Peter Memishian wrote: > > btw, it isn't the privileged applications that you're protecting, > > it is the users themselves - it looks like the choice is to protect > > them when they run ifconfig rather than dladm. I hope that doesn't > > lead to too much confusion...because while the dladm command has > > succeeded but the ifconfig one failed, there would still appear to > > be room for confusion, vis a vis: > > > > # ifconfig vni0 inet6 plumb > > # dladm rename-link ce0 vni0 > > # snoop -d vni0 > > > > What happens now? > >Cathy could answer this definitively, but offhand: /dev/net is searched >first by dlpi_open(), so they end up snooping on what was formerly ce0. >Given that no packets flow over the IP vni interface at the DLPI layer, >that seems like the right behavior to me. >
Yes, but is that what the user will expect to happen? If you do "ifconfig -a", and see "vni0", aren't you going to expect "snoop -d vni0" to intercept those packets and not those from some other interface? The expectation is that once a device is created (and especially once it is visible) is that all use of that name should refer to that name, irrespective of whether or not it is DLPI or something else and that the system should operate in such a way as to preserve the uniqueness of that name. Whether this is a contrived situation or not is beside the point (except that you came up with it, so I suppose you can be unhappy with a derivitive of your own contrived case.) It would appear that there's a serious architectural problem here that needs to be addressed. Putting in a stop gap fix that stops "ifconfig plumb" from allowing the issue to be seen seems ... suboptimal? Darren
