NTS support for systemd-timesyncd #39010

squell · 2025-09-18T13:57:49Z

This is intended to eventually close #9481

Some comments:

To keep the modification well-separated, the additions to timesyncd are split up two clearly distinguishable parts:
- The NTS logic itself; these were developed first in the repo https://github.com/squell/nts
- Modifications to integrate those into the timesyncd sources.
Currently, to select an "NTS server" an NTS= line needs to be added to the configuration; because the intent is "secure time", enabling it will ignore all other NTP servers (except for the FallbackNTP). Maybe in the future (if NTS gains traction) it might be wise to configure this differently (e.g. RequireSureTime=yes or something).
The function manager_nts_obtain_agreement currently does busy-waiting (which has the advantage of making it perhaps a bit easier to follow the logic). This still should be integrated in the async event loop! (hence the "draft" status of this PR).
The current meson build system modifications take some pains to make the selection of TLS and crypto backends flexible. I've learned from @poettering that the intent is to consolidate on OpenSSL; so that part can be simplified. Do note that the minimum required OpenSSL version is v3.5 due to a bug in OpenSSL (and a workaround for that bug not being universally compatible with existing NTS servers). In any case, this PR still allows selecting gnutls for TLS and nettle and gcrypt as alternative crypto backends. Not included in this PR (but available if desired) is a crypto backend that relies on libaes_siv, which would allow using older OpenSSL versions.
I'm not 100% sure I didn't miss some config file for integrating the tests and fuzzing code; if there's anything missing, a PR on our forked repo is appreciated!
To get in the weeds on NTS protocol details:
- This patch set supports plenty of AEAD choices. This PR will signal a preference for AES-GCM-SIV crypto (because it is most space-efficient). This will only work with up-to-date Chrony implementations (4.6.1 or later, for annoying reasons). In my practical tests I haven't found any NTS servers running an older Chrony version, and I don't think it's very useful to make this fresh NTS implementation "bug-compatible" with older Chrony versions. By the time NTS lands in timesyncd I would hope that this issue is long forgotten. But if this is seen as problematic, it's very easy to make the default AES-SIV-CMAC.
- In case there are missing cookies, the code will only ever replenish these "one cookie at a time". I've discovered (and been advised by @davidv1992) that many routers don't like large NTP packets, so this is the more robust option.

…ion warnings

src/timesync/nts_tls.c

poettering · 2025-09-18T20:44:37Z

src/timesync/tcp_connect.c

+
+                int flags;
+                if((flags = fcntl(sock, F_GETFL)) < 0 || fcntl(sock, F_SETFL, flags | O_NONBLOCK) < 0) {
+                        return close(sock), -2;


ever use raw close() in our codebase. use safe_close().

and usually you don't want to use that either, use _cleanup_close_.

finally, please just create the socket with O_NONBLOCK right-away, u.e. use SOCK_NONBLOCK.

poettering · 2025-09-18T20:44:59Z

src/timesync/tcp_connect.c

+                        continue;
+                }
+
+                int sock = socket(cur->ai_family, type, 0);


all our fds must have O_CLOEXEC set, except if it's clear they should not use it. hence please use SOCK_CLOEXEC

poettering · 2025-09-18T20:45:18Z

src/timesync/tcp_connect.c

+                }
+
+                int status = 1;
+                setsockopt(sock, IPPROTO_TCP, TCP_NODELAY, &status, sizeof(status));


please debug log about unexpected failures at least. also, use setsockopt_bool()

poettering · 2025-09-18T20:47:22Z

src/timesync/tcp_connect.c

+        hints.ai_socktype = type;
+
+        struct addrinfo *info;
+        if (getaddrinfo(host, NULL, &hints, &info) != 0)


please never use a blocking call like this in an event-loop based serice such as timesyncd. use sd_resolve_xyz

poettering · 2025-09-18T20:48:51Z

src/timesync/timesyncd-manager.c

+        assert_return(nts_handshake, -ENOMEM);
+
+        while ((r = NTS_TLS_handshake(nts_handshake)) > 0 && tls_patience_msec-- > 0)
+                usleep_safe(USEC_PER_MSEC);


what's this?

no blocking calls like this. this is event loop driven...

src/timesync/timesyncd-manager.c

poettering · 2025-09-18T20:51:43Z

i did some initial review now. please have a closer look at the coding style docs.

squell · 2025-09-19T09:27:18Z

Thanks for the quick initial review!

