NTP users are strongly urged to take immediate action to ensure that their NTP daemons are not susceptible to being used in distributed denial-of-service (DDoS) attacks. Please also take this opportunity to defeat denial-of-service attacks by implementing Ingress and Egress filtering through BCP38.

ntp-4.2.8p15 was released on 23 June 2020. It addresses 1 medium-severity security issue in ntpd, and provides 13 non-security bugfixes over 4.2.8p13.

Please see the NTP Security Notice for vulnerability and mitigation details.

---

Are you using Autokey in production? If so, please contact Harlan - he's got some questions for you.

ISC Libraries and NTP

We're currently using a useful amount of code from libisc/, mostly for networking code.

With the BIND9 release, we have access to the following via libisc/:

• taskmgr()
• networking code
• logging code

(this is correct, right? Anything else?)

There is good reason to use more of this library, specifically the logging code.

Moving forward, there is probably great benefit to using the taskmgr() code to handle the "main IO loop" processing for (S)NTP. This will also enable us to use the asynchronous DNS resolver code in libdns/.

In order to get there, we should consider the following:

• we should upgrade to the latest version of libisc/ and import the latest version of libdns/.
• we should make sure that any patches we have applied to our older code are handled by the latest released code.
• since ISC's -head branch has not yet been published, we'll need to use the latest published versions.
• our existing libisc/ import does not use the "stock" directory layout, and while this might have made sense originally, it is now counter-productive.
• libisc/ and libdns/ are currently not easily separable/usable from BIND.
  • There would be great benefit to fixing this.
  • creating ISC_LIBISC (in isc_libisc.m4) and ISC_LIBDNS (in isc_libdns.m4) for use in configure.ac would help a lot.
• We should postpone changing our current setup until after 4.2.6 has been released.