net/ipv4/esp4.c

   1 #include <linux/config.h>
   2 #include <linux/module.h>
   3 #include <net/ip.h>
   4 #include <net/xfrm.h>
   5 #include <net/esp.h>
   6 #include <asm/scatterlist.h>
   7 #include <linux/crypto.h>
   8 #include <linux/pfkeyv2.h>
   9 #include <linux/random.h>
  10 #include <net/icmp.h>
  11 #include <net/udp.h>
  12
  13 #define MAX_SG_ONSTACK 4
  14
  15 /* decapsulation data for use when post-processing */
  16 struct esp_decap_data {
  17         xfrm_address_t  saddr;
  18         __u16           sport;
  19         __u8            proto;
  20 };
  21
  22 int esp_output(struct sk_buff *skb)
  23 {
  24         int err;
  25         struct dst_entry *dst = skb->dst;
  26         struct xfrm_state *x  = dst->xfrm;
  27         struct iphdr *iph, *top_iph;
  28         struct ip_esp_hdr *esph;
  29         struct crypto_tfm *tfm;
  30         struct esp_data *esp;
  31         struct sk_buff *trailer;
  32         struct udphdr *uh = NULL;
  33         struct xfrm_encap_tmpl *encap = NULL;
  34         int blksize;
  35         int clen;
  36         int alen;
  37         int nfrags;
  38         union {
  39                 struct iphdr    iph;
  40                 char            buf[60];
  41         } tmp_iph;
  42
  43         /* First, if the skb is not checksummed, complete checksum. */
  44         if (skb->ip_summed == CHECKSUM_HW && skb_checksum_help(skb) == NULL) {
  45                 err = -EINVAL;
  46                 goto error_nolock;
  47         }
  48
  49         spin_lock_bh(&x->lock);
  50         err = xfrm_check_output(x, skb, AF_INET);
  51         if (err)
  52                 goto error;
  53         err = -ENOMEM;
  54
  55         /* Strip IP header in transport mode. Save it. */
  56         if (!x->props.mode) {
  57                 iph = skb->nh.iph;
  58                 memcpy(&tmp_iph, iph, iph->ihl*4);
  59                 __skb_pull(skb, iph->ihl*4);
  60         }
  61         /* Now skb is pure payload to encrypt */
  62
  63         /* Round to block size */
  64         clen = skb->len;
  65
  66         esp = x->data;
  67         alen = esp->auth.icv_trunc_len;
  68         tfm = esp->conf.tfm;
  69         blksize = (crypto_tfm_alg_blocksize(tfm) + 3) & ~3;
  70         clen = (clen + 2 + blksize-1)&~(blksize-1);
  71         if (esp->conf.padlen)
  72                 clen = (clen + esp->conf.padlen-1)&~(esp->conf.padlen-1);
  73
  74         if ((nfrags = skb_cow_data(skb, clen-skb->len+alen, &trailer)) < 0)
  75                 goto error;
  76
  77         /* Fill padding... */
  78         do {
  79                 int i;
  80                 for (i=0; i<clen-skb->len - 2; i++)
  81                         *(u8*)(trailer->tail + i) = i+1;
  82         } while (0);
  83         *(u8*)(trailer->tail + clen-skb->len - 2) = (clen - skb->len)-2;
  84         pskb_put(skb, trailer, clen - skb->len);
  85
  86         encap = x->encap;
  87
  88         iph = skb->nh.iph;
  89         if (x->props.mode) {
  90                 top_iph = (struct iphdr*)skb_push(skb, x->props.header_len);
  91                 esph = (struct ip_esp_hdr*)(top_iph+1);
  92                 if (encap && encap->encap_type) {
  93                         switch (encap->encap_type) {
  94                         case UDP_ENCAP_ESPINUDP:
  95                                 uh = (struct udphdr*) esph;
  96                                 esph = (struct ip_esp_hdr*)(uh+1);
  97                                 top_iph->protocol = IPPROTO_UDP;
  98                                 break;
  99                         default:
 100                                 printk(KERN_INFO
 101                                        "esp_output(): Unhandled encap: %u\n",
 102                                        encap->encap_type);
 103                                 top_iph->protocol = IPPROTO_ESP;
 104                                 break;
 105                         }
 106                 } else
 107                         top_iph->protocol = IPPROTO_ESP;
 108                 *(u8*)(trailer->tail - 1) = IPPROTO_IPIP;
 109                 top_iph->ihl = 5;
 110                 top_iph->version = 4;
 111                 top_iph->tos = iph->tos;        /* DS disclosed */
 112                 top_iph->tot_len = htons(skb->len + alen);
