On 22/12/2009 20:53, Kurt Roeckx wrote:
On Tue, Dec 22, 2009 at 02:33:54PM +0300, Matthieu Patou wrote:
Subject: ntp server didn't support mssntp
Package: ntp
Version: 4.2.4p4+dfsg-8lenny3
Severity: wishlist
Tags: patch
You tagged it patch, but you don't provide any patch?
No good excuse, but I was missing a category saying that the patch is
already in the upstream source.
Current version of ntp in debian do not support MS SNTP extension.
[...]
Version 4.2.6 of ntp (released on 12/12/09) now include patches for
allowing this extension but must be complied specifically with the
option --enable-ntp-signd to effectively build this extension.
So this is a wishlist bug asking for a new upstream version
with tht configure option? Any idea why this isn't on by default?
See the talk in this bug
https://support.ntp.org/bugs/show_bug.cgi?id=1405. Basically I'll say
that Ph. D. Mills is a bit overcautious as he don't want ntp to be
blamed for an admin that activated this option and get flooded. It's in
fact the same problem as refclock that has to be explicitly activated
during configure if you want to have it (as debian does).
I am not of course willing to make debian user run a risk when using the
new version of ntp with this extension. So it must be noted that even if
the extension is built in the ntp server it must be opted in to start to
work. This piece of code protects the emission to the signed socket:
if (flags & RES_MSSNTP) {
send_via_ntp_signd(rbufp, xmode, xkeyid, flags, &xpkt);
return;
}
If no restrict is defined or if didn't match the user ip address then
the send_via_ntp_signd is not called.
It's obvious that any publicly available server shoudn't have this
activated.
In any case if this option is activated and no samba4 server is there to
answer (because the admin has misconfigurated his/her server). There
will be no such hang. The local kernel knows if the socket does not
exist, or no process is bound to it (because the author of the patch
choose to use unix domain socket).
(from an strace of ux_client, the code I based the ntp code on):
connect(3, {sa_family=AF_FILE, path="/tmp/ux_demo"}, 110) = -1
ECONNREFUSED (Connection refused)
So it will cost 1 syscall.
Of course if the option is activated and a samba4 server is running then
there is a risk of DOS _but_ it means that the admin is making his
active directory directly available on internet so I guess that there
worse problems in this case.
Matthieu.
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
