diff -ur v2.5.67/linux/Documentation/filesystems/proc.txt linux/Documentation/filesystems/proc.txt --- v2.5.67/linux/Documentation/filesystems/proc.txt Tue Mar 18 23:09:46 2003 +++ linux/Documentation/filesystems/proc.txt Wed Apr 9 23:22:06 2003 @@ -1453,6 +1453,16 @@ Determines whether to send ICMP redirects to other hosts. +hidden +------ + +Hide addresses attached to this device from other devices. Such addresses +will never be selected by source address autoselection mechanism, host does +not answer broadcast ARP requests for them, does not announce them as source +address of ARP requests, but they are still reachable via IP. This flag is +activated only if it is enabled both in specific device section and in "all" +section. + Routing settings ---------------- diff -ur v2.5.67/linux/Documentation/networking/ip-sysctl.txt linux/Documentation/networking/ip-sysctl.txt --- v2.5.67/linux/Documentation/networking/ip-sysctl.txt Tue Feb 25 01:56:45 2003 +++ linux/Documentation/networking/ip-sysctl.txt Wed Apr 9 23:22:06 2003 @@ -489,6 +489,14 @@ Alpha 1/1024s. See the HZ define in /usr/include/asm/param.h for the exact value on your system. +hidden - BOOLEAN + Hide addresses attached to this device from other devices. + Such addresses will never be selected by source address autoselection + mechanism, host does not answer broadcast ARP requests for them, + does not announce them as source address of ARP requests, but they + are still reachable via IP. This flag is activated only if it is + enabled both in specific device section and in "all" section. + Alexey Kuznetsov. kuznet@ms2.inr.ac.ru diff -ur v2.5.67/linux/include/linux/inetdevice.h linux/include/linux/inetdevice.h --- v2.5.67/linux/include/linux/inetdevice.h Mon Nov 11 23:43:52 2002 +++ linux/include/linux/inetdevice.h Wed Apr 9 23:22:06 2003 @@ -21,6 +21,7 @@ int medium_id; int no_xfrm; int no_policy; + int hidden; void *sysctl; }; @@ -47,6 +48,7 @@ #define IN_DEV_LOG_MARTIANS(in_dev) (ipv4_devconf.log_martians || (in_dev)->cnf.log_martians) #define IN_DEV_PROXY_ARP(in_dev) (ipv4_devconf.proxy_arp || (in_dev)->cnf.proxy_arp) +#define IN_DEV_HIDDEN(in_dev) ((in_dev)->cnf.hidden && ipv4_devconf.hidden) #define IN_DEV_SHARED_MEDIA(in_dev) (ipv4_devconf.shared_media || (in_dev)->cnf.shared_media) #define IN_DEV_TX_REDIRECTS(in_dev) (ipv4_devconf.send_redirects || (in_dev)->cnf.send_redirects) #define IN_DEV_SEC_REDIRECTS(in_dev) (ipv4_devconf.secure_redirects || (in_dev)->cnf.secure_redirects) diff -ur v2.5.67/linux/include/linux/sysctl.h linux/include/linux/sysctl.h --- v2.5.67/linux/include/linux/sysctl.h Tue Feb 25 01:56:55 2003 +++ linux/include/linux/sysctl.h Wed Apr 9 23:22:06 2003 @@ -355,6 +355,7 @@ NET_IPV4_CONF_MEDIUM_ID=14, NET_IPV4_CONF_NOXFRM=15, NET_IPV4_CONF_NOPOLICY=16, + NET_IPV4_CONF_HIDDEN=17, }; /* /proc/sys/net/ipv6 */ diff -ur v2.5.67/linux/net/ipv4/arp.c linux/net/ipv4/arp.c --- v2.5.67/linux/net/ipv4/arp.c Wed Apr 9 01:18:31 2003 +++ linux/net/ipv4/arp.c Wed Apr 9 23:22:06 2003 @@ -67,6 +67,8 @@ * now it is in net/core/neighbour.c. * Krzysztof