src/vnet/ipsec/ipsec.c

   1 /*
   2  * decap.c : IPSec tunnel support
   3  *
   4  * Copyright (c) 2015 Cisco and/or its affiliates.
   5  * Licensed under the Apache License, Version 2.0 (the "License");
   6  * you may not use this file except in compliance with the License.
   7  * You may obtain a copy of the License at:
   8  *
   9  *     http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  * Unless required by applicable law or agreed to in writing, software
  12  * distributed under the License is distributed on an "AS IS" BASIS,
  13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  * See the License for the specific language governing permissions and
  15  * limitations under the License.
  16  */
  17
  18 #include <vnet/vnet.h>
  19 #include <vnet/api_errno.h>
  20 #include <vnet/ip/ip.h>
  21 #include <vnet/interface.h>
  22 #include <vnet/udp/udp.h>
  23
  24 #include <vnet/ipsec/ipsec.h>
  25 #include <vnet/ipsec/ikev2.h>
  26 #include <vnet/ipsec/esp.h>
  27 #include <vnet/ipsec/ah.h>
  28
  29
  30 ipsec_main_t ipsec_main;
  31
  32 u32
  33 ipsec_get_sa_index_by_sa_id (u32 sa_id)
  34 {
  35   ipsec_main_t *im = &ipsec_main;
  36   uword *p = hash_get (im->sa_index_by_sa_id, sa_id);
  37   if (!p)
  38     return ~0;
  39
  40   return p[0];
  41 }
  42
  43 int
  44 ipsec_set_interface_spd (vlib_main_t * vm, u32 sw_if_index, u32 spd_id,
  45                          int is_add)
  46 {
  47   ipsec_main_t *im = &ipsec_main;
  48   ip4_ipsec_config_t config;
  49
  50   u32 spd_index;
  51   uword *p;
  52
  53   p = hash_get (im->spd_index_by_spd_id, spd_id);
  54   if (!p)
  55     return VNET_API_ERROR_SYSCALL_ERROR_1;      /* no such spd-id */
  56
  57   spd_index = p[0];
  58
  59   p = hash_get (im->spd_index_by_sw_if_index, sw_if_index);
  60   if (p && is_add)
  61     return VNET_API_ERROR_SYSCALL_ERROR_1;      /* spd already assigned */
  62
  63   if (is_add)
  64     {
  65       hash_set (im->spd_index_by_sw_if_index, sw_if_index, spd_index);
  66     }
  67   else
  68     {
  69       hash_unset (im->spd_index_by_sw_if_index, sw_if_index);
  70     }
  71
  72   clib_warning ("sw_if_index %u spd_id %u spd_index %u",
  73                 sw_if_index, spd_id, spd_index);
  74
  75   /* enable IPsec on TX */
  76   vnet_feature_enable_disable ("ip4-output", "ipsec4-output", sw_if_index,
  77                                is_add, 0, 0);
  78   vnet_feature_enable_disable ("ip6-output", "ipsec6-output", sw_if_index,
  79                                is_add, 0, 0);
  80
  81   config.spd_index = spd_index;
  82
  83   /* enable IPsec on RX */
  84   vnet_feature_enable_disable ("ip4-unicast", "ipsec4-input", sw_if_index,
  85                                is_add, &config, sizeof (config));
  86   vnet_feature_enable_disable ("ip6-unicast", "ipsec6-input", sw_if_index,
  87                                is_add, &config, sizeof (config));
  88
  89   return 0;
  90 }
  91
  92 int
  93 ipsec_add_del_spd (vlib_main_t * vm, u32 spd_id, int is_add)
  94 {
  95   ipsec_main_t *im = &ipsec_main;
  96   ipsec_spd_t *spd = 0;
  97   uword *p;
  98   u32 spd_index, k, v;
  99
 100   p = hash_get (im->spd_index_by_spd_id, spd_id);
 101   if (p && is_add)
 102     return VNET_API_ERROR_INVALID_VALUE;
 103   if (!p && !is_add)
 104     return VNET_API_ERROR_INVALID_VALUE;
 105
 106   if (!is_add)                  /* delete */
 107     {
 108       spd_index = p[0];
 109       spd = pool_elt_at_index (im->spds, spd_index);
 110       if (!spd)
 111         return VNET_API_ERROR_INVALID_VALUE;
 112       /* *INDENT-OFF* */
 113       hash_foreach (k, v, im->spd_index_by_sw_if_index, ({
