Virgin import of ntpd 4.2.6p5.vendor/ntp/4.2.6p5

When the series of commits is complete, things like
https://cert.litnet.lt/en/docs/ntp-distributed-reflection-dos-attacks
should be fixed.

PR:		bin/148836 (except that we import a newer version)
Asked by:	Too many
MFC after:	2 weeks

1 files changed, 214 insertions, 180 deletions

diff --git a/include/ntpd.h b/include/ntpd.h
index d0957191becb..75e87de97a41 100644
--- a/include/ntpd.h
+++ b/include/ntpd.h
@@ -2,31 +2,31 @@
  * ntpd.h - Prototypes for ntpd.
  */
 
-#include "ntp_syslog.h"
-#include "ntp_fp.h"
 #include "ntp.h"
 #include "ntp_debug.h"
+#include "ntp_syslog.h"
 #include "ntp_select.h"
 #include "ntp_malloc.h"
 #include "ntp_refclock.h"
 #include "recvbuff.h"
 
-
 /* ntp_config.c */
-extern	void	getconfig	P((int, char **));
 
-/* ntp_config.c */
-extern	void	ctl_clr_stats	P((void));
-extern	int	ctlclrtrap	P((struct sockaddr_storage *, struct interface *, int));
-extern	u_short ctlpeerstatus	P((struct peer *));
-extern	int	ctlsettrap	P((struct sockaddr_storage *, struct interface *, int, int));
-extern	u_short ctlsysstatus	P((void));
-extern	void	init_control	P((void));
-extern	void	process_control P((struct recvbuf *, int));
-extern	void	report_event	P((int, struct peer *));
-
-extern	double	fabs		P((double));
-extern	double	sqrt		P((double));
+#define	TAI_1972	10	/* initial TAI offset (s) */
+extern	char	*keysdir;	/* crypto keys and leaptable directory */
+extern	char *	saveconfigdir;	/* ntpq saveconfig output directory */
+
+extern	void	getconfig	(int, char **);
+extern	void	ctl_clr_stats	(void);
+extern	int	ctlclrtrap	(sockaddr_u *, struct interface *, int);
+extern	u_short ctlpeerstatus	(struct peer *);
+extern	int	ctlsettrap	(sockaddr_u *, struct interface *, int, int);
+extern	u_short ctlsysstatus	(void);
+extern	void	init_control	(void);
+extern	void	init_logging	(char const *, int);
+extern	void	setup_logfile	(void);
+extern	void	process_control (struct recvbuf *, int);
+extern	void	report_event	(int, struct peer *, const char *);
 
 /* ntp_control.c */
 /*
@@ -52,120 +52,114 @@ struct ctl_var {
 #define	WO	(CAN_WRITE)
 #define	RW	(CAN_READ|CAN_WRITE)
 
-extern  char *  add_var P((struct ctl_var **, u_long, u_short));
-extern  void    free_varlist P((struct ctl_var *));
-extern  void    set_var P((struct ctl_var **, const char *, u_long, u_short));
-extern  void    set_sys_var P((const char *, u_long, u_short));
+extern  char *  add_var (struct ctl_var **, u_long, u_short);
+extern  void    free_varlist (struct ctl_var *);
+extern  void    set_var (struct ctl_var **, const char *, u_long, u_short);
+extern  void    set_sys_var (const char *, u_long, u_short);
 
 /* ntp_intres.c */
-extern	void	ntp_res_name	P((struct sockaddr_storage, u_short));
-extern	void	ntp_res_recv	P((void));
-extern	void	ntp_intres	P((void));
+extern	void	ntp_res_name	(sockaddr_u, u_short);
+extern	void	ntp_res_recv	(void);
+extern	void	ntp_intres	(void);
+#ifdef SYS_WINNT
+extern	unsigned WINAPI	ntp_intres_thread	(void *);
+#endif
 
 /* ntp_io.c */
 typedef struct interface_info {
-	struct interface *interface;
-	u_char       action;
+	endpt *	ep;
+	u_char	action;
 } interface_info_t;
 
