1 files changed, 33 insertions, 46 deletions

diff --git a/src/vnet/ipsec/esp_decrypt.c b/src/vnet/ipsec/esp_decrypt.c
index ff9fc0c2d37..45d08a683e2 100644
--- a/src/vnet/ipsec/esp_decrypt.c
+++ b/src/vnet/ipsec/esp_decrypt.c
@@ -32,8 +32,7 @@ _(DROP, "error-drop")                           \
 _(IP4_INPUT, "ip4-input-no-checksum")           \
 _(IP6_INPUT, "ip6-input")                       \
 _(L2_INPUT, "l2-input")                         \
-_(HANDOFF, "handoff")				\
-_(PENDING, "pending")
+_(HANDOFF, "handoff")
 
 #define _(v, s) ESP_DECRYPT_NEXT_##v,
 typedef enum
@@ -678,7 +677,7 @@ esp_decrypt_prepare_async_frame (vlib_main_t * vm,
 	      /* allocate buffer failed, will not add to frame and drop */
 	      b->error = node->errors[ESP_DECRYPT_ERROR_NO_BUFFERS];
 	      next[0] = ESP_DECRYPT_NEXT_DROP;
-	      return 0;
+	      return -1;
 	    }
 	}
       else
@@ -738,7 +737,6 @@ out:
   *async_pd = *pd;
   *async_pd2 = *pd2;
   pd->protect_index = current_protect_index;
-  next[0] = ESP_DECRYPT_NEXT_PENDING;
 
   /* for AEAD integ_len - crypto_len will be negative, it is ok since it
    * is ignored by the engine. */
@@ -1012,20 +1010,6 @@ esp_decrypt_post_crypto (vlib_main_t * vm, vlib_node_runtime_t * node,
     }
 }
 
-/* when submitting a frame is failed, drop all buffers in the frame */
-static_always_inline void
-esp_async_recycle_failed_submit (vnet_crypto_async_frame_t * f,
-				 vlib_buffer_t ** b, u16 * next)
-{
-  u32 n_drop = f->n_elts;
-  while (--n_drop)
-    {
-      (b - n_drop)[0]->error = ESP_DECRYPT_ERROR_CRYPTO_ENGINE_ERROR;
-      (next - n_drop)[0] = ESP_DECRYPT_NEXT_DROP;
-    }
-  vnet_crypto_async_reset_frame (f);
-}
-
 always_inline uword
 esp_decrypt_inline (vlib_main_t * vm,
 		    vlib_node_runtime_t * node, vlib_frame_t * from_frame,
@@ -1051,6 +1035,7 @@ esp_decrypt_inline (vlib_main_t * vm,
   vnet_crypto_async_frame_t *async_frame = 0;
   int is_async = im->async_mode;
   vnet_crypto_async_op_id_t last_async_op = ~0;
+  u16 n_async_drop = 0;
 
   vlib_get_buffers (vm, from, b, n_left);
   if (!is_async)
@@ -1081,6 +1066,8 @@ esp_decrypt_inline (vlib_main_t * vm,
       if (n_bufs == 0)
 	{
 	  b[0]->error = node->errors[ESP_DECRYPT_ERROR_NO_BUFFERS];
+	  esp_set_next_index (is_async, from, nexts, from[b - bufs],
+			      &n_async_drop, ESP_DECRYPT_NEXT_DROP, next);
 	  next[0] = ESP_DECRYPT_NEXT_DROP;
 	  goto next;
 	}
@@ -1110,7 +1097,10 @@ esp_decrypt_inline (vlib_main_t * vm,
 	      if (async_frame && async_frame->n_elts)
 		{
 		  if (vnet_crypto_async_submit_open_frame (vm, async_frame))
-		    esp_async_recycle_failed_submit (async_frame, b, next);
+		    esp_async_recycle_failed_submit (async_frame, b, from,
+						     nexts, &n_async_drop,
+						     ESP_DECRYPT_NEXT_DROP,
+						     ESP_DECRYPT_ERROR_CRYPTO_ENGINE_ERROR);
 		}
 	      async_frame =
 		vnet_crypto_async_get_frame (vm, sa0->crypto_async_dec_op_id);
@@ -1129,6 +1119,8 @@ esp_decrypt_inline (vlib_main_t * vm,
 
       if (PREDICT_TRUE (thread_index != sa0->decrypt_thread_index))
 	{
+	  esp_set_next_index (is_async, from, nexts, from[b - bufs],
+			      &n_async_drop, ESP_DECRYPT_NEXT_HANDOFF, next);
 	  next[0] = ESP_DECRYPT_NEXT_HANDOFF;
 	  goto next;
 	}
@@ -1161,14 +1153,16 @@ esp_decrypt_inline (vlib_main_t * vm,
       if (ipsec_sa_anti_replay_check (sa0, pd->seq))
 	{
 	  b[0]->error = node->errors[ESP_DECRYPT_ERROR_REPLAY];
-	  next[0] = ESP_DECRYPT_NEXT_DROP;
+	  esp_set_next_index (is_async, from, nexts, from[b - bufs],
+			      &n_async_drop, ESP_DECRYPT_NEXT_DROP, next);
 	  goto next;
 	}
 
       if (pd->current_length < cpd.icv_sz + esp_sz + cpd.iv_sz)
 	{
 	  b[0]->error = node->errors[ESP_DECRYPT_ERROR_RUNT];
-	  next[0] = ESP_DECRYPT_NEXT_DROP;
+	  esp_set_next_index (is_async, from, nexts, from[b - bufs],
+			      &n_async_drop, ESP_DECRYPT_NEXT_DROP, next);
 	  goto next;
 	}
 
@@ -1188,7 +1182,18 @@ esp_decrypt_inline (vlib_main_t * vm,
 						     b[0], next, async_next);
 	  if (PREDICT_FALSE (ret < 0))
 	    {
-	      esp_async_recycle_failed_submit (async_frame, b, next);
+	      b[0]->error = ESP_DECRYPT_ERROR_CRYPTO_ENGINE_ERROR;
+	      esp_set_next_index (1, from, nexts, from[b - bufs],
+				  &n_async_drop, ESP_DECRYPT_NEXT_DROP, next);
+	      /* when next[0] is ESP_DECRYPT_NEXT_DROP we only have to drop
+	       * the current packet. Otherwise it is frame submission error
+	       * thus we have to drop the whole frame.
+	       */
+	      if (next[0] != ESP_DECRYPT_NEXT_DROP && async_frame->n_elts)
+		esp_async_recycle_failed_submit (async_frame, b, from,
+						 nexts, &n_async_drop,
+						 ESP_DECRYPT_NEXT_DROP,
+						 ESP_DECRYPT_ERROR_CRYPTO_ENGINE_ERROR);
 	      goto next;
 	    }
 	}
@@ -1216,14 +1221,17 @@ esp_decrypt_inline (vlib_main_t * vm,
       if (async_frame && async_frame->n_elts)
 	{
 	  if (vnet_crypto_async_submit_open_frame (vm, async_frame) < 0)
-	    esp_async_recycle_failed_submit (async_frame, b, next);
+	    esp_async_recycle_failed_submit (async_frame, b, from, nexts,
+					     &n_async_drop,
+					     ESP_DECRYPT_NEXT_DROP,
+					     ESP_DECRYPT_ERROR_CRYPTO_ENGINE_ERROR);
 	}
 
       /* no post process in async */
-      n_left = from_frame->n_vectors;
       vlib_node_increment_counter (vm, node->node_index,
 				   ESP_DECRYPT_ERROR_RX_PKTS, n_left);
-      vlib_buffer_enqueue_to_next (vm, node, from, nexts, n_left);
+      if (n_async_drop)
+	vlib_buffer_enqueue_to_next (vm, node, from, nexts, n_async_drop);
 
       return n_left;
     }
@@ -1429,23 +1437,6 @@ VLIB_NODE_FN (esp6_decrypt_tun_post_node) (vlib_main_t * vm,
   return esp_decrypt_post_inline (vm, node, from_frame, 1, 1);
 }
 
-VLIB_NODE_FN (esp_decrypt_pending_node) (vlib_main_t * vm,
-					 vlib_node_runtime_t * node,
-					 vlib_frame_t * from_frame)
-{
-  return from_frame->n_vectors;
-}
-
-/* *INDENT-OFF* */
-VLIB_REGISTER_NODE (esp_decrypt_pending_node) = {
-  .name = "esp-decrypt-pending",
-  .vector_size = sizeof (u32),
-  .type = VLIB_NODE_TYPE_INTERNAL,
-
-  .n_next_nodes = 0
-};
-/* *INDENT-ON* */
-
 /* *INDENT-OFF* */
 VLIB_REGISTER_NODE (esp4_decrypt_node) = {
   .name = "esp4-decrypt",
@@ -1463,7 +1454,6 @@ VLIB_REGISTER_NODE (esp4_decrypt_node) = {
     [ESP_DECRYPT_NEXT_IP6_INPUT] = "ip6-input",
     [ESP_DECRYPT_NEXT_L2_INPUT] = "l2-input",
     [ESP_DECRYPT_NEXT_HANDOFF] = "esp4-decrypt-handoff",
-    [ESP_DECRYPT_NEXT_PENDING] = "esp-decrypt-pending"
   },
 };
 
@@ -1495,7 +1485,6 @@ VLIB_REGISTER_NODE (esp6_decrypt_node) = {
     [ESP_DECRYPT_NEXT_IP6_INPUT] = "ip6-input",
     [ESP_DECRYPT_NEXT_L2_INPUT] = "l2-input",
     [ESP_DECRYPT_NEXT_HANDOFF]=  "esp6-decrypt-handoff",
-    [ESP_DECRYPT_NEXT_PENDING] = "esp-decrypt-pending"
   },
 };
 
@@ -1525,7 +1514,6 @@ VLIB_REGISTER_NODE (esp4_decrypt_tun_node) = {
     [ESP_DECRYPT_NEXT_IP6_INPUT] = "ip6-input",
     [ESP_DECRYPT_NEXT_L2_INPUT] = "l2-input",
     [ESP_DECRYPT_NEXT_HANDOFF] = "esp4-decrypt-tun-handoff",
-    [ESP_DECRYPT_NEXT_PENDING] = "esp-decrypt-pending"
   },
 };
 
@@ -1555,7 +1543,6 @@ VLIB_REGISTER_NODE (esp6_decrypt_tun_node) = {
     [ESP_DECRYPT_NEXT_IP6_INPUT] = "ip6-input",
     [ESP_DECRYPT_NEXT_L2_INPUT] = "l2-input",
     [ESP_DECRYPT_NEXT_HANDOFF]=  "esp6-decrypt-tun-handoff",
-    [ESP_DECRYPT_NEXT_PENDING] = "esp-decrypt-pending"
   },
 };