qca-nss-clients/netlink/nss_nlipsec.c - manifest_repos/sdk - Git at Google

 /*
  **************************************************************************
  * Copyright (c) 2015-2016,2018-2021 The Linux Foundation. All rights reserved.
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
  * above copyright notice and this permission notice appear in all copies.
  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
  * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  **************************************************************************
  */

 /*
  * nss_nlipsec.c
  *	NSS Netlink IPsec Handler
  */

 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/version.h>
 #include <linux/types.h>
 #include <linux/if.h>
 #include <linux/netlink.h>
 #include <linux/mutex.h>

 #include <net/genetlink.h>
 #include <net/sock.h>

 #include <nss_api_if.h>
 #include <nss_cmn.h>
 #include <nss_ipsec.h>
 #include <nss_ipsecmgr.h>
 #include <nss_nl_if.h>
 #include <nss_ipsec_cmn.h>
 #include "nss_nl.h"
 #include "nss_nlcmn_if.h"
 #include "nss_nlipsec_if.h"
 #include "nss_nlipv6_if.h"
 #include "nss_nlipv4_if.h"

 /*
  * Function prototypes
  */
 static int nss_nlipsec_op_create_tunnel(struct sk_buff *skb, struct genl_info *info);
 static int nss_nlipsec_op_destroy_tunnel(struct sk_buff *skb, struct genl_info *info);
 static int nss_nlipsec_op_add_sa(struct sk_buff *skb, struct genl_info *info);
 static int nss_nlipsec_op_delete_sa(struct sk_buff *skb, struct genl_info *info);
 static int nss_nlipsec_op_add_flow(struct sk_buff *skb, struct genl_info *info);
 static int nss_nlipsec_op_delete_flow(struct sk_buff *skb, struct genl_info *info);

 /*
  * Hold netdevice references
  */
 struct nss_nlipsec_ref {
 	struct mutex lock;	/* Mutex for field access */
 	int ifindex;		/* Device interface index */
 	bool valid;		/* Reference is valid or invalid */
 };

 /*
  * Local context for the NSS_NLIPSEC
  */
 struct nss_nlipsec_ctx {
 	atomic_t tunnels;	/* Number tunnels allocated */

 	/*
 	 * This table stores device reference associated
 	 * to the IPsec tunnel that it has created through NETLINK
 	 * thus prohibiting any spurious attempts to delete
 	 * random net_devices from the Linux kernel
 	 */
 	struct nss_nlipsec_ref ref_tbl[NSS_NLIPSEC_MAX_TUNNELS];
 };

 /*
  * Global context
  */
 static struct nss_nlipsec_ctx gbl_ctx;

 /*
  * Multicast group for sending message status & events
  */
 static const struct genl_multicast_group nss_nlipsec_mcgrp[] = {
 	{.name = NSS_NLIPSEC_MCAST_GRP},
 };

 /*
  * Operation table called by the generic netlink layer based on the command
  */
 static struct genl_ops nss_nlipsec_ops[] = {
 	{ /* Create tunnel */
 		.cmd = NSS_NLIPSEC_CMD_ADD_TUNNEL,
 		.doit = nss_nlipsec_op_create_tunnel,
 	},
 	{ /* Destroy tunnel */
 		.cmd = NSS_NLIPSEC_CMD_DEL_TUNNEL,
 		.doit = nss_nlipsec_op_destroy_tunnel,
 	},
 	{ /* Add Security Association */
 		.cmd = NSS_NLIPSEC_CMD_ADD_SA,
 		.doit = nss_nlipsec_op_add_sa,
 	},
 	{ /* Delete Security Association */
 		.cmd = NSS_NLIPSEC_CMD_DEL_SA,
 		.doit = nss_nlipsec_op_delete_sa,
 	},
 	{ /* Add flow */
 		.cmd = NSS_NLIPSEC_CMD_ADD_FLOW,
 		.doit = nss_nlipsec_op_add_flow,
 	},
 	{ /* Delete flow */
 		.cmd = NSS_NLIPSEC_CMD_DEL_FLOW,
 		.doit = nss_nlipsec_op_delete_flow,
 	},
 };

 /*
  * IPsec family definition
  */
 static struct genl_family nss_nlipsec_family = {
 #if (LINUX_VERSION_CODE <= KERNEL_VERSION(4, 9, 0))
 	.id = GENL_ID_GENERATE,			/* Auto generate ID */
 #endif
 	.name = NSS_NLIPSEC_FAMILY,		/* Family name string */
 	.hdrsize = sizeof(struct nss_nlipsec_rule),/* NSS NETLINK IPsec rule */
 	.version = NSS_NL_VER,			/* Set it to NSS_NL version */
 	.maxattr = NSS_NLIPSEC_CMD_MAX,		/* Maximum commands supported */
 	.netnsok = true,
 	.pre_doit = NULL,
 	.post_doit = NULL,
 	.ops = nss_nlipsec_ops,
 	.n_ops = ARRAY_SIZE(nss_nlipsec_ops),
 	.mcgrps = nss_nlipsec_mcgrp,
 	.n_mcgrps = ARRAY_SIZE(nss_nlipsec_mcgrp)
 };

 /*
  * nss_nlipsec_add_ref()
  *	Add reference to the netdevice object
  */
 static inline void nss_nlipsec_add_ref(struct net_device *dev)
 {
 	struct nss_nlipsec_ref *ref = gbl_ctx.ref_tbl;
 	int i;

 	for (i = 0; i < NSS_NLIPSEC_MAX_TUNNELS; i++, ref++) {
 		mutex_lock(&ref->lock); /* lock_ref */

 		if (!ref->valid) {
 			ref->ifindex = dev->ifindex;
 			ref->valid = true;

 			mutex_unlock(&ref->lock); /* unlock_ref */
 			return;
 		}

 		mutex_unlock(&ref->lock); /* unlock_ref */
 	}

 	BUG_ON(i == NSS_NLIPSEC_MAX_TUNNELS);
 }

 /*
  * nss_nlipsec_del_ref()
  *	delete netdevice reference
  */
 static inline void nss_nlipsec_del_ref(struct nss_nlipsec_ref *ref)
 {
 	mutex_lock(&ref->lock);	/* lock_ref */

 	ref->ifindex = -1;
 	ref->valid = false;

 	mutex_unlock(&ref->lock); /* unlock_ref */
 }

 /*
  * nss_nlipsec_find_ref()
  *	find refernce node for the given netdevice
  */
 struct nss_nlipsec_ref *nss_nlipsec_find_ref(struct net_device *dev)
 {
 	struct nss_nlipsec_ref *ref = gbl_ctx.ref_tbl;
 	int i;

 	for (i = 0; i < NSS_NLIPSEC_MAX_TUNNELS; i++, ref++) {

 		mutex_lock(&ref->lock); /* lock_ref */

 		if (ref->valid && (dev->ifindex == ref->ifindex)) {
 			mutex_unlock(&ref->lock); /* unlock_ref */
 			return ref;
 		}

 		mutex_unlock(&ref->lock); /* unlock_ref */
 	}

 	return NULL;
 }

 /*
  * nss_nlipsec_process_event()
  *	Process events from NSS IPsec manager and MCAST it to user
  */
 static void nss_nlipsec_process_event(void *ctx, struct nss_ipsecmgr_event *ev)
 {
 	struct nss_nlipsec_rule *nl_rule;
 	struct sk_buff *skb;

 	/*
 	 * Allocate a new event message
 	 */
 	skb = nss_nl_new_msg(&nss_nlipsec_family, ev->type);
 	if (!skb) {
 		nss_nl_error("unable to allocate NSS_NLIPV4 event\n");
 		return;
 	}

 	nl_rule = nss_nl_get_data(skb);

 	/*
 	 * Initialize the NETLINK common header
 	 */
 	nss_nlipsec_rule_init(nl_rule, ev->type);

 	/*
 	 * Copy the contents of the sync message into the NETLINK message
 	 */
 	memcpy(&nl_rule->rule.event, ev, sizeof(struct nss_ipsecmgr_event));

 	nss_nl_mcast_event(&nss_nlipsec_family, skb);
 }

 /*
  * nss_nlipsec_get_ifnum()
  *	Extract dynamic interface number for inner/outer
  */
 int nss_nlipsec_get_ifnum(struct net_device *dev, uint8_t proto, uint16_t dest_port, uint16_t src_port)
 {
 	enum nss_dynamic_interface_type type;
 	int ifnum;

 	/*
 	 * If the flow is outer, then set the IPsec outer interface type else
 	 * set the inner interface type to obtain interface number.
 	 */
 	switch (proto) {
 	case IPPROTO_ESP:
 		type = NSS_DYNAMIC_INTERFACE_TYPE_IPSEC_CMN_OUTER;
 		break;

 	case IPPROTO_UDP:
 		if (dest_port == NSS_IPSECMGR_NATT_PORT_DATA)
 			type = NSS_DYNAMIC_INTERFACE_TYPE_IPSEC_CMN_OUTER;
 		else if (src_port == NSS_IPSECMGR_NATT_PORT_DATA)
 			type = NSS_DYNAMIC_INTERFACE_TYPE_IPSEC_CMN_OUTER;
 		else
 			type = NSS_DYNAMIC_INTERFACE_TYPE_IPSEC_CMN_INNER;

 		break;

 	default:
 		type = NSS_DYNAMIC_INTERFACE_TYPE_IPSEC_CMN_INNER;
 		break;
 	}

 	ifnum = nss_cmn_get_interface_number_by_dev_and_type(dev, type);
 	if (ifnum < 0) {
 		nss_nl_error("%px: Failed to find interface number (dev:%s, type:%d)\n", dev, dev->name, type);
 		return -1;
 	}

 	/*
 	 * Interface number with core-id
 	 */
 	return nss_ipsec_cmn_get_ifnum_with_coreid(ifnum);
 }

 /*
  * nss_nlipsec_get_mtu()
  * 	Provide maximum mtu if it is an outer flow and maintain minimum mtu
  */
 int nss_nlipsec_get_mtu(struct net_device *dev, uint8_t ip_ver, uint8_t proto, uint16_t dest_port, uint16_t src_port)
 {
 	int mtu = dev->mtu;

 	/*
 	 * If, flow device is IPsec tunnel and protocol is ESP or NAT-T (UDP@4500)
 	 * then the operation is Decapsulation. In this we would like to keep the MTU
 	 * at the maximum(65536). This would avoid fragmenting the  packet in NSS before
 	 * delivering it for IPsec decap. Also, if the device mtu is less than the minimum
 	 * mtu, we set it to the minimum mtu.
 	 */
 	switch (ip_ver) {
 	case 4:
 		if (proto == IPPROTO_ESP)
 			mtu = NSS_NLIPV4_MAX_MTU;
 		else if ((proto == IPPROTO_UDP) && (dest_port == NSS_IPSECMGR_NATT_PORT_DATA))
 			mtu = NSS_NLIPV4_MAX_MTU;
 		else if ((proto == IPPROTO_UDP) && (src_port == NSS_IPSECMGR_NATT_PORT_DATA))
 			mtu = NSS_NLIPV4_MAX_MTU;
 		else if (dev->mtu < NSS_NLIPV4_MIN_MTU)
 			mtu = NSS_NLIPV4_MIN_MTU;

 		break;
 	case 6:
 		if (proto == IPPROTO_ESP)
 			mtu = NSS_NLIPV6_MAX_MTU;
 		else if (dev->mtu < NSS_NLIPV6_MIN_MTU)
 			mtu = NSS_NLIPV6_MIN_MTU;

 		break;
 	}

 	return mtu;
 }

 /*
  * nss_nlipsec_op_create_tunnel()
  *	Add IPsec tunnel
  */
 static int nss_nlipsec_op_create_tunnel(struct sk_buff *skb, struct genl_info *info)
 {
 	struct nss_nlipsec_rule *nl_rule;
 	struct nss_ipsecmgr_callback cb = {0};
 	struct nss_nlcmn *nl_cm;
 	struct net_device *dev;
 	struct sk_buff *resp;
 	uint32_t pid;

 	/*
 	 * Extract the message payload
 	 */
 	nl_cm = nss_nl_get_msg(&nss_nlipsec_family, info, NSS_NLIPSEC_CMD_ADD_TUNNEL);
 	if (!nl_cm) {
 		nss_nl_error("unable to extract create tunnel data\n");
 		return -EINVAL;
 	}

 	pid = nl_cm->pid;

 	if (atomic_read(&gbl_ctx.tunnels) == NSS_NLIPSEC_MAX_TUNNELS) {
 		nss_nl_error("%d: max allowed tunnel reached (%d)\n", pid, NSS_NLIPSEC_MAX_TUNNELS);
 		return -EINVAL;
 	}

 	/*
 	 * Create a IPsec tunnel device
 	 */
 	cb.app_data = &gbl_ctx;
 	cb.skb_dev = NULL;
 	cb.data_cb = NULL;
 	cb.event_cb = nss_nlipsec_process_event;
 	dev = nss_ipsecmgr_tunnel_add(&cb);
 	if (!dev) {
 		nss_nl_error("%d:unable to add IPsec tunnel\n", pid);
 		return -ENOMEM;
 	}

 	/*
 	 * Add an internal reference to the tunnel dev
 	 */
 	atomic_inc(&gbl_ctx.tunnels);
 	nss_nlipsec_add_ref(dev);

 	/*
 	 * Response message to caller
 	 */
 	resp = nss_nl_copy_msg(skb);
 	if (!resp) {
 		nss_nl_error("unable to copy incoming message\n");
 		goto free_dev;
 	}

 	/*
 	 * Overload the nl_rule with the new response address
 	 */
 	nl_rule = nss_nl_get_data(resp);

 	/*
 	 * Init the command
 	 */
 	nss_nlipsec_rule_init(nl_rule, NSS_NLIPSEC_CMD_ADD_TUNNEL);

 	/*
 	 * We need to send the  name to the user; copy
 	 * the tunnel I/F name into the same rule and send it
 	 * as part of the response for the create operation
 	 */
 	strlcpy(nl_rule->ifname, dev->name, IFNAMSIZ);

 	/*
 	 * Send to userspace
 	 */
 	nss_nl_ucast_resp(resp);

 	return 0;

 free_dev:
 	nss_ipsecmgr_tunnel_del(dev);
 	return -ENOMEM;
 }

 /*
  * nss_nlipsec_op_destroy_tunnel()
  *	Delete an IPsec tunnel
  */
 static int nss_nlipsec_op_destroy_tunnel(struct sk_buff *skb, struct genl_info *info)
 {
 	struct nss_nlipsec_rule *nl_rule;
 	struct nss_nlipsec_ref *ref;
 	struct nss_nlcmn *nl_cm;
 	struct net_device *dev;
 	uint32_t pid;

 	/*
 	 * Extract the message payload
 	 */
 	nl_cm = nss_nl_get_msg(&nss_nlipsec_family, info, NSS_NLIPSEC_CMD_DEL_TUNNEL);
 	if (!nl_cm) {
 		nss_nl_error("unable to extract destroy tunnel data\n");
 		return -EINVAL;
 	}

 	/*
 	 * Message validation required before accepting the configuration
 	 */
 	nl_rule = container_of(nl_cm, struct nss_nlipsec_rule, cm);
 	pid = nl_cm->pid;

 	if (atomic_read(&gbl_ctx.tunnels) == 0) {
 		nss_nl_error("%d: no tunnels available for deletion\n", pid);
 		return -EINVAL;
 	}
 	/*
 	 * Get the the Linux net_device object
 	 */
 	dev = dev_get_by_name(&init_net, nl_rule->ifname);
 	if (!dev) {
 		nss_nl_error("%d: unable to find netdevice (%s)\n", pid, nl_rule->ifname);
 		return -EINVAL;
 	}

 	/*
 	 * Find if we have the local reference
 	 */
 	ref = nss_nlipsec_find_ref(dev);
 	if (!ref) {
 		nss_nl_error("%d: (%s) was not created through NL_IPSEC\n", pid, dev->name);
 		dev_put(dev);
 		return -EINVAL;
 	}

 	nss_nlipsec_del_ref(ref);
 	atomic_dec(&gbl_ctx.tunnels);

 	/*
 	 * Down the ref_cnt held by nss_nlipsec_destroy_tunnel
 	 */
 	dev_put(dev);

 	/*
 	 * Delete the tunnel device
 	 */
 	nss_ipsecmgr_tunnel_del(dev);

 	return 0;
 }

 /*
  * nss_nlipsec_get_rule()
  *	Extract the rule message
  */
 static struct nss_nlipsec_rule *nss_nlipsec_get_rule(struct genl_info *info, enum nss_nlipsec_cmd cmd,
 							struct net_device **dev)
 {
 	struct nss_nlipsec_rule *nl_rule;
 	struct nss_nlipsec_ref *ref;
 	struct nss_nlcmn *nl_cm;
 	uint32_t pid;

 	/*
 	 * Extract the message payload
 	 */
 	nl_cm = nss_nl_get_msg(&nss_nlipsec_family, info, cmd);
 	if (!nl_cm) {
 		nss_nl_error("Unable to extract SA data\n");
 		return NULL;
 	}

 	nl_rule = container_of(nl_cm, struct nss_nlipsec_rule, cm);

 	pid = nl_cm->pid;

 	*dev = dev_get_by_name(&init_net, nl_rule->ifname);
 	if (!(*dev)) {
 		nss_nl_error("%d: Unable to find Linux net_device(%s)\n", pid, nl_rule->ifname);
 		return NULL;
 	}

 	ref = nss_nlipsec_find_ref(*dev);
 	if (!ref) {
 		nss_nl_error("%d: (%s) was not created through NL_IPSEC", pid, (*dev)->name);
 		dev_put(*dev);
 		return NULL;
 	}
 	return nl_rule;
 }

 /*
  * nss_nlipsec_op_add_sa()
  *	Add a Security Association for Encapsulation or Decapsulation
  */
 static int nss_nlipsec_op_add_sa(struct sk_buff *skb, struct genl_info *info)
 {
 	struct nss_ipsecmgr_sa_data *sa_data;
 	struct nss_nlipsec_rule_sa *sa_rule;
 	struct nss_nlipsec_rule *nl_rule;
 	struct net_device *dev;
 	struct sk_buff *resp;
 	uint32_t pid, if_num;
 	int error = 0;

 	nl_rule = nss_nlipsec_get_rule(info, NSS_NLIPSEC_CMD_ADD_SA, &dev);
 	if (!nl_rule) {
 		nss_nl_error("Failed to extract SA data\n");
 		return -EINVAL;
 	}

 	pid = nl_rule->cm.pid;
 	nss_nl_error("%d: device(%s)", pid, dev->name);

