linux-kernel - Re: [RFC] [PATCH] cgroup: limit network bandwidth

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <47976FE9.5030600@users.sourceforge.net>
Date:	Wed, 23 Jan 2008 17:48:41 +0100 (MET)
From:	Andrea Righi <righiandr@...rs.sourceforge.net>
To:	Andrea Righi <righiandr@...rs.sourceforge.net>,
	Naveen Gupta <ngupta@...gle.com>,
	Paul Menage <menage@...gle.com>,
	LKML <linux-kernel@...r.kernel.org>,
	David Miller <davem@...emloft.net>
Subject: Re: [RFC] [PATCH] cgroup: limit network bandwidth

Balbir Singh wrote:
> * Andrea Righi <righiandr@...rs.sourceforge.net> [2008-01-23 10:09:28]:
> 
>> Allow to limit the network bandwidth for specific process containers (cgroups)
>> imposing additional delays in the sockets' sendmsg()/recvmsg() calls made by
>> those processes that exceed the limits defined in the control group filesystem.
>>
>> Example:
>>   # mkdir /dev/cgroup
>>   # mount -t cgroup -onet net /dev/cgroup
>>   # cd /dev/cgroup
>>   # mkdir foo
>>   --> the cgroup foo has been created
>>   # /bin/echo $$ > foo/tasks
>>   # /bin/echo 1024 > foo/net.tcp
>>   # /bin/echo 2048 > foo/net.tot
>>   # sh
>>   --> the subshell 'sh' is running in cgroup "foo" that has a maximum network
>>       bandwidth for TCP traffic of 1MB/s and 2MB/s for total network
>>       activities.
>>
>> The netlimit approach can be easily extended to support additional network
>> protocols or different socket families or types (PF_UNIX, PF_BLUETOOTH,
>> SOCK_SEQPACKET, etc.).
>>
>> Signed-off-by: Andrea Righi <a.righi@...eca.it>
> 
> Hi, Andrea,
> 
> I took a quick look at the patches and it looks like we throttle
> network (by forcing a schedule_timeout()), if we exceed our bandwidth
> limit. That is one way of doing it, but it has some disadvantages, it
> does not scale to 
> 
> 1. Implementation of soft limits (limit on contention of resource)
>    gets harder

Why? do you mean implementing a grace time when the soft-limit is
exceeded? this could be done in cgroup_nl_throttle() introducing 3 
additional attributes to struct netlimit (i.e. hard_limit,
last_time_exceeded grace_time) and perform something like:
...
	if ((current_rate > hard_limit) ||
	    time_after(jiffies, last_time_exceeded + grace_time))
			schedule_timeout(sleep);
...

> 2. Why dont use the existing infrastructure for bandwidth limitation
>    for implementing the network controller?
> 

Yes, the integration with iptables (as Paul said), and traffic shaping
rules would be absolutely the right way(tm) in perspective. I was just
proposing a possible simple API to implement the limiting stuff.

-Andrea
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/