commits August 2024

commits@lists.open-mesh.org

1 participants
41 discussions

[batman-adv] main,main: Merge branch 'stable' (50d0e1d5)
by postmaster＠open-mesh.org 31 Aug '24

31 Aug '24

Repository : ssh://git@diktynna/batman-adv On branches: main,main >--------------------------------------------------------------- commit 50d0e1d50b101524dcc4237088e7bde47792880b Merge: 3c8d29ee aa68ccb5 Author: Sven Eckelmann <sven(a)narfation.org> Date: Sat Aug 31 22:16:45 2024 +0200 Merge branch 'stable' >--------------------------------------------------------------- 50d0e1d50b101524dcc4237088e7bde47792880b net/batman-adv/originator.c | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+)

1 0

[batman-adv] main,stable,main,stable: batman-adv: Don't accept TT entries for out-of-spec VIDs (aa68ccb5)
by postmaster＠open-mesh.org 31 Aug '24

31 Aug '24

Repository : ssh://git@diktynna/batman-adv On branches: main,stable,main,stable >--------------------------------------------------------------- commit aa68ccb56023394b08929718645760dcc501f2d9 Author: Sven Eckelmann <sven(a)narfation.org> Date: Sat May 4 22:27:21 2024 +0200 batman-adv: Don't accept TT entries for out-of-spec VIDs The internal handling of VLAN IDs in batman-adv is only specified for following encodings: * VLAN is used - bit 15 is 1 - bit 11 - bit 0 is the VLAN ID (0-4095) - remaining bits are 0 * No VLAN is used - bit 15 is 0 - remaining bits are 0 batman-adv was only preparing new translation table entries (based on its soft interface information) using this encoding format. But the receive path was never checking if entries in the roam or TT TVLVs were also following this encoding. It was therefore possible to create more than the expected maximum of 4096 + 1 entries in the originator VLAN list. Simply by setting the "remaining bits" to "random" values in corresponding TVLV. Fixes: 21a57f6e7a3b ("batman-adv: make the TT CRC logic VLAN specific") Reported-by: Linus Lüssing <linus.luessing(a)c0d3.blue> Signed-off-by: Sven Eckelmann <sven(a)narfation.org> >--------------------------------------------------------------- aa68ccb56023394b08929718645760dcc501f2d9 net/batman-adv/originator.c | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c index ac74f6ea..8f6dd2c6 100644 --- a/net/batman-adv/originator.c +++ b/net/batman-adv/originator.c @@ -12,6 +12,7 @@ #include <linux/errno.h> #include <linux/etherdevice.h> #include <linux/gfp.h> +#include <linux/if_vlan.h> #include <linux/jiffies.h> #include <linux/kref.h> #include <linux/list.h> @@ -131,6 +132,29 @@ batadv_orig_node_vlan_get(struct batadv_orig_node *orig_node, return vlan; } +/** + * batadv_vlan_id_valid() - check if vlan id is in valid batman-adv encoding + * @vid: the VLAN identifier + * + * Return: true when either no vlan is set or if VLAN is in correct range, + * false otherwise + */ +static bool batadv_vlan_id_valid(unsigned short vid) +{ + unsigned short non_vlan = vid & ~(BATADV_VLAN_HAS_TAG | VLAN_VID_MASK); + + if (vid == 0) + return true; + + if (!(vid & BATADV_VLAN_HAS_TAG)) + return false; + + if (non_vlan) + return false; + + return true; +} + /** * batadv_orig_node_vlan_new() - search and possibly create an orig_node_vlan * object @@ -149,6 +173,9 @@ batadv_orig_node_vlan_new(struct batadv_orig_node *orig_node, { struct batadv_orig_node_vlan *vlan; + if (!batadv_vlan_id_valid(vid)) + return NULL; + spin_lock_bh(&orig_node->vlan_list_lock); /* first look if an object for this vid already exists */

1 0

[linux-merge]linux integration; annotated tag, v6.11-rc5, created. v6.11-rc5
by postmaster＠open-mesh.org 25 Aug '24

25 Aug '24

The annotated tag, v6.11-rc5 has been created at 042a071fcf19ce0b699ad7caaa4726915f740dd6 (tag) tagging 5be63fc19fcaa4c236b307420483578a56986a37 (commit) replaces v6.11-rc4 tagged by Linus Torvalds on Sun Aug 25 19:07:11 2024 +1200 - Shortlog ------------------------------------------------------------ Linux 6.11-rc5 -----BEGIN PGP SIGNATURE----- iQFSBAABCAA8FiEEq68RxlopcLEwq+PEeb4+QwBBGIYFAmbK2B8eHHRvcnZhbGRz QGxpbnV4LWZvdW5kYXRpb24ub3JnAAoJEHm+PkMAQRiGFwkH/10QpUgzIfbFKbF+ 5hwcvaqS5myxWwJ4PjN0eR1qGE6RzVO0Tb24+TVql+7pxu+iWm1kYgC3+/T5xJsP ECAszdmPWSco1xaHrh2y3PyCJjaBiqFbIxdjPp7odjDpG9qarbcty8YpWs44u/gd RDXzHUuScEShBhEt0ZhvE1pIDL8jJ8JL3yqOMZ+XaDxtJbjaHw4GHp8efxlBWc8N jZKIVJi22q5NWG5T0tGtPWwzCm0ewA/JNMTEvE9leoSoAgO85NZ0ivxMC76q/tbj BrYk5KnzfhJs4b/n/KtIwWaLTgLyXKGqHMaMq8sbXtp410aUdgnRJO2cl3fI+1vc vxQfAfk= =RemI -----END PGP SIGNATURE----- ----------------------------------------------------------------------- -- linux integration

1 0

[linux-merge]linux integration; annotated tag, v6.11-rc4, created. v6.11-rc4
by postmaster＠open-mesh.org 18 Aug '24

18 Aug '24

The annotated tag, v6.11-rc4 has been created at cd9d19c02d27518ed40a2231d0e0f072dfcebe33 (tag) tagging 47ac09b91befbb6a235ab620c32af719f8208399 (commit) replaces v6.11-rc3 tagged by Linus Torvalds on Sun Aug 18 13:17:27 2024 -0700 - Shortlog ------------------------------------------------------------ Linux 6.11-rc4 -----BEGIN PGP SIGNATURE----- iQFSBAABCAA8FiEEq68RxlopcLEwq+PEeb4+QwBBGIYFAmbCVtceHHRvcnZhbGRz QGxpbnV4LWZvdW5kYXRpb24ub3JnAAoJEHm+PkMAQRiGxzYH/iCMREeTPMP+SrNz EcPnwmTbKlUvITAMIZa/DRljIQzyCkloPV7YCXKr/g0RRpG43epzoM27xOqPY7PB IDwMhfxe7x7+wv567VBnMv/qZyFMlebhiTrkT3TGTOSGMH//AojGqAhijo3l8Gsw bVQ2MJ5Ksor8JeJg84tjlsf02CLULHgTJNrzTv2By5Y/VHaPoPwrlz/7lPUlgrts n1mkAhsyEQPeCaTcnsyWLrccfkBXFIFVbjZtHpOhhZQsWs6HTbli/90vrk2Wj+Gh FEXf3T66jREOZkk0gEuoGjWPo8MKM+QU9JqbGVaafq7i8cQss98wffI28ze/NpDg /x4rRZI= =ww5d -----END PGP SIGNATURE----- ----------------------------------------------------------------------- -- linux integration

1 0

[linux-merge]linux integration; annotated tag, v6.11-rc3, created. v6.11-rc3
by postmaster＠open-mesh.org 11 Aug '24

