Commit:     96fe1c0237224b24a0dfaaee6467a5767902ba4a
Parent:     50c46637aa894f904e2fb39086a3d7732f68bd50
Author:     Nick Bowler <[EMAIL PROTECTED]>
AuthorDate: Wed Aug 22 12:33:51 2007 -0700
Committer:  David S. Miller <[EMAIL PROTECTED]>
CommitDate: Sun Aug 26 18:35:33 2007 -0700

    [IPSEC] AH4: Update IPv4 options handling to conform to RFC 4302.
    In testing our ESP/AH offload hardware, I discovered an issue with how
    AH handles mutable fields in IPv4.  RFC 4302 (AH) states the following
    on the subject:
            For IPv4, the entire option is viewed as a unit; so even
            though the type and length fields within most options are immutable
            in transit, if an option is classified as mutable, the entire option
            is zeroed for ICV computation purposes.
    The current implementation does not zero the type and length fields,
    resulting in authentication failures when communicating with hosts
    that do (i.e. FreeBSD).
    I have tested record route and timestamp options (ping -R and ping -T)
    on a small network involving Windows XP, FreeBSD 6.2, and Linux hosts,
    with one router.  In the presence of these options, the FreeBSD and
    Linux hosts (with the patch or with the hardware) can communicate.
    The Windows XP host simply fails to accept these packets with or
    without the patch.
    I have also been trying to test source routing options (using
    traceroute -g), but haven't had much luck getting this option to work
    *without* AH, let alone with.
    Signed-off-by: Nick Bowler <[EMAIL PROTECTED]>
    Signed-off-by: David S. Miller <[EMAIL PROTECTED]>
 net/ipv4/ah4.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index 7a23e59..39f6211 100644
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -46,7 +46,7 @@ static int ip_clear_mutable_options(struct iphdr *iph, __be32 
                        memcpy(daddr, optptr+optlen-4, 4);
                        /* Fall through */
-                       memset(optptr+2, 0, optlen-2);
+                       memset(optptr, 0, optlen);
                l -= optlen;
                optptr += optlen;
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at

Reply via email to