CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2016/05/21 07:46:10
Modified files:
usr.sbin/ntpd : constraint.c
Log message:
Harden TLS for ntpd constraints - stop disabling server name verification,
ensure that we load the CA certificates and use tls_connect_servername()
so that we can verify the server we are connecting to (even though we've
already resolved the hostname). Also add additional warnings for TLS
connect and TLS write failures so that we know what is happening and why.
Lack of server name verification also reported by Luis M. Merino
<luismiguelmerino at gmail dot com> - thanks!
ok deraadt@ reyk@
