Re: Interface auto-cloning bug or feature?

[....]

>> That what has caused me to look into this issue. You can find patch for
>> security/vpnc to prevent unbounded interface cloning here:
>>
>> http://sobomax.sippysoft.com/~sobomax/vpnc.diff
>>
> Ok, the patch prevents interface cloning, but I think it doesn't solve
> the actual problem.
> Let's wait for Maksim :)

ok, how about attached patch. i put it together *very* quickly and
only gave it a light testing. its for tap(4), because i could compile
it as a module and tun(4) is compiled into kernel by default, but the
idea should identical for tun(4). should be even simpler for tun(4)
because it does not have to deal with 2 kind of devices (i.e. tap and
vmnet). give it a try, and see if it works. please try both cloning
paths, i.e.

1) cat /dev/tap (/dev/vmnet) with and/or without unit number

and

2) ifconfig tapX (vmnetX) create/destroy

in the mean time i will prepare something similar for tun(4).

thanks,
max