fix(connlib): never clear ECT from IP packets

[thomaseizinger]

ECN information is helpful to allow the congestion controllers to more easily fine-tune their send and receive windows. When a Firezone Client receives an IP packet where the ECN bits signal an ECN capable transport, we mirror this bit on the UDP datagram that carries the encrypted IP packet.

When receiving a datagram with ECN bits set, the Gateway will then apply these bits to the decrypted IP packet and pass it along towards its destination.

This implementation is unfortunately a bit too naive. Not all devices on the Internet support ECN and therefore, we may receive a datagram that has its ECN bits cleared when the ECN bits on the inner IP packet still signal an ECN capable transport. In this case, we should not override the ECN bits and instead pass the IP packet along as is. Network devices along the path between Gateway and Resource may still use these ECN bits to signal congestion.

We fix this by making the with_ecn function on IpPacket private. It is not meant to be used outside of the module. We supersede it with a with_ecn_from_transport function that implements the above logic.

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
firezone	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	May 2, 2025 5:17am

[Copilot]

Pull Request Overview

This PR improves ECN handling in encrypted IP packet tunneling by ensuring that ECN bits are not cleared when not appropriate. Key changes include:

• Making the existing with_ecn function private and introducing a new with_ecn_from_transport function with refined logic.
• Updating tunnel code in both the client and gateway modules to use the new function.
• Adding tests to validate the updated ECN behavior.

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
rust/ip-packet/src/lib.rs	Introduces with_ecn_from_transport with enhanced ECN logic and accompanying tests.
rust/connlib/tunnel/src/lib.rs	Updates tunnel module to correctly call the new ECN handling function.

Comments suppressed due to low confidence (1)

rust/connlib/tunnel/src/lib.rs:215

• Confirm that all possible ECN cases are covered in the new with_ecn_from_transport logic, to avoid unexpected behavior in production. Ensure thorough testing across diverse ECN scenarios.

.send_tun(packet.with_ecn_from_transport(received.ecn));

[jamilbk]

LGTM