Summary:
Even ehen COMP is cleared, the algorithm always elides part of the address when a matching
context is found.
This behviour occurs because in the line
if ((src_ctx != NULL) || ipv6_addr_is_link_local(&(ipv6_hdr->src)))
the COMP bit is not tested.
This patch fixes the problem by setting [src|dst]_ctx to NULL if the
context must not be used.
If all rbuf slots are in use, `_rbuf_gc` removes the oldest entry even if the
entry for the current fragment exists. This effectively decreases usable slots
by one. This patch makes `_rbuf_gc` removes the oldest entry only if there is
no entry for the current fragment.
https://tools.ietf.org/html/rfc4944#section-5.3 says:
> If a link fragment that overlaps another fragment is received, as
> identified above, and differs in either the size or datagram_offset
> of the overlapped fragment, the fragment(s) already accumulated in
> the reassembly buffer SHALL be discarded. A fresh reassembly may be
> commenced with the most recently received link fragment.
When `gnrc_ndp_node_next_hop_l2addr` cannot resolve L2 address, it creates a
temporary neighbor cache entry with interface `KERNEL_PID_UNDEF` (unless the
interface is already known) to send a neighbor solicitation. When another packet
directed to the same address is going to sent before receiving a neighbor
advertisement, `gnrc_sixlowpan_nd_next_hop_l2addr` gets the temporary neighbor
cache entry and calls `gnrc_ipv6_netif_get` with `KERNEL_PID_UNDEF`, resulting
get a `NULL`. We must check `NULL` before dereference it.
FYI, both `gnrc_ndp_node_next_hop_l2addr` and
`gnrc_sixlowpan_nd_next_hop_l2addr` are enabled when
`gnrc_sixlowpan_border_router_default` module is enabled with `GNRC_NETIF_NUMOF`
is greater than 1:
gnrc_sixlowpan_border_router_default
→ gnrc_ipv6_router_default
→ gnrc_ndp_router (if GNRC_NETIF_NUMOF > 1)
→ gnrc_ndp_node
→ gnrc_ndp_node_next_hop_l2addr is called from _next_hop_l2addr
gnrc_sixlowpan_border_router_default
→ gnrc_sixlowpan_nd_border_router
→ gnrc_sixlowpan_nd_router
→ gnrc_sixlowpan_nd
→ gnrc_sixlowpan_nd_next_hop_l2addr is called from _next_hop_l2addr
