Re: [Ntp] I-D Action: draft-ietf-ntp-port-randomization-00.txt

[Miroslav Lichvar <[e-mail]>]

On Sun, Nov 17, 2019 at 09:31:35PM -0300, Fernando Gont wrote:
> On 13/11/19 08:21, Miroslav Lichvar wrote:
> > - The port number may be discoverable by other means, so it should
> >   change frequently. For example, the attacker could try sending
> >   packets to all ports and observe which one changed a value reported
> >   by the client in a monitoring protocol (e.g. mode 6). If the
> >   attacker can determine the port number, which cannot be prevented in
> >   the general case, the time for which it is useful for attacks should
> >   be limited.
> 
> For client mode, I believe that responses should be limited to the
> address employed for the association. i.e., why should a client respond
> to a request from a random host?

Yes, the client's port should be "connected" to the server, so it is
closed for other hosts.

The point I'm trying to make is that the client may also operate as a
server listening on the port 123 and respond to mode 6 requests (e.g.
from hosts in the local network), allowing an attacker to observe some
of the client's state. It doesn't have to be the client leaking its
port number. It could be any host on the path between the server and
client, for example a firewall that has a monitoring access.

-- 
Miroslav Lichvar