From Newsgroup: comp.protocols.time.ntp
On 2024-06-10, Roger <
invalid@invalid.invalid> wrote:
In the UK pool Leo Bodnar has 5 consecutive IP addresses:
85.199.214.98 - 85.199.214.102
restrict default nopeer noquery nomodify notrap limited kod
restrict source noquery nomodify notrap limited kod
restrict 85.199.214.96 mask 255.255.255.248 ignore
Does not stop those servers from being mobilized.
I, too, restricted those IP addresses restricted, but I didn't think of trying to use a single entry to do it, so I didn't run into your problem. I think the behavior you're seeing is consistent with the sometimes counterintuitive way ntpd matches a given peer against the ACL.
"The ntpd daemon implements a general purpose access control list (ACL) containing address/match entries sorted first by increasing address values and then by increasing mask values. A match occurs when the bitwise AND of the mask and the packet source address is equal to the bitwise AND of the mask and address in the list. The list is searched in order with the last match found defining the restriction flags associated with the entry." ---access.html
With this in mind, your first example creates the ACL:
address mask count flags =====================================================================
0.0.0.0 0.0.0.0 0 noquery, nopeer, nomodify, notrap, limited, kod
85.199.214.96 255.255.255.248 0 ignore
When NTP Pool Project hands you 85.199.214.98, your "restrict source" applies to
it, and the ACL is now:
address mask count flags =====================================================================
0.0.0.0 0.0.0.0 0 noquery, nopeer, nomodify, notrap, limited, kod
85.199.214.96 255.255.255.248 0 ignore
85.199.214.98 255.255.255.255 0 source, noquery, nomodify, notrap, limited, kod
These three entries all match 85.199.214.98. But it's the last match that defines the restriction flags. So instead of the desired result "ignore" you get
"source, noquery, nomodify, notrap, limited, kod".
This is what I believe is going on. We'd like to be able to ignore an address block using the netmask, but we can't. This may be where we throw up our hands and chant "it's not a bug, it's a feature."
--- Synchronet 3.20a-Linux NewsLink 1.114