diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2016-02-04 13:31:18 +0100 |
|---|---|---|
| committer | Michael Bestas <mkbestas@lineageos.org> | 2019-12-23 23:43:37 +0200 |
| commit | d3f2cb3d4d3007b74d28c3fc6f9476243730a28e (patch) | |
| tree | 5b985e9cffd9e58a56627af6a104042ddcb2dd78 | |
| parent | 1a47124756646bf3f42eab939adccba186ec63bf (diff) | |
ipv4: add option to drop gratuitous ARP packets
In certain 802.11 wireless deployments, there will be ARP proxies
that use knowledge of the network to correctly answer requests.
To prevent gratuitous ARP frames on the shared medium from being
a problem, on such deployments wireless needs to drop them.
Enable this by providing an option called "drop_gratuitous_arp".
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 4078228159c9f54cca7347a8bdace29f2abdef65)
Change-Id: I8772dbd7471085878f8b4161eb2a056d79b8b232
| -rw-r--r-- | Documentation/networking/ip-sysctl.txt | 5 | ||||
| -rw-r--r-- | include/uapi/linux/ip.h | 1 | ||||
| -rw-r--r-- | net/ipv4/arp.c | 8 | ||||
| -rw-r--r-- | net/ipv4/devinet.c | 2 |
4 files changed, 16 insertions, 0 deletions
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt index be536ede2a3a..55492e5564ac 100644 --- a/Documentation/networking/ip-sysctl.txt +++ b/Documentation/networking/ip-sysctl.txt @@ -1236,6 +1236,11 @@ drop_unicast_in_l2_multicast - BOOLEAN 1122, but is disabled by default for compatibility reasons. Default: off (0) +drop_gratuitous_arp - BOOLEAN + Drop all gratuitous ARP frames, for example if there's a known + good ARP proxy on the network and such frames need not be used + (or in the case of 802.11, must not be used to prevent attacks.) + Default: off (0) tag - INTEGER Allows you to write a number, which can be used as required. diff --git a/include/uapi/linux/ip.h b/include/uapi/linux/ip.h index 7ec78a2aab29..739a4f3fbe94 100644 --- a/include/uapi/linux/ip.h +++ b/include/uapi/linux/ip.h @@ -166,6 +166,7 @@ enum IPV4_DEVCONF_IGMPV3_UNSOLICITED_REPORT_INTERVAL, IPV4_DEVCONF_IGNORE_ROUTES_WITH_LINKDOWN, IPV4_DEVCONF_DROP_UNICAST_IN_L2_MULTICAST, + IPV4_DEVCONF_DROP_GRATUITOUS_ARP, IPV4_DEVCONF_NF_IPV4_DEFRAG_SKIP, __IPV4_DEVCONF_MAX }; diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c index bfa79831873f..f1e30ff3cfd7 100644 --- a/net/ipv4/arp.c +++ b/net/ipv4/arp.c @@ -743,6 +743,14 @@ static int arp_process(struct net *net, struct sock *sk, struct sk_buff *skb) goto out; /* + * For some 802.11 wireless deployments (and possibly other networks), + * there will be an ARP proxy and gratuitous ARP frames are attacks + * and thus should not be accepted. + */ + if (sip == tip && IN_DEV_ORCONF(in_dev, DROP_GRATUITOUS_ARP)) + goto out; + +/* * Special case: We must set Frame Relay source Q.922 address */ if (dev_type == ARPHRD_DLCI) diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c index fe96f8fc48a0..532a4aeca17c 100644 --- a/net/ipv4/devinet.c +++ b/net/ipv4/devinet.c @@ -2197,6 +2197,8 @@ static struct devinet_sysctl_table { "igmpv3_unsolicited_report_interval"), DEVINET_SYSCTL_RW_ENTRY(IGNORE_ROUTES_WITH_LINKDOWN, "ignore_routes_with_linkdown"), + DEVINET_SYSCTL_RW_ENTRY(DROP_GRATUITOUS_ARP, + "drop_gratuitous_arp"), DEVINET_SYSCTL_FLUSHING_ENTRY(NOXFRM, "disable_xfrm"), DEVINET_SYSCTL_FLUSHING_ENTRY(NOPOLICY, "disable_policy"), |