diff --git a/src/vnet/CMakeLists.txt b/src/vnet/CMakeLists.txt
index 16d5cac..eb96699 100644
--- a/src/vnet/CMakeLists.txt
+++ b/src/vnet/CMakeLists.txt
@@ -762,6 +762,7 @@
 
 list(APPEND VNET_HEADERS
   tunnel/tunnel.h
+  tunnel/tunnel_dp.h
 )
 
 ##############################################################################
diff --git a/src/vnet/gre/gre.api b/src/vnet/gre/gre.api
index 0a98178..fb78b47 100644
--- a/src/vnet/gre/gre.api
+++ b/src/vnet/gre/gre.api
@@ -34,6 +34,8 @@
     @param context - sender context, to match reply w/ request
     @param tunnel_type - 0: L3, 1: TEB, 2: ERSPAN
     @param instance - optional unique custom device instance, else ~0.
+    @param mode - P2P or P2MP
+    @param flags - to control encap/decap behaviour
     @param src - Source IP address
     @param dst - Destination IP address, can be multicast
     @param outer_table_id - Encap FIB table ID
@@ -44,6 +46,7 @@
 {
   vl_api_gre_tunnel_type_t type;
   vl_api_tunnel_mode_t mode;
+  vl_api_tunnel_encap_decap_flags_t flags;
   u16 session_id;
   u32 instance;
   u32 outer_table_id;
diff --git a/src/vnet/gre/gre.c b/src/vnet/gre/gre.c
index 2b95d99..f1bc694 100644
--- a/src/vnet/gre/gre.c
+++ b/src/vnet/gre/gre.c
@@ -18,6 +18,7 @@
 #include <vnet/vnet.h>
 #include <vnet/gre/gre.h>
 #include <vnet/adj/adj_midchain.h>
+#include <vnet/tunnel/tunnel_dp.h>
 
 extern gre_main_t gre_main;
 
@@ -274,11 +275,45 @@
   return (rewrite);
 }
 
-#define is_v4_packet(_h) ((*(u8*) _h) & 0xF0) == 0x40
+static void
+gre44_fixup (vlib_main_t * vm,
+	     const ip_adjacency_t * adj, vlib_buffer_t * b0, const void *data)
+{
+  tunnel_encap_decap_flags_t flags;
+  ip4_and_gre_header_t *ip0;
+
+  ip0 = vlib_buffer_get_current (b0);
+  flags = pointer_to_uword (data);
+
+  /* Fixup the checksum and len fields in the GRE tunnel encap
+   * that was applied at the midchain node */
+  ip0->ip4.length =
+    clib_host_to_net_u16 (vlib_buffer_length_in_chain (vm, b0));
+  tunnel_encap_fixup_4o4 (flags, (ip4_header_t *) (ip0 + 1), &ip0->ip4);
+  ip0->ip4.checksum = ip4_header_checksum (&ip0->ip4);
+}
 
 static void
-gre4_fixup (vlib_main_t * vm,
-	    const ip_adjacency_t * adj, vlib_buffer_t * b0, const void *data)
+gre64_fixup (vlib_main_t * vm,
+	     const ip_adjacency_t * adj, vlib_buffer_t * b0, const void *data)
+{
+  tunnel_encap_decap_flags_t flags;
+  ip4_and_gre_header_t *ip0;
+
+  ip0 = vlib_buffer_get_current (b0);
+  flags = pointer_to_uword (data);
+
+  /* Fixup the checksum and len fields in the GRE tunnel encap
+   * that was applied at the midchain node */
+  ip0->ip4.length =
+    clib_host_to_net_u16 (vlib_buffer_length_in_chain (vm, b0));
+  tunnel_encap_fixup_6o4 (flags, (ip6_header_t *) (ip0 + 1), &ip0->ip4);
+  ip0->ip4.checksum = ip4_header_checksum (&ip0->ip4);
+}
+
+static void
+grex4_fixup (vlib_main_t * vm,
+	     const ip_adjacency_t * adj, vlib_buffer_t * b0, const void *data)
 {
   ip4_header_t *ip0;
 
@@ -291,8 +326,44 @@
 }
 
 static void
-gre6_fixup (vlib_main_t * vm,
-	    const ip_adjacency_t * adj, vlib_buffer_t * b0, const void *data)
+gre46_fixup (vlib_main_t * vm,
+	     const ip_adjacency_t * adj, vlib_buffer_t * b0, const void *data)
+{
+  tunnel_encap_decap_flags_t flags;
+  ip6_and_gre_header_t *ip0;
+
+  ip0 = vlib_buffer_get_current (b0);
+  flags = pointer_to_uword (data);
+
+  /* Fixup the payload length field in the GRE tunnel encap that was applied
+   * at the midchain node */
+  ip0->ip6.payload_length =
+    clib_host_to_net_u16 (vlib_buffer_length_in_chain (vm, b0) -
+			  sizeof (*ip0));
+  tunnel_encap_fixup_4o6 (flags, (ip4_header_t *) (ip0 + 1), &ip0->ip6);
+}
+
+static void
+gre66_fixup (vlib_main_t * vm,
+	     const ip_adjacency_t * adj, vlib_buffer_t * b0, const void *data)
+{
+  tunnel_encap_decap_flags_t flags;
+  ip6_and_gre_header_t *ip0;
+
+  ip0 = vlib_buffer_get_current (b0);
+  flags = pointer_to_uword (data);
+
+  /* Fixup the payload length field in the GRE tunnel encap that was applied
+   * at the midchain node */
+  ip0->ip6.payload_length =
+    clib_host_to_net_u16 (vlib_buffer_length_in_chain (vm, b0) -
+			  sizeof (*ip0));
+  tunnel_encap_fixup_6o6 (flags, (ip6_header_t *) (ip0 + 1), &ip0->ip6);
+}
+
+static void
+grex6_fixup (vlib_main_t * vm,
+	     const ip_adjacency_t * adj, vlib_buffer_t * b0, const void *data)
 {
   ip6_header_t *ip0;
 
@@ -305,25 +376,49 @@
 			  sizeof (*ip0));
 }
 
+/**
+ * return the appropriate fixup function given the overlay (link-type) and
+ * underlay (fproto) combination
+ */
+static adj_midchain_fixup_t
+gre_get_fixup (fib_protocol_t fproto, vnet_link_t lt)
+{
+  if (fproto == FIB_PROTOCOL_IP6 && lt == VNET_LINK_IP6)
+    return (gre66_fixup);
+  if (fproto == FIB_PROTOCOL_IP6 && lt == VNET_LINK_IP4)
+    return (gre46_fixup);
+  if (fproto == FIB_PROTOCOL_IP4 && lt == VNET_LINK_IP6)
+    return (gre64_fixup);
+  if (fproto == FIB_PROTOCOL_IP4 && lt == VNET_LINK_IP4)
+    return (gre44_fixup);
+  if (fproto == FIB_PROTOCOL_IP6 && lt == VNET_LINK_ETHERNET)
+    return (grex6_fixup);
+  if (fproto == FIB_PROTOCOL_IP4 && lt == VNET_LINK_ETHERNET)
+    return (grex4_fixup);
+
+  ASSERT (0);
+  return (gre44_fixup);
+}
+
 void
 gre_update_adj (vnet_main_t * vnm, u32 sw_if_index, adj_index_t ai)
 {
   gre_main_t *gm = &gre_main;
   gre_tunnel_t *t;
   adj_flags_t af;
-  u8 is_ipv6;
   u32 ti;
 
   ti = gm->tunnel_index_by_sw_if_index[sw_if_index];
   t = pool_elt_at_index (gm->tunnels, ti);
-  is_ipv6 = t->tunnel_dst.fp_proto == FIB_PROTOCOL_IP6 ? 1 : 0;
   af = ADJ_FLAG_MIDCHAIN_IP_STACK;
 
   if (VNET_LINK_ETHERNET == adj_get_link_type (ai))
     af |= ADJ_FLAG_MIDCHAIN_NO_COUNT;
 
   adj_nbr_midchain_update_rewrite
-    (ai, !is_ipv6 ? gre4_fixup : gre6_fixup, NULL, af,
+    (ai, gre_get_fixup (t->tunnel_dst.fp_proto,
+			adj_get_link_type (ai)),
+     uword_to_pointer (t->flags, void *), af,
      gre_build_rewrite (vnm, sw_if_index, adj_get_link_type (ai),
 			&t->tunnel_dst.fp_addr));
 
@@ -334,13 +429,12 @@
 mgre_mk_complete_walk (adj_index_t ai, void *data)
 {
   mgre_walk_ctx_t *ctx = data;
-  adj_midchain_fixup_t f;
-
-  f = (ctx->t->tunnel_dst.fp_proto == FIB_PROTOCOL_IP4 ?
-       gre4_fixup : gre6_fixup);
 
   adj_nbr_midchain_update_rewrite
-    (ai, f, NULL, ADJ_FLAG_MIDCHAIN_IP_STACK,
+    (ai, gre_get_fixup (ctx->t->tunnel_dst.fp_proto,
+			adj_get_link_type (ai)),
+     uword_to_pointer (ctx->t->flags, void *),
+     ADJ_FLAG_MIDCHAIN_IP_STACK,
      gre_build_rewrite (vnet_get_main (),
 			ctx->t->sw_if_index,
 			adj_get_link_type (ai),
@@ -355,11 +449,10 @@
 mgre_mk_incomplete_walk (adj_index_t ai, void *data)
 {
   gre_tunnel_t *t = data;
-  adj_midchain_fixup_t f;
 
-  f = (t->tunnel_dst.fp_proto == FIB_PROTOCOL_IP4 ? gre4_fixup : gre6_fixup);
-
-  adj_nbr_midchain_update_rewrite (ai, f, NULL, ADJ_FLAG_NONE, NULL);
+  adj_nbr_midchain_update_rewrite (ai, gre_get_fixup (t->tunnel_dst.fp_proto,
+						      adj_get_link_type (ai)),
+				   NULL, ADJ_FLAG_NONE, NULL);
 
   adj_midchain_delegate_unstack (ai);
 
diff --git a/src/vnet/gre/gre.h b/src/vnet/gre/gre.h
index 70f6241..0cc60b8 100644
--- a/src/vnet/gre/gre.h
+++ b/src/vnet/gre/gre.h
@@ -206,6 +206,7 @@
   u32 sw_if_index;
   gre_tunnel_type_t type;
   tunnel_mode_t mode;
+  tunnel_encap_decap_flags_t flags;
 
   /**
    * an L2 tunnel always rquires an L2 midchain. cache here for DP.
@@ -368,6 +369,7 @@
   ip46_address_t src, dst;
   u32 outer_table_id;
   u16 session_id;
+  tunnel_encap_decap_flags_t flags;
 } vnet_gre_tunnel_add_del_args_t;
 
 extern int vnet_gre_tunnel_add_del (vnet_gre_tunnel_add_del_args_t * a,
diff --git a/src/vnet/gre/gre_api.c b/src/vnet/gre/gre_api.c
index 619b5fc..934fc66 100644
--- a/src/vnet/gre/gre_api.c
+++ b/src/vnet/gre/gre_api.c
@@ -89,6 +89,7 @@
 {
   vnet_gre_tunnel_add_del_args_t _a = { }, *a = &_a;
   vl_api_gre_tunnel_add_del_reply_t *rmp;
+  tunnel_encap_decap_flags_t flags;
   u32 sw_if_index = ~0;
   ip46_type_t itype[2];
   int rv = 0;
@@ -118,11 +119,17 @@
   if (rv)
     goto out;
 
+  rv = tunnel_encap_decap_flags_decode (mp->tunnel.flags, &flags);
+
+  if (rv)
+    goto out;
+
   a->is_add = mp->is_add;
   a->is_ipv6 = (itype[0] == IP46_TYPE_IP6);
   a->instance = ntohl (mp->tunnel.instance);
   a->session_id = ntohs (mp->tunnel.session_id);
   a->outer_table_id = ntohl (mp->tunnel.outer_table_id);
+  a->flags = flags;
 
   rv = vnet_gre_tunnel_add_del (a, &sw_if_index);
 
diff --git a/src/vnet/gre/interface.c b/src/vnet/gre/interface.c
index 178b080..553c89a 100644
--- a/src/vnet/gre/interface.c
+++ b/src/vnet/gre/interface.c
@@ -346,6 +346,7 @@
 
   t->type = a->type;
   t->mode = a->mode;
+  t->flags = a->flags;
   if (t->type == GRE_TUNNEL_TYPE_ERSPAN)
     t->session_id = a->session_id;
 
diff --git a/src/vnet/ip/ip4_packet.h b/src/vnet/ip/ip4_packet.h
index 1d3607e..3872ccd 100644
--- a/src/vnet/ip/ip4_packet.h
+++ b/src/vnet/ip/ip4_packet.h
@@ -322,7 +322,7 @@
 }
 
 always_inline u8
-ip4_header_get_df (ip4_header_t * ip4)
+ip4_header_get_df (const ip4_header_t * ip4)
 {
   return (! !(ip4->flags_and_fragment_offset &
 	      clib_host_to_net_u16 (IP4_HEADER_FLAG_DONT_FRAGMENT)));
diff --git a/src/vnet/ipip/ipip.c b/src/vnet/ipip/ipip.c
index aa8d8da..c94e91d 100644
--- a/src/vnet/ipip/ipip.c
+++ b/src/vnet/ipip/ipip.c
@@ -26,6 +26,7 @@
 #include <vnet/ip/format.h>
 #include <vnet/ipip/ipip.h>
 #include <vnet/nhrp/nhrp.h>
+#include <vnet/tunnel/tunnel_dp.h>
 
 ipip_main_t ipip_main;
 
@@ -84,6 +85,18 @@
       if (t->flags & TUNNEL_ENCAP_DECAP_FLAG_ENCAP_SET_DF)
 	ip4_header_set_df (ip4);
       ip4->checksum = ip4_header_checksum (ip4);
+
+      switch (link_type)
+	{
+	case VNET_LINK_IP6:
+	  ip4->protocol = IP_PROTOCOL_IPV6;
+	  break;
+	case VNET_LINK_IP4:
+	  ip4->protocol = IP_PROTOCOL_IP_IN_IP;
+	  break;
+	default:
+	  break;
+	}
       break;
 
     case IPIP_TRANSPORT_IP6:
@@ -99,14 +112,26 @@
       ip6->dst_address.as_u64[1] = dst->ip6.as_u64[1];
       if (!(t->flags & TUNNEL_ENCAP_DECAP_FLAG_ENCAP_COPY_DSCP))
 	ip6_set_dscp_network_order (ip6, t->dscp);
+
+      switch (link_type)
+	{
+	case VNET_LINK_IP6:
+	  ip6->protocol = IP_PROTOCOL_IPV6;
+	  break;
+	case VNET_LINK_IP4:
+	  ip6->protocol = IP_PROTOCOL_IP_IN_IP;
+	  break;
+	default:
+	  break;
+	}
       break;
     }
   return (rewrite);
 }
 
 static void
-ipip4_fixup (vlib_main_t * vm, const ip_adjacency_t * adj, vlib_buffer_t * b,
-	     const void *data)
+ipip64_fixup (vlib_main_t * vm, const ip_adjacency_t * adj, vlib_buffer_t * b,
+	      const void *data)
 {
   tunnel_encap_decap_flags_t flags;
   ip4_header_t *ip4;
@@ -115,41 +140,30 @@
 
   ip4 = vlib_buffer_get_current (b);
   ip4->length = clib_host_to_net_u16 (vlib_buffer_length_in_chain (vm, b));
-  switch (adj->ia_link)
-    {
-    case VNET_LINK_IP6:
-      ip4->protocol = IP_PROTOCOL_IPV6;
-      if (flags & TUNNEL_ENCAP_DECAP_FLAG_ENCAP_COPY_DSCP)
-	ip4_header_set_dscp (ip4,
-			     ip6_dscp_network_order ((ip6_header_t *) (ip4 +
-								       1)));
-      if (flags & TUNNEL_ENCAP_DECAP_FLAG_ENCAP_COPY_ECN)
-	ip4_header_set_ecn (ip4,
-			    ip6_ecn_network_order ((ip6_header_t *) (ip4 +
-								     1)));
-      break;
-
-    case VNET_LINK_IP4:
-      ip4->protocol = IP_PROTOCOL_IP_IN_IP;
-      if (flags & TUNNEL_ENCAP_DECAP_FLAG_ENCAP_COPY_DSCP)
-	ip4_header_set_dscp (ip4, ip4_header_get_dscp (ip4 + 1));
-      if (flags & TUNNEL_ENCAP_DECAP_FLAG_ENCAP_COPY_ECN)
-	ip4_header_set_ecn (ip4, ip4_header_get_ecn (ip4 + 1));
-      if ((flags & TUNNEL_ENCAP_DECAP_FLAG_ENCAP_COPY_DF) &&
-	  ip4_header_get_df (ip4 + 1))
-	ip4_header_set_df (ip4);
-      break;
-
-    default:
-      break;
-    }
+  tunnel_encap_fixup_6o4 (flags, ((ip6_header_t *) (ip4 + 1)), ip4);
 
   ip4->checksum = ip4_header_checksum (ip4);
 }
 
 static void
-ipip6_fixup (vlib_main_t * vm, const ip_adjacency_t * adj, vlib_buffer_t * b,
-	     const void *data)
+ipip44_fixup (vlib_main_t * vm, const ip_adjacency_t * adj, vlib_buffer_t * b,
+	      const void *data)
+{
+  tunnel_encap_decap_flags_t flags;
+  ip4_header_t *ip4;
+
+  flags = pointer_to_uword (data);
+
+  ip4 = vlib_buffer_get_current (b);
+  ip4->length = clib_host_to_net_u16 (vlib_buffer_length_in_chain (vm, b));
+  tunnel_encap_fixup_4o4 (flags, ip4 + 1, ip4);
+
+  ip4->checksum = ip4_header_checksum (ip4);
+}
+
+static void
+ipip46_fixup (vlib_main_t * vm, const ip_adjacency_t * adj, vlib_buffer_t * b,
+	      const void *data)
 {
   tunnel_encap_decap_flags_t flags;
   ip6_header_t *ip6;
@@ -164,29 +178,27 @@
   ip6->payload_length =
     clib_host_to_net_u16 (vlib_buffer_length_in_chain (vm, b) -
 			  sizeof (*ip6));
-  switch (adj->ia_link)
-    {
-    case VNET_LINK_IP6:
-      ip6->protocol = IP_PROTOCOL_IPV6;
-      if (flags & TUNNEL_ENCAP_DECAP_FLAG_ENCAP_COPY_DSCP)
-	ip6_set_dscp_network_order (ip6, ip6_dscp_network_order (ip6 + 1));
-      if (flags & TUNNEL_ENCAP_DECAP_FLAG_ENCAP_COPY_ECN)
-	ip6_set_ecn_network_order (ip6, ip6_ecn_network_order (ip6 + 1));
-      break;
+  tunnel_encap_fixup_4o6 (flags, ((ip4_header_t *) (ip6 + 1)), ip6);
+}
 
-    case VNET_LINK_IP4:
-      ip6->protocol = IP_PROTOCOL_IP_IN_IP;
-      if (flags & TUNNEL_ENCAP_DECAP_FLAG_ENCAP_COPY_DSCP)
-	ip6_set_dscp_network_order
-	  (ip6, ip4_header_get_dscp ((ip4_header_t *) (ip6 + 1)));
-      if (flags & TUNNEL_ENCAP_DECAP_FLAG_ENCAP_COPY_ECN)
-	ip6_set_ecn_network_order
-	  (ip6, ip4_header_get_ecn ((ip4_header_t *) (ip6 + 1)));
-      break;
+static void
+ipip66_fixup (vlib_main_t * vm,
+	      const ip_adjacency_t * adj, vlib_buffer_t * b, const void *data)
+{
+  tunnel_encap_decap_flags_t flags;
+  ip6_header_t *ip6;
 
-    default:
-      break;
-    }
+  flags = pointer_to_uword (data);
+
+  /* Must set locally originated otherwise we're not allowed to
+     fragment the packet later */
+  b->flags |= VNET_BUFFER_F_LOCALLY_ORIGINATED;
+
+  ip6 = vlib_buffer_get_current (b);
+  ip6->payload_length =
+    clib_host_to_net_u16 (vlib_buffer_length_in_chain (vm, b) -
+			  sizeof (*ip6));
+  tunnel_encap_fixup_6o6 (flags, ip6 + 1, ip6);
 }
 
 static void
@@ -246,10 +258,25 @@
   }
 }
 
+static adj_midchain_fixup_t
+ipip_get_fixup (const ipip_tunnel_t * t, vnet_link_t lt)
+{
+  if (t->transport == IPIP_TRANSPORT_IP6 && lt == VNET_LINK_IP6)
+    return (ipip66_fixup);
+  if (t->transport == IPIP_TRANSPORT_IP6 && lt == VNET_LINK_IP4)
+    return (ipip46_fixup);
+  if (t->transport == IPIP_TRANSPORT_IP4 && lt == VNET_LINK_IP6)
+    return (ipip64_fixup);
+  if (t->transport == IPIP_TRANSPORT_IP4 && lt == VNET_LINK_IP4)
+    return (ipip44_fixup);
+
+  ASSERT (0);
+  return (ipip44_fixup);
+}
+
 void
 ipip_update_adj (vnet_main_t * vnm, u32 sw_if_index, adj_index_t ai)
 {
-  adj_midchain_fixup_t f;
   ipip_tunnel_t *t;
   adj_flags_t af;
 
@@ -257,13 +284,13 @@
   if (!t)
     return;
 
-  f = t->transport == IPIP_TRANSPORT_IP6 ? ipip6_fixup : ipip4_fixup;
   af = ADJ_FLAG_MIDCHAIN_IP_STACK;
   if (VNET_LINK_ETHERNET == adj_get_link_type (ai))
     af |= ADJ_FLAG_MIDCHAIN_NO_COUNT;
 
   adj_nbr_midchain_update_rewrite
-    (ai, f, uword_to_pointer (t->flags, void *), af,
+    (ai, ipip_get_fixup (t, adj_get_link_type (ai)),
+     uword_to_pointer (t->flags, void *), af,
      ipip_build_rewrite (vnm, sw_if_index,
 			 adj_get_link_type (ai), &t->tunnel_dst));
   ipip_tunnel_stack (ai);
@@ -279,12 +306,10 @@
 mipip_mk_complete_walk (adj_index_t ai, void *data)
 {
   mipip_walk_ctx_t *ctx = data;
-  adj_midchain_fixup_t f;
-
-  f = ctx->t->transport == IPIP_TRANSPORT_IP6 ? ipip6_fixup : ipip4_fixup;
 
   adj_nbr_midchain_update_rewrite
-    (ai, f, uword_to_pointer (ctx->t->flags, void *),
+    (ai, ipip_get_fixup (ctx->t, adj_get_link_type (ai)),
+     uword_to_pointer (ctx->t->flags, void *),
      ADJ_FLAG_MIDCHAIN_IP_STACK, ipip_build_rewrite (vnet_get_main (),
 						     ctx->t->sw_if_index,
 						     adj_get_link_type (ai),
@@ -300,11 +325,10 @@
 mipip_mk_incomplete_walk (adj_index_t ai, void *data)
 {
   ipip_tunnel_t *t = data;
-  adj_midchain_fixup_t f;
 
-  f = t->transport == IPIP_TRANSPORT_IP6 ? ipip6_fixup : ipip4_fixup;
-
-  adj_nbr_midchain_update_rewrite (ai, f, NULL, ADJ_FLAG_NONE, NULL);
+  adj_nbr_midchain_update_rewrite
+    (ai, ipip_get_fixup (t, adj_get_link_type (ai)),
+     NULL, ADJ_FLAG_NONE, NULL);
 
   adj_midchain_delegate_unstack (ai);
 
