[HICN-252] Add per-application policy framework to hicn-light forwarder

Change-Id: I0531cd7a7de179581295ae34766c81cd9cf3e172
Signed-off-by: Jordan Augé <jordan.auge+fdio@cisco.com>
Signed-off-by: Mauro Sardara <msardara@cisco.com>
Co-authored-by: Mauro Sardara <msardara@cisco.com>

8 files changed, 1149 insertions, 0 deletions

diff --git a/ctrl/libhicnctrl/src/util/hash.h b/ctrl/libhicnctrl/src/util/hash.h
new file mode 100644
index 000000000..0bc48896b
--- /dev/null
+++ b/ctrl/libhicnctrl/src/util/hash.h
@@ -0,0 +1,246 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+ * \file hash.h
+ * \brief Simple non-cryptographic hash implementation.
+ *
+ * Two helpers are provided :
+ *    hash(buf, len)  : hash a buffer <buf> of length <len>
+ *    hash_struct(buf) : hash a buffer corresponding to an allocated struct
+ *
+ * This file consists in excerpts from Jenkins hash (public domain).
+ * http://www.burtleburtle.net/bob/c/lookup3.c
+ */
+#ifndef UTIL_HASH_H
+#define UTIL_HASH_H
+
+#if (defined(__BYTE_ORDER) && defined(__LITTLE_ENDIAN) && \
+     __BYTE_ORDER == __LITTLE_ENDIAN) || \
+    (defined(i386) || defined(__i386__) || defined(__i486__) || \
+     defined(__i586__) || defined(__i686__) || defined(vax) || defined(MIPSEL))
+# define HASH_LITTLE_ENDIAN 1
+# define HASH_BIG_ENDIAN 0
+#elif (defined(__BYTE_ORDER) && defined(__BIG_ENDIAN) && \
+       __BYTE_ORDER == __BIG_ENDIAN) || \
+      (defined(sparc) || defined(POWERPC) || defined(mc68000) || defined(sel))
+# define HASH_LITTLE_ENDIAN 0
+# define HASH_BIG_ENDIAN 1
+#else
+# define HASH_LITTLE_ENDIAN 0
+# define HASH_BIG_ENDIAN 0
+#endif
+
+#define hashsize(n) ((uint32_t)1<<(n))
+#define hashmask(n) (hashsize(n)-1)
+#define rot(x,k) (((x)<<(k)) | ((x)>>(32-(k))))
+
+#define mix(a,b,c) \
+{ \
+  a -= c;  a ^= rot(c, 4);  c += b; \
+  b -= a;  b ^= rot(a, 6);  a += c; \
+  c -= b;  c ^= rot(b, 8);  b += a; \
+  a -= c;  a ^= rot(c,16);  c += b; \
+  b -= a;  b ^= rot(a,19);  a += c; \
+  c -= b;  c ^= rot(b, 4);  b += a; \
+}
+
+#define final(a,b,c) \
+{ \
+  c ^= b; c -= rot(b,14); \
+  a ^= c; a -= rot(c,11); \
+  b ^= a; b -= rot(a,25); \
+  c ^= b; c -= rot(b,16); \
+  a ^= c; a -= rot(c,4);  \
+  b ^= a; b -= rot(a,14); \
+  c ^= b; c -= rot(b,24); \
+}
+
+static inline
+uint32_t hashlittle( const void *key, size_t length, uint32_t initval)
+{
+  uint32_t a,b,c;                                          /* internal state */
+  union { const void *ptr; size_t i; } u;     /* needed for Mac Powerbook G4 */
+
+  /* Set up the internal state */
+  a = b = c = 0xdeadbeef + ((uint32_t)length) + initval;
+
+  u.ptr = key;
+  if (HASH_LITTLE_ENDIAN && ((u.i & 0x3) == 0)) {
+    const uint32_t *k = (const uint32_t *)key;         /* read 32-bit chunks */
+
+    /*------ all but last block: aligned reads and affect 32 bits of (a,b,c) */
+    while (length > 12)
+    {
+      a += k[0];
+      b += k[1];
+      c += k[2];
+      mix(a,b,c);
+      length -= 12;
+      k += 3;
+    }
+
+    /*----------------------------- handle the last (probably partial) block */
+    /*
+     * "k[2]&0xffffff" actually reads beyond the end of the string, but
+     * then masks off the part it's not allowed to read.  Because the
+     * string is aligned, the masked-off tail is in the same word as the
+     * rest of the string.  Every machine with memory protection I've seen
+     * does it on word boundaries, so is OK with this.  But VALGRIND will
+     * still catch it and complain.  The masking trick does make the hash
+     * noticably faster for short strings (like English words).
