Zheng Da
Email: zhengda1936 at gmail dot com
Project: Network virtualization for subhurds etc.
The code.
The howto shows the instructions of setting up the virtual network in hurd and subhurd.
The design and the implementation
The requirements:
- to implement a mechanism which help pfinet servers communicate with each other. For example, if pfinet 1 has IP A and pfinet 2 has IP B, the packet sent by pfinet 1 with destination address IP B should be received by pfinet 2.
- Sub-hurd should be able to use this mechanism to communicate with each other.
- Meanwhile this mechanism should allow non-privileged the user to start his own pfinet.
The possible approach is to use the multiplexer and the filter.
The multiplexer's roles are:
- to create some virtual network interface, so pfinet can send packets to it.
- to receive the packet from pfinet, and forward the packet to other pfinets in hurd
- or forward the packet to the real network device in the kernel and send it to the network.
A filter translator is needed to enforce the policies between the interface and the pfinet server. For example, the filter can control which packets can be delivered to the pfinet server, and which packets can be sent to the network interface. The filter can also guard the network traffic and drop illegal packets (forged by some malicious users) from pfinet or some other programs.
To create a virtual network interface:
- Implement the RPC interface defined in device.defs.
- The multiplexer works as a translator and other programs can get the port to it by calling file_name_port().
- Other programs can use this port as a master device port to open the virtual interface.
The routing inside the multiplexer:
- when the multiplexer gets a packet, it forwards it to every interface.
- BPF is ported to the multiplexer. BPF delivers the packet to the right pfinet (according to the filter set by the pfinet) just as the BPF in Mach does.
- All packets are forwarded to the interface which the multiplexer sits on.
The implementation of the filter translator:
- The filter works as a proxy, forwarding the packet between the interface and the pfinet server.
- BPF is also ported to the filter translator. There are two filers in the translator, one for outgoing packets, the other for incoming packets.
- Only one pfinet can connect to the translator at a time.
TODO
Coding
- make subhurds running without root privileges
- merge BPF rules from the filter translator and the multiplexer
Completed tasks
Coding
The patch of glibc (pfinet server overriding) is here.
The patch of pfinet (open the virtual network interface) is here.
The patch of pfinet (fix pfinet to use the proper filter rule) is here.
The patch of pfinet (set the mach device in the promiscuous mode) is here.
The patch of boot (open the virtual network interface) is here.
The patch of gnumach (set the network device into the promiscuous mode) is here.
the multiplexer:
- Create multiple virtual network interfaces.
- Port BPF to the multiplexer.
- Finish the routing among the pfinet servers.
the filter translator:
- Forward the packet between the interface and the pfinet server.
- Filter the packet.
the proxy of the proc server:
- Forward all requests from the process to its proc server.
- The proxy doesn't do any real work except returning the host private port and the master device port of the proxy (shown as an example).
the devnode translator:
- Create a device file to help open the network device.
The Code Read
- boot
Documentation Read
- A Programmer's Guide to the Mach System Calls
- Meet Mach by James Scott
- A Programmer's Guide to the Mach User Environment, the MIG part
- Part of The GNU Mach Reference Manual and The GNU Hurd Reference Manual
- The Hurd, a presentation by Marcus Brinkmann
- Towards a New Strategy of OS Design, an architectural overview by Thomas Bushnell, BSG.
- GNU/Hurd User's Guide
- The Hurd Hacking Guide