Fix ntp multiple vulnerabilities.

Approved by:	so

12 files changed, 411 insertions, 109 deletions

diff --git a/contrib/ntp/ntpq/invoke-ntpq.texi b/contrib/ntp/ntpq/invoke-ntpq.texi
index bcd1df4..0829876 100644
--- a/contrib/ntp/ntpq/invoke-ntpq.texi
+++ b/contrib/ntp/ntpq/invoke-ntpq.texi
@@ -6,7 +6,7 @@
 #
 # EDIT THIS FILE WITH CAUTION  (invoke-ntpq.texi)
 #
-# It has been AutoGen-ed  January 20, 2016 at 04:19:10 AM by AutoGen 5.18.5
+# It has been AutoGen-ed  April 26, 2016 at 08:29:39 PM by AutoGen 5.18.5
 # From the definitions    ntpq-opts.def
 # and the template file   agtexi-cmd.tpl
 @end ignore
@@ -826,6 +826,7 @@ This software is released under the NTP license, <http://ntp.org/license>.
 * ntpq numeric::                numeric option (-n)
 * ntpq old-rv::                 old-rv option
 * ntpq peers::                  peers option (-p)
+* ntpq refid::                  refid option (-r)
 * ntpq wide::                   wide option (-w)
 * ntpq config::                 presetting/configuring ntpq
 * ntpq exit status::            exit status
@@ -847,7 +848,7 @@ with a status code of 0.
 
 @exampleindent 0
 @example
-ntpq - standard NTP query program - Ver. 4.2.8p6
+ntpq - standard NTP query program - Ver. 4.2.8p7
 Usage:  ntpq [ -<flag> [<val>] | --<name>[@{=| @}<val>] ]... [ host ...]
   Flg Arg Option-Name    Description
    -4 no  ipv4           Force IPv4 DNS name resolution
@@ -868,6 +869,7 @@ Usage:  ntpq [ -<flag> [<val>] | --<name>[@{=| @}<val>] ]... [ host ...]
       no  old-rv         Always output status line with readvar
    -p no  peers          Print a list of the peers
                                 - prohibits the option 'interactive'
+   -r KWd refid          Set default display type for S2+ refids
    -w no  wide           Display the full 'remote' value
       opt version        output version information and exit
    -? no  help           display extended usage information and exit
@@ -885,6 +887,10 @@ The following option preset mechanisms are supported:
  - reading file ./.ntprc
  - examining environment variables named NTPQ_*
 
+The valid "refid" option keywords are:
+  hash ipv4
+  or an integer from 0 through 1
+
 Please send bug reports to:  <http://bugs.ntp.org, bugs@@ntp.org>
 @end example
 @exampleindent 4
@@ -992,6 +998,27 @@ interactive.
 
 Print a list of the peers known to the server as well as a summary
 of their state. This is equivalent to the 'peers' interactive command.
+@node ntpq refid
+@subsection refid option (-r)
+@cindex ntpq-refid
+
+This is the ``set default display type for s2+ refids'' option.
+This option takes a keyword argument.
+
+@noindent
+This option has some usage constraints.  It:
+@itemize @bullet
+@item
+This option takes a keyword as its argument.
+The argument sets an enumeration value that can be tested by comparing the option value macro (OPT_VALUE_REFID).
+The available keywords are:
+@example
+    hash ipv4
+@end example
+
+or their numeric equivalent.@end itemize
+
+Set the default display format for S2+ refids.
 @node ntpq wide
 @subsection wide option (-w)
 @cindex ntpq-wide
diff --git a/contrib/ntp/ntpq/ntpq-opts.c b/contrib/ntp/ntpq/ntpq-opts.c
index 42131a3..a3ff412 100644
--- a/contrib/ntp/ntpq/ntpq-opts.c
+++ b/contrib/ntp/ntpq/ntpq-opts.c
@@ -1,7 +1,7 @@
 /*
  *  EDIT THIS FILE WITH CAUTION  (ntpq-opts.c)
  *
- *  It has been AutoGen-ed  January 20, 2016 at 04:18:42 AM by AutoGen 5.18.5
+ *  It has been AutoGen-ed  April 26, 2016 at 08:29:11 PM by AutoGen 5.18.5
  *  From the definitions    ntpq-opts.def
  *  and the template file   options
  *
@@ -68,8 +68,8 @@ extern FILE * option_usage_fp;
 /**
  *  static const strings for ntpq options
  */
-static char const ntpq_opt_strs[1925] =
-/*     0 */ "ntpq 4.2.8p6\n"
+static char const ntpq_opt_strs[1982] =
+/*     0 */ "ntpq 4.2.8p7\n"
             "Copyright (C) 1992-2016 The University of Delaware and Network Time Foundation, all rights reserved.\n"
             "This is free software. It is licensed for use, modification and\n"
             "redistribution under the terms of the NTP License, copies of which\n"
@@ -113,29 +113,33 @@ static char const ntpq_opt_strs[1925] =
 /*  1404 */ "Print a list of the peers\0"
 /*  1430 */ "PEERS\0"
 /*  1436 */ "peers\0"
-/*  1442 */ "Display the full 'remote' value\0"
-/*  1474 */ "WIDE\0"
-/*  1479 */ "wide\0"
-/*  1484 */ "display extended usage information and exit\0"
-/*  1528 */ "help\0"
-/*  1533 */ "extended usage information passed thru pager\0"
-/*  1578 */ "more-help\0"
-/*  1588 */ "output version information and exit\0"
-/*  1624 */ "version\0"
-/*  1632 */ "save the option state to a config file\0"
-/*  1671 */ "save-opts\0"
-/*  1681 */ "load options from a config file\0"
-/*  1713 */ "LOAD_OPTS\0"
-/*  1723 */ "no-load-opts\0"
-/*  1736 */ "no\0"
-/*  1739 */ "NTPQ\0"
-/*  1744 */ "ntpq - standard NTP query program - Ver. 4.2.8p6\n"
+/*  1442 */ "Set default display type for S2+ refids\0"
+/*  1482 */ "REFID\0"
+/*  1488 */ "refid\0"
+/*  1494 */ "Display the full 'remote' value\0"
+/*  1526 */ "WIDE\0"
+/*  1531 */ "wide\0"
+/*  1536 */ "display extended usage information and exit\0"
+/*  1580 */ "help\0"
+/*  1585 */ "extended usage information passed thru pager\0"
+/*  1630 */ "more-help\0"
+/*  1640 */ "output version information and exit\0"
+/*  1676 */ "version\0"
+/*  1684 */ "save the option state to a config file\0"
+/*  1723 */ "save-opts\0"
+/*  1733 */ "load options from a config file\0"
+/*  1765 */ "LOAD_OPTS\0"
+/*  1775 */ "no-load-opts\0"
+/*  1788 */ "no\0"
+/*  1791 */ "NTPQ\0"
+/*  1796 */ "ntpq - standard NTP query program - Ver. 4.2.8p7\n"
             "Usage:  %s [ -<flag> [<val>] | --<name>[{=| }<val>] ]... [ host ...]\n\0"
-/*  1863 */ "$HOME\0"
-/*  1869 */ ".\0"
-/*  1871 */ ".ntprc\0"
-/*  1878 */ "http://bugs.ntp.org, bugs@ntp.org\0"
-/*  1912 */ "ntpq 4.2.8p6";
+/*  1915 */ "$HOME\0"
+/*  1921 */ ".\0"
+/*  1923 */ ".ntprc\0"
+/*  1930 */ "http://bugs.ntp.org, bugs@ntp.org\0"
+/*  1964 */ "ntpq 4.2.8p7\0"
+/*  1977 */ "hash";
 
 /**
  *  ipv4 option description with
@@ -265,25 +269,40 @@ static int const aPeersCantList[] = {
 #define PEERS_FLAGS     (OPTST_DISABLED)
 
 /**
+ *  refid option description:
+ */
+/** Descriptive text for the refid option */
+#define REFID_DESC      (ntpq_opt_strs+1442)
+/** Upper-cased name for the refid option */
+#define REFID_NAME      (ntpq_opt_strs+1482)
+/** Name string for the refid option */
+#define REFID_name      (ntpq_opt_strs+1488)
+/** The compiled in default value for the refid option argument */
+#define REFID_DFT_ARG   ((char const*)REFID_IPV4)
+/** Compiled in flag settings for the refid option */
+#define REFID_FLAGS     (OPTST_DISABLED \
+        | OPTST_SET_ARGTYPE(OPARG_TYPE_ENUMERATION))
+
+/**
  *  wide option description:
  */
 /** Descriptive text for the wide option */
-#define WIDE_DESC      (ntpq_opt_strs+1442)
+#define WIDE_DESC      (ntpq_opt_strs+1494)
 /** Upper-cased name for the wide option */
-#define WIDE_NAME      (ntpq_opt_strs+1474)
+#define WIDE_NAME      (ntpq_opt_strs+1526)
 /** Name string for the wide option */
-#define WIDE_name      (ntpq_opt_strs+1479)
+#define WIDE_name      (ntpq_opt_strs+1531)
 /** Compiled in flag settings for the wide option */
 #define WIDE_FLAGS     (OPTST_DISABLED)
 
 /*
  *  Help/More_Help/Version option descriptions:
  */
-#define HELP_DESC       (ntpq_opt_strs+1484)
-#define HELP_name       (ntpq_opt_strs+1528)
+#define HELP_DESC       (ntpq_opt_strs+1536)
+#define HELP_name       (ntpq_opt_strs+1580)
 #ifdef HAVE_WORKING_FORK
-#define MORE_HELP_DESC  (ntpq_opt_strs+1533)
-#define MORE_HELP_name  (ntpq_opt_strs+1578)
+#define MORE_HELP_DESC  (ntpq_opt_strs+1585)
+#define MORE_HELP_name  (ntpq_opt_strs+1630)
 #define MORE_HELP_FLAGS (OPTST_IMM | OPTST_NO_INIT)
 #else
 #define MORE_HELP_DESC  HELP_DESC
@@ -296,14 +315,14 @@ static int const aPeersCantList[] = {
 #  define VER_FLAGS     (OPTST_SET_ARGTYPE(OPARG_TYPE_STRING) | \
                          OPTST_ARG_OPTIONAL | OPTST_IMM | OPTST_NO_INIT)
 #endif
-#define VER_DESC        (ntpq_opt_strs+1588)
-#define VER_name        (ntpq_opt_strs+1624)
-#define SAVE_OPTS_DESC  (ntpq_opt_strs+1632)
-#define SAVE_OPTS_name  (ntpq_opt_strs+1671)
-#define LOAD_OPTS_DESC     (ntpq_opt_strs+1681)
-#define LOAD_OPTS_NAME     (ntpq_opt_strs+1713)
-#define NO_LOAD_OPTS_name  (ntpq_opt_strs+1723)
-#define LOAD_OPTS_pfx      (ntpq_opt_strs+1736)
+#define VER_DESC        (ntpq_opt_strs+1640)
+#define VER_name        (ntpq_opt_strs+1676)
+#define SAVE_OPTS_DESC  (ntpq_opt_strs+1684)
+#define SAVE_OPTS_name  (ntpq_opt_strs+1723)
+#define LOAD_OPTS_DESC     (ntpq_opt_strs+1733)
+#define LOAD_OPTS_NAME     (ntpq_opt_strs+1765)
+#define NO_LOAD_OPTS_name  (ntpq_opt_strs+1775)
+#define LOAD_OPTS_pfx      (ntpq_opt_strs+1788)
 #define LOAD_OPTS_name     (NO_LOAD_OPTS_name + 3)
 /**
  *  Declare option callback procedures
@@ -314,7 +333,7 @@ extern tOptProc
     optionResetOpt,          optionStackArg,          optionTimeDate,
     optionTimeVal,           optionUnstackArg,        optionVendorOption;
 static tOptProc
-    doOptDebug_Level, doUsageOpt;
+    doOptDebug_Level, doOptRefid, doUsageOpt;
 #define VER_PROC        ntpOptionPrintVersion
 
 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
@@ -432,8 +451,20 @@ static tOptDesc optDesc[OPTION_CT] = {
      /* desc, NAME, name */ PEERS_DESC, PEERS_NAME, PEERS_name,
      /* disablement strs */ NULL, NULL },
 
-  {  /* entry idx, value */ 9, VALUE_OPT_WIDE,
-     /* equiv idx, value */ 9, VALUE_OPT_WIDE,
+  {  /* entry idx, value */ 9, VALUE_OPT_REFID,
+     /* equiv idx, value */ 9, VALUE_OPT_REFID,
+     /* equivalenced to  */ NO_EQUIVALENT,
+     /* min, max, act ct */ 0, 1, 0,
+     /* opt state flags  */ REFID_FLAGS, 0,
+     /* last opt argumnt */ { REFID_DFT_ARG },
+     /* arg list/cookie  */ NULL,
+     /* must/cannot opts */ NULL, NULL,
+     /* option proc      */ doOptRefid,
+     /* desc, NAME, name */ REFID_DESC, REFID_NAME, REFID_name,
+     /* disablement strs */ NULL, NULL },
+
+  {  /* entry idx, value */ 10, VALUE_OPT_WIDE,
+     /* equiv idx, value */ 10, VALUE_OPT_WIDE,
      /* equivalenced to  */ NO_EQUIVALENT,
      /* min, max, act ct */ 0, 1, 0,
      /* opt state flags  */ WIDE_FLAGS, 0,
@@ -512,24 +543,24 @@ static tOptDesc optDesc[OPTION_CT] = {
 
 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
 /** Reference to the upper cased version of ntpq. */
-#define zPROGNAME       (ntpq_opt_strs+1739)
+#define zPROGNAME       (ntpq_opt_strs+1791)
 /** Reference to the title line for ntpq usage. */
-#define zUsageTitle     (ntpq_opt_strs+1744)
+#define zUsageTitle     (ntpq_opt_strs+1796)
 /** ntpq configuration file name. */
-#define zRcName         (ntpq_opt_strs+1871)
+#define zRcName         (ntpq_opt_strs+1923)
 /** Directories to search for ntpq config files. */
 static char const * const apzHomeList[3] = {
-    ntpq_opt_strs+1863,
-    ntpq_opt_strs+1869,
+    ntpq_opt_strs+1915,
+    ntpq_opt_strs+1921,
     NULL };
 /** The ntpq program bug email address. */
-#define zBugsAddr       (ntpq_opt_strs+1878)
+#define zBugsAddr       (ntpq_opt_strs+1930)
 /** Clarification/explanation of what ntpq does. */
 #define zExplain        (NULL)
 /** Extra detail explaining what ntpq does. */
 #define zDetail         (NULL)
 /** The full version string for ntpq. */
-#define zFullVersion    (ntpq_opt_strs+1912)
+#define zFullVersion    (ntpq_opt_strs+1964)
 /* extracted from optcode.tlib near line 364 */
 
 #if defined(ENABLE_NLS)
@@ -588,6 +619,30 @@ OPT_VALUE_SET_DEBUG_LEVEL++;
     (void)pOptDesc;
     (void)pOptions;
 }
+
+/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
+/**
+ * Code to handle the refid option.
+ * Set the default display format for S2+ refids.
+ * @param[in] pOptions the ntpq options data structure
+ * @param[in,out] pOptDesc the option descriptor for this option.
+ */
+static void
+doOptRefid(tOptions* pOptions, tOptDesc* pOptDesc)
+{
+
+/* extracted from optmain.tlib near line 945 */
+    static char const * const names[2] = {
+        ntpq_opt_strs+1977, ntpq_opt_strs+1044 };
+
+    if (pOptions <= OPTPROC_EMIT_LIMIT) {
+        (void) optionEnumerationVal(pOptions, pOptDesc, names, 2);
+        return; /* protect AutoOpts client code from internal callbacks */
+    }
+
+    pOptDesc->optArg.argEnum =
+        optionEnumerationVal(pOptions, pOptDesc, names, 2);
+}
 /* extracted from optmain.tlib near line 1250 */
 
 /**
@@ -651,7 +706,7 @@ tOptions ntpqOptions = {
       NO_EQUIVALENT, /* '-#' option index */
       NO_EQUIVALENT /* index of default opt */
     },
-    15 /* full option count */, 10 /* user option count */,
+    16 /* full option count */, 11 /* user option count */,
     ntpq_full_usage, ntpq_short_usage,
     NULL, NULL,
     PKGDATADIR, ntpq_packager_info
@@ -786,7 +841,7 @@ static void bogus_function(void) {
      translate option names.
    */
   /* referenced via ntpqOptions.pzCopyright */
-  puts(_("ntpq 4.2.8p6\n\
+  puts(_("ntpq 4.2.8p7\n\
 Copyright (C) 1992-2016 The University of Delaware and Network Time Foundation, all rights reserved.\n\
 This is free software. It is licensed for use, modification and\n\
 redistribution under the terms of the NTP License, copies of which\n\
@@ -834,6 +889,9 @@ implied warranty.\n"));
   puts(_("Print a list of the peers"));
 
   /* referenced via ntpqOptions.pOptDesc->pzText */
+  puts(_("Set default display type for S2+ refids"));
+
+  /* referenced via ntpqOptions.pOptDesc->pzText */
   puts(_("Display the full 'remote' value"));
 
