Subject: Re: [vserver] network issues with lo interface
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Wed, 25 Feb 2009 19:03:29 +0100

On Mon, Feb 23, 2009 at 10:45:52AM +1300, Corin Langosch wrote:
> On 23.02.2009 06:32, Michael S. Zick wrote:
> > In general, that is just the way "host local" is done in the network
> > stack. "host" here being the usage in network terminology. Both
> > "127.0.0.1" and the assigned machine IP address the same machine
> > Call it a feature.

> > In the newer VServer setups, you have the *option* to give each "guest"
> > an "lo A.K.A: 127.0.0.0/8" interface.

> > So, more info needed:

> > what context where you in (VServer host or Vserver guest) when you 
> > typed the telnet command?

> I did everything, except the tcpdump, from inside the same guest.  
> I just did it again and now the output looks even more strange 
> (to me):

> firewall (dropped):IN=lo OUT=
> MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=55.31.151.23
> DST=127.179.126.1 LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=61080 DF PROTO=TCP
> SPT=44517 DPT=4456 WINDOW=32792 RES=0x00 SYN URGP=0

> It seems the "real" IP of the guest is chosen this time to connect to
> the local interface, not even a random 127.0.0.1/8 one.

so?

> > how did you configure the VServer kernel?  Isolated lo or not?
> I didn't build the kernel myself, I use the precompiled one from debian.
> The config looks like this
> ~# cat /boot/config-2.6.26-1-vserver-amd64 | grep -i vser
> # Linux VServer
> CONFIG_VSERVER_AUTO_LBACK=y
> # CONFIG_VSERVER_AUTO_SINGLE is not set
> CONFIG_VSERVER_COWBL=y
> # CONFIG_VSERVER_VTIME is not set
> # CONFIG_VSERVER_DEVICE is not set
> CONFIG_VSERVER_PROC_SECURE=y
> CONFIG_VSERVER_HARDCPU=y
> CONFIG_VSERVER_IDLETIME=y
> CONFIG_VSERVER_IDLELIMIT=y
> CONFIG_VSERVER_PRIVACY=y
> CONFIG_VSERVER_CONTEXTS=768
> CONFIG_VSERVER_WARN=y
> # CONFIG_VSERVER_DEBUG is not set
> CONFIG_VSERVER=y
> CONFIG_VSERVER_SECURITY=y

> Is it correct that 127.0.0.1/8 is local to each vserver 

nope, but 127.0.0.1/8 will be remapped to the lback
address (which is unique for each context, unless
you change it)

> and so adding a general rule like

> $IPTABLES -A INPUT -d 127.0.0.0/8 -i lo -j ACCEPT

> is safe and doesn't expose any security flaws between 
> different vserver guests?

what kind of 'security flaws' do you have to be exposed?

best,
Herbert

> Thanks,
> Corin