 	/*
 	 * Get the SA rule and data from the message
 	 */
 	sa_rule = &nl_rule->rule.sa;
 	sa_data = &nl_rule->rule.sa.data;

 	/*
 	 * Switch to kernel pointers
 	 */
 	sa_data->cmn.keys.cipher_key = sa_rule->cipher_key;
 	sa_data->cmn.keys.auth_key = sa_rule->auth_key;
 	sa_data->cmn.keys.nonce = sa_rule->nonce;

 	error = nss_ipsecmgr_sa_add_sync(dev, &sa_rule->tuple, sa_data, &if_num);
 	if (error) {
 		nss_nl_error("%d: Failed to add SA for net device(%s), error:%d\n", pid, nl_rule->ifname, error);
 		goto free_dev;
 	}

 	/*
 	 * Response message to caller
 	 */
 	resp = nss_nl_copy_msg(skb);
 	if (!resp) {
 		nss_nl_error("unable to copy incoming message\n");
 		error = -ENOMEM;
 		goto free_dev;
 	}

 	/*
 	 * Overload the nl_rule with the new response address
 	 */
 	nl_rule = nss_nl_get_data(resp);

 	/*
 	 * Init the command
 	 */
 	nss_nlipsec_rule_init(nl_rule, NSS_NLIPSEC_CMD_ADD_SA);

 	/*
 	 * We need to send the ifnum to the user; copy
 	 * the if_number into the same rule and send it
 	 * as part of the response for the create operation
 	 */
 	nl_rule->ifnum = if_num;

 	/*
 	 * Send to userspace
 	 */
 	nss_nl_ucast_resp(resp);

 free_dev:
 	/*
 	 *  dev_put for dev_get done on nss_nlipsec_get_rule
 	 */
 	dev_put(dev);
 	return error;
 }

 /*
  * nss_nlipsec_op_delete_sa()
  *	Delete a Security Association for Encapsulation or Decapsulation
  */
 static int nss_nlipsec_op_delete_sa(struct sk_buff *skb, struct genl_info *info)
 {
 	struct nss_nlipsec_rule *nl_rule;
 	struct net_device *dev;
 	uint32_t pid;

 	nl_rule = nss_nlipsec_get_rule(info, NSS_NLIPSEC_CMD_DEL_SA, &dev);
 	if (!nl_rule) {
 		nss_nl_error("Failed to extract SA data\n");
 		return -EINVAL;
 	}

 	pid = nl_rule->cm.pid;
 	nss_nl_error("%d: device(%s)", pid, dev->name);

 	nss_ipsecmgr_sa_del(dev, &nl_rule->rule.sa.tuple);

 	/*
 	 *  dev_put for dev_get done on nss_nlipsec_get_rule
 	 */
 	dev_put(dev);
 	return 0;
 }

 /*
  * nss_nlipsec_op_add_flow()
  *	Add a flow
  */
 static int nss_nlipsec_op_add_flow(struct sk_buff *skb, struct genl_info *info)
 {
 	struct nss_ipsecmgr_flow_tuple *flow_tuple;
 	struct nss_ipsecmgr_sa_tuple *sa_tuple;
 	struct nss_nlipsec_rule *nl_rule;
 	struct net_device *dev;
 	uint32_t pid;
 	int error = 0;

 	nl_rule = nss_nlipsec_get_rule(info, NSS_NLIPSEC_CMD_ADD_FLOW, &dev);
 	if (!nl_rule) {
 		nss_nl_error("Failed to extract SA data\n");
 		return -EINVAL;
 	}

 	pid = nl_rule->cm.pid;
 	nss_nl_error("%d: device(%s)", pid, dev->name);

 	flow_tuple = &nl_rule->rule.flow.tuple;
 	sa_tuple = &nl_rule->rule.flow.sa;

 	error = nss_ipsecmgr_flow_add_sync(dev, flow_tuple, sa_tuple);
 	if (error) {
 		nss_nl_error("%d: Failed to add subnet for net_device(%s)", pid, nl_rule->ifname);
 	}

 	/*
 	 *  dev_put for dev_get done on nss_nlipsec_get_rule
 	 */
 	dev_put(dev);
 	return error;
 }

 /*
  * nss_nlipsec_op_delete_flow()
  *	Delete a flow
  */
 static int nss_nlipsec_op_delete_flow(struct sk_buff *skb, struct genl_info *info)
 {
 	struct nss_ipsecmgr_flow_tuple *flow_tuple;
 	struct nss_ipsecmgr_sa_tuple *sa_tuple;
 	struct nss_nlipsec_rule *nl_rule;
 	struct net_device *dev;
 	uint32_t pid;
 	int error = 0;

 	nl_rule = nss_nlipsec_get_rule(info, NSS_NLIPSEC_CMD_DEL_FLOW, &dev);
 	if (!nl_rule) {
 		nss_nl_error("Failed to extract SA data\n");
 		return -EINVAL;
 	}

 	pid = nl_rule->cm.pid;
 	nss_nl_error("%d: device(%s)", pid, dev->name);

 	flow_tuple = &nl_rule->rule.flow.tuple;
 	sa_tuple = &nl_rule->rule.flow.sa;

 	nss_ipsecmgr_flow_del(dev, flow_tuple, sa_tuple);

 	/*
 	 *  dev_put for dev_get done on nss_nlipsec_get_rule
 	 */
 	dev_put(dev);
 	return error;
 }

 /*
  * nss_nlipsec_init()
  *	Netlink IPsec handler initialization
  */
 bool nss_nlipsec_init(void)
 {
 	struct nss_nlipsec_ref *ref = gbl_ctx.ref_tbl;
 	int error;
 	int i;

 	nss_nl_info_always("Init NSS netlink IPsec handler\n");

 	/*
 	 * Initialize reference table
 	 */
 	for (i = 0; i < NSS_NLIPSEC_MAX_TUNNELS; i++, ref++) {
 		mutex_init(&ref->lock);
 		ref->valid = false;
 		ref->ifindex = -1;
 	}

 	/*
 	 * Register with the family
 	 */
 	error = genl_register_family(&nss_nlipsec_family);
 	if (error != 0) {
 		nss_nl_info_always("Error: unable to register IPsec family\n");
 		return false;
 	}

 	return true;
 }

 /*
  * nss_nlipsec_exit()
  *	Netlink IPsec handler exit
  */
 bool nss_nlipsec_exit(void)
 {
 	int error;

 	nss_nl_info_always("Exit NSS netlink IPsec handler\n");

 	/*
 	 * unregister the ops family
 	 */
 	error = genl_unregister_family(&nss_nlipsec_family);
 	if (error != 0) {
 		nss_nl_info_always("Unregister IPsec NETLINK family failed\n");
 		return false;
 	}

 	return true;
 }
	/*
	**************************************************************************
	* Copyright (c) 2015-2016,2018-2021 The Linux Foundation. All rights reserved.
	* Permission to use, copy, modify, and/or distribute this software for
	* any purpose with or without fee is hereby granted, provided that the
	* above copyright notice and this permission notice appear in all copies.
	* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
	* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
	* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
	* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
	* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
	* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
	* OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
	**************************************************************************
	*/

	/*
	* nss_nlipsec.c
	* NSS Netlink IPsec Handler
	*/

	#include <linux/kernel.h>
	#include <linux/module.h>
	#include <linux/version.h>
	#include <linux/types.h>
	#include <linux/if.h>
	#include <linux/netlink.h>
	#include <linux/mutex.h>

	#include <net/genetlink.h>
	#include <net/sock.h>

	#include <nss_api_if.h>
	#include <nss_cmn.h>
	#include <nss_ipsec.h>
	#include <nss_ipsecmgr.h>
	#include <nss_nl_if.h>
	#include <nss_ipsec_cmn.h>
	#include "nss_nl.h"
	#include "nss_nlcmn_if.h"
	#include "nss_nlipsec_if.h"
	#include "nss_nlipv6_if.h"
	#include "nss_nlipv4_if.h"

	/*
	* Function prototypes
	*/
	static int nss_nlipsec_op_create_tunnel(struct sk_buff skb, struct genl_info info);
	static int nss_nlipsec_op_destroy_tunnel(struct sk_buff skb, struct genl_info info);
	static int nss_nlipsec_op_add_sa(struct sk_buff skb, struct genl_info info);
	static int nss_nlipsec_op_delete_sa(struct sk_buff skb, struct genl_info info);
	static int nss_nlipsec_op_add_flow(struct sk_buff skb, struct genl_info info);
	static int nss_nlipsec_op_delete_flow(struct sk_buff skb, struct genl_info info);

	/*
	* Hold netdevice references
	*/
	struct nss_nlipsec_ref {
	struct mutex lock; /* Mutex for field access */
	int ifindex; /* Device interface index */
	bool valid; /* Reference is valid or invalid */
	};

	/*
	* Local context for the NSS_NLIPSEC
	*/
	struct nss_nlipsec_ctx {
	atomic_t tunnels; /* Number tunnels allocated */

	/*
	* This table stores device reference associated
	* to the IPsec tunnel that it has created through NETLINK
	* thus prohibiting any spurious attempts to delete
	* random net_devices from the Linux kernel
	*/
	struct nss_nlipsec_ref ref_tbl[NSS_NLIPSEC_MAX_TUNNELS];
	};

	/*
	* Global context
	*/
	static struct nss_nlipsec_ctx gbl_ctx;

	/*
	* Multicast group for sending message status & events
	*/
	static const struct genl_multicast_group nss_nlipsec_mcgrp[] = {
	{.name = NSS_NLIPSEC_MCAST_GRP},
	};

	/*
	* Operation table called by the generic netlink layer based on the command
	*/
	static struct genl_ops nss_nlipsec_ops[] = {
	{ /* Create tunnel */
	.cmd = NSS_NLIPSEC_CMD_ADD_TUNNEL,
	.doit = nss_nlipsec_op_create_tunnel,
	},
	{ /* Destroy tunnel */
	.cmd = NSS_NLIPSEC_CMD_DEL_TUNNEL,
	.doit = nss_nlipsec_op_destroy_tunnel,
	},
	{ /* Add Security Association */
	.cmd = NSS_NLIPSEC_CMD_ADD_SA,
	.doit = nss_nlipsec_op_add_sa,
	},
	{ /* Delete Security Association */
	.cmd = NSS_NLIPSEC_CMD_DEL_SA,
	.doit = nss_nlipsec_op_delete_sa,
	},
	{ /* Add flow */
	.cmd = NSS_NLIPSEC_CMD_ADD_FLOW,
	.doit = nss_nlipsec_op_add_flow,
	},
	{ /* Delete flow */
	.cmd = NSS_NLIPSEC_CMD_DEL_FLOW,
	.doit = nss_nlipsec_op_delete_flow,
	},
	};

	/*
	* IPsec family definition
	*/
	static struct genl_family nss_nlipsec_family = {
	#if (LINUX_VERSION_CODE <= KERNEL_VERSION(4, 9, 0))
	.id = GENL_ID_GENERATE, /* Auto generate ID */
	#endif
	.name = NSS_NLIPSEC_FAMILY, /* Family name string */
	.hdrsize = sizeof(struct nss_nlipsec_rule),/* NSS NETLINK IPsec rule */
	.version = NSS_NL_VER, /* Set it to NSS_NL version */
	.maxattr = NSS_NLIPSEC_CMD_MAX, /* Maximum commands supported */
	.netnsok = true,
	.pre_doit = NULL,
	.post_doit = NULL,
	.ops = nss_nlipsec_ops,
	.n_ops = ARRAY_SIZE(nss_nlipsec_ops),
	.mcgrps = nss_nlipsec_mcgrp,
	.n_mcgrps = ARRAY_SIZE(nss_nlipsec_mcgrp)
	};

	/*
	* nss_nlipsec_add_ref()
	* Add reference to the netdevice object
	*/
	static inline void nss_nlipsec_add_ref(struct net_device *dev)
	{
	struct nss_nlipsec_ref *ref = gbl_ctx.ref_tbl;
	int i;

	for (i = 0; i < NSS_NLIPSEC_MAX_TUNNELS; i++, ref++) {
	mutex_lock(&ref->lock); /* lock_ref */

	if (!ref->valid) {
	ref->ifindex = dev->ifindex;
	ref->valid = true;

	mutex_unlock(&ref->lock); /* unlock_ref */
	return;
	}

	mutex_unlock(&ref->lock); /* unlock_ref */
	}

	BUG_ON(i == NSS_NLIPSEC_MAX_TUNNELS);
	}

	/*
	* nss_nlipsec_del_ref()
	* delete netdevice reference
	*/
	static inline void nss_nlipsec_del_ref(struct nss_nlipsec_ref *ref)
	{
	mutex_lock(&ref->lock); /* lock_ref */

	ref->ifindex = -1;
	ref->valid = false;

	mutex_unlock(&ref->lock); /* unlock_ref */
	}

	/*
	* nss_nlipsec_find_ref()
	* find refernce node for the given netdevice
	*/
	struct nss_nlipsec_ref nss_nlipsec_find_ref(struct net_device dev)
	{
	struct nss_nlipsec_ref *ref = gbl_ctx.ref_tbl;
	int i;

	for (i = 0; i < NSS_NLIPSEC_MAX_TUNNELS; i++, ref++) {

	mutex_lock(&ref->lock); /* lock_ref */

	if (ref->valid && (dev->ifindex == ref->ifindex)) {
	mutex_unlock(&ref->lock); /* unlock_ref */
	return ref;
	}

	mutex_unlock(&ref->lock); /* unlock_ref */
	}

	return NULL;
	}

	/*
	* nss_nlipsec_process_event()
	* Process events from NSS IPsec manager and MCAST it to user
	*/
	static void nss_nlipsec_process_event(void ctx, struct nss_ipsecmgr_event ev)
	{
	struct nss_nlipsec_rule *nl_rule;
	struct sk_buff *skb;

	/*
	* Allocate a new event message
	*/
	skb = nss_nl_new_msg(&nss_nlipsec_family, ev->type);
	if (!skb) {
	nss_nl_error("unable to allocate NSS_NLIPV4 event\n");
	return;
	}

	nl_rule = nss_nl_get_data(skb);

	/*
	* Initialize the NETLINK common header
	*/
	nss_nlipsec_rule_init(nl_rule, ev->type);

	/*
	* Copy the contents of the sync message into the NETLINK message
	*/
	memcpy(&nl_rule->rule.event, ev, sizeof(struct nss_ipsecmgr_event));

	nss_nl_mcast_event(&nss_nlipsec_family, skb);
	}

	/*
	* nss_nlipsec_get_ifnum()
	* Extract dynamic interface number for inner/outer
	*/
	int nss_nlipsec_get_ifnum(struct net_device *dev, uint8_t proto, uint16_t dest_port, uint16_t src_port)
	{
	enum nss_dynamic_interface_type type;
	int ifnum;

	/*
	* If the flow is outer, then set the IPsec outer interface type else
	* set the inner interface type to obtain interface number.
	*/
	switch (proto) {
	case IPPROTO_ESP:
	type = NSS_DYNAMIC_INTERFACE_TYPE_IPSEC_CMN_OUTER;
	break;

	case IPPROTO_UDP:
	if (dest_port == NSS_IPSECMGR_NATT_PORT_DATA)
	type = NSS_DYNAMIC_INTERFACE_TYPE_IPSEC_CMN_OUTER;
	else if (src_port == NSS_IPSECMGR_NATT_PORT_DATA)
	type = NSS_DYNAMIC_INTERFACE_TYPE_IPSEC_CMN_OUTER;
	else
	type = NSS_DYNAMIC_INTERFACE_TYPE_IPSEC_CMN_INNER;

	break;

	default:
	type = NSS_DYNAMIC_INTERFACE_TYPE_IPSEC_CMN_INNER;
	break;
	}

	ifnum = nss_cmn_get_interface_number_by_dev_and_type(dev, type);
	if (ifnum < 0) {
	nss_nl_error("%px: Failed to find interface number (dev:%s, type:%d)\n", dev, dev->name, type);
	return -1;
	}

	/*
	* Interface number with core-id
	*/
	return nss_ipsec_cmn_get_ifnum_with_coreid(ifnum);
	}

	/*
	* nss_nlipsec_get_mtu()
	* Provide maximum mtu if it is an outer flow and maintain minimum mtu
	*/
	int nss_nlipsec_get_mtu(struct net_device *dev, uint8_t ip_ver, uint8_t proto, uint16_t dest_port, uint16_t src_port)
	{
	int mtu = dev->mtu;

	/*
	* If, flow device is IPsec tunnel and protocol is ESP or NAT-T (UDP@4500)
	* then the operation is Decapsulation. In this we would like to keep the MTU
	* at the maximum(65536). This would avoid fragmenting the packet in NSS before
	* delivering it for IPsec decap. Also, if the device mtu is less than the minimum
	* mtu, we set it to the minimum mtu.
	*/
	switch (ip_ver) {
	case 4:
	if (proto == IPPROTO_ESP)
	mtu = NSS_NLIPV4_MAX_MTU;
	else if ((proto == IPPROTO_UDP) && (dest_port == NSS_IPSECMGR_NATT_PORT_DATA))
	mtu = NSS_NLIPV4_MAX_MTU;
	else if ((proto == IPPROTO_UDP) && (src_port == NSS_IPSECMGR_NATT_PORT_DATA))
	mtu = NSS_NLIPV4_MAX_MTU;
	else if (dev->mtu < NSS_NLIPV4_MIN_MTU)
	mtu = NSS_NLIPV4_MIN_MTU;

	break;
	case 6:
	if (proto == IPPROTO_ESP)
	mtu = NSS_NLIPV6_MAX_MTU;
	else if (dev->mtu < NSS_NLIPV6_MIN_MTU)
	mtu = NSS_NLIPV6_MIN_MTU;

	break;
	}

	return mtu;
	}

	/*
	* nss_nlipsec_op_create_tunnel()
	* Add IPsec tunnel
	*/
	static int nss_nlipsec_op_create_tunnel(struct sk_buff skb, struct genl_info info)
	{
	struct nss_nlipsec_rule *nl_rule;
	struct nss_ipsecmgr_callback cb = {0};
	struct nss_nlcmn *nl_cm;
	struct net_device *dev;
	struct sk_buff *resp;
	uint32_t pid;

	/*
	* Extract the message payload
	*/
	nl_cm = nss_nl_get_msg(&nss_nlipsec_family, info, NSS_NLIPSEC_CMD_ADD_TUNNEL);
	if (!nl_cm) {
	nss_nl_error("unable to extract create tunnel data\n");
	return -EINVAL;
	}

	pid = nl_cm->pid;

	if (atomic_read(&gbl_ctx.tunnels) == NSS_NLIPSEC_MAX_TUNNELS) {
	nss_nl_error("%d: max allowed tunnel reached (%d)\n", pid, NSS_NLIPSEC_MAX_TUNNELS);
	return -EINVAL;
	}

	/*
	* Create a IPsec tunnel device
	*/
	cb.app_data = &gbl_ctx;
	cb.skb_dev = NULL;
	cb.data_cb = NULL;
	cb.event_cb = nss_nlipsec_process_event;
	dev = nss_ipsecmgr_tunnel_add(&cb);
	if (!dev) {
	nss_nl_error("%d:unable to add IPsec tunnel\n", pid);
	return -ENOMEM;
	}

	/*
	* Add an internal reference to the tunnel dev
	*/
	atomic_inc(&gbl_ctx.tunnels);
	nss_nlipsec_add_ref(dev);

	/*
	* Response message to caller
	*/
	resp = nss_nl_copy_msg(skb);
	if (!resp) {
	nss_nl_error("unable to copy incoming message\n");
	goto free_dev;
	}

	/*
	* Overload the nl_rule with the new response address
	*/
	nl_rule = nss_nl_get_data(resp);

	/*
	* Init the command
	*/
	nss_nlipsec_rule_init(nl_rule, NSS_NLIPSEC_CMD_ADD_TUNNEL);

	/*
	* We need to send the name to the user; copy
	* the tunnel I/F name into the same rule and send it
	* as part of the response for the create operation
	*/
	strlcpy(nl_rule->ifname, dev->name, IFNAMSIZ);

	/*
	* Send to userspace
	*/
	nss_nl_ucast_resp(resp);

	return 0;

	free_dev:
	nss_ipsecmgr_tunnel_del(dev);
	return -ENOMEM;
	}

	/*
	* nss_nlipsec_op_destroy_tunnel()
	* Delete an IPsec tunnel
	*/
	static int nss_nlipsec_op_destroy_tunnel(struct sk_buff skb, struct genl_info info)
	{
	struct nss_nlipsec_rule *nl_rule;
	struct nss_nlipsec_ref *ref;
	struct nss_nlcmn *nl_cm;
	struct net_device *dev;
	uint32_t pid;

	/*
	* Extract the message payload
	*/
	nl_cm = nss_nl_get_msg(&nss_nlipsec_family, info, NSS_NLIPSEC_CMD_DEL_TUNNEL);
	if (!nl_cm) {
	nss_nl_error("unable to extract destroy tunnel data\n");
	return -EINVAL;
	}

	/*
	* Message validation required before accepting the configuration
	*/
	nl_rule = container_of(nl_cm, struct nss_nlipsec_rule, cm);
	pid = nl_cm->pid;

	if (atomic_read(&gbl_ctx.tunnels) == 0) {
	nss_nl_error("%d: no tunnels available for deletion\n", pid);
	return -EINVAL;
	}
	/*
	* Get the the Linux net_device object
	*/
	dev = dev_get_by_name(&init_net, nl_rule->ifname);
	if (!dev) {
	nss_nl_error("%d: unable to find netdevice (%s)\n", pid, nl_rule->ifname);
	return -EINVAL;
	}

	/*
	* Find if we have the local reference
	*/
	ref = nss_nlipsec_find_ref(dev);
	if (!ref) {
	nss_nl_error("%d: (%s) was not created through NL_IPSEC\n", pid, dev->name);
	dev_put(dev);
	return -EINVAL;
	}

	nss_nlipsec_del_ref(ref);
	atomic_dec(&gbl_ctx.tunnels);

	/*
	* Down the ref_cnt held by nss_nlipsec_destroy_tunnel
	*/
	dev_put(dev);

	/*
	* Delete the tunnel device
	*/
	nss_ipsecmgr_tunnel_del(dev);

	return 0;
	}

	/*
	* nss_nlipsec_get_rule()
	* Extract the rule message
	*/
	static struct nss_nlipsec_rule nss_nlipsec_get_rule(struct genl_info info, enum nss_nlipsec_cmd cmd,
	struct net_device **dev)
	{
	struct nss_nlipsec_rule *nl_rule;
	struct nss_nlipsec_ref *ref;
	struct nss_nlcmn *nl_cm;
	uint32_t pid;

	/*
	* Extract the message payload
	*/
	nl_cm = nss_nl_get_msg(&nss_nlipsec_family, info, cmd);
	if (!nl_cm) {
	nss_nl_error("Unable to extract SA data\n");
	return NULL;
	}

	nl_rule = container_of(nl_cm, struct nss_nlipsec_rule, cm);

	pid = nl_cm->pid;

	*dev = dev_get_by_name(&init_net, nl_rule->ifname);
	if (!(*dev)) {
	nss_nl_error("%d: Unable to find Linux net_device(%s)\n", pid, nl_rule->ifname);
	return NULL;
	}

	ref = nss_nlipsec_find_ref(*dev);
	if (!ref) {
	nss_nl_error("%d: (%s) was not created through NL_IPSEC", pid, (*dev)->name);
	dev_put(*dev);
	return NULL;
	}
	return nl_rule;
	}

	/*
	* nss_nlipsec_op_add_sa()
	* Add a Security Association for Encapsulation or Decapsulation
	*/
	static int nss_nlipsec_op_add_sa(struct sk_buff skb, struct genl_info info)
	{
	struct nss_ipsecmgr_sa_data *sa_data;
	struct nss_nlipsec_rule_sa *sa_rule;
	struct nss_nlipsec_rule *nl_rule;
	struct net_device *dev;
	struct sk_buff *resp;
	uint32_t pid, if_num;
	int error = 0;

	nl_rule = nss_nlipsec_get_rule(info, NSS_NLIPSEC_CMD_ADD_SA, &dev);
	if (!nl_rule) {
	nss_nl_error("Failed to extract SA data\n");
	return -EINVAL;
	}

	pid = nl_rule->cm.pid;
	nss_nl_error("%d: device(%s)", pid, dev->name);

	/*
	* Get the SA rule and data from the message
	*/
	sa_rule = &nl_rule->rule.sa;
	sa_data = &nl_rule->rule.sa.data;

	/*
	* Switch to kernel pointers
	*/
	sa_data->cmn.keys.cipher_key = sa_rule->cipher_key;
	sa_data->cmn.keys.auth_key = sa_rule->auth_key;
	sa_data->cmn.keys.nonce = sa_rule->nonce;

	error = nss_ipsecmgr_sa_add_sync(dev, &sa_rule->tuple, sa_data, &if_num);
	if (error) {
	nss_nl_error("%d: Failed to add SA for net device(%s), error:%d\n", pid, nl_rule->ifname, error);
	goto free_dev;
	}

	/*
	* Response message to caller
	*/
	resp = nss_nl_copy_msg(skb);
	if (!resp) {
	nss_nl_error("unable to copy incoming message\n");
	error = -ENOMEM;
	goto free_dev;
	}

	/*
	* Overload the nl_rule with the new response address
	*/
	nl_rule = nss_nl_get_data(resp);

	/*
	* Init the command
	*/
	nss_nlipsec_rule_init(nl_rule, NSS_NLIPSEC_CMD_ADD_SA);

	/*
	* We need to send the ifnum to the user; copy
	* the if_number into the same rule and send it
	* as part of the response for the create operation
	*/
	nl_rule->ifnum = if_num;

	/*
	* Send to userspace
	*/
	nss_nl_ucast_resp(resp);

	free_dev:
	/*
	* dev_put for dev_get done on nss_nlipsec_get_rule
	*/
	dev_put(dev);
	return error;
	}

	/*
	* nss_nlipsec_op_delete_sa()
	* Delete a Security Association for Encapsulation or Decapsulation
	*/
	static int nss_nlipsec_op_delete_sa(struct sk_buff skb, struct genl_info info)
	{
	struct nss_nlipsec_rule *nl_rule;
	struct net_device *dev;
	uint32_t pid;

	nl_rule = nss_nlipsec_get_rule(info, NSS_NLIPSEC_CMD_DEL_SA, &dev);
	if (!nl_rule) {
	nss_nl_error("Failed to extract SA data\n");
	return -EINVAL;
	}

	pid = nl_rule->cm.pid;
	nss_nl_error("%d: device(%s)", pid, dev->name);

	nss_ipsecmgr_sa_del(dev, &nl_rule->rule.sa.tuple);

	/*
	* dev_put for dev_get done on nss_nlipsec_get_rule
	*/
	dev_put(dev);
	return 0;
	}

	/*
	* nss_nlipsec_op_add_flow()
	* Add a flow
	*/
	static int nss_nlipsec_op_add_flow(struct sk_buff skb, struct genl_info info)
	{
	struct nss_ipsecmgr_flow_tuple *flow_tuple;
	struct nss_ipsecmgr_sa_tuple *sa_tuple;
	struct nss_nlipsec_rule *nl_rule;
	struct net_device *dev;
	uint32_t pid;
	int error = 0;

	nl_rule = nss_nlipsec_get_rule(info, NSS_NLIPSEC_CMD_ADD_FLOW, &dev);
	if (!nl_rule) {
	nss_nl_error("Failed to extract SA data\n");
	return -EINVAL;
	}

	pid = nl_rule->cm.pid;
	nss_nl_error("%d: device(%s)", pid, dev->name);

	flow_tuple = &nl_rule->rule.flow.tuple;
	sa_tuple = &nl_rule->rule.flow.sa;

	error = nss_ipsecmgr_flow_add_sync(dev, flow_tuple, sa_tuple);
	if (error) {
	nss_nl_error("%d: Failed to add subnet for net_device(%s)", pid, nl_rule->ifname);
	}

	/*
	* dev_put for dev_get done on nss_nlipsec_get_rule
	*/
	dev_put(dev);
	return error;
	}

	/*
	* nss_nlipsec_op_delete_flow()
	* Delete a flow
	*/
	static int nss_nlipsec_op_delete_flow(struct sk_buff skb, struct genl_info info)
	{
	struct nss_ipsecmgr_flow_tuple *flow_tuple;
	struct nss_ipsecmgr_sa_tuple *sa_tuple;
	struct nss_nlipsec_rule *nl_rule;
	struct net_device *dev;
	uint32_t pid;
	int error = 0;

	nl_rule = nss_nlipsec_get_rule(info, NSS_NLIPSEC_CMD_DEL_FLOW, &dev);
	if (!nl_rule) {
	nss_nl_error("Failed to extract SA data\n");
	return -EINVAL;
	}

	pid = nl_rule->cm.pid;
	nss_nl_error("%d: device(%s)", pid, dev->name);

	flow_tuple = &nl_rule->rule.flow.tuple;
	sa_tuple = &nl_rule->rule.flow.sa;

	nss_ipsecmgr_flow_del(dev, flow_tuple, sa_tuple);

	/*
	* dev_put for dev_get done on nss_nlipsec_get_rule
	*/
	dev_put(dev);
	return error;
	}

	/*
	* nss_nlipsec_init()
	* Netlink IPsec handler initialization
	*/
	bool nss_nlipsec_init(void)
	{
	struct nss_nlipsec_ref *ref = gbl_ctx.ref_tbl;
	int error;
	int i;

	nss_nl_info_always("Init NSS netlink IPsec handler\n");

	/*
	* Initialize reference table
	*/
	for (i = 0; i < NSS_NLIPSEC_MAX_TUNNELS; i++, ref++) {
	mutex_init(&ref->lock);
	ref->valid = false;
	ref->ifindex = -1;
	}

	/*
	* Register with the family
	*/
	error = genl_register_family(&nss_nlipsec_family);
	if (error != 0) {
	nss_nl_info_always("Error: unable to register IPsec family\n");
	return false;
	}

	return true;
	}

	/*
	* nss_nlipsec_exit()
	* Netlink IPsec handler exit
	*/
	bool nss_nlipsec_exit(void)
	{
	int error;

	nss_nl_info_always("Exit NSS netlink IPsec handler\n");

	/*
	* unregister the ops family
	*/
	error = genl_unregister_family(&nss_nlipsec_family);
	if (error != 0) {
	nss_nl_info_always("Unregister IPsec NETLINK family failed\n");
	return false;
	}

	return true;
	}