xfrm: do not leak ESRCH to user space
[linux-2.6.git] / net / xfrm / xfrm_algo.c
index 080aae2..96036cf 100644 (file)
@@ -1,19 +1,19 @@
-/* 
+/*
  * xfrm algorithm interface
  *
  * Copyright (c) 2002 James Morris <jmorris@intercode.com.au>
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the Free
- * Software Foundation; either version 2 of the License, or (at your option) 
+ * Software Foundation; either version 2 of the License, or (at your option)
  * any later version.
  */
 
-#include <linux/config.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/pfkeyv2.h>
 #include <linux/crypto.h>
+#include <linux/scatterlist.h>
 #include <net/xfrm.h>
 #if defined(CONFIG_INET_AH) || defined(CONFIG_INET_AH_MODULE) || defined(CONFIG_INET6_AH) || defined(CONFIG_INET6_AH_MODULE)
 #include <net/ah.h>
@@ -21,7 +21,6 @@
 #if defined(CONFIG_INET_ESP) || defined(CONFIG_INET_ESP_MODULE) || defined(CONFIG_INET6_ESP) || defined(CONFIG_INET6_ESP_MODULE)
 #include <net/esp.h>
 #endif
-#include <asm/scatterlist.h>
 
 /*
  * Algorithms supported by IPsec.  These entries contain properties which
  * that instantiated crypto transforms have correct parameters for IPsec
  * purposes.
  */
+static struct xfrm_algo_desc aead_list[] = {
+{
+       .name = "rfc4106(gcm(aes))",
+
+       .uinfo = {
+               .aead = {
+                       .icv_truncbits = 64,
+               }
+       },
+
+       .desc = {
+               .sadb_alg_id = SADB_X_EALG_AES_GCM_ICV8,
+               .sadb_alg_ivlen = 8,
+               .sadb_alg_minbits = 128,
+               .sadb_alg_maxbits = 256
+       }
+},
+{
+       .name = "rfc4106(gcm(aes))",
+
+       .uinfo = {
+               .aead = {
+                       .icv_truncbits = 96,
+               }
+       },
+
+       .desc = {
+               .sadb_alg_id = SADB_X_EALG_AES_GCM_ICV12,
+               .sadb_alg_ivlen = 8,
+               .sadb_alg_minbits = 128,
+               .sadb_alg_maxbits = 256
+       }
+},
+{
+       .name = "rfc4106(gcm(aes))",
+
+       .uinfo = {
+               .aead = {
+                       .icv_truncbits = 128,
+               }
+       },
+
+       .desc = {
+               .sadb_alg_id = SADB_X_EALG_AES_GCM_ICV16,
+               .sadb_alg_ivlen = 8,
+               .sadb_alg_minbits = 128,
+               .sadb_alg_maxbits = 256
+       }
+},
+{
+       .name = "rfc4309(ccm(aes))",
+
+       .uinfo = {
+               .aead = {
+                       .icv_truncbits = 64,
+               }
+       },
+
+       .desc = {
+               .sadb_alg_id = SADB_X_EALG_AES_CCM_ICV8,
+               .sadb_alg_ivlen = 8,
+               .sadb_alg_minbits = 128,
+               .sadb_alg_maxbits = 256
+       }
+},
+{
+       .name = "rfc4309(ccm(aes))",
+
+       .uinfo = {
+               .aead = {
+                       .icv_truncbits = 96,
+               }
+       },
+
+       .desc = {
+               .sadb_alg_id = SADB_X_EALG_AES_CCM_ICV12,
+               .sadb_alg_ivlen = 8,
+               .sadb_alg_minbits = 128,
+               .sadb_alg_maxbits = 256
+       }
+},
+{
+       .name = "rfc4309(ccm(aes))",
+
+       .uinfo = {
+               .aead = {
+                       .icv_truncbits = 128,
+               }
+       },
+
+       .desc = {
+               .sadb_alg_id = SADB_X_EALG_AES_CCM_ICV16,
+               .sadb_alg_ivlen = 8,
+               .sadb_alg_minbits = 128,
+               .sadb_alg_maxbits = 256
+       }
+},
+};
+
 static struct xfrm_algo_desc aalg_list[] = {
 {
        .name = "digest_null",
-       
+
        .uinfo = {
                .auth = {
                        .icv_truncbits = 0,
                        .icv_fullbits = 0,
                }
        },
-       
+
        .desc = {
                .sadb_alg_id = SADB_X_AALG_NULL,
                .sadb_alg_ivlen = 0,
@@ -48,7 +146,8 @@ static struct xfrm_algo_desc aalg_list[] = {
        }
 },
 {
-       .name = "md5",
+       .name = "hmac(md5)",
+       .compat = "md5",
 
        .uinfo = {
                .auth = {
@@ -56,7 +155,7 @@ static struct xfrm_algo_desc aalg_list[] = {
                        .icv_fullbits = 128,
                }
        },
-       
+
        .desc = {
                .sadb_alg_id = SADB_AALG_MD5HMAC,
                .sadb_alg_ivlen = 0,
@@ -65,7 +164,8 @@ static struct xfrm_algo_desc aalg_list[] = {
        }
 },
 {
-       .name = "sha1",
+       .name = "hmac(sha1)",
+       .compat = "sha1",
 
        .uinfo = {
                .auth = {
@@ -82,7 +182,8 @@ static struct xfrm_algo_desc aalg_list[] = {
        }
 },
 {
-       .name = "sha256",
+       .name = "hmac(sha256)",
+       .compat = "sha256",
 
        .uinfo = {
                .auth = {
@@ -99,7 +200,8 @@ static struct xfrm_algo_desc aalg_list[] = {
        }
 },
 {
-       .name = "ripemd160",
+       .name = "hmac(rmd160)",
+       .compat = "rmd160",
 
        .uinfo = {
                .auth = {
@@ -115,19 +217,37 @@ static struct xfrm_algo_desc aalg_list[] = {
                .sadb_alg_maxbits = 160
        }
 },
+{
+       .name = "xcbc(aes)",
+
+       .uinfo = {
+               .auth = {
+                       .icv_truncbits = 96,
+                       .icv_fullbits = 128,
+               }
+       },
+
+       .desc = {
+               .sadb_alg_id = SADB_X_AALG_AES_XCBC_MAC,
+               .sadb_alg_ivlen = 0,
+               .sadb_alg_minbits = 128,
+               .sadb_alg_maxbits = 128
+       }
+},
 };
 
 static struct xfrm_algo_desc ealg_list[] = {
 {
-       .name = "cipher_null",
-       
+       .name = "ecb(cipher_null)",
+       .compat = "cipher_null",
+
        .uinfo = {
                .encr = {
                        .blockbits = 8,
                        .defkeybits = 0,
                }
        },
-       
+
        .desc = {
                .sadb_alg_id =  SADB_EALG_NULL,
                .sadb_alg_ivlen = 0,
@@ -136,7 +256,8 @@ static struct xfrm_algo_desc ealg_list[] = {
        }
 },
 {
-       .name = "des",
+       .name = "cbc(des)",
+       .compat = "des",
 
        .uinfo = {
                .encr = {
@@ -153,7 +274,8 @@ static struct xfrm_algo_desc ealg_list[] = {
        }
 },
 {
-       .name = "des3_ede",
+       .name = "cbc(des3_ede)",
+       .compat = "des3_ede",
 
        .uinfo = {
                .encr = {
@@ -170,7 +292,8 @@ static struct xfrm_algo_desc ealg_list[] = {
        }
 },
 {
-       .name = "cast128",
+       .name = "cbc(cast128)",
+       .compat = "cast128",
 
        .uinfo = {
                .encr = {
@@ -187,7 +310,8 @@ static struct xfrm_algo_desc ealg_list[] = {
        }
 },
 {
-       .name = "blowfish",
+       .name = "cbc(blowfish)",
+       .compat = "blowfish",
 
        .uinfo = {
                .encr = {
@@ -204,7 +328,8 @@ static struct xfrm_algo_desc ealg_list[] = {
        }
 },
 {
-       .name = "aes",
+       .name = "cbc(aes)",
+       .compat = "aes",
 
