[Git][NTPsec/ntpsec][master] ntpd/nts_extens.c: enforce RFC 8915 minimum Unique_Identifier length

[Matt Selsky (@selsky)]

Matt Selsky pushed to branch master at NTPsec / ntpsec


Commits:
26d04264 by Matt Selsky at 2026-10-05T14:45:19-04:00
ntpd/nts_extens.c: enforce RFC 8915 minimum Unique_Identifier length

RFC 8915 5.3 says the Unique Identifier "MUST be at least 32 octets long".
extens_server_recv() only checked the upper bound, NTS_UID_MAX_LENGTH (the size
of its buffer), so a UID as short as 0 bytes was accepted.

The UID is opaque data that is echoed back, so this is a protocol conformance
fix, not a memory safety one. Clients may send UIDs longer than 32 octets, so
the server checks a range rather than an exact length.

- - - - -


1 changed file:

- ntpd/nts_extens.c


Changes:

=====================================
ntpd/nts_extens.c
=====================================
@@ -153,7 +153,7 @@ bool extens_server_recv(struct ntspacket_t *ntspacket, uint8_t *pkt, int lng) {
                 }
                 switch (type) {
                     case Unique_Identifier:
-                        if (length > NTS_UID_MAX_LENGTH) {
+                        if (length > NTS_UID_MAX_LENGTH || length < NTS_UID_LENGTH) {
                                 return false;
                         }
                         ntspacket->uidlen = length;



View it on GitLab: https://gitlab.com/NTPsec/ntpsec/-/commit/26d04264f736a958be2ae0e1e04c95ad20ed5327

-- 
View it on GitLab: https://gitlab.com/NTPsec/ntpsec/-/commit/26d04264f736a958be2ae0e1e04c95ad20ed5327
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ntpsec.org/pipermail/vc/attachments/20261006/90e9b2ad/attachment.htm>