OpenVZ Forum - RDF feed
type: channel
items: [patch 00/12] net namespace : L3 namespace - introduction
items: [patch 01/12] net namespace : initialize init process to level 2
items: [patch 02/12] net namespace : store L2 parent namespace
items: [patch 03/12] net namespace : share network ressources L2 with L3
items: [patch 04/12] net namespace : isolate the inet device.
items: [patch 05/12] net namespace : ioctl to push ifa to net namespace l3
items: [patch 06/12] net namespace : check bind address
items: [patch 07/12] net namespace: set source addresse
items: [patch 08/12] net namespace : find namespace by addr
items: [patch 09/12] net namespace : make loopback address always visible
items: [patch 10/12] net namespace : add the loopback isolation
items: [patch 11/12] net namespace : debugfs - add net_ns debugfs
items: [patch 12/12] net namespace : Add broadcasting
items: Re: [patch 00/12] net namespace : L3 namespace - introduction
items: Re: [patch 05/12] net namespace : ioctl to push ifa to net namespace l3
items: Re: [patch 08/12] net namespace : find namespace by addr
items: Re: [patch 12/12] net namespace : Add broadcasting

[patch 00/12] net namespace : L3 namespace - introduction
type: item
description: This patchset provide a network isolation similar at what Linux-Vserver provides. It is based on the L2 namespaces and relies on the mechanisms provided by the namespace. This L3 namespaces does not aim to bring full virtualization for the network, it provides an IP isolation which can be reused for Linux-Vserver, jailed application or application containers. A L3 namespace are always L2 s' childs and they can not create more network namespaces, furthermore, they lose their NET_ADMIN capability. They share their parent's network ressources. From the parent namespace, IP addresses are created and assigned to the different L3 childs. From this point, L3 namespaces can use their assigned IP address and all computed broadcast addresses. Because the L3 namespace relies on the L2 virtualization mechanisms, it is possible to have several L3 namespaces listening on INADDR_ANY:port without conflict, that's allow to run several server without modifying the network configuration. The loopback is a shared device between all L3 namespaces. To ensure the 127.0.0.1 address isolation, the sender store its namespace into the packet, so when the packet arrives, the destination namespace is already set, because "source" == "destination". By this way, it is easy to disable the loopback isolation and let the application to talk with application outside of the namespace via the 127.0.0.1 because we consider them trusted (like portmap). The ifconfig / ip commands will only show IP addresses assigned to the L3 namespace. When a L3 namespace dies, the assigned IP address is released to its parent. At the IP level, when a packet arrives, the L3 network namespace destination is retrieved from the destination address. At the bind time, the address is checked against the assigned IP address. -- _______________________________________________ Containers mailing list Containers@lists.osdl.org https://lists.osdl.org/mailman/listinfo/containers
creator: Daniel Lezcano
date: 2007-01-19T15:47:14-00:00

[patch 01/12] net namespace : initialize init process to level 2
type: item
description: From: Daniel Lezcano <dlezcano@fr.ibm.com> Initialize the init's network namespace to level 2 Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com> --- net/core/net_namespace.c | 1 + 1 file changed, 1 insertion(+) Index: 2.6.20-rc4-mm1/net/core/net_namespace.c =================================================================== --- 2.6.20-rc4-mm1.orig/net/core/net_namespace.c +++ 2.6.20-rc4-mm1/net/core/net_namespace.c @@ -21,6 +21,7 @@ .dev_tail_p = &init_net_ns.dev_base_p, .loopback_dev_p = NULL, .pcpu_lstats_p = NULL, + .level = NET_NS_LEVEL2, }; #ifdef CONFIG_NET_NS -- _______________________________________________ Containers mailing list Containers@lists.osdl.org https://lists.osdl.org/mailman/listinfo/containers
creator: Daniel Lezcano
date: 2007-01-19T15:47:15-00:00

[patch 02/12] net namespace : store L2 parent namespace
type: item
description: From: Daniel Lezcano <dlezcano@fr.ibm.com> All L3 namespaces are the final nodes of the L2 namespaces tree. Because their share some ressources coming from the L2 namespace. The L2 parent namespace should be stored into the L3 child when it is created. Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com> --- include/linux/net_namespace.h | 1 + net/core/net_namespace.c | 11 +++++++++++ 2 files changed, 12 insertions(+) Index: 2.6.20-rc4-mm1/include/linux/net_namespace.h =================================================================== --- 2.6.20-rc4-mm1.orig/include/linux/net_namespace.h +++ 2.6.20-rc4-mm1/include/linux/net_namespace.h @@ -27,6 +27,7 @@ #define NET_NS_LEVEL2 1 #define NET_NS_LEVEL3 2 unsigned int level; + struct net_namespace *parent; }; extern struct net_namespace init_net_ns; Index: 2.6.20-rc4-mm1/net/core/net_namespace.c =================================================================== --- 2.6.20-rc4-mm1.orig/net/core/net_namespace.c +++ 2.6.20-rc4-mm1/net/core/net_namespace.c @@ -22,6 +22,7 @@ .loopback_dev_p = NULL, .pcpu_lstats_p = NULL, .level = NET_NS_LEVEL2, + .parent = NULL, }; #ifdef CONFIG_NET_NS @@ -62,6 +63,12 @@ if (ip_fib_struct_init()) goto out_fib4; } + + if (level == NET_NS_LEVEL3) { + get_net_ns(old_ns); + ns->parent = old_ns; + } + ns->level = level; if (loopback_init()) goto out_loopback; @@ -126,8 +133,12 @@ ns, atomic_read(&ns->kref.refcount)); return; } + if (ns->level == NET_NS_LEVEL2) ip_fib_struct_cleanup(ns); + if (ns->level == NET_NS_LEVEL3) + put_net_ns(ns->parent); + printk(KERN_DEBUG "NET_NS: net namespace %p destroyed\n", ns); kfree(ns); } -- _______________________________________________ Containers mailing list Containers@lists.osdl.org https://lists.osdl.org/mailman/listinfo/containers
creator: Daniel Lezcano
date: 2007-01-19T15:47:16-00:00

