feat(s2n-quic-dc): implement cbpf router for dcQUIC packet filtering - #3026
Open
boquan-fang wants to merge 1 commit into
Open
feat(s2n-quic-dc): implement cbpf router for dcQUIC packet filtering#3026boquan-fang wants to merge 1 commit into
boquan-fang wants to merge 1 commit into
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release Summary:
Implement a cbpf router for dcQUIC server for packet filtering. A dcQUIC server receives all client hello packets from the rx socket and all other packets will be handled by the prioritized socket.
Resolved issues:
resolves #2954. This PR follows #3014.
related to #2967.
Description of changes:
This PR implements a cbpf router for dcQUIC server in a newly created file: dc/s2n-quic-dc/src/psk/router.rs. The router would route all client hello packets (INITIAL header: 1100 + destination CID length = 8) to the rx_socket and all other packets to the prioritized socket.
The dcQUIC IO module would attach two sockets to the router by default, and hence the feature is enabled for dcQUIC endpoints by default.
Call-outs:
My reviewers should check the final assertions of my load test. See if there are anything else that we should add to it.
Testing:
router_cbpf_packet_filtering_testuses the router implemented for dcQUIC and tries to route three different packets and assert whether they are routed to the correct socket.dc_server_packet_filtering_load_test: this test simulate a dcQUIC client tries to connect with a dcQUIC server, while a packet generator flood the server withEXAMPLE_CLIENT_INITIAL_PROTECTED_PACKET. The flood should only happen until the first client hello from the client is received by the server. With packet filtering, the actual handshake should still succeed. I ran this test before the this feature was implemented, and the test will fail: main...boquan-fang:s2n-quic:before-packet-filtering.By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.