Messages in this thread | | | From | Sven Eckelmann <> | Subject | Re: batman-adv: design suggestions | Date | Mon, 9 Aug 2010 22:53:58 +0200 |
| |
Vasiliy Kulikov wrote: > Hi folks, > > I was reading batman-adv sources and noted:
Thanks a lot.
> 1) Some incoming packets may cause a storm of error logs, such as at > routing.c:862 > > > if (icmp_packet->msg_type != ECHO_REQUEST) { > pr_warning("Warning - can't forward icmp packet from %pM to " > "%pM: ttl exceeded\n", icmp_packet->orig, > icmp_packet->dst); > > Any flooding bad guy is able to fill our disks with logs. > This should be logged only at some slow rate (e.g. 5 logs/sec) or as > pr_debug().
Correct. So you would prefer pr_warn_ratelimited?
> 2) It seems to me that NF_HOOK() at hard-interface.c:458 is misused: > > ... > ret = NF_HOOK(PF_BRIDGE, NF_BR_LOCAL_IN, skb, dev, NULL, > batman_skb_recv_finish); > if (ret != 1) > goto err_out; > > /* packet should hold at least type and version */ > if (unlikely(skb_headlen(skb) < 2)) > goto err_free; > > /* expect a valid ethernet header here. */ > if (unlikely(skb->mac_len != sizeof(struct ethhdr) > > || !skb_mac_header(skb))) > > goto err_free; > ... > > static int batman_skb_recv_finish(struct sk_buff *skb) > { > return NF_ACCEPT; > } > > As I understand, if there is any hook that returns NF_STOLEN, then skb > is leaked.
@Linus Luessing: Could you please check that.
thanks, Sven [unhandled content-type:application/pgp-signature] | |