Re: Interface auto-cloning bug or feature?

From: Maksim Yevmenkin <maksim.yevmenkin_at_gmail.com>
Date: Fri, 19 Sep 2008 15:51:31 -0700
On Fri, Sep 19, 2008 at 3:43 PM, Maksim Yevmenkin
<maksim.yevmenkin_at_gmail.com> wrote:
> [....]
>
>>> That what has caused me to look into this issue. You can find patch for
>>> security/vpnc to prevent unbounded interface cloning here:
>>>
>>> http://sobomax.sippysoft.com/~sobomax/vpnc.diff
>>>
>> Ok, the patch prevents interface cloning, but I think it doesn't solve
>> the actual problem.
>> Let's wait for Maksim :)
>
> ok, how about attached patch. i put it together *very* quickly and
> only gave it a light testing. its for tap(4), because i could compile
> it as a module and tun(4) is compiled into kernel by default, but the
> idea should identical for tun(4). should be even simpler for tun(4)
> because it does not have to deal with 2 kind of devices (i.e. tap and
> vmnet). give it a try, and see if it works. please try both cloning
> paths, i.e.
>
> 1) cat /dev/tap (/dev/vmnet) with and/or without unit number
>
> and
>
> 2) ifconfig tapX (vmnetX) create/destroy
>
> in the mean time i will prepare something similar for tun(4).

attached is similar patch for tun(4). i only made sure it compiles :)
rebuilding kernel now...

thanks,
max

Received on Fri Sep 19 2008 - 20:51:33 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:39:35 UTC