OpenVZ Forum: Devel » Re: [patch 2/6] [Network namespace] Network device sharing by view

Home » Mailing lists » Devel » Re: [patch 2/6] [Network namespace] Network device sharing by view

Show: Today's Messages :: Show Polls :: Message Navigator
E-mail to friend

Re: strict isolation of net interfaces [message #4181 is a reply to message #4166]

Fri, 30 June 2006 18:09

ebiederm
Messages: 1354
Registered: February 2006

Senior Member

Daniel Lezcano <dlezcano@fr.ibm.com> writes:

> Serge E. Hallyn wrote:
>> Quoting Cedric Le Goater (clg@fr.ibm.com):
>>
>>>we could work on virtualizing the net interfaces in the host, map them to
>>>eth0 or something in the guest and let the guest handle upper network layers ?
>>>
>>>lo0 would just be exposed relying on skbuff tagging to discriminate traffic
>>>between guests.
>> This seems to me the preferable way. We create a full virtual net
>> device for each new container, and fully virtualize the device
>> namespace.
>

Answers with respect to how I see layer 2 isolation,
with network devices and sockets as well as the associated routing
information given per namespace.

> I have a few questions about all the network isolation stuff:
>
> * What level of isolation is wanted for the network ? network devices ?
> IPv4/IPv6 ? TCP/UDP ?
>
> * How is handled the incoming packets from the network ? I mean what will be
> mecanism to dispatch the packet to the right virtual device ?

Wrong question. A better question is to ask how do you know which namespace
a packet is in.
Answer: By looking at which device or socket it just came from.

How do you get a packet into a non-default namespace?
Either you move a real network interface into that namespace.
Or you use a tunnel device that shows up as two network interfaces in
two different namespaces.

Then you route, or bridge packets between the two. Trivial.

> * How to handle the SO_BINDTODEVICE socket option ?

Just like we do now.

> * Has the virtual device a different MAC address ?

All network devices are abstractions of the hardware so they are all
sort of virtual. My implementation of a tunnel device has a mac
address so I can use it with ethernet bridging but that isn't a hard
requirement. And yes the mac address is different because you can't
do layer 2 switching if everyone has the same mac address.

But there is no special ``virtual'' device.

> How to manage it with the real MAC address on the system ?
Manage?

> How to manage ARP, ICMP, multicasting and IP ?

Like you always do. It would be a terrible implementation if
we had to change that logic. There is a little bit of that
where we need to detect which network namespace we are going to because
the answers can differ but that is pretty straight forward.

> It seems for me, IMHO that will require a lot of translation and browsing
> table. It will probably add a very significant overhead.

Then look at:
git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/linux -2.6-ns.git#proof-of-concept
or the OpenVZ implementation.

It isn't serious overhead.

> * How to handle NFS access mounted outside of the container ?

The socket should remember it's network namespace.
It works fine.

> * How to handle ICMP_REDIRECT ?

Just like we always do?

Eric

Report message to a moderator

[Message index]

		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Andrey Savochkin on Tue, 27 June 2006 09:38
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Daniel Lezcano on Tue, 27 June 2006 11:21
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: ebiederm on Tue, 27 June 2006 11:52
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Herbert Poetzl on Tue, 27 June 2006 16:02
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: ebiederm on Tue, 27 June 2006 16:47
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Ben Greear on Tue, 27 June 2006 17:19
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Herbert Poetzl on Tue, 27 June 2006 22:52
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Dave Hansen on Tue, 27 June 2006 23:12
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Alexey Kuznetsov on Tue, 27 June 2006 23:42
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: ebiederm on Wed, 28 June 2006 03:38
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Herbert Poetzl on Wed, 28 June 2006 13:36
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: ebiederm on Wed, 28 June 2006 14:21
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: jamal on Wed, 28 June 2006 13:53
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Sam Vilain on Thu, 29 June 2006 21:07
		strict isolation of net interfaces By: Cedric Le Goater on Thu, 29 June 2006 22:14
		Re: strict isolation of net interfaces By: Sam Vilain on Fri, 30 June 2006 02:48
		Re: strict isolation of net interfaces By: Andrey Savochkin on Mon, 03 July 2006 14:53
		Re: strict isolation of net interfaces By: Sam Vilain on Tue, 04 July 2006 03:00
		Re: strict isolation of net interfaces By: Daniel Lezcano on Tue, 04 July 2006 12:29
		Re: strict isolation of net interfaces By: serue on Fri, 30 June 2006 02:39
		Re: strict isolation of net interfaces By: Cedric Le Goater on Fri, 30 June 2006 08:56
		Re: strict isolation of net interfaces By: Herbert Poetzl on Mon, 03 July 2006 13:36
		Re: strict isolation of net interfaces By: Daniel Lezcano on Fri, 30 June 2006 12:23
		Re: strict isolation of net interfaces By: ebiederm on Fri, 30 June 2006 14:20
		Re: strict isolation of net interfaces By: Daniel Lezcano on Fri, 30 June 2006 15:22
		Re: strict isolation of net interfaces By: ebiederm on Fri, 30 June 2006 17:58
		Re: strict isolation of net interfaces By: serue on Fri, 30 June 2006 16:14
		Re: strict isolation of net interfaces By: ebiederm on Fri, 30 June 2006 17:41
		Re: strict isolation of net interfaces By: ebiederm on Fri, 30 June 2006 18:09
		Re: strict isolation of net interfaces By: Sam Vilain on Tue, 04 July 2006 13:13
		Re: strict isolation of net interfaces By: Daniel Lezcano on Tue, 04 July 2006 13:19
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: jamal on Fri, 30 June 2006 00:15
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Herbert Poetzl on Fri, 30 June 2006 03:35
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Andrey Savochkin on Fri, 30 June 2006 07:45
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: jamal on Fri, 30 June 2006 13:50
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Andrey Savochkin on Fri, 30 June 2006 15:01
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: ebiederm on Fri, 30 June 2006 18:22
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: jamal on Fri, 30 June 2006 21:51
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: ebiederm on Sat, 01 July 2006 00:50
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: ebiederm on Wed, 28 June 2006 14:51
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Alexey Kuznetsov on Tue, 27 June 2006 16:49
		Re: [patch 2/6] [Network namespace] Network device sharing by view By: Andrey Savochkin on Tue, 27 June 2006 11:55

Previous Topic:	Re: [Vserver] Re: Container Test Campaign
Next Topic:	porting stable patch to higher kernel versions

Goto Forum:

-=] Back to Top [=-

[ Syndicate this forum (XML) ] [

] [

]

Current Time: Sat Apr 11 14:51:54 GMT 2026

Total time taken to generate the page: 0.48103 seconds