MFV ntp-4.2.8p4 (r289715)

Security:       VuXML: c4a18a12-77fc-11e5-a687-206a8a720317
Security:	CVE-2015-7871
Security:	CVE-2015-7855
Security:	CVE-2015-7854
Security:	CVE-2015-7853
Security:	CVE-2015-7852
Security:	CVE-2015-7851
Security:	CVE-2015-7850
Security:	CVE-2015-7849
Security:	CVE-2015-7848
Security:	CVE-2015-7701
Security:	CVE-2015-7703
Security:	CVE-2015-7704, CVE-2015-7705
Security:	CVE-2015-7691, CVE-2015-7692, CVE-2015-7702
Security:	http://support.ntp.org/bin/view/Main/SecurityNotice#October_2015_NTP_Security_Vulner
Sponsored by:	Nginx, Inc.

1 files changed, 175 insertions, 68 deletions

diff --git a/contrib/ntp/configure b/contrib/ntp/configure
index 1d686cb..04813a8 100755
--- a/contrib/ntp/configure
+++ b/contrib/ntp/configure
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for ntp 4.2.8p3.
+# Generated by GNU Autoconf 2.69 for ntp 4.2.8p4.
 #
 # Report bugs to <http://bugs.ntp.org./>.
 #
@@ -590,8 +590,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='ntp'
 PACKAGE_TARNAME='ntp'
-PACKAGE_VERSION='4.2.8p3'
-PACKAGE_STRING='ntp 4.2.8p3'
+PACKAGE_VERSION='4.2.8p4'
+PACKAGE_STRING='ntp 4.2.8p4'
 PACKAGE_BUGREPORT='http://bugs.ntp.org./'
 PACKAGE_URL='http://www.ntp.org./'
 
@@ -639,6 +639,12 @@ LTLIBOBJS
 subdirs
 PERLLIBDIR
 NTP_KEYSDIR
+BUILD_TEST_NTP_SIGND_FALSE
+BUILD_TEST_NTP_SIGND_TRUE
+BUILD_TEST_NTP_SCANNER_FALSE
+BUILD_TEST_NTP_SCANNER_TRUE
+BUILD_TEST_NTP_RESTRICT_FALSE
+BUILD_TEST_NTP_RESTRICT_TRUE
 GTEST_AVAILABLE_FALSE
 GTEST_AVAILABLE_TRUE
 GTEST_CPPFLAGS
@@ -689,6 +695,8 @@ PTHREADS_FALSE
 PTHREADS_TRUE
 LIBISC_PTHREADS_NOTHREADS
 PTHREAD_LIBS
+LTHREAD_LIBS
+BUILD_THREAD
 HAVE_INLINE
 LDADD_LIBUTIL
 ALLOCA
@@ -701,6 +709,7 @@ BUILD_LIBEVENT_FALSE
 BUILD_LIBEVENT_TRUE
 LDADD_LIBEVENT
 CPPFLAGS_LIBEVENT
+CFLAGS_LIBEVENT
 PKG_CONFIG
 LIBOPTS_DIR
 LIBOPTS_CFLAGS
@@ -1050,6 +1059,7 @@ enable_getifaddrs
 enable_saveconfig
 enable_leap_smear
 with_gtest
+enable_problem_tests
 '
       ac_precious_vars='build_alias
 host_alias
@@ -1606,7 +1616,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures ntp 4.2.8p3 to adapt to many kinds of systems.
+\`configure' configures ntp 4.2.8p4 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1676,7 +1686,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of ntp 4.2.8p3:";;
+     short | recursive ) echo "Configuration of ntp 4.2.8p4:";;
    esac
   cat <<\_ACEOF
 
@@ -1724,7 +1734,7 @@ Optional Features and Packages:
   --enable-libseccomp     EXPERIMENTAL: enable support for libseccomp
                           sandboxing (default is no)
   --with-stack-limit      ? =50 (200 for openbsd) 4k pages
-  --with-memlock          ? =32 (megabytes)
+  --with-memlock          ? =32 (-1 on linux) megabytes
   --enable-debug-timing   - include processing time debugging code (costs
                           performance)
   --enable-dst-minutes    =60 minutes per DST adjustment
@@ -1821,6 +1831,7 @@ Optional Features and Packages:
   --enable-saveconfig     + saveconfig mechanism
   --enable-leap-smear     - experimental leap smear code
   --with-gtest            Use the gtest framework (Default: if it's available)
+  --enable-problem-tests  + enable tests with undiagnosed problems
 
 Some influential environment variables:
   CC          C compiler command
@@ -1908,7 +1919,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-ntp configure 4.2.8p3
+ntp configure 4.2.8p4
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -2738,7 +2749,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by ntp $as_me 4.2.8p3, which was
+It was created by ntp $as_me 4.2.8p4, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
@@ -3117,6 +3128,12 @@ ac_config_sub="$SHELL $ac_aux_dir/config.sub"  # Please don't use this var.
 ac_configure="$SHELL $ac_aux_dir/configure"  # Please don't use this var.
 
 
+ac_ext=c
+ac_cpp='$CPP $CPPFLAGS'
+ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
+ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
+ac_compiler_gnu=$ac_cv_c_compiler_gnu
+
 
 
 
@@ -3733,7 +3750,7 @@ fi
 
 # Define the identity of the package.
  PACKAGE='ntp'
- VERSION='4.2.8p3'
+ VERSION='4.2.8p4'
 
 
 cat >>confdefs.h <<_ACEOF
@@ -6768,7 +6785,7 @@ esac
 
     { $as_echo "$as_me:${as_lineno-$LINENO}: checking additional compiler flags" >&5
 $as_echo_n "checking additional compiler flags... " >&6; }
-    # allow ntp_os_flags to be preset to skip this stuff
+    # allow ntp_os_cflags to be preset to skip this stuff
     case "${ntp_os_cflags+set}" in
      set)
 	;;
@@ -6856,7 +6873,7 @@ $as_echo_n "checking additional compiler flags... " >&6; }
 	    ;;
 	esac
     esac
-    case "$ntp_os_flags" in
+    case "$ntp_os_cflags" in
      '')
 	ntp_os_cflags_msg="none needed"
 	;;
@@ -6867,6 +6884,38 @@ $as_echo_n "checking additional compiler flags... " >&6; }
     { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ntp_os_cflags_msg" >&5
 $as_echo "$ntp_os_cflags_msg" >&6; }
     { ntp_os_cflags_msg=; unset ntp_os_cflags_msg;}
+    ###
+    { $as_echo "$as_me:${as_lineno-$LINENO}: checking additional linker flags" >&5
+$as_echo_n "checking additional linker flags... " >&6; }
+    # HMS: The following might still need tweaking
+    # allow ntp_os_ldflags to be preset to skip this stuff
+    case "${ntp_os_ldflags+set}" in
+     set)
+	;;
+     *)
+	ntp_os_ldflags=
+	case "$host_os" in
+	 hpux*)
+	    case "$GCC" in
+	     yes)
+		ntp_os_ldflags="-Wl,+allowdups"
+		;;
+	    esac
+	    ;;
+	esac
+	;;
+    esac
+    case "$ntp_os_ldflags" in
+     '')
+	ntp_os_ldflags_msg="none needed"
+	;;
+     *)
+	ntp_os_ldflags_msg="$ntp_os_ldflags"
+    esac
+    LDFLAGS_NTP="$LDFLAGS_NTP $ntp_os_ldflags"
+    { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ntp_os_ldflags_msg" >&5
+$as_echo "$ntp_os_ldflags_msg" >&6; }
+    { ntp_os_ldflags_msg=; unset ntp_os_ldflags_msg;}
 
 
 
@@ -19945,6 +19994,7 @@ ntp_libevent_tearoff=sntp/libevent
 
 
 
+
 case "$ntp_use_local_libevent" in
  yes)
     ;;
@@ -19958,6 +20008,7 @@ $as_echo_n "checking if libevent $ntp_libevent_min_version or later is installed
 	    ntp_use_local_libevent=no
 	    { $as_echo "$as_me:${as_lineno-$LINENO}: Using the installed libevent" >&5
 $as_echo "$as_me: Using the installed libevent" >&6;}
+	    CFLAGS_LIBEVENT=`$PKG_CONFIG --cflags libevent_pthreads`
 	    CPPFLAGS_LIBEVENT=`$PKG_CONFIG --cflags-only-I libevent`
 	    # HMS: I hope the following is accurate.
 	    # We don't need -levent, we only need  -levent_core.
@@ -19987,6 +20038,9 @@ $as_echo "$as_me: Using the installed libevent" >&6;}
 $as_echo "yes" >&6; }
 	else
 	    ntp_use_local_libevent=yes
+	    # HMS: do we only need to do this if LIBISC_PTHREADS_NOTHREADS
+	    # is "pthreads"?
+	    CFLAGS_LIBEVENT=`$PKG_CONFIG --cflags libevent_pthreads`
 	    { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
 	fi
@@ -20012,6 +20066,7 @@ $as_echo "$as_me: Using libevent tearoff" >&6;}
     esac
 esac
 
+
  if test "x$ntp_use_local_libevent" = "xyes"; then
   BUILD_LIBEVENT_TRUE=
   BUILD_LIBEVENT_FALSE='#'
@@ -22941,7 +22996,8 @@ fi
 
 have_pthreads=no
 case "$enable_thread_support" in
- yes)
+ no) ;;
+ *)
     ol_found_pthreads=no
 
 
@@ -26358,6 +26414,9 @@ $as_echo "$ol_cv_pthread_lib_lpthreads" >&6; }
 fi
 
 
+{ $as_echo "$as_me:${as_lineno-$LINENO}: ol_link_threads: <$ol_link_threads> ol_link_pthreads <$ol_link_pthreads>" >&5
+$as_echo "$as_me: ol_link_threads: <$ol_link_threads> ol_link_pthreads <$ol_link_pthreads>" >&6;}
+
 		if test $ol_link_threads != no ; then
 			LTHREAD_LIBS="$LTHREAD_LIBS $ol_link_pthreads"
 
@@ -27398,6 +27457,10 @@ ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $
 ac_compiler_gnu=$ac_cv_c_compiler_gnu
 
 
+
+
+
+
     case "$ol_found_pthreads" in
      yes)
 	saved_LIBS="$LIBS"
@@ -27423,56 +27486,6 @@ done
 	 yes)
 	    PTHREAD_LIBS="$LTHREAD_LIBS"
 	    have_pthreads=yes
-	    # Bug 2332: With GCC we need to force a reference to libgcc_s
-	    # (if libgcc_s exists) or the combination of
-	    # threads + setuid + mlockall does not work on linux because
-	    # thread cancellation fails to load libgcc_s with dlopen().
-	    # We have to pass this all as linker options to avoid argument
-	    # reordering by libtool.
-	    case "$GCC$with_gnu_ld" in
-	    yesyes)
-		{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for exit in -lgcc_s" >&5
-$as_echo_n "checking for exit in -lgcc_s... " >&6; }
-if ${ac_cv_lib_gcc_s_exit+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-  ac_check_lib_save_LIBS=$LIBS
-LIBS="-lgcc_s  $LIBS"
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-
-/* Override any GCC internal prototype to avoid an error.
-   Use char because int might match the return type of a GCC
-   builtin and then its argument prototype would still apply.  */
-#ifdef __cplusplus
-extern "C"
-#endif
-char exit ();
-int
-main ()
-{
-return exit ();
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
-  ac_cv_lib_gcc_s_exit=yes
-else
-  ac_cv_lib_gcc_s_exit=no
-fi
-rm -f core conftest.err conftest.$ac_objext \
-    conftest$ac_exeext conftest.$ac_ext
-LIBS=$ac_check_lib_save_LIBS
-fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_gcc_s_exit" >&5
-$as_echo "$ac_cv_lib_gcc_s_exit" >&6; }
-if test "x$ac_cv_lib_gcc_s_exit" = xyes; then :
-  PTHREAD_LIBS="$LTHREAD_LIBS -Wl,--no-as-needed,-lgcc_s,--as-needed"
-fi
-
-		;;
-	    esac
 	esac
     esac
 esac
@@ -31236,10 +31249,15 @@ rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
 fi
 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ntp_cv_rlimit_memlock" >&5
 $as_echo "$ntp_cv_rlimit_memlock" >&6; }
+case "$host" in
+ *-*-*linux*)
+    ntp_dflt_rlimit_memlock="-1" ;;
+ *) ntp_dflt_rlimit_memlock="32" ;;
+esac
 case "$ntp_cv_rlimit_memlock" in
  yes)
 
