Merge lp:~martin-lp/hipl/hipfwconf into lp:hipl

[David Martin]

This branch introduces changes to get the currently active connection from the firewall.

This is a resubmitted merge proposal:
instead of using a separate binary option 1 of the previous discussion is implemented:
> 1) add an extra keyword to the hipconf command line: hipconf (daemon | firewall) COMMAND

Summed up changes since the last proposal (revision 6116ff.):
Keywords to address hipd / hipfw are daemon and firewall and defined in lib/core/conf.h.
The hipconf help print has been updated.
Config file syntax does not have to be changed as only hipd parses configs via hipconf and the daemon
keyword is hardcoded.

From what I've tested everything works as before. I do not know all hipconf options or how to apply them
so I did not test them all. Please have a look if everything seems right.

[Miika Komu (miika-iki)]

Why separate binary just for configuring hipfw? Why this can't be embedded into hipconf?

review: Needs Information

[Diego Biurrun (diego-biurrun)]

On Mon, Oct 24, 2011 at 03:49:25PM +0000, Miika Komu wrote:
> Review: Needs Information
>
> Why separate binary just for configuring hipfw? Why this can't be embedded into hipconf?

Seconded. I'm terribly suspicious of this whole hipconf thing and
whether or not it is a good idea. IIUC authentication is nonexistent
and it's not clear to me what the advantage to rereading a config
file is.

Diego

[Miika Komu (miika-iki)]

Another benefit of merged functionality is to allow reading of static information from /etc/hip/hipd_config

[René Hummen (rene-hummen)]

On 24.10.2011, at 17:49, Miika Komu wrote:
> Why separate binary just for configuring hipfw? Why this can't be embedded into hipconf?

There are three ways to implement this functionality:
1) add an extra keyword to the hipconf command line: hipconf (daemon | firewall) COMMAND
2) add firewall queries as command parameter: hipconf get firewall-ha
3) implement as separate binary using libcore.

(1) would require some changes to hipconf command line parsing and would render the old user API broken. Furthermore, it would require an even longer parameter list for getting specific information. For these reasons, I would not want to implement this option.
(2) is somewhat inconsistent with the current syntax, but I would be fine with that. Only minor changes to the current proposal would be required.
(3) doesn't break the user API and clearly separates hipd configuration from hipfw status querying. This is my preferred option.

Opinions and other proposals are welcome.

Ciao,
René

--
Dipl.-Inform. Rene Hummen, Ph.D. Student
Chair of Communication and Distributed Systems
RWTH Aachen University, Germany
tel: [phone]
web: http://www.comsys.rwth-aachen.de/team/rene-hummen/

[René Hummen (rene-hummen)]

Forgot to include launchpad.

Begin forwarded message:
> From: René Hummen <email address hidden>
> Date: 27. Oktober 2011 15:41:06 MESZ
> To: <email address hidden>
> Subject: Re: [hipl-dev] Re: [Merge] lp:~martin-lp/hipl/hipfwconf into lp:hipl
>
> On 24.10.2011, at 19:27, Diego Biurrun wrote:
>> On Mon, Oct 24, 2011 at 03:49:25PM +0000, Miika Komu wrote:
>>> Review: Needs Information
>>>
>>> Why separate binary just for configuring hipfw? Why this can't be embedded into hipconf?
>>
>> Seconded. I'm terribly suspicious of this whole hipconf thing and
>> whether or not it is a good idea. IIUC authentication is nonexistent
>> and it's not clear to me what the advantage to rereading a config
>> file is.
>
> The issue of having one or multiple binaries aside, I think hipconf should rather be a hipstatus tool. I.e., hipd and hipfw should be configured via config files (with reload functionality) and the the current run-time status should be requestable via hipstatus. However, this is not as it's done in HIPL at the moment. Instead, reading the config file mimics calls to hipconf in order to set up the hipd. hipfwconf, on the other hand, only provides status information.
>
> Do I see volunteers who are willing to fix this hipconf-based configuration issue? :)
>
> Ciao,
> René

--
Dipl.-Inform. Rene Hummen, Ph.D. Student
Chair of Communication and Distributed Systems
RWTH Aachen University, Germany
tel: [phone]
web: http://www.comsys.rwth-aachen.de/team/rene-hummen/

[René Hummen (rene-hummen)]

On 25.10.2011, at 09:42, Miika Komu wrote:
> Another benefit of merged functionality is to allow reading of static information from /etc/hip/hipd_config

I don't see your point here. Can you please explain. By the way, hipfwconf wraps around libcore the same way hipconf does.

--
Dipl.-Inform. Rene Hummen, Ph.D. Student
Chair of Communication and Distributed Systems
RWTH Aachen University, Germany
tel: [phone]
web: http://www.comsys.rwth-aachen.de/team/rene-hummen/

[Miika Komu (miika-iki)]

> IIUC authentication is nonexistent

This a fallacy, it does have authentication. Critical functions are allowed only for root.

> and it's not clear to me what the advantage to rereading a config
> file is.

Obviously, changing of parameters during run time.

[Miika Komu (miika-iki)]

> On 25.10.2011, at 09:42, Miika Komu wrote:
> > Another benefit of merged functionality is to allow reading of static
> information from /etc/hip/hipd_config
>
> I don't see your point here. Can you please explain. By the way, hipfwconf
> wraps around libcore the same way hipconf does.

You mean that you can set hipfwconf parameters from /etc/hip/hipd_config ? Did you test this?

[Miika Komu (miika-iki)]

> On 24.10.2011, at 17:49, Miika Komu wrote:
> > Why separate binary just for configuring hipfw? Why this can't be embedded
> into hipconf?
>
> There are three ways to implement this functionality:
> 1) add an extra keyword to the hipconf command line: hipconf (daemon |
> firewall) COMMAND
> 2) add firewall queries as command parameter: hipconf get firewall-ha

Either of these would work for me. Probably 1 is a bit cleaner.

> 3) implement as separate binary using libcore.

I'll counterargument against this below.

> (1) would require some changes to hipconf command line parsing and would
> render the old user API broken. Furthermore, it would require an even longer
> parameter list for getting specific information. For these reasons, I would
> not want to implement this option.

Who cares if the API is changes, really? By breaking, you mean /etc/hip/hipd_config? The file could be prefixed with a "daemon" with a simple regexp when you start hipd (if we would choose #1).

> (2) is somewhat inconsistent with the current syntax, but I would be fine with
> that. Only minor changes to the current proposal would be required.

I would be fine with this.

> (3) doesn't break the user API and clearly separates hipd configuration from
> hipfw status querying. This is my preferred option.

Proposal 3 also fragments the HIP administrative interface into two. You suggest that we'll have one read-only interface and another writeable. I believe in a more unified interface and I fail see why we should disperse. It doesn't sound very responsible to say something is bad, but leave it as it is and switch to new tool?

What do you mean by "hipconf-based configuration issue"?

review: Disapprove

[Diego Biurrun (diego-biurrun)]

On Thu, Oct 27, 2011 at 01:31:29PM +0000, René Hummen wrote:
> On 24.10.2011, at 17:49, Miika Komu wrote:
> > Why separate binary just for configuring hipfw? Why this can't be embedded into hipconf?
>
> There are three ways to implement this functionality:
> 1) add an extra keyword to the hipconf command line: hipconf (daemon | firewall) COMMAND
> 2) add firewall queries as command parameter: hipconf get firewall-ha
> 3) implement as separate binary using libcore.
>
> (1) would require some changes to hipconf command line parsing and
> would render the old user API broken. Furthermore, it would require an
> even longer parameter list for getting specific information. For these
> reasons, I would not want to implement this option.

alias hipdconf="hipconf daemon"
alias hipfwconf="hipconf firewall"

Diego

[Diego Biurrun (diego-biurrun)]

 review needs-fixing

On Mon, Oct 31, 2011 at 06:22:27PM +0000, David Martin wrote:
>
> --- Makefile.am 2011-10-17 18:14:10 +0000
> +++ Makefile.am 2011-10-31 18:21:26 +0000
> @@ -90,8 +90,8 @@
>
> -tools_hipconf_SOURCES = tools/hipconf.c
> -tools_pisacert_SOURCES = tools/pisacert.c
> +tools_hipconf_SOURCES = tools/hipconf.c
> +tools_pisacert_SOURCES = tools/pisacert.c

unrelated

Diego

review: Needs Fixing

[Miika Komu (miika-iki)]

hip_send_recv_firewall_info() has been copy-pasted from hip_send_recv_daemon_info(). The same goes for
hip_send_recv_firewall_info() and hip_handle_user_msg(). Code reuse?

lib/core/conf.c:hipconf_usage is not updated accordingly. Same goes for hipd/init.c:HIPL_CONFIG_FILE_EX. Otherwise, nobody will know about your extensions.

Also, I would like to hear a test report with some existing hipconf options to understand that legacy support still works. For example, try the following:

* hipconf add map HIT IP
* hipconf get ha all
* hipconf rst all

<wait few secs>

* hipconf nat none
* hipconf add map HIT IP
* hipconf get ha all
* hipconf rst all

<wait few secs>

* hipconf nat plain-udp
* hipconf add map HIT IP
* hipconf get ha all
* hipconf rst all

<wait few secs>

* hipconf nat port 1111
* hipconf add map HIT IP
* hipconf get ha all
* hipconf rst all

Does it do what expected?

Other than this, I am satisfied with this commit.

review: Needs Fixing

[David Martin (martin-lp)]

Hi,

On Mon, Oct 31, 2011 at 9:58 PM, Diego Biurrun <email address hidden> wrote:
> On Mon, Oct 31, 2011 at 06:22:27PM +0000, David Martin wrote:
>> --- Makefile.am 2011-10-17 18:14:10 +0000
>> +++ Makefile.am 2011-10-31 18:21:26 +0000
>> @@ -90,8 +90,8 @@
>>
>> -tools_hipconf_SOURCES = tools/hipconf.c
>> -tools_pisacert_SOURCES = tools/pisacert.c
>> +tools_hipconf_SOURCES = tools/hipconf.c
>> +tools_pisacert_SOURCES = tools/pisacert.c
>
> unrelated

That's not really unrelated but unintended. Forgot to reindent after removing the hipfwconf line. Fixed now.

[lp:~martin-lp/hipl/hipfwconf]

6108. By Diego Biurrun on 2011-11-02

packaging: port package building script to openSUSE

6109. By Diego Biurrun on 2011-11-02

INSTALL: Add list of required packages for OpenSUSE.

[David Martin (martin-lp)]

Hi,

On Wed, Nov 2, 2011 at 8:32 AM, Miika Komu <email address hidden> wrote:
> Review: Needs Fixing
>
> hip_send_recv_firewall_info() has been copy-pasted from hip_send_recv_daemon_info().

You are right, that has been some pretty evil piece of copy-paste. Fixed this in revision 6121.

> The same goes for hip_send_recv_firewall_info() and hip_handle_user_msg(). Code reuse?

What exactly do you mean?

> lib/core/conf.c:hipconf_usage is not updated accordingly. Same goes for hipd/init.c:HIPL_CONFIG_FILE_EX. Otherwise, nobody will know about your extensions.

I changed it where hipconf_usage was used but this may have not been clear enough.
I've fixed it in revision 6122. Should be better now.

> Also, I would like to hear a test report with some existing hipconf options to understand that legacy support still works. For example, try the following:
>
> * hipconf add map HIT IP
> * hipconf get ha all
> * hipconf rst all
>
> <wait few secs>
>
> * hipconf nat none
> * hipconf add map HIT IP
> * hipconf get ha all
> * hipconf rst all
>
> <wait few secs>
>
> * hipconf nat plain-udp
> * hipconf add map HIT IP
> * hipconf get ha all
> * hipconf rst all
>
> <wait few secs>
>
> * hipconf nat port 1111
> * hipconf add map HIT IP
> * hipconf get ha all
> * hipconf rst all
>
> Does it do what expected?

Did not test that yet but I'll have a look into it and report back.

[Miika Komu (miika-iki)]

Hi,

On 11/02/2011 01:04 PM, David Martin wrote:
>> The same goes for hip_send_recv_firewall_info() and hip_handle_user_msg(). Code reuse?
> What exactly do you mean?

the functions offer very similar functionality (copy paste).

[David Martin (martin-lp)]

Hi again,

On Wed, Nov 2, 2011 at 12:25 PM, Miika Komu <email address hidden> wrote:
> On 11/02/2011 01:04 PM, David Martin wrote:
>>>
>>> The same goes for hip_send_recv_firewall_info() and
>>> hip_handle_user_msg(). Code reuse?
>>
>> What exactly do you mean?
>
> the functions offer very similar functionality (copy paste).

Sorry for being a bit dense but I'm still not sure what you mean.
hip_handle_user_msg() is an enormous beast of a function dealing with all incoming
hipconf messages. hip_send_recv_firewall_info() sends messages to hipfw and
since the last commit is nothing more than a wrapper for send_recv_info_internal().

Maybe you mean hip_handle_msg() in firewall_control.c which basically does the same
as hip_handle_user_msg() only for the firewall. It has not really been touched in this
branch and I see no reason to merge them together. It would result in an even bigger
and even more unwieldy function. The firewall does receive user messages of the same
message type, but it acts differently on them than hipd. I think it's reasonable to keep them
apart. We should think about renaming them to make their purpose more obvious but this
is out of scope of this branch.

[Miika Komu (miika-iki)]

Sorry, I mean fw_handle_hipd_message() and hip_handle_user_msg(). It seems that the beginning of the functions is copy paste. You could extract the beginning into another function and call it in the other two.

[David Martin (martin-lp)]

Hi,

On Wed, Nov 2, 2011 at 3:26 PM, Miika Komu <email address hidden> wrote:
> Sorry, I mean fw_handle_hipd_message() and hip_handle_user_msg(). It seems that the beginning of the functions is copy paste. You could extract the beginning into another function and call it in the other two.

You are right. But if I see it correctly those two weren't really touched by this branch so I would
say it's not related. Feel free to change it in trunk. :)))

PS: Fixed non-compiling make doxygen and added error-handling for wrong process keywords in the last two revisions.

PPS: Had a look at your proposed commands as well. They seem to work alright as far as I can judge. Here's a log:

martin@pisa1:~/src/hipl/hipl_hipfwconf$ sudo tools/hipconf daemon add map 2001:17:e5ab:56b2:3b45:419f:f784:af6a 10.0.3.1
Mapped v4 to v6.
mapped v6: 10.0.3.1
Sending user message 2 to HIPD on socket 3
Sent 88 bytes
Waiting to receive daemon info.
88 bytes received from HIP daemon.
User message was sent successfully to the HIP daemon.

martin@pisa1:~/src/hipl/hipl_hipfwconf$ sudo tools/hipconf daemon get ha all
Sending user message 22 to HIPD on socket 3
Sent 40 bytes
Waiting to receive daemon info.
248 bytes received from HIP daemon.
HA is UNASSOCIATED
 Shotgun mode is off.
 Broadcast mode is off.
 Local HIT: 2001:0017:e5ab:56b2:3b45:419f:f784:af6a
 Peer HIT: 2001:0017:e5ab:56b2:3b45:419f:f784:af6a
 Local LSI: 1.0.0.1
 Peer LSI: 1.0.0.1
 Local IP: 10.0.3.1
 Local NAT traversal UDP port: 10500
 Peer IP: 10.0.3.1
 Peer NAT traversal UDP port: 10500
 Peer hostname:

martin@pisa1:~/src/hipl/hipl_hipfwconf$ sudo tools/hipconf daemon rst all
Sending user message 68 to HIPD on socket 3
Sent 64 bytes
Waiting to receive daemon info.
64 bytes received from HIP daemon.
User message was sent successfully to the HIP daemon.

martin@pisa1:~/src/hipl/hipl_hipfwconf$ sudo tools/hipconf daemon get ha all
Sending user message 22 to HIPD on socket 3
Sent 40 bytes
Waiting to receive daemon info.
40 bytes received from HIP daemon.

martin@pisa1:~/src/hipl/hipl_hipfwconf$ sudo tools/hipconf daemon nat none
<snip>

martin@pisa1:~/src/hipl/hipl_hipfwconf$ sudo tools/hipconf daemon add map 2001:17:e5ab:56b2:3b45:419f:f784:af6a 10.0.3.1
<snip>

martin@pisa1:~/src/hipl/hipl_hipfwconf$ sudo tools/hipconf daemon get ha all
<snip>
HA is UNASSOCIATED
 Shotgun mode is off.
 Broadcast mode is off.
 Local HIT: 2001:0017:e5ab:56b2:3b45:419f:f784:af6a
 Peer HIT: 2001:0017:e5ab:56b2:3b45:419f:f784:af6a
 Local LSI: 1.0.0.1
 Peer LSI: 1.0.0.1
 Local IP: 10.0.3.1
 Local NAT traversal UDP port: 0
 Peer IP: 10.0.3.1
 Peer NAT traversal UDP port: 0
 Peer hostname:

martin@pisa1:~/src/hipl/hipl_hipfwconf$ sudo tools/hipconf daemon nat plain-udp
<snip>

martin@pisa1:~/src/hipl/hipl_hipfwconf$ sudo tools/hipconf daemon get ha all
<snip>
HA is UNASSOCIATED
 Shotgun mode is off.
 Broadcast mode is off.
 Local HIT: 2001:0017:e5ab:56b2:3b45:419f:f784:af6a
 Peer HIT: 2001:0017:e5ab:56b2:3b45:419f:f784:af6a
 Local LSI: 1.0.0.1
 Peer LSI: 1.0.0.1
 Local IP: 10.0.3.1
 Local NAT traversal UDP port: 10500
 Peer IP: 10.0.3.1
 Peer NAT traversal UDP port: 10500
 Peer hostname:

martin@pisa1:~/src/hipl/hipl_hi...

[René Hummen (rene-hummen)]

On 27.10.2011, at 16:37, Miika Komu wrote:
>> On 25.10.2011, at 09:42, Miika Komu wrote:
>>> Another benefit of merged functionality is to allow reading of static
>> information from /etc/hip/hipd_config
>>
>> I don't see your point here. Can you please explain. By the way, hipfwconf
>> wraps around libcore the same way hipconf does.
>
> You mean that you can set hipfwconf parameters from /etc/hip/hipd_config ? Did you test this?

Hmmm, I'm not sure what this discussion was about exactly. Maybe some clarification as to what kind of functionality this branch is supposed to introduce: it allows to request status information from hipfw at run-time. However, it does not allow for run-time configuration right now. Of course, it would be easy to extend hipfw with this functionality, but I don't see that this desirable.

--
Dipl.-Inform. Rene Hummen, Ph.D. Student
Chair of Communication and Distributed Systems
RWTH Aachen University, Germany
tel: [phone]
web: http://www.comsys.rwth-aachen.de/team/rene-hummen/

[lp:~martin-lp/hipl/hipfwconf]

6110. By René Hummen on 2011-11-03

merge lp:~rene-hummen/hipl/logging

This merge updates the logging facilities of HIPL and adds a new log
level "LOW".

Macros are now mapped to the debug levels as follows:
=========================================
| NONE | DIE, ASSERT
------------------------------------------
| LOW | DIE, ASSERT, ERROR
------------------------------------------
| MEDIUM | DIE, ASSERT, ERROR, INFO
------------------------------------------
| ALL | DIE, ASSERT, ERROR, INFO, DEBUG
==========================================

Also see merge proposal:
https://code.launchpad.net/~rene-hummen/hipl/logging/+merge/81065

[Miika Komu (miika-iki)]

> Hmmm, I'm not sure what this discussion was about exactly. Maybe some clarification as to what kind of functionality
> this branch is supposed to introduce: it allows to request status information from hipfw at run-time. However, it
> does not allow for run-time configuration right now. Of course, it would be easy to extend hipfw with this
> functionality, but I don't see that this desirable.

Never mind (now hipd_config can be used to trigger hipfw actions as well).

review: Approve

[David Martin (martin-lp)]

Diego, your opinion? :)

[Diego Biurrun (diego-biurrun)]

 review needs-fixing

On Mon, Oct 31, 2011 at 06:22:27PM +0000, David Martin wrote:
>
> --- lib/core/conf.h 2011-08-15 14:11:56 +0000
> +++ lib/core/conf.h 2011-10-31 18:21:26 +0000
> @@ -54,6 +54,11 @@
>
> +enum daemon_name { HIP_DAEMON, HIP_FIREWALL };
> +/* keywords used to identify hipd / hipfw as target of hipconf command */
> +#define HIPCONF_HIPD_KEYWORD "daemon"
> +#define HIPCONF_HIPFW_KEYWORD "firewall"

These appear unused outside of conf.c.

Diego

review: Needs Fixing

[Diego Biurrun (diego-biurrun)]

On Fri, Nov 04, 2011 at 12:07:34PM +0000, David Martin wrote:
> Diego, your opinion? :)

I said enough to reject it already, just added some more ;)

Diego

[David Martin (martin-lp)]

Hi,

On Fri, Nov 4, 2011 at 1:25 PM, Diego Biurrun <email address hidden> wrote:
> On Mon, Oct 31, 2011 at 06:22:27PM +0000, David Martin wrote:
>>
>> --- lib/core/conf.h 2011-08-15 14:11:56 +0000
>> +++ lib/core/conf.h 2011-10-31 18:21:26 +0000
>> @@ -54,6 +54,11 @@
>>
>> +enum daemon_name { HIP_DAEMON, HIP_FIREWALL };
>> +/* keywords used to identify hipd / hipfw as target of hipconf command */
>> +#define HIPCONF_HIPD_KEYWORD "daemon"
>> +#define HIPCONF_HIPFW_KEYWORD "firewall"
>
> These appear unused outside of conf.c.

Nope, using them in lib/core/message.c as well. Did you pull the latest revisions?

On Fri, Nov 4, 2011 at 1:29 PM, Diego Biurrun <email address hidden> wrote:
> I said enough to reject it already, just added some more ;)

Well, other than you being terribly suspicious of hipconf in general you did not say
aynthing. And that's not very constructive. :p

[Diego Biurrun (diego-biurrun)]

On Fri, Nov 04, 2011 at 12:53:25PM +0000, David Martin wrote:
> On Fri, Nov 4, 2011 at 1:25 PM, Diego Biurrun <email address hidden> wrote:
> > On Mon, Oct 31, 2011 at 06:22:27PM +0000, David Martin wrote:
> >>
> >> --- lib/core/conf.h 2011-08-15 14:11:56 +0000
> >> +++ lib/core/conf.h 2011-10-31 18:21:26 +0000
> >> @@ -54,6 +54,11 @@
> >>
> >> +enum daemon_name { HIP_DAEMON, HIP_FIREWALL };
> >> +/* keywords used to identify hipd / hipfw as target of hipconf command */
> >> +#define HIPCONF_HIPD_KEYWORD "daemon"
> >> +#define HIPCONF_HIPFW_KEYWORD "firewall"
> >
> > These appear unused outside of conf.c.
>
> Nope, using them in lib/core/message.c as well. Did you pull the latest revisions?

Of course not! I don't pull anything to review your work, why would I?
I just sit here and read emails. I should not have to care about you
committing new revisions somewhere I'm not looking.

