netdev - Re: DSCP values in TCP handshake

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4DAC8A8A.1010401@cox.net>
Date:	Mon, 18 Apr 2011 15:01:30 -0400
From:	Joe Buehler <aspam@....net>
To:	Mikael Abrahamsson <swmike@....pp.se>
CC:	Stephen Hemminger <shemminger@...tta.com>,
	Eric Dumazet <eric.dumazet@...il.com>, netdev@...r.kernel.org
Subject: Re: DSCP values in TCP handshake

> <http://tools.ietf.org/html/rfc2873> says this is ok, but I would like
> default to be that if incoming SYN has a certain DSCP value, the SYN+ACK
> should mirror this value if the application doesn't explicitly set
> anything else.
> 
> I was under the impression that mirroring was done historically, but
> this has changed? Looking at how my apache server is behaving in 2.6.32,
> it seems it uses 0x0 for the whole TOS byte by default. I send it 0x20
> and it responds with 0x0. SSH does the same thing.

In my case I just need the SYN-ACK to reflect the incoming SYN.  To get
it I am going to use iptables like so (barring bugs on my part -- still
testing this...):

iptables -t mangle -A PREROUTING -m tcp -p tcp --tcp-flags SYN,RST,ACK
SYN -m dscp --dscp 0 -j CONNMARK --set-mark 0
iptables -t mangle -A POSTROUTING -m tcp -p tcp --tcp-flags SYN,RST,ACK
SYN,ACK -m connmark --mark 0 -j DSCP --set-dscp 0
(repeat for the other 63 values of DSCP...)

The argument I have seen for not making reflection standard behavior is
that it is not always appropriate for the application.  For example, web
servers have short requests but large responses so non-identical DSCP
values might make more sense.

Thanks for all the replies.

Joe Buehler
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html