Fix ntp 4.2.8p18 patch for wolfSSL support

ntp/4.2.8p18/README.md

@@ -1,7 +1,7 @@
 ## Build Instructions
 
 ### Build wolfSSL
-+ Configure wolfSSL with `./configure --enable-ntp`. Add `--enable-debug` if you want to enable the debug version of wolfSSL.
++ Configure wolfSSL with `./configure --enable-ntp CFLAGS="-DOPENSSL_EXTRA_BSD"`. NTP uses `MD5Init`/`MD5Update`/`MD5Final`, which wolfSSL only provides under `OPENSSL_EXTRA_BSD`. Add `--enable-debug` if you want to enable the debug version of wolfSSL.
 + Compile with `make`.
 + Install wolfSSL into /usr/local with `sudo make install`.
 

ntp/4.2.8p18/ntp-4.2.8p18.patch

@@ -1,93 +1,78 @@
-From 66cb95ad98247b1ea8073986847fc4d9a3a9b783 Mon Sep 17 00:00:00 2001
+From ed5858f50be0778d7c9e049c8829bbfca8cc92f3 Mon Sep 17 00:00:00 2001
 From: Juliusz Sosinowicz <juliusz@wolfssl.com>
-Date: Fri, 20 Feb 2026 19:02:02 +0100
-Subject: [PATCH] Patch for wolfSSL
+Date: Wed, 19 Aug 2026 16:17:18 +0000
+Subject: [PATCH] Fix ntp 4.2.8p18 patch for wolfSSL
 
 ---
- configure.ac                      | 60 ++++++++++++++++---------------
- include/ntp_md5.h                 |  8 +++--
+ configure.ac                      |  4 +++
+ include/libssl_compat.h           |  4 +++
+ include/ntp_md5.h                 |  6 ++--
  libntp/lib/isc/include/isc/util.h |  2 +-
  libntp/lib/isc/lib.c              |  2 +-
  libntp/lib/isc/sockaddr.c         |  6 ++--
- libntp/ssl_init.c                 |  4 ---
+ libntp/libssl_compat.c            |  3 ++
+ libntp/ssl_init.c                 |  8 ++---
  ntpd/ntp_crypto.c                 | 11 +++++-
+ ntpq/ntpq.c                       |  4 +--
  sntp/configure.ac                 |  2 ++
+ sntp/crypto.c                     |  2 +-
+ sntp/m4/ntp_libntp.m4             |  2 ++
+ sntp/m4/ntp_wolfssl.m4            | 58 +++++++++++++++++++++++++++++++
  util/ntp-keygen.c                 | 22 ++++++++++--
- 9 files changed, 74 insertions(+), 43 deletions(-)
+ 15 files changed, 117 insertions(+), 19 deletions(-)
+ create mode 100644 sntp/m4/ntp_wolfssl.m4
 
 diff --git a/configure.ac b/configure.ac
-index aef7053..de9e789 100644
+index aef7053..a6d3b65 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -3008,34 +3008,38 @@ case "$ntp_libparse" in
- esac
- AC_MSG_RESULT([$ans])
+@@ -117,6 +117,8 @@ LIBOPTS_CHECK_NOBUILD([sntp/libopts])
+
+ NTP_LIBEVENT_CHECK_NOBUILD([2], [sntp/libevent])
 
