Subject: Re: dhcpd(8) _cannot_ be completely disabled on an interface
To: John Nemeth <jnemeth@victoria.tc.ca>
From: Andrew Brown <atatat@atatdot.net>
List: tech-security
Date: 01/09/2002 22:34:24
>} netbsd, as i understand it, doesn't do proxy arp without the help of a
>} small daemon, somewhat like rarpd.
>
>     Yes it does.  What do you think "arp -s ... ..." would do?  This
>is the same mechanism that the "proxyarp" option of pppd would use.

it sets an ethernet <-> ip address mapping in the kernel's routing
table.  and i can't add a mapping for an ip address that's not on my
local network using arp(8).

this# netstat -rnfinet
Routing tables

 Internet:
 Destination        Gateway            Flags     Refs     Use    Mtu  Interface
 default            206.223.36.132     UGS         6    41657      -  ep0
 127                127.0.0.1          UGRS        0        0  33220  lo0
 127.0.0.1          127.0.0.1          UH          1      100  33220  lo0
 206.223.36.128/25  link#31            UC          1        0      -  ep0
 206.223.36.132     00:50:04:68:c6:10  UHLc        2      406      -  ep0
 this# arp -s 1.2.3.4 00:50:04:68:c6:11
 cannot intuit interface index and type for 1.2.3.4
 this# 

perhaps one can do such a thing using a "raw" routing socket, but i
wouldn't expect it.

having never used the proxyarp functionality of pppd, i can't comment
on it.

>BTW, rarpd does it opposite, i.e. it converts mac addresses to IP
>addresses and is used for booting diskless client as well as assigning
>addresses to certain networking devices such as printers.  However,
>there is an "arpd" in pkgsrc which presumably gives more flexibility
>then "arp -s" does.

sure, rarpd is inverse arp...i knew that.  what i was trying to say is
that a proxy arp daemon would operate in much the same fashion as
rarpd.  it would have to open a bpf (or one per "interesting"
interface), listen for arp requests that it could answer, and answer
via the bpf.

-- 
|-----< "CODE WARRIOR" >-----|
codewarrior@daemon.org             * "ah!  i see you have the internet
twofsonet@graffiti.com (Andrew Brown)                that goes *ping*!"
andrew@crossbar.com       * "information is power -- share the wealth."