+     */
+#ifndef VALGRIND
+
+    switch(length)
+    {
+    case 12: c+=k[2]; b+=k[1]; a+=k[0]; break;
+    case 11: c+=k[2]&0xffffff; b+=k[1]; a+=k[0]; break;
+    case 10: c+=k[2]&0xffff; b+=k[1]; a+=k[0]; break;
+    case 9 : c+=k[2]&0xff; b+=k[1]; a+=k[0]; break;
+    case 8 : b+=k[1]; a+=k[0]; break;
+    case 7 : b+=k[1]&0xffffff; a+=k[0]; break;
+    case 6 : b+=k[1]&0xffff; a+=k[0]; break;
+    case 5 : b+=k[1]&0xff; a+=k[0]; break;
+    case 4 : a+=k[0]; break;
+    case 3 : a+=k[0]&0xffffff; break;
+    case 2 : a+=k[0]&0xffff; break;
+    case 1 : a+=k[0]&0xff; break;
+    case 0 : return c;              /* zero length strings require no mixing */
+    }
+
+#else /* make valgrind happy */
+
+    k8 = (const uint8_t *)k;
+    switch(length)
+    {
+    case 12: c+=k[2]; b+=k[1]; a+=k[0]; break;
+    case 11: c+=((uint32_t)k8[10])<<16;  /* fall through */
+    case 10: c+=((uint32_t)k8[9])<<8;    /* fall through */
+    case 9 : c+=k8[8];                   /* fall through */
+    case 8 : b+=k[1]; a+=k[0]; break;
+    case 7 : b+=((uint32_t)k8[6])<<16;   /* fall through */
+    case 6 : b+=((uint32_t)k8[5])<<8;    /* fall through */
+    case 5 : b+=k8[4];                   /* fall through */
+    case 4 : a+=k[0]; break;
+    case 3 : a+=((uint32_t)k8[2])<<16;   /* fall through */
+    case 2 : a+=((uint32_t)k8[1])<<8;    /* fall through */
+    case 1 : a+=k8[0]; break;
+    case 0 : return c;
+    }
+
+#endif /* !valgrind */
+
+  } else if (HASH_LITTLE_ENDIAN && ((u.i & 0x1) == 0)) {
+    const uint16_t *k = (const uint16_t *)key;         /* read 16-bit chunks */
+    const uint8_t  *k8;
+
+    /*--------------- all but last block: aligned reads and different mixing */
+    while (length > 12)
+    {
+      a += k[0] + (((uint32_t)k[1])<<16);
+      b += k[2] + (((uint32_t)k[3])<<16);
+      c += k[4] + (((uint32_t)k[5])<<16);
+      mix(a,b,c);
+      length -= 12;
+      k += 6;
+    }
+
+    /*----------------------------- handle the last (probably partial) block */
+    k8 = (const uint8_t *)k;
+    switch(length)
+    {
+    case 12: c+=k[4]+(((uint32_t)k[5])<<16);
+             b+=k[2]+(((uint32_t)k[3])<<16);
+             a+=k[0]+(((uint32_t)k[1])<<16);
+             break;
+    case 11: c+=((uint32_t)k8[10])<<16;     /* fall through */
+    case 10: c+=k[4];
+             b+=k[2]+(((uint32_t)k[3])<<16);
+             a+=k[0]+(((uint32_t)k[1])<<16);
+             break;
+    case 9 : c+=k8[8];                      /* fall through */
+    case 8 : b+=k[2]+(((uint32_t)k[3])<<16);
+             a+=k[0]+(((uint32_t)k[1])<<16);
+             break;
+    case 7 : b+=((uint32_t)k8[6])<<16;      /* fall through */
+    case 6 : b+=k[2];
+             a+=k[0]+(((uint32_t)k[1])<<16);
+             break;
+    case 5 : b+=k8[4];                      /* fall through */
+    case 4 : a+=k[0]+(((uint32_t)k[1])<<16);
+             break;
+    case 3 : a+=((uint32_t)k8[2])<<16;      /* fall through */
+    case 2 : a+=k[0];
+             break;
+    case 1 : a+=k8[0];
+             break;
+    case 0 : return c;                     /* zero length requires no mixing */
+    }
+
+  } else {                        /* need to read the key one byte at a time */
+    const uint8_t *k = (const uint8_t *)key;
+
+    /*--------------- all but the last block: affect some 32 bits of (a,b,c) */
+    while (length > 12)
+    {
+      a += k[0];
+      a += ((uint32_t)k[1])<<8;
+      a += ((uint32_t)k[2])<<16;
+      a += ((uint32_t)k[3])<<24;
+      b += k[4];
+      b += ((uint32_t)k[5])<<8;
+      b += ((uint32_t)k[6])<<16;
+      b += ((uint32_t)k[7])<<24;
+      c += k[8];
+      c += ((uint32_t)k[9])<<8;
+      c += ((uint32_t)k[10])<<16;
+      c += ((uint32_t)k[11])<<24;
+      mix(a,b,c);
+      length -= 12;
+      k += 12;
+    }
+
+    /*-------------------------------- last block: affect all 32 bits of (c) */
+    switch(length)                   /* all the case statements fall through */
+    {
+    case 12: c+=((uint32_t)k[11])<<24;
+    case 11: c+=((uint32_t)k[10])<<16;
+    case 10: c+=((uint32_t)k[9])<<8;
+    case 9 : c+=k[8];
+    case 8 : b+=((uint32_t)k[7])<<24;
+    case 7 : b+=((uint32_t)k[6])<<16;
+    case 6 : b+=((uint32_t)k[5])<<8;
+    case 5 : b+=k[4];
+    case 4 : a+=((uint32_t)k[3])<<24;
+    case 3 : a+=((uint32_t)k[2])<<16;
+    case 2 : a+=((uint32_t)k[1])<<8;
+    case 1 : a+=k[0];
+             break;
+    case 0 : return c;
+    }
+  }
+
+  final(a,b,c);
+  return c;
+}
+
+/* Helpers */
+
+#define HASH_INITVAL 1
+#define hash(buf, len)  (hash_t)hashlittle(buf, len, HASH_INITVAL)
+#define hash_struct(buf) hash(buf, sizeof(buf))
+
+#endif /* UTIL_JENKINS_HASH_H */
diff --git a/ctrl/libhicnctrl/src/util/ip_address.h b/ctrl/libhicnctrl/src/util/ip_address.h
new file mode 100644
index 000000000..472cceeea
--- /dev/null
+++ b/ctrl/libhicnctrl/src/util/ip_address.h
@@ -0,0 +1,316 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file ip_address.h
+ * \brief IP address type support
+ */
+#ifndef UTIL_IP_ADDRESS_H
+#define UTIL_IP_ADDRESS_H
+
+#include <arpa/inet.h>  // inet_ntop
+#ifdef __APPLE__
+#include <libkern/OSByteOrder.h>
+#define __bswap_constant_32(x) OSSwapInt32(x)
+#include <machine/endian.h>
+#else
+#ifdef __ANDROID__
+#include <byteswap.h>
+#endif
+#include <endian.h>
+#endif
+#include <errno.h>
+#include <netdb.h> // struct addrinfo
+#include <netinet/in.h> // INET*_ADDRSTRLEN, IN*ADDR_LOOPBACK
+#include <stdlib.h>
+#include <string.h> // memset
+
+#include "types.h"
+
+
+#define bytes_to_bits(x) (x * 8)
+#define IPV6_ADDR_LEN 16	/* bytes */
+#define IPV4_ADDR_LEN 4		/* bytes */
+#define IPV6_ADDR_LEN_BITS bytes_to_bits(IPV6_ADDR_LEN)
+#define IPV4_ADDR_LEN_BITS bytes_to_bits(IPV4_ADDR_LEN)
+
+#define IP_MAX_ADDR_LEN IPV6_ADDR_LEN
+
+#define DUMMY_PORT 1234
+
+typedef union {
+    union {
+        struct in_addr as_inaddr;
+        u8 as_u8[4];
+        u16 as_u16[2];
+        u32 as_u32;
+    } v4;
+    union {
+        struct in6_addr as_in6addr;
+        u8 as_u8[16];
+        u16 as_u16[8];
+        u32 as_u32[4];
+        u64 as_u64[2];
+    } v6;
+    u8 buffer[IP_MAX_ADDR_LEN];
+    u8 as_u8[IP_MAX_ADDR_LEN];
+    u16 as_u16[IP_MAX_ADDR_LEN >> 1];
+    u32 as_u32[IP_MAX_ADDR_LEN >> 2];
+    u64 as_u64[IP_MAX_ADDR_LEN >> 3];
+} ip_address_t;
+
+#define MAXSZ_IP4_ADDRESS_ INET_ADDRSTRLEN - 1
+#define MAXSZ_IP6_ADDRESS_ INET6_ADDRSTRLEN - 1
+#define MAXSZ_IP_ADDRESS_ MAXSZ_IP6_ADDRESS_
+#define MAXSZ_IP4_ADDRESS MAXSZ_IP4_ADDRESS_ + 1
+#define MAXSZ_IP6_ADDRESS MAXSZ_IP6_ADDRESS_ + 1
+#define MAXSZ_IP_ADDRESS MAXSZ_IP_ADDRESS_ + 1
+
+
+typedef struct {
+  int family;
+  ip_address_t address;
+  u8 len;
+} ip_prefix_t;
+
+#define MAXSZ_PREFIX_ MAXSZ_IP_ADDRESS_ + 1 + 3
+#define MAXSZ_PREFIX MAXSZ_PREFIX_ + 1
+
+/* No htonl() with const */
+static const ip_address_t IPV4_LOOPBACK = {
+#if __BYTE_ORDER == __LITTLE_ENDIAN
+#ifdef __ANDROID__
+    .v4.as_inaddr.s_addr = bswap_32(INADDR_LOOPBACK),
