The following commit has been merged in the next branch: commit 74e9b222da4641ee337c62727c58a18aea8754cf Author: Sven Eckelmann sven@narfation.org Date: Thu Jun 28 11:56:53 2012 +0200

batctl: Don't leak information through uninitialized packet fields

The reserved fields in batman-adv packets are not set to a constant value. The content of these memory regions is leaked unintentionally to the network.

This regression was introduced in ee319368e5d6385458345731e519640889c177c4

Signed-off-by: Sven Eckelmann sven@narfation.org

diff --git a/ping.c b/ping.c index 85b4137..b6199c6 100644 --- a/ping.c +++ b/ping.c @@ -174,6 +174,8 @@ int ping(char *mesh_iface, int argc, char **argv) icmp_packet_out.rr_cur = 1; memset(&icmp_packet_out.rr, 0, BATADV_RR_LEN * ETH_ALEN); memset(last_rr, 0, BATADV_RR_LEN * ETH_ALEN); + } else { + ((struct batadv_icmp_packet *)&icmp_packet_out)->reserved = 0; }

printf("PING %s (%s) %zu(%zu) bytes of data\n", dst_string, mac_string, diff --git a/traceroute.c b/traceroute.c index 31f77b0..aae9fa7 100644 --- a/traceroute.c +++ b/traceroute.c @@ -125,6 +125,7 @@ int traceroute(char *mesh_iface, int argc, char **argv) icmp_packet_out.header.packet_type = BATADV_ICMP; icmp_packet_out.msg_type = BATADV_ECHO_REQUEST; icmp_packet_out.seqno = 0; + icmp_packet_out.reserved = 0;

printf("traceroute to %s (%s), %d hops max, %zu byte packets\n", dst_string, mac_string, TTL_MAX, sizeof(icmp_packet_out));