X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fvnet%2Fipsec%2Fesp_decrypt.c;h=0cf31ffb00003f5d0f91ed6b6dced8bf70fe194c;hb=eba31ecebed1a7d168da17194cab7a8955761f2b;hp=1b3e0681ae12035940fbdff81929cff539b76d4f;hpb=b8f354470628e464452c062ca0802f59f8e572f3;p=vpp.git

diff --git a/src/vnet/ipsec/esp_decrypt.c b/src/vnet/ipsec/esp_decrypt.c
index 1b3e0681ae1..0cf31ffb000 100644
--- a/src/vnet/ipsec/esp_decrypt.c
+++ b/src/vnet/ipsec/esp_decrypt.c
@@ -131,14 +131,8 @@ esp_decrypt_inline (vlib_main_t * vm,
 
   if (PREDICT_FALSE (vec_len (empty_buffers) < n_left_from))
     {
-      if (is_ip6)
-	vlib_node_increment_counter (vm, esp6_decrypt_node.index,
-				     ESP_DECRYPT_ERROR_NO_BUFFER,
-				     n_left_from);
-      else
-	vlib_node_increment_counter (vm, esp4_decrypt_node.index,
-				     ESP_DECRYPT_ERROR_NO_BUFFER,
-				     n_left_from);
+      vlib_node_increment_counter (vm, node->node_index,
+				   ESP_DECRYPT_ERROR_NO_BUFFER, n_left_from);
       goto free_buffers_and_exit;
     }
 
@@ -190,15 +184,8 @@ esp_decrypt_inline (vlib_main_t * vm,
 
 	      if (PREDICT_FALSE (rv))
 		{
-		  clib_warning ("anti-replay SPI %u seq %u", sa0->spi, seq);
-		  if (is_ip6)
-		    vlib_node_increment_counter (vm,
-						 esp6_decrypt_node.index,
-						 ESP_DECRYPT_ERROR_REPLAY, 1);
-		  else
-		    vlib_node_increment_counter (vm,
-						 esp4_decrypt_node.index,
-						 ESP_DECRYPT_ERROR_REPLAY, 1);
+		  vlib_node_increment_counter (vm, node->node_index,
+					       ESP_DECRYPT_ERROR_REPLAY, 1);
 		  o_bi0 = i_bi0;
 		  to_next[0] = o_bi0;
 		  to_next += 1;
@@ -206,7 +193,9 @@ esp_decrypt_inline (vlib_main_t * vm,
 		}
 	    }
 
-	  sa0->total_data_size += i_b0->current_length;
+	  vlib_increment_combined_counter
+	    (&ipsec_sa_counters, thread_index, sa_index0,
+	     1, i_b0->current_length);
 
 	  if (PREDICT_TRUE (sa0->integ_alg != IPSEC_INTEG_ALG_NONE))
 	    {
@@ -219,22 +208,16 @@ esp_decrypt_inline (vlib_main_t * vm,
 		icv_size;
 	      i_b0->current_length -= icv_size;
 
-	      hmac_calc (sa0->integ_alg, sa0->integ_key, sa0->integ_key_len,
-			 (u8 *) esp0, i_b0->current_length, sig, sa0->use_esn,
+	      hmac_calc (sa0->integ_alg, sa0->integ_key.data,
+			 sa0->integ_key.len, (u8 *) esp0,
+			 i_b0->current_length, sig, sa0->use_esn,
 			 sa0->seq_hi);
 
 	      if (PREDICT_FALSE (memcmp (icv, sig, icv_size)))
 		{
-		  if (is_ip6)
-		    vlib_node_increment_counter (vm,
-						 esp6_decrypt_node.index,
-						 ESP_DECRYPT_ERROR_INTEG_ERROR,
-						 1);
-		  else
-		    vlib_node_increment_counter (vm,
-						 esp4_decrypt_node.index,
-						 ESP_DECRYPT_ERROR_INTEG_ERROR,
-						 1);
+		  vlib_node_increment_counter (vm, node->node_index,
+					       ESP_DECRYPT_ERROR_INTEG_ERROR,
+					       1);
 		  o_bi0 = i_bi0;
 		  to_next[0] = o_bi0;
 		  to_next += 1;
@@ -297,9 +280,19 @@ esp_decrypt_inline (vlib_main_t * vm,
 		    }
 		  else
 		    {
-		      ih4 =
-			(ip4_header_t *) ((u8 *) esp0 -
-					  sizeof (ip4_header_t));
+		      if (sa0->udp_encap)
+			{
+			  ih4 =
+			    (ip4_header_t *) ((u8 *) esp0 -
+					      sizeof (udp_header_t) -
+					      sizeof (ip4_header_t));
+			}
+		      else
+			{
+			  ih4 =
+			    (ip4_header_t *) ((u8 *) esp0 -
+					      sizeof (ip4_header_t));
+			}
 		      oh4 = vlib_buffer_get_current (o_b0);
 		      ip_hdr_size = sizeof (ip4_header_t);
 		    }
@@ -309,7 +302,7 @@ esp_decrypt_inline (vlib_main_t * vm,
 			       esp0->data + IV_SIZE,
 			       (u8 *) vlib_buffer_get_current (o_b0) +
 			       ip_hdr_size, BLOCK_SIZE * blocks,
-			       sa0->crypto_key, esp0->data);
+			       sa0->crypto_key.data, esp0->data);
 
 	      o_b0->current_length = (blocks * BLOCK_SIZE) - 2 + ip_hdr_size;
 	      o_b0->flags = VLIB_BUFFER_TOTAL_LENGTH_VALID;
@@ -330,17 +323,9 @@ esp_decrypt_inline (vlib_main_t * vm,
 		    next0 = ESP_DECRYPT_NEXT_IP6_INPUT;
 		  else
 		    {
-		      clib_warning ("next header: 0x%x", f0->next_header);
-		      if (is_ip6)
-			vlib_node_increment_counter (vm,
-						     esp6_decrypt_node.index,
-						     ESP_DECRYPT_ERROR_DECRYPTION_FAILED,
-						     1);
-		      else
-			vlib_node_increment_counter (vm,
-						     esp4_decrypt_node.index,
-						     ESP_DECRYPT_ERROR_DECRYPTION_FAILED,
-						     1);
+		      vlib_node_increment_counter (vm, node->node_index,
+						   ESP_DECRYPT_ERROR_DECRYPTION_FAILED,
+						   1);
 		      o_b0 = 0;
 		      goto trace;
 		    }
@@ -412,14 +397,9 @@ esp_decrypt_inline (vlib_main_t * vm,
 	}
       vlib_put_next_frame (vm, node, next_index, n_left_to_next);
     }
-  if (is_ip6)
-    vlib_node_increment_counter (vm, esp6_decrypt_node.index,
-				 ESP_DECRYPT_ERROR_RX_PKTS,
-				 from_frame->n_vectors);
-  else
-    vlib_node_increment_counter (vm, esp4_decrypt_node.index,
-				 ESP_DECRYPT_ERROR_RX_PKTS,
-				 from_frame->n_vectors);
+  vlib_node_increment_counter (vm, node->node_index,
+			       ESP_DECRYPT_ERROR_RX_PKTS,
+			       from_frame->n_vectors);
 
 
 free_buffers_and_exit: