A question about netgraph interface.

[yavuzg]

Hi,


I want to use netgraph interface to connect jails and create complex network topologies.
In attached tutorial steps are given clearly. But I have a problem in target topology given at slide 46.

What my problem is I can not create an ether interface in jails. As a result I can not create a bridge connection inside the jail.
( I can create eiface but in order to create a bridge connection a ether interface must be given)

At slide 45 it is written that "In vimage n1 connect parent-inherited ethernet interface to bridge",
I understand that the ethernet interface is -somehow- become enabled by default (inherited).
But when I create a jail(or vimage) I can not see any ether interface and even create one.

The attached tutorial is an old one, there may be some changes in FreeBSD 8.0 or there may be a bug.
Do you have any idea?

thanks in advance..

yavuzg


[tutorial] http://imunes.tel.fer.hr/virtnet/eurobsdcon07_tutorial.pdf

 

[SirDice]

The answer is in the jail(8) man page:

allow.raw_sockets
The prison root is allowed to create raw sockets. Setting this parameter allows utilities like ping(8) and traceroute(8) to operate inside the prison. If this is set, the source IP addresses are enforced to comply with the IP address bound to the jail, regardless of whether or not the IP_HDRINCL flag has been set on the socket. Since raw sockets can be used to configure and interact with various network subsystems, extra caution should be used where privileged access to jails is given out to untrusted parties.

You simply don't have access to the 'raw' interfaces. You may be able to use the new VIMAGE virtualized network stack.
More info can be found here: http://wiki.freebsd.org/NetworkVirtualization

 

[yavuzg]

on the host allow.raw_socket is enabled:

sysctl -a | grep jail.allow
security.jail.allow_raw_sockets: 1

I am using vimage enabled kernel and can use ping and traceroute commands inside the jail.
In addition I have access to ngctl interface, can use ngctl to create interfaces as:

ngctl mkpeer eiface ether ether

But the problem is, I can not create an "ether interface"(ng_ether) inside a jail. Or there is no inherited ether interface in jail.