Date: Fri, 07 Oct 2005 17:58:55 +0300 From: Iasen Kostov <tbyte@otel.net> To: freebsd-net@freebsd.org Subject: Proxy arp should only replay on specified interface. Message-ID: <1128697135.71975.24.camel@DraGoN.OTEL.net>
next in thread | raw e-mail | index | archive | help
--=-ZBrDdf1kBks9icJtvY6g
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
IMHO proxy arp should only replay on specified interface not on every
arp capable interface which recieved request for the proxied address.
If lets say host A have arp capable if0 and if1 interfaces and U set:
route add -host 1.0.0.2 -iface if1 -proxy
and then a request is recieved on if0 for 1.0.0.2, host A will replay
that it has it (which IMHO is wrong as the proxy route is set for if1).
This sometimes is a big problem for our PPPoE/VPN server when the
client uses linux or some small routers (e.g Linksys or something)
probably linux based. It happen that sometimes (when the link is down or
god knows why) it broadcasts arp "who-has" and the gateway replays. Then
this host try to use ethernet path and not the (right) tunnel path until
arp cache expires (which is not real fun as there is firewall rules
blocking ethernet path :)).
And even worse :) - I can think of ways to bypass routing protocols
using proxy-arp routes like the one mentioned above. But it will not
work if proxy-arp behaves the way it does now.
And 1 thing more - there could be a switch which restores (or turns on)
old behavior.
(patch agains 5.4-STABLE is attached)
regards.
--=-ZBrDdf1kBks9icJtvY6g
Content-Disposition: attachment; filename=if_ether.c.diff
Content-Type: text/x-patch; name=if_ether.c.diff; charset=UTF-8
Content-Transfer-Encoding: 7bit
--- if_ether.c.orig Fri Apr 1 23:18:43 2005
+++ if_ether.c Fri Oct 7 16:56:19 2005
@@ -796,6 +796,13 @@
#endif
} else {
rt = la->la_rt;
+ if (rt->rt_ifp != ifp) {
+#ifdef DEBUG_PROXY
+ printf("arp: droped proxy request for %s on wrong interface %s\n",
+ inet_ntoa(itaddr), ifp->if_xname);
+#endif
+ goto drop;
+ }
(void)memcpy(ar_tha(ah), ar_sha(ah), ah->ar_hln);
sdl = SDL(rt->rt_gateway);
(void)memcpy(ar_sha(ah), LLADDR(sdl), ah->ar_hln);
--=-ZBrDdf1kBks9icJtvY6g--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?1128697135.71975.24.camel>