[vserver] Network isolation and VServer

From: Daniel Risacher <drisacher_at_gmail.com>
Date: Tue 23 Oct 2007 - 03:46:39 BST
Message-ID: <a3ff00ac0710221946l6cd89cdfj6aa01f58455b86a8@mail.gmail.com>

My apologies in advance if this is re-opening old wounds.

I recently set up VServer (mainly so I could run Zimbra w/ less pain)
and I found that the network isolation did not work the way I
(perhaps naively?) expected it to. (Mainly re: binding to TCP ports
and IPADDR_ANY.)

I write this message to (1) determine whether my understanding of
VServer's functionality is correct, and possibly (2) suggest potential
improvements for discussion.

How I think it DOES work
------------------------

* Host processes that bind to IPADDR_ANY can recieve connections to any
  host or guest address

* Guest processes that bund to IPADDR_ANY show as having been bound to
  the guest primary IP address, but can receive connections to the
  localhost address that come from the same guest.

* Bind attempts to IPADDR_ANY from the host will fail if a guest is
  already listening on that port

* Bind attempts to IPADDR_ANY from a guest will fail if the host is
  already listening to IPADDR_ANY on that port

* Connection attempts to "localhost" from a guest can be answered by
  the host.

How I think it SHOULD work
--------------------------

I start from the general assumption that a virtual machine should seem
like an isolated, independent machine as much as possible. It seems
to be a desirable goal to minimize the amount of application-level
configuration tomfoolery that is required. Based on this...

* Bind attempts to IPADDR_ANY should not fail based on something
  happening in a different security context. I.e. Bind attempts to
  IPADDR_ANY from the host should be able to succeed, even if a guest
  is already listening on that port, and likewise bind attempts to
  IPADDR_ANY from a guest should be able to succeed, even if the host
  is already listening to IPADDR_ANY

* Processes listening on IPADDR_ANY should receive connections to any
  IP address that are set up for that virtual machine (be it the host
  or a guest).

Questions
---------
So, given the above discussion, here are my questions:

Do I mis-understand or mis-state how VServer functions today?

Is my proposed alternative functionality "better", or is there some
reason why today's behaviour is "better"?

How could we implement a more robust version of network isolation?
Has any work been done in this area previously?

How do the other virtualization environments handle this sort of
thing?

Thanks for the consideration,
Dan Risacher
Received on Tue Oct 23 03:46:51 2007

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Tue 23 Oct 2007 - 03:46:55 BST by hypermail 2.1.8