nfqueue-packet-delay package not building / How to use tc-netem as alternative?

[HulaHoop0]

Hi Ethan. I wanted your opinion on how to use the tc-netem utility for delaying network packets on a chosen interface to accomplish the same mitigation as implemented in nfqueue-packet-delay.

The reasons to go with tc are 1) It is already packaged in Debian and benefits from reproducible build security 2) Doesn't depend on outside deps from pypi which we have security reservations about their signing or lack thereof. 3) Less likely to break with time - (the nfqueue-packet-delay deb fails to build per an old bug report on our tracker that's stopped us from deploying it for a long time now).[0]

I've looked at the tc manual and came up with these parameters for adding a delay to to all packets going out of the local Ethernet in the order of 50 ± 50 ms for a maximum value of 100 ms or less. Network delay variation isn't purely random, so to emulate that I selected a correlation value of a normal distribution added to it as well:

# tc qdisc change dev eth0 root netem delay 50ms 50ms distribution normal

Are these values sane? Do they achieve queuing across a variable-length window? If not then is the protection ineffective?

Thanks.

---

[0] https://phabricator.whonix.org/T530#18877

cc/ @adrelanos

[HulaHoop0]

Rate control options in netem as a potential equivalent for variable windows? From what I understand, packets accumulate in a buffer and then released with this feature.

https://www.badunetworks.com/traffic-shaping-with-tc/

http://home.ifi.uio.no/paalh/students/AndersMoe.pdf (2.4.5 Rate control)

tc qdisc add dev eth0 root netem rate 1mbit delay 100ms