Commit a44ebeff authored Jun 07, 2018 by Linus Lüssing Committed by Simon Wunderlich Jun 23, 2018

batman-adv: Fix multicast TT issues with bogus ROAM flags



When a (broken) node wrongly sends multicast TT entries with a ROAM
flag then this causes any receiving node to drop all entries for the
same multicast MAC address announced by other nodes, leading to
packet loss.

Fix this DoS vector by only storing TT sync flags. For multicast TT
non-sync'ing flag bits like ROAM are unused so far anyway.

Fixes: 1d8ab8d3 ("batman-adv: Modified forwarding behaviour for multicast packets")
Reported-by: Leonardo Mörlein <me@irrelefant.net>
Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>

parent 4a519b83

net/batman-adv/translation-table.c

+4 −2

Original line number	Diff line number	Diff line
		@@ -1705,6 +1705,7 @@ static bool batadv_tt_global_add(struct batadv_priv *bat_priv,
		ether_addr_copy(common->addr, tt_addr);
		common->vid = vid;

		if (!is_multicast_ether_addr(common->addr))
		common->flags = flags & (~BATADV_TT_SYNC_MASK);

		tt_global_entry->roam_at = 0;
		@@ -1769,6 +1770,7 @@ static bool batadv_tt_global_add(struct batadv_priv *bat_priv,
		* TT_CLIENT_TEMP, therefore they have to be copied in the
		* client entry
		*/
		if (!is_multicast_ether_addr(common->addr))
		common->flags \|= flags & (~BATADV_TT_SYNC_MASK);

		/* If there is the BATADV_TT_CLIENT_ROAM flag set, there is only