o11s / open80211s

open80211s
Other
242 stars 55 forks source link

off-by-one in RANN ttl processing #7

Open jcard0na opened 12 years ago

jcard0na commented 12 years ago

Reported-by: Monthadar Al Jaberi monthadar@gmail.com

  • You don't check ttl when propagating RANN, but you do check when receiving it if (ttl <= 1) { ifmsh->mshstats.dropped_frames_ttl++; return; } ttl--;

Thanks for reporting, you are right. The element_ttl value defaults to 31. Without the check you propose users could shoot themselves on the foot by setting it to 0.

but thats wrong too, cause when you receive it you should process it and then not propagate.

Right, this is an issue only in the last node of the RANN propagation chain (e.g. with the default value, the RANN would be ignored at the 30th hop instead of the 31st.