Turning off ARP in linux-2.4.0

Well, the easises way of course is to have the internal cluster network on another network card than the external load balancer. This will remove the arp queries on their interface. But of course the back channel will be a bit more delayed.

Another option is to ifconfig -arp the eth0 interface. I browsed through the IPv4 code and did not find any other goto out which can be configured besides the input FIB, which messing with is a bad thing since it wont accept the packet at all.

so ifconfig -arp is the only option i could find which will help you. You need to hardcode the arp entries for the real ip's of those web servers to reach them.

Greetings
Bernd
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected]
Please read the FAQ at http://www.tux.org/lkml/

-arp means that the kernel will not put in link layer to the packets. It's probably not what you want. Yes the option is misnamed.

2.2 has arpfilter, which will hopefully end up in 2.4 soon too. Here is a patch. It allows to filter ARP replies based on the routing table.

-Andi

Index: include/linux/sysctl.h
===================================================================
RCS file: /cvs/linux/include/linux/sysctl.h,v
retrieving revision 1.110

diff -u -u -r1.110 sysctl.h
@@ -320,9 +320,9 @@
 	NET_IPV4_CONF_SHARED_MEDIA=7,
 	NET_IPV4_CONF_RP_FILTER=8,
 	NET_IPV4_CONF_ACCEPT_SOURCE_ROUTE=9,
-	NET_IPV4_CONF_BOOTP_RELAY=10,
 	NET_IPV4_CONF_LOG_MARTIANS=11,
-	NET_IPV4_CONF_TAG=12
+	NET_IPV4_CONF_TAG=12,
+	NET_IPV4_CONF_ARPFILTER=13, 
 };
 
 /* /proc/sys/net/ipv6 */

Index: include/linux/inetdevice.h
===================================================================
RCS file: /cvs/linux/include/linux/inetdevice.h,v
retrieving revision 1.10

diff -u -u -r1.10 inetdevice.h
@@ -12,11 +12,11 @@
 	int	accept_source_route;
 	int	rp_filter;
 	int	proxy_arp;
-	int	bootp_relay;
 	int	log_martians;
 	int	forwarding;
 	int	mc_forwarding;
 	int	tag;
+	int	arp_filter;
 	void	*sysctl;
 };
 

@@ -39,7 +39,6 @@
 #define IN_DEV_MFORWARD(in_dev)		(ipv4_devconf.mc_forwarding && (in_dev)->cnf.mc_forwarding)
 #define IN_DEV_RPFILTER(in_dev)		(ipv4_devconf.rp_filter && (in_dev)->cnf.rp_filter)
 #define IN_DEV_SOURCE_ROUTE(in_dev)	(ipv4_devconf.accept_source_route && (in_dev)->cnf.accept_source_route)
-#define IN_DEV_BOOTP_RELAY(in_dev)	(ipv4_devconf.bootp_relay && (in_dev)->cnf.bootp_relay)
 
 #define IN_DEV_LOG_MARTIANS(in_dev)	(ipv4_devconf.log_martians || (in_dev)->cnf.log_martians)
 #define IN_DEV_PROXY_ARP(in_dev)	(ipv4_devconf.proxy_arp || (in_dev)->cnf.proxy_arp)

@@ -47,6 +46,9 @@
 #define IN_DEV_TX_REDIRECTS(in_dev)	(ipv4_devconf.send_redirects || (in_dev)->cnf.send_redirects)
 #define IN_DEV_SEC_REDIRECTS(in_dev)	(ipv4_devconf.secure_redirects || (in_dev)->cnf.secure_redirects)
 #define IN_DEV_IDTAG(in_dev)		((in_dev)->cnf.tag)
+#define IN_DEV_ARPFILTER(in_dev)	(ipv4_devconf.arp_filter || \
+					 (in_dev)->cnf.arp_filter)
+
 
 #define IN_DEV_RX_REDIRECTS(in_dev) \
 	((IN_DEV_FORWARD(in_dev) && \

Index: net/ipv4/arp.c
===================================================================
RCS file: /cvs/linux/net/ipv4/arp.c,v
retrieving revision 1.95

diff -u -u -r1.95 arp.c
@@ -311,6 +311,21 @@
 	kfree_skb(skb);
 }
 
+static int arp_filter(__u32 sip, __u32 tip, struct device *dev)
+{
+	struct rtable *rt;
+	int flag = 0; 
+
+	if (ip_route_output(&rt, sip, tip, 0, 0) < 0) 
+		return 1;
+	if (rt->u.dst.dev != dev) { 
+		SNMP_INC_STATS(net_statistics, ArpFilter); 
+		flag = 1; 
+	} 
+	ip_rt_put(rt); 
+	return flag; 
+} 
+
 static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb)
 {
 	u32 saddr;

@@ -731,18 +746,25 @@
 
 		if (addr_type == RTN_LOCAL) {
 			n = neigh_event_ns(&arp_tbl, sha, &sip, dev);
-			if (n) {
+			if (!n)
+				goto out;
+			if (!(IN_DEV_ARPFILTER(in_dev)&&arp_filter(sip,tip,dev)))
 				arp_send(ARPOP_REPLY,ETH_P_ARP,sip,dev,tip,sha,dev->dev_addr,sha);
-				neigh_release(n);
-			}
+			neigh_release(n);
 			goto out;
 		} else if (IN_DEV_FORWARD(in_dev)) {
+			struct pneigh_enqueue *p = NULL; 
 			if ((rt->rt_flags&RTCF_DNAT) ||
 			    (addr_type == RTN_UNICAST  && rt->u.dst.dev != dev &&
-			     (IN_DEV_PROXY_ARP(in_dev) || pneigh_lookup(&arp_tbl, &tip, dev, 0)))) {
+			     (IN_DEV_PROXY_ARP(in_dev) || (p=pneigh_lookup(&arp_tbl, &tip, dev, 0))))) {
 				n = neigh_event_ns(&arp_tbl, sha, &sip, dev);
 				if (n)
 					neigh_release(n);
+
+				/* no arpfilter for explicit proxy arps */ 
+				if (!p && IN_DEV_ARPFILTER(in_dev)&&
+				    arp_filter(sip,tip,dev))
+					goto out; 
 
 				if (skb->stamp.tv_sec == 0 ||
 				    skb->pkt_type == PACKET_HOST ||

Index: net/ipv4/proc.c
===================================================================
RCS file: /cvs/linux/net/ipv4/proc.c,v
retrieving revision 1.44

diff -u -u -r1.44 proc.c
@@ -194,10 +194,18 @@
 		      " TCPAbortOnMemory TCPAbortOnTimeout TCPAbortOnLinger"
 		      " TCPAbortFailed TCPMemoryPressures\n"
 		      "TcpExt:");
-	for (i=0; i<offsetof(struct linux_mib, __pad)/sizeof(unsigned long); i++)
+	for (i=0; i<offsetof(struct linux_mib, __tcp_pad)/sizeof(unsigned long); i++)
 		len += sprintf(buffer+len, " %lu", fold_field((unsigned long*)net_statistics, sizeof(struct linux_mib), i));
 
 	len += sprintf (buffer + len, "\n");
+
+	len += sprintf(buffer + len, 
+				"IpExt: ArpFilter\n"
+				"IpExt: %lu\n",
+			  fold_field((unsigned long *)net_statistics,
+				     sizeof(struct linux_mib), 
+				     offsetof(struct linux_mib,ArpFilter)/
+				     sizeof(unsigned long))); 
 
 	if (offset >= len)
 	{

Index: net/ipv4/devinet.c
===================================================================
RCS file: /cvs/linux/net/ipv4/devinet.c,v
retrieving revision 1.39

diff -u -u -r1.39 devinet.c
@@ -773,7 +773,12 @@
 static int inetdev_event(struct notifier_block *this, unsigned long event, void *ptr)
 {
 	struct net_device *dev = ptr;
-	struct in_device *in_dev = __in_dev_get(dev);
+	struct in_device *in_dev;
+	
+	if (!dev) 
+		return NOTIFY_DONE; 
+
+	in_dev = __in_dev_get(dev);
 
 	ASSERT_RTNL();
 

@@ -817,13 +822,31 @@
 	case NETDEV_CHANGENAME:
 		if (in_dev->ifa_list) {
 			struct in_ifaddr *ifa;
-			for (ifa = in_dev->ifa_list; ifa; ifa = ifa->ifa_next)
+			for (ifa = in_dev->ifa_list; ifa; ifa = ifa->ifa_next) { 
+				char oldname[IFNAMSIZ]; 
+				char *alias; 
+				memcpy(oldname, ifa->ifa_label, IFNAMSIZ);
+				alias = strchr(oldname, ':');
 				memcpy(ifa->ifa_label, dev->name, IFNAMSIZ);
+				if (alias) {
+					strncat(ifa->ifa_label,alias,IFNAMSIZ-1-strlen(ifa->ifa_label));
+					ifa->ifa_label[IFNAMSIZ-1] = '\0';
+				} 
+			} 
 			/* Do not notify about label change, this event is
 			   not interesting to applications using netlink.
 			 */
 		}
 		break;
+#if 0		
+	case NETDEV_REBOOT:
+		if (dev->flags & IFF_DYNAMIC ) { 
+			for_primary_ifa(in_dev) {
+				notifier_call_chain(&inetaddr_chain, NETDEV_REBOOT, ifa); 
+			} endfor_ifa(in_dev); 
+ 		}
+ 		break;
+#endif		
 	}
 
 	return NOTIFY_DONE;

