Repository : ssh://git@open-mesh.org/openwrt-feed-batman-adv
On branch : master
>---------------------------------------------------------------
commit caf5c6a29467d42b750c798b8d79f201615d7dc6
Author: Sven Eckelmann <sven(a)narfation.org>
Date: Tue Nov 4 14:37:40 2014 +0100
batman-adv-devel: Preserve configuration file on update
The configuration file of batman-adv should be marked as such to avoid that the
old configuration options are overwritten when it is upgraded.
Signed-off-by: Sven Eckelmann <sven(a)narfation.org>
Signed-off-by: Marek Lindner <mareklindner(a)neomailbox.ch>
>---------------------------------------------------------------
caf5c6a29467d42b750c798b8d79f201615d7dc6
batman-adv-devel/Makefile | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/batman-adv-devel/Makefile b/batman-adv-devel/Makefile
index 76f5861..34f4ba7 100644
--- a/batman-adv-devel/Makefile
+++ b/batman-adv-devel/Makefile
@@ -43,6 +43,10 @@ define KernelPackage/batman-adv-devel/config
source "$(SOURCE)/Config.in"
endef
+define Package/kmod-batman-adv-devel/conffiles
+/etc/config/batman-adv
+endef
+
MAKE_BATMAN_ADV_ARGS += \
CROSS_COMPILE="$(TARGET_CROSS)" \
KERNELPATH="$(LINUX_DIR)" \
Repository : ssh://git@open-mesh.org/batctl
Branch 'master' now includes:
140882b batctl: Fix crash when parsing unknown TVLVs
e5c2e7f batctl: Parse only TVLV when header is available
79f3061 batctl: Only parse TVLV data when length is valid
0505524 batctl: Parse non-variable TVLV only with correct length
5fda4d5 batctl: Only parse big enough TVLV TTv1
36c6316 Merge branch 'next'
Repository : ssh://git@open-mesh.org/batctl
On branch : next
>---------------------------------------------------------------
commit 5fda4d5b175fb5c345a30ed3c7ffb191668c3950
Author: Sven Eckelmann <sven(a)narfation.org>
Date: Wed Nov 12 18:58:29 2014 +0100
batctl: Only parse big enough TVLV TTv1
A TTv1 has a constant header part and two variable parts. One is the defined by
the number of VLANs and the rest are the changes. The TVLV can only be parsed
when there is enough room for the constant header. Also the number of VLANs
must be validated. Otherwise the TVLV parser can read invalid data outside of
the buffer.
This regression was introduced by 4c39fb823b86036df40187f8bd342fe5398c28ef
("batctl: tcpdump - parse TVLV containers").
Signed-off-by: Sven Eckelmann <sven(a)narfation.org>
Signed-off-by: Marek Lindner <mareklindner(a)neomailbox.ch>
>---------------------------------------------------------------
5fda4d5b175fb5c345a30ed3c7ffb191668c3950
tcpdump.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/tcpdump.c b/tcpdump.c
index 361deb3..50ba010 100644
--- a/tcpdump.c
+++ b/tcpdump.c
@@ -142,13 +142,15 @@ static void batctl_tvlv_parse_nc_v1(void (*buff)__attribute__((unused)),
printf("\tTVLV NCv1: enabled\n");
}
-static void batctl_tvlv_parse_tt_v1(void *buff,
- ssize_t (buff_len)__attribute__((unused)))
+static void batctl_tvlv_parse_tt_v1(void *buff, ssize_t buff_len)
{
struct batadv_tvlv_tt_data *tvlv = buff;
struct batadv_tvlv_tt_vlan_data *vlan;
int i, num_vlan, num_entry;
const char *type;
+ size_t vlan_len;
+
+ LEN_CHECK(buff_len, sizeof(*tvlv), "TVLV TTv1")
if (tvlv->flags & BATADV_TT_OGM_DIFF)
type = "OGM DIFF";
@@ -160,7 +162,10 @@ static void batctl_tvlv_parse_tt_v1(void *buff,
type = "UNKNOWN";
num_vlan = ntohs(tvlv->num_vlan);
- buff_len -= sizeof(*tvlv) + sizeof(*vlan) * num_vlan;
+ vlan_len = sizeof(*tvlv) + sizeof(*vlan) * num_vlan;
+ LEN_CHECK(buff_len, vlan_len, "TVLV TTv1 VLAN")
+
+ buff_len -= vlan_len;
num_entry = buff_len / sizeof(struct batadv_tvlv_tt_change);
printf("\tTVLV TTv1: %s [%c] ttvn=%hhu vlan_num=%hu entry_num=%hu\n",
Repository : ssh://git@open-mesh.org/batctl
On branch : next
>---------------------------------------------------------------
commit e5c2e7f3aeedac12e1e851c8a29feda8275d8d7d
Author: Sven Eckelmann <sven(a)narfation.org>
Date: Wed Nov 12 18:58:26 2014 +0100
batctl: Parse only TVLV when header is available
The TVLV must only start parsing an header when at least one TVLV header is
available. Otherwise data behind the received data might be accessed.
This regression was introduced by 4c39fb823b86036df40187f8bd342fe5398c28ef
("batctl: tcpdump - parse TVLV containers").
Signed-off-by: Sven Eckelmann <sven(a)narfation.org>
Signed-off-by: Marek Lindner <mareklindner(a)neomailbox.ch>
>---------------------------------------------------------------
e5c2e7f3aeedac12e1e851c8a29feda8275d8d7d
tcpdump.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tcpdump.c b/tcpdump.c
index c3c847e..3e57544 100644
--- a/tcpdump.c
+++ b/tcpdump.c
@@ -256,7 +256,7 @@ static void dump_batman_ucast_tvlv(unsigned char *packet_buff, ssize_t buff_len,
ptr = (uint8_t *)(tvlv_packet + 1);
- while (tvlv_len > 0) {
+ while (tvlv_len >= (ssize_t)sizeof(*tvlv_hdr)) {
tvlv_hdr = (struct batadv_tvlv_hdr *)ptr;
len = ntohs(tvlv_hdr->len);
@@ -685,7 +685,7 @@ static void dump_batman_iv_ogm(unsigned char *packet_buff, ssize_t buff_len, int
ptr = (uint8_t *)(batman_ogm_packet + 1);
- while (tvlv_len > 0) {
+ while (tvlv_len >= (ssize_t)sizeof(*tvlv_hdr)) {
tvlv_hdr = (struct batadv_tvlv_hdr *)ptr;
len = ntohs(tvlv_hdr->len);
Repository : ssh://git@open-mesh.org/batctl
On branch : next
>---------------------------------------------------------------
commit 140882bda39c4ab891f2981e2d07146221c664a1
Author: Sven Eckelmann <sven(a)narfation.org>
Date: Wed Nov 12 18:58:25 2014 +0100
batctl: Fix crash when parsing unknown TVLVs
batctl tcpdump has an array with all known TVLVs and versions. The correct
parser for the TVLV is chosen by getting the pointer from the address
calculated by version and type. Unfortunately, the version and type was never
validated to ensure that not an unknown TVLV (like mcast) was received.
This missing validation makes it possible to crash batctl by injecting packets
with an unknown type and/or version. batctl will try to get the parser, fetch a
NULL pointer or random data and then try to dereferenced it. This is usually
handled by the operating system with a segfault. But this might be exploitable
in rare situations.
An approach to handle this problem is by combining the simple selection step
with the validation step. Only valid version+type will return a parser function
pointer and the requesting function will only call the parser function pointer
when it got one.
This regression was introduced by 4c39fb823b86036df40187f8bd342fe5398c28ef
("batctl: tcpdump - parse TVLV containers").