 113                 top_iph->frag_off = iph->frag_off&htons(IP_DF);
 114                 if (!(top_iph->frag_off))
 115                         ip_select_ident(top_iph, dst, 0);
 116                 top_iph->ttl = iph->ttl;        /* TTL disclosed */
 117                 top_iph->check = 0;
 118                 top_iph->saddr = x->props.saddr.a4;
 119                 top_iph->daddr = x->id.daddr.a4;
 120                 memset(&(IPCB(skb)->opt), 0, sizeof(struct ip_options));
 121         } else {
 122                 esph = (struct ip_esp_hdr*)skb_push(skb, x->props.header_len);
 123                 top_iph = (struct iphdr*)skb_push(skb, iph->ihl*4);
 124                 memcpy(top_iph, &tmp_iph, iph->ihl*4);
 125                 if (encap && encap->encap_type) {
 126                         switch (encap->encap_type) {
 127                         case UDP_ENCAP_ESPINUDP:
 128                                 uh = (struct udphdr*) esph;
 129                                 esph = (struct ip_esp_hdr*)(uh+1);
 130                                 top_iph->protocol = IPPROTO_UDP;
 131                                 break;
 132                         default:
 133                                 printk(KERN_INFO
 134                                        "esp_output(): Unhandled encap: %u\n",
 135                                        encap->encap_type);
 136                                 top_iph->protocol = IPPROTO_ESP;
 137                                 break;
 138                         }
 139                 } else
 140                         top_iph->protocol = IPPROTO_ESP;
 141                 iph = &tmp_iph.iph;
 142                 top_iph->tot_len = htons(skb->len + alen);
 143                 top_iph->check = 0;
 144                 top_iph->frag_off = iph->frag_off;
 145                 *(u8*)(trailer->tail - 1) = iph->protocol;
 146         }
 147
 148         /* this is non-NULL only with UDP Encapsulation */
 149         if (encap && uh) {
 150                 uh->source = encap->encap_sport;
 151                 uh->dest = encap->encap_dport;
 152                 uh->len = htons(skb->len + alen - sizeof(struct iphdr));
 153                 uh->check = 0;
 154         }
 155
 156         esph->spi = x->id.spi;
 157         esph->seq_no = htonl(++x->replay.oseq);
 158
 159         if (esp->conf.ivlen)
 160                 crypto_cipher_set_iv(tfm, esp->conf.ivec, crypto_tfm_alg_ivsize(tfm));
 161
 162         do {
 163                 struct scatterlist sgbuf[nfrags>MAX_SG_ONSTACK ? 0 : nfrags];
 164                 struct scatterlist *sg = sgbuf;
 165
 166                 if (unlikely(nfrags > MAX_SG_ONSTACK)) {
 167                         sg = kmalloc(sizeof(struct scatterlist)*nfrags, GFP_ATOMIC);
 168                         if (!sg)
 169                                 goto error;
 170                 }
 171                 skb_to_sgvec(skb, sg, esph->enc_data+esp->conf.ivlen-skb->data, clen);
 172                 crypto_cipher_encrypt(tfm, sg, sg, clen);
 173                 if (unlikely(sg != sgbuf))
 174                         kfree(sg);
 175         } while (0);
 176
 177         if (esp->conf.ivlen) {
 178                 memcpy(esph->enc_data, esp->conf.ivec, crypto_tfm_alg_ivsize(tfm));
 179                 crypto_cipher_get_iv(tfm, esp->conf.ivec, crypto_tfm_alg_ivsize(tfm));
 180         }
 181
 182         if (esp->auth.icv_full_len) {
 183                 esp->auth.icv(esp, skb, (u8*)esph-skb->data,
 184                               sizeof(struct ip_esp_hdr) + esp->conf.ivlen+clen, trailer->tail);
 185                 pskb_put(skb, trailer, alen);
 186         }
 187
 188         ip_send_check(top_iph);
 189
 190         skb->nh.raw = skb->data;
 191
 192         x->curlft.bytes += skb->len;
 193         x->curlft.packets++;
 194         spin_unlock_bh(&x->lock);
 195         if ((skb->dst = dst_pop(dst)) == NULL) {
 196                 err = -EHOSTUNREACH;
 197                 goto error_nolock;
 198         }
 199         return NET_XMIT_BYPASS;
 200
 201 error:
 202         spin_unlock_bh(&x->lock);
 203 error_nolock:
 204         kfree_skb(skb);
 205         return err;
 206 }
 207
 208 /*
 209  * Note: detecting truncated vs. non-truncated authentication data is very
 210  * expensive, so we only support truncated data, which is the recommended
 211  * and common case.
 212  */
 213 int esp_input(struct xfrm_state *x, struct xfrm_decap_state *decap, struct sk_buff *skb)
 214 {
 215         struct iphdr *iph;
 216         struct ip_esp_hdr *esph;
 217         struct esp_data *esp = x->data;
 218         struct sk_buff *trailer;
 219         int blksize = crypto_tfm_alg_blocksize(esp->conf.tfm);
 220         int alen = esp->auth.icv_trunc_len;
 221         int elen = skb->len - sizeof(struct ip_esp_hdr) - esp->conf.ivlen - alen;
 222         int nfrags;
 223         int encap_len = 0;
 224
 225         if (!pskb_may_pull(skb, sizeof(struct ip_esp_hdr)))
 226                 goto out;
 227
 228         if (elen <= 0 || (elen & (blksize-1)))
 229                 goto out;
 230
 231         /* If integrity check is required, do this. */
 232         if (esp->auth.icv_full_len) {
 233                 u8 sum[esp->auth.icv_full_len];
 234                 u8 sum1[alen];
 235
 236                 esp->auth.icv(esp, skb, 0, skb->len-alen, sum);
 237
 238                 if (skb_copy_bits(skb, skb->len-alen, sum1, alen))
 239                         BUG();
 240
 241                 if (unlikely(memcmp(sum, sum1, alen))) {
 242                         x->stats.integrity_failed++;
 243                         goto out;
 244                 }
 245         }
 246
 247         if ((nfrags = skb_cow_data(skb, 0, &trailer)) < 0)
 248                 goto out;
 249
 250         skb->ip_summed = CHECKSUM_NONE;
 251
 252         esph = (struct ip_esp_hdr*)skb->data;
 253         iph = skb->nh.iph;
 254
 255         /* Get ivec. This can be wrong, check against another impls. */
 256         if (esp->conf.ivlen)
 257                 crypto_cipher_set_iv(esp->conf.tfm, esph->enc_data, crypto_tfm_alg_ivsize(esp->conf.tfm));
 258
 259         {
 260                 u8 nexthdr[2];
 261                 struct scatterlist sgbuf[nfrags>MAX_SG_ONSTACK ? 0 : nfrags];
 262                 struct scatterlist *sg = sgbuf;
 263                 u8 workbuf[60];
 264                 int padlen;
 265
 266                 if (unlikely(nfrags > MAX_SG_ONSTACK)) {
 267                         sg = kmalloc(sizeof(struct scatterlist)*nfrags, GFP_ATOMIC);
 268                         if (!sg)
 269                                 goto out;
 270                 }
 271                 skb_to_sgvec(skb, sg, sizeof(struct ip_esp_hdr) + esp->conf.ivlen, elen);
 272                 crypto_cipher_decrypt(esp->conf.tfm, sg, sg, elen);
 273                 if (unlikely(sg != sgbuf))
 274                         kfree(sg);
 275
 276                 if (skb_copy_bits(skb, skb->len-alen-2, nexthdr, 2))
 277                         BUG();
 278
 279                 padlen = nexthdr[0];
 280                 if (padlen+2 >= elen)
 281                         goto out;
 282
 283                 /* ... check padding bits here. Silly. :-) */
 284
 285                 if (x->encap && decap && decap->decap_type) {
 286                         struct esp_decap_data *encap_data;
 287                         struct udphdr *uh = (struct udphdr *) (iph+1);
 288
 289                         encap_data = (struct esp_decap_data *) (decap->decap_data);
 290                         encap_data->proto = 0;
 291
 292                         switch (decap->decap_type) {
 293                         case UDP_ENCAP_ESPINUDP:
 294
 295                                 if ((void*)uh == (void*)esph) {
 296                                         printk(KERN_DEBUG
 297                                                "esp_input(): Got ESP; expecting ESPinUDP\n");
 298                                         break;
 299                                 }
 300
 301                                 encap_data->proto = AF_INET;
 302                                 encap_data->saddr.a4 = iph->saddr;
 303                                 encap_data->sport = uh->source;
 304                                 encap_len = (void*)esph - (void*)uh;
 305                                 if (encap_len != sizeof(*uh))
 306                                   printk(KERN_DEBUG
 307                                          "esp_input(): UDP -> ESP: too much room: %d\n",
 308                                          encap_len);
 309                                 break;
 310
 311                         default:
 312                                 printk(KERN_INFO
 313                                "esp_input(): processing unknown encap type: %u\n",
 314                                        decap->decap_type);
 315                                 break;
 316                         }
 317                 }
 318
 319                 iph->protocol = nexthdr[1];
 320                 pskb_trim(skb, skb->len - alen - padlen - 2);
 321                 memcpy(workbuf, skb->nh.raw, iph->ihl*4);
 322                 skb->h.raw = skb_pull(skb, sizeof(struct ip_esp_hdr) + esp->conf.ivlen);
 323                 skb->nh.raw += encap_len + sizeof(struct ip_esp_hdr) + esp->conf.ivlen;
 324                 memcpy(skb->nh.raw, workbuf, iph->ihl*4);
 325                 skb->nh.iph->tot_len = htons(skb->len);
 326         }
 327
 328         return 0;
 329
 330 out:
 331         return -EINVAL;
 332 }
 333
 334 int esp_post_input(struct xfrm_state *x, struct xfrm_decap_state *decap, struct sk_buff *skb)
 335 {
 336
 337         if (x->encap) {
 338                 struct xfrm_encap_tmpl *encap;
 339                 struct esp_decap_data *decap_data;
 340
 341                 encap = x->encap;
 342                 decap_data = (struct esp_decap_data *)(decap->decap_data);
 343
 344                 /* first, make sure that the decap type == the encap type */
 345                 if (encap->encap_type != decap->decap_type)
 346                         return -EINVAL;
 347
 348                 /* Next, if we don't have an encap type, then ignore it */
 349                 if (!encap->encap_type)
 350                         return 0;
 351
 352                 switch (encap->encap_type) {
 353                 case UDP_ENCAP_ESPINUDP:
 354                         /*
 355                          * 1) if the NAT-T peer's IP or port changed then
 356                          *    advertize the change to the keying daemon.
 357                          *    This is an inbound SA, so just compare
 358                          *    SRC ports.
 359                          */
 360                         if (decap_data->proto == AF_INET &&
 361                             (decap_data->saddr.a4 != x->props.saddr.a4 ||
 362                              decap_data->sport != encap->encap_sport)) {
 363                                 xfrm_address_t ipaddr;
 364
 365                                 ipaddr.a4 = decap_data->saddr.a4;
 366                                 km_new_mapping(x, &ipaddr, decap_data->sport);
 367
 368                                 /* XXX: perhaps add an extra
 369                                  * policy check here, to see
 370                                  * if we should allow or
 371                                  * reject a packet from a
 372                                  * different source
 373                                  * address/port.
 374                                  */
 375                         }
 376
 377                         /*
 378                          * 2) ignore UDP/TCP checksums in case
 379                          *    of NAT-T in Transport Mode, or
 380                          *    perform other post-processing fixes
 381                          *    as per * draft-ietf-ipsec-udp-encaps-06,
 382                          *    section 3.1.2
 383                          */
 384                         if (!x->props.mode)
 385                                 skb->ip_summed = CHECKSUM_UNNECESSARY;
 386
 387                         break;
 388                 default:
 389                         printk(KERN_INFO
 390                                "esp4_post_input(): Unhandled encap type: %u\n",
 391                                encap->encap_type);
 392                         break;
 393                 }
 394         }
 395         return 0;
 396 }
 397
 398 static u32 esp4_get_max_size(struct xfrm_state *x, int mtu)
 399 {
 400         struct esp_data *esp = x->data;
 401         u32 blksize = crypto_tfm_alg_blocksize(esp->conf.tfm);
 402
 403         if (x->props.mode) {
 404                 mtu = (mtu + 2 + blksize-1)&~(blksize-1);
 405         } else {
 406                 /* The worst case. */
 407                 mtu += 2 + blksize;
 408         }
 409         if (esp->conf.padlen)
 410                 mtu = (mtu + esp->conf.padlen-1)&~(esp->conf.padlen-1);
 411
 412         return mtu + x->props.header_len + esp->auth.icv_trunc_len;
 413 }
 414
 415 void esp4_err(struct sk_buff *skb, u32 info)
 416 {
 417         struct iphdr *iph = (struct iphdr*)skb->data;
 418         struct ip_esp_hdr *esph = (struct ip_esp_hdr*)(skb->data+(iph->ihl<<2));
 419         struct xfrm_state *x;
 420
 421         if (skb->h.icmph->type != ICMP_DEST_UNREACH ||
 422             skb->h.icmph->code != ICMP_FRAG_NEEDED)
 423                 return;
 424
 425         x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, esph->spi, IPPROTO_ESP, AF_INET);
 426         if (!x)
 427                 return;
 428         printk(KERN_DEBUG "pmtu discovery on SA ESP/%08x/%08x\n",
 429                ntohl(esph->spi), ntohl(iph->daddr));
 430         xfrm_state_put(x);
 431 }
 432
 433 void esp_destroy(struct xfrm_state *x)
 434 {
 435         struct esp_data *esp = x->data;
 436
 437         if (esp->conf.tfm) {
 438                 crypto_free_tfm(esp->conf.tfm);
 439                 esp->conf.tfm = NULL;
 440         }
 441         if (esp->conf.ivec) {
 442                 kfree(esp->conf.ivec);
 443                 esp->conf.ivec = NULL;
 444         }
 445         if (esp->auth.tfm) {
 446                 crypto_free_tfm(esp->auth.tfm);
 447                 esp->auth.tfm = NULL;
 448         }
 449         if (esp->auth.work_icv) {
 450                 kfree(esp->auth.work_icv);
 451                 esp->auth.work_icv = NULL;
 452         }
 453         kfree(esp);
 454 }
 455
 456 int esp_init_state(struct xfrm_state *x, void *args)
 457 {
 458         struct esp_data *esp = NULL;
 459
 460         /* null auth and encryption can have zero length keys */
 461         if (x->aalg) {
 462                 if (x->aalg->alg_key_len > 512)
 463                         goto error;
 464         }
 465         if (x->ealg == NULL)
 466                 goto error;
 467
 468         esp = kmalloc(sizeof(*esp), GFP_KERNEL);
 469         if (esp == NULL)
 470                 return -ENOMEM;
 471
 472         memset(esp, 0, sizeof(*esp));
 473
 474         if (x->aalg) {
 475                 struct xfrm_algo_desc *aalg_desc;
 476
 477                 esp->auth.key = x->aalg->alg_key;
 478                 esp->auth.key_len = (x->aalg->alg_key_len+7)/8;
 479                 esp->auth.tfm = crypto_alloc_tfm(x->aalg->alg_name, 0);
 480                 if (esp->auth.tfm == NULL)
 481                         goto error;
 482                 esp->auth.icv = esp_hmac_digest;
 483
 484                 aalg_desc = xfrm_aalg_get_byname(x->aalg->alg_name);
 485                 BUG_ON(!aalg_desc);
 486
 487                 if (aalg_desc->uinfo.auth.icv_fullbits/8 !=
 488                     crypto_tfm_alg_digestsize(esp->auth.tfm)) {
 489                         printk(KERN_INFO "ESP: %s digestsize %u != %hu\n",
 490                                x->aalg->alg_name,
 491                                crypto_tfm_alg_digestsize(esp->auth.tfm),
