* [B.A.T.M.A.N.] [PATCH 1/2] batctl: Don't leak information through initialized packet fields
@ 2012-06-27 20:28 Sven Eckelmann
2012-06-27 20:28 ` [B.A.T.M.A.N.] [PATCH 2/2] batman-adv: " Sven Eckelmann
2012-06-28 9:56 ` [B.A.T.M.A.N.] [PATCHv2 1/1] batman-adv: Don't leak information through uninitialized " Sven Eckelmann
0 siblings, 2 replies; 6+ messages in thread
From: Sven Eckelmann @ 2012-06-27 20:28 UTC (permalink / raw)
To: b.a.t.m.a.n
The reserved fields in batman-adv packets are not set to a constant value. The
content of these memory regions is leaked unintentionally to the network.
This regression was introduced in ee319368e5d6385458345731e519640889c177c4
Signed-off-by: Sven Eckelmann <sven@narfation.org>
---
ping.c | 2 ++
traceroute.c | 1 +
2 files changed, 3 insertions(+)
diff --git a/ping.c b/ping.c
index 9f64a8f..ce8f457 100644
--- a/ping.c
+++ b/ping.c
@@ -174,6 +174,8 @@ int ping(char *mesh_iface, int argc, char **argv)
icmp_packet_out.rr_cur = 1;
memset(&icmp_packet_out.rr, 0, BATADV_RR_LEN * ETH_ALEN);
memset(last_rr, 0, BATADV_RR_LEN * ETH_ALEN);
+ } else {
+ ((struct batadv_icmp_packet *)&icmp_packet_out)->reserved = 0;
}
printf("PING %s (%s) %zu(%zu) bytes of data\n", dst_string, mac_string,
diff --git a/traceroute.c b/traceroute.c
index c1aaad8..75ff2b3 100644
--- a/traceroute.c
+++ b/traceroute.c
@@ -125,6 +125,7 @@ int traceroute(char *mesh_iface, int argc, char **argv)
icmp_packet_out.header.packet_type = BATADV_ICMP;
icmp_packet_out.msg_type = BATADV_ECHO_REQUEST;
icmp_packet_out.seqno = 0;
+ icmp_packet_out.reserved = 0;
printf("traceroute to %s (%s), %d hops max, %zu byte packets\n",
dst_string, mac_string, TTL_MAX, sizeof(icmp_packet_out));
--
1.7.10
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [B.A.T.M.A.N.] [PATCH 2/2] batman-adv: Don't leak information through initialized packet fields
2012-06-27 20:28 [B.A.T.M.A.N.] [PATCH 1/2] batctl: Don't leak information through initialized packet fields Sven Eckelmann
@ 2012-06-27 20:28 ` Sven Eckelmann
2012-06-28 9:56 ` [B.A.T.M.A.N.] [PATCHv2 1/1] batman-adv: Don't leak information through uninitialized " Sven Eckelmann
1 sibling, 0 replies; 6+ messages in thread
From: Sven Eckelmann @ 2012-06-27 20:28 UTC (permalink / raw)
To: b.a.t.m.a.n
The reserved fields in batman-adv packets are not set to a constant value. The
content of these memory regions is leaked unintentionally to the network.
This regression was introduced in c7fb529996cbc47bc8243d6860dac716ae70af82
Signed-off-by: Sven Eckelmann <sven@narfation.org>
---
soft-interface.c | 1 +
translation-table.c | 1 +
vis.c | 2 ++
3 files changed, 4 insertions(+)
diff --git a/soft-interface.c b/soft-interface.c
index 6e2530b..80e667a 100644
--- a/soft-interface.c
+++ b/soft-interface.c
@@ -206,6 +206,7 @@ static int interface_tx(struct sk_buff *skb, struct net_device *soft_iface)
/* batman packet type: broadcast */
bcast_packet->header.packet_type = BAT_BCAST;
+ bcast_packet->reserved = 0;
/* hw address of first interface is the orig mac because only
* this mac is known throughout the mesh */
diff --git a/translation-table.c b/translation-table.c
index 2ab83d7..6cb4f79 100644
--- a/translation-table.c
+++ b/translation-table.c
@@ -1879,6 +1879,7 @@ static void send_roam_adv(struct bat_priv *bat_priv, uint8_t *client,
roam_adv_packet->header.packet_type = BAT_ROAM_ADV;
roam_adv_packet->header.version = COMPAT_VERSION;
roam_adv_packet->header.ttl = TTL;
+ roam_adv_packet->reserved = 0;
primary_if = primary_if_get_selected(bat_priv);
if (!primary_if)
goto out;
diff --git a/vis.c b/vis.c
index cec216f..70806af 100644
--- a/vis.c
+++ b/vis.c
@@ -620,6 +620,7 @@ static int generate_vis_packet(struct bat_priv *bat_priv)
packet->header.ttl = TTL;
packet->seqno = htonl(ntohl(packet->seqno) + 1);
packet->entries = 0;
+ packet->reserved = 0;
skb_trim(info->skb_packet, sizeof(*packet));
if (packet->vis_type == VIS_TYPE_CLIENT_UPDATE) {
@@ -913,6 +914,7 @@ int vis_init(struct bat_priv *bat_priv)
packet->header.packet_type = BAT_VIS;
packet->header.ttl = TTL;
packet->seqno = 0;
+ packet->reserved = 0;
packet->entries = 0;
INIT_LIST_HEAD(&bat_priv->vis_send_list);
--
1.7.10
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [B.A.T.M.A.N.] [PATCHv2 1/1] batman-adv: Don't leak information through uninitialized packet fields
2012-06-27 20:28 [B.A.T.M.A.N.] [PATCH 1/2] batctl: Don't leak information through initialized packet fields Sven Eckelmann
2012-06-27 20:28 ` [B.A.T.M.A.N.] [PATCH 2/2] batman-adv: " Sven Eckelmann
@ 2012-06-28 9:56 ` Sven Eckelmann
2012-06-28 9:56 ` [B.A.T.M.A.N.] [PATCHv2 2/2] batctl: " Sven Eckelmann
2012-06-30 12:21 ` [B.A.T.M.A.N.] [PATCHv2 1/1] batman-adv: " Marek Lindner
1 sibling, 2 replies; 6+ messages in thread
From: Sven Eckelmann @ 2012-06-28 9:56 UTC (permalink / raw)
To: b.a.t.m.a.n
The reserved fields in batman-adv packets are not set to a constant value. The
content of these memory regions is leaked unintentionally to the network.
This regression was introduced in c7fb529996cbc47bc8243d6860dac716ae70af82
Signed-off-by: Sven Eckelmann <sven@narfation.org>
---
Based on next and fixed commit title
soft-interface.c | 1 +
translation-table.c | 1 +
vis.c | 2 ++
3 files changed, 4 insertions(+)
diff --git a/soft-interface.c b/soft-interface.c
index b7c655c..9e4bb61 100644
--- a/soft-interface.c
+++ b/soft-interface.c
@@ -214,6 +214,7 @@ static int batadv_interface_tx(struct sk_buff *skb,
/* batman packet type: broadcast */
bcast_packet->header.packet_type = BATADV_BCAST;
+ bcast_packet->reserved = 0;
/* hw address of first interface is the orig mac because only
* this mac is known throughout the mesh
diff --git a/translation-table.c b/translation-table.c
index 245cc9a..a438f4b 100644
--- a/translation-table.c
+++ b/translation-table.c
@@ -2052,6 +2052,7 @@ static void batadv_send_roam_adv(struct batadv_priv *bat_priv, uint8_t *client,
roam_adv_packet->header.packet_type = BATADV_ROAM_ADV;
roam_adv_packet->header.version = BATADV_COMPAT_VERSION;
roam_adv_packet->header.ttl = BATADV_TTL;
+ roam_adv_packet->reserved = 0;
primary_if = batadv_primary_if_get_selected(bat_priv);
if (!primary_if)
goto out;
diff --git a/vis.c b/vis.c
index f09cc9a..2a2ea06 100644
--- a/vis.c
+++ b/vis.c
@@ -589,6 +589,7 @@ static int batadv_generate_vis_packet(struct batadv_priv *bat_priv)
packet->header.ttl = BATADV_TTL;
packet->seqno = htonl(ntohl(packet->seqno) + 1);
packet->entries = 0;
+ packet->reserved = 0;
skb_trim(info->skb_packet, sizeof(*packet));
if (packet->vis_type == BATADV_VIS_TYPE_CLIENT_UPDATE) {
@@ -890,6 +891,7 @@ int batadv_vis_init(struct batadv_priv *bat_priv)
packet->header.packet_type = BATADV_VIS;
packet->header.ttl = BATADV_TTL;
packet->seqno = 0;
+ packet->reserved = 0;
packet->entries = 0;
INIT_LIST_HEAD(&bat_priv->vis_send_list);
--
1.7.10
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [B.A.T.M.A.N.] [PATCHv2 2/2] batctl: Don't leak information through uninitialized packet fields
2012-06-28 9:56 ` [B.A.T.M.A.N.] [PATCHv2 1/1] batman-adv: Don't leak information through uninitialized " Sven Eckelmann
@ 2012-06-28 9:56 ` Sven Eckelmann
2012-06-30 12:25 ` Marek Lindner
2012-06-30 12:21 ` [B.A.T.M.A.N.] [PATCHv2 1/1] batman-adv: " Marek Lindner
1 sibling, 1 reply; 6+ messages in thread
From: Sven Eckelmann @ 2012-06-28 9:56 UTC (permalink / raw)
To: b.a.t.m.a.n
The reserved fields in batman-adv packets are not set to a constant value. The
content of these memory regions is leaked unintentionally to the network.
