crypto: add vnet_crypto_op_init (...)

[vpp.git] / src / vnet / ipsec / esp_decrypt.c

diff --git a/src/vnet/ipsec/esp_decrypt.c b/src/vnet/ipsec/esp_decrypt.c
index 7860ca3..b354a9e 100644 (file)
--- a/src/vnet/ipsec/esp_decrypt.c
+++ b/src/vnet/ipsec/esp_decrypt.c
@@ -87,11 +87,10 @@ esp_decrypt_cbc (vlib_main_t * vm, ipsec_sa_t * sa,
 {
   vnet_crypto_op_t _op, *op = &_op;
 
-
   if (PREDICT_FALSE (sa->crypto_dec_op_type == VNET_CRYPTO_OP_NONE))
     return;
 
-  op->op = sa->crypto_dec_op_type;
+  vnet_crypto_op_init (op, sa->crypto_dec_op_type);
   op->iv = iv;
   op->src = in;
   op->dst = out;
@@ -134,7 +133,6 @@ esp_decrypt_inline (vlib_main_t * vm,
       esp_header_t *esp0;
       ipsec_sa_t *sa0;
       u32 sa_index0 = ~0;
-      u32 seq;
       ip4_header_t *ih4 = 0, *oh4 = 0;
       ip6_header_t *ih6 = 0, *oh6 = 0;
       u8 tunnel_mode = 1;
@@ -144,29 +142,18 @@ esp_decrypt_inline (vlib_main_t * vm,
       esp0 = vlib_buffer_get_current (ib[0]);
       sa_index0 = vnet_buffer (ib[0])->ipsec.sad_index;
       sa0 = pool_elt_at_index (im->sad, sa_index0);
-      seq = clib_host_to_net_u32 (esp0->seq);
 
       /* anti-replay check */
-      if (sa0->use_anti_replay)
+      if (ipsec_sa_anti_replay_check (sa0, &esp0->seq))
        {
-         int rv = 0;
-
-         if (PREDICT_TRUE (sa0->use_esn))
-           rv = esp_replay_check_esn (sa0, seq);
-         else
-           rv = esp_replay_check (sa0, seq);
-
-         if (PREDICT_FALSE (rv))
-           {
-             u32 tmp, off = n_alloc - n_left_from;
-             /* send original packet to drop node */
-             tmp = from[off];
-             from[off] = new_bufs[off];
-             new_bufs[off] = tmp;
-             ib[0]->error = node->errors[ESP_DECRYPT_ERROR_REPLAY];
-             next[0] = ESP_DECRYPT_NEXT_DROP;
-             goto trace;
-           }
+         u32 tmp, off = n_alloc - n_left_from;
+         /* send original packet to drop node */
+         tmp = from[off];
+         from[off] = new_bufs[off];
+         new_bufs[off] = tmp;
+         ib[0]->error = node->errors[ESP_DECRYPT_ERROR_REPLAY];
+         next[0] = ESP_DECRYPT_NEXT_DROP;
+         goto trace;
        }
 
       vlib_increment_combined_counter
@@ -197,13 +184,7 @@ esp_decrypt_inline (vlib_main_t * vm,
            }
        }
 
-      if (PREDICT_TRUE (sa0->use_anti_replay))
-       {
-         if (PREDICT_TRUE (sa0->use_esn))
-           esp_replay_advance_esn (sa0, seq);
-         else
-           esp_replay_advance (sa0, seq);
-       }
+      ipsec_sa_anti_replay_advance (sa0, &esp0->seq);
 
       if ((sa0->crypto_alg >= IPSEC_CRYPTO_ALG_AES_CBC_128 &&
           sa0->crypto_alg <= IPSEC_CRYPTO_ALG_AES_CBC_256) ||
@@ -222,7 +203,8 @@ esp_decrypt_inline (vlib_main_t * vm,
          ob[0]->current_data = sizeof (ethernet_header_t);
 
          /* transport mode */
-         if (PREDICT_FALSE (!sa0->is_tunnel && !sa0->is_tunnel_ip6))
+         if (PREDICT_FALSE (!ipsec_sa_is_set_IS_TUNNEL (sa0) &&
+                            !ipsec_sa_is_set_IS_TUNNEL_V6 (sa0)))
            {
              tunnel_mode = 0;
 
@@ -235,7 +217,7 @@ esp_decrypt_inline (vlib_main_t * vm,
              else
                {
                  ip_hdr_size = sizeof (ip4_header_t);
-                 if (sa0->udp_encap)
+                 if (ipsec_sa_is_set_UDP_ENCAP (sa0))
                    ih4 = (ip4_header_t *) ((u8 *) esp0 - ip_hdr_size -
                                            sizeof (udp_header_t));
                  else