TTL=0 multicast packets leaving host

TTL=0 multicast packets leaving host

[Shawn Bohrer]

We've got some machines where we've noticed that in some cases TTL=0
multicast traffic was leaving the host.  It appear that ip_mc_output()
does the correct check with:

                ...
                /* Multicasts with ttl 0 must not go beyond the host */

                if (ip_hdr(skb)->ttl == 0) {
                        kfree_skb(skb);
                        return 0;
                }
                ...

The problem is that in __mkroute_output() it checks if the local
computer is a member of the multicast group, and if not clears
RTCF_LOCAL

                ...
                if (!ip_check_mc_rcu(in_dev, fl4->daddr, fl4->saddr,
                                     fl4->flowi4_proto))
                        flags &= ~RTCF_LOCAL;
                ...

And if RTCF_LOCAL is _not_ set then ip_output() is used instead of
ip_mc_output()

        ...
        if (flags & (RTCF_BROADCAST | RTCF_MULTICAST)) {
                rth->rt_spec_dst = fl4->saddr;
                if (flags & RTCF_LOCAL &&
                    !(dev_out->flags & IFF_LOOPBACK)) {
                        rth->dst.output = ip_mc_output;
                        RT_CACHE_STAT_INC(out_slow_mc);
                }
        ...

This looks like a bug to me.  I'd assume that if the local computer
has not joined the multicast group and I send a TTL=0 packet that it
would simply get discarded.

--
Shawn



---------------------------------------------------------------
This email, along with any attachments, is confidential. If you 
believe you received this message in error, please contact the 
sender immediately and delete all copies of the message.  
Thank you.

Re: TTL=0 multicast packets leaving host

[David Miller]

From: Shawn Bohrer <sbohrer@rgmadvisors.com>
Date: Wed, 7 Dec 2011 15:31:58 -0600

> This looks like a bug to me.  I'd assume that if the local computer
> has not joined the multicast group and I send a TTL=0 packet that it
> would simply get discarded.

This behavior is intentional, several multicast applications set TTL
to zero and expect it to reach the local network.

See the comment elsewhere in route.c:

			/* Special hack: user can direct multicasts
			   and limited broadcast via necessary interface
			   without fiddling with IP_MULTICAST_IF or IP_PKTINFO.
			   This hack is not just for fun, it allows
			   vic,vat and friends to work.
			   They bind socket to loopback, set ttl to zero
			   and expect that it will work.
			   From the viewpoint of routing cache they are broken,
			   because we are not allowed to build multicast path
			   with loopback source addr (look, routing cache
			   cannot know, that ttl is zero, so that packet
			   will not leave this host and route is valid).
			   Luckily, this hack is good workaround.
			 */