-typedef void (*interface_receiver_t)(void *, interface_info_t *);
-
-extern  volatile int disable_dynamic_updates;
-
-extern  void    interface_enumerate P((interface_receiver_t, void *));
-extern	struct interface *findinterface P((struct sockaddr_storage *));
-extern  struct interface *findbcastinter P((struct sockaddr_storage *));
-extern  void	enable_broadcast P((struct interface *, struct sockaddr_storage *));
-extern  void	enable_multicast_if P((struct interface *, struct sockaddr_storage *));
-extern	void	interface_dump	 P((struct interface *));
-
-extern  void    interface_update P((interface_receiver_t, void *));
-extern	void	init_io 	P((void));
-extern	void	input_handler	P((l_fp *));
-extern	void	io_clr_stats	P((void));
-extern	void	io_setbclient	P((void));
-extern	void	io_unsetbclient P((void));
-extern	void	io_multicast_add P((struct sockaddr_storage));
-extern	void	io_multicast_del P((struct sockaddr_storage));
-extern	void	kill_asyncio	 P((int));
-extern	void	sendpkt 	P((struct sockaddr_storage *, struct interface *, int, struct pkt *, int));
+typedef void	(*interface_receiver_t)	(void *, interface_info_t *);
+
+extern  int	disable_dynamic_updates;
+
+extern	void	interface_enumerate	(interface_receiver_t, void *);
+extern	endpt *	findinterface		(sockaddr_u *);
+extern	endpt *	findbcastinter		(sockaddr_u *);
+extern	void	enable_broadcast	(endpt *, sockaddr_u *);
+extern	void	enable_multicast_if	(endpt *, sockaddr_u *);
+extern	void	interface_update	(interface_receiver_t, void *);
+
+extern	void	init_io 	(void);
+extern	void	io_open_sockets	(void);
+extern	void	input_handler	(l_fp *);
+extern	void	io_clr_stats	(void);
+extern	void	io_setbclient	(void);
+extern	void	io_unsetbclient	(void);
+extern	void	io_multicast_add(sockaddr_u *);
+extern	void	io_multicast_del(sockaddr_u *);
+extern	void	sendpkt 	(sockaddr_u *, struct interface *, int, struct pkt *, int);
+#ifndef SYS_WINNT
+extern	void	kill_asyncio	(int);
+#endif
 #ifdef DEBUG
-extern  void    collect_timing  P((struct recvbuf *, const char *, int, l_fp *));
+extern	void	collect_timing  (struct recvbuf *, const char *, int, l_fp *);
 #endif
 #ifdef HAVE_SIGNALED_IO
-extern	void	wait_for_signal P((void));
-extern	void	unblock_io_and_alarm P((void));
-extern	void	block_io_and_alarm P((void));
-#define UNBLOCK_IO_AND_ALARM() unblock_io_and_alarm()
-#define BLOCK_IO_AND_ALARM() block_io_and_alarm()
+extern	void	wait_for_signal		(void);
+extern	void	unblock_io_and_alarm	(void);
+extern	void	block_io_and_alarm	(void);
+#define UNBLOCK_IO_AND_ALARM()		unblock_io_and_alarm()
+#define BLOCK_IO_AND_ALARM()		block_io_and_alarm()
 #else
 #define UNBLOCK_IO_AND_ALARM()
 #define BLOCK_IO_AND_ALARM()
 #endif
-
-/* ntp_leap.c */
-extern	void	init_leap	P((void));
-extern	void	leap_process	P((void));
-extern	int 	leap_setleap	P((int, int));
-/*
- * there seems to be a bug in the IRIX 4 compiler which prevents
- * u_char from beeing used in prototyped functions.
- * This is also true AIX compiler.
- * So give up and define it to be int. WLJ
- */
-extern	int	leap_actual P((int));
+#define		latoa(pif)	localaddrtoa(pif)
+extern const char * localaddrtoa(endpt *);
 
 /* ntp_loopfilter.c */
-extern	void	init_loopfilter P((void));
-extern	int 	local_clock P((struct peer *, double));
-extern	void	adj_host_clock	P((void));
-extern	void	loop_config P((int, double));
-extern	void	huffpuff	P((void));
+extern	void	init_loopfilter(void);
+extern	int 	local_clock(struct peer *, double);
+extern	void	adj_host_clock(void);
+extern	void	loop_config(int, double);
+extern	void	huffpuff(void);
 extern	u_long	sys_clocktime;
-extern	u_long	sys_tai;
+extern	u_int	sys_tai;
 
 /* ntp_monitor.c */
-extern	void	init_mon	P((void));
-extern	void	mon_start	P((int));
-extern	void	mon_stop	P((int));
-extern	int	ntp_monitor     P((struct recvbuf *));
-extern  void    ntp_monclearinterface P((struct interface *interface));
+extern	void	init_mon	(void);
+extern	void	mon_start	(int);
+extern	void	mon_stop	(int);
+extern	int	ntp_monitor	(struct recvbuf *, int);
+extern  void    ntp_monclearinterface (struct interface *interface);
 
 /* ntp_peer.c */
-extern	void	init_peer	P((void));
-extern	struct peer *findexistingpeer P((struct sockaddr_storage *, struct peer *, int));
-extern	struct peer *findpeer	P((struct sockaddr_storage *, struct interface *, int, int *));
-extern	struct peer *findpeerbyassoc P((u_int));
-extern  void         set_peerdstadr       P((struct peer *peer, struct interface *interface));
-extern	struct peer *newpeer	P((struct sockaddr_storage *, struct interface *, int, int, int, int, u_int, u_char, int, keyid_t));
-extern	void	peer_all_reset	P((void));
-extern	void	peer_clr_stats	P((void));
-extern	struct peer *peer_config P((struct sockaddr_storage *, struct interface *, int, int, int, int, u_int, int, keyid_t, u_char *));
-extern	void	peer_reset	P((struct peer *));
-extern	int 	peer_unconfig	P((struct sockaddr_storage *, struct interface *, int));
-extern  void    refresh_all_peerinterfaces P((void));
-extern	void	unpeer		P((struct peer *));
-extern	void	clear_all	P((void));
-
-#ifdef OPENSSL
-extern	void	expire_all	P((void));
-#endif /* OPENSSL */
-extern	struct	peer *findmanycastpeer	P((struct recvbuf *));
+extern	void	init_peer	(void);
+extern	struct peer *findexistingpeer (sockaddr_u *, struct peer *, int, u_char);
+extern	struct peer *findpeer	(struct recvbuf *, int, int *);
+extern	struct peer *findpeerbyassoc (u_int);
+extern  void	set_peerdstadr	(struct peer *peer, struct interface *interface);
+extern	struct peer *newpeer	(sockaddr_u *, struct interface *, int, int, int, int, u_int, u_char, int, keyid_t);
+extern	void	peer_all_reset	(void);
+extern	void	peer_clr_stats	(void);
+extern	struct peer *peer_config (sockaddr_u *, struct interface *, int, int, int, int, u_int, int, keyid_t, u_char *);
+extern	void	peer_reset	(struct peer *);
+extern	void	refresh_all_peerinterfaces (void);
+extern	void	unpeer		(struct peer *);
+extern	void	clear_all	(void);
+extern	int	score_all	(struct peer *);
+extern	struct	peer *findmanycastpeer	(struct recvbuf *);
 
 /* ntp_crypto.c */
 #ifdef OPENSSL
-extern	int	crypto_recv	P((struct peer *, struct recvbuf *));
-extern	int	crypto_xmit	P((struct pkt *, struct sockaddr_storage *, int, struct exten *, keyid_t));
-extern	keyid_t	session_key	P((struct sockaddr_storage *, struct sockaddr_storage *, keyid_t, keyid_t, u_long));
-extern	int	make_keylist	P((struct peer *, struct interface *));
-extern	void	key_expire	P((struct peer *));
-extern	void	crypto_update	P((void));
-extern	void	crypto_config	P((int, char *));
-extern	void	crypto_setup	P((void));
-extern	u_int	crypto_ident	P((struct peer *));
-extern	struct exten *crypto_args P((struct peer *, u_int, char *));
-extern	int	crypto_public	P((struct peer *, u_char *, u_int));
-extern	void	value_free	P((struct value *));
+extern	int	crypto_recv	(struct peer *, struct recvbuf *);
+extern	int	crypto_xmit	(struct peer *, struct pkt *,
+				    struct recvbuf *, int,
+				    struct exten *, keyid_t);
+extern	keyid_t	session_key	(sockaddr_u *, sockaddr_u *, keyid_t,
+				    keyid_t, u_long);
+extern	int	make_keylist	(struct peer *, struct interface *);
+extern	void	key_expire	(struct peer *);
+extern	void	crypto_update	(void);
+extern	void	crypto_config	(int, char *);
+extern	void	crypto_setup	(void);
+extern	u_int	crypto_ident	(struct peer *);
+extern	struct exten *crypto_args (struct peer *, u_int, associd_t, char *);
+extern	int	crypto_public	(struct peer *, u_char *, u_int);
+extern	void	value_free	(struct value *);
 extern	char	*iffpar_file;
 extern	EVP_PKEY *iffpar_pkey;
 extern	char	*gqpar_file;
@@ -176,13 +170,20 @@ extern struct value tai_leap;
 #endif /* OPENSSL */
 
 /* ntp_proto.c */
-extern	void	transmit	P((struct peer *));
-extern	void	receive 	P((struct recvbuf *));
-extern  void    peer_crypto_clear P((struct peer *peer));
-extern	void	peer_clear	P((struct peer *, char *));
-extern	void 	process_packet	P((struct peer *, struct pkt *));
-extern	void	clock_select	P((void));
-extern	void	kod_proto	P((void));
+extern	void	transmit	(struct peer *);
+extern	void	receive 	(struct recvbuf *);
+extern	void	peer_clear	(struct peer *, char *);
+extern	void 	process_packet	(struct peer *, struct pkt *, u_int);
+extern	void	clock_select	(void);
+
+extern	int	leap_tai;	/* TAI at next leap */
+extern	u_long	leap_sec;	/* next scheduled leap from file */
+extern	u_long	leap_peers;	/* next scheduled leap from peers */
+extern	u_long	leapsec;	/* seconds to next leap */
+extern	u_long	leap_expire;	/* leap information expiration */
+extern	int	sys_orphan;
+extern	double	sys_mindisp;
+extern	double	sys_maxdist;
 
 /*
  * there seems to be a bug in the IRIX 4 compiler which prevents
@@ -190,65 +191,71 @@ extern	void	kod_proto	P((void));
  * This is also true AIX compiler.
  * So give up and define it to be int. WLJ
  */
-extern	void	poll_update P((struct peer *, int));
+extern	void	poll_update (struct peer *, int);
 
-extern	void	clear		P((struct peer *));
-extern	void	clock_filter	P((struct peer *, double, double, double));
-extern	void	init_proto	P((void));
-extern	void	proto_config	P((int, u_long, double, struct sockaddr_storage*));
-extern	void	proto_clr_stats P((void));
+extern	void	clear		(struct peer *);
+extern	void	clock_filter	(struct peer *, double, double, double);
+extern	void	init_proto	(void);
+extern	void	proto_config	(int, u_long, double, sockaddr_u *);
+extern	void	proto_clr_stats (void);
 
 #ifdef	REFCLOCK
 /* ntp_refclock.c */
-extern	int	refclock_newpeer P((struct peer *));
-extern	void	refclock_unpeer P((struct peer *));
-extern	void	refclock_receive P((struct peer *));
-extern	void	refclock_transmit P((struct peer *));
-extern	void	init_refclock	P((void));
+extern	int	refclock_newpeer (struct peer *);
+extern	void	refclock_unpeer (struct peer *);
+extern	void	refclock_receive (struct peer *);
+extern	void	refclock_transmit (struct peer *);
+extern	void	init_refclock	(void);
 #endif	/* REFCLOCK */
 
