Re: Interface auto-cloning bug or feature?

From: Maxim Sobolev <sobomax_at_FreeBSD.org>
Date: Mon, 22 Sep 2008 15:17:18 -0700
Patch works for me just fine. Thanks!

-Maxim

Maksim Yevmenkin wrote:
> On Fri, Sep 19, 2008 at 3:43 PM, Maksim Yevmenkin
> <maksim.yevmenkin_at_gmail.com> wrote:
>> [....]
>>
>>>> That what has caused me to look into this issue. You can find patch for
>>>> security/vpnc to prevent unbounded interface cloning here:
>>>>
>>>> http://sobomax.sippysoft.com/~sobomax/vpnc.diff
>>>>
>>> Ok, the patch prevents interface cloning, but I think it doesn't solve
>>> the actual problem.
>>> Let's wait for Maksim :)
>> ok, how about attached patch. i put it together *very* quickly and
>> only gave it a light testing. its for tap(4), because i could compile
>> it as a module and tun(4) is compiled into kernel by default, but the
>> idea should identical for tun(4). should be even simpler for tun(4)
>> because it does not have to deal with 2 kind of devices (i.e. tap and
>> vmnet). give it a try, and see if it works. please try both cloning
>> paths, i.e.
>>
>> 1) cat /dev/tap (/dev/vmnet) with and/or without unit number
>>
>> and
>>
>> 2) ifconfig tapX (vmnetX) create/destroy
>>
>> in the mean time i will prepare something similar for tun(4).
> 
> attached is similar patch for tun(4). i only made sure it compiles :)
> rebuilding kernel now...
> 
> thanks,
> max
> 
Received on Mon Sep 22 2008 - 20:17:17 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:39:35 UTC