nft icmpv6 mld-listener-query rule not honored?

Hallo,

I am trying to get a basic nftables set up working but i cannot figure out why the packets get rejected despite the afaik correct rule to all this traffic. The overall result is that IPv6 connectivity is lost because the router seams not to be able to route any IPv6 Traffic to the host if Type=130 aka. mld-listener-query packets are rejected. May be someone could help me and correct me where i am wrong or point me to some documentation that would explain my misconceptions.

SysInfo:
kernel: 3.17.4.201411220955-1-grsec (all nf* modules loaded)
nft: nftables v0.3
Network setup via systemd-networkd: br0(bridge) is attached to eth0(physical nic)

nft rule set:

table inet filter {
chain input {
type filter hook input priority 0;
ip protocol icmp icmp type { echo-request} accept ip6 nexthdr ipv6-icmp icmpv6 type { packet-too-big,
mld-listener-query, nd-router-advert, mld-listener-report, nd-neighbor-advert, nd-neighbor-solicit, echo-reply, mld-listener-reduction, echo-request, destination-unreachable} accept
log prefix "REJECTED - " counter packets 211 bytes
11718 reject

        }

        chain forward {
                 type filter hook forward priority 0;
        }

        chain output {
                 type filter hook output priority 0;
        }
}

From Log: (interesting message is the second one)

kernel: REJECTED - IN=br0 OUT= PHYSIN=eth0 MAC=01:00:5e:00:00:01:fe:54:00:02:14:8a:08:00 SRC=0.0.0.0 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0xC0 TTL=1 ID=0 DF PROTO=2
Nov 25 13:49:57
kernel: REJECTED - IN=br0 OUT= PHYSIN=eth0 MAC=33:33:00:00:00:01:fe:54:00:02:14:8a:86:dd SRC=fe80:0000:0000:0000:8497:04ff:fee4:07e0 DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=72 TC=0 HOPLIMIT=1 FLOWLBL=0 PROTO=ICMPv6 TYPE=130 CODE=0

Thank you with best regards,
chris

You need these two patches:

http://git.kernel.org/cgit/linux/kernel/git/pablo/nf-next.git/commit/?id=68b0faa87d167ec87ba2a26be62241ad94eb449b
http://git.kernel.org/cgit/linux/kernel/git/pablo/nf-next.git/commit/?id=1b63d4b9b54cee6002757a8d20b537aa4037ae8f

They apply to Linux kernel 3.18-rc.

The second patch sets the transport layer offset to get layer 4 protocol matching from the bridge. Please, I'd appreciate if you can give them a test and report, those two are scheduled for 3.19.

BTW, I noticed that you're using the 'inet' family. I guess you're using bridge netfilter. I think you should use the 'bridge' family instead, it comes with native working reject support since the upcoming 3.18.

One of the goals of nftables is to supersede br_netfilter.

Thank you, I am hoping to try it out asap, but I have to setup another System because the current system is a semi-production machine that I don't have any other access then ssh, and no grsec patch set is available for 3.18-rc.

Okay I'll try that when i have 3.18 on my box.

I am not using br_netfilter, see lsmod output:

sudo lsmod | grep nf :

nf_log_ipv6             6470  2
nf_log_ipv4             5541  2
nf_log_common           4338  2 nf_log_ipv4,nf_log_ipv6
nft_log                 3411  2
nf_conntrack_ipv6      12173  4
nf_defrag_ipv6         27646  1 nf_conntrack_ipv6
nf_conntrack_ipv4      12554  4
nf_defrag_ipv4          2435  1 nf_conntrack_ipv4
nft_ct                  4498  4
nf_conntrack           86560  3 nft_ct,nf_conntrack_ipv4,nf_conntrack_ipv6
nft_counter             2467  8
nft_meta                4405  29
nft_hash                4219  4
nft_rbtree              3759  0
nf_tables_bridge        2558  0
nf_tables_arp           2546  0
nf_tables_inet          2491  4
nf_tables_ipv6          2878  1 nf_tables_inet
nf_tables_ipv4          2878  1 nf_tables_inet
nf_tables              52221  135

nf_tables_inet,nf_tables_ipv4,nf_tables_ipv6,nft_log,nft_ct,nf_tables_bridge,nft_hash,nft_meta,nft_rbtree,nf_tables_arp,nft_counter
nfnetlink 7016 1 nf_tables

sudo lsmod | grep br :

nf_tables_bridge 2558 0
nf_tables 52221 135
nf_tables_inet,nf_tables_ipv4,nf_tables_ipv6,nft_log,nft_ct,nf_tables_bridge,nft_hash,nft_meta,nft_rbtree,nf_tables_arp,nft_counter

bridge                118306  0
stp                     2653  1 bridge
llc                     5081  2 stp,bridge

OK.

If you're using 3.17, you have it built-in in the bridge module by default.

br_netfilter as module is available since 3.18-rc.