IPIP: Add IP{v4,v6} over IP{v4,v6} configured tunnel support.

Change-Id: I166301c9e2388bae5f70ec0179d663a2703e27f5
Signed-off-by: Ole Troan <ot@cisco.com>

10 files changed, 2244 insertions, 0 deletions

diff --git a/src/vnet/ip/ip6_packet.h b/src/vnet/ip/ip6_packet.h
index a02f8b2ea8e..9916f3000cb 100644
--- a/src/vnet/ip/ip6_packet.h
+++ b/src/vnet/ip/ip6_packet.h
@@ -81,6 +81,7 @@ typedef CLIB_PACKED (union {
 #define ip46_address_is_zero(ip46)	(((ip46)->as_u64[0] == 0) && ((ip46)->as_u64[1] == 0))
 #define ip46_address_is_equal(a1, a2)	(((a1)->as_u64[0] == (a2)->as_u64[0]) \
                                          && ((a1)->as_u64[1] == (a2)->as_u64[1]))
+#define ip46_address_initializer {{{ 0 }}}
 
 always_inline ip46_address_t
 to_ip46 (u32 is_ipv6, u8 * buf)
diff --git a/src/vnet/ipip/ipip.api b/src/vnet/ipip/ipip.api
new file mode 100644
index 00000000000..988eee599b1
--- /dev/null
+++ b/src/vnet/ipip/ipip.api
@@ -0,0 +1,101 @@
+/*
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+option version = "1.0.0";
+
+/** \brief Create or delete an IPIP tunnel
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+    @param is_ipv6 - Use 0 for IPv4, 1 for IPv6
+    @param instance - optional unique custom device instance, else ~0.
+    @param src_address - Source IP address
+    @param dst_address - Destination IP address, can be multicast
+    @param fib_index - Encap FIB table ID
+*/
+define ipip_add_tunnel
+{
+  u32 client_index;
+  u32 context;
+  u8 is_ipv6;
+  u32 instance;		/* If non-~0, specifies a custom dev instance */
+  u8 src_address[16];
+  u8 dst_address[16];
+  u32 fib_index;
+};
+
+define ipip_add_tunnel_reply
+{
+  u32 context;
+  i32 retval;
+  u32 sw_if_index;
+};
+
+autoreply define ipip_del_tunnel
+{
+  u32 client_index;
+  u32 context;
+  u32 sw_if_index;
+};
+
+define ipip_6rd_add_tunnel
+{
+  u32 client_index;
+  u32 context;
+  u32 fib_index;
+  u8 ip6_prefix[16];
+  u8 ip4_prefix[4];
+  u8 ip4_src[4];
+  u8 ip6_prefix_len;
+  u8 ip4_prefix_len;
+  u8 security_check;
+};
+
+define ipip_6rd_add_tunnel_reply
+{
+  u32 context;
+  i32 retval;
+  u32 sw_if_index;
+};
+
+autoreply define ipip_6rd_del_tunnel
+{
+  u32 client_index;
+  u32 context;
+  u32 sw_if_index;
+};
+
+define ipip_tunnel_dump
+{
+  u32 client_index;
+  u32 context;
+  u32 sw_if_index;
+};
+
+define ipip_tunnel_details
+{
+  u32 context;
+  u32 sw_if_index;
+  u32 instance;
+  u8 is_ipv6;
+  u8 src_address[16];
+  u8 dst_address[16];
+  u32 fib_index;
+};
+
+/*
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/vnet/ipip/ipip.c b/src/vnet/ipip/ipip.c
new file mode 100644
index 00000000000..82c961cdddd
--- /dev/null
+++ b/src/vnet/ipip/ipip.c
@@ -0,0 +1,566 @@
+/*
+ * ipip.c: ipip
+ *
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or aipiped to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <stddef.h>
+#include <vnet/adj/adj_midchain.h>
+#include <vnet/ipip/ipip.h>
+#include <vnet/vnet.h>
+#include <vnet/adj/adj_nbr.h>
+#include <vnet/fib/ip4_fib.h>
+#include <vnet/fib/ip6_fib.h>
+#include <vnet/ip/format.h>
+#include <vnet/ipip/ipip.h>
+
+ipip_main_t ipip_main;
+
+/* Packet trace structure */
+typedef struct
+{
+  u32 tunnel_id;
+  u32 length;
+  ip46_address_t src;
+  ip46_address_t dst;
+} ipip_tx_trace_t;
+
+u8 *
+format_ipip_tx_trace (u8 * s, va_list * args)
+{
+  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
+  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
+  ipip_tx_trace_t *t = va_arg (*args, ipip_tx_trace_t *);
+
+  s =
+    format (s, "IPIP: tunnel %d len %d src %U dst %U", t->tunnel_id,
+	    t->length, format_ip46_address, &t->src, IP46_TYPE_ANY,
+	    format_ip46_address, &t->dst, IP46_TYPE_ANY);
+  return s;
+}
+
+static u8 *
+ipip_build_rewrite (vnet_main_t * vnm, u32 sw_if_index,
+		    vnet_link_t link_type, const void *dst_address)
+{
+  ip4_header_t *ip4;
+  ip6_header_t *ip6;
+  u8 *rewrite = NULL;
+  ipip_tunnel_t *t = ipip_tunnel_db_find_by_sw_if_index (sw_if_index);
+
+  if (!t)
+    /* not one of ours */
+    return (0);
+
+  switch (t->transport)
+    {
+    case IPIP_TRANSPORT_IP4:
+      vec_validate (rewrite, sizeof (*ip4) - 1);
+      ip4 = (ip4_header_t *) rewrite;
+      ip4->ip_version_and_header_length = 0x45;
+      ip4->ttl = 64;
+      /* fixup ip4 header length, protocol and checksum after-the-fact */
+      ip4->src_address.as_u32 = t->tunnel_src.ip4.as_u32;
+      ip4->dst_address.as_u32 = t->tunnel_dst.ip4.as_u32;
+      ip4->checksum = ip4_header_checksum (ip4);
+      break;
+
+    case IPIP_TRANSPORT_IP6:
+      vec_validate (rewrite, sizeof (*ip6) - 1);
+      ip6 = (ip6_header_t *) rewrite;
+      ip6->ip_version_traffic_class_and_flow_label =
+	clib_host_to_net_u32 (6 << 28);
+      ip6->hop_limit = 64;
+      /* fixup ip6 header length and protocol after-the-fact */
+      ip6->src_address.as_u64[0] = t->tunnel_src.ip6.as_u64[0];
+      ip6->src_address.as_u64[1] = t->tunnel_src.ip6.as_u64[1];
+      ip6->dst_address.as_u64[0] = t->tunnel_dst.ip6.as_u64[0];
+      ip6->dst_address.as_u64[1] = t->tunnel_dst.ip6.as_u64[1];
+      break;
+    default:
+      /* pass through */
+      ;
+    }
+  return (rewrite);
+}
+
+static void
+ipip4_fixup (vlib_main_t * vm, ip_adjacency_t * adj, vlib_buffer_t * b,
+	     const void *data)
+{
+  ip4_header_t *ip4;
+
+  ip4 = vlib_buffer_get_current (b);
+  ip4->length = clib_host_to_net_u16 (vlib_buffer_length_in_chain (vm, b));
+  ip4->protocol =
+    adj->ia_link == VNET_LINK_IP6 ? IP_PROTOCOL_IPV6 : IP_PROTOCOL_IP_IN_IP;
+  ip4->checksum = ip4_header_checksum (ip4);
+}
+
+static void
+ipip6_fixup (vlib_main_t * vm, ip_adjacency_t * adj, vlib_buffer_t * b,
+	     const void *data)
+{
+  ip6_header_t *ip6;
+
+  ip6 = vlib_buffer_get_current (b);
+  ip6->payload_length =
+    clib_host_to_net_u16 (vlib_buffer_length_in_chain (vm, b) -
+			  sizeof (*ip6));
+  ip6->protocol =
+    adj->ia_link == VNET_LINK_IP6 ? IP_PROTOCOL_IPV6 : IP_PROTOCOL_IP_IN_IP;
+}
+
+static void
+ipip_tunnel_stack (adj_index_t ai)
+{
+  ip_adjacency_t *adj;
+  ipip_tunnel_t *t;
+  u32 sw_if_index;
+
+  adj = adj_get (ai);
+  sw_if_index = adj->rewrite_header.sw_if_index;
+
+  t = ipip_tunnel_db_find_by_sw_if_index (sw_if_index);
+  if (!t)
+    return;
+
+  if ((vnet_hw_interface_get_flags (vnet_get_main (), t->hw_if_index) &
+       VNET_HW_INTERFACE_FLAG_LINK_UP) == 0)
+    {
+      adj_nbr_midchain_unstack (ai);
+      return;
+    }
+
+  dpo_id_t tmp = DPO_INVALID;
+  fib_forward_chain_type_t fib_fwd =
+    t->transport ==
+    IPIP_TRANSPORT_IP6 ? FIB_FORW_CHAIN_TYPE_UNICAST_IP6 :
+    FIB_FORW_CHAIN_TYPE_UNICAST_IP4;
+
+  fib_entry_contribute_forwarding (t->p2p.fib_entry_index, fib_fwd, &tmp);
+  if (DPO_LOAD_BALANCE == tmp.dpoi_type)
+    {
+      /*
+       * post IPIP rewrite we will load-balance. However, the IPIP encap
+       * is always the same for this adjacency/tunnel and hence the IP/IPIP
+       * src,dst hash is always the same result too. So we do that hash now and
+       * stack on the choice.
+       * If the choice is an incomplete adj then we will need a poke when
+       * it becomes complete. This happens since the adj update walk propagates
+       * as far a recursive paths.
+       */
+      const dpo_id_t *choice;
+      load_balance_t *lb;
+      int hash;
+
+      lb = load_balance_get (tmp.dpoi_index);
+
+      if (fib_fwd == FIB_FORW_CHAIN_TYPE_UNICAST_IP4)
+	hash = ip4_compute_flow_hash ((ip4_header_t *) adj_get_rewrite (ai),
+				      lb->lb_hash_config);
+      else
+	hash = ip6_compute_flow_hash ((ip6_header_t *) adj_get_rewrite (ai),
+				      lb->lb_hash_config);
+      choice =
+	load_balance_get_bucket_i (lb, hash & lb->lb_n_buckets_minus_1);
+      dpo_copy (&tmp, choice);
+    }
+
+  adj_nbr_midchain_stack (ai, &tmp);
+  dpo_reset (&tmp);
+}
+
+static adj_walk_rc_t
+ipip_adj_walk_cb (adj_index_t ai, void *ctx)
+{
+  ipip_tunnel_stack (ai);
+
+  return (ADJ_WALK_RC_CONTINUE);
+}
+
+static void
+ipip_tunnel_restack (ipip_tunnel_t * gt)
+{
+  fib_protocol_t proto;
+
+  /*
+   * walk all the adjacencies on th IPIP interface and restack them
+   */
+  FOR_EACH_FIB_IP_PROTOCOL (proto)
+  {
+    adj_nbr_walk (gt->sw_if_index, proto, ipip_adj_walk_cb, NULL);
+  }
+}
+
+void
+ipip_update_adj (vnet_main_t * vnm, u32 sw_if_index, adj_index_t ai)
+{
+  ipip_tunnel_t *t;
+  adj_midchain_fixup_t f;
+
+  t = ipip_tunnel_db_find_by_sw_if_index (sw_if_index);
+  if (!t)
+    return;
+
+  f = t->transport == IPIP_TRANSPORT_IP6 ? ipip6_fixup : ipip4_fixup;
+
+  adj_nbr_midchain_update_rewrite (ai, f, NULL,
+				   (VNET_LINK_ETHERNET ==
+				    adj_get_link_type (ai) ?
+				    ADJ_FLAG_MIDCHAIN_NO_COUNT :
+				    ADJ_FLAG_NONE), ipip_build_rewrite (vnm,
+									sw_if_index,
+									adj_get_link_type
+									(ai),
+									NULL));
+  ipip_tunnel_stack (ai);
+}
+
+static u8 *
+format_ipip_tunnel_name (u8 * s, va_list * args)
+{
+  u32 dev_instance = va_arg (*args, u32);
+  ipip_main_t *gm = &ipip_main;
+  ipip_tunnel_t *t;
+
+  if (dev_instance >= vec_len (gm->tunnels))
+    return format (s, "<improperly-referenced>");
+
+  t = pool_elt_at_index (gm->tunnels, dev_instance);
+  return format (s, "ipip%d", t->user_instance);
+}
+
+static u8 *
+format_ipip_device (u8 * s, va_list * args)
+{
+  u32 dev_instance = va_arg (*args, u32);
+  CLIB_UNUSED (int verbose) = va_arg (*args, int);
+
+  s = format (s, "IPIP tunnel: id %d\n", dev_instance);
+  return s;
+}
+
+static clib_error_t *
+ipip_interface_admin_up_down (vnet_main_t * vnm, u32 hw_if_index, u32 flags)
+{
+  vnet_hw_interface_t *hi;
+  ipip_tunnel_t *t;
+
+  hi = vnet_get_hw_interface (vnm, hw_if_index);
+
+  t = ipip_tunnel_db_find_by_sw_if_index (hi->sw_if_index);
+  if (!t)
+    return 0;
+
+  if (flags & VNET_SW_INTERFACE_FLAG_ADMIN_UP)
+    vnet_hw_interface_set_flags (vnm, hw_if_index,
+				 VNET_HW_INTERFACE_FLAG_LINK_UP);
+  else
+    vnet_hw_interface_set_flags (vnm, hw_if_index, 0 /* down */ );
+
+  ipip_tunnel_restack (t);
+
+  return /* no error */ 0;
+}
+
+/* *INDENT-OFF* */
+VNET_DEVICE_CLASS(ipip_device_class) = {
+    .name = "IPIP tunnel device",
+    .format_device_name = format_ipip_tunnel_name,
+    .format_device = format_ipip_device,
+    .format_tx_trace = format_ipip_tx_trace,
+    .admin_up_down_function = ipip_interface_admin_up_down,
+#ifdef SOON
+    .clear counter = 0;
+#endif
+};
+
+VNET_HW_INTERFACE_CLASS(ipip_hw_interface_class) = {
+    .name = "IPIP",
+    //.format_header = format_ipip_header_with_length,
+    //.unformat_header = unformat_ipip_header,
+    .build_rewrite = ipip_build_rewrite,
+    .update_adjacency = ipip_update_adj,
+    .flags = VNET_HW_INTERFACE_CLASS_FLAG_P2P,
+};
+/* *INDENT-ON* */
+
+ipip_tunnel_t *
+ipip_tunnel_db_find (ipip_tunnel_key_t * key)
+{
+  ipip_main_t *gm = &ipip_main;
+  uword *p;
+
+  p = hash_get_mem (gm->tunnel_by_key, key);
+  if (!p)
+    return (NULL);
+  return (pool_elt_at_index (gm->tunnels, p[0]));
+}
+
+ipip_tunnel_t *
+ipip_tunnel_db_find_by_sw_if_index (u32 sw_if_index)
+{
+  ipip_main_t *gm = &ipip_main;
+  if (vec_len (gm->tunnel_index_by_sw_if_index) < sw_if_index)
+    return NULL;
+  u32 ti = gm->tunnel_index_by_sw_if_index[sw_if_index];
+  if (ti == ~0)
+    return NULL;
+  return pool_elt_at_index (gm->tunnels, ti);
+}
+
+void
+ipip_tunnel_db_add (ipip_tunnel_t * t, ipip_tunnel_key_t * key)
+{
+  ipip_main_t *gm = &ipip_main;
+
+  t->key = clib_mem_alloc (sizeof (*t->key));
+  clib_memcpy (t->key, key, sizeof (*key));
+  hash_set_mem (gm->tunnel_by_key, t->key, t->dev_instance);
+}
+
+void
+ipip_tunnel_db_remove (ipip_tunnel_t * t)
+{
+  ipip_main_t *gm = &ipip_main;
+
+  hash_unset_mem (gm->tunnel_by_key, t->key);
+  clib_mem_free (t->key);
+  t->key = NULL;
+}
+
+static ipip_tunnel_t *
+ipip_tunnel_from_fib_node (fib_node_t * node)
+{
+  ipip_main_t *gm = &ipip_main;
+  ASSERT (gm->fib_node_type == node->fn_type);
+  return ((ipip_tunnel_t *) (((char *) node) -
+			     offsetof (ipip_tunnel_t, p2p.node)));
+}
+
+static fib_node_back_walk_rc_t
+ipip_tunnel_back_walk (fib_node_t * node, fib_node_back_walk_ctx_t * ctx)
+{
+  ipip_tunnel_restack (ipip_tunnel_from_fib_node (node));
+
+  return (FIB_NODE_BACK_WALK_CONTINUE);
+}
+
+static fib_node_t *
+ipip_tunnel_fib_node_get (fib_node_index_t index)
+{
+  ipip_tunnel_t *gt;
+  ipip_main_t *gm;
+
+  gm = &ipip_main;
+  gt = pool_elt_at_index (gm->tunnels, index);
+
+  return (&gt->p2p.node);
+}
+
+static void
+ipip_tunnel_last_lock_gone (fib_node_t * node)
+{
+  /*
+   * The MPLS IPIP tunnel is a root of the graph. As such
+   * it never has children and thus is never locked.
+   */
+  ASSERT (0);
+}
+
+/*
+ * Virtual function table registered by IPIP tunnels
+ * for participation in the FIB object graph.
+ */
+const static fib_node_vft_t ipip_vft = {
+  .fnv_get = ipip_tunnel_fib_node_get,
+  .fnv_last_lock = ipip_tunnel_last_lock_gone,
+  .fnv_back_walk = ipip_tunnel_back_walk,
+};
+
+static void
+ipip_fib_add (ipip_tunnel_t * t)
+{
+  ipip_main_t *gm = &ipip_main;
+  fib_prefix_t dst = {.fp_len = t->transport == IPIP_TRANSPORT_IP6 ? 128 : 32,
+    .fp_proto =
+      t->transport ==
+      IPIP_TRANSPORT_IP6 ? FIB_PROTOCOL_IP6 : FIB_PROTOCOL_IP4,
+    .fp_addr = t->tunnel_dst
+  };
+
+  t->p2p.fib_entry_index =
+    fib_table_entry_special_add (t->fib_index, &dst, FIB_SOURCE_RR,
+				 FIB_ENTRY_FLAG_NONE);
+  t->p2p.sibling_index =
+    fib_entry_child_add (t->p2p.fib_entry_index, gm->fib_node_type,
+			 t->dev_instance);
+}
+
+static void
+ipip_fib_delete (ipip_tunnel_t * t)
+{
+  fib_entry_child_remove (t->p2p.fib_entry_index, t->p2p.sibling_index);
+  fib_table_entry_delete_index (t->p2p.fib_entry_index, FIB_SOURCE_RR);
+  fib_node_deinit (&t->p2p.node);
+}
+
+int
+ipip_add_tunnel (ipip_transport_t transport,
+		 u32 instance, ip46_address_t * src, ip46_address_t * dst,
+		 u32 fib_index, u32 * sw_if_indexp)
+{
+  ipip_main_t *gm = &ipip_main;
+  vnet_main_t *vnm = gm->vnet_main;
+  ip4_main_t *im4 = &ip4_main;
+  ip6_main_t *im6 = &ip6_main;
+  ipip_tunnel_t *t;
+  vnet_hw_interface_t *hi;
+  u32 hw_if_index, sw_if_index;
+  ipip_tunnel_key_t key = {.transport = transport,
+    .fib_index = fib_index,
+    .src = *src,
+    .dst = *dst
+  };
+  t = ipip_tunnel_db_find (&key);
+  if (t)
+    return VNET_API_ERROR_IF_ALREADY_EXISTS;
+
+  pool_get_aligned (gm->tunnels, t, CLIB_CACHE_LINE_BYTES);
+  memset (t, 0, sizeof (*t));
+
+  /* Reconcile the real dev_instance and a possible requested instance */
+  u32 t_idx = t - gm->tunnels;	/* tunnel index (or instance) */
+  u32 u_idx = instance;		/* user specified instance */
+  if (u_idx == ~0)
+    u_idx = t_idx;
+  if (hash_get (gm->instance_used, u_idx))
+    {
+      pool_put (gm->tunnels, t);
+      return VNET_API_ERROR_INSTANCE_IN_USE;
+    }
+  hash_set (gm->instance_used, u_idx, 1);
+
+  t->dev_instance = t_idx;	/* actual */
+  t->user_instance = u_idx;	/* name */
+  fib_node_init (&t->p2p.node, gm->fib_node_type);
+
+  hw_if_index = vnet_register_interface (vnm, ipip_device_class.index, t_idx,
+					 ipip_hw_interface_class.index,
+					 t_idx);
+
+  hi = vnet_get_hw_interface (vnm, hw_if_index);
+  sw_if_index = hi->sw_if_index;
+
+  t->hw_if_index = hw_if_index;
+  t->fib_index = fib_index;
+  t->sw_if_index = sw_if_index;
+
+  t->transport = transport;
+  vec_validate_init_empty (gm->tunnel_index_by_sw_if_index, sw_if_index, ~0);
+  gm->tunnel_index_by_sw_if_index[sw_if_index] = t_idx;
+
+  if (t->transport == IPIP_TRANSPORT_IP4)
+    {
+      vec_validate (im4->fib_index_by_sw_if_index, sw_if_index);
+      hi->min_packet_bytes = 64 + sizeof (ip4_header_t);
+    }
+  else
+    {
+      vec_validate (im6->fib_index_by_sw_if_index, sw_if_index);
+      hi->min_packet_bytes = 64 + sizeof (ip6_header_t);
+    }
+
+  hi->per_packet_overhead_bytes = /* preamble */ 8 + /* inter frame gap */ 12;
+
+  /* Standard default ipip MTU. */
+  hi->max_l3_packet_bytes[VLIB_RX] = hi->max_l3_packet_bytes[VLIB_TX] = 9000;
+
+  t->tunnel_src = *src;
+  t->tunnel_dst = *dst;
+
+  ipip_tunnel_db_add (t, &key);
+
+  /*
+   * Source the FIB entry for the tunnel's destination and become a
+   * child thereof. The tunnel will then get poked when the forwarding
+   * for the entry updates, and the tunnel can re-stack accordingly
+   */
+  ipip_fib_add (t);
+  if (sw_if_indexp)
+    *sw_if_indexp = sw_if_index;
+
+  if (t->transport == IPIP_TRANSPORT_IP6 && !gm->ip6_protocol_registered)
+    {
+      ip6_register_protocol (IP_PROTOCOL_IP_IN_IP, ipip6_input_node.index);
+      ip6_register_protocol (IP_PROTOCOL_IPV6, ipip6_input_node.index);
+      gm->ip6_protocol_registered = true;
+    }
+  else if (t->transport == IPIP_TRANSPORT_IP4 && !gm->ip4_protocol_registered)
+    {
+      ip4_register_protocol (IP_PROTOCOL_IP_IN_IP, ipip4_input_node.index);
+      ip4_register_protocol (IP_PROTOCOL_IPV6, ipip4_input_node.index);
+      gm->ip4_protocol_registered = true;
+    }
+  return 0;
+}
+
+int
+ipip_del_tunnel (u32 sw_if_index)
+{
+  ipip_main_t *gm = &ipip_main;
+  vnet_main_t *vnm = gm->vnet_main;
+  ipip_tunnel_t *t;
+
+
+  t = ipip_tunnel_db_find_by_sw_if_index (sw_if_index);
+  if (t == NULL)
+    return VNET_API_ERROR_NO_SUCH_ENTRY;
+
+  vnet_sw_interface_set_flags (vnm, sw_if_index, 0 /* down */ );
+  gm->tunnel_index_by_sw_if_index[sw_if_index] = ~0;
+  vnet_delete_hw_interface (vnm, t->hw_if_index);
+  ipip_fib_delete (t);
+  hash_unset (gm->instance_used, t->user_instance);
+  ipip_tunnel_db_remove (t);
+  pool_put (gm->tunnels, t);
+
+  return 0;
+}
+
+static clib_error_t *
+ipip_init (vlib_main_t * vm)
+{
+  ipip_main_t *gm = &ipip_main;
+
+  memset (gm, 0, sizeof (gm[0]));
+  gm->vlib_main = vm;
+  gm->vnet_main = vnet_get_main ();
+  gm->tunnel_by_key =
+    hash_create_mem (0, sizeof (ipip_tunnel_key_t), sizeof (uword));
+  gm->fib_node_type = fib_node_register_new_type (&ipip_vft);
+
+  return 0;
+}
+
+VLIB_INIT_FUNCTION (ipip_init);
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/vnet/ipip/ipip.h b/src/vnet/ipip/ipip.h
new file mode 100644
index 00000000000..e9277d8a061
--- /dev/null
+++ b/src/vnet/ipip/ipip.h
@@ -0,0 +1,168 @@
+/*
+ * ipip.h: types/functions for ipip.
+ *
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or aipiped to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef included_ipip_h
+#define included_ipip_h
+
+#include <vnet/adj/adj_types.h>
+#include <vnet/ip/ip6_packet.h>
+#include <vnet/ip/format.h>
+#include <vnet/ip/ip.h>
+#include <vnet/vnet.h>
+
+extern vnet_hw_interface_class_t ipip_hw_interface_class;
+
+#define foreach_ipip_error			\
+  /* Must be first. */				\
+  _(DECAP_PKTS, "packets decapsulated")		\
+  _(BAD_PROTOCOL, "bad protocol")		\
+  _(NO_TUNNEL, "no tunnel")
+
+typedef enum
+{
+#define _(sym, str) IPIP_ERROR_##sym,
+  foreach_ipip_error
+#undef _
+    IPIP_N_ERROR,
+} ipip_error_t;
+
+/**
+ * @brief IPIP Tunnel key
+ */
+typedef enum
+{
+  IPIP_TRANSPORT_IP4,
+  IPIP_TRANSPORT_IP6,
+} ipip_transport_t;
+
+typedef struct
+{
+  ipip_transport_t transport;
+  u32 fib_index;
+  ip46_address_t src;
+  ip46_address_t dst;
+} __attribute__ ((packed)) ipip_tunnel_key_t;
+
+typedef enum
+{
+  IPIP_MODE_P2P = 0,
+  IPIP_MODE_6RD,
+} ipip_mode_t;
+
+/**
+ * @brief A representation of a IPIP tunnel
+ */
+typedef struct
+{
+  ipip_mode_t mode;
+  ipip_transport_t transport;
+  ipip_tunnel_key_t *key;
+  ip46_address_t tunnel_src;
+  ip46_address_t tunnel_dst;
+  u32 fib_index;
+  u32 hw_if_index;
+  u32 sw_if_index;
+  u32 dev_instance;		/* Real device instance in tunnel vector */
+  u32 user_instance;		/* Instance name being shown to user */
+
+  union
+  {
+    struct
+    {
+      fib_node_t node;
+      fib_node_index_t fib_entry_index;
+      u32 sibling_index;
+    } p2p;
+    struct
+    {
+      ip6_address_t ip6_prefix;
+      ip4_address_t ip4_prefix;
+      u8 ip6_prefix_len;
+      u8 ip4_prefix_len;
+      u8 shift;
+      bool security_check;
+    } sixrd;
+  };
+} ipip_tunnel_t;
+
+typedef struct
+{
+  ipip_tunnel_t *tunnels;
+  uword *tunnel_by_key;
+  u32 *tunnel_index_by_sw_if_index;
+  fib_node_type_t fib_node_type;
+
+  /* convenience */
+  vlib_main_t *vlib_main;
+  vnet_main_t *vnet_main;
+
+  /* Record used instances */
+  uword *instance_used;
+
+  bool ip4_protocol_registered;
+  bool ip6_protocol_registered;
+} ipip_main_t;
+
+extern ipip_main_t ipip_main;
+extern vlib_node_registration_t ipip4_input_node;
+extern vlib_node_registration_t ipip6_input_node;
+
+/*
+ * sixrd_get_addr_net
+ */
+static_always_inline u32
+sixrd_get_addr_net (const ipip_tunnel_t * t, u64 dal)
+{
+  /* 1:1 mode */
+  if (t->sixrd.ip4_prefix_len == 32)
+    return (t->sixrd.ip4_prefix.as_u32);
+
+  dal = clib_net_to_host_u64 (dal);
+
+  /* Grab 32 - ip4_prefix_len bits out of IPv6 address from offset
+   * ip6_prefix_len */
+  u32 mask = ~(~0ULL << (32 - t->sixrd.ip4_prefix_len));
+  u32 ip4 =
+    clib_net_to_host_u32 (t->sixrd.
+			  ip4_prefix.as_u32) | ((u32) (dal >> t->sixrd.
+						       shift) & mask);
+  return clib_host_to_net_u32 (ip4);
+}
+
+int ipip_add_tunnel (ipip_transport_t transport, u32 instance,
+		     ip46_address_t * src, ip46_address_t * dst,
+		     u32 fib_index, u32 * sw_if_indexp);
+int ipip_del_tunnel (u32 sw_if_index);
+int sixrd_add_tunnel (ip6_address_t * ip6_prefix, u8 ip6_prefix_len,
+		      ip4_address_t * ip4_prefix, u8 ip4_prefix_len,
+		      ip4_address_t * ip4_src, bool security_check,
+		      u32 fib_index, u32 * sw_if_index);
+int sixrd_del_tunnel (u32 sw_if_index);
+void ipip_tunnel_db_add (ipip_tunnel_t * t, ipip_tunnel_key_t * key);
+void ipip_tunnel_db_remove (ipip_tunnel_t * t);
+ipip_tunnel_t *ipip_tunnel_db_find (ipip_tunnel_key_t * key);
+ipip_tunnel_t *ipip_tunnel_db_find_by_sw_if_index (u32 sw_if_index);
+
+#endif
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/vnet/ipip/ipip_api.c b/src/vnet/ipip/ipip_api.c
new file mode 100644
index 00000000000..a6633296515
--- /dev/null
+++ b/src/vnet/ipip/ipip_api.c
@@ -0,0 +1,230 @@
+/*
+ * ipip_api.c - ipip api
+ *
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <vlibmemory/api.h>
+#include <vnet/api_errno.h>
+#include <vnet/fib/fib_table.h>
+#include <vnet/interface.h>
+#include <vnet/ipip/ipip.h>
+#include <vnet/vnet.h>
+#include <vnet/vnet_msg_enum.h>
+
+#define vl_typedefs		/* define message structures */
+#include <vnet/vnet_all_api_h.h>
+#undef vl_typedefs
+
+#define vl_endianfun		/* define message structures */
+#include <vnet/vnet_all_api_h.h>
+#undef vl_endianfun
+
+/* instantiate all the print functions we know about */
+#define vl_print(handle, ...) vlib_cli_output(handle, __VA_ARGS__)
+#define vl_printfun
+#include <vnet/vnet_all_api_h.h>
+#undef vl_printfun
+
+#include <vlibapi/api_helper_macros.h>
+
+#define foreach_vpe_api_msg			\
+  _(IPIP_ADD_TUNNEL, ipip_add_tunnel)		\
+  _(IPIP_DEL_TUNNEL, ipip_del_tunnel)		\
+  _(IPIP_6RD_ADD_TUNNEL, ipip_6rd_add_tunnel)	\
+  _(IPIP_6RD_DEL_TUNNEL, ipip_6rd_del_tunnel)	\
+  _(IPIP_TUNNEL_DUMP, ipip_tunnel_dump)
+
+static void
+vl_api_ipip_add_tunnel_t_handler (vl_api_ipip_add_tunnel_t * mp)
+{
+  vl_api_ipip_add_tunnel_reply_t *rmp;
+  int rv = 0;
+  u32 sw_if_index = ~0;
+  ip46_address_t src = ip46_address_initializer, dst =
+    ip46_address_initializer;
+
+  /* ip addresses sent in network byte order */
+  if (mp->is_ipv6)
+    {
+      clib_memcpy (&src.ip6, mp->src_address, 16);
+      clib_memcpy (&dst.ip6, mp->dst_address, 16);
+    }
+  else
+    {
+      clib_memcpy (&src.ip4, mp->src_address, 4);
+      clib_memcpy (&dst.ip4, mp->dst_address, 4);
+    }
+
+  rv = ipip_add_tunnel (mp->is_ipv6 ? IPIP_TRANSPORT_IP6 : IPIP_TRANSPORT_IP4,
+			ntohl (mp->instance), &src, &dst,
+			ntohl (mp->fib_index), &sw_if_index);
+
+  /* *INDENT-OFF* */
+  REPLY_MACRO2(VL_API_IPIP_ADD_TUNNEL_REPLY,
+               ({ rmp->sw_if_index = ntohl(sw_if_index); }));
+  /* *INDENT-ON* */
+}
+
+static void
+vl_api_ipip_del_tunnel_t_handler (vl_api_ipip_del_tunnel_t * mp)
+{
+  vl_api_ipip_del_tunnel_reply_t *rmp;
+
+  int rv = ipip_del_tunnel (ntohl (mp->sw_if_index));
+
+  REPLY_MACRO (VL_API_IPIP_DEL_TUNNEL_REPLY);
+}
+
+static void
+send_ipip_tunnel_details (ipip_tunnel_t * t,
+			  vl_api_registration_t * reg, u32 context)
+{
+  vl_api_ipip_tunnel_details_t *rmp;
+  bool is_ipv6 = t->transport == IPIP_TRANSPORT_IP6 ? true : false;
+  fib_table_t *ft;
+
+  rmp = vl_msg_api_alloc (sizeof (*rmp));
+  memset (rmp, 0, sizeof (*rmp));
+  rmp->_vl_msg_id = htons (VL_API_IPIP_TUNNEL_DETAILS);
+  if (is_ipv6)
+    {
+      clib_memcpy (rmp->src_address, &t->tunnel_src.ip6.as_u8, 16);
+      clib_memcpy (rmp->dst_address, &t->tunnel_dst.ip6.as_u8, 16);
+      ft = fib_table_get (t->fib_index, FIB_PROTOCOL_IP6);
+      rmp->fib_index = htonl (ft->ft_table_id);
+    }
+  else
+    {
+      clib_memcpy (rmp->src_address, &t->tunnel_src.ip4.as_u8, 4);
+      clib_memcpy (rmp->dst_address, &t->tunnel_dst.ip4.as_u8, 4);
+      ft = fib_table_get (t->fib_index, FIB_PROTOCOL_IP4);
+      rmp->fib_index = htonl (ft->ft_table_id);
+    }
+  rmp->instance = htonl (t->user_instance);
+  rmp->sw_if_index = htonl (t->sw_if_index);
+  rmp->context = context;
+  rmp->is_ipv6 = is_ipv6;
+
+  vl_api_send_msg (reg, (u8 *) rmp);
+}
+
+static void
+vl_api_ipip_tunnel_dump_t_handler (vl_api_ipip_tunnel_dump_t * mp)
+{
+  vl_api_registration_t *reg;
+  ipip_main_t *gm = &ipip_main;
+  ipip_tunnel_t *t;
+  u32 sw_if_index;
+
+  reg = vl_api_client_index_to_registration (mp->client_index);
+  if (!reg)
+    return;
+
+  sw_if_index = ntohl (mp->sw_if_index);
+
+  if (sw_if_index == ~0)
+    {
+    /* *INDENT-OFF* */
+    pool_foreach(t, gm->tunnels,
+                 ({ send_ipip_tunnel_details(t, reg, mp->context); }));
+    /* *INDENT-ON* */
+    }
+  else
+    {
+      t = ipip_tunnel_db_find_by_sw_if_index (sw_if_index);
+      if (t)
+	send_ipip_tunnel_details (t, reg, mp->context);
+    }
+}
+
+static void
+vl_api_ipip_6rd_add_tunnel_t_handler (vl_api_ipip_6rd_add_tunnel_t * mp)
+{
+  vl_api_ipip_6rd_add_tunnel_reply_t *rmp;
+  u32 sixrd_tunnel_index;
+
+  int rv = sixrd_add_tunnel ((ip6_address_t *) & mp->ip6_prefix,
+			     mp->ip6_prefix_len,
+			     (ip4_address_t *) & mp->ip4_prefix,
+			     mp->ip4_prefix_len,
+			     (ip4_address_t *) & mp->ip4_src,
+			     mp->security_check,
+			     ntohl (mp->fib_index), &sixrd_tunnel_index);
+
+  REPLY_MACRO2 (VL_API_IPIP_6RD_ADD_TUNNEL_REPLY, (
+						    {
+						    rmp->sw_if_index =
+						    htonl
+						    (sixrd_tunnel_index);}));
+}
+
+static void
+vl_api_ipip_6rd_del_tunnel_t_handler (vl_api_ipip_6rd_del_tunnel_t * mp)
+{
+  vl_api_ipip_6rd_del_tunnel_reply_t *rmp;
+
+  int rv = sixrd_del_tunnel (ntohl (mp->sw_if_index));
+
+  REPLY_MACRO (VL_API_IPIP_6RD_DEL_TUNNEL_REPLY);
+}
+
+/*
+ * ipip_api_hookup
+ * Add vpe's API message handlers to the table.
+ * vlib has alread mapped shared memory and
+ * added the client registration handlers.
+ * See .../vlib-api/vlibmemory/memclnt_vlib.c:memclnt_process()
+ */
+#define vl_msg_name_crc_list
+#include <vnet/vnet_all_api_h.h>
+#undef vl_msg_name_crc_list
+
+static void
+setup_message_id_table (api_main_t * am)
+{
+#define _(id, n, crc) vl_msg_api_add_msg_name_crc(am, #n "_" #crc, id);
+  foreach_vl_msg_name_crc_ipip;
+#undef _
+}
+
+static clib_error_t *
+ipip_api_hookup (vlib_main_t * vm)
+{
+  api_main_t *am = &api_main;
+
+#define _(N, n)                                                                \
+  vl_msg_api_set_handlers(VL_API_##N, #n, vl_api_##n##_t_handler,              \
+                          vl_noop_handler, vl_api_##n##_t_endian,              \
+                          vl_api_##n##_t_print, sizeof(vl_api_##n##_t), 1);
+  foreach_vpe_api_msg;
+#undef _
+
+  /*
+   * Set up the (msg_name, crc, message-id) table
+   */
+  setup_message_id_table (am);
+
+  return 0;
+}
+
+VLIB_API_INIT_FUNCTION (ipip_api_hookup);
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/vnet/ipip/ipip_cli.c b/src/vnet/ipip/ipip_cli.c
new file mode 100644
index 00000000000..45e6451d69a
--- /dev/null
+++ b/src/vnet/ipip/ipip_cli.c
@@ -0,0 +1,318 @@
+/*
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "ipip.h"
+#include <vppinfra/error.h>
+#include <vnet/vnet.h>
+
+static clib_error_t *create_ipip_tunnel_command_fn(vlib_main_t *vm,
+                                                   unformat_input_t *input,
+                                                   vlib_cli_command_t *cmd) {
+  unformat_input_t _line_input, *line_input = &_line_input;
+  ip46_address_t src = ip46_address_initializer, dst = ip46_address_initializer;
+  u32 instance = ~0;
+  u32 fib_index = 0;
+  int rv;
+  u32 num_m_args = 0;
+  u32 sw_if_index;
+  clib_error_t *error = NULL;
+  bool ip4_set = false, ip6_set = false;
+
+  /* Get a line of input. */
+  if (!unformat_user(input, unformat_line_input, line_input))
+    return 0;
+
+  while (unformat_check_input(line_input) != UNFORMAT_END_OF_INPUT) {
+    if (unformat(line_input, "instance %d", &instance))
+      ;
+    else if (unformat(line_input, "src %U", unformat_ip4_address, &src.ip4)) {
+      num_m_args++;
+      ip4_set = true;
+    } else if (unformat(line_input, "dst %U", unformat_ip4_address, &dst.ip4)) {
+      num_m_args++;
+      ip4_set = true;
+    } else if (unformat(line_input, "src %U", unformat_ip6_address, &src.ip6)) {
+      num_m_args++;
+      ip6_set = true;
+    } else if (unformat(line_input, "dst %U", unformat_ip6_address, &dst.ip6)) {
+      num_m_args++;
+      ip6_set = true;
+    } else if (unformat(line_input, "outer-fib-id %d", &fib_index))
+      ;
+    else {
+      error = clib_error_return(0, "unknown input `%U'", format_unformat_error,
+                                line_input);
+      goto done;
+    }
+  }
+
+  if (num_m_args < 2) {
+    error = clib_error_return(0, "mandatory argument(s) missing");
+    goto done;
+  } 
+  if (ip4_set && ip6_set) {
+    error = clib_error_return(0, "source and destination must be of same address family");
+    goto done;
+  }
+
+  rv = ipip_add_tunnel(ip6_set ? IPIP_TRANSPORT_IP6 : IPIP_TRANSPORT_IP4,
+		       instance,
+		       &src,
+		       &dst,
+		       fib_index,
+		       &sw_if_index);
+
+  switch (rv) {
+  case 0:
+    vlib_cli_output(vm, "%U\n", format_vnet_sw_if_index_name, vnet_get_main(),
+                    sw_if_index);
+    break;
+  case VNET_API_ERROR_IF_ALREADY_EXISTS:
+    error = clib_error_return(0, "IPIP tunnel already exists...");
+    goto done;
+  case VNET_API_ERROR_NO_SUCH_FIB:
+    error = clib_error_return(0, "outer fib ID %d doesn't exist\n", fib_index);
+    goto done;
+  case VNET_API_ERROR_NO_SUCH_ENTRY:
+    error = clib_error_return(0, "IPIP tunnel doesn't exist");
+    goto done;
+  case VNET_API_ERROR_INSTANCE_IN_USE:
+    error = clib_error_return(0, "Instance is in use");
+    goto done;
+  default:
+    error = clib_error_return(0, "vnet_ipip_add_del_tunnel returned %d", rv);
+    goto done;
+  }
+
+done:
+  unformat_free(line_input);
+
+  return error;
+}
+
+static clib_error_t *delete_ipip_tunnel_command_fn(vlib_main_t *vm,
+                                                   unformat_input_t *input,
+                                                   vlib_cli_command_t *cmd) {
+  unformat_input_t _line_input, *line_input = &_line_input;
+  int rv;
+  u32 num_m_args = 0;
+  u32 sw_if_index = ~0;
+  clib_error_t *error = NULL;
+
+  /* Get a line of input. */
+  if (!unformat_user(input, unformat_line_input, line_input))
+    return 0;
+
+  while (unformat_check_input(line_input) != UNFORMAT_END_OF_INPUT) {
+    if (unformat(line_input, "sw_if_index %d", &sw_if_index))
+      num_m_args++;
+    else {
+      error = clib_error_return(0, "unknown input `%U'", format_unformat_error,
+                                line_input);
+      goto done;
+    }
+  }
+
+  if (num_m_args < 1) {
+    error = clib_error_return(0, "mandatory argument(s) missing");
+    goto done;
+  } 
+
+  rv = ipip_del_tunnel(sw_if_index);
+  printf("RV %d\n", rv);
+
+done:
+  unformat_free(line_input);
+
+  return error;
+}
+
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND(create_ipip_tunnel_command, static) = {
+    .path = "create ipip tunnel",
+    .short_help = "create ipip tunnel src <addr> dst <addr> [instance <n>] "
+                  "[outer-fib-id <fib>]",
+    .function = create_ipip_tunnel_command_fn,
+};
+VLIB_CLI_COMMAND(delete_ipip_tunnel_command, static) = {
+    .path = "delete ipip tunnel",
+    .short_help = "delete ipip tunnel sw_if_index <sw_if_index ",
+    .function = delete_ipip_tunnel_command_fn,
+};
+/* *INDENT-ON* */
+
+static u8 *format_ipip_tunnel(u8 *s, va_list *args) {
+  ipip_tunnel_t *t = va_arg(*args, ipip_tunnel_t *);
+
+  ip46_type_t type = (t->transport == IPIP_TRANSPORT_IP4) ? IP46_TYPE_IP4 : IP46_TYPE_IP6;
+  switch (t->mode) {
+  case IPIP_MODE_6RD:
+    s = format(s, "[%d] 6rd src %U ip6-pfx %U/%d fib-idx %d sw-if-idx %d ",
+	       t->dev_instance,
+	       format_ip46_address, &t->tunnel_src, type,
+	       format_ip6_address, &t->sixrd.ip6_prefix, t->sixrd.ip6_prefix_len,
+	       t->fib_index, t->sw_if_index);
+    break;
+  case IPIP_MODE_P2P:
+  default:
+    s = format(s, "[%d] instance %d src %U dst %U fib-idx %d sw-if-idx %d ",
+	       t->dev_instance, t->user_instance,
+	       format_ip46_address, &t->tunnel_src, type,
+	       format_ip46_address, &t->tunnel_dst, type,
+	       t->fib_index, t->sw_if_index);
+    break;
+  }
+
+  return s;
+}
+
+static clib_error_t *show_ipip_tunnel_command_fn(vlib_main_t *vm,
+                                                 unformat_input_t *input,
+                                                 vlib_cli_command_t *cmd) {
+  ipip_main_t *gm = &ipip_main;
+  ipip_tunnel_t *t;
+  u32 ti = ~0;
+
+  if (pool_elts(gm->tunnels) == 0)
+    vlib_cli_output(vm, "No IPIP tunnels configured...");
+
+  while (unformat_check_input(input) != UNFORMAT_END_OF_INPUT) {
+    if (unformat(input, "%d", &ti))
+      ;
+    else
+      break;
+  }
+
+  if (ti == ~0) {
+    /* *INDENT-OFF* */
+    pool_foreach(t, gm->tunnels,
+                 ({vlib_cli_output(vm, "%U", format_ipip_tunnel, t); }));
+    /* *INDENT-ON* */
+  } else {
+    t = pool_elt_at_index(gm->tunnels, ti);
+    if (t)
+      vlib_cli_output(vm, "%U", format_ipip_tunnel, t);
+  }
+  return 0;
+}
+
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND(show_ipip_tunnel_command, static) = {
+    .path = "show ipip tunnel",
+    .function = show_ipip_tunnel_command_fn,
+};
+/* *INDENT-ON* */
+
+static clib_error_t *create_sixrd_tunnel_command_fn(vlib_main_t *vm,
+                                                    unformat_input_t *input,
+                                                    vlib_cli_command_t *cmd) {
+  unformat_input_t _line_input, *line_input = &_line_input;
+  ip4_address_t ip4_prefix;
+  ip6_address_t ip6_prefix;
+  ip4_address_t ip4_src;
+  u32 ip6_prefix_len = 0, ip4_prefix_len = 0, sixrd_tunnel_index;
+  u32 num_m_args = 0;
+  /* Optional arguments */
+  u32 fib_index = 0;
+  clib_error_t *error = 0;
+  bool security_check = false;
+
+  /* Get a line of input. */
+  if (!unformat_user(input, unformat_line_input, line_input))
+    return 0;
+  while (unformat_check_input(line_input) != UNFORMAT_END_OF_INPUT) {
+    if (unformat(line_input, "security-check"))
+      security_check = true;
+    else if (unformat(line_input, "ip6-pfx %U/%d", unformat_ip6_address,
+                      &ip6_prefix, &ip6_prefix_len))
+      num_m_args++;
+    else if (unformat(line_input, "ip4-pfx %U/%d", unformat_ip4_address,
+                      &ip4_prefix, &ip4_prefix_len))
+      num_m_args++;
+    else if (unformat(line_input, "ip4-src %U", unformat_ip4_address, &ip4_src))
+      num_m_args++;
+    else if (unformat(line_input, "fib-id %d", &fib_index))
+      ;
+    else {
+      error = clib_error_return(0, "unknown input `%U'", format_unformat_error,
+                                line_input);
+      goto done;
+    }
+  }
+
+  if (num_m_args < 3) {
+    error = clib_error_return(0, "mandatory argument(s) missing");
+    goto done;
+  }
+  int rv = sixrd_add_tunnel(&ip6_prefix, ip6_prefix_len, &ip4_prefix,
+			    ip4_prefix_len, &ip4_src, security_check,
+			    fib_index, &sixrd_tunnel_index);
+  if (rv)
+    error = clib_error_return(0, "adding tunnel failed %d", rv);
+
+ done:
+  unformat_free(line_input);
+
+  return error;
+}
+
+static clib_error_t *delete_sixrd_tunnel_command_fn(vlib_main_t *vm,
+                                                    unformat_input_t *input,
+                                                    vlib_cli_command_t *cmd) {
+  unformat_input_t _line_input, *line_input = &_line_input;
+  u32 num_m_args = 0;
+  /* Optional arguments */
+  clib_error_t *error = 0;
+  u32 sw_if_index = ~0;
+
+  /* Get a line of input. */
+  if (!unformat_user(input, unformat_line_input, line_input))
+    return 0;
+  while (unformat_check_input(line_input) != UNFORMAT_END_OF_INPUT) {
+    if (unformat(line_input, "sw_if_index %d", &sw_if_index))
+      num_m_args++;
+    else {
+      error = clib_error_return(0, "unknown input `%U'", format_unformat_error,
+                                line_input);
+      goto done;
+    }
+  }
+
+  if (num_m_args < 1) {
+    error = clib_error_return(0, "mandatory argument(s) missing");
+    goto done;
+  }
+  int rv = sixrd_del_tunnel(sw_if_index);
+  printf("RV %d\n", rv);
+
+done:
+  unformat_free(line_input);
+
+  return error;
+}
+
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND(create_sixrd_tunnel_command, static) = {
+    .path = "create 6rd tunnel",
+    .short_help = "create 6rd tunnel ip6-pfx <ip6-pfx> ip4-pfx <ip4-pfx> "
+                  "ip4-src <ip4-addr> [del]",
+    .function = create_sixrd_tunnel_command_fn,
+};
+VLIB_CLI_COMMAND(delete_sixrd_tunnel_command, static) = {
+    .path = "delete 6rd tunnel",
+    .short_help = "delete 6rd tunnel sw_if_index <sw_if_index",
+    .function = delete_sixrd_tunnel_command_fn,
+};
+/* *INDENT-ON* */
diff --git a/src/vnet/ipip/node.c b/src/vnet/ipip/node.c
new file mode 100644
index 00000000000..f24ea97b2cd
--- /dev/null
+++ b/src/vnet/ipip/node.c
@@ -0,0 +1,268 @@
+/*
+ * node.c: ipip packet processing
+ *
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or aipiped to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <vlib/vlib.h>
+#include <vnet/ipip/ipip.h>
+#include <vnet/ip/ip6_packet.h>
+#include <vnet/mpls/mpls.h>
+#include <vnet/pg/pg.h>
+#include <vppinfra/sparse_vec.h>
+
+#define foreach_ipip_input_next                                                \
+  _(PUNT, "error-punt")                                                        \
+  _(DROP, "error-drop")                                                        \
+  _(IP4_INPUT, "ip4-input")                                                    \
+  _(IP6_INPUT, "ip6-input")
+
+typedef enum
+{
+#define _(s, n) IPIP_INPUT_NEXT_##s,
+  foreach_ipip_input_next
+#undef _
+    IPIP_INPUT_N_NEXT,
+} ipip_input_next_t;
+
+typedef struct
+{
+  u32 tunnel_id;
+  u32 length;
+  ip46_address_t src;
+  ip46_address_t dst;
+  u8 is_ipv6;
+} ipip_rx_trace_t;
+
+u8 *
+format_ipip_rx_trace (u8 * s, va_list * args)
+{
+  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
+  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
+  ipip_rx_trace_t *t = va_arg (*args, ipip_rx_trace_t *);
+
+  s = format (s, "IPIP: tunnel %d len %d src %U dst %U", t->tunnel_id,
+	      clib_net_to_host_u16 (t->length), format_ip46_address, &t->src,
+	      IP46_TYPE_ANY, format_ip46_address, &t->dst, IP46_TYPE_ANY);
+  return s;
+}
+
+always_inline uword
+ipip_input (vlib_main_t * vm, vlib_node_runtime_t * node,
+	    vlib_frame_t * from_frame, bool is_ipv6)
+{
+  ipip_main_t *gm = &ipip_main;
+  u32 n_left_from, next_index, *from, *to_next, n_left_to_next;
+  u32 tunnel_sw_if_index = ~0;
+  u32 thread_index = vlib_get_thread_index ();
+  u32 len;
+  vnet_interface_main_t *im = &gm->vnet_main->interface_main;
+
+  from = vlib_frame_vector_args (from_frame);
+  n_left_from = from_frame->n_vectors;
+  next_index = node->cached_next_index;
+  while (n_left_from > 0)
+    {
+      vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
+
+      while (n_left_from > 0 && n_left_to_next > 0)
+	{
+	  u32 bi0;
+	  vlib_buffer_t *b0;
+	  ip4_header_t *ip40;
+	  ip6_header_t *ip60;
+	  u32 next0 = IPIP_INPUT_NEXT_DROP;
+	  ip46_address_t src0 = ip46_address_initializer, dst0 =
+	    ip46_address_initializer;
+	  ipip_transport_t transport0;
+	  u8 inner_protocol0;
+
+	  bi0 = to_next[0] = from[0];
+	  from += 1;
+	  n_left_from -= 1;
+	  to_next += 1;
+	  n_left_to_next -= 1;
+
+	  b0 = vlib_get_buffer (vm, bi0);
+
+	  if (is_ipv6)
+	    {
+	      ip60 = vlib_buffer_get_current (b0);
+	      vlib_buffer_advance (b0, sizeof (*ip60));
+	      ip_set (&src0, &ip60->src_address, false);
+	      ip_set (&dst0, &ip60->dst_address, false);
+	      inner_protocol0 = ip60->protocol;
+	      transport0 = IPIP_TRANSPORT_IP6;
+	    }
+	  else
+	    {
+	      ip40 = vlib_buffer_get_current (b0);
+	      vlib_buffer_advance (b0, sizeof (*ip40));
+	      ip_set (&src0, &ip40->src_address, true);
+	      ip_set (&dst0, &ip40->dst_address, true);
+	      inner_protocol0 = ip40->protocol;
+	      transport0 = IPIP_TRANSPORT_IP4;
+	    }
+
+	  /*
+	   * Find tunnel. First a lookup for P2P tunnels, then a lookup
+	   * for multipoint tunnels
+	   */
+	  ipip_tunnel_key_t key0 = {.transport = transport0,
+	    .fib_index = vnet_buffer (b0)->ip.fib_index,
+	    .src = dst0,
+	    .dst = src0
+	  };
+	  ipip_tunnel_t *t0 = ipip_tunnel_db_find (&key0);
+	  if (!t0)
+	    {
+	      ip46_address_reset (&key0.dst);
+	      t0 = ipip_tunnel_db_find (&key0);
+	      if (!t0)
+		{
+		  next0 = IPIP_INPUT_NEXT_DROP;
+		  b0->error = node->errors[IPIP_ERROR_NO_TUNNEL];
+		  goto drop;
+		}
+	    }
+	  tunnel_sw_if_index = t0->sw_if_index;
+
+	  len = vlib_buffer_length_in_chain (vm, b0);
+	  vnet_buffer (b0)->sw_if_index[VLIB_RX] = tunnel_sw_if_index;
+
+	  if (inner_protocol0 == IP_PROTOCOL_IPV6)
+	    next0 = IPIP_INPUT_NEXT_IP6_INPUT;
+	  else if (inner_protocol0 == IP_PROTOCOL_IP_IN_IP)
+	    next0 = IPIP_INPUT_NEXT_IP4_INPUT;
+
+	  if (!is_ipv6 && t0->mode == IPIP_MODE_6RD
+	      && t0->sixrd.security_check)
+	    {
+	      ip6_header_t *inner_ip60 = vlib_buffer_get_current (b0);
+	      if (sixrd_get_addr_net (t0, inner_ip60->src_address.as_u64[0])
+		  != ip40->src_address.as_u32)
+		{
+		  next0 = IPIP_INPUT_NEXT_DROP;
+		  b0->error = node->errors[IPIP_ERROR_NO_TUNNEL];
+		  goto drop;
+		}
+	    }
+
+	  vlib_increment_combined_counter (im->combined_sw_if_counters +
+					   VNET_INTERFACE_COUNTER_RX,
+					   thread_index, tunnel_sw_if_index,
+					   1 /* packets */ ,
+					   len /* bytes */ );
+
+	drop:
+	  if (PREDICT_FALSE (b0->flags & VLIB_BUFFER_IS_TRACED))
+	    {
+	      ipip_rx_trace_t *tr =
+		vlib_add_trace (vm, node, b0, sizeof (*tr));
+	      tr->tunnel_id = tunnel_sw_if_index;
+	      if (is_ipv6)
+		{
+		  tr->length = ip60->payload_length;
+		  tr->src.ip6.as_u64[0] = ip60->src_address.as_u64[0];
+		  tr->src.ip6.as_u64[1] = ip60->src_address.as_u64[1];
+		  tr->dst.ip6.as_u64[0] = ip60->dst_address.as_u64[0];
+		  tr->dst.ip6.as_u64[1] = ip60->dst_address.as_u64[1];
+		}
+	      else
+		{
+		  tr->length = ip40->length;
+		  tr->src.ip4.as_u32 = ip40->src_address.as_u32;
+		  tr->dst.ip4.as_u32 = ip40->dst_address.as_u32;
+		}
+	    }
+
+	  vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next,
+					   n_left_to_next, bi0, next0);
+	}
+
+      vlib_put_next_frame (vm, node, next_index, n_left_to_next);
+    }
+  vlib_node_increment_counter (vm,
+			       !is_ipv6 ? ipip4_input_node.index :
+			       ipip6_input_node.index, IPIP_ERROR_DECAP_PKTS,
+			       from_frame->n_vectors);
+  return from_frame->n_vectors;
+}
+
+static uword
+ipip4_input (vlib_main_t * vm, vlib_node_runtime_t * node,
+	     vlib_frame_t * from_frame)
+{
+  return ipip_input (vm, node, from_frame, /* is_ip6 */ false);
+}
+
+static uword
+ipip6_input (vlib_main_t * vm, vlib_node_runtime_t * node,
+	     vlib_frame_t * from_frame)
+{
+  return ipip_input (vm, node, from_frame, /* is_ip6 */ true);
+}
+
+static char *ipip_error_strings[] = {
+#define _(sym,string) string,
+  foreach_ipip_error
+#undef _
+};
+
+/* *INDENT-OFF* */
+VLIB_REGISTER_NODE(ipip4_input_node) = {
+    .function = ipip4_input,
+    .name = "ipip4-input",
+    /* Takes a vector of packets. */
+    .vector_size = sizeof(u32),
+    .n_errors = IPIP_N_ERROR,
+    .error_strings = ipip_error_strings,
+    .n_next_nodes = IPIP_INPUT_N_NEXT,
+    .next_nodes =
+        {
+#define _(s, n) [IPIP_INPUT_NEXT_##s] = n,
+            foreach_ipip_input_next
+#undef _
+        },
+    .format_trace = format_ipip_rx_trace,
+};
+
+VLIB_REGISTER_NODE(ipip6_input_node) = {
+    .function = ipip6_input,
+    .name = "ipip6-input",
+    /* Takes a vector of packets. */
+    .vector_size = sizeof(u32),
+    .n_errors = IPIP_N_ERROR,
+    .error_strings = ipip_error_strings,
+    .n_next_nodes = IPIP_INPUT_N_NEXT,
+    .next_nodes =
+        {
+#define _(s, n) [IPIP_INPUT_NEXT_##s] = n,
+            foreach_ipip_input_next
+#undef _
+        },
+    .format_trace = format_ipip_rx_trace,
+};
+
+VLIB_NODE_FUNCTION_MULTIARCH(ipip4_input_node, ipip4_input)
+VLIB_NODE_FUNCTION_MULTIARCH(ipip6_input_node, ipip6_input)
+/* *INDENT-ON* */
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/vnet/ipip/sixrd.c b/src/vnet/ipip/sixrd.c
new file mode 100644
index 00000000000..c44c8345e30
--- /dev/null
+++ b/src/vnet/ipip/sixrd.c
@@ -0,0 +1,519 @@
+/*
+ * sixrd.c - 6RD specific functions (RFC5969)
+ *
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * This code supports the following sixrd modes:
+ *
+ * 32 EA bits (Complete IPv4 address is embedded):
+ *   ea_bits_len = 32
+ * IPv4 suffix is embedded:
+ *   ea_bits_len = < 32
+ * No embedded address bits (1:1 mode):
+ *   ea_bits_len = 0
+ */
+
+#include "ipip.h"
+#include <vlibapi/api.h>
+#include <vlibmemory/api.h>
+#include <vnet/adj/adj.h>
+#include <vnet/adj/adj_delegate.h>
+#include <vnet/adj/adj_midchain.h>
+#include <vnet/dpo/lookup_dpo.h>
+#include <vnet/fib/fib_table.h>
+#include <vnet/fib/ip6_fib.h>
+#include <vnet/plugin/plugin.h>
+#include <vpp/app/version.h>	// Really needed?
+
+extern vlib_node_registration_t ip4_sixrd_node;
+
+/**
+ * Adj delegate data
+ */
+typedef struct sixrd_adj_delegate_t_
+{
+  u32 adj_index;
+  fib_node_t sixrd_node;
+  fib_node_index_t sixrd_fib_entry_index;
+  u32 sixrd_sibling;
+} sixrd_adj_delegate_t;
+
+/**
+ * Pool of delegate structs
+ */
+static sixrd_adj_delegate_t *sixrd_adj_delegate_pool;
+
+/**
+ * Adj delegate registered type
+ */
+static adj_delegate_type_t sixrd_adj_delegate_type;
+
+/**
+ * FIB node registered type
+ */
+static fib_node_type_t sixrd_fib_node_type;
+
+static inline sixrd_adj_delegate_t *
+sixrd_adj_from_base (adj_delegate_t * ad)
+{
+  if (ad == NULL)
+    return (NULL);
+  return (pool_elt_at_index (sixrd_adj_delegate_pool, ad->ad_index));
+}
+
+static inline const sixrd_adj_delegate_t *
+sixrd_adj_from_const_base (const adj_delegate_t * ad)
+{
+  if (ad == NULL)
+    {
+      return (NULL);
+    }
+  return (pool_elt_at_index (sixrd_adj_delegate_pool, ad->ad_index));
+}
+
+static void
+sixrd_fixup (vlib_main_t * vm, ip_adjacency_t * adj, vlib_buffer_t * b0,
+	     const void *data)
+{
+  ip4_header_t *ip4 = vlib_buffer_get_current (b0);
+  ip6_header_t *ip6 = vlib_buffer_get_current (b0) + sizeof (ip4_header_t);
+  const ipip_tunnel_t *t = data;
+
+  ip4->length = clib_host_to_net_u16 (vlib_buffer_length_in_chain (vm, b0));
+  ip4->dst_address.as_u32 =
+    sixrd_get_addr_net (t, ip6->dst_address.as_u64[0]);
+  ip4->checksum = ip4_header_checksum (ip4);
+}
+
+static void
+ip6ip_fixup (vlib_main_t * vm, ip_adjacency_t * adj, vlib_buffer_t * b0,
+	     const void *data)
+{
+  const ipip_tunnel_t *t = data;
+  ip4_header_t *ip4 = vlib_buffer_get_current (b0);
+  ip4->length = clib_host_to_net_u16 (vlib_buffer_length_in_chain (vm, b0));
+  ip4->dst_address.as_u32 =
+    sixrd_get_addr_net (t, adj->sub_type.nbr.next_hop.as_u64[0]);
+  ip4->checksum = ip4_header_checksum (ip4);
+}
+
+static u8 *
+sixrd_build_rewrite (vnet_main_t * vnm, u32 sw_if_index,
+		     vnet_link_t link_type, const void *dst_address)
+{
+  u8 *rewrite = NULL;
+  ipip_tunnel_t *t;
+
+  t = ipip_tunnel_db_find_by_sw_if_index (sw_if_index);
+  if (!t)
+    return 0;
+
+  vec_validate (rewrite, sizeof (ip4_header_t) - 1);
+  ip4_header_t *ip4 = (ip4_header_t *) rewrite;
+  ip4->ip_version_and_header_length = 0x45;
+  ip4->ttl = 64;
+  ip4->protocol = IP_PROTOCOL_IPV6;
+  /* fixup ip4 header length and checksum after-the-fact */
+  ip4->src_address.as_u32 = t->tunnel_src.ip4.as_u32;
+  ip4->dst_address.as_u32 = 0;
+  ip4->checksum = ip4_header_checksum (ip4);
+
+  return rewrite;
+}
+
+static void
+ip6ip_tunnel_stack (adj_index_t ai, u32 fib_entry_index)
+{
+  ip_adjacency_t *adj = adj_get (ai);
+  ipip_tunnel_t *t;
+  u32 sw_if_index = adj->rewrite_header.sw_if_index;
+
+  t = ipip_tunnel_db_find_by_sw_if_index (sw_if_index);
+  if (!t)
+    return;
+
+  /*
+   * find the adjacency that is contributed by the FIB entry
+   * that this tunnel resolves via, and use it as the next adj
+   * in the midchain
+   */
+  if (vnet_hw_interface_get_flags (vnet_get_main (), t->hw_if_index) &
+      VNET_HW_INTERFACE_FLAG_LINK_UP)
+    {
+      adj_nbr_midchain_stack (ai,
+			      fib_entry_contribute_ip_forwarding
+			      (fib_entry_index));
+    }
+  else
+    {
+      adj_nbr_midchain_unstack (ai);
+    }
+}
+
+static void
+sixrd_tunnel_stack (adj_index_t ai, u32 fib_index)
+{
+  dpo_id_t dpo = DPO_INVALID;
+  ip_adjacency_t *adj = adj_get (ai);
+  u32 sw_if_index = adj->rewrite_header.sw_if_index;
+
+  ipip_tunnel_t *t = ipip_tunnel_db_find_by_sw_if_index (sw_if_index);
+  if (!t)
+    return;
+
+  lookup_dpo_add_or_lock_w_fib_index (fib_index, DPO_PROTO_IP4,
+				      LOOKUP_UNICAST, LOOKUP_INPUT_DST_ADDR,
+				      LOOKUP_TABLE_FROM_CONFIG, &dpo);
+  adj_nbr_midchain_stack (ai, &dpo);
+}
+
+const static ip46_address_t sixrd_special_nh = {
+  .ip6 = {
+	  .as_u64 = {
+		     [0] = 0xffffffffffffffff,
+		     [1] = 0xffffffffffffffff,
+		     },
+	  },
+};
+
+static void
+sixrd_update_adj (vnet_main_t * vnm, u32 sw_if_index, adj_index_t ai)
+{
+  ip_adjacency_t *adj = adj_get (ai);
+  ipip_tunnel_t *t = ipip_tunnel_db_find_by_sw_if_index (sw_if_index);
+
+  if (!memcmp (&sixrd_special_nh, &adj->sub_type.nbr.next_hop,
+	       sizeof (sixrd_special_nh)))
+    {
+      adj_nbr_midchain_update_rewrite (ai, sixrd_fixup, t, ADJ_FLAG_NONE,
+				       sixrd_build_rewrite (vnm, sw_if_index,
+							    adj_get_link_type
+							    (ai), NULL));
+      sixrd_tunnel_stack (ai, t->fib_index);
+    }
+  else
+    {
+      sixrd_adj_delegate_t *sixrd_ad;
+      ip4_address_t da4;
+
+      da4.as_u32 =
+	sixrd_get_addr_net (t, adj->sub_type.nbr.next_hop.as_u64[0]);
+
+      fib_prefix_t pfx = {
+	.fp_proto = FIB_PROTOCOL_IP4,
+	.fp_len = 32,
+	.fp_addr = {
+		    .ip4 = da4,
+		    }
+	,
+      };
+
+      adj_nbr_midchain_update_rewrite (ai, ip6ip_fixup, t, ADJ_FLAG_NONE,
+				       sixrd_build_rewrite (vnm, sw_if_index,
+							    adj_get_link_type
+							    (ai), NULL));
+
+      sixrd_ad =
+	sixrd_adj_from_base (adj_delegate_get (adj, sixrd_adj_delegate_type));
+      if (sixrd_ad == NULL)
+	{
+	  pool_get (sixrd_adj_delegate_pool, sixrd_ad);
+	  fib_node_init (&sixrd_ad->sixrd_node, sixrd_fib_node_type);
+	  sixrd_ad->adj_index = ai;
+	  sixrd_ad->sixrd_fib_entry_index =
+	    fib_table_entry_special_add (t->fib_index, &pfx, FIB_SOURCE_RR,
+					 FIB_ENTRY_FLAG_NONE);
+	  sixrd_ad->sixrd_sibling =
+	    fib_entry_child_add (sixrd_ad->sixrd_fib_entry_index,
+				 sixrd_fib_node_type,
+				 sixrd_ad - sixrd_adj_delegate_pool);
+
+	  adj_delegate_add (adj, sixrd_adj_delegate_type,
+			    sixrd_ad - sixrd_adj_delegate_pool);
+
+	  ip6ip_tunnel_stack (ai, sixrd_ad->sixrd_fib_entry_index);
+	}
+    }
+}
+
+clib_error_t *
+sixrd_interface_admin_up_down (vnet_main_t * vnm, u32 hw_if_index, u32 flags)
+{
+  /* Always up */
+  vnet_hw_interface_set_flags (vnm, hw_if_index,
+			       VNET_HW_INTERFACE_FLAG_LINK_UP);
+  return /* no error */ 0;
+}
+
+/* *INDENT-OFF* */
+VNET_HW_INTERFACE_CLASS(sixrd_hw_interface_class) = {
+    .name = "ip6ip-6rd",
+    .build_rewrite = sixrd_build_rewrite,
+    .update_adjacency = sixrd_update_adj,
+};
+
+VNET_DEVICE_CLASS(sixrd_device_class) = {
+    .name = "ip6ip-6rd",
+    .admin_up_down_function = sixrd_interface_admin_up_down,
+#ifdef SOON
+    .clear counter = 0;
+#endif
+}
+;
+/* *INDENT-ON* */
+
+int
+sixrd_add_tunnel (ip6_address_t * ip6_prefix, u8 ip6_prefix_len,
+		  ip4_address_t * ip4_prefix, u8 ip4_prefix_len,
+		  ip4_address_t * ip4_src, bool security_check,
+		  u32 fib_index, u32 * sw_if_index)
+{
+  ipip_main_t *gm = &ipip_main;
+  ipip_tunnel_t *t;
+
+  if (fib_index == ~0)
+    return VNET_API_ERROR_NO_SUCH_FIB;
+
+  if ((ip6_prefix_len + 32 - ip4_prefix_len) > 64)
+    return VNET_API_ERROR_INVALID_VALUE;
+
+  /* Tunnel already configured */
+  ip46_address_t src = ip46_address_initializer, dst =
+    ip46_address_initializer;
+  ip_set (&src, ip4_src, true);
+  ipip_tunnel_key_t key = {.transport = IPIP_TRANSPORT_IP4,
+    .fib_index = fib_index,
+    .src = src,
+    .dst = dst
+  };
+
+  t = ipip_tunnel_db_find (&key);
+  if (t)
+    return VNET_API_ERROR_IF_ALREADY_EXISTS;
+
+  /* Get tunnel index */
+  pool_get_aligned (gm->tunnels, t, CLIB_CACHE_LINE_BYTES);
+  memset (t, 0, sizeof (*t));
+  u32 t_idx = t - gm->tunnels;	/* tunnel index (or instance) */
+
+  /* Init tunnel struct */
+  t->mode = IPIP_MODE_6RD;
+  t->sixrd.ip4_prefix.as_u32 = ip4_prefix->as_u32;
+  t->sixrd.ip4_prefix_len = ip4_prefix_len;
+  t->sixrd.ip6_prefix = *ip6_prefix;
+  t->sixrd.ip6_prefix_len = ip6_prefix_len;
+  t->tunnel_src = src;
+  t->sixrd.security_check = security_check;
+  t->sixrd.shift =
+    (ip4_prefix_len < 32) ? 64 - ip6_prefix_len - (32 - ip4_prefix_len) : 0;
+
+  /* Create interface */
+  u32 hw_if_index =
+    vnet_register_interface (vnet_get_main (), sixrd_device_class.index,
+			     t_idx,
+			     sixrd_hw_interface_class.index, t_idx);
+
+  /* Default the interface to up and enable IPv6 (payload) */
+  vnet_hw_interface_t *hi =
+    vnet_get_hw_interface (vnet_get_main (), hw_if_index);
+  t->hw_if_index = hw_if_index;
+  t->fib_index = fib_index;
+  t->sw_if_index = hi->sw_if_index;
+  t->dev_instance = t_idx;
+  t->user_instance = t_idx;
+
+  hi->max_l3_packet_bytes[VLIB_RX] = hi->max_l3_packet_bytes[VLIB_TX] = 1480;
+
+  ipip_tunnel_db_add (t, &key);
+
+  vec_validate_init_empty (gm->tunnel_index_by_sw_if_index, hi->sw_if_index,
+			   ~0);
+  gm->tunnel_index_by_sw_if_index[hi->sw_if_index] = t_idx;
+
+  vnet_hw_interface_set_flags (vnet_get_main (), hw_if_index,
+			       VNET_HW_INTERFACE_FLAG_LINK_UP);
+  vnet_sw_interface_set_flags (vnet_get_main (), hi->sw_if_index,
+			       VNET_SW_INTERFACE_FLAG_ADMIN_UP);
+  ip6_sw_interface_enable_disable (hi->sw_if_index, true);
+
+  /* Create IPv6 route/adjacency */
+  fib_prefix_t pfx6 = {
+    .fp_proto = FIB_PROTOCOL_IP6,
+    .fp_len = t->sixrd.ip6_prefix_len,
+    .fp_addr = {
+		.ip6 = t->sixrd.ip6_prefix,
+		}
+    ,
+  };
+
+  fib_table_entry_update_one_path (fib_index, &pfx6, FIB_SOURCE_CLI,
+				   FIB_ENTRY_FLAG_ATTACHED, DPO_PROTO_IP6,
+				   &sixrd_special_nh, hi->sw_if_index, ~0, 1,
+				   NULL, FIB_ROUTE_PATH_FLAG_NONE);
+
+  *sw_if_index = hi->sw_if_index;
+
+  if (!gm->ip4_protocol_registered)
+    {
+      vlib_node_t *ipip4_input =
+	vlib_get_node_by_name (gm->vlib_main, (u8 *) "ipip4-input");
+      ASSERT (ipip4_input);
+      ip4_register_protocol (IP_PROTOCOL_IPV6, ipip4_input->index);
+    }
+  return 0;
+}
+
+/*
+ * sixrd_del_tunnel
+ */
+int
+sixrd_del_tunnel (u32 sw_if_index)
+{
+  ipip_main_t *gm = &ipip_main;
+  ipip_tunnel_t *t = ipip_tunnel_db_find_by_sw_if_index (sw_if_index);
+
+  if (!t)
+    {
+      clib_warning ("SIXRD tunnel delete: tunnel does not exist: %d",
+		    sw_if_index);
+      return -1;
+    }
+
+  fib_prefix_t pfx6 = {
+    .fp_proto = FIB_PROTOCOL_IP6,
+    .fp_len = t->sixrd.ip6_prefix_len,
+    .fp_addr = {
+		.ip6 = t->sixrd.ip6_prefix,
+		}
+    ,
+  };
+  fib_table_entry_special_remove (0, &pfx6, FIB_SOURCE_CLI);
+  vnet_sw_interface_set_flags (vnet_get_main (), t->sw_if_index,
+			       0 /* down */ );
+  ip6_sw_interface_enable_disable (t->sw_if_index, false);
+  gm->tunnel_index_by_sw_if_index[t->sw_if_index] = ~0;
+
+  vnet_delete_hw_interface (vnet_get_main (), t->hw_if_index);
+  ipip_tunnel_db_remove (t);
+  pool_put (gm->tunnels, t);
+
+  return 0;
+}
+
+static void
+sixrd_adj_delegate_adj_deleted (adj_delegate_t * aed)
+{
+  sixrd_adj_delegate_t *sixrd_ad;
+
+  sixrd_ad = sixrd_adj_from_base (aed);
+  fib_entry_child_remove (sixrd_ad->sixrd_fib_entry_index,
+			  sixrd_ad->sixrd_sibling);
+  fib_table_entry_delete_index (sixrd_ad->sixrd_fib_entry_index,
+				FIB_SOURCE_RR);
+  pool_put (sixrd_adj_delegate_pool, sixrd_ad);
+}
+
+static u8 *
+sixrd_adj_delegate_format (const adj_delegate_t * aed, u8 * s)
+{
+  const sixrd_adj_delegate_t *sixrd_ad;
+
+  sixrd_ad = sixrd_adj_from_const_base (aed);
+  s = format (s, "SIXRD:[fib-entry:%d]", sixrd_ad->sixrd_fib_entry_index);
+
+  return (s);
+}
+
+static void
+sixrd_fib_node_last_lock_gone (fib_node_t * node)
+{
+  /* top of the dependency tree, locks not managed here. */
+}
+
+static sixrd_adj_delegate_t *
+sixrd_adj_delegate_from_fib_node (fib_node_t * node)
+{
+  return ((sixrd_adj_delegate_t *) (((char *) node) -
+				    STRUCT_OFFSET_OF (sixrd_adj_delegate_t,
+						      sixrd_node)));
+}
+
+static fib_node_back_walk_rc_t
+sixrd_fib_node_back_walk_notify (fib_node_t * node,
+				 fib_node_back_walk_ctx_t * ctx)
+{
+  sixrd_adj_delegate_t *sixrd_ad;
+
+  sixrd_ad = sixrd_adj_delegate_from_fib_node (node);
+  ip6ip_tunnel_stack (sixrd_ad->adj_index, sixrd_ad->sixrd_fib_entry_index);
+
+  return (FIB_NODE_BACK_WALK_CONTINUE);
+}
+
+/**
+ * Function definition to get a FIB node from its index
+ */
+static fib_node_t *
+sixrd_fib_node_get (fib_node_index_t index)
+{
+  sixrd_adj_delegate_t *sixrd_ad;
+
+  sixrd_ad = pool_elt_at_index (sixrd_adj_delegate_pool, index);
+
+  return (&sixrd_ad->sixrd_node);
+}
+
+/**
+ * VFT registered with the adjacency delegate
+ */
+const static adj_delegate_vft_t sixrd_adj_delegate_vft = {
+  .adv_adj_deleted = sixrd_adj_delegate_adj_deleted,
+  .adv_format = sixrd_adj_delegate_format,
+};
+
+/**
+ * VFT registered with the FIB node for the adj delegate
+ */
+const static fib_node_vft_t sixrd_fib_node_vft = {
+  .fnv_get = sixrd_fib_node_get,
+  .fnv_last_lock = sixrd_fib_node_last_lock_gone,
+  .fnv_back_walk = sixrd_fib_node_back_walk_notify,
+};
+
+static clib_error_t *
+sixrd_init (vlib_main_t * vm)
+{
+  clib_error_t *error = 0;
+
+  /* Make sure the IPIP tunnel subsystem is initialised */
+  vlib_call_init_function (vm, ipip_init);
+
+  sixrd_adj_delegate_type =
+    adj_delegate_register_new_type (&sixrd_adj_delegate_vft);
+  sixrd_fib_node_type = fib_node_register_new_type (&sixrd_fib_node_vft);
+
+  return error;
+}
+
+VLIB_INIT_FUNCTION (sixrd_init);
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/vnet/ipip/sixrd.h b/src/vnet/ipip/sixrd.h
new file mode 100644
index 00000000000..f107d5e76cd
--- /dev/null
+++ b/src/vnet/ipip/sixrd.h
@@ -0,0 +1,72 @@
+/*---------------------------------------------------------------------------
+ * Copyright (c) 2009-2014 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *---------------------------------------------------------------------------
+ */
+#include <stdbool.h>
+#include <vnet/fib/ip6_fib.h>
+#include <vnet/ip/ip.h>
+#include <vnet/ipip/ipip.h>
+#include <vnet/vnet.h>
+#include <vppinfra/error.h>
+
+#define SIXRD_DEFAULT_MTU 1480	/* 1500 - IPv4 header */
+
+#define foreach_sixrd_error                                                    \
+  /* Must be first. */                                                         \
+  _(NONE, "valid SIXRD packets")                                               \
+  _(BAD_PROTOCOL, "bad protocol")                                              \
+  _(SEC_CHECK, "security check failed")                                        \
+  _(NO_TUNNEL, "no tunnel")
+
+
+typedef enum
+{
+#define _(sym, str) SIXRD_ERROR_##sym,
+  foreach_sixrd_error
+#undef _
+    SIXRD_N_ERROR,
+} sixrd_error_t;
+
+extern sixrd_main_t sixrd_main;
+
+static_always_inline sixrd_tunnel_t *
+find_tunnel_by_ip4_address (ip4_address_t * ip)
+{
+  sixrd_main_t *sm = &sixrd_main;
+  uword *p;
+  p = hash_get (sm->tunnel_by_ip, ip->as_u32);
+  if (!p)
+    return NULL;
+  return pool_elt_at_index (sm->tunnels, p[0]);
+}
+
+static_always_inline sixrd_tunnel_t *
+ip4_sixrd_get_tunnel (u32 sdi, ip4_address_t * addr, u8 * error)
+{
+  sixrd_tunnel_t *t = find_tunnel_by_ip4_address (addr);
+  if (!t)
+    {
+      *error = SIXRD_ERROR_NO_TUNNEL;
+      return NULL;
+    }
+  return t;
+}
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/vnet/vnet_all_api_h.h b/src/vnet/vnet_all_api_h.h
index dd80a09c7b2..90502bf300f 100644
--- a/src/vnet/vnet_all_api_h.h
+++ b/src/vnet/vnet_all_api_h.h
@@ -34,6 +34,7 @@
 #include <vnet/devices/virtio/vhost_user.api.h>
 #include <vnet/devices/tap/tapv2.api.h>
 #include <vnet/gre/gre.api.h>
+#include <vnet/ipip/ipip.api.h>
 #include <vnet/interface.api.h>
 #include <vnet/map/map.api.h>
 #include <vnet/l2/l2.api.h>