[PATCH conntrack-tools 1/2] conntrackd: restrict multicast reception

[PATCH conntrack-tools 1/2] conntrackd: restrict multicast reception

[Pablo Neira Ayuso]

- For IPv4, bind multicast socket to the address specified by
  IPv4_interface to restrict the interface.

- For IPv6, bind the multicast socket to the IPv6 multicast address.
  Although interface_index6 already restricts the interface, binding to
  inaddr_any still allows for IPv4 sync messages to be received.

Without this patch, multicast sync messages can be received from any
address if your firewall policy does not restrict the interface used for
sending and receiving them.

Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1819
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/mcast.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/src/mcast.c b/src/mcast.c
index 4107d5d94891..88300da32673 100644
--- a/src/mcast.c
+++ b/src/mcast.c
@@ -49,23 +49,24 @@ struct mcast_sock *mcast_server_create(struct mcast_conf *conf)
 	switch(conf->ipproto) {
 	case AF_INET:
 		mreq.ipv4.imr_multiaddr.s_addr = conf->in.inet_addr.s_addr;
-		mreq.ipv4.imr_interface.s_addr =conf->ifa.interface_addr.s_addr;
+		mreq.ipv4.imr_interface.s_addr = conf->ifa.interface_addr.s_addr;
 
 	        m->addr.ipv4.sin_family = AF_INET;
 	        m->addr.ipv4.sin_port = htons(conf->port);
-	        m->addr.ipv4.sin_addr.s_addr = htonl(INADDR_ANY);
+	        m->addr.ipv4.sin_addr.s_addr = conf->ifa.interface_addr.s_addr;
 
-		m->sockaddr_len = sizeof(struct sockaddr_in); 
+		m->sockaddr_len = sizeof(struct sockaddr_in);
 		break;
 
 	case AF_INET6:
 		memcpy(&mreq.ipv6.ipv6mr_multiaddr, &conf->in.inet_addr6,
-		       sizeof(uint32_t) * 4);
+		       sizeof(struct in6_addr));
 		mreq.ipv6.ipv6mr_interface = conf->ifa.interface_index6;
 
 		m->addr.ipv6.sin6_family = AF_INET6;
 		m->addr.ipv6.sin6_port = htons(conf->port);
-		m->addr.ipv6.sin6_addr = in6addr_any;
+		memcpy(&m->addr.ipv6.sin6_addr, &conf->in.inet_addr6,
+		       sizeof(struct in6_addr));
 
 		m->sockaddr_len = sizeof(struct sockaddr_in6);
 		break;
-- 
2.30.2

[PATCH conntrack-tools 2/2] conntrackd: remove double close() in multicast resulting in EBADFD

[Pablo Neira Ayuso]

When using multicast for synchronization, misconfiguration results in
misleading EBADFD log errors due to double close() on the file
descriptor from the error path.

The caller of __mcast_client_create_{ipv4,ipv6} already deals with
closing the socket file descriptor.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/mcast.c | 24 ++++++++----------------
 1 file changed, 8 insertions(+), 16 deletions(-)

diff --git a/src/mcast.c b/src/mcast.c
index 88300da32673..9d441e6f0b28 100644
--- a/src/mcast.c
+++ b/src/mcast.c
@@ -135,7 +135,7 @@ void mcast_server_destroy(struct mcast_sock *m)
 	free(m);
 }
 
-static int 
+static int
 __mcast_client_create_ipv4(struct mcast_sock *m, struct mcast_conf *conf)
 {
 	int no = 0;
@@ -143,25 +143,21 @@ __mcast_client_create_ipv4(struct mcast_sock *m, struct mcast_conf *conf)
 	m->addr.ipv4.sin_family = AF_INET;
 	m->addr.ipv4.sin_port = htons(conf->port);
 	m->addr.ipv4.sin_addr = conf->in.inet_addr;
-	m->sockaddr_len = sizeof(struct sockaddr_in); 
+	m->sockaddr_len = sizeof(struct sockaddr_in);
 
 	if (setsockopt(m->fd, IPPROTO_IP, IP_MULTICAST_LOOP, &no,
-		       sizeof(int)) < 0) {
-		close(m->fd);
+		       sizeof(int)) < 0)
 		return -1;
-	}
 
 	if (setsockopt(m->fd, IPPROTO_IP, IP_MULTICAST_IF,
 		       &conf->ifa.interface_addr,
-		       sizeof(struct in_addr)) == -1) {
-		close(m->fd);
+		       sizeof(struct in_addr)) == -1)
 		return -1;
-	}
 
 	return 0;
 }
 
-static int 
+static int
 __mcast_client_create_ipv6(struct mcast_sock *m, struct mcast_conf *conf)
 {
 	int no = 0;
@@ -171,20 +167,16 @@ __mcast_client_create_ipv6(struct mcast_sock *m, struct mcast_conf *conf)
 	memcpy(&m->addr.ipv6.sin6_addr,
 	       &conf->in.inet_addr6,
 	       sizeof(struct in6_addr));
-	m->sockaddr_len = sizeof(struct sockaddr_in6); 
+	m->sockaddr_len = sizeof(struct sockaddr_in6);
 
 	if (setsockopt(m->fd, IPPROTO_IPV6, IPV6_MULTICAST_LOOP, &no,
-		       sizeof(int)) < 0) {
-		close(m->fd);
+		       sizeof(int)) < 0)
 		return -1;
-	}
 
 	if (setsockopt(m->fd, IPPROTO_IPV6, IPV6_MULTICAST_IF,
 		       &conf->ifa.interface_index6,
-		       sizeof(unsigned int)) == -1) {
-		close(m->fd);
+		       sizeof(unsigned int)) == -1)
 		return -1;
-	}
 
 	return 0;
 }
-- 
2.30.2

Re: [PATCH conntrack-tools 1/2] conntrackd: restrict multicast reception

[Pablo Neira Ayuso]

On Mon, Nov 10, 2025 at 11:35:30AM +0100, Pablo Neira Ayuso wrote:
> - For IPv4, bind multicast socket to the address specified by
>   IPv4_interface to restrict the interface.
> 
> - For IPv6, bind the multicast socket to the IPv6 multicast address.
>   Although interface_index6 already restricts the interface, binding to
>   inaddr_any still allows for IPv4 sync messages to be received.
> 
> Without this patch, multicast sync messages can be received from any
> address if your firewall policy does not restrict the interface used for
> sending and receiving them.

This patch breaks communication between nodes, scratch that.