B.A.T.M.A.N November 2014

b.a.t.m.a.n@lists.open-mesh.org

19 participants
48 discussions

[B.A.T.M.A.N.] TVLV infrastructure (v2)
by Marek Lindner 10 Jun '15

10 Jun '15

Hi, at the battlemesh we had plenty of time to discuss and test the tvlv patchset. Therefore, a number of changes/fixes found their way into v2 touching the tvlv API, network coding, unicast sending and gateway announcements. This looks like the final version which is going to be merged unless objections are raised soon-ish. Cheers, Marek

2 15

[B.A.T.M.A.N.] [PATCHv14 0/6] Basic Multicast Optimizations
by Linus Lüssing 10 Jun '15

10 Jun '15

This is the fourteenth revision of the basic multicast optimization patches. Changes in v14 include: * fixed compilation for CONFIG_BATMAN_ADV_MCAST=n (issue was introduced by v13) * fixed potential null pointer exception (moved ethhdr assignment in batadv_mcast_forw_mode() to after the check methods / pskb_may_pull()s) * removed flag-list-"helper" functions * removed methods which were performing both counting and orig_node retrieval in batadv_mcast_forw_mode(), instead doing that in two logical, seperate sections in batadv_mcast_forw_mode() Cheers, Linus

3 13

[B.A.T.M.A.N.] [PATCH] batman-adv: Kconfig, Add missing DEBUG_FS dependency
by Markus Pargmann 07 Jan '15

07 Jan '15

BATMAN_ADV_DEBUG is using debugfs files for the debugging log. So it depends on DEBUG_FS which is missing as dependency in the Kconfig file. Signed-off-by: Markus Pargmann <mpa(a)pengutronix.de> --- net/batman-adv/Kconfig | 1 + 1 file changed, 1 insertion(+) diff --git a/net/batman-adv/Kconfig b/net/batman-adv/Kconfig index 11660a3aab5a..c6fc8f756c9a 100644 --- a/net/batman-adv/Kconfig +++ b/net/batman-adv/Kconfig @@ -62,6 +62,7 @@ config BATMAN_ADV_MCAST config BATMAN_ADV_DEBUG bool "B.A.T.M.A.N. debugging" depends on BATMAN_ADV + depends on DEBUG_FS help This is an option for use by developers; most people should say N here. This enables compilation of support for -- 2.1.3

2 4

[B.A.T.M.A.N.] [PATCH 1/2] batman-adv: fix misspelled words
by Antonio Quartulli 29 Dec '14

29 Dec '14

Reported-by: checkpatch Signed-off-by: Antonio Quartulli <antonio(a)meshcoding.com> --- CHANGELOG | 2 +- bridge_loop_avoidance.c | 4 ++-- main.c | 2 +- packet.h | 4 ++-- routing.c | 2 +- translation-table.c | 2 +- types.h | 2 +- 7 files changed, 9 insertions(+), 9 deletions(-) diff --git a/CHANGELOG b/CHANGELOG index a91e233..affb823 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -248,7 +248,7 @@ batman-adv 2011.4.0: batman-adv 2011.3.1: * don't send all packets to selected gateway as broadcast -* prevent translation table corruptions caused by unintialized memory and +* prevent translation table corruptions caused by uninitialized memory and invalid sizes send through client announcement mechanism -- Tue, 18 Oct 2011 20:40:59 +0200 diff --git a/bridge_loop_avoidance.c b/bridge_loop_avoidance.c index 4fc6cab..ac4b96e 100644 --- a/bridge_loop_avoidance.c +++ b/bridge_loop_avoidance.c @@ -244,7 +244,7 @@ batadv_bla_del_backbone_claims(struct batadv_bla_backbone_gw *backbone_gw) spin_unlock_bh(list_lock); } - /* all claims gone, intialize CRC */ + /* all claims gone, initialize CRC */ backbone_gw->crc = BATADV_BLA_CRC_INIT; } @@ -1328,7 +1328,7 @@ int batadv_bla_check_bcast_duplist(struct batadv_priv *bat_priv, goto out; } /* not found, add a new entry (overwrite the oldest entry) - * and allow it, its the first occurence. + * and allow it, its the first occurrence. */ curr = (bat_priv->bla.bcast_duplist_curr + BATADV_DUPLIST_SIZE - 1); curr %= BATADV_DUPLIST_SIZE; diff --git a/main.c b/main.c index d4079cd..6f48cdb 100644 --- a/main.c +++ b/main.c @@ -795,7 +795,7 @@ void batadv_tvlv_container_register(struct batadv_priv *bat_priv, } /** - * batadv_tvlv_realloc_packet_buff - reallocate packet buffer to accomodate + * batadv_tvlv_realloc_packet_buff - reallocate packet buffer to accommodate * requested packet size * @packet_buff: packet buffer * @packet_buff_len: packet buffer size diff --git a/packet.h b/packet.h index facd1fe..b81fbbf 100644 --- a/packet.h +++ b/packet.h @@ -377,7 +377,7 @@ struct batadv_frag_packet { uint8_t reserved:4; uint8_t no:4; #else -#error "unknown bitfield endianess" +#error "unknown bitfield endianness" #endif uint8_t dest[ETH_ALEN]; uint8_t orig[ETH_ALEN]; @@ -453,7 +453,7 @@ struct batadv_coded_packet { * @src: address of the source * @dst: address of the destination * @tvlv_len: length of tvlv data following the unicast tvlv header - * @align: 2 bytes to align the header to a 4 byte boundry + * @align: 2 bytes to align the header to a 4 byte boundary */ struct batadv_unicast_tvlv_packet { uint8_t packet_type; diff --git a/routing.c b/routing.c index 3a6764d..e5f2ccd 100644 --- a/routing.c +++ b/routing.c @@ -454,7 +454,7 @@ batadv_find_router(struct batadv_priv *bat_priv, * the last chosen bonding candidate (next_candidate). If no such * router is found, use the first candidate found (the previously * chosen bonding candidate might have been the last one in the list). - * If this can't be found either, return the previously choosen + * If this can't be found either, return the previously chosen * router - obviously there are no other candidates. */ rcu_read_lock(); diff --git a/translation-table.c b/translation-table.c index 84e6f01..07b263a 100644 --- a/translation-table.c +++ b/translation-table.c @@ -2852,7 +2852,7 @@ static void batadv_tt_update_changes(struct batadv_priv *bat_priv, /** * batadv_is_my_client - check if a client is served by the local node * @bat_priv: the bat priv with all the soft interface information - * @addr: the mac adress of the client to check + * @addr: the mac address of the client to check * @vid: VLAN identifier * * Returns true if the client is served by this node, false otherwise. diff --git a/types.h b/types.h index 462a70c..9398c3f 100644 --- a/types.h +++ b/types.h @@ -968,7 +968,7 @@ struct batadv_tt_orig_list_entry { }; /** - * struct batadv_tt_change_node - structure for tt changes occured + * struct batadv_tt_change_node - structure for tt changes occurred * @list: list node for batadv_priv_tt::changes_list * @change: holds the actual translation table diff data */ -- 2.1.3

2 3

[B.A.T.M.A.N.] [PATCH] batman-adv: move misplaced compat code
by Antonio Quartulli 29 Dec '14

29 Dec '14

consume_skb() has to be re-defined only for kernels <2.6.30 but the macro was accidentally placed right above any #ifdef block causing the function to be always redefined. Fix this by moving the macro to the proper #ifdef block. Introduced by: 15fb0fab51a3695738f65dfaab045e979fc89dce ("batman-adv add compat code for consume_skb") Reported-by: Sven Eckelmann <sven(a)narfation.org> Signed-off-by: Antonio Quartulli <antonio(a)meshcoding.com> --- compat.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/compat.h b/compat.h index ed5b815..8de2010 100644 --- a/compat.h +++ b/compat.h @@ -23,10 +23,10 @@ #include <linux/version.h> /* LINUX_VERSION_CODE */ -#define consume_skb(_skb) kfree_skb(_skb) - #if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 30) +#define consume_skb(_skb) kfree_skb(_skb) + #undef __alloc_percpu #define __alloc_percpu(size, align) \ percpu_alloc_mask((size), GFP_KERNEL, cpu_possible_map) -- 2.0.4

