6 files changed, 114 insertions, 10 deletions

diff --git a/RELNOTES b/RELNOTES
index 6c4c94c6a..84e474e73 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -4,6 +4,7 @@ firejail (0.9.49) baseline; urgency=low
   * feature: per-profile support to set X11 Xephyr screen size (--xephyr-screen)
   * enhancement: /proc/sys mounting
   * enhancement: default seccomp list update
+  * enhancement: rework IP address assingment for --net options
   * new profiles: curl, mplayer2, SMPlayer, Calibre, ebook-viewer, KWrite,
   * new profiles: Geary, Liferea, peek, silentarmy, IntelliJ IDEA,
   * new profiles: Android Studio, electron, riot-web
diff --git a/etc/firejail.config b/etc/firejail.config
index 1db33edda..22ce77324 100644
--- a/etc/firejail.config
+++ b/etc/firejail.config
@@ -2,6 +2,14 @@
 # keyword-argument pairs, one per line. Most features are enabled by default.
 # Use 'yes' or 'no' as configuration values.
 
+
+# Number of ARP probes sent when assigning an IP address for --net option,
+# default 2. This is a partial implementation of RFC 5227. A 0.5 seconds
+# timeout is implemented for each probe. Increase this number to 4 if your
+# local layer 2 network uses RSTP (IEEE 802.1w). Permitted values are
+# between 1 and 30.
+# arp-probes 2
+
 # Enable or disable bind support, default enabled.
 # bind yes
 
diff --git a/src/firejail/arp.c b/src/firejail/arp.c
index 6d21167f0..ffbc56841 100644
--- a/src/firejail/arp.c
+++ b/src/firejail/arp.c
@@ -41,6 +41,79 @@ typedef struct arp_hdr_t {
 } ArpHdr;
 
 
+// gracious arp announcing our address
+void arp_announce(const char *dev, Bridge *br) {
+        // RFC 5227 - using a source and destination IP address of the interface
+        uint32_t srcaddr = br->ipsandbox;
+        uint32_t destaddr = br->ipsandbox;
+
+        if (strlen(dev) > IFNAMSIZ) {
+                fprintf(stderr, "Error: invalid network device name %s\n", dev);
+                exit(1);
+        }
+
+        if (arg_debug)
+                printf("Announce %d.%d.%d.%d ...\n", PRINT_IP(destaddr));
+
+        // find interface address
+        int sock;
+        if ((sock = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0)
+                errExit("socket");
+
+        srcaddr = htonl(srcaddr);
+        destaddr = htonl(destaddr);
+
+        // Find interface MAC address
+        struct ifreq ifr;
+        memset(&ifr, 0, sizeof (ifr));
+        strncpy(ifr.ifr_name, dev, IFNAMSIZ);
+        if (ioctl(sock, SIOCGIFHWADDR, &ifr) < 0)
+                errExit("ioctl");
+        close(sock);
+
+        // configure layer2 socket address information
+        struct sockaddr_ll addr;
+        memset(&addr, 0, sizeof(addr));
+        if ((addr.sll_ifindex = if_nametoindex(dev)) == 0)
+                errExit("if_nametoindex");
+        addr.sll_family = AF_PACKET;
+        memcpy (addr.sll_addr, ifr.ifr_hwaddr.sa_data, 6);
+        addr.sll_halen = htons(6);
+
+        // build the arp packet header
+        ArpHdr hdr;
+        memset(&hdr, 0, sizeof(hdr));
+        hdr.htype = htons(1);
+        hdr.ptype = htons(ETH_P_IP);
+        hdr.hlen = 6;
+        hdr.plen = 4;
+        hdr.opcode = htons(1); //ARPOP_REQUEST
+        memcpy(hdr.sender_mac, ifr.ifr_hwaddr.sa_data, 6);
+        memcpy(hdr.sender_ip, (uint8_t *)&srcaddr, 4);
+        memcpy(hdr.target_ip, (uint8_t *)&destaddr, 4);
+
+        // build ethernet frame
+        uint8_t frame[ETH_FRAME_LEN]; // includes eht header, vlan, and crc
+        memset(frame, 0, sizeof(frame));
+        frame[0] = frame[1] = frame[2] = frame[3] = frame[4] = frame[5] = 0xff;
+        memcpy(frame + 6, ifr.ifr_hwaddr.sa_data, 6);
+        frame[12] = ETH_P_ARP / 256;
+        frame[13] = ETH_P_ARP % 256;
+        memcpy (frame + 14, &hdr, sizeof(hdr));
+
+        // open layer2 socket
+        if ((sock = socket(PF_PACKET, SOCK_RAW, htons (ETH_P_ALL))) < 0)
+                errExit("socket");
+
+        int len;
+        if ((len = sendto (sock, frame, 14 + sizeof(ArpHdr), 0, (struct sockaddr *) &addr, sizeof (addr))) <= 0)
+                errExit("send");
+        fflush(0);
+        close(sock);
+}
+
+
+
 // returns 0 if the address is not in use, -1 otherwise
 int arp_check(const char *dev, uint32_t destaddr) {
         // RFC 5227 - using a source IP address of 0 for probing
@@ -92,7 +165,7 @@ int arp_check(const char *dev, uint32_t destaddr) {
         memcpy(hdr.target_ip, (uint8_t *)&destaddr, 4);
 
         // build ethernet frame
-        uint8_t frame[ETH_FRAME_LEN]; // includes eht header, vlan, and crc
+        uint8_t frame[ETH_FRAME_LEN]; // includes eth header, vlan, and crc
         memset(frame, 0, sizeof(frame));
         frame[0] = frame[1] = frame[2] = frame[3] = frame[4] = frame[5] = 0xff;
         memcpy(frame + 6, ifr.ifr_hwaddr.sa_data, 6);
@@ -109,25 +182,34 @@ int arp_check(const char *dev, uint32_t destaddr) {
                 errExit("send");
         fflush(0);
 
-        // wait not more than one second for an answer
+        // send two probes at 0.5 seconds interva;
+        int  cnt = checkcfg(CFG_ARP_PROBES);
+        uint8_t framerx[ETH_FRAME_LEN]; // includes eth header, vlan, and crc
         fd_set fds;
         FD_ZERO(&fds);
         FD_SET(sock, &fds);
         int maxfd = sock;
         struct timeval ts;
-        ts.tv_sec = 1; // 1 second wait time
-        ts.tv_usec = 0;
+        ts.tv_sec = 0; // 0.5 seconds wait time
+        ts.tv_usec = 500000;
         while (1) {
                 int nready = select(maxfd + 1,  &fds, (fd_set *) 0, (fd_set *) 0, &ts);
                 if (nready < 0)
                         errExit("select");
                 else if (nready == 0) { // timeout
-                        close(sock);
-                        return 0;
+                        if (--cnt <= 0) {
+                                close(sock);
+                                return 0;
+                        }
+                        if ((len = sendto (sock, frame, 14 + sizeof(ArpHdr), 0, (struct sockaddr *) &addr, sizeof (addr))) <= 0)
+                                errExit("send");
+                        ts.tv_sec = 0; // 0.5 seconds wait time
+                        ts.tv_usec = 500000;
+                        fflush(0);
                 }
                 else {
                         // read the incoming packet
-                        int len = recvfrom(sock, frame, ETH_FRAME_LEN, 0, NULL, NULL);
+                        int len = recvfrom(sock, framerx, ETH_FRAME_LEN, 0, NULL, NULL);
                         if (len < 0) {
                                 perror("recvfrom");
                                 close(sock);
@@ -137,9 +219,9 @@ int arp_check(const char *dev, uint32_t destaddr) {
                         // parse the incoming packet
                         if ((unsigned int) len < 14 + sizeof(ArpHdr))
                                 continue;
-                        if (frame[12] != (ETH_P_ARP / 256) || frame[13] != (ETH_P_ARP % 256))
+                        if (framerx[12] != (ETH_P_ARP / 256) || framerx[13] != (ETH_P_ARP % 256))
                                 continue;
-                        memcpy(&hdr, frame + 14, sizeof(ArpHdr));
+                        memcpy(&hdr, framerx + 14, sizeof(ArpHdr));
                         if (hdr.opcode == htons(1))
                                 continue;
                         if (hdr.opcode == htons(2)) {
diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c
index f4e28f084..9703c9a5b 100644
--- a/src/firejail/checkcfg.c
+++ b/src/firejail/checkcfg.c
@@ -49,6 +49,7 @@ int checkcfg(int val) {
                 cfg_val[CFG_FIREJAIL_PROMPT] = 0;
                 cfg_val[CFG_FOLLOW_SYMLINK_PRIVATE_BIN] = 0;
                 cfg_val[CFG_DISABLE_MNT] = 0;
+                cfg_val[CFG_ARP_PROBES] = DEFAULT_ARP_PROBES;
 
                 // open configuration file
                 const char *fname = SYSCONFDIR "/firejail.config";
@@ -267,7 +268,7 @@ int checkcfg(int val) {
                         }
 
                         // Xvfb screen size
-                        else if (strncmp(ptr, "xvfb-screen ", 12) == 0) {
+                                else if (strncmp(ptr, "xvfb-screen ", 12) == 0) {
                                 // expecting three numbers separated by x's
                                 unsigned int n1;
                                 unsigned int n2;
@@ -346,6 +347,13 @@ int checkcfg(int val) {
                                 else
                                         goto errout;
                         }
+                        // arp probes
+                        else if (strncmp(ptr, "arp-probes ", 11) == 0) {
+                                int arp_probes = atoi(ptr + 11);
+                                if (arp_probes <= 1 || arp_probes > 30)
+                                        goto errout;
+                                cfg_val[CFG_ARP_PROBES] = arp_probes;
+                        }
                         else
                                 goto errout;
 
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 5fd978f51..b90c8d8ed 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -446,6 +446,7 @@ void shut(pid_t pid);
 int restricted_shell(const char *user);
 
 // arp.c
+void arp_announce(const char *dev, Bridge *br);
 // returns 0 if the address is not in use, -1 otherwise
 int arp_check(const char *dev, uint32_t destaddr);
 // assign an IP address using arp scanning
@@ -672,6 +673,7 @@ enum {
 void sandboxfs(int op, pid_t pid, const char *path1, const char *path2);
 
 // checkcfg.c
+#define DEFAULT_ARP_PROBES 2
 enum {
         CFG_FILE_TRANSFER = 0,
         CFG_X11,
@@ -694,6 +696,7 @@ enum {
         CFG_FOLLOW_SYMLINK_PRIVATE_BIN,
         CFG_DISABLE_MNT,
         CFG_JOIN,
+        CFG_ARP_PROBES,
         CFG_MAX // this should always be the last entry
 };
 extern char *xephyr_screen;
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 8c5c02d41..47c6b7a06 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -141,6 +141,7 @@ static void sandbox_if_up(Bridge *br) {
                 if (arg_debug)
                         printf("Configuring %d.%d.%d.%d address on interface %s\n", PRINT_IP(br->ipsandbox), dev);
                 net_config_interface(dev, br->ipsandbox, br->mask, br->mtu);
+                arp_announce(dev, br);
         }
         else if (br->arg_ip_none == 0 && br->macvlan == 1) {
                 // reassign the macvlan address
@@ -163,6 +164,7 @@ static void sandbox_if_up(Bridge *br) {
                 if (arg_debug)
                         printf("Configuring %d.%d.%d.%d address on interface %s\n", PRINT_IP(br->ipsandbox), dev);
                 net_config_interface(dev, br->ipsandbox, br->mask, br->mtu);
+                arp_announce(dev, br);
         }
 
         if (br->ip6sandbox)