 /* ntp_request.c */
-extern	void	init_request	P((void));
-extern	void	process_private P((struct recvbuf *, int));
+extern	void	init_request	(void);
+extern	void	process_private (struct recvbuf *, int);
 
 /* ntp_restrict.c */
-extern	void	init_restrict	P((void));
-extern	int 	restrictions	P((struct sockaddr_storage *, int));
-extern	void	hack_restrict	P((int, struct sockaddr_storage *, struct sockaddr_storage *, int, int));
+extern	void	init_restrict	(void);
+extern	u_short	restrictions	(sockaddr_u *);
+extern	void	hack_restrict	(int, sockaddr_u *, sockaddr_u *, u_short, u_short);
 
 /* ntp_timer.c */
-extern	void	init_timer	P((void));
-extern	void	reinit_timer	P((void));
-extern	void	timer		P((void));
-extern	void	timer_clr_stats P((void));
-extern  void    timer_interfacetimeout P((u_long));
+extern	void	init_timer	(void);
+extern	void	reinit_timer	(void);
+extern	void	timer		(void);
+extern	void	timer_clr_stats (void);
+extern  void    timer_interfacetimeout (u_long);
 extern  volatile int interface_interval;
-
 #ifdef OPENSSL
-extern	char	*sys_hostname;
-extern	l_fp	sys_revoketime;
+extern	char	*sys_hostname;	/* host name */
+extern	char	*sys_groupname;	/* group name */
+extern	char	*group_name;	/* group name */
+extern u_long	sys_revoke;	/* keys revoke timeout */
+extern u_long	sys_automax;	/* session key timeout */
 #endif /* OPENSSL */
 
 /* ntp_util.c */
-extern	void	init_util	P((void));
-extern	void	write_stats	P((void));
-extern	void	stats_config	P((int, const char *));
-extern	void	record_peer_stats P((struct sockaddr_storage *, int, double, double, double, double));
-extern	void	record_loop_stats P((double, double, double, double, int));
-extern	void	record_clock_stats P((struct sockaddr_storage *, const char *));
-extern	void	record_raw_stats P((struct sockaddr_storage *, struct sockaddr_storage *, l_fp *, l_fp *, l_fp *, l_fp *));
-extern	void	record_sys_stats P((void));
-extern	void	record_crypto_stats P((struct sockaddr_storage *, const char *));
+extern	void	init_util	(void);
+extern	void	write_stats	(void);
+extern	void	stats_config	(int, const char *);
+extern	void	record_peer_stats (sockaddr_u *, int, double, double, double, double);
+extern	void	record_proto_stats (char *);
+extern	void	record_loop_stats (double, double, double, double, int);
+extern	void	record_clock_stats (sockaddr_u *, const char *);
+extern	void	record_raw_stats (sockaddr_u *, sockaddr_u *, l_fp *, l_fp *, l_fp *, l_fp *);
+extern	u_long	leap_month(u_long);
+extern	void	record_crypto_stats (sockaddr_u *, const char *);
 #ifdef DEBUG
-extern	void	record_timing_stats P((const char *));
+extern	void	record_timing_stats (const char *);
 #endif
-extern  int	sock_hash P((struct sockaddr_storage *));
+extern  u_short	sock_hash (sockaddr_u *);
+extern	char *	fstostr(time_t);	/* NTP timescale seconds */
 extern	double	old_drift;
+extern	int	drift_file_sw;
+extern	double	wander_threshold;
+extern	double	wander_resid;
 
 /*
  * Variable declarations for ntpd.
  */
-
 /* ntp_config.c */
 extern char const *	progname;
 extern char	*sys_phone[];		/* ACTS phone numbers */
@@ -256,6 +263,20 @@ extern char	*sys_phone[];		/* ACTS phone numbers */
 extern int	config_priority_override;
 extern int	config_priority;
 #endif
+extern char *ntp_signd_socket;
+extern struct config_tree *cfg_tree_history;
+
+#ifdef BC_LIST_FRAMEWORK_NOT_YET_USED
+/*
+ * backwards compatibility flags
+ */
+typedef struct bc_entry_tag {
+	int	token;
+	int	enabled;
+} bc_entry;
+
+extern bc_entry bc_list[];
+#endif
 
 /* ntp_control.c */
 extern int	num_ctl_traps;
@@ -282,6 +303,8 @@ extern u_long	numasyncmsgs;		/* number of async messages we've sent */
 
 /* ntp_intres.c */
 extern keyid_t	req_keyid;		/* request keyid */
+extern int	req_keytype;		/* OpenSSL NID such as NID_md5 */
+extern size_t	req_hashlen;		/* digest size for req_keytype */
 extern char *	req_file;		/* name of the file with configuration info */
 #ifdef SYS_WINNT
 extern HANDLE ResolverEventHandle;
@@ -305,9 +328,9 @@ extern u_long	io_timereset;		/* time counters were reset */
 /*
  * Interface stuff
  */
-extern struct interface *any_interface;	/* default ipv4 interface */
-extern struct interface *any6_interface;/* default ipv6 interface */
-extern struct interface *loopback_interface; /* loopback interface */
+extern endpt *	any_interface;		/* IPv4 wildcard */
+extern endpt *	any6_interface;		/* IPv6 wildcard */
+extern endpt *	loopback_interface;	/* IPv4 loopback for refclocks */
 
 /*
  * File descriptor masks etc. for call to select
@@ -322,7 +345,7 @@ extern double	clock_max;		/* max offset before step (s) */
 extern double	clock_panic;		/* max offset before panic (s) */
 extern double	clock_phi;		/* dispersion rate (s/s) */
 extern double	clock_minstep;		/* step timeout (s) */
-extern u_long	pps_control;		/* last pps sample time */
+extern double	clock_codec;		/* codec frequency */
 #ifdef KERNEL_PLL
 extern int	pll_status;		/* status bits for kernel pll */
 #endif /* KERNEL_PLL */
@@ -348,8 +371,9 @@ extern int	state;			/* clock discipline state */
 extern int	tc_counter;		/* poll-adjust counter */
 extern u_long	last_time;		/* time of last clock update (s) */
 extern double	last_offset;		/* last clock offset (s) */
-extern double	allan_xpt;		/* Allan intercept (s) */
+extern u_char	allan_xpt;		/* Allan intercept (log2 s) */
 extern double	clock_jitter;		/* clock jitter (s) */
+extern double	sys_offset;		/* system offset (s) */
 extern double	sys_jitter;		/* system jitter (s) */
 
 /* ntp_monitor.c */
@@ -381,16 +405,13 @@ extern int	peer_preempt;		/* preemptable associations */
  * specification.
  */
 extern u_char	sys_leap;		/* system leap indicator */
-extern u_char	sys_stratum;		/* stratum of system */
+extern u_char	sys_stratum;		/* system stratum */
 extern s_char	sys_precision;		/* local clock precision */
-extern double	sys_rootdelay;		/* distance to current sync source */
-extern double	sys_rootdispersion;	/* dispersion of system clock */
-extern u_int32	sys_refid;		/* reference source for local clock */
-extern l_fp	sys_reftime;		/* time we were last updated */
-extern struct peer *sys_peer;		/* our current peer */
-extern struct peer *sys_pps;		/* our current PPS peer */
-extern struct peer *sys_prefer;		/* our cherished peer */
-extern u_long	sys_automax;		/* maximum session key lifetime */
+extern double	sys_rootdelay;		/* roundtrip delay to primary source */
+extern double	sys_rootdisp;		/* dispersion to primary source */
+extern u_int32	sys_refid;		/* reference id */
+extern l_fp	sys_reftime;		/* last update time */
+extern struct peer *sys_peer;		/* current peer */
 
