net namespace: empty framework

From: Cedric Le Goater <[email protected]>

This patch adds an empty net namespace framework

Signed-off-by Cedric Le Goater <[email protected]>

---
 include/linux/init_task.h     |    2 +
 include/linux/net_namespace.h |   49 ++++++++++++++++++++++++++++++++++++++++++
 include/linux/nsproxy.h       |    2 +
 kernel/nsproxy.c              |   12 ++++++++++
 net/Kconfig                   |    8 ++++++
 net/core/Makefile             |    2 -
 net/core/net_namespace.c      |   41 +++++++++++++++++++++++++++++++++++
 7 files changed, 115 insertions(+), 1 deletion(-)

Index: 2.6.19-rc5-mm2/include/linux/init_task.h
===================================================================

include/linux/init_task.h +2 -0

@@ -8,6 +8,7 @@
 #include <linux/lockdep.h>
 #include <linux/ipc.h>
 #include <linux/pid_namespace.h>
+#include <linux/net_namespace.h>
 
 #define INIT_FDTABLE \
 {							\

@@ -78,6 +79,7 @@ extern struct nsproxy init_nsproxy;
 	.id		= 0,						\
 	.uts_ns		= &init_uts_ns,					\
 	.mnt_ns		= NULL,						\
+	INIT_NET_NS(net_ns)						\
 	INIT_IPC_NS(ipc_ns)						\
 }
 

Index: 2.6.19-rc5-mm2/include/linux/net_namespace.h
===================================================================

include/linux/net_namespace.h new file +49 -0

@@ -0,0 +1,49 @@
+#ifndef _LINUX_NET_NAMESPACE_H
+#define _LINUX_NET_NAMESPACE_H
+
+#include <linux/kref.h>
+#include <linux/nsproxy.h>
+
+struct net_namespace {
+	struct kref	kref;
+};
+
+extern struct net_namespace init_net_ns;
+
+#ifdef CONFIG_NET_NS
+
+#define INIT_NET_NS(net_ns) .net_ns = &init_net_ns,
+
+static inline void get_net_ns(struct net_namespace *ns)
+{
+	kref_get(&ns->kref);
+}
+
+extern int copy_net_ns(int flags, struct task_struct *tsk);
+
+extern void free_net_ns(struct kref *kref);
+
+static inline void put_net_ns(struct net_namespace *ns)
+{
+	kref_put(&ns->kref, free_net_ns);
+}
+
+#else
+
+#define INIT_NET_NS(net_ns)
+
+static inline void get_net_ns(struct net_namespace *ns)
+{
+}
+
+static inline int copy_net_ns(int flags, struct task_struct *tsk)
+{
+	return 0;
+}
+
+static inline void put_net_ns(struct net_namespace *ns)
+{
+}
+#endif
+
+#endif /* _LINUX_NET_NAMESPACE_H */

Index: 2.6.19-rc5-mm2/include/linux/nsproxy.h
===================================================================

include/linux/nsproxy.h +2 -0

@@ -10,6 +10,7 @@ struct mnt_namespace;
 struct uts_namespace;
 struct ipc_namespace;
 struct pid_namespace;
+struct net_namespace;
 
 /*
  * namespaces flags

@@ -42,6 +43,7 @@ struct nsproxy {
 	struct ipc_namespace *ipc_ns;
 	struct mnt_namespace *mnt_ns;
 	struct pid_namespace *pid_ns;
+	struct net_namespace *net_ns;
 
 	struct hlist_node ns_hash_node;
 };

Index: 2.6.19-rc5-mm2/kernel/nsproxy.c
===================================================================

kernel/nsproxy.c +12 -0

@@ -20,6 +20,7 @@
 #include <linux/mnt_namespace.h>
 #include <linux/utsname.h>
 #include <linux/pid_namespace.h>
+#include <linux/net_namespace.h>
 
 #define NS_HASH_BITS 		3 /* this might need some configuration */
 #define NS_HASH_SIZE		(1 << NS_HASH_BITS)

@@ -89,6 +90,8 @@ struct nsproxy *dup_namespaces(struct ns
 			get_ipc_ns(ns->ipc_ns);
 		if (ns->pid_ns)
 			get_pid_ns(ns->pid_ns);
+		if (ns->net_ns)
+			get_net_ns(ns->net_ns);
 	}
 
 	return ns;

@@ -136,10 +139,17 @@ int copy_namespaces(int flags, struct ta
 	if (err)
 		goto out_pid;
 
+	err = copy_net_ns(flags, tsk);
+	if (err)
+		goto out_net;
+
 out:
 	put_nsproxy(old_ns);
 	return err;
 
+out_net:
+	if (new_ns->pid_ns)
+		put_pid_ns(new_ns->pid_ns);
 out_pid:
 	if (new_ns->ipc_ns)
 		put_ipc_ns(new_ns->ipc_ns);

@@ -165,6 +175,8 @@ static void free_nsproxy(struct nsproxy 
 		put_ipc_ns(ns->ipc_ns);
 	if (ns->pid_ns)
 		put_pid_ns(ns->pid_ns);
+	if (ns->net_ns)
+		put_net_ns(ns->net_ns);
 	kfree(ns);
 }
 

Index: 2.6.19-rc5-mm2/net/core/Makefile
===================================================================

net/core/Makefile +1 -1

@@ -3,7 +3,7 @@
 #
 
 obj-y := sock.o request_sock.o skbuff.o iovec.o datagram.o stream.o scm.o \
-	 gen_stats.o gen_estimator.o
+	 gen_stats.o gen_estimator.o net_namespace.o
 
 obj-$(CONFIG_SYSCTL) += sysctl_net_core.o
 

Index: 2.6.19-rc5-mm2/net/core/net_namespace.c
===================================================================

net/core/net_namespace.c new file +41 -0

@@ -0,0 +1,41 @@
+/*
+ *  This program is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU General Public License as
+ *  published by the Free Software Foundation, version 2 of the
+ *  License.
+ */
+
+#include <linux/module.h>
+#include <linux/version.h>
+#include <linux/nsproxy.h>
+#include <linux/net_namespace.h>
+
+struct net_namespace init_net_ns = {
+	.kref = {
+		.refcount	= ATOMIC_INIT(2),
+	},
+};
+
+#ifdef CONFIG_NET_NS
+
+int copy_net_ns(int flags, struct task_struct *tsk)
+{
+	struct net_namespace *old_ns = tsk->nsproxy->net_ns;
+	int err = 0;
+
+	if (!old_ns)
+		return 0;
+
+	get_net_ns(old_ns);
+	return err;
+}
+
+void free_net_ns(struct kref *kref)
+{
+	struct net_namespace *ns;
+
+	ns = container_of(kref, struct net_namespace, kref);
+	kfree(ns);
+}
+
+#endif /* CONFIG_NET_NS */

Index: 2.6.19-rc5-mm2/net/Kconfig
===================================================================

net/Kconfig +8 -0

@@ -67,6 +67,14 @@ source "net/netlabel/Kconfig"
 
 endif # if INET
 
+config NET_NS
+	bool "Network Namespaces"
+	help
+	  This option enables multiple independent network namespaces,
+	  each having own network devices, IP addresses, routes, and so on.
+	  If unsure, answer N.
+
+
 config NETWORK_SECMARK
 	bool "Security Marking"
 	help

Cedric,

Dmitry Mishin and Daniel Lezcano are working together on the full network namespace incorporating both needs of OpenVZ and VServer/IBM.

Thanks,
Kirill

Quoted 5 lines · Kirill Korotaev

Cedric,

Dmitry Mishin and Daniel Lezcano are working together on the full network namespace incorporating both needs of OpenVZ and VServer/IBM.

Quoted 2 lines

Thanks,
Kirill

Kirill,

We will need this framework to move the network isolation code to the ns_proxy/net_namespace structure. So if Cedric gives us a empty framework it is fine, except if someone does not agree with it...

-- Daniel.

Quoted 7 lines · Kirill Korotaev

Cedric,

Dmitry Mishin and Daniel Lezcano are working together on the full network namespace incorporating both needs of OpenVZ and VServer/IBM.

Thanks,
Kirill

Kirill,

We will need this framework to move the network isolation code to the ns_proxy/net_namespace structure. So if Cedric gives us a empty framework it is fine, except if someone does not agree with it...

   -- Daniel.

Quoted 15 lines · Daniel Lezcano

Quoted 7 lines · Kirill Korotaev

Cedric,

Dmitry Mishin and Daniel Lezcano are working together on the full network namespace incorporating both needs of OpenVZ and VServer/IBM.

Thanks,
Kirill

Kirill,

We will need this framework to move the network isolation code to the ns_proxy/net_namespace structure. So if Cedric gives us a empty framework it is fine, except if someone does not agree with it...

Quoted 1 line

   -- Daniel.

This patch looks acceptable for us.
BTW, Daniel, we agreed to be based on the Andrey's patchset. I do not see a reason, why Cedric force us to make some unnecessary work and move existent patchset over his interface.

This patch looks acceptable for us.
BTW, Daniel, we agreed to be based on the Andrey's patchset. I do not see a reason, why Cedric force us to make some unnecessary work and move existent patchset over his interface.

Quoted 10 lines

Quoted 5 lines

We will need this framework to move the network isolation code to the ns_proxy/net_namespace structure. So if Cedric gives us a empty framework it is fine, except if someone does not agree with it...

-- Daniel.

This patch looks acceptable for us.
BTW, Daniel, we agreed to be based on the Andrey's patchset. I do not see a reason, why Cedric force us to make some unnecessary work and move existent patchset over his interface.

If you are going to take that attitude. Where was this conversation?

It appears several relevant people were not aware of this development discussion. So when it comes up for general review you can expect your approach as well as your code to be critiqued.

Quoted 16 lines · Dmitry Mishin

Quoted 15 lines · Daniel Lezcano

Quoted 7 lines · Kirill Korotaev

Cedric,

Dmitry Mishin and Daniel Lezcano are working together on the full network namespace incorporating both needs of OpenVZ and VServer/IBM.

Thanks,
Kirill

Kirill,

We will need this framework to move the network isolation code to the ns_proxy/net_namespace structure. So if Cedric gives us a empty framework it is fine, except if someone does not agree with it...

Quoted 5 lines

Quoted 1 line

   -- Daniel.

This patch looks acceptable for us.
BTW, Daniel, we agreed to be based on the Andrey's patchset. I do not see a reason, why Cedric force us to make some unnecessary work and move existent patchset over his interface.

If you are going to take that attitude. Where was this conversation?

It appears several relevant people were not aware of this development discussion. So when it comes up for general review you can expect your approach as well as your code to be critiqued.

no problem here, but I think we will need another one, or some smart way to do the network isolation (layer 3) for the network namespace (as alternative to the layer 2 approach) ...

as they are both complementary in some way, I'm not sure a single space will suffice ...

This patch looks acceptable for us.

BTW, Daniel, we agreed to be based on the Andrey's patchset. I do not see a reason, why Cedric force us to make some unnecessary work and move existent patchset over his interface.

Hello,

Quoted 1 line · Dmitry Mishin

This patch looks acceptable for us.

good. shall we merge it then ? see comment below.

Quoted 3 lines

BTW, Daniel, we agreed to be based on the Andrey's patchset. I do not see a reason, why Cedric force us to make some unnecessary work and move existent patchset over his interface.

yeah it's a bit different from andrey's but not that much and it's more in

the spirit of uts and ipc namespace (and user namespace if that reaches the kernel one day :) so that's why i made the small changes.

It also helping the nsproxy/namespace syscalls to have a similar interface to manipulate namespaces. who knows, soon we might be able to have a 'struct namespace' with a ops field to define new namespace types ?

I can also send a empty framework for user namespace ;)

Quoted 8 lines · Cedric Le Goater

Hello,

Quoted 1 line · Dmitry Mishin

This patch looks acceptable for us.

good. shall we merge it then ? see comment below.

Quoted 5 lines

Quoted 3 lines

BTW, Daniel, we agreed to be based on the Andrey's patchset. I do not see a reason, why Cedric force us to make some unnecessary work and move existent patchset over his interface.

yeah it's a bit different from andrey's but not that much and it's more in

Where is Andrey's patch?

Quoted 3 lines

the spirit of uts and ipc namespace (and user namespace if that reaches the kernel one day :) so that's why i made the small changes.

I agree the namespace frameworks should be consistent, but i don't know whether Andrey's is or not. I'd like to have the framework included so we reduce the number of silly rewrites due to clone flag collisions etc.

Quoted 6 lines

It also helping the nsproxy/namespace syscalls to have a similar interface to manipulate namespaces. who knows, soon we might be able to have a 'struct namespace' with a ops field to define new namespace types ?

I can also send a empty framework for user namespace ;)

Please do - then I'll rebase the patchset I sent to the containes list onto your patch, and resubmit the whole userns.

(quoted diff) +0 -2

-serge
-

To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Where is Andrey's patch?

Quoted 2 lines

the spirit of uts and ipc namespace (and user namespace if that reaches the kernel one day :) so that's why i made the small changes.

I agree the namespace frameworks should be consistent, but i don't know whether Andrey's is or not. I'd like to have the framework included so we reduce the number of silly rewrites due to clone flag collisions etc.

Quoted 5 lines

It also helping the nsproxy/namespace syscalls to have a similar interface to manipulate namespaces. who knows, soon we might be able to have a 'struct namespace' with a ops field to define new namespace types ?

I can also send a empty framework for user namespace ;)

Please do - then I'll rebase the patchset I sent to the containes list onto your patch, and resubmit the whole userns.

Quoted 4 lines

no problem here, but I think we will need another one, or some smart way to do the network isolation (layer 3) for the network namespace (as alternative to the layer 2 approach) ...

My feeling (Dmitry and Daniel can correct me) is that it will be addressed with an unshare-like flag : NETNS2 and NETNS3.

Quoted 2 lines

as they are both complementary in some way, I'm not sure a single space will suffice ...

hmm, so you think there could be a 2 differents namespaces for network to handle layer 2 or 3. Couldn't that be just a sub part of net_namespace.

The justification is performance and a little on the simplicity side.

My personal feel is still that layer 3 is something easier done as a new kind of table in an iptables type infrastructure. And in fact I believe if done that way would capture do what 90%+ of what all of the iptables rules do. So it might be a nice firewalling speed up. I don't think the layer 3 idea where you just do bind filter fits the namespace concept very well.

Quoted 9 lines · Serge E. Hallyn

Quoted 8 lines · Cedric Le Goater

Hello,

Quoted 1 line · Dmitry Mishin

This patch looks acceptable for us.

good. shall we merge it then ? see comment below.

Quoted 7 lines

Quoted 5 lines

Quoted 3 lines

BTW, Daniel, we agreed to be based on the Andrey's patchset. I do not see a reason, why Cedric force us to make some unnecessary work and move existent patchset over his interface.

yeah it's a bit different from andrey's but not that much and it's more in

Where is Andrey's patch?

This thread - http://thread.gmane.org/gmane.linux.network/42666

Quoted 8 lines · Cedric Le Goater

Quoted 4 lines

no problem here, but I think we will need another one, or some smart way to do the network isolation (layer 3) for the network namespace (as alternative to the layer 2 approach) ...

My feeling (Dmitry and Daniel can correct me) is that it will be addressed with an unshare-like flag : NETNS2 and NETNS3.

Quoted 6 lines

Quoted 2 lines

as they are both complementary in some way, I'm not sure a single space will suffice ...

hmm, so you think there could be a 2 differents namespaces for network to handle layer 2 or 3. Couldn't that be just a sub part of net_namespace.

The justification is performance and a little on the simplicity side.

My personal feel is still that layer 3 is something easier done as a new kind of table in an iptables type infrastructure. And in fact I believe if done that way would capture do what 90%+ of what all of the iptables rules do. So it might be a nice firewalling speed up.

I don't think the layer 3 idea where you just do bind filter fits the namespace concept very well.

Eric

Quoted 13 lines · Dmitry Mishin

Quoted 12 lines · Serge E. Hallyn

Quoted 11 lines · Cedric Le Goater

Hello,

Quoted 1 line · Dmitry Mishin

This patch looks acceptable for us.

good. shall we merge it then ? see comment below.

Quoted 3 lines

BTW, Daniel, we agreed to be based on the Andrey's patchset. I do not see a reason, why Cedric force us to make some unnecessary work and move existent patchset over his interface.

Quoted 6 lines

Quoted 4 lines

Quoted 2 lines

yeah it's a bit different from andrey's but not that much and it's more in

Where is Andrey's patch?

This thread - http://thread.gmane.org/gmane.linux.network/42666

Thanks, Dmitry. Now I do recall seeing that before.

That patchset appears to go part, but not all the way to fitting in with the existing namespaces. For instance, you use exit_task_namespaces() for refcounting, but don't put the net_namespace in the nsproxy and use your own mechanism for unsharing.

It really seems useful to have all the namespaces be consistent whenever practical, and I don't think your patchset would need much tweaking to fit onto Cedric's patch. Am I missing a complicating factor?

Quoted 23 lines · Serge E. Hallyn

Quoted 8 lines · Dmitry Mishin

Quoted 7 lines · Serge E. Hallyn

Quoted 6 lines · Cedric Le Goater

Hello,

Quoted 1 line · Dmitry Mishin

This patch looks acceptable for us.

good. shall we merge it then ? see comment below.

Quoted 7 lines

Quoted 6 lines

Quoted 5 lines

Quoted 3 lines

BTW, Daniel, we agreed to be based on the Andrey's patchset. I do not see a reason, why Cedric force us to make some unnecessary work and move existent patchset over his interface.

yeah it's a bit different from andrey's but not that much and it's more in

Where is Andrey's patch?

This thread - http://thread.gmane.org/gmane.linux.network/42666

Thanks, Dmitry. Now I do recall seeing that before.

That patchset appears to go part, but not all the way to fitting in with the existing namespaces. For instance, you use exit_task_namespaces() for refcounting, but don't put the net_namespace in the nsproxy and use your own mechanism for unsharing.

Quoted 3 lines

It really seems useful to have all the namespaces be consistent whenever practical, and I don't think your patchset would need much tweaking to fit onto Cedric's patch. Am I missing a complicating factor?

No. I've already said, Cedric's patch is acceptable for us.

Quoted 23 lines · Serge E. Hallyn

Quoted 8 lines · Dmitry Mishin

Quoted 7 lines · Serge E. Hallyn

Quoted 6 lines · Cedric Le Goater

Hello,

Quoted 1 line · Dmitry Mishin

This patch looks acceptable for us.

good. shall we merge it then ? see comment below.

Quoted 7 lines

Quoted 6 lines

Quoted 5 lines

Quoted 3 lines

BTW, Daniel, we agreed to be based on the Andrey's patchset. I do not see a reason, why Cedric force us to make some unnecessary work and move existent patchset over his interface.

yeah it's a bit different from andrey's but not that much and it's more in

Where is Andrey's patch?

This thread - http://thread.gmane.org/gmane.linux.network/42666

Thanks, Dmitry. Now I do recall seeing that before.

That patchset appears to go part, but not all the way to fitting in with the existing namespaces. For instance, you use exit_task_namespaces() for refcounting, but don't put the net_namespace in the nsproxy and use your own mechanism for unsharing.

Quoted 3 lines

It really seems useful to have all the namespaces be consistent whenever practical, and I don't think your patchset would need much tweaking to fit onto Cedric's patch. Am I missing a complicating factor?

No. I've already said, Cedric's patch is acceptable for us.