18.3 Split Paths

18.3 Split Paths

In some scenarios, a malicious or corrupted router could have access to only a subset of packets in a flow. The question is as follows: Can that router, by changing the ECN field in the subset of packets that it can access, cause greater harm to that flow than it could cause by simply dropping that set of packets?

We classify packets in a flow as A packets and B packets, and assume that the adversary has access only to the A packets. Assume that the adversary subverts end-to-end congestion control along the transmission path for A packets only by falsely indicating ECN-capability upstream of where congestion occurs on the path for A packets, or clearing congestion indications downstream. Consider also that there is a monitoring device that sees both A and B packets, and will "penalize" both A and B packets if it determines that the aggregate flow is not responding correctly to congestion indications. Another key characteristic that we believe is likely to be true is that the monitoring device, before "penalizing" the A&B flow, will first drop packets instead of setting the CE codepoint, and will drop arriving packets from that flow that already have the CE codepoint set. If the end nodes are actually using end-to-end congestion control, they will see all the congestion indications that the monitoring device sees, and will begin to respond to those congestion indications. Thus, the monitoring device successfully provides indications to the flow at an early stage.

Indeed, an adversary with access only to A packets could, by subverting ECN-based congestion control, be able to deny the benefits of ECN to other packets in the A&B aggregate. While this is undesirable, it is not a sufficient concern to argue for disabling ECN.

A variant of falsely reporting congestion is to have two adversaries on the path, where the first adversary falsely reports congestion, and the second adversary "clears" those reports. (Unlike packet drops, ECN congestion reports can be "undone" later in the network by a malicious or corrupted router. However, use of the ECN nonce can help the transport detect this behavior.) While this would be transparent to the end nodes, monitoring devices between the first and second adversaries could see the false congestion indication. Remember the recommendation in this document that before "penalizing" flows for not responding appropriately to congestion, routers will first switch to dropping packets instead of marking them. In this case, the end nodes would again receive congestion indications, even if the second adversary succeeds in clearing the false congestion reports initiated by the first adversary.