Tue, Feb 06, 2007 at 06:34:59PM +0100, Antoine Jacoutot wrote:
Sure, why not. But let's wait for more feedbacks and see if people are
interested in this change first.
Anyway, thanks for the idea.

At the moment I use a quick'n'dirty script for setting up a large table
of ARP entries at my dorm's gateway to prevent ARP spoofing to some
extent. I would surely like to see the arp.conf idea implemented in
BSD :)
- Martin

[demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

antoine, this looks pretty reasonable to me.
?
-Bob

antoine, this looks pretty reasonable to me.
?
i like it

Antoine Jacoutot wrote:
Hi.

I'm not sure if people are still using arp(8) a lot, but I've been using
this on several boxes for a while (except for the man page changes I
just wrote).

Juts like mixerctl.conf(5) and wsconsctl.conf(5) and their respective
commands if /etc/arp.conf exists, rc will use arp(8) to add entries on
system startup.

Cheers!

I don't see a benefit from this.

If you need static arp entries, you can add the corresponding arp
command to /etc/rc.local.

( the more than 150 openbsd systems we operate, not a single one uses
static arp entries, so for me this is creeping featurism ;)

Index: rc

RCS file: /cvs/src/etc/rc,v
retrieving revision 1.298
diff -u -r1.298 rc
rc 2 Feb 2007 14:51:19 -0000 1.298
rc 6 Feb 2007 16:17:02 -0000
@@ -251,6 +251,10 @@
fi
. /etc/netstart

+if [ -s /etc/arp.conf ]; then
+ echo 'setting static ARP entries'; arp -Ff /etc/arp.conf
>/dev/null 2>&1
+fi
+
if [ X"${pf}" != X"N" ]; then
if [ -f ${pf_rules} ]; then
pfctl -f ${pf_rules}
Index: arp.8

RCS file: /cvs/src/usr.sbin/arp/arp.8,v
retrieving revision 1.17
diff -u -r1.17 arp.8
arp.8 26 May 2006 09:00:57 -0000 1.17
arp.8 4 Feb 2007 17:00:38 -0000
@@ -123,6 +123,12 @@
even though the host address is not its own.
This behavior has traditionally been called
.Em proxy ARP .
+.Pp
+If the file
+.Em /etc/arp.conf
+exists, it will be processed by
+.Xr rc 8
+as input file on system startup.
.It Fl n
Show network addresses as numbers (normally
.Nm
@@ -175,6 +181,7 @@
.Sh SEE ALS
.Xr inet 3 ,
.Xr arp 4 ,
+.Xr arp.conf 5 ,
.Xr ifconfig 8
.Sh HISTRY
The
/dev/null Sun Feb 4 18:09:37 2007
/ Sun Feb 4 17:51:20 2007
@@ -0,0 +1,46 @@
+.\" $BSD$
+.\"
+.\" Copyright (c) 2007 Antoine Jacoutot <ajacoutot (AT) openbsd (DOT) org>
+.\"
+.\" Permission to use, copy, modify, and distribute this software for any
+.\" purpose with or without fee is hereby granted, provided that the above
+.\" copyright notice and this permission notice appear in all copies.
+.\"
+.\" THE SFTWARE IS PRVIDED "AS IS" AND THE AUTHR DISCLAIMS ALL
WARRANTIES
+.\" WITH REGARD T THIS SFTWARE INCLUDING ALL IMPLIED WARRANTIES F
+.\" MERCHANTABILITY AND FITNESS. IN N EVENT SHALL THE AUTHR BE LIABLE
FR
+.\" ANY SPECIAL, DIRECT, INDIRECT, R CNSEQUENTIAL DAMAGES R ANY DAMAGES
+.\" WHATSEVER RESULTING FRM LSS F USE, DATA R PRFITS, WHETHER IN AN
+.\" ACTIN F CNTRACT, NEGLIGENCE R THER TRTIUS ACTIN, ARISING
UT F
+.\" R IN CNNECTIN WITH THE USE R PERFRMANCE F THIS SFTWARE.
+.\"
+.Dd February 04, 2007
+.Dt ARP.CNF 5
+
+.Sh NAME
+.Nm arp.conf
+.Nd static arp entries processed at system startup
+.Sh DESCRIPTIN
+.Nm
+contains a list of static
+.Xr arp 8
+entries to be set in the ARP tables at system startup by
+.Xr rc 8 .
+.Pp
+As described in
+.Xr arp 8 ,
+entries in this file should be of the form:
+.Bd -filled -offset indent
+.Ar hostname ether_addr
+ Cm temp | permanent
+ Cm pub
+.Ed
+.Pp
+.Sh FILES
+.Bl -tag -width /etc/arp.conf -compact
+.It Pa /etc/arp.conf
+.El
+.Ed
+.Sh SEE ALS
+.Xr arp 8 ,
+.Xr rc 8

