Skip to content

feat(s2n-quic-dc): implement cbpf router for dcQUIC packet filtering - #3026

Open
boquan-fang wants to merge 1 commit into
aws:mainfrom
boquan-fang:boquan-fang/dc-packet-filtering
Open

feat(s2n-quic-dc): implement cbpf router for dcQUIC packet filtering#3026
boquan-fang wants to merge 1 commit into
aws:mainfrom
boquan-fang:boquan-fang/dc-packet-filtering

Conversation

@boquan-fang

@boquan-fang boquan-fang commented Mar 24, 2026

Copy link
Copy Markdown
Contributor

Release Summary:

Implement a cbpf router for dcQUIC server for packet filtering. A dcQUIC server receives all client hello packets from the rx socket and all other packets will be handled by the prioritized socket.

Resolved issues:

resolves #2954. This PR follows #3014.

related to #2967.

Description of changes:

This PR implements a cbpf router for dcQUIC server in a newly created file: dc/s2n-quic-dc/src/psk/router.rs. The router would route all client hello packets (INITIAL header: 1100 + destination CID length = 8) to the rx_socket and all other packets to the prioritized socket.

The dcQUIC IO module would attach two sockets to the router by default, and hence the feature is enabled for dcQUIC endpoints by default.

Call-outs:

My reviewers should check the final assertions of my load test. See if there are anything else that we should add to it.

Testing:

  • unit test for the router: router_cbpf_packet_filtering_test uses the router implemented for dcQUIC and tries to route three different packets and assert whether they are routed to the correct socket.
  • dc_server_packet_filtering_load_test: this test simulate a dcQUIC client tries to connect with a dcQUIC server, while a packet generator flood the server with EXAMPLE_CLIENT_INITIAL_PROTECTED_PACKET. The flood should only happen until the first client hello from the client is received by the server. With packet filtering, the actual handshake should still succeed. I ran this test before the this feature was implemented, and the test will fail: main...boquan-fang:s2n-quic:before-packet-filtering.
  • Negative load test: I also try to run the load test without the router and the prioritized socket (basically comparing this feature with no prioritization or two sockets setup), the test errors on a handshake timeout as expected. main...boquan-fang:s2n-quic:before-packet-filtering
    thread 'psk::io::tests::dc_server_packet_filtering_load_test' (842506) panicked at dc/s2n-quic-dc/src/psk/io.rs:985:9:
    handshake failed: Some(HandshakeFailed(Custom { kind: TimedOut, error: "The connection was closed because   the handshake took longer than the max handshake duration of 10s" }))
    

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

@boquan-fang
boquan-fang marked this pull request as ready for review March 25, 2026 18:07
@boquan-fang
boquan-fang requested a review from a team as a code owner March 25, 2026 18:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Implement kernel packet filtering for dc-quic

1 participant