   /* referenced via ntpqOptions.pOptDesc->pzText */
@@ -852,11 +910,11 @@ implied warranty.\n"));
   puts(_("load options from a config file"));
 
   /* referenced via ntpqOptions.pzUsageTitle */
-  puts(_("ntpq - standard NTP query program - Ver. 4.2.8p6\n\
+  puts(_("ntpq - standard NTP query program - Ver. 4.2.8p7\n\
 Usage:  %s [ -<flag> [<val>] | --<name>[{=| }<val>] ]... [ host ...]\n"));
 
   /* referenced via ntpqOptions.pzFullVersion */
-  puts(_("ntpq 4.2.8p6"));
+  puts(_("ntpq 4.2.8p7"));
 
   /* referenced via ntpqOptions.pzFullUsage */
   puts(_("<<<NOT-FOUND>>>"));
diff --git a/contrib/ntp/ntpq/ntpq-opts.def b/contrib/ntp/ntpq/ntpq-opts.def
index bac20d7..9232268 100644
--- a/contrib/ntp/ntpq/ntpq-opts.def
+++ b/contrib/ntp/ntpq/ntpq-opts.def
@@ -100,6 +100,18 @@ flag = {
 };
 
 flag = {
+    name      = refid;
+    value     = r;
+    descrip   = "Set default display type for S2+ refids";
+    arg-type  = keyword;
+    keyword   = hash, ipv4;
+    arg-default = ipv4;
+    doc = <<-  _EndOfDoc_
+	Set the default display format for S2+ refids.
+	_EndOfDoc_;
+};
+
+flag = {
     name      = wide;
     value     = w;
     descrip   = "Display the full 'remote' value";
diff --git a/contrib/ntp/ntpq/ntpq-opts.h b/contrib/ntp/ntpq/ntpq-opts.h
index af7a4c2..d275471 100644
--- a/contrib/ntp/ntpq/ntpq-opts.h
+++ b/contrib/ntp/ntpq/ntpq-opts.h
@@ -1,7 +1,7 @@
 /*
  *  EDIT THIS FILE WITH CAUTION  (ntpq-opts.h)
  *
- *  It has been AutoGen-ed  January 20, 2016 at 04:18:42 AM by AutoGen 5.18.5
+ *  It has been AutoGen-ed  April 26, 2016 at 08:29:10 PM by AutoGen 5.18.5
  *  From the definitions    ntpq-opts.def
  *  and the template file   options
  *
@@ -73,19 +73,20 @@ typedef enum {
     INDEX_OPT_NUMERIC          =  6,
     INDEX_OPT_OLD_RV           =  7,
     INDEX_OPT_PEERS            =  8,
-    INDEX_OPT_WIDE             =  9,
-    INDEX_OPT_VERSION          = 10,
-    INDEX_OPT_HELP             = 11,
-    INDEX_OPT_MORE_HELP        = 12,
-    INDEX_OPT_SAVE_OPTS        = 13,
-    INDEX_OPT_LOAD_OPTS        = 14
+    INDEX_OPT_REFID            =  9,
+    INDEX_OPT_WIDE             = 10,
+    INDEX_OPT_VERSION          = 11,
+    INDEX_OPT_HELP             = 12,
+    INDEX_OPT_MORE_HELP        = 13,
+    INDEX_OPT_SAVE_OPTS        = 14,
+    INDEX_OPT_LOAD_OPTS        = 15
 } teOptIndex;
 /** count of all options for ntpq */
-#define OPTION_CT    15
+#define OPTION_CT    16
 /** ntpq version */
-#define NTPQ_VERSION       "4.2.8p6"
+#define NTPQ_VERSION       "4.2.8p7"
 /** Full ntpq version text */
-#define NTPQ_FULL_VERSION  "ntpq 4.2.8p6"
+#define NTPQ_FULL_VERSION  "ntpq 4.2.8p7"
 
 /**
  *  Interface defines for all options.  Replace "n" with the UPPER_CASED
@@ -174,6 +175,10 @@ typedef enum {
 #  warning undefining PEERS due to option name conflict
 #  undef   PEERS
 # endif
+# ifdef    REFID
+#  warning undefining REFID due to option name conflict
+#  undef   REFID
+# endif
 # ifdef    WIDE
 #  warning undefining WIDE due to option name conflict
 #  undef   WIDE
@@ -188,6 +193,7 @@ typedef enum {
 # undef NUMERIC
 # undef OLD_RV
 # undef PEERS
+# undef REFID
 # undef WIDE
 #endif  /*  NO_OPTION_NAME_WARNINGS */
 
@@ -206,6 +212,13 @@ typedef enum {
 #define VALUE_OPT_NUMERIC        'n'
 #define VALUE_OPT_OLD_RV         0x1001
 #define VALUE_OPT_PEERS          'p'
+#define VALUE_OPT_REFID          'r'
+
+typedef enum {
+    REFID_HASH, REFID_IPV4
+} te_Refid;
+#define OPT_REFID_VAL2STR(_v)    optionKeywordName(&DESC(REFID), (_v))
+#define OPT_VALUE_REFID          (DESC(REFID).optArg.argEnum)
 #define VALUE_OPT_WIDE           'w'
 /** option flag (value) for help-value option */
 #define VALUE_OPT_HELP          '?'
diff --git a/contrib/ntp/ntpq/ntpq-subs.c b/contrib/ntp/ntpq/ntpq-subs.c
index 8e70477..35caee2 100644
--- a/contrib/ntp/ntpq/ntpq-subs.c
+++ b/contrib/ntp/ntpq/ntpq-subs.c
@@ -1679,7 +1679,8 @@ doprintpeers(
 		} else if (!strcmp("hmode", name)) {
 			decodeint(value, &hmode);
 		} else if (!strcmp("refid", name)) {
-			if (pvl == peervarlist) {
+			if (   (pvl == peervarlist)
+			    && (drefid == REFID_IPV4)) {
 				have_da_rid = TRUE;
 				drlen = strlen(value);
 				if (0 == drlen) {
@@ -1700,7 +1701,9 @@ doprintpeers(
 				} else {
 					have_da_rid = FALSE;
 				}
-			} else if (pvl == apeervarlist) {
+			} else if (   (pvl == apeervarlist)
+				   || (pvl == peervarlist)) {
+				/* no need to check drefid == REFID_HASH */
 				have_da_rid = TRUE;
 				drlen = strlen(value);
 				if (0 == drlen) {
@@ -2030,15 +2033,19 @@ peers(
 	FILE *fp
 	)
 {
-	int af = 0;
+	if (drefid == REFID_HASH) {
+		apeers(pcmd, fp);
+	} else {
+		int af = 0;
 
