netdev - Re: ebtables on a stick

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 29 Nov 2011 11:23:38 +0100
From:	David Lamparter <equinox@...c24.net>
To:	Greg Scott <GregScott@...rasupport.com>
Cc:	David Lamparter <equinox@...c24.net>, netdev@...r.kernel.org
Subject: Re: ebtables on a stick

On Tue, Nov 29, 2011 at 04:05:18AM -0600, Greg Scott wrote:
> > We already had this discussion in July.
> >
> > "ip neigh add proxy" is independent of /proc/.../proxy_arp.
> 
> We did discuss this back in July but never finished.  I posted a bunch
> of questions about "ip neigh add proxy" because I haven't seen much in
> the way of documentation.  When nobody answered, I left it alone for a
> while.  
> 
> I found a discussion starting here:
> http://lkml.indiana.edu/hypermail/linux/kernel/0110.2/0523.html
> 
> where some of the kernel folks are suggesting "ip neigh add proxy" is
> deprecated.  By now that discussion is 10 years old and it apparently is
> still around.  But for how long?

While the feature is still around after 10 years, Alexey isn't touching
the network stack much anymore. Funny, that.

> Appendix B of this 2007 document, http://linux-ip.net/html/index.html,
> by Martin Brown also says "ip neigh add proxy" is deprecated.
>
> So now, in addition to my paranoia about proxy ARP in general, I have
> this fear I will build a bunch of scripting around "ip neigh add proxy"
> only to find it's gone in a future kernel, leaving me in a world of hurt
> again.
>
> So humor me and convince me that "ip neigh add" is not on the chopping
> block so I can try it with a little bit of confidence.

I'll humor myself instead. I'm shipping this as a feature to customers,
so if it comes up for chopping I'll have to maintain it myself
worst-case.

(I wasn't actually aware that this is supposed to be deprecated. Yes,
it's buggy in that you need "arp" to show the entries, but that's exacly
that - a low-severity bug.)


-David
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html