Allow 24-byte NTP MACs

[lblommesteyn]

Summary

• treat 24‑octet MACs as valid in Mac::deserialize, matching RFC 7822’s allowance for 4+20 byte digests
• add regression tests covering accepted MAC lengths and the rejection path for oversized MACs

Testing

• cargo +1.88.0 test -p ntp-proto mac::tests::roundtrip mac::tests::accepts_various_lengths mac::tests::rejects_too_long

[lblommesteyn]

Root cause

Mac::deserialize returned IncorrectLength whenever a MAC was at least 24 bytes. RFC 7822 allows MACs of 16–24 bytes (4‑byte key ID + up to 20 bytes), so any client sending the full 24 bytes was rejected. In practice that meant NTS-authenticated requests using 20‑byte digests were treated as parse errors and dropped—a remote DoS against authenticated clients.

Fix

• Relax the upper bound so values up to MAXIMUM_SIZE (24 bytes) are accepted.
• Add unit tests covering 4, 20, and 24‑byte MACs and confirming that anything longer still fails.

With those changes, RFC-compliant MACs are accepted again while malformed packets remain filtered out.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.47%. Comparing base (528e142) to head (50f83b6).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2009      +/-   ##
==========================================
- Coverage   83.50%   83.47%   -0.04%     
==========================================
  Files          70       70              
  Lines       19315    19330      +15     
==========================================
+ Hits        16129    16135       +6     
- Misses       3186     3195       +9     

Flag	Coverage Δ
fuzz-cookie_parsing_sound	0.41% <0.00%> (-0.05%)	⬇️
fuzz-duration_from_float	0.28% <0.00%> (ø)
fuzz-encrypted_client_parsing	6.60% <100.00%> (-1.14%)	⬇️
fuzz-encrypted_server_parsing	10.12% <100.00%> (-0.58%)	⬇️
fuzz-ipfilter	2.59% <0.00%> (ø)
fuzz-key_exchange_request_parsing	3.90% <0.00%> (-2.13%)	⬇️
fuzz-key_exchange_response_parsing	3.72% <0.00%> (-0.12%)	⬇️
fuzz-packet_keyset	5.10% <100.00%> (-0.86%)	⬇️
fuzz-packet_parsing_sound	6.32% <100.00%> (-1.99%)	⬇️
fuzz-record_encode_decode	4.68% <0.00%> (ø)
test-aarch64-apple-darwin	83.19% <100.00%> (+0.01%)	⬆️
test-x86_64-unknown-linux-gnu	83.10% <100.00%> (+0.01%)	⬆️
test-x86_64-unknown-linux-musl	83.10% <100.00%> (+0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.