -562,8 +576,11 @@ int main(
  printf("fetch from %f = %d\n", f, fetch_ieee754((void *)&f_p, IEEE_DOUBLE, &fp, native_off));
  printf("fp [%s %s] = %s\n", fmt_blong(fp.l_ui, 32), fmt_blong(fp.l_uf, 32), mfptoa(fp.l_ui, fp.l_uf, 15));
  f_p = &f;
+#ifdef PUT_IEEE754_UNUSED_FUNC
  put_ieee754((void *)&f_p, IEEE_DOUBLE, &fp, native_off);
-  
+/* there should be a check on *f_p (f) having the expected result here */
+#endif	/* PUT_IEEE754_UNUSED_FUNC */
+
  return 0;
 }

--- a/contrib/ntp/libparse/parse.c
+++ b/contrib/ntp/libparse/parse.c
@ -875,7 +875,7 @@ parse_setcs(
 }

 #else /* not (REFCLOCK && CLOCK_PARSE) */
-int parse_bs;
+NONEMPTY_TRANSLATION_UNIT
 #endif /* not (REFCLOCK && CLOCK_PARSE) */

 /*
--- a/contrib/ntp/libparse/parse_conf.c
+++ b/contrib/ntp/libparse/parse_conf.c
@ -148,7 +148,7 @@ clockformat_t *clockformats[] =
 unsigned short nformats = sizeof(clockformats) / sizeof(clockformats[0]) - 1;

 #else /* not (REFCLOCK && CLOCK_PARSE) */
-int parse_conf_bs;
+NONEMPTY_TRANSLATION_UNIT
 #endif /* not (REFCLOCK && CLOCK_PARSE) */

 /*
--- a/contrib/ntp/ntpd/Makefile.in
+++ b/contrib/ntp/ntpd/Makefile.in
@ -97,6 +97,7 @@ build_triplet = @build@
 host_triplet = @host@
 EXTRA_PROGRAMS = check_y2k$(EXEEXT) keyword-gen$(EXEEXT) ntpd$(EXEEXT) \
 	ntpdsim$(EXEEXT)
+@LIBNTP_SUBMAKES_TRUE@am__append_1 = check-libntp
 subdir = ntpd
 ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
 am__aclocal_m4_deps = $(top_srcdir)/sntp/libopts/m4/libopts.m4 \
@ -551,6 +552,7 @@ PACKAGE_TARNAME = @PACKAGE_TARNAME@
 PACKAGE_URL = @PACKAGE_URL@
 PACKAGE_VERSION = @PACKAGE_VERSION@
 PATH_NET_SNMP_CONFIG = @PATH_NET_SNMP_CONFIG@
+PATH_OPENSSL = @PATH_OPENSSL@
 PATH_PERL = @PATH_PERL@
 PATH_RUBY = @PATH_RUBY@
 PATH_SEPARATOR = @PATH_SEPARATOR@
@ -688,8 +690,8 @@ B_S_DIST = \
 	$(NULL)

 BUILT_SOURCES = $(VPHACK) $(LIBPARSE) ntp_parser.c ntp_parser.h \
-	$(VPHACK_AFTER) $(B_S_DIST) $(NULL) check-libopts check-libntp \
-	.deps-ver
+	$(VPHACK_AFTER) $(B_S_DIST) $(NULL) check-libopts \
+	$(am__append_1) .deps-ver
 man1_MANS = 
 man5_MANS = ntp.conf.5 ntp.keys.5
 man8_MANS = 
@ -708,7 +710,7 @@ CLEANFILES = check-psl0 check-psl1 check-psl2 check-pslsaveconfig \
 	psl0save.conf psl0save.conf+ psl1save.conf psl1save.conf+ \
 	psl2save.conf psl2save.conf+ .version version.c ntpd-version.c \
 	sim-version.c $(EXTRA_PROGRAMS) $(NULL) check-libopts \
-	check-libntp .deps-ver
+	.deps-ver
 EXTRA_DIST = \
 	complete.conf.in	\
 	invoke-ntp.conf.menu	\
@ -2124,18 +2126,16 @@ check-libopts: ../sntp/libopts/libopts.la
 ../sntp/libopts/libopts.la:
 	-cd ../sntp/libopts && $(MAKE) $(AM_MAKEFLAGS) libopts.la

