+ iv_size = cipher_alg->iv_len;
+ trunc_size = auth_alg->trunc_size;
+
+ /* if UDP encapsulation is used adjust the address of the IP header */
+ if (sa0->udp_encap && !is_ip6)
+ udp_encap_adv = sizeof (udp_header_t);
+
+ if (sa0->is_tunnel)
+ {
+ rewrite_len = 0;
+ if (!is_ip6 && !sa0->is_tunnel_ip6) /* ip4inip4 */
+ {
+ /* in tunnel mode send it back to FIB */
+ priv->next = DPDK_CRYPTO_INPUT_NEXT_IP4_LOOKUP;
+ u8 adv = sizeof (ip4_header_t) + udp_encap_adv +
+ sizeof (esp_header_t) + iv_size;
+ vlib_buffer_advance (b0, -adv);
+ oh0 = vlib_buffer_get_current (b0);
+ ouh0 = vlib_buffer_get_current (b0);
+ next_hdr_type = IP_PROTOCOL_IP_IN_IP;
+ /*
+ * oh0->ip4.ip_version_and_header_length = 0x45;
+ * oh0->ip4.tos = ih0->ip4.tos;
+ * oh0->ip4.fragment_id = 0;
+ * oh0->ip4.flags_and_fragment_offset = 0;
+ */
+ oh0->ip4.checksum_data_64[0] =
+ clib_host_to_net_u64 (0x45ULL << 56);
+ /*
+ * oh0->ip4.ttl = 254;
+ * oh0->ip4.protocol = IP_PROTOCOL_IPSEC_ESP;
+ */
+ oh0->ip4.checksum_data_32[2] =
+ clib_host_to_net_u32 (0xfe320000);
+
+ oh0->ip4.src_address.as_u32 =
+ sa0->tunnel_src_addr.ip4.as_u32;
+ oh0->ip4.dst_address.as_u32 =
+ sa0->tunnel_dst_addr.ip4.as_u32;
+
+ if (sa0->udp_encap)
+ {
+ oh0->ip4.protocol = IP_PROTOCOL_UDP;
+ esp0 = &ouh0->esp;
+ }
+ else
+ esp0 = &oh0->esp;
+ esp0->spi = clib_host_to_net_u32 (sa0->spi);
+ esp0->seq = clib_host_to_net_u32 (sa0->seq);
+ }
+ else if (is_ip6 && sa0->is_tunnel_ip6) /* ip6inip6 */