diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2016-02-04 13:31:18 +0100 |
|---|---|---|
| committer | Moyster <oysterized@gmail.com> | 2017-11-18 19:27:08 +0100 |
| commit | 1212bd2498a4852c104f6cf7557f7c1ac4c2f75c (patch) | |
| tree | 76d1506ba238b16b004554dad5663103ffa7c369 /net | |
| parent | 8c791e8f78f0de5a6e03f418a8ff354f2f3ea777 (diff) | |
ipv4: add option to drop gratuitous ARP packets
In certain 802.11 wireless deployments, there will be ARP proxies
that use knowledge of the network to correctly answer requests.
To prevent gratuitous ARP frames on the shared medium from being
a problem, on such deployments wireless needs to drop them.
Enable this by providing an option called "drop_gratuitous_arp".
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: danielhk <daniel_hk>
Diffstat (limited to 'net')
| -rw-r--r-- | net/ipv4/arp.c | 8 | ||||
| -rw-r--r-- | net/ipv4/devinet.c | 2 |
2 files changed, 10 insertions, 0 deletions
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c index 5fe16a76d..d0ee14d6a 100644 --- a/net/ipv4/arp.c +++ b/net/ipv4/arp.c @@ -808,6 +808,14 @@ static int arp_process(struct sk_buff *skb) (!IN_DEV_ROUTE_LOCALNET(in_dev) && ipv4_is_loopback(tip))) goto out; + /* + * For some 802.11 wireless deployments (and possibly other networks), + * there will be an ARP proxy and gratuitous ARP frames are attacks + * and thus should not be accepted. + */ + if (sip == tip && IN_DEV_ORCONF(in_dev, DROP_GRATUITOUS_ARP)) + goto out; + /* * Special case: We must set Frame Relay source Q.922 address */ diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c index 08b0c1e42..ee3c309ef 100644 --- a/net/ipv4/devinet.c +++ b/net/ipv4/devinet.c @@ -2109,6 +2109,8 @@ static struct devinet_sysctl_table { DEVINET_SYSCTL_RW_ENTRY(ARP_ACCEPT, "arp_accept"), DEVINET_SYSCTL_RW_ENTRY(ARP_NOTIFY, "arp_notify"), DEVINET_SYSCTL_RW_ENTRY(PROXY_ARP_PVLAN, "proxy_arp_pvlan"), + DEVINET_SYSCTL_RW_ENTRY(DROP_GRATUITOUS_ARP, + "drop_gratuitous_arp"), DEVINET_SYSCTL_FLUSHING_ENTRY(NOXFRM, "disable_xfrm"), DEVINET_SYSCTL_FLUSHING_ENTRY(NOPOLICY, "disable_policy"), |