Re: [vserver] Multicast support in vserver

From: Daniel Hokka Zakrisson <daniel_at_hozac.com>
Date: Fri 28 Mar 2008 - 05:42:12 GMT
Message-ID: <48746.192.168.101.12.1206682932.squirrel@intranet>

dash700@excite.com wrote:
> Hello VServer experts!
>
> I'm working on a project that uses VServer to provide application
> isolation functionality. As part of the development we came across a
> problem supporting multicast binding from inside vserver unless NET_ADMIN
> capability is turned on. It appears that VServer treats multicast
> addresses as any other network address. So in order to allow multicast
> addresses in vserver they need to be a part of NX_INFO list. This list can
> become quite large if all multicast address space is included.

If you use Linux-VServer 2.3, you could just do naddress --nid <guest>
--add --mask 224.0.0.0/4. I don't see how CAP_NET_ADMIN would let you get
around the address restrictions though.

> I've looked at af_inet.c code and it appears that it's easy to provide
> multicast support if multicast addresses are differentiated from the rest
> of the address space. I believe this is safe to do because multicast
> addresses are handled differently by the kernel than normal IP addresses.
> I've attached a patch against a stable VServer release and 2.6.22 kernel
> that provides multicast support to vservers without NET_ADMIN capability.
>
> Would it be possible to review this patch for any criticism and possibly
> inclusion into upcoming stable VServer release if it is useful?
>
> multicast-plain.diff : Kernel patch

This would need a network context capability, at least.

> demo_mc_bind.c : C program that demonstrates lack of multicast support
> inside VServer
>
> Thank you in advance!
>
> Sincerely,
> Artem Dmytrenko

-- 
Daniel Hokka Zakrisson
Received on Fri Mar 28 20:32:32 2008
[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Fri 28 Mar 2008 - 20:32:35 GMT by hypermail 2.1.8