ECN: Volunteers needed

ECN: Volunteers needed

[jamal]

Folks,

ECN is about to become a Proposed Standard RFC. Thanks to
efforts from the Linux community, a few issues were discovered
in the course of deploying the code. Special kudos go to Alexey
Kuznetsov and David Miller.

I wont go into details of the issues other than to say some
midlle-box vendors in the past have associated the semantics of the
natural-language English word "reserved" to have a different meaning.
visit Jeff Garzik's ECN-under-Linux Unofficial Vendor Support Page
at: http://gtf.org/garzik/ecn/ for more details

Sally Floyd explains best why it is wrong for vendors of middle boxes to
be doing this in the draft to be found at:
ftp://ftp.normos.org/ietf/internet-drafts/draft-floyd-tcp-reset-00.txt

So why am i posting this?

This is to solicit volunteers who will help removing the remaining cruft.
Some vendors (special positive mention goes to CISCO) have released
patches which are unfortunately not being propagated by some of the
site owners.
Help is needed to contact these site owners and politely using a standard
email ask them that their site was non-conformant.
Point them to Sally's draft and the fact that ECN is becoming standard
in the next week or so. Also to Jeff's ECN-under-Linux Unofficial
Vendor Support Page, and to encourage them to have their firewall
or load-balancer upgraded.
I suppose the first volunteer needed is to draft such an email. We have to
be polite and persistent for this to work.

Jitendra Padhye at ACIRI is running weekly tests to detect offending
sites. Most recent results can be found at:
http://www.aciri.org/tbit/ecn_test3A.html
Any site with the word "RST" on the line should be considered
non-conformant.

Volunteers please send an email to ecn@gtf.org with subject "interested in
volunteering"

Flames etc please redirect to netdev (since that's the only list i am on).
as well make sure you cc the other people (other than linux-kernel and
linux-net)

cheers,
jamal

Re: ECN: Volunteers needed

[David S. Miller]

jamal writes:
 > Help is needed to contact these site owners and politely using a standard
 > email ask them that their site was non-conformant.
 > Point them to Sally's draft and the fact that ECN is becoming standard
 > in the next week or so. Also to Jeff's ECN-under-Linux Unofficial
 > Vendor Support Page, and to encourage them to have their firewall
 > or load-balancer upgraded.
 > I suppose the first volunteer needed is to draft such an email. We have to
 > be polite and persistent for this to work.

I believe it would only be prudent to actually send out these messages
starting at the moment ECN is officially standard.

This was the big argument I was running into from sites, "well it
isn't standard yet, when it is we'll do something about it".  The
larger sites like to avoid updates until absolutely necessary.

If we are to improve ECN deployment, we should understand the
priorities of the people who run the sites which stand in the way
of our doing so.

Later,
David S. Miller
davem@redhat.com

Re: ECN: Volunteers needed

[jamal]

On Tue, 8 May 2001, David S. Miller wrote:

>
> I believe it would only be prudent to actually send out these messages
> starting at the moment ECN is officially standard.
>
> This was the big argument I was running into from sites, "well it
> isn't standard yet, when it is we'll do something about it".  The
> larger sites like to avoid updates until absolutely necessary.
>
> If we are to improve ECN deployment, we should understand the
> priorities of the people who run the sites which stand in the way
> of our doing so.
>

Sally new draft:
ftp://ftp.normos.org/ietf/internet-drafts/draft-floyd-tcp-reset-00.txt

builds a strong case against the RST issue and maybe used to point
to problems despite ECN.
But you are right, it will be stronger and wiser to wait until this is
standardized before paying a visit to the site owners.
Any one wishing to volunteer, please still send your emails in --
we should be ready in a few days from now,

cheers,
jamal

Re: ECN: Volunteers needed

[jamal]

On Tue, 8 May 2001, jamal wrote:
> Any one wishing to volunteer, please still send your emails in --
> we should be ready in a few days from now,
>

I guess i should have mentioned the IESG is sitting in to approve ECN
as proposed standard in about a week or so.

cheers,
jamal

Re: ECN: Volunteers needed

[Billy Harvey]

 > This was the big argument I was running into from sites, "well it
 > isn't standard yet, when it is we'll do something about it".  The
 > larger sites like to avoid updates until absolutely necessary.

