Move java,lua api and remaining plugins to src/

Change-Id: I1c3b87e886603678368428ae56a6bd3327cbc90d
Signed-off-by: Damjan Marion <damarion@cisco.com>

8 files changed, 1633 insertions, 0 deletions

diff --git a/src/plugins/ioam/lib-pot/math64.h b/src/plugins/ioam/lib-pot/math64.h
new file mode 100644
index 00000000000..4c608a37de4
--- /dev/null
+++ b/src/plugins/ioam/lib-pot/math64.h
@@ -0,0 +1,159 @@
+/* 
+ * math64.h provides the 64 bit unsigned integer add, multiply followed by  modulo operation
+ * The linux/math64.h provides divide and multiply 64 bit integers but:
+ * 1. multiply: mul_u64_u64_shr - only returns 64 bits of the result and has to be called
+ *                     twice to get the complete 128 bits of the result.
+ * 2. Modulo operation of the result of  addition and multiplication of u64 that may result 
+ *                        in integers > 64 bits is not supported
+ * Hence this header to combine add/multiply followed by modulo of u64 integrers
+ * always resulting in u64.
+ * 
+ * Copyright (c) 2016 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#ifndef include_vnet_math64_h
+#define include_vnet_math64_h
+#include <stdint.h>
+
+/* 
+ * multiplies and returns result in hi and lo 
+ */
+static inline void mul64by64(u64 a, u64 b, u64 * hi, u64 * lo)
+{
+    u64 a_lo = (u64) (uint32_t) a;
+    u64 a_hi = a >> 32;
+    u64 b_lo = (u64) (u32) b;
+    u64 b_hi = b >> 32;
+
+    u64 p0 = a_lo * b_lo;
+    u64 p1 = a_lo * b_hi;
+    u64 p2 = a_hi * b_lo;
+    u64 p3 = a_hi * b_hi;
+
+    u32 cy = (u32) (((p0 >> 32) + (u32) p1 + (u32) p2) >> 32);
+
+    *lo = p0 + (p1 << 32) + (p2 << 32);
+    *hi = p3 + (p1 >> 32) + (p2 >> 32) + cy;
+    return;
+}
+
+#define TWO64 18446744073709551616.0
+
+static inline u64 mod128by64(u64 x, u64 y, u64 m, double di)
+{
+    u64 q1, q2, q;
+    u64 p1, p0;
+    double dq;
+
+    /* calculate quotient first pass 53 bits */
+    dq = (TWO64 * (double)x + (double)y) * di;
+
+    if (dq >= TWO64)
+        q1 = 0xfffffffffffff800L;
+    else
+        q1 = dq;
+
+    /* q1 * m to compare the product to the dividend.  */
+    mul64by64(q1, m, &p1, &p0);
+
+    /* Adjust quotient. is it > actual result: */
+    if (x < p1 || (x == p1 && y < p0))
+    {
+        /* q1 > quotient.  calculate abs remainder */
+        x = p1 - (x + (p0 < y));
+        y = p0 - y;
+
+        /* use the remainder as new dividend to adjust quotient */
+        q2 = (u64) ((TWO64 * (double)x + (double)y) * di);
+        mul64by64(q2, m, &p1, &p0);
+
+        q = q1 - q2;
+        if (x < p1 || (x == p1 && y <= p0))
+        {
+            y = p0 - y;
+        }
+        else
+        {
+            y = p0 - y;
+            y += m;
+            q--;
+        }
+    }
+    else
+    {
+        x = x - (p1 + (y < p0));
+        y = y - p0;
+
+        q2 = (u64) ((TWO64 * (double)x + (double)y) * di);
+        mul64by64(q2, m, &p1, &p0);
+
+        q = q1 + q2;
+        if (x < p1 || (x == p1 && y < p0))
+        {
+            y = y - p0;
+            y += m;
+            q--;
+        }
+        else
+        {
+            y = y - p0;
+            if (y >= m)
+            {
+                y -= m;
+                q++;
+            }
+        }
+    }
+
+    return y;
+}
+
+/* 
+ * returns a % p
+ */
+static inline u64 mod64by64(u64 a, u64 p, u64 primeinv)
+{
+    return (mod128by64(0, a, p, primeinv));
+}
+
+static inline void add64(u64 a, u64 b, u64 * whi, u64 * wlo)
+{
+    *wlo = a + b;
+    if (*wlo < a)
+        *whi = 1;
+
+}
+
+/* 
+ * returns (a + b)%p
+ */
+static inline u64 add64_mod(u64 a, u64 b, u64 p, double pi)
+{
+    u64 shi = 0, slo = 0;
+
+    add64(a, b, &shi, &slo);
+    return (mod128by64(shi, slo, p, pi));
+}
+
+/* 
+ * returns (ab) % p
+ */
+static inline u64 mul64_mod(u64 a, u64 b, u64 p, double pi)
+{
+    u64 phi = 0, plo = 0;
+
+    mul64by64(a, b, &phi, &plo);
+    return (mod128by64(phi, plo, p, pi));
+}
+
+#endif
diff --git a/src/plugins/ioam/lib-pot/pot.api b/src/plugins/ioam/lib-pot/pot.api
new file mode 100644
index 00000000000..fa2fc126b7e
--- /dev/null
+++ b/src/plugins/ioam/lib-pot/pot.api
@@ -0,0 +1,133 @@
+/* Hey Emacs use -*- mode: C -*- */
+/*
+ * Copyright (c) 2016 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+/** \brief Proof of Transit(POT): Set POT profile
+    @param id - id of the profile 
+    @param validator - True/False to indicate if this is verifier
+    @param secret_key - Verification key
+    @param secret_share - Share of the 1st polynomial
+    @param prime - Prime number used for modulo operation
+    @param max_bits - Max bits to be used for Random number generation
+    @param lpc - Lagrange basis polynomial
+    @param polynomial_public - pre-evaluated public polynomial 
+    @param list_name_len - length of the name of this profile list
+    @param list_name - name of this profile list
+*/
+define pot_profile_add {
+  u32 client_index;
+  u32 context;
+  u8 id;
+  u8 validator;
+  u64 secret_key;
+  u64 secret_share;
+  u64 prime;
+  u8  max_bits;
+  u64 lpc;
+  u64 polynomial_public;
+  u8 list_name_len;
+  u8 list_name[0];
+};
+
+/** \brief Proof of Transit profile add / del response
+    @param context - sender context, to match reply w/ request
+    @param retval - return value for request
+*/
+define pot_profile_add_reply {
+    u32 context;
+    i32 retval;
+};
+
+
+/** \brief Proof of Transit(POT): Activate POT profile in the list
+    @param id - id of the profile 
+    @param list_name_len - length of the name of this profile list
+    @param list_name - name of this profile list
+*/
+define pot_profile_activate {
+  u32 client_index;
+  u32 context;
+  u8 id;
+  u8 list_name_len;
+  u8 list_name[0];
+};
+
+/** \brief Proof of Transit profile activate response
+    @param context - sender context, to match reply w/ request
+    @param retval - return value for request 
+*/
+define pot_profile_activate_reply {
+  u32 context;
+  i32 retval;
+};
+
+/** \brief Delete POT Profile 
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+    @param list_name_len - length of the name of the profile list
+    @param list_name - name of profile list to delete
+*/
+define pot_profile_del {
+  u32 client_index;
+  u32 context;
+  u8 list_name_len;
+  u8 list_name[0];
+};
+
+/** \brief Proof of Transit profile add / del response
+    @param context - sender context, to match reply w/ request
+    @param retval - return value for request
+*/
+define pot_profile_del_reply {
+    u32 context;
+    i32 retval;
+};
+
+/** \brief Show POT Profiles
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+    @param id - id of the profile
+*/
+define pot_profile_show_config_dump {
+  u32 client_index;
+  u32 context;
+  u8 id;
+};
+
+/** \brief Show POT profile reply
+    @param id - id of the profile
+    @param validator - True/False to indicate if this is verifier
+    @param secret_key - Verification key
+    @param secret_share - Share of the 1st polynomial
+    @param prime - Prime number used for modulo operation
+    @param max_bits - Max bits to be used for Random number generation
+    @param lpc - Lagrange basis polynomial
+    @param polynomial_public - pre-evaluated public polynomial
+    @param list_name_len - length of the name of this profile list
+    @param list_name - name of this profile list
+*/
+define pot_profile_show_config_details {
+  u32 context;
+  i32 retval;
+  u8 id;
+  u8 validator;
+  u64 secret_key;
+  u64 secret_share;
+  u64 prime;
+  u64 bit_mask;
+  u64 lpc;
+  u64 polynomial_public;
+};
diff --git a/src/plugins/ioam/lib-pot/pot_all_api_h.h b/src/plugins/ioam/lib-pot/pot_all_api_h.h
new file mode 100644
index 00000000000..63967c45444
--- /dev/null
+++ b/src/plugins/ioam/lib-pot/pot_all_api_h.h
@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) 2016 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/* Include the generated file, see BUILT_SOURCES in Makefile.am */
+#include <ioam/lib-pot/pot.api.h>
diff --git a/src/plugins/ioam/lib-pot/pot_api.c b/src/plugins/ioam/lib-pot/pot_api.c
new file mode 100644
index 00000000000..d3af7b4036a
--- /dev/null
+++ b/src/plugins/ioam/lib-pot/pot_api.c
@@ -0,0 +1,292 @@
+/*
+ * Copyright (c) 2016 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*
+ *------------------------------------------------------------------
+ * pot_api.c - Proof of Transit related APIs to create 
+ *             and maintain profiles
+ *------------------------------------------------------------------
+ */
+
+#include <vnet/vnet.h>
+#include <vnet/plugin/plugin.h>
+#include <ioam/lib-pot/pot_util.h>
+
+#include <vlibapi/api.h>
+#include <vlibmemory/api.h>
+#include <vlibsocket/api.h>
+
+/* define message IDs */
+#include <ioam/lib-pot/pot_msg_enum.h>
+
+/* define message structures */
+#define vl_typedefs
+#include <ioam/lib-pot/pot_all_api_h.h>
+#undef vl_typedefs
+
+/* define generated endian-swappers */
+#define vl_endianfun
+#include <ioam/lib-pot/pot_all_api_h.h>
+#undef vl_endianfun
+
+/* instantiate all the print functions we know about */
+#define vl_print(handle, ...) vlib_cli_output (handle, __VA_ARGS__)
+#define vl_printfun
+#include <ioam/lib-pot/pot_all_api_h.h>
+#undef vl_printfun
+
+/* Get the API version number */
+#define vl_api_version(n,v) static u32 api_version=(v);
+#include <ioam/lib-pot/pot_all_api_h.h>
+#undef vl_api_version
+
+/* 
+ * A handy macro to set up a message reply.
+ * Assumes that the following variables are available:
+ * mp - pointer to request message
+ * rmp - pointer to reply message type
+ * rv - return value
+ */
+
+#define REPLY_MACRO(t)                                          \
+do {                                                            \
+    unix_shared_memory_queue_t * q =                            \
+    vl_api_client_index_to_input_queue (mp->client_index);      \
+    if (!q)                                                     \
+        return;                                                 \
+                                                                \
+    rmp = vl_msg_api_alloc (sizeof (*rmp));                     \
+    rmp->_vl_msg_id = ntohs((t)+sm->msg_id_base);               \
+    rmp->context = mp->context;                                 \
+    rmp->retval = ntohl(rv);                                    \
+                                                                \
+    vl_msg_api_send_shmem (q, (u8 *)&rmp);                      \
+} while(0);
+
+#define REPLY_MACRO2(t, body)                                   \
+do {                                                            \
+    unix_shared_memory_queue_t * q;                             \
+    rv = vl_msg_api_pd_handler (mp, rv);                        \
+    q = vl_api_client_index_to_input_queue (mp->client_index);  \
+    if (!q)                                                     \
+        return;                                                 \
+                                                                \
+    rmp = vl_msg_api_alloc (sizeof (*rmp));                     \
+    rmp->_vl_msg_id = ntohs((t)+sm->msg_id_base);               \
+    rmp->context = mp->context;                                 \
+    rmp->retval = ntohl(rv);                                    \
+    do {body;} while (0);                                       \
+    vl_msg_api_send_shmem (q, (u8 *)&rmp);                      \
+} while(0);
+
+/* List of message types that this plugin understands */
+
+#define foreach_pot_plugin_api_msg                                      \
