Re: [PATCH] AH4: Update IPv4 options handling to conform to RFC 4302.

[David Miller <davem@davemloft.net>]

From: Nick Bowler <nbowler@ellipticsemi.com>
Date: Wed, 22 Aug 2007 10:22:53 -0400

> In testing our ESP/AH offload hardware, I discovered an issue with how AH
> handles mutable fields in IPv4.  RFC 4302 (AH) states the following on the
> subject:
> 
>         For IPv4, the entire option is viewed as a unit; so even
>         though the type and length fields within most options are immutable
>         in transit, if an option is classified as mutable, the entire option
>         is zeroed for ICV computation purposes.
> 
> The current implementation does not zero the type and length fields, resulting
> in authentication failures when communicating with hosts that do (i.e. FreeBSD).
> 
> I have tested record route and timestamp options (ping -R and ping -T) on a
> small network involving Windows XP, FreeBSD 6.2, and Linux hosts, with one
> router.  In the presence of these options, the FreeBSD and Linux hosts (with
> the patch or with the hardware) can communicate.  The Windows XP host simply
> fails to accept these packets with or without the patch.
> 
> I have also been trying to test source routing options (using traceroute -g),
> but haven't had much luck getting this option to work *without* AH, let alone
> with.
> 
> Signed-off-by: Nick Bowler <nbowler@ellipticsemi.com>

Patch applied, thanks a lot Nick.