diff mbox

6lowpan: Uncompression of traffic class field was incorrect

Message ID 1384333419-4087-1-git-send-email-jukka.rissanen@linux.intel.com
State Accepted, archived
Delegated to: David Miller
Headers show

Commit Message

Jukka Rissanen Nov. 13, 2013, 9:03 a.m. UTC
If priority/traffic class field in IPv6 header is set (seen when
using ssh), the uncompression sets the TC and Flow fields incorrectly.

Example:

This is IPv6 header of a sent packet. Note the priority/TC (=1) in
the first byte.

00000000: 61 00 00 00 00 2c 06 40 fe 80 00 00 00 00 00 00
00000010: 02 02 72 ff fe c6 42 10 fe 80 00 00 00 00 00 00
00000020: 02 1e ab ff fe 4c 52 57

This gets compressed like this in the sending side

00000000: 72 31 04 06 02 1e ab ff fe 4c 52 57 ec c2 00 16
00000010: aa 2d fe 92 86 4e be c6 ....

In the receiving end, the packet gets uncompressed to this
IPv6 header

00000000: 60 06 06 02 00 2a 1e 40 fe 80 00 00 00 00 00 00
00000010: 02 02 72 ff fe c6 42 10 fe 80 00 00 00 00 00 00
00000020: ab ff fe 4c 52 57 ec c2

First four bytes are set incorrectly and we have also lost
two bytes from destination address.

The fix is to switch the case values in switch statement
when checking the TC field.

Signed-off-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
---
 net/ieee802154/6lowpan.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Comments

Alexander Aring Nov. 13, 2013, 9:14 a.m. UTC | #1
Hi Jukka,

I know there are some issues with traffic class 
compression/uncompression, but I didn't have time to dig into it.
That's all what I can say now about traffic class issue. Maybe there are
more than one issues or not, I need to dig into the code. :-)


Another note:
Since we known you don't need the fragmentation api accroding rfc4944
for blte 6lowpan I will send the udp fixes in the next days, so then you
can work with it and maybe we can share some code.

- Alex
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
David Miller Nov. 14, 2013, 8:22 a.m. UTC | #2
From: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Date: Wed, 13 Nov 2013 11:03:39 +0200

> If priority/traffic class field in IPv6 header is set (seen when
> using ssh), the uncompression sets the TC and Flow fields incorrectly.
> 
> Example:
> 
> This is IPv6 header of a sent packet. Note the priority/TC (=1) in
> the first byte.
> 
> 00000000: 61 00 00 00 00 2c 06 40 fe 80 00 00 00 00 00 00
> 00000010: 02 02 72 ff fe c6 42 10 fe 80 00 00 00 00 00 00
> 00000020: 02 1e ab ff fe 4c 52 57
> 
> This gets compressed like this in the sending side
> 
> 00000000: 72 31 04 06 02 1e ab ff fe 4c 52 57 ec c2 00 16
> 00000010: aa 2d fe 92 86 4e be c6 ....
> 
> In the receiving end, the packet gets uncompressed to this
> IPv6 header
> 
> 00000000: 60 06 06 02 00 2a 1e 40 fe 80 00 00 00 00 00 00
> 00000010: 02 02 72 ff fe c6 42 10 fe 80 00 00 00 00 00 00
> 00000020: ab ff fe 4c 52 57 ec c2
> 
> First four bytes are set incorrectly and we have also lost
> two bytes from destination address.
> 
> The fix is to switch the case values in switch statement
> when checking the TC field.
> 
> Signed-off-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>

Applied, thanks.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/net/ieee802154/6lowpan.c b/net/ieee802154/6lowpan.c
index 426b5df..459e200 100644
--- a/net/ieee802154/6lowpan.c
+++ b/net/ieee802154/6lowpan.c
@@ -956,7 +956,7 @@  lowpan_process_data(struct sk_buff *skb)
 	 * Traffic class carried in-line
 	 * ECN + DSCP (1 byte), Flow Label is elided
 	 */
-	case 1: /* 10b */
+	case 2: /* 10b */
 		if (lowpan_fetch_skb_u8(skb, &tmp))
 			goto drop;
 
@@ -967,7 +967,7 @@  lowpan_process_data(struct sk_buff *skb)
 	 * Flow Label carried in-line
 	 * ECN + 2-bit Pad + Flow Label (3 bytes), DSCP is elided
 	 */
-	case 2: /* 01b */
+	case 1: /* 01b */
 		if (lowpan_fetch_skb_u8(skb, &tmp))
 			goto drop;