5 files changed, 15 insertions, 7 deletions

diff --git a/src/plugins/unittest/crypto_test.c b/src/plugins/unittest/crypto_test.c
index 6d57cea82c7..768221b56ad 100644
--- a/src/plugins/unittest/crypto_test.c
+++ b/src/plugins/unittest/crypto_test.c
@@ -62,7 +62,7 @@ test_crypto (vlib_main_t * vm, crypto_test_main_t * tm)
     {
       r = rv[i];
       op  = ops + i;
-      op->op = r->op;
+      vnet_crypto_op_init (op, r->op);
       op->iv = r->iv.data;
       op->key = r->key.data;
       op->src = r->data.data;
diff --git a/src/vnet/crypto/crypto.h b/src/vnet/crypto/crypto.h
index 62db291fce2..7a9ca2c2278 100644
--- a/src/vnet/crypto/crypto.h
+++ b/src/vnet/crypto/crypto.h
@@ -165,6 +165,16 @@ format_function_t format_vnet_crypto_alg;
 format_function_t format_vnet_crypto_engine;
 format_function_t format_vnet_crypto_op;
 
+
+static_always_inline void
+vnet_crypto_op_init (vnet_crypto_op_t * op, vnet_crypto_op_type_t type)
+{
+  if (CLIB_DEBUG > 0)
+    clib_memset (op, 0xfe, sizeof (*op));
+  op->op = type;
+  op->flags = 0;
+}
+
 #endif /* included_vnet_crypto_crypto_h */
 
 /*
diff --git a/src/vnet/ipsec/esp.h b/src/vnet/ipsec/esp.h
index 2f734aa05ce..6ba2e7c7579 100644
--- a/src/vnet/ipsec/esp.h
+++ b/src/vnet/ipsec/esp.h
@@ -96,7 +96,7 @@ hmac_calc (vlib_main_t * vm, ipsec_sa_t * sa, u8 * data, int data_len,
   if (PREDICT_FALSE (sa->integ_op_type == 0))
     return 0;
 
-  op->op = sa->integ_op_type;
+  vnet_crypto_op_init (op, sa->integ_op_type);
   op->key = sa->integ_key.data;
   op->key_len = sa->integ_key.len;
   op->src = data;
diff --git a/src/vnet/ipsec/esp_decrypt.c b/src/vnet/ipsec/esp_decrypt.c
index 93666194e4f..b354a9e5037 100644
--- a/src/vnet/ipsec/esp_decrypt.c
+++ b/src/vnet/ipsec/esp_decrypt.c
@@ -87,11 +87,10 @@ esp_decrypt_cbc (vlib_main_t * vm, ipsec_sa_t * sa,
 {
   vnet_crypto_op_t _op, *op = &_op;
 
-
   if (PREDICT_FALSE (sa->crypto_dec_op_type == VNET_CRYPTO_OP_NONE))
     return;
 
-  op->op = sa->crypto_dec_op_type;
+  vnet_crypto_op_init (op, sa->crypto_dec_op_type);
   op->iv = iv;
   op->src = in;
   op->dst = out;
diff --git a/src/vnet/ipsec/esp_encrypt.c b/src/vnet/ipsec/esp_encrypt.c
index fc1fe392f16..c2069e52b33 100644
--- a/src/vnet/ipsec/esp_encrypt.c
+++ b/src/vnet/ipsec/esp_encrypt.c
@@ -429,7 +429,7 @@ esp_encrypt_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 	{
 	  vnet_crypto_op_t *op;
 	  vec_add2_aligned (ptd->crypto_ops, op, 1, CLIB_CACHE_LINE_BYTES);
-	  op->op = sa0->crypto_enc_op_type;
+	  vnet_crypto_op_init (op, sa0->crypto_enc_op_type);
 	  op->iv = payload - iv_sz;
 	  op->src = op->dst = payload;
 	  op->key = sa0->crypto_key.data;
@@ -442,14 +442,13 @@ esp_encrypt_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 	{
 	  vnet_crypto_op_t *op;
 	  vec_add2_aligned (ptd->integ_ops, op, 1, CLIB_CACHE_LINE_BYTES);
-	  op->op = sa0->integ_op_type;
+	  vnet_crypto_op_init (op, sa0->integ_op_type);
 	  op->src = payload - iv_sz - sizeof (esp_header_t);
 	  op->dst = payload + payload_len - icv_sz;
 	  op->key = sa0->integ_key.data;
 	  op->key_len = sa0->integ_key.len;
 	  op->hmac_trunc_len = icv_sz;
 	  op->len = payload_len - icv_sz + iv_sz + sizeof (esp_header_t);
-	  op->flags = 0;
 	  op->user_data = b - bufs;
 	  if (ipsec_sa_is_set_USE_ESN (sa0))
 	    {