-check-libntp: $(top_builddir)/libntp/libntp.a
-	@: avoid default SCCS get by some make implementations
+.PHONY: check-libntp

-$(top_builddir)/libntp/libntp.a:
-	cd $(top_builddir)/libntp && $(MAKE) $(AM_MAKEFLAGS) libntp.a
+@LIBNTP_SUBMAKES_TRUE@check-libntp:
+@LIBNTP_SUBMAKES_TRUE@	cd $(top_builddir)/libntp && $(MAKE) $(AM_MAKEFLAGS) libntp.a
 $(top_srcdir)/sntp/scm-rev: FRC.scm-rev
 	$(AM_V_GEN)cd $(top_builddir)/sntp && $(MAKE) $(AM_MAKEFLAGS) check-scm-rev

+.PHONY: FRC.scm-rev
 FRC.scm-rev:
-	@: FRC.scm-rev "force" depends on nothing and is not a file, so is	\
-	   always out-of-date causing targets which depend on it to also		\
-	   be outdated so their rules to fire each time they are built.
+	@: FRC.scm-rev is always out of date, triggering the check every make invocation.
 $(DEPDIR)/deps-ver: $(top_srcdir)/deps-ver
 	@[ -f $@ ] ||							\
 		cp $(top_srcdir)/deps-ver $@
--- a/contrib/ntp/ntpd/cmd_args.c
+++ b/contrib/ntp/ntpd/cmd_args.c
@ -178,16 +178,14 @@ getCmdOpts(

 	if (HAVE_OPT( UPDATEINTERVAL )) {
 		long val = OPT_VALUE_UPDATEINTERVAL;
+		const char errfmt[] =
+			"-U/--updateinterval %ld must be >= 0\n";

-		if (val >= 0)
-			interface_interval = val;
-		else {
-			fprintf(stderr,
-				"command line interface update interval %ld must not be negative\n",
-				val);
-			msyslog(LOG_ERR,
-				"command line interface update interval %ld must not be negative",
-				val);
+		if (val >= 0) {
+			endpt_scan_period = val;
+		} else {
+			fprintf(stderr, errfmt, val);
+			msyslog(LOG_ERR, errfmt, val);
 			errflg++;
 		}
 	}
--- a/contrib/ntp/ntpd/complete.conf.in
+++ b/contrib/ntp/ntpd/complete.conf.in
@ -33,40 +33,45 @@ tinker allan 1500 dispersion 15 freq 0 huffpuff 7200 panic 1000 step 0.128 stepo
 broadcastclient
 server 127.127.1.0 mode 4294967295 prefer true
 fudge 127.127.1.0 time1 0 time2 1.1 stratum 7 refid Abcd minjitter 0.2
-pool 0.north-america.pool.ntp.org. iburst preempt
-server 1.north-america.pool.ntp.org. iburst
-server -4 2.north-america.pool.ntp.org. minpoll 6 maxpoll 10 iburst
-server -6 ntp.davehart.net. minpoll 6 maxpoll 10 version 5 burst iburst
-peer -6 davehart.broker.freenet6.net. ident "autokey-group" xleave autokey
-peer -4 192.168.192.168 key 1 noselect
+pool 2.ubuntu.pool.ntp.org. iburst preempt
+pool 2.freebsd.pool.ntp.org. iburst
+server -6 2.debian.pool.ntp.org. minpoll 6 maxpoll 10 iburst
+server -4 ntp.davehart.net. minpoll 6 maxpoll 10 version 5 burst iburst
+peer -6 ntp.md. ident "autokey-group" xleave autokey
+peer -4 198.51.100.123 key 1 noselect
 server [fe80::123%1] xmtnonce
-broadcast 192.168.192.255
-manycastclient 224.0.1.1
-manycastclient ff05::101
+broadcast 192.0.2.255
+manycastclient 224.0.1.1 key 14 iburst
+manycastclient ff05::101 maxpoll 6 key 1
 manycastserver 224.0.1.1 ff05::101
 multicastclient 224.0.1.1 ff05::101
 mru maxage 64 mindepth 600 initalloc 600 initmem 16 incalloc 99 incmem 4 maxdepth 1024 maxmem 4096
 discard minimum 1 average 3 monitor 3000
 pollskewlist 3 1|2 4 3|4 default 6|7
-restrict default ippeerlimit -1
-restrict default ippeerlimit 0 nomodify limited kod noserve nomrulist
+restrict default
+restrict default ippeerlimit 0 nomodify limited kod nopeer noserve nomrulist
 restrict source ippeerlimit 1
 restrict source ippeerlimit 2 nomodify limited kod
-restrict trusted.host.name.example.com. ippeerlimit -1 nomodify
-restrict [fe80::1] mask [ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff] ippeerlimit -1
-restrict 127.0.0.1 mask 255.255.255.255 ippeerlimit -1
-restrict 127.0.0.2 ippeerlimit -1 serverresponse fuzz
-restrict ::1 ippeerlimit -1
+restrict trusted.host.name.example.com. nomodify
+delrestrict trusted.host.name.example.com.
+restrict 192.0.2.66 epeer flake lowpriotrap mssntp noepeer noquery notrap notrust ntpport version
+delrestrict source 192.0.2.123
+delrestrict source [2001:db8::123]
+restrict fe80::1
+restrict 127.0.0.1
+restrict ::1
+restrict 198.51.100.123 serverresponse fuzz
+restrict fec0:: mask [ffff::] ignore
 interface drop ipv6
 interface ignore ipv4
 interface drop wildcard
 interface listen eth0
 interface listen ipv6
-interface listen 192.168.192.0/24
-interface listen 192.168.193.1
+interface listen 203.0.113.0/24
+interface listen 192.0.2.123
 phone "ATDT13034944774" "ATDT12027621594"
 setvar varnondef = "this variable does not have default after the value"
 setvar vanity = "name plate" default
 trap 127.0.0.1 interface 127.0.0.1 port 1234
-trap 127.0.0.2
+trap 192.0.2.2
 reset allpeers auth ctl io mem sys timer
--- a/contrib/ntp/ntpd/invoke-ntp.conf.texi
+++ b/contrib/ntp/ntpd/invoke-ntp.conf.texi
@ -6,7 +6,7 @@
 #
 # EDIT THIS FILE WITH CAUTION  (invoke-ntp.conf.texi)
 #
-# It has been AutoGen-ed  June  6, 2023 at 04:37:38 AM by AutoGen 5.18.16
+# It has been AutoGen-ed  May 25, 2024 at 12:03:56 AM by AutoGen 5.18.16
 # From the definitions    ntp.conf.def
 # and the template file   agtexi-file.tpl
@end ignore
@ -251,27 +251,15 @@ include authentication fields encrypted using the autokey scheme
 described in
@ref{Authentication Options}.
@item @code{burst}
-when the server is reachable, send a burst of eight packets
-instead of the usual one.
-The packet spacing is normally 2 s;
-however, the spacing between the first and second packets
-can be changed with the
-@code{calldelay}
-command to allow
-additional time for a modem or ISDN call to complete.
-This is designed to improve timekeeping quality
-with the
+when the server is reachable, send a burst of six packets
+instead of the usual one. The packet spacing is 2 s.
+This is designed to improve timekeeping quality with the
@code{server}
 command and s addresses.
@item @code{iburst}
 When the server is unreachable, send a burst of eight packets
