X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fvnet%2Fipsec%2Fesp_decrypt.c;h=62b12dbbdf6314d5859e981d9b744d69c98f56a7;hb=8640dbdb7292d8d206aab3a90551d93798c9c50c;hp=a769e6bd51a4a15be2fe7da9695eb9d56bb42c28;hpb=07a38572caa2c2d2d8658420a7c3df8e7f9d0e74;p=vpp.git

diff --git a/src/vnet/ipsec/esp_decrypt.c b/src/vnet/ipsec/esp_decrypt.c
index a769e6bd51a..62b12dbbdf6 100644
--- a/src/vnet/ipsec/esp_decrypt.c
+++ b/src/vnet/ipsec/esp_decrypt.c
@@ -268,9 +268,10 @@ esp_decrypt_node_fn (vlib_main_t * vm,
 	      if (PREDICT_FALSE (!sa0->is_tunnel && !sa0->is_tunnel_ip6))
 		{
 		  tunnel_mode = 0;
+
 		  ih4 =
-		    (ip4_header_t *) (i_b0->data +
-				      sizeof (ethernet_header_t));
+		    (ip4_header_t *) ((u8 *) i_b0->data +
+				      vnet_buffer (i_b0)->l3_hdr_offset);
 		  if (PREDICT_TRUE
 		      ((ih4->ip_version_and_header_length & 0xF0) != 0x40))
 		    {
@@ -280,9 +281,7 @@ esp_decrypt_node_fn (vlib_main_t * vm,
 			{
 			  transport_ip6 = 1;
 			  ip_hdr_size = sizeof (ip6_header_t);
-			  ih6 =
-			    (ip6_header_t *) (i_b0->data +
-					      sizeof (ethernet_header_t));
+			  ih6 = (ip6_header_t *) ih4;
 			  oh6 = vlib_buffer_get_current (o_b0);
 			}
 		      else