[patch 03/12] net namespace : share network ressources L2 with L3
type: item
description: From: Daniel Lezcano <dlezcano@fr.ibm.com> L3 namespace will use routes and devices belonging to its parent, so the old network namespace structure is copied when allocating a new one. By this way, hash value, dev list, routes are accessible from the L3 namespaces. In case of L2 namespace, these values are overwritten by the newly allocated values. Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com> --- include/linux/net_namespace.h | 14 ++++++++++++++ net/core/dev.c | 4 ++-- net/core/net_namespace.c | 33 ++++++++++++++++++--------------- 3 files changed, 34 insertions(+), 17 deletions(-) Index: 2.6.20-rc4-mm1/net/core/net_namespace.c =================================================================== --- 2.6.20-rc4-mm1.orig/net/core/net_namespace.c +++ 2.6.20-rc4-mm1/net/core/net_namespace.c @@ -37,7 +37,7 @@ * Return ERR_PTR on error, new ns otherwise */ static struct net_namespace *clone_net_ns(unsigned int level, - struct net_namespace *old_ns) + struct net_namespace *old_ns) { struct net_namespace *ns; @@ -45,23 +45,26 @@ if (current_net_ns->level == NET_NS_LEVEL3) return ERR_PTR(-EPERM); - ns = kzalloc(sizeof(struct net_namespace), GFP_KERNEL); + ns = kmemdup(old_ns, sizeof(struct net_namespace), GFP_KERNEL); if (!ns) return NULL; kref_init(&ns->kref); - ns->dev_base_p = NULL; - ns->dev_tail_p = &ns->dev_base_p; - ns->hash = net_random(); - if ((push_net_ns(ns)) != old_ns) + BUG(); if (level == NET_NS_LEVEL2) { + ns->dev_base_p = NULL; + ns->dev_tail_p = &ns->dev_base_p; + ns->hash = net_random(); + #ifdef CONFIG_IP_MULTIPLE_TABLES INIT_LIST_HEAD(&ns->fib_rules_ops_list); #endif if (ip_fib_struct_init()) goto out_fib4; + if (loopback_init()) + goto out_loopback; } if (level == NET_NS_LEVEL3) { @@ -70,8 +73,6 @@ } ns->level = level; - if (loopback_init()) - goto out_loopback; pop_net_ns(old_ns); printk(KERN_DEBUG "NET_NS: created new netcontext %p, level %u, " "for %s (pid=%d)\n", ns, (ns->level == NET_NS_LEVEL2) ? @@ -127,15 +128,17 @@ struct net_namespace *ns…
creator: Daniel Lezcano
date: 2007-01-19T15:47:17-00:00

[patch 04/12] net namespace : isolate the inet device.
type: item
description: From: Daniel Lezcano <dlezcano@fr.ibm.com> ip and ifconfig commands will not show ip addr not belonging to the current network namespace. Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com> --- include/linux/inetdevice.h | 1 + net/ipv4/devinet.c | 22 +++++++++++++++++++++- 2 files changed, 22 insertions(+), 1 deletion(-) Index: 2.6.20-rc4-mm1/include/linux/inetdevice.h =================================================================== --- 2.6.20-rc4-mm1.orig/include/linux/inetdevice.h +++ 2.6.20-rc4-mm1/include/linux/inetdevice.h @@ -99,6 +99,7 @@ unsigned char ifa_flags; unsigned char ifa_prefixlen; char ifa_label[IFNAMSIZ]; + struct net_namespace *ifa_net_ns; }; extern int register_inetaddr_notifier(struct notifier_block *nb); Index: 2.6.20-rc4-mm1/net/ipv4/devinet.c =================================================================== --- 2.6.20-rc4-mm1.orig/net/ipv4/devinet.c +++ 2.6.20-rc4-mm1/net/ipv4/devinet.c @@ -53,6 +53,7 @@ #include <linux/notifier.h> #include <linux/inetdevice.h> #include <linux/igmp.h> +#include <linux/net_namespace.h> #ifdef CONFIG_SYSCTL #include <linux/sysctl.h> #endif @@ -269,6 +270,7 @@ if (!(ifa->ifa_flags & IFA_F_SECONDARY) || ifa1->ifa_mask != ifa->ifa_mask || + !net_ns_match(ifa->ifa_net_ns, ifa1->ifa_net_ns) || !inet_ifa_match(ifa1->ifa_address, ifa)) { ifap1 = &ifa->ifa_next; prev_prom = ifa; @@ -471,6 +473,9 @@ for (ifap = &in_dev->ifa_list; (ifa = *ifap) != NULL; ifap = &ifa->ifa_next) { + if (!net_ns_match(ifa->ifa_net_ns, current_net_ns)) + continue; + if (tb[IFA_LOCAL] && ifa->ifa_local != nla_get_be32(tb[IFA_LOCAL])) continue; @@ -544,6 +549,7 @@ ifa->ifa_flags = ifm->ifa_flags; ifa->ifa_scope = ifm->ifa_scope; ifa->ifa_dev = in_dev; + ifa->ifa_net_ns = current_net_ns; ifa->ifa_local = nla_get_be32(tb[IFA_LOCAL]); ifa->ifa_address = nla_get_be32(tb[IFA_ADDRESS]); @@ -689,6 +695,8 @@ for (ifap = &in_dev->ifa_list; (ifa = *ifap) != NULL; ifap = &ifa->ifa_next) { if (!strcmp(ifr.ifr_name, ifa->ifa_label) && + net_ns_match(i…
creator: Daniel Lezcano
date: 2007-01-19T15:47:18-00:00

[patch 05/12] net namespace : ioctl to push ifa to net namespace l3
type: item
description: From: Daniel Lezcano <dlezcano@fr.ibm.com> New ioctl to "push" ifaddr to a container. Actually, the push is done from the current namespace, so the right word is "pull". That will be changed to move ifaddr from l2 network namespace to l3. Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com> --- include/linux/net_namespace.h | 7 ++ include/linux/sockios.h | 4 + net/core/net_namespace.c | 118 +++++++++++++++++++++++++++++++++++++++++- net/ipv4/af_inet.c | 4 + 4 files changed, 132 insertions(+), 1 deletion(-) Index: 2.6.20-rc4-mm1/include/linux/sockios.h =================================================================== --- 2.6.20-rc4-mm1.orig/include/linux/sockios.h +++ 2.6.20-rc4-mm1/include/linux/sockios.h @@ -122,6 +122,10 @@ #define SIOCBRADDIF 0x89a2 /* add interface to bridge */ #define SIOCBRDELIF 0x89a3 /* remove interface from bridge */ +/* Container calls */ +#define SIOCNETNSPUSHIF 0x89b0 /* add ifaddr to namespace */ +#define SIOCNETNSPULLIF 0x89b1 /* remove ifaddr to namespace */ + /* Device private ioctl calls */ /* Index: 2.6.20-rc4-mm1/net/ipv4/af_inet.c =================================================================== --- 2.6.20-rc4-mm1.orig/net/ipv4/af_inet.c +++ 2.6.20-rc4-mm1/net/ipv4/af_inet.c @@ -789,6 +789,10 @@ case SIOCSIFFLAGS: err = devinet_ioctl(cmd, (void __user *)arg); break; + case SIOCNETNSPUSHIF: + case SIOCNETNSPULLIF: + err = net_ns_ioctl(cmd, (void __user *)arg); + break; default: if (sk->sk_prot->ioctl) err = sk->sk_prot->ioctl(sk, cmd, arg); Index: 2.6.20-rc4-mm1/include/linux/net_namespace.h =================================================================== --- 2.6.20-rc4-mm1.orig/include/linux/net_namespace.h +++ 2.6.20-rc4-mm1/include/linux/net_namespace.h @@ -91,6 +91,8 @@ #define net_ns_hash(ns) ((ns)->hash) +extern int net_ns_ioctl(unsigned int cmd, void __user *arg); + #else /* CONFIG_NET_NS */ #define INIT_NET_NS(net_ns) @@ -141,6 +143,11 @@ #define net_ns_hash(ns) (0) +static inline int net_ns_ioctl(unsigned int cmd, v…
creator: Daniel Lezcano
date: 2007-01-19T15:47:19-00:00

[patch 06/12] net namespace : check bind address
type: item
description: From: Daniel Lezcano <dlezcano@fr.ibm.com> Check the bind address is allowed. It must match ifaddr assigned to the namespace and all derivative addresses. Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com> --- include/linux/net_namespace.h | 7 +++++ net/core/net_namespace.c | 54 ++++++++++++++++++++++++++++++++++++++++++ net/ipv4/af_inet.c | 2 + net/ipv4/raw.c | 3 ++ 4 files changed, 66 insertions(+) Index: 2.6.20-rc4-mm1/net/ipv4/af_inet.c =================================================================== --- 2.6.20-rc4-mm1.orig/net/ipv4/af_inet.c +++ 2.6.20-rc4-mm1/net/ipv4/af_inet.c @@ -433,6 +433,8 @@ * is temporarily down) */ err = -EADDRNOTAVAIL; + if (net_ns_check_bind(chk_addr_ret, addr->sin_addr.s_addr)) + goto out; if (!sysctl_ip_nonlocal_bind && !inet->freebind && addr->sin_addr.s_addr != INADDR_ANY && Index: 2.6.20-rc4-mm1/net/ipv4/raw.c =================================================================== --- 2.6.20-rc4-mm1.orig/net/ipv4/raw.c +++ 2.6.20-rc4-mm1/net/ipv4/raw.c @@ -559,7 +559,10 @@ if (sk->sk_state != TCP_CLOSE || addr_len < sizeof(struct sockaddr_in)) goto out; chk_addr_ret = inet_addr_type(addr->sin_addr.s_addr); + ret = -EADDRNOTAVAIL; + if (net_ns_check_bind(chk_addr_ret, addr->sin_addr.s_addr)) + goto out; if (addr->sin_addr.s_addr && chk_addr_ret != RTN_LOCAL && chk_addr_ret != RTN_MULTICAST && chk_addr_ret != RTN_BROADCAST) goto out; Index: 2.6.20-rc4-mm1/include/linux/net_namespace.h =================================================================== --- 2.6.20-rc4-mm1.orig/include/linux/net_namespace.h +++ 2.6.20-rc4-mm1/include/linux/net_namespace.h @@ -93,6 +93,8 @@ extern int net_ns_ioctl(unsigned int cmd, void __user *arg); +extern int net_ns_check_bind(int addr_type, u32 addr); + #else /* CONFIG_NET_NS */ #define INIT_NET_NS(net_ns) @@ -148,6 +150,11 @@ return -ENOSYS; } +static inline int net_ns_check_bind(int addr_type, u32 addr) +{ + return 0; +} + #endif /* !CONFIG_NET_NS */ #endif /* _LINUX_NET_NAMESPACE_H */ Index: 2.…
creator: Daniel Lezcano
date: 2007-01-19T15:47:20-00:00

