netdev - Re: [PATCH net-next v2 2/5] net: tcp: add flag for ca to indicate that ECN is required

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 22 Sep 2014 16:33:57 -0400 (EDT)
From:	David Miller <davem@...emloft.net>
To:	fw@...len.de
Cc:	hagen@...u.net, lars@...app.com, eric.dumazet@...il.com,
	fontana@...rpeleven.org, hannes@...essinduktion.org,
	glenn.judd@...ganstanley.com, dborkman@...hat.com,
	netdev@...r.kernel.org
Subject: Re: [PATCH net-next v2 2/5] net: tcp: add flag for ca to indicate
 that ECN is required

From: Florian Westphal <fw@...len.de>
Date: Sat, 20 Sep 2014 23:29:19 +0200

> From: Daniel Borkmann <dborkman@...hat.com>
> 
> This patch adds a flag to TCP congestion algorithms that allows
> for requesting to mark IPv4/IPv6 sockets with transport as ECN
> capable, that is, ECT(0), when required by a congestion algorithm.
> 
> It is currently used and needed in DataCenter TCP (DCTCP), as it
> requires both peers to assert ECT on all IP packets sent - it
> uses ECN feedback (i.e. CE, Congestion Encountered information)
> from switches inside the data center to derive feedback to the
> end hosts.
> 
> Therefore, simply add a new flag to icsk_ca_ops. Note that DCTCP's
> algorithm/behaviour slightly diverges from RFC3168, therefore this
> is only (!) enabled iff the assigned congestion control ops module
> has requested this. By that, we can tightly couple this logic really
> only to the provided congestion control ops.
> 
> Joint work with Florian Westphal and Glenn Judd.
> 
> Signed-off-by: Daniel Borkmann <dborkman@...hat.com>
> Signed-off-by: Florian Westphal <fw@...len.de>
> Signed-off-by: Glenn Judd <glenn.judd@...ganstanley.com>

I don't think any administrator is going to be happy with this behavior.

If he explicitly sets the tcp_ecn sysctl to zero, and then an
unprivileged user can just start emitting ECN bits by selecting a
different congestion control algorithm, that is unexpected.

Please instead make datacenter TCP require ECN to be enabled.

Thanks.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html