+static void
+ipsec_tun_protect_adj_delegate_adj_deleted (adj_delegate_t * ad)
+{
+ /* remove our delegate */
+ ipsec_tun_protect_add_adj (ad->ad_adj_index, NULL);
+ adj_delegate_remove (ad->ad_adj_index, ipsec_tun_adj_delegate_type);
+}
+
+static void
+ipsec_tun_protect_adj_delegate_adj_modified (adj_delegate_t * ad)
+{
+ ipsec_tun_protect_add_adj (ad->ad_adj_index,
+ ipsec_tun_protect_get (ad->ad_index));
+}
+
+static void
+ipsec_tun_protect_adj_delegate_adj_created (adj_index_t ai)
+{
+ /* add our delegate if there is protection for this neighbour */
+ ip_address_t ip = IP_ADDRESS_V4_ALL_0S;
+ ip_adjacency_t *adj;
+ index_t itpi;
+
+ if (!adj_is_midchain (ai))
+ return;
+
+ adj = adj_get (ai);
+
+ ip_address_from_46 (&adj->sub_type.midchain.next_hop,
+ adj->ia_nh_proto, &ip);
+
+ itpi = ipsec_tun_protect_find (adj->rewrite_header.sw_if_index, &ip);
+
+ if (INDEX_INVALID != itpi)
+ ipsec_tun_protect_adj_add (ai, ipsec_tun_protect_get (itpi));
+}
+
+static u8 *
+ipsec_tun_protect_adj_delegate_format (const adj_delegate_t * aed, u8 * s)
+{
+ const ipsec_tun_protect_t *itp;
+
+ itp = ipsec_tun_protect_from_const_base (aed);
+ s = format (s, "ipsec-tun-protect:\n%U", format_ipsec_tun_protect, itp);
+
+ return (s);
+}
+
+static void
+ipsec_tun_teib_entry_added (const teib_entry_t * ne)
+{
+ ipsec_tun_protect_t *itp;
+ index_t itpi;
+
+ itpi = ipsec_tun_protect_find (teib_entry_get_sw_if_index (ne),
+ teib_entry_get_peer (ne));
+
+ if (INDEX_INVALID == itpi)
+ return;
+
+ itp = ipsec_tun_protect_get (itpi);
+ ipsec_tun_protect_rx_db_remove (&ipsec_main, itp);
+ ipsec_tun_protect_update_from_teib (itp, ne);
+ ipsec_tun_protect_set_crypto_addr (itp);
+ ipsec_tun_protect_rx_db_add (&ipsec_main, itp);
+
+ ITP_DBG (itp, "teib-added");
+}
+
+static void
+ipsec_tun_teib_entry_deleted (const teib_entry_t * ne)
+{
+ ipsec_tun_protect_t *itp;
+ index_t itpi;
+
+ itpi = ipsec_tun_protect_find (teib_entry_get_sw_if_index (ne),
+ teib_entry_get_peer (ne));
+
+ if (INDEX_INVALID == itpi)
+ return;
+
+ itp = ipsec_tun_protect_get (itpi);
+ ipsec_tun_protect_rx_db_remove (&ipsec_main, itp);
+ ipsec_tun_protect_update_from_teib (itp, NULL);
+ ipsec_tun_protect_set_crypto_addr (itp);
+
+ ITP_DBG (itp, "teib-removed");
+}
+
+/**
+ * VFT registered with the adjacency delegate
+ */
+const static adj_delegate_vft_t ipsec_tun_adj_delegate_vft = {
+ .adv_adj_deleted = ipsec_tun_protect_adj_delegate_adj_deleted,
+ .adv_adj_created = ipsec_tun_protect_adj_delegate_adj_created,
+ .adv_adj_modified = ipsec_tun_protect_adj_delegate_adj_modified,
+ .adv_format = ipsec_tun_protect_adj_delegate_format,
+};
+
+const static teib_vft_t ipsec_tun_teib_vft = {
+ .nv_added = ipsec_tun_teib_entry_added,
+ .nv_deleted = ipsec_tun_teib_entry_deleted,
+};
+
+static void
+ipsec_tun_table_init (ip_address_family_t af, uword table_size, u32 n_buckets)
+{
+ ipsec_main_t *im;
+
+ im = &ipsec_main;
+
+ if (AF_IP4 == af)
+ clib_bihash_init_8_16 (&im->tun4_protect_by_key,
+ "IPSec IPv4 tunnels", n_buckets, table_size);
+ else
+ clib_bihash_init_24_16 (&im->tun6_protect_by_key,
+ "IPSec IPv6 tunnels", n_buckets, table_size);
+}
+
+static clib_error_t *
+ipsec_tunnel_protect_init (vlib_main_t *vm)