IPSEC-GRE: fixes and API update to common types.

Change-Id: Icdcbac7453baa837a9c0c4a2401dff4a6aa6cba0
Signed-off-by: Neale Ranns <nranns@cisco.com>

20 files changed, 189 insertions, 196 deletions

diff --git a/src/vat/api_format.c b/src/vat/api_format.c
index bfc9e3cb644..bdfa8c1b56a 100644
--- a/src/vat/api_format.c
+++ b/src/vat/api_format.c
@@ -5030,8 +5030,8 @@ static void vl_api_policer_classify_details_t_handler_json
   vat_json_object_add_uint (node, "table_index", ntohl (mp->table_index));
 }
 
-static void vl_api_ipsec_gre_add_del_tunnel_reply_t_handler
-  (vl_api_ipsec_gre_add_del_tunnel_reply_t * mp)
+static void vl_api_ipsec_gre_tunnel_add_del_reply_t_handler
+  (vl_api_ipsec_gre_tunnel_add_del_reply_t * mp)
 {
   vat_main_t *vam = &vat_main;
   i32 retval = ntohl (mp->retval);
@@ -5048,8 +5048,8 @@ static void vl_api_ipsec_gre_add_del_tunnel_reply_t_handler
   vam->regenerate_interface_table = 1;
 }
 
-static void vl_api_ipsec_gre_add_del_tunnel_reply_t_handler_json
-  (vl_api_ipsec_gre_add_del_tunnel_reply_t * mp)
+static void vl_api_ipsec_gre_tunnel_add_del_reply_t_handler_json
+  (vl_api_ipsec_gre_tunnel_add_del_reply_t * mp)
 {
   vat_main_t *vam = &vat_main;
   vat_json_node_t node;
@@ -5550,7 +5550,7 @@ _(IP_SOURCE_AND_PORT_RANGE_CHECK_ADD_DEL_REPLY,                         \
  ip_source_and_port_range_check_add_del_reply)                          \
 _(IP_SOURCE_AND_PORT_RANGE_CHECK_INTERFACE_ADD_DEL_REPLY,               \
  ip_source_and_port_range_check_interface_add_del_reply)                \
-_(IPSEC_GRE_ADD_DEL_TUNNEL_REPLY, ipsec_gre_add_del_tunnel_reply)       \
+_(IPSEC_GRE_TUNNEL_ADD_DEL_REPLY, ipsec_gre_tunnel_add_del_reply)       \
 _(IPSEC_GRE_TUNNEL_DETAILS, ipsec_gre_tunnel_details)                   \
 _(DELETE_SUBIF_REPLY, delete_subif_reply)                               \
 _(L2_INTERFACE_PBB_TAG_REWRITE_REPLY, l2_interface_pbb_tag_rewrite_reply) \
@@ -20346,14 +20346,14 @@ api_ip_source_and_port_range_check_interface_add_del (vat_main_t * vam)
 }
 
 static int
-api_ipsec_gre_add_del_tunnel (vat_main_t * vam)
+api_ipsec_gre_tunnel_add_del (vat_main_t * vam)
 {
   unformat_input_t *i = vam->input;
-  vl_api_ipsec_gre_add_del_tunnel_t *mp;
+  vl_api_ipsec_gre_tunnel_add_del_t *mp;
   u32 local_sa_id = 0;
   u32 remote_sa_id = 0;
-  ip4_address_t src_address;
-  ip4_address_t dst_address;
+  vl_api_ip4_address_t src_address;
+  vl_api_ip4_address_t dst_address;
   u8 is_add = 1;
   int ret;
 
@@ -20363,9 +20363,11 @@ api_ipsec_gre_add_del_tunnel (vat_main_t * vam)
 	;
       else if (unformat (i, "remote_sa %d", &remote_sa_id))
 	;
-      else if (unformat (i, "src %U", unformat_ip4_address, &src_address))
+      else
+	if (unformat (i, "src %U", unformat_vl_api_ip4_address, &src_address))
 	;
-      else if (unformat (i, "dst %U", unformat_ip4_address, &dst_address))
+      else
+	if (unformat (i, "dst %U", unformat_vl_api_ip4_address, &dst_address))
 	;
       else if (unformat (i, "del"))
 	is_add = 0;
@@ -20376,12 +20378,12 @@ api_ipsec_gre_add_del_tunnel (vat_main_t * vam)
 	}
     }
 
-  M (IPSEC_GRE_ADD_DEL_TUNNEL, mp);
+  M (IPSEC_GRE_TUNNEL_ADD_DEL, mp);
 
-  mp->local_sa_id = ntohl (local_sa_id);
-  mp->remote_sa_id = ntohl (remote_sa_id);
-  clib_memcpy (mp->src_address, &src_address, sizeof (src_address));
-  clib_memcpy (mp->dst_address, &dst_address, sizeof (dst_address));
+  mp->tunnel.local_sa_id = ntohl (local_sa_id);
+  mp->tunnel.remote_sa_id = ntohl (remote_sa_id);
+  clib_memcpy (mp->tunnel.src, &src_address, sizeof (src_address));
+  clib_memcpy (mp->tunnel.dst, &dst_address, sizeof (dst_address));
   mp->is_add = is_add;
 
   S (mp);
@@ -20435,10 +20437,21 @@ static void vl_api_ipsec_gre_tunnel_details_t_handler
   vat_main_t *vam = &vat_main;
 
   print (vam->ofp, "%11d%15U%15U%14d%14d",
-	 ntohl (mp->sw_if_index),
-	 format_ip4_address, &mp->src_address,
-	 format_ip4_address, &mp->dst_address,
-	 ntohl (mp->local_sa_id), ntohl (mp->remote_sa_id));
+	 ntohl (mp->tunnel.sw_if_index),
+	 format_vl_api_ip4_address, mp->tunnel.src,
+	 format_vl_api_ip4_address, mp->tunnel.dst,
+	 ntohl (mp->tunnel.local_sa_id), ntohl (mp->tunnel.remote_sa_id));
+}
+
+static void
+vat_json_object_add_vl_api_ip4 (vat_json_node_t * node,
+				const char *name,
+				const vl_api_ip4_address_t addr)
+{
+  struct in_addr ip4;
+
+  clib_memcpy (&ip4, addr, sizeof (ip4));
+  vat_json_object_add_ip4 (node, name, ip4);
 }
 
 static void vl_api_ipsec_gre_tunnel_details_t_handler_json
@@ -20456,13 +20469,14 @@ static void vl_api_ipsec_gre_tunnel_details_t_handler_json
   node = vat_json_array_add (&vam->json_tree);
 
   vat_json_init_object (node);
-  vat_json_object_add_uint (node, "sw_if_index", ntohl (mp->sw_if_index));
-  clib_memcpy (&ip4, &mp->src_address, sizeof (ip4));
-  vat_json_object_add_ip4 (node, "src_address", ip4);
-  clib_memcpy (&ip4, &mp->dst_address, sizeof (ip4));
-  vat_json_object_add_ip4 (node, "dst_address", ip4);
-  vat_json_object_add_uint (node, "local_sa_id", ntohl (mp->local_sa_id));
-  vat_json_object_add_uint (node, "remote_sa_id", ntohl (mp->remote_sa_id));
+  vat_json_object_add_uint (node, "sw_if_index",
+			    ntohl (mp->tunnel.sw_if_index));
+  vat_json_object_add_vl_api_ip4 (node, "src", mp->tunnel.src);
+  vat_json_object_add_vl_api_ip4 (node, "src", mp->tunnel.dst);
+  vat_json_object_add_uint (node, "local_sa_id",
+			    ntohl (mp->tunnel.local_sa_id));
+  vat_json_object_add_uint (node, "remote_sa_id",
+			    ntohl (mp->tunnel.remote_sa_id));
 }
 
 static int
@@ -22657,7 +22671,7 @@ _(ip_source_and_port_range_check_add_del,                               \
 _(ip_source_and_port_range_check_interface_add_del,                     \
   "<intf> | sw_if_index <nn> [tcp-out-vrf <id>] [tcp-in-vrf <id>]"      \
   "[udp-in-vrf <id>] [udp-out-vrf <id>]")                               \
-_(ipsec_gre_add_del_tunnel,                                             \
+_(ipsec_gre_tunnel_add_del,                                             \
   "src <addr> dst <addr> local_sa <sa-id> remote_sa <sa-id> [del]")     \
 _(ipsec_gre_tunnel_dump, "[sw_if_index <nn>]")                          \
 _(delete_subif,"<intfc> | sw_if_index <nn>")                            \
diff --git a/src/vnet/buffer.h b/src/vnet/buffer.h
index c9b99c9a231..2144ed3a9df 100644
--- a/src/vnet/buffer.h
+++ b/src/vnet/buffer.h
@@ -274,7 +274,6 @@ typedef struct
     /* interface output features */
     struct
     {
-      u32 flags;
       u32 sad_index;
     } ipsec;
 
diff --git a/src/vnet/interface_format.c b/src/vnet/interface_format.c
index 2cc10f9b057..ee332f398e9 100644
--- a/src/vnet/interface_format.c
+++ b/src/vnet/interface_format.c
@@ -486,9 +486,7 @@ format_vnet_buffer_opaque (u8 * s, va_list * args)
   s = format (s, "policer.index: %d", o->policer.index);
   vec_add1 (s, '\n');
 
-  s = format (s,
-	      "ipsec.flags: 0x%x, ipsec.sad_index: %d",
-	      o->ipsec.flags, o->ipsec.sad_index);
+  s = format (s, "ipsec.sad_index: %d", o->ipsec.sad_index);
   vec_add1 (s, '\n');
 
   s = format (s, "map.mtu: %d", (u32) (o->map.mtu));
diff --git a/src/vnet/ipsec-gre/interface.c b/src/vnet/ipsec-gre/interface.c
index 700072350ca..6a8bb7d8f0b 100644
--- a/src/vnet/ipsec-gre/interface.c
+++ b/src/vnet/ipsec-gre/interface.c
@@ -86,31 +86,23 @@ VLIB_INIT_FUNCTION (ipsec_gre_interface_init);
 /**
  * @brief Add or delete ipsec-gre tunnel interface.
  *
- * @param *a vnet_ipsec_gre_add_del_tunnel_args_t - tunnel interface parameters
+ * @param *a vnet_ipsec_gre_tunnel_add_del_args_t - tunnel interface parameters
  * @param *sw_if_indexp u32 - software interface index
  * @return int - 0 if success otherwise <code>VNET_API_ERROR_</code>
  */
 int
-vnet_ipsec_gre_add_del_tunnel (vnet_ipsec_gre_add_del_tunnel_args_t * a,
+vnet_ipsec_gre_tunnel_add_del (const ipsec_gre_tunnel_add_del_args_t * a,
 			       u32 * sw_if_indexp)
 {
   ipsec_gre_main_t *igm = &ipsec_gre_main;
   vnet_main_t *vnm = igm->vnet_main;
-  ip4_main_t *im = &ip4_main;
+  ipsec_main_t *im = &ipsec_main;
   ipsec_gre_tunnel_t *t;
   vnet_hw_interface_t *hi;
   u32 hw_if_index, sw_if_index;
   u32 slot;
   uword *p;
   u64 key;
-  ipsec_add_del_ipsec_gre_tunnel_args_t args;
-
-  clib_memset (&args, 0, sizeof (args));
-  args.is_add = a->is_add;
-  args.local_sa_id = a->lsa;
-  args.remote_sa_id = a->rsa;
-  args.local_ip.as_u32 = a->src.as_u32;
-  args.remote_ip.as_u32 = a->dst.as_u32;
 
   key = (u64) a->src.as_u32 << 32 | (u64) a->dst.as_u32;
   p = hash_get (igm->tunnel_by_key, key);
@@ -160,10 +152,10 @@ vnet_ipsec_gre_add_del_tunnel (vnet_ipsec_gre_add_del_tunnel_args_t * a,
 
       t->hw_if_index = hw_if_index;
       t->sw_if_index = sw_if_index;
-      t->local_sa_id = a->lsa;
-      t->remote_sa_id = a->rsa;
-      t->local_sa = ipsec_get_sa_index_by_sa_id (a->lsa);
-      t->remote_sa = ipsec_get_sa_index_by_sa_id (a->rsa);
+      t->local_sa_id = a->local_sa_id;
+      t->remote_sa_id = a->remote_sa_id;
+      t->local_sa = ipsec_get_sa_index_by_sa_id (t->local_sa_id);
+      t->remote_sa = ipsec_get_sa_index_by_sa_id (t->remote_sa_id);
 
       ip4_sw_interface_enable_disable (sw_if_index, 1);
 
@@ -171,8 +163,6 @@ vnet_ipsec_gre_add_del_tunnel (vnet_ipsec_gre_add_del_tunnel_args_t * a,
 			       sw_if_index, ~0);
       igm->tunnel_index_by_sw_if_index[sw_if_index] = t - igm->tunnels;
 
-      vec_validate (im->fib_index_by_sw_if_index, sw_if_index);
-
       hi->min_packet_bytes = 64 + sizeof (gre_header_t) +
 	sizeof (ip4_header_t) + sizeof (esp_header_t) + sizeof (esp_footer_t);
 
@@ -185,12 +175,11 @@ vnet_ipsec_gre_add_del_tunnel (vnet_ipsec_gre_add_del_tunnel_args_t * a,
 
       hash_set (igm->tunnel_by_key, key, t - igm->tunnels);
 
-      slot = vlib_node_add_named_next_with_slot
-	(vnm->vlib_main, hi->tx_node_index, "esp4-encrypt",
+      slot = vlib_node_add_next_with_slot
+	(vnm->vlib_main, hi->tx_node_index, im->esp4_encrypt_node_index,
 	 IPSEC_GRE_OUTPUT_NEXT_ESP_ENCRYPT);
 
       ASSERT (slot == IPSEC_GRE_OUTPUT_NEXT_ESP_ENCRYPT);
-
     }
   else
     {				/* !is_add => delete */
@@ -216,7 +205,7 @@ vnet_ipsec_gre_add_del_tunnel (vnet_ipsec_gre_add_del_tunnel_args_t * a,
   if (sw_if_indexp)
     *sw_if_indexp = sw_if_index;
 
-  return ipsec_add_del_ipsec_gre_tunnel (vnm, &args);
+  return ipsec_add_del_ipsec_gre_tunnel (vnm, a);
 }
 
 static clib_error_t *
@@ -225,15 +214,15 @@ create_ipsec_gre_tunnel_command_fn (vlib_main_t * vm,
 				    vlib_cli_command_t * cmd)
 {
   unformat_input_t _line_input, *line_input = &_line_input;
-  u8 is_add = 1;
   u32 num_m_args = 0;
-  ip4_address_t src, dst;
-  u32 lsa = 0, rsa = 0;
-  vnet_ipsec_gre_add_del_tunnel_args_t _a, *a = &_a;
+  ipsec_gre_tunnel_add_del_args_t _a, *a = &_a;
   int rv;
   u32 sw_if_index;
   clib_error_t *error = NULL;
 
+  clib_memset (a, 0, sizeof (*a));
+  a->is_add = 1;
+
   /* Get a line of input. */
   if (!unformat_user (input, unformat_line_input, line_input))
     return 0;
@@ -241,14 +230,14 @@ create_ipsec_gre_tunnel_command_fn (vlib_main_t * vm,
   while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
     {
       if (unformat (line_input, "del"))
-	is_add = 0;
-      else if (unformat (line_input, "src %U", unformat_ip4_address, &src))
+	a->is_add = 0;
+      else if (unformat (line_input, "src %U", unformat_ip4_address, &a->src))
 	num_m_args++;
-      else if (unformat (line_input, "dst %U", unformat_ip4_address, &dst))
+      else if (unformat (line_input, "dst %U", unformat_ip4_address, &a->dst))
 	num_m_args++;
-      else if (unformat (line_input, "local-sa %d", &lsa))
+      else if (unformat (line_input, "local-sa %d", &a->local_sa_id))
 	num_m_args++;
-      else if (unformat (line_input, "remote-sa %d", &rsa))
+      else if (unformat (line_input, "remote-sa %d", &a->remote_sa_id))
 	num_m_args++;
       else
 	{
@@ -264,20 +253,13 @@ create_ipsec_gre_tunnel_command_fn (vlib_main_t * vm,
       goto done;
     }
 
-  if (memcmp (&src, &dst, sizeof (src)) == 0)
+  if (memcmp (&a->src, &a->dst, sizeof (a->src)) == 0)
     {
       error = clib_error_return (0, "src and dst are identical");
       goto done;
     }
 
-  clib_memset (a, 0, sizeof (*a));
-  a->is_add = is_add;
-  a->lsa = lsa;
-  a->rsa = rsa;
-  clib_memcpy (&a->src, &src, sizeof (src));
-  clib_memcpy (&a->dst, &dst, sizeof (dst));
-
-  rv = vnet_ipsec_gre_add_del_tunnel (a, &sw_if_index);
+  rv = vnet_ipsec_gre_tunnel_add_del (a, &sw_if_index);
 
   switch (rv)
     {
@@ -290,7 +272,7 @@ create_ipsec_gre_tunnel_command_fn (vlib_main_t * vm,
       goto done;
     default:
       error = clib_error_return (0,
-				 "vnet_ipsec_gre_add_del_tunnel returned %d",
+				 "vnet_ipsec_gre_tunnel_add_del returned %d",
 				 rv);
       goto done;
     }
diff --git a/src/vnet/ipsec-gre/ipsec_gre.api b/src/vnet/ipsec-gre/ipsec_gre.api
index 770746d5e32..b4950097f61 100644
--- a/src/vnet/ipsec-gre/ipsec_gre.api
+++ b/src/vnet/ipsec-gre/ipsec_gre.api
@@ -13,25 +13,37 @@
  * limitations under the License.
  */
 
-option version = "1.0.0";
+option version = "1.1.0";
+
+import "vnet/ip/ip_types.api";
 
 /** \brief Add / del ipsec gre tunnel request
     @param client_index - opaque cookie to identify the sender
     @param context - sender context, to match reply w/ request
-    @param local_sa_id - local SA id
-    @param remote_sa_id - remote SA id
+    @param local_sa_id - local/output SA id
+    @param remote_sa_id - remote/input SA id
     @param is_add - 1 if adding the tunnel, 0 if deleting
-    @param src_address - tunnel source address
-    @param dst_address - tunnel destination address
+    @param sw_if_index - software index of the ipsec gre tunnel
+                         ignored on create. set in dump/details
+    @param src - tunnel source address
+    @param dst - tunnel destination address
 */
-define ipsec_gre_add_del_tunnel {
+typedef ipsec_gre_tunnel {
     u32 client_index;
     u32 context;
     u32 local_sa_id;
     u32 remote_sa_id;
     u8 is_add;
-    u8 src_address[4];
-    u8 dst_address[4];
+    u32 sw_if_index;
+    vl_api_ip4_address_t src;
+    vl_api_ip4_address_t dst;
+};
+
+define ipsec_gre_tunnel_add_del {
+    u32 client_index;
+    u32 context;
+    u8 is_add;
+    vl_api_ipsec_gre_tunnel_t tunnel;
 };
 
 /** \brief Reply for add / del ipsec gre tunnel request
@@ -39,7 +51,7 @@ define ipsec_gre_add_del_tunnel {
     @param retval - return code
     @param sw_if_index - software index of the new ipsec gre tunnel
 */
-define ipsec_gre_add_del_tunnel_reply {
+define ipsec_gre_tunnel_add_del_reply {
     u32 context;
     i32 retval;
     u32 sw_if_index;
@@ -58,7 +70,6 @@ define ipsec_gre_tunnel_dump {
 
