From owner-freebsd-current@FreeBSD.ORG Mon Sep 22 22:17:17 2008 Return-Path: Delivered-To: freebsd-current@FreeBSD.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 1DECA106567C for ; Mon, 22 Sep 2008 22:17:17 +0000 (UTC) (envelope-from sobomax@FreeBSD.org) Received: from sippysoft.com (gk1.360sip.com [72.236.70.240]) by mx1.freebsd.org (Postfix) with ESMTP id D7D2A8FC17 for ; Mon, 22 Sep 2008 22:17:16 +0000 (UTC) (envelope-from sobomax@FreeBSD.org) Received: from [192.168.0.61] ([204.244.149.125]) (authenticated bits=0) by sippysoft.com (8.13.8/8.13.8) with ESMTP id m8MMHEXd093039 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 22 Sep 2008 15:17:15 -0700 (PDT) (envelope-from sobomax@FreeBSD.org) Message-ID: <48D8196E.7020005@FreeBSD.org> Date: Mon, 22 Sep 2008 15:17:18 -0700 From: Maxim Sobolev Organization: Sippy Software, Inc. User-Agent: Thunderbird 2.0.0.16 (Windows/20080708) MIME-Version: 1.0 To: Maksim Yevmenkin References: <48D2F942.4070801@FreeBSD.org> <20080919084201.GD44330@wep4035.physik.uni-wuerzburg.de> <48D38DFF.8000803@FreeBSD.org> <20080919203310.GA34131@localhost.my.domain> In-Reply-To: Content-Type: text/plain; charset=KOI8-U; format=flowed Content-Transfer-Encoding: 7bit Cc: Alexey Shuvaev , freebsd-current@FreeBSD.org Subject: Re: Interface auto-cloning bug or feature? X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Sep 2008 22:17:17 -0000 Patch works for me just fine. Thanks! -Maxim Maksim Yevmenkin wrote: > On Fri, Sep 19, 2008 at 3:43 PM, Maksim Yevmenkin > wrote: >> [....] >> >>>> That what has caused me to look into this issue. You can find patch for >>>> security/vpnc to prevent unbounded interface cloning here: >>>> >>>> http://sobomax.sippysoft.com/~sobomax/vpnc.diff >>>> >>> Ok, the patch prevents interface cloning, but I think it doesn't solve >>> the actual problem. >>> Let's wait for Maksim :) >> ok, how about attached patch. i put it together *very* quickly and >> only gave it a light testing. its for tap(4), because i could compile >> it as a module and tun(4) is compiled into kernel by default, but the >> idea should identical for tun(4). should be even simpler for tun(4) >> because it does not have to deal with 2 kind of devices (i.e. tap and >> vmnet). give it a try, and see if it works. please try both cloning >> paths, i.e. >> >> 1) cat /dev/tap (/dev/vmnet) with and/or without unit number >> >> and >> >> 2) ifconfig tapX (vmnetX) create/destroy >> >> in the mean time i will prepare something similar for tun(4). > > attached is similar patch for tun(4). i only made sure it compiles :) > rebuilding kernel now... > > thanks, > max >