Page MenuHomeFreeBSD

Disallow broken ECN TCP stacks from using ECN
ClosedPublic

Authored by rscheff on Jan 28 2019, 1:56 AM.

Details

Summary

RFC3168 specifies on page 15, how to correctly negotiate for a TCP session with ECN support.

There are a (diminishing) number of middleboxes reflecting reserved TCP header bits. Simultaneously an increasing interest in deploying ECN, may lead to
the incorrect behavior for TCP sessions.

On a SYN, both CWR and ECE have to be set, while on the SYN,ACK only the ECE must be set, and CWR must be clear.

Test Plan

Simulating a non-compliant ECN client, injecting ECE-marked ACKs should not result in a reduction of cwnd (and no packets with the CWR bit set).

Diff Detail

Repository
rS FreeBSD src repository
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

rscheff created this revision.Jan 28 2019, 1:56 AM
rscheff set the repository for this revision to rS FreeBSD src repository.

Here are two test scripts to validate both the proper behavior of ECN as a client, against a conformant RFC3168 client, as well as a non-conformant client which reflects back all header flags as received:

tuexen accepted this revision.Jan 28 2019, 12:04 PM
This revision is now accepted and ready to land.Jan 28 2019, 12:04 PM
tuexen requested changes to this revision.Jan 28 2019, 12:23 PM

Please apply the same fix to tcp_stacks/rack.c.

This revision now requires changes to proceed.Jan 28 2019, 12:23 PM
rscheff updated this revision to Diff 53306.Jan 28 2019, 12:28 PM
  • adding RACK stack to ECN handshake check
  • trailing whitespace
This revision was not accepted when it landed; it landed in state Needs Review.Jan 28 2019, 12:45 PM
This revision was automatically updated to reflect the committed changes.