| Re: [chrony-dev] [PATCH] ntp: allow NTS pools to use multiple negotiated servers |
[ Thread Index |
Date Index
| More chrony.tuxfamily.org/chrony-dev Archives
]
- To: Sofia Scalzo <sofiascalzo@xxxxxxxx>
- Subject: Re: [chrony-dev] [PATCH] ntp: allow NTS pools to use multiple negotiated servers
- From: Miroslav Lichvar <mlichvar@xxxxxxxxxx>
- Date: Wed, 2 Sep 2026 16:09:16 +0200
- Cc: chrony-dev@xxxxxxxxxxxxxxxxxxxx
- Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1788358162; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=Gc50MbzweqXjTRmZA2Y9OF8u2BDVcuVKl+fwosjlby4=; b=iaBVIlEIEKcdHyjS7HFJA/gwnC8yPoFxbvNDU6GX5vcb6jiAlUBa8fzR8CmmUsWYZcf/uu mXDLYpEms/9BXJ0MprecAKKhdMlFYbQYThAE0qcPxZvDliTbJ/XMKmyXlPr5VIuTXdIIol /V2hirAy8pM6Yd9uwNf+Df4sWDoo3/8=
On Thu, Aug 20, 2026 at 08:02:28AM -0700, Sofia Scalzo wrote:
> Allow an unresolved member of an NTS pool to reuse the NTS-KE address
> after another member moves to a negotiated NTP server address.
>
> This enables a pool resolving to one NTS-KE endpoint to discover
> multiple distinct NTP responders up to maxsources. Each tentative member
> retains independent NTS keys, cookies, and protocol state.
In this pool there is only one NTS-KE server that as the address of
the NTP server in the NTS-KE response provides a hostname that
resolves to multiple IP addresses? That's unusual. Are there any
public pools using this approach?
If I understand your patch correctly, it doesn't "enable", it only
makes the discovery faster by avoiding the delay before the next
attempt to resolve the unresolved source is made.
In a local test with three NTS-NTP servers with and without your patch
(with the same randomized order of resolved addresses) it took 194
seconds instead of 260 to send the first NTP request to the third
server. An improvement, but the main problem that the first successful
selection doesn't happen when all sources are selectable is still
there.
I think a better approach would be to allow NTS sources to start with
their original IPADDR_ID addresses and change them at the same time to
the resolved addresses of the NTS-KE-provided hostname, so the first
selection uses all sources. This would be a much more invasive change.
I suspect it might also be confusing to users as the sources would be
invisisible in chronyc reports without the -a option until a
successful NTS-KE exchange.
If this type of NTS pool is not going to be more common, I'm not sure
if it's not worth the additional complexity.
--
Miroslav Lichvar
--
To unsubscribe email chrony-dev-request@xxxxxxxxxxxxxxxxxxxx with "unsubscribe" in the subject.
For help email chrony-dev-request@xxxxxxxxxxxxxxxxxxxx with "help" in the subject.
Trouble? Email listmaster@xxxxxxxxxxxxxxxxxxxx.