hs-test: cache docker build in local filesystem

[vpp.git] / src / vnet / ipsec / ah_decrypt.c

diff --git a/src/vnet/ipsec/ah_decrypt.c b/src/vnet/ipsec/ah_decrypt.c
index 5f98693..ec4db0f 100644 (file)
--- a/src/vnet/ipsec/ah_decrypt.c
+++ b/src/vnet/ipsec/ah_decrypt.c
@@ -128,6 +128,7 @@ ah_decrypt_inline (vlib_main_t * vm,
   from = vlib_frame_vector_args (from_frame);
   n_left = from_frame->n_vectors;
   ipsec_sa_t *sa0 = 0;
+  bool anti_replay_result;
   u32 current_sa_index = ~0, current_sa_bytes = 0, current_sa_pkts = 0;
 
   clib_memset (pkt_data, 0, VLIB_FRAME_SIZE * sizeof (pkt_data[0]));
@@ -201,8 +202,17 @@ ah_decrypt_inline (vlib_main_t * vm,
       pd->seq = clib_host_to_net_u32 (ah0->seq_no);
 
       /* anti-replay check */
-      if (ipsec_sa_anti_replay_and_sn_advance (sa0, pd->seq, ~0, false,
-                                              &pd->seq_hi))
+      if (PREDICT_FALSE (ipsec_sa_is_set_ANTI_REPLAY_HUGE (sa0)))
+       {
+         anti_replay_result = ipsec_sa_anti_replay_and_sn_advance (
+           sa0, pd->seq, ~0, false, &pd->seq_hi, true);
+       }
+      else
+       {
+         anti_replay_result = ipsec_sa_anti_replay_and_sn_advance (
+           sa0, pd->seq, ~0, false, &pd->seq_hi, false);
+       }
+      if (anti_replay_result)
        {
          ah_decrypt_set_next_index (b[0], node, vm->thread_index,
                                     AH_DECRYPT_ERROR_REPLAY, 0, next,
@@ -306,16 +316,32 @@ ah_decrypt_inline (vlib_main_t * vm,
       if (PREDICT_TRUE (sa0->integ_alg != IPSEC_INTEG_ALG_NONE))
        {
          /* redo the anti-reply check. see esp_decrypt for details */
-         if (ipsec_sa_anti_replay_and_sn_advance (sa0, pd->seq, pd->seq_hi,
-                                                  true, NULL))
+         if (PREDICT_FALSE (ipsec_sa_is_set_ANTI_REPLAY_HUGE (sa0)))
            {
-             ah_decrypt_set_next_index (b[0], node, vm->thread_index,
-                                        AH_DECRYPT_ERROR_REPLAY, 0, next,
-                                        AH_DECRYPT_NEXT_DROP, pd->sa_index);
-             goto trace;
+             if (ipsec_sa_anti_replay_and_sn_advance (
+                   sa0, pd->seq, pd->seq_hi, true, NULL, true))
+               {
+                 ah_decrypt_set_next_index (
+                   b[0], node, vm->thread_index, AH_DECRYPT_ERROR_REPLAY, 0,
+                   next, AH_DECRYPT_NEXT_DROP, pd->sa_index);
+                 goto trace;
+               }
+             n_lost = ipsec_sa_anti_replay_advance (
+               sa0, thread_index, pd->seq, pd->seq_hi, true);
+           }
+         else
+           {
+             if (ipsec_sa_anti_replay_and_sn_advance (
+                   sa0, pd->seq, pd->seq_hi, true, NULL, false))
+               {
+                 ah_decrypt_set_next_index (
+                   b[0], node, vm->thread_index, AH_DECRYPT_ERROR_REPLAY, 0,
+                   next, AH_DECRYPT_NEXT_DROP, pd->sa_index);
+                 goto trace;
+               }
+             n_lost = ipsec_sa_anti_replay_advance (
+               sa0, thread_index, pd->seq, pd->seq_hi, false);
            }
-         n_lost = ipsec_sa_anti_replay_advance (sa0, thread_index, pd->seq,
-                                                pd->seq_hi);
          vlib_prefetch_simple_counter (
            &ipsec_sa_err_counters[IPSEC_SA_ERROR_LOST], thread_index,
            pd->sa_index);
@@ -424,7 +450,6 @@ VLIB_NODE_FN (ah4_decrypt_node) (vlib_main_t * vm,
   return ah_decrypt_inline (vm, node, from_frame, 0 /* is_ip6 */ );
 }
 
-/* *INDENT-OFF* */
 VLIB_REGISTER_NODE (ah4_decrypt_node) = {
   .name = "ah4-decrypt",
   .vector_size = sizeof (u32),
@@ -442,7 +467,6 @@ VLIB_REGISTER_NODE (ah4_decrypt_node) = {
     [AH_DECRYPT_NEXT_HANDOFF] = "ah4-decrypt-handoff",
   },
 };
-/* *INDENT-ON* */
 
 VLIB_NODE_FN (ah6_decrypt_node) (vlib_main_t * vm,
                                 vlib_node_runtime_t * node,
@@ -451,7 +475,6 @@ VLIB_NODE_FN (ah6_decrypt_node) (vlib_main_t * vm,
   return ah_decrypt_inline (vm, node, from_frame, 1 /* is_ip6 */ );
 }
 
-/* *INDENT-OFF* */
 VLIB_REGISTER_NODE (ah6_decrypt_node) = {
   .name = "ah6-decrypt",
   .vector_size = sizeof (u32),
@@ -469,7 +492,6 @@ VLIB_REGISTER_NODE (ah6_decrypt_node) = {
     [AH_DECRYPT_NEXT_HANDOFF] = "ah6-decrypt-handoff",
   },
 };
-/* *INDENT-ON* */
 
 #ifndef CLIB_MARCH_VARIANT
 
@@ -478,10 +500,10 @@ ah_decrypt_init (vlib_main_t *vm)
 {
   ipsec_main_t *im = &ipsec_main;
 
-  im->ah4_dec_fq_index =
-    vlib_frame_queue_main_init (ah4_decrypt_node.index, 0);
-  im->ah6_dec_fq_index =
-    vlib_frame_queue_main_init (ah6_decrypt_node.index, 0);
+  im->ah4_dec_fq_index = vlib_frame_queue_main_init (ah4_decrypt_node.index,
+                                                    im->handoff_queue_size);
+  im->ah6_dec_fq_index = vlib_frame_queue_main_init (ah6_decrypt_node.index,
+                                                    im->handoff_queue_size);
 
   return 0;
 }