2 1

[B.A.T.M.A.N.] Bridging multiple mesh segments across WAN
by tjhowse 02 Dec '14

02 Dec '14

Hi All, I've partially covered a large site in routers running batman-adv. The mesh is used for mobile access to equipment on a static site copper and fibre network around the site. A few of the routers have WAN connections to the site network. The routers with WAN connections are configured as gateways in batman-adv. There are gaps in the mesh; typically there is no route between WAN-connected routers via the mesh. I would like to join up the separate mesh segments, via the site network, such that a client to one segment can ping a client of another network, having the traffic transparently tunnel via the WAN. Has anyone looked at doing this in the past? Thanks, Travis.

2 3

[B.A.T.M.A.N.] [RFC] batman-adv: Calculate extra tail size based on queued fragments
by Sven Eckelmann 01 Dec '14

01 Dec '14

The fragmentation code was replaced in 9b3eab61754d74a93c9840c296013fe3b4a1b606 ("batman-adv: Receive fragmented packets and merge"). The new code provided a mostly unused parameter skb for the merging function. It is used inside the function to calculate the additionally needed skb tailroom. But instead of increasing its own tailroom, it is only increasing the tailroom of the first queued skb. This is not correct in most situations because the first queued entry can be a different one than the parameter. An observed problem was: 1. packet with size 104, total_size 1464, fragno 1 was received - packet is queued 2. packet with size 1400, total_size 1464, fragno 0 was received - packet is queued at the end of the list 3. enough data was received and can be given to the merge function (1464 == (1400 - 20) + (104 - 20)) - merge functions gets 1400 byte large packet as skb argument 4. merge function gets first entry in queue (104 byte) - stored as skb_out 5. merge function calculates the required extra tail as total_size - skb->len - pskb_expand_head tail of skb_out with 64 bytes 6. merge function tries to squeeze the extra 1380 bytes from the second queued skb (1400 byte aka skb parameter) in the 64 extra tail bytes of skb_out Instead take only skbs from the queue to merge a packet and remove the problematic parameter. Signed-off-by: Sven Eckelmann <sven(a)narfation.org> Reported-by: Philipp Psurek <philipp.psurek(a)gmail.com> --- This patch requires also the patch "Check total_size when reassembling fragments" to be applied. This is only compile tested. fragmentation.c | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-) diff --git a/fragmentation.c b/fragmentation.c index c741318..aeaf1ab 100644 --- a/fragmentation.c +++ b/fragmentation.c @@ -228,18 +228,13 @@ err: * Returns the merged skb or NULL on error. */ static struct sk_buff * -batadv_frag_merge_packets(struct hlist_head *chain, struct sk_buff *skb) +batadv_frag_merge_packets(struct hlist_head *chain) { struct batadv_frag_packet *packet; struct batadv_frag_list_entry *entry; struct sk_buff *skb_out = NULL; int size, hdr_size = sizeof(struct batadv_frag_packet); - - /* Make sure incoming skb has non-bogus data. */ - packet = (struct batadv_frag_packet *)skb->data; - size = ntohs(packet->total_size); - if (size > batadv_frag_size_limit()) - goto free; + int extra_tail; /* Remove first entry, as this is the destination for the rest of the * fragments. @@ -249,11 +244,17 @@ batadv_frag_merge_packets(struct hlist_head *chain, struct sk_buff *skb) skb_out = entry->skb; kfree(entry); + packet = (struct batadv_frag_packet *)skb_out->data; + size = ntohs(packet->total_size); + /* Make room for the rest of the fragments. */ - if (pskb_expand_head(skb_out, 0, size - skb->len, GFP_ATOMIC) < 0) { - kfree_skb(skb_out); - skb_out = NULL; - goto free; + if (size > skb_out->len) { + extra_tail = size - skb_out->len; + if (pskb_expand_head(skb_out, 0, extra_tail, GFP_ATOMIC) < 0) { + kfree_skb(skb_out); + skb_out = NULL; + goto free; + } } /* Move the existing MAC header to just before the payload. (Override @@ -304,7 +305,7 @@ bool batadv_frag_skb_buffer(struct sk_buff **skb, if (hlist_empty(&head)) goto out; - skb_out = batadv_frag_merge_packets(&head, *skb); + skb_out = batadv_frag_merge_packets(&head); if (!skb_out) goto out_err; -- 2.1.3

2 5

[B.A.T.M.A.N.] [PATCH-maint] batman-adv: Check total_size when reassembling fragments
by Sven Eckelmann 01 Dec '14

01 Dec '14

The fragmentation code was replaced in 9b3eab61754d74a93c9840c296013fe3b4a1b606 ("batman-adv: Receive fragmented packets and merge") by an implementation which handles the queueing+merging of fragments based on their size and the total_size of the non-fragmented packet. This total_size is announced by each fragment. The new implementation doesn't check if the the total_size information of the packets inside one chain is consistent. This allows an attacker to inject packets belonging to the same fragmentation sequence number with varying total_size information. The missing validation can cause a crash when the fragments are merged because the total_size information is only retrieved from the first packet by batadv_frag_merge_packets. But the queueing function batadv_frag_insert_packet always uses the total_size from the latest packet to check if the fragmented packet was transferred completely and is now ready to be merged. Assume two packets with the size x and y. 1. first packet (fragno 1) is sent with a size x and the total_size x+y' (y' < y) 2. second packet (fragno 0) is sent with a size y and the total_size x+y The fragmentation code would try to merge the two packets because the accumulated packets have a combined size of x+y and the second packet was sent with total_size of x+y. The fragments merging code only took the information from the first packet with the total_size x+y' and created a buffer with enough space for x+y' bytes. But the second packet cannot be copied inside the prepared free space because it is y-y' bytes larger than the remaining space. Signed-off-by: Sven Eckelmann <sven(a)narfation.org> Acked-by: Martin Hundebøll <martin(a)hundeboll.net> --- This is only a resend of the patch https://lists.open-mesh.org/pipermail/b.a.t.m.a.n/2014-November/012584.html This was necessary because the mail thread was hijacked by others who started to discuss a different problem which may or may not be caused by the fragmentation code (or batman-adv at all). At least they removed me from the Cc so I had not received their "responses". This also gave me the opportunity to change some words in the commit message. --- fragmentation.c | 7 +++++-- types.h | 2 ++ 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/fragmentation.c b/fragmentation.c index 362e91a..3a19d4d 100644 --- a/fragmentation.c +++ b/fragmentation.c @@ -161,6 +161,7 @@ static bool batadv_frag_insert_packet(struct batadv_orig_node *orig_node, hlist_add_head(&frag_entry_new->list, &chain->head); chain->size = skb->len - hdr_size; chain->timestamp = jiffies; + chain->total_size = ntohs(frag_packet->total_size); ret = true; goto out; } @@ -195,9 +196,11 @@ static bool batadv_frag_insert_packet(struct batadv_orig_node *orig_node, out: if (chain->size > batadv_frag_size_limit() || - ntohs(frag_packet->total_size) > batadv_frag_size_limit()) { + chain->total_size != ntohs(frag_packet->total_size) || + chain->total_size > batadv_frag_size_limit()) { /* Clear chain if total size of either the list or the packet - * exceeds the maximum size of one merged packet. + * exceeds the maximum size of one merged packet. Don't allow + * packets to have different total_size. */ batadv_frag_clear_chain(&chain->head); chain->size = 0; diff --git a/types.h b/types.h index 462a70c..c4d7d24 100644 --- a/types.h +++ b/types.h @@ -132,6 +132,7 @@ struct batadv_orig_ifinfo { * @timestamp: time (jiffie) of last received fragment * @seqno: sequence number of the fragments in the list * @size: accumulated size of packets in list + * @total_size: expected size of the assembled packet */ struct batadv_frag_table_entry { struct hlist_head head; @@ -139,6 +140,7 @@ struct batadv_frag_table_entry { unsigned long timestamp; uint16_t seqno; uint16_t size; + uint16_t total_size; }; /** -- 2.1.3

