iptables AH/ESP fix (3/3)

Hi Davem!

The below patch (by Patrick McHardy) fixes the iptables 'esp' match to use the same structure definition like the 2.5/2.6 in-kernel IPsec implementation.

Please apply, thanks.

# This is a BitKeeper generated patch for the following project:
# Project Name: Linux kernel tree
# This patch format is intended for GNU patch command version 2.5 or higher. # This patch includes the following deltas:
# ChangeSet 1.1537 -> 1.1538
# net/ipv4/netfilter/ipt_esp.c 1.6 -> 1.7
#
# The following is the BitKeeper ChangeSet Log
# --------------------------------------------
# 03/07/21 [email protected] 1.1538
# [NETFILTER]: Use common struct ip_esp_hdr declaration
# --------------------------------------------
#

@@ -1,6 +1,7 @@
 /* Kernel module to match ESP parameters. */
 #include <linux/module.h>
 #include <linux/skbuff.h>
+#include <linux/ip.h>
 
 #include <linux/netfilter_ipv4/ipt_esp.h>
 #include <linux/netfilter_ipv4/ip_tables.h>

@@ -13,10 +14,6 @@
 #define duprintf(format, args...)
 #endif
 
-struct esphdr {
-	__u32   spi;
-};
-
 /* Returns 1 if the spi is matched by the range, 0 otherwise */
 static inline int
 spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, int invert)

@@ -37,7 +34,7 @@
       int offset,
       int *hotdrop)
 {
-	struct esphdr esp;
+	struct ip_esp_hdr esp;
 	const struct ipt_esp *espinfo = matchinfo;
 
 	/* Must not be a fragment. */

- Harald Welte <[email protected]>             http://www.netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie