Fix multiple vulnerabilities of ntp.releng/10.1

Approved by:	so

6 files changed, 114 insertions, 5 deletions

diff --git a/contrib/ntp/include/Makefile.am b/contrib/ntp/include/Makefile.am
index 521ac14..749a0c8 100644
--- a/contrib/ntp/include/Makefile.am
+++ b/contrib/ntp/include/Makefile.am
@@ -16,6 +16,7 @@ noinst_HEADERS =	\
 	intreswork.h	\
 	iosignal.h	\
 	l_stdlib.h	\
+	libssl_compat.h	\
 	lib_strbuf.h	\
 	libntp.h	\
 	mbg_gps166.h	\
diff --git a/contrib/ntp/include/Makefile.in b/contrib/ntp/include/Makefile.in
index ef92804..acd3bb5 100644
--- a/contrib/ntp/include/Makefile.in
+++ b/contrib/ntp/include/Makefile.in
@@ -501,6 +501,7 @@ noinst_HEADERS = \
 	intreswork.h	\
 	iosignal.h	\
 	l_stdlib.h	\
+	libssl_compat.h	\
 	lib_strbuf.h	\
 	libntp.h	\
 	mbg_gps166.h	\
diff --git a/contrib/ntp/include/libssl_compat.h b/contrib/ntp/include/libssl_compat.h
new file mode 100644
index 0000000..a8938a1
--- /dev/null
+++ b/contrib/ntp/include/libssl_compat.h
@@ -0,0 +1,100 @@
+/*
+ * libssl_compat.h -- OpenSSL v1.1 compatibility shims
+ *
+ * ---------------------------------------------------------------------
+ *
+ * Written by Juergen Perlinger <perlinger@ntp.org> for the NTP project
+ *
+ * Based on an idea by Kurt Roeckx <kurt@roeckx.be>
+ *
+ * ---------------------------------------------------------------------
+ * This is a clean room implementation of shim functions that have
+ * counterparts in the OpenSSL v1.1 API but not in earlier versions.
+ *
+ * If the OpenSSL version used for compilation needs the shims (that is,
+ * does not provide the new functions) the names of these functions are
+ * redirected to our shims.
+ * ---------------------------------------------------------------------
+ */
+
+#ifndef NTP_LIBSSL_COMPAT_H
+#define NTP_LIBSSL_COMPAT_H
+
+#include "openssl/evp.h"
+#include "openssl/dsa.h"
+#include "openssl/rsa.h"
+
+/* ----------------------------------------------------------------- */
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+/* ----------------------------------------------------------------- */
+
+# include <openssl/objects.h>
+# include <openssl/x509.h>
+
+/* shim the new-style API on an old-style OpenSSL */
+
+extern BN_GENCB*	sslshimBN_GENCB_new(void);
+extern void		sslshimBN_GENCB_free(BN_GENCB*);
+
+extern EVP_MD_CTX*	sslshim_EVP_MD_CTX_new(void);
+extern void		sslshim_EVP_MD_CTX_free(EVP_MD_CTX *ctx);
+
+extern int	sslshim_EVP_PKEY_id(const EVP_PKEY * pkey);
+extern int	sslshim_EVP_PKEY_base_id(const EVP_PKEY * pkey);
+extern RSA*	sslshim_EVP_PKEY_get0_RSA(EVP_PKEY * pkey);
+extern DSA*	sslshim_EVP_PKEY_get0_DSA(EVP_PKEY * pkey);
+
+extern void	sslshim_RSA_get0_key(const RSA *prsa, const BIGNUM **pn,
+				     const BIGNUM **pe, const BIGNUM **pd);
+extern int	sslshim_RSA_set0_key(RSA *prsa, BIGNUM *n,
+				     BIGNUM *e, BIGNUM *d);
+extern void	sslshim_RSA_get0_factors(const RSA *prsa, const BIGNUM **pp,
+					 const BIGNUM **pq);
+extern int 	sslshim_RSA_set0_factors(RSA *prsar, BIGNUM *p, BIGNUM *q);
+extern int	sslshim_RSA_set0_crt_params(RSA *prsa, BIGNUM *dmp1,
+					BIGNUM *dmq1, BIGNUM *iqmp);
+
+extern void	sslshim_DSA_SIG_get0(const DSA_SIG *psig, const BIGNUM **pr,
+				     const BIGNUM **ps);
+extern int	sslshim_DSA_SIG_set0(DSA_SIG *psig, BIGNUM *r, BIGNUM *s);
+extern void	sslshim_DSA_get0_pqg(const DSA *pdsa, const BIGNUM **pp,
+				 const BIGNUM **pq, const BIGNUM **pg);
+extern int	sslshim_DSA_set0_pqg(DSA *pdsa, BIGNUM *p, BIGNUM *q, BIGNUM *g);
+extern void	sslshim_DSA_get0_key(const DSA *pdsa, const BIGNUM **ppub_key,
+				 const BIGNUM **ppriv_key);
+extern int	sslshim_DSA_set0_key(DSA *pdsa, BIGNUM *pub_key,
+				     BIGNUM *priv_key);
+
+extern int	sslshim_X509_get_signature_nid(const X509 *x);
+
+#define	BN_GENCB_new		sslshimBN_GENCB_new
+#define	BN_GENCB_free		sslshimBN_GENCB_free
+
+#define EVP_MD_CTX_new		sslshim_EVP_MD_CTX_new
+#define EVP_MD_CTX_free		sslshim_EVP_MD_CTX_free
+
+#define EVP_PKEY_id		sslshim_EVP_PKEY_id
+#define EVP_PKEY_base_id	sslshim_EVP_PKEY_base_id
+#define EVP_PKEY_get0_RSA	sslshim_EVP_PKEY_get0_RSA
+#define EVP_PKEY_get0_DSA	sslshim_EVP_PKEY_get0_DSA
+
+#define RSA_get0_key		sslshim_RSA_get0_key
+#define RSA_set0_key		sslshim_RSA_set0_key
+#define RSA_get0_factors	sslshim_RSA_get0_factors
+#define RSA_set0_factors	sslshim_RSA_set0_factors
+#define RSA_set0_crt_params	sslshim_RSA_set0_crt_params
+
+#define DSA_SIG_get0		sslshim_DSA_SIG_get0
+#define DSA_SIG_set0		sslshim_DSA_SIG_set0
+#define DSA_get0_pqg		sslshim_DSA_get0_pqg
+#define DSA_set0_pqg		sslshim_DSA_set0_pqg
+#define DSA_get0_key		sslshim_DSA_get0_key
+#define DSA_set0_key		sslshim_DSA_set0_key
+
+#define X509_get_signature_nid	sslshim_X509_get_signature_nid
+
+/* ----------------------------------------------------------------- */
+#endif /* OPENSSL_VERSION_NUMBER < v1.1.0 */
+/* ----------------------------------------------------------------- */
+
+#endif /* NTP_LIBSSL_COMPAT_H */
diff --git a/contrib/ntp/include/ntp.h b/contrib/ntp/include/ntp.h
index 84c30d9..323135d 100644
--- a/contrib/ntp/include/ntp.h
+++ b/contrib/ntp/include/ntp.h
@@ -391,7 +391,7 @@ struct peer {
 	 * Statistic counters
 	 */
 	u_long	timereset;	/* time stat counters were reset */
-	u_long	timelastrec;	/* last packet received time */
+	u_long	timelastrec;	/* last packet received time, incl. trash */
 	u_long	timereceived;	/* last (clean) packet received time */
 	u_long	timereachable;	/* last reachable/unreachable time */
 
@@ -419,8 +419,7 @@ struct peer {
  * MODE_BROADCAST and MODE_BCLIENT appear in the transition
  * function. MODE_CONTROL and MODE_PRIVATE can appear in packets,
  * but those never survive to the transition function.
- * is a
-/ */
+ */
 #define	MODE_UNSPEC	0	/* unspecified (old version) */
 #define	MODE_ACTIVE	1	/* symmetric active mode */
 #define	MODE_PASSIVE	2	/* symmetric passive mode */
@@ -433,7 +432,7 @@ struct peer {
 #define	MODE_CONTROL	6	/* control mode */
 #define	MODE_PRIVATE	7	/* private mode */
 /*
- * This is a madeup mode for broadcast client.
+ * This is a made-up mode for broadcast client.
  */
 #define	MODE_BCLIENT	6	/* broadcast client mode */
 
@@ -724,6 +723,7 @@ struct pkt {
 #define	PROTO_UECRYPTONAK	30
 #define	PROTO_UEDIGEST		31
 #define	PROTO_PCEDIGEST		32
+#define	PROTO_BCPOLLBSTEP	33
 
 /*
  * Configuration items for the loop filter
@@ -731,7 +731,7 @@ struct pkt {
 #define	LOOP_DRIFTINIT		1	/* iniitialize frequency */
 #define	LOOP_KERN_CLEAR		2	/* set initial frequency offset */
 #define LOOP_MAX		3	/* set both step offsets */
-#define LOOP_MAX_BACK		4	/* set bacward-step offset */
+#define LOOP_MAX_BACK		4	/* set backward-step offset */
 #define LOOP_MAX_FWD		5	/* set forward-step offset */
 #define LOOP_PANIC		6	/* set panic offseet */
 #define LOOP_PHI		7	/* set dispersion rate */
diff --git a/contrib/ntp/include/ntp_intres.h b/contrib/ntp/include/ntp_intres.h
index 1b6bd66..1109130 100644
--- a/contrib/ntp/include/ntp_intres.h
+++ b/contrib/ntp/include/ntp_intres.h
@@ -9,6 +9,9 @@
 #ifdef WORKER
 #define	INITIAL_DNS_RETRY	2	/* seconds between queries */
 
+/* flags for extended addrinfo version */
+#define GAIR_F_IGNDNSERR	0x0001	/* ignore DNS errors */
+
 /*
  * you call getaddrinfo_sometime(name, service, &hints, retry, callback_func, context);
  * later (*callback_func)(rescode, gai_errno, context, name, service, hints, ai_result) is called.
@@ -19,6 +22,9 @@ typedef void	(*gai_sometime_callback)
 extern int	getaddrinfo_sometime(const char *, const char *,
 				     const struct addrinfo *, int,
 				     gai_sometime_callback, void *);
+extern int	getaddrinfo_sometime_ex(const char *, const char *,
+				     const struct addrinfo *, int,
+				     gai_sometime_callback, void *, u_int);
 /*
  * In gai_sometime_callback routines, the resulting addrinfo list is
  * only available until the callback returns.  To hold on to the list
diff --git a/contrib/ntp/include/ntpd.h b/contrib/ntp/include/ntpd.h
index 362068c..1f33bf4 100644
--- a/contrib/ntp/include/ntpd.h
+++ b/contrib/ntp/include/ntpd.h
@@ -483,6 +483,7 @@ extern int	sys_bclient;		/* we set our time to broadcasts */
 extern double	sys_bdelay; 		/* broadcast client default delay */
 extern int	sys_authenticate;	/* requre authentication for config */
 extern l_fp	sys_authdelay;		/* authentication delay */
+extern u_char	sys_bcpollbstep;	/* broadcast poll backstep gate */
 extern u_long 	sys_epoch;		/* last clock update time */
 extern keyid_t	sys_private;		/* private value for session seed */
 extern int	sys_manycastserver;	/* respond to manycast client pkts */