IPSEC-AH: fix packet drop

[vpp.git] / src / vnet / ipsec / esp_decrypt.c

diff --git a/src/vnet/ipsec/esp_decrypt.c b/src/vnet/ipsec/esp_decrypt.c
index bfddb9e..8ef160a 100644 (file)
--- a/src/vnet/ipsec/esp_decrypt.c
+++ b/src/vnet/ipsec/esp_decrypt.c
@@ -190,7 +190,6 @@ esp_decrypt_inline (vlib_main_t * vm,
 
              if (PREDICT_FALSE (rv))
                {
-                 clib_warning ("anti-replay SPI %u seq %u", sa0->spi, seq);
                  if (is_ip6)
                    vlib_node_increment_counter (vm,
                                                 esp6_decrypt_node.index,
@@ -213,7 +212,7 @@ esp_decrypt_inline (vlib_main_t * vm,
              u8 sig[64];
              int icv_size =
                em->ipsec_proto_main_integ_algs[sa0->integ_alg].trunc_size;
-             memset (sig, 0, sizeof (sig));
+             clib_memset (sig, 0, sizeof (sig));
              u8 *icv =
                vlib_buffer_get_current (i_b0) + i_b0->current_length -
                icv_size;
@@ -330,7 +329,6 @@ esp_decrypt_inline (vlib_main_t * vm,
                    next0 = ESP_DECRYPT_NEXT_IP6_INPUT;
                  else
                    {
-                     clib_warning ("next header: 0x%x", f0->next_header);
                      if (is_ip6)
                        vlib_node_increment_counter (vm,
                                                     esp6_decrypt_node.index,
@@ -429,16 +427,15 @@ free_buffers_and_exit:
   return from_frame->n_vectors;
 }
 
-static uword
-esp4_decrypt_node_fn (vlib_main_t * vm,
-                     vlib_node_runtime_t * node, vlib_frame_t * from_frame)
+VLIB_NODE_FN (esp4_decrypt_node) (vlib_main_t * vm,
+                                 vlib_node_runtime_t * node,
+                                 vlib_frame_t * from_frame)
 {
   return esp_decrypt_inline (vm, node, from_frame, 0 /* is_ip6 */ );
 }
 
 /* *INDENT-OFF* */
 VLIB_REGISTER_NODE (esp4_decrypt_node) = {
-  .function = esp4_decrypt_node_fn,
   .name = "esp4-decrypt",
   .vector_size = sizeof (u32),
   .format_trace = format_esp_decrypt_trace,
@@ -456,18 +453,15 @@ VLIB_REGISTER_NODE (esp4_decrypt_node) = {
 };
 /* *INDENT-ON* */
 
-VLIB_NODE_FUNCTION_MULTIARCH (esp4_decrypt_node, esp4_decrypt_node_fn);
-
-static uword
-esp6_decrypt_node_fn (vlib_main_t * vm,
-                     vlib_node_runtime_t * node, vlib_frame_t * from_frame)
+VLIB_NODE_FN (esp6_decrypt_node) (vlib_main_t * vm,
+                                 vlib_node_runtime_t * node,
+                                 vlib_frame_t * from_frame)
 {
   return esp_decrypt_inline (vm, node, from_frame, 1 /* is_ip6 */ );
 }
 
 /* *INDENT-OFF* */
 VLIB_REGISTER_NODE (esp6_decrypt_node) = {
-  .function = esp6_decrypt_node_fn,
   .name = "esp6-decrypt",
   .vector_size = sizeof (u32),
   .format_trace = format_esp_decrypt_trace,
@@ -485,7 +479,6 @@ VLIB_REGISTER_NODE (esp6_decrypt_node) = {
 };
 /* *INDENT-ON* */
 
-VLIB_NODE_FUNCTION_MULTIARCH (esp6_decrypt_node, esp6_decrypt_node_fn);
 /*
  * fd.io coding-style-patch-verification: ON
  *