No OneTemporary
Actions

Size

168 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/libknet/crypto.c b/libknet/crypto.c
	index 5d39048c..6c340f5c 100644
	--- a/libknet/crypto.c
	+++ b/libknet/crypto.c
	@@ -1,217 +1,234 @@
	/*
	* Copyright (C) 2012-2019 Red Hat, Inc. All rights reserved.
	*
	* Author: Fabio M. Di Nitto <fabbione@kronosnet.org>
	*
	* This software licensed under GPL-2.0+, LGPL-2.0+
	*/

	#include "config.h"

	#include <sys/errno.h>
	#include <stdlib.h>
	#include <string.h>
	#include <pthread.h>
	#include <time.h>

	#include "crypto.h"
	#include "crypto_model.h"
	#include "internals.h"
	#include "logging.h"
	#include "common.h"

	/*
	* internal module switch data
	*/

	static crypto_model_t crypto_modules_cmds[] = {
	{ "nss", WITH_CRYPTO_NSS, 0, NULL },
	{ "openssl", WITH_CRYPTO_OPENSSL, 0, NULL },
	{ NULL, 0, 0, NULL }
	};

	static int crypto_get_model(const char *model)
	{
	int idx = 0;

	while (crypto_modules_cmds[idx].model_name != NULL) {
	if (!strcmp(crypto_modules_cmds[idx].model_name, model))
	return idx;
	idx++;
	}
	return -1;
	}

	/*
	* exported API
	*/

	int crypto_encrypt_and_sign (
	knet_handle_t knet_h,
	const unsigned char *buf_in,
	const ssize_t buf_in_len,
	unsigned char *buf_out,
	ssize_t *buf_out_len)
	{
	return crypto_modules_cmds[knet_h->crypto_instance->model].ops->crypt(knet_h, buf_in, buf_in_len, buf_out, buf_out_len);
	}

	int crypto_encrypt_and_signv (
	knet_handle_t knet_h,
	const struct iovec *iov_in,
	int iovcnt_in,
	unsigned char *buf_out,
	ssize_t *buf_out_len)
	{
	return crypto_modules_cmds[knet_h->crypto_instance->model].ops->cryptv(knet_h, iov_in, iovcnt_in, buf_out, buf_out_len);
	}

	int crypto_authenticate_and_decrypt (
	knet_handle_t knet_h,
	const unsigned char *buf_in,
	const ssize_t buf_in_len,
	unsigned char *buf_out,
	ssize_t *buf_out_len)
	{
	return crypto_modules_cmds[knet_h->crypto_instance->model].ops->decrypt(knet_h, buf_in, buf_in_len, buf_out, buf_out_len);
	}

	int crypto_init(
	knet_handle_t knet_h,
	struct knet_handle_crypto_cfg *knet_handle_crypto_cfg)
	{
	- int savederrno = 0;
	+ int err = 0, savederrno = 0;
	int model = 0;
	+ struct crypto_instance current = NULL, new = NULL;
	+
	+ current = knet_h->crypto_instance;

	model = crypto_get_model(knet_handle_crypto_cfg->crypto_model);
	if (model < 0) {
	log_err(knet_h, KNET_SUB_CRYPTO, "model %s not supported", knet_handle_crypto_cfg->crypto_model);
	return -1;
	}

	if (crypto_modules_cmds[model].built_in == 0) {
	log_err(knet_h, KNET_SUB_CRYPTO, "this version of libknet was built without %s support. Please contact your vendor or fix the build.", knet_handle_crypto_cfg->crypto_model);
	return -1;
	}

	savederrno = pthread_rwlock_wrlock(&shlib_rwlock);
	if (savederrno) {
	log_err(knet_h, KNET_SUB_CRYPTO, "Unable to get write lock: %s",
	strerror(savederrno));
	return -1;
	}

	if (!crypto_modules_cmds[model].loaded) {
	crypto_modules_cmds[model].ops = load_module (knet_h, "crypto", crypto_modules_cmds[model].model_name);
	if (!crypto_modules_cmds[model].ops) {
	savederrno = errno;
	+ err = -1;
	log_err(knet_h, KNET_SUB_CRYPTO, "Unable to load %s lib", crypto_modules_cmds[model].model_name);
	- goto out_err;
	+ goto out;
	}
	if (crypto_modules_cmds[model].ops->abi_ver != KNET_CRYPTO_MODEL_ABI) {
	+ savederrno = EINVAL;
	+ err = -1;
	log_err(knet_h, KNET_SUB_CRYPTO,
	"ABI mismatch loading module %s. knet ver: %d, module ver: %d",
	crypto_modules_cmds[model].model_name, KNET_CRYPTO_MODEL_ABI,
	crypto_modules_cmds[model].ops->abi_ver);
	- savederrno = EINVAL;
	- goto out_err;
	+ goto out;
	}
	crypto_modules_cmds[model].loaded = 1;
	}

	log_debug(knet_h, KNET_SUB_CRYPTO,
	"Initizializing crypto module [%s/%s/%s]",
	knet_handle_crypto_cfg->crypto_model,
	knet_handle_crypto_cfg->crypto_cipher_type,
	knet_handle_crypto_cfg->crypto_hash_type);

	- knet_h->crypto_instance = malloc(sizeof(struct crypto_instance));
	+ new = malloc(sizeof(struct crypto_instance));

	- if (!knet_h->crypto_instance) {
	- log_err(knet_h, KNET_SUB_CRYPTO, "Unable to allocate memory for crypto instance");
	+ if (!new) {
	savederrno = ENOMEM;
	- goto out_err;
	+ err = -1;
	+ log_err(knet_h, KNET_SUB_CRYPTO, "Unable to allocate memory for crypto instance");
	+ goto out;
	}

	/*
	* if crypto_modules_cmds.ops->init fails, it is expected that
	* it will clean everything by itself.
	* crypto_modules_cmds.ops->fini is not invoked on error.
	*/
	- knet_h->crypto_instance->model = model;
	- if (crypto_modules_cmds[knet_h->crypto_instance->model].ops->init(knet_h, knet_handle_crypto_cfg)) {
	+ new->model = model;
	+ if (crypto_modules_cmds[model].ops->init(knet_h, new, knet_handle_crypto_cfg)) {
	savederrno = errno;
	- goto out_err;
	+ err = -1;
	+ goto out;
	}

	log_debug(knet_h, KNET_SUB_CRYPTO, "security network overhead: %zu", knet_h->sec_header_size);
	- pthread_rwlock_unlock(&shlib_rwlock);
	- return 0;

	-out_err:
	- if (knet_h->crypto_instance) {
	- free(knet_h->crypto_instance);
	- knet_h->crypto_instance = NULL;
	+out:
	+ if (!err) {
	+ knet_h->crypto_instance = new;
	+ knet_h->sec_header_size = new->sec_header_size;
	+ knet_h->sec_block_size = new->sec_block_size;
	+ knet_h->sec_hash_size = new->sec_hash_size;
	+ knet_h->sec_salt_size = new->sec_salt_size;
	+
	+ if (current) {
	+ if (crypto_modules_cmds[current->model].ops->fini != NULL) {
	+ crypto_modules_cmds[current->model].ops->fini(knet_h, current);
	+ }
	+ free(current);
	+ }
	+ } else {
	+ if (new) {
	+ free(new);
	+ }
	}

	pthread_rwlock_unlock(&shlib_rwlock);
	- errno = savederrno;
	- return -1;
	+ errno = err ? savederrno : 0;
	+ return err;
	}

	void crypto_fini(
	knet_handle_t knet_h)
	{
	int savederrno = 0;
	- int model = 0;

	savederrno = pthread_rwlock_wrlock(&shlib_rwlock);
	if (savederrno) {
	log_err(knet_h, KNET_SUB_CRYPTO, "Unable to get write lock: %s",
	strerror(savederrno));
	return;
	}

	if (knet_h->crypto_instance) {
	- model = knet_h->crypto_instance->model;
	- if (crypto_modules_cmds[model].ops->fini != NULL) {
	- crypto_modules_cmds[model].ops->fini(knet_h);
	+ if (crypto_modules_cmds[knet_h->crypto_instance->model].ops->fini != NULL) {
	+ crypto_modules_cmds[knet_h->crypto_instance->model].ops->fini(knet_h, knet_h->crypto_instance);
	}
	free(knet_h->crypto_instance);
	knet_h->sec_header_size = 0;
	knet_h->sec_block_size = 0;
	knet_h->sec_hash_size = 0;
	knet_h->sec_salt_size = 0;
	knet_h->crypto_instance = NULL;
	}

	pthread_rwlock_unlock(&shlib_rwlock);
	return;
	}

	int knet_get_crypto_list(struct knet_crypto_info crypto_list, size_t crypto_list_entries)
	{
	int err = 0;
	int idx = 0;
	int outidx = 0;

	if (!crypto_list_entries) {
	errno = EINVAL;
	return -1;
	}

	while (crypto_modules_cmds[idx].model_name != NULL) {
	if (crypto_modules_cmds[idx].built_in) {
	if (crypto_list) {
	crypto_list[outidx].name = crypto_modules_cmds[idx].model_name;
	}
	outidx++;
	}
	idx++;
	}
	*crypto_list_entries = outidx;

	if (!err)
	errno = 0;
	return err;
	}
	diff --git a/libknet/crypto_model.h b/libknet/crypto_model.h
	index f11299a6..9bb4f17a 100644
	--- a/libknet/crypto_model.h
	+++ b/libknet/crypto_model.h
	@@ -1,53 +1,59 @@
	/*
	* Copyright (C) 2012-2019 Red Hat, Inc. All rights reserved.
	*
	* Author: Fabio M. Di Nitto <fabbione@kronosnet.org>
	*
	* This software licensed under GPL-2.0+, LGPL-2.0+
	*/

	#ifndef __KNET_CRYPTO_MODEL_H__
	#define __KNET_CRYPTO_MODEL_H__

	#include "internals.h"

	struct crypto_instance {
	int model;
	void *model_instance;
	+ size_t sec_header_size;
	+ size_t sec_block_size;
	+ size_t sec_hash_size;
	+ size_t sec_salt_size;
	};

	-#define KNET_CRYPTO_MODEL_ABI 1
	+#define KNET_CRYPTO_MODEL_ABI 2

	/*
	* see compress_model.h for explanation of the various lib related functions
	*/
	typedef struct {
	uint8_t abi_ver;
	int (*init) (knet_handle_t knet_h,
	+ struct crypto_instance *crypto_instance,
	struct knet_handle_crypto_cfg *knet_handle_crypto_cfg);
	- void (*fini) (knet_handle_t knet_h);
	+ void (*fini) (knet_handle_t knet_h,
	+ struct crypto_instance *crypto_instance);
	int (*crypt) (knet_handle_t knet_h,
	const unsigned char *buf_in,
	const ssize_t buf_in_len,
	unsigned char *buf_out,
	ssize_t *buf_out_len);
	int (*cryptv) (knet_handle_t knet_h,
	const struct iovec *iov_in,
	int iovcnt_in,
	unsigned char *buf_out,
	ssize_t *buf_out_len);
	int (*decrypt) (knet_handle_t knet_h,
	const unsigned char *buf_in,
	const ssize_t buf_in_len,
	unsigned char *buf_out,
	ssize_t *buf_out_len);
	} crypto_ops_t;

	typedef struct {
	const char *model_name;
	uint8_t built_in;
	uint8_t loaded;
	crypto_ops_t *ops;
	} crypto_model_t;

	#endif
	diff --git a/libknet/crypto_nss.c b/libknet/crypto_nss.c
	index cc838275..5c3a4374 100644
	--- a/libknet/crypto_nss.c
	+++ b/libknet/crypto_nss.c
	@@ -1,841 +1,845 @@
	/*
	* Copyright (C) 2012-2019 Red Hat, Inc. All rights reserved.
	*
	* Author: Fabio M. Di Nitto <fabbione@kronosnet.org>
	*
	* This software licensed under GPL-2.0+, LGPL-2.0+
	*/
	#define KNET_MODULE

	#include "config.h"

	#include <errno.h>
	#include <stdlib.h>
	#include <nss.h>
	#include <nspr.h>
	#include <pk11pub.h>
	#include <pkcs11.h>
	#include <prerror.h>
	#include <blapit.h>
	#include <hasht.h>
	#include <pthread.h>
	#include <secerr.h>
	#include <prinit.h>

	#include "crypto_model.h"
	#include "logging.h"

	static int nss_db_is_init = 0;

	static void nss_atexit_handler(void)
	{
	if (nss_db_is_init) {
	NSS_Shutdown();
	if (PR_Initialized()) {
	PL_ArenaFinish();
	PR_Cleanup();
	}
	}
	return;
	}

	/*
	* crypto definitions and conversion tables
	*/

	#define SALT_SIZE 16

	/*
	* This are defined in new NSS. For older one, we will define our own
	*/
	#ifndef AES_256_KEY_LENGTH
	#define AES_256_KEY_LENGTH 32
	#endif

	#ifndef AES_192_KEY_LENGTH
	#define AES_192_KEY_LENGTH 24
	#endif

	#ifndef AES_128_KEY_LENGTH
	#define AES_128_KEY_LENGTH 16
	#endif

	enum nsscrypto_crypt_t {
	CRYPTO_CIPHER_TYPE_NONE = 0,
	CRYPTO_CIPHER_TYPE_AES256 = 1,
	CRYPTO_CIPHER_TYPE_AES192 = 2,
	CRYPTO_CIPHER_TYPE_AES128 = 3
	};

	CK_MECHANISM_TYPE cipher_to_nss[] = {
	0, /* CRYPTO_CIPHER_TYPE_NONE */
	CKM_AES_CBC_PAD, /* CRYPTO_CIPHER_TYPE_AES256 */
	CKM_AES_CBC_PAD, /* CRYPTO_CIPHER_TYPE_AES192 */
	CKM_AES_CBC_PAD /* CRYPTO_CIPHER_TYPE_AES128 */
	};

	size_t nsscipher_key_len[] = {
	0, /* CRYPTO_CIPHER_TYPE_NONE */
	AES_256_KEY_LENGTH, /* CRYPTO_CIPHER_TYPE_AES256 */
	AES_192_KEY_LENGTH, /* CRYPTO_CIPHER_TYPE_AES192 */
	AES_128_KEY_LENGTH /* CRYPTO_CIPHER_TYPE_AES128 */
	};

	size_t nsscypher_block_len[] = {
	0, /* CRYPTO_CIPHER_TYPE_NONE */
	AES_BLOCK_SIZE, /* CRYPTO_CIPHER_TYPE_AES256 */
	AES_BLOCK_SIZE, /* CRYPTO_CIPHER_TYPE_AES192 */
	AES_BLOCK_SIZE /* CRYPTO_CIPHER_TYPE_AES128 */
	};

	/*
	* hash definitions and conversion tables
	*/

	enum nsscrypto_hash_t {
	CRYPTO_HASH_TYPE_NONE = 0,
	CRYPTO_HASH_TYPE_MD5 = 1,
	CRYPTO_HASH_TYPE_SHA1 = 2,
	CRYPTO_HASH_TYPE_SHA256 = 3,
	CRYPTO_HASH_TYPE_SHA384 = 4,
	CRYPTO_HASH_TYPE_SHA512 = 5
	};

	CK_MECHANISM_TYPE hash_to_nss[] = {
	0, /* CRYPTO_HASH_TYPE_NONE */
	CKM_MD5_HMAC, /* CRYPTO_HASH_TYPE_MD5 */
	CKM_SHA_1_HMAC, /* CRYPTO_HASH_TYPE_SHA1 */
	CKM_SHA256_HMAC, /* CRYPTO_HASH_TYPE_SHA256 */
	CKM_SHA384_HMAC, /* CRYPTO_HASH_TYPE_SHA384 */
	CKM_SHA512_HMAC /* CRYPTO_HASH_TYPE_SHA512 */
	};

	size_t nsshash_len[] = {
	0, /* CRYPTO_HASH_TYPE_NONE */
	MD5_LENGTH, /* CRYPTO_HASH_TYPE_MD5 */
	SHA1_LENGTH, /* CRYPTO_HASH_TYPE_SHA1 */
	SHA256_LENGTH, /* CRYPTO_HASH_TYPE_SHA256 */
	SHA384_LENGTH, /* CRYPTO_HASH_TYPE_SHA384 */
	SHA512_LENGTH /* CRYPTO_HASH_TYPE_SHA512 */
	};

	enum sym_key_type {
	SYM_KEY_TYPE_CRYPT,
	SYM_KEY_TYPE_HASH
	};

	struct nsscrypto_instance {
	PK11SymKey *nss_sym_key;
	PK11SymKey *nss_sym_key_sign;

	unsigned char *private_key;

	unsigned int private_key_len;

	int crypto_cipher_type;

	int crypto_hash_type;
	};

	/*
	* crypt/decrypt functions
	*/

	static int nssstring_to_crypto_cipher_type(const char* crypto_cipher_type)
	{
	if (strcmp(crypto_cipher_type, "none") == 0) {
	return CRYPTO_CIPHER_TYPE_NONE;
	} else if (strcmp(crypto_cipher_type, "aes256") == 0) {
	return CRYPTO_CIPHER_TYPE_AES256;
	} else if (strcmp(crypto_cipher_type, "aes192") == 0) {
	return CRYPTO_CIPHER_TYPE_AES192;
	} else if (strcmp(crypto_cipher_type, "aes128") == 0) {
	return CRYPTO_CIPHER_TYPE_AES128;
	}
	return -1;
	}

	-static PK11SymKey *nssimport_symmetric_key(knet_handle_t knet_h, enum sym_key_type key_type)
	+static PK11SymKey *nssimport_symmetric_key(knet_handle_t knet_h,
	+ struct crypto_instance *crypto_instance,
	+ enum sym_key_type key_type)
	{
	- struct nsscrypto_instance *instance = knet_h->crypto_instance->model_instance;
	+ struct nsscrypto_instance *instance = crypto_instance->model_instance;
	SECItem key_item;
	PK11SlotInfo *slot;
	PK11SymKey *res_key;
	CK_MECHANISM_TYPE cipher;
	CK_ATTRIBUTE_TYPE operation;
	CK_MECHANISM_TYPE wrap_mechanism;
	int wrap_key_len;
	PK11SymKey *wrap_key;
	PK11Context *wrap_key_crypt_context;
	SECItem tmp_sec_item;
	SECItem wrapped_key;
	int wrapped_key_len;
	int wrap_key_block_size;
	unsigned char wrapped_key_data[KNET_MAX_KEY_LEN];
	unsigned char pad_key_data[KNET_MAX_KEY_LEN];

	memset(&key_item, 0, sizeof(key_item));
	slot = NULL;
	wrap_key = NULL;
	res_key = NULL;
	wrap_key_crypt_context = NULL;

	if (instance->private_key_len > sizeof(pad_key_data)) {
	log_err(knet_h, KNET_SUB_NSSCRYPTO, "Import symmetric key failed. Private key is too long");
	goto exit_res_key;
	}
	memset(pad_key_data, 0, sizeof(pad_key_data));
	memcpy(pad_key_data, instance->private_key, instance->private_key_len);

	key_item.type = siBuffer;
	key_item.data = pad_key_data;

	switch (key_type) {
	case SYM_KEY_TYPE_CRYPT:
	key_item.len = nsscipher_key_len[instance->crypto_cipher_type];
	cipher = cipher_to_nss[instance->crypto_cipher_type];
	operation = CKA_ENCRYPT\|CKA_DECRYPT;
	break;
	case SYM_KEY_TYPE_HASH:
	key_item.len = instance->private_key_len;
	cipher = hash_to_nss[instance->crypto_hash_type];
	operation = CKA_SIGN;
	break;
	default:
	log_err(knet_h, KNET_SUB_NSSCRYPTO, "Import symmetric key failed. Unknown keyimport request");
	goto exit_res_key;
	break;
	}

	slot = PK11_GetBestSlot(cipher, NULL);
	if (slot == NULL) {
	log_err(knet_h, KNET_SUB_NSSCRYPTO, "Unable to find security slot (%d): %s",
	PR_GetError(), PR_ErrorToString(PR_GetError(), PR_LANGUAGE_I_DEFAULT));
	goto exit_res_key;
	}

	/*
	* Without FIPS it would be possible to just use
	* res_key = PK11_ImportSymKey(slot, cipher, PK11_OriginUnwrap, operation, &key_item, NULL);
	* with FIPS NSS Level 2 certification has to be "workarounded" (so it becomes Level 1) by using
	* following method:
	* 1. Generate wrap key
	* 2. Encrypt authkey with wrap key
	* 3. Unwrap encrypted authkey using wrap key
	*/

	/*
	* Generate wrapping key
	*/
	wrap_mechanism = PK11_GetBestWrapMechanism(slot);
	wrap_key_len = PK11_GetBestKeyLength(slot, wrap_mechanism);
	wrap_key = PK11_KeyGen(slot, wrap_mechanism, NULL, wrap_key_len, NULL);
	if (wrap_key == NULL) {
	log_err(knet_h, KNET_SUB_NSSCRYPTO, "Unable to generate wrapping key (%d): %s",
	PR_GetError(), PR_ErrorToString(PR_GetError(), PR_LANGUAGE_I_DEFAULT));
	goto exit_res_key;
	}

	/*
	* Encrypt authkey with wrapping key
	*/

	/*
	* Key must be padded to a block size
	*/
	wrap_key_block_size = PK11_GetBlockSize(wrap_mechanism, 0);
	if (wrap_key_block_size < 0) {
	log_err(knet_h, KNET_SUB_NSSCRYPTO, "Unable to get wrap key block size (%d): %s",
	PR_GetError(), PR_ErrorToString(PR_GetError(), PR_LANGUAGE_I_DEFAULT));
	goto exit_res_key;
	}
	if (sizeof(pad_key_data) % wrap_key_block_size != 0) {
	log_err(knet_h, KNET_SUB_NSSCRYPTO, "Padded key buffer size (%zu) is not dividable by "
	"wrap key block size (%u).", sizeof(pad_key_data), (unsigned int)wrap_key_block_size);
	goto exit_res_key;
	}

	/*
	* Initialization of IV is not needed because PK11_GetBestWrapMechanism should return ECB mode
	*/
	memset(&tmp_sec_item, 0, sizeof(tmp_sec_item));
	wrap_key_crypt_context = PK11_CreateContextBySymKey(wrap_mechanism, CKA_ENCRYPT,
	wrap_key, &tmp_sec_item);
	if (wrap_key_crypt_context == NULL) {
	log_err(knet_h, KNET_SUB_NSSCRYPTO, "Unable to create encrypt context (%d): %s",
	PR_GetError(), PR_ErrorToString(PR_GetError(), PR_LANGUAGE_I_DEFAULT));
	goto exit_res_key;
	}

	wrapped_key_len = (int)sizeof(wrapped_key_data);

	if (PK11_CipherOp(wrap_key_crypt_context, wrapped_key_data, &wrapped_key_len,
	sizeof(wrapped_key_data), key_item.data, sizeof(pad_key_data)) != SECSuccess) {
	log_err(knet_h, KNET_SUB_NSSCRYPTO, "Unable to encrypt authkey (%d): %s",
	PR_GetError(), PR_ErrorToString(PR_GetError(), PR_LANGUAGE_I_DEFAULT));
	goto exit_res_key;
	}

	if (PK11_Finalize(wrap_key_crypt_context) != SECSuccess) {
	log_err(knet_h, KNET_SUB_NSSCRYPTO, "Unable to finalize encryption of authkey (%d): %s",
	PR_GetError(), PR_ErrorToString(PR_GetError(), PR_LANGUAGE_I_DEFAULT));
	goto exit_res_key;
	}

	/*
	* Finally unwrap sym key
	*/
	memset(&tmp_sec_item, 0, sizeof(tmp_sec_item));
	wrapped_key.data = wrapped_key_data;
	wrapped_key.len = wrapped_key_len;

	res_key = PK11_UnwrapSymKey(wrap_key, wrap_mechanism, &tmp_sec_item, &wrapped_key,
	cipher, operation, key_item.len);
	if (res_key == NULL) {
	log_err(knet_h, KNET_SUB_NSSCRYPTO, "Failure to import key into NSS (%d): %s",
	PR_GetError(), PR_ErrorToString(PR_GetError(), PR_LANGUAGE_I_DEFAULT));

	if (PR_GetError() == SEC_ERROR_BAD_DATA) {
	/*
	* Maximum key length for FIPS enabled softtoken is limited to
	* MAX_KEY_LEN (pkcs11i.h - 256) and checked in NSC_UnwrapKey. Returned
	* error is CKR_TEMPLATE_INCONSISTENT which is mapped to SEC_ERROR_BAD_DATA.
	*/
	log_err(knet_h, KNET_SUB_NSSCRYPTO, "Secret key is probably too long. "
	"Try reduce it to 256 bytes");
	}
	goto exit_res_key;
	}

	exit_res_key:
	if (wrap_key_crypt_context != NULL) {
	PK11_DestroyContext(wrap_key_crypt_context, PR_TRUE);
	}

	if (wrap_key != NULL) {
	PK11_FreeSymKey(wrap_key);
	}

	if (slot != NULL) {
	PK11_FreeSlot(slot);
	}

	return (res_key);
	}

	-static int init_nss_crypto(knet_handle_t knet_h)
	+static int init_nss_crypto(knet_handle_t knet_h, struct crypto_instance *crypto_instance)
	{
	- struct nsscrypto_instance *instance = knet_h->crypto_instance->model_instance;
	+ struct nsscrypto_instance *instance = crypto_instance->model_instance;

	if (!cipher_to_nss[instance->crypto_cipher_type]) {
	return 0;
	}

	- instance->nss_sym_key = nssimport_symmetric_key(knet_h, SYM_KEY_TYPE_CRYPT);
	+ instance->nss_sym_key = nssimport_symmetric_key(knet_h, crypto_instance, SYM_KEY_TYPE_CRYPT);
	if (instance->nss_sym_key == NULL) {
	errno = ENXIO; /* NSS reported error */
	return -1;
	}

	return 0;
	}

	static int encrypt_nss(
	knet_handle_t knet_h,
	const struct iovec *iov,
	int iovcnt,
	unsigned char *buf_out,
	ssize_t *buf_out_len)
	{
	struct nsscrypto_instance *instance = knet_h->crypto_instance->model_instance;
	PK11Context* crypt_context = NULL;
	SECItem crypt_param;
	SECItem *nss_sec_param = NULL;
	int tmp_outlen = 0, tmp1_outlen = 0;
	unsigned int tmp2_outlen = 0;
	unsigned char *salt = buf_out;
	unsigned char *data = buf_out + SALT_SIZE;
	int err = -1;
	int i;

	if (PK11_GenerateRandom(salt, SALT_SIZE) != SECSuccess) {
	log_err(knet_h, KNET_SUB_NSSCRYPTO, "Failure to generate a random number (err %d): %s",
	PR_GetError(), PR_ErrorToString(PR_GetError(), PR_LANGUAGE_I_DEFAULT));
	goto out;
	}

	crypt_param.type = siBuffer;
	crypt_param.data = salt;
	crypt_param.len = SALT_SIZE;

	nss_sec_param = PK11_ParamFromIV(cipher_to_nss[instance->crypto_cipher_type],
	&crypt_param);
	if (nss_sec_param == NULL) {
	log_err(knet_h, KNET_SUB_NSSCRYPTO, "Failure to set up PKCS11 param (err %d): %s",
	PR_GetError(), PR_ErrorToString(PR_GetError(), PR_LANGUAGE_I_DEFAULT));
	goto out;
	}

	/*
	* Create cipher context for encryption
	*/
	crypt_context = PK11_CreateContextBySymKey(cipher_to_nss[instance->crypto_cipher_type],
	CKA_ENCRYPT,
	instance->nss_sym_key,
	nss_sec_param);
	if (!crypt_context) {
	log_err(knet_h, KNET_SUB_NSSCRYPTO, "PK11_CreateContext failed (encrypt) crypt_type=%d (err %d): %s",
	(int)cipher_to_nss[instance->crypto_cipher_type],
	PR_GetError(), PR_ErrorToString(PR_GetError(), PR_LANGUAGE_I_DEFAULT));
	goto out;
	}

	for (i=0; i<iovcnt; i++) {
	if (PK11_CipherOp(crypt_context, data,
	&tmp_outlen,
	KNET_DATABUFSIZE_CRYPT,
	(unsigned char *)iov[i].iov_base,
	iov[i].iov_len) != SECSuccess) {
	log_err(knet_h, KNET_SUB_NSSCRYPTO, "PK11_CipherOp failed (encrypt) crypt_type=%d (err %d): %s",
	(int)cipher_to_nss[instance->crypto_cipher_type],
	PR_GetError(), PR_ErrorToString(PR_GetError(), PR_LANGUAGE_I_DEFAULT));
	goto out;
	}
	tmp1_outlen = tmp1_outlen + tmp_outlen;
	}

	if (PK11_DigestFinal(crypt_context, data + tmp1_outlen,
	&tmp2_outlen, KNET_DATABUFSIZE_CRYPT - tmp1_outlen) != SECSuccess) {
	log_err(knet_h, KNET_SUB_NSSCRYPTO, "PK11_DigestFinal failed (encrypt) crypt_type=%d (err %d): %s",
	(int)cipher_to_nss[instance->crypto_cipher_type],
	PR_GetError(), PR_ErrorToString(PR_GetError(), PR_LANGUAGE_I_DEFAULT));
	goto out;

	}

	*buf_out_len = tmp1_outlen + tmp2_outlen + SALT_SIZE;

	err = 0;

	out:
	if (crypt_context) {
	PK11_DestroyContext(crypt_context, PR_TRUE);
	}
	if (nss_sec_param) {
	SECITEM_FreeItem(nss_sec_param, PR_TRUE);
	}
	return err;
	}

	static int decrypt_nss (
	knet_handle_t knet_h,
	const unsigned char *buf_in,
	const ssize_t buf_in_len,
	unsigned char *buf_out,
	ssize_t *buf_out_len)
	{
	struct nsscrypto_instance *instance = knet_h->crypto_instance->model_instance;
	PK11Context* decrypt_context = NULL;
	SECItem decrypt_param;
	int tmp1_outlen = 0;
	unsigned int tmp2_outlen = 0;
	unsigned char salt = (unsigned char )buf_in;
	unsigned char *data = salt + SALT_SIZE;
	int datalen = buf_in_len - SALT_SIZE;
	int err = -1;

	if (datalen <= 0) {
	log_err(knet_h, KNET_SUB_NSSCRYPTO, "Packet is too short");
	goto out;
	}

	/* Create cipher context for decryption */
	decrypt_param.type = siBuffer;
	decrypt_param.data = salt;
	decrypt_param.len = SALT_SIZE;

	decrypt_context = PK11_CreateContextBySymKey(cipher_to_nss[instance->crypto_cipher_type],
	CKA_DECRYPT,
	instance->nss_sym_key, &decrypt_param);
	if (!decrypt_context) {
	log_err(knet_h, KNET_SUB_NSSCRYPTO, "PK11_CreateContext (decrypt) failed (err %d): %s",
	PR_GetError(), PR_ErrorToString(PR_GetError(), PR_LANGUAGE_I_DEFAULT));
	goto out;
	}

	if (PK11_CipherOp(decrypt_context, buf_out, &tmp1_outlen,
	KNET_DATABUFSIZE_CRYPT, data, datalen) != SECSuccess) {
	log_err(knet_h, KNET_SUB_NSSCRYPTO, "PK11_CipherOp (decrypt) failed (err %d): %s",
	PR_GetError(), PR_ErrorToString(PR_GetError(), PR_LANGUAGE_I_DEFAULT));
	goto out;
	}

	if (PK11_DigestFinal(decrypt_context, buf_out + tmp1_outlen, &tmp2_outlen,
	KNET_DATABUFSIZE_CRYPT - tmp1_outlen) != SECSuccess) {
	log_err(knet_h, KNET_SUB_NSSCRYPTO, "PK11_DigestFinal (decrypt) failed (err %d): %s",
	PR_GetError(), PR_ErrorToString(PR_GetError(), PR_LANGUAGE_I_DEFAULT));
	goto out;
	}

	*buf_out_len = tmp1_outlen + tmp2_outlen;

	err = 0;

	out:
	if (decrypt_context) {
	PK11_DestroyContext(decrypt_context, PR_TRUE);
	}

	return err;
	}

	/*
	* hash/hmac/digest functions
	*/

	static int nssstring_to_crypto_hash_type(const char* crypto_hash_type)
	{
	if (strcmp(crypto_hash_type, "none") == 0) {
	return CRYPTO_HASH_TYPE_NONE;
	} else if (strcmp(crypto_hash_type, "md5") == 0) {
	return CRYPTO_HASH_TYPE_MD5;
	} else if (strcmp(crypto_hash_type, "sha1") == 0) {
	return CRYPTO_HASH_TYPE_SHA1;
	} else if (strcmp(crypto_hash_type, "sha256") == 0) {
	return CRYPTO_HASH_TYPE_SHA256;
	} else if (strcmp(crypto_hash_type, "sha384") == 0) {
	return CRYPTO_HASH_TYPE_SHA384;
	} else if (strcmp(crypto_hash_type, "sha512") == 0) {
	return CRYPTO_HASH_TYPE_SHA512;
	}

	return -1;
	}

	-static int init_nss_hash(knet_handle_t knet_h)
	+static int init_nss_hash(knet_handle_t knet_h, struct crypto_instance *crypto_instance)
	{
	- struct nsscrypto_instance *instance = knet_h->crypto_instance->model_instance;
	+ struct nsscrypto_instance *instance = crypto_instance->model_instance;

	if (!hash_to_nss[instance->crypto_hash_type]) {
	return 0;
	}

	- instance->nss_sym_key_sign = nssimport_symmetric_key(knet_h, SYM_KEY_TYPE_HASH);
	+ instance->nss_sym_key_sign = nssimport_symmetric_key(knet_h, crypto_instance, SYM_KEY_TYPE_HASH);
	if (instance->nss_sym_key_sign == NULL) {
	errno = ENXIO; /* NSS reported error */
	return -1;
	}

	return 0;
	}

	static int calculate_nss_hash(
	knet_handle_t knet_h,
	const unsigned char *buf,
	const size_t buf_len,
	unsigned char *hash)
	{
	struct nsscrypto_instance *instance = knet_h->crypto_instance->model_instance;
	PK11Context* hash_context = NULL;
	SECItem hash_param;
	unsigned int hash_tmp_outlen = 0;
	int err = -1;

	/* Now do the digest */
	hash_param.type = siBuffer;
	hash_param.data = 0;
	hash_param.len = 0;

	hash_context = PK11_CreateContextBySymKey(hash_to_nss[instance->crypto_hash_type],
	CKA_SIGN,
	instance->nss_sym_key_sign,
	&hash_param);

	if (!hash_context) {
	log_err(knet_h, KNET_SUB_NSSCRYPTO, "PK11_CreateContext failed (hash) hash_type=%d (err %d): %s",
	(int)hash_to_nss[instance->crypto_hash_type],
	PR_GetError(), PR_ErrorToString(PR_GetError(), PR_LANGUAGE_I_DEFAULT));
	goto out;
	}

	if (PK11_DigestBegin(hash_context) != SECSuccess) {
	log_err(knet_h, KNET_SUB_NSSCRYPTO, "PK11_DigestBegin failed (hash) hash_type=%d (err %d): %s",
	(int)hash_to_nss[instance->crypto_hash_type],
	PR_GetError(), PR_ErrorToString(PR_GetError(), PR_LANGUAGE_I_DEFAULT));
	goto out;
	}

	if (PK11_DigestOp(hash_context, buf, buf_len) != SECSuccess) {
	log_err(knet_h, KNET_SUB_NSSCRYPTO, "PK11_DigestOp failed (hash) hash_type=%d (err %d): %s",
	(int)hash_to_nss[instance->crypto_hash_type],
	PR_GetError(), PR_ErrorToString(PR_GetError(), PR_LANGUAGE_I_DEFAULT));
	goto out;
	}

	if (PK11_DigestFinal(hash_context, hash,
	&hash_tmp_outlen, nsshash_len[instance->crypto_hash_type]) != SECSuccess) {
	log_err(knet_h, KNET_SUB_NSSCRYPTO, "PK11_DigestFinale failed (hash) hash_type=%d (err %d): %s",
	(int)hash_to_nss[instance->crypto_hash_type],
	PR_GetError(), PR_ErrorToString(PR_GetError(), PR_LANGUAGE_I_DEFAULT));
	goto out;
	}

	err = 0;

	out:
	if (hash_context) {
	PK11_DestroyContext(hash_context, PR_TRUE);
	}

	return err;
	}

	/*
	* global/glue nss functions
	*/

	-static int init_nss(knet_handle_t knet_h)
	+static int init_nss(knet_handle_t knet_h, struct crypto_instance *crypto_instance)
	{
	static int at_exit_registered = 0;

	if (!at_exit_registered) {
	if (atexit(nss_atexit_handler)) {
	log_err(knet_h, KNET_SUB_NSSCRYPTO, "Unable to register NSS atexit handler");
	errno = EAGAIN;
	return -1;
	}
	at_exit_registered = 1;
	}

	if (!nss_db_is_init) {
	if (NSS_NoDB_Init(NULL) != SECSuccess) {
	log_err(knet_h, KNET_SUB_NSSCRYPTO, "NSS DB initialization failed (err %d): %s",
	PR_GetError(), PR_ErrorToString(PR_GetError(), PR_LANGUAGE_I_DEFAULT));
	errno = EAGAIN;
	return -1;
	}
	nss_db_is_init = 1;
	}

	- if (init_nss_crypto(knet_h) < 0) {
	+ if (init_nss_crypto(knet_h, crypto_instance) < 0) {
	return -1;
	}

	- if (init_nss_hash(knet_h) < 0) {
	+ if (init_nss_hash(knet_h, crypto_instance) < 0) {
	return -1;
	}

	return 0;
	}

	/*
	* exported API
	*/

	static int nsscrypto_encrypt_and_signv (
	knet_handle_t knet_h,
	const struct iovec *iov_in,
	int iovcnt_in,
	unsigned char *buf_out,
	ssize_t *buf_out_len)
	{
	struct nsscrypto_instance *instance = knet_h->crypto_instance->model_instance;
	int i;

	if (cipher_to_nss[instance->crypto_cipher_type]) {
	if (encrypt_nss(knet_h, iov_in, iovcnt_in, buf_out, buf_out_len) < 0) {
	return -1;
	}
	} else {
	*buf_out_len = 0;
	for (i=0; i<iovcnt_in; i++) {
	memmove(buf_out + *buf_out_len, iov_in[i].iov_base, iov_in[i].iov_len);
	buf_out_len = buf_out_len + iov_in[i].iov_len;
	}
	}

	if (hash_to_nss[instance->crypto_hash_type]) {
	if (calculate_nss_hash(knet_h, buf_out, buf_out_len, buf_out + buf_out_len) < 0) {
	return -1;
	}
	buf_out_len = buf_out_len + nsshash_len[instance->crypto_hash_type];
	}

	return 0;
	}

	static int nsscrypto_encrypt_and_sign (
	knet_handle_t knet_h,
	const unsigned char *buf_in,
	const ssize_t buf_in_len,
	unsigned char *buf_out,
	ssize_t *buf_out_len)
	{
	struct iovec iov_in;

	memset(&iov_in, 0, sizeof(iov_in));
	iov_in.iov_base = (unsigned char *)buf_in;
	iov_in.iov_len = buf_in_len;

	return nsscrypto_encrypt_and_signv(knet_h, &iov_in, 1, buf_out, buf_out_len);
	}

	static int nsscrypto_authenticate_and_decrypt (
	knet_handle_t knet_h,
	const unsigned char *buf_in,
	const ssize_t buf_in_len,
	unsigned char *buf_out,
	ssize_t *buf_out_len)
	{
	struct nsscrypto_instance *instance = knet_h->crypto_instance->model_instance;
	ssize_t temp_len = buf_in_len;

	if (hash_to_nss[instance->crypto_hash_type]) {
	unsigned char tmp_hash[nsshash_len[instance->crypto_hash_type]];
	ssize_t temp_buf_len = buf_in_len - nsshash_len[instance->crypto_hash_type];

	if ((temp_buf_len <= 0) \|\| (temp_buf_len > KNET_MAX_PACKET_SIZE)) {
	log_err(knet_h, KNET_SUB_NSSCRYPTO, "Incorrect packet size.");
	return -1;
	}

	if (calculate_nss_hash(knet_h, buf_in, temp_buf_len, tmp_hash) < 0) {
	return -1;
	}

	if (memcmp(tmp_hash, buf_in + temp_buf_len, nsshash_len[instance->crypto_hash_type]) != 0) {
	log_err(knet_h, KNET_SUB_NSSCRYPTO, "Digest does not match");
	return -1;
	}

	temp_len = temp_len - nsshash_len[instance->crypto_hash_type];
	*buf_out_len = temp_len;
	}

	if (cipher_to_nss[instance->crypto_cipher_type]) {
	if (decrypt_nss(knet_h, buf_in, temp_len, buf_out, buf_out_len) < 0) {
	return -1;
	}
	} else {
	memmove(buf_out, buf_in, temp_len);
	*buf_out_len = temp_len;
	}

	return 0;
	}

	static void nsscrypto_fini(
	- knet_handle_t knet_h)
	+ knet_handle_t knet_h,
	+ struct crypto_instance *crypto_instance)
	{
	- struct nsscrypto_instance *nsscrypto_instance = knet_h->crypto_instance->model_instance;
	+ struct nsscrypto_instance *nsscrypto_instance = crypto_instance->model_instance;

	if (nsscrypto_instance) {
	if (nsscrypto_instance->nss_sym_key) {
	PK11_FreeSymKey(nsscrypto_instance->nss_sym_key);
	nsscrypto_instance->nss_sym_key = NULL;
	}
	if (nsscrypto_instance->nss_sym_key_sign) {
	PK11_FreeSymKey(nsscrypto_instance->nss_sym_key_sign);
	nsscrypto_instance->nss_sym_key_sign = NULL;
	}
	free(nsscrypto_instance);
	- knet_h->crypto_instance->model_instance = NULL;
	+ crypto_instance->model_instance = NULL;
	}

	return;
	}

	static int nsscrypto_init(
	knet_handle_t knet_h,
	+ struct crypto_instance *crypto_instance,
	struct knet_handle_crypto_cfg *knet_handle_crypto_cfg)
	{
	struct nsscrypto_instance *nsscrypto_instance = NULL;
	int savederrno;

	log_debug(knet_h, KNET_SUB_NSSCRYPTO,
	"Initizializing nss crypto module [%s/%s]",
	knet_handle_crypto_cfg->crypto_cipher_type,
	knet_handle_crypto_cfg->crypto_hash_type);

	- knet_h->crypto_instance->model_instance = malloc(sizeof(struct nsscrypto_instance));
	- if (!knet_h->crypto_instance->model_instance) {
	+ crypto_instance->model_instance = malloc(sizeof(struct nsscrypto_instance));
	+ if (!crypto_instance->model_instance) {
	log_err(knet_h, KNET_SUB_NSSCRYPTO, "Unable to allocate memory for nss model instance");
	errno = ENOMEM;
	return -1;
	}

	- nsscrypto_instance = knet_h->crypto_instance->model_instance;
	+ nsscrypto_instance = crypto_instance->model_instance;

	memset(nsscrypto_instance, 0, sizeof(struct nsscrypto_instance));

	nsscrypto_instance->crypto_cipher_type = nssstring_to_crypto_cipher_type(knet_handle_crypto_cfg->crypto_cipher_type);
	if (nsscrypto_instance->crypto_cipher_type < 0) {
	log_err(knet_h, KNET_SUB_NSSCRYPTO, "unknown crypto cipher type requested");
	savederrno = ENXIO;
	goto out_err;
	}

	nsscrypto_instance->crypto_hash_type = nssstring_to_crypto_hash_type(knet_handle_crypto_cfg->crypto_hash_type);
	if (nsscrypto_instance->crypto_hash_type < 0) {
	log_err(knet_h, KNET_SUB_NSSCRYPTO, "unknown crypto hash type requested");
	savederrno = ENXIO;
	goto out_err;
	}

	if ((nsscrypto_instance->crypto_cipher_type > 0) &&
	(nsscrypto_instance->crypto_hash_type == 0)) {
	log_err(knet_h, KNET_SUB_NSSCRYPTO, "crypto communication requires hash specified");
	savederrno = EINVAL;
	goto out_err;
	}

	nsscrypto_instance->private_key = knet_handle_crypto_cfg->private_key;
	nsscrypto_instance->private_key_len = knet_handle_crypto_cfg->private_key_len;

	- if (init_nss(knet_h) < 0) {
	+ if (init_nss(knet_h, crypto_instance) < 0) {
	savederrno = errno;
	goto out_err;
	}

	- knet_h->sec_header_size = 0;
	+ crypto_instance->sec_header_size = 0;

	if (nsscrypto_instance->crypto_hash_type > 0) {
	- knet_h->sec_header_size += nsshash_len[nsscrypto_instance->crypto_hash_type];
	- knet_h->sec_hash_size = nsshash_len[nsscrypto_instance->crypto_hash_type];
	+ crypto_instance->sec_header_size += nsshash_len[nsscrypto_instance->crypto_hash_type];
	+ crypto_instance->sec_hash_size = nsshash_len[nsscrypto_instance->crypto_hash_type];
	}

	if (nsscrypto_instance->crypto_cipher_type > 0) {
	int block_size;

	if (nsscypher_block_len[nsscrypto_instance->crypto_cipher_type]) {
	block_size = nsscypher_block_len[nsscrypto_instance->crypto_cipher_type];
	} else {
	block_size = PK11_GetBlockSize(nsscrypto_instance->crypto_cipher_type, NULL);
	if (block_size < 0) {
	savederrno = ENXIO;
	goto out_err;
	}
	}

	- knet_h->sec_header_size += (block_size * 2);
	- knet_h->sec_header_size += SALT_SIZE;
	- knet_h->sec_salt_size = SALT_SIZE;
	- knet_h->sec_block_size = block_size;
	+ crypto_instance->sec_header_size += (block_size * 2);
	+ crypto_instance->sec_header_size += SALT_SIZE;
	+ crypto_instance->sec_salt_size = SALT_SIZE;
	+ crypto_instance->sec_block_size = block_size;
	}

	return 0;

	out_err:
	- nsscrypto_fini(knet_h);
	+ nsscrypto_fini(knet_h, crypto_instance);
	errno = savederrno;
	return -1;
	}

	crypto_ops_t crypto_model = {
	KNET_CRYPTO_MODEL_ABI,
	nsscrypto_init,
	nsscrypto_fini,
	nsscrypto_encrypt_and_sign,
	nsscrypto_encrypt_and_signv,
	nsscrypto_authenticate_and_decrypt
	};
	diff --git a/libknet/crypto_openssl.c b/libknet/crypto_openssl.c
	index 73058ccf..5c7a74a1 100644
	--- a/libknet/crypto_openssl.c
	+++ b/libknet/crypto_openssl.c
	@@ -1,613 +1,615 @@
	/*
	* Copyright (C) 2017-2019 Red Hat, Inc. All rights reserved.
	*
	* Author: Fabio M. Di Nitto <fabbione@kronosnet.org>
	*
	* This software licensed under GPL-2.0+, LGPL-2.0+
	*/
	#define KNET_MODULE

	#include "config.h"

	#include <string.h>
	#include <errno.h>
	#include <dlfcn.h>
	#include <openssl/conf.h>
	#include <openssl/evp.h>
	#include <openssl/hmac.h>
	#include <openssl/rand.h>
	#include <openssl/err.h>

	#include "logging.h"
	#include "crypto_model.h"

	/*
	* 1.0.2 requires at least 120 bytes
	* 1.1.0 requires at least 256 bytes
	*/
	#define SSLERR_BUF_SIZE 512

	/*
	* crypto definitions and conversion tables
	*/

	#define SALT_SIZE 16

	struct opensslcrypto_instance {
	void *private_key;

	int private_key_len;

	const EVP_CIPHER *crypto_cipher_type;

	const EVP_MD *crypto_hash_type;
	};

	/*
	* crypt/decrypt functions openssl1.0
	*/

	#ifdef BUILDCRYPTOOPENSSL10
	static int encrypt_openssl(
	knet_handle_t knet_h,
	const struct iovec *iov,
	int iovcnt,
	unsigned char *buf_out,
	ssize_t *buf_out_len)
	{
	struct opensslcrypto_instance *instance = knet_h->crypto_instance->model_instance;
	EVP_CIPHER_CTX ctx;
	int tmplen = 0, offset = 0;
	unsigned char *salt = buf_out;
	unsigned char *data = buf_out + SALT_SIZE;
	int err = 0;
	int i;
	char sslerr[SSLERR_BUF_SIZE];

	EVP_CIPHER_CTX_init(&ctx);

	/*
	* contribute to PRNG for each packet we send/receive
	*/
	RAND_seed((unsigned char *)iov[iovcnt - 1].iov_base, iov[iovcnt - 1].iov_len);

	if (!RAND_bytes(salt, SALT_SIZE)) {
	ERR_error_string_n(ERR_get_error(), sslerr, sizeof(sslerr));
	log_err(knet_h, KNET_SUB_OPENSSLCRYPTO, "Unable to get random salt data: %s", sslerr);
	err = -1;
	goto out;
	}

	/*
	* add warning re keylength
	*/
	EVP_EncryptInit_ex(&ctx, instance->crypto_cipher_type, NULL, instance->private_key, salt);

	for (i=0; i<iovcnt; i++) {
	if (!EVP_EncryptUpdate(&ctx,
	data + offset, &tmplen,
	(unsigned char *)iov[i].iov_base, iov[i].iov_len)) {
	ERR_error_string_n(ERR_get_error(), sslerr, sizeof(sslerr));
	log_err(knet_h, KNET_SUB_OPENSSLCRYPTO, "Unable to encrypt: %s", sslerr);
	err = -1;
	goto out;
	}
	offset = offset + tmplen;
	}

	if (!EVP_EncryptFinal_ex(&ctx, data + offset, &tmplen)) {
	ERR_error_string_n(ERR_get_error(), sslerr, sizeof(sslerr));
	log_err(knet_h, KNET_SUB_OPENSSLCRYPTO, "Unable to finalize encrypt: %s", sslerr);
	err = -1;
	goto out;
	}

	*buf_out_len = offset + tmplen + SALT_SIZE;

	out:
	EVP_CIPHER_CTX_cleanup(&ctx);
	return err;
	}

	static int decrypt_openssl (
	knet_handle_t knet_h,
	const unsigned char *buf_in,
	const ssize_t buf_in_len,
	unsigned char *buf_out,
	ssize_t *buf_out_len)
	{
	struct opensslcrypto_instance *instance = knet_h->crypto_instance->model_instance;
	EVP_CIPHER_CTX ctx;
	int tmplen1 = 0, tmplen2 = 0;
	unsigned char salt = (unsigned char )buf_in;
	unsigned char *data = salt + SALT_SIZE;
	int datalen = buf_in_len - SALT_SIZE;
	int err = 0;
	char sslerr[SSLERR_BUF_SIZE];

	EVP_CIPHER_CTX_init(&ctx);

	/*
	* contribute to PRNG for each packet we send/receive
	*/
	RAND_seed(buf_in, buf_in_len);

	/*
	* add warning re keylength
	*/
	EVP_DecryptInit_ex(&ctx, instance->crypto_cipher_type, NULL, instance->private_key, salt);

	if (!EVP_DecryptUpdate(&ctx, buf_out, &tmplen1, data, datalen)) {
	ERR_error_string_n(ERR_get_error(), sslerr, sizeof(sslerr));
	log_err(knet_h, KNET_SUB_OPENSSLCRYPTO, "Unable to decrypt: %s", sslerr);
	err = -1;
	goto out;
	}

	if (!EVP_DecryptFinal_ex(&ctx, buf_out + tmplen1, &tmplen2)) {
	ERR_error_string_n(ERR_get_error(), sslerr, sizeof(sslerr));
	log_err(knet_h, KNET_SUB_OPENSSLCRYPTO, "Unable to finalize decrypt: %s", sslerr);
	err = -1;
	goto out;
	}

	*buf_out_len = tmplen1 + tmplen2;

	out:
	EVP_CIPHER_CTX_cleanup(&ctx);
	return err;
	}
	#endif

	#ifdef BUILDCRYPTOOPENSSL11
	static int encrypt_openssl(
	knet_handle_t knet_h,
	const struct iovec *iov,
	int iovcnt,
	unsigned char *buf_out,
	ssize_t *buf_out_len)
	{
	struct opensslcrypto_instance *instance = knet_h->crypto_instance->model_instance;
	EVP_CIPHER_CTX *ctx;
	int tmplen = 0, offset = 0;
	unsigned char *salt = buf_out;
	unsigned char *data = buf_out + SALT_SIZE;
	int err = 0;
	int i;
	char sslerr[SSLERR_BUF_SIZE];

	ctx = EVP_CIPHER_CTX_new();

	/*
	* contribute to PRNG for each packet we send/receive
	*/
	RAND_seed((unsigned char *)iov[iovcnt - 1].iov_base, iov[iovcnt - 1].iov_len);

	if (!RAND_bytes(salt, SALT_SIZE)) {
	ERR_error_string_n(ERR_get_error(), sslerr, sizeof(sslerr));
	log_err(knet_h, KNET_SUB_OPENSSLCRYPTO, "Unable to get random salt data: %s", sslerr);
	err = -1;
	goto out;
	}

	/*
	* add warning re keylength
	*/
	EVP_EncryptInit_ex(ctx, instance->crypto_cipher_type, NULL, instance->private_key, salt);

	for (i=0; i<iovcnt; i++) {
	if (!EVP_EncryptUpdate(ctx,
	data + offset, &tmplen,
	(unsigned char *)iov[i].iov_base, iov[i].iov_len)) {
	ERR_error_string_n(ERR_get_error(), sslerr, sizeof(sslerr));
	log_err(knet_h, KNET_SUB_OPENSSLCRYPTO, "Unable to encrypt: %s", sslerr);
	err = -1;
	goto out;
	}
	offset = offset + tmplen;
	}

	if (!EVP_EncryptFinal_ex(ctx, data + offset, &tmplen)) {
	ERR_error_string_n(ERR_get_error(), sslerr, sizeof(sslerr));
	log_err(knet_h, KNET_SUB_OPENSSLCRYPTO, "Unable to finalize encrypt: %s", sslerr);
	err = -1;
	goto out;
	}

	*buf_out_len = offset + tmplen + SALT_SIZE;

	out:
	EVP_CIPHER_CTX_free(ctx);
	return err;
	}

	static int decrypt_openssl (
	knet_handle_t knet_h,
	const unsigned char *buf_in,
	const ssize_t buf_in_len,
	unsigned char *buf_out,
	ssize_t *buf_out_len)
	{
	struct opensslcrypto_instance *instance = knet_h->crypto_instance->model_instance;
	EVP_CIPHER_CTX *ctx = NULL;
	int tmplen1 = 0, tmplen2 = 0;
	unsigned char salt = (unsigned char )buf_in;
	unsigned char *data = salt + SALT_SIZE;
	int datalen = buf_in_len - SALT_SIZE;
	int err = 0;
	char sslerr[SSLERR_BUF_SIZE];

	if (datalen <= 0) {
	log_err(knet_h, KNET_SUB_OPENSSLCRYPTO, "Packet is too short");
	err = -1;
	goto out;
	}

	ctx = EVP_CIPHER_CTX_new();

	/*
	* contribute to PRNG for each packet we send/receive
	*/
	RAND_seed(buf_in, buf_in_len);

	/*
	* add warning re keylength
	*/
	EVP_DecryptInit_ex(ctx, instance->crypto_cipher_type, NULL, instance->private_key, salt);

	if (!EVP_DecryptUpdate(ctx, buf_out, &tmplen1, data, datalen)) {
	ERR_error_string_n(ERR_get_error(), sslerr, sizeof(sslerr));
	log_err(knet_h, KNET_SUB_OPENSSLCRYPTO, "Unable to decrypt: %s", sslerr);
	err = -1;
	goto out;
	}

	if (!EVP_DecryptFinal_ex(ctx, buf_out + tmplen1, &tmplen2)) {
	ERR_error_string_n(ERR_get_error(), sslerr, sizeof(sslerr));
	log_err(knet_h, KNET_SUB_OPENSSLCRYPTO, "Unable to finalize decrypt: %s", sslerr);
	err = -1;
	goto out;
	}

	*buf_out_len = tmplen1 + tmplen2;

	out:
	if (ctx) {
	EVP_CIPHER_CTX_free(ctx);
	}
	return err;
	}
	#endif

	/*
	* hash/hmac/digest functions
	*/

	static int calculate_openssl_hash(
	knet_handle_t knet_h,
	const unsigned char *buf,
	const size_t buf_len,
	unsigned char *hash)
	{
	struct opensslcrypto_instance *instance = knet_h->crypto_instance->model_instance;
	unsigned int hash_len = 0;
	unsigned char *hash_out = NULL;
	char sslerr[SSLERR_BUF_SIZE];

	hash_out = HMAC(instance->crypto_hash_type,
	instance->private_key, instance->private_key_len,
	buf, buf_len,
	hash, &hash_len);

	if ((!hash_out) \|\| (hash_len != knet_h->sec_hash_size)) {
	ERR_error_string_n(ERR_get_error(), sslerr, sizeof(sslerr));
	log_err(knet_h, KNET_SUB_OPENSSLCRYPTO, "Unable to calculate hash: %s", sslerr);
	return -1;
	}

	return 0;
	}

	/*
	* exported API
	*/

	static int opensslcrypto_encrypt_and_signv (
	knet_handle_t knet_h,
	const struct iovec *iov_in,
	int iovcnt_in,
	unsigned char *buf_out,
	ssize_t *buf_out_len)
	{
	struct opensslcrypto_instance *instance = knet_h->crypto_instance->model_instance;
	int i;

	if (instance->crypto_cipher_type) {
	if (encrypt_openssl(knet_h, iov_in, iovcnt_in, buf_out, buf_out_len) < 0) {
	return -1;
	}
	} else {
	*buf_out_len = 0;
	for (i=0; i<iovcnt_in; i++) {
	memmove(buf_out + *buf_out_len, iov_in[i].iov_base, iov_in[i].iov_len);
	buf_out_len = buf_out_len + iov_in[i].iov_len;
	}
	}

	if (instance->crypto_hash_type) {
	if (calculate_openssl_hash(knet_h, buf_out, buf_out_len, buf_out + buf_out_len) < 0) {
	return -1;
	}
	buf_out_len = buf_out_len + knet_h->sec_hash_size;
	}

	return 0;
	}

	static int opensslcrypto_encrypt_and_sign (
	knet_handle_t knet_h,
	const unsigned char *buf_in,
	const ssize_t buf_in_len,
	unsigned char *buf_out,
	ssize_t *buf_out_len)
	{
	struct iovec iov_in;

	memset(&iov_in, 0, sizeof(iov_in));
	iov_in.iov_base = (unsigned char *)buf_in;
	iov_in.iov_len = buf_in_len;

	return opensslcrypto_encrypt_and_signv(knet_h, &iov_in, 1, buf_out, buf_out_len);
	}

	static int opensslcrypto_authenticate_and_decrypt (
	knet_handle_t knet_h,
	const unsigned char *buf_in,
	const ssize_t buf_in_len,
	unsigned char *buf_out,
	ssize_t *buf_out_len)
	{
	struct opensslcrypto_instance *instance = knet_h->crypto_instance->model_instance;
	ssize_t temp_len = buf_in_len;

	if (instance->crypto_hash_type) {
	unsigned char tmp_hash[knet_h->sec_hash_size];
	ssize_t temp_buf_len = buf_in_len - knet_h->sec_hash_size;

	if ((temp_buf_len <= 0) \|\| (temp_buf_len > KNET_MAX_PACKET_SIZE)) {
	log_err(knet_h, KNET_SUB_OPENSSLCRYPTO, "Incorrect packet size.");
	return -1;
	}

	if (calculate_openssl_hash(knet_h, buf_in, temp_buf_len, tmp_hash) < 0) {
	return -1;
	}

	if (memcmp(tmp_hash, buf_in + temp_buf_len, knet_h->sec_hash_size) != 0) {
	log_err(knet_h, KNET_SUB_OPENSSLCRYPTO, "Digest does not match");
	return -1;
	}

	temp_len = temp_len - knet_h->sec_hash_size;
	*buf_out_len = temp_len;
	}
	if (instance->crypto_cipher_type) {
	if (decrypt_openssl(knet_h, buf_in, temp_len, buf_out, buf_out_len) < 0) {
	return -1;
	}
	} else {
	memmove(buf_out, buf_in, temp_len);
	*buf_out_len = temp_len;
	}

	return 0;
	}

	#ifdef BUILDCRYPTOOPENSSL10
	static pthread_mutex_t *openssl_internal_lock;

	static void openssl_internal_locking_callback(int mode, int type, char *file, int line)
	{
	if (mode & CRYPTO_LOCK) {
	(void)pthread_mutex_lock(&(openssl_internal_lock[type]));
	} else {
	pthread_mutex_unlock(&(openssl_internal_lock[type]));
	}
	}

	static pthread_t openssl_internal_thread_id(void)
	{
	return pthread_self();
	}

	static void openssl_internal_lock_cleanup(void)
	{
	int i;

	CRYPTO_set_locking_callback(NULL);
	CRYPTO_set_id_callback(NULL);

	for (i = 0; i < CRYPTO_num_locks(); i++) {
	pthread_mutex_destroy(&(openssl_internal_lock[i]));
	}

	if (openssl_internal_lock) {
	free(openssl_internal_lock);
	}

	return;
	}

	static int openssl_internal_lock_setup(void)
	{
	int savederrno = 0, err = 0;
	int i;

	openssl_internal_lock = malloc(CRYPTO_num_locks() * sizeof(pthread_mutex_t));
	if (!openssl_internal_lock) {
	savederrno = errno;
	err = -1;
	goto out;
	}

	for (i = 0; i < CRYPTO_num_locks(); i++) {
	savederrno = pthread_mutex_init(&(openssl_internal_lock[i]), NULL);
	if (savederrno) {
	err = -1;
	goto out;
	}
	}

	CRYPTO_set_id_callback((void *)openssl_internal_thread_id);
	CRYPTO_set_locking_callback((void *)&openssl_internal_locking_callback);

	out:
	if (err) {
	openssl_internal_lock_cleanup();
	}
	errno = savederrno;
	return err;
	}
	#endif

	static void opensslcrypto_fini(
	- knet_handle_t knet_h)
	+ knet_handle_t knet_h,
	+ struct crypto_instance *crypto_instance)
	{
	- struct opensslcrypto_instance *opensslcrypto_instance = knet_h->crypto_instance->model_instance;
	+ struct opensslcrypto_instance *opensslcrypto_instance = crypto_instance->model_instance;

	if (opensslcrypto_instance) {
	#ifdef BUILDCRYPTOOPENSSL10
	openssl_internal_lock_cleanup();
	#endif
	if (opensslcrypto_instance->private_key) {
	free(opensslcrypto_instance->private_key);
	opensslcrypto_instance->private_key = NULL;
	}
	free(opensslcrypto_instance);
	- knet_h->crypto_instance->model_instance = NULL;
	+ crypto_instance->model_instance = NULL;
	}

	return;
	}

	static int opensslcrypto_init(
	knet_handle_t knet_h,
	+ struct crypto_instance *crypto_instance,
	struct knet_handle_crypto_cfg *knet_handle_crypto_cfg)
	{
	static int openssl_is_init = 0;
	struct opensslcrypto_instance *opensslcrypto_instance = NULL;
	int savederrno;

	log_debug(knet_h, KNET_SUB_OPENSSLCRYPTO,
	"Initizializing openssl crypto module [%s/%s]",
	knet_handle_crypto_cfg->crypto_cipher_type,
	knet_handle_crypto_cfg->crypto_hash_type);

	if (!openssl_is_init) {
	#ifdef BUILDCRYPTOOPENSSL10
	ERR_load_crypto_strings();
	OPENSSL_add_all_algorithms_noconf();
	#endif
	#ifdef BUILDCRYPTOOPENSSL11
	if (!OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS \
	\| OPENSSL_INIT_ADD_ALL_DIGESTS, NULL)) {
	log_err(knet_h, KNET_SUB_OPENSSLCRYPTO, "Unable to init openssl");
	errno = EAGAIN;
	return -1;
	}
	#endif
	openssl_is_init = 1;
	}

	#ifdef BUILDCRYPTOOPENSSL10
	if (openssl_internal_lock_setup() < 0) {
	log_err(knet_h, KNET_SUB_OPENSSLCRYPTO, "Unable to init openssl");
	errno = EAGAIN;
	return -1;
	}
	#endif

	- knet_h->crypto_instance->model_instance = malloc(sizeof(struct opensslcrypto_instance));
	- if (!knet_h->crypto_instance->model_instance) {
	+ crypto_instance->model_instance = malloc(sizeof(struct opensslcrypto_instance));
	+ if (!crypto_instance->model_instance) {
	log_err(knet_h, KNET_SUB_OPENSSLCRYPTO, "Unable to allocate memory for openssl model instance");
	errno = ENOMEM;
	return -1;
	}

	- opensslcrypto_instance = knet_h->crypto_instance->model_instance;
	+ opensslcrypto_instance = crypto_instance->model_instance;

	memset(opensslcrypto_instance, 0, sizeof(struct opensslcrypto_instance));

	if (strcmp(knet_handle_crypto_cfg->crypto_cipher_type, "none") == 0) {
	opensslcrypto_instance->crypto_cipher_type = NULL;
	} else {
	opensslcrypto_instance->crypto_cipher_type = EVP_get_cipherbyname(knet_handle_crypto_cfg->crypto_cipher_type);
	if (!opensslcrypto_instance->crypto_cipher_type) {
	log_err(knet_h, KNET_SUB_OPENSSLCRYPTO, "unknown crypto cipher type requested");
	savederrno = ENXIO;
	goto out_err;
	}
	}

	if (strcmp(knet_handle_crypto_cfg->crypto_hash_type, "none") == 0) {
	opensslcrypto_instance->crypto_hash_type = NULL;
	} else {
	opensslcrypto_instance->crypto_hash_type = EVP_get_digestbyname(knet_handle_crypto_cfg->crypto_hash_type);
	if (!opensslcrypto_instance->crypto_hash_type) {
	log_err(knet_h, KNET_SUB_OPENSSLCRYPTO, "unknown crypto hash type requested");
	savederrno = ENXIO;
	goto out_err;
	}
	}

	if ((opensslcrypto_instance->crypto_cipher_type) &&
	(!opensslcrypto_instance->crypto_hash_type)) {
	log_err(knet_h, KNET_SUB_OPENSSLCRYPTO, "crypto communication requires hash specified");
	savederrno = EINVAL;
	goto out_err;
	}

	opensslcrypto_instance->private_key = malloc(knet_handle_crypto_cfg->private_key_len);
	if (!opensslcrypto_instance->private_key) {
	log_err(knet_h, KNET_SUB_OPENSSLCRYPTO, "Unable to allocate memory for openssl private key");
	savederrno = ENOMEM;
	goto out_err;
	}
	memmove(opensslcrypto_instance->private_key, knet_handle_crypto_cfg->private_key, knet_handle_crypto_cfg->private_key_len);
	opensslcrypto_instance->private_key_len = knet_handle_crypto_cfg->private_key_len;

	- knet_h->sec_header_size = 0;
	+ crypto_instance->sec_header_size = 0;

	if (opensslcrypto_instance->crypto_hash_type) {
	- knet_h->sec_hash_size = EVP_MD_size(opensslcrypto_instance->crypto_hash_type);
	- knet_h->sec_header_size += knet_h->sec_hash_size;
	+ crypto_instance->sec_hash_size = EVP_MD_size(opensslcrypto_instance->crypto_hash_type);
	+ crypto_instance->sec_header_size += crypto_instance->sec_hash_size;
	}

	if (opensslcrypto_instance->crypto_cipher_type) {
	size_t block_size;

	block_size = EVP_CIPHER_block_size(opensslcrypto_instance->crypto_cipher_type);

	- knet_h->sec_header_size += (block_size * 2);
	- knet_h->sec_header_size += SALT_SIZE;
	- knet_h->sec_salt_size = SALT_SIZE;
	- knet_h->sec_block_size = block_size;
	+ crypto_instance->sec_header_size += (block_size * 2);
	+ crypto_instance->sec_header_size += SALT_SIZE;
	+ crypto_instance->sec_salt_size = SALT_SIZE;
	+ crypto_instance->sec_block_size = block_size;
	}

	return 0;

	out_err:
	- opensslcrypto_fini(knet_h);
	+ opensslcrypto_fini(knet_h, crypto_instance);

	errno = savederrno;
	return -1;
	}

	crypto_ops_t crypto_model = {
	KNET_CRYPTO_MODEL_ABI,
	opensslcrypto_init,
	opensslcrypto_fini,
	opensslcrypto_encrypt_and_sign,
	opensslcrypto_encrypt_and_signv,
	opensslcrypto_authenticate_and_decrypt
	};
	diff --git a/libknet/handle.c b/libknet/handle.c
	index 7009cc34..e95c6c14 100644
	--- a/libknet/handle.c
	+++ b/libknet/handle.c
	@@ -1,1654 +1,1653 @@
	/*
	* Copyright (C) 2010-2019 Red Hat, Inc. All rights reserved.
	*
	* Authors: Fabio M. Di Nitto <fabbione@kronosnet.org>
	* Federico Simoncelli <fsimon@kronosnet.org>
	*
	* This software licensed under GPL-2.0+, LGPL-2.0+
	*/

	#include "config.h"

	#include <stdlib.h>
	#include <string.h>
	#include <unistd.h>
	#include <errno.h>
	#include <pthread.h>
	#include <sys/uio.h>
	#include <math.h>
	#include <sys/time.h>
	#include <sys/resource.h>

	#include "internals.h"
	#include "crypto.h"
	#include "links.h"
	#include "compress.h"
	#include "compat.h"
	#include "common.h"
	#include "threads_common.h"
	#include "threads_heartbeat.h"
	#include "threads_pmtud.h"
	#include "threads_dsthandler.h"
	#include "threads_rx.h"
	#include "threads_tx.h"
	#include "transports.h"
	#include "transport_common.h"
	#include "logging.h"

	static pthread_mutex_t handle_config_mutex = PTHREAD_MUTEX_INITIALIZER;

	pthread_rwlock_t shlib_rwlock;
	static uint8_t shlib_wrlock_init = 0;

	static uint32_t knet_ref = 0;

	static int _init_shlib_tracker(knet_handle_t knet_h)
	{
	int savederrno = 0;

	if (!shlib_wrlock_init) {
	savederrno = pthread_rwlock_init(&shlib_rwlock, NULL);
	if (savederrno) {
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to initialize shared lib rwlock: %s",
	strerror(savederrno));
	errno = savederrno;
	return -1;
	}
	shlib_wrlock_init = 1;
	}

	return 0;
	}

	static void _fini_shlib_tracker(void)
	{
	if (knet_ref == 0) {
	pthread_rwlock_destroy(&shlib_rwlock);
	shlib_wrlock_init = 0;
	}
	return;
	}

	static int _init_locks(knet_handle_t knet_h)
	{
	int savederrno = 0;

	savederrno = pthread_rwlock_init(&knet_h->global_rwlock, NULL);
	if (savederrno) {
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to initialize list rwlock: %s",
	strerror(savederrno));
	goto exit_fail;
	}

	savederrno = pthread_mutex_init(&knet_h->threads_status_mutex, NULL);
	if (savederrno) {
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to initialize threads status mutex: %s",
	strerror(savederrno));
	goto exit_fail;
	}

	savederrno = pthread_mutex_init(&knet_h->pmtud_mutex, NULL);
	if (savederrno) {
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to initialize pmtud mutex: %s",
	strerror(savederrno));
	goto exit_fail;
	}

	savederrno = pthread_mutex_init(&knet_h->kmtu_mutex, NULL);
	if (savederrno) {
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to initialize kernel_mtu mutex: %s",
	strerror(savederrno));
	goto exit_fail;
	}

	savederrno = pthread_cond_init(&knet_h->pmtud_cond, NULL);
	if (savederrno) {
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to initialize pmtud conditional mutex: %s",
	strerror(savederrno));
	goto exit_fail;
	}

	savederrno = pthread_mutex_init(&knet_h->hb_mutex, NULL);
	if (savederrno) {
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to initialize hb_thread mutex: %s",
	strerror(savederrno));
	goto exit_fail;
	}

	savederrno = pthread_mutex_init(&knet_h->tx_mutex, NULL);
	if (savederrno) {
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to initialize tx_thread mutex: %s",
	strerror(savederrno));
	goto exit_fail;
	}

	savederrno = pthread_mutex_init(&knet_h->backoff_mutex, NULL);
	if (savederrno) {
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to initialize pong timeout backoff mutex: %s",
	strerror(savederrno));
	goto exit_fail;
	}

	savederrno = pthread_mutex_init(&knet_h->tx_seq_num_mutex, NULL);
	if (savederrno) {
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to initialize tx_seq_num_mutex mutex: %s",
	strerror(savederrno));
	goto exit_fail;
	}

	return 0;

	exit_fail:
	errno = savederrno;
	return -1;
	}

	static void _destroy_locks(knet_handle_t knet_h)
	{
	pthread_rwlock_destroy(&knet_h->global_rwlock);
	pthread_mutex_destroy(&knet_h->pmtud_mutex);
	pthread_mutex_destroy(&knet_h->kmtu_mutex);
	pthread_cond_destroy(&knet_h->pmtud_cond);
	pthread_mutex_destroy(&knet_h->hb_mutex);
	pthread_mutex_destroy(&knet_h->tx_mutex);
	pthread_mutex_destroy(&knet_h->backoff_mutex);
	pthread_mutex_destroy(&knet_h->tx_seq_num_mutex);
	pthread_mutex_destroy(&knet_h->threads_status_mutex);
	}

	static int _init_socks(knet_handle_t knet_h)
	{
	int savederrno = 0;

	if (_init_socketpair(knet_h, knet_h->hostsockfd)) {
	savederrno = errno;
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to initialize internal hostsockpair: %s",
	strerror(savederrno));
	goto exit_fail;
	}

	if (_init_socketpair(knet_h, knet_h->dstsockfd)) {
	savederrno = errno;
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to initialize internal dstsockpair: %s",
	strerror(savederrno));
	goto exit_fail;
	}

	return 0;

	exit_fail:
	errno = savederrno;
	return -1;
	}

	static void _close_socks(knet_handle_t knet_h)
	{
	_close_socketpair(knet_h, knet_h->dstsockfd);
	_close_socketpair(knet_h, knet_h->hostsockfd);
	}

