ipsec: enable input features on tunnels

Make the ipsec[46]-tun-input nodes siblings of device-input so that
input features can be enabled on them. Register ipsec-tun for feature
updates. When a feature is enabled on the device-input arc and the
ifindex is an IPSec tunnel, change the end node of the arc for that
ifindex to be the appropriate ESP decrypt node. Set a flag on the
tunnel to indicate that the feature arc should be started for packets
input on the tunnel.

Test input policing on ESP IPSec tunnels.

Type: improvement
Signed-off-by: Brian Russell <brian@graphiant.com>
Change-Id: I3b9f047e5e737f3ea4c58fc82cd3c15700b6f9f7

1 files changed, 6 insertions, 0 deletions

diff --git a/test/template_ipsec.py b/test/template_ipsec.py
index 0c1f5a19298..48ac270df72 100644
--- a/test/template_ipsec.py
+++ b/test/template_ipsec.py
@@ -1202,6 +1202,9 @@ class IpsecTun6HandoffTests(IpsecTun6):
 
     def test_tun_handoff_66(self):
         """ ipsec 6o6 tunnel worker hand-off test """
+        self.vapi.cli("clear errors")
+        self.vapi.cli("clear ipsec sa")
+
         N_PKTS = 15
         p = self.params[socket.AF_INET6]
 
@@ -1233,6 +1236,9 @@ class IpsecTun4HandoffTests(IpsecTun4):
 
     def test_tun_handooff_44(self):
         """ ipsec 4o4 tunnel worker hand-off test """
+        self.vapi.cli("clear errors")
+        self.vapi.cli("clear ipsec sa")
+
         N_PKTS = 15
         p = self.params[socket.AF_INET]