Re: Jails with IP6 addresses?

Am Samstag, 13. August 2005 01:54 CEST schrieb Olivier Houchard:
> On Fri, Aug 12, 2005 at 10:19:24PM +0200, Harald Schmalzbauer wrote:
> > Hi Olivier,
> >
> > I have some more things to make clear with IPv6 so I'm quiet sure I'll
> > need more than a week to make the new systems productive.
> > I'd love to test your patchset, preferably on RELENG_6, that's what's
> > on the CF-Cards and what I'd like to use for production service.
> >
> > Thanks a lot,
> >
> > -Harry (Emanuel is just the fake ID I use for mailinglists)
>
> So hi Harry :-)
>
> By curiosity, I had a look to see if it would be a lot of work to get my
> patch to work on -CURRENT, and it turned out it was not as painful as I
> feared (it was still long enough to make my girlfriend unhappy, but well
> :)) So here is the patch, against -RELENG_6 (I didn't test it under
> RELENG_6, as I have no RELENG_6 box, shame on me, but I suspect it'll
> work as well). It has to be applied in src/. You'll of course have to
> recompile your kernel, but you can skip the "make world" part by just
> copying sys/sys/jail.h into /usr/include/sys and doing cd
> /usr/src/usr.sbin/jail && make depend all install
>
> It basically adds a -6 optional flag to the jail command, which takes
> the v6 addr you want to use as an argument. I did a quick test on my
> laptop, it seems to still work. Beware however, I don't know the v6 code
> well enough to warrant you you will be as secure as with a classic v4
> jail. That's why I wanted a proper review of this code before committing
> it. I certainly hope it's the case, though.
>
> Tell me how it goes once you're done with your IPv6 setup. If all goes

Hello Olivier, a little late but finally I'm about to setup a IPv6 only 
environment. I'm using RELENG_6 from today with your patch but 
unfortunately the jail doesn't "bind" to one ip6 address.

gune:~#7: netstat -a | grep ssh
tcp4       0      0  0.0.0.2.ssh            *.*                    LISTEN
tcp6       0      0  *.ssh                  *.*                    LISTEN
tcp6       0      0  fec0::1:0:0:2:1.ssh    *.*                    LISTEN

See the second line, it's the ssh daemon running in the jail. I can connect 
to it also by ssh to fec0::2:0:0:1:5 although ifconfig inside the jail 
shows: (only fec0::2:0:0:1:2)

fxp0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        options=8<VLAN_MTU>
        inet6 fec0::2:0:0:1:2 prefixlen 64
        ether 00:e0:18:06:ad:59
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        options=b<RXCSUM,TXCSUM,VLAN_MTU>
        ether 00:0e:0c:34:2b:f8
        media: Ethernet autoselect (1000baseTX <full-duplex>)
        status: active
fwe0: 
flags=108943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST,NEEDSGIANT> 
mtu 1500
        options=8<VLAN_MTU>
        ether 02:01:08:01:ea:60
        ch 1 dma 0
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384

Unfortunately I couldn't find a way to redirect IPv4 addresses to IPv6 with 
pf on my router, so at the moment I won't keep using IPv6 with my jails, 
but I'd highly appreciate ongoing IPv6 support :)
Do you know anything about the network virtualization project? Will it be 
adopted to -current? (http://tel.fer.hr/zec/vimage/)

Thanks a lot,

-Harry

> well, I'll try harder to get it into the tree, if somebody else than
> myself actually wants it :-)
>
> Cheers,
>
> Olivier