lkml.org 
[lkml]   [1999]   [Mar]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: eth-Devices and naming wishes
Hi Marc.

Before I start, please note that I'm nowhere near being an expert on
this, so don't treat my comments as authorative - they're based on my
experience with Linux, and I could easily be missing something, or
just to have set up particular sets of cards for which my comments
were true, when they're not true for other sets...

> I am building a firewall system based on Linux. My machine has
> two ne2k-pci-network cards, one of them being destined to be
> connected to the untrusted network. The drivers will be loaded
> as kernel modules.

> I am thinking about doing the following:

> - The trusted card will have its slot shield painted green; its MAC
> address will be known.

> - When the system boots, the ethernet drivers will be loaded and the
> interface that has the known MAC address of the will be marked in
> the system configuration as being connected to the trusted network.

> However, it seems that I can't control which ethx alias will be
> associated with the trusted network because both cards are PCI
> and their resource assignments are controlled by the system
> BIOS. Thus, I will have to jump through hoops to take care of
> this in every init and maintenance script which will prove a
> major pain and source of problems.

In my experience, for any particular pair of PCI NE2K cards, the BIOS
will always allocate them the same way round, so if a particular card
appears first on one occasion relative to a particular second card,
then it will always appear first relative to that particular second
card.

As a result, you should be able to deal with it on that basis...

> Does Linux (I will mostly be using 2.0.36 for my research but
> will check if my system works with 2.2.x too) have a possibility
> to define "network card aliases"?

> That way, I could do the following:

> (1) load the modules.

> (2) configure eth0 and eth1.

> (3) parse ifconfig's output and determine which interface has
> the "trusted" MAC address.

> (4) define appropriate aliases for ueth0 and teth0 (for
> untrusted and trusted ethernet, respectively).

> All scripts could use ueth0 and teth0 exclusively.

I don't believe what you're asking actually exists, but you could try
something like using the following bash script from your scripts:

===8<=== CUT ===>8===
#!/bin/bash
if [ $# -ne 1 ]; then
echo "Usage: `basename $0` mac" >&2
exit 255
fi
# Check existing valid interfaces first...
FOUND="`/sbin/ifconfig | grep ^eth | grep \"HWaddr $1\"`"
if [ -z "$FOUND" ]; then
EXISTS="`/sbin/ifconfig | grep ^eth | cut -d ' ' -f 1`"
FOUND=NO
declare -i N=0
while [ $N -lt 256 ]; do
if ! echo $EXISTS | grep eth$N > /dev/null ; then
if /sbin/ifconfig eth$N | grep "HWaddr $1" > /dev/null ; then
FOUND=eth$N
break
fi
fi
N=$N+1
done
if [ $FOUND = NO ]; then
echo "`basename $0`: ERROR 1: No interface with hardware" \
"address $1" >&2
exit 1
fi
fi
echo $FOUND | cut -d ' ' -f 1
===8<=== CUT ===>8===

Put the above script somewhere like /usr/local/bin with name hw2if and
mode 755, then you can do things like the following...

Q> ifconfig `hw2if 01:23:45:67:89:AB` down

...which should shut the interface with that hardware address down,
whatever its ethX allocation is...

> Ethernet devices don't seem to have /dev nodes (at least, if
> they are there, they are not used - the docs say so) so simply
> doing symlinks seems to be impossible.

They don't have /dev nodes since such isn't appropriate, as I
understand it.

> Is there a chance to do that elegantly or do I really have to
> generate a config file that reflects the trust relationships of
> the eth interfaces for the init scripts?

> Any hints will be appreciated.

Hopefully, the above suggestion should help you?

Best wishes from Riley.

+----------------------------------------------------------------------+
| There is something frustrating about the quality and speed of Linux |
| development, ie., the quality is too high and the speed is too high, |
| in other words, I can implement this XXXX feature, but I bet someone |
| else has already done so and is just about to release their patch. |
+----------------------------------------------------------------------+
* ftp://ftp.Amush.cx/pub/rhw/Linux
* http://www.Amush.cx/~rhw/kernel.versions.html



-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:50    [W:0.058 / U:0.032 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site