linux-kernel - Re: [PATCH 4.19 01/24] bridge: do not add port to router list when receives query with source 0.0.0.0

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190221114145.GC10737@kroah.com>
Date:   Thu, 21 Feb 2019 12:41:45 +0100
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     Sebastian Gottschall <s.gottschall@...media-net.de>
Cc:     linux-kernel@...r.kernel.org, stable@...r.kernel.org,
        Ying Xu <yinxu@...hat.com>, Hangbin Liu <liuhangbin@...il.com>,
        Nikolay Aleksandrov <nikolay@...ulusnetworks.com>,
        Roopa Prabhu <roopa@...ulusnetworks.com>,
        "David S. Miller" <davem@...emloft.net>
Subject: Re: [PATCH 4.19 01/24] bridge: do not add port to router list when
 receives query with source 0.0.0.0

On Wed, Feb 20, 2019 at 01:48:47PM +0100, Sebastian Gottschall wrote:
> *reminder*
> 
> Am 18.02.2019 um 11:18 schrieb Sebastian Gottschall:
> > 
> > Am 17.02.2019 um 17:48 schrieb Greg Kroah-Hartman:
> > > On Sun, Feb 17, 2019 at 03:29:22PM +0100, Sebastian Gottschall wrote:
> > > > according to user reports this patch will cause a serious
> > > > regression. igmp
> > > > snooping is not working anymore with this patch
> > > > 
> > > > Am 02.11.2018 um 19:34 schrieb Greg Kroah-Hartman:
> > > > > 4.19-stable review patch.  If anyone has any objections,
> > > > > please let me know.
> > > > > 
> > > > > ------------------
> > > > > 
> > > > > From: Hangbin Liu <liuhangbin@...il.com>
> > > > > 
> > > > > [ Upstream commit 5a2de63fd1a59c30c02526d427bc014b98adf508 ]
> > > > > 
> > > > > Based on RFC 4541, 2.1.1.  IGMP Forwarding Rules
> > > > > 
> > > > >     The switch supporting IGMP snooping must maintain a list of
> > > > >     multicast routers and the ports on which they are attached.  This
> > > > >     list can be constructed in any combination of the following ways:
> > > > > 
> > > > >     a) This list should be built by the snooping switch sending
> > > > >        Multicast Router Solicitation messages as described in IGMP
> > > > >        Multicast Router Discovery [MRDISC].  It may also snoop
> > > > >        Multicast Router Advertisement messages sent by and to other
> > > > >        nodes.
> > > > > 
> > > > >     b) The arrival port for IGMP Queries (sent by multicast routers)
> > > > >        where the source address is not 0.0.0.0.
> > > > > 
> > > > > We should not add the port to router list when receives
> > > > > query with source
> > > > > 0.0.0.0.
> > > > > 
> > > > > Reported-by: Ying Xu <yinxu@...hat.com>
> > > > > Signed-off-by: Hangbin Liu <liuhangbin@...il.com>
> > > > > Acked-by: Nikolay Aleksandrov <nikolay@...ulusnetworks.com>
> > > > > Acked-by: Roopa Prabhu <roopa@...ulusnetworks.com>
> > > > > Signed-off-by: David S. Miller <davem@...emloft.net>
> > > > > Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
> > > > > ---
> > > > >    net/bridge/br_multicast.c |   10 +++++++++-
> > > > >    1 file changed, 9 insertions(+), 1 deletion(-)
> > > > > 
> > > > > --- a/net/bridge/br_multicast.c
> > > > > +++ b/net/bridge/br_multicast.c
> > > > > @@ -1420,7 +1420,15 @@ static void br_multicast_query_received(
> > > > >            return;
> > > > >        br_multicast_update_query_timer(br, query, max_delay);
> > > > > -    br_multicast_mark_router(br, port);
> > > > > +
> > > > > +    /* Based on RFC4541, section 2.1.1 IGMP Forwarding Rules,
> > > > > +     * the arrival port for IGMP Queries where the source address
> > > > > +     * is 0.0.0.0 should not be added to router port list.
> > > > > +     */
> > > > > +    if ((saddr->proto == htons(ETH_P_IP) && saddr->u.ip4) ||
> > > > > +        (saddr->proto == htons(ETH_P_IPV6) &&
> > > > > +         !ipv6_addr_any(&saddr->u.ip6)))
> > > > > +        br_multicast_mark_router(br, port);
> > > > >    }
> > > > >    static void br_ip4_multicast_query(struct net_bridge *br,
> > > Is this also a problem in 4.20?  This patch went into 4.20-rc1, so it
> > > has been around for a while with no reported issues that I can find.
> > > Any pointers to the reports?
> > 
> > i need to check this. i found this patch in 4.9, 4.14 and 4.4
> > the rest was picked up from the mailinglist. according to the git
> > sources of 4.20 and 5.0 the same code is in there as well
> > 
> > i just got the report from users today and was able to reproduce it with
> > iptv streams. just by disabling the code it was working again.

Reminder of what?

If this is still an issue in 4.20, and 5.0-rc, there's nothing I can do.
Please work with the networking developers to resolve the issue and get
the fix merged into Linus's tree and then I will be glad to take the fix
into the stable trees.

If this is _not_ an issue with 4.20 and 5.0-rc, I need to know that as
well.

thanks,

greg k-h