Date: Fri, 19 Sep 2008 15:43:21 -0700 From: "Maksim Yevmenkin" <maksim.yevmenkin@gmail.com> To: "Alexey Shuvaev" <shuvaev@physik.uni-wuerzburg.de> Cc: freebsd-current@freebsd.org Subject: Re: Interface auto-cloning bug or feature? Message-ID: <bb4a86c70809191543y7f3d38ex73c48186dfd163c5@mail.gmail.com> In-Reply-To: <20080919203310.GA34131@localhost.my.domain> References: <48D2F942.4070801@FreeBSD.org> <20080919084201.GD44330@wep4035.physik.uni-wuerzburg.de> <48D38DFF.8000803@FreeBSD.org> <20080919203310.GA34131@localhost.my.domain>
next in thread | previous in thread | raw e-mail | index | archive | help
------=_Part_1342_5580332.1221864201515 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline [....] >> That what has caused me to look into this issue. You can find patch for >> security/vpnc to prevent unbounded interface cloning here: >> >> http://sobomax.sippysoft.com/~sobomax/vpnc.diff >> > Ok, the patch prevents interface cloning, but I think it doesn't solve > the actual problem. > Let's wait for Maksim :) ok, how about attached patch. i put it together *very* quickly and only gave it a light testing. its for tap(4), because i could compile it as a module and tun(4) is compiled into kernel by default, but the idea should identical for tun(4). should be even simpler for tun(4) because it does not have to deal with 2 kind of devices (i.e. tap and vmnet). give it a try, and see if it works. please try both cloning paths, i.e. 1) cat /dev/tap (/dev/vmnet) with and/or without unit number and 2) ifconfig tapX (vmnetX) create/destroy in the mean time i will prepare something similar for tun(4). thanks, max ------=_Part_1342_5580332.1221864201515 Content-Type: text/plain; name=if_tap.c.diff.txt Content-Transfer-Encoding: base64 X-Attachment-Id: f_flbe63da0 Content-Disposition: attachment; filename=if_tap.c.diff.txt LS0tIGlmX3RhcC5jLm9yaWcJMjAwOC0wOS0wOCAxNzoyMDo1Ny4wMDAwMDAwMDAgLTA3MDAKKysr IGlmX3RhcC5jCTIwMDgtMDktMTkgMTU6MzU6MDIuMDAwMDAwMDAwIC0wNzAwCkBAIC05NCw2ICs5 NCw3IEBACiBzdGF0aWMgaW50CQl0YXBpZmlvY3RsKHN0cnVjdCBpZm5ldCAqLCB1X2xvbmcsIGNh ZGRyX3QpOwogc3RhdGljIHZvaWQJCXRhcGlmaW5pdCh2b2lkICopOwogCitzdGF0aWMgaW50CQl0 YXBfY2xvbmVfbG9va3VwKHN0cnVjdCBjZGV2ICoqLCB1X3Nob3J0KTsKIHN0YXRpYyBpbnQJCXRh cF9jbG9uZV9jcmVhdGUoc3RydWN0IGlmX2Nsb25lICosIGludCwgY2FkZHJfdCk7CiBzdGF0aWMg dm9pZAkJdGFwX2Nsb25lX2Rlc3Ryb3koc3RydWN0IGlmbmV0ICopOwogc3RhdGljIGludAkJdm1u ZXRfY2xvbmVfY3JlYXRlKHN0cnVjdCBpZl9jbG9uZSAqLCBpbnQsIGNhZGRyX3QpOwpAQCAtMTc2 LDYgKzE3NywyOCBAQAogREVWX01PRFVMRShpZl90YXAsIHRhcG1vZGV2ZW50LCBOVUxMKTsKIAog c3RhdGljIGludAordGFwX2Nsb25lX2xvb2t1cChzdHJ1Y3QgY2RldiAqKmRldiwgdV9zaG9ydCBl eHRyYSkKK3sKKwlzdHJ1Y3QgdGFwX3NvZnRjICp0cDsKKworCW10eF9sb2NrKCZ0YXBtdHgpOwor CVNMSVNUX0ZPUkVBQ0godHAsICZ0YXBoZWFkLCB0YXBfbmV4dCkgeworCQltdHhfbG9jaygmdHAt PnRhcF9tdHgpOworCQlpZiAoKHRwLT50YXBfZmxhZ3MgJiAoVEFQX09QRU58ZXh0cmEpKSA9PSBl eHRyYSkgeworCQkJKmRldiA9IHRwLT50YXBfZGV2OworCQkJbXR4X3VubG9jaygmdHAtPnRhcF9t dHgpOworCQkJbXR4X3VubG9jaygmdGFwbXR4KTsKKworCQkJcmV0dXJuICgxKTsKKwkJfQorCQlt dHhfdW5sb2NrKCZ0cC0+dGFwX210eCk7CisJfQorCW10eF91bmxvY2soJnRhcG10eCk7CisKKwly ZXR1cm4gKDApOworfQorCitzdGF0aWMgaW50CiB0YXBfY2xvbmVfY3JlYXRlKHN0cnVjdCBpZl9j bG9uZSAqaWZjLCBpbnQgdW5pdCwgY2FkZHJfdCBwYXJhbXMpCiB7CiAJc3RydWN0IGNkZXYgKmRl djsKQEAgLTM1Myw4ICszNzYsMTggQEAKIAogCS8qIFdlJ3JlIGludGVyZXN0ZWQgaW4gb25seSB0 YXAvdm1uZXQgZGV2aWNlcy4gKi8KIAlpZiAoc3RyY21wKG5hbWUsIFRBUCkgPT0gMCkgeworCQlp ZiAodGFwX2Nsb25lX2xvb2t1cChkZXYsIDApKSB7CisJCQlkZXZfcmVmKCpkZXYpOworCQkJcmV0 dXJuOworCQl9CisKIAkJdW5pdCA9IC0xOwogCX0gZWxzZSBpZiAoc3RyY21wKG5hbWUsIFZNTkVU KSA9PSAwKSB7CisJCWlmICh0YXBfY2xvbmVfbG9va3VwKGRldiwgVEFQX1ZNTkVUKSkgeworCQkJ ZGV2X3JlZigqZGV2KTsKKwkJCXJldHVybjsKKwkJfQorCiAJCXVuaXQgPSAtMTsKIAkJZXh0cmEg PSBWTU5FVF9ERVZfTUFTSzsKIAl9IGVsc2UgaWYgKGRldl9zdGRjbG9uZShuYW1lLCBOVUxMLCBU QVAsICZ1bml0KSAhPSAxKSB7Cg== ------=_Part_1342_5580332.1221864201515--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bb4a86c70809191543y7f3d38ex73c48186dfd163c5>