ntpsec-rs

ntpsec-rs is a forensic Rust reconstruction of NTPsec — a secure, modern, full-featured implementation of the Network Time Protocol. The entire NTPsec ecosystem — daemon, query tools, monitoring utilities, and supporting libraries — is being rebuilt in safe, idiomatic Rust, organized as a Cargo workspace of focused sub-crates.

Table of Contents

• Project Overview
• Architecture
• Crates
• Building
• Running
• Project Status
• License
• Links

Project Overview

NTPsec is a hardened, security-focused fork of the classic NTP reference implementation. ntpsec-rs reimplements the NTPsec codebase in Rust, leveraging Rust's safety guarantees, modern tooling (Cargo, crates.io), and ecosystem libraries to produce a reliable, memory-safe NTP implementation.

The workspace follows a modular design:

• Core libraries — protocol encoding/decoding, state machines, authentication, NTS
• I/O layer — system clock interaction, network sockets, drift-file persistence
• Daemon — the ntpd replacement (ntpd-rs)
• Tooling — query clients (ntpq-rs, ntpdig-rs), diagnostics, monitoring, visualization
• Utilities — key generation, leap-second fetching, configuration manipulation

Architecture

                        ┌──────────────────────────────────────────┐
                        │              ntpsec-rs                   │
                        │         (umbrella facade)                │
                        └───────────┬──────────────────────────────┘
                                    │
             ┌──────────────────────┼──────────────────────┐
             ▼                      ▼                      ▼
   ┌─────────────────┐   ┌──────────────────┐   ┌────────────────────┐
   │  ntpsec-rs-core  │   │   ntpsec-rs-io   │   │   Binaries / Tools │
   │  (no_std-ready)  │   │  (std required)  │   │   (14 crates)      │
   │                  │   │                  │   │                    │
   │ • Wire codec     │   │ • System clock   │   │ • ntpd-rs          │
   │ • Mode 6 control │   │ • UDP sockets    │   │ • ntpq-rs          │
   │ • Auth (MD5/SHA) │   │ • State store    │   │ • ntpdig-rs        │
   │ • NTS            │   │ • Refclock I/O   │   │ • ...              │
   │ • Refclocks      │   │                  │   │                    │
   │ • Engine         │   │                  │   │                    │
   └─────────────────┘   └──────────────────┘   └────────────────────┘

• ntpsec-rs-core — Pure protocol logic. Deterministic engine, wire format codec (NTP v4), Mode 6 control protocol, symmetric-key and NTS (Network Time Security) authentication, reference clock drivers. Designed to be no_std compatible where possible.
• ntpsec-rs-io — Real-world I/O. System clock access (clock_gettime/settimeofday), UDP sockets, drift-file and state persistence.
• Tooling crates — Each provides a standalone binary, building on top of core and io.

Crates

The workspace publishes 18 crates to crates.io. All are prefixed ntpsec-rs-*.

Core Libraries

Crate	Description	crates.io
ntpsec-rs-core	Deterministic engine, wire codec, Mode 6 control, authentication, refclocks, NTS
ntpsec-rs-io	Real I/O layer (system clock, network sockets, state store)

Daemon and Facade

Crate	Description	crates.io
ntpsec-rs	Umbrella facade crate re-exporting all public APIs
ntpsec-rs-d	ntpd-rs — NTP daemon binary

Query Tools

Crate	Description	crates.io
ntpsec-rs-query	ntpq-rs — Mode 6 control query client
ntpsec-rs-dig	ntpdig-rs — NTP mode 3 query tool
ntpsec-rs-time	Single-shot time query tool
ntpsec-rs-sweep	Sweep through servers collecting stats

Monitoring and Diagnostics

Crate	Description	crates.io
ntpsec-rs-mon	Real-time NTP monitoring tool
ntpsec-rs-trace	NTP path trace tool
ntpsec-rs-snmpd	SNMP monitoring daemon
ntpsec-rs-viz	NTP data visualization

Utilities

Crate	Description	crates.io
ntpsec-rs-keygen	NTP symmetric key generation
ntpsec-rs-leapfetch	Leap second file fetcher
ntpsec-rs-wait	Wait until NTP server reachable
ntpsec-rs-frob	NTP configuration manipulator

Data Logging

Crate	Description	crates.io
ntpsec-rs-loggps	GPS reference clock logging
ntpsec-rs-logtemp	System temperature logging

Building

Prerequisites

• Rust 1.75+ (stable toolchain)
• Cargo (included with Rust)
• Linux (primary target; other Unix-likes may work)

Build the entire workspace

git clone https://github.com/infinityabundance/ntpsec-rs.git
cd ntpsec-rs
cargo build --workspace

Build a specific crate

cargo build -p ntpsec-rs-core
cargo build -p ntpsec-rs-d

Release build

cargo build --workspace --release

Release binaries will be placed in target/release/. Notable binaries include:

Cross-compilation

The ntpsec-rs-core crate is designed to be no_std compatible where practical, enabling its use in embedded environments.

Running

Start the daemon

sudo ./target/release/ntpd-rs -c /etc/ntp.conf

Query the daemon

./target/release/ntpq-rs -c peers
./target/release/ntpq-rs -c associations

Check time offset

./target/release/ntpdig-rs pool.ntp.org

Project Status

This is an active forensic reconstruction project. The crate structure and public API may change as development progresses. Key milestones:

• ☑ Core protocol codec (NTP v4 wire format, Mode 6 control)
• ☑ Authentication (MD5, SHA-1, SHA-256/384/512)
• ☑ NTS (Network Time Security) basic support
• ☑ Reference clock framework
• ☑ Deterministic engine (clock filter, selection, combining, discipline)
• ☑ I/O layer (system clock, UDP sockets, state store)
• ☑ Daemon skeleton
• ☐ Full daemon integration and lifecycle management
• ☐ Comprehensive test suite
• ☐ Fuzz testing and security audit
• ☐ Production readiness

License

This project is distributed under the same license as NTPsec. See the LICENSE file for details.

Links

• GitHub Repository: https://github.com/infinityabundance/ntpsec-rs
• NTPsec Project: https://www.ntpsec.org/
• NTP Protocol: RFC 5905
• NTS (Network Time Security): RFC 8915
• crates.io: https://crates.io/crates/ntpsec-rs