 instead of the usual one.
-The packet spacing is normally 2 s;
-however, the spacing between the first two packets can be
-changed with the
-@code{calldelay}
-command to allow
-additional time for a modem or ISDN call to complete.
+The packet spacing is 2 s.
 This is designed to speed the initial synchronization
 acquisition with the
@code{server}
@ -833,7 +821,7 @@ The
 argument is
 the key identifier for a trusted key, where the value can be in the
 range 1 to 65,535, inclusive.
-@item @code{crypto} @code{[@code{cert} @kbd{file}]} @code{[@code{leap} @kbd{file}]} @code{[@code{randfile} @kbd{file}]} @code{[@code{host} @kbd{file}]} @code{[@code{sign} @kbd{file}]} @code{[@code{gq} @kbd{file}]} @code{[@code{gqpar} @kbd{file}]} @code{[@code{iffpar} @kbd{file}]} @code{[@code{mvpar} @kbd{file}]} @code{[@code{pw} @kbd{password}]}
+@item @code{crypto} @code{[@code{cert} @kbd{file}]} @code{[@code{leap} @kbd{file}]} @code{[@code{randfile} @kbd{file}]} @code{[@code{host} @kbd{file}]} @code{[@code{gq} @kbd{file}]} @code{[@code{gqpar} @kbd{file}]} @code{[@code{iffpar} @kbd{file}]} @code{[@code{mvpar} @kbd{file}]} @code{[@code{pw} @kbd{password}]}
 This command requires the OpenSSL library.
 It activates public key
 cryptography, selects the message digest and signature
@ -890,14 +878,6 @@ encrypted.
 Specifies the location of the random seed file used by the OpenSSL
 library.
 The defaults are described in the main text above.
-@item @code{sign} @kbd{file}
-Specifies the location of the optional sign key file.
-This overrides
-the link
-@file{ntpkey_sign_}@kbd{hostname}
-in the keys directory.
-If this file is
-not found, the host key is also the sign key.
@end table
@item @code{keys} @kbd{keyfile}
 Specifies the complete path and location of the MD5 key file
@ -1477,25 +1457,26 @@ by default the probability of replacing it with an
 entry representing the client request being processed
 now is 10%. Conversely, if the oldest entry is more
 than 3000 seconds old, the probability is 100%.
-@item @code{restrict} @code{address} @code{[@code{mask} @kbd{mask}]} @code{[@code{ippeerlimit} @kbd{int}]} @code{[@kbd{flag} @kbd{...}]}
+@item @code{restrict} @kbd{address} @code{[@code{mask} @kbd{mask}]} @code{[@code{ippeerlimit} @kbd{int}]} @code{[@kbd{flag} @kbd{...}]}
 The
@kbd{address}
 argument expressed in
-dotted-quad form is the address of a host or network.
+numeric form is the address of a host or network.
 Alternatively, the
@kbd{address}
-argument can be a valid host DNS name.
+argument can be a valid hostname.  When a hostname
+is provided, a restriction entry is created for each
+address the hostname resolves to, and any provided
+@kbd{mask}
+is ignored and an individual host mask is
+used for each entry.
 The
@kbd{mask}
-argument expressed in dotted-quad form defaults to
-@code{255.255.255.255},
-meaning that the
+argument expressed in numeric form defaults to
+all bits lit, meaning that the
@kbd{address}
 is treated as the address of an individual host.
-A default entry (address
-@code{0.0.0.0},
-mask
-@code{0.0.0.0})
+A default entry with address and mask all zeroes
 is always included and is always the first entry in the list.
 Note that text string
@code{default},
@ -1532,12 +1513,12 @@ and
@code{ntpdc(1ntpdcmdoc)}
 queries.
@item @code{kod}
-If this flag is set when an access violation occurs, a kiss-o'-death
-(KoD) packet is sent.
-KoD packets are rate limited to no more than one
-per second.
-If another KoD packet occurs within one second after the
-last one, the packet is dropped.
+If this flag is set when a rate violation occurs, a kiss-o'-death
+(KoD) packet is sometimes sent.
+KoD packets are rate limited to no more than one per minimum
+average interpacket spacing, set by
+@code{discard} @code{average}
+defaulting to 8s.  Otherwise, no response is sent.
@item @code{limited}
 Deny service if the packet spacing violates the lower limits specified
 in the
@ -1627,15 +1608,13 @@ restriction flag.
 Its presence causes the restriction entry to be
 matched only if the source port in the packet is the standard NTP
 UDP port (123).
-Both
+There can be two restriction entries with the same IP address if
+one specifies
@code{ntpport}
-and
-@code{non-ntpport}
-may
-be specified.
+and the other does not.
 The
@code{ntpport}
-is considered more specific and
+entry is considered more specific and
 is sorted later in the list.
@item @code{serverresponse fuzz}
 When reponding to server requests,
@ -1647,12 +1626,28 @@ Deny packets that do not match the current NTP version.

