diff -ur v2.6.3/linux/Documentation/filesystems/proc.txt linux/Documentation/filesystems/proc.txt --- v2.6.3/linux/Documentation/filesystems/proc.txt 2003-09-27 23:14:56.000000000 +0300 +++ linux/Documentation/filesystems/proc.txt 2004-02-19 01:18:17.532637584 +0200 @@ -1578,6 +1578,18 @@ (external addresses can still be spoofed), without the need for additional firewall rules. +forward_shared +-------------- + +Integer value determines if a source validation should allow forwarding of +packets with local source address. 1 means yes, 0 means no. By default the +flag is disabled and such packets are not forwarded. + +If you enable this flag on internal network, the router will forward packets +from internal hosts with shared IP addresses no matter how the rp_filter is +set. This flag is activated only if it is enabled both in specific device +section and in "all" section. + secure_redirects ---------------- @@ -1595,6 +1607,16 @@ Determines whether to send ICMP redirects to other hosts. +hidden +------ + +Hide addresses attached to this device from other devices. Such addresses +will never be selected by source address autoselection mechanism, host does +not answer broadcast ARP requests for them, does not announce them as source +address of ARP requests, but they are still reachable via IP. This flag is +activated only if it is enabled both in specific device section and in "all" +section. + Routing settings ---------------- diff -ur v2.6.3/linux/Documentation/networking/ip-sysctl.txt linux/Documentation/networking/ip-sysctl.txt --- v2.6.3/linux/Documentation/networking/ip-sysctl.txt 2004-02-19 00:13:33.000000000 +0200 +++ linux/Documentation/networking/ip-sysctl.txt 2004-02-19 01:18:17.533637432 +0200 @@ -403,6 +403,17 @@ forwarding - BOOLEAN Enable IP forwarding on this interface. +forward_shared - BOOLEAN + Integer value determines if a source validation should allow + forwarding of packets with local source address. 1 means yes, + 0 means no. By default the flag is disabled and such packets + are not forwarded. + + If you enable this flag on internal network, the router will forward + packets from internal hosts with shared IP addresses no matter how + the rp_filter is set. This flag is activated only if it is + enabled both in specific device section and in "all" section. + mc_forwarding - BOOLEAN Do multicast routing. The kernel needs to be compiled with CONFIG_MROUTE and a multicast routing daemon is required. @@ -503,6 +514,15 @@ Allows you to write a number, which can be used as required. Default value is 0. + +hidden - BOOLEAN + Hide addresses attached to this device from other devices. + Such addresses will never be selected by source address autoselection + mechanism, host does not answer broadcast ARP requests for them, + does not announce them as source address of ARP requests, but they + are still reachable via IP. This flag is activated only if it is + enabled both in specific device section and in "all" section. + (1) Jiffie: internal timeunit for the kernel. On the i386 1/100s, on the Alpha 1/1024s. See the HZ define in /usr/include/asm/param.h for the exact value on your system. diff -ur v2.6.3/linux/include/linux/inetdevice.h linux/include/linux/inetdevice.h --- v2.6.3/linux/include/linux/inetdevice.h 2004-02-19 00:13:38.000000000 +0200 +++ linux/include/linux/inetdevice.h 2004-02-19 01:18:45.515383560 +0200 @@ -22,6 +22,8 @@ int no_xfrm; int no_policy; int force_igmp_version; + int hidden; + int forward_shared; void *sysctl; }; @@ -58,6 +60,7 @@ #define IN_DEV_LOG_MARTIANS(in_dev) (ipv4_devconf.log_martians || (in_dev)->cnf.log_martians) #define IN_DEV_PROXY_ARP(in_dev) (ipv4_devconf.proxy_arp || (in_dev)->cnf.proxy_arp) +#define IN_DEV_HIDDEN(in_dev) ((in_dev)->cnf.hidden && ipv4_devconf.hidden) #define IN_DEV_SHARED_MEDIA(in_dev) (ipv4_devconf.shared_media || (in_dev)->cnf.shared_media) #define IN_DEV_TX_REDIRECTS(in_dev) (ipv4_devconf.send_redirects || (in_dev)->cnf.send_redirects) #define IN_DEV_SEC_REDIRECTS(in_dev) (ipv4_devconf.secure_redirects || (in_dev)->cnf.secure_redirects) @@ -72,6 +75,8 @@ #define IN_DEV_ARPFILTER(in_dev) (ipv4_devconf.arp_filter || (in_dev)->cnf.arp_filter) +#define IN_DEV_FORWARD_SHARED(in_dev) ((in_dev)->cnf.forward_shared && ipv4_devconf.forward_shared) + struct in_ifaddr { struct in_ifaddr *ifa_next; diff -ur v2.6.3/linux/include/linux/sysctl.h linux/include/linux/sysctl.h --- v2.6.3/linux/include/linux/sysctl.h 2004-02-19 00:13:38.000000000 +0200 +++ linux/include/linux/sysctl.h 2004-02-19 01:19:08.488891056 +0200 @@ -362,6 +362,8 @@ NET_IPV4_CONF_NOXFRM=15, NET_IPV4_CONF_NOPOLICY=16, NET_IPV4_CONF_FORCE_IGMP_VERSION=17, + NET_IPV4_CONF_HIDDEN=18, + NET_IPV4_CONF_FORWARD_SHARED=19, }; /* /proc/sys/net/ipv4/netfilter */ diff -ur v2.6.3/linux/include/net/ip_fib.h linux/include/net/ip_fib.h --- v2.6.3/linux/include/net/ip_fib.h 2003-08-23 19:43:12.000000000 +0300 +++ linux/include/net/ip_fib.h 2004-02-19 01:18:17.536636976 +0200 @@ -207,7 +207,7 @@ extern int inet_rtm_getroute(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg); extern int inet_dump_fib(struct sk_buff *skb, struct netlink_callback *cb); extern int fib_validate_source(u32 src, u32 dst, u8 tos, int oif, - struct net_device *dev, u32 *spec_dst, u32 *itag); + struct net_device *dev, u32 *spec_dst, u32 *itag, int our); extern void fib_select_multipath(const struct flowi *flp, struct fib_result *res); /* Exported by fib_semantics.c */ diff -ur v2.6.3/linux/net/ipv4/arp.c linux/net/ipv4/arp.c --- v2.6.3/linux/net/ipv4/arp.c 2004-02-19 00:13:38.000000000 +0200 +++ linux/net/ipv4/arp.c 2004-02-19 01:19:28.114907448 +0200 @@ -71,6 +71,8 @@ * arp_xmit so intermediate drivers like * bonding can change the skb before * sending (e.g. insert 8021q tag). + * Julian Anastasov: "hidden" flag: hide the + * interface and don't reply for it */ #include @@ -326,12 +328,23 @@ static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb) { u32 saddr; + int from_skb; + struct in_device *in_dev2 = NULL; + struct net_device *dev2 = NULL; u8 *dst_ha = NULL; struct net_device *dev = neigh->dev; u32 target = *(u32*)neigh->primary_key; int probes = atomic_read(&neigh->probes); - if (skb && inet_addr_type(skb->nh.iph->saddr) == RTN_LOCAL) + from_skb = (skb && + (dev2 = ip_dev_find(skb->nh.iph->saddr)) != NULL && + (in_dev2 = in_dev_get(dev2)) != NULL && + !IN_DEV_HIDDEN(in_dev2)); + if (dev2) { + if (in_dev2) in_dev_put(in_dev2); + dev_put(dev2); + } + if (from_skb) saddr = skb->nh.iph->saddr; else saddr = inet_select_addr(dev, target, RT_SCOPE_LINK); @@ -763,9 +776,22 @@ /* Special case: IPv4 duplicate address detection packet (RFC2131) */ if (sip == 0) { - if (arp->ar_op == htons(ARPOP_REQUEST) && - inet_addr_type(tip) == RTN_LOCAL) + int reply; + struct net_device *dev2 = NULL; + struct in_device *in_dev2 = NULL; + + reply = + (arp->ar_op == htons(ARPOP_REQUEST) && + (dev2 = ip_dev_find(tip)) != NULL && + (dev2 == dev || + ((in_dev2 = in_dev_get(dev2)) != NULL && + !IN_DEV_HIDDEN(in_dev2)))); + if (dev2) { + if (in_dev2) in_dev_put(in_dev2); + dev_put(dev2); + if (reply) arp_send(ARPOP_REPLY,ETH_P_ARP,tip,dev,tip,sha,dev->dev_addr,dev->dev_addr); + } goto out; } @@ -779,6 +805,21 @@ n = neigh_event_ns(&arp_tbl, sha, &sip, dev); if (n) { int dont_send = 0; + if (ipv4_devconf.hidden && + skb->pkt_type != PACKET_HOST) { + struct net_device *dev2 = NULL; + struct in_device *in_dev2 = NULL; + + dont_send |= + ((dev2 = ip_dev_find(tip)) != NULL && + dev2 != dev && + (in_dev2=in_dev_get(dev2)) != NULL && + IN_DEV_HIDDEN(in_dev2)); + if (dev2) { + if (in_dev2) in_dev_put(in_dev2); + dev_put(dev2); + } + } if (IN_DEV_ARPFILTER(in_dev)) dont_send |= arp_filter(sip,tip,dev); if (!dont_send) diff -ur v2.6.3/linux/net/ipv4/devinet.c linux/net/ipv4/devinet.c --- v2.6.3/linux/net/ipv4/devinet.c 2004-02-19 00:13:38.000000000 +0200 +++ linux/net/ipv4/devinet.c 2004-02-19 01:19:42.795675632 +0200 @@ -790,7 +790,8 @@ read_lock(&in_dev->lock); for_primary_ifa(in_dev) { - if (ifa->ifa_scope != RT_SCOPE_LINK && + if (!IN_DEV_HIDDEN(in_dev) && + ifa->ifa_scope != RT_SCOPE_LINK && ifa->ifa_scope <= scope) { read_unlock(&in_dev->lock); addr = ifa->ifa_local; @@ -1132,7 +1133,7 @@ static struct devinet_sysctl_table { struct ctl_table_header *sysctl_header; - ctl_table devinet_vars[18]; + ctl_table devinet_vars[20]; ctl_table devinet_dev[2]; ctl_table devinet_conf_dir[2]; ctl_table devinet_proto_dir[2]; @@ -1244,6 +1245,14 @@ .proc_handler = &proc_dointvec, }, { + .ctl_name = NET_IPV4_CONF_HIDDEN, + .procname = "hidden", + .data = &ipv4_devconf.hidden, + .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = &proc_dointvec, + }, + { .ctl_name = NET_IPV4_CONF_ARPFILTER, .procname = "arp_filter", .data = &ipv4_devconf.arp_filter, @@ -1252,6 +1261,14 @@ .proc_handler = &proc_dointvec, }, { + .ctl_name = NET_IPV4_CONF_FORWARD_SHARED, + .procname = "forward_shared", + .data = &ipv4_devconf.forward_shared, + .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = &proc_dointvec, + }, + { .ctl_name = NET_IPV4_CONF_NOXFRM, .procname = "disable_xfrm", .data = &ipv4_devconf.no_xfrm, diff -ur v2.6.3/linux/net/ipv4/fib_frontend.c linux/net/ipv4/fib_frontend.c --- v2.6.3/linux/net/ipv4/fib_frontend.c 2003-10-10 01:16:29.000000000 +0300 +++ linux/net/ipv4/fib_frontend.c 2004-02-19 01:18:17.541636216 +0200 @@ -159,7 +159,8 @@ */ int fib_validate_source(u32 src, u32 dst, u8 tos, int oif, - struct net_device *dev, u32 *spec_dst, u32 *itag) + struct net_device *dev, u32 *spec_dst, u32 *itag, + int our) { struct in_device *in_dev; struct flowi fl = { .nl_u = { .ip4_u = @@ -170,6 +171,7 @@ struct fib_result res; int no_addr, rpf; int ret; + int fwdsh = 0; no_addr = rpf = 0; read_lock(&inetdev_lock); @@ -177,6 +179,7 @@ if (in_dev) { no_addr = in_dev->ifa_list == NULL; rpf = IN_DEV_RPFILTER(in_dev); + fwdsh = IN_DEV_FORWARD_SHARED(in_dev); } read_unlock(&inetdev_lock); @@ -185,7 +188,12 @@ if (fib_lookup(&fl, &res)) goto last_resort; - if (res.type != RTN_UNICAST) + if (fwdsh) { + fwdsh = (res.type == RTN_LOCAL && !our); + if (fwdsh) + rpf = 0; + } + if (res.type != RTN_UNICAST && !fwdsh) goto e_inval_res; *spec_dst = FIB_RES_PREFSRC(res); fib_combine_itag(itag, &res); @@ -205,6 +213,8 @@ if (rpf) goto e_inval; fl.oif = dev->ifindex; + if (fwdsh) + fl.iif = loopback_dev.ifindex; ret = 0; if (fib_lookup(&fl, &res) == 0) { diff -ur v2.6.3/linux/net/ipv4/route.c linux/net/ipv4/route.c --- v2.6.3/linux/net/ipv4/route.c 2004-02-05 00:23:18.000000000 +0200 +++ linux/net/ipv4/route.c 2004-02-19 01:18:17.543635912 +0200 @@ -1454,7 +1454,7 @@ goto e_inval; spec_dst = inet_select_addr(dev, 0, RT_SCOPE_LINK); } else if (fib_validate_source(saddr, 0, tos, 0, - dev, &spec_dst, &itag) < 0) + dev, &spec_dst, &itag, our) < 0) goto e_inval; rth = dst_alloc(&ipv4_dst_ops); @@ -1619,7 +1619,7 @@ int result; result = fib_validate_source(saddr, daddr, tos, loopback_dev.ifindex, - dev, &spec_dst, &itag); + dev, &spec_dst, &itag, 1); if (result < 0) goto martian_source; if (result) @@ -1646,7 +1646,7 @@ } err = fib_validate_source(saddr, daddr, tos, FIB_RES_OIF(res), dev, - &spec_dst, &itag); + &spec_dst, &itag, 0); if (err < 0) goto martian_source; @@ -1734,7 +1734,7 @@ spec_dst = inet_select_addr(dev, 0, RT_SCOPE_LINK); else { err = fib_validate_source(saddr, 0, tos, 0, dev, &spec_dst, - &itag); + &itag, 1); if (err < 0) goto martian_source; if (err)