OpenVZ Forum: Devel » Re: [patch 2/6] [Network namespace] Network device sharing by view

Home » Mailing lists » Devel » Re: [patch 2/6] [Network namespace] Network device sharing by view

Show: Today's Messages :: Show Polls :: Message Navigator
E-mail to friend

Re: strict isolation of net interfaces [message #4171 is a reply to message #4166]

Fri, 30 June 2006 14:20

ebiederm
Messages: 1354
Registered: February 2006

Senior Member

Daniel Lezcano <dlezcano@fr.ibm.com> writes:

> Serge E. Hallyn wrote:
>> Quoting Cedric Le Goater (clg@fr.ibm.com):
>>
>>>we could work on virtualizing the net interfaces in the host, map them to
>>>eth0 or something in the guest and let the guest handle upper network layers ?
>>>
>>>lo0 would just be exposed relying on skbuff tagging to discriminate traffic
>>>between guests.
>> This seems to me the preferable way. We create a full virtual net
>> device for each new container, and fully virtualize the device
>> namespace.
>
> I have a few questions about all the network isolation stuff:

So far I have seen two viable possibilities on the table,
neither of them involve multiple names for a network device.

layer 3 (filtering the allowed ip addresses at bind time roughly the current vserver).
- implementable as a security hook.
- Benefit no measurable performance impact.
- Downside not many things we can do.

layer 2 (What appears to applications a separate instance of the network stack).
- Implementable as a namespace.
- Each network namespace would have dedicated network devices.
- Benefit extremely flexible.
- Downside since at least the slow path must examine the packet
it has the possibility of slowing down the networking stack.

For me the important characteristics.
- Allows for application migration, when we take our ip address with us.
In particular it allows for importation of addresses assignments
mad on other machines.

- No measurable impact on the existing networking when the code
is compiled in.

- Clean predictable semantics.

This whole debate on network devices show up in multiple network namespaces
is just silly. The only reason for wanting that appears to be better management.
We have deeper issues like can we do a reasonable implementation without a
network device showing up in multiple namespaces.

I think the reason the debate exists at all is that it is a very approachable
topic, as opposed to the fundamentals here.

If we can get layer 2 level isolation working without measurable overhead
with one namespace per device it may be worth revisiting things. Until
then it is a side issue at best.

Eric

Report message to a moderator

[Message index]

		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Andrey Savochkin on Tue, 27 June 2006 09:38
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Daniel Lezcano on Tue, 27 June 2006 11:21
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: ebiederm on Tue, 27 June 2006 11:52
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Herbert Poetzl on Tue, 27 June 2006 16:02
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: ebiederm on Tue, 27 June 2006 16:47
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Ben Greear on Tue, 27 June 2006 17:19
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Herbert Poetzl on Tue, 27 June 2006 22:52
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Dave Hansen on Tue, 27 June 2006 23:12
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Alexey Kuznetsov on Tue, 27 June 2006 23:42
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: ebiederm on Wed, 28 June 2006 03:38
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Herbert Poetzl on Wed, 28 June 2006 13:36
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: ebiederm on Wed, 28 June 2006 14:21
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: jamal on Wed, 28 June 2006 13:53
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Sam Vilain on Thu, 29 June 2006 21:07
		strict isolation of net interfaces By: Cedric Le Goater on Thu, 29 June 2006 22:14
		Re: strict isolation of net interfaces By: Sam Vilain on Fri, 30 June 2006 02:48
		Re: strict isolation of net interfaces By: Andrey Savochkin on Mon, 03 July 2006 14:53
		Re: strict isolation of net interfaces By: Sam Vilain on Tue, 04 July 2006 03:00
		Re: strict isolation of net interfaces By: Daniel Lezcano on Tue, 04 July 2006 12:29
		Re: strict isolation of net interfaces By: serue on Fri, 30 June 2006 02:39
		Re: strict isolation of net interfaces By: Cedric Le Goater on Fri, 30 June 2006 08:56
		Re: strict isolation of net interfaces By: Herbert Poetzl on Mon, 03 July 2006 13:36
		Re: strict isolation of net interfaces By: Daniel Lezcano on Fri, 30 June 2006 12:23
		Re: strict isolation of net interfaces By: ebiederm on Fri, 30 June 2006 14:20
		Re: strict isolation of net interfaces By: Daniel Lezcano on Fri, 30 June 2006 15:22
		Re: strict isolation of net interfaces By: ebiederm on Fri, 30 June 2006 17:58
		Re: strict isolation of net interfaces By: serue on Fri, 30 June 2006 16:14
		Re: strict isolation of net interfaces By: ebiederm on Fri, 30 June 2006 17:41
		Re: strict isolation of net interfaces By: ebiederm on Fri, 30 June 2006 18:09
		Re: strict isolation of net interfaces By: Sam Vilain on Tue, 04 July 2006 13:13
		Re: strict isolation of net interfaces By: Daniel Lezcano on Tue, 04 July 2006 13:19
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: jamal on Fri, 30 June 2006 00:15
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Herbert Poetzl on Fri, 30 June 2006 03:35
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Andrey Savochkin on Fri, 30 June 2006 07:45
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: jamal on Fri, 30 June 2006 13:50
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Andrey Savochkin on Fri, 30 June 2006 15:01
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: ebiederm on Fri, 30 June 2006 18:22
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: jamal on Fri, 30 June 2006 21:51
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: ebiederm on Sat, 01 July 2006 00:50
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: ebiederm on Wed, 28 June 2006 14:51
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Alexey Kuznetsov on Tue, 27 June 2006 16:49
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Andrey Savochkin on Tue, 27 June 2006 11:55

Previous Topic:	Re: [Vserver] Re: Container Test Campaign
Next Topic:	porting stable patch to higher kernel versions

Goto Forum:

-=] Back to Top [=-

[ Syndicate this forum (XML) ] [

] [

]

Current Time: Thu Jan 15 05:44:10 GMT 2026

Total time taken to generate the page: 0.45375 seconds