netdev - Re: [PATCH net-next v2 2/5] net: tcp: add flag for ca to indicate that ECN is required

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 26 Sep 2014 16:20:29 -0400 (EDT)
From:	David Miller <davem@...emloft.net>
To:	fw@...len.de
Cc:	hagen@...u.net, lars@...app.com, eric.dumazet@...il.com,
	fontana@...rpeleven.org, hannes@...essinduktion.org,
	glenn.judd@...ganstanley.com, dborkman@...hat.com,
	netdev@...r.kernel.org
Subject: Re: [PATCH net-next v2 2/5] net: tcp: add flag for ca to indicate
 that ECN is required

From: Florian Westphal <fw@...len.de>
Date: Tue, 23 Sep 2014 11:11:05 +0200

> Thanks for your feedback! We have actually thought about that for
> quite a while before starting on the implementation, and concluded
> that the behaviour is actually fine as is for three reasons:
> 
> 1) DCTCP is very tighly coupled to the ECN machinery as described
>    in the paper. Not having ECN enabled and nevertheless allowing
>    DCTCP (if we would implement above feedback) would just make it
>    fallback to Reno, which would not be useful in the first place.
>    So an administrator would rather not load DCTCP to the available
>    congestion control modules in the first place in this case.
> 
> 2) Right now an administrator can choose to use DCTCP only for a
>    particular process, and still avoid exposing ECN to the outside
>    world for every other process.
> 
> 3) An unpriviledged user would not be able to use DCTCP *unless*
>    an administrator has explicitly allowed to use it. This is being
>    reflected since Stephen's commit ce7bc3bf15cb ("[TCP]: Restrict
>    congestion control choices.") where only Reno or the currently
>    compiled-in default choice is non-restricted.
> 
> If you nevertheless think that it is useful to include above feedback
> to overcome your objection, we could just add a check for tcp_ecn
> sysctl being set to 1 for the initialization of the congestion control
> ops of the socket and otherwise fall back to Reno.

Ok, I'm convinced (for now).

Please resubmit this series and I'll apply it, thanks.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html