[PATCH 1/4] crypto/dpaa_sec: enhance IPsec extended sequence number

[PATCH 1/4] crypto/dpaa_sec: enhance IPsec extended sequence number

[Hemant Agrawal]

From: Gagandeep Singh <g.singh@nxp.com>

Setting ESN seq number initialization.
Initialize the sequence number of ESP to 1.

Signed-off-by: Gagandeep Singh <g.singh@nxp.com>
Signed-off-by: Barry Cao <barry.cao@nxp.com>
---
 drivers/crypto/dpaa_sec/dpaa_sec.c | 17 ++++++++++++++---
 drivers/crypto/dpaa_sec/dpaa_sec.h | 10 +++++++---
 2 files changed, 21 insertions(+), 6 deletions(-)

diff --git a/drivers/crypto/dpaa_sec/dpaa_sec.c b/drivers/crypto/dpaa_sec/dpaa_sec.c
index 225bf950e9..e6ca0e6f0e 100644
--- a/drivers/crypto/dpaa_sec/dpaa_sec.c
+++ b/drivers/crypto/dpaa_sec/dpaa_sec.c
@@ -3011,9 +3011,17 @@ dpaa_sec_set_ipsec_session(__rte_unused struct rte_cryptodev *dev,
 			PDBHMO_ESP_SNR;
 		if (ipsec_xform->options.dec_ttl)
 			session->encap_pdb.options |= PDBHMO_ESP_ENCAP_DTTL;
-		if (ipsec_xform->options.esn)
-			session->encap_pdb.options |= PDBOPTS_ESP_ESN;
 		session->encap_pdb.spi = ipsec_xform->spi;
+		/* Initializing the sequence number to 1, Security
+		 * engine will choose this sequence number for first packet
+		 * Refer: RFC4303 section: 3.3.3.Sequence Number Generation
+		 */
+		session->encap_pdb.seq_num = 1;
+		if (ipsec_xform->options.esn) {
+			session->encap_pdb.options |= PDBOPTS_ESP_ESN;
+			session->encap_pdb.seq_num_ext_hi = conf->ipsec.esn.hi;
+			session->encap_pdb.seq_num = conf->ipsec.esn.low;
+		}
 
 	} else if (ipsec_xform->direction ==
 			RTE_SECURITY_IPSEC_SA_DIR_INGRESS) {
@@ -3022,8 +3030,11 @@ dpaa_sec_set_ipsec_session(__rte_unused struct rte_cryptodev *dev,
 		else
 			session->decap_pdb.options =
 					sizeof(struct rte_ipv6_hdr) << 16;
-		if (ipsec_xform->options.esn)
+		if (ipsec_xform->options.esn) {
 			session->decap_pdb.options |= PDBOPTS_ESP_ESN;
+			session->decap_pdb.seq_num_ext_hi = conf->ipsec.esn.hi;
+			session->decap_pdb.seq_num = conf->ipsec.esn.low;
+		}
 		if (ipsec_xform->replay_win_sz) {
 			uint32_t win_sz;
 			win_sz = rte_align32pow2(ipsec_xform->replay_win_sz);
diff --git a/drivers/crypto/dpaa_sec/dpaa_sec.h b/drivers/crypto/dpaa_sec/dpaa_sec.h
index eff6dcf311..02e5307660 100644
--- a/drivers/crypto/dpaa_sec/dpaa_sec.h
+++ b/drivers/crypto/dpaa_sec/dpaa_sec.h
@@ -1,6 +1,6 @@
 /* SPDX-License-Identifier: BSD-3-Clause
  *
- *   Copyright 2016-2023 NXP
+ *   Copyright 2016-2024 NXP
  *
  */
 
@@ -989,7 +989,9 @@ static const struct rte_security_capability dpaa_sec_security_cap[] = {
 			.proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
 			.mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
 			.direction = RTE_SECURITY_IPSEC_SA_DIR_EGRESS,
-			.options = { 0 },
+			.options = {
+				.esn = 1,
+			},
 			.replay_win_sz_max = 128
 		},
 		.crypto_capabilities = dpaa_sec_capabilities
@@ -1001,7 +1003,9 @@ static const struct rte_security_capability dpaa_sec_security_cap[] = {
 			.proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
 			.mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
 			.direction = RTE_SECURITY_IPSEC_SA_DIR_INGRESS,
-			.options = { 0 },
+			.options = {
+				.esn = 1,
+			},
 			.replay_win_sz_max = 128
 		},
 		.crypto_capabilities = dpaa_sec_capabilities
-- 
2.25.1

[PATCH 2/4] crypto/dpaa_sec: enabling diffserv and ECN support

[Hemant Agrawal]

Enabling DIFFSERV and ECN in IPSEC proto offload descriptor.

Signed-off-by: Hemant Agrawal <hemant.agrawal@nxp.com>
---
 drivers/crypto/dpaa_sec/dpaa_sec.c | 14 ++++++++++++--
 drivers/crypto/dpaa_sec/dpaa_sec.h |  8 ++++++++
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/drivers/crypto/dpaa_sec/dpaa_sec.c b/drivers/crypto/dpaa_sec/dpaa_sec.c
index e6ca0e6f0e..881435fdb6 100644
--- a/drivers/crypto/dpaa_sec/dpaa_sec.c
+++ b/drivers/crypto/dpaa_sec/dpaa_sec.c
@@ -3023,18 +3023,28 @@ dpaa_sec_set_ipsec_session(__rte_unused struct rte_cryptodev *dev,
 			session->encap_pdb.seq_num = conf->ipsec.esn.low;
 		}
 
+		if (ipsec_xform->options.ecn)
+			session->encap_pdb.options |= PDBOPTS_ESP_TECN;
 	} else if (ipsec_xform->direction ==
 			RTE_SECURITY_IPSEC_SA_DIR_INGRESS) {
-		if (ipsec_xform->tunnel.type == RTE_SECURITY_IPSEC_TUNNEL_IPV4)
+		if (ipsec_xform->tunnel.type == RTE_SECURITY_IPSEC_TUNNEL_IPV4) {
 			session->decap_pdb.options = sizeof(struct ip) << 16;
-		else
+			if (ipsec_xform->options.copy_df)
+				session->decap_pdb.options |= PDBHMO_ESP_DFV;
+		} else {
 			session->decap_pdb.options =
 					sizeof(struct rte_ipv6_hdr) << 16;
+		}
 		if (ipsec_xform->options.esn) {
 			session->decap_pdb.options |= PDBOPTS_ESP_ESN;
 			session->decap_pdb.seq_num_ext_hi = conf->ipsec.esn.hi;
 			session->decap_pdb.seq_num = conf->ipsec.esn.low;
 		}
+		if (ipsec_xform->options.copy_dscp)
+			session->decap_pdb.options |= PDBHMO_ESP_DIFFSERV;
+		if (ipsec_xform->options.ecn)
+			session->decap_pdb.options |= PDBOPTS_ESP_TECN;
+
 		if (ipsec_xform->replay_win_sz) {
 			uint32_t win_sz;
 			win_sz = rte_align32pow2(ipsec_xform->replay_win_sz);
diff --git a/drivers/crypto/dpaa_sec/dpaa_sec.h b/drivers/crypto/dpaa_sec/dpaa_sec.h
index 02e5307660..603a7d8f38 100644
--- a/drivers/crypto/dpaa_sec/dpaa_sec.h
+++ b/drivers/crypto/dpaa_sec/dpaa_sec.h
@@ -990,6 +990,10 @@ static const struct rte_security_capability dpaa_sec_security_cap[] = {
 			.mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
 			.direction = RTE_SECURITY_IPSEC_SA_DIR_EGRESS,
 			.options = {
+				.copy_df = 1,
+				.copy_dscp = 1,
+				.dec_ttl = 1,
+				.ecn = 1,
 				.esn = 1,
 			},
 			.replay_win_sz_max = 128
@@ -1004,6 +1008,10 @@ static const struct rte_security_capability dpaa_sec_security_cap[] = {
 			.mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
 			.direction = RTE_SECURITY_IPSEC_SA_DIR_INGRESS,
 			.options = {
+				.copy_df = 1,
+				.copy_dscp = 1,
+				.dec_ttl = 1,
+				.ecn = 1,
 				.esn = 1,
 			},
 			.replay_win_sz_max = 128
-- 
2.25.1

[PATCH 3/4] crypto/dpaa_sec: add support for UDP-encapsulated ESP

[Hemant Agrawal]

From: Barry Cao <barry.cao@nxp.com>

This patch enables support for NAT-T traversal in IPSEC ESP
protocol offload mode.

Signed-off-by: Hemant Agrawal <hemant.agrawal@nxp.com>
Signed-off-by: Barry Cao <barry.cao@nxp.com>
---
 drivers/crypto/dpaa_sec/dpaa_sec.c | 63 ++++++++++++++++++++++++------
 drivers/crypto/dpaa_sec/dpaa_sec.h | 14 +++++++
 2 files changed, 66 insertions(+), 11 deletions(-)

diff --git a/drivers/crypto/dpaa_sec/dpaa_sec.c b/drivers/crypto/dpaa_sec/dpaa_sec.c
index 881435fdb6..3fa88ca968 100644
--- a/drivers/crypto/dpaa_sec/dpaa_sec.c
+++ b/drivers/crypto/dpaa_sec/dpaa_sec.c
@@ -20,6 +20,7 @@
 #include <dev_driver.h>
 #include <rte_io.h>
 #include <rte_ip.h>
+#include <rte_udp.h>
 #include <rte_kvargs.h>
 #include <rte_malloc.h>
 #include <rte_mbuf.h>
@@ -46,6 +47,7 @@
 #include <dpaax_iova_table.h>
 
 #define DRIVER_DUMP_MODE "drv_dump_mode"
+#define DPAA_DEFAULT_NAT_T_PORT 4500
 
 /* DPAA_SEC_DP_DUMP levels */
 enum dpaa_sec_dump_levels {
@@ -2961,15 +2963,22 @@ dpaa_sec_set_ipsec_session(__rte_unused struct rte_cryptodev *dev,
 				RTE_SECURITY_IPSEC_TUNNEL_IPV4) {
 			session->ip4_hdr.ip_v = IPVERSION;
 			session->ip4_hdr.ip_hl = 5;
-			session->ip4_hdr.ip_len = rte_cpu_to_be_16(
-						sizeof(session->ip4_hdr));
+			if (ipsec_xform->options.udp_encap)
+				session->ip4_hdr.ip_len = rte_cpu_to_be_16(
+					sizeof(session->ip4_hdr) + sizeof(struct rte_udp_hdr));
+			else
+				session->ip4_hdr.ip_len = rte_cpu_to_be_16(
+					sizeof(session->ip4_hdr));
 			session->ip4_hdr.ip_tos = ipsec_xform->tunnel.ipv4.dscp;
 			session->ip4_hdr.ip_id = 0;
 			session->ip4_hdr.ip_off = 0;
 			session->ip4_hdr.ip_ttl = ipsec_xform->tunnel.ipv4.ttl;
-			session->ip4_hdr.ip_p = (ipsec_xform->proto ==
-					RTE_SECURITY_IPSEC_SA_PROTO_ESP) ?
-					IPPROTO_ESP : IPPROTO_AH;
+			if (ipsec_xform->options.udp_encap)
+				session->ip4_hdr.ip_p = IPPROTO_UDP;
+			else
+				session->ip4_hdr.ip_p = (ipsec_xform->proto ==
+						RTE_SECURITY_IPSEC_SA_PROTO_ESP) ?
+						IPPROTO_ESP : IPPROTO_AH;
 			session->ip4_hdr.ip_sum = 0;
 			session->ip4_hdr.ip_src =
 					ipsec_xform->tunnel.ipv4.src_ip;
@@ -2993,9 +3002,12 @@ dpaa_sec_set_ipsec_session(__rte_unused struct rte_cryptodev *dev,
 			session->ip6_hdr.payload_len = 0;
 			session->ip6_hdr.hop_limits =
 					ipsec_xform->tunnel.ipv6.hlimit;
-			session->ip6_hdr.proto = (ipsec_xform->proto ==
-					RTE_SECURITY_IPSEC_SA_PROTO_ESP) ?
-					IPPROTO_ESP : IPPROTO_AH;
+			if (ipsec_xform->options.udp_encap)
+				session->ip6_hdr.proto = IPPROTO_UDP;
+			else
+				session->ip6_hdr.proto = (ipsec_xform->proto ==
+						RTE_SECURITY_IPSEC_SA_PROTO_ESP) ?
+						IPPROTO_ESP : IPPROTO_AH;
 			memcpy(&session->ip6_hdr.src_addr,
 					&ipsec_xform->tunnel.ipv6.src_addr, 16);
 			memcpy(&session->ip6_hdr.dst_addr,
@@ -3022,18 +3034,47 @@ dpaa_sec_set_ipsec_session(__rte_unused struct rte_cryptodev *dev,
 			session->encap_pdb.seq_num_ext_hi = conf->ipsec.esn.hi;
 			session->encap_pdb.seq_num = conf->ipsec.esn.low;
 		}
+		if (ipsec_xform->options.udp_encap) {
+			struct rte_udp_hdr *udp_hdr;
+
+			if (ipsec_xform->tunnel.type == RTE_SECURITY_IPSEC_TUNNEL_IPV4)
+				udp_hdr = (struct rte_udp_hdr *)(&session->udp4.udp_hdr);
+			else
+				udp_hdr = (struct rte_udp_hdr *)(&session->udp6.udp_hdr);
+
+			if (ipsec_xform->udp.sport)
+				udp_hdr->src_port = rte_cpu_to_be_16(ipsec_xform->udp.sport);
+			else
+				udp_hdr->src_port = rte_cpu_to_be_16(DPAA_DEFAULT_NAT_T_PORT);
+
+			if (ipsec_xform->udp.dport)
+				udp_hdr->dst_port = rte_cpu_to_be_16(ipsec_xform->udp.dport);
+			else
+				udp_hdr->dst_port = rte_cpu_to_be_16(DPAA_DEFAULT_NAT_T_PORT);
+			udp_hdr->dgram_len = 0;
+			udp_hdr->dgram_cksum = 0;
 
+			session->encap_pdb.ip_hdr_len += sizeof(struct rte_udp_hdr);
+			session->encap_pdb.options |= PDBOPTS_ESP_NAT | PDBOPTS_ESP_NUC;
+		}
 		if (ipsec_xform->options.ecn)
 			session->encap_pdb.options |= PDBOPTS_ESP_TECN;
 	} else if (ipsec_xform->direction ==
 			RTE_SECURITY_IPSEC_SA_DIR_INGRESS) {
 		if (ipsec_xform->tunnel.type == RTE_SECURITY_IPSEC_TUNNEL_IPV4) {
-			session->decap_pdb.options = sizeof(struct ip) << 16;
+			if (ipsec_xform->options.udp_encap)
+				session->decap_pdb.options =
+					(sizeof(struct ip) + sizeof(struct rte_udp_hdr)) << 16;
+			else
+				session->decap_pdb.options = sizeof(struct ip) << 16;
 			if (ipsec_xform->options.copy_df)
 				session->decap_pdb.options |= PDBHMO_ESP_DFV;
 		} else {
-			session->decap_pdb.options =
-					sizeof(struct rte_ipv6_hdr) << 16;
+			if (ipsec_xform->options.udp_encap)
+				session->decap_pdb.options =
+				(sizeof(struct rte_ipv6_hdr) + sizeof(struct rte_udp_hdr)) << 16;
+			else
+				session->decap_pdb.options = sizeof(struct rte_ipv6_hdr) << 16;
 		}
 		if (ipsec_xform->options.esn) {
 			session->decap_pdb.options |= PDBOPTS_ESP_ESN;
diff --git a/drivers/crypto/dpaa_sec/dpaa_sec.h b/drivers/crypto/dpaa_sec/dpaa_sec.h
index 603a7d8f38..64d9e22159 100644
--- a/drivers/crypto/dpaa_sec/dpaa_sec.h
+++ b/drivers/crypto/dpaa_sec/dpaa_sec.h
@@ -143,6 +143,16 @@ typedef struct dpaa_sec_job* (*dpaa_sec_build_raw_dp_fd_t)(uint8_t *drv_ctx,
 			void *userdata,
 			struct qm_fd *fd);
 
+struct dpaa_ipv4_udp {
+	struct ip ip4_hdr;
+	struct rte_udp_hdr udp_hdr;
+};
+
+struct dpaa_ipv6_udp {
+	struct rte_ipv6_hdr ip6_hdr;
+	struct rte_udp_hdr udp_hdr;
+};
+
 typedef struct dpaa_sec_session_entry {
 	struct sec_cdb cdb;	/**< cmd block associated with qp */
 	struct dpaa_sec_qp *qp[MAX_DPAA_CORES];
@@ -191,6 +201,8 @@ typedef struct dpaa_sec_session_entry {
 			union {
 				struct ip ip4_hdr;
 				struct rte_ipv6_hdr ip6_hdr;
+				struct dpaa_ipv4_udp udp4;
+				struct dpaa_ipv6_udp udp6;
 			};
 			uint8_t auth_cipher_text;
 				/**< Authenticate/cipher ordering */
@@ -995,6 +1007,7 @@ static const struct rte_security_capability dpaa_sec_security_cap[] = {
 				.dec_ttl = 1,
 				.ecn = 1,
 				.esn = 1,
+				.udp_encap = 1,
 			},
 			.replay_win_sz_max = 128
 		},
@@ -1013,6 +1026,7 @@ static const struct rte_security_capability dpaa_sec_security_cap[] = {
 				.dec_ttl = 1,
 				.ecn = 1,
 				.esn = 1,
+				.udp_encap = 1,
 			},
 			.replay_win_sz_max = 128
 		},
-- 
2.25.1

[PATCH 4/4] crypto/dpaa2_sec: add support for IPv6 UDP encap

[Hemant Agrawal]

This patch enables support for NAT-T traversal in IPSEC ESP
protocol offload mode for IPv6

Signed-off-by: Hemant Agrawal <hemant.agrawal@nxp.com>
---
 drivers/crypto/dpaa2_sec/dpaa2_sec_dpseci.c | 68 +++++++++++++--------
 1 file changed, 43 insertions(+), 25 deletions(-)

diff --git a/drivers/crypto/dpaa2_sec/dpaa2_sec_dpseci.c b/drivers/crypto/dpaa2_sec/dpaa2_sec_dpseci.c
index b34183d594..3814f954ce 100644
--- a/drivers/crypto/dpaa2_sec/dpaa2_sec_dpseci.c
+++ b/drivers/crypto/dpaa2_sec/dpaa2_sec_dpseci.c
@@ -50,6 +50,7 @@
 #define FSL_SUBSYSTEM_SEC       1
 #define FSL_MC_DPSECI_DEVID     3
 
+#define DPAA2_DEFAULT_NAT_T_PORT 4500
 #define NO_PREFETCH 0
 
 #define DRIVER_DUMP_MODE "drv_dump_mode"
@@ -3164,6 +3165,7 @@ dpaa2_sec_set_ipsec_session(struct rte_cryptodev *dev,
 		uint8_t hdr[48] = {};
 		struct rte_ipv4_hdr *ip4_hdr;
 		struct rte_ipv6_hdr *ip6_hdr;
+		struct rte_udp_hdr *uh = NULL;
 		struct ipsec_encap_pdb encap_pdb;
 
 		flc->dhr = SEC_FLC_DHR_OUTBOUND;
@@ -3235,29 +3237,10 @@ dpaa2_sec_set_ipsec_session(struct rte_cryptodev *dev,
 			memcpy(&ip4_hdr->dst_addr, &ipsec_xform->tunnel.ipv4.dst_ip,
 			       sizeof(struct in_addr));
 			if (ipsec_xform->options.udp_encap) {
-				uint16_t sport, dport;
-				struct rte_udp_hdr *uh =
-					(struct rte_udp_hdr *) (hdr +
-						sizeof(struct rte_ipv4_hdr));
-
-				sport = ipsec_xform->udp.sport ?
-					ipsec_xform->udp.sport : 4500;
-				dport = ipsec_xform->udp.dport ?
-					ipsec_xform->udp.dport : 4500;
-				uh->src_port = rte_cpu_to_be_16(sport);
-				uh->dst_port = rte_cpu_to_be_16(dport);
-				uh->dgram_len = 0;
-				uh->dgram_cksum = 0;
-
 				ip4_hdr->next_proto_id = IPPROTO_UDP;
-				ip4_hdr->total_length =
-					rte_cpu_to_be_16(
+				ip4_hdr->total_length = rte_cpu_to_be_16(
 						sizeof(struct rte_ipv4_hdr) +
 						sizeof(struct rte_udp_hdr));
-				encap_pdb.ip_hdr_len +=
-					sizeof(struct rte_udp_hdr);
-				encap_pdb.options |=
-					PDBOPTS_ESP_NAT | PDBOPTS_ESP_NUC;
 			} else {
 				ip4_hdr->total_length =
 					rte_cpu_to_be_16(
@@ -3284,14 +3267,39 @@ dpaa2_sec_set_ipsec_session(struct rte_cryptodev *dev,
 			ip6_hdr->payload_len = 0;
 			ip6_hdr->hop_limits = ipsec_xform->tunnel.ipv6.hlimit ?
 					ipsec_xform->tunnel.ipv6.hlimit : 0x40;
-			ip6_hdr->proto = (ipsec_xform->proto ==
-					RTE_SECURITY_IPSEC_SA_PROTO_ESP) ?
-					IPPROTO_ESP : IPPROTO_AH;
 			memcpy(&ip6_hdr->src_addr,
 				&ipsec_xform->tunnel.ipv6.src_addr, 16);
 			memcpy(&ip6_hdr->dst_addr,
 				&ipsec_xform->tunnel.ipv6.dst_addr, 16);
 			encap_pdb.ip_hdr_len = sizeof(struct rte_ipv6_hdr);
+			if (ipsec_xform->options.udp_encap)
+				ip6_hdr->proto = IPPROTO_UDP;
+			else
+				ip6_hdr->proto = (ipsec_xform->proto ==
+					RTE_SECURITY_IPSEC_SA_PROTO_ESP) ?
+					IPPROTO_ESP : IPPROTO_AH;
+		}
+		if (ipsec_xform->options.udp_encap) {
+			uint16_t sport, dport;
+
+			if (ipsec_xform->tunnel.type == RTE_SECURITY_IPSEC_TUNNEL_IPV4)
+				uh = (struct rte_udp_hdr *) (hdr +
+						sizeof(struct rte_ipv4_hdr));
+			else
+				uh = (struct rte_udp_hdr *) (hdr +
+						sizeof(struct rte_ipv6_hdr));
+
+			sport = ipsec_xform->udp.sport ?
+				ipsec_xform->udp.sport : DPAA2_DEFAULT_NAT_T_PORT;
+			dport = ipsec_xform->udp.dport ?
+				ipsec_xform->udp.dport : DPAA2_DEFAULT_NAT_T_PORT;
+			uh->src_port = rte_cpu_to_be_16(sport);
+			uh->dst_port = rte_cpu_to_be_16(dport);
+			uh->dgram_len = 0;
+			uh->dgram_cksum = 0;
+
+			encap_pdb.ip_hdr_len += sizeof(struct rte_udp_hdr);
+			encap_pdb.options |= PDBOPTS_ESP_NAT | PDBOPTS_ESP_NUC;
 		}
 
 		bufsize = cnstr_shdsc_ipsec_new_encap(priv->flc_desc[0].desc,
@@ -3320,13 +3328,23 @@ dpaa2_sec_set_ipsec_session(struct rte_cryptodev *dev,
 
 		if (ipsec_xform->tunnel.type ==
 				RTE_SECURITY_IPSEC_TUNNEL_IPV4) {
-			decap_pdb.options = sizeof(struct ip) << 16;
+			if (ipsec_xform->options.udp_encap)
+				decap_pdb.options =
+					(sizeof(struct ip) + sizeof(struct rte_udp_hdr)) << 16;
+			else
+				decap_pdb.options = sizeof(struct ip) << 16;
 			if (ipsec_xform->options.copy_df)
 				decap_pdb.options |= PDBHMO_ESP_DFV;
 			if (ipsec_xform->options.dec_ttl)
 				decap_pdb.options |= PDBHMO_ESP_DECAP_DTTL;
 		} else {
-			decap_pdb.options = sizeof(struct rte_ipv6_hdr) << 16;
+			if (ipsec_xform->options.udp_encap) {
+				decap_pdb.options =
+					(sizeof(struct rte_ipv6_hdr) +
+					 sizeof(struct rte_udp_hdr)) << 16;
+			} else {
+				decap_pdb.options = sizeof(struct rte_ipv6_hdr) << 16;
+			}
 		}
 		if (ipsec_xform->options.esn) {
 			decap_pdb.options |= PDBOPTS_ESP_ESN;
-- 
2.25.1