Re: [Ntp] New I-D: NTP Port Randomization (draft-gont-ntp-port-randomization-00.txt)

[Fernando Gont <[e-mail]>]

On 24/4/19 10:34, Miroslav Lichvar wrote:
> On Wed, Apr 24, 2019 at 01:17:43AM +0200, Fernando Gont wrote:
>> On 23/4/19 10:48, Miroslav Lichvar wrote:
>>> Yes, ntpd and ntpdate (without -q or -d) seem to be in the minority of
>>> clients using source port 123.
>>
>> Any clues whether in other cases they explicitly randomize the source
>> port, or rely on the kernel doing port randomization?
> 
> I think most, if not all, rely on the OS to do that. When there is no
> OS, it seems it's common to use a fixed port, but different from 123.

Maybe we could make an explicit note that in order to comply with this
spec, you can normally rely on the underlying OS for doing the
randomization part? -- and then learn the selected port to store it in
the NTP data structure.


> There are many peaks in the port distribution observed on servers.

That's interesting. -- any clues if that's an artifact of NATs rewriting
the local port or something else?

(We worked on RFC6056 years ago, and I would have expected that the port
distribution was mostly normal...)


> 
>> Stupid question: Can the peer doing active mode assume that the other
>> peer will be using passive mode? I don't recall of the top of my head:
>> is symmetric mode where both peers employ active mode supported? (as in
>> e.g. TCP simultaneous open)
> 
> It depends on the configuration. If a peer has the other peer
> specified in the config, it's using the active mode.

So it would be active-mode on both sides, leading to a single association?


> There could be an
> option to enable random source port for the case when I know the other
> peer doesn't have this one specified in the config (e.g. because it's
> behind NAT).

I may be confused: how do you connect to the other endpoint if it has
randomized the local port?




>> OTOH, if symmetric mode where both endpoints do active mode is
>> supported, then it would seem to me it wouldn't be possible to randomize
>> the port on symmetric mode -- since otherwise you wouldn't know which
>> port to connect to.
> 
> In the general case yes, but it could be enabled in the configuration file.

Are you assuming symmetric-passive on one side, and symmetric-active on
the other, with the later employing port randomization? -- that's the
only case of symmetric mode where it'd seem to me one can randomize the
port.

Side question: any clues regarding what's the normal deployed model for
symmetric mode? -- i,.e., is the usual thing to configure one peer with
passive mode, and the other in active mode? Or is the usual thing to
configure both peers in active mode? (i.e., have both peers try to
actively mobilize an association), instead of waiting for the other end
to do it).

Thanks!

Cheers,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492