Inbound Packet Flow: IPSec pkt comes in from n/w

if(proto == IPPROTO_AH | IPPROTO_ESP){
    //Check SPI & Get matching SA
    if(SA == transport){
        //Decrypt Send to N/w Layer
    }else{
        //Remove Outer IP Header
        //Decrypt.    send to N/W
    }
} 
      

Outbound: IPSec pkt comes on interface to be routed

if(proto == IPPROTO_AH | IPPROTO_ESP){
    //Check SPI & Get matching SA
    if(SA == transport){
        //Decrypt Send to N/w Layer
    }else{
        //Remove Outer IP Header
        //Decrypt.    send to N/W
    }
}