Merge lp:~martin-lp/hipl/hipfwconf into lp:hipl

[David Martin]

This branch introduces changes to get the currently active connection from the firewall.

This is a resubmitted merge proposal:
instead of using a separate binary option 1 of the previous discussion is implemented:
> 1) add an extra keyword to the hipconf command line: hipconf (daemon | firewall) COMMAND

Changes since last proposal:
Addressed Diegos 'needs fixing' comments.
-> move enum daemon_name into conf.c and make conf_get_process() const-correct.

Summed up changes since the last proposal (revision 6116ff.):
Keywords to address hipd / hipfw are daemon and firewall and defined in lib/core/conf.h.
The hipconf help print has been updated.
Config file syntax does not have to be changed as only hipd parses configs via hipconf and the daemon
keyword is hardcoded.

From what I've tested everything works as before.

[Miika Komu (miika-iki)]

Why separate binary just for configuring hipfw? Why this can't be embedded into hipconf?

review: Needs Information

[Diego Biurrun (diego-biurrun)]

On Mon, Oct 24, 2011 at 03:49:25PM +0000, Miika Komu wrote:
> Review: Needs Information
>
> Why separate binary just for configuring hipfw? Why this can't be embedded into hipconf?

Seconded. I'm terribly suspicious of this whole hipconf thing and
whether or not it is a good idea. IIUC authentication is nonexistent
and it's not clear to me what the advantage to rereading a config
file is.

Diego

[Miika Komu (miika-iki)]

Another benefit of merged functionality is to allow reading of static information from /etc/hip/hipd_config

[René Hummen (rene-hummen)]

On 24.10.2011, at 17:49, Miika Komu wrote:
> Why separate binary just for configuring hipfw? Why this can't be embedded into hipconf?

There are three ways to implement this functionality:
1) add an extra keyword to the hipconf command line: hipconf (daemon | firewall) COMMAND
2) add firewall queries as command parameter: hipconf get firewall-ha
3) implement as separate binary using libcore.

(1) would require some changes to hipconf command line parsing and would render the old user API broken. Furthermore, it would require an even longer parameter list for getting specific information. For these reasons, I would not want to implement this option.
(2) is somewhat inconsistent with the current syntax, but I would be fine with that. Only minor changes to the current proposal would be required.
(3) doesn't break the user API and clearly separates hipd configuration from hipfw status querying. This is my preferred option.

Opinions and other proposals are welcome.

Ciao,
René

--
Dipl.-Inform. Rene Hummen, Ph.D. Student
Chair of Communication and Distributed Systems
RWTH Aachen University, Germany
tel: [phone]
web: http://www.comsys.rwth-aachen.de/team/rene-hummen/

[René Hummen (rene-hummen)]

Forgot to include launchpad.

Begin forwarded message:
> From: René Hummen <email address hidden>
> Date: 27. Oktober 2011 15:41:06 MESZ
> To: <email address hidden>
> Subject: Re: [hipl-dev] Re: [Merge] lp:~martin-lp/hipl/hipfwconf into lp:hipl
>
> On 24.10.2011, at 19:27, Diego Biurrun wrote:
>> On Mon, Oct 24, 2011 at 03:49:25PM +0000, Miika Komu wrote:
>>> Review: Needs Information
>>>
>>> Why separate binary just for configuring hipfw? Why this can't be embedded into hipconf?
>>
>> Seconded. I'm terribly suspicious of this whole hipconf thing and
>> whether or not it is a good idea. IIUC authentication is nonexistent
>> and it's not clear to me what the advantage to rereading a config
>> file is.
>
> The issue of having one or multiple binaries aside, I think hipconf should rather be a hipstatus tool. I.e., hipd and hipfw should be configured via config files (with reload functionality) and the the current run-time status should be requestable via hipstatus. However, this is not as it's done in HIPL at the moment. Instead, reading the config file mimics calls to hipconf in order to set up the hipd. hipfwconf, on the other hand, only provides status information.
>
> Do I see volunteers who are willing to fix this hipconf-based configuration issue? :)
>
> Ciao,
> René

--
Dipl.-Inform. Rene Hummen, Ph.D. Student
Chair of Communication and Distributed Systems
RWTH Aachen University, Germany
tel: [phone]
web: http://www.comsys.rwth-aachen.de/team/rene-hummen/

[René Hummen (rene-hummen)]

On 25.10.2011, at 09:42, Miika Komu wrote:
> Another benefit of merged functionality is to allow reading of static information from /etc/hip/hipd_config

I don't see your point here. Can you please explain. By the way, hipfwconf wraps around libcore the same way hipconf does.

--
Dipl.-Inform. Rene Hummen, Ph.D. Student
Chair of Communication and Distributed Systems
RWTH Aachen University, Germany
tel: [phone]
web: http://www.comsys.rwth-aachen.de/team/rene-hummen/

[Miika Komu (miika-iki)]

> IIUC authentication is nonexistent

This a fallacy, it does have authentication. Critical functions are allowed only for root.

> and it's not clear to me what the advantage to rereading a config
> file is.

Obviously, changing of parameters during run time.

[Miika Komu (miika-iki)]

> On 25.10.2011, at 09:42, Miika Komu wrote:
> > Another benefit of merged functionality is to allow reading of static
> information from /etc/hip/hipd_config
>
> I don't see your point here. Can you please explain. By the way, hipfwconf
> wraps around libcore the same way hipconf does.

You mean that you can set hipfwconf parameters from /etc/hip/hipd_config ? Did you test this?

[Miika Komu (miika-iki)]

> On 24.10.2011, at 17:49, Miika Komu wrote:
> > Why separate binary just for configuring hipfw? Why this can't be embedded
> into hipconf?
>
> There are three ways to implement this functionality:
> 1) add an extra keyword to the hipconf command line: hipconf (daemon |
> firewall) COMMAND
> 2) add firewall queries as command parameter: hipconf get firewall-ha

Either of these would work for me. Probably 1 is a bit cleaner.

> 3) implement as separate binary using libcore.

I'll counterargument against this below.

> (1) would require some changes to hipconf command line parsing and would
> render the old user API broken. Furthermore, it would require an even longer
> parameter list for getting specific information. For these reasons, I would
> not want to implement this option.

Who cares if the API is changes, really? By breaking, you mean /etc/hip/hipd_config? The file could be prefixed with a "daemon" with a simple regexp when you start hipd (if we would choose #1).

> (2) is somewhat inconsistent with the current syntax, but I would be fine with
> that. Only minor changes to the current proposal would be required.

I would be fine with this.

> (3) doesn't break the user API and clearly separates hipd configuration from
> hipfw status querying. This is my preferred option.

Proposal 3 also fragments the HIP administrative interface into two. You suggest that we'll have one read-only interface and another writeable. I believe in a more unified interface and I fail see why we should disperse. It doesn't sound very responsible to say something is bad, but leave it as it is and switch to new tool?

What do you mean by "hipconf-based configuration issue"?

review: Disapprove

[Diego Biurrun (diego-biurrun)]

On Thu, Oct 27, 2011 at 01:31:29PM +0000, René Hummen wrote:
> On 24.10.2011, at 17:49, Miika Komu wrote:
> > Why separate binary just for configuring hipfw? Why this can't be embedded into hipconf?
>
> There are three ways to implement this functionality:
> 1) add an extra keyword to the hipconf command line: hipconf (daemon | firewall) COMMAND
> 2) add firewall queries as command parameter: hipconf get firewall-ha
> 3) implement as separate binary using libcore.
>
> (1) would require some changes to hipconf command line parsing and
> would render the old user API broken. Furthermore, it would require an
> even longer parameter list for getting specific information. For these
> reasons, I would not want to implement this option.

alias hipdconf="hipconf daemon"
alias hipfwconf="hipconf firewall"

Diego

[Diego Biurrun (diego-biurrun)]

 review needs-fixing

On Mon, Oct 31, 2011 at 06:22:27PM +0000, David Martin wrote:
>
> --- Makefile.am 2011-10-17 18:14:10 +0000
> +++ Makefile.am 2011-10-31 18:21:26 +0000
> @@ -90,8 +90,8 @@
>
> -tools_hipconf_SOURCES = tools/hipconf.c
> -tools_pisacert_SOURCES = tools/pisacert.c
> +tools_hipconf_SOURCES = tools/hipconf.c
> +tools_pisacert_SOURCES = tools/pisacert.c

unrelated

Diego

review: Needs Fixing

[Miika Komu (miika-iki)]

hip_send_recv_firewall_info() has been copy-pasted from hip_send_recv_daemon_info(). The same goes for
hip_send_recv_firewall_info() and hip_handle_user_msg(). Code reuse?

lib/core/conf.c:hipconf_usage is not updated accordingly. Same goes for hipd/init.c:HIPL_CONFIG_FILE_EX. Otherwise, nobody will know about your extensions.

Also, I would like to hear a test report with some existing hipconf options to understand that legacy support still works. For example, try the following:

* hipconf add map HIT IP
* hipconf get ha all
* hipconf rst all

<wait few secs>

* hipconf nat none
* hipconf add map HIT IP
* hipconf get ha all
* hipconf rst all

<wait few secs>

* hipconf nat plain-udp
* hipconf add map HIT IP
* hipconf get ha all
* hipconf rst all

<wait few secs>

* hipconf nat port 1111
* hipconf add map HIT IP
* hipconf get ha all
* hipconf rst all

Does it do what expected?

Other than this, I am satisfied with this commit.

review: Needs Fixing

[David Martin (martin-lp)]

Hi,

On Mon, Oct 31, 2011 at 9:58 PM, Diego Biurrun <email address hidden> wrote:
> On Mon, Oct 31, 2011 at 06:22:27PM +0000, David Martin wrote:
>> --- Makefile.am 2011-10-17 18:14:10 +0000
>> +++ Makefile.am 2011-10-31 18:21:26 +0000
>> @@ -90,8 +90,8 @@
>>
>> -tools_hipconf_SOURCES = tools/hipconf.c
>> -tools_pisacert_SOURCES = tools/pisacert.c
>> +tools_hipconf_SOURCES = tools/hipconf.c
>> +tools_pisacert_SOURCES = tools/pisacert.c
>
> unrelated

That's not really unrelated but unintended. Forgot to reindent after removing the hipfwconf line. Fixed now.

[David Martin (martin-lp)]

Hi,

On Wed, Nov 2, 2011 at 8:32 AM, Miika Komu <email address hidden> wrote:
> Review: Needs Fixing
>
> hip_send_recv_firewall_info() has been copy-pasted from hip_send_recv_daemon_info().

You are right, that has been some pretty evil piece of copy-paste. Fixed this in revision 6121.

> The same goes for hip_send_recv_firewall_info() and hip_handle_user_msg(). Code reuse?

What exactly do you mean?

> lib/core/conf.c:hipconf_usage is not updated accordingly. Same goes for hipd/init.c:HIPL_CONFIG_FILE_EX. Otherwise, nobody will know about your extensions.

I changed it where hipconf_usage was used but this may have not been clear enough.
I've fixed it in revision 6122. Should be better now.

> Also, I would like to hear a test report with some existing hipconf options to understand that legacy support still works. For example, try the following:
>
> * hipconf add map HIT IP
> * hipconf get ha all
> * hipconf rst all
>
> <wait few secs>
>
> * hipconf nat none
> * hipconf add map HIT IP
> * hipconf get ha all
> * hipconf rst all
>
> <wait few secs>
>
> * hipconf nat plain-udp
> * hipconf add map HIT IP
> * hipconf get ha all
> * hipconf rst all
>
> <wait few secs>
>
> * hipconf nat port 1111
> * hipconf add map HIT IP
> * hipconf get ha all
> * hipconf rst all
>
> Does it do what expected?

Did not test that yet but I'll have a look into it and report back.

[Miika Komu (miika-iki)]

Hi,

On 11/02/2011 01:04 PM, David Martin wrote:
>> The same goes for hip_send_recv_firewall_info() and hip_handle_user_msg(). Code reuse?
> What exactly do you mean?

the functions offer very similar functionality (copy paste).

[David Martin (martin-lp)]

Hi again,

On Wed, Nov 2, 2011 at 12:25 PM, Miika Komu <email address hidden> wrote:
> On 11/02/2011 01:04 PM, David Martin wrote:
>>>
>>> The same goes for hip_send_recv_firewall_info() and
>>> hip_handle_user_msg(). Code reuse?
>>
>> What exactly do you mean?
>
> the functions offer very similar functionality (copy paste).

Sorry for being a bit dense but I'm still not sure what you mean.
hip_handle_user_msg() is an enormous beast of a function dealing with all incoming
hipconf messages. hip_send_recv_firewall_info() sends messages to hipfw and
since the last commit is nothing more than a wrapper for send_recv_info_internal().

Maybe you mean hip_handle_msg() in firewall_control.c which basically does the same
as hip_handle_user_msg() only for the firewall. It has not really been touched in this
branch and I see no reason to merge them together. It would result in an even bigger
and even more unwieldy function. The firewall does receive user messages of the same
message type, but it acts differently on them than hipd. I think it's reasonable to keep them
apart. We should think about renaming them to make their purpose more obvious but this
is out of scope of this branch.

[Miika Komu (miika-iki)]

Sorry, I mean fw_handle_hipd_message() and hip_handle_user_msg(). It seems that the beginning of the functions is copy paste. You could extract the beginning into another function and call it in the other two.

[David Martin (martin-lp)]

Hi,

On Wed, Nov 2, 2011 at 3:26 PM, Miika Komu <email address hidden> wrote:
> Sorry, I mean fw_handle_hipd_message() and hip_handle_user_msg(). It seems that the beginning of the functions is copy paste. You could extract the beginning into another function and call it in the other two.

You are right. But if I see it correctly those two weren't really touched by this branch so I would
say it's not related. Feel free to change it in trunk. :)))

PS: Fixed non-compiling make doxygen and added error-handling for wrong process keywords in the last two revisions.

PPS: Had a look at your proposed commands as well. They seem to work alright as far as I can judge. Here's a log:

martin@pisa1:~/src/hipl/hipl_hipfwconf$ sudo tools/hipconf daemon add map 2001:17:e5ab:56b2:3b45:419f:f784:af6a 10.0.3.1
Mapped v4 to v6.
mapped v6: 10.0.3.1
Sending user message 2 to HIPD on socket 3
Sent 88 bytes
Waiting to receive daemon info.
88 bytes received from HIP daemon.
User message was sent successfully to the HIP daemon.

martin@pisa1:~/src/hipl/hipl_hipfwconf$ sudo tools/hipconf daemon get ha all
Sending user message 22 to HIPD on socket 3
Sent 40 bytes
Waiting to receive daemon info.
248 bytes received from HIP daemon.
HA is UNASSOCIATED
 Shotgun mode is off.
 Broadcast mode is off.
 Local HIT: 2001:0017:e5ab:56b2:3b45:419f:f784:af6a
 Peer HIT: 2001:0017:e5ab:56b2:3b45:419f:f784:af6a
 Local LSI: 1.0.0.1
 Peer LSI: 1.0.0.1
 Local IP: 10.0.3.1
 Local NAT traversal UDP port: 10500
 Peer IP: 10.0.3.1
 Peer NAT traversal UDP port: 10500
 Peer hostname:

martin@pisa1:~/src/hipl/hipl_hipfwconf$ sudo tools/hipconf daemon rst all
Sending user message 68 to HIPD on socket 3
Sent 64 bytes
Waiting to receive daemon info.
64 bytes received from HIP daemon.
User message was sent successfully to the HIP daemon.

martin@pisa1:~/src/hipl/hipl_hipfwconf$ sudo tools/hipconf daemon get ha all
Sending user message 22 to HIPD on socket 3
Sent 40 bytes
Waiting to receive daemon info.
40 bytes received from HIP daemon.

martin@pisa1:~/src/hipl/hipl_hipfwconf$ sudo tools/hipconf daemon nat none
<snip>

martin@pisa1:~/src/hipl/hipl_hipfwconf$ sudo tools/hipconf daemon add map 2001:17:e5ab:56b2:3b45:419f:f784:af6a 10.0.3.1
<snip>

martin@pisa1:~/src/hipl/hipl_hipfwconf$ sudo tools/hipconf daemon get ha all
<snip>
HA is UNASSOCIATED
 Shotgun mode is off.
 Broadcast mode is off.
 Local HIT: 2001:0017:e5ab:56b2:3b45:419f:f784:af6a
 Peer HIT: 2001:0017:e5ab:56b2:3b45:419f:f784:af6a
 Local LSI: 1.0.0.1
 Peer LSI: 1.0.0.1
 Local IP: 10.0.3.1
 Local NAT traversal UDP port: 0
 Peer IP: 10.0.3.1
 Peer NAT traversal UDP port: 0
 Peer hostname:

martin@pisa1:~/src/hipl/hipl_hipfwconf$ sudo tools/hipconf daemon nat plain-udp
<snip>

martin@pisa1:~/src/hipl/hipl_hipfwconf$ sudo tools/hipconf daemon get ha all
<snip>
HA is UNASSOCIATED
 Shotgun mode is off.
 Broadcast mode is off.
 Local HIT: 2001:0017:e5ab:56b2:3b45:419f:f784:af6a
 Peer HIT: 2001:0017:e5ab:56b2:3b45:419f:f784:af6a
 Local LSI: 1.0.0.1
 Peer LSI: 1.0.0.1
 Local IP: 10.0.3.1
 Local NAT traversal UDP port: 10500
 Peer IP: 10.0.3.1
 Peer NAT traversal UDP port: 10500
 Peer hostname:

martin@pisa1:~/src/hipl/hipl_hi...

[René Hummen (rene-hummen)]

On 27.10.2011, at 16:37, Miika Komu wrote:
>> On 25.10.2011, at 09:42, Miika Komu wrote:
>>> Another benefit of merged functionality is to allow reading of static
>> information from /etc/hip/hipd_config
>>
>> I don't see your point here. Can you please explain. By the way, hipfwconf
>> wraps around libcore the same way hipconf does.
>
> You mean that you can set hipfwconf parameters from /etc/hip/hipd_config ? Did you test this?

Hmmm, I'm not sure what this discussion was about exactly. Maybe some clarification as to what kind of functionality this branch is supposed to introduce: it allows to request status information from hipfw at run-time. However, it does not allow for run-time configuration right now. Of course, it would be easy to extend hipfw with this functionality, but I don't see that this desirable.

--
Dipl.-Inform. Rene Hummen, Ph.D. Student
Chair of Communication and Distributed Systems
RWTH Aachen University, Germany
tel: [phone]
web: http://www.comsys.rwth-aachen.de/team/rene-hummen/

[Miika Komu (miika-iki)]

> Hmmm, I'm not sure what this discussion was about exactly. Maybe some clarification as to what kind of functionality
> this branch is supposed to introduce: it allows to request status information from hipfw at run-time. However, it
> does not allow for run-time configuration right now. Of course, it would be easy to extend hipfw with this
> functionality, but I don't see that this desirable.

Never mind (now hipd_config can be used to trigger hipfw actions as well).

review: Approve

[David Martin (martin-lp)]

Diego, your opinion? :)

[Diego Biurrun (diego-biurrun)]

 review needs-fixing

On Mon, Oct 31, 2011 at 06:22:27PM +0000, David Martin wrote:
>
> --- lib/core/conf.h 2011-08-15 14:11:56 +0000
> +++ lib/core/conf.h 2011-10-31 18:21:26 +0000
> @@ -54,6 +54,11 @@
>
> +enum daemon_name { HIP_DAEMON, HIP_FIREWALL };
> +/* keywords used to identify hipd / hipfw as target of hipconf command */
> +#define HIPCONF_HIPD_KEYWORD "daemon"
> +#define HIPCONF_HIPFW_KEYWORD "firewall"

These appear unused outside of conf.c.

Diego

review: Needs Fixing

[Diego Biurrun (diego-biurrun)]

On Fri, Nov 04, 2011 at 12:07:34PM +0000, David Martin wrote:
> Diego, your opinion? :)

I said enough to reject it already, just added some more ;)

Diego

[David Martin (martin-lp)]

Hi,

On Fri, Nov 4, 2011 at 1:25 PM, Diego Biurrun <email address hidden> wrote:
> On Mon, Oct 31, 2011 at 06:22:27PM +0000, David Martin wrote:
>>
>> --- lib/core/conf.h 2011-08-15 14:11:56 +0000
>> +++ lib/core/conf.h 2011-10-31 18:21:26 +0000
>> @@ -54,6 +54,11 @@
>>
>> +enum daemon_name { HIP_DAEMON, HIP_FIREWALL };
>> +/* keywords used to identify hipd / hipfw as target of hipconf command */
>> +#define HIPCONF_HIPD_KEYWORD "daemon"
>> +#define HIPCONF_HIPFW_KEYWORD "firewall"
>
> These appear unused outside of conf.c.

Nope, using them in lib/core/message.c as well. Did you pull the latest revisions?

On Fri, Nov 4, 2011 at 1:29 PM, Diego Biurrun <email address hidden> wrote:
> I said enough to reject it already, just added some more ;)

Well, other than you being terribly suspicious of hipconf in general you did not say
aynthing. And that's not very constructive. :p

[Diego Biurrun (diego-biurrun)]

On Fri, Nov 04, 2011 at 12:53:25PM +0000, David Martin wrote:
> On Fri, Nov 4, 2011 at 1:25 PM, Diego Biurrun <email address hidden> wrote:
> > On Mon, Oct 31, 2011 at 06:22:27PM +0000, David Martin wrote:
> >>
> >> --- lib/core/conf.h 2011-08-15 14:11:56 +0000
> >> +++ lib/core/conf.h 2011-10-31 18:21:26 +0000
> >> @@ -54,6 +54,11 @@
> >>
> >> +enum daemon_name { HIP_DAEMON, HIP_FIREWALL };
> >> +/* keywords used to identify hipd / hipfw as target of hipconf command */
> >> +#define HIPCONF_HIPD_KEYWORD "daemon"
> >> +#define HIPCONF_HIPFW_KEYWORD "firewall"
> >
> > These appear unused outside of conf.c.
>
> Nope, using them in lib/core/message.c as well. Did you pull the latest revisions?

Of course not! I don't pull anything to review your work, why would I?
I just sit here and read emails. I should not have to care about you
committing new revisions somewhere I'm not looking.

> On Fri, Nov 4, 2011 at 1:29 PM, Diego Biurrun <email address hidden> wrote:
> > I said enough to reject it already, just added some more ;)
>
> Well, other than you being terribly suspicious of hipconf in general you did not say
> aynthing. And that's not very constructive. :p

I said there were unrelated stray changes - that's ground enough not to
commit it so I did not bother to look in detail at a version that will
not be pushed anyway ;)

Diego

[Miika Komu (miika-iki)]

Good work!

review: Approve

[Miika Komu (miika-iki)]

Sorry, I stumbled on a problem after hitting the Approve button. "hipconf daemon" is needed now for all existing commands, right? If yes, then this need to be properly adjusted in:

* doc/HOWTO.xml.in
* lib/core/conf.c
* lib/core/hostid.c
* lib/core/message.c
* lib/tool/nlink.c
* hipd/nat.c
* tools/hipdnsproxy/hipdnsproxy.in
* firewall/conntrack.c
* firewall/cache.c

Scan for "hipconf" in the files and adjust where appropiate.

review: Needs Fixing

[David Martin (martin-lp)]

Hi,

On Mon, Nov 7, 2011 at 3:33 PM, Miika Komu <email address hidden> wrote:
> Review: Needs Fixing
>
> Sorry, I stumbled on a problem after hitting the Approve button. "hipconf daemon" is needed now for all existing commands, right? If yes, then this need to be properly adjusted in:
>
> * doc/HOWTO.xml.in
> * lib/core/conf.c
> * lib/core/hostid.c
> * lib/core/message.c
> * lib/tool/nlink.c
> * hipd/nat.c
> * tools/hipdnsproxy/hipdnsproxy.in
> * firewall/conntrack.c
> * firewall/cache.c
>
> Scan for "hipconf" in the files and adjust where appropiate.

Good catch! Should've thought about grepping through the other files to find hipconf occurances. I would have missed the *.in for sure though.

Fixed this and will resubmit the proposal.

[David Martin (martin-lp)]

Sorry, seems like I oversaw a merge conflict. Will fix this and retransmit.

[Miika Komu (miika-iki)]

Let's make it final this time :)

review: Approve

[David Martin (martin-lp)]

Hey,

On Mon, Nov 7, 2011 at 6:08 PM, Miika Komu <email address hidden> wrote:

> Let's make it final this time :)

sorry, one more time at least. Maybe wait with your approval for Diego. I fear this is not yet over. ;)

[Diego Biurrun (diego-biurrun)]

 review needs-fixing

On Mon, Nov 07, 2011 at 05:15:33PM +0000, David Martin wrote:
> David Martin has proposed merging lp:~martin-lp/hipl/hipfwconf into lp:hipl.
>
> --- firewall/firewall_control.c 2011-10-25 21:14:16 +0000
> +++ firewall/firewall_control.c 2011-11-07 17:14:40 +0000
> @@ -38,10 +38,12 @@
>
> +#include "conntrack.h"
> #include "lib/core/builder.h"
> #include "lib/core/debug.h"
> #include "lib/core/ife.h"
> #include "lib/core/message.h"
> +#include "lib/core/prefix.h"
> #include "lib/core/protodefs.h"
> #include "cache.h"
> #include "firewall.h"

conntrack.h should come after cache.h.

> --- lib/core/conf.c 2011-11-03 09:21:12 +0000
> +++ lib/core/conf.c 2011-11-07 17:14:40 +0000
> @@ -226,6 +234,51 @@
>
> +const char *hipfwconf_usage =
> + HIPCONF_HIPFW_KEYWORD
> + " <command>\n\n"
> + "HIP firewall commands:\n"
> + "get ha <hit> | all\n";

I think this can be static.

> @@ -510,6 +563,25 @@
>
> /**
> + * Map daemon / firewall keyboard to its respective enum.

You are mapping a keyBOARD? Is that maybe a typo? :)

> @@ -2525,7 +2604,8 @@
>
> if (err) {
> - HIP_ERROR("(Check syntax for hipconf. Is hipd running or root privilege needed?)\n");
> + HIP_ERROR("(Check syntax for hipconf. Is hipd or hipfw running or root"
> + " privilege needed?)\n");

Maybe just say "daemon" instead of enumerating the 12345 programs that
will become part of HIPL over the next decade.

> --- lib/core/conf.h 2011-08-15 14:11:56 +0000
> +++ lib/core/conf.h 2011-11-07 17:14:40 +0000
> @@ -54,6 +54,11 @@
> #define ACTION_ADD 1
> #define ACTION_NEW 3
>
> +enum daemon_name { HIP_DAEMON, HIP_FIREWALL, UNKNOWN_KEYWORD };

This is still unused outside of conf.c.

Diego

review: Needs Fixing

[David Martin (martin-lp)]

Hi,

On Tue, Nov 8, 2011 at 9:47 AM, Diego Biurrun <email address hidden> wrote:
> review needs-fixing
>
> On Mon, Nov 07, 2011 at 05:15:33PM +0000, David Martin wrote:
>> David Martin has proposed merging lp:~martin-lp/hipl/hipfwconf into lp:hipl.
>>
>> --- firewall/firewall_control.c 2011-10-25 21:14:16 +0000
>> +++ firewall/firewall_control.c 2011-11-07 17:14:40 +0000
>> @@ -38,10 +38,12 @@
>>
>> +#include "conntrack.h"
>> #include "lib/core/builder.h"
>> #include "lib/core/debug.h"
>> #include "lib/core/ife.h"
>> #include "lib/core/message.h"
>> +#include "lib/core/prefix.h"
>> #include "lib/core/protodefs.h"
>> #include "cache.h"
>> #include "firewall.h"
>
> conntrack.h should come after cache.h.

fixed.

>> --- lib/core/conf.c 2011-11-03 09:21:12 +0000
>> +++ lib/core/conf.c 2011-11-07 17:14:40 +0000
>> @@ -226,6 +234,51 @@
>>
>> +const char *hipfwconf_usage =
>> + HIPCONF_HIPFW_KEYWORD
>> + " <command>\n\n"
>> + "HIP firewall commands:\n"
>> + "get ha <hit> | all\n";
>
> I think this can be static.

yup, fixed.

>> @@ -510,6 +563,25 @@
>>
>> /**
>> + * Map daemon / firewall keyboard to its respective enum.
>
> You are mapping a keyBOARD? Is that maybe a typo? :)

Heaven forbid! That does indeed seem to be a typo. ^^ Fixed.

>> @@ -2525,7 +2604,8 @@
>>
>> if (err) {
>> - HIP_ERROR("(Check syntax for hipconf. Is hipd running or root privilege needed?)\n");
>> + HIP_ERROR("(Check syntax for hipconf. Is hipd or hipfw running or root"
>> + " privilege needed?)\n");
>
> Maybe just say "daemon" instead of enumerating the 12345 programs that
> will become part of HIPL over the next decade.

You are right. Personally I find it a bit strange to call hipd the HIP daemon when they are all daemons. Whatever, fixed this as well.

>
>> --- lib/core/conf.h 2011-08-15 14:11:56 +0000
>> +++ lib/core/conf.h 2011-11-07 17:14:40 +0000
>> @@ -54,6 +54,11 @@
>> #define ACTION_ADD 1
>> #define ACTION_NEW 3
>>
>> +enum daemon_name { HIP_DAEMON, HIP_FIREWALL, UNKNOWN_KEYWORD };
>
> This is still unused outside of conf.c.

You are right. I made it static.

[René Hummen (rene-hummen)]

LGTM. You also obviously fixed Diego's comments and Miika was satisfied already with the last request. So go ahead and merge it.

review: Approve

[Diego Biurrun (diego-biurrun)]

 review needs-fixing

On Tue, Nov 08, 2011 at 03:41:03PM +0000, David Martin wrote:
>
> --- lib/core/conf.h 2011-08-15 14:11:56 +0000
> +++ lib/core/conf.h 2011-11-08 15:39:04 +0000
> @@ -54,6 +54,11 @@
>
> +enum daemon_name { HIP_DAEMON, HIP_FIREWALL, UNKNOWN_KEYWORD };

This is only used in conf.c, so it has no business in a header file.
Header files are for interface definitions *only*.
Should be in HACKING, if not we need to update it.

Diego

review: Needs Fixing

[Diego Biurrun (diego-biurrun)]

 review approve

On Tue, Nov 08, 2011 at 05:12:08PM +0000, David Martin wrote:
> David Martin has proposed merging lp:~martin-lp/hipl/hipfwconf into lp:hipl.
>
> --- lib/core/message.c 2011-10-25 21:44:47 +0000
> +++ lib/core/message.c 2011-11-08 17:09:18 +0000
> @@ -319,23 +330,30 @@
>
> -static int send_recv_daemon_info_internal(struct hip_common *msg,
> - int opt_socket)
> +static int send_recv_info_internal(struct hip_common *msg, int opt_socket, int port)

nit: This is now a long line.

Anyway, this looks good to me now, so go ahead and push :)

Diego

review: Approve

[David Martin (martin-lp)]

Hi,

On Tue, Nov 8, 2011 at 8:55 PM, Diego Biurrun <email address hidden> wrote:
> Review: Approve

> On Tue, Nov 08, 2011 at 05:12:08PM +0000, David Martin wrote:
>> David Martin has proposed merging lp:~martin-lp/hipl/hipfwconf into lp:hipl.
>>
>> --- lib/core/message.c 2011-10-25 21:44:47 +0000
>> +++ lib/core/message.c 2011-11-08 17:09:18 +0000
>> @@ -319,23 +330,30 @@
>>
>> -static int send_recv_daemon_info_internal(struct hip_common *msg,
>> - int opt_socket)
>> +g
>
> nit: This is now a long line.

I wonder whether if I had broken that line and it would have shown in the diff
you may have said it would have been ok to keep it in a single line.
Come on, it's 85 characters. That is not yet a long line. :p

> Anyway, this looks good to me now, so go ahead and push :)

Kk, merge is pushed in trunk revision 6121.

[Diego Biurrun (diego-biurrun)]

On Wed, Nov 09, 2011 at 04:01:33PM +0000, David Martin wrote:
> On Tue, Nov 8, 2011 at 8:55 PM, Diego Biurrun <email address hidden> wrote:
> > On Tue, Nov 08, 2011 at 05:12:08PM +0000, David Martin wrote:
> >> David Martin has proposed merging lp:~martin-lp/hipl/hipfwconf into lp:hipl.
> >>
> >> --- lib/core/message.c 2011-10-25 21:44:47 +0000
> >> +++ lib/core/message.c 2011-11-08 17:09:18 +0000
> >> @@ -319,23 +330,30 @@
> >>
> >> -static int send_recv_daemon_info_internal(struct hip_common *msg,
> >> - int opt_socket)
> >> +g
> >
> > nit: This is now a long line.
>
> I wonder whether if I had broken that line and it would have shown in the diff
> you may have said it would have been ok to keep it in a single line.
> Come on, it's 85 characters. That is not yet a long line. :p

Long lines are those that go over the 80 character mark.

Diego

=== modified file 'doc/HOWTO.xml.in'
--- doc/HOWTO.xml.in	2011-11-03 09:21:12 +0000
+++ doc/HOWTO.xml.in	2011-11-08 17:09:18 +0000
@@ -594,7 +594,7 @@
 
     <itemizedlist>
       <listitem><programlisting>Version of HIPL software. Ubuntu: dpkg -l 'hipl*'. Red Hat-based distros: rpm -qa | grep hipl</programlisting></listitem>
-      <listitem><programlisting>hipconf get ha all</programlisting></listitem>
+      <listitem><programlisting>hipconf daemon get ha all</programlisting></listitem>
       <listitem><programlisting>ip xfrm state</programlisting></listitem>
       <listitem><programlisting>uname -a</programlisting></listitem>
       <listitem><programlisting>lsb_release -a</programlisting></listitem>
@@ -658,7 +658,7 @@
 
     <para>To use access the servers using HIP behind a NAT box, you
           have two alternatives. Firstly, you enable the UDP
-          encapsulation using "hipconf nat plain-udp". See <xref
+          encapsulation using "hipconf daemon nat plain-udp". See <xref
           linkend="ch_hip_nat" /> for more information. Secondly,
           you can install miredo on your machine and make sure that HIP
           uses the IPv6 address of the server.</para>
@@ -674,7 +674,7 @@
     <title>Closing HIP Security Associations Manually</title>
     <para>
       You can use the hipconf tool to reset HIP SAs manually. Type
-      "hipconf rst all" to close all SAs.
+      "hipconf daemon rst all" to close all SAs.
     </para>
   </section>
 
@@ -761,10 +761,10 @@
       HIT_OF_XXX with the HIT of the host XXX. The hip daemon loads (and
       creates if necessary) the host identities from @sysconfdir@ automatically.
       If you want to know the default HIT of the localhost, run
-      "hipconf get hi default".
-      You can list all HITs of the machine with "hipconf get hi all". By
+      "hipconf daemon get hi default".
+      You can list all HITs of the machine with "hipconf daemon get hi all". By
       default, you'll see only one. If you want to use all four HITs of the
-      host, you have to invoke "hipconf add hi default". The use of multiple
+      host, you have to invoke "hipconf daemon add hi default". The use of multiple
       local HITs is not currently recommended!
     </para>
     <para>
@@ -773,7 +773,7 @@
       possible but not necessary:
     </para>
     <para>
-      hipconf add map PEER_HIT PEER_IP
+      hipconf daemon add map PEER_HIT PEER_IP
     </para>
     <para>
       You can also add the mapping to "@sysconfdir@/hipd_config" and restart hipd.
@@ -830,18 +830,18 @@
             more information messages with the daemons or capturing the network packets.</para>
             <para>The log messages displayed by the hip daemon can be changed dynamically:</para>
             <para>
-              hipconf debug none # &lt;only HIP_DIE and HIP_ASSERT messages are shown&gt;
+              hipconf daemon debug none # &lt;only HIP_DIE and HIP_ASSERT messages are shown&gt;
             </para>
             <para>
-              hipconf debug low # &lt;shows HIP_DIE, HIP_ASSERT and HIP_ERROR
+              hipconf daemon debug low # &lt;shows HIP_DIE, HIP_ASSERT and HIP_ERROR
               messages&gt;
             </para>
             <para>
-              hipconf debug medium # &lt;shows HIP_DIE, HIP_ASSERT, HIP_ERROR and
+              hipconf daemon debug medium # &lt;shows HIP_DIE, HIP_ASSERT, HIP_ERROR and
               HIP_INFO messages&gt;
             </para>
             <para>
-              hipconf debug all # &lt;shows all messages, including
+              hipconf daemon debug all # &lt;shows all messages, including
               HIP_DEBUG&gt;
             </para>
             <para>
@@ -882,14 +882,14 @@
               </para>
               </listitem>
               <listitem>
-                <para>Add the information with hipconf add map
+                <para>Add the information with hipconf daemon add map
                   <itemizedlist>
-                    <listitem><para>hipconf add map OOPS_HIT OOPS_IP [OOPS_LSI] </para></listitem>
+                    <listitem><para>hipconf daemon add map OOPS_HIT OOPS_IP [OOPS_LSI] </para></listitem>
                   </itemizedlist>
                 </para>
               </listitem>
             </itemizedlist>
-            <para>If the command hipconf add map is not executed, we must add the peer IP in
+            <para>If the command hipconf daemon add map is not executed, we must add the peer IP in
             the file /etc/hosts</para>
              <itemizedlist>
                     <listitem><para>OOPS_IP oops</para></listitem>
@@ -929,7 +929,7 @@
               <formalpara><title>Running the application</title><para></para></formalpara>
               <para>Once we have finished the step before and started running hipd and hipfw, we can
               run the application. If the LSI has been generated automatically, we can check its
-              value with hipconf get ha OOPS_HIT or hipconf get ha all.
+              value with hipconf daemon get ha OOPS_HIT or hipconf daemon get ha all.
               Afterwards, we start running the application, e.g.:
               </para>
               <itemizedlist>
@@ -989,7 +989,7 @@
     </itemizedlist>
     <para>
       You can also trigger the handover message exchange without
-      changing IP addresses by running "hipconf manual-update". Note that this
+      changing IP addresses by running "hipconf daemon manual-update". Note that this
       only simulates the message exchange that would normally occur on IP
       address changes and does not test handover detection.
     </para>
@@ -1056,9 +1056,9 @@
         /etc/hosts.
       </para>
       <para>
-        3b. Execute "hipconf add map PEER_HIT PEER_IP" and use the HIT directly
+        3b. Execute "hipconf daemon add map PEER_HIT PEER_IP" and use the HIT directly
         in the application. You can insert the
-        hipconf command also to @sysconfdir@/hipd_config and restart hipd.
+        hipconf command without daemon keyword also to @sysconfdir@/hipd_config and restart hipd.
       </para>
     </section>
 
@@ -1107,7 +1107,7 @@
         run at that time):
       </para>
       <para>
-        hipconf run normal|opp firefox
+        hipconf daemon run normal|opp firefox
       </para>
     </section>
     <section id="sec_sendmail">
@@ -1167,7 +1167,7 @@
   </programlisting>
   <para>
     The "HIT_OF_THE_CLIENT" should not be taken as literal. Replace it with the
-    actual HIT of the client (run "hipconf get ha default" at the client host).
+    actual HIT of the client (run "hipconf daemon get ha default" at the client host).
   </para>
   <para>
     It should be noticed that you can also specify the HIT_OF_CLIENT at the
@@ -1412,7 +1412,7 @@
   </programlisting>
   <para>
     Notice that &lt;hit-of-the-server&gt; should not be taken literally. Replace
-    it with the HIT of the server (run "hipconf get hi default" at the server).
+    it with the HIT of the server (run "hipconf daemon get hi default" at the server).
     If you want to use LSIs instead of HITs, you shouldn't use the -V option
     and use LSIs as instructed in <xref linkend="interop_ip_v4_v6" />.
   </para>
@@ -1624,15 +1624,15 @@
       </para>
 
     <para>
-      With "hipconf hit-to-ip on", the HIP daemon uses IP addresses of
+      With "hipconf daemon hit-to-ip on", the HIP daemon uses IP addresses of
       5.7.d.1.c.c.8.d.0.6.3.b.a.4.6.2.5.0.5.2.e.4.7.5.e.1.0.0.1.0.0.2.hit-to-ip.infrahip.net.
       to contact peer host with HIT 2001:1e:574e:2505:264a:b360:d8cc:1d75
     </para>
     <para>Default hit-to-ip.infrahip.net. suffix can be changed with
-      "hipconf hit-to-ip-set &lt;new.hit-to-ip.zone.&gt;. Please note it is independent from HIT_TO_IP_ZONE in @sysconfdir@/nsupdate.conf"
+      "hipconf daemon hit-to-ip-set &lt;new.hit-to-ip.zone.&gt;. Please note it is independent from HIT_TO_IP_ZONE in @sysconfdir@/nsupdate.conf"
     </para>
     <para>
-      With "hipconf nsupdate on", the HIP daemon also maintains
+      With "hipconf daemon nsupdate on", the HIP daemon also maintains
       records in hit-to-ip.infrahip.net. Once you start hipd, it will
       call nsupdate.pl with HIT and IP address for every HIT of your
       host. It is executed upon mobility events (i.e. address changes)
@@ -1799,7 +1799,7 @@
           the HIP daemon at the responder and use the "<emphasis>hipconf</emphasis>" tool from another
           shell at the responder to get the default hi:
           <programlisting>
-            hipconf get hi default
+            hipconf daemon get hi default
           </programlisting>
           Now, add this HIT in between the white list quotation marks in the
           configuration file of the RVS / HIP relay server:
@@ -1849,10 +1849,10 @@
                     otherwise modify the configuration file, you can reinitialize the server
                     without restarting the daemon itself using the "<emphasis>hipconf</emphasis>" tool:
                     <programlisting>
-                    hipconf reinit service rvs</programlisting>
+                    hipconf daemon reinit service rvs</programlisting>
                     or
                     <programlisting>
-                    hipconf reinit service relay</programlisting>
+                    hipconf daemon reinit service relay</programlisting>
                     The reinitialization does not have any effect on the existing
                     RVS / HIP relay server clients, but only affects clients registering
                     after the reinitialization.
@@ -1963,7 +1963,7 @@
                   that you would have in a normal base exchange execution not
                   involving an RVS. Please make sure that you use the same HIT
                   here as &lt;RESPONDER HIT&gt; as what the
-                  "<emphasis>hipconf get hi default</emphasis>"
+                  "<emphasis>hipconf daemon get hi default</emphasis>"
                   outputs at the responder.
                 </para>
               </listitem>
@@ -2012,14 +2012,14 @@
           </para></listitem>
           <listitem><para>
             At the rendezvous server, we have to indicate that we are willing to offer
-            rendezvous service:<programlisting>hipconf add service rvs</programlisting>
+            rendezvous service:<programlisting>hipconf daemon add service rvs</programlisting>
           </para></listitem>
           <listitem id="listitem_rvs"><para>
             At the responder, we have to register to the rendezvous server:
-            <programlisting>hipconf add server rvs [RVS-HIT] &lt;RVS-IP or hostname&gt; &lt;LIFETIME-IN-SECONDS&gt;</programlisting>
+            <programlisting>hipconf daemon add server rvs [RVS-HIT] &lt;RVS-IP or hostname&gt; &lt;LIFETIME-IN-SECONDS&gt;</programlisting>
             This will launch a base exchange i.e. establish a HIP SA between the
             rendezvous server and the responder. Please use the default HIT of
-            the rendezvous server ("<emphasis>hipconf get hi default</emphasis>" at the RVS).
+            the rendezvous server ("<emphasis>hipconf daemon get hi default</emphasis>" at the RVS).
             The &lt;LIFETIME-IN-SECONDS&gt; value represents the number of seconds
             we would like our service registration to last, but it is not
             necessarily the number of seconds we are granted the service.
@@ -2053,7 +2053,7 @@
                     To cancel the rendezvous service (without killing the HIP
                     daemon) type:
                     <programlisting>
-                      hipconf del service rvs
+                      hipconf daemon del service rvs
                     </programlisting>
                     This will delete all existing rendezvous server registrations
                     and remove the rendezvous service from the offered services.
@@ -2064,7 +2064,7 @@
                     To reinitialize the rendezvous service after modifications to
                     the configuration file (without killing the HIP daemon) type:
                     <programlisting>
-                      hipconf reinit service rvs
+                      hipconf daemon reinit service rvs
                     </programlisting>
                     The changes that you have made to the configuration file affect the
                     clients registering after the reinitialization.
@@ -2082,7 +2082,7 @@
                   <para>
                     To cancel the registration to the rendezvous service type:
                     <programlisting>
-                      hipconf del server rvs &lt;RVS-HIT&gt; &lt;RVS-IP&gt;
+                      hipconf daemon del server rvs &lt;RVS-HIT&gt; &lt;RVS-IP&gt;
                     </programlisting>
                     This will send a HIP message asking for rendezvous service
                     cancellation to the rendezvous server.
@@ -2237,17 +2237,17 @@
             At the relay server, we have to indicate that we are willing to offer
             relay service:
             <programlisting>
-              hipconf add service relay
+              hipconf daemon add service relay
             </programlisting>
           </para></listitem>
           <listitem><para>
             At the responder, we have to register to the relay server:
             <programlisting>
-              hipconf add server relay &lt;RELAY-HIT&gt; &lt;RELAY-IP&gt; &lt;LIFETIME-IN-SECONDS&gt;
+              hipconf daemon add server relay &lt;RELAY-HIT&gt; &lt;RELAY-IP&gt; &lt;LIFETIME-IN-SECONDS&gt;
             </programlisting>
             This will launch a base exchange i.e. establish a HIP SA between the
             relay server and the responder. Please use the default HIT of the
-            relay server ("<emphasis>hipconf get hi default</emphasis>" at
+            relay server ("<emphasis>hipconf daemon get hi default</emphasis>" at
             the relay server). The &lt;LIFETIME-IN-SECONDS&gt; value represents
             the number of seconds we would like our service registration to
             last, but it is not necessarily the number of seconds we are granted
@@ -2285,7 +2285,7 @@
                     To cancel the relay service (without killing the HIP daemon)
                     type:
                     <programlisting>
-                      hipconf del service relay
+                      hipconf daemon del service relay
                     </programlisting>
                     This will delete all existing relay server registrations
                     and remove the relay service from the offered services.
@@ -2296,7 +2296,7 @@
                     To reinitialize the relay service after modifications to
                     the configuration file (without killing the HIP daemon) type:
                     <programlisting>
-                      hipconf reinit service relay
+                      hipconf daemon reinit service relay
                     </programlisting>
                     The changes that you have made to the configuration file affect the
                     clients registering after the reinitialization.
@@ -2314,7 +2314,7 @@
                   <para>
                     To cancel the registration to the relay service type:
                     <programlisting>
-                      hipconf del server relay &lt;RELAY-HIT&gt; &lt;RELAY-IP&gt;
+                      hipconf daemon del server relay &lt;RELAY-HIT&gt; &lt;RELAY-IP&gt;
                     </programlisting>
                     This will send a HIP message asking for relay service
                     cancellation to the relay server.
@@ -2494,7 +2494,7 @@
                   example, to request a service identified by number 1 (the
                   rendezvous service), you can type
                   <programlisting>
-                    hipconf add server 1 &lt;SERVER-HIT&gt; &lt;SERVER-IP&gt; &lt;LIFETIME-IN-SECONDS&gt;
+                    hipconf daemon add server 1 &lt;SERVER-HIT&gt; &lt;SERVER-IP&gt; &lt;LIFETIME-IN-SECONDS&gt;
                   </programlisting>
                   Notice, however, that if the server does not support the
                   service you have requested, a request is never sent.
@@ -2506,7 +2506,7 @@
                   can chain the service types. For example, to request services
                   identified by registration types 3, 10 and 245 you can type:
                   <programlisting>
-                    hipconf add server 3 10 245 &lt;SERVER-HIT&gt; &lt;SERVER-IP&gt; &lt;LIFETIME-IN-SECONDS&gt;
+                    hipconf daemon add server 3 10 245 &lt;SERVER-HIT&gt; &lt;SERVER-IP&gt; &lt;LIFETIME-IN-SECONDS&gt;
                   </programlisting>
                   Using this chaining method one can request up to ten
                   services with one REG_REQUEST parameter.
@@ -2518,7 +2518,7 @@
                   request you can chain the service types as with
                   registration.
                   <programlisting>
-                    hipconf del server 3 10 245 &lt;SERVER-HIT&gt; &lt;SERVER-IP&gt;
+                    hipconf daemon del server 3 10 245 &lt;SERVER-HIT&gt; &lt;SERVER-IP&gt;
                   </programlisting>
                   Using this chaining method one can request up to ten
                   service cancellations with one REG_REQUEST parameter.
@@ -2696,7 +2696,7 @@
       </para>
       <para>The NAT traversal can be experimented in a similar way as depicted
         in earlier sections. The only difference is that you have to tell the
-        initiator manually that it is behind a NAT using "hipconf nat on".
+        initiator manually that it is behind a NAT using "hipconf daemon nat on".
         After this, you can initiate the base exchange
         according to the previous instructions. The manual configuration is
         currently required because support for automatic NAT detection (STUN)
@@ -2709,10 +2709,10 @@
       </para>
       <itemizedlist>
         <listitem><para>
-            hipconf nat plain-udp
+            hipconf daemon nat plain-udp
         </para>    </listitem>
         <listitem><para>
-            hipconf add map peer_hit peer_ipv4_addr
+            hipconf daemon add map peer_hit peer_ipv4_addr
         </para> </listitem>
         <listitem><para>
             ping6 -I source_hit dst_hit
@@ -2735,7 +2735,7 @@
         by installing the Miredo client software. Then, establish HIP connections
         to Teredo addresses (check ifconfig teredo) at the client side as
         instructed in <xref linkend="ch_basictest" />. As Teredo is a NAT traversal
-        solution by itself, you don't have use UDP encapsulation for HIP (hipconf nat none).
+        solution by itself, you don't have use UDP encapsulation for HIP (hipconf daemon nat none).
       </para>
       <para>
         See
@@ -2770,7 +2770,7 @@
       relays HIP control and ESP data traffic. You can use one the InfraHIP servers
       or set up your own as instructed in <xref linkend="ch_rvs_relay"
       />. Both Initiator and Responder must be configured with
-      "hipconf nat ice-udp".  Then Initiator must run the base exchange through the
+      "hipconf daemon nat ice-udp".  Then Initiator must run the base exchange through the
       relay server.
     </para>
 
@@ -2816,12 +2816,12 @@
 
 <para>
 <programlisting>
-hipconf shotgun on
+hipconf daemon shotgun on
 </programlisting>
 </para>
 
     <para>The same line can be also included in @sysconfdir@/hipd_config
-          without the "hipconf" prefix.
+          without the "hipconf daemon" prefix.
     </para>
 
     <para>At the time of writing this, the shotgun extension did not yet
 
=== modified file 'firewall/cache.c'
--- firewall/cache.c	2011-10-25 21:14:16 +0000
+++ firewall/cache.c	2011-11-08 17:09:18 +0000
@@ -281,7 +281,7 @@
         }
     }
 
-    /* Note: this function is also reached by "hipconf rst all"
+    /* Note: this function is also reached by "hipconf daemon rst all"
      * so we don't want to uninitialize hash table here. Instead,
      * we handle it in firewall_exit(). */
 
 
=== modified file 'firewall/conntrack.c'
--- firewall/conntrack.c	2011-10-25 21:14:16 +0000
+++ firewall/conntrack.c	2011-11-08 17:09:18 +0000
@@ -910,7 +910,7 @@
  * Relay to pass e.g.  p2p-unfriendly NAT boxes. The ESP relay mode
  * assumes that the HIP relay (in hipd) and ESP relay (in hipfw) are
  * running on the same middlehost in a public network. The responder
- * has to register to the relay with "hipconf add server full-relay"
+ * has to register to the relay with "hipconf daemon add server full-relay"
  * which operates as defined in <a
  * href="http://tools.ietf.org/html/draft-ietf-hip-nat-traversal"> NAT
  * traversal for HIP</a>. Then the initiator can contact the responder
@@ -2244,3 +2244,56 @@
         remove_connection(conn_list->data);
     }
 }
+
+/**
+ * Prepare given message with host association info from the tracked connections.
+ *
+ * @param msg The message where the info is written.
+ * @return  0 on success
+ *         -1 on error
+ */
+int hip_fw_handle_get_ha_info(struct hip_common *msg)
+{
+    struct hip_hadb_user_info_state hid = { { { { 0 } } } };
+    struct slist                   *iter_conn;
+    struct connection              *conn;
+    struct hip_data                *data;
+
+    if (!msg) {
+        HIP_ERROR("Missing message parameter.\n");
+        return -1;
+    }
+
+    if (conn_list == NULL) {
+        HIP_DEBUG("No tracked connections to return.\n");
+        return 0;
+    }
+
+    hip_msg_init(msg);
+    if (hip_build_user_hdr(msg, HIP_MSG_GET_HA_INFO, 0) < 0) {
+        HIP_ERROR("Failed to build GET_HA_INFO message header.\n");
+        return -1;
+    }
+
+    iter_conn = conn_list;
+    while (iter_conn) {
+        conn = iter_conn->data;
+        data = conn->original.hip_tuple->data;
+
+        // build HA_INFO with info from connection initiator
+        hid.state = conn->state;
+        ipv6_addr_copy(&hid.hit_our, &data->src_hit);
+        ipv6_addr_copy(&hid.hit_peer, &data->dst_hit);
+        hid.nat_udp_port_local = conn->original.src_port;
+        hid.nat_udp_port_peer  = conn->original.dst_port;
+
+        if (hip_build_param_contents(msg, &hid, HIP_PARAM_HA_INFO, sizeof(hid)) < 0) {
+            HIP_ERROR("Failed to build initiator HA_INFO parameter.\n");
+            return -1;
+        }
+
+        iter_conn = iter_conn->next;
+    }
+
+    return 0;
+}
 
=== modified file 'firewall/conntrack.h'
--- firewall/conntrack.h	2011-07-18 16:31:37 +0000
+++ firewall/conntrack.h	2011-11-08 17:09:18 +0000
@@ -63,4 +63,6 @@
 void hip_fw_conntrack_periodic_cleanup(void);
 void hip_fw_uninit_conntrack(void);
 
+int hip_fw_handle_get_ha_info(struct hip_common *msg);
+
 #endif /* HIP_FIREWALL_CONNTRACK_H */
 
=== modified file 'firewall/firewall.c'
--- firewall/firewall.c	2011-10-30 11:41:51 +0000
+++ firewall/firewall.c	2011-11-08 17:09:18 +0000
@@ -1672,7 +1672,7 @@
     n    = recvfrom(hip_fw_async_sock, msg, sizeof(struct hip_common),
                     MSG_PEEK, (struct sockaddr *) &sock_addr, &alen);
     if (n < 0) {
-        HIP_ERROR("Error receiving message header from daemon.\n");
+        HIP_ERROR("Error receiving message header.\n");
         return -1;
     }
 
@@ -1701,24 +1701,13 @@
                  (struct sockaddr *) &sock_addr, &alen);
 
     if (n < 0) {
-        HIP_ERROR("Error receiving message parameters from daemon.\n");
+        HIP_ERROR("Error receiving message parameters.\n");
         return -1;
     }
 
     HIP_ASSERT(n == len);
 
-    if (ntohs(sock_addr.sin6_port) != HIP_DAEMON_LOCAL_PORT) {
-        int type = hip_get_msg_type(msg);
-        if (type == HIP_MSG_FW_BEX_DONE) {
-            HIP_DEBUG("HIP_MSG_FW_BEX_DONE\n");
-            HIP_DEBUG("%d == %d\n", ntohs(sock_addr.sin6_port),
-                      HIP_DAEMON_LOCAL_PORT);
-        }
-        HIP_DEBUG("Drop, message not from hipd\n");
-        return -1;
-    }
-
-    if (hip_handle_msg(msg) < 0) {
+    if (hip_handle_msg(msg, (struct sockaddr *) &sock_addr) < 0) {
         HIP_ERROR("Error handling message\n");
         return -1;
     }
@@ -1847,8 +1836,6 @@
     sock_addr.sin6_addr   = in6addr_loopback;
     HIP_IFEL(bind(hip_fw_async_sock, (struct sockaddr *) &sock_addr, sizeof(sock_addr)), -1,
              "Bind on firewall socket addr failed. Give -k option to kill old hipfw\n");
-    HIP_IFEL(hip_daemon_connect(hip_fw_async_sock), -1,
-             "connecting socket failed\n");
 
     /* Starting hipfw does not always work when hipfw starts first -miika */
     if (hip_userspace_ipsec || hip_lsi_support) {
@@ -1944,7 +1931,7 @@
         }
 
         if (FD_ISSET(hip_fw_async_sock, &read_fdset)) {
-            HIP_DEBUG("****** Received HIPD message ******\n");
+            HIP_DEBUG("****** Received user message ******\n");
             err = fw_handle_hipd_message(msg);
         }
 
@@ -2009,3 +1996,31 @@
 
     return &default_lsi;
 }
+
+/**
+ * Send a message via the firewall socket for asynchronous messages.
+ * Caller is responsible for setting up the message.
+ *
+ * @param msg  The message to be sent.
+ * @param addr The destination address.
+ *
+ * @return  0 on success
+ *         -1 on error
+ */
+int hip_fw_send_message(const struct hip_common *const msg,
+                        const struct sockaddr *const addr)
+{
+    uint16_t len;
+
+    if (msg == NULL || addr == NULL) {
+        HIP_ERROR("Empty message or address.\n");
+        return -1;
+    }
+
+    len = hip_get_msg_total_len(msg);
+    if (sendto(hip_fw_async_sock, msg, len, 0, addr, hip_sockaddr_len(addr)) != len) {
+        return -1;
+    }
+
+    return 0;
+}
 
=== modified file 'firewall/firewall.h'
--- firewall/firewall.h	2011-04-05 16:44:22 +0000
+++ firewall/firewall.h	2011-11-08 17:09:18 +0000
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2010 Aalto University and RWTH Aachen University.
+ * Copyright (c) 2010-2011 Aalto University and RWTH Aachen University.
  *
  * Permission is hereby granted, free of charge, to any person
  * obtaining a copy of this software and associated documentation
@@ -55,5 +55,7 @@
 void hip_fw_uninit_esp_relay(void);
 hip_hit_t *hip_fw_get_default_hit(void);
 hip_lsi_t *hip_fw_get_default_lsi(void);
+int hip_fw_send_message(const struct hip_common *const msg,
+                        const struct sockaddr *const addr);
 
 #endif /* HIP_FIREWALL_FIREWALL_H */
 
=== modified file 'firewall/firewall_control.c'
--- firewall/firewall_control.c	2011-10-25 21:14:16 +0000
+++ firewall/firewall_control.c	2011-11-08 17:09:18 +0000
@@ -42,8 +42,10 @@
 #include "lib/core/debug.h"
 #include "lib/core/ife.h"
 #include "lib/core/message.h"
+#include "lib/core/prefix.h"
 #include "lib/core/protodefs.h"
 #include "cache.h"
+#include "conntrack.h"
 #include "firewall.h"
 #include "user_ipsec_fw_msg.h"
 #include "user_ipsec_sadb.h"
@@ -91,12 +93,13 @@
 }
 