        .uinfo = {
                .encr = {
@@ -221,38 +346,74 @@ static struct xfrm_algo_desc ealg_list[] = {
        }
 },
 {
-        .name = "serpent",
-
-        .uinfo = {
-                .encr = {
-                        .blockbits = 128,
-                        .defkeybits = 128,
-                }
-        },
-
-        .desc = {
-                .sadb_alg_id = SADB_X_EALG_SERPENTCBC,
-                .sadb_alg_ivlen = 8,
-                .sadb_alg_minbits = 128,
-                .sadb_alg_maxbits = 256,
-        }
+       .name = "cbc(serpent)",
+       .compat = "serpent",
+
+       .uinfo = {
+               .encr = {
+                       .blockbits = 128,
+                       .defkeybits = 128,
+               }
+       },
+
+       .desc = {
+               .sadb_alg_id = SADB_X_EALG_SERPENTCBC,
+               .sadb_alg_ivlen = 8,
+               .sadb_alg_minbits = 128,
+               .sadb_alg_maxbits = 256,
+       }
 },
 {
-        .name = "twofish",
-                 
-        .uinfo = {
-                .encr = {
-                        .blockbits = 128,
-                        .defkeybits = 128,
-                }
-        },
-
-        .desc = {
-                .sadb_alg_id = SADB_X_EALG_TWOFISHCBC,
-                .sadb_alg_ivlen = 8,
-                .sadb_alg_minbits = 128,
-                .sadb_alg_maxbits = 256
-        }
+       .name = "cbc(camellia)",
+
+       .uinfo = {
+               .encr = {
+                       .blockbits = 128,
+                       .defkeybits = 128,
+               }
+       },
+
+       .desc = {
+               .sadb_alg_id = SADB_X_EALG_CAMELLIACBC,
+               .sadb_alg_ivlen = 8,
+               .sadb_alg_minbits = 128,
+               .sadb_alg_maxbits = 256
+       }
+},
+{
+       .name = "cbc(twofish)",
+       .compat = "twofish",
+
+       .uinfo = {
+               .encr = {
+                       .blockbits = 128,
+                       .defkeybits = 128,
+               }
+       },
+
+       .desc = {
+               .sadb_alg_id = SADB_X_EALG_TWOFISHCBC,
+               .sadb_alg_ivlen = 8,
+               .sadb_alg_minbits = 128,
+               .sadb_alg_maxbits = 256
+       }
+},
+{
+       .name = "rfc3686(ctr(aes))",
+
+       .uinfo = {
+               .encr = {
+                       .blockbits = 128,
+                       .defkeybits = 160, /* 128-bit key + 32-bit nonce */
+               }
+       },
+
+       .desc = {
+               .sadb_alg_id = SADB_X_EALG_AESCTR,
+               .sadb_alg_ivlen = 8,
+               .sadb_alg_minbits = 128,
+               .sadb_alg_maxbits = 256
+       }
 },
 };
 
@@ -286,6 +447,11 @@ static struct xfrm_algo_desc calg_list[] = {
 },
 };
 
+static inline int aead_entries(void)
+{
+       return ARRAY_SIZE(aead_list);
+}
+
 static inline int aalg_entries(void)
 {
        return ARRAY_SIZE(aalg_list);
@@ -301,66 +467,51 @@ static inline int calg_entries(void)
        return ARRAY_SIZE(calg_list);
 }
 
-/* Todo: generic iterators */
-struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id)
-{
-       int i;
-
-       for (i = 0; i < aalg_entries(); i++) {
-               if (aalg_list[i].desc.sadb_alg_id == alg_id) {
-                       if (aalg_list[i].available)
-                               return &aalg_list[i];
-                       else
-                               break;
-               }
-       }
-       return NULL;
-}
-EXPORT_SYMBOL_GPL(xfrm_aalg_get_byid);
+struct xfrm_algo_list {
+       struct xfrm_algo_desc *algs;
+       int entries;
+       u32 type;
+       u32 mask;
+};
 
-struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id)
-{
-       int i;
+static const struct xfrm_algo_list xfrm_aead_list = {
+       .algs = aead_list,
+       .entries = ARRAY_SIZE(aead_list),
+       .type = CRYPTO_ALG_TYPE_AEAD,
+       .mask = CRYPTO_ALG_TYPE_MASK,
+};
 
