Re: [Ntp] Public NTP servers already responds to NTPv5

[Miroslav Lichvar <[e-mail]>]

On Mon, Nov 30, 2020 at 12:49:09AM +0900, g16 wrote:
> So I surveyed how the currently public NTP servers respond to NTPv5 packets.

Thanks for doing that.

> ## Result
> > NTPv4 format packet that version field is 5
> - 25% response: timeout
> - 65% response: NTPv4 format packet that version field is 5

This seems to be mostly the ntp.org ntpd.

> - 10% response: NTPv4 or NTPv3

This is mostly the NIST NTP implementation.

> > NTPv5 format packet (draft-mlichvar-ntp-ntpv5-00)
> - 10% response: NTPv4 format packet that version field is  5

This seems to be mostly the Google and Cloudflare NTP implementations.

> ## Is this a problem?
> I'm not sure. It may confuse implementations that support nptv5.

I don't think it's a problem. An NTPv5 client following the draft
is supposed to check the client cookie field (replacing the origin
timestamp), which will be incorrect if it is a NTPv4 response using
version 5. For the client it will look like an off-path attacker.
All NTP clients need to be able to deal with unexpected responses.

Please note that the broken servers respond also to versions 6 and 7.
There is no point in trying to make v5 compatible with v4 and
postponing incompatible changes to v6.

-- 
Miroslav Lichvar