5

I have a laptop running a version of Linux ( 3.12 ). I have ntpd installed and configured to sync with time.google.com. The problem I am having is if I am plugged into a network that only provides an IPV4 address, ntp's dns is using the ipv6 address:

    root@Node00b01973d6cc:~# ntpq -pn                                                                                           
     remote           refid      st t when poll reach   delay   offset  jitter                                              
==============================================================================                                              
 127.127.1.0     .LOCL.          10 l    7   64    1    0.000    0.000   0.002                                              
 ff0e::101       .MCST.          16 M    -   64    0    0.000    0.000   0.002                                              
 2001:4860:4806: .INIT.          16 u    -   64    0    0.000    0.000   0.000  

Now, if I force ntpd to use only ipv4 DNS with the -4 option, everything works fine

root@Node00b01973d6cc:~# ntpq -pn 172.16.17.111                                                                             
     remote           refid      st t when poll reach   delay   offset  jitter                                              
==============================================================================                                              
 127.127.1.0     .LOCL.          10 l   60   64    1    0.000    0.000   0.002                                              
 216.239.35.12   .GOOG.           1 u   57   64    1   29.278  341.883   0.002     

But I don't want to do this because if I go to a network that only gives ipv6 addresses this will fail. Is there a way to configure ntp to only use ipv4 ( or ipv6 ) if my interface actually has an ip address in that family?

The version of ntpd is 4.2.8p12. This is the ntp.conf file:

tinker panic 0                                                              

driftfile /usr/local/etc/ntp.drift                                          
disable auth                                                                   

# Update the realtime clock and override its default                         
# stratum of 0.                                                                   
server time.google.com prefer #Real Time Clock                             
server 127.127.1.0 #Real Time Clock                           
server 127.127.1.0 #Real Time Clock                                         
fudge 127.127.1.0 stratum 10                                      
broadcast ff0e::101 iburst ttl 7              

I have figured out the root cause of why this started to happen. I recently disabled ipv6 forwarding on my system. Once I turn ipv6 forwarding back on, ntp starts using the ipv4 address as I would expect.

Why would turning on ipv6 forwarding do this?

By default the system boots with ipv6 forwarding disabled. To turn it on, in one of the boot scripts I have the line:

sysctl -w net.ipv6.conf.all.forwarding=1
2
  • I don't know. I notice on my Fedora 29 system that getent hosts time.google.com returns IPv6 only, even though I do not have ipv6 access, but getent ahosts time.google.com returns all results in the correct preference order. So I tried enabling ipv6 forwarding at runtime, both in conf.all and in conf.wlp2s0, but it did not change the result of getent hosts time.google.com
    – sourcejedi
    Apr 6 '19 at 20:08
  • 1
    To gain a working configuration, I guess you could try an ugly hack with two separate server lines. server -4 time.google.com and server -6 time.google.com.
    – sourcejedi
    Apr 6 '19 at 20:09
0

Remove or comment out the IPv6 localhost from your hosts file:

#::1            localhost6.localdomain6 localhost6
0

although the question is 2y old, the topic surely is not.

according to RFC3484 Default Address Selection for IPv6

the OS automatically selects the best IP address, which is either IPv6 or IPv4. if /etc/gai.conf is unchanged and your DNS works fine, than Linux (and any other OS) will prefer IPv6 address(es), otherwise it will choose IPv4, to connect to e.g. time.google.com.

you can check that by

getent ahosts time.google.com

every software should try all ip addresses of that list in that order, beginning at the top. where did your linux get the timeservers from? if it is DHCP than your OS perhaps cannot choose because it got IPv4 IP adresses, not FQDNs?! the ntp client may show reverse DNS hosts to IP addresses, not the real configured ntp server "names".

/edit: I tried with ntpd 4.2.8p15 and ntpd 4.2.6p5 on opensuse15.2 and centos7. both ntpd do not obey rfc6742(3484). chronyd does btw.

/edit2: chronyd (3.4) seems to need a looooong time until v4 addresses will be used, if ntp servers are not reachable via v6. (but what do I know, try for yourself, dont rely on strangers from the internet ;)

HTH

9
  • Where do you get "every software should try all ip addresses". That behaviour doesn't sound common behaviour . Usually if one A or AAAA record points to an offline server you will see sporadic connection failures. AFAIK if a client is consistently picking an AAAA record where ipv6 is given it causes failure to connect. Apr 12 at 8:07
  • 1
    rfc3484 2. Well-behaved applications SHOULD iterate through the list of addresses returned from getaddrinfo() until they find a working address. besides that. I see this everyday when a postfix MTA try to send email but fails to connect via v6 .. it will then try v4 and succeeds. this is just one example of many. Apr 12 at 11:06
  • 2
    @StefanKarest interesting. So here's the problem with this answer... The OP has come with a problem where ntp is not doing this. Your answer in response is "well it should", and you offer no information on how to force it to do so. More over, no standards are being broken as RFC 3484 only says "SHOULD" and not "MUST" (see rfc 2119). The problem with RFC 3484 is it has placed the responsibility on every application developer and taken it away from the OS developers. From experience there are a lot of exceptions where this rule is not followed! Apr 12 at 11:25
  • @StefanKarest and now that I re-read it your statement "every software should try all ip addresses" is categorically incorrect because of RFC 2119: "This word, or the adjective "RECOMMENDED", mean that there may exist valid reasons in particular circumstances to ignore a particular item". It's incorrect to claim that SHOULD means "all software should" because valid exceptions are explicitly allowed. Apr 12 at 11:33
  • as we do not know wether the ntp client in question uses FQDN or IP Adresses this ^^ discussion is meaningless. maybe I try with my NTP client (as this only uses a IPv4 address from dhcp). Apr 12 at 11:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.