[HICN-252] Add per-application policy framework to hicn-light forwarder

Change-Id: I0531cd7a7de179581295ae34766c81cd9cf3e172
Signed-off-by: Jordan Augé <jordan.auge+fdio@cisco.com>
Signed-off-by: Mauro Sardara <msardara@cisco.com>
Co-authored-by: Mauro Sardara <msardara@cisco.com>

21 files changed, 5576 insertions, 0 deletions

diff --git a/ctrl/libhicnctrl/.gitignore b/ctrl/libhicnctrl/.gitignore
new file mode 100644
index 000000000..c6127b38c
--- /dev/null
+++ b/ctrl/libhicnctrl/.gitignore
@@ -0,0 +1,52 @@
+# Prerequisites
+*.d
+
+# Object files
+*.o
+*.ko
+*.obj
+*.elf
+
+# Linker output
+*.ilk
+*.map
+*.exp
+
+# Precompiled Headers
+*.gch
+*.pch
+
+# Libraries
+*.lib
+*.a
+*.la
+*.lo
+
+# Shared objects (inc. Windows DLLs)
+*.dll
+*.so
+*.so.*
+*.dylib
+
+# Executables
+*.exe
+*.out
+*.app
+*.i*86
+*.x86_64
+*.hex
+
+# Debug files
+*.dSYM/
+*.su
+*.idb
+*.pdb
+
+# Kernel Module Compile Results
+*.mod*
+*.cmd
+.tmp_versions/
+modules.order
+Module.symvers
+Mkfile.old
+dkms.conf
diff --git a/ctrl/libhicnctrl/CMakeLists.txt b/ctrl/libhicnctrl/CMakeLists.txt
new file mode 100644
index 000000000..3a2358f65
--- /dev/null
+++ b/ctrl/libhicnctrl/CMakeLists.txt
@@ -0,0 +1,53 @@
+# Copyright (c) 2017-2019 Cisco and/or its affiliates.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+cmake_minimum_required(VERSION 3.5 FATAL_ERROR)
+
+project(libhicnctrl)
+
+if (NOT CMAKE_BUILD_TYPE)
+    message(STATUS "No build type selected, default to Release")
+    set(CMAKE_BUILD_TYPE "Release")
+endif()
+
+set(CMAKE_MODULE_PATH
+  ${CMAKE_MODULE_PATH}
+  "${CMAKE_CURRENT_SOURCE_DIR}/../../cmake/Modules"
+  "${CMAKE_CURRENT_SOURCE_DIR}/cmake/Modules"
+)
+
+set(CMAKE_C_STANDARD 11)
+set(CMAKE_C_STANDARD_REQUIRED ON)
+
+set(CMAKE_MACOSX_RPATH ON)
+
+if(CMAKE_SOURCE_DIR STREQUAL PROJECT_SOURCE_DIR)
+  set(HICN_CTRL hicn-ctrl)
+  set(LIBHICN_CTRL hicn-ctrl)
+  set(LIBHICN_CTRL_SHARED ${LIBHICNCTRL}.shared)
+  set(LIBHICN_CTRL_STATIC ${LIBHICNCTRL}.static)
+endif()
+
+set(LIBHICNCTRL_COMPONENT lib${LIBHICN_CTRL})
+
+set(TO_INSTALL_HEADER_FILES)
+
+add_subdirectory(includes)
+add_subdirectory(src)
+
+include(Packaging)
+
+if(CMAKE_SOURCE_DIR STREQUAL PROJECT_SOURCE_DIR)
+    include(Packager)
+    make_packages()
+endif()
diff --git a/ctrl/libhicnctrl/cmake/Modules/Packaging.cmake b/ctrl/libhicnctrl/cmake/Modules/Packaging.cmake
new file mode 100644
index 000000000..cbee25d35
--- /dev/null
+++ b/ctrl/libhicnctrl/cmake/Modules/Packaging.cmake
@@ -0,0 +1,46 @@
+# Copyright (c) 2017-2019 Cisco and/or its affiliates.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+######################
+# Packages section
+######################
+
+set(${LIBHICNCTRL_COMPONENT}_DESCRIPTION
+  "hicn control library"
+  CACHE STRING "Description for deb/rpm package."
+)
+
+set(${LIBHICNCTRL_COMPONENT}-dev_DESCRIPTION
+  "hicn control library headers"
+  CACHE STRING "Description for deb/rpm package."
+)
+
+set(${LIBHICNCTRL_COMPONENT}_DEB_DEPENDENCIES
+  ""
+  CACHE STRING "Dependencies for deb/rpm package."
+)
+
+set(${LIBHICNCTRL_COMPONENT}-dev_DEB_DEPENDENCIES
+  "${LIBHICNCTRL_COMPONENT} (>= stable_version)"
+  CACHE STRING "Dependencies for deb/rpm package."
+)
+
+set(${LIBHICNCTRL_COMPONENT}_RPM_DEPENDENCIES
+  ""
+  CACHE STRING "Dependencies for deb/rpm package."
+)
+
+set(${LIBHICNCTRL_COMPONENT}-dev_RPM_DEPENDENCIES
+  "${LIBHICNCTRL_COMPONENT} >= stable_version"
+  CACHE STRING "Dependencies for deb/rpm package."
+)
\ No newline at end of file
diff --git a/ctrl/libhicnctrl/includes/CMakeLists.txt b/ctrl/libhicnctrl/includes/CMakeLists.txt
new file mode 100644
index 000000000..a85489a0c
--- /dev/null
+++ b/ctrl/libhicnctrl/includes/CMakeLists.txt
@@ -0,0 +1,26 @@
+# Copyright (c) 2017-2019 Cisco and/or its affiliates.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set(LIBHICNCTRL_INCLUDE_DIRS
+  ${CMAKE_CURRENT_SOURCE_DIR} ""
+  CACHE INTERNAL
+  "" FORCE
+)
+
+set(TO_INSTALL_HEADER_FILES
+  ${CMAKE_CURRENT_SOURCE_DIR}/ctrl.h
+  ${CMAKE_CURRENT_SOURCE_DIR}/hicn/ctrl/api.h
+  ${CMAKE_CURRENT_SOURCE_DIR}/hicn/ctrl/commands.h
+  ${CMAKE_CURRENT_SOURCE_DIR}/hicn/ctrl/face.h
+  PARENT_SCOPE
+)
\ No newline at end of file
diff --git a/ctrl/libhicnctrl/includes/ctrl.h b/ctrl/libhicnctrl/includes/ctrl.h
new file mode 120000
index 000000000..646630968
--- /dev/null
+++ b/ctrl/libhicnctrl/includes/ctrl.h
@@ -0,0 +1 @@
+hicn/ctrl.h
\ No newline at end of file
diff --git a/ctrl/libhicnctrl/includes/hicn/ctrl.h b/ctrl/libhicnctrl/includes/hicn/ctrl.h
new file mode 100644
index 000000000..e61b7a482
--- /dev/null
+++ b/ctrl/libhicnctrl/includes/hicn/ctrl.h
@@ -0,0 +1,25 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file ctrl.h
+ * \brief Main interface for hICN control library
+ */
+#ifndef HICNCTRL_H
+#define HICNCTRL_H
+
+#include <hicn/ctrl/api.h>
+
+#endif /* HICNCTRL_H */
diff --git a/ctrl/libhicnctrl/includes/hicn/ctrl/api.h b/ctrl/libhicnctrl/includes/hicn/ctrl/api.h
new file mode 100644
index 000000000..45efb39f9
--- /dev/null
+++ b/ctrl/libhicnctrl/includes/hicn/ctrl/api.h
@@ -0,0 +1,758 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file api.h
+ * \brief hICN control library API
+ *
+ * This API supports basic hICN objects (face, route, punting) plus
+ * implementation-specific ones (connection, listener). Currently, this library
+ * only supports the hicn-light forwarder.
+ *
+ * For each object, a set of methods is provided among:
+ *  - CREATE, GET, UPDATE, DELETE, LIST
+ *  - CMP, PARSE, SNPRINTF
+ *  - additionally, attribute getters and/or setters are provided and denoted
+ *    GET( attribute ) and SET( attribute )
+ *
+ * A summary per-object is presented here:
+ *
+ *              | CRE GET UPD DEL LST | VAL CMP PAR SNP | attributes [GET/SET]
+ * +------------+---------------------+-------------+---------------------------
+ * | face       |  O   O   !   O   O  |      !   !   O  | state [-S]
+ * | route      |  O   -   !   O   O  |      !   O   -  |
+ * | punting    |  !   -   !   !   !  |      !   !   !  |
+ * +------------+---------------------+-----------------+---------------------------
+ * | cache      |                     |                 | store [!!], serve [!!]
+ * | strategy   |                     |                 |
+ * | FIB        |                     |                 |
+ * | PIT        |                     |                 |
+ * | WLDR       |                     |                 |
+ * | MAP-Me     |                     |                 |
+ * +------------+---------------------+-----------------+---------------------------
+ * | connection |  O   O   !   O   O  |      O   O   O  | state [-S]
+ * | listener   |  O   O   !   -   O  |  O   O   O   O  |
+ * +------------+---------------------+-----------------+---------------------------
+ *
+ * LEGEND: [O] implemented, [!] in progress / TODO, [-] not supported
+ *
+ * NOTES:
+ *
+ *  - Different extensions of the forwarder functionalities bring both new API
+ *    calls, and new object attributes. While it is expected that the former will
+ *    only raised NACK answers because of unsupported API calls, the latter will
+ *    certainly trigger incompatibilities. It is expected that the forwarder
+ *    validates the message length and returns a NACK too. In that case, we
+ *    provide a set of defines to preserve backwards compatibility. At the
+ *    moment, those defines are :
+ *
+ *  WITH_POLICY:
+ *
+ */
+
+#ifndef HICNTRL_API
+#define HICNTRL_API
+
+#include <stdbool.h>
+#include <stdint.h>
+
+#include "face.h"
+#include "util/types.h"
+
+#define LIBHICNCTRL_SUCCESS 0
+#define LIBHICNCTRL_FAILURE -1
+#define LIBHICNCTRL_NOT_IMPLEMENTED -99
+#define LIBHICNCTRL_IS_ERROR(x) (x < 0)
+
+
+/**
+ * This allows to selectively define convenience types to avoid any collision
+ * when using the library in conjunction with other frameworks including similar
+ * defines
+ */
+#ifdef _HICNTRL_NO_DEFS
+#define _HICNTRL_NO_DEF_TYPES
+#define _HICNTRL_NO_DEF_IPADDR
+#define _HICNTRL_NO_DEF_UNIONCAST
+#endif
+
+#ifndef _HICNTRL_NO_DEF_TYPES
+typedef uint8_t u8;
+typedef uint16_t u16;
+typedef uint32_t u32;
+typedef uint64_t u64;
+#endif /* _HICNTRL_NO_DEF_TYPES */
+
+#ifndef _HICNTRL_NO_DEF_IPADDR
+#include "util/ip_address.h"
+#endif /* _HICNTRL_NO_DEF_IPADDR */
+
+#ifndef _HICNTRL_NO_DEF_UNIONCAST
+/* Helper for avoiding warnings about type-punning */
+#define UNION_CAST(x, destType) \
+   (((union {__typeof__(x) a; destType b;})x).b)
+#endif /* _HICNTRL_NO_DEF_UNIONCAST */
+
+/******************************************************************************
+ * Message helper types and aliases
+ ******************************************************************************/
+
+#define foreach_command \
+    _(UNDEFINED)        \
+    _(CREATE)           \
+    _(UPDATE)           \
+    _(DELETE)           \
+    _(LIST)             \
+    _(SET)		\
+    _(N)
+
+typedef enum {
+#define _(x) ACTION_ ## x,
+foreach_command
+#undef _
+} hc_action_t;
+
+/**
+ * \brief hICN control message header
+ */
+typedef struct hc_msg_s hc_msg_t;
+
+/******************************************************************************
+ * Control Data
+ ******************************************************************************/
+
+struct hc_data_s;
+typedef int (*data_callback_t)(struct hc_data_s *, void *);
+
+/**
+ * \brief Holds the results of an hICN control request
+ */
+typedef struct hc_data_s {
+    size_t size;
+    size_t max_size_log;
+    size_t in_element_size;
+    size_t out_element_size;
+    u8 command_id; /**< Expected message type (should give element size) */
+    u8 * buffer;
+    bool complete;
+
+    /* Callbacks */
+    data_callback_t complete_cb; // XXX int (*complete_cb)(struct hc_data_s * data);
+    void * complete_cb_data;
+} hc_data_t;
+
+/**
+ * Create a structure holding the results of an hICN control request.
+ * \result The newly create data structure.
+ */
+hc_data_t *
+hc_data_create(size_t in_element_size, size_t out_element_size);
+
+/**
+ * Free a structure holding the results of an hICN control request.
+ * \param [in] data - The data structure to free.
+ */
+void
+hc_data_free(hc_data_t * data);
+
+/**
+ * \brief Adds many new results at the end of the data structure, eventually
+ * allocating buffer space for it.
+ * \param [in] data - The data structure to which to add elements.
+ * \param [in] elements - The array of elements to add.
+ * \param [in] count - The number of elements to add.
+ * \return Error code
+ *
+ * NOTE: The size of the element should match the one declared at structure
+ * initialization.
+ */
+int
+hc_data_push_many(hc_data_t * data, const void * elements, size_t count);
+
+/**
+ * \brief Adds a new result at the end of the data structure, eventually
+ * allocating buffer space for it.
+ * \param [in] data - The data structure to which to add an element.
+ * \param [in] element - The element to add
+ * \return Error code
+ *
+ * NOTE: The size of the element should match the one declared at structure
+ * initialization.
+ */
+int
+hc_data_push(hc_data_t * data, const void * element);
+
+/**
+ * \brief Configure a callback (along with private data) to be called upon
+ * completion of a request
+ * \param [in] data - hICN control data
+ * \param [in] cb - Callback function
+ * \param [in] cb_data - Callback private data
+ */
+int
+hc_data_set_callback(hc_data_t * data, data_callback_t cb, void * cb_data);
+
+/**
+ * \brief Mark the data structure as complete.
+ * \param [in] data - The data structure to which to add an element.
+ * \return The error code resulting from callback execution if any. 0 is
+ * returned if the callback executed successfully, or if no callback were
+ * defined.
+ */
+int
+hc_data_set_complete(hc_data_t * data);
+
+/**
+ * \brief Reset the data structure holding control data
+ * \param [in] data - hICN control data
+ * \return Error code
+ */
+int
+hc_data_reset(hc_data_t * data);
+
+/**
+ * \brief Find en element in the data structure
+ * \param [in] data - The data structure in which to find
+ * \param [in] element - The element to find
+ * \param [out] found - A pointer to the element, or NULL if not found.
+ * \return Error code
+ */
+#define GENERATE_FIND_HEADER(TYPE)                                          \
+int                                                                         \
+hc_ ## TYPE ## _find(hc_data_t * data, const hc_ ## TYPE ## _t * element,   \
+        hc_ ## TYPE ## _t **found)
+
+#define GENERATE_FIND(TYPE)                                                 \
+int                                                                         \
+hc_ ## TYPE ## _find(hc_data_t * data, const hc_ ## TYPE ## _t * element,   \
+        hc_ ## TYPE ## _t **found)                                          \
+{                                                                           \
+    foreach_type(hc_ ## TYPE ## _t, x, data) {                              \
+        if (hc_ ## TYPE ## _cmp(x, element) >= 0) {                         \
+            *found = x;                                                     \
+            return LIBHICNCTRL_SUCCESS;                                     \
+        }                                                                   \
+    };                                                                      \
+    *found = NULL; /* this is optional */                                   \
+    return LIBHICNCTRL_SUCCESS;                                             \
+}
+
+/******************************************************************************
+ * Control socket
+ ******************************************************************************/
+
+/* This should be at least equal to the maximum packet size */
+#define RECV_BUFLEN 8192
+
+/**
+ * \brief Holds the state of an hICN control socket
+ */
+typedef struct {
+    char * url;
+    int fd;
+    u32 seq;
+
+    /* Partial receive buffer */
+    u8 buf[RECV_BUFLEN];
+    size_t roff; /**< Read offset */
+    size_t woff; /**< Write offset */
+
+    /*
+     * Because received messages are potentially unbounded in size, we might not
+     * guarantee that we can store a full packet before processing it. We must
+     * implement a very simple state machine remembering the current parsing
+     * status in order to partially process the packet.
+     */
+    size_t remaining;
+    u32 send_id;
+    u32 send_seq;
+    u32 recv_seq;
+} hc_sock_t;
+
+/**
+ * \brief Create an hICN control socket using the specified URL.
+ * \param [in] url - The URL to connect to.
+ * \return an hICN control socket
+ */
+hc_sock_t *
+hc_sock_create_url(const char * url);
+
+/**
+ * \brief Create an hICN control socket using the default connection type.
+ * \return an hICN control socket
+ */
+hc_sock_t *
+hc_sock_create(void);
+
+/**
+ * \brief Frees an hICN control socket
+ */
+void
+hc_sock_free(hc_sock_t *s);
+
+/**
+ * \brief Sets the socket as non-blocking
+ * \return Error code
+ */
+int
+hc_sock_set_nonblocking(hc_sock_t *s);
+
+/**
+ * \brief Connect the socket
+ * \return Error code
+ */
+int
+hc_sock_connect(hc_sock_t *s);
+
+/**
+ * \brief Return the offset and size of available buffer space
+ * \param [in] sock - hICN control socket
+ * \param [out] buffer - Offset in buffer
+ * \param [out] size - Remaining size
+ * \return Error code
+ */
+int
+hc_sock_get_available(hc_sock_t * s, u8 ** buffer, size_t * size);
+
+/**
+ * \brief Write/read iexchance on the control socket (internal helper function)
+ * \param [in] sock - hICN control socket
+ * \param [in] msg - Message to send
+ * \param [in] msglen - Length of the message to send
+ * \return Error code
+ */
+int
+hc_sock_send(hc_sock_t * s, hc_msg_t * msg, size_t msglen);
+
+/**
+ * \brief Helper for reading socket contents
+ * \param [in] sock - hICN control socket
+ * \param [in] data - Result data buffer
+ * \param [in] parse - Parse function to convert remote types into lib native
+ *      types, or NULL not to perform any translation.
+ * \return Error code
+ */
+int
+hc_sock_recv(hc_sock_t * s, hc_data_t * data);
+
+/**
+ * \brief Processing data received by socket
+ * \param [in] sock - hICN control socket
+ * \param [in] data - Result data buffer
+ * \param [in] parse - Parse function to convert remote types into lib native
+ *      types, or NULL not to perform any translation.
+ * \return Error code
+ */
+int
+hc_sock_process(hc_sock_t * s, hc_data_t * data,
+        int (*parse)(const u8 * src, u8 * dst));
+
+/**
+ * \brief Reset the state of the sock (eg. to handle a reconnecton)
+ * \param [in] sock - hICN control socket
+ * \return Error code
+ */
+int
+hc_sock_reset(hc_sock_t * s);
+
+/******************************************************************************
+ * Command-specific structures and functions
+ ******************************************************************************/
+
+/*
+ * The following definitions are organized by sections each dealing with a
+ * specific object being manipulated. All follow a similar structure.
+ *
+ * TYPE DEFINITIONS AND ALIASES
+ *
+ * We redefine command struct:
+ *  - for uniformization
+ *  - to use enum instead of type specifiers more appropriate for packet format
+ *  - to use more flexible types such as for manipulating IP addresses
+ *  - host endianness
+ *  - more intuitive field name, ordering, consistency, and hierarchy removal
+ *  - to have command types in between add/list/... commands
+ *
+ * COMMAND IMPLEMENTATION
+ *
+ * All commands return information in a common format
+ *
+ * RETURN DATA FIXME
+ *
+ * \param [out] pdata - Pointer to the structure storing the results of the call
+ * (NULL if no data has been received). If the pointer is NULL, no result will
+ * be stored and only the error code will be exposed to the caller. It is
+ * expected that the caller frees this structure using hc_data_free() after
+ * usage.
+ * \see hc_data_free.
+ *
+ * PARSING
+ *
+ * While this is not made mandatory by the library, the returned data can be
+ * converted to the library's own data structures as described before.
+ *
+ * ITERATORS
+ *
+ * Macros are defined to facilitate iteration on the returned data structures.
+ */
+
+#ifndef SPACES
+#define SPACES(x) x
+#endif
+#ifndef SPACE
+#define SPACE SPACES(1)
+#endif
+#ifndef NULLTERM
+#define NULLTERM 1
+#endif
+
+#define NAME_LEN 16 /* NULL-terminated right ? */
+#ifdef __linux__
+#define INTERFACE_LEN 16
+#endif
+#define MAXSZ_HC_NAME_ NAME_LEN
+#define MAXSZ_HC_NAME MAXSZ_HC_NAME_ + NULLTERM
+
+#define MAXSZ_HC_ID_ 10 /* Number of digits for MAX_INT */
+#define MAXSZ_HC_ID MAXSZ_HC_ID_ + NULLTERM
+
+#define MAXSZ_HC_PROTO_ 8 /* inetX:// */
+#define MAXSZ_HC_PROTO MAXSZ_HC_PROTO_ + NULLTERM
+
+#define MAXSZ_HC_URL4_ MAXSZ_HC_PROTO_ + MAXSZ_IP4_ADDRESS_ + MAXSZ_PORT_
+#define MAXSZ_HC_URL6_ MAXSZ_HC_PROTO_ + MAXSZ_IP6_ADDRESS_ + MAXSZ_PORT_
+#define MAXSZ_HC_URL_ MAXSZ_HC_URL6_
+#define MAXSZ_HC_URL4 MAXSZ_HC_URL4_ + NULLTERM
+#define MAXSZ_HC_URL6 MAXSZ_HC_URL6_ + NULLTERM
+#define MAXSZ_HC_URL MAXSZ_HC_URL_ + NULLTERM
+
+int hc_url_snprintf(char * s, size_t size, int family,
+        const ip_address_t * ip_address, u16 port);
+
+#define foreach_type(TYPE, VAR, data) \
+    for (TYPE * VAR = (TYPE*)data->buffer; \
+            VAR < (TYPE*)(data->buffer + data->size * data->out_element_size); \
+            VAR++)
+
+/**
+ * New type is defined to reconciliate different enum for add and list.
+ * Also, values not implemented have been removed for clarity.