 /**
- * distribute a message from hipd to the respective extension handler
+ * distribute a user message to the respective extension handler
  *
- * @param   msg pointer to the received user message
+ * @param   msg  pointer to the received user message
+ * @param   addr destination address for a reply
  * @return  0 on success, else -1
  */
-int hip_handle_msg(struct hip_common *msg)
+int hip_handle_msg(struct hip_common *msg, struct sockaddr *addr)
 {
     int                type, err = 0;
     struct hip_common *msg_out = NULL;
@@ -150,12 +153,36 @@
         HIP_IFEL(hip_send_recv_daemon_info(msg_out, 1, hip_fw_sock), -1,
                  "Couldn't notify daemon of firewall presence\n");
         break;
+    case HIP_MSG_GET_HA_INFO:
+        HIP_IFEL(hip_fw_handle_get_ha_info(msg), -1,
+                 "Could not handle GET_HA message.\n");
+        HIP_IFEL(hip_fw_send_message(msg, addr), -1,
+                 "Could not send HA reply.\n");
+        break;
     default:
         HIP_ERROR("Unhandled message type %d\n", type);
         err = -1;
         break;
     }
+
 out_err:
+    if (hip_get_msg_response(msg)) {
+        HIP_DEBUG("Send response\n");
+        if (err) {
+            hip_hdr msg_type = hip_get_msg_type(msg);
+            hip_msg_init(msg);
+            hip_build_user_hdr(msg, msg_type, 0);
+            hip_set_msg_err(msg, 1);
+        }
+        HIP_DEBUG("Sending message (type=%d) response\n",
+                  hip_get_msg_type(msg));
+        if (hip_fw_send_message(msg, addr) == -1) {
+            err = -1;
+        } else {
+            HIP_DEBUG("Response sent ok\n");
+        }
+    }
+
     free(msg_out);
     return err;
 }
 
=== modified file 'firewall/firewall_control.h'
--- firewall/firewall_control.h	2010-10-15 15:29:14 +0000
+++ firewall/firewall_control.h	2011-11-08 17:09:18 +0000
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2010 Aalto University and RWTH Aachen University.
+ * Copyright (c) 2010-2011 Aalto University and RWTH Aachen University.
  *
  * Permission is hereby granted, free of charge, to any person
  * obtaining a copy of this software and associated documentation
@@ -28,6 +28,6 @@
 
 #include "lib/core/protodefs.h"
 
-int hip_handle_msg(struct hip_common *msg);
+int hip_handle_msg(struct hip_common *msg, struct sockaddr *addr);
 
 #endif /* HIP_FIREWALL_FIREWALL_CONTROL_H */
 
=== modified file 'hipd/init.c'
--- hipd/init.c	2011-11-03 09:21:12 +0000
+++ hipd/init.c	2011-11-08 17:09:18 +0000
@@ -164,7 +164,7 @@
 }
 
 #define HIPL_CONFIG_FILE_EX \
-    "# Format of this file is as with hipconf, but without hipconf prefix\n\
+    "# Format of this file is as with hipconf, but without \"hipconf daemon\" prefix\n\
 # add hi default    # add all four HITs (see bug id 592127)\n\
 # add map HIT IP    # preload some HIT-to-IP mappings to hipd\n\
 # add service rvs   # the host acts as HIP rendezvous (see also HIPL_SYSCONFDIR/relay_config)\n\
@@ -549,7 +549,7 @@
     /* Three steps because multiple large keys will not fit in the same message */
 
     /* DSA keys and RSA anonymous are not loaded by default until bug id
-     * 592127 is properly solved. Run hipconf add hi default if you want to
+     * 592127 is properly solved. Run hipconf daemon add hi default if you want to
      * enable non-default HITs. */
 
     /* rsa pub */
 
=== modified file 'hipd/nat.c'
--- hipd/nat.c	2011-10-25 21:14:16 +0000
+++ hipd/nat.c	2011-11-08 17:09:18 +0000
@@ -209,7 +209,7 @@
  *
  * @return zero on success, or negative error value on error.
  * @todo   Extend this to handle peer_hit case for
- *         <code>"hipconf hip nat peer_hit"</code> This would be helpful in
+ *         <code>"hipconf daemon hip nat peer_hit"</code> This would be helpful in
  *         multihoming case.
  */
 int hip_user_nat_mode(int nat_mode)
 
=== modified file 'hipd/registration.c'
--- hipd/registration.c	2011-10-25 21:44:47 +0000
+++ hipd/registration.c	2011-11-08 17:09:18 +0000
@@ -1574,7 +1574,7 @@
     }
 
     /* Workaround for registration when a mapping already pre-exists
-     * (inserted e.g. with "hipconf add map"). This can be removed
+     * (inserted e.g. with "hipconf daemon add map"). This can be removed
      * after bug id 592135 is resolved. */
     if (entry->state != HIP_STATE_NONE || HIP_STATE_UNASSOCIATED) {
         struct hip_common *msg2 = calloc(HIP_MAX_PACKET, 1);
 
=== modified file 'lib/core/conf.c'
--- lib/core/conf.c	2011-11-08 14:19:35 +0000
+++ lib/core/conf.c	2011-11-08 17:09:18 +0000
@@ -77,9 +77,9 @@
 
 /**
  * hipconf tool actions. These are numerical values for the first commandline
- * argument. For example in "tools/hipconf get hi default" -command "get"
- * is the action. If you want a new action named as 'NEWACT', define a
- * constant variable which has value between 0 and ACTION_MAX.
+ * argument. For example in "tools/hipconf daemon get hi default"
+ * -command "get" is the action. If you want a new action named as 'NEWACT',
+ * define a constant variable which has value between 0 and ACTION_MAX.
  * Probably you also need to increase the value of ACTION_MAX.
  * @see conf_get_action()
  */
@@ -181,6 +181,11 @@
 /* #define TYPE_RELAY         22 */
 
 /**
+ * The daemon process to be configured by the conf command.
+ */
+static enum daemon_name { HIP_DAEMON, HIP_FIREWALL, UNKNOWN_KEYWORD } daemon_name;
+
+/**
  * A help string containing the usage of @c hipconf and also
  * @c HIPL_SYSCONFDIR/hipd_config.
  *
@@ -188,6 +193,9 @@
  *       for the action.
  */
 static const char *hipconf_usage =
+    HIPCONF_HIPD_KEYWORD
+    " <command>\n\n"
+    "HIP daemon commands:\n"
     "add map <hit> <ip> [lsi]\n"
     "get map <hit | lsi>\n"
     "del hi <hit> | all\n"
@@ -226,6 +234,51 @@
 ;
 
 /**
+ * A help string containing the usage of @c hipfwconf.
+ *
+ * @note If you added a new action, do not forget to add a brief usage below
+ *       for the action.
+ */
+static const char *hipfwconf_usage =
+    HIPCONF_HIPFW_KEYWORD
+    " <command>\n\n"
+    "HIP firewall commands:\n"
+    "get ha <hit> | all\n";
+
+/**
+ * Send a message to hipd or hipfw and optionally receive an answer.
+ *
+ * @param msg       The message to be sent. The respective answer will be stored
+ *                  here as well.
+ * @param send_only 1 if no response from hipd should be requested.
+ *                  0 if it should block until a response from hipd is received.
+ *                  This option has no effect when sending messages to hipfw.
+ *
+ * @return  0 on success
+ *         -1 on error
+ */
+static int send_receive_message(struct hip_common *msg,
+                                const int send_only)
+{
+    if (daemon_name == HIP_DAEMON) {
+        if (hip_send_recv_daemon_info(msg, send_only, 0)) {
+            HIP_ERROR("Failed to send user message to the HIP daemon.\n");
+            return -1;
+        }
+    } else if (daemon_name == HIP_FIREWALL) {
+        if (hip_send_recv_firewall_info(msg)) {
+            HIP_ERROR("Failed to send user message to the HIP firewall.\n");
+            return -1;
+        }
+    } else {
+        HIP_ERROR("Destination daemon process unknown.\n");
+        return -1;
+    }
+
+    return 0;
+}
+
+/**
  * Query hipd for the HITs of the local host
  *
  * @param msg input/output message for the query/response for hipd
@@ -510,6 +563,25 @@
 /* Non-static functions -> global scope */
 
 /**
+ * Map daemon / firewall keyword to its respective enum.
+ *
+ * @param argv an array of strings (command line args to hipconf)
+ * @return HIP_DAEMON in case of hipd keyword
+ *         HIP_FIREWALL in case of hipfw keyword
+ *         UNKNOWN_KEYWORD else
+ */
+static enum daemon_name conf_get_process(const char *const argv[])
+{
+    if (!strcmp(HIPCONF_HIPD_KEYWORD, argv[1])) {
+        return HIP_DAEMON;
+    } else if (!strcmp(HIPCONF_HIPFW_KEYWORD, argv[1])) {
+        return HIP_FIREWALL;
+    }
+
+    return UNKNOWN_KEYWORD;
+}
+
+/**
  * Map a symbolic hipconf action (=add/del) into a number
  *
  * @param argv an array of strings (command line args to hipconf)
@@ -526,61 +598,61 @@
 {
     int ret = -1;
 
-    if (!strcmp("add", argv[1])) {
+    if (!strcmp("add", argv[2])) {
         ret = ACTION_ADD;
-    } else if (!strcmp("del", argv[1])) {
+    } else if (!strcmp("del", argv[2])) {
         ret = ACTION_DEL;
-    } else if (!strcmp("new", argv[1])) {
+    } else if (!strcmp("new", argv[2])) {
         ret = ACTION_NEW;
-    } else if (!strcmp("get", argv[1])) {
+    } else if (!strcmp("get", argv[2])) {
         ret = ACTION_GET;
-    } else if (!strcmp("set", argv[1])) {
+    } else if (!strcmp("set", argv[2])) {
         ret = ACTION_SET;
-    } else if (!strcmp("inc", argv[1])) {
+    } else if (!strcmp("inc", argv[2])) {
         ret = ACTION_INC;
-    } else if (!strcmp("dec", argv[1])) {
+    } else if (!strcmp("dec", argv[2])) {
         ret = ACTION_DEC;
-    } else if (!strcmp("rst", argv[1])) {
+    } else if (!strcmp("rst", argv[2])) {
         ret = ACTION_RST;
-    } else if (!strcmp("run", argv[1])) {
+    } else if (!strcmp("run", argv[2])) {
         ret = ACTION_RUN;
-    } else if (!strcmp("load", argv[1])) {
+    } else if (!strcmp("load", argv[2])) {
         ret = ACTION_LOAD;
-    } else if (!strcmp("heartbeat", argv[1])) {
+    } else if (!strcmp("heartbeat", argv[2])) {
         ret = ACTION_HEARTBEAT;
-    } else if (!strcmp("locator", argv[1])) {
+    } else if (!strcmp("locator", argv[2])) {
         ret = ACTION_LOCATOR;
-    } else if (!strcmp("debug", argv[1])) {
+    } else if (!strcmp("debug", argv[2])) {
         ret = ACTION_DEBUG;
-    } else if (!strcmp("transform", argv[1])) {
+    } else if (!strcmp("transform", argv[2])) {
         ret = ACTION_TRANSORDER;
-    } else if (!strcmp("reinit", argv[1])) {
+    } else if (!strcmp("reinit", argv[2])) {
         ret = ACTION_REINIT;
-    } else if (!strcmp("manual-update", argv[1])) {
+    } else if (!strcmp("manual-update", argv[2])) {
         ret = ACTION_MANUAL_UPDATE;
-    } else if (!strcmp("hit-to-lsi", argv[1])) {
+    } else if (!strcmp("hit-to-lsi", argv[2])) {
         ret = ACTION_HIT_TO_LSI;
-    } else if (!strcmp("nsupdate", argv[1])) {
+    } else if (!strcmp("nsupdate", argv[2])) {
         ret = ACTION_NSUPDATE;
-    } else if (!strcmp("hit-to-ip-set", argv[1])) {
+    } else if (!strcmp("hit-to-ip-set", argv[2])) {
         ret = ACTION_HIT_TO_IP_SET;
-    } else if (!strcmp("hit-to-ip", argv[1])) {
+    } else if (!strcmp("hit-to-ip", argv[2])) {
         ret = ACTION_HIT_TO_IP;
-    } else if (!strcmp("shotgun", argv[1])) {
+    } else if (!strcmp("shotgun", argv[2])) {
         ret = ACTION_SHOTGUN;
-    } else if (!strcmp("lsi-to-hit", argv[1])) {
+    } else if (!strcmp("lsi-to-hit", argv[2])) {
         ret = ACTION_LSI_TO_HIT;
-    } else if (!strcmp("nat", argv[1])) {
-        if (!strcmp("port", argv[2])) {
-            if (!strcmp("local", argv[3])) {
+    } else if (!strcmp("nat", argv[2])) {
+        if (!strcmp("port", argv[3])) {
+            if (!strcmp("local", argv[4])) {
                 ret = ACTION_NAT_LOCAL_PORT;
-            } else if (!strcmp("peer", argv[3])) {
+            } else if (!strcmp("peer", argv[4])) {
                 ret = ACTION_NAT_PEER_PORT;
             }
         } else {
             ret = ACTION_NAT;
         }
-    } else if (!strcmp("broadcast", argv[1])) {
+    } else if (!strcmp("broadcast", argv[2])) {
         ret = ACTION_BROADCAST;
     }
 
@@ -670,45 +742,45 @@
         ret = TYPE_HA;
     } else if (!strcmp("shotgun", text)) {
         ret = TYPE_SHOTGUN;
-    } else if ((!strcmp("all", text)) && (strcmp("rst", argv[1]) == 0)) {
-        ret = TYPE_RST;
-    } else if ((!strcmp("peer_hit", text)) && (strcmp("rst", argv[1]) == 0)) {
-        ret = TYPE_RST;
-    } else if (strcmp("nat", argv[1]) == 0) {
-        if (argv[2] && strcmp("port", argv[2]) == 0) {
-            if (argv[3] && strcmp("local", argv[3]) == 0) {
+    } else if ((!strcmp("all", text)) && (strcmp("rst", argv[2]) == 0)) {
+        ret = TYPE_RST;
+    } else if ((!strcmp("peer_hit", text)) && (strcmp("rst", argv[2]) == 0)) {
+        ret = TYPE_RST;
+    } else if (strcmp("nat", argv[2]) == 0) {
+        if (argv[3] && strcmp("port", argv[3]) == 0) {
+            if (argv[4] && strcmp("local", argv[4]) == 0) {
                 ret = TYPE_NAT_LOCAL_PORT;
-            } else if (argv[3] && strcmp("peer", argv[3]) == 0) {
+            } else if (argv[4] && strcmp("peer", argv[4]) == 0) {
                 ret = TYPE_NAT_PEER_PORT;
             }
         } else {
             ret = TYPE_NAT;
         }
-    } else if (strcmp("locator", argv[1]) == 0) {
+    } else if (strcmp("locator", argv[2]) == 0) {
         ret = TYPE_LOCATOR;
     } else if (!strcmp("debug", text)) {
         ret = TYPE_DEBUG;
     } else if (!strcmp("order", text)) {
         ret = TYPE_ORDER;
-    } else if (strcmp("heartbeat", argv[1]) == 0) {
+    } else if (strcmp("heartbeat", argv[2]) == 0) {
         ret = TYPE_HEARTBEAT;
     } else if (!strcmp("ttl", text)) {
         ret = TYPE_TTL;
     } else if (!strcmp("config", text)) {
         ret = TYPE_CONFIG;
-    } else if (strcmp("manual-update", argv[1]) == 0) {
+    } else if (strcmp("manual-update", argv[2]) == 0) {
         ret = TYPE_MANUAL_UPDATE;
-    } else if (strcmp("hit-to-lsi", argv[1]) == 0) {
+    } else if (strcmp("hit-to-lsi", argv[2]) == 0) {
         ret = TYPE_HIT_TO_LSI;
-    } else if (strcmp("nsupdate", argv[1]) == 0) {
+    } else if (strcmp("nsupdate", argv[2]) == 0) {
         ret = TYPE_NSUPDATE;
-    } else if (strcmp("hit-to-ip-set", argv[1]) == 0) {
+    } else if (strcmp("hit-to-ip-set", argv[2]) == 0) {
         ret = TYPE_HIT_TO_IP_SET;
-    } else if (strcmp("hit-to-ip", argv[1]) == 0) {
+    } else if (strcmp("hit-to-ip", argv[2]) == 0) {
         ret = TYPE_HIT_TO_IP;
-    } else if (strcmp("lsi-to-hit", argv[1]) == 0) {
+    } else if (strcmp("lsi-to-hit", argv[2]) == 0) {
         ret = TYPE_LSI_TO_HIT;
-    } else if (strcmp("broadcast", argv[1]) == 0) {
+    } else if (strcmp("broadcast", argv[2]) == 0) {
         ret = TYPE_BROADCAST;
     } else {
         HIP_DEBUG("ERROR: NO MATCHES FOUND \n");
@@ -725,7 +797,7 @@
  *       here in the switch(action) block.
  * @param action integer value for an action
  * @return an index for argv[], which indicates the type argument.
- *         Usually either 1 or 2.
+ *         Usually either 2 or 3.
  */
 static int conf_get_type_arg(int action)
 {
@@ -753,15 +825,15 @@
     case ACTION_HIT_TO_IP:
     case ACTION_HIT_TO_IP_SET:
     case ACTION_BROADCAST:
+        type_arg = 3;
+        break;
+    case ACTION_MANUAL_UPDATE:
+    case ACTION_HIT_TO_LSI:
+    case ACTION_LSI_TO_HIT:
+    case ACTION_DEBUG:
+    case ACTION_SHOTGUN:
         type_arg = 2;
         break;
-    case ACTION_MANUAL_UPDATE:
-    case ACTION_HIT_TO_LSI:
-    case ACTION_LSI_TO_HIT:
-    case ACTION_DEBUG:
-    case ACTION_SHOTGUN:
-        type_arg = 1;
-        break;
     default:
         break;
     }
@@ -816,9 +888,9 @@
  * Handles the hipconf commands where the type is @c server. Creates a user
  * message from the function parameters @c msg, @c action and @c opt[]. The
  * command line that this function parses is of type:
- * <code>tools/hipconf <b>add</b> server &lt;SERVICES&gt; &lt;SERVER HIT&gt;
+ * <code>tools/hipconf daemon <b>add</b> server &lt;SERVICES&gt; &lt;SERVER HIT&gt;
  * &lt;SERVER IP ADDRESS&gt; &lt;LIFETIME&gt;</code> or
- * <code>tools/hipconf <b>del</b> server &lt;SERVICES&gt; &lt;SERVER HIT&gt;
+ * <code>tools/hipconf daemon <b>del</b> server &lt;SERVICES&gt; &lt;SERVER HIT&gt;
  * &lt;SERVER IP ADDRESS&gt;</code>, where <code>&lt;SERVICES&gt;</code> is a list of
  * the services to which we want to register or cancel or registration. The
  * list can consist of any number of the strings @c rvs, @c relay,
@@ -1999,9 +2071,9 @@
 }
 
 /**
- * Handle e.g. "hipconf run normal firefox". Enables HIP support
- * for the given application using LD_PRELOAD. This means that
- * all getaddrinfo() calls go through the modified libinet6 library.
+ * Handle e.g. "hipconf daemon run normal firefox".
+ * Enables HIP support for the given application using LD_PRELOAD. This means
+ * that all getaddrinfo() calls go through the modified libinet6 library.
  * This function is depracated.
  *
  * @param msg input/output message for the query/response for hipd
@@ -2045,10 +2117,10 @@
     HIP_IFEL(optc > 1, -1, "Too many arguments\n");
 
     HIP_IFEL(hip_build_user_hdr(msg, HIP_MSG_GET_HA_INFO, 0), -1,
-             "Building of daemon header failed\n");
+             "Building of user msg header failed\n");
 
-    HIP_IFEL(hip_send_recv_daemon_info(msg, send_only, 0), -1,
-             "send recv daemon info\n");
+    HIP_IFEL(send_receive_message(msg, send_only), -1,
+             "send recv info\n");
 
     while ((current_param = hip_get_next_param(msg, current_param))) {
         ha = hip_get_param_contents_direct(current_param);
@@ -2316,8 +2388,9 @@
             *comment = '\0';
         }
 
-        /* prefix the contents of the line with" hipconf"  */
-        res_len = sprintf(str, "hipconf %s", c);
+        /* prefix the contents of the line with" hipconf HIPCONF_HIPD_KEYWORD"
+         * Only hipd parses config files as hipconf commands, hardcode it as target */
+        res_len = sprintf(str, "hipconf %s %s", HIPCONF_HIPD_KEYWORD, c);
         if (str[res_len] == '\n') {
             str[res_len] = '\0';
         }
@@ -2330,7 +2403,6 @@
             args[i++] = token;
             token     = strtok(NULL, " \t");
         }
-
         err = hip_do_hipconf(i, args, 1);
         if (err) {
             HIP_ERROR("Error on the following line: %s\n", line);
@@ -2454,9 +2526,18 @@
     struct hip_common *msg    = NULL;
 
     /* Check that we have at least one command line argument. */
-    if (argc < 2) {
-        HIP_ERROR("Invalid arguments.\n\n%s usage:\n%s\n",
-                  argv[0], hipconf_usage);
+    if (argc < 3) {
+        HIP_ERROR("Invalid arguments.\nUsage to communicate with HIP daemon:\n %s %s\n"
+                  "\nUsage to communicate with HIP firewall:\n %s %s\n",
+                  argv[0], hipconf_usage, argv[0], hipfwconf_usage);
+        return -1;
+    }
+
+    /* set context for this conf command */
+    daemon_name = conf_get_process(argv);
+    if (daemon_name == UNKNOWN_KEYWORD) {
+        HIP_ERROR("Invalid target process argument '%s'. Expected '%s' or '%s'.\n",
+                  argv[1], HIPCONF_HIPD_KEYWORD, HIPCONF_HIPFW_KEYWORD);
         return -1;
     }
 
@@ -2464,14 +2545,14 @@
     action = conf_get_action(argv);
 
     if (action == -1) {
-        HIP_ERROR("Invalid action argument '%s'\n", argv[1]);
+        HIP_ERROR("Invalid action argument '%s'\n", argv[2]);
         return -1;
     }
 
     /* Check that we have at least the minimum number of arguments
      * for the given action. */
-    if (argc < conf_check_action_argc(action) + 2) {
-        HIP_ERROR("Not enough arguments given for the action '%s'\n", argv[1]);
+    if (argc < conf_check_action_argc(action) + 3) {
+        HIP_ERROR("Not enough arguments given for the action '%s'\n", argv[2]);
         return -1;
     }
 
@@ -2499,25 +2580,23 @@
     /* Call handler function from the handler function pointer
      * array at index "type" with given commandline arguments.
      * The functions build a hip_common message. */
-    if (argc == 3) {
-        err = (*action_handler[type])(msg, action, &argv[2], argc - 3, send_only);
+    if (argc == 4) {
+        err = (*action_handler[type])(msg, action, &argv[3], argc - 4, send_only);
     } else {
-        err = (*action_handler[type])(msg, action, &argv[3], argc - 3, send_only);
+        err = (*action_handler[type])(msg, action, &argv[4], argc - 4, send_only);
     }
 
     if (err != 0) {
-        HIP_ERROR("Failed to send a message to the HIP daemon.\n");
+        HIP_ERROR("Failed to send user message.\n");
         goto out_err;
     }
 
-    /* hipconf new hi does not involve any messages to hipd */
+    /* hipconf daemon new hi does not involve any messages to hipd */
     if (hip_get_msg_type(msg) == 0) {
         goto out_err;
     }
 
-    /* Send message to hipd */
-    HIP_IFEL(hip_send_recv_daemon_info(msg, send_only, 0), -1,
-             "Failed to send user message to the HIP daemon.\n");
+    send_receive_message(msg, send_only);
 
     HIP_INFO("User message was sent successfully to the HIP daemon.\n");
 
@@ -2525,7 +2604,8 @@
     free(msg);
 
     if (err) {
-        HIP_ERROR("(Check syntax for hipconf. Is hipd running or root privilege needed?)\n");
+        HIP_ERROR("(Check syntax for hipconf. Is the daemon running or root"
+                  " privilege needed?)\n");
     }
 
     return err;
 
=== modified file 'lib/core/conf.h'
--- lib/core/conf.h	2011-08-15 14:11:56 +0000
+++ lib/core/conf.h	2011-11-08 17:09:18 +0000
@@ -54,6 +54,10 @@
 #define ACTION_ADD 1
 #define ACTION_NEW 3
 