-       for (i = 0; i < ealg_entries(); i++) {
-               if (ealg_list[i].desc.sadb_alg_id == alg_id) {
-                       if (ealg_list[i].available)
-                               return &ealg_list[i];
-                       else
-                               break;
-               }
-       }
-       return NULL;
-}
-EXPORT_SYMBOL_GPL(xfrm_ealg_get_byid);
+static const struct xfrm_algo_list xfrm_aalg_list = {
+       .algs = aalg_list,
+       .entries = ARRAY_SIZE(aalg_list),
+       .type = CRYPTO_ALG_TYPE_HASH,
+       .mask = CRYPTO_ALG_TYPE_HASH_MASK,
+};
 
-struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id)
-{
-       int i;
+static const struct xfrm_algo_list xfrm_ealg_list = {
+       .algs = ealg_list,
+       .entries = ARRAY_SIZE(ealg_list),
+       .type = CRYPTO_ALG_TYPE_BLKCIPHER,
+       .mask = CRYPTO_ALG_TYPE_BLKCIPHER_MASK,
+};
 
-       for (i = 0; i < calg_entries(); i++) {
-               if (calg_list[i].desc.sadb_alg_id == alg_id) {
-                       if (calg_list[i].available)
-                               return &calg_list[i];
-                       else
-                               break;
-               }
-       }
-       return NULL;
-}
-EXPORT_SYMBOL_GPL(xfrm_calg_get_byid);
+static const struct xfrm_algo_list xfrm_calg_list = {
+       .algs = calg_list,
+       .entries = ARRAY_SIZE(calg_list),
+       .type = CRYPTO_ALG_TYPE_COMPRESS,
+       .mask = CRYPTO_ALG_TYPE_MASK,
+};
 
-static struct xfrm_algo_desc *xfrm_get_byname(struct xfrm_algo_desc *list,
-                                             int entries, char *name,
-                                             int probe)
+static struct xfrm_algo_desc *xfrm_find_algo(
+       const struct xfrm_algo_list *algo_list,
+       int match(const struct xfrm_algo_desc *entry, const void *data),
+       const void *data, int probe)
 {
+       struct xfrm_algo_desc *list = algo_list->algs;
        int i, status;
 
-       if (!name)
-               return NULL;
-
-       for (i = 0; i < entries; i++) {
-               if (strcmp(name, list[i].name))
+       for (i = 0; i < algo_list->entries; i++) {
+               if (!match(list + i, data))
                        continue;
 
                if (list[i].available)
@@ -369,7 +520,8 @@ static struct xfrm_algo_desc *xfrm_get_byname(struct xfrm_algo_desc *list,
                if (!probe)
                        break;
 
-               status = crypto_alg_available(name, 0);
+               status = crypto_has_alg(list[i].name, algo_list->type,
+                                       algo_list->mask);
                if (!status)
                        break;
 
@@ -379,24 +531,90 @@ static struct xfrm_algo_desc *xfrm_get_byname(struct xfrm_algo_desc *list,
        return NULL;
 }
 
+static int xfrm_alg_id_match(const struct xfrm_algo_desc *entry,
+                            const void *data)
+{
+       return entry->desc.sadb_alg_id == (unsigned long)data;
+}
+
+struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id)
+{
+       return xfrm_find_algo(&xfrm_aalg_list, xfrm_alg_id_match,
+                             (void *)(unsigned long)alg_id, 1);
+}
+EXPORT_SYMBOL_GPL(xfrm_aalg_get_byid);
+
+struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id)
+{
+       return xfrm_find_algo(&xfrm_ealg_list, xfrm_alg_id_match,
+                             (void *)(unsigned long)alg_id, 1);
+}
+EXPORT_SYMBOL_GPL(xfrm_ealg_get_byid);
+
+struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id)
+{
+       return xfrm_find_algo(&xfrm_calg_list, xfrm_alg_id_match,
+                             (void *)(unsigned long)alg_id, 1);
+}
+EXPORT_SYMBOL_GPL(xfrm_calg_get_byid);
+
+static int xfrm_alg_name_match(const struct xfrm_algo_desc *entry,
+                              const void *data)
+{
+       const char *name = data;
+
+       return name && (!strcmp(name, entry->name) ||
+                       (entry->compat && !strcmp(name, entry->compat)));
+}
+
 struct xfrm_algo_desc *xfrm_aalg_get_byname(char *name, int probe)
 {
-       return xfrm_get_byname(aalg_list, aalg_entries(), name, probe);
+       return xfrm_find_algo(&xfrm_aalg_list, xfrm_alg_name_match, name,
+                             probe);
 }
 EXPORT_SYMBOL_GPL(xfrm_aalg_get_byname);
 
 struct xfrm_algo_desc *xfrm_ealg_get_byname(char *name, int probe)
 {
-       return xfrm_get_byname(ealg_list, ealg_entries(), name, probe);
+       return xfrm_find_algo(&xfrm_ealg_list, xfrm_alg_name_match, name,
+                             probe);
 }
 EXPORT_SYMBOL_GPL(xfrm_ealg_get_byname);
 
 struct xfrm_algo_desc *xfrm_calg_get_byname(char *name, int probe)
 {
-       return xfrm_get_byname(calg_list, calg_entries(), name, probe);
+       return xfrm_find_algo(&xfrm_calg_list, xfrm_alg_name_match, name,
+                             probe);
 }
 EXPORT_SYMBOL_GPL(xfrm_calg_get_byname);
 
+struct xfrm_aead_name {
+       const char *name;
+       int icvbits;
+};
+
+static int xfrm_aead_name_match(const struct xfrm_algo_desc *entry,
+                               const void *data)
+{
+       const struct xfrm_aead_name *aead = data;
+       const char *name = aead->name;
+
+       return aead->icvbits == entry->uinfo.aead.icv_truncbits && name &&
+              !strcmp(name, entry->name);
+}
+
+struct xfrm_algo_desc *xfrm_aead_get_byname(char *name, int icv_len, int probe)
+{
+       struct xfrm_aead_name data = {
+               .name = name,
+               .icvbits = icv_len,
+       };
+
+       return xfrm_find_algo(&xfrm_aead_list, xfrm_aead_name_match, &data,
+                             probe);
+}
+EXPORT_SYMBOL_GPL(xfrm_aead_get_byname);
+
 struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx)
 {
        if (idx >= aalg_entries())
@@ -422,29 +640,30 @@ EXPORT_SYMBOL_GPL(xfrm_ealg_get_byidx);
  */
 void xfrm_probe_algs(void)
 {
-#ifdef CONFIG_CRYPTO
        int i, status;
-       
+
        BUG_ON(in_softirq());
 
        for (i = 0; i < aalg_entries(); i++) {
-               status = crypto_alg_available(aalg_list[i].name, 0);
+               status = crypto_has_hash(aalg_list[i].name, 0,
+                                        CRYPTO_ALG_ASYNC);
                if (aalg_list[i].available != status)
                        aalg_list[i].available = status;
        }
-       
+
        for (i = 0; i < ealg_entries(); i++) {
-               status = crypto_alg_available(ealg_list[i].name, 0);
+               status = crypto_has_blkcipher(ealg_list[i].name, 0,
+                                             CRYPTO_ALG_ASYNC);
                if (ealg_list[i].available != status)
                        ealg_list[i].available = status;
        }
-       
+
        for (i = 0; i < calg_entries(); i++) {
-               status = crypto_alg_available(calg_list[i].name, 0);
+               status = crypto_has_comp(calg_list[i].name, 0,
+                                        CRYPTO_ALG_ASYNC);
                if (calg_list[i].available != status)
                        calg_list[i].available = status;
        }
-#endif
 }
 EXPORT_SYMBOL_GPL(xfrm_probe_algs);
 
@@ -472,106 +691,34 @@ EXPORT_SYMBOL_GPL(xfrm_count_enc_supported);
 
 /* Move to common area: it is shared with AH. */
 
-void skb_icv_walk(const struct sk_buff *skb, struct crypto_tfm *tfm,
-                 int offset, int len, icv_update_fn_t icv_update)
+int skb_icv_walk(const struct sk_buff *skb, struct hash_desc *desc,
+                int offset, int len, icv_update_fn_t icv_update)
 {
        int start = skb_headlen(skb);
        int i, copy = start - offset;
+       int err;
        struct scatterlist sg;
 
        /* Checksum header. */
        if (copy > 0) {
                if (copy > len)
                        copy = len;
-               
-               sg.page = virt_to_page(skb->data + offset);
-               sg.offset = (unsigned long)(skb->data + offset) % PAGE_SIZE;
-               sg.length = copy;
-               
-               icv_update(tfm, &sg, 1);
-               
-               if ((len -= copy) == 0)
-                       return;
-               offset += copy;
-       }
-
-       for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
-               int end;
-
-               BUG_TRAP(start <= offset + len);
-
-               end = start + skb_shinfo(skb)->frags[i].size;
-               if ((copy = end - offset) > 0) {
-                       skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
-
-                       if (copy > len)
-                               copy = len;
-                       
-                       sg.page = frag->page;
-                       sg.offset = frag->page_offset + offset-start;
-                       sg.length = copy;
-                       
-                       icv_update(tfm, &sg, 1);
-
-                       if (!(len -= copy))
-                               return;
-                       offset += copy;
-               }
-               start = end;
-       }
-
-       if (skb_shinfo(skb)->frag_list) {
-               struct sk_buff *list = skb_shinfo(skb)->frag_list;
-
-               for (; list; list = list->next) {
-                       int end;
-
-                       BUG_TRAP(start <= offset + len);
-
-                       end = start + list->len;
-                       if ((copy = end - offset) > 0) {
-                               if (copy > len)
-                                       copy = len;
-                               skb_icv_walk(list, tfm, offset-start, copy, icv_update);
-                               if ((len -= copy) == 0)
-                                       return;
-                               offset += copy;
-                       }
-                       start = end;
-               }
-       }
-       if (len)
-               BUG();
-}
-EXPORT_SYMBOL_GPL(skb_icv_walk);
-
-#if defined(CONFIG_INET_ESP) || defined(CONFIG_INET_ESP_MODULE) || defined(CONFIG_INET6_ESP) || defined(CONFIG_INET6_ESP_MODULE)
 
-/* Looking generic it is not used in another places. */
+               sg_init_one(&sg, skb->data + offset, copy);
 
-int
-skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len)
-{
-       int start = skb_headlen(skb);
-       int i, copy = start - offset;
-       int elt = 0;
+               err = icv_update(desc, &sg, copy);
+               if (unlikely(err))
+                       return err;
 
-       if (copy > 0) {
-               if (copy > len)
-                       copy = len;
-               sg[elt].page = virt_to_page(skb->data + offset);
-               sg[elt].offset = (unsigned long)(skb->data + offset) % PAGE_SIZE;
-               sg[elt].length = copy;
-               elt++;
                if ((len -= copy) == 0)
-                       return elt;
+                       return 0;
                offset += copy;
        }
 
        for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
                int end;
 
-               BUG_TRAP(start <= offset + len);
+               WARN_ON(start > offset + len);
 
                end = start + skb_shinfo(skb)->frags[i].size;
                if ((copy = end - offset) > 0) {
@@ -579,12 +726,17 @@ skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len)
 
                        if (copy > len)
                                copy = len;
-                       sg[elt].page = frag->page;
-                       sg[elt].offset = frag->page_offset+offset-start;
-                       sg[elt].length = copy;
-                       elt++;
+
+                       sg_init_table(&sg, 1);
+                       sg_set_page(&sg, frag->page, copy,
+                                   frag->page_offset + offset-start);
+
+                       err = icv_update(desc, &sg, copy);
+                       if (unlikely(err))
+                               return err;
+
                        if (!(len -= copy))
-                               return elt;
+                               return 0;
                        offset += copy;
                }
                start = end;
@@ -596,126 +748,29 @@ skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len)
                for (; list; list = list->next) {
                        int end;
 
-                       BUG_TRAP(start <= offset + len);
+                       WARN_ON(start > offset + len);
 
                        end = start + list->len;
                        if ((copy = end - offset) > 0) {
                                if (copy > len)
                                        copy = len;
-                               elt += skb_to_sgvec(list, sg+elt, offset - start, copy);
+                               err = skb_icv_walk(list, desc, offset-start,
+                                                  copy, icv_update);
+                               if (unlikely(err))
+                                       return err;
                                if ((len -= copy) == 0)
-                                       return elt;
+                                       return 0;
                                offset += copy;
                        }
                        start = end;
                }
        }
-       if (len)
-               BUG();
-       return elt;
+       BUG_ON(len);
+       return 0;
 }
-EXPORT_SYMBOL_GPL(skb_to_sgvec);
-
-/* Check that skb data bits are writable. If they are not, copy data
- * to newly created private area. If "tailbits" is given, make sure that
- * tailbits bytes beyond current end of skb are writable.
- *
- * Returns amount of elements of scatterlist to load for subsequent
- * transformations and pointer to writable trailer skb.
- */
-
-int skb_cow_data(struct sk_buff *skb, int tailbits, struct sk_buff **trailer)
-{
-       int copyflag;
-       int elt;
-       struct sk_buff *skb1, **skb_p;
-
-       /* If skb is cloned or its head is paged, reallocate
-        * head pulling out all the pages (pages are considered not writable
-        * at the moment even if they are anonymous).
-        */
-       if ((skb_cloned(skb) || skb_shinfo(skb)->nr_frags) &&
-           __pskb_pull_tail(skb, skb_pagelen(skb)-skb_headlen(skb)) == NULL)
-               return -ENOMEM;
-
-       /* Easy case. Most of packets will go this way. */
-       if (!skb_shinfo(skb)->frag_list) {
-               /* A little of trouble, not enough of space for trailer.
-                * This should not happen, when stack is tuned to generate
-                * good frames. OK, on miss we reallocate and reserve even more
-                * space, 128 bytes is fair. */
-
-               if (skb_tailroom(skb) < tailbits &&
-                   pskb_expand_head(skb, 0, tailbits-skb_tailroom(skb)+128, GFP_ATOMIC))
-                       return -ENOMEM;
-
-               /* Voila! */
-               *trailer = skb;
-               return 1;
-       }
-
-       /* Misery. We are in troubles, going to mincer fragments... */
-
-       elt = 1;
-       skb_p = &skb_shinfo(skb)->frag_list;
-       copyflag = 0;
-
-       while ((skb1 = *skb_p) != NULL) {
-               int ntail = 0;
-
-               /* The fragment is partially pulled by someone,
-                * this can happen on input. Copy it and everything
-                * after it. */
-
-               if (skb_shared(skb1))
-                       copyflag = 1;
-
-               /* If the skb is the last, worry about trailer. */
-
-               if (skb1->next == NULL && tailbits) {
-                       if (skb_shinfo(skb1)->nr_frags ||
-                           skb_shinfo(skb1)->frag_list ||
-                           skb_tailroom(skb1) < tailbits)
-                               ntail = tailbits + 128;
-               }
-
-               if (copyflag ||
-                   skb_cloned(skb1) ||
-                   ntail ||
-                   skb_shinfo(skb1)->nr_frags ||
-                   skb_shinfo(skb1)->frag_list) {
-                       struct sk_buff *skb2;
-
-                       /* Fuck, we are miserable poor guys... */
-                       if (ntail == 0)
-                               skb2 = skb_copy(skb1, GFP_ATOMIC);
-                       else
-                               skb2 = skb_copy_expand(skb1,
-                                                      skb_headroom(skb1),
-                                                      ntail,
-                                                      GFP_ATOMIC);
-                       if (unlikely(skb2 == NULL))
-                               return -ENOMEM;
-
-                       if (skb1->sk)
-                               skb_set_owner_w(skb, skb1->sk);
-
-                       /* Looking around. Are we still alive?
-                        * OK, link new skb, drop old one */
-
-                       skb2->next = skb1->next;
-                       *skb_p = skb2;
-                       kfree_skb(skb1);
-                       skb1 = skb2;
-               }
-               elt++;
-               *trailer = skb1;
-               skb_p = &skb1->next;
-       }
+EXPORT_SYMBOL_GPL(skb_icv_walk);
 
-       return elt;
-}
-EXPORT_SYMBOL_GPL(skb_cow_data);
+#if defined(CONFIG_INET_ESP) || defined(CONFIG_INET_ESP_MODULE) || defined(CONFIG_INET6_ESP) || defined(CONFIG_INET6_ESP_MODULE)
 
 void *pskb_put(struct sk_buff *skb, struct sk_buff *tail, int len)
 {