Signed-off-by: Sven Eckelmann <sven(a)narfation.org>
Signed-off-by: Marek Lindner <mareklindner(a)neomailbox.ch>
>---------------------------------------------------------------
140882bda39c4ab891f2981e2d07146221c664a1
tcpdump.c | 67 ++++++++++++++++++++++++++++++++++++++++++++++++-------------
1 file changed, 53 insertions(+), 14 deletions(-)
diff --git a/tcpdump.c b/tcpdump.c
index ad5469b..c3c847e 100644
--- a/tcpdump.c
+++ b/tcpdump.c
@@ -171,16 +171,53 @@ static void batctl_tvlv_parse_roam_v1(void *buff,
typedef void (*batctl_tvlv_parser_t)(void *buff, ssize_t buff_len);
-/* location [i][j] contains the parsing function for TVLV of type 'i' and
- * version 'j + 1'
- */
-batctl_tvlv_parser_t tvlv_parsers[][1] = {
- [BATADV_TVLV_GW][0] = batctl_tvlv_parse_gw_v1,
- [BATADV_TVLV_DAT][0] = batctl_tvlv_parse_dat_v1,
- [BATADV_TVLV_NC][0] = batctl_tvlv_parse_nc_v1,
- [BATADV_TVLV_TT][0] = batctl_tvlv_parse_tt_v1,
- [BATADV_TVLV_ROAM][0] = batctl_tvlv_parse_roam_v1,
-};
+static batctl_tvlv_parser_t tvlv_parser_get(uint8_t type, uint8_t version)
+{
+ switch (type) {
+ case BATADV_TVLV_GW:
+ switch (version) {
+ case 1:
+ return batctl_tvlv_parse_gw_v1;
+ default:
+ return NULL;
+ }
+
+ case BATADV_TVLV_DAT:
+ switch (version) {
+ case 1:
+ return batctl_tvlv_parse_dat_v1;
+ default:
+ return NULL;
+ }
+
+ case BATADV_TVLV_NC:
+ switch (version) {
+ case 1:
+ return batctl_tvlv_parse_nc_v1;
+ default:
+ return NULL;
+ }
+
+ case BATADV_TVLV_TT:
+ switch (version) {
+ case 1:
+ return batctl_tvlv_parse_tt_v1;
+ default:
+ return NULL;
+ }
+
+ case BATADV_TVLV_ROAM:
+ switch (version) {
+ case 1:
+ return batctl_tvlv_parse_roam_v1;
+ default:
+ return NULL;
+ }
+
+ default:
+ return NULL;
+ }
+}
static void dump_batman_ucast_tvlv(unsigned char *packet_buff, ssize_t buff_len,
int read_opt, int time_printed)
@@ -223,8 +260,9 @@ static void dump_batman_ucast_tvlv(unsigned char *packet_buff, ssize_t buff_len,
tvlv_hdr = (struct batadv_tvlv_hdr *)ptr;
len = ntohs(tvlv_hdr->len);
- parser = tvlv_parsers[tvlv_hdr->type][tvlv_hdr->version - 1];
- parser(tvlv_hdr + 1, len);
+ parser = tvlv_parser_get(tvlv_hdr->type, tvlv_hdr->version);
+ if (parser)
+ parser(tvlv_hdr + 1, len);
/* go to the next container */
ptr = (uint8_t *)(tvlv_hdr + 1) + len;
@@ -651,8 +689,9 @@ static void dump_batman_iv_ogm(unsigned char *packet_buff, ssize_t buff_len, int
tvlv_hdr = (struct batadv_tvlv_hdr *)ptr;
len = ntohs(tvlv_hdr->len);
- parser = tvlv_parsers[tvlv_hdr->type][tvlv_hdr->version - 1];
- parser(tvlv_hdr + 1, len);
+ parser = tvlv_parser_get(tvlv_hdr->type, tvlv_hdr->version);
+ if (parser)
+ parser(tvlv_hdr + 1, len);
/* go to the next container */
ptr = (uint8_t *)(tvlv_hdr + 1) + len;