| 1077 | return ip_header.__class__(raw(ip_header / esp)) |
| 1078 | |
| 1079 | def _encrypt_ah(self, pkt, seq_num=None, esn_en=False, esn=0): |
| 1080 | |
| 1081 | ah = AH(spi=self.spi, seq=seq_num or self.seq_num, |
| 1082 | icv=b"\x00" * self.auth_algo.icv_size) |
| 1083 | |
| 1084 | if self.tunnel_header: |
| 1085 | tunnel = self.tunnel_header.copy() |
| 1086 | |
| 1087 | if tunnel.version == 4: |
| 1088 | del tunnel.proto |
| 1089 | del tunnel.len |
| 1090 | del tunnel.chksum |
| 1091 | else: |
| 1092 | del tunnel.nh |
| 1093 | del tunnel.plen |
| 1094 | |
| 1095 | pkt = tunnel.__class__(raw(tunnel / pkt)) |
| 1096 | |
| 1097 | ip_header, nh, payload = split_for_transport(pkt, socket.IPPROTO_AH) |
| 1098 | ah.nh = nh |
| 1099 | |
| 1100 | if ip_header.version == 6 and len(ah) % 8 != 0: |
| 1101 | # For IPv6, the total length of the header must be a multiple of |
| 1102 | # 8-octet units. |
| 1103 | ah.padding = b"\x00" * (-len(ah) % 8) |
| 1104 | elif len(ah) % 4 != 0: |
| 1105 | # For IPv4, the total length of the header must be a multiple of |
| 1106 | # 4-octet units. |
| 1107 | ah.padding = b"\x00" * (-len(ah) % 4) |
| 1108 | |
| 1109 | # RFC 4302 - Section 2.2. Payload Length |
| 1110 | # This 8-bit field specifies the length of AH in 32-bit words (4-byte |
| 1111 | # units), minus "2". |
| 1112 | ah.payloadlen = len(ah) // 4 - 2 |
| 1113 | |
| 1114 | if ip_header.version == 4: |
| 1115 | ip_header.len = len(ip_header) + len(ah) + len(payload) |
| 1116 | del ip_header.chksum |
| 1117 | ip_header = ip_header.__class__(raw(ip_header)) |
| 1118 | else: |
| 1119 | ip_header.plen = len(ip_header.payload) + len(ah) + len(payload) |
| 1120 | |
| 1121 | signed_pkt = self.auth_algo.sign(ip_header / ah / payload, |
| 1122 | self.auth_key, |
| 1123 | esn_en=esn_en or self.esn_en, |
| 1124 | esn=esn or self.esn) |
| 1125 | |
| 1126 | # sequence number must always change, unless specified by the user |
| 1127 | if seq_num is None: |
| 1128 | self.seq_num += 1 |
| 1129 | |
| 1130 | return signed_pkt |
| 1131 | |
| 1132 | def encrypt(self, pkt, seq_num=None, iv=None, esn_en=None, esn=None): |
| 1133 | """ |