1.2.0 etharp_ip_input change

classic Classic list List threaded Threaded
5 messages Options
Reply | Threaded
Open this post in threaded view
|

1.2.0 etharp_ip_input change

Jonathan Larmour
I was wondering about the following change in 1.2.0. Isn't updating the ARP
table from incoming IP packets a good thing and normal practice? Otherwise
for something which isn't already in the ARP cache (especially a new TCP
connection, or UDP from a novel host) won't the lwip stack need to send an
ARP request for any response?

Note I haven't tried 1.2.0 yet - I wanted to review changes before jumping.
I couldn't find any discussion about this change in lwip-users/devel around
2006-05-05 (when it was made) so there may well be prior discussed
motivation I just haven't seen.

Jifl

Index: src/netif/ethernetif.c
===================================================================
RCS file: /sources/lwip/lwip/src/netif/ethernetif.c,v
retrieving revision 1.22
retrieving revision 1.24
diff -u -5 -p -r1.22 -r1.24
--- src/netif/ethernetif.c      17 Oct 2004 18:13:18 -0000      1.22
+++ src/netif/ethernetif.c      14 Jul 2006 11:17:00 -0000      1.24
@@ -237,12 +237,16 @@ ethernetif_input(struct netif *netif)
    ethhdr = p->payload;

    switch (htons(ethhdr->type)) {
    /* IP packet? */
    case ETHTYPE_IP:
+#if 0
+/* CSi disabled ARP table update on ingress IP packets.
+   This seems to work but needs thorough testing. */
      /* update ARP table */
      etharp_ip_input(netif, p);
+#endif
      /* skip Ethernet header */
      pbuf_header(p, -sizeof(struct eth_hdr));
      /* pass to network layer */
      netif->input(p, netif);
      break;


--
eCosCentric    http://www.eCosCentric.com/    The eCos and RedBoot experts
Company legal info, address and number:   http://www.ecoscentric.com/legal
------["The best things in life aren't things."]------      Opinions==mine


_______________________________________________
lwip-users mailing list
[hidden email]
http://lists.nongnu.org/mailman/listinfo/lwip-users
Reply | Threaded
Open this post in threaded view
|

Re: 1.2.0 etharp_ip_input change

Kieran Mansley
On Tue, 2007-01-02 at 17:50 +0000, Jonathan Larmour wrote:
> I was wondering about the following change in 1.2.0. Isn't updating the ARP
> table from incoming IP packets a good thing and normal practice? Otherwise
> for something which isn't already in the ARP cache (especially a new TCP
> connection, or UDP from a novel host) won't the lwip stack need to send an
> ARP request for any response?

There is a moderate spoofing problem with that approach, as you
essentially take it as given that the person who sent you the packet
isn't lying about their MAC address.  By always checking it (by sending
a broadcast ARP request) you give yourself at least a little protection
from such things.  Whether the efficiency of avoiding the ARP outweighs
the paranoia of always checking is perhaps up to the local network
manager, and we should perhaps consider it as a compile time option.

Kieran



_______________________________________________
lwip-users mailing list
[hidden email]
http://lists.nongnu.org/mailman/listinfo/lwip-users
Reply | Threaded
Open this post in threaded view
|

Re: 1.2.0 etharp_ip_input change

Jonathan Larmour
Kieran Mansley wrote:

> On Tue, 2007-01-02 at 17:50 +0000, Jonathan Larmour wrote:
>> I was wondering about the following change in 1.2.0. Isn't updating the ARP
>> table from incoming IP packets a good thing and normal practice? Otherwise
>> for something which isn't already in the ARP cache (especially a new TCP
>> connection, or UDP from a novel host) won't the lwip stack need to send an
>> ARP request for any response?
>
> There is a moderate spoofing problem with that approach, as you
> essentially take it as given that the person who sent you the packet
> isn't lying about their MAC address.  By always checking it (by sending
> a broadcast ARP request) you give yourself at least a little protection
> from such things.

Very little indeed, unfortunately, unless it was by accident, not
intentionally.

> Whether the efficiency of avoiding the ARP outweighs
> the paranoia of always checking is perhaps up to the local network
> manager, and we should perhaps consider it as a compile time option.

I'll submit a patch for this then.

Jifl
--
--["No sense being pessimistic, it wouldn't work anyway"]-- Opinions==mine


_______________________________________________
lwip-users mailing list
[hidden email]
http://lists.nongnu.org/mailman/listinfo/lwip-users
Reply | Threaded
Open this post in threaded view
|

RE : 1.2.0 etharp_ip_input change

Frédéric BERNON
In reply to this post by Jonathan Larmour
Hi Jonathan,

It seems there is a problem to download your patch from   <http://savannah.nongnu.org/patch/?5657>

Can you please send me the diff file please?
 
====================================
Frédéric BERNON
HYMATOM SA
Chef de projet informatique
Microsoft Certified Professional
Tél. : +33 (0)4-67-87-61-10
Fax. : +33 (0)4-67-70-85-44
Email : [hidden email]
Web Site : http://www.hymatom.fr 
====================================
P Avant d'imprimer, penser à l'environnement
 


-----Message d'origine-----
De : lwip-users-bounces+frederic.bernon=[hidden email] [mailto:lwip-users-bounces+frederic.bernon=[hidden email]] De la part de Jonathan Larmour
Envoyé : mercredi 3 janvier 2007 16:49
À : Mailing list for lwIP users
Objet : Re: [lwip-users] 1.2.0 etharp_ip_input change


Kieran Mansley wrote:

> On Tue, 2007-01-02 at 17:50 +0000, Jonathan Larmour wrote:
>> I was wondering about the following change in 1.2.0. Isn't updating
>> the ARP
>> table from incoming IP packets a good thing and normal practice? Otherwise
>> for something which isn't already in the ARP cache (especially a new TCP
>> connection, or UDP from a novel host) won't the lwip stack need to send an
>> ARP request for any response?
>
> There is a moderate spoofing problem with that approach, as you
> essentially take it as given that the person who sent you the packet
> isn't lying about their MAC address.  By always checking it (by
> sending a broadcast ARP request) you give yourself at least a little
> protection from such things.
Very little indeed, unfortunately, unless it was by accident, not
intentionally.

> Whether the efficiency of avoiding the ARP outweighs
> the paranoia of always checking is perhaps up to the local network
> manager, and we should perhaps consider it as a compile time option.

I'll submit a patch for this then.

Jifl
--
--["No sense being pessimistic, it wouldn't work anyway"]-- Opinions==mine


_______________________________________________
lwip-users mailing list
[hidden email] http://lists.nongnu.org/mailman/listinfo/lwip-users

_______________________________________________
lwip-users mailing list
[hidden email]
http://lists.nongnu.org/mailman/listinfo/lwip-users

=?iso-8859-1?Q?Fr=E9d=E9ric_BERNON=2Evcf?= (810 bytes) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: RE : 1.2.0 etharp_ip_input change

Jonathan Larmour
Frédéric BERNON wrote:
> Hi Jonathan,
>
> It seems there is a problem to download your patch from   <http://savannah.nongnu.org/patch/?5657>
>
> Can you please send me the diff file please?

Thanks. I thought when I submitted it that it took a long time - must have
been a glitch. I've added the patch again, and it's fine now, so you can go
back to that link.

Jifl
--
eCosCentric    http://www.eCosCentric.com/    The eCos and RedBoot experts
Company legal info, address and number:   http://www.ecoscentric.com/legal
------["The best things in life aren't things."]------      Opinions==mine


_______________________________________________
lwip-users mailing list
[hidden email]
http://lists.nongnu.org/mailman/listinfo/lwip-users