Skip to contentSkip to conversation

using cgroups' classif with iptables

DISCUSSION Jean-Tiare LE BIGOT 2 participants 3 messages Mar 20, 2014 – Mar 21, 2014 2 messages not in the archive cgroup

lore
Share & tools
lore

Jean-Tiare LE BIGOT

author
#0 lore raw

Hi,

In https://www.kernel.org/doc/Documentation/cgroups/net_cls.txt there is a example to match the classid, set with a cgroup, with iptables:

	iptables -A OUTPUT -m cgroup ! --cgroup 0x100001 -j DROP

However, I've not been able to find the corresponding kernel module neither the iptables side module...

Do you have any hint where I could find it ?

Thanks,

Signature · 1 line
Jean-Tiare, shared-hosting team

A message that is not in the archive (sent off-list or not yet received): [email protected]

#2 lore raw

Hi, Jean,

You should look at t the Control Group Classifier module:
http://lxr.free-electrons.com/source/net/sched/cls_cgroup.c

Best regards,
Rami Rosen
http://ramirose.wix.com/ramirosen

Quoted 19 lines · Jean-Tiare LE BIGOT

Hi,

In https://www.kernel.org/doc/Documentation/cgroups/net_cls.txt there is a example to match the classid, set with a cgroup, with iptables:

        iptables -A OUTPUT -m cgroup ! --cgroup 0x100001 -j DROP

However, I've not been able to find the corresponding kernel module neither the iptables side module...

Do you have any hint where I could find it ?

Thanks,

--
Jean-Tiare, shared-hosting team
--
To unsubscribe from this list: send the line "unsubscribe cgroups" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html

A message that is not in the archive (sent off-list or not yet received): CAKoUArkS2mBZkFULqvvHEUEt6btcAAmV-+oWBk2KbNxrnt-s8Q-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org

author
#4 lore raw

Hi Rami,

Thanks for your hint. Looking in this direction I found https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/net/netfilter/xt_cgroup.c?id=82a37132f300ea53bdcd812917af5a6329ec80c3 which includes netfilter side of cgroup filtering in... 3.14. I'll backport it.

Regards,

Quoted 37 lines · Rami Rosen

Hi, Jean,

You should look at t the Control Group Classifier module:
http://lxr.free-electrons.com/source/net/sched/cls_cgroup.c

Best regards,
Rami Rosen
http://ramirose.wix.com/ramirosen

Quoted 11 lines · Jean-Tiare LE BIGOT

Hi,

In https://www.kernel.org/doc/Documentation/cgroups/net_cls.txt there is a example to match the classid, set with a cgroup, with iptables:

         iptables -A OUTPUT -m cgroup ! --cgroup 0x100001 -j DROP

However, I've not been able to find the corresponding kernel module neither the iptables side module...

Do you have any hint where I could find it ?

Quoted 8 lines

Thanks,

--
Jean-Tiare, shared-hosting team
--
To unsubscribe from this list: send the line "unsubscribe cgroups" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html

--
To unsubscribe from this list: send the line "unsubscribe cgroups" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html

Signature · 1 line
Jean-Tiare, shared-hosting team