[patch 07/12] net namespace: set source addresse
type: item
description: From: Daniel Lezcano <dlezcano@fr.ibm.com> When no source address is specified, search from the dev list the ifaddr allowed to be used as source address. Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com> --- include/linux/net_namespace.h | 14 ++++++++ net/core/net_namespace.c | 68 ++++++++++++++++++++++++++++++++++++++++++ net/ipv4/route.c | 28 +++++++++++------ 3 files changed, 100 insertions(+), 10 deletions(-) Index: 2.6.20-rc4-mm1/net/ipv4/route.c =================================================================== --- 2.6.20-rc4-mm1.orig/net/ipv4/route.c +++ 2.6.20-rc4-mm1/net/ipv4/route.c @@ -2475,17 +2475,17 @@ if (LOCAL_MCAST(oldflp->fl4_dst) || oldflp->fl4_dst == htonl(0xFFFFFFFF)) { if (!fl.fl4_src) - fl.fl4_src = inet_select_addr(dev_out, 0, - RT_SCOPE_LINK); + fl.fl4_src = SELECT_SRC_ADDR(dev_out, 0, + RT_SCOPE_LINK); goto make_route; } if (!fl.fl4_src) { if (MULTICAST(oldflp->fl4_dst)) - fl.fl4_src = inet_select_addr(dev_out, 0, - fl.fl4_scope); + fl.fl4_src = SELECT_SRC_ADDR(dev_out, 0, + fl.fl4_scope); else if (!oldflp->fl4_dst) - fl.fl4_src = inet_select_addr(dev_out, 0, - RT_SCOPE_HOST); + fl.fl4_src = SELECT_SRC_ADDR(dev_out, 0, + RT_SCOPE_HOST); } } @@ -2525,8 +2525,8 @@ */ if (fl.fl4_src == 0) - fl.fl4_src = inet_select_addr(dev_out, 0, - RT_SCOPE_LINK); + fl.fl4_src = SELECT_SRC_ADDR(dev_out, 0, + RT_SCOPE_LINK); res.type = RTN_UNICAST; goto make_route; } @@ -2539,7 +2539,13 @@ if (res.type == RTN_LOCAL) { if (!fl.fl4_src) +#ifdef CONFIG_NET_NS + fl.fl4_src = net_ns_select_source_address(dev_out, + fl.fl4_dst, + RT_SCOPE_LINK); +#else fl.fl4_src = fl.fl4_dst; +#endif if (dev_out) dev_put(dev_out); dev_out = &loopback_dev; @@ -2561,8 +2567,10 @@ fib_select_default(&fl, &res); if (!fl.fl4_src) - fl.fl4_src = FIB_RES_PREFSRC(res); - + fl.fl4_src = res.fi->fib_prefsrc ? : + SELECT_SRC_ADDR(FIB_RES_DEV(res), + FIB_RES_GW(res), + res.scope); if (dev_out) dev_put(dev_out); dev_out = FIB_RES_DEV(res); Index: 2.6.20-rc4-mm1/include/linux/net_namespace.h…
creator: Daniel Lezcano
date: 2007-01-19T15:47:21-00:00

[patch 08/12] net namespace : find namespace by addr
type: item
description: From: Daniel Lezcano <dlezcano@fr.ibm.com> Switch to the the l3 namespace using the destination address. Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com> --- include/linux/net_namespace.h | 7 +++++++ net/core/net_namespace.c | 35 +++++++++++++++++++++++++++++++++++ net/ipv4/ip_input.c | 16 +++++++++++++++- 3 files changed, 57 insertions(+), 1 deletion(-) Index: 2.6.20-rc4-mm1/net/ipv4/ip_input.c =================================================================== --- 2.6.20-rc4-mm1.orig/net/ipv4/ip_input.c +++ 2.6.20-rc4-mm1/net/ipv4/ip_input.c @@ -374,6 +374,9 @@ { struct iphdr *iph; u32 len; + int err; + struct net_namespace *net_ns = current_net_ns; + struct net_namespace *dst_net_ns = NULL; /* When the interface is in promisc. mode, drop all the crap * that it receives, do not try to analyse it. @@ -393,6 +396,9 @@ iph = skb->nh.iph; + dst_net_ns = net_ns_find_from_dest_addr(iph->daddr); + if (dst_net_ns && !net_ns_match(net_ns, dst_net_ns)) + push_net_ns(dst_net_ns); /* * RFC1122: 3.1.2.2 MUST silently discard any IP frame that fails the checksum. * @@ -431,10 +437,18 @@ /* Remove any debris in the socket control block */ memset(IPCB(skb), 0, sizeof(struct inet_skb_parm)); - return NF_HOOK(PF_INET, NF_IP_PRE_ROUTING, skb, dev, NULL, + err = NF_HOOK(PF_INET, NF_IP_PRE_ROUTING, skb, dev, NULL, ip_rcv_finish); + if (dst_net_ns && !net_ns_match(net_ns, dst_net_ns)) + pop_net_ns(net_ns); + + return err; + inhdr_error: + if (dst_net_ns && !net_ns_match(net_ns, dst_net_ns)) + pop_net_ns(net_ns); + IP_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS); drop: kfree_skb(skb); Index: 2.6.20-rc4-mm1/include/linux/net_namespace.h =================================================================== --- 2.6.20-rc4-mm1.orig/include/linux/net_namespace.h +++ 2.6.20-rc4-mm1/include/linux/net_namespace.h @@ -99,6 +99,8 @@ extern __be32 net_ns_select_source_address(const struct net_device *dev, u32 dst, int scope); +extern struct net_namespace *net_ns_find_from_dest_addr(u32 daddr); + #define…
creator: Daniel Lezcano
date: 2007-01-19T15:47:22-00:00

