Brain dump

• Global IPv6 access (users get own address/prefix)
  • Need to turn on net.ipv6.conf.all.forwarding sysctl
  • Need to configure the network inside of user namespaces.
    • Can we use systemd.network?
    • Do we want to use DHCPv6?
    • We can do simple, static configuration, using the 32bit UID as a suffix in the server's /64 subnet.
• Internal IPv4 network, for NATed IPv4 connectivity
  • Address allocation
    • Use UIDs as suffix for a large subnet?
      Imposes UID range restrictions, hard to extend or interconnect.
    • Do we want to use DHCP?
  • Need to NAT user traffic
• Need to identify which user traffic is from?
  • For IPv6, can be done using the src/dst addresses
  • For IPv4, we need to either expose that info using identd, or drop identd support
  • When creating veth, give non-session side a MAC address ending in UID?
    • Use private use MAC address ranges
    • How to get a UID from a pam plugin?
  • Need to filter each user's packets and only allow a 'dst' with their assigned ranges
• What should setup iptables rules?
  For static rules, we already use ferm

To make it a named netns:

• mkdir("/var/run/netns", 0755) != EEXIST
• mount("", "/var/run/netns", "none", MS_REC|MS_SHARED, NULL)
• open("/var/run/netns/%s", O_RDONLY|O_CREAT|O_EXCL, 0) = 5
• close(5)
• mount("/proc/self/ns/net", "/var/run/netns/%s", "proc", MS_BIND, NULL)

Unfortunatly, I think this would lose us automatic cleanup