ip ipsec: Remove IPSec SPI-0 punt reason
Type: fix
There's no call for an SPI-0 punt reason with UDP encap, since
it's only with UDP encap that the ambiguity between IKE or IPSEC
occurs (and SPI=0 determines IKE).
Enhance the punt API to dum ponly the reason requested, so a client
can use this as a get-ID API
Change-Id: I5c6d72b03885e88c489117677e72f1ef5da90dfc
Signed-off-by: Neale Ranns <nranns@cisco.com>
diff --git a/src/vnet/ipsec/ipsec_if_in.c b/src/vnet/ipsec/ipsec_if_in.c
index d1f9d5c..4e93725 100644
--- a/src/vnet/ipsec/ipsec_if_in.c
+++ b/src/vnet/ipsec/ipsec_if_in.c
@@ -74,7 +74,8 @@
b->error = node->errors[IPSEC_IF_INPUT_ERROR_SPI_0];
b->punt_reason =
ipsec_punt_reason[(ip4->protocol == IP_PROTOCOL_UDP ?
- IPSEC_PUNT_IP4_SPI_UDP_0 : IPSEC_PUNT_IP4_SPI_0)];
+ IPSEC_PUNT_IP4_SPI_UDP_0 :
+ IPSEC_PUNT_IP4_NO_SUCH_TUNNEL)];
}
else
{
@@ -90,16 +91,9 @@
vlib_buffer_t * b,
const esp_header_t * esp, u16 offset)
{
- if (PREDICT_FALSE (0 == esp->spi))
- {
- b->error = node->errors[IPSEC_IF_INPUT_ERROR_NO_TUNNEL];
- b->punt_reason = ipsec_punt_reason[IPSEC_PUNT_IP6_SPI_0];
- }
- else
- {
- b->error = node->errors[IPSEC_IF_INPUT_ERROR_NO_TUNNEL];
- b->punt_reason = ipsec_punt_reason[IPSEC_PUNT_IP6_NO_SUCH_TUNNEL];
- }
+ b->error = node->errors[IPSEC_IF_INPUT_ERROR_NO_TUNNEL];
+ b->punt_reason = ipsec_punt_reason[IPSEC_PUNT_IP6_NO_SUCH_TUNNEL];
+
vlib_buffer_advance (b, -offset);
return (IPSEC_INPUT_NEXT_PUNT);
}