On Fri, Sep 22, 2000 at 01:25:54AM -0700, David S. Miller wrote:
> You've made the foo-address to ascii string routines non-reentrant.
> The hbuffer[] was on the local stack for a very good reason.
You are right, fixed.
http://marc.merlins.org/linux/arppatch/arp-patch-2.4_v1.3
(that part of the patch is a year old, and I honestly don't remember why
hbuffer became a static, as it is obviously wrong)
> Why can't you write a userspace daemon that listens on one of the
> lower level raw'ish sockets for arp packets and do the same checks
> there.
You can.
> I don't like this change at all, I think it can be done completely
> in user space. The existence of a working tcpdump is proof of this
> fact. :-) Whether it can be done efficiently is another issue.
That was my original point.
http://marc.merlins.org/linux/arppatch/
----------------------------------------------------------------------------
But then why not write the whole thing in user space?
Well, the line has to be drawn somewhere... The whole IP stack could be in
user space if we wanted... In this case, the actual added code (I'm not
talking about the existing code which I turned into a function) is about 20
lines, it's trivial and it uses much less resources on a slow machine (386)
than a user space solution which forces a context switches, system calls,
and memory for that user process.
Also, not that others are always right, but do you know any OS that does
duplicate IP checking by inspecting ARP requests in user space?
----------------------------------------------------------------------------
> Making it possible to do this efficiently would be the kernel change
> which might result from your work on a userspace variant, so have at
> it.
You're saying that you'd rather have a hook to do this from user space?
I guess I didn't see the point since the kernel change is so small.
> Even failing that, I would prefer something like a special "arp
> netlink socket" which would allow a privileged userspace program
> to hear all arp traffic the machine can hear.
I guess I can see why you'd want that, but it will be more code and overhead
than the current solution (by quite a bit actually, and Andi seemed
concerned about not impacting the fast path, which this will, and in an
significant way).
Again, everyone else isn't always right, but all the other systems I know
check for dupe IP by looking at ARP packets, and do it in the kernel, since
it's a simple check.
On Fri, Sep 22, 2000 at 01:19:30PM +0200, Andi Kleen wrote:
> On Fri, Sep 22, 2000 at 01:25:54AM -0700, David S. Miller wrote:
> > I don't like this change at all, I think it can be done completely
> > in user space. The existence of a working tcpdump is proof of this
> > fact. :-) Whether it can be done efficiently is another issue.
>
> I agree. I think DAD once during IP configuration should be enough.
Come on, Andi, it's not. You do DAD, you get your IP, I plug my laptop, use
your IP, you don't even know it. My patch lets you know.
The reason I wrote it is that I've seen this happen too many times already.
On Fri, Sep 22, 2000 at 04:10:53AM -0700, David S. Miller wrote:
> That already exists in form of a packet socket bound to the ARP
> IEEE protocol. Marc is probably right though that running an arp
> daemon all the time just for that would be a bit of overkill
> though.
>
> Then it stands to reason that it's _really_ overkill to have this kind
> of stuff in the kernel too :-)
It's not the same. It's overkill do to this in userspace because you need to
be looking at the packets a second time, with context switches and all,
while in the kernel, you already have the ARP packet in hand, you just take
a quick extra peek at it.
But going back to the original point, passively checking the from addresses
of ARP packets you are already receiving is useful and induces just about no
extra load.
I can fix the patch, but if you're really against the concept, you can let
me know and I'll leave you alone :-)
Regardless though, linux is one of the few well known TCP/IP capable OSes
that doesn't say a word when its IP is being used by someone else, and this
has to be fixed some way or another. I simply believe my way is the simplest
and the lightest, but you're more than welcome to write you own and prove me
wrong :-)
Marc
--
Microsoft is to software what McDonalds is to gourmet cooking
Home page: http://marc.merlins.org/ (friendly to non IE browsers)
Finger [EMAIL PROTECTED] for PGP key and other contact information
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [EMAIL PROTECTED]
Please read the FAQ at http://www.tux.org/lkml/