-	if (pcmd->nargs == 1) {
-		if (pcmd->argval->ival == 6)
-			af = AF_INET6;
-		else
-			af = AF_INET;
+		if (pcmd->nargs == 1) {
+			if (pcmd->argval->ival == 6)
+				af = AF_INET6;
+			else
+				af = AF_INET;
+		}
+		dopeers(0, fp, af);
 	}
-	dopeers(0, fp, af);
 }
 
 
@@ -2244,6 +2251,10 @@ config (
  *    Longer lines will lead to unpredictable results.
  * 3. Since this function is sending a line at a time, we can't update
  *    the control key through the configuration file (YUCK!!)
+ *
+ * Pearly: There are a few places where 'size_t' is cast to 'int' based
+ * on the assumption that 'int' can hold the size of the involved
+ * buffers without overflow.
  */
 static void 
 config_from_file (
@@ -2254,6 +2265,7 @@ config_from_file (
 	u_short rstatus;
 	size_t rsize;
 	const char *rdata;
+	char * cp;
 	int res;
 	FILE *config_fd;
 	char config_cmd[MAXLINE];
@@ -2278,33 +2290,47 @@ config_from_file (
 	printf("Sending configuration file, one line at a time.\n");
 	i = 0;
 	while (fgets(config_cmd, MAXLINE, config_fd) != NULL) {
-		config_len = strlen(config_cmd);
-		/* ensure even the last line has newline, if possible */
-		if (config_len > 0 && 
-		    config_len + 2 < sizeof(config_cmd) &&
-		    '\n' != config_cmd[config_len - 1])
-			config_cmd[config_len++] = '\n';
+		/* Eliminate comments first. */
+		cp = strchr(config_cmd, '#');
+		config_len = (NULL != cp)
+		    ? (size_t)(cp - config_cmd)
+		    : strlen(config_cmd);
+		
+		/* [Bug 3015] make sure there's no trailing whitespace;
+		 * the fix for [Bug 2853] on the server side forbids
+		 * those. And don't transmit empty lines, as this would
+		 * just be waste.
+		 */
+		while (config_len != 0 &&
+		       (u_char)config_cmd[config_len-1] <= ' ')
+			--config_len;
+		config_cmd[config_len] = '\0';
+
 		++i;
+		if (0 == config_len)
+			continue;
+
 		retry_limit = 2;
 		do 
 			res = doquery(CTL_OP_CONFIGURE, 0, 1,
-				      strlen(config_cmd), config_cmd,
+				      config_len, config_cmd,
 				      &rstatus, &rsize, &rdata);
 		while (res != 0 && retry_limit--);
 		if (res != 0) {
-			printf("Line No: %d query failed: %s", i,
-			       config_cmd);
-			printf("Subsequent lines not sent.\n");
+			printf("Line No: %d query failed: %.*s\n"
+			       "Subsequent lines not sent.\n",
+			       i, (int)config_len, config_cmd);
 			fclose(config_fd);
 			return;
 		}
 