 /*
  * Nonspecified system state variables.
@@ -405,23 +426,24 @@ extern int	sys_minclock;		/* minimum survivors */
 extern int	sys_minsane;		/* minimum candidates */
 extern int	sys_floor;		/* cluster stratum floor */
 extern int	sys_ceiling;		/* cluster stratum ceiling */
-extern u_char	sys_ttl[];		/* ttl mapping vector */
+extern u_char	sys_ttl[MAX_TTL];	/* ttl mapping vector */
 extern int	sys_ttlmax;		/* max ttl mapping vector index */
-extern int	leap_next;		/* leap consensus */
 
 /*
  * Statistics counters
  */
-extern u_long	sys_stattime;		/* time when we started recording */
+extern u_long	sys_stattime;		/* time since reset */
+extern u_long	sys_received;		/* packets received */
+extern u_long	sys_processed;		/* packets for this host */
 extern u_long	sys_restricted;	 	/* restricted packets */
-extern u_long	sys_oldversionpkt;	/* old version packets */
-extern u_long	sys_newversionpkt;	/* new version packets  */
-extern u_long	sys_unknownversion;	/* don't know version packets */
+extern u_long	sys_newversion;		/* current version  */
+extern u_long	sys_oldversion;		/* old version */
+extern u_long	sys_restricted;		/* access denied */
 extern u_long	sys_badlength;		/* bad length or format */
-extern u_long	sys_processed;		/* packets processed */
 extern u_long	sys_badauth;		/* bad authentication */
-extern u_long	sys_limitrejected;	/* rate limit exceeded */
-extern u_long	sys_received;		/* packets received */
+extern u_long	sys_declined;		/* declined */
+extern u_long	sys_limitrejected;	/* rate exceeded */
+extern u_long	sys_kodsent;		/* KoD sent */
 
 /* ntp_refclock.c */
 #ifdef REFCLOCK
@@ -434,15 +456,14 @@ extern int	fdpps;			/* pps file descriptor */
 extern keyid_t	info_auth_keyid;	/* keyid used to authenticate requests */
 
 /* ntp_restrict.c */
-extern struct restrictlist *restrictlist; /* the ipv4 restriction list */
-extern struct restrictlist6 *restrictlist6; /* the ipv6 restriction list */
-extern u_long	res_min_interval;
-extern u_long	res_avg_interval;
-extern u_long	mon_age;		/* monitor preempt age */
+extern restrict_u *	restrictlist4;	/* IPv4 restriction list */
+extern restrict_u *	restrictlist6;	/* IPv6 restriction list */
+extern int	ntp_minpkt;
+extern int	ntp_minpoll;
+extern int	mon_age;		/* monitor preempt age */
 
 /* ntp_timer.c */
 extern volatile int alarm_flag;		/* alarm flag */
-extern u_char	sys_revoke;		/* keys revoke timeout (log2 s) */
 extern volatile u_long alarm_overflow;
 extern u_long	current_time;		/* current time (s) */
 extern u_long	timer_timereset;
@@ -462,11 +483,24 @@ extern int 	initializing;		/* initializing flag */
 extern int droproot;			/* flag: try to drop root privileges after startup */
 extern char *user;			/* user to switch to */
 extern char *group;			/* group to switch to */
-extern char *chrootdir;			/* directory to chroot to */
+extern const char *chrootdir;		/* directory to chroot to */
 #endif
 
 /* refclock_conf.c */
 #ifdef REFCLOCK
-extern struct refclock *refclock_conf[]; /* refclock configuration table */
+/* refclock configuration table */
+extern struct refclock * const refclock_conf[];
 extern u_char	num_refclock_conf;
 #endif
+
+/* ntp_signd.c */
+#ifdef HAVE_NTP_SIGND
+extern void 
+send_via_ntp_signd(
+	struct recvbuf *rbufp,	/* receive packet pointer */
+	int	xmode,
+	keyid_t	xkeyid, 
+	int flags,
+	struct pkt  *xpkt
+	);
+#endif