From owner-freebsd-bugs@FreeBSD.ORG Wed May 31 01:20:15 2006 Return-Path: X-Original-To: freebsd-bugs@hub.freebsd.org Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 76BFB16A64E for ; Wed, 31 May 2006 01:20:15 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 6269943D58 for ; Wed, 31 May 2006 01:20:14 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.4/8.13.4) with ESMTP id k4V1KECt097453 for ; Wed, 31 May 2006 01:20:14 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.13.4/8.13.4/Submit) id k4V1KElC097447; Wed, 31 May 2006 01:20:14 GMT (envelope-from gnats) Resent-Date: Wed, 31 May 2006 01:20:14 GMT Resent-Message-Id: <200605310120.k4V1KElC097447@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Steven Baker Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 2B1F016A618 for ; Wed, 31 May 2006 01:17:17 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [216.136.204.117]) by mx1.FreeBSD.org (Postfix) with ESMTP id DECC543D4C for ; Wed, 31 May 2006 01:17:16 +0000 (GMT) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.13.1/8.13.1) with ESMTP id k4V1HGk5070124 for ; Wed, 31 May 2006 01:17:16 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.13.1/8.13.1/Submit) id k4V1HGBK070123; Wed, 31 May 2006 01:17:16 GMT (envelope-from nobody) Message-Id: <200605310117.k4V1HGBK070123@www.freebsd.org> Date: Wed, 31 May 2006 01:17:16 GMT From: Steven Baker To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-2.3 Cc: Subject: kern/98184: ipfw add pass 224.0.0.0/4 multicast rule prevents natd forwarding for dynamic rules X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 May 2006 01:20:15 -0000 >Number: 98184 >Category: kern >Synopsis: ipfw add pass 224.0.0.0/4 multicast rule prevents natd forwarding for dynamic rules >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Wed May 31 01:20:13 GMT 2006 >Closed-Date: >Last-Modified: >Originator: Steven Baker >Release: FreeBSD 6.0 RTM kernel build with some components removed and others added >Organization: >Environment: FreeBSD firewall 6.0-RELEASE-p3 FreeBSD 6.0-RELEASE-p3 #0: Sun Jan 22 22:34:41 PST 2006 root@firewall:/usr/obj/usr/src/sys/FIREWALL601 i386 >Description: I have a subset of IPFW rules that deal questionable IP addresses. I have been using these same rules on FreeBSD firewalls since probably FreeBSD 3.1. The rules in question are as follows where: oif = the outside network interface iif = the internal network interface inet = the internal network (192.168.0.0, for example) imask = the internal network mask (255.255.255.0, for example) # Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1, # DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E) # on the outside interface ${fwcmd} add deny all from any to 0.0.0.0/8 via ${oif} ${fwcmd} add deny all from any to 169.254.0.0/16 via ${oif} ${fwcmd} add deny all from any to 192.0.2.0/24 via ${oif} # Stop Class D ${fwcmd} add deny log all from any to 224.0.0.0/4 via ${oif} # Stop Class E ${fwcmd} add deny all from any to 240.0.0.0/4 via ${oif} This same block of rules is repeated before and after the NATD rule I also have a set of rules after the NATD rule to allow DNS queries to a bunch of known DNS servers: # Allow DNS queries out to our primary DNS Servers, all from firewall ${fwcmd} add pass udp from any to ${dns1} 53 keep-state ${fwcmd} add pass udp from any to ${dns2} 53 keep-state etc ... Because of some other issues, I changed the Class D rule to allow multicast packets both before and after NATD. # Allow Class D ${fwcmd} add pass log all from any to 224.0.0.0/4 via ${oif} keep-state I also added the following rule after NATD ${fwcmd} add pass log all from ${inet}${imask} to 224.0.0.0/4 via ${iif} keep-state Once these changes were made, dns queries from the firewall machine worked but all dns queries from behind the firewall failed. TCP connections to an external IP address (http://72.5.124.61 which is www.sun.com) would still work and traverse the firewall/gateway. But the DNS queries/responses did not appear to traverse the firewall/gateway. My best guess not looking at the source code is that having an allow rule for multicast D addresses with keep-state somehow interfered with the DNS queries keep-state rules and the dynamic rules that were created. After issuing an nslookup from a client machine behind the firewall, I could see that an appropriate dynamic rule was created using "ipfw -ad show" (output not enclosed). In troubleshooting, I added a rule at the beginniing of the ruleset so that I would see all packets: ipfw add 333 count log all ip from any to any >From the firewall log (note I have replaced addresses with symbolic names) nslookup request from firewall machine that works: May 30 11:00:52 firewall kernel: ipfw: 333 Count UDP ${oip}:60915 ${dns1}:53 out via ${oif} May 30 11:00:53 firewall kernel: ipfw: 333 Count UDP ${dns1}:53 192.168.186. 1:60915 in via ${oif} nslookup from behind firewall machine that fails May 30 10:59:51 firewall kernel: ipfw: 333 Count UDP ${client1}:1066 ${dns1}:53 in via ${iif} Note that there were no multicast packets logged. Just changing the rule appears to cause this problem. >How-To-Repeat: Add the following rules on a firewall machine running FreeBSD 6.0 using natd and ipfw2 # Allow Class D ${fwcmd} add pass log all from any to 224.0.0.0/4 via ${oif} keep-state ${fwcmd} add pass log all from ${inet}${imask} to 224.0.0.0/4 via ${iif} keep-state This machine should also have some rules to allow queries to known name servers after the NATD rule and the above rules: # Allow DNS queries out to our primary DNS Servers, all from firewall ${fwcmd} add pass udp from any to ${dns1} 53 keep-state ${fwcmd} add pass udp from any to ${dns2} 53 keep-state etc ... Try a dns query from behind the firewall machine and it should fail. >Fix: >Release-Note: >Audit-Trail: >Unformatted: