Fix ntp 4.2.8p18 patch for wolfSSL support

[julek-wolfssl]

wolfSSL/wolfssl#11207 needs to be merged before this. Otherwise wolfssl CI will fail.

The 4.2.8p18 patch was incomplete: it lacked the ntp_wolfssl.m4 macro (so --with-wolfssl was unrecognized and USE_WOLFSSL was never defined), and p18 moved the NTP_OPENSSL/NTP_CRYPTO_RAND checks into NTP_LIBNTP in sntp/m4/ntp_libntp.m4, so the old patch insertions ran too late and system OpenSSL kept being detected and linked.

• Add sntp/m4/ntp_wolfssl.m4 implementing --with-wolfssl=DIR:
  • adds include paths, -lwolfssl and -DWOLFSSL_USE_OPTIONS_H to CPPFLAGS_NTP so all NTP binaries pick them up
  • checks wolfssl/options.h exists and was built with OPENSSL_EXTRA_BSD (required for MD5Init/MD5Update/MD5Final), failing configure with a clear error otherwise
  • defines OPENSSL, WITH_WOLFSSL, ENABLE_CMAC, USE_OPENSSL_CRYPTO_RAND and AUTOKEY
• Call NTP_WOLFSSL before NTP_LIBNTP in configure.ac and sntp/configure.ac, and wrap NTP_OPENSSL/NTP_CRYPTO_RAND (and the autokey block) in if test $USE_WOLFSSL = no so system OpenSSL isn't detected/linked when wolfSSL is used.
• Port the p17 compatibility fixes:
  • WITH_WOLFSSL guards in libssl_compat.h/.c
  • CMAC guards (WITH_WOLFSSL && WOLFSSL_CMAC) in ntp_md5.h/ssl_init.c/ntpq.c
  • EVP_MD_CTX_FLAG_NON_FIPS_ALLOW guard in sntp/crypto.c
  • BN_GENCB/BN_gcd/BN_bin2bn workarounds in ntp-keygen.c and ntp_crypto.c
  • rename FATAL_ERROR to NTP_FATAL_ERROR (collides with a wolfSSL macro)
  • remove the md5 key-type prefix in keytype_from_text
• Document in the README building wolfSSL with ./configure --enable-ntp CFLAGS="-DOPENSSL_EXTRA_BSD" (--enable-md4 additionally needed to pass make check).

[Copilot]

Pull request overview

Updates the NTP 4.2.8p18 wolfSSL integration patch and accompanying build notes so --with-wolfssl is recognized early enough to prevent unintended system OpenSSL detection/linking, and ports forward the prior (p17) wolfSSL compatibility guards.

Changes:

• Adds a new NTP_WOLFSSL autoconf macro (and wires it into configure.ac / sntp/configure.ac) to support --with-wolfssl=DIR and avoid running OpenSSL detection when wolfSSL is selected.
• Ports multiple wolfSSL/OpenSSL-compatibility guards across crypto-related code paths and headers, plus resolves a macro name collision (FATAL_ERROR).
• Updates build documentation for wolfSSL to require OPENSSL_EXTRA_BSD.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
ntp/4.2.8p18/README.md	Updates wolfSSL build instructions to include OPENSSL_EXTRA_BSD.
ntp/4.2.8p18/ntp-4.2.8p18.patch	Updates/extends the upstream patch: adds ntp_wolfssl.m4, reorders/configures checks, and ports wolfSSL compatibility fixes.

Suppressed comments (3)

ntp/4.2.8p18/ntp-4.2.8p18.patch:342

• AC_CHECK_HEADER uses the preprocessor flags (CPPFLAGS), not CFLAGS. Appending CPPFLAGS_NTP to CFLAGS can cause the wolfssl/options.h check to fail even when the include paths are correct.

+    SAVED_CFLAGS=$CFLAGS
+    CFLAGS="$CFLAGS $CPPFLAGS_NTP"
+    AC_CHECK_HEADER([wolfssl/options.h])
+    CFLAGS=$SAVED_CFLAGS

ntp/4.2.8p18/ntp-4.2.8p18.patch:335

• --with-wolfssl=DIR is documented as requiring a directory, but AC_ARG_WITH will also accept --with-wolfssl (setting withval=yes) and this macro will then build -Iyes/include ..., leading to confusing failures. Also, AC_HELP_STRING is obsolete in newer autoconf; prefer AS_HELP_STRING.

+    AC_HELP_STRING([--with-wolfssl=DIR],[location of wolfssl]),
+[
+    CPPFLAGS_NTP="$CPPFLAGS_NTP -I${withval}/include/ -I${withval}/include/wolfssl -DWOLFSSL_USE_OPTIONS_H"
+    LDADD_NTP="$LDADD_NTP -L${withval}/lib -lwolfssl"
+    USE_WOLFSSL=yes

ntp/4.2.8p18/ntp-4.2.8p18.patch:345

• The grep path is unquoted, so a wolfSSL install prefix containing spaces (or other shell-special characters) will break the configure check.

+        if grep -q "define OPENSSL_EXTRA_BSD" ${withval}/include/wolfssl/options.h; then

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

ntp/4.2.8p18/ntp-4.2.8p18.patch:350

• The NTP_WOLFSSL macro tries to make AC_CHECK_HEADER([wolfssl/options.h]) see the --with-wolfssl include paths by appending $CPPFLAGS_NTP to CFLAGS. Autoconf header checks use preprocessor flags (CPPFLAGS), so this can still fail when wolfSSL isn’t installed in a default include directory. Also, invoking plain grep in configure logic is less portable than using Autoconf’s header-grep helpers.

+    SAVED_CFLAGS=$CFLAGS
+    CFLAGS="$CFLAGS $CPPFLAGS_NTP"
+    AC_CHECK_HEADER([wolfssl/options.h])
+    CFLAGS=$SAVED_CFLAGS
+    if test $ac_cv_header_wolfssl_options_h = yes; then
+        AC_MSG_CHECKING([for OPENSSL_EXTRA_BSD in wolfssl/options.h])
+        if grep -q "define OPENSSL_EXTRA_BSD" ${withval}/include/wolfssl/options.h; then
+            ans=yes