Virgin import of ntpd 4.2.0

11 files changed, 2521 insertions, 186 deletions

diff --git a/contrib/ntp/util/Makefile.am b/contrib/ntp/util/Makefile.am
index d9a85f3..8f1ba9e 100644
--- a/contrib/ntp/util/Makefile.am
+++ b/contrib/ntp/util/Makefile.am
@@ -1,18 +1,16 @@
 #AUTOMAKE_OPTIONS = ../ansi2knr no-dependencies
-AUTOMAKE_OPTIONS = ansi2knr
-bin_PROGRAMS = @MAKE_NTPTIME@ @MAKE_TICKADJ@ @MAKE_TIMETRIM@ ntp-genkeys
-EXTRA_PROGRAMS = byteorder hist jitter kern longsize ntptime \
-precision sht testrs6000 tickadj timetrim
+AUTOMAKE_OPTIONS=	ansi2knr
+bin_PROGRAMS=	@MAKE_NTPTIME@ @MAKE_TICKADJ@ @MAKE_TIMETRIM@ @MAKE_NTP_KEYGEN@
+EXTRA_PROGRAMS=	audio-pcm byteorder hist jitter kern longsize \
+	ntp-keygen ntptime pps-api precision sht testrs6000 tickadj timetrim
 
-ntp_genkeys_LDADD = ../ntpd/ntp_config$U.o ../libntp/libntp.a $(LIBRSAREF)
-ntp_genkeys_DEPENDENCIES = ../ntpd/ntp_config$U.o ../libntp/libntp.a $(LIBRSAREF)
-
-INCLUDES = -I$(top_srcdir)/include -I$(top_srcdir)/librsaref
+INCLUDES=	-I$(top_srcdir)/include
 # LDADD might need RESLIB and ADJLIB
-LDADD =	../libntp/libntp.a
-#EXTRA_DIST = README TAGS
-EXTRA_DIST = 
-ETAGS_ARGS = Makefile.am
+LDADD=		../libntp/libntp.a
+ntp_keygen_LDADD=	@LCRYPTO@
+#EXTRA_DIST=	README TAGS
+EXTRA_DIST=
+ETAGS_ARGS=	Makefile.am
 
 ../libntp/libntp.a:
 	cd ../libntp && $(MAKE)
diff --git a/contrib/ntp/util/Makefile.in b/contrib/ntp/util/Makefile.in
index f05b7a5..50b3042 100644
--- a/contrib/ntp/util/Makefile.in
+++ b/contrib/ntp/util/Makefile.in
@@ -1,6 +1,7 @@
-# Makefile.in generated automatically by automake 1.5 from Makefile.am.
+# Makefile.in generated by automake 1.7.7 from Makefile.am.
+# @configure_input@
 
-# Copyright 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001
+# Copyright 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003
 # Free Software Foundation, Inc.
 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -13,82 +14,79 @@
 
 @SET_MAKE@
 
-#AUTOMAKE_OPTIONS = ../ansi2knr no-dependencies
-
-SHELL = @SHELL@
-
 srcdir = @srcdir@
 top_srcdir = @top_srcdir@
 VPATH = @srcdir@
-prefix = @prefix@
-exec_prefix = @exec_prefix@
-
-bindir = @bindir@
-sbindir = @sbindir@
-libexecdir = @libexecdir@
-datadir = @datadir@
-sysconfdir = @sysconfdir@
-sharedstatedir = @sharedstatedir@
-localstatedir = @localstatedir@
-libdir = @libdir@
-infodir = @infodir@
-mandir = @mandir@
-includedir = @includedir@
-oldincludedir = /usr/include
 pkgdatadir = $(datadir)/@PACKAGE@
 pkglibdir = $(libdir)/@PACKAGE@
 pkgincludedir = $(includedir)/@PACKAGE@
 top_builddir = ..
 
-ACLOCAL = @ACLOCAL@
-AUTOCONF = @AUTOCONF@
-AUTOMAKE = @AUTOMAKE@
-AUTOHEADER = @AUTOHEADER@
-
+am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
 INSTALL = @INSTALL@
-INSTALL_PROGRAM = @INSTALL_PROGRAM@
-INSTALL_DATA = @INSTALL_DATA@
-INSTALL_SCRIPT = @INSTALL_SCRIPT@
+install_sh_DATA = $(install_sh) -c -m 644
+install_sh_PROGRAM = $(install_sh) -c
+install_sh_SCRIPT = $(install_sh) -c
 INSTALL_HEADER = $(INSTALL_DATA)
-transform = @program_transform_name@
+transform = $(program_transform_name)
 NORMAL_INSTALL = :
 PRE_INSTALL = :
 POST_INSTALL = :
 NORMAL_UNINSTALL = :
 PRE_UNINSTALL = :
 POST_UNINSTALL = :
-build_alias = @build_alias@
 build_triplet = @build@
-host_alias = @host_alias@
 host_triplet = @host@
-target_alias = @target_alias@
 target_triplet = @target@
+ACLOCAL = @ACLOCAL@
+AMDEP_FALSE = @AMDEP_FALSE@
+AMDEP_TRUE = @AMDEP_TRUE@
 AMTAR = @AMTAR@
-AUTOKEY = @AUTOKEY@
+ARLIB_DIR = @ARLIB_DIR@
+AUTOCONF = @AUTOCONF@
+AUTOHEADER = @AUTOHEADER@
+AUTOMAKE = @AUTOMAKE@
 AWK = @AWK@
 CC = @CC@
+CCDEPMODE = @CCDEPMODE@
 CFLAGS = @CFLAGS@
 CHUTEST = @CHUTEST@
 CLKTEST = @CLKTEST@
 CPP = @CPP@
+CPPFLAGS = @CPPFLAGS@
+CYGPATH_W = @CYGPATH_W@
 DCFD = @DCFD@
+DEFS = @DEFS@
 DEPDIR = @DEPDIR@
+ECHO_C = @ECHO_C@
+ECHO_N = @ECHO_N@
+ECHO_T = @ECHO_T@
 EF_LIBS = @EF_LIBS@
 EF_PROGS = @EF_PROGS@
+EGREP = @EGREP@
 EXEEXT = @EXEEXT@
+INSTALL_DATA = @INSTALL_DATA@
+INSTALL_PROGRAM = @INSTALL_PROGRAM@
+INSTALL_SCRIPT = @INSTALL_SCRIPT@
 INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
+LCRYPTO = @LCRYPTO@
 LDFLAGS = @LDFLAGS@
+LIBOBJS = @LIBOBJS@
 LIBPARSE = @LIBPARSE@
-LIBRSAREF = @LIBRSAREF@
+LIBS = @LIBS@
 LN_S = @LN_S@
+LTLIBOBJS = @LTLIBOBJS@
+MAKEINFO = @MAKEINFO@
 MAKE_ADJTIMED = @MAKE_ADJTIMED@
 MAKE_CHECK_Y2K = @MAKE_CHECK_Y2K@
+MAKE_LIBNTPSIM = @MAKE_LIBNTPSIM@
 MAKE_LIBPARSE = @MAKE_LIBPARSE@
 MAKE_LIBPARSE_KERNEL = @MAKE_LIBPARSE_KERNEL@
-MAKE_LIBRSAREF = @MAKE_LIBRSAREF@
+MAKE_NTPDSIM = @MAKE_NTPDSIM@
 MAKE_NTPTIME = @MAKE_NTPTIME@
-MAKE_NTP_GENKEYS = @MAKE_NTP_GENKEYS@
+MAKE_NTP_KEYGEN = @MAKE_NTP_KEYGEN@
 MAKE_PARSEKMODULE = @MAKE_PARSEKMODULE@
+MAKE_SNTP = @MAKE_SNTP@
 MAKE_TICKADJ = @MAKE_TICKADJ@
 MAKE_TIMETRIM = @MAKE_TIMETRIM@
 OBJEXT = @OBJEXT@
@@ -96,48 +94,97 @@ OPENSSL = @OPENSSL@
 OPENSSL_INC = @OPENSSL_INC@
 OPENSSL_LIB = @OPENSSL_LIB@
 PACKAGE = @PACKAGE@
+PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
+PACKAGE_NAME = @PACKAGE_NAME@
+PACKAGE_STRING = @PACKAGE_STRING@
+PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_VERSION = @PACKAGE_VERSION@
 PATH_PERL = @PATH_PERL@
+PATH_SEPARATOR = @PATH_SEPARATOR@
 PATH_SH = @PATH_SH@
 PROPDELAY = @PROPDELAY@
 RANLIB = @RANLIB@
-RSADIR = @RSADIR@
-RSAOBJS = @RSAOBJS@
-RSAREF = @RSAREF@
-RSASRCS = @RSASRCS@
+READLINE_LIBS = @READLINE_LIBS@
+SET_MAKE = @SET_MAKE@
+SHELL = @SHELL@
+STRIP = @STRIP@
 TESTDCF = @TESTDCF@
 U = @U@
 VERSION = @VERSION@
+ac_ct_CC = @ac_ct_CC@
+ac_ct_RANLIB = @ac_ct_RANLIB@
+ac_ct_STRIP = @ac_ct_STRIP@
+am__fastdepCC_FALSE = @am__fastdepCC_FALSE@
+am__fastdepCC_TRUE = @am__fastdepCC_TRUE@
 am__include = @am__include@
+am__leading_dot = @am__leading_dot@
 am__quote = @am__quote@
+bindir = @bindir@
+build = @build@
+build_alias = @build_alias@
+build_cpu = @build_cpu@
+build_os = @build_os@
+build_vendor = @build_vendor@
+datadir = @datadir@
+exec_prefix = @exec_prefix@
+host = @host@
+host_alias = @host_alias@
+host_cpu = @host_cpu@
+host_os = @host_os@
+host_vendor = @host_vendor@
+includedir = @includedir@
+infodir = @infodir@
 install_sh = @install_sh@
+libdir = @libdir@
+libexecdir = @libexecdir@
+localstatedir = @localstatedir@
+mandir = @mandir@
+oldincludedir = @oldincludedir@
+prefix = @prefix@
+program_transform_name = @program_transform_name@
+sbindir = @sbindir@
+sharedstatedir = @sharedstatedir@
+subdirs = @subdirs@
+sysconfdir = @sysconfdir@
+target = @target@
+target_alias = @target_alias@
+target_cpu = @target_cpu@
+target_os = @target_os@
+target_vendor = @target_vendor@
 
+#AUTOMAKE_OPTIONS = ../ansi2knr no-dependencies
 AUTOMAKE_OPTIONS = ansi2knr
-bin_PROGRAMS = @MAKE_NTPTIME@ @MAKE_TICKADJ@ @MAKE_TIMETRIM@ ntp-genkeys
-EXTRA_PROGRAMS = byteorder hist jitter kern longsize ntptime \
-precision sht testrs6000 tickadj timetrim
+bin_PROGRAMS = @MAKE_NTPTIME@ @MAKE_TICKADJ@ @MAKE_TIMETRIM@ @MAKE_NTP_KEYGEN@
+EXTRA_PROGRAMS = audio-pcm byteorder hist jitter kern longsize \
+	ntp-keygen ntptime pps-api precision sht testrs6000 tickadj timetrim
 
 
-ntp_genkeys_LDADD = ../ntpd/ntp_config$U.o ../libntp/libntp.a $(LIBRSAREF)
-ntp_genkeys_DEPENDENCIES = ../ntpd/ntp_config$U.o ../libntp/libntp.a $(LIBRSAREF)
-
-INCLUDES = -I$(top_srcdir)/include -I$(top_srcdir)/librsaref
+INCLUDES = -I$(top_srcdir)/include
 # LDADD might need RESLIB and ADJLIB
 LDADD = ../libntp/libntp.a
-#EXTRA_DIST = README TAGS
+ntp_keygen_LDADD = @LCRYPTO@
+#EXTRA_DIST=	README TAGS
 EXTRA_DIST = 
 ETAGS_ARGS = Makefile.am
 subdir = util
+ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
 mkinstalldirs = $(SHELL) $(top_srcdir)/mkinstalldirs
 CONFIG_HEADER = $(top_builddir)/config.h
 CONFIG_CLEAN_FILES =
-EXTRA_PROGRAMS = byteorder$(EXEEXT) hist$(EXEEXT) jitter$(EXEEXT) \
-	kern$(EXEEXT) longsize$(EXEEXT) ntptime$(EXEEXT) \
+EXTRA_PROGRAMS = audio-pcm$(EXEEXT) byteorder$(EXEEXT) hist$(EXEEXT) \
+	jitter$(EXEEXT) kern$(EXEEXT) longsize$(EXEEXT) \
+	ntp-keygen$(EXEEXT) ntptime$(EXEEXT) pps-api$(EXEEXT) \
 	precision$(EXEEXT) sht$(EXEEXT) testrs6000$(EXEEXT) \
 	tickadj$(EXEEXT) timetrim$(EXEEXT)
 bin_PROGRAMS = @MAKE_NTPTIME@ @MAKE_TICKADJ@ @MAKE_TIMETRIM@ \
-	ntp-genkeys$(EXEEXT)
+	@MAKE_NTP_KEYGEN@
 PROGRAMS = $(bin_PROGRAMS)
 
+audio_pcm_SOURCES = audio-pcm.c
+audio_pcm_OBJECTS = audio-pcm$U.$(OBJEXT)
+audio_pcm_LDADD = $(LDADD)
+audio_pcm_DEPENDENCIES = ../libntp/libntp.a
+audio_pcm_LDFLAGS =
 byteorder_SOURCES = byteorder.c
 byteorder_OBJECTS = byteorder$U.$(OBJEXT)
 byteorder_LDADD = $(LDADD)
@@ -163,14 +210,20 @@ longsize_OBJECTS = longsize$U.$(OBJEXT)
 longsize_LDADD = $(LDADD)
 longsize_DEPENDENCIES = ../libntp/libntp.a
 longsize_LDFLAGS =
-ntp_genkeys_SOURCES = ntp-genkeys.c
-ntp_genkeys_OBJECTS = ntp-genkeys$U.$(OBJEXT)
-ntp_genkeys_LDFLAGS =
+ntp_keygen_SOURCES = ntp-keygen.c
+ntp_keygen_OBJECTS = ntp-keygen$U.$(OBJEXT)
+ntp_keygen_DEPENDENCIES =
+ntp_keygen_LDFLAGS =
 ntptime_SOURCES = ntptime.c
 ntptime_OBJECTS = ntptime$U.$(OBJEXT)
 ntptime_LDADD = $(LDADD)
 ntptime_DEPENDENCIES = ../libntp/libntp.a
 ntptime_LDFLAGS =
+pps_api_SOURCES = pps-api.c
+pps_api_OBJECTS = pps-api$U.$(OBJEXT)
+pps_api_LDADD = $(LDADD)
+pps_api_DEPENDENCIES = ../libntp/libntp.a
+pps_api_LDFLAGS =
 precision_SOURCES = precision.c
 precision_OBJECTS = precision$U.$(OBJEXT)
 precision_LDADD = $(LDADD)
@@ -197,27 +250,28 @@ timetrim_LDADD = $(LDADD)
 timetrim_DEPENDENCIES = ../libntp/libntp.a
 timetrim_LDFLAGS =
 
-DEFS = @DEFS@
 DEFAULT_INCLUDES =  -I. -I$(srcdir) -I$(top_builddir)
-CPPFLAGS = @CPPFLAGS@
-LDFLAGS = @LDFLAGS@
-LIBS = @LIBS@
 depcomp = $(SHELL) $(top_srcdir)/depcomp
-@AMDEP_TRUE@DEP_FILES = $(DEPDIR)/byteorder$U.Po $(DEPDIR)/hist$U.Po \
-@AMDEP_TRUE@	$(DEPDIR)/jitter$U.Po $(DEPDIR)/kern$U.Po \
-@AMDEP_TRUE@	$(DEPDIR)/longsize$U.Po $(DEPDIR)/ntp-genkeys$U.Po \
-@AMDEP_TRUE@	$(DEPDIR)/ntptime$U.Po $(DEPDIR)/precision$U.Po \
-@AMDEP_TRUE@	$(DEPDIR)/sht$U.Po $(DEPDIR)/testrs6000$U.Po \
-@AMDEP_TRUE@	$(DEPDIR)/tickadj$U.Po $(DEPDIR)/timetrim$U.Po
+am__depfiles_maybe = depfiles
+@AMDEP_TRUE@DEP_FILES = ./$(DEPDIR)/audio-pcm$U.Po \
+@AMDEP_TRUE@	./$(DEPDIR)/byteorder$U.Po ./$(DEPDIR)/hist$U.Po \
+@AMDEP_TRUE@	./$(DEPDIR)/jitter$U.Po ./$(DEPDIR)/kern$U.Po \
+@AMDEP_TRUE@	./$(DEPDIR)/longsize$U.Po \
+@AMDEP_TRUE@	./$(DEPDIR)/ntp-keygen$U.Po \
+@AMDEP_TRUE@	./$(DEPDIR)/ntptime$U.Po ./$(DEPDIR)/pps-api$U.Po \
+@AMDEP_TRUE@	./$(DEPDIR)/precision$U.Po ./$(DEPDIR)/sht$U.Po \
+@AMDEP_TRUE@	./$(DEPDIR)/testrs6000$U.Po \
+@AMDEP_TRUE@	./$(DEPDIR)/tickadj$U.Po ./$(DEPDIR)/timetrim$U.Po
 COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
 	$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
 CCLD = $(CC)
 LINK = $(CCLD) $(AM_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) $(LDFLAGS) -o $@
-DIST_SOURCES = byteorder.c hist.c jitter.c kern.c longsize.c \
-	ntp-genkeys.c ntptime.c precision.c sht.c testrs6000.c \
+DIST_SOURCES = audio-pcm.c byteorder.c hist.c jitter.c kern.c longsize.c \
+	ntp-keygen.c ntptime.c pps-api.c precision.c sht.c testrs6000.c \
 	tickadj.c timetrim.c
-DIST_COMMON = README Makefile.am Makefile.in ansi2knr.1 ansi2knr.c
-SOURCES = byteorder.c hist.c jitter.c kern.c longsize.c ntp-genkeys.c ntptime.c precision.c sht.c testrs6000.c tickadj.c timetrim.c
+DIST_COMMON = README $(srcdir)/Makefile.in Makefile.am ansi2knr.1 \
+	ansi2knr.c
+SOURCES = audio-pcm.c byteorder.c hist.c jitter.c kern.c longsize.c ntp-keygen.c ntptime.c pps-api.c precision.c sht.c testrs6000.c tickadj.c timetrim.c
 
 all: all-am
 
@@ -227,9 +281,8 @@ $(srcdir)/Makefile.in:  Makefile.am  $(top_srcdir)/configure.in $(ACLOCAL_M4)
 	cd $(top_srcdir) && \
 	  $(AUTOMAKE) --gnu  util/Makefile
 Makefile:  $(srcdir)/Makefile.in  $(top_builddir)/config.status
-	cd $(top_builddir) && \
-	  CONFIG_HEADERS= CONFIG_LINKS= \
-	  CONFIG_FILES=$(subdir)/$@ $(SHELL) ./config.status
+	cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)
+binPROGRAMS_INSTALL = $(INSTALL_PROGRAM)
 install-binPROGRAMS: $(bin_PROGRAMS)
 	@$(NORMAL_INSTALL)
 	$(mkinstalldirs) $(DESTDIR)$(bindir)
@@ -237,22 +290,25 @@ install-binPROGRAMS: $(bin_PROGRAMS)
 	  p1=`echo $$p|sed 's/$(EXEEXT)$$//'`; \
 	  if test -f $$p \
 	  ; then \
-	    f=`echo $$p1|sed '$(transform);s/$$/$(EXEEXT)/'`; \
-	   echo " $(INSTALL_PROGRAM_ENV) $(INSTALL_PROGRAM) $$p $(DESTDIR)$(bindir)/$$f"; \
-	   $(INSTALL_PROGRAM_ENV) $(INSTALL_PROGRAM) $$p $(DESTDIR)$(bindir)/$$f; \
+	    f=`echo "$$p1" | sed 's,^.*/,,;$(transform);s/$$/$(EXEEXT)/'`; \
+	   echo " $(INSTALL_PROGRAM_ENV) $(binPROGRAMS_INSTALL) $$p $(DESTDIR)$(bindir)/$$f"; \
+	   $(INSTALL_PROGRAM_ENV) $(binPROGRAMS_INSTALL) $$p $(DESTDIR)$(bindir)/$$f || exit 1; \
 	  else :; fi; \
 	done
 
 uninstall-binPROGRAMS:
 	@$(NORMAL_UNINSTALL)
 	@list='$(bin_PROGRAMS)'; for p in $$list; do \
-	  f=`echo $$p|sed 's/$(EXEEXT)$$//;$(transform);s/$$/$(EXEEXT)/'`; \
+	  f=`echo "$$p" | sed 's,^.*/,,;s/$(EXEEXT)$$//;$(transform);s/$$/$(EXEEXT)/'`; \
 	  echo " rm -f $(DESTDIR)$(bindir)/$$f"; \
 	  rm -f $(DESTDIR)$(bindir)/$$f; \
 	done
 
 clean-binPROGRAMS:
 	-test -z "$(bin_PROGRAMS)" || rm -f $(bin_PROGRAMS)
+audio-pcm$(EXEEXT): $(audio_pcm_OBJECTS) $(audio_pcm_DEPENDENCIES) 
+	@rm -f audio-pcm$(EXEEXT)
+	$(LINK) $(audio_pcm_LDFLAGS) $(audio_pcm_OBJECTS) $(audio_pcm_LDADD) $(LIBS)
 byteorder$(EXEEXT): $(byteorder_OBJECTS) $(byteorder_DEPENDENCIES) 
 	@rm -f byteorder$(EXEEXT)
 	$(LINK) $(byteorder_LDFLAGS) $(byteorder_OBJECTS) $(byteorder_LDADD) $(LIBS)
@@ -268,12 +324,15 @@ kern$(EXEEXT): $(kern_OBJECTS) $(kern_DEPENDENCIES)
 longsize$(EXEEXT): $(longsize_OBJECTS) $(longsize_DEPENDENCIES) 
 	@rm -f longsize$(EXEEXT)
 	$(LINK) $(longsize_LDFLAGS) $(longsize_OBJECTS) $(longsize_LDADD) $(LIBS)
-ntp-genkeys$(EXEEXT): $(ntp_genkeys_OBJECTS) $(ntp_genkeys_DEPENDENCIES) 
-	@rm -f ntp-genkeys$(EXEEXT)
-	$(LINK) $(ntp_genkeys_LDFLAGS) $(ntp_genkeys_OBJECTS) $(ntp_genkeys_LDADD) $(LIBS)
+ntp-keygen$(EXEEXT): $(ntp_keygen_OBJECTS) $(ntp_keygen_DEPENDENCIES) 
+	@rm -f ntp-keygen$(EXEEXT)
+	$(LINK) $(ntp_keygen_LDFLAGS) $(ntp_keygen_OBJECTS) $(ntp_keygen_LDADD) $(LIBS)
 ntptime$(EXEEXT): $(ntptime_OBJECTS) $(ntptime_DEPENDENCIES) 
 	@rm -f ntptime$(EXEEXT)
 	$(LINK) $(ntptime_LDFLAGS) $(ntptime_OBJECTS) $(ntptime_LDADD) $(LIBS)
+pps-api$(EXEEXT): $(pps_api_OBJECTS) $(pps_api_DEPENDENCIES) 
+	@rm -f pps-api$(EXEEXT)
+	$(LINK) $(pps_api_LDFLAGS) $(pps_api_OBJECTS) $(pps_api_LDADD) $(LIBS)
 precision$(EXEEXT): $(precision_OBJECTS) $(precision_DEPENDENCIES) 
 	@rm -f precision$(EXEEXT)
 	$(LINK) $(precision_LDFLAGS) $(precision_OBJECTS) $(precision_LDADD) $(LIBS)
@@ -305,113 +364,158 @@ clean-krextra:
 	-rm -f ansi2knr
 
 mostlyclean-kr:
-	-rm -f *_.c
-
-@AMDEP_TRUE@@am__include@ @am__quote@$(DEPDIR)/byteorder$U.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@$(DEPDIR)/hist$U.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@$(DEPDIR)/jitter$U.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@$(DEPDIR)/kern$U.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@$(DEPDIR)/longsize$U.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@$(DEPDIR)/ntp-genkeys$U.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@$(DEPDIR)/ntptime$U.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@$(DEPDIR)/precision$U.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@$(DEPDIR)/sht$U.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@$(DEPDIR)/testrs6000$U.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@$(DEPDIR)/tickadj$U.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@$(DEPDIR)/timetrim$U.Po@am__quote@
-
-distclean-depend:
-	-rm -rf $(DEPDIR)
+	-test "$U" = "" || rm -f *_.c
+
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/audio-pcm$U.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/byteorder$U.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/hist$U.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/jitter$U.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/kern$U.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/longsize$U.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ntp-keygen$U.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ntptime$U.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pps-api$U.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/precision$U.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/sht$U.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/testrs6000$U.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/tickadj$U.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/timetrim$U.Po@am__quote@
 
 .c.o:
-@AMDEP_TRUE@	source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
-@AMDEP_TRUE@	depfile='$(DEPDIR)/$*.Po' tmpdepfile='$(DEPDIR)/$*.TPo' @AMDEPBACKSLASH@
-@AMDEP_TRUE@	$(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-	$(COMPILE) -c `test -f $< || echo '$(srcdir)/'`$<
+@am__fastdepCC_TRUE@	if $(COMPILE) -MT $@ -MD -MP -MF "$(DEPDIR)/$*.Tpo" \
+@am__fastdepCC_TRUE@	  -c -o $@ `test -f '$<' || echo '$(srcdir)/'`$<; \
+@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/$*.Tpo" "$(DEPDIR)/$*.Po"; \
+@am__fastdepCC_TRUE@	else rm -f "$(DEPDIR)/$*.Tpo"; exit 1; \
+@am__fastdepCC_TRUE@	fi
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	depfile='$(DEPDIR)/$*.Po' tmpdepfile='$(DEPDIR)/$*.TPo' @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(COMPILE) -c `test -f '$<' || echo '$(srcdir)/'`$<
 
 .c.obj:
-@AMDEP_TRUE@	source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
-@AMDEP_TRUE@	depfile='$(DEPDIR)/$*.Po' tmpdepfile='$(DEPDIR)/$*.TPo' @AMDEPBACKSLASH@
-@AMDEP_TRUE@	$(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-	$(COMPILE) -c `cygpath -w $<`
-CCDEPMODE = @CCDEPMODE@
+@am__fastdepCC_TRUE@	if $(COMPILE) -MT $@ -MD -MP -MF "$(DEPDIR)/$*.Tpo" \
+@am__fastdepCC_TRUE@	  -c -o $@ `if test -f '$<'; then $(CYGPATH_W) '$<'; else $(CYGPATH_W) '$(srcdir)/$<'; fi`; \
+@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/$*.Tpo" "$(DEPDIR)/$*.Po"; \
+@am__fastdepCC_TRUE@	else rm -f "$(DEPDIR)/$*.Tpo"; exit 1; \
+@am__fastdepCC_TRUE@	fi
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	depfile='$(DEPDIR)/$*.Po' tmpdepfile='$(DEPDIR)/$*.TPo' @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(COMPILE) -c `if test -f '$<'; then $(CYGPATH_W) '$<'; else $(CYGPATH_W) '$(srcdir)/$<'; fi`
+audio-pcm_.c: audio-pcm.c $(ANSI2KNR)
+	$(CPP) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) `if test -f $(srcdir)/audio-pcm.c; then echo $(srcdir)/audio-pcm.c; else echo audio-pcm.c; fi` | sed 's/^# \([0-9]\)/#line \1/' | $(ANSI2KNR) > $@ || rm -f $@
 byteorder_.c: byteorder.c $(ANSI2KNR)
-	$(CPP) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) `if test -f $(srcdir)/byteorder.c; then echo $(srcdir)/byteorder.c; else echo byteorder.c; fi` | sed 's/^# \([0-9]\)/#line \1/' | $(ANSI2KNR) > byteorder_.c || rm -f byteorder_.c
+	$(CPP) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) `if test -f $(srcdir)/byteorder.c; then echo $(srcdir)/byteorder.c; else echo byteorder.c; fi` | sed 's/^# \([0-9]\)/#line \1/' | $(ANSI2KNR) > $@ || rm -f $@
 hist_.c: hist.c $(ANSI2KNR)
-	$(CPP) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) `if test -f $(srcdir)/hist.c; then echo $(srcdir)/hist.c; else echo hist.c; fi` | sed 's/^# \([0-9]\)/#line \1/' | $(ANSI2KNR) > hist_.c || rm -f hist_.c
+	$(CPP) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) `if test -f $(srcdir)/hist.c; then echo $(srcdir)/hist.c; else echo hist.c; fi` | sed 's/^# \([0-9]\)/#line \1/' | $(ANSI2KNR) > $@ || rm -f $@
 jitter_.c: jitter.c $(ANSI2KNR)
-	$(CPP) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) `if test -f $(srcdir)/jitter.c; then echo $(srcdir)/jitter.c; else echo jitter.c; fi` | sed 's/^# \([0-9]\)/#line \1/' | $(ANSI2KNR) > jitter_.c || rm -f jitter_.c
+	$(CPP) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) `if test -f $(srcdir)/jitter.c; then echo $(srcdir)/jitter.c; else echo jitter.c; fi` | sed 's/^# \([0-9]\)/#line \1/' | $(ANSI2KNR) > $@ || rm -f $@
 kern_.c: kern.c $(ANSI2KNR)
-	$(CPP) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) `if test -f $(srcdir)/kern.c; then echo $(srcdir)/kern.c; else echo kern.c; fi` | sed 's/^# \([0-9]\)/#line \1/' | $(ANSI2KNR) > kern_.c || rm -f kern_.c
+	$(CPP) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) `if test -f $(srcdir)/kern.c; then echo $(srcdir)/kern.c; else echo kern.c; fi` | sed 's/^# \([0-9]\)/#line \1/' | $(ANSI2KNR) > $@ || rm -f $@
 longsize_.c: longsize.c $(ANSI2KNR)
-	$(CPP) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) `if test -f $(srcdir)/longsize.c; then echo $(srcdir)/longsize.c; else echo longsize.c; fi` | sed 's/^# \([0-9]\)/#line \1/' | $(ANSI2KNR) > longsize_.c || rm -f longsize_.c
-ntp-genkeys_.c: ntp-genkeys.c $(ANSI2KNR)
-	$(CPP) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) `if test -f $(srcdir)/ntp-genkeys.c; then echo $(srcdir)/ntp-genkeys.c; else echo ntp-genkeys.c; fi` | sed 's/^# \([0-9]\)/#line \1/' | $(ANSI2KNR) > ntp-genkeys_.c || rm -f ntp-genkeys_.c
+	$(CPP) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) `if test -f $(srcdir)/longsize.c; then echo $(srcdir)/longsize.c; else echo longsize.c; fi` | sed 's/^# \([0-9]\)/#line \1/' | $(ANSI2KNR) > $@ || rm -f $@
+ntp-keygen_.c: ntp-keygen.c $(ANSI2KNR)
+	$(CPP) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) `if test -f $(srcdir)/ntp-keygen.c; then echo $(srcdir)/ntp-keygen.c; else echo ntp-keygen.c; fi` | sed 's/^# \([0-9]\)/#line \1/' | $(ANSI2KNR) > $@ || rm -f $@
 ntptime_.c: ntptime.c $(ANSI2KNR)
-	$(CPP) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) `if test -f $(srcdir)/ntptime.c; then echo $(srcdir)/ntptime.c; else echo ntptime.c; fi` | sed 's/^# \([0-9]\)/#line \1/' | $(ANSI2KNR) > ntptime_.c || rm -f ntptime_.c
+	$(CPP) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) `if test -f $(srcdir)/ntptime.c; then echo $(srcdir)/ntptime.c; else echo ntptime.c; fi` | sed 's/^# \([0-9]\)/#line \1/' | $(ANSI2KNR) > $@ || rm -f $@
+pps-api_.c: pps-api.c $(ANSI2KNR)
+	$(CPP) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) `if test -f $(srcdir)/pps-api.c; then echo $(srcdir)/pps-api.c; else echo pps-api.c; fi` | sed 's/^# \([0-9]\)/#line \1/' | $(ANSI2KNR) > $@ || rm -f $@
 precision_.c: precision.c $(ANSI2KNR)
-	$(CPP) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) `if test -f $(srcdir)/precision.c; then echo $(srcdir)/precision.c; else echo precision.c; fi` | sed 's/^# \([0-9]\)/#line \1/' | $(ANSI2KNR) > precision_.c || rm -f precision_.c
+	$(CPP) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) `if test -f $(srcdir)/precision.c; then echo $(srcdir)/precision.c; else echo precision.c; fi` | sed 's/^# \([0-9]\)/#line \1/' | $(ANSI2KNR) > $@ || rm -f $@
 sht_.c: sht.c $(ANSI2KNR)
-	$(CPP) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) `if test -f $(srcdir)/sht.c; then echo $(srcdir)/sht.c; else echo sht.c; fi` | sed 's/^# \([0-9]\)/#line \1/' | $(ANSI2KNR) > sht_.c || rm -f sht_.c
+	$(CPP) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) `if test -f $(srcdir)/sht.c; then echo $(srcdir)/sht.c; else echo sht.c; fi` | sed 's/^# \([0-9]\)/#line \1/' | $(ANSI2KNR) > $@ || rm -f $@
 testrs6000_.c: testrs6000.c $(ANSI2KNR)
-	$(CPP) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) `if test -f $(srcdir)/testrs6000.c; then echo $(srcdir)/testrs6000.c; else echo testrs6000.c; fi` | sed 's/^# \([0-9]\)/#line \1/' | $(ANSI2KNR) > testrs6000_.c || rm -f testrs6000_.c
+	$(CPP) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) `if test -f $(srcdir)/testrs6000.c; then echo $(srcdir)/testrs6000.c; else echo testrs6000.c; fi` | sed 's/^# \([0-9]\)/#line \1/' | $(ANSI2KNR) > $@ || rm -f $@
 tickadj_.c: tickadj.c $(ANSI2KNR)
-	$(CPP) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) `if test -f $(srcdir)/tickadj.c; then echo $(srcdir)/tickadj.c; else echo tickadj.c; fi` | sed 's/^# \([0-9]\)/#line \1/' | $(ANSI2KNR) > tickadj_.c || rm -f tickadj_.c
+	$(CPP) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) `if test -f $(srcdir)/tickadj.c; then echo $(srcdir)/tickadj.c; else echo tickadj.c; fi` | sed 's/^# \([0-9]\)/#line \1/' | $(ANSI2KNR) > $@ || rm -f $@
 timetrim_.c: timetrim.c $(ANSI2KNR)
-	$(CPP) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) `if test -f $(srcdir)/timetrim.c; then echo $(srcdir)/timetrim.c; else echo timetrim.c; fi` | sed 's/^# \([0-9]\)/#line \1/' | $(ANSI2KNR) > timetrim_.c || rm -f timetrim_.c
-byteorder_.$(OBJEXT) hist_.$(OBJEXT) jitter_.$(OBJEXT) kern_.$(OBJEXT) \
-longsize_.$(OBJEXT) ntp-genkeys_.$(OBJEXT) ntptime_.$(OBJEXT) \
+	$(CPP) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) `if test -f $(srcdir)/timetrim.c; then echo $(srcdir)/timetrim.c; else echo timetrim.c; fi` | sed 's/^# \([0-9]\)/#line \1/' | $(ANSI2KNR) > $@ || rm -f $@
+audio-pcm_.$(OBJEXT) byteorder_.$(OBJEXT) hist_.$(OBJEXT) \
+jitter_.$(OBJEXT) kern_.$(OBJEXT) longsize_.$(OBJEXT) \
+ntp-keygen_.$(OBJEXT) ntptime_.$(OBJEXT) pps-api_.$(OBJEXT) \
 precision_.$(OBJEXT) sht_.$(OBJEXT) testrs6000_.$(OBJEXT) \
 tickadj_.$(OBJEXT) timetrim_.$(OBJEXT) : $(ANSI2KNR)
 uninstall-info-am:
 
+ETAGS = etags
+ETAGSFLAGS =
+
+CTAGS = ctags
+CTAGSFLAGS =
+
 tags: TAGS
 
 ID: $(HEADERS) $(SOURCES) $(LISP) $(TAGS_FILES)
-	list='$(SOURCES) $(HEADERS) $(TAGS_FILES)'; \
+	list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
 	unique=`for i in $$list; do \
 	    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
 	  done | \
 	  $(AWK) '    { files[$$0] = 1; } \
 	       END { for (i in files) print i; }'`; \
-	mkid -fID $$unique $(LISP)
+	mkid -fID $$unique
 
 TAGS:  $(HEADERS) $(SOURCES)  $(TAGS_DEPENDENCIES) \
 		$(TAGS_FILES) $(LISP)
 	tags=; \
 	here=`pwd`; \
-	list='$(SOURCES) $(HEADERS) $(TAGS_FILES)'; \
+	list='$(SOURCES) $(HEADERS)  $(LISP) $(TAGS_FILES)'; \
+	unique=`for i in $$list; do \
+	    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
+	  done | \
+	  $(AWK) '    { files[$$0] = 1; } \
+	       END { for (i in files) print i; }'`; \
+	test -z "$(ETAGS_ARGS)$$tags$$unique" \
+	  || $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	     $$tags $$unique
+
+ctags: CTAGS
+CTAGS:  $(HEADERS) $(SOURCES)  $(TAGS_DEPENDENCIES) \
+		$(TAGS_FILES) $(LISP)
+	tags=; \
+	here=`pwd`; \
+	list='$(SOURCES) $(HEADERS)  $(LISP) $(TAGS_FILES)'; \
 	unique=`for i in $$list; do \
 	    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
 	  done | \
 	  $(AWK) '    { files[$$0] = 1; } \
 	       END { for (i in files) print i; }'`; \
-	test -z "$(ETAGS_ARGS)$$unique$(LISP)$$tags" \
-	  || etags $(ETAGS_ARGS) $$tags  $$unique $(LISP)
+	test -z "$(CTAGS_ARGS)$$tags$$unique" \
+	  || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
+	     $$tags $$unique
 
 GTAGS:
-	here=`CDPATH=: && cd $(top_builddir) && pwd` \
+	here=`$(am__cd) $(top_builddir) && pwd` \
 	  && cd $(top_srcdir) \
 	  && gtags -i $(GTAGS_ARGS) $$here
 
 distclean-tags:
-	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH
-
+	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
 DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
 
 top_distdir = ..
 distdir = $(top_distdir)/$(PACKAGE)-$(VERSION)
 
 distdir: $(DISTFILES)
-	@for file in $(DISTFILES); do \
-	  if test -f $$file; then d=.; else d=$(srcdir); fi; \
+	@srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`; \
+	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's|.|.|g'`; \
+	list='$(DISTFILES)'; for file in $$list; do \
+	  case $$file in \
+	    $(srcdir)/*) file=`echo "$$file" | sed "s|^$$srcdirstrip/||"`;; \
+	    $(top_srcdir)/*) file=`echo "$$file" | sed "s|^$$topsrcdirstrip/|$(top_builddir)/|"`;; \
+	  esac; \
+	  if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
 	  dir=`echo "$$file" | sed -e 's,/[^/]*$$,,'`; \
 	  if test "$$dir" != "$$file" && test "$$dir" != "."; then \
-	    $(mkinstalldirs) "$(distdir)/$$dir"; \
+	    dir="/$$dir"; \
+	    $(mkinstalldirs) "$(distdir)$$dir"; \
+	  else \
+	    dir=''; \
 	  fi; \
 	  if test -d $$d/$$file; then \
-	    cp -pR $$d/$$file $(distdir) \
-	    || exit 1; \
+	    if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
+	      cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \
+	    fi; \
+	    cp -pR $$d/$$file $(distdir)$$dir || exit 1; \
 	  else \
 	    test -f $(distdir)/$$file \
 	    || cp -p $$d/$$file $(distdir)/$$file \
@@ -424,7 +528,6 @@ all-am: Makefile $(ANSI2KNR) $(PROGRAMS)
 
 installdirs:
 	$(mkinstalldirs) $(DESTDIR)$(bindir)
-
 install: install-am
 install-exec: install-exec-am
 install-data: install-data-am
@@ -436,6 +539,7 @@ install-am: all-am
 installcheck: installcheck-am
 install-strip:
 	$(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	  INSTALL_STRIP_FLAG=-s \
 	  `test -z '$(STRIP)' || \
 	    echo "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'"` install
 mostlyclean-generic:
@@ -443,7 +547,7 @@ mostlyclean-generic:
 clean-generic:
 
 distclean-generic:
-	-rm -f Makefile $(CONFIG_CLEAN_FILES) stamp-h stamp-h[0-9]*
+	-rm -f $(CONFIG_CLEAN_FILES)
 
 maintainer-clean-generic:
 	@echo "This command is intended for maintainers to use"
@@ -453,9 +557,11 @@ clean: clean-am
 clean-am: clean-binPROGRAMS clean-generic clean-krextra mostlyclean-am
 
 distclean: distclean-am
+	-rm -rf ./$(DEPDIR)
+	-rm -f Makefile
 
-distclean-am: clean-am distclean-compile distclean-depend \
-	distclean-generic distclean-tags
+distclean-am: clean-am distclean-compile distclean-generic \
+	distclean-tags
 
 dvi: dvi-am
 
@@ -476,6 +582,8 @@ install-man:
 installcheck-am:
 
 maintainer-clean: maintainer-clean-am
+	-rm -rf ./$(DEPDIR)
+	-rm -f Makefile
 
 maintainer-clean-am: distclean-am maintainer-clean-generic
 
@@ -483,18 +591,26 @@ mostlyclean: mostlyclean-am
 
 mostlyclean-am: mostlyclean-compile mostlyclean-generic mostlyclean-kr
 
+pdf: pdf-am
+
+pdf-am:
+
+ps: ps-am
+
+ps-am:
+
 uninstall-am: uninstall-binPROGRAMS uninstall-info-am
 
-.PHONY: GTAGS all all-am check check-am clean clean-binPROGRAMS \
-	clean-generic clean-krextra distclean distclean-compile \
-	distclean-depend distclean-generic distclean-tags distdir dvi \
-	dvi-am info info-am install install-am install-binPROGRAMS \
-	install-data install-data-am install-exec install-exec-am \
-	install-info install-info-am install-man install-strip \
-	installcheck installcheck-am installdirs maintainer-clean \
+.PHONY: CTAGS GTAGS all all-am check check-am clean clean-binPROGRAMS \
+	clean-generic clean-krextra ctags distclean distclean-compile \
+	distclean-generic distclean-tags distdir dvi dvi-am info \
+	info-am install install-am install-binPROGRAMS install-data \
+	install-data-am install-exec install-exec-am install-info \
+	install-info-am install-man install-strip installcheck \
+	installcheck-am installdirs maintainer-clean \
 	maintainer-clean-generic mostlyclean mostlyclean-compile \
-	mostlyclean-generic mostlyclean-kr tags uninstall uninstall-am \
-	uninstall-binPROGRAMS uninstall-info-am
+	mostlyclean-generic mostlyclean-kr pdf pdf-am ps ps-am tags \
+	uninstall uninstall-am uninstall-binPROGRAMS uninstall-info-am
 
 
 ../libntp/libntp.a:
diff --git a/contrib/ntp/util/README b/contrib/ntp/util/README
index b9ed50e..297a562 100644
--- a/contrib/ntp/util/README
+++ b/contrib/ntp/util/README
@@ -28,8 +28,8 @@ size (32 or 64 bits).  See the configure scripts for further details.
 
 The testrs6000.c program is used for testing purposes with the IBM
 RS/6000 AIX machines. Bill Jones <jones@chpc.utexas.edu> reports:
-"I could not get a tickadj of less then 40 us to work on a RS6000.
-If you set it less then 40 us do so at your own risk!"
+"I could not get a tickadj of less than 40 us to work on a RS6000.
+If you set it less than 40 us do so at your own risk!"
 
 The tickadj.c program can be used to read and set various kernel
 parameters affecting NTP operations. See the tickadj page in the HTML
diff --git a/contrib/ntp/util/audio-pcm.c b/contrib/ntp/util/audio-pcm.c
new file mode 100644
index 0000000..6f2e4fa
--- /dev/null
+++ b/contrib/ntp/util/audio-pcm.c
@@ -0,0 +1,154 @@
+/*
+ * audio-pcm.c - Scope out the PCM audio stuff
+ */
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+
+#if defined(HAVE_MACHINE_SOUNDCARD_H) || defined(HAVE_SYS_SOUNDCARD_H)
+
+#include "audio.h"
+#include "ntp_stdlib.h"
+#include "ntp_syslog.h"
+#ifdef HAVE_UNISTD_H
+# include <unistd.h>
+#endif
+#include <stdio.h>
+#include "ntp_string.h"
+
+#ifdef HAVE_SYS_IOCTL_H
+#include <sys/ioctl.h>
+#endif /* HAVE_SYS_IOCTL_H */
+
+#include <fcntl.h>
+
+#ifdef HAVE_MACHINE_SOUNDCARD_H
+# include <machine/soundcard.h>
+# define PCM_STYLE_SOUND
+#else
+# ifdef HAVE_SYS_SOUNDCARD_H
+#  include <sys/soundcard.h>
+#  define PCM_STYLE_SOUND
+# endif
+#endif
+
+/*
+ * Global variables
+ */
+static int ctl_fd;		/* audio control file descriptor */
+
+const char *m_names[SOUND_MIXER_NRDEVICES] = SOUND_DEVICE_NAMES ;
+
+void
+d_fmt(
+      unsigned int format
+      )
+{
+
+  if (format & AFMT_MU_LAW)	printf("MU_LAW ");
+  if (format & AFMT_A_LAW)	printf("A_LAW ");
+  if (format & AFMT_IMA_ADPCM)	printf("IMA_ADPCM ");
+  if (format & AFMT_U8)		printf("U8 ");
+  if (format & AFMT_S16_LE)	printf("S16_LE ");
+  if (format & AFMT_S16_BE)	printf("S16_BE ");
+  if (format & AFMT_S8)		printf("S8 ");
+  if (format & AFMT_U16_LE)	printf("U16_LE ");
+  if (format & AFMT_U16_BE)	printf("U16_BE ");
+  if (format & AFMT_MPEG)	printf("MPEG ");
+  if (format & AFMT_AC3)	printf("AC3 ");
+  printf("\n");
+}
+
+void
+d_mixer(
+	unsigned int mixer
+	)
+{
+  int i;
+  int n = 0;
+
+  for (i = 0; i < SOUND_MIXER_NRDEVICES; ++i)
+    if ((1 << i) & mixer) {
+      if (n)
+	printf(", ");
+      printf("%s", m_names[i]);
+      n = 1;
+    }
+  printf("\n");
+}
+
+int
+main( )
+{
+	int	unit = 0;	/* device unit (0-3) */
+# define AI_DEV		"/dev/audio%d"
+# define AC_DEV		"/dev/mixer%d"
+	char ai_dev[30];
+	char ac_dev[30];
+	struct snd_size s_size;
+	snd_chan_param s_c_p;
+	snd_capabilities s_c;
+	int fd;
+	int rval;
+	char *dname = ai_dev;		/* device name */
+	char *actl = ac_dev;
+	int devmask = 0, recmask = 0, recsrc = 0;
+
+	(void)sprintf(ai_dev, AI_DEV, unit);
+	(void)sprintf(ac_dev, AC_DEV, unit);
+
+	/*
+	 * Open audio device. Do not complain if not there.
+	 */
+	fd = open(dname, O_RDWR | O_NONBLOCK, 0777);
+	if (fd < 0)
+		return (fd);
+
+	/*
+	 * Open audio control device.
+	 */
+	ctl_fd = open(actl, O_RDWR);
+	if (ctl_fd < 0) {
+		fprintf(stderr, "invalid control device <%s>\n", actl);
+		close(fd);
+		return(ctl_fd);
+	}
+
+	printf("input:   <%s> %d\n", dname, fd);
+	printf("control: <%s> %d\n", actl, ctl_fd);
+
+	if (ioctl(ctl_fd, SOUND_MIXER_READ_DEVMASK, &devmask) == -1)
+	    printf("SOUND_MIXER_READ_DEVMASK: %s\n", strerror(errno));
+	if (ioctl(ctl_fd, SOUND_MIXER_READ_RECMASK, &recmask) == -1)
+	    printf("SOUND_MIXER_READ_RECMASK: %s\n", strerror(errno));
+	if (ioctl(ctl_fd, SOUND_MIXER_READ_RECSRC, &recsrc) == -1)
+	    printf("SOUND_MIXER_READ_RECSRC: %s\n", strerror(errno));
+
+	printf("devmask: %#x recmask: %#x recsrc: %#x\n",
+		devmask, recmask, recsrc);
+	printf("Devmask: "); d_mixer(devmask);
+	printf("Recmask: "); d_mixer(recmask);
+	printf("RecSrc:  "); d_mixer(recsrc);
+
+	/*
+	 * Set audio device parameters.
+	 */
+	rval = fd;
+
+	if (ioctl(fd, AIOGSIZE, &s_size) == -1)
+	    printf("AIOGSIZE: %s\n", strerror(errno));
+	else
+	    printf("play_size %d, rec_size %d\n",
+		s_size.play_size, s_size.rec_size);
+
+	if (ioctl(fd, AIOGFMT, &s_c_p) == -1)
+	    printf("AIOGFMT: %s\n", strerror(errno));
+	else {
+	  printf("play_rate %lu, rec_rate %lu, play_format %#lx, rec_format %#lx\n",
+		 s_c_p.play_rate, s_c_p.rec_rate, s_c_p.play_format, s_c_p.rec_format);
+	  printf("Play format: "); d_fmt(s_c_p.play_format);
+	  printf("Rec format:  "); d_fmt(s_c_p.rec_format);
+	}
+
+}
+#endif /* HAVE_{MACHINE_SOUNDCARD,SYS_SOUNDCARD}_H */
diff --git a/contrib/ntp/util/hist.c b/contrib/ntp/util/hist.c
index b02d73f..c9763ce 100644
--- a/contrib/ntp/util/hist.c
+++ b/contrib/ntp/util/hist.c
@@ -7,20 +7,24 @@
  * runs backwards.
  */
 
+#if 0
 #ifdef HAVE_CONFIG_H
 # include <config.h>
 #endif
 
 #include "ntp_types.h"
+#endif
 
 #include <stdio.h>
 #include <stdlib.h>
+#include <time.h>
 
 #define NBUF 100001		/* size of basic histogram */
 #define NSRT 20000		/* size of overflow histogram */
 #define NCNT (600 * 1000000)	/* sample interval (us) */
 
-int col P((long *, long *));
+extern int col(hrtime_t *, hrtime_t *);
+extern hrtime_t gethrtime(void);
 
 int
 main(
@@ -28,10 +32,8 @@ main(
 	char *argv[]
 	)
 {
-	struct timeval ts, tr, tp;
-	struct timezone tzp;
 	int i, j, n;
-	long t, u, v, w, gtod[NBUF], ovfl[NSRT];
+	hrtime_t t, u, v, w, gtod[NBUF], ovfl[NSRT];
 
 	/*
 	 * Force pages into memory
@@ -45,12 +47,10 @@ main(
 	 * Construct histogram
 	 */
 	n = 0;
-	gettimeofday(&ts, &tzp);
-	t = ts.tv_sec * 1000000 + ts.tv_usec;
+	t = gethrtime();
 	v = t;
 	while (1) {
-		gettimeofday(&tr, &tzp);
-		u = tr.tv_sec * 1000000 + tr.tv_usec; 
+		u = gethirestime();
 		if (u - v > NCNT)
 		    break;
 		w = u - t;
@@ -66,7 +66,6 @@ main(
 		} else {
 			gtod[w]++;
 		}
-		ts = tr;
 		t = u;
 	}
 
@@ -79,7 +78,7 @@ main(
 	}
 	if (n == 0)
 	    return;
-	qsort((char *)ovfl, (size_t)n, sizeof(long), col);
+	qsort((char *)ovfl, (size_t)n, sizeof(hrtime_t), col);
 	w = 0;
 	j = 0;
 	for (i = 0; i < n; i++) {
@@ -99,8 +98,8 @@ main(
 
 int
 col(
-	long *x,
-	long *y
+	hrtime_t *x,
+	hrtime_t *y
 	)
 {
 	return (*x - *y);
diff --git a/contrib/ntp/util/ntp-keygen.c b/contrib/ntp/util/ntp-keygen.c
new file mode 100644
index 0000000..850ae4c
--- /dev/null
+++ b/contrib/ntp/util/ntp-keygen.c
@@ -0,0 +1,1953 @@
+/*
+ * Program to generate cryptographic keys for NTP clients and servers
+ *
+ * This program generates files "ntpkey_<type>_<hostname>.<filestamp>",
+ * where <type> is the file type, <hostname> is the generating host and
+ * <filestamp> is the NTP seconds in decimal format. The NTP programs
+ * expect generic names such as "ntpkey_<type>_whimsy.udel.edu" with the
+ * association maintained by soft links.
+ *
+ * Files are prefixed with a header giving the name and date of creation
+ * followed by a type-specific descriptive label and PEM-encoded data
+ * string compatible with programs of the OpenSSL library.
+ *
+ * Note that private keys can be password encrypted as per OpenSSL
+ * conventions.
+ *
+ * The file types include
+ *
+ * ntpkey_MD5key_<hostname>.<filestamp>
+ * 	MD5 (128-bit) keys used to compute message digests in symmetric
+ *	key cryptography
+ *
+ * ntpkey_RSAkey_<hostname>.<filestamp>
+ * ntpkey_host_<hostname> (RSA) link
+ *	RSA private/public host key pair used for public key signatures
+ *	and data encryption
+ *
+ * ntpkey_DSAkey_<hostname>.<filestamp>
+ * ntpkey_sign_<hostname> (RSA or DSA) link
+ *	DSA private/public sign key pair used for public key signatures,
+ *	but not data encryption
+ *
+ * ntpkey_IFFpar_<hostname>.<filestamp>
+ * ntpkey_iff_<hostname> (IFF server/client) link
+ * ntpkey_iffkey_<hostname> (IFF client) link
+ *	Schnorr (IFF) server/client identity parameters
+ *
+ * ntpkey_IFFkey_<hostname>.<filestamp>
+ *	Schnorr (IFF) client identity parameters
+ *
+ * ntpkey_GQpar_<hostname>.<filestamp>,
+ * ntpkey_gq_<hostname> (GQ) link
+ *	Guillou-Quisquater (GQ) identity parameters
+ *
+ * ntpkey_MVpar_<hostname>.<filestamp>,
+ *	Mu-Varadharajan (MV) server identity parameters 
+ *
+ * ntpkey_MVkeyX_<hostname>.<filestamp>,
+ * ntpkey_mv_<hostname> (MV server) link
+ * ntpkey_mvkey_<hostname> (MV client) link
+ *	Mu-Varadharajan (MV) client identity parameters
+ *
+ * ntpkey_XXXcert_<hostname>.<filestamp>
+ * ntpkey_cert_<hostname> (RSA or DSA) link
+ *	X509v3 certificate using RSA or DSA public keys and signatures.
+ *	XXX is a code identifying the message digest and signature
+ *	encryption algorithm
+ *
+ * Available digest/signature schemes
+ *
+ * RSA:	RSA-MD2, RSA-MD5, RSA-SHA, RSA-SHA1, RSA-MDC2, EVP-RIPEMD160
+ * DSA:	DSA-SHA, DSA-SHA1
+ *
+ * Note: Once in a while because of some statistical fluke this program
+ * fails to generate and verify some cryptographic data, as indicated by
+ * exit status -1. In this case simply run the program again. If the
+ * program does complete with return code 0, the data are correct as
+ * verified.
+ *
+ * These cryptographic routines are characterized by the prime modulus
+ * size in bits. The default value of 512 bits is a compromise between
+ * cryptographic strength and computing time and is ordinarily
+ * considered adequate for this application. The routines have been
+ * tested with sizes of 256, 512, 1024 and 2048 bits. Not all message
+ * digest and signature encryption schemes work with sizes less than 512
+ * bits. The computing time for sizes greater than 2048 bits is
+ * prohibitive on all but the fastest processors. An UltraSPARC Blade
+ * 1000 took something over nine minutes to generate and verify the
+ * values with size 2048. An old SPARC IPC would take a week.
+ *
+ * The OpenSSL library used by this program expects a random seed file.
+ * As described in the OpenSSL documentation, the file name defaults to
+ * first the RANDFILE environment variable in the user's home directory
+ * and then .rnd in the user's home directory.
+ */
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+#include <string.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <sys/stat.h>
+#include <sys/time.h>
+#if HAVE_SYS_TYPES_H
+# include <sys/types.h>
+#endif
+#include "ntp_types.h"
+#include "l_stdlib.h"
+
+#ifdef SYS_WINNT
+extern	int	ntp_getopt	P((int, char **, const char *));
+#define getopt ntp_getopt
+#define optarg ntp_optarg
+#endif
+
+#ifdef OPENSSL
+#include "openssl/bn.h"
+#include "openssl/evp.h"
+#include "openssl/err.h"
+#include "openssl/rand.h"
+#include "openssl/pem.h"
+#include "openssl/x509v3.h"
+#include <openssl/objects.h>
+#endif /* OPENSSL */
+
+/*
+ * Cryptodefines
+ */
+#define	MD5KEYS		16	/* number of MD5 keys generated */
+#define	JAN_1970	ULONG_CONST(2208988800) /* NTP seconds */
+#define YEAR		((long)60*60*24*365) /* one year in seconds */
+#define MAXFILENAME	256	/* max file name length */
+#define MAXHOSTNAME	256	/* max host name length */
+#ifdef OPENSSL
+#define	PLEN		512	/* default prime modulus size (bits) */
+
+/*
+ * Strings used in X509v3 extension fields
+ */
+#define KEY_USAGE		"digitalSignature,keyCertSign"
+#define BASIC_CONSTRAINTS	"critical,CA:TRUE"
+#define EXT_KEY_PRIVATE		"private"
+#define EXT_KEY_TRUST		"trustRoot"
+#endif /* OPENSSL */
+
+/*
+ * Prototypes
+ */
+FILE	*fheader	P((const char *, const char *));
+void	fslink		P((const char *, const char *));
+int	gen_md5		P((char *));
+#ifdef OPENSSL
+EVP_PKEY *gen_rsa	P((char *));
+EVP_PKEY *gen_dsa	P((char *));
+EVP_PKEY *gen_iff	P((char *));
+EVP_PKEY *gen_gqpar	P((char *));
+EVP_PKEY *gen_gqkey	P((char *, EVP_PKEY *));
+EVP_PKEY *gen_mv	P((char *));
+int	x509		P((EVP_PKEY *, const EVP_MD *, char *, char *));
+void	cb		P((int, int, void *));
+EVP_PKEY *genkey	P((char *, char *));
+u_long	asn2ntp		P((ASN1_TIME *));
+#endif /* OPENSSL */
+
+/*
+ * Program variables
+ */
+extern char *optarg;		/* command line argument */
+int	debug = 0;		/* debug, not de bug */
+int	rval;			/* return status */
+u_int	modulus = PLEN;		/* prime modulus size (bits) */
+int	nkeys = 0;		/* MV keys */
+time_t	epoch;			/* Unix epoch (seconds) since 1970 */
+char	*hostname;		/* host name (subject name) */
+char	*trustname;		/* trusted host name (issuer name) */
+char	filename[MAXFILENAME + 1]; /* file name */
+char	*passwd1 = NULL;	/* input private key password */
+char	*passwd2 = NULL;	/* output private key password */
+#ifdef OPENSSL
+long	d0, d1, d2, d3;		/* callback counters */
+#endif /* OPENSSL */
+
+#ifdef SYS_WINNT
+BOOL init_randfile();
+
+/*
+ * Don't try to follow symbolic links
+ */
+int
+readlink(char * link, char * file, int len) {
+	return (-1);
+}
+/*
+ * Don't try to create a symbolic link for now.
+ * Just move the file to the name you need.
+ */
+int
+symlink(char *filename, char *linkname) {
+	DeleteFile(linkname);
+	MoveFile(filename, linkname);
+	return 0;
+}
+void
+InitWin32Sockets() {
+	WORD wVersionRequested;
+	WSADATA wsaData;
+	wVersionRequested = MAKEWORD(2,0);
+	if (WSAStartup(wVersionRequested, &wsaData))
+	{
+		fprintf(stderr, "No useable winsock.dll");
+		exit(1);
+	}
+}
+#endif /* SYS_WINNT */
+
+/*
+ * Main program
+ */
+int
+main(
+	int	argc,		/* command line options */
+	char	**argv
+	)
+{
+	struct timeval tv;	/* initialization vector */
+#ifdef OPENSSL
+	X509	*cert = NULL;	/* X509 certificate */
+	EVP_PKEY *pkey_host = NULL; /* host key */
+	EVP_PKEY *pkey_sign = NULL; /* sign key */
+	EVP_PKEY *pkey_iff = NULL; /* IFF parameters */
+	EVP_PKEY *pkey_gq = NULL; /* GQ parameters */
+	EVP_PKEY *pkey_mv = NULL; /* MV parameters */
+	int	md5key = 0;	/* generate MD5 keys */
+	int	hostkey = 0;	/* generate RSA keys */
+	int	iffkey = 0;	/* generate IFF parameters */
+	int	gqpar = 0;	/* generate GQ parameters */
+	int	gqkey = 0;	/* update GQ keys */
+	int	mvpar = 0;	/* generate MV parameters */
+	int	mvkey = 0;	/* update MV keys */
+	char	*sign = NULL;	/* sign key */
+	EVP_PKEY *pkey = NULL;	/* temp key */
+	const EVP_MD *ectx;	/* EVP digest */
+	char	hostbuf[MAXHOSTNAME + 1];
+	char	pathbuf[MAXFILENAME + 1];
+	const char *scheme = NULL; /* digest/signature scheme */
+	char	*exten = NULL;	/* private extension */
+	char	*grpkey = NULL;	/* identity extension */
+	int	nid;		/* X509 digest/signature scheme */
+	FILE	*fstr = NULL;	/* file handle */
+	int	iffsw = 0;	/* IFF key switch */
+#endif /* OPENSSL */
+	u_int	temp;
+
+#ifdef SYS_WINNT
+	/* Initialize before OpenSSL checks */
+	InitWin32Sockets();
+	if(!init_randfile())
+		fprintf(stderr, "Unable to initialize .rnd file\n");
+#endif
+
+#ifdef OPENSSL
+	if (SSLeay() != OPENSSL_VERSION_NUMBER) {
+		fprintf(stderr,
+		    "OpenSSL version mismatch. Built against %lx, you have %lx\n",
+		    OPENSSL_VERSION_NUMBER, SSLeay());
+		return (-1);
+
+	} else {
+		fprintf(stderr,
+		    "Using OpenSSL version %lx\n", SSLeay());
+	}
+#endif /* OPENSSL */
+
+	/*
+	 * Process options, initialize host name and timestamp.
+	 */
+	gethostname(hostbuf, MAXHOSTNAME);
+	hostname = hostbuf;
+	trustname = hostbuf;
+	passwd1 = hostbuf;
+#ifndef SYS_WINNT
+	gettimeofday(&tv, 0);
+#else
+	gettimeofday(&tv);
+#endif
+	epoch = tv.tv_sec;
+	rval = 0;
+	while ((temp = getopt(argc, argv,
+	    "c:deGgHIi:Mm:nPp:q:S:s:TV:v:")) != -1) {
+		switch(temp) {
+
+		/*
+		 * -c select public certificate type
+		 */
+		case 'c':
+			scheme = optarg;
+			continue;
+
+		/*
+		 * -d debug
+		 */
+		case 'd':
+			debug++;
+			continue;
+
+		/*
+		 * -e write identity keys
+		 */
+		case 'e':
+			iffsw++;
+			continue;
+
+		/*
+		 * -G generate GQ parameters and keys
+		 */
+		case 'G':
+			gqpar++;
+			continue;
+
+		/*
+		 * -g update GQ keys
+		 */
+		case 'g':
+			gqkey++;
+			continue;
+
+		/*
+		 * -H generate host key (RSA)
+		 */
+		case 'H':
+			hostkey++;
+			continue;
+
+		/*
+		 * -I generate IFF parameters
+		 */
+		case 'I':
+			iffkey++;
+			continue;
+
+		/*
+		 * -i set issuer name
+		 */
+		case 'i':
+			trustname = optarg;
+			continue;
+
+		/*
+		 * -M generate MD5 keys
+		 */
+		case 'M':
+			md5key++;
+			continue;
+
+
+		/*
+		 * -m select modulus (256-2048)
+		 */
+		case 'm':
+			if (sscanf(optarg, "%d", &modulus) != 1)
+				fprintf(stderr,
+				    "invalid option -m %s\n", optarg);	
+			continue;
+		
+		/*
+		 * -P generate PC private certificate
+		 */
+		case 'P':
+			exten = EXT_KEY_PRIVATE;
+			continue;
+
+		/*
+		 * -p output private key password
+		 */
+		case 'p':
+			passwd2 = optarg;
+			continue;
+
+		/*
+		 * -q input private key password
+		 */
+		case 'q':
+			passwd1 = optarg;
+			continue;
+
+		/*
+		 * -S generate sign key (RSA or DSA)
+		 */
+		case 'S':
+			sign = optarg;
+			continue;
+
+		/*
+		 * -s set subject name
+		 */
+		case 's':
+			hostname = optarg;
+			continue;
+		
+		/*
+		 * -T trusted certificate (TC scheme)
+		 */
+		case 'T':
+			exten = EXT_KEY_TRUST;
+			continue;
+
+		/*
+		 * -V <keys> generate MV parameters
+		 */
+		case 'V':
+			mvpar++;
+			if (sscanf(optarg, "%d", &nkeys) != 1)
+				fprintf(stderr,
+				    "invalid option -V %s\n", optarg);
+			continue;
+
+		/*
+		 * -v <key> update MV keys
+		 */
+		case 'v':
+			mvkey++;
+			if (sscanf(optarg, "%d", &nkeys) != 1)
+				fprintf(stderr,
+				    "invalid option -v %s\n", optarg);
+			continue;
+
+		/*
+		 * None of the above.
+		 */
+		default:
+			fprintf(stderr, "Option ignored\n");
+			continue;
+		}
+	}
+
+	if (passwd1 != NULL && passwd2 == NULL)
+		passwd2 = passwd1;
+#ifdef OPENSSL
+	/*
+	 * Seed random number generator and grow weeds.
+	 */
+	ERR_load_crypto_strings();
+	OpenSSL_add_all_algorithms();
+	if (RAND_file_name(pathbuf, MAXFILENAME) == NULL) {
+		fprintf(stderr, "RAND_file_name %s\n",
+		    ERR_error_string(ERR_get_error(), NULL));
+		return (-1);
+	}
+	temp = RAND_load_file(pathbuf, -1);
+	if (temp == 0) {
+		fprintf(stderr,
+		    "RAND_load_file %s not found or empty\n", pathbuf);
+		return (-1);
+	}
+	fprintf(stderr,
+	    "Random seed file %s %u bytes\n", pathbuf, temp);
+	RAND_add(&epoch, sizeof(epoch), 4.0);
+
+	/*
+	 * Generate new parameters and keys as requested. These replace
+	 * any values already generated.
+	 */
+	if (md5key)
+		gen_md5("MD5");
+	if (hostkey)
+		pkey_host = genkey("RSA", "host");
+	if (sign != NULL)
+		pkey_sign = genkey(sign, "sign");
+	if (iffkey)
+		pkey_iff = gen_iff("iff");
+	if (gqpar)
+		pkey_gq = gen_gqpar("gq");
+	if (mvpar)
+		pkey_mv = gen_mv("mv");
+
+	/*
+	 * If there is no new host key, look for an existing one. If not
+	 * found, create it.
+	 */
+	while (pkey_host == NULL && rval == 0 && !iffsw) {
+		sprintf(filename, "ntpkey_host_%s", hostname);
+		if ((fstr = fopen(filename, "r")) != NULL) {
+			pkey_host = PEM_read_PrivateKey(fstr, NULL,
+			    NULL, passwd1);
+			fclose(fstr);
+			readlink(filename, filename,  sizeof(filename));
+			if (pkey_host == NULL) {
+				fprintf(stderr, "Host key\n%s\n",
+				    ERR_error_string(ERR_get_error(),
+				    NULL));
+				rval = -1;
+			} else {
+				fprintf(stderr,
+				    "Using host key %s\n", filename);
+			}
+			break;
+
+		} else if ((pkey_host = genkey("RSA", "host")) ==
+		    NULL) {
+			rval = -1;
+			break;
+		}
+	}
+
+	/*
+	 * If there is no new sign key, look for an existing one. If not
+	 * found, use the host key instead.
+	 */
+	pkey = pkey_sign;
+	while (pkey_sign == NULL && rval == 0 && !iffsw) {
+		sprintf(filename, "ntpkey_sign_%s", hostname);
+		if ((fstr = fopen(filename, "r")) != NULL) {
+			pkey_sign = PEM_read_PrivateKey(fstr, NULL,
+			    NULL, passwd1);
+			fclose(fstr);
+			readlink(filename, filename, sizeof(filename));
+			if (pkey_sign == NULL) {
+				fprintf(stderr, "Sign key\n%s\n",
+				    ERR_error_string(ERR_get_error(),
+				    NULL));
+				rval = -1;
+			} else {
+				fprintf(stderr, "Using sign key %s\n",
+				    filename);
+			}
+			break;
+		} else {
+			pkey = pkey_host;
+			fprintf(stderr, "Using host key as sign key\n");
+			break;
+		}
+	}
+
+	/*
+	 * If there is no new IFF file, look for an existing one.
+	 */
+	if (pkey_iff == NULL && rval == 0) {
+		sprintf(filename, "ntpkey_iff_%s", hostname);
+		if ((fstr = fopen(filename, "r")) != NULL) {
+			pkey_iff = PEM_read_PrivateKey(fstr, NULL,
+			    NULL, passwd1);
+			fclose(fstr);
+			readlink(filename, filename, sizeof(filename));
+			if (pkey_iff == NULL) {
+				fprintf(stderr, "IFF parameters\n%s\n",
+				    ERR_error_string(ERR_get_error(),
+				    NULL));
+				rval = -1;
+			} else {
+				fprintf(stderr,
+				    "Using IFF parameters %s\n",
+				    filename);
+			}
+		}
+	}
+
+	/*
+	 * If there is no new GQ file, look for an existing one.
+	 */
+	if (pkey_gq == NULL && rval == 0 && !iffsw) {
+		sprintf(filename, "ntpkey_gq_%s", hostname);
+		if ((fstr = fopen(filename, "r")) != NULL) {
+			pkey_gq = PEM_read_PrivateKey(fstr, NULL, NULL,
+			    passwd1);
+			fclose(fstr);
+			readlink(filename, filename, sizeof(filename));
+			if (pkey_gq == NULL) {
+				fprintf(stderr, "GQ parameters\n%s\n",
+				    ERR_error_string(ERR_get_error(),
+				    NULL));
+				rval = -1;
+			} else {
+				fprintf(stderr,
+				    "Using GQ parameters %s\n",
+				    filename);
+			}
+		}
+	}
+
+	/*
+	 * If there is a GQ parameter file, create GQ private/public
+	 * keys and extract the public key for the certificate.
+	 */
+	if (pkey_gq != NULL && rval == 0) {
+		gen_gqkey("gq", pkey_gq);
+		grpkey = BN_bn2hex(pkey_gq->pkey.rsa->q);
+	}
+
+	/*
+	 * Generate a X509v3 certificate.
+	 */
+	while (scheme == NULL && rval == 0 && !iffsw) {
+		sprintf(filename, "ntpkey_cert_%s", hostname);
+		if ((fstr = fopen(filename, "r")) != NULL) {
+			cert = PEM_read_X509(fstr, NULL, NULL, NULL);
+			fclose(fstr);
+			readlink(filename, filename, sizeof(filename));
+			if (cert == NULL) {
+				fprintf(stderr, "Cert \n%s\n",
+				    ERR_error_string(ERR_get_error(),
+				    NULL));
+				rval = -1;
+			} else {
+				nid = OBJ_obj2nid(
+				 cert->cert_info->signature->algorithm);
+				scheme = OBJ_nid2sn(nid);
+				fprintf(stderr,
+				    "Using scheme %s from %s\n", scheme,
+				     filename);
+				break;
+			}
+		}
+		scheme = "RSA-MD5";
+	}
+	if (pkey != NULL && rval == 0 && !iffsw) {
+		ectx = EVP_get_digestbyname(scheme);
+		if (ectx == NULL) {
+			fprintf(stderr,
+			    "Invalid digest/signature combination %s\n",
+			    scheme);
+			rval = -1;
+		} else {
+			x509(pkey, ectx, grpkey, exten);
+		}
+	}
+
+	/*
+	 * Write the IFF client parameters and keys as a DSA private key
+	 * encoded in PEM. Note the private key is obscured.
+	 */
+	if (pkey_iff != NULL && rval == 0 && iffsw) {
+		DSA	*dsa;
+		char	*sptr;
+
+		sptr = strrchr(filename, '.');
+		sprintf(filename, "ntpkey_IFFkey_%s.%s", trustname,
+		    ++sptr);
+		fprintf(stderr, "Writing new IFF key %s\n", filename);
+		fprintf(stdout, "# %s\n# %s", filename, ctime(&epoch));
+		dsa = pkey_iff->pkey.dsa;
+		BN_copy(dsa->priv_key, BN_value_one());
+		pkey = EVP_PKEY_new();
+		EVP_PKEY_assign_DSA(pkey, dsa);
+		PEM_write_PrivateKey(stdout, pkey, passwd2 ?
+		    EVP_des_cbc() : NULL, NULL, 0, NULL, passwd2);
+		fclose(stdout);
+		if (debug)
+			DSA_print_fp(stdout, dsa, 0);
+	}
+
+	/*
+	 * Return the marbles.
+	 */
+	if (grpkey != NULL)
+		OPENSSL_free(grpkey);
+	if (pkey_host != NULL)
+		EVP_PKEY_free(pkey_host);
+	if (pkey_sign != NULL)
+		EVP_PKEY_free(pkey_sign);
+	if (pkey_iff != NULL)
+		EVP_PKEY_free(pkey_iff);
+	if (pkey_gq != NULL)
+		EVP_PKEY_free(pkey_gq);
+	if (pkey_mv != NULL)
+		EVP_PKEY_free(pkey_mv);
+#endif /* OPENSSL */
+	return (rval);
+}
+
+
+#if 0
+/*
+ * Generate random MD5 key with password.
+ */
+int
+gen_md5(
+	char	*id		/* file name id */
+	)
+{
+	BIGNUM	*key;
+	BIGNUM	*keyid;
+	FILE	*str;
+	u_char	bin[16];
+
+	fprintf(stderr, "Generating MD5 keys...\n");
+	str = fheader("MD5key", hostname);
+	keyid = BN_new(); key = BN_new();
+	BN_rand(keyid, 16, -1, 0);
+	BN_rand(key, 128, -1, 0);
+	BN_bn2bin(key, bin);
+	PEM_write_fp(str, MD5, NULL, bin);
+	fclose(str);
+	fslink(id, hostname);
+	return (1);
+}
+
+
+#else
+/*
+ * Generate semi-random MD5 keys compatible with NTPv3 and NTPv4
+ */
+int
+gen_md5(
+	char	*id		/* file name id */
+	)
+{
+	u_char	md5key[16];	/* MD5 key */
+	FILE	*str;
+	u_int	temp = 0;	/* Initialize to prevent warnings during compile */
+	int	i, j;
+
+	fprintf(stderr, "Generating MD5 keys...\n");
+	str = fheader("MD5key", hostname);
+	srandom(epoch);
+	for (i = 1; i <= MD5KEYS; i++) {
+		for (j = 0; j < 16; j++) {
+			while (1) {
+				temp = random() & 0xff;
+				if (temp == '#')
+					continue;
+				if (temp > 0x20 && temp < 0x7f)
+					break;
+			}
+			md5key[j] = (u_char)temp;
+		}
+		md5key[16] = '\0';
+		fprintf(str, "%2d MD5 %16s	# MD5 key\n", i,
+		    md5key);
+	}
+	fclose(str);
+	fslink(id, hostname);
+	return (1);
+}
+#endif /* OPENSSL */
+
+
+#ifdef OPENSSL
+/*
+ * Generate RSA public/private key pair
+ */
+EVP_PKEY *			/* public/private key pair */
+gen_rsa(
+	char	*id		/* file name id */
+	)
+{
+	EVP_PKEY *pkey;		/* private key */
+	RSA	*rsa;		/* RSA parameters and key pair */
+	FILE	*str;
+
+	fprintf(stderr, "Generating RSA keys (%d bits)...\n", modulus);
+	rsa = RSA_generate_key(modulus, 3, cb, "RSA");
+	fprintf(stderr, "\n");
+	if (rsa == NULL) {
+		fprintf(stderr, "RSA generate keys fails\n%s\n",
+		    ERR_error_string(ERR_get_error(), NULL));
+		rval = -1;
+		return (NULL);
+	}
+
+	/*
+	 * For signature encryption it is not necessary that the RSA
+	 * parameters be strictly groomed and once in a while the
+	 * modulus turns out to be non-prime. Just for grins, we check
+	 * the primality.
+	 */
+	if (!RSA_check_key(rsa)) {
+		fprintf(stderr, "Invalid RSA key\n%s\n",
+		    ERR_error_string(ERR_get_error(), NULL));
+		RSA_free(rsa);
+		rval = -1;
+		return (NULL);
+	}
+
+	/*
+	 * Write the RSA parameters and keys as a RSA private key
+	 * encoded in PEM.
+	 */
+	str = fheader("RSAkey", hostname);
+	pkey = EVP_PKEY_new();
+	EVP_PKEY_assign_RSA(pkey, rsa);
+	PEM_write_PrivateKey(str, pkey, passwd2 ? EVP_des_cbc() : NULL,
+	    NULL, 0, NULL, passwd2);
+	fclose(str);
+	if (debug)
+		RSA_print_fp(stdout, rsa, 0);
+	fslink(id, hostname);
+	return (pkey);
+}
+
+ 
+/*
+ * Generate DSA public/private key pair
+ */
+EVP_PKEY *			/* public/private key pair */
+gen_dsa(
+	char	*id		/* file name id */
+	)
+{
+	EVP_PKEY *pkey;		/* private key */
+	DSA	*dsa;		/* DSA parameters */
+	u_char	seed[20];	/* seed for parameters */
+	FILE	*str;
+
+	/*
+	 * Generate DSA parameters.
+	 */
+	fprintf(stderr,
+	    "Generating DSA parameters (%d bits)...\n", modulus);
+	RAND_bytes(seed, sizeof(seed));
+	dsa = DSA_generate_parameters(modulus, seed, sizeof(seed), NULL,
+	    NULL, cb, "DSA");
+	fprintf(stderr, "\n");
+	if (dsa == NULL) {
+		fprintf(stderr, "DSA generate parameters fails\n%s\n",
+		    ERR_error_string(ERR_get_error(), NULL));
+		rval = -1;
+		return (NULL);
+	}
+
+	/*
+	 * Generate DSA keys.
+	 */
+	fprintf(stderr, "Generating DSA keys (%d bits)...\n", modulus);
+	if (!DSA_generate_key(dsa)) {
+		fprintf(stderr, "DSA generate keys fails\n%s\n",
+		    ERR_error_string(ERR_get_error(), NULL));
+		DSA_free(dsa);
+		rval = -1;
+		return (NULL);
+	}
+
+	/*
+	 * Write the DSA parameters and keys as a DSA private key
+	 * encoded in PEM.
+	 */
+	str = fheader("DSAkey", hostname);
+	pkey = EVP_PKEY_new();
+	EVP_PKEY_assign_DSA(pkey, dsa);
+	PEM_write_PrivateKey(str, pkey, passwd2 ? EVP_des_cbc() : NULL,
+	    NULL, 0, NULL, passwd2);
+	fclose(str);
+	if (debug)
+		DSA_print_fp(stdout, dsa, 0);
+	fslink(id, hostname);
+	return (pkey);
+}
+
+
+/*
+ * Generate Schnorr (IFF) parameters and keys
+ *
+ * The Schnorr (IFF)identity scheme is intended for use when
+ * certificates are generated by some other trusted certificate
+ * authority and the parameters cannot be conveyed in the certificate
+ * itself. For this purpose, new generations of IFF values must be
+ * securely transmitted to all members of the group before use. There
+ * are two kinds of files: server/client files that include private and
+ * public parameters and client files that include only public
+ * parameters. The scheme is self contained and independent of new
+ * generations of host keys, sign keys and certificates.
+ *
+ * The IFF values hide in a DSA cuckoo structure which uses the same
+ * parameters. The values are used by an identity scheme based on DSA
+ * cryptography and described in Stimson p. 285. The p is a 512-bit
+ * prime, g a generator of Zp* and q a 160-bit prime that divides p - 1
+ * and is a qth root of 1 mod p; that is, g^q = 1 mod p. The TA rolls a
+ * private random group key b (0 < b < q), then computes public
+ * v = g^(q - a). All values except the group key are known to all group
+ * members; the group key is known to the group servers, but not the
+ * group clients. Alice challenges Bob to confirm identity using the
+ * protocol described below.
+ */
+EVP_PKEY *			/* DSA cuckoo nest */
+gen_iff(
+	char	*id		/* file name id */
+	)
+{
+	EVP_PKEY *pkey;		/* private key */
+	DSA	*dsa;		/* DSA parameters */
+	u_char	seed[20];	/* seed for parameters */
+	BN_CTX	*ctx;		/* BN working space */
+	BIGNUM	*b, *r, *k, *u, *v, *w; /* BN temp */
+	FILE	*str;
+	u_int	temp;
+
+	/*
+	 * Generate DSA parameters for use as IFF parameters.
+	 */
+	fprintf(stderr, "Generating IFF parameters (%d bits)...\n",
+	    modulus);
+	RAND_bytes(seed, sizeof(seed));
+	dsa = DSA_generate_parameters(modulus, seed, sizeof(seed), NULL,
+	    NULL, cb, "IFF");
+	fprintf(stderr, "\n");
+	if (dsa == NULL) {
+		fprintf(stderr, "DSA generate parameters fails\n%s\n",
+		    ERR_error_string(ERR_get_error(), NULL));
+		rval = -1;
+		return (NULL);;
+	}
+
+	/*
+	 * Generate the private and public keys. The DSA parameters and
+	 * these keys are distributed to all members of the group.
+	 */
+	fprintf(stderr, "Generating IFF keys (%d bits)...\n", modulus);
+	b = BN_new(); r = BN_new(); k = BN_new();
+	u = BN_new(); v = BN_new(); w = BN_new(); ctx = BN_CTX_new();
+	BN_rand(b, BN_num_bits(dsa->q), -1, 0);	/* a */
+	BN_mod(b, b, dsa->q, ctx);
+	BN_sub(v, dsa->q, b);
+	BN_mod_exp(v, dsa->g, v, dsa->p, ctx); /* g^(q - b) mod p */
+	BN_mod_exp(u, dsa->g, b, dsa->p, ctx);	/* g^b mod p */
+	BN_mod_mul(u, u, v, dsa->p, ctx);
+	temp = BN_is_one(u);
+	fprintf(stderr,
+	    "Confirm g^(q - b) g^b = 1 mod p: %s\n", temp == 1 ?
+	    "yes" : "no");
+	if (!temp) {
+		BN_free(b); BN_free(r); BN_free(k);
+		BN_free(u); BN_free(v); BN_free(w); BN_CTX_free(ctx);
+		rval = -1;
+		return (NULL);
+	}
+	dsa->priv_key = BN_dup(b);		/* private key */
+	dsa->pub_key = BN_dup(v);		/* public key */
+
+	/*
+	 * Here is a trial round of the protocol. First, Alice rolls
+	 * random r (0 < r < q) and sends it to Bob. She needs only
+	 * modulus q.
+	 */
+	BN_rand(r, BN_num_bits(dsa->q), -1, 0);	/* r */
+	BN_mod(r, r, dsa->q, ctx);
+
+	/*
+	 * Bob rolls random k (0 < k < q), computes y = k + b r mod q
+	 * and x = g^k mod p, then sends (y, x) to Alice. He needs
+	 * moduli p, q and the group key b.
+	 */
+	BN_rand(k, BN_num_bits(dsa->q), -1, 0);	/* k, 0 < k < q  */
+	BN_mod(k, k, dsa->q, ctx);
+	BN_mod_mul(v, dsa->priv_key, r, dsa->q, ctx); /* b r mod q */
+	BN_add(v, v, k);
+	BN_mod(v, v, dsa->q, ctx);		/* y = k + b r mod q */
+	BN_mod_exp(u, dsa->g, k, dsa->p, ctx);	/* x = g^k mod p */
+
+	/*
+	 * Alice computes g^y v^r and verifies the result is equal to x.
+	 * She needs modulus p, generator g, and the public key v, as
+	 * well as her original r.
+	 */
+	BN_mod_exp(v, dsa->g, v, dsa->p, ctx); /* g^y mod p */
+	BN_mod_exp(w, dsa->pub_key, r, dsa->p, ctx); /* v^r */
+	BN_mod_mul(v, w, v, dsa->p, ctx);	/* product mod p */
+	temp = BN_cmp(u, v);
+	fprintf(stderr,
+	    "Confirm g^k = g^(k + b r) g^(q - b) r: %s\n", temp ==
+	    0 ? "yes" : "no");
+	BN_free(b); BN_free(r);	BN_free(k);
+	BN_free(u); BN_free(v); BN_free(w); BN_CTX_free(ctx);
+	if (temp != 0) {
+		DSA_free(dsa);
+		rval = -1;
+		return (NULL);
+	}
+
+	/*
+	 * Write the IFF server parameters and keys as a DSA private key
+	 * encoded in PEM.
+	 *
+	 * p	modulus p
+	 * q	modulus q
+	 * g	generator g
+	 * priv_key b
+	 * public_key v
+	 */
+	str = fheader("IFFpar", trustname);
+	pkey = EVP_PKEY_new();
+	EVP_PKEY_assign_DSA(pkey, dsa);
+	PEM_write_PrivateKey(str, pkey, passwd2 ? EVP_des_cbc() : NULL,
+	    NULL, 0, NULL, passwd2);
+	fclose(str);
+	if (debug)
+		DSA_print_fp(stdout, dsa, 0);
+	fslink(id, trustname);
+	return (pkey);
+}
+
+
+/*
+ * Generate Guillou-Quisquater (GQ) parameters and keys
+ *
+ * The Guillou-Quisquater (GQ) identity scheme is intended for use when
+ * the parameters, keys and certificates are generated by this program.
+ * The scheme uses a certificate extension field do convey the public
+ * key of a particular group identified by a group key known only to
+ * members of the group. The scheme is self contained and independent of
+ * new generations of host keys and sign keys.
+ *
+ * The GQ parameters hide in a RSA cuckoo structure which uses the same
+ * parameters. The values are used by an identity scheme based on RSA
+ * cryptography and described in Stimson p. 300 (with errors). The 512-
+ * bit public modulus is n = p q, where p and q are secret large primes.
+ * The TA rolls private random group key b as RSA exponent. These values
+ * are known to all group members.
+ *
+ * When rolling new certificates, a member recomputes the private and
+ * public keys. The private key u is a random roll, while the public key
+ * is the inverse obscured by the group key v = (u^-1)^b. These values
+ * replace the private and public keys normally generated by the RSA
+ * scheme. Alice challenges Bob to confirm identity using the protocol
+ * described below.
+ */
+EVP_PKEY *			/* RSA cuckoo nest */
+gen_gqpar(
+	char	*id		/* file name id */
+	)
+{
+	EVP_PKEY *pkey;		/* private key */
+	RSA	*rsa;		/* GQ parameters */
+	BN_CTX	*ctx;		/* BN working space */
+	FILE	*str;
+
+	/*
+	 * Generate RSA parameters for use as GQ parameters.
+	 */
+	fprintf(stderr,
+	    "Generating GQ parameters (%d bits)...\n", modulus);
+	rsa = RSA_generate_key(modulus, 3, cb, "GQ");
+	fprintf(stderr, "\n");
+	if (rsa == NULL) {
+		fprintf(stderr, "RSA generate keys fails\n%s\n",
+		    ERR_error_string(ERR_get_error(), NULL));
+		rval = -1;
+		return (NULL);
+	}
+
+	/*
+	 * Generate the group key b, which is saved in the e member of
+	 * the RSA structure. These values are distributed to all
+	 * members of the group, but shielded from all other groups. We
+	 * don't use all the parameters, but set the unused ones to a
+	 * small number to minimize the file size.
+	 */
+	ctx = BN_CTX_new();
+	BN_rand(rsa->e, BN_num_bits(rsa->n), -1, 0); /* b */
+	BN_mod(rsa->e, rsa->e, rsa->n, ctx);
+	BN_copy(rsa->d, BN_value_one());
+	BN_copy(rsa->p, BN_value_one());
+	BN_copy(rsa->q, BN_value_one());
+	BN_copy(rsa->dmp1, BN_value_one());
+	BN_copy(rsa->dmq1, BN_value_one());
+	BN_copy(rsa->iqmp, BN_value_one());
+
+	/*
+	 * Write the GQ parameters as a RSA private key encoded in PEM.
+	 * The public and private keys are filled in later.
+	 *
+	 * n	modulus n
+	 * e	group key b
+	 * (remaining values are not used)
+	 */
+	str = fheader("GQpar", trustname);
+	pkey = EVP_PKEY_new();
+	EVP_PKEY_assign_RSA(pkey, rsa);
+	PEM_write_PrivateKey(str, pkey, passwd2 ? EVP_des_cbc() : NULL,
+	    NULL, 0, NULL, passwd2);
+	fclose(str);
+	if (debug)
+		RSA_print_fp(stdout, rsa, 0);
+	fslink(id, trustname);
+	return (pkey);
+}
+
+
+/*
+ * Update Guillou-Quisquater (GQ) parameters
+ */
+EVP_PKEY *			/* RSA cuckoo nest */
+gen_gqkey(
+	char	*id,		/* file name id */
+	EVP_PKEY *gqpar		/* GQ parameters */
+	)
+{
+	EVP_PKEY *pkey;		/* private key */
+	RSA	*rsa;		/* RSA parameters */
+	BN_CTX	*ctx;		/* BN working space */
+	BIGNUM	*u, *v, *g, *k, *r, *y; /* BN temps */
+	FILE	*str;
+	u_int	temp;
+
+	/*
+	 * Generate GQ keys. Note that the group key b is the e member
+	 * of
+	 * the GQ parameters.
+	 */
+	fprintf(stderr, "Updating GQ keys (%d bits)...\n", modulus);
+	ctx = BN_CTX_new(); u = BN_new(); v = BN_new();
+	g = BN_new(); k = BN_new(); r = BN_new(); y = BN_new();
+
+	/*
+	 * When generating his certificate, Bob rolls random private key
+	 * u. 
+	 */
+	rsa = gqpar->pkey.rsa;
+	BN_rand(u, BN_num_bits(rsa->n), -1, 0); /* u */
+	BN_mod(u, u, rsa->n, ctx);
+	BN_mod_inverse(v, u, rsa->n, ctx);	/* u^-1 mod n */
+	BN_mod_mul(k, v, u, rsa->n, ctx);
+
+	/*
+	 * Bob computes public key v = (u^-1)^b, which is saved in an
+	 * extension field on his certificate. We check that u^b v =
+	 * 1 mod n.
+	 */
+	BN_mod_exp(v, v, rsa->e, rsa->n, ctx);
+	BN_mod_exp(g, u, rsa->e, rsa->n, ctx); /* u^b */
+	BN_mod_mul(g, g, v, rsa->n, ctx); /* u^b (u^-1)^b */
+	temp = BN_is_one(g);
+	fprintf(stderr,
+	    "Confirm u^b (u^-1)^b = 1 mod n: %s\n", temp ? "yes" :
+	    "no");
+	if (!temp) {
+		BN_free(u); BN_free(v);
+		BN_free(g); BN_free(k); BN_free(r); BN_free(y);
+		BN_CTX_free(ctx);
+		RSA_free(rsa);
+		rval = -1;
+		return (NULL);
+	}
+	BN_copy(rsa->p, u);			/* private key */
+	BN_copy(rsa->q, v);			/* public key */
+
+	/*
+	 * Here is a trial run of the protocol. First, Alice rolls
+	 * random r (0 < r < n) and sends it to Bob. She needs only
+	 * modulus n from the parameters.
+	 */
+	BN_rand(r, BN_num_bits(rsa->n), -1, 0);	/* r */
+	BN_mod(r, r, rsa->n, ctx);
+
+	/*
+	 * Bob rolls random k (0 < k < n), computes y = k u^r mod n and
+	 * g = k^b mod n, then sends (y, g) to Alice. He needs modulus n
+	 * from the parameters and his private key u. 
+	 */
+	BN_rand(k, BN_num_bits(rsa->n), -1, 0);	/* k */
+	BN_mod(k, k, rsa->n, ctx);
+	BN_mod_exp(y, rsa->p, r, rsa->n, ctx);	/* u^r mod n */
+	BN_mod_mul(y, k, y, rsa->n, ctx);	/* y = k u^r mod n */
+	BN_mod_exp(g, k, rsa->e, rsa->n, ctx); /* g = k^b mod n */
+
+	/*
+	 * Alice computes v^r y^b mod n and verifies the result is equal
+	 * to g. She needs modulus n, generator g and group key b from
+	 * the parameters and Bob's public key v = (u^-1)^b from his
+	 * certificate.
+	 */
+	BN_mod_exp(v, rsa->q, r, rsa->n, ctx);	/* v^r mod n */
+	BN_mod_exp(y, y, rsa->e, rsa->n, ctx); /* y^b mod n */
+	BN_mod_mul(y, v, y, rsa->n, ctx);	/* v^r y^b mod n */
+	temp = BN_cmp(y, g);
+	fprintf(stderr, "Confirm g^k = v^r y^b mod n: %s\n", temp == 0 ?
+	    "yes" : "no");
+	BN_CTX_free(ctx); BN_free(u); BN_free(v);
+	BN_free(g); BN_free(k); BN_free(r); BN_free(y);
+	if (temp != 0) {
+		RSA_free(rsa);
+		rval = -1;
+		return (NULL);
+	}
+
+	/*
+	 * Write the GQ parameters and keys as a RSA private key encoded
+	 * in PEM.
+	 *
+	 * n	modulus n
+	 * e	group key b
+	 * p	private key u
+	 * q	public key (u^-1)^b
+	 * (remaining values are not used)
+	 */
+	str = fheader("GQpar", trustname);
+	pkey = EVP_PKEY_new();
+	EVP_PKEY_assign_RSA(pkey, rsa);
+	PEM_write_PrivateKey(str, pkey, passwd2 ? EVP_des_cbc() : NULL,
+	    NULL, 0, NULL, passwd2);
+	fclose(str);
+	if (debug)
+		RSA_print_fp(stdout, rsa, 0);
+	fslink(id, trustname);
+	return (pkey);
+}
+
+
+/*
+ * Generate Mu-Varadharajan (MV) parameters and keys
+ *
+ * The Mu-Varadharajan (MV) cryptosystem is useful when servers
+ * broadcast messages to clients, but clients never send messages to
+ * servers. There is one encryption key for the server and a separate
+ * decryption key for each client. It operates something like a
+ * pay-per-view satellite broadcasting system where the session key is
+ * encrypted by the broadcaster and the decryption keys are held in a
+ * tamperproof set-top box. We don't use it this way, but read on.
+ *
+ * The MV parameters and private encryption key hide in a DSA cuckoo
+ * structure which uses the same parameters, but generated in a
+ * different way. The values are used in an encryption scheme similar to
+ * El Gamal cryptography and a polynomial formed from the expansion of
+ * product terms (x - x[j]), as described in Mu, Y., and V.
+ * Varadharajan: Robust and Secure Broadcasting, Proc. Indocrypt 2001,
+ * 223-231. The paper has significant errors and serious omissions.
+ *
+ * Let q be the product of n distinct primes s'[j] (j = 1...n), where
+ * each s'[j] has m significant bits. Let p be a prime p = 2 * q + 1, so
+ * that q and each s'[j] divide p - 1 and p has M = n * m + 1
+ * significant bits. Let g be a generator of Zp; that is, gcd(g, p - 1)
+ * = 1 and g^q = 1 mod p. We do modular arithmetic over Zq and then
+ * project into Zp* as exponents of g. Sometimes we have to compute an
+ * inverse b^-1 of random b in Zq, but for that purpose we require
+ * gcd(b, q) = 1. We expect M to be in the 500-bit range and n
+ * relatively small, like 30. Associated with each s'[j] is an element
+ * s[j] such that s[j] s'[j] = s'[j] mod q. We find s[j] as the quotient
+ * (q + s'[j]) / s'[j]. These are the parameters of the scheme and they
+ * are expensive to compute.
+ *
+ * We set up an instance of the scheme as follows. A set of random
+ * values x[j] mod q (j = 1...n), are generated as the zeros of a
+ * polynomial of order n. The product terms (x - x[j]) are expanded to
+ * form coefficients a[i] mod q (i = 0...n) in powers of x. These are
+ * used as exponents of the generator g mod p to generate the private
+ * encryption key A. The pair (gbar, ghat) of public server keys and the
+ * pairs (xbar[j], xhat[j]) (j = 1...n) of private client keys are used
+ * to construct the decryption keys. The devil is in the details.
+ *
+ * This routine generates a private encryption file including the
+ * private encryption key E and public key (gbar, ghat). It then
+ * generates decryption files including the private key (xbar[j],
+ * xhat[j]) for each client. E is a permutation that encrypts a block
+ * y = E x. The jth client computes the inverse permutation E^-1 =
+ * gbar^xhat[j] ghat^xbar[j] and decrypts the block x = E^-1 y.
+ *
+ * The distinguishing characteristic of this scheme is the capability to
+ * revoke keys. Included in the calculation of E, gbar and ghat is the
+ * product s = prod(s'[j]) (j = 1...n) above. If the factor s'[j] is
+ * subsequently removed from the product and E, gbar and ghat
+ * recomputed, the jth client will no longer be able to compute E^-1 and
+ * thus unable to decrypt the block.
+ */
+EVP_PKEY *			/* DSA cuckoo nest */
+gen_mv(
+	char	*id		/* file name id */
+	)
+{
+	EVP_PKEY *pkey;		/* private key */
+	DSA	*dsa;		/* DSA parameters */
+	DSA	*sdsa;		/* DSA parameters */
+	BN_CTX	*ctx;		/* BN working space */
+	BIGNUM	**x;		/* polynomial zeros vector */
+	BIGNUM	**a;		/* polynomial coefficient vector */
+	BIGNUM	**g;		/* public key vector */
+	BIGNUM	**s, **s1;	/* private enabling keys */
+	BIGNUM	**xbar, **xhat;	/* private keys vector */
+	BIGNUM	*b;		/* group key */
+	BIGNUM	*b1;		/* inverse group key */
+	BIGNUM	*ss;		/* enabling key */
+	BIGNUM	*biga;		/* master encryption key */
+	BIGNUM	*bige;		/* session encryption key */
+	BIGNUM	*gbar, *ghat;	/* public key */
+	BIGNUM	*u, *v, *w;	/* BN scratch */
+	int	i, j, n;
+	FILE	*str;
+	u_int	temp;
+	char	ident[20];
+
+	/*
+	 * Generate MV parameters.
+	 *
+	 * The object is to generate a multiplicative group Zp* modulo a
+	 * prime p and a subset Zq mod q, where q is the product of n
+	 * distinct primes s'[j] (j = 1...n) and q divides p - 1. We
+	 * first generate n distinct primes, which may have to be
+	 * regenerated later. As a practical matter, it is tough to find
+	 * more than 31 distinct primes for modulus 512 or 61 primes for
+	 * modulus 1024. The latter can take several hundred iterations
+	 * and several minutes on a Sun Blade 1000.
+	 */
+	n = nkeys;
+	fprintf(stderr,
+	    "Generating MV parameters for %d keys (%d bits)...\n", n,
+	    modulus / n);
+	ctx = BN_CTX_new(); u = BN_new(); v = BN_new(); w = BN_new();
+	b = BN_new(); b1 = BN_new();
+	dsa = malloc(sizeof(DSA));
+	dsa->p = BN_new();
+	dsa->q = BN_new();
+	dsa->g = BN_new();
+	s = malloc((n + 1) * sizeof(BIGNUM));
+	s1 = malloc((n + 1) * sizeof(BIGNUM));
+	for (j = 1; j <= n; j++)
+		s1[j] = BN_new();
+	temp = 0;
+	for (j = 1; j <= n; j++) {
+		while (1) {
+			fprintf(stderr, "Birthdays %d\r", temp);
+			BN_generate_prime(s1[j], modulus / n, 0, NULL,
+			    NULL, NULL, NULL);
+			for (i = 1; i < j; i++) {
+				if (BN_cmp(s1[i], s1[j]) == 0)
+					break;
+			}
+			if (i == j)
+				break;
+			temp++;
+		}
+	}
+	fprintf(stderr, "Birthday keys rejected %d\n", temp);
+
+	/*
+	 * Compute the modulus q as the product of the primes. Compute
+	 * the modulus p as 2 * q + 1 and test p for primality. If p
+	 * is composite, replace one of the primes with a new distinct
+	 * one and try again. Note that q will hardly be a secret since
+	 * we have to reveal p to servers and clients. However,
+	 * factoring q to find the primes should be adequately hard, as
+	 * this is the same problem considered hard in RSA. Question: is
+	 * it as hard to find n small prime factors totalling n bits as
+	 * it is to find two large prime factors totalling n bits?
+	 * Remember, the bad guy doesn't know n.
+	 */
+	temp = 0;
+	while (1) {
+		fprintf(stderr, "Duplicate keys rejected %d\r", ++temp);
+		BN_one(dsa->q);
+		for (j = 1; j <= n; j++)
+			BN_mul(dsa->q, dsa->q, s1[j], ctx);
+		BN_copy(dsa->p, dsa->q);
+		BN_add(dsa->p, dsa->p, dsa->p);
+		BN_add_word(dsa->p, 1);
+		if (BN_is_prime(dsa->p, BN_prime_checks, NULL, ctx,
+		    NULL))
+			break;
+
+		j = temp % n + 1;
+		while (1) {
+			BN_generate_prime(u, modulus / n, 0, 0, NULL,
+			    NULL, NULL);
+			for (i = 1; i <= n; i++) {
+				if (BN_cmp(u, s1[i]) == 0)
+					break;
+			}
+			if (i > n)
+				break;
+		}
+		BN_copy(s1[j], u);
+	}
+	fprintf(stderr, "Duplicate keys rejected %d\n", temp);
+
+	/*
+	 * Compute the generator g using a random roll such that
+	 * gcd(g, p - 1) = 1 and g^q = 1. This is a generator of p, not
+	 * q.
+	 */
+	BN_copy(v, dsa->p);
+	BN_sub_word(v, 1);
+	while (1) {
+		BN_rand(dsa->g, BN_num_bits(dsa->p) - 1, 0, 0);
+		BN_mod(dsa->g, dsa->g, dsa->p, ctx);
+		BN_gcd(u, dsa->g, v, ctx);
+		if (!BN_is_one(u))
+			continue;
+
+		BN_mod_exp(u, dsa->g, dsa->q, dsa->p, ctx);
+		if (BN_is_one(u))
+			break;
+	}
+
+	/*
+	 * Compute s[j] such that s[j] * s'[j] = s'[j] for all j. The
+	 * easy way to do this is to compute q + s'[j] and divide the
+	 * result by s'[j]. Exercise for the student: prove the
+	 * remainder is always zero.
+	 */
+	for (j = 1; j <= n; j++) {
+		s[j] = BN_new();
+		BN_add(s[j], dsa->q, s1[j]);
+		BN_div(s[j], u, s[j], s1[j], ctx);
+	}
+
+	/*
+	 * Setup is now complete. Roll random polynomial roots x[j]
+	 * (0 < x[j] < q) for all j. While it may not be strictly
+	 * necessary, Make sure each root has no factors in common with
+	 * q.
+	 */
+	fprintf(stderr,
+	    "Generating polynomial coefficients for %d roots (%d bits)\n",
+	    n, BN_num_bits(dsa->q)); 
+	x = malloc((n + 1) * sizeof(BIGNUM));
+	for (j = 1; j <= n; j++) {
+		x[j] = BN_new();
+		while (1) {
+			BN_rand(x[j], BN_num_bits(dsa->q), 0, 0);
+			BN_mod(x[j], x[j], dsa->q, ctx);
+			BN_gcd(u, x[j], dsa->q, ctx);
+			if (BN_is_one(u))
+				break;
+		}
+	}
+
+	/*
+	 * Generate polynomial coefficients a[i] (i = 0...n) from the
+	 * expansion of root products (x - x[j]) mod q for all j. The
+	 * method is a present from Charlie Boncelet.
+	 */
+	a = malloc((n + 1) * sizeof(BIGNUM));
+	for (i = 0; i <= n; i++) {
+		a[i] = BN_new();
+		BN_one(a[i]);
+	}
+	for (j = 1; j <= n; j++) {
+		BN_zero(w);
+		for (i = 0; i < j; i++) {
+			BN_copy(u, dsa->q);
+			BN_mod_mul(v, a[i], x[j], dsa->q, ctx);
+			BN_sub(u, u, v);
+			BN_add(u, u, w);
+			BN_copy(w, a[i]);
+			BN_mod(a[i], u, dsa->q, ctx);
+		}
+	}
+
+	/*
+	 * Generate g[i] = g^a[i] mod p for all i and the generator g.
+	 */
+	fprintf(stderr, "Generating g[i] parameters\n");
+	g = malloc((n + 1) * sizeof(BIGNUM));
+	for (i = 0; i <= n; i++) {
+		g[i] = BN_new();
+		BN_mod_exp(g[i], dsa->g, a[i], dsa->p, ctx);
+	}
+
+	/*
+	 * Verify prod(g[i]^(a[i] x[j]^i)) = 1 for all i, j; otherwise,
+	 * exit. Note the a[i] x[j]^i exponent is computed mod q, but
+	 * the g[i] is computed mod p. also note the expression given in
+	 * the paper is incorrect.
+	 */
+	temp = 1;
+	for (j = 1; j <= n; j++) {
+		BN_one(u);
+		for (i = 0; i <= n; i++) {
+			BN_set_word(v, i);
+			BN_mod_exp(v, x[j], v, dsa->q, ctx);
+			BN_mod_mul(v, v, a[i], dsa->q, ctx);
+			BN_mod_exp(v, dsa->g, v, dsa->p, ctx);
+			BN_mod_mul(u, u, v, dsa->p, ctx);
+		}
+		if (!BN_is_one(u))
+			temp = 0;
+	}
+	fprintf(stderr,
+	    "Confirm prod(g[i]^(x[j]^i)) = 1 for all i, j: %s\n", temp ?
+	    "yes" : "no");
+	if (!temp) {
+		rval = -1;
+		return (NULL);
+	}
+
+	/*
+	 * Make private encryption key A. Keep it around for awhile,
+	 * since it is expensive to compute.
+	 */
+	biga = BN_new();
+	BN_one(biga);
+	for (j = 1; j <= n; j++) {
+		for (i = 0; i < n; i++) {
+			BN_set_word(v, i);
+			BN_mod_exp(v, x[j], v, dsa->q, ctx);
+			BN_mod_exp(v, g[i], v, dsa->p, ctx);
+			BN_mod_mul(biga, biga, v, dsa->p, ctx);
+		}
+	}
+
+	/*
+	 * Roll private random group key b mod q (0 < b < q), where
+	 * gcd(b, q) = 1 to guarantee b^1 exists, then compute b^-1
+	 * mod q. If b is changed, the client keys must be recomputed.
+	 */
+	while (1) {
+		BN_rand(b, BN_num_bits(dsa->q), 0, 0);
+		BN_mod(b, b, dsa->q, ctx);
+		BN_gcd(u, b, dsa->q, ctx);
+		if (BN_is_one(u))
+			break;
+	}
+	BN_mod_inverse(b1, b, dsa->q, ctx);
+
+	/*
+	 * Make private client keys (xbar[j], xhat[j]) for all j. Note
+	 * that the keys for the jth client involve s[j], but not s'[j]
+	 * or the product s = prod(s'[j]) mod q, which is the enabling
+	 * key.
+	 */
+	xbar = malloc((n + 1) * sizeof(BIGNUM));
+	xhat = malloc((n + 1) * sizeof(BIGNUM));
+	for (j = 1; j <= n; j++) {
+		xbar[j] = BN_new(); xhat[j] = BN_new();
+		BN_zero(xbar[j]);
+		BN_set_word(v, n);
+		for (i = 1; i <= n; i++) {
+			if (i == j)
+				continue;
+			BN_mod_exp(u, x[i], v, dsa->q, ctx);
+			BN_add(xbar[j], xbar[j], u);
+		}
+		BN_mod_mul(xbar[j], xbar[j], b1, dsa->q, ctx);
+		BN_mod_exp(xhat[j], x[j], v, dsa->q, ctx);
+		BN_mod_mul(xhat[j], xhat[j], s[j], dsa->q, ctx);
+	}
+
+	/*
+	 * The enabling key is initially q by construction. We can
+	 * revoke client j by dividing q by s'[j]. The quotient becomes
+	 * the enabling key s. Note we always have to revoke one key;
+	 * otherwise, the plaintext and cryptotext would be identical.
+	 */
+	ss = BN_new();
+	BN_copy(ss, dsa->q);
+	BN_div(ss, u, dsa->q, s1[n], ctx);
+
+	/*
+	 * Make private server encryption key E = A^s and public server
+	 * keys gbar = g^s mod p and ghat = g^(s b) mod p. The (gbar,
+	 * ghat) is the public key provided to the server, which uses it
+	 * to compute the session encryption key and public key included
+	 * in its messages. These values must be regenerated if the
+	 * enabling key is changed.
+	 */
+	bige = BN_new(); gbar = BN_new(); ghat = BN_new();
+	BN_mod_exp(bige, biga, ss, dsa->p, ctx);
+	BN_mod_exp(gbar, dsa->g, ss, dsa->p, ctx);
+	BN_mod_mul(v, ss, b, dsa->q, ctx);
+	BN_mod_exp(ghat, dsa->g, v, dsa->p, ctx);
+
+	/*
+	 * We produce the key media in three steps. The first step is to
+	 * generate the private values that do not depend on the
+	 * enabling key. These include the server values p, q, g, b, A
+	 * and the client values s'[j], xbar[j] and xhat[j] for each j.
+	 * The p, xbar[j] and xhat[j] values are encoded in private
+	 * files which are distributed to respective clients. The p, q,
+	 * g, A and s'[j] values (will be) written to a secret file to
+	 * be read back later.
+	 *
+	 * The secret file (will be) read back at some later time to
+	 * enable/disable individual keys and generate/regenerate the
+	 * enabling key s. The p, q, E, gbar and ghat values are written
+	 * to a secret file to be read back later by the server.
+	 *
+	 * The server reads the secret file and rolls the session key
+	 * k, which is used only once, then computes E^k, gbar^k and
+	 * ghat^k. The E^k is the session encryption key. The encrypted
+	 * data, gbar^k and ghat^k are transmtted to clients in an
+	 * extension field. The client receives the message and computes
+	 * x = (gbar^k)^xbar[j] (ghat^k)^xhat[j], finds the session
+	 * encryption key E^k as the inverse x^-1 and decrypts the data.
+	 */
+	BN_copy(dsa->g, bige);
+	dsa->priv_key = BN_dup(gbar);
+	dsa->pub_key = BN_dup(ghat);
+
+	/*
+	 * Write the MV server parameters and keys as a DSA private key
+	 * encoded in PEM.
+	 *
+	 * p	modulus p
+	 * q	modulus q (used only to generate k)
+	 * g	E mod p
+	 * priv_key gbar mod p
+	 * pub_key ghat mod p
+	 */
+	str = fheader("MVpar", trustname);
+	pkey = EVP_PKEY_new();
+	EVP_PKEY_assign_DSA(pkey, dsa);
+	PEM_write_PrivateKey(str, pkey, passwd2 ? EVP_des_cbc() : NULL,
+	    NULL, 0, NULL, passwd2);
+	fclose(str);
+	if (debug)
+		DSA_print_fp(stdout, dsa, 0);
+	fslink(id, trustname);
+
+	/*
+	 * Write the parameters and private key (xbar[j], xhat[j]) for
+	 * all j as a DSA private key encoded in PEM. It is used only by
+	 * the designated recipient(s) who pay a suitably outrageous fee
+	 * for its use.
+	 */
+	sdsa = malloc(sizeof(DSA));
+	sdsa->p = BN_dup(dsa->p);
+	sdsa->q = BN_dup(BN_value_one());
+	sdsa->g = BN_dup(BN_value_one());
+	sdsa->priv_key = BN_new();
+	sdsa->pub_key = BN_new();
+	for (j = 1; j <= n; j++) {
+		BN_copy(sdsa->priv_key, xbar[j]);
+		BN_copy(sdsa->pub_key, xhat[j]);
+		BN_mod_exp(v, dsa->priv_key, sdsa->pub_key, dsa->p,
+		    ctx);
+		BN_mod_exp(u, dsa->pub_key, sdsa->priv_key, dsa->p,
+		    ctx);
+		BN_mod_mul(u, u, v, dsa->p, ctx);
+		BN_mod_mul(u, u, dsa->g, dsa->p, ctx);
+		BN_free(xbar[j]); BN_free(xhat[j]);
+		BN_free(x[j]); BN_free(s[j]); BN_free(s1[j]);
+		if (!BN_is_one(u)) {
+			fprintf(stderr, "Revoke key %d\n", j);
+			continue;
+		}
+
+		/*
+		 * Write the client parameters as a DSA private key
+		 * encoded in PEM. We don't make links for these.
+		 *
+		 * p	modulus p
+		 * priv_key xbar[j] mod q
+		 * pub_key xhat[j] mod q
+		 * (remaining values are not used)
+		 */
+		sprintf(ident, "MVkey%d", j);
+		str = fheader(ident, trustname);
+		pkey = EVP_PKEY_new();
+		EVP_PKEY_assign_DSA(pkey, sdsa);
+		PEM_write_PrivateKey(str, pkey, passwd2 ?
+		    EVP_des_cbc() : NULL, NULL, 0, NULL, passwd2);
+		fclose(str);
+		fprintf(stderr, "ntpkey_%s_%s.%lu\n", ident, trustname,
+		    epoch + JAN_1970);
+		if (debug)
+			DSA_print_fp(stdout, sdsa, 0);
+	}
+
+	/*
+	 * Free the countries.
+	 */
+	for (i = 0; i <= n; i++) {
+		BN_free(a[i]);
+		BN_free(g[i]);
+	}
+	BN_free(u); BN_free(v); BN_free(w); BN_CTX_free(ctx);
+	BN_free(b); BN_free(b1); BN_free(biga); BN_free(bige);
+	BN_free(ss); BN_free(gbar); BN_free(ghat);
+	DSA_free(dsa); DSA_free(sdsa);
+
+	/*
+	 * Free the world.
+	 */
+	free(x); free(a); free(g); free(s); free(s1);
+	free(xbar); free(xhat);
+	return (pkey);
+}
+
+
+/*
+ * Generate X509v3 scertificate.
+ *
+ * The certificate consists of the version number, serial number,
+ * validity interval, issuer name, subject name and public key. For a
+ * self-signed certificate, the issuer name is the same as the subject
+ * name and these items are signed using the subject private key. The
+ * validity interval extends from the current time to the same time one
+ * year hence. For NTP purposes, it is convenient to use the NTP seconds
+ * of the current time as the serial number.
+ */
+int
+x509	(
+	EVP_PKEY *pkey,		/* generic signature algorithm */
+	const EVP_MD *md,	/* generic digest algorithm */
+	char	*gqpub,		/* identity extension (hex string) */
+	char	*exten		/* private cert extension */
+	)
+{
+	X509	*cert;		/* X509 certificate */
+	X509_NAME *subj;	/* distinguished (common) name */
+	X509_EXTENSION *ex;	/* X509v3 extension */
+	FILE	*str;		/* file handle */
+	ASN1_INTEGER *serial;	/* serial number */
+	const char *id;		/* digest/signature scheme name */
+	char	pathbuf[MAXFILENAME + 1];
+
+	/*
+	 * Generate X509 self-signed certificate.
+	 *
+	 * Set the certificate serial to the NTP seconds for grins. Set
+	 * the version to 3. Set the subject name and issuer name to the
+	 * subject name in the request. Set the initial validity to the
+	 * current time and the final validity one year hence. 
+	 */
+	id = OBJ_nid2sn(md->pkey_type);
+	fprintf(stderr, "Generating certificate %s\n", id);
+	cert = X509_new();
+	X509_set_version(cert, 2L);
+	serial = ASN1_INTEGER_new();
+	ASN1_INTEGER_set(serial, epoch + JAN_1970);
+	X509_set_serialNumber(cert, serial);
+	ASN1_INTEGER_free(serial);
+	X509_gmtime_adj(X509_get_notBefore(cert), 0L);
+	X509_gmtime_adj(X509_get_notAfter(cert), YEAR);
+	subj = X509_get_subject_name(cert);
+	X509_NAME_add_entry_by_txt(subj, "commonName", MBSTRING_ASC,
+	    (unsigned char *) hostname, strlen(hostname), -1, 0);
+	subj = X509_get_issuer_name(cert);
+	X509_NAME_add_entry_by_txt(subj, "commonName", MBSTRING_ASC,
+	    (unsigned char *) trustname, strlen(trustname), -1, 0);
+	if (!X509_set_pubkey(cert, pkey)) {
+		fprintf(stderr, "Assign key fails\n%s\n",
+		    ERR_error_string(ERR_get_error(), NULL));
+		X509_free(cert);
+		rval = -1;
+		return (0);
+	}
+
+	/*
+	 * Add X509v3 extensions if present. These represent the minimum
+	 * set defined in RFC3280 less the certificate_policy extension,
+	 * which is seriously obfuscated in OpenSSL.
+	 */
+	/*
+	 * The basic_constraints extension CA:TRUE allows servers to
+	 * sign client certficitates.
+	 */
+	fprintf(stderr, "%s: %s\n", LN_basic_constraints,
+	    BASIC_CONSTRAINTS);
+	ex = X509V3_EXT_conf_nid(NULL, NULL, NID_basic_constraints,
+	    BASIC_CONSTRAINTS);
+	if (!X509_add_ext(cert, ex, -1)) {
+		fprintf(stderr, "Add extension field fails\n%s\n",
+		    ERR_error_string(ERR_get_error(), NULL));
+		rval = -1;
+		return (0);
+	}
+	X509_EXTENSION_free(ex);
+
+	/*
+	 * The key_usage extension designates the purposes the key can
+	 * be used for.
+	 */
+	fprintf(stderr, "%s: %s\n", LN_key_usage, KEY_USAGE);
+	ex = X509V3_EXT_conf_nid(NULL, NULL, NID_key_usage, KEY_USAGE);
+	if (!X509_add_ext(cert, ex, -1)) {
+		fprintf(stderr, "Add extension field fails\n%s\n",
+		    ERR_error_string(ERR_get_error(), NULL));
+		rval = -1;
+		return (0);
+	}
+	X509_EXTENSION_free(ex);
+	/*
+	 * The subject_key_identifier is used for the GQ public key.
+	 * This should not be controversial.
+	 */
+	if (gqpub != NULL) {
+		fprintf(stderr, "%s\n", LN_subject_key_identifier);
+		ex = X509V3_EXT_conf_nid(NULL, NULL,
+		    NID_subject_key_identifier, gqpub);
+		if (!X509_add_ext(cert, ex, -1)) {
+			fprintf(stderr,
+			    "Add extension field fails\n%s\n",
+			    ERR_error_string(ERR_get_error(), NULL));
+			rval = -1;
+			return (0);
+		}
+		X509_EXTENSION_free(ex);
+	}
+
+	/*
+	 * The extended key usage extension is used for special purpose
+	 * here. The semantics probably do not conform to the designer's
+	 * intent and will likely change in future.
+	 * 
+	 * "trustRoot" designates a root authority
+	 * "private" designates a private certificate
+	 */
+	if (exten != NULL) {
+		fprintf(stderr, "%s: %s\n", LN_ext_key_usage, exten);
+		ex = X509V3_EXT_conf_nid(NULL, NULL,
+		    NID_ext_key_usage, exten);
+		if (!X509_add_ext(cert, ex, -1)) {
+			fprintf(stderr,
+			    "Add extension field fails\n%s\n",
+			    ERR_error_string(ERR_get_error(), NULL));
+			rval = -1;
+			return (0);
+		}
+		X509_EXTENSION_free(ex);
+	}
+
+	/*
+	 * Sign and verify.
+	 */
+	X509_sign(cert, pkey, md);
+	if (!X509_verify(cert, pkey)) {
+		fprintf(stderr, "Verify %s certificate fails\n%s\n", id,
+		    ERR_error_string(ERR_get_error(), NULL));
+		X509_free(cert);
+		rval = -1;
+		return (0);
+	}
+
+	/*
+	 * Write the certificate encoded in PEM.
+	 */
+	sprintf(pathbuf, "%scert", id);
+	str = fheader(pathbuf, hostname);
+	PEM_write_X509(str, cert);
+	fclose(str);
+	if (debug)
+		X509_print_fp(stdout, cert);
+	X509_free(cert);
+	fslink("cert", hostname);
+	return (1);
+}
+
+#if 0	/* asn2ntp is not used */
+/*
+ * asn2ntp - convert ASN1_TIME time structure to NTP time
+ */
+u_long
+asn2ntp	(
+	ASN1_TIME *asn1time	/* pointer to ASN1_TIME structure */
+	)
+{
+	char	*v;		/* pointer to ASN1_TIME string */
+	struct	tm tm;		/* time decode structure time */
+
+	/*
+	 * Extract time string YYMMDDHHMMSSZ from ASN.1 time structure.
+	 * Note that the YY, MM, DD fields start with one, the HH, MM,
+	 * SS fiels start with zero and the Z character should be 'Z'
+	 * for UTC. Also note that years less than 50 map to years
+	 * greater than 100. Dontcha love ASN.1?
+	 */
+	if (asn1time->length > 13)
+		return (-1);
+	v = (char *)asn1time->data;
+	tm.tm_year = (v[0] - '0') * 10 + v[1] - '0';
+	if (tm.tm_year < 50)
+		tm.tm_year += 100;
+	tm.tm_mon = (v[2] - '0') * 10 + v[3] - '0' - 1;
+	tm.tm_mday = (v[4] - '0') * 10 + v[5] - '0';
+	tm.tm_hour = (v[6] - '0') * 10 + v[7] - '0';
+	tm.tm_min = (v[8] - '0') * 10 + v[9] - '0';
+	tm.tm_sec = (v[10] - '0') * 10 + v[11] - '0';
+	tm.tm_wday = 0;
+	tm.tm_yday = 0;
+	tm.tm_isdst = 0;
+	return (mktime(&tm) + JAN_1970);
+}
+#endif
+
+/*
+ * Callback routine
+ */
+void
+cb	(
+	int	n1,		/* arg 1 */
+	int	n2,		/* arg 2 */
+	void	*chr		/* arg 3 */
+	)
+{
+	switch (n1) {
+	case 0:
+		d0++;
+		fprintf(stderr, "%s %d %d %lu\r", (char *)chr, n1, n2,
+		    d0);
+		break;
+	case 1:
+		d1++;
+		fprintf(stderr, "%s\t\t%d %d %lu\r", (char *)chr, n1,
+		    n2, d1);
+		break;
+	case 2:
+		d2++;
+		fprintf(stderr, "%s\t\t\t\t%d %d %lu\r", (char *)chr,
+		    n1, n2, d2);
+		break;
+	case 3:
+		d3++;
+		fprintf(stderr, "%s\t\t\t\t\t\t%d %d %lu\r",
+		    (char *)chr, n1, n2, d3);
+		break;
+	}
+}
+#endif /* OPENSSL */
+
+
+/*
+ * Generate key
+ */
+EVP_PKEY *			/* public/private key pair */
+genkey(
+	char	*type,		/* key type (RSA or DSA) */
+	char	*id		/* file name id */
+	)
+{
+	if (type == NULL)
+		return (NULL);
+	if (strcmp(type, "RSA") == 0)
+		return (gen_rsa(id));
+
+	else if (strcmp(type, "DSA") == 0)
+		return (gen_dsa(id));
+
+	fprintf(stderr, "Invalid %s key type %s\n", id, type);
+	rval = -1;
+	return (NULL);
+}
+
+
+/*
+ * Generate file header
+ */
+FILE *
+fheader	(
+	const char *id,		/* file name id */
+	const char *name	/* owner name */
+	)
+{
+	FILE	*str;		/* file handle */
+
+	sprintf(filename, "ntpkey_%s_%s.%lu", id, name, epoch +
+	    JAN_1970);
+	if ((str = fopen(filename, "w")) == NULL) {
+		perror("Write");
+		exit (-1);
+	}
+	fprintf(str, "# %s\n# %s", filename, ctime(&epoch));
+	return (str);
+}
+
+
+/*
+ * Generate symbolic links
+ */
+void
+fslink(
+	const char *id,		/* file name id */
+	const char *name	/* owner name */
+	)
+{
+	char	linkname[MAXFILENAME]; /* link name */
+	int	temp;
+
+	sprintf(linkname, "ntpkey_%s_%s", id, name);
+	remove(linkname);
+	temp = symlink(filename, linkname);
+	if (temp < 0)
+		perror(id);
+	fprintf(stderr, "Generating new %s file and link\n", id);
+	fprintf(stderr, "%s->%s\n", linkname, filename);
+}
diff --git a/contrib/ntp/util/ntptime.c b/contrib/ntp/util/ntptime.c
index 81bd2be..51111be 100644
--- a/contrib/ntp/util/ntptime.c
+++ b/contrib/ntp/util/ntptime.c
@@ -54,7 +54,6 @@
  */
 char *sprintb		P((u_int, const char *));
 const char *timex_state	P((int));
-volatile int debug = 0;
 
