IMHO proxy arp should only replay on specified interface not on every
arp capable interface which recieved request for the proxied address.
If lets say host A have arp capable if0 and if1 interfaces and U set:
route add -host 1.0.0.2 -iface if1 -proxy
and then a request is recieved on if0 for 1.0.0.2, host A will replay
that it has it (which IMHO is wrong as the proxy route is set for if1).
This sometimes is a big problem for our PPPoE/VPN server when the
client uses linux or some small routers (e.g Linksys or something)
probably linux based. It happen that sometimes (when the link is down or
god knows why) it broadcasts arp "who-has" and the gateway replays. Then
this host try to use ethernet path and not the (right) tunnel path until
arp cache expires (which is not real fun as there is firewall rules
blocking ethernet path :)).
And even worse :) - I can think of ways to bypass routing protocols
using proxy-arp routes like the one mentioned above. But it will not
work if proxy-arp behaves the way it does now.
And 1 thing more - there could be a switch which restores (or turns on)
old behavior.
(patch agains 5.4-STABLE is attached)
regards.
--- if_ether.c.orig Fri Apr 1 23:18:43 2005
+++ if_ether.c Fri Oct 7 16:56:19 2005
@@ -796,6 +796,13 @@
#endif
} else {
rt = la->la_rt;
+ if (rt->rt_ifp != ifp) {
+#ifdef DEBUG_PROXY
+ printf("arp: droped proxy request for %s on wrong interface %s\n",
+ inet_ntoa(itaddr), ifp->if_xname);
+#endif
+ goto drop;
+ }
(void)memcpy(ar_tha(ah), ar_sha(ah), ah->ar_hln);
sdl = SDL(rt->rt_gateway);
(void)memcpy(ar_sha(ah), LLADDR(sdl), ah->ar_hln);
_______________________________________________
freebsd-net@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
