networkd: support `proxy_arp_pvlan` sysctl

The proxy ARP private VLAN sysctl is useful for VLAN aggregation, see
https://sysctl-explorer.net/net/ipv4/proxy_arp_pvlan/ for details.

diff --git a/NEWS b/NEWS
index b1e7779b6027c75a3fa53bacbcb52714dbceb1ce..e9783cb1f89b88d1cddf8a9843cf85d34fc933ce 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -10,6 +10,12 @@ CHANGES WITH 256 in spe:
           section, then all assigned VLAN IDs on the interface that are not
           configured in the .network file are removed.
 
+        Network Management:
+
+        * systemd-networkd's proxy support gained a new option to configure
+          a private VLAN variant of the proxy ARP supported by the kernel
+          under the name IPv4ProxyARPPrivateVLAN=.
+
 CHANGES WITH 255:
 
         Announcements of Future Feature Removals and Incompatible Changes:

diff --git a/man/systemd.network.xml b/man/systemd.network.xml
index 09aa8c4826751aa1dd1d5581f51f3db1b194df9a..ea558c4b4ef58bb8a436e6bee8269090a81cdb3e 100644 (file)
--- a/man/systemd.network.xml
+++ b/man/systemd.network.xml
@@ -928,6 +928,21 @@ Table=1234</programlisting></para>
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><varname>IPv4ProxyARPPrivateVLAN=</varname></term>
+        <listitem>
+          <para>Takes a boolean. Configures proxy ARP private VLAN for IPv4, also known as VLAN aggregation,
+          private VLAN, source-port filtering, port-isolation, or MAC-forced forwarding.</para>
+
+          <para>This variant of the ARP proxy technique will allow the ARP proxy to reply back to the same
+          interface.</para>
+
+          <para>See <ulink url="https://tools.ietf.org/html/rfc3069">RFC 3069</ulink>. When unset,
+          the kernel's default will be used.</para>
+          <xi:include href="version-info.xml" xpointer="v256"/>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term><varname>IPv6ProxyNDP=</varname></term>
         <listitem>

diff --git a/src/network/networkd-network-gperf.gperf b/src/network/networkd-network-gperf.gperf
index 24b0f24aec6b64b1a5ef489ce03792ada09a3613..c3f0e6416044a9854ba7f5744e20c089baeb3fa7 100644 (file)
--- a/src/network/networkd-network-gperf.gperf
+++ b/src/network/networkd-network-gperf.gperf
@@ -138,6 +138,7 @@ Network.IPv4RouteLocalnet,                   config_parse_tristate,
 Network.ActiveSlave,                         config_parse_bool,                                        0,                             offsetof(Network, active_slave)
 Network.PrimarySlave,                        config_parse_bool,                                        0,                             offsetof(Network, primary_slave)
 Network.IPv4ProxyARP,                        config_parse_tristate,                                    0,                             offsetof(Network, proxy_arp)
+Network.IPv4ProxyARPPrivateVLAN,             config_parse_tristate,                                    0,                             offsetof(Network, proxy_arp_pvlan)
 Network.ProxyARP,                            config_parse_tristate,                                    0,                             offsetof(Network, proxy_arp)
 Network.IPv6ProxyNDPAddress,                 config_parse_ipv6_proxy_ndp_address,                      0,                             0
 Network.IPv4ReversePathFilter,               config_parse_ip_reverse_path_filter,                      0,                             offsetof(Network, ipv4_rp_filter)

diff --git a/src/network/networkd-network.c b/src/network/networkd-network.c
index dcfdfd1b52eade6da994d3e834fea3fe85afbd6b..a2b3580ced134802f72c08c88fe4d91927e18a1a 100644 (file)
--- a/src/network/networkd-network.c
+++ b/src/network/networkd-network.c
@@ -473,6 +473,7 @@ int network_load_one(Manager *manager, OrderedHashmap **networks, const char *fi
                 .ipv6_dad_transmits = -1,
                 .ipv6_proxy_ndp = -1,
                 .proxy_arp = -1,
+                .proxy_arp_pvlan = -1,
                 .ipv4_rp_filter = _IP_REVERSE_PATH_FILTER_INVALID,
 
                 .ipv6_accept_ra = -1,

diff --git a/src/network/networkd-network.h b/src/network/networkd-network.h
index fc0065147aa9ef8f16db419ed804b942135b8330..1d7a7da798214977de3a4d6391b504334732ba62 100644 (file)
--- a/src/network/networkd-network.h
+++ b/src/network/networkd-network.h
@@ -325,6 +325,7 @@ struct Network {
         int ipv6_dad_transmits;
         uint8_t ipv6_hop_limit;
         int proxy_arp;
+        int proxy_arp_pvlan;
         uint32_t ipv6_mtu;
         IPv6PrivacyExtensions ipv6_privacy_extensions;
         IPReversePathFilter ipv4_rp_filter;

diff --git a/src/network/networkd-sysctl.c b/src/network/networkd-sysctl.c
index 2b226b2e2a1836cedd969917de85973c4832f272..9d188c022e0bde093542580b6dddcdd50479e5d3 100644 (file)
--- a/src/network/networkd-sysctl.c
+++ b/src/network/networkd-sysctl.c
@@ -58,6 +58,18 @@ static int link_set_proxy_arp(Link *link) {
         return sysctl_write_ip_property_boolean(AF_INET, link->ifname, "proxy_arp", link->network->proxy_arp > 0);
 }
 