+ */
+#define foreach_connection_type \
+    _(UNDEFINED)                \
+    _(TCP)                      \
+    _(UDP)                      \
+    _(HICN)                     \
+    _(N)
+
+typedef enum {
+#define _(x) CONNECTION_TYPE_ ## x,
+foreach_connection_type
+#undef _
+} hc_connection_type_t;
+
+#define MAXSZ_HC_CONNECTION_TYPE_ 9
+#define MAXSZ_HC_CONNECTION_TYPE MAXSZ_HC_CONNECTION_TYPE_ + NULLTERM
+
+extern const char * connection_type_str[];
+
+hc_connection_type_t
+connection_type_from_str(const char * str);
+
+/* Same order as connection_state_t in hicn/core/connectionState.h */
+#define foreach_connection_state \
+    _(UNDEFINED)                \
+    _(DOWN)                     \
+    _(UP)                       \
+    _(N)
+
+typedef enum {
+#define _(x) HC_CONNECTION_STATE_ ## x,
+foreach_connection_state
+#undef _
+} hc_connection_state_t;
+
+#define MAXSZ_HC_CONNECTION_STATE_ 9
+#define MAXSZ_HC_CONNECTION_STATE MAXSZ_HC_CONNECTION_STATE_ + NULLTERM
+
+extern const char * connection_state_str[];
+
+typedef int (*HC_PARSE)(const u8 *, u8 *);
+
+/*----------------------------------------------------------------------------*
+ * Listeners
+ *----------------------------------------------------------------------------*/
+
+// FIXME the listener should not require any port for hICN...
+typedef struct {
+    char name[NAME_LEN];        /* K.w */ // XXX clarify what used for
+#ifdef __linux__
+    char interface_name[INTERFACE_LEN];                     /* Kr. */
+#endif
+    u32 id;
+    hc_connection_type_t type;  /* .rw */
+    int family;                 /* .rw */
+    ip_address_t local_addr;    /* .rw */
+    u16 local_port;             /* .rw */
+} hc_listener_t;
+
+int hc_listener_create(hc_sock_t * s, hc_listener_t * listener);
+int hc_listener_get(hc_sock_t *s, hc_listener_t * listener,
+        hc_listener_t ** listener_found);
+int hc_listener_delete(hc_sock_t * s, hc_listener_t * listener);
+int hc_listener_list(hc_sock_t * s, hc_data_t ** pdata);
+
+int hc_listener_validate(const hc_listener_t * listener);
+int hc_listener_cmp(const hc_listener_t * l1, const hc_listener_t * l2);
+int hc_listener_parse(void * in, hc_listener_t * listener);
+
+#define foreach_listener(VAR, data) foreach_type(hc_listener_t, VAR, data)
+
+#define MAXSZ_HC_LISTENER_ MAXSZ_HC_URL_ + SPACE + MAXSZ_HC_CONNECTION_TYPE_
+#define MAXSZ_HC_LISTENER MAXSZ_HC_LISTENER_ + NULLTERM
+
+GENERATE_FIND_HEADER(listener);
+
+int hc_listener_snprintf(char * s, size_t size, hc_listener_t * listener);
+
+/*----------------------------------------------------------------------------*
+ * Connections
+ *----------------------------------------------------------------------------*/
+
+typedef struct {
+    u32 id;                 /* Kr. */
+    char name[NAME_LEN];         /* K.w */
+    hc_connection_type_t type;   /* .rw */
+    int family;                  /* .rw */
+    ip_address_t local_addr;     /* .rw */
+    u16 local_port;              /* .rw */
+    ip_address_t remote_addr;    /* .rw */
+    u16 remote_port;             /* .rw */
+    hc_connection_state_t admin_state;  /* .rw */
+#ifdef WITH_POLICY
+    policy_tags_t tags;          /* .rw */
+#endif /* WITH_POLICY */
+    hc_connection_state_t state; /* .r. */
+} hc_connection_t;
+
+
+int hc_connection_create(hc_sock_t * s, hc_connection_t * connection);
+int hc_connection_get(hc_sock_t *s, hc_connection_t * connection,
+        hc_connection_t ** connection_found);
+int hc_connection_update_by_id(hc_sock_t * s, int hc_connection_id,
+        hc_connection_t * connection);
+int hc_connection_update(hc_sock_t * s, hc_connection_t * connection_current,
+        hc_connection_t * connection_updated);
+int hc_connection_delete(hc_sock_t * s, hc_connection_t * connection);
+/*
+int hc_connection_remove_by_id(hc_sock_t * s, char * name);
+int hc_connection_remove_by_name(hc_sock_t * s, char * name);
+*/
+int hc_connection_list(hc_sock_t * s, hc_data_t ** pdata);
+
+int hc_connection_validate(const hc_connection_t * connection);
+int hc_connection_cmp(const hc_connection_t * c1, const hc_connection_t * c2);
+int hc_connection_parse(void * in, hc_connection_t * connection);
+
+#ifdef WITH_POLICY
+int hc_connection_set_state(hc_sock_t * s, const char * conn_id_or_name, face_state_t state);
+#endif /* WITH_POLICY */
+
+#define foreach_connection(VAR, data) foreach_type(hc_connection_t, VAR, data)
+
+#define MAXSZ_HC_CONNECTION_ MAXSZ_HC_CONNECTION_STATE_ + \
+    2 * MAXSZ_HC_URL_ + MAXSZ_HC_CONNECTION_TYPE_ + SPACES(3)
+#define MAXSZ_HC_CONNECTION MAXSZ_HC_CONNECTION_ + NULLTERM
+
+GENERATE_FIND_HEADER(connection);
+
+int hc_connection_snprintf(char * s, size_t size, const hc_connection_t * connection);
+
+/*----------------------------------------------------------------------------*
+ * Routes
+ *----------------------------------------------------------------------------*/
+
+typedef struct {
+    u8 face_id;                  /* Kr. */
+    int family;                  /* Krw */
+    ip_address_t remote_addr;    /* krw */
+    u8 len;                      /* krw */
+    u16 cost;                    /* .rw */
+} hc_route_t;
+
+int hc_route_parse(void * in, hc_route_t * route);
+
+int hc_route_create(hc_sock_t * s, hc_route_t * route);
+int hc_route_delete(hc_sock_t * s, hc_route_t * route);
+int hc_route_list(hc_sock_t * s, hc_data_t ** pdata);
+
+#define foreach_route(VAR, data) foreach_type(hc_route_t, VAR, data)
+
+#define MAX_FACE_ID 255
+#define MAXSZ_FACE_ID 3
+#define MAX_COST 65535
+#define MAXSZ_COST 5
+#define MAX_LEN 255
+#define MAXSZ_LEN 3
+
+#define MAXSZ_HC_ROUTE_ MAXSZ_FACE_ID + 1 + MAXSZ_COST + 1 + MAXSZ_IP_ADDRESS + 1 + MAXSZ_LEN
+#define MAXSZ_HC_ROUTE MAXSZ_HC_ROUTE_ + NULLTERM
+
+int hc_route_snprintf(char * s, size_t size, hc_route_t * route);
+
+/*----------------------------------------------------------------------------*
+ * Faces
+ *
+ * A face is an abstraction introduced by the control library to abstract the
+ * forwarder implementation details. It encompasses connections and listeners
+ * and ensures the right dependencies are enforced, eg that we always have a
+ * listener when a connection is created.
+ *
+ *----------------------------------------------------------------------------*/
+
+typedef struct {
+    u32 id;
+    char name[NAME_LEN];
+    face_t face; // or embed ?
+    //face_id_t parent; /* Pointer from connection to listener */
+} hc_face_t;
+
+/**
+ * \brief Create a face
+ * \param [in] s - hICN socket
+ * \param [in,out] face - Parameters of the face to create
+ * \return Error code
+ *
+ * The face parameters will be updated with the face ID.
+ */
+int hc_face_create(hc_sock_t * s, hc_face_t * face);
+int hc_face_get(hc_sock_t * s, hc_face_t * face, hc_face_t ** face_found);
+int hc_face_delete(hc_sock_t * s, hc_face_t * face);
+int hc_face_list(hc_sock_t * s, hc_data_t ** pdata);
+
+#define foreach_face(VAR, data) foreach_type(hc_face_t, VAR, data)
+
+#define MAXSZ_HC_FACE_ 0
+#define MAXSZ_HC_FACE MAXSZ_HC_FACE_ + NULLTERM
+
+int hc_face_snprintf(char * s, size_t size, hc_face_t * face);
+
+/////// XXX XXX XXX XXX missing face api functions, cf punting now...
+
+/*----------------------------------------------------------------------------*
+ * Punting
+ *----------------------------------------------------------------------------*/
+
+typedef struct {
+    u8 face_id;                 /* Kr. */ // XXX listener id, could be NULL for all ?
+    int family;                 /* Krw */
+    ip_address_t prefix;        /* krw */
+    u8 prefix_len;              /* krw */
+} hc_punting_t;
+
+int hc_punting_create(hc_sock_t * s, hc_punting_t * punting);
+int hc_punting_get(hc_sock_t * s, hc_punting_t * punting, hc_punting_t ** punting_found);
+int hc_punting_delete(hc_sock_t * s, hc_punting_t * punting);
+int hc_punting_list(hc_sock_t * s, hc_data_t ** pdata);
+
+int hc_punting_validate(const hc_punting_t * punting);
+int hc_punting_cmp(const hc_punting_t * c1, const hc_punting_t * c2);
+int hc_punting_parse(void * in, hc_punting_t * punting);
+
+#define foreach_punting(VAR, data) foreach_type(hc_punting_t, VAR, data)
+
+#define MAXSZ_HC_PUNTING_ 0
+#define MAXSZ_HC_PUNTING MAXSZ_HC_PUNTING_ + NULLTERM
+
+GENERATE_FIND_HEADER(punting);
+
+int hc_punting_snprintf(char * s, size_t size, hc_punting_t * punting);
+
+
+/*----------------------------------------------------------------------------*
+ * Cache
+ *----------------------------------------------------------------------------*/
+
+int hc_cache_set_store(hc_sock_t * s, int enabled);
+int hc_cache_set_serve(hc_sock_t * s, int enabled);
+
+/*----------------------------------------------------------------------------*
+ * Strategy
+ *----------------------------------------------------------------------------*/
+
+#define MAXSZ_STRATEGY_NAME 255
+
+typedef struct {
+    char name[MAXSZ_STRATEGY_NAME];
+} hc_strategy_t;
+
+int hc_strategy_list(hc_sock_t * s, hc_data_t ** data);
+
+#define foreach_strategy(VAR, data) foreach_type(hc_strategy_t, VAR, data)
+
+#define MAXSZ_HC_STRATEGY_ MAXSZ_STRATEGY_NAME
+#define MAXSZ_HC_STRATEGY MAXSZ_HC_STRATEGY_ + NULLTERM
+
+int hc_strategy_snprintf(char * s, size_t size, hc_strategy_t * strategy);
+
+// per prefix
+int hc_strategy_set(hc_sock_t * s /* XXX */);
+
+/*----------------------------------------------------------------------------*
+ * WLDR
+ *----------------------------------------------------------------------------*/
+
+// per connection
+int hc_wldr_set(hc_sock_t * s /* XXX */);
+
+/*----------------------------------------------------------------------------*
+ * MAP-Me
+ *----------------------------------------------------------------------------*/
+
+int hc_mapme_set(hc_sock_t * s, int enabled);
+int hc_mapme_set_discovery(hc_sock_t * s, int enabled);
+int hc_mapme_set_timescale(hc_sock_t * s, double timescale);
+int hc_mapme_set_retx(hc_sock_t * s, double timescale);
+
+/*----------------------------------------------------------------------------*
+ * Policies
+ *----------------------------------------------------------------------------*/
+
+#ifdef WITH_POLICY
+
+typedef struct {
+    int family;                  /* Krw */
+    ip_address_t remote_addr;    /* krw */
+    u8 len;                      /* krw */
+    policy_t policy;             /* .rw */
+} hc_policy_t;
+
+int hc_policy_parse(void * in, hc_policy_t * policy);
+
+int hc_policy_create(hc_sock_t * s, hc_policy_t * policy);
+int hc_policy_delete(hc_sock_t * s, hc_policy_t * policy);
+int hc_policy_list(hc_sock_t * s, hc_data_t ** pdata);
+
+#define foreach_policy(VAR, data) foreach_type(hc_policy_t, VAR, data)
+
+/* TODO */
+#define MAXSZ_HC_POLICY_ 0
+#define MAXSZ_HC_POLICY MAXSZ_HC_POLICY_ + NULLTERM
+
+int hc_policy_snprintf(char * s, size_t size, hc_policy_t * policy);
+
+#endif /* WITH_POLICY */
+
+#endif /* HICNTRL_API */
diff --git a/ctrl/libhicnctrl/includes/hicn/ctrl/commands.h b/ctrl/libhicnctrl/includes/hicn/ctrl/commands.h
new file mode 100755
index 000000000..1d07c9b72
--- /dev/null
+++ b/ctrl/libhicnctrl/includes/hicn/ctrl/commands.h
@@ -0,0 +1,411 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+ * @file commands.h
+ * @brief All hicn-light commands: 14 in total.
+ *
+ * Header and payload in binary format.
+ */
+
+#ifndef commands_h
+#define commands_h
+
+#ifndef _WIN32
+#include <netinet/in.h>
+#include <sys/socket.h>
+#endif
+
+#include <stdint.h>
+#include <stdlib.h>
+
+#ifdef WITH_POLICY
+#include "util/policy.h"
+#endif /* WITH_POLICY */
+
+typedef struct in6_addr ipv6_addr_t;
+typedef uint32_t ipv4_addr_t;
+
+union commandAddr {
+  ipv4_addr_t ipv4;
+  ipv6_addr_t ipv6;
+};
+
+typedef enum {
+  REQUEST_LIGHT = 0xc0, // this is a command
+  RESPONSE_LIGHT,
+  ACK_LIGHT,
+  NACK_LIGHT,
+  LAST_MSG_TYPE_VALUE
+} message_type;
+
+typedef enum {
+  ADD_LISTENER = 0,
+  ADD_CONNECTION,
+  LIST_CONNECTIONS,
+  ADD_ROUTE,
+  LIST_ROUTES,
+  REMOVE_CONNECTION,
+  REMOVE_ROUTE,
+  CACHE_STORE,
+  CACHE_SERVE,
+  CACHE_CLEAR,
+  SET_STRATEGY,
+  SET_WLDR,
+  ADD_PUNTING,
+  LIST_LISTENERS,
+  MAPME_ENABLE,
+  MAPME_DISCOVERY,
+  MAPME_TIMESCALE,
+  MAPME_RETX,
+  CONNECTION_SET_ADMIN_STATE,
+#ifdef WITH_POLICY
+  ADD_POLICY,
+  LIST_POLICIES,
+  REMOVE_POLICY,
+  UPDATE_CONNECTION,
+#endif /* WITH_POLICY */
+  REMOVE_LISTENER,
+  LAST_COMMAND_VALUE
+} command_id;
+
+typedef enum {
+  ADDR_INET = 1,
+  ADDR_INET6,
+  ADDR_LINK,
+  ADDR_IFACE,
+  ADDR_UNIX /* PF_UNIX */
+} address_type;
+
+typedef enum {
+  UDP_CONN,
+  TCP_CONN,
+  GRE_CONN,  // not implemented
+  HICN_CONN
+} connection_type;
+
+typedef enum { ACTIVATE_ON, ACTIVATE_OFF } activate_type;
+
+//==========    HEADER    ==========
+
+typedef struct {
+  uint8_t messageType;
+  uint8_t commandID;
+  uint16_t length;  // tells the number of structures in the payload
+  uint32_t seqNum;
+} header_control_message;
+// for the moment has to be at least 8 bytes
+
+// SIZE=8
+
+//==========  [00]  ADD LISTENER    ==========
+
+typedef enum { ETHER_MODE, IP_MODE, HICN_MODE } listener_mode;
+
+typedef struct {
+  char symbolic[16];
+  char interfaceName[16];
+  union commandAddr address;
+  uint16_t port;
+  // uint16_t etherType;
+  uint8_t addressType;
+  uint8_t listenerMode;
+  uint8_t connectionType;
+} add_listener_command;
+
+// SIZE=40
+
+//==========  [01]  ADD CONNECTION    ==========
+
+typedef struct {
+  char symbolic[16];
+  union commandAddr remoteIp;
+  union commandAddr localIp;
+  uint16_t remotePort;
+  uint16_t localPort;
+  uint8_t ipType;
+  uint8_t connectionType;
+  uint8_t admin_state;
+#ifdef WITH_POLICY
+  policy_tags_t tags;
+#endif /* WITH_POLICY */
+} add_connection_command;
+
+// SIZE=56
+
+//==========  [02]  LIST CONNECTIONS    ==========
+
+typedef enum {
+  CONN_GRE,
+  CONN_TCP,
+  CONN_UDP,
+  CONN_MULTICAST,
+  CONN_L2,
+  CONN_HICN
+} list_connections_type;
+
+typedef enum {
+  IFACE_UP = 0,
+  IFACE_DOWN = 1,
+  IFACE_UNKNOWN = 2  // not used actually
+} connection_state;
+
+typedef struct {
+  add_connection_command connectionData;
+  uint32_t connid;
+  uint8_t state;
+#ifdef WITH_UPDATE
+  char connectionName[16];
+#endif /* WITH_UPDATE */
+} list_connections_command;
+
+// SIZE=64
+
+//==========  [03]  ADD ROUTE    ==========
+
+typedef struct {
+  char symbolicOrConnid[16];
+  union commandAddr address;
+  uint16_t cost;
+  uint8_t addressType;
+  uint8_t len;
+} add_route_command;
+
+// SIZE=36
+
+//==========  [04]  LIST ROUTE    ==========
+
+typedef struct {
+  union commandAddr address;
+  uint32_t connid;
+  uint16_t cost;
+  uint8_t addressType;
+  uint8_t len;
+} list_routes_command;
+
+// SIZE=24
+
+//==========  [05]  REMOVE CONNECTION    ==========
+
+typedef struct {
+  char symbolicOrConnid[16];
+} remove_connection_command;
+
+//==========  [06]  REMOVE LISTENER    ==========
+typedef struct {
+  char symbolicOrListenerid[16];
+} remove_listener_command;
+
+// SIZE=16
+
+//==========  [06]  REMOVE ROUTE    ==========
+
+typedef struct {
+  char symbolicOrConnid[16];
+  union commandAddr address;
+  uint8_t addressType;
+  uint8_t len;
+} remove_route_command;
+
+// SIZE=36
+
+//==========  [07]  CACHE STORE    ==========
+
+typedef struct {
+  uint8_t activate;
+} cache_store_command;
+
+// SIZE=1
+
+//==========  [08]  CACHE SERVE    ==========
+
+typedef struct {
+  uint8_t activate;
+} cache_serve_command;
+
+// SIZE=1
+
+//==========  [09]  SET STRATEGY    ==========
+
+typedef enum {
+  SET_STRATEGY_LOADBALANCER,
+  SET_STRATEGY_RANDOM,
+  SET_STRATEGY_RANDOM_PER_DASH_SEGMENT,
+  SET_STRATEGY_LOADBALANCER_WITH_DELAY,
+  SET_STRATEGY_LOADBALANCER_BY_RATE,
+  SET_STRATEGY_LOADBALANCER_BEST_ROUTE,
+  LAST_STRATEGY_VALUE
+} strategy_type;
+
+typedef struct {
+  union commandAddr address;
+  uint8_t strategyType;
+  uint8_t addressType;
+  uint8_t len;
+} set_strategy_command;
+
+// SIZE=20
+
+//==========  [11]  SET WLDR    ==========
+
+typedef struct {
+  char symbolicOrConnid[16];
+  uint8_t activate;
+} set_wldr_command;
+
+// SIZE=17
+
+//==========  [12]  ADD PUNTING    ==========
+
+typedef struct {
+  char symbolicOrConnid[16];
+  union commandAddr address;
+  uint8_t addressType;
+  uint8_t len;
+} add_punting_command;
+
+// SIZE=36
+
+//==========  [13]  LIST LISTENER    ==========
+
+typedef struct {
+  union commandAddr address;
+#ifdef WITH_UPDATE
+  char listenerName[16];
+  char interfaceName[16];
+#endif /* WITH_UPDATE */
+  uint32_t connid;
+  uint16_t port;
+  uint8_t addressType;
+  uint8_t encapType;
+} list_listeners_command;
+
+// SIZE=56
+
+//==========  [14]  MAPME    ==========
+
+//  (enable/discovery/timescale/retx)
+
+typedef struct {
+  uint8_t activate;
+} mapme_activator_command;
+
+// SIZE=1
+
+typedef struct {
+  uint32_t timePeriod;
+} mapme_timing_command;
+
+// SIZE=1
+
+//==========  NEW COMMANDS  ==========
+
+typedef struct {
+  char symbolicOrConnid[16];
+  uint8_t admin_state;
+} connection_set_admin_state_command;
+
+#ifdef WITH_POLICY
+
+typedef struct {
+  union commandAddr address;
+  uint8_t addressType;
+  uint8_t len;
+  policy_t policy;
+} add_policy_command;
+
+typedef struct {
+  union commandAddr address;
+  uint8_t addressType;
+  uint8_t len;
+  policy_t policy;
+} list_policies_command;
+
+typedef struct {
+  union commandAddr address;
+  uint8_t addressType;
+  uint8_t len;
+} remove_policy_command;
+
+typedef struct {
+  char symbolicOrConnid[16];
+  uint8_t admin_state;
+  policy_tags_t tags;
+} update_connection_command;
+
+#endif /* WITH_POLICY */
+
+//===== size of commands ======
+// REMINDER: when a new_command is added, the following switch has to be
+// updated.