 /** \brief ipsec gre tunnel operational state response
     @param context - returned sender context, to match reply w/ request
-    @param sw_if_index - software index of the ipsec gre tunnel
     @param local_sa_id - local SA id
     @param remote_sa_id - remote SA id
     @param src_address - tunnel source address
@@ -66,11 +77,7 @@ define ipsec_gre_tunnel_dump {
 */
 define ipsec_gre_tunnel_details {
     u32 context;
-    u32 sw_if_index;
-    u32 local_sa_id;
-    u32 remote_sa_id;
-    u8 src_address[4];
-    u8 dst_address[4];
+    vl_api_ipsec_gre_tunnel_t tunnel;
 };
 
 /*
diff --git a/src/vnet/ipsec-gre/ipsec_gre.c b/src/vnet/ipsec-gre/ipsec_gre.c
index e4f5e805289..cdb23dd9deb 100644
--- a/src/vnet/ipsec-gre/ipsec_gre.c
+++ b/src/vnet/ipsec-gre/ipsec_gre.c
@@ -106,8 +106,7 @@ VNET_DEVICE_CLASS_TX_FN (ipsec_gre_device_class) (vlib_main_t * vm,
   vnet_interface_output_runtime_t *rd = (void *) node->runtime_data;
   ipsec_gre_tunnel_t *t = pool_elt_at_index (igm->tunnels, rd->dev_instance);
 
-  /* use an ethertype of 0x01 for l2-gre */
-  u16 l2_gre_protocol_ethertype = clib_net_to_host_u16 (0x01);
+  u16 l2_gre_protocol_ethertype = clib_net_to_host_u16 (GRE_PROTOCOL_teb);
 
   /* Vector of buffer / pkt indices we're supposed to process */
   from = vlib_frame_vector_args (frame);
diff --git a/src/vnet/ipsec-gre/ipsec_gre.h b/src/vnet/ipsec-gre/ipsec_gre.h
index caf2ecf8b30..730cd717795 100644
--- a/src/vnet/ipsec-gre/ipsec_gre.h
+++ b/src/vnet/ipsec-gre/ipsec_gre.h
@@ -28,6 +28,8 @@
 #include <vnet/ip/ip4_packet.h>
 #include <vnet/pg/pg.h>
 #include <vnet/ip/format.h>
+#include <vnet/ipsec/ipsec.h>
+#include <vnet/ipsec/ipsec_if.h>
 
 extern vnet_hw_interface_class_t ipsec_gre_hw_interface_class;
 
@@ -86,24 +88,11 @@ extern vlib_node_registration_t ipsec_gre_input_node;
 extern vnet_device_class_t ipsec_gre_device_class;
 
 /* manually added to the interface output node in ipsec_gre.c */
-#define IPSEC_GRE_OUTPUT_NEXT_ESP_ENCRYPT 1
+#define IPSEC_GRE_OUTPUT_NEXT_ESP_ENCRYPT 0
 
-/**
- * @brief IPSec-GRE tunnel add/del arguments.
- *
-*/
-typedef struct
-{
-  u8 is_add; /**< 1 - add, 0 - delete */
-
-  ip4_address_t src; /**< tunnel IPv4 src address */
-  ip4_address_t dst; /**< tunnel IPv4 dst address */
-  u32 lsa;	     /**< local IPSec SA id */
-  u32 rsa;	     /**< remote IPSec SA id */
-} vnet_ipsec_gre_add_del_tunnel_args_t;
-
-int vnet_ipsec_gre_add_del_tunnel
-  (vnet_ipsec_gre_add_del_tunnel_args_t * a, u32 * sw_if_indexp);
+extern int vnet_ipsec_gre_tunnel_add_del (const
+					  ipsec_gre_tunnel_add_del_args_t * a,
+					  u32 * sw_if_indexp);
 
 #endif /* included_ipsec_gre_h */
 
diff --git a/src/vnet/ipsec-gre/ipsec_gre_api.c b/src/vnet/ipsec-gre/ipsec_gre_api.c
index 3f85c4fc266..24c1f0d5600 100644
--- a/src/vnet/ipsec-gre/ipsec_gre_api.c
+++ b/src/vnet/ipsec-gre/ipsec_gre_api.c
@@ -23,6 +23,7 @@
 #include <vnet/interface.h>
 #include <vnet/api_errno.h>
 #include <vnet/ipsec-gre/ipsec_gre.h>
+#include <vnet/ip/ip_types_api.h>
 
 #include <vnet/vnet_msg_enum.h>
 
@@ -43,43 +44,43 @@
 #include <vlibapi/api_helper_macros.h>
 
 #define foreach_vpe_api_msg                             \
-_(IPSEC_GRE_ADD_DEL_TUNNEL, ipsec_gre_add_del_tunnel)                   \
+_(IPSEC_GRE_TUNNEL_ADD_DEL, ipsec_gre_tunnel_add_del)                   \
 _(IPSEC_GRE_TUNNEL_DUMP, ipsec_gre_tunnel_dump)
 
 static void
-vl_api_ipsec_gre_add_del_tunnel_t_handler (vl_api_ipsec_gre_add_del_tunnel_t *
+vl_api_ipsec_gre_tunnel_add_del_t_handler (vl_api_ipsec_gre_tunnel_add_del_t *
 					   mp)
 {
-  vl_api_ipsec_gre_add_del_tunnel_reply_t *rmp;
+  vl_api_ipsec_gre_tunnel_add_del_reply_t *rmp;
   int rv = 0;
-  vnet_ipsec_gre_add_del_tunnel_args_t _a, *a = &_a;
+  ipsec_gre_tunnel_add_del_args_t _a, *a = &_a;
   u32 sw_if_index = ~0;
 
+  clib_memset (a, 0, sizeof (*a));
+
+  ip4_address_decode (mp->tunnel.src, &a->src);
+  ip4_address_decode (mp->tunnel.dst, &a->dst);
+
   /* Check src & dst are different */
-  if (memcmp (mp->src_address, mp->dst_address, 4) == 0)
+  if (a->src.as_u32 == a->dst.as_u32)
     {
       rv = VNET_API_ERROR_SAME_SRC_DST;
       goto out;
     }
 
-  clib_memset (a, 0, sizeof (*a));
-
-  /* ip addresses sent in network byte order */
-  clib_memcpy (&(a->src), mp->src_address, 4);
-  clib_memcpy (&(a->dst), mp->dst_address, 4);
   a->is_add = mp->is_add;
-  a->lsa = ntohl (mp->local_sa_id);
-  a->rsa = ntohl (mp->remote_sa_id);
+  a->local_sa_id = ntohl (mp->tunnel.local_sa_id);
+  a->remote_sa_id = ntohl (mp->tunnel.remote_sa_id);
 
-  rv = vnet_ipsec_gre_add_del_tunnel (a, &sw_if_index);
+  rv = vnet_ipsec_gre_tunnel_add_del (a, &sw_if_index);
 
 out:
-    /* *INDENT-OFF* */
-    REPLY_MACRO2(VL_API_GRE_ADD_DEL_TUNNEL_REPLY,
-    ({
-        rmp->sw_if_index = ntohl (sw_if_index);
-    }));
-    /* *INDENT-ON* */
+  /* *INDENT-OFF* */
+  REPLY_MACRO2(VL_API_GRE_ADD_DEL_TUNNEL_REPLY,
+  ({
+    rmp->sw_if_index = ntohl (sw_if_index);
+  }));
+  /* *INDENT-ON* */
 }
 
 static void send_ipsec_gre_tunnel_details
@@ -90,11 +91,12 @@ static void send_ipsec_gre_tunnel_details
   rmp = vl_msg_api_alloc (sizeof (*rmp));
   clib_memset (rmp, 0, sizeof (*rmp));
   rmp->_vl_msg_id = ntohs (VL_API_IPSEC_GRE_TUNNEL_DETAILS);
-  clib_memcpy (rmp->src_address, &(t->tunnel_src), 4);
-  clib_memcpy (rmp->dst_address, &(t->tunnel_dst), 4);
-  rmp->sw_if_index = htonl (t->sw_if_index);
-  rmp->local_sa_id = htonl (t->local_sa_id);
-  rmp->remote_sa_id = htonl (t->remote_sa_id);
+
+  ip4_address_encode (&t->tunnel_src, rmp->tunnel.src);
+  ip4_address_encode (&t->tunnel_dst, rmp->tunnel.dst);
+  rmp->tunnel.sw_if_index = htonl (t->sw_if_index);
+  rmp->tunnel.local_sa_id = htonl (t->local_sa_id);
+  rmp->tunnel.remote_sa_id = htonl (t->remote_sa_id);
   rmp->context = context;
 
   vl_api_send_msg (reg, (u8 *) rmp);
diff --git a/src/vnet/ipsec-gre/node.c b/src/vnet/ipsec-gre/node.c
index 9e1ab206ad4..6a3aaa12e8c 100644
--- a/src/vnet/ipsec-gre/node.c
+++ b/src/vnet/ipsec-gre/node.c
@@ -160,7 +160,7 @@ VLIB_NODE_FN (ipsec_gre_input_node) (vlib_main_t * vm,
 
           protocol0 = clib_net_to_host_u16 (h0->protocol);
           protocol1 = clib_net_to_host_u16 (h1->protocol);
-          if (PREDICT_TRUE(protocol0 == 0x0001))
+          if (PREDICT_TRUE(protocol0 == GRE_PROTOCOL_teb))
             {
               next0 = IPSEC_GRE_INPUT_NEXT_L2_INPUT;
               b0->error = node->errors[IPSEC_GRE_ERROR_NONE];
@@ -170,7 +170,7 @@ VLIB_NODE_FN (ipsec_gre_input_node) (vlib_main_t * vm,
               b0->error = node->errors[IPSEC_GRE_ERROR_UNKNOWN_PROTOCOL];
               next0 = IPSEC_GRE_INPUT_NEXT_DROP;
             }
-          if (PREDICT_TRUE(protocol1 == 0x0001))
+          if (PREDICT_TRUE(protocol1 == GRE_PROTOCOL_teb))
             {
               next1 = IPSEC_GRE_INPUT_NEXT_L2_INPUT;
               b1->error = node->errors[IPSEC_GRE_ERROR_NONE];
@@ -314,7 +314,7 @@ drop1:
 	  h0 = vlib_buffer_get_current (b0);
 
           protocol0 = clib_net_to_host_u16 (h0->protocol);
-          if (PREDICT_TRUE(protocol0 == 0x0001))
+          if (PREDICT_TRUE(protocol0 == GRE_PROTOCOL_teb))
             {
               next0 = IPSEC_GRE_INPUT_NEXT_L2_INPUT;
               b0->error = node->errors[IPSEC_GRE_ERROR_NONE];
@@ -332,7 +332,7 @@ drop1:
           next0 = verr0 ? IPSEC_GRE_INPUT_NEXT_DROP : next0;
 
           /* For L2 payload set input sw_if_index to GRE tunnel for learning */
-          if (PREDICT_FALSE(next0 == IPSEC_GRE_INPUT_NEXT_L2_INPUT))
+          if (PREDICT_TRUE(next0 == IPSEC_GRE_INPUT_NEXT_L2_INPUT))
             {
               u64 key = ((u64)(tun_dst0) << 32) | (u64)(tun_src0);
 
diff --git a/src/vnet/ipsec/ah_decrypt.c b/src/vnet/ipsec/ah_decrypt.c
index cf955889420..e68accd9da2 100644
--- a/src/vnet/ipsec/ah_decrypt.c
+++ b/src/vnet/ipsec/ah_decrypt.c
@@ -259,12 +259,9 @@ ah_decrypt_inline (vlib_main_t * vm,
 	    }
 
 	  /* for IPSec-GRE tunnel next node is ipsec-gre-input */
-	  if (PREDICT_FALSE
-	      ((vnet_buffer (i_b0)->ipsec.flags) &
-	       IPSEC_FLAG_IPSEC_GRE_TUNNEL))
+	  if (PREDICT_FALSE (ipsec_sa_is_set_IS_GRE (sa0)))
 	    next0 = AH_DECRYPT_NEXT_IPSEC_GRE_INPUT;
 
-
 	  vnet_buffer (i_b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
 	trace:
 	  if (PREDICT_FALSE (i_b0->flags & VLIB_BUFFER_IS_TRACED))
diff --git a/src/vnet/ipsec/esp_decrypt.c b/src/vnet/ipsec/esp_decrypt.c
index 3e09d9d74c2..c6cb439f1f8 100644
--- a/src/vnet/ipsec/esp_decrypt.c
+++ b/src/vnet/ipsec/esp_decrypt.c
@@ -396,7 +396,7 @@ esp_decrypt_inline (vlib_main_t * vm,
 	    }
 	}
 
-      if (vnet_buffer (b[0])->ipsec.flags & IPSEC_FLAG_IPSEC_GRE_TUNNEL)
+      if (PREDICT_FALSE (ipsec_sa_is_set_IS_GRE (sa0)))
 	next[0] = ESP_DECRYPT_NEXT_IPSEC_GRE_INPUT;
 
     trace:
diff --git a/src/vnet/ipsec/ipsec_api.c b/src/vnet/ipsec/ipsec_api.c
index 4c7242da30a..753d7530de4 100644
--- a/src/vnet/ipsec/ipsec_api.c
+++ b/src/vnet/ipsec/ipsec_api.c
@@ -308,11 +308,18 @@ ipsec_sa_flags_decode (vl_api_ipsec_sad_flags_t in)
   ipsec_sa_flags_t flags = IPSEC_SA_FLAG_NONE;
   in = clib_net_to_host_u32 (in);
 
