+ ikev2_main_t *km = &ikev2_main;
+ u32 sw_if_index;
+ int rv;
+ uword *p = 0;
+
+ rv = ipip_add_tunnel (IPIP_TRANSPORT_IP4, ~0,
+ &a->local_ip, &a->remote_ip, 0,
+ TUNNEL_ENCAP_DECAP_FLAG_NONE, IP_DSCP_CS0,
+ TUNNEL_MODE_P2P, &sw_if_index);
+
+ if (rv == VNET_API_ERROR_IF_ALREADY_EXISTS)
+ {
+ p = hash_get (km->sw_if_indices, sw_if_index);
+ if (p)
+ /* interface is managed by IKE; proceed with updating SAs */
+ rv = 0;
+ }
+
+ if (rv)
+ {
+ clib_warning ("installing ipip tunnel failed! loc:%U rem:%U",
+ format_ip4_address, &a->local_ip,
+ format_ip4_address, &a->remote_ip);
+ return;
+ }
+
+ rv |= ipsec_sa_add_and_lock (a->local_sa_id,
+ a->local_spi,
+ IPSEC_PROTOCOL_ESP, a->encr_type,
+ &a->loc_ckey, a->integ_type, &a->loc_ikey,
+ a->flags, 0, a->salt_local, &a->local_ip,
+ &a->remote_ip, NULL);
+ rv |= ipsec_sa_add_and_lock (a->remote_sa_id, a->remote_spi,
+ IPSEC_PROTOCOL_ESP, a->encr_type, &a->rem_ckey,
+ a->integ_type, &a->rem_ikey,
+ (a->flags | IPSEC_SA_FLAG_IS_INBOUND), 0,
+ a->salt_remote, &a->remote_ip,
+ &a->local_ip, NULL);
+
+ u32 *sas_in = NULL;
+ vec_add1 (sas_in, a->remote_sa_id);
+ rv |= ipsec_tun_protect_update (sw_if_index, a->local_sa_id, sas_in);
+ hash_set1 (km->sw_if_indices, sw_if_index);