-		if (rsize > 0 && '\n' == rdata[rsize - 1])
-			rsize--;
-		if (rsize > 0 && '\r' == rdata[rsize - 1])
-			rsize--;
-		printf("Line No: %d %.*s: %s", i, (int)rsize, rdata, /* cast is wobbly */
-		       config_cmd);
+		/* Right-strip the result code string, then output the
+		 * last line executed, with result code. */
+		while (rsize != 0 && (u_char)rdata[rsize - 1] <= ' ')
+			--rsize;
+		printf("Line No: %d %.*s: %.*s\n", i,
+		       (int)rsize, rdata,
+		       (int)config_len, config_cmd);
 	}
 	printf("Done sending file\n");
 	fclose(config_fd);
diff --git a/contrib/ntp/ntpq/ntpq.1ntpqman b/contrib/ntp/ntpq/ntpq.1ntpqman
index b96d106..40f7afe 100644
--- a/contrib/ntp/ntpq/ntpq.1ntpqman
+++ b/contrib/ntp/ntpq/ntpq.1ntpqman
@@ -10,11 +10,11 @@
 .ds B-Font B
 .ds I-Font I
 .ds R-Font R
-.TH ntpq 1ntpqman "20 Jan 2016" "4.2.8p6" "User Commands"
+.TH ntpq 1ntpqman "26 Apr 2016" "4.2.8p7" "User Commands"
 .\"
-.\" EDIT THIS FILE WITH CAUTION (/tmp/.ag-Z7aWRV/ag-_7aOQV)
+.\" EDIT THIS FILE WITH CAUTION (/tmp/.ag-11aqEI/ag-c2aiDI)
 .\"
-.\" It has been AutoGen-ed January 20, 2016 at 04:19:06 AM by AutoGen 5.18.5
+.\" It has been AutoGen-ed April 26, 2016 at 08:29:35 PM by AutoGen 5.18.5
 .\" From the definitions ntpq-opts.def
 .\" and the template file agman-cmd.tpl
 .SH NAME
@@ -1347,6 +1347,27 @@ interactive.
 Print a list of the peers known to the server as well as a summary
 of their state. This is equivalent to the 'peers' interactive command.
 .TP
+.NOP \f\*[B-Font]\-r\f[] \f\*[I-Font]keyword\f[], \f\*[B-Font]\-\-refid\f[]=\f\*[I-Font]keyword\f[]
+Set default display type for S2+ refids.
+This option takes a keyword as its argument.  The argument sets an enumeration value that can
+be tested by comparing them against the option value macro.
+The available keywords are:
+.in +4
+.nf
+.na
+hash ipv4
+.fi
+or their numeric equivalent.
+.in -4
+.sp
+The default
+\f\*[I-Font]keyword\f[]
+for this option is:
+.ti +4
+ ipv4
+.sp
+Set the default display format for S2+ refids.
+.TP
 .NOP \f\*[B-Font]\-w\f[], \f\*[B-Font]\-\-wide\f[]
 Display the full 'remote' value.
 .sp
diff --git a/contrib/ntp/ntpq/ntpq.1ntpqmdoc b/contrib/ntp/ntpq/ntpq.1ntpqmdoc
index d4da8d7..7a7be52 100644
--- a/contrib/ntp/ntpq/ntpq.1ntpqmdoc
+++ b/contrib/ntp/ntpq/ntpq.1ntpqmdoc
@@ -1,9 +1,9 @@
-.Dd January 20 2016
+.Dd April 26 2016
 .Dt NTPQ 1ntpqmdoc User Commands
 .Os
 .\"  EDIT THIS FILE WITH CAUTION  (ntpq-opts.mdoc)
 .\"
-.\"  It has been AutoGen-ed  January 20, 2016 at 04:19:12 AM by AutoGen 5.18.5
+.\"  It has been AutoGen-ed  April 26, 2016 at 08:29:41 PM by AutoGen 5.18.5
 .\"  From the definitions    ntpq-opts.def
 .\"  and the template file   agmdoc-cmd.tpl
 .Sh NAME
@@ -898,6 +898,26 @@ interactive.
 .sp
 Print a list of the peers known to the server as well as a summary
 of their state. This is equivalent to the 'peers' interactive command.
+.It  Fl r Ar keyword , Fl \-refid Ns = Ns Ar keyword 
+Set default display type for S2+ refids.
+This option takes a keyword as its argument.  The argument sets an enumeration value that can
+be tested by comparing them against the option value macro.
+The available keywords are:
+.in +4
+.nf
+.na
+hash ipv4
+.fi
+or their numeric equivalent.
+.in -4
+.sp
+The default
+.Ar keyword
+for this option is:
+.ti +4
+ ipv4
+.sp
+Set the default display format for S2+ refids.
 .It  Fl w , Fl \-wide 
 Display the full 'remote' value.
 .sp
diff --git a/contrib/ntp/ntpq/ntpq.c b/contrib/ntp/ntpq/ntpq.c
index 1dcaeb7..3710375 100644
--- a/contrib/ntp/ntpq/ntpq.c
+++ b/contrib/ntp/ntpq/ntpq.c
@@ -38,7 +38,6 @@
 #include <ssl_applink.c>
 
 #include "ntp_libopts.h"
-#include "ntpq-opts.h"
 #include "safecast.h"
 
 #ifdef SYS_VXWORKS		/* vxWorks needs mode flag -casey*/
@@ -67,6 +66,11 @@ const char *prompt = "ntpq> ";	/* prompt to ask him about */
  */
 int	old_rv = 1;
 
+/*
+ * How should we display the refid?
+ * REFID_HASH, REFID_IPV4
+ */
+te_Refid drefid = -1;
 
 /*
  * for get_systime()
@@ -198,6 +202,7 @@ static	void	passwd		(struct parse *, FILE *);
 static	void	hostnames	(struct parse *, FILE *);
 static	void	setdebug	(struct parse *, FILE *);
 static	void	quit		(struct parse *, FILE *);
+static	void	showdrefid	(struct parse *, FILE *);
 static	void	version		(struct parse *, FILE *);
 static	void	raw		(struct parse *, FILE *);
 static	void	cooked		(struct parse *, FILE *);
@@ -269,6 +274,9 @@ struct xcmd builtins[] = {
 	{ "keyid",	keyid,		{ OPT|NTP_UINT, NO, NO, NO },
 	  { "key#", "", "", "" },
 	  "set keyid to use for authenticated requests" },
+	{ "drefid",	showdrefid,	{ OPT|NTP_STR, NO, NO, NO },
+	  { "hash|ipv4", "", "", "" },
+	  "display refid's as IPv4 or hash" },
 	{ "version",	version,	{ NO, NO, NO, NO },
 	  { "", "", "", "" },
 	  "print version number" },
@@ -532,6 +540,8 @@ ntpqmain(
 
 	old_rv = HAVE_OPT(OLD_RV);
 
+	drefid = OPT_VALUE_REFID;
+
 	if (0 == argc) {
 		ADDHOST(DEFHOST);
 	} else {
@@ -1327,7 +1337,7 @@ show_error_msg(
 	if (numhosts > 1)
 		fprintf(stderr, "server=%s ", currenthost);
 
-	switch(m6resp) {
+	switch (m6resp) {
 
 	case CERR_BADFMT:
 		fprintf(stderr,
@@ -2441,6 +2451,47 @@ ntp_poll(
 
 
 /*
+ * showdrefid2str - return a string explanation of the value of drefid
+ */
+static char *
+showdrefid2str(void)
+{
+	switch (drefid) {
+	    case REFID_HASH:
+	    	return "hash";
+	    case REFID_IPV4:
+	    	return "ipv4";
+	    default:
+	    	return "Unknown";
+	}
+}
+
+
+/*
+ * drefid - display/change "display hash" 
+ */
+static void
+showdrefid(
+	struct parse *pcmd,
+	FILE *fp
+	)
+{
+	if (pcmd->nargs == 0) {
+		(void) fprintf(fp, "drefid value is %s\n", showdrefid2str());
+		return;
+	} else if (STREQ(pcmd->argval[0].string, "hash")) {
+		drefid = REFID_HASH;
+	} else if (STREQ(pcmd->argval[0].string, "ipv4")) {
+		drefid = REFID_IPV4;
+	} else {
+		(void) fprintf(fp, "What?\n");
+		return;
+	}
+	(void) fprintf(fp, "drefid value set to %s\n", showdrefid2str());
+}
+
+
+/*
  * keyid - get a keyid to use for authenticating requests
  */
 static void
diff --git a/contrib/ntp/ntpq/ntpq.h b/contrib/ntp/ntpq/ntpq.h
index 55ea0fb..1f02915 100644
--- a/contrib/ntp/ntpq/ntpq.h
+++ b/contrib/ntp/ntpq/ntpq.h
@@ -13,6 +13,8 @@
 #include "ntp_control.h"
 #include "lib_strbuf.h"
 
+#include "ntpq-opts.h"
+
 /*
  * Maximum number of arguments
  */
@@ -126,6 +128,7 @@ extern chost	chosts[];
 
 extern int	interactive;	/* are we prompting? */
 extern int	old_rv;		/* use old rv behavior? --old-rv */
+extern te_Refid	drefid;		/* How should we display a refid? */
 extern u_int	assoc_cache_slots;/* count of allocated array entries */
 extern u_int	numassoc;	/* number of cached associations */
 extern u_int	numhosts;
diff --git a/contrib/ntp/ntpq/ntpq.html b/contrib/ntp/ntpq/ntpq.html
index 96df83d..24ef3d1 100644
--- a/contrib/ntp/ntpq/ntpq.html
+++ b/contrib/ntp/ntpq/ntpq.html
@@ -44,7 +44,7 @@ monitor the operational status
 and determine the performance of
 <code>ntpd</code>, the NTP daemon.
 
-  <p>This document applies to version 4.2.8p6 of <code>ntpq</code>.
+  <p>This document applies to version 4.2.8p7 of <code>ntpq</code>.
 
 <ul class="menu">
 <li><a accesskey="1" href="#ntpq-Description">ntpq Description</a>
@@ -744,7 +744,8 @@ This software is released under the NTP license, &lt;http://ntp.org/license&gt;.
 <li><a accesskey="6" href="#ntpq-numeric">ntpq numeric</a>:                 numeric option (-n)
 <li><a accesskey="7" href="#ntpq-old_002drv">ntpq old-rv</a>:                  old-rv option
 <li><a accesskey="8" href="#ntpq-peers">ntpq peers</a>:                   peers option (-p)
-<li><a accesskey="9" href="#ntpq-wide">ntpq wide</a>:                    wide option (-w)
+<li><a accesskey="9" href="#ntpq-refid">ntpq refid</a>:                   refid option (-r)
+<li><a href="#ntpq-wide">ntpq wide</a>:                    wide option (-w)
 <li><a href="#ntpq-config">ntpq config</a>:                  presetting/configuring ntpq
 <li><a href="#ntpq-exit-status">ntpq exit status</a>:             exit status
 </ul>
@@ -769,7 +770,7 @@ the usage text by passing it through a pager program.
 used to select the program, defaulting to <span class="file">more</span>.  Both will exit
 with a status code of 0.
 
-<pre class="example">ntpq - standard NTP query program - Ver. 4.2.8p5
+<pre class="example">ntpq - standard NTP query program - Ver. 4.2.8p6
 Usage:  ntpq [ -&lt;flag&gt; [&lt;val&gt;] | --&lt;name&gt;[{=| }&lt;val&gt;] ]... [ host ...]
   Flg Arg Option-Name    Description
    -4 no  ipv4           Force IPv4 DNS name resolution
@@ -790,6 +791,7 @@ Usage:  ntpq [ -&lt;flag&gt; [&lt;val&gt;] | --&lt;name&gt;[{=| }&lt;val&gt;] ].
       no  old-rv         Always output status line with readvar
    -p no  peers          Print a list of the peers
                                 - prohibits the option 'interactive'
+   -r KWd refid          Set default display type for S2+ refids
    -w no  wide           Display the full 'remote' value
       opt version        output version information and exit
    -? no  help           display extended usage information and exit
@@ -807,6 +809,10 @@ The following option preset mechanisms are supported:
  - reading file ./.ntprc
  - examining environment variables named NTPQ_*
 
+The valid "refid" option keywords are:
+  hash ipv4
+  or an integer from 0 through 1
+
 Please send bug reports to:  &lt;http://bugs.ntp.org, bugs@ntp.org&gt;
 </pre>
   <div class="node">
@@ -932,7 +938,7 @@ preset this option in a script will enable both older and
 newer <code>ntpq</code> to behave identically in this regard. 
 <div class="node">
 <p><hr>
-<a name="ntpq-peers"></a>Next:&nbsp;<a rel="next" accesskey="n" href="#ntpq-wide">ntpq wide</a>,
+<a name="ntpq-peers"></a>Next:&nbsp;<a rel="next" accesskey="n" href="#ntpq-refid">ntpq refid</a>,
 Previous:&nbsp;<a rel="previous" accesskey="p" href="#ntpq-old_002drv">ntpq old-rv</a>,
 Up:&nbsp;<a rel="up" accesskey="u" href="#ntpq-Invocation">ntpq Invocation</a>
 <br>
@@ -953,15 +959,39 @@ interactive.
 of their state. This is equivalent to the 'peers' interactive command. 
 <div class="node">
 <p><hr>
-<a name="ntpq-wide"></a>Next:&nbsp;<a rel="next" accesskey="n" href="#ntpq-config">ntpq config</a>,
+<a name="ntpq-refid"></a>Next:&nbsp;<a rel="next" accesskey="n" href="#ntpq-wide">ntpq wide</a>,
 Previous:&nbsp;<a rel="previous" accesskey="p" href="#ntpq-peers">ntpq peers</a>,
 Up:&nbsp;<a rel="up" accesskey="u" href="#ntpq-Invocation">ntpq Invocation</a>
 <br>
 </div>
 
+<h4 class="subsection">refid option (-r)</h4>
+
+<p><a name="index-ntpq_002drefid-11"></a>
+This is the &ldquo;set default display type for s2+ refids&rdquo; option. 
+This option takes a keyword argument.
+
+<p class="noindent">This option has some usage constraints.  It:
+     <ul>
+<li>This option takes a keyword as its argument. 
+The argument sets an enumeration value that can be tested by comparing the option value macro (OPT_VALUE_REFID). 
+The available keywords are:
+     <pre class="example">             hash ipv4
+    </pre>
+     <p>or their numeric equivalent.</ul>
+
+  <p>Set the default display format for S2+ refids. 
+<div class="node">
+<p><hr>
+<a name="ntpq-wide"></a>Next:&nbsp;<a rel="next" accesskey="n" href="#ntpq-config">ntpq config</a>,
+Previous:&nbsp;<a rel="previous" accesskey="p" href="#ntpq-refid">ntpq refid</a>,
+Up:&nbsp;<a rel="up" accesskey="u" href="#ntpq-Invocation">ntpq Invocation</a>
+<br>
+</div>
+
 <h4 class="subsection">wide option (-w)</h4>
 
-<p><a name="index-ntpq_002dwide-11"></a>
+<p><a name="index-ntpq_002dwide-12"></a>
 This is the &ldquo;display the full 'remote' value&rdquo; option. 
 Display the full value of the 'remote' value.  If this requires
 more than 15 characters, display the full value, emit a newline,
diff --git a/contrib/ntp/ntpq/ntpq.man.in b/contrib/ntp/ntpq/ntpq.man.in
index abe2608..bf74a50 100644
--- a/contrib/ntp/ntpq/ntpq.man.in
+++ b/contrib/ntp/ntpq/ntpq.man.in
@@ -10,11 +10,11 @@
 .ds B-Font B
 .ds I-Font I
 .ds R-Font R
-.TH ntpq @NTPQ_MS@ "20 Jan 2016" "4.2.8p6" "User Commands"
+.TH ntpq @NTPQ_MS@ "26 Apr 2016" "4.2.8p7" "User Commands"
 .\"
-.\" EDIT THIS FILE WITH CAUTION (/tmp/.ag-Z7aWRV/ag-_7aOQV)
+.\" EDIT THIS FILE WITH CAUTION (/tmp/.ag-11aqEI/ag-c2aiDI)
 .\"
-.\" It has been AutoGen-ed January 20, 2016 at 04:19:06 AM by AutoGen 5.18.5
+.\" It has been AutoGen-ed April 26, 2016 at 08:29:35 PM by AutoGen 5.18.5
 .\" From the definitions ntpq-opts.def
 .\" and the template file agman-cmd.tpl
 .SH NAME
@@ -1347,6 +1347,27 @@ interactive.
 Print a list of the peers known to the server as well as a summary
 of their state. This is equivalent to the 'peers' interactive command.
 .TP
+.NOP \f\*[B-Font]\-r\f[] \f\*[I-Font]keyword\f[], \f\*[B-Font]\-\-refid\f[]=\f\*[I-Font]keyword\f[]
+Set default display type for S2+ refids.
+This option takes a keyword as its argument.  The argument sets an enumeration value that can
+be tested by comparing them against the option value macro.
+The available keywords are:
+.in +4
+.nf
+.na
+hash ipv4
+.fi
+or their numeric equivalent.
+.in -4
+.sp
+The default
+\f\*[I-Font]keyword\f[]
+for this option is:
+.ti +4
+ ipv4
+.sp
+Set the default display format for S2+ refids.
+.TP
 .NOP \f\*[B-Font]\-w\f[], \f\*[B-Font]\-\-wide\f[]
 Display the full 'remote' value.
 .sp
diff --git a/contrib/ntp/ntpq/ntpq.mdoc.in b/contrib/ntp/ntpq/ntpq.mdoc.in
index d71c508..6cf0cc4 100644
--- a/contrib/ntp/ntpq/ntpq.mdoc.in
+++ b/contrib/ntp/ntpq/ntpq.mdoc.in
@@ -1,9 +1,9 @@
-.Dd January 20 2016
+.Dd April 26 2016
 .Dt NTPQ @NTPQ_MS@ User Commands
 .Os
 .\"  EDIT THIS FILE WITH CAUTION  (ntpq-opts.mdoc)
 .\"
-.\"  It has been AutoGen-ed  January 20, 2016 at 04:19:12 AM by AutoGen 5.18.5
+.\"  It has been AutoGen-ed  April 26, 2016 at 08:29:41 PM by AutoGen 5.18.5
 .\"  From the definitions    ntpq-opts.def
 .\"  and the template file   agmdoc-cmd.tpl
 .Sh NAME
@@ -898,6 +898,26 @@ interactive.
 .sp
 Print a list of the peers known to the server as well as a summary
 of their state. This is equivalent to the 'peers' interactive command.
+.It  Fl r Ar keyword , Fl \-refid Ns = Ns Ar keyword 
+Set default display type for S2+ refids.
+This option takes a keyword as its argument.  The argument sets an enumeration value that can
+be tested by comparing them against the option value macro.
+The available keywords are:
+.in +4
+.nf
+.na
+hash ipv4
+.fi
+or their numeric equivalent.
+.in -4
+.sp
+The default
+.Ar keyword
+for this option is:
+.ti +4
+ ipv4
+.sp
+Set the default display format for S2+ refids.
 .It  Fl w , Fl \-wide 
 Display the full 'remote' value.
 .sp