RE: [Freeipmi-devel] Using libfreeipmi interface

[Cress, Andrew R]

The library works if that check is removed (patch applied), it fails if
that check is present.  

If there is still any doubt about this bug, you can build a test case
against any IPMI-compliant system where the sequence number goes above
63 (0x3F) and when FreeIPMI wraps it to 0, you can watch it be
discarded.   The ping apps don't have sessions, so they won't see this.


Andy

-----Original Message-----
From: address@hidden
[mailto:address@hidden On
Behalf Of Cress, Andrew R
Sent: Friday, October 29, 2004 11:45 AM
To: Ian Zimmerman; address@hidden
Subject: RE: [Freeipmi-devel] Using libfreeipmi interface


Ian,

In IPMI 1.5 sections 6.11.8 through 6.11.11 it describes sequence number
handling for outbound and inbound.
Regarding wrapping, the spec clearly says that FFFF_FFFFh wraps to
0000_0000h, but otherwise packets with lower sequence numbers than the
current seqnum shall be "silently discarded".

Andy

-----Original Message-----
From: address@hidden
[mailto:address@hidden On
Behalf Of Ian Zimmerman
Sent: Thursday, October 28, 2004 9:00 PM
To: address@hidden
Subject: Re: [Freeipmi-devel] Using libfreeipmi interface



Andrew> I also found a problem with the IPMI_LAN_SEQ_NUM_MAX (=0x3F).
Andrew> There isn't any precedent in IPMI 1.5 for this, and limiting the
Andrew> 32- bitsequence number to 6 bits causes some problems, since the
Andrew> BMC LAN won't handle wrapping the sequence number back to 0 or 1
Andrew> after 63 (0x3f).

Al> I'm not quite convinced this is a problem.  The bounds check makes
Al> the user knowledgeable to the fact that arbitrary sequence numbers
Al> aren't allowed.  I spoke to a few other developers I work with, and
Al> they feel that the bounds checking is more appropriate.  Ab, Ian,
Al> Bala, what are your thoughts??

Ian> Hmm, where is the sequence number field specified?  The closest I
Ian> see is Figure 12-4 which is unfortunately quite unclear (to me at
Ian> least).  It doesn't say how many bits are taken by the LUN and how
Ian> many by Rqseq.  How have we come by tmpl_lan_msg_hdr_r[sq] - by
Ian> experiment?

Sorry for replying to myself :-)  Regardless of the spec, just the fact
that the number is going to be stuffed into a 6 bit field justifies the
check, IMHO.


_______________________________________________
Freeipmi-devel mailing list
address@hidden
http://lists.gnu.org/mailman/listinfo/freeipmi-devel


_______________________________________________
Freeipmi-devel mailing list
address@hidden
http://lists.gnu.org/mailman/listinfo/freeipmi-devel