[ieee80211_hwmp][panic] hwmp_recv_prep(...)

[Adrian Chadd]

Besides being a potential DoS vector (and thus panicing on anything
like that == bad idea), what legitimate-but-broken circumstances could
cause a node to hear its own announcement?



Adrian


On 15 February 2011 07:00, Monthadar Al Jaberi <monthadar at gmail.com> wrote:
> Hej,
>
> I found that a panic can be generated when having a couple of
> ieee80211s nodes in a line topology with one of them being a ROOT
> node. A ping from ROOT in a newly started nodes causes a panic:
> panic: ieee80211_mesh_rt_add: adding self to the routing table
> KDB: enter: panic
> [ thread pid 0 tid 100030 ]
> Stopped at      kdb_enter+0x50: lui     at,0x804e
> db>
>
> This is because we receive a copy of our own generated
> IEEE80211_ELEMID_MESHPREP packet from our neighbor node.
> I added check code in the begining of hwmp_recv_prep(...) similar to
> the check code found in hwmp_recv_preq(...). Here is a diff output:
>
> --- freebsd/head/sys/net80211/ieee80211_hwmp.c  2010-11-03
> 09:29:25.023610380 +0000
> +++ src/head-current/sys/net80211/ieee80211_hwmp.c      2011-02-15
> 10:06:02.526163874 +0000
> @@ -28,7 +28,7 @@
>  */
>  #include <sys/cdefs.h>
>  #ifdef __FreeBSD__
> -__FBSDID("$FreeBSD$");
> +__FBSDID("$FreeBSD: src/sys/net80211/ieee80211_hwmp.c,v 1.4.2.7.2.1
> 2010/12/21 17:09:25 kensmith Exp $");
>  #endif
>
>  /*
> @@ -951,6 +951,12 @@
>        if (ni == vap->iv_bss ||
>            ni->ni_mlstate != IEEE80211_NODE_MESH_ESTABLISHED)
>                return;
> +       /*
> +        * Ignore PREPs from us. Could happen because someone forward it
> +        * back to us.
> +        */
> +       if (IEEE80211_ADDR_EQ(vap->iv_myaddr, prep->prep_targetaddr))
> +               return;
>        if (!IEEE80211_ADDR_EQ(vap->iv_myaddr, prep->prep_origaddr) &&
>            !(ms->ms_flags & IEEE80211_MESHFLAGS_FWD))
>                return;
>
> --
> //Monthadar Al Jaberi
> _______________________________________________
> freebsd-net at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-net
> To unsubscribe, send any mail to "freebsd-net-unsubscribe at freebsd.org"
>