Commit | Line | Data |
---|---|---|
dff3bb06 | 1 | #include <crypto/hash.h> |
07d4ee58 | 2 | #include <linux/err.h> |
1da177e4 | 3 | #include <linux/module.h> |
5a0e3ad6 | 4 | #include <linux/slab.h> |
1da177e4 LT |
5 | #include <net/ip.h> |
6 | #include <net/xfrm.h> | |
7 | #include <net/ah.h> | |
8 | #include <linux/crypto.h> | |
9 | #include <linux/pfkeyv2.h> | |
dff3bb06 | 10 | #include <linux/scatterlist.h> |
1da177e4 | 11 | #include <net/icmp.h> |
14c85021 | 12 | #include <net/protocol.h> |
1da177e4 | 13 | |
dff3bb06 SK |
14 | struct ah_skb_cb { |
15 | struct xfrm_skb_cb xfrm; | |
16 | void *tmp; | |
17 | }; | |
18 | ||
19 | #define AH_SKB_CB(__skb) ((struct ah_skb_cb *)&((__skb)->cb[0])) | |
20 | ||
21 | static void *ah_alloc_tmp(struct crypto_ahash *ahash, int nfrags, | |
22 | unsigned int size) | |
23 | { | |
24 | unsigned int len; | |
25 | ||
26 | len = size + crypto_ahash_digestsize(ahash) + | |
27 | (crypto_ahash_alignmask(ahash) & | |
28 | ~(crypto_tfm_ctx_alignment() - 1)); | |
29 | ||
30 | len = ALIGN(len, crypto_tfm_ctx_alignment()); | |
31 | ||
32 | len += sizeof(struct ahash_request) + crypto_ahash_reqsize(ahash); | |
33 | len = ALIGN(len, __alignof__(struct scatterlist)); | |
34 | ||
35 | len += sizeof(struct scatterlist) * nfrags; | |
36 | ||
37 | return kmalloc(len, GFP_ATOMIC); | |
38 | } | |
39 | ||
40 | static inline u8 *ah_tmp_auth(void *tmp, unsigned int offset) | |
41 | { | |
42 | return tmp + offset; | |
43 | } | |
44 | ||
45 | static inline u8 *ah_tmp_icv(struct crypto_ahash *ahash, void *tmp, | |
46 | unsigned int offset) | |
47 | { | |
48 | return PTR_ALIGN((u8 *)tmp + offset, crypto_ahash_alignmask(ahash) + 1); | |
49 | } | |
50 | ||
51 | static inline struct ahash_request *ah_tmp_req(struct crypto_ahash *ahash, | |
52 | u8 *icv) | |
53 | { | |
54 | struct ahash_request *req; | |
55 | ||
56 | req = (void *)PTR_ALIGN(icv + crypto_ahash_digestsize(ahash), | |
57 | crypto_tfm_ctx_alignment()); | |
58 | ||
59 | ahash_request_set_tfm(req, ahash); | |
60 | ||
61 | return req; | |
62 | } | |
63 | ||
64 | static inline struct scatterlist *ah_req_sg(struct crypto_ahash *ahash, | |
65 | struct ahash_request *req) | |
66 | { | |
67 | return (void *)ALIGN((unsigned long)(req + 1) + | |
68 | crypto_ahash_reqsize(ahash), | |
69 | __alignof__(struct scatterlist)); | |
70 | } | |
1da177e4 LT |
71 | |
72 | /* Clear mutable options and find final destination to substitute | |
73 | * into IP header for icv calculation. Options are already checked | |
74 | * for validity, so paranoia is not required. */ | |
75 | ||
d5a0a1e3 | 76 | static int ip_clear_mutable_options(struct iphdr *iph, __be32 *daddr) |
1da177e4 LT |
77 | { |
78 | unsigned char * optptr = (unsigned char*)(iph+1); | |
79 | int l = iph->ihl*4 - sizeof(struct iphdr); | |
80 | int optlen; | |
81 | ||
82 | while (l > 0) { | |
83 | switch (*optptr) { | |
84 | case IPOPT_END: | |
85 | return 0; | |
86 | case IPOPT_NOOP: | |
87 | l--; | |
88 | optptr++; | |
89 | continue; | |
90 | } | |
91 | optlen = optptr[1]; | |
92 | if (optlen<2 || optlen>l) | |
93 | return -EINVAL; | |
94 | switch (*optptr) { | |
95 | case IPOPT_SEC: | |
96 | case 0x85: /* Some "Extended Security" crap. */ | |
11a03f78 | 97 | case IPOPT_CIPSO: |
1da177e4 LT |
98 | case IPOPT_RA: |
99 | case 0x80|21: /* RFC1770 */ | |
100 | break; | |
101 | case IPOPT_LSRR: | |
102 | case IPOPT_SSRR: | |
103 | if (optlen < 6) | |
104 | return -EINVAL; | |
105 | memcpy(daddr, optptr+optlen-4, 4); | |
106 | /* Fall through */ | |
107 | default: | |
96fe1c02 | 108 | memset(optptr, 0, optlen); |
1da177e4 LT |
109 | } |
110 | l -= optlen; | |
111 | optptr += optlen; | |
112 | } | |
113 | return 0; | |
114 | } | |
115 | ||
dff3bb06 SK |
116 | static void ah_output_done(struct crypto_async_request *base, int err) |
117 | { | |
118 | u8 *icv; | |
119 | struct iphdr *iph; | |
120 | struct sk_buff *skb = base->data; | |
121 | struct xfrm_state *x = skb_dst(skb)->xfrm; | |
122 | struct ah_data *ahp = x->data; | |
123 | struct iphdr *top_iph = ip_hdr(skb); | |
124 | struct ip_auth_hdr *ah = ip_auth_hdr(skb); | |
125 | int ihl = ip_hdrlen(skb); | |
126 | ||
127 | iph = AH_SKB_CB(skb)->tmp; | |
128 | icv = ah_tmp_icv(ahp->ahash, iph, ihl); | |
129 | memcpy(ah->auth_data, icv, ahp->icv_trunc_len); | |
130 | ||
131 | top_iph->tos = iph->tos; | |
132 | top_iph->ttl = iph->ttl; | |
133 | top_iph->frag_off = iph->frag_off; | |
134 | if (top_iph->ihl != 5) { | |
135 | top_iph->daddr = iph->daddr; | |
136 | memcpy(top_iph+1, iph+1, top_iph->ihl*4 - sizeof(struct iphdr)); | |
137 | } | |
138 | ||
139 | err = ah->nexthdr; | |
140 | ||
141 | kfree(AH_SKB_CB(skb)->tmp); | |
142 | xfrm_output_resume(skb, err); | |
143 | } | |
144 | ||
1da177e4 LT |
145 | static int ah_output(struct xfrm_state *x, struct sk_buff *skb) |
146 | { | |
147 | int err; | |
dff3bb06 SK |
148 | int nfrags; |
149 | int ihl; | |
150 | u8 *icv; | |
151 | struct sk_buff *trailer; | |
152 | struct crypto_ahash *ahash; | |
153 | struct ahash_request *req; | |
154 | struct scatterlist *sg; | |
1da177e4 LT |
155 | struct iphdr *iph, *top_iph; |
156 | struct ip_auth_hdr *ah; | |
157 | struct ah_data *ahp; | |
dff3bb06 SK |
158 | |
159 | ahp = x->data; | |
160 | ahash = ahp->ahash; | |
161 | ||
162 | if ((err = skb_cow_data(skb, 0, &trailer)) < 0) | |
163 | goto out; | |
164 | nfrags = err; | |
1da177e4 | 165 | |
7b277b1a | 166 | skb_push(skb, -skb_network_offset(skb)); |
dff3bb06 SK |
167 | ah = ip_auth_hdr(skb); |
168 | ihl = ip_hdrlen(skb); | |
169 | ||
170 | err = -ENOMEM; | |
171 | iph = ah_alloc_tmp(ahash, nfrags, ihl); | |
172 | if (!iph) | |
173 | goto out; | |
174 | ||
175 | icv = ah_tmp_icv(ahash, iph, ihl); | |
176 | req = ah_tmp_req(ahash, icv); | |
177 | sg = ah_req_sg(ahash, req); | |
178 | ||
179 | memset(ah->auth_data, 0, ahp->icv_trunc_len); | |
180 | ||
eddc9ec5 | 181 | top_iph = ip_hdr(skb); |
1da177e4 LT |
182 | |
183 | iph->tos = top_iph->tos; | |
184 | iph->ttl = top_iph->ttl; | |
185 | iph->frag_off = top_iph->frag_off; | |
186 | ||
187 | if (top_iph->ihl != 5) { | |
188 | iph->daddr = top_iph->daddr; | |
189 | memcpy(iph+1, top_iph+1, top_iph->ihl*4 - sizeof(struct iphdr)); | |
190 | err = ip_clear_mutable_options(top_iph, &top_iph->daddr); | |
191 | if (err) | |
dff3bb06 | 192 | goto out_free; |
1da177e4 LT |
193 | } |
194 | ||
37fedd3a HX |
195 | ah->nexthdr = *skb_mac_header(skb); |
196 | *skb_mac_header(skb) = IPPROTO_AH; | |
1da177e4 LT |
197 | |
198 | top_iph->tos = 0; | |
199 | top_iph->tot_len = htons(skb->len); | |
200 | top_iph->frag_off = 0; | |
201 | top_iph->ttl = 0; | |
1da177e4 LT |
202 | top_iph->check = 0; |
203 | ||
87bdc48d | 204 | ah->hdrlen = (XFRM_ALIGN8(sizeof(*ah) + ahp->icv_trunc_len) >> 2) - 2; |
1da177e4 LT |
205 | |
206 | ah->reserved = 0; | |
207 | ah->spi = x->id.spi; | |
b318e0e4 | 208 | ah->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output); |
b7c6538c | 209 | |
dff3bb06 SK |
210 | sg_init_table(sg, nfrags); |
211 | skb_to_sgvec(skb, sg, 0, skb->len); | |
b7c6538c | 212 | |
dff3bb06 SK |
213 | ahash_request_set_crypt(req, sg, icv, skb->len); |
214 | ahash_request_set_callback(req, 0, ah_output_done, skb); | |
215 | ||
216 | AH_SKB_CB(skb)->tmp = iph; | |
217 | ||
218 | err = crypto_ahash_digest(req); | |
219 | if (err) { | |
220 | if (err == -EINPROGRESS) | |
221 | goto out; | |
222 | ||
223 | if (err == -EBUSY) | |
224 | err = NET_XMIT_DROP; | |
225 | goto out_free; | |
226 | } | |
227 | ||
228 | memcpy(ah->auth_data, icv, ahp->icv_trunc_len); | |
1da177e4 LT |
229 | |
230 | top_iph->tos = iph->tos; | |
231 | top_iph->ttl = iph->ttl; | |
232 | top_iph->frag_off = iph->frag_off; | |
233 | if (top_iph->ihl != 5) { | |
234 | top_iph->daddr = iph->daddr; | |
235 | memcpy(top_iph+1, iph+1, top_iph->ihl*4 - sizeof(struct iphdr)); | |
236 | } | |
237 | ||
dff3bb06 SK |
238 | out_free: |
239 | kfree(iph); | |
240 | out: | |
1da177e4 LT |
241 | return err; |
242 | } | |
243 | ||
dff3bb06 SK |
244 | static void ah_input_done(struct crypto_async_request *base, int err) |
245 | { | |
246 | u8 *auth_data; | |
247 | u8 *icv; | |
248 | struct iphdr *work_iph; | |
249 | struct sk_buff *skb = base->data; | |
250 | struct xfrm_state *x = xfrm_input_state(skb); | |
251 | struct ah_data *ahp = x->data; | |
252 | struct ip_auth_hdr *ah = ip_auth_hdr(skb); | |
253 | int ihl = ip_hdrlen(skb); | |
254 | int ah_hlen = (ah->hdrlen + 2) << 2; | |
255 | ||
256 | work_iph = AH_SKB_CB(skb)->tmp; | |
257 | auth_data = ah_tmp_auth(work_iph, ihl); | |
258 | icv = ah_tmp_icv(ahp->ahash, auth_data, ahp->icv_trunc_len); | |
259 | ||
260 | err = memcmp(icv, auth_data, ahp->icv_trunc_len) ? -EBADMSG: 0; | |
261 | if (err) | |
262 | goto out; | |
263 | ||
264 | skb->network_header += ah_hlen; | |
265 | memcpy(skb_network_header(skb), work_iph, ihl); | |
266 | __skb_pull(skb, ah_hlen + ihl); | |
267 | skb_set_transport_header(skb, -ihl); | |
268 | ||
269 | err = ah->nexthdr; | |
270 | out: | |
271 | kfree(AH_SKB_CB(skb)->tmp); | |
