OpenVZ Forum - RDF feed
type: channel
items: [RFC PATCH 0/31] An introduction and A path for merging network namespace work
items: [PATCH RFC 1/31] net: Add net_namespace_type.h to allow for per network namespace variables.
items: [PATCH RFC 2/31] net: Implement a place holder network namespace
items: [PATCH RFC 3/31] net: Add a network namespace parameter to tasks
items: [PATCH RFC 4/31] net: Add a network namespace tag to struct net_device
items: [PATCH RFC 5/31] net: Add a network namespace parameter to struct sock
items: [PATCH RFC 6/31] net: Add a helper to get a reference to the initial network namespace.
items: [PATCH RFC 7/31] net: Make /proc/net per network namespace
items: [PATCH RFC 8/31] net: Make /sys/class/net handle multiple network namespaces
items: [PATCH RFC 9/31] net: Implement the per network namespace sysctl infrastructure
items: [PATCH RFC 10/31] net: Make socket creation namespace safe.
items: [PATCH RFC 11/31] net: Initialize the network namespace of network devices.
items: [PATCH RFC 12/31] net: Make packet reception network namespace safe
items: [PATCH RFC 13/31] net: Make device event notification network namespace safe
items: [PATCH RFC 14/31] net: Support multiple network namespaces with netlink
items: [PATCH RFC 15/31] net: Make the loopback device per network namespace
items: [PATCH RFC 16/31] net: Make the device list and device lookups per namespace.
items: [PATCH RFC 17/31] net: Factor out __dev_alloc_name from dev_alloc_name
items: [PATCH RFC 18/31] net: Implment network device movement between namespaces
items: [PATCH RFC 19/31] net: sysfs interface support for moving devices between network namespaces.
items: [PATCH RFC 20/31] net: Implement CONFIG_NET_NS
items: [PATCH RFC 21/31] net: Implement the guts of the network namespace infrastructure
items: [PATCH RFC 22/31] net: Add network namespace clone support.
items: [PATCH RFC 23/31] net: Modify all rtnetlink methods to only work in the initial namespace
items: [PATCH RFC 24/31] net: Make rtnetlink network namespace aware
items: [PATCH RFC 25/31] net: Make wireless netlink event generation handle multiple network namespaces
items: [PATCH RFC 26/31] net: Make the netlink methods in rtnetlink handle multiple network namespaces
items: [PATCH RFC 27/31] net: Make the xfrm sysctls per network namespace.
items: [PATCH RFC 28/31] net: Make the SOMAXCONN sysctl per network namespace
items: [PATCH RFC 29/31] net: Make AF_PACKET handle multiple network namespaces
items: [PATCH RFC 30/31] net: Make AF_UNIX per network namespace safe.
items: [PATCH RFC 31/31] net: Add etun driver
items: Re: [PATCH RFC 1/31] net: Add net_namespace_type.h to allow for per network namespace variables.
items: Re: [PATCH RFC 18/31] net: Implment network device movement between namespaces
items: Re: [PATCH RFC 22/31] net: Add network namespace clone support.
items: Re: [RFC PATCH 0/31] An introduction and A path for merging network namespace work
items: Re: [PATCH RFC 17/31] net: Factor out __dev_alloc_name from dev_alloc_name

[RFC PATCH 0/31] An introduction and A path for merging network namespace work
type: item
description: The idea of a network namespace is fundamentally quite simple. We create a mechanism that from the users perspective allows creation of separate instances of the network stack. When combined with mechanism like chroot this results in a much more complete isolation. When seen in the context of application migration this allows for taking your IP address and other global identifiers with you. What does this mean in the context of the networking stack? The basic idea is to tag processes with a network namespace that is used when they create new sockets or otherwise initiate a new fresh communication with the networking stack. The idea is to tag all sockets with a network namespace they will always be in and all operations on them will be relative to. The idea is to tag all network devices with a network namespace they are a member of, but may be changed during the lifetime of a device. Mostly a network namespace at it's most basic level is about names. It is about creating a view of the networking stack where you can name the network devices that are members anything you want. Likewise for iptables rules and all of the rest of the state. It is a lot like creating a new directory in a filesystem. The underlying data structures don't really change just the users view of those data structures, and we continue to have a single network stack. My goal today is that even if we can't agree on a specific set of patches that we come to an agreement on roughly what those patches should accomplish, and what process we should go through to get them merged. For implementing a network namespace the core problem is that there is a lot of networking code, and it is continually evolving. This means that the task of implementing a network namespace is not a small one, a lot of code must be read, touched and updated, while hoping someone doesn't change something important before you get your changes in. To do this sanely means we need an incremental path to our goal, that allows small pie…
creator: ebiederm
date: 2007-01-25T18:55:04-00:00

[PATCH RFC 1/31] net: Add net_namespace_type.h to allow for per network namespace variables.
type: item
description: The problem: To properly implement a ``level 2'' network namespace we need to move many of the networking stack global variables into the network namespace. We want to keep it explicit that the code is accessing a variable in a network namespace. We want to be able to completely compile out the network namespace support so we can do comparitive performance testing, and so to not penalize users who don't need network namespace support. Because the network stack is a moving target we want something simple that allows for the bulk of the changes to be merged before we enable network namespace support. My biggest challenge when looking into this was to find an approach that would allow the code to compile out, in a way that does not yield any performance overhead and does not make the code ugly. While playing with the different possibilities I discovered that gcc will not pass 0 byte structures that are arguments to functions and instead will simply optmize them away. This appears to be true on i386 all of the way back to gcc-2.95 and I verified that it also works with gcc 4.1 on x86_64. Since this is part of the ABI I never expect it to change. Hopefully gcc uses this nice optimization on all architectures, I suspect so as C++ allows passing function arguments of type void in certain circumstances. Using this observation I was able to come up with an network namespace implementation network namespace code that allows the changes to completely compile out when we don't build the kernel with network namespace support. This patch implements my dummy network namespace support that should completely compiles out. Further patches will add the real version. Starting with the dummy gives a quick hint of where I am going and allows for dependencies to be overcome. When doing my proof of concept implementation one of the other problems I had was that as the network stack comes in so many modular pieces figuring out how to get their global variables into the network namespace str…
creator: ebiederm
date: 2007-01-25T19:00:03-00:00

[PATCH RFC 2/31] net: Implement a place holder network namespace
type: item
description: From: Eric W. Biederman <ebiederm@xmission.com> - unquoted Many of the changes to the network stack will simply be adding a network namespace parameter to function calls or moving variables from globals to being per network namespace. When those variables have initializers that cannot statically compute the proper value, a function that runs at the creation and destruction of network namespaces will need to be registered, and the logic will need to be changed to accomidate that. Adding unconditional support for these functions ensures that even when everything else is compiled out the modified network stack logic will continue to run correctly. This patch adds struct pernet_operations that has an init (constructor) and an exit (destructor) method. When registered the init method is called for every existing namespace, and when unregistered the exit method is called for every existing namespace. When a new network namespace is created all of the init methods are called in the order in which they were registered, and when a network namespace is destroyed the exit methods are called in the reverse order in which they were registered. There are two distinct types of pernet_operations recognized: subsys and device. At creation all subsys init functions are called before device init functions, and at destruction all device exit functions are called before subsys exit function. For other ordering the preservation of the order of registration combined with the various kinds of kernel initcalls should be sufficient. Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> --- include/net/net_namespace.h | 62 ++++++++++++++++++ net/core/Makefile | 2 +- net/core/net_namespace.c | 149 +++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 212 insertions(+), 1 deletions(-) diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h new file mode 100644 index 0000000..06a9ba1 --- /dev/null +++ b/include/net/net_namespace.h @@ -0,0 +1,62 @@ +/* + * Operations on t…
creator: ebiederm
date: 2007-01-25T19:00:04-00:00

[PATCH RFC 3/31] net: Add a network namespace parameter to tasks
type: item
description: From: Eric W. Biederman <ebiederm@xmission.com> - unquoted This is the network namespace from which all which all sockets and anything else under user control ultimately get their network namespace parameters. Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> --- include/linux/nsproxy.h | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) diff --git a/include/linux/nsproxy.h b/include/linux/nsproxy.h index 0b9f0dc..cc76610 100644 --- a/include/linux/nsproxy.h +++ b/include/linux/nsproxy.h @@ -3,6 +3,7 @@ #include <linux/spinlock.h> #include <linux/sched.h> +#include <linux/net_namespace_type.h> struct mnt_namespace; struct uts_namespace; @@ -28,6 +29,7 @@ struct nsproxy { struct ipc_namespace *ipc_ns; struct mnt_namespace *mnt_ns; struct pid_namespace *pid_ns; + net_t net_ns; }; extern struct nsproxy init_nsproxy; -- 1.4.4.1.g278f _______________________________________________ Containers mailing list Containers@lists.osdl.org https://lists.osdl.org/mailman/listinfo/containers
creator: ebiederm
date: 2007-01-25T19:00:05-00:00

[PATCH RFC 4/31] net: Add a network namespace tag to struct net_device
type: item
description: From: Eric W. Biederman <ebiederm@xmission.com> - unquoted Please note that network devices do not increase the count count on the network namespace. The are inside the network namespace and so the network namespace tag is in the nature of a back pointer and so getting and putting the network namespace is unnecessary. Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> --- include/linux/netdevice.h | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h index 4cb8b39..6a1579d 100644 --- a/include/linux/netdevice.h +++ b/include/linux/netdevice.h @@ -38,6 +38,7 @@ #include <linux/device.h> #include <linux/percpu.h> #include <linux/dmaengine.h> +#include <linux/net_namespace_type.h> struct vlan_group; struct ethtool_ops; @@ -525,6 +526,9 @@ struct net_device void (*poll_controller)(struct net_device *dev); #endif + /* Network namespace this network device is inside */ + net_t nd_net; + /* bridge stuff */ struct net_bridge_port *br_port; -- 1.4.4.1.g278f _______________________________________________ Containers mailing list Containers@lists.osdl.org https://lists.osdl.org/mailman/listinfo/containers
creator: ebiederm
date: 2007-01-25T19:00:06-00:00

[PATCH RFC 5/31] net: Add a network namespace parameter to struct sock
type: item
description: From: Eric W. Biederman <ebiederm@xmission.com> - unquoted Sockets need to get a reference to their network namespace, or possibly a simple hold if someone registers on the network namespace notifier and will free the sockets when the namespace is going to be destroyed. Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> --- include/net/inet_timewait_sock.h | 1 + include/net/sock.h | 3 +++ 2 files changed, 4 insertions(+), 0 deletions(-) diff --git a/include/net/inet_timewait_sock.h b/include/net/inet_timewait_sock.h index f7be1ac..162c2b9 100644 --- a/include/net/inet_timewait_sock.h +++ b/include/net/inet_timewait_sock.h @@ -115,6 +115,7 @@ struct inet_timewait_sock { #define tw_refcnt __tw_common.skc_refcnt #define tw_hash __tw_common.skc_hash #define tw_prot __tw_common.skc_prot +#define tw_net __tw_common.skc_net volatile unsigned char tw_substate; /* 3 bits hole, try to pack */ unsigned char tw_rcv_wscale; diff --git a/include/net/sock.h b/include/net/sock.h index 03684e7..5bf6bb5 100644 --- a/include/net/sock.h +++ b/include/net/sock.h @@ -105,6 +105,7 @@ struct proto; * @skc_refcnt: reference count * @skc_hash: hash value used with various protocol lookup tables * @skc_prot: protocol handlers inside a network family + * @skc_net: reference to the network namespace of this socket * * This is the minimal network layer representation of sockets, the header * for struct sock and struct inet_timewait_sock. @@ -119,6 +120,7 @@ struct sock_common { atomic_t skc_refcnt; unsigned int skc_hash; struct proto *skc_prot; + net_t skc_net; }; /** @@ -195,6 +197,7 @@ struct sock { #define sk_refcnt __sk_common.skc_refcnt #define sk_hash __sk_common.skc_hash #define sk_prot __sk_common.skc_prot +#define sk_net __sk_common.skc_net unsigned char sk_shutdown : 2, sk_no_check : 2, sk_userlocks : 4; -- 1.4.4.1.g278f _______________________________________________ Containers mailing list Containers@lists.osdl.org https://lists.osdl.org/mailman/listinfo/containers
creator: ebiederm
date: 2007-01-25T19:00:07-00:00

[PATCH RFC 6/31] net: Add a helper to get a reference to the initial network namespace.
type: item
description: From: Eric W. Biederman <ebiederm@xmission.com> - unquoted The initial network namespace is special and we need to use it for various things. Probably the biggest initial use will be to ensure code that can't cope with multiple namespaces only sees the initial network namespace. For that reason and because getting at the initial network namespace is just a little clumsy add a helper function. Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> --- include/net/net_namespace.h | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h index 06a9ba1..9208e2e 100644 --- a/include/net/net_namespace.h +++ b/include/net/net_namespace.h @@ -27,6 +27,12 @@ struct net_namespace_head { struct work_struct work; }; +/* Get the initial network namespace */ +static inline net_t init_net(void) +{ + return init_nsproxy.net_ns; +} + static inline net_t get_net(net_t net) { return net; } static inline void put_net(net_t net) {} static inline net_t hold_net(net_t net) { return net; } -- 1.4.4.1.g278f _______________________________________________ Containers mailing list Containers@lists.osdl.org https://lists.osdl.org/mailman/listinfo/containers
creator: ebiederm
date: 2007-01-25T19:00:08-00:00

[PATCH RFC 7/31] net: Make /proc/net per network namespace
type: item
description: From: Eric W. Biederman <ebiederm@xmission.com> - unquoted This patch makes /proc/net per network namespace. It modifies the global variables proc_net and proc_net_stat to be per network namespace. The proc_net file helpers are modified to take a network namespace argument, and all of their callers are fixed to pass init_net() for that argument. This ensures that all of the /proc/net files are only visible and usable in the initial network namespace until the code behind them has bee updated to be handle multiple network namespaces. Making /proc/net per namespace is necessary as at least some files in /proc/net depend upon the set of network devices which is per network namespace, and even more files in /proc/net have contents that are relevant to a single network namespace. Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> --- drivers/isdn/divert/divert_procfs.c | 7 +- drivers/isdn/hardware/eicon/diva_didd.c | 5 +- drivers/isdn/hysdn/hysdn_procconf.c | 4 +- drivers/net/bonding/bond_main.c | 7 +- drivers/net/hamradio/bpqether.c | 5 +- drivers/net/hamradio/scc.c | 4 +- drivers/net/hamradio/yam.c | 5 +- drivers/net/ibmveth.c | 6 +- drivers/net/pppoe.c | 5 +- drivers/net/tc35815.c | 1 - drivers/net/tokenring/lanstreamer.c | 4 +- drivers/net/tokenring/olympic.c | 9 +- drivers/net/wireless/hostap/hostap_main.c | 7 +- drivers/net/wireless/strip.c | 5 +- fs/proc/Makefile | 1 + fs/proc/internal.h | 5 + fs/proc/proc_net.c | 126 ++++++++++++++++++++ fs/proc/root.c | 8 +- include/linux/proc_fs.h | 28 +++-- include/net/net_namespace.h | 11 ++ net/802/tr.c | 3 +- net/8021q/vlanproc.c | 5 +- net/appletalk/atalk_proc.c | 7 +- net/atm/proc.c | 5 +- net/ax25/af_ax25.c | 13 +- net/core/dev.c | 9 +- net/core/dev_mcast.c | 3 +- net/core/neighbour.c | 3 +- net/core/pktgen.c | 9 +- net/core/sock.c | 3 +- net/core/wireless.c | 3 +- net/dccp/probe.c | 7 +- net/decnet/af_decnet.c | 5 +- net/decnet/dn_dev.c | 5 +- net/decnet/dn_neigh.c | 5 +- net/decnet/dn_route.c | 5 +- net/ieee80211…
creator: ebiederm
date: 2007-01-25T19:00:09-00:00

[PATCH RFC 8/31] net: Make /sys/class/net handle multiple network namespaces
type: item
description: From: Eric W. Biederman <ebiederm@xmission.com> - unquoted In combination with the sysfs support I am in the process of merging with gregkh, creates a separate instance of the /sys/class/net directory for each network namespace so two devices with the same name do not conflict. Then a network namespace sensitive follow link method on the /sys/class/net directory ensures that you see the directory instance for your current network namespace. Ensuring all existing applications continue to see what we is currently present in sysfs. Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> --- net/core/net-sysfs.c | 53 +++++++++++++++++++++++++++++++++++++++++++++++++- 1 files changed, 52 insertions(+), 1 deletions(-) diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c index 5d08cc9..b08c1be 100644 --- a/net/core/net-sysfs.c +++ b/net/core/net-sysfs.c @@ -11,12 +11,14 @@ #include <linux/capability.h> #include <linux/kernel.h> +#include <linux/sysfs.h> #include <linux/netdevice.h> #include <linux/if_arp.h> #include <net/sock.h> #include <linux/rtnetlink.h> #include <linux/wireless.h> #include <net/iw_handler.h> +#include <net/net_namespace.h> #define to_class_dev(obj) container_of(obj,struct class_device,kobj) #define to_net_dev(class) container_of(class, struct net_device, class_dev) @@ -431,6 +433,24 @@ static void netdev_release(struct class_device *cd) kfree((char *)dev - dev->padded); } +static DEFINE_PER_NET(struct dentry *, net_shadow) = NULL; + +static struct dentry *net_class_device_dparent(struct class_device *cd) +{ + struct net_device *dev + = container_of(cd, struct net_device, class_dev); + net_t net = dev->nd_net; + + return per_net(net_shadow, net); +} + +static void *class_net_follow_link(struct dentry *dentry, struct nameidata *nd) +{ + dput(nd->dentry); + nd->dentry = dget(per_net(net_shadow, current->nsproxy->net_ns)); + return NULL; +} + static struct class net_class = { .name = "net", .release = netdev_release, @@ -438,6 +458,8 @@ static struct …
creator: ebiederm
date: 2007-01-25T19:00:10-00:00

[PATCH RFC 9/31] net: Implement the per network namespace sysctl infrastructure
type: item
description: From: Eric W. Biederman <ebiederm@xmission.com> - unquoted The user interface is: register_net_sysctl_table and unregister_net_sysctl_table. Very much like the current interface except there is an network namespace parameter. This this any sysctl in the net_root_table and it's subdirectories are registered with register_net_sysctl shows up only to tasks in the same network namespace. All other sysctls continue to be globally visible. Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> --- include/linux/sysctl.h | 7 ++++ include/net/sock.h | 1 + kernel/sysctl.c | 71 ++++++++++++++++++++++++++++++++++++++++++- net/core/sysctl_net_core.c | 5 +++ net/sysctl_net.c | 20 ++++++++++++ 5 files changed, 102 insertions(+), 2 deletions(-) diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h index 8eba2d2..286e723 100644 --- a/include/linux/sysctl.h +++ b/include/linux/sysctl.h @@ -1044,6 +1044,13 @@ struct ctl_table_header * register_sysctl_table(ctl_table * table); void unregister_sysctl_table(struct ctl_table_header * table); +#ifdef CONFIG_NET +#include <linux/net_namespace_type.h> +extern struct ctl_table_header *register_net_sysctl_table(net_t net, struct ctl_table *table); +extern void unregister_net_sysctl_table(struct ctl_table_header *header); +DECLARE_PER_NET(struct ctl_table, net_root_table[]); +#endif + #else /* __KERNEL__ */ #endif /* __KERNEL__ */ diff --git a/include/net/sock.h b/include/net/sock.h index 5bf6bb5..01a2781 100644 --- a/include/net/sock.h +++ b/include/net/sock.h @@ -1414,6 +1414,7 @@ extern void sk_init(void); #ifdef CONFIG_SYSCTL extern struct ctl_table core_table[]; +DECLARE_PER_NET(struct ctl_table, multi_core_table[]); #endif extern int sysctl_optmem_max; diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 7da313e..ae6a424 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -45,6 +45,7 @@ #include <linux/syscalls.h> #include <linux/nfs_fs.h> #include <linux/acpi.h> +#include <net/net_namespace.h> #include <asm/uaccess.h> #includ…
creator: ebiederm
date: 2007-01-25T19:00:11-00:00

[PATCH RFC 10/31] net: Make socket creation namespace safe.
type: item
description: From: Eric W. Biederman <ebiederm@xmission.com> - unquoted This patch passes in the namespace a new socket should be created in and has the socket code do the appropriate reference counting. By virtue of this all socket create methods are touched. In addition the socket create methods are modified so that they will fail if you attempt to create a socket in a non-default network namespace. Failing if we attempt to create a socket outside of the default socket namespace ensures that as we incrementally make the network stack network namespace aware we will not export functionality that someone has not audited and made certain is network namespace safe. Allowing us to partially enable network namespaces before all of the exotic protocols are supported. Any protocol layers I have missed will fail to compile because I now pass an extra parameter into the socket creation code. Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> --- drivers/net/pppoe.c | 4 ++-- drivers/net/pppox.c | 7 +++++-- include/linux/if_pppox.h | 2 +- include/linux/net.h | 3 ++- include/net/llc_conn.h | 2 +- include/net/sock.h | 4 +++- net/appletalk/ddp.c | 7 +++++-- net/atm/common.c | 4 ++-- net/atm/common.h | 2 +- net/atm/pvc.c | 7 +++++-- net/atm/svc.c | 11 +++++++---- net/ax25/af_ax25.c | 9 ++++++--- net/bluetooth/af_bluetooth.c | 7 +++++-- net/bluetooth/bnep/sock.c | 4 ++-- net/bluetooth/cmtp/sock.c | 4 ++-- net/bluetooth/hci_sock.c | 4 ++-- net/bluetooth/hidp/sock.c | 4 ++-- net/bluetooth/l2cap.c | 10 +++++----- net/bluetooth/rfcomm/sock.c | 10 +++++----- net/bluetooth/sco.c | 10 +++++----- net/core/sock.c | 6 ++++-- net/decnet/af_decnet.c | 13 ++++++++----- net/econet/af_econet.c | 7 +++++-- net/ipv4/af_inet.c | 7 +++++-- net/ipv6/af_inet6.c | 7 +++++-- net/ipx/af_ipx.c | 7 +++++-- net/irda/af_irda.c | 11 +++++++---- net/key/af_key.c | 7 +++++-- net/llc/af_llc.c | 7 +++++-- net/llc/llc_conn.c | 6 +++--- net/netlink/af_netlink.c | 13 ++++++++----- net/netrom/af_netrom.c | 9 ++++++--- net/p…
creator: ebiederm
date: 2007-01-25T19:00:12-00:00

