Mailing List Archive: iptables: Devel

[PATCH] Netfilter hook for ARP

Index | Next | Previous | View Threaded

tv at stonesoft

Jul 27, 2001, 11:36 AM

Post #1 of 7 (228 views)
Permalink

[PATCH] Netfilter hook for ARP

Hi. Here's a patch you might like, as there has been lots of
talk about ARP filtering etc lately. The send hook is just
before dev_queue_xmit(), and arp_rcv() is split in two, with
the hook in between. Please include..

diff -Naur linux-2.4.6/include/linux/netfilter_arp.h linux/include/linux/netfilter_arp.h
--- linux-2.4.6/include/linux/netfilter_arp.h Thu Jan 1 02:00:00 1970
+++ linux/include/linux/netfilter_arp.h Tue Jul 10 11:03:33 2001
@@ -0,0 +1,15 @@
+#ifndef __LINUX_ARP_NETFILTER_H
+#define __LINUX_ARP_NETFILTER_H
+
+/* ARP-specific defines for netfilter.
+ * Copyright 2000 Stonesoft Corp.
+ * Licensed under the GNU General Public License.
+ */
+
+#include <linux/netfilter.h>
+
+#define NF_ARP_IN 0
+#define NF_ARP_OUT 1
+#define NF_ARP_NUMHOOKS 2
+
+#endif /*__LINUX_ARP_NETFILTER_H*/
diff -Naur linux-2.4.6/net/ipv4/arp.c linux/net/ipv4/arp.c
--- linux-2.4.6/net/ipv4/arp.c Wed May 16 20:21:45 2001
+++ linux/net/ipv4/arp.c Tue Jul 10 11:04:16 2001
@@ -111,6 +111,8 @@

#include <asm/system.h>
#include <asm/uaccess.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter_arp.h>

@@ -562,7 +564,8 @@
memcpy(arp_ptr, &dest_ip, 4);
skb->dev = dev;

- dev_queue_xmit(skb);
+ NF_HOOK(PF_UNSPEC, NF_ARP_OUT, skb, dev, NULL,
+ dev_queue_xmit);
return;

out:
@@ -578,17 +581,16 @@
* Receive an arp request by the device layer.
*/

+static int arp_rcv2(struct sk_buff *skb);
+
int arp_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt)
{
struct arphdr *arp = skb->nh.arph;
unsigned char *arp_ptr= (unsigned char *)(arp+1);
- struct rtable *rt;
unsigned char *sha, *tha;
u32 sip, tip;
u16 dev_type = dev->type;
- int addr_type;
struct in_device *in_dev = in_dev_get(dev);
- struct neighbour *n;

/*
* The hardware length of the packet should match the hardware length
@@ -739,6 +741,42 @@
* and in the case of requests for us we add the requester to the arp
* cache.
*/
+
+ if (in_dev)
+ in_dev_put(in_dev);
+ return NF_HOOK(PF_UNSPEC, NF_ARP_IN, skb, dev, NULL,
+ arp_rcv2);
+
+ out:
+ if (in_dev)
+ in_dev_put(in_dev);
+ freeskb:
+ kfree_skb(skb);
+ out_of_mem:
+ return 0;
+}
+
+int arp_rcv2(struct sk_buff *skb) {
+ int addr_type;
+ struct rtable *rt;
+ struct neighbour *n;
+ struct arphdr *arp = skb->nh.arph;
+ unsigned char *arp_ptr= (unsigned char *)(arp+1);
+ struct net_device *dev = skb->dev;
+ struct in_device *in_dev = in_dev_get(dev);
+ unsigned char *sha, *tha;
+ u32 sip, tip;
+
+/*
+ * Extract fields
+ */
+ sha=arp_ptr;
+ arp_ptr += dev->addr_len;
+ memcpy(&sip, arp_ptr, 4);
+ arp_ptr += 4;
+ tha=arp_ptr;
+ arp_ptr += dev->addr_len;
+ memcpy(&tip, arp_ptr, 4);

/* Special case: IPv4 duplicate address detection packet (RFC2131) */
if (sip == 0) {
@@ -747,7 +785,7 @@
arp_send(ARPOP_REPLY,ETH_P_ARP,tip,dev,tip,sha,dev->dev_addr,dev->dev_addr);
goto out;
}
-
+
if (arp->ar_op == __constant_htons(ARPOP_REQUEST) &&
ip_route_input(skb, tip, sip, 0, dev) == 0) {

@@ -768,7 +806,8 @@
goto out;
} else if (IN_DEV_FORWARD(in_dev)) {
if ((rt->rt_flags&RTCF_DNAT) ||
- (addr_type == RTN_UNICAST && rt->u.dst.dev != dev &&
+ ((addr_type == RTN_UNICAST || addr_type == RTN_BLACKHOLE || addr_type == RTN_UNREACHABLE)
+ && rt->u.dst.dev != dev &&
(IN_DEV_PROXY_ARP(in_dev) || pneigh_lookup(&arp_tbl, &tip, dev, 0)))) {
n = neigh_event_ns(&arp_tbl, sha, &sip, dev);
if (n)
@@ -828,9 +867,7 @@
out:
if (in_dev)
in_dev_put(in_dev);
-freeskb:
kfree_skb(skb);
-out_of_mem:
return 0;
}

--
tv@{{hq.yok.utu,havoc,gaeshido}.fi,{debian,wanderer}.org,stonesoft.com}
double a,b=4,c;main(){for(;++a<2e6;c-=(b=-b)/a++);printf("%f\n",c);}

kakadu at earthlink

Jul 27, 2001, 1:33 PM

Post #2 of 7 (221 views)
Permalink

Re: [PATCH] Netfilter hook for ARP [In reply to]

Mr. Virtanen,

Due to a buggy e-mail tool, a portion of your patch was cut off. Did your
patch also include new shared library protocol extensions for iptables
and/or
ip6tables, so that we can actually manipulate traffic in these hooks? AFAIK,
the current protocol matches won't work for this low-level thing. This looks
mildly interesting, but without the new extensions, no one will be able to
do anything with it.

Brad

Tommi Virtanen wrote:

> Hi. Here's a patch you might like, as there has been lots of
> talk about ARP filtering etc lately. The send hook is just
> before dev_queue_xmit(), and arp_rcv() is split in two, with
> the hook in between. Please include..
>
> diff -Naur linux-2.4.6/include/linux/netfilter_arp.h linux/include/linux/netfilter_arp.h
> --- linux-2.4.6/include/linux/netfilter_arp.h Thu Jan 1 02:00:00 1970
> +++ linux/include/linux/netfilter_arp.h Tue Jul 10 11:03:33 2001
> @@ -0,0 +1,15 @@
> +#ifndef __LINUX_ARP_NETFILTER_H
> +#define __LINUX_ARP_NETFILTER_H
> +
> +/* ARP-specific defines for netfilter.
> + * Copyright 2000 Stonesoft Corp.
> + * Licensed under the GNU General Public License.
> + */
> +
> +#include <linux/netfilter.h>
> +
> +#define NF_ARP_IN 0
> +#define NF_ARP_OUT 1
> +#define NF_ARP_NUMHOOKS 2
> +
> +#endif /*__LINUX_ARP_NETFILTER_H*/
> diff -Naur linux-2.4.6/net/ipv4/arp.c linux/net/ipv4/arp.c
> --- linux-2.4.6/net/ipv4/arp.c Wed May 16 20:21:45 2001
> +++ linux/net/ipv4/arp.c Tue Jul 10 11:04:16 2001
> @@ -111,6 +111,8 @@
>
> #include <asm/system.h>
> #include <asm/uaccess.h>
> +#include <linux/netfilter.h>
> +#include <linux/netfilter_arp.h>
>
>
>
> @@ -562,7 +564,8 @@
> memcpy(arp_ptr, &dest_ip, 4);
> skb->dev = dev;
>
> - dev_queue_xmit(skb);
> + NF_HOOK(PF_UNSPEC, NF_ARP_OUT, skb, dev, NULL,
> + dev_queue_xmit);
> return;
>
> out:
> @@ -578,17 +581,16 @@
> * Receive an arp request by the device layer.
> */
>
> +static int arp_rcv2(struct sk_buff *skb);
> +
> int arp_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt)
> {
> struct arphdr *arp = skb->nh.arph;
> unsigned char *arp_ptr= (unsigned char *)(arp+1);
> - struct rtable *rt;
> unsigned char *sha, *tha;
> u32 sip, tip;
> u16 dev_type = dev->type;
> - int addr_type;
> struct in_device *in_dev = in_dev_get(dev);
> - struct neighbour *n;
>
> /*
> * The hardware length of the packet should match the hardware length
> @@ -739,6 +741,42 @@
> * and in the case of requests for us we add the requester to the arp
> * cache.
> */
> +
> + if (in_dev)
> + in_dev_put(in_dev);
> + return NF_HOOK(PF_UNSPEC, NF_ARP_IN, skb, dev, NULL,
> + arp_rcv2);
> +
> + out:
> + if (in_dev)
> + in_dev_put(in_dev);
> + freeskb:
> + kfree_skb(skb);
> + out_of_mem:
> + return 0

kisza at sch

Jul 27, 2001, 2:44 PM

Post #3 of 7 (229 views)
Permalink

Re: [PATCH] Netfilter hook for ARP [In reply to]

Brad Chapman ........................................ (2001. j�lius 27.)