+/* keywords used to identify hipd / hipfw as target of hipconf command */
+#define HIPCONF_HIPD_KEYWORD  "daemon"
+#define HIPCONF_HIPFW_KEYWORD "firewall"
+
 int hip_handle_exec_app(int fork, int type, int argc,
                         const char *const argv[]);
 int hip_do_hipconf(int argc, const char *argv[], int send_only);
 
=== modified file 'lib/core/hostid.c'
--- lib/core/hostid.c	2011-10-25 21:14:16 +0000
+++ lib/core/hostid.c	2011-11-08 17:09:18 +0000
@@ -710,7 +710,7 @@
 
     switch (action) {
     case ACTION_NEW:
-        /* Default directory is created only in "hipconf new default hi" */
+        /* Default directory is created only in "hipconf daemon new default hi" */
         if (use_default) {
             if ((err = check_and_create_dir(HIPL_SYSCONFDIR,
                                             HIP_DIR_MODE))) {
 
=== modified file 'lib/core/message.c'
--- lib/core/message.c	2011-10-25 21:44:47 +0000
+++ lib/core/message.c	2011-11-08 17:09:18 +0000
@@ -40,7 +40,7 @@
  * hence the message does not block.
  *
  * Use the synchronous message interface only when you expect the
- * request message to be completed immediately. For example, "hipconf
+ * request message to be completed immediately. For example, "hipconf daemon
  * get ha all" was safe to be implemented with synchronous messaging
  * because hipd can process the request immediately.
  *
@@ -86,6 +86,7 @@
 #include <sys/time.h>
 #include <sys/types.h>
 
+#include "lib/core/conf.h"
 #include "lib/tool/nlink.h"
 #include "builder.h"
 #include "common.h"
@@ -144,7 +145,7 @@
     } while (timeout_left > 0 && errno == EAGAIN && bytes < 0);
 
     if (bytes < 0) {
-        HIP_ERROR("recv() peek error (is hipd running?)\n");
+        HIP_ERROR("recv() peek error (is the daemon running?)\n");
         err = -EAGAIN;
         goto out_err;
     } else if (bytes < hdr_size) {
@@ -178,6 +179,30 @@
 }
 
 /**
+ * Connect a socket to the loopback address of hipd or hipfw.
+ *
+ * @param  hip_user_sock The socket to connect.
+ * @param  port          The port to connect.
+ * @return zero on success and negative on failure
+ * @note   currently only SOCK_DGRAM and AF_INET6 are supported
+ */
+static int hip_connect(int hip_user_sock, int port)
+{
+    struct sockaddr_in6 addr = { 0 };
+
+    addr.sin6_family = AF_INET6;
+    addr.sin6_port   = htons(port);
+    addr.sin6_addr   = in6addr_loopback;
+
+    if (connect(hip_user_sock, (struct sockaddr *) &addr, sizeof(addr))) {
+        HIP_ERROR("connection failed: %s\n", strerror(errno));
+        return -1;
+    }
+
+    return 0;
+}
+
+/**
  * Connect a socket to the loop back address of hipd
  *
  * @param hip_user_sock The socket to connect. Currently only SOCK_DGRAM
@@ -187,21 +212,7 @@
  */
 int hip_daemon_connect(int hip_user_sock)
 {
-    int                 err         = 0;
-    struct sockaddr_in6 daemon_addr = { 0 };
-    // We're using system call here add thus resetting errno.
-    errno = 0;
-
-    daemon_addr.sin6_family = AF_INET6;
-    daemon_addr.sin6_port   = htons(HIP_DAEMON_LOCAL_PORT);
-    daemon_addr.sin6_addr   = in6addr_loopback;
-
-    HIP_IFEL(connect(hip_user_sock, (struct sockaddr *) &daemon_addr,
-                     sizeof(daemon_addr)), -1, "connection to daemon failed\n");
-
-out_err:
-
-    return err;
+    return hip_connect(hip_user_sock, HIP_DAEMON_LOCAL_PORT);
 }
 
 /**
@@ -211,7 +222,7 @@
  * obtain a port number below 1024. In UNIX/Linux this means that the
  * process has superuser privileges. Hipd uses the port number to
  * verify if the caller has sufficient privileges to execute
- * e.g. "hipconf rst all". The function falls back to non-privileged
+ * e.g. "hipconf daemon rst all". The function falls back to non-privileged
  * ports if it fails to obtain a privileged port and then hipd allows
  * only certain operations for the calling process.
  *
@@ -319,23 +330,30 @@
 #define EHIP       500
 
 /**
- * Send and receive data with hipd. Do not call this function directly, use
- * hip_send_recv_daemon_info instead!
+ * Send and receive data with hipd or hipfw. Do not call this function directly,
+ * use hip_send_recv_daemon_info or hip_send_recv_firewall_info instead!
  *
- * @param msg the message to send to hipd
+ * @param msg        The message to send to hipd or hipfw
  * @param opt_socket Optional socket to use for the message exchange. When
  *                   set to zero, the function creates a temporary socket
  *                   and closes it after the transaction is completed.
+ * @param port       The port to send the message to.
  * @return zero on success and negative on failure
  * @note currently only SOCK_DGRAM and AF_INET6 are supported
  */
-static int send_recv_daemon_info_internal(struct hip_common *msg,
-                                          int opt_socket)
+static int send_recv_info_internal(struct hip_common *msg, int opt_socket, int port)
 {
     int                 hip_user_sock = 0, err = 0, n = 0, len = 0;
     struct sockaddr_in6 addr          = { 0 };
     uint8_t             msg_type_old, msg_type_new;
+    const char         *receiver;
 
+    /* determine receiver to print correct debug / error messages */
+    if (port == HIP_FIREWALL_PORT) {
+        receiver = HIPCONF_HIPFW_KEYWORD;
+    } else {
+        receiver = HIPCONF_HIPD_KEYWORD;
+    }
     msg_type_old = hip_get_msg_type(msg);
 
     // We're using system call here and thus resetting errno.
@@ -354,9 +372,9 @@
         HIP_IFEL(daemon_bind_socket(hip_user_sock,
                                     (struct sockaddr *) &addr), -1,
                  "bind failed\n");
-        /* Connect to hipd. Otherwise e.g. "hipconf get ha all"
+        /* Connect to hipd or hipfw. Otherwise e.g. "hipconf daemon get ha all"
          * blocks when hipd is not running. */
-        HIP_IFEL(hip_daemon_connect(hip_user_sock), -1,
+        HIP_IFEL(hip_connect(hip_user_sock, port), -1,
                  "connect failed\n");
     }
 
@@ -368,14 +386,18 @@
     /* Require a response from hipd */
     hip_set_msg_response(msg, 1);
 
-    n = sendto_hipd(hip_user_sock, msg, len);
+    if (port == HIP_FIREWALL_PORT) {
+        n = send(hip_user_sock, msg, len, 0);
+    } else {
+        n = sendto_hipd(hip_user_sock, msg, len);
+    }
     if (n < len) {
-        HIP_ERROR("Could not send message to daemon.\n");
+        HIP_ERROR("Could not send message to %s.\n", receiver);
         err = -ECOMM;
         goto out_err;
     }
 
-    HIP_DEBUG("Waiting to receive daemon info.\n");
+    HIP_DEBUG("Waiting to receive %s info.\n", receiver);
 
     if ((len = peek_recv_total_len(hip_user_sock, 0, HIP_DEFAULT_MSG_TIMEOUT)) < 0) {
         err = len;
@@ -390,14 +412,14 @@
              "Message sync problem. Expected %d, got %d\n",
              msg_type_old, msg_type_new);
 
-    HIP_DEBUG("%d bytes received from HIP daemon\n", n);
+    HIP_DEBUG("%d bytes received from HIP %s.\n", n, receiver);
 
     if (n == 0) {
-        HIP_INFO("The HIP daemon has performed an orderly shutdown.\n");
+        HIP_INFO("The HIP %s has performed an orderly shutdown.\n", receiver);
         // Note. This is not an error condition, thus we return zero.
         goto out_err;
     } else if (n < (int) sizeof(struct hip_common)) {
-        HIP_ERROR("Could not receive message from daemon.\n");
+        HIP_ERROR("Could not receive message from %s.\n", receiver);
         goto out_err;
     }
 
@@ -442,7 +464,7 @@
     struct sockaddr_in6 addr          = { 0 };
 
     if (!send_only) {
-        return send_recv_daemon_info_internal(msg, opt_socket);
+        return send_recv_info_internal(msg, opt_socket, HIP_DAEMON_LOCAL_PORT);
     }
 
     if (opt_socket) {
@@ -479,6 +501,21 @@
 }
 
 /**
+ * A generic function to send messages to hipfw with subsequent reply. This will
+ * block the process until the hipfw sends the response or a predefined timeout
+ * is exceeded.
+ *
+ * @param msg An input/output parameter. As input, contains the
+ *            message to be sent to hipfw. As output, hipfw response
+ *            will be written here.
+ * @return zero on success and negative on failure.
+ */
+int hip_send_recv_firewall_info(struct hip_common *const msg)
+{
+    return send_recv_info_internal(msg, 0, HIP_FIREWALL_PORT);
+}
+
+/**
  * Read an interprocess (user) message
  *
  * @param  sockfd   a socket from where to read
 
=== modified file 'lib/core/message.h'
--- lib/core/message.h	2011-08-15 14:11:56 +0000
+++ lib/core/message.h	2011-11-08 17:09:18 +0000
@@ -46,5 +46,6 @@
 int hip_send_recv_daemon_info(struct hip_common *msg,
                               int send_only,
                               int opt_socket);
+int hip_send_recv_firewall_info(struct hip_common *const msg);
 
 #endif /* HIP_LIB_CORE_MESSAGE_H */
 
=== modified file 'lib/tool/nlink.c'
--- lib/tool/nlink.c	2011-10-25 21:14:16 +0000
+++ lib/tool/nlink.c	2011-11-08 17:09:18 +0000
@@ -146,7 +146,7 @@
 
         /* Transitioned from recvmsg() to recvfrom() due to
          * "Netlink overrun" errors when executing
-         * "hipconf rst all" */
+         * "hipconf daemon rst all" */
 
         status = recvfrom(nl->fd, buf, sizeof(buf),
                           0, NULL, NULL);
 
=== modified file 'tools/hipconf.c'
--- tools/hipconf.c	2011-08-15 14:11:56 +0000
+++ tools/hipconf.c	2011-11-08 17:09:18 +0000
@@ -53,7 +53,7 @@
     hip_set_logdebug(LOGDEBUG_ALL);
 
     HIP_IFEL(hip_do_hipconf(argc, argv, 0), -2,
-             "Error: Cannot configure the HIP daemon.\n");
+             "Error: Cannot configure the daemon.\n");
 
 out_err:
     return err;
 
=== modified file 'tools/hipdnsproxy/hipdnsproxy.in'
--- tools/hipdnsproxy/hipdnsproxy.in	2011-06-09 19:11:46 +0000
+++ tools/hipdnsproxy/hipdnsproxy.in	2011-11-08 17:09:18 +0000
@@ -545,7 +545,7 @@
         f.close()
 
     def map_hit_to_lsi(gp, hit):
-        cmd = "hipconf hit-to-lsi " + hit + " 2>&1"
+        cmd = "hipconf daemon hit-to-lsi " + hit + " 2>&1"
         #gp.fout.write("cmd - %s\n" % (cmd,))
         p = Popen(cmd, shell=True, stdout=subprocess.PIPE).stdout
         result = p.readline()
@@ -558,7 +558,7 @@
         return None
 
     def lsi_to_hit(gp, lsi):
-        cmd = "hipconf lsi-to-hit " + lsi + " 2>&1"
+        cmd = "hipconf daemon lsi-to-hit " + lsi + " 2>&1"
         p = Popen(cmd, shell=True, stdout=subprocess.PIPE).stdout
         result = p.readline()
         while result:
@@ -570,7 +570,7 @@
         return None
 
     def add_hit_ip_map(gp, hit, ip):
-        cmd = "hipconf add map " + hit + " " + ip + \
+        cmd = "hipconf daemon add map " + hit + " " + ip + \
             " > /dev/null 2>&1"
         gp.fout.write('Associating HIT %s with IP %s\n' % (hit, ip))
         os.system(cmd)