Proxy arp should only replay on specified interface.

[Iasen Kostov]

On Mon, 2005-10-10 at 14:32 +0400, Gleb Smirnoff wrote:
>   Iasen,
> 
> On Fri, Oct 07, 2005 at 05:58:55PM +0300, Iasen Kostov wrote:
> I> 	IMHO proxy arp should only replay on specified interface not on every
> I> arp capable interface which recieved request for the proxied address.
> I> If lets say host A have arp capable if0 and if1 interfaces and U set:
> I> 	route add -host 1.0.0.2 -iface if1 -proxy
> I> 
> I> and then a request is recieved on if0 for 1.0.0.2, host A will replay
> I> that it has it (which IMHO is wrong as the proxy route is set for if1).
> I> 
> I> 	This sometimes is a big problem for our PPPoE/VPN server when the
> I> client uses linux or some small routers (e.g Linksys or something)
> I> probably linux based. It happen that sometimes (when the link is down or
> I> god knows why) it broadcasts arp "who-has" and the gateway replays. Then
> I> this host try to use ethernet path and not the (right) tunnel path until
> I> arp cache expires (which is not real fun as there is firewall rules
> I> blocking ethernet path :)).
> I> 
> I> 	And even worse :) - I can think of ways to bypass routing protocols
> I> using proxy-arp routes like the one mentioned above. But it will not
> I> work if proxy-arp behaves the way it does now.
> I> 	And 1 thing more - there could be a switch which restores (or turns on)
> I> old behavior.
> I> 
> I> (patch agains 5.4-STABLE is attached)
> 
> Isn't this what you need?
> 
> http://www.freebsd.org/cgi/cvsweb.cgi/src/sys/netinet/if_ether.c?rev=1.140&content-type=text/x-cvsweb-markup
> 
	Exactly :). Thanks. This probably won't make it into 5.x but its good
to know that it's fixed :)
        
        regards.