* cgroup filter on physics interface can't container
@ 2013-12-09 2:32 Libo Chen
[not found] ` <52A52BBF.6030105-hv44wF8Li93QT0dZR+AlfA@public.gmane.org>
0 siblings, 1 reply; 3+ messages in thread
From: Libo Chen @ 2013-12-09 2:32 UTC (permalink / raw)
To: David Miller, kaber, xemul, Serge Hallyn, ebiederm
Cc: edumazet, fbl, ebiederm, jeff, edumazet, peterz, honkiko, netdev,
LKML, Li Zefan, zhangwei(Jovi), Huang Qiang, Wengmeiling
hello network hackers,
A linux container was builded with veth pair(veth0 inside container, veth1 outside container),
the config as below:
lxc.network.type = veth
lxc.network.flags = up
lxc.network.link = br0 // base on eth0
lxc.network.name = eth0
lxc.network.ipv4 = 128.5.130.26/24
then I use tc command with cgroup filter on veth0, it works well. But when setting on eth0, it doesn`t work.
The reason is dev_forward_skb() in veth_xmit will call skb_scrub_packet and clean all information including skb->sk
in the skb, so if cls_cgroup_classify is working in serving softirq state, it will return failer, see below:
if (in_serving_softirq()) {
/* If there is an sk_classid we'll use that. */
if (!skb->sk)
return -1;
classid = skb->sk->sk_classid;
}
Qdisc with cgroup filter on physics interface can not control a container network, it is disappointed.
we can save sk_classid before skb_scrub_packet and restore it after that. Is it reasonable? or any way to achieve this?
thanks,
Libo
^ permalink raw reply [flat|nested] 3+ messages in thread[parent not found: <52A52BBF.6030105-hv44wF8Li93QT0dZR+AlfA@public.gmane.org>]
* Re: cgroup filter on physics interface can't control container [not found] ` <52A52BBF.6030105-hv44wF8Li93QT0dZR+AlfA@public.gmane.org> @ 2013-12-12 12:18 ` Libo Chen [not found] ` <52A9A97F.20902-hv44wF8Li93QT0dZR+AlfA@public.gmane.org> 0 siblings, 1 reply; 3+ messages in thread From: Libo Chen @ 2013-12-12 12:18 UTC (permalink / raw) To: David Miller, kaber-dcUjhNyLwpNeoWH0uzbU5w, xemul-GEFAQzZX7r8dnm+yROfE0A, Serge Hallyn, ebiederm-aS9lmoZGLiVWk0Htik3J/w Cc: jeff-o2qLIJkoznsdnm+yROfE0A, netdev-u79uwXL29TY76Z2rM5mHXA, containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA, daniel.wagner-98C5kh4wR6ohFhg+JK9F0w, LKML, honkiko-Re5JQEeQqe8AvxtiuMwx3w, edumazet-hpIqsD4AKlfQT0dZR+AlfA, ebiederm-aS9lmoZGLiVWk0Htik3J/w, cgroups-u79uwXL29TY76Z2rM5mHXA, fbl-H+wXaHxf7aLQT0dZR+AlfA, nhorman-2XuSBdqkA4R54TAoqtyWWQ, zhangwei(Jovi) ping... On 2013/12/9 10:32, Libo Chen wrote: > hello network hackers, > > A linux container was builded with veth pair(veth0 inside container, veth1 outside container), > > the config as below: > > lxc.network.type = veth > lxc.network.flags = up > lxc.network.link = br0 // base on eth0 > lxc.network.name = eth0 > lxc.network.ipv4 = 128.5.130.26/24 > > then I use tc command with cgroup filter on veth0, it works well. But when setting on eth0, it doesn`t work. > > The reason is dev_forward_skb() in veth_xmit will call skb_scrub_packet and clean all information including skb->sk > in the skb, so if cls_cgroup_classify is working in serving softirq state, it will return failer, see below: > > if (in_serving_softirq()) { > /* If there is an sk_classid we'll use that. */ > if (!skb->sk) > return -1; > classid = skb->sk->sk_classid; > } > > > Qdisc with cgroup filter on physics interface can not control a container network, it is disappointed. > > we can save sk_classid before skb_scrub_packet and restore it after that. Is it reasonable? or any way to achieve this? > > thanks, > Libo > ^ permalink raw reply [flat|nested] 3+ messages in thread