@@ -1053,16 +1076,16 @@
          &proc_dointvec},
 	{NET_IPV4_CONF_PROXY_ARP, "proxy_arp",
          &ipv4_devconf.proxy_arp, sizeof(int), 0644, NULL,
-         &proc_dointvec},
-	{NET_IPV4_CONF_BOOTP_RELAY, "bootp_relay",
-         &ipv4_devconf.bootp_relay, sizeof(int), 0644, NULL,
          &proc_dointvec},
-        {NET_IPV4_CONF_LOG_MARTIANS, "log_martians",
+	{NET_IPV4_CONF_LOG_MARTIANS, "log_martians",
          &ipv4_devconf.log_martians, sizeof(int), 0644, NULL,
          &proc_dointvec},
 	{NET_IPV4_CONF_TAG, "tag",
 	 &ipv4_devconf.tag, sizeof(int), 0644, NULL,
 	 &proc_dointvec},
+	{NET_IPV4_CONF_ARPFILTER, "arp_filter",
+          &ipv4_devconf.arp_filter, sizeof(int), 0644, NULL,
+          &proc_dointvec},
 	 {0}},
 
 	{{NET_PROTO_CONF_ALL, "all", NULL, 0, 0555, devinet_sysctl.devinet_vars},{0}},

Index: include/net/snmp.h
===================================================================
RCS file: /cvs/linux/include/net/snmp.h,v
retrieving revision 1.17

diff -u -u -r1.17 snmp.h
@@ -254,6 +254,9 @@
 	unsigned long	TCPAbortOnLinger;
 	unsigned long	TCPAbortFailed;
 	unsigned long	TCPMemoryPressures;
+	unsigned long	__tcp_pad[0];
+	unsigned long	ArpFilter;
+	unsigned long	__ip_pad[0];
 	unsigned long   __pad[0];
 } ____cacheline_aligned;
 

Index: Documentation/networking/ip-sysctl.txt
===================================================================
RCS file: /cvs/linux/Documentation/networking/ip-sysctl.txt,v retrieving revision 1.17

diff -u -u -r1.17 ip-sysctl.txt
@@ -345,14 +345,6 @@
 send_redirects - BOOLEAN
 	Send redirects, if router. Default: TRUE
 
-bootp_relay - BOOLEAN
-	Accept packets with source address 0.b.c.d destined
-	not to this host as local ones. It is supposed, that
-	BOOTP relay daemon will catch and forward such packets.
-
-	default FALSE
-	Not Implemented Yet.
-
 accept_source_route - BOOLEAN
 	Accept packets with SRR option.
 	default TRUE (router)

@@ -369,6 +361,10 @@
 
 	Default value is 0. Note that some distributions enable it
 	in startip scripts.
+
+arp_filter - BOOLEAN
+	Only answer ARP requests on this device when the routing table would 
+	send packets to the source it to the same device.
 
 Alexey Kuznetsov.
 [email protected]

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected]
Please read the FAQ at http://www.tux.org/lkml/

Thanks for the patches. I patched the kernel and tried it and it still is reponding to arps even after I issued:

echo 1 > /proc/sys/net/ipv4/conf/all/arp_filter
echo 1 > /proc/sys/net/ipv4/conf/lo/arp_filter

I do not know what the hidden interface did exactly and I am still unsure why it no longer shows up in the 2.4.0 kernel.
Here is a clip from the TurboLinux ClusterServer manual that explains how to turn off the arping. Maybe it will clear up what I am trying to accomplish:

Next you have to turn off ARP replies on the interface. How you accomplish that depends upon which Linux kernel version you are using. On UNIX systems and Linux 2.0 kernels, you can supply the -arp option to the ifconfig command when you bring up the interface. (Note that some UNIX and Linux systems may use a slightly different syntax, such as using noarp instead of -arp.) So in our example, we would use this command to configure the interface:

# ifconfig lo:1 10.0.0.99 netmask 255.255.255.255 -arp

Unfortunately, this method does not work in any Linux kernels more recent than the 2.0 series. For systems running kernel 2.2.14 and higher the -arp option does not work. Instead, you will have to use the /proc filesystem to turn off ARP replies. To do this, echo a 1 to the hidden file in /proc/sys/net/ipv4/conf/all and the hidden file for the interface you are using. Here is an example that will turn off ARP replies on the loopback interface:

# echo 1 > /proc/sys/net/ipv4/conf/all/hidden # echo 1 > /proc/sys/net/ipv4/conf/lo/hidden

Is there something that the arp_filter can do that will mirror this functionality? The modification that you made to the documentation was pretty straight forward in that the arp_filter was BOOLEAN, so I think I implemented it right.

Any other ideas?

Thanks for your help.

Pete

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected]
Please read the FAQ at http://www.tux.org/lkml/

The snippet you posted doesn't describe what ClusterThingy exactly wants to do with ARPs.

Arpfilter was designed for multiple interfaces, to direct ARP replies to specific interfaces based on the routing table. If you have only a single interface and no other way to policy route the packet I think you can only try to use policy routing hacks (not tested). e.g. tag all outgoing packets with a specific fwmark that redirects them to a specific routing table which does the real routing, and put no routes into the normal one used by arpfilter so that it doesnt' reply.

Admittedly it's quite a hack. Perhaps Alexey can suggest a better solution, he's the routing/arp guru. I guess it would be easier if arpfilter was able to select a special own routing table, but I was too chicken to implement that.

-Andi
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected]
Please read the FAQ at http://www.tux.org/lkml/

Well I think the main difference in what you implemented and what the cluster server thing is doing (I think) is it sounds like you can arp on a specific interface, but for the cluster server software to work, the node cannot arp at all since a separate machine is acting as a redirector and all incoming request go to that server first and are then pasted to a node. (how's that for a run on sentence)

Here is what their documentation says about that explicitly. It appears just before the other section I quoted:
Creating an alias has one problem: when another system on the network wants to send a packet to the IP address 10.0.0.99 on the same subnet, it sends an ARP broadcast to determine which computer has that IP address. The machine with that IP address is supposed to answer back with its IP address and corresponding MAC (hardware) address. But if all the nodes in the cluster have the same IP address, they are all going to answer this broadcast ARP message. So we have to tell all of the systems except for the primary ATM not to reply to those ARP requests. We want all traffic destined for the cluster to go through the primary ATM first.

Part of the solution to this is to create the alias on the loopback interface instead of the Ethernet interface. The loopback interface is a network interface that has no hardware or physical network associated with it. So instead of creating the alias on eth0:1, you would add the alias to the loopback interface (lo) using the following command:

# ifconfig lo:1 10.0.0.99 netmask 255.255.255.255 up

So in the setup I have, we have an ATM which gets all incoming requests for the web site. And then we have 7 other machines that get the requests passed onto them by the ATM. So only the ATM can ARP for the ip address of the web site. The 7 other servers cannot. So for the 2.2.18 kernel, I have the ipaddress aliased to the lo interface with the hidden sysctrl option set to 1 and everything works. When I try and bring one of the nodes up on the 2.4.0 kernel, I cannot keep it from ARPing so it fights with the ATM for all of the traffic and that causes problems.

I hope that this makes more sense.

Any ideas on how I can turn off the arping? I guess the thing that I am most curious about is how it ending up being removed from the kernel in the first place. It must have been a decision that someone made. Either, we don't need that any more since we can do it this way, or we'll take it out since nobody uses it.

Pete

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected]
Please read the FAQ at http://www.tux.org/lkml/

I explained it in my last mail how to do it using arpfilter. I do not claim that it is an elegant solution.

It's probably not worse a hack than hidden is in the first place though.

It was only submitted to 2.2 a few months ago (=years after 2.3 branched), but never added to 2.4.

-Andi
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected]
Please read the FAQ at http://www.tux.org/lkml/

I either missed that or did not understand it. I am now rereading your message....

Is that what you were referring to when you said
only try to use policy routing hacks (not tested). e.g. tag all outgoing packets with a specific fwmark that redirects them to a specific routing table which does the real routing, and put no routes into the normal one used by arpfilter so that it doesnt' reply.

I am not familiar with policy routing. Could you point me to some docs I could read or maybe even give a trivial example to start me on the right path?

Well that at least makes sense as to why it's not in there.

Thank you for all of your help.

Pete

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected]
Please read the FAQ at http://www.tux.org/lkml/