From owner-freebsd-current@FreeBSD.ORG Sat Sep 20 00:34:25 2008 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 4DA841065673; Sat, 20 Sep 2008 00:34:25 +0000 (UTC) (envelope-from shuvaev@physik.uni-wuerzburg.de) Received: from mailrelay.rz.uni-wuerzburg.de (wrzx28.rz.uni-wuerzburg.de [132.187.3.28]) by mx1.freebsd.org (Postfix) with ESMTP id C9ED48FC15; Sat, 20 Sep 2008 00:34:24 +0000 (UTC) (envelope-from shuvaev@physik.uni-wuerzburg.de) Received: from virusscan.mail (localhost [127.0.0.1]) by mailrelay.mail (Postfix) with ESMTP id E931FA06DB; Sat, 20 Sep 2008 02:34:22 +0200 (CEST) Received: from localhost (localhost [127.0.0.1]) by virusscan.mail (Postfix) with ESMTP id DC776A06D8; Sat, 20 Sep 2008 02:34:22 +0200 (CEST) Received: from mail.physik.uni-wuerzburg.de (wthp192.physik.uni-wuerzburg.de [132.187.40.192]) by mailmaster.uni-wuerzburg.de (Postfix) with ESMTP id C8B67A06D4; Sat, 20 Sep 2008 02:34:22 +0200 (CEST) Received: from localhost.my.domain ([80.129.180.100]) by mail.physik.uni-wuerzburg.de (Lotus Domino Release 8.0.2) with ESMTP id 2008092002342212-35504 ; Sat, 20 Sep 2008 02:34:22 +0200 Received: by localhost.my.domain (sSMTP sendmail emulation); Sat, 20 Sep 2008 02:38:44 +0200 Date: Sat, 20 Sep 2008 02:38:43 +0200 From: Alexey Shuvaev To: Maksim Yevmenkin , Maxim Sobolev Message-ID: <20080920003843.GA2710@localhost.my.domain> References: <48D2F942.4070801@FreeBSD.org> <20080919084201.GD44330@wep4035.physik.uni-wuerzburg.de> <48D38DFF.8000803@FreeBSD.org> <20080919203310.GA34131@localhost.my.domain> MIME-Version: 1.0 In-Reply-To: Organization: Universitaet Wuerzburg User-Agent: Mutt/1.5.18 (2008-05-17) X-MIMETrack: Itemize by SMTP Server on domino1/uni-wuerzburg(Release 8.0.2|August 07, 2008) at 09/20/2008 02:34:22 AM, Serialize by Router on domino1/uni-wuerzburg(Release 8.0.2|August 07, 2008) at 09/20/2008 02:34:22 AM, Serialize complete at 09/20/2008 02:34:22 AM Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Virus-Scanned: by amavisd-new at uni-wuerzburg.de Cc: freebsd-current@freebsd.org Subject: Re: Interface auto-cloning bug or feature? X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 20 Sep 2008 00:34:25 -0000 On Fri, Sep 19, 2008 at 03:51:31PM -0700, Maksim Yevmenkin wrote: > On Fri, Sep 19, 2008 at 3:43 PM, Maksim Yevmenkin > wrote: > > [....] > > > >>> That what has caused me to look into this issue. You can find patch for > >>> security/vpnc to prevent unbounded interface cloning here: > >>> > >>> http://sobomax.sippysoft.com/~sobomax/vpnc.diff > >>> > >> Ok, the patch prevents interface cloning, but I think it doesn't solve > >> the actual problem. > >> Let's wait for Maksim :) > > As for vpnc-script, yes I also think using kldstat to check if the module is present is more correct than stat-ing /dev/tun. Actually I have commented these lines out in my previous mail instead of applying the patch %-) > > ok, how about attached patch. i put it together *very* quickly and > > only gave it a light testing. its for tap(4), because i could compile > > it as a module and tun(4) is compiled into kernel by default, but the > > idea should identical for tun(4). should be even simpler for tun(4) > > because it does not have to deal with 2 kind of devices (i.e. tap and > > vmnet). give it a try, and see if it works. please try both cloning > > paths, i.e. > > > > 1) cat /dev/tap (/dev/vmnet) with and/or without unit number > > > > and > > > > 2) ifconfig tapX (vmnetX) create/destroy > > > > in the mean time i will prepare something similar for tun(4). > > attached is similar patch for tun(4). i only made sure it compiles :) > rebuilding kernel now... > Ok, I have tried both patches and in both cases 'cloning bug' is went away. I have tried cat /dev/tap (creates only /dev/tap0) cat /dev/tapX (creates exactly /dev/tapX) stat /dev/[tun|tap|vmnet] (creates only '0' device) and also running unpatched security/vpnc. Everything works fine! Thanks! Alexey.