[PATCH 2.6] iptables AH/ESP fix (2/3)

From: Harald Welte (laforge@netfilter.org)
Date: Sat Aug 02 2003 - 08:00:39 EST

Hi Davem!

The below patch (by Patrick McHardy) fixes the iptables 'ah' match to
use the same structure definition like the 2.5/2.6 in-kernel IPsec
implementation.

Please apply, thanks.

diff -Nru a/net/ipv4/netfilter/ipt_ah.c b/net/ipv4/netfilter/ipt_ah.c
--- a/net/ipv4/netfilter/ipt_ah.c Thu May 22 01:35:36 2003
+++ b/net/ipv4/netfilter/ipt_ah.c Mon Jul 21 02:48:59 2003
@@ -1,6 +1,7 @@
 /* Kernel module to match AH parameters. */
 #include <linux/module.h>
 #include <linux/skbuff.h>
+#include <linux/ip.h>
 
 #include <linux/netfilter_ipv4/ipt_ah.h>
 #include <linux/netfilter_ipv4/ip_tables.h>
@@ -13,10 +14,6 @@
 #define duprintf(format, args...)
 #endif
 
-struct ahhdr {
- __u32 spi;
-};
-
 /* Returns 1 if the spi is matched by the range, 0 otherwise */
 static inline int
 spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, int invert)
@@ -37,7 +34,7 @@
       int offset,
       int *hotdrop)
 {
- struct ahhdr ah;
+ struct ip_auth_hdr ah;
         const struct ipt_ah *ahinfo = matchinfo;
 
         /* Must not be a fragment. */ 

-- 
- Harald Welte <laforge@netfilter.org>             http://www.netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/

This archive was generated by hypermail 2b29 : Thu Aug 07 2003 - 22:00:19 EST