[PATCH RFC 11/31] net: Initialize the network namespace of network devices.
type: item
description: From: Eric W. Biederman <ebiederm@xmission.com> - unquoted Except for carefully selected pseudo devices all network interfaces should start out in the initial network namespace. Ultimately it will be register_netdev that examines what dev->nd_net is set to and places a device in a network namespace. This patch modifies alloc_netdev to initialize the network namespace a device is in with the initial network namespace. This gets it right for the vast majority of devices so their drivers need not be modified and for those few pseudo devices that need something different they can change this parameter before calling register_netdevice. The network namespace parameter on a network device is not reference counted as the devices are inside of a network namespace and cannot remain in that namespace past the lifetime of the network namespace. Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> --- drivers/net/loopback.c | 1 + net/core/dev.c | 1 + 2 files changed, 2 insertions(+), 0 deletions(-) diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c index 2b739fd..22b672d 100644 --- a/drivers/net/loopback.c +++ b/drivers/net/loopback.c @@ -231,6 +231,7 @@ struct net_device loopback_dev = { /* Setup and register the loopback device. */ static int __init loopback_init(void) { + loopback_dev.nd_net = init_net(); return register_netdev(&loopback_dev); }; diff --git a/net/core/dev.c b/net/core/dev.c index 90e4c0e..a3ee150 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -3192,6 +3192,7 @@ struct net_device *alloc_netdev(int sizeof_priv, const char *name, dev = (struct net_device *) (((long)p + NETDEV_ALIGN_CONST) & ~NETDEV_ALIGN_CONST); dev->padded = (char *)dev - (char *)p; + dev->nd_net = init_net(); if (sizeof_priv) dev->priv = netdev_priv(dev); -- 1.4.4.1.g278f _______________________________________________ Containers mailing list Containers@lists.osdl.org https://lists.osdl.org/mailman/listinfo/containers
creator: ebiederm
date: 2007-01-25T19:00:13-00:00

[PATCH RFC 12/31] net: Make packet reception network namespace safe
type: item
description: From: Eric W. Biederman <ebiederm@xmission.com> - unquoted This patch modifies every packet receive function registered with dev_add_pack() to drop packets if they are not from the initial network namespace, in addition to ensure consistency of argument passing the unnecessary device parameter is removed. This should ensure that the various network stacks do not receive packets in a anything but the initial network namespace until the code has been converted and is ready for them. Anything I may have missed will generate a compiler error, as the function protype has changed, preventing us from overlooking something by accident. Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> --- drivers/block/aoe/aoenet.c | 7 ++++++- drivers/net/bonding/bond_3ad.c | 7 ++++++- drivers/net/bonding/bond_3ad.h | 2 +- drivers/net/bonding/bond_alb.c | 6 +++++- drivers/net/bonding/bond_main.c | 6 +++++- drivers/net/hamradio/bpqether.c | 8 ++++++-- drivers/net/pppoe.c | 8 ++++++-- drivers/net/wan/hdlc.c | 10 +++++++++- drivers/net/wan/lapbether.c | 6 +++++- drivers/net/wan/syncppp.c | 14 ++++++++++---- include/linux/netdevice.h | 1 - include/net/ax25.h | 2 +- include/net/datalink.h | 2 +- include/net/ip.h | 2 +- include/net/ipv6.h | 1 - include/net/llc.h | 4 +--- include/net/p8022.h | 1 - include/net/psnap.h | 2 +- include/net/x25.h | 2 +- net/802/p8022.c | 1 - net/802/psnap.c | 5 ++--- net/8021q/vlan.h | 2 +- net/8021q/vlan_dev.c | 8 +++++++- net/appletalk/aarp.c | 6 +++++- net/appletalk/ddp.c | 15 ++++++++++++--- net/ax25/ax25_in.c | 8 +++++++- net/bridge/br_private.h | 2 +- net/bridge/br_stp_bpdu.c | 8 ++++++-- net/core/dev.c | 6 +++--- net/decnet/af_decnet.c | 2 +- net/decnet/dn_route.c | 6 +++++- net/econet/af_econet.c | 6 +++++- net/ipv4/arp.c | 6 +++++- net/ipv4/ip_input.c | 7 +++++-- net/ipv4/ipconfig.c | 16 ++++++++++++---- net/ipv6/ip6_input.c | 8 +++++++- net/ipx/af_ipx.c | 6 +++++- net/irda/irlap_frame.c | 7 +++++-- net/irda/irmod.c | 2 +- net/llc/llc_core.c | 1 - net/l…
creator: ebiederm
date: 2007-01-25T19:00:14-00:00

[PATCH RFC 13/31] net: Make device event notification network namespace safe
type: item
description: From: Eric W. Biederman <ebiederm@xmission.com> - unquoted Every user of the network device notifiers is either a protocol stack or a pseudo device. If a protocol stack that does not have support for multiple network namespaces receives an event for a device that is not in the initial network namespace it quite possibly can get confused and do the wrong thing. To avoid problems until all of the protocol stacks are converted this patch modifies all netdev event handlers to ignore events on devices that are not in the initial network namespace. As the rest of the code is made network namespace aware these checks can be removed. Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> --- arch/ia64/hp/sim/simeth.c | 3 +++ drivers/net/bonding/bond_main.c | 3 +++ drivers/net/hamradio/bpqether.c | 3 +++ drivers/net/pppoe.c | 3 +++ drivers/net/wan/dlci.c | 3 +++ drivers/net/wan/hdlc.c | 3 +++ drivers/net/wan/lapbether.c | 3 +++ net/8021q/vlan.c | 4 ++++ net/appletalk/aarp.c | 3 +++ net/appletalk/ddp.c | 3 +++ net/atm/clip.c | 3 +++ net/atm/mpc.c | 4 ++++ net/ax25/af_ax25.c | 3 +++ net/bridge/br_notify.c | 4 ++++ net/core/dst.c | 4 ++++ net/core/fib_rules.c | 4 ++++ net/core/pktgen.c | 3 +++ net/core/rtnetlink.c | 4 ++++ net/decnet/af_decnet.c | 3 +++ net/econet/af_econet.c | 3 +++ net/ipv4/arp.c | 3 +++ net/ipv4/devinet.c | 3 +++ net/ipv4/fib_frontend.c | 3 +++ net/ipv4/ipmr.c | 7 ++++++- net/ipv4/multipath_drr.c | 3 +++ net/ipv4/netfilter/ip_queue.c | 3 +++ net/ipv4/netfilter/ipt_MASQUERADE.c | 3 +++ net/ipv6/addrconf.c | 3 +++ net/ipv6/ndisc.c | 3 +++ net/ipv6/netfilter/ip6_queue.c | 3 +++ net/ipx/af_ipx.c | 3 +++ net/netfilter/nfnetlink_queue.c | 3 +++ net/netrom/af_netrom.c | 3 +++ net/packet/af_packet.c | 3 +++ net/rose/af_rose.c | 3 +++ net/tipc/eth_media.c | 3 +++ net/wanrouter/af_wanpipe.c | 3 +++ net/x25/af_x25.c | 3 +++ net/xfrm/xfrm_policy.c | 5 +++++ security/selinux/netif.c | 3 +++ 40 files changed, 131 insertions(+), 1 deletions(-) diff --git a/arch/ia64/hp/s…
creator: ebiederm
date: 2007-01-25T19:00:15-00:00

[PATCH RFC 14/31] net: Support multiple network namespaces with netlink
type: item
description: From: Eric W. Biederman <ebiederm@xmission.com> - unquoted Each netlink socket will live in exactly one network namespace, this includes the controlling kernel sockets. This patch updates all of the existing netlink protocols to only support the initial network namespace. Request by clients in other namespaces will get -ECONREFUSED. As they would if the kernel did not have the support for that netlink protocol compiled in. As each netlink protocol is updated to be multiple network namespace safe it can register multiple kernel sockets to acquire a presence in the rest of the network namespaces. The implementation in af_netlink is a simple filter implemenation at hash table insertion and hash table look up time. Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> --- drivers/scsi/scsi_netlink.c | 2 +- drivers/scsi/scsi_transport_iscsi.c | 2 +- include/linux/netlink.h | 3 +- kernel/audit.c | 4 +- lib/kobject_uevent.c | 4 +- net/bridge/netfilter/ebt_ulog.c | 5 +- net/core/rtnetlink.c | 4 +- net/decnet/netfilter/dn_rtmsg.c | 3 +- net/ipv4/fib_frontend.c | 3 +- net/ipv4/inet_diag.c | 4 +- net/ipv4/netfilter/ip_queue.c | 6 +- net/ipv4/netfilter/ipt_ULOG.c | 4 +- net/ipv6/netfilter/ip6_queue.c | 4 +- net/netfilter/nfnetlink.c | 2 +- net/netfilter/nfnetlink_log.c | 3 +- net/netfilter/nfnetlink_queue.c | 3 +- net/netlink/af_netlink.c | 104 ++++++++++++++++++++++++++--------- net/netlink/genetlink.c | 4 +- net/xfrm/xfrm_user.c | 2 +- 19 files changed, 112 insertions(+), 54 deletions(-) diff --git a/drivers/scsi/scsi_netlink.c b/drivers/scsi/scsi_netlink.c index 1b59b27..02c2c1e 100644 --- a/drivers/scsi/scsi_netlink.c +++ b/drivers/scsi/scsi_netlink.c @@ -167,7 +167,7 @@ scsi_netlink_init(void) return; } - scsi_nl_sock = netlink_kernel_create(NETLINK_SCSITRANSPORT, + scsi_nl_sock = netlink_kernel_create(init_net(), NETLINK_SCSITRANSPORT, SCSI_NL_GRP_CNT, scsi_nl_rcv, THIS_MODULE); if (!scsi_nl_sock) { printk(KERN_ERR "%s: register of recieve handler failed\n", diff --git…
creator: ebiederm
date: 2007-01-25T19:00:16-00:00

