Re: [Ntp] NTPv5 KISS code support

[Miroslav Lichvar <[e-mail]>]

On Wed, Nov 01, 2023 at 03:37:44PM +0100, David Venhoek wrote:
> Hi All,
> 
> I have made a pull request with suggested wording for including kiss
> code support in ntpv5. The PR can be found
> athttps://github.com/mlichvar/draft-ntp-ntpv5/pull/9, the suggested
> patch is also included below for completeness. Please do share any
> feedback regarding the chosen design, this looked good to me but there
> may be better approaches.

This looks similar to the description of DENY, RSTR, RATE codes in RFC
5905.

One problem is that it's a security issue, a denial of service for the
client. A single spoofed response shouldn't be able to completely break
synchronization with a server. There needs to be some maximum poll
value specificied for RATE and some interval specified for RSTR and
DENY. With that, I would ask how is it better than what we already
have with the suggested poll interval returned in a normal server
response.

The other issue is the most buggy clients that would need this
handling are least likely to implement it, at least that's what
we have seen with (S)NTPv4 implementations. With the most severe bugs
that lead to flooding of servers (e.g. in systemd-timesyncd and
Fortigate firewalls for example), handling of these codes wouldn't
make a difference anyway. By the time the client receives a response
from the server, it has already sent another request, so it couldn't
accept it as valid even if it had this functionality implemented.

-- 
Miroslav Lichvar