1 1

[B.A.T.M.A.N.] [PATCH] batman-adv: Check size information when reassembling fragments
by Sven Eckelmann 30 Nov '14

30 Nov '14

The fragmentation code doesn't check if the the total_size information of the packets inside one chain is consistent. This allows an attacker to inject packets belonging to the same fragmentation sequence number with different total_size. This can cause a crash when these are assembled because the total_size information is only parsed from the first packet in batadv_frag_merge_packets but the queueing function always uses the total_size of the latest packet. Assume two packets with the size x and y. 1. first packet is sent with a size x and the total_size x+y' (y' < y) 2. second packet is sent with a size y and the total_size x+y The fragmentation code would try to assemble the two packets because the accumulated packets have a combined size of x+y and the second packet had the total_size of x+y. The fragmentation assembling code only took the information from the first packet with the total_size x+y' and create a packet with enough space for x+y' bytes. But the second packet cannot be copied inside the prepared free space because it is y-y' bytes larger than the remaining space. Signed-off-by: Sven Eckelmann <sven(a)narfation.org> --- This is only build tested. I've never spend time in creation of these packets to verify my claim. fragmentation.c | 7 +++++-- types.h | 2 ++ 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/fragmentation.c b/fragmentation.c index 362e91a..3a19d4d 100644 --- a/fragmentation.c +++ b/fragmentation.c @@ -161,6 +161,7 @@ static bool batadv_frag_insert_packet(struct batadv_orig_node *orig_node, hlist_add_head(&frag_entry_new->list, &chain->head); chain->size = skb->len - hdr_size; chain->timestamp = jiffies; + chain->total_size = ntohs(frag_packet->total_size); ret = true; goto out; } @@ -195,9 +196,11 @@ static bool batadv_frag_insert_packet(struct batadv_orig_node *orig_node, out: if (chain->size > batadv_frag_size_limit() || - ntohs(frag_packet->total_size) > batadv_frag_size_limit()) { + chain->total_size != ntohs(frag_packet->total_size) || + chain->total_size > batadv_frag_size_limit()) { /* Clear chain if total size of either the list or the packet - * exceeds the maximum size of one merged packet. + * exceeds the maximum size of one merged packet. Don't allow + * packets to have different total_size. */ batadv_frag_clear_chain(&chain->head); chain->size = 0; diff --git a/types.h b/types.h index 462a70c..c4d7d24 100644 --- a/types.h +++ b/types.h @@ -132,6 +132,7 @@ struct batadv_orig_ifinfo { * @timestamp: time (jiffie) of last received fragment * @seqno: sequence number of the fragments in the list * @size: accumulated size of packets in list + * @total_size: expected size of the assembled packet */ struct batadv_frag_table_entry { struct hlist_head head; @@ -139,6 +140,7 @@ struct batadv_frag_table_entry { unsigned long timestamp; uint16_t seqno; uint16_t size; + uint16_t total_size; }; /** -- 2.1.3

4 13

[B.A.T.M.A.N.] mib for batman-adv
by Lucas Aimaretto 28 Nov '14

28 Nov '14

Hi All, A simple question: is there any snmp MIB for batman-adv so we can gather routing information, that otherwise can only obtained by using batctl? Thanks! Lucas -- "Antes teníamos hambre y mirábamos el reloj para saber qué hora era. Ahora miramos el reloj para saber si tenemos hambre." -- Ernesto Sábato

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

B.A.T.M.A.N November 2014