crypto error ipsec counter

[Alexander Bluhm]

Hi,

Propagate the crypto errors and count them in ipsec.  This is part
of a larger diff where I disable the crypto queues for ipsec.  I
think it cannot happen, but errors should always be checked.

tq is never NULL.

I know that tdb->tdb_odrops++ is not MP safe.  I have just copied
the code.  My plan is to address this in multiple places later.

ok?

bluhm

Index: crypto/crypto.c
===================================================================
RCS file: /data/mirror/openbsd/cvs/src/sys/crypto/crypto.c,v
retrieving revision 1.83
diff -u -p -r1.83 crypto.c
--- crypto/crypto.c     30 Jun 2021 12:21:02 -0000      1.83
+++ crypto/crypto.c     20 Jul 2021 22:51:56 -0000
@@ -388,7 +388,7 @@ int
 crypto_dispatch(struct cryptop *crp)
 {
        struct taskq *tq = crypto_taskq;
-       int s;
+       int error = 0, s;
        u_int32_t hid;
 
        s = splvm();
@@ -399,14 +399,14 @@ crypto_dispatch(struct cryptop *crp)
        }
        splx(s);
 
-       if (tq && !(crp->crp_flags & CRYPTO_F_NOQUEUE)) {
+       if ((crp->crp_flags & CRYPTO_F_NOQUEUE) == 0) {
                task_set(&crp->crp_task, (void (*))crypto_invoke, crp);
                task_add(tq, &crp->crp_task);
        } else {
-               crypto_invoke(crp);
+               error = crypto_invoke(crp);
        }
 
-       return 0;
+       return error;
 }
 
 /*
Index: netinet/ipsec_output.c
===================================================================
RCS file: /data/mirror/openbsd/cvs/src/sys/netinet/ipsec_output.c,v
retrieving revision 1.82
diff -u -p -r1.82 ipsec_output.c
--- netinet/ipsec_output.c      8 Jul 2021 15:13:14 -0000       1.82
+++ netinet/ipsec_output.c      20 Jul 2021 23:09:06 -0000
@@ -418,7 +418,12 @@ ipsec_output_cb(struct cryptop *crp)
                        if (tdb->tdb_cryptoid != 0)
                                tdb->tdb_cryptoid = crp->crp_sid;
                        NET_UNLOCK();
-                       crypto_dispatch(crp);
+                       error = crypto_dispatch(crp);
+                       if (error) {
+                               DPRINTF("crypto dispatch error %d", error);
+                               ipsecstat_inc(ipsec_odrops);
+                               tdb->tdb_odrops++;
+                       }
                        return;
                }
                DPRINTF("crypto error %d", crp->crp_etype);