-2

I want make basic syntax validation of NTP server hostnames. (For example, I expect %^$&" is a syntaxticly invalid NTP server hostname.)

The reason I want to make this basic validation is because I am building a Web app to configure a server. The app presents the user with a form, for which one of the fields is NTP server hostname. I want to make a quick validation in the browser before sending any server configurations partly to avoid XSS attacks, and partly to provide quick feedback to the user.

I have found a regex to validate DNS hostnames here.

What RFC does the syntax of NTP server hostnames have to abide to? Will the DNS hostname regex also validate NTP server hostnames?

Randomblue
  • 1,135
  • 5
  • 15
  • 33
  • A comment from the downvoters would be appreciated. – Randomblue Jan 03 '13 at 15:28
  • (Not a downvoter) What are you actually trying to accomplish?? If you run a medium or larger network you should have your own NTP servers. Small networks and home users should use the NTP.org Pool. See [NTP Best Practices in this Question](http://serverfault.com/questions/221834/local-or-public-ntp-servers) for more information. – Chris S Jan 03 '13 at 15:43
  • 1
    NTP Server names are plain DNS Hostnames, so the same regex will validate both, as Ladadadada points out below. It would be a good idea for your software to have a default (register with NTP.org [here](http://www.pool.ntp.org/en/vendors.html)) too. – Chris S Jan 03 '13 at 16:02

2 Answers2

1

A regex may be able to validate that a hostname conforms to one of the RFCs but it can't validate that the hostname is valid or that it exists or that it resolves to an IP address that runs an NTP server.

A regex is a bad way to achieve what I think you are trying to achieve, although you haven't actually stated what you are trying to achieve. Feel free to add this to your question.

A better way would be to perform a DNS lookup on the hostname and verify that it resolves to an IP address (be that IPv6 or IPv4) and that when you connect to that IP address on port 123, you get a valid NTP protocol response.


Answering the additional questions, NTP has nothing to do with hostnames at all. An NTP server will listen on an IP address but it will have no idea whether you obtained that IP address by looking up a hostname using DNS or by giving the IP address raw to your NTP client.

This means, by extension, that a hostname is a hostname. There is no difference between a web server hostname, an email server hostname and an NTP server hostname. The regex you found in that StackOverflow answer will serve the basic purpose of validating that it is superficially valid but remember that your users could easily type in an IP address and expect it to work.

I would still do a DNS lookup if it were me doing this validation but you should provide different feedback depending on what is wrong with it. The NTP connection would be a nice addition.

Ladadadada
  • 25,847
  • 7
  • 57
  • 90
0

NTP server names have nothing special

http://en.wikipedia.org/wiki/Hostname#Restrictions_on_valid_host_names

marcoc
  • 738
  • 4
  • 10