Slashdot Mirror
Network Stack Cloning Updates on FreeBSD
Dan writes "Network stack cloning patches on FreeBSD allow for multiple fully independent network stacks to simultaneously coexist in a single FreeBSD kernel. Marko Zec has prepared a latest snapshot of the patches (against 4.8-RELEASE). The latest snapshot includes (a) internal restructuring - - struct vimage is now separated in resource-specific containers, and (b) Kernel message buffers - each vimage / vprocg now has a private kernel message buffer instance. Julian Elischer gave a talk on this subject at the USENIX Annual Technical Conference (FreeNIX track) in San Antonio, TX, June 2003. Marko's slides were presented at BSDCon Europe 2002 in Amsterdam."
Like many of the new ideas in the BSDs (private namespaces as chroot for instance), the idea of separate networks stacks is taken from plan9.
It is even possible in plan9 to use the network stack of a remote machine as your own.
Using sshnet one can do "sshnet remote_host" then all subsequent network activity for the current process group and any children will use the remote hosts' network stack as though it were local.
In this way one can run tcp listeners on a remote machine (on IP N) that deny requests from anything but the IP N and leave SSH as the only external listener. No special tunnelling hoops to jump through.
Monolithic kernels are dying.
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
amen to that!
/net /net
one hasn't truly lived until they've done an:
import somewhere.far.away
Trolling is an ancient artform, you my freind are a spammer. Learn the way of the troll and you can help others come to new realisations, elightening the world.
The troll is outcast, he is forever the outsider commited to the outside. When the reality changes, so does the troll. In this sense a troll is like water, changing his position as the rock moves. You have yet to change your nappies.
When someone is about to snap the troll pushes a little harder till he hears cracking, then stops. The victim of the trolling can then see the cracks, and has the spinal mobility to change form and evolve. If you push too hard you either make them snap or you make them dig into an immobile position to resist the trolling (which is the case when you spam them).
I appreciate what you are trying to do, but you are giving trolling a bad name.
what is the point? :( pdf is a little rough for a monday morning.
Just sent an email to the author to see if using this would allows jails full access to the TCP/IP stack
Rus
Cheap UK and US VPS
this is great work, i appreciate it. I think its important to enjoy all forms of open source research.
I do, however, pity the children who squander their valued time in life on putting down the hard work of individuals who create such great things.
People like this, give whatever "community" they think they are a part of a childish image, when in reality the community wants nothing to do with any of them.
I would rather not make any insults back, but please...go home, give your mother or whom ever raised you a visit, and ask them to explain why you were fed so paint chips as a child.
If this is true, why not tell us his last name?
me thinks you just have a grudge against someone and do not want to reveal his full name because of the obvious slander lawsuit that would be levied against you.
But didn't get the point.
What are some concrete uses of this technology?
TIA
Naw, in fact I didn't know his name was Kevin until I read post #6926523. I am also unafraid of slander lawsuits - I doubt this prick has the intelligence to figure out who I am, and the gumption to act upon that information if indeed he found out.
I'm just tired of the crapflooding.
Absolutely brilliant. Here is the original post for other readers, if they cannot grasp the genius.
How helpful of you to point out your own genius.
The only Kevin I knew of was Kevin Rose - marketing director. He didn't make the WindRiver cut as I remember. I didn't keep records of when the 1st of the BSD is dying crapflooding started, so I can't say if the WindRiver buyout is about the time of the crapflooding.
I'd have to see if I had his old e-mail(s) talking about he was going to be doing the consulting 'thing'.
IT MAKES ME SICK JUST THINKING ABOUT IT.
Then please nip off and shoot yourself, M'kay?
Your wish has been granted... actually it was around more than a decade ago.
Check out QNX, you can use other QNX machine's network (and other devices, including audio, graphics, block devices etc) as your own local ones!!! And no silly imports etc... they just work!
- mritunjai
We're talking about a different level of abstraction, here. After all, from the OS's perspective, how can Plan9 "use the network stack of a remote machine" except via the network stack of the local machine? Nothing short of magic will let a machine "use another machine's nic" except via packets sent through its own. Yes, Plan9 supports user namespaces that allows network interfaces to be virtualized, but that's from the perspective of what BSD calls "userland" -- which is only partly related to what the article discusses.
This facility is about allowing multiple networks stacks from the kernel's perspective. Not just the illusion of separate stacks as seen from userland (though it certainly provides that, too). These stacks can then be treated independently from the perspective of packet filtering, traffic shaping, and so on, as well as providing a "virtual machine" from a user's perspective. This isn't to say that Plan9's capabilities aren't useful or interesting, especially from a theoretical perspective. But Plan9 has different goals than an OS like FreeBSD that first and foremost is designed to be used as on server in a datacenter. Thus the perspective is more along the lines of machine virtualization and really has little to do with Plan9's concept of a namespace.
Plan 9 had it 14 years ago. Importing something and using it as your own is a consequence of its design -- everything is a file, so everything could be shared -- not a special hack like in QNX. That means I can let people import my mailbox so they can send mail to me on the 9grid or I can import somebody's IRC file system on my machine.
And it really means _everything_, not only devices. Check out this MPI implementation using remotely served and imported _pipes_:
message passing for Plan 9
It's dead. D - E - A - D.