-#define _(v,f,s) if (in & IPSEC_API_SAD_FLAG_##f)    \
-    flags |= IPSEC_SA_FLAG_##f;
-  foreach_ipsec_sa_flags
-#undef _
-    return (flags);
+  if (in & IPSEC_API_SAD_FLAG_USE_ESN)
+    flags |= IPSEC_SA_FLAG_USE_ESN;
+  if (in & IPSEC_API_SAD_FLAG_USE_ANTI_REPLAY)
+    flags |= IPSEC_SA_FLAG_USE_ANTI_REPLAY;
+  if (in & IPSEC_API_SAD_FLAG_IS_TUNNEL)
+    flags |= IPSEC_SA_FLAG_IS_TUNNEL;
+  if (in & IPSEC_API_SAD_FLAG_IS_TUNNEL_V6)
+    flags |= IPSEC_SA_FLAG_IS_TUNNEL_V6;
+  if (in & IPSEC_API_SAD_FLAG_UDP_ENCAP)
+    flags |= IPSEC_SA_FLAG_UDP_ENCAP;
+
+  return (flags);
 }
 
 static vl_api_ipsec_sad_flags_t
diff --git a/src/vnet/ipsec/ipsec_format.c b/src/vnet/ipsec/ipsec_format.c
index dd99f780be6..a8616555629 100644
--- a/src/vnet/ipsec/ipsec_format.c
+++ b/src/vnet/ipsec/ipsec_format.c
@@ -244,6 +244,19 @@ unformat_ipsec_key (unformat_input_t * input, va_list * args)
 }
 
 u8 *
+format_ipsec_sa_flags (u8 * s, va_list * args)
+{
+  ipsec_sa_flags_t flags = va_arg (*args, int);
+
+  if (0)
+    ;
+#define _(v, f, str) else if (flags & IPSEC_SA_FLAG_##f) s = format(s, "%s ", str);
+  foreach_ipsec_sa_flags
+#undef _
+    return (s);
+}
+
+u8 *
 format_ipsec_sa (u8 * s, va_list * args)
 {
   u32 sai = va_arg (*args, u32);
@@ -254,15 +267,11 @@ format_ipsec_sa (u8 * s, va_list * args)
 
   sa = pool_elt_at_index (im->sad, sai);
 
-  s = format (s, "[%d] sa 0x%x spi %u mode %s%s protocol %s%s%s%s",
+  s = format (s, "[%d] sa 0x%x spi %u mode %s%s protocol %s %U",
 	      sai, sa->id, sa->spi,
 	      ipsec_sa_is_set_IS_TUNNEL (sa) ? "tunnel" : "transport",
 	      ipsec_sa_is_set_IS_TUNNEL_V6 (sa) ? "-ip6" : "",
-	      sa->protocol ? "esp" : "ah",
-	      ipsec_sa_is_set_UDP_ENCAP (sa) ? " udp-encap-enabled" : "",
-	      ipsec_sa_is_set_USE_ANTI_REPLAY (sa) ? " anti-replay" : "",
-	      ipsec_sa_is_set_USE_ESN (sa) ?
-	      " extended-sequence-number" : "");
+	      sa->protocol ? "esp" : "ah", format_ipsec_sa_flags, sa->flags);
   s = format (s, "\n   seq %u seq-hi %u", sa->seq, sa->seq_hi);
   s = format (s, "\n   last-seq %u last-seq-hi %u window %U",
 	      sa->last_seq, sa->last_seq_hi,
diff --git a/src/vnet/ipsec/ipsec_if.c b/src/vnet/ipsec/ipsec_if.c
index 17f28a09ac8..bfdc2bb6814 100644
--- a/src/vnet/ipsec/ipsec_if.c
+++ b/src/vnet/ipsec/ipsec_if.c
@@ -429,7 +429,7 @@ ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm,
 
 int
 ipsec_add_del_ipsec_gre_tunnel (vnet_main_t * vnm,
-				ipsec_add_del_ipsec_gre_tunnel_args_t * args)
+				const ipsec_gre_tunnel_add_del_args_t * args)
 {
   ipsec_tunnel_if_t *t = 0;
   ipsec_main_t *im = &ipsec_main;
@@ -441,22 +441,27 @@ ipsec_add_del_ipsec_gre_tunnel (vnet_main_t * vnm,
   p = hash_get (im->sa_index_by_sa_id, args->local_sa_id);
   if (!p)
     return VNET_API_ERROR_INVALID_VALUE;
-  isa = p[0];
+  osa = p[0];
+  sa = pool_elt_at_index (im->sad, p[0]);
+  ipsec_sa_set_IS_GRE (sa);
 
   p = hash_get (im->sa_index_by_sa_id, args->remote_sa_id);
   if (!p)
     return VNET_API_ERROR_INVALID_VALUE;
-  osa = p[0];
+  isa = p[0];
   sa = pool_elt_at_index (im->sad, p[0]);
+  ipsec_sa_set_IS_GRE (sa);
 
+  /* we form the key from the input/remote SA whose tunnel is srouce
+   * at the remote end */
   if (ipsec_sa_is_set_IS_TUNNEL (sa))
     {
-      key.remote_ip = sa->tunnel_dst_addr.ip4.as_u32;
+      key.remote_ip = sa->tunnel_src_addr.ip4.as_u32;
       key.spi = clib_host_to_net_u32 (sa->spi);
     }
   else
     {
-      key.remote_ip = args->remote_ip.as_u32;
+      key.remote_ip = args->src.as_u32;
       key.spi = clib_host_to_net_u32 (sa->spi);
     }
 
diff --git a/src/vnet/ipsec/ipsec_if.h b/src/vnet/ipsec/ipsec_if.h
index 7f0eb08b24c..34a1721f4fc 100644
--- a/src/vnet/ipsec/ipsec_if.h
+++ b/src/vnet/ipsec/ipsec_if.h
@@ -97,17 +97,18 @@ typedef struct
   u8 is_add;
   u32 local_sa_id;
   u32 remote_sa_id;
-  ip4_address_t local_ip;
-  ip4_address_t remote_ip;
-} ipsec_add_del_ipsec_gre_tunnel_args_t;
+  ip4_address_t src;
+  ip4_address_t dst;
+} ipsec_gre_tunnel_add_del_args_t;
 
 extern int ipsec_add_del_tunnel_if_internal (vnet_main_t * vnm,
 					     ipsec_add_del_tunnel_args_t *
 					     args, u32 * sw_if_index);
 extern int ipsec_add_del_tunnel_if (ipsec_add_del_tunnel_args_t * args);
 extern int ipsec_add_del_ipsec_gre_tunnel (vnet_main_t * vnm,
-					   ipsec_add_del_ipsec_gre_tunnel_args_t
-					   * args);
+					   const
+					   ipsec_gre_tunnel_add_del_args_t *
+					   args);
 
 extern int ipsec_set_interface_key (vnet_main_t * vnm, u32 hw_if_index,
 				    ipsec_if_set_key_type_t type,
diff --git a/src/vnet/ipsec/ipsec_if_in.c b/src/vnet/ipsec/ipsec_if_in.c
index 63d463bd633..9ba2c10bca6 100644
--- a/src/vnet/ipsec/ipsec_if_in.c
+++ b/src/vnet/ipsec/ipsec_if_in.c
@@ -197,6 +197,7 @@ ipsec_if_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 		}
 	      else
 		{
+		  b[0]->error = node->errors[IPSEC_IF_INPUT_ERROR_NO_TUNNEL];
 		  n_no_tunnel++;
 		  next[0] = IPSEC_INPUT_NEXT_DROP;
 		  goto pkt1;
@@ -224,6 +225,7 @@ ipsec_if_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 		}
 	      else
 		{
+		  b[0]->error = node->errors[IPSEC_IF_INPUT_ERROR_NO_TUNNEL];
 		  n_no_tunnel++;
 		  next[0] = IPSEC_INPUT_NEXT_DROP;
 		  goto pkt1;
@@ -236,7 +238,6 @@ ipsec_if_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 
       if (PREDICT_TRUE (t0->hw_if_index != ~0))
 	{
-	  vnet_buffer (b[0])->ipsec.flags = 0;
 	  sw_if_index0 = t0->sw_if_index;
 	  vnet_buffer (b[0])->sw_if_index[VLIB_RX] = sw_if_index0;
 
@@ -245,6 +246,7 @@ ipsec_if_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 	      vlib_increment_combined_counter
 		(drop_counter, thread_index, sw_if_index0, 1, len0);
 	      n_disabled++;
+	      b[0]->error = node->errors[IPSEC_IF_INPUT_ERROR_DISABLED];
 	      next[0] = IPSEC_INPUT_NEXT_DROP;
 	      goto pkt1;
 	    }
@@ -268,10 +270,6 @@ ipsec_if_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 	      n_bytes = len0;
 	    }
 	}
-      else
-	{
-	  vnet_buffer (b[0])->ipsec.flags = IPSEC_FLAG_IPSEC_GRE_TUNNEL;
-	}
 
     pkt1:
       if (is_ip6)
@@ -295,6 +293,7 @@ ipsec_if_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 		}
 	      else
 		{
+		  b[1]->error = node->errors[IPSEC_IF_INPUT_ERROR_NO_TUNNEL];
 		  n_no_tunnel++;
 		  next[1] = IPSEC_INPUT_NEXT_DROP;
 		  goto trace1;
@@ -322,6 +321,7 @@ ipsec_if_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 		}
 	      else
 		{
+		  b[1]->error = node->errors[IPSEC_IF_INPUT_ERROR_NO_TUNNEL];
 		  n_no_tunnel++;
 		  next[1] = IPSEC_INPUT_NEXT_DROP;
 		  goto trace1;
@@ -334,7 +334,6 @@ ipsec_if_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 
       if (PREDICT_TRUE (t1->hw_if_index != ~0))
 	{
-	  vnet_buffer (b[1])->ipsec.flags = 0;
 	  sw_if_index1 = t1->sw_if_index;
 	  vnet_buffer (b[1])->sw_if_index[VLIB_RX] = sw_if_index1;
 
@@ -343,6 +342,7 @@ ipsec_if_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 	      vlib_increment_combined_counter
 		(drop_counter, thread_index, sw_if_index1, 1, len1);
 	      n_disabled++;
+	      b[1]->error = node->errors[IPSEC_IF_INPUT_ERROR_DISABLED];
 	      next[1] = IPSEC_INPUT_NEXT_DROP;
 	      goto trace1;
 	    }
@@ -366,10 +366,6 @@ ipsec_if_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 	      n_bytes = len1;
 	    }
 	}
-      else
-	{
-	  vnet_buffer (b[1])->ipsec.flags = IPSEC_FLAG_IPSEC_GRE_TUNNEL;
-	}
 
     trace1:
       if (PREDICT_FALSE (is_trace))
@@ -460,6 +456,7 @@ ipsec_if_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 		}
 	      else
 		{
+		  b[0]->error = node->errors[IPSEC_IF_INPUT_ERROR_NO_TUNNEL];
 		  n_no_tunnel++;
 		  next[0] = IPSEC_INPUT_NEXT_DROP;
 		  goto trace00;
@@ -487,6 +484,7 @@ ipsec_if_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 		}
 	      else
 		{
+		  b[0]->error = node->errors[IPSEC_IF_INPUT_ERROR_NO_TUNNEL];
 		  n_no_tunnel++;
 		  next[0] = IPSEC_INPUT_NEXT_DROP;
 		  goto trace00;
@@ -499,7 +497,6 @@ ipsec_if_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 
       if (PREDICT_TRUE (t0->hw_if_index != ~0))
 	{
-	  vnet_buffer (b[0])->ipsec.flags = 0;
 	  sw_if_index0 = t0->sw_if_index;
 	  vnet_buffer (b[0])->sw_if_index[VLIB_RX] = sw_if_index0;
 
@@ -508,6 +505,7 @@ ipsec_if_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 	      vlib_increment_combined_counter
 		(drop_counter, thread_index, sw_if_index0, 1, len0);
 	      n_disabled++;
+	      b[0]->error = node->errors[IPSEC_IF_INPUT_ERROR_DISABLED];
 	      next[0] = IPSEC_INPUT_NEXT_DROP;
 	      goto trace00;
 	    }
@@ -531,10 +529,6 @@ ipsec_if_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 	      n_bytes = len0;
 	    }
 	}
-      else
-	{
-	  vnet_buffer (b[0])->ipsec.flags = IPSEC_FLAG_IPSEC_GRE_TUNNEL;
-	}
 
     trace00:
       if (PREDICT_FALSE (is_trace))
@@ -563,11 +557,8 @@ ipsec_if_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 
   vlib_node_increment_counter (vm, node->node_index,
 			       IPSEC_IF_INPUT_ERROR_RX,
-			       from_frame->n_vectors - n_disabled);
-  vlib_node_increment_counter (vm, node->node_index,
-			       IPSEC_IF_INPUT_ERROR_DISABLED, n_disabled);
-  vlib_node_increment_counter (vm, node->node_index,
-			       IPSEC_IF_INPUT_ERROR_NO_TUNNEL, n_no_tunnel);
+			       from_frame->n_vectors - (n_disabled +
+							n_no_tunnel));
 
   vlib_buffer_enqueue_to_next (vm, node, from, nexts, from_frame->n_vectors);
 
diff --git a/src/vnet/ipsec/ipsec_input.c b/src/vnet/ipsec/ipsec_input.c
index 970211eccaa..5be72c3a161 100644
--- a/src/vnet/ipsec/ipsec_input.c
+++ b/src/vnet/ipsec/ipsec_input.c
@@ -253,7 +253,6 @@ VLIB_NODE_FN (ipsec4_input_node) (vlib_main_t * vm,
 		     clib_net_to_host_u16 (ip0->length));
 
 		  vnet_buffer (b0)->ipsec.sad_index = p0->sa_index;
-		  vnet_buffer (b0)->ipsec.flags = 0;
 		  next0 = im->esp4_decrypt_next_index;
 		  vlib_buffer_advance (b0, ((u8 *) esp0 - (u8 *) ip0));
 		  goto trace0;
@@ -304,7 +303,6 @@ VLIB_NODE_FN (ipsec4_input_node) (vlib_main_t * vm,
 		     clib_net_to_host_u16 (ip0->length));
 
 		  vnet_buffer (b0)->ipsec.sad_index = p0->sa_index;
-		  vnet_buffer (b0)->ipsec.flags = 0;
 		  next0 = im->ah4_decrypt_next_index;
 		  goto trace1;
 		}
@@ -450,7 +448,6 @@ VLIB_NODE_FN (ipsec6_input_node) (vlib_main_t * vm,
 		     header_size);
 
 		  vnet_buffer (b0)->ipsec.sad_index = p0->sa_index;
-		  vnet_buffer (b0)->ipsec.flags = 0;
 		  next0 = im->esp6_decrypt_next_index;
 		  vlib_buffer_advance (b0, header_size);
 		  goto trace0;
@@ -479,7 +476,6 @@ VLIB_NODE_FN (ipsec6_input_node) (vlib_main_t * vm,
 		     header_size);
 
 		  vnet_buffer (b0)->ipsec.sad_index = p0->sa_index;
-		  vnet_buffer (b0)->ipsec.flags = 0;
 		  next0 = im->ah6_decrypt_next_index;
 		  goto trace0;
 		}
diff --git a/src/vnet/ipsec/ipsec_io.h b/src/vnet/ipsec/ipsec_io.h
index c180a784eaa..f156b48360f 100644
--- a/src/vnet/ipsec/ipsec_io.h
+++ b/src/vnet/ipsec/ipsec_io.h
@@ -15,8 +15,6 @@
 #ifndef __IPSEC_IO_H__
 #define __IPSEC_IO_H__
 
-#define IPSEC_FLAG_IPSEC_GRE_TUNNEL (1 << 0)
-
 #define foreach_ipsec_output_next  \
   _ (DROP, "error-drop")
 
diff --git a/src/vnet/ipsec/ipsec_sa.h b/src/vnet/ipsec/ipsec_sa.h
index 94f1554112f..cfb44b9e86d 100644
--- a/src/vnet/ipsec/ipsec_sa.h
+++ b/src/vnet/ipsec/ipsec_sa.h
@@ -90,6 +90,7 @@ typedef struct ipsec_key_t_
   _ (4, IS_TUNNEL, "tunnel")                              \
   _ (8, IS_TUNNEL_V6, "tunnel-v6")                        \
   _ (16, UDP_ENCAP, "udp-encap")                          \
+  _ (32, IS_GRE, "GRE")                                   \
 
 typedef enum ipsec_sad_flags_t_
 {
diff --git a/src/vpp/api/custom_dump.c b/src/vpp/api/custom_dump.c
index a1206b1016a..fac2aa26c0d 100644
--- a/src/vpp/api/custom_dump.c
+++ b/src/vpp/api/custom_dump.c
@@ -3307,22 +3307,20 @@ static void *vl_api_lisp_eid_table_map_dump_t_print
   FINISH;
 }
 
-static void *vl_api_ipsec_gre_add_del_tunnel_t_print
-  (vl_api_ipsec_gre_add_del_tunnel_t * mp, void *handle)
+static void *vl_api_ipsec_gre_tunnel_add_del_t_print
+  (vl_api_ipsec_gre_tunnel_add_del_t * mp, void *handle)
 {
   u8 *s;
 
-  s = format (0, "SCRIPT: ipsec_gre_add_del_tunnel ");
+  s = format (0, "SCRIPT: ipsec_gre_tunnel_add_del ");
 
-  s = format (s, "dst %U ", format_ip4_address,
-	      (ip4_address_t *) & (mp->dst_address));
+  s = format (s, "dst %U ", format_vl_api_ip4_address, mp->tunnel.dst);
 
-  s = format (s, "src %U ", format_ip4_address,
-	      (ip4_address_t *) & (mp->src_address));
+  s = format (s, "src %U ", format_vl_api_ip4_address, mp->tunnel.src);
 
-  s = format (s, "local_sa %d ", ntohl (mp->local_sa_id));
+  s = format (s, "local_sa %d ", ntohl (mp->tunnel.local_sa_id));
 
-  s = format (s, "remote_sa %d ", ntohl (mp->remote_sa_id));
+  s = format (s, "remote_sa %d ", ntohl (mp->tunnel.remote_sa_id));
 
   if (mp->is_add == 0)
     s = format (s, "del ");
@@ -3901,7 +3899,7 @@ _(SHOW_LISP_RLOC_PROBE_STATE, show_lisp_rloc_probe_state)               \
 _(SHOW_LISP_MAP_REGISTER_STATE, show_lisp_map_register_state)           \
 _(LISP_RLOC_PROBE_ENABLE_DISABLE, lisp_rloc_probe_enable_disable)       \
 _(LISP_MAP_REGISTER_ENABLE_DISABLE, lisp_map_register_enable_disable)   \
-_(IPSEC_GRE_ADD_DEL_TUNNEL, ipsec_gre_add_del_tunnel)                   \
+_(IPSEC_GRE_TUNNEL_ADD_DEL, ipsec_gre_tunnel_add_del)                   \
 _(IPSEC_GRE_TUNNEL_DUMP, ipsec_gre_tunnel_dump)                         \
 _(DELETE_SUBIF, delete_subif)                                           \
 _(L2_INTERFACE_PBB_TAG_REWRITE, l2_interface_pbb_tag_rewrite)           \