dash700@excite.com wrote:
> Hello VServer experts!
>
> I'm working on a project that uses VServer to provide application
> isolation functionality. As part of the development we came across a
> problem supporting multicast binding from inside vserver unless NET_ADMIN
> capability is turned on. It appears that VServer treats multicast
> addresses as any other network address. So in order to allow multicast
> addresses in vserver they need to be a part of NX_INFO list. This list can
> become quite large if all multicast address space is included.
If you use Linux-VServer 2.3, you could just do naddress --nid <guest>
--add --mask 224.0.0.0/4. I don't see how CAP_NET_ADMIN would let you get
around the address restrictions though.
> I've looked at af_inet.c code and it appears that it's easy to provide
> multicast support if multicast addresses are differentiated from the rest
> of the address space. I believe this is safe to do because multicast
> addresses are handled differently by the kernel than normal IP addresses.
> I've attached a patch against a stable VServer release and 2.6.22 kernel
> that provides multicast support to vservers without NET_ADMIN capability.
>
> Would it be possible to review this patch for any criticism and possibly
> inclusion into upcoming stable VServer release if it is useful?
>
> multicast-plain.diff : Kernel patch
This would need a network context capability, at least.
> demo_mc_bind.c : C program that demonstrates lack of multicast support
> inside VServer
>
> Thank you in advance!
>
> Sincerely,
> Artem Dmytrenko
-- Daniel Hokka ZakrissonReceived on Fri Mar 28 20:32:32 2008