diff options
| author | Jeff Garzik <jeff@garzik.org> | 2006-06-22 22:11:56 -0400 |
|---|---|---|
| committer | Jeff Garzik <jeff@garzik.org> | 2006-06-22 22:11:56 -0400 |
| commit | 71d530cd1b6d97094481002a04c77fea1c8e1c22 (patch) | |
| tree | e786da7145d83c19a594adf76ed90d52c51058b1 /net/ipv4/ah4.c | |
| parent | d7a80dad2fe19a2b8c119c8e9cba605474a75a2b (diff) | |
| parent | d588fcbe5a7ba8bba2cebf7799ab2d573717a806 (diff) | |
Merge branch 'master' into upstream
Conflicts:
drivers/scsi/libata-core.c
drivers/scsi/libata-scsi.c
include/linux/pci_ids.h
Diffstat (limited to 'net/ipv4/ah4.c')
| -rw-r--r-- | net/ipv4/ah4.c | 15 |
1 files changed, 7 insertions, 8 deletions
diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c index e2e4771fa4c..c7782230080 100644 --- a/net/ipv4/ah4.c +++ b/net/ipv4/ah4.c @@ -119,6 +119,7 @@ error: static int ah_input(struct xfrm_state *x, struct sk_buff *skb) { int ah_hlen; + int ihl; struct iphdr *iph; struct ip_auth_hdr *ah; struct ah_data *ahp; @@ -149,13 +150,14 @@ static int ah_input(struct xfrm_state *x, struct sk_buff *skb) ah = (struct ip_auth_hdr*)skb->data; iph = skb->nh.iph; - memcpy(work_buf, iph, iph->ihl*4); + ihl = skb->data - skb->nh.raw; + memcpy(work_buf, iph, ihl); iph->ttl = 0; iph->tos = 0; iph->frag_off = 0; iph->check = 0; - if (iph->ihl != 5) { + if (ihl > sizeof(*iph)) { u32 dummy; if (ip_clear_mutable_options(iph, &dummy)) goto out; @@ -164,7 +166,7 @@ static int ah_input(struct xfrm_state *x, struct sk_buff *skb) u8 auth_data[MAX_AH_AUTH_LEN]; memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len); - skb_push(skb, skb->data - skb->nh.raw); + skb_push(skb, ihl); ahp->icv(ahp, skb, ah->auth_data); if (memcmp(ah->auth_data, auth_data, ahp->icv_trunc_len)) { x->stats.integrity_failed++; @@ -172,11 +174,8 @@ static int ah_input(struct xfrm_state *x, struct sk_buff *skb) } } ((struct iphdr*)work_buf)->protocol = ah->nexthdr; - skb->nh.raw = skb_pull(skb, ah_hlen); - memcpy(skb->nh.raw, work_buf, iph->ihl*4); - skb->nh.iph->tot_len = htons(skb->len); - skb_pull(skb, skb->nh.iph->ihl*4); - skb->h.raw = skb->data; + skb->h.raw = memcpy(skb->nh.raw += ah_hlen, work_buf, ihl); + __skb_pull(skb, ah_hlen + ihl); return 0; |