Multicast in jail?

[Bjoern A. Zeeb]

On Tue, 7 Jul 2009, Alexander Leidinger wrote:

> Quoting Bill Marquette <bill.marquette at ucsecurity.com> (from Mon, 6 Jul 2009 
> 20:14:02 -0500 (CDT)):
>
>> I'm trying to run Avahi in a jail, much the same as Alexander Leidinger in 
>> this email from late last year 
>> http://www.mail-archive.com/freebsd-jail@freebsd.org/msg00587.html.  I 
>> couldn't find any replies to that thread and it seems that I'm running into 
>> the same issues - the service announcements make it on the wire and the 
>> other devices in the network see them.
>
> So far I have nothing working.
>
> I assume that the mcast traffic is not arriving at all IPs. <wild 
> guess>Either because on overly restrictive jail check, and/or just because 
> there's no code which is distributing the traffic to all IPs.</wild guess>
>
> It seems kern_jail.c is a place to check if there's some code which handles

No, in_pcb.c in6_pcb.c in_m*.[ch] in6_m*.[ch] are the files you need
as a starting point; there's more and more and more.

> this. Maybe prison_check_ip[46] if mcast is on top of this, or something new 
> to write if mcast is a different "AF". Again, this is a wild guess, I don't 
> have enough understanding of the network code in the kernel to even make 
> educated guesses about the real reason.

But you first will have to understand all implications, that need a
proper design plan and after that thoughtout implementation.

Alternatively I wouldn't wonder if enabling raw sockets would give
what you want or you'll wait for virtualization to be ready.

/bz

-- 
Bjoern A. Zeeb                      The greatest risk is not taking one.