PKG_NAME:=batman-adv
-PKG_VERSION:=2012.2.0
-BATCTL_VERSION:=2012.2.0
-PKG_RELEASE:=4
-PKG_MD5SUM:=68967ed1df709de18ab795722dde9341
-BATCTL_MD5SUM:=7abd284098c514d3f2858e8a956c495e
+PKG_VERSION:=2012.3.0
+BATCTL_VERSION:=2012.3.0
+PKG_RELEASE:=1
+PKG_MD5SUM:=9f2d0bb2792fe0db012203d502e2085c
+BATCTL_MD5SUM:=fe9e6a3994539037b48afc5e3d31628c
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=http://downloads.open-mesh.org/batman/releases/batman-adv-$(PKG_VERSION)
+++ /dev/null
-From c7d05ee2b60370392d9c7bb1b764fd36b5aec81b Mon Sep 17 00:00:00 2001
-From: Antonio Quartulli <ordex@autistici.org>
-Date: Thu, 14 Jun 2012 22:21:28 +0200
-Subject: [PATCH] batman-adv: fix skb->data assignment
-
-skb_linearize(skb) possibly rearranges the skb internal data and then changes
-the skb->data pointer value. For this reason any other pointer in the code that
-was assigned skb->data before invoking skb_linearise(skb) must be re-assigned.
-
-In the current tt_query message handling code this is not done and therefore, in
-case of skb linearization, the pointer used to handle the packet header ends up
-in pointing to poisoned memory. The packet is then dropped but the
-translation-table mechanism is corrupted.
-
-Signed-off-by: Antonio Quartulli <ordex@autistici.org>
----
- routing.c | 2 ++
- 1 files changed, 2 insertions(+), 0 deletions(-)
-
-diff --git a/routing.c b/routing.c
-index 840e2c6..015471d 100644
---- a/routing.c
-+++ b/routing.c
-@@ -617,6 +617,8 @@ int recv_tt_query(struct sk_buff *skb, struct hard_iface *recv_if)
- * changes */
- if (skb_linearize(skb) < 0)
- goto out;
-+ /* skb_linearize() possibly changed skb->data */
-+ tt_query = (struct tt_query_packet *)skb->data;
-
- tt_len = tt_query->tt_data * sizeof(struct tt_change);
-
---
-1.7.9.1
-
+++ /dev/null
-From 7c6c6db94848497178cc246585b59fad4368c3e2 Mon Sep 17 00:00:00 2001
-From: Marek Lindner <lindner_marek@yahoo.de>
-Date: Wed, 20 Jun 2012 16:56:04 +0200
-Subject: [PATCH] batman-adv: only drop packets of known wifi clients
-
-If the source or destination mac address of an ethernet packet
-could not be found in the translation table the packet was
-dropped if AP isolation was turned on. This behavior would
-make it impossible to send broadcast packets over the mesh
-as the broadcast address will never enter the translation
-table.
-
-Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
----
- translation-table.c | 8 ++++----
- 1 files changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/translation-table.c b/translation-table.c
-index a66c2dc..660c40f 100644
---- a/translation-table.c
-+++ b/translation-table.c
-@@ -2031,10 +2031,10 @@ bool is_ap_isolated(struct bat_priv *bat_priv, uint8_t *src, uint8_t *dst)
- {
- struct tt_local_entry *tt_local_entry = NULL;
- struct tt_global_entry *tt_global_entry = NULL;
-- bool ret = true;
-+ bool ret = false;
-
- if (!atomic_read(&bat_priv->ap_isolation))
-- return false;
-+ goto out;
-
- tt_local_entry = tt_local_hash_find(bat_priv, dst);
- if (!tt_local_entry)
-@@ -2044,10 +2044,10 @@ bool is_ap_isolated(struct bat_priv *bat_priv, uint8_t *src, uint8_t *dst)
- if (!tt_global_entry)
- goto out;
-
-- if (_is_ap_isolated(tt_local_entry, tt_global_entry))
-+ if (!_is_ap_isolated(tt_local_entry, tt_global_entry))
- goto out;
-
-- ret = false;
-+ ret = true;
-
- out:
- if (tt_global_entry)
---
-1.7.9.1
-
+++ /dev/null
-From d1f13e24ec3ebdadc2bc08c9d4708197279096fa Mon Sep 17 00:00:00 2001
-From: Antonio Quartulli <ordex@autistici.org>
-Date: Wed, 20 Jun 2012 14:12:56 +0200
-Subject: [PATCH] batman-adv: fix race condition in TT full-table replacement
-
-bug introduced with cea194d90b11aff7fc289149e4c7f305fad3535a
-
-In the current TT code, when a TT_Response containing a full table is received
-from an originator, first the node purges all the clients for that originator in
-the global translation-table and then merges the newly received table.
-During the purging phase each client deletion is done by means of a call_rcu()
-invocation and at the end of this phase the global entry counter for that
-originator is set to 0. However the invoked rcu function decreases the global
-entry counter for that originator by one too and since the rcu invocation is
-likely to be postponed, the node will end up in first setting the counter to 0
-and then decreasing it one by one for each deleted client.
-
-This bug leads to having a wrong global entry counter for the related node, say
-X. Then when the node with the broken counter will answer to a TT_REQUEST on
-behalf of node X, it will create faulty TT_RESPONSE that will generate an
-unrecoverable situation on the node that asked for the full table recover.
-
-The non-recoverability is given by the fact that the node with the broken
-counter will keep answering on behalf of X because its knowledge about X's state
-(ttvn + tt_crc) is correct.
-
-To solve this problem the counter is not explicitly set to 0 anymore and the
-counter decrement is performed right before the invocation of call_rcu().
-
-Signed-off-by: Antonio Quartulli <ordex@autistici.org>
----
- translation-table.c | 4 ++--
- 1 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/translation-table.c b/translation-table.c
-index 660c40f..2ab83d7 100644
---- a/translation-table.c
-+++ b/translation-table.c
-@@ -141,13 +141,14 @@ static void tt_orig_list_entry_free_rcu(struct rcu_head *rcu)
- struct tt_orig_list_entry *orig_entry;
-
- orig_entry = container_of(rcu, struct tt_orig_list_entry, rcu);
-- atomic_dec(&orig_entry->orig_node->tt_size);
- orig_node_free_ref(orig_entry->orig_node);
- kfree(orig_entry);
- }
-
- static void tt_orig_list_entry_free_ref(struct tt_orig_list_entry *orig_entry)
- {
-+ /* to avoid race conditions, immediately decrease the tt counter */
-+ atomic_dec(&orig_entry->orig_node->tt_size);
- call_rcu(&orig_entry->rcu, tt_orig_list_entry_free_rcu);
- }
-
-@@ -910,7 +911,6 @@ void tt_global_del_orig(struct bat_priv *bat_priv,
- }
- spin_unlock_bh(list_lock);
- }
-- atomic_set(&orig_node->tt_size, 0);
- orig_node->tt_initialised = false;
- }
-
---
-1.7.9.1
-
+++ /dev/null
-From 0a29f3a348c68f375585e25153da0f0a061fd71d Mon Sep 17 00:00:00 2001
-From: Marek Lindner <lindner_marek@yahoo.de>
-Date: Sun, 22 Jul 2012 13:04:48 +0200
-Subject: [PATCH] batman-adv: select an internet gateway if none was chosen
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This is a regression introduced by: 6a17ecc4603be7f065c38b288d038a0082bbf21d
-
-Reported-by: Nicolás Echániz <nicoechaniz@codigosur.org>
-Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
----
- gateway_client.c | 6 +++---
- 1 files changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/gateway_client.c b/gateway_client.c
-index 47f7186..dace001 100644
---- a/gateway_client.c
-+++ b/gateway_client.c
-@@ -197,11 +197,11 @@ void gw_election(struct bat_priv *bat_priv)
- if (atomic_read(&bat_priv->gw_mode) != GW_MODE_CLIENT)
- goto out;
-
-- if (!atomic_dec_not_zero(&bat_priv->gw_reselect))
-- goto out;
--
- curr_gw = gw_get_selected_gw_node(bat_priv);
-
-+ if (!atomic_dec_not_zero(&bat_priv->gw_reselect) && curr_gw)
-+ goto out;
-+
- next_gw = gw_get_best_gw_node(bat_priv);
-
- if (curr_gw == next_gw)
---
-1.7.9.1
-
+++ /dev/null
-From e32470167379db2ca7713108f1e917c531426eee Mon Sep 17 00:00:00 2001
-From: Simon Wunderlich <simon.wunderlich@s2003.tu-chemnitz.de>
-Date: Wed, 4 Jul 2012 20:38:19 +0200
-Subject: [PATCH] batman-adv: check incoming packet type for bla
-
-If the gateway functionality is used, some broadcast packets (DHCP
-requests) may be transmitted as unicast packets. As the bridge loop
-avoidance code now only considers the payload Ethernet destination,
-it may drop the DHCP request for clients which are claimed by other
-backbone gateways, because it falsely infers from the broadcast address
-that the right backbone gateway should havehandled the broadcast.
-
-Fix this by checking and delegating the batman-adv packet type used
-for transmission.
-
-Reported-by: Guido Iribarren <guidoiribarren@buenosaireslibre.org>
-Signed-off-by: Simon Wunderlich <siwu@hrz.tu-chemnitz.de>
----
- bridge_loop_avoidance.c | 15 +++++++++++----
- bridge_loop_avoidance.h | 5 +++--
- soft-interface.c | 6 +++++-
- 3 files changed, 19 insertions(+), 7 deletions(-)
-
-diff --git a/bridge_loop_avoidance.c b/bridge_loop_avoidance.c
-index 8bf9751..c5863f4 100644
---- a/bridge_loop_avoidance.c
-+++ b/bridge_loop_avoidance.c
-@@ -1351,6 +1351,7 @@ void bla_free(struct bat_priv *bat_priv)
- * @bat_priv: the bat priv with all the soft interface information
- * @skb: the frame to be checked
- * @vid: the VLAN ID of the frame
-+ * @is_bcast: the packet came in a broadcast packet type.
- *
- * bla_rx avoidance checks if:
- * * we have to race for a claim
-@@ -1361,7 +1362,8 @@ void bla_free(struct bat_priv *bat_priv)
- * process the skb.
- *
- */
--int bla_rx(struct bat_priv *bat_priv, struct sk_buff *skb, short vid)
-+int bla_rx(struct bat_priv *bat_priv, struct sk_buff *skb, short vid,
-+ bool is_bcast)
- {
- struct ethhdr *ethhdr;
- struct claim search_claim, *claim = NULL;
-@@ -1380,7 +1382,7 @@ int bla_rx(struct bat_priv *bat_priv, struct sk_buff *skb, short vid)
-
- if (unlikely(atomic_read(&bat_priv->bla_num_requests)))
- /* don't allow broadcasts while requests are in flight */
-- if (is_multicast_ether_addr(ethhdr->h_dest))
-+ if (is_multicast_ether_addr(ethhdr->h_dest) && is_bcast)
- goto handled;
-
- memcpy(search_claim.addr, ethhdr->h_source, ETH_ALEN);
-@@ -1406,8 +1408,13 @@ int bla_rx(struct bat_priv *bat_priv, struct sk_buff *skb, short vid)
- }
-
- /* if it is a broadcast ... */
-- if (is_multicast_ether_addr(ethhdr->h_dest)) {
-- /* ... drop it. the responsible gateway is in charge. */
-+ if (is_multicast_ether_addr(ethhdr->h_dest) && is_bcast) {
-+ /* ... drop it. the responsible gateway is in charge.
-+ *
-+ * We need to check is_bcast because with the gateway
-+ * feature, broadcasts (like DHCP requests) may be sent
-+ * using a unicast packet type.
-+ */
- goto handled;
- } else {
- /* seems the client considers us as its best gateway.
-diff --git a/bridge_loop_avoidance.h b/bridge_loop_avoidance.h
-index e39f93a..dc5227b 100644
---- a/bridge_loop_avoidance.h
-+++ b/bridge_loop_avoidance.h
-@@ -23,7 +23,8 @@
- #define _NET_BATMAN_ADV_BLA_H_
-
- #ifdef CONFIG_BATMAN_ADV_BLA
--int bla_rx(struct bat_priv *bat_priv, struct sk_buff *skb, short vid);
-+int bla_rx(struct bat_priv *bat_priv, struct sk_buff *skb, short vid,
-+ bool is_bcast);
- int bla_tx(struct bat_priv *bat_priv, struct sk_buff *skb, short vid);
- int bla_is_backbone_gw(struct sk_buff *skb,
- struct orig_node *orig_node, int hdr_size);
-@@ -41,7 +42,7 @@ void bla_free(struct bat_priv *bat_priv);
- #else /* ifdef CONFIG_BATMAN_ADV_BLA */
-
- static inline int bla_rx(struct bat_priv *bat_priv, struct sk_buff *skb,
-- short vid)
-+ short vid, bool is_bcast)
- {
- return 0;
- }
-diff --git a/soft-interface.c b/soft-interface.c
-index 6e2530b..a0ec0e4 100644
---- a/soft-interface.c
-+++ b/soft-interface.c
-@@ -256,7 +256,11 @@ void interface_rx(struct net_device *soft_iface,
- struct bat_priv *bat_priv = netdev_priv(soft_iface);
- struct ethhdr *ethhdr;
- struct vlan_ethhdr *vhdr;
-+ struct batman_header *batadv_header = (struct batman_header *)skb->data;
- short vid __maybe_unused = -1;
-+ bool is_bcast;
-+
-+ is_bcast = (batadv_header->packet_type == BAT_BCAST);
-
- /* check if enough space is available for pulling, and pull */
- if (!pskb_may_pull(skb, hdr_size))
-@@ -302,7 +306,7 @@ void interface_rx(struct net_device *soft_iface,
- /* Let the bridge loop avoidance check the packet. If will
- * not handle it, we can safely push it up.
- */
-- if (bla_rx(bat_priv, skb, vid))
-+ if (bla_rx(bat_priv, skb, vid, is_bcast))
- goto out;
-
- netif_rx(skb);
---
-1.7.9.1
-
projects / openwrt / svn-archive / archive.git / commitdiff