lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Mon, 30 Nov 2009 21:15:00 +0100
From:	Patrick McHardy <>
To:	Benjamin LaHaise <>
CC:	Ben Greear <>,
	"Eric W. Biederman" <>,
Subject: Re: RFC: net 00/05: routing based send-to-self implementation

Benjamin LaHaise wrote:
> On Mon, Nov 30, 2009 at 11:37:31AM -0800, Ben Greear wrote:
>> This doesn't work if you want to have one application manage lots of 
>> interfaces and send traffic between these interfaces.  Certainly there are 
>> use-cases that can use multiple name-spaces, but it's nice to have the 
>> option not to use them as well.
> Actually, it's quite doable from within one application.  An application 
> I recently adapted to make use of multiple network namespaces within a single 
> process by way of pthreads and unshare(CLONE_NEWNET).  The scheme I used 
> is to just open the socket in a new namespace in a thread.  Since the 
> file descriptor table is still shared, it's easy to send/receive data from 
> any other thread, regardless of which virtual network namespace it's in.  
> All told, setting up virtual routers with namespaces is pretty easy.

Yes, that works for creating sockets. Its gets more complicated
though if you want to change network configuration of those devices
once created and moved to a different namespace. Besides that you
might have to replicate your other configuration, like iptables rules,
routing rules and routes, xfrm policies etc.
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to
More majordomo info at

Powered by blists - more mailing lists