hidden interface (ARP) 2.4.20

Bingner Sam J Contractor PACAF CSS/SCHE
2002-12-05T20:47:13Z

[-- Attachment #1: Type: text/plain, Size: 149 bytes --]

Attached is a patch that seems to work for the hidden flag in 2.4.20... for
anybody else who needs this functionality

Sam Bingner
PACAF CSS/SCHE

[-- Attachment #2: hidden-2.4.20.diff --]
[-- Type: application/octet-stream, Size: 6802 bytes --]

diff -u -r linux-2.4.20/Documentation/filesystems/proc.txt linux-hidden/Documentation/filesystems/proc.txt
--- linux-2.4.20/Documentation/filesystems/proc.txt Thu Nov 28 13:53:08 2002
+++ linux-hidden/Documentation/filesystems/proc.txt Thu Dec 5 08:57:03 2002
@@ -1573,6 +1573,16 @@

Determines whether to send ICMP redirects to other hosts.

+hidden
+------
+
+Hide addresses attached to this device from another devices.
+Such addresses will never be selected by source address autoselection
+mechanism, host does not answer broadcast ARP requests for them,
+does not announce it as source address of ARP requests, but they
+are still reachable via IP. This flag is activated only if it is
+enabled both in specific device section and in "all" section.
+
Routing settings
----------------

diff -u -r linux-2.4.20/Documentation/networking/ip-sysctl.txt linux-hidden/Documentation/networking/ip-sysctl.txt
--- linux-2.4.20/Documentation/networking/ip-sysctl.txt Fri Aug 2 14:39:42 2002
+++ linux-hidden/Documentation/networking/ip-sysctl.txt Thu Dec 5 08:57:03 2002
@@ -445,6 +445,14 @@
Alpha 1/1024s. See the HZ define in /usr/include/asm/param.h for the exact
value on your system.

+hidden - BOOLEAN
+ Hide addresses attached to this device from another devices.
+ Such addresses will never be selected by source address autoselection
+ mechanism, host does not answer broadcast ARP requests for them,
+ does not announce it as source address of ARP requests, but they
+ are still reachable via IP. This flag is activated only if it is
+ enabled both in specific device section and in "all" section.
+
Alexey Kuznetsov.
kuznet@ms2.inr.ac.ru

diff -u -r linux-2.4.20/include/linux/inetdevice.h linux-hidden/include/linux/inetdevice.h
--- linux-2.4.20/include/linux/inetdevice.h Fri Aug 2 14:39:45 2002
+++ linux-hidden/include/linux/inetdevice.h Thu Dec 5 08:57:03 2002
@@ -17,6 +17,7 @@
int forwarding;
int mc_forwarding;
int tag;
+ int hidden;
int arp_filter;
int medium_id;
void *sysctl;
@@ -45,6 +46,7 @@

#define IN_DEV_LOG_MARTIANS(in_dev) (ipv4_devconf.log_martians || (in_dev)->cnf.log_martians)
#define IN_DEV_PROXY_ARP(in_dev) (ipv4_devconf.proxy_arp || (in_dev)->cnf.proxy_arp)
+#define IN_DEV_HIDDEN(in_dev) ((in_dev)->cnf.hidden && ipv4_devconf.hidden)
#define IN_DEV_SHARED_MEDIA(in_dev) (ipv4_devconf.shared_media || (in_dev)->cnf.shared_media)
#define IN_DEV_TX_REDIRECTS(in_dev) (ipv4_devconf.send_redirects || (in_dev)->cnf.send_redirects)
#define IN_DEV_SEC_REDIRECTS(in_dev) (ipv4_devconf.secure_redirects || (in_dev)->cnf.secure_redirects)
diff -u -r linux-2.4.20/include/linux/sysctl.h linux-hidden/include/linux/sysctl.h
--- linux-2.4.20/include/linux/sysctl.h Thu Nov 28 13:53:15 2002
+++ linux-hidden/include/linux/sysctl.h Thu Dec 5 08:57:03 2002
@@ -339,6 +339,7 @@
NET_IPV4_CONF_TAG=12,
NET_IPV4_CONF_ARPFILTER=13,
NET_IPV4_CONF_MEDIUM_ID=14,
+ NET_IPV4_CONF_HIDDEN=15,
};

/* /proc/sys/net/ipv6 */
diff -u -r linux-2.4.20/net/ipv4/arp.c linux-hidden/net/ipv4/arp.c
--- linux-2.4.20/net/ipv4/arp.c Thu Nov 28 13:53:15 2002
+++ linux-hidden/net/ipv4/arp.c Thu Dec 5 08:57:42 2002
@@ -66,6 +66,8 @@
* Alexey Kuznetsov: new arp state machine;
* now it is in net/core/neighbour.c.
* Krzysztof Halasa: Added Frame Relay ARP support.
+ * Julian Anastasov: "hidden" flag: hide the
+ * interface and don't reply for it
*/

#include <linux/types.h>
@@ -317,12 +319,23 @@
static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb)
{
u32 saddr;
+ int from_skb;
+ struct in_device *in_dev2 = NULL;
+ struct net_device *dev2 = NULL;
u8 *dst_ha = NULL;
struct net_device *dev = neigh->dev;
u32 target = *(u32*)neigh->primary_key;
int probes = atomic_read(&neigh->probes);

- if (skb && inet_addr_type(skb->nh.iph->saddr) == RTN_LOCAL)
+ from_skb = (skb &&
+ (dev2 = ip_dev_find(skb->nh.iph->saddr)) != NULL &&
+ (in_dev2 = in_dev_get(dev2)) != NULL &&
+ !IN_DEV_HIDDEN(in_dev2));
+ if (dev2) {
+ if (in_dev2) in_dev_put(in_dev2);
+ dev_put(dev2);
+ }
+ if (from_skb)
saddr = skb->nh.iph->saddr;
else
saddr = inet_select_addr(dev, target, RT_SCOPE_LINK);
@@ -754,9 +767,22 @@

/* Special case: IPv4 duplicate address detection packet (RFC2131) */
if (sip == 0) {
- if (arp->ar_op == htons(ARPOP_REQUEST) &&
- inet_addr_type(tip) == RTN_LOCAL)
+ int reply;
+ struct net_device *dev2 = NULL;
+ struct in_device *in_dev2 = NULL;
+
+ reply =
+ (arp->ar_op == htons(ARPOP_REQUEST) &&
+ (dev2 = ip_dev_find(tip)) != NULL &&
+ (dev2 == dev ||
+ ((in_dev2 = in_dev_get(dev2)) != NULL &&
+ !IN_DEV_HIDDEN(in_dev2))));
+ if (dev2) {
+ if (in_dev2) in_dev_put(in_dev2);
+ dev_put(dev2);
+ if (reply)
arp_send(ARPOP_REPLY,ETH_P_ARP,tip,dev,tip,sha,dev->dev_addr,dev->dev_addr);
+ }
goto out;
}

@@ -770,6 +796,21 @@
n = neigh_event_ns(&arp_tbl, sha, &sip, dev);
if (n) {
int dont_send = 0;
+ if (ipv4_devconf.hidden &&
+ skb->pkt_type != PACKET_HOST) {
+ struct net_device *dev2 = NULL;
+ struct in_device *in_dev2 = NULL;
+
+ dont_send |=
+ ((dev2 = ip_dev_find(tip)) != NULL &&
+ dev2 != dev &&
+ (in_dev2=in_dev_get(dev2)) != NULL &&
+ IN_DEV_HIDDEN(in_dev2));
+ if (dev2) {
+ if (in_dev2) in_dev_put(in_dev2);
+ dev_put(dev2);
+ }
+ }
if (IN_DEV_ARPFILTER(in_dev))
dont_send |= arp_filter(sip,tip,dev);
if (!dont_send)
diff -u -r linux-2.4.20/net/ipv4/devinet.c linux-hidden/net/ipv4/devinet.c
--- linux-2.4.20/net/ipv4/devinet.c Fri Aug 2 14:39:46 2002
+++ linux-hidden/net/ipv4/devinet.c Thu Dec 5 08:57:03 2002
@@ -756,7 +756,8 @@

read_lock(&in_dev->lock);
for_primary_ifa(in_dev) {
- if (ifa->ifa_scope != RT_SCOPE_LINK &&
+ if (!IN_DEV_HIDDEN(in_dev) &&
+ ifa->ifa_scope != RT_SCOPE_LINK &&
ifa->ifa_scope <= scope) {
read_unlock(&in_dev->lock);
read_unlock(&inetdev_lock);
@@ -1032,7 +1033,7 @@
static struct devinet_sysctl_table
{
struct ctl_table_header *sysctl_header;
- ctl_table devinet_vars[15];
+ ctl_table devinet_vars[16];
ctl_table devinet_dev[2];
ctl_table devinet_conf_dir[2];
ctl_table devinet_proto_dir[2];
@@ -1078,6 +1079,9 @@
{NET_IPV4_CONF_TAG, "tag",
&ipv4_devconf.tag, sizeof(int), 0644, NULL,
&proc_dointvec},
+ {NET_IPV4_CONF_HIDDEN, "hidden",
+ &ipv4_devconf.hidden, sizeof(int), 0644, NULL,
+ &proc_dointvec},
{NET_IPV4_CONF_ARPFILTER, "arp_filter",
&ipv4_devconf.arp_filter, sizeof(int), 0644, NULL,
&proc_dointvec},