Halasa: Added Frame Relay ARP support. * Arnaldo C. Melo : convert /proc/net/arp to seq_file + * Julian Anastasov: "hidden" flag: hide the + * interface and don't reply for it */ #include @@ -320,12 +322,23 @@ static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb) { u32 saddr; + int from_skb; + struct in_device *in_dev2 = NULL; + struct net_device *dev2 = NULL; u8 *dst_ha = NULL; struct net_device *dev = neigh->dev; u32 target = *(u32*)neigh->primary_key; int probes = atomic_read(&neigh->probes); - if (skb && inet_addr_type(skb->nh.iph->saddr) == RTN_LOCAL) + from_skb = (skb && + (dev2 = ip_dev_find(skb->nh.iph->saddr)) != NULL && + (in_dev2 = in_dev_get(dev2)) != NULL && + !IN_DEV_HIDDEN(in_dev2)); + if (dev2) { + if (in_dev2) in_dev_put(in_dev2); + dev_put(dev2); + } + if (from_skb) saddr = skb->nh.iph->saddr; else saddr = inet_select_addr(dev, target, RT_SCOPE_LINK); @@ -731,9 +744,22 @@ /* Special case: IPv4 duplicate address detection packet (RFC2131) */ if (sip == 0) { - if (arp->ar_op == htons(ARPOP_REQUEST) && - inet_addr_type(tip) == RTN_LOCAL) + int reply; + struct net_device *dev2 = NULL; + struct in_device *in_dev2 = NULL; + + reply = + (arp->ar_op == htons(ARPOP_REQUEST) && + (dev2 = ip_dev_find(tip)) != NULL && + (dev2 == dev || + ((in_dev2 = in_dev_get(dev2)) != NULL && + !IN_DEV_HIDDEN(in_dev2)))); + if (dev2) { + if (in_dev2) in_dev_put(in_dev2); + dev_put(dev2); + if (reply) arp_send(ARPOP_REPLY,ETH_P_ARP,tip,dev,tip,sha,dev->dev_addr,dev->dev_addr); + } goto out; } @@ -747,6 +773,21 @@ n = neigh_event_ns(&arp_tbl, sha, &sip, dev); if (n) { int dont_send = 0; + if (ipv4_devconf.hidden && + skb->pkt_type != PACKET_HOST) { + struct net_device *dev2 = NULL; + struct in_device *in_dev2 = NULL; + + dont_send |= + ((dev2 = ip_dev_find(tip)) != NULL && + dev2 != dev && + (in_dev2=in_dev_get(dev2)) != NULL && + IN_DEV_HIDDEN(in_dev2)); + if (dev2) { + if (in_dev2) in_dev_put(in_dev2); + dev_put(dev2); + } + } if (IN_DEV_ARPFILTER(in_dev)) dont_send |= arp_filter(sip,tip,dev); if (!dont_send) diff -ur v2.5.67/linux/net/ipv4/devinet.c linux/net/ipv4/devinet.c --- v2.5.67/linux/net/ipv4/devinet.c Wed Apr 9 01:21:26 2003 +++ linux/net/ipv4/devinet.c Wed Apr 9 23:24:42 2003 @@ -790,7 +790,8 @@ read_lock(&in_dev->lock); for_primary_ifa(in_dev) { - if (ifa->ifa_scope != RT_SCOPE_LINK && + if (!IN_DEV_HIDDEN(in_dev) && + ifa->ifa_scope != RT_SCOPE_LINK && ifa->ifa_scope <= scope) { read_unlock(&in_dev->lock); addr = ifa->ifa_local; @@ -1123,7 +1124,7 @@ static struct devinet_sysctl_table { struct ctl_table_header *sysctl_header; - ctl_table devinet_vars[17]; + ctl_table devinet_vars[18]; ctl_table devinet_dev[2]; ctl_table devinet_conf_dir[2]; ctl_table devinet_proto_dir[2]; @@ -1230,6 +1231,14 @@ .ctl_name = NET_IPV4_CONF_TAG, .procname = "tag", .data = &ipv4_devconf.tag, + .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = &proc_dointvec, + }, + { + .ctl_name = NET_IPV4_CONF_HIDDEN, + .procname = "hidden", + .data = &ipv4_devconf.hidden, .maxlen = sizeof(int), .mode = 0644, .proc_handler = &proc_dointvec,