From owner-freebsd-hackers  Tue Nov 16 22:30:56 1999
Delivered-To: freebsd-hackers@freebsd.org
Received: from orange.kame.net (orange.kame.net [203.178.141.194])
	by hub.freebsd.org (Postfix) with ESMTP
	id 8C3C014ECE; Tue, 16 Nov 1999 22:30:51 -0800 (PST)
	(envelope-from shin@nd.net.fujitsu.co.jp)
Received: from localhost (kame209.kame.net [203.178.141.209])
	by orange.kame.net (8.9.1+3.1W/3.7W) with ESMTP id PAA18369;
	Wed, 17 Nov 1999 15:30:38 +0900 (JST)
To: phk@critter.freebsd.dk
Cc: beyssac@enst.fr, freebsd-hackers@FreeBSD.ORG,
	freebsd-security@FreeBSD.ORG
Subject: Re: Should jail treat ip-number? 
In-Reply-To: <19991117151309T.shin@nd.net.fujitsu.co.jp>
References: <19991117134132S.shin@nd.net.fujitsu.co.jp>
	<28858.942818296@critter.freebsd.dk>
	<19991117151309T.shin@nd.net.fujitsu.co.jp>
X-Mailer: Mew version 1.94 on Emacs 20.4 / Mule 4.0 (HANANOEN)
X-Prom-Mew: Prom-Mew 1.93.4 (procmail reader for Mew)
Mime-Version: 1.0
Content-Type: Text/Plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <19991117153126C.shin@nd.net.fujitsu.co.jp>
Date: Wed, 17 Nov 1999 15:31:26 +0900
From: Yoshinobu Inoue <shin@nd.net.fujitsu.co.jp>
X-Dispatcher: imput version 990905(IM130)
Lines: 30
Sender: owner-freebsd-hackers@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

> > >  Don't specify addresses via jail(2), and let kernel select
> > >  any non binded address.
> > No, that doesn't work.  People want to run servers so they want
> > to know their IP for DNS.
> Hmmm, I wish if I could just let jail(2) pass DNS name into
> the kernel, but the implementation in the kernel won't be easy
> nor clean....

Then I have a new proposal which might not be so clean but
I think it is somewhat practical.

-Only think about inet and inet6. Forget about other protocol
 family and sockaddr.
 (Just as current jail only think about inet.)

-Just add an in6_addr structure(IPv6 address) member
 "ip6_number" into the jail structure.

-Jail(2) specify "ip_number" and/or "ip6_number" into the kernel.

-Kernel treat "ip6_number" as just a same kind of extension
 for IPv6 as "ip_number" for IPv4.

-Jail(8) command can also accept DNS name, and then it resolve
 the name internally and,
   if A record is obtained, specify its address into "ip_number".
   if AAAA record is obtained, also specify its address into "ip6_number".


Yoshinobu Inoue


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-hackers" in the body of the message