Re: [PATCH net v4] net: Fix Hole-196 vulnerability by dropping unicast ARP/IP in L2 BMC

[Star Chang <starchang@google.com>]

Hi Julian,

Thank you! Your point is spot-on: in a shared-key Wi-Fi network, an attacker
can simply broadcast a forged GARP reply (sip == tip == gateway_ip) to poison
the gateway MAC for all peers. Giving GARP an exemption indeed leaves a door open.

We verified the Android / mobile use case and confirmed that completely
disallowing neighbor learning from L2 BMC is safe:
- Gateway validation: Android relies on NUD (Neighbor Unreachability Detection)
  unicast probes and unicast replies (PACKET_HOST), never on broadcast replies.
- Wi-Fi Roaming: Roaming clients *send* GARP to notify the AP/switch; they do
  not need to receive broadcast GARP.
- Router failover: NUD naturally detects stale neighbor state and re-probes
  via unicast, recovering within seconds.

For v6, following your guidance:
1. L2 BMC ARP Replies:
   Drop all of them unconditionally (including GARP) with
   SKB_DROP_REASON_UNICAST_IN_L2_MULTICAST.
2. L2 BMC ARP Requests:
   Process and send replies as usual, but suppress updating/creating neighbor
   cache entries.

Does this match your vision for v6? If so, I will prepare the patch accordingly.

Best regards,
Star Chang