Re: [Ntp] NTP port randomization: per-association vs. per-request basis?

On Mon, Jan 27, 2020, 6:32 PM Fernando Gont <fgont@si6networks.com> wrote:

> Folks,
>
> A while ago Miroslav raised a few questions
> (https://mailarchive.ietf.org/arch/msg/ntp/9VDGNerkFM5E0rCmzuf019rfclo/)
> on this list. In order to get a better idea of what's the wg's feeling
> about them, I'm re-raising them in separate emails.
>
> The current version of the I-D recommends the (more conservative) port
> randomization on a per-association basis. However, he raised the
> question regarding whether it would make sense to recommend per-request
> port randomization, based on these arguments:
>
> - It seems to be the current practice. From the implementations
>    that I'm familiar with and that use a random source port, each one
>    opens a new socket for each request, at least by default. On my
>    public servers I see that most clients do change their port over
>    time.
>
> - It doesn't seem like a good idea to require a client to keep its
>    port open when it's not waiting for a response. If it received a
>    valid response, or didn't receive a valid response in few seconds
>    after sending the request, it should close the port.
>
> - The port number may be discoverable by other means, so it should
>    change frequently. For example, the attacker could try sending
>    packets to all ports and observe which one changed a value reported
>    by the client in a monitoring protocol (e.g. mode 6). If the
>    attacker can determine the port number, which cannot be prevented in
>    the general case, the time for which it is useful for attacks should
>    be limited.
>

My one consideration is that per-packet randomization may interact badly
with ECMP by directing each packet to a different server in setups using
ECMP for reliability.

I don't know how big a concern this is: I'm not an expert in the relevant
area.

> Thoughts?
>
> Thanks!
>
> Cheers,
> --
> Fernando Gont
> SI6 Networks
> e-mail: fgont@si6networks.com
> PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492
>
>
>
>
> _______________________________________________
> ntp mailing list
> ntp@ietf.org
> https://www.ietf.org/mailman/listinfo/ntp
>