Re: [Ntp] [tsvwg] [Tsv-art] Tsvart early review of draft-ietf-ntp-alternative-port-02

[Miroslav Lichvar <[e-mail]>]

On Mon, Dec 06, 2021 at 05:25:52PM -0500, Danny Mayer wrote:
> That's untrue. It's been working for over 25 years and probably longer. The
> real issue here is that there are firewalls and routers blocking packets
> longer than 48 bytes, yet I've watch autokey do its dance with packet
> lengths much longer. What you are trying to do is circumvent these firewall
> and router rules to get NTP to work with larger packets but on a new port
> and you will still have to set the rules to allow it.

The problematic middleboxes don't block other ports. They specifically
block or rate limit packets on the port 123 as a mitigation for the
amplification attacks. If a non-amplifying subset of NTP moves to
another port, they will have no reason to block it.

Autokey allows amplification, so it must not be used on the
alternative port. 

BTW, the length-specific blocking starts around 200 bytes, not 48.
Autokey wouldn't be as impacted as NTS. See this great post from
Steven Sommars (who spent a lot of time debugging these issues):

https://weberblog.net/ntp-filtering-delay-blockage-in-the-internet/

> Like EDNS0 adjusting
> the existing rules on port 123 is a much better solution. Removing or
> restricting support for mode 6 and 7 packets is trivial and requires no
> additional complexity.

If it is so easy, why it didn't happen in those 8 years since the
attacks become widespread?

> > With NTS, which uses longer NTP messages it's quite common to see a
> > client that doesn't get a response to most of its requests.
> Fix the firewall rules.

Some of them are in hardware. They cannot be fixed. They would need to
be replaced with something that blocks all mode 6 and 7 packets, and
packets in modes 1, 2, 3, 4 that contain an Autokey extension field.
Even in a software firewall that would be difficult to do.

> No, instead you should be fixing the servers to not reply to mode 6/7
> packets instead.

How do you find them, how do you convince the owners to fix/replace
them, and make sure it doesn't happen again?

> In the NTP Reference implementation it's trivial to update
> the configuration.

Maybe it is, but how likely do you think it is that everyone will do
that?

> In other implementations that's a SMOP if it's not
> already there.

AFAIK, no other widely used implementation supports mode 6 or 7, or
Autokey. It's just one implementation that still amplifies traffic in
its default configuration.

-- 
Miroslav Lichvar