Xen and The Art of Free Speech

Aside from the laugh­able idea of “mil­i­tantly” sup­port­ing any­thing with a blog post, Miguel sim­ply noted that these peo­ple exist, have writ­ten a book, and will be doing the speaking-tour-thing near him. Does he agree with the con­tents? (shakes eight-ball) Signs point to Yes.

Is he free to do so? Also yes.

Are you free to ignore him? Still yes.

Does His Chomskiness actu­ally take the chal­lenge and pro­vide a bet­ter rebut­tal to the under­ly­ing book than politely demand­ing Miguel STFU? Yep.

Oh, and here’s a patch that will let you do some­thing cool with XEN 3.0.3:

--- network-bridge      2007-02-08 09:21:12.000000000 -0600
+++ network-vlans       2007-09-14 09:55:20.000000000 -0500
@@ -26,6 +26,7 @@
 # bridge     The bridge to use (default xenbr${vifnum}).
 # netdev     The interface to add to the bridge (default eth${vifnum}).
 # antispoof  Whether to use iptables to prevent spoofing (default no).
+# vlans      VLANs to add on top of the bridge
 #
 # Internal Vars:
 # pdev="p${netdev}"
@@ -64,18 +65,27 @@
 bridge=${bridge:-xenbr${vifnum}}
 netdev=${netdev:-eth${vifnum}}
 antispoof=${antispoof:-no}
+vlans=$(echo $vlans | sed -e 's/,/ /g')

 pdev="p${netdev}"
 vdev="veth${vifnum}"
 vif0="vif0.${vifnum}"

 get_ip_info() {
-    addr_pfx=`ip addr show dev $1 | egrep '^ *inet' | sed -e 's/ *inet //' -e 's/ .*//'`
+    addr_pfx=`ip addr show dev $1 | sed -n 's/^ *inet \(.*\) [^ ]*$/\1/p'`
     gateway=`ip route show dev $1 | fgrep default | sed 's/default via //'`
 }
+
+is_bonding() {
+    [ -f "/sys/class/net/$1/bonding/slaves" ]
+}
+
+is_ifup() {
+    ip link show dev $1 | awk '{ exit $3 !~ /[< ,]UP[,>]/ }'
+}

 do_ifup() {
-    if ! ifup $1 ; then
+    if ! ifup $1 || ! is_ifup $1 ; then
         if [ ${addr_pfx} ] ; then
             # use the info from get_ip_info()
             ip addr flush $1
@@ -206,8 +216,8 @@
        mac=`ip link show ${netdev} | grep 'link\/ether' | sed -e 's/.*ether \(..:..:..:..:..:..\).*/\1/'`
        preiftransfer ${netdev}
        transfer_addrs ${netdev} ${vdev}
-       if ! ifdown ${netdev}; then
-           # If ifdown fails, remember the IP details.
+       if is_bonding ${netdev} || ! ifdown ${netdev}; then
+           # Remember the IP details if necessary.
            get_ip_info ${netdev}
            ip link set ${netdev} down
            ip addr flush ${netdev}
@@ -223,6 +233,18 @@
        add_to_bridge  ${bridge} ${vif0}
        add_to_bridge2 ${bridge} ${pdev}
        do_ifup ${netdev}
+
+       if [ -n "$vlans" ]; then
+               vconfig set_name_type VLAN_PLUS_VID_NO_PAD
+
+               for vlan in $vlans; do
+                       create_bridge xenbr${vlan}
+
+                       vconfig add ${bridge} ${vlan}
+                       setup_bridge_port vlan${vlan}
+                       add_to_bridge xenbr${vlan} vlan${vlan}
+               done
+       fi
     else
        # old style without ${vdev}
        transfer_addrs  ${netdev} ${bridge}
@@ -262,6 +284,20 @@
        ip link set ${netdev} name ${vdev}
        ip link set ${pdev} name ${netdev}
        do_ifup ${netdev}
+
+       if [ -n "$vlans" ]; then
+               for vlan in $vlans; do
+                       if [ -n `ip link show vlan${vlan} | grep '${bridge}\:'` ]; then
+                               ip link delif ${bridge} xenbr${vlan}
+                               ip link set ${bridge} down
+
+                               ip link set vlan${vlan} down
+                               vconfig rem ${bridge} ${vlan}
+                       fi
+               done
+
+               vconfig set_name_type DEV_PLUS_VID_NO_PAD
+       fi
     else
        transfer_routes ${bridge} ${netdev}
        ip link set ${bridge} down

It may be buggy, since I haven’t tested it in pro­duc­tion. What it does is this: allows you to run an 802.1Q trunk into your XEN server, then put your vir­tual machines on any VLAN you want with a cou­ple con­fig­u­ra­tion stanzas.

So, your xend-config.sxp will have:

(network-script 'network-vlans netdev=eth0 vlans=8,9,10,11,13,121,14,15')

Which trans­lates to “cre­ate bridges for VLAN 8, 9, 11, 13, 121, 14, and 15 with a xenbr pre­fix”. Then you set your DomU vif stanza to be “bridge=xenbr13” and bam! your DomU exists on the VLAN13. The pri­mary lim­i­ta­tion of this is that it keeps your Dom0 on the untagged/native VLAN, which isn’t best practice.

The stack of mod­ules a packet tra­verses to get to a DomU will look like this (with rel­e­vant modules):

[network] -->
dom0: peth0 (dev) -->
dom0: xenbr0 (bridge) -->
dom0: vlan13 (dot1q attached to xenbr0) -->
dom0: xenbr13 (bridge) -->
dom0: vifX.0 (netloop) -->
domU: xen0 (xennet)

8 Responses

  1. Miguel de Icaza says:

    Chomsky is talk­ing about the arti­cle, and he basi­cally agrees with the premise, but dis­agrees that only the Lobby is to blame for, that there is plenty of other blame to go around.

    I have not read the book in its entirety, but it sig­nif­i­cantly larger than the arti­cle that you can read in a cou­ple of hours.

  2. Martin Coxall says:

    It’s not great for GNOME, really though, is it?

    That you let this fetid, anti-semitic, cretino-leftists, Microsoft-arse-licking lick­spit­tle get away with spew­ing his passive-aggressive unpleas­ant­ness across your free soft­ware project blogregator.

    It really is about time that Icaza is told that he’s not wel­come any more and should STFU.

  3. James Cape says:

    Miguel:

    I’ve not read the book either. I didn’t know there was one, honestly.

    Martin:

    1. You begin by refer­ring to GNOME in the sec­ond per­son — “you” — but drop the pro­nouns alto­gether when demand­ing Miguel be told (by “us”, I pre­sume) that he’s not wel­come any­more. Are you say­ing you want some­one ostri­cized from a group you’re not a part of?

    2. So far as I am aware, Planet GNOME is what­ever those who have been involved in GNOME — past and present — want to make it. It’s not a “project” any­thing, nor has it ever been. If Miguel’s mis­sives on the state of Israel’s behav­ior in the ter­ri­to­ries make it on http://​www​.gnome​.org, then you’ve got a complaint…

    3. Typically, demands that X be purged from the party take longer than 100 words. Otherwise people’s minds rebel at the abrupt shift. You would do well to remem­ber that in the future, Comrade Coxall.

  4. iain says:

    “The expres­sion “Partisan pol­i­tics” usu­ally refers to fer­vent, some­times mil­i­tant sup­port of a party, cause, fac­tion, per­son, or idea.”

    Surely that is exactly what we want. People who are pas­sion­ate about the things they believe. The falecy that every­thing has to appeal to every­one and not offend or upset any­one is what has made the world a bland place.

    And I love the anti-israel == anti-semetic bull­shit from Mr Coxall. Still, same thing hap­pens with America. I dis­agree with peo­ple get­ting tasered for ask­ing the wrong ques­tions, so obvi­ously I just hate amer­ica. Makes per­fect sense. How can one hate a coun­try anyway?

  5. Herman Bos says:

    We already do the same thing with­out any patching.

    Just cre­ate all the vlan devices in dom0 (eth0.2, eth0.342, etc.), put them each in a bridge (xenbr2, xenbr342, etc.) and then you can do the exact same. Decide in which VLAN the DomU lives.

    Basicly you just com­ment the (network-script ) thingy out com­pletely and con­fig­ure all the bridges and stuff in the dom0 system.

  6. James Cape says:

    That’s true, except that the RHEL 5 network-scripts fall apart when your “eth0” is actu­ally an active/passive 802.3ad “bond0,” and is built on top of sev­eral eth­er­net devices.

    In that case, your options are to either fix the RHEL 5 scripts, or write a cus­tom script to bring up all your inter­faces in the proper order. Using the “network-vlans” patch above, you sim­ply con­fig­ure your bond0 (which does work with the RHEL 5 scripts), and then just let XEN do it’s thing on top of that.

    Update: Let me rephrase the first para­graph: RHEL 5’s net­work scripts fall apart when you try to do a bridge on top of a dot1q on top of a bond­ing device on top of the real NICs, and make it come up on boot. In which case you’re going to be script­ing the startup any­ways, so why not just do a reg­u­lar bonded device and then let XEN’s net­work scripts do all the inter­face renam­ing and bridg­ing craziness.

  7. Andy Shelley says:

    In more recent RedHat updates, this patch spits out errors, appar­ently it seems because some of the changes were already incorporated.


    *** network-bridge 2007-10-12 14:44:44.000000000 -0400
    --- network-vlans 2007-10-22 13:06:20.000000000 -0400
    ***************
    *** 27,32 ****
    --- 27,33 ----
    # bridge The bridge to use (default xenbr${vifnum}).
    # netdev The interface to add to the bridge (default eth${vifnum}).
    # antispoof Whether to use iptables to prevent spoofing (default no).
    + # vlans VLANs to add on top of the bridge
    #
    # Internal Vars:
    # pdev="p${netdev}"
    ***************
    *** 65,70 ****
    --- 66,72 ----
    bridge=${bridge:-xenbr${vifnum}}
    netdev=${netdev:-eth${vifnum}}
    antispoof=${antispoof:-no}
    + vlans=$(echo $vlans | sed -e 's/,/ /g')

    pdev=“p${netdev}“
    vdev=“veth${vifnum}“
    ***************
    *** 232,237 ****
     — 234,251 —-
    add_to_bridge ${bridge} ${vif0}
    add_to_bridge2 ${bridge} ${pdev}
    do_ifup ${net­dev}
    +
    + if [ –n “$vlans”] ]; then
    + vcon­fig set_name_type VLAN_PLUS_VID_NO_PAD
    +
    + for vlan in $vlans; do
    + create_bridge xenbr${vlan}
    +
    + vcon­fig add ${bridge} ${vlan}
    + setup_bridge_port vlan${vlan}
    + add_to_bridge xenbr${vlan} vlan${vlan}
    + done
    + fi
    else
    # old style with­out ${vdev}
    transfer_addrs ${net­dev} ${bridge}
    ***************
    *** 271,276 ****
     — 285,304 —-
    ip link set ${net­dev} name ${vdev}
    ip link set ${pdev} name ${net­dev}
    do_ifup ${net­dev}
    +
    + if [ –n “$vlans”] ]; then
    + for vlan in $vlans; do
    + if [ –n ‘ip link show vlan${vlan} | grep ‘${bridge}:’‘ ]; then
    + ip link delif ${bridge} xenbr${vlan}
    + ip link set ${bridge} down
    +
    + ip link set vlan${vlan} down
    + vcon­fig rem ${bridge} ${vlan}
    + fi
    + done
    +
    + vcon­fig set_name_type DEV_PLUS_VID_NO_PAD
    + fi
    else
    transfer_routes ${bridge} ${net­dev}
    ip link set ${bridge} down

    Also, you don’t HAVE to leave dom0 on the native vlan. I’ve found that run­ning the new xen script with some­thing like:

    network-vlans vlans=7,10 vifnum=0 netdev=bond0 start

    worked just fine, my local bond0.7 or bond0.10 inter­faces that were cre­ated with RedHat star­tups still func­tioned. However, it killed the local rout­ing table, neces­si­tat­ing re-doing that.

Leave a Reply

*