X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;ds=sidebyside;f=src%2Fvnet%2Fipsec%2Fah_encrypt.c;h=a1f233cfda9d7176491c0754b9f662aeea74c817;hb=2d49830c7dabd3104770957724d61f8fa6998235;hp=7213e473723edf765a683c15ba82406b38d12eef;hpb=c7eaa711f3e25580687df0618e9ca80d3dc85e5f;p=vpp.git

diff --git a/src/vnet/ipsec/ah_encrypt.c b/src/vnet/ipsec/ah_encrypt.c
index 7213e473723..a1f233cfda9 100644
--- a/src/vnet/ipsec/ah_encrypt.c
+++ b/src/vnet/ipsec/ah_encrypt.c
@@ -116,8 +116,8 @@ typedef struct
      * integrity check */
     struct
     {
-      u8 hop_limit;
       u32 ip_version_traffic_class_and_flow_label;
+      u8 hop_limit;
     };
     struct
     {
@@ -125,8 +125,8 @@ typedef struct
       u8 tos;
     };
   };
-  i16 current_data;
   u8 skip;
+  i16 current_data;
   u32 sa_index;
 } ah_encrypt_packet_data_t;
 
@@ -195,6 +195,7 @@ ah_encrypt_inline (vlib_main_t * vm,
 
       if (PREDICT_TRUE (thread_index != sa0->thread_index))
 	{
+	  vnet_buffer (b[0])->ipsec.thread_index = sa0->thread_index;
 	  next[0] = AH_ENCRYPT_NEXT_HANDOFF;
 	  goto next;
 	}
@@ -251,14 +252,14 @@ ah_encrypt_inline (vlib_main_t * vm,
 	  oh6_0->ip6.ip_version_traffic_class_and_flow_label =
 	    ih6_0->ip6.ip_version_traffic_class_and_flow_label;
 
-	  ip6_set_dscp_network_order (&oh6_0->ip6, sa0->tunnel.t_dscp);
-
-	  tunnel_encap_fixup_6o6 (sa0->tunnel_flags,
-				  &ih6_0->ip6, &oh6_0->ip6);
-
+	  if (PREDICT_FALSE (ipsec_sa_is_set_IS_TUNNEL (sa0)))
+	    {
+	      ip6_set_dscp_network_order (&oh6_0->ip6, sa0->tunnel.t_dscp);
+	      tunnel_encap_fixup_6o6 (sa0->tunnel_flags, &ih6_0->ip6,
+				      &oh6_0->ip6);
+	    }
 	  pd->ip_version_traffic_class_and_flow_label =
 	    oh6_0->ip6.ip_version_traffic_class_and_flow_label;
-	  oh6_0->ip6.ip_version_traffic_class_and_flow_label = 0;
 
 	  if (PREDICT_TRUE (ipsec_sa_is_set_IS_TUNNEL (sa0)))
 	    {
@@ -287,20 +288,27 @@ ah_encrypt_inline (vlib_main_t * vm,
 	  oh0 = vlib_buffer_get_current (b[0]);
 	  pd->ttl = ih0->ip4.ttl;
 
-	  if (sa0->tunnel.t_dscp)
-	    pd->tos = sa0->tunnel.t_dscp << 2;
+	  if (PREDICT_FALSE (ipsec_sa_is_set_IS_TUNNEL (sa0)))
+	    {
+	      if (sa0->tunnel.t_dscp)
+		pd->tos = sa0->tunnel.t_dscp << 2;
+	      else
+		{
+		  pd->tos = ih0->ip4.tos;
+
+		  if (!(sa0->tunnel_flags &
+			TUNNEL_ENCAP_DECAP_FLAG_ENCAP_COPY_DSCP))
+		    pd->tos &= 0x3;
+		  if (!(sa0->tunnel_flags &
+			TUNNEL_ENCAP_DECAP_FLAG_ENCAP_COPY_ECN))
+		    pd->tos &= 0xfc;
+		}
+	    }
 	  else
 	    {
 	      pd->tos = ih0->ip4.tos;
-	      if (!
-		  (sa0->tunnel_flags &
-		   TUNNEL_ENCAP_DECAP_FLAG_ENCAP_COPY_DSCP))
-		pd->tos &= 0x3;
-	      if (!
-		  (sa0->tunnel_flags &
-		   TUNNEL_ENCAP_DECAP_FLAG_ENCAP_COPY_ECN))
-		pd->tos &= 0xfc;
 	    }
+
 	  pd->current_data = b[0]->current_data;
 	  clib_memset (oh0, 0, sizeof (ip4_and_ah_header_t));
 
@@ -377,6 +385,18 @@ ah_encrypt_inline (vlib_main_t * vm,
 	}
 
     next:
+      if (PREDICT_FALSE (b[0]->flags & VLIB_BUFFER_IS_TRACED))
+	{
+	  sa0 = vec_elt_at_index (im->sad, pd->sa_index);
+	  ah_encrypt_trace_t *tr =
+	    vlib_add_trace (vm, node, b[0], sizeof (*tr));
+	  tr->spi = sa0->spi;
+	  tr->seq_lo = sa0->seq;
+	  tr->seq_hi = sa0->seq_hi;
+	  tr->integ_alg = sa0->integ_alg;
+	  tr->sa_index = pd->sa_index;
+	}
+
       n_left -= 1;
       next += 1;
       pd += 1;
@@ -399,7 +419,7 @@ ah_encrypt_inline (vlib_main_t * vm,
   while (n_left)
     {
       if (pd->skip)
-	goto trace;
+	goto next_pkt;
 
       if (is_ip6)
 	{
@@ -416,19 +436,7 @@ ah_encrypt_inline (vlib_main_t * vm,
 	  oh0->ip4.checksum = ip4_header_checksum (&oh0->ip4);
 	}
 
-    trace:
-      if (PREDICT_FALSE (b[0]->flags & VLIB_BUFFER_IS_TRACED))
-	{
-	  sa0 = vec_elt_at_index (im->sad, pd->sa_index);
-	  ah_encrypt_trace_t *tr =
-	    vlib_add_trace (vm, node, b[0], sizeof (*tr));
-	  tr->spi = sa0->spi;
-	  tr->seq_lo = sa0->seq;
-	  tr->seq_hi = sa0->seq_hi;
-	  tr->integ_alg = sa0->integ_alg;
-	  tr->sa_index = pd->sa_index;
-	}
-
+    next_pkt:
       n_left -= 1;
       next += 1;
       pd += 1;
@@ -493,6 +501,25 @@ VLIB_REGISTER_NODE (ah6_encrypt_node) = {
 };
 /* *INDENT-ON* */
 
+#ifndef CLIB_MARCH_VARIANT
+
+static clib_error_t *
+ah_encrypt_init (vlib_main_t *vm)
+{
+  ipsec_main_t *im = &ipsec_main;
+
+  im->ah4_enc_fq_index =
+    vlib_frame_queue_main_init (ah4_encrypt_node.index, 0);
+  im->ah6_enc_fq_index =
+    vlib_frame_queue_main_init (ah6_encrypt_node.index, 0);
+
+  return 0;
+}
+
+VLIB_INIT_FUNCTION (ah_encrypt_init);
+
+#endif
+
 /*
  * fd.io coding-style-patch-verification: ON
  *