nft icmpv6 mld-listener-query rule not honored?

nft icmpv6 mld-listener-query rule not honored?

[stoffl4ever]

Hallo,

I am trying to get a basic nftables set up working but i cannot figure
out why  the packets get rejected despite the afaik correct rule to all
this traffic. The overall result is that IPv6 connectivity is lost
because the router seams not to be able to route any IPv6 Traffic to the
host if Type=130 aka. mld-listener-query packets are rejected. May be
someone could help me and correct me where i am wrong or point me to
some documentation that would explain my misconceptions.

SysInfo:
kernel: 3.17.4.201411220955-1-grsec (all nf* modules loaded)
nft: nftables v0.3
Network setup via systemd-networkd: br0(bridge) is attached to
eth0(physical nic)

nft rule set:

table inet filter {
        chain input {
                 type filter hook input priority 0;
                 ip protocol icmp icmp type { echo-request} accept
                 ip6 nexthdr ipv6-icmp icmpv6 type { packet-too-big,
mld-listener-query, nd-router-advert, mld-listener-report,
nd-neighbor-advert, nd-neighbor-solicit, echo-reply,
mld-listener-reduction, echo-request, destination-unreachable} accept
                 log prefix "REJECTED - " counter packets 211 bytes
11718 reject
        }

        chain forward {
                 type filter hook forward priority 0;
        }

        chain output {
                 type filter hook output priority 0;
        }
}


From Log: (interesting message is the second one)

kernel: REJECTED - IN=br0 OUT= PHYSIN=eth0
MAC=01:00:5e:00:00:01:fe:54:00:02:14:8a:08:00 SRC=0.0.0.0 DST=224.0.0.1
LEN=32 TOS=0x00 PREC=0xC0 TTL=1 ID=0 DF PROTO=2
Nov 25 13:49:57
kernel: REJECTED - IN=br0 OUT= PHYSIN=eth0
MAC=33:33:00:00:00:01:fe:54:00:02:14:8a:86:dd
SRC=fe80:0000:0000:0000:8497:04ff:fee4:07e0
DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=72 TC=0 HOPLIMIT=1
FLOWLBL=0 PROTO=ICMPv6 TYPE=130 CODE=0

Thank you with best regards,
chris

Re: nft icmpv6 mld-listener-query rule not honored?

[Pablo Neira Ayuso]

On Tue, Nov 25, 2014 at 02:27:15PM +0100, stoffl4ever wrote:
> Hallo,
> 
> I am trying to get a basic nftables set up working but i cannot figure
> out why  the packets get rejected despite the afaik correct rule to all
> this traffic. The overall result is that IPv6 connectivity is lost
> because the router seams not to be able to route any IPv6 Traffic to the
> host if Type=130 aka. mld-listener-query packets are rejected. May be
> someone could help me and correct me where i am wrong or point me to
> some documentation that would explain my misconceptions.
> 
> SysInfo:
> kernel: 3.17.4.201411220955-1-grsec (all nf* modules loaded)
> nft: nftables v0.3
> Network setup via systemd-networkd: br0(bridge) is attached to
> eth0(physical nic)
> 
> nft rule set:
> 
> table inet filter {
>         chain input {
>                  type filter hook input priority 0;
>                  ip protocol icmp icmp type { echo-request} accept
>                  ip6 nexthdr ipv6-icmp icmpv6 type { packet-too-big,
> mld-listener-query, nd-router-advert, mld-listener-report,
> nd-neighbor-advert, nd-neighbor-solicit, echo-reply,
> mld-listener-reduction, echo-request, destination-unreachable} accept
>                  log prefix "REJECTED - " counter packets 211 bytes 11718 reject
>         }
> 
>         chain forward {
>                  type filter hook forward priority 0;
>         }
> 
>         chain output {
>                  type filter hook output priority 0;
>         }
> }
> 
> 
> From Log: (interesting message is the second one)
> 
> kernel: REJECTED - IN=br0 OUT= PHYSIN=eth0
> MAC=01:00:5e:00:00:01:fe:54:00:02:14:8a:08:00 SRC=0.0.0.0 DST=224.0.0.1
> LEN=32 TOS=0x00 PREC=0xC0 TTL=1 ID=0 DF PROTO=2
> Nov 25 13:49:57
> kernel: REJECTED - IN=br0 OUT= PHYSIN=eth0
> MAC=33:33:00:00:00:01:fe:54:00:02:14:8a:86:dd
> SRC=fe80:0000:0000:0000:8497:04ff:fee4:07e0
> DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=72 TC=0 HOPLIMIT=1
> FLOWLBL=0 PROTO=ICMPv6 TYPE=130 CODE=0

You need these two patches:

http://git.kernel.org/cgit/linux/kernel/git/pablo/nf-next.git/commit/?id=68b0faa87d167ec87ba2a26be62241ad94eb449b
http://git.kernel.org/cgit/linux/kernel/git/pablo/nf-next.git/commit/?id=1b63d4b9b54cee6002757a8d20b537aa4037ae8f

They apply to Linux kernel 3.18-rc.

The second patch sets the transport layer offset to get layer 4
protocol matching from the bridge. Please, I'd appreciate if you can
give them a test and report, those two are scheduled for 3.19.

BTW, I noticed that you're using the 'inet' family. I guess you're
using bridge netfilter. I think you should use the 'bridge' family
instead, it comes with native working reject support since the
upcoming 3.18.

One of the goals of nftables is to supersede br_netfilter.

Re: nft icmpv6 mld-listener-query rule not honored?

[stoffl4ever]

On 01.12.2014 13:59, Pablo Neira Ayuso wrote:
> On Tue, Nov 25, 2014 at 02:27:15PM +0100, stoffl4ever wrote:
>> SysInfo:
>> kernel: 3.17.4.201411220955-1-grsec (all nf* modules loaded)
>> nft: nftables v0.3
>> Network setup via systemd-networkd: br0(bridge) is attached to
>> eth0(physical nic)
>>
> You need these two patches:
>
> http://git.kernel.org/cgit/linux/kernel/git/pablo/nf-next.git/commit/?id=68b0faa87d167ec87ba2a26be62241ad94eb449b
> http://git.kernel.org/cgit/linux/kernel/git/pablo/nf-next.git/commit/?id=1b63d4b9b54cee6002757a8d20b537aa4037ae8f
>
> They apply to Linux kernel 3.18-rc.
>
> The second patch sets the transport layer offset to get layer 4
> protocol matching from the bridge. Please, I'd appreciate if you can
> give them a test and report, those two are scheduled for 3.19.
Thank you, I am hoping to try it out asap, but I have to setup another
System because the current system is a semi-production machine that I
don't have any other access then ssh, and no grsec patch set is
available for 3.18-rc.
> BTW, I noticed that you're using the 'inet' family. I guess you're
> using bridge netfilter. I think you should use the 'bridge' family
> instead, it comes with native working reject support since the
> upcoming 3.18.
Okay I'll try that when i have 3.18 on my box.
> One of the goals of nftables is to supersede br_netfilter.
>
I am not using br_netfilter, see lsmod output:

sudo lsmod | grep nf :

nf_log_ipv6             6470  2
nf_log_ipv4             5541  2
nf_log_common           4338  2 nf_log_ipv4,nf_log_ipv6
nft_log                 3411  2
nf_conntrack_ipv6      12173  4
nf_defrag_ipv6         27646  1 nf_conntrack_ipv6
nf_conntrack_ipv4      12554  4
nf_defrag_ipv4          2435  1 nf_conntrack_ipv4
nft_ct                  4498  4
nf_conntrack           86560  3 nft_ct,nf_conntrack_ipv4,nf_conntrack_ipv6
nft_counter             2467  8
nft_meta                4405  29
nft_hash                4219  4
nft_rbtree              3759  0
nf_tables_bridge        2558  0
nf_tables_arp           2546  0
nf_tables_inet          2491  4
nf_tables_ipv6          2878  1 nf_tables_inet
nf_tables_ipv4          2878  1 nf_tables_inet
nf_tables              52221  135
nf_tables_inet,nf_tables_ipv4,nf_tables_ipv6,nft_log,nft_ct,nf_tables_bridge,nft_hash,nft_meta,nft_rbtree,nf_tables_arp,nft_counter
nfnetlink               7016  1 nf_tables

sudo lsmod | grep br :

nf_tables_bridge        2558  0
nf_tables              52221  135
nf_tables_inet,nf_tables_ipv4,nf_tables_ipv6,nft_log,nft_ct,nf_tables_bridge,nft_hash,nft_meta,nft_rbtree,nf_tables_arp,nft_counter
bridge                118306  0
stp                     2653  1 bridge
llc                     5081  2 stp,bridge

Re: nft icmpv6 mld-listener-query rule not honored?

[Pablo Neira Ayuso]

On Mon, Dec 01, 2014 at 04:53:20PM +0100, stoffl4ever wrote:
> On 01.12.2014 13:59, Pablo Neira Ayuso wrote:
> > On Tue, Nov 25, 2014 at 02:27:15PM +0100, stoffl4ever wrote:
> >> SysInfo:
> >> kernel: 3.17.4.201411220955-1-grsec (all nf* modules loaded)
> >> nft: nftables v0.3
> >> Network setup via systemd-networkd: br0(bridge) is attached to
> >> eth0(physical nic)
> >>
> > You need these two patches:
> >
> > http://git.kernel.org/cgit/linux/kernel/git/pablo/nf-next.git/commit/?id=68b0faa87d167ec87ba2a26be62241ad94eb449b
> > http://git.kernel.org/cgit/linux/kernel/git/pablo/nf-next.git/commit/?id=1b63d4b9b54cee6002757a8d20b537aa4037ae8f
> >
> > They apply to Linux kernel 3.18-rc.
> >
> > The second patch sets the transport layer offset to get layer 4
> > protocol matching from the bridge. Please, I'd appreciate if you can
> > give them a test and report, those two are scheduled for 3.19.
>
> Thank you, I am hoping to try it out asap, but I have to setup another
> System because the current system is a semi-production machine that I
> don't have any other access then ssh, and no grsec patch set is
> available for 3.18-rc.

OK.

> > BTW, I noticed that you're using the 'inet' family. I guess you're
> > using bridge netfilter. I think you should use the 'bridge' family
> > instead, it comes with native working reject support since the
> > upcoming 3.18.
>
> Okay I'll try that when i have 3.18 on my box.
>
> > One of the goals of nftables is to supersede br_netfilter.
> >
> I am not using br_netfilter, see lsmod output:

If you're using 3.17, you have it built-in in the bridge module by
default.

br_netfilter as module is available since 3.18-rc.