3 ms·

But on VNET enabled kernels (enabled in GENERIC since 13.0) you can have multiple instances of the IP stack to provide jails with their own IP stacks including

by crest 5y ago

But on VNET enabled kernels (enabled in GENERIC since 13.0) you can have multiple instances of the IP stack to provide jails with their own IP stacks including a loopback, firewall(s) and IPsec.

hestefisk 5y ago
VNET has been around for quite a while though…
- crest 5y ago
  And has been a quick way to panic() for most of them.
  - nix23 5y ago
    No not "most" but some of them. And it's declared stable in FreeBSD13
skissane 5y ago
So, with FreeBSD multiple TCP stack feature, a single process can talk to multiple TCP stacks simultaneously, by calling setsockopt(TCP_FUNCTION_BLK) on each socket to select a different stack. Similarly, in z/OS, a single process can have sockets belonging to multiple TCP/IP stacks. There is a system call (setibmopt) which can be used to choose a default stack, and thereafter all sockets created by that process will be bound to that stack only (the "stack affinity" is inherited over fork/exec; can also be set with _BPXK_SETIBMOPT_TRANSPORT environment variable). Alternatively, you can call ioctl(SIOCSETRTTD) on a socket to pick which TCP/IP stack to use for that particular socket. There is also a feature, CINET, where the OS chooses which TCP/IP stack to use for each socket automatically, based on the address the process binds it to. CINET asks each TCP/IP stack to provide a copy of its routing tables, and then uses those routing tables to "preroute" sockets to the appropriate stack. But I get the impression VNET doesn't allow a single process to use multiple IP stack instances simultaneously? If VNET is bound to jails, a single process can belong to only one jail. One reason why z/OS has this multiple TCP/IP stack support, is historically the TCP/IP stack has been a third party product, not a core part of the OS. So instead of IBM's stack, but some people used third party ones instead, such as CA TCPaccess (at one point resold by Cisco as IOS for S/390). One can even use both products on the same OS instance, primarily to help with piecemeal migrations from one to the other. Other operating systems with a history of supporting TCP/IP stacks from multiple vendors include OpenVMS and older versions of Windows (especially 3.x)

by crest 5y ago

But on VNET enabled kernels (enabled in GENERIC since 13.0) you can have multiple instances of the IP stack to provide jails with their own IP stacks including a loopback, firewall(s) and IPsec.

hestefisk 5y ago

VNET has been around for quite a while though…

crest 5y ago
And has been a quick way to panic() for most of them.
- nix23 5y ago
  No not "most" but some of them. And it's declared stable in FreeBSD13

skissane 5y ago

So, with FreeBSD multiple TCP stack feature, a single process can talk to multiple TCP stacks simultaneously, by calling setsockopt(TCP_FUNCTION_BLK) on each socket to select a different stack. Similarly, in z/OS, a single process can have sockets belonging to multiple TCP/IP stacks. There is a system call (setibmopt) which can be used to choose a default stack, and thereafter all sockets created by that process will be bound to that stack only (the "stack affinity" is inherited over fork/exec; can also be set with _BPXK_SETIBMOPT_TRANSPORT environment variable). Alternatively, you can call ioctl(SIOCSETRTTD) on a socket to pick which TCP/IP stack to use for that particular socket. There is also a feature, CINET, where the OS chooses which TCP/IP stack to use for each socket automatically, based on the address the process binds it to. CINET asks each TCP/IP stack to provide a copy of its routing tables, and then uses those routing tables to "preroute" sockets to the appropriate stack. But I get the impression VNET doesn't allow a single process to use multiple IP stack instances simultaneously? If VNET is bound to jails, a single process can belong to only one jail. One reason why z/OS has this multiple TCP/IP stack support, is historically the TCP/IP stack has been a third party product, not a core part of the OS. So instead of IBM's stack, but some people used third party ones instead, such as CA TCPaccess (at one point resold by Cisco as IOS for S/390). One can even use both products on the same OS instance, primarily to help with piecemeal migrations from one to the other. Other operating systems with a history of supporting TCP/IP stacks from multiple vendors include OpenVMS and older versions of Windows (especially 3.x)