The commit is pushed to "branch-rh7-3.10.0-123.1.2-ovz" and will appear at
https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-123.1.2.vz7.5.3
------>
commit a90ad4e8ce17a95a7ba01f40ffd67f9db4f676bd
Author: Cyrill Gorcunov <[email protected]>
Date: Tue May 19 12:00:40 2015 +0400
ve: Add support of iptables mask
While working on running Docker on rhel7 kernel I found that we
don't have any interface to setup VE's iptables mask.
So here is a trivial one: new entry in ve/$ID cgroup as @ve.iptables_mask.
https://jira.sw.ru/browse/PSBM-32737
Signed-off-by: Cyrill Gorcunov <[email protected]>
CC: Vladimir Davydov <[email protected]>
CC: Konstantin Khorenko <[email protected]>
CC: Pavel Emelyanov <[email protected]>
CC: Andrey Vagin <[email protected]>
---
kernel/ve/ve.c | 30 ++++++++++++++++++++++++++++++
1 file changed, 30 insertions(+)
diff --git a/kernel/ve/ve.c b/kernel/ve/ve.c
index 42b1021..f4af6d2 100644
--- a/kernel/ve/ve.c
+++ b/kernel/ve/ve.c
@@ -1094,12 +1094,15 @@ enum {
VE_CF_STATE,
VE_CF_LEGACY_VEID,
VE_CF_FEATURES,
+ VE_CF_IPTABLES_MASK,
};
static u64 ve_read_u64(struct cgroup *cg, struct cftype *cft)
{
if (cft->private == VE_CF_FEATURES)
return cgroup_ve(cg)->features;
+ else if (cft->private == VE_CF_IPTABLES_MASK)
+ return cgroup_ve(cg)->ipt_mask;
return 0;
}
@@ -1110,6 +1113,26 @@ static int ve_write_u64(struct cgroup *cg, struct cftype
*cft, u64 value)
if (cft->private == VE_CF_FEATURES)
cgroup_ve(cg)->features = value;
+ else if (cft->private == VE_CF_IPTABLES_MASK) {
+ value &= ~VE_IP_IPTABLES6;
+ value &= ~VE_IP_FILTER6;
+ value &= ~VE_IP_MANGLE6;
+ value &= ~VE_IP_IPTABLE_NAT_MOD;
+ value &= ~VE_NF_CONNTRACK_MOD;
+
+ if (mask_ipt_allow(value, VE_IP_IPTABLES))
+ value |= VE_IP_IPTABLES6;
+ if (mask_ipt_allow(value, VE_IP_FILTER))
+ value |= VE_IP_FILTER6;
+ if (mask_ipt_allow(value, VE_IP_MANGLE))
+ value |= VE_IP_MANGLE6;
+ if (mask_ipt_allow(value, VE_IP_NAT))
+ value |= VE_IP_IPTABLE_NAT;
+ if (mask_ipt_allow(value, VE_IP_CONNTRACK))
+ value |= VE_NF_CONNTRACK;
+
+ cgroup_ve(cg)->ipt_mask = value;
+ }
return 0;
}
@@ -1147,6 +1170,13 @@ static struct cftype ve_cftypes[] = {
.read_seq_string = ve_os_release_read,
.write_string = ve_os_release_write,
},
+ {
+ .name = "iptables_mask",
+ .flags = CFTYPE_NOT_ON_ROOT,
+ .read_u64 = ve_read_u64,
+ .write_u64 = ve_write_u64,
+ .private = VE_CF_IPTABLES_MASK,
+ },
{ }
};
_______________________________________________
Devel mailing list
[email protected]
https://lists.openvz.org/mailman/listinfo/devel
