Commit 3c26f1f6 authored by Thomas Pedersen's avatar Thomas Pedersen Committed by John W. Linville
Browse files

mac80211: fix switched HWMP frame addresses 



HWMP originator and target addresses were switched on the air but also
on reception, which is why path selection still worked.

Signed-off-by: default avatarThomas Pedersen <thomas@cozybit.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 7e3c8866

net/mac80211/mesh_hwmp.c

+11 −19
Original line number Diff line number Diff line
@@ -393,15 +393,13 @@ static u32 hwmp_route_info_get(struct ieee80211_sub_if_data *sdata, 
		orig_metric = PREQ_IE_METRIC(hwmp_ie);

		break;

	case MPATH_PREP:

		/* Originator here refers to the MP that was the destination in

		 * the Path Request. The draft refers to that MP as the

		 * destination address, even though usually it is the origin of

		 * the PREP frame. We divert from the nomenclature in the draft

		/* Originator here refers to the MP that was the target in the

		 * Path Request. We divert from the nomenclature in the draft

		 * so that we can easily use a single function to gather path

		 * information from both PREQ and PREP frames.

		 */

		orig_addr = PREP_IE_ORIG_ADDR(hwmp_ie);

		orig_sn = PREP_IE_ORIG_SN(hwmp_ie);

		orig_addr = PREP_IE_TARGET_ADDR(hwmp_ie);

		orig_sn = PREP_IE_TARGET_SN(hwmp_ie);

		orig_lifetime = PREP_IE_LIFETIME(hwmp_ie);

		orig_metric = PREP_IE_METRIC(hwmp_ie);

		break;
@@ -562,9 +560,9 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata, 
		ttl = ifmsh->mshcfg.element_ttl;

		if (ttl != 0) {

			mhwmp_dbg("replying to the PREQ");

			mesh_path_sel_frame_tx(MPATH_PREP, 0, target_addr,

				cpu_to_le32(target_sn), 0, orig_addr,

				cpu_to_le32(orig_sn), mgmt->sa, 0, ttl,

			mesh_path_sel_frame_tx(MPATH_PREP, 0, orig_addr,

				cpu_to_le32(orig_sn), 0, target_addr,

				cpu_to_le32(target_sn), mgmt->sa, 0, ttl,

				cpu_to_le32(lifetime), cpu_to_le32(metric),

				0, sdata);

		} else
@@ -618,14 +616,8 @@ static void hwmp_prep_frame_process(struct ieee80211_sub_if_data *sdata, 


	mhwmp_dbg("received PREP from %pM", PREP_IE_ORIG_ADDR(prep_elem));



	/* Note that we divert from the draft nomenclature and denominate

	 * destination to what the draft refers to as origininator. So in this

	 * function destnation refers to the final destination of the PREP,

	 * which corresponds with the originator of the PREQ which this PREP

	 * replies

	 */

	target_addr = PREP_IE_TARGET_ADDR(prep_elem);

	if (memcmp(target_addr, sdata->vif.addr, ETH_ALEN) == 0)

	orig_addr = PREP_IE_ORIG_ADDR(prep_elem);

	if (memcmp(orig_addr, sdata->vif.addr, ETH_ALEN) == 0)

		/* destination, no forwarding required */

		return;
@@ -636,7 +628,7 @@ static void hwmp_prep_frame_process(struct ieee80211_sub_if_data *sdata, 
	}



	rcu_read_lock();

	mpath = mesh_path_lookup(target_addr, sdata);

	mpath = mesh_path_lookup(orig_addr, sdata);

	if (mpath)

		spin_lock_bh(&mpath->state_lock);

	else
@@ -651,7 +643,7 @@ static void hwmp_prep_frame_process(struct ieee80211_sub_if_data *sdata, 
	flags = PREP_IE_FLAGS(prep_elem);

	lifetime = PREP_IE_LIFETIME(prep_elem);

	hopcount = PREP_IE_HOPCOUNT(prep_elem) + 1;

	orig_addr = PREP_IE_ORIG_ADDR(prep_elem);

	target_addr = PREP_IE_TARGET_ADDR(prep_elem);

	target_sn = PREP_IE_TARGET_SN(prep_elem);

	orig_sn = PREP_IE_ORIG_SN(prep_elem);