Add SKB Priority qdisc support in tc(8)
Subsystems (2)
PATCH v2 1/1 Add SKB Priority qdisc support in tc(8)
sch_skbprio is a qdisc that prioritizes packets according to their skb->priority field. Under congestion, it drops already-enqueued lower priority packets to make space available for higher priority packets. Skbprio was conceived as a solution for denial-of-service defenses that need to route packets with different priorities as a means to overcome DoS attacks.
---
v2
*Patch applies cleanly, fixes for proper code indentation.
--- man/man8/tc-skbprio.8 | 70 ++++++++++++++++++++++++++++++++++++++++++ tc/Makefile | 1 + tc/q_skbprio.c | 84 +++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 155 insertions(+) create mode 100644 man/man8/tc-skbprio.8 create mode 100644 tc/q_skbprio.c
man/man8/tc-skbprio.8 new file +70 -0
@@ -0,0 +1,70 @@ +.TH SKBPRIO 8 "13 August 2018" "iproute2" "Linux" +.SH NAME +skbprio \- SKB Priority Queue + +.SH SYNOPSIS +.B tc qdisc ... add skbprio +.B [ limit +packets +.B ] + +.SH DESCRIPTION +SKB Priority Queue is a queueing discipline intended to prioritize +the most important packets during a denial-of-service ( +.B DoS +) attack. The priority of a packet is given by +.B skb->priority +, where a higher value places the packet closer to the exit of the queue. When +the queue is full, the lowest priority packet in the queue is dropped to make +room for the packet to be added if it has higher priority. If the packet to be +added has lower priority than all packets in the queue, it is dropped. + +Without SKB priority queue, queue length limits must be imposed +on individual sub-queues, and there is no straightforward way to enforce +a global queue length limit across all priorities. SKBprio queue enforces +a global queue length limit while not restricting the lengths of +individual sub-queues. + +While SKB Priority Queue is agnostic to how +.B skb->priority +is assigned. A typical use case is to copy +the 6-bit DS field of IPv4 and IPv6 packets using +.BR tc-skbedit (8) +. If +.B skb->priority +is greater or equal to 64, the priority is assumed to be 63. +Priorities less than 64 are taken at face value. + +SKB Priority Queue enables routers to locally decide which +packets to drop under a DoS attack. +Priorities should be assigned to packets such that the higher the priority, +the more expected behavior a source shows. +So sources have an incentive to play by the rules. + +.SH ALGORITHM + +Skbprio maintains 64 lists (priorities go from 0 to 63). +When a packet is enqueued, it gets inserted at the +.B tail +of its priority list. When a packet needs to be sent out to the network, it is +taken from the head of the highest priority list. When the queue is full, +the packet at the tail of the lowest priority list is dropped to serve the +ingress packet - if it is of higher priority, otherwise the ingress packet is +dropped. This algorithm allocates as much bandwidth as possible to high +priority packets, while only servicing low priority packets when +there is enough bandwidth. + +.SH PARAMETERS +.TP +limit +Maximum queue size specified in packets. It defaults to 64. +The range for this parameter is [0, UINT32_MAX]. + +.SH SEE ALSO +.BR tc-prio (8), +.BR tc-skbedit (8) + +.SH AUTHORS +Nishanth Devarajan <[email protected]>, Michel Machado <[email protected]> + +This manpage maintained by Bert Hubert <[email protected]>
tc/Makefile +1 -0
@@ -12,6 +12,7 @@ TCMODULES += q_fifo.o TCMODULES += q_sfq.o TCMODULES += q_red.o TCMODULES += q_prio.o +TCMODULES += q_skbprio.o TCMODULES += q_tbf.o TCMODULES += q_cbq.o TCMODULES += q_rr.o
tc/q_skbprio.c new file +84 -0
84 lines not on this page · raw message
Signature · 1 line
1.9.1
David Ahern
AppliedQuoted 11 lines · Nishanth Devarajan
sch_skbpriois a qdisc that prioritizes packets according to theirskb->priorityfield. Under congestion, it drops already-enqueued lower priority packets to make space available for higher priority packets. Skbprio was conceived as a solution for denial-of-service defenses that need to route packets with different priorities as a means to overcome DoS attacks.Signed-off-by Nishanth Devarajan <[email protected]>Reviewed-by Michel Machado <[email protected]>---
v2
*Patch applies cleanly, fixes for proper code indentation.
Quoted 7 lines
--- man/man8/tc-skbprio.8 | 70 ++++++++++++++++++++++++++++++++++++++++++ tc/Makefile | 1 + tc/q_skbprio.c | 84 +++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 155 insertions(+) create mode 100644 man/man8/tc-skbprio.8 create mode 100644 tc/q_skbprio.c
applied to iproute2-next. Thanks