LIMIT_NETDEBUG( printk(KERN_WARNING "ipsec ah authentication error\n")); 
LIMIT_NETDEBUG(KERN_WARNING "ipsec ah authentication error\n"); 
static int ah6_input(struct xfrm_state *x, struct xfrm_decap_state *decap, struct sk_buff *skb){	/*	 * Before process AH	 * [IPv6][Ext1][Ext2][AH][Dest][Payload]	 * |<-------------->| hdr_len	 *	 * To erase AH:	 * Keeping copy of cleared headers. After AH processing,	 * Moving the pointer of skb->nh.raw by using skb_pull as long as AH	 * header length. Then copy back the copy as long as hdr_len	 * If destination header following AH exists, copy it into after [Ext2].	 * 	 * |<>|[IPv6][Ext1][Ext2][Dest][Payload]	 * There is offset of AH before IPv6 header after the process.	 */	struct ipv6_auth_hdr *ah;	struct ah_data *ahp;	unsigned char *tmp_hdr = NULL;	u16 hdr_len;	u16 ah_hlen;	int nexthdr;	if (!pskb_may_pull(skb, sizeof(struct ip_auth_hdr)))		goto out;	/* We are going to _remove_ AH header to keep sockets happy,	 * so... Later this can change. */	if (skb_cloned(skb) &&	    pskb_expand_head(skb, 0, 0, GFP_ATOMIC))		goto out;	hdr_len = skb->data - skb->nh.raw;	ah = (struct ipv6_auth_hdr*)skb->data;	ahp = x->data;	nexthdr = ah->nexthdr;	ah_hlen = (ah->hdrlen + 2) << 2;        if (ah_hlen != XFRM_ALIGN8(sizeof(struct ipv6_auth_hdr) + ahp->icv_full_len) &&            ah_hlen != XFRM_ALIGN8(sizeof(struct ipv6_auth_hdr) + ahp->icv_trunc_len))                goto out;	if (!pskb_may_pull(skb, ah_hlen))		goto out;	tmp_hdr = kmalloc(hdr_len, GFP_ATOMIC);	if (!tmp_hdr)		goto out;	memcpy(tmp_hdr, skb->nh.raw, hdr_len);	if (ipv6_clear_mutable_options(skb->nh.ipv6h, hdr_len))		goto out;	skb->nh.ipv6h->priority    = 0;	skb->nh.ipv6h->flow_lbl[0] = 0;	skb->nh.ipv6h->flow_lbl[1] = 0;	skb->nh.ipv6h->flow_lbl[2] = 0;	skb->nh.ipv6h->hop_limit   = 0;        {		u8 auth_data[MAX_AH_AUTH_LEN];		memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len);		memset(ah->auth_data, 0, ahp->icv_trunc_len);		skb_push(skb, skb->data - skb->nh.raw);		ahp->icv(ahp, skb, ah->auth_data);		if (memcmp(ah->auth_data, auth_data, ahp->icv_trunc_len)) {			LIMIT_NETDEBUG(				printk(KERN_WARNING "ipsec ah authentication error\n"));			x->stats.integrity_failed++;			goto free_out;		}	}	skb->nh.raw = skb_pull(skb, ah_hlen);	memcpy(skb->nh.raw, tmp_hdr, hdr_len);	skb->nh.ipv6h->payload_len = htons(skb->len - sizeof(struct ipv6hdr));	skb_pull(skb, hdr_len);	skb->h.raw = skb->data;	kfree(tmp_hdr);	return nexthdr;free_out:	kfree(tmp_hdr);out:	return -EINVAL;}
4520	/local/tlutelli/issta_data/temp/c/2005_temp/2005/4520/64ce207306debd7157f47282be94770407bec01c/ah6.c/clean/net/ipv6/ah6.c