summaryrefslogtreecommitdiff
path: root/python
diff options
context:
space:
mode:
Diffstat (limited to 'python')
-rw-r--r--python/vyos/configdict.py20
-rw-r--r--python/vyos/ifconfig.py85
-rw-r--r--python/vyos/ifconfig_vlan.py8
3 files changed, 113 insertions, 0 deletions
diff --git a/python/vyos/configdict.py b/python/vyos/configdict.py
index 7f5ae3db9..80e199907 100644
--- a/python/vyos/configdict.py
+++ b/python/vyos/configdict.py
@@ -119,6 +119,10 @@ def vlan_to_dict(conf):
'disable_link_detect': 1,
'egress_qos': '',
'egress_qos_changed': False,
+ 'ip_disable_arp_filter': 1,
+ 'ip_enable_arp_accept': 0,
+ 'ip_enable_arp_announce': 0,
+ 'ip_enable_arp_ignore': 0,
'ingress_qos': '',
'ingress_qos_changed': False,
'mac': '',
@@ -166,6 +170,22 @@ def vlan_to_dict(conf):
if conf.exists('disable'):
vlan['disable'] = True
+ # ARP filter configuration
+ if conf.exists('ip disable-arp-filter'):
+ vlan['ip_disable_arp_filter'] = 0
+
+ # ARP enable accept
+ if conf.exists('ip enable-arp-accept'):
+ vlan['ip_enable_arp_accept'] = 1
+
+ # ARP enable announce
+ if conf.exists('ip enable-arp-announce'):
+ vlan['ip_enable_arp_announce'] = 1
+
+ # ARP enable ignore
+ if conf.exists('ip enable-arp-ignore'):
+ vlan['ip_enable_arp_ignore'] = 1
+
# Media Access Control (MAC) address
if conf.exists('mac'):
vlan['mac'] = conf.return_value('mac')
diff --git a/python/vyos/ifconfig.py b/python/vyos/ifconfig.py
index 36bd8c57c..90b8fc169 100644
--- a/python/vyos/ifconfig.py
+++ b/python/vyos/ifconfig.py
@@ -261,6 +261,91 @@ class Interface:
return self._write_sysfs('/proc/sys/net/ipv4/neigh/{0}/base_reachable_time_ms'
.format(self._ifname), (int(tmo) * 1000))
+ def set_arp_filter(self, arp_filter):
+ """
+ Filter ARP requests
+
+ 1 - Allows you to have multiple network interfaces on the same
+ subnet, and have the ARPs for each interface be answered
+ based on whether or not the kernel would route a packet from
+ the ARP'd IP out that interface (therefore you must use source
+ based routing for this to work). In other words it allows control
+ of which cards (usually 1) will respond to an arp request.
+
+ 0 - (default) The kernel can respond to arp requests with addresses
+ from other interfaces. This may seem wrong but it usually makes
+ sense, because it increases the chance of successful communication.
+ IP addresses are owned by the complete host on Linux, not by
+ particular interfaces. Only for more complex setups like load-
+ balancing, does this behaviour cause problems.
+ """
+ if int(arp_filter) >= 0 and int(arp_filter) <= 1:
+ return self._write_sysfs('/proc/sys/net/ipv4/conf/{0}/arp_filter'
+ .format(self._ifname), arp_filter)
+ else:
+ raise ValueError("Value out of range")
+
+ def set_arp_accept(self, arp_accept):
+ """
+ Define behavior for gratuitous ARP frames who's IP is not
+ already present in the ARP table:
+ 0 - don't create new entries in the ARP table
+ 1 - create new entries in the ARP table
+
+ Both replies and requests type gratuitous arp will trigger the
+ ARP table to be updated, if this setting is on.
+
+ If the ARP table already contains the IP address of the
+ gratuitous arp frame, the arp table will be updated regardless
+ if this setting is on or off.
+ """
+ if int(arp_accept) >= 0 and int(arp_accept) <= 1:
+ return self._write_sysfs('/proc/sys/net/ipv4/conf/{0}/arp_accept'
+ .format(self._ifname), arp_accept)
+ else:
+ raise ValueError("Value out of range")
+
+ def set_arp_announce(self, arp_announce):
+ """
+ Define different restriction levels for announcing the local
+ source IP address from IP packets in ARP requests sent on
+ interface:
+ 0 - (default) Use any local address, configured on any interface
+ 1 - Try to avoid local addresses that are not in the target's
+ subnet for this interface. This mode is useful when target
+ hosts reachable via this interface require the source IP
+ address in ARP requests to be part of their logical network
+ configured on the receiving interface. When we generate the
+ request we will check all our subnets that include the
+ target IP and will preserve the source address if it is from
+ such subnet.
+
+ Increasing the restriction level gives more chance for
+ receiving answer from the resolved target while decreasing
+ the level announces more valid sender's information.
+ """
+ if int(arp_announce) >= 0 and int(arp_announce) <= 1:
+ return self._write_sysfs('/proc/sys/net/ipv4/conf/{0}/arp_announce'
+ .format(self._ifname), arp_announce)
+ else:
+ raise ValueError("Value out of range")
+
+ def set_arp_ignore(self, arp_ignore):
+ """
+ Define different modes for sending replies in response to received ARP
+ requests that resolve local target IP addresses:
+
+ 0 - (default): reply for any local target IP address, configured
+ on any interface
+ 1 - reply only if the target IP address is local address
+ configured on the incoming interface
+ """
+ if int(arp_ignore) >= 0 and int(arp_ignore) <= 1:
+ return self._write_sysfs('/proc/sys/net/ipv4/conf/{0}/arp_ignore'
+ .format(self._ifname), arp_ignore)
+ else:
+ raise ValueError("Value out of range")
+
def set_link_detect(self, link_filter):
"""
Configure kernel response in packets received on interfaces that are 'down'
diff --git a/python/vyos/ifconfig_vlan.py b/python/vyos/ifconfig_vlan.py
index 1299aa380..8e09db95a 100644
--- a/python/vyos/ifconfig_vlan.py
+++ b/python/vyos/ifconfig_vlan.py
@@ -55,6 +55,14 @@ def apply_vlan_config(vlan, config):
vlan.set_alias(config['description'])
# ignore link state changes
vlan.set_link_detect(config['disable_link_detect'])
+ # configure ARP filter configuration
+ vlan.set_arp_filter(config['ip_disable_arp_filter'])
+ # configure ARP accept
+ vlan.set_arp_accept(config['ip_enable_arp_accept'])
+ # configure ARP announce
+ vlan.set_arp_announce(config['ip_enable_arp_announce'])
+ # configure ARP ignore
+ vlan.set_arp_ignore(config['ip_enable_arp_ignore'])
# Maximum Transmission Unit (MTU)
vlan.set_mtu(config['mtu'])
# Change VLAN interface MAC address