+#define foreach_ipsec_protect_flags \
+ _(L2, 1, "l2") \
+ _(ENCAPED, 2, "encapped") \
+ _(ITF, 4, "itf") \
+
+typedef enum ipsec_protect_flags_t_
+{
+ IPSEC_PROTECT_NONE = 0,
+#define _(a,b,c) IPSEC_PROTECT_##a = b,
+ foreach_ipsec_protect_flags
+#undef _
+} __clib_packed ipsec_protect_flags_t;
+
+extern u8 *format_ipsec_tun_protect_flags (u8 * s, va_list * args);
+
+/**
+ * result of a lookup in the protection bihash
+ */
+typedef struct ipsec_tun_lkup_result_t_
+{
+ u32 tun_index;
+ u32 sa_index;
+ u32 sw_if_index;
+ ipsec_protect_flags_t flags;
+ u8 __pad[3];
+} ipsec_tun_lkup_result_t;
+
+typedef struct ipsec4_tunnel_kv_t
+{