Re: Identify gratuitous arp?
Bart De Schuymer <[email protected]>
| Newsgroups | gmane.linux.network.bridge.ebtables.user |
|---|---|
| Message-ID | <[email protected]> |
Op vr, 02-09-2005 te 13:06 +0200, schreef [email protected]: > Sounds great that it should be easy to add :) Unfortunately I'm not into C > so much but maybe I can create a patch if someone explain short in what > file the opcode "lives". > > /Oscar > > > Op do, 01-09-2005 te 09:01 +0200, schreef [email protected]: > >> Is it possible to identify gratuitous arp packets. If not it would be a > >> nice feature to do so with the opcode. > > > > It's currently not possible, but it should be easy to add the feature. Something like the attached untested and uncompiled patches should do the trick... cheers, Bart
patch.diff
(text/x-patch, 1.2 KB)
--- linux-2.6.13/include/linux/netfilter_bridge/ebt_arp.h.old 2005-09-03 09:58:14.223019808 +0000
+++ linux-2.6.13/include/linux/netfilter_bridge/ebt_arp.h 2005-09-03 09:58:40.041094864 +0000
@@ -9,7 +9,8 @@
#define EBT_ARP_SRC_MAC 0x20
#define EBT_ARP_DST_MAC 0x40
#define EBT_ARP_MASK (EBT_ARP_OPCODE | EBT_ARP_HTYPE | EBT_ARP_PTYPE | \
- EBT_ARP_SRC_IP | EBT_ARP_DST_IP | EBT_ARP_SRC_MAC | EBT_ARP_DST_MAC)
+ EBT_ARP_SRC_IP | EBT_ARP_DST_IP | EBT_ARP_SRC_MAC | EBT_ARP_DST_MAC | \
+ EBT_ARP_GRAT)
#define EBT_ARP_MATCH "arp"
struct ebt_arp_info
--- linux-2.6.13/net/bridge/netfilter/ebt_arp.c.old 2005-09-03 09:41:44.948412408 +0000
+++ linux-2.6.13/net/bridge/netfilter/ebt_arp.c 2005-09-03 10:00:08.721613376 +0000
@@ -98,6 +98,18 @@ static int ebt_filter_arp(const struct s
}
}
+ if (info->bitmask & EBT_ARP_GRAT) {
+ uint32_t _addr[2], *ap;
+ if (ah->ar_pln != sizeof(uint32_t) || ah->ar_op != ARPOP_REQUEST || ah->ar_pro != ntohs(0x0800))
+ return EBT_NOMATCH;
+ ap = skb_header_pointer(skb, sizeof(struct arphdr) +
+ 2*ah->ar_hln, sizeof(_addr), _addr);
+ if (ap == NULL)
+ return EBT_NOMATCH;
+ if (FWINV(ap[0] != ap[1], EBT_ARP_GRAT))
+ return EBT_NOMATCH;
+ }
+
return EBT_MATCH;
}
patch_user.diff
(text/x-patch, 1.7 KB)
--- ebtables-2-0-7/extensions/ebt_arp.c.old 2005-09-03 09:37:06.050811288 +0000
+++ ebtables-2-0-7/extensions/ebt_arp.c 2005-09-03 10:01:34.928507936 +0000
@@ -23,6 +23,7 @@
#define ARP_IP_D '5'
#define ARP_MAC_S '6'
#define ARP_MAC_D '7'
+#define ARP_GRAT '8'
static struct option opts[] =
{
{ "arp-opcode" , required_argument, 0, ARP_OPCODE },
@@ -33,6 +34,7 @@ static struct option opts[] =
{ "arp-ip-dst" , required_argument, 0, ARP_IP_D },
{ "arp-mac-src" , required_argument, 0, ARP_MAC_S },
{ "arp-mac-dst" , required_argument, 0, ARP_MAC_D },
+ { "arp-gratuitous", no_argument, 0, ARP_GRAT },
{ 0 }
};
@@ -64,6 +66,7 @@ static void print_help()
"--arp-ip-dst [!] address[/mask]: ARP IP target specification\n"
"--arp-mac-src [!] address[/mask]: ARP MAC source specification\n"
"--arp-mac-dst [!] address[/mask]: ARP MAC target specification\n"
+"--arp-gratuitous [!] : gratuitous ARP request\n"
" opcode strings: \n");
for (i = 0; i < NUMOPCODES; i++)
printf(" %d = %s\n", i + 1, opcodes[i]);
@@ -88,6 +91,7 @@ static void init(struct ebt_entry_match
#define OPT_IP_D 0x10
#define OPT_MAC_S 0x20
#define OPT_MAC_D 0x40
+#define OPT_GRAT 0x80
static int parse(int c, char **argv, int argc, const struct ebt_u_entry *entry,
unsigned int *flags, struct ebt_entry_match **match)
{
@@ -201,6 +205,12 @@ static int parse(int c, char **argv, int
if (ebt_get_mac_and_mask(optarg, maddr, mmask))
ebt_print_error2("Problem with ARP MAC address argument");
break;
+ case ARP_GRAT:
+ ebt_check_option2(flags, OPT_GRAT);
+ arpinfo->bitmask |= EBT_ARP_GRAT;
+ if (ebt_check_inverse2(optarg))
+ arpinfo->invflags |= EBT_ARP_GRAT;
+ break;
default:
return 0;