IPSEC: run encrpyt as a feautre on the tunnel

Change-Id: I6527e3fd8bbbca2d5f728621fc66b3856b39d505
Signed-off-by: Neale Ranns <nranns@cisco.com>

8 files changed, 333 insertions, 158 deletions

diff --git a/src/vnet/adj/adj_midchain.c b/src/vnet/adj/adj_midchain.c
index f8a39494fb9..dfe52c3c39f 100644
--- a/src/vnet/adj/adj_midchain.c
+++ b/src/vnet/adj/adj_midchain.c
@@ -69,22 +69,13 @@ adj_midchain_tx_inline (vlib_main_t * vm,
 
 	while (n_left_from >= 8 && n_left_to_next > 4)
 	{
+	    const ip_adjacency_t *adj0, *adj1, *adj2, *adj3;
+	    const dpo_id_t *dpo0, *dpo1, *dpo2, *dpo3;
+	    vlib_buffer_t * b0, *b1, *b2, *b3;
 	    u32 bi0, adj_index0, next0;
-	    const ip_adjacency_t * adj0;
-	    const dpo_id_t *dpo0;
-	    vlib_buffer_t * b0;
 	    u32 bi1, adj_index1, next1;
-	    const ip_adjacency_t * adj1;
-	    const dpo_id_t *dpo1;
-	    vlib_buffer_t * b1;
 	    u32 bi2, adj_index2, next2;
-	    const ip_adjacency_t * adj2;
-	    const dpo_id_t *dpo2;
-	    vlib_buffer_t * b2;
 	    u32 bi3, adj_index3, next3;
-	    const ip_adjacency_t * adj3;
-	    const dpo_id_t *dpo3;
-	    vlib_buffer_t * b3;
 
 	    /* Prefetch next iteration. */
 	    {
@@ -526,11 +517,6 @@ adj_nbr_midchain_update_rewrite (adj_index_t adj_index,
            (adj->lookup_next_index == IP_LOOKUP_NEXT_GLEAN) ||
            (adj->lookup_next_index == IP_LOOKUP_NEXT_BCAST));
 
-    /*
-     * tunnels can always provide a rewrite.
-     */
-    ASSERT(NULL != rewrite);
-
     adj_midchain_setup(adj_index, fixup, fixup_data, flags);
 
     /*
@@ -704,6 +690,8 @@ format_adj_midchain (u8* s, va_list *ap)
     ip_adjacency_t * adj = adj_get(index);
 
     s = format (s, "%U", format_vnet_link, adj->ia_link);
+    if (adj->rewrite_header.flags & VNET_REWRITE_HAS_FEATURES)
+        s = format(s, " [features]");
     s = format (s, " via %U",
 		format_ip46_address, &adj->sub_type.nbr.next_hop,
 		adj_proto_to_46(adj->ia_nh_proto));
diff --git a/src/vnet/interface_output.h b/src/vnet/interface_output.h
new file mode 100644
index 00000000000..58f7f617957
--- /dev/null
+++ b/src/vnet/interface_output.h
@@ -0,0 +1,106 @@
+/*
+ * Copyright (c) 2015 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*
+ * interface_output.c: interface output node
+ *
+ * Copyright (c) 2008 Eliot Dresselhaus
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ *  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ *  EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ *  MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ *  NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+ *  LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ *  OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ *  WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#ifndef __INTERFACE_INLINES_H__
+#define __INTERFACE_INLINES_H__
+
+#include <vnet/vnet.h>
+
+static_always_inline void
+calc_checksums (vlib_main_t * vm, vlib_buffer_t * b)
+{
+  ip4_header_t *ip4;
+  ip6_header_t *ip6;
+  tcp_header_t *th;
+  udp_header_t *uh;
+
+  int is_ip4 = (b->flags & VNET_BUFFER_F_IS_IP4) != 0;
+  int is_ip6 = (b->flags & VNET_BUFFER_F_IS_IP6) != 0;
+
+  ASSERT (!(is_ip4 && is_ip6));
+
+  ip4 = (ip4_header_t *) (b->data + vnet_buffer (b)->l3_hdr_offset);
+  ip6 = (ip6_header_t *) (b->data + vnet_buffer (b)->l3_hdr_offset);
+  th = (tcp_header_t *) (b->data + vnet_buffer (b)->l4_hdr_offset);
+  uh = (udp_header_t *) (b->data + vnet_buffer (b)->l4_hdr_offset);
+
+  if (is_ip4)
+    {
+      ip4 = (ip4_header_t *) (b->data + vnet_buffer (b)->l3_hdr_offset);
+      if (b->flags & VNET_BUFFER_F_OFFLOAD_IP_CKSUM)
+	ip4->checksum = ip4_header_checksum (ip4);
+      if (b->flags & VNET_BUFFER_F_OFFLOAD_TCP_CKSUM)
+	{
+	  th->checksum = 0;
+	  th->checksum = ip4_tcp_udp_compute_checksum (vm, b, ip4);
+	}
+      if (b->flags & VNET_BUFFER_F_OFFLOAD_UDP_CKSUM)
+	uh->checksum = ip4_tcp_udp_compute_checksum (vm, b, ip4);
+    }
+  if (is_ip6)
+    {
+      int bogus;
+      if (b->flags & VNET_BUFFER_F_OFFLOAD_TCP_CKSUM)
+	{
+	  th->checksum = 0;
+	  th->checksum =
+	    ip6_tcp_udp_icmp_compute_checksum (vm, b, ip6, &bogus);
+	}
+      if (b->flags & VNET_BUFFER_F_OFFLOAD_UDP_CKSUM)
+	{
+	  uh->checksum = 0;
+	  uh->checksum =
+	    ip6_tcp_udp_icmp_compute_checksum (vm, b, ip6, &bogus);
+	}
+    }
+
+  b->flags &= ~VNET_BUFFER_F_OFFLOAD_TCP_CKSUM;
+  b->flags &= ~VNET_BUFFER_F_OFFLOAD_UDP_CKSUM;
+  b->flags &= ~VNET_BUFFER_F_OFFLOAD_IP_CKSUM;
+}
+
+#endif
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/vnet/ip/ip4_forward.c b/src/vnet/ip/ip4_forward.c
index 981dfe3c91f..985db21d6b0 100644
--- a/src/vnet/ip/ip4_forward.c
+++ b/src/vnet/ip/ip4_forward.c
@@ -55,6 +55,7 @@
 #include <vnet/mfib/mfib_table.h>	/* for mFIB table and entry creation */
 
 #include <vnet/ip/ip4_forward.h>
+#include <vnet/interface_output.h>
 
 /** @brief IPv4 lookup node.
     @node ip4-lookup
@@ -2336,7 +2337,11 @@ ip4_rewrite_inline_with_gso (vlib_main_t * vm,
 	{
 	  b[1]->error = error_node->errors[error1];
 	}
-
+      if (is_midchain)
+	{
+	  calc_checksums (vm, b[0]);
+	  calc_checksums (vm, b[1]);
+	}
       /* Guess we are only writing on simple Ethernet header. */
       vnet_rewrite_two_headers (adj0[0], adj1[0],
 				ip0, ip1, sizeof (ethernet_header_t));
@@ -2359,10 +2364,12 @@ ip4_rewrite_inline_with_gso (vlib_main_t * vm,
 
       if (is_midchain)
 	{
-	  adj0->sub_type.midchain.fixup_func
-	    (vm, adj0, b[0], adj0->sub_type.midchain.fixup_data);
-	  adj1->sub_type.midchain.fixup_func
-	    (vm, adj1, b[1], adj1->sub_type.midchain.fixup_data);
+	  if (adj0->sub_type.midchain.fixup_func)
+	    adj0->sub_type.midchain.fixup_func
+	      (vm, adj0, b[0], adj0->sub_type.midchain.fixup_data);
+	  if (adj1->sub_type.midchain.fixup_func)
+	    adj1->sub_type.midchain.fixup_func
+	      (vm, adj1, b[1], adj1->sub_type.midchain.fixup_data);
 	}
 
       if (is_mcast)
@@ -2447,7 +2454,10 @@ ip4_rewrite_inline_with_gso (vlib_main_t * vm,
 	{
 	  b[0]->error = error_node->errors[error0];
 	}
-
+      if (is_midchain)
+	{
+	  calc_checksums (vm, b[0]);
+	}
       /* Guess we are only writing on simple Ethernet header. */
       vnet_rewrite_one_header (adj0[0], ip0, sizeof (ethernet_header_t));
 
