Commit 436a0a40 authored by Herbert Xu's avatar Herbert Xu Committed by David S. Miller
Browse files

[IPSEC]: Move output replay code into xfrm_output 



The replay counter is one of only two remaining things in the output code
that requires a lock on the xfrm state (the other being the crypto).  This
patch moves it into the generic xfrm_output so we can remove the lock from
the transforms themselves.

Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 83815dea

include/net/xfrm.h

+19 −1
Original line number Diff line number Diff line
@@ -2,7 +2,6 @@ 
#define _NET_XFRM_H



#include <linux/compiler.h>

#include <linux/in.h>

#include <linux/xfrm.h>

#include <linux/spinlock.h>

#include <linux/list.h>
@@ -16,6 +15,7 @@ 


#include <net/sock.h>

#include <net/dst.h>

#include <net/ip.h>

#include <net/route.h>

#include <net/ipv6.h>

#include <net/ip6_fib.h>
@@ -279,6 +279,7 @@ struct xfrm_type 
	__u8			proto;

	__u8			flags;

#define XFRM_TYPE_NON_FRAGMENT	1

#define XFRM_TYPE_REPLAY_PROT	2



	int			(*init_state)(struct xfrm_state *x);

	void			(*destructor)(struct xfrm_state *);
@@ -419,6 +420,23 @@ extern int xfrm_unregister_km(struct xfrm_mgr *km); 


extern unsigned int xfrm_policy_count[XFRM_POLICY_MAX*2];



/*

 * This structure is used for the duration where packets are being

 * transformed by IPsec.  As soon as the packet leaves IPsec the

 * area beyond the generic IP part may be overwritten.

 */

struct xfrm_skb_cb {

	union {

		struct inet_skb_parm h4;

		struct inet6_skb_parm h6;

        } header;



        /* Sequence number for replay protection. */

        u64 seq;

};



#define XFRM_SKB_CB(__skb) ((struct xfrm_skb_cb *)&((__skb)->cb[0]))



/* Audit Information */

struct xfrm_audit

{

net/ipv4/ah4.c

+2 −2
Original line number Diff line number Diff line
@@ -96,8 +96,7 @@ static int ah_output(struct xfrm_state *x, struct sk_buff *skb) 


	ah->reserved = 0;

	ah->spi = x->id.spi;

	ah->seq_no = htonl(++x->replay.oseq);

	xfrm_aevent_doreplay(x);

	ah->seq_no = htonl(XFRM_SKB_CB(skb)->seq);

	err = ah_mac_digest(ahp, skb, ah->auth_data);

	if (err)

		goto error;
@@ -297,6 +296,7 @@ static struct xfrm_type ah_type = 
	.description	= "AH4",

	.owner		= THIS_MODULE,

	.proto	     	= IPPROTO_AH,

	.flags		= XFRM_TYPE_REPLAY_PROT,

	.init_state	= ah_init_state,

	.destructor	= ah_destroy,

	.input		= ah_input,

net/ipv4/esp4.c

+2 −2
Original line number Diff line number Diff line
@@ -95,8 +95,7 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb) 
		top_iph->protocol = IPPROTO_ESP;



	esph->spi = x->id.spi;

	esph->seq_no = htonl(++x->replay.oseq);

	xfrm_aevent_doreplay(x);

	esph->seq_no = htonl(XFRM_SKB_CB(skb)->seq);



	if (esp->conf.ivlen) {

		if (unlikely(!esp->conf.ivinitted)) {
@@ -437,6 +436,7 @@ static struct xfrm_type esp_type = 
	.description	= "ESP4",

	.owner		= THIS_MODULE,

	.proto	     	= IPPROTO_ESP,

	.flags		= XFRM_TYPE_REPLAY_PROT,

	.init_state	= esp_init_state,

	.destructor	= esp_destroy,

	.get_mtu	= esp4_get_mtu,

net/ipv6/ah6.c

+2 −2
Original line number Diff line number Diff line
@@ -283,8 +283,7 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb) 


	ah->reserved = 0;

	ah->spi = x->id.spi;

	ah->seq_no = htonl(++x->replay.oseq);

	xfrm_aevent_doreplay(x);

	ah->seq_no = htonl(XFRM_SKB_CB(skb)->seq);

	err = ah_mac_digest(ahp, skb, ah->auth_data);

	if (err)

		goto error_free_iph;
@@ -506,6 +505,7 @@ static struct xfrm_type ah6_type = 
	.description	= "AH6",

	.owner		= THIS_MODULE,

	.proto	     	= IPPROTO_AH,

	.flags		= XFRM_TYPE_REPLAY_PROT,

	.init_state	= ah6_init_state,

	.destructor	= ah6_destroy,

	.input		= ah6_input,

net/ipv6/esp6.c

+2 −2
Original line number Diff line number Diff line
@@ -95,8 +95,7 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb) 
	*skb_network_header(skb) = IPPROTO_ESP;



	esph->spi = x->id.spi;

	esph->seq_no = htonl(++x->replay.oseq);

	xfrm_aevent_doreplay(x);

	esph->seq_no = htonl(XFRM_SKB_CB(skb)->seq);



	if (esp->conf.ivlen) {

		if (unlikely(!esp->conf.ivinitted)) {
@@ -373,6 +372,7 @@ static struct xfrm_type esp6_type = 
	.description	= "ESP6",

	.owner	     	= THIS_MODULE,

	.proto	     	= IPPROTO_ESP,

	.flags		= XFRM_TYPE_REPLAY_PROT,

	.init_state	= esp6_init_state,

	.destructor	= esp6_destroy,

	.get_mtu	= esp6_get_mtu,