public inbox for netdev@vger.kernel.org 
 help / color / mirror / Atom feed

From: Daniel Wagner <wagi@monom•org>
To: Stephen Hemminger <shemminger@vyatta•com>
Cc: Chris Friesen <chris.friesen@genband•com>,
	"Eric W. Biederman" <ebiederm@xmission•com>,
	KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp•fujitsu.com>,
	Glauber Costa <glommer@parallels•com>,
	Linux Containers <containers@lists•osdl.org>,
	netdev@vger•kernel.org, David Miller <davem@davemloft•net>,
	Pavel Emelyanov <xemul@parallels•com>
Subject: Re: [RFC] per-containers tcp buffer limitation
Date: Thu, 25 Aug 2011 20:45:02 +0200	[thread overview]
Message-ID: <4E56982E.9090901@monom.org> (raw)
In-Reply-To: <4E569571.1080603@monom.org>

Hi Stephen,

> On 08/25/2011 05:44 PM, Stephen Hemminger wrote:
>> What about using netfilter (with extensions)? We already have iptables
>> module to match on uid or gid. It wouldn't be hard to extend this to
>> other bits of meta data like originating and target containers.
> 
> From reading the man pages the "owner" extension of netfilter would only
> allow to match on outgoing traffic. Would it be possible to extend this
> to also match on incoming traffic? Sorry to be completely ignorant here.

I just realized, that the "owner" extension is "only" matching on
UID/GID. For thing I would like to solve the match should be on PID.

IIRC the "owner" extension supported but this feature but it was removed [1]

thanks,
daniel

[1]
http://www.mail-archive.com/git-commits-head@vger.kernel.org/msg00486.html

next prev parent reply	other threads:[~2011-08-25 18:45 UTC|newest]

Thread overview: 16+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2011-08-24 22:54 [RFC] per-containers tcp buffer limitation Glauber Costa
2011-08-25  0:35 ` Eric W. Biederman
2011-08-25  1:28   ` Glauber Costa
2011-08-25  1:49     ` KAMEZAWA Hiroyuki
2011-08-25  2:16       ` Eric W. Biederman
     [not found]         ` <m14o16qlq1.fsf-+imSwln9KH6u2/kzUuoCbdi2O/JbrIOy@public.gmane.org>
2011-08-25 12:55           ` Daniel Wagner
2011-08-25 15:05             ` Chris Friesen
2011-08-25 15:44               ` Stephen Hemminger
2011-08-25 18:11                 ` Glauber Costa
2011-08-25 18:33                 ` Daniel Wagner
2011-08-25 18:45                   ` Daniel Wagner [this message]
2011-08-25 18:27               ` Daniel Wagner
     [not found]                 ` <4E56942A.3080905-kQCPcA+X3s7YtjvyW6yDsg@public.gmane.org>
2011-08-27 23:39                   ` Matthew Helsley
2011-08-28  6:09                     ` David Miller
2011-08-25 18:02         ` Glauber Costa
2011-08-25 18:05       ` Glauber Costa

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=4E56982E.9090901@monom.org \
    --to=wagi@monom$(echo .)org \
    --cc=chris.friesen@genband$(echo .)com \
    --cc=containers@lists$(echo .)osdl.org \
    --cc=davem@davemloft$(echo .)net \
    --cc=ebiederm@xmission$(echo .)com \
    --cc=glommer@parallels$(echo .)com \
    --cc=kamezawa.hiroyu@jp$(echo .)fujitsu.com \
    --cc=netdev@vger$(echo .)kernel.org \
    --cc=shemminger@vyatta$(echo .)com \
    --cc=xemul@parallels$(echo .)com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox