[Bug 259879] enabling PF blocks multicast/igmp sendto

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=259879

            Bug ID: 259879
           Summary: enabling PF blocks multicast/igmp sendto
           Product: Base System
           Version: 12.2-RELEASE
          Hardware: amd64
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: johan@stromnet.se

While trying to get multicast routing to work on my FreeBSD 12.2-based router.
I tried with mrouted, then igmpproxy, them pimd.. The latter two actually shows
errors, mrouted did not. In any case, I never got the machine to send out any
IGMP join packets, nor pick up any IGMP join's from local nodes.
On another machine, where I ran basic socat test (see below), the machine did
never produce any IGMP Join packets. Trying the same on a linux machine worked
fine.

At least one other person have had these issues with pimd, but probably not
related to pimd: https://github.com/troglobit/pimd/issues/171


After doing tests on clean VMs, I've nailed it down to PF. Having pf just
enabled, even with blank rules, seems to block outbound multicast/igmp somehow.

Reproducable:

1. Launch blank VM with FreeBSD 12.2 or 13.0 qcow image in KVM:
2. Prepare:

  pkg install pimd truss 
  kldload ip_mroute

3. Launch pimd, working with no errors:

root@freebsd:~ #  pimd -f
^C 

4. Enable pf (blank, no rules):


root@freebsd:~ # pfctl -e
root@freebsd:~ # 

5. Now trying to use pimd, gives failures to send:

root@freebsd:~ # pimd -f
pimd: 12:30:03.170 Sendto to 224.0.0.1 on 172.28.6.15: Permission denied


6. Disable pf again and it works fine again...
7. truss output (from socket creation to sendto failure) with pf enabled (but
no rules at all):

socket(PF_INET,SOCK_RAW,IPPROTO_IGMP)            = 4 (0x4)                      
setsockopt(4,IPPROTO_IP,IP_HDRINCL,0x7fffffffe6dc,4) = 0 (0x0)                  
setsockopt(4,SOL_SOCKET,SO_SNDBUF,0x7fffffffe6bc,4) = 0 (0x0)                   
setsockopt(4,SOL_SOCKET,SO_RCVBUF,0x7fffffffe6bc,4) = 0 (0x0)                   
setsockopt(4,IPPROTO_IP,IP_MULTICAST_TTL,0x7fffffffe6df,1) = 0 (0x0)            
setsockopt(4,IPPROTO_IP,IP_MULTICAST_LOOP,0x7fffffffe6d7,1) = 0 (0x0)           
socket(PF_INET,SOCK_RAW,IPPROTO_PIM)             = 5 (0x5)                      
setsockopt(5,IPPROTO_IP,IP_HDRINCL,0x7fffffffe6dc,4) = 0 (0x0)                  
setsockopt(5,SOL_SOCKET,SO_SNDBUF,0x7fffffffe6bc,4) = 0 (0x0)                   
setsockopt(5,SOL_SOCKET,SO_RCVBUF,0x7fffffffe6bc,4) = 0 (0x0)                   
setsockopt(5,IPPROTO_IP,IP_MULTICAST_TTL,0x7fffffffe6df,1) = 0 (0x0)            
setsockopt(5,IPPROTO_IP,IP_MULTICAST_LOOP,0x7fffffffe6d7,1) = 0 (0x0)           
mmap(0x0,135168,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 34366939136
(0x8006de000)
mmap(0x0,135168,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 34367074304
(0x8006ff000)
socket(PF_ROUTE,SOCK_RAW,0)                      = 6 (0x6)                      
fcntl(6,F_SETFL,O_RDONLY|O_NONBLOCK)             = 0 (0x0)                      
socket(PF_INET,SOCK_DGRAM,0)                     = 7 (0x7)                      
ioctl(7,SIOCGIFCONF,0x7fffffffe690)              = 0 (0x0)                      
ioctl(7,SIOCGIFFLAGS,0x7fffffffe6a0)             = 0 (0x0)                      
ioctl(7,SIOCGIFNETMASK,0x7fffffffe6a0)           = 0 (0x0)                      
ioctl(7,SIOCGIFMTU,0x7fffffffe6a0)               = 0 (0x0)                      
ioctl(7,SIOCGIFFLAGS,0x7fffffffe6a0)             = 0 (0x0)                      
open("/usr/local/etc//pimd.conf",O_RDONLY,0666)  = 8 (0x8)                      
fstat(8,{ mode=-rw-r--r-- ,inode=321234,size=6435,blksize=32768 }) = 0 (0x0)    
mmap(0x0,36864,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 34367209472
(0x800720000)                                                                   
read(8,"# Exmaple configuration file for"...,32768) = 6435 (0x1923)             
read(8,0x8007204c0,32768)                        = 0 (0x0)                      
close(8)                                         = 0 (0x0)                      
setsockopt(4,IPPROTO_IP,100,0x7fffffffe6dc,4)    = 0 (0x0)                      
setsockopt(4,IPPROTO_IP,107,0x7fffffffe6dc,4)    = 0 (0x0)                      
getrandom("\M-2\f\M-M\M-@\M-7\^\ \M-jU\v"...,40,0) = 40 (0x28)                  
mmap(0x0,1104,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 34367246336
(0x800729000)                            
minherit(0x800729000,1104,INHERIT_ZERO)          = 0 (0x0)                      
setsockopt(4,IPPROTO_IP,102,0x7fffffffe698,16)   = 0 (0x0)                      
setsockopt(5,IPPROTO_IP,IP_ADD_MEMBERSHIP,0x7fffffffe698,8) = 0 (0x0)           
setsockopt(4,IPPROTO_IP,IP_ADD_MEMBERSHIP,0x7fffffffe698,8) = 0 (0x0)           
setsockopt(4,IPPROTO_IP,IP_ADD_MEMBERSHIP,0x7fffffffe698,8) = 0 (0x0)           
setsockopt(4,IPPROTO_IP,IP_MULTICAST_IF,0x7fffffffe5c8,4) = 0 (0x0)             
setsockopt(4,IPPROTO_IP,IP_MULTICAST_LOOP,0x7fffffffe5c7,1) = 0 (0x0)           
sendto(4,"F\M-@\0$\0\0\0\0\M^?\^B\0\0\M-,"...,36,0,{ AF_INET 224.0.0.1:0 },16)
ERR#13 'Permission denied'                                                      




Another test case, with socat:
1. Disable pf on FreeBSD machine (172.28.6.15)
2. Start tcpdump on another machine in same network.
3. Start socat on freebsd machine:

   socat -d -d -u UDP4-RECV:5568,ip-add-membership=239.255.0.100:172.28.6.15
/dev/null

4. Check tcpdump output on another machine, you can see the IGMP Joins

   13:40:29.226382 IP 172.28.6.15 > 224.0.0.22: igmp v3 report, 1 group
record(s)

5. Enable pf (blank rules), run socat again. No IGMP traffic whatsoever seen on
remote machine.

-- 
You are receiving this mail because:
You are the assignee for the bug.