netdev - Re: RFC: net 00/05: routing based send-to-self implementation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4B1427C4.3090509@trash.net>
Date:	Mon, 30 Nov 2009 21:15:00 +0100
From:	Patrick McHardy <kaber@...sh.net>
To:	Benjamin LaHaise <bcrl@...et.ca>
CC:	Ben Greear <greearb@...delatech.com>,
	"Eric W. Biederman" <ebiederm@...ssion.com>, netdev@...r.kernel.org
Subject: Re: RFC: net 00/05: routing based send-to-self implementation

Benjamin LaHaise wrote:
> On Mon, Nov 30, 2009 at 11:37:31AM -0800, Ben Greear wrote:
>> This doesn't work if you want to have one application manage lots of 
>> interfaces and send traffic between these interfaces.  Certainly there are 
>> use-cases that can use multiple name-spaces, but it's nice to have the 
>> option not to use them as well.
> 
> Actually, it's quite doable from within one application.  An application 
> I recently adapted to make use of multiple network namespaces within a single 
> process by way of pthreads and unshare(CLONE_NEWNET).  The scheme I used 
> is to just open the socket in a new namespace in a thread.  Since the 
> file descriptor table is still shared, it's easy to send/receive data from 
> any other thread, regardless of which virtual network namespace it's in.  
> All told, setting up virtual routers with namespaces is pretty easy.

Yes, that works for creating sockets. Its gets more complicated
though if you want to change network configuration of those devices
once created and moved to a different namespace. Besides that you
might have to replicate your other configuration, like iptables rules,
routing rules and routes, xfrm policies etc.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html