This regression was introduced in ee319368e5d6385458345731e519640889c177c4
Signed-off-by: Sven Eckelmann <sven@narfation.org>
---
Based on next and fixed commit title
ping.c | 2 ++
traceroute.c | 1 +
2 files changed, 3 insertions(+)
diff --git a/ping.c b/ping.c
index 85b4137..b6199c6 100644
--- a/ping.c
+++ b/ping.c
@@ -174,6 +174,8 @@ int ping(char *mesh_iface, int argc, char **argv)
icmp_packet_out.rr_cur = 1;
memset(&icmp_packet_out.rr, 0, BATADV_RR_LEN * ETH_ALEN);
memset(last_rr, 0, BATADV_RR_LEN * ETH_ALEN);
+ } else {
+ ((struct batadv_icmp_packet *)&icmp_packet_out)->reserved = 0;
}
printf("PING %s (%s) %zu(%zu) bytes of data\n", dst_string, mac_string,
diff --git a/traceroute.c b/traceroute.c
index 31f77b0..aae9fa7 100644
--- a/traceroute.c
+++ b/traceroute.c
@@ -125,6 +125,7 @@ int traceroute(char *mesh_iface, int argc, char **argv)
icmp_packet_out.header.packet_type = BATADV_ICMP;
icmp_packet_out.msg_type = BATADV_ECHO_REQUEST;
icmp_packet_out.seqno = 0;
+ icmp_packet_out.reserved = 0;
printf("traceroute to %s (%s), %d hops max, %zu byte packets\n",
dst_string, mac_string, TTL_MAX, sizeof(icmp_packet_out));
--
1.7.10
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [B.A.T.M.A.N.] [PATCHv2 1/1] batman-adv: Don't leak information through uninitialized packet fields
2012-06-28 9:56 ` [B.A.T.M.A.N.] [PATCHv2 1/1] batman-adv: Don't leak information through uninitialized " Sven Eckelmann
2012-06-28 9:56 ` [B.A.T.M.A.N.] [PATCHv2 2/2] batctl: " Sven Eckelmann
@ 2012-06-30 12:21 ` Marek Lindner
1 sibling, 0 replies; 6+ messages in thread
From: Marek Lindner @ 2012-06-30 12:21 UTC (permalink / raw)
To: The list for a Better Approach To Mobile Ad-hoc Networking
On Thursday, June 28, 2012 11:56:52 Sven Eckelmann wrote:
> The reserved fields in batman-adv packets are not set to a constant value.
> The content of these memory regions is leaked unintentionally to the
> network.
>
> This regression was introduced in c7fb529996cbc47bc8243d6860dac716ae70af82
>
> Signed-off-by: Sven Eckelmann <sven@narfation.org>
> ---
> Based on next and fixed commit title
>
> soft-interface.c | 1 +
> translation-table.c | 1 +
> vis.c | 2 ++
> 3 files changed, 4 insertions(+)
Applied in revision 4aae804.
Thanks,
Marek
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [B.A.T.M.A.N.] [PATCHv2 2/2] batctl: Don't leak information through uninitialized packet fields
2012-06-28 9:56 ` [B.A.T.M.A.N.] [PATCHv2 2/2] batctl: " Sven Eckelmann
@ 2012-06-30 12:25 ` Marek Lindner
0 siblings, 0 replies; 6+ messages in thread
From: Marek Lindner @ 2012-06-30 12:25 UTC (permalink / raw)
To: The list for a Better Approach To Mobile Ad-hoc Networking
On Thursday, June 28, 2012 11:56:53 Sven Eckelmann wrote:
> The reserved fields in batman-adv packets are not set to a constant value.
> The content of these memory regions is leaked unintentionally to the
> network.
>
> This regression was introduced in ee319368e5d6385458345731e519640889c177c4
>
> Signed-off-by: Sven Eckelmann <sven@narfation.org>
> ---
> Based on next and fixed commit title
>
> ping.c | 2 ++
> traceroute.c | 1 +
> 2 files changed, 3 insertions(+)
Applied in revision 74e9b22.
Thanks,
Marek
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2012-06-30 12:25 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-06-27 20:28 [B.A.T.M.A.N.] [PATCH 1/2] batctl: Don't leak information through initialized packet fields Sven Eckelmann
2012-06-27 20:28 ` [B.A.T.M.A.N.] [PATCH 2/2] batman-adv: " Sven Eckelmann
2012-06-28 9:56 ` [B.A.T.M.A.N.] [PATCHv2 1/1] batman-adv: Don't leak information through uninitialized " Sven Eckelmann
2012-06-28 9:56 ` [B.A.T.M.A.N.] [PATCHv2 2/2] batctl: " Sven Eckelmann
2012-06-30 12:25 ` Marek Lindner
2012-06-30 12:21 ` [B.A.T.M.A.N.] [PATCHv2 1/1] batman-adv: " Marek Lindner
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox