Fix multiple vulnerabilities of ntp.

Approved by:	so

Author: delphij

UPDATING

@@ -16,6 +16,10 @@ from older versions of FreeBSD, try WITHOUT_CLANG to bootstrap to the tip of
 stable/10, and then rebuild without this option. The bootstrap process from
 older version of current is a bit fragile.
 
+20161222	p45	FreeBSD-SA-16:39.ntp
+
+	Fix multiple vulnerabilities of ntp.
+
 20161208	p44	FreeBSD-SA-16:37.libc [revised]
 
 	Fix regressions introduced by SA-16:37.libc.

contrib/ntp/ChangeLog

@@ -1,3 +1,72 @@
+---
+(4.2.8p9) 2016/11/21 Released by Harlan Stenn <[email protected]>
+(4.2.8p9) 2016/MM/DD Released by Harlan Stenn <[email protected]>
+
+* [Sec 3119] Trap crash <[email protected]>
+* [Sec 3118] Mode 6 information disclosure and DDoS vector <[email protected]>
+  - TRAP config via mode 6 packet requires AUTH now.
+* [Sec 3114] Broadcast Mode Replay Prevention DoS
+  - applied patches by Matthew Van Gundy. <[email protected]>
+  - with bcpollbstep, tweaks and cleanup by [email protected]
+* [Sec 3113] Broadcast Mode Poll Interval Enforcement DoS <[email protected]>
+  - applied fix as suggested by Matthew Van Gundy
+* [Sec 3110] Windows: ntpd DoS by oversized UDP packet
+  - fixed error handling for truncated UDP packets. <[email protected]>
+* [Sec 3102] Zero origin issues.  HStenn.
+* [Sec 3082] null pointer dereference in _IO_str_init_static_internal()
+  - more hardening to read_mru_list(). [email protected]
+* [Sec 3072] Attack on interface selection <[email protected]>
+  - implemented Miroslav Lichvars <[email protected]> suggestion
+    to skip interface updates based on incoming packets
+* [Bug 3142] bug in netmask prefix length detection <[email protected]>
+* [Bug 3138] gpsdjson refclock should honor fudgetime1. [email protected]
+* [Bug 3129] Unknown hosts can put resolver thread into a hard loop
+  - moved retry decision where it belongs. <[email protected]>
+* [Bug 3125] NTPD doesn't fully start when ntp.conf entries are out of order
+  using the loopback-ppsapi-provider.dll <[email protected]>
+* [Bug 3116] unit tests for NTP time stamp expansion. <[email protected]>
+* [Bug 3100] ntpq can't retrieve daemon_version <[email protected]>
+  - fixed extended sysvar lookup (bug introduced with bug 3008 fix)
+* [Bug 3095] Compatibility with openssl 1.1 <[email protected]>
+  - applied patches by Kurt Roeckx <[email protected]> to source
+  - added shim layer for SSL API calls with issues (both directions)
+* [Bug 3089] Serial Parser does not work anymore for hopfser like device
+  - simplified / refactored hex-decoding in driver. <[email protected]>
+* [Bug 3084] update-leap mis-parses the leapfile name.  HStenn.
+* [Bug 3068] Linker warnings when building on Solaris. [email protected]
+  - applied patch thanks to Andrew Stormont <[email protected]>
+* [Bug 3067] Root distance calculation needs improvement.  HStenn.
+* [Bug 3066] NMEA clock ignores pps. [email protected]
+  - PPS-HACK works again.
+* [Bug 3059] Potential buffer overrun from oversized hash <[email protected]>
+  - applied patch by Brian Utterback <[email protected]>
+* [Bug 3053] ntp_loopfilter.c frequency calc precedence error.  Sarah White.
+* [Bug 3050]  Fix for bug #2960 causes [...] spurious error message.
+  <[email protected]>
+  - patches by Reinhard Max <[email protected]> and Havard Eidnes <[email protected]>
+* [Bug 3047] Fix refclock_jjy C-DEX JST2000. [email protected]
+  - Patch provided by Kuramatsu.
+* [Bug 3021] unity_fixture.c needs pragma weak <[email protected]>
+  - removed unnecessary & harmful decls of 'setUp()' & 'tearDown()'
+* [Bug 3019] Windows: ERROR_HOST_UNREACHABLE block packet processing.
+  DMayer and JPerlinger.
+* [Bug 2998] sntp/tests/packetProcessing.c broken without openssl. JPerlinger
+* [Bug 2961] sntp/tests/packetProcessing.c assumes AUTOKEY.  HStenn.
+* [Bug 2959] refclock_jupiter: gps week correction <[email protected]>
+  - fixed GPS week expansion to work based on build date. Special thanks
+    to Craig Leres for initial patch and testing.
+* [Bug 2951] ntpd tests fail: multiple definition of `send_via_ntp_signd'
+  - fixed Makefile.am <[email protected]>
+* [Bug 2689] ATOM driver processes last PPS pulse at startup,
+             even if it is very old <[email protected]>
+  - make sure PPS source is alive before processing samples
+  - improve stability close to the 500ms phase jump (phase gate)
+* Fix typos in include/ntp.h.
+* Shim X509_get_signature_nid() if needed.
+* git author attribution cleanup
+* bk ignore file cleanup
+* remove locks in Windows IO, use rpc-like thread synchronisation instead
+
 ---
 (4.2.8p8) 2016/06/02 Released by Harlan Stenn <[email protected]>
 
@@ -19,7 +88,7 @@
 * Fix typo in ntp-wait and plot_summary.  HStenn.
 * Make sure we have an "author" file for git imports.  HStenn.
 * Update the sntp problem tests for MacOS.  HStenn.
-  
+
 ---
 (4.2.8p7) 2016/04/26 Released by Harlan Stenn <[email protected]>