[IPSEC]: Lock state when copying non-atomic fields to user-space

[deliverable/linux.git] / net / ipv4 / ah4.c

diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index 7194eb40b6d08cbd2304fb8dd8d9eb415b9a73de..58af298e1941faca1e9ee078e43c6e4a8b12ff5e 100644 (file)
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -46,7 +46,7 @@ static int ip_clear_mutable_options(struct iphdr *iph, __be32 *daddr)
                        memcpy(daddr, optptr+optlen-4, 4);
                        /* Fall through */
                default:
-                       memset(optptr+2, 0, optlen-2);
+                       memset(optptr, 0, optlen);
                }
                l -= optlen;
                optptr += optlen;
@@ -65,7 +65,7 @@ static int ah_output(struct xfrm_state *x, struct sk_buff *skb)
                char            buf[60];
        } tmp_iph;
 
-       top_iph = skb->nh.iph;
+       top_iph = ip_hdr(skb);
        iph = &tmp_iph.iph;
 
        iph->tos = top_iph->tos;
@@ -96,8 +96,7 @@ static int ah_output(struct xfrm_state *x, struct sk_buff *skb)
 
        ah->reserved = 0;
        ah->spi = x->id.spi;
-       ah->seq_no = htonl(++x->replay.oseq);
-       xfrm_aevent_doreplay(x);
+       ah->seq_no = htonl(XFRM_SKB_CB(skb)->seq);
        err = ah_mac_digest(ahp, skb, ah->auth_data);
        if (err)
                goto error;
@@ -152,9 +151,9 @@ static int ah_input(struct xfrm_state *x, struct sk_buff *skb)
        skb->ip_summed = CHECKSUM_NONE;
 
        ah = (struct ip_auth_hdr*)skb->data;
-       iph = skb->nh.iph;
+       iph = ip_hdr(skb);
 
-       ihl = skb->data - skb->nh.raw;
+       ihl = skb->data - skb_network_header(skb);
        memcpy(work_buf, iph, ihl);
 
        iph->ttl = 0;
@@ -181,7 +180,9 @@ static int ah_input(struct xfrm_state *x, struct sk_buff *skb)
                }
        }
        ((struct iphdr*)work_buf)->protocol = ah->nexthdr;
-       skb->h.raw = memcpy(skb->nh.raw += ah_hlen, work_buf, ihl);
+       skb->network_header += ah_hlen;
+       memcpy(skb_network_header(skb), work_buf, ihl);
+       skb->transport_header = skb->network_header;
        __skb_pull(skb, ah_hlen + ihl);
 
        return 0;
@@ -196,8 +197,8 @@ static void ah4_err(struct sk_buff *skb, u32 info)
        struct ip_auth_hdr *ah = (struct ip_auth_hdr*)(skb->data+(iph->ihl<<2));
        struct xfrm_state *x;
 
-       if (skb->h.icmph->type != ICMP_DEST_UNREACH ||
-           skb->h.icmph->code != ICMP_FRAG_NEEDED)
+       if (icmp_hdr(skb)->type != ICMP_DEST_UNREACH ||
+           icmp_hdr(skb)->code != ICMP_FRAG_NEEDED)
                return;
 
        x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, ah->spi, IPPROTO_AH, AF_INET);
@@ -217,10 +218,6 @@ static int ah_init_state(struct xfrm_state *x)
        if (!x->aalg)
                goto error;
 
-       /* null auth can use a zero length key */
-       if (x->aalg->alg_key_len > 512)
-               goto error;
-
        if (x->encap)
                goto error;
 
@@ -228,14 +225,13 @@ static int ah_init_state(struct xfrm_state *x)
        if (ahp == NULL)
                return -ENOMEM;
 
-       ahp->key = x->aalg->alg_key;
-       ahp->key_len = (x->aalg->alg_key_len+7)/8;
        tfm = crypto_alloc_hash(x->aalg->alg_name, 0, CRYPTO_ALG_ASYNC);
        if (IS_ERR(tfm))
                goto error;
 
        ahp->tfm = tfm;
-       if (crypto_hash_setkey(tfm, ahp->key, ahp->key_len))
+       if (crypto_hash_setkey(tfm, x->aalg->alg_key,
+                              (x->aalg->alg_key_len + 7) / 8))
                goto error;
 
        /*
@@ -300,6 +296,7 @@ static struct xfrm_type ah_type =
        .description    = "AH4",
        .owner          = THIS_MODULE,
        .proto          = IPPROTO_AH,
+       .flags          = XFRM_TYPE_REPLAY_PROT,
        .init_state     = ah_init_state,
        .destructor     = ah_destroy,
        .input          = ah_input,
@@ -337,3 +334,4 @@ static void __exit ah4_fini(void)
 module_init(ah4_init);
 module_exit(ah4_fini);
 MODULE_LICENSE("GPL");
+MODULE_ALIAS_XFRM_TYPE(AF_INET, XFRM_PROTO_AH);