Hi!

> Due to a buggy e-mail tool, a portion of your patch was cut off. Did your
> patch also include new shared library protocol extensions for iptables
> and/or
> ip6tables, so that we can actually manipulate traffic in these hooks? AFAIK,
^^^^^^^^^
The ipv6 hasn't got ARP (it doesn't use ARP)...
(The neighbour-solicitation and neighbour-advertisement are used in ipv6)

Regards,

kisza

--
Kis-Szabo Andras BUTE - Schonherz Dormitory
---------------------------/ Favourite tools: Zorp, NetFilter
kisza [at] sch /---Member of the BUTE-MIS-SEARCHLab-->>>>>.Info

tv-nospam-e2aac4 at hq

Jul 27, 2001, 11:48 PM

Post #4 of 7 (225 views)
Permalink

Re: [PATCH] Netfilter hook for ARP [In reply to]

Brad Chapman <kakadu [at] earthlink> writes:

> Due to a buggy e-mail tool, a portion of your patch was cut off.
> Did your

Hmm, the copy I got from the list looks okay.
Reattaching as MIME.

> patch also include new shared library protocol extensions for
> iptables and/or ip6tables, so that we can actually manipulate
> traffic in these hooks? AFAIK, the current protocol matches won't
> work for this low-level thing. This looks mildly interesting, but
> without the new extensions, no one will be able to do anything with
> it.

Unfortunately I don't grok the userspace portion nearly as
well. Hopefully someone else will step up. The reason I posted
the patch was that someone mentioned he might be implementing
it; no need for double work.

Attachments:

netfilter-arp-246.patch (3.31 KB)

laforge at gnumonks

Aug 2, 2001, 1:06 AM

Post #5 of 7 (226 views)
Permalink

Re: [PATCH] Netfilter hook for ARP [In reply to]

> Unfortunately I don't grok the userspace portion nearly as
> well. Hopefully someone else will step up. The reason I posted
> the patch was that someone mentioned he might be implementing
> it; no need for double work.

Are you using the patch for something right now? I have been talking to
Andi Kleen last week, and we were unable to find an application where
you really would need that...

If somebody can make up a case where this really would be of use
(apart from only being nice), we could take into consideration submitting
it to the kernel...

--
Live long and prosper
- Harald Welte / laforge [at] gnumonks http://www.gnumonks.org
============================================================================
GCS/E/IT d- s-: a-- C+++ UL++++$ P+++ L++++$ E--- W- N++ o? K- w--- O- M-
V-- PS+ PE-- Y+ PGP++ t++ 5-- !X !R tv-- b+++ DI? !D G+ e* h+ r% y+(*)

bof at bof

Aug 3, 2001, 12:33 AM

Post #6 of 7 (224 views)
Permalink

Re: [PATCH] Netfilter hook for ARP [In reply to]

> If somebody can make up a case where this really would be of use
> (apart from only being nice), we could take into consideration submitting
> it to the kernel...

Any kind of MAC address filtering, only starts to make sense if you
have everything connected to a switch which allows MAC pinning to
ports. The switch then takes care that only THIS configured MAC can
come in THIS port, and THAT configured MAC can come in THAT port
(always looking at the source MAC of ingres packets).

ARP filtering, and MAC filtering in iptables, only then can be used
as a security device. If done properly, you can then avoid most MAC
and IP takeover games.

No, I don't have that in production right now, and don't even know
which of our switches could do it. We partition into many VLANs,
grouping roughly by administratos, and project.

regards
Patrick

tv at debian

Aug 6, 2001, 2:42 AM

Post #7 of 7 (223 views)
Permalink

Re: [PATCH] Netfilter hook for ARP [In reply to]

Harald Welte <laforge [at] gnumonks> writes:

> Are you using the patch for something right now? I have been talking to
> Andi Kleen last week, and we were unable to find an application where
> you really would need that...

Yes. It's basically an ARP filter/mangler for a custom
clustering thingie (yes, that's the technical word :).

--
tv@{{hq.yok.utu,havoc,gaeshido}.fi,{debian,wanderer}.org,stonesoft.com}
double a,b=4,c;main(){for(;++a<2e6;c-=(b=-b)/a++);printf("%f\n",c);}

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads