[Git][NTPsec/ntpsec][master] ntpd/nts_server.c: send Internal Server Error record on key failure

[Matt Selsky (@selsky)]

Matt Selsky pushed to branch master at NTPsec / ntpsec


Commits:
de85dc6a by Matt Selsky at 2026-10-07T17:54:49+00:00
ntpd/nts_server.c: send Internal Server Error record on key failure

RFC 8915 4.1.3: "The server MUST respond with this error [2, Internal Server
Error] if it is unable to respond properly due to an internal condition."
nts_ke_request() already sends Error records for Unrecognized Critical Record
(0) and Bad Request (1), but a failure in nts_make_keys() still closed the
connection without a response.

- Add nts_internal_server_error = 2 to enum nts_errors_type.
- On nts_make_keys() failure, send Error(2) + EOM before returning.

- - - - -


2 changed files:

- include/nts.h
- ntpd/nts_server.c


Changes:

=====================================
include/nts.h
=====================================
@@ -199,7 +199,8 @@ enum nts_protocol_type {
 
 enum nts_errors_type {
         nts_unrecognized_critical_section = 0,
-        nts_bad_request = 1
+        nts_bad_request = 1,
+        nts_internal_server_error = 2
 };
 
 


=====================================
ntpd/nts_server.c
=====================================
@@ -426,6 +426,13 @@ void nts_ke_request(NTS_Server_Info *nsi, SSL *ssl) {
         keylen = nts_get_key_length(nsi->aead);
         if (!nts_make_keys(ssl, nsi->aead, c2s, s2c, keylen)) {
                 nsi->errtxt = "Can't make keys";
+                buf.next = buff;
+                buf.left = sizeof(buff);
+                ke_append_record_uint16(&buf, NTS_CRITICAL+nts_error,
+                  nts_internal_server_error);
+                ke_append_record_null(&buf, NTS_CRITICAL+nts_end_of_message);
+                used = sizeof(buff)-buf.left;
+                nts_ssl_write(ssl, buff, used, &nsi->errtxt);
                 return;
         }
 



View it on GitLab: https://gitlab.com/NTPsec/ntpsec/-/commit/de85dc6a527a87688ed0ed48b0b0a6e567c9600c

-- 
View it on GitLab: https://gitlab.com/NTPsec/ntpsec/-/commit/de85dc6a527a87688ed0ed48b0b0a6e567c9600c
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ntpsec.org/pipermail/vc/attachments/20261007/ecdc4f86/attachment-0001.htm>