From 3a4a4def5d0538733309bd1fafaacfccb6b4eded Mon Sep 17 00:00:00 2001 From: Christian Weisgerber Date: Sat, 5 Mar 2016 16:09:21 +0000 Subject: According to RFC7231, section 7.1.1.1, the HTTP date header supports no other timezone than the fixed string "GMT". Avoid using strptime %Z, which is nonstandard and can give surprising results on other operating systems. ok deraadt@ giovanni@ bcook@ --- usr.sbin/ntpd/constraint.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'usr.sbin') diff --git a/usr.sbin/ntpd/constraint.c b/usr.sbin/ntpd/constraint.c index 169007e4bde..e09c654ddf4 100644 --- a/usr.sbin/ntpd/constraint.c +++ b/usr.sbin/ntpd/constraint.c @@ -1,4 +1,4 @@ -/* $OpenBSD: constraint.c,v 1.25 2016/01/27 21:48:34 reyk Exp $ */ +/* $OpenBSD: constraint.c,v 1.26 2016/03/05 16:09:20 naddy Exp $ */ /* * Copyright (c) 2015 Reyk Floeter @@ -903,7 +903,7 @@ httpsdate_request(struct httpsdate *httpsdate, struct timeval *when) * or ANSI C's asctime() - the latter doesn't include * the timezone which is required here. */ - if (strptime(p, "%a, %d %h %Y %T %Z", + if (strptime(p, "%a, %d %h %Y %T GMT", &httpsdate->tls_tm) == NULL) { log_warnx("unsupported date format"); free(line); -- cgit v1.2.3