+static int link_set_proxy_arp_pvlan(Link *link) {
+        assert(link);
+
+        if (!link_is_configured_for_family(link, AF_INET))
+                return 0;
+
+        if (link->network->proxy_arp_pvlan < 0)
+                return 0;
+
+        return sysctl_write_ip_property_boolean(AF_INET, link->ifname, "proxy_arp_pvlan", link->network->proxy_arp_pvlan > 0);
+}
+
 static bool link_ip_forward_enabled(Link *link, int family) {
         assert(link);
         assert(IN_SET(family, AF_INET, AF_INET6));
@@ -257,6 +269,10 @@ int link_set_sysctl(Link *link) {
         if (r < 0)
                log_link_warning_errno(link, r, "Cannot configure proxy ARP for interface, ignoring: %m");
 
+        r = link_set_proxy_arp_pvlan(link);
+        if (r < 0)
+                log_link_warning_errno(link, r, "Cannot configure proxy ARP private VLAN for interface, ignoring: %m");
+
         r = link_set_ipv4_forward(link);
         if (r < 0)
                 log_link_warning_errno(link, r, "Cannot turn on IPv4 packet forwarding, ignoring: %m");

diff --git a/test/fuzz/fuzz-network-parser/sysctl b/test/fuzz/fuzz-network-parser/sysctl
index 2452fb7e8563aeda742066d51a5bfff3a9ca2019..01b45a2b5db28d01775545a6208b371d246c7045 100644 (file)
--- a/test/fuzz/fuzz-network-parser/sysctl
+++ b/test/fuzz/fuzz-network-parser/sysctl
@@ -7,4 +7,5 @@ IPv6PrivacyExtensions=true
 IPv6DuplicateAddressDetection=3
 IPv6HopLimit=5
 IPv4ProxyARP=true
+IPv4ProxyARPPrivateVLAN=true
 IPv6ProxyNDP=true

diff --git a/test/fuzz/fuzz-unit-file/directives-all.service b/test/fuzz/fuzz-unit-file/directives-all.service
index d5877f930cc232e58d7e1fbff726c1090a8c1ab7..93307c0bbd1d899f52d1839dec16594f76885791 100644 (file)
--- a/test/fuzz/fuzz-unit-file/directives-all.service
+++ b/test/fuzz/fuzz-unit-file/directives-all.service
@@ -472,6 +472,7 @@ IPForward=
 IPMasquerade=
 IPv4LLRoute=
 IPv4ProxyARP=
+IPv4ProxyARPPrivateVLAN=
 IPv6AcceptRA=
 IPv6DuplicateAddressDetection=
 IPv6FlowLabel=

diff --git a/test/test-network/conf/25-sysctl.network b/test/test-network/conf/25-sysctl.network
index a71ffb2e539318d00890688a6abf63fed8c7c0e8..ff1ded4ef0f174d3e58a2f990a472e82f2f31267 100644 (file)
--- a/test/test-network/conf/25-sysctl.network
+++ b/test/test-network/conf/25-sysctl.network
@@ -7,6 +7,7 @@ IPForward=yes
 IPv6DuplicateAddressDetection=3
 IPv6HopLimit=5
 IPv4ProxyARP=yes
+IPv4ProxyARPPrivateVLAN=yes
 IPv6ProxyNDP=yes
 IPv6AcceptRA=no
 IPv4AcceptLocal=yes

diff --git a/test/test-network/systemd-networkd-tests.py b/test/test-network/systemd-networkd-tests.py
index 6af6e6dc10f1745e17ebd2c057563817cfb3dfe9..eefd7192a75198bc319fa1a2232e75187101b3cc 100755 (executable)
--- a/test/test-network/systemd-networkd-tests.py
+++ b/test/test-network/systemd-networkd-tests.py
@@ -3592,6 +3592,7 @@ class NetworkdNetworkTests(unittest.TestCase, Utilities):
         self.check_ipv6_sysctl_attr('dummy98', 'proxy_ndp', '1')
         self.check_ipv4_sysctl_attr('dummy98', 'forwarding', '1')
         self.check_ipv4_sysctl_attr('dummy98', 'proxy_arp', '1')
+        self.check_ipv4_sysctl_attr('dummy98', 'proxy_arp_pvlan', '1')
         self.check_ipv4_sysctl_attr('dummy98', 'accept_local', '1')
         self.check_ipv4_sysctl_attr('dummy98', 'rp_filter', '0')