Re: [Ntp] Antw: Re: Calls for Adoption -- NTP Extension Field drafts -- Four separate drafts

[Miroslav Lichvar <[e-mail]>]

On Mon, Sep 09, 2019 at 12:18:01PM -0400, Daniel Franke wrote:
> On Mon, Sep 9, 2019 at 12:08 PM Salz, Rich <[e-mail]> wrote:
> >
> > >    It can't.  There are fields in a NTP v3 reply that are copied from the request
> >     packet.  The v3 only system doesn't know how to find them in a v4 packet.
> >
> > So that could be a signal to the sender that the receiver does not know the version, right?
> 
> The only thing that would really paint us into a corner would be if
> there were a lot of v4 servers out there that reply to v5 packets with
> something structured like a v4 packet but with a 5 in the version
> field.

IIRC, there are few implementations that do that. openntpd is probably
the most widely used one. As a server, it just checks if the packet is
48 or 64 octets long and that the mode is 1 or 3. It doesn't support
extension fields. Sending requests with length != 48 would be a simple
way to prevent it from responding (correctly).

> I propose we just avoid this situation entirely by making NTS a
> mandatory part of v5.

I don't think that is a good idea. I'm sure we can figure out
something simple that doesn't require TCP or TLS. For instance, moving
the origin field in the header would prevent such broken servers from
sending a valid response.

-- 
Miroslav Lichvar