Zheng Da
Email: zhengda1936 at gmail dot com
Project: Network virtualization for subhurds etc.
The code.
The design and the implementation
The requirements:
- to implement a mechanism which help pfinet servers communicate with each other. For example, if pfinet 1 has IP A and pfinet 2 has IP B, the packet sent by pfinet 1 with destination address IP B should be received by pfinet 2.
- Sub-hurd should be able to use this mechanism to communicate with each other.
- Meanwhile this mechanism should allow non-privileged the user to start his own pfinet.
The possible approach is to use the multiplexer and the filter.
The multiplexer's roles are:
- to create some virtual network interface, so pfinet can send packets to it.
- to receive the packet from pfinet, and forward the packet to other pfinets in hurd
- or forward the packet to the real network device in the kernel and send it to the network.
A filter translator is needed to enforce the policies between the interface and the pfinet server. For example, the filter can control which packets can be delivered to the pfinet server, and which packets can be sent to the network interface. The filter can also guard the network traffic and drop illegal packets (forged by some malicious users) from pfinet or some other programs.
To create a virtual network interface:
- Implement the RPC interface defined in device.defs.
- The multiplexer works as a translator and other programs can get the port to it by calling filenameport().
- Other programs can use this port as a master device port to open the virtual interface.
The routing inside the multiplexer:
- when the multiplexer gets a packet, it forwards it to every interface.
- BPF is ported to the multiplexer. BPF delivers the packet to the right pfinet (according to the filter set by the pfinet) just as the BPF in Mach does.
- All packets are forwarded to the interface which the multiplexer sits on.
The implementation of the filter translator:
- The filter works as a proxy, forwarding the packet between the interface and the pfinet server.
- BPF is also ported to the filter translator. There are two filers in the translator, one for outgoing packets, the other for incoming packets.
- Only one pfinet can connect to the translator at a time.
TODO
Coding
- a proxy of the process server.
- set the device into the promiscuous mode.
- add the policy control. for example, a suer's pfinet has to connect to the filter translator instead of to the interface directly.
Completed tasks
Coding
pfinet server overriding by modifying glibc. The patch is here.
fix pfinet to use the proper filter rule. The patch of pfinet is here.
the multiplexer:
- Create multiple virtual network interfaces.
- Port BPF to the multiplexer.
- Finish the routing among the pfinet servers.
the filter translator:
- Forward the packet between the interface and the pfinet server.
- Filter the packet.
The Code Read
- boot
Documentation Read
- A Programmer's Guide to the Mach System Calls
- Meet Mach by James Scott
- A Programmer's Guide to the Mach User Environment, the MIG part
- Part of The GNU Mach Reference Manual and The GNU Hurd Reference Manual
- The Hurd, a presentation by Marcus Brinkmann
- Towards a New Strategy of OS Design, an architectural overview by Thomas Bushnell, BSG.
- GNU/Hurd User's Guide
- The Hurd Hacking Guide