Date: Sat, 20 Sep 2008 02:38:43 +0200 From: Alexey Shuvaev <shuvaev@physik.uni-wuerzburg.de> To: Maksim Yevmenkin <maksim.yevmenkin@gmail.com>, Maxim Sobolev <sobomax@FreeBSD.org> Cc: freebsd-current@freebsd.org Subject: Re: Interface auto-cloning bug or feature? Message-ID: <20080920003843.GA2710@localhost.my.domain> In-Reply-To: <bb4a86c70809191551y774c233g5e664c431be62a50@mail.gmail.com> References: <48D2F942.4070801@FreeBSD.org> <20080919084201.GD44330@wep4035.physik.uni-wuerzburg.de> <48D38DFF.8000803@FreeBSD.org> <20080919203310.GA34131@localhost.my.domain> <bb4a86c70809191543y7f3d38ex73c48186dfd163c5@mail.gmail.com> <bb4a86c70809191551y774c233g5e664c431be62a50@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, Sep 19, 2008 at 03:51:31PM -0700, Maksim Yevmenkin wrote: > On Fri, Sep 19, 2008 at 3:43 PM, Maksim Yevmenkin > <maksim.yevmenkin@gmail.com> wrote: > > [....] > > > >>> That what has caused me to look into this issue. You can find patch for > >>> security/vpnc to prevent unbounded interface cloning here: > >>> > >>> http://sobomax.sippysoft.com/~sobomax/vpnc.diff > >>> > >> Ok, the patch prevents interface cloning, but I think it doesn't solve > >> the actual problem. > >> Let's wait for Maksim :) > > As for vpnc-script, yes I also think using kldstat to check if the module is present is more correct than stat-ing /dev/tun. Actually I have commented these lines out in my previous mail instead of applying the patch %-) > > ok, how about attached patch. i put it together *very* quickly and > > only gave it a light testing. its for tap(4), because i could compile > > it as a module and tun(4) is compiled into kernel by default, but the > > idea should identical for tun(4). should be even simpler for tun(4) > > because it does not have to deal with 2 kind of devices (i.e. tap and > > vmnet). give it a try, and see if it works. please try both cloning > > paths, i.e. > > > > 1) cat /dev/tap (/dev/vmnet) with and/or without unit number > > > > and > > > > 2) ifconfig tapX (vmnetX) create/destroy > > > > in the mean time i will prepare something similar for tun(4). > > attached is similar patch for tun(4). i only made sure it compiles :) > rebuilding kernel now... > Ok, I have tried both patches and in both cases 'cloning bug' is went away. I have tried cat /dev/tap (creates only /dev/tap0) cat /dev/tapX (creates exactly /dev/tapX) stat /dev/[tun|tap|vmnet] (creates only '0' device) and also running unpatched security/vpnc. Everything works fine! Thanks! Alexey.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20080920003843.GA2710>