+_(POT_PROFILE_ADD, pot_profile_add)                                     \
+_(POT_PROFILE_ACTIVATE, pot_profile_activate)                           \
+_(POT_PROFILE_DEL, pot_profile_del)                                     \
+_(POT_PROFILE_SHOW_CONFIG_DUMP, pot_profile_show_config_dump)                                     \
+
+static void vl_api_pot_profile_add_t_handler
+(vl_api_pot_profile_add_t *mp)
+{
+    pot_main_t * sm = &pot_main;
+    int rv = 0;
+    vl_api_pot_profile_add_reply_t * rmp;
+    u8 id;
+    pot_profile *profile = NULL;
+    u8 *name = 0;
+
+    if (mp->list_name_len)
+        name = format(0, "%s", mp->list_name);
+
+    pot_profile_list_init(name);
+    id = mp->id;
+    profile = pot_profile_find(id);
+    if (profile) {
+	rv = pot_profile_create(profile,
+				clib_net_to_host_u64(mp->prime),
+				clib_net_to_host_u64(mp->polynomial_public),
+				clib_net_to_host_u64(mp->lpc),
+				clib_net_to_host_u64(mp->secret_share));
+	if (rv != 0)
+            goto ERROROUT;
+	if (1 == mp->validator)
+	  (void)pot_set_validator(profile, clib_net_to_host_u64(mp->secret_key));
+        (void)pot_profile_set_bit_mask(profile, mp->max_bits);
+    } else {
+        rv = -3;
+    }  
+ ERROROUT:
+    vec_free(name);
+    REPLY_MACRO(VL_API_POT_PROFILE_ADD_REPLY);
+}
+
+static void send_pot_profile_details(vl_api_pot_profile_show_config_dump_t *mp, u8 id)
+{
+    vl_api_pot_profile_show_config_details_t * rmp;
+    pot_main_t * sm = &pot_main;
+    pot_profile *profile = pot_profile_find(id);
+    int rv = 0;
+    if(profile){
+        REPLY_MACRO2(VL_API_POT_PROFILE_SHOW_CONFIG_DETAILS,
+			rmp->id=id;
+			rmp->validator=profile->validator;
+			rmp->secret_key=clib_host_to_net_u64(profile->secret_key);
+			rmp->secret_share=clib_host_to_net_u64(profile->secret_share);
+			rmp->prime=clib_host_to_net_u64(profile->prime);
+			rmp->bit_mask=clib_host_to_net_u64(profile->bit_mask);
+			rmp->lpc=clib_host_to_net_u64(profile->lpc);
+			rmp->polynomial_public=clib_host_to_net_u64(profile->poly_pre_eval);
+			);
+    }
+    else{
+        REPLY_MACRO2(VL_API_POT_PROFILE_SHOW_CONFIG_DETAILS,
+			rmp->id=id;
+			rmp->validator=0;
+			rmp->secret_key=0;
+			rmp->secret_share=0;
+			rmp->prime=0;
+			rmp->bit_mask=0;
+			rmp->lpc=0;
+			rmp->polynomial_public=0;
+			);
+    }
+}
+
+static void vl_api_pot_profile_show_config_dump_t_handler
+(vl_api_pot_profile_show_config_dump_t *mp)
+{
+    u8 id = mp->id;
+    u8 dump_call_id = ~0;
+    if(dump_call_id==id){
+        for(id=0;id<MAX_POT_PROFILES;id++)
+	    send_pot_profile_details(mp,id);
+    }
+    else
+        send_pot_profile_details(mp,id);
+}
+
+static void vl_api_pot_profile_activate_t_handler
+(vl_api_pot_profile_activate_t *mp)
+{
+    pot_main_t * sm = &pot_main;
+    int rv = 0;
+    vl_api_pot_profile_add_reply_t * rmp;
+    u8 id;
+    u8 *name = NULL;
+
+    if (mp->list_name_len)
+        name = format(0, "%s", mp->list_name);
+    if (!pot_profile_list_is_enabled(name)) {
+        rv = -1;
+    } else {
+        id = mp->id;
+	rv = pot_profile_set_active(id);
+    }
+     
+    vec_free(name);
+    REPLY_MACRO(VL_API_POT_PROFILE_ACTIVATE_REPLY);
+}
+
+
+static void vl_api_pot_profile_del_t_handler
+(vl_api_pot_profile_del_t *mp)
+{
+    pot_main_t * sm = &pot_main;
+    int rv = 0;
+    vl_api_pot_profile_del_reply_t * rmp;
+
+    clear_pot_profiles();
+
+    REPLY_MACRO(VL_API_POT_PROFILE_DEL_REPLY);
+}
+
+
+/* 
+ * This routine exists to convince the vlib plugin framework that
+ * we haven't accidentally copied a random .dll into the plugin directory.
+ *
+ * Also collects global variable pointers passed from the vpp engine
+ */
+
+clib_error_t * 
+vlib_plugin_register (vlib_main_t * vm, vnet_plugin_handoff_t * h,
+                      int from_early_init)
+{
+  pot_main_t * sm = &pot_main;
+  clib_error_t * error = 0;
+
+  sm->vlib_main = vm;
+  sm->vnet_main = h->vnet_main;
+  return error;
+}
+
+/* Set up the API message handling tables */
+static clib_error_t *
+pot_plugin_api_hookup (vlib_main_t *vm)
+{
+  pot_main_t * sm = &pot_main;
+#define _(N,n)                                                  \
+    vl_msg_api_set_handlers((VL_API_##N + sm->msg_id_base),     \
+                           #n,					\
+                           vl_api_##n##_t_handler,              \
+                           vl_noop_handler,                     \
+                           vl_api_##n##_t_endian,               \
+                           vl_api_##n##_t_print,                \
+                           sizeof(vl_api_##n##_t), 1); 
+    foreach_pot_plugin_api_msg;
+#undef _
+
+    return 0;
+}
+
+#define vl_msg_name_crc_list
+#include <ioam/lib-pot/pot_all_api_h.h>
+#undef vl_msg_name_crc_list
+
+static void
+setup_message_id_table (pot_main_t * sm, api_main_t * am)
+{
+#define _(id,n,crc) \
+  vl_msg_api_add_msg_name_crc (am, #n "_" #crc, id + sm->msg_id_base);
+  foreach_vl_msg_name_crc_pot;
+#undef _
+}
+
+static clib_error_t * pot_init (vlib_main_t * vm)
+{
+  pot_main_t * sm = &pot_main;
+  clib_error_t * error = 0;
+  u8 * name;
+
+  bzero(sm, sizeof(pot_main));
+  (void)pot_util_init();
+  name = format (0, "ioam_pot_%08x%c", api_version, 0);
+
+  /* Ask for a correctly-sized block of API message decode slots */
+  sm->msg_id_base = vl_msg_api_get_msg_ids 
+      ((char *) name, VL_MSG_FIRST_AVAILABLE);
+
+  error = pot_plugin_api_hookup (vm);
+
+  /* Add our API messages to the global name_crc hash table */
+  setup_message_id_table (sm, &api_main);
+
+  vec_free(name);
+
+  return error;
+}
+
+VLIB_INIT_FUNCTION (pot_init);
diff --git a/src/plugins/ioam/lib-pot/pot_msg_enum.h b/src/plugins/ioam/lib-pot/pot_msg_enum.h
new file mode 100644
index 00000000000..a4a88bed20f
--- /dev/null