[parent not found: <52A9A97F.20902-hv44wF8Li93QT0dZR+AlfA@public.gmane.org>]
* Re: cgroup filter on physics interface can't control container [not found] ` <52A9A97F.20902-hv44wF8Li93QT0dZR+AlfA@public.gmane.org> @ 2013-12-18 9:12 ` Libo Chen 0 siblings, 0 replies; 3+ messages in thread From: Libo Chen @ 2013-12-18 9:12 UTC (permalink / raw) To: David Miller, kaber-dcUjhNyLwpNeoWH0uzbU5w, xemul-GEFAQzZX7r8dnm+yROfE0A, Serge Hallyn, ebiederm-aS9lmoZGLiVWk0Htik3J/w, herbert-lOAM2aK0SrRLBo1qDEOMRrpzq4S04n8Q Cc: jeff-o2qLIJkoznsdnm+yROfE0A, netdev-u79uwXL29TY76Z2rM5mHXA, containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA, daniel.wagner-98C5kh4wR6ohFhg+JK9F0w, LKML, honkiko-Re5JQEeQqe8AvxtiuMwx3w, edumazet-hpIqsD4AKlfQT0dZR+AlfA, ebiederm-aS9lmoZGLiVWk0Htik3J/w, cgroups-u79uwXL29TY76Z2rM5mHXA, fbl-H+wXaHxf7aLQT0dZR+AlfA, nhorman-2XuSBdqkA4R54TAoqtyWWQ, zhangwei(Jovi) hello guys, I said before "we can save sk_classid before skb_scrub_packet and restore it after that" since skb->sk had been freed in skb_scrub_packet(), so it is not reasonable. yes? I have another idea. commit:f84517253(cls_cgroup: Store classid in struct sock) introduces sk_classid and put it in skb->sk pointer. can we put sk_classid form struct sock to struct sk_buff? then sk_classid will not be affected by dev_forward_skb()->skb_scrub_packet() ? any comment are welcome! thanks, Libo On 2013/12/12 20:18, Libo Chen wrote: > ping... > > On 2013/12/9 10:32, Libo Chen wrote: >> hello network hackers, >> >> A linux container was builded with veth pair(veth0 inside container, veth1 outside container), >> >> the config as below: >> >> lxc.network.type = veth >> lxc.network.flags = up >> lxc.network.link = br0 // base on eth0 >> lxc.network.name = eth0 >> lxc.network.ipv4 = 128.5.130.26/24 >> >> then I use tc command with cgroup filter on veth0, it works well. But when setting on eth0, it doesn`t work. >> >> The reason is dev_forward_skb() in veth_xmit will call skb_scrub_packet and clean all information including skb->sk >> in the skb, so if cls_cgroup_classify is working in serving softirq state, it will return failer, see below: >> >> if (in_serving_softirq()) { >> /* If there is an sk_classid we'll use that. */ >> if (!skb->sk) >> return -1; >> classid = skb->sk->sk_classid; >> } >> >> >> Qdisc with cgroup filter on physics interface can not control a container network, it is disappointed. >> >> we can save sk_classid before skb_scrub_packet and restore it after that. Is it reasonable? or any way to achieve this? >> >> thanks, >> Libo >> > ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2013-12-18 9:12 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-12-09 2:32 cgroup filter on physics interface can't container Libo Chen
[not found] ` <52A52BBF.6030105-hv44wF8Li93QT0dZR+AlfA@public.gmane.org>
2013-12-12 12:18 ` cgroup filter on physics interface can't control container Libo Chen
[not found] ` <52A9A97F.20902-hv44wF8Li93QT0dZR+AlfA@public.gmane.org>
2013-12-18 9:12 ` Libo Chen
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).