Repository navigation
feat(ntp): RFC 5905 symmetric-key MD5 MAC authentication (#361) - #698
Merged
Merged
Conversation
- libntp: MD5 (RFC 1321), RFC 5905 authenticator: build_request_authed, sign_request_md5, parse_reply_authed (rejects missing key id / bad MAC via constant-time compare), parse_key_hex. MAC = MD5(key || packet-through-keyid). New errors AuthMissing/AuthKeyMismatch/AuthFailed. - ntpd: reads KeyId/Key/Mac from Ntpd\Parameters; when a key is configured it sends authenticated requests and rejects unauthenticated replies. Off by default (no Key) so unconfigured behaviour is unchanged. - tests (libntp, host): MD5 RFC 1321 vectors, request key id, valid-MAC accept, and rejection of unauthenticated / key-id-mismatch / wrong-key / tampered replies, hex key parsing. 24/24. - docs/services/ntpd.md: KeyId/Key/Mac + authentication and NTS-unsupported note. NTS (RFC 8915) is out of scope (no TLS). Verified: libntp 24/24; QEMU 953/953.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #361.
What
RFC 5905 Appendix A symmetric-key authentication (key id + MD5 MAC). NTS (RFC 8915) stays out of scope (no TLS).
build_request_authed/sign_request_md5/parse_reply_authed(constant-time MAC compare; rejects missing authenticator, key-id mismatch, bad MAC) +parse_key_hex. MAC =MD5(key || packet-through-key-id).KeyId/Key/MacfromNtpd\Parameters; sends authenticated requests and requires verified replies when a key is set. Off by default (noKey) — unconfigured behaviour unchanged.docs/services/ntpd.mdconfig table + authentication section + MD5/NTS limitations.Acceptance criteria (#361)
parse_reply_authedenforces it; tested (plain 48-byte reply →AuthMissing).docs/services/ntpd.md.Limits
MD5 is the RFC 5905 default and is not collision-resistant; NTS is not implemented. The authenticated success path could not be exercised against a real server (no pre-shared key with a public server), so it is covered by unit tests at the parse boundary; the unauthenticated path is unchanged and still syncs in VirtualBox.
QEMU
neodev test: 953/953;check-depsclean.