 Default restriction list entries with the flags ignore, interface,
 ntpport, for each of the local host's interface addresses are
-inserted into the table at startup to prevent the server
-from attempting to synchronize to its own time.
+inserted into the table at startup to prevent ntpd
+from attempting to synchronize to itself, such as with
+@code{manycastclient}
+when
+@code{manycast}
+is also specified with the same multicast address.
 A default entry is also always present, though if it is
 otherwise unconfigured; no flags are associated
 with the default entry (i.e., everything besides your own
 NTP server is unrestricted).
+@item @code{delrestrict} @code{[source]} @kbd{address}
+Remove a previously-set restriction.  This is useful for
+runtime configuration via
+@code{ntpq(1ntpqmdoc)}
+.  If
+@code{source}
+is specified, a dynamic restriction created from the 
+@code{restrict} @code{source}
+template at the time
+an association was added is removed.  Without
+@code{source}
+a static restriction is removed.
@end table
@node Automatic NTP Configuration Options
@subsection Automatic NTP Configuration Options
@ -2357,10 +2352,6 @@ Typically (for Ethernet), a
 number between 0.003 and 0.007 seconds is appropriate.
 The default
 when this command is not used is 0.004 seconds.
-@item @code{calldelay} @kbd{delay}
-This option controls the delay in seconds between the first and second
-packets sent in burst or iburst mode to allow additional time for a modem
-or ISDN call to complete.
@item @code{driftfile} @kbd{driftfile}
 This command specifies the complete path and name of the file used to
 record the frequency of the local clock oscillator.
--- a/contrib/ntp/ntpd/invoke-ntp.keys.texi
+++ b/contrib/ntp/ntpd/invoke-ntp.keys.texi
@ -6,7 +6,7 @@
 #
 # EDIT THIS FILE WITH CAUTION  (invoke-ntp.keys.texi)
 #
-# It has been AutoGen-ed  June  6, 2023 at 04:37:41 AM by AutoGen 5.18.16
+# It has been AutoGen-ed  May 25, 2024 at 12:03:59 AM by AutoGen 5.18.16
 # From the definitions    ntp.keys.def
 # and the template file   agtexi-file.tpl
@end ignore
--- a/contrib/ntp/ntpd/invoke-ntpd.texi
+++ b/contrib/ntp/ntpd/invoke-ntpd.texi
@ -6,7 +6,7 @@
 #
 # EDIT THIS FILE WITH CAUTION  (invoke-ntpd.texi)
 #
-# It has been AutoGen-ed  June  6, 2023 at 04:37:42 AM by AutoGen 5.18.16
+# It has been AutoGen-ed  May 25, 2024 at 12:04:00 AM by AutoGen 5.18.16
 # From the definitions    ntpd-opts.def
 # and the template file   agtexi-cmd.tpl
@end ignore
@ -142,7 +142,7 @@ with a status code of 0.

@exampleindent 0
@example
-ntpd - NTP daemon program - Ver. 4.2.8p17
+ntpd - NTP daemon program - Ver. 4.2.8p18
 Usage:  ntpd [ -<flag> [<val>] | --<name>[@{=| @}<val>] ]... \
                [ <server1> ... <serverN> ]
  Flg Arg Option-Name    Description
--- a/contrib/ntp/ntpd/keyword-gen-utd
+++ b/contrib/ntp/ntpd/keyword-gen-utd
@ -1 +1 @@
- *	 Generated 2022-03-27 14:17:11 UTC	  diff_ignore_line
+ *	 Generated 2023-09-25 05:34:02 UTC	  diff_ignore_line
--- a/Show More
+++ b/Show More