^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) =========================
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) Network classifier cgroup
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) =========================
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) The Network classifier cgroup provides an interface to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6) tag network packets with a class identifier (classid).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8) The Traffic Controller (tc) can be used to assign
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9) different priorities to packets from different cgroups.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10) Also, Netfilter (iptables) can use this tag to perform
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) actions on such packets.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) Creating a net_cls cgroups instance creates a net_cls.classid file.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14) This net_cls.classid value is initialized to 0.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16) You can write hexadecimal values to net_cls.classid; the format for these
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) values is 0xAAAABBBB; AAAA is the major handle number and BBBB
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) is the minor handle number.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) Reading net_cls.classid yields a decimal result.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) Example::
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) mkdir /sys/fs/cgroup/net_cls
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) mount -t cgroup -onet_cls net_cls /sys/fs/cgroup/net_cls
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) mkdir /sys/fs/cgroup/net_cls/0
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) echo 0x100001 > /sys/fs/cgroup/net_cls/0/net_cls.classid
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28) - setting a 10:1 handle::
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) cat /sys/fs/cgroup/net_cls/0/net_cls.classid
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) 1048577
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) - configuring tc::
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) tc qdisc add dev eth0 root handle 10: htb
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) tc class add dev eth0 parent 10: classid 10:1 htb rate 40mbit
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) - creating traffic class 10:1::
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) tc filter add dev eth0 parent 10: protocol ip prio 10 handle 1: cgroup
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) configuring iptables, basic example::
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) iptables -A OUTPUT -m cgroup ! --cgroup 0x100001 -j DROP