> On Fri, Nov 4, 2011 at 1:29 PM, Diego Biurrun <email address hidden> wrote:
> > I said enough to reject it already, just added some more ;)
>
> Well, other than you being terribly suspicious of hipconf in general you did not say
> aynthing. And that's not very constructive. :p

I said there were unrelated stray changes - that's ground enough not to
commit it so I did not bother to look in detail at a version that will
not be pushed anyway ;)

Diego

[lp:~martin-lp/hipl/hipfwconf]

6111. By Miika Komu on 2011-11-04

Fixed an annoyance in a maintainer script

From bug #795846: The "make syncrepo" target seems to unnecessarily copy also
old packages to the repository. Fixed by including the revision number also.

6112. By David Martin on 2011-11-07

Cosmetics: Move comment in queue_packet() to where it belongs.

6113. By David Martin on 2011-11-08

Make hipconf_usage string static as it is local to lib/core/conf.c.

6126. By David Martin on 2011-11-02

Cosmetics: fix leftover indentation in Makefile.am.

6127. By David Martin on 2011-11-02

Refactor hip_send_recv_daemon_info_internal() to avoid code duplication.

send_recv_daemon_info_internal() is now called send_recv_info_internal()
and gets the destination port as an additional parameter. This way it will
be used to communicate with both hipd and hipfw. As a consequence
hip_send_recv_firewall_info() has been reduced to a simple wrapper call.

6128. By David Martin on 2011-11-02

Make hipconf and config file usage more clear.

6129. By David Martin on 2011-11-02

Add error handling for process keyword in lib/core/conf.{c, h}.

Comparing an enum to a -1 return value is not good. Add UNKNOWN_KEYWORD
as error return value for conf_get_process().

Exit hipconf when an invalid target process keyword is specified and
print an error notice as well.

6130. By David Martin on 2011-11-02

Fix missing / leftover doxygen documentation.

6131. By David Martin on 2011-11-07

Apply new hipconf syntax to doc/HOWTO.xml.in.

6132. By David Martin on 2011-11-07

Add daemon keyword to commands in hipdnsproxy.in.

6133. By David Martin on 2011-11-07

Apply changed hipconf usage to documentation in sourcefiles.

6134. By David Martin on 2011-11-07

Fix some stray error messages referring incorrectly only to the HIP daemon.

Make them more generic by adding the firewall as well.

6135. By David Martin on 2011-11-08

Correct header #include ordering in firewall_control.c.

6136. By David Martin on 2011-11-08

Make hipfwconf_usage static as it's local to conf.c.

6137. By David Martin on 2011-11-08

Cosmetics: Fix typo in conf_get_process() documentation.

6138. By David Martin on 2011-11-08

Make daemon_name enum static, it is local to lib/core/conf.c.

6139. By David Martin on 2011-11-08

Refer to daemon in error messages instead of mentioning both hipd and hipfw.

6140. By David Martin on 2011-11-08

Use 'the' when referring to the daemon in conf.c/message.c error messages.

Sounds a lot better this way.

6141. By David Martin on 2011-11-08

Move daemon_name enum to lib/core/conf.c as it is only used there.

6142. By David Martin on 2011-11-08

Return enum daemon_name instead of int in conf_get_process().

If we have got a named enum for that purpose we may as well use it.

6143. By David Martin on 2011-11-08

Make conf_get_process() const-correct.

Unmerged revisions

=== modified file 'firewall/conntrack.c'
--- firewall/conntrack.c	2011-10-25 21:14:16 +0000
+++ firewall/conntrack.c	2011-11-02 14:51:25 +0000
@@ -2244,3 +2244,56 @@
         remove_connection(conn_list->data);
     }
 }
+
+/**
+ * Prepare given message with host association info from the tracked connections.
+ *
+ * @param msg The message where the info is written.
+ * @return  0 on success
+ *         -1 on error
+ */
+int hip_fw_handle_get_ha_info(struct hip_common *msg)
+{
+    struct hip_hadb_user_info_state hid = { { { { 0 } } } };
+    struct slist                   *iter_conn;
+    struct connection              *conn;
+    struct hip_data                *data;
+
+    if (!msg) {
+        HIP_ERROR("Missing message parameter.\n");
+        return -1;
+    }
+
+    if (conn_list == NULL) {
+        HIP_DEBUG("No tracked connections to return.\n");
+        return 0;
+    }
+
+    hip_msg_init(msg);
+    if (hip_build_user_hdr(msg, HIP_MSG_GET_HA_INFO, 0) < 0) {
+        HIP_ERROR("Failed to build GET_HA_INFO message header.\n");
+        return -1;
+    }
+
+    iter_conn = conn_list;
+    while (iter_conn) {
+        conn = iter_conn->data;
+        data = conn->original.hip_tuple->data;
+
+        // build HA_INFO with info from connection initiator
+        hid.state = conn->state;
+        ipv6_addr_copy(&hid.hit_our, &data->src_hit);
+        ipv6_addr_copy(&hid.hit_peer, &data->dst_hit);
+        hid.nat_udp_port_local = conn->original.src_port;
+        hid.nat_udp_port_peer  = conn->original.dst_port;
+
+        if (hip_build_param_contents(msg, &hid, HIP_PARAM_HA_INFO, sizeof(hid)) < 0) {
+            HIP_ERROR("Failed to build initiator HA_INFO parameter.\n");
+            return -1;
+        }
+
+        iter_conn = iter_conn->next;
+    }
+
+    return 0;
+}

=== modified file 'firewall/conntrack.h'
--- firewall/conntrack.h	2011-07-18 16:31:37 +0000
+++ firewall/conntrack.h	2011-11-02 14:51:25 +0000
@@ -63,4 +63,6 @@
 void hip_fw_conntrack_periodic_cleanup(void);
 void hip_fw_uninit_conntrack(void);
 
+int hip_fw_handle_get_ha_info(struct hip_common *msg);
+
 #endif /* HIP_FIREWALL_CONNTRACK_H */

=== modified file 'firewall/firewall.c'
--- firewall/firewall.c	2011-10-30 11:41:51 +0000
+++ firewall/firewall.c	2011-11-02 14:51:25 +0000
@@ -1672,7 +1672,7 @@
     n    = recvfrom(hip_fw_async_sock, msg, sizeof(struct hip_common),
                     MSG_PEEK, (struct sockaddr *) &sock_addr, &alen);
     if (n < 0) {
-        HIP_ERROR("Error receiving message header from daemon.\n");
+        HIP_ERROR("Error receiving message header.\n");
         return -1;
     }
 
@@ -1701,24 +1701,13 @@
                  (struct sockaddr *) &sock_addr, &alen);
 
     if (n < 0) {
-        HIP_ERROR("Error receiving message parameters from daemon.\n");
+        HIP_ERROR("Error receiving message parameters.\n");
         return -1;
     }
 
     HIP_ASSERT(n == len);
 
-    if (ntohs(sock_addr.sin6_port) != HIP_DAEMON_LOCAL_PORT) {
-        int type = hip_get_msg_type(msg);
-        if (type == HIP_MSG_FW_BEX_DONE) {
-            HIP_DEBUG("HIP_MSG_FW_BEX_DONE\n");
-            HIP_DEBUG("%d == %d\n", ntohs(sock_addr.sin6_port),
-                      HIP_DAEMON_LOCAL_PORT);
-        }
-        HIP_DEBUG("Drop, message not from hipd\n");
-        return -1;
-    }
-
-    if (hip_handle_msg(msg) < 0) {
+    if (hip_handle_msg(msg, (struct sockaddr *) &sock_addr) < 0) {
         HIP_ERROR("Error handling message\n");
         return -1;
     }
@@ -1847,8 +1836,6 @@
     sock_addr.sin6_addr   = in6addr_loopback;
     HIP_IFEL(bind(hip_fw_async_sock, (struct sockaddr *) &sock_addr, sizeof(sock_addr)), -1,
              "Bind on firewall socket addr failed. Give -k option to kill old hipfw\n");
-    HIP_IFEL(hip_daemon_connect(hip_fw_async_sock), -1,
-             "connecting socket failed\n");
 
     /* Starting hipfw does not always work when hipfw starts first -miika */
     if (hip_userspace_ipsec || hip_lsi_support) {
@@ -1944,7 +1931,7 @@
         }
 
         if (FD_ISSET(hip_fw_async_sock, &read_fdset)) {
-            HIP_DEBUG("****** Received HIPD message ******\n");
+            HIP_DEBUG("****** Received user message ******\n");
             err = fw_handle_hipd_message(msg);
         }
 
@@ -2009,3 +1996,31 @@
 
     return &default_lsi;
 }
+
+/**
+ * Send a message via the firewall socket for asynchronous messages.
+ * Caller is responsible for setting up the message.
+ *
+ * @param msg  The message to be sent.
+ * @param addr The destination address.
+ *
+ * @return  0 on success
+ *         -1 on error
+ */
+int hip_fw_send_message(const struct hip_common *const msg,
+                        const struct sockaddr *const addr)
+{
+    uint16_t len;
+
+    if (msg == NULL || addr == NULL) {
+        HIP_ERROR("Empty message or address.\n");
+        return -1;
+    }
+
+    len = hip_get_msg_total_len(msg);
+    if (sendto(hip_fw_async_sock, msg, len, 0, addr, hip_sockaddr_len(addr)) != len) {
+        return -1;
+    }
+
+    return 0;
+}

=== modified file 'firewall/firewall.h'
--- firewall/firewall.h	2011-04-05 16:44:22 +0000
+++ firewall/firewall.h	2011-11-02 14:51:25 +0000
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2010 Aalto University and RWTH Aachen University.
+ * Copyright (c) 2010-2011 Aalto University and RWTH Aachen University.
  *
  * Permission is hereby granted, free of charge, to any person
  * obtaining a copy of this software and associated documentation
@@ -55,5 +55,7 @@
 void hip_fw_uninit_esp_relay(void);
 hip_hit_t *hip_fw_get_default_hit(void);
 hip_lsi_t *hip_fw_get_default_lsi(void);
+int hip_fw_send_message(const struct hip_common *const msg,
+                        const struct sockaddr *const addr);
 
 #endif /* HIP_FIREWALL_FIREWALL_H */

=== modified file 'firewall/firewall_control.c'
--- firewall/firewall_control.c	2011-10-25 21:14:16 +0000
+++ firewall/firewall_control.c	2011-11-02 14:51:25 +0000
@@ -38,10 +38,12 @@
 #include <string.h>
 #include <netinet/in.h>
 
+#include "conntrack.h"
 #include "lib/core/builder.h"
 #include "lib/core/debug.h"
 #include "lib/core/ife.h"
 #include "lib/core/message.h"
+#include "lib/core/prefix.h"
 #include "lib/core/protodefs.h"
 #include "cache.h"
 #include "firewall.h"
@@ -91,12 +93,13 @@
 }
 
 /**
- * distribute a message from hipd to the respective extension handler
+ * distribute a user message to the respective extension handler
  *
- * @param   msg pointer to the received user message
+ * @param   msg  pointer to the received user message
+ * @param   addr destination address for a reply
  * @return  0 on success, else -1
  */
-int hip_handle_msg(struct hip_common *msg)
+int hip_handle_msg(struct hip_common *msg, struct sockaddr *addr)
 {
     int                type, err = 0;
     struct hip_common *msg_out = NULL;
@@ -150,12 +153,36 @@
         HIP_IFEL(hip_send_recv_daemon_info(msg_out, 1, hip_fw_sock), -1,
                  "Couldn't notify daemon of firewall presence\n");
         break;
+    case HIP_MSG_GET_HA_INFO:
+        HIP_IFEL(hip_fw_handle_get_ha_info(msg), -1,
+                 "Could not handle GET_HA message.\n");
+        HIP_IFEL(hip_fw_send_message(msg, addr), -1,
+                 "Could not send HA reply.\n");
+        break;
     default:
         HIP_ERROR("Unhandled message type %d\n", type);
         err = -1;
         break;
     }
+
 out_err:
+    if (hip_get_msg_response(msg)) {
+        HIP_DEBUG("Send response\n");
+        if (err) {
+            hip_hdr msg_type = hip_get_msg_type(msg);
+            hip_msg_init(msg);
+            hip_build_user_hdr(msg, msg_type, 0);
+            hip_set_msg_err(msg, 1);
+        }
+        HIP_DEBUG("Sending message (type=%d) response\n",
+                  hip_get_msg_type(msg));
+        if (hip_fw_send_message(msg, addr) == -1) {
+            err = -1;
+        } else {
+            HIP_DEBUG("Response sent ok\n");
+        }
+    }
+
     free(msg_out);
     return err;
 }

=== modified file 'firewall/firewall_control.h'
--- firewall/firewall_control.h	2010-10-15 15:29:14 +0000
+++ firewall/firewall_control.h	2011-11-02 14:51:25 +0000
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2010 Aalto University and RWTH Aachen University.
+ * Copyright (c) 2010-2011 Aalto University and RWTH Aachen University.
  *
  * Permission is hereby granted, free of charge, to any person
  * obtaining a copy of this software and associated documentation
@@ -28,6 +28,6 @@
 
 #include "lib/core/protodefs.h"
 
-int hip_handle_msg(struct hip_common *msg);
+int hip_handle_msg(struct hip_common *msg, struct sockaddr *addr);
 
 #endif /* HIP_FIREWALL_FIREWALL_CONTROL_H */

=== modified file 'hipd/init.c'
--- hipd/init.c	2011-10-30 11:54:44 +0000
+++ hipd/init.c	2011-11-02 14:51:25 +0000
@@ -164,7 +164,7 @@
 }
 
 #define HIPL_CONFIG_FILE_EX \
-    "# Format of this file is as with hipconf, but without hipconf prefix\n\
+    "# Format of this file is as with hipconf, but without \"hipconf daemon\" prefix\n\
 # add hi default    # add all four HITs (see bug id 592127)\n\
 # add map HIT IP    # preload some HIT-to-IP mappings to hipd\n\
 # add service rvs   # the host acts as HIP rendezvous (see also HIPL_SYSCONFDIR/relay_config)\n\

=== modified file 'lib/core/conf.c'
--- lib/core/conf.c	2011-10-31 17:38:04 +0000
+++ lib/core/conf.c	2011-11-02 14:51:25 +0000
@@ -181,6 +181,11 @@
 /* #define TYPE_RELAY         22 */
 
 /**
+ * The daemon process to be configured by the conf command.
+ */
+enum daemon_name daemon_name;
+
+/**
  * A help string containing the usage of @c hipconf and also
  * @c HIPL_SYSCONFDIR/hipd_config.
  *
@@ -188,6 +193,9 @@
  *       for the action.
  */
 const char *hipconf_usage =
+    HIPCONF_HIPD_KEYWORD
+    " <command>\n\n"
+    "HIP daemon commands:\n"
     "add map <hit> <ip> [lsi]\n"
     "get map <hit | lsi>\n"
     "del hi <hit> | all\n"
@@ -226,6 +234,51 @@
 ;
 