+++ b/src/plugins/ioam/lib-pot/pot_msg_enum.h
@@ -0,0 +1,28 @@
+/*
+ * Copyright (c) 2016 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#ifndef included_pot_msg_enum_h
+#define included_pot_msg_enum_h
+
+#include <vppinfra/byte_order.h>
+
+#define vl_msg_id(n,h) n,
+typedef enum {
+#include <ioam/lib-pot/pot_all_api_h.h>
+    /* We'll want to know how many messages IDs we need... */
+    VL_MSG_FIRST_AVAILABLE,
+} vl_msg_id_t;
+#undef vl_msg_id
+
+#endif /* included_pot_msg_enum_h */
diff --git a/src/plugins/ioam/lib-pot/pot_test.c b/src/plugins/ioam/lib-pot/pot_test.c
new file mode 100644
index 00000000000..2e87023896e
--- /dev/null
+++ b/src/plugins/ioam/lib-pot/pot_test.c
@@ -0,0 +1,365 @@
+/*
+ * Copyright (c) 2016 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*
+ *------------------------------------------------------------------
+ * pot_test.c - test harness for pot plugin
+ *------------------------------------------------------------------
+ */
+
+#include <vat/vat.h>
+#include <vlibapi/api.h>
+#include <vlibmemory/api.h>
+#include <vlibsocket/api.h>
+#include <vppinfra/error.h>
+
+/* Declare message IDs */
+#include <ioam/lib-pot/pot_msg_enum.h>
+
+/* define message structures */
+#define vl_typedefs
+#include <ioam/lib-pot/pot_all_api_h.h>
+#undef vl_typedefs
+
+/* declare message handlers for each api */
+
+#define vl_endianfun             /* define message structures */
+#include <ioam/lib-pot/pot_all_api_h.h>
+#undef vl_endianfun
+
+/* instantiate all the print functions we know about */
+#define vl_print(handle, ...)
+#define vl_printfun
+#include <ioam/lib-pot/pot_all_api_h.h>
+#undef vl_printfun
+
+/* Get the API version number. */
+#define vl_api_version(n,v) static u32 api_version=(v);
+#include <ioam/lib-pot/pot_all_api_h.h>
+#undef vl_api_version
+
+
+typedef struct {
+    /* API message ID base */
+    u16 msg_id_base;
+    vat_main_t *vat_main;
+} pot_test_main_t;
+
+pot_test_main_t pot_test_main;
+
+#define foreach_standard_reply_retval_handler     \
+_(pot_profile_add_reply)                          \
+_(pot_profile_activate_reply)                     \
+_(pot_profile_del_reply)
+
+#define foreach_custom_reply_retval_handler     		\
+_(pot_profile_show_config_details,				\
+    errmsg("		ID:%d\n",mp->id);			\
+    errmsg("	 Validator:%d\n",mp->validator);		\
+    errmsg("	secret_key:%Lx\n",clib_net_to_host_u64(mp->secret_key));		\
+    errmsg("  secret_share:%Lx\n",clib_net_to_host_u64(mp->secret_share));		\
+    errmsg("  	     prime:%Lx\n",clib_net_to_host_u64(mp->prime));			\
+    errmsg("  	   bitmask:%Lx\n",clib_net_to_host_u64(mp->bit_mask));		\
+    errmsg("  	       lpc:%Lx\n",clib_net_to_host_u64(mp->lpc));			\
+    errmsg("   public poly:%Lx\n",clib_net_to_host_u64(mp->polynomial_public));	\
+		)
+
+#define _(n)                                            \
+    static void vl_api_##n##_t_handler                  \
+    (vl_api_##n##_t * mp)                               \
+    {                                                   \
+        vat_main_t * vam = pot_test_main.vat_main;   \
+        i32 retval = ntohl(mp->retval);                 \
+        if (vam->async_mode) {                          \
+            vam->async_errors += (retval < 0);          \
+        } else {                                        \
+            vam->retval = retval;                       \
+            vam->result_ready = 1;                      \
+        }                                               \
+    }
+foreach_standard_reply_retval_handler;
+#undef _
+
+#define _(n,body)                                       \
+    static void vl_api_##n##_t_handler                  \
+    (vl_api_##n##_t * mp)                               \
+    {                                                   \
+        vat_main_t * vam = pot_test_main.vat_main;   \
+        i32 retval = ntohl(mp->retval);                 \
+        if (vam->async_mode) {                          \
+            vam->async_errors += (retval < 0);          \
+        } else {                                        \
+            vam->retval = retval;                       \
+            vam->result_ready = 1;                      \
+        }                                               \
+	do{body;}while(0);				\
+    }
+foreach_custom_reply_retval_handler;
+#undef _
+
+/* 
+ * Table of message reply handlers, must include boilerplate handlers
+ * we just generated
+ */
+#define foreach_vpe_api_reply_msg                                       \
+_(POT_PROFILE_ADD_REPLY, pot_profile_add_reply)                         \
+_(POT_PROFILE_ACTIVATE_REPLY, pot_profile_activate_reply)               \
+_(POT_PROFILE_DEL_REPLY, pot_profile_del_reply)                         \
+_(POT_PROFILE_SHOW_CONFIG_DETAILS, pot_profile_show_config_details)
+
+
+/* M: construct, but don't yet send a message */
+
+#define M(T,t)                                                  \
+do {                                                            \
+    vam->result_ready = 0;                                      \
+    mp = vl_msg_api_alloc(sizeof(*mp));                         \
+    memset (mp, 0, sizeof (*mp));                               \
+    mp->_vl_msg_id = ntohs (VL_API_##T + sm->msg_id_base);      \
+    mp->client_index = vam->my_client_index;                    \
+} while(0);
+
+#define M2(T,t,n)                                               \
+do {                                                            \
+    vam->result_ready = 0;                                      \
+    mp = vl_msg_api_alloc(sizeof(*mp)+(n));                     \
+    memset (mp, 0, sizeof (*mp));                               \
+    mp->_vl_msg_id = ntohs (VL_API_##T + sm->msg_id_base);      \
+    mp->client_index = vam->my_client_index;                    \
+} while(0);
+
+/* S: send a message */
+#define S (vl_msg_api_send_shmem (vam->vl_input_queue, (u8 *)&mp))
+
+/* W: wait for results, with timeout */
+#define W                                       \
+do {                                            \
+    timeout = vat_time_now (vam) + 1.0;         \
+                                                \
+    while (vat_time_now (vam) < timeout) {      \
+        if (vam->result_ready == 1) {           \
+            return (vam->retval);               \
+        }                                       \
+    }                                           \
+    return -99;                                 \
+} while(0);
+
+
+static int api_pot_profile_add (vat_main_t *vam)
+{
+#define MAX_BITS 64
+    pot_test_main_t * sm = &pot_test_main;
+    unformat_input_t *input = vam->input;
+    vl_api_pot_profile_add_t *mp;
+    u8 *name = NULL;
+    u64 prime = 0;
+    u64 secret_share = 0;
+    u64 secret_key = 0;
+    u32  bits = MAX_BITS;
+    u64 lpc = 0, poly2 = 0;
+    f64 timeout;
+    u8 id = 0;
+    int rv = 0;
+
+    while (unformat_check_input(input) != UNFORMAT_END_OF_INPUT)
+      {
+        if (unformat(input, "name %s", &name))
+	  ;
+	else if(unformat(input, "id %d", &id))
+	  ;
+        else if (unformat(input, "validator-key 0x%Lx", &secret_key))
+          ;
+        else if (unformat(input, "prime-number 0x%Lx", &prime))
+          ;
+        else if (unformat(input, "secret-share 0x%Lx", &secret_share))
+          ;
+        else if (unformat(input, "polynomial-public 0x%Lx", &poly2))
+          ;
+        else if (unformat(input, "lpc 0x%Lx", &lpc))
+          ;
+        else if (unformat(input, "bits-in-random %u", &bits))
+	  {
+	    if (bits > MAX_BITS)
+	      bits = MAX_BITS;
+	  }
+        else
+  	break;
+      }
+
+    if (!name)
+      {
+        errmsg ("name required\n");
+        rv = -99;
+        goto OUT;
+      }
+    
+    M2(POT_PROFILE_ADD, pot_profile_add, vec_len(name));
+
+    mp->list_name_len = vec_len(name);
+    clib_memcpy(mp->list_name, name, mp->list_name_len);
+    mp->secret_share = clib_host_to_net_u64(secret_share);
+    mp->polynomial_public = clib_host_to_net_u64(poly2);
+    mp->lpc = clib_host_to_net_u64(lpc);
+    mp->prime = clib_host_to_net_u64(prime);
+    if (secret_key != 0)
+      {
+        mp->secret_key = clib_host_to_net_u64(secret_key);
+        mp->validator = 1;
+      }
+    else
+      {
+	mp->validator = 0;
+      }
+    mp->id = id;
+    mp->max_bits = bits;
+      
+    S; W;
+  
+OUT:
+    vec_free(name);
+    return(rv);
+}
+
+static int api_pot_profile_activate (vat_main_t *vam)
+{
+#define MAX_BITS 64
+    pot_test_main_t * sm = &pot_test_main;  
+    unformat_input_t *input = vam->input;
+    vl_api_pot_profile_activate_t *mp;
+    u8 *name = NULL;
+    u8 id = 0;
+    int rv = 0;
+    f64 timeout;
+    
+    while (unformat_check_input(input) != UNFORMAT_END_OF_INPUT)
+      {
+        if (unformat(input, "name %s", &name))
+	  ;
+	else if(unformat(input, "id %d", &id))
+	  ;
+        else
+  	break;
+      }
+
+    if (!name)
+      {
+        errmsg ("name required\n");
+        rv = -99;
+        goto OUT;
+      }
+    
+    M2(POT_PROFILE_ACTIVATE, pot_profile_activate, vec_len(name));
+
+    mp->list_name_len = vec_len(name);
+    clib_memcpy(mp->list_name, name, mp->list_name_len);
+    mp->id = id;
+      
+    S; W;
+  
+OUT:
+    vec_free(name);
+    return(rv);
+}
+
+
+static int api_pot_profile_del (vat_main_t *vam)
+{
+    pot_test_main_t * sm = &pot_test_main;
+    vl_api_pot_profile_del_t *mp;
+    f64 timeout;
+   
+    M(POT_PROFILE_DEL, pot_profile_del);
+    mp->list_name_len = 0;
+    S; W;
+    return 0;
+}
+
+static int api_pot_profile_show_config_dump (vat_main_t *vam)
+{
+    pot_test_main_t * sm = &pot_test_main;
+    unformat_input_t *input = vam->input;
+    vl_api_pot_profile_show_config_dump_t *mp;
+    f64 timeout;
+    u8 id = 0;
+
+    while(unformat_check_input(input) != UNFORMAT_END_OF_INPUT)
+    {
+      if(unformat(input,"id %d",&id));
+      else
+        break;
+    }
+    M(POT_PROFILE_SHOW_CONFIG_DUMP, pot_profile_show_config_dump);
+
+    mp->id = id;
+
+    S; W;
+    return 0;
+}
+
+/* 
+ * List of messages that the api test plugin sends,
+ * and that the data plane plugin processes
+ */
+#define foreach_vpe_api_msg \
+_(pot_profile_add, "name <name> id [0-1] "                              \
+  "prime-number <0xu64> bits-in-random [0-64] "                         \
+  "secret-share <0xu64> lpc <0xu64> polynomial-public <0xu64> "         \
+  "[validator-key <0xu64>] [validity <0xu64>]")                         \
+_(pot_profile_activate, "name <name> id [0-1] ")    			\
+_(pot_profile_del, "[id <nn>]")                                         \
+_(pot_profile_show_config_dump, "id [0-1]")
+
+void vat_api_hookup (vat_main_t *vam)
+{
+    pot_test_main_t * sm = &pot_test_main;
+    /* Hook up handlers for replies from the data plane plug-in */
+#define _(N,n)                                                  \
+    vl_msg_api_set_handlers((VL_API_##N + sm->msg_id_base),     \
+                           #n,                                  \
+                           vl_api_##n##_t_handler,              \
+                           vl_noop_handler,                     \
+                           vl_api_##n##_t_endian,               \
+                           vl_api_##n##_t_print,                \
+                           sizeof(vl_api_##n##_t), 1); 
+    foreach_vpe_api_reply_msg;
+#undef _
+
+    /* API messages we can send */
+#define _(n,h) hash_set_mem (vam->function_by_name, #n, api_##n);
+    foreach_vpe_api_msg;
+#undef _    
+    
+    /* Help strings */
+#define _(n,h) hash_set_mem (vam->help_by_name, #n, h);
+    foreach_vpe_api_msg;
+#undef _
+}
+
+clib_error_t * vat_plugin_register (vat_main_t *vam)
+{
+  pot_test_main_t * sm = &pot_test_main;
+  u8 * name;
+
+  sm->vat_main = vam;
+
+  name = format (0, "ioam_pot_%08x%c", api_version, 0);
+  sm->msg_id_base = vl_client_get_first_plugin_msg_id ((char *) name);
+
+  if (sm->msg_id_base != (u16) ~0)
+    vat_api_hookup (vam);
+  
+  vec_free(name);
+  
+  return 0;
+}
diff --git a/src/plugins/ioam/lib-pot/pot_util.c b/src/plugins/ioam/lib-pot/pot_util.c
new file mode 100644
index 00000000000..a253ad4130f
--- /dev/null
+++ b/src/plugins/ioam/lib-pot/pot_util.c
@@ -0,0 +1,445 @@
+/* 
+ * Copyright (c) 2016 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include <vnet/vnet.h>
+#include <stdint.h>
+#include <time.h>
+#include <string.h>
+#include <vppinfra/mem.h>
+#include "math64.h"
+#include "pot_util.h"
+
+pot_main_t pot_main;
+
+static void pot_profile_cleanup(pot_profile *profile);
+
+static void pot_main_profiles_reset (void)
+{
+    pot_main_t *sm = &pot_main;
+    int i = 0;
+
+    for (i = 0; i < MAX_POT_PROFILES; i++)
+    {
+      pot_profile_cleanup(&(sm->profile_list[i]));
+    }
+    sm->active_profile_id = 0;
+    if (sm->profile_list_name)
+	vec_free(sm->profile_list_name);
+    sm->profile_list_name = NULL;
+}
+
+int pot_util_init (void)
+{
+    pot_main_profiles_reset();
+    
+    return(0);
+}
+
+static void pot_profile_init(pot_profile * new, u8 id)
+{
+    if (new)
+    {
+        memset(new, 0, sizeof(pot_profile));
+        new->id = id;
+    }
+}
+
+pot_profile *pot_profile_find(u8 id)
+{
+    pot_main_t *sm = &pot_main;
+
+    if (id < MAX_POT_PROFILES)
+    {
+        return (&(sm->profile_list[id]));
+    }
+    return (NULL);
+}
+static int pot_profile_name_equal (u8 *name0, u8 *name1)
+{
+    int len0, len1;
+
+    len0 = vec_len (name0);
+    len1 = vec_len (name1);
+    if (len0 != len1)
+        return(0);
+    return (0==strncmp ((char *) name0, (char *)name1, len0));
+}
+
+int pot_profile_list_is_enabled (u8 *name)
+{
+    pot_main_t *sm = &pot_main;
+    return (pot_profile_name_equal(sm->profile_list_name, name));
+}
+
+void pot_profile_list_init(u8 * profile_list_name)
+{
+    pot_main_t *sm = &pot_main;
+    int i = 0;
+
+    /* If it is the same profile list skip reset */
+    if (pot_profile_name_equal(sm->profile_list_name, profile_list_name))
+    {
+      return;
+    }
+
+    pot_main_profiles_reset();
+    if (vec_len(profile_list_name))
+      sm->profile_list_name = (u8 *)vec_dup(profile_list_name);
+    else
+      sm->profile_list_name = 0;
+    sm->active_profile_id = 0;
+    
+    for (i = 0; i < MAX_POT_PROFILES; i++)
+    {
+      pot_profile_init(&(sm->profile_list[i]), i);
+    }
+}
+
+static void pot_profile_cleanup(pot_profile * profile)
+{
+    u16 id = profile->id;
+
+    memset(profile, 0, sizeof(pot_profile));
+    profile->id = id;           /* Restore id alone */
+}
+
+int pot_profile_create(pot_profile * profile, u64 prime,
+    u64 poly2, u64 lpc, u64 secret_share)
+{
+    if (profile && !profile->in_use)
+    {
+        pot_profile_cleanup(profile);
+        profile->prime = prime;
+        profile->primeinv = 1.0 / prime;
+        profile->lpc = lpc;
+        profile->poly_pre_eval = poly2;
+        profile->secret_share = secret_share;
+	profile->total_pkts_using_this_profile = 0;
+        profile->valid = 1;
+	return(0);
+    }
+    
+    return(-1);
+}
+
+int pot_set_validator(pot_profile * profile, u64 key)
+{
+    if (profile && !profile->in_use)
+    {
+        profile->validator = 1;
+        profile->secret_key = key;
+	return(0);
+    }
+    return(-1);
+}
+
+always_inline u64 pot_update_cumulative_inline(u64 cumulative, u64 random,
+    u64 secret_share, u64 prime, u64 lpc, u64 pre_split, double prime_inv)
+{
+    u64 share_random = 0;
+    u64 cumulative_new = 0;
+
+    /* 
+     * calculate split share for random
+     */
+    share_random = add64_mod(pre_split, random, prime, prime_inv);
+
+    /* 
+     * lpc * (share_secret + share_random)
+     */
+    share_random = add64_mod(share_random, secret_share, prime, prime_inv);
+    share_random = mul64_mod(share_random, lpc, prime, prime_inv);
+
+    cumulative_new = add64_mod(cumulative, share_random, prime, prime_inv);
+
+    return (cumulative_new);
+}
+
+u64 pot_update_cumulative(pot_profile * profile, u64 cumulative, u64 random)
+{
+    if (profile && profile->valid != 0)
+    {
+        return (pot_update_cumulative_inline(cumulative, random, profile->secret_share,
+                profile->prime, profile->lpc, profile->poly_pre_eval,
+                profile->primeinv));
+    }
+    return (0);
+}
+
+always_inline u8 pot_validate_inline(u64 secret, u64 prime, double prime_inv,
+    u64 cumulative, u64 random)
+{
+    if (cumulative == (random + secret))
+    {
+        return (1);
+    }
+    else if (cumulative == add64_mod(random, secret, prime, prime_inv))
+    {
+        return (1);
+    }
+    return (0);
+}
+
+/* 
+ * return True if the cumulative matches secret from a profile
+ */
+u8 pot_validate(pot_profile * profile, u64 cumulative, u64 random)
+{
+    if (profile && profile->validator)
+    {
+        return (pot_validate_inline(profile->secret_key, profile->prime,
+                profile->primeinv, cumulative, random));
+    }
+    return (0);
+}
+
+/* 
+ * Utility function to get random number per pack
+ */
+u64 pot_generate_random(pot_profile * profile)
+{
+    u64 random = 0;
+    int32_t second_half;
+    static u32 seed = 0;
+
+    if (PREDICT_FALSE(!seed))
+        seed = random_default_seed();
+
+    /* 
+     * Upper 4 bytes seconds
+     */
+    random = (u64) time(NULL);
+
+    random &= 0xffffffff;
+    random = random << 32;
+    /* 
+     * Lower 4 bytes random number
+     */
+    second_half = random_u32(&seed);
+
+    random |= second_half;
+
+    if (PREDICT_TRUE(profile != NULL))
+    {
+        random &= profile->bit_mask;
+    }
+    return (random);
+}
+
+int pot_profile_set_bit_mask(pot_profile * profile, u16 bits)
+{
+    int sizeInBits;
+
+    if (profile && !profile->in_use)
+    {
+        sizeInBits = sizeof(profile->bit_mask) * 8;
+        profile->bit_mask =
+            (bits >=
+            sizeInBits ? (u64) - 1 : (u64) ((u64) 1 << (u64) bits) - 1);
+	return(0);
+    }
+    return(-1);
+}
+
+clib_error_t *clear_pot_profile_command_fn(vlib_main_t * vm,
+    unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+
+    pot_main_profiles_reset();
+    
+    return 0;
+}
+
+void clear_pot_profiles()
+{
+    clear_pot_profile_command_fn(0, 0, 0);
+}
+
+VLIB_CLI_COMMAND(clear_pot_profile_command) =
+{
+.path = "clear pot profile",
+.short_help = "clear pot profile [<index>|all]",
+.function = clear_pot_profile_command_fn,
+};
+
+static clib_error_t *set_pot_profile_command_fn(vlib_main_t * vm,
+    unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+    u64 prime;
+    u64 secret_share;
+    u64 secret_key;
+    u8 validator = 0;
+    u32 profile_id = ~0;
+    u32 bits;
+    u64 lpc = 0, poly2 = 0;
+    pot_profile *profile = NULL;
+    u8 *profile_list_name = NULL;
+    
+    bits = MAX_BITS;
+
+    while (unformat_check_input(input) != UNFORMAT_END_OF_INPUT)
+    {
+        if (unformat(input, "name %s",
+		     &profile_list_name));
+        else if (unformat(input, "id %d", &profile_id))
+            ;
+        else if (unformat(input, "validate-key 0x%Lx", &secret_key))
+            validator = 1;
+        else if (unformat(input, "prime-number 0x%Lx", &prime))
+            ;
+        else if (unformat(input, "secret_share 0x%Lx", &secret_share))
+            ;
+        else if (unformat(input, "polynomial2 0x%Lx", &poly2))
+            ;
+        else if (unformat(input, "lpc 0x%Lx", &lpc))
+            ;
+        else if (unformat(input, "bits-in-random %d", &bits))
+        {
+            if (bits > MAX_BITS)
+                bits = MAX_BITS;
+        }
+        else
+	  break;
+    }
+    if (profile_list_name == 0)
+    {
+        return clib_error_return(0, "Name cannot be null");
+    }	
+    pot_profile_list_init(profile_list_name);
+    profile = pot_profile_find(profile_id);
+
+    if (profile)
+    {
+        pot_profile_create(profile, prime, poly2, lpc, secret_share);
+        if (validator)
+            pot_set_validator(profile, secret_key);
+        pot_profile_set_bit_mask(profile, bits);
+    }
+    vec_free(profile_list_name);
+    return 0;
+}
+
+VLIB_CLI_COMMAND(set_pot_profile_command) =
+{
+.path = "set pot profile",
+.short_help = "set pot profile name <string> id [0-1] [validator-key 0xu64] \
+                  prime-number 0xu64 secret_share 0xu64 lpc 0xu64 \
+                  polynomial2 0xu64 bits-in-random [0-64] ",
+.function = set_pot_profile_command_fn,
+};
+
+static clib_error_t *set_pot_profile_activate_command_fn(vlib_main_t * vm,
+    unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+    pot_main_t *sm = &pot_main;
+    u8 *profile_list_name = NULL;
+    u32 id = 0;
+    clib_error_t *result = NULL;
+    
+    while (unformat_check_input(input) != UNFORMAT_END_OF_INPUT)
+    {
+        if (unformat(input, "name %s",
+		     &profile_list_name));
+        else if (unformat(input, "id %d", &id))
+            ;
+        else
+            return clib_error_return(0, "unknown input `%U'",
+                format_unformat_error, input);
+    }
+    if (profile_list_name == 0)
+    {
+        return clib_error_return(0, "Name cannot be null");
+    }
+
+    if (!pot_profile_list_is_enabled(profile_list_name)) {
+        result = clib_error_return(0, "%s list is not enabled, profile in use %s",
+				 profile_list_name, sm->profile_list_name);
+    } else if (0 != pot_profile_set_active((u8)id)) {
+        result = clib_error_return(0, "Profile %d not defined in %s",
+				 id, sm->profile_list_name);
+    }
+    vec_free(profile_list_name);
+    return result;
+}
+
+VLIB_CLI_COMMAND(set_pot_profile_activate_command) =
+{
+.path = "set pot profile-active",
+.short_help = "set pot profile-active name <string> id [0-1]",
+.function = set_pot_profile_activate_command_fn,
+};
+
+static clib_error_t *show_pot_profile_command_fn(vlib_main_t * vm,
+    unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+    pot_main_t *sm = &pot_main;
+    pot_profile *p = NULL;
+    u16 i;
+    u8 *s = 0;
+
+    if (vec_len(sm->profile_list_name) == 0)
+    {
+        s = format(s, "POT Profiles not configured\n");
+        vlib_cli_output(vm, "%v", s);
+        return 0;
+    }
+    s = format(s, "Profile list in use  : %s\n",sm->profile_list_name);
+    for (i = 0; i < MAX_POT_PROFILES; i++)
+    {
+        p = pot_profile_find(i);
+        if (p->valid == 0)
+            continue;
+        s = format(s, "POT Profile at index: %d\n", i);
+        s = format(s, "                 Id : %d\n", p->id);
+        s = format(s, "          Validator : %s (%d)\n",
+            (p->validator) ? "True" : "False", p->validator);
+        if (p->validator == 1)
+            s = format(s, "         Secret key : 0x%Lx (%Ld)\n",
+                p->secret_key, p->secret_key);
+        s = format(s, "       Secret share : 0x%Lx (%Ld)\n",
+            p->secret_share, p->secret_share);
+        s = format(s, "       Prime number : 0x%Lx (%Ld)\n",
+            p->prime, p->prime);
+        s = format(s, "2nd polynomial(eval) : 0x%Lx (%Ld)\n",
+            p->poly_pre_eval, p->poly_pre_eval);
+        s = format(s, "                 LPC : 0x%Lx (%Ld)\n", p->lpc, p->lpc);
+
+        s = format(s, "           Bit mask : 0x%Lx (%Ld)\n",
+            p->bit_mask, p->bit_mask);
+    }
+
+    p = pot_profile_find(sm->active_profile_id);
+
+    if (p && p->valid && p->in_use) {
+        s = format(s, "\nProfile index in use: %d\n", sm->active_profile_id);
+        s = format(s, "Pkts passed : 0x%Lx (%Ld)\n",
+		   p->total_pkts_using_this_profile,
+		   p->total_pkts_using_this_profile);
+        if (pot_is_decap(p))
+            s = format(s, "  This is Decap node.  \n");
+    } else {
+        s = format(s, "\nProfile index in use: None\n");
+    }
+    vlib_cli_output(vm, "%v", s);
+    vec_free(s);
+
+    return 0;
+}
+
+VLIB_CLI_COMMAND(show_pot_profile_command) =
+{
+.path = "show pot profile",
+.short_help = "show pot profile",
+.function = show_pot_profile_command_fn,
+};
diff --git a/src/plugins/ioam/lib-pot/pot_util.h b/src/plugins/ioam/lib-pot/pot_util.h
new file mode 100644
index 00000000000..9df31fae0df
--- /dev/null
+++ b/src/plugins/ioam/lib-pot/pot_util.h
@@ -0,0 +1,195 @@
+/* 
+ * pot_util.h -- Proof Of Transit Utility Header
+ *
+ * Copyright (c) 2016 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef include_vnet_pot_util_h
+#define include_vnet_pot_util_h
+
+#include <vnet/ip/ip6_hop_by_hop.h>
+#define debug_ioam debug_ioam_fn
+/* Dont change this size 256. This is there across multiple components */
+#define PATH_NAME_SIZE  256
+
+/* Ring size. this should be same as the one in ODL. Do not change this
+   without change in ODL. */
+#define MAX_POT_PROFILES 2
+
+/**
+ * Usage:
+ * 
+ * On any node that participates in Proof of Transit:
+ *
+ * Step 1: Initialize this library by calling pot_init()
+ * Step 2: Setup a proof of transit  profile that contains all the parameters needed to compute cumulative:
+ *         Call these functions:
+ *         pot_profile_find
+ *         pot_profile_create
+ *         pot_profile_set_bit_mask - To setup how large we want the numbers used in the computation and random number <= 64 bits
+ * Step 2a: For validator do this:
+ *          pot_set_validator
+ * Step 2b: On initial node enable the profile to be used:
+ *          pot_profile_set_active / pot_profile_get_active will return the profile
+ * Step 3a: At the initial node to generate Random number that will be read by all other nodes:
+ *          pot_generate_random
+ * Step 3b: At all nodes including initial and verifier call this to compute cumulative:
+ *          pot_update_cumulative
+ * Step 4: At the verifier:
+ *         pot_validate
+ * 
+ */
+
+typedef struct pot_profile_
+{
+    u8 id : 1;
+    u8 valid : 1;
+    u8 in_use : 1;
+    u64 random;
+    u8 validator;
+    u64 secret_key;
+    u64 secret_share;
+    u64 prime;
+    u64 lpc;
+    u64 poly_pre_eval;
+    u64 bit_mask;
+    u64 limit;
+    double primeinv;
+    u64 total_pkts_using_this_profile;
+} pot_profile;
+
+typedef struct {
+    /* Name of the default profile list in use*/
+    u8 *profile_list_name;
+    pot_profile profile_list[MAX_POT_PROFILES];
+    /* number of profiles in the list */
+    u8 active_profile_id : 1;
+
+    /* API message ID base */
+    u16 msg_id_base;
+
+    /* convenience */
+    vlib_main_t * vlib_main;
+    vnet_main_t * vnet_main;
+} pot_main_t;
+
+extern pot_main_t pot_main;
+
+/* 
+ * Initialize proof of transit
+ */
+int pot_util_init(void);
+void pot_profile_list_init(u8 * name);
+
+
+/* 
+ * Find a pot profile by ID
+ */
+pot_profile *pot_profile_find(u8 id);
+
+static inline u16 pot_profile_get_id(pot_profile * profile)
+{
+    if (profile)
+    {
+        return (profile->id);
+    }
+    return (0);
+}
+
+/* setup and clean up profile */
+int pot_profile_create(pot_profile * profile, u64 prime,
+    u64 poly2, u64 lpc, u64 secret_share);
+/* 
+ * Setup profile as a validator
+ */
+int pot_set_validator(pot_profile * profile, u64 key);
+
+/* 
+ * Setup max bits to be used for random number generation
+ */
+#define MAX_BITS 64
+int pot_profile_set_bit_mask(pot_profile * profile, u16 bits);
+
+/* 
+ * Given a random and cumulative compute the new cumulative for a given profile
+ */
+u64 pot_update_cumulative(pot_profile * profile, u64 cumulative, u64 random);
+
+/* 
+ * return True if the cumulative matches secret from a profile
+ */
+u8 pot_validate(pot_profile * profile, u64 cumulative, u64 random);
+
+/* 
+ * Utility function to get random number per pack
+ */
+u64 pot_generate_random(pot_profile * profile);
+
+
+extern void clear_pot_profiles();
+extern int pot_profile_list_is_enabled(u8 *name);
+
+static inline u8 pot_is_decap(pot_profile * p)
+{
+    return (p->validator == 1);
+}
+
+static inline int pot_profile_set_active (u8 id)
+{
+    pot_main_t *sm = &pot_main;
+    pot_profile *profile = NULL;
+    pot_profile *current_active_prof = NULL;
+
+    current_active_prof = pot_profile_find(sm->active_profile_id);
+    profile = pot_profile_find(id);
+    if (profile && profile->valid) {
+        sm->active_profile_id = id;
+	current_active_prof->in_use = 0;
+	profile->in_use = 1;
+	return(0);
+    }
+    return(-1);
+}
+static inline u8 pot_profile_get_active_id (void)
+{
+    pot_main_t *sm = &pot_main;
+    return (sm->active_profile_id);
+}
+
+static inline pot_profile * pot_profile_get_active (void)
+{
+    pot_main_t *sm = &pot_main;
+    pot_profile *profile = NULL;
+    profile = pot_profile_find(sm->active_profile_id);
+    if (profile && profile->in_use)
+        return(profile);
+    return (NULL);
+}
+
+static inline void pot_profile_reset_usage_stats (pot_profile *pow)
+{
+  if (pow) {
+    pow->total_pkts_using_this_profile = 0;
+  }
+}
+
+static inline void pot_profile_incr_usage_stats (pot_profile *pow)
+{
+  if (pow) {
+    pow->total_pkts_using_this_profile++;
+  }
+}
+
+
+#endif