netdev - Q: disable IGMP_ALL_HOSTS from user-space?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Wed, 08 Apr 2015 21:10:50 +0200
From:	Albrecht Dreß <albrecht.dress@...or.de>
To:	netdev@...r.kernel.org
Subject: Q: disable IGMP_ALL_HOSTS from user-space?

Hi all,

a hopefully not too dumb question, and for the right list...

I noticed that Linux always adds IGMP_ALL_HOSTS (224.0.0.1) to the nic's "whitelist", even if multicasting for the interface has been disabled, i.e. started via the SIOCSIFFLAGS ioctl /without/ IFF_MULTICAST in ifr_flags.  Is it possible to disable this behaviour via software, so that the system behaves like a device according to RFC 1112 Level 0 or Level 1, dropping all received multicast packets in the nic (if supported by the hardware, of course)?

Background of the question:  I use an embedded system (currently with Linux 3.2.68) with a built-in nic (the FEC of a PowerPC MPC5200B) which supports a mac hash filter.  As group E0000001 is enabled (BE; as reported by /proc/net/igmp), the nic's MAC hash filter is programmed to accept 01-00-5e-00-00-01.  In one case, the device shall be operated in the same network as a bunch of Profinet/RT systems, producing a high level of traffic which unfortunately also matches the above mac hash.  This results in a high load on the cpu, instead of dropping those packets in the nic.  As the system has a hardware watchdog, this in turn causes the cpu being rebooted by the watchdog regularly...  Thus removing this mac hash from the nic should be a remedy.

I didn't check what happens if I configure the kernel to completely disable multicasting.  However, I would prefer to disable it from user-space, as the system /might/ be used in an environment where multicasting is actually needed, and maintaining two different kernels is not a good idea imho.

Thanks in advance for any insight,
Albrecht.
Content of type "application/pgp-signature" skipped