diff -ur v2.4.23/linux/include/linux/in_route.h linux/include/linux/in_route.h --- v2.4.23/linux/include/linux/in_route.h 1998-06-12 08:52:33.000000000 +0300 +++ linux/include/linux/in_route.h 2003-11-16 16:59:08.816465800 +0200 @@ -13,6 +13,7 @@ #define RTCF_DIRECTDST 0x00020000 #define RTCF_REDIRECTED 0x00040000 #define RTCF_TPROXY 0x00080000 +#define RTCF_NOARP 0x00100000 #define RTCF_FAST 0x00200000 #define RTCF_MASQ 0x00400000 diff -ur v2.4.23/linux/include/linux/rtnetlink.h linux/include/linux/rtnetlink.h --- v2.4.23/linux/include/linux/rtnetlink.h 2003-11-16 15:40:06.000000000 +0200 +++ linux/include/linux/rtnetlink.h 2003-11-16 17:00:58.675764648 +0200 @@ -168,6 +168,7 @@ #define RTM_F_CLONED 0x200 /* This route is cloned */ #define RTM_F_EQUALIZE 0x400 /* Multipath equalizer: NI */ #define RTM_F_PREFIX 0x800 /* Prefix addresses */ +#define RTM_F_NOARP 0x1000 /* Disable ARP for this route */ /* Reserved table identifiers */ @@ -316,6 +317,7 @@ /* ifa_flags */ #define IFA_F_SECONDARY 0x01 +#define IFA_F_HIDDEN 0x02 #define IFA_F_DEPRECATED 0x20 #define IFA_F_TENTATIVE 0x40 diff -ur v2.4.23/linux/net/ipv4/arp.c linux/net/ipv4/arp.c --- v2.4.23/linux/net/ipv4/arp.c 2003-11-16 15:40:07.000000000 +0200 +++ linux/net/ipv4/arp.c 2003-11-16 16:59:08.822464888 +0200 @@ -66,6 +66,7 @@ * Alexey Kuznetsov: new arp state machine; * now it is in net/core/neighbour.c. * Krzysztof Halasa: Added Frame Relay ARP support. + * Julian Anastasov: Per-route ARP control */ #include @@ -322,11 +323,24 @@ struct net_device *dev = neigh->dev; u32 target = *(u32*)neigh->primary_key; int probes = atomic_read(&neigh->probes); + struct rtable *rt; - if (skb && inet_addr_type(skb->nh.iph->saddr) == RTN_LOCAL) - saddr = skb->nh.iph->saddr; - else - saddr = inet_select_addr(dev, target, RT_SCOPE_LINK); + /* Determine source IP for the probing packet. */ + saddr = 0; + if (skb != NULL) { + rt = (struct rtable*)skb->dst; + if (rt && !rt->rt_iif && !(rt->rt_flags & RTCF_NOARP)) + saddr = rt->rt_src; + } + if (!saddr) { + if (ip_route_output(&rt, target, 0, 0, dev->ifindex) < 0) + /* Never send probes with 0 source as we used to. */ + return; + saddr = rt->rt_src; + ip_rt_put(rt); + } + if (!saddr) + return; if ((probes -= neigh->parms->ucast_probes) < 0) { if (!(neigh->nud_state&NUD_VALID)) @@ -346,20 +360,35 @@ read_unlock_bh(&neigh->lock); } -static int arp_filter(__u32 sip, __u32 tip, struct net_device *dev) +static int arp_filter(struct sk_buff *skb, __u32 sip, __u32 tip, + struct in_device *in_dev) { struct rtable *rt; int flag = 0; - /*unsigned long now; */ + if (!IN_DEV_ARPFILTER(in_dev)) + return 0; + + /* Always answer direct queries. */ + if (skb->pkt_type == PACKET_HOST) + return 0; + + /* Then check routes: + * primarily, this check is used to not to answer to some requests if + * several interfaces are connected to the same segment. + * This check also may be used for manual control of who sees IP + * addresses at which link-level addresses by installing prohibiting + * routes. -- 2001/05/20 SAW + */ if (ip_route_output(&rt, sip, tip, 0, 0) < 0) return 1; - if (rt->u.dst.dev != dev) { + if (rt->u.dst.dev != in_dev->dev) { NET_INC_STATS_BH(ArpFilter); flag = 1; } ip_rt_put(rt); - return flag; + + return flag; } /* OBSOLETE FUNCTIONS */ @@ -770,10 +799,8 @@ if (addr_type == RTN_LOCAL) { n = neigh_event_ns(&arp_tbl, sha, &sip, dev); if (n) { - int dont_send = 0; - if (IN_DEV_ARPFILTER(in_dev)) - dont_send |= arp_filter(sip,tip,dev); - if (!dont_send) + if (!(rt->rt_flags & RTCF_NOARP) && + !arp_filter(skb, sip, tip, in_dev)) arp_send(ARPOP_REPLY,ETH_P_ARP,sip,dev,tip,sha,dev->dev_addr,sha); neigh_release(n); @@ -787,6 +814,9 @@ if (n) neigh_release(n); + if (rt->rt_flags & RTCF_NOARP) + goto out; + if (skb->stamp.tv_sec == 0 || skb->pkt_type == PACKET_HOST || in_dev->arp_parms->proxy_delay == 0) { diff -ur v2.4.23/linux/net/ipv4/fib_frontend.c linux/net/ipv4/fib_frontend.c --- v2.4.23/linux/net/ipv4/fib_frontend.c 2003-08-25 22:06:13.000000000 +0300 +++ linux/net/ipv4/fib_frontend.c 2003-11-16 16:59:08.823464736 +0200 @@ -445,6 +445,9 @@ req.rtm.rtm_protocol = RTPROT_KERNEL; req.rtm.rtm_scope = (type != RTN_LOCAL ? RT_SCOPE_LINK : RT_SCOPE_HOST); req.rtm.rtm_type = type; + if (ifa->ifa_flags & IFA_F_HIDDEN && type == RTN_LOCAL && + cmd == RTM_NEWROUTE) + req.rtm.rtm_flags |= RTM_F_NOARP; rta.rta_dst = &dst; rta.rta_prefsrc = &ifa->ifa_local; diff -ur v2.4.23/linux/net/ipv4/route.c linux/net/ipv4/route.c --- v2.4.23/linux/net/ipv4/route.c 2003-11-16 15:40:07.000000000 +0200 +++ linux/net/ipv4/route.c 2003-11-16 16:59:08.829463824 +0200 @@ -1484,6 +1484,9 @@ if (res.type == RTN_BROADCAST) goto brd_input; + if (res.fi && res.fi->fib_flags & RTM_F_NOARP) + flags |= RTCF_NOARP; + if (res.type == RTN_LOCAL) { int result; result = fib_validate_source(saddr, daddr, tos, @@ -1921,6 +1924,9 @@ if (res.type == RTN_NAT) goto e_inval; + if (res.fi && res.fi->fib_flags & RTM_F_NOARP) + flags |= RTCF_NOARP; + if (res.type == RTN_LOCAL) { if (!key.src) key.src = key.dst; @@ -2124,6 +2130,8 @@ r->rtm_flags = (rt->rt_flags & ~0xFFFF) | RTM_F_CLONED; if (rt->rt_flags & RTCF_NOTIFY) r->rtm_flags |= RTM_F_NOTIFY; + if (rt->rt_flags & RTCF_NOARP) + r->rtm_flags |= RTM_F_NOARP; RTA_PUT(skb, RTA_DST, 4, &rt->rt_dst); if (rt->key.src) { r->rtm_src_len = 32; @@ -2248,6 +2256,8 @@ skb->dst = &rt->u.dst; if (rtm->rtm_flags & RTM_F_NOTIFY) rt->rt_flags |= RTCF_NOTIFY; + if (rtm->rtm_flags & RTM_F_NOARP) + rt->rt_flags |= RTCF_NOARP; NETLINK_CB(skb).dst_pid = NETLINK_CB(in_skb).pid;