diff options
Diffstat (limited to 'src/vnet/ipsec/ah_decrypt.c')
| -rw-r--r-- | src/vnet/ipsec/ah_decrypt.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/src/vnet/ipsec/ah_decrypt.c b/src/vnet/ipsec/ah_decrypt.c index bc6b5c4ec9d..bbe6b647c52 100644 --- a/src/vnet/ipsec/ah_decrypt.c +++ b/src/vnet/ipsec/ah_decrypt.c @@ -303,6 +303,13 @@ ah_decrypt_inline (vlib_main_t * vm, if (PREDICT_TRUE (sa0->integ_alg != IPSEC_INTEG_ALG_NONE)) { + /* redo the anit-reply check. see esp_decrypt for details */ + if (ipsec_sa_anti_replay_check (sa0, pd->seq)) + { + b[0]->error = node->errors[AH_DECRYPT_ERROR_REPLAY]; + next[0] = AH_DECRYPT_NEXT_DROP; + goto trace; + } ipsec_sa_anti_replay_advance (sa0, pd->seq); } |