Re: [pim] Group-Specific Queries dropped by kernel

[<[e-mail]>]

Linus,

Thanks for looking at this. Capture attached.

Mal

-----Original Message-----
From: Linus Lüssing [mailto:[e-mail]] 
Sent: 13 April 2019 11:20
To: Hubert,MT,Mal,TLV2 R
Cc: [e-mail]
Subject: Re: [pim] Group-Specific Queries dropped by kernel

Hi Hubert,

On Fri, Apr 12, 2019 at 12:34:52PM +0000, [e-mail] wrote:
> Hey
> 
>  
> 
> Hopefully someone on here can answer this basic query for me. It would appear
> that the Linux kernel by default will allow IGMPv3 "General Query" if it has a
> source IP of 0.0.0.0 but will drop any "Group-Specific Queries" if the source
> IP is 0..0.0.0. This doesn't appear to be specific to my implementation and
> seems to be the implementation in the Linux Kernel.
> 
>  
> 
> Some questions about this, if someone would be so kind as to help.
> 
>  
> 
>  
> 
> 1)    Is this by design in the rfc3367 standard and would someone point out to
> me where it is and enlighten me as to why this is the case.

I couldn't find anything like this in RFC3367. I searched for
0.0.0.0 and "zero" in this document, but these only seem to be
mentioned for the IGMPv3 report source address and the group
address for IGMP queries.

There is a "4.2.13. IP Source Addresses for Reports" but no
equivalent in 4.1 for IGMP queries.

> 2)    Is this by design in the Kernel and would enlighten me as to why this is
> the case.

Hm, for the Linux bridge IGMP snooping code at least I think we do not
have such a restriction (or I keep missing it while rereading the code). Both
an IGMPv3 "General Query" and "Group-Specific Queries" with a
0.0.0.0 source addres should be accepted here.

In the Linux IPv4 stack code I wasn't able to find such a restriction either.
igmp_rcv() or igmp_heard_query() do not seem to have such a
check? But I'm not that familiar with the IP stack code - do you
know where this check should be?


I do see a comment "Stop IGMP from 0.0.0.0 being accepted." (which
seems wrong) in the changelog here:

https://elixir.bootlin.com/linux/v5.0/source/net/ipv4/igmp.c#L47

But as it came with the big git import in 2005 I'm unable to track
with "git blame" etc. what Alan had actually changed in the code.


Could you share a tcpdump capture of the IGMP queries your
application is sending? Maybe "by coincidence" the IGMP or IP
checksums are messed up only for the Group-Specific IGMP queries
in your application or something like that?

Does Wireshark remark anything suspicious for your IGMP queries?

Regards, Linus