netdev - Re: [RFC PATCH 28/28] tcp: AccECN sysctl documentation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAA93jw7_YG-KMns8UP-aTPHNjPG+A_rwWUWbt1+8i4+UNhALnA@mail.gmail.com>
Date:   Thu, 19 Mar 2020 16:02:36 -0700
From:   Dave Taht <dave.taht@...il.com>
To:     Ilpo Järvinen <ilpo.jarvinen@...sinki.fi>
Cc:     Linux Kernel Network Developers <netdev@...r.kernel.org>,
        Yuchung Cheng <ycheng@...gle.com>,
        Neal Cardwell <ncardwell@...gle.com>,
        Eric Dumazet <eric.dumazet@...il.com>,
        Olivier Tilmans <olivier.tilmans@...ia-bell-labs.com>
Subject: Re: [RFC PATCH 28/28] tcp: AccECN sysctl documentation

On Wed, Mar 18, 2020 at 2:44 AM Ilpo Järvinen <ilpo.jarvinen@...sinki.fi> wrote:
>
> From: Ilpo Järvinen <ilpo.jarvinen@...helsinki.fi>
>
> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@...helsinki.fi>
> ---
>  Documentation/networking/ip-sysctl.txt | 12 +++++++++---
>  1 file changed, 9 insertions(+), 3 deletions(-)
>
> diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
> index 5f53faff4e25..ecca6e1d6bea 100644
> --- a/Documentation/networking/ip-sysctl.txt
> +++ b/Documentation/networking/ip-sysctl.txt
> @@ -301,15 +301,21 @@ tcp_ecn - INTEGER
>                 0 Disable ECN.  Neither initiate nor accept ECN.
>                 1 Enable ECN when requested by incoming connections and
>                   also request ECN on outgoing connection attempts.
> -               2 Enable ECN when requested by incoming connections
> +               2 Enable ECN or AccECN when requested by incoming connections
>                   but do not request ECN on outgoing connections.

Changing existing user-behavior for this default seems to be overly
optimistic. Useful for testing, but...

> +               3 Enable AccECN when requested by incoming connections and
> +                 also request AccECN on outgoing connection attempts.
> +           0x102 Enable AccECN in optionless mode for incoming connections.
> +           0x103 Enable AccECN in optionless mode for incoming and outgoing
> +                 connections.

In terms of the logic bits here, it might make more sense

0: disable ecn
1: enable std ecn on in or out
2: enable std ecn when requested on in (the default)
3: essentially unused
4: enable accecn when requested on in
5: enable std ecn and accecn on in or out
6: enable accecn and ecn on in but not out

Do we have any data on how often the tcp ns bit is a source of
firewalling problems yet?

0x102 strikes me as a bit more magical than required and I don't know
what optionless means in this context.

>         Default: 2
>
>  tcp_ecn_fallback - BOOLEAN
>         If the kernel detects that ECN connection misbehaves, enable fall
>         back to non-ECN. Currently, this knob implements the fallback
> -       from RFC3168, section 6.1.1.1., but we reserve that in future,
> -       additional detection mechanisms could be implemented under this
> +       from RFC3168, section 6.1.1.1., as well as the ECT codepoint mangling
> +       detection during the Accurate ECN handshake, but we reserve that in
> +       future, additional detection mechanisms could be implemented under this
>         knob. The value is not used, if tcp_ecn or per route (or congestion
>         control) ECN settings are disabled.
>         Default: 1 (fallback enabled)
> --
> 2.20.1
>


-- 
Make Music, Not War

Dave Täht
CTO, TekLibre, LLC
http://www.teklibre.com
Tel: 1-831-435-0729