Re: [Ntp] [EXT] Re: NTPv5 KISS code support

[Miroslav Lichvar <[e-mail]>]

On Tue, Nov 07, 2023 at 12:02:26PM -0800, Hal Murray wrote:
> Suppose the bad guys are trying to DoS somebody by sending enough forged 
> requests to trigger rate limiting.
> 
> How did the bad guy figure out which servers the victim is using?  Can we 
> fight that by using a few more?

The typical default configuration uses pool.ntp.org. There are only
few thousand servers in the pool. The attacker can simply keep sending
requests with spoofed source address to all of them. One per second
per server, that's no big deal.

> Will responding to some requests be good enough?
> What fraction of requests need to get answered for NTP to "work"?

In my tests responding to 25% of requests seems to be sufficient for
clients like ntpd to keep the clock synchronized, although not very
well.

> Do the numbers work?  If the bad guy sends 1 packet per second and the victim 
> sends 1 packet every 64 seconds and the server responds to 1 packet per 
> second, the victim gets 1/2 or 1/65 depending on implementation details.  The 
> bad guy can reduce the odds by sending faster.  This is an arms race.

The server needs to respond to some constant percentage of the
requests and select them randomly. The attacker would need to send
requests at a much higher rate in order to overload the network or the
server to actually reduce the rate of responses that the victim gets.
Doing that for a larger number of servers like pool.ntp.org would be
impractical.

> I think we can fix this by adding an option to NTS to include the client's IP 
> Address in the cookie.  That would let the server split rate limiting into 2 
> piles, one for requests with a verified source, and the other for everybody 
> else.

Yes, that would help. The drawback is that the clients would need to
restart NTS-KE after moving to a different network.

> Note that if an NTS client misses 8 responses in a row and doesn't reuse 
> cookies, then the NTS-KE server will get increased traffic.

Right. NTS-KE can be rate limited too if necessary.

-- 
Miroslav Lichvar