[PATCH] 802.1p priority (fixed)

From: Boris Kovalenko (boris_at_ntmk.ru)
Date: 01/22/05

  • Next message: Maxim Konovalov: "Re: kern/73129: [patch] IPFW misbehaviour in RELENG_5"
    Date: Sat, 22 Jan 2005 10:50:18 +0500
    To: freebsd-net@freebsd.org
    
    

    Hello!

            802.1p is just a 3 bits of 802.1Q header. Based on it Layer 2 devices
    may assign packets to different output queues (more simple, 802.1p is
    QoS at Layer 2). So, You have right, this value differentiates packets
    within a vlan and Layer 2 device may make a decision what packets should
    be processed first. Of course, we may give the application the ability
    to set this value itself, but what to do with old applications that have
    no knowledge about this ability? Ok, You suppose to mark packets within
    PF/IPFW. Yes, the idea is good too, but what to do on routers not
    running any firewall software? So, may be right way will be:

    1. Mark 802.1p at application level
    2. Mark 802.1p at PF/IPFW level. But we shold foresee a keyword to trust
    application level information or override it. For example
    ipfw add 802.1p trust 6 on any to any ssh <-- this trust application
    level information and set 802.1p to 6 if it is omitted
    ipfw add 802.1p override 6 on any to any ssh <-- this silently set
    802.1p == 6, regardless of application
    3. Mark 802.1p at vlan drivers like 2
    ifconfig vlan0
            vlan: 100 802.1p: 6 CFI: 0 mode: trust vlandev: bge0
    Here we are trusting received from low level information and set 6 if it
    is omitted
    ifconfig vlan0
            vlan: 100 802.1p: 6 CFI: 0 mode: override vlandev: bge0
    Here we silently set 6.

    How this idea is?

    >My letting the application handle it, I was thinking of adding a socket
    >option (possibly requiring privilege) to set the priority.

    >As to having PF/IPFW deal with it, I was thinking about two
    >modifications to IPFW. First, the ability to filter based on .1p tags.
    >You might want to peal that information off in the Ethernet
    >code and tag the packets so you could still inspect it at a higher
    >level, but maybe not. The second modification would be to give ipfw/pf
    >the ability to set .1p priorities on packets, ie:
    >
    >ipfw add 802.1p 6 on any to any ssh
    >
    >My concern is that 802.1p is like the TOS bits in that it >differentiates
    >packets within a network rather then segregating them in to networks
    >like 802.1Q. In a switch it makes sense to handle priorities as >separate
    >networks, but I'm not sure it makes sense in a host. If nothing else,
    >it seems to make sense to be able to set priorities on vlan >encapsulated
    >frames.
    >
    >I've done a little googling on 802.1p and that hardened my believe that
    >the application and packet filter are the places to deal with this. >I'm
    >downloading the standard now to take a look at it.
    >
    >-- Brooks
    _______________________________________________
    freebsd-net@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-net
    To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"


  • Next message: Maxim Konovalov: "Re: kern/73129: [patch] IPFW misbehaviour in RELENG_5"

    Relevant Pages

    • Re: [PATCH] 802.1p priority (fixed)
      ... > is QoS at Layer 2). ... So, You have right, this value differentiates packets ... > Here we are trusting received from low level information and set 6 if it ... not convinced we should be doing it in the vlan device. ...
      (freebsd-net)
    • Re: bge data corruption bug (was: 1168 octets payload and bad TCPchecksums)
      ... but the difference is the same even for other packets). ... > dword of the transmitted frame is getting corrupted in hardware. ... > with 1168 octets of payload, using vlan tagging on the bge interface. ... bge interface for one supported by the sk or em driver solves the problem. ...
      (freebsd-net)
    • Re: New look for classic double-slit quantum-interference experiment
      ... return current from the electron detectors etc). ... interaction model has a question mark tagged onto it "since symmetric ... the laser pulse in reality are wave packets which may and, ...
      (sci.physics)
    • VLAN security question
      ... installed a Cisco switch, programmed the switch to route Internet ... Internet traffic is now on a VLAN, ... VLAN traffic can be seen there (sensible because the phones contain ... can send packets onto the telephone VLAN (i.e., ...
      (freebsd-questions)
    • Re: 5.4 -- bridging, ipfw, dot1q
      ... The packets you see are encapsulated in 802.1q aka VLAN frames, ... > assume the bridge at least sees the packets). ... > My only guess is that ipfw doesn't have the brains to look beyond the VLAN ...
      (freebsd-hackers)