Antoine Jacoutot wrote:
+if [ -s /etc/arp.conf ]; then
+echo 'setting static ARP entries';arp -Ff /etc/arp.conf
/dev/null 2>&1
+fi

I'd like to suggest a construction like this:

set -- $(stripcom /etc/arp.conf)
if [ $# -gt 0 ]; then
echo 'setting static ARP entries'
arp -Ff /etc/arp.conf >/dev/null 2>&1
fi

If the file only contains comments and blank lines nothing is
done.

# Han

* Marc Balmer <marc (AT) msys (DOT) ch[2007-02-06 15:31]:

( the more than 150 openbsd systems we operate, not a single one uses
static arp entries, so for me this is creeping featurism ;)

because you don't have places where you may be concerned
about traffic hijacking through a switch. I do have servers that
do this, and usually to staticly arp their default gateway and the
important stuff they talk to.
-Bob

I don't see your criticism as relevant at all.
# Han

Henning Brauer wrote:
* Marc Balmer <marc (AT) msys (DOT) ch[2007-02-06 23:27]:
>Antoine Jacoutot wrote:
Hi.

I'm not sure if people are still using arp(8) a lot, but I've been using
this on several boxes for a while (except for the man page changes I
just wrote).

Juts like mixerctl.conf(5) and wsconsctl.conf(5) and their respective
commands if /etc/arp.conf exists, rc will use arp(8) to add entries on
system startup.

Cheers!
>I don't see a benefit from this.
>>
>If you need static arp entries, you can add the corresponding arp
>command to /etc/rc.local.
>>
>( the more than 150 openbsd systems we operate, not a single one uses
>static arp entries, so for me this is creeping featurism ;)

yeah sure, and your usage case is the only one that matters, right.

together with mac-locked switch ports, static arp entries on routers
are powerful. both are somewhat common in service provider networks, and
fortunately becoming more popular.

I am not certain we need arp.conf, but your argument is pure bull****.

oh boy my argument was _not_ about my boxes, but that
a static arp table can be loaded with a single command in rc.local and
that does the job perfectly with a single line added to a single file.

on the, dunno the number really, 100+ systems we operare, none has a
mixerctl.conf or a wsconsctl.comf, so both are useless, right?

Antoine Jacoutot wrote:
Tue, 6 Feb 2007, Marc Balmer wrote:
>I don't see a benefit from this.

Really?
Do you see a ! benefit?

>If you need static arp entries, you can add the corresponding arp
>command to /etc/rc.local.

Yes!

>( the more than 150 openbsd systems we operate, not a single one uses
>static arp entries, so for me this is creeping featurism ;)

, should I be impressed?
, yes, sorry, 150 BSD systems man allright, you must be God
speaking
Actually you now what, if out of the "150 openbsd systems you operate,
not a single one uses static arp entries", then this diff diff does
_not_ concern you!

don't be an asshole, antoine. that was a remark only. My point was
that a single command does the job as well and _not_ that it is not
needed just because I don't use it at the moment.

Antoine Jacoutot wrote:
Anyway, I've been called stupid for proposing this, so obviously it was
a bad idea and there's no point in discussing it anymore.

Really? I thought almost everyone agreed it was a good idea?
At least that's the impression I got from the responses.

Lars Hansson

Antoine Jacoutot wrote:
>Anyway, I've been called stupid for proposing this, so obviously it was
>a bad idea and there's no point in discussing it anymore.
>
Really? I thought almost everyone agreed it was a good idea?
At least that's the impression I got from the responses.

Lars Hansson

Hey, you have my vote FR implementing arp.conf . I have been doing this
by modyfying rc.local and calling a script to do so.
Mr Antoine, do not loose your spirit, it just happens that people go too
far in their opinions. But there are other users who might listen to.

Thanks for raising this topic.
Chris Pfaff

Anyway, I've been called stupid for proposing this, so obviously it was
a bad idea and there's no point in discussing it anymore.

Antoine get some balls. some of us do not think you're stupid
for proposing it and think it's a good idea. Particularly since it puts
the issue front and center that is something that people should often
times be considering, and they don't.
-Bob