X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fvnet%2Fip%2Fip_in_out_acl.c;h=699f69eda78c42b27d601dcac8b8442675eb32a8;hb=3935fc8527c340535a00108b78f3de064df50a7f;hp=b50f5b1ff674fc4057faf2d311425fe7094bb151;hpb=1bc560463b96930b067452c8908c6bb6adf0e129;p=vpp.git

diff --git a/src/vnet/ip/ip_in_out_acl.c b/src/vnet/ip/ip_in_out_acl.c
index b50f5b1ff67..699f69eda78 100644
--- a/src/vnet/ip/ip_in_out_acl.c
+++ b/src/vnet/ip/ip_in_out_acl.c
@@ -401,6 +401,10 @@ ip_in_out_acl_inline (vlib_main_t * vm,
 		      else
 			h0 = b0->data;
 
+		      /* advance the match pointer so the matching happens on IP header */
+		      if (is_output)
+			h0 += vnet_buffer (b0)->l2_classify.pad.l2_len;
+
 		      hash0 = vnet_classify_hash_packet (t0, (u8 *) h0);
 		      e0 = vnet_classify_find_entry
 			(t0, (u8 *) h0, hash0, now);
@@ -424,11 +428,19 @@ ip_in_out_acl_inline (vlib_main_t * vm,
 			       IP6_ERROR_INACL_SESSION_DENY) : IP6_ERROR_NONE;
 			  b0->error = error_node->errors[error0];
 
-			  if (e0->action == CLASSIFY_ACTION_SET_IP4_FIB_INDEX
-			      || e0->action ==
-			      CLASSIFY_ACTION_SET_IP6_FIB_INDEX)
-			    vnet_buffer (b0)->sw_if_index[VLIB_TX] =
-			      e0->metadata;
+			  if (!is_output)
+			    {
+			      if (e0->action ==
+				  CLASSIFY_ACTION_SET_IP4_FIB_INDEX
+				  || e0->action ==
+				  CLASSIFY_ACTION_SET_IP6_FIB_INDEX)
+				vnet_buffer (b0)->sw_if_index[VLIB_TX] =
+				  e0->metadata;
+			      else if (e0->action ==
+				       CLASSIFY_ACTION_SET_METADATA)
+				vnet_buffer (b0)->ip.adj_index[VLIB_TX] =
+				  e0->metadata;
+			    }
 			  break;
 			}
 		    }