@@ -2459,8 +2469,9 @@ ip4_rewrite_inline_with_gso (vlib_main_t * vm,
 
       if (is_midchain)
 	{
-	  adj0->sub_type.midchain.fixup_func
-	    (vm, adj0, b[0], adj0->sub_type.midchain.fixup_data);
+	  if (adj0->sub_type.midchain.fixup_func)
+	    adj0->sub_type.midchain.fixup_func
+	      (vm, adj0, b[0], adj0->sub_type.midchain.fixup_data);
 	}
 
       if (is_mcast)
diff --git a/src/vnet/ip/ip6_forward.c b/src/vnet/ip/ip6_forward.c
index 858dd73a712..511fc9329e8 100644
--- a/src/vnet/ip/ip6_forward.c
+++ b/src/vnet/ip/ip6_forward.c
@@ -54,6 +54,7 @@
 #include <vppinfra/bihash_template.c>
 #endif
 #include <vnet/ip/ip6_forward.h>
+#include <vnet/interface_output.h>
 
 /* Flag used by IOAM code. Classifier sets it pop-hop-by-hop checks it */
 #define OI_DECAP   0x80000000
@@ -1831,16 +1832,26 @@ ip6_rewrite_inline_with_gso (vlib_main_t * vm,
 	      p1->error = error_node->errors[error1];
 	    }
 
+	  if (is_midchain)
+	    {
+	      /* before we paint on the next header, update the L4
+	       * checksums if required, since there's no offload on a tunnel */
+	      calc_checksums (vm, p0);
+	      calc_checksums (vm, p1);
+	    }
+
 	  /* Guess we are only writing on simple Ethernet header. */
 	  vnet_rewrite_two_headers (adj0[0], adj1[0],
 				    ip0, ip1, sizeof (ethernet_header_t));
 
 	  if (is_midchain)
 	    {
-	      adj0->sub_type.midchain.fixup_func
-		(vm, adj0, p0, adj0->sub_type.midchain.fixup_data);
-	      adj1->sub_type.midchain.fixup_func
-		(vm, adj1, p1, adj1->sub_type.midchain.fixup_data);
+	      if (adj0->sub_type.midchain.fixup_func)
+		adj0->sub_type.midchain.fixup_func
+		  (vm, adj0, p0, adj0->sub_type.midchain.fixup_data);
+	      if (adj1->sub_type.midchain.fixup_func)
+		adj1->sub_type.midchain.fixup_func
+		  (vm, adj1, p1, adj1->sub_type.midchain.fixup_data);
 	    }
 	  if (is_mcast)
 	    {
@@ -1919,6 +1930,11 @@ ip6_rewrite_inline_with_gso (vlib_main_t * vm,
 	      p0->flags &= ~VNET_BUFFER_F_LOCALLY_ORIGINATED;
 	    }
 
+	  if (is_midchain)
+	    {
+	      calc_checksums (vm, p0);
+	    }
+
 	  /* Guess we are only writing on simple Ethernet header. */
 	  vnet_rewrite_one_header (adj0[0], ip0, sizeof (ethernet_header_t));
 
@@ -1969,8 +1985,9 @@ ip6_rewrite_inline_with_gso (vlib_main_t * vm,
 
 	  if (is_midchain)
 	    {
-	      adj0->sub_type.midchain.fixup_func
-		(vm, adj0, p0, adj0->sub_type.midchain.fixup_data);
+	      if (adj0->sub_type.midchain.fixup_func)
+		adj0->sub_type.midchain.fixup_func
+		  (vm, adj0, p0, adj0->sub_type.midchain.fixup_data);
 	    }
 	  if (is_mcast)
 	    {
diff --git a/src/vnet/ipsec/esp_encrypt.c b/src/vnet/ipsec/esp_encrypt.c
index 6e5007151b9..ebcf0ed8e08 100644
--- a/src/vnet/ipsec/esp_encrypt.c
+++ b/src/vnet/ipsec/esp_encrypt.c
@@ -220,7 +220,7 @@ esp_process_ops (vlib_main_t * vm, vlib_node_runtime_t * node,
 
 always_inline uword
 esp_encrypt_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
-		    vlib_frame_t * frame, int is_ip6)
+		    vlib_frame_t * frame, int is_ip6, int is_tun)
 {
   ipsec_main_t *im = &ipsec_main;
   ipsec_per_thread_data_t *ptd = vec_elt_at_index (im->ptd, vm->thread_index);
@@ -258,7 +258,19 @@ esp_encrypt_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 	  CLIB_PREFETCH (p, CLIB_CACHE_LINE_BYTES, LOAD);
 	}
 
-      if (vnet_buffer (b[0])->ipsec.sad_index != current_sa_index)
+      if (is_tun)
+	{
+	  /* we are on a ipsec tunnel's feature arc */
+	  u32 next0;
+	  sa_index0 = *(u32 *) vnet_feature_next_with_data (&next0, b[0],
+							    sizeof
+							    (sa_index0));
+	  next[0] = next0;
+	}
+      else
+	sa_index0 = vnet_buffer (b[0])->ipsec.sad_index;
+
+      if (sa_index0 != current_sa_index)
 	{
 	  sa0 = pool_elt_at_index (im->sad, sa_index0);
 	  current_sa_index = sa_index0;
@@ -335,8 +347,11 @@ esp_encrypt_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 	    }
 
 	  dpo = sa0->dpo + IPSEC_PROTOCOL_ESP;
-	  next[0] = dpo->dpoi_next_node;
-	  vnet_buffer (b[0])->ip.adj_index[VLIB_TX] = dpo->dpoi_index;
+	  if (!is_tun)
+	    {
+	      next[0] = dpo->dpoi_next_node;
+	      vnet_buffer (b[0])->ip.adj_index[VLIB_TX] = dpo->dpoi_index;
+	    }
 	}
       else			/* transport mode */
 	{
@@ -483,7 +498,7 @@ VLIB_NODE_FN (esp4_encrypt_node) (vlib_main_t * vm,
 				  vlib_node_runtime_t * node,
 				  vlib_frame_t * from_frame)
 {
-  return esp_encrypt_inline (vm, node, from_frame, 0 /* is_ip6 */ );
+  return esp_encrypt_inline (vm, node, from_frame, 0 /* is_ip6 */ , 0);
 }
 
 /* *INDENT-OFF* */
@@ -509,7 +524,7 @@ VLIB_NODE_FN (esp6_encrypt_node) (vlib_main_t * vm,
 				  vlib_node_runtime_t * node,
 				  vlib_frame_t * from_frame)
 {
-  return esp_encrypt_inline (vm, node, from_frame, 1 /* is_ip6 */ );
+  return esp_encrypt_inline (vm, node, from_frame, 1 /* is_ip6 */ , 0);
 }
 
 /* *INDENT-OFF* */
@@ -531,6 +546,60 @@ VLIB_REGISTER_NODE (esp6_encrypt_node) = {
 };
 /* *INDENT-ON* */
 
+VLIB_NODE_FN (esp4_encrypt_tun_node) (vlib_main_t * vm,
+				      vlib_node_runtime_t * node,
+				      vlib_frame_t * from_frame)
+{
+  return esp_encrypt_inline (vm, node, from_frame, 0 /* is_ip6 */ , 1);
+}
+
+/* *INDENT-OFF* */
+VLIB_REGISTER_NODE (esp4_encrypt_tun_node) = {
+  .name = "esp4-encrypt-tun",
+  .vector_size = sizeof (u32),
+  .format_trace = format_esp_encrypt_trace,
+  .type = VLIB_NODE_TYPE_INTERNAL,
+
+  .n_errors = ARRAY_LEN(esp_encrypt_error_strings),
+  .error_strings = esp_encrypt_error_strings,
+};
+
+VNET_FEATURE_INIT (esp4_encrypt_tun_feat_node, static) =
+{
+  .arc_name = "ip4-output",
+  .node_name = "esp4-encrypt-tun",
+  .runs_before = VNET_FEATURES ("ip4-frag",
+                                "adj-midchain-tx"),
+};
+/* *INDENT-ON* */
+
+VLIB_NODE_FN (esp6_encrypt_tun_node) (vlib_main_t * vm,
+				      vlib_node_runtime_t * node,
+				      vlib_frame_t * from_frame)
+{
+  return esp_encrypt_inline (vm, node, from_frame, 1 /* is_ip6 */ , 1);
+}
+
+/* *INDENT-OFF* */
+VLIB_REGISTER_NODE (esp6_encrypt_tun_node) = {
+  .name = "esp6-encrypt-tun",
+  .vector_size = sizeof (u32),
+  .format_trace = format_esp_encrypt_trace,
+  .type = VLIB_NODE_TYPE_INTERNAL,
+
+  .n_errors = ARRAY_LEN(esp_encrypt_error_strings),
+  .error_strings = esp_encrypt_error_strings,
+};
+
+VNET_FEATURE_INIT (esp6_encrypt_tun_feat_node, static) =
+{
+  .arc_name = "ip6-output",
+  .node_name = "esp6-encrypt-tun",
+  .runs_before = VNET_FEATURES ("ip6-frag",
+                                "adj-midchain-tx"),
+};
+/* *INDENT-ON* */
+
 /*
  * fd.io coding-style-patch-verification: ON
  *
diff --git a/src/vnet/ipsec/ipsec.h b/src/vnet/ipsec/ipsec.h
index 9a5dbb3e8b2..47b3ed370b8 100644
--- a/src/vnet/ipsec/ipsec.h
+++ b/src/vnet/ipsec/ipsec.h
@@ -109,6 +109,7 @@ typedef struct
   uword *ipsec4_if_pool_index_by_key;
   uword *ipsec6_if_pool_index_by_key;
   uword *ipsec_if_real_dev_by_show_dev;
+  uword *ipsec_if_by_sw_if_index;
 
   /* node indices */
   u32 error_drop_node_index;
@@ -212,6 +213,13 @@ u32 ipsec_register_esp_backend (vlib_main_t * vm, ipsec_main_t * im,
 
 int ipsec_select_ah_backend (ipsec_main_t * im, u32 ah_backend_idx);
 int ipsec_select_esp_backend (ipsec_main_t * im, u32 esp_backend_idx);
+
+always_inline ipsec_sa_t *
+ipsec_sa_get (u32 sa_index)
+{
+  return (pool_elt_at_index (ipsec_main.sad, sa_index));
+}
+
 #endif /* __IPSEC_H__ */
 
 /*
diff --git a/src/vnet/ipsec/ipsec_if.c b/src/vnet/ipsec/ipsec_if.c
index b1c05346dd0..304c52eac7c 100644
--- a/src/vnet/ipsec/ipsec_if.c
+++ b/src/vnet/ipsec/ipsec_if.c
@@ -20,6 +20,7 @@
 #include <vnet/ip/ip.h>
 #include <vnet/fib/fib.h>
 #include <vnet/udp/udp.h>
+#include <vnet/adj/adj_midchain.h>
 
 #include <vnet/ipsec/ipsec.h>
 #include <vnet/ipsec/esp.h>
@@ -40,121 +41,68 @@ format_ipsec_name (u8 * s, va_list * args)
 #define foreach_ipsec_if_tx_error    \
 _(TX, "good packets transmitted")
 
-static char *ipsec_if_tx_error_strings[] = {
-#define _(sym,string) string,
-  foreach_ipsec_if_tx_error
-#undef _
-};
-
-typedef enum
-{
-#define _(sym,str) IPSEC_IF_OUTPUT_ERROR_##sym,
-  foreach_ipsec_if_tx_error
-#undef _
-    IPSEC_IF_TX_N_ERROR,
-} ipsec_if_tx_error_t;
-
-typedef struct
-{
-  u32 spi;
-  u32 seq;
-} ipsec_if_tx_trace_t;
-
-u8 *
-format_ipsec_if_tx_trace (u8 * s, va_list * args)
+static void
+ipsec_if_tunnel_stack (adj_index_t ai)
 {
-  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
-  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
-  ipsec_if_tx_trace_t *t = va_arg (*args, ipsec_if_tx_trace_t *);
+  ipsec_main_t *ipm = &ipsec_main;
+  ipsec_tunnel_if_t *it;
+  ip_adjacency_t *adj;
+  u32 sw_if_index;
 
-  s = format (s, "IPSec: spi %u seq %u", t->spi, t->seq);
-  return s;
-}
+  adj = adj_get (ai);
+  sw_if_index = adj->rewrite_header.sw_if_index;
 
-static void
-ipsec_output_trace (vlib_main_t * vm,
-		    vlib_node_runtime_t * node,
-		    vlib_frame_t * frame, const ipsec_tunnel_if_t * t0)
-{
-  ipsec_main_t *im = &ipsec_main;
-  u32 *from, n_left;
+  if ((vec_len (ipm->ipsec_if_by_sw_if_index) <= sw_if_index) ||
+      (~0 == ipm->ipsec_if_by_sw_if_index[sw_if_index]))
+    return;
 
-  n_left = frame->n_vectors;
-  from = vlib_frame_vector_args (frame);
+  it = pool_elt_at_index (ipm->tunnel_interfaces,
+			  ipm->ipsec_if_by_sw_if_index[sw_if_index]);
 
-  while (n_left > 0)
+  if (!vnet_hw_interface_is_link_up (vnet_get_main (), it->hw_if_index))
     {
-      vlib_buffer_t *b0;
+      adj_midchain_delegate_unstack (ai);
+    }
+  else
+    {
+      ipsec_sa_t *sa;
 
-      b0 = vlib_get_buffer (vm, from[0]);
+      sa = ipsec_sa_get (it->output_sa_index);
 
-      if (b0->flags & VLIB_BUFFER_IS_TRACED)
-	{
-	  ipsec_if_tx_trace_t *tr =
-	    vlib_add_trace (vm, node, b0, sizeof (*tr));
-	  ipsec_sa_t *sa0 = pool_elt_at_index (im->sad, t0->output_sa_index);
-	  tr->spi = sa0->spi;
-	  tr->seq = sa0->seq;
-	}
+      fib_prefix_t pfx = {
+	.fp_addr = sa->tunnel_dst_addr,
+	.fp_len = (sa->is_tunnel_ip6 ? 128 : 32),
+	.fp_proto = (sa->is_tunnel_ip6 ? FIB_PROTOCOL_IP6 : FIB_PROTOCOL_IP4),
+      };
 
-      from += 1;
-      n_left -= 1;
+      adj_midchain_delegate_stack (ai, sa->tx_fib_index, &pfx);
     }
 }
 
-VNET_DEVICE_CLASS_TX_FN (ipsec_device_class) (vlib_main_t * vm,
-					      vlib_node_runtime_t * node,
-					      vlib_frame_t * frame)
+/**
+ * @brief Call back when restacking all adjacencies on a GRE interface
+ */
+static adj_walk_rc_t
+ipsec_if_adj_walk_cb (adj_index_t ai, void *ctx)
 {
-  ipsec_main_t *im = &ipsec_main;
-  u32 *from, n_left;
-  vnet_interface_output_runtime_t *rd = (void *) node->runtime_data;
-  const ipsec_tunnel_if_t *t0;
-  vlib_buffer_t *bufs[VLIB_FRAME_SIZE], **b;
-  u16 nexts[VLIB_FRAME_SIZE];
-
-  from = vlib_frame_vector_args (frame);
-  t0 = pool_elt_at_index (im->tunnel_interfaces, rd->dev_instance);
-  n_left = frame->n_vectors;
-  b = bufs;
-
-  /* All going to encrypt */
-  clib_memset (nexts, 0, sizeof (nexts));
-
-  if (node->flags & VLIB_NODE_FLAG_TRACE)
-    ipsec_output_trace (vm, node, frame, t0);
-
-  vlib_get_buffers (vm, from, bufs, n_left);
+  ipsec_if_tunnel_stack (ai);
 
