MirageOS is a library operating system that constructs unikernels
CHANGES:
CHANGES:
CHANGES:
CHANGES:
CHANGES:
CHANGES:
CHANGES:
CHANGES:
IPv6 and dual (IPv4 and IPv6) stack support #1187
Since a long time, IPv6 code was around in our TCP/IP stack (thanks to @nojb who developed it in 2014). Some months ago, @hannesm and @MagnusS got excited to use it. After we managed to fix some bugs and add some test cases, and writing more code to setup IPv6-only and dual stacks, we are eager to share this support for MirageOS in a released version. We expect there to be bugs lingering around, but duplicate address detection (neighbour solicitation and advertisements) has been implemented, and (unless "--accept-router-advertisement=false") router advertisements are decoded and used to configure the IPv6 part of the stack. Configuring a static IPv6 address is also possible (with "--ipv6=2001::42/64").
While at it, we unified the boot arguments between the different targets: namely, on Unix (when using the socket stack), you can now pass "--ipv4=127.0.0.1/24" to the same effect as the direct stack: only listen on 127.0.0.1 (the subnet mask is ignored for the Unix socket stack).
A dual stack unikernel has "--ipv4-only=BOOL" and "--ipv6-only=BOOL" parameters, so a unikernel binary could support both Internet Protocol versions, while the operator can decide which protocol version to use.
Please also note that the default IPv4 network configuration no longer uses 10.0.0.1 as default gateway (since there was no way to unset the default gateway #1147).
For unikernel developers, there are some API changes in the Mirage module
Some parts of the Mirage_key module were unified as well:
If you're ready to experiment with the dual stack, here's a diff for our basic network example (from mirage-skeleton/device-usage/network) replacing IPv4 with a dual stack:
diff --git a/device-usage/network/config.ml b/device-usage/network/config.ml
CHANGES:
The Xen backend is a minimal legacy-free re-write: Solo5 (since 0.6.6) provides the low-level glue code, and ocaml-freestanding provides the OCaml runtime. The PV-only Mini-OS implementation has been retired.
The only supported virtualization mode is now Xen PVH (version 2 or above), supported since Xen version 4.10 or later (and Qubes OS 4.0).
The support for the ARM32 architecture on Xen has been removed.
Security posture improvements:
With the move to a Solo5 and ocaml-freestanding base MirageOS gains several notable improvements to security posture for unikernels on Xen:
.text
is read-execute, .rodata
is
read-only, non-executable and .data
, heap and stack are read-write and
non-executable.Interface changes:
Other changes:
dev-repo
field is emitted for the generated opam file.qvm-prefs qube-name kernelopts ''
.Acknowledgements:
CHANGES: