nts

type Session struct {
	// contains filtered or unexported fields
}

type SessionOptions struct {
	// TLSConfig is used to override the default TLS configuration for NTS key
	// exchange. Attempts to downgrade the TLS protocol version below 1.3
	// using this override are ignored.
	TLSConfig *tls.Config

	// Timeout determines how long the session waits for a response from the
	// key exchange server before failing with a timeout error. Defaults to 5
	// seconds.
	Timeout time.Duration

	// RequestedNTPServerAddress is the hostname or IP address of the NTPv4
	// server the client wishes to associate with once the NTS key exchange
	// has completed. The field must contain a fully qualified domain name, an
	// IPv4 address in dotted decimal notation, or an IPv6 address conforming
	// to the "Text Representation of Addresses" as specified in RFC 4291. The
	// NTS key exchange server's decision to honor this request is optional.
	// If this field contains the empty string, the server will select the NTP
	// server the client should use.
	RequestedNTPServerAddress string

	// RequestedNTPServerPort is the port number of the NTPv4 server with
	// which the client should associate once the NTS key exchange has
	// completed. It is used in conjunction with the RequestedNTPServerAddress
	// option. The NTS key exchange server's decision to honor this request is
	// optional. If this field contains the value zero, the NTS server will
	// select the NTP server port the client should use.
	RequestedNTPServerPort int

	// Dialer is a callback that overrides the default TLS dialer behavior
	// used to establish a connection with the NTS key exchange endpoint's
	// network address. The tlsConfig is the TLS configuration used to
	// establish the connection.
	Dialer func(network, addr string, tlsConfig *tls.Config) (*tls.Conn, error)

	// Resolver is a callback used to override the NTP address returned by the
	// NTS key exchange protocol. The addr parameter contains the "host:port"
	// address of the NTP server returned by the key exchange protocol. The
	// function is expected to return a "host:port" address to override this
	// address. This option is commonly used in proxy setups.
	Resolver func(addr string) string

	// AssumeCompliant128GCM determines whether the client should assume the
	// NTS key exchange server implements a default-compliant use of the
	// AES-128-GCM-SIV algorithm. At the present time, only chrony supports
	// this algorithm, but it was introduced with a bug that caused it to use
	// the wrong algorithm ID when generating keys. Version 4.6.1 introduced a
	// workaround for this issue by adding a new key-exchange record to
	// negotiate the use of compliant AES-128-GCM-SIV.
	//
	// Setting this option to false (the default) causes the client to assume
	// a non-compliant server and to attempt negotation of compliant
	// AES-128-GCM-SIV behavior during key exchange. Setting this option to
	// false is necessary when communicating with chrony servers until all of
	// them have migrated to a default-compliant AES-128-GCM-SIV behavior.
	//
	// Setting this option to true causes the client to assume the server
	// implements a default-compliant AES-128-GCM-SIV behavior without
	// exchanging any additional records. This should only be done when the
	// client is sure the server implements default-compliant AES-128-GCM-SIV
	// behavior.
	//
	// For further details, see:
	// https://chrony-project.org/doc/spec/nts-compliant-128gcm.html
	AssumeCompliant128GCM bool
}