Subject: Re: dhcpd(8) _cannot_ be completely disabled on an interface
To: John Nemeth <jnemeth@victoria.tc.ca>
From: Andrew Brown <atatat@atatdot.net>
List: tech-security
Date: 01/09/2002 22:34:24
>} netbsd, as i understand it, doesn't do proxy arp without the help of a
>} small daemon, somewhat like rarpd.
>
> Yes it does. What do you think "arp -s ... ..." would do? This
>is the same mechanism that the "proxyarp" option of pppd would use.
it sets an ethernet <-> ip address mapping in the kernel's routing
table. and i can't add a mapping for an ip address that's not on my
local network using arp(8).
this# netstat -rnfinet
Routing tables
Internet:
Destination Gateway Flags Refs Use Mtu Interface
default 206.223.36.132 UGS 6 41657 - ep0
127 127.0.0.1 UGRS 0 0 33220 lo0
127.0.0.1 127.0.0.1 UH 1 100 33220 lo0
206.223.36.128/25 link#31 UC 1 0 - ep0
206.223.36.132 00:50:04:68:c6:10 UHLc 2 406 - ep0
this# arp -s 1.2.3.4 00:50:04:68:c6:11
cannot intuit interface index and type for 1.2.3.4
this#
perhaps one can do such a thing using a "raw" routing socket, but i
wouldn't expect it.
having never used the proxyarp functionality of pppd, i can't comment
on it.
>BTW, rarpd does it opposite, i.e. it converts mac addresses to IP
>addresses and is used for booting diskless client as well as assigning
>addresses to certain networking devices such as printers. However,
>there is an "arpd" in pkgsrc which presumably gives more flexibility
>then "arp -s" does.
sure, rarpd is inverse arp...i knew that. what i was trying to say is
that a proxy arp daemon would operate in much the same fashion as
rarpd. it would have to open a bpf (or one per "interesting"
interface), listen for arp requests that it could answer, and answer
via the bpf.
--
|-----< "CODE WARRIOR" >-----|
codewarrior@daemon.org * "ah! i see you have the internet
twofsonet@graffiti.com (Andrew Brown) that goes *ping*!"
andrew@crossbar.com * "information is power -- share the wealth."