[HICN-252] Add per-application policy framework to hicn-light forwarder

Change-Id: I0531cd7a7de179581295ae34766c81cd9cf3e172
Signed-off-by: Jordan Augé <jordan.auge+fdio@cisco.com>
Signed-off-by: Mauro Sardara <msardara@cisco.com>
Co-authored-by: Mauro Sardara <msardara@cisco.com>

48 files changed, 4973 insertions, 0 deletions

diff --git a/ctrl/facemgr/CMakeLists.txt b/ctrl/facemgr/CMakeLists.txt
new file mode 100644
index 000000000..fcd221a98
--- /dev/null
+++ b/ctrl/facemgr/CMakeLists.txt
@@ -0,0 +1,68 @@
+# Copyright (c) 2017-2019 Cisco and/or its affiliates.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+if (APPLE)
+    # >= 3.13 - CMP0079 (only needed on Apple platform for conditionally linking Network.framwork to libfacemgr)
+    cmake_minimum_required(VERSION 3.13 FATAL_ERROR)
+else()
+    cmake_minimum_required(VERSION 3.5 FATAL_ERROR)
+endif()
+
+project(facemgr)
+
+if (NOT CMAKE_BUILD_TYPE)
+    message(STATUS "No build type selected, default to Release")
+    set(CMAKE_BUILD_TYPE "Release")
+endif()
+
+set(CMAKE_MODULE_PATH
+  ${CMAKE_MODULE_PATH}
+  "${CMAKE_CURRENT_SOURCE_DIR}/../../cmake/Modules"
+  "${CMAKE_CURRENT_SOURCE_DIR}/cmake/Modules"
+)
+
+include(BuildMacros)
+
+set(CMAKE_C_STANDARD 11)
+set(CMAKE_C_STANDARD_REQUIRED ON)
+
+set(CMAKE_INSTALL_RPATH_USE_LINK_PATH ON)
+
+find_package_wrapper(Config REQUIRED)
+find_package_wrapper(LibEvent REQUIRED)
+
+if(CMAKE_SOURCE_DIR STREQUAL PROJECT_SOURCE_DIR)
+  find_package_wrapper(Libhicnctrl REQUIRED)
+  set(FACE_MGR facemgr)
+else()
+  if (ANDROID_API)
+    set(LIBHICNCTRL_LIBRARIES ${LIBHICN_CTRL_STATIC})
+    list(APPEND DEPENDENCIES
+      ${LIBHICN_CTRL_STATIC}
+    )
+  else ()
+    set(LIBHICNCTRL_LIBRARIES ${LIBHICN_CTRL_SHARED})
+    list(APPEND DEPENDENCIES
+      ${LIBHICN_CTRL_SHARED}
+    )
+  endif ()
+endif()
+
+add_subdirectory(src)
+
+include(Packaging)
+
+if(CMAKE_SOURCE_DIR STREQUAL PROJECT_SOURCE_DIR)
+    include(Packager)
+    make_packages()
+endif()
diff --git a/ctrl/facemgr/README.md b/ctrl/facemgr/README.md
new file mode 100644
index 000000000..e1a1beb4f
--- /dev/null
+++ b/ctrl/facemgr/README.md
@@ -0,0 +1 @@
+# hICN Face Manager
diff --git a/ctrl/facemgr/cmake/Modules/Packaging.cmake b/ctrl/facemgr/cmake/Modules/Packaging.cmake
new file mode 100644
index 000000000..97a1b6260
--- /dev/null
+++ b/ctrl/facemgr/cmake/Modules/Packaging.cmake
@@ -0,0 +1,31 @@
+# Copyright (c) 2017-2019 Cisco and/or its affiliates.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+######################
+# Packages section
+######################
+
+set(${FACE_MGR}_DESCRIPTION
+  "hICN face manager, lib${LIBHICN_CTRL}"
+  CACHE STRING "Description for deb/rpm package."
+)
+
+set(${FACE_MGR}_DEB_DEPENDENCIES
+  "libconfig9, libevent-dev, lib${LIBHICN_CTRL} (>= stable_version)"
+  CACHE STRING "Dependencies for deb/rpm package."
+)
+
+set(${FACE_MGR}_RPM_DEPENDENCIES
+  "libconfig, libevent-devel, lib${LIBHICN_CTRL} >= stable_version"
+  CACHE STRING "Dependencies for deb/rpm package."
+)
diff --git a/ctrl/facemgr/examples/facemgr.conf b/ctrl/facemgr/examples/facemgr.conf
new file mode 100644
index 000000000..54c212c2b
--- /dev/null
+++ b/ctrl/facemgr/examples/facemgr.conf
@@ -0,0 +1,37 @@
+# hICN facemgr configuration file
+
+faces:
+{
+    # A list of interfaces to ignore
+    ignore = ("lo");
+
+    # A list of rules used to assign tags to interfaces
+    # Each rule follows the syntax { name = "NAME"; tags = ("TAG", ...); }
+    # with TAG = WIRED | WIFI | CELLULAR | TRUSTED
+    rules = (
+        {
+            name = "utun1";
+            tags = ("WIRED", "TRUSTED");
+        }
+    );
+
+    overlay = {
+        ipv4 = {
+            local_port = 9695;
+            remote_port = 9695;
+            remote_addr = "10.60.16.14";
+        };
+        ipv6 = {
+            local_port = 9695;
+            remote_port = 9695;
+            remote_addr = "2001:420:44f1:10:20c:29ff:fef3:8f8f";
+        };
+    };
+}
+
+log:
+{
+    log_level = "DEBUG";
+}
+
+
diff --git a/ctrl/facemgr/src/CMakeLists.txt b/ctrl/facemgr/src/CMakeLists.txt
new file mode 100644
index 000000000..e7dbda5c1
--- /dev/null
+++ b/ctrl/facemgr/src/CMakeLists.txt
@@ -0,0 +1,112 @@
+# Copyright (c) 2017-2019 Cisco and/or its affiliates.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+if(UNIX AND NOT APPLE)
+    set(LINUX TRUE)
+endif()
+
+set(COMPILER_DEFINITIONS
+  "-DWITH_POLICY"
+)
+
+set(HEADER_FILES
+#cache.h
+    common.h
+    error.h
+    event.h
+    face.h
+    face_cache.h
+    face_rules.h
+    interface.h
+    interface_map.h
+    interface_ops_map.h
+    util/hash.h
+    util/ip_address.h
+    util/log.h
+    util/map.h
+    util/policy.h
+    util/set.h
+    util/token.h
+    util/types.h
+
+)
+
+set(SOURCE_FILES
+#   cache.c
+    error.c
+    event.c
+    face.c
+    face_cache.c
+    face_rules.c
+    interface.c
+    interface_map.c
+    interface_ops_map.c
+    facemgr.c
+    util/log.c
+    util/policy.c
+)
+
+set(INCLUDE_DIRS
+    ./
+    ../includes/
+    ${CONFIG_INCLUDE_DIR}
+    ${LIBEVENT_INCLUDE_DIR}
+    ${LIBHICNCTRL_INCLUDE_DIRS}
+)
+
+set(LIBRARIES
+    ${CONFIG_LIBRARY}
+    ${LIBEVENT_LIBRARY}
+    ${LIBHICNCTRL_LIBRARIES}
+)
+
+add_subdirectory(interfaces)
+
+if (ANDROID_API)
+    build_library(${FACE_MGR}
+        STATIC
+        SOURCES ${SOURCE_FILES}
+        INSTALL_HEADERS ${TO_INSTALL_HEADER_FILES}
+        DEPENDS ${DEPENDENCIES}
+        COMPONENT ${FACE_MGR}
+        INCLUDE_DIRS ${INCLUDE_DIRS}
+        INSTALL_ROOT_DIR hicn
+        DEFINITIONS ${COMPILER_DEFINITIONS}
+    )
+else ()
+    build_library(${FACE_MGR}
+        STATIC NO_DEV
+        SOURCES ${SOURCE_FILES}
+        INSTALL_HEADERS ${TO_INSTALL_HEADER_FILES}
+        DEPENDS ${DEPENDENCIES}
+        COMPONENT ${FACE_MGR}
+        INCLUDE_DIRS ${INCLUDE_DIRS}
+        INSTALL_ROOT_DIR hicn
+        DEFINITIONS ${COMPILER_DEFINITIONS}
+    )
+endif ()
+
+if(NOT ANDROID_API AND NOT COMPILE_FOR_IOS)
+    list(APPEND DAEMON_SRC
+      main.c
+    )
+
+    build_executable(${FACE_MGR}
+      SOURCES ${DAEMON_SRC}
+      LINK_LIBRARIES ${FACE_MGR}.static ${LIBRARIES}
+      DEPENDS ${FACE_MGR}.static
+      COMPONENT ${FACE_MGR}
+      INCLUDE_DIRS ${INCLUDE_DIRS}
+      DEFINITIONS ${COMPILER_DEFINITIONS}
+    )
+endif ()
diff --git a/ctrl/facemgr/src/cache.c b/ctrl/facemgr/src/cache.c
new file mode 100644
index 000000000..f994d7d37
--- /dev/null
+++ b/ctrl/facemgr/src/cache.c
@@ -0,0 +1,127 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file cache.c
+ * \brief Implementation of face cache.
+ *
+ * The cache is currently implemented as a list so as not to worry about
+ * platform-specific implementations (eg missing functions in BSD libC for
+ * search.h).
+ */
+
+#include <math.h> // log2
+#include <string.h> // memmove
+
+#include "cache.h"
+
+#define FACE_CACHE_MAX_SIZE_LOG_INIT 0
+
+face_cache_t *
+face_cache_create()
+{
+    face_cache_t * face_cache = malloc(sizeof(face_cache_t));
+    if (!face_cache)
+        goto ERR_MALLOC;
+
+    face_cache->max_size_log = FACE_CACHE_MAX_SIZE_LOG_INIT;
+#if(FACE_CACHE_MAX_SIZE_LOG_INIT == 0)
+    face_cache->faces = NULL;
+#else
+    face_cache->faces = malloc((1 << face_cache->max_size_log) * sizeof(face_t*));
+    if (!face_cache->faces)
+        goto ERR_ARRAY:
+#endif
+    face_cache->size = 0;
+
+    return face_cache;
+
+#if(FACE_CACHE_MAX_SIZE_LOG_INIT != 0)
+ERR_ARRAY:
+    free(face_cache);
+#endif
+ERR_MALLOC:
+    return NULL;
+}
+
+void
+face_cache_free(face_cache_t * face_cache)
+{
+    free(face_cache->faces);
+
+    free(face_cache);
+}
+
+face_t *
+face_cache_add(face_cache_t * face_cache, face_t * face)
+{
+    /* Ensure sufficient space for next addition */
+    size_t new_size_log = (face_cache->size > 0) ? log2(face_cache->size) + 1 : 0;
+    if (new_size_log > face_cache->max_size_log) {
+        face_cache->max_size_log = new_size_log;
+        face_cache->faces = realloc(face_cache->faces, (1 << new_size_log) * sizeof(face_t*));
+    }
+
+    if (!face_cache->faces)
+        goto ERR_REALLOC;
+
+    face_cache->faces[face_cache->size++] = face;
+
+    return face;
+
+ERR_REALLOC:
+    return NULL;
+}
+
+int face_cache_search(face_cache_t * face_cache, face_t * face, face_cmp_t face_cmp)
+{
+    for (int i = 0; i < face_cache->size; i++)
+        if (face_cmp(face, face_cache->faces[i]))
+            return i;
+    return -1;
+}
+
+/* Remove a single occurrence */
+face_t *
+face_cache_remove(face_cache_t * face_cache, face_t * face)
+{
+    int pos = face_cache_search(face_cache, face, face_cmp);
+    if (pos < 0)
+        return NULL;
+
+    /* No need to move memory if last item is removed */
+    if (pos < face_cache->size)
+        memmove(face_cache->faces+pos, face_cache->faces+pos+1, face_cache->size - pos);
+
+    face_cache->size--;
+
+    return face;
+}
+
+/* TODO : remove by ... */
+
+face_t *
+face_cache_get_by_id(face_cache_t * face_cache, int id)
+{
+    return NULL;
+}
+
+
+
+void
+face_cache_dump(face_cache_t * face_cache)
+{
+
+}
diff --git a/ctrl/facemgr/src/cache.h b/ctrl/facemgr/src/cache.h
new file mode 100644
index 000000000..1389ed6ec
--- /dev/null
+++ b/ctrl/facemgr/src/cache.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file state.h
+ * \brief Face cache
+ *
+ * The face cache is an index array of faces that mirror the current state of
+ * the forwarder in order to filter out redundant events, and perform set
+ * reconciliation.
+ */
+#ifndef FACEMGR_CACHE_H
+#define FACEMGR_CACHE_H
+
+#include <stdlib.h>
+
+#include "face.h"
+
+/**
+ * \brief Face cache
+ */
+typedef struct {
+    face_t ** faces;     /**< array of _pointers_ to faces */
+    size_t max_size_log; /**< log2 of allocated size */
+    size_t size;         /**< effective array size */
+} face_cache_t;
+
+face_cache_t * face_cache_create();
+void face_cache_free(face_cache_t * face_cache);
+
+/* a la VPP vector, we never create a face outside of the vector */
+/* problem is that face ptr can get invalid if we manipulate the vector */
+face_t * face_cache_get(face_cache_t * cache_cache);
+
+face_t * face_cache_add(face_cache_t * face_cache, face_t * face);
+face_t * face_cache_remove(face_cache_t * face_cache, face_t * face);
+face_t * face_cache_get_by_id(face_cache_t * face_cache, int id);
+
+void face_cache_dump(face_cache_t * face_cache);
+
+#endif /* FACEMGR_CACHE_H */
diff --git a/ctrl/facemgr/src/common.h b/ctrl/facemgr/src/common.h
new file mode 100644
index 000000000..a73964b6d
--- /dev/null
+++ b/ctrl/facemgr/src/common.h
@@ -0,0 +1,94 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file common.h
+ * \file Common definitions used throughout the code
+ */
+#ifndef FACEMGR_COMMON_H
+#define FACEMGR_COMMON_H
+
+#include <stdbool.h>
+#include <stdint.h>
+
+#include "util/types.h"
+#include "util/ip_address.h"
+#include "util/token.h" // XXX debug
+
+//#define DEBUG
+
+/* Return value conventions */
+#define FACEMGR_SUCCESS 0
+#define FACEMGR_FAILURE -1
+#define FACEMGR_IS_ERROR(rc) (rc < 0)
+
+/* Useful types and macros for comparisons */
+typedef int(*cmp_t)(const void * x, const void * y);
+
+#define INT_CMP(x, y) x < y ? -1 : (x == y ? 0 : 1)
+
+/* Dump with indent */
+#define INDENT(n, fmt) "%*s" fmt, n, ""
+#define printfi(n, fmt, ...) printf(INDENT(n*4, fmt), ##__VA_ARGS__)
+
+/* Boilerplate code */
+
+#define NO_INITIALIZE(NAME)                                             \
+int                                                                     \
+NAME ## _initialize(NAME ## _t * obj) {                                 \
+    return FACEMGR_SUCCESS;                                             \
+}
+
+#define NO_FINALIZE(NAME)                                               \
+int                                                                     \
+NAME ## _finalize(NAME ## _t * obj) {                                   \
+    return FACEMGR_SUCCESS;                                             \
+}
+
+#define AUTOGENERATE_CREATE_FREE(NAME)                                  \
+                                                                        \
+NAME ## _t *                                                            \
+NAME ## _create()                                                       \
+{                                                                       \
+    NAME ## _t * obj  = malloc(sizeof(NAME ## _t));                     \
+    if (!obj)                                                           \
+        goto ERR_MALLOC;                                                \
+                                                                        \
+    if (FACEMGR_IS_ERROR(NAME ## _initialize(obj)))                     \
+        goto ERR_INIT;                                                  \
+                                                                        \
+    return obj;                                                         \
+                                                                        \
+ERR_INIT:                                                               \
+    free(obj);                                                          \
+ERR_MALLOC:                                                             \
+    return NULL;                                                        \
+}                                                                       \
+                                                                        \
+void                                                                    \
+NAME ## _free(NAME ## _t * obj)                                         \
+{                                                                       \
+    if (FACEMGR_IS_ERROR(NAME ## _finalize(obj)))                       \
+        (void)0; /* XXX */                                              \
+    free(obj);                                                          \
+}                                                                       \
+
+#define AUTOGENERATE_DEFS(NAME)                                         \
+int NAME ## _initialize(NAME ## _t *);                                  \
+int NAME ## _finalize(NAME ## _t *);                                    \
+NAME ## _t * NAME ## _create();                                         \
+void NAME ## _free(NAME ## _t *);                                       \
+
+#endif /* FACEMGR_COMMON_H */
diff --git a/ctrl/facemgr/src/error.c b/ctrl/facemgr/src/error.c
new file mode 100644
index 000000000..4dcea6e1f
--- /dev/null
+++ b/ctrl/facemgr/src/error.c
@@ -0,0 +1,28 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * @file error.c
+ * @brief Implementation of error management functions.
+ */
+
+#include "error.h"
+
+const char *FACEMGR_ERROR_STRING[] = {
+#define _(a,b,c) [b] = c,
+  foreach_facemgr_error
+#undef _
+};
+
diff --git a/ctrl/facemgr/src/error.h b/ctrl/facemgr/src/error.h
new file mode 100644
index 000000000..a0d76b3e5
--- /dev/null
+++ b/ctrl/facemgr/src/error.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef FACEMGR_ERROR_H
+#define FACEMGR_ERROR_H
+
+#define foreach_facemgr_error                           \
+_(NONE,         0,      "OK")                           \
+
+
+typedef enum {
+#define _(a,b,c) FACEMGR_ERROR_##a = (-b),
+    foreach_facemgr_error
+#undef _
+    FACEMGR_ERROR_N,
+} facemgr_error_t;
+
+extern const char *HICN_LIB_ERROR_STRING[];
+
+#define hicn_strerror(errno) (char *)(HICN_LIB_ERROR_STRING[-errno])
+
+#endif /* FACEMGR_ERROR_H */
diff --git a/ctrl/facemgr/src/event.c b/ctrl/facemgr/src/event.c
new file mode 100644
index 000000000..446c51c22
--- /dev/null
+++ b/ctrl/facemgr/src/event.c
@@ -0,0 +1,39 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file event.h
+ * \brief Implementatino of face events
+ */
+
+#include "common.h"
+#include "event.h"
+#include "interface.h"
+#include "util/token.h"
+
+const char * event_type_str[] = {
+#define _(x) [EVENT_TYPE_ ## x] = STRINGIZE(x),
+foreach_event_type
+#undef _
+};
+
+int
+event_raise(event_type_t type, const face_t * face, const interface_t * interface)
+{
+    event_t event = { .type = type, .face = face };
+    if (interface->callback)
+        interface->callback(interface->callback_data, &event);
+    return FACEMGR_SUCCESS;
+}
diff --git a/ctrl/facemgr/src/event.h b/ctrl/facemgr/src/event.h
new file mode 100644
index 000000000..53295d009
--- /dev/null
+++ b/ctrl/facemgr/src/event.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file event.h
+ * \brief Face event
+ */
+#ifndef FACEMGR_EVENT_H
+#define FACEMGR_EVENT_H
+
+#include "face.h"
+#include "interface.h"
+
+#define foreach_event_type      \
+    _(UNDEFINED)                \
+    _(CREATE)                   \
+    _(UPDATE)                   \
+    _(DELETE)                   \
+    _(SET_PARAMS)               \
+    _(SET_UP)                   \
+    _(SET_DOWN)                 \
+    _(SET_TAGS)                 \
+    _(CLEAR_TAGS)               \
+    _(ADD_TAG)                  \
+    _(REMOVE_TAG)               \
+    _(N)
+
+#define MAXSZ_EVENT_TYPE_ 10
+#define MAXSZ_EVENT_TYPE MAXSZ_EVENT_TYPE_ + 1
+
+typedef enum {
+#define _(x) EVENT_TYPE_ ## x,
+foreach_event_type
+#undef _
+} event_type_t;
+
+extern const char * event_type_str[];
+
+typedef struct event_s {
+    event_type_t type;
+    const face_t * face; /* + bitfield for face fields ? */
+} event_t;
+
+int
+event_raise(event_type_t type, const face_t * face, const interface_t * interface);
+
+#endif /* FACEMGR_EVENT_H */
diff --git a/ctrl/facemgr/src/face.c b/ctrl/facemgr/src/face.c
new file mode 100644
index 000000000..7da255049
--- /dev/null
+++ b/ctrl/facemgr/src/face.c
@@ -0,0 +1,258 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file face.c
+ * \brief Implementation of face abstraction
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "face.h"
+#include "util/hash.h"
+#include "util/token.h"
+
+#define member_size(type, member) sizeof(((type *)0)->member)
+
+
+/* Netdevice */
+
+const char * netdevice_type_str[] = {
+#define _(x) [NETDEVICE_TYPE_ ## x] = STRINGIZE(x),
+foreach_netdevice_type
+#undef _
+};
+
+
+/* Face state */
+
+const char * face_state_str[] = {
+#define _(x) [FACE_STATE_ ## x] = STRINGIZE(x),
+foreach_face_state
+#undef _
+};
+
+
+/* Face type */
+
+const char * face_type_str[] = {
+#define _(x) [FACE_TYPE_ ## x] = STRINGIZE(x),
+foreach_face_type
+#undef _
+};
+
+
+/* Face */
+
+int
+face_initialize(face_t * face)
+{
+    bzero(face, sizeof(face_t)); /* 0'ed for hash */
+    return 1;
+}
+
+int
+face_initialize_udp(face_t * face, const ip_address_t * local_addr,
+        u16 local_port, const ip_address_t * remote_addr, u16 remote_port,
+        int family)
+{
+    if (!local_addr)
+        return -1;
+
+    *face = (face_t) {
+        .type = FACE_TYPE_UDP,
+        .params.tunnel = {
+            .family = family,
+            .local_addr = *local_addr,
+            .local_port = local_port,
+            .remote_addr = remote_addr ? *remote_addr : IP_ADDRESS_EMPTY,
+            .remote_port = remote_port,
+        },
+    };
+    return 1;
+}
+
+int
+face_initialize_udp_sa(face_t * face, const struct sockaddr * local_addr,
+        const struct sockaddr * remote_addr)
+{
+    if (!local_addr)
+        return -1;
+
+    if (remote_addr && (local_addr->sa_family != remote_addr->sa_family))
+        return -1;
+
+    switch (local_addr->sa_family) {
+        case AF_INET:
+            {
+            struct sockaddr_in *lsai = (struct sockaddr_in *)local_addr;
+            struct sockaddr_in *rsai = (struct sockaddr_in *)remote_addr;
+            *face = (face_t) {
+                .type = FACE_TYPE_UDP,
+                .params.tunnel = {
+                    .family = AF_INET,
+                    .local_addr.v4.as_inaddr = lsai->sin_addr,
+                    .local_port = lsai ? ntohs(lsai->sin_port) : 0,
+                    .remote_addr = IP_ADDRESS_EMPTY,
+                    .remote_port = rsai ? ntohs(rsai->sin_port) : 0,
+                },
+            };
+            if (rsai)
+                face->params.tunnel.remote_addr.v4.as_inaddr = rsai->sin_addr;
+            }
+            break;
+        case AF_INET6:
+            {
+            struct sockaddr_in6 *lsai = (struct sockaddr_in6 *)local_addr;
+            struct sockaddr_in6 *rsai = (struct sockaddr_in6 *)remote_addr;
+            *face = (face_t) {
+                .type = FACE_TYPE_UDP,
+                .params.tunnel = {
+                    .family = AF_INET6,
+                    .local_addr.v6.as_in6addr = lsai->sin6_addr,
+                    .local_port = lsai ? ntohs(lsai->sin6_port) : 0,
+                    .remote_addr = IP_ADDRESS_EMPTY,
+                    .remote_port = rsai ? ntohs(rsai->sin6_port) : 0,
+                },
+            };
+            if (rsai)
+                face->params.tunnel.remote_addr.v6.as_in6addr = rsai->sin6_addr;
+            }
+            break;
+        default:
+            return -1;
+    }
+    return 1;
+}
+
+face_t * face_create()
+{
+    face_t * face = calloc(1, sizeof(face_t)); /* 0'ed for hash */
+    return face;
+}
+
+face_t * face_create_udp(const ip_address_t * local_addr, u16 local_port,
+        const ip_address_t * remote_addr, u16 remote_port, int family)
+{
+    face_t * face = face_create();
+    if (face_initialize_udp(face, local_addr, local_port, remote_addr, remote_port, family) < 0)
+        goto ERR_INIT;
+    return face;
+
+ERR_INIT:
+    free(face);
+    return NULL;
+}
+
+face_t * face_create_udp_sa(const struct sockaddr * local_addr,
+        const struct sockaddr * remote_addr)
+{
+    face_t * face = face_create();
+    if (face_initialize_udp_sa(face, local_addr, remote_addr) < 0)
+        goto ERR_INIT;
+    return face;
+
+ERR_INIT:
+    free(face);
+    return NULL;
+}
+
+void face_free(face_t * face)
+{
+    free(face);
+}
+
+#define face_param_cmp(f1, f2, face_param_type)            \
+    memcmp(&f1->type, &f2->type,  \
+            member_size(face_params_t, face_param_type));
+
+/**
+ * \brief Compare two faces
+ * \param [in] f1 - First face
+ * \param [in] f2 - Second face
+ * \return whether faces are equal, ie both their types are parameters are
+ * equal.
+ *
+ * NOTE: this function implements a partial order.
+ */
+int
+face_cmp(const face_t * f1, const face_t * f2)
+{
+    if (f1->type != f2->type)
+        return false;
+
+    switch(f1->type) {
+        case FACE_TYPE_HICN:
+            return face_param_cmp(f1, f2, hicn);
+        case FACE_TYPE_TCP:
+        case FACE_TYPE_UDP:
+            return face_param_cmp(f1, f2, tunnel);
+        default:
+            return false;
+    }
+}
+
+hash_t
+face_hash(const face_t * face)
+{
+    /* Assuming the unused part of the struct is set to zero */
+    return hash_struct(face);
+}
+
+/* /!\ Please update constants in header file upon changes */
+size_t
+face_snprintf(char * s, size_t size, const face_t * face)
+{
+    switch(face->type) {
+        case FACE_TYPE_HICN:
+            return 0; // XXX Not implemented
+        case FACE_TYPE_TCP:
+        case FACE_TYPE_UDP:
+            {
+                char local[MAXSZ_IP_ADDRESS];
+                char remote[MAXSZ_IP_ADDRESS];
+                char tags[MAXSZ_POLICY_TAGS];
+
+                ip_address_snprintf(local, MAXSZ_IP_ADDRESS,
+                        &face->params.tunnel.local_addr,
+                        face->params.tunnel.family);
+                ip_address_snprintf(remote, MAXSZ_IP_ADDRESS,
+                        &face->params.tunnel.remote_addr,
+                        face->params.tunnel.family);
+                policy_tags_snprintf(tags, MAXSZ_POLICY_TAGS, face->tags);
+
+                return snprintf(s, size, "%s [%s:%d -> %s:%d] [%s]",
+                        face_type_str[face->type],
+                        local,
+                        face->params.tunnel.local_port,
+                        remote,
+                        face->params.tunnel.remote_port,
+                        tags);
+            }
+            break;
+        default:
+            return 0;
+    }
+
+}
+
+int
+face_set_tags(face_t * face, policy_tags_t tags)
+{
+    face->tags = tags;
+    return 1;
+}
diff --git a/ctrl/facemgr/src/face.h b/ctrl/facemgr/src/face.h
new file mode 100644
index 000000000..8b553f685
--- /dev/null
+++ b/ctrl/facemgr/src/face.h
@@ -0,0 +1,177 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file face.h
+ * \brief Face abstraction
+ */
+#ifndef HICN_FACE_H
+#define HICN_FACE_H
+
+#ifndef SPACES
+#define SPACES(x) x
+#endif
+#ifndef SPACE
+#define SPACE 1
+#endif
+#ifndef NULLTERM
+#define NULLTERM 1
+#endif
+
+#include "util/ip_address.h"
+#include "util/policy.h"
+#include "util/types.h"
+
+
+/* Netdevice type */
+
+#include <net/if.h> // IFNAMSIZ
+
+#define foreach_netdevice_type  \
+    _(UNDEFINED)                \
+    _(WIRED)                    \
+    _(WIFI)                     \
+    _(CELLULAR)                 \
+    _(VPN)                      \
+    _(N)
+
+#define MAXSZ_NETDEVICE_TYPE_ 9
+#define MAXSZ_NETDEVICE_TYPE MAXSZ_NETDEVICE_TYPE_ + NULLTERM
+
+typedef enum {
+#define _(x) NETDEVICE_TYPE_ ## x,
+foreach_netdevice_type
+#undef _
+} netdevice_type_t;
+
+extern const char * netdevice_type_str[];
+
+
+/* Netdevice */
+
+typedef struct {
+    u32 index;
+    char name[IFNAMSIZ];
+} netdevice_t;
+
+#define NETDEVICE_UNDEFINED_INDEX 0
+
+/* Face state */
+
+#define foreach_face_state      \
+    _(UNDEFINED)                \
+    _(PENDING_UP)               \
+    _(UP)                       \
+    _(PENDING_DOWN)             \
+    _(DOWN)                     \
+    _(ERROR)                    \
+    _(N)
+
+#define MAXSZ_FACE_STATE_ 12
+#define MAXSZ_FACE_STATE MAXSZ_FACE_STATE_ + 1
+
+typedef enum {
+#define _(x) FACE_STATE_ ## x,
+foreach_face_state
+#undef _
+} face_state_t;
+
+extern const char * face_state_str[];
+
+
+/* Face type */
+
+#define foreach_face_type       \
+    _(UNDEFINED)                \
+    _(HICN)                     \
+    _(HICN_LISTENER)            \
+    _(TCP)                      \
+    _(TCP_LISTENER)             \
+    _(UDP)                      \
+    _(UDP_LISTENER)             \
+    _(N)
+
+#define MAXSZ_FACE_TYPE_ 13
+#define MAXSZ_FACE_TYPE MAXSZ_FACE_TYPE_  + 1
+
+typedef enum {
+#define _(x) FACE_TYPE_ ## x,
+foreach_face_type
+#undef _
+} face_type_t;
+
+extern const char * face_type_str[];
+
+#define MAXSZ_FACE_ MAXSZ_FACE_TYPE_ + 2 * MAXSZ_IP_ADDRESS_ + 2 * MAXSZ_PORT_ + 9 + MAXSZ_POLICY_TAGS_
+#define MAXSZ_FACE MAXSZ_FACE_ + 1
+
+/* Face */
+
+typedef union {
+    int family; /* To access family independently of face type */
+    struct {
+        int family;
+        netdevice_t netdevice;
+        ip_address_t local_addr;
+        ip_address_t remote_addr;
+    } hicn;
+    struct {
+        int family;
+        ip_address_t local_addr;
+        u16 local_port;
+        ip_address_t remote_addr;
+        u16 remote_port;
+    } tunnel;
+} face_params_t;
+
+typedef struct {
+    face_type_t type;
+    face_params_t params;
+    face_state_t admin_state;
+    face_state_t state;
+#ifdef WITH_POLICY
+    policy_tags_t tags; /**< \see policy_tag_t */
+#endif /* WITH_POLICY */
+} face_t;
+
+int face_initialize(face_t * face);
+int face_initialize_udp(face_t * face, const ip_address_t * local_addr,
+        u16 local_port, const ip_address_t * remote_addr, u16 remote_port,
+        int family);
+int face_initialize_udp_sa(face_t * face,
+        const struct sockaddr * local_addr, const struct sockaddr * remote_addr);
+
+face_t * face_create();
+face_t * face_create_udp(const ip_address_t * local_addr, u16 local_port,
+        const ip_address_t * remote_addr, u16 remote_port, int family);
+face_t * face_create_udp_sa(const struct sockaddr * local_addr,
+        const struct sockaddr * remote_addr);
+
+int face_finalize(face_t * face);
+
+void face_free(face_t * face);
+
+typedef int (*face_cmp_t)(const face_t * f1, const face_t * f2);
+
+int face_cmp(const face_t * f1, const face_t * f2);
+hash_t face_hash(const face_t * face);
+
+size_t
+face_snprintf(char * s, size_t size, const face_t * face);
+
+int face_set_tags(face_t * face, policy_tags_t tags);
+
+#endif /* HICN_FACE_H */
+
diff --git a/ctrl/facemgr/src/face_cache.c b/ctrl/facemgr/src/face_cache.c
new file mode 100644
index 000000000..bee36af30
--- /dev/null
+++ b/ctrl/facemgr/src/face_cache.c
@@ -0,0 +1,21 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "face_cache.h"
+
+#include "face.h"
+#include "util/set.h"
+
+TYPEDEF_SET(face_cache, face_t *, face_cmp, face_snprintf);
diff --git a/ctrl/facemgr/src/face_cache.h b/ctrl/facemgr/src/face_cache.h
new file mode 100644
index 000000000..caefb7e22
--- /dev/null
+++ b/ctrl/facemgr/src/face_cache.h
@@ -0,0 +1,24 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef FACE_CACHE_H
+#define FACE_CACHE_H
+
+#include "face.h"
+#include "util/set.h"
+
+TYPEDEF_SET_H(face_cache, face_t *);
+
+#endif /* FACE_CACHE_H */
diff --git a/ctrl/facemgr/src/face_rules.c b/ctrl/facemgr/src/face_rules.c
new file mode 100644
index 000000000..ddefc15f9
--- /dev/null
+++ b/ctrl/facemgr/src/face_rules.c
@@ -0,0 +1,21 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "face_rules.h"
+
+#include <string.h>
+#include "util/policy.h"
+
+TYPEDEF_MAP(face_rules, const char *, policy_tags_t, strcmp, string_snprintf, policy_tags_snprintf);
diff --git a/ctrl/facemgr/src/face_rules.h b/ctrl/facemgr/src/face_rules.h
new file mode 100644
index 000000000..28f5391a0
--- /dev/null
+++ b/ctrl/facemgr/src/face_rules.h
@@ -0,0 +1,31 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef FACE_RULES_H
+#define FACE_RULES_H
+
+#include "util/map.h"
+#include "util/policy.h"
+
+/*
+ * Face creation rules
+ *
+ * For now, face creations rules are very simple and consist in a map between
+ * the physical interface name, and the associated list of tags that will
+ * preempt those assigned by the system.
+ */
+TYPEDEF_MAP_H(face_rules, const char *, policy_tags_t);
+
+#endif /* FACE_RULES_H */
diff --git a/ctrl/facemgr/src/facemgr.c b/ctrl/facemgr/src/facemgr.c
new file mode 100644
index 000000000..41e30de56
--- /dev/null
+++ b/ctrl/facemgr/src/facemgr.c
@@ -0,0 +1,298 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file facemgr.c
+ * \brief Implementation of Face manager library interface
+ */
+
+#include <stdio.h>
+
+#include "common.h"
+#include "event.h"
+#include "facemgr.h"
+#include "interface.h"
+#include "util/log.h"
+
+#ifdef __APPLE__
+extern interface_ops_t network_framework_ops;
+#endif
+#ifdef __linux__
+extern interface_ops_t netlink_ops;
+#endif
+#if 0
+extern interface_ops_t dummy_ops;
+#endif
+extern interface_ops_t hicn_light_ops;
+
+int
+facemgr_initialize(facemgr_t * facemgr)
+{
+    int rc;
+
+    rc = interface_map_initialize(&facemgr->interface_map);
+    if (FACEMGR_IS_ERROR(rc))
+        goto ERR_INTERFACE_MAP;
+
+    rc = face_cache_initialize(&facemgr->face_cache);
+    if (FACEMGR_IS_ERROR(rc))
+        goto ERR_FACE_SET;
+
+    rc = face_rules_initialize(&facemgr->rules);
+    if (FACEMGR_IS_ERROR(rc))
+        goto ERR_FACE_SET;
+
+    return FACEMGR_SUCCESS;
+
+ERR_FACE_SET:
+    interface_map_finalize(&facemgr->interface_map);
+
+ERR_INTERFACE_MAP:
+    return FACEMGR_FAILURE;
+}
+
+int
+facemgr_finalize(facemgr_t * facemgr)
+{
+    int rc;
+
+    /* XXX Free all interfaces: pass free to map */
+    rc = interface_map_finalize(&facemgr->interface_map);
+    if (FACEMGR_IS_ERROR(rc))
+        goto ERR;
+
+    rc = face_cache_finalize(&facemgr->face_cache);
+    if (FACEMGR_IS_ERROR(rc))
+        goto ERR;
+
+    rc = face_rules_finalize(&facemgr->rules);
+    if (FACEMGR_IS_ERROR(rc))
+        goto ERR;
+
+    return FACEMGR_SUCCESS;
+
+ERR:
+    return FACEMGR_FAILURE;
+}
+
+AUTOGENERATE_CREATE_FREE(facemgr);
+
+int
+facemgr_on_event(facemgr_t * facemgr, event_t * event)
+{
+    int rc;
+    char face_s[MAXSZ_FACE];
+    face_t * cached_face;
+
+    if (!event->face) {
+        printf("Event with empty face\n");
+        return -1;
+    }
+
+    face_t face = *event->face;
+
+    /* Complement unbound UDP faces */
+    switch(face.type) {
+        case FACE_TYPE_TCP:
+        case FACE_TYPE_UDP:
+            switch (face.params.tunnel.family) {
+                case AF_INET:
+                    if ((ip_address_empty(&face.params.tunnel.remote_addr)) &&
+                            (!ip_address_empty(&facemgr->overlay_v4_remote_addr)))
+                        face.params.tunnel.remote_addr = facemgr->overlay_v4_remote_addr;
+                    if ((face.params.tunnel.local_port == 0) && (facemgr->overlay_v4_local_port != 0))
+                        face.params.tunnel.local_port = facemgr->overlay_v4_local_port;
+                    if ((face.params.tunnel.remote_port == 0) && (facemgr->overlay_v4_remote_port != 0))
+                        face.params.tunnel.remote_port = facemgr->overlay_v4_remote_port;
+                    break;
+                case AF_INET6:
+                    if ((ip_address_empty(&face.params.tunnel.remote_addr)) &&
+                            (!ip_address_empty(&facemgr->overlay_v6_remote_addr)))
+                        face.params.tunnel.remote_addr = facemgr->overlay_v6_remote_addr;
+                    if ((face.params.tunnel.local_port == 0) && (facemgr->overlay_v6_local_port != 0))
+                        face.params.tunnel.local_port = facemgr->overlay_v6_local_port;
+                    if ((face.params.tunnel.remote_port == 0) && (facemgr->overlay_v6_remote_port != 0))
+                        face.params.tunnel.remote_port = facemgr->overlay_v6_remote_port;
+                default:
+                    break;
+            }
+            break;
+        default:
+            break;
+    }
+
+    face_snprintf(face_s, MAXSZ_FACE, &face);
+
+    /* TODO Here, we need to filter events based on our cache, and update the cache
+     * based on our actions if they are successful */
+
+    switch(event->type) {
+        case EVENT_TYPE_CREATE:
+            rc = face_cache_get(&facemgr->face_cache, &face, &cached_face);
+            if (!FACEMGR_IS_ERROR(rc)) {
+                DEBUG("Face found in cache");
+                goto IGNORE_EVENT;
+            }
+            rc = face_cache_add(&facemgr->face_cache, &face);
+            if (FACEMGR_IS_ERROR(rc))
+                WARN("Failed to add face to cache");
+            break;
+        case EVENT_TYPE_DELETE:
+            rc = face_cache_remove(&facemgr->face_cache, &face, &cached_face);
+            if (FACEMGR_IS_ERROR(rc))
+                WARN("Face not found in cache");
+            break;
+        case EVENT_TYPE_SET_UP:
+        case EVENT_TYPE_SET_DOWN:
+            /* TODO We need a return code to update the cache */
+            break;
+        default:
+            printf("Not implemented!\n");
+            break;
+    }
+
+    /* Process event */
+    printf("[ FACE %s ] %s\n", event_type_str[event->type], face_s);
+    /* Hardcoded hicn-light */
+    rc = interface_on_event(facemgr->hl, event);
+    if (FACEMGR_IS_ERROR(rc))
+        goto ERR;
+
+IGNORE_EVENT:
+    return FACEMGR_SUCCESS;
+
+ERR:
+    return FACEMGR_FAILURE;
+}
+
+#ifdef __linux__
+void interface_callback(evutil_socket_t fd, short what, void * arg) {
+    interface_t * interface = (interface_t *)arg;
+    interface->ops->callback(interface);
+}
+#endif /* __linux__ */
+
+int
+facemgr_create_interface(facemgr_t * facemgr, const char * name, const char * type, interface_t ** interface)
+{
+    int fd, rc;
+
+    INFO("Creating interface %s [%s]...\n", name, type);
+    *interface = interface_create(name, type);
+    if (!*interface) {
+        ERROR("Error creating interface %s [%s]\n", name, type);
+        return -1;
+    }
+    interface_set_callback(*interface, facemgr_on_event, facemgr);
+
+    fd = interface_initialize(*interface, &facemgr->rules);
+    if (fd < 0)
+        return -2;
+    if (fd != 0) {
+#ifdef __linux__
+        evutil_make_socket_nonblocking(fd);
+        struct event * event = event_new(facemgr->loop, fd, EV_READ | EV_PERSIST, interface_callback, *interface);
+        if (!event) {
+            return -3;
+        }
+
+        if (event_add(event, NULL) < 0) {
+            return -4;
+        }
+#else
+        ERROR("Not implemented\n");
+        return FACEMGR_FAILURE;
+#endif /* __linux__ */
+    }
+
+    rc = interface_map_add(&facemgr->interface_map, (*interface)->name, *interface);
+    if (FACEMGR_IS_ERROR(rc))
+        return -5;
+
+    DEBUG("Interface created successfully.\n");
+    return FACEMGR_SUCCESS;
+}
+
+int
+facemgr_bootstrap(facemgr_t * facemgr)
+{
+    int rc;
+
+    DEBUG("Registering interfaces...");
+    rc = interface_register(&hicn_light_ops);
+    if (FACEMGR_IS_ERROR(rc)) {
+        ERROR("Could not register interfaces");
+        goto ERR_REGISTER;
+    }
+
+#ifdef __APPLE__
+    rc = interface_register(&network_framework_ops);
+    if (FACEMGR_IS_ERROR(rc))
+        goto ERR_REGISTER;
+#endif /* __APPLE__ */
+
+#ifdef __linux__
+    rc = interface_register(&netlink_ops);
+    if (FACEMGR_IS_ERROR(rc))
+        goto ERR_REGISTER;
+#endif /* __linux__ */
+
+#if 0
+    rc = interface_register(&dummy_ops);
+    if (FACEMGR_IS_ERROR(rc))
+        goto ERR_REGISTER;
+#endif
+
+    rc = facemgr_create_interface(facemgr, "hl", "hicn_light", &facemgr->hl);
+    if (rc < 0) {
+        ERROR("Error creating 'hICN forwarder (hicn-light)' interface\n");
+        goto ERR_HL_CREATE;
+    }
+
+#ifdef __APPLE__
+    rc = facemgr_create_interface(facemgr, "nf", "network_framework", &facemgr->nf);
+    if (rc < 0) {
+        ERROR("Error creating 'Apple Network Framework' interface\n");
+        goto ERR_NF_CREATE;
+    }
+#endif /* __APPLE__ */
+
+#ifdef __linux__
+    rc = facemgr_create_interface(facemgr, "nl", "netlink", &facemgr->nl);
+    if (rc < 0) {
+        ERROR("Error creating 'Netlink' interface\n");
+        goto ERR_NF_CREATE;
+    }
+#endif /* __linux__ */
+
+#if 0
+    rc = facemgr_create_interface(facemgr, "dummy", "dummy", &facemgr->dummy);
+    if (rc < 0) {
+        ERROR("Error creating 'Dummy' interface\n");
+        goto ERR_NF_CREATE;
+    }
+#endif
+
+    DEBUG("Facemgr successfully initialized...");
+
+    return FACEMGR_SUCCESS;
+
+ERR_NF_CREATE:
+    interface_free(facemgr->hl);
+ERR_HL_CREATE:
+    //interface_map_remove(&facemgr->interface_map, data->nf->name);
+ERR_REGISTER:
+    return FACEMGR_FAILURE;
+}
diff --git a/ctrl/facemgr/src/facemgr.h b/ctrl/facemgr/src/facemgr.h
new file mode 100644
index 000000000..6505a1bd8
--- /dev/null
+++ b/ctrl/facemgr/src/facemgr.h
@@ -0,0 +1,77 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file facemgr.h
+ * \brief Face manager library interface
+ */
+#ifndef FACEMGR_H
+#define FACEMGR_H
+
+#include <string.h>
+#include "common.h"
+#include "face.h"
+#include "face_cache.h"
+#include "face_rules.h"
+#include "interface.h"
+#include "interface_map.h"
+#include "util/ip_address.h"
+#include "util/map.h"
+#include "util/policy.h"
+#ifndef __APPLE__
+#include <event2/event.h>
+#endif /* __APPLE__ */
+
+/*
+ * \brief Face manager context
+ */
+typedef struct {
+#ifndef APPLE
+    /* Event loop */
+    struct event_base * loop;
+#endif /* APPLE */
+
+    interface_map_t interface_map;
+    interface_t * hl;
+
+#ifdef __APPLE__
+    interface_t * nf;
+#endif /* __APPLE__ */
+
+#ifdef __linux__
+    interface_t * nl;
+#endif /* __linux__ */
+
+#if 0
+    interface_t * dummy;
+#endif
+
+    /* Overlay management */
+    uint16_t overlay_v4_local_port;
+    ip_address_t overlay_v4_remote_addr;
+    uint16_t overlay_v4_remote_port;
+    uint16_t overlay_v6_local_port;
+    ip_address_t overlay_v6_remote_addr;
+    uint16_t overlay_v6_remote_port;
+
+    face_rules_t rules;
+    face_cache_t face_cache;
+} facemgr_t;
+
+AUTOGENERATE_DEFS(facemgr);
+
+int facemgr_bootstrap(facemgr_t * facemgr);
+
+#endif /* FACEMGR_H */
diff --git a/ctrl/facemgr/src/interface.c b/ctrl/facemgr/src/interface.c
new file mode 100644
index 000000000..af9f666a7
--- /dev/null
+++ b/ctrl/facemgr/src/interface.c
@@ -0,0 +1,104 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file interface.c
+ * \brief Implementation of interface base class.
+ */
+
+#include <stdlib.h>
+#include <string.h>
+#include "event.h"
+#include "face_rules.h"
+#include "interface.h"
+#include "interface_ops_map.h"
+#include "util/map.h"
+
+static interface_ops_map_t * interface_ops_map = NULL;
+
+int
+interface_register(const interface_ops_t * ops)
+{
+    if (!interface_ops_map) {
+        interface_ops_map = interface_ops_map_create();
+        if (!interface_ops_map)
+            return FACEMGR_FAILURE;
+    }
+    interface_ops_map_add(interface_ops_map, ops->type, ops);
+    return FACEMGR_SUCCESS;
+}
+
+interface_t *
+interface_create(const char * name, const char * type)
+{
+
+    interface_ops_t * ops;
+    int rc = interface_ops_map_get(interface_ops_map, type, &ops);
+    if (FACEMGR_IS_ERROR(rc)) {
+        printf("Interface type not found %s\n", type);
+        return NULL;
+    }
+
+    interface_t * interface = malloc(sizeof(interface_t));
+    if (!interface)
+        return NULL;
+
+    interface->name = strdup(name);
+    /* this should use type */
+    interface->ops = ops;
+    interface->callback = NULL;
+    interface->callback_data = NULL;
+    interface->data = NULL;
+
+    return interface;
+}
+
+void
+interface_free(interface_t * interface)
+{
+    free(interface->name);
+    free(interface);
+}
+
+void
+_interface_set_callback(interface_t * interface, callback_t callback, void * callback_data)
+{
+    interface->callback = callback;
+    interface->callback_data = callback_data;
+}
+
+int
+interface_initialize(interface_t * interface, struct face_rules_s * rules)
+{
+    if (!interface->ops->initialize)
+        return FACEMGR_FAILURE;
+    return interface->ops->initialize(interface, rules, &interface->data);
+}
+
+int
+interface_finalize(interface_t * interface)
+{
+    if (!interface->ops->finalize)
+        return FACEMGR_FAILURE;
+    return interface->ops->finalize(interface);
+}
+
+int
+interface_on_event(interface_t * interface, const event_t * event)
+{
+    if (!interface->ops->on_event)
+        return FACEMGR_FAILURE;
+    return interface->ops->on_event(interface, event);
+}
diff --git a/ctrl/facemgr/src/interface.h b/ctrl/facemgr/src/interface.h
new file mode 100644
index 000000000..f38313182
--- /dev/null
+++ b/ctrl/facemgr/src/interface.h
@@ -0,0 +1,98 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file interface.h
+ * \brief Interface base class
+ *
+ * Interfaces are the priviledged way to extend the functionalities of the face
+ * manager. They both provide input and/or output functionality to allow for
+ * several components to interoperate, respectively by raising/receiving events
+ * about changes in the underlying network.
+ *
+ * All communication happens through base operations (create, delete, etc.) over
+ * a generic face abstraction.
+ */
+#ifndef FACEMGR_INTERFACE_H
+#define FACEMGR_INTERFACE_H
+
+#include <stdbool.h>
+
+struct event_s;
+typedef int (*callback_t)(struct event_s * event, void * callback_data);
+
+struct interface_s;
+struct face_rules_s;
+
+/**
+ * \brief Interface operations
+ */
+typedef struct {
+    char * type;
+    bool is_singleton;
+    int (*initialize)(struct interface_s * interface, struct face_rules_s * rules, void ** pdata);
+    int (*finalize)(struct interface_s * interface);
+    int (*callback)(struct interface_s * interface);
+    int (*on_event)(struct interface_s * interface, const struct event_s * event);
+} interface_ops_t;
+
+typedef struct interface_s {
+    char * name;
+    interface_ops_t * ops;
+    callback_t callback;
+    void * callback_data;
+    void * data;
+} interface_t;
+
+/**
+ * \brief Registers a new interface type
+ * \param [in] ops - Virtual function table representing the interface
+ *     operations.
+ * \return Flag indicating the success (FACEMGR_SUCCESS=0), or failure (any
+ *     other value) of the operation.
+ */
+int interface_register(const interface_ops_t * ops);
+
+/**
+ * \brief Create a new instance of an interface of a given type.
+ * \param [in] name - Name of the newly create interface instance.
+ * \param [in] type - Name of the interface type to create.
+ * \return A a pointer to the newly created instance of the requested type, or
+ *     NULL in case of failure.
+ */
+interface_t * interface_create(const char * name, const char * type);
+
+/**
+ * \brief Free an interface instance.
+ * \param [in] interface - Pointer to the instance to free.
+ */
+void interface_free(interface_t * interface);
+
+/**
+ * This function is equivalent to interface_set_callback, which should be
+ * preferred. The difference is the lack of explicit type casts which should
+ * simplify the calling syntax.
+ */
+
+void _interface_set_callback(interface_t * interface, callback_t callback, void * callback_data);
+#define interface_set_callback(interface, callback, callback_data) \
+    _interface_set_callback(interface, (callback_t)callback, (void*)callback_data)
+
+int interface_initialize(interface_t * interface, struct face_rules_s * rules);
+int interface_finalize(interface_t * interface);
+
+int interface_on_event(interface_t * interface, const struct event_s * event);
+
+#endif /* FACEMGR_INTERFACE_H */
diff --git a/ctrl/facemgr/src/interface_map.c b/ctrl/facemgr/src/interface_map.c
new file mode 100644
index 000000000..9f7c20cab
--- /dev/null
+++ b/ctrl/facemgr/src/interface_map.c
@@ -0,0 +1,21 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "interface_map.h"
+
+#include <string.h>
+#include "interface.h"
+
+TYPEDEF_MAP(interface_map, const char *, interface_t *, strcmp, string_snprintf, generic_snprintf);
diff --git a/ctrl/facemgr/src/interface_map.h b/ctrl/facemgr/src/interface_map.h
new file mode 100644
index 000000000..5930b3001
--- /dev/null
+++ b/ctrl/facemgr/src/interface_map.h
@@ -0,0 +1,24 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef INTERFACE_MAP_H
+#define INTERFACE_MAP_H
+
+#include "interface.h"
+#include "util/map.h"
+
+TYPEDEF_MAP_H(interface_map, const char *, interface_t *);
+
+#endif /* INTERFACE_MAP_H */
diff --git a/ctrl/facemgr/src/interface_ops_map.c b/ctrl/facemgr/src/interface_ops_map.c
new file mode 100644
index 000000000..373f5d22f
--- /dev/null
+++ b/ctrl/facemgr/src/interface_ops_map.c
@@ -0,0 +1,21 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "interface_ops_map.h"
+
+#include <string.h>
+#include "util/map.h"
+
+TYPEDEF_MAP(interface_ops_map, const char *, interface_ops_t *, strcmp, string_snprintf, generic_snprintf);
diff --git a/ctrl/facemgr/src/interface_ops_map.h b/ctrl/facemgr/src/interface_ops_map.h
new file mode 100644
index 000000000..2d590390a
--- /dev/null
+++ b/ctrl/facemgr/src/interface_ops_map.h
@@ -0,0 +1,24 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef INTERFACE_OPS_MAP_H
+#define INTERFACE_OPS_MAP_H
+
+#include "interface.h"
+#include "util/map.h"
+
+TYPEDEF_MAP_H(interface_ops_map, const char *, interface_ops_t *);
+
+#endif /* INTERFACE_OPS_MAP_H */
diff --git a/ctrl/facemgr/src/interfaces/CMakeLists.txt b/ctrl/facemgr/src/interfaces/CMakeLists.txt
new file mode 100644
index 000000000..e5a26177a
--- /dev/null
+++ b/ctrl/facemgr/src/interfaces/CMakeLists.txt
@@ -0,0 +1,36 @@
+# Copyright (c) 2017-2019 Cisco and/or its affiliates.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+list(APPEND HEADER_FILES)
+list(APPEND SOURCE_FILES)
+list(APPEND INCLUDE_DIRS)
+list(APPEND LIBRARIES)
+
+add_subdirectory(hicn_light)
+
+if(APPLE)
+add_subdirectory(network_framework)
+endif()
+
+if(LINUX)
+add_subdirectory(netlink)
+endif()
+
+if(false)
+add_subdirectory(dummy)
+endif()
+
+set(SOURCE_FILES ${SOURCE_FILES} PARENT_SCOPE)
+set(HEADER_FILES ${HEADER_FILES} PARENT_SCOPE)
+set(INCLUDE_DIRS ${INCLUDE_DIRS} PARENT_SCOPE)
+set(LIBRARIES    ${LIBRARIES}    PARENT_SCOPE)
diff --git a/ctrl/facemgr/src/interfaces/dummy/CMakeLists.txt b/ctrl/facemgr/src/interfaces/dummy/CMakeLists.txt
new file mode 100644
index 000000000..1af3b4b2a
--- /dev/null
+++ b/ctrl/facemgr/src/interfaces/dummy/CMakeLists.txt
@@ -0,0 +1,30 @@
+# Copyright (c) 2017-2019 Cisco and/or its affiliates.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+list(APPEND HEADER_FILES
+)
+
+list(APPEND SOURCE_FILES
+    ${CMAKE_CURRENT_SOURCE_DIR}/dummy.c
+)
+
+list(APPEND INCLUDE_DIRS
+)
+
+list(APPEND LIBRARIES
+)
+
+set(SOURCE_FILES ${SOURCE_FILES} PARENT_SCOPE)
+set(HEADER_FILES ${HEADER_FILES} PARENT_SCOPE)
+set(INCLUDE_DIRS ${INCLUDE_DIRS} PARENT_SCOPE)
+set(LIBRARIES    ${LIBRARIES}    PARENT_SCOPE)
diff --git a/ctrl/facemgr/src/interfaces/dummy/dummy.c b/ctrl/facemgr/src/interfaces/dummy/dummy.c
new file mode 100644
index 000000000..b0c558388
--- /dev/null
+++ b/ctrl/facemgr/src/interfaces/dummy/dummy.c
@@ -0,0 +1,49 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file dummy.c
+ * \brief Implementation of Dummy interface
+ */
+
+#include <stdlib.h>
+
+#include "../../interface.h"
+#include "../../common.h"
+#include "../../event.h"
+#include "../../face.h"
+#include "../../facemgr.h"
+
+#define DEFAULT_PORT 9695
+
+int dummy_initialize(interface_t * interface, face_rules_t * rules, void **pdata) {
+    ip_address_t local = IPV4_LOOPBACK;
+    ip_address_t remote = IPV4_LOOPBACK;
+    face_t * face = face_create_udp(&local, DEFAULT_PORT, &remote, DEFAULT_PORT, AF_INET);
+    event_raise(EVENT_TYPE_CREATE, face, interface);
+    return FACEMGR_SUCCESS;
+}
+
+int dummy_finalize(interface_t * interface) {
+    return FACEMGR_SUCCESS;
+}
+
+interface_ops_t dummy_ops = {
+    .type = "dummy",
+    .is_singleton = true,
+    .initialize = dummy_initialize,
+    .finalize = dummy_finalize,
+    .on_event = NULL,
+};
diff --git a/ctrl/facemgr/src/interfaces/hicn_light/CMakeLists.txt b/ctrl/facemgr/src/interfaces/hicn_light/CMakeLists.txt
new file mode 100644
index 000000000..ef839a69c
--- /dev/null
+++ b/ctrl/facemgr/src/interfaces/hicn_light/CMakeLists.txt
@@ -0,0 +1,33 @@
+# Copyright (c) 2017-2019 Cisco and/or its affiliates.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+list(APPEND HEADER_FILES
+)
+
+list(APPEND SOURCE_FILES
+    ${CMAKE_CURRENT_SOURCE_DIR}/hicn_light.c
+)
+
+list(APPEND LIBRARIES
+    ${HICNCTRL_LIBRARIES}
+)
+
+
+list(APPEND INCLUDE_DIRS
+    ${HICNCTRL_INCLUDE_DIR}
+)
+
+set(SOURCE_FILES ${SOURCE_FILES} PARENT_SCOPE)
+set(HEADER_FILES ${HEADER_FILES} PARENT_SCOPE)
+set(INCLUDE_DIRS ${INCLUDE_DIRS} PARENT_SCOPE)
+set(LIBRARIES    ${LIBRARIES}    PARENT_SCOPE)
diff --git a/ctrl/facemgr/src/interfaces/hicn_light/hicn_light.c b/ctrl/facemgr/src/interfaces/hicn_light/hicn_light.c
new file mode 100644
index 000000000..85694573d
--- /dev/null
+++ b/ctrl/facemgr/src/interfaces/hicn_light/hicn_light.c
@@ -0,0 +1,222 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file interfaces/hicn_light/hicn_light.c
+ * \brief hICN light interface
+ */
+#include <stdbool.h>
+#include <stdlib.h> // arc4random [random, rand]
+#include <stdio.h> // snprintf
+#include <time.h> // time
+
+#include <hicn/ctrl.h>
+
+#include "../../facemgr.h"
+#include "../../interface.h"
+#include "../../util/ip_address.h"
+#include "../../util/log.h"
+#include "../../util/map.h"
+#include "../../event.h"
+
+#define DEFAULT_ROUTE_COST 0
+
+typedef struct {
+    hc_sock_t * s;
+    bool busy;
+} hl_data_t;
+
+int hl_initialize(interface_t * interface, face_rules_t * rules, void ** pdata)
+{
+    hl_data_t * data = malloc(sizeof(hl_data_t));
+    if (!data) {
+        ERROR("[hicn_light] Out of memory!");
+        goto ERR_MALLOC;
+    }
+
+    data->s = hc_sock_create();
+    if (data->s <= 0) {
+        ERROR("[hicn_light] Could not create control socket");
+        goto ERR_SOCK;
+    }
+
+    if (hc_sock_connect(data->s) < 0) {
+        ERROR("[hicn_light] Could not connect control socket");
+        goto ERR_CONNECT;
+    }
+
+    data->busy = false;
+
+    *pdata = data;
+
+    return FACEMGR_SUCCESS;
+
+ERR_CONNECT:
+    hc_sock_free(data->s);
+ERR_SOCK:
+    free(data);
+ERR_MALLOC:
+    return FACEMGR_FAILURE;
+}
+
+int hl_finalize(interface_t * interface)
+{
+    //hc_data_t * data = interface->data;
+    //hc_sock_close(data->s);
+    return FACEMGR_SUCCESS;
+}
+
+int hl_on_event(interface_t * interface, const event_t * event)
+{
+    hc_face_t face;
+    hc_route_t route;
+    int rc;
+    hl_data_t * data = (hl_data_t *)interface->data;
+
+    /* XXX We need  a queue or a socket pool to process concurrent events */
+    if (data->busy) {
+        ERROR("[hicn_light] Busy !");
+        return FACEMGR_FAILURE;
+    }
+
+    switch(event->type) {
+        case EVENT_TYPE_CREATE:
+
+            /* Create face */
+            face.face = *event->face;
+            rc = hc_face_create(data->s, &face);
+            if (rc < 0) {
+                ERROR("Failed to create face\n");
+                goto ERR;
+            }
+            DEBUG("Created face id=%d\n", face.id);
+
+#if 0
+            /* Add default route v4 */
+            route = (hc_route_t) {
+                .face_id = face.id,
+                .family = AF_INET,
+                .remote_addr = IPV4_ANY,
+                .len = 0,
+                .cost = DEFAULT_ROUTE_COST,
+
+            };
+            if (hc_route_create(data->s, &route) < 0) {
+                ERROR("Failed to create default hICN/IPv4 route");
+                goto ERR;
+            }
+            INFO("Successfully created default hICN/IPv4 route.");
+#endif
+
+#if 0
+            route = (hc_route_t) {
+                .face_id = face.id,
+                .family = AF_INET6,
+                .remote_addr = IPV6_ANY,
+                .len = 0,
+                .cost = DEFAULT_ROUTE_COST,
+            };
+            if (hc_route_create(data->s, &route) < 0) {
+                ERROR("Failed to create default hICN/IPv6 route");
+                goto ERR;
+            }
+#endif
+
+#if 1
+            /* We add routes based on face tags */
+
+            if (policy_tags_has(event->face->tags, POLICY_TAG_TRUSTED)) {
+                route = (hc_route_t) {
+                    .face_id = face.id,
+                    .family = AF_INET6,
+                    .len = 16,
+                    .cost = DEFAULT_ROUTE_COST,
+                };
+                if (ip_address_pton("b001::", &route.remote_addr) < 0) {
+                    ERROR("Failed to convert prefix");
+                    goto ERR;
+                }
+                if (hc_route_create(data->s, &route) < 0) {
+                    ERROR("Failed to create hICN/IPv6 route");
+                    goto ERR;
+                }
+
+                route = (hc_route_t) {
+                    .face_id = face.id,
+                    .family = AF_INET6,
+                    .len = 16,
+                    .cost = DEFAULT_ROUTE_COST,
+                };
+                if (ip_address_pton("d001::", &route.remote_addr) < 0) {
+                    ERROR("Failed to convert prefix");
+                    goto ERR;
+                }
+                if (hc_route_create(data->s, &route) < 0) {
+                    ERROR("Failed to create hICN/IPv6 route");
+                    goto ERR;
+                }
+
+            } else {
+
+                route = (hc_route_t) {
+                    .face_id = face.id,
+                    .family = AF_INET6,
+                    .len = 16,
+                    .cost = DEFAULT_ROUTE_COST,
+                };
+                if (ip_address_pton("c001::", &route.remote_addr) < 0) {
+                    ERROR("Failed to convert prefix");
+                    goto ERR;
+                }
+                if (hc_route_create(data->s, &route) < 0) {
+                    ERROR("Failed to create hICN/IPv6 route");
+                    goto ERR;
+                }
+            }
+#endif
+
+            break;
+
+        case EVENT_TYPE_DELETE:
+            /* Removing a face should also remove associated routes */
+            /* Create face */
+            face.face = *event->face;
+            rc = hc_face_delete(data->s, &face);
+            if (rc < 0) {
+                ERROR("Failed to delete face\n");
+                goto ERR;
+            }
+            INFO("Deleted face id=%d\n", face.id);
+            break;
+
+        default:
+            ERROR("Unknown event %s\n", event_type_str[event->type]);
+            /* Unsupported events */
+            goto ERR;
+    }
+
+    return FACEMGR_SUCCESS;
+
+ERR:
+    return FACEMGR_FAILURE;
+}
+
+const interface_ops_t hicn_light_ops = {
+    .type = "hicn_light",
+    .is_singleton = false,
+    .initialize = hl_initialize,
+    .finalize = hl_finalize,
+    .on_event = hl_on_event,
+};
diff --git a/ctrl/facemgr/src/interfaces/netlink/CMakeLists.txt b/ctrl/facemgr/src/interfaces/netlink/CMakeLists.txt
new file mode 100644
index 000000000..7f44d87fe
--- /dev/null
+++ b/ctrl/facemgr/src/interfaces/netlink/CMakeLists.txt
@@ -0,0 +1,30 @@
+# Copyright (c) 2017-2019 Cisco and/or its affiliates.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+list(APPEND HEADER_FILES
+)
+
+list(APPEND SOURCE_FILES
+    ${CMAKE_CURRENT_SOURCE_DIR}/netlink.c
+)
+
+list(APPEND LIBRARIES
+)
+
+list(APPEND INCLUDE_DIRS
+)
+
+set(SOURCE_FILES ${SOURCE_FILES} PARENT_SCOPE)
+set(HEADER_FILES ${HEADER_FILES} PARENT_SCOPE)
+set(INCLUDE_DIRS ${INCLUDE_DIRS} PARENT_SCOPE)
+set(LIBRARIES    ${LIBRARIES}    PARENT_SCOPE)
diff --git a/ctrl/facemgr/src/interfaces/netlink/netlink.c b/ctrl/facemgr/src/interfaces/netlink/netlink.c
new file mode 100644
index 000000000..5bf0baf9f
--- /dev/null
+++ b/ctrl/facemgr/src/interfaces/netlink/netlink.c
@@ -0,0 +1,254 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file interfaces/netlink/netlink.c
+ * \brief Netlink interface
+ */
+
+#include <linux/rtnetlink.h>
+#include <sys/types.h> // getpid
+#include <unistd.h> // getpid
+
+#include "../../event.h"
+#include "../../facemgr.h"
+#include "../../interface.h"
+
+/* Internal data storage */
+typedef struct {
+    int fd;
+} nl_data_t;
+
+// little helper to parsing message using netlink macroses
+void parseRtattr(struct rtattr *tb[], int max, struct rtattr *rta, int len)
+{
+    memset(tb, 0, sizeof(struct rtattr *) * (max + 1));
+
+    while (RTA_OK(rta, len)) {  // while not end of the message
+        if (rta->rta_type <= max) {
+            tb[rta->rta_type] = rta; // read attr
+        }
+        rta = RTA_NEXT(rta,len);    // get next attr
+    }
+}
+
+
+int nl_initialize(interface_t * interface, face_rules_t * rules, void ** pdata)
+{
+    nl_data_t * data = malloc(sizeof(nl_data_t));
+    if (!data)
+        goto ERR_MALLOC;
+
+    data->fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
+    if (data->fd < 0) {
+        printf("Failed to create netlink socket: %s\n", (char*)strerror(errno));
+        goto ERR_SOCKET;
+    }
+
+    struct sockaddr_nl  local;  // local addr struct
+    memset(&local, 0, sizeof(local));
+    local.nl_family = AF_NETLINK;       // set protocol family
+    local.nl_groups = RTMGRP_LINK | RTMGRP_IPV4_IFADDR | RTMGRP_IPV4_ROUTE;   // set groups we interested in
+    local.nl_pid = getpid();    // set out id using current process id
+
+
+    if (bind(data->fd, (struct sockaddr*)&local, sizeof(local)) < 0) {     // bind socket
+        printf("Failed to bind netlink socket: %s\n", (char*)strerror(errno));
+        goto ERR_BIND;
+    }
+
+    /* Issue a first query to receive static state */
+
+
+    *pdata = data;
+    return data->fd; // FACEMGR_SUCCESS;
+
+ERR_BIND:
+    close(data->fd);
+ERR_SOCKET:
+    free(data);
+ERR_MALLOC:
+    *pdata = NULL;
+    return FACEMGR_FAILURE;
+}
+
+int nl_callback(interface_t * interface)
+{
+    nl_data_t * data = (nl_data_t*)interface->data;
+
+    struct sockaddr_nl  local;  // local addr struct
+    memset(&local, 0, sizeof(local));
+
+    char buf[8192];             // message buffer
+    struct iovec iov;           // message structure
+    iov.iov_base = buf;         // set message buffer as io
+    iov.iov_len = sizeof(buf);  // set size
+
+    // initialize protocol message header
+    struct msghdr msg;
+    {
+        msg.msg_name = &local;                  // local address
+        msg.msg_namelen = sizeof(local);        // address size
+        msg.msg_iov = &iov;                     // io vector
+        msg.msg_iovlen = 1;                     // io size
+    }
+
+    ssize_t status = recvmsg(data->fd, &msg, 0);
+
+    //  check status
+    if (status < 0) {
+/*
+        if (errno == EINTR || errno == EAGAIN)
+            continue;
+*/
+
+        printf("Failed to read netlink: %s", (char*)strerror(errno));
+        return FACEMGR_FAILURE;
+    }
+
+    if (msg.msg_namelen != sizeof(local)) { // check message length, just in case
+        printf("Invalid length of the sender address struct\n");
+        return FACEMGR_FAILURE;
+    }
+
+    // message parser
+    struct nlmsghdr *h;
+
+    for (h = (struct nlmsghdr*)buf; status >= (ssize_t)sizeof(*h); ) {   // read all messagess headers
+        int len = h->nlmsg_len;
+        int l = len - sizeof(*h);
+        char *ifName = NULL;
+
+        if ((l < 0) || (len > status)) {
+            printf("Invalid message length: %i\n", len);
+            continue;
+        }
+
+        // now we can check message type
+        if ((h->nlmsg_type == RTM_NEWROUTE) || (h->nlmsg_type == RTM_DELROUTE)) { // some changes in routing table
+            printf("Routing table was changed\n");
+        } else {    // in other case we need to go deeper
+            char *ifUpp;
+            char *ifRunn;
+            struct ifinfomsg *ifi;  // structure for network interface info
+            struct rtattr *tb[IFLA_MAX + 1];
+
+            ifi = (struct ifinfomsg*) NLMSG_DATA(h);    // get information about changed network interface
+
+            parseRtattr(tb, IFLA_MAX, IFLA_RTA(ifi), h->nlmsg_len);  // get attributes
+
+            if (tb[IFLA_IFNAME]) {  // validation
+                ifName = (char*)RTA_DATA(tb[IFLA_IFNAME]); // get network interface name
+            }
+
+            if (ifi->ifi_flags & IFF_UP) { // get UP flag of the network interface
+                ifUpp = (char*)"UP";
+            } else {
+                ifUpp = (char*)"DOWN";
+            }
+
+            if (ifi->ifi_flags & IFF_RUNNING) { // get RUNNING flag of the network interface
+                ifRunn = (char*)"RUNNING";
+            } else {
+                ifRunn = (char*)"NOT RUNNING";
+            }
+
+            char ifAddress[256] = {0};    // network addr
+            struct ifaddrmsg *ifa; // structure for network interface data
+            struct rtattr *tba[IFA_MAX+1];
+
+            ifa = (struct ifaddrmsg*)NLMSG_DATA(h); // get data from the network interface
+
+            parseRtattr(tba, IFA_MAX, IFA_RTA(ifa), h->nlmsg_len);
+
+            if (tba[IFA_LOCAL]) {
+                inet_ntop(AF_INET, RTA_DATA(tba[IFA_LOCAL]), ifAddress, sizeof(ifAddress)); // get IP addr
+            }
+
+            face_t * face;
+
+            if (tba[IFA_LOCAL]) {
+                ip_address_t local_addr = IP_ADDRESS_EMPTY;
+                switch(ifa->ifa_family) {
+                    case AF_INET:
+                        local_addr.v4.as_inaddr = *(struct in_addr*)RTA_DATA(tba[IFA_LOCAL]);
+                        break;
+                    case AF_INET6:
+                        local_addr.v6.as_in6addr = *(struct in6_addr*)RTA_DATA(tba[IFA_LOCAL]);
+                        break;
+                    default:
+                        continue;
+                }
+                face = face_create_udp(&local_addr, 0, &IP_ADDRESS_EMPTY, 0, ifa->ifa_family);
+            } else {
+                face = NULL;
+            }
+
+            switch (h->nlmsg_type) {
+                case RTM_DELADDR:
+                    // DOES NOT SEEM TO BE TRIGGERED
+                    printf("Interface %s: address was removed\n", ifName);
+                    if (face)
+                        event_raise(EVENT_TYPE_DELETE, face, interface);
+                    break;
+
+                case RTM_DELLINK:
+                    printf("Network interface %s was removed\n", ifName);
+                    break;
+
+                case RTM_NEWLINK:
+                    printf("New network interface %s, state: %s %s\n", ifName, ifUpp, ifRunn);
+                    // UP RUNNING
+                    // UP NOT RUNNING
+                    // DOWN NOT RUNNING
+                    if (!(ifi->ifi_flags & IFF_UP) || (!(ifi->ifi_flags & IFF_RUNNING))) {
+                        if(face)
+                            event_raise(EVENT_TYPE_DELETE, face, interface);
+                    }
+                    break;
+
+                case RTM_NEWADDR:
+                    printf("Interface %s: new address was assigned: %s\n", ifName, ifAddress);
+                    printf("NEW FACE\n");
+                    if (face)
+                        event_raise(EVENT_TYPE_CREATE, face, interface);
+                    break;
+            }
+        }
+
+        status -= NLMSG_ALIGN(len); // align offsets by the message length, this is important
+
+        h = (struct nlmsghdr*)((char*)h + NLMSG_ALIGN(len));    // get next message
+    }
+
+    return FACEMGR_SUCCESS;
+}
+
+int nl_finalize(interface_t * interface)
+{
+    nl_data_t * data = (nl_data_t*)interface->data;
+    close(data->fd);
+    return FACEMGR_SUCCESS;
+
+}
+
+const interface_ops_t netlink_ops = {
+    .type = "netlink",
+    .is_singleton = true,
+    .initialize = nl_initialize,
+    .callback = nl_callback,
+    .finalize = nl_finalize,
+    .on_event = NULL,
+};
diff --git a/ctrl/facemgr/src/interfaces/network_framework/CMakeLists.txt b/ctrl/facemgr/src/interfaces/network_framework/CMakeLists.txt
new file mode 100644
index 000000000..ca6659342
--- /dev/null
+++ b/ctrl/facemgr/src/interfaces/network_framework/CMakeLists.txt
@@ -0,0 +1,36 @@
+# Copyright (c) 2017-2019 Cisco and/or its affiliates.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+find_library(NETWORK_LIBRARY Network)
+if (NOT NETWORK_LIBRARY)
+    message(FATAL_ERROR "NetworkFramework not found")
+endif()
+
+list(APPEND HEADER_FILES
+)
+
+list(APPEND SOURCE_FILES
+    ${CMAKE_CURRENT_SOURCE_DIR}/network_framework.c
+)
+
+list(APPEND INCLUDE_DIRS
+)
+
+list(APPEND LIBRARIES
+    ${NETWORK_LIBRARY}
+)
+
+set(SOURCE_FILES ${SOURCE_FILES} PARENT_SCOPE)
+set(HEADER_FILES ${HEADER_FILES} PARENT_SCOPE)
+set(INCLUDE_DIRS ${INCLUDE_DIRS} PARENT_SCOPE)
+set(LIBRARIES    ${LIBRARIES}    PARENT_SCOPE)
diff --git a/ctrl/facemgr/src/interfaces/network_framework/network_framework.c b/ctrl/facemgr/src/interfaces/network_framework/network_framework.c
new file mode 100644
index 000000000..8a33129b4
--- /dev/null
+++ b/ctrl/facemgr/src/interfaces/network_framework/network_framework.c
@@ -0,0 +1,581 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file network_framework.c
+ * \brief Implementation of Network framework interface
+ */
+
+#include <sys/socket.h>
+#include <arpa/inet.h>
+
+#include <Network/Network.h>
+#include <err.h>
+
+#include "../../common.h"
+#include "../../event.h"
+#include "../../face.h"
+#include "../../facemgr.h"
+#include "../../interface.h"
+#include "../../util/map.h"
+#include "../../util/token.h"
+#include "../../util/log.h"
+
+/*
+ * Bonjour service discovery for hICN forwarder
+ *
+ * Possible values for BONJOUR_PROTOCOL:
+ *      udp (default) : avoid potential handshake during connection setup.
+ *      tcp
+ *
+ * Service advertisement / discovery on MacOSX
+ *
+ *      dns-sd -R hicn _hicn._tcp local 9695
+ *      dns-sd -R hicn _hicn._udp local 9695
+ *
+ *      dns-sd -B _hicn._tcp local
+ *      dns-sd -B _hicn._udp local
+ *
+ * Service discovery on Linux (various useful commandline arguments):
+ *
+ *      avahi-browse -pt _hicn._udp
+ *      avahi-browse -rp _hicn._tcp
+ */
+
+#define BONJOUR_PROTOCOL udp
+#define BONJOUR_SERVICE_DOMAIN "local"
+#define BONJOUR_SERVICE_NAME "hicn"
+
+/* Generated variables */
+#define BONJOUR_SERVICE_TYPE "_hicn._" STRINGIZE(BONJOUR_PROTOCOL)
+#define BONJOUR_PROTOCOL_NAME STRINGIZE(BONJOUR_PROTOCOL)
+#define nw_parameters_create_fn PPCAT(nw_parameters_create_secure_, BONJOUR_PROTOCOL)
+
+#define DEFAULT_PORT 9695
+
+typedef enum {
+    INTERFACE_TYPE_OTHER,
+    INTERFACE_TYPE_WIFI,
+    INTERFACE_TYPE_CELLULAR,
+    INTERFACE_TYPE_WIRED,
+    INTERFACE_TYPE_LOOPBACK,
+} _nw_interface_type_t;
+
+const char * interface_type_str[] = {
+    "OTHER", "WIFI", "CELLULAR", "WIRED", "LOOPBACK",
+};
+
+#if 0
+typedef enum {
+    PATH_STATUS_INVALID,
+    PATH_STATUS_SATISTIED,
+    PATH_STATUS_UNSATISFIED,
+    PATH_STATUS_SATISFIABLE,
+} _nw_path_status_t;
+#endif
+
+const char * path_status_str[] = {
+    "INVALID", "SATISFIED", "UNSATISFIED", "SATISFIABLE",
+};
+
+const char * endpoint_type_str[] = {
+    "INVALID", "ADDRESS", "HOST", "BONJOUR",
+};
+
+const char * connection_state_str[] = {
+    "INVALID", "WAITING", "PREPARING", "READY", "FAILED", "CANCELLED",
+};
+
+int
+cmp_iface(const nw_interface_t iface1, const nw_interface_t iface2)
+{
+    return INT_CMP(nw_interface_get_index(iface1), nw_interface_get_index(iface2));
+}
+
+//TYPEDEF_MAP(map_cnx, nw_interface_t, nw_connection_t, cmp_iface);
+
+typedef struct {
+    face_rules_t * rules; /**< Face creation rules */
+    nw_path_monitor_t pm; /**< Main path monitor */
+//    map_cnx_t map_cnx;    /**< Map: interface -> connection for face status */
+} nf_data_t;
+
+void
+dump_interface(nw_interface_t interface, int indent)
+{
+    uint32_t index = nw_interface_get_index(interface);
+    const char * name = nw_interface_get_name(interface);
+    nw_interface_type_t type = nw_interface_get_type(interface);
+
+    printfi(indent+1, "%d: %s [%s]\n", index, name, interface_type_str[type]);
+}
+
+void
+dump_endpoint(nw_endpoint_t endpoint, int indent)
+{
+    if (!endpoint) {
+        printfi(indent, "N/A\n");
+        return;
+    }
+
+    nw_endpoint_type_t endpoint_type = nw_endpoint_get_type(endpoint);
+    const char * hostname = nw_endpoint_get_hostname(endpoint);
+    short port = nw_endpoint_get_port(endpoint);
+    const struct sockaddr * address = nw_endpoint_get_address(endpoint);
+
+    printfi(indent, "Type: %s\n", endpoint_type_str[endpoint_type]);
+    printfi(indent, "Hostname: %s\n", hostname);
+    printfi(indent, "Port: %d\n", port);
+
+    if (address) {
+        char *s = NULL;
+        switch(address->sa_family) {
+            case AF_INET: {
+                              struct sockaddr_in *addr_in = (struct sockaddr_in *)address;
+                              s = malloc(INET_ADDRSTRLEN);
+                              inet_ntop(AF_INET, &(addr_in->sin_addr), s, INET_ADDRSTRLEN);
+                              break;
+                          }
+            case AF_INET6: {
+                               struct sockaddr_in6 *addr_in6 = (struct sockaddr_in6 *)address;
+                               s = malloc(INET6_ADDRSTRLEN);
+                               inet_ntop(AF_INET6, &(addr_in6->sin6_addr), s, INET6_ADDRSTRLEN);
+                               break;
+                           }
+            default:
+                           break;
+        }
+        printfi(indent, "IP address: %s\n", s);
+        free(s);
+    }
+}
+
+void
+dump_path(nw_path_t path, int indent)
+{
+    /* nw_path_enumerate_interfaces : not interesting */
+    nw_path_status_t path_status = nw_path_get_status(path);
+    printfi(indent, "Status: %s\n", path_status_str[path_status]);
+    printfi(indent, "Expensive: %s\n", nw_path_is_expensive(path) ? "true" : "false");
+    printfi(indent, "IPv4 enabled: %s\n", nw_path_has_ipv4(path) ? "true" : "false");
+    printfi(indent, "IPv6 enabled: %s\n", nw_path_has_ipv6(path) ? "true" : "false");
+    printfi(indent, "DNS: %s\n", nw_path_has_dns(path) ? "true" : "false");
+    printfi(indent, "Interfaces:\n");
+    nw_path_enumerate_interfaces(path, (nw_path_enumerate_interfaces_block_t)^(nw_interface_t interface) {
+        dump_interface(interface, indent+1);
+        return true;
+    });
+
+    nw_endpoint_t local = nw_path_copy_effective_local_endpoint(path);
+    printfi(indent, "Effective local endpoint:\n");
+    dump_endpoint(local, indent+1);
+    nw_release(local);
+
+    nw_endpoint_t remote = nw_path_copy_effective_remote_endpoint(path);
+    printfi(indent, "Effective remote endpoint:\n");
+    dump_endpoint(remote, indent+1);
+    nw_release(remote);
+}
+
+void
+dump_connection(nw_connection_t connection, int indent)
+{
+    nw_endpoint_t remote = nw_connection_copy_endpoint(connection);
+    nw_path_t path = nw_connection_copy_current_path(connection);
+
+    printfi(indent, "Remote endpoint:\n");
+    dump_endpoint(remote, indent+1);
+    printfi(indent, "Path:\n");
+    dump_path(path, indent+1);
+
+    /*
+    nw_connection_copy_protocol_metadata();
+    nw_connection_get_maximum_datagram_size();
+    */
+
+    nw_release(remote);
+    nw_release(path);
+}
+
+face_t *
+face_create_from_connection(nw_connection_t connection, face_rules_t * rules)
+{
+    face_t * face;
+    struct sockaddr_in * sin;
+    struct sockaddr_in6 * sin6;
+
+    nw_path_t path = nw_connection_copy_current_path(connection);
+    nw_endpoint_t local = nw_path_copy_effective_local_endpoint(path);
+    nw_endpoint_t remote = nw_path_copy_effective_remote_endpoint(path);
+    __block nw_interface_t interface;
+
+    const struct sockaddr * local_addr = nw_endpoint_get_address(local);
+    const struct sockaddr * remote_addr = nw_endpoint_get_address(remote);
+
+    assert (local_addr->sa_family == remote_addr->sa_family);
+    switch(local_addr->sa_family) {
+        case AF_INET:
+            sin = (struct sockaddr_in *)local_addr;
+            sin->sin_port = htons(DEFAULT_PORT);
+            sin = (struct sockaddr_in *)remote_addr;
+            sin->sin_port = htons(DEFAULT_PORT);
+            break;
+        case AF_INET6:
+            sin6 = (struct sockaddr_in6 *)local_addr;
+            sin6->sin6_port = htons(DEFAULT_PORT);
+            sin6 = (struct sockaddr_in6 *)remote_addr;
+            sin6->sin6_port = htons(DEFAULT_PORT);
+            break;
+        default:
+            ERROR("Unsupported address family: %d\n", local_addr->sa_family);
+            return NULL;
+    }
+
+    face = face_create_udp_sa(local_addr, remote_addr);
+
+    /* Retrieving path interface type (a single one expected */
+    nw_path_enumerate_interfaces(path, (nw_path_enumerate_interfaces_block_t)^(nw_interface_t path_interface) {
+        interface = path_interface;
+        return false;
+    });
+    nw_interface_type_t type = nw_interface_get_type(interface);
+    const char * name = nw_interface_get_name(interface);
+
+    policy_tags_t tags = POLICY_TAGS_EMPTY;
+
+    if (rules) {
+        if (!FACEMGR_IS_ERROR(face_rules_get(rules, name, &tags)))
+            goto SET_TAGS;
+
+        char tags[MAXSZ_POLICY_TAGS];
+        policy_tags_snprintf(tags, MAXSZ_POLICY_TAGS, face->tags);
+    }
+
+    switch(type) {
+        case INTERFACE_TYPE_OTHER:
+            policy_tags_add(&tags, POLICY_TAG_WIFI);
+            policy_tags_add(&tags, POLICY_TAG_TRUSTED);
+            break;
+        case INTERFACE_TYPE_WIFI:
+            // XXX disambuiguate on interface name for now.
+            policy_tags_add(&tags, POLICY_TAG_WIFI);
+            policy_tags_add(&tags, POLICY_TAG_TRUSTED);
+            break;
+        case INTERFACE_TYPE_CELLULAR:
+            policy_tags_add(&tags, POLICY_TAG_CELLULAR);
+            break;
+        case INTERFACE_TYPE_WIRED:
+            /* Both VPN and USB WiFi are not well detected on MacOS. For USB
+             * WiFi, we currently have no solution. For VPN, until we have
+             * proper support of AnyC APIs, we need to have heuristics to
+             * determine VPN interfaces. */
+            policy_tags_add(&tags, POLICY_TAG_WIRED);
+            policy_tags_add(&tags, POLICY_TAG_TRUSTED);
+            break;
+        case INTERFACE_TYPE_LOOPBACK:
+            tags = POLICY_TAGS_EMPTY;
+            break;
+        default:
+            break;
+
+    }
+
+SET_TAGS:
+    face_set_tags(face, tags);
+
+    nw_release(local);
+    nw_release(remote);
+    nw_release(path);
+
+    return face;
+}
+
+void
+on_connection_state_event(interface_t * interface, nw_interface_t iface,
+        nw_connection_t cnx, nw_connection_state_t state, nw_error_t error)
+{
+#if 0
+    DEBUG("Connection [new state = %s]:\n", connection_state_str[state]);
+    nw_path_t path = nw_connection_copy_current_path(cnx);
+    nw_path_enumerate_interfaces(path, (nw_path_enumerate_interfaces_block_t)^(nw_interface_t interface) {
+        const char * name = nw_interface_get_name(interface);
+        printf("NAME=%s\n", name);
+        return true;
+    });
+#endif
+
+    /* We should get enough information to create the face and set if up
+     * asap */
+
+    nw_endpoint_t remote = nw_connection_copy_endpoint(cnx);
+    errno = error ? nw_error_get_error_code(error) : 0;
+
+    switch(state) {
+        case nw_connection_state_waiting:
+            warn("connect to %s port %u (%s) failed, is waiting",
+                    nw_endpoint_get_hostname(remote),
+                    nw_endpoint_get_port(remote),
+                    BONJOUR_PROTOCOL_NAME);
+            break;
+
+        case nw_connection_state_preparing:
+            break;
+
+        case nw_connection_state_ready:
+            {
+#if 0
+            WITH_DEBUG({
+                dump_connection(cnx, 1);
+            });
+#endif
+            nf_data_t * data = (nf_data_t*)interface->data;
+            face_t * face = face_create_from_connection(cnx, data->rules);
+            event_raise(EVENT_TYPE_CREATE, face, interface);
+            break;
+            }
+        case nw_connection_state_failed:
+            /* Can we fail with bonjour, or are we always waiting ? */
+            warn("connect to %s port %u (%s) failed",
+                    nw_endpoint_get_hostname(remote),
+                    nw_endpoint_get_port(remote),
+                    BONJOUR_PROTOCOL_NAME);
+            break;
+
+        case nw_connection_state_cancelled:
+            // Release the primary reference on the connection
+            // that was taken at creation time
+            nw_release(cnx);
+            break;
+
+        default: /* nw_connection_state_invalid */
+            /* Should never be called */
+            break;
+
+    }
+
+    nw_release(remote);
+
+}
+
+void
+on_connection_path_event(interface_t * interface, nw_interface_t iface,
+        nw_connection_t cnx, nw_path_t path)
+{
+#if 0
+    DEBUG("Connection [path changed]:\n");
+    WITH_DEBUG({
+        //dump_connection(cnx, 1);
+    });
+#endif
+    /* redundant *//*
+    DEBUG(1, "Path:\n");
+    dump_path(path, 2);
+    */
+}
+
+/**
+ * Enumerate main path interfaces
+ *
+ * We need to create specific dummy connections for each newly discovered
+ * interface
+ *
+ * Currently we only use Bonjour/TCP for remote hICN discovery and connection
+ * path monitoring.
+ */
+void on_interface_event(interface_t * interface, nw_interface_t iface)
+{
+    /* We can create an hICN face on this interface that will be down until
+     * connected
+     * It is however possible to have two default gateways on the same
+     * interface, or more, or even zero. Somehow we need a strategy, timers, etc
+     * to properly do the job.
+     *
+     * We have to determine:
+     *  - how many faces to build
+     *  - the face type : hICN, tunnel (TCP/UDP)
+     *  - the underlying protocol : v4, v6
+     *
+     * This depends on the configuration, end host and network capabilities.
+     *
+     * We can rely on several types of discovery:
+     *  - DHCP
+     *  - Bonjour
+     *  - ...
+     *
+     * So far:
+     * - bonjour discovery attempt, we expect to discover one hICN interface
+     *   (how bonjour works with more than one is unclear), after a certain
+     *   time, if none is discovered, we cannot do any tunnel face.
+     */
+
+    nw_endpoint_t endpoint;
+
+    endpoint = nw_endpoint_create_bonjour_service(
+            BONJOUR_SERVICE_NAME,
+            BONJOUR_SERVICE_TYPE,
+            BONJOUR_SERVICE_DOMAIN);
+
+    if (!endpoint)
+        goto ERR;
+
+    /* nw_parameters_create_secure_{udp,tcp} */
+    nw_parameters_t parameters = nw_parameters_create_fn(
+                NW_PARAMETERS_DISABLE_PROTOCOL, /* no (d)tls */
+                NW_PARAMETERS_DEFAULT_CONFIGURATION /* default udp/tcp */);
+
+    if (!parameters)
+        goto ERR;
+
+    nw_parameters_require_interface(parameters, iface);
+    nw_parameters_set_reuse_local_address(parameters, true);
+
+    nw_connection_t connection = nw_connection_create(endpoint, parameters);
+    if (!connection)
+        goto ERR;
+
+    nw_release(endpoint);
+    nw_release(parameters);
+
+    /* Remember not to recreate connection */
+    // XXX TODO
+
+    /* Setup connection handlers */
+
+    nw_connection_set_state_changed_handler(connection, ^(nw_connection_state_t state, nw_error_t error) {
+        on_connection_state_event(interface, iface, connection, state, error);
+    });
+
+    nw_connection_set_path_changed_handler(connection, ^(nw_path_t path) {
+        on_connection_path_event(interface, iface, connection, path);
+    });
+
+    nw_connection_set_better_path_available_handler(connection, ^(bool value) {
+#if 0
+        DEBUG("Connection [better path = %s]\n", (value ? "true" : "false"));
+        WITH_DEBUG({
+            dump_connection(connection, 1);
+        });
+#endif
+    });
+
+    nw_connection_set_viability_changed_handler(connection, ^(bool value) {
+#if 0
+        DEBUG("Connection [viable = %s]\n", (value ? "true" : "false"));
+        WITH_DEBUG({
+            //dump_connection(connection, 1);
+        });
+#endif
+
+        /*
+         * This is the first time we have a connection with address and port
+         * and thus the full identification of an hICN face
+         */
+        nf_data_t * data = (nf_data_t*)interface->data;
+        face_t * face = face_create_from_connection(connection, data->rules);
+        //event_raise(value ? EVENT_TYPE_SET_UP : EVENT_TYPE_SET_DOWN, face, interface);
+        if(value) {
+            event_raise(EVENT_TYPE_CREATE, face, interface);
+        } else {
+            event_raise(EVENT_TYPE_DELETE, face, interface);
+        }
+
+    });
+
+    nw_connection_start(connection);
+
+    nw_connection_set_queue(connection, dispatch_get_main_queue());
+    nw_retain(connection); // Hold a reference until cancelled
+
+#if 0
+    DEBUG("Created Bonjour cnx on interface:\n");
+    WITH_DEBUG({
+        dump_interface(iface, 1);
+    });
+#endif
+
+ERR:
+    return;
+}
+
+void on_path_event(interface_t * interface, nw_path_t path)
+{
+    /* Simplification: we handle path event only once.
+     * Ideally, test whether we discover new interfaces or not
+     */
+#if 0
+    DEBUG("Path [event]:\n");
+    WITH_DEBUG({
+        dump_path(path, 1);
+    });
+#endif
+
+    nw_path_enumerate_interfaces(path, (nw_path_enumerate_interfaces_block_t)^(nw_interface_t iface) {
+            on_interface_event(interface, iface);
+            return true;
+    });
+
+}
+
+int nf_initialize(interface_t * interface, face_rules_t * rules, void ** pdata)
+{
+    nf_data_t * data = malloc(sizeof(nf_data_t));
+    if (!data)
+        goto ERR_MALLOC;
+
+    data->rules = rules;
+
+    data->pm = nw_path_monitor_create();
+    if (!data->pm)
+        goto ERR_PM;
+
+    nw_path_monitor_set_queue(data->pm, dispatch_get_main_queue());
+    nw_path_monitor_set_cancel_handler(data->pm, ^() { });
+    nw_path_monitor_set_update_handler(data->pm, ^(nw_path_t path) {
+            on_path_event(interface, path);
+            });
+
+    // XXX NEEDED ?
+    nw_retain(data->pm);
+
+    DEBUG("Starting network path monitor");
+    nw_path_monitor_start(data->pm);
+
+    *pdata = data;
+    return FACEMGR_SUCCESS;
+
+ERR_PM:
+    free(data);
+ERR_MALLOC:
+    *pdata = NULL;
+    return FACEMGR_FAILURE;
+}
+
+int nf_finalize(interface_t * interface)
+{
+    nf_data_t * data = (nf_data_t*)interface->data;
+    if (data->pm) {
+        nw_path_monitor_cancel(data->pm);
+        data->pm = NULL;
+    }
+    return FACEMGR_SUCCESS;
+}
+
+const interface_ops_t network_framework_ops = {
+    .type = "network_framework",
+    .is_singleton = true,
+    .initialize = nf_initialize,
+    .finalize = nf_finalize,
+    .on_event = NULL,
+};
diff --git a/ctrl/facemgr/src/main.c b/ctrl/facemgr/src/main.c
new file mode 100644
index 000000000..6a80d806b
--- /dev/null
+++ b/ctrl/facemgr/src/main.c
@@ -0,0 +1,349 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file main.c
+ * \brief Face manager daemon entry point
+ */
+
+#include <getopt.h>
+#include <limits.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h> // faccess
+
+#include <libconfig.h>
+
+#include "util/log.h"
+#include "util/policy.h"
+
+#ifdef __APPLE__
+#include <Dispatch/Dispatch.h>
+#else
+// Note: we might want to use libevent on Apple too
+#include <event2/event.h>
+#endif
+
+#include "facemgr.h"
+
+#define FACEMGR_TIMEOUT 3
+
+
+static struct option long_options[] =
+{
+    {"config",  required_argument, 0, 'c'},
+    {0, 0, 0, 0}
+};
+
+typedef struct {
+    char * cfgfile;
+} facemgr_options_t;
+
+static const char * DEFAULT_CFGFILES[] = {
+    "/etc/facemgr.conf",
+    "~/facemgr.conf",
+};
+
+#define ARRAYSIZE(x) (sizeof(x)/sizeof(*x))
+
+void usage(const char * progname)
+{
+    printf("%s: Face manager daemon\n", progname);
+    printf("\n");
+    printf("Usage: %s [OPTIONS]\n", progname);
+    printf("\n");
+    printf("OPTIONS:\n");
+    printf("  -c  --config [FILE|none]    Sets the configuration file (unless none, default: /etc/facemgr.conf, ~/facemgr.conf)\n");
+    printf("\n");
+}
+
+int probe_cfgfile(char * f)
+{
+    for (unsigned i = 0; i < ARRAYSIZE(DEFAULT_CFGFILES); i++) {
+        if (access(DEFAULT_CFGFILES[i], F_OK ) != -1) {
+            if (!realpath(DEFAULT_CFGFILES[i], f))
+                continue;
+            return 0;
+        }
+    }
+    return -1;
+}
+
+int parse_cmdline(int argc, char ** argv, facemgr_options_t * opts)
+{
+    int c;
+    while ((c = getopt_long(argc, argv, "c:", long_options, NULL)) != -1) {
+        switch(c) {
+            case 'c':
+                opts->cfgfile = strdup(optarg);
+                break;
+            case ':':
+            case '?':
+            default:
+                usage(argv[0]);
+                exit(EXIT_FAILURE);
+        }
+
+    }
+    return 0;
+}
+
+int parse_config_file(const char * cfgpath, facemgr_t * facemgr)
+{
+    /* Reading configuration file */
+    config_t cfg;
+    config_setting_t *setting;
+
+    config_init(&cfg);
+
+    /* Read the file. If there is an error, report it and exit. */
+    if(!config_read_file(&cfg, cfgpath))
+        goto ERR_FILE;
+
+    setting = config_lookup(&cfg, "log");
+    if (setting) {
+        const char *log_level_str;
+        if (config_setting_lookup_string(setting, "log_level", &log_level_str)) {
+            if (strcmp(log_level_str, "FATAL") == 0) {
+                log_conf.log_level = LOG_FATAL;
+            } else
+            if (strcmp(log_level_str, "ERROR") == 0) {
+                log_conf.log_level = LOG_ERROR;
+            } else
+            if (strcmp(log_level_str, "WARN") == 0) {
+                log_conf.log_level = LOG_WARN;
+            } else
+            if (strcmp(log_level_str, "INFO") == 0) {
+                log_conf.log_level = LOG_INFO;
+            } else
+            if (strcmp(log_level_str, "DEBUG") == 0) {
+                log_conf.log_level = LOG_DEBUG;
+            } else
+            if (strcmp(log_level_str, "TRACE") == 0) {
+                log_conf.log_level = LOG_TRACE;
+            } else {
+                printf("Ignored unknown log level\n");
+            }
+        }
+    }
+
+    setting = config_lookup(&cfg, "faces.overlay.ipv4");
+    if (setting) {
+        const char * ip_address;
+        int local_port, remote_port;
+        if (config_setting_lookup_int(setting, "local_port", &local_port)) {
+            if ((local_port < 0) || (local_port > MAX_PORT))
+                goto ERR;
+            facemgr->overlay_v4_local_port = (uint16_t)local_port;
+        }
+
+        if (config_setting_lookup_int(setting, "remote_port", &remote_port)) {
+            if ((remote_port < 0) || (remote_port > MAX_PORT))
+                goto ERR;
+            facemgr->overlay_v4_remote_port = (uint16_t)remote_port;
+        }
+
+        if (config_setting_lookup_string(setting, "remote_addr", &ip_address)) {
+            ip_address_pton(ip_address, &facemgr->overlay_v4_remote_addr);
+            printf("got v4 remote addr\n");
+        }
+    }
+
+    setting = config_lookup(&cfg, "faces.overlay.ipv6");
+    if (setting) {
+        const char * ip_address;
+        int local_port, remote_port;
+        if (config_setting_lookup_int(setting, "local_port", &local_port)) {
+            if ((local_port < 0) || (local_port > MAX_PORT))
+                goto ERR;
+            facemgr->overlay_v6_local_port = (uint16_t)local_port;
+        }
+
+        if (config_setting_lookup_int(setting, "remote_port", &remote_port)) {
+            if ((remote_port < 0) || (remote_port > MAX_PORT))
+                goto ERR;
+            facemgr->overlay_v6_remote_port = (uint16_t)remote_port;
+        }
+
+        if (config_setting_lookup_string(setting, "remote_addr", &ip_address))
+            ip_address_pton(ip_address, &facemgr->overlay_v6_remote_addr);
+    }
+
+    setting = config_lookup(&cfg, "faces.rules");
+    if (setting) {
+        int count = config_setting_length(setting);
+        for(unsigned i = 0; i < count; ++i) {
+            const char *interface_name;
+            policy_tags_t tags = POLICY_TAGS_EMPTY;
+
+            config_setting_t *rule = config_setting_get_elem(setting, i);
+
+            /* Interface name */
+            if(!(config_setting_lookup_string(rule, "name", &interface_name)))
+                continue;
+
+            /* Associated tags */
+            config_setting_t *tag_settings = config_setting_get_member(rule, "tags");
+            if (!tag_settings)
+                goto ERR;
+
+
+            for (unsigned j = 0; j < config_setting_length(tag_settings); j++) {
+                const char * tag_str = config_setting_get_string_elem(tag_settings, j);
+                policy_tag_t tag = policy_tag_from_str(tag_str);
+                if (tag == POLICY_TAG_N)
+                    goto ERR;
+                policy_tags_add(&tags, tag);
+            }
+
+            /* debug */
+            char tags_str[MAXSZ_POLICY_TAGS];
+            policy_tags_snprintf(tags_str, MAXSZ_POLICY_TAGS, tags);
+            printf("Rule #%d interface_name=%s, tags=%s\n", i, interface_name, tags_str);
+            face_rules_add(&facemgr->rules, strdup(interface_name), tags);
+        }
+    }
+
+    config_destroy(&cfg);
+    return 0;
+
+ERR_FILE:
+    printf("Could not read configuration file %s\n", cfgpath);
+    fprintf(stderr, "%s:%d - %s\n", config_error_file(&cfg),
+            config_error_line(&cfg), config_error_text(&cfg));
+    config_destroy(&cfg);
+    exit(EXIT_FAILURE);
+    return -1;
+ERR:
+    fprintf(stderr, "%s:%d - %s\n", config_error_file(&cfg),
+            config_error_line(&cfg), config_error_text(&cfg));
+    config_destroy(&cfg);
+    return -1;
+}
+
+#ifndef APPLE
+void dummy_handler(int fd, short event, void *arg) { }
+#endif /* APPLE */
+
+
+int main(int argc, char **argv)
+{
+    facemgr_t * facemgr = facemgr_create();
+    if (!facemgr)
+        goto ERR_FACEMGR;
+
+    char cfgfile[PATH_MAX];
+
+    // TODO: default < config < commandline on a per option basis
+
+    /* Commandline */
+    facemgr_options_t cmdline_opts = {0};
+    if (parse_cmdline(argc, argv, &cmdline_opts) < 0) {
+        ERROR("Error parsing commandline\n");
+        goto ERR_CMDLINE;
+    }
+
+    /* Configuration file */
+    //facemgr_options_t cfgfile_opts;
+
+    if (cmdline_opts.cfgfile) {
+        if (strcmp(cmdline_opts.cfgfile, "none") == 0)
+            goto NO_CFGFILE;
+
+        if (!realpath(cmdline_opts.cfgfile, (char*)&cfgfile))
+            goto ERR_PATH;
+
+        goto PARSE_CFGFILE;
+    }
+
+    /* No commandline path specifed, probe default locations... */
+
+    if (probe_cfgfile(cfgfile) < 0)
+        goto NO_CFGFILE;
+
+    printf("Using configuration file %s\n", cfgfile);
+
+PARSE_CFGFILE:
+
+    if (parse_config_file(cfgfile, facemgr) < 0) {
+        ERROR("Error parsing configuration file %s\n", cfgfile);
+        goto ERR_PARSE;
+    }
+
+NO_CFGFILE:
+
+#ifdef __linux__
+    facemgr->loop = event_base_new();
+    if (!facemgr->loop)
+        fatal("Could not create an event base");
+
+    /* Main loop
+     *
+     * To avoid the loop to exit when empty, we might either rely on an option
+     * introduced from versions 2.1.x:
+     *   event_base_loop(loop->base, EVLOOP_NO_EXIT_ON_EMPTY);
+     * or use this workaround:
+     *   http://archives.seul.org/libevent/users/Sep-2012/msg00056.html
+     *
+     * TODO:
+     *  - HUP should interrupt the main loop
+     */
+    {
+        struct event *ev;
+        struct timeval tv;
+        tv.tv_sec = FACEMGR_TIMEOUT;
+        tv.tv_usec = 0;
+
+        ev = event_new(facemgr->loop, fileno(stdin), EV_TIMEOUT | EV_PERSIST, dummy_handler, NULL);
+        event_add(ev, &tv);
+    }
+#endif /* __linux__ */
+
+    DEBUG("Bootstrap...\n");
+    if (facemgr_bootstrap(facemgr) < 0 )
+        goto ERR_BOOTSTRAP;
+
+#ifdef __linux__
+    event_set_log_callback(NULL);
+    event_base_dispatch(facemgr->loop);
+
+    event_base_free(facemgr->loop);
+#endif /* __linux__ */
+
+#ifdef __APPLE__
+    /* Main loop */
+    facemgr->loop = NULL;
+    dispatch_main();
+#endif /* __APPLE__ */
+
+    /* Clean up */
+    //interface_delete_all();
+
+
+    facemgr_free(facemgr);
+
+    return EXIT_SUCCESS;
+
+ERR_BOOTSTRAP:
+ERR_PARSE:
+ERR_PATH:
+ERR_CMDLINE:
+    facemgr_free(facemgr);
+ERR_FACEMGR:
+    return EXIT_FAILURE;
+
+}
+
diff --git a/ctrl/facemgr/src/netdevice.c b/ctrl/facemgr/src/netdevice.c
new file mode 100644
index 000000000..817b0e47b
--- /dev/null
+++ b/ctrl/facemgr/src/netdevice.c
@@ -0,0 +1,28 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file netdevice.c
+ * \brief Implementation of Netdevice abstraction
+ */
+
+#include "common.h"
+#include "netdevice.h"
+
+const char * netdevice_type_str[] = {
+#define _(x) [NETDEVICE_TYPE_ ## x] = STRINGIZE(x),
+foreach_netdevice_type
+#undef _
+}
diff --git a/ctrl/facemgr/src/netdevice.h b/ctrl/facemgr/src/netdevice.h
new file mode 100644
index 000000000..b64ad0f9a
--- /dev/null
+++ b/ctrl/facemgr/src/netdevice.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file netdevice.h
+ * \brief Netdevice abstraction
+ */
+#ifndef FACEMGR_NETDEVICE_H
+#define FACEMGR_NETDEVICE_H
+
+#include <net/if.h> // IFNAMSIZ
+
+#include "common.h"
+
+#define foreach_netdevice_type  \
+    _(UNDEFINED)                \
+    _(WIRED)                    \
+    _(WIFI)                     \
+    _(CELLULAR)                 \
+    _(VPN)                      \
+    _(N)
+
+#define MAXSZ_NETDEVICE_TYPE 9
+#define MAXSZ_NETDEVICE_TYPE_ MAXSZ_NETDEVICE_TYPE
+
+typedef enum {
+#define _(x) x,
+foreach_netdevice_type
+#undef _
+} netdevice_type_t;
+
+extern const char * netdevice_type_str[];
+
+
+typedef struct {
+    u32 index;
+    char name[IFNAMSIZ];
+} netdevice_t;
+
+#endif /* FACEMGR_NETDEVICE_H */
diff --git a/ctrl/facemgr/src/util/hash.h b/ctrl/facemgr/src/util/hash.h
new file mode 100644
index 000000000..04b08eb54
--- /dev/null
+++ b/ctrl/facemgr/src/util/hash.h
@@ -0,0 +1,233 @@
+/*
+ * \file hash.h
+ * \brief Simple non-cryptographic hash implementation.
+ *
+ * Two helpers are provided :
+ *    hash(buf, len)  : hash a buffer <buf> of length <len>
+ *    hash_struct(buf) : hash a buffer corresponding to an allocated struct
+ *
+ * This file consists in excerpts from Jenkins hash (public domain).
+ * http://www.burtleburtle.net/bob/c/lookup3.c
+ */
+#ifndef UTIL_HASH_H
+#define UTIL_HASH_H
+
+#include "../common.h"
+
+#if (defined(__BYTE_ORDER) && defined(__LITTLE_ENDIAN) && \
+     __BYTE_ORDER == __LITTLE_ENDIAN) || \
+    (defined(i386) || defined(__i386__) || defined(__i486__) || \
+     defined(__i586__) || defined(__i686__) || defined(vax) || defined(MIPSEL))
+# define HASH_LITTLE_ENDIAN 1
+# define HASH_BIG_ENDIAN 0
+#elif (defined(__BYTE_ORDER) && defined(__BIG_ENDIAN) && \
+       __BYTE_ORDER == __BIG_ENDIAN) || \
+      (defined(sparc) || defined(POWERPC) || defined(mc68000) || defined(sel))
+# define HASH_LITTLE_ENDIAN 0
+# define HASH_BIG_ENDIAN 1
+#else
+# define HASH_LITTLE_ENDIAN 0
+# define HASH_BIG_ENDIAN 0
+#endif
+
+#define hashsize(n) ((uint32_t)1<<(n))
+#define hashmask(n) (hashsize(n)-1)
+#define rot(x,k) (((x)<<(k)) | ((x)>>(32-(k))))
+
+#define mix(a,b,c) \
+{ \
+  a -= c;  a ^= rot(c, 4);  c += b; \
+  b -= a;  b ^= rot(a, 6);  a += c; \
+  c -= b;  c ^= rot(b, 8);  b += a; \
+  a -= c;  a ^= rot(c,16);  c += b; \
+  b -= a;  b ^= rot(a,19);  a += c; \
+  c -= b;  c ^= rot(b, 4);  b += a; \
+}
+
+#define final(a,b,c) \
+{ \
+  c ^= b; c -= rot(b,14); \
+  a ^= c; a -= rot(c,11); \
+  b ^= a; b -= rot(a,25); \
+  c ^= b; c -= rot(b,16); \
+  a ^= c; a -= rot(c,4);  \
+  b ^= a; b -= rot(a,14); \
+  c ^= b; c -= rot(b,24); \
+}
+
+static inline
+uint32_t hashlittle( const void *key, size_t length, uint32_t initval)
+{
+  uint32_t a,b,c;                                          /* internal state */
+  union { const void *ptr; size_t i; } u;     /* needed for Mac Powerbook G4 */
+
+  /* Set up the internal state */
+  a = b = c = 0xdeadbeef + ((uint32_t)length) + initval;
+
+  u.ptr = key;
+  if (HASH_LITTLE_ENDIAN && ((u.i & 0x3) == 0)) {
+    const uint32_t *k = (const uint32_t *)key;         /* read 32-bit chunks */
+
+    /*------ all but last block: aligned reads and affect 32 bits of (a,b,c) */
+    while (length > 12)
+    {
+      a += k[0];
+      b += k[1];
+      c += k[2];
+      mix(a,b,c);
+      length -= 12;
+      k += 3;
+    }
+
+    /*----------------------------- handle the last (probably partial) block */
+    /*
+     * "k[2]&0xffffff" actually reads beyond the end of the string, but
+     * then masks off the part it's not allowed to read.  Because the
+     * string is aligned, the masked-off tail is in the same word as the
+     * rest of the string.  Every machine with memory protection I've seen
+     * does it on word boundaries, so is OK with this.  But VALGRIND will
+     * still catch it and complain.  The masking trick does make the hash
+     * noticably faster for short strings (like English words).
+     */
+#ifndef VALGRIND
+
+    switch(length)
+    {
+    case 12: c+=k[2]; b+=k[1]; a+=k[0]; break;
+    case 11: c+=k[2]&0xffffff; b+=k[1]; a+=k[0]; break;
+    case 10: c+=k[2]&0xffff; b+=k[1]; a+=k[0]; break;
+    case 9 : c+=k[2]&0xff; b+=k[1]; a+=k[0]; break;
+    case 8 : b+=k[1]; a+=k[0]; break;
+    case 7 : b+=k[1]&0xffffff; a+=k[0]; break;
+    case 6 : b+=k[1]&0xffff; a+=k[0]; break;
+    case 5 : b+=k[1]&0xff; a+=k[0]; break;
+    case 4 : a+=k[0]; break;
+    case 3 : a+=k[0]&0xffffff; break;
+    case 2 : a+=k[0]&0xffff; break;
+    case 1 : a+=k[0]&0xff; break;
+    case 0 : return c;              /* zero length strings require no mixing */
+    }
+
+#else /* make valgrind happy */
+
+    k8 = (const uint8_t *)k;
+    switch(length)
+    {
+    case 12: c+=k[2]; b+=k[1]; a+=k[0]; break;
+    case 11: c+=((uint32_t)k8[10])<<16;  /* fall through */
+    case 10: c+=((uint32_t)k8[9])<<8;    /* fall through */
+    case 9 : c+=k8[8];                   /* fall through */
+    case 8 : b+=k[1]; a+=k[0]; break;
+    case 7 : b+=((uint32_t)k8[6])<<16;   /* fall through */
+    case 6 : b+=((uint32_t)k8[5])<<8;    /* fall through */
+    case 5 : b+=k8[4];                   /* fall through */
+    case 4 : a+=k[0]; break;
+    case 3 : a+=((uint32_t)k8[2])<<16;   /* fall through */
+    case 2 : a+=((uint32_t)k8[1])<<8;    /* fall through */
+    case 1 : a+=k8[0]; break;
+    case 0 : return c;
+    }
+
+#endif /* !valgrind */
+
+  } else if (HASH_LITTLE_ENDIAN && ((u.i & 0x1) == 0)) {
+    const uint16_t *k = (const uint16_t *)key;         /* read 16-bit chunks */
+    const uint8_t  *k8;
+
+    /*--------------- all but last block: aligned reads and different mixing */
+    while (length > 12)
+    {
+      a += k[0] + (((uint32_t)k[1])<<16);
+      b += k[2] + (((uint32_t)k[3])<<16);
+      c += k[4] + (((uint32_t)k[5])<<16);
+      mix(a,b,c);
+      length -= 12;
+      k += 6;
+    }
+
+    /*----------------------------- handle the last (probably partial) block */
+    k8 = (const uint8_t *)k;
+    switch(length)
+    {
+    case 12: c+=k[4]+(((uint32_t)k[5])<<16);
+             b+=k[2]+(((uint32_t)k[3])<<16);
+             a+=k[0]+(((uint32_t)k[1])<<16);
+             break;
+    case 11: c+=((uint32_t)k8[10])<<16;     /* fall through */
+    case 10: c+=k[4];
+             b+=k[2]+(((uint32_t)k[3])<<16);
+             a+=k[0]+(((uint32_t)k[1])<<16);
+             break;
+    case 9 : c+=k8[8];                      /* fall through */
+    case 8 : b+=k[2]+(((uint32_t)k[3])<<16);
+             a+=k[0]+(((uint32_t)k[1])<<16);
+             break;
+    case 7 : b+=((uint32_t)k8[6])<<16;      /* fall through */
+    case 6 : b+=k[2];
+             a+=k[0]+(((uint32_t)k[1])<<16);
+             break;
+    case 5 : b+=k8[4];                      /* fall through */
+    case 4 : a+=k[0]+(((uint32_t)k[1])<<16);
+             break;
+    case 3 : a+=((uint32_t)k8[2])<<16;      /* fall through */
+    case 2 : a+=k[0];
+             break;
+    case 1 : a+=k8[0];
+             break;
+    case 0 : return c;                     /* zero length requires no mixing */
+    }
+
+  } else {                        /* need to read the key one byte at a time */
+    const uint8_t *k = (const uint8_t *)key;
+
+    /*--------------- all but the last block: affect some 32 bits of (a,b,c) */
+    while (length > 12)
+    {
+      a += k[0];
+      a += ((uint32_t)k[1])<<8;
+      a += ((uint32_t)k[2])<<16;
+      a += ((uint32_t)k[3])<<24;
+      b += k[4];
+      b += ((uint32_t)k[5])<<8;
+      b += ((uint32_t)k[6])<<16;
+      b += ((uint32_t)k[7])<<24;
+      c += k[8];
+      c += ((uint32_t)k[9])<<8;
+      c += ((uint32_t)k[10])<<16;
+      c += ((uint32_t)k[11])<<24;
+      mix(a,b,c);
+      length -= 12;
+      k += 12;
+    }
+
+    /*-------------------------------- last block: affect all 32 bits of (c) */
+    switch(length)                   /* all the case statements fall through */
+    {
+    case 12: c+=((uint32_t)k[11])<<24;
+    case 11: c+=((uint32_t)k[10])<<16;
+    case 10: c+=((uint32_t)k[9])<<8;
+    case 9 : c+=k[8];
+    case 8 : b+=((uint32_t)k[7])<<24;
+    case 7 : b+=((uint32_t)k[6])<<16;
+    case 6 : b+=((uint32_t)k[5])<<8;
+    case 5 : b+=k[4];
+    case 4 : a+=((uint32_t)k[3])<<24;
+    case 3 : a+=((uint32_t)k[2])<<16;
+    case 2 : a+=((uint32_t)k[1])<<8;
+    case 1 : a+=k[0];
+             break;
+    case 0 : return c;
+    }
+  }
+
+  final(a,b,c);
+  return c;
+}
+
+/* Helpers */
+
+#define HASH_INITVAL 1
+#define hash(buf, len)  (hash_t)hashlittle(buf, len, HASH_INITVAL)
+#define hash_struct(buf) hash(buf, sizeof(buf))
+
+#endif /* UTIL_JENKINS_HASH_H */
diff --git a/ctrl/facemgr/src/util/ip_address.h b/ctrl/facemgr/src/util/ip_address.h
new file mode 100644
index 000000000..165394709
--- /dev/null
+++ b/ctrl/facemgr/src/util/ip_address.h
@@ -0,0 +1,321 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file ip_address.h
+ * \brief IP address type support
+ */
+#ifndef UTIL_IP_ADDRESS_H
+#define UTIL_IP_ADDRESS_H
+
+#include <arpa/inet.h>  // inet_ntop
+#ifdef __APPLE__
+#include <libkern/OSByteOrder.h>
+#define __bswap_constant_32(x) OSSwapInt32(x)
+#include <machine/endian.h>
+#else
+#include <endian.h>
+#endif
+#include <errno.h>
+#include <netdb.h> // struct addrinfo
+#include <netinet/in.h> // INET*_ADDRSTRLEN, IN*ADDR_LOOPBACK
+#include <stdlib.h>
+#include <stdio.h> // snprintf
+#include <string.h> // memset
+
+#include "types.h"
+
+#define bytes_to_bits(x) (x * 8)
+#define IPV6_ADDR_LEN 16	/* bytes */
+#define IPV4_ADDR_LEN 4		/* bytes */
+#define IPV6_ADDR_LEN_BITS bytes_to_bits(IPV6_ADDR_LEN)
+#define IPV4_ADDR_LEN_BITS bytes_to_bits(IPV4_ADDR_LEN)
+
+#define IP_MAX_ADDR_LEN IPV6_ADDR_LEN
+
+#define DUMMY_PORT 1234
+
+typedef union {
+    union {
+        struct in_addr as_inaddr;
+        u8 as_u8[4];
+        u16 as_u16[2];
+        u32 as_u32;
+    } v4;
+    union {
+        struct in6_addr as_in6addr;
+        u8 as_u8[16];
+        u16 as_u16[8];
+        u32 as_u32[4];
+        u64 as_u64[2];
+    } v6;
+    u8 buffer[IP_MAX_ADDR_LEN];
+    u8 as_u8[IP_MAX_ADDR_LEN];
+    u16 as_u16[IP_MAX_ADDR_LEN >> 1];
+    u32 as_u32[IP_MAX_ADDR_LEN >> 2];
+    u64 as_u64[IP_MAX_ADDR_LEN >> 3];
+} ip_address_t;
+
+#define MAXSZ_IP4_ADDRESS_ INET_ADDRSTRLEN - 1
+#define MAXSZ_IP6_ADDRESS_ INET6_ADDRSTRLEN - 1
+#define MAXSZ_IP_ADDRESS_ MAXSZ_IP6_ADDRESS_
+#define MAXSZ_IP4_ADDRESS MAXSZ_IP4_ADDRESS_ + 1
+#define MAXSZ_IP6_ADDRESS MAXSZ_IP6_ADDRESS_ + 1
+#define MAXSZ_IP_ADDRESS MAXSZ_IP_ADDRESS_ + 1
+
+typedef struct {
+  int family;
+  ip_address_t address;
+  u8 len;
+} ip_prefix_t;
+
+#define MAXSZ_PREFIX_ MAXSZ_IP_ADDRESS_ + 1 + 3
+#define MAXSZ_PREFIX MAXSZ_PREFIX_ + 1
+
+/* No htonl() with const */
+static const ip_address_t IPV4_LOOPBACK = {
+#if __BYTE_ORDER == __LITTLE_ENDIAN
+    .v4.as_inaddr.s_addr = __bswap_constant_32(INADDR_LOOPBACK),
+#else
+    .v4.as_inaddr.s_addr = INADDR_LOOPBACK,
+#endif
+};
+
+static const ip_address_t IPV6_LOOPBACK = {
+    .v6.as_in6addr = IN6ADDR_LOOPBACK_INIT,
+};
+
+static const ip_address_t IPV4_ANY = {
+    .v4.as_inaddr.s_addr = INADDR_ANY,
+};
+
+static const ip_address_t IPV6_ANY = {
+    .v6.as_in6addr = IN6ADDR_ANY_INIT,
+};
+
+#define IP_ANY(family) (family == AF_INET) ? IPV4_ANY : IPV6_ANY
+
+static const ip_address_t IP_ADDRESS_EMPTY = {
+    .as_u64 = { 0 },
+};
+
+
+#define MAX_PORT 1 << (8 * sizeof(u16))
+#define IS_VALID_PORT(x) ((x > 0) && (x < MAX_PORT))
+
+#define MAXSZ_PORT_ 5
+#define MAXSZ_PORT MAXSZ_PORT_ + 1
+
+#define IS_VALID_FAMILY(x) ((x == AF_INET) || (x == AF_INET6))
+
+static inline
+int
+ip_address_get_family (const char * ip_address)
+{
+  struct addrinfo hint, *res = NULL;
+  int rc;
+
+  memset (&hint, '\0', sizeof hint);
+
+  hint.ai_family = PF_UNSPEC;
+  hint.ai_flags = AI_NUMERICHOST;
+
+  rc = getaddrinfo (ip_address, NULL, &hint, &res);
+  if (rc)
+    {
+      return -1;
+    }
+  rc = res->ai_family;
+  freeaddrinfo (res);
+  return rc;
+}
+
+static inline
+int
+ip_address_len (const ip_address_t * ip_address, int family)
+{
+  return (family == AF_INET6) ? IPV6_ADDR_LEN :
+    (family == AF_INET) ? IPV4_ADDR_LEN : 0;
+}
+
+static inline
+int
+ip_address_ntop (const ip_address_t * ip_address, char *dst, const size_t len,
+		int family)
+{
+  const char * s = inet_ntop (family, ip_address->buffer, dst, len);
+  return (s ? 1 : -1);
+}
+
+/*
+ * Parse ip addresses in presentation format
+ */
+static inline
+int
+ip_address_pton (const char *ip_address_str, ip_address_t * ip_address)
+{
+  int pton_fd;
+  char *addr = strdup (ip_address_str);
+  int family;
+
+
+  family = ip_address_get_family (addr);
+
+  switch (family)
+    {
+    case AF_INET6:
+      pton_fd = inet_pton (AF_INET6, addr, &ip_address->buffer);
+      break;
+    case AF_INET:
+      pton_fd = inet_pton (AF_INET, addr, &ip_address->buffer);
+      break;
+    default:
+      goto ERR;
+    }
+
+  //   0 = not in presentation format
+  // < 0 = other error (use perror)
+  if (pton_fd <= 0)
+    {
+      goto ERR;
+    }
+
+  return 1;
+ERR:
+  free (addr);
+  return -1;
+}
+
+
+
+static inline
+int
+ip_address_snprintf(char * s, size_t size, const ip_address_t * ip_address, int family)
+{
+    size_t len = family == AF_INET ? INET_ADDRSTRLEN : INET6_ADDRSTRLEN;
+    const char * rc = inet_ntop (family, ip_address->buffer, s, len);
+    return rc ? strlen(rc) : -1;
+}
+
+
+static inline
+int
+ip_address_to_sockaddr(const ip_address_t * ip_address,
+		struct sockaddr *sockaddr_address, int family)
+{
+  struct sockaddr_in6 *tmp6 = (struct sockaddr_in6 *) sockaddr_address;
+  struct sockaddr_in *tmp4 = (struct sockaddr_in *) sockaddr_address;
+
+  switch (family)
+    {
+    case AF_INET6:
+      tmp6->sin6_family = AF_INET6;
+      tmp6->sin6_port = DUMMY_PORT;
+      tmp6->sin6_scope_id = 0;
+      memcpy (&tmp6->sin6_addr, ip_address->buffer, IPV6_ADDR_LEN);
+      break;
+    case AF_INET:
+      tmp4->sin_family = AF_INET;
+      tmp4->sin_port = DUMMY_PORT;
+      memcpy (&tmp4->sin_addr, ip_address->buffer, IPV4_ADDR_LEN);
+      break;
+    default:
+      return -1;
+    }
+
+  return 1;
+}
+
+static inline
+int
+ip_address_cmp(const ip_address_t * ip1, const ip_address_t * ip2, int family)
+{
+    return memcmp(ip1, ip2, ip_address_len(ip1, family));
+}
+
+static inline
+int
+ip_address_empty(const ip_address_t * ip)
+{
+    return (memcmp(ip, &IP_ADDRESS_EMPTY, sizeof(IP_ADDRESS_EMPTY)) == 0);
+}
+
+/* Parse IP Prefixes in presentation format (in bits, separated by a slash) */
+static inline
+int
+ip_prefix_pton (const char *ip_address_str, ip_prefix_t * ip_prefix)
+{
+  int pton_fd;
+  char *p;
+  char *eptr;
+  char *addr = strdup (ip_address_str);
+
+  p = strchr (addr, '/');
+  if (!p)
+    {
+      ip_prefix->len = 0;		// until we get the ip address family
+    }
+  else
+    {
+      ip_prefix->len = strtoul (p + 1, &eptr, 10);
+      *p = 0;
+    }
+
+  ip_prefix->family = ip_address_get_family (addr);
+
+  switch (ip_prefix->family)
+    {
+    case AF_INET6:
+      if (ip_prefix->len > IPV6_ADDR_LEN_BITS)
+	goto ERR;
+      pton_fd = inet_pton (AF_INET6, addr, &ip_prefix->address.buffer);
+      break;
+    case AF_INET:
+      if (ip_prefix->len > IPV4_ADDR_LEN_BITS)
+	goto ERR;
+      pton_fd = inet_pton (AF_INET, addr, &ip_prefix->address.buffer);
+      break;
+    default:
+      goto ERR;
+    }
+
+  //   0 = not in presentation format
+  // < 0 = other error (use perror)
+  if (pton_fd <= 0)
+    {
+      goto ERR;
+    }
+
+  return 1;
+ERR:
+  free (addr);
+  return -1;
+}
+
+static inline
+int
+ip_prefix_ntop (const ip_prefix_t * ip_prefix, char *dst, size_t size)
+{
+  char ip_s[MAXSZ_IP_ADDRESS];
+  const char * s = inet_ntop (ip_prefix->family, ip_prefix->address.buffer, ip_s, MAXSZ_IP_ADDRESS);
+  if (!s)
+      return -1;
+  size_t n = snprintf(dst, size, "%s/%d", ip_s, ip_prefix->len);
+
+  return (n > 0 ? 1 : -1);
+}
+
+
+#endif /* UTIL_IP_ADDRESS_H */
diff --git a/ctrl/facemgr/src/util/log.c b/ctrl/facemgr/src/util/log.c
new file mode 100644
index 000000000..54943cf45
--- /dev/null
+++ b/ctrl/facemgr/src/util/log.c
@@ -0,0 +1,126 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "log.h"
+
+#include <stdarg.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+log_conf_t log_conf = DEFAULT_LOG_CONF;
+
+#define FMT_DATETIME "%02d-%02d-%04d %02d:%02d:%02d"
+#define FMT_DATETIME_LEN 20
+#define snprintf_nowarn(...) (snprintf(__VA_ARGS__) < 0 ? abort() : (void)0)
+
+
+static char ts[FMT_DATETIME_LEN];
+
+static char *timestamp(void)
+{
+	time_t tv;
+	struct tm *tm;
+
+	time(&tv);
+	tm = localtime(&tv);
+
+        snprintf_nowarn(ts, FMT_DATETIME_LEN, FMT_DATETIME, tm->tm_mday,
+                tm->tm_mon + 1, tm->tm_year + 1900, tm->tm_hour, tm->tm_min,
+                tm->tm_sec);
+	return ts;
+}
+
+void _log_va(int level, const char *fmt, va_list ap)
+{
+	char *prefix;
+  FILE *f = log_conf.log_file ? log_conf.log_file : stdout;
+
+#if 0
+	if (!conf.log_system)
+		return;
+#endif
+
+	if (level > log_conf.log_level)
+		return;
+
+	switch (level) {
+		case LOG_FATAL:
+			prefix = "FATAL: ";
+			break;
+		case LOG_ERROR:
+			prefix = "ERROR: ";
+			break;
+		case LOG_WARN:
+			prefix = "WARNING: ";
+			break;
+		case LOG_INFO:
+			prefix = "";
+			break;
+		case LOG_DEBUG:
+			prefix = "DEBUG: ";
+			break;
+		case LOG_TRACE:
+			prefix = "TRACE: ";
+			break;
+		default:
+			prefix = "";
+			break;
+	}
+
+	fprintf(f, "%s %s", timestamp(), prefix);
+	vfprintf(f, fmt, ap);
+	fprintf(f, "\n");
+#ifdef DEBUG
+	fflush(f);
+#endif
+}
+
+void _log(int level, const char *fmt, ...)
+{
+	va_list ap;
+
+	va_start(ap, fmt);
+	_log_va(level, fmt, ap);
+	va_end(ap);
+}
+
+#ifdef HAVE_BACKTRACE
+#include <execinfo.h>
+
+void print_trace(void)
+{
+	void *array[32];
+	size_t size;
+
+	size = backtrace(array, 32);
+	fflush(conf.log_file);
+	backtrace_symbols_fd(array, size, fileno(conf.log_file));
+}
+#endif
+
+void fatal(char *fmt, ...)
+{
+	va_list ap;
+
+	va_start(ap, fmt);
+	_log_va(LOG_FATAL, fmt, ap);
+	va_end(ap);
+
+#ifdef HAVE_BACKTRACE
+	print_trace();
+#endif
+
+	exit(200);
+}
diff --git a/ctrl/facemgr/src/util/log.h b/ctrl/facemgr/src/util/log.h
new file mode 100644
index 000000000..f1cafba47
--- /dev/null
+++ b/ctrl/facemgr/src/util/log.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef UTIL_LOG_H
+#define UTIL_LOG_H
+
+#include <stdarg.h> // va_*
+#include <stdio.h> // FILE
+#include <time.h> // time, localtime
+
+#define LOG_FATAL 0
+#define LOG_ERROR 1
+#define LOG_WARN  2
+#define LOG_INFO  3
+#define LOG_DEBUG 4
+#define LOG_TRACE 5
+
+typedef struct {
+  int log_level;
+  int debug;
+  FILE * log_file;
+} log_conf_t;
+
+#define DEFAULT_LOG_CONF {      \
+    .log_level = LOG_DEBUG,     \
+    .debug = 0,                 \
+    .log_file = NULL,           \
+};
+
+extern log_conf_t log_conf;
+
+#define WITH_DEBUG(BLOCK)                       \
+    if (log_conf.log_level >= LOG_DEBUG)        \
+        BLOCK
+
+#define FATAL(fmt, ...) (_log(LOG_FATAL, fmt, ##__VA_ARGS__ ))
+#define ERROR(fmt, ...) (_log(LOG_ERROR, fmt, ##__VA_ARGS__ ))
+#define WARN(fmt,  ...) (_log(LOG_WARN,  fmt, ##__VA_ARGS__ ))
+#define INFO(fmt,  ...) (_log(LOG_INFO,  fmt, ##__VA_ARGS__ ))
+#define DEBUG(fmt, ...) (_log(LOG_DEBUG, fmt, ##__VA_ARGS__ ))
+#define TRACE(fmt, ...) (_log(LOG_TRACE, fmt, ##__VA_ARGS__ ))
+
+void _log_va(int level, const char *fmt, va_list ap);
+
+void _log(int level, const char *fmt, ...);
+
+void fatal(char *fmt, ...);
+
+#ifdef HAVE_BACKTRACE
+#include <execinfo.h>
+void print_trace(void);
+#endif
+
+#endif // UTIL_LOG_H
diff --git a/ctrl/facemgr/src/util/map.h b/ctrl/facemgr/src/util/map.h
new file mode 100644
index 000000000..2694de2a7
--- /dev/null
+++ b/ctrl/facemgr/src/util/map.h
@@ -0,0 +1,149 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef UTIL_MAP_H
+#define UTIL_MAP_H
+
+#include <stdlib.h>
+
+#include "../common.h"
+#include "set.h"
+
+#define ERR_MAP_EXISTS -2
+#define ERR_MAP_NOT_FOUND -3
+
+#define TYPEDEF_MAP_H(NAME, KEY_T, VAL_T)                                       \
+                                                                                \
+typedef struct {                                                                \
+    KEY_T key;                                                                  \
+    VAL_T value;                                                                \
+} NAME ## _pair_t;                                                              \
+                                                                                \
+int NAME ## _pair_cmp(const NAME ## _pair_t * p1, const NAME ## _pair_t * p2);  \
+                                                                                \
+TYPEDEF_SET_H(NAME ## _pair_set, NAME ## _pair_t *)                             \
+                                                                                \
+typedef struct NAME ## _s {                                                     \
+    NAME ## _pair_set_t pair_set;                                               \
+} NAME ## _t;                                                                   \
+                                                                                \
+int NAME ## _initialize(NAME ## _t * map);                                      \
+                                                                                \
+int NAME ## _finalize(NAME ## _t * map);                                        \
+                                                                                \
+NAME ## _t * NAME ## _create();                                                 \
+                                                                                \
+void NAME ## _free(NAME ## _t * map);                                           \
+                                                                                \
+int NAME ## _add(NAME ## _t * map, KEY_T key, const VAL_T value);               \
+                                                                                \
+int NAME ## _remove(NAME ## _t * map, KEY_T key, VAL_T * value);                \
+                                                                                \
+int NAME ## _get(NAME ## _t * map, KEY_T key, VAL_T * value);                   \
+                                                                                \
+void NAME ## _dump(NAME ## _t * map);
+
+
+
+
+#define TYPEDEF_MAP(NAME, KEY_T, VAL_T, CMP, KEY_SNPRINTF, VALUE_SNPRINTF)      \
+                                                                                \
+int                                                                             \
+NAME ## _pair_cmp(const NAME ## _pair_t * p1, const NAME ## _pair_t * p2)       \
+{                                                                               \
+    return (CMP(p1->key, p2->key));                                             \
+}                                                                               \
+                                                                                \
+int                                                                             \
+NAME ## _pair_snprintf(char * buf, size_t size, const NAME ## _pair_t * pair) { \
+    int rc;                                                                     \
+    rc = KEY_SNPRINTF(buf, BUFSIZE/2, (KEY_T)pair->key);                        \
+    if (rc < 0)                                                                 \
+        return rc;                                                              \
+    rc = VALUE_SNPRINTF(buf+rc, BUFSIZE/2, (VAL_T)pair->value);             \
+    return rc;                                                                  \
+}                                                                               \
+                                                                                \
+TYPEDEF_SET(NAME ## _pair_set, NAME ## _pair_t *, NAME ## _pair_cmp, NAME ## _pair_snprintf); \
+                                                                                \
+int                                                                             \
+NAME ## _initialize(NAME ## _t * map)                                           \
+{                                                                               \
+    return NAME ## _pair_set_initialize(&map->pair_set);                        \
+}                                                                               \
+                                                                                \
+int                                                                             \
+NAME ## _finalize(NAME ## _t * map)                                             \
+{                                                                               \
+    return NAME ## _pair_set_finalize(&map->pair_set);                          \
+}                                                                               \
+                                                                                \
+AUTOGENERATE_CREATE_FREE(NAME)                                                  \
+                                                                                \
+int                                                                             \
+NAME ## _add(NAME ## _t * map, KEY_T key, const VAL_T value)                    \
+{                                                                               \
+    int rc;                                                                     \
+                                                                                \
+    /* Create pair */                                                           \
+    NAME ## _pair_t * pair = malloc(sizeof(NAME ## _pair_t));                   \
+    if (!pair)                                                                  \
+        return FACEMGR_FAILURE;                                                 \
+                                                                                \
+    pair->key = key;                                                            \
+    pair->value = (VAL_T)value;                                                 \
+                                                                                \
+    rc = NAME ## _pair_set_get(&map->pair_set, pair, NULL);                     \
+    if (!FACEMGR_IS_ERROR(rc)) {                                                \
+        free(pair);                                                             \
+        return ERR_MAP_EXISTS;                                                  \
+    }                                                                           \
+                                                                                \
+    rc = NAME ## _pair_set_add(&map->pair_set, pair);                           \
+    if (FACEMGR_IS_ERROR(rc)) {                                                 \
+        free(pair);                                                             \
+        return FACEMGR_FAILURE;                                                 \
+    }                                                                           \
+    return FACEMGR_SUCCESS;                                                     \
+}                                                                               \
+                                                                                \
+int                                                                             \
+NAME ## _remove(NAME ## _t * map, KEY_T key, VAL_T * value)                     \
+{                                                                               \
+    NAME ## _pair_t * found, search = { .key = key };                           \
+    int rc = NAME ## _pair_set_remove(&map->pair_set, &search, &found);         \
+    if (FACEMGR_IS_ERROR(rc))                                                   \
+        return ERR_MAP_NOT_FOUND;                                               \
+    *value = found->value;                                                      \
+    return FACEMGR_SUCCESS;                                                     \
+}                                                                               \
+                                                                                \
+int                                                                             \
+NAME ## _get(NAME ## _t * map, KEY_T key, VAL_T * value)                        \
+{                                                                               \
+    NAME ## _pair_t * found, search = { .key = key };                           \
+    int rc = NAME ## _pair_set_get(&map->pair_set, &search, &found);            \
+    if (FACEMGR_IS_ERROR(rc))                                                   \
+        return ERR_MAP_NOT_FOUND;                                               \
+    *value = found->value;                                                      \
+    return FACEMGR_SUCCESS;                                                     \
+}                                                                               \
+                                                                                \
+void                                                                            \
+NAME ## _dump(NAME ## _t * map) {                                               \
+    NAME ## _pair_set_dump(&map->pair_set);                                     \
+}
+
+#endif /* UTIL_MAP_H */
diff --git a/ctrl/facemgr/src/util/policy.c b/ctrl/facemgr/src/util/policy.c
new file mode 100644
index 000000000..6c8651ee3
--- /dev/null
+++ b/ctrl/facemgr/src/util/policy.c
@@ -0,0 +1,59 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file policy.h
+ * \brief Implementation of policy description
+ */
+
+#include <stdio.h>
+#include "policy.h"
+
+const char * policy_tag_str[] = {
+    #define _(x, y) [POLICY_TAG_ ## x] = STRINGIZE(x),
+    foreach_policy_tag
+    #undef _
+};
+
+const char policy_tag_short_str[] = {
+    #define _(x, y) [POLICY_TAG_ ## x] = y,
+    foreach_policy_tag
+    #undef _
+};
+
+const char * policy_state_str[] = {
+    #define _(x) [POLICY_STATE_ ## x] = STRINGIZE(x),
+    foreach_policy_state
+    #undef _
+};
+
+int
+policy_tag_state_snprintf(char * s, size_t size, const policy_tag_state_t * tag_state)
+{
+    char *cur = s;
+    int rc;
+
+    if (tag_state->disabled > 1)
+        return -1;
+
+    rc = snprintf(cur, s + size - cur, "%s%s", (tag_state->disabled == 1) ? "!" : "", policy_state_str[tag_state->state]);
+    if (rc < 0)
+        return rc;
+    cur += rc;
+    if (size != 0 && cur >= s + size)
+        return cur - s;
+
+    return cur - s;
+}
diff --git a/ctrl/facemgr/src/util/policy.h b/ctrl/facemgr/src/util/policy.h
new file mode 100644
index 000000000..e20af6560
--- /dev/null
+++ b/ctrl/facemgr/src/util/policy.h
@@ -0,0 +1,234 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file policy.h
+ * \brief Policy description
+ */
+#ifndef HICN_POLICY_H
+#define HICN_POLICY_H
+
+#include <netinet/in.h> // INET*_ADDRSTRLEN
+#include <string.h> // strcasecmp
+#include "token.h"
+
+/* POLICY TAG */
+
+#define foreach_policy_tag      \
+    /* Interface type */        \
+    _(WIRED, 'E')               \
+    _(WIFI, 'W')                \
+    _(CELLULAR, 'C')            \
+    /* QoS */                   \
+    _(BEST_EFFORT, 'b')         \
+    _(REALTIME, 'r')            \
+    _(MULTIPATH, 'M')           \
+    /* Security */              \
+    _(TRUSTED, 'T')
+
+typedef enum {
+#define _(x, y) POLICY_TAG_ ## x,
+foreach_policy_tag
+#undef _
+    POLICY_TAG_N
+} policy_tag_t;
+
+#define MAXSZ_POLICY_TAG_ 11
+#define MAXSZ_POLICY_TAG MAXSZ_POLICY_TAG_ + 1
+
+extern const char * policy_tag_str[];
+extern const char policy_tag_short_str[];
+
+static inline
+policy_tag_t
+policy_tag_from_str(const char * str)
+{
+#define _(x, y) if (strcasecmp(str, policy_tag_str[POLICY_TAG_ ## x] ) == 0) { return POLICY_TAG_ ## x; } else
+foreach_policy_tag
+#undef _
+    return POLICY_TAG_N;
+}
+
+/* POLICY_TAGS */
+
+typedef int policy_tags_t;
+
+static inline
+void policy_tags_add(policy_tags_t * tags, policy_tag_t tag)
+{
+    *tags |= (1 << tag);
+}
+
+static inline
+void policy_tags_remove(policy_tags_t * tags, policy_tag_t tag)
+{
+    *tags &= ~(1 << tag);
+}
+
+static inline
+int policy_tags_has(policy_tags_t tags, policy_tag_t tag)
+{
+    return tags & (1 << tag);
+}
+
+#define POLICY_TAGS_EMPTY 0
+
+static inline
+int
+policy_tags_snprintf(char * s, size_t size, policy_tags_t tags)
+{
+#define _(x, y) s[POLICY_TAG_ ## x] = policy_tags_has(tags, POLICY_TAG_ ## x) ? y : '.';
+foreach_policy_tag
+#undef _
+    s[POLICY_TAG_N] = '\0';
+    return POLICY_TAG_N + 1;
+}
+
+#define MAXSZ_POLICY_TAGS_ POLICY_TAG_N
+#define MAXSZ_POLICY_TAGS MAXSZ_POLICY_TAGS_ + 1
+
+/* POLICY STATE */
+
+/* TODO vs. weight */
+
+#define foreach_policy_state    \
+    _(NEUTRAL)                  \
+    _(REQUIRE)                  \
+    _(PREFER)                   \
+    _(AVOID)                    \
+    _(PROHIBIT)                 \
+    _(N)
+
+typedef enum {
+#define _(x) POLICY_STATE_ ## x,
+foreach_policy_state
+#undef _
+} policy_state_t;
+
+#define MAXSZ_POLICY_STATE_ 8
+#define MAXSZ_POLICY_STATE MAXSZ_POLICY_STATE_ + 1
+
+extern const char * policy_state_str[];
+
+
+/* POLICY TAG STATE */
+
+typedef struct {
+    policy_state_t state;
+    uint8_t disabled;
+} policy_tag_state_t;
+
+#define MAXSZ_POLICY_TAG_STATE_ 8
+#define MAXSZ_POLICY_TAG_STATE MAXSZ_POLICY_TAG_STATE_ + 1
+
+int policy_tag_state_snprintf(char * s, size_t size, const policy_tag_state_t * tag_state);
+
+
+/* INTERFACE STATS */
+
+typedef struct {
+    float throughput;
+    float latency;
+    float loss_rate;
+} interface_stats_t;
+
+#define INTERFACE_STATS_NONE {                          \
+    .throughput = 0,                                    \
+    .latency = 0,                                       \
+    .loss_rate = 0,                                     \
+}
+
+
+/* POLICY STATS */
+
+typedef struct {
+    interface_stats_t wired;
+    interface_stats_t wifi;
+    interface_stats_t cellular;
+    interface_stats_t all;
+} policy_stats_t;
+
+#define POLICY_STATS_NONE {                     \
+    .wired    = INTERFACE_STATS_NONE,           \
+    .wifi     = INTERFACE_STATS_NONE,           \
+    .cellular = INTERFACE_STATS_NONE,           \
+    .all      = INTERFACE_STATS_NONE,           \
+}
+
+typedef struct {
+    uint32_t num_packets;
+    uint32_t num_bytes;
+    uint32_t num_losses;
+    uint32_t latency_idle;
+} interface_counters_t;
+
+#define INTERFACE_COUNTERS_NONE {               \
+    .num_packets = 0,                           \
+    .num_bytes = 0,                             \
+    .num_losses = 0,                            \
+    .latency_idle = 0,                          \
+}
+
+typedef struct {
+    interface_counters_t wired;
+    interface_counters_t wifi;
+    interface_counters_t cellular;
+    interface_counters_t all;
+    uint64_t last_update;
+} policy_counters_t;
+
+#define POLICY_COUNTERS_NONE (policy_counters_t) {      \
+    .wired    = INTERFACE_COUNTERS_NONE,                \
+    .wifi     = INTERFACE_COUNTERS_NONE,                \
+    .cellular = INTERFACE_COUNTERS_NONE,                \
+    .all      = INTERFACE_COUNTERS_NONE,                \
+    .last_update = 0,                                   \
+}
+
+/* POLICY */
+
+#define APP_NAME_LEN 128
+
+typedef struct {
+    char app_name[APP_NAME_LEN];
+    policy_tag_state_t tags[POLICY_TAG_N];
+    policy_stats_t stats;
+} policy_t;
+
+static const policy_t POLICY_NONE = {
+    .app_name = { 0 },
+    .tags = {
+#define _(x, y) [POLICY_TAG_ ## x] = { POLICY_STATE_NEUTRAL, 0 },
+foreach_policy_tag
+#undef _
+    },
+    .stats = POLICY_STATS_NONE,
+};
+
+
+/* POLICY DESCRIPTION */
+
+#define PFX_STRLEN 4 /* eg. /128 */
+
+typedef struct {
+    int family;
+    union {
+        char ipv4_prefix[INET_ADDRSTRLEN + PFX_STRLEN];
+        char ipv6_prefix[INET6_ADDRSTRLEN + PFX_STRLEN];
+    };
+    policy_t policy;
+} policy_description_t;
+
+#endif /* HICN_POLICY_H */
diff --git a/ctrl/facemgr/src/util/set.h b/ctrl/facemgr/src/util/set.h
new file mode 100644
index 000000000..47a6eeaff
--- /dev/null
+++ b/ctrl/facemgr/src/util/set.h
@@ -0,0 +1,127 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef UTIL_SET_H
+#define UTIL_SET_H
+
+#include <search.h>
+#include <string.h>
+#include "token.h"
+#include "../common.h"
+
+#define ERR_SET_EXISTS -2
+#define ERR_SET_NOT_FOUND -3
+
+#define BUFSIZE 80
+
+static inline
+int
+string_snprintf(char * buf, size_t size, const char * s) {
+    return snprintf(buf, size, "%s", s);
+}
+
+static inline
+int
+generic_snprintf(char * buf, size_t size, void * value) {
+    return snprintf(buf, BUFSIZE, "%p", value);
+}
+
+#define TYPEDEF_SET_H(NAME, T)                                          \
+                                                                        \
+typedef struct {                                                        \
+    size_t size;                                                        \
+    void * root;                                                        \
+} NAME ## _t;                                                           \
+                                                                        \
+int NAME ## _initialize(NAME ## _t * set);                              \
+                                                                        \
+int NAME ## _finalize(NAME ## _t * set);                                \
+                                                                        \
+NAME ## _t * NAME ## _create();                                         \
+                                                                        \
+void NAME ## _free(NAME ## _t * set);                                   \
+                                                                        \
+int NAME ## _add(NAME ## _t * set, const T element);                    \
+                                                                        \
+int NAME ## _remove(NAME ## _t * set, const T search, T * element);     \
+                                                                        \
+int NAME ## _get(NAME ## _t * set, const T search, T * element);        \
+                                                                        \
+void NAME ## _dump(NAME ## _t * set);
+
+
+
+
+#define TYPEDEF_SET(NAME, T, CMP, SNPRINTF)                             \
+int                                                                     \
+NAME ## _initialize(NAME ## _t * set)                                   \
+{                                                                       \
+    set->root = NULL;                                                   \
+    set->size = 0;                                                      \
+    return FACEMGR_SUCCESS;                                             \
+}                                                                       \
+                                                                        \
+NO_FINALIZE(NAME);                                                      \
+AUTOGENERATE_CREATE_FREE(NAME);                                         \
+                                                                        \
+int                                                                     \
+NAME ## _add(NAME ## _t * set, const T element)                         \
+{                                                                       \
+    return tsearch(element, &set->root, (cmp_t)CMP)              \
+        ? FACEMGR_SUCCESS : FACEMGR_FAILURE;                            \
+}                                                                       \
+                                                                        \
+int                                                                     \
+NAME ## _remove(NAME ## _t * set, const T search, T * element)          \
+{                                                                       \
+    T * found = tdelete(search, &set->root, (cmp_t)CMP);         \
+    if (found && element)                                               \
+        *element = *found;                                              \
+    return found ? FACEMGR_SUCCESS : ERR_SET_NOT_FOUND;                 \
+}                                                                       \
+                                                                        \
+int                                                                     \
+NAME ## _get(NAME ## _t * set, const T search, T * element)             \
+{                                                                       \
+    T * found = tfind(search, &set->root, (cmp_t)CMP);                  \
+    if (found && element)                                               \
+        *element = *found;                                              \
+    return found ? FACEMGR_SUCCESS : ERR_SET_NOT_FOUND;                 \
+}                                                                       \
+                                                                        \
+void                                                                    \
+__ ## NAME ## _dump_node(const void *nodep, const VISIT which, const int depth) \
+{                                                                       \
+    char buf[BUFSIZE];                                                  \
+    switch (which) {                                                    \
+    case preorder:                                                      \
+        break;                                                          \
+    case postorder:                                                     \
+        break;                                                          \
+    case endorder:                                                      \
+        break;                                                          \
+    case leaf:                                                          \
+        SNPRINTF(buf, BUFSIZE, *(T*)nodep);                             \
+        printf("%s\n", buf);                                            \
+        break;                                                          \
+    }                                                                   \
+}                                                                       \
+                                                                        \
+void                                                                    \
+NAME ## _dump(NAME ## _t * set) {                                       \
+    twalk(set->root, __ ## NAME ## _dump_node);                         \
+}                                                                       \
+
+#endif /* UTIL_SET_H */
diff --git a/ctrl/facemgr/src/util/token.h b/ctrl/facemgr/src/util/token.h
new file mode 100644
index 000000000..43e0a77b2
--- /dev/null
+++ b/ctrl/facemgr/src/util/token.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/* Token concatenation */
+
+/*
+ * Concatenate preprocessor tokens A and B without expanding macro definitions
+ * (however, if invoked from a macro, macro arguments are expanded).
+ */
+#define PPCAT_NX(A, B) A ## B
+
+/*
+ * Concatenate preprocessor tokens A and B after macro-expanding them.
+ */
+#define PPCAT(A, B) PPCAT_NX(A, B)
+
+/* Token stringification */
+
+/*
+ * Turn A into a string literal without expanding macro definitions
+ * (however, if invoked from a macro, macro arguments are expanded).
+ */
+#define STRINGIZE_NX(A) #A
+
+/*
+ * Turn A into a string literal after macro-expanding it.
+ */
+#define STRINGIZE(A) STRINGIZE_NX(A)
diff --git a/ctrl/facemgr/src/util/types.h b/ctrl/facemgr/src/util/types.h
new file mode 100644
index 000000000..10a0bdca0
--- /dev/null
+++ b/ctrl/facemgr/src/util/types.h
@@ -0,0 +1,36 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef UTIL_TYPES
+#define UTIL_TYPES
+
+typedef uint8_t u8;
+typedef uint16_t u16;
+typedef uint32_t u32;
+typedef uint64_t u64;
+
+/* Helper for avoiding warnings about type-punning */
+#define UNION_CAST(x, destType) \
+   (((union {__typeof__(x) a; destType b;})x).b)
+
+typedef unsigned int hash_t;
+
+typedef int (*cmp_t)(const void *, const void *);
+
+/* Enums */
+
+#define IS_VALID_ENUM_TYPE(NAME, x) ((x > NAME ## _UNDEFINED) && (x < NAME ## _N))
+
+#endif /* UTIL_TYPES */