[HICN-252] Add per-application policy framework to hicn-light forwarder

Change-Id: I0531cd7a7de179581295ae34766c81cd9cf3e172
Signed-off-by: Jordan Augé <jordan.auge+fdio@cisco.com>
Signed-off-by: Mauro Sardara <msardara@cisco.com>
Co-authored-by: Mauro Sardara <msardara@cisco.com>

152 files changed, 14231 insertions, 548 deletions

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 37d232ea0..1d1d75061 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -19,14 +19,13 @@ set(CMAKE_MODULE_PATH ${CMAKE_MODULE_PATH} "${CMAKE_SOURCE_DIR}/cmake/Modules")
 
 set_property(GLOBAL PROPERTY USE_FOLDERS ON)
 
-set(HICN_INCLUDE_DIRS ${PROJECT_BINARY_DIR}/lib)
-
 ## Enabled components
 option(BUILD_LIBHICN "Build the hicn core library" ON)
 option(BUILD_HICNLIGHT "Build the hicn light forwarder" ON)
 option(BUILD_LIBTRANSPORT "Build the hicn transport library" ON)
 option(BUILD_UTILS "Build the hicn utils" ON)
 option(BUILD_APPS "Build the hicn apps" OFF)
+option(BUILD_CTRL "Build the hicn control tools" ON)
 option(BUILD_HICNPLUGIN "Build the hicn vpp plugin" OFF)
 option(BUILD_HICNEXTRAPLUGIN "Build the hicn extra plugin" OFF)
 
@@ -36,6 +35,7 @@ list(APPEND dir_options
   BUILD_LIBTRANSPORT
   BUILD_UTILS
   BUILD_APPS
+  BUILD_CTRL
 )
 
 set(BUILD_LIBHICN_DIR lib)
@@ -43,15 +43,10 @@ set(BUILD_HICNLIGHT_DIR hicn-light)
 set(BUILD_LIBTRANSPORT_DIR libtransport)
 set(BUILD_UTILS_DIR utils)
 set(BUILD_APPS_DIR apps)
+set(BUILD_CTRL_DIR ctrl)
 set(BUILD_HICNPLUGIN_DIR hicn-plugin)
 set(BUILD_HICNEXTRAPLUGIN_DIR utils/extras/)
 
-
-## HEADER FILES
-set(LIBHICN_HEADER_FILES)
-set(LIBHICN_LIGHT_HEADER_FILES)
-set(LIBTRANSPORT_HEADER_FILES)
-
 ## Add enabled components
 foreach (opt ${dir_options})
   if (${opt})
@@ -70,7 +65,10 @@ set(HICN_PLUGIN hicn-plugin)
 set(HICN_EXTRA_PLUGIN hicn-extra-plugin)
 set(LIBTRANSPORT hicntransport)
 set(HICN_UTILS hicn-utils)
+set(HICN_CTRL hicn-ctrl)
+set(LIBHICN_CTRL hicn-ctrl)
 set(HICN_APPS hicn-apps)
+set(FACE_MGR facemgr)
 
 if (BUILD_HICNPLUGIN AND "${CMAKE_SYSTEM_NAME}" STREQUAL "Linux")
   list(APPEND subdirs
@@ -94,9 +92,16 @@ endif()
 ## Libraries targets
 set(LIBHICN_SHARED ${LIBHICN}.shared)
 set(LIBTRANSPORT_SHARED ${LIBTRANSPORT}.shared)
+set(LIBHICN_CTRL_SHARED ${LIBHICN_CTRL}.shared)
 
 set(LIBHICN_STATIC ${LIBHICN}.static)
 set(LIBTRANSPORT_STATIC ${LIBTRANSPORT}.static)
+set(LIBHICN_CTRL_STATIC ${LIBHICN_CTRL}.static)
+
+## HEADER FILES
+set(HICN_INCLUDE_DIRS "" "" CACHE INTERNAL "" FORCE)
+set(LIBTRANSPORT_INCLUDE_DIRS "" "" CACHE INTERNAL "" FORCE)
+set(LIBHICNCTRL_INCLUDE_DIRS ""  "" CACHE INTERNAL "" FORCE)
 
 if (NOT WIN32)
   add_compile_options(-Wall -Werror)
diff --git a/README.md b/README.md
index 5e3ead81b..a4afc2435 100644
--- a/README.md
+++ b/README.md
@@ -9,14 +9,15 @@ real-time transport service for audio/video media.
 
 ## Directory layout
 
-| Directory name | Description                                  |
-| -------------- | -------------------------------------------- |
-| lib            | Core support library                         |
-| hicn-plugin    | VPP plugin                                   |
-| hicn-light     | Lightweight packet forwarder                 |
-| libtransport   | Support library with transport layer and API |
-| utils          | Tools for testing                            |
-| apps           | Application examples using hicn stack        |
+| Directory name | Description                                               |
+| -------------- | --------------------------------------------------------- |
+| lib            | Core support library                                      |
+| hicn-plugin    | VPP plugin                                                |
+| hicn-light     | Lightweight packet forwarder                              |
+| libtransport   | Support library with transport layer and API              |
+| utils          | Tools for testing                                         |
+| apps           | Application examples using hicn stack                     |
+| ctrl           | Tools and libraries for network configuration and control |
 
 hicn plugin is a VPP plugin that implement hicn packet processing as specified in
 https://datatracker.ietf.org/doc/draft-muscariello-intarea-hicn/. The transport library is used to
diff --git a/apps/CMakeLists.txt b/apps/CMakeLists.txt
index 161555c5b..933097892 100644
--- a/apps/CMakeLists.txt
+++ b/apps/CMakeLists.txt
@@ -38,7 +38,6 @@ else()
   else ()
     set(LIBTRANSPORT_LIBRARIES ${LIBTRANSPORT_SHARED})
   endif ()
-
   list(APPEND DEPENDENCIES
     ${LIBTRANSPORT_LIBRARIES}
   )
@@ -67,4 +66,4 @@ set(HIGET higet)
 set(HTTP_PROXY hicn-http-proxy)
 
 add_subdirectory(http-proxy)
-add_subdirectory(higet)
\ No newline at end of file
+add_subdirectory(higet)
diff --git a/apps/http-proxy/CMakeLists.txt b/apps/http-proxy/CMakeLists.txt
index dea544510..0b97c0e5c 100644
--- a/apps/http-proxy/CMakeLists.txt
+++ b/apps/http-proxy/CMakeLists.txt
@@ -63,4 +63,4 @@ build_executable(${HTTP_PROXY}
   DEPENDS ${LIBHTTP_PROXY_STATIC}
   COMPONENT ${HICN_APPS}
   DEFINITIONS ${COMPILER_DEFINITIONS}
-)
\ No newline at end of file
+)
diff --git a/cmake/Modules/BuildMacros.cmake b/cmake/Modules/BuildMacros.cmake
index 8125fa7f9..63d54502b 100644
--- a/cmake/Modules/BuildMacros.cmake
+++ b/cmake/Modules/BuildMacros.cmake
@@ -169,8 +169,16 @@ macro(build_library lib)
 
     foreach(file ${ARG_INSTALL_HEADERS})
       get_filename_component(_dir ${file} DIRECTORY)
-      get_filename_component(dir ${_dir} NAME)
-      if (${dir} STREQUAL src)
+
+      if (_dir)
+        get_filename_component(dir ${_dir} NAME)
+        if ("${dir}" STREQUAL src)
+          set(dir "")
+        endif()
+        if ("${dir}" STREQUAL includes)
+          set(dir "")
+        endif()
+      else()
         set(dir "")
       endif()
 
@@ -200,3 +208,6 @@ macro(AddTest testFile)
   set_target_properties(${ARGV0} PROPERTIES FOLDER Test)
   add_dependencies(${ARGV0} ${PROJECT_NAME}_cleanup_profiling_data)
 endmacro(AddTest)
+
+include(IosMacros)
+include(WindowsMacros)
diff --git a/cmake/Modules/FindConfig.cmake b/cmake/Modules/FindConfig.cmake
new file mode 100644
index 000000000..5361d9611
--- /dev/null
+++ b/cmake/Modules/FindConfig.cmake
@@ -0,0 +1,23 @@
+FIND_PATH(CONFIG_INCLUDE_DIR libconfig.h /usr/include /usr/local/include)
+
+FIND_LIBRARY(CONFIG_LIBRARY NAMES config PATH /usr/lib /usr/local/lib) 
+
+IF (CONFIG_INCLUDE_DIR AND CONFIG_LIBRARY)
+    SET(CONFIG_FOUND TRUE)
+ENDIF ( CONFIG_INCLUDE_DIR AND CONFIG_LIBRARY)
+
+IF (CONFIG_FOUND)
+    IF (NOT CONFIG_FIND_QUIETLY)
+	MESSAGE(STATUS "Found Config: ${CONFIG_LIBRARY}")
+    ENDIF (NOT  CONFIG_FIND_QUIETLY)
+ELSE(CONFIG_FOUND)
+    IF (Config_FIND_REQUIRED)
+	IF(NOT CONFIG_INCLUDE_DIR)
+	    MESSAGE(FATAL_ERROR "Could not find LibConfig header file!")
+	ENDIF(NOT CONFIG_INCLUDE_DIR)
+
+	IF(NOT CONFIG_LIBRARY)
+	    MESSAGE(FATAL_ERROR "Could not find LibConfig library file!")
+	ENDIF(NOT CONFIG_LIBRARY)
+    ENDIF (Config_FIND_REQUIRED)
+ENDIF (CONFIG_FOUND)
\ No newline at end of file
diff --git a/cmake/Modules/FindLibhicnctrl.cmake b/cmake/Modules/FindLibhicnctrl.cmake
new file mode 100755
index 000000000..1399b41bf
--- /dev/null
+++ b/cmake/Modules/FindLibhicnctrl.cmake
@@ -0,0 +1,45 @@
+# Copyright (c) 2017-2019 Cisco and/or its affiliates.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+########################################
+#
+# Find the hICN control library and include files
+#
+
+set(HICN_SEARCH_PATH_LIST
+  ${HICN_HOME}
+  $ENV{HICN_HOME}
+  $ENV{FOUNDATION_HOME}
+  /usr/local
+  /opt
+  /usr
+)
+
+find_path(LIBHICNCTRL_INCLUDE_DIR hicn/ctrl.h
+  HINTS ${HICN_SEARCH_PATH_LIST}
+  PATH_SUFFIXES include
+  DOC "Find the hICN control include"
+)
+
+find_library(LIBHICNCTRL_LIBRARY NAMES hicn-ctrl
+  HINTS ${HICN_SEARCH_PATH_LIST}
+  PATH_SUFFIXES lib
+  DOC "Find the hicn control library"
+)
+
+set(LIBHICNCTRL_LIBRARIES ${HICNCTRL_LIBRARY})
+set(LIBHICNCTRL_INCLUDE_DIRS ${HICNCTRL_INCLUDE_DIR})
+
+include(FindPackageHandleStandardArgs)
+find_package_handle_standard_args(hicnctrl DEFAULT_MSG
+        LIBHICNCTRL_LIBRARY LIBHICNCTRL_INCLUDE_DIR)
diff --git a/cmake/Modules/Packager.cmake b/cmake/Modules/Packager.cmake
index b4849963d..27a269b88 100644
--- a/cmake/Modules/Packager.cmake
+++ b/cmake/Modules/Packager.cmake
@@ -84,11 +84,11 @@ macro(make_packages)
       set(rpm_ver "${tag}-${commit_num}-release")
     endif()
 
-    get_next_version(${tag}, next_version)
+    get_next_version(${tag} next_version)
 
     get_cmake_property(components COMPONENTS)
 
-    if(OS_ID_LIKE MATCHES "debian")
+    if(OS_ID MATCHES "debian" OR OS_ID_LIKE MATCHES "debian")
       set(CPACK_GENERATOR "DEB")
       set(type "DEBIAN")
 
diff --git a/ctrl/CMakeLists.txt b/ctrl/CMakeLists.txt
new file mode 100644
index 000000000..cdce8bbdb
--- /dev/null
+++ b/ctrl/CMakeLists.txt
@@ -0,0 +1,19 @@
+# Copyright (c) 2017-2019 Cisco and/or its affiliates.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+cmake_minimum_required(VERSION 3.5 FATAL_ERROR)
+
+project(ctrl)
+
+add_subdirectory(libhicnctrl)
+add_subdirectory(facemgr)
diff --git a/ctrl/facemgr/CMakeLists.txt b/ctrl/facemgr/CMakeLists.txt
new file mode 100644
index 000000000..fcd221a98
--- /dev/null
+++ b/ctrl/facemgr/CMakeLists.txt
@@ -0,0 +1,68 @@
+# Copyright (c) 2017-2019 Cisco and/or its affiliates.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+if (APPLE)
+    # >= 3.13 - CMP0079 (only needed on Apple platform for conditionally linking Network.framwork to libfacemgr)
+    cmake_minimum_required(VERSION 3.13 FATAL_ERROR)
+else()
+    cmake_minimum_required(VERSION 3.5 FATAL_ERROR)
+endif()
+
+project(facemgr)
+
+if (NOT CMAKE_BUILD_TYPE)
+    message(STATUS "No build type selected, default to Release")
+    set(CMAKE_BUILD_TYPE "Release")
+endif()
+
+set(CMAKE_MODULE_PATH
+  ${CMAKE_MODULE_PATH}
+  "${CMAKE_CURRENT_SOURCE_DIR}/../../cmake/Modules"
+  "${CMAKE_CURRENT_SOURCE_DIR}/cmake/Modules"
+)
+
+include(BuildMacros)
+
+set(CMAKE_C_STANDARD 11)
+set(CMAKE_C_STANDARD_REQUIRED ON)
+
+set(CMAKE_INSTALL_RPATH_USE_LINK_PATH ON)
+
+find_package_wrapper(Config REQUIRED)
+find_package_wrapper(LibEvent REQUIRED)
+
+if(CMAKE_SOURCE_DIR STREQUAL PROJECT_SOURCE_DIR)
+  find_package_wrapper(Libhicnctrl REQUIRED)
+  set(FACE_MGR facemgr)
+else()
+  if (ANDROID_API)
+    set(LIBHICNCTRL_LIBRARIES ${LIBHICN_CTRL_STATIC})
+    list(APPEND DEPENDENCIES
+      ${LIBHICN_CTRL_STATIC}
+    )
+  else ()
+    set(LIBHICNCTRL_LIBRARIES ${LIBHICN_CTRL_SHARED})
+    list(APPEND DEPENDENCIES
+      ${LIBHICN_CTRL_SHARED}
+    )
+  endif ()
+endif()
+
+add_subdirectory(src)
+
+include(Packaging)
+
+if(CMAKE_SOURCE_DIR STREQUAL PROJECT_SOURCE_DIR)
+    include(Packager)
+    make_packages()
+endif()
diff --git a/ctrl/facemgr/README.md b/ctrl/facemgr/README.md
new file mode 100644
index 000000000..e1a1beb4f
--- /dev/null
+++ b/ctrl/facemgr/README.md
@@ -0,0 +1 @@
+# hICN Face Manager
diff --git a/ctrl/facemgr/cmake/Modules/Packaging.cmake b/ctrl/facemgr/cmake/Modules/Packaging.cmake
new file mode 100644
index 000000000..97a1b6260
--- /dev/null
+++ b/ctrl/facemgr/cmake/Modules/Packaging.cmake
@@ -0,0 +1,31 @@
+# Copyright (c) 2017-2019 Cisco and/or its affiliates.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+######################
+# Packages section
+######################
+
+set(${FACE_MGR}_DESCRIPTION
+  "hICN face manager, lib${LIBHICN_CTRL}"
+  CACHE STRING "Description for deb/rpm package."
+)
+
+set(${FACE_MGR}_DEB_DEPENDENCIES
+  "libconfig9, libevent-dev, lib${LIBHICN_CTRL} (>= stable_version)"
+  CACHE STRING "Dependencies for deb/rpm package."
+)
+
+set(${FACE_MGR}_RPM_DEPENDENCIES
+  "libconfig, libevent-devel, lib${LIBHICN_CTRL} >= stable_version"
+  CACHE STRING "Dependencies for deb/rpm package."
+)
diff --git a/ctrl/facemgr/examples/facemgr.conf b/ctrl/facemgr/examples/facemgr.conf
new file mode 100644
index 000000000..54c212c2b
--- /dev/null
+++ b/ctrl/facemgr/examples/facemgr.conf
@@ -0,0 +1,37 @@
+# hICN facemgr configuration file
+
+faces:
+{
+    # A list of interfaces to ignore
+    ignore = ("lo");
+
+    # A list of rules used to assign tags to interfaces
+    # Each rule follows the syntax { name = "NAME"; tags = ("TAG", ...); }
+    # with TAG = WIRED | WIFI | CELLULAR | TRUSTED
+    rules = (
+        {
+            name = "utun1";
+            tags = ("WIRED", "TRUSTED");
+        }
+    );
+
+    overlay = {
+        ipv4 = {
+            local_port = 9695;
+            remote_port = 9695;
+            remote_addr = "10.60.16.14";
+        };
+        ipv6 = {
+            local_port = 9695;
+            remote_port = 9695;
+            remote_addr = "2001:420:44f1:10:20c:29ff:fef3:8f8f";
+        };
+    };
+}
+
+log:
+{
+    log_level = "DEBUG";
+}
+
+
diff --git a/ctrl/facemgr/src/CMakeLists.txt b/ctrl/facemgr/src/CMakeLists.txt
new file mode 100644
index 000000000..e7dbda5c1
--- /dev/null
+++ b/ctrl/facemgr/src/CMakeLists.txt
@@ -0,0 +1,112 @@
+# Copyright (c) 2017-2019 Cisco and/or its affiliates.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+if(UNIX AND NOT APPLE)
+    set(LINUX TRUE)
+endif()
+
+set(COMPILER_DEFINITIONS
+  "-DWITH_POLICY"
+)
+
+set(HEADER_FILES
+#cache.h
+    common.h
+    error.h
+    event.h
+    face.h
+    face_cache.h
+    face_rules.h
+    interface.h
+    interface_map.h
+    interface_ops_map.h
+    util/hash.h
+    util/ip_address.h
+    util/log.h
+    util/map.h
+    util/policy.h
+    util/set.h
+    util/token.h
+    util/types.h
+
+)
+
+set(SOURCE_FILES
+#   cache.c
+    error.c
+    event.c
+    face.c
+    face_cache.c
+    face_rules.c
+    interface.c
+    interface_map.c
+    interface_ops_map.c
+    facemgr.c
+    util/log.c
+    util/policy.c
+)
+
+set(INCLUDE_DIRS
+    ./
+    ../includes/
+    ${CONFIG_INCLUDE_DIR}
+    ${LIBEVENT_INCLUDE_DIR}
+    ${LIBHICNCTRL_INCLUDE_DIRS}
+)
+
+set(LIBRARIES
+    ${CONFIG_LIBRARY}
+    ${LIBEVENT_LIBRARY}
+    ${LIBHICNCTRL_LIBRARIES}
+)
+
+add_subdirectory(interfaces)
+
+if (ANDROID_API)
+    build_library(${FACE_MGR}
+        STATIC
+        SOURCES ${SOURCE_FILES}
+        INSTALL_HEADERS ${TO_INSTALL_HEADER_FILES}
+        DEPENDS ${DEPENDENCIES}
+        COMPONENT ${FACE_MGR}
+        INCLUDE_DIRS ${INCLUDE_DIRS}
+        INSTALL_ROOT_DIR hicn
+        DEFINITIONS ${COMPILER_DEFINITIONS}
+    )
+else ()
+    build_library(${FACE_MGR}
+        STATIC NO_DEV
+        SOURCES ${SOURCE_FILES}
+        INSTALL_HEADERS ${TO_INSTALL_HEADER_FILES}
+        DEPENDS ${DEPENDENCIES}
+        COMPONENT ${FACE_MGR}
+        INCLUDE_DIRS ${INCLUDE_DIRS}
+        INSTALL_ROOT_DIR hicn
+        DEFINITIONS ${COMPILER_DEFINITIONS}
+    )
+endif ()
+
+if(NOT ANDROID_API AND NOT COMPILE_FOR_IOS)
+    list(APPEND DAEMON_SRC
+      main.c
+    )
+
+    build_executable(${FACE_MGR}
+      SOURCES ${DAEMON_SRC}
+      LINK_LIBRARIES ${FACE_MGR}.static ${LIBRARIES}
+      DEPENDS ${FACE_MGR}.static
+      COMPONENT ${FACE_MGR}
+      INCLUDE_DIRS ${INCLUDE_DIRS}
+      DEFINITIONS ${COMPILER_DEFINITIONS}
+    )
+endif ()
diff --git a/ctrl/facemgr/src/cache.c b/ctrl/facemgr/src/cache.c
new file mode 100644
index 000000000..f994d7d37
--- /dev/null
+++ b/ctrl/facemgr/src/cache.c
@@ -0,0 +1,127 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file cache.c
+ * \brief Implementation of face cache.
+ *
+ * The cache is currently implemented as a list so as not to worry about
+ * platform-specific implementations (eg missing functions in BSD libC for
+ * search.h).
+ */
+
+#include <math.h> // log2
+#include <string.h> // memmove
+
+#include "cache.h"
+
+#define FACE_CACHE_MAX_SIZE_LOG_INIT 0
+
+face_cache_t *
+face_cache_create()
+{
+    face_cache_t * face_cache = malloc(sizeof(face_cache_t));
+    if (!face_cache)
+        goto ERR_MALLOC;
+
+    face_cache->max_size_log = FACE_CACHE_MAX_SIZE_LOG_INIT;
+#if(FACE_CACHE_MAX_SIZE_LOG_INIT == 0)
+    face_cache->faces = NULL;
+#else
+    face_cache->faces = malloc((1 << face_cache->max_size_log) * sizeof(face_t*));
+    if (!face_cache->faces)
+        goto ERR_ARRAY:
+#endif
+    face_cache->size = 0;
+
+    return face_cache;
+
+#if(FACE_CACHE_MAX_SIZE_LOG_INIT != 0)
+ERR_ARRAY:
+    free(face_cache);
+#endif
+ERR_MALLOC:
+    return NULL;
+}
+
+void
+face_cache_free(face_cache_t * face_cache)
+{
+    free(face_cache->faces);
+
+    free(face_cache);
+}
+
+face_t *
+face_cache_add(face_cache_t * face_cache, face_t * face)
+{
+    /* Ensure sufficient space for next addition */
+    size_t new_size_log = (face_cache->size > 0) ? log2(face_cache->size) + 1 : 0;
+    if (new_size_log > face_cache->max_size_log) {
+        face_cache->max_size_log = new_size_log;
+        face_cache->faces = realloc(face_cache->faces, (1 << new_size_log) * sizeof(face_t*));
+    }
+
+    if (!face_cache->faces)
+        goto ERR_REALLOC;
+
+    face_cache->faces[face_cache->size++] = face;
+
+    return face;
+
+ERR_REALLOC:
+    return NULL;
+}
+
+int face_cache_search(face_cache_t * face_cache, face_t * face, face_cmp_t face_cmp)
+{
+    for (int i = 0; i < face_cache->size; i++)
+        if (face_cmp(face, face_cache->faces[i]))
+            return i;
+    return -1;
+}
+
+/* Remove a single occurrence */
+face_t *
+face_cache_remove(face_cache_t * face_cache, face_t * face)
+{
+    int pos = face_cache_search(face_cache, face, face_cmp);
+    if (pos < 0)
+        return NULL;
+
+    /* No need to move memory if last item is removed */
+    if (pos < face_cache->size)
+        memmove(face_cache->faces+pos, face_cache->faces+pos+1, face_cache->size - pos);
+
+    face_cache->size--;
+
+    return face;
+}
+
+/* TODO : remove by ... */
+
+face_t *
+face_cache_get_by_id(face_cache_t * face_cache, int id)
+{
+    return NULL;
+}
+
+
+
+void
+face_cache_dump(face_cache_t * face_cache)
+{
+
+}
diff --git a/ctrl/facemgr/src/cache.h b/ctrl/facemgr/src/cache.h
new file mode 100644
index 000000000..1389ed6ec
--- /dev/null
+++ b/ctrl/facemgr/src/cache.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file state.h
+ * \brief Face cache
+ *
+ * The face cache is an index array of faces that mirror the current state of
+ * the forwarder in order to filter out redundant events, and perform set
+ * reconciliation.
+ */
+#ifndef FACEMGR_CACHE_H
+#define FACEMGR_CACHE_H
+
+#include <stdlib.h>
+
+#include "face.h"
+
+/**
+ * \brief Face cache
+ */
+typedef struct {
+    face_t ** faces;     /**< array of _pointers_ to faces */
+    size_t max_size_log; /**< log2 of allocated size */
+    size_t size;         /**< effective array size */
+} face_cache_t;
+
+face_cache_t * face_cache_create();
+void face_cache_free(face_cache_t * face_cache);
+
+/* a la VPP vector, we never create a face outside of the vector */
+/* problem is that face ptr can get invalid if we manipulate the vector */
+face_t * face_cache_get(face_cache_t * cache_cache);
+
+face_t * face_cache_add(face_cache_t * face_cache, face_t * face);
+face_t * face_cache_remove(face_cache_t * face_cache, face_t * face);
+face_t * face_cache_get_by_id(face_cache_t * face_cache, int id);
+
+void face_cache_dump(face_cache_t * face_cache);
+
+#endif /* FACEMGR_CACHE_H */
diff --git a/ctrl/facemgr/src/common.h b/ctrl/facemgr/src/common.h
new file mode 100644
index 000000000..a73964b6d
--- /dev/null
+++ b/ctrl/facemgr/src/common.h
@@ -0,0 +1,94 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file common.h
+ * \file Common definitions used throughout the code
+ */
+#ifndef FACEMGR_COMMON_H
+#define FACEMGR_COMMON_H
+
+#include <stdbool.h>
+#include <stdint.h>
+
+#include "util/types.h"
+#include "util/ip_address.h"
+#include "util/token.h" // XXX debug
+
+//#define DEBUG
+
+/* Return value conventions */
+#define FACEMGR_SUCCESS 0
+#define FACEMGR_FAILURE -1
+#define FACEMGR_IS_ERROR(rc) (rc < 0)
+
+/* Useful types and macros for comparisons */
+typedef int(*cmp_t)(const void * x, const void * y);
+
+#define INT_CMP(x, y) x < y ? -1 : (x == y ? 0 : 1)
+
+/* Dump with indent */
+#define INDENT(n, fmt) "%*s" fmt, n, ""
+#define printfi(n, fmt, ...) printf(INDENT(n*4, fmt), ##__VA_ARGS__)
+
+/* Boilerplate code */
+
+#define NO_INITIALIZE(NAME)                                             \
+int                                                                     \
+NAME ## _initialize(NAME ## _t * obj) {                                 \
+    return FACEMGR_SUCCESS;                                             \
+}
+
+#define NO_FINALIZE(NAME)                                               \
+int                                                                     \
+NAME ## _finalize(NAME ## _t * obj) {                                   \
+    return FACEMGR_SUCCESS;                                             \
+}
+
+#define AUTOGENERATE_CREATE_FREE(NAME)                                  \
+                                                                        \
+NAME ## _t *                                                            \
+NAME ## _create()                                                       \
+{                                                                       \
+    NAME ## _t * obj  = malloc(sizeof(NAME ## _t));                     \
+    if (!obj)                                                           \
+        goto ERR_MALLOC;                                                \
+                                                                        \
+    if (FACEMGR_IS_ERROR(NAME ## _initialize(obj)))                     \
+        goto ERR_INIT;                                                  \
+                                                                        \
+    return obj;                                                         \
+                                                                        \
+ERR_INIT:                                                               \
+    free(obj);                                                          \
+ERR_MALLOC:                                                             \
+    return NULL;                                                        \
+}                                                                       \
+                                                                        \
+void                                                                    \
+NAME ## _free(NAME ## _t * obj)                                         \
+{                                                                       \
+    if (FACEMGR_IS_ERROR(NAME ## _finalize(obj)))                       \
+        (void)0; /* XXX */                                              \
+    free(obj);                                                          \
+}                                                                       \
+
+#define AUTOGENERATE_DEFS(NAME)                                         \
+int NAME ## _initialize(NAME ## _t *);                                  \
+int NAME ## _finalize(NAME ## _t *);                                    \
+NAME ## _t * NAME ## _create();                                         \
+void NAME ## _free(NAME ## _t *);                                       \
+
+#endif /* FACEMGR_COMMON_H */
diff --git a/ctrl/facemgr/src/error.c b/ctrl/facemgr/src/error.c
new file mode 100644
index 000000000..4dcea6e1f
--- /dev/null
+++ b/ctrl/facemgr/src/error.c
@@ -0,0 +1,28 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * @file error.c
+ * @brief Implementation of error management functions.
+ */
+
+#include "error.h"
+
+const char *FACEMGR_ERROR_STRING[] = {
+#define _(a,b,c) [b] = c,
+  foreach_facemgr_error
+#undef _
+};
+
diff --git a/ctrl/facemgr/src/error.h b/ctrl/facemgr/src/error.h
new file mode 100644
index 000000000..a0d76b3e5
--- /dev/null
+++ b/ctrl/facemgr/src/error.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef FACEMGR_ERROR_H
+#define FACEMGR_ERROR_H
+
+#define foreach_facemgr_error                           \
+_(NONE,         0,      "OK")                           \
+
+
+typedef enum {
+#define _(a,b,c) FACEMGR_ERROR_##a = (-b),
+    foreach_facemgr_error
+#undef _
+    FACEMGR_ERROR_N,
+} facemgr_error_t;
+
+extern const char *HICN_LIB_ERROR_STRING[];
+
+#define hicn_strerror(errno) (char *)(HICN_LIB_ERROR_STRING[-errno])
+
+#endif /* FACEMGR_ERROR_H */
diff --git a/ctrl/facemgr/src/event.c b/ctrl/facemgr/src/event.c
new file mode 100644
index 000000000..446c51c22
--- /dev/null
+++ b/ctrl/facemgr/src/event.c
@@ -0,0 +1,39 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file event.h
+ * \brief Implementatino of face events
+ */
+
+#include "common.h"
+#include "event.h"
+#include "interface.h"
+#include "util/token.h"
+
+const char * event_type_str[] = {
+#define _(x) [EVENT_TYPE_ ## x] = STRINGIZE(x),
+foreach_event_type
+#undef _
+};
+
+int
+event_raise(event_type_t type, const face_t * face, const interface_t * interface)
+{
+    event_t event = { .type = type, .face = face };
+    if (interface->callback)
+        interface->callback(interface->callback_data, &event);
+    return FACEMGR_SUCCESS;
+}
diff --git a/ctrl/facemgr/src/event.h b/ctrl/facemgr/src/event.h
new file mode 100644
index 000000000..53295d009
--- /dev/null
+++ b/ctrl/facemgr/src/event.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file event.h
+ * \brief Face event
+ */
+#ifndef FACEMGR_EVENT_H
+#define FACEMGR_EVENT_H
+
+#include "face.h"
+#include "interface.h"
+
+#define foreach_event_type      \
+    _(UNDEFINED)                \
+    _(CREATE)                   \
+    _(UPDATE)                   \
+    _(DELETE)                   \
+    _(SET_PARAMS)               \
+    _(SET_UP)                   \
+    _(SET_DOWN)                 \
+    _(SET_TAGS)                 \
+    _(CLEAR_TAGS)               \
+    _(ADD_TAG)                  \
+    _(REMOVE_TAG)               \
+    _(N)
+
+#define MAXSZ_EVENT_TYPE_ 10
+#define MAXSZ_EVENT_TYPE MAXSZ_EVENT_TYPE_ + 1
+
+typedef enum {
+#define _(x) EVENT_TYPE_ ## x,
+foreach_event_type
+#undef _
+} event_type_t;
+
+extern const char * event_type_str[];
+
+typedef struct event_s {
+    event_type_t type;
+    const face_t * face; /* + bitfield for face fields ? */
+} event_t;
+
+int
+event_raise(event_type_t type, const face_t * face, const interface_t * interface);
+
+#endif /* FACEMGR_EVENT_H */
diff --git a/ctrl/facemgr/src/face.c b/ctrl/facemgr/src/face.c
new file mode 100644
index 000000000..7da255049
--- /dev/null
+++ b/ctrl/facemgr/src/face.c
@@ -0,0 +1,258 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file face.c
+ * \brief Implementation of face abstraction
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "face.h"
+#include "util/hash.h"
+#include "util/token.h"
+
+#define member_size(type, member) sizeof(((type *)0)->member)
+
+
+/* Netdevice */
+
+const char * netdevice_type_str[] = {
+#define _(x) [NETDEVICE_TYPE_ ## x] = STRINGIZE(x),
+foreach_netdevice_type
+#undef _
+};
+
+
+/* Face state */
+
+const char * face_state_str[] = {
+#define _(x) [FACE_STATE_ ## x] = STRINGIZE(x),
+foreach_face_state
+#undef _
+};
+
+
+/* Face type */
+
+const char * face_type_str[] = {
+#define _(x) [FACE_TYPE_ ## x] = STRINGIZE(x),
+foreach_face_type
+#undef _
+};
+
+
+/* Face */
+
+int
+face_initialize(face_t * face)
+{
+    bzero(face, sizeof(face_t)); /* 0'ed for hash */
+    return 1;
+}
+
+int
+face_initialize_udp(face_t * face, const ip_address_t * local_addr,
+        u16 local_port, const ip_address_t * remote_addr, u16 remote_port,
+        int family)
+{
+    if (!local_addr)
+        return -1;
+
+    *face = (face_t) {
+        .type = FACE_TYPE_UDP,
+        .params.tunnel = {
+            .family = family,
+            .local_addr = *local_addr,
+            .local_port = local_port,
+            .remote_addr = remote_addr ? *remote_addr : IP_ADDRESS_EMPTY,
+            .remote_port = remote_port,
+        },
+    };
+    return 1;
+}
+
+int
+face_initialize_udp_sa(face_t * face, const struct sockaddr * local_addr,
+        const struct sockaddr * remote_addr)
+{
+    if (!local_addr)
+        return -1;
+
+    if (remote_addr && (local_addr->sa_family != remote_addr->sa_family))
+        return -1;
+
+    switch (local_addr->sa_family) {
+        case AF_INET:
+            {
+            struct sockaddr_in *lsai = (struct sockaddr_in *)local_addr;
+            struct sockaddr_in *rsai = (struct sockaddr_in *)remote_addr;
+            *face = (face_t) {
+                .type = FACE_TYPE_UDP,
+                .params.tunnel = {
+                    .family = AF_INET,
+                    .local_addr.v4.as_inaddr = lsai->sin_addr,
+                    .local_port = lsai ? ntohs(lsai->sin_port) : 0,
+                    .remote_addr = IP_ADDRESS_EMPTY,
+                    .remote_port = rsai ? ntohs(rsai->sin_port) : 0,
+                },
+            };
+            if (rsai)
+                face->params.tunnel.remote_addr.v4.as_inaddr = rsai->sin_addr;
+            }
+            break;
+        case AF_INET6:
+            {
+            struct sockaddr_in6 *lsai = (struct sockaddr_in6 *)local_addr;
+            struct sockaddr_in6 *rsai = (struct sockaddr_in6 *)remote_addr;
+            *face = (face_t) {
+                .type = FACE_TYPE_UDP,
+                .params.tunnel = {
+                    .family = AF_INET6,
+                    .local_addr.v6.as_in6addr = lsai->sin6_addr,
+                    .local_port = lsai ? ntohs(lsai->sin6_port) : 0,
+                    .remote_addr = IP_ADDRESS_EMPTY,
+                    .remote_port = rsai ? ntohs(rsai->sin6_port) : 0,
+                },
+            };
+            if (rsai)
+                face->params.tunnel.remote_addr.v6.as_in6addr = rsai->sin6_addr;
+            }
+            break;
+        default:
+            return -1;
+    }
+    return 1;
+}
+
+face_t * face_create()
+{
+    face_t * face = calloc(1, sizeof(face_t)); /* 0'ed for hash */
+    return face;
+}
+
+face_t * face_create_udp(const ip_address_t * local_addr, u16 local_port,
+        const ip_address_t * remote_addr, u16 remote_port, int family)
+{
+    face_t * face = face_create();
+    if (face_initialize_udp(face, local_addr, local_port, remote_addr, remote_port, family) < 0)
+        goto ERR_INIT;
+    return face;
+
+ERR_INIT:
+    free(face);
+    return NULL;
+}
+
+face_t * face_create_udp_sa(const struct sockaddr * local_addr,
+        const struct sockaddr * remote_addr)
+{
+    face_t * face = face_create();
+    if (face_initialize_udp_sa(face, local_addr, remote_addr) < 0)
+        goto ERR_INIT;
+    return face;
+
+ERR_INIT:
+    free(face);
+    return NULL;
+}
+
+void face_free(face_t * face)
+{
+    free(face);
+}
+
+#define face_param_cmp(f1, f2, face_param_type)            \
+    memcmp(&f1->type, &f2->type,  \
+            member_size(face_params_t, face_param_type));
+
+/**
+ * \brief Compare two faces
+ * \param [in] f1 - First face
+ * \param [in] f2 - Second face
+ * \return whether faces are equal, ie both their types are parameters are
+ * equal.
+ *
+ * NOTE: this function implements a partial order.
+ */
+int
+face_cmp(const face_t * f1, const face_t * f2)
+{
+    if (f1->type != f2->type)
+        return false;
+
+    switch(f1->type) {
+        case FACE_TYPE_HICN:
+            return face_param_cmp(f1, f2, hicn);
+        case FACE_TYPE_TCP:
+        case FACE_TYPE_UDP:
+            return face_param_cmp(f1, f2, tunnel);
+        default:
+            return false;
+    }
+}
+
+hash_t
+face_hash(const face_t * face)
+{
+    /* Assuming the unused part of the struct is set to zero */
+    return hash_struct(face);
+}
+
+/* /!\ Please update constants in header file upon changes */
+size_t
+face_snprintf(char * s, size_t size, const face_t * face)
+{
+    switch(face->type) {
+        case FACE_TYPE_HICN:
+            return 0; // XXX Not implemented
+        case FACE_TYPE_TCP:
+        case FACE_TYPE_UDP:
+            {
+                char local[MAXSZ_IP_ADDRESS];
+                char remote[MAXSZ_IP_ADDRESS];
+                char tags[MAXSZ_POLICY_TAGS];
+
+                ip_address_snprintf(local, MAXSZ_IP_ADDRESS,
+                        &face->params.tunnel.local_addr,
+                        face->params.tunnel.family);
+                ip_address_snprintf(remote, MAXSZ_IP_ADDRESS,
+                        &face->params.tunnel.remote_addr,
+                        face->params.tunnel.family);
+                policy_tags_snprintf(tags, MAXSZ_POLICY_TAGS, face->tags);
+
+                return snprintf(s, size, "%s [%s:%d -> %s:%d] [%s]",
+                        face_type_str[face->type],
+                        local,
+                        face->params.tunnel.local_port,
+                        remote,
+                        face->params.tunnel.remote_port,
+                        tags);
+            }
+            break;
+        default:
+            return 0;
+    }
+
+}
+
+int
+face_set_tags(face_t * face, policy_tags_t tags)
+{
+    face->tags = tags;
+    return 1;
+}
diff --git a/ctrl/facemgr/src/face.h b/ctrl/facemgr/src/face.h
new file mode 100644
index 000000000..8b553f685
--- /dev/null
+++ b/ctrl/facemgr/src/face.h
@@ -0,0 +1,177 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file face.h
+ * \brief Face abstraction
+ */
+#ifndef HICN_FACE_H
+#define HICN_FACE_H
+
+#ifndef SPACES
+#define SPACES(x) x
+#endif
+#ifndef SPACE
+#define SPACE 1
+#endif
+#ifndef NULLTERM
+#define NULLTERM 1
+#endif
+
+#include "util/ip_address.h"
+#include "util/policy.h"
+#include "util/types.h"
+
+
+/* Netdevice type */
+
+#include <net/if.h> // IFNAMSIZ
+
+#define foreach_netdevice_type  \
+    _(UNDEFINED)                \
+    _(WIRED)                    \
+    _(WIFI)                     \
+    _(CELLULAR)                 \
+    _(VPN)                      \
+    _(N)
+
+#define MAXSZ_NETDEVICE_TYPE_ 9
+#define MAXSZ_NETDEVICE_TYPE MAXSZ_NETDEVICE_TYPE_ + NULLTERM
+
+typedef enum {
+#define _(x) NETDEVICE_TYPE_ ## x,
+foreach_netdevice_type
+#undef _
+} netdevice_type_t;
+
+extern const char * netdevice_type_str[];
+
+
+/* Netdevice */
+
+typedef struct {
+    u32 index;
+    char name[IFNAMSIZ];
+} netdevice_t;
+
+#define NETDEVICE_UNDEFINED_INDEX 0
+
+/* Face state */
+
+#define foreach_face_state      \
+    _(UNDEFINED)                \
+    _(PENDING_UP)               \
+    _(UP)                       \
+    _(PENDING_DOWN)             \
+    _(DOWN)                     \
+    _(ERROR)                    \
+    _(N)
+
+#define MAXSZ_FACE_STATE_ 12
+#define MAXSZ_FACE_STATE MAXSZ_FACE_STATE_ + 1
+
+typedef enum {
+#define _(x) FACE_STATE_ ## x,
+foreach_face_state
+#undef _
+} face_state_t;
+
+extern const char * face_state_str[];
+
+
+/* Face type */
+
+#define foreach_face_type       \
+    _(UNDEFINED)                \
+    _(HICN)                     \
+    _(HICN_LISTENER)            \
+    _(TCP)                      \
+    _(TCP_LISTENER)             \
+    _(UDP)                      \
+    _(UDP_LISTENER)             \
+    _(N)
+
+#define MAXSZ_FACE_TYPE_ 13
+#define MAXSZ_FACE_TYPE MAXSZ_FACE_TYPE_  + 1
+
+typedef enum {
+#define _(x) FACE_TYPE_ ## x,
+foreach_face_type
+#undef _
+} face_type_t;
+
+extern const char * face_type_str[];
+
+#define MAXSZ_FACE_ MAXSZ_FACE_TYPE_ + 2 * MAXSZ_IP_ADDRESS_ + 2 * MAXSZ_PORT_ + 9 + MAXSZ_POLICY_TAGS_
+#define MAXSZ_FACE MAXSZ_FACE_ + 1
+
+/* Face */
+
+typedef union {
+    int family; /* To access family independently of face type */
+    struct {
+        int family;
+        netdevice_t netdevice;
+        ip_address_t local_addr;
+        ip_address_t remote_addr;
+    } hicn;
+    struct {
+        int family;
+        ip_address_t local_addr;
+        u16 local_port;
+        ip_address_t remote_addr;
+        u16 remote_port;
+    } tunnel;
+} face_params_t;
+
+typedef struct {
+    face_type_t type;
+    face_params_t params;
+    face_state_t admin_state;
+    face_state_t state;
+#ifdef WITH_POLICY
+    policy_tags_t tags; /**< \see policy_tag_t */
+#endif /* WITH_POLICY */
+} face_t;
+
+int face_initialize(face_t * face);
+int face_initialize_udp(face_t * face, const ip_address_t * local_addr,
+        u16 local_port, const ip_address_t * remote_addr, u16 remote_port,
+        int family);
+int face_initialize_udp_sa(face_t * face,
+        const struct sockaddr * local_addr, const struct sockaddr * remote_addr);
+
+face_t * face_create();
+face_t * face_create_udp(const ip_address_t * local_addr, u16 local_port,
+        const ip_address_t * remote_addr, u16 remote_port, int family);
+face_t * face_create_udp_sa(const struct sockaddr * local_addr,
+        const struct sockaddr * remote_addr);
+
+int face_finalize(face_t * face);
+
+void face_free(face_t * face);
+
+typedef int (*face_cmp_t)(const face_t * f1, const face_t * f2);
+
+int face_cmp(const face_t * f1, const face_t * f2);
+hash_t face_hash(const face_t * face);
+
+size_t
+face_snprintf(char * s, size_t size, const face_t * face);
+
+int face_set_tags(face_t * face, policy_tags_t tags);
+
+#endif /* HICN_FACE_H */
+
diff --git a/ctrl/facemgr/src/face_cache.c b/ctrl/facemgr/src/face_cache.c
new file mode 100644
index 000000000..bee36af30
--- /dev/null
+++ b/ctrl/facemgr/src/face_cache.c
@@ -0,0 +1,21 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "face_cache.h"
+
+#include "face.h"
+#include "util/set.h"
+
+TYPEDEF_SET(face_cache, face_t *, face_cmp, face_snprintf);
diff --git a/ctrl/facemgr/src/face_cache.h b/ctrl/facemgr/src/face_cache.h
new file mode 100644
index 000000000..caefb7e22
--- /dev/null
+++ b/ctrl/facemgr/src/face_cache.h
@@ -0,0 +1,24 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef FACE_CACHE_H
+#define FACE_CACHE_H
+
+#include "face.h"
+#include "util/set.h"
+
+TYPEDEF_SET_H(face_cache, face_t *);
+
+#endif /* FACE_CACHE_H */
diff --git a/ctrl/facemgr/src/face_rules.c b/ctrl/facemgr/src/face_rules.c
new file mode 100644
index 000000000..ddefc15f9
--- /dev/null
+++ b/ctrl/facemgr/src/face_rules.c
@@ -0,0 +1,21 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "face_rules.h"
+
+#include <string.h>
+#include "util/policy.h"
+
+TYPEDEF_MAP(face_rules, const char *, policy_tags_t, strcmp, string_snprintf, policy_tags_snprintf);
diff --git a/ctrl/facemgr/src/face_rules.h b/ctrl/facemgr/src/face_rules.h
new file mode 100644
index 000000000..28f5391a0
--- /dev/null
+++ b/ctrl/facemgr/src/face_rules.h
@@ -0,0 +1,31 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef FACE_RULES_H
+#define FACE_RULES_H
+
+#include "util/map.h"
+#include "util/policy.h"
+
+/*
+ * Face creation rules
+ *
+ * For now, face creations rules are very simple and consist in a map between
+ * the physical interface name, and the associated list of tags that will
+ * preempt those assigned by the system.
+ */
+TYPEDEF_MAP_H(face_rules, const char *, policy_tags_t);
+
+#endif /* FACE_RULES_H */
diff --git a/ctrl/facemgr/src/facemgr.c b/ctrl/facemgr/src/facemgr.c
new file mode 100644
index 000000000..41e30de56
--- /dev/null
+++ b/ctrl/facemgr/src/facemgr.c
@@ -0,0 +1,298 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file facemgr.c
+ * \brief Implementation of Face manager library interface
+ */
+
+#include <stdio.h>
+
+#include "common.h"
+#include "event.h"
+#include "facemgr.h"
+#include "interface.h"
+#include "util/log.h"
+
+#ifdef __APPLE__
+extern interface_ops_t network_framework_ops;
+#endif
+#ifdef __linux__
+extern interface_ops_t netlink_ops;
+#endif
+#if 0
+extern interface_ops_t dummy_ops;
+#endif
+extern interface_ops_t hicn_light_ops;
+
+int
+facemgr_initialize(facemgr_t * facemgr)
+{
+    int rc;
+
+    rc = interface_map_initialize(&facemgr->interface_map);
+    if (FACEMGR_IS_ERROR(rc))
+        goto ERR_INTERFACE_MAP;
+
+    rc = face_cache_initialize(&facemgr->face_cache);
+    if (FACEMGR_IS_ERROR(rc))
+        goto ERR_FACE_SET;
+
+    rc = face_rules_initialize(&facemgr->rules);
+    if (FACEMGR_IS_ERROR(rc))
+        goto ERR_FACE_SET;
+
+    return FACEMGR_SUCCESS;
+
+ERR_FACE_SET:
+    interface_map_finalize(&facemgr->interface_map);
+
+ERR_INTERFACE_MAP:
+    return FACEMGR_FAILURE;
+}
+
+int
+facemgr_finalize(facemgr_t * facemgr)
+{
+    int rc;
+
+    /* XXX Free all interfaces: pass free to map */
+    rc = interface_map_finalize(&facemgr->interface_map);
+    if (FACEMGR_IS_ERROR(rc))
+        goto ERR;
+
+    rc = face_cache_finalize(&facemgr->face_cache);
+    if (FACEMGR_IS_ERROR(rc))
+        goto ERR;
+
+    rc = face_rules_finalize(&facemgr->rules);
+    if (FACEMGR_IS_ERROR(rc))
+        goto ERR;
+
+    return FACEMGR_SUCCESS;
+
+ERR:
+    return FACEMGR_FAILURE;
+}
+
+AUTOGENERATE_CREATE_FREE(facemgr);
+
+int
+facemgr_on_event(facemgr_t * facemgr, event_t * event)
+{
+    int rc;
+    char face_s[MAXSZ_FACE];
+    face_t * cached_face;
+
+    if (!event->face) {
+        printf("Event with empty face\n");
+        return -1;
+    }
+
+    face_t face = *event->face;
+
+    /* Complement unbound UDP faces */
+    switch(face.type) {
+        case FACE_TYPE_TCP:
+        case FACE_TYPE_UDP:
+            switch (face.params.tunnel.family) {
+                case AF_INET:
+                    if ((ip_address_empty(&face.params.tunnel.remote_addr)) &&
+                            (!ip_address_empty(&facemgr->overlay_v4_remote_addr)))
+                        face.params.tunnel.remote_addr = facemgr->overlay_v4_remote_addr;
+                    if ((face.params.tunnel.local_port == 0) && (facemgr->overlay_v4_local_port != 0))
+                        face.params.tunnel.local_port = facemgr->overlay_v4_local_port;
+                    if ((face.params.tunnel.remote_port == 0) && (facemgr->overlay_v4_remote_port != 0))
+                        face.params.tunnel.remote_port = facemgr->overlay_v4_remote_port;
+                    break;
+                case AF_INET6:
+                    if ((ip_address_empty(&face.params.tunnel.remote_addr)) &&
+                            (!ip_address_empty(&facemgr->overlay_v6_remote_addr)))
+                        face.params.tunnel.remote_addr = facemgr->overlay_v6_remote_addr;
+                    if ((face.params.tunnel.local_port == 0) && (facemgr->overlay_v6_local_port != 0))
+                        face.params.tunnel.local_port = facemgr->overlay_v6_local_port;
+                    if ((face.params.tunnel.remote_port == 0) && (facemgr->overlay_v6_remote_port != 0))
+                        face.params.tunnel.remote_port = facemgr->overlay_v6_remote_port;
+                default:
+                    break;
+            }
+            break;
+        default:
+            break;
+    }
+
+    face_snprintf(face_s, MAXSZ_FACE, &face);
+
+    /* TODO Here, we need to filter events based on our cache, and update the cache
+     * based on our actions if they are successful */
+
+    switch(event->type) {
+        case EVENT_TYPE_CREATE:
+            rc = face_cache_get(&facemgr->face_cache, &face, &cached_face);
+            if (!FACEMGR_IS_ERROR(rc)) {
+                DEBUG("Face found in cache");
+                goto IGNORE_EVENT;
+            }
+            rc = face_cache_add(&facemgr->face_cache, &face);
+            if (FACEMGR_IS_ERROR(rc))
+                WARN("Failed to add face to cache");
+            break;
+        case EVENT_TYPE_DELETE:
+            rc = face_cache_remove(&facemgr->face_cache, &face, &cached_face);
+            if (FACEMGR_IS_ERROR(rc))
+                WARN("Face not found in cache");
+            break;
+        case EVENT_TYPE_SET_UP:
+        case EVENT_TYPE_SET_DOWN:
+            /* TODO We need a return code to update the cache */
+            break;
+        default:
+            printf("Not implemented!\n");
+            break;
+    }
+
+    /* Process event */
+    printf("[ FACE %s ] %s\n", event_type_str[event->type], face_s);
+    /* Hardcoded hicn-light */
+    rc = interface_on_event(facemgr->hl, event);
+    if (FACEMGR_IS_ERROR(rc))
+        goto ERR;
+
+IGNORE_EVENT:
+    return FACEMGR_SUCCESS;
+
+ERR:
+    return FACEMGR_FAILURE;
+}
+
+#ifdef __linux__
+void interface_callback(evutil_socket_t fd, short what, void * arg) {
+    interface_t * interface = (interface_t *)arg;
+    interface->ops->callback(interface);
+}
+#endif /* __linux__ */
+
+int
+facemgr_create_interface(facemgr_t * facemgr, const char * name, const char * type, interface_t ** interface)
+{
+    int fd, rc;
+
+    INFO("Creating interface %s [%s]...\n", name, type);
+    *interface = interface_create(name, type);
+    if (!*interface) {
+        ERROR("Error creating interface %s [%s]\n", name, type);
+        return -1;
+    }
+    interface_set_callback(*interface, facemgr_on_event, facemgr);
+
+    fd = interface_initialize(*interface, &facemgr->rules);
+    if (fd < 0)
+        return -2;
+    if (fd != 0) {
+#ifdef __linux__
+        evutil_make_socket_nonblocking(fd);
+        struct event * event = event_new(facemgr->loop, fd, EV_READ | EV_PERSIST, interface_callback, *interface);
+        if (!event) {
+            return -3;
+        }
+
+        if (event_add(event, NULL) < 0) {
+            return -4;
+        }
+#else
+        ERROR("Not implemented\n");
+        return FACEMGR_FAILURE;
+#endif /* __linux__ */
+    }
+
+    rc = interface_map_add(&facemgr->interface_map, (*interface)->name, *interface);
+    if (FACEMGR_IS_ERROR(rc))
+        return -5;
+
+    DEBUG("Interface created successfully.\n");
+    return FACEMGR_SUCCESS;
+}
+
+int
+facemgr_bootstrap(facemgr_t * facemgr)
+{
+    int rc;
+
+    DEBUG("Registering interfaces...");
+    rc = interface_register(&hicn_light_ops);
+    if (FACEMGR_IS_ERROR(rc)) {
+        ERROR("Could not register interfaces");
+        goto ERR_REGISTER;
+    }
+
+#ifdef __APPLE__
+    rc = interface_register(&network_framework_ops);
+    if (FACEMGR_IS_ERROR(rc))
+        goto ERR_REGISTER;
+#endif /* __APPLE__ */
+
+#ifdef __linux__
+    rc = interface_register(&netlink_ops);
+    if (FACEMGR_IS_ERROR(rc))
+        goto ERR_REGISTER;
+#endif /* __linux__ */
+
+#if 0
+    rc = interface_register(&dummy_ops);
+    if (FACEMGR_IS_ERROR(rc))
+        goto ERR_REGISTER;
+#endif
+
+    rc = facemgr_create_interface(facemgr, "hl", "hicn_light", &facemgr->hl);
+    if (rc < 0) {
+        ERROR("Error creating 'hICN forwarder (hicn-light)' interface\n");
+        goto ERR_HL_CREATE;
+    }
+
+#ifdef __APPLE__
+    rc = facemgr_create_interface(facemgr, "nf", "network_framework", &facemgr->nf);
+    if (rc < 0) {
+        ERROR("Error creating 'Apple Network Framework' interface\n");
+        goto ERR_NF_CREATE;
+    }
+#endif /* __APPLE__ */
+
+#ifdef __linux__
+    rc = facemgr_create_interface(facemgr, "nl", "netlink", &facemgr->nl);
+    if (rc < 0) {
+        ERROR("Error creating 'Netlink' interface\n");
+        goto ERR_NF_CREATE;
+    }
+#endif /* __linux__ */
+
+#if 0
+    rc = facemgr_create_interface(facemgr, "dummy", "dummy", &facemgr->dummy);
+    if (rc < 0) {
+        ERROR("Error creating 'Dummy' interface\n");
+        goto ERR_NF_CREATE;
+    }
+#endif
+
+    DEBUG("Facemgr successfully initialized...");
+
+    return FACEMGR_SUCCESS;
+
+ERR_NF_CREATE:
+    interface_free(facemgr->hl);
+ERR_HL_CREATE:
+    //interface_map_remove(&facemgr->interface_map, data->nf->name);
+ERR_REGISTER:
+    return FACEMGR_FAILURE;
+}
diff --git a/ctrl/facemgr/src/facemgr.h b/ctrl/facemgr/src/facemgr.h
new file mode 100644
index 000000000..6505a1bd8
--- /dev/null
+++ b/ctrl/facemgr/src/facemgr.h
@@ -0,0 +1,77 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file facemgr.h
+ * \brief Face manager library interface
+ */
+#ifndef FACEMGR_H
+#define FACEMGR_H
+
+#include <string.h>
+#include "common.h"
+#include "face.h"
+#include "face_cache.h"
+#include "face_rules.h"
+#include "interface.h"
+#include "interface_map.h"
+#include "util/ip_address.h"
+#include "util/map.h"
+#include "util/policy.h"
+#ifndef __APPLE__
+#include <event2/event.h>
+#endif /* __APPLE__ */
+
+/*
+ * \brief Face manager context
+ */
+typedef struct {
+#ifndef APPLE
+    /* Event loop */
+    struct event_base * loop;
+#endif /* APPLE */
+
+    interface_map_t interface_map;
+    interface_t * hl;
+
+#ifdef __APPLE__
+    interface_t * nf;
+#endif /* __APPLE__ */
+
+#ifdef __linux__
+    interface_t * nl;
+#endif /* __linux__ */
+
+#if 0
+    interface_t * dummy;
+#endif
+
+    /* Overlay management */
+    uint16_t overlay_v4_local_port;
+    ip_address_t overlay_v4_remote_addr;
+    uint16_t overlay_v4_remote_port;
+    uint16_t overlay_v6_local_port;
+    ip_address_t overlay_v6_remote_addr;
+    uint16_t overlay_v6_remote_port;
+
+    face_rules_t rules;
+    face_cache_t face_cache;
+} facemgr_t;
+
+AUTOGENERATE_DEFS(facemgr);
+
+int facemgr_bootstrap(facemgr_t * facemgr);
+
+#endif /* FACEMGR_H */
diff --git a/ctrl/facemgr/src/interface.c b/ctrl/facemgr/src/interface.c
new file mode 100644
index 000000000..af9f666a7
--- /dev/null
+++ b/ctrl/facemgr/src/interface.c
@@ -0,0 +1,104 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file interface.c
+ * \brief Implementation of interface base class.
+ */
+
+#include <stdlib.h>
+#include <string.h>
+#include "event.h"
+#include "face_rules.h"
+#include "interface.h"
+#include "interface_ops_map.h"
+#include "util/map.h"
+
+static interface_ops_map_t * interface_ops_map = NULL;
+
+int
+interface_register(const interface_ops_t * ops)
+{
+    if (!interface_ops_map) {
+        interface_ops_map = interface_ops_map_create();
+        if (!interface_ops_map)
+            return FACEMGR_FAILURE;
+    }
+    interface_ops_map_add(interface_ops_map, ops->type, ops);
+    return FACEMGR_SUCCESS;
+}
+
+interface_t *
+interface_create(const char * name, const char * type)
+{
+
+    interface_ops_t * ops;
+    int rc = interface_ops_map_get(interface_ops_map, type, &ops);
+    if (FACEMGR_IS_ERROR(rc)) {
+        printf("Interface type not found %s\n", type);
+        return NULL;
+    }
+
+    interface_t * interface = malloc(sizeof(interface_t));
+    if (!interface)
+        return NULL;
+
+    interface->name = strdup(name);
+    /* this should use type */
+    interface->ops = ops;
+    interface->callback = NULL;
+    interface->callback_data = NULL;
+    interface->data = NULL;
+
+    return interface;
+}
+
+void
+interface_free(interface_t * interface)
+{
+    free(interface->name);
+    free(interface);
+}
+
+void
+_interface_set_callback(interface_t * interface, callback_t callback, void * callback_data)
+{
+    interface->callback = callback;
+    interface->callback_data = callback_data;
+}
+
+int
+interface_initialize(interface_t * interface, struct face_rules_s * rules)
+{
+    if (!interface->ops->initialize)
+        return FACEMGR_FAILURE;
+    return interface->ops->initialize(interface, rules, &interface->data);
+}
+
+int
+interface_finalize(interface_t * interface)
+{
+    if (!interface->ops->finalize)
+        return FACEMGR_FAILURE;
+    return interface->ops->finalize(interface);
+}
+
+int
+interface_on_event(interface_t * interface, const event_t * event)
+{
+    if (!interface->ops->on_event)
+        return FACEMGR_FAILURE;
+    return interface->ops->on_event(interface, event);
+}
diff --git a/ctrl/facemgr/src/interface.h b/ctrl/facemgr/src/interface.h
new file mode 100644
index 000000000..f38313182
--- /dev/null
+++ b/ctrl/facemgr/src/interface.h
@@ -0,0 +1,98 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file interface.h
+ * \brief Interface base class
+ *
+ * Interfaces are the priviledged way to extend the functionalities of the face
+ * manager. They both provide input and/or output functionality to allow for
+ * several components to interoperate, respectively by raising/receiving events
+ * about changes in the underlying network.
+ *
+ * All communication happens through base operations (create, delete, etc.) over
+ * a generic face abstraction.
+ */
+#ifndef FACEMGR_INTERFACE_H
+#define FACEMGR_INTERFACE_H
+
+#include <stdbool.h>
+
+struct event_s;
+typedef int (*callback_t)(struct event_s * event, void * callback_data);
+
+struct interface_s;
+struct face_rules_s;
+
+/**
+ * \brief Interface operations
+ */
+typedef struct {
+    char * type;
+    bool is_singleton;
+    int (*initialize)(struct interface_s * interface, struct face_rules_s * rules, void ** pdata);
+    int (*finalize)(struct interface_s * interface);
+    int (*callback)(struct interface_s * interface);
+    int (*on_event)(struct interface_s * interface, const struct event_s * event);
+} interface_ops_t;
+
+typedef struct interface_s {
+    char * name;
+    interface_ops_t * ops;
+    callback_t callback;
+    void * callback_data;
+    void * data;
+} interface_t;
+
+/**
+ * \brief Registers a new interface type
+ * \param [in] ops - Virtual function table representing the interface
+ *     operations.
+ * \return Flag indicating the success (FACEMGR_SUCCESS=0), or failure (any
+ *     other value) of the operation.
+ */
+int interface_register(const interface_ops_t * ops);
+
+/**
+ * \brief Create a new instance of an interface of a given type.
+ * \param [in] name - Name of the newly create interface instance.
+ * \param [in] type - Name of the interface type to create.
+ * \return A a pointer to the newly created instance of the requested type, or
+ *     NULL in case of failure.
+ */
+interface_t * interface_create(const char * name, const char * type);
+
+/**
+ * \brief Free an interface instance.
+ * \param [in] interface - Pointer to the instance to free.
+ */
+void interface_free(interface_t * interface);
+
+/**
+ * This function is equivalent to interface_set_callback, which should be
+ * preferred. The difference is the lack of explicit type casts which should
+ * simplify the calling syntax.
+ */
+
+void _interface_set_callback(interface_t * interface, callback_t callback, void * callback_data);
+#define interface_set_callback(interface, callback, callback_data) \
+    _interface_set_callback(interface, (callback_t)callback, (void*)callback_data)
+
+int interface_initialize(interface_t * interface, struct face_rules_s * rules);
+int interface_finalize(interface_t * interface);
+
+int interface_on_event(interface_t * interface, const struct event_s * event);
+
+#endif /* FACEMGR_INTERFACE_H */
diff --git a/ctrl/facemgr/src/interface_map.c b/ctrl/facemgr/src/interface_map.c
new file mode 100644
index 000000000..9f7c20cab
--- /dev/null
+++ b/ctrl/facemgr/src/interface_map.c
@@ -0,0 +1,21 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "interface_map.h"
+
+#include <string.h>
+#include "interface.h"
+
+TYPEDEF_MAP(interface_map, const char *, interface_t *, strcmp, string_snprintf, generic_snprintf);
diff --git a/ctrl/facemgr/src/interface_map.h b/ctrl/facemgr/src/interface_map.h
new file mode 100644
index 000000000..5930b3001
--- /dev/null
+++ b/ctrl/facemgr/src/interface_map.h
@@ -0,0 +1,24 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef INTERFACE_MAP_H
+#define INTERFACE_MAP_H
+
+#include "interface.h"
+#include "util/map.h"
+
+TYPEDEF_MAP_H(interface_map, const char *, interface_t *);
+
+#endif /* INTERFACE_MAP_H */
diff --git a/ctrl/facemgr/src/interface_ops_map.c b/ctrl/facemgr/src/interface_ops_map.c
new file mode 100644
index 000000000..373f5d22f
--- /dev/null
+++ b/ctrl/facemgr/src/interface_ops_map.c
@@ -0,0 +1,21 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "interface_ops_map.h"
+
+#include <string.h>
+#include "util/map.h"
+
+TYPEDEF_MAP(interface_ops_map, const char *, interface_ops_t *, strcmp, string_snprintf, generic_snprintf);
diff --git a/ctrl/facemgr/src/interface_ops_map.h b/ctrl/facemgr/src/interface_ops_map.h
new file mode 100644
index 000000000..2d590390a
--- /dev/null
+++ b/ctrl/facemgr/src/interface_ops_map.h
@@ -0,0 +1,24 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef INTERFACE_OPS_MAP_H
+#define INTERFACE_OPS_MAP_H
+
+#include "interface.h"
+#include "util/map.h"
+
+TYPEDEF_MAP_H(interface_ops_map, const char *, interface_ops_t *);
+
+#endif /* INTERFACE_OPS_MAP_H */
diff --git a/ctrl/facemgr/src/interfaces/CMakeLists.txt b/ctrl/facemgr/src/interfaces/CMakeLists.txt
new file mode 100644
index 000000000..e5a26177a
--- /dev/null
+++ b/ctrl/facemgr/src/interfaces/CMakeLists.txt
@@ -0,0 +1,36 @@
+# Copyright (c) 2017-2019 Cisco and/or its affiliates.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+list(APPEND HEADER_FILES)
+list(APPEND SOURCE_FILES)
+list(APPEND INCLUDE_DIRS)
+list(APPEND LIBRARIES)
+
+add_subdirectory(hicn_light)
+
+if(APPLE)
+add_subdirectory(network_framework)
+endif()
+
+if(LINUX)
+add_subdirectory(netlink)
+endif()
+
+if(false)
+add_subdirectory(dummy)
+endif()
+
+set(SOURCE_FILES ${SOURCE_FILES} PARENT_SCOPE)
+set(HEADER_FILES ${HEADER_FILES} PARENT_SCOPE)
+set(INCLUDE_DIRS ${INCLUDE_DIRS} PARENT_SCOPE)
+set(LIBRARIES    ${LIBRARIES}    PARENT_SCOPE)
diff --git a/ctrl/facemgr/src/interfaces/dummy/CMakeLists.txt b/ctrl/facemgr/src/interfaces/dummy/CMakeLists.txt
new file mode 100644
index 000000000..1af3b4b2a
--- /dev/null
+++ b/ctrl/facemgr/src/interfaces/dummy/CMakeLists.txt
@@ -0,0 +1,30 @@
+# Copyright (c) 2017-2019 Cisco and/or its affiliates.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+list(APPEND HEADER_FILES
+)
+
+list(APPEND SOURCE_FILES
+    ${CMAKE_CURRENT_SOURCE_DIR}/dummy.c
+)
+
+list(APPEND INCLUDE_DIRS
+)
+
+list(APPEND LIBRARIES
+)
+
+set(SOURCE_FILES ${SOURCE_FILES} PARENT_SCOPE)
+set(HEADER_FILES ${HEADER_FILES} PARENT_SCOPE)
+set(INCLUDE_DIRS ${INCLUDE_DIRS} PARENT_SCOPE)
+set(LIBRARIES    ${LIBRARIES}    PARENT_SCOPE)
diff --git a/ctrl/facemgr/src/interfaces/dummy/dummy.c b/ctrl/facemgr/src/interfaces/dummy/dummy.c
new file mode 100644
index 000000000..b0c558388
--- /dev/null
+++ b/ctrl/facemgr/src/interfaces/dummy/dummy.c
@@ -0,0 +1,49 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file dummy.c
+ * \brief Implementation of Dummy interface
+ */
+
+#include <stdlib.h>
+
+#include "../../interface.h"
+#include "../../common.h"
+#include "../../event.h"
+#include "../../face.h"
+#include "../../facemgr.h"
+
+#define DEFAULT_PORT 9695
+
+int dummy_initialize(interface_t * interface, face_rules_t * rules, void **pdata) {
+    ip_address_t local = IPV4_LOOPBACK;
+    ip_address_t remote = IPV4_LOOPBACK;
+    face_t * face = face_create_udp(&local, DEFAULT_PORT, &remote, DEFAULT_PORT, AF_INET);
+    event_raise(EVENT_TYPE_CREATE, face, interface);
+    return FACEMGR_SUCCESS;
+}
+
+int dummy_finalize(interface_t * interface) {
+    return FACEMGR_SUCCESS;
+}
+
+interface_ops_t dummy_ops = {
+    .type = "dummy",
+    .is_singleton = true,
+    .initialize = dummy_initialize,
+    .finalize = dummy_finalize,
+    .on_event = NULL,
+};
diff --git a/ctrl/facemgr/src/interfaces/hicn_light/CMakeLists.txt b/ctrl/facemgr/src/interfaces/hicn_light/CMakeLists.txt
new file mode 100644
index 000000000..ef839a69c
--- /dev/null
+++ b/ctrl/facemgr/src/interfaces/hicn_light/CMakeLists.txt
@@ -0,0 +1,33 @@
+# Copyright (c) 2017-2019 Cisco and/or its affiliates.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+list(APPEND HEADER_FILES
+)
+
+list(APPEND SOURCE_FILES
+    ${CMAKE_CURRENT_SOURCE_DIR}/hicn_light.c
+)
+
+list(APPEND LIBRARIES
+    ${HICNCTRL_LIBRARIES}
+)
+
+
+list(APPEND INCLUDE_DIRS
+    ${HICNCTRL_INCLUDE_DIR}
+)
+
+set(SOURCE_FILES ${SOURCE_FILES} PARENT_SCOPE)
+set(HEADER_FILES ${HEADER_FILES} PARENT_SCOPE)
+set(INCLUDE_DIRS ${INCLUDE_DIRS} PARENT_SCOPE)
+set(LIBRARIES    ${LIBRARIES}    PARENT_SCOPE)
diff --git a/ctrl/facemgr/src/interfaces/hicn_light/hicn_light.c b/ctrl/facemgr/src/interfaces/hicn_light/hicn_light.c
new file mode 100644
index 000000000..85694573d
--- /dev/null
+++ b/ctrl/facemgr/src/interfaces/hicn_light/hicn_light.c
@@ -0,0 +1,222 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file interfaces/hicn_light/hicn_light.c
+ * \brief hICN light interface
+ */
+#include <stdbool.h>
+#include <stdlib.h> // arc4random [random, rand]
+#include <stdio.h> // snprintf
+#include <time.h> // time
+
+#include <hicn/ctrl.h>
+
+#include "../../facemgr.h"
+#include "../../interface.h"
+#include "../../util/ip_address.h"
+#include "../../util/log.h"
+#include "../../util/map.h"
+#include "../../event.h"
+
+#define DEFAULT_ROUTE_COST 0
+
+typedef struct {
+    hc_sock_t * s;
+    bool busy;
+} hl_data_t;
+
+int hl_initialize(interface_t * interface, face_rules_t * rules, void ** pdata)
+{
+    hl_data_t * data = malloc(sizeof(hl_data_t));
+    if (!data) {
+        ERROR("[hicn_light] Out of memory!");
+        goto ERR_MALLOC;
+    }
+
+    data->s = hc_sock_create();
+    if (data->s <= 0) {
+        ERROR("[hicn_light] Could not create control socket");
+        goto ERR_SOCK;
+    }
+
+    if (hc_sock_connect(data->s) < 0) {
+        ERROR("[hicn_light] Could not connect control socket");
+        goto ERR_CONNECT;
+    }
+
+    data->busy = false;
+
+    *pdata = data;
+
+    return FACEMGR_SUCCESS;
+
+ERR_CONNECT:
+    hc_sock_free(data->s);
+ERR_SOCK:
+    free(data);
+ERR_MALLOC:
+    return FACEMGR_FAILURE;
+}
+
+int hl_finalize(interface_t * interface)
+{
+    //hc_data_t * data = interface->data;
+    //hc_sock_close(data->s);
+    return FACEMGR_SUCCESS;
+}
+
+int hl_on_event(interface_t * interface, const event_t * event)
+{
+    hc_face_t face;
+    hc_route_t route;
+    int rc;
+    hl_data_t * data = (hl_data_t *)interface->data;
+
+    /* XXX We need  a queue or a socket pool to process concurrent events */
+    if (data->busy) {
+        ERROR("[hicn_light] Busy !");
+        return FACEMGR_FAILURE;
+    }
+
+    switch(event->type) {
+        case EVENT_TYPE_CREATE:
+
+            /* Create face */
+            face.face = *event->face;
+            rc = hc_face_create(data->s, &face);
+            if (rc < 0) {
+                ERROR("Failed to create face\n");
+                goto ERR;
+            }
+            DEBUG("Created face id=%d\n", face.id);
+
+#if 0
+            /* Add default route v4 */
+            route = (hc_route_t) {
+                .face_id = face.id,
+                .family = AF_INET,
+                .remote_addr = IPV4_ANY,
+                .len = 0,
+                .cost = DEFAULT_ROUTE_COST,
+
+            };
+            if (hc_route_create(data->s, &route) < 0) {
+                ERROR("Failed to create default hICN/IPv4 route");
+                goto ERR;
+            }
+            INFO("Successfully created default hICN/IPv4 route.");
+#endif
+
+#if 0
+            route = (hc_route_t) {
+                .face_id = face.id,
+                .family = AF_INET6,
+                .remote_addr = IPV6_ANY,
+                .len = 0,
+                .cost = DEFAULT_ROUTE_COST,
+            };
+            if (hc_route_create(data->s, &route) < 0) {
+                ERROR("Failed to create default hICN/IPv6 route");
+                goto ERR;
+            }
+#endif
+
+#if 1
+            /* We add routes based on face tags */
+
+            if (policy_tags_has(event->face->tags, POLICY_TAG_TRUSTED)) {
+                route = (hc_route_t) {
+                    .face_id = face.id,
+                    .family = AF_INET6,
+                    .len = 16,
+                    .cost = DEFAULT_ROUTE_COST,
+                };
+                if (ip_address_pton("b001::", &route.remote_addr) < 0) {
+                    ERROR("Failed to convert prefix");
+                    goto ERR;
+                }
+                if (hc_route_create(data->s, &route) < 0) {
+                    ERROR("Failed to create hICN/IPv6 route");
+                    goto ERR;
+                }
+
+                route = (hc_route_t) {
+                    .face_id = face.id,
+                    .family = AF_INET6,
+                    .len = 16,
+                    .cost = DEFAULT_ROUTE_COST,
+                };
+                if (ip_address_pton("d001::", &route.remote_addr) < 0) {
+                    ERROR("Failed to convert prefix");
+                    goto ERR;
+                }
+                if (hc_route_create(data->s, &route) < 0) {
+                    ERROR("Failed to create hICN/IPv6 route");
+                    goto ERR;
+                }
+
+            } else {
+
+                route = (hc_route_t) {
+                    .face_id = face.id,
+                    .family = AF_INET6,
+                    .len = 16,
+                    .cost = DEFAULT_ROUTE_COST,
+                };
+                if (ip_address_pton("c001::", &route.remote_addr) < 0) {
+                    ERROR("Failed to convert prefix");
+                    goto ERR;
+                }
+                if (hc_route_create(data->s, &route) < 0) {
+                    ERROR("Failed to create hICN/IPv6 route");
+                    goto ERR;
+                }
+            }
+#endif
+
+            break;
+
+        case EVENT_TYPE_DELETE:
+            /* Removing a face should also remove associated routes */
+            /* Create face */
+            face.face = *event->face;
+            rc = hc_face_delete(data->s, &face);
+            if (rc < 0) {
+                ERROR("Failed to delete face\n");
+                goto ERR;
+            }
+            INFO("Deleted face id=%d\n", face.id);
+            break;
+
+        default:
+            ERROR("Unknown event %s\n", event_type_str[event->type]);
+            /* Unsupported events */
+            goto ERR;
+    }
+
+    return FACEMGR_SUCCESS;
+
+ERR:
+    return FACEMGR_FAILURE;
+}
+
+const interface_ops_t hicn_light_ops = {
+    .type = "hicn_light",
+    .is_singleton = false,
+    .initialize = hl_initialize,
+    .finalize = hl_finalize,
+    .on_event = hl_on_event,
+};
diff --git a/ctrl/facemgr/src/interfaces/netlink/CMakeLists.txt b/ctrl/facemgr/src/interfaces/netlink/CMakeLists.txt
new file mode 100644
index 000000000..7f44d87fe
--- /dev/null
+++ b/ctrl/facemgr/src/interfaces/netlink/CMakeLists.txt
@@ -0,0 +1,30 @@
+# Copyright (c) 2017-2019 Cisco and/or its affiliates.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+list(APPEND HEADER_FILES
+)
+
+list(APPEND SOURCE_FILES
+    ${CMAKE_CURRENT_SOURCE_DIR}/netlink.c
+)
+
+list(APPEND LIBRARIES
+)
+
+list(APPEND INCLUDE_DIRS
+)
+
+set(SOURCE_FILES ${SOURCE_FILES} PARENT_SCOPE)
+set(HEADER_FILES ${HEADER_FILES} PARENT_SCOPE)
+set(INCLUDE_DIRS ${INCLUDE_DIRS} PARENT_SCOPE)
+set(LIBRARIES    ${LIBRARIES}    PARENT_SCOPE)
diff --git a/ctrl/facemgr/src/interfaces/netlink/netlink.c b/ctrl/facemgr/src/interfaces/netlink/netlink.c
new file mode 100644
index 000000000..5bf0baf9f
--- /dev/null
+++ b/ctrl/facemgr/src/interfaces/netlink/netlink.c
@@ -0,0 +1,254 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file interfaces/netlink/netlink.c
+ * \brief Netlink interface
+ */
+
+#include <linux/rtnetlink.h>
+#include <sys/types.h> // getpid
+#include <unistd.h> // getpid
+
+#include "../../event.h"
+#include "../../facemgr.h"
+#include "../../interface.h"
+
+/* Internal data storage */
+typedef struct {
+    int fd;
+} nl_data_t;
+
+// little helper to parsing message using netlink macroses
+void parseRtattr(struct rtattr *tb[], int max, struct rtattr *rta, int len)
+{
+    memset(tb, 0, sizeof(struct rtattr *) * (max + 1));
+
+    while (RTA_OK(rta, len)) {  // while not end of the message
+        if (rta->rta_type <= max) {
+            tb[rta->rta_type] = rta; // read attr
+        }
+        rta = RTA_NEXT(rta,len);    // get next attr
+    }
+}
+
+
+int nl_initialize(interface_t * interface, face_rules_t * rules, void ** pdata)
+{
+    nl_data_t * data = malloc(sizeof(nl_data_t));
+    if (!data)
+        goto ERR_MALLOC;
+
+    data->fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
+    if (data->fd < 0) {
+        printf("Failed to create netlink socket: %s\n", (char*)strerror(errno));
+        goto ERR_SOCKET;
+    }
+
+    struct sockaddr_nl  local;  // local addr struct
+    memset(&local, 0, sizeof(local));
+    local.nl_family = AF_NETLINK;       // set protocol family
+    local.nl_groups = RTMGRP_LINK | RTMGRP_IPV4_IFADDR | RTMGRP_IPV4_ROUTE;   // set groups we interested in
+    local.nl_pid = getpid();    // set out id using current process id
+
+
+    if (bind(data->fd, (struct sockaddr*)&local, sizeof(local)) < 0) {     // bind socket
+        printf("Failed to bind netlink socket: %s\n", (char*)strerror(errno));
+        goto ERR_BIND;
+    }
+
+    /* Issue a first query to receive static state */
+
+
+    *pdata = data;
+    return data->fd; // FACEMGR_SUCCESS;
+
+ERR_BIND:
+    close(data->fd);
+ERR_SOCKET:
+    free(data);
+ERR_MALLOC:
+    *pdata = NULL;
+    return FACEMGR_FAILURE;
+}
+
+int nl_callback(interface_t * interface)
+{
+    nl_data_t * data = (nl_data_t*)interface->data;
+
+    struct sockaddr_nl  local;  // local addr struct
+    memset(&local, 0, sizeof(local));
+
+    char buf[8192];             // message buffer
+    struct iovec iov;           // message structure
+    iov.iov_base = buf;         // set message buffer as io
+    iov.iov_len = sizeof(buf);  // set size
+
+    // initialize protocol message header
+    struct msghdr msg;
+    {
+        msg.msg_name = &local;                  // local address
+        msg.msg_namelen = sizeof(local);        // address size
+        msg.msg_iov = &iov;                     // io vector
+        msg.msg_iovlen = 1;                     // io size
+    }
+
+    ssize_t status = recvmsg(data->fd, &msg, 0);
+
+    //  check status
+    if (status < 0) {
+/*
+        if (errno == EINTR || errno == EAGAIN)
+            continue;
+*/
+
+        printf("Failed to read netlink: %s", (char*)strerror(errno));
+        return FACEMGR_FAILURE;
+    }
+
+    if (msg.msg_namelen != sizeof(local)) { // check message length, just in case
+        printf("Invalid length of the sender address struct\n");
+        return FACEMGR_FAILURE;
+    }
+
+    // message parser
+    struct nlmsghdr *h;
+
+    for (h = (struct nlmsghdr*)buf; status >= (ssize_t)sizeof(*h); ) {   // read all messagess headers
+        int len = h->nlmsg_len;
+        int l = len - sizeof(*h);
+        char *ifName = NULL;
+
+        if ((l < 0) || (len > status)) {
+            printf("Invalid message length: %i\n", len);
+            continue;
+        }
+
+        // now we can check message type
+        if ((h->nlmsg_type == RTM_NEWROUTE) || (h->nlmsg_type == RTM_DELROUTE)) { // some changes in routing table
+            printf("Routing table was changed\n");
+        } else {    // in other case we need to go deeper
+            char *ifUpp;
+            char *ifRunn;
+            struct ifinfomsg *ifi;  // structure for network interface info
+            struct rtattr *tb[IFLA_MAX + 1];
+
+            ifi = (struct ifinfomsg*) NLMSG_DATA(h);    // get information about changed network interface
+
+            parseRtattr(tb, IFLA_MAX, IFLA_RTA(ifi), h->nlmsg_len);  // get attributes
+
+            if (tb[IFLA_IFNAME]) {  // validation
+                ifName = (char*)RTA_DATA(tb[IFLA_IFNAME]); // get network interface name
+            }
+
+            if (ifi->ifi_flags & IFF_UP) { // get UP flag of the network interface
+                ifUpp = (char*)"UP";
+            } else {
+                ifUpp = (char*)"DOWN";
+            }
+
+            if (ifi->ifi_flags & IFF_RUNNING) { // get RUNNING flag of the network interface
+                ifRunn = (char*)"RUNNING";
+            } else {
+                ifRunn = (char*)"NOT RUNNING";
+            }
+
+            char ifAddress[256] = {0};    // network addr
+            struct ifaddrmsg *ifa; // structure for network interface data
+            struct rtattr *tba[IFA_MAX+1];
+
+            ifa = (struct ifaddrmsg*)NLMSG_DATA(h); // get data from the network interface
+
+            parseRtattr(tba, IFA_MAX, IFA_RTA(ifa), h->nlmsg_len);
+
+            if (tba[IFA_LOCAL]) {
+                inet_ntop(AF_INET, RTA_DATA(tba[IFA_LOCAL]), ifAddress, sizeof(ifAddress)); // get IP addr
+            }
+
+            face_t * face;
+
+            if (tba[IFA_LOCAL]) {
+                ip_address_t local_addr = IP_ADDRESS_EMPTY;
+                switch(ifa->ifa_family) {
+                    case AF_INET:
+                        local_addr.v4.as_inaddr = *(struct in_addr*)RTA_DATA(tba[IFA_LOCAL]);
+                        break;
+                    case AF_INET6:
+                        local_addr.v6.as_in6addr = *(struct in6_addr*)RTA_DATA(tba[IFA_LOCAL]);
+                        break;
+                    default:
+                        continue;
+                }
+                face = face_create_udp(&local_addr, 0, &IP_ADDRESS_EMPTY, 0, ifa->ifa_family);
+            } else {
+                face = NULL;
+            }
+
+            switch (h->nlmsg_type) {
+                case RTM_DELADDR:
+                    // DOES NOT SEEM TO BE TRIGGERED
+                    printf("Interface %s: address was removed\n", ifName);
+                    if (face)
+                        event_raise(EVENT_TYPE_DELETE, face, interface);
+                    break;
+
+                case RTM_DELLINK:
+                    printf("Network interface %s was removed\n", ifName);
+                    break;
+
+                case RTM_NEWLINK:
+                    printf("New network interface %s, state: %s %s\n", ifName, ifUpp, ifRunn);
+                    // UP RUNNING
+                    // UP NOT RUNNING
+                    // DOWN NOT RUNNING
+                    if (!(ifi->ifi_flags & IFF_UP) || (!(ifi->ifi_flags & IFF_RUNNING))) {
+                        if(face)
+                            event_raise(EVENT_TYPE_DELETE, face, interface);
+                    }
+                    break;
+
+                case RTM_NEWADDR:
+                    printf("Interface %s: new address was assigned: %s\n", ifName, ifAddress);
+                    printf("NEW FACE\n");
+                    if (face)
+                        event_raise(EVENT_TYPE_CREATE, face, interface);
+                    break;
+            }
+        }
+
+        status -= NLMSG_ALIGN(len); // align offsets by the message length, this is important
+
+        h = (struct nlmsghdr*)((char*)h + NLMSG_ALIGN(len));    // get next message
+    }
+
+    return FACEMGR_SUCCESS;
+}
+
+int nl_finalize(interface_t * interface)
+{
+    nl_data_t * data = (nl_data_t*)interface->data;
+    close(data->fd);
+    return FACEMGR_SUCCESS;
+
+}
+
+const interface_ops_t netlink_ops = {
+    .type = "netlink",
+    .is_singleton = true,
+    .initialize = nl_initialize,
+    .callback = nl_callback,
+    .finalize = nl_finalize,
+    .on_event = NULL,
+};
diff --git a/ctrl/facemgr/src/interfaces/network_framework/CMakeLists.txt b/ctrl/facemgr/src/interfaces/network_framework/CMakeLists.txt
new file mode 100644
index 000000000..ca6659342
--- /dev/null
+++ b/ctrl/facemgr/src/interfaces/network_framework/CMakeLists.txt
@@ -0,0 +1,36 @@
+# Copyright (c) 2017-2019 Cisco and/or its affiliates.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+find_library(NETWORK_LIBRARY Network)
+if (NOT NETWORK_LIBRARY)
+    message(FATAL_ERROR "NetworkFramework not found")
+endif()
+
+list(APPEND HEADER_FILES
+)
+
+list(APPEND SOURCE_FILES
+    ${CMAKE_CURRENT_SOURCE_DIR}/network_framework.c
+)
+
+list(APPEND INCLUDE_DIRS
+)
+
+list(APPEND LIBRARIES
+    ${NETWORK_LIBRARY}
+)
+
+set(SOURCE_FILES ${SOURCE_FILES} PARENT_SCOPE)
+set(HEADER_FILES ${HEADER_FILES} PARENT_SCOPE)
+set(INCLUDE_DIRS ${INCLUDE_DIRS} PARENT_SCOPE)
+set(LIBRARIES    ${LIBRARIES}    PARENT_SCOPE)
diff --git a/ctrl/facemgr/src/interfaces/network_framework/network_framework.c b/ctrl/facemgr/src/interfaces/network_framework/network_framework.c
new file mode 100644
index 000000000..8a33129b4
--- /dev/null
+++ b/ctrl/facemgr/src/interfaces/network_framework/network_framework.c
@@ -0,0 +1,581 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file network_framework.c
+ * \brief Implementation of Network framework interface
+ */
+
+#include <sys/socket.h>
+#include <arpa/inet.h>
+
+#include <Network/Network.h>
+#include <err.h>
+
+#include "../../common.h"
+#include "../../event.h"
+#include "../../face.h"
+#include "../../facemgr.h"
+#include "../../interface.h"
+#include "../../util/map.h"
+#include "../../util/token.h"
+#include "../../util/log.h"
+
+/*
+ * Bonjour service discovery for hICN forwarder
+ *
+ * Possible values for BONJOUR_PROTOCOL:
+ *      udp (default) : avoid potential handshake during connection setup.
+ *      tcp
+ *
+ * Service advertisement / discovery on MacOSX
+ *
+ *      dns-sd -R hicn _hicn._tcp local 9695
+ *      dns-sd -R hicn _hicn._udp local 9695
+ *
+ *      dns-sd -B _hicn._tcp local
+ *      dns-sd -B _hicn._udp local
+ *
+ * Service discovery on Linux (various useful commandline arguments):
+ *
+ *      avahi-browse -pt _hicn._udp
+ *      avahi-browse -rp _hicn._tcp
+ */
+
+#define BONJOUR_PROTOCOL udp
+#define BONJOUR_SERVICE_DOMAIN "local"
+#define BONJOUR_SERVICE_NAME "hicn"
+
+/* Generated variables */
+#define BONJOUR_SERVICE_TYPE "_hicn._" STRINGIZE(BONJOUR_PROTOCOL)
+#define BONJOUR_PROTOCOL_NAME STRINGIZE(BONJOUR_PROTOCOL)
+#define nw_parameters_create_fn PPCAT(nw_parameters_create_secure_, BONJOUR_PROTOCOL)
+
+#define DEFAULT_PORT 9695
+
+typedef enum {
+    INTERFACE_TYPE_OTHER,
+    INTERFACE_TYPE_WIFI,
+    INTERFACE_TYPE_CELLULAR,
+    INTERFACE_TYPE_WIRED,
+    INTERFACE_TYPE_LOOPBACK,
+} _nw_interface_type_t;
+
+const char * interface_type_str[] = {
+    "OTHER", "WIFI", "CELLULAR", "WIRED", "LOOPBACK",
+};
+
+#if 0
+typedef enum {
+    PATH_STATUS_INVALID,
+    PATH_STATUS_SATISTIED,
+    PATH_STATUS_UNSATISFIED,
+    PATH_STATUS_SATISFIABLE,
+} _nw_path_status_t;
+#endif
+
+const char * path_status_str[] = {
+    "INVALID", "SATISFIED", "UNSATISFIED", "SATISFIABLE",
+};
+
+const char * endpoint_type_str[] = {
+    "INVALID", "ADDRESS", "HOST", "BONJOUR",
+};
+
+const char * connection_state_str[] = {
+    "INVALID", "WAITING", "PREPARING", "READY", "FAILED", "CANCELLED",
+};
+
+int
+cmp_iface(const nw_interface_t iface1, const nw_interface_t iface2)
+{
+    return INT_CMP(nw_interface_get_index(iface1), nw_interface_get_index(iface2));
+}
+
+//TYPEDEF_MAP(map_cnx, nw_interface_t, nw_connection_t, cmp_iface);
+
+typedef struct {
+    face_rules_t * rules; /**< Face creation rules */
+    nw_path_monitor_t pm; /**< Main path monitor */
+//    map_cnx_t map_cnx;    /**< Map: interface -> connection for face status */
+} nf_data_t;
+
+void
+dump_interface(nw_interface_t interface, int indent)
+{
+    uint32_t index = nw_interface_get_index(interface);
+    const char * name = nw_interface_get_name(interface);
+    nw_interface_type_t type = nw_interface_get_type(interface);
+
+    printfi(indent+1, "%d: %s [%s]\n", index, name, interface_type_str[type]);
+}
+
+void
+dump_endpoint(nw_endpoint_t endpoint, int indent)
+{
+    if (!endpoint) {
+        printfi(indent, "N/A\n");
+        return;
+    }
+
+    nw_endpoint_type_t endpoint_type = nw_endpoint_get_type(endpoint);
+    const char * hostname = nw_endpoint_get_hostname(endpoint);
+    short port = nw_endpoint_get_port(endpoint);
+    const struct sockaddr * address = nw_endpoint_get_address(endpoint);
+
+    printfi(indent, "Type: %s\n", endpoint_type_str[endpoint_type]);
+    printfi(indent, "Hostname: %s\n", hostname);
+    printfi(indent, "Port: %d\n", port);
+
+    if (address) {
+        char *s = NULL;
+        switch(address->sa_family) {
+            case AF_INET: {
+                              struct sockaddr_in *addr_in = (struct sockaddr_in *)address;
+                              s = malloc(INET_ADDRSTRLEN);
+                              inet_ntop(AF_INET, &(addr_in->sin_addr), s, INET_ADDRSTRLEN);
+                              break;
+                          }
+            case AF_INET6: {
+                               struct sockaddr_in6 *addr_in6 = (struct sockaddr_in6 *)address;
+                               s = malloc(INET6_ADDRSTRLEN);
+                               inet_ntop(AF_INET6, &(addr_in6->sin6_addr), s, INET6_ADDRSTRLEN);
+                               break;
+                           }
+            default:
+                           break;
+        }
+        printfi(indent, "IP address: %s\n", s);
+        free(s);
+    }
+}
+
+void
+dump_path(nw_path_t path, int indent)
+{
+    /* nw_path_enumerate_interfaces : not interesting */
+    nw_path_status_t path_status = nw_path_get_status(path);
+    printfi(indent, "Status: %s\n", path_status_str[path_status]);
+    printfi(indent, "Expensive: %s\n", nw_path_is_expensive(path) ? "true" : "false");
+    printfi(indent, "IPv4 enabled: %s\n", nw_path_has_ipv4(path) ? "true" : "false");
+    printfi(indent, "IPv6 enabled: %s\n", nw_path_has_ipv6(path) ? "true" : "false");
+    printfi(indent, "DNS: %s\n", nw_path_has_dns(path) ? "true" : "false");
+    printfi(indent, "Interfaces:\n");
+    nw_path_enumerate_interfaces(path, (nw_path_enumerate_interfaces_block_t)^(nw_interface_t interface) {
+        dump_interface(interface, indent+1);
+        return true;
+    });
+
+    nw_endpoint_t local = nw_path_copy_effective_local_endpoint(path);
+    printfi(indent, "Effective local endpoint:\n");
+    dump_endpoint(local, indent+1);
+    nw_release(local);
+
+    nw_endpoint_t remote = nw_path_copy_effective_remote_endpoint(path);
+    printfi(indent, "Effective remote endpoint:\n");
+    dump_endpoint(remote, indent+1);
+    nw_release(remote);
+}
+
+void
+dump_connection(nw_connection_t connection, int indent)
+{
+    nw_endpoint_t remote = nw_connection_copy_endpoint(connection);
+    nw_path_t path = nw_connection_copy_current_path(connection);
+
+    printfi(indent, "Remote endpoint:\n");
+    dump_endpoint(remote, indent+1);
+    printfi(indent, "Path:\n");
+    dump_path(path, indent+1);
+
+    /*
+    nw_connection_copy_protocol_metadata();
+    nw_connection_get_maximum_datagram_size();
+    */
+
+    nw_release(remote);
+    nw_release(path);
+}
+
+face_t *
+face_create_from_connection(nw_connection_t connection, face_rules_t * rules)
+{
+    face_t * face;
+    struct sockaddr_in * sin;
+    struct sockaddr_in6 * sin6;
+
+    nw_path_t path = nw_connection_copy_current_path(connection);
+    nw_endpoint_t local = nw_path_copy_effective_local_endpoint(path);
+    nw_endpoint_t remote = nw_path_copy_effective_remote_endpoint(path);
+    __block nw_interface_t interface;
+
+    const struct sockaddr * local_addr = nw_endpoint_get_address(local);
+    const struct sockaddr * remote_addr = nw_endpoint_get_address(remote);
+
+    assert (local_addr->sa_family == remote_addr->sa_family);
+    switch(local_addr->sa_family) {
+        case AF_INET:
+            sin = (struct sockaddr_in *)local_addr;
+            sin->sin_port = htons(DEFAULT_PORT);
+            sin = (struct sockaddr_in *)remote_addr;
+            sin->sin_port = htons(DEFAULT_PORT);
+            break;
+        case AF_INET6:
+            sin6 = (struct sockaddr_in6 *)local_addr;
+            sin6->sin6_port = htons(DEFAULT_PORT);
+            sin6 = (struct sockaddr_in6 *)remote_addr;
+            sin6->sin6_port = htons(DEFAULT_PORT);
+            break;
+        default:
+            ERROR("Unsupported address family: %d\n", local_addr->sa_family);
+            return NULL;
+    }
+
+    face = face_create_udp_sa(local_addr, remote_addr);
+
+    /* Retrieving path interface type (a single one expected */
+    nw_path_enumerate_interfaces(path, (nw_path_enumerate_interfaces_block_t)^(nw_interface_t path_interface) {
+        interface = path_interface;
+        return false;
+    });
+    nw_interface_type_t type = nw_interface_get_type(interface);
+    const char * name = nw_interface_get_name(interface);
+
+    policy_tags_t tags = POLICY_TAGS_EMPTY;
+
+    if (rules) {
+        if (!FACEMGR_IS_ERROR(face_rules_get(rules, name, &tags)))
+            goto SET_TAGS;
+
+        char tags[MAXSZ_POLICY_TAGS];
+        policy_tags_snprintf(tags, MAXSZ_POLICY_TAGS, face->tags);
+    }
+
+    switch(type) {
+        case INTERFACE_TYPE_OTHER:
+            policy_tags_add(&tags, POLICY_TAG_WIFI);
+            policy_tags_add(&tags, POLICY_TAG_TRUSTED);
+            break;
+        case INTERFACE_TYPE_WIFI:
+            // XXX disambuiguate on interface name for now.
+            policy_tags_add(&tags, POLICY_TAG_WIFI);
+            policy_tags_add(&tags, POLICY_TAG_TRUSTED);
+            break;
+        case INTERFACE_TYPE_CELLULAR:
+            policy_tags_add(&tags, POLICY_TAG_CELLULAR);
+            break;
+        case INTERFACE_TYPE_WIRED:
+            /* Both VPN and USB WiFi are not well detected on MacOS. For USB
+             * WiFi, we currently have no solution. For VPN, until we have
+             * proper support of AnyC APIs, we need to have heuristics to
+             * determine VPN interfaces. */
+            policy_tags_add(&tags, POLICY_TAG_WIRED);
+            policy_tags_add(&tags, POLICY_TAG_TRUSTED);
+            break;
+        case INTERFACE_TYPE_LOOPBACK:
+            tags = POLICY_TAGS_EMPTY;
+            break;
+        default:
+            break;
+
+    }
+
+SET_TAGS:
+    face_set_tags(face, tags);
+
+    nw_release(local);
+    nw_release(remote);
+    nw_release(path);
+
+    return face;
+}
+
+void
+on_connection_state_event(interface_t * interface, nw_interface_t iface,
+        nw_connection_t cnx, nw_connection_state_t state, nw_error_t error)
+{
+#if 0
+    DEBUG("Connection [new state = %s]:\n", connection_state_str[state]);
+    nw_path_t path = nw_connection_copy_current_path(cnx);
+    nw_path_enumerate_interfaces(path, (nw_path_enumerate_interfaces_block_t)^(nw_interface_t interface) {
+        const char * name = nw_interface_get_name(interface);
+        printf("NAME=%s\n", name);
+        return true;
+    });
+#endif
+
+    /* We should get enough information to create the face and set if up
+     * asap */
+
+    nw_endpoint_t remote = nw_connection_copy_endpoint(cnx);
+    errno = error ? nw_error_get_error_code(error) : 0;
+
+    switch(state) {
+        case nw_connection_state_waiting:
+            warn("connect to %s port %u (%s) failed, is waiting",
+                    nw_endpoint_get_hostname(remote),
+                    nw_endpoint_get_port(remote),
+                    BONJOUR_PROTOCOL_NAME);
+            break;
+
+        case nw_connection_state_preparing:
+            break;
+
+        case nw_connection_state_ready:
+            {
+#if 0
+            WITH_DEBUG({
+                dump_connection(cnx, 1);
+            });
+#endif
+            nf_data_t * data = (nf_data_t*)interface->data;
+            face_t * face = face_create_from_connection(cnx, data->rules);
+            event_raise(EVENT_TYPE_CREATE, face, interface);
+            break;
+            }
+        case nw_connection_state_failed:
+            /* Can we fail with bonjour, or are we always waiting ? */
+            warn("connect to %s port %u (%s) failed",
+                    nw_endpoint_get_hostname(remote),
+                    nw_endpoint_get_port(remote),
+                    BONJOUR_PROTOCOL_NAME);
+            break;
+
+        case nw_connection_state_cancelled:
+            // Release the primary reference on the connection
+            // that was taken at creation time
+            nw_release(cnx);
+            break;
+
+        default: /* nw_connection_state_invalid */
+            /* Should never be called */
+            break;
+
+    }
+
+    nw_release(remote);
+
+}
+
+void
+on_connection_path_event(interface_t * interface, nw_interface_t iface,
+        nw_connection_t cnx, nw_path_t path)
+{
+#if 0
+    DEBUG("Connection [path changed]:\n");
+    WITH_DEBUG({
+        //dump_connection(cnx, 1);
+    });
+#endif
+    /* redundant *//*
+    DEBUG(1, "Path:\n");
+    dump_path(path, 2);
+    */
+}
+
+/**
+ * Enumerate main path interfaces
+ *
+ * We need to create specific dummy connections for each newly discovered
+ * interface
+ *
+ * Currently we only use Bonjour/TCP for remote hICN discovery and connection
+ * path monitoring.
+ */
+void on_interface_event(interface_t * interface, nw_interface_t iface)
+{
+    /* We can create an hICN face on this interface that will be down until
+     * connected
+     * It is however possible to have two default gateways on the same
+     * interface, or more, or even zero. Somehow we need a strategy, timers, etc
+     * to properly do the job.
+     *
+     * We have to determine:
+     *  - how many faces to build
+     *  - the face type : hICN, tunnel (TCP/UDP)
+     *  - the underlying protocol : v4, v6
+     *
+     * This depends on the configuration, end host and network capabilities.
+     *
+     * We can rely on several types of discovery:
+     *  - DHCP
+     *  - Bonjour
+     *  - ...
+     *
+     * So far:
+     * - bonjour discovery attempt, we expect to discover one hICN interface
+     *   (how bonjour works with more than one is unclear), after a certain
+     *   time, if none is discovered, we cannot do any tunnel face.
+     */
+
+    nw_endpoint_t endpoint;
+
+    endpoint = nw_endpoint_create_bonjour_service(
+            BONJOUR_SERVICE_NAME,
+            BONJOUR_SERVICE_TYPE,
+            BONJOUR_SERVICE_DOMAIN);
+
+    if (!endpoint)
+        goto ERR;
+
+    /* nw_parameters_create_secure_{udp,tcp} */
+    nw_parameters_t parameters = nw_parameters_create_fn(
+                NW_PARAMETERS_DISABLE_PROTOCOL, /* no (d)tls */
+                NW_PARAMETERS_DEFAULT_CONFIGURATION /* default udp/tcp */);
+
+    if (!parameters)
+        goto ERR;
+
+    nw_parameters_require_interface(parameters, iface);
+    nw_parameters_set_reuse_local_address(parameters, true);
+
+    nw_connection_t connection = nw_connection_create(endpoint, parameters);
+    if (!connection)
+        goto ERR;
+
+    nw_release(endpoint);
+    nw_release(parameters);
+
+    /* Remember not to recreate connection */
+    // XXX TODO
+
+    /* Setup connection handlers */
+
+    nw_connection_set_state_changed_handler(connection, ^(nw_connection_state_t state, nw_error_t error) {
+        on_connection_state_event(interface, iface, connection, state, error);
+    });
+
+    nw_connection_set_path_changed_handler(connection, ^(nw_path_t path) {
+        on_connection_path_event(interface, iface, connection, path);
+    });
+
+    nw_connection_set_better_path_available_handler(connection, ^(bool value) {
+#if 0
+        DEBUG("Connection [better path = %s]\n", (value ? "true" : "false"));
+        WITH_DEBUG({
+            dump_connection(connection, 1);
+        });
+#endif
+    });
+
+    nw_connection_set_viability_changed_handler(connection, ^(bool value) {
+#if 0
+        DEBUG("Connection [viable = %s]\n", (value ? "true" : "false"));
+        WITH_DEBUG({
+            //dump_connection(connection, 1);
+        });
+#endif
+
+        /*
+         * This is the first time we have a connection with address and port
+         * and thus the full identification of an hICN face
+         */
+        nf_data_t * data = (nf_data_t*)interface->data;
+        face_t * face = face_create_from_connection(connection, data->rules);
+        //event_raise(value ? EVENT_TYPE_SET_UP : EVENT_TYPE_SET_DOWN, face, interface);
+        if(value) {
+            event_raise(EVENT_TYPE_CREATE, face, interface);
+        } else {
+            event_raise(EVENT_TYPE_DELETE, face, interface);
+        }
+
+    });
+
+    nw_connection_start(connection);
+
+    nw_connection_set_queue(connection, dispatch_get_main_queue());
+    nw_retain(connection); // Hold a reference until cancelled
+
+#if 0
+    DEBUG("Created Bonjour cnx on interface:\n");
+    WITH_DEBUG({
+        dump_interface(iface, 1);
+    });
+#endif
+
+ERR:
+    return;
+}
+
+void on_path_event(interface_t * interface, nw_path_t path)
+{
+    /* Simplification: we handle path event only once.
+     * Ideally, test whether we discover new interfaces or not
+     */
+#if 0
+    DEBUG("Path [event]:\n");
+    WITH_DEBUG({
+        dump_path(path, 1);
+    });
+#endif
+
+    nw_path_enumerate_interfaces(path, (nw_path_enumerate_interfaces_block_t)^(nw_interface_t iface) {
+            on_interface_event(interface, iface);
+            return true;
+    });
+
+}
+
+int nf_initialize(interface_t * interface, face_rules_t * rules, void ** pdata)
+{
+    nf_data_t * data = malloc(sizeof(nf_data_t));
+    if (!data)
+        goto ERR_MALLOC;
+
+    data->rules = rules;
+
+    data->pm = nw_path_monitor_create();
+    if (!data->pm)
+        goto ERR_PM;
+
+    nw_path_monitor_set_queue(data->pm, dispatch_get_main_queue());
+    nw_path_monitor_set_cancel_handler(data->pm, ^() { });
+    nw_path_monitor_set_update_handler(data->pm, ^(nw_path_t path) {
+            on_path_event(interface, path);
+            });
+
+    // XXX NEEDED ?
+    nw_retain(data->pm);
+
+    DEBUG("Starting network path monitor");
+    nw_path_monitor_start(data->pm);
+
+    *pdata = data;
+    return FACEMGR_SUCCESS;
+
+ERR_PM:
+    free(data);
+ERR_MALLOC:
+    *pdata = NULL;
+    return FACEMGR_FAILURE;
+}
+
+int nf_finalize(interface_t * interface)
+{
+    nf_data_t * data = (nf_data_t*)interface->data;
+    if (data->pm) {
+        nw_path_monitor_cancel(data->pm);
+        data->pm = NULL;
+    }
+    return FACEMGR_SUCCESS;
+}
+
+const interface_ops_t network_framework_ops = {
+    .type = "network_framework",
+    .is_singleton = true,
+    .initialize = nf_initialize,
+    .finalize = nf_finalize,
+    .on_event = NULL,
+};
diff --git a/ctrl/facemgr/src/main.c b/ctrl/facemgr/src/main.c
new file mode 100644
index 000000000..6a80d806b
--- /dev/null
+++ b/ctrl/facemgr/src/main.c
@@ -0,0 +1,349 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file main.c
+ * \brief Face manager daemon entry point
+ */
+
+#include <getopt.h>
+#include <limits.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h> // faccess
+
+#include <libconfig.h>
+
+#include "util/log.h"
+#include "util/policy.h"
+
+#ifdef __APPLE__
+#include <Dispatch/Dispatch.h>
+#else
+// Note: we might want to use libevent on Apple too
+#include <event2/event.h>
+#endif
+
+#include "facemgr.h"
+
+#define FACEMGR_TIMEOUT 3
+
+
+static struct option long_options[] =
+{
+    {"config",  required_argument, 0, 'c'},
+    {0, 0, 0, 0}
+};
+
+typedef struct {
+    char * cfgfile;
+} facemgr_options_t;
+
+static const char * DEFAULT_CFGFILES[] = {
+    "/etc/facemgr.conf",
+    "~/facemgr.conf",
+};
+
+#define ARRAYSIZE(x) (sizeof(x)/sizeof(*x))
+
+void usage(const char * progname)
+{
+    printf("%s: Face manager daemon\n", progname);
+    printf("\n");
+    printf("Usage: %s [OPTIONS]\n", progname);
+    printf("\n");
+    printf("OPTIONS:\n");
+    printf("  -c  --config [FILE|none]    Sets the configuration file (unless none, default: /etc/facemgr.conf, ~/facemgr.conf)\n");
+    printf("\n");
+}
+
+int probe_cfgfile(char * f)
+{
+    for (unsigned i = 0; i < ARRAYSIZE(DEFAULT_CFGFILES); i++) {
+        if (access(DEFAULT_CFGFILES[i], F_OK ) != -1) {
+            if (!realpath(DEFAULT_CFGFILES[i], f))
+                continue;
+            return 0;
+        }
+    }
+    return -1;
+}
+
+int parse_cmdline(int argc, char ** argv, facemgr_options_t * opts)
+{
+    int c;
+    while ((c = getopt_long(argc, argv, "c:", long_options, NULL)) != -1) {
+        switch(c) {
+            case 'c':
+                opts->cfgfile = strdup(optarg);
+                break;
+            case ':':
+            case '?':
+            default:
+                usage(argv[0]);
+                exit(EXIT_FAILURE);
+        }
+
+    }
+    return 0;
+}
+
+int parse_config_file(const char * cfgpath, facemgr_t * facemgr)
+{
+    /* Reading configuration file */
+    config_t cfg;
+    config_setting_t *setting;
+
+    config_init(&cfg);
+
+    /* Read the file. If there is an error, report it and exit. */
+    if(!config_read_file(&cfg, cfgpath))
+        goto ERR_FILE;
+
+    setting = config_lookup(&cfg, "log");
+    if (setting) {
+        const char *log_level_str;
+        if (config_setting_lookup_string(setting, "log_level", &log_level_str)) {
+            if (strcmp(log_level_str, "FATAL") == 0) {
+                log_conf.log_level = LOG_FATAL;
+            } else
+            if (strcmp(log_level_str, "ERROR") == 0) {
+                log_conf.log_level = LOG_ERROR;
+            } else
+            if (strcmp(log_level_str, "WARN") == 0) {
+                log_conf.log_level = LOG_WARN;
+            } else
+            if (strcmp(log_level_str, "INFO") == 0) {
+                log_conf.log_level = LOG_INFO;
+            } else
+            if (strcmp(log_level_str, "DEBUG") == 0) {
+                log_conf.log_level = LOG_DEBUG;
+            } else
+            if (strcmp(log_level_str, "TRACE") == 0) {
+                log_conf.log_level = LOG_TRACE;
+            } else {
+                printf("Ignored unknown log level\n");
+            }
+        }
+    }
+
+    setting = config_lookup(&cfg, "faces.overlay.ipv4");
+    if (setting) {
+        const char * ip_address;
+        int local_port, remote_port;
+        if (config_setting_lookup_int(setting, "local_port", &local_port)) {
+            if ((local_port < 0) || (local_port > MAX_PORT))
+                goto ERR;
+            facemgr->overlay_v4_local_port = (uint16_t)local_port;
+        }
+
+        if (config_setting_lookup_int(setting, "remote_port", &remote_port)) {
+            if ((remote_port < 0) || (remote_port > MAX_PORT))
+                goto ERR;
+            facemgr->overlay_v4_remote_port = (uint16_t)remote_port;
+        }
+
+        if (config_setting_lookup_string(setting, "remote_addr", &ip_address)) {
+            ip_address_pton(ip_address, &facemgr->overlay_v4_remote_addr);
+            printf("got v4 remote addr\n");
+        }
+    }
+
+    setting = config_lookup(&cfg, "faces.overlay.ipv6");
+    if (setting) {
+        const char * ip_address;
+        int local_port, remote_port;
+        if (config_setting_lookup_int(setting, "local_port", &local_port)) {
+            if ((local_port < 0) || (local_port > MAX_PORT))
+                goto ERR;
+            facemgr->overlay_v6_local_port = (uint16_t)local_port;
+        }
+
+        if (config_setting_lookup_int(setting, "remote_port", &remote_port)) {
+            if ((remote_port < 0) || (remote_port > MAX_PORT))
+                goto ERR;
+            facemgr->overlay_v6_remote_port = (uint16_t)remote_port;
+        }
+
+        if (config_setting_lookup_string(setting, "remote_addr", &ip_address))
+            ip_address_pton(ip_address, &facemgr->overlay_v6_remote_addr);
+    }
+
+    setting = config_lookup(&cfg, "faces.rules");
+    if (setting) {
+        int count = config_setting_length(setting);
+        for(unsigned i = 0; i < count; ++i) {
+            const char *interface_name;
+            policy_tags_t tags = POLICY_TAGS_EMPTY;
+
+            config_setting_t *rule = config_setting_get_elem(setting, i);
+
+            /* Interface name */
+            if(!(config_setting_lookup_string(rule, "name", &interface_name)))
+                continue;
+
+            /* Associated tags */
+            config_setting_t *tag_settings = config_setting_get_member(rule, "tags");
+            if (!tag_settings)
+                goto ERR;
+
+
+            for (unsigned j = 0; j < config_setting_length(tag_settings); j++) {
+                const char * tag_str = config_setting_get_string_elem(tag_settings, j);
+                policy_tag_t tag = policy_tag_from_str(tag_str);
+                if (tag == POLICY_TAG_N)
+                    goto ERR;
+                policy_tags_add(&tags, tag);
+            }
+
+            /* debug */
+            char tags_str[MAXSZ_POLICY_TAGS];
+            policy_tags_snprintf(tags_str, MAXSZ_POLICY_TAGS, tags);
+            printf("Rule #%d interface_name=%s, tags=%s\n", i, interface_name, tags_str);
+            face_rules_add(&facemgr->rules, strdup(interface_name), tags);
+        }
+    }
+
+    config_destroy(&cfg);
+    return 0;
+
+ERR_FILE:
+    printf("Could not read configuration file %s\n", cfgpath);
+    fprintf(stderr, "%s:%d - %s\n", config_error_file(&cfg),
+            config_error_line(&cfg), config_error_text(&cfg));
+    config_destroy(&cfg);
+    exit(EXIT_FAILURE);
+    return -1;
+ERR:
+    fprintf(stderr, "%s:%d - %s\n", config_error_file(&cfg),
+            config_error_line(&cfg), config_error_text(&cfg));
+    config_destroy(&cfg);
+    return -1;
+}
+
+#ifndef APPLE
+void dummy_handler(int fd, short event, void *arg) { }
+#endif /* APPLE */
+
+
+int main(int argc, char **argv)
+{
+    facemgr_t * facemgr = facemgr_create();
+    if (!facemgr)
+        goto ERR_FACEMGR;
+
+    char cfgfile[PATH_MAX];
+
+    // TODO: default < config < commandline on a per option basis
+
+    /* Commandline */
+    facemgr_options_t cmdline_opts = {0};
+    if (parse_cmdline(argc, argv, &cmdline_opts) < 0) {
+        ERROR("Error parsing commandline\n");
+        goto ERR_CMDLINE;
+    }
+
+    /* Configuration file */
+    //facemgr_options_t cfgfile_opts;
+
+    if (cmdline_opts.cfgfile) {
+        if (strcmp(cmdline_opts.cfgfile, "none") == 0)
+            goto NO_CFGFILE;
+
+        if (!realpath(cmdline_opts.cfgfile, (char*)&cfgfile))
+            goto ERR_PATH;
+
+        goto PARSE_CFGFILE;
+    }
+
+    /* No commandline path specifed, probe default locations... */
+
+    if (probe_cfgfile(cfgfile) < 0)
+        goto NO_CFGFILE;
+
+    printf("Using configuration file %s\n", cfgfile);
+
+PARSE_CFGFILE:
+
+    if (parse_config_file(cfgfile, facemgr) < 0) {
+        ERROR("Error parsing configuration file %s\n", cfgfile);
+        goto ERR_PARSE;
+    }
+
+NO_CFGFILE:
+
+#ifdef __linux__
+    facemgr->loop = event_base_new();
+    if (!facemgr->loop)
+        fatal("Could not create an event base");
+
+    /* Main loop
+     *
+     * To avoid the loop to exit when empty, we might either rely on an option
+     * introduced from versions 2.1.x:
+     *   event_base_loop(loop->base, EVLOOP_NO_EXIT_ON_EMPTY);
+     * or use this workaround:
+     *   http://archives.seul.org/libevent/users/Sep-2012/msg00056.html
+     *
+     * TODO:
+     *  - HUP should interrupt the main loop
+     */
+    {
+        struct event *ev;
+        struct timeval tv;
+        tv.tv_sec = FACEMGR_TIMEOUT;
+        tv.tv_usec = 0;
+
+        ev = event_new(facemgr->loop, fileno(stdin), EV_TIMEOUT | EV_PERSIST, dummy_handler, NULL);
+        event_add(ev, &tv);
+    }
+#endif /* __linux__ */
+
+    DEBUG("Bootstrap...\n");
+    if (facemgr_bootstrap(facemgr) < 0 )
+        goto ERR_BOOTSTRAP;
+
+#ifdef __linux__
+    event_set_log_callback(NULL);
+    event_base_dispatch(facemgr->loop);
+
+    event_base_free(facemgr->loop);
+#endif /* __linux__ */
+
+#ifdef __APPLE__
+    /* Main loop */
+    facemgr->loop = NULL;
+    dispatch_main();
+#endif /* __APPLE__ */
+
+    /* Clean up */
+    //interface_delete_all();
+
+
+    facemgr_free(facemgr);
+
+    return EXIT_SUCCESS;
+
+ERR_BOOTSTRAP:
+ERR_PARSE:
+ERR_PATH:
+ERR_CMDLINE:
+    facemgr_free(facemgr);
+ERR_FACEMGR:
+    return EXIT_FAILURE;
+
+}
+
diff --git a/ctrl/facemgr/src/netdevice.c b/ctrl/facemgr/src/netdevice.c
new file mode 100644
index 000000000..817b0e47b
--- /dev/null
+++ b/ctrl/facemgr/src/netdevice.c
@@ -0,0 +1,28 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file netdevice.c
+ * \brief Implementation of Netdevice abstraction
+ */
+
+#include "common.h"
+#include "netdevice.h"
+
+const char * netdevice_type_str[] = {
+#define _(x) [NETDEVICE_TYPE_ ## x] = STRINGIZE(x),
+foreach_netdevice_type
+#undef _
+}
diff --git a/ctrl/facemgr/src/netdevice.h b/ctrl/facemgr/src/netdevice.h
new file mode 100644
index 000000000..b64ad0f9a
--- /dev/null
+++ b/ctrl/facemgr/src/netdevice.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file netdevice.h
+ * \brief Netdevice abstraction
+ */
+#ifndef FACEMGR_NETDEVICE_H
+#define FACEMGR_NETDEVICE_H
+
+#include <net/if.h> // IFNAMSIZ
+
+#include "common.h"
+
+#define foreach_netdevice_type  \
+    _(UNDEFINED)                \
+    _(WIRED)                    \
+    _(WIFI)                     \
+    _(CELLULAR)                 \
+    _(VPN)                      \
+    _(N)
+
+#define MAXSZ_NETDEVICE_TYPE 9
+#define MAXSZ_NETDEVICE_TYPE_ MAXSZ_NETDEVICE_TYPE
+
+typedef enum {
+#define _(x) x,
+foreach_netdevice_type
+#undef _
+} netdevice_type_t;
+
+extern const char * netdevice_type_str[];
+
+
+typedef struct {
+    u32 index;
+    char name[IFNAMSIZ];
+} netdevice_t;
+
+#endif /* FACEMGR_NETDEVICE_H */
diff --git a/ctrl/facemgr/src/util/hash.h b/ctrl/facemgr/src/util/hash.h
new file mode 100644
index 000000000..04b08eb54
--- /dev/null
+++ b/ctrl/facemgr/src/util/hash.h
@@ -0,0 +1,233 @@
+/*
+ * \file hash.h
+ * \brief Simple non-cryptographic hash implementation.
+ *
+ * Two helpers are provided :
+ *    hash(buf, len)  : hash a buffer <buf> of length <len>
+ *    hash_struct(buf) : hash a buffer corresponding to an allocated struct
+ *
+ * This file consists in excerpts from Jenkins hash (public domain).
+ * http://www.burtleburtle.net/bob/c/lookup3.c
+ */
+#ifndef UTIL_HASH_H
+#define UTIL_HASH_H
+
+#include "../common.h"
+
+#if (defined(__BYTE_ORDER) && defined(__LITTLE_ENDIAN) && \
+     __BYTE_ORDER == __LITTLE_ENDIAN) || \
+    (defined(i386) || defined(__i386__) || defined(__i486__) || \
+     defined(__i586__) || defined(__i686__) || defined(vax) || defined(MIPSEL))
+# define HASH_LITTLE_ENDIAN 1
+# define HASH_BIG_ENDIAN 0
+#elif (defined(__BYTE_ORDER) && defined(__BIG_ENDIAN) && \
+       __BYTE_ORDER == __BIG_ENDIAN) || \
+      (defined(sparc) || defined(POWERPC) || defined(mc68000) || defined(sel))
+# define HASH_LITTLE_ENDIAN 0
+# define HASH_BIG_ENDIAN 1
+#else
+# define HASH_LITTLE_ENDIAN 0
+# define HASH_BIG_ENDIAN 0
+#endif
+
+#define hashsize(n) ((uint32_t)1<<(n))
+#define hashmask(n) (hashsize(n)-1)
+#define rot(x,k) (((x)<<(k)) | ((x)>>(32-(k))))
+
+#define mix(a,b,c) \
+{ \
+  a -= c;  a ^= rot(c, 4);  c += b; \
+  b -= a;  b ^= rot(a, 6);  a += c; \
+  c -= b;  c ^= rot(b, 8);  b += a; \
+  a -= c;  a ^= rot(c,16);  c += b; \
+  b -= a;  b ^= rot(a,19);  a += c; \
+  c -= b;  c ^= rot(b, 4);  b += a; \
+}
+
+#define final(a,b,c) \
+{ \
+  c ^= b; c -= rot(b,14); \
+  a ^= c; a -= rot(c,11); \
+  b ^= a; b -= rot(a,25); \
+  c ^= b; c -= rot(b,16); \
+  a ^= c; a -= rot(c,4);  \
+  b ^= a; b -= rot(a,14); \
+  c ^= b; c -= rot(b,24); \
+}
+
+static inline
+uint32_t hashlittle( const void *key, size_t length, uint32_t initval)
+{
+  uint32_t a,b,c;                                          /* internal state */
+  union { const void *ptr; size_t i; } u;     /* needed for Mac Powerbook G4 */
+
+  /* Set up the internal state */
+  a = b = c = 0xdeadbeef + ((uint32_t)length) + initval;
+
+  u.ptr = key;
+  if (HASH_LITTLE_ENDIAN && ((u.i & 0x3) == 0)) {
+    const uint32_t *k = (const uint32_t *)key;         /* read 32-bit chunks */
+
+    /*------ all but last block: aligned reads and affect 32 bits of (a,b,c) */
+    while (length > 12)
+    {
+      a += k[0];
+      b += k[1];
+      c += k[2];
+      mix(a,b,c);
+      length -= 12;
+      k += 3;
+    }
+
+    /*----------------------------- handle the last (probably partial) block */
+    /*
+     * "k[2]&0xffffff" actually reads beyond the end of the string, but
+     * then masks off the part it's not allowed to read.  Because the
+     * string is aligned, the masked-off tail is in the same word as the
+     * rest of the string.  Every machine with memory protection I've seen
+     * does it on word boundaries, so is OK with this.  But VALGRIND will
+     * still catch it and complain.  The masking trick does make the hash
+     * noticably faster for short strings (like English words).
+     */
+#ifndef VALGRIND
+
+    switch(length)
+    {
+    case 12: c+=k[2]; b+=k[1]; a+=k[0]; break;
+    case 11: c+=k[2]&0xffffff; b+=k[1]; a+=k[0]; break;
+    case 10: c+=k[2]&0xffff; b+=k[1]; a+=k[0]; break;
+    case 9 : c+=k[2]&0xff; b+=k[1]; a+=k[0]; break;
+    case 8 : b+=k[1]; a+=k[0]; break;
+    case 7 : b+=k[1]&0xffffff; a+=k[0]; break;
+    case 6 : b+=k[1]&0xffff; a+=k[0]; break;
+    case 5 : b+=k[1]&0xff; a+=k[0]; break;
+    case 4 : a+=k[0]; break;
+    case 3 : a+=k[0]&0xffffff; break;
+    case 2 : a+=k[0]&0xffff; break;
+    case 1 : a+=k[0]&0xff; break;
+    case 0 : return c;              /* zero length strings require no mixing */
+    }
+
+#else /* make valgrind happy */
+
+    k8 = (const uint8_t *)k;
+    switch(length)
+    {
+    case 12: c+=k[2]; b+=k[1]; a+=k[0]; break;
+    case 11: c+=((uint32_t)k8[10])<<16;  /* fall through */
+    case 10: c+=((uint32_t)k8[9])<<8;    /* fall through */
+    case 9 : c+=k8[8];                   /* fall through */
+    case 8 : b+=k[1]; a+=k[0]; break;
+    case 7 : b+=((uint32_t)k8[6])<<16;   /* fall through */
+    case 6 : b+=((uint32_t)k8[5])<<8;    /* fall through */
+    case 5 : b+=k8[4];                   /* fall through */
+    case 4 : a+=k[0]; break;
+    case 3 : a+=((uint32_t)k8[2])<<16;   /* fall through */
+    case 2 : a+=((uint32_t)k8[1])<<8;    /* fall through */
+    case 1 : a+=k8[0]; break;
+    case 0 : return c;
+    }
+
+#endif /* !valgrind */
+
+  } else if (HASH_LITTLE_ENDIAN && ((u.i & 0x1) == 0)) {
+    const uint16_t *k = (const uint16_t *)key;         /* read 16-bit chunks */
+    const uint8_t  *k8;
+
+    /*--------------- all but last block: aligned reads and different mixing */
+    while (length > 12)
+    {
+      a += k[0] + (((uint32_t)k[1])<<16);
+      b += k[2] + (((uint32_t)k[3])<<16);
+      c += k[4] + (((uint32_t)k[5])<<16);
+      mix(a,b,c);
+      length -= 12;
+      k += 6;
+    }
+
+    /*----------------------------- handle the last (probably partial) block */
+    k8 = (const uint8_t *)k;
+    switch(length)
+    {
+    case 12: c+=k[4]+(((uint32_t)k[5])<<16);
+             b+=k[2]+(((uint32_t)k[3])<<16);
+             a+=k[0]+(((uint32_t)k[1])<<16);
+             break;
+    case 11: c+=((uint32_t)k8[10])<<16;     /* fall through */
+    case 10: c+=k[4];
+             b+=k[2]+(((uint32_t)k[3])<<16);
+             a+=k[0]+(((uint32_t)k[1])<<16);
+             break;
+    case 9 : c+=k8[8];                      /* fall through */
+    case 8 : b+=k[2]+(((uint32_t)k[3])<<16);
+             a+=k[0]+(((uint32_t)k[1])<<16);
+             break;
+    case 7 : b+=((uint32_t)k8[6])<<16;      /* fall through */
+    case 6 : b+=k[2];
+             a+=k[0]+(((uint32_t)k[1])<<16);
+             break;
+    case 5 : b+=k8[4];                      /* fall through */
+    case 4 : a+=k[0]+(((uint32_t)k[1])<<16);
+             break;
+    case 3 : a+=((uint32_t)k8[2])<<16;      /* fall through */
+    case 2 : a+=k[0];
+             break;
+    case 1 : a+=k8[0];
+             break;
+    case 0 : return c;                     /* zero length requires no mixing */
+    }
+
+  } else {                        /* need to read the key one byte at a time */
+    const uint8_t *k = (const uint8_t *)key;
+
+    /*--------------- all but the last block: affect some 32 bits of (a,b,c) */
+    while (length > 12)
+    {
+      a += k[0];
+      a += ((uint32_t)k[1])<<8;
+      a += ((uint32_t)k[2])<<16;
+      a += ((uint32_t)k[3])<<24;
+      b += k[4];
+      b += ((uint32_t)k[5])<<8;
+      b += ((uint32_t)k[6])<<16;
+      b += ((uint32_t)k[7])<<24;
+      c += k[8];
+      c += ((uint32_t)k[9])<<8;
+      c += ((uint32_t)k[10])<<16;
+      c += ((uint32_t)k[11])<<24;
+      mix(a,b,c);
+      length -= 12;
+      k += 12;
+    }
+
+    /*-------------------------------- last block: affect all 32 bits of (c) */
+    switch(length)                   /* all the case statements fall through */
+    {
+    case 12: c+=((uint32_t)k[11])<<24;
+    case 11: c+=((uint32_t)k[10])<<16;
+    case 10: c+=((uint32_t)k[9])<<8;
+    case 9 : c+=k[8];
+    case 8 : b+=((uint32_t)k[7])<<24;
+    case 7 : b+=((uint32_t)k[6])<<16;
+    case 6 : b+=((uint32_t)k[5])<<8;
+    case 5 : b+=k[4];
+    case 4 : a+=((uint32_t)k[3])<<24;
+    case 3 : a+=((uint32_t)k[2])<<16;
+    case 2 : a+=((uint32_t)k[1])<<8;
+    case 1 : a+=k[0];
+             break;
+    case 0 : return c;
+    }
+  }
+
+  final(a,b,c);
+  return c;
+}
+
+/* Helpers */
+
+#define HASH_INITVAL 1
+#define hash(buf, len)  (hash_t)hashlittle(buf, len, HASH_INITVAL)
+#define hash_struct(buf) hash(buf, sizeof(buf))
+
+#endif /* UTIL_JENKINS_HASH_H */
diff --git a/ctrl/facemgr/src/util/ip_address.h b/ctrl/facemgr/src/util/ip_address.h
new file mode 100644
index 000000000..165394709
--- /dev/null
+++ b/ctrl/facemgr/src/util/ip_address.h
@@ -0,0 +1,321 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file ip_address.h
+ * \brief IP address type support
+ */
+#ifndef UTIL_IP_ADDRESS_H
+#define UTIL_IP_ADDRESS_H
+
+#include <arpa/inet.h>  // inet_ntop
+#ifdef __APPLE__
+#include <libkern/OSByteOrder.h>
+#define __bswap_constant_32(x) OSSwapInt32(x)
+#include <machine/endian.h>
+#else
+#include <endian.h>
+#endif
+#include <errno.h>
+#include <netdb.h> // struct addrinfo
+#include <netinet/in.h> // INET*_ADDRSTRLEN, IN*ADDR_LOOPBACK
+#include <stdlib.h>
+#include <stdio.h> // snprintf
+#include <string.h> // memset
+
+#include "types.h"
+
+#define bytes_to_bits(x) (x * 8)
+#define IPV6_ADDR_LEN 16	/* bytes */
+#define IPV4_ADDR_LEN 4		/* bytes */
+#define IPV6_ADDR_LEN_BITS bytes_to_bits(IPV6_ADDR_LEN)
+#define IPV4_ADDR_LEN_BITS bytes_to_bits(IPV4_ADDR_LEN)
+
+#define IP_MAX_ADDR_LEN IPV6_ADDR_LEN
+
+#define DUMMY_PORT 1234
+
+typedef union {
+    union {
+        struct in_addr as_inaddr;
+        u8 as_u8[4];
+        u16 as_u16[2];
+        u32 as_u32;
+    } v4;
+    union {
+        struct in6_addr as_in6addr;
+        u8 as_u8[16];
+        u16 as_u16[8];
+        u32 as_u32[4];
+        u64 as_u64[2];
+    } v6;
+    u8 buffer[IP_MAX_ADDR_LEN];
+    u8 as_u8[IP_MAX_ADDR_LEN];
+    u16 as_u16[IP_MAX_ADDR_LEN >> 1];
+    u32 as_u32[IP_MAX_ADDR_LEN >> 2];
+    u64 as_u64[IP_MAX_ADDR_LEN >> 3];
+} ip_address_t;
+
+#define MAXSZ_IP4_ADDRESS_ INET_ADDRSTRLEN - 1
+#define MAXSZ_IP6_ADDRESS_ INET6_ADDRSTRLEN - 1
+#define MAXSZ_IP_ADDRESS_ MAXSZ_IP6_ADDRESS_
+#define MAXSZ_IP4_ADDRESS MAXSZ_IP4_ADDRESS_ + 1
+#define MAXSZ_IP6_ADDRESS MAXSZ_IP6_ADDRESS_ + 1
+#define MAXSZ_IP_ADDRESS MAXSZ_IP_ADDRESS_ + 1
+
+typedef struct {
+  int family;
+  ip_address_t address;
+  u8 len;
+} ip_prefix_t;
+
+#define MAXSZ_PREFIX_ MAXSZ_IP_ADDRESS_ + 1 + 3
+#define MAXSZ_PREFIX MAXSZ_PREFIX_ + 1
+
+/* No htonl() with const */
+static const ip_address_t IPV4_LOOPBACK = {
+#if __BYTE_ORDER == __LITTLE_ENDIAN
+    .v4.as_inaddr.s_addr = __bswap_constant_32(INADDR_LOOPBACK),
+#else
+    .v4.as_inaddr.s_addr = INADDR_LOOPBACK,
+#endif
+};
+
+static const ip_address_t IPV6_LOOPBACK = {
+    .v6.as_in6addr = IN6ADDR_LOOPBACK_INIT,
+};
+
+static const ip_address_t IPV4_ANY = {
+    .v4.as_inaddr.s_addr = INADDR_ANY,
+};
+
+static const ip_address_t IPV6_ANY = {
+    .v6.as_in6addr = IN6ADDR_ANY_INIT,
+};
+
+#define IP_ANY(family) (family == AF_INET) ? IPV4_ANY : IPV6_ANY
+
+static const ip_address_t IP_ADDRESS_EMPTY = {
+    .as_u64 = { 0 },
+};
+
+
+#define MAX_PORT 1 << (8 * sizeof(u16))
+#define IS_VALID_PORT(x) ((x > 0) && (x < MAX_PORT))
+
+#define MAXSZ_PORT_ 5
+#define MAXSZ_PORT MAXSZ_PORT_ + 1
+
+#define IS_VALID_FAMILY(x) ((x == AF_INET) || (x == AF_INET6))
+
+static inline
+int
+ip_address_get_family (const char * ip_address)
+{
+  struct addrinfo hint, *res = NULL;
+  int rc;
+
+  memset (&hint, '\0', sizeof hint);
+
+  hint.ai_family = PF_UNSPEC;
+  hint.ai_flags = AI_NUMERICHOST;
+
+  rc = getaddrinfo (ip_address, NULL, &hint, &res);
+  if (rc)
+    {
+      return -1;
+    }
+  rc = res->ai_family;
+  freeaddrinfo (res);
+  return rc;
+}
+
+static inline
+int
+ip_address_len (const ip_address_t * ip_address, int family)
+{
+  return (family == AF_INET6) ? IPV6_ADDR_LEN :
+    (family == AF_INET) ? IPV4_ADDR_LEN : 0;
+}
+
+static inline
+int
+ip_address_ntop (const ip_address_t * ip_address, char *dst, const size_t len,
+		int family)
+{
+  const char * s = inet_ntop (family, ip_address->buffer, dst, len);
+  return (s ? 1 : -1);
+}
+
+/*
+ * Parse ip addresses in presentation format
+ */
+static inline
+int
+ip_address_pton (const char *ip_address_str, ip_address_t * ip_address)
+{
+  int pton_fd;
+  char *addr = strdup (ip_address_str);
+  int family;
+
+
+  family = ip_address_get_family (addr);
+
+  switch (family)
+    {
+    case AF_INET6:
+      pton_fd = inet_pton (AF_INET6, addr, &ip_address->buffer);
+      break;
+    case AF_INET:
+      pton_fd = inet_pton (AF_INET, addr, &ip_address->buffer);
+      break;
+    default:
+      goto ERR;
+    }
+
+  //   0 = not in presentation format
+  // < 0 = other error (use perror)
+  if (pton_fd <= 0)
+    {
+      goto ERR;
+    }
+
+  return 1;
+ERR:
+  free (addr);
+  return -1;
+}
+
+
+
+static inline
+int
+ip_address_snprintf(char * s, size_t size, const ip_address_t * ip_address, int family)
+{
+    size_t len = family == AF_INET ? INET_ADDRSTRLEN : INET6_ADDRSTRLEN;
+    const char * rc = inet_ntop (family, ip_address->buffer, s, len);
+    return rc ? strlen(rc) : -1;
+}
+
+
+static inline
+int
+ip_address_to_sockaddr(const ip_address_t * ip_address,
+		struct sockaddr *sockaddr_address, int family)
+{
+  struct sockaddr_in6 *tmp6 = (struct sockaddr_in6 *) sockaddr_address;
+  struct sockaddr_in *tmp4 = (struct sockaddr_in *) sockaddr_address;
+
+  switch (family)
+    {
+    case AF_INET6:
+      tmp6->sin6_family = AF_INET6;
+      tmp6->sin6_port = DUMMY_PORT;
+      tmp6->sin6_scope_id = 0;
+      memcpy (&tmp6->sin6_addr, ip_address->buffer, IPV6_ADDR_LEN);
+      break;
+    case AF_INET:
+      tmp4->sin_family = AF_INET;
+      tmp4->sin_port = DUMMY_PORT;
+      memcpy (&tmp4->sin_addr, ip_address->buffer, IPV4_ADDR_LEN);
+      break;
+    default:
+      return -1;
+    }
+
+  return 1;
+}
+
+static inline
+int
+ip_address_cmp(const ip_address_t * ip1, const ip_address_t * ip2, int family)
+{
+    return memcmp(ip1, ip2, ip_address_len(ip1, family));
+}
+
+static inline
+int
+ip_address_empty(const ip_address_t * ip)
+{
+    return (memcmp(ip, &IP_ADDRESS_EMPTY, sizeof(IP_ADDRESS_EMPTY)) == 0);
+}
+
+/* Parse IP Prefixes in presentation format (in bits, separated by a slash) */
+static inline
+int
+ip_prefix_pton (const char *ip_address_str, ip_prefix_t * ip_prefix)
+{
+  int pton_fd;
+  char *p;
+  char *eptr;
+  char *addr = strdup (ip_address_str);
+
+  p = strchr (addr, '/');
+  if (!p)
+    {
+      ip_prefix->len = 0;		// until we get the ip address family
+    }
+  else
+    {
+      ip_prefix->len = strtoul (p + 1, &eptr, 10);
+      *p = 0;
+    }
+
+  ip_prefix->family = ip_address_get_family (addr);
+
+  switch (ip_prefix->family)
+    {
+    case AF_INET6:
+      if (ip_prefix->len > IPV6_ADDR_LEN_BITS)
+	goto ERR;
+      pton_fd = inet_pton (AF_INET6, addr, &ip_prefix->address.buffer);
+      break;
+    case AF_INET:
+      if (ip_prefix->len > IPV4_ADDR_LEN_BITS)
+	goto ERR;
+      pton_fd = inet_pton (AF_INET, addr, &ip_prefix->address.buffer);
+      break;
+    default:
+      goto ERR;
+    }
+
+  //   0 = not in presentation format
+  // < 0 = other error (use perror)
+  if (pton_fd <= 0)
+    {
+      goto ERR;
+    }
+
+  return 1;
+ERR:
+  free (addr);
+  return -1;
+}
+
+static inline
+int
+ip_prefix_ntop (const ip_prefix_t * ip_prefix, char *dst, size_t size)
+{
+  char ip_s[MAXSZ_IP_ADDRESS];
+  const char * s = inet_ntop (ip_prefix->family, ip_prefix->address.buffer, ip_s, MAXSZ_IP_ADDRESS);
+  if (!s)
+      return -1;
+  size_t n = snprintf(dst, size, "%s/%d", ip_s, ip_prefix->len);
+
+  return (n > 0 ? 1 : -1);
+}
+
+
+#endif /* UTIL_IP_ADDRESS_H */
diff --git a/ctrl/facemgr/src/util/log.c b/ctrl/facemgr/src/util/log.c
new file mode 100644
index 000000000..54943cf45
--- /dev/null
+++ b/ctrl/facemgr/src/util/log.c
@@ -0,0 +1,126 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "log.h"
+
+#include <stdarg.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+log_conf_t log_conf = DEFAULT_LOG_CONF;
+
+#define FMT_DATETIME "%02d-%02d-%04d %02d:%02d:%02d"
+#define FMT_DATETIME_LEN 20
+#define snprintf_nowarn(...) (snprintf(__VA_ARGS__) < 0 ? abort() : (void)0)
+
+
+static char ts[FMT_DATETIME_LEN];
+
+static char *timestamp(void)
+{
+	time_t tv;
+	struct tm *tm;
+
+	time(&tv);
+	tm = localtime(&tv);
+
+        snprintf_nowarn(ts, FMT_DATETIME_LEN, FMT_DATETIME, tm->tm_mday,
+                tm->tm_mon + 1, tm->tm_year + 1900, tm->tm_hour, tm->tm_min,
+                tm->tm_sec);
+	return ts;
+}
+
+void _log_va(int level, const char *fmt, va_list ap)
+{
+	char *prefix;
+  FILE *f = log_conf.log_file ? log_conf.log_file : stdout;
+
+#if 0
+	if (!conf.log_system)
+		return;
+#endif
+
+	if (level > log_conf.log_level)
+		return;
+
+	switch (level) {
+		case LOG_FATAL:
+			prefix = "FATAL: ";
+			break;
+		case LOG_ERROR:
+			prefix = "ERROR: ";
+			break;
+		case LOG_WARN:
+			prefix = "WARNING: ";
+			break;
+		case LOG_INFO:
+			prefix = "";
+			break;
+		case LOG_DEBUG:
+			prefix = "DEBUG: ";
+			break;
+		case LOG_TRACE:
+			prefix = "TRACE: ";
+			break;
+		default:
+			prefix = "";
+			break;
+	}
+
+	fprintf(f, "%s %s", timestamp(), prefix);
+	vfprintf(f, fmt, ap);
+	fprintf(f, "\n");
+#ifdef DEBUG
+	fflush(f);
+#endif
+}
+
+void _log(int level, const char *fmt, ...)
+{
+	va_list ap;
+
+	va_start(ap, fmt);
+	_log_va(level, fmt, ap);
+	va_end(ap);
+}
+
+#ifdef HAVE_BACKTRACE
+#include <execinfo.h>
+
+void print_trace(void)
+{
+	void *array[32];
+	size_t size;
+
+	size = backtrace(array, 32);
+	fflush(conf.log_file);
+	backtrace_symbols_fd(array, size, fileno(conf.log_file));
+}
+#endif
+
+void fatal(char *fmt, ...)
+{
+	va_list ap;
+
+	va_start(ap, fmt);
+	_log_va(LOG_FATAL, fmt, ap);
+	va_end(ap);
+
+#ifdef HAVE_BACKTRACE
+	print_trace();
+#endif
+
+	exit(200);
+}
diff --git a/ctrl/facemgr/src/util/log.h b/ctrl/facemgr/src/util/log.h
new file mode 100644
index 000000000..f1cafba47
--- /dev/null
+++ b/ctrl/facemgr/src/util/log.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef UTIL_LOG_H
+#define UTIL_LOG_H
+
+#include <stdarg.h> // va_*
+#include <stdio.h> // FILE
+#include <time.h> // time, localtime
+
+#define LOG_FATAL 0
+#define LOG_ERROR 1
+#define LOG_WARN  2
+#define LOG_INFO  3
+#define LOG_DEBUG 4
+#define LOG_TRACE 5
+
+typedef struct {
+  int log_level;
+  int debug;
+  FILE * log_file;
+} log_conf_t;
+
+#define DEFAULT_LOG_CONF {      \
+    .log_level = LOG_DEBUG,     \
+    .debug = 0,                 \
+    .log_file = NULL,           \
+};
+
+extern log_conf_t log_conf;
+
+#define WITH_DEBUG(BLOCK)                       \
+    if (log_conf.log_level >= LOG_DEBUG)        \
+        BLOCK
+
+#define FATAL(fmt, ...) (_log(LOG_FATAL, fmt, ##__VA_ARGS__ ))
+#define ERROR(fmt, ...) (_log(LOG_ERROR, fmt, ##__VA_ARGS__ ))
+#define WARN(fmt,  ...) (_log(LOG_WARN,  fmt, ##__VA_ARGS__ ))
+#define INFO(fmt,  ...) (_log(LOG_INFO,  fmt, ##__VA_ARGS__ ))
+#define DEBUG(fmt, ...) (_log(LOG_DEBUG, fmt, ##__VA_ARGS__ ))
+#define TRACE(fmt, ...) (_log(LOG_TRACE, fmt, ##__VA_ARGS__ ))
+
+void _log_va(int level, const char *fmt, va_list ap);
+
+void _log(int level, const char *fmt, ...);
+
+void fatal(char *fmt, ...);
+
+#ifdef HAVE_BACKTRACE
+#include <execinfo.h>
+void print_trace(void);
+#endif
+
+#endif // UTIL_LOG_H
diff --git a/ctrl/facemgr/src/util/map.h b/ctrl/facemgr/src/util/map.h
new file mode 100644
index 000000000..2694de2a7
--- /dev/null
+++ b/ctrl/facemgr/src/util/map.h
@@ -0,0 +1,149 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef UTIL_MAP_H
+#define UTIL_MAP_H
+
+#include <stdlib.h>
+
+#include "../common.h"
+#include "set.h"
+
+#define ERR_MAP_EXISTS -2
+#define ERR_MAP_NOT_FOUND -3
+
+#define TYPEDEF_MAP_H(NAME, KEY_T, VAL_T)                                       \
+                                                                                \
+typedef struct {                                                                \
+    KEY_T key;                                                                  \
+    VAL_T value;                                                                \
+} NAME ## _pair_t;                                                              \
+                                                                                \
+int NAME ## _pair_cmp(const NAME ## _pair_t * p1, const NAME ## _pair_t * p2);  \
+                                                                                \
+TYPEDEF_SET_H(NAME ## _pair_set, NAME ## _pair_t *)                             \
+                                                                                \
+typedef struct NAME ## _s {                                                     \
+    NAME ## _pair_set_t pair_set;                                               \
+} NAME ## _t;                                                                   \
+                                                                                \
+int NAME ## _initialize(NAME ## _t * map);                                      \
+                                                                                \
+int NAME ## _finalize(NAME ## _t * map);                                        \
+                                                                                \
+NAME ## _t * NAME ## _create();                                                 \
+                                                                                \
+void NAME ## _free(NAME ## _t * map);                                           \
+                                                                                \
+int NAME ## _add(NAME ## _t * map, KEY_T key, const VAL_T value);               \
+                                                                                \
+int NAME ## _remove(NAME ## _t * map, KEY_T key, VAL_T * value);                \
+                                                                                \
+int NAME ## _get(NAME ## _t * map, KEY_T key, VAL_T * value);                   \
+                                                                                \
+void NAME ## _dump(NAME ## _t * map);
+
+
+
+
+#define TYPEDEF_MAP(NAME, KEY_T, VAL_T, CMP, KEY_SNPRINTF, VALUE_SNPRINTF)      \
+                                                                                \
+int                                                                             \
+NAME ## _pair_cmp(const NAME ## _pair_t * p1, const NAME ## _pair_t * p2)       \
+{                                                                               \
+    return (CMP(p1->key, p2->key));                                             \
+}                                                                               \
+                                                                                \
+int                                                                             \
+NAME ## _pair_snprintf(char * buf, size_t size, const NAME ## _pair_t * pair) { \
+    int rc;                                                                     \
+    rc = KEY_SNPRINTF(buf, BUFSIZE/2, (KEY_T)pair->key);                        \
+    if (rc < 0)                                                                 \
+        return rc;                                                              \
+    rc = VALUE_SNPRINTF(buf+rc, BUFSIZE/2, (VAL_T)pair->value);             \
+    return rc;                                                                  \
+}                                                                               \
+                                                                                \
+TYPEDEF_SET(NAME ## _pair_set, NAME ## _pair_t *, NAME ## _pair_cmp, NAME ## _pair_snprintf); \
+                                                                                \
+int                                                                             \
+NAME ## _initialize(NAME ## _t * map)                                           \
+{                                                                               \
+    return NAME ## _pair_set_initialize(&map->pair_set);                        \
+}                                                                               \
+                                                                                \
+int                                                                             \
+NAME ## _finalize(NAME ## _t * map)                                             \
+{                                                                               \
+    return NAME ## _pair_set_finalize(&map->pair_set);                          \
+}                                                                               \
+                                                                                \
+AUTOGENERATE_CREATE_FREE(NAME)                                                  \
+                                                                                \
+int                                                                             \
+NAME ## _add(NAME ## _t * map, KEY_T key, const VAL_T value)                    \
+{                                                                               \
+    int rc;                                                                     \
+                                                                                \
+    /* Create pair */                                                           \
+    NAME ## _pair_t * pair = malloc(sizeof(NAME ## _pair_t));                   \
+    if (!pair)                                                                  \
+        return FACEMGR_FAILURE;                                                 \
+                                                                                \
+    pair->key = key;                                                            \
+    pair->value = (VAL_T)value;                                                 \
+                                                                                \
+    rc = NAME ## _pair_set_get(&map->pair_set, pair, NULL);                     \
+    if (!FACEMGR_IS_ERROR(rc)) {                                                \
+        free(pair);                                                             \
+        return ERR_MAP_EXISTS;                                                  \
+    }                                                                           \
+                                                                                \
+    rc = NAME ## _pair_set_add(&map->pair_set, pair);                           \
+    if (FACEMGR_IS_ERROR(rc)) {                                                 \
+        free(pair);                                                             \
+        return FACEMGR_FAILURE;                                                 \
+    }                                                                           \
+    return FACEMGR_SUCCESS;                                                     \
+}                                                                               \
+                                                                                \
+int                                                                             \
+NAME ## _remove(NAME ## _t * map, KEY_T key, VAL_T * value)                     \
+{                                                                               \
+    NAME ## _pair_t * found, search = { .key = key };                           \
+    int rc = NAME ## _pair_set_remove(&map->pair_set, &search, &found);         \
+    if (FACEMGR_IS_ERROR(rc))                                                   \
+        return ERR_MAP_NOT_FOUND;                                               \
+    *value = found->value;                                                      \
+    return FACEMGR_SUCCESS;                                                     \
+}                                                                               \
+                                                                                \
+int                                                                             \
+NAME ## _get(NAME ## _t * map, KEY_T key, VAL_T * value)                        \
+{                                                                               \
+    NAME ## _pair_t * found, search = { .key = key };                           \
+    int rc = NAME ## _pair_set_get(&map->pair_set, &search, &found);            \
+    if (FACEMGR_IS_ERROR(rc))                                                   \
+        return ERR_MAP_NOT_FOUND;                                               \
+    *value = found->value;                                                      \
+    return FACEMGR_SUCCESS;                                                     \
+}                                                                               \
+                                                                                \
+void                                                                            \
+NAME ## _dump(NAME ## _t * map) {                                               \
+    NAME ## _pair_set_dump(&map->pair_set);                                     \
+}
+
+#endif /* UTIL_MAP_H */
diff --git a/ctrl/facemgr/src/util/policy.c b/ctrl/facemgr/src/util/policy.c
new file mode 100644
index 000000000..6c8651ee3
--- /dev/null
+++ b/ctrl/facemgr/src/util/policy.c
@@ -0,0 +1,59 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file policy.h
+ * \brief Implementation of policy description
+ */
+
+#include <stdio.h>
+#include "policy.h"
+
+const char * policy_tag_str[] = {
+    #define _(x, y) [POLICY_TAG_ ## x] = STRINGIZE(x),
+    foreach_policy_tag
+    #undef _
+};
+
+const char policy_tag_short_str[] = {
+    #define _(x, y) [POLICY_TAG_ ## x] = y,
+    foreach_policy_tag
+    #undef _
+};
+
+const char * policy_state_str[] = {
+    #define _(x) [POLICY_STATE_ ## x] = STRINGIZE(x),
+    foreach_policy_state
+    #undef _
+};
+
+int
+policy_tag_state_snprintf(char * s, size_t size, const policy_tag_state_t * tag_state)
+{
+    char *cur = s;
+    int rc;
+
+    if (tag_state->disabled > 1)
+        return -1;
+
+    rc = snprintf(cur, s + size - cur, "%s%s", (tag_state->disabled == 1) ? "!" : "", policy_state_str[tag_state->state]);
+    if (rc < 0)
+        return rc;
+    cur += rc;
+    if (size != 0 && cur >= s + size)
+        return cur - s;
+
+    return cur - s;
+}
diff --git a/ctrl/facemgr/src/util/policy.h b/ctrl/facemgr/src/util/policy.h
new file mode 100644
index 000000000..e20af6560
--- /dev/null
+++ b/ctrl/facemgr/src/util/policy.h
@@ -0,0 +1,234 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file policy.h
+ * \brief Policy description
+ */
+#ifndef HICN_POLICY_H
+#define HICN_POLICY_H
+
+#include <netinet/in.h> // INET*_ADDRSTRLEN
+#include <string.h> // strcasecmp
+#include "token.h"
+
+/* POLICY TAG */
+
+#define foreach_policy_tag      \
+    /* Interface type */        \
+    _(WIRED, 'E')               \
+    _(WIFI, 'W')                \
+    _(CELLULAR, 'C')            \
+    /* QoS */                   \
+    _(BEST_EFFORT, 'b')         \
+    _(REALTIME, 'r')            \
+    _(MULTIPATH, 'M')           \
+    /* Security */              \
+    _(TRUSTED, 'T')
+
+typedef enum {
+#define _(x, y) POLICY_TAG_ ## x,
+foreach_policy_tag
+#undef _
+    POLICY_TAG_N
+} policy_tag_t;
+
+#define MAXSZ_POLICY_TAG_ 11
+#define MAXSZ_POLICY_TAG MAXSZ_POLICY_TAG_ + 1
+
+extern const char * policy_tag_str[];
+extern const char policy_tag_short_str[];
+
+static inline
+policy_tag_t
+policy_tag_from_str(const char * str)
+{
+#define _(x, y) if (strcasecmp(str, policy_tag_str[POLICY_TAG_ ## x] ) == 0) { return POLICY_TAG_ ## x; } else
+foreach_policy_tag
+#undef _
+    return POLICY_TAG_N;
+}
+
+/* POLICY_TAGS */
+
+typedef int policy_tags_t;
+
+static inline
+void policy_tags_add(policy_tags_t * tags, policy_tag_t tag)
+{
+    *tags |= (1 << tag);
+}
+
+static inline
+void policy_tags_remove(policy_tags_t * tags, policy_tag_t tag)
+{
+    *tags &= ~(1 << tag);
+}
+
+static inline
+int policy_tags_has(policy_tags_t tags, policy_tag_t tag)
+{
+    return tags & (1 << tag);
+}
+
+#define POLICY_TAGS_EMPTY 0
+
+static inline
+int
+policy_tags_snprintf(char * s, size_t size, policy_tags_t tags)
+{
+#define _(x, y) s[POLICY_TAG_ ## x] = policy_tags_has(tags, POLICY_TAG_ ## x) ? y : '.';
+foreach_policy_tag
+#undef _
+    s[POLICY_TAG_N] = '\0';
+    return POLICY_TAG_N + 1;
+}
+
+#define MAXSZ_POLICY_TAGS_ POLICY_TAG_N
+#define MAXSZ_POLICY_TAGS MAXSZ_POLICY_TAGS_ + 1
+
+/* POLICY STATE */
+
+/* TODO vs. weight */
+
+#define foreach_policy_state    \
+    _(NEUTRAL)                  \
+    _(REQUIRE)                  \
+    _(PREFER)                   \
+    _(AVOID)                    \
+    _(PROHIBIT)                 \
+    _(N)
+
+typedef enum {
+#define _(x) POLICY_STATE_ ## x,
+foreach_policy_state
+#undef _
+} policy_state_t;
+
+#define MAXSZ_POLICY_STATE_ 8
+#define MAXSZ_POLICY_STATE MAXSZ_POLICY_STATE_ + 1
+
+extern const char * policy_state_str[];
+
+
+/* POLICY TAG STATE */
+
+typedef struct {
+    policy_state_t state;
+    uint8_t disabled;
+} policy_tag_state_t;
+
+#define MAXSZ_POLICY_TAG_STATE_ 8
+#define MAXSZ_POLICY_TAG_STATE MAXSZ_POLICY_TAG_STATE_ + 1
+
+int policy_tag_state_snprintf(char * s, size_t size, const policy_tag_state_t * tag_state);
+
+
+/* INTERFACE STATS */
+
+typedef struct {
+    float throughput;
+    float latency;
+    float loss_rate;
+} interface_stats_t;
+
+#define INTERFACE_STATS_NONE {                          \
+    .throughput = 0,                                    \
+    .latency = 0,                                       \
+    .loss_rate = 0,                                     \
+}
+
+
+/* POLICY STATS */
+
+typedef struct {
+    interface_stats_t wired;
+    interface_stats_t wifi;
+    interface_stats_t cellular;
+    interface_stats_t all;
+} policy_stats_t;
+
+#define POLICY_STATS_NONE {                     \
+    .wired    = INTERFACE_STATS_NONE,           \
+    .wifi     = INTERFACE_STATS_NONE,           \
+    .cellular = INTERFACE_STATS_NONE,           \
+    .all      = INTERFACE_STATS_NONE,           \
+}
+
+typedef struct {
+    uint32_t num_packets;
+    uint32_t num_bytes;
+    uint32_t num_losses;
+    uint32_t latency_idle;
+} interface_counters_t;
+
+#define INTERFACE_COUNTERS_NONE {               \
+    .num_packets = 0,                           \
+    .num_bytes = 0,                             \
+    .num_losses = 0,                            \
+    .latency_idle = 0,                          \
+}
+
+typedef struct {
+    interface_counters_t wired;
+    interface_counters_t wifi;
+    interface_counters_t cellular;
+    interface_counters_t all;
+    uint64_t last_update;
+} policy_counters_t;
+
+#define POLICY_COUNTERS_NONE (policy_counters_t) {      \
+    .wired    = INTERFACE_COUNTERS_NONE,                \
+    .wifi     = INTERFACE_COUNTERS_NONE,                \
+    .cellular = INTERFACE_COUNTERS_NONE,                \
+    .all      = INTERFACE_COUNTERS_NONE,                \
+    .last_update = 0,                                   \
+}
+
+/* POLICY */
+
+#define APP_NAME_LEN 128
+
+typedef struct {
+    char app_name[APP_NAME_LEN];
+    policy_tag_state_t tags[POLICY_TAG_N];
+    policy_stats_t stats;
+} policy_t;
+
+static const policy_t POLICY_NONE = {
+    .app_name = { 0 },
+    .tags = {
+#define _(x, y) [POLICY_TAG_ ## x] = { POLICY_STATE_NEUTRAL, 0 },
+foreach_policy_tag
+#undef _
+    },
+    .stats = POLICY_STATS_NONE,
+};
+
+
+/* POLICY DESCRIPTION */
+
+#define PFX_STRLEN 4 /* eg. /128 */
+
+typedef struct {
+    int family;
+    union {
+        char ipv4_prefix[INET_ADDRSTRLEN + PFX_STRLEN];
+        char ipv6_prefix[INET6_ADDRSTRLEN + PFX_STRLEN];
+    };
+    policy_t policy;
+} policy_description_t;
+
+#endif /* HICN_POLICY_H */
diff --git a/ctrl/facemgr/src/util/set.h b/ctrl/facemgr/src/util/set.h
new file mode 100644
index 000000000..47a6eeaff
--- /dev/null
+++ b/ctrl/facemgr/src/util/set.h
@@ -0,0 +1,127 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef UTIL_SET_H
+#define UTIL_SET_H
+
+#include <search.h>
+#include <string.h>
+#include "token.h"
+#include "../common.h"
+
+#define ERR_SET_EXISTS -2
+#define ERR_SET_NOT_FOUND -3
+
+#define BUFSIZE 80
+
+static inline
+int
+string_snprintf(char * buf, size_t size, const char * s) {
+    return snprintf(buf, size, "%s", s);
+}
+
+static inline
+int
+generic_snprintf(char * buf, size_t size, void * value) {
+    return snprintf(buf, BUFSIZE, "%p", value);
+}
+
+#define TYPEDEF_SET_H(NAME, T)                                          \
+                                                                        \
+typedef struct {                                                        \
+    size_t size;                                                        \
+    void * root;                                                        \
+} NAME ## _t;                                                           \
+                                                                        \
+int NAME ## _initialize(NAME ## _t * set);                              \
+                                                                        \
+int NAME ## _finalize(NAME ## _t * set);                                \
+                                                                        \
+NAME ## _t * NAME ## _create();                                         \
+                                                                        \
+void NAME ## _free(NAME ## _t * set);                                   \
+                                                                        \
+int NAME ## _add(NAME ## _t * set, const T element);                    \
+                                                                        \
+int NAME ## _remove(NAME ## _t * set, const T search, T * element);     \
+                                                                        \
+int NAME ## _get(NAME ## _t * set, const T search, T * element);        \
+                                                                        \
+void NAME ## _dump(NAME ## _t * set);
+
+
+
+
+#define TYPEDEF_SET(NAME, T, CMP, SNPRINTF)                             \
+int                                                                     \
+NAME ## _initialize(NAME ## _t * set)                                   \
+{                                                                       \
+    set->root = NULL;                                                   \
+    set->size = 0;                                                      \
+    return FACEMGR_SUCCESS;                                             \
+}                                                                       \
+                                                                        \
+NO_FINALIZE(NAME);                                                      \
+AUTOGENERATE_CREATE_FREE(NAME);                                         \
+                                                                        \
+int                                                                     \
+NAME ## _add(NAME ## _t * set, const T element)                         \
+{                                                                       \
+    return tsearch(element, &set->root, (cmp_t)CMP)              \
+        ? FACEMGR_SUCCESS : FACEMGR_FAILURE;                            \
+}                                                                       \
+                                                                        \
+int                                                                     \
+NAME ## _remove(NAME ## _t * set, const T search, T * element)          \
+{                                                                       \
+    T * found = tdelete(search, &set->root, (cmp_t)CMP);         \
+    if (found && element)                                               \
+        *element = *found;                                              \
+    return found ? FACEMGR_SUCCESS : ERR_SET_NOT_FOUND;                 \
+}                                                                       \
+                                                                        \
+int                                                                     \
+NAME ## _get(NAME ## _t * set, const T search, T * element)             \
+{                                                                       \
+    T * found = tfind(search, &set->root, (cmp_t)CMP);                  \
+    if (found && element)                                               \
+        *element = *found;                                              \
+    return found ? FACEMGR_SUCCESS : ERR_SET_NOT_FOUND;                 \
+}                                                                       \
+                                                                        \
+void                                                                    \
+__ ## NAME ## _dump_node(const void *nodep, const VISIT which, const int depth) \
+{                                                                       \
+    char buf[BUFSIZE];                                                  \
+    switch (which) {                                                    \
+    case preorder:                                                      \
+        break;                                                          \
+    case postorder:                                                     \
+        break;                                                          \
+    case endorder:                                                      \
+        break;                                                          \
+    case leaf:                                                          \
+        SNPRINTF(buf, BUFSIZE, *(T*)nodep);                             \
+        printf("%s\n", buf);                                            \
+        break;                                                          \
+    }                                                                   \
+}                                                                       \
+                                                                        \
+void                                                                    \
+NAME ## _dump(NAME ## _t * set) {                                       \
+    twalk(set->root, __ ## NAME ## _dump_node);                         \
+}                                                                       \
+
+#endif /* UTIL_SET_H */
diff --git a/ctrl/facemgr/src/util/token.h b/ctrl/facemgr/src/util/token.h
new file mode 100644
index 000000000..43e0a77b2
--- /dev/null
+++ b/ctrl/facemgr/src/util/token.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/* Token concatenation */
+
+/*
+ * Concatenate preprocessor tokens A and B without expanding macro definitions
+ * (however, if invoked from a macro, macro arguments are expanded).
+ */
+#define PPCAT_NX(A, B) A ## B
+
+/*
+ * Concatenate preprocessor tokens A and B after macro-expanding them.
+ */
+#define PPCAT(A, B) PPCAT_NX(A, B)
+
+/* Token stringification */
+
+/*
+ * Turn A into a string literal without expanding macro definitions
+ * (however, if invoked from a macro, macro arguments are expanded).
+ */
+#define STRINGIZE_NX(A) #A
+
+/*
+ * Turn A into a string literal after macro-expanding it.
+ */
+#define STRINGIZE(A) STRINGIZE_NX(A)
diff --git a/ctrl/facemgr/src/util/types.h b/ctrl/facemgr/src/util/types.h
new file mode 100644
index 000000000..10a0bdca0
--- /dev/null
+++ b/ctrl/facemgr/src/util/types.h
@@ -0,0 +1,36 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef UTIL_TYPES
+#define UTIL_TYPES
+
+typedef uint8_t u8;
+typedef uint16_t u16;
+typedef uint32_t u32;
+typedef uint64_t u64;
+
+/* Helper for avoiding warnings about type-punning */
+#define UNION_CAST(x, destType) \
+   (((union {__typeof__(x) a; destType b;})x).b)
+
+typedef unsigned int hash_t;
+
+typedef int (*cmp_t)(const void *, const void *);
+
+/* Enums */
+
+#define IS_VALID_ENUM_TYPE(NAME, x) ((x > NAME ## _UNDEFINED) && (x < NAME ## _N))
+
+#endif /* UTIL_TYPES */
diff --git a/ctrl/libhicnctrl/.gitignore b/ctrl/libhicnctrl/.gitignore
new file mode 100644
index 000000000..c6127b38c
--- /dev/null
+++ b/ctrl/libhicnctrl/.gitignore
@@ -0,0 +1,52 @@
+# Prerequisites
+*.d
+
+# Object files
+*.o
+*.ko
+*.obj
+*.elf
+
+# Linker output
+*.ilk
+*.map
+*.exp
+
+# Precompiled Headers
+*.gch
+*.pch
+
+# Libraries
+*.lib
+*.a
+*.la
+*.lo
+
+# Shared objects (inc. Windows DLLs)
+*.dll
+*.so
+*.so.*
+*.dylib
+
+# Executables
+*.exe
+*.out
+*.app
+*.i*86
+*.x86_64
+*.hex
+
+# Debug files
+*.dSYM/
+*.su
+*.idb
+*.pdb
+
+# Kernel Module Compile Results
+*.mod*
+*.cmd
+.tmp_versions/
+modules.order
+Module.symvers
+Mkfile.old
+dkms.conf
diff --git a/ctrl/libhicnctrl/CMakeLists.txt b/ctrl/libhicnctrl/CMakeLists.txt
new file mode 100644
index 000000000..3a2358f65
--- /dev/null
+++ b/ctrl/libhicnctrl/CMakeLists.txt
@@ -0,0 +1,53 @@
+# Copyright (c) 2017-2019 Cisco and/or its affiliates.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+cmake_minimum_required(VERSION 3.5 FATAL_ERROR)
+
+project(libhicnctrl)
+
+if (NOT CMAKE_BUILD_TYPE)
+    message(STATUS "No build type selected, default to Release")
+    set(CMAKE_BUILD_TYPE "Release")
+endif()
+
+set(CMAKE_MODULE_PATH
+  ${CMAKE_MODULE_PATH}
+  "${CMAKE_CURRENT_SOURCE_DIR}/../../cmake/Modules"
+  "${CMAKE_CURRENT_SOURCE_DIR}/cmake/Modules"
+)
+
+set(CMAKE_C_STANDARD 11)
+set(CMAKE_C_STANDARD_REQUIRED ON)
+
+set(CMAKE_MACOSX_RPATH ON)
+
+if(CMAKE_SOURCE_DIR STREQUAL PROJECT_SOURCE_DIR)
+  set(HICN_CTRL hicn-ctrl)
+  set(LIBHICN_CTRL hicn-ctrl)
+  set(LIBHICN_CTRL_SHARED ${LIBHICNCTRL}.shared)
+  set(LIBHICN_CTRL_STATIC ${LIBHICNCTRL}.static)
+endif()
+
+set(LIBHICNCTRL_COMPONENT lib${LIBHICN_CTRL})
+
+set(TO_INSTALL_HEADER_FILES)
+
+add_subdirectory(includes)
+add_subdirectory(src)
+
+include(Packaging)
+
+if(CMAKE_SOURCE_DIR STREQUAL PROJECT_SOURCE_DIR)
+    include(Packager)
+    make_packages()
+endif()
diff --git a/ctrl/libhicnctrl/cmake/Modules/Packaging.cmake b/ctrl/libhicnctrl/cmake/Modules/Packaging.cmake
new file mode 100644
index 000000000..cbee25d35
--- /dev/null
+++ b/ctrl/libhicnctrl/cmake/Modules/Packaging.cmake
@@ -0,0 +1,46 @@
+# Copyright (c) 2017-2019 Cisco and/or its affiliates.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+######################
+# Packages section
+######################
+
+set(${LIBHICNCTRL_COMPONENT}_DESCRIPTION
+  "hicn control library"
+  CACHE STRING "Description for deb/rpm package."
+)
+
+set(${LIBHICNCTRL_COMPONENT}-dev_DESCRIPTION
+  "hicn control library headers"
+  CACHE STRING "Description for deb/rpm package."
+)
+
+set(${LIBHICNCTRL_COMPONENT}_DEB_DEPENDENCIES
+  ""
+  CACHE STRING "Dependencies for deb/rpm package."
+)
+
+set(${LIBHICNCTRL_COMPONENT}-dev_DEB_DEPENDENCIES
+  "${LIBHICNCTRL_COMPONENT} (>= stable_version)"
+  CACHE STRING "Dependencies for deb/rpm package."
+)
+
+set(${LIBHICNCTRL_COMPONENT}_RPM_DEPENDENCIES
+  ""
+  CACHE STRING "Dependencies for deb/rpm package."
+)
+
+set(${LIBHICNCTRL_COMPONENT}-dev_RPM_DEPENDENCIES
+  "${LIBHICNCTRL_COMPONENT} >= stable_version"
+  CACHE STRING "Dependencies for deb/rpm package."
+)
\ No newline at end of file
diff --git a/ctrl/libhicnctrl/includes/CMakeLists.txt b/ctrl/libhicnctrl/includes/CMakeLists.txt
new file mode 100644
index 000000000..a85489a0c
--- /dev/null
+++ b/ctrl/libhicnctrl/includes/CMakeLists.txt
@@ -0,0 +1,26 @@
+# Copyright (c) 2017-2019 Cisco and/or its affiliates.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set(LIBHICNCTRL_INCLUDE_DIRS
+  ${CMAKE_CURRENT_SOURCE_DIR} ""
+  CACHE INTERNAL
+  "" FORCE
+)
+
+set(TO_INSTALL_HEADER_FILES
+  ${CMAKE_CURRENT_SOURCE_DIR}/ctrl.h
+  ${CMAKE_CURRENT_SOURCE_DIR}/hicn/ctrl/api.h
+  ${CMAKE_CURRENT_SOURCE_DIR}/hicn/ctrl/commands.h
+  ${CMAKE_CURRENT_SOURCE_DIR}/hicn/ctrl/face.h
+  PARENT_SCOPE
+)
\ No newline at end of file
diff --git a/ctrl/libhicnctrl/includes/ctrl.h b/ctrl/libhicnctrl/includes/ctrl.h
new file mode 120000
index 000000000..646630968
--- /dev/null
+++ b/ctrl/libhicnctrl/includes/ctrl.h
@@ -0,0 +1 @@
+hicn/ctrl.h
\ No newline at end of file
diff --git a/ctrl/libhicnctrl/includes/hicn/ctrl.h b/ctrl/libhicnctrl/includes/hicn/ctrl.h
new file mode 100644
index 000000000..e61b7a482
--- /dev/null
+++ b/ctrl/libhicnctrl/includes/hicn/ctrl.h
@@ -0,0 +1,25 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file ctrl.h
+ * \brief Main interface for hICN control library
+ */
+#ifndef HICNCTRL_H
+#define HICNCTRL_H
+
+#include <hicn/ctrl/api.h>
+
+#endif /* HICNCTRL_H */
diff --git a/ctrl/libhicnctrl/includes/hicn/ctrl/api.h b/ctrl/libhicnctrl/includes/hicn/ctrl/api.h
new file mode 100644
index 000000000..45efb39f9
--- /dev/null
+++ b/ctrl/libhicnctrl/includes/hicn/ctrl/api.h
@@ -0,0 +1,758 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file api.h
+ * \brief hICN control library API
+ *
+ * This API supports basic hICN objects (face, route, punting) plus
+ * implementation-specific ones (connection, listener). Currently, this library
+ * only supports the hicn-light forwarder.
+ *
+ * For each object, a set of methods is provided among:
+ *  - CREATE, GET, UPDATE, DELETE, LIST
+ *  - CMP, PARSE, SNPRINTF
+ *  - additionally, attribute getters and/or setters are provided and denoted
+ *    GET( attribute ) and SET( attribute )
+ *
+ * A summary per-object is presented here:
+ *
+ *              | CRE GET UPD DEL LST | VAL CMP PAR SNP | attributes [GET/SET]
+ * +------------+---------------------+-------------+---------------------------
+ * | face       |  O   O   !   O   O  |      !   !   O  | state [-S]
+ * | route      |  O   -   !   O   O  |      !   O   -  |
+ * | punting    |  !   -   !   !   !  |      !   !   !  |
+ * +------------+---------------------+-----------------+---------------------------
+ * | cache      |                     |                 | store [!!], serve [!!]
+ * | strategy   |                     |                 |
+ * | FIB        |                     |                 |
+ * | PIT        |                     |                 |
+ * | WLDR       |                     |                 |
+ * | MAP-Me     |                     |                 |
+ * +------------+---------------------+-----------------+---------------------------
+ * | connection |  O   O   !   O   O  |      O   O   O  | state [-S]
+ * | listener   |  O   O   !   -   O  |  O   O   O   O  |
+ * +------------+---------------------+-----------------+---------------------------
+ *
+ * LEGEND: [O] implemented, [!] in progress / TODO, [-] not supported
+ *
+ * NOTES:
+ *
+ *  - Different extensions of the forwarder functionalities bring both new API
+ *    calls, and new object attributes. While it is expected that the former will
+ *    only raised NACK answers because of unsupported API calls, the latter will
+ *    certainly trigger incompatibilities. It is expected that the forwarder
+ *    validates the message length and returns a NACK too. In that case, we
+ *    provide a set of defines to preserve backwards compatibility. At the
+ *    moment, those defines are :
+ *
+ *  WITH_POLICY:
+ *
+ */
+
+#ifndef HICNTRL_API
+#define HICNTRL_API
+
+#include <stdbool.h>
+#include <stdint.h>
+
+#include "face.h"
+#include "util/types.h"
+
+#define LIBHICNCTRL_SUCCESS 0
+#define LIBHICNCTRL_FAILURE -1
+#define LIBHICNCTRL_NOT_IMPLEMENTED -99
+#define LIBHICNCTRL_IS_ERROR(x) (x < 0)
+
+
+/**
+ * This allows to selectively define convenience types to avoid any collision
+ * when using the library in conjunction with other frameworks including similar
+ * defines
+ */
+#ifdef _HICNTRL_NO_DEFS
+#define _HICNTRL_NO_DEF_TYPES
+#define _HICNTRL_NO_DEF_IPADDR
+#define _HICNTRL_NO_DEF_UNIONCAST
+#endif
+
+#ifndef _HICNTRL_NO_DEF_TYPES
+typedef uint8_t u8;
+typedef uint16_t u16;
+typedef uint32_t u32;
+typedef uint64_t u64;
+#endif /* _HICNTRL_NO_DEF_TYPES */
+
+#ifndef _HICNTRL_NO_DEF_IPADDR
+#include "util/ip_address.h"
+#endif /* _HICNTRL_NO_DEF_IPADDR */
+
+#ifndef _HICNTRL_NO_DEF_UNIONCAST
+/* Helper for avoiding warnings about type-punning */
+#define UNION_CAST(x, destType) \
+   (((union {__typeof__(x) a; destType b;})x).b)
+#endif /* _HICNTRL_NO_DEF_UNIONCAST */
+
+/******************************************************************************
+ * Message helper types and aliases
+ ******************************************************************************/
+
+#define foreach_command \
+    _(UNDEFINED)        \
+    _(CREATE)           \
+    _(UPDATE)           \
+    _(DELETE)           \
+    _(LIST)             \
+    _(SET)		\
+    _(N)
+
+typedef enum {
+#define _(x) ACTION_ ## x,
+foreach_command
+#undef _
+} hc_action_t;
+
+/**
+ * \brief hICN control message header
+ */
+typedef struct hc_msg_s hc_msg_t;
+
+/******************************************************************************
+ * Control Data
+ ******************************************************************************/
+
+struct hc_data_s;
+typedef int (*data_callback_t)(struct hc_data_s *, void *);
+
+/**
+ * \brief Holds the results of an hICN control request
+ */
+typedef struct hc_data_s {
+    size_t size;
+    size_t max_size_log;
+    size_t in_element_size;
+    size_t out_element_size;
+    u8 command_id; /**< Expected message type (should give element size) */
+    u8 * buffer;
+    bool complete;
+
+    /* Callbacks */
+    data_callback_t complete_cb; // XXX int (*complete_cb)(struct hc_data_s * data);
+    void * complete_cb_data;
+} hc_data_t;
+
+/**
+ * Create a structure holding the results of an hICN control request.
+ * \result The newly create data structure.
+ */
+hc_data_t *
+hc_data_create(size_t in_element_size, size_t out_element_size);
+
+/**
+ * Free a structure holding the results of an hICN control request.
+ * \param [in] data - The data structure to free.
+ */
+void
+hc_data_free(hc_data_t * data);
+
+/**
+ * \brief Adds many new results at the end of the data structure, eventually
+ * allocating buffer space for it.
+ * \param [in] data - The data structure to which to add elements.
+ * \param [in] elements - The array of elements to add.
+ * \param [in] count - The number of elements to add.
+ * \return Error code
+ *
+ * NOTE: The size of the element should match the one declared at structure
+ * initialization.
+ */
+int
+hc_data_push_many(hc_data_t * data, const void * elements, size_t count);
+
+/**
+ * \brief Adds a new result at the end of the data structure, eventually
+ * allocating buffer space for it.
+ * \param [in] data - The data structure to which to add an element.
+ * \param [in] element - The element to add
+ * \return Error code
+ *
+ * NOTE: The size of the element should match the one declared at structure
+ * initialization.
+ */
+int
+hc_data_push(hc_data_t * data, const void * element);
+
+/**
+ * \brief Configure a callback (along with private data) to be called upon
+ * completion of a request
+ * \param [in] data - hICN control data
+ * \param [in] cb - Callback function
+ * \param [in] cb_data - Callback private data
+ */
+int
+hc_data_set_callback(hc_data_t * data, data_callback_t cb, void * cb_data);
+
+/**
+ * \brief Mark the data structure as complete.
+ * \param [in] data - The data structure to which to add an element.
+ * \return The error code resulting from callback execution if any. 0 is
+ * returned if the callback executed successfully, or if no callback were
+ * defined.
+ */
+int
+hc_data_set_complete(hc_data_t * data);
+
+/**
+ * \brief Reset the data structure holding control data
+ * \param [in] data - hICN control data
+ * \return Error code
+ */
+int
+hc_data_reset(hc_data_t * data);
+
+/**
+ * \brief Find en element in the data structure
+ * \param [in] data - The data structure in which to find
+ * \param [in] element - The element to find
+ * \param [out] found - A pointer to the element, or NULL if not found.
+ * \return Error code
+ */
+#define GENERATE_FIND_HEADER(TYPE)                                          \
+int                                                                         \
+hc_ ## TYPE ## _find(hc_data_t * data, const hc_ ## TYPE ## _t * element,   \
+        hc_ ## TYPE ## _t **found)
+
+#define GENERATE_FIND(TYPE)                                                 \
+int                                                                         \
+hc_ ## TYPE ## _find(hc_data_t * data, const hc_ ## TYPE ## _t * element,   \
+        hc_ ## TYPE ## _t **found)                                          \
+{                                                                           \
+    foreach_type(hc_ ## TYPE ## _t, x, data) {                              \
+        if (hc_ ## TYPE ## _cmp(x, element) >= 0) {                         \
+            *found = x;                                                     \
+            return LIBHICNCTRL_SUCCESS;                                     \
+        }                                                                   \
+    };                                                                      \
+    *found = NULL; /* this is optional */                                   \
+    return LIBHICNCTRL_SUCCESS;                                             \
+}
+
+/******************************************************************************
+ * Control socket
+ ******************************************************************************/
+
+/* This should be at least equal to the maximum packet size */
+#define RECV_BUFLEN 8192
+
+/**
+ * \brief Holds the state of an hICN control socket
+ */
+typedef struct {
+    char * url;
+    int fd;
+    u32 seq;
+
+    /* Partial receive buffer */
+    u8 buf[RECV_BUFLEN];
+    size_t roff; /**< Read offset */
+    size_t woff; /**< Write offset */
+
+    /*
+     * Because received messages are potentially unbounded in size, we might not
+     * guarantee that we can store a full packet before processing it. We must
+     * implement a very simple state machine remembering the current parsing
+     * status in order to partially process the packet.
+     */
+    size_t remaining;
+    u32 send_id;
+    u32 send_seq;
+    u32 recv_seq;
+} hc_sock_t;
+
+/**
+ * \brief Create an hICN control socket using the specified URL.
+ * \param [in] url - The URL to connect to.
+ * \return an hICN control socket
+ */
+hc_sock_t *
+hc_sock_create_url(const char * url);
+
+/**
+ * \brief Create an hICN control socket using the default connection type.
+ * \return an hICN control socket
+ */
+hc_sock_t *
+hc_sock_create(void);
+
+/**
+ * \brief Frees an hICN control socket
+ */
+void
+hc_sock_free(hc_sock_t *s);
+
+/**
+ * \brief Sets the socket as non-blocking
+ * \return Error code
+ */
+int
+hc_sock_set_nonblocking(hc_sock_t *s);
+
+/**
+ * \brief Connect the socket
+ * \return Error code
+ */
+int
+hc_sock_connect(hc_sock_t *s);
+
+/**
+ * \brief Return the offset and size of available buffer space
+ * \param [in] sock - hICN control socket
+ * \param [out] buffer - Offset in buffer
+ * \param [out] size - Remaining size
+ * \return Error code
+ */
+int
+hc_sock_get_available(hc_sock_t * s, u8 ** buffer, size_t * size);
+
+/**
+ * \brief Write/read iexchance on the control socket (internal helper function)
+ * \param [in] sock - hICN control socket
+ * \param [in] msg - Message to send
+ * \param [in] msglen - Length of the message to send
+ * \return Error code
+ */
+int
+hc_sock_send(hc_sock_t * s, hc_msg_t * msg, size_t msglen);
+
+/**
+ * \brief Helper for reading socket contents
+ * \param [in] sock - hICN control socket
+ * \param [in] data - Result data buffer
+ * \param [in] parse - Parse function to convert remote types into lib native
+ *      types, or NULL not to perform any translation.
+ * \return Error code
+ */
+int
+hc_sock_recv(hc_sock_t * s, hc_data_t * data);
+
+/**
+ * \brief Processing data received by socket
+ * \param [in] sock - hICN control socket
+ * \param [in] data - Result data buffer
+ * \param [in] parse - Parse function to convert remote types into lib native
+ *      types, or NULL not to perform any translation.
+ * \return Error code
+ */
+int
+hc_sock_process(hc_sock_t * s, hc_data_t * data,
+        int (*parse)(const u8 * src, u8 * dst));
+
+/**
+ * \brief Reset the state of the sock (eg. to handle a reconnecton)
+ * \param [in] sock - hICN control socket
+ * \return Error code
+ */
+int
+hc_sock_reset(hc_sock_t * s);
+
+/******************************************************************************
+ * Command-specific structures and functions
+ ******************************************************************************/
+
+/*
+ * The following definitions are organized by sections each dealing with a
+ * specific object being manipulated. All follow a similar structure.
+ *
+ * TYPE DEFINITIONS AND ALIASES
+ *
+ * We redefine command struct:
+ *  - for uniformization
+ *  - to use enum instead of type specifiers more appropriate for packet format
+ *  - to use more flexible types such as for manipulating IP addresses
+ *  - host endianness
+ *  - more intuitive field name, ordering, consistency, and hierarchy removal
+ *  - to have command types in between add/list/... commands
+ *
+ * COMMAND IMPLEMENTATION
+ *
+ * All commands return information in a common format
+ *
+ * RETURN DATA FIXME
+ *
+ * \param [out] pdata - Pointer to the structure storing the results of the call
+ * (NULL if no data has been received). If the pointer is NULL, no result will
+ * be stored and only the error code will be exposed to the caller. It is
+ * expected that the caller frees this structure using hc_data_free() after
+ * usage.
+ * \see hc_data_free.
+ *
+ * PARSING
+ *
+ * While this is not made mandatory by the library, the returned data can be
+ * converted to the library's own data structures as described before.
+ *
+ * ITERATORS
+ *
+ * Macros are defined to facilitate iteration on the returned data structures.
+ */
+
+#ifndef SPACES
+#define SPACES(x) x
+#endif
+#ifndef SPACE
+#define SPACE SPACES(1)
+#endif
+#ifndef NULLTERM
+#define NULLTERM 1
+#endif
+
+#define NAME_LEN 16 /* NULL-terminated right ? */
+#ifdef __linux__
+#define INTERFACE_LEN 16
+#endif
+#define MAXSZ_HC_NAME_ NAME_LEN
+#define MAXSZ_HC_NAME MAXSZ_HC_NAME_ + NULLTERM
+
+#define MAXSZ_HC_ID_ 10 /* Number of digits for MAX_INT */
+#define MAXSZ_HC_ID MAXSZ_HC_ID_ + NULLTERM
+
+#define MAXSZ_HC_PROTO_ 8 /* inetX:// */
+#define MAXSZ_HC_PROTO MAXSZ_HC_PROTO_ + NULLTERM
+
+#define MAXSZ_HC_URL4_ MAXSZ_HC_PROTO_ + MAXSZ_IP4_ADDRESS_ + MAXSZ_PORT_
+#define MAXSZ_HC_URL6_ MAXSZ_HC_PROTO_ + MAXSZ_IP6_ADDRESS_ + MAXSZ_PORT_
+#define MAXSZ_HC_URL_ MAXSZ_HC_URL6_
+#define MAXSZ_HC_URL4 MAXSZ_HC_URL4_ + NULLTERM
+#define MAXSZ_HC_URL6 MAXSZ_HC_URL6_ + NULLTERM
+#define MAXSZ_HC_URL MAXSZ_HC_URL_ + NULLTERM
+
+int hc_url_snprintf(char * s, size_t size, int family,
+        const ip_address_t * ip_address, u16 port);
+
+#define foreach_type(TYPE, VAR, data) \
+    for (TYPE * VAR = (TYPE*)data->buffer; \
+            VAR < (TYPE*)(data->buffer + data->size * data->out_element_size); \
+            VAR++)
+
+/**
+ * New type is defined to reconciliate different enum for add and list.
+ * Also, values not implemented have been removed for clarity.
+ */
+#define foreach_connection_type \
+    _(UNDEFINED)                \
+    _(TCP)                      \
+    _(UDP)                      \
+    _(HICN)                     \
+    _(N)
+
+typedef enum {
+#define _(x) CONNECTION_TYPE_ ## x,
+foreach_connection_type
+#undef _
+} hc_connection_type_t;
+
+#define MAXSZ_HC_CONNECTION_TYPE_ 9
+#define MAXSZ_HC_CONNECTION_TYPE MAXSZ_HC_CONNECTION_TYPE_ + NULLTERM
+
+extern const char * connection_type_str[];
+
+hc_connection_type_t
+connection_type_from_str(const char * str);
+
+/* Same order as connection_state_t in hicn/core/connectionState.h */
+#define foreach_connection_state \
+    _(UNDEFINED)                \
+    _(DOWN)                     \
+    _(UP)                       \
+    _(N)
+
+typedef enum {
+#define _(x) HC_CONNECTION_STATE_ ## x,
+foreach_connection_state
+#undef _
+} hc_connection_state_t;
+
+#define MAXSZ_HC_CONNECTION_STATE_ 9
+#define MAXSZ_HC_CONNECTION_STATE MAXSZ_HC_CONNECTION_STATE_ + NULLTERM
+
+extern const char * connection_state_str[];
+
+typedef int (*HC_PARSE)(const u8 *, u8 *);
+
+/*----------------------------------------------------------------------------*
+ * Listeners
+ *----------------------------------------------------------------------------*/
+
+// FIXME the listener should not require any port for hICN...
+typedef struct {
+    char name[NAME_LEN];        /* K.w */ // XXX clarify what used for
+#ifdef __linux__
+    char interface_name[INTERFACE_LEN];                     /* Kr. */
+#endif
+    u32 id;
+    hc_connection_type_t type;  /* .rw */
+    int family;                 /* .rw */
+    ip_address_t local_addr;    /* .rw */
+    u16 local_port;             /* .rw */
+} hc_listener_t;
+
+int hc_listener_create(hc_sock_t * s, hc_listener_t * listener);
+int hc_listener_get(hc_sock_t *s, hc_listener_t * listener,
+        hc_listener_t ** listener_found);
+int hc_listener_delete(hc_sock_t * s, hc_listener_t * listener);
+int hc_listener_list(hc_sock_t * s, hc_data_t ** pdata);
+
+int hc_listener_validate(const hc_listener_t * listener);
+int hc_listener_cmp(const hc_listener_t * l1, const hc_listener_t * l2);
+int hc_listener_parse(void * in, hc_listener_t * listener);
+
+#define foreach_listener(VAR, data) foreach_type(hc_listener_t, VAR, data)
+
+#define MAXSZ_HC_LISTENER_ MAXSZ_HC_URL_ + SPACE + MAXSZ_HC_CONNECTION_TYPE_
+#define MAXSZ_HC_LISTENER MAXSZ_HC_LISTENER_ + NULLTERM
+
+GENERATE_FIND_HEADER(listener);
+
+int hc_listener_snprintf(char * s, size_t size, hc_listener_t * listener);
+
+/*----------------------------------------------------------------------------*
+ * Connections
+ *----------------------------------------------------------------------------*/
+
+typedef struct {
+    u32 id;                 /* Kr. */
+    char name[NAME_LEN];         /* K.w */
+    hc_connection_type_t type;   /* .rw */
+    int family;                  /* .rw */
+    ip_address_t local_addr;     /* .rw */
+    u16 local_port;              /* .rw */
+    ip_address_t remote_addr;    /* .rw */
+    u16 remote_port;             /* .rw */
+    hc_connection_state_t admin_state;  /* .rw */
+#ifdef WITH_POLICY
+    policy_tags_t tags;          /* .rw */
+#endif /* WITH_POLICY */
+    hc_connection_state_t state; /* .r. */
+} hc_connection_t;
+
+
+int hc_connection_create(hc_sock_t * s, hc_connection_t * connection);
+int hc_connection_get(hc_sock_t *s, hc_connection_t * connection,
+        hc_connection_t ** connection_found);
+int hc_connection_update_by_id(hc_sock_t * s, int hc_connection_id,
+        hc_connection_t * connection);
+int hc_connection_update(hc_sock_t * s, hc_connection_t * connection_current,
+        hc_connection_t * connection_updated);
+int hc_connection_delete(hc_sock_t * s, hc_connection_t * connection);
+/*
+int hc_connection_remove_by_id(hc_sock_t * s, char * name);
+int hc_connection_remove_by_name(hc_sock_t * s, char * name);
+*/
+int hc_connection_list(hc_sock_t * s, hc_data_t ** pdata);
+
+int hc_connection_validate(const hc_connection_t * connection);
+int hc_connection_cmp(const hc_connection_t * c1, const hc_connection_t * c2);
+int hc_connection_parse(void * in, hc_connection_t * connection);
+
+#ifdef WITH_POLICY
+int hc_connection_set_state(hc_sock_t * s, const char * conn_id_or_name, face_state_t state);
+#endif /* WITH_POLICY */
+
+#define foreach_connection(VAR, data) foreach_type(hc_connection_t, VAR, data)
+
+#define MAXSZ_HC_CONNECTION_ MAXSZ_HC_CONNECTION_STATE_ + \
+    2 * MAXSZ_HC_URL_ + MAXSZ_HC_CONNECTION_TYPE_ + SPACES(3)
+#define MAXSZ_HC_CONNECTION MAXSZ_HC_CONNECTION_ + NULLTERM
+
+GENERATE_FIND_HEADER(connection);
+
+int hc_connection_snprintf(char * s, size_t size, const hc_connection_t * connection);
+
+/*----------------------------------------------------------------------------*
+ * Routes
+ *----------------------------------------------------------------------------*/
+
+typedef struct {
+    u8 face_id;                  /* Kr. */
+    int family;                  /* Krw */
+    ip_address_t remote_addr;    /* krw */
+    u8 len;                      /* krw */
+    u16 cost;                    /* .rw */
+} hc_route_t;
+
+int hc_route_parse(void * in, hc_route_t * route);
+
+int hc_route_create(hc_sock_t * s, hc_route_t * route);
+int hc_route_delete(hc_sock_t * s, hc_route_t * route);
+int hc_route_list(hc_sock_t * s, hc_data_t ** pdata);
+
+#define foreach_route(VAR, data) foreach_type(hc_route_t, VAR, data)
+
+#define MAX_FACE_ID 255
+#define MAXSZ_FACE_ID 3
+#define MAX_COST 65535
+#define MAXSZ_COST 5
+#define MAX_LEN 255
+#define MAXSZ_LEN 3
+
+#define MAXSZ_HC_ROUTE_ MAXSZ_FACE_ID + 1 + MAXSZ_COST + 1 + MAXSZ_IP_ADDRESS + 1 + MAXSZ_LEN
+#define MAXSZ_HC_ROUTE MAXSZ_HC_ROUTE_ + NULLTERM
+
+int hc_route_snprintf(char * s, size_t size, hc_route_t * route);
+
+/*----------------------------------------------------------------------------*
+ * Faces
+ *
+ * A face is an abstraction introduced by the control library to abstract the
+ * forwarder implementation details. It encompasses connections and listeners
+ * and ensures the right dependencies are enforced, eg that we always have a
+ * listener when a connection is created.
+ *
+ *----------------------------------------------------------------------------*/
+
+typedef struct {
+    u32 id;
+    char name[NAME_LEN];
+    face_t face; // or embed ?
+    //face_id_t parent; /* Pointer from connection to listener */
+} hc_face_t;
+
+/**
+ * \brief Create a face
+ * \param [in] s - hICN socket
+ * \param [in,out] face - Parameters of the face to create
+ * \return Error code
+ *
+ * The face parameters will be updated with the face ID.
+ */
+int hc_face_create(hc_sock_t * s, hc_face_t * face);
+int hc_face_get(hc_sock_t * s, hc_face_t * face, hc_face_t ** face_found);
+int hc_face_delete(hc_sock_t * s, hc_face_t * face);
+int hc_face_list(hc_sock_t * s, hc_data_t ** pdata);
+
+#define foreach_face(VAR, data) foreach_type(hc_face_t, VAR, data)
+
+#define MAXSZ_HC_FACE_ 0
+#define MAXSZ_HC_FACE MAXSZ_HC_FACE_ + NULLTERM
+
+int hc_face_snprintf(char * s, size_t size, hc_face_t * face);
+
+/////// XXX XXX XXX XXX missing face api functions, cf punting now...
+
+/*----------------------------------------------------------------------------*
+ * Punting
+ *----------------------------------------------------------------------------*/
+
+typedef struct {
+    u8 face_id;                 /* Kr. */ // XXX listener id, could be NULL for all ?
+    int family;                 /* Krw */
+    ip_address_t prefix;        /* krw */
+    u8 prefix_len;              /* krw */
+} hc_punting_t;
+
+int hc_punting_create(hc_sock_t * s, hc_punting_t * punting);
+int hc_punting_get(hc_sock_t * s, hc_punting_t * punting, hc_punting_t ** punting_found);
+int hc_punting_delete(hc_sock_t * s, hc_punting_t * punting);
+int hc_punting_list(hc_sock_t * s, hc_data_t ** pdata);
+
+int hc_punting_validate(const hc_punting_t * punting);
+int hc_punting_cmp(const hc_punting_t * c1, const hc_punting_t * c2);
+int hc_punting_parse(void * in, hc_punting_t * punting);
+
+#define foreach_punting(VAR, data) foreach_type(hc_punting_t, VAR, data)
+
+#define MAXSZ_HC_PUNTING_ 0
+#define MAXSZ_HC_PUNTING MAXSZ_HC_PUNTING_ + NULLTERM
+
+GENERATE_FIND_HEADER(punting);
+
+int hc_punting_snprintf(char * s, size_t size, hc_punting_t * punting);
+
+
+/*----------------------------------------------------------------------------*
+ * Cache
+ *----------------------------------------------------------------------------*/
+
+int hc_cache_set_store(hc_sock_t * s, int enabled);
+int hc_cache_set_serve(hc_sock_t * s, int enabled);
+
+/*----------------------------------------------------------------------------*
+ * Strategy
+ *----------------------------------------------------------------------------*/
+
+#define MAXSZ_STRATEGY_NAME 255
+
+typedef struct {
+    char name[MAXSZ_STRATEGY_NAME];
+} hc_strategy_t;
+
+int hc_strategy_list(hc_sock_t * s, hc_data_t ** data);
+
+#define foreach_strategy(VAR, data) foreach_type(hc_strategy_t, VAR, data)
+
+#define MAXSZ_HC_STRATEGY_ MAXSZ_STRATEGY_NAME
+#define MAXSZ_HC_STRATEGY MAXSZ_HC_STRATEGY_ + NULLTERM
+
+int hc_strategy_snprintf(char * s, size_t size, hc_strategy_t * strategy);
+
+// per prefix
+int hc_strategy_set(hc_sock_t * s /* XXX */);
+
+/*----------------------------------------------------------------------------*
+ * WLDR
+ *----------------------------------------------------------------------------*/
+
+// per connection
+int hc_wldr_set(hc_sock_t * s /* XXX */);
+
+/*----------------------------------------------------------------------------*
+ * MAP-Me
+ *----------------------------------------------------------------------------*/
+
+int hc_mapme_set(hc_sock_t * s, int enabled);
+int hc_mapme_set_discovery(hc_sock_t * s, int enabled);
+int hc_mapme_set_timescale(hc_sock_t * s, double timescale);
+int hc_mapme_set_retx(hc_sock_t * s, double timescale);
+
+/*----------------------------------------------------------------------------*
+ * Policies
+ *----------------------------------------------------------------------------*/
+
+#ifdef WITH_POLICY
+
+typedef struct {
+    int family;                  /* Krw */
+    ip_address_t remote_addr;    /* krw */
+    u8 len;                      /* krw */
+    policy_t policy;             /* .rw */
+} hc_policy_t;
+
+int hc_policy_parse(void * in, hc_policy_t * policy);
+
+int hc_policy_create(hc_sock_t * s, hc_policy_t * policy);
+int hc_policy_delete(hc_sock_t * s, hc_policy_t * policy);
+int hc_policy_list(hc_sock_t * s, hc_data_t ** pdata);
+
+#define foreach_policy(VAR, data) foreach_type(hc_policy_t, VAR, data)
+
+/* TODO */
+#define MAXSZ_HC_POLICY_ 0
+#define MAXSZ_HC_POLICY MAXSZ_HC_POLICY_ + NULLTERM
+
+int hc_policy_snprintf(char * s, size_t size, hc_policy_t * policy);
+
+#endif /* WITH_POLICY */
+
+#endif /* HICNTRL_API */
diff --git a/ctrl/libhicnctrl/includes/hicn/ctrl/commands.h b/ctrl/libhicnctrl/includes/hicn/ctrl/commands.h
new file mode 100755
index 000000000..1d07c9b72
--- /dev/null
+++ b/ctrl/libhicnctrl/includes/hicn/ctrl/commands.h
@@ -0,0 +1,411 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+ * @file commands.h
+ * @brief All hicn-light commands: 14 in total.
+ *
+ * Header and payload in binary format.
+ */
+
+#ifndef commands_h
+#define commands_h
+
+#ifndef _WIN32
+#include <netinet/in.h>
+#include <sys/socket.h>
+#endif
+
+#include <stdint.h>
+#include <stdlib.h>
+
+#ifdef WITH_POLICY
+#include "util/policy.h"
+#endif /* WITH_POLICY */
+
+typedef struct in6_addr ipv6_addr_t;
+typedef uint32_t ipv4_addr_t;
+
+union commandAddr {
+  ipv4_addr_t ipv4;
+  ipv6_addr_t ipv6;
+};
+
+typedef enum {
+  REQUEST_LIGHT = 0xc0, // this is a command
+  RESPONSE_LIGHT,
+  ACK_LIGHT,
+  NACK_LIGHT,
+  LAST_MSG_TYPE_VALUE
+} message_type;
+
+typedef enum {
+  ADD_LISTENER = 0,
+  ADD_CONNECTION,
+  LIST_CONNECTIONS,
+  ADD_ROUTE,
+  LIST_ROUTES,
+  REMOVE_CONNECTION,
+  REMOVE_ROUTE,
+  CACHE_STORE,
+  CACHE_SERVE,
+  CACHE_CLEAR,
+  SET_STRATEGY,
+  SET_WLDR,
+  ADD_PUNTING,
+  LIST_LISTENERS,
+  MAPME_ENABLE,
+  MAPME_DISCOVERY,
+  MAPME_TIMESCALE,
+  MAPME_RETX,
+  CONNECTION_SET_ADMIN_STATE,
+#ifdef WITH_POLICY
+  ADD_POLICY,
+  LIST_POLICIES,
+  REMOVE_POLICY,
+  UPDATE_CONNECTION,
+#endif /* WITH_POLICY */
+  REMOVE_LISTENER,
+  LAST_COMMAND_VALUE
+} command_id;
+
+typedef enum {
+  ADDR_INET = 1,
+  ADDR_INET6,
+  ADDR_LINK,
+  ADDR_IFACE,
+  ADDR_UNIX /* PF_UNIX */
+} address_type;
+
+typedef enum {
+  UDP_CONN,
+  TCP_CONN,
+  GRE_CONN,  // not implemented
+  HICN_CONN
+} connection_type;
+
+typedef enum { ACTIVATE_ON, ACTIVATE_OFF } activate_type;
+
+//==========    HEADER    ==========
+
+typedef struct {
+  uint8_t messageType;
+  uint8_t commandID;
+  uint16_t length;  // tells the number of structures in the payload
+  uint32_t seqNum;
+} header_control_message;
+// for the moment has to be at least 8 bytes
+
+// SIZE=8
+
+//==========  [00]  ADD LISTENER    ==========
+
+typedef enum { ETHER_MODE, IP_MODE, HICN_MODE } listener_mode;
+
+typedef struct {
+  char symbolic[16];
+  char interfaceName[16];
+  union commandAddr address;
+  uint16_t port;
+  // uint16_t etherType;
+  uint8_t addressType;
+  uint8_t listenerMode;
+  uint8_t connectionType;
+} add_listener_command;
+
+// SIZE=40
+
+//==========  [01]  ADD CONNECTION    ==========
+
+typedef struct {
+  char symbolic[16];
+  union commandAddr remoteIp;
+  union commandAddr localIp;
+  uint16_t remotePort;
+  uint16_t localPort;
+  uint8_t ipType;
+  uint8_t connectionType;
+  uint8_t admin_state;
+#ifdef WITH_POLICY
+  policy_tags_t tags;
+#endif /* WITH_POLICY */
+} add_connection_command;
+
+// SIZE=56
+
+//==========  [02]  LIST CONNECTIONS    ==========
+
+typedef enum {
+  CONN_GRE,
+  CONN_TCP,
+  CONN_UDP,
+  CONN_MULTICAST,
+  CONN_L2,
+  CONN_HICN
+} list_connections_type;
+
+typedef enum {
+  IFACE_UP = 0,
+  IFACE_DOWN = 1,
+  IFACE_UNKNOWN = 2  // not used actually
+} connection_state;
+
+typedef struct {
+  add_connection_command connectionData;
+  uint32_t connid;
+  uint8_t state;
+#ifdef WITH_UPDATE
+  char connectionName[16];
+#endif /* WITH_UPDATE */
+} list_connections_command;
+
+// SIZE=64
+
+//==========  [03]  ADD ROUTE    ==========
+
+typedef struct {
+  char symbolicOrConnid[16];
+  union commandAddr address;
+  uint16_t cost;
+  uint8_t addressType;
+  uint8_t len;
+} add_route_command;
+
+// SIZE=36
+
+//==========  [04]  LIST ROUTE    ==========
+
+typedef struct {
+  union commandAddr address;
+  uint32_t connid;
+  uint16_t cost;
+  uint8_t addressType;
+  uint8_t len;
+} list_routes_command;
+
+// SIZE=24
+
+//==========  [05]  REMOVE CONNECTION    ==========
+
+typedef struct {
+  char symbolicOrConnid[16];
+} remove_connection_command;
+
+//==========  [06]  REMOVE LISTENER    ==========
+typedef struct {
+  char symbolicOrListenerid[16];
+} remove_listener_command;
+
+// SIZE=16
+
+//==========  [06]  REMOVE ROUTE    ==========
+
+typedef struct {
+  char symbolicOrConnid[16];
+  union commandAddr address;
+  uint8_t addressType;
+  uint8_t len;
+} remove_route_command;
+
+// SIZE=36
+
+//==========  [07]  CACHE STORE    ==========
+
+typedef struct {
+  uint8_t activate;
+} cache_store_command;
+
+// SIZE=1
+
+//==========  [08]  CACHE SERVE    ==========
+
+typedef struct {
+  uint8_t activate;
+} cache_serve_command;
+
+// SIZE=1
+
+//==========  [09]  SET STRATEGY    ==========
+
+typedef enum {
+  SET_STRATEGY_LOADBALANCER,
+  SET_STRATEGY_RANDOM,
+  SET_STRATEGY_RANDOM_PER_DASH_SEGMENT,
+  SET_STRATEGY_LOADBALANCER_WITH_DELAY,
+  SET_STRATEGY_LOADBALANCER_BY_RATE,
+  SET_STRATEGY_LOADBALANCER_BEST_ROUTE,
+  LAST_STRATEGY_VALUE
+} strategy_type;
+
+typedef struct {
+  union commandAddr address;
+  uint8_t strategyType;
+  uint8_t addressType;
+  uint8_t len;
+} set_strategy_command;
+
+// SIZE=20
+
+//==========  [11]  SET WLDR    ==========
+
+typedef struct {
+  char symbolicOrConnid[16];
+  uint8_t activate;
+} set_wldr_command;
+
+// SIZE=17
+
+//==========  [12]  ADD PUNTING    ==========
+
+typedef struct {
+  char symbolicOrConnid[16];
+  union commandAddr address;
+  uint8_t addressType;
+  uint8_t len;
+} add_punting_command;
+
+// SIZE=36
+
+//==========  [13]  LIST LISTENER    ==========
+
+typedef struct {
+  union commandAddr address;
+#ifdef WITH_UPDATE
+  char listenerName[16];
+  char interfaceName[16];
+#endif /* WITH_UPDATE */
+  uint32_t connid;
+  uint16_t port;
+  uint8_t addressType;
+  uint8_t encapType;
+} list_listeners_command;
+
+// SIZE=56
+
+//==========  [14]  MAPME    ==========
+
+//  (enable/discovery/timescale/retx)
+
+typedef struct {
+  uint8_t activate;
+} mapme_activator_command;
+
+// SIZE=1
+
+typedef struct {
+  uint32_t timePeriod;
+} mapme_timing_command;
+
+// SIZE=1
+
+//==========  NEW COMMANDS  ==========
+
+typedef struct {
+  char symbolicOrConnid[16];
+  uint8_t admin_state;
+} connection_set_admin_state_command;
+
+#ifdef WITH_POLICY
+
+typedef struct {
+  union commandAddr address;
+  uint8_t addressType;
+  uint8_t len;
+  policy_t policy;
+} add_policy_command;
+
+typedef struct {
+  union commandAddr address;
+  uint8_t addressType;
+  uint8_t len;
+  policy_t policy;
+} list_policies_command;
+
+typedef struct {
+  union commandAddr address;
+  uint8_t addressType;
+  uint8_t len;
+} remove_policy_command;
+
+typedef struct {
+  char symbolicOrConnid[16];
+  uint8_t admin_state;
+  policy_tags_t tags;
+} update_connection_command;
+
+#endif /* WITH_POLICY */
+
+//===== size of commands ======
+// REMINDER: when a new_command is added, the following switch has to be
+// updated.
+static inline int payloadLengthDaemon(command_id id) {
+  switch (id) {
+    case ADD_LISTENER:
+      return sizeof(add_listener_command);
+    case ADD_CONNECTION:
+      return sizeof(add_connection_command);
+    case LIST_CONNECTIONS:
+      return 0;  // list connections: payload always 0
+    case ADD_ROUTE:
+      return sizeof(add_route_command);
+    case LIST_ROUTES:
+      return 0;  // list routes: payload always 0
+    case REMOVE_CONNECTION:
+      return sizeof(remove_connection_command);
+    case REMOVE_LISTENER:
+      return sizeof(remove_listener_command);
+    case REMOVE_ROUTE:
+      return sizeof(remove_route_command);
+    case CACHE_STORE:
+      return sizeof(cache_store_command);
+    case CACHE_SERVE:
+      return sizeof(cache_serve_command);
+    case CACHE_CLEAR:
+      return 0;  // cache clear
+    case SET_STRATEGY:
+      return sizeof(set_strategy_command);
+    case SET_WLDR:
+      return sizeof(set_wldr_command);
+    case ADD_PUNTING:
+      return sizeof(add_punting_command);
+    case LIST_LISTENERS:
+      return 0;  // list listeners: payload always 0
+    case MAPME_ENABLE:
+      return sizeof(mapme_activator_command);
+    case MAPME_DISCOVERY:
+      return sizeof(mapme_activator_command);
+    case MAPME_TIMESCALE:
+      return sizeof(mapme_timing_command);
+    case MAPME_RETX:
+      return sizeof(mapme_timing_command);
+    case CONNECTION_SET_ADMIN_STATE:
+      return sizeof(connection_set_admin_state_command);
+#ifdef WITH_POLICY
+    case ADD_POLICY:
+      return sizeof(add_policy_command);
+    case LIST_POLICIES:
+      return 0; // list policies: payload always 0
+    case REMOVE_POLICY:
+      return sizeof(remove_policy_command);
+    case UPDATE_CONNECTION:
+      return sizeof(update_connection_command);
+#endif /* WITH_POLICY */
+    case LAST_COMMAND_VALUE:
+      return 0;
+    default:
+      return 0;
+  }
+}
+#endif
diff --git a/ctrl/libhicnctrl/includes/hicn/ctrl/face.h b/ctrl/libhicnctrl/includes/hicn/ctrl/face.h
new file mode 100644
index 000000000..2856ce89b
--- /dev/null
+++ b/ctrl/libhicnctrl/includes/hicn/ctrl/face.h
@@ -0,0 +1,179 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file face.h
+ * \brief Face abstraction
+ */
+#ifndef HICN_FACE_H
+#define HICN_FACE_H
+
+#ifndef SPACES
+#define SPACES(x) x
+#endif
+#ifndef SPACE
+#define SPACE 1
+#endif
+#ifndef NULLTERM
+#define NULLTERM 1
+#endif
+
+#ifndef _HICNTRL_NO_DEF_IPADDR
+#include "util/ip_address.h"
+#endif /* _HICNTRL_NO_DEF_IPADDR */
+#include "util/policy.h"
+#include "util/types.h"
+
+
+/* Netdevice type */
+
+#include <net/if.h> // IFNAMSIZ
+
+#define foreach_netdevice_type  \
+    _(UNDEFINED)                \
+    _(WIRED)                    \
+    _(WIFI)                     \
+    _(CELLULAR)                 \
+    _(VPN)                      \
+    _(N)
+
+#define MAXSZ_NETDEVICE_TYPE_ 9
+#define MAXSZ_NETDEVICE_TYPE MAXSZ_NETDEVICE_TYPE_ + NULLTERM
+
+typedef enum {
+#define _(x) NETDEVICE_TYPE_ ## x,
+foreach_netdevice_type
+#undef _
+} netdevice_type_t;
+
+extern const char * netdevice_type_str[];
+
+
+/* Netdevice */
+
+typedef struct {
+    u32 index;
+    char name[IFNAMSIZ];
+} netdevice_t;
+
+#define NETDEVICE_UNDEFINED_INDEX 0
+
+/* Face state */
+
+#define foreach_face_state      \
+    _(UNDEFINED)                \
+    _(PENDING_UP)               \
+    _(UP)                       \
+    _(PENDING_DOWN)             \
+    _(DOWN)                     \
+    _(ERROR)                    \
+    _(N)
+
+#define MAXSZ_FACE_STATE_ 12
+#define MAXSZ_FACE_STATE MAXSZ_FACE_STATE_ + 1
+
+typedef enum {
+#define _(x) FACE_STATE_ ## x,
+foreach_face_state
+#undef _
+} face_state_t;
+
+extern const char * face_state_str[];
+
+
+/* Face type */
+
+#define foreach_face_type       \
+    _(UNDEFINED)                \
+    _(HICN)                     \
+    _(HICN_LISTENER)            \
+    _(TCP)                      \
+    _(TCP_LISTENER)             \
+    _(UDP)                      \
+    _(UDP_LISTENER)             \
+    _(N)
+
+#define MAXSZ_FACE_TYPE_ 13
+#define MAXSZ_FACE_TYPE MAXSZ_FACE_TYPE_  + 1
+
+typedef enum {
+#define _(x) FACE_TYPE_ ## x,
+foreach_face_type
+#undef _
+} face_type_t;
+
+extern const char * face_type_str[];
+
+#define MAXSZ_FACE_ MAXSZ_FACE_TYPE_ + 2 * MAXSZ_IP_ADDRESS + 2 * MAXSZ_PORT + 9
+#define MAXSZ_FACE MAXSZ_FACE_ + 1
+
+/* Face */
+
+typedef union {
+    int family; /* To access family independently of face type */
+    struct {
+        int family;
+        netdevice_t netdevice;
+        ip_address_t local_addr;
+        ip_address_t remote_addr;
+    } hicn;
+    struct {
+        int family;
+        ip_address_t local_addr;
+        u16 local_port;
+        ip_address_t remote_addr;
+        u16 remote_port;
+    } tunnel;
+} face_params_t;
+
+typedef struct {
+    face_type_t type;
+    face_params_t params;
+    face_state_t admin_state;
+    face_state_t state;
+#ifdef WITH_POLICY
+    policy_tags_t tags; /**< \see policy_tag_t */
+#endif /* WITH_POLICY */
+} face_t;
+
+int face_initialize(face_t * face);
+int face_initialize_udp(face_t * face, const ip_address_t * local_addr,
+        u16 local_port, const ip_address_t * remote_addr, u16 remote_port,
+        int family);
+int face_initialize_udp_sa(face_t * face,
+        const struct sockaddr * local_addr, const struct sockaddr * remote_addr);
+
+face_t * face_create();
+face_t * face_create_udp(const ip_address_t * local_addr, u16 local_port,
+        const ip_address_t * remote_addr, u16 remote_port, int family);
+face_t * face_create_udp_sa(const struct sockaddr * local_addr,
+        const struct sockaddr * remote_addr);
+
+int face_finalize(face_t * face);
+
+void face_free(face_t * face);
+
+typedef int (*face_cmp_t)(const face_t * f1, const face_t * f2);
+
+int face_cmp(const face_t * f1, const face_t * f2);
+hash_t face_hash(const face_t * face);
+
+size_t
+face_snprintf(char * s, size_t size, const face_t * face);
+
+int face_set_tags(face_t * face, policy_tags_t tags);
+
+#endif /* HICN_FACE_H */
+
diff --git a/ctrl/libhicnctrl/src/CMakeLists.txt b/ctrl/libhicnctrl/src/CMakeLists.txt
new file mode 100644
index 000000000..ebccb7ddd
--- /dev/null
+++ b/ctrl/libhicnctrl/src/CMakeLists.txt
@@ -0,0 +1,87 @@
+# Copyright (c) 2017-2019 Cisco and/or its affiliates.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+include(BuildMacros)
+
+list(APPEND COMPILER_DEFINITIONS
+  "-DWITH_POLICY"
+#  "-DWITH_UPDATE"
+)
+
+set(HEADER_FILES
+    api.h
+    commands.h
+    face.h
+)
+
+set(UTIL_HEADER_FILES
+    face.h
+    util/ip_address.h
+    util/log.h
+    util/policy.h
+    util/token.h
+    util/types.h
+)
+
+set(SOURCE_FILES
+    api.c
+    util/policy.c
+    util/log.c
+)
+
+set(LIBRARIES
+    m
+)
+
+set(INCLUDE_DIRS
+    ./
+    ../includes/
+)
+
+if (ANDROID_API)
+    build_library(${LIBHICN_CTRL}
+        STATIC
+        SOURCES ${SOURCE_FILES}
+        INSTALL_HEADERS ${TO_INSTALL_HEADER_FILES}
+        LINK_LIBRARIES ${LIBRARIES}
+        COMPONENT ${LIBHICNCTRL_COMPONENT}
+        INCLUDE_DIRS ${INCLUDE_DIRS}
+        INSTALL_ROOT_DIR hicn
+        DEFINITIONS ${COMPILER_DEFINITIONS}
+    )
+else ()
+    build_library(${LIBHICN_CTRL}
+        SHARED STATIC
+        SOURCES ${SOURCE_FILES}
+        INSTALL_HEADERS ${TO_INSTALL_HEADER_FILES}
+        LINK_LIBRARIES ${LIBRARIES}
+        COMPONENT ${LIBHICNCTRL_COMPONENT}
+        INCLUDE_DIRS ${INCLUDE_DIRS}
+        INSTALL_ROOT_DIR hicn
+        DEFINITIONS ${COMPILER_DEFINITIONS}
+    )
+endif ()
+
+if(NOT ANDROID_API AND NOT COMPILE_FOR_IOS)
+    list(APPEND DAEMON_SRC
+      cli.c
+    )
+    build_executable(${HICN_CTRL}
+      SOURCES ${DAEMON_SRC}
+      LINK_LIBRARIES ${LIBHICN_CTRL_SHARED}
+      DEPENDS ${LIBHICN_CTRL_SHARED}
+      COMPONENT ${LIBHICNCTRL_COMPONENT}
+      INCLUDE_DIRS ${INCLUDE_DIRS}
+      DEFINITIONS ${COMPILER_DEFINITIONS}
+    )
+endif ()
diff --git a/ctrl/libhicnctrl/src/api.c b/ctrl/libhicnctrl/src/api.c
new file mode 100644
index 000000000..3d8a2c166
--- /dev/null
+++ b/ctrl/libhicnctrl/src/api.c
@@ -0,0 +1,2163 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file api.c
+ * \brief Implementation of hICN control library API
+ */
+
+#include <assert.h> // assert
+#include <math.h> // log2
+#include <stdio.h> // snprintf
+#include <string.h> // memmove, strcasecmp
+#include <sys/socket.h> // socket
+#include <unistd.h> // close, fcntl
+#include <fcntl.h> // fcntl
+
+#include <hicn/ctrl/api.h>
+#include <hicn/ctrl/commands.h>
+#include "util/log.h"
+#include "util/token.h"
+#include <strings.h>
+
+#define PORT 9695
+
+/*
+ * list was working with all seq set to 0, but it seems hicnLightControl uses
+ * 1, and replies with the same seqno
+ */
+#define HICN_CTRL_SEND_SEQ_INIT 1
+#define HICN_CTRL_RECV_SEQ_INIT 1
+
+#define MAX(x, y) ((x > y) ? x : y)
+
+/**
+ * \brief Defines the default size for the allocated data arrays holding the
+ * results of API calls.
+ *
+ * This size should not be too small to avoid wasting memoyy, but also not too
+ * big to avoid unnecessary realloc's. Later on this size is doubled at each
+ * reallocation.
+ */
+#define DEFAULT_SIZE_LOG 3
+
+/**
+ * In practise, we want to preserve enough room to store a full packet of
+ * average expected size (say a header + N payload elements).
+ */
+#define AVG_ELEMENTS (1 << DEFAULT_SIZE_LOG)
+#define AVG_BUFLEN sizeof(hc_msg_header_t) + AVG_ELEMENTS * sizeof(hc_msg_payload_t)
+
+/*
+ * We should at least have buffer space allowing to store one processable unit
+ * of data, either the header of the maximum possible payload
+ */
+#define MIN_BUFLEN MAX(sizeof(hc_msg_header_t), sizeof(hc_msg_payload_t))
+
+static const struct in6_addr loopback_addr = IN6ADDR_LOOPBACK_INIT;
+
+/* /!\ Please update constants in header file upon changes */
+const char * connection_type_str[] = {
+#define _(x) [CONNECTION_TYPE_ ## x] = STRINGIZE(x),
+foreach_connection_type
+#undef _
+};
+
+#define IS_VALID_CONNECTION_TYPE(x) IS_VALID_ENUM_TYPE(CONNECTION_TYPE, x)
+
+hc_connection_type_t
+connection_type_from_str(const char * str)
+{
+    if (strcasecmp(str, "TCP") == 0)
+        return CONNECTION_TYPE_TCP;
+    else if (strcasecmp(str, "UDP") == 0)
+        return CONNECTION_TYPE_UDP;
+    else if (strcasecmp(str, "HICN") == 0)
+        return CONNECTION_TYPE_HICN;
+    else
+	return CONNECTION_TYPE_UNDEFINED;
+}
+
+/* Conversions to shield lib user from heterogeneity */
+
+#define IS_VALID_LIST_CONNECTIONS_TYPE(x) ((x >= CONN_GRE) && (x <= CONN_HICN))
+
+static const hc_connection_type_t map_from_list_connections_type[] = {
+    [CONN_GRE]       = CONNECTION_TYPE_UNDEFINED,
+    [CONN_TCP]       = CONNECTION_TYPE_TCP,
+    [CONN_UDP]       = CONNECTION_TYPE_UDP,
+    [CONN_MULTICAST] = CONNECTION_TYPE_UNDEFINED,
+    [CONN_L2]        = CONNECTION_TYPE_UNDEFINED,
+    [CONN_HICN]      = CONNECTION_TYPE_HICN,
+};
+
+typedef enum {
+    ENCAP_TCP,
+    ENCAP_UDP,
+    ENCAP_ETHER,
+    ENCAP_LOCAL,
+    ENCAP_HICN
+} EncapType;
+
+#define IS_VALID_LIST_LISTENERS_TYPE(x) ((x >= ENCAP_TCP) && (x <= ENCAP_HICN))
+
+static const hc_connection_type_t map_from_encap_type[] = {
+    [ENCAP_TCP]     = CONNECTION_TYPE_TCP,
+    [ENCAP_UDP]     = CONNECTION_TYPE_UDP,
+    [ENCAP_ETHER]   = CONNECTION_TYPE_UNDEFINED,
+    [ENCAP_LOCAL]   = CONNECTION_TYPE_UNDEFINED,
+    [ENCAP_HICN]    = CONNECTION_TYPE_HICN,
+};
+
+static const connection_type map_to_connection_type[] = {
+    [CONNECTION_TYPE_TCP]   = TCP_CONN,
+    [CONNECTION_TYPE_UDP]   = UDP_CONN,
+    [CONNECTION_TYPE_HICN]  = HICN_CONN,
+};
+
+static const listener_mode map_to_listener_mode[] = {
+    [CONNECTION_TYPE_TCP]       = IP_MODE,
+    [CONNECTION_TYPE_UDP]       = IP_MODE,
+    [CONNECTION_TYPE_HICN]      = HICN_MODE,
+};
+
+#define IS_VALID_LIST_CONNECTIONS_STATE(x) ((x >= IFACE_UP) && (x <= IFACE_UNKNOWN))
+
+/* /!\ Please update constants in header file upon changes */
+const char * connection_state_str[] = {
+#define _(x) [HC_CONNECTION_STATE_ ## x] = STRINGIZE(x),
+foreach_connection_state
+#undef _
+};
+
+/*
+#define IS_VALID_CONNECTION_STATE(x) IS_VALID_ENUM_TYPE(CONNECTION_STATE, x)
+
+static const connection_state map_to_connection_state[] = {
+    [HC_CONNECTION_STATE_UP]       = IFACE_UP,
+    [HC_CONNECTION_STATE_DOWN]     = IFACE_DOWN,
+};
+
+*/
+
+static const hc_connection_state_t map_from_list_connections_state[] = {
+    [IFACE_UP]                  = HC_CONNECTION_STATE_UP,
+    [IFACE_DOWN]                = HC_CONNECTION_STATE_DOWN,
+    [IFACE_UNKNOWN]             = HC_CONNECTION_STATE_UNDEFINED,
+};
+
+
+#define connection_state_to_face_state(x) ((face_state_t)x)
+#define face_state_to_connection_state(x) ((hc_connection_state_t)x)
+
+#define IS_VALID_ADDR_TYPE(x) ((x >= ADDR_INET) && (x <= ADDR_UNIX))
+
+static const int map_from_addr_type[] = {
+    [ADDR_INET]     = AF_INET,
+    [ADDR_INET6]    = AF_INET6,
+    [ADDR_LINK]     = AF_UNSPEC,
+    [ADDR_IFACE]    = AF_UNSPEC,
+    [ADDR_UNIX]     = AF_UNSPEC,
+};
+
+static const address_type map_to_addr_type[] = {
+    [AF_INET]   = ADDR_INET,
+    [AF_INET6]  = ADDR_INET6,
+};
+
+/******************************************************************************
+ * Message helper types and aliases
+ ******************************************************************************/
+
+#define foreach_hc_command      \
+    _(add_connection)           \
+    _(remove_connection)        \
+    _(list_connections)         \
+    _(add_listener)             \
+    _(remove_listener)          \
+    _(list_listeners)           \
+    _(add_route)                \
+    _(remove_route)             \
+    _(list_routes)              \
+    _(cache_store)              \
+    _(cache_serve)              \
+    /*_(cache_clear) */         \
+    _(set_strategy)             \
+    _(set_wldr)                 \
+    _(add_punting)              \
+    _(mapme_activator)          \
+    _(mapme_timing)
+
+typedef header_control_message hc_msg_header_t;
+
+typedef union {
+#define _(x) x ## _command x;
+        foreach_hc_command
+#undef _
+} hc_msg_payload_t;
+
+
+typedef struct hc_msg_s {
+    hc_msg_header_t hdr;
+    hc_msg_payload_t payload;
+} hc_msg_t;
+
+/******************************************************************************
+ * Control Data
+ ******************************************************************************/
+
+hc_data_t *
+hc_data_create(size_t in_element_size, size_t out_element_size)
+{
+    hc_data_t * data = malloc(sizeof(hc_data_t));
+    if (!data)
+        goto ERR_MALLOC;
+
+    /* FIXME Could be NULL thanks to realloc provided size is 0 */
+    data->max_size_log = DEFAULT_SIZE_LOG;
+    data->in_element_size = in_element_size;
+    data->out_element_size = out_element_size;
+    data->size = 0;
+    data->complete = 0;
+    data->command_id = 0; // TODO this could also be a busy mark in the socket
+    /* No callback needed in blocking code for instance */
+    data->complete_cb = NULL;
+
+    data->buffer = malloc((1 << data->max_size_log) * data->out_element_size);
+    if (!data->buffer)
+        goto ERR_BUFFER;
+
+    return data;
+
+ERR_BUFFER:
+    free(data);
+ERR_MALLOC:
+    return NULL;
+}
+
+void
+hc_data_free(hc_data_t * data)
+{
+    if (data->buffer)
+        free(data->buffer);
+    free(data);
+}
+
+int
+hc_data_ensure_available(hc_data_t * data, size_t count)
+{
+    size_t new_size_log = (data->size + count - 1 > 0)
+        ? log2(data->size + count - 1) + 1
+        : 0;
+    if (new_size_log > data->max_size_log) {
+        data->max_size_log = new_size_log;
+        data->buffer = realloc(data->buffer, (1 << new_size_log) * data->out_element_size);
+        if (!data->buffer)
+             return LIBHICNCTRL_FAILURE;
+    }
+     return LIBHICNCTRL_SUCCESS;
+}
+
+int
+hc_data_push_many(hc_data_t * data, const void * elements, size_t count)
+{
+    if (hc_data_ensure_available(data, count) < 0)
+         return LIBHICNCTRL_FAILURE;
+
+    memcpy(data->buffer + data->size * data->out_element_size, elements,
+            count * data->out_element_size);
+    data->size += count;
+     return LIBHICNCTRL_SUCCESS;
+}
+
+int
+hc_data_push(hc_data_t * data, const void * element)
+{
+    return hc_data_push_many(data, element, 1);
+}
+
+/**
+ *
+ * NOTE: This function make sure there is enough room available in the data
+ * structure.
+ */
+u8 *
+hc_data_get_next(hc_data_t * data)
+{
+    if (hc_data_ensure_available(data, 1) < 0)
+        return NULL;
+
+    return data->buffer + data->size * data->out_element_size;
+}
+
+int
+hc_data_set_callback(hc_data_t * data, data_callback_t cb, void * cb_data)
+{
+    data->complete_cb = cb;
+    data->complete_cb_data = cb_data;
+     return LIBHICNCTRL_SUCCESS;
+}
+
+int
+hc_data_set_complete(hc_data_t * data)
+{
+    data->complete = true;
+    if (data->complete_cb)
+        return data->complete_cb(data, data->complete_cb_data);
+     return LIBHICNCTRL_SUCCESS;
+}
+
+int
+hc_data_reset(hc_data_t * data)
+{
+    data->size = 0;
+     return LIBHICNCTRL_SUCCESS;
+}
+
+/******************************************************************************
+ * Control socket
+ ******************************************************************************/
+
+/**
+ * \brief Parse a connection URL into a sockaddr
+ * \param [in] url - URL
+ * \param [out] sa - Resulting struct sockaddr, expected zero'ed.
+ * \return 0 if parsing succeeded, a negative error value otherwise.
+ */
+int
+hc_sock_parse_url(const char * url, struct sockaddr * sa)
+{
+    /* FIXME URL parsing is currently not implemented */
+    assert(!url);
+
+    /*
+     * A temporary solution is to inspect the sa_family fields of the passed in
+     * sockaddr, which defaults to AF_UNSPEC (0) and thus creates an IPv4/TCP
+     * connection to localhost.
+     */
+    switch (sa->sa_family) {
+        case AF_UNSPEC:
+        case AF_INET:
+        {
+            struct sockaddr_in * sai = (struct sockaddr_in *)sa;
+            sai->sin_family = AF_INET;
+            sai->sin_port = htons(PORT);
+            sai->sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+            break;
+        }
+        case AF_INET6:
+        {
+            struct sockaddr_in6 * sai6 = (struct sockaddr_in6 *)sa;
+            sai6->sin6_family = AF_INET6;
+            sai6->sin6_port = htons(PORT);
+            sai6->sin6_addr = loopback_addr;
+            break;
+        }
+        default:
+             return LIBHICNCTRL_FAILURE;
+    }
+
+     return LIBHICNCTRL_SUCCESS;
+}
+
+hc_sock_t *
+hc_sock_create_url(const char * url)
+{
+    hc_sock_t * s = malloc(sizeof(hc_sock_t));
+    if (!s)
+        goto ERR_MALLOC;
+
+    s->url = url ? strdup(url) : NULL;
+
+    s->fd = socket(AF_INET, SOCK_STREAM, 0);
+    if (s->fd < 0)
+        goto ERR_SOCKET;
+
+    if (hc_sock_reset(s) < 0)
+        goto ERR_RESET;
+
+    return s;
+
+ERR_RESET:
+    close(s->fd);
+ERR_SOCKET:
+    free(s);
+ERR_MALLOC:
+    return NULL;
+}
+
+hc_sock_t *
+hc_sock_create(void)
+{
+    return hc_sock_create_url(NULL);
+}
+
+void
+hc_sock_free(hc_sock_t * s)
+{
+    if (s->url)
+        free(s->url);
+    close(s->fd);
+    free(s);
+}
+
+int
+hc_sock_set_nonblocking(hc_sock_t *s)
+{
+    return (fcntl(s->fd, F_SETFL, fcntl(s->fd, F_GETFL) | O_NONBLOCK) < 0);
+}
+
+int
+hc_sock_connect(hc_sock_t *s)
+{
+    struct sockaddr_storage ss = { 0 };
+
+    if (hc_sock_parse_url(s->url, (struct sockaddr *)&ss) < 0)
+        goto ERR_PARSE;
+
+    size_t size = ss.ss_family == AF_INET
+        ? sizeof(struct sockaddr_in)
+        : sizeof(struct sockaddr_in6);
+    if (connect(s->fd, (struct sockaddr *)&ss, size) < 0) //sizeof(struct sockaddr)) < 0)
+        goto ERR_CONNECT;
+
+     return LIBHICNCTRL_SUCCESS;
+
+ERR_CONNECT:
+ERR_PARSE:
+     return LIBHICNCTRL_FAILURE;
+}
+
+int
+hc_sock_send(hc_sock_t * s, hc_msg_t * msg, size_t msglen)
+{
+    return send(s->fd, msg, msglen, 0);
+}
+
+int
+hc_sock_get_available(hc_sock_t * s, u8 ** buffer, size_t * size)
+{
+    *buffer = s->buf + s->woff;
+    *size = RECV_BUFLEN - s->woff;
+
+     return LIBHICNCTRL_SUCCESS;
+}
+
+int
+hc_sock_recv(hc_sock_t * s, hc_data_t * data)
+{
+    int rc;
+
+    /*
+     * This condition should be ensured to guarantee correct processing of
+     * messages
+     */
+    assert(RECV_BUFLEN - s->woff > MIN_BUFLEN);
+
+    rc = recv(s->fd, s->buf + s->woff, RECV_BUFLEN - s->woff, 0);
+    if (rc == 0) {
+         return LIBHICNCTRL_FAILURE;
+        /* Connection has been closed */
+        // XXX
+    }
+    if (rc < 0) {
+        /* Error occurred */
+        // XXX check for EWOULDBLOCK;
+        // XXX
+         return LIBHICNCTRL_FAILURE;
+    }
+    s->woff += rc;
+     return LIBHICNCTRL_SUCCESS;
+}
+
+int
+hc_sock_process(hc_sock_t * s, hc_data_t * data,
+        int (*parse)(const u8 * src, u8 * dst))
+{
+    int err = 0;
+
+    /* We must have received at least one byte */
+    size_t available = s->woff - s->roff;
+
+    while(available > 0) {
+
+        if (s->remaining == 0) {
+            hc_msg_t * msg = (hc_msg_t*)(s->buf + s->roff);
+
+            /* We expect a message header */
+            if (available < sizeof(hc_msg_header_t))
+                break;
+
+            /* Sanity checks (might instead raise warnings) */
+            // TODO: sync check ?
+            assert((msg->hdr.messageType == RESPONSE_LIGHT) ||
+                   (msg->hdr.messageType == ACK_LIGHT) ||
+                   (msg->hdr.messageType == NACK_LIGHT));
+            //assert(msg->hdr.commandID == data->command_id); // FIXME
+            assert(msg->hdr.seqNum == s->recv_seq++);
+
+            s->remaining = msg->hdr.length;
+            if (s->remaining == 0) {
+                /*
+                 * The protocol expects all sequence number to be reset after
+                 * each transaction. We reset before running the callback in
+                 * case it triggers new exchanges.
+                 */
+                s->send_seq = HICN_CTRL_SEND_SEQ_INIT;
+                s->recv_seq = HICN_CTRL_RECV_SEQ_INIT;
+
+                // TODO : check before even sending ?
+                /* Complete message without payload */
+                // TODO : is this correct ? no error code ?
+                hc_data_set_complete(data);
+            }
+
+            available -= sizeof(hc_msg_header_t);
+            s->roff += sizeof(hc_msg_header_t);
+        } else {
+            /* We expect the complete payload, or at least a chunk of it */
+            size_t num_chunks = available / data->in_element_size;
+            if (num_chunks == 0)
+                break;
+            if (num_chunks > s->remaining)
+                num_chunks = s->remaining;
+
+            if (!parse) {
+                hc_data_push_many(data, s->buf + s->roff, num_chunks);
+            } else {
+                int rc;
+                rc = hc_data_ensure_available(data, num_chunks);
+                if (rc < 0)
+                     return LIBHICNCTRL_FAILURE;
+                for (int i = 0; i < num_chunks; i++) {
+                    u8 * dst = hc_data_get_next(data);
+                    if (!dst)
+                         return LIBHICNCTRL_FAILURE;
+
+                    rc = parse(s->buf + s->roff + i * data->in_element_size, dst);
+                    if (rc < 0)
+                        err = -1; /* FIXME we let the loop complete (?) */
+                    data->size++;
+                }
+            }
+
+
+            s->remaining -= num_chunks;
+            if (s->remaining == 0) {
+                /*
+                 * The protocol expects all sequence number to be reset after
+                 * each transaction. We reset before running the callback in
+                 * case it triggers new exchanges.
+                 */
+                s->send_seq = HICN_CTRL_SEND_SEQ_INIT;
+                s->recv_seq = HICN_CTRL_RECV_SEQ_INIT;
+
+                hc_data_set_complete(data);
+            }
+
+            available -= num_chunks * data->in_element_size;
+            s->roff += num_chunks * data->in_element_size;
+        }
+    }
+
+    /* Make sure there is enough remaining space in the buffer */
+    if (RECV_BUFLEN - s->woff < AVG_BUFLEN) {
+        /*
+         * There should be no overlap provided a sufficiently large BUFLEN, but
+         * who knows.
+         */
+        memmove(s->buf, s->buf + s->roff, s->woff - s->roff);
+        s->woff -= s->roff;
+        s->roff = 0;
+    }
+
+    return err;
+}
+
+int
+hc_sock_reset(hc_sock_t * s)
+{
+    s->roff = s->woff = 0;
+    s->send_seq = HICN_CTRL_SEND_SEQ_INIT;
+    s->recv_seq = HICN_CTRL_RECV_SEQ_INIT;
+    s->remaining = 0;
+     return LIBHICNCTRL_SUCCESS;
+}
+
+/******************************************************************************
+ * Command-specific structures and functions
+ ******************************************************************************/
+
+typedef int (*HC_PARSE)(const u8 *, u8 *);
+
+typedef struct {
+    hc_action_t cmd;
+    command_id cmd_id;
+    size_t size_in;
+    size_t size_out;
+    HC_PARSE parse;
+} hc_command_params_t;
+
+int
+hc_execute_command(hc_sock_t * s, hc_msg_t * msg, size_t msg_len,
+        hc_command_params_t * params, hc_data_t ** pdata)
+{
+    /* Sanity check */
+    switch(params->cmd) {
+        case ACTION_CREATE:
+            assert(params->size_in != 0); /* payload repeated */
+            assert(params->size_out == 0);
+            assert(params->parse == NULL);
+            break;
+        case ACTION_DELETE:
+            assert(params->size_in != 0); /* payload repeated */
+            assert(params->size_out == 0);
+            assert(params->parse == NULL);
+            break;
+        case ACTION_LIST:
+            assert(params->size_in != 0);
+            assert(params->size_out != 0);
+            assert(params->parse != NULL);
+            break;
+        case ACTION_SET:
+            assert(params->size_in != 0);
+            assert(params->size_out == 0);
+            assert(params->parse == NULL);
+            break;
+        default:
+             return LIBHICNCTRL_FAILURE;
+    }
+
+    hc_sock_reset(s);
+
+    /* XXX data will at least store the result (complete) */
+    hc_data_t * data = hc_data_create(params->size_in, params->size_out);
+    if (!data)
+        goto ERR_DATA;
+
+    hc_sock_send(s, msg, msg_len);
+    while(!data->complete) {
+        if (hc_sock_recv(s, data) < 0)
+            break;
+        if (hc_sock_process(s, data, params->parse) < 0) {
+            goto ERR_PROCESS;
+        }
+    }
+
+    if (pdata)
+        *pdata = data;
+
+     return LIBHICNCTRL_SUCCESS;
+
+ERR_PROCESS:
+    free(data);
+ERR_DATA:
+     return LIBHICNCTRL_FAILURE;
+}
+
+/* /!\ Please update constants in header file upon changes */
+int
+hc_url_snprintf(char * s, size_t size, int family,
+        const ip_address_t * ip_address, u16 port)
+{
+    char * cur = s;
+    int rc;
+
+    /* Other address are currently not supported */
+    if (!IS_VALID_FAMILY(family)) {
+        ERROR("Invalid family %d for IP address", family);
+        return -1;
+    }
+
+    rc = snprintf(cur, s + size - cur, "inet%c://",
+            (family == AF_INET) ? '4' : '6');
+    if (rc < 0)
+        return rc;
+    cur += rc;
+    if (size != 0 && cur >= s + size)
+        return cur - s;
+
+    rc = ip_address_snprintf(cur, s + size - cur, ip_address, family);
+    if (rc < 0)
+        return rc;
+    cur += rc;
+    if (size != 0 && cur >= s + size)
+        return cur - s;
+
+    rc = snprintf(cur, s + size - cur, ":");
+    if (rc < 0)
+        return rc;
+    cur += rc;
+    if (size != 0 && cur >= s + size)
+        return cur - s;
+
+    rc = snprintf(cur, s + size - cur, "%d", port);
+    if (rc < 0)
+        return rc;
+    cur += rc;
+    if (size != 0 && cur >= s + size)
+        return cur - s;
+
+    return cur - s;
+}
+
+/*----------------------------------------------------------------------------*
+ * Listeners
+ *----------------------------------------------------------------------------*/
+
+/* LISTENER CREATE */
+
+int
+hc_listener_create(hc_sock_t * s, hc_listener_t * listener)
+{
+    if (!IS_VALID_FAMILY(listener->family))
+         return LIBHICNCTRL_FAILURE;
+
+    if (!IS_VALID_CONNECTION_TYPE(listener->type))
+         return LIBHICNCTRL_FAILURE;
+
+    struct {
+        header_control_message hdr;
+        add_listener_command payload;
+    } msg = {
+        .hdr = {
+            .messageType = REQUEST_LIGHT,
+            .commandID = ADD_LISTENER,
+            .length = 1,
+            .seqNum = s->send_seq,
+        },
+        .payload = {
+            .address = {
+                .ipv6 = listener->local_addr.v6.as_in6addr,
+            },
+            .port = htons(listener->local_port),
+            .addressType = (u8)map_to_addr_type[listener->family],
+            .listenerMode = (u8)map_to_listener_mode[listener->type],
+            .connectionType = (u8)map_to_connection_type[listener->type],
+        }
+    };
+
+    snprintf(msg.payload.symbolic, NAME_LEN, "%s", listener->name);
+#ifdef __linux__
+    snprintf(msg.payload.interfaceName, INTERFACE_LEN, "%s", listener->interface_name);
+#endif
+
+    hc_command_params_t params = {
+        .cmd = ACTION_CREATE,
+        .cmd_id = ADD_LISTENER,
+        .size_in = sizeof(add_listener_command),
+        .size_out = 0,
+        .parse = NULL,
+    };
+
+    return hc_execute_command(s, (hc_msg_t*)&msg, sizeof(msg), &params, NULL);
+}
+
+/* LISTENER GET */
+
+int
+hc_listener_get(hc_sock_t *s, hc_listener_t * listener,
+        hc_listener_t ** listener_found)
+{
+    hc_data_t * listeners;
+
+    if (hc_listener_list(s, &listeners) < 0)
+        return LIBHICNCTRL_FAILURE;
+
+    /* Test */
+    if (hc_listener_find(listeners, listener, listener_found) < 0)
+        return LIBHICNCTRL_FAILURE;
+
+    hc_data_free(listeners);
+
+    return LIBHICNCTRL_SUCCESS;
+}
+
+
+/* LISTENER DELETE */
+
+int
+hc_listener_delete(hc_sock_t * s, hc_listener_t * listener)
+{
+    struct {
+        header_control_message hdr;
+        remove_listener_command payload;
+    } msg = {
+        .hdr = {
+            .messageType = REQUEST_LIGHT,
+            .commandID = REMOVE_LISTENER,
+            .length = 1,
+            .seqNum = s->send_seq,
+        },
+    };
+
+    if (listener->id) {
+        printf("Delete by ID\n");
+        snprintf(msg.payload.symbolicOrListenerid, NAME_LEN, "%d", listener->id);
+    } else if (*listener->name) {
+        printf("Delete by name %s\n", listener->name);
+        snprintf(msg.payload.symbolicOrListenerid, NAME_LEN, "%s", listener->name);
+    } else {
+        printf("Delete after search\n");
+        hc_listener_t * listener_found;
+        if (hc_listener_get(s, listener, &listener_found) < 0)
+            return LIBHICNCTRL_FAILURE;
+        if (!listener_found)
+            return LIBHICNCTRL_FAILURE;
+        printf("Delete listener ID=%d\n", listener_found->id);
+        snprintf(msg.payload.symbolicOrListenerid, NAME_LEN, "%d", listener_found->id);
+    }
+
+    hc_command_params_t params = {
+        .cmd = ACTION_DELETE,
+        .cmd_id = REMOVE_LISTENER,
+        .size_in = sizeof(remove_listener_command),
+        .size_out = 0,
+        .parse = NULL,
+    };
+
+    return hc_execute_command(s, (hc_msg_t*)&msg, sizeof(msg), &params, NULL);
+}
+
+/* LISTENER LIST */
+
+int
+hc_listener_list(hc_sock_t * s, hc_data_t ** pdata)
+{
+    struct {
+        header_control_message hdr;
+    } msg = {
+        .hdr = {
+            .messageType = REQUEST_LIGHT,
+            .commandID = LIST_LISTENERS,
+            .length = 0,
+            .seqNum = s->send_seq,
+        },
+    };
+
+    hc_command_params_t params = {
+        .cmd = ACTION_LIST,
+        .cmd_id = LIST_LISTENERS,
+        .size_in = sizeof(list_listeners_command),
+        .size_out = sizeof(hc_listener_t),
+        .parse = (HC_PARSE)hc_listener_parse,
+    };
+
+    return hc_execute_command(s, (hc_msg_t*)&msg, sizeof(msg), &params, pdata);
+}
+
+/* LISTENER VALIDATE */
+
+int
+hc_listener_validate(const hc_listener_t * listener)
+{
+    if (!IS_VALID_FAMILY(listener->family))
+         return LIBHICNCTRL_FAILURE;
+
+    if (!IS_VALID_CONNECTION_TYPE(listener->type))
+         return LIBHICNCTRL_FAILURE;
+
+    return LIBHICNCTRL_SUCCESS;
+}
+
+/* LISTENER CMP */
+
+int
+hc_listener_cmp(const hc_listener_t * l1, const hc_listener_t * l2)
+{
+    return ((l1->type == l2->type) &&
+            (l1->family == l2->family) &&
+            (ip_address_cmp(&l1->local_addr, &l2->local_addr, l1->family) == 0) &&
+            (l1->local_port == l2->local_port))
+        ? LIBHICNCTRL_SUCCESS
+        : LIBHICNCTRL_FAILURE;
+}
+
+/* LISTENER PARSE */
+
+int
+hc_listener_parse(void * in, hc_listener_t * listener)
+{
+    list_listeners_command * cmd = (list_listeners_command *)in;
+
+    if (!IS_VALID_LIST_LISTENERS_TYPE(cmd->encapType))
+         return LIBHICNCTRL_FAILURE;
+
+    hc_connection_type_t type = map_from_encap_type[cmd->encapType];
+    if (type == CONNECTION_TYPE_UNDEFINED)
+         return LIBHICNCTRL_FAILURE;
+
+    if (!IS_VALID_ADDR_TYPE(cmd->addressType))
+         return LIBHICNCTRL_FAILURE;
+
+    int family = map_from_addr_type[cmd->addressType];
+    if (!IS_VALID_FAMILY(family))
+         return LIBHICNCTRL_FAILURE;
+
+    *listener = (hc_listener_t) {
+        .id = cmd->connid,
+        .type = type,
+        .family = family,
+        .local_addr = UNION_CAST(cmd->address, ip_address_t),
+        .local_port = ntohs(cmd->port),
+    };
+    memset(listener->name, 0, NAME_LEN);
+    return LIBHICNCTRL_SUCCESS;
+}
+
+GENERATE_FIND(listener)
+
+/* LISTENER SNPRINTF */
+
+/* /!\ Please update constants in header file upon changes */
+int
+hc_listener_snprintf(char * s, size_t size, hc_listener_t * listener)
+{
+    char local[MAXSZ_HC_URL];
+    int rc;
+    rc = hc_url_snprintf(local, MAXSZ_HC_URL,
+         listener->family, &listener->local_addr, listener->local_port);
+    if (rc < 0)
+        return rc;
+
+    return snprintf(s, size+17, "%s %s",
+            local,
+            connection_type_str[listener->type]);
+}
+
+/*----------------------------------------------------------------------------*
+ * CONNECTION
+ *----------------------------------------------------------------------------*/
+
+/* CONNECTION CREATE */
+
+int
+hc_connection_create(hc_sock_t * s, hc_connection_t * connection)
+{
+    if (hc_connection_validate(connection) < 0)
+        return LIBHICNCTRL_FAILURE;
+
+    struct {
+        header_control_message hdr;
+        add_connection_command payload;
+    } msg = {
+        .hdr = {
+            .messageType = REQUEST_LIGHT,
+            .commandID = ADD_CONNECTION,
+            .length = 1,
+            .seqNum = s->send_seq,
+        },
+        .payload = {
+            /* we use IPv6 which is the longest address */
+            .remoteIp.ipv6 = connection->remote_addr.v6.as_in6addr,
+            .localIp.ipv6 = connection->local_addr.v6.as_in6addr,
+            .remotePort = htons(connection->remote_port),
+            .localPort = htons(connection->local_port),
+            .ipType = (u8)map_to_addr_type[connection->family],
+            .admin_state = connection->admin_state,
+#ifdef WITH_POLICY
+            .tags = connection->tags,
+#endif /* WITH_POLICY */
+            .connectionType = (u8)map_to_connection_type[connection->type],
+        }
+    };
+    snprintf(msg.payload.symbolic, NAME_LEN, "%s", connection->name);
+
+    hc_command_params_t params = {
+        .cmd = ACTION_CREATE,
+        .cmd_id = ADD_CONNECTION,
+        .size_in = sizeof(add_connection_command),
+        .size_out = 0,
+        .parse = NULL,
+    };
+
+    return hc_execute_command(s, (hc_msg_t*)&msg, sizeof(msg), &params, NULL);
+}
+
+/* CONNECTION GET */
+
+int
+hc_connection_get(hc_sock_t *s, hc_connection_t * connection,
+        hc_connection_t ** connection_found)
+{
+    hc_data_t * connections;
+
+    if (hc_connection_list(s, &connections) < 0)
+        return LIBHICNCTRL_FAILURE;
+
+    /* Test */
+    if (hc_connection_find(connections, connection, connection_found) < 0)
+        return LIBHICNCTRL_FAILURE;
+
+    hc_data_free(connections);
+
+    return LIBHICNCTRL_SUCCESS;
+}
+
+
+/* CONNECTION DELETE */
+
+int
+hc_connection_delete(hc_sock_t * s, hc_connection_t * connection)
+{
+    struct {
+        header_control_message hdr;
+        remove_connection_command payload;
+    } msg = {
+        .hdr = {
+            .messageType = REQUEST_LIGHT,
+            .commandID = REMOVE_CONNECTION,
+            .length = 1,
+            .seqNum = s->send_seq,
+        },
+    };
+
+    if (connection->id) {
+        printf("Delete by ID\n");
+        snprintf(msg.payload.symbolicOrConnid, NAME_LEN, "%d", connection->id);
+    } else if (*connection->name) {
+        printf("Delete by name %s\n", connection->name);
+        snprintf(msg.payload.symbolicOrConnid, NAME_LEN, "%s", connection->name);
+    } else {
+        printf("Delete after search\n");
+        hc_connection_t * connection_found;
+        if (hc_connection_get(s, connection, &connection_found) < 0)
+            return LIBHICNCTRL_FAILURE;
+        if (!connection_found)
+            return LIBHICNCTRL_FAILURE;
+        printf("Delete connection ID=%d\n", connection_found->id);
+        snprintf(msg.payload.symbolicOrConnid, NAME_LEN, "%d", connection_found->id);
+    }
+
+    hc_command_params_t params = {
+        .cmd = ACTION_DELETE,
+        .cmd_id = REMOVE_CONNECTION,
+        .size_in = sizeof(remove_connection_command),
+        .size_out = 0,
+        .parse = NULL,
+    };
+
+    return hc_execute_command(s, (hc_msg_t*)&msg, sizeof(msg), &params, NULL);
+}
+
+
+/* CONNECTION LIST */
+
+int
+hc_connection_list(hc_sock_t * s, hc_data_t ** pdata)
+{
+    struct {
+        header_control_message hdr;
+    } msg = {
+        .hdr = {
+            .messageType = REQUEST_LIGHT,
+            .commandID = LIST_CONNECTIONS,
+            .length = 0,
+            .seqNum = s->send_seq,
+        },
+    };
+
+    hc_command_params_t params = {
+        .cmd = ACTION_LIST,
+        .cmd_id = LIST_CONNECTIONS,
+        .size_in = sizeof(list_connections_command),
+        .size_out = sizeof(hc_connection_t),
+        .parse = (HC_PARSE)hc_connection_parse,
+    };
+
+    return hc_execute_command(s, (hc_msg_t*)&msg, sizeof(msg), &params, pdata);
+}
+
+/* CONNECTION VALIDATE */
+
+int
+hc_connection_validate(const hc_connection_t * connection)
+{
+    if (!IS_VALID_FAMILY(connection->family))
+         return LIBHICNCTRL_FAILURE;
+
+    if (!IS_VALID_CONNECTION_TYPE(connection->type))
+         return LIBHICNCTRL_FAILURE;
+
+    /* TODO assert both local and remote have the right family */
+
+    return LIBHICNCTRL_SUCCESS;
+}
+
+/* CONNECTION CMP */
+
+/*
+ * hICN light uses ports even for hICN connections, but their value is ignored.
+ * As connections are specific to hicn-light, we can safely use IP and ports for
+ * comparison independently of the face type.
+ */
+int hc_connection_cmp(const hc_connection_t * c1, const hc_connection_t * c2)
+{
+    return ((c1->type == c2->type) &&
+            (c1->family == c2->family) &&
+            (ip_address_cmp(&c1->local_addr, &c2->local_addr, c1->family) == 0) &&
+            (c1->local_port == c2->local_port) &&
+            (ip_address_cmp(&c1->remote_addr, &c2->remote_addr, c1->family) == 0) &&
+            (c1->remote_port == c2->remote_port))
+        ? LIBHICNCTRL_SUCCESS
+        : LIBHICNCTRL_FAILURE;
+}
+
+/* CONNECTION PARSE */
+
+int
+hc_connection_parse(void * in, hc_connection_t * connection)
+{
+    list_connections_command * cmd = (list_connections_command *)in;
+
+    if (!IS_VALID_LIST_CONNECTIONS_TYPE(cmd->connectionData.connectionType))
+         return LIBHICNCTRL_FAILURE;
+
+    hc_connection_type_t type = map_from_list_connections_type[cmd->connectionData.connectionType];
+    if (type == CONNECTION_TYPE_UNDEFINED)
+         return LIBHICNCTRL_FAILURE;
+
+    if (!IS_VALID_LIST_CONNECTIONS_STATE(cmd->state))
+         return LIBHICNCTRL_FAILURE;
+
+    hc_connection_state_t state = map_from_list_connections_state[cmd->state];
+    if (state == HC_CONNECTION_STATE_UNDEFINED)
+         return LIBHICNCTRL_FAILURE;
+
+    if (!IS_VALID_ADDR_TYPE(cmd->connectionData.ipType))
+         return LIBHICNCTRL_FAILURE;
+
+    int family = map_from_addr_type[cmd->connectionData.ipType];
+    if (!IS_VALID_FAMILY(family))
+         return LIBHICNCTRL_FAILURE;
+
+    *connection = (hc_connection_t) {
+        .id = cmd->connid,
+        .type = type,
+        .family = family,
+        .local_addr = UNION_CAST(cmd->connectionData.localIp, ip_address_t),
+        .local_port = ntohs(cmd->connectionData.localPort),
+        .remote_addr = UNION_CAST(cmd->connectionData.remoteIp, ip_address_t),
+        .remote_port = ntohs(cmd->connectionData.remotePort),
+        .admin_state = cmd->connectionData.admin_state,
+#ifdef WITH_POLICY
+        .tags = cmd->connectionData.tags,
+#endif /* WITH_POLICY */
+        .state = state,
+    };
+    snprintf(connection->name, NAME_LEN, "%s", cmd->connectionData.symbolic);
+    return LIBHICNCTRL_SUCCESS;
+}
+
+GENERATE_FIND(connection)
+
+/* CONNECTION SNPRINTF */
+
+/* /!\ Please update constants in header file upon changes */
+int
+hc_connection_snprintf(char * s, size_t size, const hc_connection_t * connection)
+{
+    char local[MAXSZ_HC_URL];
+    char remote[MAXSZ_HC_URL];
+    int rc;
+
+    // assert(connection->connection_state)
+
+    rc = hc_url_snprintf(local, MAXSZ_HC_URL, connection->family,
+            &connection->local_addr, connection->local_port);
+    if (rc < 0)
+        return rc;
+    rc = hc_url_snprintf(remote, MAXSZ_HC_URL, connection->family,
+            &connection->remote_addr, connection->remote_port);
+    if (rc < 0)
+        return rc;
+
+    return snprintf(s, size, "%s %s %s %s",
+            connection_state_str[connection->state],
+            local,
+            remote,
+            connection_type_str[connection->type]);
+}
+
+/* CONNECTION SET ADMIN STATE */
+
+int
+hc_connection_set_admin_state(hc_sock_t * s, const char * conn_id_or_name,
+        hc_connection_state_t admin_state)
+{
+    struct {
+        header_control_message hdr;
+        connection_set_admin_state_command payload;
+    } msg = {
+        .hdr = {
+            .messageType = REQUEST_LIGHT,
+            .commandID = CONNECTION_SET_ADMIN_STATE,
+            .length = 1,
+            .seqNum = s->send_seq,
+        },
+        .payload = {
+            .admin_state = admin_state,
+        },
+    };
+    snprintf(msg.payload.symbolicOrConnid, NAME_LEN, "%s", conn_id_or_name);
+
+    hc_command_params_t params = {
+        .cmd = ACTION_SET,
+        .cmd_id = CONNECTION_SET_ADMIN_STATE,
+        .size_in = sizeof(connection_set_admin_state_command),
+        .size_out = 0,
+        .parse = NULL,
+    };
+
+    return hc_execute_command(s, (hc_msg_t*)&msg, sizeof(msg), &params, NULL);
+}
+
+/*----------------------------------------------------------------------------*
+ * Routes
+ *----------------------------------------------------------------------------*/
+
+/* ROUTE CREATE */
+
+int
+hc_route_create(hc_sock_t * s, hc_route_t * route)
+{
+    if (!IS_VALID_FAMILY(route->family))
+         return LIBHICNCTRL_FAILURE;
+
+    struct {
+        header_control_message hdr;
+        add_route_command payload;
+    } msg = {
+        .hdr = {
+            .messageType = REQUEST_LIGHT,
+            .commandID = ADD_ROUTE,
+            .length = 1,
+            .seqNum = s->send_seq,
+        },
+        .payload = {
+            /* we use IPv6 which is the longest address */
+            .address.ipv6 = route->remote_addr.v6.as_in6addr,
+            .cost = route->cost,
+            .addressType = (u8)map_to_addr_type[route->family],
+            .len = route->len,
+        }
+    };
+
+    /*
+     * The route commands expects the ID (or name that we don't use) as part of
+     * the symbolicOrConnid attribute.
+     */
+    snprintf(msg.payload.symbolicOrConnid, NAME_LEN, "%d", route->face_id);
+
+    hc_command_params_t params = {
+        .cmd = ACTION_CREATE,
+        .cmd_id = ADD_ROUTE,
+        .size_in = sizeof(add_route_command),
+        .size_out = 0,
+        .parse = NULL,
+    };
+
+    return hc_execute_command(s, (hc_msg_t*)&msg, sizeof(msg), &params, NULL);
+}
+
+/* ROUTE DELETE */
+
+int
+hc_route_delete(hc_sock_t * s, hc_route_t * route)
+{
+    if (!IS_VALID_FAMILY(route->family))
+         return LIBHICNCTRL_FAILURE;
+
+    struct {
+        header_control_message hdr;
+        remove_route_command payload;
+    } msg = {
+        .hdr = {
+            .messageType = REQUEST_LIGHT,
+            .commandID = REMOVE_ROUTE,
+            .length = 1,
+            .seqNum = s->send_seq,
+        },
+        .payload = {
+            /* we use IPv6 which is the longest address */
+            .address.ipv6 = route->remote_addr.v6.as_in6addr,
+            .addressType = (u8)map_to_addr_type[route->family],
+            .len = route->len,
+        }
+    };
+
+    hc_command_params_t params = {
+        .cmd = ACTION_DELETE,
+        .cmd_id = REMOVE_ROUTE,
+        .size_in = sizeof(remove_route_command),
+        .size_out = 0,
+        .parse = NULL,
+    };
+
+    return hc_execute_command(s, (hc_msg_t*)&msg, sizeof(msg), &params, NULL);
+}
+
+/* ROUTE LIST */
+
+int
+hc_route_list(hc_sock_t * s, hc_data_t ** pdata)
+{
+    struct {
+        header_control_message hdr;
+    } msg = {
+        .hdr = {
+            .messageType = REQUEST_LIGHT,
+            .commandID = LIST_ROUTES,
+            .length = 0,
+            .seqNum = s->send_seq,
+        },
+    };
+
+    hc_command_params_t params = {
+        .cmd = ACTION_LIST,
+        .cmd_id = LIST_ROUTES,
+        .size_in = sizeof(list_routes_command),
+        .size_out = sizeof(hc_route_t),
+        .parse = (HC_PARSE)hc_route_parse,
+    };
+
+    return hc_execute_command(s, (hc_msg_t*)&msg, sizeof(msg), &params, pdata);
+}
+
+/* ROUTE PARSE */
+
+int
+hc_route_parse(void * in, hc_route_t * route)
+{
+    list_routes_command * cmd = (list_routes_command *) in;
+
+    if (!IS_VALID_ADDR_TYPE(cmd->addressType))
+         return LIBHICNCTRL_FAILURE;
+
+    int family = map_from_addr_type[cmd->addressType];
+    if (!IS_VALID_FAMILY(family))
+         return LIBHICNCTRL_FAILURE;
+
+    *route = (hc_route_t) {
+        .face_id = cmd->connid,
+        .family = family,
+        .remote_addr = UNION_CAST(cmd->address, ip_address_t),
+        .len = cmd->len,
+        .cost = cmd->cost,
+    };
+    return LIBHICNCTRL_SUCCESS;
+}
+
+/* ROUTE SNPRINTF */
+
+/* /!\ Please update constants in header file upon changes */
+int
+hc_route_snprintf(char * s, size_t size, hc_route_t * route)
+{
+    /* interface cost prefix length */
+
+    char prefix[MAXSZ_IP_ADDRESS];
+    int rc;
+
+    rc = ip_address_snprintf(prefix, MAXSZ_IP_ADDRESS, &route->remote_addr,
+            route->family);
+    if (rc < 0)
+        return rc;
+
+    return snprintf(s, size, "%*d %*d %s %*d",
+            MAXSZ_FACE_ID,
+            route->face_id,
+            MAXSZ_COST,
+            route->cost,
+            prefix,
+            MAXSZ_LEN,
+            route->len);
+}
+
+/*----------------------------------------------------------------------------*
+ * Face
+ *
+ * Face support is not directly available in hicn-light, but we can offer such
+ * an interface through a combination of listeners and connections. The code
+ * starts with some conversion functions between faces/listeners/connections.
+ *
+ * We also need to make sure that there always exist a (single) listener when a
+ * connection is created, and in the hICN face case, that there is a single
+ * connection attached to this listener.
+ *
+ *----------------------------------------------------------------------------*/
+
+/* FACE -> LISTENER */
+
+int
+hc_face_to_listener(const hc_face_t * face, hc_listener_t * listener)
+{
+    const face_t * f = &face->face;
+
+    switch(f->type) {
+        case FACE_TYPE_HICN_LISTENER:
+            break;
+        case FACE_TYPE_TCP_LISTENER:
+            break;
+        case FACE_TYPE_UDP_LISTENER:
+            break;
+        default:
+             return LIBHICNCTRL_FAILURE;
+    }
+    return LIBHICNCTRL_FAILURE; /* XXX Not implemented */
+}
+
+/* LISTENER -> FACE */
+
+int
+hc_listener_to_face(const hc_listener_t * listener, hc_face_t * face)
+{
+    return LIBHICNCTRL_FAILURE; /* XXX Not implemented */
+}
+
+/* FACE -> CONNECTION */
+
+int
+hc_face_to_connection(const hc_face_t * face, hc_connection_t * connection, bool generate_name)
+{
+    const face_t * f = &face->face;
+
+    switch(f->type) {
+        case FACE_TYPE_HICN:
+            /* FIXME truncations, collisions, ... */
+            *connection = (hc_connection_t) {
+                .type = CONNECTION_TYPE_HICN,
+                .family = f->params.hicn.family,
+                .local_addr = f->params.hicn.local_addr,
+                .local_port = 0,
+                .remote_addr = f->params.hicn.remote_addr,
+                .remote_port = 0,
+                .admin_state = face_state_to_connection_state(f->admin_state),
+                .state = face_state_to_connection_state(f->state),
+#ifdef WITH_POLICY
+                .tags = f->tags,
+#endif /* WITH_POLICY */
+            };
+            snprintf(connection->name, NAME_LEN, "%s",
+                    f->params.hicn.netdevice.name);
+            break;
+        case FACE_TYPE_TCP:
+            *connection = (hc_connection_t) {
+                .type = CONNECTION_TYPE_TCP,
+                .family = f->params.hicn.family,
+                .local_addr = f->params.tunnel.local_addr,
+                .local_port = f->params.tunnel.local_port,
+                .remote_addr = f->params.tunnel.remote_addr,
+                .remote_port = f->params.tunnel.remote_port,
+                .admin_state = face_state_to_connection_state(f->admin_state),
+                .state = face_state_to_connection_state(f->state),
+#ifdef WITH_POLICY
+                .tags = f->tags,
+#endif /* WITH_POLICY */
+            };
+            if (generate_name) {
+#ifdef __APPLE__
+                snprintf(connection->name, NAME_LEN, "tcp%d", arc4random() & 0xFF);
+#else
+                snprintf(connection->name, NAME_LEN, "tcp%ld", random() & 0xFF);
+#endif
+            } else {
+                memset(connection->name, 0, NAME_LEN);
+            }
+            break;
+        case FACE_TYPE_UDP:
+            *connection = (hc_connection_t) {
+                .type = CONNECTION_TYPE_UDP,
+                .family = AF_INET,
+                .local_addr = f->params.tunnel.local_addr,
+                .local_port = f->params.tunnel.local_port,
+                .remote_addr = f->params.tunnel.remote_addr,
+                .remote_port = f->params.tunnel.remote_port,
+                .admin_state = face_state_to_connection_state(f->admin_state),
+                .state = face_state_to_connection_state(f->state),
+#ifdef WITH_POLICY
+                .tags = f->tags,
+#endif /* WITH_POLICY */
+            };
+            if (generate_name) {
+#ifdef __APPLE__
+                snprintf(connection->name, NAME_LEN, "udp%d", arc4random() & 0xFF);
+#else
+                snprintf(connection->name, NAME_LEN, "udp%ld", random() & 0xFF);
+#endif
+            } else {
+                memset(connection->name, 0, NAME_LEN);
+            }
+            break;
+        default:
+             return LIBHICNCTRL_FAILURE;
+    }
+
+     return LIBHICNCTRL_SUCCESS;
+}
+
+/* CONNECTION -> FACE */
+
+int
+hc_connection_to_face(const hc_connection_t * connection, hc_face_t * face)
+{
+    switch (connection->type) {
+        case CONNECTION_TYPE_TCP:
+            *face = (hc_face_t) {
+                .id = connection->id,
+                .face = {
+                    .type = FACE_TYPE_TCP,
+                    .params.tunnel = {
+                        .family = connection->family,
+                        .local_addr = connection->local_addr,
+                        .local_port = connection->local_port,
+                        .remote_addr = connection->remote_addr,
+                        .remote_port = connection->remote_port,
+                    },
+                    .admin_state = connection_state_to_face_state(connection->admin_state),
+                    .state = connection_state_to_face_state(connection->state),
+#ifdef WITH_POLICY
+                    .tags = connection->tags,
+#endif /* WITH_POLICY */
+                },
+            };
+            break;
+        case CONNECTION_TYPE_UDP:
+            *face = (hc_face_t) {
+                .id = connection->id,
+                .face = {
+                    .type = FACE_TYPE_UDP,
+                    .params.tunnel = {
+                        .family = connection->family,
+                        .local_addr = connection->local_addr,
+                        .local_port = connection->local_port,
+                        .remote_addr = connection->remote_addr,
+                        .remote_port = connection->remote_port,
+                    },
+                    .admin_state = connection_state_to_face_state(connection->admin_state),
+                    .state = connection_state_to_face_state(connection->state),
+#ifdef WITH_POLICY
+                    .tags = connection->tags,
+#endif /* WITH_POLICY */
+                },
+            };
+            break;
+        case CONNECTION_TYPE_HICN:
+            *face = (hc_face_t) {
+                .id = connection->id,
+                .face = {
+                    .type = FACE_TYPE_HICN,
+                    .params.hicn = {
+                        .family = connection->family,
+                        .netdevice.index = NETDEVICE_UNDEFINED_INDEX, // XXX
+                        .local_addr = connection->local_addr,
+                        .remote_addr = connection->remote_addr,
+                    },
+                    .admin_state = connection_state_to_face_state(connection->admin_state),
+                    .state = connection_state_to_face_state(connection->state),
+#ifdef WITH_POLICY
+                    .tags = connection->tags,
+#endif /* WITH_POLICY */
+                },
+            };
+            break;
+        default:
+            return LIBHICNCTRL_FAILURE;
+    }
+    snprintf(face->name, NAME_LEN, "%s", connection->name);
+    return LIBHICNCTRL_SUCCESS;
+}
+
+/* CONNECTION -> LISTENER */
+
+int
+hc_connection_to_local_listener(const hc_connection_t * connection, hc_listener_t * listener)
+{
+    *listener = (hc_listener_t) {
+        .id = ~0,
+        .type = connection->type,
+        .family = connection->family,
+        .local_addr = connection->local_addr,
+        .local_port = connection->local_port,
+    };
+    return LIBHICNCTRL_SUCCESS;
+}
+
+/* FACE CREATE */
+
+int
+hc_face_create(hc_sock_t * s, hc_face_t * face)
+{
+    hc_listener_t listener;
+    hc_listener_t * listener_found;
+
+    hc_connection_t connection;
+    hc_connection_t * connection_found;
+
+    switch(face->face.type)
+    {
+        case FACE_TYPE_HICN:
+        case FACE_TYPE_TCP:
+        case FACE_TYPE_UDP:
+            if (hc_face_to_connection(face, &connection, true) < 0) {
+                ERROR("[hc_face_create] Could not convert face to connection.");
+                return LIBHICNCTRL_FAILURE;
+            }
+
+            /* Ensure we have a corresponding local listener */
+            if (hc_connection_to_local_listener(&connection, &listener) < 0) {
+                ERROR("[hc_face_create] Could not convert face to local listener.");
+                return LIBHICNCTRL_FAILURE;
+            }
+
+            if (hc_listener_get(s, &listener, &listener_found) < 0) {
+                ERROR("[hc_face_create] Could not retrieve listener");
+                return LIBHICNCTRL_FAILURE;
+            }
+
+            if (!listener_found) {
+                /* We need to create the listener if it does not exist */
+                if (hc_listener_create(s, &listener) < 0) {
+                    ERROR("[hc_face_create] Could not create listener.");
+                    return LIBHICNCTRL_FAILURE;
+                }
+            }
+
+            /* Create corresponding connection */
+            if (hc_connection_create(s, &connection) < 0) {
+                ERROR("[hc_face_create] Could not create connection.");
+                return LIBHICNCTRL_FAILURE;
+            }
+
+            /*
+             * Once the connection is created, we need to list all connections
+             * and compare with the current one to find the created face ID.
+             */
+            if (hc_connection_get(s, &connection, &connection_found) < 0) {
+                ERROR("[hc_face_create] Could not retrieve connection");
+                return LIBHICNCTRL_FAILURE;
+            }
+
+            if (!connection_found) {
+                ERROR("[hc_face_create] Could not find newly created connection.");
+                return LIBHICNCTRL_FAILURE;
+            }
+
+            face->id = connection_found->id;
+
+            break;
+
+        case FACE_TYPE_HICN_LISTENER:
+        case FACE_TYPE_TCP_LISTENER:
+        case FACE_TYPE_UDP_LISTENER:
+            if (hc_face_to_listener(face, &listener) < 0) {
+                ERROR("Could not convert face to listener.");
+                return LIBHICNCTRL_FAILURE;
+            }
+            if (hc_listener_create(s, &listener) < 0) {
+                ERROR("[hc_face_create] Could not create listener.");
+                return LIBHICNCTRL_FAILURE;
+            }
+            return LIBHICNCTRL_FAILURE;
+            break;
+        default:
+            ERROR("[hc_face_create] Unknwon face type.");
+            return LIBHICNCTRL_FAILURE;
+    };
+
+    return LIBHICNCTRL_SUCCESS;
+}
+
+int
+hc_face_get(hc_sock_t * s, hc_face_t * face, hc_face_t ** face_found)
+{
+    hc_listener_t listener;
+    hc_listener_t * listener_found;
+
+    hc_connection_t connection;
+    hc_connection_t * connection_found;
+
+    switch(face->face.type)
+    {
+        case FACE_TYPE_HICN:
+        case FACE_TYPE_TCP:
+        case FACE_TYPE_UDP:
+            if (hc_face_to_connection(face, &connection, false) < 0)
+                 return LIBHICNCTRL_FAILURE;
+            if (hc_connection_get(s, &connection, &connection_found) < 0)
+                 return LIBHICNCTRL_FAILURE;
+            if (!connection_found) {
+                *face_found = NULL;
+                return LIBHICNCTRL_SUCCESS;
+            }
+            hc_connection_to_face(connection_found, *face_found);
+            break;
+
+        case FACE_TYPE_HICN_LISTENER:
+        case FACE_TYPE_TCP_LISTENER:
+        case FACE_TYPE_UDP_LISTENER:
+            if (hc_face_to_listener(face, &listener) < 0)
+                 return LIBHICNCTRL_FAILURE;
+            if (hc_listener_get(s, &listener, &listener_found) < 0)
+                 return LIBHICNCTRL_FAILURE;
+            if (!listener_found) {
+                *face_found = NULL;
+                return LIBHICNCTRL_SUCCESS;
+            }
+            hc_listener_to_face(listener_found, *face_found);
+            break;
+
+        default:
+             return LIBHICNCTRL_FAILURE;
+    }
+
+    return LIBHICNCTRL_SUCCESS;
+
+}
+
+/* FACE DELETE */
+
+int
+hc_face_delete(hc_sock_t * s, hc_face_t * face)
+{
+    /* XXX We currently do not delete the listener */
+    hc_connection_t connection;
+    if (hc_face_to_connection(face, &connection, false) < 0) {
+        ERROR("[hc_face_delete] Could not convert face to connection.");
+        return LIBHICNCTRL_FAILURE;
+    }
+    return hc_connection_delete(s, &connection);
+}
+
+/* FACE LIST */
+
+int
+hc_face_list(hc_sock_t * s, hc_data_t ** pdata)
+{
+    hc_data_t * connection_data;
+    hc_face_t face;
+
+    if (hc_connection_list(s, &connection_data) < 0) {
+        ERROR("[hc_face_list] Could not list connections.");
+        return LIBHICNCTRL_FAILURE;
+    }
+
+    hc_data_t * face_data = hc_data_create(sizeof(hc_connection_t), sizeof(hc_face_t));
+    foreach_connection(c, connection_data) {
+        if (hc_connection_to_face(c, &face) < 0) {
+            ERROR("[hc_face_list] Could not convert connection to face.");
+            goto ERR;
+        }
+        hc_data_push(face_data, &face);
+    }
+
+    *pdata = face_data;
+    hc_data_free(connection_data);
+    return LIBHICNCTRL_SUCCESS;
+
+ERR:
+    hc_data_free(connection_data);
+    return LIBHICNCTRL_FAILURE;
+}
+
+/* /!\ Please update constants in header file upon changes */
+int
+hc_face_snprintf(char * s, size_t size, hc_face_t * face)
+{
+    return LIBHICNCTRL_SUCCESS;
+}
+
+int
+hc_face_set_admin_state(hc_sock_t * s, const char * conn_id_or_name, // XXX wrong identifier
+        face_state_t admin_state)
+{
+    return hc_connection_set_admin_state(s, conn_id_or_name, (hc_connection_state_t)admin_state);
+}
+
+/*----------------------------------------------------------------------------*
+ * Punting
+ *----------------------------------------------------------------------------*/
+
+int hc_punting_create(hc_sock_t * s, hc_punting_t * punting)
+{
+    if (hc_punting_validate(punting) < 0)
+        return LIBHICNCTRL_FAILURE;
+
+    struct {
+        header_control_message hdr;
+        add_punting_command payload;
+    } msg = {
+        .hdr = {
+            .messageType = REQUEST_LIGHT,
+            .commandID = ADD_PUNTING,
+            .length = 1,
+            .seqNum = s->send_seq,
+        },
+        .payload = {
+            /* we use IPv6 which is the longest address */
+            .address.ipv6 = punting->prefix.v6.as_in6addr,
+            .addressType = (u8)map_to_addr_type[punting->family],
+            .len = punting->prefix_len,
+        }
+    };
+    snprintf(msg.payload.symbolicOrConnid, NAME_LEN, "%d", punting->face_id);
+
+    hc_command_params_t params = {
+        .cmd = ACTION_CREATE,
+        .cmd_id = ADD_PUNTING,
+        .size_in = sizeof(add_punting_command),
+        .size_out = 0,
+        .parse = NULL,
+    };
+
+    return hc_execute_command(s, (hc_msg_t*)&msg, sizeof(msg), &params, NULL);
+}
+
+int hc_punting_get(hc_sock_t * s, hc_punting_t * punting, hc_punting_t ** punting_found)
+{
+    return LIBHICNCTRL_NOT_IMPLEMENTED;
+}
+
+int hc_punting_delete(hc_sock_t * s, hc_punting_t * punting)
+{
+    return LIBHICNCTRL_NOT_IMPLEMENTED;
+}
+
+int hc_punting_list(hc_sock_t * s, hc_data_t ** pdata)
+{
+    return LIBHICNCTRL_NOT_IMPLEMENTED;
+}
+
+int hc_punting_validate(const hc_punting_t * punting)
+{
+    if (!IS_VALID_FAMILY(punting->family))
+         return LIBHICNCTRL_FAILURE;
+
+    /*
+     * We might use the zero value to add punting on all faces but this is not
+     * (yet) implemented
+     */
+    if (punting->face_id == 0)
+        return LIBHICNCTRL_NOT_IMPLEMENTED;
+
+    return LIBHICNCTRL_SUCCESS;
+}
+
+int hc_punting_cmp(const hc_punting_t * p1, const hc_punting_t * p2)
+{
+    return ((p1->face_id == p2->face_id) &&
+            (p1->family == p2->family) &&
+            (ip_address_cmp(&p1->prefix, &p2->prefix, p1->family) == 0) &&
+            (p1->prefix_len == p2->prefix_len))
+        ? LIBHICNCTRL_SUCCESS
+        : LIBHICNCTRL_FAILURE;
+}
+
+int hc_punting_parse(void * in, hc_punting_t * punting)
+{
+    return LIBHICNCTRL_NOT_IMPLEMENTED;
+}
+
+int hc_punting_snprintf(char * s, size_t size, hc_punting_t * punting)
+{
+    return LIBHICNCTRL_NOT_IMPLEMENTED;
+}
+
+
+/*----------------------------------------------------------------------------*
+ * Cache
+ *----------------------------------------------------------------------------*/
+
+int
+hc_cache_set_store(hc_sock_t * s, int enabled)
+{
+    struct {
+        header_control_message hdr;
+        cache_store_command payload;
+    } msg = {
+        .hdr = {
+            .messageType = REQUEST_LIGHT,
+            .commandID = CACHE_STORE,
+            .length = 1,
+            .seqNum = s->send_seq,
+        },
+        .payload = {
+            .activate = enabled,
+        }
+    };
+
+    hc_command_params_t params = {
+        .cmd = ACTION_SET,
+        .cmd_id = CACHE_STORE,
+        .size_in = sizeof(cache_store_command),
+        .size_out = 0,
+        .parse = NULL,
+    };
+
+    return hc_execute_command(s, (hc_msg_t*)&msg, sizeof(msg), &params, NULL);
+}
+
+int
+hc_cache_set_serve(hc_sock_t * s, int enabled)
+{
+    struct {
+        header_control_message hdr;
+        cache_serve_command payload;
+    } msg = {
+        .hdr = {
+            .messageType = REQUEST_LIGHT,
+            .commandID = CACHE_SERVE,
+            .length = 1,
+            .seqNum = s->send_seq,
+        },
+        .payload = {
+            .activate = enabled,
+        }
+    };
+
+    hc_command_params_t params = {
+        .cmd = ACTION_SET,
+        .cmd_id = CACHE_SERVE,
+        .size_in = sizeof(cache_serve_command),
+        .size_out = 0,
+        .parse = NULL,
+    };
+
+    return hc_execute_command(s, (hc_msg_t*)&msg, sizeof(msg), &params, NULL);
+}
+
+
+/*----------------------------------------------------------------------------*
+ * Strategy
+ *----------------------------------------------------------------------------*/
+
+// per prefix
+int
+hc_strategy_set(hc_sock_t * s /* XXX */)
+{
+     return LIBHICNCTRL_SUCCESS;
+}
+
+/* How to retrieve that from the forwarder ? */
+static const char * strategies[] = {
+    "random",
+    "load_balancer",
+};
+
+#define ARRAY_SIZE(array) (sizeof(array) / sizeof(*array))
+
+int
+hc_strategy_list(hc_sock_t * s, hc_data_t ** data)
+{
+    *data = hc_data_create(0, sizeof(hc_strategy_t));
+
+    for (unsigned i = 0; i < ARRAY_SIZE(strategies); i++) {
+        hc_strategy_t * strategy = (hc_strategy_t*)hc_data_get_next(*data);
+        if (!strategy)
+             return LIBHICNCTRL_FAILURE;
+        snprintf(strategy->name, MAXSZ_HC_STRATEGY, "%s", strategies[i]);
+        (*data)->size++;
+    }
+
+    return LIBHICNCTRL_SUCCESS;
+}
+
+/* /!\ Please update constants in header file upon changes */
+int
+hc_strategy_snprintf(char * s, size_t size, hc_strategy_t * strategy)
+{
+    return snprintf(s, size, "%s", strategy->name);
+}
+
+/*----------------------------------------------------------------------------*
+ * WLDR
+ *----------------------------------------------------------------------------*/
+
+// per connection
+int
+hc_wldr_set(hc_sock_t * s /* XXX */)
+{
+     return LIBHICNCTRL_SUCCESS;
+}
+
+/*----------------------------------------------------------------------------*
+ * MAP-Me
+ *----------------------------------------------------------------------------*/
+
+int
+hc_mapme_set(hc_sock_t * s, int enabled)
+{
+     return LIBHICNCTRL_SUCCESS;
+}
+
+int
+hc_mapme_set_discovery(hc_sock_t * s, int enabled)
+{
+     return LIBHICNCTRL_SUCCESS;
+}
+
+int
+hc_mapme_set_timescale(hc_sock_t * s, double timescale)
+{
+     return LIBHICNCTRL_SUCCESS;
+}
+
+int
+hc_mapme_set_retx(hc_sock_t * s, double timescale)
+{
+     return LIBHICNCTRL_SUCCESS;
+}
+
+/*----------------------------------------------------------------------------*
+ * Policy
+ *----------------------------------------------------------------------------*/
+
+#ifdef WITH_POLICY
+
+/* POLICY CREATE */
+
+int
+hc_policy_create(hc_sock_t * s, hc_policy_t * policy)
+{
+    if (!IS_VALID_FAMILY(policy->family))
+         return LIBHICNCTRL_FAILURE;
+
+    struct {
+        header_control_message hdr;
+        add_policy_command payload;
+    } msg = {
+        .hdr = {
+            .messageType = REQUEST_LIGHT,
+            .commandID = ADD_POLICY,
+            .length = 1,
+            .seqNum = s->send_seq,
+        },
+        .payload = {
+            /* we use IPv6 which is the longest address */
+            .address.ipv6 = policy->remote_addr.v6.as_in6addr,
+            .addressType = (u8)map_to_addr_type[policy->family],
+            .len = policy->len,
+            .policy = policy->policy,
+        }
+    };
+
+    hc_command_params_t params = {
+        .cmd = ACTION_CREATE,
+        .cmd_id = ADD_POLICY,
+        .size_in = sizeof(add_policy_command),
+        .size_out = 0,
+        .parse = NULL,
+    };
+
+    return hc_execute_command(s, (hc_msg_t*)&msg, sizeof(msg), &params, NULL);
+}
+
+/* POLICY DELETE */
+
+int
+hc_policy_delete(hc_sock_t * s, hc_policy_t * policy)
+{
+    if (!IS_VALID_FAMILY(policy->family))
+         return LIBHICNCTRL_FAILURE;
+
+    struct {
+        header_control_message hdr;
+        remove_policy_command payload;
+    } msg = {
+        .hdr = {
+            .messageType = REQUEST_LIGHT,
+            .commandID = REMOVE_POLICY,
+            .length = 1,
+            .seqNum = s->send_seq,
+        },
+        .payload = {
+            /* we use IPv6 which is the longest address */
+            .address.ipv6 = policy->remote_addr.v6.as_in6addr,
+            .addressType = (u8)map_to_addr_type[policy->family],
+            .len = policy->len,
+        }
+    };
+
+    hc_command_params_t params = {
+        .cmd = ACTION_DELETE,
+        .cmd_id = REMOVE_POLICY,
+        .size_in = sizeof(remove_policy_command),
+        .size_out = 0,
+        .parse = NULL,
+    };
+
+    return hc_execute_command(s, (hc_msg_t*)&msg, sizeof(msg), &params, NULL);
+}
+
+/* POLICY LIST */
+
+int
+hc_policy_list(hc_sock_t * s, hc_data_t ** pdata)
+{
+    struct {
+        header_control_message hdr;
+    } msg = {
+        .hdr = {
+            .messageType = REQUEST_LIGHT,
+            .commandID = LIST_POLICIES,
+            .length = 0,
+            .seqNum = s->send_seq,
+        },
+    };
+
+    hc_command_params_t params = {
+        .cmd = ACTION_LIST,
+        .cmd_id = LIST_POLICIES,
+        .size_in = sizeof(list_policies_command),
+        .size_out = sizeof(hc_policy_t),
+        .parse = (HC_PARSE)hc_policy_parse,
+    };
+
+    return hc_execute_command(s, (hc_msg_t*)&msg, sizeof(msg), &params, pdata);
+}
+
+/* POLICY PARSE */
+
+int
+hc_policy_parse(void * in, hc_policy_t * policy)
+{
+    list_policies_command * cmd = (list_policies_command *) in;
+
+    if (!IS_VALID_ADDR_TYPE(cmd->addressType))
+         return LIBHICNCTRL_FAILURE;
+
+    int family = map_from_addr_type[cmd->addressType];
+    if (!IS_VALID_FAMILY(family))
+         return LIBHICNCTRL_FAILURE;
+
+    *policy = (hc_policy_t) {
+        .family = family,
+        .remote_addr = UNION_CAST(cmd->address, ip_address_t),
+        .len = cmd->len,
+        .policy = cmd->policy,
+    };
+    return LIBHICNCTRL_SUCCESS;
+}
+
+/* POLICY SNPRINTF */
+
+/* /!\ Please update constants in header file upon changes */
+int
+hc_policy_snprintf(char * s, size_t size, hc_policy_t * policy)
+{
+     return LIBHICNCTRL_SUCCESS;
+}
+
+#endif /* WITH_POLICY */
diff --git a/ctrl/libhicnctrl/src/cli.c b/ctrl/libhicnctrl/src/cli.c
new file mode 100644
index 000000000..70620a84f
--- /dev/null
+++ b/ctrl/libhicnctrl/src/cli.c
@@ -0,0 +1,381 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file cli.c
+ * \brief Command line interface
+ */
+#include <stdlib.h>
+#include <stdio.h>
+#include <unistd.h> // getopt
+
+#include <hicn/ctrl.h>
+
+#include "util/ip_address.h"
+#include "util/token.h"
+
+
+#define die(LABEL, MESSAGE) do {    \
+        printf(MESSAGE "\n");       \
+        rc = -1;                    \
+        goto ERR_ ## LABEL;         \
+} while(0)
+
+#define foreach_object  \
+    _(UNDEFINED)        \
+    _(LISTENER)         \
+    _(CONNECTION)       \
+    _(ROUTE)            \
+    _(STRATEGY)         \
+    _(N)
+
+typedef enum {
+#define _(x) OBJECT_ ## x,
+foreach_object
+#undef _
+} hc_object_t;
+
+void usage(const char * prog)
+{
+    fprintf(stderr, "Usage: %s [ [-d] [-l|-c|-r] PARAMETERS | [-L|-C|-R] ]\n", prog);
+    fprintf(stderr, "\n");
+    fprintf(stderr, "%s -l <NAME> <TYPE> <ADDRESS> <PORT> <INTERFACE_NAME>\n", prog);
+    fprintf(stderr, "    Create a listener on specified address and port.\n");
+    fprintf(stderr, "%s -dl ...\n", prog);
+    fprintf(stderr, "    Delete a listener...\n");
+    fprintf(stderr, "%s -L\n", prog);
+    fprintf(stderr, "    List all listeners.\n");
+    fprintf(stderr, "%s -c <TYPE> <LOCAL_ADDRESS> <LOCAL_PORT> <REMOTE_ADDRESS> <REMOTE_PORT>\n", prog);
+    fprintf(stderr, "    Create a connection on specified address and port.\n");
+    fprintf(stderr, "%s -dc ...\n", prog);
+    fprintf(stderr, "    Delete a connection...\n");
+    fprintf(stderr, "%s -C\n", prog);
+    fprintf(stderr, "    List all connections.\n");
+    fprintf(stderr, "%s -r ...>\n", prog);
+    fprintf(stderr, "    Create a route...\n");
+    fprintf(stderr, "%s -dr ...\n", prog);
+    fprintf(stderr, "    Delete a route...\n");
+    fprintf(stderr, "%s -R\n", prog);
+    fprintf(stderr, "    List all routes.\n");
+    fprintf(stderr, "%s -S\n", prog);
+    fprintf(stderr, "    List all availble forwarding strategies.\n");
+}
+
+typedef struct {
+    hc_action_t action;
+    hc_object_t object;
+    union {
+        hc_connection_t connection;
+        hc_listener_t listener;
+        hc_route_t route;
+    };
+} hc_command_t;
+
+int
+parse_options(int argc, char *argv[], hc_command_t * command)
+{
+    command->object = OBJECT_UNDEFINED;
+    command->action = ACTION_CREATE;
+    int nargs = 0; /* default for list */
+    int opt;
+    int family;
+
+    while ((opt = getopt(argc, argv, "dlcrLCRSh")) != -1) {
+        switch (opt) {
+            case 'd':
+                command->action = ACTION_DELETE;
+                break;
+            case 'l':
+                command->object = OBJECT_LISTENER;
+                nargs = 5;
+                break;
+            case 'c':
+                command->object = OBJECT_CONNECTION;
+                nargs = 6;
+                break;
+            case 'r':
+                command->object = OBJECT_ROUTE;
+                nargs = 0; // XXX
+                break;
+            case 'L':
+                command->action = ACTION_LIST;
+                command->object = OBJECT_LISTENER;
+                break;
+            case 'C':
+                command->action = ACTION_LIST;
+                command->object = OBJECT_CONNECTION;
+                break;
+            case 'R':
+                command->action = ACTION_LIST;
+                command->object = OBJECT_ROUTE;
+                break;
+            case 'S':
+                command->action = ACTION_LIST;
+                command->object = OBJECT_STRATEGY;
+                break;
+            default: /* "h" */
+                usage(argv[0]);
+                exit(EXIT_SUCCESS);
+        }
+    }
+
+    if (command->action == ACTION_DELETE)
+        nargs = 1;
+
+    /* Each option expects a different number of arguments */
+    if ((command->object == OBJECT_UNDEFINED) || (optind != argc - nargs)) {
+        //printf("Object requires %d arguments [optind=%d != args=%d - nargs=%d\n", nargs, optind, argc, nargs);
+        return -1;
+    }
+    if (nargs == 0)
+    return 0;
+
+    /* Parse and validate parameters for add/delete */
+    switch(command->object) {
+        case OBJECT_LISTENER:
+            switch(command->action) {
+                case ACTION_CREATE:
+                    /* NAME TYPE LOCAL_ADDRESS LOCAL_PORT */
+                    snprintf(command->listener.name, NAME_LEN, "%s", argv[optind++]);
+                    // conn type
+                    command->listener.type = connection_type_from_str(argv[optind++]);
+                    if (command->listener.type == CONNECTION_TYPE_UNDEFINED)
+                        goto ERR_PARAM;
+                    command->listener.family = ip_address_get_family(argv[optind]);
+                    if (!IS_VALID_FAMILY(command->listener.family))
+                        goto ERR_PARAM;
+                    if (ip_address_pton(argv[optind++], &command->listener.local_addr) < 0)
+                        goto ERR_PARAM;
+                    command->listener.local_port = atoi(argv[optind++]);
+#ifdef __linux__
+                    snprintf(command->listener.interface_name, INTERFACE_LEN, "%s", argv[optind++]);
+#endif
+                    break;
+                case ACTION_DELETE:
+                        goto ERR_COMMAND;
+                    break;
+                default:
+                        goto ERR_COMMAND;
+                    break;
+            }
+            break;
+        case OBJECT_CONNECTION:
+            switch(command->action) {
+                case ACTION_CREATE:
+                    /* NAME TYPE LOCAL_ADDRESS LOCAL_PORT REMOTE_ADDRESS REMOTE_PORT */
+                    snprintf(command->connection.name, NAME_LEN, "%s", argv[optind++]);
+                    command->connection.type = connection_type_from_str(argv[optind++]);
+                    if (command->connection.type == CONNECTION_TYPE_UNDEFINED)
+                        goto ERR_PARAM;
+                    command->connection.family = ip_address_get_family(argv[optind]);
+                    if (!IS_VALID_FAMILY(command->connection.family))
+                        goto ERR_PARAM;
+                    if (ip_address_pton(argv[optind++], &command->connection.local_addr) < 0)
+                        goto ERR_PARAM;
+                    command->connection.local_port = atoi(argv[optind++]);
+                    family = ip_address_get_family(argv[optind]);
+                    if (!IS_VALID_FAMILY(family) || (command->connection.family != family))
+                        goto ERR_PARAM;
+                    if (ip_address_pton(argv[optind++], &command->connection.remote_addr) < 0)
+                        goto ERR_PARAM;
+                    command->connection.remote_port = atoi(argv[optind++]);
+
+                    {
+                    char buf_connection[MAXSZ_HC_CONNECTION];
+                    if (hc_connection_snprintf(buf_connection, MAXSZ_HC_CONNECTION, &command->connection) >= MAXSZ_HC_CONNECTION)
+	                    printf("PARSED !!\n");
+                    else
+                        printf("PARSED %s\n", buf_connection);
+                    }
+
+                    break;
+                case ACTION_DELETE:
+                    goto ERR_COMMAND;
+                    break;
+                default:
+                    goto ERR_COMMAND;
+                    break;
+            }
+            break;
+        case OBJECT_ROUTE:
+            switch(command->action) {
+                case ACTION_CREATE:
+                    goto ERR_COMMAND;
+                    break;
+                case ACTION_DELETE:
+                    goto ERR_COMMAND;
+                    break;
+                default:
+                    goto ERR_COMMAND;
+                    break;
+            }
+            break;
+        case OBJECT_STRATEGY:
+            switch(command->action) {
+                case ACTION_LIST:
+                    break;
+                default:
+                    goto ERR_COMMAND;
+                    break;
+            }
+            break;
+        default:
+            goto ERR_COMMAND;
+            break;
+    }
+
+    return 0;
+
+ERR_PARAM:
+ERR_COMMAND:
+    return -1;
+}
+
+int main(int argc, char *argv[])
+{
+    hc_data_t * data;
+    int rc = 1;
+    hc_command_t command;
+    char buf_listener[MAXSZ_HC_LISTENER];
+    char buf_connection[MAXSZ_HC_CONNECTION];
+    char buf_route[MAXSZ_HC_ROUTE];
+    char buf_strategy[MAXSZ_HC_STRATEGY];
+
+    if (parse_options(argc, argv, &command) < 0)
+        die(OPTIONS, "Bad arguments");
+
+    hc_sock_t * s = hc_sock_create();
+    if (!s)
+        die(SOCKET, "Error creating socket.");
+
+    if (hc_sock_connect(s) < 0)
+        die(CONNECT, "Error connecting to the forwarder.");
+
+    switch(command.object) {
+        case OBJECT_LISTENER:
+            switch(command.action) {
+                case ACTION_CREATE:
+                    if (hc_listener_create(s, &command.listener) < 0)
+                        die(COMMAND, "Error creating listener");
+                    printf("OK\n");
+                    break;
+                case ACTION_DELETE:
+                    die(COMMAND, "Not implemented.");
+                    break;
+                case ACTION_LIST:
+                    if (hc_listener_list(s, &data) < 0)
+                        die(COMMAND, "Error getting listeners.");
+
+                    printf("Listeners:\n");
+                    foreach_listener(l, data) {
+                        if (hc_listener_snprintf(buf_listener, MAXSZ_HC_LISTENER+17, l) >= MAXSZ_HC_LISTENER)
+                            die(COMMAND, "Display error");
+                        printf("[%d] %s\n", l->id, buf_listener);
+                    }
+
+                    hc_data_free(data);
+                    break;
+                default:
+                    die(COMMAND, "Unsupported command for listener");
+                    break;
+            }
+            break;
+        case OBJECT_CONNECTION:
+            switch(command.action) {
+                case ACTION_CREATE:
+                    die(COMMAND, "Not implemented.");
+                    break;
+                case ACTION_DELETE:
+                    die(COMMAND, "Not implemented.");
+                    break;
+                case ACTION_LIST:
+                    if (hc_connection_list(s, &data) < 0)
+                        die(COMMAND, "Error getting connections.");
+
+                    printf("Connections:\n");
+                    foreach_connection(c, data) {
+                        if (hc_connection_snprintf(buf_connection, MAXSZ_HC_CONNECTION, c) >= MAXSZ_HC_CONNECTION)
+                            die(COMMAND, "Display error");
+                        printf("[%s] %s\n", c->name, buf_connection);
+                    }
+
+                    hc_data_free(data);
+                    break;
+                default:
+                    die(COMMAND, "Unsupported command for connection");
+                    break;
+            }
+            break;
+        case OBJECT_ROUTE:
+            switch(command.action) {
+                case ACTION_CREATE:
+                    die(COMMAND, "Not implemented.");
+                    break;
+                case ACTION_DELETE:
+                    die(COMMAND, "Not implemented.");
+                    break;
+                case ACTION_LIST:
+                    if (hc_route_list(s, &data) < 0)
+                        die(COMMAND, "Error getting routes.");
+
+                    printf("Routes:\n");
+                    foreach_route(r, data) {
+                        if (hc_route_snprintf(buf_route, MAXSZ_HC_ROUTE, r) >= MAXSZ_HC_ROUTE)
+                            die(COMMAND, "Display error");
+                        printf("%s\n", buf_route);
+                    }
+
+                    hc_data_free(data);
+                    break;
+                default:
+                    die(COMMAND, "Unsupported command for route");
+                    break;
+            }
+            break;
+        case OBJECT_STRATEGY:
+            switch(command.action) {
+                case ACTION_LIST:
+                    if (hc_strategy_list(s, &data) < 0)
+                        die(COMMAND, "Error getting routes.");
+
+                    printf("Forwarding strategies:\n");
+                    foreach_strategy(st, data) {
+                        if (hc_strategy_snprintf(buf_strategy, MAXSZ_HC_STRATEGY, st) >= MAXSZ_HC_STRATEGY)
+                            die(COMMAND, "Display error");
+                        printf("%s\n", buf_strategy);
+                    }
+
+                    hc_data_free(data);
+                    break;
+                default:
+                    die(COMMAND, "Unsupported command for strategy");
+                    break;
+            }
+            break;
+        default:
+           die(COMMAND, "Unsupported object");
+           break;
+    }
+
+
+    /* ROUTES */
+
+ERR_COMMAND:
+ERR_CONNECT:
+    hc_sock_free(s);
+ERR_SOCKET:
+ERR_OPTIONS:
+    return (rc < 0) ? EXIT_FAILURE : EXIT_SUCCESS;
+}
diff --git a/ctrl/libhicnctrl/src/face.c b/ctrl/libhicnctrl/src/face.c
new file mode 100644
index 000000000..9e0fbb597
--- /dev/null
+++ b/ctrl/libhicnctrl/src/face.c
@@ -0,0 +1,245 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file face.c
+ * \brief Implementation of face abstraction
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "face.h"
+#include "util/hash.h"
+#include "util/token.h"
+
+#define member_size(type, member) sizeof(((type *)0)->member)
+
+
+/* Netdevice */
+
+const char * netdevice_type_str[] = {
+#define _(x) [NETDEVICE_TYPE_ ## x] = STRINGIZE(x),
+foreach_netdevice_type
+#undef _
+};
+
+
+/* Face state */
+
+const char * face_state_str[] = {
+#define _(x) [FACE_STATE_ ## x] = STRINGIZE(x),
+foreach_face_state
+#undef _
+};
+
+
+/* Face type */
+
+const char * face_type_str[] = {
+#define _(x) [FACE_TYPE_ ## x] = STRINGIZE(x),
+foreach_face_type
+#undef _
+};
+
+
+/* Face */
+
+int
+face_initialize(face_t * face)
+{
+    bzero(face, sizeof(face_t)); /* 0'ed for hash */
+    return 1;
+}
+
+int
+face_initialize_udp(face_t * face, const ip_address_t * local_addr,
+        u16 local_port, const ip_address_t * remote_addr, u16 remote_port,
+        int family)
+{
+    *face = (face_t) {
+        .type = FACE_TYPE_UDP,
+        .params.tunnel = {
+            .family = family,
+            .local_addr = *local_addr,
+            .local_port = local_port,
+            .remote_addr = *remote_addr,
+            .remote_port = remote_port,
+        },
+    };
+    return 1;
+}
+
+int
+face_initialize_udp_sa(face_t * face, const struct sockaddr * local_addr,
+        const struct sockaddr * remote_addr)
+{
+    if (local_addr->sa_family != remote_addr->sa_family)
+        return -1;
+
+    switch (local_addr->sa_family) {
+        case AF_INET:
+            {
+            struct sockaddr_in *lsai = (struct sockaddr_in *)local_addr;
+            struct sockaddr_in *rsai = (struct sockaddr_in *)remote_addr;
+            *face = (face_t) {
+                .type = FACE_TYPE_UDP,
+                .params.tunnel = {
+                    .family = AF_INET,
+                    .local_addr.v4.as_inaddr = lsai->sin_addr,
+                    .local_port = ntohs(lsai->sin_port),
+                    .remote_addr.v4.as_inaddr = rsai->sin_addr,
+                    .remote_port = ntohs(rsai->sin_port),
+                },
+            };
+            }
+            break;
+        case AF_INET6:
+            {
+            struct sockaddr_in6 *lsai = (struct sockaddr_in6 *)local_addr;
+            struct sockaddr_in6 *rsai = (struct sockaddr_in6 *)remote_addr;
+            *face = (face_t) {
+                .type = FACE_TYPE_UDP,
+                .params.tunnel = {
+                    .family = AF_INET6,
+                    .local_addr.v6.as_in6addr = lsai->sin6_addr,
+                    .local_port = ntohs(lsai->sin6_port),
+                    .remote_addr.v6.as_in6addr = rsai->sin6_addr,
+                    .remote_port = ntohs(rsai->sin6_port),
+                },
+            };
+            }
+            break;
+        default:
+            return -1;
+    }
+    return 1;
+}
+
+face_t * face_create()
+{
+    face_t * face = calloc(1, sizeof(face_t)); /* 0'ed for hash */
+    return face;
+}
+
+face_t * face_create_udp(const ip_address_t * local_addr, u16 local_port,
+        const ip_address_t * remote_addr, u16 remote_port, int family)
+{
+    face_t * face = face_create();
+    if (face_initialize_udp(face, local_addr, local_port, remote_addr, remote_port, family) < 0)
+        goto ERR_INIT;
+    return face;
+
+ERR_INIT:
+    free(face);
+    return NULL;
+}
+
+face_t * face_create_udp_sa(const struct sockaddr * local_addr,
+        const struct sockaddr * remote_addr)
+{
+    face_t * face = face_create();
+    if (face_initialize_udp_sa(face, local_addr, remote_addr) < 0)
+        goto ERR_INIT;
+    return face;
+
+ERR_INIT:
+    free(face);
+    return NULL;
+}
+
+void face_free(face_t * face)
+{
+    free(face);
+}
+
+#define face_param_cmp(f1, f2, face_param_type)            \
+    memcmp(&f1->type, &f2->type,  \
+            member_size(face_params_t, face_param_type));
+
+/**
+ * \brief Compare two faces
+ * \param [in] f1 - First face
+ * \param [in] f2 - Second face
+ * \return whether faces are equal, ie both their types are parameters are
+ * equal.
+ *
+ * NOTE: this function implements a partial order.
+ */
+int
+face_cmp(const face_t * f1, const face_t * f2)
+{
+    if (f1->type != f2->type)
+        return false;
+
+    switch(f1->type) {
+        case FACE_TYPE_HICN:
+            return face_param_cmp(f1, f2, hicn);
+        case FACE_TYPE_TCP:
+        case FACE_TYPE_UDP:
+            return face_param_cmp(f1, f2, tunnel);
+        default:
+            return false;
+    }
+}
+
+hash_t
+face_hash(const face_t * face)
+{
+    /* Assuming the unused part of the struct is set to zero */
+    return hash_struct(face);
+}
+
+/* /!\ Please update constants in header file upon changes */
+size_t
+face_snprintf(char * s, size_t size, const face_t * face)
+{
+    switch(face->type) {
+        case FACE_TYPE_HICN:
+            return 0; // XXX Not implemented
+        case FACE_TYPE_TCP:
+        case FACE_TYPE_UDP:
+            {
+                char local[MAXSZ_IP_ADDRESS];
+                char remote[MAXSZ_IP_ADDRESS];
+
+                ip_address_snprintf(local, MAXSZ_IP_ADDRESS,
+                        &face->params.tunnel.local_addr,
+                        face->params.tunnel.family);
+                ip_address_snprintf(remote, MAXSZ_IP_ADDRESS,
+                        &face->params.tunnel.remote_addr,
+                        face->params.tunnel.family);
+
+                return snprintf(s, size, "%s [%s:%d -> %s:%d]",
+                        face_type_str[face->type],
+                        local,
+                        face->params.tunnel.local_port,
+                        remote,
+                        face->params.tunnel.remote_port);
+            }
+            break;
+        default:
+            return 0;
+    }
+
+}
+
+int
+face_set_tags(face_t * face, policy_tags_t tags)
+{
+    face->tags = tags;
+    return 1;
+}
diff --git a/ctrl/libhicnctrl/src/util/hash.h b/ctrl/libhicnctrl/src/util/hash.h
new file mode 100644
index 000000000..0bc48896b
--- /dev/null
+++ b/ctrl/libhicnctrl/src/util/hash.h
@@ -0,0 +1,246 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+ * \file hash.h
+ * \brief Simple non-cryptographic hash implementation.
+ *
+ * Two helpers are provided :
+ *    hash(buf, len)  : hash a buffer <buf> of length <len>
+ *    hash_struct(buf) : hash a buffer corresponding to an allocated struct
+ *
+ * This file consists in excerpts from Jenkins hash (public domain).
+ * http://www.burtleburtle.net/bob/c/lookup3.c
+ */
+#ifndef UTIL_HASH_H
+#define UTIL_HASH_H
+
+#if (defined(__BYTE_ORDER) && defined(__LITTLE_ENDIAN) && \
+     __BYTE_ORDER == __LITTLE_ENDIAN) || \
+    (defined(i386) || defined(__i386__) || defined(__i486__) || \
+     defined(__i586__) || defined(__i686__) || defined(vax) || defined(MIPSEL))
+# define HASH_LITTLE_ENDIAN 1
+# define HASH_BIG_ENDIAN 0
+#elif (defined(__BYTE_ORDER) && defined(__BIG_ENDIAN) && \
+       __BYTE_ORDER == __BIG_ENDIAN) || \
+      (defined(sparc) || defined(POWERPC) || defined(mc68000) || defined(sel))
+# define HASH_LITTLE_ENDIAN 0
+# define HASH_BIG_ENDIAN 1
+#else
+# define HASH_LITTLE_ENDIAN 0
+# define HASH_BIG_ENDIAN 0
+#endif
+
+#define hashsize(n) ((uint32_t)1<<(n))
+#define hashmask(n) (hashsize(n)-1)
+#define rot(x,k) (((x)<<(k)) | ((x)>>(32-(k))))
+
+#define mix(a,b,c) \
+{ \
+  a -= c;  a ^= rot(c, 4);  c += b; \
+  b -= a;  b ^= rot(a, 6);  a += c; \
+  c -= b;  c ^= rot(b, 8);  b += a; \
+  a -= c;  a ^= rot(c,16);  c += b; \
+  b -= a;  b ^= rot(a,19);  a += c; \
+  c -= b;  c ^= rot(b, 4);  b += a; \
+}
+
+#define final(a,b,c) \
+{ \
+  c ^= b; c -= rot(b,14); \
+  a ^= c; a -= rot(c,11); \
+  b ^= a; b -= rot(a,25); \
+  c ^= b; c -= rot(b,16); \
+  a ^= c; a -= rot(c,4);  \
+  b ^= a; b -= rot(a,14); \
+  c ^= b; c -= rot(b,24); \
+}
+
+static inline
+uint32_t hashlittle( const void *key, size_t length, uint32_t initval)
+{
+  uint32_t a,b,c;                                          /* internal state */
+  union { const void *ptr; size_t i; } u;     /* needed for Mac Powerbook G4 */
+
+  /* Set up the internal state */
+  a = b = c = 0xdeadbeef + ((uint32_t)length) + initval;
+
+  u.ptr = key;
+  if (HASH_LITTLE_ENDIAN && ((u.i & 0x3) == 0)) {
+    const uint32_t *k = (const uint32_t *)key;         /* read 32-bit chunks */
+
+    /*------ all but last block: aligned reads and affect 32 bits of (a,b,c) */
+    while (length > 12)
+    {
+      a += k[0];
+      b += k[1];
+      c += k[2];
+      mix(a,b,c);
+      length -= 12;
+      k += 3;
+    }
+
+    /*----------------------------- handle the last (probably partial) block */
+    /*
+     * "k[2]&0xffffff" actually reads beyond the end of the string, but
+     * then masks off the part it's not allowed to read.  Because the
+     * string is aligned, the masked-off tail is in the same word as the
+     * rest of the string.  Every machine with memory protection I've seen
+     * does it on word boundaries, so is OK with this.  But VALGRIND will
+     * still catch it and complain.  The masking trick does make the hash
+     * noticably faster for short strings (like English words).
+     */
+#ifndef VALGRIND
+
+    switch(length)
+    {
+    case 12: c+=k[2]; b+=k[1]; a+=k[0]; break;
+    case 11: c+=k[2]&0xffffff; b+=k[1]; a+=k[0]; break;
+    case 10: c+=k[2]&0xffff; b+=k[1]; a+=k[0]; break;
+    case 9 : c+=k[2]&0xff; b+=k[1]; a+=k[0]; break;
+    case 8 : b+=k[1]; a+=k[0]; break;
+    case 7 : b+=k[1]&0xffffff; a+=k[0]; break;
+    case 6 : b+=k[1]&0xffff; a+=k[0]; break;
+    case 5 : b+=k[1]&0xff; a+=k[0]; break;
+    case 4 : a+=k[0]; break;
+    case 3 : a+=k[0]&0xffffff; break;
+    case 2 : a+=k[0]&0xffff; break;
+    case 1 : a+=k[0]&0xff; break;
+    case 0 : return c;              /* zero length strings require no mixing */
+    }
+
+#else /* make valgrind happy */
+
+    k8 = (const uint8_t *)k;
+    switch(length)
+    {
+    case 12: c+=k[2]; b+=k[1]; a+=k[0]; break;
+    case 11: c+=((uint32_t)k8[10])<<16;  /* fall through */
+    case 10: c+=((uint32_t)k8[9])<<8;    /* fall through */
+    case 9 : c+=k8[8];                   /* fall through */
+    case 8 : b+=k[1]; a+=k[0]; break;
+    case 7 : b+=((uint32_t)k8[6])<<16;   /* fall through */
+    case 6 : b+=((uint32_t)k8[5])<<8;    /* fall through */
+    case 5 : b+=k8[4];                   /* fall through */
+    case 4 : a+=k[0]; break;
+    case 3 : a+=((uint32_t)k8[2])<<16;   /* fall through */
+    case 2 : a+=((uint32_t)k8[1])<<8;    /* fall through */
+    case 1 : a+=k8[0]; break;
+    case 0 : return c;
+    }
+
+#endif /* !valgrind */
+
+  } else if (HASH_LITTLE_ENDIAN && ((u.i & 0x1) == 0)) {
+    const uint16_t *k = (const uint16_t *)key;         /* read 16-bit chunks */
+    const uint8_t  *k8;
+
+    /*--------------- all but last block: aligned reads and different mixing */
+    while (length > 12)
+    {
+      a += k[0] + (((uint32_t)k[1])<<16);
+      b += k[2] + (((uint32_t)k[3])<<16);
+      c += k[4] + (((uint32_t)k[5])<<16);
+      mix(a,b,c);
+      length -= 12;
+      k += 6;
+    }
+
+    /*----------------------------- handle the last (probably partial) block */
+    k8 = (const uint8_t *)k;
+    switch(length)
+    {
+    case 12: c+=k[4]+(((uint32_t)k[5])<<16);
+             b+=k[2]+(((uint32_t)k[3])<<16);
+             a+=k[0]+(((uint32_t)k[1])<<16);
+             break;
+    case 11: c+=((uint32_t)k8[10])<<16;     /* fall through */
+    case 10: c+=k[4];
+             b+=k[2]+(((uint32_t)k[3])<<16);
+             a+=k[0]+(((uint32_t)k[1])<<16);
+             break;
+    case 9 : c+=k8[8];                      /* fall through */
+    case 8 : b+=k[2]+(((uint32_t)k[3])<<16);
+             a+=k[0]+(((uint32_t)k[1])<<16);
+             break;
+    case 7 : b+=((uint32_t)k8[6])<<16;      /* fall through */
+    case 6 : b+=k[2];
+             a+=k[0]+(((uint32_t)k[1])<<16);
+             break;
+    case 5 : b+=k8[4];                      /* fall through */
+    case 4 : a+=k[0]+(((uint32_t)k[1])<<16);
+             break;
+    case 3 : a+=((uint32_t)k8[2])<<16;      /* fall through */
+    case 2 : a+=k[0];
+             break;
+    case 1 : a+=k8[0];
+             break;
+    case 0 : return c;                     /* zero length requires no mixing */
+    }
+
+  } else {                        /* need to read the key one byte at a time */
+    const uint8_t *k = (const uint8_t *)key;
+
+    /*--------------- all but the last block: affect some 32 bits of (a,b,c) */
+    while (length > 12)
+    {
+      a += k[0];
+      a += ((uint32_t)k[1])<<8;
+      a += ((uint32_t)k[2])<<16;
+      a += ((uint32_t)k[3])<<24;
+      b += k[4];
+      b += ((uint32_t)k[5])<<8;
+      b += ((uint32_t)k[6])<<16;
+      b += ((uint32_t)k[7])<<24;
+      c += k[8];
+      c += ((uint32_t)k[9])<<8;
+      c += ((uint32_t)k[10])<<16;
+      c += ((uint32_t)k[11])<<24;
+      mix(a,b,c);
+      length -= 12;
+      k += 12;
+    }
+
+    /*-------------------------------- last block: affect all 32 bits of (c) */
+    switch(length)                   /* all the case statements fall through */
+    {
+    case 12: c+=((uint32_t)k[11])<<24;
+    case 11: c+=((uint32_t)k[10])<<16;
+    case 10: c+=((uint32_t)k[9])<<8;
+    case 9 : c+=k[8];
+    case 8 : b+=((uint32_t)k[7])<<24;
+    case 7 : b+=((uint32_t)k[6])<<16;
+    case 6 : b+=((uint32_t)k[5])<<8;
+    case 5 : b+=k[4];
+    case 4 : a+=((uint32_t)k[3])<<24;
+    case 3 : a+=((uint32_t)k[2])<<16;
+    case 2 : a+=((uint32_t)k[1])<<8;
+    case 1 : a+=k[0];
+             break;
+    case 0 : return c;
+    }
+  }
+
+  final(a,b,c);
+  return c;
+}
+
+/* Helpers */
+
+#define HASH_INITVAL 1
+#define hash(buf, len)  (hash_t)hashlittle(buf, len, HASH_INITVAL)
+#define hash_struct(buf) hash(buf, sizeof(buf))
+
+#endif /* UTIL_JENKINS_HASH_H */
diff --git a/ctrl/libhicnctrl/src/util/ip_address.h b/ctrl/libhicnctrl/src/util/ip_address.h
new file mode 100644
index 000000000..472cceeea
--- /dev/null
+++ b/ctrl/libhicnctrl/src/util/ip_address.h
@@ -0,0 +1,316 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file ip_address.h
+ * \brief IP address type support
+ */
+#ifndef UTIL_IP_ADDRESS_H
+#define UTIL_IP_ADDRESS_H
+
+#include <arpa/inet.h>  // inet_ntop
+#ifdef __APPLE__
+#include <libkern/OSByteOrder.h>
+#define __bswap_constant_32(x) OSSwapInt32(x)
+#include <machine/endian.h>
+#else
+#ifdef __ANDROID__
+#include <byteswap.h>
+#endif
+#include <endian.h>
+#endif
+#include <errno.h>
+#include <netdb.h> // struct addrinfo
+#include <netinet/in.h> // INET*_ADDRSTRLEN, IN*ADDR_LOOPBACK
+#include <stdlib.h>
+#include <string.h> // memset
+
+#include "types.h"
+
+
+#define bytes_to_bits(x) (x * 8)
+#define IPV6_ADDR_LEN 16	/* bytes */
+#define IPV4_ADDR_LEN 4		/* bytes */
+#define IPV6_ADDR_LEN_BITS bytes_to_bits(IPV6_ADDR_LEN)
+#define IPV4_ADDR_LEN_BITS bytes_to_bits(IPV4_ADDR_LEN)
+
+#define IP_MAX_ADDR_LEN IPV6_ADDR_LEN
+
+#define DUMMY_PORT 1234
+
+typedef union {
+    union {
+        struct in_addr as_inaddr;
+        u8 as_u8[4];
+        u16 as_u16[2];
+        u32 as_u32;
+    } v4;
+    union {
+        struct in6_addr as_in6addr;
+        u8 as_u8[16];
+        u16 as_u16[8];
+        u32 as_u32[4];
+        u64 as_u64[2];
+    } v6;
+    u8 buffer[IP_MAX_ADDR_LEN];
+    u8 as_u8[IP_MAX_ADDR_LEN];
+    u16 as_u16[IP_MAX_ADDR_LEN >> 1];
+    u32 as_u32[IP_MAX_ADDR_LEN >> 2];
+    u64 as_u64[IP_MAX_ADDR_LEN >> 3];
+} ip_address_t;
+
+#define MAXSZ_IP4_ADDRESS_ INET_ADDRSTRLEN - 1
+#define MAXSZ_IP6_ADDRESS_ INET6_ADDRSTRLEN - 1
+#define MAXSZ_IP_ADDRESS_ MAXSZ_IP6_ADDRESS_
+#define MAXSZ_IP4_ADDRESS MAXSZ_IP4_ADDRESS_ + 1
+#define MAXSZ_IP6_ADDRESS MAXSZ_IP6_ADDRESS_ + 1
+#define MAXSZ_IP_ADDRESS MAXSZ_IP_ADDRESS_ + 1
+
+
+typedef struct {
+  int family;
+  ip_address_t address;
+  u8 len;
+} ip_prefix_t;
+
+#define MAXSZ_PREFIX_ MAXSZ_IP_ADDRESS_ + 1 + 3
+#define MAXSZ_PREFIX MAXSZ_PREFIX_ + 1
+
+/* No htonl() with const */
+static const ip_address_t IPV4_LOOPBACK = {
+#if __BYTE_ORDER == __LITTLE_ENDIAN
+#ifdef __ANDROID__
+    .v4.as_inaddr.s_addr = bswap_32(INADDR_LOOPBACK),
+#else
+    .v4.as_inaddr.s_addr = __bswap_constant_32(INADDR_LOOPBACK),
+#endif
+#else
+    .v4.as_inaddr.s_addr = INADDR_LOOPBACK,
+#endif
+};
+
+static const ip_address_t IPV6_LOOPBACK = {
+    .v6.as_in6addr = IN6ADDR_LOOPBACK_INIT,
+};
+
+static const ip_address_t IPV4_ANY = {
+    .v4.as_inaddr.s_addr = INADDR_ANY,
+};
+
+static const ip_address_t IPV6_ANY = {
+    .v6.as_in6addr = IN6ADDR_ANY_INIT,
+};
+
+#define IP_ANY(family) (family == AF_INET) ? IPV4_ANY : IPV6_ANY
+
+#define MAX_PORT 1 << (8 * sizeof(u16))
+#define IS_VALID_PORT(x) ((x > 0) && (x < MAX_PORT))
+
+#define MAXSZ_PORT_ 5
+#define MAXSZ_PORT MAXSZ_PORT_ + 1
+
+#define IS_VALID_FAMILY(x) ((x == AF_INET) || (x == AF_INET6))
+
+static inline
+int
+ip_address_get_family (const char * ip_address)
+{
+  struct addrinfo hint, *res = NULL;
+  int rc;
+
+  memset (&hint, '\0', sizeof hint);
+
+  hint.ai_family = PF_UNSPEC;
+  hint.ai_flags = AI_NUMERICHOST;
+
+  rc = getaddrinfo (ip_address, NULL, &hint, &res);
+  if (rc)
+    {
+      return -1;
+    }
+  rc = res->ai_family;
+  freeaddrinfo (res);
+  return rc;
+}
+
+static inline
+int
+ip_address_len (const ip_address_t * ip_address, int family)
+{
+  return (family == AF_INET6) ? IPV6_ADDR_LEN :
+    (family == AF_INET) ? IPV4_ADDR_LEN : 0;
+}
+
+static inline
+int
+ip_address_ntop (const ip_address_t * ip_address, char *dst, const size_t len,
+		int family)
+{
+  const char * s = inet_ntop (family, ip_address->buffer, dst, len);
+  return (s ? 1 : -1);
+}
+
+/*
+ * Parse ip addresses in presentation format
+ */
+static inline
+int
+ip_address_pton (const char *ip_address_str, ip_address_t * ip_address)
+{
+  int pton_fd;
+  char *addr = strdup (ip_address_str);
+  int family;
+
+
+  family = ip_address_get_family (addr);
+
+  switch (family)
+    {
+    case AF_INET6:
+      pton_fd = inet_pton (AF_INET6, addr, &ip_address->buffer);
+      break;
+    case AF_INET:
+      pton_fd = inet_pton (AF_INET, addr, &ip_address->buffer);
+      break;
+    default:
+      goto ERR;
+    }
+
+  //   0 = not in presentation format
+  // < 0 = other error (use perror)
+  if (pton_fd <= 0)
+    {
+      goto ERR;
+    }
+
+  return 1;
+ERR:
+  free (addr);
+  return -1;
+}
+
+
+
+static inline
+int
+ip_address_snprintf(char * s, size_t size, const ip_address_t * ip_address, int family)
+{
+    size_t len = family == AF_INET ? INET_ADDRSTRLEN : INET6_ADDRSTRLEN;
+    const char * rc = inet_ntop (family, ip_address->buffer, s, len);
+    return rc ? strlen(rc) : -1;
+}
+
+
+static inline
+int
+ip_address_to_sockaddr(const ip_address_t * ip_address,
+		struct sockaddr *sockaddr_address, int family)
+{
+  struct sockaddr_in6 *tmp6 = (struct sockaddr_in6 *) sockaddr_address;
+  struct sockaddr_in *tmp4 = (struct sockaddr_in *) sockaddr_address;
+
+  switch (family)
+    {
+    case AF_INET6:
+      tmp6->sin6_family = AF_INET6;
+      tmp6->sin6_port = DUMMY_PORT;
+      tmp6->sin6_scope_id = 0;
+      memcpy (&tmp6->sin6_addr, ip_address->buffer, IPV6_ADDR_LEN);
+      break;
+    case AF_INET:
+      tmp4->sin_family = AF_INET;
+      tmp4->sin_port = DUMMY_PORT;
+      memcpy (&tmp4->sin_addr, ip_address->buffer, IPV4_ADDR_LEN);
+      break;
+    default:
+      return -1;
+    }
+
+  return 1;
+}
+
+static inline
+int
+ip_address_cmp(const ip_address_t * ip1, const ip_address_t * ip2, int family)
+{
+    return memcmp(ip1, ip2, ip_address_len(ip1, family));
+}
+
+/* Parse IP Prefixes in presentation format (in bits, separated by a slash) */
+static inline
+int
+ip_prefix_pton (const char *ip_address_str, ip_prefix_t * ip_prefix)
+{
+  int pton_fd;
+  char *p;
+  char *eptr;
+  char *addr = strdup (ip_address_str);
+
+  p = strchr (addr, '/');
+  if (!p)
+    {
+      ip_prefix->len = 0;		// until we get the ip address family
+    }
+  else
+    {
+      ip_prefix->len = strtoul (p + 1, &eptr, 10);
+      *p = 0;
+    }
+
+  ip_prefix->family = ip_address_get_family (addr);
+
+  switch (ip_prefix->family)
+    {
+    case AF_INET6:
+      if (ip_prefix->len > IPV6_ADDR_LEN_BITS)
+	goto ERR;
+      pton_fd = inet_pton (AF_INET6, addr, &ip_prefix->address.buffer);
+      break;
+    case AF_INET:
+      if (ip_prefix->len > IPV4_ADDR_LEN_BITS)
+	goto ERR;
+      pton_fd = inet_pton (AF_INET, addr, &ip_prefix->address.buffer);
+      break;
+    default:
+      goto ERR;
+    }
+
+  //   0 = not in presentation format
+  // < 0 = other error (use perror)
+  if (pton_fd <= 0)
+    {
+      goto ERR;
+    }
+
+  return 1;
+ERR:
+  free (addr);
+  return -1;
+}
+
+static inline
+int
+ip_prefix_ntop (const ip_prefix_t * ip_prefix, char *dst, size_t size)
+{
+  char ip_s[MAXSZ_IP_ADDRESS];
+  const char * s = inet_ntop (ip_prefix->family, ip_prefix->address.buffer, ip_s, MAXSZ_IP_ADDRESS);
+  if (!s)
+      return -1;
+  size_t n = snprintf(dst, size, "%s/%d", ip_s, ip_prefix->len);
+
+  return (n > 0 ? 1 : -1);
+}
+
+#endif /* UTIL_IP_ADDRESS_H */
diff --git a/ctrl/libhicnctrl/src/util/log.c b/ctrl/libhicnctrl/src/util/log.c
new file mode 100644
index 000000000..54943cf45
--- /dev/null
+++ b/ctrl/libhicnctrl/src/util/log.c
@@ -0,0 +1,126 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "log.h"
+
+#include <stdarg.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+log_conf_t log_conf = DEFAULT_LOG_CONF;
+
+#define FMT_DATETIME "%02d-%02d-%04d %02d:%02d:%02d"
+#define FMT_DATETIME_LEN 20
+#define snprintf_nowarn(...) (snprintf(__VA_ARGS__) < 0 ? abort() : (void)0)
+
+
+static char ts[FMT_DATETIME_LEN];
+
+static char *timestamp(void)
+{
+	time_t tv;
+	struct tm *tm;
+
+	time(&tv);
+	tm = localtime(&tv);
+
+        snprintf_nowarn(ts, FMT_DATETIME_LEN, FMT_DATETIME, tm->tm_mday,
+                tm->tm_mon + 1, tm->tm_year + 1900, tm->tm_hour, tm->tm_min,
+                tm->tm_sec);
+	return ts;
+}
+
+void _log_va(int level, const char *fmt, va_list ap)
+{
+	char *prefix;
+  FILE *f = log_conf.log_file ? log_conf.log_file : stdout;
+
+#if 0
+	if (!conf.log_system)
+		return;
+#endif
+
+	if (level > log_conf.log_level)
+		return;
+
+	switch (level) {
+		case LOG_FATAL:
+			prefix = "FATAL: ";
+			break;
+		case LOG_ERROR:
+			prefix = "ERROR: ";
+			break;
+		case LOG_WARN:
+			prefix = "WARNING: ";
+			break;
+		case LOG_INFO:
+			prefix = "";
+			break;
+		case LOG_DEBUG:
+			prefix = "DEBUG: ";
+			break;
+		case LOG_TRACE:
+			prefix = "TRACE: ";
+			break;
+		default:
+			prefix = "";
+			break;
+	}
+
+	fprintf(f, "%s %s", timestamp(), prefix);
+	vfprintf(f, fmt, ap);
+	fprintf(f, "\n");
+#ifdef DEBUG
+	fflush(f);
+#endif
+}
+
+void _log(int level, const char *fmt, ...)
+{
+	va_list ap;
+
+	va_start(ap, fmt);
+	_log_va(level, fmt, ap);
+	va_end(ap);
+}
+
+#ifdef HAVE_BACKTRACE
+#include <execinfo.h>
+
+void print_trace(void)
+{
+	void *array[32];
+	size_t size;
+
+	size = backtrace(array, 32);
+	fflush(conf.log_file);
+	backtrace_symbols_fd(array, size, fileno(conf.log_file));
+}
+#endif
+
+void fatal(char *fmt, ...)
+{
+	va_list ap;
+
+	va_start(ap, fmt);
+	_log_va(LOG_FATAL, fmt, ap);
+	va_end(ap);
+
+#ifdef HAVE_BACKTRACE
+	print_trace();
+#endif
+
+	exit(200);
+}
diff --git a/ctrl/libhicnctrl/src/util/log.h b/ctrl/libhicnctrl/src/util/log.h
new file mode 100644
index 000000000..f1cafba47
--- /dev/null
+++ b/ctrl/libhicnctrl/src/util/log.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef UTIL_LOG_H
+#define UTIL_LOG_H
+
+#include <stdarg.h> // va_*
+#include <stdio.h> // FILE
+#include <time.h> // time, localtime
+
+#define LOG_FATAL 0
+#define LOG_ERROR 1
+#define LOG_WARN  2
+#define LOG_INFO  3
+#define LOG_DEBUG 4
+#define LOG_TRACE 5
+
+typedef struct {
+  int log_level;
+  int debug;
+  FILE * log_file;
+} log_conf_t;
+
+#define DEFAULT_LOG_CONF {      \
+    .log_level = LOG_DEBUG,     \
+    .debug = 0,                 \
+    .log_file = NULL,           \
+};
+
+extern log_conf_t log_conf;
+
+#define WITH_DEBUG(BLOCK)                       \
+    if (log_conf.log_level >= LOG_DEBUG)        \
+        BLOCK
+
+#define FATAL(fmt, ...) (_log(LOG_FATAL, fmt, ##__VA_ARGS__ ))
+#define ERROR(fmt, ...) (_log(LOG_ERROR, fmt, ##__VA_ARGS__ ))
+#define WARN(fmt,  ...) (_log(LOG_WARN,  fmt, ##__VA_ARGS__ ))
+#define INFO(fmt,  ...) (_log(LOG_INFO,  fmt, ##__VA_ARGS__ ))
+#define DEBUG(fmt, ...) (_log(LOG_DEBUG, fmt, ##__VA_ARGS__ ))
+#define TRACE(fmt, ...) (_log(LOG_TRACE, fmt, ##__VA_ARGS__ ))
+
+void _log_va(int level, const char *fmt, va_list ap);
+
+void _log(int level, const char *fmt, ...);
+
+void fatal(char *fmt, ...);
+
+#ifdef HAVE_BACKTRACE
+#include <execinfo.h>
+void print_trace(void);
+#endif
+
+#endif // UTIL_LOG_H
diff --git a/ctrl/libhicnctrl/src/util/policy.c b/ctrl/libhicnctrl/src/util/policy.c
new file mode 100644
index 000000000..90dbc72cd
--- /dev/null
+++ b/ctrl/libhicnctrl/src/util/policy.c
@@ -0,0 +1,53 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file policy.h
+ * \brief Implementation of policy description
+ */
+
+#include <stdio.h>
+#include "policy.h"
+
+const char * policy_tag_str[] = {
+    #define _(x) [POLICY_TAG_ ## x] = STRINGIZE(x),
+    foreach_policy_tag
+    #undef _
+};
+
+const char * policy_state_str[] = {
+    #define _(x) [POLICY_STATE_ ## x] = STRINGIZE(x),
+    foreach_policy_state
+    #undef _
+};
+
+int
+policy_tag_state_snprintf(char * s, size_t size, const policy_tag_state_t * tag_state)
+{
+    char *cur = s;
+    int rc;
+
+    if (tag_state->disabled > 1)
+        return -1;
+
+    rc = snprintf(cur, s + size - cur, "%s%s", (tag_state->disabled == 1) ? "!" : "", policy_state_str[tag_state->state]);
+    if (rc < 0)
+        return rc;
+    cur += rc;
+    if (size != 0 && cur >= s + size)
+        return cur - s;
+
+    return cur - s;
+}
diff --git a/ctrl/libhicnctrl/src/util/policy.h b/ctrl/libhicnctrl/src/util/policy.h
new file mode 100644
index 000000000..231e53f73
--- /dev/null
+++ b/ctrl/libhicnctrl/src/util/policy.h
@@ -0,0 +1,266 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file policy.h
+ * \brief Policy description
+ */
+#ifndef HICN_POLICY_H
+#define HICN_POLICY_H
+
+#include <netinet/in.h> // INET*_ADDRSTRLEN
+#include "token.h"
+
+/* POLICY TAG */
+
+#define foreach_policy_tag      \
+    /* Interface type */        \
+    _(WIRED)                    \
+    _(WIFI)                     \
+    _(CELLULAR)                 \
+    /* QoS */                   \
+    _(BEST_EFFORT)              \
+    _(REALTIME)                 \
+    _(MULTIPATH)                \
+    /* Security */              \
+    _(TRUSTED)
+
+typedef enum {
+#define _(x) POLICY_TAG_ ## x,
+foreach_policy_tag
+#undef _
+    POLICY_TAG_N
+} policy_tag_t;
+
+#define MAXSZ_POLICY_TAG_ 11
+#define MAXSZ_POLICY_TAG MAXSZ_POLICY_TAG_ + 1
+
+extern const char * policy_tag_str[];
+
+
+/* POLICY_TAGS */
+
+typedef int policy_tags_t;
+
+static inline
+void policy_tags_add(policy_tags_t * tags, policy_tag_t tag)
+{
+    *tags |= (1 << tag);
+}
+
+static inline
+void policy_tags_remove(policy_tags_t * tags, policy_tag_t tag)
+{
+    *tags &= ~(1 << tag);
+}
+
+static inline
+int policy_tags_has(policy_tags_t tags, policy_tag_t tag)
+{
+    return tags & (1 << tag);
+}
+
+#define POLICY_TAGS_EMPTY 0
+
+
+/* POLICY STATE */
+
+/* TODO vs. weight */
+
+#define foreach_policy_state    \
+    _(NEUTRAL)                  \
+    _(REQUIRE)                  \
+    _(PREFER)                   \
+    _(AVOID)                    \
+    _(PROHIBIT)                 \
+    _(N)
+
+typedef enum {
+#define _(x) POLICY_STATE_ ## x,
+foreach_policy_state
+#undef _
+} policy_state_t;
+
+#define MAXSZ_POLICY_STATE_ 8
+#define MAXSZ_POLICY_STATE MAXSZ_POLICY_STATE_ + 1
+
+extern const char * policy_state_str[];
+
+
+/* POLICY TAG STATE */
+
+typedef struct {
+    policy_state_t state;
+    uint8_t disabled;
+} policy_tag_state_t;
+
+#define MAXSZ_POLICY_TAG_STATE_ 8
+#define MAXSZ_POLICY_TAG_STATE MAXSZ_POLICY_TAG_STATE_ + 1
+
+int policy_tag_state_snprintf(char * s, size_t size, const policy_tag_state_t * tag_state);
+
+
+/* INTERFACE STATS */
+
+typedef struct {
+    float throughput;
+    float latency;
+    float loss_rate;
+} interface_stats_t;
+
+#define INTERFACE_STATS_NONE {                          \
+    .throughput = 0,                                    \
+    .latency = 0,                                       \
+    .loss_rate = 0,                                     \
+}
+
+
+/* POLICY STATS */
+
+typedef struct {
+    interface_stats_t wired;
+    interface_stats_t wifi;
+    interface_stats_t cellular;
+    interface_stats_t all;
+} policy_stats_t;
+
+#define POLICY_STATS_NONE {                     \
+    .wired    = INTERFACE_STATS_NONE,           \
+    .wifi     = INTERFACE_STATS_NONE,           \
+    .cellular = INTERFACE_STATS_NONE,           \
+    .all      = INTERFACE_STATS_NONE,           \
+}
+
+typedef struct {
+    uint32_t num_packets;
+    uint32_t num_bytes;
+    uint32_t num_losses;
+    uint32_t latency_idle;
+} interface_counters_t;
+
+#define INTERFACE_COUNTERS_NONE {               \
+    .num_packets = 0,                           \
+    .num_bytes = 0,                             \
+    .num_losses = 0,                            \
+    .latency_idle = 0,                          \
+}
+
+typedef struct {
+    interface_counters_t wired;
+    interface_counters_t wifi;
+    interface_counters_t cellular;
+    interface_counters_t all;
+    uint64_t last_update;
+} policy_counters_t;
+
+#define POLICY_COUNTERS_NONE (policy_counters_t) {      \
+    .wired    = INTERFACE_COUNTERS_NONE,                \
+    .wifi     = INTERFACE_COUNTERS_NONE,                \
+    .cellular = INTERFACE_COUNTERS_NONE,                \
+    .all      = INTERFACE_COUNTERS_NONE,                \
+    .last_update = 0,                                   \
+}
+
+/* POLICY */
+
+#define APP_NAME_LEN 128
+
+typedef struct {
+    char app_name[APP_NAME_LEN];
+    policy_tag_state_t tags[POLICY_TAG_N];
+    policy_stats_t stats;
+} policy_t;
+
+static const policy_t POLICY_NONE = {
+    .app_name = { 0 },
+    .tags = {
+#define _(x) [POLICY_TAG_ ## x] = { POLICY_STATE_NEUTRAL, 0 },
+foreach_policy_tag
+#undef _
+    },
+    .stats = POLICY_STATS_NONE,
+};
+
+
+/* POLICY DESCRIPTION */
+
+#define PFX_STRLEN 4 /* eg. /128 */
+
+typedef struct {
+    int family;
+    union {
+        char ipv4_prefix[INET_ADDRSTRLEN + PFX_STRLEN];
+        char ipv6_prefix[INET6_ADDRSTRLEN + PFX_STRLEN];
+    };
+    policy_t policy;
+} policy_description_t;
+
+/* DEFAULT POLICY */
+
+static const policy_description_t default_policy[] = {
+    {
+        .family = AF_INET6,
+        .ipv6_prefix = "a001::/16",
+        .policy = {
+            .app_name = "Webex",
+            .tags  = {
+                [POLICY_TAG_WIRED]       = { POLICY_STATE_PREFER,   0 },
+                [POLICY_TAG_WIFI]        = { POLICY_STATE_NEUTRAL,  0 },
+                [POLICY_TAG_CELLULAR]    = { POLICY_STATE_AVOID,    1 },
+                [POLICY_TAG_BEST_EFFORT] = { POLICY_STATE_PROHIBIT, 0 },
+                [POLICY_TAG_REALTIME]    = { POLICY_STATE_REQUIRE,  1 },
+                [POLICY_TAG_MULTIPATH]   = { POLICY_STATE_AVOID,    0 },
+                [POLICY_TAG_TRUSTED]     = { POLICY_STATE_REQUIRE,  1 },
+            },
+            .stats = POLICY_STATS_NONE,
+        },
+    },
+    {
+        .family = AF_INET6,
+        .ipv6_prefix = "b001::/16",
+        .policy = {
+            .app_name = "Video Streaming",
+            .tags  = {
+                [POLICY_TAG_WIRED]       = { POLICY_STATE_PREFER,   0 },
+                [POLICY_TAG_WIFI]        = { POLICY_STATE_NEUTRAL,  0 },
+                [POLICY_TAG_CELLULAR]    = { POLICY_STATE_NEUTRAL,  0 },
+                [POLICY_TAG_BEST_EFFORT] = { POLICY_STATE_PROHIBIT, 0 },
+                [POLICY_TAG_REALTIME]    = { POLICY_STATE_REQUIRE,  0 },
+                [POLICY_TAG_MULTIPATH]   = { POLICY_STATE_AVOID,    0 },
+                [POLICY_TAG_TRUSTED]     = { POLICY_STATE_PREFER,   0 },
+            },
+            .stats = POLICY_STATS_NONE,
+        },
+    },
+    {
+        .family = AF_INET6,
+        .ipv6_prefix = "c001::/16",
+        .policy = {
+            .app_name = "*",
+            .tags  = {
+                [POLICY_TAG_WIRED]       = { POLICY_STATE_PREFER,   0 },
+                [POLICY_TAG_WIFI]        = { POLICY_STATE_NEUTRAL,  0 },
+                [POLICY_TAG_CELLULAR]    = { POLICY_STATE_NEUTRAL,  0 },
+                [POLICY_TAG_BEST_EFFORT] = { POLICY_STATE_PROHIBIT, 0 },
+                [POLICY_TAG_REALTIME]    = { POLICY_STATE_REQUIRE,  0 },
+                [POLICY_TAG_MULTIPATH]   = { POLICY_STATE_AVOID,    0 },
+                [POLICY_TAG_TRUSTED]     = { POLICY_STATE_PROHIBIT, 1 },
+            },
+            .stats = POLICY_STATS_NONE,
+        },
+    },
+};
+
+#endif /* HICN_POLICY_H */
diff --git a/ctrl/libhicnctrl/src/util/token.h b/ctrl/libhicnctrl/src/util/token.h
new file mode 100644
index 000000000..43e0a77b2
--- /dev/null
+++ b/ctrl/libhicnctrl/src/util/token.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/* Token concatenation */
+
+/*
+ * Concatenate preprocessor tokens A and B without expanding macro definitions
+ * (however, if invoked from a macro, macro arguments are expanded).
+ */
+#define PPCAT_NX(A, B) A ## B
+
+/*
+ * Concatenate preprocessor tokens A and B after macro-expanding them.
+ */
+#define PPCAT(A, B) PPCAT_NX(A, B)
+
+/* Token stringification */
+
+/*
+ * Turn A into a string literal without expanding macro definitions
+ * (however, if invoked from a macro, macro arguments are expanded).
+ */
+#define STRINGIZE_NX(A) #A
+
+/*
+ * Turn A into a string literal after macro-expanding it.
+ */
+#define STRINGIZE(A) STRINGIZE_NX(A)
diff --git a/ctrl/libhicnctrl/src/util/types.h b/ctrl/libhicnctrl/src/util/types.h
new file mode 100644
index 000000000..10a0bdca0
--- /dev/null
+++ b/ctrl/libhicnctrl/src/util/types.h
@@ -0,0 +1,36 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef UTIL_TYPES
+#define UTIL_TYPES
+
+typedef uint8_t u8;
+typedef uint16_t u16;
+typedef uint32_t u32;
+typedef uint64_t u64;
+
+/* Helper for avoiding warnings about type-punning */
+#define UNION_CAST(x, destType) \
+   (((union {__typeof__(x) a; destType b;})x).b)
+
+typedef unsigned int hash_t;
+
+typedef int (*cmp_t)(const void *, const void *);
+
+/* Enums */
+
+#define IS_VALID_ENUM_TYPE(NAME, x) ((x > NAME ## _UNDEFINED) && (x < NAME ## _N))
+
+#endif /* UTIL_TYPES */
diff --git a/hicn-light/CMakeLists.txt b/hicn-light/CMakeLists.txt
index 5637c1dbb..31d189a3b 100644
--- a/hicn-light/CMakeLists.txt
+++ b/hicn-light/CMakeLists.txt
@@ -54,7 +54,6 @@ find_package_wrapper(Libparc REQUIRED)
 
 if(CMAKE_SOURCE_DIR STREQUAL PROJECT_SOURCE_DIR)
   find_package_wrapper(Libhicn REQUIRED)
-  find_package_wrapper(Libparc REQUIRED)
   set(HICN_LIGHT hicn-light)
   set(HICN_LIGHT_CONTROL ${HICN_LIGHT}-control)
   set(HICN_LIGHT_DAEMON ${HICN_LIGHT}-daemon)
@@ -108,4 +107,4 @@ if("${CMAKE_CXX_COMPILER_ID}" STREQUAL "AppleClang")
 	message(STATUS "Set \"-undefined dynamic_lookup\" for shared libraries")
 endif()
 
-add_subdirectory(src/hicn)
\ No newline at end of file
+add_subdirectory(src/hicn)
diff --git a/hicn-light/src/hicn/CMakeLists.txt b/hicn-light/src/hicn/CMakeLists.txt
index a9861c32d..0f711e353 100644
--- a/hicn-light/src/hicn/CMakeLists.txt
+++ b/hicn-light/src/hicn/CMakeLists.txt
@@ -3,6 +3,18 @@
 include(BuildMacros)
 configure_file(config.h.in hicn-light/config.h @ONLY)
 
+if("${CMAKE_SYSTEM_NAME}" STREQUAL "Linux" AND ENABLE_PUNTING)
+  list(APPEND COMPILER_DEFINITIONS
+    "-DPUNTING"
+  )
+endif()
+
+list(APPEND COMPILER_DEFINITIONS
+  "-DWITH_MAPME"
+  "-DWITH_POLICY"
+)
+
+
 if(NOT ANDROID_API AND NOT COMPILE_FOR_IOS)
   add_subdirectory(command_line)
 endif ()
@@ -22,16 +34,6 @@ list(APPEND HEADER_FILES
   ${CMAKE_CURRENT_BINARY_DIR}/hicn-light/config.h
 )
 
-if("${CMAKE_SYSTEM_NAME}" STREQUAL "Linux" AND ENABLE_PUNTING)
-  list(APPEND COMPILER_DEFINITIONS
-    "-DPUNTING"
-  )
-endif()
-
-list(APPEND COMPILER_DEFINITIONS
-  "-DWITH_MAPME -DWITH_MAPME_FIXES"
-)
-
 list(INSERT HICN_LIGHT_INCLUDE_DIRS 0
   ${CMAKE_CURRENT_SOURCE_DIR}/..
   ${CMAKE_CURRENT_BINARY_DIR}/..
@@ -41,6 +43,9 @@ list(APPEND TO_INSTALL_HEADER_FILES
   ${CMAKE_CURRENT_BINARY_DIR}/hicn-light/config.h
 )
 
+set(TO_INSTALL_HEADER_FILES
+)
+
 if (ANDROID_API)
   build_library(${LIBHICN_LIGHT}
     STATIC
diff --git a/hicn-light/src/hicn/command_line/controller/CMakeLists.txt b/hicn-light/src/hicn/command_line/controller/CMakeLists.txt
index c0a584dae..405654052 100644
--- a/hicn-light/src/hicn/command_line/controller/CMakeLists.txt
+++ b/hicn-light/src/hicn/command_line/controller/CMakeLists.txt
@@ -20,4 +20,5 @@ build_executable(${HICN_LIGHT_CONTROL}
   LINK_LIBRARIES ${HICN_LIGHT_LINK_LIBRARIES}
   DEPENDS ${LIBHICN_LIGHT_STATIC}
   COMPONENT ${HICN_LIGHT}
+  DEFINITIONS ${COMPILER_DEFINITIONS}
 )
diff --git a/hicn-light/src/hicn/command_line/controller/hicnLightControl_main.c b/hicn-light/src/hicn/command_line/controller/hicnLightControl_main.c
index 8cbccde34..f704d237e 100644
--- a/hicn-light/src/hicn/command_line/controller/hicnLightControl_main.c
+++ b/hicn-light/src/hicn/command_line/controller/hicnLightControl_main.c
@@ -74,7 +74,15 @@ static int payloadLengthController[LAST_COMMAND_VALUE] = {
     sizeof(mapme_activator_command),
     sizeof(mapme_activator_command),
     sizeof(mapme_timing_command),
-    sizeof(mapme_timing_command)};
+    sizeof(mapme_timing_command),
+    sizeof(connection_set_admin_state_command),
+#ifdef WITH_POLICY
+    sizeof(add_policy_command),
+    sizeof(list_policies_command),
+    sizeof(remove_policy_command),
+    sizeof(update_connection_command),
+#endif
+};
 
 typedef struct controller_main_state {
   ControlState *controlState;
@@ -320,9 +328,11 @@ int main(int argc, char *argv[]) {
     char **commandOutputMain =
         controlState_GetCommandOutput(mainState.controlState);
     if (commandOutputMain != NULL && commandOutputLen > 0) {
+#if 0
       for (size_t j = 0; j < commandOutputLen; j++) {
         printf("Output %zu: %s \n", j, commandOutputMain[j]);
       }
+#endif
       controlState_ReleaseCommandOutput(mainState.controlState,
                                         commandOutputMain, commandOutputLen);
     }
diff --git a/hicn-light/src/hicn/command_line/daemon/CMakeLists.txt b/hicn-light/src/hicn/command_line/daemon/CMakeLists.txt
index ca8c02ef0..ff9d31ebc 100644
--- a/hicn-light/src/hicn/command_line/daemon/CMakeLists.txt
+++ b/hicn-light/src/hicn/command_line/daemon/CMakeLists.txt
@@ -20,4 +20,5 @@ build_executable(${HICN_LIGHT_DAEMON}
   LINK_LIBRARIES ${HICN_LIGHT_LINK_LIBRARIES}
   DEPENDS ${LIBHICN_LIGHT_STATIC}
   COMPONENT ${HICN_LIGHT}
-)
\ No newline at end of file
+  DEFINITIONS ${COMPILER_DEFINITIONS}
+)
diff --git a/hicn-light/src/hicn/config/CMakeLists.txt b/hicn-light/src/hicn/config/CMakeLists.txt
index 5ce680bfc..b1e475aee 100644
--- a/hicn-light/src/hicn/config/CMakeLists.txt
+++ b/hicn-light/src/hicn/config/CMakeLists.txt
@@ -26,15 +26,18 @@ list(APPEND HEADER_FILES
   ${CMAKE_CURRENT_SOURCE_DIR}/configurationFile.h
   ${CMAKE_CURRENT_SOURCE_DIR}/configurationListeners.h
   ${CMAKE_CURRENT_SOURCE_DIR}/controlAddRoute.h
+  ${CMAKE_CURRENT_SOURCE_DIR}/controlAddPolicy.h
   ${CMAKE_CURRENT_SOURCE_DIR}/controlAddListener.h
   ${CMAKE_CURRENT_SOURCE_DIR}/controlListConnections.h
   ${CMAKE_CURRENT_SOURCE_DIR}/controlList.h
   ${CMAKE_CURRENT_SOURCE_DIR}/controlListListeners.h
   ${CMAKE_CURRENT_SOURCE_DIR}/controlListRoutes.h
+  ${CMAKE_CURRENT_SOURCE_DIR}/controlListPolicies.h
   ${CMAKE_CURRENT_SOURCE_DIR}/controlQuit.h
   ${CMAKE_CURRENT_SOURCE_DIR}/controlRemove.h
   ${CMAKE_CURRENT_SOURCE_DIR}/controlRemoveConnection.h
   ${CMAKE_CURRENT_SOURCE_DIR}/controlRemoveRoute.h
+  ${CMAKE_CURRENT_SOURCE_DIR}/controlRemovePolicy.h
   ${CMAKE_CURRENT_SOURCE_DIR}/controlSet.h
   ${CMAKE_CURRENT_SOURCE_DIR}/controlUnset.h
   ${CMAKE_CURRENT_SOURCE_DIR}/controlSetDebug.h
@@ -51,6 +54,8 @@ list(APPEND HEADER_FILES
   ${CMAKE_CURRENT_SOURCE_DIR}/controlSetWldr.h
   ${CMAKE_CURRENT_SOURCE_DIR}/controlAddPunting.h
   ${CMAKE_CURRENT_SOURCE_DIR}/controlRemovePunting.h
+  ${CMAKE_CURRENT_SOURCE_DIR}/controlUpdate.h
+  ${CMAKE_CURRENT_SOURCE_DIR}/controlUpdateConnection.h
 )
 
 list(APPEND SOURCE_FILES
@@ -64,15 +69,18 @@ list(APPEND SOURCE_FILES
   ${CMAKE_CURRENT_SOURCE_DIR}/controlAdd.c
   ${CMAKE_CURRENT_SOURCE_DIR}/controlAddConnection.c
   ${CMAKE_CURRENT_SOURCE_DIR}/controlAddRoute.c
+  ${CMAKE_CURRENT_SOURCE_DIR}/controlAddPolicy.c
   ${CMAKE_CURRENT_SOURCE_DIR}/controlAddListener.c
   ${CMAKE_CURRENT_SOURCE_DIR}/controlList.c
   ${CMAKE_CURRENT_SOURCE_DIR}/controlListConnections.c
   ${CMAKE_CURRENT_SOURCE_DIR}/controlListListeners.c
   ${CMAKE_CURRENT_SOURCE_DIR}/controlListRoutes.c
+  ${CMAKE_CURRENT_SOURCE_DIR}/controlListPolicies.c
   ${CMAKE_CURRENT_SOURCE_DIR}/controlQuit.c
   ${CMAKE_CURRENT_SOURCE_DIR}/controlRemove.c
   ${CMAKE_CURRENT_SOURCE_DIR}/controlRemoveConnection.c
   ${CMAKE_CURRENT_SOURCE_DIR}/controlRemoveRoute.c
+  ${CMAKE_CURRENT_SOURCE_DIR}/controlRemovePolicy.c
   ${CMAKE_CURRENT_SOURCE_DIR}/controlRoot.c
   ${CMAKE_CURRENT_SOURCE_DIR}/controlSet.c
   ${CMAKE_CURRENT_SOURCE_DIR}/controlSetDebug.c
@@ -91,7 +99,9 @@ list(APPEND SOURCE_FILES
   ${CMAKE_CURRENT_SOURCE_DIR}/controlSetWldr.c
   ${CMAKE_CURRENT_SOURCE_DIR}/controlAddPunting.c
   ${CMAKE_CURRENT_SOURCE_DIR}/controlRemovePunting.c
+  ${CMAKE_CURRENT_SOURCE_DIR}/controlUpdate.c
+  ${CMAKE_CURRENT_SOURCE_DIR}/controlUpdateConnection.c
 )
 
 set(SOURCE_FILES ${SOURCE_FILES} PARENT_SCOPE)
-set(HEADER_FILES ${HEADER_FILES} PARENT_SCOPE)
\ No newline at end of file
+set(HEADER_FILES ${HEADER_FILES} PARENT_SCOPE)
diff --git a/hicn-light/src/hicn/config/configuration.c b/hicn-light/src/hicn/config/configuration.c
index 07120f95b..182c2fdc1 100644
--- a/hicn-light/src/hicn/config/configuration.c
+++ b/hicn-light/src/hicn/config/configuration.c
@@ -356,8 +356,8 @@ struct iovec *configuration_ProcessCreateTunnel(Configuration *config,
   add_connection_command *control = request[1].iov_base;
 
   bool success = false;
-  bool exists = true;
 
+  Connection *conn;
   const char *symbolicName = control->symbolic;
 
   Address *source = NULL;
@@ -379,18 +379,15 @@ struct iovec *configuration_ProcessCreateTunnel(Configuration *config,
     }
 
     AddressPair *pair = addressPair_Create(source, destination);
-    const Connection *conn = connectionTable_FindByAddressPair(
+    conn = (Connection *)connectionTable_FindByAddressPair(
         forwarder_GetConnectionTable(config->forwarder), pair);
 
     addressPair_Release(&pair);
-
-    if (conn == NULL) {
-      // the connection does not exists (even without a name)
-      exists = false;
-    }
+  } else {
+    conn = NULL;
   }
 
-  if (!exists) {
+  if (!conn) {
     IoOperations *ops = NULL;
     switch (control->connectionType) {
       case TCP_CONN:
@@ -420,6 +417,9 @@ struct iovec *configuration_ProcessCreateTunnel(Configuration *config,
 
     if (ops != NULL) {
       Connection *conn = connection_Create(ops);
+#ifdef WITH_POLICY
+      connection_SetTags(conn, control->tags);
+#endif /* WITH_POLICY */
 
       connection_SetAdminState(conn, control->admin_state);
 
@@ -428,6 +428,11 @@ struct iovec *configuration_ProcessCreateTunnel(Configuration *config,
       symbolicNameTable_Add(config->symbolicNameTable, symbolicName,
                             connection_GetConnectionId(conn));
 
+#ifdef WITH_MAPME
+       /* Hook: new connection created through the control protocol */
+      forwarder_onConnectionEvent(config->forwarder, conn, CONNECTION_EVENT_CREATE);
+#endif /* WITH_MAPME */
+
       success = true;
 
     } else {
@@ -435,23 +440,31 @@ struct iovec *configuration_ProcessCreateTunnel(Configuration *config,
     }
 
   } else {
-    printf("failed, symbolic name or connextion already exist\n");
-  }
+#ifdef WITH_POLICY
+    connection_SetTags(conn, control->tags);
+    connection_SetAdminState(conn, control->admin_state);
 
-  addressDestroy(&source);
-  addressDestroy(&destination);
+#ifdef WITH_MAPME
+    /* Hook: new connection created through the control protocol */
+    forwarder_onConnectionEvent(config->forwarder, conn, CONNECTION_EVENT_UPDATE);
+#endif /* WITH_MAPME */
 
-  // generate ACK/NACK
-  struct iovec *response;
+    success = true;
+#else
+    printf("failed, symbolic name or connection already exist\n");
+#endif /* WITH_POLICY */
+  }
+
+  if (source)
+    addressDestroy(&source);
+  if (destination)
+    addressDestroy(&destination);
 
   if (success) {  // ACK
-    response = utils_CreateAck(header, control, sizeof(add_connection_command));
+    return utils_CreateAck(header, control, sizeof(add_connection_command));
   } else {  // NACK
-    response =
-        utils_CreateNack(header, control, sizeof(add_connection_command));
+    return utils_CreateNack(header, control, sizeof(add_connection_command));
   }
-
-  return response;
 }
 
 /**
@@ -479,6 +492,12 @@ struct iovec *configuration_ProcessRemoveTunnel(Configuration *config,
   if (strcmp(symbolicOrConnid, "SELF") == 0) {
     forwarder_RemoveConnectionIdFromRoutes(config->forwarder, ingressId);
     connectionTable_RemoveById(table, ingressId);
+
+#ifdef WITH_MAPME
+       /* Hook: new connection created through the control protocol */
+      forwarder_onConnectionEvent(config->forwarder, NULL, CONNECTION_EVENT_DELETE);
+#endif /* WITH_MAPME */
+
     success = true;
   } else if (utils_IsNumber(symbolicOrConnid)) {
     // case for connid as input
@@ -492,6 +511,11 @@ struct iovec *configuration_ProcessRemoveTunnel(Configuration *config,
       // remove connection
       connectionTable_RemoveById(table, connid);
 
+#ifdef WITH_MAPME
+       /* Hook: new connection created through the control protocol */
+      forwarder_onConnectionEvent(config->forwarder, NULL, CONNECTION_EVENT_DELETE);
+#endif /* WITH_MAPME */
+
       success = true;
     } else {
       logger_Log(forwarder_GetLogger(config->forwarder), LoggerFacility_IO,
@@ -520,6 +544,12 @@ struct iovec *configuration_ProcessRemoveTunnel(Configuration *config,
       connectionTable_RemoveById(table, connid);
       // remove connection from symbolicNameTable since we have symbolic input
       symbolicNameTable_Remove(config->symbolicNameTable, symbolicOrConnid);
+
+#ifdef WITH_MAPME
+       /* Hook: new connection created through the control protocol */
+      forwarder_onConnectionEvent(config->forwarder, NULL, CONNECTION_EVENT_DELETE);
+#endif /* WITH_MAPME */
+
       success = true;  // to write
     } else {
       if (logger_IsLoggable(config->logger, LoggerFacility_Config,
@@ -580,6 +610,10 @@ struct iovec *configuration_ProcessConnectionList(Configuration *config,
 
     listConnectionsCommand->connectionData.admin_state = connection_GetAdminState(original);
 
+#ifdef WITH_POLICY
+    listConnectionsCommand->connectionData.tags = connection_GetTags(original);
+#endif /* WITH_POLICY */
+
     if (addressGetType(localAddress) == ADDR_INET &&
         addressGetType(remoteAddress) == ADDR_INET) {
       listConnectionsCommand->connectionData.ipType = ADDR_INET;
@@ -1017,15 +1051,119 @@ struct iovec *configuration_ConnectionSetAdminState(Configuration *config,
   header_control_message *header = request[0].iov_base;
   connection_set_admin_state_command *control = request[1].iov_base;
 
+  if ((control->admin_state != CONNECTION_STATE_UP) && (control->admin_state != CONNECTION_STATE_DOWN))
+    return utils_CreateNack(header, control, sizeof(connection_set_admin_state_command));
+
   Connection * conn = getConnectionBySymbolicOrId(config, control->symbolicOrConnid);
   if (!conn)
     return utils_CreateNack(header, control, sizeof(connection_set_admin_state_command));
 
   connection_SetAdminState(conn, control->admin_state);
 
+#ifdef WITH_MAPME
+  /* Hook: new connection created through the control protocol */
+  forwarder_onConnectionEvent(config->forwarder, conn,
+      control->admin_state == CONNECTION_STATE_UP
+              ? CONNECTION_EVENT_SET_UP
+              : CONNECTION_EVENT_SET_DOWN);
+#endif /* WITH_MAPME */
+
   return utils_CreateAck(header, control, sizeof(connection_set_admin_state_command));
 }
 
+#ifdef WITH_POLICY
+struct iovec *configuration_ProcessPolicyAdd(Configuration *config,
+                                      struct iovec *request) {
+  header_control_message *header = request[0].iov_base;
+  add_policy_command *control = request[1].iov_base;
+
+  if (forwarder_AddOrUpdatePolicy(config->forwarder, control)) {
+    return utils_CreateAck(header, control, sizeof(add_policy_command));
+  } else {
+    return utils_CreateNack(header, control, sizeof(add_policy_command));
+  }
+}
+
+struct iovec *configuration_ProcessPolicyList(Configuration *config,
+                                                    struct iovec *request) {
+  FibEntryList *fibList = forwarder_GetFibEntries(config->forwarder);
+
+  size_t payloadSize = fibEntryList_Length(fibList);
+  struct sockaddr_in tmpAddr;
+  struct sockaddr_in6 tmpAddr6;
+
+  // allocate payload, cast from void* to uint8_t* = bytes granularity
+  uint8_t *payloadResponse =
+      parcMemory_AllocateAndClear(sizeof(list_policies_command) * payloadSize);
+
+  for (size_t i = 0; i < fibEntryList_Length(fibList); i++) {
+    FibEntry *entry = (FibEntry *)fibEntryList_Get(fibList, i);
+    NameBitvector *prefix = name_GetContentName(fibEntry_GetPrefix(entry));
+
+    list_policies_command *listPoliciesCommand =
+        (list_policies_command *)(payloadResponse +
+                (i * sizeof(list_policies_command)));
+
+    Address *addressEntry = nameBitvector_ToAddress(prefix);
+    if (addressGetType(addressEntry) == ADDR_INET) {
+      addressGetInet(addressEntry, &tmpAddr);
+      listPoliciesCommand->addressType = ADDR_INET;
+      listPoliciesCommand->address.ipv4 = tmpAddr.sin_addr.s_addr;
+    } else if (addressGetType(addressEntry) == ADDR_INET6) {
+      addressGetInet6(addressEntry, &tmpAddr6);
+      listPoliciesCommand->addressType = ADDR_INET6;
+      listPoliciesCommand->address.ipv6 = tmpAddr6.sin6_addr;
+    }
+    listPoliciesCommand->len = nameBitvector_GetLength(prefix);
+    listPoliciesCommand->policy = fibEntry_GetPolicy(entry);
+
+    addressDestroy(&addressEntry);
+  }
+
+  // send response
+  header_control_message *header = request[0].iov_base;
+  header->messageType = RESPONSE_LIGHT;
+  header->length = (unsigned)payloadSize;
+
+  struct iovec *response =
+      parcMemory_AllocateAndClear(sizeof(struct iovec) * 2);
+
+  response[0].iov_base = header;
+  response[0].iov_len = sizeof(header_control_message);
+  response[1].iov_base = payloadResponse;
+  response[1].iov_len = sizeof(list_policies_command) * payloadSize;
+
+  fibEntryList_Destroy(&fibList);
+  return response;
+}
+
+struct iovec *configuration_ProcessPolicyRemove(Configuration *config,
+                                                        struct iovec *request) {
+  header_control_message *header = request[0].iov_base;
+  remove_policy_command *control = request[1].iov_base;
+
+  if (forwarder_RemovePolicy(config->forwarder, control))
+    return utils_CreateAck(header, control, sizeof(remove_policy_command));
+  else
+    return utils_CreateNack(header, control, sizeof(remove_policy_command));
+}
+
+struct iovec *configuration_UpdateConnection(Configuration *config,
+                                                        struct iovec *request) {
+  header_control_message *header = request[0].iov_base;
+  update_connection_command *control = request[1].iov_base;
+
+  Connection * conn = getConnectionBySymbolicOrId(config, control->symbolicOrConnid);
+  if (!conn)
+    return utils_CreateNack(header, control, sizeof(connection_set_admin_state_command));
+
+  connection_SetTags(conn, control->tags);
+  connection_SetAdminState(conn, control->admin_state);
+
+  return utils_CreateAck(header, control, sizeof(remove_policy_command));
+}
+#endif /* WITH_POLICY */
+
 // ===========================
 // Main functions that deal with receiving commands, executing them, and sending
 // ACK/NACK
@@ -1114,6 +1252,24 @@ struct iovec *configuration_DispatchCommand(Configuration *config,
       response = configuration_ConnectionSetAdminState(config, control);
       break;
 
+#ifdef WITH_POLICY
+    case ADD_POLICY:
+      response = configuration_ProcessPolicyAdd(config, control);
+      break;
+
+    case LIST_POLICIES:
+      response = configuration_ProcessPolicyList(config, control);
+      break;
+
+    case REMOVE_POLICY:
+      response = configuration_ProcessPolicyRemove(config, control);
+      break;
+
+    case UPDATE_CONNECTION:
+      response = configuration_UpdateConnection(config, control);
+      break;
+#endif /* WITH_POLICY */
+
     default:
       break;
   }
diff --git a/hicn-light/src/hicn/config/controlAdd.c b/hicn-light/src/hicn/config/controlAdd.c
index 7667f467e..519e11e40 100644
--- a/hicn-light/src/hicn/config/controlAdd.c
+++ b/hicn-light/src/hicn/config/controlAdd.c
@@ -28,6 +28,9 @@
 #include <hicn/config/controlAddListener.h>
 #include <hicn/config/controlAddPunting.h>
 #include <hicn/config/controlAddRoute.h>
+#ifdef WITH_POLICY
+#include <hicn/config/controlAddPolicy.h>
+#endif /* WITH_POLICY */
 
 // ===================================================
 
@@ -60,18 +63,27 @@ static CommandReturn _controlAdd_HelpExecute(CommandParser *parser,
   CommandOps *ops_add_route = controlAddRoute_Create(NULL);
   CommandOps *ops_add_punting = controlAddPunting_Create(NULL);
   CommandOps *ops_add_listener = controlAddListener_Create(NULL);
+#ifdef WITH_POLICY
+  CommandOps *ops_add_policy = controlAddPolicy_Create(NULL);
+#endif /* WITH_POLICY */
 
   printf("Available commands:\n");
   printf("   %s\n", ops_add_connection->command);
   printf("   %s\n", ops_add_route->command);
   printf("   %s\n", ops_add_punting->command);
   printf("   %s\n", ops_add_listener->command);
+#ifdef WITH_POLICIES
+  printf("   %s\n", ops_add_policy->command);
+#endif /* WITH_POLICIES */
   printf("\n");
 
   commandOps_Destroy(&ops_add_connection);
   commandOps_Destroy(&ops_add_route);
   commandOps_Destroy(&ops_add_punting);
   commandOps_Destroy(&ops_add_listener);
+#ifdef WITH_POLICY
+  commandOps_Destroy(&ops_add_policy);
+#endif /* WITH_POLICY */
   return CommandReturn_Success;
 }
 
@@ -85,6 +97,10 @@ static void _controlAdd_Init(CommandParser *parser, CommandOps *ops) {
   controlState_RegisterCommand(state, controlAddRoute_Create(state));
   controlState_RegisterCommand(state, controlAddPunting_Create(state));
   controlState_RegisterCommand(state, controlAddPunting_HelpCreate(state));
+#ifdef WITH_POLICY
+  controlState_RegisterCommand(state, controlAddPolicy_HelpCreate(state));
+  controlState_RegisterCommand(state, controlAddPolicy_Create(state));
+#endif /* WITH_POLICY */
 }
 
 static CommandReturn _controlAdd_Execute(CommandParser *parser, CommandOps *ops,
diff --git a/hicn-light/src/hicn/config/controlAddPolicy.c b/hicn-light/src/hicn/config/controlAddPolicy.c
new file mode 100644
index 000000000..9bca3355e
--- /dev/null
+++ b/hicn-light/src/hicn/config/controlAddPolicy.c
@@ -0,0 +1,175 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifdef WITH_POLICY
+
+#include <hicn/hicn-light/config.h>
+
+#include <ctype.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+#include <parc/assert/parc_Assert.h>
+
+#include <parc/algol/parc_Memory.h>
+#include <parc/algol/parc_Network.h>
+
+#include <hicn/config/controlAddPolicy.h>
+
+#include <hicn/utils/commands.h>
+#include <hicn/utils/utils.h>
+#include <hicn/utils/token.h>
+
+static CommandReturn _controlAddPolicy_Execute(CommandParser *parser,
+                                              CommandOps *ops, PARCList *args);
+static CommandReturn _controlAddPolicy_HelpExecute(CommandParser *parser,
+                                                  CommandOps *ops,
+                                                  PARCList *args);
+
+static const char *_commandAddPolicy = "add policy";
+static const char *_commandAddPolicyHelp = "help add policy";
+
+CommandOps *controlAddPolicy_Create(ControlState *state) {
+  return commandOps_Create(state, _commandAddPolicy, NULL,
+                           _controlAddPolicy_Execute, commandOps_Destroy);
+}
+
+CommandOps *controlAddPolicy_HelpCreate(ControlState *state) {
+  return commandOps_Create(state, _commandAddPolicyHelp, NULL,
+                           _controlAddPolicy_HelpExecute, commandOps_Destroy);
+}
+
+// ====================================================
+
+static CommandReturn _controlAddPolicy_HelpExecute(CommandParser *parser,
+                                                  CommandOps *ops,
+                                                  PARCList *args) {
+  printf("commands:\n");
+  printf("   add policy <prefix> <app_name>"
+            #define _(x, y) " FLAG:%s"
+            foreach_policy_tag
+            #undef _
+            "%s",
+            #define _(x, y) policy_tag_str[POLICY_TAG_ ## x],
+            foreach_policy_tag
+            #undef _
+      "\n");
+  printf("\n");
+  printf(
+      "   prefix:    The hicn name as IPv4 or IPv6 address (e.g 1234::0/64)\n");
+  printf("   app_name:      The application name associated to this policy\n");
+  printf("   FLAG:*:  A value among [neutral|require|prefer|avoid|prohibit] with an optional '!' character prefix for disabling changes\n");
+  printf("\n");
+  return CommandReturn_Success;
+}
+
+static CommandReturn _controlAddPolicy_Execute(CommandParser *parser,
+                                              CommandOps *ops, PARCList *args) {
+  ControlState *state = ops->closure;
+
+  if (parcList_Size(args) != 11) {
+    _controlAddPolicy_HelpExecute(parser, ops, args);
+    return CommandReturn_Failure;
+  }
+
+  const char *prefixStr = parcList_GetAtIndex(args, 2);
+  char *addr = (char *)malloc((strlen(prefixStr) + 1) * sizeof(char));
+
+  // separate address and len
+  char *slash;
+  uint32_t len = 0;
+  strcpy(addr, prefixStr);
+  slash = strrchr(addr, '/');
+  if (slash != NULL) {
+    len = atoi(slash + 1);
+    *slash = '\0';
+  }
+
+  // allocate command payload
+  add_policy_command *addPolicyCommand =
+      parcMemory_AllocateAndClear(sizeof(add_policy_command));
+
+  // check and set IP address
+  if (inet_pton(AF_INET, addr, &addPolicyCommand->address.ipv4) == 1) {
+    if (len > 32) {
+      printf("ERROR: exceeded INET mask length, max=32\n");
+      parcMemory_Deallocate(&addPolicyCommand);
+      free(addr);
+      return CommandReturn_Failure;
+    }
+    addPolicyCommand->addressType = ADDR_INET;
+  } else if (inet_pton(AF_INET6, addr, &addPolicyCommand->address.ipv6) == 1) {
+    if (len > 128) {
+      printf("ERROR: exceeded INET6 mask length, max=128\n");
+      parcMemory_Deallocate(&addPolicyCommand);
+      free(addr);
+      return CommandReturn_Failure;
+    }
+    addPolicyCommand->addressType = ADDR_INET6;
+  } else {
+    printf("Error: %s is not a valid network address \n", addr);
+    parcMemory_Deallocate(&addPolicyCommand);
+    free(addr);
+    return CommandReturn_Failure;
+  }
+
+  free(addr);
+
+  addPolicyCommand->len = len;
+
+  policy_t policy;
+  snprintf((char*)policy.app_name, APP_NAME_LEN, "%s", (char*)parcList_GetAtIndex(args, 3));
+  for (int i=4; i < 11; i++) {
+    const char *tag = parcList_GetAtIndex(args, i);
+    policy_tag_state_t tag_state;
+    tag_state.disabled = (tag[0] == '!') ? 1 : 0;
+    if (strcmp(&tag[tag_state.disabled], "neutral") == 0) {
+      tag_state.state = POLICY_STATE_NEUTRAL;
+    } else if (strcmp(&tag[tag_state.disabled], "require") == 0) {
+      tag_state.state = POLICY_STATE_REQUIRE;
+    } else if (strcmp(&tag[tag_state.disabled], "prefer") == 0) {
+      tag_state.state = POLICY_STATE_PREFER;
+    } else if (strcmp(&tag[tag_state.disabled], "avoid") == 0) {
+      tag_state.state = POLICY_STATE_AVOID;
+    } else if (strcmp(&tag[tag_state.disabled], "prohibit") == 0) {
+      tag_state.state = POLICY_STATE_PROHIBIT;
+    } else {
+      printf("ERROR: invalid tag value '%s'\n", tag);
+      parcMemory_Deallocate(&addPolicyCommand);
+      free(addr);
+      return CommandReturn_Failure;
+    }
+
+    policy.tags[i-4] = tag_state;
+
+  }
+
+  addPolicyCommand->policy = policy;
+
+  // send message and receive response
+  struct iovec *response = utils_SendRequest(state, ADD_POLICY, addPolicyCommand,
+                                             sizeof(add_policy_command));
+
+  if (!response) {  // get NULL pointer
+    return CommandReturn_Failure;
+  }
+
+  parcMemory_Deallocate(&response);  // free iovec pointer
+  return CommandReturn_Success;
+}
+
+#endif /* WITH_POLICY */
diff --git a/hicn-light/src/hicn/config/controlAddPolicy.h b/hicn-light/src/hicn/config/controlAddPolicy.h
new file mode 100644
index 000000000..273e3a476
--- /dev/null
+++ b/hicn-light/src/hicn/config/controlAddPolicy.h
@@ -0,0 +1,35 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * @file control_AddPolicy.h
+ * @brief Add a static policy
+ *
+ * Implements the "add policy" node of the CLI tree
+ *
+ */
+
+#ifndef Control_AddPolicy_h
+#define Control_AddPolicy_h
+
+#ifdef WITH_POLICY
+
+#include <hicn/config/controlState.h>
+CommandOps *controlAddPolicy_Create(ControlState *state);
+CommandOps *controlAddPolicy_HelpCreate(ControlState *state);
+
+#endif /* WITH_POLICY */
+
+#endif  // Control_AddPolicy_h
diff --git a/hicn-light/src/hicn/config/controlAddPunting.c b/hicn-light/src/hicn/config/controlAddPunting.c
index 61308b33b..ff441f7f0 100644
--- a/hicn-light/src/hicn/config/controlAddPunting.c
+++ b/hicn-light/src/hicn/config/controlAddPunting.c
@@ -104,12 +104,6 @@ static CommandReturn _controlAddPunting_Execute(CommandParser *parser,
     *slash = '\0';
   }
 
-  if (len == 0) {
-    printf("ERROR: a prefix can not be of length 0\n");
-    free(addr);
-    return CommandReturn_Failure;
-  }
-
   // allocate command payload
   add_punting_command *addPuntingCommand =
       parcMemory_AllocateAndClear(sizeof(add_punting_command));
diff --git a/hicn-light/src/hicn/config/controlAddRoute.c b/hicn-light/src/hicn/config/controlAddRoute.c
index d7847f837..086cf3a2b 100644
--- a/hicn-light/src/hicn/config/controlAddRoute.c
+++ b/hicn-light/src/hicn/config/controlAddRoute.c
@@ -108,12 +108,6 @@ static CommandReturn _controlAddRoute_Execute(CommandParser *parser,
     *slash = '\0';
   }
 
-  if (len == 0) {
-    printf("ERROR: a prefix can not be of length 0\n");
-    free(addr);
-    return CommandReturn_Failure;
-  }
-
   // allocate command payload
   add_route_command *addRouteCommand =
       parcMemory_AllocateAndClear(sizeof(add_route_command));
diff --git a/hicn-light/src/hicn/config/controlList.c b/hicn-light/src/hicn/config/controlList.c
index 8ec47ad23..c45f05428 100644
--- a/hicn-light/src/hicn/config/controlList.c
+++ b/hicn-light/src/hicn/config/controlList.c
@@ -31,6 +31,9 @@
 //#include <hicn/config/controlListInterfaces.h>
 #include <hicn/config/controlListListeners.h>
 #include <hicn/config/controlListRoutes.h>
+#ifdef WITH_POLICY
+#include <hicn/config/controlListPolicies.h>
+#endif /* WITH_POLICY */
 
 static void _controlList_Init(CommandParser *parser, CommandOps *ops);
 static CommandReturn _controlList_Execute(CommandParser *parser,
@@ -59,18 +62,27 @@ static CommandReturn _controlList_HelpExecute(CommandParser *parser,
   // CommandOps *ops_list_interfaces = controlListInterfaces_HelpCreate(NULL);
   CommandOps *ops_list_routes = controlListRoutes_HelpCreate(NULL);
   CommandOps *ops_list_listeners = controlListListeners_HelpCreate(NULL);
+#ifdef WITH_POLICY
+  CommandOps *ops_list_policies = controlListPolicies_HelpCreate(NULL);
+#endif /* WITH_POLICY */
 
   printf("Available commands:\n");
   printf("   %s\n", ops_list_connections->command);
   // printf("   %s\n", ops_list_interfaces->command);
   printf("   %s\n", ops_list_routes->command);
   printf("   %s\n", ops_list_listeners->command);
+#ifdef WITH_POLICY
+  printf("   %s\n", ops_list_policies->command);
+#endif /* WITH_POLICY */
   printf("\n");
 
   commandOps_Destroy(&ops_list_connections);
   // commandOps_Destroy(&ops_list_interfaces);
   commandOps_Destroy(&ops_list_routes);
   commandOps_Destroy(&ops_list_listeners);
+#ifdef WITH_POLICY
+  commandOps_Destroy(&ops_list_policies);
+#endif /* WITH_POLICY */
 
   return CommandReturn_Success;
 }
@@ -86,6 +98,10 @@ static void _controlList_Init(CommandParser *parser, CommandOps *ops) {
   // controlState_RegisterCommand(state, controlListInterfaces_Create(state));
   controlState_RegisterCommand(state, controlListRoutes_Create(state));
   controlState_RegisterCommand(state, controlListListeners_Create(state));
+#ifdef WITH_POLICY
+  controlState_RegisterCommand(state, controlListPolicies_HelpCreate(state));
+  controlState_RegisterCommand(state, controlListPolicies_Create(state));
+#endif /* WITH_POLICY */
 }
 
 static CommandReturn _controlList_Execute(CommandParser *parser,
diff --git a/hicn-light/src/hicn/config/controlListConnections.c b/hicn-light/src/hicn/config/controlListConnections.c
index f94a1e7ca..0eb6392ea 100644
--- a/hicn-light/src/hicn/config/controlListConnections.c
+++ b/hicn-light/src/hicn/config/controlListConnections.c
@@ -82,6 +82,10 @@ static CommandReturn _controlListConnections_Execute(CommandParser *parser,
     _controlListConnections_HelpExecute(parser, ops, args);
     return CommandReturn_Failure;
   }
+#ifdef WITH_POLICY
+  char flags_str[POLICY_TAG_N];
+  char *s;
+#endif /* WITH_POLICY */
 
   ControlState *state = ops->closure;
 
@@ -127,11 +131,28 @@ static CommandReturn _controlListConnections_Execute(CommandParser *parser,
 
     PARCBufferComposer *composer = parcBufferComposer_Create();
 
+#ifdef WITH_POLICY
+
+    s = flags_str;
+#define _(x, y) *s++ = policy_tags_has(listConnectionsCommand->connectionData.tags, POLICY_TAG_ ## x) ? y : '.';
+foreach_policy_tag
+#undef _
+    *s = '\0';
+
+    parcBufferComposer_Format(
+        composer, "%5d %4s %s %s %s [%s]", listConnectionsCommand->connid,
+        stateString[listConnectionsCommand->state], sourceString,
+        destinationString,
+        connTypeString[listConnectionsCommand->connectionData.connectionType],
+        flags_str);
+
+#else
     parcBufferComposer_Format(
         composer, "%5d %4s %s %s %s", listConnectionsCommand->connid,
         stateString[listConnectionsCommand->state], sourceString,
         destinationString,
         connTypeString[listConnectionsCommand->connectionData.connectionType]);
+#endif /* WITH_POLICY */
 
     PARCBuffer *tempBuffer = parcBufferComposer_ProduceBuffer(composer);
     char *result = parcBuffer_ToString(tempBuffer);
diff --git a/hicn-light/src/hicn/config/controlListPolicies.c b/hicn-light/src/hicn/config/controlListPolicies.c
new file mode 100644
index 000000000..c70d8baea
--- /dev/null
+++ b/hicn-light/src/hicn/config/controlListPolicies.c
@@ -0,0 +1,240 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifdef WITH_POLICY
+
+#include <hicn/hicn-light/config.h>
+
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+#include <parc/assert/parc_Assert.h>
+
+#include <parc/algol/parc_Memory.h>
+#include <parc/algol/parc_Time.h>
+
+#include <hicn/config/controlListPolicies.h>
+
+#include <hicn/utils/commands.h>
+#include <hicn/utils/utils.h>
+
+static CommandReturn _controlListPolicies_Execute(CommandParser *parser,
+                                                CommandOps *ops,
+                                                PARCList *args);
+static CommandReturn _controlListPolicies_HelpExecute(CommandParser *parser,
+                                                    CommandOps *ops,
+                                                    PARCList *args);
+
+static const char *_commandListPolicies = "list policies";
+static const char *_commandListPoliciesHelp = "help list policies";
+
+// ====================================================
+
+CommandOps *controlListPolicies_Create(ControlState *state) {
+  return commandOps_Create(state, _commandListPolicies, NULL,
+                           _controlListPolicies_Execute, commandOps_Destroy);
+}
+
+CommandOps *controlListPolicies_HelpCreate(ControlState *state) {
+  return commandOps_Create(state, _commandListPoliciesHelp, NULL,
+                           _controlListPolicies_HelpExecute, commandOps_Destroy);
+}
+
+// ====================================================
+
+static CommandReturn _controlListPolicies_HelpExecute(CommandParser *parser,
+                                                    CommandOps *ops,
+                                                    PARCList *args) {
+  printf("command: list policies\n");
+  printf("\n");
+  return CommandReturn_Success;
+}
+
+#define MAX(x,y) (x > y ? x : y)
+#define MAXSZ_COLUMN MAX(MAXSZ_POLICY_TAG, MAXSZ_POLICY_TAG_STATE)
+
+#define MAXSZ_STR_STAT 10
+#define MAXSZ_APP_NAME 25
+#define MAXSZ_PREFIX 25
+
+typedef struct {
+  #define _(x, y) char x[MAXSZ_POLICY_TAG_STATE];
+  foreach_policy_tag
+  #undef _
+} tag_state_str_t;
+
+static CommandReturn _controlListPolicies_Execute(CommandParser *parser,
+                                                CommandOps *ops,
+                                                PARCList *args) {
+  if (parcList_Size(args) != 2) {
+    _controlListPolicies_HelpExecute(parser, ops, args);
+    return CommandReturn_Failure;
+  }
+
+  ControlState *state = ops->closure;
+
+  // send message and receive response
+  struct iovec *response = utils_SendRequest(state, LIST_POLICIES, NULL, 0);
+  if (!response) {  // get NULL pointer = FAILURE
+    return CommandReturn_Failure;
+  }
+
+  // Process/Print message
+  header_control_message *receivedHeader =
+      (header_control_message *)response[0].iov_base;
+  uint8_t *receivedPayload = (uint8_t *)response[1].iov_base;
+  if (!receivedPayload) {
+      printf("No payload!\n");
+      return CommandReturn_Failure;
+  }
+
+  // Allocate output to pass to the main function if the call is not interactive
+  char **commandOutputMain = NULL;
+  if (!controlState_IsInteractive(state) && receivedHeader->length > 0) {
+    commandOutputMain =
+        parcMemory_Allocate(sizeof(char *) * receivedHeader->length);
+    for (size_t j = 0; j < receivedHeader->length; j++) {
+      commandOutputMain[j] = parcMemory_Allocate(sizeof(char) * 128);
+    }
+  }
+
+  char *addrString = NULL;
+  in_port_t port = htons(1234);  // this is a random port number that is ignored
+
+  if (receivedHeader->length > 0) {
+    printf("%*s %*s"
+            #define _(x, y) " %*s"
+            foreach_policy_tag
+            #undef _
+            "%s",
+            MAXSZ_PREFIX, "prefix", MAXSZ_APP_NAME /*APP_NAME_LEN*/, "app_name",
+            #define _(x, y) MAXSZ_COLUMN, policy_tag_str[POLICY_TAG_ ## x],
+            foreach_policy_tag
+            #undef _
+            "\n");
+  } else {
+    printf(" --- No entry in the list \n");
+  }
+
+  tag_state_str_t str;
+
+  for (int i = 0; i < receivedHeader->length; i++) {
+    list_policies_command *listPoliciesCommand =
+        (list_policies_command *)(receivedPayload +
+                                (i * sizeof(list_policies_command)));
+
+#if 0
+    char tag_s[MAXSZ_POLICY_TAG_STATE * POLICY_TAG_N];
+
+        policy_tag_state_snprintf((char*)&tag_s[MAXSZ_POLICY_TAG_STATE * POLICY_TAG_ ## x],      \
+                MAXSZ_POLICY_TAG_STATE,                                 \
+                &listPoliciesCommand->policy.tags[POLICY_TAG_ ## x]);
+#endif
+
+    #define _(x, y) policy_tag_state_snprintf(str.x, MAXSZ_POLICY_TAG_STATE, &listPoliciesCommand->policy.tags[POLICY_TAG_ ## x]);
+    foreach_policy_tag
+    #undef _
+
+    addrString = utils_CommandAddressToString(
+        listPoliciesCommand->addressType, &listPoliciesCommand->address, &port);
+
+#if 0
+    PARCBufferComposer *composer = parcBufferComposer_Create();
+
+    parcBufferComposer_Format(
+        composer, "%*s %*s"
+        #define _(x, y) " %*s"
+        foreach_policy_tag
+        #undef _
+        "%s",
+        MAXSZ_PREFIX, addrString, APP_NAME_LEN, listPoliciesCommand->policy.app_name,
+        #define _(x, y) MAXSZ_COLUMN, str.x,
+        foreach_policy_tag
+        #undef _
+        "");
+
+    PARCBuffer *tempBuffer = parcBufferComposer_ProduceBuffer(composer);
+    char *result = parcBuffer_ToString(tempBuffer);
+    parcBuffer_Release(&tempBuffer);
+
+    if (!controlState_IsInteractive(state)) {
+      strcpy(commandOutputMain[i], result);
+    }
+
+    puts(result);
+    parcMemory_Deallocate((void **)&result);
+    parcBufferComposer_Release(&composer);
+#else
+    printf("%*s %*s"
+        #define _(x, y) " %*s"
+        foreach_policy_tag
+        #undef _
+        "%s\n",
+        MAXSZ_PREFIX, addrString, MAXSZ_APP_NAME /*APP_NAME_LEN*/, listPoliciesCommand->policy.app_name,
+        #define _(x, y) MAXSZ_COLUMN, str.x,
+        foreach_policy_tag
+        #undef _
+        "");
+
+#endif
+  }
+
+  printf("\nSTATISTICS\n\n");
+  // STATISTICS
+  printf("%*s %*s %*s | %*s | %*s | %*s\n",
+          MAXSZ_PREFIX, "", MAXSZ_APP_NAME /*APP_NAME_LEN*/, "",
+          3*MAXSZ_STR_STAT+2, "WIRED", 3*MAXSZ_STR_STAT+2, "WIFI", 3*MAXSZ_STR_STAT+2, "CELLULAR", 3*MAXSZ_STR_STAT+2, "ALL");
+  printf("%*s %*s %*s %*s %*s | %*s %*s %*s | %*s %*s %*s | %*s %*s %*s\n",
+            MAXSZ_PREFIX, "prefix", MAXSZ_APP_NAME /*APP_NAME_LEN*/, "app_name",
+            MAXSZ_STR_STAT, "throughput", MAXSZ_STR_STAT, "latency", MAXSZ_STR_STAT, "loss_rate",
+            MAXSZ_STR_STAT, "throughput", MAXSZ_STR_STAT, "latency", MAXSZ_STR_STAT, "loss_rate",
+            MAXSZ_STR_STAT, "throughput", MAXSZ_STR_STAT, "latency", MAXSZ_STR_STAT, "loss_rate",
+            MAXSZ_STR_STAT, "throughput", MAXSZ_STR_STAT, "latency", MAXSZ_STR_STAT, "loss_rate");
+  for (int i = 0; i < receivedHeader->length; i++) {
+    list_policies_command *listPoliciesCommand =
+        (list_policies_command *)(receivedPayload +
+                                (i * sizeof(list_policies_command)));
+    addrString = utils_CommandAddressToString(
+        listPoliciesCommand->addressType, &listPoliciesCommand->address, &port);
+    printf("%*s %*s %*.2f %*.2f %*.2f | %*.2f %*.2f %*.2f | %*.2f %*.2f %*.2f | %*.2f %*.2f %*.2f\n",
+        MAXSZ_PREFIX, addrString, MAXSZ_APP_NAME, listPoliciesCommand->policy.app_name,
+        MAXSZ_STR_STAT, listPoliciesCommand->policy.stats.wired.throughput,
+        MAXSZ_STR_STAT, listPoliciesCommand->policy.stats.wired.latency,
+        MAXSZ_STR_STAT, listPoliciesCommand->policy.stats.wired.loss_rate,
+        MAXSZ_STR_STAT, listPoliciesCommand->policy.stats.wifi.throughput,
+        MAXSZ_STR_STAT, listPoliciesCommand->policy.stats.wifi.latency,
+        MAXSZ_STR_STAT, listPoliciesCommand->policy.stats.wifi.loss_rate,
+        MAXSZ_STR_STAT, listPoliciesCommand->policy.stats.cellular.throughput,
+        MAXSZ_STR_STAT, listPoliciesCommand->policy.stats.cellular.latency,
+        MAXSZ_STR_STAT, listPoliciesCommand->policy.stats.cellular.loss_rate,
+        MAXSZ_STR_STAT, listPoliciesCommand->policy.stats.all.throughput,
+        MAXSZ_STR_STAT, listPoliciesCommand->policy.stats.all.latency,
+        MAXSZ_STR_STAT, listPoliciesCommand->policy.stats.all.loss_rate);
+ }
+
+  controlState_SetCommandOutput(state, commandOutputMain);
+
+  // DEALLOCATE
+  parcMemory_Deallocate((void **)&addrString);
+  parcMemory_Deallocate(&receivedHeader);   // free response[0].iov_base
+  parcMemory_Deallocate(&receivedPayload);  // free response[1].iov_base
+  parcMemory_Deallocate(&response);         // free iovec pointer
+
+  return CommandReturn_Success;
+}
+
+#endif /* WITH_POLICY */
diff --git a/hicn-light/src/hicn/config/controlListPolicies.h b/hicn-light/src/hicn/config/controlListPolicies.h
new file mode 100644
index 000000000..7aa0bdd26
--- /dev/null
+++ b/hicn-light/src/hicn/config/controlListPolicies.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * @file control_ListPolicies.h
+ * @brief List the icn-light policies
+ *
+ * Implements the "list policies" and "help list policies" nodes of the command tree
+ *
+ */
+#ifndef Control_ListPolicies_h
+#define Control_ListPolicies_h
+
+#ifdef WITH_POLICY
+
+#include <hicn/config/controlState.h>
+CommandOps *controlListPolicies_Create(ControlState *state);
+CommandOps *controlListPolicies_HelpCreate(ControlState *state);
+
+#endif /* WITH_POLICY */
+
+#endif  // Control_ListPolicies_h
diff --git a/hicn-light/src/hicn/config/controlRemove.c b/hicn-light/src/hicn/config/controlRemove.c
index d33d57206..af833dc8b 100644
--- a/hicn-light/src/hicn/config/controlRemove.c
+++ b/hicn-light/src/hicn/config/controlRemove.c
@@ -30,6 +30,9 @@
 #include <hicn/config/controlRemoveConnection.h>
 #include <hicn/config/controlRemovePunting.h>
 #include <hicn/config/controlRemoveRoute.h>
+#ifdef WITH_POLICY
+#include <hicn/config/controlRemovePolicy.h>
+#endif /* WITH_POLICY */
 
 static void _controlRemove_Init(CommandParser *parser, CommandOps *ops);
 static CommandReturn _controlRemove_Execute(CommandParser *parser,
@@ -61,16 +64,25 @@ static CommandReturn _controlRemove_HelpExecute(CommandParser *parser,
   CommandOps *ops_remove_connection = controlRemoveConnection_Create(NULL);
   CommandOps *ops_remove_route = controlRemoveRoute_Create(NULL);
   CommandOps *ops_remove_punting = controlRemovePunting_Create(NULL);
+#ifdef WITH_POLICY
+  CommandOps *ops_remove_policy = controlRemovePolicy_Create(NULL);
+#endif /* WITH_POLICY */
 
   printf("Available commands:\n");
   printf("   %s\n", ops_remove_connection->command);
   printf("   %s\n", ops_remove_route->command);
   printf("   %s\n", ops_remove_punting->command);
+#ifdef WITH_POLICY
+  printf("   %s\n", ops_remove_policy->command);
+#endif /* WITH_POLICY */
   printf("\n");
 
   commandOps_Destroy(&ops_remove_connection);
   commandOps_Destroy(&ops_remove_route);
   commandOps_Destroy(&ops_remove_punting);
+#ifdef WITH_POLICY
+  commandOps_Destroy(&ops_remove_policy);
+#endif /* WITH_POLICY */
   return CommandReturn_Success;
 }
 
@@ -83,6 +95,10 @@ static void _controlRemove_Init(CommandParser *parser, CommandOps *ops) {
   controlState_RegisterCommand(state, controlRemoveRoute_Create(state));
   controlState_RegisterCommand(state, controlRemovePunting_Create(state));
   controlState_RegisterCommand(state, controlRemovePunting_HelpCreate(state));
+#ifdef WITH_POLICY
+  controlState_RegisterCommand(state, controlRemovePolicy_HelpCreate(state));
+  controlState_RegisterCommand(state, controlRemovePolicy_Create(state));
+#endif /* WITH_POLICY */
 }
 
 static CommandReturn _controlRemove_Execute(CommandParser *parser,
diff --git a/hicn-light/src/hicn/config/controlRemovePolicy.c b/hicn-light/src/hicn/config/controlRemovePolicy.c
new file mode 100644
index 000000000..510203886
--- /dev/null
+++ b/hicn-light/src/hicn/config/controlRemovePolicy.c
@@ -0,0 +1,139 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifdef WITH_POLICY
+
+#include <hicn/hicn-light/config.h>
+
+#include <ctype.h>
+#include <parc/algol/parc_List.h>
+#include <parc/algol/parc_Memory.h>
+#include <parc/algol/parc_Network.h>
+#include <parc/assert/parc_Assert.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+#include <hicn/utils/address.h>
+
+#include <hicn/config/controlRemovePolicy.h>
+
+#include <hicn/utils/commands.h>
+#include <hicn/utils/utils.h>
+
+static CommandReturn _controlRemovePolicy_Execute(CommandParser *parser,
+                                                 CommandOps *ops,
+                                                 PARCList *args);
+static CommandReturn _controlRemovePolicy_HelpExecute(CommandParser *parser,
+                                                     CommandOps *ops,
+                                                     PARCList *args);
+
+// ===================================================
+
+static const char *_commandRemovePolicy = "remove policy";
+static const char *_commandRemovePolicyHelp = "help remove policy";
+
+// ====================================================
+
+CommandOps *controlRemovePolicy_Create(ControlState *state) {
+  return commandOps_Create(state, _commandRemovePolicy, NULL,
+                           _controlRemovePolicy_Execute, commandOps_Destroy);
+}
+
+CommandOps *controlRemovePolicy_HelpCreate(ControlState *state) {
+  return commandOps_Create(state, _commandRemovePolicyHelp, NULL,
+                           _controlRemovePolicy_HelpExecute, commandOps_Destroy);
+}
+
+// ====================================================
+
+static CommandReturn _controlRemovePolicy_HelpExecute(CommandParser *parser,
+                                                     CommandOps *ops,
+                                                     PARCList *args) {
+  printf("commands:\n");
+  printf("    remove policy <prefix>\n");
+  return CommandReturn_Success;
+}
+
+static CommandReturn _controlRemovePolicy_Execute(CommandParser *parser,
+                                                 CommandOps *ops,
+                                                 PARCList *args) {
+  ControlState *state = ops->closure;
+
+  if (parcList_Size(args) != 3) {
+    _controlRemovePolicy_HelpExecute(parser, ops, args);
+    return CommandReturn_Failure;
+  }
+
+  const char *prefixStr = parcList_GetAtIndex(args, 2);
+  char *addr = (char *)malloc(sizeof(char) * (strlen(prefixStr) + 1));
+
+  // separate address and len
+  char *slash;
+  uint32_t len = 0;
+  strcpy(addr, prefixStr);
+  slash = strrchr(addr, '/');
+  if (slash != NULL) {
+    len = atoi(slash + 1);
+    *slash = '\0';
+  }
+
+  // allocate command payload
+  remove_policy_command *removePolicyCommand =
+      parcMemory_AllocateAndClear(sizeof(remove_policy_command));
+
+  // check and set IP address
+  if (inet_pton(AF_INET, addr, &removePolicyCommand->address.ipv4) == 1) {
+    if (len > 32) {
+      printf("ERROR: exceeded INET mask length, max=32\n");
+      parcMemory_Deallocate(&removePolicyCommand);
+      free(addr);
+      return CommandReturn_Failure;
+    }
+    removePolicyCommand->addressType = ADDR_INET;
+  } else if (inet_pton(AF_INET6, addr, &removePolicyCommand->address.ipv6) ==
+             1) {
+    if (len > 128) {
+      printf("ERROR: exceeded INET6 mask length, max=128\n");
+      parcMemory_Deallocate(&removePolicyCommand);
+      free(addr);
+      return CommandReturn_Failure;
+    }
+    removePolicyCommand->addressType = ADDR_INET6;
+  } else {
+    printf("Error: %s is not a valid network address \n", addr);
+    parcMemory_Deallocate(&removePolicyCommand);
+    free(addr);
+    return CommandReturn_Failure;
+  }
+
+  free(addr);
+  // Fill remaining payload fields
+  removePolicyCommand->len = len;
+
+  // send message and receive response
+  struct iovec *response = utils_SendRequest(
+      state, REMOVE_POLICY, removePolicyCommand, sizeof(remove_policy_command));
+
+  if (!response) {  // get NULL pointer
+    return CommandReturn_Failure;
+  }
+
+  parcMemory_Deallocate(&response);  // free iovec pointer
+  return CommandReturn_Success;
+}
+
+#endif /* WITH_POLICY */
diff --git a/hicn-light/src/hicn/config/controlRemovePolicy.h b/hicn-light/src/hicn/config/controlRemovePolicy.h
new file mode 100644
index 000000000..ebe098985
--- /dev/null
+++ b/hicn-light/src/hicn/config/controlRemovePolicy.h
@@ -0,0 +1,36 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * @file control_RemovePolicy.h
+ * @brief Remove a policy from the FIB
+ *
+ * Implements the "remove policy" and "help remove policy" nodes of the command
+ * tree
+ *
+ */
+
+#ifndef Control_RemovePolicy_h
+#define Control_RemovePolicy_h
+
+#ifdef WITH_POLICY
+
+#include <hicn/config/controlState.h>
+CommandOps *controlRemovePolicy_Create(ControlState *state);
+CommandOps *controlRemovePolicy_HelpCreate(ControlState *state);
+
+#endif /* WITH_POLICY */
+
+#endif  // Control_RemovePolicy_h
diff --git a/hicn-light/src/hicn/config/controlRemoveRoute.c b/hicn-light/src/hicn/config/controlRemoveRoute.c
index 8cb888f7c..0626886de 100644
--- a/hicn-light/src/hicn/config/controlRemoveRoute.c
+++ b/hicn-light/src/hicn/config/controlRemoveRoute.c
@@ -99,12 +99,6 @@ static CommandReturn _controlRemoveRoute_Execute(CommandParser *parser,
     *slash = '\0';
   }
 
-  if (len == 0) {
-    printf("ERROR: a prefix can not be of length 0\n");
-    free(addr);
-    return CommandReturn_Failure;
-  }
-
   // allocate command payload
   remove_route_command *removeRouteCommand =
       parcMemory_AllocateAndClear(sizeof(remove_route_command));
diff --git a/hicn-light/src/hicn/config/controlRoot.c b/hicn-light/src/hicn/config/controlRoot.c
index 675fe4c6e..e135dfc50 100644
--- a/hicn-light/src/hicn/config/controlRoot.c
+++ b/hicn-light/src/hicn/config/controlRoot.c
@@ -31,6 +31,9 @@
 #include <hicn/config/controlRoot.h>
 #include <hicn/config/controlSet.h>
 #include <hicn/config/controlUnset.h>
+#ifdef WITH_POLICY
+#include <hicn/config/controlUpdate.h>
+#endif /* WITH_POLICY */
 
 static void _controlRoot_Init(CommandParser *parser, CommandOps *ops);
 static CommandReturn _controlRoot_Execute(CommandParser *parser,
@@ -79,6 +82,9 @@ static CommandReturn _controlRoot_HelpExecute(CommandParser *parser,
   CommandOps *ops_help_unset = controlUnset_HelpCreate(NULL);
   CommandOps *ops_help_cache = controlCache_HelpCreate(NULL);
   CommandOps *ops_help_mapme = controlMapMe_HelpCreate(NULL);
+#ifdef WITH_POLICY
+  CommandOps *ops_help_update = controlUpdate_HelpCreate(NULL);
+#endif /* WITH_POLICY */
 
   printf("Available commands:\n");
   printf("   %s\n", ops_help_add->command);
@@ -89,6 +95,9 @@ static CommandReturn _controlRoot_HelpExecute(CommandParser *parser,
   printf("   %s\n", ops_help_unset->command);
   printf("   %s\n", ops_help_cache->command);
   printf("   %s\n", ops_help_mapme->command);
+#ifdef WITH_POLICY
+  printf("   %s\n", ops_help_update->command);
+#endif /* WITH_POLICY */
   printf("\n");
 
   commandOps_Destroy(&ops_help_add);
@@ -99,6 +108,9 @@ static CommandReturn _controlRoot_HelpExecute(CommandParser *parser,
   commandOps_Destroy(&ops_help_unset);
   commandOps_Destroy(&ops_help_cache);
   commandOps_Destroy(&ops_help_mapme);
+#ifdef WITH_POLICY
+  commandOps_Destroy(&ops_help_update);
+#endif /* WITH_POLICY */
 
   return CommandReturn_Success;
 }
@@ -114,6 +126,9 @@ static void _controlRoot_Init(CommandParser *parser, CommandOps *ops) {
   controlState_RegisterCommand(state, controlUnset_HelpCreate(state));
   controlState_RegisterCommand(state, controlCache_HelpCreate(state));
   controlState_RegisterCommand(state, controlMapMe_HelpCreate(state));
+#ifdef WITH_POLICY
+  controlState_RegisterCommand(state, controlUpdate_HelpCreate(state));
+#endif /* WITH_POLICY */
 
   controlState_RegisterCommand(state, webControlAdd_Create(state));
   controlState_RegisterCommand(state, controlList_Create(state));
@@ -123,6 +138,9 @@ static void _controlRoot_Init(CommandParser *parser, CommandOps *ops) {
   controlState_RegisterCommand(state, controlUnset_Create(state));
   controlState_RegisterCommand(state, controlCache_Create(state));
   controlState_RegisterCommand(state, controlMapMe_Create(state));
+#ifdef WITH_POLICY
+  controlState_RegisterCommand(state, controlUpdate_Create(state));
+#endif /* WITH_POLICY */
 }
 
 static CommandReturn _controlRoot_Execute(CommandParser *parser,
diff --git a/hicn-light/src/hicn/config/controlSetStrategy.c b/hicn-light/src/hicn/config/controlSetStrategy.c
index 1b1396342..b2968712f 100644
--- a/hicn-light/src/hicn/config/controlSetStrategy.c
+++ b/hicn-light/src/hicn/config/controlSetStrategy.c
@@ -47,8 +47,7 @@ static const char *_commandSetStrategyOptions[LAST_STRATEGY_VALUE] = {
     "random",
     "random_per_dash_segment",
     "loadbalancer_with_delay",
-    "loadbalancer_by_rate",
-    "loadbalancer_best_route"};
+};
 
 // ====================================================
 
@@ -118,11 +117,6 @@ static CommandReturn _controlSetStrategy_Execute(CommandParser *parser,
     len = atoi(slash + 1);
     *slash = '\0';
   }
-  if (len == 0) {
-    printf("ERROR: a prefix can not be of length 0\n");
-    free(addr);
-    return CommandReturn_Failure;
-  }
 
   // allocate command payload
   set_strategy_command *setStrategyCommand =
diff --git a/hicn-light/src/hicn/config/controlUpdate.c b/hicn-light/src/hicn/config/controlUpdate.c
new file mode 100644
index 000000000..4c74660c2
--- /dev/null
+++ b/hicn-light/src/hicn/config/controlUpdate.c
@@ -0,0 +1,95 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifdef WITH_POLICY
+
+#include <hicn/hicn-light/config.h>
+
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+#include <parc/assert/parc_Assert.h>
+
+#include <parc/security/parc_Security.h>
+
+#include <parc/algol/parc_Memory.h>
+
+#include <hicn/config/controlUpdate.h>
+#include <hicn/config/controlUpdateConnection.h>
+
+static void _controlUpdate_Init(CommandParser *parser, CommandOps *ops);
+static CommandReturn _controlUpdate_Execute(CommandParser *parser,
+                                          CommandOps *ops, PARCList *args);
+static CommandReturn _controlUpdate_HelpExecute(CommandParser *parser,
+                                              CommandOps *ops, PARCList *args);
+
+static const char *_commandUpdate = "update";
+static const char *_commandUpdateHelp = "help update";
+
+CommandOps *controlUpdate_Create(ControlState *state) {
+  return commandOps_Create(state, _commandUpdate, _controlUpdate_Init,
+                           _controlUpdate_Execute, commandOps_Destroy);
+}
+
+CommandOps *controlUpdate_HelpCreate(ControlState *state) {
+  return commandOps_Create(state, _commandUpdateHelp, NULL,
+                           _controlUpdate_HelpExecute, commandOps_Destroy);
+}
+
+// =====================================================
+
+static CommandReturn _controlUpdate_HelpExecute(CommandParser *parser,
+                                              CommandOps *ops, PARCList *args) {
+  //CommandOps *ops_update_connections = controlUpdateConnections_HelpCreate(NULL);
+  // CommandOps *ops_update_interfaces = controlUpdateInterfaces_HelpCreate(NULL);
+  //CommandOps *ops_update_routes = controlUpdateRoutes_HelpCreate(NULL);
+  CommandOps *ops_update_listeners = controlUpdateConnection_HelpCreate(NULL);
+
+  printf("Available commands:\n");
+  //printf("   %s\n", ops_update_connections->command);
+  // printf("   %s\n", ops_update_interfaces->command);
+  //printf("   %s\n", ops_update_routes->command);
+  printf("   %s\n", ops_update_listeners->command);
+  printf("\n");
+
+ // commandOps_Destroy(&ops_update_connections);
+  // commandOps_Destroy(&ops_update_interfaces);
+  //commandOps_Destroy(&ops_update_routes);
+  commandOps_Destroy(&ops_update_listeners);
+
+  return CommandReturn_Success;
+}
+
+static void _controlUpdate_Init(CommandParser *parser, CommandOps *ops) {
+  ControlState *state = ops->closure;
+  //controlState_RegisterCommand(state, controlUpdateConnections_HelpCreate(state));
+  // controlState_RegisterCommand(state,
+  // controlUpdateInterfaces_HelpCreate(state));
+  controlState_RegisterCommand(state, controlUpdateConnection_HelpCreate(state));
+  //controlState_RegisterCommand(state, controlUpdateRoutes_HelpCreate(state));
+  //controlState_RegisterCommand(state, controlUpdateConnections_Create(state));
+  // controlState_RegisterCommand(state, controlUpdateInterfaces_Create(state));
+  //controlState_RegisterCommand(state, controlUpdateRoutes_Create(state));
+  controlState_RegisterCommand(state, controlUpdateConnection_Create(state));
+}
+
+static CommandReturn _controlUpdate_Execute(CommandParser *parser,
+                                          CommandOps *ops, PARCList *args) {
+  return _controlUpdate_HelpExecute(parser, ops, args);
+}
+
+#endif /* WITH_POLICY */
diff --git a/hicn-light/src/hicn/config/controlUpdate.h b/hicn-light/src/hicn/config/controlUpdate.h
new file mode 100644
index 000000000..0007ab653
--- /dev/null
+++ b/hicn-light/src/hicn/config/controlUpdate.h
@@ -0,0 +1,35 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * @file control_Update.h
+ * @brief Root node for the "update" commands
+ *
+ * Implements the "update" node of the CLI tree.
+ *
+ */
+
+#ifndef controlUpdate_h
+#define controlUpdate_h
+
+#ifdef WITH_POLICY
+
+#include <hicn/config/controlState.h>
+CommandOps *controlUpdate_Create(ControlState *state);
+CommandOps *controlUpdate_HelpCreate(ControlState *state);
+
+#endif /* WITH_POLICY */
+
+#endif  // controlUpdate_h
diff --git a/hicn-light/src/hicn/config/controlUpdateConnection.c b/hicn-light/src/hicn/config/controlUpdateConnection.c
new file mode 100644
index 000000000..3e573d41d
--- /dev/null
+++ b/hicn-light/src/hicn/config/controlUpdateConnection.c
@@ -0,0 +1,145 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifdef WITH_POLICY
+
+#include <hicn/hicn-light/config.h>
+
+#include <ctype.h>
+#include <inttypes.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+#include <parc/assert/parc_Assert.h>
+
+#include <parc/algol/parc_Memory.h>
+#include <parc/algol/parc_Network.h>
+
+#include <hicn/config/controlUpdateConnection.h>
+
+#include <hicn/utils/commands.h>
+#include <hicn/utils/utils.h>
+#include <hicn/utils/policy.h>
+
+static CommandReturn _controlUpdateConnection_Execute(CommandParser *parser,
+                                                 CommandOps *ops,
+                                                 PARCList *args);
+static CommandReturn _controlUpdateConnection_HelpExecute(CommandParser *parser,
+                                                     CommandOps *ops,
+                                                     PARCList *args);
+
+static const char *command_update_connection = "update connection";
+static const char *command_help_update_connection = "help update connection";
+
+CommandOps *controlUpdateConnection_Create(ControlState *state) {
+  return commandOps_Create(state, command_update_connection, NULL,
+                           _controlUpdateConnection_Execute, commandOps_Destroy);
+}
+
+CommandOps *controlUpdateConnection_HelpCreate(ControlState *state) {
+  return commandOps_Create(state, command_help_update_connection, NULL,
+                           _controlUpdateConnection_HelpExecute, commandOps_Destroy);
+}
+
+// ====================================================
+
+static const int _indexSymbolic = 2;
+static const int _indexTags = 3;
+
+static CommandReturn _controlUpdateConnection_HelpExecute(CommandParser *parser,
+                                                     CommandOps *ops,
+                                                     PARCList *args) {
+  printf("commands:\n");
+  printf("   update connection <symbolic | id> <tags> \n");
+  printf("\n");
+  printf(
+      "   symbolic:        User defined name for connection, must start with "
+      "alpha and be alphanum\n");
+  printf("         id:        Identifier for the connection\n");
+  printf("   tags:            A string representing tags\n");
+  return CommandReturn_Success;
+}
+
+
+static CommandReturn _controlUpdateConnection_Execute(CommandParser *parser,
+                                                 CommandOps *ops,
+                                                 PARCList *args) {
+  if ((parcList_Size(args) != 3) && (parcList_Size(args) != 4)) {
+    _controlUpdateConnection_HelpExecute(parser, ops, args);
+    return CommandReturn_Failure;
+  }
+
+  const char *symbolicOrConnid = parcList_GetAtIndex(args, _indexSymbolic);
+
+  if (!utils_ValidateSymbolicName(symbolicOrConnid) &&
+      !utils_IsNumber(symbolicOrConnid)) {
+    printf(
+        "ERROR: Invalid symbolic or connid:\nsymbolic name must begin with an "
+        "alpha followed by alphanum;\nconnid must be an integer\n");
+    return CommandReturn_Failure;
+  }
+
+  policy_tags_t tags = POLICY_TAGS_EMPTY;
+  if (parcList_Size(args) == 4) {
+    const char *str_tags = parcList_GetAtIndex(args, _indexTags);
+  
+    for (unsigned i = 0; str_tags[i] != 0; i++) {
+      switch(tolower(str_tags[i])) {
+        case 'e':
+          policy_tags_add(&tags, POLICY_TAG_WIRED);
+          break;
+        case 'w':
+          policy_tags_add(&tags, POLICY_TAG_WIFI);
+          break;
+        case 'c':
+          policy_tags_add(&tags, POLICY_TAG_CELLULAR);
+          break;
+        case 'b':
+          policy_tags_add(&tags, POLICY_TAG_BEST_EFFORT);
+          break;
+        case 'r':
+          policy_tags_add(&tags, POLICY_TAG_REALTIME);
+          break;
+        case 'm':
+          policy_tags_add(&tags, POLICY_TAG_MULTIPATH);
+          break;
+        case 't':
+          policy_tags_add(&tags, POLICY_TAG_TRUSTED);
+          break;
+      }
+    }
+  }
+  ControlState *state = ops->closure;
+
+  // allocate command payload
+  update_connection_command *updateConnectionCommand =
+      parcMemory_AllocateAndClear(sizeof(update_connection_command));
+  updateConnectionCommand->tags = tags;
+  strcpy(updateConnectionCommand->symbolicOrConnid, symbolicOrConnid);
+
+  // send message and receive response
+  struct iovec *response = utils_SendRequest(
+      state, UPDATE_CONNECTION, updateConnectionCommand, sizeof(update_connection_command));
+
+  if (!response)  // get NULL pointer
+    return CommandReturn_Failure;
+
+  parcMemory_Deallocate(&response);  // free iovec pointer
+  return CommandReturn_Success;
+}
+
+#endif /* WITH_POLICY */
diff --git a/hicn-light/src/hicn/config/controlUpdateConnection.h b/hicn-light/src/hicn/config/controlUpdateConnection.h
new file mode 100644
index 000000000..eea303202
--- /dev/null
+++ b/hicn-light/src/hicn/config/controlUpdateConnection.h
@@ -0,0 +1,35 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * @file control_UpdateConnection.h
+ * @brief Update a connection to an interface
+ *
+ * <#Detailed Description#>
+ *
+ */
+
+#ifndef Control_UpdateConnection_h
+#define Control_UpdateConnection_h
+
+#ifdef WITH_POLICY
+
+#include <hicn/config/controlState.h>
+CommandOps *controlUpdateConnection_Create(ControlState *state);
+CommandOps *controlUpdateConnection_HelpCreate(ControlState *state);
+
+#endif /* WITH_POLICY */
+
+#endif  // Control_UpdateConnection_h
diff --git a/hicn-light/src/hicn/core/connection.c b/hicn-light/src/hicn/core/connection.c
index d9b2770b9..2f50dbf7f 100644
--- a/hicn-light/src/hicn/core/connection.c
+++ b/hicn-light/src/hicn/core/connection.c
@@ -27,6 +27,9 @@
 
 #include <parc/algol/parc_Memory.h>
 #include <parc/assert/parc_Assert.h>
+#ifdef WITH_POLICY
+#include <hicn/utils/policy.h>
+#endif /* WITH_POLICY */
 
 struct connection {
   const AddressPair *addressPair;
@@ -46,6 +49,11 @@ struct connection {
                        // file/hicnLightControl) this value is set to false so
                        // that a base station can not disable wldr at the client
   Wldr *wldr;
+
+#ifdef WITH_POLICY
+  policy_tags_t tags;
+#endif /* WITH_POLICY */
+
 };
 
 Connection *connection_Create(IoOperations *ops) {
@@ -68,6 +76,10 @@ Connection *connection_Create(IoOperations *ops) {
   /* By default, a connection will aim at the UP state */
   connection_SetAdminState(conn, CONNECTION_STATE_UP);
 
+#ifdef WITH_POLICY
+  conn->tags = POLICY_TAGS_EMPTY;
+#endif /* WITH_POLICY */
+
   return conn;
 }
 
@@ -316,3 +328,37 @@ void connection_SetAdminState(Connection *conn, connection_state_t admin_state)
     return;
   ioOperations_SetAdminState(conn->ops, admin_state);
 }
+
+#ifdef WITH_POLICY
+
+void connection_AddTag(Connection *conn, policy_tag_t tag)
+{
+    policy_tags_add(&conn->tags, tag);
+}
+
+void connection_RemoveTag(Connection *conn, policy_tag_t tag)
+{
+    policy_tags_remove(&conn->tags, tag);
+}
+
+policy_tags_t connection_GetTags(const Connection *conn)
+{
+    return conn->tags;
+}
+
+void connection_SetTags(Connection *conn, policy_tags_t tags)
+{
+    conn->tags = tags;
+}
+
+void connection_ClearTags(Connection *conn)
+{
+    conn->tags = POLICY_TAGS_EMPTY;
+}
+
+int connection_HasTag(const Connection *conn, policy_tag_t tag)
+{
+    return policy_tags_has(conn->tags, tag);
+}
+
+#endif /* WITH_POLICY */
diff --git a/hicn-light/src/hicn/core/connection.h b/hicn-light/src/hicn/core/connection.h
index df1c780a1..c007a1a26 100644
--- a/hicn-light/src/hicn/core/connection.h
+++ b/hicn-light/src/hicn/core/connection.h
@@ -29,6 +29,21 @@
 #include <hicn/io/ioOperations.h>
 #include <hicn/utils/address.h>
 
+#ifdef WITH_MAPME
+typedef enum {
+  CONNECTION_EVENT_CREATE,
+  CONNECTION_EVENT_DELETE,
+  CONNECTION_EVENT_UPDATE,
+  CONNECTION_EVENT_SET_UP,
+  CONNECTION_EVENT_SET_DOWN,
+} connection_event_t;
+
+#endif /* WITH_MAPME */
+
+#ifdef WITH_POLICY
+#include <hicn/utils/policy.h>
+#endif /* WITH_POLICY */
+
 // packet types for probing
 #define PACKET_TYPE_PROBE_REQUEST 5
 #define PACKET_TYPE_PROBE_REPLY 6
@@ -168,4 +183,13 @@ connection_state_t connection_GetAdminState(const Connection *conn);
 
 void connection_SetAdminState(Connection *conn, connection_state_t admin_state);
 
+#ifdef WITH_POLICY
+void connection_AddTag(Connection *conn, policy_tag_t tag);
+void connection_RemoveTag(Connection *conn, policy_tag_t tag);
+policy_tags_t connection_GetTags(const Connection *conn);
+void connection_SetTags(Connection *conn, policy_tags_t tags);
+void connection_ClearTags(Connection *conn);
+int connection_HasTag(const Connection *conn, policy_tag_t tag);
+#endif /* WITH_POLICY */
+
 #endif  // connection_h
diff --git a/hicn-light/src/hicn/core/connectionTable.c b/hicn-light/src/hicn/core/connectionTable.c
index 0a1301328..f8589c12b 100644
--- a/hicn-light/src/hicn/core/connectionTable.c
+++ b/hicn-light/src/hicn/core/connectionTable.c
@@ -206,7 +206,7 @@ const Connection *connectionTable_FindByAddressPair(ConnectionTable *table,
   return (Connection *)parcHashCodeTable_Get(table->indexByAddressPair, pair);
 }
 
-const Connection *connectionTable_FindById(ConnectionTable *table,
+const Connection *connectionTable_FindById(const ConnectionTable *table,
                                            unsigned id) {
   parcAssertNotNull(table, "Parameter table must be non-null");
   return (Connection *)parcHashCodeTable_Get(table->storageTableById, &id);
diff --git a/hicn-light/src/hicn/core/connectionTable.h b/hicn-light/src/hicn/core/connectionTable.h
index bd8f553c2..548ef8e6e 100644
--- a/hicn-light/src/hicn/core/connectionTable.h
+++ b/hicn-light/src/hicn/core/connectionTable.h
@@ -84,7 +84,7 @@ const Connection *connectionTable_FindByAddressPair(ConnectionTable *table,
  * @abstract Find a connection by its numeric id.
  * @return NULL if not found
  */
-const Connection *connectionTable_FindById(ConnectionTable *table, unsigned id);
+const Connection *connectionTable_FindById(const ConnectionTable *table, unsigned id);
 
 /**
  * @function connectionTable_GetEntries
diff --git a/hicn-light/src/hicn/core/forwarder.c b/hicn-light/src/hicn/core/forwarder.c
index c8cac98ba..c9527bb49 100644
--- a/hicn-light/src/hicn/core/forwarder.c
+++ b/hicn-light/src/hicn/core/forwarder.c
@@ -313,7 +313,11 @@ Dispatcher *forwarder_GetDispatcher(Forwarder *forwarder) {
   return forwarder->dispatcher;
 }
 
+#ifdef WITH_POLICY
+ConnectionTable *forwarder_GetConnectionTable(const Forwarder *forwarder) {
+#else
 ConnectionTable *forwarder_GetConnectionTable(Forwarder *forwarder) {
+#endif /* WITH_POLICY */
   parcAssertNotNull(forwarder, "Parameter must be non-null");
   return forwarder->connectionTable;
 }
@@ -412,6 +416,7 @@ bool forwarder_AddOrUpdateRoute(Forwarder *forwarder,
   return res;
 }
 
+
 bool forwarder_RemoveRoute(Forwarder *forwarder, remove_route_command *control,
                            unsigned ifidx) {
   parcAssertNotNull(forwarder, "Parameter hicn-light must be non-null");
@@ -421,6 +426,25 @@ bool forwarder_RemoveRoute(Forwarder *forwarder, remove_route_command *control,
   return messageProcessor_RemoveRoute(forwarder->processor, control, ifidx);
 }
 
+#ifdef WITH_POLICY
+
+bool forwarder_AddOrUpdatePolicy(Forwarder *forwarder,
+                                add_policy_command *control) {
+  parcAssertNotNull(forwarder, "Parameter forwarder must be non-null");
+  parcAssertNotNull(control, "Parameter control must be non-null");
+
+  return messageProcessor_AddOrUpdatePolicy(forwarder->processor, control);
+}
+
+bool forwarder_RemovePolicy(Forwarder *forwarder, remove_policy_command *control) {
+  parcAssertNotNull(forwarder, "Parameter forwarder must be non-null");
+  parcAssertNotNull(control, "Parameter control must be non-null");
+
+  return messageProcessor_RemovePolicy(forwarder->processor, control);
+}
+
+#endif /* WITH_POLICY */
+
 void forwarder_RemoveConnectionIdFromRoutes(Forwarder *forwarder,
                                             unsigned connectionId) {
   parcAssertNotNull(forwarder, "Parameter hicn-light must be non-null");
@@ -504,16 +528,22 @@ FIB *forwarder_getFib(Forwarder *forwarder) {
   return messageProcessor_getFib(forwarder->processor);
 }
 
-void forwarder_onConnectionAdded(Forwarder *forwarder, const Connection *conn) {
-  mapMe_onConnectionAdded(forwarder->mapme, conn);
+void forwarder_onConnectionEvent(Forwarder *forwarder, const Connection *conn, connection_event_t event) {
+#ifdef WITH_POLICY
+    messageProcessor_onConnectionEvent(forwarder->processor, conn, event);
+#else
+  mapMe_onConnectionEvent(forwarder->mapme, conn, event);
+#endif /* WITH_POLICY */
 }
 
-void forwarder_onConnectionRemoved(Forwarder *forwarder,
-                                   const Connection *conn) {}
-
-void forwarder_ProcessMapMe(Forwarder *forwarder, uint8_t *msgBuffer,
+void forwarder_ProcessMapMe(Forwarder *forwarder, const uint8_t *msgBuffer,
                             unsigned conn_id) {
   mapMe_Process(forwarder->mapme, msgBuffer, conn_id);
 }
 
+MapMe *
+forwarder_getMapmeInstance(const Forwarder *forwarder) {
+    return forwarder->mapme;
+}
+
 #endif /* WITH_MAPME */
diff --git a/hicn-light/src/hicn/core/forwarder.h b/hicn-light/src/hicn/core/forwarder.h
index c1b279d2e..b8e68f0e4 100644
--- a/hicn-light/src/hicn/core/forwarder.h
+++ b/hicn-light/src/hicn/core/forwarder.h
@@ -156,7 +156,11 @@ ListenerSet *forwarder_GetListenerSet(Forwarder *forwarder);
  * @retval null An error
  *
  */
+#ifdef WITH_POLICY
+ConnectionTable *forwarder_GetConnectionTable(const Forwarder *forwarder);
+#else
 ConnectionTable *forwarder_GetConnectionTable(Forwarder *forwarder);
+#endif /* WITH_POLICY */
 
 /**
  * Returns a Tick-based clock
@@ -209,6 +213,20 @@ bool forwarder_AddOrUpdateRoute(Forwarder *forwarder,
 bool forwarder_RemoveRoute(Forwarder *forwarder, remove_route_command *control,
                            unsigned ifidx);
 
+#ifdef WITH_POLICY
+/**
+ * @function forwarder_AddOrUpdatePolicy
+ * @abstract Adds or updates a policy on the message processor
+ */
+bool forwarder_AddOrUpdatePolicy(Forwarder *forwarder, add_policy_command *control);
+
+/**
+ * @function forwarder_RemovePolicy
+ * @abstract Removes a policy from the message processor
+ */
+bool forwarder_RemovePolicy(Forwarder *forwarder, remove_policy_command *control);
+#endif /* WITH_POLICY */
+
 /**
  * Removes a connection id from all routes
  */
@@ -260,23 +278,14 @@ hicn_socket_helper_t *forwarder_GetHicnSocketHelper(Forwarder *forwarder);
 FIB *forwarder_getFib(Forwarder *forwarder);
 
 /**
- * @function forwarder_onConnectionAdded
+ * @function forwarder_onConnectionEvent
  * @abstract Callback fired upon addition of a new connection through the
  *   control protocol.
  * @param [in] forwarder - Pointer to the hICN forwarder.
  * @param [in] conn - Pointer to the newly added connection.
+ * @param [in] event - Connection event
  */
-void forwarder_onConnectionAdded(Forwarder *forwarder, const Connection *conn);
-
-/**
- * @function forwarder_onConnectionRemoved
- * @abstract Callback fired upon removal of a connection through the control
- *   protocol.
- * @param [in] forwarder - Pointer to the hICN forwarder.
- * @param [in] conn - Pointer to the removed connection.
- */
-void forwarder_onConnectionRemoved(Forwarder *forwarder,
-                                   const Connection *conn);
+void forwarder_onConnectionEvent(Forwarder *forwarder, const Connection *conn, connection_event_t event);
 
 /**
  * @function forwarder_ProcessMapMe
@@ -286,9 +295,12 @@ void forwarder_onConnectionRemoved(Forwarder *forwarder,
  * @param [in] msgBuffer - MAP-Me buffer
  * @param [in] conn_id - Ingress connection id
  */
-void forwarder_ProcessMapMe(Forwarder *forwarder, uint8_t *msgBuffer,
+void forwarder_ProcessMapMe(Forwarder *forwarder, const uint8_t *msgBuffer,
                             unsigned conn_id);
 
+struct mapme;
+struct mapme * forwarder_getMapmeInstance(const Forwarder *forwarder);
+
 #endif /* WITH_MAPME */
 
 #endif  // forwarder_h
diff --git a/hicn-light/src/hicn/core/mapMe.c b/hicn-light/src/hicn/core/mapMe.c
index 74ff1ed96..865841f67 100644
--- a/hicn-light/src/hicn/core/mapMe.c
+++ b/hicn-light/src/hicn/core/mapMe.c
@@ -24,6 +24,7 @@
 #include <hicn/core/mapMe.h>
 #include <stdio.h>  // printf
 
+#include <hicn/core/connection.h>
 #include <hicn/core/connectionList.h>
 #include <hicn/core/forwarder.h>
 #include <hicn/core/logger.h>
@@ -87,8 +88,6 @@ static MapMe MapMeDefault = {.retx = MAPME_DEFAULT_RETX,
 
 /******************************************************************************/
 
-#include <hicn/core/connection.h>
-
 bool mapMe_Init(MapMe **mapme, Forwarder *forwarder) {
   *mapme = malloc(sizeof(MapMe));
   if (!mapme) goto ERR_MALLOC;
@@ -98,12 +97,9 @@ bool mapMe_Init(MapMe **mapme, Forwarder *forwarder) {
 
   (*mapme)->forwarder = forwarder;
 
-  /* Install hook on Face events to onConnectionAdded */
-  // see. config/configuration.c
-
-  /* Install hook for signalization processing. See :
-   *  - io/hicnListener.c
-   *  - src/core/connection.{c,h}
+  /* As there is no face table and no related events, we need to install hooks
+   * in various places in the forwarder, where both control commands and
+   * signalization are processed.
    */
 
   return true;
@@ -117,20 +113,20 @@ ERR_MALLOC:
  ******************************************************************************/
 
 #define INVALID_SEQ 0
-#define INIT_SEQ 1
+#define INIT_SEQ 0
 
 typedef struct {
   uint32_t seq;
   PARCHashMap *nexthops;
   /* Update/Notification heuristic */
-  Ticks lastAckedUpdate;  // XXX This is only for producer !!!
+  Ticks lastAckedUpdate;
 } MapMeTFIB;
 
 static MapMeTFIB *mapMeTFIB_Create() {
   MapMeTFIB *tfib;
   tfib = malloc(sizeof(MapMeTFIB));
   if (!tfib) goto ERR_MALLOC;
-  tfib->seq = 0;
+  tfib->seq = INIT_SEQ;
   tfib->lastAckedUpdate = 0;
   tfib->nexthops = parcHashMap_Create();
   if (!tfib->nexthops) goto ERR_HASHMAP;
@@ -239,7 +235,7 @@ static Message *mapMe_createMessage(const MapMe *mapme, const Name *name,
 
   INFO(mapme, "[MAP-Me] Creating MAP-Me packet");
   size_t len = hicn_mapme_create_packet(icmp_pkt, &prefix, params);
-  if (len != 0) {
+  if (len == 0) {
     ERR(mapme, "[MAP-Me] Failed to create mapme packet through lib");
     goto ERR_CREATE;
   }
@@ -341,7 +337,6 @@ static bool mapMe_setFacePending(const MapMe *mapme, const Name *name,
   // set the timer.
   // - in the network, we always forward an IU, and never an IN
   if (is_first || send) {
-    // XXX
     mapme_params_t params = {
         .protocol = IPPROTO_IPV6,
         .type = is_first ? mapMe_getTypeFromHeuristic(mapme, fibEntry) : UPDATE,
@@ -357,7 +352,11 @@ static bool mapMe_setFacePending(const MapMe *mapme, const Name *name,
     const Connection *conn =
         connectionTable_FindById((ConnectionTable *)table, conn_id);
     if (conn) {
-      INFO(mapme, "[MAP-Me] Sending MAP-Me packet");
+      const Name * name = message_GetName(special_interest);
+      char * name_str = name_ToString(name);
+      INFO(mapme, "[MAP-Me] Sending MAP-Me packet name=%s seq=%d conn=%d",
+              name_str, params.seq, conn_id);
+      free(name_str);
       connection_ReSend(conn, special_interest, NOT_A_NOTIFICATION);
     } else {
       INFO(mapme, "[MAP-Me] Stopped retransmissions as face went down");
@@ -439,42 +438,85 @@ static bool mapMe_hasLocalNextHops(const MapMe *mapme,
 /*
  * Callback called everytime a new connection is created by the control protocol
  */
-void mapMe_onConnectionAdded(const MapMe *mapme, const Connection *conn_added) {
-  /* bool ret; */
-  FibEntryList *fiblist;
+void mapMe_onConnectionEvent(const MapMe *mapme, const Connection *conn_added, connection_event_t event) {
+  switch(event) {
+    case CONNECTION_EVENT_CREATE:
+    case CONNECTION_EVENT_SET_UP:
+    {
+      FibEntryList *fiblist;
+
+      /* Ignore local connections corresponding to applications for now */
+      if (connection_IsLocal(conn_added))
+          return;
+
+      unsigned conn_added_id = connection_GetConnectionId(conn_added);
+      INFO(mapme, "[MAP-Me] New connection %d", conn_added_id);
+
+      /*
+       * Iterate on FIB to find locally served prefix
+       * Ideally, we want to avoid a FIB scan everytime a face is added/removed
+       */
+      fiblist = forwarder_GetFibEntries(mapme->forwarder);
+      for (size_t i = 0; i < fibEntryList_Length(fiblist); i++) {
+        FibEntry *fibEntry = (FibEntry *)fibEntryList_Get(fiblist, i);
+        const Name *name = fibEntry_GetPrefix(fibEntry);
+
+        /* Skip entries that have no local connection as next hop */
+        if (!mapMe_hasLocalNextHops(mapme, fibEntry))
+            continue;
+
+        /* This entry corresponds to a locally served prefix, set
+         * Special Interest */
+        if (!TFIB(fibEntry)) /* Create TFIB associated to FIB entry */
+          mapMe_CreateTFIB(fibEntry);
+        TFIB(fibEntry)->seq++;
+
+        char *name_str = name_ToString(name);
+        INFO(mapme, "[MAP-Me] sending IU/IN for name %s on connection %d", name_str,
+             conn_added_id);
+        free(name_str);
+
+        mapMe_setFacePending(mapme, name, fibEntry, conn_added_id, true, true, 0);
+      }
+      break;
+    }
+    case CONNECTION_EVENT_DELETE:
+    case CONNECTION_EVENT_SET_DOWN:
+    case CONNECTION_EVENT_UPDATE:
+      break;
+  }
+}
 
+#ifdef WITH_POLICY
+void mapMe_onPolicyUpdate(const MapMe *mapme, const Connection *conn_selected, FibEntry * fibEntry)
+{
   /* Ignore local connections corresponding to applications for now */
-  if (connection_IsLocal(conn_added)) return;
+  if (connection_IsLocal(conn_selected))
+      return;
 
-  unsigned conn_added_id = connection_GetConnectionId(conn_added);
-  INFO(mapme, "[MAP-Me] New connection %d", conn_added_id);
+  unsigned conn_selected_id = connection_GetConnectionId(conn_selected);
+  INFO(mapme, "[MAP-Me] New connection %d", conn_selected_id);
 
-  /*
-   * Iterate on FIB to find locally served prefix
-   * Ideally, we want to avoid a FIB scan everytime a face is added/removed
-   */
-  fiblist = forwarder_GetFibEntries(mapme->forwarder);
-  for (size_t i = 0; i < fibEntryList_Length(fiblist); i++) {
-    FibEntry *fibEntry = (FibEntry *)fibEntryList_Get(fiblist, i);
-    const Name *name = fibEntry_GetPrefix(fibEntry);
-
-    /* Skip entries that have no local connection as next hop */
-    if (!mapMe_hasLocalNextHops(mapme, fibEntry)) continue;
-
-    /* This entry corresponds to a locally served prefix, set
-     * Special Interest */
-    if (!TFIB(fibEntry)) /* Create TFIB associated to FIB entry */
-      mapMe_CreateTFIB(fibEntry);
-    TFIB(fibEntry)->seq++;
-
-    char *name_str = name_ToString(name);
-    INFO(mapme, "[MAP-Me] sending IU/IN for name %s on connection %d", name_str,
-         conn_added_id);
-    free(name_str);
-
-    mapMe_setFacePending(mapme, name, fibEntry, conn_added_id, true, true, 0);
-  }
+  const Name *name = fibEntry_GetPrefix(fibEntry);
+
+  /* Skip entries that have no local connection as next hop */
+  if (!mapMe_hasLocalNextHops(mapme, fibEntry))
+      return;
+
+  /* This entry corresponds to a locally served prefix, set
+   * Special Interest */
+  if (!TFIB(fibEntry)) /* Create TFIB associated to FIB entry */
+    mapMe_CreateTFIB(fibEntry);
+  TFIB(fibEntry)->seq++;
+
+  char *name_str = name_ToString(name);
+  INFO(mapme, "[MAP-Me] sending IU/IN for name %s on connection %d", name_str,
+       conn_selected_id);
+  free(name_str);
+
+  mapMe_setFacePending(mapme, name, fibEntry, conn_selected_id, true, true, 0);
 }
+#endif /* WITH_POLICY */
 
 /*------------------------------------------------------------------------------
  * Special Interest handling
@@ -497,6 +539,7 @@ static bool mapMe_onSpecialInterest(const MapMe *mapme,
   bool rv;
 
   Name *name = name_CreateFromPacket(msgBuffer, MessagePacketType_Interest);
+  name_setLen(name, prefix->len);
   char *name_str = name_ToString(name);
   INFO(mapme,
        "[MAP-Me] Ack'ed Special Interest on connection %d - prefix=%s type=XX "
@@ -530,12 +573,34 @@ static bool mapMe_onSpecialInterest(const MapMe *mapme,
      */
     strategy_type fwdStrategy = LAST_STRATEGY_VALUE;
 
+    /*
+     * It might also be due to the announcement of a more specific prefix. In
+     * that case we need to perform a FIB lookup to find the next hops to which
+     * the message should be propagated.
+     */
+#ifdef WITH_POLICY
+    fibEntry = fibEntry_Create(name, fwdStrategy, mapme->forwarder);
+#else
     fibEntry = fibEntry_Create(name, fwdStrategy);
-    fibEntry_AddNexthopByConnectionId(fibEntry, conn_in_id);
+#endif /* WITH_POLICY */
+    FibEntry *lpm = fib_LPM(fib, name);
     mapMe_CreateTFIB(fibEntry);
-    TFIB(fibEntry)->seq = seq;  // INIT_SEQ;
     fib_Add(fib, fibEntry);
-    return true;  // with proper seq, we are done
+    if (!lpm) {
+      TFIB(fibEntry)->seq = seq;
+      fibEntry_AddNexthop(fibEntry, conn_in_id);
+      return true;
+    }
+
+    /*
+     * We make a clone of the FIB entry (zero'ing the sequence number ?) with
+     * the more specific name, and proceed as usual. Worst case we clone the
+     * default route...
+     */
+    const NumberSet *lpm_nexthops = fibEntry_GetNexthops(lpm);
+    for (size_t i = 0; i < numberSet_Length(lpm_nexthops); i++) {
+        fibEntry_AddNexthop(fibEntry, numberSet_GetItem(lpm_nexthops, i));
+    }
 
   } else if (!TFIB(fibEntry)) {
     /* Create TFIB associated to FIB entry */
@@ -613,7 +678,7 @@ static bool mapMe_onSpecialInterest(const MapMe *mapme,
       INFO(mapme, "[MAP-Me]   - Replaced next hops by connection %d", conn_id);
       fibEntry_RemoveNexthopByConnectionId(fibEntry, conn_id);
     }
-    fibEntry_AddNexthopByConnectionId(fibEntry, conn_in_id);
+    fibEntry_AddNexthop(fibEntry, conn_in_id);
 
     INFO(mapme, "[MAP-Me]   - (2/3) processing next hops");
     bool complete = true;
@@ -658,7 +723,7 @@ static bool mapMe_onSpecialInterest(const MapMe *mapme,
 
     INFO(mapme, "[MAP-Me]   - Adding multipath next hop on connection %d",
          conn_in_id);
-    fibEntry_AddNexthopByConnectionId(fibEntry, conn_in_id);
+    fibEntry_AddNexthop(fibEntry, conn_in_id);
 
   } else {  // seq < fibSeq
     /*
@@ -688,11 +753,19 @@ void mapMe_onSpecialInterestAck(const MapMe *mapme, const uint8_t *msgBuffer,
                                 mapme_params_t *params) {
   INFO(mapme, "[MAP-Me] Receive IU/IN Ack on connection %d", conn_in_id);
 
-  const Name *name =
-      name_CreateFromPacket(msgBuffer, MessagePacketType_Interest);
+  const Name * name =
+      name_CreateFromPacket(msgBuffer, MessagePacketType_ContentObject);
+  name_setLen(name, prefix->len);
+  char * name_str = name_ToString(name);
+  INFO(mapme, "[MAP-Me] Received ack for name prefix=%s seq=%d on conn id=%d",
+          name_str, params->seq, conn_in_id);
+  free(name_str);
 
   FIB *fib = forwarder_getFib(mapme->forwarder);
   FibEntry *fibEntry = fib_Contains(fib, name);
+  if (!fibEntry) {
+    return;
+  }
   parcAssertNotNull(fibEntry,
                     "No corresponding FIB entry for name contained in IU Ack");
 
@@ -758,23 +831,21 @@ void mapMe_onSpecialInterestAck(const MapMe *mapme, const uint8_t *msgBuffer,
 /*
  * Returns true iif the message corresponds to a MAP-Me packet
  */
-bool mapMe_isMapMe(const uint8_t *msgBuffer) {
-  uint8_t next_header = messageHandler_NextHeaderType(msgBuffer);
-
-  const uint8_t *icmp_ptr;
-  if (next_header == IPPROTO_ICMP) {
-    icmp_ptr = msgBuffer + IPV4_HDRLEN;
-  } else if (next_header == IPPROTO_ICMPV6) {
-    icmp_ptr = msgBuffer + IPV6_HDRLEN;
-  } else {
-    return false;
+bool mapMe_isMapMe(const uint8_t *packet) {
+  hicn_mapme_header_t * mapme = (hicn_mapme_header_t*)packet;
+
+  switch(HICN_IP_VERSION(packet)) {
+    case 4:
+      if (mapme->v4.ip.protocol != IPPROTO_ICMP)
+        return false;
+      return HICN_IS_MAPME(mapme->v4.icmp_rd.type, mapme->v4.icmp_rd.code);
+    case 6:
+      if (mapme->v6.ip.nxt != IPPROTO_ICMPV6)
+        return false;
+      return HICN_IS_MAPME(mapme->v6.icmp_rd.type, mapme->v6.icmp_rd.code);
+    default:
+      return false;
   }
-
-  uint8_t type = ((_icmp_header_t *)icmp_ptr)->type;
-  uint8_t code = ((_icmp_header_t *)icmp_ptr)->code;
-  if (HICN_IS_MAPME(type, code)) return true;
-
-  return false;
 }
 
 /**
@@ -794,7 +865,6 @@ void mapMe_Process(const MapMe *mapme, const uint8_t *msgBuffer,
   mapme_params_t params;
   hicn_mapme_parse_packet(msgBuffer, &prefix, &params);
 
-  // XXX Dispatch message dependenging on type
   switch (params.type) {
     case UPDATE:
     case NOTIFICATION:
@@ -805,7 +875,7 @@ void mapMe_Process(const MapMe *mapme, const uint8_t *msgBuffer,
       mapMe_onSpecialInterestAck(mapme, msgBuffer, conn_id, &prefix, &params);
       break;
     default:
-      printf("E:Unknown message\n");
+      ERR(mapme, "[MAP-Me] Unknown message");
       break;
   }
 }
diff --git a/hicn-light/src/hicn/core/mapMe.h b/hicn-light/src/hicn/core/mapMe.h
index a99d4710b..7ea90d299 100644
--- a/hicn-light/src/hicn/core/mapMe.h
+++ b/hicn-light/src/hicn/core/mapMe.h
@@ -26,9 +26,9 @@
 #include <stdbool.h>
 #include <stdint.h>
 
-#include <hicn/io/hicnListener.h>
-
 #include <hicn/hicn.h>
+#include <hicn/core/forwarder.h>
+#include <hicn/core/connection.h>
 #include <hicn/utils/commands.h>
 
 struct mapme;
@@ -63,14 +63,23 @@ void mapMe_Process(const MapMe *mapme, const uint8_t *msgBuffer,
                    unsigned conn_id);
 
 /**
- * @function mapMe_onConnectionAdded
+ * @function mapMe_onConnectionEvent
  * @abstract Callback following the addition of the face though the control
  * protocol.
  * @discussion This callback triggers the sending of control packets by MAP-Me.
  * @param [in] mapme - Pointer to the MAP-Me data structure.
  * @param [in] conn - The newly added connection.
+ * @param [in] event - Connection event
+ */
+void mapMe_onConnectionEvent(const MapMe *mapme, const Connection *conn, connection_event_t event);
+
+#ifdef WITH_POLICY
+
+/**
+ * @function mapMe_onPolicyUpdate
  */
-void mapMe_onConnectionAdded(const MapMe *mapme, const Connection *conn);
+void mapMe_onPolicyUpdate(const MapMe *mapme, const Connection *conn_added, FibEntry * fibEntry);
+#endif /* WITH_POLICY */
 
 /**
  * @function mapMe_getNextHops
diff --git a/hicn-light/src/hicn/core/message.c b/hicn-light/src/hicn/core/message.c
index b0140eda4..5d0d04ae4 100644
--- a/hicn-light/src/hicn/core/message.c
+++ b/hicn-light/src/hicn/core/message.c
@@ -220,7 +220,6 @@ Message *message_CreateWldrNotification(Message *original, uint16_t expected,
   // set notification stuff.
   messageHandler_SetWldrNotification(
       message->messageHead, original->messageHead, expected, lastReceived);
-  // XXX: what about the checksum?
   return message;
 }
 
diff --git a/hicn-light/src/hicn/core/messageHandler.h b/hicn-light/src/hicn/core/messageHandler.h
index c1fc0481a..74535d80f 100644
--- a/hicn-light/src/hicn/core/messageHandler.h
+++ b/hicn-light/src/hicn/core/messageHandler.h
@@ -55,6 +55,11 @@
 
 #include <hicn/core/forwarder.h>
 
+#ifdef WITH_MAPME
+#include <hicn/core/mapMe.h>
+#include <hicn/socket/api.h>
+#endif /* WITH_MAPME */
+
 #define CONNECTION_ID_UNDEFINED -1
 
 static inline uint8_t messageHandler_GetIPPacketType(const uint8_t *message) {
@@ -168,76 +173,32 @@ static inline uint8_t messageHandler_NextHeaderType(const uint8_t *message) {
 
 /* Forward declarations */
 static inline void * messageHandler_GetSource(const uint8_t *message);
-
-/* Helpers */
-
-// NOTE: this function is generalized from the one in hICN listener and takes a
-// forwarder as parameter
-static inline
-const Connection *
-_getConnectionFromPacket(Forwarder * forwarder, Address * localAddress, Address *packetSourceAddress)
-{
-  if (!packetSourceAddress)
-      return NULL;
-
-  AddressPair *pair = addressPair_Create(localAddress,
-          packetSourceAddress);
-  const Connection * conn = connectionTable_FindByAddressPair(
-              forwarder_GetConnectionTable(forwarder), pair);
-  addressPair_Release(&pair);
-
-  return conn;
-}
-
-static inline
-Address *
-_createAddressFromPacket(const uint8_t *msgBuffer)
-{
-  Address *packetAddr = NULL;
-  if (messageHandler_GetIPPacketType(msgBuffer) == IPv6_TYPE) {
-    struct sockaddr_in6 addr_in6;
-    addr_in6.sin6_family = AF_INET6;
-    addr_in6.sin6_port = htons(1234);
-    addr_in6.sin6_flowinfo = 0;
-    addr_in6.sin6_scope_id = 0;
-    memcpy(&addr_in6.sin6_addr,
-           (struct in6_addr *)messageHandler_GetSource(msgBuffer), 16);
-    packetAddr = addressCreateFromInet6(&addr_in6);
-  } else if (messageHandler_GetIPPacketType(msgBuffer) == IPv4_TYPE) {
-    struct sockaddr_in addr_in;
-    addr_in.sin_family = AF_INET;
-    addr_in.sin_port = htons(1234);
-    memcpy(&addr_in.sin_addr,
-           (struct in_addr *)messageHandler_GetSource(msgBuffer), 4);
-    packetAddr = addressCreateFromInet(&addr_in);
-  }
-  return packetAddr;
-}
-
-/* Hooks */
-
-/* ... */
+static inline void *messageHandler_GetDestination(const uint8_t *message);
 
 /* Main hook handler */
 
 /**
  * \brief Handle incoming messages
  * \param [in] forwarder - Reference to the Forwarder instance
- * \param [in] connection_id - A hint on the connection ID on which the packet
- *      was received, CONNECTION_ID_UNDEFINED (-1) otherwise.
- * \param [in] localAddress - Local listener address
- * \param [in] messsage - Buffer possibly containing a hooked message
+ * \param [in] packet - Packet buffer
+ * \param [in] conn_id - A hint on the connection ID on which the packet
+ *      was received
  * \return Flag indicating whether the packet matched a hook and was
  *      (successfully or not) processed.
  */
 static inline bool messageHandler_handleHooks(Forwarder * forwarder,
-        int connection_id, Address * localAddress, const uint8_t * message)
+        const uint8_t * packet, int conn_id)
 {
-  /* ... */
+#ifdef WITH_MAPME
+  if (mapMe_isMapMe(packet)) {
+    forwarder_ProcessMapMe(forwarder, packet, conn_id);
+    goto END;
+  }
+#endif /* WITH_MAPME */
 
   return false;
 
-#if 0 // Enable and jump here when a handler has successfully processed the packet
+#if 1 // Enable and jump here when a handler has successfully processed the packet
 END:
   return true;
 #endif
diff --git a/hicn-light/src/hicn/core/name.c b/hicn-light/src/hicn/core/name.c
index ed3432ec5..8cf8dacbc 100644
--- a/hicn-light/src/hicn/core/name.c
+++ b/hicn-light/src/hicn/core/name.c
@@ -234,3 +234,9 @@ char *name_ToString(const Name *name) {
 void name_setLen(const Name *name, uint8_t len) {
   nameBitvector_setLen(name->content_name, len);
 }
+
+#ifdef WITH_POLICY
+uint32_t name_GetSuffix(const Name * name) {
+    return name->segment;
+}
+#endif /* WITH_POLICY */
diff --git a/hicn-light/src/hicn/core/name.h b/hicn-light/src/hicn/core/name.h
index 8ab75cf05..4eb80cf36 100644
--- a/hicn-light/src/hicn/core/name.h
+++ b/hicn-light/src/hicn/core/name.h
@@ -102,4 +102,8 @@ void name_setLen(const Name *name, uint8_t len);
 Name *name_CreateFromAddress(address_type addressType, union commandAddr addr,
                              uint8_t len);
 
+#ifdef WITH_POLICY
+uint32_t name_GetSuffix(const Name * name);
+#endif /* WITH_POLICY */
+
 #endif  // name_h
diff --git a/hicn-light/src/hicn/io/hicnConnection.c b/hicn-light/src/hicn/io/hicnConnection.c
index 6193e8696..124885b33 100644
--- a/hicn-light/src/hicn/io/hicnConnection.c
+++ b/hicn-light/src/hicn/io/hicnConnection.c
@@ -218,7 +218,6 @@ static void _destroy(IoOperations **opsPtr) {
                __func__, "HicnConnection %p destroyed", (void *)hicnConnState);
   }
 
-  // XXX
   // do not close hicListenerSocket, the listener will close
   // that when its done
   // should I say something to libhicn?
@@ -279,7 +278,6 @@ static bool _send(IoOperations *ops, const Address *dummy, Message *message) {
   _HicnState *hicnConnState = (_HicnState *)ioOperations_GetClosure(ops);
 
   // NAT for HICN
-  // XXX
   if (message_GetType(message) == MessagePacketType_ContentObject) {
     // this is a data packet. We need to put the remote address in the
     // destination field
diff --git a/hicn-light/src/hicn/io/hicnListener.c b/hicn-light/src/hicn/io/hicnListener.c
index 40cdadcd6..e8cab9aca 100644
--- a/hicn-light/src/hicn/io/hicnListener.c
+++ b/hicn-light/src/hicn/io/hicnListener.c
@@ -29,12 +29,6 @@
 #include <hicn/core/connection.h>
 #include <hicn/core/connectionTable.h>
 #include <hicn/core/forwarder.h>
-#ifdef WITH_MAPME
-#include <hicn/config/symbolicNameTable.h>
-#include <hicn/core/mapMe.h>
-#include <hicn/core/message.h>
-#include <hicn/io/hicnTunnel.h>
-#endif /* WITH_MAPME */
 #include <parc/algol/parc_Memory.h>
 #include <parc/algol/parc_Network.h>
 #include <parc/assert/parc_Assert.h>
@@ -82,13 +76,19 @@ static unsigned _getInterfaceIndex(const ListenerOps *ops);
 static const Address *_getListenAddress(const ListenerOps *ops);
 static EncapType _getEncapType(const ListenerOps *ops);
 static int _getSocket(const ListenerOps *ops);
-
-static ListenerOps _hicnTemplate = {.context = NULL,
-                                    .destroy = &_destroy,
-                                    .getInterfaceIndex = &_getInterfaceIndex,
-                                    .getListenAddress = &_getListenAddress,
-                                    .getEncapType = &_getEncapType,
-                                    .getSocket = &_getSocket};
+static unsigned _createNewConnection(ListenerOps *listener, int fd, const AddressPair *pair);
+static const Connection * _lookupConnection(ListenerOps * listener, const AddressPair *pair);
+
+static ListenerOps _hicnTemplate = {
+  .context = NULL,
+  .destroy = &_destroy,
+  .getInterfaceIndex = &_getInterfaceIndex,
+  .getListenAddress = &_getListenAddress,
+  .getEncapType = &_getEncapType,
+  .getSocket = &_getSocket,
+  .createConnection = &_createNewConnection,
+  .lookupConnection = &_lookupConnection,
+};
 
 static void _hicnListener_readcb(int fd, PARCEventType what, void *hicnVoid);
 
@@ -177,12 +177,6 @@ ListenerOps *hicnListener_CreateInet(Forwarder *forwarder, char *symbolic,
   parcAssertFalse(failure, "fcntl failed to set file descriptor flags (%d)",
                   errno);
 
-  hicn->hicn_event = dispatcher_CreateNetworkEvent(
-      forwarder_GetDispatcher(forwarder), true, _hicnListener_readcb,
-      (void *)hicn, hicn->hicn_fd);
-  dispatcher_StartNetworkEvent(forwarder_GetDispatcher(forwarder),
-                               hicn->hicn_event);
-
   ListenerOps *ops = parcMemory_AllocateAndClear(sizeof(ListenerOps));
   parcAssertNotNull(ops, "parcMemory_AllocateAndClear(%zu) returned NULL",
                     sizeof(ListenerOps));
@@ -190,6 +184,13 @@ ListenerOps *hicnListener_CreateInet(Forwarder *forwarder, char *symbolic,
   memcpy(ops, &_hicnTemplate, sizeof(ListenerOps));
   ops->context = hicn;
 
+  hicn->hicn_event = dispatcher_CreateNetworkEvent(
+      forwarder_GetDispatcher(forwarder), true, _hicnListener_readcb,
+      (void *)ops, hicn->hicn_fd);
+  dispatcher_StartNetworkEvent(forwarder_GetDispatcher(forwarder),
+                               hicn->hicn_event);
+
+
   if (logger_IsLoggable(hicn->logger, LoggerFacility_IO, PARCLogLevel_Debug)) {
     logger_Log(hicn->logger, LoggerFacility_IO, PARCLogLevel_Debug, __func__,
                "HicnListener %s created", symbolic);
@@ -267,12 +268,6 @@ ListenerOps *hicnListener_CreateInet6(Forwarder *forwarder, char *symbolic,
   parcAssertFalse(failure, "fcntl failed to set file descriptor flags (%d)",
                   errno);
 
-  hicn->hicn_event = dispatcher_CreateNetworkEvent(
-      forwarder_GetDispatcher(forwarder), true, _hicnListener_readcb,
-      (void *)hicn, hicn->hicn_fd);
-  dispatcher_StartNetworkEvent(forwarder_GetDispatcher(forwarder),
-                               hicn->hicn_event);
-
   ListenerOps *ops = parcMemory_AllocateAndClear(sizeof(ListenerOps));
   parcAssertNotNull(ops, "parcMemory_AllocateAndClear(%zu) returned NULL",
                     sizeof(ListenerOps));
@@ -280,6 +275,12 @@ ListenerOps *hicnListener_CreateInet6(Forwarder *forwarder, char *symbolic,
   memcpy(ops, &_hicnTemplate, sizeof(ListenerOps));
   ops->context = hicn;
 
+  hicn->hicn_event = dispatcher_CreateNetworkEvent(
+      forwarder_GetDispatcher(forwarder), true, _hicnListener_readcb,
+      (void *)ops, hicn->hicn_fd);
+  dispatcher_StartNetworkEvent(forwarder_GetDispatcher(forwarder),
+                               hicn->hicn_event);
+
   if (logger_IsLoggable(hicn->logger, LoggerFacility_IO, PARCLogLevel_Debug)) {
     logger_Log(hicn->logger, LoggerFacility_IO, PARCLogLevel_Debug, __func__,
                "HicnListener %s created", symbolic);
@@ -405,7 +406,6 @@ static void _hicnListener_Destroy(HicnListener **listenerPtr) {
 
   HicnListener *hicn = *listenerPtr;
 
-  // close(hicn->hicn_fd); //XXX close the fd in the hicnlib (detroy listener?)
   dispatcher_DestroyNetworkEvent(forwarder_GetDispatcher(hicn->forwarder),
                                  &hicn->hicn_event);
   logger_Release(&hicn->logger);
@@ -454,8 +454,6 @@ static void _readFrameToDiscard(HicnListener *hicn, int fd) {
                  "Discarded frame from fd %d", fd);
     }
   } else if (nread < 0) {
-    printf("Error trying to discard frame from fd %d: (%d) %s", fd, errno,
-           strerror(errno));
     if (logger_IsLoggable(hicn->logger, LoggerFacility_IO,
                           PARCLogLevel_Error)) {
       logger_Log(hicn->logger, LoggerFacility_IO, PARCLogLevel_Error, __func__,
@@ -465,8 +463,9 @@ static void _readFrameToDiscard(HicnListener *hicn, int fd) {
   }
 }
 
-static unsigned _createNewConnection(HicnListener *hicn, int fd,
+static unsigned _createNewConnection(ListenerOps * listener, int fd,
                                      const AddressPair *pair) {
+  HicnListener * hicn = (HicnListener *)listener->context;
   bool isLocal = false;
 
   // udpConnection_Create takes ownership of the pair
@@ -479,8 +478,11 @@ static unsigned _createNewConnection(HicnListener *hicn, int fd,
   return connid;
 }
 
-const Connection *_findConnectionFromPacket(HicnListener *hicn,
-                                            Address *packetSourceAddress) {
+static const Connection * _lookupConnection(ListenerOps * listener,
+                                const AddressPair *pair) {
+  HicnListener * hicn = (HicnListener*)listener->context;
+  const Address * packetSourceAddress = addressPair_GetLocal(pair);
+
   const Connection *conn = NULL;
   if (hicn->connection_id != -1) {
     conn = connectionTable_FindById(
@@ -500,7 +502,6 @@ const Connection *_findConnectionFromPacket(HicnListener *hicn,
   return conn;
 }
 
-#if 0
 static Address *_createAddressFromPacket(uint8_t *msgBuffer) {
   Address *packetAddr = NULL;
   if (messageHandler_GetIPPacketType(msgBuffer) == IPv6_TYPE) {
@@ -522,25 +523,33 @@ static Address *_createAddressFromPacket(uint8_t *msgBuffer) {
   }
   return packetAddr;
 }
-#endif
 
-static void _handleProbeMessage(HicnListener *hicn, uint8_t *msgBuffer) {
+static void _handleProbeMessage(ListenerOps * listener, uint8_t *msgBuffer) {
+  HicnListener * hicn = (HicnListener *)listener->context;
+
   Address *packetAddr = _createAddressFromPacket(msgBuffer);
+  AddressPair * pair = addressPair_Create(packetAddr, /* dummy */ hicn->localAddress);
 
-  if (packetAddr != NULL) {
-    const Connection *conn = _findConnectionFromPacket(hicn, packetAddr);
-    if (conn != NULL) {
-      // we drop all the probes for a connection that does not exists
-      connection_HandleProbe((Connection *)conn, msgBuffer,
-                             forwarder_GetTicks(hicn->forwarder));
-    }
-  }
+  if (!packetAddr)
+    goto DROP;
+
+  // we drop all the probes for a connection that does not exists
+  const Connection *conn = _lookupConnection(listener, pair);
+  if (!conn)
+    goto DROP;
+
+  connection_HandleProbe((Connection *)conn, msgBuffer,
+        forwarder_GetTicks(hicn->forwarder));
 
+DROP:
+  addressPair_Release(&pair);
   addressDestroy(&packetAddr);
   parcMemory_Deallocate((void **)&msgBuffer);
 }
 
-static void _handleWldrNotification(HicnListener *hicn, uint8_t *msgBuffer) {
+static void _handleWldrNotification(ListenerOps *listener, uint8_t *msgBuffer) {
+  HicnListener * hicn = (HicnListener *)listener->context;
+
   Address *packetAddr = _createAddressFromPacket(msgBuffer);
 
   if (packetAddr == NULL) {
@@ -548,14 +557,18 @@ static void _handleWldrNotification(HicnListener *hicn, uint8_t *msgBuffer) {
     return;
   }
 
-  const Connection *conn = _findConnectionFromPacket(hicn, packetAddr);
+  AddressPair * pair = addressPair_Create(packetAddr, /* dummy */ hicn->localAddress);
+
+  const Connection *conn = _lookupConnection(listener, pair);
+
+  addressPair_Release(&pair);
+  addressDestroy(&packetAddr);
+
   if (conn == NULL) {
-    addressDestroy(&packetAddr);
+    parcMemory_Deallocate((void **)&msgBuffer);
     return;
   }
 
-  addressDestroy(&packetAddr);
-
   Message *message = message_CreateFromByteArray(
       connection_GetConnectionId(conn), msgBuffer,
       MessagePacketType_WldrNotification, forwarder_GetTicks(hicn->forwarder),
@@ -566,75 +579,87 @@ static void _handleWldrNotification(HicnListener *hicn, uint8_t *msgBuffer) {
   message_Release(&message);
 }
 
-#ifdef WITH_MAPME
-static void _handleMapMe(HicnListener *hicn, int fd, uint8_t *msgBuffer) {
-  Address *packetAddr = _createAddressFromPacket(msgBuffer);
-
-  if (packetAddr == NULL) {
-    parcMemory_Deallocate((void **)&msgBuffer);
-    return;
-  }
-
-  const Connection *conn = _findConnectionFromPacket(hicn, packetAddr);
-  unsigned conn_id;
-  if (conn == NULL) {
-    /* Unlike the interest path, we don't create virtual connections bound
-     * on the listener, whose only interest is to send data, but full
-     * tunnels to be able to route interests
-     *
-     * packetAddr is the remote address, we need to ask the lib for our
-     * local address
-     * hicn->localAddress is None as the interest is received by the main
-     * listener.
-     */
-    printf("MapMe, connection did not exist, creating\n");
-
-    /* Populate remote_address through packetAddr */
-    struct sockaddr_in6 sockaddr;  // XXX IPv6 only
-    addressGetInet6(packetAddr, &sockaddr);
-    ip_address_t remote_address = {.family = AF_INET6,
-                                   .prefix_len = IPV6_ADDR_LEN_BITS};
-    memcpy(&remote_address.buffer, &sockaddr.sin6_addr,
-           ip_address_len(&remote_address));
-
-    /* Get local address through libhicn */
-    ip_address_t local_address;
-    int rc = hicn_get_local_address(&remote_address, &local_address);
-    if (rc < 0) {
-      printf("Error getting local address. Discarded mapme packet.\n");
-      return;
-    }
+static const
+AddressPair *
+_createRecvAddressPairFromPacket(const uint8_t *msgBuffer) {
+  Address *packetSrcAddr = NULL; /* This one is in the packet */
+  Address *localAddr = NULL; /* This one is to be determined */
 
+  if (messageHandler_GetIPPacketType(msgBuffer) == IPv6_TYPE) {
     struct sockaddr_in6 addr_in6;
     addr_in6.sin6_family = AF_INET6;
     addr_in6.sin6_port = htons(1234);
     addr_in6.sin6_flowinfo = 0;
     addr_in6.sin6_scope_id = 0;
-    memcpy(&addr_in6.sin6_addr, (struct in6_addr *)&(local_address.buffer), 16);
+    memcpy(&addr_in6.sin6_addr,
+           (struct in6_addr *)messageHandler_GetSource(msgBuffer), 16);
+    packetSrcAddr = addressCreateFromInet6(&addr_in6);
+
+    /* We now determine the local address used to reach the packet src address */
+    int sock = socket (AF_INET6, SOCK_DGRAM, 0);
+    if (sock < 0)
+      goto ERR;
+
+    struct sockaddr_in6 remote, local;
+    memset(&remote, 0, sizeof(remote));
+    remote.sin6_family = AF_INET6;
+    remote.sin6_addr = addr_in6.sin6_addr;
+    remote.sin6_port = htons(1234);
+
+    socklen_t locallen = sizeof(local);
+    if (connect(sock, (const struct sockaddr*)&remote, sizeof(remote)) == -1)
+      goto ERR;
+    if (getsockname(sock, (struct sockaddr*) &local, &locallen) == -1)
+      goto ERR;
 
-    Address *localAddr = addressCreateFromInet6(&addr_in6);
-    IoOperations *ops =
-        hicnTunnel_Create(hicn->forwarder, localAddr, packetAddr);
+    local.sin6_port = htons(1234);
+    localAddr = addressCreateFromInet6(&local);
 
-    if (!ops) {
-      printf("Error creating tunnel. Discarded mapme packet.\n");
-      return;
+    close(sock);
+
+  } else if (messageHandler_GetIPPacketType(msgBuffer) == IPv4_TYPE) {
+    struct sockaddr_in addr_in;
+    addr_in.sin_family = AF_INET;
+    addr_in.sin_port = htons(1234);
+    memcpy(&addr_in.sin_addr,
+           (struct in_addr *)messageHandler_GetSource(msgBuffer), 4);
+    packetSrcAddr = addressCreateFromInet(&addr_in);
+
+    /* We now determine the local address used to reach the packet src address */
+
+    int sock = socket (AF_INET, SOCK_DGRAM, 0);
+    if (sock < 0) {
+      perror("Socket error");
+      goto ERR;
     }
 
-    conn = connection_Create(ops);
+    struct sockaddr_in remote, local;
+    memset(&remote, 0, sizeof(remote));
+    remote.sin_family = AF_INET;
+    remote.sin_addr = addr_in.sin_addr;
+    remote.sin_port = htons(1234);
 
-    connectionTable_Add(forwarder_GetConnectionTable(hicn->forwarder),
-                        (Connection *)conn);
-  }
-  conn_id = connection_GetConnectionId(conn);
+    socklen_t locallen = sizeof(local);
+    if (connect(sock, (const struct sockaddr*)&remote, sizeof(remote)) == -1)
+      goto ERR;
+    if (getsockname(sock, (struct sockaddr*) &local, &locallen) == -1)
+      goto ERR;
 
-  addressDestroy(&packetAddr);
+    local.sin_port = htons(1234);
+    localAddr = addressCreateFromInet(&local);
+
+    close(sock);
+  }
+  /* As this is a receive pair, we swap src and dst */
+  return addressPair_Create(localAddr, packetSrcAddr);
 
-  forwarder_ProcessMapMe(hicn->forwarder, msgBuffer, conn_id);
+ERR:
+  perror("Socket error");
+  return NULL;
 }
-#endif /* WITH_MAPME */
 
-static Message *_readMessage(HicnListener *hicn, int fd, uint8_t *msgBuffer) {
+static Message *_readMessage(ListenerOps * listener, int fd, uint8_t *msgBuffer) {
+  HicnListener * hicn = (HicnListener*)listener->context;
   Message *message = NULL;
 
   ssize_t readLength = read(fd, msgBuffer, MTU_SIZE);
@@ -667,11 +692,13 @@ static Message *_readMessage(HicnListener *hicn, int fd, uint8_t *msgBuffer) {
       // run time) uses as a local address 0::0, so the main tun
       pktType = MessagePacketType_Interest;
       Address *packetAddr = _createAddressFromPacket(msgBuffer);
-      const Connection *conn = _findConnectionFromPacket(hicn, packetAddr);
 
+      AddressPair *pair_find = addressPair_Create(packetAddr, /* dummy */ hicn->localAddress);
+      const Connection *conn = _lookupConnection(listener, pair_find);
+      addressPair_Release(&pair_find);
       if (conn == NULL) {
         AddressPair *pair = addressPair_Create(hicn->localAddress, packetAddr);
-        connid = _createNewConnection(hicn, fd, pair);
+        connid = _createNewConnection(listener, fd, pair);
         addressPair_Release(&pair);
       } else {
         connid = connection_GetConnectionId(conn);
@@ -690,42 +717,52 @@ static Message *_readMessage(HicnListener *hicn, int fd, uint8_t *msgBuffer) {
       parcMemory_Deallocate((void **)&msgBuffer);
     }
   } else if (messageHandler_IsWldrNotification(msgBuffer)) {
-    _handleWldrNotification(hicn, msgBuffer);
+    _handleWldrNotification(listener, msgBuffer);
   } else if (messageHandler_IsLoadBalancerProbe(msgBuffer)) {
-    _handleProbeMessage(hicn, msgBuffer);
-#ifdef WITH_MAPME
-  } else if (mapMe_isMapMe(msgBuffer)) {
-    /* This function triggers the handling of the MAP-Me message, and we
-     * will return NULL so as to terminate the processing of this
-     * msgBuffer. */
-    _handleMapMe(hicn, fd, msgBuffer);
-#endif /* WITH_MAPME */
-  }
+    _handleProbeMessage(listener, msgBuffer);
+  } else {
+    const AddressPair * pair = _createRecvAddressPairFromPacket(msgBuffer);
+    if (!pair)
+      goto ERR;
+
+    /* Find connection and eventually create it */
+    const Connection * conn = connectionTable_FindByAddressPair(
+          forwarder_GetConnectionTable(hicn->forwarder), pair);
+    unsigned conn_id;
+    if (conn == NULL) {
+      conn_id = listener->createConnection(listener, fd, pair);
+    } else {
+      conn_id = connection_GetConnectionId(conn);
+    }
 
-  if (messageHandler_handleHooks(hicn->forwarder, hicn->connection_id,
-              hicn->localAddress, msgBuffer))
-    goto END;
+    messageHandler_handleHooks(hicn->forwarder, msgBuffer, conn_id);
+
+ERR:
+  parcMemory_Deallocate((void **)&msgBuffer);
+
+  }
 
-END:
   return message;
 }
 
-static void _receivePacket(HicnListener *hicn, int fd) {
+static void _receivePacket(ListenerOps * listener, int fd) {
+  HicnListener * hicn = (HicnListener*)listener->context;
   Message *msg = NULL;
   uint8_t *msgBuffer = parcMemory_AllocateAndClear(MTU_SIZE);
-  msg = _readMessage(hicn, fd, msgBuffer);
+  msg = _readMessage(listener, fd, msgBuffer);
 
   if (msg) {
     forwarder_Receive(hicn->forwarder, msg);
   }
 }
 
-static void _hicnListener_readcb(int fd, PARCEventType what, void *hicnVoid) {
-  HicnListener *hicn = (HicnListener *)hicnVoid;
+static void _hicnListener_readcb(int fd, PARCEventType what, void *listener_void) {
+  ListenerOps * listener = (ListenerOps *)listener_void;
+  HicnListener *hicn = (HicnListener *)listener->context;
 
   if (hicn->inetFamily == IPv4 || hicn->inetFamily == IPv6) {
     if (what & PARCEventType_Read) {
-      _receivePacket(hicn, fd);
+      _receivePacket(listener, fd);
     }
   } else {
     _readFrameToDiscard(hicn, fd);
diff --git a/hicn-light/src/hicn/io/listener.h b/hicn-light/src/hicn/io/listener.h
index 3d195ee88..ef1955b12 100644
--- a/hicn-light/src/hicn/io/listener.h
+++ b/hicn-light/src/hicn/io/listener.h
@@ -27,6 +27,8 @@
 #define listener_h
 
 #include <hicn/utils/address.h>
+#include <hicn/io/addressPair.h>
+#include <hicn/core/connection.h>
 
 struct listener_ops;
 typedef struct listener_ops ListenerOps;
@@ -101,5 +103,8 @@ struct listener_ops {
    * @endcode
    */
   int (*getSocket)(const ListenerOps *ops);
+
+  unsigned (*createConnection)(ListenerOps *listener, int fd, const AddressPair *pair);
+  const Connection * (*lookupConnection)(ListenerOps * listener, const AddressPair *pair);
 };
 #endif  // listener_h
diff --git a/hicn-light/src/hicn/io/udpListener.c b/hicn-light/src/hicn/io/udpListener.c
index 3dd4b466c..32f633984 100644
--- a/hicn-light/src/hicn/io/udpListener.c
+++ b/hicn-light/src/hicn/io/udpListener.c
@@ -36,10 +36,6 @@
 #include <hicn/core/forwarder.h>
 #include <hicn/core/messagePacketType.h>
 
-#ifdef WITH_MAPME
-#include <hicn/core/mapMe.h>
-#endif /* WITH_MAPME */
-
 #define IPv4 4
 #define IPv6 6
 
@@ -60,15 +56,21 @@ static unsigned _getInterfaceIndex(const ListenerOps *ops);
 static const Address *_getListenAddress(const ListenerOps *ops);
 static EncapType _getEncapType(const ListenerOps *ops);
 static int _getSocket(const ListenerOps *ops);
+static unsigned _createNewConnection(ListenerOps *listener, int fd, const AddressPair *pair);
+static const Connection * _lookupConnection(ListenerOps * listener, const AddressPair *pair);
+
+static ListenerOps udpTemplate = {
+  .context = NULL,
+  .destroy = &_destroy,
+  .getInterfaceIndex = &_getInterfaceIndex,
+  .getListenAddress = &_getListenAddress,
+  .getEncapType = &_getEncapType,
+  .getSocket = &_getSocket,
+  .createConnection = &_createNewConnection,
+  .lookupConnection = &_lookupConnection,
+};
 
-static ListenerOps udpTemplate = {.context = NULL,
-                                  .destroy = &_destroy,
-                                  .getInterfaceIndex = &_getInterfaceIndex,
-                                  .getListenAddress = &_getListenAddress,
-                                  .getEncapType = &_getEncapType,
-                                  .getSocket = &_getSocket};
-
-static void _readcb(int fd, PARCEventType what, void *udpVoid);
+static void _readcb(int fd, PARCEventType what, void * listener_void);
 
 #ifdef __linux__
 ListenerOps *udpListener_CreateInet6(Forwarder *forwarder,
@@ -123,11 +125,6 @@ ListenerOps *udpListener_CreateInet6(Forwarder *forwarder,
     setsockopt(udp->udp_socket, SOL_SOCKET, SO_BINDTODEVICE,
                      interfaceName, strlen(interfaceName) + 1);
 #endif
-    udp->udp_event =
-        dispatcher_CreateNetworkEvent(forwarder_GetDispatcher(forwarder), true,
-                                      _readcb, (void *)udp, udp->udp_socket);
-    dispatcher_StartNetworkEvent(forwarder_GetDispatcher(forwarder),
-                                 udp->udp_event);
 
     ops = parcMemory_AllocateAndClear(sizeof(ListenerOps));
     parcAssertNotNull(ops, "parcMemory_AllocateAndClear(%zu) returned NULL",
@@ -135,6 +132,12 @@ ListenerOps *udpListener_CreateInet6(Forwarder *forwarder,
     memcpy(ops, &udpTemplate, sizeof(ListenerOps));
     ops->context = udp;
 
+    udp->udp_event =
+        dispatcher_CreateNetworkEvent(forwarder_GetDispatcher(forwarder), true,
+                                      _readcb, (void*)ops, udp->udp_socket);
+    dispatcher_StartNetworkEvent(forwarder_GetDispatcher(forwarder),
+                                 udp->udp_event);
+
     if (logger_IsLoggable(udp->logger, LoggerFacility_IO, PARCLogLevel_Debug)) {
       char *str = addressToString(udp->localAddress);
       logger_Log(udp->logger, LoggerFacility_IO, PARCLogLevel_Debug, __func__,
@@ -214,18 +217,19 @@ ListenerOps *udpListener_CreateInet(Forwarder *forwarder,
     setsockopt(udp->udp_socket, SOL_SOCKET, SO_BINDTODEVICE,
                      interfaceName, strlen(interfaceName) + 1);
 #endif
-    udp->udp_event =
-        dispatcher_CreateNetworkEvent(forwarder_GetDispatcher(forwarder), true,
-                                      _readcb, (void *)udp, udp->udp_socket);
-    dispatcher_StartNetworkEvent(forwarder_GetDispatcher(forwarder),
-                                 udp->udp_event);
-
     ops = parcMemory_AllocateAndClear(sizeof(ListenerOps));
     parcAssertNotNull(ops, "parcMemory_AllocateAndClear(%zu) returned NULL",
                       sizeof(ListenerOps));
     memcpy(ops, &udpTemplate, sizeof(ListenerOps));
     ops->context = udp;
 
+    udp->udp_event =
+        dispatcher_CreateNetworkEvent(forwarder_GetDispatcher(forwarder), true,
+                                      _readcb, (void *)ops, udp->udp_socket);
+    dispatcher_StartNetworkEvent(forwarder_GetDispatcher(forwarder),
+                                 udp->udp_event);
+
+
     if (logger_IsLoggable(udp->logger, LoggerFacility_IO, PARCLogLevel_Debug)) {
       char *str = addressToString(udp->localAddress);
       logger_Log(udp->logger, LoggerFacility_IO, PARCLogLevel_Debug, __func__,
@@ -341,28 +345,12 @@ static AddressPair *_constructAddressPair(UdpListener *udp,
   return pair;
 }
 
-/**
- * @function _lookupConnectionId
- * @abstract  Lookup a connection in the connection table
- * @discussion
- *   Looks up the connection in the connection table and returns the connection
- * id if it exists.
- *
- * @param outputConnectionIdPtr is the output parameter
- * @return true if connection found and outputConnectionIdPtr set
- */
-static bool _lookupConnectionId(UdpListener *udp, AddressPair *pair,
-                                unsigned *outputConnectionIdPtr) {
+static const Connection * _lookupConnection(ListenerOps * listener,
+                                const AddressPair *pair) {
+  UdpListener * udp = (UdpListener *)listener->context;
   ConnectionTable *connTable = forwarder_GetConnectionTable(udp->forwarder);
+  return connectionTable_FindByAddressPair(connTable, pair);
 
-  const Connection *conn = connectionTable_FindByAddressPair(connTable, pair);
-  if (conn) {
-    *outputConnectionIdPtr = connection_GetConnectionId(conn);
-    return true;
-  } else {
-    *outputConnectionIdPtr = 0;
-    return false;
-  }
 }
 
 /**
@@ -378,8 +366,10 @@ static bool _lookupConnectionId(UdpListener *udp, AddressPair *pair,
  * @return The connection id for the new connection
  */
 
-static unsigned _createNewConnection(UdpListener *udp, int fd,
+static unsigned _createNewConnection(ListenerOps * listener, int fd,
                                      const AddressPair *pair) {
+  UdpListener * udp = (UdpListener *)listener->context;
+
   //check it the connection is local
   bool isLocal = false;
   const Address *localAddress = addressPair_GetLocal(pair);
@@ -428,13 +418,23 @@ static void _handleWldrNotification(UdpListener *udp, unsigned connId,
   message_Release(&message);
 }
 
-static Message *_readMessage(UdpListener *udp, int fd,
+static Message *_readMessage(ListenerOps * ops, int fd,
                       AddressPair *pair, uint8_t * packet, bool * processed) {
+  UdpListener * udp = (UdpListener *)ops->context;
 
   Message *message = NULL;
 
-  unsigned connid = 0;
-  bool foundConnection = _lookupConnectionId(udp, pair, &connid);
+  unsigned connid;
+  bool foundConnection;
+
+  const Connection *conn = _lookupConnection(ops, pair);
+  if (conn) {
+    connid = connection_GetConnectionId(conn);
+    foundConnection = true;
+  } else {
+    connid = 0;
+    foundConnection = false;
+  }
 
   if (messageHandler_IsTCP(packet)) {
     *processed = true;
@@ -449,7 +449,7 @@ static Message *_readMessage(UdpListener *udp, int fd,
     } else if (messageHandler_IsInterest(packet)) {
       pktType = MessagePacketType_Interest;
       if (!foundConnection) {
-        connid = _createNewConnection(udp, fd, pair);
+        connid = _createNewConnection(ops, fd, pair);
       }
     } else {
       printf("Got a packet that is not a data nor an interest, drop it!\n");
@@ -470,25 +470,20 @@ static Message *_readMessage(UdpListener *udp, int fd,
   } else if (messageHandler_IsLoadBalancerProbe(packet)) {
     *processed = true;
     _handleProbeMessage(udp, packet);
-#ifdef WITH_MAPME
-  } else if (mapMe_isMapMe(packet)) {
-    *processed = true;
-    forwarder_ProcessMapMe(udp->forwarder, packet, connid);
-#endif /* WITH_MAPME */
-  }
+  } else {
+    /* Generic hook handler */
+    if (!foundConnection)
+      connid = _createNewConnection(ops, fd, pair);
 
-  /* Generic hook handler */
-  if (messageHandler_handleHooks(udp->forwarder, CONNECTION_ID_UNDEFINED,
-              udp->localAddress, packet))
-      goto END;
-END:
+    *processed = messageHandler_handleHooks(udp->forwarder, packet, connid);
+  }
 
   return message;
 }
 
-static void _readCommand(UdpListener *udp, int fd,
-                        AddressPair *pair,
-                        uint8_t * command) {
+static void _readCommand(ListenerOps * listener, int fd,
+                        AddressPair *pair, uint8_t * command) {
+  UdpListener * udp = (UdpListener *)listener->context;
 
   if (*command != REQUEST_LIGHT){
     printf("the message received is not a command, drop\n");
@@ -502,10 +497,13 @@ static void _readCommand(UdpListener *udp, int fd,
     return;
   }
 
-  unsigned connid = 0;
-  bool foundConnection = _lookupConnectionId(udp, pair, &connid);
-  if(!foundConnection){
-    connid = _createNewConnection(udp, fd, pair);
+  unsigned connid;
+
+  const Connection *conn = _lookupConnection(listener, pair);
+  if (conn) {
+    connid = connection_GetConnectionId(conn);
+  } else {
+    connid = _createNewConnection(listener, fd, pair);
   }
 
   struct iovec *request;
@@ -525,11 +523,12 @@ static void _readCommand(UdpListener *udp, int fd,
 }
 
 
-static bool _receivePacket(UdpListener *udp, int fd,
+static bool _receivePacket(ListenerOps * listener, int fd,
                            AddressPair *pair,
                            uint8_t * packet) {
+  UdpListener * udp = (UdpListener *)listener->context;
   bool processed = false;
-  Message *message = _readMessage(udp, fd, pair,
+  Message *message = _readMessage(listener, fd, pair,
                                    packet, &processed);
   if (message) {
     forwarder_Receive(udp->forwarder, message);
@@ -537,8 +536,9 @@ static bool _receivePacket(UdpListener *udp, int fd,
   return processed;
 }
 
-static void _readcb(int fd, PARCEventType what, void *udpVoid) {
-  UdpListener *udp = (UdpListener *)udpVoid;
+static void _readcb(int fd, PARCEventType what, void * listener_void) {
+  ListenerOps * listener = (ListenerOps *)listener_void;
+  UdpListener * udp = (UdpListener *)listener->context;
 
   if (logger_IsLoggable(udp->logger, LoggerFacility_IO, PARCLogLevel_Debug)) {
     logger_Log(udp->logger, LoggerFacility_IO, PARCLogLevel_Debug, __func__,
@@ -546,7 +546,7 @@ static void _readcb(int fd, PARCEventType what, void *udpVoid) {
                (what & PARCEventType_Timeout) ? " timeout" : "",
                (what & PARCEventType_Read) ? " read" : "",
                (what & PARCEventType_Write) ? " write" : "",
-               (what & PARCEventType_Signal) ? " signal" : "", udpVoid);
+               (what & PARCEventType_Signal) ? " signal" : "", udp);
   }
 
   if (what & PARCEventType_Read) {
@@ -570,9 +570,9 @@ static void _readcb(int fd, PARCEventType what, void *udpVoid) {
     AddressPair *pair = _constructAddressPair(
       udp, (struct sockaddr *)&peerIpAddress, peerIpAddressLength);
 
-    bool done = _receivePacket(udp, fd, pair, packet);
+    bool done = _receivePacket(listener, fd, pair, packet);
     if(!done){
-      _readCommand(udp, fd, pair, packet);
+      _readCommand(listener, fd, pair, packet);
     }
 
     addressPair_Release(&pair);
diff --git a/hicn-light/src/hicn/processor/fib.c b/hicn-light/src/hicn/processor/fib.c
index 19e4db60b..7cb94d4ba 100644
--- a/hicn-light/src/hicn/processor/fib.c
+++ b/hicn-light/src/hicn/processor/fib.c
@@ -81,7 +81,6 @@ void _destroyNode(FibNode *n) {
 }
 
 void _destroyFib(FIB *fib) {
-  // XXX
   // to be done
   return;
 }
@@ -103,6 +102,13 @@ void fib_Add(FIB *fib, FibEntry *entry) {
 
   NameBitvector *name = name_GetContentName(fibEntry_GetPrefix(entry));
 
+  //if the name len is 0, we add this entry on the root
+  if(nameBitvector_GetLength(name) == 0){
+    fib->size++;
+    fib->root->entry = entry;
+    return;
+  }
+
   // search the name
   FibNode *prev = fib->root;
   FibNode *curr;
@@ -122,7 +128,7 @@ void fib_Add(FIB *fib, FibEntry *entry) {
     }
   }
 
-  if (curr->entry != NULL &&
+  if (curr->entry != NULL && curr->pos != NULL_POS &&
       nameBitvector_Equals(
           name, name_GetContentName(fibEntry_GetPrefix(curr->entry)))) {
     // there is already an entry with this name
@@ -134,9 +140,10 @@ void fib_Add(FIB *fib, FibEntry *entry) {
   // if the name is not in the FIB search for the first different bit between
   // the new name to add and the node found in the trie
   uint8_t pos = MSB_POS;
-  if (curr->entry != NULL)
+  if (curr->entry != NULL && curr->pos != NULL_POS){
     pos = nameBitvector_firstDiff(
         name, name_GetContentName(fibEntry_GetPrefix(curr->entry)));
+  }
 
   // reset pointer and search the insertion point
   prev = fib->root;
@@ -182,6 +189,13 @@ FibEntry *fib_Contains(const FIB *fib, const Name *prefix) {
 
   NameBitvector *name = name_GetContentName(prefix);
 
+  //if prefix len is 0 it must be stored in the root.
+  //if the root entry is null we need to create it, otherwise
+  //we just need to add an other nexthop
+  if(nameBitvector_GetLength(name) == 0){
+    return fib->root->entry;
+  }
+
   // this is the same as the first part of the add function
   // we cannnot call this function inside the add because
   // we need the pointer prev and curr for the insertion
@@ -204,7 +218,7 @@ FibEntry *fib_Contains(const FIB *fib, const Name *prefix) {
     }
   }
 
-  if (curr->entry != NULL &&
+  if (curr->entry != NULL && curr->pos != NULL_POS &&
       nameBitvector_Equals(
           name, name_GetContentName(fibEntry_GetPrefix(curr->entry)))) {
     return curr->entry;
@@ -333,7 +347,17 @@ void fib_Remove(FIB *fib, const Name *name, unsigned connId) {
 
   fibEntry_RemoveNexthopByConnectionId(entry, connId);
   if (fibEntry_NexthopCount(entry) == 0) {
-    _removeNode(fib, name);
+    //if the len is 0, just release the fibEntry on the root node
+    if(nameBitvector_GetLength(
+              name_GetContentName(fibEntry_GetPrefix(entry))) == 0){
+      parcAssertTrue(entry == fib->root->entry,
+          "prefix len == 0, entry is not in the FIB root");
+      fib->size--;
+      fibEntry_Release(&entry);
+      fib->root->entry = NULL;
+    } else {
+      _removeNode(fib, name);
+    }
   }
 }
 
@@ -352,10 +376,20 @@ void _removeConnectionId(FibNode *n, unsigned pos, unsigned connectionId,
 void fib_RemoveConnectionId(FIB *fib, unsigned connectionId) {
   parcAssertNotNull(fib, "Parameter must be non-null");
 
+  // 0 - remove the connection id from the root
   // 1 - we vist the tree to remove the connection id
   // 2 - during the visit we collect the fib entry with 0 nexthop
   // 3 - after the visit we remove this entries
 
+  if(fib->root->entry){
+    fibEntry_RemoveNexthopByConnectionId(fib->root->entry, connectionId);
+    if(fibEntry_NexthopCount(fib->root->entry) == 0){
+      fib->size--;
+      fibEntry_Release(&fib->root->entry);
+      fib->root->entry = NULL;
+    }
+  }
+
   FibEntryList *list = fibEntryList_Create();
 
   _removeConnectionId(fib->root->left, fib->root->pos, connectionId, list);
@@ -393,7 +427,7 @@ FibEntry *fib_Match(const FIB *fib, const Message *interestMessage) {
   while (prev->pos > curr->pos) {
     prev = curr;
 
-    if (curr->entry != NULL) {
+    if (curr->entry != NULL && curr->pos != NULL_POS) {
       if (nameBitvector_StartsWith(
               name, name_GetContentName(fibEntry_GetPrefix(curr->entry))) &&
           nameBitvector_GetLength(
@@ -410,7 +444,7 @@ FibEntry *fib_Match(const FIB *fib, const Message *interestMessage) {
       curr = curr->left;
   }
 
-  if (curr->entry != NULL) {
+  if (curr->entry != NULL && curr->pos != NULL_POS) {
     if (nameBitvector_StartsWith(
             name, name_GetContentName(fibEntry_GetPrefix(curr->entry))) &&
         nameBitvector_GetLength(
@@ -424,10 +458,73 @@ FibEntry *fib_Match(const FIB *fib, const Message *interestMessage) {
   if (match != NULL && match->entry != NULL) {
     return match->entry;
   } else {
-    return NULL;
+    //if there is a  default route, return it.
+    //the dafualt route is in the route
+    return fib->root->entry;
   }
 }
 
+#ifdef WITH_MAPME
+
+FibEntry *fib_LPM(const FIB *fib, const Name * prefix) {
+  parcAssertNotNull(fib, "Parameter must be non-null");
+  parcAssertNotNull(prefix, "Parameter must be non-null");
+
+  NameBitvector *name = name_GetContentName(prefix);
+
+  FibNode *prev = fib->root;
+  FibNode *curr;
+
+  FibNode *match = NULL;
+  unsigned len = 0;
+
+  if (nameBitvector_testBit(name, MSB_POS))
+    curr = fib->root->right;
+  else
+    curr = fib->root->left;
+
+  while (prev->pos > curr->pos) {
+    prev = curr;
+
+    if (curr->entry != NULL && curr->pos != NULL_POS) {
+      if (nameBitvector_StartsWith(
+              name, name_GetContentName(fibEntry_GetPrefix(curr->entry))) &&
+          nameBitvector_GetLength(
+              name_GetContentName(fibEntry_GetPrefix(curr->entry))) > len) {
+        match = curr;
+        len = nameBitvector_GetLength(
+            name_GetContentName(fibEntry_GetPrefix(curr->entry)));
+      }
+    }
+
+    if (nameBitvector_testBit(name, curr->pos))
+      curr = curr->right;
+    else
+      curr = curr->left;
+  }
+
+  if (curr->entry != NULL && curr->pos != NULL_POS) {
+    if (nameBitvector_StartsWith(
+            name, name_GetContentName(fibEntry_GetPrefix(curr->entry))) &&
+        nameBitvector_GetLength(
+            name_GetContentName(fibEntry_GetPrefix(curr->entry))) > len) {
+      match = curr;
+      len = nameBitvector_GetLength(
+          name_GetContentName(fibEntry_GetPrefix(curr->entry)));
+    }
+  }
+
+  if (match != NULL && match->entry != NULL) {
+    return match->entry;
+  } else {
+    //if there is a  default route, return it.
+    //the dafualt route is in the route
+    return fib->root->entry;
+  }
+}
+
+#endif /* WITH_MAPME */
+
 void _collectFibEntries(FibNode *n, int pos, FibEntryList *list) {
   if (n->pos < (unsigned)pos) {
     fibEntryList_Append(list, n->entry);
@@ -441,6 +538,10 @@ FibEntryList *fib_GetEntries(const FIB *fib) {
 
   FibEntryList *list = fibEntryList_Create();
 
+  if(fib->root->entry){
+    fibEntryList_Append(list, fib->root->entry);
+  }
+
   _collectFibEntries(fib->root->left, fib->root->pos, list);
   _collectFibEntries(fib->root->right, fib->root->pos, list);
 
diff --git a/hicn-light/src/hicn/processor/fib.h b/hicn-light/src/hicn/processor/fib.h
index 28ea19a0d..8c03537fe 100644
--- a/hicn-light/src/hicn/processor/fib.h
+++ b/hicn-light/src/hicn/processor/fib.h
@@ -37,6 +37,10 @@ void fib_RemoveConnectionId(FIB *fib, unsigned connectionId);
 
 FibEntry *fib_Match(const FIB *fib, const Message *interestMessage);
 
+#ifdef WITH_MAPME
+FibEntry *fib_LPM(const FIB *fib, const Name * name);
+#endif /* WITH_MAPME */
+
 size_t fib_Length(const FIB *fib);
 
 FibEntryList *fib_GetEntries(const FIB *fib);
diff --git a/hicn-light/src/hicn/processor/fibEntry.c b/hicn-light/src/hicn/processor/fibEntry.c
index 6f6b3aa12..15d754168 100644
--- a/hicn-light/src/hicn/processor/fibEntry.c
+++ b/hicn-light/src/hicn/processor/fibEntry.c
@@ -35,18 +35,47 @@
 #include <parc/assert/parc_Assert.h>
 
 #include <hicn/utils/commands.h>
+#include <hicn/core/connectionState.h>
+
+#ifdef WITH_POLICY
+#include <hicn/core/forwarder.h>
+#include <hicn/utils/policy.h>
+
+#ifdef WITH_MAPME
+#include <hicn/core/mapMe.h>
+#endif /* WITH_MAPME */
+
+#define ALPHA 0.5
+
+#endif /* WITH_POLICY */
 
 struct fib_entry {
   Name *name;
   unsigned refcount;
   StrategyImpl *fwdStrategy;
+#ifdef WITH_POLICY
+  NumberSet *nexthops;
+  const Forwarder * forwarder;
+  policy_t policy;
+  policy_counters_t policy_counters;
+  NumberSet *available_nexthops;
+#ifdef WITH_MAPME
+  /* In case of no multipath, this stores the previous decision taken by policy */
+  unsigned previous_nexthop;
+#endif /* WITH_MAPME */
+#endif /* WITH_POLICY */
 #ifdef WITH_MAPME
   void *userData;
   void (*userDataRelease)(void **userData);
 #endif /* WITH_MAPME */
 };
 
+#ifdef WITH_POLICY
+FibEntry *fibEntry_Create(Name *name, strategy_type fwdStrategy, const Forwarder * forwarder) {
+  ConnectionTable * table = forwarder_GetConnectionTable(forwarder);
+#else
 FibEntry *fibEntry_Create(Name *name, strategy_type fwdStrategy) {
+#endif /* WITH_POLICY */
   FibEntry *fibEntry = parcMemory_AllocateAndClear(sizeof(FibEntry));
   parcAssertNotNull(fibEntry, "parcMemory_AllocateAndClear(%zu) returned NULL",
                     sizeof(FibEntry));
@@ -55,27 +84,47 @@ FibEntry *fibEntry_Create(Name *name, strategy_type fwdStrategy) {
   if (fwdStrategy) {
     switch (fwdStrategy) {
       case SET_STRATEGY_LOADBALANCER:
+#ifdef WITH_POLICY
+        fibEntry->fwdStrategy = strategyLoadBalancer_Create(table);
+#else
         fibEntry->fwdStrategy = strategyLoadBalancer_Create();
+#endif /* WITH_POLICY */
         break;
 
       case SET_STRATEGY_RANDOM_PER_DASH_SEGMENT:
+#ifdef WITH_POLICY
+        fibEntry->fwdStrategy = strategyRndSegment_Create(table);
+#else
         fibEntry->fwdStrategy = strategyRndSegment_Create();
+#endif /* WITH_POLICY */
         break;
 
       case SET_STRATEGY_LOADBALANCER_WITH_DELAY:
+#ifdef WITH_POLICY
+        fibEntry->fwdStrategy = strategyLoadBalancerWithPD_Create(table);
+#else
         fibEntry->fwdStrategy = strategyLoadBalancerWithPD_Create();
+#endif /* WITH_POLICY */
         break;
 
       default:
-        // LB is the defualt strategy
+        // LB is the default strategy
+#ifdef WITH_POLICY
+        fibEntry->fwdStrategy = strategyLoadBalancer_Create(table);
+#else
         fibEntry->fwdStrategy = strategyLoadBalancer_Create();
+#endif /* WITH_POLICY */
         // the LB strategy is the default one
         // other strategies can be set using the appropiate function
         break;
     }
 
   } else {
+#ifdef WITH_POLICY
+    fibEntry->fwdStrategy = strategyLoadBalancer_Create(table);
+#else
     fibEntry->fwdStrategy = strategyLoadBalancer_Create();
+#endif /* WITH_POLICY */
   }
 
   fibEntry->refcount = 1;
@@ -85,6 +134,16 @@ FibEntry *fibEntry_Create(Name *name, strategy_type fwdStrategy) {
   fibEntry->userDataRelease = NULL;
 #endif /* WITH_MAPME */
 
+#ifdef WITH_POLICY
+  fibEntry->nexthops = numberSet_Create();
+  fibEntry->forwarder = forwarder;
+  fibEntry->policy = POLICY_NONE;
+  fibEntry->policy_counters = POLICY_COUNTERS_NONE;
+#ifdef WITH_MAPME
+  fibEntry->previous_nexthop = ~0;
+#endif /* WITH_MAPME */
+#endif /* WITH_POLICY */
+
   return fibEntry;
 }
 
@@ -114,23 +173,42 @@ void fibEntry_Release(FibEntry **fibEntryPtr) {
 
 void fibEntry_SetStrategy(FibEntry *fibEntry, strategy_type strategy) {
   StrategyImpl *fwdStrategyImpl;
+#ifdef WITH_POLICY
+  ConnectionTable * table = forwarder_GetConnectionTable(fibEntry->forwarder);
+#endif /* WITH_POLICY */
 
   switch (strategy) {
     case SET_STRATEGY_LOADBALANCER:
+#ifdef WITH_POLICY
+      fwdStrategyImpl = strategyLoadBalancer_Create(table);
+#else
       fwdStrategyImpl = strategyLoadBalancer_Create();
+#endif /* WITH_POLICY */
       break;
 
     case SET_STRATEGY_RANDOM_PER_DASH_SEGMENT:
+#ifdef WITH_POLICY
+      fwdStrategyImpl = strategyRndSegment_Create(table);
+#else
       fwdStrategyImpl = strategyRndSegment_Create();
+#endif /* WITH_POLICY */
       break;
 
     case SET_STRATEGY_LOADBALANCER_WITH_DELAY:
+#ifdef WITH_POLICY
+      fwdStrategyImpl = strategyLoadBalancerWithPD_Create(table);
+#else
       fwdStrategyImpl = strategyLoadBalancerWithPD_Create();
+#endif /* WITH_POLICY */
       break;
 
     default:
       // LB is the defualt strategy
+#ifdef WITH_POLICY
+      fwdStrategyImpl = strategyLoadBalancer_Create(table);
+#else
       fwdStrategyImpl = strategyLoadBalancer_Create();
+#endif /* WITH_POLICY */
       // the LB strategy is the default one
       // other strategies can be set using the appropiate function
       break;
@@ -145,47 +223,648 @@ void fibEntry_SetStrategy(FibEntry *fibEntry, strategy_type strategy) {
   fibEntry->fwdStrategy->destroy(&(fibEntry->fwdStrategy));
   fibEntry->fwdStrategy = fwdStrategyImpl;
 }
+
+#ifdef WITH_POLICY
+
+/*
+ * Update available next hops following policy update.
+ */
+NumberSet *
+fibEntry_GetAvailableNextHops(const FibEntry *fibEntry, unsigned in_connection) {
+  ConnectionTable * table = forwarder_GetConnectionTable(fibEntry->forwarder);
+  NumberSet * nexthops;
+  policy_t policy = fibEntry_GetPolicy(fibEntry);
+
+  /* Reset available next hops and start filtering */
+  NumberSet * available_nexthops = numberSet_Create();
+
+  /*
+   * Give absolute preference to local faces, with no policy, unless
+   * in_connection == ~0, which means we are searching faces on which to
+   * advertise our prefix
+   */
+  if (in_connection == ~0) {
+    /* We might advertise among all available up connections */
+    nexthops = numberSet_Create();
+
+    ConnectionList * list = connectionTable_GetEntries(table);
+    for (size_t i = 0; i < connectionList_Length(list); i++) {
+      Connection *conn = connectionList_Get(list, i);
+      if (connection_GetState(conn) == CONNECTION_STATE_DOWN)
+        continue;
+      if (connection_IsLocal(conn))
+        continue;
+      numberSet_Add(nexthops, connection_GetConnectionId(conn));
+    }
+
+  } else {
+    nexthops = (NumberSet*)fibEntry_GetNexthops(fibEntry);
+    for (size_t k = 0; k < numberSet_Length(nexthops); k++) {
+      unsigned conn_id = numberSet_GetItem(nexthops, k);
+      /* Filtering out ingress face */
+      if (conn_id == in_connection)
+        continue;
+      /* Filtering out DOWN faces */
+      const Connection *  conn = connectionTable_FindById(table, conn_id);
+      if (!conn)
+        continue;
+      if (connection_GetState(conn) == CONNECTION_STATE_DOWN)
+        continue;
+      if (!connection_IsLocal(conn))
+        continue;
+      numberSet_Add(available_nexthops, conn_id);
+    }
+
+    if (numberSet_Length(available_nexthops) > 0)
+      return available_nexthops;
+  }
+
+  for (size_t k = 0; k < numberSet_Length(nexthops); k++) {
+    unsigned conn_id = numberSet_GetItem(nexthops, k);
+    const Connection * conn;
+
+    /* Filtering out ingress face */
+    if (conn_id == in_connection)
+      continue;
+
+    /* Filtering out DOWN faces */
+    conn = connectionTable_FindById(table, conn_id);
+    if (!conn)
+      continue;
+    if (connection_GetState(conn) == CONNECTION_STATE_DOWN)
+      continue;
+
+    /* Policy filtering : next hops */
+    if ((policy.tags[POLICY_TAG_WIRED].state == POLICY_STATE_REQUIRE) &&
+        (!connection_HasTag(conn, POLICY_TAG_WIRED)))
+      continue;
+    if ((policy.tags[POLICY_TAG_WIRED].state == POLICY_STATE_PROHIBIT) &&
+        (connection_HasTag(conn, POLICY_TAG_WIRED)))
+      continue;
+    if ((policy.tags[POLICY_TAG_WIFI].state == POLICY_STATE_REQUIRE) &&
+        (!connection_HasTag(conn, POLICY_TAG_WIFI)))
+      continue;
+    if ((policy.tags[POLICY_TAG_WIFI].state == POLICY_STATE_PROHIBIT) &&
+        (connection_HasTag(conn, POLICY_TAG_WIFI)))
+      continue;
+    if ((policy.tags[POLICY_TAG_CELLULAR].state == POLICY_STATE_REQUIRE) &&
+        (!connection_HasTag(conn, POLICY_TAG_CELLULAR)))
+      continue;
+    if ((policy.tags[POLICY_TAG_CELLULAR].state == POLICY_STATE_PROHIBIT) &&
+        (connection_HasTag(conn, POLICY_TAG_CELLULAR)))
+      continue;
+    if ((policy.tags[POLICY_TAG_TRUSTED].state == POLICY_STATE_REQUIRE) &&
+        (!connection_HasTag(conn, POLICY_TAG_TRUSTED)))
+      continue;
+    if ((policy.tags[POLICY_TAG_TRUSTED].state == POLICY_STATE_PROHIBIT) &&
+        (connection_HasTag(conn, POLICY_TAG_TRUSTED)))
+      continue;
+
+    numberSet_Add(available_nexthops, conn_id);
+  }
+
+  if (numberSet_Length(available_nexthops) == 0)
+    return available_nexthops;
+
+  /* We have at least one matching next hop, implement heuristic */
+
+  /*
+   * As VPN connections might trigger duplicate uses of one interface, we start
+   * by filtering out interfaces based on trust status.
+   */
+  NumberSet * filtered_nexthops = numberSet_Create();
+  if ((policy.tags[POLICY_TAG_TRUSTED].state == POLICY_STATE_REQUIRE) ||
+      (policy.tags[POLICY_TAG_TRUSTED].state == POLICY_STATE_PREFER)) {
+    /* Try to filter out NON TRUSTED faces */
+    for (size_t k = 0; k < numberSet_Length(available_nexthops); k++) {
+      unsigned conn_id = numberSet_GetItem(available_nexthops, k);
+      const Connection * conn = connectionTable_FindById(table, conn_id);
+      if (!connection_HasTag(conn, POLICY_TAG_TRUSTED))
+          continue;
+      numberSet_Add(filtered_nexthops, conn_id);
+    }
+  } else {
+      /* Try to filter out TRUSTED faces */
+    for (size_t k = 0; k < numberSet_Length(available_nexthops); k++) {
+      unsigned conn_id = numberSet_GetItem(available_nexthops, k);
+      const Connection * conn = connectionTable_FindById(table, conn_id);
+      if (connection_HasTag(conn, POLICY_TAG_TRUSTED))
+          continue;
+      numberSet_Add(filtered_nexthops, conn_id);
+    }
+  }
+  if (numberSet_Length(filtered_nexthops) > 0) {
+    numberSet_Release(&available_nexthops);
+    available_nexthops = numberSet_Create();
+    numberSet_AddSet(available_nexthops, filtered_nexthops);
+  }
+  numberSet_Release(&filtered_nexthops);
+
+  /* Other preferences */
+  if (policy.tags[POLICY_TAG_WIRED].state == POLICY_STATE_AVOID) {
+    filtered_nexthops = numberSet_Create();
+    for (size_t k = 0; k < numberSet_Length(available_nexthops); k++) {
+      unsigned conn_id = numberSet_GetItem(available_nexthops, k);
+      const Connection * conn = connectionTable_FindById(table, conn_id);
+      if (connection_HasTag(conn, POLICY_TAG_WIRED))
+          continue;
+      numberSet_Add(filtered_nexthops, conn_id);
+    }
+    if (numberSet_Length(filtered_nexthops) > 0) {
+        numberSet_Release(&available_nexthops);
+        available_nexthops = numberSet_Create();
+        numberSet_AddSet(available_nexthops, filtered_nexthops);
+    }
+    numberSet_Release(&filtered_nexthops);
+  }
+  if (policy.tags[POLICY_TAG_WIFI].state == POLICY_STATE_AVOID) {
+    filtered_nexthops = numberSet_Create();
+    for (size_t k = 0; k < numberSet_Length(available_nexthops); k++) {
+      unsigned conn_id = numberSet_GetItem(available_nexthops, k);
+      const Connection * conn = connectionTable_FindById(table, conn_id);
+      if (connection_HasTag(conn, POLICY_TAG_WIFI))
+          continue;
+      numberSet_Add(filtered_nexthops, conn_id);
+    }
+    if (numberSet_Length(filtered_nexthops) > 0) {
+        numberSet_Release(&available_nexthops);
+        available_nexthops = numberSet_Create();
+        numberSet_AddSet(available_nexthops, filtered_nexthops);
+    }
+    numberSet_Release(&filtered_nexthops);
+  }
+  if (policy.tags[POLICY_TAG_CELLULAR].state == POLICY_STATE_AVOID) {
+    filtered_nexthops = numberSet_Create();
+    for (size_t k = 0; k < numberSet_Length(available_nexthops); k++) {
+      unsigned conn_id = numberSet_GetItem(available_nexthops, k);
+      const Connection * conn = connectionTable_FindById(table, conn_id);
+      if (connection_HasTag(conn, POLICY_TAG_CELLULAR))
+          continue;
+      numberSet_Add(filtered_nexthops, conn_id);
+    }
+    if (numberSet_Length(filtered_nexthops) > 0) {
+        numberSet_Release(&available_nexthops);
+        available_nexthops = numberSet_Create();
+        numberSet_AddSet(available_nexthops, filtered_nexthops);
+    }
+    numberSet_Release(&filtered_nexthops);
+  }
+
+  if (policy.tags[POLICY_TAG_WIRED].state == POLICY_STATE_PREFER) {
+    filtered_nexthops = numberSet_Create();
+    for (size_t k = 0; k < numberSet_Length(available_nexthops); k++) {
+      unsigned conn_id = numberSet_GetItem(available_nexthops, k);
+      const Connection * conn = connectionTable_FindById(table, conn_id);
+      if (!connection_HasTag(conn, POLICY_TAG_WIRED))
+          continue;
+      numberSet_Add(filtered_nexthops, conn_id);
+    }
+    if (numberSet_Length(filtered_nexthops) > 0) {
+        numberSet_Release(&available_nexthops);
+        available_nexthops = numberSet_Create();
+        numberSet_AddSet(available_nexthops, filtered_nexthops);
+    }
+    numberSet_Release(&filtered_nexthops);
+  }
+  if (policy.tags[POLICY_TAG_WIFI].state == POLICY_STATE_PREFER) {
+    filtered_nexthops = numberSet_Create();
+    for (size_t k = 0; k < numberSet_Length(available_nexthops); k++) {
+      unsigned conn_id = numberSet_GetItem(available_nexthops, k);
+      const Connection * conn = connectionTable_FindById(table, conn_id);
+      if (!connection_HasTag(conn, POLICY_TAG_WIFI))
+          continue;
+      numberSet_Add(filtered_nexthops, conn_id);
+    }
+    if (numberSet_Length(filtered_nexthops) > 0) {
+        numberSet_Release(&available_nexthops);
+        available_nexthops = numberSet_Create();
+        numberSet_AddSet(available_nexthops, filtered_nexthops);
+    }
+    numberSet_Release(&filtered_nexthops);
+  }
+  if (policy.tags[POLICY_TAG_CELLULAR].state == POLICY_STATE_PREFER) {
+    filtered_nexthops = numberSet_Create();
+    for (size_t k = 0; k < numberSet_Length(available_nexthops); k++) {
+      unsigned conn_id = numberSet_GetItem(available_nexthops, k);
+      const Connection * conn = connectionTable_FindById(table, conn_id);
+      if (!connection_HasTag(conn, POLICY_TAG_CELLULAR))
+          continue;
+      numberSet_Add(filtered_nexthops, conn_id);
+    }
+    if (numberSet_Length(filtered_nexthops) > 0) {
+        numberSet_Release(&available_nexthops);
+        available_nexthops = numberSet_Create();
+        numberSet_AddSet(available_nexthops, filtered_nexthops);
+    }
+    numberSet_Release(&filtered_nexthops);
+  }
+
+  return available_nexthops;
+}
+
+policy_t fibEntry_GetPolicy(const FibEntry *fibEntry) {
+  return fibEntry->policy;
+}
+
+void fibEntry_ReconsiderPolicy(FibEntry *fibEntry) {
+#ifdef WITH_MAPME
+  NumberSet * available_nexthops = fibEntry_GetAvailableNextHops(fibEntry, ~0);
+
+  if (numberSet_Length(available_nexthops) == 0)
+    goto END;
+
+  /* Multipath */
+  if ((fibEntry->policy.tags[POLICY_TAG_MULTIPATH].state != POLICY_STATE_PROHIBIT) &&
+        (fibEntry->policy.tags[POLICY_TAG_MULTIPATH].state != POLICY_STATE_AVOID))
+    goto END;
+
+  unsigned nexthop = numberSet_GetItem(available_nexthops, 0);
+  if (nexthop != fibEntry->previous_nexthop) {
+    /* Policy has elected a new nexthop, signal it using MAP-Me */
+    fibEntry->previous_nexthop = nexthop;
+    ConnectionTable * table = forwarder_GetConnectionTable(fibEntry->forwarder);
+    const Connection * conn = connectionTable_FindById(table, nexthop);
+    mapMe_onPolicyUpdate(forwarder_getMapmeInstance(fibEntry->forwarder), conn, fibEntry);
+  }
+
+END:
+  numberSet_Release(&available_nexthops);
+#endif /* WITH_MAPME */
+}
+
+void fibEntry_SetPolicy(FibEntry *fibEntry, policy_t policy) {
+  fibEntry->policy = policy;
+  fibEntry_ReconsiderPolicy(fibEntry);
+}
+
+#endif /* WITH_POLICY */
+
 void fibEntry_AddNexthop(FibEntry *fibEntry, unsigned connectionId) {
   parcAssertNotNull(fibEntry, "Parameter fibEntry must be non-null");
+#ifdef WITH_POLICY
+  if (!numberSet_Contains(fibEntry->nexthops, connectionId)) {
+    numberSet_Add(fibEntry->nexthops, connectionId);
+  }
+#endif /* WITH_POLICY */
   fibEntry->fwdStrategy->addNexthop(fibEntry->fwdStrategy, connectionId);
 }
 
 void fibEntry_RemoveNexthopByConnectionId(FibEntry *fibEntry,
                                           unsigned connectionId) {
   parcAssertNotNull(fibEntry, "Parameter fibEntry must be non-null");
+#ifdef WITH_POLICY
+  if (numberSet_Contains(fibEntry->nexthops, connectionId)) {
+    numberSet_Remove(fibEntry->nexthops, connectionId);
+  }
+#endif /* WITH_POLICY */
   fibEntry->fwdStrategy->removeNexthop(fibEntry->fwdStrategy, connectionId);
 }
 
 size_t fibEntry_NexthopCount(const FibEntry *fibEntry) {
   parcAssertNotNull(fibEntry, "Parameter fibEntry must be non-null");
+#ifdef WITH_POLICY
+  return numberSet_Length(fibEntry->nexthops);
+#else
   return fibEntry->fwdStrategy->countNexthops(fibEntry->fwdStrategy);
+#endif /* WITH_POLICY */
 }
 
 const NumberSet *fibEntry_GetNexthops(const FibEntry *fibEntry) {
   parcAssertNotNull(fibEntry, "Parameter fibEntry must be non-null");
+#ifdef WITH_POLICY
+  return fibEntry->nexthops;
+#else
   return fibEntry->fwdStrategy->returnNexthops(fibEntry->fwdStrategy);
+#endif /* WITH_POLICY */
 }
 
 const NumberSet *fibEntry_GetNexthopsFromForwardingStrategy(
+#ifdef WITH_POLICY
+    FibEntry *fibEntry, const Message *interestMessage, bool is_retransmission) {
+#else
     const FibEntry *fibEntry, const Message *interestMessage) {
+#endif /* WITH_POLICY */
   parcAssertNotNull(fibEntry, "Parameter fibEntry must be non-null");
+#ifdef WITH_POLICY
+  ConnectionTable * table = forwarder_GetConnectionTable(fibEntry->forwarder);
+  unsigned in_connection = message_GetIngressConnectionId(interestMessage);
+
+  policy_t policy = fibEntry_GetPolicy(fibEntry);
+
+  NumberSet * out;
+
+  /* Filtering */
+  NumberSet * available_nexthops = fibEntry_GetAvailableNextHops(fibEntry, in_connection);
+  if (numberSet_Length(available_nexthops) == 0) {
+    numberSet_Release(&available_nexthops);
+    out = numberSet_Create();
+    return out;
+  }
+
+  /*
+   * Update statistics about loss rates. We only detect losses upon
+   * retransmissions, and assume for the computation that the candidate set of
+   * output faces is the same as previously (i.e. does not take into account
+   * event such as face up/down, policy update, etc. Otherwise we would need to
+   * know what was the previous choice !
+   */
+  if (is_retransmission) {
+    for (size_t k = 0; k < numberSet_Length(available_nexthops); k++) {
+      unsigned conn_id = numberSet_GetItem(available_nexthops, k);
+      const Connection * conn = connectionTable_FindById(table, conn_id);
+
+      if (connection_HasTag(conn, POLICY_TAG_WIRED))
+        fibEntry->policy_counters.wired.num_losses++;
+      if (connection_HasTag(conn, POLICY_TAG_WIFI))
+        fibEntry->policy_counters.wifi.num_losses++;
+      if (connection_HasTag(conn, POLICY_TAG_CELLULAR))
+        fibEntry->policy_counters.cellular.num_losses++;
+      fibEntry->policy_counters.all.num_losses++;
+    }
+  }
+
+  /*
+   * NOTE: We might want to call a forwarding strategy even with no nexthop to
+   * take a fallback decision.
+   */
+  if (numberSet_Length(available_nexthops) == 0) {
+    out = numberSet_Create();
+  } else {
+    /* Multipath */
+    if ((policy.tags[POLICY_TAG_MULTIPATH].state != POLICY_STATE_PROHIBIT) &&
+        (policy.tags[POLICY_TAG_MULTIPATH].state != POLICY_STATE_AVOID)) {
+      out = fibEntry->fwdStrategy->lookupNexthop(fibEntry->fwdStrategy, available_nexthops,
+          interestMessage);
+    } else {
+      unsigned nexthop = numberSet_GetItem(available_nexthops, 0);
+      out = numberSet_Create();
+      numberSet_Add(out, nexthop);
+    }
+  }
+
+  numberSet_Release(&available_nexthops);
+
+  return out;
+#else
   return fibEntry->fwdStrategy->lookupNexthop(fibEntry->fwdStrategy,
-                                              interestMessage);
+          interestMessage);
+#endif /* WITH_POLICY */
 }
 
+#ifdef WITH_POLICY
+void fibEntry_ReceiveObjectMessage(FibEntry *fibEntry,
+#else
 void fibEntry_ReceiveObjectMessage(const FibEntry *fibEntry,
+#endif /* WITH_POLICY */
                                    const NumberSet *egressId,
                                    const Message *objectMessage, Ticks rtt) {
   parcAssertNotNull(fibEntry, "Parameter fibEntry must be non-null");
+
+#ifdef WITH_POLICY
+  ConnectionTable * table = forwarder_GetConnectionTable(fibEntry->forwarder);
+
+  /* Update statistic counters : */
+
+  size_t msg_size = message_Length(objectMessage);
+
+  for (unsigned i = 0; i < numberSet_Length(egressId); i++) {
+    unsigned conn_id = numberSet_GetItem(egressId, i);
+    const Connection * conn = connectionTable_FindById(table, conn_id);
+    if (!conn)
+      continue;
+    if (connection_HasTag(conn, POLICY_TAG_WIRED)) {
+      fibEntry->policy_counters.wired.num_packets++;
+      fibEntry->policy_counters.wired.num_bytes += msg_size;
+      fibEntry->policy.stats.wired.latency = \
+                      ALPHA       * fibEntry->policy.stats.wired.latency + \
+                      (1 - ALPHA) * (double)rtt;
+      fibEntry->policy_counters.wired.latency_idle = 0;
+    }
+    if (connection_HasTag(conn, POLICY_TAG_WIFI)) {
+      fibEntry->policy_counters.wifi.num_packets++;
+      fibEntry->policy_counters.wifi.num_bytes += msg_size;
+      fibEntry->policy.stats.wifi.latency = \
+                      ALPHA       * fibEntry->policy.stats.wifi.latency + \
+                      (1 - ALPHA) * (double)rtt;
+      fibEntry->policy_counters.wifi.latency_idle = 0;
+
+    }
+    if (connection_HasTag(conn, POLICY_TAG_CELLULAR)) {
+      fibEntry->policy_counters.cellular.num_packets++;
+      fibEntry->policy_counters.cellular.num_bytes += msg_size;
+      fibEntry->policy.stats.cellular.latency = \
+                      ALPHA       * fibEntry->policy.stats.cellular.latency + \
+                      (1 - ALPHA) * (double)rtt;
+      fibEntry->policy_counters.cellular.latency_idle = 0;
+    }
+  }
+
+  fibEntry->policy.stats.all.latency = \
+                    ALPHA       * fibEntry->policy.stats.all.latency + \
+                    (1 - ALPHA) * (double)rtt;
+  fibEntry->policy_counters.all.latency_idle = 0;
+
+  fibEntry->policy_counters.all.num_packets++;
+  fibEntry->policy_counters.all.num_bytes += msg_size;
+
+#endif /* WITH_POLICY */
+
   fibEntry->fwdStrategy->receiveObject(fibEntry->fwdStrategy, egressId,
                                        objectMessage, rtt);
 }
 
+#ifdef WITH_POLICY
+void fibEntry_OnTimeout(FibEntry *fibEntry, const NumberSet *egressId) {
+#else
 void fibEntry_OnTimeout(const FibEntry *fibEntry, const NumberSet *egressId) {
+#endif /* WITH_POLICY */
   parcAssertNotNull(fibEntry, "Parameter fibEntry must be non-null");
+
+#ifdef WITH_POLICY
+
+  ConnectionTable * table = forwarder_GetConnectionTable(fibEntry->forwarder);
+
+  for (unsigned i = 0; i < numberSet_Length(egressId); i++) {
+    unsigned conn_id = numberSet_GetItem(egressId, i);
+    const Connection * conn = connectionTable_FindById(table, conn_id);
+    if (!conn)
+      continue;
+    if (connection_HasTag(conn, POLICY_TAG_WIRED)) {
+      fibEntry->policy_counters.wired.num_losses++;
+    }
+    if (connection_HasTag(conn, POLICY_TAG_WIFI)) {
+      fibEntry->policy_counters.wifi.num_losses++;
+    }
+    if (connection_HasTag(conn, POLICY_TAG_CELLULAR)) {
+      fibEntry->policy_counters.cellular.num_losses++;
+    }
+  }
+
+  fibEntry->policy_counters.all.num_losses++;
+
+#endif /* WITH_POLICY */
+
   fibEntry->fwdStrategy->onTimeout(fibEntry->fwdStrategy, egressId);
 }
 
+#ifdef WITH_POLICY
+void fibEntry_UpdateStats(FibEntry *fibEntry, uint64_t now) {
+  double throughput;
+  double loss_rate;
+
+  if (now == fibEntry->policy_counters.last_update)
+      return ;
+
+  /* WIRED */
+
+  /*  a) throughput */
+  if (fibEntry->policy_counters.wired.num_bytes > 0) {
+    throughput = fibEntry->policy_counters.wired.num_bytes / \
+          (now - fibEntry->policy_counters.last_update) ;
+    throughput = throughput * 8 / 1024;
+    if (throughput < 0)
+        throughput = 0;
+  } else {
+    throughput = 0;
+  }
+  fibEntry->policy.stats.wired.throughput = \
+        ALPHA     * fibEntry->policy.stats.wired.throughput + \
+        (1-ALPHA) * throughput;
+
+  /* b) loss rate */
+  if ((fibEntry->policy_counters.wired.num_losses > 0) && \
+          (fibEntry->policy_counters.wired.num_packets > 0)){
+      loss_rate = fibEntry->policy_counters.wired.num_losses / \
+            fibEntry->policy_counters.wired.num_packets;
+      loss_rate *= 100;
+  } else {
+      loss_rate = 0;
+  }
+  fibEntry->policy.stats.wired.loss_rate = \
+        ALPHA     * fibEntry->policy.stats.wired.loss_rate + \
+        (1-ALPHA) * loss_rate;
+
+  /* Latency */
+  fibEntry->policy_counters.wired.latency_idle++;
+  if (fibEntry->policy_counters.wired.latency_idle > 1)
+      fibEntry->policy.stats.wired.latency = 0;
+  fibEntry->policy_counters.wifi.latency_idle++;
+  if (fibEntry->policy_counters.wifi.latency_idle > 1)
+      fibEntry->policy.stats.wifi.latency = 0;
+  fibEntry->policy_counters.cellular.latency_idle++;
+  if (fibEntry->policy_counters.cellular.latency_idle > 1)
+      fibEntry->policy.stats.cellular.latency = 0;
+  fibEntry->policy_counters.all.latency_idle++;
+  if (fibEntry->policy_counters.all.latency_idle > 1)
+      fibEntry->policy.stats.all.latency = 0;
+
+  fibEntry->policy_counters.wired.num_bytes = 0;
+  fibEntry->policy_counters.wired.num_losses = 0;
+  fibEntry->policy_counters.wired.num_packets = 0;
+
+  /* WIFI */
+
+  /*  a) throughput */
+  if (fibEntry->policy_counters.wifi.num_bytes > 0) {
+    throughput = fibEntry->policy_counters.wifi.num_bytes / \
+          (now - fibEntry->policy_counters.last_update);
+    throughput = throughput * 8 / 1024;
+    if (throughput < 0)
+        throughput = 0;
+  } else {
+    throughput = 0;
+  }
+  fibEntry->policy.stats.wifi.throughput = \
+        ALPHA     * fibEntry->policy.stats.wifi.throughput + \
+        (1-ALPHA) * throughput;
+
+  /* b) loss rate */
+  if ((fibEntry->policy_counters.wifi.num_losses > 0) && \
+          (fibEntry->policy_counters.wifi.num_packets > 0)) {
+    loss_rate = fibEntry->policy_counters.wifi.num_losses / \
+          fibEntry->policy_counters.wifi.num_packets;
+      loss_rate *= 100;
+  } else {
+      loss_rate = 0;
+  }
+  fibEntry->policy.stats.wifi.loss_rate = \
+        ALPHA     * fibEntry->policy.stats.wifi.loss_rate + \
+        (1-ALPHA) * loss_rate;
+
+  fibEntry->policy_counters.wifi.num_bytes = 0;
+  fibEntry->policy_counters.wifi.num_losses = 0;
+  fibEntry->policy_counters.wifi.num_packets = 0;
+
+  /* CELLULAR */
+
+  /*  a) throughput */
+  if (fibEntry->policy_counters.cellular.num_bytes > 0) {
+    throughput = fibEntry->policy_counters.cellular.num_bytes / \
+          (now - fibEntry->policy_counters.last_update) ;
+    throughput = throughput * 8 / 1024;
+    if (throughput < 0)
+        throughput = 0;
+  } else {
+    throughput = 0;
+  }
+  fibEntry->policy.stats.cellular.throughput = \
+        ALPHA     * fibEntry->policy.stats.cellular.throughput + \
+        (1-ALPHA) * throughput;
+
+  /* b) loss rate */
+  if ((fibEntry->policy_counters.cellular.num_losses > 0) && \
+          (fibEntry->policy_counters.cellular.num_packets > 0)) {
+    loss_rate = fibEntry->policy_counters.cellular.num_losses / \
+          fibEntry->policy_counters.cellular.num_packets;
+      loss_rate *= 100;
+  } else {
+      loss_rate = 0;
+  }
+  fibEntry->policy.stats.cellular.loss_rate = \
+        ALPHA     * fibEntry->policy.stats.cellular.loss_rate + \
+        (1-ALPHA) * loss_rate;
+
+  fibEntry->policy_counters.cellular.num_bytes = 0;
+  fibEntry->policy_counters.cellular.num_losses = 0;
+  fibEntry->policy_counters.cellular.num_packets = 0;
+
+  /* ALL */
+
+  /*  a) throughput */
+  if (fibEntry->policy_counters.all.num_bytes > 0) {
+    throughput = fibEntry->policy_counters.all.num_bytes / \
+          (now - fibEntry->policy_counters.last_update);
+    throughput = throughput * 8 / 1024;
+    if (throughput < 0)
+        throughput = 0;
+  } else {
+    throughput = 0;
+  }
+  fibEntry->policy.stats.all.throughput = \
+        ALPHA     * fibEntry->policy.stats.all.throughput + \
+        (1-ALPHA) * throughput;
+
+  /* b) loss rate */
+  if ((fibEntry->policy_counters.all.num_losses > 0) && \
+          (fibEntry->policy_counters.all.num_packets > 0)) {
+    loss_rate = fibEntry->policy_counters.all.num_losses / \
+          fibEntry->policy_counters.all.num_packets;
+      loss_rate *= 100;
+  } else {
+      loss_rate = 0;
+  }
+  fibEntry->policy.stats.all.loss_rate = \
+        ALPHA     * fibEntry->policy.stats.all.loss_rate + \
+        (1-ALPHA) * loss_rate;
+
+  fibEntry->policy_counters.all.num_bytes = 0;
+  fibEntry->policy_counters.all.num_losses = 0;
+  fibEntry->policy_counters.all.num_packets = 0;
+
+  fibEntry->policy_counters.last_update = now;
+}
+#endif /* WITH_POLICY */
+
 Name *fibEntry_GetPrefix(const FibEntry *fibEntry) {
   parcAssertNotNull(fibEntry, "Parameter fibEntry must be non-null");
   return fibEntry->name;
@@ -202,12 +881,6 @@ StrategyImpl *fibEntry_GetFwdStrategy(const FibEntry *fibEntry) {
 
 #ifdef WITH_MAPME
 
-void fibEntry_AddNexthopByConnectionId(FibEntry *fibEntry,
-                                       unsigned connectionId) {
-  parcAssertNotNull(fibEntry, "Parameter fibEntry must be non-null");
-  fibEntry->fwdStrategy->addNexthop(fibEntry->fwdStrategy, connectionId);
-}
-
 void *fibEntry_getUserData(const FibEntry *fibEntry) {
   parcAssertNotNull(fibEntry, "Parameter fibEntry must be non-null");
   return fibEntry->userData;
diff --git a/hicn-light/src/hicn/processor/fibEntry.h b/hicn-light/src/hicn/processor/fibEntry.h
index d677ae998..11a00e836 100644
--- a/hicn-light/src/hicn/processor/fibEntry.h
+++ b/hicn-light/src/hicn/processor/fibEntry.h
@@ -40,6 +40,10 @@
 #include <hicn/core/name.h>
 #include <hicn/strategies/strategyImpl.h>
 
+#ifdef WITH_POLICY
+#include <hicn/core/connectionTable.h>
+#endif /* WITH_POLICY */
+
 #ifdef WITH_MAPME
 #include <parc/algol/parc_EventTimer.h>
 #include <parc/algol/parc_Iterator.h>
@@ -48,7 +52,12 @@
 struct fib_entry;
 typedef struct fib_entry FibEntry;
 
+#ifdef WITH_POLICY
+struct forwarder;
+FibEntry *fibEntry_Create(Name *name, strategy_type fwdStrategy, const struct forwarder * table);
+#else
 FibEntry *fibEntry_Create(Name *name, strategy_type fwdStrategy);
+#endif
 
 /**
  * Decrements the reference count by one, and destroys the memory after last
@@ -72,6 +81,16 @@ FibEntry *fibEntry_Acquire(const FibEntry *fibEntry);
 
 void fibEntry_SetStrategy(FibEntry *fibEntry, strategy_type strategy);
 
+#ifdef WITH_POLICY
+
+policy_t fibEntry_GetPolicy(const FibEntry *fibEntry);
+
+void fibEntry_ReconsiderPolicy(FibEntry *fibEntry);
+
+void fibEntry_SetPolicy(FibEntry *fibEntry, policy_t policy);
+
+#endif /* WITH_POLICY */
+
 void fibEntry_AddNexthop(FibEntry *fibEntry, unsigned connectionId);
 
 void fibEntry_RemoveNexthopByConnectionId(FibEntry *fibEntry,
@@ -89,13 +108,29 @@ size_t fibEntry_NexthopCount(const FibEntry *fibEntry);
 const NumberSet *fibEntry_GetNexthops(const FibEntry *fibEntry);
 
 const NumberSet *fibEntry_GetNexthopsFromForwardingStrategy(
+#ifdef WITH_POLICY
+    FibEntry *fibEntry, const Message *interestMessage, bool is_retransmission);
+#else
     const FibEntry *fibEntry, const Message *interestMessage);
+#endif /* WITH_POLICY */
 
+#ifdef WITH_POLICY
+void fibEntry_ReceiveObjectMessage(FibEntry *fibEntry,
+#else
 void fibEntry_ReceiveObjectMessage(const FibEntry *fibEntry,
+#endif /* WITH_POLICY */
                                    const NumberSet *egressId,
                                    const Message *objectMessage, Ticks rtt);
 
+#ifdef WITH_POLICY
+void fibEntry_OnTimeout(FibEntry *fibEntry, const NumberSet *egressId);
+#else
 void fibEntry_OnTimeout(const FibEntry *fibEntry, const NumberSet *egressId);
+#endif /* WITH_POLICY */
+
+#ifdef WITH_POLICY
+void fibEntry_UpdateStats(FibEntry *fibEntry, uint64_t now);
+#endif /* WITH_POLICY */
 
 strategy_type fibEntry_GetFwdStrategyType(const FibEntry *fibEntry);
 
@@ -111,15 +146,6 @@ Name *fibEntry_GetPrefix(const FibEntry *fibEntry);
 #ifdef WITH_MAPME
 
 /**
- * @function fibEntry_AddNexthopByConnectionId
- * @abstract Adds a next hop directly from the connection id.
- * @param [in] fibEntry - Pointer to the FIB entry.
- * @return The sequence number stored in the FIB entry.
- */
-void fibEntry_AddNexthopByConnectionId(FibEntry *fibEntry,
-                                       unsigned connectionId);
-
-/**
  * @function fibEntry_getUserData
  * @abstract Returns user data associated to the FIB entry.
  * @param [in] fibEntry - Pointer to the FIB entry.
diff --git a/hicn-light/src/hicn/processor/messageProcessor.c b/hicn-light/src/hicn/processor/messageProcessor.c
index 4db1a0eb2..7e0ece257 100644
--- a/hicn-light/src/hicn/processor/messageProcessor.c
+++ b/hicn-light/src/hicn/processor/messageProcessor.c
@@ -19,6 +19,12 @@
 
 #include <parc/algol/parc_ArrayList.h>
 #include <parc/algol/parc_Memory.h>
+#ifdef WITH_POLICY
+#include <parc/algol/parc_EventTimer.h>
+#ifdef WITH_MAPME
+#include <hicn/core/connection.h>
+#endif /* WITH_MAPME */
+#endif /* WITH_POLICY */
 #include <hicn/processor/messageProcessor.h>
 
 #include <hicn/processor/fib.h>
@@ -28,7 +34,9 @@
 #include <hicn/content_store/contentStoreLRU.h>
 
 #include <hicn/strategies/loadBalancer.h>
+#ifndef WITH_POLICY
 #include <hicn/strategies/loadBalancerWithPD.h>
+#endif /* ! WITH_POLICY */
 #include <hicn/strategies/rnd.h>
 #include <hicn/strategies/rndSegment.h>
 #include <hicn/strategies/strategyImpl.h>
@@ -43,6 +51,10 @@
 
 #include <hicn/utils/address.h>
 
+#ifdef WITH_POLICY
+#define STATS_INTERVAL 1000 /* ms */
+#endif /* WITH_POLICY */
+
 /*
  * Copyright (c) 2017-2019 Cisco and/or its affiliates.
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -94,6 +106,10 @@ struct message_processor {
   bool serve_from_cache;
 
   _ProcessorStats stats;
+
+#ifdef WITH_POLICY
+  void * timer;
+#endif /* WITH_POLICY */
 };
 
 static void messageProcessor_Drop(MessageProcessor *processor,
@@ -113,6 +129,23 @@ static void messageProcessor_ForwardToInterfaceId(MessageProcessor *processor,
 // ============================================================
 // Public API
 
+#ifdef WITH_POLICY
+static void
+messageProcessor_Tick(int fd, PARCEventType type, void *user_data)
+{
+    MessageProcessor *processor = (MessageProcessor*)user_data;
+    uint64_t now = (uint64_t)forwarder_GetTicks(processor->forwarder);
+
+    /* Loop over FIB entries to compute statistics from counters */
+    FibEntryList *fibList = forwarder_GetFibEntries(processor->forwarder);
+
+    for (size_t i = 0; i < fibEntryList_Length(fibList); i++) {
+      FibEntry *entry = (FibEntry *)fibEntryList_Get(fibList, i);
+      fibEntry_UpdateStats(entry, now);
+    }
+}
+#endif /* WITH_POLICY */
+
 MessageProcessor *messageProcessor_Create(Forwarder *forwarder) {
   size_t objectStoreSize =
       configuration_GetObjectStoreSize(forwarder_GetConfiguration(forwarder));
@@ -148,6 +181,20 @@ MessageProcessor *messageProcessor_Create(Forwarder *forwarder) {
   processor->store_in_cache = true;
   processor->serve_from_cache = true;
 
+#ifdef WITH_POLICY
+  /* Create statistics timer */
+  Dispatcher *dispatcher = forwarder_GetDispatcher(forwarder);
+  if (!dispatcher)
+    goto ERR;
+  processor->timer = dispatcher_CreateTimer(dispatcher, /* repeat */ true,
+          messageProcessor_Tick, processor);
+  if (!processor->timer)
+      goto ERR;
+  struct timeval timeout = {STATS_INTERVAL / 1000, (STATS_INTERVAL % 1000) * 1000};
+  dispatcher_StartTimer(dispatcher, processor->timer, &timeout);
+ERR:
+#endif /* WITH_POLICY */
+
   return processor;
 }
 
@@ -201,6 +248,15 @@ void messageProcessor_Destroy(MessageProcessor **processorPtr) {
   contentStoreInterface_Release(&processor->contentStore);
   pit_Release(&processor->pit);
 
+#ifdef WITH_POLICY
+  Dispatcher *dispatcher = forwarder_GetDispatcher(processor->forwarder);
+  if (!dispatcher)
+    goto ERR;
+  dispatcher_StopTimer(dispatcher, processor->timer);
+  dispatcher_DestroyTimerEvent(dispatcher, (PARCEventTimer**)&processor->timer);
+ERR:
+#endif /* WITH_POLICY */
+
   parcMemory_Deallocate((void **)&processor);
   *processorPtr = NULL;
 }
@@ -255,22 +311,33 @@ bool messageProcessor_AddOrUpdateRoute(MessageProcessor *processor,
   Name *prefix = name_CreateFromAddress(control->addressType, control->address,
                                         control->len);
   FibEntry *entry = fib_Contains(processor->fib, prefix);
+#ifndef WITH_POLICY
   bool newEntry = false;
+#endif /* ! WITH_POLICY */
   if (entry != NULL) {
     fibEntry_AddNexthop(entry, ifidx);
   } else {
+#ifdef WITH_POLICY
+    entry = fibEntry_Create(prefix, fwdStrategy, processor->forwarder);
+#else
     newEntry = true;
     entry = fibEntry_Create(prefix, fwdStrategy);
+#endif /* WITH_POLICY */
     fibEntry_AddNexthop(entry, ifidx);
     fib_Add(processor->fib, entry);
   }
 
   name_Release(&prefix);
+
+#ifndef WITH_POLICY
+  /* For policy implementation, we need access to the ConnectionTable in all
+   * Forwarding Strategies, so it is setup during FIB Entry creation */
   if (newEntry && (fwdStrategy == SET_STRATEGY_LOADBALANCER_WITH_DELAY)) {
     strategyLoadBalancerWithPD_SetConnectionTable(
         fibEntry_GetFwdStrategy(entry),
         forwarder_GetConnectionTable(processor->forwarder));
   }
+#endif /* ! WITH_POLICY */
 
   return true;
 }
@@ -286,6 +353,65 @@ bool messageProcessor_RemoveRoute(MessageProcessor *processor,
   return true;
 }
 
+#ifdef WITH_POLICY
+
+bool messageProcessor_AddOrUpdatePolicy(MessageProcessor *processor,
+                                       add_policy_command *control) {
+  Configuration *config = forwarder_GetConfiguration(processor->forwarder);
+
+  const char *prefixStr = utils_PrefixLenToString(
+      control->addressType, &control->address, &control->len);
+
+  Name *prefix = name_CreateFromAddress(control->addressType, control->address,
+                                        control->len);
+  FibEntry *entry = fib_Contains(processor->fib, prefix);
+  if (!entry) {
+    strategy_type fwdStrategy =
+        configuration_GetForwardingStrategy(config, prefixStr);
+    if (fwdStrategy == LAST_STRATEGY_VALUE) {
+      fwdStrategy = SET_STRATEGY_LOADBALANCER;
+    }
+    entry = fibEntry_Create(prefix, fwdStrategy, processor->forwarder);
+    fib_Add(processor->fib, entry);
+  }
+  fibEntry_SetPolicy(entry, control->policy);
+
+  name_Release(&prefix);
+
+  return true;
+}
+
+bool messageProcessor_RemovePolicy(MessageProcessor *processor,
+                                  remove_policy_command *control) {
+  Name *prefix = name_CreateFromAddress(control->addressType, control->address,
+                                      control->len);
+  FibEntry *entry = fib_Contains(processor->fib, prefix);
+  name_Release(&prefix);
+
+  if (!entry)
+      return false;
+
+  fibEntry_SetPolicy(entry, POLICY_NONE);
+
+  return true;
+}
+
+
+#ifdef WITH_MAPME
+void messageProcessor_onConnectionEvent(const MessageProcessor *processor,
+        const Connection *conn_added, connection_event_t event)
+{
+  FibEntryList *fiblist = forwarder_GetFibEntries(processor->forwarder);
+  for (size_t i = 0; i < fibEntryList_Length(fiblist); i++) {
+    FibEntry *fibEntry = (FibEntry *)fibEntryList_Get(fiblist, i);
+    fibEntry_ReconsiderPolicy(fibEntry);
+  }
+
+}
+#endif /* WITH_MAPME */
+
+#endif /* WITH_POLICY */
+
 void messageProcessor_RemoveConnectionIdFromRoutes(MessageProcessor *processor,
                                                    unsigned connectionId) {
   fib_RemoveConnectionId(processor->fib, connectionId);
@@ -295,12 +421,14 @@ void processor_SetStrategy(MessageProcessor *processor, Name *prefix,
                            strategy_type strategy) {
   FibEntry *entry = fib_Contains(processor->fib, prefix);
   if (entry != NULL) {
+#ifndef WITH_POLICY
     fibEntry_SetStrategy(entry, strategy);
     if (strategy == SET_STRATEGY_LOADBALANCER_WITH_DELAY) {
       strategyLoadBalancerWithPD_SetConnectionTable(
           fibEntry_GetFwdStrategy(entry),
           forwarder_GetConnectionTable(processor->forwarder));
     }
+#endif /* ! WITH_POLICY */
   }
 }
 
@@ -352,8 +480,13 @@ static void messageProcessor_Drop(MessageProcessor *processor,
  * @return true if interest aggregagted (no more forwarding needed), false if
  * need to keep processing it.
  */
+#ifdef WITH_POLICY
+static PITVerdict messageProcessor_AggregateInterestInPit(MessageProcessor *processor,
+                                                    Message *interestMessage) {
+#else
 static bool messageProcessor_AggregateInterestInPit(MessageProcessor *processor,
                                                     Message *interestMessage) {
+#endif /* WITH_POLICY */
   PITVerdict verdict = pit_ReceiveInterest(processor->pit, interestMessage);
 
   if (verdict == PITVerdict_Aggregate) {
@@ -444,8 +577,13 @@ static bool _satisfyFromContentStore(MessageProcessor *processor,
  *
  * @return true if we found a route and tried to forward it, false if no route
  */
+#ifdef WITH_POLICY
+static bool messageProcessor_ForwardViaFib(MessageProcessor *processor,
+    Message *interestMessage, PITVerdict verdict) {
+#else
 static bool messageProcessor_ForwardViaFib(MessageProcessor *processor,
                                            Message *interestMessage) {
+#endif /* WITH_POLICY */
   FibEntry *fibEntry = fib_Match(processor->fib, interestMessage);
   if (fibEntry == NULL) {
     return false;
@@ -459,7 +597,12 @@ static bool messageProcessor_ForwardViaFib(MessageProcessor *processor,
   pitEntry_AddFibEntry(pitEntry, fibEntry);
 
   NumberSet *nexthops = (NumberSet *)fibEntry_GetNexthopsFromForwardingStrategy(
+#ifdef WITH_POLICY
+      fibEntry, interestMessage, verdict);
+#else
       fibEntry, interestMessage);
+#endif /* WITH_POLICY */
+
   // this requires some additional checks. It may happen that some of the output
   // faces selected by the forwarding strategy are not usable. So far all the
   // forwarding strategy return only valid faces (or an empty list)
@@ -503,10 +646,23 @@ static void messageProcessor_ReceiveInterest(MessageProcessor *processor,
   processor->stats.countInterestsReceived++;
 
   // (1) Try to aggregate in PIT
+#ifdef WITH_POLICY
+  PITVerdict verdict = messageProcessor_AggregateInterestInPit(processor, interestMessage);
+  switch(verdict) {
+    case PITVerdict_Aggregate:
+      //done
+      return;
+
+    case PITVerdict_Forward:
+    case PITVerdict_Retransmit:
+      break;
+  }
+#else
   if (messageProcessor_AggregateInterestInPit(processor, interestMessage)) {
     // done
     return;
   }
+#endif /* WITH_POLICY */
 
   // At this point, we just created a PIT entry.  If we don't forward the
   // interest, we need to remove the PIT entry.
@@ -520,7 +676,11 @@ static void messageProcessor_ReceiveInterest(MessageProcessor *processor,
   }
 
   // (3) Try to forward it
+#ifdef WITH_POLICY
+  if (messageProcessor_ForwardViaFib(processor, interestMessage, verdict)) {
+#else
   if (messageProcessor_ForwardViaFib(processor, interestMessage)) {
+#endif /* WITH_POLICY */
     // done
     return;
   }
@@ -595,6 +755,7 @@ static void messageProcessor_ReceiveContentObject(MessageProcessor *processor,
     }
     // (3) Reverse path forward via PIT entries
     messageProcessor_ForwardToNexthops(processor, message, ingressSetUnion);
+
   }
 
   numberSet_Release(&ingressSetUnion);
diff --git a/hicn-light/src/hicn/processor/messageProcessor.h b/hicn-light/src/hicn/processor/messageProcessor.h
index 64b08272d..6804ba018 100644
--- a/hicn-light/src/hicn/processor/messageProcessor.h
+++ b/hicn-light/src/hicn/processor/messageProcessor.h
@@ -32,6 +32,12 @@
 
 #include <hicn/utils/commands.h>
 
+#ifdef WITH_POLICY
+#ifdef WITH_MAPME
+#include <hicn/core/connection.h>
+#endif /* WITH_MAPME */
+#endif /* WITH_POLICY */
+
 struct message_processor;
 typedef struct message_processor MessageProcessor;
 
@@ -100,6 +106,43 @@ bool messageProcessor_RemoveRoute(MessageProcessor *processor,
                                   remove_route_command *control,
                                   unsigned ifidx);
 
+#ifdef WITH_POLICY
+
+/**
+ * Adds or updates a policy in the FIB
+ *
+ * If the policy is already set, it is replaced
+ *
+ * @param [in] procesor An allocated message processor
+ * @param [in] control Control message
+ *
+ * @retval true added or updated
+ * @retval false An error
+ */
+bool messageProcessor_AddOrUpdatePolicy(MessageProcessor *processor,
+        add_policy_command *control);
+
+/**
+ * Removes a policy from the FIB
+ *
+ * Reset the policy in the FIB to the default (empty) policy.
+ *
+ * @param [in] procesor An allocated message processor
+ * @param [in] control Control message
+ *
+ * @retval true Policy completely removed
+ * @retval false There is still a nexthop for the policy
+ */
+bool messageProcessor_RemovePolicy(MessageProcessor *processor,
+        remove_policy_command *control);
+
+#ifdef WITH_MAPME
+void messageProcessor_onConnectionEvent(const MessageProcessor *processor,
+        const Connection *conn_added, connection_event_t event);
+#endif /* WITH_MAPME */
+
+#endif /* WITH_POLICY */
+
 /**
  * Removes a given connection id from all FIB entries
  *
diff --git a/hicn-light/src/hicn/processor/pitStandard.c b/hicn-light/src/hicn/processor/pitStandard.c
index 9a3a829bd..edf0b5e98 100644
--- a/hicn-light/src/hicn/processor/pitStandard.c
+++ b/hicn-light/src/hicn/processor/pitStandard.c
@@ -160,7 +160,11 @@ static PITVerdict _pitStandard_ReceiveInterest(PIT *generic,
                      (void *)interestMessage, pitEntry_GetExpiryTime(pitEntry));
         }
 
+#ifdef WITH_POLICY
+        return PITVerdict_Retransmit;
+#else
         return PITVerdict_Forward;
+#endif /* WITH_POLICY */
       }
 
       // It is in the PIT but this is the first interest for the reverse path
diff --git a/hicn-light/src/hicn/processor/pitVerdict.h b/hicn-light/src/hicn/processor/pitVerdict.h
index 16631fa51..f37242027 100644
--- a/hicn-light/src/hicn/processor/pitVerdict.h
+++ b/hicn-light/src/hicn/processor/pitVerdict.h
@@ -32,5 +32,9 @@
  * @constant PITVerdict_Aggregate The Interest was aggregated in the PIT, does
  * not need to be forwarded
  */
+#ifdef WITH_POLICY
+typedef enum { PITVerdict_Forward, PITVerdict_Aggregate, PITVerdict_Retransmit } PITVerdict;
+#else
 typedef enum { PITVerdict_Forward, PITVerdict_Aggregate } PITVerdict;
+#endif /* WITH_POLICY */
 #endif  // pitVerdict_h
diff --git a/hicn-light/src/hicn/socket/api.c b/hicn-light/src/hicn/socket/api.c
index aede01efe..213163675 100644
--- a/hicn-light/src/hicn/socket/api.c
+++ b/hicn-light/src/hicn/socket/api.c
@@ -36,7 +36,6 @@ static hicn_conf_t hicn_default_conf = {
 };
 
 /* Global state */
-// FIXME move into helper state ?
 
 struct ip_rule_state_ {
   char tun_name[IF_NAMESIZE];
@@ -61,8 +60,6 @@ uint16_t routes_counter;
 static ip_rule_state rules_to_remove[MAX_TABLES];
 static ip_route_state routes_to_remove[MAX_TABLES];
 
-// END FIXME
-
 hicn_socket_helper_t *hicn_create() {
   int rc;
 
@@ -265,8 +262,6 @@ end:
   return rc;
 }
 
-// XXX This could be used by hicn_set_remote_endpoint
-// XXX This has been introduced for mapme
 int hicn_get_local_address(const ip_address_t *remote_address,
                            ip_address_t *local_address) {
   int rc = 0;
@@ -520,11 +515,9 @@ int hicn_bind(hicn_socket_helper_t *hicn, int fd,
   // each connection is associated a table id, let's take it equal to the
   // tun ID by default (% MAX_TABLES, assuming TUN IDs do not overlap modulo
   // 256...).
-  // XXX we need to make sure the corresponding table is flushed.
   socket->connection.table_id =
       socket->tun_id % MAX_TABLES;  // interface_id; // ops.get_free_table_id();
 
-  // XXX use IP address
   rc = hicn_set_remote_endpoint(socket, remote_ip_address);
   if (rc < 0) {
     goto ERR;
diff --git a/hicn-light/src/hicn/socket/api.h b/hicn-light/src/hicn/socket/api.h
index 3a1ae92b4..283065fc7 100644
--- a/hicn-light/src/hicn/socket/api.h
+++ b/hicn-light/src/hicn/socket/api.h
@@ -155,7 +155,14 @@ int hicn_set_conf(hicn_socket_helper_t *hicn, hicn_conf_t *hicn_conf);
  */
 void hicn_free(hicn_socket_helper_t *hicn);
 
-// FIXME doc
+/**
+ * Returns the local address used to reach the remote address
+ *
+ * @param [in] remote_address
+ * @param [out] local address
+ *
+ * @return 0 in case of success, -1 otherwise.
+ */
 int hicn_get_local_address(const ip_address_t *remote_address,
                            ip_address_t *local_address);
 
@@ -207,8 +214,6 @@ int hicn_listen(hicn_socket_helper_t *hicn, int fd, const char *prefix);
  *    RFC-compliant presentation format.
  * @return 0 in case of success, -1 otherwise.
  *
- * XXX adjacency does not perform any copy heresofar
- *
  * @see hicn_socket
  */
 int hicn_bind(hicn_socket_helper_t *hicn, int fd,
diff --git a/hicn-light/src/hicn/socket/error.h b/hicn-light/src/hicn/socket/error.h
index 8195efd84..f7c1d9f19 100644
--- a/hicn-light/src/hicn/socket/error.h
+++ b/hicn-light/src/hicn/socket/error.h
@@ -1,7 +1,6 @@
 #ifndef HICN_SOCKET_ERROR_H
 #define HICN_SOCKET_ERROR_H
 
-// FIXME remove unused errors
 #define foreach_hicn_socket_error                                             \
   _(NONE, 0, "OK")                                                            \
   _(UNSPEC, 1, "unspecified error")                                           \
diff --git a/hicn-light/src/hicn/socket/ops_linux.c b/hicn-light/src/hicn/socket/ops_linux.c
index 1356e1ba0..0b1c6b817 100644
--- a/hicn-light/src/hicn/socket/ops_linux.c
+++ b/hicn-light/src/hicn/socket/ops_linux.c
@@ -1,6 +1,5 @@
 #include <sys/ioctl.h>   // ioctl
 #include <sys/socket.h>  // needed by linux/if.h
-//#include <linux/if.h>
 #include <errno.h>
 #include <fcntl.h>  // ''
 #include <linux/if_tun.h>
@@ -26,22 +25,6 @@
 #include <stdint.h>
 #include <stdlib.h>
 
-// DEPRECATED|/* Socket */
-// DEPRECATED|int _nl_get_socket();
-// DEPRECATED|int _nl_send(int s, uint8_t * buffer, size_t len);
-// DEPRECATED|size_t _nl_receive(uint8_t * buffer, size_t len);
-// DEPRECATED|
-// DEPRECATED|/* Netlink packet format */
-// DEPRECATED|int _nl_header(int request, uint8_t * buffer, size_t len, uint32_t
-// flags); DEPRECATED|int _nl_payload_rule(uint8_t table_id, uint8_t * buffer,
-// size_t len); DEPRECATED|int _nl_payload_link(uint32_t ifindex, uint8_t *
-// buffer, size_t len); DEPRECATED|int _nl_payload_route(uint8_t table_id,
-// uint8_t dst_len, uint8_t * buffer, size_t len); DEPRECATED| DEPRECATED|int
-// _nl_parse(uint8_t * buffer, size_t len); DEPRECATED|int _nl_parse_ret(uint8_t
-// * buffer, size_t len); DEPRECATED|int _nl_parse_link_ifid(uint8_t * buffer,
-// size_t len, uint32_t * interface_id); DEPRECATED|int
-// _nl_parse_link_ip_addr(uint8_t * buffer, size_t len, struct in6_addr * addr);
-
 /* Public interface */
 
 /**
@@ -127,25 +110,22 @@ int _nl_del_lo_prio_rule(const ip_address_t *ip_address,
  *
  * More specifically, it consists of the following functionalities:
  *  - LINK
-       . map interface name to ID
-       . set and interface up
+ *     . map interface name to ID
+ *     . set and interface up
  *  - ADDR
-       . get and set ip addresses on a given interface ID
+ *     . get and set ip addresses on a given interface ID
  *  - ROUTE
-       . get output interface id towards IP (ip route get IP > interface_id)
-       . add input route (ip route add PREFIX dev INTERFACE) for punting
- interests . add output route (ip route add default GATEWAY table TABLE) for
- routing interests (2, 3) . delete local route towards IP (ip route del IP table
- local) for ???
-         /!\ could this be avoided by removing the local attribute in the
- netlink call ?
+ *     . get output interface id towards IP (ip route get IP > interface_id)
+ *     . add input route (ip route add PREFIX dev INTERFACE) for punting
+ *     interests . add output route (ip route add default GATEWAY table TABLE)
+ *     for routing interests (2, 3)
+ *     . delete local route towards IP (ip route del IP table local)
  *  - RULE
  *     . add output rule (ip rule add iif interface table TABLE) for routing
- interests (2, 3)
- *  - ND PROXY
+ *     interests (2, 3) - ND PROXY
  *     . enable NDP proxy functionality for IP on interface ID (ip -6 neigh add
- proxy IP dev INTERFACE)
- *       for allowing the TUN to be reachable on the reverse data path
+ *     proxy IP dev INTERFACE) for allowing the TUN to be reachable on the
+ *     reverse data path
  *
  * Implementation notes:
  *  (1) We have not been using the libnl library because it requires
@@ -209,16 +189,11 @@ int _nl_del_lo_prio_rule(const ip_address_t *ip_address,
 #include <sys/socket.h>  // ''
 #include <sys/types.h>   // send, recv
 
-//#include "../../hicn.h"
-//#include "../../hicn_util.h"    // ARRAY_SIZE, hicn_packet_dump_iov
-
 #define BUFSIZE 4096
 #define FLAGS_CREATE NLM_F_REQUEST | NLM_F_CREATE | NLM_F_ACK
-// ??
 #define FLAGS_CREATE_MATCH \
   NLM_F_REQUEST | NLM_F_CREATE | NLM_F_ACK | NLM_F_MATCH
 
-// XXX putting ACK poses a prolem for the value received by get_if_id.
 #define FLAGS_GET NLM_F_REQUEST
 #define FLAGS_GET_ROOT (NLM_F_REQUEST | NLM_F_ROOT)
 
@@ -226,7 +201,7 @@ int _nl_del_lo_prio_rule(const ip_address_t *ip_address,
 
 #ifndef __ANDROID__
 #define IF_NAMESIZE 16
-#endif 
+#endif
 #define FR_ACT_TO_TBL 1
 #define NLMSG_BOTTOM(nlmsg) \
   ((struct rtattr *)(((void *)(nlmsg)) + NLMSG_ALIGN((nlmsg)->nlmsg_len)))
@@ -651,15 +626,10 @@ int _nl_set_ip_addr(uint32_t interface_id, ip_address_t *ip_address) {
   /* Set attributes = length/type/value */
   struct rtattr ifa_address = {RTA_LENGTH(ip_address_len(ip_address)),
                                IFA_ADDRESS};
-  // XXX maybe the reason why we have a local route ?
-  // struct rtattr ifa_local   = { RTA_LENGTH(ip_address_len(ip_address)),
-  // IFA_LOCAL };
   struct iovec iov[] = {
       {&msg, sizeof(msg)},
       {&ifa_address, sizeof(ifa_address)},
       {(void *)&ip_address->buffer, sizeof(ip_address->buffer)},
-      //        { &ifa_local, sizeof(ifa_local) },
-      //        { (void*)&ip_address->buffer, sizeof(ip_address->buffer) },
   };
   msg.hdr.nlmsg_len = iov_length(iov, ARRAY_SIZE(iov));
 
@@ -1075,11 +1045,8 @@ int _nl_add_rule(const char *interface_name, uint8_t address_family,
   _nl_header(RTM_NEWRULE, (uint8_t *)buffer, BUFSIZE, FLAGS_CREATE);
   _nl_payload_rule(table_id, address_family, (uint8_t *)buffer, BUFSIZE);
 
-  /* XXX iif */
   addAttr(hdr, BUFSIZE, FRA_IIFNAME, (void *)interface_name,
           strlen(interface_name));
-  // attr1 = addNestedAttr(hdr, IFLA_LINKINFO);
-  // endNestedAttr(hdr, attr1);
 
   fd = socket(AF_NETLINK, SOCK_DGRAM, NETLINK_ROUTE);
   if (fd < 0) {
@@ -1124,7 +1091,6 @@ int _nl_del_rule(const char *interface_name, uint8_t address_family,
   _nl_header(RTM_DELRULE, (uint8_t *)buffer, BUFSIZE, FLAGS_CREATE);
   _nl_payload_rule(table_id, address_family, (uint8_t *)buffer, BUFSIZE);
 
-  /* XXX iif */
   addAttr(hdr, BUFSIZE, FRA_IIFNAME, (void *)interface_name,
           strlen(interface_name));
 
@@ -1253,7 +1219,7 @@ int _nl_add_in_route_table(const ip_address_t *prefix,
       .hdr.nlmsg_flags = NLM_F_REQUEST | NLM_F_CREATE | NLM_F_ACK | NLM_F_EXCL,
       .hdr.nlmsg_seq = seq++,
       .payload.rtm_family = prefix->family,
-      .payload.rtm_dst_len = prefix->prefix_len,  // XXX ? XXX dst_len,
+      .payload.rtm_dst_len = prefix->prefix_len,
       .payload.rtm_src_len = 0,
       .payload.rtm_tos = 0,
       .payload.rtm_table = table_id, /* RT_TABLE_MAIN, etc. */
@@ -1265,7 +1231,6 @@ int _nl_add_in_route_table(const ip_address_t *prefix,
   };
 
   /* Message attributes = length/type/value */
-  // XXX This could be put directly inside the iovec maybe ? XXX
   struct rtattr a_dst = {RTA_LENGTH(ip_address_len(prefix)), RTA_DST};
   struct rtattr a_oif = {RTA_LENGTH(sizeof(uint32_t)), RTA_OIF};
 
@@ -1332,7 +1297,6 @@ int _nl_add_in_route_s(const char *prefix, const uint32_t interface_id) {
   return _nl_add_in_route_table_s(prefix, interface_id, RT_TABLE_MAIN);
 }
 
-////////* ip -6 rule add from all prio 10 table local */
 /* ip -6 rule add from b001::/16 prio 0 table 100 */
 int _nl_add_prio_rule(const ip_address_t *ip_address, uint8_t address_family,
                       const uint32_t priority, const uint8_t table_id) {
diff --git a/hicn-light/src/hicn/strategies/loadBalancer.c b/hicn-light/src/hicn/strategies/loadBalancer.c
index 6ab26b7ca..b66de217e 100644
--- a/hicn-light/src/hicn/strategies/loadBalancer.c
+++ b/hicn-light/src/hicn/strategies/loadBalancer.c
@@ -36,9 +36,15 @@ static void _strategyLoadBalancer_ReceiveObject(StrategyImpl *strategy,
 static void _strategyLoadBalancer_OnTimeout(StrategyImpl *strategy,
                                             const NumberSet *egressId);
 static NumberSet *_strategyLoadBalancer_LookupNexthop(
-    StrategyImpl *strategy, const Message *interestMessage);
+    StrategyImpl *strategy,
+#ifdef WITH_POLICY
+    NumberSet * nexthops,
+#endif /* WITH_POLICY */
+    const Message *interestMessage);
+#ifndef WITH_POLICY
 static NumberSet *_strategyLoadBalancer_ReturnNexthops(StrategyImpl *strategy);
 static unsigned _strategyLoadBalancer_CountNexthops(StrategyImpl *strategy);
+#endif /* ! WITH_POLICY */
 static void _strategyLoadBalancer_AddNexthop(StrategyImpl *strategy,
                                              unsigned connectionId);
 static void _strategyLoadBalancer_RemoveNexthop(StrategyImpl *strategy,
@@ -51,8 +57,10 @@ static StrategyImpl _template = {
     .receiveObject = &_strategyLoadBalancer_ReceiveObject,
     .onTimeout = &_strategyLoadBalancer_OnTimeout,
     .lookupNexthop = &_strategyLoadBalancer_LookupNexthop,
+#ifndef WITH_POLICY
     .returnNexthops = &_strategyLoadBalancer_ReturnNexthops,
     .countNexthops = &_strategyLoadBalancer_CountNexthops,
+#endif /* ! WITH_POLICY */
     .addNexthop = &_strategyLoadBalancer_AddNexthop,
     .removeNexthop = &_strategyLoadBalancer_RemoveNexthop,
     .destroy = &_strategyLoadBalancer_ImplDestroy,
@@ -63,10 +71,14 @@ struct strategy_load_balancer;
 typedef struct strategy_load_balancer StrategyLoadBalancer;
 
 struct strategy_load_balancer {
+#ifndef WITH_POLICY
   double weights_sum;
+#endif /* ! WITH_POLICY */
   // hash map from connectionId to StrategyNexthopState
   PARCHashMap *strategy_state;
+#ifndef WITH_POLICY
   NumberSet *nexthops;
+#endif /* ! WITH_POLICY */
 };
 
 StrategyImpl *strategyLoadBalancer_Create() {
@@ -75,9 +87,13 @@ StrategyImpl *strategyLoadBalancer_Create() {
   parcAssertNotNull(strategy, "parcMemory_AllocateAndClear(%zu) returned NULL",
                     sizeof(StrategyLoadBalancer));
 
+#ifndef WITH_POLICY
   strategy->weights_sum = 0.0;
+#endif /* ! WITH_POLICY */
   strategy->strategy_state = parcHashMap_Create();
+#ifndef WITH_POLICY
   strategy->nexthops = numberSet_Create();
+#endif /* ! WITH_POLICY */
   srand((unsigned int)time(NULL));
 
   StrategyImpl *impl = parcMemory_AllocateAndClear(sizeof(StrategyImpl));
@@ -99,12 +115,17 @@ strategy_type _strategyLoadBalancer_GetStrategy(StrategyImpl *strategy) {
 static void _update_Stats(StrategyLoadBalancer *strategy,
                           StrategyNexthopState *state, bool inc) {
   const double ALPHA = 0.9;
+#ifdef WITH_POLICY
+  strategyNexthopState_UpdateState(state, inc, ALPHA);
+#else
   double w = strategyNexthopState_GetWeight(state);
   strategy->weights_sum -= w;
   w = strategyNexthopState_UpdateState(state, inc, ALPHA);
   strategy->weights_sum += w;
+#endif /* WITH_POLICY */
 }
 
+#ifndef WITH_POLICY
 static unsigned _select_Nexthop(StrategyLoadBalancer *strategy) {
   double rnd = (double)rand() / (double)RAND_MAX;
   double start_range = 0.0;
@@ -135,6 +156,7 @@ static unsigned _select_Nexthop(StrategyLoadBalancer *strategy) {
   // this!
   return nexthop;
 }
+#endif /* ! WITH_POLICY */
 
 static void _strategyLoadBalancer_ReceiveObject(StrategyImpl *strategy,
                                                 const NumberSet *egressId,
@@ -164,14 +186,47 @@ static void _strategyLoadBalancer_OnTimeout(StrategyImpl *strategy,
 }
 
 static NumberSet *_strategyLoadBalancer_LookupNexthop(
-    StrategyImpl *strategy, const Message *interestMessage) {
+    StrategyImpl *strategy,
+#ifdef WITH_POLICY
+    NumberSet * nexthops,
+#endif /* WITH_POLICY */
+    const Message *interestMessage) {
   StrategyLoadBalancer *lb = (StrategyLoadBalancer *)strategy->context;
+  NumberSet *outList = numberSet_Create();
 
+#ifdef WITH_POLICY
+  /* Compute the sum of weights of potential next hops */
+  double sum = 0;
+  for (unsigned i = 0; i < numberSet_Length(nexthops); i++) {
+    PARCUnsigned *cid = parcUnsigned_Create(numberSet_GetItem(nexthops, i));
+    const StrategyNexthopState *elem =
+        parcHashMap_Get(lb->strategy_state, cid);
+    if (!elem)
+      continue;
+    sum += strategyNexthopState_GetWeight(elem);
+  }
+
+  /* Perform weighted random selection */
+  double distance = (double)rand() * sum / ((double)RAND_MAX + 1);
+
+  for (unsigned i = 0; i < numberSet_Length(nexthops); i++) {
+    PARCUnsigned *cid = parcUnsigned_Create(numberSet_GetItem(nexthops, i));
+    const StrategyNexthopState *state =
+        parcHashMap_Get(lb->strategy_state, cid);
+    if (!state)
+      continue;
+    distance -= strategyNexthopState_GetWeight(state);
+    if (distance < 0) {
+      numberSet_Add(outList, parcUnsigned_GetUnsigned(cid));
+      _update_Stats(lb, (StrategyNexthopState *)state, true);
+      break;
+    }
+  }
+#else
   unsigned in_connection = message_GetIngressConnectionId(interestMessage);
   PARCUnsigned *in = parcUnsigned_Create(in_connection);
 
   unsigned mapSize = (unsigned)parcHashMap_Size(lb->strategy_state);
-  NumberSet *outList = numberSet_Create();
 
   if ((mapSize == 0) ||
       ((mapSize == 1) && parcHashMap_Contains(lb->strategy_state, in))) {
@@ -201,9 +256,12 @@ static NumberSet *_strategyLoadBalancer_LookupNexthop(
   parcUnsigned_Release(&out);
 
   numberSet_Add(outList, out_connection);
+#endif /* WITH_POLICY */
+
   return outList;
 }
 
+#ifndef WITH_POLICY
 static NumberSet *_strategyLoadBalancer_ReturnNexthops(StrategyImpl *strategy) {
   StrategyLoadBalancer *lb = (StrategyLoadBalancer *)strategy->context;
   return lb->nexthops;
@@ -213,10 +271,13 @@ unsigned _strategyLoadBalancer_CountNexthops(StrategyImpl *strategy) {
   StrategyLoadBalancer *lb = (StrategyLoadBalancer *)strategy->context;
   return (unsigned)numberSet_Length(lb->nexthops);
 }
+#endif /* ! WITH_POLICY */
 
 static void _strategyLoadBalancer_resetState(StrategyImpl *strategy) {
   StrategyLoadBalancer *lb = (StrategyLoadBalancer *)strategy->context;
+#ifndef WITH_POLICY
   lb->weights_sum = 0.0;
+#endif/* ! WITH_POLICY */
   PARCIterator *it = parcHashMap_CreateKeyIterator(lb->strategy_state);
 
   while (parcIterator_HasNext(it)) {
@@ -225,7 +286,9 @@ static void _strategyLoadBalancer_resetState(StrategyImpl *strategy) {
         (StrategyNexthopState *)parcHashMap_Get(lb->strategy_state, cid);
 
     strategyNexthopState_Reset(elem);
+#ifndef WITH_POLICY
     lb->weights_sum += strategyNexthopState_GetWeight(elem);
+#endif /* ! WITH_POLICY */
   }
 
   parcIterator_Release(&it);
@@ -241,7 +304,9 @@ static void _strategyLoadBalancer_AddNexthop(StrategyImpl *strategy,
 
   if (!parcHashMap_Contains(lb->strategy_state, cid)) {
     parcHashMap_Put(lb->strategy_state, cid, state);
+#ifndef WITH_POLICY
     numberSet_Add(lb->nexthops, connectionId);
+#endif /* WITH_POLICY */
     _strategyLoadBalancer_resetState(strategy);
   }
 }
@@ -254,7 +319,9 @@ static void _strategyLoadBalancer_RemoveNexthop(StrategyImpl *strategy,
 
   if (parcHashMap_Contains(lb->strategy_state, cid)) {
     parcHashMap_Remove(lb->strategy_state, cid);
+#ifndef WITH_POLICY
     numberSet_Remove(lb->nexthops, connectionId);
+#endif /* WITH_POLICY */
     _strategyLoadBalancer_resetState(strategy);
   }
 
@@ -270,7 +337,9 @@ static void _strategyLoadBalancer_ImplDestroy(StrategyImpl **strategyPtr) {
   StrategyLoadBalancer *strategy = (StrategyLoadBalancer *)impl->context;
 
   parcHashMap_Release(&(strategy->strategy_state));
+#ifndef WITH_POLICY
   numberSet_Release(&(strategy->nexthops));
+#endif /* ! WITH_POLICY */
 
   parcMemory_Deallocate((void **)&strategy);
   parcMemory_Deallocate((void **)&impl);
diff --git a/hicn-light/src/hicn/strategies/loadBalancer.h b/hicn-light/src/hicn/strategies/loadBalancer.h
index d0f4faece..74920768d 100644
--- a/hicn-light/src/hicn/strategies/loadBalancer.h
+++ b/hicn-light/src/hicn/strategies/loadBalancer.h
@@ -23,4 +23,5 @@
 #include <hicn/strategies/strategyImpl.h>
 
 StrategyImpl *strategyLoadBalancer_Create();
+
 #endif  // loadBalancer_h
diff --git a/hicn-light/src/hicn/strategies/loadBalancerWithPD.c b/hicn-light/src/hicn/strategies/loadBalancerWithPD.c
index 58f3b25fc..b0aae4cbb 100644
--- a/hicn-light/src/hicn/strategies/loadBalancerWithPD.c
+++ b/hicn-light/src/hicn/strategies/loadBalancerWithPD.c
@@ -38,11 +38,17 @@ static void _strategyLoadBalancerWithPD_ReceiveObject(
 static void _strategyLoadBalancerWithPD_OnTimeout(StrategyImpl *strategy,
                                                   const NumberSet *egressId);
 static NumberSet *_strategyLoadBalancerWithPD_LookupNexthop(
-    StrategyImpl *strategy, const Message *interestMessage);
+    StrategyImpl *strategy,
+#ifdef WITH_POLICY
+    NumberSet * nexthops,
+#endif
+    const Message *interestMessage);
+#ifndef WITH_POLICY
 static NumberSet *_strategyLoadBalancerWithPD_ReturnNexthops(
     StrategyImpl *strategy);
 static unsigned _strategyLoadBalancerWithPD_CountNexthops(
     StrategyImpl *strategy);
+#endif /* ! WITH_POLICY */
 static void _strategyLoadBalancerWithPD_AddNexthop(StrategyImpl *strategy,
                                                    unsigned connectionId);
 static void _strategyLoadBalancerWithPD_RemoveNexthop(StrategyImpl *strategy,
@@ -56,8 +62,10 @@ static StrategyImpl _template = {
     .receiveObject = &_strategyLoadBalancerWithPD_ReceiveObject,
     .onTimeout = &_strategyLoadBalancerWithPD_OnTimeout,
     .lookupNexthop = &_strategyLoadBalancerWithPD_LookupNexthop,
+#ifndef WITH_POLICY
     .returnNexthops = &_strategyLoadBalancerWithPD_ReturnNexthops,
     .countNexthops = &_strategyLoadBalancerWithPD_CountNexthops,
+#endif /* ! WITH_POLICY */
     .addNexthop = &_strategyLoadBalancerWithPD_AddNexthop,
     .removeNexthop = &_strategyLoadBalancerWithPD_RemoveNexthop,
     .destroy = &_strategyLoadBalancerWithPD_ImplDestroy,
@@ -72,13 +80,19 @@ struct strategy_load_balancer_with_pd {
   unsigned min_delay;
   // hash map from connectionId to StrategyNexthopState
   PARCHashMap *strategy_state;
+#ifndef WITH_POLICY
   NumberSet *nexthops;
-  ConnectionTable *connTable;
+#endif /* ! WITH_POLICY */
+  const ConnectionTable *connTable;
   bool toInit;
   unsigned int fwdPackets;
 };
 
+#ifdef WITH_POLICY
+StrategyImpl *strategyLoadBalancerWithPD_Create(const ConnectionTable *table) {
+#else
 StrategyImpl *strategyLoadBalancerWithPD_Create() {
+#endif /* WITH_POLICY */
   StrategyLoadBalancerWithPD *strategy =
       parcMemory_AllocateAndClear(sizeof(StrategyLoadBalancerWithPD));
   parcAssertNotNull(strategy, "parcMemory_AllocateAndClear(%zu) returned NULL",
@@ -87,7 +101,9 @@ StrategyImpl *strategyLoadBalancerWithPD_Create() {
   strategy->weights_sum = 0.0;
   strategy->min_delay = INT_MAX;
   strategy->strategy_state = parcHashMap_Create();
+#ifndef WITH_POLICY
   strategy->nexthops = numberSet_Create();
+#endif /* ! WITH_POLICY */
   srand((unsigned int)time(NULL));
 
   StrategyImpl *impl = parcMemory_AllocateAndClear(sizeof(StrategyImpl));
@@ -127,6 +143,31 @@ static void _update_Stats(StrategyLoadBalancerWithPD *strategy,
   strategy->weights_sum += w;
 }
 
+#ifdef WITH_POLICY
+static void _sendProbes(StrategyLoadBalancerWithPD *strategy, NumberSet * nexthops) {
+  unsigned size = (unsigned)numberSet_Length(nexthops);
+  for (unsigned i = 0; i < size; i++) {
+    unsigned nhop = numberSet_GetItem(nexthops, i);
+    Connection *conn =
+        (Connection *)connectionTable_FindById(strategy->connTable, nhop);
+    if (!conn)
+        continue;
+
+    connection_Probe(conn);
+    unsigned delay = (unsigned)connection_GetDelay(conn);
+    PARCUnsigned *cid = parcUnsigned_Create(nhop);
+    StrategyNexthopStateWithPD *elem =
+        (StrategyNexthopStateWithPD *)parcHashMap_Get(
+            strategy->strategy_state, cid);
+    strategyNexthopStateWithPD_SetDelay(elem, delay);
+    if (delay < strategy->min_delay && delay != 0) {
+      strategy->min_delay = delay;
+    }
+
+    parcUnsigned_Release(&cid);
+  }
+}
+#else
 static void _sendProbes(StrategyLoadBalancerWithPD *strategy) {
   unsigned size = (unsigned)numberSet_Length(strategy->nexthops);
   for (unsigned i = 0; i < size; i++) {
@@ -149,7 +190,53 @@ static void _sendProbes(StrategyLoadBalancerWithPD *strategy) {
     }
   }
 }
+#endif /* WITH_POLICY */
+
+#ifdef WITH_POLICY
+static unsigned _select_Nexthop(StrategyLoadBalancerWithPD *strategy, NumberSet * nexthops) {
+  strategy->fwdPackets++;
+  if (strategy->toInit || strategy->fwdPackets == PROBE_FREQUENCY) {
+    strategy->toInit = false;
+    strategy->fwdPackets = 0;
+    _sendProbes(strategy, nexthops);
+  }
+  double rnd = (double)rand() / (double)RAND_MAX;
+  double start_range = 0.0;
+
+  PARCIterator *it = parcHashMap_CreateKeyIterator(strategy->strategy_state);
+
+  unsigned nexthop = 100000;
+  while (parcIterator_HasNext(it)) {
+    PARCUnsigned *cid = parcIterator_Next(it);
+    const StrategyNexthopStateWithPD *elem =
+        parcHashMap_Get(strategy->strategy_state, cid);
 
+    double w = strategyNexthopStateWithPD_GetWeight(elem);
+
+    // printf("next = %u .. pi %u avgpi %f w %f avgrtt
+    // %f\n",parcUnsigned_GetUnsigned(cid),
+    // strategyNexthopStateWithPD_GetPI(elem),
+    //        strategyNexthopStateWithPD_GetWeight(elem),
+    //        strategyNexthopStateWithPD_GetWeight(elem),
+    //        strategyNexthopStateWithPD_GetAvgRTT(elem));
+
+    double prob = w / strategy->weights_sum;
+    if ((rnd >= start_range) && (rnd < (start_range + prob))) {
+      nexthop = parcUnsigned_GetUnsigned(cid);
+      break;
+    } else {
+      start_range += prob;
+    }
+  }
+
+  parcIterator_Release(&it);
+
+  // if no face is selected by the algorithm (for example because of a wrong
+  // round in the weights) we may always select the last face here. Double check
+  // this!
+  return nexthop;
+}
+#else
 static unsigned _select_Nexthop(StrategyLoadBalancerWithPD *strategy) {
   strategy->fwdPackets++;
   if (strategy->toInit || strategy->fwdPackets == PROBE_FREQUENCY) {
@@ -193,6 +280,7 @@ static unsigned _select_Nexthop(StrategyLoadBalancerWithPD *strategy) {
   // this!
   return nexthop;
 }
+#endif /* WITH_POLICY */
 
 static void _strategyLoadBalancerWithPD_ReceiveObject(
     StrategyImpl *strategy, const NumberSet *egressId,
@@ -242,7 +330,11 @@ static void _strategyLoadBalancerWithPD_OnTimeout(StrategyImpl *strategy,
 // function never returns NULL. in case we have no output face we need to return
 // an empty NumberSet
 static NumberSet *_strategyLoadBalancerWithPD_LookupNexthop(
-    StrategyImpl *strategy, const Message *interestMessage) {
+    StrategyImpl *strategy,
+#ifdef WITH_POLICY
+    NumberSet * nexthops,
+#endif
+    const Message *interestMessage) {
   StrategyLoadBalancerWithPD *lb =
       (StrategyLoadBalancerWithPD *)strategy->context;
 
@@ -262,7 +354,11 @@ static NumberSet *_strategyLoadBalancerWithPD_LookupNexthop(
 
   unsigned out_connection;
   do {
+#ifdef WITH_POLICY
+    out_connection = _select_Nexthop(lb, nexthops);
+#else
     out_connection = _select_Nexthop(lb);
+#endif /* WITH_POLICY */
   } while (out_connection == in_connection);
 
   PARCUnsigned *out = parcUnsigned_Create(out_connection);
@@ -284,6 +380,7 @@ static NumberSet *_strategyLoadBalancerWithPD_LookupNexthop(
   return outList;
 }
 
+#ifndef WITH_POLICY
 static NumberSet *_strategyLoadBalancerWithPD_ReturnNexthops(
     StrategyImpl *strategy) {
   StrategyLoadBalancerWithPD *lb =
@@ -296,6 +393,7 @@ unsigned _strategyLoadBalancerWithPD_CountNexthops(StrategyImpl *strategy) {
       (StrategyLoadBalancerWithPD *)strategy->context;
   return (unsigned)numberSet_Length(lb->nexthops);
 }
+#endif /* WITH_POLICY */
 
 static void _strategyLoadBalancerWithPD_resetState(StrategyImpl *strategy) {
   StrategyLoadBalancerWithPD *lb =
@@ -328,7 +426,9 @@ static void _strategyLoadBalancerWithPD_AddNexthop(StrategyImpl *strategy,
 
   if (!parcHashMap_Contains(lb->strategy_state, cid)) {
     parcHashMap_Put(lb->strategy_state, cid, state);
+#ifndef WITH_POLICY
     numberSet_Add(lb->nexthops, connectionId);
+#endif /* ! WITH_POLICY */
     _strategyLoadBalancerWithPD_resetState(strategy);
   }
 }
@@ -342,7 +442,9 @@ static void _strategyLoadBalancerWithPD_RemoveNexthop(StrategyImpl *strategy,
 
   if (parcHashMap_Contains(lb->strategy_state, cid)) {
     parcHashMap_Remove(lb->strategy_state, cid);
+#ifndef WITH_POLICY
     numberSet_Remove(lb->nexthops, connectionId);
+#endif /* ! WITH_POLICY */
     _strategyLoadBalancerWithPD_resetState(strategy);
   }
 
@@ -360,7 +462,9 @@ static void _strategyLoadBalancerWithPD_ImplDestroy(
       (StrategyLoadBalancerWithPD *)impl->context;
 
   parcHashMap_Release(&(strategy->strategy_state));
+#ifndef WITH_POLICY
   numberSet_Release(&(strategy->nexthops));
+#endif /* ! WITH_POLICY */
 
   parcMemory_Deallocate((void **)&strategy);
   parcMemory_Deallocate((void **)&impl);
diff --git a/hicn-light/src/hicn/strategies/loadBalancerWithPD.h b/hicn-light/src/hicn/strategies/loadBalancerWithPD.h
index d8a215913..e6c9f8271 100644
--- a/hicn-light/src/hicn/strategies/loadBalancerWithPD.h
+++ b/hicn-light/src/hicn/strategies/loadBalancerWithPD.h
@@ -21,10 +21,15 @@
 #ifndef loadBalancerWithPD_h
 #define loadBalancerWithPD_h
 
-#include <hicn/core/connectionTable.h>
 #include <hicn/strategies/strategyImpl.h>
+#include <hicn/core/connectionTable.h>
 
+#ifdef WITH_POLICY
+StrategyImpl *strategyLoadBalancerWithPD_Create(const ConnectionTable * table);
+#else
 StrategyImpl *strategyLoadBalancerWithPD_Create();
+#endif /* WITH_POLICY */
+
 void strategyLoadBalancerWithPD_SetConnectionTable(StrategyImpl *strategy,
                                                    ConnectionTable *connTable);
 #endif  // loadBalancerWithPD_h
diff --git a/hicn-light/src/hicn/strategies/nexthopState.c b/hicn-light/src/hicn/strategies/nexthopState.c
index 0997193ce..40af14832 100644
--- a/hicn-light/src/hicn/strategies/nexthopState.c
+++ b/hicn-light/src/hicn/strategies/nexthopState.c
@@ -23,6 +23,8 @@
 #include <parc/assert/parc_Assert.h>
 #include <hicn/strategies/nexthopState.h>
 
+#define AVG_PI_THRESHOLD 1e-3
+
 struct strategy_nexthop_state {
   unsigned int pi;
   double avg_pi;
@@ -197,7 +199,11 @@ double strategyNexthopState_UpdateState(StrategyNexthopState *x, bool inc,
     }
   }
   x->avg_pi = (x->avg_pi * alpha) + (x->pi * (1 - alpha));
+#ifdef WITH_POLICY
+  if (x->avg_pi < AVG_PI_THRESHOLD) {
+#else
   if (x->avg_pi == 0.0) {
+#endif /* WITH_POLICY */
     x->avg_pi = 0.1;
   }
   x->weight = 1 / x->avg_pi;
diff --git a/hicn-light/src/hicn/strategies/rnd.c b/hicn-light/src/hicn/strategies/rnd.c
index e2d74036c..637fd90f9 100644
--- a/hicn-light/src/hicn/strategies/rnd.c
+++ b/hicn-light/src/hicn/strategies/rnd.c
@@ -32,9 +32,14 @@ static void _strategyRnd_ReceiveObject(StrategyImpl *strategy,
 static void _strategyRnd_OnTimeout(StrategyImpl *strategy,
                                    const NumberSet *egressId);
 static NumberSet *_strategyRnd_LookupNexthop(StrategyImpl *strategy,
-                                             const Message *interestMessage);
+#ifdef WITH_POLICY
+    NumberSet * nexthops,
+#endif /* WITH_POLICY */
+    const Message *interestMessage);
+#ifndef WITH_POLICY
 static NumberSet *_strategyRnd_ReturnNexthops(StrategyImpl *strategy);
 static unsigned _strategyRnd_CountNexthops(StrategyImpl *strategy);
+#endif /* ! WITH_POLICY */
 static void _strategyRnd_AddNexthop(StrategyImpl *strategy,
                                     unsigned connectionId);
 static void _strategyRnd_RemoveNexthop(StrategyImpl *strategy,
@@ -47,8 +52,10 @@ static StrategyImpl _template = {
     .receiveObject = &_strategyRnd_ReceiveObject,
     .onTimeout = &_strategyRnd_OnTimeout,
     .lookupNexthop = &_strategyRnd_LookupNexthop,
+#ifndef WITH_POLICY
     .returnNexthops = &_strategyRnd_ReturnNexthops,
     .countNexthops = &_strategyRnd_CountNexthops,
+#endif /* ! WITH_POLICY */
     .addNexthop = &_strategyRnd_AddNexthop,
     .removeNexthop = &_strategyRnd_RemoveNexthop,
     .destroy = &_strategyRnd_ImplDestroy,
@@ -59,7 +66,9 @@ struct strategy_rnd;
 typedef struct strategy_rnd StrategyRnd;
 
 struct strategy_rnd {
+#ifndef WITH_POLICY
   NumberSet *nexthops;
+#endif /* ! WITH_POLICY */
 };
 
 StrategyImpl *strategyRnd_Create() {
@@ -67,7 +76,9 @@ StrategyImpl *strategyRnd_Create() {
   parcAssertNotNull(strategy, "parcMemory_AllocateAndClear(%zu) returned NULL",
                     sizeof(StrategyRnd));
 
+#ifndef WITH_POLICY
   strategy->nexthops = numberSet_Create();
+#endif /* ! WITH_POLICY */
   srand((unsigned int)time(NULL));
 
   StrategyImpl *impl = parcMemory_AllocateAndClear(sizeof(StrategyImpl));
@@ -85,6 +96,7 @@ strategy_type _strategyRnd_GetStrategy(StrategyImpl *strategy) {
   return SET_STRATEGY_RANDOM;
 }
 
+#ifndef WITH_POLICY
 static int _select_Nexthop(StrategyRnd *strategy) {
   unsigned len = (unsigned)numberSet_Length(strategy->nexthops);
   if (len == 0) {
@@ -94,6 +106,7 @@ static int _select_Nexthop(StrategyRnd *strategy) {
   int rnd = (rand() % len);
   return numberSet_GetItem(strategy->nexthops, rnd);
 }
+#endif /* ! WITH_POLICY */
 
 static void _strategyRnd_ReceiveObject(StrategyImpl *strategy,
                                        const NumberSet *egressId,
@@ -104,13 +117,22 @@ static void _strategyRnd_OnTimeout(StrategyImpl *strategy,
                                    const NumberSet *egressId) {}
 
 static NumberSet *_strategyRnd_LookupNexthop(StrategyImpl *strategy,
-                                             const Message *interestMessage) {
-  StrategyRnd *srnd = (StrategyRnd *)strategy->context;
+#ifdef WITH_POLICY
+        NumberSet * nexthops,
+#endif /* WITH_POLICY */
+        const Message *interestMessage) {
+  unsigned out_connection;
+  NumberSet *out = numberSet_Create();
+
+#ifdef WITH_POLICY
+  // We return one next hop at random
+  out_connection = numberSet_GetItem(nexthops, rand() % numberSet_Length(nexthops));
 
+#else
+  StrategyRnd *srnd = (StrategyRnd *)strategy->context;
   unsigned in_connection = message_GetIngressConnectionId(interestMessage);
   unsigned nexthopSize = (unsigned)numberSet_Length(srnd->nexthops);
 
-  NumberSet *out = numberSet_Create();
   if ((nexthopSize == 0) ||
       ((nexthopSize == 1) &&
        numberSet_Contains(srnd->nexthops, in_connection))) {
@@ -119,7 +141,6 @@ static NumberSet *_strategyRnd_LookupNexthop(StrategyImpl *strategy,
     return out;
   }
 
-  unsigned out_connection;
   do {
     out_connection = _select_Nexthop(srnd);
   } while (out_connection == in_connection);
@@ -127,11 +148,13 @@ static NumberSet *_strategyRnd_LookupNexthop(StrategyImpl *strategy,
   if (out_connection == -1) {
     return out;
   }
+#endif /* WITH_POLICY */
 
   numberSet_Add(out, out_connection);
   return out;
 }
 
+#ifndef WITH_POLICY
 static NumberSet *_strategyRnd_ReturnNexthops(StrategyImpl *strategy) {
   StrategyRnd *srnd = (StrategyRnd *)strategy->context;
   return srnd->nexthops;
@@ -141,22 +164,27 @@ unsigned _strategyRnd_CountNexthops(StrategyImpl *strategy) {
   StrategyRnd *srnd = (StrategyRnd *)strategy->context;
   return (unsigned)numberSet_Length(srnd->nexthops);
 }
+#endif /* ! WITH_POLICY */
 
 static void _strategyRnd_AddNexthop(StrategyImpl *strategy,
                                     unsigned connectionId) {
+#ifndef WITH_POLICY
   StrategyRnd *srnd = (StrategyRnd *)strategy->context;
   if (!numberSet_Contains(srnd->nexthops, connectionId)) {
     numberSet_Add(srnd->nexthops, connectionId);
   }
+#endif /* ! WITH_POLICY */
 }
 
 static void _strategyRnd_RemoveNexthop(StrategyImpl *strategy,
                                        unsigned connectionId) {
+#ifndef WITH_POLICY
   StrategyRnd *srnd = (StrategyRnd *)strategy->context;
 
   if (numberSet_Contains(srnd->nexthops, connectionId)) {
     numberSet_Remove(srnd->nexthops, connectionId);
   }
+#endif /* ! WITH_POLICY */
 }
 
 static void _strategyRnd_ImplDestroy(StrategyImpl **strategyPtr) {
@@ -167,7 +195,9 @@ static void _strategyRnd_ImplDestroy(StrategyImpl **strategyPtr) {
   StrategyImpl *impl = *strategyPtr;
   StrategyRnd *strategy = (StrategyRnd *)impl->context;
 
+#ifndef WITH_POLICY
   numberSet_Release(&(strategy->nexthops));
+#endif /* ! WITH_POLICY */
 
   parcMemory_Deallocate((void **)&strategy);
   parcMemory_Deallocate((void **)&impl);
diff --git a/hicn-light/src/hicn/strategies/rnd.h b/hicn-light/src/hicn/strategies/rnd.h
index b57b41ccf..78fb34758 100644
--- a/hicn-light/src/hicn/strategies/rnd.h
+++ b/hicn-light/src/hicn/strategies/rnd.h
@@ -23,4 +23,5 @@
 #include <hicn/strategies/strategyImpl.h>
 
 StrategyImpl* strategyRnd_Create();
+
 #endif  // rnd_h
diff --git a/hicn-light/src/hicn/strategies/rndSegment.c b/hicn-light/src/hicn/strategies/rndSegment.c
index d7a5c6aec..93e39ee74 100644
--- a/hicn-light/src/hicn/strategies/rndSegment.c
+++ b/hicn-light/src/hicn/strategies/rndSegment.c
@@ -33,9 +33,15 @@ static void _strategyRndSegment_ReceiveObject(StrategyImpl *strategy,
 static void _strategyRndSegment_OnTimeout(StrategyImpl *strategy,
                                           const NumberSet *egressId);
 static NumberSet *_strategyRndSegment_LookupNexthop(
-    StrategyImpl *strategy, const Message *interestMessage);
+    StrategyImpl *strategy,
+#ifdef WITH_POLICY
+    NumberSet * nexthops,
+#endif /* WITH_POLICY */
+    const Message *interestMessage);
+#ifndef WITH_POLICY
 static NumberSet *_strategyRndSegment_ReturnNexthops(StrategyImpl *strategy);
 static unsigned _strategyRndSegment_CountNexthops(StrategyImpl *strategy);
+#endif /* ! WITH_POLICY */
 static void _strategyRndSegment_AddNexthop(StrategyImpl *strategy,
                                            unsigned connectionId);
 static void _strategyRndSegment_RemoveNexthop(StrategyImpl *strategy,
@@ -48,8 +54,10 @@ static StrategyImpl _template = {
     .receiveObject = &_strategyRndSegment_ReceiveObject,
     .onTimeout = &_strategyRndSegment_OnTimeout,
     .lookupNexthop = &_strategyRndSegment_LookupNexthop,
+#ifndef WITH_POLICY
     .returnNexthops = &_strategyRndSegment_ReturnNexthops,
     .countNexthops = &_strategyRndSegment_CountNexthops,
+#endif /* ! WITH_POLICY */
     .addNexthop = &_strategyRndSegment_AddNexthop,
     .removeNexthop = &_strategyRndSegment_RemoveNexthop,
     .destroy = &_strategyRndSegment_ImplDestroy,
@@ -111,7 +119,11 @@ static void _strategyRndSegment_OnTimeout(StrategyImpl *strategy,
                                           const NumberSet *egressId) {}
 
 static NumberSet *_strategyRndSegment_LookupNexthop(
-    StrategyImpl *strategy, const Message *interestMessage) {
+    StrategyImpl *strategy,
+#ifdef WITH_POLICY
+    NumberSet * nexthops,
+#endif /* WITH_POLICY */
+    const Message *interestMessage) {
   StrategyRndSegment *srnd = (StrategyRndSegment *)strategy->context;
 
   unsigned in_connection = message_GetIngressConnectionId(interestMessage);
@@ -161,6 +173,7 @@ static NumberSet *_strategyRndSegment_LookupNexthop(
   return out;
 }
 
+#ifndef WITH_POLICY
 static NumberSet *_strategyRndSegment_ReturnNexthops(StrategyImpl *strategy) {
   StrategyRndSegment *srnd = (StrategyRndSegment *)strategy->context;
   return srnd->nexthops;
@@ -170,22 +183,27 @@ unsigned _strategyRndSegment_CountNexthops(StrategyImpl *strategy) {
   StrategyRndSegment *srnd = (StrategyRndSegment *)strategy->context;
   return (unsigned)numberSet_Length(srnd->nexthops);
 }
+#endif /* ! WITH_POLICY */
 
 static void _strategyRndSegment_AddNexthop(StrategyImpl *strategy,
                                            unsigned connectionId) {
+#ifndef WITH_POLICY
   StrategyRndSegment *srnd = (StrategyRndSegment *)strategy->context;
   if (!numberSet_Contains(srnd->nexthops, connectionId)) {
     numberSet_Add(srnd->nexthops, connectionId);
   }
+#endif /* ! WITH_POLICY */
 }
 
 static void _strategyRndSegment_RemoveNexthop(StrategyImpl *strategy,
                                               unsigned connectionId) {
+#ifndef WITH_POLICY
   StrategyRndSegment *srnd = (StrategyRndSegment *)strategy->context;
 
   if (numberSet_Contains(srnd->nexthops, connectionId)) {
     numberSet_Remove(srnd->nexthops, connectionId);
   }
+#endif /* ! WITH_POLICY */
 }
 
 static void _strategyRndSegment_ImplDestroy(StrategyImpl **strategyPtr) {
diff --git a/hicn-light/src/hicn/strategies/rndSegment.h b/hicn-light/src/hicn/strategies/rndSegment.h
index 897ccca47..6694f03e5 100644
--- a/hicn-light/src/hicn/strategies/rndSegment.h
+++ b/hicn-light/src/hicn/strategies/rndSegment.h
@@ -23,5 +23,6 @@
 
 #include <hicn/strategies/strategyImpl.h>
 
-StrategyImpl* strategyRndSegment_Create();
+StrategyImpl *strategyRndSegment_Create();
+
 #endif  // rnd_Segment_h
diff --git a/hicn-light/src/hicn/strategies/strategyImpl.h b/hicn-light/src/hicn/strategies/strategyImpl.h
index 2634665eb..d4001194a 100644
--- a/hicn-light/src/hicn/strategies/strategyImpl.h
+++ b/hicn-light/src/hicn/strategies/strategyImpl.h
@@ -55,12 +55,18 @@ struct strategy_impl {
                         const Message *objectMessage, Ticks rtt);
   void (*onTimeout)(StrategyImpl *strategy, const NumberSet *egressId);
   NumberSet *(*lookupNexthop)(StrategyImpl *strategy,
+#ifdef WITH_POLICY
+    NumberSet * nexthops,
+#endif /* WITH_POLICY */
                               const Message *interestMessage);
+#ifndef WITH_POLICY
   NumberSet *(*returnNexthops)(StrategyImpl *strategy);
   unsigned (*countNexthops)(StrategyImpl *strategy);
+#endif /* ! WITH_POLICY */
   void (*addNexthop)(StrategyImpl *strategy, unsigned connectionId);
   void (*removeNexthop)(StrategyImpl *strategy, unsigned connectionId);
   void (*destroy)(StrategyImpl **strategyPtr);
   strategy_type (*getStrategy)(StrategyImpl *strategy);
 };
+
 #endif  // strategyImpl_h
diff --git a/hicn-light/src/hicn/utils/CMakeLists.txt b/hicn-light/src/hicn/utils/CMakeLists.txt
index ad9c8e4c1..dd9e12c15 100644
--- a/hicn-light/src/hicn/utils/CMakeLists.txt
+++ b/hicn-light/src/hicn/utils/CMakeLists.txt
@@ -19,7 +19,9 @@ list(APPEND HEADER_FILES
   ${CMAKE_CURRENT_SOURCE_DIR}/commands.h
   ${CMAKE_CURRENT_SOURCE_DIR}/interface.h
   ${CMAKE_CURRENT_SOURCE_DIR}/interfaceSet.h
+  ${CMAKE_CURRENT_SOURCE_DIR}/policy.h
   ${CMAKE_CURRENT_SOURCE_DIR}/punting.h
+  ${CMAKE_CURRENT_SOURCE_DIR}/token.h
   ${CMAKE_CURRENT_SOURCE_DIR}/utils.h
 )
 
@@ -28,6 +30,7 @@ list(APPEND SOURCE_FILES
   ${CMAKE_CURRENT_SOURCE_DIR}/addressList.c
   ${CMAKE_CURRENT_SOURCE_DIR}/interface.c
   ${CMAKE_CURRENT_SOURCE_DIR}/interfaceSet.c
+  ${CMAKE_CURRENT_SOURCE_DIR}/policy.c
   ${CMAKE_CURRENT_SOURCE_DIR}/punting.c
   ${CMAKE_CURRENT_SOURCE_DIR}/utils.c
 )
diff --git a/hicn-light/src/hicn/utils/commands.h b/hicn-light/src/hicn/utils/commands.h
index 96415d8da..223bbffaa 100644
--- a/hicn-light/src/hicn/utils/commands.h
+++ b/hicn-light/src/hicn/utils/commands.h
@@ -31,6 +31,8 @@
 #include <stdint.h>
 #include <stdlib.h>
 
+#include <hicn/utils/policy.h>
+
 typedef struct in6_addr ipv6_addr_t;
 typedef uint32_t ipv4_addr_t;
 
@@ -67,6 +69,12 @@ typedef enum {
   MAPME_TIMESCALE,
   MAPME_RETX,
   CONNECTION_SET_ADMIN_STATE,
+#ifdef WITH_POLICY
+  ADD_POLICY,
+  LIST_POLICIES,
+  REMOVE_POLICY,
+  UPDATE_CONNECTION,
+#endif /* WITH_POLICY */
   LAST_COMMAND_VALUE
 } command_id;
 
@@ -129,6 +137,9 @@ typedef struct {
   uint8_t ipType;
   uint8_t connectionType;
   uint8_t admin_state;
+#ifdef WITH_POLICY
+  policy_tags_t tags;
+#endif /* WITH_POLICY */
 } add_connection_command;
 
 // SIZE=56
@@ -291,6 +302,36 @@ typedef struct {
   uint8_t admin_state;
 } connection_set_admin_state_command;
 
+#ifdef WITH_POLICY
+
+typedef struct {
+  union commandAddr address;
+  uint8_t addressType;
+  uint8_t len;
+  policy_t policy;
+} add_policy_command;
+
+typedef struct {
+  union commandAddr address;
+  uint8_t addressType;
+  uint8_t len;
+  policy_t policy;
+} list_policies_command;
+
+typedef struct {
+  union commandAddr address;
+  uint8_t addressType;
+  uint8_t len;
+} remove_policy_command;
+
+typedef struct {
+  char symbolicOrConnid[16];
+  uint8_t admin_state;
+  policy_tags_t tags;
+} update_connection_command;
+
+#endif /* WITH_POLICY */
+
 //===== size of commands ======
 // REMINDER: when a new_command is added, the following switch has to be
 // updated.
@@ -334,6 +375,16 @@ static inline int payloadLengthDaemon(command_id id) {
       return sizeof(mapme_timing_command);
     case CONNECTION_SET_ADMIN_STATE:
       return sizeof(connection_set_admin_state_command);
+#ifdef WITH_POLICY
+    case ADD_POLICY:
+      return sizeof(add_policy_command);
+    case LIST_POLICIES:
+      return 0; // list policies: payload always 0
+    case REMOVE_POLICY:
+      return sizeof(remove_policy_command);
+    case UPDATE_CONNECTION:
+      return sizeof(update_connection_command);
+#endif /* WITH_POLICY */
     case LAST_COMMAND_VALUE:
       return 0;
     default:
diff --git a/hicn-light/src/hicn/utils/policy.c b/hicn-light/src/hicn/utils/policy.c
new file mode 100644
index 000000000..6c8651ee3
--- /dev/null
+++ b/hicn-light/src/hicn/utils/policy.c
@@ -0,0 +1,59 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file policy.h
+ * \brief Implementation of policy description
+ */
+
+#include <stdio.h>
+#include "policy.h"
+
+const char * policy_tag_str[] = {
+    #define _(x, y) [POLICY_TAG_ ## x] = STRINGIZE(x),
+    foreach_policy_tag
+    #undef _
+};
+
+const char policy_tag_short_str[] = {
+    #define _(x, y) [POLICY_TAG_ ## x] = y,
+    foreach_policy_tag
+    #undef _
+};
+
+const char * policy_state_str[] = {
+    #define _(x) [POLICY_STATE_ ## x] = STRINGIZE(x),
+    foreach_policy_state
+    #undef _
+};
+
+int
+policy_tag_state_snprintf(char * s, size_t size, const policy_tag_state_t * tag_state)
+{
+    char *cur = s;
+    int rc;
+
+    if (tag_state->disabled > 1)
+        return -1;
+
+    rc = snprintf(cur, s + size - cur, "%s%s", (tag_state->disabled == 1) ? "!" : "", policy_state_str[tag_state->state]);
+    if (rc < 0)
+        return rc;
+    cur += rc;
+    if (size != 0 && cur >= s + size)
+        return cur - s;
+
+    return cur - s;
+}
diff --git a/hicn-light/src/hicn/utils/policy.h b/hicn-light/src/hicn/utils/policy.h
new file mode 100644
index 000000000..993fdca44
--- /dev/null
+++ b/hicn-light/src/hicn/utils/policy.h
@@ -0,0 +1,232 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file policy.h
+ * \brief Policy description
+ */
+#ifndef HICN_POLICY_H
+#define HICN_POLICY_H
+
+#include <netinet/in.h> // INET*_ADDRSTRLEN
+#include <string.h> // strcasecmp
+#include "token.h"
+
+/* POLICY TAG */
+
+#define foreach_policy_tag      \
+    /* Interface type */        \
+    _(WIRED, 'E')               \
+    _(WIFI, 'W')                \
+    _(CELLULAR, 'C')            \
+    /* QoS */                   \
+    _(BEST_EFFORT, 'b')         \
+    _(REALTIME, 'r')            \
+    _(MULTIPATH, 'M')           \
+    /* Security */              \
+    _(TRUSTED, 'T')
+
+typedef enum {
+#define _(x, y) POLICY_TAG_ ## x,
+foreach_policy_tag
+#undef _
+    POLICY_TAG_N
+} policy_tag_t;
+
+#define MAXSZ_POLICY_TAG_ 11
+#define MAXSZ_POLICY_TAG MAXSZ_POLICY_TAG_ + 1
+
+extern const char * policy_tag_str[];
+extern const char policy_tag_short_str[];
+
+static inline
+policy_tag_t
+policy_tag_from_str(const char * str)
+{
+#define _(x, y) if (strcasecmp(str, policy_tag_str[POLICY_TAG_ ## x] ) == 0) { return POLICY_TAG_ ## x; } else
+foreach_policy_tag
+#undef _
+    return POLICY_TAG_N;
+}
+
+/* POLICY_TAGS */
+
+typedef int policy_tags_t;
+
+static inline
+void policy_tags_add(policy_tags_t * tags, policy_tag_t tag)
+{
+    *tags |= (1 << tag);
+}
+
+static inline
+void policy_tags_remove(policy_tags_t * tags, policy_tag_t tag)
+{
+    *tags &= ~(1 << tag);
+}
+
+static inline
+int policy_tags_has(policy_tags_t tags, policy_tag_t tag)
+{
+    return tags & (1 << tag);
+}
+
+#define POLICY_TAGS_EMPTY 0
+
+static inline
+int
+policy_tags_snprintf(char * s, size_t size, policy_tags_t tags)
+{
+#define _(x, y) s[POLICY_TAG_ ## x] = policy_tags_has(tags, POLICY_TAG_ ## x) ? y : '.';
+foreach_policy_tag
+#undef _
+    s[POLICY_TAG_N] = '\0';
+    return POLICY_TAG_N + 1;
+}
+
+#define MAXSZ_POLICY_TAGS_ POLICY_TAG_N
+#define MAXSZ_POLICY_TAGS MAXSZ_POLICY_TAGS_ + 1
+
+/* POLICY STATE */
+
+#define foreach_policy_state    \
+    _(NEUTRAL)                  \
+    _(REQUIRE)                  \
+    _(PREFER)                   \
+    _(AVOID)                    \
+    _(PROHIBIT)                 \
+    _(N)
+
+typedef enum {
+#define _(x) POLICY_STATE_ ## x,
+foreach_policy_state
+#undef _
+} policy_state_t;
+
+#define MAXSZ_POLICY_STATE_ 8
+#define MAXSZ_POLICY_STATE MAXSZ_POLICY_STATE_ + 1
+
+extern const char * policy_state_str[];
+
+
+/* POLICY TAG STATE */
+
+typedef struct {
+    policy_state_t state;
+    uint8_t disabled;
+} policy_tag_state_t;
+
+#define MAXSZ_POLICY_TAG_STATE_ 8
+#define MAXSZ_POLICY_TAG_STATE MAXSZ_POLICY_TAG_STATE_ + 1
+
+int policy_tag_state_snprintf(char * s, size_t size, const policy_tag_state_t * tag_state);
+
+
+/* INTERFACE STATS */
+
+typedef struct {
+    float throughput;
+    float latency;
+    float loss_rate;
+} interface_stats_t;
+
+#define INTERFACE_STATS_NONE {                          \
+    .throughput = 0,                                    \
+    .latency = 0,                                       \
+    .loss_rate = 0,                                     \
+}
+
+
+/* POLICY STATS */
+
+typedef struct {
+    interface_stats_t wired;
+    interface_stats_t wifi;
+    interface_stats_t cellular;
+    interface_stats_t all;
+} policy_stats_t;
+
+#define POLICY_STATS_NONE {                     \
+    .wired    = INTERFACE_STATS_NONE,           \
+    .wifi     = INTERFACE_STATS_NONE,           \
+    .cellular = INTERFACE_STATS_NONE,           \
+    .all      = INTERFACE_STATS_NONE,           \
+}
+
+typedef struct {
+    uint32_t num_packets;
+    uint32_t num_bytes;
+    uint32_t num_losses;
+    uint32_t latency_idle;
+} interface_counters_t;
+
+#define INTERFACE_COUNTERS_NONE {               \
+    .num_packets = 0,                           \
+    .num_bytes = 0,                             \
+    .num_losses = 0,                            \
+    .latency_idle = 0,                          \
+}
+
+typedef struct {
+    interface_counters_t wired;
+    interface_counters_t wifi;
+    interface_counters_t cellular;
+    interface_counters_t all;
+    uint64_t last_update;
+} policy_counters_t;
+
+#define POLICY_COUNTERS_NONE (policy_counters_t) {      \
+    .wired    = INTERFACE_COUNTERS_NONE,                \
+    .wifi     = INTERFACE_COUNTERS_NONE,                \
+    .cellular = INTERFACE_COUNTERS_NONE,                \
+    .all      = INTERFACE_COUNTERS_NONE,                \
+    .last_update = 0,                                   \
+}
+
+/* POLICY */
+
+#define APP_NAME_LEN 128
+
+typedef struct {
+    char app_name[APP_NAME_LEN];
+    policy_tag_state_t tags[POLICY_TAG_N];
+    policy_stats_t stats;
+} policy_t;
+
+static const policy_t POLICY_NONE = {
+    .app_name = { 0 },
+    .tags = {
+#define _(x, y) [POLICY_TAG_ ## x] = { POLICY_STATE_NEUTRAL, 0 },
+foreach_policy_tag
+#undef _
+    },
+    .stats = POLICY_STATS_NONE,
+};
+
+
+/* POLICY DESCRIPTION */
+
+#define PFX_STRLEN 4 /* eg. /128 */
+
+typedef struct {
+    int family;
+    union {
+        char ipv4_prefix[INET_ADDRSTRLEN + PFX_STRLEN];
+        char ipv6_prefix[INET6_ADDRSTRLEN + PFX_STRLEN];
+    };
+    policy_t policy;
+} policy_description_t;
+
+#endif /* HICN_POLICY_H */
diff --git a/hicn-light/src/hicn/utils/token.h b/hicn-light/src/hicn/utils/token.h
new file mode 100644
index 000000000..43e0a77b2
--- /dev/null
+++ b/hicn-light/src/hicn/utils/token.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/* Token concatenation */
+
+/*
+ * Concatenate preprocessor tokens A and B without expanding macro definitions
+ * (however, if invoked from a macro, macro arguments are expanded).
+ */
+#define PPCAT_NX(A, B) A ## B
+
+/*
+ * Concatenate preprocessor tokens A and B after macro-expanding them.
+ */
+#define PPCAT(A, B) PPCAT_NX(A, B)
+
+/* Token stringification */
+
+/*
+ * Turn A into a string literal without expanding macro definitions
+ * (however, if invoked from a macro, macro arguments are expanded).
+ */
+#define STRINGIZE_NX(A) #A
+
+/*
+ * Turn A into a string literal after macro-expanding it.
+ */
+#define STRINGIZE(A) STRINGIZE_NX(A)
diff --git a/lib/CMakeLists.txt b/lib/CMakeLists.txt
index 51aeccb2a..4c51f3daf 100644
--- a/lib/CMakeLists.txt
+++ b/lib/CMakeLists.txt
@@ -27,8 +27,8 @@ if (NOT CMAKE_BUILD_TYPE)
 endif()
 
 if(CMAKE_SOURCE_DIR STREQUAL PROJECT_SOURCE_DIR)
-  set(LIBHICN hicn)
-  set(LIBHICN_STATIC ${LIBHICN}.static)
+    set(LIBHICN hicn)
+    set(LIBHICN_STATIC ${LIBHICN}.static)
 endif()
 
 include (Packaging)
diff --git a/lib/src/CMakeLists.txt b/lib/src/CMakeLists.txt
index d62ac7e8f..65eae8d77 100644
--- a/lib/src/CMakeLists.txt
+++ b/lib/src/CMakeLists.txt
@@ -50,7 +50,7 @@ list(APPEND LIBHICN_SOURCE_FILES
   ${CMAKE_CURRENT_SOURCE_DIR}/protocol/tcp.c
 )
 
-set (COMPILER_DEFINITIONS "-DWITH_MAPME -DWITH_MAPME_FIXES")
+set (COMPILER_DEFINITIONS "-DWITH_MAPME")
 
 include(BuildMacros)
 include(WindowsMacros)
@@ -79,17 +79,23 @@ else ()
   )
 endif ()
 add_custom_command(TARGET ${LIBHICN_STATIC} PRE_BUILD
-  COMMAND ${CMAKE_COMMAND} -E remove_directory ${PROJECT_BINARY_DIR}/hicn
+  COMMAND ${CMAKE_COMMAND} -E remove_directory ${CMAKE_BINARY_DIR}/hicn
 )
 
 add_custom_command(TARGET ${LIBHICN_STATIC} POST_BUILD
-  COMMAND ${CMAKE_COMMAND} -E make_directory ${PROJECT_BINARY_DIR}/hicn/
-  COMMAND ${CMAKE_COMMAND} -E copy ${LIBHICN_HEADER_FILES} ${PROJECT_BINARY_DIR}/hicn/
+  COMMAND ${CMAKE_COMMAND} -E make_directory ${CMAKE_BINARY_DIR}/hicn/
+  COMMAND ${CMAKE_COMMAND} -E copy ${LIBHICN_HEADER_FILES} ${CMAKE_BINARY_DIR}/hicn/
 )
 
 add_custom_command(TARGET ${LIBHICN_STATIC} POST_BUILD
-  COMMAND ${CMAKE_COMMAND} -E make_directory ${PROJECT_BINARY_DIR}/hicn/protocol
-  COMMAND ${CMAKE_COMMAND} -E copy ${LIBHICN_HEADER_FILES_PROTOCOL} ${PROJECT_BINARY_DIR}/hicn/protocol
+  COMMAND ${CMAKE_COMMAND} -E make_directory ${CMAKE_BINARY_DIR}/hicn/protocol
+  COMMAND ${CMAKE_COMMAND} -E copy ${LIBHICN_HEADER_FILES_PROTOCOL} ${CMAKE_BINARY_DIR}/hicn/protocol
+)
+
+set(HICN_INCLUDE_DIRS
+  ${CMAKE_BINARY_DIR} ""
+  CACHE INTERNAL
+  "" FORCE
 )
 
 # install(FILES ${LIBHICN_HEADER_FILES} DESTINATION ${CMAKE_INSTALL_PREFIX}/include/hicn COMPONENT libhicn)
diff --git a/libtransport/CMakeLists.txt b/libtransport/CMakeLists.txt
index 4ae46bb9a..fb059e390 100644
--- a/libtransport/CMakeLists.txt
+++ b/libtransport/CMakeLists.txt
@@ -59,7 +59,7 @@ if ((BUILD_HICNPLUGIN OR BUILD_MEMIF_CONNECTOR) AND "${CMAKE_SYSTEM_NAME}" STREQ
   set(__vpp__ 1)
   find_package(Vpp REQUIRED)
   find_package(Libmemif REQUIRED)
-  list(APPEND LIBTRANSPORT_INCLUDE_DIRS
+  list(APPEND LIBTRANSPORT_INTERNAL_INCLUDE_DIRS
     ${VPP_INCLUDE_DIRS}
     ${LIBMEMIF_INCLUDE_DIRS}
   )
@@ -110,7 +110,7 @@ find_package(Threads REQUIRED)
 if (${COMPILE_TESTS})
   include(TestMacros)
   find_package(GTest REQUIRED)
-  list(APPEND LIBTRANSPORT_INCLUDE_DIRS
+  list(APPEND LIBTRANSPORT_INTERNAL_INCLUDE_DIRS
     ${GTEST_INCLUDE_DIRS}
   )
 endif()
@@ -130,7 +130,7 @@ list(APPEND LIBRARIES
 )
 
 # Include dirs -- Order does matter!
-list(APPEND LIBTRANSPORT_INCLUDE_DIRS
+list(APPEND LIBTRANSPORT_INTERNAL_INCLUDE_DIRS
   ${HICN_INCLUDE_DIRS}
   ${HICN_BINARY_API_INCLUDE_DIRS}
   ${LIBPARC_INCLUDE_DIRS}
diff --git a/libtransport/src/hicn/transport/CMakeLists.txt b/libtransport/src/hicn/transport/CMakeLists.txt
index 3b5e9a15f..76fcd072b 100644
--- a/libtransport/src/hicn/transport/CMakeLists.txt
+++ b/libtransport/src/hicn/transport/CMakeLists.txt
@@ -34,11 +34,18 @@ install(
 
 set (COMPILER_DEFINITIONS "-DTRANSPORT_LOG_DEF_LEVEL=TRANSPORT_LOG_${TRANSPORT_LOG_LEVEL}")
 
-list(INSERT LIBTRANSPORT_INCLUDE_DIRS 0
+list(INSERT LIBTRANSPORT_INTERNAL_INCLUDE_DIRS 0
   ${CMAKE_CURRENT_SOURCE_DIR}/../..
   ${CMAKE_CURRENT_BINARY_DIR}/../..
 )
 
+set(LIBTRANSPORT_INCLUDE_DIRS
+  ${CMAKE_CURRENT_SOURCE_DIR}/../../
+  ${CMAKE_CURRENT_BINARY_DIR}/../../
+  "" CACHE INTERNAL
+  "" FORCE
+)
+
 if (NOT WIN32)
   set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -pthread")
 else ()
@@ -58,7 +65,7 @@ if (ANDROID_API)
     LINK_LIBRARIES ${LIBRARIES}
     DEPENDS ${DEPENDENCIES}
     COMPONENT lib${LIBTRANSPORT}
-    INCLUDE_DIRS ${LIBTRANSPORT_INCLUDE_DIRS}
+    INCLUDE_DIRS ${LIBTRANSPORT_INTERNAL_INCLUDE_DIRS}
     INSTALL_ROOT_DIR hicn/transport
     DEFINITIONS ${COMPILER_DEFINITIONS}
   )
@@ -70,7 +77,7 @@ else ()
     LINK_LIBRARIES ${LIBRARIES}
     DEPENDS ${DEPENDENCIES}
     COMPONENT lib${LIBTRANSPORT}
-    INCLUDE_DIRS ${LIBTRANSPORT_INCLUDE_DIRS}
+    INCLUDE_DIRS ${LIBTRANSPORT_INTERNAL_INCLUDE_DIRS}
     INSTALL_ROOT_DIR hicn/transport
     DEFINITIONS ${COMPILER_DEFINITIONS}
   )
diff --git a/scripts/build-packages.sh b/scripts/build-packages.sh
index b02572ca2..d1e491e3e 100644
--- a/scripts/build-packages.sh
+++ b/scripts/build-packages.sh
@@ -29,10 +29,10 @@ VPP_VERSION_RPM="19.04.1-release.x86_64"
 
 BUILD_TOOLS_UBUNTU="build-essential doxygen"
 LIBSSL_LIBEVENT_UBUNTU="libevent-dev libssl-dev"
-DEPS_UBUNTU="libparc-dev libasio-dev libcurl4-openssl-dev vpp=${VPP_VERSION_DEB} vpp-dev=${VPP_VERSION_DEB} libvppinfra=${VPP_VERSION_DEB} libvppinfra-dev=${VPP_VERSION_DEB} vpp-plugin-core=${VPP_VERSION_DEB}"
+DEPS_UBUNTU="libparc-dev libasio-dev libconfig-dev libcurl4-openssl-dev vpp=${VPP_VERSION_DEB} vpp-dev=${VPP_VERSION_DEB} libvppinfra=${VPP_VERSION_DEB} libvppinfra-dev=${VPP_VERSION_DEB} vpp-plugin-core=${VPP_VERSION_DEB}"
 
 # BUILD_TOOLS_GROUP_CENTOS="'Development Tools'"
-DEPS_CENTOS="vpp-devel-${VPP_VERSION_RPM} vpp-lib-${VPP_VERSION_RPM} libparc-devel libcurl-devel asio-devel centos-release-scl devtoolset-7"
+DEPS_CENTOS="vpp-devel-${VPP_VERSION_RPM} vpp-lib-${VPP_VERSION_RPM} libparc-devel libcurl-devel asio-devel libconfig-devel centos-release-scl devtoolset-7"
 DEPS_CENTOS_NOVERSION="vpp-devel vpp-lib libparc-devel libcurl-devel asio-devel centos-release-scl devtoolset-7"
 LATEST_EPEL_REPO="http://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm"
 
@@ -153,7 +153,7 @@ build_package() {
 
     cmake -DCMAKE_INSTALL_PREFIX=/usr   \
           -DBUILD_HICNPLUGIN=ON         \
-          -DBUILD_HICNEXTRAPLUGIN=ON       \
+          -DBUILD_HICNEXTRAPLUGIN=ON    \
           -DBUILD_LIBTRANSPORT=ON       \
           -DBUILD_APPS=ON               \
           -DLIBMEMIF_HOME=${MEMIF_HOME} \