Subject: Re: [vserver] Multicast support in vserver
From: "" <dash700@excite.com>
Date: Fri, 28 Mar 2008 02:52:19 -0400 (EDT)


Thanks for the suggestion! But isn't Linux VServer 2.3 still a development release?
When will it be considered stable and recommended for production use?

I was really recommending a patch for a stable (2.2) releases where this functionality
is not available at the moment. So are you recommending to wrap this patch in an extra
capability? If so would NET_BROADCAST from Posix caps cover this capability? Or would
you really recommend defining a new network context capability.

Thanks in advance!

Sincerely,
Artem Dmytrenko


 --- On Fri 03/28, Daniel Hokka Zakrisson < daniel@hozac.com > wrote:
From: Daniel Hokka Zakrisson [mailto: daniel@hozac.com]
To: vserver@list.linux-vserver.org
Date: Fri, 28 Mar 2008 06:42:12 +0100 (CET)
Subject: Re: [vserver] Multicast support in vserver

dash700@excite.com wrote:>  Hello VServer experts!>> I'm working on a project that uses
VServer to provide application> isolation functionality. As part of the development
we came across a> problem supporting multicast binding from inside vserver unless NET_ADMIN>
capability is turned on. It appears that VServer treats multicast> addresses as any
other network address. So in order to allow multicast> addresses in vserver they need
to be a part of NX_INFO list. This list can> become quite large if all multicast address
space is included.If you use Linux-VServer 2.3, you could just do naddress --nid <guest>--add
--mask 224.0.0.0/4. I don't see how CAP_NET_ADMIN would let you getaround the address
restrictions though.> I've looked at af_inet.c code and it appears that it's easy to
provide> multicast support if multicast addresses are differentiated from the rest>
of the address space. I believe this is safe to do because multicast> addresses are
handled differently by the kernel 
than normal IP addresses.> I've attached a patch against a stable VServer release and
2.6.22 kernel> that provides multicast support to vservers without NET_ADMIN capability.>>
Would it be possible to review this patch for any criticism and possibly> inclusion
into upcoming stable VServer release if it is useful?>> multicast-plain.diff : Kernel
patchThis would need a network context capability, at least.> demo_mc_bind.c : C program
that demonstrates lack of multicast support> inside VServer>> Thank you in advance!>>
Sincerely,> Artem Dmytrenko-- Daniel Hokka Zakrisson

_______________________________________________
Join Excite! - http://www.excite.com
The most personalized portal on the Web!