nts: add parameter for maximum NTS-KE retry interval

Add a new parameter to the NAU/NNC functions creating a new NTS instance
for the maximum NTS-KE retry interval.

diff --git a/ntp_auth.c b/ntp_auth.c
index 58374c57baef5d91fa876af7e5318483dd33ca1e..b90e916831f60bd024661f8d65a0b8a8db50f306 100644 (file)
--- a/ntp_auth.c
+++ b/ntp_auth.c
@@ -148,11 +148,12 @@ NAU_CreateSymmetricInstance(uint32_t key_id)
 
 NAU_Instance
 NAU_CreateNtsInstance(IPSockAddr *nts_address, const char *name, uint32_t cert_set,
-                      uint16_t ntp_port)
+                      uint16_t ntp_port, int max_retry_interval2)
 {
   NAU_Instance instance = create_instance(NTP_AUTH_NTS);
 
-  instance->nts = NNC_CreateInstance(nts_address, name, cert_set, ntp_port);
+  instance->nts = NNC_CreateInstance(nts_address, name, cert_set, ntp_port,
+                                     max_retry_interval2);
 
   return instance;
 }

diff --git a/ntp_auth.h b/ntp_auth.h
index 0b8a8253e10630f7c32238d2e935c00e7015891c..c7999196cc30d1344c106a38dadbcc555f078d9d 100644 (file)
--- a/ntp_auth.h
+++ b/ntp_auth.h
@@ -37,7 +37,8 @@ typedef struct NAU_Instance_Record *NAU_Instance;
 extern NAU_Instance NAU_CreateNoneInstance(void);
 extern NAU_Instance NAU_CreateSymmetricInstance(uint32_t key_id);
 extern NAU_Instance NAU_CreateNtsInstance(IPSockAddr *nts_address, const char *name,
-                                          uint32_t cert_set, uint16_t ntp_port);
+                                          uint32_t cert_set, uint16_t ntp_port,
+                                          int max_retry_interval2);
 
 /* Destroy an instance */
 extern void NAU_DestroyInstance(NAU_Instance instance);

diff --git a/ntp_core.c b/ntp_core.c
index bb9920d00860015dedc7a79a0c7a78b0a88aa131..863c99ea5a30bccfaff11b5556af27d711ac05a8 100644 (file)
--- a/ntp_core.c
+++ b/ntp_core.c
@@ -666,7 +666,7 @@ NCR_CreateInstance(NTP_Remote_Address *remote_addr, NTP_Source_Type type,
     nts_address.port = params->nts_port;
 
     result->auth = NAU_CreateNtsInstance(&nts_address, name, params->cert_set,
-                                         result->remote_addr.port);
+                                         result->remote_addr.port, 19);
   } else if (params->authkey != INACTIVE_AUTHKEY) {
     result->auth = NAU_CreateSymmetricInstance(params->authkey);
   } else {

diff --git a/nts_ke.h b/nts_ke.h
index 2cfbb085c8621937aa4feddb79857c26574bbb97..191a99313659b67d4531138b786d0027fa78cc10 100644 (file)
--- a/nts_ke.h
+++ b/nts_ke.h
@@ -59,7 +59,8 @@
 
 #define NKE_RETRY_FACTOR2_CONNECT       4
 #define NKE_RETRY_FACTOR2_TLS           10
-#define NKE_MAX_RETRY_INTERVAL2         19
+#define NKE_MIN_MAX_RETRY_INTERVAL2     6
+#define NKE_MAX_MAX_RETRY_INTERVAL2     24
 
 typedef struct {
   int length;

diff --git a/nts_ntp_client.c b/nts_ntp_client.c
index 2c3464fe8c3a8cab71d7921bb1bce555fe50589c..3b92d1a4e11ba6e6e7e15dcb36a627c70ef00849 100644 (file)
--- a/nts_ntp_client.c
+++ b/nts_ntp_client.c
@@ -61,6 +61,8 @@ struct NNC_Instance_Record {
   uint32_t cert_set;
   /* Configured NTP port */
   uint16_t default_ntp_port;
+  /* Configured maximum NTS-KE retry interval */
+  int32_t max_retry_interval2;
   /* Address of NTP server (can be negotiated in NTS-KE) */
   IPSockAddr ntp_address;
 
@@ -121,7 +123,8 @@ reset_instance(NNC_Instance inst)
 /* ================================================== */
 
 NNC_Instance
-NNC_CreateInstance(IPSockAddr *nts_address, const char *name, uint32_t cert_set, uint16_t ntp_port)
+NNC_CreateInstance(IPSockAddr *nts_address, const char *name, uint32_t cert_set,
+                   uint16_t ntp_port, int max_retry_interval2)
 {
   NNC_Instance inst;
 
@@ -131,6 +134,8 @@ NNC_CreateInstance(IPSockAddr *nts_address, const char *name, uint32_t cert_set,
   inst->name = Strdup(name);
   inst->cert_set = cert_set;
   inst->default_ntp_port = ntp_port;
+  inst->max_retry_interval2 = CLAMP(NKE_MIN_MAX_RETRY_INTERVAL2, max_retry_interval2,
+                                    NKE_MAX_MAX_RETRY_INTERVAL2);
   inst->ntp_address.ip_addr = nts_address->ip_addr;
   inst->ntp_address.port = ntp_port;
   inst->siv = NULL;
@@ -236,7 +241,7 @@ update_next_nke_attempt(NNC_Instance inst, int failed_start, double now)
     return;
 
   factor = NKC_GetRetryFactor(inst->nke);
-  interval = MIN(factor + inst->nke_attempts - 1, NKE_MAX_RETRY_INTERVAL2);
+  interval = MIN(factor + inst->nke_attempts - 1, inst->max_retry_interval2);
   inst->next_nke_attempt = now + UTI_Log2ToDouble(interval);
 }
 

diff --git a/nts_ntp_client.h b/nts_ntp_client.h
index 2c314cca7974da5c638af18ff242f5162d14d386..cb408ef5833015d6a04f50803628aa5948835e08 100644 (file)
--- a/nts_ntp_client.h
+++ b/nts_ntp_client.h
@@ -34,7 +34,8 @@
 typedef struct NNC_Instance_Record *NNC_Instance;
 
 extern NNC_Instance NNC_CreateInstance(IPSockAddr *nts_address, const char *name,
-                                       uint32_t cert_set, uint16_t ntp_port);
+                                       uint32_t cert_set, uint16_t ntp_port,
+                                       int max_retry_interval2);
 extern void NNC_DestroyInstance(NNC_Instance inst);
 extern int NNC_PrepareForAuth(NNC_Instance inst);
 extern int NNC_GenerateRequestAuth(NNC_Instance inst, NTP_Packet *packet,

diff --git a/stubs.c b/stubs.c
index afa925e2cf17456856ccd403bfaaad20c5be7e17..31d3d70bbdfb7279e2c909b9b9cf806fe568441f 100644 (file)
--- a/stubs.c
+++ b/stubs.c
@@ -197,7 +197,7 @@ NNS_GenerateResponseAuth(NTP_Packet *request, NTP_PacketInfo *req_info,
 
 NNC_Instance
 NNC_CreateInstance(IPSockAddr *nts_address, const char *name, uint32_t cert_set,
-                   uint16_t ntp_port)
+                   uint16_t ntp_port, int max_retry_interval2)
 {
   return NULL;
 }

diff --git a/test/unit/ntp_auth.c b/test/unit/ntp_auth.c
index e2924a3348b12077329d64cca9c110774a7d2fb9..a9f32865df9b9040f52e83fe2e8fe80694f30e4c 100644 (file)
--- a/test/unit/ntp_auth.c
+++ b/test/unit/ntp_auth.c
@@ -169,7 +169,7 @@ test_unit(void)
         can_auth_res = can_auth_req;
         break;
       case 2:
-        inst = NAU_CreateNtsInstance(&nts_addr, "test", 0, 0);
+        inst = NAU_CreateNtsInstance(&nts_addr, "test", 0, 0, 0);
         TEST_CHECK(NAU_IsAuthEnabled(inst));
         TEST_CHECK(NAU_GetSuggestedNtpVersion(inst) == 4);
         mode = NTP_AUTH_NTS;

diff --git a/test/unit/nts_ntp_client.c b/test/unit/nts_ntp_client.c
index 4b56732446a71ab64b20c5e34be4ea7ef9edc54e..6a773442282ef025ccf61f617169d7ede9efcf3c 100644 (file)
--- a/test/unit/nts_ntp_client.c
+++ b/test/unit/nts_ntp_client.c
@@ -253,7 +253,7 @@ test_unit(void)
   SCK_GetLoopbackIPAddress(AF_INET, &addr.ip_addr);
   addr.port = 0;
 
-  inst = NNC_CreateInstance(&addr, "test", 0, 0);
+  inst = NNC_CreateInstance(&addr, "test", 0, 0, 0);
   TEST_CHECK(inst);
 
   for (i = 0; i < 100000; i++) {