+static inline int payloadLengthDaemon(command_id id) {
+  switch (id) {
+    case ADD_LISTENER:
+      return sizeof(add_listener_command);
+    case ADD_CONNECTION:
+      return sizeof(add_connection_command);
+    case LIST_CONNECTIONS:
+      return 0;  // list connections: payload always 0
+    case ADD_ROUTE:
+      return sizeof(add_route_command);
+    case LIST_ROUTES:
+      return 0;  // list routes: payload always 0
+    case REMOVE_CONNECTION:
+      return sizeof(remove_connection_command);
+    case REMOVE_LISTENER:
+      return sizeof(remove_listener_command);
+    case REMOVE_ROUTE:
+      return sizeof(remove_route_command);
+    case CACHE_STORE:
+      return sizeof(cache_store_command);
+    case CACHE_SERVE:
+      return sizeof(cache_serve_command);
+    case CACHE_CLEAR:
+      return 0;  // cache clear
+    case SET_STRATEGY:
+      return sizeof(set_strategy_command);
+    case SET_WLDR:
+      return sizeof(set_wldr_command);
+    case ADD_PUNTING:
+      return sizeof(add_punting_command);
+    case LIST_LISTENERS:
+      return 0;  // list listeners: payload always 0
+    case MAPME_ENABLE:
+      return sizeof(mapme_activator_command);
+    case MAPME_DISCOVERY:
+      return sizeof(mapme_activator_command);
+    case MAPME_TIMESCALE:
+      return sizeof(mapme_timing_command);
+    case MAPME_RETX:
+      return sizeof(mapme_timing_command);
+    case CONNECTION_SET_ADMIN_STATE:
+      return sizeof(connection_set_admin_state_command);
+#ifdef WITH_POLICY
+    case ADD_POLICY:
+      return sizeof(add_policy_command);
+    case LIST_POLICIES:
+      return 0; // list policies: payload always 0
+    case REMOVE_POLICY:
+      return sizeof(remove_policy_command);
+    case UPDATE_CONNECTION:
+      return sizeof(update_connection_command);
+#endif /* WITH_POLICY */
+    case LAST_COMMAND_VALUE:
+      return 0;
+    default:
+      return 0;
+  }
+}
+#endif
diff --git a/ctrl/libhicnctrl/includes/hicn/ctrl/face.h b/ctrl/libhicnctrl/includes/hicn/ctrl/face.h
new file mode 100644
index 000000000..2856ce89b
--- /dev/null
+++ b/ctrl/libhicnctrl/includes/hicn/ctrl/face.h
@@ -0,0 +1,179 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file face.h
+ * \brief Face abstraction
+ */
+#ifndef HICN_FACE_H
+#define HICN_FACE_H
+
+#ifndef SPACES
+#define SPACES(x) x
+#endif
+#ifndef SPACE
+#define SPACE 1
+#endif
+#ifndef NULLTERM
+#define NULLTERM 1
+#endif
+
+#ifndef _HICNTRL_NO_DEF_IPADDR
+#include "util/ip_address.h"
+#endif /* _HICNTRL_NO_DEF_IPADDR */
+#include "util/policy.h"
+#include "util/types.h"
+
+
+/* Netdevice type */
+
+#include <net/if.h> // IFNAMSIZ
+
+#define foreach_netdevice_type  \
+    _(UNDEFINED)                \
+    _(WIRED)                    \
+    _(WIFI)                     \
+    _(CELLULAR)                 \
+    _(VPN)                      \
+    _(N)
+
+#define MAXSZ_NETDEVICE_TYPE_ 9
+#define MAXSZ_NETDEVICE_TYPE MAXSZ_NETDEVICE_TYPE_ + NULLTERM
+
+typedef enum {
+#define _(x) NETDEVICE_TYPE_ ## x,
+foreach_netdevice_type
+#undef _
+} netdevice_type_t;
+
+extern const char * netdevice_type_str[];
+
+
+/* Netdevice */
+
+typedef struct {
+    u32 index;
+    char name[IFNAMSIZ];
+} netdevice_t;
+
+#define NETDEVICE_UNDEFINED_INDEX 0
+
+/* Face state */
+
+#define foreach_face_state      \
+    _(UNDEFINED)                \
+    _(PENDING_UP)               \
+    _(UP)                       \
+    _(PENDING_DOWN)             \
+    _(DOWN)                     \
+    _(ERROR)                    \
+    _(N)
+
+#define MAXSZ_FACE_STATE_ 12
+#define MAXSZ_FACE_STATE MAXSZ_FACE_STATE_ + 1
+
+typedef enum {
+#define _(x) FACE_STATE_ ## x,
+foreach_face_state
+#undef _
+} face_state_t;
+
+extern const char * face_state_str[];
+
+
+/* Face type */
+
+#define foreach_face_type       \
+    _(UNDEFINED)                \
+    _(HICN)                     \
+    _(HICN_LISTENER)            \
+    _(TCP)                      \
+    _(TCP_LISTENER)             \
+    _(UDP)                      \
+    _(UDP_LISTENER)             \
+    _(N)
+
+#define MAXSZ_FACE_TYPE_ 13
+#define MAXSZ_FACE_TYPE MAXSZ_FACE_TYPE_  + 1
+
+typedef enum {
+#define _(x) FACE_TYPE_ ## x,
+foreach_face_type
+#undef _
+} face_type_t;
+
+extern const char * face_type_str[];
+
+#define MAXSZ_FACE_ MAXSZ_FACE_TYPE_ + 2 * MAXSZ_IP_ADDRESS + 2 * MAXSZ_PORT + 9
+#define MAXSZ_FACE MAXSZ_FACE_ + 1
+
+/* Face */
+
+typedef union {
+    int family; /* To access family independently of face type */
+    struct {
+        int family;
+        netdevice_t netdevice;
+        ip_address_t local_addr;
+        ip_address_t remote_addr;
+    } hicn;
+    struct {
+        int family;
+        ip_address_t local_addr;
+        u16 local_port;
+        ip_address_t remote_addr;
+        u16 remote_port;
+    } tunnel;
+} face_params_t;
+
+typedef struct {
+    face_type_t type;
+    face_params_t params;
+    face_state_t admin_state;
+    face_state_t state;
+#ifdef WITH_POLICY
+    policy_tags_t tags; /**< \see policy_tag_t */
+#endif /* WITH_POLICY */
+} face_t;
+
+int face_initialize(face_t * face);
+int face_initialize_udp(face_t * face, const ip_address_t * local_addr,
+        u16 local_port, const ip_address_t * remote_addr, u16 remote_port,
+        int family);
+int face_initialize_udp_sa(face_t * face,
+        const struct sockaddr * local_addr, const struct sockaddr * remote_addr);
+
+face_t * face_create();
+face_t * face_create_udp(const ip_address_t * local_addr, u16 local_port,
+        const ip_address_t * remote_addr, u16 remote_port, int family);
+face_t * face_create_udp_sa(const struct sockaddr * local_addr,
+        const struct sockaddr * remote_addr);
+
+int face_finalize(face_t * face);
+
+void face_free(face_t * face);
+
+typedef int (*face_cmp_t)(const face_t * f1, const face_t * f2);
+
+int face_cmp(const face_t * f1, const face_t * f2);
+hash_t face_hash(const face_t * face);
+
+size_t
+face_snprintf(char * s, size_t size, const face_t * face);
+
+int face_set_tags(face_t * face, policy_tags_t tags);
+
+#endif /* HICN_FACE_H */
+
diff --git a/ctrl/libhicnctrl/src/CMakeLists.txt b/ctrl/libhicnctrl/src/CMakeLists.txt
new file mode 100644
index 000000000..ebccb7ddd
--- /dev/null
+++ b/ctrl/libhicnctrl/src/CMakeLists.txt
@@ -0,0 +1,87 @@
+# Copyright (c) 2017-2019 Cisco and/or its affiliates.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+include(BuildMacros)
+
+list(APPEND COMPILER_DEFINITIONS
+  "-DWITH_POLICY"
+#  "-DWITH_UPDATE"
+)
+
+set(HEADER_FILES
+    api.h
+    commands.h
+    face.h
+)
+
+set(UTIL_HEADER_FILES
+    face.h
+    util/ip_address.h
+    util/log.h
+    util/policy.h
+    util/token.h
+    util/types.h
+)
+
+set(SOURCE_FILES
+    api.c
+    util/policy.c
+    util/log.c
+)
+
+set(LIBRARIES
+    m
+)
+
+set(INCLUDE_DIRS
+    ./
+    ../includes/
+)
+
+if (ANDROID_API)
+    build_library(${LIBHICN_CTRL}
+        STATIC
+        SOURCES ${SOURCE_FILES}
+        INSTALL_HEADERS ${TO_INSTALL_HEADER_FILES}
+        LINK_LIBRARIES ${LIBRARIES}
+        COMPONENT ${LIBHICNCTRL_COMPONENT}
+        INCLUDE_DIRS ${INCLUDE_DIRS}
+        INSTALL_ROOT_DIR hicn
+        DEFINITIONS ${COMPILER_DEFINITIONS}
+    )
+else ()
+    build_library(${LIBHICN_CTRL}
+        SHARED STATIC
+        SOURCES ${SOURCE_FILES}
+        INSTALL_HEADERS ${TO_INSTALL_HEADER_FILES}
+        LINK_LIBRARIES ${LIBRARIES}
+        COMPONENT ${LIBHICNCTRL_COMPONENT}
+        INCLUDE_DIRS ${INCLUDE_DIRS}
+        INSTALL_ROOT_DIR hicn
+        DEFINITIONS ${COMPILER_DEFINITIONS}
+    )
+endif ()
+
+if(NOT ANDROID_API AND NOT COMPILE_FOR_IOS)
+    list(APPEND DAEMON_SRC
+      cli.c
+    )
+    build_executable(${HICN_CTRL}
+      SOURCES ${DAEMON_SRC}
+      LINK_LIBRARIES ${LIBHICN_CTRL_SHARED}
+      DEPENDS ${LIBHICN_CTRL_SHARED}
+      COMPONENT ${LIBHICNCTRL_COMPONENT}
+      INCLUDE_DIRS ${INCLUDE_DIRS}
+      DEFINITIONS ${COMPILER_DEFINITIONS}
+    )
+endif ()
diff --git a/ctrl/libhicnctrl/src/api.c b/ctrl/libhicnctrl/src/api.c
new file mode 100644
index 000000000..3d8a2c166
--- /dev/null
+++ b/ctrl/libhicnctrl/src/api.c
@@ -0,0 +1,2163 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file api.c
+ * \brief Implementation of hICN control library API
+ */
+
+#include <assert.h> // assert
+#include <math.h> // log2
+#include <stdio.h> // snprintf
+#include <string.h> // memmove, strcasecmp
+#include <sys/socket.h> // socket
+#include <unistd.h> // close, fcntl
+#include <fcntl.h> // fcntl
+
+#include <hicn/ctrl/api.h>
+#include <hicn/ctrl/commands.h>
+#include "util/log.h"
+#include "util/token.h"
+#include <strings.h>
+
+#define PORT 9695
+
+/*
+ * list was working with all seq set to 0, but it seems hicnLightControl uses
+ * 1, and replies with the same seqno
+ */
+#define HICN_CTRL_SEND_SEQ_INIT 1
+#define HICN_CTRL_RECV_SEQ_INIT 1
+
+#define MAX(x, y) ((x > y) ? x : y)
+
+/**
+ * \brief Defines the default size for the allocated data arrays holding the
+ * results of API calls.
+ *
+ * This size should not be too small to avoid wasting memoyy, but also not too
+ * big to avoid unnecessary realloc's. Later on this size is doubled at each
+ * reallocation.
+ */
+#define DEFAULT_SIZE_LOG 3
+
+/**
+ * In practise, we want to preserve enough room to store a full packet of
+ * average expected size (say a header + N payload elements).
+ */
+#define AVG_ELEMENTS (1 << DEFAULT_SIZE_LOG)
+#define AVG_BUFLEN sizeof(hc_msg_header_t) + AVG_ELEMENTS * sizeof(hc_msg_payload_t)
+
+/*
+ * We should at least have buffer space allowing to store one processable unit
+ * of data, either the header of the maximum possible payload
+ */
+#define MIN_BUFLEN MAX(sizeof(hc_msg_header_t), sizeof(hc_msg_payload_t))
+
+static const struct in6_addr loopback_addr = IN6ADDR_LOOPBACK_INIT;
+
+/* /!\ Please update constants in header file upon changes */
+const char * connection_type_str[] = {
+#define _(x) [CONNECTION_TYPE_ ## x] = STRINGIZE(x),
+foreach_connection_type
+#undef _
+};
+
+#define IS_VALID_CONNECTION_TYPE(x) IS_VALID_ENUM_TYPE(CONNECTION_TYPE, x)
+
+hc_connection_type_t
+connection_type_from_str(const char * str)
+{
+    if (strcasecmp(str, "TCP") == 0)
+        return CONNECTION_TYPE_TCP;
+    else if (strcasecmp(str, "UDP") == 0)
+        return CONNECTION_TYPE_UDP;
+    else if (strcasecmp(str, "HICN") == 0)
+        return CONNECTION_TYPE_HICN;
+    else
+	return CONNECTION_TYPE_UNDEFINED;
+}
+
+/* Conversions to shield lib user from heterogeneity */
+
+#define IS_VALID_LIST_CONNECTIONS_TYPE(x) ((x >= CONN_GRE) && (x <= CONN_HICN))
+
+static const hc_connection_type_t map_from_list_connections_type[] = {
+    [CONN_GRE]       = CONNECTION_TYPE_UNDEFINED,
+    [CONN_TCP]       = CONNECTION_TYPE_TCP,
+    [CONN_UDP]       = CONNECTION_TYPE_UDP,
+    [CONN_MULTICAST] = CONNECTION_TYPE_UNDEFINED,
+    [CONN_L2]        = CONNECTION_TYPE_UNDEFINED,
+    [CONN_HICN]      = CONNECTION_TYPE_HICN,
+};
+
+typedef enum {
+    ENCAP_TCP,
+    ENCAP_UDP,
+    ENCAP_ETHER,
+    ENCAP_LOCAL,
+    ENCAP_HICN
+} EncapType;
+
+#define IS_VALID_LIST_LISTENERS_TYPE(x) ((x >= ENCAP_TCP) && (x <= ENCAP_HICN))
+
+static const hc_connection_type_t map_from_encap_type[] = {
+    [ENCAP_TCP]     = CONNECTION_TYPE_TCP,
+    [ENCAP_UDP]     = CONNECTION_TYPE_UDP,
+    [ENCAP_ETHER]   = CONNECTION_TYPE_UNDEFINED,
+    [ENCAP_LOCAL]   = CONNECTION_TYPE_UNDEFINED,
+    [ENCAP_HICN]    = CONNECTION_TYPE_HICN,
+};
+
+static const connection_type map_to_connection_type[] = {
+    [CONNECTION_TYPE_TCP]   = TCP_CONN,
+    [CONNECTION_TYPE_UDP]   = UDP_CONN,
+    [CONNECTION_TYPE_HICN]  = HICN_CONN,
+};
+
+static const listener_mode map_to_listener_mode[] = {
+    [CONNECTION_TYPE_TCP]       = IP_MODE,
+    [CONNECTION_TYPE_UDP]       = IP_MODE,
+    [CONNECTION_TYPE_HICN]      = HICN_MODE,
+};
+
+#define IS_VALID_LIST_CONNECTIONS_STATE(x) ((x >= IFACE_UP) && (x <= IFACE_UNKNOWN))
+
+/* /!\ Please update constants in header file upon changes */
+const char * connection_state_str[] = {
+#define _(x) [HC_CONNECTION_STATE_ ## x] = STRINGIZE(x),
+foreach_connection_state
+#undef _
+};
+
+/*
+#define IS_VALID_CONNECTION_STATE(x) IS_VALID_ENUM_TYPE(CONNECTION_STATE, x)
+
+static const connection_state map_to_connection_state[] = {
+    [HC_CONNECTION_STATE_UP]       = IFACE_UP,
+    [HC_CONNECTION_STATE_DOWN]     = IFACE_DOWN,
+};
+
+*/
+
+static const hc_connection_state_t map_from_list_connections_state[] = {
+    [IFACE_UP]                  = HC_CONNECTION_STATE_UP,
+    [IFACE_DOWN]                = HC_CONNECTION_STATE_DOWN,
+    [IFACE_UNKNOWN]             = HC_CONNECTION_STATE_UNDEFINED,
+};
+
+
+#define connection_state_to_face_state(x) ((face_state_t)x)
+#define face_state_to_connection_state(x) ((hc_connection_state_t)x)
+
+#define IS_VALID_ADDR_TYPE(x) ((x >= ADDR_INET) && (x <= ADDR_UNIX))
+
+static const int map_from_addr_type[] = {
+    [ADDR_INET]     = AF_INET,
+    [ADDR_INET6]    = AF_INET6,
+    [ADDR_LINK]     = AF_UNSPEC,
+    [ADDR_IFACE]    = AF_UNSPEC,
+    [ADDR_UNIX]     = AF_UNSPEC,
+};
+
+static const address_type map_to_addr_type[] = {
+    [AF_INET]   = ADDR_INET,
+    [AF_INET6]  = ADDR_INET6,
+};
+
+/******************************************************************************
+ * Message helper types and aliases
+ ******************************************************************************/
+
+#define foreach_hc_command      \
+    _(add_connection)           \
+    _(remove_connection)        \
+    _(list_connections)         \
+    _(add_listener)             \
+    _(remove_listener)          \
+    _(list_listeners)           \
+    _(add_route)                \
+    _(remove_route)             \
+    _(list_routes)              \
+    _(cache_store)              \
+    _(cache_serve)              \
+    /*_(cache_clear) */         \
+    _(set_strategy)             \
+    _(set_wldr)                 \
+    _(add_punting)              \
+    _(mapme_activator)          \
+    _(mapme_timing)
+
+typedef header_control_message hc_msg_header_t;
+
+typedef union {
+#define _(x) x ## _command x;
+        foreach_hc_command
+#undef _
+} hc_msg_payload_t;
+
+
+typedef struct hc_msg_s {
+    hc_msg_header_t hdr;
+    hc_msg_payload_t payload;
+} hc_msg_t;
+
+/******************************************************************************
+ * Control Data
+ ******************************************************************************/
+
+hc_data_t *
+hc_data_create(size_t in_element_size, size_t out_element_size)
+{
+    hc_data_t * data = malloc(sizeof(hc_data_t));
+    if (!data)
+        goto ERR_MALLOC;
+
+    /* FIXME Could be NULL thanks to realloc provided size is 0 */
+    data->max_size_log = DEFAULT_SIZE_LOG;
+    data->in_element_size = in_element_size;
+    data->out_element_size = out_element_size;
+    data->size = 0;
+    data->complete = 0;
+    data->command_id = 0; // TODO this could also be a busy mark in the socket
+    /* No callback needed in blocking code for instance */
+    data->complete_cb = NULL;
+
+    data->buffer = malloc((1 << data->max_size_log) * data->out_element_size);
+    if (!data->buffer)
+        goto ERR_BUFFER;
+
+    return data;
+
+ERR_BUFFER:
+    free(data);
+ERR_MALLOC:
+    return NULL;
+}
+
+void
+hc_data_free(hc_data_t * data)
+{
+    if (data->buffer)
+        free(data->buffer);
+    free(data);
+}
+
+int
+hc_data_ensure_available(hc_data_t * data, size_t count)
+{
+    size_t new_size_log = (data->size + count - 1 > 0)
+        ? log2(data->size + count - 1) + 1
+        : 0;
+    if (new_size_log > data->max_size_log) {
+        data->max_size_log = new_size_log;
+        data->buffer = realloc(data->buffer, (1 << new_size_log) * data->out_element_size);
+        if (!data->buffer)
+             return LIBHICNCTRL_FAILURE;
+    }
+     return LIBHICNCTRL_SUCCESS;
+}
+
+int
+hc_data_push_many(hc_data_t * data, const void * elements, size_t count)
+{
+    if (hc_data_ensure_available(data, count) < 0)
+         return LIBHICNCTRL_FAILURE;
+
+    memcpy(data->buffer + data->size * data->out_element_size, elements,
+            count * data->out_element_size);
+    data->size += count;
+     return LIBHICNCTRL_SUCCESS;
+}
+
+int
+hc_data_push(hc_data_t * data, const void * element)
+{
+    return hc_data_push_many(data, element, 1);
+}
+
+/**
+ *
+ * NOTE: This function make sure there is enough room available in the data
+ * structure.
+ */
+u8 *
+hc_data_get_next(hc_data_t * data)
+{
+    if (hc_data_ensure_available(data, 1) < 0)
+        return NULL;
+
+    return data->buffer + data->size * data->out_element_size;
+}
+
+int
+hc_data_set_callback(hc_data_t * data, data_callback_t cb, void * cb_data)
+{
+    data->complete_cb = cb;
+    data->complete_cb_data = cb_data;
+     return LIBHICNCTRL_SUCCESS;
+}
+
+int
+hc_data_set_complete(hc_data_t * data)
+{
+    data->complete = true;
+    if (data->complete_cb)
+        return data->complete_cb(data, data->complete_cb_data);
+     return LIBHICNCTRL_SUCCESS;
+}
+
+int
+hc_data_reset(hc_data_t * data)
+{
+    data->size = 0;
+     return LIBHICNCTRL_SUCCESS;
+}
+
+/******************************************************************************
+ * Control socket
+ ******************************************************************************/
+
+/**
+ * \brief Parse a connection URL into a sockaddr
+ * \param [in] url - URL
+ * \param [out] sa - Resulting struct sockaddr, expected zero'ed.
+ * \return 0 if parsing succeeded, a negative error value otherwise.
+ */
+int
+hc_sock_parse_url(const char * url, struct sockaddr * sa)
+{
+    /* FIXME URL parsing is currently not implemented */
+    assert(!url);
+
+    /*
+     * A temporary solution is to inspect the sa_family fields of the passed in
+     * sockaddr, which defaults to AF_UNSPEC (0) and thus creates an IPv4/TCP
+     * connection to localhost.
+     */
+    switch (sa->sa_family) {
+        case AF_UNSPEC:
+        case AF_INET:
+        {
+            struct sockaddr_in * sai = (struct sockaddr_in *)sa;
+            sai->sin_family = AF_INET;
+            sai->sin_port = htons(PORT);
+            sai->sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+            break;
+        }
+        case AF_INET6:
+        {
+            struct sockaddr_in6 * sai6 = (struct sockaddr_in6 *)sa;
+            sai6->sin6_family = AF_INET6;
+            sai6->sin6_port = htons(PORT);
+            sai6->sin6_addr = loopback_addr;
+            break;
+        }
+        default:
+             return LIBHICNCTRL_FAILURE;
+    }
+
+     return LIBHICNCTRL_SUCCESS;
+}
+
+hc_sock_t *
+hc_sock_create_url(const char * url)
+{
+    hc_sock_t * s = malloc(sizeof(hc_sock_t));
+    if (!s)
+        goto ERR_MALLOC;
+
+    s->url = url ? strdup(url) : NULL;
+
+    s->fd = socket(AF_INET, SOCK_STREAM, 0);
+    if (s->fd < 0)
+        goto ERR_SOCKET;
+
+    if (hc_sock_reset(s) < 0)
+        goto ERR_RESET;
+
+    return s;
+
+ERR_RESET:
+    close(s->fd);
+ERR_SOCKET:
+    free(s);
+ERR_MALLOC:
+    return NULL;
+}
+
+hc_sock_t *
+hc_sock_create(void)
+{
+    return hc_sock_create_url(NULL);
+}
+
+void
+hc_sock_free(hc_sock_t * s)
+{
+    if (s->url)
+        free(s->url);
+    close(s->fd);
+    free(s);
+}
+
+int
+hc_sock_set_nonblocking(hc_sock_t *s)
+{
+    return (fcntl(s->fd, F_SETFL, fcntl(s->fd, F_GETFL) | O_NONBLOCK) < 0);
+}
+
+int
+hc_sock_connect(hc_sock_t *s)
+{
+    struct sockaddr_storage ss = { 0 };
+
+    if (hc_sock_parse_url(s->url, (struct sockaddr *)&ss) < 0)
+        goto ERR_PARSE;
+
+    size_t size = ss.ss_family == AF_INET
+        ? sizeof(struct sockaddr_in)
+        : sizeof(struct sockaddr_in6);
+    if (connect(s->fd, (struct sockaddr *)&ss, size) < 0) //sizeof(struct sockaddr)) < 0)
+        goto ERR_CONNECT;
+
+     return LIBHICNCTRL_SUCCESS;
+
+ERR_CONNECT:
+ERR_PARSE:
+     return LIBHICNCTRL_FAILURE;
+}
+
+int
+hc_sock_send(hc_sock_t * s, hc_msg_t * msg, size_t msglen)
+{
+    return send(s->fd, msg, msglen, 0);
+}
+
+int
+hc_sock_get_available(hc_sock_t * s, u8 ** buffer, size_t * size)
+{
+    *buffer = s->buf + s->woff;
+    *size = RECV_BUFLEN - s->woff;
+
+     return LIBHICNCTRL_SUCCESS;
+}
+
+int
+hc_sock_recv(hc_sock_t * s, hc_data_t * data)
+{
+    int rc;
+
+    /*
+     * This condition should be ensured to guarantee correct processing of
+     * messages
+     */
+    assert(RECV_BUFLEN - s->woff > MIN_BUFLEN);
+
+    rc = recv(s->fd, s->buf + s->woff, RECV_BUFLEN - s->woff, 0);
+    if (rc == 0) {
+         return LIBHICNCTRL_FAILURE;
+        /* Connection has been closed */
+        // XXX
+    }
+    if (rc < 0) {
+        /* Error occurred */
+        // XXX check for EWOULDBLOCK;
+        // XXX
+         return LIBHICNCTRL_FAILURE;
+    }
+    s->woff += rc;
+     return LIBHICNCTRL_SUCCESS;
+}
+
+int
+hc_sock_process(hc_sock_t * s, hc_data_t * data,
+        int (*parse)(const u8 * src, u8 * dst))
+{
+    int err = 0;
+
+    /* We must have received at least one byte */
+    size_t available = s->woff - s->roff;
+
+    while(available > 0) {
+
+        if (s->remaining == 0) {
+            hc_msg_t * msg = (hc_msg_t*)(s->buf + s->roff);
+
+            /* We expect a message header */
+            if (available < sizeof(hc_msg_header_t))
+                break;
+
+            /* Sanity checks (might instead raise warnings) */
+            // TODO: sync check ?
+            assert((msg->hdr.messageType == RESPONSE_LIGHT) ||
+                   (msg->hdr.messageType == ACK_LIGHT) ||
+                   (msg->hdr.messageType == NACK_LIGHT));
+            //assert(msg->hdr.commandID == data->command_id); // FIXME
+            assert(msg->hdr.seqNum == s->recv_seq++);
+
+            s->remaining = msg->hdr.length;
+            if (s->remaining == 0) {
+                /*
+                 * The protocol expects all sequence number to be reset after
+                 * each transaction. We reset before running the callback in
+                 * case it triggers new exchanges.
+                 */
+                s->send_seq = HICN_CTRL_SEND_SEQ_INIT;
+                s->recv_seq = HICN_CTRL_RECV_SEQ_INIT;
+
+                // TODO : check before even sending ?
+                /* Complete message without payload */
+                // TODO : is this correct ? no error code ?
+                hc_data_set_complete(data);
+            }
+
+            available -= sizeof(hc_msg_header_t);
+            s->roff += sizeof(hc_msg_header_t);
+        } else {
+            /* We expect the complete payload, or at least a chunk of it */
+            size_t num_chunks = available / data->in_element_size;
+            if (num_chunks == 0)
+                break;
+            if (num_chunks > s->remaining)
+                num_chunks = s->remaining;
+
+            if (!parse) {
+                hc_data_push_many(data, s->buf + s->roff, num_chunks);
+            } else {
+                int rc;
+                rc = hc_data_ensure_available(data, num_chunks);
+                if (rc < 0)
+                     return LIBHICNCTRL_FAILURE;
+                for (int i = 0; i < num_chunks; i++) {
+                    u8 * dst = hc_data_get_next(data);
+                    if (!dst)
+                         return LIBHICNCTRL_FAILURE;
+
+                    rc = parse(s->buf + s->roff + i * data->in_element_size, dst);
+                    if (rc < 0)
+                        err = -1; /* FIXME we let the loop complete (?) */
+                    data->size++;
+                }
+            }
+
+
+            s->remaining -= num_chunks;
+            if (s->remaining == 0) {
+                /*
+                 * The protocol expects all sequence number to be reset after
+                 * each transaction. We reset before running the callback in
+                 * case it triggers new exchanges.
+                 */
+                s->send_seq = HICN_CTRL_SEND_SEQ_INIT;
+                s->recv_seq = HICN_CTRL_RECV_SEQ_INIT;
+
+                hc_data_set_complete(data);
+            }
+
+            available -= num_chunks * data->in_element_size;
+            s->roff += num_chunks * data->in_element_size;
+        }
+    }
+
+    /* Make sure there is enough remaining space in the buffer */
+    if (RECV_BUFLEN - s->woff < AVG_BUFLEN) {
+        /*
+         * There should be no overlap provided a sufficiently large BUFLEN, but
+         * who knows.
+         */
+        memmove(s->buf, s->buf + s->roff, s->woff - s->roff);
+        s->woff -= s->roff;
+        s->roff = 0;
+    }
+
+    return err;
+}
+
+int
+hc_sock_reset(hc_sock_t * s)
+{
+    s->roff = s->woff = 0;
+    s->send_seq = HICN_CTRL_SEND_SEQ_INIT;
+    s->recv_seq = HICN_CTRL_RECV_SEQ_INIT;
+    s->remaining = 0;
+     return LIBHICNCTRL_SUCCESS;
+}
+
+/******************************************************************************
+ * Command-specific structures and functions
+ ******************************************************************************/
+
+typedef int (*HC_PARSE)(const u8 *, u8 *);
+
+typedef struct {
+    hc_action_t cmd;
+    command_id cmd_id;
+    size_t size_in;
+    size_t size_out;
+    HC_PARSE parse;
+} hc_command_params_t;
+
+int
+hc_execute_command(hc_sock_t * s, hc_msg_t * msg, size_t msg_len,
+        hc_command_params_t * params, hc_data_t ** pdata)
+{
+    /* Sanity check */
+    switch(params->cmd) {
+        case ACTION_CREATE:
+            assert(params->size_in != 0); /* payload repeated */
+            assert(params->size_out == 0);
+            assert(params->parse == NULL);
+            break;
+        case ACTION_DELETE:
+            assert(params->size_in != 0); /* payload repeated */
+            assert(params->size_out == 0);
+            assert(params->parse == NULL);
+            break;
+        case ACTION_LIST:
+            assert(params->size_in != 0);
+            assert(params->size_out != 0);
+            assert(params->parse != NULL);
+            break;
+        case ACTION_SET:
+            assert(params->size_in != 0);
+            assert(params->size_out == 0);
+            assert(params->parse == NULL);
+            break;
+        default:
+             return LIBHICNCTRL_FAILURE;
+    }
+
+    hc_sock_reset(s);
+
+    /* XXX data will at least store the result (complete) */
+    hc_data_t * data = hc_data_create(params->size_in, params->size_out);
+    if (!data)
+        goto ERR_DATA;
+
+    hc_sock_send(s, msg, msg_len);
+    while(!data->complete) {
+        if (hc_sock_recv(s, data) < 0)
+            break;
+        if (hc_sock_process(s, data, params->parse) < 0) {
+            goto ERR_PROCESS;
+        }
+    }
+
+    if (pdata)
+        *pdata = data;
+
+     return LIBHICNCTRL_SUCCESS;
+
+ERR_PROCESS:
+    free(data);
+ERR_DATA:
+     return LIBHICNCTRL_FAILURE;
+}
+
+/* /!\ Please update constants in header file upon changes */
+int
+hc_url_snprintf(char * s, size_t size, int family,
+        const ip_address_t * ip_address, u16 port)
+{
+    char * cur = s;
+    int rc;
+
+    /* Other address are currently not supported */
+    if (!IS_VALID_FAMILY(family)) {
+        ERROR("Invalid family %d for IP address", family);
+        return -1;
+    }
+
+    rc = snprintf(cur, s + size - cur, "inet%c://",
+            (family == AF_INET) ? '4' : '6');
+    if (rc < 0)
+        return rc;
+    cur += rc;
+    if (size != 0 && cur >= s + size)
+        return cur - s;
+
+    rc = ip_address_snprintf(cur, s + size - cur, ip_address, family);
+    if (rc < 0)
+        return rc;
+    cur += rc;
+    if (size != 0 && cur >= s + size)
+        return cur - s;
+
+    rc = snprintf(cur, s + size - cur, ":");
+    if (rc < 0)
+        return rc;
+    cur += rc;
+    if (size != 0 && cur >= s + size)
+        return cur - s;
+
+    rc = snprintf(cur, s + size - cur, "%d", port);
+    if (rc < 0)
+        return rc;
+    cur += rc;
+    if (size != 0 && cur >= s + size)
+        return cur - s;
+
+    return cur - s;
+}
+
+/*----------------------------------------------------------------------------*
+ * Listeners
+ *----------------------------------------------------------------------------*/
+
+/* LISTENER CREATE */
+
+int
+hc_listener_create(hc_sock_t * s, hc_listener_t * listener)
+{
+    if (!IS_VALID_FAMILY(listener->family))
+         return LIBHICNCTRL_FAILURE;
+
+    if (!IS_VALID_CONNECTION_TYPE(listener->type))
+         return LIBHICNCTRL_FAILURE;
+
+    struct {
+        header_control_message hdr;
+        add_listener_command payload;
+    } msg = {
+        .hdr = {
+            .messageType = REQUEST_LIGHT,
+            .commandID = ADD_LISTENER,
+            .length = 1,
+            .seqNum = s->send_seq,
+        },
+        .payload = {
+            .address = {
+                .ipv6 = listener->local_addr.v6.as_in6addr,
+            },
+            .port = htons(listener->local_port),
+            .addressType = (u8)map_to_addr_type[listener->family],
+            .listenerMode = (u8)map_to_listener_mode[listener->type],
+            .connectionType = (u8)map_to_connection_type[listener->type],
+        }
+    };
+
+    snprintf(msg.payload.symbolic, NAME_LEN, "%s", listener->name);
+#ifdef __linux__
+    snprintf(msg.payload.interfaceName, INTERFACE_LEN, "%s", listener->interface_name);
+#endif
+
+    hc_command_params_t params = {
+        .cmd = ACTION_CREATE,
+        .cmd_id = ADD_LISTENER,
+        .size_in = sizeof(add_listener_command),
+        .size_out = 0,
+        .parse = NULL,
+    };
+
+    return hc_execute_command(s, (hc_msg_t*)&msg, sizeof(msg), &params, NULL);
+}
+
+/* LISTENER GET */
+
+int
+hc_listener_get(hc_sock_t *s, hc_listener_t * listener,
+        hc_listener_t ** listener_found)
+{
+    hc_data_t * listeners;
+
+    if (hc_listener_list(s, &listeners) < 0)
+        return LIBHICNCTRL_FAILURE;
+
+    /* Test */
+    if (hc_listener_find(listeners, listener, listener_found) < 0)
+        return LIBHICNCTRL_FAILURE;
+
+    hc_data_free(listeners);
+
+    return LIBHICNCTRL_SUCCESS;
+}
+
+
+/* LISTENER DELETE */
+
+int
+hc_listener_delete(hc_sock_t * s, hc_listener_t * listener)
+{
+    struct {
+        header_control_message hdr;
+        remove_listener_command payload;
+    } msg = {
+        .hdr = {
+            .messageType = REQUEST_LIGHT,
+            .commandID = REMOVE_LISTENER,
+            .length = 1,
+            .seqNum = s->send_seq,
+        },
+    };
+
+    if (listener->id) {
+        printf("Delete by ID\n");
+        snprintf(msg.payload.symbolicOrListenerid, NAME_LEN, "%d", listener->id);
+    } else if (*listener->name) {
+        printf("Delete by name %s\n", listener->name);
+        snprintf(msg.payload.symbolicOrListenerid, NAME_LEN, "%s", listener->name);
+    } else {
+        printf("Delete after search\n");
+        hc_listener_t * listener_found;
+        if (hc_listener_get(s, listener, &listener_found) < 0)
+            return LIBHICNCTRL_FAILURE;
+        if (!listener_found)
+            return LIBHICNCTRL_FAILURE;
+        printf("Delete listener ID=%d\n", listener_found->id);
+        snprintf(msg.payload.symbolicOrListenerid, NAME_LEN, "%d", listener_found->id);
+    }
+
+    hc_command_params_t params = {
+        .cmd = ACTION_DELETE,
+        .cmd_id = REMOVE_LISTENER,
+        .size_in = sizeof(remove_listener_command),
+        .size_out = 0,
+        .parse = NULL,
+    };
+
+    return hc_execute_command(s, (hc_msg_t*)&msg, sizeof(msg), &params, NULL);
+}
+
+/* LISTENER LIST */
+
+int
+hc_listener_list(hc_sock_t * s, hc_data_t ** pdata)
+{
+    struct {
+        header_control_message hdr;
+    } msg = {
+        .hdr = {
+            .messageType = REQUEST_LIGHT,
+            .commandID = LIST_LISTENERS,
+            .length = 0,
+            .seqNum = s->send_seq,
+        },
+    };
+
+    hc_command_params_t params = {
+        .cmd = ACTION_LIST,
+        .cmd_id = LIST_LISTENERS,
+        .size_in = sizeof(list_listeners_command),
+        .size_out = sizeof(hc_listener_t),
+        .parse = (HC_PARSE)hc_listener_parse,
+    };
+
+    return hc_execute_command(s, (hc_msg_t*)&msg, sizeof(msg), &params, pdata);
+}
+
+/* LISTENER VALIDATE */
+
+int
+hc_listener_validate(const hc_listener_t * listener)
+{
+    if (!IS_VALID_FAMILY(listener->family))
+         return LIBHICNCTRL_FAILURE;
+
+    if (!IS_VALID_CONNECTION_TYPE(listener->type))
+         return LIBHICNCTRL_FAILURE;
+
+    return LIBHICNCTRL_SUCCESS;
+}
+
+/* LISTENER CMP */
+
+int
+hc_listener_cmp(const hc_listener_t * l1, const hc_listener_t * l2)
+{
+    return ((l1->type == l2->type) &&
+            (l1->family == l2->family) &&
+            (ip_address_cmp(&l1->local_addr, &l2->local_addr, l1->family) == 0) &&
+            (l1->local_port == l2->local_port))
+        ? LIBHICNCTRL_SUCCESS
+        : LIBHICNCTRL_FAILURE;
+}
+
+/* LISTENER PARSE */
+
+int
+hc_listener_parse(void * in, hc_listener_t * listener)
+{
+    list_listeners_command * cmd = (list_listeners_command *)in;
+
+    if (!IS_VALID_LIST_LISTENERS_TYPE(cmd->encapType))
+         return LIBHICNCTRL_FAILURE;
+
+    hc_connection_type_t type = map_from_encap_type[cmd->encapType];
+    if (type == CONNECTION_TYPE_UNDEFINED)
+         return LIBHICNCTRL_FAILURE;
+
+    if (!IS_VALID_ADDR_TYPE(cmd->addressType))
+         return LIBHICNCTRL_FAILURE;
+
+    int family = map_from_addr_type[cmd->addressType];
+    if (!IS_VALID_FAMILY(family))
+         return LIBHICNCTRL_FAILURE;
+
+    *listener = (hc_listener_t) {
+        .id = cmd->connid,
+        .type = type,
+        .family = family,
+        .local_addr = UNION_CAST(cmd->address, ip_address_t),
+        .local_port = ntohs(cmd->port),
+    };
+    memset(listener->name, 0, NAME_LEN);
+    return LIBHICNCTRL_SUCCESS;
+}
+
+GENERATE_FIND(listener)
+
+/* LISTENER SNPRINTF */
+
+/* /!\ Please update constants in header file upon changes */
+int
+hc_listener_snprintf(char * s, size_t size, hc_listener_t * listener)
+{
+    char local[MAXSZ_HC_URL];
+    int rc;
+    rc = hc_url_snprintf(local, MAXSZ_HC_URL,
+         listener->family, &listener->local_addr, listener->local_port);
+    if (rc < 0)
+        return rc;
+
+    return snprintf(s, size+17, "%s %s",
+            local,
+            connection_type_str[listener->type]);
+}
+
+/*----------------------------------------------------------------------------*
+ * CONNECTION
+ *----------------------------------------------------------------------------*/
+
+/* CONNECTION CREATE */
+
+int
+hc_connection_create(hc_sock_t * s, hc_connection_t * connection)
+{
+    if (hc_connection_validate(connection) < 0)
+        return LIBHICNCTRL_FAILURE;
+
+    struct {
+        header_control_message hdr;
+        add_connection_command payload;
+    } msg = {
+        .hdr = {
+            .messageType = REQUEST_LIGHT,
+            .commandID = ADD_CONNECTION,
+            .length = 1,
+            .seqNum = s->send_seq,
+        },
+        .payload = {
+            /* we use IPv6 which is the longest address */
+            .remoteIp.ipv6 = connection->remote_addr.v6.as_in6addr,
+            .localIp.ipv6 = connection->local_addr.v6.as_in6addr,
+            .remotePort = htons(connection->remote_port),
+            .localPort = htons(connection->local_port),
+            .ipType = (u8)map_to_addr_type[connection->family],
+            .admin_state = connection->admin_state,
+#ifdef WITH_POLICY
+            .tags = connection->tags,
+#endif /* WITH_POLICY */
+            .connectionType = (u8)map_to_connection_type[connection->type],
+        }
+    };
+    snprintf(msg.payload.symbolic, NAME_LEN, "%s", connection->name);
+
+    hc_command_params_t params = {
+        .cmd = ACTION_CREATE,
+        .cmd_id = ADD_CONNECTION,
+        .size_in = sizeof(add_connection_command),
+        .size_out = 0,
+        .parse = NULL,
+    };
+
+    return hc_execute_command(s, (hc_msg_t*)&msg, sizeof(msg), &params, NULL);
+}
+
+/* CONNECTION GET */
+
+int
+hc_connection_get(hc_sock_t *s, hc_connection_t * connection,
+        hc_connection_t ** connection_found)
+{
+    hc_data_t * connections;
+
+    if (hc_connection_list(s, &connections) < 0)
+        return LIBHICNCTRL_FAILURE;
+
+    /* Test */
+    if (hc_connection_find(connections, connection, connection_found) < 0)
+        return LIBHICNCTRL_FAILURE;
+
+    hc_data_free(connections);
+
+    return LIBHICNCTRL_SUCCESS;
+}
+
+
+/* CONNECTION DELETE */
+
+int
+hc_connection_delete(hc_sock_t * s, hc_connection_t * connection)
+{
+    struct {
+        header_control_message hdr;
+        remove_connection_command payload;
+    } msg = {
+        .hdr = {
+            .messageType = REQUEST_LIGHT,
+            .commandID = REMOVE_CONNECTION,
+            .length = 1,
+            .seqNum = s->send_seq,
+        },
+    };
+
+    if (connection->id) {
+        printf("Delete by ID\n");
+        snprintf(msg.payload.symbolicOrConnid, NAME_LEN, "%d", connection->id);
+    } else if (*connection->name) {
+        printf("Delete by name %s\n", connection->name);
+        snprintf(msg.payload.symbolicOrConnid, NAME_LEN, "%s", connection->name);
+    } else {
+        printf("Delete after search\n");
+        hc_connection_t * connection_found;
+        if (hc_connection_get(s, connection, &connection_found) < 0)
+            return LIBHICNCTRL_FAILURE;
+        if (!connection_found)
+            return LIBHICNCTRL_FAILURE;
+        printf("Delete connection ID=%d\n", connection_found->id);
+        snprintf(msg.payload.symbolicOrConnid, NAME_LEN, "%d", connection_found->id);
+    }
+
+    hc_command_params_t params = {
+        .cmd = ACTION_DELETE,
+        .cmd_id = REMOVE_CONNECTION,
+        .size_in = sizeof(remove_connection_command),
+        .size_out = 0,
+        .parse = NULL,
+    };
+
+    return hc_execute_command(s, (hc_msg_t*)&msg, sizeof(msg), &params, NULL);
+}
+
+
+/* CONNECTION LIST */
+
+int
+hc_connection_list(hc_sock_t * s, hc_data_t ** pdata)
+{
+    struct {
+        header_control_message hdr;
+    } msg = {
+        .hdr = {
+            .messageType = REQUEST_LIGHT,
+            .commandID = LIST_CONNECTIONS,
+            .length = 0,
+            .seqNum = s->send_seq,
+        },
+    };
+
+    hc_command_params_t params = {
+        .cmd = ACTION_LIST,
+        .cmd_id = LIST_CONNECTIONS,
+        .size_in = sizeof(list_connections_command),
+        .size_out = sizeof(hc_connection_t),
+        .parse = (HC_PARSE)hc_connection_parse,
+    };
+
+    return hc_execute_command(s, (hc_msg_t*)&msg, sizeof(msg), &params, pdata);
+}
+
+/* CONNECTION VALIDATE */
+
+int
+hc_connection_validate(const hc_connection_t * connection)
+{
+    if (!IS_VALID_FAMILY(connection->family))
+         return LIBHICNCTRL_FAILURE;
+
+    if (!IS_VALID_CONNECTION_TYPE(connection->type))
+         return LIBHICNCTRL_FAILURE;
+
+    /* TODO assert both local and remote have the right family */
+
+    return LIBHICNCTRL_SUCCESS;
+}
+
+/* CONNECTION CMP */
+
+/*
+ * hICN light uses ports even for hICN connections, but their value is ignored.
+ * As connections are specific to hicn-light, we can safely use IP and ports for
+ * comparison independently of the face type.
+ */
+int hc_connection_cmp(const hc_connection_t * c1, const hc_connection_t * c2)
+{
+    return ((c1->type == c2->type) &&
+            (c1->family == c2->family) &&
+            (ip_address_cmp(&c1->local_addr, &c2->local_addr, c1->family) == 0) &&
+            (c1->local_port == c2->local_port) &&
+            (ip_address_cmp(&c1->remote_addr, &c2->remote_addr, c1->family) == 0) &&
+            (c1->remote_port == c2->remote_port))
+        ? LIBHICNCTRL_SUCCESS
+        : LIBHICNCTRL_FAILURE;
+}
+
+/* CONNECTION PARSE */
+
+int
+hc_connection_parse(void * in, hc_connection_t * connection)
+{
+    list_connections_command * cmd = (list_connections_command *)in;
+
+    if (!IS_VALID_LIST_CONNECTIONS_TYPE(cmd->connectionData.connectionType))
+         return LIBHICNCTRL_FAILURE;
+
+    hc_connection_type_t type = map_from_list_connections_type[cmd->connectionData.connectionType];
+    if (type == CONNECTION_TYPE_UNDEFINED)
+         return LIBHICNCTRL_FAILURE;
+
+    if (!IS_VALID_LIST_CONNECTIONS_STATE(cmd->state))
+         return LIBHICNCTRL_FAILURE;
+
+    hc_connection_state_t state = map_from_list_connections_state[cmd->state];
+    if (state == HC_CONNECTION_STATE_UNDEFINED)
+         return LIBHICNCTRL_FAILURE;
+
+    if (!IS_VALID_ADDR_TYPE(cmd->connectionData.ipType))
+         return LIBHICNCTRL_FAILURE;
+
+    int family = map_from_addr_type[cmd->connectionData.ipType];
+    if (!IS_VALID_FAMILY(family))
+         return LIBHICNCTRL_FAILURE;
+
+    *connection = (hc_connection_t) {
+        .id = cmd->connid,
+        .type = type,
+        .family = family,
+        .local_addr = UNION_CAST(cmd->connectionData.localIp, ip_address_t),
+        .local_port = ntohs(cmd->connectionData.localPort),
+        .remote_addr = UNION_CAST(cmd->connectionData.remoteIp, ip_address_t),
+        .remote_port = ntohs(cmd->connectionData.remotePort),
+        .admin_state = cmd->connectionData.admin_state,
+#ifdef WITH_POLICY
+        .tags = cmd->connectionData.tags,
+#endif /* WITH_POLICY */
+        .state = state,
+    };
+    snprintf(connection->name, NAME_LEN, "%s", cmd->connectionData.symbolic);
+    return LIBHICNCTRL_SUCCESS;
+}
+
+GENERATE_FIND(connection)
+
+/* CONNECTION SNPRINTF */
+
+/* /!\ Please update constants in header file upon changes */
+int
+hc_connection_snprintf(char * s, size_t size, const hc_connection_t * connection)
+{
+    char local[MAXSZ_HC_URL];
+    char remote[MAXSZ_HC_URL];
+    int rc;
+
+    // assert(connection->connection_state)
+
+    rc = hc_url_snprintf(local, MAXSZ_HC_URL, connection->family,
+            &connection->local_addr, connection->local_port);
+    if (rc < 0)
+        return rc;
+    rc = hc_url_snprintf(remote, MAXSZ_HC_URL, connection->family,
+            &connection->remote_addr, connection->remote_port);
+    if (rc < 0)
+        return rc;
+
+    return snprintf(s, size, "%s %s %s %s",
+            connection_state_str[connection->state],
+            local,
+            remote,
+            connection_type_str[connection->type]);
+}
+
+/* CONNECTION SET ADMIN STATE */
+
+int
+hc_connection_set_admin_state(hc_sock_t * s, const char * conn_id_or_name,
+        hc_connection_state_t admin_state)
+{
+    struct {
+        header_control_message hdr;
+        connection_set_admin_state_command payload;
+    } msg = {
+        .hdr = {
+            .messageType = REQUEST_LIGHT,
+            .commandID = CONNECTION_SET_ADMIN_STATE,
+            .length = 1,
+            .seqNum = s->send_seq,
+        },
+        .payload = {
+            .admin_state = admin_state,
+        },
+    };
+    snprintf(msg.payload.symbolicOrConnid, NAME_LEN, "%s", conn_id_or_name);
+
+    hc_command_params_t params = {
+        .cmd = ACTION_SET,
+        .cmd_id = CONNECTION_SET_ADMIN_STATE,
+        .size_in = sizeof(connection_set_admin_state_command),
+        .size_out = 0,
+        .parse = NULL,
+    };
+
+    return hc_execute_command(s, (hc_msg_t*)&msg, sizeof(msg), &params, NULL);
+}
+
+/*----------------------------------------------------------------------------*
+ * Routes
+ *----------------------------------------------------------------------------*/
+
+/* ROUTE CREATE */
+
+int
+hc_route_create(hc_sock_t * s, hc_route_t * route)
+{
+    if (!IS_VALID_FAMILY(route->family))
+         return LIBHICNCTRL_FAILURE;
+
+    struct {
+        header_control_message hdr;
+        add_route_command payload;
+    } msg = {
+        .hdr = {
+            .messageType = REQUEST_LIGHT,
+            .commandID = ADD_ROUTE,
+            .length = 1,
+            .seqNum = s->send_seq,
+        },
+        .payload = {
+            /* we use IPv6 which is the longest address */
+            .address.ipv6 = route->remote_addr.v6.as_in6addr,
+            .cost = route->cost,
+            .addressType = (u8)map_to_addr_type[route->family],
+            .len = route->len,
+        }
+    };
+
+    /*
+     * The route commands expects the ID (or name that we don't use) as part of
+     * the symbolicOrConnid attribute.
+     */
+    snprintf(msg.payload.symbolicOrConnid, NAME_LEN, "%d", route->face_id);
+
+    hc_command_params_t params = {
+        .cmd = ACTION_CREATE,
+        .cmd_id = ADD_ROUTE,
+        .size_in = sizeof(add_route_command),
+        .size_out = 0,
+        .parse = NULL,
+    };
+
+    return hc_execute_command(s, (hc_msg_t*)&msg, sizeof(msg), &params, NULL);
+}
+
+/* ROUTE DELETE */
+
+int
+hc_route_delete(hc_sock_t * s, hc_route_t * route)
+{
+    if (!IS_VALID_FAMILY(route->family))
+         return LIBHICNCTRL_FAILURE;
+
+    struct {
+        header_control_message hdr;
+        remove_route_command payload;
+    } msg = {
+        .hdr = {
+            .messageType = REQUEST_LIGHT,
+            .commandID = REMOVE_ROUTE,
+            .length = 1,
+            .seqNum = s->send_seq,
+        },
+        .payload = {
+            /* we use IPv6 which is the longest address */
+            .address.ipv6 = route->remote_addr.v6.as_in6addr,
+            .addressType = (u8)map_to_addr_type[route->family],
+            .len = route->len,
+        }
+    };
+
+    hc_command_params_t params = {
+        .cmd = ACTION_DELETE,
+        .cmd_id = REMOVE_ROUTE,
+        .size_in = sizeof(remove_route_command),
+        .size_out = 0,
+        .parse = NULL,
+    };
+
+    return hc_execute_command(s, (hc_msg_t*)&msg, sizeof(msg), &params, NULL);
+}
+
+/* ROUTE LIST */
+
+int
+hc_route_list(hc_sock_t * s, hc_data_t ** pdata)
+{
+    struct {
+        header_control_message hdr;
+    } msg = {
+        .hdr = {
+            .messageType = REQUEST_LIGHT,
+            .commandID = LIST_ROUTES,
+            .length = 0,
+            .seqNum = s->send_seq,
+        },
+    };
+
+    hc_command_params_t params = {
+        .cmd = ACTION_LIST,
+        .cmd_id = LIST_ROUTES,
+        .size_in = sizeof(list_routes_command),
+        .size_out = sizeof(hc_route_t),
+        .parse = (HC_PARSE)hc_route_parse,
+    };
+
+    return hc_execute_command(s, (hc_msg_t*)&msg, sizeof(msg), &params, pdata);
+}
+
+/* ROUTE PARSE */
+
+int
+hc_route_parse(void * in, hc_route_t * route)
+{
+    list_routes_command * cmd = (list_routes_command *) in;
+
+    if (!IS_VALID_ADDR_TYPE(cmd->addressType))
+         return LIBHICNCTRL_FAILURE;
+
+    int family = map_from_addr_type[cmd->addressType];
+    if (!IS_VALID_FAMILY(family))
+         return LIBHICNCTRL_FAILURE;
+
+    *route = (hc_route_t) {
+        .face_id = cmd->connid,
+        .family = family,
+        .remote_addr = UNION_CAST(cmd->address, ip_address_t),
+        .len = cmd->len,
+        .cost = cmd->cost,
+    };
+    return LIBHICNCTRL_SUCCESS;
+}
+
+/* ROUTE SNPRINTF */
+
+/* /!\ Please update constants in header file upon changes */
+int
+hc_route_snprintf(char * s, size_t size, hc_route_t * route)
+{
+    /* interface cost prefix length */
+
+    char prefix[MAXSZ_IP_ADDRESS];
+    int rc;
+
+    rc = ip_address_snprintf(prefix, MAXSZ_IP_ADDRESS, &route->remote_addr,
+            route->family);
+    if (rc < 0)
+        return rc;
+
+    return snprintf(s, size, "%*d %*d %s %*d",
+            MAXSZ_FACE_ID,
+            route->face_id,
+            MAXSZ_COST,
+            route->cost,
+            prefix,
+            MAXSZ_LEN,
+            route->len);
+}
+
+/*----------------------------------------------------------------------------*
+ * Face
+ *
+ * Face support is not directly available in hicn-light, but we can offer such
+ * an interface through a combination of listeners and connections. The code
+ * starts with some conversion functions between faces/listeners/connections.
+ *
+ * We also need to make sure that there always exist a (single) listener when a
+ * connection is created, and in the hICN face case, that there is a single
+ * connection attached to this listener.
+ *
+ *----------------------------------------------------------------------------*/
+
+/* FACE -> LISTENER */
+
+int
+hc_face_to_listener(const hc_face_t * face, hc_listener_t * listener)
+{
+    const face_t * f = &face->face;
+
+    switch(f->type) {
+        case FACE_TYPE_HICN_LISTENER:
+            break;
+        case FACE_TYPE_TCP_LISTENER:
+            break;
+        case FACE_TYPE_UDP_LISTENER:
+            break;
+        default:
+             return LIBHICNCTRL_FAILURE;
+    }
+    return LIBHICNCTRL_FAILURE; /* XXX Not implemented */
+}
+
+/* LISTENER -> FACE */
+
+int
+hc_listener_to_face(const hc_listener_t * listener, hc_face_t * face)
+{
+    return LIBHICNCTRL_FAILURE; /* XXX Not implemented */
+}
+
+/* FACE -> CONNECTION */
+
+int
+hc_face_to_connection(const hc_face_t * face, hc_connection_t * connection, bool generate_name)
+{
+    const face_t * f = &face->face;
+
+    switch(f->type) {
+        case FACE_TYPE_HICN:
+            /* FIXME truncations, collisions, ... */
+            *connection = (hc_connection_t) {
+                .type = CONNECTION_TYPE_HICN,
+                .family = f->params.hicn.family,
+                .local_addr = f->params.hicn.local_addr,
+                .local_port = 0,
+                .remote_addr = f->params.hicn.remote_addr,
+                .remote_port = 0,
+                .admin_state = face_state_to_connection_state(f->admin_state),
+                .state = face_state_to_connection_state(f->state),
+#ifdef WITH_POLICY
+                .tags = f->tags,
+#endif /* WITH_POLICY */
+            };
+            snprintf(connection->name, NAME_LEN, "%s",
+                    f->params.hicn.netdevice.name);
+            break;
+        case FACE_TYPE_TCP:
+            *connection = (hc_connection_t) {
+                .type = CONNECTION_TYPE_TCP,
+                .family = f->params.hicn.family,
+                .local_addr = f->params.tunnel.local_addr,
+                .local_port = f->params.tunnel.local_port,
+                .remote_addr = f->params.tunnel.remote_addr,
+                .remote_port = f->params.tunnel.remote_port,
+                .admin_state = face_state_to_connection_state(f->admin_state),
+                .state = face_state_to_connection_state(f->state),
+#ifdef WITH_POLICY
+                .tags = f->tags,
+#endif /* WITH_POLICY */
+            };
+            if (generate_name) {
+#ifdef __APPLE__
+                snprintf(connection->name, NAME_LEN, "tcp%d", arc4random() & 0xFF);
+#else
+                snprintf(connection->name, NAME_LEN, "tcp%ld", random() & 0xFF);
+#endif
+            } else {
+                memset(connection->name, 0, NAME_LEN);
+            }
+            break;
+        case FACE_TYPE_UDP:
+            *connection = (hc_connection_t) {
+                .type = CONNECTION_TYPE_UDP,
+                .family = AF_INET,
+                .local_addr = f->params.tunnel.local_addr,
+                .local_port = f->params.tunnel.local_port,
+                .remote_addr = f->params.tunnel.remote_addr,
+                .remote_port = f->params.tunnel.remote_port,
+                .admin_state = face_state_to_connection_state(f->admin_state),
+                .state = face_state_to_connection_state(f->state),
+#ifdef WITH_POLICY
+                .tags = f->tags,
+#endif /* WITH_POLICY */
+            };
+            if (generate_name) {
+#ifdef __APPLE__
+                snprintf(connection->name, NAME_LEN, "udp%d", arc4random() & 0xFF);
+#else
+                snprintf(connection->name, NAME_LEN, "udp%ld", random() & 0xFF);
+#endif
+            } else {
+                memset(connection->name, 0, NAME_LEN);
+            }
+            break;
+        default:
+             return LIBHICNCTRL_FAILURE;
+    }
+
+     return LIBHICNCTRL_SUCCESS;
+}
+
+/* CONNECTION -> FACE */
+
+int
+hc_connection_to_face(const hc_connection_t * connection, hc_face_t * face)
+{
+    switch (connection->type) {
+        case CONNECTION_TYPE_TCP:
+            *face = (hc_face_t) {
+                .id = connection->id,
+                .face = {
+                    .type = FACE_TYPE_TCP,
+                    .params.tunnel = {
+                        .family = connection->family,
+                        .local_addr = connection->local_addr,
+                        .local_port = connection->local_port,
+                        .remote_addr = connection->remote_addr,
+                        .remote_port = connection->remote_port,
+                    },
+                    .admin_state = connection_state_to_face_state(connection->admin_state),
+                    .state = connection_state_to_face_state(connection->state),
+#ifdef WITH_POLICY
+                    .tags = connection->tags,
+#endif /* WITH_POLICY */
+                },
+            };
+            break;
+        case CONNECTION_TYPE_UDP:
+            *face = (hc_face_t) {
+                .id = connection->id,
+                .face = {
+                    .type = FACE_TYPE_UDP,
+                    .params.tunnel = {
+                        .family = connection->family,
+                        .local_addr = connection->local_addr,
+                        .local_port = connection->local_port,
+                        .remote_addr = connection->remote_addr,
+                        .remote_port = connection->remote_port,
+                    },
+                    .admin_state = connection_state_to_face_state(connection->admin_state),
+                    .state = connection_state_to_face_state(connection->state),
+#ifdef WITH_POLICY
+                    .tags = connection->tags,
+#endif /* WITH_POLICY */
+                },
+            };
+            break;
+        case CONNECTION_TYPE_HICN:
+            *face = (hc_face_t) {
+                .id = connection->id,
+                .face = {
+                    .type = FACE_TYPE_HICN,
+                    .params.hicn = {
+                        .family = connection->family,
+                        .netdevice.index = NETDEVICE_UNDEFINED_INDEX, // XXX
+                        .local_addr = connection->local_addr,
+                        .remote_addr = connection->remote_addr,
+                    },
+                    .admin_state = connection_state_to_face_state(connection->admin_state),
+                    .state = connection_state_to_face_state(connection->state),
+#ifdef WITH_POLICY
+                    .tags = connection->tags,
+#endif /* WITH_POLICY */
+                },
+            };
+            break;
+        default:
+            return LIBHICNCTRL_FAILURE;
+    }
+    snprintf(face->name, NAME_LEN, "%s", connection->name);
+    return LIBHICNCTRL_SUCCESS;
+}
+
+/* CONNECTION -> LISTENER */
+
+int
+hc_connection_to_local_listener(const hc_connection_t * connection, hc_listener_t * listener)
+{
+    *listener = (hc_listener_t) {
+        .id = ~0,
+        .type = connection->type,
+        .family = connection->family,
+        .local_addr = connection->local_addr,
+        .local_port = connection->local_port,
+    };
+    return LIBHICNCTRL_SUCCESS;
+}
+
+/* FACE CREATE */
+
+int
+hc_face_create(hc_sock_t * s, hc_face_t * face)
+{
+    hc_listener_t listener;
+    hc_listener_t * listener_found;
+
+    hc_connection_t connection;
+    hc_connection_t * connection_found;
+
+    switch(face->face.type)
+    {
+        case FACE_TYPE_HICN:
+        case FACE_TYPE_TCP:
+        case FACE_TYPE_UDP:
+            if (hc_face_to_connection(face, &connection, true) < 0) {
+                ERROR("[hc_face_create] Could not convert face to connection.");
+                return LIBHICNCTRL_FAILURE;
+            }
+
+            /* Ensure we have a corresponding local listener */
+            if (hc_connection_to_local_listener(&connection, &listener) < 0) {
+                ERROR("[hc_face_create] Could not convert face to local listener.");
+                return LIBHICNCTRL_FAILURE;
+            }
+
+            if (hc_listener_get(s, &listener, &listener_found) < 0) {
+                ERROR("[hc_face_create] Could not retrieve listener");
+                return LIBHICNCTRL_FAILURE;
+            }
+
+            if (!listener_found) {
+                /* We need to create the listener if it does not exist */
+                if (hc_listener_create(s, &listener) < 0) {
+                    ERROR("[hc_face_create] Could not create listener.");
+                    return LIBHICNCTRL_FAILURE;
+                }
+            }
+
+            /* Create corresponding connection */
+            if (hc_connection_create(s, &connection) < 0) {
+                ERROR("[hc_face_create] Could not create connection.");
+                return LIBHICNCTRL_FAILURE;
+            }
+
+            /*
+             * Once the connection is created, we need to list all connections
+             * and compare with the current one to find the created face ID.
+             */
+            if (hc_connection_get(s, &connection, &connection_found) < 0) {
+                ERROR("[hc_face_create] Could not retrieve connection");
+                return LIBHICNCTRL_FAILURE;
+            }
+
+            if (!connection_found) {
+                ERROR("[hc_face_create] Could not find newly created connection.");
+                return LIBHICNCTRL_FAILURE;
+            }
+
+            face->id = connection_found->id;
+
+            break;
+
+        case FACE_TYPE_HICN_LISTENER:
+        case FACE_TYPE_TCP_LISTENER:
+        case FACE_TYPE_UDP_LISTENER:
+            if (hc_face_to_listener(face, &listener) < 0) {
+                ERROR("Could not convert face to listener.");
+                return LIBHICNCTRL_FAILURE;
+            }
+            if (hc_listener_create(s, &listener) < 0) {
+                ERROR("[hc_face_create] Could not create listener.");
+                return LIBHICNCTRL_FAILURE;
+            }
+            return LIBHICNCTRL_FAILURE;
+            break;
+        default:
+            ERROR("[hc_face_create] Unknwon face type.");
+            return LIBHICNCTRL_FAILURE;
+    };
+
+    return LIBHICNCTRL_SUCCESS;
+}
+
+int
+hc_face_get(hc_sock_t * s, hc_face_t * face, hc_face_t ** face_found)
+{
+    hc_listener_t listener;
+    hc_listener_t * listener_found;
+
+    hc_connection_t connection;
+    hc_connection_t * connection_found;
+
+    switch(face->face.type)
+    {
+        case FACE_TYPE_HICN:
+        case FACE_TYPE_TCP:
+        case FACE_TYPE_UDP:
+            if (hc_face_to_connection(face, &connection, false) < 0)
+                 return LIBHICNCTRL_FAILURE;
+            if (hc_connection_get(s, &connection, &connection_found) < 0)
+                 return LIBHICNCTRL_FAILURE;
+            if (!connection_found) {
+                *face_found = NULL;
+                return LIBHICNCTRL_SUCCESS;
+            }
+            hc_connection_to_face(connection_found, *face_found);
+            break;
+
+        case FACE_TYPE_HICN_LISTENER:
+        case FACE_TYPE_TCP_LISTENER:
+        case FACE_TYPE_UDP_LISTENER:
+            if (hc_face_to_listener(face, &listener) < 0)
+                 return LIBHICNCTRL_FAILURE;
+            if (hc_listener_get(s, &listener, &listener_found) < 0)
+                 return LIBHICNCTRL_FAILURE;
+            if (!listener_found) {
+                *face_found = NULL;
+                return LIBHICNCTRL_SUCCESS;
+            }
+            hc_listener_to_face(listener_found, *face_found);
+            break;
+
+        default:
+             return LIBHICNCTRL_FAILURE;
+    }
+
+    return LIBHICNCTRL_SUCCESS;
+
+}
+
+/* FACE DELETE */
+
+int
+hc_face_delete(hc_sock_t * s, hc_face_t * face)
+{
+    /* XXX We currently do not delete the listener */
+    hc_connection_t connection;
+    if (hc_face_to_connection(face, &connection, false) < 0) {
+        ERROR("[hc_face_delete] Could not convert face to connection.");
+        return LIBHICNCTRL_FAILURE;
+    }
+    return hc_connection_delete(s, &connection);
+}
+
+/* FACE LIST */
+
+int
+hc_face_list(hc_sock_t * s, hc_data_t ** pdata)
+{
+    hc_data_t * connection_data;
+    hc_face_t face;
+
+    if (hc_connection_list(s, &connection_data) < 0) {
+        ERROR("[hc_face_list] Could not list connections.");
+        return LIBHICNCTRL_FAILURE;
+    }
+
+    hc_data_t * face_data = hc_data_create(sizeof(hc_connection_t), sizeof(hc_face_t));
+    foreach_connection(c, connection_data) {
+        if (hc_connection_to_face(c, &face) < 0) {
+            ERROR("[hc_face_list] Could not convert connection to face.");
+            goto ERR;
+        }
+        hc_data_push(face_data, &face);
+    }
+
+    *pdata = face_data;
+    hc_data_free(connection_data);
+    return LIBHICNCTRL_SUCCESS;
+
+ERR:
+    hc_data_free(connection_data);
+    return LIBHICNCTRL_FAILURE;
+}
+
+/* /!\ Please update constants in header file upon changes */
+int
+hc_face_snprintf(char * s, size_t size, hc_face_t * face)
+{
+    return LIBHICNCTRL_SUCCESS;
+}
+
+int
+hc_face_set_admin_state(hc_sock_t * s, const char * conn_id_or_name, // XXX wrong identifier
+        face_state_t admin_state)
+{
+    return hc_connection_set_admin_state(s, conn_id_or_name, (hc_connection_state_t)admin_state);
+}
+
+/*----------------------------------------------------------------------------*
+ * Punting
+ *----------------------------------------------------------------------------*/
+
+int hc_punting_create(hc_sock_t * s, hc_punting_t * punting)
+{
+    if (hc_punting_validate(punting) < 0)
+        return LIBHICNCTRL_FAILURE;
+
+    struct {
+        header_control_message hdr;
+        add_punting_command payload;
+    } msg = {
+        .hdr = {
+            .messageType = REQUEST_LIGHT,
+            .commandID = ADD_PUNTING,
+            .length = 1,
+            .seqNum = s->send_seq,
+        },
+        .payload = {
+            /* we use IPv6 which is the longest address */
+            .address.ipv6 = punting->prefix.v6.as_in6addr,
+            .addressType = (u8)map_to_addr_type[punting->family],
+            .len = punting->prefix_len,
+        }
+    };
+    snprintf(msg.payload.symbolicOrConnid, NAME_LEN, "%d", punting->face_id);
+
+    hc_command_params_t params = {
+        .cmd = ACTION_CREATE,
+        .cmd_id = ADD_PUNTING,
+        .size_in = sizeof(add_punting_command),
+        .size_out = 0,
+        .parse = NULL,
+    };
+
+    return hc_execute_command(s, (hc_msg_t*)&msg, sizeof(msg), &params, NULL);
+}
+
+int hc_punting_get(hc_sock_t * s, hc_punting_t * punting, hc_punting_t ** punting_found)
+{
+    return LIBHICNCTRL_NOT_IMPLEMENTED;
+}
+
+int hc_punting_delete(hc_sock_t * s, hc_punting_t * punting)
+{
+    return LIBHICNCTRL_NOT_IMPLEMENTED;
+}
+
+int hc_punting_list(hc_sock_t * s, hc_data_t ** pdata)
+{
+    return LIBHICNCTRL_NOT_IMPLEMENTED;
+}
+
+int hc_punting_validate(const hc_punting_t * punting)
+{
+    if (!IS_VALID_FAMILY(punting->family))
+         return LIBHICNCTRL_FAILURE;
+
+    /*
+     * We might use the zero value to add punting on all faces but this is not
+     * (yet) implemented
+     */
+    if (punting->face_id == 0)
+        return LIBHICNCTRL_NOT_IMPLEMENTED;
+
+    return LIBHICNCTRL_SUCCESS;
+}
+
+int hc_punting_cmp(const hc_punting_t * p1, const hc_punting_t * p2)
+{
+    return ((p1->face_id == p2->face_id) &&
+            (p1->family == p2->family) &&
+            (ip_address_cmp(&p1->prefix, &p2->prefix, p1->family) == 0) &&
+            (p1->prefix_len == p2->prefix_len))
+        ? LIBHICNCTRL_SUCCESS
+        : LIBHICNCTRL_FAILURE;
+}
+
+int hc_punting_parse(void * in, hc_punting_t * punting)
+{
+    return LIBHICNCTRL_NOT_IMPLEMENTED;
+}
+
+int hc_punting_snprintf(char * s, size_t size, hc_punting_t * punting)
+{
+    return LIBHICNCTRL_NOT_IMPLEMENTED;
+}
+
+
+/*----------------------------------------------------------------------------*
+ * Cache
+ *----------------------------------------------------------------------------*/
+
+int
+hc_cache_set_store(hc_sock_t * s, int enabled)
+{
+    struct {
+        header_control_message hdr;
+        cache_store_command payload;
+    } msg = {
+        .hdr = {
+            .messageType = REQUEST_LIGHT,
+            .commandID = CACHE_STORE,
+            .length = 1,
+            .seqNum = s->send_seq,
+        },
+        .payload = {
+            .activate = enabled,
+        }
+    };
+
+    hc_command_params_t params = {
+        .cmd = ACTION_SET,
+        .cmd_id = CACHE_STORE,
+        .size_in = sizeof(cache_store_command),
+        .size_out = 0,
+        .parse = NULL,
+    };
+
+    return hc_execute_command(s, (hc_msg_t*)&msg, sizeof(msg), &params, NULL);
+}
+
+int
+hc_cache_set_serve(hc_sock_t * s, int enabled)
+{
+    struct {
+        header_control_message hdr;
+        cache_serve_command payload;
+    } msg = {
+        .hdr = {
+            .messageType = REQUEST_LIGHT,
+            .commandID = CACHE_SERVE,
+            .length = 1,
+            .seqNum = s->send_seq,
+        },
+        .payload = {
+            .activate = enabled,
+        }
+    };
+
+    hc_command_params_t params = {
+        .cmd = ACTION_SET,
+        .cmd_id = CACHE_SERVE,
+        .size_in = sizeof(cache_serve_command),
+        .size_out = 0,
+        .parse = NULL,
+    };
+
+    return hc_execute_command(s, (hc_msg_t*)&msg, sizeof(msg), &params, NULL);
+}
+
+
+/*----------------------------------------------------------------------------*
+ * Strategy
+ *----------------------------------------------------------------------------*/
+
+// per prefix
+int
+hc_strategy_set(hc_sock_t * s /* XXX */)
+{
+     return LIBHICNCTRL_SUCCESS;
+}
+
+/* How to retrieve that from the forwarder ? */
+static const char * strategies[] = {
+    "random",
+    "load_balancer",
+};
+
+#define ARRAY_SIZE(array) (sizeof(array) / sizeof(*array))
+
+int
+hc_strategy_list(hc_sock_t * s, hc_data_t ** data)
+{
+    *data = hc_data_create(0, sizeof(hc_strategy_t));
+
+    for (unsigned i = 0; i < ARRAY_SIZE(strategies); i++) {
+        hc_strategy_t * strategy = (hc_strategy_t*)hc_data_get_next(*data);
+        if (!strategy)
+             return LIBHICNCTRL_FAILURE;
+        snprintf(strategy->name, MAXSZ_HC_STRATEGY, "%s", strategies[i]);
+        (*data)->size++;
+    }
+
+    return LIBHICNCTRL_SUCCESS;
+}
+
+/* /!\ Please update constants in header file upon changes */
+int
+hc_strategy_snprintf(char * s, size_t size, hc_strategy_t * strategy)
+{
+    return snprintf(s, size, "%s", strategy->name);
+}
+
+/*----------------------------------------------------------------------------*
+ * WLDR
+ *----------------------------------------------------------------------------*/
+
+// per connection
+int
+hc_wldr_set(hc_sock_t * s /* XXX */)
+{
+     return LIBHICNCTRL_SUCCESS;
+}
+
+/*----------------------------------------------------------------------------*
+ * MAP-Me
+ *----------------------------------------------------------------------------*/
+
+int
+hc_mapme_set(hc_sock_t * s, int enabled)
+{
+     return LIBHICNCTRL_SUCCESS;
+}
+
+int
+hc_mapme_set_discovery(hc_sock_t * s, int enabled)
+{
+     return LIBHICNCTRL_SUCCESS;
+}
+
+int
+hc_mapme_set_timescale(hc_sock_t * s, double timescale)
+{
+     return LIBHICNCTRL_SUCCESS;
+}
+
+int
+hc_mapme_set_retx(hc_sock_t * s, double timescale)
+{
+     return LIBHICNCTRL_SUCCESS;
+}
+
+/*----------------------------------------------------------------------------*
+ * Policy
+ *----------------------------------------------------------------------------*/
+
+#ifdef WITH_POLICY
+
+/* POLICY CREATE */
+
+int
+hc_policy_create(hc_sock_t * s, hc_policy_t * policy)
+{
+    if (!IS_VALID_FAMILY(policy->family))
+         return LIBHICNCTRL_FAILURE;
+
+    struct {
+        header_control_message hdr;
+        add_policy_command payload;
+    } msg = {
+        .hdr = {
+            .messageType = REQUEST_LIGHT,
+            .commandID = ADD_POLICY,
+            .length = 1,
+            .seqNum = s->send_seq,
+        },
+        .payload = {
+            /* we use IPv6 which is the longest address */
+            .address.ipv6 = policy->remote_addr.v6.as_in6addr,
+            .addressType = (u8)map_to_addr_type[policy->family],
+            .len = policy->len,
+            .policy = policy->policy,
+        }
+    };
+
+    hc_command_params_t params = {
+        .cmd = ACTION_CREATE,
+        .cmd_id = ADD_POLICY,
+        .size_in = sizeof(add_policy_command),
+        .size_out = 0,
+        .parse = NULL,
+    };
+
+    return hc_execute_command(s, (hc_msg_t*)&msg, sizeof(msg), &params, NULL);
+}
+
+/* POLICY DELETE */
+
+int
+hc_policy_delete(hc_sock_t * s, hc_policy_t * policy)
+{
+    if (!IS_VALID_FAMILY(policy->family))
+         return LIBHICNCTRL_FAILURE;
+
+    struct {
+        header_control_message hdr;
+        remove_policy_command payload;
+    } msg = {
+        .hdr = {
+            .messageType = REQUEST_LIGHT,
+            .commandID = REMOVE_POLICY,
+            .length = 1,
+            .seqNum = s->send_seq,
+        },
+        .payload = {
+            /* we use IPv6 which is the longest address */
+            .address.ipv6 = policy->remote_addr.v6.as_in6addr,
+            .addressType = (u8)map_to_addr_type[policy->family],
+            .len = policy->len,
+        }
+    };
+
+    hc_command_params_t params = {
+        .cmd = ACTION_DELETE,
+        .cmd_id = REMOVE_POLICY,
+        .size_in = sizeof(remove_policy_command),
+        .size_out = 0,
+        .parse = NULL,
+    };
+
+    return hc_execute_command(s, (hc_msg_t*)&msg, sizeof(msg), &params, NULL);
+}
+
+/* POLICY LIST */
+
+int
+hc_policy_list(hc_sock_t * s, hc_data_t ** pdata)
+{
+    struct {
+        header_control_message hdr;
+    } msg = {
+        .hdr = {
+            .messageType = REQUEST_LIGHT,
+            .commandID = LIST_POLICIES,
+            .length = 0,
+            .seqNum = s->send_seq,
+        },
+    };
+
+    hc_command_params_t params = {
+        .cmd = ACTION_LIST,
+        .cmd_id = LIST_POLICIES,
+        .size_in = sizeof(list_policies_command),
+        .size_out = sizeof(hc_policy_t),
+        .parse = (HC_PARSE)hc_policy_parse,
+    };
+
+    return hc_execute_command(s, (hc_msg_t*)&msg, sizeof(msg), &params, pdata);
+}
+
+/* POLICY PARSE */
+
+int
+hc_policy_parse(void * in, hc_policy_t * policy)
+{
+    list_policies_command * cmd = (list_policies_command *) in;
+
+    if (!IS_VALID_ADDR_TYPE(cmd->addressType))
+         return LIBHICNCTRL_FAILURE;
+
+    int family = map_from_addr_type[cmd->addressType];
+    if (!IS_VALID_FAMILY(family))
+         return LIBHICNCTRL_FAILURE;
+
+    *policy = (hc_policy_t) {
+        .family = family,
+        .remote_addr = UNION_CAST(cmd->address, ip_address_t),
+        .len = cmd->len,
+        .policy = cmd->policy,
+    };
+    return LIBHICNCTRL_SUCCESS;
+}
+
+/* POLICY SNPRINTF */
+
+/* /!\ Please update constants in header file upon changes */
+int
+hc_policy_snprintf(char * s, size_t size, hc_policy_t * policy)
+{
+     return LIBHICNCTRL_SUCCESS;
+}
+
+#endif /* WITH_POLICY */
diff --git a/ctrl/libhicnctrl/src/cli.c b/ctrl/libhicnctrl/src/cli.c
new file mode 100644
index 000000000..70620a84f
--- /dev/null
+++ b/ctrl/libhicnctrl/src/cli.c
@@ -0,0 +1,381 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file cli.c
+ * \brief Command line interface
+ */
+#include <stdlib.h>
+#include <stdio.h>
+#include <unistd.h> // getopt
+
+#include <hicn/ctrl.h>
+
+#include "util/ip_address.h"
+#include "util/token.h"
+
+
+#define die(LABEL, MESSAGE) do {    \
+        printf(MESSAGE "\n");       \
+        rc = -1;                    \
+        goto ERR_ ## LABEL;         \
+} while(0)
+
+#define foreach_object  \
+    _(UNDEFINED)        \
+    _(LISTENER)         \
+    _(CONNECTION)       \
+    _(ROUTE)            \
+    _(STRATEGY)         \
+    _(N)
+
+typedef enum {
+#define _(x) OBJECT_ ## x,
+foreach_object
+#undef _
+} hc_object_t;
+
+void usage(const char * prog)
+{
+    fprintf(stderr, "Usage: %s [ [-d] [-l|-c|-r] PARAMETERS | [-L|-C|-R] ]\n", prog);
+    fprintf(stderr, "\n");
+    fprintf(stderr, "%s -l <NAME> <TYPE> <ADDRESS> <PORT> <INTERFACE_NAME>\n", prog);
+    fprintf(stderr, "    Create a listener on specified address and port.\n");
+    fprintf(stderr, "%s -dl ...\n", prog);
+    fprintf(stderr, "    Delete a listener...\n");
+    fprintf(stderr, "%s -L\n", prog);
+    fprintf(stderr, "    List all listeners.\n");
+    fprintf(stderr, "%s -c <TYPE> <LOCAL_ADDRESS> <LOCAL_PORT> <REMOTE_ADDRESS> <REMOTE_PORT>\n", prog);
+    fprintf(stderr, "    Create a connection on specified address and port.\n");
+    fprintf(stderr, "%s -dc ...\n", prog);
+    fprintf(stderr, "    Delete a connection...\n");
+    fprintf(stderr, "%s -C\n", prog);
+    fprintf(stderr, "    List all connections.\n");
+    fprintf(stderr, "%s -r ...>\n", prog);
+    fprintf(stderr, "    Create a route...\n");
+    fprintf(stderr, "%s -dr ...\n", prog);
+    fprintf(stderr, "    Delete a route...\n");
+    fprintf(stderr, "%s -R\n", prog);
+    fprintf(stderr, "    List all routes.\n");
+    fprintf(stderr, "%s -S\n", prog);
+    fprintf(stderr, "    List all availble forwarding strategies.\n");
+}
+
+typedef struct {
+    hc_action_t action;
+    hc_object_t object;
+    union {
+        hc_connection_t connection;
+        hc_listener_t listener;
+        hc_route_t route;
+    };
+} hc_command_t;
+
+int
+parse_options(int argc, char *argv[], hc_command_t * command)
+{
+    command->object = OBJECT_UNDEFINED;
+    command->action = ACTION_CREATE;
+    int nargs = 0; /* default for list */
+    int opt;
+    int family;
+
+    while ((opt = getopt(argc, argv, "dlcrLCRSh")) != -1) {
+        switch (opt) {
+            case 'd':
+                command->action = ACTION_DELETE;
+                break;
+            case 'l':
+                command->object = OBJECT_LISTENER;
+                nargs = 5;
+                break;
+            case 'c':
+                command->object = OBJECT_CONNECTION;
+                nargs = 6;
+                break;
+            case 'r':
+                command->object = OBJECT_ROUTE;
+                nargs = 0; // XXX
+                break;
+            case 'L':
+                command->action = ACTION_LIST;
+                command->object = OBJECT_LISTENER;
+                break;
+            case 'C':
+                command->action = ACTION_LIST;
+                command->object = OBJECT_CONNECTION;
+                break;
+            case 'R':
+                command->action = ACTION_LIST;
+                command->object = OBJECT_ROUTE;
+                break;
+            case 'S':
+                command->action = ACTION_LIST;
+                command->object = OBJECT_STRATEGY;
+                break;
+            default: /* "h" */
+                usage(argv[0]);
+                exit(EXIT_SUCCESS);
+        }
+    }
+
+    if (command->action == ACTION_DELETE)
+        nargs = 1;
+
+    /* Each option expects a different number of arguments */
+    if ((command->object == OBJECT_UNDEFINED) || (optind != argc - nargs)) {
+        //printf("Object requires %d arguments [optind=%d != args=%d - nargs=%d\n", nargs, optind, argc, nargs);
+        return -1;
+    }
+    if (nargs == 0)
+    return 0;
+
+    /* Parse and validate parameters for add/delete */
+    switch(command->object) {
+        case OBJECT_LISTENER:
+            switch(command->action) {
+                case ACTION_CREATE:
+                    /* NAME TYPE LOCAL_ADDRESS LOCAL_PORT */
+                    snprintf(command->listener.name, NAME_LEN, "%s", argv[optind++]);
+                    // conn type
+                    command->listener.type = connection_type_from_str(argv[optind++]);
+                    if (command->listener.type == CONNECTION_TYPE_UNDEFINED)
+                        goto ERR_PARAM;
+                    command->listener.family = ip_address_get_family(argv[optind]);
+                    if (!IS_VALID_FAMILY(command->listener.family))
+                        goto ERR_PARAM;
+                    if (ip_address_pton(argv[optind++], &command->listener.local_addr) < 0)
+                        goto ERR_PARAM;
+                    command->listener.local_port = atoi(argv[optind++]);
+#ifdef __linux__
+                    snprintf(command->listener.interface_name, INTERFACE_LEN, "%s", argv[optind++]);
+#endif
+                    break;
+                case ACTION_DELETE:
+                        goto ERR_COMMAND;
+                    break;
+                default:
+                        goto ERR_COMMAND;
+                    break;
+            }
+            break;
+        case OBJECT_CONNECTION:
+            switch(command->action) {
+                case ACTION_CREATE:
+                    /* NAME TYPE LOCAL_ADDRESS LOCAL_PORT REMOTE_ADDRESS REMOTE_PORT */
+                    snprintf(command->connection.name, NAME_LEN, "%s", argv[optind++]);
+                    command->connection.type = connection_type_from_str(argv[optind++]);
+                    if (command->connection.type == CONNECTION_TYPE_UNDEFINED)
+                        goto ERR_PARAM;
+                    command->connection.family = ip_address_get_family(argv[optind]);
+                    if (!IS_VALID_FAMILY(command->connection.family))
+                        goto ERR_PARAM;
+                    if (ip_address_pton(argv[optind++], &command->connection.local_addr) < 0)
+                        goto ERR_PARAM;
+                    command->connection.local_port = atoi(argv[optind++]);
+                    family = ip_address_get_family(argv[optind]);
+                    if (!IS_VALID_FAMILY(family) || (command->connection.family != family))
+                        goto ERR_PARAM;
+                    if (ip_address_pton(argv[optind++], &command->connection.remote_addr) < 0)
+                        goto ERR_PARAM;
+                    command->connection.remote_port = atoi(argv[optind++]);
+
+                    {
+                    char buf_connection[MAXSZ_HC_CONNECTION];
+                    if (hc_connection_snprintf(buf_connection, MAXSZ_HC_CONNECTION, &command->connection) >= MAXSZ_HC_CONNECTION)
+	                    printf("PARSED !!\n");
+                    else
+                        printf("PARSED %s\n", buf_connection);
+                    }
+
+                    break;
+                case ACTION_DELETE:
+                    goto ERR_COMMAND;
+                    break;
+                default:
+                    goto ERR_COMMAND;
+                    break;
+            }
+            break;
+        case OBJECT_ROUTE:
+            switch(command->action) {
+                case ACTION_CREATE:
+                    goto ERR_COMMAND;
+                    break;
+                case ACTION_DELETE:
+                    goto ERR_COMMAND;
+                    break;
+                default:
+                    goto ERR_COMMAND;
+                    break;
+            }
+            break;
+        case OBJECT_STRATEGY:
+            switch(command->action) {
+                case ACTION_LIST:
+                    break;
+                default:
+                    goto ERR_COMMAND;
+                    break;
+            }
+            break;
+        default:
+            goto ERR_COMMAND;
+            break;
+    }
+
+    return 0;
+
+ERR_PARAM:
+ERR_COMMAND:
+    return -1;
+}
+
+int main(int argc, char *argv[])
+{
+    hc_data_t * data;
+    int rc = 1;
+    hc_command_t command;
+    char buf_listener[MAXSZ_HC_LISTENER];
+    char buf_connection[MAXSZ_HC_CONNECTION];
+    char buf_route[MAXSZ_HC_ROUTE];
+    char buf_strategy[MAXSZ_HC_STRATEGY];
+
+    if (parse_options(argc, argv, &command) < 0)
+        die(OPTIONS, "Bad arguments");
+
+    hc_sock_t * s = hc_sock_create();
+    if (!s)
+        die(SOCKET, "Error creating socket.");
+
+    if (hc_sock_connect(s) < 0)
+        die(CONNECT, "Error connecting to the forwarder.");
+
+    switch(command.object) {
+        case OBJECT_LISTENER:
+            switch(command.action) {
+                case ACTION_CREATE:
+                    if (hc_listener_create(s, &command.listener) < 0)
+                        die(COMMAND, "Error creating listener");
+                    printf("OK\n");
+                    break;
+                case ACTION_DELETE:
+                    die(COMMAND, "Not implemented.");
+                    break;
+                case ACTION_LIST:
+                    if (hc_listener_list(s, &data) < 0)
+                        die(COMMAND, "Error getting listeners.");
+
+                    printf("Listeners:\n");
+                    foreach_listener(l, data) {
+                        if (hc_listener_snprintf(buf_listener, MAXSZ_HC_LISTENER+17, l) >= MAXSZ_HC_LISTENER)
+                            die(COMMAND, "Display error");
+                        printf("[%d] %s\n", l->id, buf_listener);
+                    }
+
+                    hc_data_free(data);
+                    break;
+                default:
+                    die(COMMAND, "Unsupported command for listener");
+                    break;
+            }
+            break;
+        case OBJECT_CONNECTION:
+            switch(command.action) {
+                case ACTION_CREATE:
+                    die(COMMAND, "Not implemented.");
+                    break;
+                case ACTION_DELETE:
+                    die(COMMAND, "Not implemented.");
+                    break;
+                case ACTION_LIST:
+                    if (hc_connection_list(s, &data) < 0)
+                        die(COMMAND, "Error getting connections.");
+
+                    printf("Connections:\n");
+                    foreach_connection(c, data) {
+                        if (hc_connection_snprintf(buf_connection, MAXSZ_HC_CONNECTION, c) >= MAXSZ_HC_CONNECTION)
+                            die(COMMAND, "Display error");
+                        printf("[%s] %s\n", c->name, buf_connection);
+                    }
+
+                    hc_data_free(data);
+                    break;
+                default:
+                    die(COMMAND, "Unsupported command for connection");
+                    break;
+            }
+            break;
+        case OBJECT_ROUTE:
+            switch(command.action) {
+                case ACTION_CREATE:
+                    die(COMMAND, "Not implemented.");
+                    break;
+                case ACTION_DELETE:
+                    die(COMMAND, "Not implemented.");
+                    break;
+                case ACTION_LIST:
+                    if (hc_route_list(s, &data) < 0)
+                        die(COMMAND, "Error getting routes.");
+
+                    printf("Routes:\n");
+                    foreach_route(r, data) {
+                        if (hc_route_snprintf(buf_route, MAXSZ_HC_ROUTE, r) >= MAXSZ_HC_ROUTE)
+                            die(COMMAND, "Display error");
+                        printf("%s\n", buf_route);
+                    }
+
+                    hc_data_free(data);
+                    break;
+                default:
+                    die(COMMAND, "Unsupported command for route");
+                    break;
+            }
+            break;
+        case OBJECT_STRATEGY:
+            switch(command.action) {
+                case ACTION_LIST:
+                    if (hc_strategy_list(s, &data) < 0)
+                        die(COMMAND, "Error getting routes.");
+
+                    printf("Forwarding strategies:\n");
+                    foreach_strategy(st, data) {
+                        if (hc_strategy_snprintf(buf_strategy, MAXSZ_HC_STRATEGY, st) >= MAXSZ_HC_STRATEGY)
+                            die(COMMAND, "Display error");
+                        printf("%s\n", buf_strategy);
+                    }
+
+                    hc_data_free(data);
+                    break;
+                default:
+                    die(COMMAND, "Unsupported command for strategy");
+                    break;
+            }
+            break;
+        default:
+           die(COMMAND, "Unsupported object");
+           break;
+    }
+
+
+    /* ROUTES */
+
+ERR_COMMAND:
+ERR_CONNECT:
+    hc_sock_free(s);
+ERR_SOCKET:
+ERR_OPTIONS:
+    return (rc < 0) ? EXIT_FAILURE : EXIT_SUCCESS;
+}
diff --git a/ctrl/libhicnctrl/src/face.c b/ctrl/libhicnctrl/src/face.c
new file mode 100644
index 000000000..9e0fbb597
--- /dev/null
+++ b/ctrl/libhicnctrl/src/face.c
@@ -0,0 +1,245 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file face.c
+ * \brief Implementation of face abstraction
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "face.h"
+#include "util/hash.h"
+#include "util/token.h"
+
+#define member_size(type, member) sizeof(((type *)0)->member)
+
+
+/* Netdevice */
+
+const char * netdevice_type_str[] = {
+#define _(x) [NETDEVICE_TYPE_ ## x] = STRINGIZE(x),
+foreach_netdevice_type
+#undef _
+};
+
+
+/* Face state */
+
+const char * face_state_str[] = {
+#define _(x) [FACE_STATE_ ## x] = STRINGIZE(x),
+foreach_face_state
+#undef _
+};
+
+
+/* Face type */
+
+const char * face_type_str[] = {
+#define _(x) [FACE_TYPE_ ## x] = STRINGIZE(x),
+foreach_face_type
+#undef _
+};
+
+
+/* Face */
+
+int
+face_initialize(face_t * face)
+{
+    bzero(face, sizeof(face_t)); /* 0'ed for hash */
+    return 1;
+}
+
+int
+face_initialize_udp(face_t * face, const ip_address_t * local_addr,
+        u16 local_port, const ip_address_t * remote_addr, u16 remote_port,
+        int family)
+{
+    *face = (face_t) {
+        .type = FACE_TYPE_UDP,
+        .params.tunnel = {
+            .family = family,
+            .local_addr = *local_addr,
+            .local_port = local_port,
+            .remote_addr = *remote_addr,
+            .remote_port = remote_port,
+        },
+    };
+    return 1;
+}
+
+int
+face_initialize_udp_sa(face_t * face, const struct sockaddr * local_addr,
+        const struct sockaddr * remote_addr)
+{
+    if (local_addr->sa_family != remote_addr->sa_family)
+        return -1;
+
+    switch (local_addr->sa_family) {
+        case AF_INET:
+            {
+            struct sockaddr_in *lsai = (struct sockaddr_in *)local_addr;
+            struct sockaddr_in *rsai = (struct sockaddr_in *)remote_addr;
+            *face = (face_t) {
+                .type = FACE_TYPE_UDP,
+                .params.tunnel = {
+                    .family = AF_INET,
+                    .local_addr.v4.as_inaddr = lsai->sin_addr,
+                    .local_port = ntohs(lsai->sin_port),
+                    .remote_addr.v4.as_inaddr = rsai->sin_addr,
+                    .remote_port = ntohs(rsai->sin_port),
+                },
+            };
+            }
+            break;
+        case AF_INET6:
+            {
+            struct sockaddr_in6 *lsai = (struct sockaddr_in6 *)local_addr;
+            struct sockaddr_in6 *rsai = (struct sockaddr_in6 *)remote_addr;
+            *face = (face_t) {
+                .type = FACE_TYPE_UDP,
+                .params.tunnel = {
+                    .family = AF_INET6,
+                    .local_addr.v6.as_in6addr = lsai->sin6_addr,
+                    .local_port = ntohs(lsai->sin6_port),
+                    .remote_addr.v6.as_in6addr = rsai->sin6_addr,
+                    .remote_port = ntohs(rsai->sin6_port),
+                },
+            };
+            }
+            break;
+        default:
+            return -1;
+    }
+    return 1;
+}
+
+face_t * face_create()
+{
+    face_t * face = calloc(1, sizeof(face_t)); /* 0'ed for hash */
+    return face;
+}
+
+face_t * face_create_udp(const ip_address_t * local_addr, u16 local_port,
+        const ip_address_t * remote_addr, u16 remote_port, int family)
+{
+    face_t * face = face_create();
+    if (face_initialize_udp(face, local_addr, local_port, remote_addr, remote_port, family) < 0)
+        goto ERR_INIT;
+    return face;
+
+ERR_INIT:
+    free(face);
+    return NULL;
+}
+
+face_t * face_create_udp_sa(const struct sockaddr * local_addr,
+        const struct sockaddr * remote_addr)
+{
+    face_t * face = face_create();
+    if (face_initialize_udp_sa(face, local_addr, remote_addr) < 0)
+        goto ERR_INIT;
+    return face;
+
+ERR_INIT:
+    free(face);
+    return NULL;
+}
+
+void face_free(face_t * face)
+{
+    free(face);
+}
+
+#define face_param_cmp(f1, f2, face_param_type)            \
+    memcmp(&f1->type, &f2->type,  \
+            member_size(face_params_t, face_param_type));
+
+/**
+ * \brief Compare two faces
+ * \param [in] f1 - First face
+ * \param [in] f2 - Second face
+ * \return whether faces are equal, ie both their types are parameters are
+ * equal.
+ *
+ * NOTE: this function implements a partial order.
+ */
+int
+face_cmp(const face_t * f1, const face_t * f2)
+{
+    if (f1->type != f2->type)
+        return false;
+
+    switch(f1->type) {
+        case FACE_TYPE_HICN:
+            return face_param_cmp(f1, f2, hicn);
+        case FACE_TYPE_TCP:
+        case FACE_TYPE_UDP:
+            return face_param_cmp(f1, f2, tunnel);
+        default:
+            return false;
+    }
+}
+
+hash_t
+face_hash(const face_t * face)
+{
+    /* Assuming the unused part of the struct is set to zero */
+    return hash_struct(face);
+}
+
+/* /!\ Please update constants in header file upon changes */
+size_t
+face_snprintf(char * s, size_t size, const face_t * face)
+{
+    switch(face->type) {
+        case FACE_TYPE_HICN:
+            return 0; // XXX Not implemented
+        case FACE_TYPE_TCP:
+        case FACE_TYPE_UDP:
+            {
+                char local[MAXSZ_IP_ADDRESS];
+                char remote[MAXSZ_IP_ADDRESS];
+
+                ip_address_snprintf(local, MAXSZ_IP_ADDRESS,
+                        &face->params.tunnel.local_addr,
+                        face->params.tunnel.family);
+                ip_address_snprintf(remote, MAXSZ_IP_ADDRESS,
+                        &face->params.tunnel.remote_addr,
+                        face->params.tunnel.family);
+
+                return snprintf(s, size, "%s [%s:%d -> %s:%d]",
+                        face_type_str[face->type],
+                        local,
+                        face->params.tunnel.local_port,
+                        remote,
+                        face->params.tunnel.remote_port);
+            }
+            break;
+        default:
+            return 0;
+    }
+
+}
+
+int
+face_set_tags(face_t * face, policy_tags_t tags)
+{
+    face->tags = tags;
+    return 1;
+}
diff --git a/ctrl/libhicnctrl/src/util/hash.h b/ctrl/libhicnctrl/src/util/hash.h
new file mode 100644
index 000000000..0bc48896b
--- /dev/null
+++ b/ctrl/libhicnctrl/src/util/hash.h
@@ -0,0 +1,246 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+ * \file hash.h
+ * \brief Simple non-cryptographic hash implementation.
+ *
+ * Two helpers are provided :
+ *    hash(buf, len)  : hash a buffer <buf> of length <len>
+ *    hash_struct(buf) : hash a buffer corresponding to an allocated struct
+ *
+ * This file consists in excerpts from Jenkins hash (public domain).
+ * http://www.burtleburtle.net/bob/c/lookup3.c
+ */
+#ifndef UTIL_HASH_H
+#define UTIL_HASH_H
+
+#if (defined(__BYTE_ORDER) && defined(__LITTLE_ENDIAN) && \
+     __BYTE_ORDER == __LITTLE_ENDIAN) || \
+    (defined(i386) || defined(__i386__) || defined(__i486__) || \
+     defined(__i586__) || defined(__i686__) || defined(vax) || defined(MIPSEL))
+# define HASH_LITTLE_ENDIAN 1
+# define HASH_BIG_ENDIAN 0
+#elif (defined(__BYTE_ORDER) && defined(__BIG_ENDIAN) && \
+       __BYTE_ORDER == __BIG_ENDIAN) || \
+      (defined(sparc) || defined(POWERPC) || defined(mc68000) || defined(sel))
+# define HASH_LITTLE_ENDIAN 0
+# define HASH_BIG_ENDIAN 1
+#else
+# define HASH_LITTLE_ENDIAN 0
+# define HASH_BIG_ENDIAN 0
+#endif
+
+#define hashsize(n) ((uint32_t)1<<(n))
+#define hashmask(n) (hashsize(n)-1)
+#define rot(x,k) (((x)<<(k)) | ((x)>>(32-(k))))
+
+#define mix(a,b,c) \
+{ \
+  a -= c;  a ^= rot(c, 4);  c += b; \
+  b -= a;  b ^= rot(a, 6);  a += c; \
+  c -= b;  c ^= rot(b, 8);  b += a; \
+  a -= c;  a ^= rot(c,16);  c += b; \
+  b -= a;  b ^= rot(a,19);  a += c; \
+  c -= b;  c ^= rot(b, 4);  b += a; \
+}
+
+#define final(a,b,c) \
+{ \
+  c ^= b; c -= rot(b,14); \
+  a ^= c; a -= rot(c,11); \
+  b ^= a; b -= rot(a,25); \
+  c ^= b; c -= rot(b,16); \
+  a ^= c; a -= rot(c,4);  \
+  b ^= a; b -= rot(a,14); \
+  c ^= b; c -= rot(b,24); \
+}
+
+static inline
+uint32_t hashlittle( const void *key, size_t length, uint32_t initval)
+{
+  uint32_t a,b,c;                                          /* internal state */
+  union { const void *ptr; size_t i; } u;     /* needed for Mac Powerbook G4 */
+
+  /* Set up the internal state */
+  a = b = c = 0xdeadbeef + ((uint32_t)length) + initval;
+
+  u.ptr = key;
+  if (HASH_LITTLE_ENDIAN && ((u.i & 0x3) == 0)) {
+    const uint32_t *k = (const uint32_t *)key;         /* read 32-bit chunks */
+
+    /*------ all but last block: aligned reads and affect 32 bits of (a,b,c) */
+    while (length > 12)
+    {
+      a += k[0];
+      b += k[1];
+      c += k[2];
+      mix(a,b,c);
+      length -= 12;
+      k += 3;
+    }
+
+    /*----------------------------- handle the last (probably partial) block */
+    /*
+     * "k[2]&0xffffff" actually reads beyond the end of the string, but
+     * then masks off the part it's not allowed to read.  Because the
+     * string is aligned, the masked-off tail is in the same word as the
+     * rest of the string.  Every machine with memory protection I've seen
+     * does it on word boundaries, so is OK with this.  But VALGRIND will
+     * still catch it and complain.  The masking trick does make the hash
+     * noticably faster for short strings (like English words).
+     */
+#ifndef VALGRIND
+
+    switch(length)
+    {
+    case 12: c+=k[2]; b+=k[1]; a+=k[0]; break;
+    case 11: c+=k[2]&0xffffff; b+=k[1]; a+=k[0]; break;
+    case 10: c+=k[2]&0xffff; b+=k[1]; a+=k[0]; break;
+    case 9 : c+=k[2]&0xff; b+=k[1]; a+=k[0]; break;
+    case 8 : b+=k[1]; a+=k[0]; break;
+    case 7 : b+=k[1]&0xffffff; a+=k[0]; break;
+    case 6 : b+=k[1]&0xffff; a+=k[0]; break;
+    case 5 : b+=k[1]&0xff; a+=k[0]; break;
+    case 4 : a+=k[0]; break;
+    case 3 : a+=k[0]&0xffffff; break;
+    case 2 : a+=k[0]&0xffff; break;
+    case 1 : a+=k[0]&0xff; break;
+    case 0 : return c;              /* zero length strings require no mixing */
+    }
+
+#else /* make valgrind happy */
+
+    k8 = (const uint8_t *)k;
+    switch(length)
+    {
+    case 12: c+=k[2]; b+=k[1]; a+=k[0]; break;
+    case 11: c+=((uint32_t)k8[10])<<16;  /* fall through */
+    case 10: c+=((uint32_t)k8[9])<<8;    /* fall through */
+    case 9 : c+=k8[8];                   /* fall through */
+    case 8 : b+=k[1]; a+=k[0]; break;
+    case 7 : b+=((uint32_t)k8[6])<<16;   /* fall through */
+    case 6 : b+=((uint32_t)k8[5])<<8;    /* fall through */
+    case 5 : b+=k8[4];                   /* fall through */
+    case 4 : a+=k[0]; break;
+    case 3 : a+=((uint32_t)k8[2])<<16;   /* fall through */
+    case 2 : a+=((uint32_t)k8[1])<<8;    /* fall through */
+    case 1 : a+=k8[0]; break;
+    case 0 : return c;
+    }
+
+#endif /* !valgrind */
+
+  } else if (HASH_LITTLE_ENDIAN && ((u.i & 0x1) == 0)) {
+    const uint16_t *k = (const uint16_t *)key;         /* read 16-bit chunks */
+    const uint8_t  *k8;
+
+    /*--------------- all but last block: aligned reads and different mixing */
+    while (length > 12)
+    {
+      a += k[0] + (((uint32_t)k[1])<<16);
+      b += k[2] + (((uint32_t)k[3])<<16);
+      c += k[4] + (((uint32_t)k[5])<<16);
+      mix(a,b,c);
+      length -= 12;
+      k += 6;
+    }
+
+    /*----------------------------- handle the last (probably partial) block */
+    k8 = (const uint8_t *)k;
+    switch(length)
+    {
+    case 12: c+=k[4]+(((uint32_t)k[5])<<16);
+             b+=k[2]+(((uint32_t)k[3])<<16);
+             a+=k[0]+(((uint32_t)k[1])<<16);
+             break;
+    case 11: c+=((uint32_t)k8[10])<<16;     /* fall through */
+    case 10: c+=k[4];
+             b+=k[2]+(((uint32_t)k[3])<<16);
+             a+=k[0]+(((uint32_t)k[1])<<16);
+             break;
+    case 9 : c+=k8[8];                      /* fall through */
+    case 8 : b+=k[2]+(((uint32_t)k[3])<<16);
+             a+=k[0]+(((uint32_t)k[1])<<16);
+             break;
+    case 7 : b+=((uint32_t)k8[6])<<16;      /* fall through */
+    case 6 : b+=k[2];
+             a+=k[0]+(((uint32_t)k[1])<<16);
+             break;
+    case 5 : b+=k8[4];                      /* fall through */
+    case 4 : a+=k[0]+(((uint32_t)k[1])<<16);
+             break;
+    case 3 : a+=((uint32_t)k8[2])<<16;      /* fall through */
+    case 2 : a+=k[0];
+             break;
+    case 1 : a+=k8[0];
+             break;
+    case 0 : return c;                     /* zero length requires no mixing */
+    }
+
+  } else {                        /* need to read the key one byte at a time */
+    const uint8_t *k = (const uint8_t *)key;
+
+    /*--------------- all but the last block: affect some 32 bits of (a,b,c) */
+    while (length > 12)
+    {
+      a += k[0];
+      a += ((uint32_t)k[1])<<8;
+      a += ((uint32_t)k[2])<<16;
+      a += ((uint32_t)k[3])<<24;
+      b += k[4];
+      b += ((uint32_t)k[5])<<8;
+      b += ((uint32_t)k[6])<<16;
+      b += ((uint32_t)k[7])<<24;
+      c += k[8];
+      c += ((uint32_t)k[9])<<8;
+      c += ((uint32_t)k[10])<<16;
+      c += ((uint32_t)k[11])<<24;
+      mix(a,b,c);
+      length -= 12;
+      k += 12;
+    }
+
+    /*-------------------------------- last block: affect all 32 bits of (c) */
+    switch(length)                   /* all the case statements fall through */
+    {
+    case 12: c+=((uint32_t)k[11])<<24;
+    case 11: c+=((uint32_t)k[10])<<16;
+    case 10: c+=((uint32_t)k[9])<<8;
+    case 9 : c+=k[8];
+    case 8 : b+=((uint32_t)k[7])<<24;
+    case 7 : b+=((uint32_t)k[6])<<16;
+    case 6 : b+=((uint32_t)k[5])<<8;
+    case 5 : b+=k[4];
+    case 4 : a+=((uint32_t)k[3])<<24;
+    case 3 : a+=((uint32_t)k[2])<<16;
+    case 2 : a+=((uint32_t)k[1])<<8;
+    case 1 : a+=k[0];
+             break;
+    case 0 : return c;
+    }
+  }
+
+  final(a,b,c);
+  return c;
+}
+
+/* Helpers */
+
+#define HASH_INITVAL 1
+#define hash(buf, len)  (hash_t)hashlittle(buf, len, HASH_INITVAL)
+#define hash_struct(buf) hash(buf, sizeof(buf))
+
+#endif /* UTIL_JENKINS_HASH_H */
diff --git a/ctrl/libhicnctrl/src/util/ip_address.h b/ctrl/libhicnctrl/src/util/ip_address.h
new file mode 100644
index 000000000..472cceeea
--- /dev/null
+++ b/ctrl/libhicnctrl/src/util/ip_address.h
@@ -0,0 +1,316 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file ip_address.h
+ * \brief IP address type support
+ */
+#ifndef UTIL_IP_ADDRESS_H
+#define UTIL_IP_ADDRESS_H
+
+#include <arpa/inet.h>  // inet_ntop
+#ifdef __APPLE__
+#include <libkern/OSByteOrder.h>
+#define __bswap_constant_32(x) OSSwapInt32(x)
+#include <machine/endian.h>
+#else
+#ifdef __ANDROID__
+#include <byteswap.h>
+#endif
+#include <endian.h>
+#endif
+#include <errno.h>
+#include <netdb.h> // struct addrinfo
+#include <netinet/in.h> // INET*_ADDRSTRLEN, IN*ADDR_LOOPBACK
+#include <stdlib.h>
+#include <string.h> // memset
+
+#include "types.h"
+
+
+#define bytes_to_bits(x) (x * 8)
+#define IPV6_ADDR_LEN 16	/* bytes */
+#define IPV4_ADDR_LEN 4		/* bytes */
+#define IPV6_ADDR_LEN_BITS bytes_to_bits(IPV6_ADDR_LEN)
+#define IPV4_ADDR_LEN_BITS bytes_to_bits(IPV4_ADDR_LEN)
+
+#define IP_MAX_ADDR_LEN IPV6_ADDR_LEN
+
+#define DUMMY_PORT 1234
+
+typedef union {
+    union {
+        struct in_addr as_inaddr;
+        u8 as_u8[4];
+        u16 as_u16[2];
+        u32 as_u32;
+    } v4;
+    union {
+        struct in6_addr as_in6addr;
+        u8 as_u8[16];
+        u16 as_u16[8];
+        u32 as_u32[4];
+        u64 as_u64[2];
+    } v6;
+    u8 buffer[IP_MAX_ADDR_LEN];
+    u8 as_u8[IP_MAX_ADDR_LEN];
+    u16 as_u16[IP_MAX_ADDR_LEN >> 1];
+    u32 as_u32[IP_MAX_ADDR_LEN >> 2];
+    u64 as_u64[IP_MAX_ADDR_LEN >> 3];
+} ip_address_t;
+
+#define MAXSZ_IP4_ADDRESS_ INET_ADDRSTRLEN - 1
+#define MAXSZ_IP6_ADDRESS_ INET6_ADDRSTRLEN - 1
+#define MAXSZ_IP_ADDRESS_ MAXSZ_IP6_ADDRESS_
+#define MAXSZ_IP4_ADDRESS MAXSZ_IP4_ADDRESS_ + 1
+#define MAXSZ_IP6_ADDRESS MAXSZ_IP6_ADDRESS_ + 1
+#define MAXSZ_IP_ADDRESS MAXSZ_IP_ADDRESS_ + 1
+
+
+typedef struct {
+  int family;
+  ip_address_t address;
+  u8 len;
+} ip_prefix_t;
+
+#define MAXSZ_PREFIX_ MAXSZ_IP_ADDRESS_ + 1 + 3
+#define MAXSZ_PREFIX MAXSZ_PREFIX_ + 1
+
+/* No htonl() with const */
+static const ip_address_t IPV4_LOOPBACK = {
+#if __BYTE_ORDER == __LITTLE_ENDIAN
+#ifdef __ANDROID__
+    .v4.as_inaddr.s_addr = bswap_32(INADDR_LOOPBACK),
+#else
+    .v4.as_inaddr.s_addr = __bswap_constant_32(INADDR_LOOPBACK),
+#endif
+#else
+    .v4.as_inaddr.s_addr = INADDR_LOOPBACK,
+#endif
+};
+
+static const ip_address_t IPV6_LOOPBACK = {
+    .v6.as_in6addr = IN6ADDR_LOOPBACK_INIT,
+};
+
+static const ip_address_t IPV4_ANY = {
+    .v4.as_inaddr.s_addr = INADDR_ANY,
+};
+
+static const ip_address_t IPV6_ANY = {
+    .v6.as_in6addr = IN6ADDR_ANY_INIT,
+};
+
+#define IP_ANY(family) (family == AF_INET) ? IPV4_ANY : IPV6_ANY
+
+#define MAX_PORT 1 << (8 * sizeof(u16))
+#define IS_VALID_PORT(x) ((x > 0) && (x < MAX_PORT))
+
+#define MAXSZ_PORT_ 5
+#define MAXSZ_PORT MAXSZ_PORT_ + 1
+
+#define IS_VALID_FAMILY(x) ((x == AF_INET) || (x == AF_INET6))
+
+static inline
+int
+ip_address_get_family (const char * ip_address)
+{
+  struct addrinfo hint, *res = NULL;
+  int rc;
+
+  memset (&hint, '\0', sizeof hint);
+
+  hint.ai_family = PF_UNSPEC;
+  hint.ai_flags = AI_NUMERICHOST;
+
+  rc = getaddrinfo (ip_address, NULL, &hint, &res);
+  if (rc)
+    {
+      return -1;
+    }
+  rc = res->ai_family;
+  freeaddrinfo (res);
+  return rc;
+}
+
+static inline
+int
+ip_address_len (const ip_address_t * ip_address, int family)
+{
+  return (family == AF_INET6) ? IPV6_ADDR_LEN :
+    (family == AF_INET) ? IPV4_ADDR_LEN : 0;
+}
+
+static inline
+int
+ip_address_ntop (const ip_address_t * ip_address, char *dst, const size_t len,
+		int family)
+{
+  const char * s = inet_ntop (family, ip_address->buffer, dst, len);
+  return (s ? 1 : -1);
+}
+
+/*
+ * Parse ip addresses in presentation format
+ */
+static inline
+int
+ip_address_pton (const char *ip_address_str, ip_address_t * ip_address)
+{
+  int pton_fd;
+  char *addr = strdup (ip_address_str);
+  int family;
+
+
+  family = ip_address_get_family (addr);
+
+  switch (family)
+    {
+    case AF_INET6:
+      pton_fd = inet_pton (AF_INET6, addr, &ip_address->buffer);
+      break;
+    case AF_INET:
+      pton_fd = inet_pton (AF_INET, addr, &ip_address->buffer);
+      break;
+    default:
+      goto ERR;
+    }
+
+  //   0 = not in presentation format
+  // < 0 = other error (use perror)
+  if (pton_fd <= 0)
+    {
+      goto ERR;
+    }
+
+  return 1;
+ERR:
+  free (addr);
+  return -1;
+}
+
+
+
+static inline
+int
+ip_address_snprintf(char * s, size_t size, const ip_address_t * ip_address, int family)
+{
+    size_t len = family == AF_INET ? INET_ADDRSTRLEN : INET6_ADDRSTRLEN;
+    const char * rc = inet_ntop (family, ip_address->buffer, s, len);
+    return rc ? strlen(rc) : -1;
+}
+
+
+static inline
+int
+ip_address_to_sockaddr(const ip_address_t * ip_address,
+		struct sockaddr *sockaddr_address, int family)
+{
+  struct sockaddr_in6 *tmp6 = (struct sockaddr_in6 *) sockaddr_address;
+  struct sockaddr_in *tmp4 = (struct sockaddr_in *) sockaddr_address;
+
+  switch (family)
+    {
+    case AF_INET6:
+      tmp6->sin6_family = AF_INET6;
+      tmp6->sin6_port = DUMMY_PORT;
+      tmp6->sin6_scope_id = 0;
+      memcpy (&tmp6->sin6_addr, ip_address->buffer, IPV6_ADDR_LEN);
+      break;
+    case AF_INET:
+      tmp4->sin_family = AF_INET;
+      tmp4->sin_port = DUMMY_PORT;
+      memcpy (&tmp4->sin_addr, ip_address->buffer, IPV4_ADDR_LEN);
+      break;
+    default:
+      return -1;
+    }
+
+  return 1;
+}
+
+static inline
+int
+ip_address_cmp(const ip_address_t * ip1, const ip_address_t * ip2, int family)
+{
+    return memcmp(ip1, ip2, ip_address_len(ip1, family));
+}
+
+/* Parse IP Prefixes in presentation format (in bits, separated by a slash) */
+static inline
+int
+ip_prefix_pton (const char *ip_address_str, ip_prefix_t * ip_prefix)
+{
+  int pton_fd;
+  char *p;
+  char *eptr;
+  char *addr = strdup (ip_address_str);
+
+  p = strchr (addr, '/');
+  if (!p)
+    {
+      ip_prefix->len = 0;		// until we get the ip address family
+    }
+  else
+    {
+      ip_prefix->len = strtoul (p + 1, &eptr, 10);
+      *p = 0;
+    }
+
+  ip_prefix->family = ip_address_get_family (addr);
+
+  switch (ip_prefix->family)
+    {
+    case AF_INET6:
+      if (ip_prefix->len > IPV6_ADDR_LEN_BITS)
+	goto ERR;
+      pton_fd = inet_pton (AF_INET6, addr, &ip_prefix->address.buffer);
+      break;
+    case AF_INET:
+      if (ip_prefix->len > IPV4_ADDR_LEN_BITS)
+	goto ERR;
+      pton_fd = inet_pton (AF_INET, addr, &ip_prefix->address.buffer);
+      break;
+    default:
+      goto ERR;
+    }
+
+  //   0 = not in presentation format
+  // < 0 = other error (use perror)
+  if (pton_fd <= 0)
+    {
+      goto ERR;
+    }
+
+  return 1;
+ERR:
+  free (addr);
+  return -1;
+}
+
+static inline
+int
+ip_prefix_ntop (const ip_prefix_t * ip_prefix, char *dst, size_t size)
+{
+  char ip_s[MAXSZ_IP_ADDRESS];
+  const char * s = inet_ntop (ip_prefix->family, ip_prefix->address.buffer, ip_s, MAXSZ_IP_ADDRESS);
+  if (!s)
+      return -1;
+  size_t n = snprintf(dst, size, "%s/%d", ip_s, ip_prefix->len);
+
+  return (n > 0 ? 1 : -1);
+}
+
+#endif /* UTIL_IP_ADDRESS_H */
diff --git a/ctrl/libhicnctrl/src/util/log.c b/ctrl/libhicnctrl/src/util/log.c
new file mode 100644
index 000000000..54943cf45
--- /dev/null
+++ b/ctrl/libhicnctrl/src/util/log.c
@@ -0,0 +1,126 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "log.h"
+
+#include <stdarg.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+log_conf_t log_conf = DEFAULT_LOG_CONF;
+
+#define FMT_DATETIME "%02d-%02d-%04d %02d:%02d:%02d"
+#define FMT_DATETIME_LEN 20
+#define snprintf_nowarn(...) (snprintf(__VA_ARGS__) < 0 ? abort() : (void)0)
+
+
+static char ts[FMT_DATETIME_LEN];
+
+static char *timestamp(void)
+{
+	time_t tv;
+	struct tm *tm;
+
+	time(&tv);
+	tm = localtime(&tv);
+
+        snprintf_nowarn(ts, FMT_DATETIME_LEN, FMT_DATETIME, tm->tm_mday,
+                tm->tm_mon + 1, tm->tm_year + 1900, tm->tm_hour, tm->tm_min,
+                tm->tm_sec);
+	return ts;
+}
+
+void _log_va(int level, const char *fmt, va_list ap)
+{
+	char *prefix;
+  FILE *f = log_conf.log_file ? log_conf.log_file : stdout;
+
+#if 0
+	if (!conf.log_system)
+		return;
+#endif
+
+	if (level > log_conf.log_level)
+		return;
+
+	switch (level) {
+		case LOG_FATAL:
+			prefix = "FATAL: ";
+			break;
+		case LOG_ERROR:
+			prefix = "ERROR: ";
+			break;
+		case LOG_WARN:
+			prefix = "WARNING: ";
+			break;
+		case LOG_INFO:
+			prefix = "";
+			break;
+		case LOG_DEBUG:
+			prefix = "DEBUG: ";
+			break;
+		case LOG_TRACE:
+			prefix = "TRACE: ";
+			break;
+		default:
+			prefix = "";
+			break;
+	}
+
+	fprintf(f, "%s %s", timestamp(), prefix);
+	vfprintf(f, fmt, ap);
+	fprintf(f, "\n");
+#ifdef DEBUG
+	fflush(f);
+#endif
+}
+
+void _log(int level, const char *fmt, ...)
+{
+	va_list ap;
+
+	va_start(ap, fmt);
+	_log_va(level, fmt, ap);
+	va_end(ap);
+}
+
+#ifdef HAVE_BACKTRACE
+#include <execinfo.h>
+
+void print_trace(void)
+{
+	void *array[32];
+	size_t size;
+
+	size = backtrace(array, 32);
+	fflush(conf.log_file);
+	backtrace_symbols_fd(array, size, fileno(conf.log_file));
+}
+#endif
+
+void fatal(char *fmt, ...)
+{
+	va_list ap;
+
+	va_start(ap, fmt);
+	_log_va(LOG_FATAL, fmt, ap);
+	va_end(ap);
+
+#ifdef HAVE_BACKTRACE
+	print_trace();
+#endif
+
+	exit(200);
+}
diff --git a/ctrl/libhicnctrl/src/util/log.h b/ctrl/libhicnctrl/src/util/log.h
new file mode 100644
index 000000000..f1cafba47
--- /dev/null
+++ b/ctrl/libhicnctrl/src/util/log.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef UTIL_LOG_H
+#define UTIL_LOG_H
+
+#include <stdarg.h> // va_*
+#include <stdio.h> // FILE
+#include <time.h> // time, localtime
+
+#define LOG_FATAL 0
+#define LOG_ERROR 1
+#define LOG_WARN  2
+#define LOG_INFO  3
+#define LOG_DEBUG 4
+#define LOG_TRACE 5
+
+typedef struct {
+  int log_level;
+  int debug;
+  FILE * log_file;
+} log_conf_t;
+
+#define DEFAULT_LOG_CONF {      \
+    .log_level = LOG_DEBUG,     \
+    .debug = 0,                 \
+    .log_file = NULL,           \
+};
+
+extern log_conf_t log_conf;
+
+#define WITH_DEBUG(BLOCK)                       \
+    if (log_conf.log_level >= LOG_DEBUG)        \
+        BLOCK
+
+#define FATAL(fmt, ...) (_log(LOG_FATAL, fmt, ##__VA_ARGS__ ))
+#define ERROR(fmt, ...) (_log(LOG_ERROR, fmt, ##__VA_ARGS__ ))
+#define WARN(fmt,  ...) (_log(LOG_WARN,  fmt, ##__VA_ARGS__ ))
+#define INFO(fmt,  ...) (_log(LOG_INFO,  fmt, ##__VA_ARGS__ ))
+#define DEBUG(fmt, ...) (_log(LOG_DEBUG, fmt, ##__VA_ARGS__ ))
+#define TRACE(fmt, ...) (_log(LOG_TRACE, fmt, ##__VA_ARGS__ ))
+
+void _log_va(int level, const char *fmt, va_list ap);
+
+void _log(int level, const char *fmt, ...);
+
+void fatal(char *fmt, ...);
+
+#ifdef HAVE_BACKTRACE
+#include <execinfo.h>
+void print_trace(void);
+#endif
+
+#endif // UTIL_LOG_H
diff --git a/ctrl/libhicnctrl/src/util/policy.c b/ctrl/libhicnctrl/src/util/policy.c
new file mode 100644
index 000000000..90dbc72cd
--- /dev/null
+++ b/ctrl/libhicnctrl/src/util/policy.c
@@ -0,0 +1,53 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file policy.h
+ * \brief Implementation of policy description
+ */
+
+#include <stdio.h>
+#include "policy.h"
+
+const char * policy_tag_str[] = {
+    #define _(x) [POLICY_TAG_ ## x] = STRINGIZE(x),
+    foreach_policy_tag
+    #undef _
+};
+
+const char * policy_state_str[] = {
+    #define _(x) [POLICY_STATE_ ## x] = STRINGIZE(x),
+    foreach_policy_state
+    #undef _
+};
+
+int
+policy_tag_state_snprintf(char * s, size_t size, const policy_tag_state_t * tag_state)
+{
+    char *cur = s;
+    int rc;
+
+    if (tag_state->disabled > 1)
+        return -1;
+
+    rc = snprintf(cur, s + size - cur, "%s%s", (tag_state->disabled == 1) ? "!" : "", policy_state_str[tag_state->state]);
+    if (rc < 0)
+        return rc;
+    cur += rc;
+    if (size != 0 && cur >= s + size)
+        return cur - s;
+
+    return cur - s;
+}
diff --git a/ctrl/libhicnctrl/src/util/policy.h b/ctrl/libhicnctrl/src/util/policy.h
new file mode 100644
index 000000000..231e53f73
--- /dev/null
+++ b/ctrl/libhicnctrl/src/util/policy.h
@@ -0,0 +1,266 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * \file policy.h
+ * \brief Policy description
+ */
+#ifndef HICN_POLICY_H
+#define HICN_POLICY_H
+
+#include <netinet/in.h> // INET*_ADDRSTRLEN
+#include "token.h"
+
+/* POLICY TAG */
+
+#define foreach_policy_tag      \
+    /* Interface type */        \
+    _(WIRED)                    \
+    _(WIFI)                     \
+    _(CELLULAR)                 \
+    /* QoS */                   \
+    _(BEST_EFFORT)              \
+    _(REALTIME)                 \
+    _(MULTIPATH)                \
+    /* Security */              \
+    _(TRUSTED)
+
+typedef enum {
+#define _(x) POLICY_TAG_ ## x,
+foreach_policy_tag
+#undef _
+    POLICY_TAG_N
+} policy_tag_t;
+
+#define MAXSZ_POLICY_TAG_ 11
+#define MAXSZ_POLICY_TAG MAXSZ_POLICY_TAG_ + 1
+
+extern const char * policy_tag_str[];
+
+
+/* POLICY_TAGS */
+
+typedef int policy_tags_t;
+
+static inline
+void policy_tags_add(policy_tags_t * tags, policy_tag_t tag)
+{
+    *tags |= (1 << tag);
+}
+
+static inline
+void policy_tags_remove(policy_tags_t * tags, policy_tag_t tag)
+{
+    *tags &= ~(1 << tag);
+}
+
+static inline
+int policy_tags_has(policy_tags_t tags, policy_tag_t tag)
+{
+    return tags & (1 << tag);
+}
+
+#define POLICY_TAGS_EMPTY 0
+
+
+/* POLICY STATE */
+
+/* TODO vs. weight */
+
+#define foreach_policy_state    \
+    _(NEUTRAL)                  \
+    _(REQUIRE)                  \
+    _(PREFER)                   \
+    _(AVOID)                    \
+    _(PROHIBIT)                 \
+    _(N)
+
+typedef enum {
+#define _(x) POLICY_STATE_ ## x,
+foreach_policy_state
+#undef _
+} policy_state_t;
+
+#define MAXSZ_POLICY_STATE_ 8
+#define MAXSZ_POLICY_STATE MAXSZ_POLICY_STATE_ + 1
+
+extern const char * policy_state_str[];
+
+
+/* POLICY TAG STATE */
+
+typedef struct {
+    policy_state_t state;
+    uint8_t disabled;
+} policy_tag_state_t;
+
+#define MAXSZ_POLICY_TAG_STATE_ 8
+#define MAXSZ_POLICY_TAG_STATE MAXSZ_POLICY_TAG_STATE_ + 1
+
+int policy_tag_state_snprintf(char * s, size_t size, const policy_tag_state_t * tag_state);
+
+
+/* INTERFACE STATS */
+
+typedef struct {
+    float throughput;
+    float latency;
+    float loss_rate;
+} interface_stats_t;
+
+#define INTERFACE_STATS_NONE {                          \
+    .throughput = 0,                                    \
+    .latency = 0,                                       \
+    .loss_rate = 0,                                     \
+}
+
+
+/* POLICY STATS */
+
+typedef struct {
+    interface_stats_t wired;
+    interface_stats_t wifi;
+    interface_stats_t cellular;
+    interface_stats_t all;
+} policy_stats_t;
+
+#define POLICY_STATS_NONE {                     \
+    .wired    = INTERFACE_STATS_NONE,           \
+    .wifi     = INTERFACE_STATS_NONE,           \
+    .cellular = INTERFACE_STATS_NONE,           \
+    .all      = INTERFACE_STATS_NONE,           \
+}
+
+typedef struct {
+    uint32_t num_packets;
+    uint32_t num_bytes;
+    uint32_t num_losses;
+    uint32_t latency_idle;
+} interface_counters_t;
+
+#define INTERFACE_COUNTERS_NONE {               \
+    .num_packets = 0,                           \
+    .num_bytes = 0,                             \
+    .num_losses = 0,                            \
+    .latency_idle = 0,                          \
+}
+
+typedef struct {
+    interface_counters_t wired;
+    interface_counters_t wifi;
+    interface_counters_t cellular;
+    interface_counters_t all;
+    uint64_t last_update;
+} policy_counters_t;
+
+#define POLICY_COUNTERS_NONE (policy_counters_t) {      \
+    .wired    = INTERFACE_COUNTERS_NONE,                \
+    .wifi     = INTERFACE_COUNTERS_NONE,                \
+    .cellular = INTERFACE_COUNTERS_NONE,                \
+    .all      = INTERFACE_COUNTERS_NONE,                \
+    .last_update = 0,                                   \
+}
+
+/* POLICY */
+
+#define APP_NAME_LEN 128
+
+typedef struct {
+    char app_name[APP_NAME_LEN];
+    policy_tag_state_t tags[POLICY_TAG_N];
+    policy_stats_t stats;
+} policy_t;
+
+static const policy_t POLICY_NONE = {
+    .app_name = { 0 },
+    .tags = {
+#define _(x) [POLICY_TAG_ ## x] = { POLICY_STATE_NEUTRAL, 0 },
+foreach_policy_tag
+#undef _
+    },
+    .stats = POLICY_STATS_NONE,
+};
+
+
+/* POLICY DESCRIPTION */
+
+#define PFX_STRLEN 4 /* eg. /128 */
+
+typedef struct {
+    int family;
+    union {
+        char ipv4_prefix[INET_ADDRSTRLEN + PFX_STRLEN];
+        char ipv6_prefix[INET6_ADDRSTRLEN + PFX_STRLEN];
+    };
+    policy_t policy;
+} policy_description_t;
+
+/* DEFAULT POLICY */
+
+static const policy_description_t default_policy[] = {
+    {
+        .family = AF_INET6,
+        .ipv6_prefix = "a001::/16",
+        .policy = {
+            .app_name = "Webex",
+            .tags  = {
+                [POLICY_TAG_WIRED]       = { POLICY_STATE_PREFER,   0 },
+                [POLICY_TAG_WIFI]        = { POLICY_STATE_NEUTRAL,  0 },
+                [POLICY_TAG_CELLULAR]    = { POLICY_STATE_AVOID,    1 },
+                [POLICY_TAG_BEST_EFFORT] = { POLICY_STATE_PROHIBIT, 0 },
+                [POLICY_TAG_REALTIME]    = { POLICY_STATE_REQUIRE,  1 },
+                [POLICY_TAG_MULTIPATH]   = { POLICY_STATE_AVOID,    0 },
+                [POLICY_TAG_TRUSTED]     = { POLICY_STATE_REQUIRE,  1 },
+            },
+            .stats = POLICY_STATS_NONE,
+        },
+    },
+    {
+        .family = AF_INET6,
+        .ipv6_prefix = "b001::/16",
+        .policy = {
+            .app_name = "Video Streaming",
+            .tags  = {
+                [POLICY_TAG_WIRED]       = { POLICY_STATE_PREFER,   0 },
+                [POLICY_TAG_WIFI]        = { POLICY_STATE_NEUTRAL,  0 },
+                [POLICY_TAG_CELLULAR]    = { POLICY_STATE_NEUTRAL,  0 },
+                [POLICY_TAG_BEST_EFFORT] = { POLICY_STATE_PROHIBIT, 0 },
+                [POLICY_TAG_REALTIME]    = { POLICY_STATE_REQUIRE,  0 },
+                [POLICY_TAG_MULTIPATH]   = { POLICY_STATE_AVOID,    0 },
+                [POLICY_TAG_TRUSTED]     = { POLICY_STATE_PREFER,   0 },
+            },
+            .stats = POLICY_STATS_NONE,
+        },
+    },
+    {
+        .family = AF_INET6,
+        .ipv6_prefix = "c001::/16",
+        .policy = {
+            .app_name = "*",
+            .tags  = {
+                [POLICY_TAG_WIRED]       = { POLICY_STATE_PREFER,   0 },
+                [POLICY_TAG_WIFI]        = { POLICY_STATE_NEUTRAL,  0 },
+                [POLICY_TAG_CELLULAR]    = { POLICY_STATE_NEUTRAL,  0 },
+                [POLICY_TAG_BEST_EFFORT] = { POLICY_STATE_PROHIBIT, 0 },
+                [POLICY_TAG_REALTIME]    = { POLICY_STATE_REQUIRE,  0 },
+                [POLICY_TAG_MULTIPATH]   = { POLICY_STATE_AVOID,    0 },
+                [POLICY_TAG_TRUSTED]     = { POLICY_STATE_PROHIBIT, 1 },
+            },
+            .stats = POLICY_STATS_NONE,
+        },
+    },
+};
+
+#endif /* HICN_POLICY_H */
diff --git a/ctrl/libhicnctrl/src/util/token.h b/ctrl/libhicnctrl/src/util/token.h
new file mode 100644
index 000000000..43e0a77b2
--- /dev/null
+++ b/ctrl/libhicnctrl/src/util/token.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/* Token concatenation */
+
+/*
+ * Concatenate preprocessor tokens A and B without expanding macro definitions
+ * (however, if invoked from a macro, macro arguments are expanded).
+ */
+#define PPCAT_NX(A, B) A ## B
+
+/*
+ * Concatenate preprocessor tokens A and B after macro-expanding them.
+ */
+#define PPCAT(A, B) PPCAT_NX(A, B)
+
+/* Token stringification */
+
+/*
+ * Turn A into a string literal without expanding macro definitions
+ * (however, if invoked from a macro, macro arguments are expanded).
+ */
+#define STRINGIZE_NX(A) #A
+
+/*
+ * Turn A into a string literal after macro-expanding it.
+ */
+#define STRINGIZE(A) STRINGIZE_NX(A)
diff --git a/ctrl/libhicnctrl/src/util/types.h b/ctrl/libhicnctrl/src/util/types.h
new file mode 100644
index 000000000..10a0bdca0
--- /dev/null
+++ b/ctrl/libhicnctrl/src/util/types.h
@@ -0,0 +1,36 @@
+/*
+ * Copyright (c) 2017-2019 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef UTIL_TYPES
+#define UTIL_TYPES
+
+typedef uint8_t u8;
+typedef uint16_t u16;
+typedef uint32_t u32;
+typedef uint64_t u64;
+
+/* Helper for avoiding warnings about type-punning */
+#define UNION_CAST(x, destType) \
+   (((union {__typeof__(x) a; destType b;})x).b)
+
+typedef unsigned int hash_t;
+
+typedef int (*cmp_t)(const void *, const void *);
+
+/* Enums */
+
+#define IS_VALID_ENUM_TYPE(NAME, x) ((x > NAME ## _UNDEFINED) && (x < NAME ## _N))
+
+#endif /* UTIL_TYPES */