* [PATCH 2.6] iptables AH/ESP fix (3/3)
@ 2003-08-02 13:01 ` Harald Welte
0 siblings, 0 replies; 2+ messages in thread
From: Harald Welte @ 2003-08-02 13:01 UTC (permalink / raw)
To: David Miller; +Cc: Netfilter Development Mailinglist, Linux Kernel Mailinglist
[-- Attachment #1: Type: text/plain, Size: 1947 bytes --]
Hi Davem!
The below patch (by Patrick McHardy) fixes the iptables 'esp' match to
use the same structure definition like the 2.5/2.6 in-kernel IPsec
implementation.
Please apply, thanks.
# This is a BitKeeper generated patch for the following project:
# Project Name: Linux kernel tree
# This patch format is intended for GNU patch command version 2.5 or higher.
# This patch includes the following deltas:
# ChangeSet 1.1537 -> 1.1538
# net/ipv4/netfilter/ipt_esp.c 1.6 -> 1.7
#
# The following is the BitKeeper ChangeSet Log
# --------------------------------------------
# 03/07/21 kaber@trash.net 1.1538
# [NETFILTER]: Use common struct ip_esp_hdr declaration
# --------------------------------------------
#
--- a/net/ipv4/netfilter/ipt_esp.c Thu May 22 01:35:36 2003
+++ b/net/ipv4/netfilter/ipt_esp.c Mon Jul 21 02:46:04 2003
@@ -1,6 +1,7 @@
/* Kernel module to match ESP parameters. */
#include <linux/module.h>
#include <linux/skbuff.h>
+#include <linux/ip.h>
#include <linux/netfilter_ipv4/ipt_esp.h>
#include <linux/netfilter_ipv4/ip_tables.h>
@@ -13,10 +14,6 @@
#define duprintf(format, args...)
#endif
-struct esphdr {
- __u32 spi;
-};
-
/* Returns 1 if the spi is matched by the range, 0 otherwise */
static inline int
spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, int invert)
@@ -37,7 +34,7 @@
int offset,
int *hotdrop)
{
- struct esphdr esp;
+ struct ip_esp_hdr esp;
const struct ipt_esp *espinfo = matchinfo;
/* Must not be a fragment. */
--
- Harald Welte <laforge@netfilter.org> http://www.netfilter.org/
============================================================================
"Fragmentation is like classful addressing -- an interesting early
architectural error that shows how much experimentation was going
on while IP was being designed." -- Paul Vixie
[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
* [PATCH 2.6] iptables AH/ESP fix (3/3)
@ 2003-08-02 13:01 ` Harald Welte
0 siblings, 0 replies; 2+ messages in thread
From: Harald Welte @ 2003-08-02 13:01 UTC (permalink / raw)
To: David Miller; +Cc: Netfilter Development Mailinglist, Linux Kernel Mailinglist
[-- Attachment #1: Type: text/plain, Size: 1947 bytes --]
Hi Davem!
The below patch (by Patrick McHardy) fixes the iptables 'esp' match to
use the same structure definition like the 2.5/2.6 in-kernel IPsec
implementation.
Please apply, thanks.
# This is a BitKeeper generated patch for the following project:
# Project Name: Linux kernel tree
# This patch format is intended for GNU patch command version 2.5 or higher.
# This patch includes the following deltas:
# ChangeSet 1.1537 -> 1.1538
# net/ipv4/netfilter/ipt_esp.c 1.6 -> 1.7
#
# The following is the BitKeeper ChangeSet Log
# --------------------------------------------
# 03/07/21 kaber@trash.net 1.1538
# [NETFILTER]: Use common struct ip_esp_hdr declaration
# --------------------------------------------
#
--- a/net/ipv4/netfilter/ipt_esp.c Thu May 22 01:35:36 2003
+++ b/net/ipv4/netfilter/ipt_esp.c Mon Jul 21 02:46:04 2003
@@ -1,6 +1,7 @@
/* Kernel module to match ESP parameters. */
#include <linux/module.h>
#include <linux/skbuff.h>
+#include <linux/ip.h>
#include <linux/netfilter_ipv4/ipt_esp.h>
#include <linux/netfilter_ipv4/ip_tables.h>
@@ -13,10 +14,6 @@
#define duprintf(format, args...)
#endif
-struct esphdr {
- __u32 spi;
-};
-
/* Returns 1 if the spi is matched by the range, 0 otherwise */
static inline int
spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, int invert)
@@ -37,7 +34,7 @@
int offset,
int *hotdrop)
{
- struct esphdr esp;
+ struct ip_esp_hdr esp;
const struct ipt_esp *espinfo = matchinfo;
/* Must not be a fragment. */
--
- Harald Welte <laforge@netfilter.org> http://www.netfilter.org/
============================================================================
"Fragmentation is like classful addressing -- an interesting early
architectural error that shows how much experimentation was going
on while IP was being designed." -- Paul Vixie
[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2003-08-02 13:22 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2003-08-02 13:01 [PATCH 2.6] iptables AH/ESP fix (3/3) Harald Welte
2003-08-02 13:01 ` Harald Welte
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.