[PATCH RFC 15/31] net: Make the loopback device per network namespace
type: item
description: From: Eric W. Biederman <ebiederm@xmission.com> - unquoted This patch makes the loopback_dev per network namespace. The loopback device registers itself as a pernet_device so we can register the new loopback_dev instance when we add a new network namespace and so we can unregister the loopback device when we destory the network namespace. Currently the loopback device statitics are kept accross all loopback devices, a minor glitch that will not affect correct operation but something we may want to fix. This patch modifies all users the loopback_dev so they access it as per_net(loopback_dev, init_net()), keeping all of the code compiling and working. A later pass will be needed to update the users to use something other than the initial network namespace. The only non-trivial modification was the ipv6 code in route.c as the loopback_dev can no longer be used in static initializers, and even that change was very simple. Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> --- drivers/net/loopback.c | 24 ++++++++++++++++++++---- include/linux/netdevice.h | 2 +- net/core/dst.c | 8 ++++---- net/decnet/dn_dev.c | 4 ++-- net/decnet/dn_route.c | 14 +++++++------- net/ipv4/devinet.c | 4 ++-- net/ipv4/ipconfig.c | 8 +++++--- net/ipv4/ipvs/ip_vs_core.c | 2 +- net/ipv4/route.c | 18 +++++++++--------- net/ipv4/xfrm4_policy.c | 2 +- net/ipv6/addrconf.c | 8 ++++---- net/ipv6/netfilter/ip6t_REJECT.c | 2 +- net/ipv6/route.c | 24 +++++++++++++++--------- net/ipv6/xfrm6_policy.c | 2 +- net/xfrm/xfrm_policy.c | 4 ++-- 15 files changed, 75 insertions(+), 51 deletions(-) diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c index 22b672d..e9abf3f 100644 --- a/drivers/net/loopback.c +++ b/drivers/net/loopback.c @@ -57,6 +57,7 @@ #include <linux/ip.h> #include <linux/tcp.h> #include <linux/percpu.h> +#include <net/net_namespace.h> struct pcpu_lstats { unsigned long packets; @@ -204,7 +205,7 @@ static const struct ethtool_ops loopback_ethtool_ops = { * The loopback device is spec…
creator: ebiederm
date: 2007-01-25T19:00:17-00:00

[PATCH RFC 16/31] net: Make the device list and device lookups per namespace.
type: item
description: From: Eric W. Biederman <ebiederm@xmission.com> - unquoted This patch makes most of the generic device layer network namespace safe. This patch makes dev_base, dev_base_lock per network namespace variables, and then it picks up a few associated variables. The funnctions: dev_getbyhwaddr dev_getfirsthwbytype dev_get_by_flags dev_get_by_name __dev_get_by_name dev_get_by_index __dev_get_by_index dev_ioctl dev_ethtool dev_load wireless_process_ioctl were modified to take a network namespace argument, and deal with it. vlan_ioctl_set and brioctl_set were modified so their hooks will receive a network namespace argument. So basically anthing in the core of the network stack that was affected to by the change of dev_base and dev_base_lock was modified to handle multiple network namespaces. The rest of the network stack was simply modified to explicitly use init_net() the initial network namespace. This can be fixed when those components of the network stack are modified to handle multiple network namespaces. For now the ifindex generator is left global. Fundametally ifindex numbers are per namespace, or else we will have corner case problems with migration when we get that far. At the same time there are assumptions in the network stack that the ifindex of a network device won't change. Making the ifindex number global seems a good compromise until the network stack can cope with ifindex changes when you change namespaces, and the like. Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> --- arch/s390/appldata/appldata_net_sum.c | 6 +- arch/sparc64/solaris/ioctl.c | 6 +- drivers/atm/idt77252.c | 2 +- drivers/block/aoe/aoecmd.c | 7 +- drivers/net/bonding/bond_main.c | 6 +- drivers/net/bonding/bond_sysfs.c | 3 +- drivers/net/eql.c | 9 +- drivers/net/pppoe.c | 2 +- drivers/net/shaper.c | 3 +- drivers/net/tun.c | 3 +- drivers/net/wan/dlci.c | 4 +- drivers/net/wan/sbni.c | 2 +- drivers/net/wireless/strip.c | 8 +- drivers/parisc/led.c | 6 +- include/linux/if_bridge.h | 2 +-…
creator: ebiederm
date: 2007-01-25T19:00:18-00:00

[PATCH RFC 17/31] net: Factor out __dev_alloc_name from dev_alloc_name
type: item
description: From: Eric W. Biederman <ebiederm@xmission.com> - unquoted When forcibly changing the network namespace of a device I need something that can generate a name for the device in the new namespace without overwriting the old name. __dev_alloc_name provides me that functionality. Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> --- net/core/dev.c | 44 +++++++++++++++++++++++++++++++++----------- 1 files changed, 33 insertions(+), 11 deletions(-) diff --git a/net/core/dev.c b/net/core/dev.c index 32fe905..fc0d2af 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -655,9 +655,10 @@ int dev_valid_name(const char *name) } /** - * dev_alloc_name - allocate a name for a device - * @dev: device + * __dev_alloc_name - allocate a name for a device + * @net: network namespace to allocate the device name in * @name: name format string + * @buf: scratch buffer and result name string * * Passed a format string - eg "lt%d" it will try and find a suitable * id. It scans list of devices to build up a free map, then chooses @@ -668,18 +669,13 @@ int dev_valid_name(const char *name) * Returns the number of the unit assigned or a negative errno code. */ -int dev_alloc_name(struct net_device *dev, const char *name) +static int __dev_alloc_name(net_t net, const char *name, char buf[IFNAMSIZ]) { int i = 0; - char buf[IFNAMSIZ]; const char *p; const int max_netdevices = 8*PAGE_SIZE; long *inuse; struct net_device *d; - net_t net; - - BUG_ON(null_net(dev->nd_net)); - net = dev->nd_net; p = strnchr(name, IFNAMSIZ-1, '%'); if (p) { @@ -713,10 +709,8 @@ int dev_alloc_name(struct net_device *dev, const char *name) } snprintf(buf, sizeof(buf), name, i); - if (!__dev_get_by_name(net, buf)) { - strlcpy(dev->name, buf, IFNAMSIZ); + if (!__dev_get_by_name(net, buf)) return i; - } /* It is possible to run out of possible slots * when the name is long and there isn't enough space left @@ -725,6 +719,34 @@ int dev_alloc_name(struct net_device *dev, const char *name) return -ENFILE; } +/** + * dev…
creator: ebiederm
date: 2007-01-25T19:00:19-00:00

[PATCH RFC 18/31] net: Implment network device movement between namespaces
type: item
description: From: Eric W. Biederman <ebiederm@xmission.com> - unquoted This patch introduces NETIF_F_NETNS_LOCAL a flag to indicate a network device is local to a single network namespace and should never be moved. Useful for pseudo devices that we need an instance in each network namespace (like the loopback device) and for any device we find that cannot handle multiple network namespaces so we may trap them in the initial network namespace. This patch introduces the function dev_change_net_namespace a function used to move a network device from one network namespace to another. To the network device nothing special appears to happen, to the components of the network stack it appears as if the network device was unregistered in the network namespace it is in, and a new device was registered in the network namespace the device was moved to. This patch sets up a namespace device destructor that upon the exit of a network namespace moves all of the movable network devices to the initial network namespace so they are not lost. Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> --- drivers/net/loopback.c | 3 +- include/linux/netdevice.h | 3 + net/core/dev.c | 222 +++++++++++++++++++++++++++++++++++++++----- 3 files changed, 201 insertions(+), 27 deletions(-) diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c index e9abf3f..7d15de0 100644 --- a/drivers/net/loopback.c +++ b/drivers/net/loopback.c @@ -225,7 +225,8 @@ DEFINE_PER_NET(struct net_device, loopback_dev) = { | NETIF_F_TSO #endif | NETIF_F_NO_CSUM | NETIF_F_HIGHDMA - | NETIF_F_LLTX, + | NETIF_F_LLTX + | NETIF_F_NETNS_LOCAL, .ethtool_ops = &loopback_ethtool_ops, }; diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h index 0b4a4dc..3fcaf60 100644 --- a/include/linux/netdevice.h +++ b/include/linux/netdevice.h @@ -324,6 +324,7 @@ struct net_device #define NETIF_F_VLAN_CHALLENGED 1024 /* Device cannot handle VLAN packets */ #define NETIF_F_GSO 2048 /* Enable software GSO. */ #define NETIF_F_LLTX 409…
creator: ebiederm
date: 2007-01-25T19:00:20-00:00

[PATCH RFC 19/31] net: sysfs interface support for moving devices between network namespaces.
type: item
description: From: Eric W. Biederman <ebiederm@xmission.com> - unquoted I haven't a clue if this interface will meet with widespread approval but at this point it is simple, and very useful. Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> --- net/core/net-sysfs.c | 35 +++++++++++++++++++++++++++++++++++ 1 files changed, 35 insertions(+), 0 deletions(-) diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c index 1be6f94..f8a5c6b 100644 --- a/net/core/net-sysfs.c +++ b/net/core/net-sysfs.c @@ -188,6 +188,40 @@ static ssize_t store_mtu(struct class_device *cd, const char *buf, size_t len) return netdev_store(cd, buf, len, change_mtu); } +static ssize_t show_new_ns_pid(struct class_device *cd, char *buf) +{ + return -EPERM; +} +static int change_new_ns_pid(struct net_device *dev, unsigned long new_ns_pid) +{ + struct task_struct *tsk; + int err; + net_t net; + /* Look up the network namespace */ + err = -ESRCH; + rcu_read_lock(); + tsk = find_task_by_pid(new_ns_pid); + if (tsk) { + task_lock(tsk); + if (tsk->nsproxy) { + err = 0; + net = get_net(tsk->nsproxy->net_ns); + } + task_unlock(tsk); + } + rcu_read_unlock(); + /* If I found a network namespace move the device */ + if (!err) { + err = dev_change_net_namespace(dev, net, NULL); + put_net(net); + } + return err; +} +static ssize_t store_new_ns_pid(struct class_device *cd, const char *buf, size_t len) +{ + return netdev_store(cd, buf, len, change_new_ns_pid); +} + NETDEVICE_SHOW(flags, fmt_hex); static int change_flags(struct net_device *dev, unsigned long new_flags) @@ -243,6 +277,7 @@ static struct class_device_attribute net_class_attributes[] = { __ATTR(tx_queue_len, S_IRUGO | S_IWUSR, show_tx_queue_len, store_tx_queue_len), __ATTR(weight, S_IRUGO | S_IWUSR, show_weight, store_weight), + __ATTR(new_ns_pid, S_IWUSR, show_new_ns_pid, store_new_ns_pid), {} }; -- 1.4.4.1.g278f _______________________________________________ Containers mailing list Containers@lists.osdl.org https://lists.osdl.org/mailman/listinfo/contai…
creator: ebiederm
date: 2007-01-25T19:00:21-00:00

[PATCH RFC 20/31] net: Implement CONFIG_NET_NS
type: item
description: From: Eric W. Biederman <ebiederm@xmission.com> - unquoted Add the config option to enable multiple network namespaces. Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> --- net/Kconfig | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-) diff --git a/net/Kconfig b/net/Kconfig index 7dfc949..4671398 100644 --- a/net/Kconfig +++ b/net/Kconfig @@ -27,6 +27,13 @@ if NET menu "Networking options" +config NET_NS + bool "Network namespace support" + depends on EXPERIMENTAL + help + Support what appear to user space as multiple instances of the + network stack. + config NETDEBUG bool "Network packet debugging" help -- 1.4.4.1.g278f _______________________________________________ Containers mailing list Containers@lists.osdl.org https://lists.osdl.org/mailman/listinfo/containers
creator: ebiederm
date: 2007-01-25T19:00:22-00:00

[PATCH RFC 21/31] net: Implement the guts of the network namespace infrastructure
type: item
description: From: Eric W. Biederman <ebiederm@xmission.com> - unquoted Support is added for the .data.pernet section where all of the variables who have a single instance in each network namespace will live. Every architectures linker script is modified so is should work. Summarizing the functions: net_ns_init creates a slab and allocates the template and the initial network namespace. pernet_modcopy keeps the network namespaces in sync with the loaded modules. Initializing new data variables as they are added. The network namespace destruction because the last reference can come from interrupt context queues itself for later with schedule_work. Then we alert everyone the network namespace is disappearing. If a buggy user is still holding a reference to the network namespace we print a nasty message and leak the network namespace. The wrest are just light-weight wrapper functions to make things more convinient. A little should probably be said about net_head the variable at the start of my network namespace structure. It is the only variable with a location decided by the C code instead of the linker and I string them together in a linked list so I can iterate. Probably more interesting is that it looks like it is saner not to directly use a pointer to my network namespace but instead to use an offset. All of the references to data in my network namespace are coming from per_net(...) which takes the address of the variable in the .data.pernet section and then adds my magic offset. If I used a pointer I would have to subract an additional value and export an extra symbol. Not good for performance or maintenance :) The expected usage of network namespace variables is to replace sequences like: &loopback_dev with &per_net(loopback_dev, net) where net is some network namespace reference. In my preliminary tests the only a single additional addition is inserted so it appears to be an efficient idiom. Hopefully it is also easy to comprehend and use. Signed-off-by: Eric W. Biederman <…
creator: ebiederm
date: 2007-01-25T19:00:23-00:00

[PATCH RFC 22/31] net: Add network namespace clone support.
type: item
description: From: Eric W. Biederman <ebiederm@xmission.com> - unquoted This patch allows you to create a new network namespace using sys_clone(...). Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> --- include/linux/sched.h | 1 + kernel/nsproxy.c | 11 +++++++++++ net/core/net_namespace.c | 38 ++++++++++++++++++++++++++++++++++++++ 3 files changed, 50 insertions(+), 0 deletions(-) diff --git a/include/linux/sched.h b/include/linux/sched.h index 4463735..9e0f91a 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -26,6 +26,7 @@ #define CLONE_STOPPED 0x02000000 /* Start in stopped state */ #define CLONE_NEWUTS 0x04000000 /* New utsname group? */ #define CLONE_NEWIPC 0x08000000 /* New ipcs */ +#define CLONE_NEWNET 0x20000000 /* New network namespace */ /* * Scheduling policies diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c index 4f3c95a..7861c4c 100644 --- a/kernel/nsproxy.c +++ b/kernel/nsproxy.c @@ -20,6 +20,7 @@ #include <linux/mnt_namespace.h> #include <linux/utsname.h> #include <linux/pid_namespace.h> +#include <net/net_namespace.h> struct nsproxy init_nsproxy = INIT_NSPROXY(init_nsproxy); EXPORT_SYMBOL_GPL(init_nsproxy); @@ -70,6 +71,7 @@ struct nsproxy *dup_namespaces(struct nsproxy *orig) get_ipc_ns(ns->ipc_ns); if (ns->pid_ns) get_pid_ns(ns->pid_ns); + get_net(ns->net_ns); } return ns; @@ -117,10 +119,18 @@ int copy_namespaces(int flags, struct task_struct *tsk) if (err) goto out_pid; + err = copy_net(flags, tsk); + if (err) + goto out_net; + out: put_nsproxy(old_ns); return err; +out_net: + if (new_ns->pid_ns) + put_pid_ns(new_ns->pid_ns); + out_pid: if (new_ns->ipc_ns) put_ipc_ns(new_ns->ipc_ns); @@ -146,5 +156,6 @@ void free_nsproxy(struct nsproxy *ns) put_ipc_ns(ns->ipc_ns); if (ns->pid_ns) put_pid_ns(ns->pid_ns); + put_net(ns->net_ns); kfree(ns); } diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c index 93e3879..cc56105 100644 --- a/net/core/net_namespace.c +++ b/net/core/net_namespace.c @@ -175,6 +175,44 @@ out_undo: goto out; }…
creator: ebiederm
date: 2007-01-25T19:00:24-00:00

[PATCH RFC 23/31] net: Modify all rtnetlink methods to only work in the initial namespace
type: item
description: From: Eric W. Biederman <ebiederm@xmission.com> - unquoted Before I can enable rtnetlink to work in all network namespaces I need to be certain that something won't break. So this patch deliberately disables all of the methods and when they are audited this extra check can be disabled. Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> --- net/bridge/br_netlink.c | 9 +++++++++ net/core/fib_rules.c | 7 +++++++ net/core/neighbour.c | 18 ++++++++++++++++++ net/core/rtnetlink.c | 13 +++++++++++++ net/decnet/dn_dev.c | 12 ++++++++++++ net/decnet/dn_fib.c | 8 ++++++++ net/decnet/dn_route.c | 8 ++++++++ net/decnet/dn_rules.c | 5 +++++ net/decnet/dn_table.c | 4 ++++ net/ipv4/devinet.c | 12 ++++++++++++ net/ipv4/fib_frontend.c | 12 ++++++++++++ net/ipv4/fib_rules.c | 5 +++++ net/ipv6/addrconf.c | 31 +++++++++++++++++++++++++++++++ net/ipv6/fib6_rules.c | 5 +++++ net/ipv6/ip6_fib.c | 4 ++++ net/ipv6/route.c | 12 ++++++++++++ net/sched/act_api.c | 8 ++++++++ net/sched/cls_api.c | 8 ++++++++ net/sched/sch_api.c | 20 ++++++++++++++++++++ 19 files changed, 201 insertions(+), 0 deletions(-) diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c index 119b97d..85165a1 100644 --- a/net/bridge/br_netlink.c +++ b/net/bridge/br_netlink.c @@ -14,6 +14,7 @@ #include <linux/rtnetlink.h> #include <net/netlink.h> #include <net/net_namespace.h> +#include <net/sock.h> #include "br_private.h" static inline size_t br_nlmsg_size(void) @@ -104,9 +105,13 @@ errout: */ static int br_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb) { + net_t net = skb->sk->sk_net; struct net_device *dev; int idx; + if (!net_eq(net, init_net())) + return 0; + read_lock(&per_net(dev_base_lock, init_net())); for (dev = per_net(dev_base, init_net()), idx = 0; dev; dev = dev->next) { /* not a bridge port */ @@ -133,12 +138,16 @@ skip: */ static int br_rtm_setlink(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg) { + net_t net = skb->sk->sk_net; struct ifinfomsg *ifm; struct nlattr *protinfo…
creator: ebiederm
date: 2007-01-25T19:00:25-00:00

[PATCH RFC 24/31] net: Make rtnetlink network namespace aware
type: item
description: From: Eric W. Biederman <ebiederm@xmission.com> - unquoted After this patch none of the netlink callback support anything except the initial network namespace but the rtnetlink infrastructure now handles multiple network namespaces. Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> --- include/linux/rtnetlink.h | 8 ++-- net/bridge/br_netlink.c | 4 +- net/core/fib_rules.c | 4 +- net/core/neighbour.c | 4 +- net/core/rtnetlink.c | 74 +++++++++++++++++++++++++++++++++++--------- net/core/wireless.c | 5 ++- net/decnet/dn_dev.c | 4 +- net/decnet/dn_route.c | 2 +- net/decnet/dn_table.c | 4 +- net/ipv4/devinet.c | 4 +- net/ipv4/fib_semantics.c | 4 +- net/ipv4/ipmr.c | 4 +- net/ipv4/route.c | 2 +- net/ipv6/addrconf.c | 14 ++++---- net/ipv6/route.c | 6 ++-- net/sched/cls_api.c | 2 +- net/sched/sch_api.c | 4 +- 17 files changed, 98 insertions(+), 51 deletions(-) diff --git a/include/linux/rtnetlink.h b/include/linux/rtnetlink.h index 4a629ea..6c8281d 100644 --- a/include/linux/rtnetlink.h +++ b/include/linux/rtnetlink.h @@ -581,11 +581,11 @@ struct rtnetlink_link }; extern struct rtnetlink_link * rtnetlink_links[NPROTO]; -extern int rtnetlink_send(struct sk_buff *skb, u32 pid, u32 group, int echo); -extern int rtnl_unicast(struct sk_buff *skb, u32 pid); -extern int rtnl_notify(struct sk_buff *skb, u32 pid, u32 group, +extern int rtnetlink_send(struct sk_buff *skb, net_t net, u32 pid, u32 group, int echo); +extern int rtnl_unicast(struct sk_buff *skb, net_t net, u32 pid); +extern int rtnl_notify(struct sk_buff *skb, net_t net, u32 pid, u32 group, struct nlmsghdr *nlh, gfp_t flags); -extern void rtnl_set_sk_err(u32 group, int error); +extern void rtnl_set_sk_err(net_t net, u32 group, int error); extern int rtnetlink_put_metrics(struct sk_buff *skb, u32 *metrics); extern int rtnl_put_cacheinfo(struct sk_buff *skb, struct dst_entry *dst, u32 id, u32 ts, u32 tsage, long expires, diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c index 85165a1..372fb18 100644 --- …
creator: ebiederm
date: 2007-01-25T19:00:26-00:00

[PATCH RFC 25/31] net: Make wireless netlink event generation handle multiple network namespaces
type: item
description: From: Eric W. Biederman <ebiederm@xmission.com> - unquoted Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> --- net/core/wireless.c | 15 ++++++++++----- 1 files changed, 10 insertions(+), 5 deletions(-) diff --git a/net/core/wireless.c b/net/core/wireless.c index 9036359..d534617 100644 --- a/net/core/wireless.c +++ b/net/core/wireless.c @@ -1934,8 +1934,13 @@ static void wireless_nlevent_process(unsigned long data) { struct sk_buff *skb; - while ((skb = skb_dequeue(&wireless_nlevent_queue))) - rtnl_notify(skb, init_net(), 0, RTNLGRP_LINK, NULL, GFP_ATOMIC); + while ((skb = skb_dequeue(&wireless_nlevent_queue))) { + struct net_device *dev = skb->dev; + net_t net = dev->nd_net; + skb->dev = NULL; + rtnl_notify(skb, net, 0, RTNLGRP_LINK, NULL, GFP_ATOMIC); + dev_put(dev); + } } static DECLARE_TASKLET(wireless_nlevent_tasklet, wireless_nlevent_process, 0); @@ -1992,9 +1997,6 @@ static inline void rtmsg_iwinfo(struct net_device * dev, struct sk_buff *skb; int size = NLMSG_GOODSIZE; - if (!net_eq(dev->nd_net, init_net())) - return; - skb = alloc_skb(size, GFP_ATOMIC); if (!skb) return; @@ -2004,6 +2006,9 @@ static inline void rtmsg_iwinfo(struct net_device * dev, kfree_skb(skb); return; } + /* Remember the device until we are in process context */ + dev_hold(dev); + skb->dev = dev; NETLINK_CB(skb).dst_group = RTNLGRP_LINK; skb_queue_tail(&wireless_nlevent_queue, skb); tasklet_schedule(&wireless_nlevent_tasklet); -- 1.4.4.1.g278f _______________________________________________ Containers mailing list Containers@lists.osdl.org https://lists.osdl.org/mailman/listinfo/containers
creator: ebiederm
date: 2007-01-25T19:00:27-00:00

[PATCH RFC 26/31] net: Make the netlink methods in rtnetlink handle multiple network namespaces
type: item
description: From: Eric W. Biederman <ebiederm@xmission.com> - unquoted It turns out after a quick audit that except for removing the checks there is really nothing to do here. Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> --- net/core/rtnetlink.c | 21 +++------------------ 1 files changed, 3 insertions(+), 18 deletions(-) diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c index 29a81bf..0a42258 100644 --- a/net/core/rtnetlink.c +++ b/net/core/rtnetlink.c @@ -409,9 +409,6 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb) int s_idx = cb->args[0]; struct net_device *dev; - if (!net_eq(net, init_net())) - return 0; - read_lock(&per_net(dev_base_lock, net)); for (dev=per_net(dev_base, net), idx=0; dev; dev = dev->next, idx++) { if (idx < s_idx) @@ -446,9 +443,6 @@ static int rtnl_setlink(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg) struct nlattr *tb[IFLA_MAX+1]; char ifname[IFNAMSIZ]; - if (!net_eq(net, init_net())) - return -EINVAL; - err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFLA_MAX, ifla_policy); if (err < 0) goto errout; @@ -622,9 +616,6 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg) int iw_buf_len = 0; int err; - if (!net_eq(net, init_net())) - return -EINVAL; - err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFLA_MAX, ifla_policy); if (err < 0) return err; @@ -673,13 +664,9 @@ errout: static int rtnl_dump_all(struct sk_buff *skb, struct netlink_callback *cb) { - net_t net = skb->sk->sk_net; int idx; int s_idx = cb->family; - if (!net_eq(net, init_net())) - return 0; - if (s_idx == 0) s_idx = 1; for (idx=1; idx<NPROTO; idx++) { @@ -701,6 +688,7 @@ static int rtnl_dump_all(struct sk_buff *skb, struct netlink_callback *cb) void rtmsg_ifinfo(int type, struct net_device *dev, unsigned change) { + net_t net = dev->nd_net; struct sk_buff *skb; int err = -ENOBUFS; @@ -712,10 +700,10 @@ void rtmsg_ifinfo(int type, struct net_device *dev, unsigned change) /* failure implies BUG in if_nlmsg_size() */ BUG_…
creator: ebiederm
date: 2007-01-25T19:00:28-00:00

[PATCH RFC 27/31] net: Make the xfrm sysctls per network namespace.
type: item
description: From: Eric W. Biederman <ebiederm@xmission.com> - unquoted In particalure I moved: /proc/sys/net/core/xfrm_aevent_etime /proc/sys/net/core/xfrm_aevent_rseqth Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> --- include/net/xfrm.h | 4 ++-- net/core/sysctl_net_core.c | 37 ++++++++++++++++++------------------- net/xfrm/xfrm_state.c | 8 ++++---- net/xfrm/xfrm_user.c | 10 ++++++---- 4 files changed, 30 insertions(+), 29 deletions(-) diff --git a/include/net/xfrm.h b/include/net/xfrm.h index e476541..9b2e727 100644 --- a/include/net/xfrm.h +++ b/include/net/xfrm.h @@ -24,8 +24,8 @@ MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap)) extern struct sock *xfrm_nl; -extern u32 sysctl_xfrm_aevent_etime; -extern u32 sysctl_xfrm_aevent_rseqth; +DECLARE_PER_NET(u32, sysctl_xfrm_aevent_etime); +DECLARE_PER_NET(u32, sysctl_xfrm_aevent_rseqth); extern struct mutex xfrm_cfg_mutex; diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c index 76f7a29..90f2a39 100644 --- a/net/core/sysctl_net_core.c +++ b/net/core/sysctl_net_core.c @@ -88,24 +88,6 @@ ctl_table core_table[] = { .mode = 0644, .proc_handler = &proc_dointvec }, -#ifdef CONFIG_XFRM - { - .ctl_name = NET_CORE_AEVENT_ETIME, - .procname = "xfrm_aevent_etime", - .data = &sysctl_xfrm_aevent_etime, - .maxlen = sizeof(u32), - .mode = 0644, - .proc_handler = &proc_dointvec - }, - { - .ctl_name = NET_CORE_AEVENT_RSEQTH, - .procname = "xfrm_aevent_rseqth", - .data = &sysctl_xfrm_aevent_rseqth, - .maxlen = sizeof(u32), - .mode = 0644, - .proc_handler = &proc_dointvec - }, -#endif /* CONFIG_XFRM */ #endif /* CONFIG_NET */ { .ctl_name = NET_CORE_SOMAXCONN, @@ -127,6 +109,23 @@ ctl_table core_table[] = { }; DEFINE_PER_NET(struct ctl_table, multi_core_table[]) = { - /* Stub for holding per network namespace sysctls */ +#ifdef CONFIG_XFRM + { + .ctl_name = NET_CORE_AEVENT_ETIME, + .procname = "xfrm_aevent_etime", + .data = &__per_net_base(sysctl_xfrm_aevent_etime), + .maxlen = sizeof(u32), + .mode = 0…
creator: ebiederm
date: 2007-01-25T19:00:29-00:00

[PATCH RFC 28/31] net: Make the SOMAXCONN sysctl per network namespace
type: item
description: From: Eric W. Biederman <ebiederm@xmission.com> - unquoted Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> --- include/linux/socket.h | 3 ++- net/core/sysctl_net_core.c | 16 ++++++++-------- net/socket.c | 7 ++++--- 3 files changed, 14 insertions(+), 12 deletions(-) diff --git a/include/linux/socket.h b/include/linux/socket.h index 92cd38e..aa159ea 100644 --- a/include/linux/socket.h +++ b/include/linux/socket.h @@ -23,8 +23,9 @@ struct __kernel_sockaddr_storage { #include <linux/uio.h> /* iovec support */ #include <linux/types.h> /* pid_t */ #include <linux/compiler.h> /* __user */ +#include <linux/net_namespace_type.h> -extern int sysctl_somaxconn; +DECLARE_PER_NET(int, sysctl_somaxconn); #ifdef CONFIG_PROC_FS struct seq_file; extern void socket_seq_show(struct seq_file *seq); diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c index 90f2a39..14eca68 100644 --- a/net/core/sysctl_net_core.c +++ b/net/core/sysctl_net_core.c @@ -90,14 +90,6 @@ ctl_table core_table[] = { }, #endif /* CONFIG_NET */ { - .ctl_name = NET_CORE_SOMAXCONN, - .procname = "somaxconn", - .data = &sysctl_somaxconn, - .maxlen = sizeof(int), - .mode = 0644, - .proc_handler = &proc_dointvec - }, - { .ctl_name = NET_CORE_BUDGET, .procname = "netdev_budget", .data = &netdev_budget, @@ -127,5 +119,13 @@ DEFINE_PER_NET(struct ctl_table, multi_core_table[]) = { .proc_handler = &proc_dointvec }, #endif /* CONFIG_XFRM */ + { + .ctl_name = NET_CORE_SOMAXCONN, + .procname = "somaxconn", + .data = &__per_net_base(sysctl_somaxconn), + .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = &proc_dointvec + }, {} }; diff --git a/net/socket.c b/net/socket.c index 7371654..ab2aeea 100644 --- a/net/socket.c +++ b/net/socket.c @@ -1305,7 +1305,7 @@ asmlinkage long sys_bind(int fd, struct sockaddr __user *umyaddr, int addrlen) * ready for listening. */ -int sysctl_somaxconn __read_mostly = SOMAXCONN; +DEFINE_PER_NET(int, sysctl_somaxconn)= SOMAXCONN; asmlinkage long sys_listen(int fd, int…
creator: ebiederm
date: 2007-01-25T19:00:30-00:00

[PATCH RFC 29/31] net: Make AF_PACKET handle multiple network namespaces
type: item
description: From: Eric W. Biederman <ebiederm@xmission.com> - unquoted This is done by making all of the relevant global variables per network namespace. Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> --- net/packet/af_packet.c | 125 +++++++++++++++++++++++++++++++----------------- 1 files changed, 81 insertions(+), 44 deletions(-) diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index 4ac9f9f..c772491 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -152,8 +152,8 @@ dev->hard_header == NULL (ll header is added by device, we cannot control it) */ /* List of all packet sockets. */ -static HLIST_HEAD(packet_sklist); -static DEFINE_RWLOCK(packet_sklist_lock); +static DEFINE_PER_NET(rwlock_t, packet_sklist_lock); +static DEFINE_PER_NET(struct hlist_head, packet_sklist); static atomic_t packet_socks_nr; @@ -264,9 +264,6 @@ static int packet_rcv_spkt(struct sk_buff *skb, struct packet_type *pt, struct n struct sock *sk; struct sockaddr_pkt *spkt; - if (!net_eq(dev->nd_net, init_net())) - goto out; - /* * When we registered the protocol we saved the socket in the data * field for just this event. @@ -288,6 +285,9 @@ static int packet_rcv_spkt(struct sk_buff *skb, struct packet_type *pt, struct n if (skb->pkt_type == PACKET_LOOPBACK) goto out; + if (!net_eq(dev->nd_net, sk->sk_net)) + goto out; + if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL) goto oom; @@ -359,7 +359,7 @@ static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock, */ saddr->spkt_device[13] = 0; - dev = dev_get_by_name(init_net(), saddr->spkt_device); + dev = dev_get_by_name(sk->sk_net, saddr->spkt_device); err = -ENODEV; if (dev == NULL) goto out_unlock; @@ -475,15 +475,15 @@ static int packet_rcv(struct sk_buff *skb, struct packet_type *pt, struct net_de int skb_len = skb->len; unsigned snaplen; - if (!net_eq(dev->nd_net, init_net())) - goto drop; - if (skb->pkt_type == PACKET_LOOPBACK) goto drop; sk = pt->af_packet_priv; po = pkt_sk(sk); + if (!net_eq(dev->n…
creator: ebiederm
date: 2007-01-25T19:00:31-00:00

[PATCH RFC 30/31] net: Make AF_UNIX per network namespace safe.
type: item
description: From: Eric W. Biederman <ebiederm@xmission.com> - unquoted Because of the global nature of garbage collection, and because of the cost of per namespace hash tables unix_socket_table has been kept global. With a filter added on lookups so we don't see sockets from the wrong namespace. Currently I don't fold the namesapce into the hash so multiple namespaces using the same socket name will be guaranateed a hash collision. Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> --- include/net/af_unix.h | 10 ++-- net/unix/af_unix.c | 116 ++++++++++++++++++++++++++++++++------------ net/unix/sysctl_net_unix.c | 24 +++++---- 3 files changed, 103 insertions(+), 47 deletions(-) diff --git a/include/net/af_unix.h b/include/net/af_unix.h index c0398f5..1f40dd2 100644 --- a/include/net/af_unix.h +++ b/include/net/af_unix.h @@ -89,12 +89,12 @@ struct unix_sock { #define unix_sk(__sk) ((struct unix_sock *)__sk) #ifdef CONFIG_SYSCTL -extern int sysctl_unix_max_dgram_qlen; -extern void unix_sysctl_register(void); -extern void unix_sysctl_unregister(void); +DECLARE_PER_NET(int, sysctl_unix_max_dgram_qlen); +extern void unix_sysctl_register(net_t net); +extern void unix_sysctl_unregister(net_t net); #else -static inline void unix_sysctl_register(void) {} -static inline void unix_sysctl_unregister(void) {} +static inline void unix_sysctl_register(net_t net) {} +static inline void unix_sysctl_unregister(net_t net) {} #endif #endif #endif diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c index 8015a03..3f57cb2 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c @@ -118,7 +118,7 @@ #include <linux/security.h> #include <net/net_namespace.h> -int sysctl_unix_max_dgram_qlen __read_mostly = 10; +DEFINE_PER_NET(int, sysctl_unix_max_dgram_qlen) = 10; struct hlist_head unix_socket_table[UNIX_HASH_SIZE + 1]; DEFINE_SPINLOCK(unix_table_lock); @@ -245,7 +245,8 @@ static inline void unix_insert_socket(struct hlist_head *list, struct sock *sk) spin_unlock(&unix_table_lock); } -static stru…
creator: ebiederm
date: 2007-01-25T19:00:32-00:00

