X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fvnet%2Fipsec%2Fipsec_sa.h;fp=src%2Fvnet%2Fipsec%2Fipsec_sa.h;h=a5756f556f9f72ab7d1e70a5dd2a298d59a4b4c5;hb=aa7d7662f63bfe6643b193f74288aea67f883744;hp=84abd6ef4b44c063772e4e6d40da6327cf32de46;hpb=088bf1dcc32fcd26dac312a5561e0f263fa401d9;p=vpp.git

diff --git a/src/vnet/ipsec/ipsec_sa.h b/src/vnet/ipsec/ipsec_sa.h
index 84abd6ef4b4..a5756f556f9 100644
--- a/src/vnet/ipsec/ipsec_sa.h
+++ b/src/vnet/ipsec/ipsec_sa.h
@@ -223,6 +223,14 @@ typedef struct
 STATIC_ASSERT_OFFSET_OF (ipsec_sa_t, cacheline1, CLIB_CACHE_LINE_BYTES);
 STATIC_ASSERT_OFFSET_OF (ipsec_sa_t, cacheline2, 2 * CLIB_CACHE_LINE_BYTES);
 
+/*
+ * Ensure that the IPsec data does not overlap with the IP data in
+ * the buffer meta data
+ */
+STATIC_ASSERT (STRUCT_OFFSET_OF (vnet_buffer_opaque_t, ipsec.sad_index) ==
+		 STRUCT_OFFSET_OF (vnet_buffer_opaque_t, ip.save_protocol),
+	       "IPSec data is overlapping with IP data");
+
 #define _(a,v,s)                                                        \
   always_inline int                                                     \
   ipsec_sa_is_set_##v (const ipsec_sa_t *sa) {                          \