Re: [vserver] assigning less than /64 to individual guests

----- Forwarded message from Michael Richardson <mcr@sandelman.ca> -----

From: Michael Richardson <mcr@sandelman.ca>
Date: Tue, 17 May 2011 16:12:35 -0400
To: Eugen Leitl <eugen@leitl.org>
cc: debian-ipv6@lists.debian.org
Subject: Re: [vserver] assigning less than /64 to individual guests
X-Mailer: MH-E 8.1; nmh 1.1; XEmacs 21.4 (patch 22)

>>>>> "Eugen" == Eugen Leitl <eugen@leitl.org> writes:
>> If you are saying that you will allocate /80s to each vserver,
>> but actually they will not be layer-2 isolated from each other,
>> this is just an administrative partition, then I think it's a
>> good idea.

    Eugen> The Linux vserver patch is a very lightweight
    Eugen> virtualization. It doesn't share the network stack, shares
    Eugen> the physical NIC MAC and only recently were the vserver
    Eugen> guests given 127.0.0.1 that is distinct from the host's
    Eugen> localhost -- as far as I known ::1 hasn't been given that
    Eugen> treatment yet.

Yes, I know it well, because it added lots of namespace arguments inside
the kernel to lots of network code (like IPsec). The list of IP
addresses is per-vserver, but the list of interfaces is not.
Do the containers share the same mac address? I think so, right?

Or do you have a virtual interface adapter per vserver with a fake mac
address?

    Eugen> How much autoconfig do I need? Each physical host will be
    Eugen> given a private /64 (out of the /56 I have total), just the
    Eugen> guests will be given an /80, allocated from a different /64.

I think you can just give out a seperate /80, and since you won't care
about privacy extensions for a link that nobody can see or use, you
leave them off, and arrange for bit 6 to always be 0. Allocate your
/80s out of the prefix:0000::/71. Is 512 vservers per physical host enough?

    Eugen> I'm not really familiar with IPv6 advanced uses, at the
    Eugen> moment I'm treating it just like a bigger version of IPv4, at
    Eugen> least as far as guests are concerned. I don't really know
    Eugen> what users would want to run on their own /80s

If I had such a system, I'd want to put each of my HTTP 1.1 virtual
hosts on a seperate IPv6 address, assuming that I didn't have seperate
vservers already. Why? Because it sure makes it easier to host
different sensitivities of content (adult vs child friendly).

I'd want the mail, pop3, imap, ftp, and ssh targets to be different,
because that would like me move them around as it might make sense.

And of course, SSL port 443 (and IMAPS, and SMTPS and...) can now have
sensible CNs that match the name in DNS.

>> Permitting autoconfig to work seems like a nice thing to retain.

    Eugen> If the guests can all use the host's (different) /64, will
    Eugen> that work?

I think that you just want autoconfig to work well enough so that if you
install a new machine in the rack, it can autoconfig up an address
easily, and you can finish the install via ssh :-)

-- 
]       He who is tired of Weird Al is tired of life!           |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] mcr_at_sandelman.ottawa.on.ca http://www.sandelman.ottawa.on.ca/ |device driver[
   Kyoto Plus: watch the video <http://www.youtube.com/watch?v=kzx1ycLXQSE>
	               then sign the petition. 
----- End forwarded message -----
-- 
Eugen* Leitl leitl http://leitl.org
______________________________________________________________
ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org
8B29F6BE: 099D 78BA 2FD3 B014 B08A  7779 75B0 2443 8B29 F6BE