Editing
Util-vserver:SplitSharedNetworks
(section)
From Linix VServer
Jump to navigation
Jump to search
Warning:
You are not logged in. Your IP address will be publicly visible if you make any edits. If you
log in
or
create an account
, your edits will be attributed to your username, along with other benefits.
Anti-spam check. Do
not
fill this in!
= Namespace ramblings = Playing with the latest and greatest ip route I discovered that ip supports the creation and naming of network namespaces, albeit with a trick. The current ip route utility manages network namespaces by creating a new namespace, and then bind-mounting /proc/self/ns/net (a file!) to /var/run/netns/<a file named after the namespace>. Network namespaces always had a big problem of not being able to reach them, unless you know a pid in that namespace. There is another technique, and that is to open a file which is somehow located in that namespace. Enough of that. == Vserver to ip == How can we use that? First we must make sure that we are compatible: we can make vserver create the network namespace and let the ip utility know about that: <PRE> mkdir -p /var/run/netns touch /var/run/netns/$VSERVER vspace -e $VSERVER --net mount -o bind /proc/self/ns/net /var/run/netns/$VSERVER </PRE> From then on you can use the following incantations: <PRE> ip netns exec $VSERVER cmds vspace -e $VSERVER --net cmds </PRE> == Interface to vserver == To put a network device into that namespace we do something like this: <PRE> ip link set dev $IFACE netns $VSERVER </PRE> We can check that with: <PRE> ip netns exec $VSERVER ip a ls vspace -e $VSERVER --net ip a ls </PRE> === Useful interface creationism === What's a network namespace without an interface? Here are some create statements: <PRE> # Create an interface on a a "real" device # A macvlan in bridge mode is as if we have a second network card # in the same network. It already knows all mac-addresses, so the "bridging" code is lightweight ip link add link $BASEDEVICE name $VSERVERDEVICE type macvlan mode bridge # Create a virtual network tunnel # This is basically a virtual cross cable type of interface # You can use a veth like any ordinary device like # plugging it into a bridge device ip link add name $DEVICE_A type veth peer name $DEVICE_B # Create a normal vlan interface on a device. # Great when giving vservers a seperate vlan ip link add link $BASEDEVICE name $VSERVERDEVICE type vlan id $VLANID </PRE> Remember though: all interfaces need valid mac-addresses, especially when going to the outside. I use this complex script to generate a pair of static mac-addresses for a veth: <PRE> stringasmac() { echo "$1"|sed 's/\(..\)\(..\)\(..\)\(..\)\(..\)\(..\)/\1:\2:\3:\4:\5:\6/' } read CONTEXTID < /etc/vservers/${VSERVER}/context MACSTRING=$(printf "%04x" $VID)$(printf "%04x" $CONTEXTID) MACADDRC=$(stringasmac 02${MACSTRING}00) MACADDRH=$(stringasmac 02${MACSTRING}01) </PRE> Valid addresses are addresses that have bit0 unset and bit1 set in the first byte. It means a normal (bit0: 1 == multicast) and locally administrated (bit1: 1==Not official) address. You set them like: <PRE> ip link set address ${MACADDRC} dev ${CLIENTDEV} </PRE> == ip to vserver == Turned around, could we create a namespace and use it in vserver? We can then prepare interfaces in the namespace before starting the vserver. If it works, it should go like this: <PRE> ip netns add $VSERVER ip netns exec $VSERVER vserver $VSERVER start </PRE> == interface management == Any vserver with a seperate network namespace should have it's lo brought up (in *that* namespace). Any link configuration should be done within that namespace. Util-vserver needs some patches for that. == /proc/net/ == Initially the contents of /proc/net/ is not visible in the vserver. vprocunhide unhides only /proc/net from the host network namespace. So to be able to see /proc/net/* inside the vserver you will have to run vprocunhide in the created network namespace again. Something like that could be useful: <pre> ip netns exec $VSERVER /usr/lib/util-vserver/vprocunhide </pre>
Summary:
Please note that all contributions to Linix VServer may be edited, altered, or removed by other contributors. If you do not want your writing to be edited mercilessly, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource (see
Linix VServer:Copyrights
for details).
Do not submit copyrighted work without permission!
Cancel
Editing help
(opens in new window)
Navigation menu
Page actions
Page
Discussion
Read
Edit
History
Page actions
Page
Discussion
More
Tools
Personal tools
Not logged in
Talk
Contributions
Create account
Log in
About
Overview
Paper
News
Developers
Donations
Search
Getting Started
Downloads
FAQs
Documentation
Support
Participate
How to participate
Report a Bug
Communicate
Teams/Projects
Hall of Fame
Resources
Archives
Recent Wiki Changes
Pastebin
Related Projects
VServer Hosting
Happy VServer Users
Tools
What links here
Related changes
Special pages
Page information