AcoSail/kernel_optimize_test
8
0
Fork 0
forked from luck/tmp_suning_uos_patched
Code Pull Requests Activity

batman-adv: Fix multicast TT issues with bogus ROAM flags

Browse Source 
When a (broken) node wrongly sends multicast TT entries with a ROAM
flag then this causes any receiving node to drop all entries for the
same multicast MAC address announced by other nodes, leading to
packet loss.

Fix this DoS vector by only storing TT sync flags. For multicast TT
non-sync'ing flag bits like ROAM are unused so far anyway.

Fixes: 1d8ab8d3c1 ("batman-adv: Modified forwarding behaviour for multicast packets")
Reported-by: Leonardo Mörlein <me@irrelefant.net>
Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
This commit is contained in:
Linus Lüssing 2018-06-07 00:46:24 +02:00 committed by Simon Wunderlich
parent 4a519b83da
commit a44ebeff6b
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
net/batman-adv/translation-table.c
View File

@ -1705,7 +1705,8 @@ static bool batadv_tt_global_add(struct batadv_priv *bat_priv,
ether_addr_copy(common->addr, tt_addr); ether_addr_copy(common->addr, tt_addr);
common->vid = vid; common->vid = vid;
common->flags = flags & (~BATADV_TT_SYNC_MASK); if (!is_multicast_ether_addr(common->addr))
common->flags = flags & (~BATADV_TT_SYNC_MASK);
tt_global_entry->roam_at = 0; tt_global_entry->roam_at = 0;
/* node must store current time in case of roaming. This is /* node must store current time in case of roaming. This is
@ -1769,7 +1770,8 @@ static bool batadv_tt_global_add(struct batadv_priv *bat_priv,
* TT_CLIENT_TEMP, therefore they have to be copied in the * TT_CLIENT_TEMP, therefore they have to be copied in the
* client entry * client entry
*/ */
common->flags |= flags & (~BATADV_TT_SYNC_MASK); if (!is_multicast_ether_addr(common->addr))
common->flags |= flags & (~BATADV_TT_SYNC_MASK);
/* If there is the BATADV_TT_CLIENT_ROAM flag set, there is only /* If there is the BATADV_TT_CLIENT_ROAM flag set, there is only
* one originator left in the list and we previously received a * one originator left in the list and we previously received a