+#else
+    .v4.as_inaddr.s_addr = __bswap_constant_32(INADDR_LOOPBACK),
+#endif
+#else
+    .v4.as_inaddr.s_addr = INADDR_LOOPBACK,
+#endif
+};
+
+static const ip_address_t IPV6_LOOPBACK = {
+    .v6.as_in6addr = IN6ADDR_LOOPBACK_INIT,
+};
+
+static const ip_address_t IPV4_ANY = {
+    .v4.as_inaddr.s_addr = INADDR_ANY,
+};
+
+static const ip_address_t IPV6_ANY = {
+    .v6.as_in6addr = IN6ADDR_ANY_INIT,
+};
+
+#define IP_ANY(family) (family == AF_INET) ? IPV4_ANY : IPV6_ANY
+
+#define MAX_PORT 1 << (8 * sizeof(u16))
+#define IS_VALID_PORT(x) ((x > 0) && (x < MAX_PORT))
+
+#define MAXSZ_PORT_ 5
+#define MAXSZ_PORT MAXSZ_PORT_ + 1
+
+#define IS_VALID_FAMILY(x) ((x == AF_INET) || (x == AF_INET6))
+
+static inline
+int
+ip_address_get_family (const char * ip_address)
+{
+  struct addrinfo hint, *res = NULL;
+  int rc;
+
+  memset (&hint, '\0', sizeof hint);
+
+  hint.ai_family = PF_UNSPEC;
+  hint.ai_flags = AI_NUMERICHOST;
+
+  rc = getaddrinfo (ip_address, NULL, &hint, &res);
+  if (rc)
+    {
+      return -1;
+    }
+  rc = res->ai_family;
+  freeaddrinfo (res);
+  return rc;
+}
+
+static inline
+int
+ip_address_len (const ip_address_t * ip_address, int family)
+{
+  return (family == AF_INET6) ? IPV6_ADDR_LEN :
+    (family == AF_INET) ? IPV4_ADDR_LEN : 0;
+}
+
+static inline
+int
+ip_address_ntop (const ip_address_t * ip_address, char *dst, const size_t len,
+		int family)
+{
+  const char * s = inet_ntop (family, ip_address->buffer, dst, len);
+  return (s ? 1 : -1);
+}
+
+/*
+ * Parse ip addresses in presentation format
+ */
+static inline
+int
+ip_address_pton (const char *ip_address_str, ip_address_t * ip_address)
+{
+  int pton_fd;
+  char *addr = strdup (ip_address_str);
+  int family;
+
+
+  family = ip_address_get_family (addr);
+
+  switch (family)
+    {
+    case AF_INET6:
+      pton_fd = inet_pton (AF_INET6, addr, &ip_address->buffer);
+      break;
+    case AF_INET:
+      pton_fd = inet_pton (AF_INET, addr, &ip_address->buffer);
+      break;
+    default:
+      goto ERR;
+    }
+
+  //   0 = not in presentation format
+  // < 0 = other error (use perror)
+  if (pton_fd <= 0)
+    {
+      goto ERR;
+    }
+
+  return 1;
+ERR:
+  free (addr);
+  return -1;
+}
+
+
+
+static inline
+int
+ip_address_snprintf(char * s, size_t size, const ip_address_t * ip_address, int family)
+{
+    size_t len = family == AF_INET ? INET_ADDRSTRLEN : INET6_ADDRSTRLEN;
+    const char * rc = inet_ntop (family, ip_address->buffer, s, len);
+    return rc ? strlen(rc) : -1;
+}
+
+
+static inline
+int
+ip_address_to_sockaddr(const ip_address_t * ip_address,
+		struct sockaddr *sockaddr_address, int family)
+{
+  struct sockaddr_in6 *tmp6 = (struct sockaddr_in6 *) sockaddr_address;
+  struct sockaddr_in *tmp4 = (struct sockaddr_in *) sockaddr_address;
+
+  switch (family)
+    {
+    case AF_INET6:
+      tmp6->sin6_family = AF_INET6;
+      tmp6->sin6_port = DUMMY_PORT;
+      tmp6->sin6_scope_id = 0;
+      memcpy (&tmp6->sin6_addr, ip_address->buffer, IPV6_ADDR_LEN);
+      break;
+    case AF_INET:
+      tmp4->sin_family = AF_INET;
+      tmp4->sin_port = DUMMY_PORT;
+      memcpy (&tmp4->sin_addr, ip_address->buffer, IPV4_ADDR_LEN);
+      break;
+    default:
+      return -1;
+    }
+
+  return 1;
+}
+
+static inline
+int
+ip_address_cmp(const ip_address_t * ip1, const ip_address_t * ip2, int family)
+{
+    return memcmp(ip1, ip2, ip_address_len(ip1, family));
+}
+
+/* Parse IP Prefixes in presentation format (in bits, separated by a slash) */
