Fixes a bug in LSA flooding.

LSAs are sometimes prematurely removed from LS retransmission lists.

1 files changed, 15 insertions, 21 deletions

diff --git a/proto/ospf/lsupd.c b/proto/ospf/lsupd.c
index 7d5d89da..62e7eac1 100644
--- a/proto/ospf/lsupd.c
+++ b/proto/ospf/lsupd.c
@@ -241,9 +241,6 @@ ospf_lsupd_flood(struct proto_ospf *po,
 	if ((en = ospf_hash_find_header(nn->lsrth, domain, hh)) != NULL)
 	{
 	  s_rem_node(SNODE en);
-	  if (en->lsa_body != NULL)
-	    mb_free(en->lsa_body);
-	  en->lsa_body = NULL;
 	  ospf_hash_delete(nn->lsrth, en);
 	}
       }
@@ -585,20 +582,9 @@ ospf_lsupd_receive(struct ospf_packet *ps_i, struct ospf_iface *ifa,
 	continue;
       }
 
-      if (ospf_lsupd_flood(po, n, lsa, &lsatmp, domain, 1) == 0)
-      {
-	DBG("Wasn't flooded back\n");	/* ps 144(5e), pg 153 */
-	if (ifa->state == OSPF_IS_BACKUP)
-	{
-	  if (ifa->drid == n->rid)
-	    ospf_lsack_enqueue(n, lsa, ACKL_DELAY);
-	}
-	else
-	  ospf_lsack_enqueue(n, lsa, ACKL_DELAY);
-      }
-
       /* Remove old from all ret lists */
       /* pg 144 (5c) */
+      /* Must be done before (5b), otherwise it also removes the new entries from (5b) */
       if (lsadb)
 	WALK_LIST(ift, po->iface_list)
 	  WALK_LIST(ntmp, ift->neigh_list)
@@ -608,13 +594,23 @@ ospf_lsupd_receive(struct ospf_packet *ps_i, struct ospf_iface *ifa,
 	  if ((en = ospf_hash_find_header(ntmp->lsrth, domain, &lsadb->lsa)) != NULL)
 	  {
 	    s_rem_node(SNODE en);
-	    if (en->lsa_body != NULL)
-	      mb_free(en->lsa_body);
-	    en->lsa_body = NULL;
 	    ospf_hash_delete(ntmp->lsrth, en);
 	  }
       }
 
+      /* pg 144 (5b) */
+      if (ospf_lsupd_flood(po, n, lsa, &lsatmp, domain, 1) == 0)
+      {
+	DBG("Wasn't flooded back\n");	/* ps 144(5e), pg 153 */
+	if (ifa->state == OSPF_IS_BACKUP)
+	{
+	  if (ifa->drid == n->rid)
+	    ospf_lsack_enqueue(n, lsa, ACKL_DELAY);
+	}
+	else
+	  ospf_lsack_enqueue(n, lsa, ACKL_DELAY);
+      }
+
       if ((lsatmp.age == LSA_MAXAGE) && (lsatmp.sn == LSA_MAXSEQNO)
 	  && lsadb && can_flush_lsa(po))
       {
@@ -661,10 +657,8 @@ ospf_lsupd_receive(struct ospf_packet *ps_i, struct ospf_iface *ifa,
       {
 	/* pg145 (7a) */
 	s_rem_node(SNODE en);
-	if (en->lsa_body != NULL)
-	  mb_free(en->lsa_body);
-	en->lsa_body = NULL;
 	ospf_hash_delete(n->lsrth, en);
+
 	if (ifa->state == OSPF_IS_BACKUP)
 	{
 	  if (n->rid == ifa->drid)