Hi Sven, > Maybe this behaviour comes form some settings on the ipsec gateway > system (this is btw. a brand new Ubuntu 10.04 LTS)?
I'm running the same on my testing boxes, but use a custom kernel based on 2.6.34. > + /* Make sure this is an ARP packet... */ > + BPF_STMT (BPF_LD + BPF_H + BPF_ABS, 12), > + BPF_JUMP (BPF_JMP + BPF_JEQ + BPF_K, ETHERTYPE_ARP, 0, 3), > + arp_request_filter_code[1].jf = 0; /* skip the IP packet type check */ This actually disables the packet type check above... > + /* Make sure this is an ARP REPLY... */ > + BPF_STMT (BPF_LD + BPF_H + BPF_ABS, 20), > + BPF_JUMP (BPF_JMP + BPF_JEQ + BPF_K, ARPOP_REQUEST, 0, 1), > + arp_request_filter_code[2].k -= ETH_HLEN; ... and reduces the offset of the Opcode field. Makes sense, as Linux does not return the Ethernet header, only the ARP header. This will actually result in the same test as ours: > - BPF_STMT(BPF_LD+BPF_H+BPF_ABS, offsetof(arp_t, opcode)), > - BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ARPOP_REQUEST, 0, 3), After applying your patch, there is not much left of our packet filter. It would help if we know which statement is actually the problem. You can replace each test by a NOP using the patch below, and then re-enable one by one to find out which one is causing troubles. For a reference of BPF, have a look at: http://www.pcausa.com/support/bpfhelp.htm Best regards Martin --- a/src/libcharon/plugins/farp/farp_spoofer.c +++ b/src/libcharon/plugins/farp/farp_spoofer.c @@ -148,13 +148,13 @@ farp_spoofer_t *farp_spoofer_create(farp_listener_t *listener) private_farp_spoofer_t *this; struct sock_filter arp_request_filter_code[] = { BPF_STMT(BPF_LD+BPF_H+BPF_ABS, offsetof(arp_t, protocol_type)), - BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETH_P_IP, 0, 9), + BPF_JUMP(BPF_JMP+BPF_JA, 0, 0, 0), BPF_STMT(BPF_LD+BPF_B+BPF_ABS, offsetof(arp_t, hardware_size)), - BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 6, 0, 7), + BPF_JUMP(BPF_JMP+BPF_JA, 0, 0, 0), BPF_STMT(BPF_LD+BPF_B+BPF_ABS, offsetof(arp_t, protocol_size)), - BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 4, 0, 4), + BPF_JUMP(BPF_JMP+BPF_JA, 0, 0, 0), BPF_STMT(BPF_LD+BPF_H+BPF_ABS, offsetof(arp_t, opcode)), - BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ARPOP_REQUEST, 0, 3), + BPF_JUMP(BPF_JMP+BPF_JA, 0, 0, 0), BPF_STMT(BPF_LD+BPF_W+BPF_LEN, 0), BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 28, 0, 1), BPF_STMT(BPF_RET+BPF_A, 0), _______________________________________________ Dev mailing list [email protected] https://lists.strongswan.org/mailman/listinfo/dev
