public inbox for b.a.t.m.a.n@lists.open-mesh.org
 help / color / mirror / Atom feed
From: Sven Eckelmann <sven@narfation.org>
To: b.a.t.m.a.n@lists.open-mesh.org
Subject: [B.A.T.M.A.N.] [PATCH 2/2] batman-adv: Don't leak information through initialized packet fields
Date: Wed, 27 Jun 2012 22:28:18 +0200	[thread overview]
Message-ID: <1340828898-12352-2-git-send-email-sven@narfation.org> (raw)
In-Reply-To: <1340828898-12352-1-git-send-email-sven@narfation.org>

The reserved fields in batman-adv packets are not set to a constant value. The
content of these memory regions is leaked unintentionally to the network.

This regression was introduced in c7fb529996cbc47bc8243d6860dac716ae70af82

Signed-off-by: Sven Eckelmann <sven@narfation.org>
---
 soft-interface.c    |    1 +
 translation-table.c |    1 +
 vis.c               |    2 ++
 3 files changed, 4 insertions(+)

diff --git a/soft-interface.c b/soft-interface.c
index 6e2530b..80e667a 100644
--- a/soft-interface.c
+++ b/soft-interface.c
@@ -206,6 +206,7 @@ static int interface_tx(struct sk_buff *skb, struct net_device *soft_iface)
 
 		/* batman packet type: broadcast */
 		bcast_packet->header.packet_type = BAT_BCAST;
+		bcast_packet->reserved = 0;
 
 		/* hw address of first interface is the orig mac because only
 		 * this mac is known throughout the mesh */
diff --git a/translation-table.c b/translation-table.c
index 2ab83d7..6cb4f79 100644
--- a/translation-table.c
+++ b/translation-table.c
@@ -1879,6 +1879,7 @@ static void send_roam_adv(struct bat_priv *bat_priv, uint8_t *client,
 	roam_adv_packet->header.packet_type = BAT_ROAM_ADV;
 	roam_adv_packet->header.version = COMPAT_VERSION;
 	roam_adv_packet->header.ttl = TTL;
+	roam_adv_packet->reserved = 0;
 	primary_if = primary_if_get_selected(bat_priv);
 	if (!primary_if)
 		goto out;
diff --git a/vis.c b/vis.c
index cec216f..70806af 100644
--- a/vis.c
+++ b/vis.c
@@ -620,6 +620,7 @@ static int generate_vis_packet(struct bat_priv *bat_priv)
 	packet->header.ttl = TTL;
 	packet->seqno = htonl(ntohl(packet->seqno) + 1);
 	packet->entries = 0;
+	packet->reserved = 0;
 	skb_trim(info->skb_packet, sizeof(*packet));
 
 	if (packet->vis_type == VIS_TYPE_CLIENT_UPDATE) {
@@ -913,6 +914,7 @@ int vis_init(struct bat_priv *bat_priv)
 	packet->header.packet_type = BAT_VIS;
 	packet->header.ttl = TTL;
 	packet->seqno = 0;
+	packet->reserved = 0;
 	packet->entries = 0;
 
 	INIT_LIST_HEAD(&bat_priv->vis_send_list);
-- 
1.7.10


  reply	other threads:[~2012-06-27 20:28 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2012-06-27 20:28 [B.A.T.M.A.N.] [PATCH 1/2] batctl: Don't leak information through initialized packet fields Sven Eckelmann
2012-06-27 20:28 ` Sven Eckelmann [this message]
2012-06-28  9:56 ` [B.A.T.M.A.N.] [PATCHv2 1/1] batman-adv: Don't leak information through uninitialized " Sven Eckelmann
2012-06-28  9:56   ` [B.A.T.M.A.N.] [PATCHv2 2/2] batctl: " Sven Eckelmann
2012-06-30 12:25     ` Marek Lindner
2012-06-30 12:21   ` [B.A.T.M.A.N.] [PATCHv2 1/1] batman-adv: " Marek Lindner

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1340828898-12352-2-git-send-email-sven@narfation.org \
    --to=sven@narfation.org \
    --cc=b.a.t.m.a.n@lists.open-mesh.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox