Re: [Ntp] New I-D: NTP Port Randomization (draft-gont-ntp-port-randomization-00.txt)

[Fernando Gont <[e-mail]>]

On 23/4/19 10:48, Miroslav Lichvar wrote:
> On Fri, Apr 19, 2019 at 12:56:04AM +0200, Fernando Gont wrote:
>> On 18/4/19 14:36, Miroslav Lichvar wrote:
>>> The source port in client mode packets can be random and it can also
>>> change with each request, which might be recommended in the document.
>>> Most NTP clients do that.
>>
>> FWIW, I'm running ntpd 4.2.8p11@1.3728-o on Ubuntu, and all packets use
>> src port 123.
> 
> Yes, ntpd and ntpdate (without -q or -d) seem to be in the minority of
> clients using source port 123.

Any clues whether in other cases they explicitly randomize the source
port, or rely on the kernel doing port randomization?



>>> The source port in active mode packets doesn't necessarily have to be
>>> 123. It can be random if the other peer is not expected to have a
>>> permanent association with the peer, but it must not change between
>>> requests as that would create new assocations.
>>
>> Are you referring to to symmetric mode? My understanding is that if one
>> of the peers employs a port other than 123, then symmetric mode would
>> result in two different associations, rather than a single one. Am I
>> missing something?
> 
> Yes, symmetric mode.
> 
> If both peers are using the active mode (i.e. permanent association),
> they need to use the same port numbers in order to avoid creating more
> associations. If one of them is expected to be using passive mode
> (i.e. ephemeral association or stateless), I think the active peer can
> use any source port as long as it doesn't change (frequently). 

Stupid question: Can the peer doing active mode assume that the other
peer will be using passive mode? I don't recall of the top of my head:
is symmetric mode where both peers employ active mode supported? (as in
e.g. TCP simultaneous open)

If use of symmetric mode always means that one peer does passive mode,
and the other does active mode, then it would be safe to randomize the
port on the peer doing active mode.

OTOH, if symmetric mode where both endpoints do active mode is
supported, then it would seem to me it wouldn't be possible to randomize
the port on symmetric mode -- since otherwise you wouldn't know which
port to connect to.

Thanks!

Cheers,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492