+static inline
+int
+ip_prefix_pton (const char *ip_address_str, ip_prefix_t * ip_prefix)
+{
+  int pton_fd;
+  char *p;
+  char *eptr;
+  char *addr = strdup (ip_address_str);
+
+  p = strchr (addr, '/');
+  if (!p)
+    {
+      ip_prefix->len = 0;		// until we get the ip address family
+    }
+  else
+    {
+      ip_prefix->len = strtoul (p + 1, &eptr, 10);
+      *p = 0;
+    }
+
+  ip_prefix->family = ip_address_get_family (addr);
+
+  switch (ip_prefix->family)
+    {
+    case AF_INET6:
+      if (ip_prefix->len > IPV6_ADDR_LEN_BITS)
+	goto ERR;
+      pton_fd = inet_pton (AF_INET6, addr, &ip_prefix->address.buffer);
+      break;
+    case AF_INET:
+      if (ip_prefix->len > IPV4_ADDR_LEN_BITS)
+	goto ERR;
+      pton_fd = inet_pton (AF_INET, addr, &ip_prefix->address.buffer);
+      break;
+    default:
+      goto ERR;
+    }
+
+  //   0 = not in presentation format
+  // < 0 = other error (use perror)
+  if (pton_fd <= 0)
+    {
+      goto ERR;
+    }
+
+  return 1;
+ERR:
+  free (addr);
+  return -1;
+}
+
+static inline
+int
+ip_prefix_ntop (const ip_prefix_t * ip_prefix, char *dst, size_t size)
+{
+  char ip_s[MAXSZ_IP_ADDRESS];
+  const char * s = inet_ntop (ip_prefix->family, ip_prefix->address.buffer, ip_s, MAXSZ_IP_ADDRESS);
+  if (!s)
+      return -1;
+  size_t n = snprintf(dst, size, "%s/%d", ip_s, ip_prefix->len);
+
+  return (n > 0 ? 1 : -1);
+}
+
+#endif /* UTIL_IP_ADDRESS_H */
diff --git a/ctrl/libhicnctrl/src/util/log.c b/ctrl/libhicnctrl/src/util/log.c
new file mode 100644
index 000000000..54943cf45
--- /dev/null
+++ b/ctrl/libhicnctrl/src/util/log.c
@@ -0,0 +1,126 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "log.h"
+
+#include <stdarg.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+log_conf_t log_conf = DEFAULT_LOG_CONF;
+
+#define FMT_DATETIME "%02d-%02d-%04d %02d:%02d:%02d"
+#define FMT_DATETIME_LEN 20
+#define snprintf_nowarn(...) (snprintf(__VA_ARGS__) < 0 ? abort() : (void)0)
+
+
+static char ts[FMT_DATETIME_LEN];
+
+static char *timestamp(void)
+{
+	time_t tv;
+	struct tm *tm;
+
+	time(&tv);
+	tm = localtime(&tv);
+
+        snprintf_nowarn(ts, FMT_DATETIME_LEN, FMT_DATETIME, tm->tm_mday,
+                tm->tm_mon + 1, tm->tm_year + 1900, tm->tm_hour, tm->tm_min,
+                tm->tm_sec);
+	return ts;
+}
+
+void _log_va(int level, const char *fmt, va_list ap)
+{
+	char *prefix;
+  FILE *f = log_conf.log_file ? log_conf.log_file : stdout;
+
+#if 0
+	if (!conf.log_system)
+		return;
+#endif
+
+	if (level > log_conf.log_level)
+		return;
+
+	switch (level) {
+		case LOG_FATAL:
+			prefix = "FATAL: ";
+			break;
+		case LOG_ERROR:
+			prefix = "ERROR: ";
+			break;
+		case LOG_WARN:
+			prefix = "WARNING: ";
+			break;
+		case LOG_INFO:
+			prefix = "";
+			break;
+		case LOG_DEBUG:
+			prefix = "DEBUG: ";
+			break;
+		case LOG_TRACE:
+			prefix = "TRACE: ";
+			break;
+		default:
+			prefix = "";
+			break;
+	}
+
+	fprintf(f, "%s %s", timestamp(), prefix);
+	vfprintf(f, fmt, ap);
+	fprintf(f, "\n");
+#ifdef DEBUG
+	fflush(f);
+#endif
+}
+
+void _log(int level, const char *fmt, ...)
+{
+	va_list ap;
+
+	va_start(ap, fmt);
+	_log_va(level, fmt, ap);
+	va_end(ap);
+}
+
+#ifdef HAVE_BACKTRACE
+#include <execinfo.h>
+
+void print_trace(void)
+{
+	void *array[32];
+	size_t size;
+
+	size = backtrace(array, 32);
+	fflush(conf.log_file);
+	backtrace_symbols_fd(array, size, fileno(conf.log_file));
+}
+#endif
+
+void fatal(char *fmt, ...)
+{
+	va_list ap;
+
+	va_start(ap, fmt);
+	_log_va(LOG_FATAL, fmt, ap);
+	va_end(ap);
+
+#ifdef HAVE_BACKTRACE
+	print_trace();
+#endif
+
+	exit(200);
+}
diff --git a/ctrl/libhicnctrl/src/util/log.h b/ctrl/libhicnctrl/src/util/log.h
new file mode 100644
index 000000000..f1cafba47
--- /dev/null
+++ b/ctrl/libhicnctrl/src/util/log.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef UTIL_LOG_H
+#define UTIL_LOG_H
+
+#include <stdarg.h> // va_*
+#include <stdio.h> // FILE
+#include <time.h> // time, localtime
+
+#define LOG_FATAL 0
+#define LOG_ERROR 1
+#define LOG_WARN  2
+#define LOG_INFO  3
+#define LOG_DEBUG 4
+#define LOG_TRACE 5
+
+typedef struct {
+  int log_level;
+  int debug;
+  FILE * log_file;
+} log_conf_t;
+
+#define DEFAULT_LOG_CONF {      \
+    .log_level = LOG_DEBUG,     \
+    .debug = 0,                 \
+    .log_file = NULL,           \
+};
+
+extern log_conf_t log_conf;
+
+#define WITH_DEBUG(BLOCK)                       \
+    if (log_conf.log_level >= LOG_DEBUG)        \
+        BLOCK
+
+#define FATAL(fmt, ...) (_log(LOG_FATAL, fmt, ##__VA_ARGS__ ))
+#define ERROR(fmt, ...) (_log(LOG_ERROR, fmt, ##__VA_ARGS__ ))
+#define WARN(fmt,  ...) (_log(LOG_WARN,  fmt, ##__VA_ARGS__ ))
+#define INFO(fmt,  ...) (_log(LOG_INFO,  fmt, ##__VA_ARGS__ ))
+#define DEBUG(fmt, ...) (_log(LOG_DEBUG, fmt, ##__VA_ARGS__ ))
+#define TRACE(fmt, ...) (_log(LOG_TRACE, fmt, ##__VA_ARGS__ ))
+
+void _log_va(int level, const char *fmt, va_list ap);
+
+void _log(int level, const char *fmt, ...);
+
+void fatal(char *fmt, ...);
+
+#ifdef HAVE_BACKTRACE
+#include <execinfo.h>
+void print_trace(void);
+#endif
+
+#endif // UTIL_LOG_H
diff --git a/ctrl/libhicnctrl/src/util/policy.c b/ctrl/libhicnctrl/src/util/policy.c
new file mode 100644
index 000000000..90dbc72cd
--- /dev/null
+++ b/ctrl/libhicnctrl/src/util/policy.c
@@ -0,0 +1,53 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file policy.h
+ * \brief Implementation of policy description
+ */
+
+#include <stdio.h>
+#include "policy.h"
+
+const char * policy_tag_str[] = {
+    #define _(x) [POLICY_TAG_ ## x] = STRINGIZE(x),
+    foreach_policy_tag
+    #undef _
+};
+
+const char * policy_state_str[] = {
+    #define _(x) [POLICY_STATE_ ## x] = STRINGIZE(x),
+    foreach_policy_state
+    #undef _
+};
+
+int
+policy_tag_state_snprintf(char * s, size_t size, const policy_tag_state_t * tag_state)
+{
+    char *cur = s;
+    int rc;
+
+    if (tag_state->disabled > 1)
+        return -1;
+
+    rc = snprintf(cur, s + size - cur, "%s%s", (tag_state->disabled == 1) ? "!" : "", policy_state_str[tag_state->state]);
+    if (rc < 0)
+        return rc;
+    cur += rc;
+    if (size != 0 && cur >= s + size)
+        return cur - s;
+
+    return cur - s;
+}
diff --git a/ctrl/libhicnctrl/src/util/policy.h b/ctrl/libhicnctrl/src/util/policy.h
new file mode 100644
index 000000000..231e53f73
--- /dev/null
+++ b/ctrl/libhicnctrl/src/util/policy.h
@@ -0,0 +1,266 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file policy.h
+ * \brief Policy description
+ */
+#ifndef HICN_POLICY_H
+#define HICN_POLICY_H
+
+#include <netinet/in.h> // INET*_ADDRSTRLEN
+#include "token.h"
+
+/* POLICY TAG */
+
+#define foreach_policy_tag      \
+    /* Interface type */        \
+    _(WIRED)                    \
+    _(WIFI)                     \
+    _(CELLULAR)                 \
+    /* QoS */                   \
+    _(BEST_EFFORT)              \
+    _(REALTIME)                 \
+    _(MULTIPATH)                \
+    /* Security */              \
+    _(TRUSTED)
+
+typedef enum {
+#define _(x) POLICY_TAG_ ## x,
+foreach_policy_tag
+#undef _
+    POLICY_TAG_N
+} policy_tag_t;
+
+#define MAXSZ_POLICY_TAG_ 11
+#define MAXSZ_POLICY_TAG MAXSZ_POLICY_TAG_ + 1
+
+extern const char * policy_tag_str[];
+
+
+/* POLICY_TAGS */
+
+typedef int policy_tags_t;
