From: Sven Eckelmann <sven@narfation.org>
To: b.a.t.m.a.n@lists.open-mesh.org
Subject: [B.A.T.M.A.N.] [PATCH 2/2] batman-adv: Don't leak information through initialized packet fields
Date: Wed, 27 Jun 2012 22:28:18 +0200 [thread overview]
Message-ID: <1340828898-12352-2-git-send-email-sven@narfation.org> (raw)
In-Reply-To: <1340828898-12352-1-git-send-email-sven@narfation.org>
The reserved fields in batman-adv packets are not set to a constant value. The
content of these memory regions is leaked unintentionally to the network.
This regression was introduced in c7fb529996cbc47bc8243d6860dac716ae70af82
Signed-off-by: Sven Eckelmann <sven@narfation.org>
---
soft-interface.c | 1 +
translation-table.c | 1 +
vis.c | 2 ++
3 files changed, 4 insertions(+)
diff --git a/soft-interface.c b/soft-interface.c
index 6e2530b..80e667a 100644
--- a/soft-interface.c
+++ b/soft-interface.c
@@ -206,6 +206,7 @@ static int interface_tx(struct sk_buff *skb, struct net_device *soft_iface)
/* batman packet type: broadcast */
bcast_packet->header.packet_type = BAT_BCAST;
+ bcast_packet->reserved = 0;
/* hw address of first interface is the orig mac because only
* this mac is known throughout the mesh */
diff --git a/translation-table.c b/translation-table.c
index 2ab83d7..6cb4f79 100644
--- a/translation-table.c
+++ b/translation-table.c
@@ -1879,6 +1879,7 @@ static void send_roam_adv(struct bat_priv *bat_priv, uint8_t *client,
roam_adv_packet->header.packet_type = BAT_ROAM_ADV;
roam_adv_packet->header.version = COMPAT_VERSION;
roam_adv_packet->header.ttl = TTL;
+ roam_adv_packet->reserved = 0;
primary_if = primary_if_get_selected(bat_priv);
if (!primary_if)
goto out;
diff --git a/vis.c b/vis.c
index cec216f..70806af 100644
--- a/vis.c
+++ b/vis.c
@@ -620,6 +620,7 @@ static int generate_vis_packet(struct bat_priv *bat_priv)
packet->header.ttl = TTL;
packet->seqno = htonl(ntohl(packet->seqno) + 1);
packet->entries = 0;
+ packet->reserved = 0;
skb_trim(info->skb_packet, sizeof(*packet));
if (packet->vis_type == VIS_TYPE_CLIENT_UPDATE) {
@@ -913,6 +914,7 @@ int vis_init(struct bat_priv *bat_priv)
packet->header.packet_type = BAT_VIS;
packet->header.ttl = TTL;
packet->seqno = 0;
+ packet->reserved = 0;
packet->entries = 0;
INIT_LIST_HEAD(&bat_priv->vis_send_list);
--
1.7.10
next prev parent reply other threads:[~2012-06-27 20:28 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-06-27 20:28 [B.A.T.M.A.N.] [PATCH 1/2] batctl: Don't leak information through initialized packet fields Sven Eckelmann
2012-06-27 20:28 ` Sven Eckelmann [this message]
2012-06-28 9:56 ` [B.A.T.M.A.N.] [PATCHv2 1/1] batman-adv: Don't leak information through uninitialized " Sven Eckelmann
2012-06-28 9:56 ` [B.A.T.M.A.N.] [PATCHv2 2/2] batctl: " Sven Eckelmann
2012-06-30 12:25 ` Marek Lindner
2012-06-30 12:21 ` [B.A.T.M.A.N.] [PATCHv2 1/1] batman-adv: " Marek Lindner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1340828898-12352-2-git-send-email-sven@narfation.org \
--to=sven@narfation.org \
--cc=b.a.t.m.a.n@lists.open-mesh.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox