Subject: [quicwg/base-drafts] Detect adversarial ECN reporting (#1426)

From: Christian Huitema <[email-masked]>
Date: Thu, 07 Jun 2018 01:15:34 -0700

In the ECN proposal, the sender relies on the recipient to send back an honest count of ECN marks. A client who wants the sender to overshoot the network capacity will be able to just avoid reporting the "congestion experienced" marks, pretending that there never is congestion.

This is similar to the "optimistic ack" problem that is mitigated by leaving holes in the sequence of packet numbers. If a bad client acks a hole, the sender notices it and can terminate the connection.

We should consider a similar mechanism for ECN. The sender normally marks packets as ECT(0) or ECT(1). It could also at some random intervals mark a packet as "CE", and then verify that the CE is reflected in the counters sent by the recipient.

The downside is that the sender-set CE may "mask" a congestion in the network. But if only a small fraction of the packets are used for this probing mechanism, it should not be too much of a problem.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1426

---

From: Gorry Fairhurst <[email-masked]>
Date: Thu, 07 Jun 2018 01:23:39 -0700

This is not a unique issue to QUIC! 

Setting ECN-CE is something I routinely do in ECN measurement work and we have talked about adding this to TCP, and it's mentioned in TSVWG docs - To do it with TCP requires accurate ECN feedback - which is similar to what is being proposed by the DT for QUIC - so this should be OK.

A sender should not set CE often (if they are going to ignore markings), but as an infrequent probe I think it has useful properties… If it masks one CE mark every now and again, it's not a big deal - if the congestion marking rate is really that low, it is OK - if the sender sees other CE marks it knows to react. Since this is a generic ECN comment, I'd encourage discussion within TSVWG - where you may also attract more feedback from people with understanding of ECN.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1426#issuecomment-395335864

---

From: Magnus Westerlund <[email-masked]>
Date: Mon, 11 Jun 2018 04:53:00 -0700

Agree with @gorryfair that this is a generic issue for ECN. On the higher level clearly a sender should be able to test the response of the receiver by marking ECN-CE from the sender side. I think this falls into the same optional possibilities as the intentional sequence number gaps. 

So, I think it would be good if there could be a general recommendation for this type of receiver behavior verification. The masking of actual CE marks are one issue. The others I see, is any API limitations on certain platforms. 

On the other side one can question the value of lying about the CE marks. Being none-responsive to CE-marks may result in pushing other flows out of the way, at the same time it does build queue, especially if one-self is the main flow. Also, in certain networks, one could be penalized for not being responsive to CE marks. 

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1426#issuecomment-396217066