Subject: Re: [vserver] Network isolation and VServer
From: Daniel Hokka Zakrisson <daniel@hozac.com>
Date: Wed, 24 Oct 2007 13:56:14 +0200

Daniel Risacher wrote:
> My apologies in advance if this is re-opening old wounds.
> 
> I recently set up VServer (mainly so I could run Zimbra w/ less pain)
> and I found that the network isolation did not work the way I
> (perhaps naively?) expected it to.  (Mainly re: binding to TCP ports
> and IPADDR_ANY.)
> 
> I write this message to (1) determine whether my understanding of
> VServer's functionality is correct, and possibly (2) suggest potential
> improvements for discussion.
> 
> How I think it DOES work
> ------------------------
> 
> * Host processes that bind to IPADDR_ANY can recieve connections to any
>   host or guest address
> 
> * Guest processes that bund to IPADDR_ANY show as having been bound to
>   the guest primary IP address, but can receive connections to the
>   localhost address that come from the same guest.

This is just an optimization that kicks in if your guest only has one 
address, it significantly speeds up the lookups.

> * Bind attempts to IPADDR_ANY from the host will fail if a guest is
>   already listening on that port
> 
> * Bind attempts to IPADDR_ANY from a guest will fail if the host is
>   already listening to IPADDR_ANY on that port
> 
> * Connection attempts to "localhost" from a guest can be answered by
>   the host.
> 
> How I think it SHOULD work
> --------------------------
> 
> I start from the general assumption that a virtual machine should seem
> like an isolated, independent machine as much as possible.  It seems
> to be a desirable goal to minimize the amount of application-level
> configuration tomfoolery that is required.  Based on this...

You only have to configure the host, which shouldn't really be running 
any services in the first place.

> * Bind attempts to IPADDR_ANY should not fail based on something
>   happening in a different security context.  I.e.  Bind attempts to
>   IPADDR_ANY from the host should be able to succeed, even if a guest
>   is already listening on that port, and likewise bind attempts to
>   IPADDR_ANY from a guest should be able to succeed, even if the host
>   is already listening to IPADDR_ANY

So when someone connects to it, where should they be directed? You can't 
have multiple listeners on the same IP:port pairs, when the contexts 
overlap.

> * Processes listening on IPADDR_ANY should receive connections to any
>   IP address that are set up for that virtual machine (be it the host
>   or a guest).

The host does not have a context. How would you expect that to work?

> Questions
> ---------
> So, given the above discussion, here are my questions:
> 
> Do I mis-understand or mis-state how VServer functions today?
> 
> Is my proposed alternative functionality "better", or is there some
> reason why today's behaviour is "better"?

It just goes against the general Linux-VServer paradigm. As far as 
possible, we do isolation by limiting the guest to a subset of the 
host's resources. As such, limiting the host's ability to use the IP 
addresses it wants is just not something that fits in.

> How could we implement a more robust version of network isolation?
> Has any work been done in this area previously? 

I don't get what robust means in this context.

> How do the other virtualization environments handle this sort of
> thing?

OpenVZ and the containers people use virtualized network stacks for the 
guests, which I consider to be too much overhead (both performance and 
configuration wise).

> Thanks for the consideration,
> Dan Risacher

-- 
Daniel Hokka Zakrisson