From a6bee0a11a07e4e1e4ac67e5041e9ad197766ba2 Mon Sep 17 00:00:00 2001 From: Neale Ranns Date: Fri, 14 Jun 2019 01:13:25 -0700 Subject: ipsec: Correctly rewind the buffer to the IP header when punting UDP encapped SPI-0 packets Type: fix Fixes: b71fa75d48 Change-Id: I2d81b373f7659e702759939c096b315afa36f621 Signed-off-by: Neale Ranns --- src/vnet/ipsec/ipsec_if_in.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) (limited to 'src/vnet/ipsec') diff --git a/src/vnet/ipsec/ipsec_if_in.c b/src/vnet/ipsec/ipsec_if_in.c index b585c3d4dcf..9565078b3b9 100644 --- a/src/vnet/ipsec/ipsec_if_in.c +++ b/src/vnet/ipsec/ipsec_if_in.c @@ -440,7 +440,7 @@ ipsec_if_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node, ip6_header_t *ip60; esp_header_t *esp0; u32 len0; - u16 buf_adv0; + u16 buf_adv0, buf_rewind0; u32 tid0; ipsec_tunnel_if_t *t0; ipsec4_tunnel_key_t key40; @@ -464,11 +464,12 @@ ipsec_if_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node, (esp_header_t *) ((u8 *) ip40 + ip4_header_bytes (ip40) + sizeof (udp_header_t)); buf_adv0 = 0; + buf_rewind0 = ip4_header_bytes (ip40) + sizeof (udp_header_t); } else { esp0 = (esp_header_t *) ((u8 *) ip40 + ip4_header_bytes (ip40)); - buf_adv0 = ip4_header_bytes (ip40); + buf_rewind0 = buf_adv0 = ip4_header_bytes (ip40); } } @@ -527,7 +528,8 @@ ipsec_if_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node, else { next[0] = - ipsec_ip4_if_no_tunnel (node, b[0], esp0, ip40, buf_adv0); + ipsec_ip4_if_no_tunnel (node, b[0], esp0, ip40, + buf_rewind0); n_no_tunnel++; goto trace00; } -- cgit 1.2.3-korg