netdev - Re: How to make stack send broadcast ARP request when entry is STALE?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 6 Nov 2014 06:48:15 -0500
From:	Sowmini Varadhan <sowmini05@...il.com>
To:	Ulf samuelsson <netdev@...gii.com>
Cc:	Netdev <netdev@...r.kernel.org>
Subject: Re: How to make stack send broadcast ARP request when entry is STALE?

On Wed, Nov 5, 2014 at 1:48 AM, Ulf samuelsson <netdev@...gii.com> wrote:
> Have a problem with an HP router at a certain location, which
> is configured to only answer to broadcast ARP requests.
> That cannot be changed.
>
> The first ARP request the kernel sends out, is a broadcast request,
> which is fine, but after the reply, the kernel sends unicast requests,
> which will not get any replies.

I'm afraid that's a problem with your HP router. There is nothing
in RFC 826 that says that the ARP request MUST be broadcast,
and many OS'es  will follow the IPv6 ND model of sending
unicast ARP requests to re-verify cached arp information.
Looks like the "kernel" you refer to above is following this
state machine, which is a good and healthy thing- you dont
want to be needlessly broadcasting arp reverification requests.

thus even if you have access to the kernel source code (as with linux)
it's not recommended to broadcast the ARP reverification.

> The ARP entry will after some time enter STALE state,
> and if nothing is done it will time out, and be removed.
 :

> I think the recommended behaviour in IPv6 is to send out 3 unicasts
> and if all fails, to send out broadcasts.

Be careful about the distinction between IPv4 ARP and IPv6 ND.
The base state-machine for IPv6 is explicitly specified in RFC 4861 (with
ongoing work to optimize some of this in various ietf working groups)

The territory is less clearly defined for ARP. The base protocol comes from
RFC 726, which does not address DAD  at all- that only comes from rfc 5227.
Some OS-es (solaris, microsoft?) implelement the same state-machine
for both IPv4 and IPv6, while also support 5227.

>
> Anyone know any good literature on how the ARP + neigh state machine works
> in the kernel.
>
> I read in Herberts book about the Linux TCP/IP stack and it only discuss how to reply to
> ARP requests and not anything on how to generate ARP requests.

Hope that helps.

--Sowmini
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html