OpenVZ Forum: Support » error with multiple containers using libipq and iptables QUEUE targets

Home » General » Support » error with multiple containers using libipq and iptables QUEUE targets (error message received by libipq when run inside two different containers that have iptables QUEUE targets)

Show: Today's Messages :: Show Polls :: Message Navigator
E-mail to friend

error with multiple containers using libipq and iptables QUEUE targets [message #36806]

Mon, 20 July 2009 23:38

jeffa
Messages: 8
Registered: September 2006

Junior Member

I have two running containers and in each I can insert an iptables rule such as:

iptables -t mangle -A PREROUTING -p icmp -j QUEUE

I have a sample program that uses libipq to fetch packets in userspace from the netfilter QUEUE target. Here is pseudo-code from that program:

raw_ip4_socket = socket(PF_INET, SOCK_RAW, IPPROTO_RAW);
h4 = ipq_create_handle(0, PF_INET);
err = ipq_set_mode(h4, IPQ_COPY_PACKET, BUFSIZE);
err = ipq_read(h4, buf, BUFSIZE, 0);
type = ipq_message_type(buf);
if (NLMSG_ERROR == type) {
   printf("received error message (%d): %s\n",
          ipq_get_msgerr(buf), ipq_errstr());
}

Now when I run this program on the first container, it works fine! I can get packets as expected into my userspace program, for example when I run ping.

However when I start the program on the second container, I receive netlink error messages from the kernel from ipq_read() (sample output is: "received error message (16): Unknown error"). Then I never receive any valid packets.

If I look at the iptables stats using "iptables -nvL -t mangle" the kernel says that the packets are hitting the QUEUE targets. Each machine shows correct packet counts. I am using 2.6.18-128.1.1.el5.028stab062.3. Any ideas?

Report message to a moderator