Subject: Re: [Ntp] New rev of the NTP port randomization I-D (Fwd: New Version Notification for draft-gont-ntp-port-randomization-01.txt)
From: Fernando Gont <[email-masked]>
To: Harlan Stenn <[email-masked]>, [email-masked]
Date: Thu, 30 May 2019 14:29:04 -0400
List-Id: <ntp.ietf.org>

On 29/5/19 15:00, Fernando Gont wrote:
> On 29/5/19 13:15, Harlan Stenn wrote:
>>
>>
[....]
>>
>> I'm not seeing that ephemeral UDP ports are predictable in general.  Got
>> a reference?
> 
> Appendix A (page 26) of RFC6056 contains a survey. Stacks were employing
> the same code. In some cases, it was a counter. In other cases, a value
> that was decremented. These algorithms are * RFcovered in "TCP/IP
> Illustrated, Volume 2" by Rich Stevens, for example.
> 
> Nowadays, at least Linux and *BSD do port number randomization. OpenBSD
> was first to do it. My co-author implemented the
> code in Linux.

FWIW, compare lines 285-455 of
https://github.com/freebsd/freebsd/blob/4a037b3dd4b704250886ced57a0ab6d97411e694/sys/netinet/in_pcb.c

(15+ years old version of the FreeBSD kernel)

vs lines 602-717 of
https://github.com/freebsd/freebsd/blob/4a037b3dd4b704250886ced57a0ab6d97411e694/sys/netinet/in_pcb.c

current version of the FreeBSD kernel.

Most of the changes in this area happened around year 2004+, when there
was a lot of work in the transport area around off-path attacks, which
lead to:

* RFC6056 (BCP on port randomization)
* RFC5927 (ICMP-based off-path attacks against TCP, which similar
analysis to the one I did in the interim call yesterday)
* RFC4953 (TCP-based attacks against TCP)

and others.

As noted, OpenBSD was doing port randomization before everyone else.

Thanks!

Cheers,
-- 
Fernando Gont
SI6 Networks
e-mail: [email-masked]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492