-    HAVE_RLIMIT_MEMLOCK=" memlock 32"
+    HAVE_RLIMIT_MEMLOCK=" memlock $ntp_dflt_rlimit_memlock"  ;;
 esac
 
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for RLIMIT_STACK" >&5
@@ -31288,8 +31306,6 @@ case "$ntp_cv_rlimit_stack" in
     HAVE_RLIMIT_STACK=" stacksize 50"
 esac
 
-
-
 # HMS: Only if we are doing the MLOCKALL stuff...
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for the default number of 4k stack pages" >&5
 $as_echo_n "checking for the default number of 4k stack pages... " >&6; }
@@ -31339,7 +31355,7 @@ fi
 
 case "$ans" in
  yes | no)
-    ans=32
+    ans=$ntp_dflt_rlimit_memlock
     ;;
  [1-9][0-9]*) ;;
  *) as_fn_error $? "\"--with-memlock requires an integer argument.\"" "$LINENO" 5
@@ -31354,6 +31370,7 @@ _ACEOF
 
 
 
+
 # some OSes prefer _exit() in forked children to exit()
 for ac_func in _exit
 do :
@@ -36995,6 +37012,81 @@ fi
 
 
 
+
+case "$build" in
+ $host)	cross=0 ;;
+ *)	cross=1 ;;
+esac
+
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if we want to enable tests with undiagnosed problems" >&5
+$as_echo_n "checking if we want to enable tests with undiagnosed problems... " >&6; }
+# Check whether --enable-problem-tests was given.
+if test "${enable_problem_tests+set}" = set; then :
+  enableval=$enable_problem_tests; ntp_ept=$enableval
+else
+  ntp_ept=yes
+
+fi
+
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ntp_ept" >&5
+$as_echo "$ntp_ept" >&6; }
+
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if we can run test-ntp_restrict" >&5
+$as_echo_n "checking if we can run test-ntp_restrict... " >&6; }
+ntp_test_ntp_restrict="no"
+case "$ntp_ept:$cross:$host" in
+ no:0:*-*-solaris*) ;;
+ no:0:*-*-hpux-11.23*) ;;
+ *) ntp_test_ntp_restrict="yes" ;;
+esac
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ntp_test_ntp_restrict" >&5
+$as_echo "$ntp_test_ntp_restrict" >&6; }
+ if test x$ntp_test_ntp_restrict = xyes; then
+  BUILD_TEST_NTP_RESTRICT_TRUE=
+  BUILD_TEST_NTP_RESTRICT_FALSE='#'
+else
+  BUILD_TEST_NTP_RESTRICT_TRUE='#'
+  BUILD_TEST_NTP_RESTRICT_FALSE=
+fi
+
+
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if we can run test-ntp_scanner" >&5
+$as_echo_n "checking if we can run test-ntp_scanner... " >&6; }
+ntp_test_ntp_scanner="no"
+case "$ntp_ept:$cross:$host" in
+ no:0:*-*-solaris*) ;;
+ *) ntp_test_ntp_scanner="yes" ;;
+esac
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ntp_test_ntp_scanner" >&5
+$as_echo "$ntp_test_ntp_scanner" >&6; }
+ if test x$ntp_test_ntp_scanner = xyes; then
+  BUILD_TEST_NTP_SCANNER_TRUE=
+  BUILD_TEST_NTP_SCANNER_FALSE='#'
+else
+  BUILD_TEST_NTP_SCANNER_TRUE='#'
+  BUILD_TEST_NTP_SCANNER_FALSE=
+fi
+
+
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if we can run test-ntp_signd" >&5
+$as_echo_n "checking if we can run test-ntp_signd... " >&6; }
+ntp_test_ntp_signd="no"
+case "$ntp_ept:$cross:$host" in
+ no:0:*-*-solaris*) ;;
+ *) ntp_test_ntp_signd="yes" ;;
+esac
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ntp_test_ntp_signd" >&5
+$as_echo "$ntp_test_ntp_signd" >&6; }
+ if test x$ntp_test_ntp_signd = xyes; then
+  BUILD_TEST_NTP_SIGND_TRUE=
+  BUILD_TEST_NTP_SIGND_FALSE='#'
+else
+  BUILD_TEST_NTP_SIGND_TRUE='#'
+  BUILD_TEST_NTP_SIGND_FALSE=
+fi
+
+
+
 ###
 
 
@@ -37091,6 +37183,8 @@ ac_config_files="$ac_config_files tests/libntp/Makefile"
 
 ac_config_files="$ac_config_files tests/ntpd/Makefile"
 
+ac_config_files="$ac_config_files tests/ntpq/Makefile"
+
 ac_config_files="$ac_config_files tests/sandbox/Makefile"
 
 ac_config_files="$ac_config_files tests/sec-2853/Makefile"
@@ -37333,6 +37427,18 @@ if test -z "${GTEST_AVAILABLE_TRUE}" && test -z "${GTEST_AVAILABLE_FALSE}"; then
   as_fn_error $? "conditional \"GTEST_AVAILABLE\" was never defined.
 Usually this means the macro was only invoked conditionally." "$LINENO" 5
 fi
+if test -z "${BUILD_TEST_NTP_RESTRICT_TRUE}" && test -z "${BUILD_TEST_NTP_RESTRICT_FALSE}"; then
+  as_fn_error $? "conditional \"BUILD_TEST_NTP_RESTRICT\" was never defined.
+Usually this means the macro was only invoked conditionally." "$LINENO" 5
+fi
+if test -z "${BUILD_TEST_NTP_SCANNER_TRUE}" && test -z "${BUILD_TEST_NTP_SCANNER_FALSE}"; then
+  as_fn_error $? "conditional \"BUILD_TEST_NTP_SCANNER\" was never defined.
+Usually this means the macro was only invoked conditionally." "$LINENO" 5
+fi
+if test -z "${BUILD_TEST_NTP_SIGND_TRUE}" && test -z "${BUILD_TEST_NTP_SIGND_FALSE}"; then
+  as_fn_error $? "conditional \"BUILD_TEST_NTP_SIGND\" was never defined.
+Usually this means the macro was only invoked conditionally." "$LINENO" 5
+fi
 
 : "${CONFIG_STATUS=./config.status}"
 ac_write_fail=0
@@ -37730,7 +37836,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by ntp $as_me 4.2.8p3, which was
+This file was extended by ntp $as_me 4.2.8p4, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -37797,7 +37903,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-ntp config.status 4.2.8p3
+ntp config.status 4.2.8p4
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 
@@ -38344,6 +38450,7 @@ do
     "tests/bug-2803/Makefile") CONFIG_FILES="$CONFIG_FILES tests/bug-2803/Makefile" ;;
     "tests/libntp/Makefile") CONFIG_FILES="$CONFIG_FILES tests/libntp/Makefile" ;;
     "tests/ntpd/Makefile") CONFIG_FILES="$CONFIG_FILES tests/ntpd/Makefile" ;;
+    "tests/ntpq/Makefile") CONFIG_FILES="$CONFIG_FILES tests/ntpq/Makefile" ;;
     "tests/sandbox/Makefile") CONFIG_FILES="$CONFIG_FILES tests/sandbox/Makefile" ;;
     "tests/sec-2853/Makefile") CONFIG_FILES="$CONFIG_FILES tests/sec-2853/Makefile" ;;
     "util/Makefile") CONFIG_FILES="$CONFIG_FILES util/Makefile" ;;