+
+static inline
+void policy_tags_add(policy_tags_t * tags, policy_tag_t tag)
+{
+    *tags |= (1 << tag);
+}
+
+static inline
+void policy_tags_remove(policy_tags_t * tags, policy_tag_t tag)
+{
+    *tags &= ~(1 << tag);
+}
+
+static inline
+int policy_tags_has(policy_tags_t tags, policy_tag_t tag)
+{
+    return tags & (1 << tag);
+}
+
+#define POLICY_TAGS_EMPTY 0
+
+
+/* POLICY STATE */
+
+/* TODO vs. weight */
+
+#define foreach_policy_state    \
+    _(NEUTRAL)                  \
+    _(REQUIRE)                  \
+    _(PREFER)                   \
+    _(AVOID)                    \
+    _(PROHIBIT)                 \
+    _(N)
+
+typedef enum {
+#define _(x) POLICY_STATE_ ## x,
+foreach_policy_state
+#undef _
+} policy_state_t;
+
+#define MAXSZ_POLICY_STATE_ 8
+#define MAXSZ_POLICY_STATE MAXSZ_POLICY_STATE_ + 1
+
+extern const char * policy_state_str[];
+
+
+/* POLICY TAG STATE */
+
+typedef struct {
+    policy_state_t state;
+    uint8_t disabled;
+} policy_tag_state_t;
+
+#define MAXSZ_POLICY_TAG_STATE_ 8
+#define MAXSZ_POLICY_TAG_STATE MAXSZ_POLICY_TAG_STATE_ + 1
+
+int policy_tag_state_snprintf(char * s, size_t size, const policy_tag_state_t * tag_state);
+
+
+/* INTERFACE STATS */
+
+typedef struct {
+    float throughput;
+    float latency;
+    float loss_rate;
+} interface_stats_t;
+
+#define INTERFACE_STATS_NONE {                          \
+    .throughput = 0,                                    \
+    .latency = 0,                                       \
+    .loss_rate = 0,                                     \
+}
+
+
+/* POLICY STATS */
+
+typedef struct {
+    interface_stats_t wired;
+    interface_stats_t wifi;
+    interface_stats_t cellular;
+    interface_stats_t all;
+} policy_stats_t;
+
+#define POLICY_STATS_NONE {                     \
+    .wired    = INTERFACE_STATS_NONE,           \
+    .wifi     = INTERFACE_STATS_NONE,           \
+    .cellular = INTERFACE_STATS_NONE,           \
+    .all      = INTERFACE_STATS_NONE,           \
+}
+
+typedef struct {
+    uint32_t num_packets;
+    uint32_t num_bytes;
+    uint32_t num_losses;
+    uint32_t latency_idle;
+} interface_counters_t;
+
+#define INTERFACE_COUNTERS_NONE {               \
+    .num_packets = 0,                           \
+    .num_bytes = 0,                             \
+    .num_losses = 0,                            \
+    .latency_idle = 0,                          \
+}
+
+typedef struct {
+    interface_counters_t wired;
+    interface_counters_t wifi;
+    interface_counters_t cellular;
+    interface_counters_t all;
+    uint64_t last_update;
+} policy_counters_t;
+
+#define POLICY_COUNTERS_NONE (policy_counters_t) {      \
+    .wired    = INTERFACE_COUNTERS_NONE,                \
+    .wifi     = INTERFACE_COUNTERS_NONE,                \
+    .cellular = INTERFACE_COUNTERS_NONE,                \
+    .all      = INTERFACE_COUNTERS_NONE,                \
+    .last_update = 0,                                   \
+}
+
+/* POLICY */
+
+#define APP_NAME_LEN 128
+
+typedef struct {
+    char app_name[APP_NAME_LEN];
+    policy_tag_state_t tags[POLICY_TAG_N];
+    policy_stats_t stats;
+} policy_t;
+
+static const policy_t POLICY_NONE = {
+    .app_name = { 0 },
+    .tags = {
+#define _(x) [POLICY_TAG_ ## x] = { POLICY_STATE_NEUTRAL, 0 },
+foreach_policy_tag
+#undef _
+    },
+    .stats = POLICY_STATS_NONE,
+};
+
+
+/* POLICY DESCRIPTION */
+
+#define PFX_STRLEN 4 /* eg. /128 */
+
+typedef struct {
+    int family;
+    union {
+        char ipv4_prefix[INET_ADDRSTRLEN + PFX_STRLEN];
+        char ipv6_prefix[INET6_ADDRSTRLEN + PFX_STRLEN];
+    };
+    policy_t policy;
+} policy_description_t;
+
+/* DEFAULT POLICY */
+
+static const policy_description_t default_policy[] = {
+    {
+        .family = AF_INET6,
+        .ipv6_prefix = "a001::/16",
+        .policy = {
+            .app_name = "Webex",
+            .tags  = {
+                [POLICY_TAG_WIRED]       = { POLICY_STATE_PREFER,   0 },
+                [POLICY_TAG_WIFI]        = { POLICY_STATE_NEUTRAL,  0 },
+                [POLICY_TAG_CELLULAR]    = { POLICY_STATE_AVOID,    1 },
+                [POLICY_TAG_BEST_EFFORT] = { POLICY_STATE_PROHIBIT, 0 },
+                [POLICY_TAG_REALTIME]    = { POLICY_STATE_REQUIRE,  1 },
+                [POLICY_TAG_MULTIPATH]   = { POLICY_STATE_AVOID,    0 },
+                [POLICY_TAG_TRUSTED]     = { POLICY_STATE_REQUIRE,  1 },
+            },
+            .stats = POLICY_STATS_NONE,
+        },
+    },
+    {
+        .family = AF_INET6,
+        .ipv6_prefix = "b001::/16",
+        .policy = {
+            .app_name = "Video Streaming",
+            .tags  = {
+                [POLICY_TAG_WIRED]       = { POLICY_STATE_PREFER,   0 },
+                [POLICY_TAG_WIFI]        = { POLICY_STATE_NEUTRAL,  0 },
+                [POLICY_TAG_CELLULAR]    = { POLICY_STATE_NEUTRAL,  0 },
+                [POLICY_TAG_BEST_EFFORT] = { POLICY_STATE_PROHIBIT, 0 },
+                [POLICY_TAG_REALTIME]    = { POLICY_STATE_REQUIRE,  0 },
+                [POLICY_TAG_MULTIPATH]   = { POLICY_STATE_AVOID,    0 },
+                [POLICY_TAG_TRUSTED]     = { POLICY_STATE_PREFER,   0 },
+            },
+            .stats = POLICY_STATS_NONE,
+        },
+    },
+    {
+        .family = AF_INET6,
+        .ipv6_prefix = "c001::/16",
+        .policy = {
+            .app_name = "*",
+            .tags  = {
+                [POLICY_TAG_WIRED]       = { POLICY_STATE_PREFER,   0 },
+                [POLICY_TAG_WIFI]        = { POLICY_STATE_NEUTRAL,  0 },
+                [POLICY_TAG_CELLULAR]    = { POLICY_STATE_NEUTRAL,  0 },
+                [POLICY_TAG_BEST_EFFORT] = { POLICY_STATE_PROHIBIT, 0 },
+                [POLICY_TAG_REALTIME]    = { POLICY_STATE_REQUIRE,  0 },
+                [POLICY_TAG_MULTIPATH]   = { POLICY_STATE_AVOID,    0 },
+                [POLICY_TAG_TRUSTED]     = { POLICY_STATE_PROHIBIT, 1 },
+            },
+            .stats = POLICY_STATS_NONE,
+        },
+    },
+};
+
+#endif /* HICN_POLICY_H */
diff --git a/ctrl/libhicnctrl/src/util/token.h b/ctrl/libhicnctrl/src/util/token.h
new file mode 100644
index 000000000..43e0a77b2
--- /dev/null
+++ b/ctrl/libhicnctrl/src/util/token.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/* Token concatenation */
+
+/*
+ * Concatenate preprocessor tokens A and B without expanding macro definitions
+ * (however, if invoked from a macro, macro arguments are expanded).
+ */
+#define PPCAT_NX(A, B) A ## B
+
+/*
+ * Concatenate preprocessor tokens A and B after macro-expanding them.
+ */
+#define PPCAT(A, B) PPCAT_NX(A, B)
+
+/* Token stringification */
+
+/*
+ * Turn A into a string literal without expanding macro definitions
+ * (however, if invoked from a macro, macro arguments are expanded).
+ */
+#define STRINGIZE_NX(A) #A
+
+/*
+ * Turn A into a string literal after macro-expanding it.
+ */
+#define STRINGIZE(A) STRINGIZE_NX(A)
diff --git a/ctrl/libhicnctrl/src/util/types.h b/ctrl/libhicnctrl/src/util/types.h
new file mode 100644
index 000000000..10a0bdca0
--- /dev/null
+++ b/ctrl/libhicnctrl/src/util/types.h
@@ -0,0 +1,36 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef UTIL_TYPES
+#define UTIL_TYPES
+
+typedef uint8_t u8;
+typedef uint16_t u16;
+typedef uint32_t u32;
+typedef uint64_t u64;
+
+/* Helper for avoiding warnings about type-punning */
+#define UNION_CAST(x, destType) \
+   (((union {__typeof__(x) a; destType b;})x).b)
+
+typedef unsigned int hash_t;
+
+typedef int (*cmp_t)(const void *, const void *);
+
+/* Enums */
+
+#define IS_VALID_ENUM_TYPE(NAME, x) ((x > NAME ## _UNDEFINED) && (x < NAME ## _N))
+
+#endif /* UTIL_TYPES */