--# if we have crypto, by default Autokey is enabled
--AC_ARG_ENABLE(
--    [autokey],
--    AS_HELP_STRING(
--	[--enable-autokey],
--	[+ support NTP Autokey protocol]
--	),
--    [ntp_autokey=$enableval],
--    [ntp_autokey=$ntp_openssl]
--)
--case "$ntp_autokey" in
-- no)
--    ;;
-- *)
--    case "$ntp_openssl" in
--     no)
--	AC_MSG_WARN([Disabling Autokey, crypto unavailable.])
--	ntp_autokey=no
--	;;
--     *)
--	AC_DEFINE([AUTOKEY], [1], [Support NTP Autokey protocol?])
--	ntp_autokey=yes
--	;;
--    esac
--    ;;
--esac
--AC_MSG_CHECKING([if NTP Autokey protocol will be supported])
--AC_MSG_RESULT([$ntp_autokey])
 +NTP_WOLFSSL
 +
-+if test $USE_WOLFSSL = no; then
-+	# if we have crypto, by default Autokey is enabled
-+	AC_ARG_ENABLE(
-+	    [autokey],
-+	    AS_HELP_STRING(
-+		[--enable-autokey],
-+		[+ support NTP Autokey protocol]
-+		),
-+	    [ntp_autokey=$enableval],
-+	    [ntp_autokey=$ntp_openssl]
-+	)
-+	case "$ntp_autokey" in
-+	 no)
-+	    ;;
-+	 *)
-+	    case "$ntp_openssl" in
-+	     no)
-+		AC_MSG_WARN([Disabling Autokey, crypto unavailable.])
-+		ntp_autokey=no
-+		;;
-+	     *)
-+		AC_DEFINE([AUTOKEY], [1], [Support NTP Autokey protocol?])
-+		ntp_autokey=yes
-+		;;
-+	    esac
-+	    ;;
-+	esac
-+	AC_MSG_CHECKING([if NTP Autokey protocol will be supported])
-+	AC_MSG_RESULT([$ntp_autokey])
+ NTP_LIBNTP
+
+ dnl  we need to check for cross compile tools for vxWorks here
+@@ -3008,6 +3010,7 @@ case "$ntp_libparse" in
+ esac
+ AC_MSG_RESULT([$ans])
+
++if test "x$USE_WOLFSSL" = xno; then
+ # if we have crypto, by default Autokey is enabled
+ AC_ARG_ENABLE(
+     [autokey],
+@@ -3036,6 +3039,7 @@ case "$ntp_autokey" in
+ esac
+ AC_MSG_CHECKING([if NTP Autokey protocol will be supported])
+ AC_MSG_RESULT([$ntp_autokey])
 +fi
 
  AC_SUBST([MAKE_CHECK_LAYOUT])
  AC_MSG_CHECKING([if we want to run check-layout])
+diff --git a/include/libssl_compat.h b/include/libssl_compat.h
+index 2a3697c..2964515 100644
+--- a/include/libssl_compat.h
++++ b/include/libssl_compat.h
+@@ -20,6 +20,8 @@
+ #ifndef NTP_LIBSSL_COMPAT_H
+ #define NTP_LIBSSL_COMPAT_H
+
++#ifndef WITH_WOLFSSL
++
+ #include "openssl/evp.h"
+ #include "openssl/dsa.h"
+ #include "openssl/rsa.h"
+@@ -116,4 +118,6 @@ extern int	sslshim_X509_get_signature_nid(const X509 *x);
+ #endif /* OPENSSL_VERSION_NUMBER < v1.1.0 */
+ /* ----------------------------------------------------------------- */
+
++#endif /* !WITH_WOLFSSL */
++
+ #endif /* NTP_LIBSSL_COMPAT_H */
 diff --git a/include/ntp_md5.h b/include/ntp_md5.h
-index 22caff3..0e12bf5 100644
+index 22caff3..fc2b6a8 100644
 --- a/include/ntp_md5.h
 +++ b/include/ntp_md5.h
 @@ -7,6 +7,7 @@
@@ -98,7 +83,7 @@ index 22caff3..0e12bf5 100644
  # if defined HAVE_MD5_H && defined HAVE_MD5INIT
  #  include <md5.h>
  # else
-@@ -17,18 +18,19 @@
+@@ -17,17 +18,18 @@
  #  define MD5Update(c, p, s)	isc_md5_update(c, (const void *)p, s)
  #  define MD5Final(d, c)	isc_md5_final((c), (d))	/* swapped */
  # endif
@@ -115,12 +100,10 @@ index 22caff3..0e12bf5 100644
  #  define CMAC                  "AES128CMAC"
  #  define AES_128_KEY_SIZE      16
 -# endif /*HAVE_OPENSSL_CMAC_H*/
--#else	/* !OPENSSL follows */
 +# endif /* HAVE_OPENSSL_CMAC_H || (WITH_WOLFSSL && WOLFSSL_CMAC) */
-+#else /* !OPENSSL follows */
+ #else	/* !OPENSSL follows */
  /*
   * Provide OpenSSL-alike MD5 API if we're not using OpenSSL
-  */
 diff --git a/libntp/lib/isc/include/isc/util.h b/libntp/lib/isc/include/isc/util.h
 index 670b28b..96b35c0 100644
 --- a/libntp/lib/isc/include/isc/util.h
@@ -178,10 +161,42 @@ index c6932d4..b7184f0 100644
  			    "%s: %d",
  			    isc_msgcat_get(isc_msgcat, ISC_MSGSET_SOCKADDR,
  					   ISC_MSG_UNKNOWNFAMILY,
+diff --git a/libntp/libssl_compat.c b/libntp/libssl_compat.c
+index 5527682..3a3ab79 100644
+--- a/libntp/libssl_compat.c
++++ b/libntp/libssl_compat.c
+@@ -17,6 +17,7 @@
+ #include "config.h"
+ #include "ntp_types.h"
+
++#ifndef WITH_WOLFSSL
+ /* ----------------------------------------------------------------- */
+ #ifdef OPENSSL
+ # include <string.h>
+@@ -339,3 +340,5 @@ NONEMPTY_TRANSLATION_UNIT
+ /* ----------------------------------------------------------------- */
+ #endif
+ /* ----------------------------------------------------------------- */
++
++#endif /* !WITH_WOLFSSL */
 diff --git a/libntp/ssl_init.c b/libntp/ssl_init.c
-index 6de8a0b..7756b79 100644
+index 6de8a0b..03e8794 100644
 --- a/libntp/ssl_init.c
 +++ b/libntp/ssl_init.c
+@@ -18,11 +18,11 @@
+ # include <openssl/evp.h>
+ # include <openssl/opensslv.h>
+ # include "libssl_compat.h"
+-# ifdef HAVE_OPENSSL_CMAC_H
++# if defined(HAVE_OPENSSL_CMAC_H) || (defined(WITH_WOLFSSL) && defined(WOLFSSL_CMAC))
+ #  include <openssl/cmac.h>
+ #  define CMAC_LENGTH	16
+ #  define CMAC		"AES128CMAC"
+-# endif /*HAVE_OPENSSL_CMAC_H*/
++# endif /* HAVE_OPENSSL_CMAC_H || (WITH_WOLFSSL && WOLFSSL_CMAC) */
+
+ EVP_MD_CTX *digest_ctx;
+
 @@ -134,10 +134,6 @@ keytype_from_text(
  	key_type = 0;
  #endif
@@ -224,19 +239,128 @@ index 38a62fd..6b44637 100644
  			/* fall through */
  		default:
  			DPRINTF(1, ("cert_parse: %s\n",
+diff --git a/ntpq/ntpq.c b/ntpq/ntpq.c
+index 56ff4e5..92623c0 100644
+--- a/ntpq/ntpq.c
++++ b/ntpq/ntpq.c
+@@ -41,10 +41,10 @@
+ #  endif
+ # endif
+ # include "libssl_compat.h"
+-# ifdef HAVE_OPENSSL_CMAC_H
++# if defined(HAVE_OPENSSL_CMAC_H) || (defined(WITH_WOLFSSL) && defined(WOLFSSL_CMAC))
+ #  include <openssl/cmac.h>
+ #  define CMAC "AES128CMAC"
+-# endif
++# endif /* HAVE_OPENSSL_CMAC_H || (WITH_WOLFSSL && WOLFSSL_CMAC) */
+ #endif
+ #include <ssl_applink.c>
+
 diff --git a/sntp/configure.ac b/sntp/configure.ac
-index 4fb182b..9213f62 100644
+index 4fb182b..1e9f3b2 100644
 --- a/sntp/configure.ac
 +++ b/sntp/configure.ac
-@@ -120,6 +120,8 @@ NTP_FACILITYNAMES
- # Checks for typedefs, structures, and compiler characteristics.
- AC_HEADER_STDBOOL
+@@ -60,6 +60,8 @@ NTP_LOCINFO()
+
+ AM_PROG_AR
 
