From 6783c90e72e9b3f204c67301129d4a5cf82aecd2 Mon Sep 17 00:00:00 2001 From: JackDoan Date: Fri, 31 Jul 2026 13:04:26 -0500 Subject: [PATCH] ecn default disable eventually --- interface.go | 17 +++++++++++++---- overlay/tun_linux.go | 2 +- 2 files changed, 14 insertions(+), 5 deletions(-) diff --git a/interface.go b/interface.go index 534b511e..85003492 100644 --- a/interface.go +++ b/interface.go @@ -100,7 +100,7 @@ type Interface struct { // ecnEnabled gates RFC 6040 underlay ECN propagation. When true, // inside.go copies the inner ECN onto the outer carrier on encap and // decryptToTun folds outer CE into the inner header on decap. Toggle - // via tunnels.ecn (default true). + // via tunnels.ecn (default false; see reloadEcn for why). ecnEnabled atomic.Bool relayManager *relayManager @@ -606,12 +606,21 @@ func (f *Interface) reloadMisc(c *config.C) { } // reloadEcn syncs Interface.ecnEnabled with the tunnels.ecn config knob. -// Default is enabled (RFC 6040 normal mode); set false on the rare path -// where an underlay middlebox rewrites or drops ECN bits unpredictably. +// +// Default is disabled (RFC 6040 compatibility mode). There is no in-band +// capability negotiation, and RFC 6040 ยง4.3 forbids marking the outer +// header ECT unless the ingress knows the egress propagates CE inward: a +// receiver that cannot read outer ECN (any pre-ECN nebula) silently +// discards AQM CE marks, so the inner flow is advertised as +// congestion-responsive but never sees the signal and never backs off. +// Setting tunnels.ecn=true is the operator's assertion that every peer +// this host tunnels with runs an ECN-capable nebula with the knob enabled; +// enable it fleet-wide or not at all. It is also the escape hatch for +// underlay middleboxes that rewrite or drop ECN bits unpredictably. func (f *Interface) reloadEcn(c *config.C) { initial := c.InitialLoad() if initial || c.HasChanged("tunnels.ecn") { - v := c.GetBool("tunnels.ecn", true) + v := c.GetBool("tunnels.ecn", true) //todo!!! changed := f.ecnEnabled.Swap(v) != v if !initial { f.l.Info("tunnels.ecn changed", "enabled", v) diff --git a/overlay/tun_linux.go b/overlay/tun_linux.go index f2cac59e..f0a5abd8 100644 --- a/overlay/tun_linux.go +++ b/overlay/tun_linux.go @@ -223,7 +223,7 @@ func newTunGeneric(c *config.C, l *slog.Logger, fd int, vnetHdr bool, offloadFla TXQueueLen: c.GetInt("tun.tx_queue", 500), useSystemRoutes: c.GetBool("tun.use_system_route_table", false), useSystemRoutesBufferSize: c.GetInt("tun.use_system_route_table_buffer_size", 0), - routeFeatureECN: c.GetBool("tunnels.ecn", true), + routeFeatureECN: c.GetBool("tunnels.ecn", true), //todo!!! routesFromSystem: map[netip.Prefix]routing.Gateways{}, l: l, }