272 | xfrm_input_resume(skb, err); | |
273 | } | |
274 | ||
e695633e | 275 | static int ah_input(struct xfrm_state *x, struct sk_buff *skb) |
1da177e4 LT |
276 | { |
277 | int ah_hlen; | |
31a4ab93 | 278 | int ihl; |
631a6698 | 279 | int nexthdr; |
dff3bb06 SK |
280 | int nfrags; |
281 | u8 *auth_data; | |
282 | u8 *icv; | |
283 | struct sk_buff *trailer; | |
284 | struct crypto_ahash *ahash; | |
285 | struct ahash_request *req; | |
286 | struct scatterlist *sg; | |
287 | struct iphdr *iph, *work_iph; | |
1da177e4 LT |
288 | struct ip_auth_hdr *ah; |
289 | struct ah_data *ahp; | |
dff3bb06 | 290 | int err = -ENOMEM; |
1da177e4 | 291 | |
87bdc48d | 292 | if (!pskb_may_pull(skb, sizeof(*ah))) |
1da177e4 LT |
293 | goto out; |
294 | ||
87bdc48d | 295 | ah = (struct ip_auth_hdr *)skb->data; |
1da177e4 | 296 | ahp = x->data; |
dff3bb06 SK |
297 | ahash = ahp->ahash; |
298 | ||
631a6698 | 299 | nexthdr = ah->nexthdr; |
1da177e4 | 300 | ah_hlen = (ah->hdrlen + 2) << 2; |
e905a9ed | 301 | |
87bdc48d HX |
302 | if (ah_hlen != XFRM_ALIGN8(sizeof(*ah) + ahp->icv_full_len) && |
303 | ah_hlen != XFRM_ALIGN8(sizeof(*ah) + ahp->icv_trunc_len)) | |
1da177e4 LT |
304 | goto out; |
305 | ||
306 | if (!pskb_may_pull(skb, ah_hlen)) | |
307 | goto out; | |
308 | ||
309 | /* We are going to _remove_ AH header to keep sockets happy, | |
310 | * so... Later this can change. */ | |
311 | if (skb_cloned(skb) && | |
312 | pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) | |
313 | goto out; | |
314 | ||
315 | skb->ip_summed = CHECKSUM_NONE; | |
316 | ||
87bdc48d | 317 | ah = (struct ip_auth_hdr *)skb->data; |
eddc9ec5 | 318 | iph = ip_hdr(skb); |
dff3bb06 SK |
319 | ihl = ip_hdrlen(skb); |
320 | ||
321 | if ((err = skb_cow_data(skb, 0, &trailer)) < 0) | |
322 | goto out; | |
323 | nfrags = err; | |
324 | ||
325 | work_iph = ah_alloc_tmp(ahash, nfrags, ihl + ahp->icv_trunc_len); | |
326 | if (!work_iph) | |
327 | goto out; | |
328 | ||
329 | auth_data = ah_tmp_auth(work_iph, ihl); | |
330 | icv = ah_tmp_icv(ahash, auth_data, ahp->icv_trunc_len); | |
331 | req = ah_tmp_req(ahash, icv); | |
332 | sg = ah_req_sg(ahash, req); | |
1da177e4 | 333 | |
dff3bb06 SK |
334 | memcpy(work_iph, iph, ihl); |
335 | memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len); | |
336 | memset(ah->auth_data, 0, ahp->icv_trunc_len); | |
1da177e4 LT |
337 | |
338 | iph->ttl = 0; | |
339 | iph->tos = 0; | |
340 | iph->frag_off = 0; | |
341 | iph->check = 0; | |
31a4ab93 | 342 | if (ihl > sizeof(*iph)) { |
d5a0a1e3 | 343 | __be32 dummy; |
dff3bb06 SK |
344 | err = ip_clear_mutable_options(iph, &dummy); |
345 | if (err) | |
346 | goto out_free; | |
1da177e4 | 347 | } |
0ebea8ef | 348 | |
dff3bb06 | 349 | skb_push(skb, ihl); |
e905a9ed | 350 | |
dff3bb06 SK |
351 | sg_init_table(sg, nfrags); |
352 | skb_to_sgvec(skb, sg, 0, skb->len); | |
353 | ||
354 | ahash_request_set_crypt(req, sg, icv, skb->len); | |
355 | ahash_request_set_callback(req, 0, ah_input_done, skb); | |
356 | ||
357 | AH_SKB_CB(skb)->tmp = work_iph; | |
358 | ||
359 | err = crypto_ahash_digest(req); | |
360 | if (err) { | |
361 | if (err == -EINPROGRESS) | |
362 | goto out; | |
363 | ||
364 | if (err == -EBUSY) | |
365 | err = NET_XMIT_DROP; | |
366 | goto out_free; | |
1da177e4 | 367 | } |
0ebea8ef | 368 | |
dff3bb06 | 369 | err = memcmp(icv, auth_data, ahp->icv_trunc_len) ? -EBADMSG: 0; |
0ebea8ef | 370 | if (err) |
dff3bb06 | 371 | goto out_free; |
0ebea8ef | 372 | |
b0e380b1 | 373 | skb->network_header += ah_hlen; |
dff3bb06 | 374 | memcpy(skb_network_header(skb), work_iph, ihl); |
31a4ab93 | 375 | __skb_pull(skb, ah_hlen + ihl); |
dff3bb06 | 376 | skb_set_transport_header(skb, -ihl); |
1da177e4 | 377 | |
dff3bb06 | 378 | err = nexthdr; |
1da177e4 | 379 | |
dff3bb06 SK |
380 | out_free: |
381 | kfree (work_iph); | |
1da177e4 | 382 | out: |
07d4ee58 | 383 | return err; |
1da177e4 LT |
384 | } |
385 | ||
386 | static void ah4_err(struct sk_buff *skb, u32 info) | |
387 | { | |
4fb236ba | 388 | struct net *net = dev_net(skb->dev); |
d9319100 JK |
389 | struct iphdr *iph = (struct iphdr *)skb->data; |
390 | struct ip_auth_hdr *ah = (struct ip_auth_hdr *)(skb->data+(iph->ihl<<2)); | |
1da177e4 LT |
391 | struct xfrm_state *x; |
392 | ||
88c7664f ACM |
393 | if (icmp_hdr(skb)->type != ICMP_DEST_UNREACH || |
394 | icmp_hdr(skb)->code != ICMP_FRAG_NEEDED) | |
1da177e4 LT |
395 | return; |
396 | ||
bd55775c | 397 | x = xfrm_state_lookup(net, skb->mark, (xfrm_address_t *)&iph->daddr, ah->spi, IPPROTO_AH, AF_INET); |
1da177e4 LT |
398 | if (!x) |
399 | return; | |
400 | printk(KERN_DEBUG "pmtu discovery on SA AH/%08x/%08x\n", | |
401 | ntohl(ah->spi), ntohl(iph->daddr)); | |
402 | xfrm_state_put(x); | |
403 | } | |
404 | ||
72cb6962 | 405 | static int ah_init_state(struct xfrm_state *x) |
1da177e4 LT |
406 | { |
407 | struct ah_data *ahp = NULL; | |
408 | struct xfrm_algo_desc *aalg_desc; | |
dff3bb06 | 409 | struct crypto_ahash *ahash; |
1da177e4 LT |
410 | |
411 | if (!x->aalg) | |
412 | goto error; | |
413 | ||
1da177e4 LT |
414 | if (x->encap) |
415 | goto error; | |
416 | ||
0da974f4 | 417 | ahp = kzalloc(sizeof(*ahp), GFP_KERNEL); |
dff3bb06 | 418 | if (!ahp) |
1da177e4 LT |
419 | return -ENOMEM; |
420 | ||
dff3bb06 SK |
421 | ahash = crypto_alloc_ahash(x->aalg->alg_name, 0, 0); |
422 | if (IS_ERR(ahash)) | |
07d4ee58 HX |
423 | goto error; |
424 | ||
dff3bb06 SK |
425 | ahp->ahash = ahash; |
426 | if (crypto_ahash_setkey(ahash, x->aalg->alg_key, | |
427 | (x->aalg->alg_key_len + 7) / 8)) | |
1da177e4 | 428 | goto error; |
e905a9ed | 429 | |
1da177e4 LT |
430 | /* |
431 | * Lookup the algorithm description maintained by xfrm_algo, | |
432 | * verify crypto transform properties, and store information | |
433 | * we need for AH processing. This lookup cannot fail here | |
dff3bb06 | 434 | * after a successful crypto_alloc_ahash(). |
1da177e4 LT |
435 | */ |
436 | aalg_desc = xfrm_aalg_get_byname(x->aalg->alg_name, 0); | |
437 | BUG_ON(!aalg_desc); | |
438 | ||
439 | if (aalg_desc->uinfo.auth.icv_fullbits/8 != | |
dff3bb06 | 440 | crypto_ahash_digestsize(ahash)) { |
1da177e4 | 441 | printk(KERN_INFO "AH: %s digestsize %u != %hu\n", |
dff3bb06 | 442 | x->aalg->alg_name, crypto_ahash_digestsize(ahash), |
1da177e4 LT |
443 | aalg_desc->uinfo.auth.icv_fullbits/8); |
444 | goto error; | |
445 | } | |
e905a9ed | 446 | |
1da177e4 | 447 | ahp->icv_full_len = aalg_desc->uinfo.auth.icv_fullbits/8; |
8f8a088c | 448 | ahp->icv_trunc_len = x->aalg->alg_trunc_len/8; |
e905a9ed | 449 | |
1da177e4 | 450 | BUG_ON(ahp->icv_trunc_len > MAX_AH_AUTH_LEN); |
e905a9ed | 451 | |
87bdc48d HX |
452 | x->props.header_len = XFRM_ALIGN8(sizeof(struct ip_auth_hdr) + |
453 | ahp->icv_trunc_len); | |
7e49e6de | 454 | if (x->props.mode == XFRM_MODE_TUNNEL) |
1da177e4 LT |
455 | x->props.header_len += sizeof(struct iphdr); |
456 | x->data = ahp; | |
457 | ||
458 | return 0; | |
459 | ||
460 | error: | |
461 | if (ahp) { | |
dff3bb06 | 462 | crypto_free_ahash(ahp->ahash); |
1da177e4 LT |
463 | kfree(ahp); |
464 | } | |
465 | return -EINVAL; | |
466 | } | |
467 | ||
468 | static void ah_destroy(struct xfrm_state *x) | |
469 | { | |
470 | struct ah_data *ahp = x->data; | |
471 | ||
472 | if (!ahp) | |
473 | return; | |
474 | ||
dff3bb06 | 475 | crypto_free_ahash(ahp->ahash); |
1da177e4 LT |
476 | kfree(ahp); |
477 | } | |
478 | ||
479 | ||
533cb5b0 | 480 | static const struct xfrm_type ah_type = |
1da177e4 LT |
481 | { |
482 | .description = "AH4", | |
483 | .owner = THIS_MODULE, | |
484 | .proto = IPPROTO_AH, | |
436a0a40 | 485 | .flags = XFRM_TYPE_REPLAY_PROT, |
1da177e4 LT |
486 | .init_state = ah_init_state, |
487 | .destructor = ah_destroy, | |
488 | .input = ah_input, | |
489 | .output = ah_output | |
490 | }; | |
491 | ||
32613090 | 492 | static const struct net_protocol ah4_protocol = { |
1da177e4 LT |
493 | .handler = xfrm4_rcv, |
494 | .err_handler = ah4_err, | |
495 | .no_policy = 1, | |
4fb236ba | 496 | .netns_ok = 1, |
1da177e4 LT |
497 | }; |
498 | ||
499 | static int __init ah4_init(void) | |
500 | { | |
501 | if (xfrm_register_type(&ah_type, AF_INET) < 0) { | |
502 | printk(KERN_INFO "ip ah init: can't add xfrm type\n"); | |
503 | return -EAGAIN; | |
504 | } | |
505 | if (inet_add_protocol(&ah4_protocol, IPPROTO_AH) < 0) { | |
506 | printk(KERN_INFO "ip ah init: can't add protocol\n"); | |
507 | xfrm_unregister_type(&ah_type, AF_INET); | |
508 | return -EAGAIN; | |
509 | } | |
510 | return 0; | |
511 | } | |
512 | ||
513 | static void __exit ah4_fini(void) | |
514 | { | |
515 | if (inet_del_protocol(&ah4_protocol, IPPROTO_AH) < 0) | |
516 | printk(KERN_INFO "ip ah close: can't remove protocol\n"); | |
517 | if (xfrm_unregister_type(&ah_type, AF_INET) < 0) | |
518 | printk(KERN_INFO "ip ah close: can't remove xfrm type\n"); | |
519 | } | |
520 | ||
521 | module_init(ah4_init); | |
522 | module_exit(ah4_fini); | |
523 | MODULE_LICENSE("GPL"); | |
d3d6dd3a | 524 | MODULE_ALIAS_XFRM_TYPE(AF_INET, XFRM_PROTO_AH); |