summaryrefslogtreecommitdiff
path: root/net/xfrm
diff options
context:
space:
mode:
authorHerbert Xu <herbert@gondor.apana.org.au>2007-12-16 15:55:02 -0800
committerDavid S. Miller <davem@davemloft.net>2008-01-28 14:53:51 -0800
commit668dc8af3150f837f7f0461001bbbc0ce25d7bdf (patch)
tree9ba3534a190bb69b3aebf24aaa4340685fe16539 /net/xfrm
parentb2aa5e9d43a38dcdfa0878ed750cf32f98460278 (diff)
[IPSEC]: Move integrity stat collection into xfrm_input
Similar to the moving out of the replay processing on the output, this patch moves the integrity stat collectin from x->type->input into xfrm_input. This would eventually allow transforms such as AH/ESP to be lockless. The error value EBADMSG (currently unused in the crypto layer) is used to indicate a failed integrity check. In future this error can be directly returned by the crypto layer once we switch to aead algorithms. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/xfrm')
-rw-r--r--net/xfrm/xfrm_input.c5
1 files changed, 4 insertions, 1 deletions
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index 587f3474ed3d..b7d68eb9434c 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -147,8 +147,11 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
goto drop_unlock;
nexthdr = x->type->input(x, skb);
- if (nexthdr <= 0)
+ if (nexthdr <= 0) {
+ if (nexthdr == -EBADMSG)
+ x->stats.integrity_failed++;
goto drop_unlock;
+ }
skb_network_header(skb)[nhoff] = nexthdr;