summaryrefslogtreecommitdiffstats
path: root/src/vnet/ipsec/ah_decrypt.c
diff options
context:
space:
mode:
authorNeale Ranns <nranns@cisco.com>2019-08-01 04:45:15 -0700
committerDave Barach <openvpp@barachs.net>2019-08-01 18:04:42 +0000
commit3b9374fa57218c72306d372167724e88ef7d57be (patch)
tree5387c6d7f191671e180041ad081510da6601b2a4 /src/vnet/ipsec/ah_decrypt.c
parent55c68c9521d98005ce850ee54a40c7579d88928b (diff)
ipsec: Redo the anit-replay check post decrypt
Type: fix Change-Id: I1fa8c5326d6f22cfb8dd40e97d8a22d11a716922 Signed-off-by: Neale Ranns <nranns@cisco.com>
Diffstat (limited to 'src/vnet/ipsec/ah_decrypt.c')
-rw-r--r--src/vnet/ipsec/ah_decrypt.c7
1 files changed, 7 insertions, 0 deletions
diff --git a/src/vnet/ipsec/ah_decrypt.c b/src/vnet/ipsec/ah_decrypt.c
index bc6b5c4ec9d..bbe6b647c52 100644
--- a/src/vnet/ipsec/ah_decrypt.c
+++ b/src/vnet/ipsec/ah_decrypt.c
@@ -303,6 +303,13 @@ ah_decrypt_inline (vlib_main_t * vm,
if (PREDICT_TRUE (sa0->integ_alg != IPSEC_INTEG_ALG_NONE))
{
+ /* redo the anit-reply check. see esp_decrypt for details */
+ if (ipsec_sa_anti_replay_check (sa0, pd->seq))
+ {
+ b[0]->error = node->errors[AH_DECRYPT_ERROR_REPLAY];
+ next[0] = AH_DECRYPT_NEXT_DROP;
+ goto trace;
+ }
ipsec_sa_anti_replay_advance (sa0, pd->seq);
}