Once again a round of bugfixes in the db exchange process. This is

one of the worst documented parts of the RFC.
The initial packet sent by the slave may have no flags set. Don't
enforce that the M bit is set but instead check that the I bit and
MS bit are unset.
The master should only issue NBR_EVT_XCHNG_DONE if it has sent at
least one packet with M bit cleared else the slave may get stuck
in state Exchange.
In NBR_STA_LOAD the db_tx_timer() still needs to send db descriptions
out. This will be the last packet sent with the cleared M bit.

1 files changed, 5 insertions, 4 deletions

diff --git a/usr.sbin/ospfd/database.c b/usr.sbin/ospfd/database.c
index d94c988f7c5..dd0f5b5cd78 100644
--- a/usr.sbin/ospfd/database.c
+++ b/usr.sbin/ospfd/database.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: database.c,v 1.3 2005/02/02 19:15:07 henning Exp $ */
+/*	$OpenBSD: database.c,v 1.4 2005/02/09 15:39:22 claudio Exp $ */
 
 /*
  * Copyright (c) 2005 Claudio Jeker <claudio@openbsd.org>
@@ -251,7 +251,7 @@ recv_db_description(struct nbr *nbr, char *buf, u_int16_t len)
 				/* event negotiation done */
 				nbr_fsm(nbr, NBR_EVT_NEG_DONE);
 			}
-		} else if (dd_hdr.bits == OSPF_DBD_M) {
+		} else if (!(dd_hdr.bits & (OSPF_DBD_I | OSPF_DBD_MS))) {
 			/* master */
 			if (ntohl(dd_hdr.dd_seq_num) != nbr->dd_seq_num) {
 				log_warnx("recv_db_description: invalid "
@@ -347,7 +347,8 @@ recv_db_description(struct nbr *nbr, char *buf, u_int16_t len)
 
 		if (!(dd_hdr.bits & OSPF_DBD_M) &&
 		    TAILQ_EMPTY(&nbr->db_sum_list))
-			nbr_fsm(nbr, NBR_EVT_XCHNG_DONE);
+			if (!nbr->master || !(nbr->options & OSPF_DBD_M))
+				nbr_fsm(nbr, NBR_EVT_XCHNG_DONE);
 		break;
 	default:
 		fatalx("recv_db_description: unknown neighbor state");
@@ -404,10 +405,10 @@ db_tx_timer(int fd, short event, void *arg)
 	case NBR_STA_INIT:
 	case NBR_STA_2_WAY:
 	case NBR_STA_SNAP:
-	case NBR_STA_LOAD:
 		return ;
 	case NBR_STA_XSTRT:
 	case NBR_STA_XCHNG:
+	case NBR_STA_LOAD:
 	case NBR_STA_FULL:
 		send_db_description(nbr);
 		break;