11 Aug '24

The annotated tag, v6.11-rc3 has been created at 6e47bdbd91c0c22fc9783fc0233ccfdc9b63be9c (tag) tagging 7c626ce4bae1ac14f60076d00eafe71af30450ba (commit) replaces v6.11-rc2 tagged by Linus Torvalds on Sun Aug 11 14:27:14 2024 -0700 - Shortlog ------------------------------------------------------------ Linux 6.11-rc3 -----BEGIN PGP SIGNATURE----- iQFSBAABCAA8FiEEq68RxlopcLEwq+PEeb4+QwBBGIYFAma5LLIeHHRvcnZhbGRz QGxpbnV4LWZvdW5kYXRpb24ub3JnAAoJEHm+PkMAQRiGwUAIAJNwbkdgTIqEsyBU wsFcXGaFSsGJNbTulINJb34jl2gD2yr4pmnnrA0NePW1TUKOnx169hNMF8NWbr/A 0cHIREV9cyfnm/kzAcnHn7cWLSmsKd+x3TnCbCyodDZQDJzdLmw3LQG+4dTNJbw1 WtJO/EoaU4qaydW2VxtApw54sirq5bopZz7rpcRapA1afzbA2TUDbnnuEWjm9KCF 5K+RZTJZA/xI9gqEwJB+/p5FglW4n/T3xcDwaQp5uFsDskgV5e1AUrRLM+icTsem 0Egrs8Ca2Vp4oBM+r9miCSwjRu04jLKyuu20p7AN8zXLyN7WGAjduS15Dv+aHRZ/ 9XABZs0= =/T17 -----END PGP SIGNATURE----- ----------------------------------------------------------------------- -- linux integration

1 0

[linux-merge]linux integration; annotated tag, v6.11-rc2, created. v6.11-rc2
by postmaster＠open-mesh.org 04 Aug '24

04 Aug '24

The annotated tag, v6.11-rc2 has been created at 985513f98be23b25f42fd33c0d53e27a0a0ad705 (tag) tagging de9c2c66ad8e787abec7c9d7eff4f8c3cdd28aed (commit) replaces v6.11-rc1 tagged by Linus Torvalds on Sun Aug 4 13:50:53 2024 -0700 - Shortlog ------------------------------------------------------------ Linux 6.11-rc2 -----BEGIN PGP SIGNATURE----- iQFSBAABCAA8FiEEq68RxlopcLEwq+PEeb4+QwBBGIYFAmav6a0eHHRvcnZhbGRz QGxpbnV4LWZvdW5kYXRpb24ub3JnAAoJEHm+PkMAQRiGLPEH+wYyg1opOK9dabL7 a4t9+ewxwVTOYHJ8uBaFHzaLSKSvVifY7pO7v+bVH1hc7diHpfmcvRWkMVQYQadd XVMYLq4vLGBFC/EOwlcmLCiEvoy+wadKvck+5DdpUUeAjsyp7+K3qZjHXQtF9vZU 4EHny0eJ2b59ApLm0/o8Ee0qWe0lLio6ELJXLqNWJkITdSONvuvOEmQQwBO67VQp SBpwYNmK3BJwrKzkIQjuG0rGsffVAX6FoRhK4tZRGae9piP6ma/qJ0prNDtf5gbC Fo+FxLD1GQAEZdKeFpUbvhcOmOPEqi/ddCdPVA8jqFAGN7DJYJ6dQJkYYLoCYNIl JLtl2Y0= =rJp7 -----END PGP SIGNATURE----- ----------------------------------------------------------------------- -- linux integration

1 0

[doc] backup-redmine,main: doc: open-mesh/OpenHarbors (46f3016b)
by postmaster＠open-mesh.org 03 Aug '24

03 Aug '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine,main >--------------------------------------------------------------- commit 46f3016bb7b82ceaad74bd5c8e6dbfd49b0e9da2 Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Mon Jul 8 14:29:56 2024 +0000 doc: open-mesh/OpenHarbors >--------------------------------------------------------------- 46f3016bb7b82ceaad74bd5c8e6dbfd49b0e9da2 open-mesh/OpenHarbors.textile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/open-mesh/OpenHarbors.textile b/open-mesh/OpenHarbors.textile index efd38343..a4771f68 100644 --- a/open-mesh/OpenHarbors.textile +++ b/open-mesh/OpenHarbors.textile @@ -94,7 +94,7 @@ h3. Solution # Like in scenario A), move the authenticator from the AP into the server room # Client device will have encrypted communication into the server room, AP + wire becomes part of the untrusted medium # No potential to Man-in-the-Middle from outside the server room -# Attacker now *needs a physical key* to the server room to get the sensitive data +# Attacker now *needs a physical key* to the server room to get the sensitive data (or access to the client device) h2. (Additional) Use-cases & Benefits