[PATCH RFC 31/31] net: Add etun driver
type: item
description: From: Eric W. Biederman <ebiederm@xmission.com> - unquoted etun is a simple two headed tunnel driver that at the link layer looks like ethernet. It's target audience is communicating between network namespaces but it is general enough it may have other uses as well. Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> --- drivers/net/Kconfig | 14 ++ drivers/net/Makefile | 1 + drivers/net/etun.c | 470 ++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 485 insertions(+), 0 deletions(-) diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig index 8aa8dd0..969d3df 100644 --- a/drivers/net/Kconfig +++ b/drivers/net/Kconfig @@ -119,6 +119,20 @@ config TUN If you don't know what to use this for, you don't need it. +config ETUN + tristate "Ethernet tunnel device driver support" + depends on SYSFS + ---help--- + ETUN provices a pair of network devices that can be used for + configuring interesting topolgies. What one devices transmits + the other receives and vice versa. The link level framing + is ethernet for wide compatibility with network stacks. + + To compile this driver as a module, choose M here: the module + will be called etun. + + If you don't know what to use this for, you don't need it. + config NET_SB1000 tristate "General Instruments Surfboard 1000" depends on PNP diff --git a/drivers/net/Makefile b/drivers/net/Makefile index 4c0d4e5..396af4f 100644 --- a/drivers/net/Makefile +++ b/drivers/net/Makefile @@ -185,6 +185,7 @@ obj-$(CONFIG_MACSONIC) += macsonic.o obj-$(CONFIG_MACMACE) += macmace.o obj-$(CONFIG_MAC89x0) += mac89x0.o obj-$(CONFIG_TUN) += tun.o +obj-$(CONFIG_ETUN) += etun.o obj-$(CONFIG_NET_NETX) += netx-eth.o obj-$(CONFIG_DL2K) += dl2k.o obj-$(CONFIG_R8169) += r8169.o diff --git a/drivers/net/etun.c b/drivers/net/etun.c new file mode 100644 index 0000000..1dd8cd8 --- /dev/null +++ b/drivers/net/etun.c @@ -0,0 +1,470 @@ +/* + * ETUN - Universal ETUN device driver. + * Copyright (C) 2006 Linux Networx + * + */ + +#define DRV_NAME "…
creator: ebiederm
date: 2007-01-25T19:00:33-00:00

Re: [PATCH RFC 1/31] net: Add net_namespace_type.h to allow for per network namespace variables.
type: item
description: Can all this be a nop if a CONFIG option is not selected? > > diff --git a/include/linux/net_namespace_type.h b/include/linux/net_namespace_type.h > new file mode 100644 > index 0000000..8173f59 > --- /dev/null > +++ b/include/linux/net_namespace_type.h > @@ -0,0 +1,52 @@ > +/* > + * Definition of the network namespace reference type > + * And operations upon it. > + */ > +#ifndef __LINUX_NET_NAMESPACE_TYPE_H > +#define __LINUX_NET_NAMESPACE_TYPE_H > + > +#define __pernetname(name) per_net__##name Code obfuscation, please don't do that > +typedef struct {} net_t; No typedef for this please. > + > +#define __data_pernet > + > +/* Look up a per network namespace variable */ > +static inline unsigned long __per_net_offset(net_t net) { return 0; } > + > +/* Like per_net but returns a pseudo variable address that must be moved > + * __per_net_offset() bytes before it will point to a real variable. > + * Useful for static initializers. > + */ > +#define __per_net_base(name) __pernetname(name) > + > +/* Get the network namespace reference from a per_net variable address */ > +#define net_of(ptr, name) ({ net_t net; ptr; net; }) > + > +/* Look up a per network namespace variable */ > +#define per_net(name, net) \ > + (*(__per_net_offset(net), &__per_net_base(name))) > + > +/* Are the two network namespaces the same */ > +static inline int net_eq(net_t a, net_t b) { return 1; } > +/* Get an unsigned value appropriate for hashing the network namespace */ > +static inline unsigned int net_hval(net_t net) { return 0; } > + > +/* Convert to and from to and from void pointers */ > +static inline void *net_to_voidp(net_t net) { return NULL; } > +static inline net_t net_from_voidp(void *ptr) { net_t net; return net; } > + > +static inline int null_net(net_t net) { return 0; } > + > +#define DEFINE_PER_NET(type, name) \ > + __data_pernet __typeof__(type) __pernetname(name) > + > +#define DECLARE_PER_NET(type, name) \ > + extern __typeof__(type) __pernetname(name) > + > +#define EXPO…
creator: Stephen Hemminger
date: 2007-01-25T20:30:17-00:00

Re: [PATCH RFC 1/31] net: Add net_namespace_type.h to allow for per network namespace variables.
type: item
description: Stephen Hemminger <shemminger@linux-foundation.org> writes: > Can all this be a nop if a CONFIG option is not selected? That is exactly what this infrastructure supports. What you see is the version that comes into effect when the CONFIG option is not selected. >From using an empty structure to replace a pointer to make that a NOP to most of the rest below. >> diff --git a/include/linux/net_namespace_type.h > b/include/linux/net_namespace_type.h >> new file mode 100644 >> index 0000000..8173f59 >> --- /dev/null >> +++ b/include/linux/net_namespace_type.h >> @@ -0,0 +1,52 @@ >> +/* >> + * Definition of the network namespace reference type >> + * And operations upon it. >> + */ >> +#ifndef __LINUX_NET_NAMESPACE_TYPE_H >> +#define __LINUX_NET_NAMESPACE_TYPE_H >> + >> +#define __pernetname(name) per_net__##name > > Code obfuscation, please don't do that Single point of making the naming rules, better maintenance. The basic point is that variables that come through this path you should not access directly. Tweaking the name enforces that even in the compiled out state. >> +typedef struct {} net_t; > > No typedef for this please. Why. That is conventially how we do opaque types in linux when someone is doing something sophisticated. You probably want to look down to patch 21 to see what the compiled in version of these look like. Eric _______________________________________________ Containers mailing list Containers@lists.osdl.org https://lists.osdl.org/mailman/listinfo/containers
creator: ebiederm
date: 2007-01-25T20:53:11-00:00

Re: [PATCH RFC 18/31] net: Implment network device movement between namespaces
type: item
description: Eric W. Biederman wrote: > From: Eric W. Biederman <ebiederm@xmission.com> - unquoted > > This patch introduces NETIF_F_NETNS_LOCAL a flag to indicate > a network device is local to a single network namespace and > should never be moved. Useful for pseudo devices that we > need an instance in each network namespace (like the loopback > device) and for any device we find that cannot handle multiple > network namespaces so we may trap them in the initial network > namespace. > > This patch introduces the function dev_change_net_namespace > a function used to move a network device from one network > namespace to another. To the network device nothing > special appears to happen, to the components of the network > stack it appears as if the network device was unregistered > in the network namespace it is in, and a new device > was registered in the network namespace the device > was moved to. > > This patch sets up a namespace device destructor that > upon the exit of a network namespace moves all of the > movable network devices to the initial network namespace > so they are not lost. > If you: * create etun0/etun1 * create a namespace * move etun1 to this namespace * rename the etun1 to eth0 * kill the namespace the former network device etun1 will be lost if you have in your parent namespace an interface eth0 because it will conflict. Perhaps, the first name should be restored before moving the device back to the initial network namespace ? -- Daniel ps : nice patchset _______________________________________________ Containers mailing list Containers@lists.osdl.org https://lists.osdl.org/mailman/listinfo/containers
creator: Daniel Lezcano
date: 2007-02-28T14:35:41-00:00

Re: [PATCH RFC 22/31] net: Add network namespace clone support.
type: item
description: Eric W. Biederman wrote: > From: Eric W. Biederman <ebiederm@xmission.com> - unquoted > > This patch allows you to create a new network namespace > using sys_clone(...). > > Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> > --- > include/linux/sched.h | 1 + > kernel/nsproxy.c | 11 +++++++++++ > net/core/net_namespace.c | 38 ++++++++++++++++++++++++++++++++++++++ > 3 files changed, 50 insertions(+), 0 deletions(-) > > diff --git a/include/linux/sched.h b/include/linux/sched.h > index 4463735..9e0f91a 100644 > --- a/include/linux/sched.h > +++ b/include/linux/sched.h > @@ -26,6 +26,7 @@ > #define CLONE_STOPPED 0x02000000 /* Start in stopped state */ > #define CLONE_NEWUTS 0x04000000 /* New utsname group? */ > #define CLONE_NEWIPC 0x08000000 /* New ipcs */ > +#define CLONE_NEWNET 0x20000000 /* New network namespace */ > > /* > * Scheduling policies > diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c > index 4f3c95a..7861c4c 100644 > --- a/kernel/nsproxy.c > +++ b/kernel/nsproxy.c > @@ -20,6 +20,7 @@ > #include <linux/mnt_namespace.h> > #include <linux/utsname.h> > #include <linux/pid_namespace.h> > +#include <net/net_namespace.h> > > struct nsproxy init_nsproxy = INIT_NSPROXY(init_nsproxy); > EXPORT_SYMBOL_GPL(init_nsproxy); > @@ -70,6 +71,7 @@ struct nsproxy *dup_namespaces(struct nsproxy *orig) > get_ipc_ns(ns->ipc_ns); > if (ns->pid_ns) > get_pid_ns(ns->pid_ns); > + get_net(ns->net_ns); > } > > return ns; > @@ -117,10 +119,18 @@ int copy_namespaces(int flags, struct task_struct *tsk) > if (err) > goto out_pid; > > + err = copy_net(flags, tsk); > + if (err) > + goto out_net; > + > out: > put_nsproxy(old_ns); > return err; > > +out_net: > + if (new_ns->pid_ns) > + put_pid_ns(new_ns->pid_ns); > + > out_pid: > if (new_ns->ipc_ns) > put_ipc_ns(new_ns->ipc_ns); > @@ -146,5 +156,6 @@ void free_nsproxy(struct nsproxy *ns) > put_ipc_ns(ns->ipc_ns); > if (ns->pid_ns) > put_pid_ns(ns->pid_ns); > + put_net(ns->net_ns); > kfree(ns); > } > diff --git a/net/core/net_namesp…
creator: Daniel Lezcano
date: 2007-02-28T14:42:08-00:00

Re: [PATCH RFC 22/31] net: Add network namespace clone support.
type: item
description: Daniel Lezcano <dlezcano@fr.ibm.com> writes: >> + >> + mutex_lock(&net_mutex); >> + err = setup_net(new_net); >> + if (err) >> + goto out_unlock; >> > Should we "net_free" in case of error ? Oops. Yes we should. Thanks. >> + net_lock(); >> + net_list_append(new_net); >> + net_unlock(); >> + >> + tsk->nsproxy->net_ns = new_net; >> + >> +out_unlock: >> + mutex_unlock(&net_mutex); net_free(new_net); >> +out: >> + put_net(old_net); >> + return err; >> +} >> + >> Eric _______________________________________________ Containers mailing list Containers@lists.osdl.org https://lists.osdl.org/mailman/listinfo/containers
creator: ebiederm
date: 2007-02-28T15:05:13-00:00

Re: [PATCH RFC 18/31] net: Implment network device movement between namespaces
type: item
description: Daniel Lezcano <dlezcano@fr.ibm.com> writes: > Eric W. Biederman wrote: >> From: Eric W. Biederman <ebiederm@xmission.com> - unquoted >> >> This patch introduces NETIF_F_NETNS_LOCAL a flag to indicate >> a network device is local to a single network namespace and >> should never be moved. Useful for pseudo devices that we >> need an instance in each network namespace (like the loopback >> device) and for any device we find that cannot handle multiple >> network namespaces so we may trap them in the initial network >> namespace. >> >> This patch introduces the function dev_change_net_namespace >> a function used to move a network device from one network >> namespace to another. To the network device nothing >> special appears to happen, to the components of the network >> stack it appears as if the network device was unregistered >> in the network namespace it is in, and a new device >> was registered in the network namespace the device >> was moved to. >> >> This patch sets up a namespace device destructor that >> upon the exit of a network namespace moves all of the >> movable network devices to the initial network namespace >> so they are not lost. >> > If you: > * create etun0/etun1 > * create a namespace > * move etun1 to this namespace > * rename the etun1 to eth0 > * kill the namespace > > the former network device etun1 will be lost if you have in your parent > namespace an interface eth0 because it will conflict. > Perhaps, the first name should be restored before moving the device back to the > initial network namespace ? Restoration of a previous name is no guarantee of anything. Someone may have renamed the some other interface etun1 in the original network namespace. However if you look closely at the code. You will discover that if it can't keep the same name it will rename the device as it switches namespaces. In particular it will become devN where N is replaced by some unused number. That is what the pat parameter to dev_change_net_namespace is about…
creator: ebiederm
date: 2007-02-28T15:12:16-00:00

Re: [RFC PATCH 0/31] An introduction and A path for merging network namespace work
type: item
description: Hi Eric, Do you plan to propose to merge into mainline your patchset ? Shouldn't we ask netdev guys what they think about the explicit network namespace parameter into function you did versus the implicit network context using the push_net_ns/pop_net_ns function ? -- Daniel _______________________________________________ Containers mailing list Containers@lists.osdl.org https://lists.osdl.org/mailman/listinfo/containers
creator: Daniel Lezcano
date: 2007-02-28T16:38:46-00:00

Re: [RFC PATCH 0/31] An introduction and A path for merging network namespace work
type: item
description: Daniel Lezcano <dlezcano@fr.ibm.com> writes: > Hi Eric, > > Do you plan to propose to merge into mainline your patchset ? I'm hung up at the moment in the sysfs support. Network device renaming is broken in 2.6.21-rc2 at the moment. Then I would like to see the best of etun/veth merged. After that yes I would like to propose getting a network namespace implementation into mainline. Which would like be based on the patchset I posted. > Shouldn't we ask netdev guys what they think about the explicit network > namespace parameter into function you did versus the implicit network context > using the push_net_ns/pop_net_ns function ? It is an important question. My impression is that in the larger context it seems to be a minor detail. >From what I have seen of Dmitry's patches and from what I have seen of my own. When not talking functions parameters we make roughly the same set of code changes. For example in my git tree without referencing Dmitry's work, I made roughly the same set of changes to the fib code as he did. I currently prefer my register_pernet_subsys infrastructure as it is much easier to deal with then gradually accumulating the code into the namespace initialization. There is nothing to clever about it, so we should be fine. I think my current per_net() function is questionable (it borders on being too clever) but it is very straight forward to use. In fact I am probably over using it a bit and making my network namespace data structures a little too big. If you look at the slab or the initialization messages you will see I have exceeded page size. Oops. The big advantage of my pernet work (as opposed to other techniques) is that it makes compiling out any the effect of my code possible, and it allows for pernet variables with file scope. If continuing to support compiling out the pernet code isn't a requirement we could get less clever solution, and just pass a pointer around. If we do start passing a pointer around there becomes the question of how do…
creator: ebiederm
date: 2007-02-28T19:45:10-00:00

Re: [RFC PATCH 0/31] An introduction and A path for merging network namespace work
type: item
description: Eric W. Biederman wrote: [ cut ] > Dmitry? Daniel? What do you think. > Hi Eric, I agree with all the points you presented but I am still 50/50 for both approaches. The major argument in favor of the explicit parameter is that it allows to keep track of the network namespace. But the argument against is it touchs a lot of files and that can makes the patch less attractive. Furthermore, everybody should not be aware of what a network namespace is and should not know how to handle the parameter function. The implicit network namespace has the advantage to reduce considerably the impact on the code and to have network developer to be unware of the network virtualization. But in the same way the network developer should "forget" in which network namespace he is running. Another point is the race condition we have while doing network namespace switching and that can make a contention point. Concerning the network namespace compile out, that can be done by both approaches. In the [1/31] patch description, you mention you tryed zero sized structure on x86_64, and the optimization works for all architectures. Does it mean, you tested it with s390, PowerPC, ia64, etc ... ? IMHO, both approaches are equivalent in terms of pros/cons. Perhaps we should ask netdev@ ... Regards. -- Daniel _______________________________________________ Containers mailing list Containers@lists.osdl.org https://lists.osdl.org/mailman/listinfo/containers
creator: Daniel Lezcano
date: 2007-03-01T13:53:49-00:00

Re: [RFC PATCH 0/31] An introduction and A path for merging network namespace work
type: item
description: Eric W. Biederman wrote: [ cut ] > Dmitry? Daniel? What do you think. > Hi Eric, I agree with all the points you presented but I am still 50/50 for both approaches. The major argument in favor of the explicit parameter is that it allows to keep track of the network namespace. But the argument against is it touchs a lot of files and that can makes the patch less attractive. Furthermore, everybody should not be aware of what a network namespace is and should not know how to handle the parameter function. The implicit network namespace has the advantage to reduce considerably the impact on the code and to have network developer to be unware of the network virtualization. But in the same way the network developer should "forget" in which network namespace he is running. Another point is the race condition we have while doing network namespace switching and that can make a contention point. Concerning the network namespace compile out, that can be done by both approaches. In the [1/31] patch description, you mention you tryed zero sized structure on x86_64, and the optimization works for all architectures. Does it mean, you tested it with s390, PowerPC, ia64, etc ... ? IMHO, both approaches are equivalent in terms of pros/cons. Perhaps we should ask netdev@ ... Regards. -- Daniel _______________________________________________ Containers mailing list Containers@lists.osdl.org https://lists.osdl.org/mailman/listinfo/containers
creator: Daniel Lezcano
date: 2007-03-01T14:22:56-00:00

Re: [PATCH RFC 17/31] net: Factor out __dev_alloc_name from dev_alloc_name
type: item
description: Hello Eric, See comments about __dev_alloc_name() below. Regards, Benjamin Eric W. Biederman wrote: > From: Eric W. Biederman <ebiederm@xmission.com> - unquoted > > When forcibly changing the network namespace of a device > I need something that can generate a name for the device > in the new namespace without overwriting the old name. > > __dev_alloc_name provides me that functionality. > > Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> > --- > net/core/dev.c | 44 +++++++++++++++++++++++++++++++++----------- > 1 files changed, 33 insertions(+), 11 deletions(-) > > diff --git a/net/core/dev.c b/net/core/dev.c > index 32fe905..fc0d2af 100644 > --- a/net/core/dev.c > +++ b/net/core/dev.c > @@ -655,9 +655,10 @@ int dev_valid_name(const char *name) > } > > /** > - * dev_alloc_name - allocate a name for a device > - * @dev: device > + * __dev_alloc_name - allocate a name for a device > + * @net: network namespace to allocate the device name in > * @name: name format string > + * @buf: scratch buffer and result name string > * > * Passed a format string - eg "lt%d" it will try and find a suitable > * id. It scans list of devices to build up a free map, then chooses > @@ -668,18 +669,13 @@ int dev_valid_name(const char *name) > * Returns the number of the unit assigned or a negative errno code. > */ > > -int dev_alloc_name(struct net_device *dev, const char *name) > +static int __dev_alloc_name(net_t net, const char *name, char buf[IFNAMSIZ]) IMHO the third parameter should be: char *buf Indeed using "char buf[IFNAMSIZ]" is misleading because later in the routine sizeof(buf) is used (with an expected result of IFNAMSIZ). Unfortunately this is no longer the case: sizeof(buf) value is only 4 now (buf is pointer parameter). This corrupts the registration of network devices (now I understand why only one of my e1000 showed up after each reboot :). Also sizeof(buf) should be replaced by IFNAMSIZ in this new routine. (See below) > { > int i = 0; > - char buf[IFNAMSIZ];…
creator: Benjamin Thery
date: 2007-03-05T15:29:49-00:00

Re: [RFC PATCH 0/31] An introduction and A path for merging network namespace work
type: item
description: Daniel Lezcano <dlezcano@fr.ibm.com> writes: > Eric W. Biederman wrote: > > [ cut ] >> Dmitry? Daniel? What do you think. >> > > Hi Eric, > > I agree with all the points you presented but I am still 50/50 for both > approaches. > > The major argument in favor of the explicit parameter is that it allows > to keep track of the network namespace. But the argument against is it > touchs a lot of files and that can makes the patch less attractive. > Furthermore, everybody should not be aware of what a network namespace > is and should not know how to handle the parameter function. Daniel please look at the patches and see how this interacts. What you describe is how sight unseen one would expect the situation to be however that doesn't seem to match the reality of the code. Besides which a one time big impact is not a problem, for merging code. It is more of a problem for maintaining out of tree patches. > The implicit network namespace has the advantage to reduce considerably > the impact on the code and to have network developer to be unware of the > network virtualization. But in the same way the network developer should > "forget" in which network namespace he is running. Another point is the > race condition we have while doing network namespace switching and that > can make a contention point. Actually this is largely false. The implicit parameter does not do more than remove a few patches. The bulk of the changes are the fundamental changes like the arp cache, the routing tables etc. In general all of the basic data structures. > Concerning the network namespace compile out, that can be done by both > approaches. Agreed. My innovation was finding a way to compile out an explicit parameter. > In the [1/31] patch description, you mention you tryed zero sized > structure on x86_64, and the optimization works for all architectures. > Does it mean, you tested it with s390, PowerPC, ia64, etc ... ? I think my meaning was this: Every where I tested it (i386 (many compile…
creator: ebiederm
date: 2007-03-07T04:53:27-00:00