 +NTP_WOLFSSL
 +
- NTP_IPV6
+ NTP_LIBNTP
 
- ###
+ LT_INIT([disable-shared])
+diff --git a/sntp/crypto.c b/sntp/crypto.c
+index 1be2ea3..db1f302 100644
+--- a/sntp/crypto.c
++++ b/sntp/crypto.c
+@@ -81,7 +81,7 @@ compute_mac(
+ 			goto mac_fail;
+ 		}
+ #ifdef OPENSSL	/* OpenSSL 1 supports return codes 0 fail, 1 okay */
+-#	    ifdef EVP_MD_CTX_FLAG_NON_FIPS_ALLOW
++#	    if defined(EVP_MD_CTX_FLAG_NON_FIPS_ALLOW) && !defined(WITH_WOLFSSL)
+ 		EVP_MD_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
+ #	    endif
+ 		/* [Bug 3457] DON'T use plain EVP_DigestInit! It would
+diff --git a/sntp/m4/ntp_libntp.m4 b/sntp/m4/ntp_libntp.m4
+index e0cc216..d11f956 100644
+--- a/sntp/m4/ntp_libntp.m4
++++ b/sntp/m4/ntp_libntp.m4
+@@ -1123,8 +1123,10 @@ dnl build from tarball.  It's only useful when modifying libntp source code
+ dnl and rebuilding in a client subdir rather than the whole package.
+ AM_CONDITIONAL([LIBNTP_SUBMAKES], [test x"$enable_dependency_tracking" = x"yes"])
+
++if test "x$USE_WOLFSSL" = xno; then
+ NTP_OPENSSL
+ NTP_CRYPTO_RAND
++fi
+
+ dnl add to LDADD_LIBNTP set by ntp_compiler.m4
+ LDADD_LIBNTP="$LDADD_LIBNTP $LIBS"
+diff --git a/sntp/m4/ntp_wolfssl.m4 b/sntp/m4/ntp_wolfssl.m4
+new file mode 100644
+index 0000000..f8d4de2
+--- /dev/null
++++ b/sntp/m4/ntp_wolfssl.m4
+@@ -0,0 +1,58 @@
++dnl ####################################################################
++dnl wolfSSL support
++dnl
++dnl Provides the --with-wolfssl=DIR command-line option.  When given,
++dnl the wolfSSL library is used in place of OpenSSL:
++dnl
++dnl	- include paths and -lwolfssl are added to CPPFLAGS_NTP /
++dnl	  LDADD_NTP so that all NTP binaries pick them up
++dnl	- WOLFSSL_USE_OPTIONS_H is defined so that the wolfSSL headers
++dnl	  include the build-time options.h on behalf of NTP
++dnl	- OPENSSL, WITH_WOLFSSL, ENABLE_CMAC, USE_OPENSSL_CRYPTO_RAND
++dnl	  and AUTOKEY are defined for config.h
++dnl
++dnl wolfSSL must be built with OPENSSL_EXTRA_BSD (e.g.
++dnl ./configure --enable-ntp CFLAGS="-DOPENSSL_EXTRA_BSD"), NTP uses
++dnl MD5Init/MD5Update/MD5Final which wolfSSL only provides under it.
++dnl
++dnl Must be called before NTP_LIBNTP (which calls NTP_OPENSSL).
++dnl
++dnl Output variables:
++dnl	USE_WOLFSSL	yes if wolfSSL is used, no otherwise
++dnl
++dnl ####################################################################
++AC_DEFUN([NTP_WOLFSSL], [
++AC_ARG_WITH(wolfssl,
++    AC_HELP_STRING([--with-wolfssl=DIR],[location of wolfssl]),
++[
++    CPPFLAGS_NTP="$CPPFLAGS_NTP -I${withval}/include/ -I${withval}/include/wolfssl -DWOLFSSL_USE_OPTIONS_H"
++    LDADD_NTP="$LDADD_NTP -L${withval}/lib -lwolfssl"
++    USE_WOLFSSL=yes
++],[USE_WOLFSSL=no])
++
++if test "x$USE_WOLFSSL" = xyes; then
++    SAVED_CFLAGS=$CFLAGS
++    CFLAGS="$CFLAGS $CPPFLAGS_NTP"
++    AC_CHECK_HEADER([wolfssl/options.h])
++    CFLAGS=$SAVED_CFLAGS
++    if test $ac_cv_header_wolfssl_options_h = yes; then
++        AC_MSG_CHECKING([for OPENSSL_EXTRA_BSD in wolfssl/options.h])
++        if grep -q "define OPENSSL_EXTRA_BSD" ${withval}/include/wolfssl/options.h; then
++            ans=yes
++        else
++            ans=no
++        fi
++        AC_MSG_RESULT([$ans])
++        if test $ans = no; then
++            AC_MSG_ERROR([wolfSSL was built without OPENSSL_EXTRA_BSD, which is required for MD5Init/MD5Update/MD5Final. Rebuild wolfSSL with: ./configure --enable-ntp CFLAGS="-DOPENSSL_EXTRA_BSD"])
++        fi
++        AC_DEFINE([OPENSSL], [], [Use OpenSSL?])
++        AC_DEFINE([WITH_WOLFSSL], [], [Use wolfSSL?])
++        AC_DEFINE([ENABLE_CMAC], [1], [Enable CMAC support?])
++        AC_DEFINE([USE_OPENSSL_CRYPTO_RAND], [1], [Use OpenSSL's crypto random functions?])
++        AC_DEFINE([AUTOKEY], [1], [Support NTP Autokey protocol?])
++    else
++        AC_MSG_ERROR([Unable to find wolfssl.])
++    fi
++fi
++])
 diff --git a/util/ntp-keygen.c b/util/ntp-keygen.c
 index c9c0ff9..de79f48 100644
 --- a/util/ntp-keygen.c
@@ -303,5 +427,5 @@ index c9c0ff9..de79f48 100644
  }
 
 -- 
-2.43.0
+2.39.5