netdev - Broken IPv6 multicast binding

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 17 Jun 2014 14:12:09 +1000
From:	James Ward <j.ward@...r.usyd.edu.au>
To:	"David S. Miller" <davem@...emloft.net>,
	Alexey Kuznetsov <kuznet@....inr.ac.ru>,
	James Morris <jmorris@...ei.org>,
	Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>,
	Patrick McHardy <kaber@...sh.net>, netdev@...r.kernel.org
Subject: Broken IPv6 multicast binding

My colleagues and I have uncovered what we believe is a bug around 
multicast IPv6 introduced to the kernel recently.

When more than one socket is bound to different multicast group 
addresses on the same interface and port, only the last bound socket 
will receive packets sent to it.

I have bisected the kernel and identified that commit efe4208f47f907  - 
https://github.com/torvalds/linux/commit/efe4208f47f907
was the one that introduced this behaviour. Prior commits behave as 
expected.

Attached are two demonstrations of the behaviour.

C:
Run "mcreceive6 ff15::1 14678 0"
Run "mcreceive6 ff15::2 14678 0"
Run "mcsend6 ff15::1 14678"
Run "mcsend6 ff15::2 14678"

Expected: all messages typed into both mcsend6 instances will be echoed 
to corresponding mcreceive6 instances.
Actual: only messages sent to ff15::2 are echoed. Messages sent to 
ff15::1 are not echoed.
Killing mcreceive6 on ff15::2 will mean messages on ff15::1 are received 
again.

Python:
Run "test_multicast.py"
Test involving subscription to multiple groups fails.

James

-- 
James Ward
Australian Centre for Field Robotics
The Rose Street Building J04
The University of Sydney, NSW 2006, Australia

View attachment "mcreceive6.c" of type "text/x-csrc" (3903 bytes)

View attachment "mcsend6.c" of type "text/x-csrc" (3197 bytes)

View attachment "test_multicast.py" of type "text/x-python" (2086 bytes)