Re: [Ntp] Rate limiting: DDoS, KoD, Pool, NAT

> On Dec 7, 2020, at 7:28 PM, Hal Murray <hmurray@megapathdsl.net> wrote:
> 
> [Context is putting the requester's address in the cookie so that a bad guy 
> can't get cookies from a server and then use them to DDoS somebody by 
> reflecting off a NTP+NTS server.]
> 
> philipp@redfish-solutions.com said:
>>> In the normal case, the IP Address in the cookie would match
>>> the IP Address in the packet so there is no information leaked.
> 
>> What about port-forwarding to a server behind a NATting firewall?  I.e.
>> 45.33.216.244. 
> 
> I don't see any information leaked.  The NTP server doesn't know it's a NAT 
> box.  The NTS-KE step would put the address of the NAT box into the initial 
> cookies.  When the cookie came back from the NAT box, the address would match 
> and the returned new cookie would have the same address in it.
> 
> If the client got a new IP Address via DHCP or whatever and was still behind 
> the same NAT box, things would keep working.
> 
> ----------
> 
> The case where that would get leakage would be when the client goes from, for 
> example, work to home.  If it uses work cookies from home, the server would 
> drop the requests due to address mismatch.  That would happen with/without NAT 
> at home or work.  If the server logged that mismatch that info could be used 
> to track somebody.  If the server drops the packet without logging the info is 
> gone.
> 
> There is potential leakage from statistical counters.  If you can watch the 
> counters you might be able to correlate with the packet that just arrived.  
> But if you can see the arriving packets, you can probably see the lack of 
> responses.  The IP Address within the cookie would be encrypted so seeing the 
> packet on the wire doesn't tell you where the cookie came from.
> 
> ----------
> 
> Your question actually says "server behind a NATting firewall".  The answer above was for the case of a client behind the NAT box.
> 
> I don't see any leaks if the server is behind a NAT box.  Do you have anything in mind?  I don't see any way for the client to determine that there is NAT involved.

My point was that the address stuffed into the cookie/nonce would mismatch the address in the source address of the IP packet once it got SNAT’d.

It sounded like you were tacitly counting on the two being a match.

-Philip

> 
> Autokey didn't work through NAT boxes.  I never got far enough with Autokey to understand the details.  I assume an IP Address was tangled in the crypto.
> 
> NTS and shared-key both work and are well tested through NAT.
> 
> 
> -- 
> These are my opinions.  I hate spam.
> 
> 
> 
> _______________________________________________
> ntp mailing list
> ntp@ietf.org
> https://www.ietf.org/mailman/listinfo/ntp