diff -ruN linux-2.4.2.orig/Documentation/filesystems/proc.txt linux-2.4.2/Documentation/filesystems/proc.txt --- linux-2.4.2.orig/Documentation/filesystems/proc.txt Mon Nov 27 17:47:38 2000 +++ linux-2.4.2/Documentation/filesystems/proc.txt Thu Feb 22 10:00:13 2001 @@ -1578,6 +1578,16 @@ Determines whether to send ICMP redirects to other hosts. +hidden +------ + +Hide addresses attached to this device from another devices. +Such addresses will never be selected by source address autoselection +mechanism, host does not answer broadcast ARP requests for them, +does not announce it as source address of ARP requests, but they +are still reachable via IP. This flag is activated only if it is +enabled both in specific device section and in "all" section. + Routing settings ---------------- diff -ruN linux-2.4.2.orig/Documentation/networking/ip-sysctl.txt linux-2.4.2/Documentation/networking/ip-sysctl.txt --- linux-2.4.2.orig/Documentation/networking/ip-sysctl.txt Thu Nov 9 15:57:53 2000 +++ linux-2.4.2/Documentation/networking/ip-sysctl.txt Thu Feb 22 10:00:13 2001 @@ -370,6 +370,14 @@ Default value is 0. Note that some distributions enable it in startip scripts. +hidden - BOOLEAN + Hide addresses attached to this device from another devices. + Such addresses will never be selected by source address autoselection + mechanism, host does not answer broadcast ARP requests for them, + does not announce it as source address of ARP requests, but they + are still reachable via IP. This flag is activated only if it is + enabled both in specific device section and in "all" section. + Alexey Kuznetsov. kuznet@xxxxxxxxxxxxx diff -ruN linux-2.4.2.orig/include/linux/inetdevice.h linux-2.4.2/include/linux/inetdevice.h --- linux-2.4.2.orig/include/linux/inetdevice.h Mon Aug 23 10:01:02 1999 +++ linux-2.4.2/include/linux/inetdevice.h Thu Feb 22 10:00:13 2001 @@ -17,6 +17,7 @@ int forwarding; int mc_forwarding; int tag; + int hidden; void *sysctl; }; @@ -43,6 +44,7 @@ #define IN_DEV_LOG_MARTIANS(in_dev) (ipv4_devconf.log_martians || (in_dev)->cnf.log_martians) #define IN_DEV_PROXY_ARP(in_dev) (ipv4_devconf.proxy_arp || (in_dev)->cnf.proxy_arp) +#define IN_DEV_HIDDEN(in_dev) ((in_dev)->cnf.hidden && ipv4_devconf.hidden) #define IN_DEV_SHARED_MEDIA(in_dev) (ipv4_devconf.shared_media || (in_dev)->cnf.shared_media) #define IN_DEV_TX_REDIRECTS(in_dev) (ipv4_devconf.send_redirects || (in_dev)->cnf.send_redirects) #define IN_DEV_SEC_REDIRECTS(in_dev) (ipv4_devconf.secure_redirects || (in_dev)->cnf.secure_redirects) diff -ruN linux-2.4.2.orig/include/linux/sysctl.h linux-2.4.2/include/linux/sysctl.h --- linux-2.4.2.orig/include/linux/sysctl.h Thu Feb 22 09:20:47 2001 +++ linux-2.4.2/include/linux/sysctl.h Thu Feb 22 10:00:13 2001 @@ -322,7 +322,8 @@ NET_IPV4_CONF_ACCEPT_SOURCE_ROUTE=9, NET_IPV4_CONF_BOOTP_RELAY=10, NET_IPV4_CONF_LOG_MARTIANS=11, - NET_IPV4_CONF_TAG=12 + NET_IPV4_CONF_TAG=12, + NET_IPV4_CONF_HIDDEN=13, }; /* /proc/sys/net/ipv6 */ diff -ruN linux-2.4.2.orig/net/ipv4/arp.c linux-2.4.2/net/ipv4/arp.c --- linux-2.4.2.orig/net/ipv4/arp.c Fri Feb 9 11:34:13 2001 +++ linux-2.4.2/net/ipv4/arp.c Thu Feb 22 10:02:58 2001 @@ -66,6 +66,9 @@ * Alexey Kuznetsov: new arp state machine; * now it is in net/core/neighbour.c. * Krzysztof Halasa: Added Frame Relay ARP support. + * Julian Anastasov: "hidden" flag: hide the + * interface and don't reply for it + * */ #include @@ -315,12 +318,23 @@ static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb) { u32 saddr; + int from_skb; + struct in_device *in_dev2 = NULL; + struct net_device *dev2 = NULL; u8 *dst_ha = NULL; struct net_device *dev = neigh->dev; u32 target = *(u32*)neigh->primary_key; int probes = atomic_read(&neigh->probes); - if (skb && inet_addr_type(skb->nh.iph->saddr) == RTN_LOCAL) + from_skb = (skb && + (dev2 = ip_dev_find(skb->nh.iph->saddr)) != NULL && + (in_dev2 = in_dev_get(dev2)) != NULL && + !IN_DEV_HIDDEN(in_dev2)); + if (dev2) { + if (in_dev2) in_dev_put(in_dev2); + dev_put(dev2); + } + if (from_skb) saddr = skb->nh.iph->saddr; else saddr = inet_select_addr(dev, target, RT_SCOPE_LINK); @@ -717,9 +731,22 @@ /* Special case: IPv4 duplicate address detection packet (RFC2131) */ if (sip == 0) { - if (arp->ar_op == __constant_htons(ARPOP_REQUEST) && - inet_addr_type(tip) == RTN_LOCAL) + int reply; + struct net_device *dev2 = NULL; + struct in_device *in_dev2 = NULL; + + reply = + (arp->ar_op == __constant_htons(ARPOP_REQUEST) && + (dev2 = ip_dev_find(tip)) != NULL && + (dev2 == dev || + ((in_dev2 = in_dev_get(dev2)) != NULL && + !IN_DEV_HIDDEN(in_dev2)))); + if (dev2) { + if (in_dev2) in_dev_put(in_dev2); + dev_put(dev2); + if (reply) arp_send(ARPOP_REPLY,ETH_P_ARP,tip,dev,tip,sha,dev->dev_addr,dev->dev_addr); + } goto out; } @@ -732,6 +759,26 @@ if (addr_type == RTN_LOCAL) { n = neigh_event_ns(&arp_tbl, sha, &sip, dev); if (n) { + if (ipv4_devconf.hidden && + skb->pkt_type != PACKET_HOST) { + int skip; + struct net_device *dev2 = NULL; + struct in_device *in_dev2 = NULL; + + skip = + ((dev2 = ip_dev_find(tip)) != NULL && + dev2 != dev && + (in_dev2=in_dev_get(dev2)) != NULL && + IN_DEV_HIDDEN(in_dev2)); + if (dev2) { + if (in_dev2) in_dev_put(in_dev2); + dev_put(dev2); + if (skip) { + neigh_release(n); + goto out; + } + } + } arp_send(ARPOP_REPLY,ETH_P_ARP,sip,dev,tip,sha,dev->dev_addr,sha); neigh_release(n); } diff -ruN linux-2.4.2.orig/net/ipv4/devinet.c linux-2.4.2/net/ipv4/devinet.c --- linux-2.4.2.orig/net/ipv4/devinet.c Fri Feb 9 11:34:13 2001 +++ linux-2.4.2/net/ipv4/devinet.c Thu Feb 22 10:00:13 2001 @@ -736,7 +736,8 @@ read_lock(&in_dev->lock); for_primary_ifa(in_dev) { - if (ifa->ifa_scope != RT_SCOPE_LINK && + if (!IN_DEV_HIDDEN(in_dev) && + ifa->ifa_scope != RT_SCOPE_LINK && ifa->ifa_scope <= scope) { read_unlock(&in_dev->lock); read_unlock(&inetdev_lock); @@ -1018,7 +1019,7 @@ static struct devinet_sysctl_table { struct ctl_table_header *sysctl_header; - ctl_table devinet_vars[13]; + ctl_table devinet_vars[14]; ctl_table devinet_dev[2]; ctl_table devinet_conf_dir[2]; ctl_table devinet_proto_dir[2]; @@ -1060,6 +1061,9 @@ &proc_dointvec}, {NET_IPV4_CONF_TAG, "tag", &ipv4_devconf.tag, sizeof(int), 0644, NULL, + &proc_dointvec}, + {NET_IPV4_CONF_HIDDEN, "hidden", + &ipv4_devconf.hidden, sizeof(int), 0644, NULL, &proc_dointvec}, {0}},