What we’ve accomplished

This was not a trivial achievement. One of our team members has more experience doing messy repository conversions than anyone else alive, including gnarly and venerable projects like groff and Emacs. Producing a really high-quality conversion took him ten weeks of concentrated effort. You can read more about how to spot a high-quality repository conversion; our NTP history has all the traits of good ones.

To prevent buffer overruns, we have replaced all unsafe string functions (strcpy/strcat/strtok/sprintf/vsprintf/gets) with safe versions that take a buffer bound.

On 2020-09-30 the IETF released RFC8915 "Network Time Security for the Network Time Protocol". We implemented NTS as of draft 17, and tracked changes to each draft to remain conformat. We successfully interoperate with several test implementations.

Less code means less attack surface. Here are some things we’ve found to remove:

When NTP was originally written, computer clocks only delivered microsecond precision. Now they deliver nanosecond precision (though not all of that precision is accurate). By changing some internal representations we have made NTPsec able to use the full precision of modern clocks, which results in a factor 10 or more of accuracy improvement with real hardware such as GPSDOs and dedicated time radios.

Legacy versions of NTP required synchronization to network check peers before they could use local reference clocks. Ours does not, provided the refclock driver returns 4-digit years.

The ntp.conf configuration syntax for declaring local reference clocks was notoriously odd and opaque. While we continue to support it for backward compatibility, we have implemented and documented a simpler and more comprehensible syntax. No more magic 127.127.t.u address or numeric driver types!

Tuning the configuration of a time server is a subtle and sometimes tricky process. The causes of problems can range from misconfiguration through power outages to bad network weather and beyond. NTP keeps logs of operating statistics that can be very helpful - if you know how to interpret them. NTPsec supplies a visualization tool that makes those numbers into graphs so you can (literally) see what’s going on.

NTP Classic had occasionally been Coverity-checked in the past, but those warnings were not systematically fixed. We found 40 unresolved defect reports and dealt with them appropriately.

All compiler warnings have been either fixed or suppressed for principled reasons (like "that one is caused by a known GCC optimizer bug"). This may seem like a small thing, but it can have a significant effect on maintainability and downstream defect rates. Noise warnings are a kind of undergrowth in which real warnings and the bugs that trigger them can lurk undetected.

By well-defined transformations of the code, including improving its type discipline, we can give static analyzers and verification tools better traction to find defects and potential vulnerabilities. We’ve got a good running start on this already, changing the code to use C99 bools wherever possible and safe.

The NTP Classic build system was 31,000 lines of impacted autotools cruft, a Lovecraftian nightmare of complexity that reached out from sunken R’lyeh to trouble the dreams of the living. We switched to waf, an alternative single-phase build system also used (among other places) by the Samba project. Our builds got an order of magnitude faster, and the new build recipe is about 1 KLOC!

The NTP in-tree documentation was in terrible shape - incomplete where it was not actively misleading, with some parts of it that needed updating (such as the WHERE-TO-START file) actually unmodified since 1998. It had a serious problem with different documents telling different stories. We’ve fixed all that; every command-line switch and every configuration entity now has a single point of truth, also the manual pages and Web documentation are generated from the same master files. Archaisms have been removed and much has been updated.

The code we inherited used way too many languages - there were scripts lurking in Perl, awk, and S. By discarding or replacing this stuff we have increased its maintainability, leaving fewer dark corners for bugs to lurk in. All the scripting we install is now Python, creating opportunities for code reuse across programs that didn’t exist before.

We have collected on the gains from Pythonizing all our scripting by adding ntpmon, an administrator’s tool that can watch the status of a time server in near real time. It is especially useful for catching startup problems and traffic spikes that might indicate a DoS attempt.

NTPSec was the first NTP implementation to respond to and develop a fix for CVE-2015-7704, the KoD off-path attack bug that achieved news coverage in Ars Technica and elsewhere in October 2015. Even before we first shipped code we participated in the mitigation and disclosure process on over a dozen CVEs, and developed good working relationships with some key players in the security community. They have already learned to trust us to respond rapidly and effectively to vulnerability reports.

Since early 2016 and our 0.1 release it has become routine that, in public disclosures of batches of CVEs against NTP Classic, around 75% fail to affect NTPsec at all because we had pre-hardened the code or removed the relevant attack surface.