From owner-freebsd-transport@freebsd.org Mon Dec 28 23:08:09 2015 Return-Path: Delivered-To: freebsd-transport@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 004AEA54075 for ; Mon, 28 Dec 2015 23:08:09 +0000 (UTC) (envelope-from bzeeb-lists@lists.zabbadoz.net) Received: from mx1.sbone.de (mx1.sbone.de [IPv6:2a01:4f8:130:3ffc::401:25]) (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) (Client CN "mx1.sbone.de", Issuer "SBone.DE" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id B8C6414C5 for ; Mon, 28 Dec 2015 23:08:08 +0000 (UTC) (envelope-from bzeeb-lists@lists.zabbadoz.net) Received: from mail.sbone.de (mail.sbone.de [IPv6:fde9:577b:c1a9:31::2013:587]) (using TLSv1 with cipher ADH-CAMELLIA256-SHA (256/256 bits)) (No client certificate requested) by mx1.sbone.de (Postfix) with ESMTPS id 79DEB25D37C7; Mon, 28 Dec 2015 23:08:05 +0000 (UTC) Received: from content-filter.sbone.de (content-filter.sbone.de [IPv6:fde9:577b:c1a9:31::2013:2742]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.sbone.de (Postfix) with ESMTPS id 90036C770A0; Mon, 28 Dec 2015 23:08:04 +0000 (UTC) X-Virus-Scanned: amavisd-new at sbone.de Received: from mail.sbone.de ([IPv6:fde9:577b:c1a9:31::2013:587]) by content-filter.sbone.de (content-filter.sbone.de [fde9:577b:c1a9:31::2013:2742]) (amavisd-new, port 10024) with ESMTP id OY3uZIS2EfZr; Mon, 28 Dec 2015 23:08:03 +0000 (UTC) Received: from [IPv6:fde9:577b:c1a9:4410:d0e9:39ce:5d55:4dbc] (unknown [IPv6:fde9:577b:c1a9:4410:d0e9:39ce:5d55:4dbc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.sbone.de (Postfix) with ESMTPSA id 7ABAEC77090; Mon, 28 Dec 2015 23:08:02 +0000 (UTC) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2104\)) Subject: Re: Extending FIBs to support multi-tenancy From: "Bjoern A. Zeeb" In-Reply-To: Date: Mon, 28 Dec 2015 23:07:42 +0000 Cc: freebsd-transport@freebsd.org Content-Transfer-Encoding: quoted-printable Message-Id: <5175FE80-32FE-4D5D-9065-1C52EBD49409@lists.zabbadoz.net> References: To: Ryan Stone X-Mailer: Apple Mail (2.2104) X-BeenThere: freebsd-transport@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: Discussions of transport level network protocols in FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 28 Dec 2015 23:08:09 -0000 > On 18 Dec 2015, at 22:26 , Ryan Stone wrote: >=20 > My employer is going through the process of extending our product to > support multi-tenant networking. The details of what are product does > isn't really relevant to the discussion -- it's enough to know that we = have > a number of daemons acting as servers for various network protocols. > Multi-tenacy, as we've defined the feature, imposes the requirement = that > our network services be able to communicate with clients from = completely > independent networks. This has imposed the following new requirements = on us: Stupid question: if we=E2=80=99d bring back the original feature that = processes could attached to different VNET/VIMAGE stacks would that = solve some more of your problems without making the list of problems (a = lot [thinking of ifp management]) longer and be a way cleaner solution? It=E2=80=99s something that=E2=80=99s been in the back of some of our = heads and probably help a lot more people. We=E2=80=99d need to be = careful to be able to support both modes (jail with the =E2=80=9Csecurity=E2= =80=9D view) and the other mode with the multi-tenancy-single-daemon in = mind (think of routers as well for example). /bz=