From owner-freebsd-current@FreeBSD.ORG Sat Sep 20 13:27:09 2008 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 90D1D1065670 for ; Sat, 20 Sep 2008 13:27:09 +0000 (UTC) (envelope-from kostikbel@gmail.com) Received: from mail.terabit.net.ua (mail.terabit.net.ua [195.137.202.147]) by mx1.freebsd.org (Postfix) with ESMTP id 3104B8FC14 for ; Sat, 20 Sep 2008 13:27:09 +0000 (UTC) (envelope-from kostikbel@gmail.com) Received: from skuns.zoral.com.ua ([91.193.166.194] helo=mail.zoral.com.ua) by mail.terabit.net.ua with esmtp (Exim 4.63 (FreeBSD)) (envelope-from ) id 1Kh2UM-000HyM-U2; Sat, 20 Sep 2008 16:27:06 +0300 Received: from deviant.kiev.zoral.com.ua (root@deviant.kiev.zoral.com.ua [10.1.1.148]) by mail.zoral.com.ua (8.14.2/8.14.2) with ESMTP id m8KDR3Ug087167 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Sat, 20 Sep 2008 16:27:03 +0300 (EEST) (envelope-from kostikbel@gmail.com) Received: from deviant.kiev.zoral.com.ua (kostik@localhost [127.0.0.1]) by deviant.kiev.zoral.com.ua (8.14.2/8.14.2) with ESMTP id m8KDR3IW001129; Sat, 20 Sep 2008 16:27:03 +0300 (EEST) (envelope-from kostikbel@gmail.com) Received: (from kostik@localhost) by deviant.kiev.zoral.com.ua (8.14.3/8.14.3/Submit) id m8KDR3O7001127; Sat, 20 Sep 2008 16:27:03 +0300 (EEST) (envelope-from kostikbel@gmail.com) X-Authentication-Warning: deviant.kiev.zoral.com.ua: kostik set sender to kostikbel@gmail.com using -f Date: Sat, 20 Sep 2008 16:27:03 +0300 From: Kostik Belousov To: Maksim Yevmenkin Message-ID: <20080920132703.GG47828@deviant.kiev.zoral.com.ua> References: <48D2F942.4070801@FreeBSD.org> <20080919084201.GD44330@wep4035.physik.uni-wuerzburg.de> <48D38DFF.8000803@FreeBSD.org> <20080919203310.GA34131@localhost.my.domain> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="Sw7tCqrGA+HQ0/zt" Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4.2.3i X-Virus-Scanned: ClamAV version 0.93.3, clamav-milter version 0.93.3 on skuns.kiev.zoral.com.ua X-Virus-Status: Clean X-Spam-Status: No, score=-4.4 required=5.0 tests=ALL_TRUSTED,AWL,BAYES_00 autolearn=ham version=3.2.5 X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on skuns.kiev.zoral.com.ua X-Virus-Scanned: mail.terabit.net.ua 1Kh2UM-000HyM-U2 37c5a57f2777565e84c8d6124645e2bf X-Terabit: YES Cc: Alexey Shuvaev , freebsd-current@freebsd.org Subject: Re: Interface auto-cloning bug or feature? X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 20 Sep 2008 13:27:09 -0000 --Sw7tCqrGA+HQ0/zt Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Fri, Sep 19, 2008 at 03:43:21PM -0700, Maksim Yevmenkin wrote: > [....] >=20 > >> That what has caused me to look into this issue. You can find patch for > >> security/vpnc to prevent unbounded interface cloning here: > >> > >> http://sobomax.sippysoft.com/~sobomax/vpnc.diff > >> > > Ok, the patch prevents interface cloning, but I think it doesn't solve > > the actual problem. > > Let's wait for Maksim :) >=20 > ok, how about attached patch. i put it together *very* quickly and > only gave it a light testing. its for tap(4), because i could compile > it as a module and tun(4) is compiled into kernel by default, but the > idea should identical for tun(4). should be even simpler for tun(4) > because it does not have to deal with 2 kind of devices (i.e. tap and > vmnet). give it a try, and see if it works. please try both cloning > paths, i.e. >=20 > 1) cat /dev/tap (/dev/vmnet) with and/or without unit number >=20 > and >=20 > 2) ifconfig tapX (vmnetX) create/destroy >=20 > in the mean time i will prepare something similar for tun(4). >=20 > thanks, > max > --- if_tap.c.orig 2008-09-08 17:20:57.000000000 -0700 > +++ if_tap.c 2008-09-19 15:35:02.000000000 -0700 > @@ -94,6 +94,7 @@ > static int tapifioctl(struct ifnet *, u_long, caddr_t); > static void tapifinit(void *); > =20 > +static int tap_clone_lookup(struct cdev **, u_short); > static int tap_clone_create(struct if_clone *, int, caddr_t); > static void tap_clone_destroy(struct ifnet *); > static int vmnet_clone_create(struct if_clone *, int, caddr_t); > @@ -176,6 +177,28 @@ > DEV_MODULE(if_tap, tapmodevent, NULL); > =20 > static int > +tap_clone_lookup(struct cdev **dev, u_short extra) > +{ > + struct tap_softc *tp; > + > + mtx_lock(&tapmtx); > + SLIST_FOREACH(tp, &taphead, tap_next) { > + mtx_lock(&tp->tap_mtx); > + if ((tp->tap_flags & (TAP_OPEN|extra)) =3D=3D extra) { > + *dev =3D tp->tap_dev; > + mtx_unlock(&tp->tap_mtx); > + mtx_unlock(&tapmtx); > + > + return (1); > + } > + mtx_unlock(&tp->tap_mtx); > + } > + mtx_unlock(&tapmtx); > + > + return (0); > +} > + > +static int > tap_clone_create(struct if_clone *ifc, int unit, caddr_t params) > { > struct cdev *dev; > @@ -353,8 +376,18 @@ > =20 > /* We're interested in only tap/vmnet devices. */ > if (strcmp(name, TAP) =3D=3D 0) { > + if (tap_clone_lookup(dev, 0)) { > + dev_ref(*dev); > + return; What would prevent two concurrent threads from selecting the same device there ? First thread could look up the device, unloc tapmtx and be preempted. Then second thread is put on CPU, do the same selection. Now you have a problem. --Sw7tCqrGA+HQ0/zt Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (FreeBSD) iEYEARECAAYFAkjU+iYACgkQC3+MBN1Mb4g78wCfddJKStzNj9xTz79XbtUJ8do0 zqkAoJY/J9EELGG2kCa1Lz++C7/U7Gwg =t1a/ -----END PGP SIGNATURE----- --Sw7tCqrGA+HQ0/zt--