ipsec: fix sa counters in esp-decrypt

Type: fix
Fixes: b4fff3a
Change-Id: I2552cbc0a02e7445825a5a4ce290cde3d10c5f0b
Signed-off-by: Damjan Marion <damarion@cisco.com>

diff --git a/src/vnet/ipsec/esp_decrypt.c b/src/vnet/ipsec/esp_decrypt.c
index 8272bb0..710c8f1 100644 (file)
--- a/src/vnet/ipsec/esp_decrypt.c
+++ b/src/vnet/ipsec/esp_decrypt.c
@@ -156,18 +156,19 @@ esp_decrypt_inline (vlib_main_t * vm,
 
       if (vnet_buffer (b[0])->ipsec.sad_index != current_sa_index)
        {
+         if (current_sa_pkts)
+           vlib_increment_combined_counter (&ipsec_sa_counters, thread_index,
+                                            current_sa_index,
+                                            current_sa_pkts,
+                                            current_sa_bytes);
+         current_sa_bytes = current_sa_pkts = 0;
+
          current_sa_index = vnet_buffer (b[0])->ipsec.sad_index;
          sa0 = pool_elt_at_index (im->sad, current_sa_index);
          cpd.icv_sz = sa0->integ_icv_size;
          cpd.iv_sz = sa0->crypto_iv_size;
          cpd.flags = sa0->flags;
          cpd.sa_index = current_sa_index;
-
-         vlib_increment_combined_counter (&ipsec_sa_counters, thread_index,
-                                          current_sa_index, current_sa_pkts,
-                                          current_sa_bytes);
-
-         current_sa_bytes = current_sa_pkts = 0;
        }
 
       /* store packet data for next round for easier prefetch */