[patch 09/12] net namespace : make loopback address always visible
type: item
description: From: Daniel Lezcano <dlezcano@fr.ibm.com> Add a specific condition when doing inet interface listing in order to see always the loopback address. Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com> --- include/linux/net_namespace.h | 9 +++++++++ net/core/net_namespace.c | 22 ++++++++++++++++++++++ net/ipv4/devinet.c | 12 +++++------- 3 files changed, 36 insertions(+), 7 deletions(-) Index: 2.6.20-rc4-mm1/net/ipv4/devinet.c =================================================================== --- 2.6.20-rc4-mm1.orig/net/ipv4/devinet.c +++ 2.6.20-rc4-mm1/net/ipv4/devinet.c @@ -695,8 +695,7 @@ for (ifap = &in_dev->ifa_list; (ifa = *ifap) != NULL; ifap = &ifa->ifa_next) { if (!strcmp(ifr.ifr_name, ifa->ifa_label) && - net_ns_match(ifa->ifa_net_ns, - current_net_ns) && + net_ns_ifa_is_visible(ifa) && sin_orig.sin_addr.s_addr == ifa->ifa_address) { break; /* found */ @@ -710,13 +709,12 @@ for (ifap = &in_dev->ifa_list; (ifa = *ifap) != NULL; ifap = &ifa->ifa_next) if (!strcmp(ifr.ifr_name, ifa->ifa_label) && - net_ns_match(ifa->ifa_net_ns, - current_net_ns)) + net_ns_ifa_is_visible(ifa)) break; } } - if (ifa && !net_ns_match(ifa->ifa_net_ns, current_net_ns)) + if (ifa && !net_ns_ifa_is_visible(ifa)) goto done; ret = -EADDRNOTAVAIL; @@ -868,7 +866,7 @@ goto out; for (; ifa; ifa = ifa->ifa_next) { - if (!net_ns_match(ifa->ifa_net_ns, current_net_ns)) + if (!net_ns_ifa_is_visible(ifa)) continue; if (!buf) { done += sizeof(ifr); @@ -1216,7 +1214,7 @@ for (ifa = in_dev->ifa_list, ip_idx = 0; ifa; ifa = ifa->ifa_next, ip_idx++) { - if (!net_ns_match(ifa->ifa_net_ns, current_net_ns)) + if (!net_ns_ifa_is_visible(ifa)) continue; if (ip_idx < s_ip_idx) continue; Index: 2.6.20-rc4-mm1/include/linux/net_namespace.h =================================================================== --- 2.6.20-rc4-mm1.orig/include/linux/net_namespace.h +++ 2.6.20-rc4-mm1/include/linux/net_namespace.h @@ -7,6 +7,8 @@ #include <linux/errno.h> #include <linux/types.h> +struct in_ifaddr; + struct net_name…
creator: Daniel Lezcano
date: 2007-01-19T15:47:23-00:00

[patch 10/12] net namespace : add the loopback isolation
type: item
description: From: Daniel Lezcano <dlezcano@fr.ibm.com> When a packet is outgoing, the namespace source is stored into the skbuff. Because it is the loopback address, the source == destination, so when the packet is incoming, it has already the namespace destination set into the packet. Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com> --- include/linux/net_namespace.h | 13 +++++++++++-- include/linux/skbuff.h | 5 ++++- net/core/net_namespace.c | 32 +++++++++++++++++++++++++++----- net/ipv4/ip_input.c | 2 +- net/ipv4/ip_output.c | 1 + 5 files changed, 44 insertions(+), 9 deletions(-) Index: 2.6.20-rc4-mm1/include/linux/skbuff.h =================================================================== --- 2.6.20-rc4-mm1.orig/include/linux/skbuff.h +++ 2.6.20-rc4-mm1/include/linux/skbuff.h @@ -225,6 +225,7 @@ * @dma_cookie: a cookie to one of several possible DMA operations * done by skb DMA functions * @secmark: security marking + * @net_ns: namespace destination */ struct sk_buff { @@ -309,7 +310,9 @@ #ifdef CONFIG_NETWORK_SECMARK __u32 secmark; #endif - +#ifdef CONFIG_NET_NS + struct net_namespace *net_ns; +#endif __u32 mark; /* These elements must be at the end, see alloc_skb() for details. */ Index: 2.6.20-rc4-mm1/net/ipv4/ip_input.c =================================================================== --- 2.6.20-rc4-mm1.orig/net/ipv4/ip_input.c +++ 2.6.20-rc4-mm1/net/ipv4/ip_input.c @@ -396,7 +396,7 @@ iph = skb->nh.iph; - dst_net_ns = net_ns_find_from_dest_addr(iph->daddr); + dst_net_ns = net_ns_find_from_dest_addr(skb); if (dst_net_ns && !net_ns_match(net_ns, dst_net_ns)) push_net_ns(dst_net_ns); /* Index: 2.6.20-rc4-mm1/net/ipv4/ip_output.c =================================================================== --- 2.6.20-rc4-mm1.orig/net/ipv4/ip_output.c +++ 2.6.20-rc4-mm1/net/ipv4/ip_output.c @@ -272,6 +272,7 @@ IP_INC_STATS(IPSTATS_MIB_OUTREQUESTS); + net_ns_tag_sk_buff(skb); skb->dev = dev; skb->protocol = htons(ETH_P_IP); Index: 2.6.20-rc4-mm1/include/linux/net_namespace.h ===…
creator: Daniel Lezcano
date: 2007-01-19T15:47:24-00:00

