Re: Network Namespace-1000 networks with Overlap Addresses

[ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org (Eric W. Biederman)]

"Serge E. Hallyn" <serue-r/Jw6+rmf7HQT0dZR+AlfA@public.gmane.org> writes:

> Quoting Krishna Vamsi-B22174 (avamsi-KZfg59tc24xl57MIdRCFDg@public.gmane.org):
>> 
>> 
>> Hi,
>> 
>> I am a newbie  to this list.  Here is my use case , we have  Loadable
>> Kernel Module which applies security to
>> the packets arriving from 1000 networks with overlap addresses. There
>> are 3 different  user space process which handles 
>> control traffic  from these 1000 networks .   
>> 
>> Please let me know
>> 
>> 1)How to create a Network Namespace Object ?
>
> clone(CLONE_NEWNET)
>
>> 2)How to delete a Network Namespace Object ?
>
> exit
>
>> 3)Can these 3  user space process see all the Network Namespace objects
>> created in the kernel ?
>
> No, network namespaces are fully isolated.  A virtual nic can only exist
> in one network namespace, and physical nics can only exist in the
> initial network namespace.

Sockets can be passed between network namespaces if you set things up correctly.
At which point you can have 3 user space processes doing all of the work.

It can be a bit of a pain to have processes lying around just so you can
create a socket in another network namespace but the code works today
and isn't too bad.

>>  If so, how can they access these objects?
>> 4)How to group 2-3 interfaces under a particular Network Namespace ?
>
> I don't understand the question, but you pass a veth endpoint into a
> network namespace using
>
> 	/sbin/ip link set veth1 netns $pid_in_other_netns

yep.

Eric