Fix NTP Authenticator parsing for non-MD5 digest types

[Copilot]

Implementation Plan for NTP Authenticator Parsing Fix

• Add XStrField to imports in scapy/layers/ntp.py
• Create _ntp_auth_tail_size() helper function to dynamically compute tail size
• Update _NTPAuthenticatorPaddingField to use dynamic tail size computation
• Update NTPAuthenticator.dgst from XStrFixedLenField to XStrField
• Update NTPExtPacketListField.getfield() to use dynamic tail size detection
• Update NTPHeader.guess_payload_class() to include SHA384 (48-byte) digest
• Add test cases for SHA1 (24-byte) NTP authenticator parsing
• Add test cases for SHA256 (36-byte) NTP authenticator parsing
• Address code review feedback (add constants, clarify comments)
• Run security checks (0 vulnerabilities found)
• Fix code health issues (flake8 compliance)

Summary

Successfully fixed NTP Authenticator parsing to support multiple digest types (MD5, SHA1, SHA256, SHA384, SHA512) instead of being hardcoded to MD5's 16-byte digest size.

Changes:

• Added dynamic MAC size detection via _ntp_auth_tail_size() helper
• Defined MAC size constants for better maintainability
• Updated all parsing logic to use dynamic sizes
• Changed NTPAuthenticator.dgst from fixed-length to variable-length field
• Added comprehensive tests with round-trip verification
• Fixed all code health issues (flake8 compliance)

Test Results:

• All 77 NTP regression tests pass
• New tests verify SHA1 (24-byte) and SHA256 (36-byte) parsing
• Security scan: 0 vulnerabilities
• Code health: All flake8 checks pass

Security Summary:

No security vulnerabilities detected by CodeQL analysis.

Original prompt

The PR #4917 addresses an issue with NTP Authenticator parsing in the Scapy project. The problem arises because the NTP Authenticator fields were hardcoded to MD5's 16-byte digest size, leading to misaligned parsing for other digest types such as SHA1, SHA256, SHA384, and SHA512. Specifically, the _NTPAuthenticatorPaddingField wrongly assumed a 20-byte tail (4 key_id + 16 MD5 digest). For instance, in the case of SHA1 (24 bytes total), the first 4 bytes of the digest were wrongly consumed as padding, causing incorrect parsing of fields like key_id and dgst.

Required Fixes:

1. Update _NTPAuthenticatorPaddingField to compute the tail size dynamically by matching against known valid MAC sizes (20/24/36/52/68) instead of using a hardcoded value _NTP_AUTH_MD5_TAIL_SIZE.
2. Update NTPAuthenticator.dgst to replace XStrFixedLenField with XStrField to ensure it consumes all remaining bytes after the key_id.
3. Modify NTPExtPacketListField.getfield() to implement dynamic tail size detection when separating extensions from the MAC.
4. Update NTPHeader.guess_payload_class() to include the recognized SHA384 (48-byte) digest size.
5. Update NTPExtensions so that _NTPAuthenticatorPaddingField uses dynamic size calculation by adding a new _ntp_auth_tail_size() helper.

Testing:

You should also add test cases to verify the correct parsing and round-trip build/parse of SHA1 (24-byte) and SHA256 (36-byte) NTP authenticators.

Commit these changes to the secdev/scapy repository on the copilot/check-oldest-issues branch. Retain the existing PR title and description, and include a message summarizing the new implementation and tests.

This pull request was created from Copilot chat.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[codecov]

Codecov Report

❌ Patch coverage is 70.58824% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 80.10%. Comparing base (ded1d73) to head (4dd2c8f).

Files with missing lines	Patch %	Lines
scapy/layers/ntp.py	70.58%	5 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #4918   +/-   ##
=======================================
  Coverage   80.10%   80.10%           
=======================================
  Files         370      370           
  Lines       91727    91739   +12     
=======================================
+ Hits        73477    73488   +11     
- Misses      18250    18251    +1     

Files with missing lines	Coverage Δ
scapy/layers/ntp.py	86.60% <70.58%> (-1.05%)	⬇️

... and 5 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[guedou]

@copilot fix the code health error, please.

[Copilot]

@copilot fix the code health error, please.

Fixed in commit 4dd2c8f. Addressed all flake8 violations:

• Removed trailing whitespace on blank lines and at end of line
• Added blank line before class definition
• Moved inline comment to separate line to fix line length (88 char limit)