Re: [Ntp] comments on draft-mlichvar-ntp-ntpv5-03 / Message Format

[Miroslav Lichvar <[e-mail]>]

On Wed, Nov 24, 2021 at 09:33:07PM -0800, Harlan Stenn wrote:
> This is what happens when the choice is made to ignore the design of NTP
> packet version "evolution".
> 
> The original design is that the packet format to the length of a version N
> packet is ALWAYS the same.  This is why ntpd will respond to a "higher"
> version number packet with the requested newer version but with a packet
> length of the responding ntpd's version.

If NTP was intended to evolve in such a way, why wasn't the expected
server behavior specified in the NTP RFCs? RFC 5905 makes it quite clear
that packets using higher version number should be ignored.

>From 9.2:
  Format checks require correct field length and alignment, acceptable
  version number (1-4), and correct extension field syntax, if present.

>From A.5.1:
	if (r->version > VERSION /* or format error */)
		return;                 /* format error */

> If a v4 NTP packet is 48 bytes, the design and expectation has been that if
> v5 wants any different data then the packet is made longer and the new data
> lives AFTER the v4 data.

That might make sense if NTP packets had a constant length. But with
extension fields and MACs I don't see how could it work. The NTPv4
server wouldn't know how long is the NTPv5 header and where an
extension field starts.

> Assume, for purposes of this thread, that an NTPv5 packet format is now 64
> bytes.
> 
> Should a v5 client send a request to a v4 server, the v5 client sends a
> 64-byte v5 request, and assuming the v4 server responds, it will do so with
> a 48-byte v5 response that is effectively a v4 response packet. The client
> will see this, note that the packet is short, and be in a position to
> understand that the target server is a v4 server, not a v5 server.

The vast majority of existing servers doesn't respond with a 48-octet
packet to a 64-octet v5 request.

> Should a v4 client send a request to a v5 server, the v5 server should
> respond with a 48-byte v4 response.

If the server supported NTPv4, that would be expected. If it supported
NTPv5 only, it shouldn't respond.

-- 
Miroslav Lichvar