 /**
+ * A help string containing the usage of @c hipfwconf.
+ *
+ * @note If you added a new action, do not forget to add a brief usage below
+ *       for the action.
+ */
+const char *hipfwconf_usage =
+    HIPCONF_HIPFW_KEYWORD
+    " <command>\n\n"
+    "HIP firewall commands:\n"
+    "get ha <hit> | all\n";
+
+/**
+ * Send a message to hipd or hipfw and optionally receive an answer.
+ *
+ * @param msg       The message to be sent. The respective answer will be stored
+ *                  here as well.
+ * @param send_only 1 if no response from hipd should be requested.
+ *                  0 if it should block until a response from hipd is received.
+ *                  This option has no effect when sending messages to hipfw.
+ *
+ * @return  0 on success
+ *         -1 on error
+ */
+static int send_receive_message(struct hip_common *msg,
+                                const int send_only)
+{
+    if (daemon_name == HIP_DAEMON) {
+        if (hip_send_recv_daemon_info(msg, send_only, 0)) {
+            HIP_ERROR("Failed to send user message to the HIP daemon.\n");
+            return -1;
+        }
+    } else if (daemon_name == HIP_FIREWALL) {
+        if (hip_send_recv_firewall_info(msg)) {
+            HIP_ERROR("Failed to send user message to the HIP firewall.\n");
+            return -1;
+        }
+    } else {
+        HIP_ERROR("Destination daemon process unknown.\n");
+        return -1;
+    }
+
+    return 0;
+}
+
+/**
  * Query hipd for the HITs of the local host
  *
  * @param msg input/output message for the query/response for hipd
@@ -510,6 +563,25 @@
 /* Non-static functions -> global scope */
 
 /**
+ * Map daemon / firewall keyboard to its respective enum.
+ *
+ * @param argv an array of strings (command line args to hipconf)
+ * @return HIP_DAEMON in case of hipd keyword
+ *         HIP_FIREWALL in case of hipfw keyword
+ *         UNKNOWN_KEYWORD else
+ */
+static int conf_get_process(const char *argv[])
+{
+    if (!strcmp(HIPCONF_HIPD_KEYWORD, argv[1])) {
+        return HIP_DAEMON;
+    } else if (!strcmp(HIPCONF_HIPFW_KEYWORD, argv[1])) {
+        return HIP_FIREWALL;
+    }
+
+    return UNKNOWN_KEYWORD;
+}
+
+/**
  * Map a symbolic hipconf action (=add/del) into a number
  *
  * @param argv an array of strings (command line args to hipconf)
@@ -526,61 +598,61 @@
 {
     int ret = -1;
 
-    if (!strcmp("add", argv[1])) {
+    if (!strcmp("add", argv[2])) {
         ret = ACTION_ADD;
-    } else if (!strcmp("del", argv[1])) {
+    } else if (!strcmp("del", argv[2])) {
         ret = ACTION_DEL;
-    } else if (!strcmp("new", argv[1])) {
+    } else if (!strcmp("new", argv[2])) {
         ret = ACTION_NEW;
-    } else if (!strcmp("get", argv[1])) {
+    } else if (!strcmp("get", argv[2])) {
         ret = ACTION_GET;
-    } else if (!strcmp("set", argv[1])) {
+    } else if (!strcmp("set", argv[2])) {
         ret = ACTION_SET;
-    } else if (!strcmp("inc", argv[1])) {
+    } else if (!strcmp("inc", argv[2])) {
         ret = ACTION_INC;
-    } else if (!strcmp("dec", argv[1])) {
+    } else if (!strcmp("dec", argv[2])) {
         ret = ACTION_DEC;
-    } else if (!strcmp("rst", argv[1])) {
+    } else if (!strcmp("rst", argv[2])) {
         ret = ACTION_RST;
-    } else if (!strcmp("run", argv[1])) {
+    } else if (!strcmp("run", argv[2])) {
         ret = ACTION_RUN;
-    } else if (!strcmp("load", argv[1])) {
+    } else if (!strcmp("load", argv[2])) {
         ret = ACTION_LOAD;
-    } else if (!strcmp("heartbeat", argv[1])) {
+    } else if (!strcmp("heartbeat", argv[2])) {
         ret = ACTION_HEARTBEAT;
-    } else if (!strcmp("locator", argv[1])) {
+    } else if (!strcmp("locator", argv[2])) {
         ret = ACTION_LOCATOR;
-    } else if (!strcmp("debug", argv[1])) {
+    } else if (!strcmp("debug", argv[2])) {
         ret = ACTION_DEBUG;
-    } else if (!strcmp("transform", argv[1])) {
+    } else if (!strcmp("transform", argv[2])) {
         ret = ACTION_TRANSORDER;
-    } else if (!strcmp("reinit", argv[1])) {
+    } else if (!strcmp("reinit", argv[2])) {
         ret = ACTION_REINIT;
-    } else if (!strcmp("manual-update", argv[1])) {
+    } else if (!strcmp("manual-update", argv[2])) {
         ret = ACTION_MANUAL_UPDATE;
-    } else if (!strcmp("hit-to-lsi", argv[1])) {
+    } else if (!strcmp("hit-to-lsi", argv[2])) {
         ret = ACTION_HIT_TO_LSI;
-    } else if (!strcmp("nsupdate", argv[1])) {
+    } else if (!strcmp("nsupdate", argv[2])) {
         ret = ACTION_NSUPDATE;
-    } else if (!strcmp("hit-to-ip-set", argv[1])) {
+    } else if (!strcmp("hit-to-ip-set", argv[2])) {
         ret = ACTION_HIT_TO_IP_SET;
-    } else if (!strcmp("hit-to-ip", argv[1])) {
+    } else if (!strcmp("hit-to-ip", argv[2])) {
         ret = ACTION_HIT_TO_IP;
-    } else if (!strcmp("shotgun", argv[1])) {
+    } else if (!strcmp("shotgun", argv[2])) {
         ret = ACTION_SHOTGUN;
-    } else if (!strcmp("lsi-to-hit", argv[1])) {
+    } else if (!strcmp("lsi-to-hit", argv[2])) {
         ret = ACTION_LSI_TO_HIT;
-    } else if (!strcmp("nat", argv[1])) {
-        if (!strcmp("port", argv[2])) {
-            if (!strcmp("local", argv[3])) {
+    } else if (!strcmp("nat", argv[2])) {
+        if (!strcmp("port", argv[3])) {
+            if (!strcmp("local", argv[4])) {
                 ret = ACTION_NAT_LOCAL_PORT;
-            } else if (!strcmp("peer", argv[3])) {
+            } else if (!strcmp("peer", argv[4])) {
                 ret = ACTION_NAT_PEER_PORT;
             }
         } else {
             ret = ACTION_NAT;
         }
-    } else if (!strcmp("broadcast", argv[1])) {
+    } else if (!strcmp("broadcast", argv[2])) {
         ret = ACTION_BROADCAST;
     }
 
@@ -670,45 +742,45 @@
         ret = TYPE_HA;
     } else if (!strcmp("shotgun", text)) {
         ret = TYPE_SHOTGUN;
-    } else if ((!strcmp("all", text)) && (strcmp("rst", argv[1]) == 0)) {
-        ret = TYPE_RST;
-    } else if ((!strcmp("peer_hit", text)) && (strcmp("rst", argv[1]) == 0)) {
-        ret = TYPE_RST;
-    } else if (strcmp("nat", argv[1]) == 0) {
-        if (argv[2] && strcmp("port", argv[2]) == 0) {
-            if (argv[3] && strcmp("local", argv[3]) == 0) {
+    } else if ((!strcmp("all", text)) && (strcmp("rst", argv[2]) == 0)) {
+        ret = TYPE_RST;
+    } else if ((!strcmp("peer_hit", text)) && (strcmp("rst", argv[2]) == 0)) {
+        ret = TYPE_RST;
+    } else if (strcmp("nat", argv[2]) == 0) {
+        if (argv[3] && strcmp("port", argv[3]) == 0) {
+            if (argv[4] && strcmp("local", argv[4]) == 0) {
                 ret = TYPE_NAT_LOCAL_PORT;
-            } else if (argv[3] && strcmp("peer", argv[3]) == 0) {
+            } else if (argv[4] && strcmp("peer", argv[4]) == 0) {
                 ret = TYPE_NAT_PEER_PORT;
             }
         } else {
             ret = TYPE_NAT;
         }
-    } else if (strcmp("locator", argv[1]) == 0) {
+    } else if (strcmp("locator", argv[2]) == 0) {
         ret = TYPE_LOCATOR;
     } else if (!strcmp("debug", text)) {
         ret = TYPE_DEBUG;
     } else if (!strcmp("order", text)) {
         ret = TYPE_ORDER;
-    } else if (strcmp("heartbeat", argv[1]) == 0) {
+    } else if (strcmp("heartbeat", argv[2]) == 0) {
         ret = TYPE_HEARTBEAT;
     } else if (!strcmp("ttl", text)) {
         ret = TYPE_TTL;
     } else if (!strcmp("config", text)) {
         ret = TYPE_CONFIG;
-    } else if (strcmp("manual-update", argv[1]) == 0) {
+    } else if (strcmp("manual-update", argv[2]) == 0) {
         ret = TYPE_MANUAL_UPDATE;
-    } else if (strcmp("hit-to-lsi", argv[1]) == 0) {
+    } else if (strcmp("hit-to-lsi", argv[2]) == 0) {
         ret = TYPE_HIT_TO_LSI;
-    } else if (strcmp("nsupdate", argv[1]) == 0) {
+    } else if (strcmp("nsupdate", argv[2]) == 0) {
         ret = TYPE_NSUPDATE;
-    } else if (strcmp("hit-to-ip-set", argv[1]) == 0) {
+    } else if (strcmp("hit-to-ip-set", argv[2]) == 0) {
         ret = TYPE_HIT_TO_IP_SET;
-    } else if (strcmp("hit-to-ip", argv[1]) == 0) {
+    } else if (strcmp("hit-to-ip", argv[2]) == 0) {
         ret = TYPE_HIT_TO_IP;
-    } else if (strcmp("lsi-to-hit", argv[1]) == 0) {
+    } else if (strcmp("lsi-to-hit", argv[2]) == 0) {
         ret = TYPE_LSI_TO_HIT;
-    } else if (strcmp("broadcast", argv[1]) == 0) {
+    } else if (strcmp("broadcast", argv[2]) == 0) {
         ret = TYPE_BROADCAST;
     } else {
         HIP_DEBUG("ERROR: NO MATCHES FOUND \n");
@@ -725,7 +797,7 @@
  *       here in the switch(action) block.
  * @param action integer value for an action
  * @return an index for argv[], which indicates the type argument.
- *         Usually either 1 or 2.
+ *         Usually either 2 or 3.
  */
 static int conf_get_type_arg(int action)
 {
@@ -753,15 +825,15 @@
     case ACTION_HIT_TO_IP:
     case ACTION_HIT_TO_IP_SET:
     case ACTION_BROADCAST:
+        type_arg = 3;
+        break;
+    case ACTION_MANUAL_UPDATE:
+    case ACTION_HIT_TO_LSI:
+    case ACTION_LSI_TO_HIT:
+    case ACTION_DEBUG:
+    case ACTION_SHOTGUN:
         type_arg = 2;
         break;
-    case ACTION_MANUAL_UPDATE:
-    case ACTION_HIT_TO_LSI:
-    case ACTION_LSI_TO_HIT:
-    case ACTION_DEBUG:
-    case ACTION_SHOTGUN:
-        type_arg = 1;
-        break;
     default:
         break;
     }
@@ -2042,10 +2114,10 @@
     HIP_IFEL(optc > 1, -1, "Too many arguments\n");
 
     HIP_IFEL(hip_build_user_hdr(msg, HIP_MSG_GET_HA_INFO, 0), -1,
-             "Building of daemon header failed\n");
+             "Building of user msg header failed\n");
 
-    HIP_IFEL(hip_send_recv_daemon_info(msg, send_only, 0), -1,
-             "send recv daemon info\n");
+    HIP_IFEL(send_receive_message(msg, send_only), -1,
+             "send recv info\n");
 
     while ((current_param = hip_get_next_param(msg, current_param))) {
         ha = hip_get_param_contents_direct(current_param);
@@ -2313,8 +2385,9 @@
             *comment = '\0';
         }
 
-        /* prefix the contents of the line with" hipconf"  */
-        res_len = sprintf(str, "hipconf %s", c);
+        /* prefix the contents of the line with" hipconf HIPCONF_HIPD_KEYWORD"
+         * Only hipd parses config files as hipconf commands, hardcode it as target */
+        res_len = sprintf(str, "hipconf %s %s", HIPCONF_HIPD_KEYWORD, c);
         if (str[res_len] == '\n') {
             str[res_len] = '\0';
         }
@@ -2327,7 +2400,6 @@
             args[i++] = token;
             token     = strtok(NULL, " \t");
         }
-
         err = hip_do_hipconf(i, args, 1);
         if (err) {
             HIP_ERROR("Error on the following line: %s\n", line);
@@ -2451,9 +2523,18 @@
     struct hip_common *msg    = NULL;
 
     /* Check that we have at least one command line argument. */
-    if (argc < 2) {
-        HIP_ERROR("Invalid arguments.\n\n%s usage:\n%s\n",
-                  argv[0], hipconf_usage);
+    if (argc < 3) {
+        HIP_ERROR("Invalid arguments.\nUsage to communicate with HIP daemon:\n %s %s\n"
+                  "\nUsage to communicate with HIP firewall:\n %s %s\n",
+                  argv[0], hipconf_usage, argv[0], hipfwconf_usage);
+        return -1;
+    }
+
+    /* set context for this conf command */
+    daemon_name = conf_get_process(argv);
+    if (daemon_name == UNKNOWN_KEYWORD) {
+        HIP_ERROR("Invalid target process argument '%s'. Expected '%s' or '%s'.\n",
+                  argv[1], HIPCONF_HIPD_KEYWORD, HIPCONF_HIPFW_KEYWORD);
         return -1;
     }
 
@@ -2461,14 +2542,14 @@
     action = conf_get_action(argv);
 
     if (action == -1) {
-        HIP_ERROR("Invalid action argument '%s'\n", argv[1]);
+        HIP_ERROR("Invalid action argument '%s'\n", argv[2]);
         return -1;
     }
 
     /* Check that we have at least the minimum number of arguments
      * for the given action. */
-    if (argc < conf_check_action_argc(action) + 2) {
-        HIP_ERROR("Not enough arguments given for the action '%s'\n", argv[1]);
+    if (argc < conf_check_action_argc(action) + 3) {
+        HIP_ERROR("Not enough arguments given for the action '%s'\n", argv[2]);
         return -1;
     }
 
@@ -2496,14 +2577,14 @@
     /* Call handler function from the handler function pointer
      * array at index "type" with given commandline arguments.
      * The functions build a hip_common message. */
-    if (argc == 3) {
-        err = (*action_handler[type])(msg, action, &argv[2], argc - 3, send_only);
+    if (argc == 4) {
+        err = (*action_handler[type])(msg, action, &argv[3], argc - 4, send_only);
     } else {
-        err = (*action_handler[type])(msg, action, &argv[3], argc - 3, send_only);
+        err = (*action_handler[type])(msg, action, &argv[4], argc - 4, send_only);
     }
 
     if (err != 0) {
-        HIP_ERROR("Failed to send a message to the HIP daemon.\n");
+        HIP_ERROR("Failed to send user message.\n");
         goto out_err;
     }
 
@@ -2512,9 +2593,7 @@
         goto out_err;
     }
 
-    /* Send message to hipd */
-    HIP_IFEL(hip_send_recv_daemon_info(msg, send_only, 0), -1,
-             "Failed to send user message to the HIP daemon.\n");
+    send_receive_message(msg, send_only);
 
     HIP_INFO("User message was sent successfully to the HIP daemon.\n");
 

=== modified file 'lib/core/conf.h'
--- lib/core/conf.h	2011-08-15 14:11:56 +0000
+++ lib/core/conf.h	2011-11-02 14:51:25 +0000
@@ -54,6 +54,11 @@
 #define ACTION_ADD 1
 #define ACTION_NEW 3
 
+enum daemon_name { HIP_DAEMON, HIP_FIREWALL, UNKNOWN_KEYWORD };
+/* keywords used to identify hipd / hipfw as target of hipconf command */
+#define HIPCONF_HIPD_KEYWORD  "daemon"
+#define HIPCONF_HIPFW_KEYWORD "firewall"
+
 int hip_handle_exec_app(int fork, int type, int argc,
                         const char *const argv[]);
 int hip_do_hipconf(int argc, const char *argv[], int send_only);

=== modified file 'lib/core/message.c'
--- lib/core/message.c	2011-10-25 21:44:47 +0000
+++ lib/core/message.c	2011-11-02 14:51:25 +0000
@@ -86,6 +86,7 @@
 #include <sys/time.h>
 #include <sys/types.h>
 
+#include "lib/core/conf.h"
 #include "lib/tool/nlink.h"
 #include "builder.h"
 #include "common.h"
@@ -178,6 +179,30 @@
 }
 
 /**
+ * Connect a socket to the loopback address of hipd or hipfw.
+ *
+ * @param  hip_user_sock The socket to connect.
+ * @param  port          The port to connect.
+ * @return zero on success and negative on failure
+ * @note   currently only SOCK_DGRAM and AF_INET6 are supported
+ */
+static int hip_connect(int hip_user_sock, int port)
+{
+    struct sockaddr_in6 addr = { 0 };
+
+    addr.sin6_family = AF_INET6;
+    addr.sin6_port   = htons(port);
+    addr.sin6_addr   = in6addr_loopback;
+
+    if (connect(hip_user_sock, (struct sockaddr *) &addr, sizeof(addr))) {
+        HIP_ERROR("connection failed: %s\n", strerror(errno));
+        return -1;
+    }
+
+    return 0;
+}
+
+/**
  * Connect a socket to the loop back address of hipd
  *
  * @param hip_user_sock The socket to connect. Currently only SOCK_DGRAM
@@ -187,21 +212,7 @@
  */
 int hip_daemon_connect(int hip_user_sock)
 {
-    int                 err         = 0;
-    struct sockaddr_in6 daemon_addr = { 0 };
-    // We're using system call here add thus resetting errno.
-    errno = 0;
-
-    daemon_addr.sin6_family = AF_INET6;
-    daemon_addr.sin6_port   = htons(HIP_DAEMON_LOCAL_PORT);
-    daemon_addr.sin6_addr   = in6addr_loopback;
-
-    HIP_IFEL(connect(hip_user_sock, (struct sockaddr *) &daemon_addr,
-                     sizeof(daemon_addr)), -1, "connection to daemon failed\n");
-
-out_err:
-
-    return err;
+    return hip_connect(hip_user_sock, HIP_DAEMON_LOCAL_PORT);
 }
 
 /**
@@ -319,23 +330,30 @@
 #define EHIP       500
 
 /**
- * Send and receive data with hipd. Do not call this function directly, use
- * hip_send_recv_daemon_info instead!
+ * Send and receive data with hipd or hipfw. Do not call this function directly,
+ * use hip_send_recv_daemon_info or hip_send_recv_firewall_info instead!
  *
- * @param msg the message to send to hipd
+ * @param msg        The message to send to hipd or hipfw
  * @param opt_socket Optional socket to use for the message exchange. When
  *                   set to zero, the function creates a temporary socket
  *                   and closes it after the transaction is completed.
+ * @param port       The port to send the message to.
  * @return zero on success and negative on failure
  * @note currently only SOCK_DGRAM and AF_INET6 are supported
  */
-static int send_recv_daemon_info_internal(struct hip_common *msg,
-                                          int opt_socket)
+static int send_recv_info_internal(struct hip_common *msg, int opt_socket, int port)
 {
     int                 hip_user_sock = 0, err = 0, n = 0, len = 0;
     struct sockaddr_in6 addr          = { 0 };
     uint8_t             msg_type_old, msg_type_new;
+    const char         *receiver;
 
+    /* determine receiver to print correct debug / error messages */
+    if (port == HIP_FIREWALL_PORT) {
+        receiver = HIPCONF_HIPFW_KEYWORD;
+    } else {
+        receiver = HIPCONF_HIPD_KEYWORD;
+    }
     msg_type_old = hip_get_msg_type(msg);
 
     // We're using system call here and thus resetting errno.
@@ -354,9 +372,9 @@
         HIP_IFEL(daemon_bind_socket(hip_user_sock,
                                     (struct sockaddr *) &addr), -1,
                  "bind failed\n");
-        /* Connect to hipd. Otherwise e.g. "hipconf get ha all"
+        /* Connect to hipd or hipfw. Otherwise e.g. "hipconf daemon get ha all"
          * blocks when hipd is not running. */
-        HIP_IFEL(hip_daemon_connect(hip_user_sock), -1,
+        HIP_IFEL(hip_connect(hip_user_sock, port), -1,
                  "connect failed\n");
     }
 
@@ -368,14 +386,18 @@
     /* Require a response from hipd */
     hip_set_msg_response(msg, 1);
 
-    n = sendto_hipd(hip_user_sock, msg, len);
+    if (port == HIP_FIREWALL_PORT) {
+        n = send(hip_user_sock, msg, len, 0);
+    } else {
+        n = sendto_hipd(hip_user_sock, msg, len);
+    }
     if (n < len) {
-        HIP_ERROR("Could not send message to daemon.\n");
+        HIP_ERROR("Could not send message to %s.\n", receiver);
         err = -ECOMM;
         goto out_err;
     }
 
-    HIP_DEBUG("Waiting to receive daemon info.\n");
+    HIP_DEBUG("Waiting to receive %s info.\n", receiver);
 
     if ((len = peek_recv_total_len(hip_user_sock, 0, HIP_DEFAULT_MSG_TIMEOUT)) < 0) {
         err = len;
@@ -390,14 +412,14 @@
              "Message sync problem. Expected %d, got %d\n",
              msg_type_old, msg_type_new);
 
-    HIP_DEBUG("%d bytes received from HIP daemon\n", n);
+    HIP_DEBUG("%d bytes received from HIP %s.\n", n, receiver);
 
     if (n == 0) {
-        HIP_INFO("The HIP daemon has performed an orderly shutdown.\n");
+        HIP_INFO("The HIP %s has performed an orderly shutdown.\n", receiver);
         // Note. This is not an error condition, thus we return zero.
         goto out_err;
     } else if (n < (int) sizeof(struct hip_common)) {
-        HIP_ERROR("Could not receive message from daemon.\n");
+        HIP_ERROR("Could not receive message from %s.\n", receiver);
         goto out_err;
     }
 
@@ -442,7 +464,7 @@
     struct sockaddr_in6 addr          = { 0 };
 
     if (!send_only) {
-        return send_recv_daemon_info_internal(msg, opt_socket);
+        return send_recv_info_internal(msg, opt_socket, HIP_DAEMON_LOCAL_PORT);
     }
 
     if (opt_socket) {
@@ -479,6 +501,21 @@
 }
 
 /**
+ * A generic function to send messages to hipfw with subsequent reply. This will
+ * block the process until the hipfw sends the response or a predefined timeout
+ * is exceeded.
+ *
+ * @param msg An input/output parameter. As input, contains the
+ *            message to be sent to hipfw. As output, hipfw response
+ *            will be written here.
+ * @return zero on success and negative on failure.
+ */
+int hip_send_recv_firewall_info(struct hip_common *const msg)
+{
+    return send_recv_info_internal(msg, 0, HIP_FIREWALL_PORT);
+}
+
+/**
  * Read an interprocess (user) message
  *
  * @param  sockfd   a socket from where to read

=== modified file 'lib/core/message.h'
--- lib/core/message.h	2011-08-15 14:11:56 +0000
+++ lib/core/message.h	2011-11-02 14:51:25 +0000
@@ -46,5 +46,6 @@
 int hip_send_recv_daemon_info(struct hip_common *msg,
                               int send_only,
                               int opt_socket);
+int hip_send_recv_firewall_info(struct hip_common *const msg);
 
 #endif /* HIP_LIB_CORE_MESSAGE_H */