 492                                aalg_desc->uinfo.auth.icv_fullbits/8);
 493                         goto error;
 494                 }
 495
 496                 esp->auth.icv_full_len = aalg_desc->uinfo.auth.icv_fullbits/8;
 497                 esp->auth.icv_trunc_len = aalg_desc->uinfo.auth.icv_truncbits/8;
 498
 499                 esp->auth.work_icv = kmalloc(esp->auth.icv_full_len, GFP_KERNEL);
 500                 if (!esp->auth.work_icv)
 501                         goto error;
 502         }
 503         esp->conf.key = x->ealg->alg_key;
 504         esp->conf.key_len = (x->ealg->alg_key_len+7)/8;
 505         esp->conf.tfm = crypto_alloc_tfm(x->ealg->alg_name, CRYPTO_TFM_MODE_CBC);
 506         if (esp->conf.tfm == NULL)
 507                 goto error;
 508         esp->conf.ivlen = crypto_tfm_alg_ivsize(esp->conf.tfm);
 509         esp->conf.padlen = 0;
 510         if (esp->conf.ivlen) {
 511                 esp->conf.ivec = kmalloc(esp->conf.ivlen, GFP_KERNEL);
 512                 get_random_bytes(esp->conf.ivec, esp->conf.ivlen);
 513         }
 514         crypto_cipher_setkey(esp->conf.tfm, esp->conf.key, esp->conf.key_len);
 515         x->props.header_len = sizeof(struct ip_esp_hdr) + esp->conf.ivlen;
 516         if (x->props.mode)
 517                 x->props.header_len += sizeof(struct iphdr);
 518         if (x->encap) {
 519                 struct xfrm_encap_tmpl *encap = x->encap;
 520
 521                 if (encap->encap_type) {
 522                         switch (encap->encap_type) {
 523                         case UDP_ENCAP_ESPINUDP:
 524                                 x->props.header_len += sizeof(struct udphdr);
 525                                 break;
 526                         default:
 527                                 printk (KERN_INFO
 528                                 "esp_init_state(): Unhandled encap type: %u\n",
 529                                         encap->encap_type);
 530                                 break;
 531                         }
 532                 }
 533         }
 534         x->data = esp;
 535         x->props.trailer_len = esp4_get_max_size(x, 0) - x->props.header_len;
 536         return 0;
 537
 538 error:
 539         if (esp) {
 540                 if (esp->auth.tfm)
 541                         crypto_free_tfm(esp->auth.tfm);
 542                 if (esp->auth.work_icv)
 543                         kfree(esp->auth.work_icv);
 544                 if (esp->conf.tfm)
 545                         crypto_free_tfm(esp->conf.tfm);
 546                 kfree(esp);
 547         }
 548         return -EINVAL;
 549 }
 550
 551 static struct xfrm_type esp_type =
 552 {
 553         .description    = "ESP4",
 554         .owner          = THIS_MODULE,
 555         .proto          = IPPROTO_ESP,
 556         .init_state     = esp_init_state,
 557         .destructor     = esp_destroy,
 558         .get_max_size   = esp4_get_max_size,
 559         .input          = esp_input,
 560         .post_input     = esp_post_input,
 561         .output         = esp_output
 562 };
 563
 564 static struct inet_protocol esp4_protocol = {
 565         .handler        =       xfrm4_rcv,
 566         .err_handler    =       esp4_err,
 567         .no_policy      =       1,
 568 };
 569
 570 static int __init esp4_init(void)
 571 {
 572         struct xfrm_decap_state decap;
 573
 574         if (sizeof(struct esp_decap_data)  <
 575             sizeof(decap.decap_data)) {
 576                 extern void decap_data_too_small(void);
 577
 578                 decap_data_too_small();
 579         }
 580
 581         if (xfrm_register_type(&esp_type, AF_INET) < 0) {
 582                 printk(KERN_INFO "ip esp init: can't add xfrm type\n");
 583                 return -EAGAIN;
 584         }
 585         if (inet_add_protocol(&esp4_protocol, IPPROTO_ESP) < 0) {
 586                 printk(KERN_INFO "ip esp init: can't add protocol\n");
 587                 xfrm_unregister_type(&esp_type, AF_INET);
 588                 return -EAGAIN;
 589         }
 590         return 0;
 591 }
 592
 593 static void __exit esp4_fini(void)
 594 {
 595         if (inet_del_protocol(&esp4_protocol, IPPROTO_ESP) < 0)
 596                 printk(KERN_INFO "ip esp close: can't remove protocol\n");
 597         if (xfrm_unregister_type(&esp_type, AF_INET) < 0)
 598                 printk(KERN_INFO "ip esp close: can't remove xfrm type\n");
 599 }
 600
 601 module_init(esp4_init);
 602 module_exit(esp4_fini);
 603 MODULE_LICENSE("GPL");