netdev - Re: Trying to implement secondary loopback

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 15 Mar 2013 18:36:02 +0000
From:	Ben Hutchings <bhutchings@...arflare.com>
To:	Thomas Martitz <thomas.martitz@....fraunhofer.de>
CC:	"Eric W. Biederman" <ebiederm@...ssion.com>,
	richard -rw- weinberger <richard.weinberger@...il.com>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	"davem@...emloft.net" <davem@...emloft.net>,
	"edumazet@...gle.com" <edumazet@...gle.com>,
	"herbert@...dor.apana.org.au" <herbert@...dor.apana.org.au>
Subject: Re: Trying to implement secondary loopback

On Fri, 2013-03-15 at 08:30 +0100, Thomas Martitz wrote:
> Am 13.03.2013 22:21, schrieb Eric W. Biederman:
> > "Martitz, Thomas" <thomas.martitz@....fraunhofer.de> writes:
> >
> >>> Von: Eric W. Biederman [ebiederm@...ssion.com]
> >>>
> >>> The easy solution is to setup two network namespaces and two nics.
> >>> And transmit data from one network namespace to another, through your
> >>> nics.
> >
> >>
> >> That sounds a lot more involed than using loopback to send data back
> >> to the same process. And I guess just calling netif_rx() in the xmit()
> >> function wouldn't be sufficient either? Also I wouldn't know how to do
> >> that as I'm not yet very familiar with network namespaces (but that
> >> can clearly get fixed).
> >
> > It may sound involved but it is just a few lines of code to set up.
> >
> > ip netns add ns1
> > ip netns add ns2
> > ip link set nic1 netns ns1
> > ip link set nic2 netns ns2
> >
> > int main(int argc, char **argv)
> > {
> >          int netfd1, netfd2;
> >          int sk1, sk2;
> > 	netfd1 = open(/var/run/netns/nic1);
> > 	netfd2 = open(/var/run/netns/nic2);
> >
> > 	setns(netfd1, 0);
> > 	sk1 = socket(...);
> >
> >          setns(netfd2, 0);
> >          sk2 = socket(...);
> >
> >          /* test test test */
> > }
> >
> > And what is partidcularly interesting is that all of this works with
> > your drivers normal code paths without any kernel hacks.
> >
> > Eric
> >
> 
> 
> I have trouble understanding this approach. Does it mean that I have to 
> expose two interfaces from my kernel module. I.e. call register_netdev() 
> twice?
[...]

Perhaps you can use macvlan for this.  Create one net device in your
driver, then use macvlan to stack two net devices on top of it using
different MAC addresses.  I think you'll need to configure them in VEPA
mode so that macvlan doesn't bridge them.

As an alternative to network namespaces, you might find it easier to
assign one or both net devices to virtual machines.  virt-manager and
virsh can set up KVM virtual machines using macvlan/macvtap interfaces.

Ben.

-- 
Ben Hutchings, Staff Engineer, Solarflare
Not speaking for my employer; that's the marketing department's job.
They asked us to note that Solarflare product names are trademarked.

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html