netdev - [PATCH 1/2 net-next] xfrm: count esp/ah header to lifetime

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Fri,  1 Feb 2013 13:17:15 +0800
From:	roy.qing.li@...il.com
To:	netdev@...r.kernel.org, steffen.klassert@...unet.com
Subject: [PATCH 1/2 net-next] xfrm: count esp/ah header to lifetime

From: Li RongQing <roy.qing.li@...il.com> 

rfc4301 4.4.2 says:

(a) If byte count is used, then the implementation SHOULD count the
    number of bytes to which the IPsec cryptographic algorithm is
    applied.  For ESP, this is the encryption algorithm (including
    Null encryption) and for AH, this is the authentication
    algorithm.  This includes pad bytes, etc.

Signed-off-by: Li RongQing <roy.qing.li@...il.com>
---
 net/xfrm/xfrm_input.c  |    4 +++-
 net/xfrm/xfrm_output.c |    8 +++++---
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index ab2bb42..da156e9 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -114,6 +114,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
 	unsigned int family;
 	int decaps = 0;
 	int async = 0;
+	int skb_len = 0;
 
 	/* A negative encap_type indicates async resumption. */
 	if (encap_type < 0) {
@@ -192,6 +193,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
 
 		skb_dst_force(skb);
 
+		skb_len = skb->len;
 		nexthdr = x->type->input(x, skb);
 
 		if (nexthdr == -EINPROGRESS)
@@ -219,7 +221,7 @@ resume:
 
 		x->repl->advance(x, seq);
 
-		x->curlft.bytes += skb->len;
+		x->curlft.bytes += skb_len;
 		x->curlft.packets++;
 
 		spin_unlock(&x->lock);
diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index 3670526..2c5aa8d 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -79,9 +79,6 @@ static int xfrm_output_one(struct sk_buff *skb, int err)
 			goto error;
 		}
 
-		x->curlft.bytes += skb->len;
-		x->curlft.packets++;
-
 		spin_unlock_bh(&x->lock);
 
 		skb_dst_force(skb);
@@ -90,6 +87,11 @@ static int xfrm_output_one(struct sk_buff *skb, int err)
 		if (err == -EINPROGRESS)
 			goto out_exit;
 
+		spin_lock_bh(&x->lock);
+		x->curlft.bytes += skb->len;
+		x->curlft.packets++;
+		spin_unlock_bh(&x->lock);
+
 resume:
 		if (err) {
 			XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEPROTOERROR);
-- 
1.7.10.4

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html