Good grief - nothing like planning ahead ... and these large-site
administrators actually accept paychecks for their lack of foresight?

Billy

Re: ECN: Volunteers needed

[Sally Floyd]

>This was the big argument I was running into from sites, "well it
>isn't standard yet, when it is we'll do something about it".  The
>larger sites like to avoid updates until absolutely necessary.

The purpose of my draft on "Inappropriate TCP Resets Considered
Harmful" is to argue that firewalls and other devices should not
send Resets in response to Reserved flags in the TCP header regardless
of the standards status of the reserved flag.  System administrators
will clearly have to decide for themselves whether they find the
argument convincing.  And my own belief is that, while working to
get the broken firewalls and such fixed, it is also not a bad idea
for TCP implementations to make sure they are as robust as possible
in the presence of such broken equipment...

- Sally

Re: ECN: Volunteers needed

[Matthew Geier]

> This is to solicit volunteers who will help removing the remaining cruft.
> Some vendors (special positive mention goes to CISCO) have released
> patches which are unfortunately not being propagated by some of the
> site owners.
> Help is needed to contact these site owners and politely using a standard
> email ask them that their site was non-conformant.


 I tried to get my local bank to fix their internet banking service about a
month ago. I ran into a 'brick wall'. They only support Windows and MacOS,
since neither currently implement ECN, they don't have a problem :-(

 The only answer I got is 'we don't support Linux'. The operator tried
to find some one interested in the network, but the answer was always
the same. 'We don't support.....'

 They actually suggested I 'upgrade' my browser at one point!

 Their service actually works perfectly with Netscape and Linux 2.4.x
(as long as ECN is disabled).

Re: ECN: Volunteers needed

[Pekka Savola]

On Wed, 9 May 2001, Matthew Geier wrote:
> > This is to solicit volunteers who will help removing the remaining cruft.
> > Some vendors (special positive mention goes to CISCO) have released
> > patches which are unfortunately not being propagated by some of the
> > site owners.
> > Help is needed to contact these site owners and politely using a standard
> > email ask them that their site was non-conformant.
>
>
>  I tried to get my local bank to fix their internet banking service about a
> month ago. I ran into a 'brick wall'. They only support Windows and MacOS,
> since neither currently implement ECN, they don't have a problem :-(
>
>  The only answer I got is 'we don't support Linux'. The operator tried
> to find some one interested in the network, but the answer was always
> the same. 'We don't support.....'
[snip]

There are a couple of ways to deal with these:

 0) speak to the right persons: don't expect helpdesk can do anything
about these, especially don't expect anyone to "call you back".  Try to
get in touch with someone who is a network admin; if the bank is not a
kiosk with tiny amount of money in the safe, a whois database e.g. RIPE
might give some clues.  If helpdesk/network admin is clueless, ask to
speak with their supervisor.

 1) vote with your feet: switch the bank.  This is how modern economy
works; money is power.  Make sure they know you switched (or intend to
switch) banks, and why.  Make sure their boss, and the person somewhat in
charge of handling customer relations, knows it.

 2) make it (more) public: if there are potentially more people in the
area who this would concern, making this public, and causing the bank a
potential loss of 50 customers, not 1, might wake them to the reality.

 3) forget about it: just don't enable ECN.

And lastly: do not make them think of this as a Linux problem.  Their
software breaks Internet standards (soon, anyway :), and eventually they
will be shut out.  In many cases, the fix is free and easily installable.

.. Let's not start a huge thread (especially with this big Cc: list; there
should be a smaller forum to discuss this if necessary) on this though.

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

Re: ECN: Volunteers needed

[Gregory Maxwell]

On Tue, May 08, 2001 at 10:31:23PM -0400, jamal wrote:
> Folks,
> 
> ECN is about to become a Proposed Standard RFC. Thanks to
> efforts from the Linux community, a few issues were discovered
> in the course of deploying the code. Special kudos go to Alexey
> Kuznetsov and David Miller.
[snip]

Anyone have any friends at AOL? I wonder what the effect on these
non-conformant sites would be if AOL's proxy's became ECN enabled?

Re: ECN: Volunteers needed

[Horst von Brand]

Gregory Maxwell <greg@linuxpower.cx> said:

[...]

> Anyone have any friends at AOL? I wonder what the effect on these
> non-conformant sites would be if AOL's proxy's became ECN enabled?

And AOL is sure crazy enough to "break compatibility with everybody" just
out of courtesy to someone's friend call. 

Get real, it _won't_ happen unless they are forced to do so. Standard or
not.
-- 
Dr. Horst H. von Brand                       mailto:vonbrand@inf.utfsm.cl
Departamento de Informatica                     Fono: +56 32 654431
Universidad Tecnica Federico Santa Maria              +56 32 654239
Casilla 110-V, Valparaiso, Chile                Fax:  +56 32 797513

Re: ECN: Volunteers needed

[Gregory Maxwell]

On Wed, May 09, 2001 at 10:10:29AM -0400, Horst von Brand wrote:
> Gregory Maxwell <greg@linuxpower.cx> said:
> 
> [...]
> 
> > Anyone have any friends at AOL? I wonder what the effect on these
> > non-conformant sites would be if AOL's proxy's became ECN enabled?
> 
> And AOL is sure crazy enough to "break compatibility with everybody" just
> out of courtesy to someone's friend call. 
> 
> Get real, it _won't_ happen unless they are forced to do so. Standard or
> not.

1) It's not everybody.
2) They certainly are.  Every once in a while they go through a period of
   silently dropping all email coming from hosts that don't have PTRs.
   This would be no worse.

Re: ECN: Volunteers needed

[God]

On Wed, 9 May 2001, Pekka Savola wrote:

> To: Matthew Geier <matthew@sleeper.apana.org.au>
> 
> On Wed, 9 May 2001, Matthew Geier wrote:

> > > Help is needed to contact these site owners and politely using a standard
> > > email ask them that their site was non-conformant.

[snip]

> >
> >
> >  I tried to get my local bank to fix their internet banking service about a
> > month ago. I ran into a 'brick wall'. They only support Windows and MacOS,
> > since neither currently implement ECN, they don't have a problem :-(

[snip]
> 
> There are a couple of ways to deal with these:
> 
> Try to get in touch with someone who is a network admin; 

[snip]

In most cases, good luck.  Though as you pointed out, checking RIPE might
help.

I mentioned in here (kernel list) about dogpile.com not supporting
it.  I've tried to contact their administrators with no luck.

> .. Let's not start a huge thread (especially with this big Cc: list; there
> should be a smaller forum to discuss this if necessary) on this though.


Agreed.  For now ECN has been disabled here.  I got tired of so many sites
not supporting it that I gave up.  Maybe by 2.8.x kernels it will be worth
turning back on.  Thats not to say however that I don't like what the ECN
people are trying to do, rather its causing me more grief with it on, then
the grief I get with it off.

Re: ECN: Volunteers needed

[God]

On Wed, 9 May 2001, Gregory Maxwell wrote:

> 2) They certainly are.  Every once in a while they go through a period of
>    silently dropping all email coming from hosts that don't have PTRs.
>    This would be no worse.

ACK .... Which do you mean? :

-Hosts that don't have valid PTRs (which would be no PTR at all -- Not
deliverable, but not because AOL said so)

-Hosts that don't have valid PTRs, but DO have at least one valid MX
(Forward and reverse)

-Same as above, but said hosts MX's forward and/or reverse don't match

etc etc ....   I ask this simply because I DO know of users who have
complained their E-Mail to/from an AOL customer, didn't get there.  I've
always assumed .. well ... AOL user .. no comment :)

Re: ECN: Volunteers needed

[H. Peter Anvin]

Followup to:  <Pine.LNX.4.21.0105091249520.23642-100000@scotch.homeip.net>
By author:    God <atm@sdk.ca>
In newsgroup: linux.dev.kernel
> 
> Agreed.  For now ECN has been disabled here.  I got tired of so many sites
> not supporting it that I gave up.  Maybe by 2.8.x kernels it will be worth
> turning back on.  Thats not to say however that I don't like what the ECN
> people are trying to do, rather its causing me more grief with it on, then
> the grief I get with it off.
> 

I suspect that the main way to get this thing fixed is to make sure
ECN is enabled on the server side; for example, we have turned on ECN
on kernel.org.  If a user is using a broken software stack, it's their
loss, not ours.

	-hpa
-- 
<hpa@transmeta.com> at work, <hpa@zytor.com> in private!
"Unix gives you enough rope to shoot yourself in the foot."
http://www.zytor.com/~hpa/puzzle.txt

Re: ECN: Volunteers needed

[Gregory Maxwell]

On Wed, May 09, 2001 at 01:08:31PM -0400, God wrote:
> On Wed, 9 May 2001, Gregory Maxwell wrote:
> 
> > 2) They certainly are.  Every once in a while they go through a period of
> >    silently dropping all email coming from hosts that don't have PTRs.
> >    This would be no worse.
> 
> ACK .... Which do you mean? :
> 
> -Hosts that don't have valid PTRs (which would be no PTR at all -- Not
> deliverable, but not because AOL said so)
> 
> -Hosts that don't have valid PTRs, but DO have at least one valid MX
> (Forward and reverse)
> 
> -Same as above, but said hosts MX's forward and/or reverse don't match
> 
> etc etc ....   I ask this simply because I DO know of users who have
> complained their E-Mail to/from an AOL customer, didn't get there.  I've
> always assumed .. well ... AOL user .. no comment :)

AFIK, mail which contains Path with host names which don't pass a two-way
check (forward, reverse the forward) AOL drops. Not always though, MX
records are irrelevantly.

Re: ECN: Volunteers needed :: AOL ::: Spam filter

[God]

On Wed, 9 May 2001, Gregory Maxwell wrote:

> On Wed, May 09, 2001 at 01:08:31PM -0400, God wrote:
> > On Wed, 9 May 2001, Gregory Maxwell wrote:
> > 
> > > 2) They certainly are.  Every once in a while they go through a period of
> > >    silently dropping all email coming from hosts that don't have PTRs.
> > >    This would be no worse.
> > 
> > ACK .... Which do you mean? :

> 
> AFIK, mail which contains Path with host names which don't pass a two-way
> check (forward, reverse the forward) AOL drops. Not always though, MX
> records are irrelevantly.
> 

OMG ... that .. is gay ...   oh well .... should add them as a blocked
domain anyway ... for all the dam spam that comes from them ....grrr

</thread>

Re: ECN: Volunteers needed

[Holger Lubitz]

"H. Peter Anvin" wrote:
> I suspect that the main way to get this thing fixed is to make sure
> ECN is enabled on the server side; for example, we have turned on ECN
> on kernel.org.  If a user is using a broken software stack, it's their
> loss, not ours.

This is what we do here, too. The only exceptions: Our mail server
(needs to deliver mail, even to broken sites) and our web proxy server
(also needs to connect to broken sites sometimes). Everything else is
ECN enabled. And this is the approach I'd suggest to anybody running 2.4
servers.

Holger

Re: ECN: Volunteers needed

[Michel Eyckmans (MCE)]

> I suspect that the main way to get this thing fixed is to make sure
> ECN is enabled on the server side; for example, we have turned on ECN
> on kernel.org.  If a user is using a broken software stack, it's their
> loss, not ours.

I agree it's the server side that will eventuelly push it through,
but don't expect miracles. I informed the sysadmins at the place 
where I work that ftp.kernel.org isn't reachable anymore for us, 
only to get a long reply full of reasons (some better than others) 
why they wouldn't act. The final statement was: "use one of the 
many ftp.<country>.kernel.org mirrors".

MCE
-- 
========================================================================
M. Eyckmans (MCE)          Code of the Geeks v3.1              mce@pi.be
GCS d+ s+:- a35 C+++$ UHLUASO+++$ P+ L+++ E--- W++ N+++ !o K w--- !O M--
 V-- PS+ PE+ Y+ PGP- t--- !5 !X R- tv- b+ DI++ D-- G++ e+++ h+(*) !r y?
========================================================================

Re: ECN: Volunteers needed

[David Ford]

I simply crontab an ECN off period for five minutes every hour and flush 
the mail queue.

David.

Holger Lubitz wrote:

>"H. Peter Anvin" wrote:
>
>>I suspect that the main way to get this thing fixed is to make sure
>>ECN is enabled on the server side; for example, we have turned on ECN
>>on kernel.org.  If a user is using a broken software stack, it's their
>>loss, not ours.
>>
>
>This is what we do here, too. The only exceptions: Our mail server
>(needs to deliver mail, even to broken sites) and our web proxy server
>(also needs to connect to broken sites sometimes). Everything else is
>ECN enabled. And this is the approach I'd suggest to anybody running 2.4
>servers.
>