[patch 11/12] net namespace : debugfs - add net_ns debugfs
type: item
description: From: Daniel Lezcano <dlezcano@fr.ibm.com> For debug purpose only, this is not intended to be included. Add /sys/kernel/debug/net_ns. Creation of network namespace: echo <level> > /sys/kernel/debug/net_ns/start Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com> --- fs/debugfs/Makefile | 2 fs/debugfs/net_ns.c | 335 ++++++++++++++++++++++++++++++++++++++++++++++++++++ net/Kconfig | 4 3 files changed, 340 insertions(+), 1 deletion(-) Index: 2.6.20-rc4-mm1/fs/debugfs/Makefile =================================================================== --- 2.6.20-rc4-mm1.orig/fs/debugfs/Makefile +++ 2.6.20-rc4-mm1/fs/debugfs/Makefile @@ -1,4 +1,4 @@ debugfs-objs := inode.o file.o obj-$(CONFIG_DEBUG_FS) += debugfs.o - +obj-$(CONFIG_NET_NS_DEBUG) += net_ns.o Index: 2.6.20-rc4-mm1/fs/debugfs/net_ns.c =================================================================== --- /dev/null +++ 2.6.20-rc4-mm1/fs/debugfs/net_ns.c @@ -0,0 +1,335 @@ +/* + * net_ns.c - adds a net_ns/ directory to debug NET namespaces + * + * Author: Daniel Lezcano <dlezcano@fr.ibm.com> + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License as + * published by the Free Software Foundation, version 2 of the + * License. + */ + +#include <linux/module.h> +#include <linux/kernel.h> +#include <linux/pagemap.h> +#include <linux/debugfs.h> +#include <linux/sched.h> +#include <linux/netdevice.h> +#include <linux/inetdevice.h> +#include <linux/syscalls.h> +#include <linux/net_namespace.h> +#include <linux/rtnetlink.h> + +static struct dentry *net_ns_dentry; +static struct dentry *net_ns_dentry_dev; +static struct dentry *net_ns_dentry_start; +static struct dentry *net_ns_dentry_info; + +static ssize_t net_ns_dev_read_file(struct file *file, char __user *user_buf, + size_t count, loff_t *ppos) +{ + return 0; +} + +static ssize_t net_ns_dev_write_file(struct file *file, + const char __user *user_buf, + size_t count, loff_t *ppos) +{ + return 0; …
creator: Daniel Lezcano
date: 2007-01-19T15:47:25-00:00

[patch 12/12] net namespace : Add broadcasting
type: item
description: From: Daniel Lezcano <dlezcano@fr.ibm.com> Broadcast packets should be delivered to l2 and all l3 childs Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com> --- include/linux/net_namespace.h | 11 +++++++++++ net/core/net_namespace.c | 27 +++++++++++++++++++++++++++ net/ipv4/udp.c | 3 ++- 3 files changed, 40 insertions(+), 1 deletion(-) Index: 2.6.20-rc4-mm1/include/linux/net_namespace.h =================================================================== --- 2.6.20-rc4-mm1.orig/include/linux/net_namespace.h +++ 2.6.20-rc4-mm1/include/linux/net_namespace.h @@ -9,6 +9,7 @@ struct in_ifaddr; struct sk_buff; +struct sock; struct net_namespace { struct kref kref; @@ -109,6 +110,9 @@ extern void net_ns_tag_sk_buff(struct sk_buff *skb); +extern int net_ns_sock_is_visible(const struct sock *sk, + const struct net_namespace *net_ns); + #define SELECT_SRC_ADDR net_ns_select_source_address #else /* CONFIG_NET_NS */ @@ -192,6 +196,13 @@ { ; } + +static inline int net_ns_sock_is_visible(const struct sock *sk, + const struct net_namespace *net_ns) +{ + return 1; +} + #define SELECT_SRC_ADDR inet_select_addr #endif /* !CONFIG_NET_NS */ Index: 2.6.20-rc4-mm1/net/core/net_namespace.c =================================================================== --- 2.6.20-rc4-mm1.orig/net/core/net_namespace.c +++ 2.6.20-rc4-mm1/net/core/net_namespace.c @@ -17,6 +17,7 @@ #include <linux/ip.h> #include <net/ip_fib.h> +#include <net/sock.h> struct net_namespace init_net_ns = { .kref = { @@ -464,4 +465,30 @@ struct net_namespace *net_ns = current_net_ns; skb->net_ns = net_ns; } + +/* + * This function checks if the socket is visible from the specified + * namespace. This is needed to ensure the broadcast and the multicast + * for multiple network namespace l2 and l3 to have the packets to be + * delivered. If we have a l3 namespace and its parent (l2 namespace) + * listening on a broadcast address, we should deliver the packet to + * both. That is done by the udp_v4_mcast_next function. But we shou…
creator: Daniel Lezcano
date: 2007-01-19T15:47:26-00:00

Re: [patch 00/12] net namespace : L3 namespace - introduction
type: item
description: On Fri, Jan 19, 2007 at 04:47:14PM +0100, dlezcano@fr.ibm.com wrote: > This patchset provide a network isolation similar at what > Linux-Vserver provides. It is based on the L2 namespaces and relies on > the mechanisms provided by the namespace. This L3 namespaces does not > aim to bring full virtualization for the network, it provides an IP > isolation which can be reused for Linux-Vserver, jailed application or > application containers. > > A L3 namespace are always L2 s' childs and they can not create more > network namespaces, furthermore, they lose their NET_ADMIN > capability. They share their parent's network ressources. From the > parent namespace, IP addresses are created and assigned to the > different L3 childs. From this point, L3 namespaces can use their > assigned IP address and all computed broadcast addresses. ~~~~~~~~~~~~~~~~~~~ okay, I conclude that this only handles a single address for now. what are your plans to handle entire sets? TIA, Herbert > Because the L3 namespace relies on the L2 virtualization mechanisms, > it is possible to have several L3 namespaces listening on > INADDR_ANY:port without conflict, that's allow to run several server > without modifying the network configuration. > > The loopback is a shared device between all L3 namespaces. To ensure > the 127.0.0.1 address isolation, the sender store its namespace into > the packet, so when the packet arrives, the destination namespace is > already set, because "source" == "destination". By this way, it is > easy to disable the loopback isolation and let the application to talk > with application outside of the namespace via the 127.0.0.1 because we > consider them trusted (like portmap). > > The ifconfig / ip commands will only show IP addresses assigned to the > L3 namespace. When a L3 namespace dies, the assigned IP address is > released to its parent. > > At the IP level, when a packet arrives, the L3 network namespace > destination is retrieved from the destination address. > > A…
creator: Herbert Poetzl
date: 2007-01-20T04:48:12-00:00

Re: [patch 05/12] net namespace : ioctl to push ifa to net namespace l3
type: item
description: On Fri, Jan 19, 2007 at 04:47:19PM +0100, dlezcano@fr.ibm.com wrote: > From: Daniel Lezcano <dlezcano@fr.ibm.com> > > New ioctl to "push" ifaddr to a container. Actually, the push is done > from the current namespace, so the right word is "pull". That will be > changed to move ifaddr from l2 network namespace to l3. > > Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com> > > --- > include/linux/net_namespace.h | 7 ++ > include/linux/sockios.h | 4 + > net/core/net_namespace.c | 118 +++++++++++++++++++++++++++++++++++++++++- > net/ipv4/af_inet.c | 4 + > 4 files changed, 132 insertions(+), 1 deletion(-) > > Index: 2.6.20-rc4-mm1/include/linux/sockios.h > =================================================================== > --- 2.6.20-rc4-mm1.orig/include/linux/sockios.h > +++ 2.6.20-rc4-mm1/include/linux/sockios.h > @@ -122,6 +122,10 @@ > #define SIOCBRADDIF 0x89a2 /* add interface to bridge */ > #define SIOCBRDELIF 0x89a3 /* remove interface from bridge */ > > +/* Container calls */ > +#define SIOCNETNSPUSHIF 0x89b0 /* add ifaddr to namespace */ > +#define SIOCNETNSPULLIF 0x89b1 /* remove ifaddr to namespace */ ~~~ from > + > /* Device private ioctl calls */ > > /* > Index: 2.6.20-rc4-mm1/net/ipv4/af_inet.c > =================================================================== > --- 2.6.20-rc4-mm1.orig/net/ipv4/af_inet.c > +++ 2.6.20-rc4-mm1/net/ipv4/af_inet.c > @@ -789,6 +789,10 @@ > case SIOCSIFFLAGS: > err = devinet_ioctl(cmd, (void __user *)arg); > break; > + case SIOCNETNSPUSHIF: > + case SIOCNETNSPULLIF: > + err = net_ns_ioctl(cmd, (void __user *)arg); > + break; > default: > if (sk->sk_prot->ioctl) > err = sk->sk_prot->ioctl(sk, cmd, arg); > Index: 2.6.20-rc4-mm1/include/linux/net_namespace.h > =================================================================== > --- 2.6.20-rc4-mm1.orig/include/linux/net_namespace.h > +++ 2.6.20-rc4-mm1/include/linux/net_namespace.h > @@ -91,6 +91,8 @@ > > #define net_ns_hash(ns) ((ns)->hash) > > +extern int net_ns_ioctl(unsigne…
creator: Herbert Poetzl
date: 2007-01-20T04:52:34-00:00

Re: [patch 08/12] net namespace : find namespace by addr
type: item
description: On Fri, Jan 19, 2007 at 04:47:22PM +0100, dlezcano@fr.ibm.com wrote: > From: Daniel Lezcano <dlezcano@fr.ibm.com> > > Switch to the the l3 namespace using the destination address. > > Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com> > > --- > include/linux/net_namespace.h | 7 +++++++ > net/core/net_namespace.c | 35 +++++++++++++++++++++++++++++++++++ > net/ipv4/ip_input.c | 16 +++++++++++++++- > 3 files changed, 57 insertions(+), 1 deletion(-) > > Index: 2.6.20-rc4-mm1/net/ipv4/ip_input.c > =================================================================== > --- 2.6.20-rc4-mm1.orig/net/ipv4/ip_input.c > +++ 2.6.20-rc4-mm1/net/ipv4/ip_input.c > @@ -374,6 +374,9 @@ > { > struct iphdr *iph; > u32 len; > + int err; > + struct net_namespace *net_ns = current_net_ns; > + struct net_namespace *dst_net_ns = NULL; > > /* When the interface is in promisc. mode, drop all the crap > * that it receives, do not try to analyse it. > @@ -393,6 +396,9 @@ > > iph = skb->nh.iph; > > + dst_net_ns = net_ns_find_from_dest_addr(iph->daddr); > + if (dst_net_ns && !net_ns_match(net_ns, dst_net_ns)) > + push_net_ns(dst_net_ns); > /* > * RFC1122: 3.1.2.2 MUST silently discard any IP frame that fails the checksum. > * > @@ -431,10 +437,18 @@ > /* Remove any debris in the socket control block */ > memset(IPCB(skb), 0, sizeof(struct inet_skb_parm)); > > - return NF_HOOK(PF_INET, NF_IP_PRE_ROUTING, skb, dev, NULL, > + err = NF_HOOK(PF_INET, NF_IP_PRE_ROUTING, skb, dev, NULL, > ip_rcv_finish); > > + if (dst_net_ns && !net_ns_match(net_ns, dst_net_ns)) > + pop_net_ns(net_ns); > + > + return err; > + > inhdr_error: > + if (dst_net_ns && !net_ns_match(net_ns, dst_net_ns)) > + pop_net_ns(net_ns); > + > IP_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS); > drop: > kfree_skb(skb); > Index: 2.6.20-rc4-mm1/include/linux/net_namespace.h > =================================================================== > --- 2.6.20-rc4-mm1.orig/include/linux/net_namespace.h > +++ 2.6.20-rc4-mm1/include/linux/net_namespace.h >…
creator: Herbert Poetzl
date: 2007-01-20T04:56:13-00:00

Re: [patch 12/12] net namespace : Add broadcasting
type: item
description: On Fri, Jan 19, 2007 at 04:47:26PM +0100, dlezcano@fr.ibm.com wrote: > From: Daniel Lezcano <dlezcano@fr.ibm.com> > > Broadcast packets should be delivered to l2 and all l3 childs hmm, really? shouldn't it only reach those which actually have related addresses assigned? best, Herbert > Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com> > > --- > include/linux/net_namespace.h | 11 +++++++++++ > net/core/net_namespace.c | 27 +++++++++++++++++++++++++++ > net/ipv4/udp.c | 3 ++- > 3 files changed, 40 insertions(+), 1 deletion(-) > > Index: 2.6.20-rc4-mm1/include/linux/net_namespace.h > =================================================================== > --- 2.6.20-rc4-mm1.orig/include/linux/net_namespace.h > +++ 2.6.20-rc4-mm1/include/linux/net_namespace.h > @@ -9,6 +9,7 @@ > > struct in_ifaddr; > struct sk_buff; > +struct sock; > > struct net_namespace { > struct kref kref; > @@ -109,6 +110,9 @@ > > extern void net_ns_tag_sk_buff(struct sk_buff *skb); > > +extern int net_ns_sock_is_visible(const struct sock *sk, > + const struct net_namespace *net_ns); > + > #define SELECT_SRC_ADDR net_ns_select_source_address > > #else /* CONFIG_NET_NS */ > @@ -192,6 +196,13 @@ > { > ; > } > + > +static inline int net_ns_sock_is_visible(const struct sock *sk, > + const struct net_namespace *net_ns) > +{ > + return 1; > +} > + > #define SELECT_SRC_ADDR inet_select_addr > > #endif /* !CONFIG_NET_NS */ > Index: 2.6.20-rc4-mm1/net/core/net_namespace.c > =================================================================== > --- 2.6.20-rc4-mm1.orig/net/core/net_namespace.c > +++ 2.6.20-rc4-mm1/net/core/net_namespace.c > @@ -17,6 +17,7 @@ > #include <linux/ip.h> > > #include <net/ip_fib.h> > +#include <net/sock.h> > > struct net_namespace init_net_ns = { > .kref = { > @@ -464,4 +465,30 @@ > struct net_namespace *net_ns = current_net_ns; > skb->net_ns = net_ns; > } > + > +/* > + * This function checks if the socket is visible from the specified > + * namespace. This is needed to ensure the b…
creator: Herbert Poetzl
date: 2007-01-20T04:58:37-00:00

Re: [patch 00/12] net namespace : L3 namespace - introduction
type: item
description: Herbert Poetzl wrote: > On Fri, Jan 19, 2007 at 04:47:14PM +0100, dlezcano@fr.ibm.com wrote: >> This patchset provide a network isolation similar at what >> Linux-Vserver provides. It is based on the L2 namespaces and relies on >> the mechanisms provided by the namespace. This L3 namespaces does not >> aim to bring full virtualization for the network, it provides an IP >> isolation which can be reused for Linux-Vserver, jailed application or >> application containers. >> >> A L3 namespace are always L2 s' childs and they can not create more >> network namespaces, furthermore, they lose their NET_ADMIN >> capability. They share their parent's network ressources. From the >> parent namespace, IP addresses are created and assigned to the >> different L3 childs. From this point, L3 namespaces can use their >> assigned IP address and all computed broadcast addresses. > ~~~~~~~~~~~~~~~~~~~ > > okay, I conclude that this only handles a single address > for now. what are your plans to handle entire sets? > You can assign more than one IP address to a L3 network namespace. _______________________________________________ Containers mailing list Containers@lists.osdl.org https://lists.osdl.org/mailman/listinfo/containers
creator: Daniel Lezcano
date: 2007-01-20T11:42:45-00:00

Re: [patch 05/12] net namespace : ioctl to push ifa to net namespace l3
type: item
description: Herbert Poetzl wrote: > On Fri, Jan 19, 2007 at 04:47:19PM +0100, dlezcano@fr.ibm.com wrote: >> From: Daniel Lezcano <dlezcano@fr.ibm.com> >> >> New ioctl to "push" ifaddr to a container. Actually, the push is done >> from the current namespace, so the right word is "pull". That will be >> changed to move ifaddr from l2 network namespace to l3. >> >> Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com> >> [ ... ] >> + * namespace to his l2 network namespace parent. > > hmm, sounds like the address is moved between the > namespaces? does that mean that the 'parent' will > not see the 'isolated' ip anymore? Yes, exact. If the IP address is visible into several namespaces (L2 parent and L3 child), nothing ensures the two will not use the IP address. _______________________________________________ Containers mailing list Containers@lists.osdl.org https://lists.osdl.org/mailman/listinfo/containers
creator: Daniel Lezcano
date: 2007-01-20T11:48:27-00:00

Re: [patch 12/12] net namespace : Add broadcasting
type: item
description: Herbert Poetzl wrote: > On Fri, Jan 19, 2007 at 04:47:26PM +0100, dlezcano@fr.ibm.com wrote: >> From: Daniel Lezcano <dlezcano@fr.ibm.com> >> >> Broadcast packets should be delivered to l2 and all l3 childs > > hmm, really? shouldn't it only reach those which > actually have related addresses assigned? Yes right but this is what happens, My sentence is incomplete. "broadcast packets should be delivered to l2 and all l3 childs having sockets listening for this broadcast address" Thanks. _______________________________________________ Containers mailing list Containers@lists.osdl.org https://lists.osdl.org/mailman/listinfo/containers
creator: Daniel Lezcano
date: 2007-01-20T11:54:33-00:00