Subject: Re: [vserver] network issues with lo interface
From: Corin Langosch <corinl@gmx.de>
Date: Mon, 23 Feb 2009 10:45:52 +1300

On 23.02.2009 06:32, Michael S. Zick wrote:
> In general, that is just the way "host local" is done in the network stack.
> "host" here being the usage in network terminology.
> Both "127.0.0.1" and the assigned machine IP address the same machine.
> Call it a feature.
>
> In the newer VServer setups, you have the *option* to give each "guest"
> an "lo A.K.A: 127.0.0.0/8" interface.
>
> So, more info needed:
>
> what context where you in (VServer host or Vserver guest) when you 
> typed the telnet command?
>   
I did everything, except the tcpdump, from inside the same guest.  I
just did it again and now the output looks even more strange (to me):

firewall (dropped):IN=lo OUT=
MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=55.31.151.23
DST=127.179.126.1 LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=61080 DF PROTO=TCP
SPT=44517 DPT=4456 WINDOW=32792 RES=0x00 SYN URGP=0

It seems the "real" IP of the guest is chosen this time to connect to
the local interface, not even a random 127.0.0.1/8 one.
> how did you configure the VServer kernel?  Isolated lo or not?
I didn't build the kernel myself, I use the precompiled one from debian.
The config looks like this
~# cat /boot/config-2.6.26-1-vserver-amd64 | grep -i vser
# Linux VServer
CONFIG_VSERVER_AUTO_LBACK=y
# CONFIG_VSERVER_AUTO_SINGLE is not set
CONFIG_VSERVER_COWBL=y
# CONFIG_VSERVER_VTIME is not set
# CONFIG_VSERVER_DEVICE is not set
CONFIG_VSERVER_PROC_SECURE=y
CONFIG_VSERVER_HARDCPU=y
CONFIG_VSERVER_IDLETIME=y
CONFIG_VSERVER_IDLELIMIT=y
CONFIG_VSERVER_PRIVACY=y
CONFIG_VSERVER_CONTEXTS=768
CONFIG_VSERVER_WARN=y
# CONFIG_VSERVER_DEBUG is not set
CONFIG_VSERVER=y
CONFIG_VSERVER_SECURITY=y

Is it correct that 127.0.0.1/8 is local to each vserver and so adding a
general rule like

$IPTABLES -A INPUT -d 127.0.0.0/8 -i lo -j ACCEPT

is safe and doesn't expose any security flaws between different vserver
guests?

Thanks,
Corin