Re: Status update on 1.0

[Thompson, David]

On Fri, Mar 15, 2019 at 10:33 AM Ludovic Courtès <address@hidden> wrote:
>
> Hi,
>
> Gábor Boskovits <address@hidden> skribis:
>
> > Ludovic Courtès <address@hidden> ezt írta (időpont: 2019. márc. 13., Sze, 
> > 16:21):
> >>
> >> Hello Guix!
> >
> >>   • IPv6 support in ‘static-networking-service’: as discussed at the
> >>     Guix Days, we’ll probably need to Linux Netlink sockets to do that
> >>     rather than the old ioctls currently used in (guix build syscalls).
> >>
> >>     The netlink interface for network config is vaguely documented at
> >>     <https://wiki.linuxfoundation.org/networking/generic_netlink_howto>.
> >>     Writing bindings for ‘sendmsg’ and the associated data structures
> >>     looks reasonable… it just needs to be done.
> >>
> >
> > I am interested in doing this.
>
> Awesome!
>
> > However, there are a few points that needs to be clarified: 1. I came
> > to the same conclusion regarding the netlink stuff, but the old ioctl
> > cannot be fully dropped. (It still provides funcions that are needed
> > to get the netlink working)
>
> Yes, I think we can keep it.
>
> > 2. This might be linux specific. What do we do on other kernels?
> > (It might be reasonable to provide the abstractions in a module, and
> > from there select an available implementation, or signal an error that
> > the functionality is not yet implemented for this system...)
> > Wdyt?
>
> For now, we’ll have to ignore the other kernel.
>
> Longer-term, I suppose we should provide an abstraction over network
> configuration and have it translated to Netlink messages or Hurd RPCs.
>
> > Also a nice low level binding written in C is available as libmnl:
> > https://netfilter.org/projects/libmnl/index.html
>
> Or libnl also.  Though if it’s not too hard, I’d rather have us directly
> bind to ‘sendmsg’, ‘struct msghdr’, and so on.

Quick tangent: My memory is a bit fuzzy, but I think that netlink API
wrappers would put us one step closer to being able to implement
useful network isolation in our container implementation (right now
you only have loopback, not so fun), like what Docker can do. Just
something to consider. :)

- Dave