From owner-freebsd-current@FreeBSD.ORG Fri Sep 19 22:43:23 2008 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id D5E4D1065673 for ; Fri, 19 Sep 2008 22:43:23 +0000 (UTC) (envelope-from maksim.yevmenkin@gmail.com) Received: from fg-out-1718.google.com (fg-out-1718.google.com [72.14.220.159]) by mx1.freebsd.org (Postfix) with ESMTP id 5C99F8FC12 for ; Fri, 19 Sep 2008 22:43:22 +0000 (UTC) (envelope-from maksim.yevmenkin@gmail.com) Received: by fg-out-1718.google.com with SMTP id l26so684190fgb.35 for ; Fri, 19 Sep 2008 15:43:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:cc:in-reply-to:mime-version:content-type:references; bh=wTYytnkuCLtx+9HVfRz/pOHao4+3wB5ohEM+f7zUuJ4=; b=QCK5HcAUlW8AU2jUG/gb/PwhCq+tksOtPvAvJHQYr9KOepJH1QB7Dfd1fhYpC0t9ob zU69NtYFu9RSJ/0KC8U21BgqP05uwT5LbNYWfCvW7dwFICX5buR2gUpn4raGn6Bhk+u4 uV2GiGKGZY7lDEB3O52BWQKa6IOemC1DPTStU= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version :content-type:references; b=xqvRsKeEzugi4hpe2nlseBBapJZlHJJmMvUcsIKeRMwWbBnizJXR0p+l1UUOtBRSQw pauSHrUAyhpeRJi956Kf7S2fUHSJGAKdUM6aSc3jZ7uHdRttatVb9kAkIiDkzar1UsMg BVkdvPhMySi2MLyYOpkGjgKk5SmpkGczzT0iA= Received: by 10.86.98.10 with SMTP id v10mr2578227fgb.46.1221864201536; Fri, 19 Sep 2008 15:43:21 -0700 (PDT) Received: by 10.86.62.1 with HTTP; Fri, 19 Sep 2008 15:43:21 -0700 (PDT) Message-ID: Date: Fri, 19 Sep 2008 15:43:21 -0700 From: "Maksim Yevmenkin" To: "Alexey Shuvaev" In-Reply-To: <20080919203310.GA34131@localhost.my.domain> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_Part_1342_5580332.1221864201515" References: <48D2F942.4070801@FreeBSD.org> <20080919084201.GD44330@wep4035.physik.uni-wuerzburg.de> <48D38DFF.8000803@FreeBSD.org> <20080919203310.GA34131@localhost.my.domain> Cc: freebsd-current@freebsd.org Subject: Re: Interface auto-cloning bug or feature? X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Sep 2008 22:43:23 -0000 ------=_Part_1342_5580332.1221864201515 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline [....] >> That what has caused me to look into this issue. You can find patch for >> security/vpnc to prevent unbounded interface cloning here: >> >> http://sobomax.sippysoft.com/~sobomax/vpnc.diff >> > Ok, the patch prevents interface cloning, but I think it doesn't solve > the actual problem. > Let's wait for Maksim :) ok, how about attached patch. i put it together *very* quickly and only gave it a light testing. its for tap(4), because i could compile it as a module and tun(4) is compiled into kernel by default, but the idea should identical for tun(4). should be even simpler for tun(4) because it does not have to deal with 2 kind of devices (i.e. tap and vmnet). give it a try, and see if it works. please try both cloning paths, i.e. 1) cat /dev/tap (/dev/vmnet) with and/or without unit number and 2) ifconfig tapX (vmnetX) create/destroy in the mean time i will prepare something similar for tun(4). thanks, max ------=_Part_1342_5580332.1221864201515 Content-Type: text/plain; name=if_tap.c.diff.txt Content-Transfer-Encoding: base64 X-Attachment-Id: f_flbe63da0 Content-Disposition: attachment; filename=if_tap.c.diff.txt LS0tIGlmX3RhcC5jLm9yaWcJMjAwOC0wOS0wOCAxNzoyMDo1Ny4wMDAwMDAwMDAgLTA3MDAKKysr IGlmX3RhcC5jCTIwMDgtMDktMTkgMTU6MzU6MDIuMDAwMDAwMDAwIC0wNzAwCkBAIC05NCw2ICs5 NCw3IEBACiBzdGF0aWMgaW50CQl0YXBpZmlvY3RsKHN0cnVjdCBpZm5ldCAqLCB1X2xvbmcsIGNh ZGRyX3QpOwogc3RhdGljIHZvaWQJCXRhcGlmaW5pdCh2b2lkICopOwogCitzdGF0aWMgaW50CQl0 YXBfY2xvbmVfbG9va3VwKHN0cnVjdCBjZGV2ICoqLCB1X3Nob3J0KTsKIHN0YXRpYyBpbnQJCXRh cF9jbG9uZV9jcmVhdGUoc3RydWN0IGlmX2Nsb25lICosIGludCwgY2FkZHJfdCk7CiBzdGF0aWMg dm9pZAkJdGFwX2Nsb25lX2Rlc3Ryb3koc3RydWN0IGlmbmV0ICopOwogc3RhdGljIGludAkJdm1u ZXRfY2xvbmVfY3JlYXRlKHN0cnVjdCBpZl9jbG9uZSAqLCBpbnQsIGNhZGRyX3QpOwpAQCAtMTc2 LDYgKzE3NywyOCBAQAogREVWX01PRFVMRShpZl90YXAsIHRhcG1vZGV2ZW50LCBOVUxMKTsKIAog c3RhdGljIGludAordGFwX2Nsb25lX2xvb2t1cChzdHJ1Y3QgY2RldiAqKmRldiwgdV9zaG9ydCBl eHRyYSkKK3sKKwlzdHJ1Y3QgdGFwX3NvZnRjICp0cDsKKworCW10eF9sb2NrKCZ0YXBtdHgpOwor CVNMSVNUX0ZPUkVBQ0godHAsICZ0YXBoZWFkLCB0YXBfbmV4dCkgeworCQltdHhfbG9jaygmdHAt PnRhcF9tdHgpOworCQlpZiAoKHRwLT50YXBfZmxhZ3MgJiAoVEFQX09QRU58ZXh0cmEpKSA9PSBl eHRyYSkgeworCQkJKmRldiA9IHRwLT50YXBfZGV2OworCQkJbXR4X3VubG9jaygmdHAtPnRhcF9t dHgpOworCQkJbXR4X3VubG9jaygmdGFwbXR4KTsKKworCQkJcmV0dXJuICgxKTsKKwkJfQorCQlt dHhfdW5sb2NrKCZ0cC0+dGFwX210eCk7CisJfQorCW10eF91bmxvY2soJnRhcG10eCk7CisKKwly ZXR1cm4gKDApOworfQorCitzdGF0aWMgaW50CiB0YXBfY2xvbmVfY3JlYXRlKHN0cnVjdCBpZl9j bG9uZSAqaWZjLCBpbnQgdW5pdCwgY2FkZHJfdCBwYXJhbXMpCiB7CiAJc3RydWN0IGNkZXYgKmRl djsKQEAgLTM1Myw4ICszNzYsMTggQEAKIAogCS8qIFdlJ3JlIGludGVyZXN0ZWQgaW4gb25seSB0 YXAvdm1uZXQgZGV2aWNlcy4gKi8KIAlpZiAoc3RyY21wKG5hbWUsIFRBUCkgPT0gMCkgeworCQlp ZiAodGFwX2Nsb25lX2xvb2t1cChkZXYsIDApKSB7CisJCQlkZXZfcmVmKCpkZXYpOworCQkJcmV0 dXJuOworCQl9CisKIAkJdW5pdCA9IC0xOwogCX0gZWxzZSBpZiAoc3RyY21wKG5hbWUsIFZNTkVU KSA9PSAwKSB7CisJCWlmICh0YXBfY2xvbmVfbG9va3VwKGRldiwgVEFQX1ZNTkVUKSkgeworCQkJ ZGV2X3JlZigqZGV2KTsKKwkJCXJldHVybjsKKwkJfQorCiAJCXVuaXQgPSAtMTsKIAkJZXh0cmEg PSBWTU5FVF9ERVZfTUFTSzsKIAl9IGVsc2UgaWYgKGRldl9zdGRjbG9uZShuYW1lLCBOVUxMLCBU QVAsICZ1bml0KSAhPSAxKSB7Cg== ------=_Part_1342_5580332.1221864201515--