Re: OpenVPN isolation using NetworkNamespaces



On 02.04.2016 23:16, Thomas Haller wrote:
On Sat, 2016-04-02 at 21:49 +0200, Stjepan Groš wrote:
I have one problem now. Namely, function _is_root in NMNetns doesn't
work, or am I doing something wrong? When constructing
NMNetnsController object the first NMNetns is created and that one
should be for root network namespace. I'm using _is_root() to skip
device initialization (for root that is done by NMManager now) but
_is_root() returns FALSE?
Hi Stjepan,


The NMPNetns instance that represents the root namespace
is nmp_netns_get_initial(). You don't create that one, it's always
there.


You change to call 
  priv->nmp_netns = nmp_netns_new();
is wrong.
This creates a new namespace and switches to it. When you switch
namespace at a certain moment, you *must* switch back before you return
from the function; that is, you must always call nmp_netns_pop() before
your function returns.

The reason for that is, that at any point it must be known which
namespace is currently active. If you call a function and that function
switchs namespace, that function is required to restore the callers
namespace before returning.


For that reason, I think it's better that nm_netns_new() /
nm_netns_init() does *not* call nmp_netns_new() to create a new
namespace.
Instead, it seems more logical that it takes over the *current*
namespace nmp_netns_get_current(). So it's the job of the caller of
nm_netns_new() -- create_new_namespace() -- to prepare the namespace.

Then, when creating the NMNetns instance for the root namespace, the
caller just does not call nmp_netns_new() but stays on the root
namespace. At that point, nmp_netns_get_currenty() equals
nmp_netns_get_initial() and it just works.



Does that make sense?

Yes, it makes sense. I tried it and it passed the problem I had.

SG


Thomas





The code with my changes to your branch is on the following URL:

https://github.com/sgros/NETNS_NetworkManager

SG

Attachment: signature.asc
Description: OpenPGP digital signature



[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]