[Freeipmi-devel] [bug #38781] Errant "Legacy PAD" byte added to IPMI 2.0 (RMCP+) packets

[anonymous]

URL:
  <http://savannah.gnu.org/bugs/?38781>

                 Summary: Errant "Legacy PAD" byte added to IPMI 2.0 (RMCP+)
packets
                 Project: GNU FreeIPMI
            Submitted by: None
            Submitted on: Sat 20 Apr 2013 09:10:21 AM UTC
                Category: libfreeipmi
                Severity: 3 - Normal
                Priority: 5 - Normal
              Item Group: Improper Behaviour
                  Status: None
                 Privacy: Public
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any
        Operating System: None

    _______________________________________________________

Details:

In ipmi-lan-interface.c->ipmi_lan_sendto(), the following code exists:

/*
    Note from Table 12-8, RMCP Packet for IPMI via Ethernet footnote
    Some LAN adapter chips may have a problem where packets of overall
    lengths 56, 84, 112, 128, or 156 are not handled correctly. The
    PAD byte is added as necessary to avoid these overall
    lengths. Remote console software must use the PAD byte when
    formatting packets to any 10/100 Ethernet device that accepts RMCP
    packets. -- Anand Babu
  */
  _len = len;
  if (_len == 56
      || _len == 84
      || _len == 112
      || _len == 128
      || _len == 156)
    pad_len += IPMI_LAN_PKT_PAD_SIZE;

The problem is that this code should *only* apply to IPMI 1.5 packets and
should *not* apply to IPMI 2.0 (RMCP+) packets. This code causes integrity
(AuthCode) check failures when used with IPMI 2.0 servers (BMCs) when the
packet size happens to be one of the "magic" lengths shown above.

You can observe this problem with the following example command (and many
others):

ipmi-dcmi -h 192.168.1.19 --set-asset-tag=1234567890123

The solution is to either:
1. remove this code
2. create another ipmi_lan2_sendto() function which doesn't perform this
padding
3. add an argument to ipmi_lan_sendto() to defeat this behavior when called
from _api_lan_2_0_cmd_send().

-Rob Swindell




    _______________________________________________________

Reply to this item at:

  <http://savannah.gnu.org/bugs/?38781>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.gnu.org/