summaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorNick Bowler <nbowler@ellipticsemi.com>2007-10-06 20:34:18 +0200
committerAdrian Bunk <bunk@stusta.de>2007-10-06 20:34:18 +0200
commit1104012f7911f1b46a4cdd23c4b949337211920f (patch)
tree7608963ce55599154095a983ab2b033ec8445b5a /net
parent334b8bd4137e9954494b2c5f625b8e7528b372df (diff)
[IPSEC] AH4: Update IPv4 options handling to conform to RFC 4302.
In testing our ESP/AH offload hardware, I discovered an issue with how AH handles mutable fields in IPv4. RFC 4302 (AH) states the following on the subject: For IPv4, the entire option is viewed as a unit; so even though the type and length fields within most options are immutable in transit, if an option is classified as mutable, the entire option is zeroed for ICV computation purposes. The current implementation does not zero the type and length fields, resulting in authentication failures when communicating with hosts that do (i.e. FreeBSD). I have tested record route and timestamp options (ping -R and ping -T) on a small network involving Windows XP, FreeBSD 6.2, and Linux hosts, with one router. In the presence of these options, the FreeBSD and Linux hosts (with the patch or with the hardware) can communicate. The Windows XP host simply fails to accept these packets with or without the patch. I have also been trying to test source routing options (using traceroute -g), but haven't had much luck getting this option to work *without* AH, let alone with. Signed-off-by: Nick Bowler <nbowler@ellipticsemi.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Adrian Bunk <bunk@kernel.org>
Diffstat (limited to 'net')
-rw-r--r--net/ipv4/ah4.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index aed537fa2c88..12af78ebdfe1 100644
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -46,7 +46,7 @@ static int ip_clear_mutable_options(struct iphdr *iph, u32 *daddr)
memcpy(daddr, optptr+optlen-4, 4);
/* Fall through */
default:
- memset(optptr+2, 0, optlen-2);
+ memset(optptr, 0, optlen);
}
l -= optlen;
optptr += optlen;