Re: [Ntp] Symmetric mode

Hal Murray <halmurray@sonic.net> Sun, 25 September 2022 07:09 UTC

Return-Path: <halmurray@sonic.net>
X-Original-To: ntp@ietfa.amsl.com
Delivered-To: ntp@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 99A2DC14CF0B for <ntp@ietfa.amsl.com>; Sun, 25 Sep 2022 00:09:44 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.61
X-Spam-Level:
X-Spam-Status: No, score=-2.61 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id P_ERmDVTV4wc for <ntp@ietfa.amsl.com>; Sun, 25 Sep 2022 00:09:39 -0700 (PDT)
Received: from d.mail.sonic.net (d.mail.sonic.net [64.142.111.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 22AF6C14CF03 for <ntp@ietf.org>; Sun, 25 Sep 2022 00:09:38 -0700 (PDT)
Received: from 107-137-68-211.lightspeed.sntcca.sbcglobal.net (107-137-68-211.lightspeed.sntcca.sbcglobal.net [107.137.68.211]) (authenticated bits=0) by d.mail.sonic.net (8.16.1/8.16.1) with ESMTPSA id 28P79bhE017079 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT); Sun, 25 Sep 2022 00:09:38 -0700
Received: from hgm (localhost [IPv6:::1]) by 107-137-68-211.lightspeed.sntcca.sbcglobal.net (Postfix) with ESMTP id 7FE1028C1D8; Sun, 25 Sep 2022 00:09:37 -0700 (PDT)
X-Mailer: exmh version 2.9.0 11/07/2018 with nmh-1.7.1
To: Danny Mayer <mayer@pdmconsulting.net>
cc: Hal Murray <halmurray@sonic.net>, "ntp@ietf.org" <ntp@ietf.org>
From: Hal Murray <halmurray@sonic.net>
In-Reply-To: Message from Danny Mayer <mayer@pdmconsulting.net> of "Sat, 24 Sep 2022 18:08:20 -0400." <ce3c36b7-bd7d-13f1-5d49-aae37b1289a4@pdmconsulting.net>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Sun, 25 Sep 2022 00:09:37 -0700
Message-Id: <20220925070937.7FE1028C1D8@107-137-68-211.lightspeed.sntcca.sbcglobal.net>
X-Sonic-CAuth: UmFuZG9tSVbUP6bbBHPNYfDjVCBu3SM17ppWDqu2SaglWe1P91YLoCGZx2FICc2+f/KxOPJLIhJEgMxDuOpjH+3QysCPQwOUrootJJTbDlo=
X-Sonic-ID: C;fnVFBKE87RGnkJArP63e0g== M;HM9wBKE87RGnkJArP63e0g==
X-Sonic-Spam-Details: -1.5/5.0 by cerberusd
Archived-At: <https://mailarchive.ietf.org/arch/msg/ntp/AojH679Ex5pT2Tfbd3UU-maviUI>
Subject: Re: [Ntp] Symmetric mode
X-BeenThere: ntp@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: Network Time Protocol <ntp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ntp>, <mailto:ntp-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ntp/>
List-Post: <mailto:ntp@ietf.org>
List-Help: <mailto:ntp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ntp>, <mailto:ntp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 25 Sep 2022 07:09:44 -0000

>> It uses twice as many packets.
> No, it doesn't. Run it and check the packet traffic. Yes each side sends  a
> packet to the other the same as if both were referencing the other as
> servers 

We had a pronoun binding mixed up.

A setup with a pair of client/server connections will use twice as much 
traffic as a single symmetric connection.


>> It works with NTS.
> NTS dropped it in the interested of getting NTS out.

Same issue.  NTS works today if you use client/server mode.


>> You don't have to worry about bad guys setting up symmetric connections.
> We don't. I have no idea where this claim came from. A server that  doesn't
> know the client sending a symmetric mode peer packet will not  make it a peer
> and it will just act as responding to a client packet  (with the asymmetric
> mode response). 

Let me try again.  If you don't do something like "restrict nopeer", bad guys 
can setup peer connections and trash your clock.  If you do use "restrict 
nopeer", you have to poke a hole in it to let a good guy setup a symmetric 
connection or just setup your end of the connection with "peer other-guy".  
Either way, you have to make an edit ti the config files on both ends in order 
to setup a symmetric connection.  So what is the convenience?

--------------

Back to the important point.

Is there any case where a symmetric connection is necessary?

Should we devote effort to extending NTS to cover symmetric mode?



-- 
These are my opinions.  I hate spam.