netdev - Re: [PATCH net-next] tcp: Accept ECT on SYN in the presence of RFC8311

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 3 Apr 2019 08:51:35 -0700
From:   Yuchung Cheng <ycheng@...gle.com>
To:     Neal Cardwell <ncardwell@...gle.com>
Cc:     "Tilmans, Olivier (Nokia - BE/Antwerp)" 
        <olivier.tilmans@...ia-bell-labs.com>,
        Bob Briscoe <research@...briscoe.net>,
        "De Schepper, Koen (Nokia - BE/Antwerp)" 
        <koen.de_schepper@...ia-bell-labs.com>,
        Eric Dumazet <edumazet@...gle.com>,
        "David S. Miller" <davem@...emloft.net>,
        Alexey Kuznetsov <kuznet@....inr.ac.ru>,
        Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH net-next] tcp: Accept ECT on SYN in the presence of RFC8311

On Wed, Apr 3, 2019 at 8:39 AM Neal Cardwell <ncardwell@...gle.com> wrote:
>
> On Wed, Apr 3, 2019 at 9:50 AM Tilmans, Olivier (Nokia - BE/Antwerp)
> <olivier.tilmans@...ia-bell-labs.com> wrote:
> >
> > Linux currently disable ECN for incoming connections when the SYN
> > requests ECN and the IP header has ECT(0)/ECT(1) set, as some
> > networks were reportedly mangling the ToS byte, hence could later
> > trigger false congestion notifications.
> >
> > RFC8311 §4.3 relaxes RFC3168's requirements such that ECT can be set
> > one TCP control packets (including SYNs). The main benefit of this
> > is the decreased probability of losing a SYN in a congested
> > ECN-capable network (i.e., it avoids the initial 1s timeout).
> > Additionally, this allows the development of newer TCP extensions,
> > such as AccECN.
> >
> > This patch relaxes the previous check, by enabling ECN on incoming
> > connections using SYN+ECT if at least one bit of the reserved flags
> > of the TCP header is set. Such bit would indicate that the sender of
> > the SYN is using a newer TCP feature than what the host implements,
> > such as AccECN, and is thus implementing RFC8311. This enables
> > end-hosts not supporting such extensions to still negociate ECN, and
> > to have some of the benefits of using ECN on control packets.
> >
> > Signed-off-by: Olivier Tilmans <olivier.tilmans@...ia-bell-labs.com>
> > Suggested-by: Bob Briscoe <research@...briscoe.net>
> > Cc: Koen De Schepper <koen.de_schepper@...ia-bell-labs.com>
>
> Acked-by: Neal Cardwell <ncardwell@...gle.com>
Acked-by: Yuchung Cheng <ycheng@...gle.com>

>
> Thank you for this patch, Olivier and Bob.
>
> thanks,
> neal