1 0

[doc] backup-redmine,main: doc: open-mesh/OpenHarbors (24781b1a)
by postmaster＠open-mesh.org 03 Aug '24

03 Aug '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine,main >--------------------------------------------------------------- commit 24781b1a0ebcc3e01bddc689eef9cdb5ed1370ed Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Mon Jul 8 14:28:09 2024 +0000 doc: open-mesh/OpenHarbors >--------------------------------------------------------------- 24781b1a0ebcc3e01bddc689eef9cdb5ed1370ed open-mesh/OpenHarbors.textile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/open-mesh/OpenHarbors.textile b/open-mesh/OpenHarbors.textile index 9d3815fc..efd38343 100644 --- a/open-mesh/OpenHarbors.textile +++ b/open-mesh/OpenHarbors.textile @@ -84,7 +84,7 @@ h3. Issue ** can get physical access to the AP # Can then copy the AP's flash and extract RADIUS credentials # Can then replace with a rogue Man-in-the-Middle AP or install a backdoor -** If no extra encryption/authentication is used between AP<->server then can also simply add a snooping device between AP and wire to server +** If no extra encryption/authentication/tunnel is used between AP<->server then can also simply add a snooping device between AP and wire to server # Now has access to sensitive data in the locked server room h3. Solution

1 0

[doc] backup-redmine,main: doc: open-mesh/OpenHarbors (130f1e45)
by postmaster＠open-mesh.org 03 Aug '24

03 Aug '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine,main >--------------------------------------------------------------- commit 130f1e4508a94d66baf8a4a38a49d6dde539e493 Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Mon Jul 8 14:27:35 2024 +0000 doc: open-mesh/OpenHarbors >--------------------------------------------------------------- 130f1e4508a94d66baf8a4a38a49d6dde539e493 open-mesh/OpenHarbors.textile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/open-mesh/OpenHarbors.textile b/open-mesh/OpenHarbors.textile index c09657f2..9d3815fc 100644 --- a/open-mesh/OpenHarbors.textile +++ b/open-mesh/OpenHarbors.textile @@ -84,7 +84,7 @@ h3. Issue ** can get physical access to the AP # Can then copy the AP's flash and extract RADIUS credentials # Can then replace with a rogue Man-in-the-Middle AP or install a backdoor -** If no extra encryption/authentication is used between AP<->server then can also simply add a snooping device between AP and wire +** If no extra encryption/authentication is used between AP<->server then can also simply add a snooping device between AP and wire to server # Now has access to sensitive data in the locked server room h3. Solution

1 0

[doc] backup-redmine,main: doc: open-mesh/OpenHarbors (cce8a202)
by postmaster＠open-mesh.org 03 Aug '24

03 Aug '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine,main >--------------------------------------------------------------- commit cce8a202712a1f828bd92bba9810bef5587a05db Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Mon Jul 8 14:25:51 2024 +0000 doc: open-mesh/OpenHarbors >--------------------------------------------------------------- cce8a202712a1f828bd92bba9810bef5587a05db open-mesh/OpenHarbors.textile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/open-mesh/OpenHarbors.textile b/open-mesh/OpenHarbors.textile index 1bcaf4cc..c09657f2 100644 --- a/open-mesh/OpenHarbors.textile +++ b/open-mesh/OpenHarbors.textile @@ -75,7 +75,7 @@ h2. Scenario B) Hospital/University/Company/... !university-server-room-scenario-traditional.png! * An exposed AP, visible/reachable by visitors -* A server with sensitive data +* A server with sensitive data inside a locked server room * Authorized employees/students/... accessing the server via WPA Enterprise from their laptop h3. Issue

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

commits August 2024