ipsec: separate UDP and UDP-encapsulated ESP packet processing 93/38793/2
authorvinay tripathi <vinayx.tripathi@intel.com>
Tue, 6 Jun 2023 07:27:55 +0000 (12:57 +0530)
committervinay Tripathi <vinayx.tripathi@intel.com>
Tue, 31 Oct 2023 11:41:54 +0000 (11:41 +0000)
commit2d7988d719d1f3cab9ac4a0762786c4b07443671
tree8b149e722029f810d6ae860662b765519186b82c
parentbc5f5305997e3b8f624b64bcc2d68687f31d515a
ipsec: separate UDP and UDP-encapsulated ESP packet processing

This fix differentiates UDP and UDP-encapsulated ESP packets processing.
While UDP-encapsulated ESP traffic is processed as IPsec traffic, UDP as
other plain-text protocols is NOT dispatched against SPD policies.
Key logic is taken from RFC 3948, and is based on the fact
that the checksum of UDP packet encapsulating ESP packet must be zero.

Type:  fix

Signed-off-by: vinay tripathi <vinayx.tripathi@intel.com>
Change-Id: Ib1b4d240eea8e89f2daf17ec833905f26cdb31bd
src/vnet/ipsec/ipsec_input.c