-  while (n_left >= 8)
-    {
-      /* Prefetch the buffer header for the N+2 loop iteration */
-      vlib_prefetch_buffer_header (b[4], STORE);
-      vlib_prefetch_buffer_header (b[5], STORE);
-      vlib_prefetch_buffer_header (b[6], STORE);
-      vlib_prefetch_buffer_header (b[7], STORE);
-
-      vnet_buffer (b[0])->ipsec.sad_index = t0->output_sa_index;
-      vnet_buffer (b[1])->ipsec.sad_index = t0->output_sa_index;
-      vnet_buffer (b[2])->ipsec.sad_index = t0->output_sa_index;
-      vnet_buffer (b[3])->ipsec.sad_index = t0->output_sa_index;
-
-      n_left -= 4;
-      b += 4;
-    }
-  while (n_left > 0)
-    {
-      vnet_buffer (b[0])->ipsec.sad_index = t0->output_sa_index;
-
-      n_left -= 1;
-      b += 1;
-    }
-
-  vlib_buffer_enqueue_to_next (vm, node, from, nexts, frame->n_vectors);
-
-  return frame->n_vectors;
+  return (ADJ_WALK_RC_CONTINUE);
 }
 
+static void
+ipsec_if_tunnel_restack (ipsec_tunnel_if_t * it)
+{
+  fib_protocol_t proto;
+
+  /*
+   * walk all the adjacencies on th GRE interface and restack them
+   */
+  FOR_EACH_FIB_IP_PROTOCOL (proto)
+  {
+    adj_nbr_walk (it->sw_if_index, proto, ipsec_if_adj_walk_cb, NULL);
+  }
+}
 
 static clib_error_t *
 ipsec_admin_up_down_function (vnet_main_t * vnm, u32 hw_if_index, u32 flags)
@@ -207,18 +155,34 @@ ipsec_admin_up_down_function (vnet_main_t * vnm, u32 hw_if_index, u32 flags)
 	return err;
     }
 
-  return /* no error */ 0;
+  ipsec_if_tunnel_restack (t);
+
+  return (NULL);
 }
 
+static u8 *
+ipsec_if_build_rewrite (vnet_main_t * vnm,
+			u32 sw_if_index,
+			vnet_link_t link_type, const void *dst_address)
+{
+  return (NULL);
+}
+
+static void
+ipsec_if_update_adj (vnet_main_t * vnm, u32 sw_if_index, adj_index_t ai)
+{
+  adj_nbr_midchain_update_rewrite
+    (ai, NULL, NULL, ADJ_FLAG_MIDCHAIN_IP_STACK,
+     ipsec_if_build_rewrite (vnm, sw_if_index, adj_get_link_type (ai), NULL));
+
+  ipsec_if_tunnel_stack (ai);
+}
 
 /* *INDENT-OFF* */
 VNET_DEVICE_CLASS (ipsec_device_class) =
 {
   .name = "IPSec",
   .format_device_name = format_ipsec_name,
-  .format_tx_trace = format_ipsec_if_tx_trace,
-  .tx_function_n_errors = IPSEC_IF_TX_N_ERROR,
-  .tx_function_error_strings = ipsec_if_tx_error_strings,
   .admin_up_down_function = ipsec_admin_up_down_function,
 };
 /* *INDENT-ON* */
@@ -228,6 +192,7 @@ VNET_HW_INTERFACE_CLASS (ipsec_hw_class) =
 {
   .name = "IPSec",
   .build_rewrite = default_build_rewrite,
+  .update_adjacency = ipsec_if_update_adj,
   .flags = VNET_HW_INTERFACE_CLASS_FLAG_P2P,
 };
 /* *INDENT-ON* */
@@ -380,21 +345,25 @@ ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm,
 
       hi = vnet_get_hw_interface (vnm, hw_if_index);
 
