[IPSEC] ah: Remove keys from ah_data structure

The keys are only used during initialisation so we don't need to carry them
in esp_data.  Since we don't have to allocate them again, there is no need
to place a limit on the authentication key length anymore.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

2 files changed, 4 insertions, 14 deletions

diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index 39f6211f1496..dc1d8e871b24 100644
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -219,10 +219,6 @@ static int ah_init_state(struct xfrm_state *x)
         if (!x->aalg)
                 goto error;
 
-        /* null auth can use a zero length key */
-        if (x->aalg->alg_key_len > 512)
-                goto error;
-
         if (x->encap)
                 goto error;
 
@@ -230,14 +226,13 @@ static int ah_init_state(struct xfrm_state *x)
         if (ahp == NULL)
                 return -ENOMEM;
 
-        ahp->key = x->aalg->alg_key;
-        ahp->key_len = (x->aalg->alg_key_len+7)/8;
         tfm = crypto_alloc_hash(x->aalg->alg_name, 0, CRYPTO_ALG_ASYNC);
         if (IS_ERR(tfm))
                 goto error;
 
         ahp->tfm = tfm;
-        if (crypto_hash_setkey(tfm, ahp->key, ahp->key_len))
+        if (crypto_hash_setkey(tfm, x->aalg->alg_key,
+                               (x->aalg->alg_key_len + 7) / 8))
                 goto error;
 
         /*
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index 53f46ab6af70..69a2030407b8 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -429,10 +429,6 @@ static int ah6_init_state(struct xfrm_state *x)
         if (!x->aalg)
                 goto error;
 
-        /* null auth can use a zero length key */
-        if (x->aalg->alg_key_len > 512)
-                goto error;
-
         if (x->encap)
                 goto error;
 
@@ -440,14 +436,13 @@ static int ah6_init_state(struct xfrm_state *x)
         if (ahp == NULL)
                 return -ENOMEM;
 
-        ahp->key = x->aalg->alg_key;
-        ahp->key_len = (x->aalg->alg_key_len+7)/8;
         tfm = crypto_alloc_hash(x->aalg->alg_name, 0, CRYPTO_ALG_ASYNC);
         if (IS_ERR(tfm))
                 goto error;
 
         ahp->tfm = tfm;
-        if (crypto_hash_setkey(tfm, ahp->key, ahp->key_len))
+        if (crypto_hash_setkey(tfm, x->aalg->alg_key,
+                               (x->aalg->alg_key_len + 7) / 8))
                 goto error;
 
         /*