 #ifdef SIGSYS
 void pll_trap		P((int));
@@ -89,13 +88,13 @@ main(
 	double ftemp, gtemp, htemp;
 	long time_frac;				/* ntv.time.tv_frac_sec (us/ns) */
 	l_fp ts;
-	unsigned ts_mask = TS_MASK;		/* defaults to 20 bits (us) */
-	unsigned ts_roundbit = TS_ROUNDBIT;	/* defaults to 20 bits (us) */
-	int fdigits = 6;			/* fractional digits for us */
+	volatile unsigned ts_mask = TS_MASK;		/* defaults to 20 bits (us) */
+	volatile unsigned ts_roundbit = TS_ROUNDBIT;	/* defaults to 20 bits (us) */
+	volatile int fdigits = 6;			/* fractional digits for us */
 	int c;
 	int errflg	= 0;
 	int cost	= 0;
-	int rawtime	= 0;
+	volatile int rawtime	= 0;
 
 	memset((char *)&ntx, 0, sizeof(ntx));
 	progname = argv[0];
@@ -121,9 +120,6 @@ main(
 	    case 'c':
 		cost++;
 		break;
-	    case 'd':
-		debug++;
-		break;
 	    case 'e':
 		ntx.modes |= MOD_ESTERROR;
 		ntx.esterror = atoi(ntp_optarg);
@@ -166,7 +162,7 @@ main(
 -m maxerror	max possible error (us)\n\
 -o offset	current offset (ms)\n\
 -r		print the unix and NTP time raw\n\
--l leap		Set the leap bits\n\
+-s status	Set the status bits\n\
 -t timeconstant	log2 of PLL time constant (0 .. %d)\n",
 			       progname, optargs,
 #ifdef MOD_MICRO
@@ -305,7 +301,7 @@ main(
 		    (int) ntv.time.tv_sec, fdigits, (int) time_frac,
 		    ctime((const time_t *) &ntv.time.tv_sec));
 #if NTP_API > 3
-		printf(", TAI offset %d\n", ntv.tai);
+		printf(", TAI offset %ld\n", (long)ntv.tai);
 #else
 		printf("\n");
 #endif /* NTP_API */
diff --git a/contrib/ntp/util/pps-api.c b/contrib/ntp/util/pps-api.c
new file mode 100644
index 0000000..60c98b8
--- /dev/null
+++ b/contrib/ntp/util/pps-api.c
@@ -0,0 +1,100 @@
+/*
+
+Try to run this program to see what the PPS-API finds. You give it the
+device as argument and you may have to modify the pp.mode = BLA assignment.
+
+Poul-Henning
+
+*/
+
+#include <stdio.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <err.h>
+#include <sys/types.h>
+#include <time.h>
+#include <sys/timepps.h>
+#include <sys/termios.h>
+
+#define timespecsub(vvp, uvp)                                           \
+        do {                                                            \
+                (vvp)->tv_sec -= (uvp)->tv_sec;                         \
+                (vvp)->tv_nsec -= (uvp)->tv_nsec;                       \
+                if ((vvp)->tv_nsec < 0) {                               \
+                        (vvp)->tv_sec--;                                \
+                        (vvp)->tv_nsec += 1000000000;                   \
+                }                                                       \
+        } while (0)
+
+
+void
+Chew(struct timespec *tsa, struct timespec *tsc, unsigned sa, unsigned sc)
+{
+	static int idx;
+	struct timespec ts;
+
+	printf("%d.%09d ", tsa->tv_sec, tsa->tv_nsec);
+	printf("%d.%09d ", tsc->tv_sec, tsc->tv_nsec);
+	printf("%u %u ", sa, sc);
+
+	ts = *tsc;
+	timespecsub(&ts,tsa);
+	printf("%.9f ", ts.tv_sec + ts.tv_nsec / 1e9);
+	printf("\n");
+	fflush(stdout);
+}
+
+int
+main(int argc, char **argv)
+{
+	int fd;
+	pps_info_t pi;
+	pps_params_t pp;
+	pps_handle_t ph;
+	int i, mode;
+	u_int olda, oldc;
+	double d = 0;
+	struct timespec to;
+
+	if (argc < 2)
+		argv[1] = "/dev/cuaa1";
+	setbuf(stdout, 0);
+	fd = open(argv[1], O_RDONLY);
+	if (fd < 0) 
+		err(1, argv[1]);
+	i = time_pps_create(fd, &ph);
+	if (i < 0)
+		err(1, "time_pps_create");
+
+	i = time_pps_getcap(ph, &mode);
+	if (i < 0)
+		err(1, "time_pps_getcap");
+
+	pp.mode = PPS_CAPTUREASSERT | PPS_ECHOASSERT;
+	pp.mode = PPS_CAPTUREBOTH;
+	/* pp.mode = PPS_CAPTUREASSERT; */
+
+	i = time_pps_setparams(ph, &pp);
+	if (i < 0)
+		err(1, "time_pps_setparams");
+
+	while (1) {
+		to.tv_nsec = 0;
+		to.tv_sec = 0;
+		i = time_pps_fetch(ph, PPS_TSFMT_TSPEC, &pi, &to);
+		if (i < 0)
+			err(1, "time_pps_fetch");
+		if (olda == pi.assert_sequence &&
+		    oldc == pi.clear_sequence) {
+			usleep(10000);
+			continue;
+		}
+
+		Chew(&pi.assert_timestamp, &pi.clear_timestamp,
+			pi.assert_sequence, pi.clear_sequence);
+		olda = pi.assert_sequence;
+		oldc = pi.clear_sequence;
+	}
+
+	return(0);
+}
diff --git a/contrib/ntp/util/sht.c b/contrib/ntp/util/sht.c
index 4abd350..b993de9 100644
--- a/contrib/ntp/util/sht.c
+++ b/contrib/ntp/util/sht.c
@@ -177,7 +177,7 @@ main (
 			    p->valid=1;
 		    }
 		    else {
-			    printf ("p->valid still set\n"); // not an error!
+			    printf ("p->valid still set\n"); /* not an error! */
 		    }
 	    }
 	    break;
diff --git a/contrib/ntp/util/tickadj.c b/contrib/ntp/util/tickadj.c
index 4f524b1..4a7f2c4 100644
--- a/contrib/ntp/util/tickadj.c
+++ b/contrib/ntp/util/tickadj.c
@@ -755,8 +755,8 @@ getoffsets(
 		else
 		{
 			(void) fprintf(stderr,
-				       "%s: nlist didn't find needed symbols from <%s>: %m\n",
-				       progname, *kname);
+				       "%s: nlist didn't find needed symbols from <%s>: %s\n",
+				       progname, *kname, strerror(errno));
 		}
 	}
 	if (*kname == NULL)
diff --git a/contrib/ntp/util/timetrim.c b/contrib/ntp/util/timetrim.c
index 8f0a9ba..911ea28 100644
--- a/contrib/ntp/util/timetrim.c
+++ b/contrib/ntp/util/timetrim.c
@@ -1,4 +1,4 @@
-#ifdef sgi
+#if defined(sgi) || defined(_UNICOSMP)
 /*
  * timetrim.c
  * 
@@ -31,6 +31,9 @@
 #ifdef HAVE_SYS_SYSSGI_H
 # include <sys/syssgi.h>
 #endif
+#ifdef HAVE_SYS_SYSTUNE_H
+# include <sys/systune.h>
+#endif
 
 #define abs(X) (((X) < 0) ? -(X) : (X))
 #define USAGE "usage: timetrim [-n] [[-i] value]\n"
@@ -62,10 +65,18 @@ main(
 		}
 	}
 
+#ifdef HAVE_SYS_SYSSGI_H
 	if (syssgi(SGI_GETTIMETRIM, &timetrim) < 0) {
 		perror("syssgi");
 		exit(2);
 	}
+#endif
+#ifdef HAVE_SYS_SYSTUNE_H
+	if (systune(SYSTUNE_GET, "timetrim", &timetrim) < 0) {
+		perror("systune");
+		exit(2);
+	}
+#endif
 
 	if (argc == 0) {
 		if (ntpunits)
@@ -87,10 +98,18 @@ main(
 		    timetrim += value;
 		else
 		    timetrim = value;
+#ifdef HAVE_SYS_SYSSGI_H
 		if (syssgi(SGI_SETTIMETRIM, timetrim) < 0) {
 			perror("syssgi");
 			exit(2);
 		}
+#endif
+#ifdef HAVE_SYS_SYSTUNE_H
+		if (systune(SYSTUNE_SET, "timer", "timetrim", &timetrim) < 0) {
+			perror("systune");
+			exit(2);
+		}
+#endif
 	}
 	return 0;
 }