linux 2.6.16.38 w/ vs2.0.3-rc1

[linux-2.6.git] / net / ipv6 / esp6.c

diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 77b4ba6..7b5b94f 100644 (file)
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -31,18 +31,18 @@
 #include <net/esp.h>
 #include <asm/scatterlist.h>
 #include <linux/crypto.h>
+#include <linux/kernel.h>
 #include <linux/pfkeyv2.h>
 #include <linux/random.h>
 #include <net/icmp.h>
 #include <net/ipv6.h>
+#include <net/protocol.h>
 #include <linux/icmpv6.h>
 
-static int esp6_output(struct sk_buff *skb)
+static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
 {
        int err;
        int hdr_len;
-       struct dst_entry *dst = skb->dst;
-       struct xfrm_state *x  = dst->xfrm;
        struct ipv6hdr *top_iph;
        struct ipv6_esp_hdr *esph;
        struct crypto_tfm *tfm;
@@ -68,10 +68,10 @@ static int esp6_output(struct sk_buff *skb)
 
        alen = esp->auth.icv_trunc_len;
        tfm = esp->conf.tfm;
-       blksize = (crypto_tfm_alg_blocksize(tfm) + 3) & ~3;
-       clen = (clen + 2 + blksize-1)&~(blksize-1);
+       blksize = ALIGN(crypto_tfm_alg_blocksize(tfm), 4);
+       clen = ALIGN(clen + 2, blksize);
        if (esp->conf.padlen)
-               clen = (clen + esp->conf.padlen-1)&~(esp->conf.padlen-1);
+               clen = ALIGN(clen, esp->conf.padlen);
 
        if ((nfrags = skb_cow_data(skb, clen-skb->len+alen, &trailer)) < 0) {
                goto error;
@@ -135,7 +135,7 @@ static int esp6_input(struct xfrm_state *x, struct xfrm_decap_state *decap, stru
        struct ipv6_esp_hdr *esph;
        struct esp_data *esp = x->data;
        struct sk_buff *trailer;
-       int blksize = crypto_tfm_alg_blocksize(esp->conf.tfm);
+       int blksize = ALIGN(crypto_tfm_alg_blocksize(esp->conf.tfm), 4);
        int alen = esp->auth.icv_trunc_len;
        int elen = skb->len - sizeof(struct ipv6_esp_hdr) - esp->conf.ivlen - alen;
 
@@ -214,8 +214,7 @@ static int esp6_input(struct xfrm_state *x, struct xfrm_decap_state *decap, stru
 
                padlen = nexthdr[0];
                if (padlen+2 >= elen) {
-                       LIMIT_NETDEBUG(
-                               printk(KERN_WARNING "ipsec esp packet is garbage padlen=%d, elen=%d\n", padlen+2, elen));
+                       LIMIT_NETDEBUG(KERN_WARNING "ipsec esp packet is garbage padlen=%d, elen=%d\n", padlen+2, elen);
                        ret = -EINVAL;
                        goto out;
                }
@@ -238,18 +237,19 @@ out_nofree:
 static u32 esp6_get_max_size(struct xfrm_state *x, int mtu)
 {
        struct esp_data *esp = x->data;
-       u32 blksize = crypto_tfm_alg_blocksize(esp->conf.tfm);
+       u32 blksize = ALIGN(crypto_tfm_alg_blocksize(esp->conf.tfm), 4);
 
        if (x->props.mode) {
-               mtu = (mtu + 2 + blksize-1)&~(blksize-1);
+               mtu = ALIGN(mtu + 2, blksize);
        } else {
                /* The worst case. */
-               mtu += 2 + blksize;
+               u32 padsize = ((blksize - 1) & 7) + 1;
+               mtu = ALIGN(mtu + 2, padsize) + blksize - padsize;
        }
        if (esp->conf.padlen)
-               mtu = (mtu + esp->conf.padlen-1)&~(esp->conf.padlen-1);
+               mtu = ALIGN(mtu, esp->conf.padlen);
 
-       return mtu + x->props.header_len + esp->auth.icv_full_len;
+       return mtu + x->props.header_len + esp->auth.icv_trunc_len;
 }
 
 static void esp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
@@ -266,8 +266,7 @@ static void esp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
        x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, esph->spi, IPPROTO_ESP, AF_INET6);
        if (!x)
                return;
-       printk(KERN_DEBUG "pmtu discovery on SA ESP/%08x/"
-                       "%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x\n", 
+       printk(KERN_DEBUG "pmtu discovery on SA ESP/%08x/" NIP6_FMT "\n", 
                        ntohl(esph->spi), NIP6(iph->daddr));
        xfrm_state_put(x);
 }
@@ -279,26 +278,18 @@ static void esp6_destroy(struct xfrm_state *x)
        if (!esp)
                return;
 
-       if (esp->conf.tfm) {
-               crypto_free_tfm(esp->conf.tfm);
-               esp->conf.tfm = NULL;
-       }
-       if (esp->conf.ivec) {
-               kfree(esp->conf.ivec);
-               esp->conf.ivec = NULL;
-       }
-       if (esp->auth.tfm) {
-               crypto_free_tfm(esp->auth.tfm);
-               esp->auth.tfm = NULL;
-       }
-       if (esp->auth.work_icv) {
-               kfree(esp->auth.work_icv);
-               esp->auth.work_icv = NULL;
-       }
+       crypto_free_tfm(esp->conf.tfm);
+       esp->conf.tfm = NULL;
+       kfree(esp->conf.ivec);
+       esp->conf.ivec = NULL;
+       crypto_free_tfm(esp->auth.tfm);
+       esp->auth.tfm = NULL;
+       kfree(esp->auth.work_icv);
+       esp->auth.work_icv = NULL;
        kfree(esp);
 }
 
-static int esp6_init_state(struct xfrm_state *x, void *args)
+static int esp6_init_state(struct xfrm_state *x)
 {
        struct esp_data *esp = NULL;
 
@@ -329,7 +320,7 @@ static int esp6_init_state(struct xfrm_state *x, void *args)
                        goto error;
                esp->auth.icv = esp_hmac_digest;
  
-               aalg_desc = xfrm_aalg_get_byname(x->aalg->alg_name);
+               aalg_desc = xfrm_aalg_get_byname(x->aalg->alg_name, 0);
                BUG_ON(!aalg_desc);
  
                if (aalg_desc->uinfo.auth.icv_fullbits/8 !=
@@ -364,7 +355,8 @@ static int esp6_init_state(struct xfrm_state *x, void *args)
                        goto error;
                get_random_bytes(esp->conf.ivec, esp->conf.ivlen);
        }
-       crypto_cipher_setkey(esp->conf.tfm, esp->conf.key, esp->conf.key_len);
+       if (crypto_cipher_setkey(esp->conf.tfm, esp->conf.key, esp->conf.key_len))
+               goto error;
        x->props.header_len = sizeof(struct ipv6_esp_hdr) + esp->conf.ivlen;
        if (x->props.mode)
                x->props.header_len += sizeof(struct ipv6hdr);
@@ -372,15 +364,9 @@ static int esp6_init_state(struct xfrm_state *x, void *args)
        return 0;
 
 error:
-       if (esp) {
-               if (esp->auth.tfm)
-                       crypto_free_tfm(esp->auth.tfm);
-               if (esp->auth.work_icv)
-                       kfree(esp->auth.work_icv);
-               if (esp->conf.tfm)
-                       crypto_free_tfm(esp->conf.tfm);
-               kfree(esp);
-       }
+       x->data = esp;
+       esp6_destroy(x);
+       x->data = NULL;
        return -EINVAL;
 }