5 files changed, 20 insertions, 2 deletions
diff --git a/vnet/vnet/ip/ip4.h b/vnet/vnet/ip/ip4.h
index 5ea4ebf56ef..fb04893a0f7 100644
--- a/vnet/vnet/ip/ip4.h
+++ b/vnet/vnet/ip/ip4.h
@@ -137,6 +137,7 @@ typedef struct ip4_main_t {
   u32 ip4_unicast_rx_feature_check_access;
   u32 ip4_unicast_rx_feature_source_reachable_via_rx;
   u32 ip4_unicast_rx_feature_source_reachable_via_any;
+  u32 ip4_unicast_rx_feature_policer_classify;
   u32 ip4_unicast_rx_feature_ipsec;
   u32 ip4_unicast_rx_feature_vpath;
   u32 ip4_unicast_rx_feature_lookup;
diff --git a/vnet/vnet/ip/ip4_forward.c b/vnet/vnet/ip/ip4_forward.c
index d2e761fe9ea..2ccdd37cbc2 100644
--- a/vnet/vnet/ip/ip4_forward.c
+++ b/vnet/vnet/ip/ip4_forward.c
@@ -1380,11 +1380,18 @@ VNET_IP4_UNICAST_FEATURE_INIT (ip4_source_check_1, static) = {
 
 VNET_IP4_UNICAST_FEATURE_INIT (ip4_source_check_2, static) = {
   .node_name = "ip4-source-check-via-any",
-  .runs_before = {"ipsec-input-ip4", 0},
+  .runs_before = {"ip4-policer-classify", 0},
   .feature_index = 
   &ip4_main.ip4_unicast_rx_feature_source_reachable_via_any,
 };
 
+VNET_IP4_UNICAST_FEATURE_INIT (ip4_policer_classify, static) = {
+  .node_name = "ip4-policer-classify",
+  .runs_before = {"ipsec-input-ip4", 0},
+  .feature_index =
+  &ip4_main.ip4_unicast_rx_feature_policer_classify,
+};
+
 VNET_IP4_UNICAST_FEATURE_INIT (ip4_ipsec, static) = {
   .node_name = "ipsec-input-ip4",
   .runs_before = {"vpath-input-ip4", 0},
diff --git a/vnet/vnet/ip/ip6.h b/vnet/vnet/ip/ip6.h
index 22d1a4feaa0..3d6c9f422e8 100644
--- a/vnet/vnet/ip/ip6.h
+++ b/vnet/vnet/ip/ip6.h
@@ -148,6 +148,7 @@ typedef struct ip6_main_t {
 
   /* Built-in unicast feature path indices, see ip_feature_init_cast(...)  */
   u32 ip6_unicast_rx_feature_check_access;
+  u32 ip6_unicast_rx_feature_policer_classify;
   u32 ip6_unicast_rx_feature_ipsec;
   u32 ip6_unicast_rx_feature_l2tp_decap;
   u32 ip6_unicast_rx_feature_vpath;
diff --git a/vnet/vnet/ip/ip6_forward.c b/vnet/vnet/ip/ip6_forward.c
index 823daa69699..57057a729c1 100644
--- a/vnet/vnet/ip/ip6_forward.c
+++ b/vnet/vnet/ip/ip6_forward.c
@@ -1260,10 +1260,16 @@ VNET_SW_INTERFACE_ADMIN_UP_DOWN_FUNCTION (ip6_sw_interface_admin_up_down);
 /* Built-in ip6 unicast rx feature path definition */
 VNET_IP6_UNICAST_FEATURE_INIT (ip6_inacl, static) = {
   .node_name = "ip6-inacl", 
-  .runs_before = {"ipsec-input-ip6", 0}, 
+  .runs_before = {"ip6-policer-classify", 0},
   .feature_index = &ip6_main.ip6_unicast_rx_feature_check_access,
 };
 
+VNET_IP6_UNICAST_FEATURE_INIT (ip6_policer_classify, static) = {
+  .node_name = "ip6-policer-classify",
+  .runs_before = {"ipsec-input-ip6", 0},
+  .feature_index = &ip6_main.ip6_unicast_rx_feature_policer_classify,
+};
+
 VNET_IP6_UNICAST_FEATURE_INIT (ip6_ipsec, static) = {
   .node_name = "ipsec-input-ip6",
   .runs_before = {"l2tp-decap", 0},
diff --git a/vnet/vnet/ip/ip_init.c b/vnet/vnet/ip/ip_init.c
index 8b6659dedd3..c0c1c9560bc 100644
--- a/vnet/vnet/ip/ip_init.c
+++ b/vnet/vnet/ip/ip_init.c
@@ -133,6 +133,9 @@ do {						\
   if ((error = vlib_call_init_function (vm, input_acl_init)))
     return error;
 
+  if ((error = vlib_call_init_function (vm, policer_classify_init)))
+    return error;
+
   return error;
 }