 114         if (v == spd_index)
 115           ipsec_set_interface_spd(vm, k, spd_id, 0);
 116       }));
 117       /* *INDENT-ON* */
 118       hash_unset (im->spd_index_by_spd_id, spd_id);
 119       pool_free (spd->policies);
 120       vec_free (spd->ipv4_outbound_policies);
 121       vec_free (spd->ipv6_outbound_policies);
 122       vec_free (spd->ipv4_inbound_protect_policy_indices);
 123       vec_free (spd->ipv4_inbound_policy_discard_and_bypass_indices);
 124       pool_put (im->spds, spd);
 125     }
 126   else                          /* create new SPD */
 127     {
 128       pool_get (im->spds, spd);
 129       memset (spd, 0, sizeof (*spd));
 130       spd_index = spd - im->spds;
 131       spd->id = spd_id;
 132       hash_set (im->spd_index_by_spd_id, spd_id, spd_index);
 133     }
 134   return 0;
 135 }
 136
 137 static int
 138 ipsec_spd_entry_sort (void *a1, void *a2)
 139 {
 140   u32 *id1 = a1;
 141   u32 *id2 = a2;
 142   ipsec_spd_t *spd = ipsec_main.spd_to_sort;
 143   ipsec_policy_t *p1, *p2;
 144
 145   p1 = pool_elt_at_index (spd->policies, *id1);
 146   p2 = pool_elt_at_index (spd->policies, *id2);
 147   if (p1 && p2)
 148     return p2->priority - p1->priority;
 149
 150   return 0;
 151 }
 152
 153 int
 154 ipsec_add_del_policy (vlib_main_t * vm, ipsec_policy_t * policy, int is_add)
 155 {
 156   ipsec_main_t *im = &ipsec_main;
 157   ipsec_spd_t *spd = 0;
 158   ipsec_policy_t *vp;
 159   uword *p;
 160   u32 spd_index;
 161
 162   clib_warning ("policy-id %u priority %d is_outbound %u", policy->id,
 163                 policy->priority, policy->is_outbound);
 164
 165   if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
 166     {
 167       p = hash_get (im->sa_index_by_sa_id, policy->sa_id);
 168       if (!p)
 169         return VNET_API_ERROR_SYSCALL_ERROR_1;
 170       policy->sa_index = p[0];
 171     }
 172
 173   p = hash_get (im->spd_index_by_spd_id, policy->id);
 174
 175   if (!p)
 176     return VNET_API_ERROR_SYSCALL_ERROR_1;
 177
 178   spd_index = p[0];
 179   spd = pool_elt_at_index (im->spds, spd_index);
 180   if (!spd)
 181     return VNET_API_ERROR_SYSCALL_ERROR_1;
 182
 183   if (is_add)
 184     {
 185       u32 policy_index;
 186
 187       pool_get (spd->policies, vp);
 188       clib_memcpy (vp, policy, sizeof (*vp));
 189       policy_index = vp - spd->policies;
 190
 191       ipsec_main.spd_to_sort = spd;
 192
 193       if (policy->is_outbound)
 194         {
 195           if (policy->is_ipv6)
 196             {
 197               vec_add1 (spd->ipv6_outbound_policies, policy_index);
 198               clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
 199               vec_sort_with_function (spd->ipv6_outbound_policies,
 200                                       ipsec_spd_entry_sort);
 201             }
 202           else
 203             {
 204               vec_add1 (spd->ipv4_outbound_policies, policy_index);
 205               clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
 206               vec_sort_with_function (spd->ipv4_outbound_policies,
 207                                       ipsec_spd_entry_sort);
 208             }
 209         }
 210       else
 211         {
 212           if (policy->is_ipv6)
 213             {
 214               if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
 215                 {
 216                   vec_add1 (spd->ipv6_inbound_protect_policy_indices,
 217                             policy_index);
 218                   clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
 219                   vec_sort_with_function
 220                     (spd->ipv6_inbound_protect_policy_indices,
 221                      ipsec_spd_entry_sort);
 222                 }
 223               else
 224                 {
 225                   vec_add1
 226                     (spd->ipv6_inbound_policy_discard_and_bypass_indices,
 227                      policy_index);
 228                   clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
 229                   vec_sort_with_function
 230                     (spd->ipv6_inbound_policy_discard_and_bypass_indices,
 231                      ipsec_spd_entry_sort);
 232                 }
 233             }
 234           else
 235             {
 236               if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
 237                 {
 238                   vec_add1 (spd->ipv4_inbound_protect_policy_indices,
 239                             policy_index);
 240                   clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
 241                   vec_sort_with_function
 242                     (spd->ipv4_inbound_protect_policy_indices,
 243                      ipsec_spd_entry_sort);
 244                 }
 245               else
 246                 {
 247                   vec_add1
 248                     (spd->ipv4_inbound_policy_discard_and_bypass_indices,
 249                      policy_index);
 250                   clib_memcpy (vp, policy, sizeof (ipsec_policy_t));
 251                   vec_sort_with_function
 252                     (spd->ipv4_inbound_policy_discard_and_bypass_indices,
 253                      ipsec_spd_entry_sort);
 254                 }
 255             }
 256         }
 257
 258       ipsec_main.spd_to_sort = NULL;
 259     }
 260   else
 261     {
 262       u32 i, j;
 263       /* *INDENT-OFF* */
 264       pool_foreach_index(i, spd->policies, ({
 265         vp = pool_elt_at_index(spd->policies, i);
 266         if (vp->priority != policy->priority)
 267           continue;
 268         if (vp->is_outbound != policy->is_outbound)
 269           continue;
 270         if (vp->policy != policy->policy)
 271           continue;
 272         if (vp->sa_id != policy->sa_id)
 273           continue;
 274         if (vp->protocol != policy->protocol)
 275           continue;
 276         if (vp->lport.start != policy->lport.start)
 277           continue;
 278         if (vp->lport.stop != policy->lport.stop)
 279           continue;
 280         if (vp->rport.start != policy->rport.start)
 281           continue;
 282         if (vp->rport.stop != policy->rport.stop)
 283           continue;
 284         if (vp->is_ipv6 != policy->is_ipv6)
 285           continue;
 286         if (policy->is_ipv6)
 287           {
 288             if (vp->laddr.start.ip6.as_u64[0] != policy->laddr.start.ip6.as_u64[0])
 289               continue;
 290             if (vp->laddr.start.ip6.as_u64[1] != policy->laddr.start.ip6.as_u64[1])
 291               continue;
 292             if (vp->laddr.stop.ip6.as_u64[0] != policy->laddr.stop.ip6.as_u64[0])
 293               continue;
 294             if (vp->laddr.stop.ip6.as_u64[1] != policy->laddr.stop.ip6.as_u64[1])
 295               continue;
 296             if (vp->raddr.start.ip6.as_u64[0] != policy->raddr.start.ip6.as_u64[0])
 297               continue;
 298             if (vp->raddr.start.ip6.as_u64[1] != policy->raddr.start.ip6.as_u64[1])
 299               continue;
 300             if (vp->raddr.stop.ip6.as_u64[0] != policy->raddr.stop.ip6.as_u64[0])
 301               continue;
 302            if (vp->laddr.stop.ip6.as_u64[1] != policy->laddr.stop.ip6.as_u64[1])
 303               continue;
 304            if (policy->is_outbound)
 305              {
 306                vec_foreach_index(j, spd->ipv6_outbound_policies) {
 307                  if (vec_elt(spd->ipv6_outbound_policies, j) == i) {
 308                    vec_del1 (spd->ipv6_outbound_policies, j);
 309                    break;
 310                  }
 311                }
 312              }
 313            else
 314              {
 315                if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
 316                  {
 317                    vec_foreach_index(j, spd->ipv6_inbound_protect_policy_indices) {
 318                      if (vec_elt(spd->ipv6_inbound_protect_policy_indices, j) == i) {
 319                        vec_del1 (spd->ipv6_inbound_protect_policy_indices, j);
 320                        break;
 321                      }
 322                    }
 323                  }
 324                else
 325                  {
 326                    vec_foreach_index(j, spd->ipv6_inbound_policy_discard_and_bypass_indices) {
 327                      if (vec_elt(spd->ipv6_inbound_policy_discard_and_bypass_indices, j) == i) {
 328                        vec_del1 (spd->ipv6_inbound_policy_discard_and_bypass_indices, j);
 329                        break;
 330                      }
 331                    }
 332                  }
 333              }
 334           }
 335         else
 336           {
 337             if (vp->laddr.start.ip4.as_u32 != policy->laddr.start.ip4.as_u32)
 338               continue;
 339             if (vp->laddr.stop.ip4.as_u32 != policy->laddr.stop.ip4.as_u32)
 340               continue;
 341             if (vp->raddr.start.ip4.as_u32 != policy->raddr.start.ip4.as_u32)
 342               continue;
 343             if (vp->raddr.stop.ip4.as_u32 != policy->raddr.stop.ip4.as_u32)
 344               continue;
 345             if (policy->is_outbound)
 346               {
 347                 vec_foreach_index(j, spd->ipv4_outbound_policies) {
 348                   if (vec_elt(spd->ipv4_outbound_policies, j) == i) {
 349                     vec_del1 (spd->ipv4_outbound_policies, j);
 350                     break;
 351                   }
 352                 }
 353               }
 354             else
 355               {
 356                 if (policy->policy == IPSEC_POLICY_ACTION_PROTECT)
 357                   {
 358                     vec_foreach_index(j, spd->ipv4_inbound_protect_policy_indices) {
 359                       if (vec_elt(spd->ipv4_inbound_protect_policy_indices, j) == i) {
 360                         vec_del1 (spd->ipv4_inbound_protect_policy_indices, j);
 361                         break;
 362                       }
 363                     }
 364                   }
 365                 else
 366                   {
 367                     vec_foreach_index(j, spd->ipv4_inbound_policy_discard_and_bypass_indices) {
 368                       if (vec_elt(spd->ipv4_inbound_policy_discard_and_bypass_indices, j) == i) {
 369                         vec_del1 (spd->ipv4_inbound_policy_discard_and_bypass_indices, j);
 370                         break;
 371                       }
 372                     }
 373                   }
 374               }
 375           }
 376           pool_put (spd->policies, vp);
 377           break;
 378       }));
 379       /* *INDENT-ON* */
 380     }
 381
 382   return 0;
 383 }
 384
 385 u8
 386 ipsec_is_sa_used (u32 sa_index)
 387 {
 388   ipsec_main_t *im = &ipsec_main;
 389   ipsec_spd_t *spd;
 390   ipsec_policy_t *p;
 391   ipsec_tunnel_if_t *t;
 392
 393   /* *INDENT-OFF* */
 394   pool_foreach(spd, im->spds, ({
 395     pool_foreach(p, spd->policies, ({
 396       if (p->policy == IPSEC_POLICY_ACTION_PROTECT)
 397         {
 398           if (p->sa_index == sa_index)
 399             return 1;
 400         }
 401     }));
 402   }));
 403
 404   pool_foreach(t, im->tunnel_interfaces, ({
 405     if (t->input_sa_index == sa_index)
 406       return 1;
 407     if (t->output_sa_index == sa_index)
 408       return 1;
 409   }));
 410   /* *INDENT-ON* */
 411
 412   return 0;
 413 }
 414
 415 int
 416 ipsec_add_del_sa (vlib_main_t * vm, ipsec_sa_t * new_sa, int is_add)
 417 {
 418   ipsec_main_t *im = &ipsec_main;
 419   ipsec_sa_t *sa = 0;
 420   uword *p;
 421   u32 sa_index;
 422   clib_error_t *err;
 423
 424   clib_warning ("id %u spi %u", new_sa->id, new_sa->spi);
 425
 426   p = hash_get (im->sa_index_by_sa_id, new_sa->id);
 427   if (p && is_add)
 428     return VNET_API_ERROR_SYSCALL_ERROR_1;      /* already exists */
 429   if (!p && !is_add)
 430     return VNET_API_ERROR_SYSCALL_ERROR_1;
 431
 432   if (!is_add)                  /* delete */
 433     {
 434       sa_index = p[0];
 435       sa = pool_elt_at_index (im->sad, sa_index);
 436       if (ipsec_is_sa_used (sa_index))
 437         {
 438           clib_warning ("sa_id %u used in policy", sa->id);
 439           return VNET_API_ERROR_SYSCALL_ERROR_1;        /* sa used in policy */
 440         }
 441       hash_unset (im->sa_index_by_sa_id, sa->id);
 442       if (im->cb.add_del_sa_sess_cb)
 443         {
 444           err = im->cb.add_del_sa_sess_cb (sa_index, 0);
 445           if (err)
 446             return VNET_API_ERROR_SYSCALL_ERROR_1;
 447         }
 448       pool_put (im->sad, sa);
 449     }
 450   else                          /* create new SA */
 451     {
 452       pool_get (im->sad, sa);
 453       clib_memcpy (sa, new_sa, sizeof (*sa));
 454       sa_index = sa - im->sad;
 455       hash_set (im->sa_index_by_sa_id, sa->id, sa_index);
 456       if (im->cb.add_del_sa_sess_cb)
 457         {
 458           err = im->cb.add_del_sa_sess_cb (sa_index, 1);
 459           if (err)
 460             return VNET_API_ERROR_SYSCALL_ERROR_1;
 461         }
 462     }
 463   return 0;
 464 }
 465
 466 int
 467 ipsec_set_sa_key (vlib_main_t * vm, ipsec_sa_t * sa_update)
 468 {
 469   ipsec_main_t *im = &ipsec_main;
 470   uword *p;
 471   u32 sa_index;
 472   ipsec_sa_t *sa = 0;
 473   clib_error_t *err;
 474
 475   p = hash_get (im->sa_index_by_sa_id, sa_update->id);
 476   if (!p)
 477     return VNET_API_ERROR_SYSCALL_ERROR_1;      /* no such sa-id */
 478
 479   sa_index = p[0];
 480   sa = pool_elt_at_index (im->sad, sa_index);
 481
 482   /* new crypto key */
 483   if (0 < sa_update->crypto_key_len)
 484     {
 485       clib_memcpy (sa->crypto_key, sa_update->crypto_key,
 486                    sa_update->crypto_key_len);
 487       sa->crypto_key_len = sa_update->crypto_key_len;
 488     }
 489
 490   /* new integ key */
 491   if (0 < sa_update->integ_key_len)
 492     {
 493       clib_memcpy (sa->integ_key, sa_update->integ_key,
 494                    sa_update->integ_key_len);
 495       sa->integ_key_len = sa_update->integ_key_len;
 496     }
 497
 498   if (0 < sa_update->crypto_key_len || 0 < sa_update->integ_key_len)
 499     {
 500       if (im->cb.add_del_sa_sess_cb)
 501         {
 502           err = im->cb.add_del_sa_sess_cb (sa_index, 0);
 503           if (err)
 504             return VNET_API_ERROR_SYSCALL_ERROR_1;
 505         }
 506     }
 507
 508   return 0;
 509 }
 510
 511 static void
 512 ipsec_rand_seed (void)
 513 {
 514   struct
 515   {
 516     time_t time;
 517     pid_t pid;
 518     void *p;
 519   } seed_data;
 520
 521   seed_data.time = time (NULL);
 522   seed_data.pid = getpid ();
 523   seed_data.p = (void *) &seed_data;
 524
 525   RAND_seed ((const void *) &seed_data, sizeof (seed_data));
 526 }
 527
 528 static clib_error_t *
 529 ipsec_check_support (ipsec_sa_t * sa)
 530 {
 531   if (sa->crypto_alg == IPSEC_CRYPTO_ALG_AES_GCM_128)
 532     return clib_error_return (0, "unsupported aes-gcm-128 crypto-alg");
 533   if (sa->integ_alg == IPSEC_INTEG_ALG_NONE)
 534     return clib_error_return (0, "unsupported none integ-alg");
 535
 536   return 0;
 537 }
 538
 539 static clib_error_t *
 540 ipsec_init (vlib_main_t * vm)
 541 {
 542   clib_error_t *error;
 543   ipsec_main_t *im = &ipsec_main;
 544   vlib_thread_main_t *tm = vlib_get_thread_main ();
 545   vlib_node_t *node;
 546
 547   ipsec_rand_seed ();
 548
 549   memset (im, 0, sizeof (im[0]));
 550
 551   im->vnet_main = vnet_get_main ();
 552   im->vlib_main = vm;
 553
 554   im->spd_index_by_spd_id = hash_create (0, sizeof (uword));
 555   im->sa_index_by_sa_id = hash_create (0, sizeof (uword));
 556   im->spd_index_by_sw_if_index = hash_create (0, sizeof (uword));
 557
 558   vec_validate_aligned (im->empty_buffers, tm->n_vlib_mains - 1,
 559                         CLIB_CACHE_LINE_BYTES);
 560
 561   node = vlib_get_node_by_name (vm, (u8 *) "error-drop");
 562   ASSERT (node);
 563   im->error_drop_node_index = node->index;
 564
 565   node = vlib_get_node_by_name (vm, (u8 *) "esp4-encrypt");
 566   ASSERT (node);
 567   im->esp4_encrypt_node_index = node->index;
 568
 569   node = vlib_get_node_by_name (vm, (u8 *) "esp4-decrypt");
 570   ASSERT (node);
 571   im->esp4_decrypt_node_index = node->index;
 572
 573   node = vlib_get_node_by_name (vm, (u8 *) "ah4-encrypt");
 574   ASSERT (node);
 575   im->ah4_encrypt_node_index = node->index;
 576
 577   node = vlib_get_node_by_name (vm, (u8 *) "ah4-decrypt");
 578   ASSERT (node);
 579   im->ah4_decrypt_node_index = node->index;
 580
 581   im->esp4_encrypt_next_index = IPSEC_OUTPUT_NEXT_ESP4_ENCRYPT;
 582   im->esp4_decrypt_next_index = IPSEC_INPUT_NEXT_ESP4_DECRYPT;
 583   im->ah4_encrypt_next_index = IPSEC_OUTPUT_NEXT_AH4_ENCRYPT;
 584   im->ah4_decrypt_next_index = IPSEC_INPUT_NEXT_AH4_DECRYPT;
 585
 586   node = vlib_get_node_by_name (vm, (u8 *) "esp6-encrypt");
 587   ASSERT (node);
 588   im->esp6_encrypt_node_index = node->index;
 589
 590   node = vlib_get_node_by_name (vm, (u8 *) "esp6-decrypt");
 591   ASSERT (node);
 592   im->esp6_decrypt_node_index = node->index;
 593
 594   node = vlib_get_node_by_name (vm, (u8 *) "ah6-encrypt");
 595   ASSERT (node);
 596   im->ah6_encrypt_node_index = node->index;
 597
 598   node = vlib_get_node_by_name (vm, (u8 *) "ah6-decrypt");
 599   ASSERT (node);
 600   im->ah6_decrypt_node_index = node->index;
 601
 602   im->esp6_encrypt_next_index = IPSEC_OUTPUT_NEXT_ESP6_ENCRYPT;
 603   im->esp6_decrypt_next_index = IPSEC_INPUT_NEXT_ESP6_DECRYPT;
 604   im->ah6_encrypt_next_index = IPSEC_OUTPUT_NEXT_AH6_ENCRYPT;
 605   im->ah6_decrypt_next_index = IPSEC_INPUT_NEXT_AH6_DECRYPT;
 606
 607   im->cb.check_support_cb = ipsec_check_support;
 608
 609   if ((error = vlib_call_init_function (vm, ipsec_cli_init)))
 610     return error;
 611
 612   if ((error = vlib_call_init_function (vm, ipsec_tunnel_if_init)))
 613     return error;
 614
 615   ipsec_proto_init ();
 616
 617   if ((error = ikev2_init (vm)))
 618     return error;
 619
 620   return 0;
 621 }
 622
 623 VLIB_INIT_FUNCTION (ipsec_init);
 624
 625 /*
 626  * fd.io coding-style-patch-verification: ON
 627  *
 628  * Local Variables:
 629  * eval: (c-set-style "gnu")
 630  * End:
 631  */