-      /* add esp4/6 as the next-node-index of this tx-node */
-      uword slot = vlib_node_add_next_with_slot
-	(vnm->vlib_main, hi->tx_node_index,
-	 is_ip6 ? im->esp6_encrypt_node_index : im->esp4_encrypt_node_index,
-	 0);
-
-      ASSERT (slot == 0);
-
       t->hw_if_index = hw_if_index;
       t->sw_if_index = hi->sw_if_index;
 
-      vnet_feature_enable_disable ("interface-output",
-				   args->is_ip6 ? "ipsec6-if-output" :
-				   "ipsec4-if-output", hi->sw_if_index, 1, 0,
-				   0);
+      /* Add the new tunnel to the DB of tunnels per sw_if_index ... */
+      vec_validate_init_empty (im->ipsec_if_by_sw_if_index, t->sw_if_index,
+			       ~0);
+      im->ipsec_if_by_sw_if_index[t->sw_if_index] = dev_instance;
+
+      vnet_feature_enable_disable ("ip4-output",
+				   "esp4-encrypt-tun",
+				   t->sw_if_index, 1,
+				   &t->output_sa_index,
+				   sizeof (t->output_sa_index));
+      vnet_feature_enable_disable ("ip6-output",
+				   "esp6-encrypt-tun",
+				   t->sw_if_index, 1,
+				   &t->output_sa_index,
+				   sizeof (t->output_sa_index));
+
       /*1st interface, register protocol */
       if (pool_elts (im->tunnel_interfaces) == 1)
 	{
@@ -418,10 +387,16 @@ ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm,
       hi = vnet_get_hw_interface (vnm, t->hw_if_index);
       vnet_sw_interface_set_flags (vnm, hi->sw_if_index, 0);	/* admin down */
 
-      vnet_feature_enable_disable ("interface-output",
-				   args->is_ip6 ? "ipsec6-if-output" :
-				   "ipsec4-if-output", hi->sw_if_index, 0, 0,
-				   0);
+      vnet_feature_enable_disable ("ip4-output",
+				   "esp4-encrypt-tun",
+				   hi->sw_if_index, 0,
+				   &t->output_sa_index,
+				   sizeof (t->output_sa_index));
+      vnet_feature_enable_disable ("ip6-output",
+				   "esp6-encrypt-tun",
+				   hi->sw_if_index, 0,
+				   &t->output_sa_index,
+				   sizeof (t->output_sa_index));
       vnet_delete_hw_interface (vnm, t->hw_if_index);
 
       if (is_ip6)
@@ -430,6 +405,7 @@ ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm,
 	hash_unset (im->ipsec4_if_pool_index_by_key, key4.as_u64);
 
       hash_unset (im->ipsec_if_real_dev_by_show_dev, t->show_instance);
+      im->ipsec_if_by_sw_if_index[t->sw_if_index] = ~0;
 
       pool_put (im->tunnel_interfaces, t);
 
diff --git a/test/test_ipsec_tun_if_esp.py b/test/test_ipsec_tun_if_esp.py
index 7b68f1fcfe6..44b44043647 100644
--- a/test/test_ipsec_tun_if_esp.py
+++ b/test/test_ipsec_tun_if_esp.py
@@ -29,7 +29,7 @@ class TemplateIpsec4TunIfEsp(TemplateIpsec):
         tun_if.admin_up()
         tun_if.config_ip4()
 
-        VppIpRoute(self,  p.remote_tun_if_host, 32,
+        VppIpRoute(self, p.remote_tun_if_host, 32,
                    [VppRoutePath(tun_if.remote_ip4,
                                  0xffffffff)]).add_vpp_config()
 
@@ -70,7 +70,7 @@ class TemplateIpsec6TunIfEsp(TemplateIpsec):
         tun_if.admin_up()
         tun_if.config_ip6()
 
-        VppIpRoute(self,  p.remote_tun_if_host, 128,
+        VppIpRoute(self, p.remote_tun_if_host, 128,
                    [VppRoutePath(tun_if.remote_ip6,
                                  0xffffffff,
                                  proto=DpoProto.DPO_PROTO_IP6)],