Note that the tcp_connect will eventually be completely removed as it's only part of the blocking handshake, which as mentioned needs to be rewritten to fit inside the event system.

hmm, what's the license of the code you are copying in in the first commit? we really want spdx headers.

They're LGPL2.1+ licensed (since they're specifically targetted for timesyncd).

…till trigger the compiler in case of misuse

squell · 2025-09-19T12:19:02Z

For my own reference, I'm tracking more general issues that still need attention on the forked repo: https://github.com/pendulum-project/nts-timesyncd/issues

bluca · 2025-09-19T16:24:53Z

meson_options.txt

 option('openssl', type : 'feature', deprecated : { 'true' : 'enabled', 'false' : 'disabled' },
       description : 'openssl support')
 option('cryptolib', type : 'combo', choices : ['auto', 'openssl', 'gcrypt'], deprecated : true)
+option('timesync-nts', type : 'combo', choices : ['auto', 'enabled', 'disabled'],


this should be of type "feature" rather than a manual combo

bluca · 2025-09-19T16:26:35Z

src/timesync/meson.build

+
+if conf.get('ENABLE_TIMESYNC_NTS') == 1
+
+executables += [


indentation and whitespace above

bluca · 2025-09-19T16:27:43Z

tools/dbus_ignorelist

 org.freedesktop.timesync1.Manager.SystemNTPServers
 org.freedesktop.timesync1.Manager.RuntimeNTPServers
 org.freedesktop.timesync1.Manager.FallbackNTPServers
+org.freedesktop.timesync1.Manager.NTSKeyExchangeServers


Don't, add to the version history instead

behrmann · 2025-09-22T22:09:41Z

man/systemd-timesyncd.service.xml

    <filename>systemd-timesyncd.service</filename>.</para>

+    <para>The <filename>systemd-timesyncd.service</filename> service supports the Network Time Security (NTS)
+    mechanism for NTP. These allow for authentication of the time source and protect against spoofing attacks.</para>


What does the plural here refer to?

Suggested change

mechanism for NTP. These allow for authentication of the time source and protect against spoofing attacks.</para>

mechanism for NTP. This allows for authentication of the time source and protect against spoofing attacks.</para>

behrmann · 2025-09-22T22:10:25Z

man/timesyncd.conf.xml

+        <command>systemd-timesyncd</command> will contact all configured servers in turn, until one responds.
+        When the empty string is assigned, the list of NTS servers is reset, and
+        all prior assignments will have no effect. This setting defaults to an empty list.
+        If NTS severs have been configured, any other configured NTP servers (including per-interface NTP servers acquired


Suggested change

If NTS severs have been configured, any other configured NTP servers (including per-interface NTP servers acquired

If NTS servers have been configured, any other configured NTP servers (including per-interface NTP servers acquired

squell and others added 26 commits September 18, 2025 14:35

add sources from https://github.com/squell/nts.git

56756ef

let the user configure NTS servers using NTS= / SecureServers=

5c3a348

add logic to try NTSKE servers first (and only)

96d158e

add initial key exchange control flow logic

308a0b9

add error handling

9eddb78

store keys and cookies

5cbd344

send extension fields

1d58176

add tolerance for NTS servers that send broken-up NTS responses

1b6afba

don't add nonce if there are NTS extension fields

f54fb62

free cookies, move handshake out of manager object, fix some compilat…

34ba48a

…ion warnings

add verification of NTS extension fields

88d9e1b

add detection of NTS unique identifier

65f1cb9

add FIFO queue system for cookies

a378cbc

request additional cookies if we are missing some

141c03e

change classification of log messages

e781dbb

add cookie choice randomization

1730287

add timeout logic

ce95feb

make timeout configurable

49d8d6d

add a preference for GCM

a8a523d

add comment about cookie replenishment strategy

ae323e4

scaffolding for meson

0830f28

integrate nts config into existing systemd structure (mostly)

ec81a7f

add NTS-tests

85a3aac

add fuzzers

6f4cbb7

set socket to O_NONBLOCK

e5a04ab

window dressing: explicitly mention security used in the log

0a23c66

squell force-pushed the nts-time-v258 branch from e276d71 to 0a23c66 Compare September 18, 2025 14:06

squell added 2 commits September 18, 2025 16:22

add manpage for NTS

c47b9a4

mark NTSKeyExchangeServers the same as FallbackNTPServers

13fde6d

github-actions bot added the documentation label Sep 18, 2025

poettering reviewed Sep 18, 2025

View reviewed changes

src/timesync/nts_tls.c Outdated Show resolved Hide resolved

poettering reviewed Sep 18, 2025

View reviewed changes

src/timesync/timesyncd-manager.c Outdated Show resolved Hide resolved

poettering reviewed Sep 18, 2025

View reviewed changes

src/timesync/timesyncd-manager.c Show resolved Hide resolved

poettering added the reviewed/needs-rework 🔨 PR has been reviewed and needs another round of reworks label Sep 18, 2025

squell added 2 commits September 19, 2025 10:34

add more aggressive input validation

890f572

add spdx headers

4f2723a

squell added 11 commits September 19, 2025 13:36

link source code to issues on forked repo

328db2d

make nts logic depend on systemd headers

3bdbf06

improve style in fuzz test, and use empty initializers gnuism

4b082e6

change interface of add_extension_fields to raise less eyebrows but s…

bc011a9

…till trigger the compiler in case of misuse

fix type of context

65cf889

make enum more conforming to coding standard

adeea65

respect the include ordering guideline

172bdb9

remove incorrect assert_return

0add2f4

remove every crypto provider except openssl

e296c08

DRY null cipher

ac2c357

more safety around potential future OpenSSL misconfiguration

6f7f328

silence more compiler warning

f92a88e

bluca reviewed Sep 19, 2025

View reviewed changes

behrmann reviewed Sep 22, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

NTS support for systemd-timesyncd #39010

NTS support for systemd-timesyncd #39010

squell commented Sep 18, 2025 •

edited

Loading

Uh oh!

Uh oh!

poettering Sep 18, 2025

Uh oh!

poettering Sep 18, 2025

Uh oh!

poettering Sep 18, 2025

Uh oh!

poettering Sep 18, 2025

Uh oh!

poettering Sep 18, 2025

Uh oh!

Uh oh!

Uh oh!

poettering commented Sep 18, 2025

Uh oh!

squell commented Sep 19, 2025

Uh oh!

squell commented Sep 19, 2025

Uh oh!

bluca Sep 19, 2025

Uh oh!

bluca Sep 19, 2025

Uh oh!

bluca Sep 19, 2025

Uh oh!

behrmann Sep 22, 2025

Uh oh!

behrmann Sep 22, 2025

Uh oh!

Uh oh!

	mechanism for NTP. These allow for authentication of the time source and protect against spoofing attacks.</para>
	mechanism for NTP. This allows for authentication of the time source and protect against spoofing attacks.</para>

	If NTS severs have been configured, any other configured NTP servers (including per-interface NTP servers acquired
	If NTS servers have been configured, any other configured NTP servers (including per-interface NTP servers acquired


		if conf.get('ENABLE_TIMESYNC_NTS') == 1

		executables += [

Uh oh!

NTS support for systemd-timesyncd #39010

Are you sure you want to change the base?

NTS support for systemd-timesyncd #39010

Conversation

squell commented Sep 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

poettering commented Sep 18, 2025

Uh oh!

squell commented Sep 19, 2025

Uh oh!

squell commented Sep 19, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

squell commented Sep 18, 2025 •

edited

Loading