@@ -315,7 +339,6 @@
 mipip_update_adj (vnet_main_t * vnm, u32 sw_if_index, adj_index_t ai)
 {
   ipip_main_t *gm = &ipip_main;
-  adj_midchain_fixup_t f;
   ip_adjacency_t *adj;
   nhrp_entry_t *ne;
   ipip_tunnel_t *t;
@@ -324,7 +347,6 @@
   adj = adj_get (ai);
   ti = gm->tunnel_index_by_sw_if_index[sw_if_index];
   t = pool_elt_at_index (gm->tunnels, ti);
-  f = t->transport == IPIP_TRANSPORT_IP6 ? ipip6_fixup : ipip4_fixup;
 
   ne = nhrp_entry_find (sw_if_index, &adj->sub_type.nbr.next_hop);
 
@@ -332,7 +354,8 @@
     {
       // no NHRP entry to provide the next-hop
       adj_nbr_midchain_update_rewrite
-	(ai, f, uword_to_pointer (t->flags, void *), ADJ_FLAG_NONE, NULL);
+	(ai, ipip_get_fixup (t, adj_get_link_type (ai)),
+	 uword_to_pointer (t->flags, void *), ADJ_FLAG_NONE, NULL);
       return;
     }
 
diff --git a/src/vnet/ipip/node.c b/src/vnet/ipip/node.c
index 0f47f26..baaeee8 100644
--- a/src/vnet/ipip/node.c
+++ b/src/vnet/ipip/node.c
@@ -19,7 +19,7 @@
 #include <vnet/ipip/ipip.h>
 #include <vnet/ip/ip6_packet.h>
 #include <vnet/mpls/mpls.h>
-#include <vnet/pg/pg.h>
+#include <vnet/tunnel/tunnel_dp.h>
 #include <vppinfra/sparse_vec.h>
 
 #define foreach_ipip_input_next                                                \
@@ -159,29 +159,21 @@
 	    {
 	      next0 = IPIP_INPUT_NEXT_IP6_INPUT;
 
-	      if (t0->flags & TUNNEL_ENCAP_DECAP_FLAG_DECAP_COPY_ECN)
-		{
-		  if (is_ipv6)
-		    ip6_set_ecn_network_order ((ip60 + 1),
-					       ip6_ecn_network_order (ip60));
-		  else
-		    ip6_set_ecn_network_order ((ip6_header_t *) (ip40 + 1),
-					       ip4_header_get_ecn (ip40));
-		}
+	      if (is_ipv6)
+		tunnel_decap_fixup_6o6 (t0->flags, (ip60 + 1), ip60);
+	      else
+		tunnel_decap_fixup_6o4 (t0->flags,
+					(ip6_header_t *) (ip40 + 1), ip40);
 	    }
 	  else if (inner_protocol0 == IP_PROTOCOL_IP_IN_IP)
 	    {
 	      next0 = IPIP_INPUT_NEXT_IP4_INPUT;
-	      if (t0->flags & TUNNEL_ENCAP_DECAP_FLAG_DECAP_COPY_ECN)
-		{
-		  if (is_ipv6)
-		    ip4_header_set_ecn_w_chksum ((ip4_header_t *) (ip60 + 1),
-						 ip6_ecn_network_order
-						 (ip60));
-		  else
-		    ip4_header_set_ecn_w_chksum (ip40 + 1,
-						 ip4_header_get_ecn (ip40));
-		}
+
+	      if (is_ipv6)
+		tunnel_decap_fixup_4o6 (t0->flags,
+					(ip4_header_t *) (ip60 + 1), ip60);
+	      else
+		tunnel_decap_fixup_4o4 (t0->flags, ip40 + 1, ip40);
 	    }
 
 	  if (!is_ipv6 && t0->mode == IPIP_MODE_6RD
diff --git a/src/vnet/tunnel/tunnel_dp.h b/src/vnet/tunnel/tunnel_dp.h
new file mode 100644
index 0000000..3e3a813
--- /dev/null
+++ b/src/vnet/tunnel/tunnel_dp.h
@@ -0,0 +1,104 @@
+/*
+ * tunnel_dp.h: data-plane functions tunnels.
+ *
+ * Copyright (c) 2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __TUNNEL_DP_H__
+#define __TUNNEL_DP_H__
+
+static_always_inline void
+tunnel_encap_fixup_4o4 (tunnel_encap_decap_flags_t flags,
+			const ip4_header_t * inner, ip4_header_t * outer)
+{
+  if (flags & TUNNEL_ENCAP_DECAP_FLAG_ENCAP_COPY_DSCP)
+    ip4_header_set_dscp (outer, ip4_header_get_dscp (inner));
+  if (flags & TUNNEL_ENCAP_DECAP_FLAG_ENCAP_COPY_ECN)
+    ip4_header_set_ecn (outer, ip4_header_get_ecn (inner));
+  if ((flags & TUNNEL_ENCAP_DECAP_FLAG_ENCAP_COPY_DF) &&
+      ip4_header_get_df (inner))
+    ip4_header_set_df (outer);
+}
+
+static_always_inline void
+tunnel_encap_fixup_6o4 (tunnel_encap_decap_flags_t flags,
+			const ip6_header_t * inner, ip4_header_t * outer)
+{
+  if (flags & TUNNEL_ENCAP_DECAP_FLAG_ENCAP_COPY_DSCP)
+    ip4_header_set_dscp (outer, ip6_dscp_network_order (inner));
+  if (flags & TUNNEL_ENCAP_DECAP_FLAG_ENCAP_COPY_ECN)
+    ip4_header_set_ecn (outer, ip6_ecn_network_order ((inner)));
+}
+
+static_always_inline void
+tunnel_encap_fixup_6o6 (tunnel_encap_decap_flags_t flags,
+			const ip6_header_t * inner, ip6_header_t * outer)
+{
+  if (flags & TUNNEL_ENCAP_DECAP_FLAG_ENCAP_COPY_DSCP)
+    ip6_set_dscp_network_order (outer, ip6_dscp_network_order (inner));
+  if (flags & TUNNEL_ENCAP_DECAP_FLAG_ENCAP_COPY_ECN)
+    ip6_set_ecn_network_order (outer, ip6_ecn_network_order (inner));
+}
+
+static_always_inline void
+tunnel_encap_fixup_4o6 (tunnel_encap_decap_flags_t flags,
+			const ip4_header_t * inner, ip6_header_t * outer)
+{
+  if (flags & TUNNEL_ENCAP_DECAP_FLAG_ENCAP_COPY_DSCP)
+    ip6_set_dscp_network_order (outer, ip4_header_get_dscp (inner));
+  if (flags & TUNNEL_ENCAP_DECAP_FLAG_ENCAP_COPY_ECN)
+    ip6_set_ecn_network_order (outer, ip4_header_get_ecn (inner));
+}
+
+static_always_inline void
+tunnel_decap_fixup_4o6 (tunnel_encap_decap_flags_t flags,
+			ip4_header_t * inner, const ip6_header_t * outer)
+{
+  if (flags & TUNNEL_ENCAP_DECAP_FLAG_DECAP_COPY_ECN)
+    ip4_header_set_ecn_w_chksum (inner, ip6_ecn_network_order (outer));
+}
+
+static_always_inline void
+tunnel_decap_fixup_6o6 (tunnel_encap_decap_flags_t flags,
+			ip6_header_t * inner, const ip6_header_t * outer)
+{
+  if (flags & TUNNEL_ENCAP_DECAP_FLAG_DECAP_COPY_ECN)
+    ip6_set_ecn_network_order (inner, ip6_ecn_network_order (outer));
+}
+
+static_always_inline void
+tunnel_decap_fixup_6o4 (tunnel_encap_decap_flags_t flags,
+			ip6_header_t * inner, const ip4_header_t * outer)
+{
+  if (flags & TUNNEL_ENCAP_DECAP_FLAG_DECAP_COPY_ECN)
+    ip6_set_ecn_network_order (inner, ip4_header_get_ecn (outer));
+}
+
+static_always_inline void
+tunnel_decap_fixup_4o4 (tunnel_encap_decap_flags_t flags,
+			ip4_header_t * inner, const ip4_header_t * outer)
+{
+  if (flags & TUNNEL_ENCAP_DECAP_FLAG_DECAP_COPY_ECN)
+    ip4_header_set_ecn_w_chksum (inner, ip4_header_get_ecn (outer));
+}
+
+#endif
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */