From 115e31b43fcd5308601c624afbaf61211e48f56d Mon Sep 17 00:00:00 2001 From: Maxime Peim Date: Tue, 31 Oct 2023 16:29:59 +0100 Subject: ipsec: IPsec fix constant propagation In some anti-replay, some functions weren't using the boolean telling if the window was huge or not. Hence, limiting the constant propagation at compilation. Type: fix Change-Id: Ie5f2dda38339bb32113c6f7b2b82c82135fc92a8 Signed-off-by: Maxime Peim --- src/vnet/ipsec/ipsec_sa.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'src/vnet/ipsec') diff --git a/src/vnet/ipsec/ipsec_sa.h b/src/vnet/ipsec/ipsec_sa.h index 47058511036..4f73f1eab0f 100644 --- a/src/vnet/ipsec/ipsec_sa.h +++ b/src/vnet/ipsec/ipsec_sa.h @@ -731,13 +731,14 @@ ipsec_sa_anti_replay_window_shift (ipsec_sa_t *sa, u32 inc, bool ar_huge) else { /* holes in the replay window are lost packets */ - n_lost = window_size - IPSEC_SA_ANTI_REPLAY_WINDOW_N_SEEN (sa); + n_lost = window_size - + IPSEC_SA_ANTI_REPLAY_WINDOW_N_SEEN_KNOWN_WIN (sa, ar_huge); /* any sequence numbers that now fall outside the window * are forever lost */ n_lost += inc - window_size; - if (PREDICT_FALSE (ipsec_sa_is_set_ANTI_REPLAY_HUGE (sa))) + if (PREDICT_FALSE (ar_huge)) { clib_bitmap_zero (sa->replay_window_huge); clib_bitmap_set_no_check (sa->replay_window_huge, -- cgit 1.2.3-korg