Thu, 27 Mar 2008 20:06:13 -0400 (EDT)
Hello VServer experts!
I'm working on a project that uses VServer to provide application isolation functionality.
As part of the development we came across a problem supporting multicast binding from
inside vserver unless NET_ADMIN capability is turned on. It appears that VServer treats
multicast addresses as any other network address. So in order to allow multicast addresses
in vserver they need to be a part of NX_INFO list. This list can become quite large
if all multicast address space is included.
I've looked at af_inet.c code and it appears that it's easy to provide multicast support
if multicast addresses are differentiated from the rest of the address space. I believe
this is safe to do because multicast addresses are handled differently by the kernel
than normal IP addresses. I've attached a patch against a stable VServer release and
2.6.22 kernel that provides multicast support to vservers without NET_ADMIN capability.
Would it be possible to review this patch for any criticism and possibly inclusion into
upcoming stable VServer release if it is useful?
multicast-plain.diff : Kernel patch
demo_mc_bind.c : C program that demonstrates lack of multicast support inside VServer
Thank you in advance!
Sincerely,
Artem Dmytrenko
_______________________________________________
Join Excite! - http://www.excite.com
The most personalized portal on the Web!
["application/octet-stream" not shown]
["application/octet-stream" not shown]