From: Miroslav Lichvar Date: Wed, 22 Jul 2026 13:18:26 +0000 (+0200) Subject: nts: add parameter for maximum NTS-KE retry interval X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=57d2edf6625d783fe892a4bc0296ea77bc3823ed;p=thirdparty%2Fchrony.git nts: add parameter for maximum NTS-KE retry interval Add a new parameter to the NAU/NNC functions creating a new NTS instance for the maximum NTS-KE retry interval. --- diff --git a/ntp_auth.c b/ntp_auth.c index 58374c57..b90e9168 100644 --- a/ntp_auth.c +++ b/ntp_auth.c @@ -148,11 +148,12 @@ NAU_CreateSymmetricInstance(uint32_t key_id) NAU_Instance NAU_CreateNtsInstance(IPSockAddr *nts_address, const char *name, uint32_t cert_set, - uint16_t ntp_port) + uint16_t ntp_port, int max_retry_interval2) { NAU_Instance instance = create_instance(NTP_AUTH_NTS); - instance->nts = NNC_CreateInstance(nts_address, name, cert_set, ntp_port); + instance->nts = NNC_CreateInstance(nts_address, name, cert_set, ntp_port, + max_retry_interval2); return instance; } diff --git a/ntp_auth.h b/ntp_auth.h index 0b8a8253..c7999196 100644 --- a/ntp_auth.h +++ b/ntp_auth.h @@ -37,7 +37,8 @@ typedef struct NAU_Instance_Record *NAU_Instance; extern NAU_Instance NAU_CreateNoneInstance(void); extern NAU_Instance NAU_CreateSymmetricInstance(uint32_t key_id); extern NAU_Instance NAU_CreateNtsInstance(IPSockAddr *nts_address, const char *name, - uint32_t cert_set, uint16_t ntp_port); + uint32_t cert_set, uint16_t ntp_port, + int max_retry_interval2); /* Destroy an instance */ extern void NAU_DestroyInstance(NAU_Instance instance); diff --git a/ntp_core.c b/ntp_core.c index bb9920d0..863c99ea 100644 --- a/ntp_core.c +++ b/ntp_core.c @@ -666,7 +666,7 @@ NCR_CreateInstance(NTP_Remote_Address *remote_addr, NTP_Source_Type type, nts_address.port = params->nts_port; result->auth = NAU_CreateNtsInstance(&nts_address, name, params->cert_set, - result->remote_addr.port); + result->remote_addr.port, 19); } else if (params->authkey != INACTIVE_AUTHKEY) { result->auth = NAU_CreateSymmetricInstance(params->authkey); } else { diff --git a/nts_ke.h b/nts_ke.h index 2cfbb085..191a9931 100644 --- a/nts_ke.h +++ b/nts_ke.h @@ -59,7 +59,8 @@ #define NKE_RETRY_FACTOR2_CONNECT 4 #define NKE_RETRY_FACTOR2_TLS 10 -#define NKE_MAX_RETRY_INTERVAL2 19 +#define NKE_MIN_MAX_RETRY_INTERVAL2 6 +#define NKE_MAX_MAX_RETRY_INTERVAL2 24 typedef struct { int length; diff --git a/nts_ntp_client.c b/nts_ntp_client.c index 2c3464fe..3b92d1a4 100644 --- a/nts_ntp_client.c +++ b/nts_ntp_client.c @@ -61,6 +61,8 @@ struct NNC_Instance_Record { uint32_t cert_set; /* Configured NTP port */ uint16_t default_ntp_port; + /* Configured maximum NTS-KE retry interval */ + int32_t max_retry_interval2; /* Address of NTP server (can be negotiated in NTS-KE) */ IPSockAddr ntp_address; @@ -121,7 +123,8 @@ reset_instance(NNC_Instance inst) /* ================================================== */ NNC_Instance -NNC_CreateInstance(IPSockAddr *nts_address, const char *name, uint32_t cert_set, uint16_t ntp_port) +NNC_CreateInstance(IPSockAddr *nts_address, const char *name, uint32_t cert_set, + uint16_t ntp_port, int max_retry_interval2) { NNC_Instance inst; @@ -131,6 +134,8 @@ NNC_CreateInstance(IPSockAddr *nts_address, const char *name, uint32_t cert_set, inst->name = Strdup(name); inst->cert_set = cert_set; inst->default_ntp_port = ntp_port; + inst->max_retry_interval2 = CLAMP(NKE_MIN_MAX_RETRY_INTERVAL2, max_retry_interval2, + NKE_MAX_MAX_RETRY_INTERVAL2); inst->ntp_address.ip_addr = nts_address->ip_addr; inst->ntp_address.port = ntp_port; inst->siv = NULL; @@ -236,7 +241,7 @@ update_next_nke_attempt(NNC_Instance inst, int failed_start, double now) return; factor = NKC_GetRetryFactor(inst->nke); - interval = MIN(factor + inst->nke_attempts - 1, NKE_MAX_RETRY_INTERVAL2); + interval = MIN(factor + inst->nke_attempts - 1, inst->max_retry_interval2); inst->next_nke_attempt = now + UTI_Log2ToDouble(interval); } diff --git a/nts_ntp_client.h b/nts_ntp_client.h index 2c314cca..cb408ef5 100644 --- a/nts_ntp_client.h +++ b/nts_ntp_client.h @@ -34,7 +34,8 @@ typedef struct NNC_Instance_Record *NNC_Instance; extern NNC_Instance NNC_CreateInstance(IPSockAddr *nts_address, const char *name, - uint32_t cert_set, uint16_t ntp_port); + uint32_t cert_set, uint16_t ntp_port, + int max_retry_interval2); extern void NNC_DestroyInstance(NNC_Instance inst); extern int NNC_PrepareForAuth(NNC_Instance inst); extern int NNC_GenerateRequestAuth(NNC_Instance inst, NTP_Packet *packet, diff --git a/stubs.c b/stubs.c index afa925e2..31d3d70b 100644 --- a/stubs.c +++ b/stubs.c @@ -197,7 +197,7 @@ NNS_GenerateResponseAuth(NTP_Packet *request, NTP_PacketInfo *req_info, NNC_Instance NNC_CreateInstance(IPSockAddr *nts_address, const char *name, uint32_t cert_set, - uint16_t ntp_port) + uint16_t ntp_port, int max_retry_interval2) { return NULL; } diff --git a/test/unit/ntp_auth.c b/test/unit/ntp_auth.c index e2924a33..a9f32865 100644 --- a/test/unit/ntp_auth.c +++ b/test/unit/ntp_auth.c @@ -169,7 +169,7 @@ test_unit(void) can_auth_res = can_auth_req; break; case 2: - inst = NAU_CreateNtsInstance(&nts_addr, "test", 0, 0); + inst = NAU_CreateNtsInstance(&nts_addr, "test", 0, 0, 0); TEST_CHECK(NAU_IsAuthEnabled(inst)); TEST_CHECK(NAU_GetSuggestedNtpVersion(inst) == 4); mode = NTP_AUTH_NTS; diff --git a/test/unit/nts_ntp_client.c b/test/unit/nts_ntp_client.c index 4b567324..6a773442 100644 --- a/test/unit/nts_ntp_client.c +++ b/test/unit/nts_ntp_client.c @@ -253,7 +253,7 @@ test_unit(void) SCK_GetLoopbackIPAddress(AF_INET, &addr.ip_addr); addr.port = 0; - inst = NNC_CreateInstance(&addr, "test", 0, 0); + inst = NNC_CreateInstance(&addr, "test", 0, 0, 0); TEST_CHECK(inst); for (i = 0; i < 100000; i++) {