1 files changed, 83 insertions, 44 deletions

diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index ca5b93a5c02a..ae45f9835014 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -736,64 +736,105 @@ static int tcp_v6_parse_md5_keys (struct sock *sk, char __user *optval,
         return tcp_v6_md5_do_add(sk, &sin6->sin6_addr, newkey, cmd.tcpm_keylen);
 }
 
-static int tcp_v6_do_calc_md5_hash(char *md5_hash, struct tcp_md5sig_key *key,
-                                   struct in6_addr *saddr,
-                                   struct in6_addr *daddr,
-                                   struct tcphdr *th, unsigned int tcplen)
+static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
+                                        struct in6_addr *daddr,
+                                        struct in6_addr *saddr, int nbytes)
 {
-        struct tcp_md5sig_pool *hp;
         struct tcp6_pseudohdr *bp;
-        int err;
-
-        hp = tcp_get_md5sig_pool();
-        if (!hp) {
-                printk(KERN_WARNING "%s(): hash pool not found...\n", __func__);
-                goto clear_hash_noput;
-        }
+        struct scatterlist sg;
 
         bp = &hp->md5_blk.ip6;
-
         /* 1. TCP pseudo-header (RFC2460) */
         ipv6_addr_copy(&bp->saddr, saddr);
         ipv6_addr_copy(&bp->daddr, daddr);
-        bp->len = htonl(tcplen);
-        bp->protocol = htonl(IPPROTO_TCP);
+        bp->protocol = cpu_to_be32(IPPROTO_TCP);
+        bp->len = cpu_to_be16(nbytes);
 
-        err = tcp_calc_md5_hash(md5_hash, key, sizeof(*bp),
-                                th, tcplen, hp);
+        sg_init_one(&sg, bp, sizeof(*bp));
+        return crypto_hash_update(&hp->md5_desc, &sg, sizeof(*bp));
+}
 
-        if (err)
+static int tcp_v6_md5_hash_hdr(char *md5_hash, struct tcp_md5sig_key *key,
+                               struct in6_addr *daddr, struct in6_addr *saddr,
+                               struct tcphdr *th)
+{
+        struct tcp_md5sig_pool *hp;
+        struct hash_desc *desc;
+
+        hp = tcp_get_md5sig_pool();
+        if (!hp)
+                goto clear_hash_noput;
+        desc = &hp->md5_desc;
+
+        if (crypto_hash_init(desc))
+                goto clear_hash;
+        if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, th->doff << 2))
+                goto clear_hash;
+        if (tcp_md5_hash_header(hp, th))
+                goto clear_hash;
+        if (tcp_md5_hash_key(hp, key))
+                goto clear_hash;
+        if (crypto_hash_final(desc, md5_hash))
                 goto clear_hash;
 
-        /* Free up the crypto pool */
         tcp_put_md5sig_pool();
-out:
         return 0;
+
 clear_hash:
         tcp_put_md5sig_pool();
 clear_hash_noput:
         memset(md5_hash, 0, 16);
-        goto out;
+        return 1;
 }
 
-static int tcp_v6_calc_md5_hash(char *md5_hash, struct tcp_md5sig_key *key,
-                                struct sock *sk,
-                                struct dst_entry *dst,
-                                struct request_sock *req,
-                                struct tcphdr *th, unsigned int tcplen)
+static int tcp_v6_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key,
+                               struct sock *sk, struct request_sock *req,
+                               struct sk_buff *skb)
 {
         struct in6_addr *saddr, *daddr;
+        struct tcp_md5sig_pool *hp;
+        struct hash_desc *desc;
+        struct tcphdr *th = tcp_hdr(skb);
 
         if (sk) {
                 saddr = &inet6_sk(sk)->saddr;
                 daddr = &inet6_sk(sk)->daddr;
-        } else {
+        } else if (req) {
                 saddr = &inet6_rsk(req)->loc_addr;
                 daddr = &inet6_rsk(req)->rmt_addr;
+        } else {
+                struct ipv6hdr *ip6h = ipv6_hdr(skb);
+                saddr = &ip6h->saddr;
+                daddr = &ip6h->daddr;
         }
-        return tcp_v6_do_calc_md5_hash(md5_hash, key,
-                                       saddr, daddr,
-                                       th, tcplen);
+
+        hp = tcp_get_md5sig_pool();
+        if (!hp)
+                goto clear_hash_noput;
+        desc = &hp->md5_desc;
+
+        if (crypto_hash_init(desc))
+                goto clear_hash;
+
+        if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, skb->len))
+                goto clear_hash;
+        if (tcp_md5_hash_header(hp, th))
+                goto clear_hash;
+        if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
+                goto clear_hash;
+        if (tcp_md5_hash_key(hp, key))
+                goto clear_hash;
+        if (crypto_hash_final(desc, md5_hash))
+                goto clear_hash;
+
+        tcp_put_md5sig_pool();
+        return 0;
+
+clear_hash:
+        tcp_put_md5sig_pool();
+clear_hash_noput:
+        memset(md5_hash, 0, 16);
+        return 1;
 }
 
 static int tcp_v6_inbound_md5_hash (struct sock *sk, struct sk_buff *skb)
@@ -834,10 +875,10 @@ static int tcp_v6_inbound_md5_hash (struct sock *sk, struct sk_buff *skb)
         }
 
         /* check the signature */
-        genhash = tcp_v6_do_calc_md5_hash(newhash,
-                                          hash_expected,
-                                          &ip6h->saddr, &ip6h->daddr,
-                                          th, skb->len);
+        genhash = tcp_v6_md5_hash_skb(newhash,
+                                      hash_expected,
+                                      NULL, NULL, skb);
+
         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
                 if (net_ratelimit()) {
                         printk(KERN_INFO "MD5 Hash %s for "
@@ -974,10 +1015,9 @@ static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
                                (TCPOPT_NOP << 16) |
                                (TCPOPT_MD5SIG << 8) |
                                TCPOLEN_MD5SIG);
-                tcp_v6_do_calc_md5_hash((__u8 *)&opt[1], key,
-                                        &ipv6_hdr(skb)->daddr,
-                                        &ipv6_hdr(skb)->saddr,
-                                        t1, tot_len);
+                tcp_v6_md5_hash_hdr((__u8 *)&opt[1], key,
+                                    &ipv6_hdr(skb)->daddr,
+                                    &ipv6_hdr(skb)->saddr, t1);
         }
 #endif
 
@@ -1064,10 +1104,9 @@ static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32
         if (key) {
                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
                                 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
-                tcp_v6_do_calc_md5_hash((__u8 *)topt, key,
-                                        &ipv6_hdr(skb)->daddr,
-                                        &ipv6_hdr(skb)->saddr,
-                                        t1, tot_len);
+                tcp_v6_md5_hash_hdr((__u8 *)topt, key,
+                                    &ipv6_hdr(skb)->daddr,
+                                    &ipv6_hdr(skb)->saddr, t1);
         }
 #endif
 
@@ -1783,7 +1822,7 @@ static struct inet_connection_sock_af_ops ipv6_specific = {
 #ifdef CONFIG_TCP_MD5SIG
 static struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
         .md5_lookup     =       tcp_v6_md5_lookup,
-        .calc_md5_hash  =       tcp_v6_calc_md5_hash,
+        .calc_md5_hash  =       tcp_v6_md5_hash_skb,
         .md5_add        =       tcp_v6_md5_add_func,
         .md5_parse      =       tcp_v6_parse_md5_keys,
 };
@@ -1815,7 +1854,7 @@ static struct inet_connection_sock_af_ops ipv6_mapped = {
 #ifdef CONFIG_TCP_MD5SIG
 static struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
         .md5_lookup     =       tcp_v4_md5_lookup,
-        .calc_md5_hash  =       tcp_v4_calc_md5_hash,
+        .calc_md5_hash  =       tcp_v4_md5_hash_skb,
         .md5_add        =       tcp_v6_md5_add_func,
         .md5_parse      =       tcp_v6_parse_md5_keys,
 };