Daniel Risacher wrote: > My apologies in advance if this is re-opening old wounds. > > I recently set up VServer (mainly so I could run Zimbra w/ less pain) > and I found that the network isolation did not work the way I > (perhaps naively?) expected it to. (Mainly re: binding to TCP ports > and IPADDR_ANY.) > > I write this message to (1) determine whether my understanding of > VServer's functionality is correct, and possibly (2) suggest potential > improvements for discussion. > > How I think it DOES work > ------------------------ > > * Host processes that bind to IPADDR_ANY can recieve connections to any > host or guest address > > * Guest processes that bund to IPADDR_ANY show as having been bound to > the guest primary IP address, but can receive connections to the > localhost address that come from the same guest. This is just an optimization that kicks in if your guest only has one address, it significantly speeds up the lookups. > * Bind attempts to IPADDR_ANY from the host will fail if a guest is > already listening on that port > > * Bind attempts to IPADDR_ANY from a guest will fail if the host is > already listening to IPADDR_ANY on that port > > * Connection attempts to "localhost" from a guest can be answered by > the host. > > How I think it SHOULD work > -------------------------- > > I start from the general assumption that a virtual machine should seem > like an isolated, independent machine as much as possible. It seems > to be a desirable goal to minimize the amount of application-level > configuration tomfoolery that is required. Based on this... You only have to configure the host, which shouldn't really be running any services in the first place. > * Bind attempts to IPADDR_ANY should not fail based on something > happening in a different security context. I.e. Bind attempts to > IPADDR_ANY from the host should be able to succeed, even if a guest > is already listening on that port, and likewise bind attempts to > IPADDR_ANY from a guest should be able to succeed, even if the host > is already listening to IPADDR_ANY So when someone connects to it, where should they be directed? You can't have multiple listeners on the same IP:port pairs, when the contexts overlap. > * Processes listening on IPADDR_ANY should receive connections to any > IP address that are set up for that virtual machine (be it the host > or a guest). The host does not have a context. How would you expect that to work? > Questions > --------- > So, given the above discussion, here are my questions: > > Do I mis-understand or mis-state how VServer functions today? > > Is my proposed alternative functionality "better", or is there some > reason why today's behaviour is "better"? It just goes against the general Linux-VServer paradigm. As far as possible, we do isolation by limiting the guest to a subset of the host's resources. As such, limiting the host's ability to use the IP addresses it wants is just not something that fits in. > How could we implement a more robust version of network isolation? > Has any work been done in this area previously? I don't get what robust means in this context. > How do the other virtualization environments handle this sort of > thing? OpenVZ and the containers people use virtualized network stacks for the guests, which I consider to be too much overhead (both performance and configuration wise). > Thanks for the consideration, > Dan Risacher -- Daniel Hokka Zakrisson