	static int _init_buffers(knet_handle_t knet_h)
	{
	int savederrno = 0;
	int i;
	size_t bufsize;

	for (i = 0; i < PCKT_FRAG_MAX; i++) {
	bufsize = ceil((float)KNET_MAX_PACKET_SIZE / (i + 1)) + KNET_HEADER_ALL_SIZE;
	knet_h->send_to_links_buf[i] = malloc(bufsize);
	if (!knet_h->send_to_links_buf[i]) {
	savederrno = errno;
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to allocate memory datafd to link buffer: %s",
	strerror(savederrno));
	goto exit_fail;
	}
	memset(knet_h->send_to_links_buf[i], 0, bufsize);
	}

	for (i = 0; i < PCKT_RX_BUFS; i++) {
	knet_h->recv_from_links_buf[i] = malloc(KNET_DATABUFSIZE);
	if (!knet_h->recv_from_links_buf[i]) {
	savederrno = errno;
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to allocate memory for link to datafd buffer: %s",
	strerror(savederrno));
	goto exit_fail;
	}
	memset(knet_h->recv_from_links_buf[i], 0, KNET_DATABUFSIZE);
	}

	knet_h->recv_from_sock_buf = malloc(KNET_DATABUFSIZE);
	if (!knet_h->recv_from_sock_buf) {
	savederrno = errno;
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to allocate memory for app to datafd buffer: %s",
	strerror(savederrno));
	goto exit_fail;
	}
	memset(knet_h->recv_from_sock_buf, 0, KNET_DATABUFSIZE);

	knet_h->pingbuf = malloc(KNET_HEADER_PING_SIZE);
	if (!knet_h->pingbuf) {
	savederrno = errno;
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to allocate memory for hearbeat buffer: %s",
	strerror(savederrno));
	goto exit_fail;
	}
	memset(knet_h->pingbuf, 0, KNET_HEADER_PING_SIZE);

	knet_h->pmtudbuf = malloc(KNET_PMTUD_SIZE_V6);
	if (!knet_h->pmtudbuf) {
	savederrno = errno;
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to allocate memory for pmtud buffer: %s",
	strerror(savederrno));
	goto exit_fail;
	}
	memset(knet_h->pmtudbuf, 0, KNET_PMTUD_SIZE_V6);

	for (i = 0; i < PCKT_FRAG_MAX; i++) {
	bufsize = ceil((float)KNET_MAX_PACKET_SIZE / (i + 1)) + KNET_HEADER_ALL_SIZE + KNET_DATABUFSIZE_CRYPT_PAD;
	knet_h->send_to_links_buf_crypt[i] = malloc(bufsize);
	if (!knet_h->send_to_links_buf_crypt[i]) {
	savederrno = errno;
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to allocate memory for crypto datafd to link buffer: %s",
	strerror(savederrno));
	goto exit_fail;
	}
	memset(knet_h->send_to_links_buf_crypt[i], 0, bufsize);
	}

	knet_h->recv_from_links_buf_decrypt = malloc(KNET_DATABUFSIZE_CRYPT);
	if (!knet_h->recv_from_links_buf_decrypt) {
	savederrno = errno;
	log_err(knet_h, KNET_SUB_CRYPTO, "Unable to allocate memory for crypto link to datafd buffer: %s",
	strerror(savederrno));
	goto exit_fail;
	}
	memset(knet_h->recv_from_links_buf_decrypt, 0, KNET_DATABUFSIZE_CRYPT);

	knet_h->recv_from_links_buf_crypt = malloc(KNET_DATABUFSIZE_CRYPT);
	if (!knet_h->recv_from_links_buf_crypt) {
	savederrno = errno;
	log_err(knet_h, KNET_SUB_CRYPTO, "Unable to allocate memory for crypto link to datafd buffer: %s",
	strerror(savederrno));
	goto exit_fail;
	}
	memset(knet_h->recv_from_links_buf_crypt, 0, KNET_DATABUFSIZE_CRYPT);

	knet_h->pingbuf_crypt = malloc(KNET_DATABUFSIZE_CRYPT);
	if (!knet_h->pingbuf_crypt) {
	savederrno = errno;
	log_err(knet_h, KNET_SUB_CRYPTO, "Unable to allocate memory for crypto hearbeat buffer: %s",
	strerror(savederrno));
	goto exit_fail;
	}
	memset(knet_h->pingbuf_crypt, 0, KNET_DATABUFSIZE_CRYPT);

	knet_h->pmtudbuf_crypt = malloc(KNET_DATABUFSIZE_CRYPT);
	if (!knet_h->pmtudbuf_crypt) {
	savederrno = errno;
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to allocate memory for crypto pmtud buffer: %s",
	strerror(savederrno));
	goto exit_fail;
	}
	memset(knet_h->pmtudbuf_crypt, 0, KNET_DATABUFSIZE_CRYPT);

	knet_h->recv_from_links_buf_decompress = malloc(KNET_DATABUFSIZE_COMPRESS);
	if (!knet_h->recv_from_links_buf_decompress) {
	savederrno = errno;
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to allocate memory for decompress buffer: %s",
	strerror(savederrno));
	goto exit_fail;
	}
	memset(knet_h->recv_from_links_buf_decompress, 0, KNET_DATABUFSIZE_COMPRESS);

	knet_h->send_to_links_buf_compress = malloc(KNET_DATABUFSIZE_COMPRESS);
	if (!knet_h->send_to_links_buf_compress) {
	savederrno = errno;
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to allocate memory for compress buffer: %s",
	strerror(savederrno));
	goto exit_fail;
	}
	memset(knet_h->send_to_links_buf_compress, 0, KNET_DATABUFSIZE_COMPRESS);

	memset(knet_h->knet_transport_fd_tracker, 0, sizeof(knet_h->knet_transport_fd_tracker));
	for (i = 0; i < KNET_MAX_FDS; i++) {
	knet_h->knet_transport_fd_tracker[i].transport = KNET_MAX_TRANSPORTS;
	}

	return 0;

	exit_fail:
	errno = savederrno;
	return -1;
	}

	static void _destroy_buffers(knet_handle_t knet_h)
	{
	int i;

	for (i = 0; i < PCKT_FRAG_MAX; i++) {
	free(knet_h->send_to_links_buf[i]);
	free(knet_h->send_to_links_buf_crypt[i]);
	}

	for (i = 0; i < PCKT_RX_BUFS; i++) {
	free(knet_h->recv_from_links_buf[i]);
	}

	free(knet_h->recv_from_links_buf_decompress);
	free(knet_h->send_to_links_buf_compress);
	free(knet_h->recv_from_sock_buf);
	free(knet_h->recv_from_links_buf_decrypt);
	free(knet_h->recv_from_links_buf_crypt);
	free(knet_h->pingbuf);
	free(knet_h->pingbuf_crypt);
	free(knet_h->pmtudbuf);
	free(knet_h->pmtudbuf_crypt);
	}

	static int _init_epolls(knet_handle_t knet_h)
	{
	struct epoll_event ev;
	int savederrno = 0;

	/*
	* even if the kernel does dynamic allocation with epoll_ctl
	* we need to reserve one extra for host to host communication
	*/
	knet_h->send_to_links_epollfd = epoll_create(KNET_EPOLL_MAX_EVENTS + 1);
	if (knet_h->send_to_links_epollfd < 0) {
	savederrno = errno;
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to create epoll datafd to link fd: %s",
	strerror(savederrno));
	goto exit_fail;
	}

	knet_h->recv_from_links_epollfd = epoll_create(KNET_EPOLL_MAX_EVENTS);
	if (knet_h->recv_from_links_epollfd < 0) {
	savederrno = errno;
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to create epoll link to datafd fd: %s",
	strerror(savederrno));
	goto exit_fail;
	}

	knet_h->dst_link_handler_epollfd = epoll_create(KNET_EPOLL_MAX_EVENTS);
	if (knet_h->dst_link_handler_epollfd < 0) {
	savederrno = errno;
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to create epoll dst cache fd: %s",
	strerror(savederrno));
	goto exit_fail;
	}

	if (_fdset_cloexec(knet_h->send_to_links_epollfd)) {
	savederrno = errno;
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to set CLOEXEC on datafd to link epoll fd: %s",
	strerror(savederrno));
	goto exit_fail;
	}

	if (_fdset_cloexec(knet_h->recv_from_links_epollfd)) {
	savederrno = errno;
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to set CLOEXEC on link to datafd epoll fd: %s",
	strerror(savederrno));
	goto exit_fail;
	}

	if (_fdset_cloexec(knet_h->dst_link_handler_epollfd)) {
	savederrno = errno;
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to set CLOEXEC on dst cache epoll fd: %s",
	strerror(savederrno));
	goto exit_fail;
	}

	memset(&ev, 0, sizeof(struct epoll_event));
	ev.events = EPOLLIN;
	ev.data.fd = knet_h->hostsockfd[0];

	if (epoll_ctl(knet_h->send_to_links_epollfd,
	EPOLL_CTL_ADD, knet_h->hostsockfd[0], &ev)) {
	savederrno = errno;
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to add hostsockfd[0] to epoll pool: %s",
	strerror(savederrno));
	goto exit_fail;
	}

	memset(&ev, 0, sizeof(struct epoll_event));
	ev.events = EPOLLIN;
	ev.data.fd = knet_h->dstsockfd[0];

	if (epoll_ctl(knet_h->dst_link_handler_epollfd,
	EPOLL_CTL_ADD, knet_h->dstsockfd[0], &ev)) {
	savederrno = errno;
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to add dstsockfd[0] to epoll pool: %s",
	strerror(savederrno));
	goto exit_fail;
	}

	return 0;

	exit_fail:
	errno = savederrno;
	return -1;
	}

	static void _close_epolls(knet_handle_t knet_h)
	{
	struct epoll_event ev;
	int i;

	memset(&ev, 0, sizeof(struct epoll_event));

	for (i = 0; i < KNET_DATAFD_MAX; i++) {
	if (knet_h->sockfd[i].in_use) {
	epoll_ctl(knet_h->send_to_links_epollfd, EPOLL_CTL_DEL, knet_h->sockfd[i].sockfd[knet_h->sockfd[i].is_created], &ev);
	if (knet_h->sockfd[i].sockfd[knet_h->sockfd[i].is_created]) {
	_close_socketpair(knet_h, knet_h->sockfd[i].sockfd);
	}
	}
	}

	epoll_ctl(knet_h->send_to_links_epollfd, EPOLL_CTL_DEL, knet_h->hostsockfd[0], &ev);
	epoll_ctl(knet_h->dst_link_handler_epollfd, EPOLL_CTL_DEL, knet_h->dstsockfd[0], &ev);
	close(knet_h->send_to_links_epollfd);
	close(knet_h->recv_from_links_epollfd);
	close(knet_h->dst_link_handler_epollfd);
	}

	static int _start_threads(knet_handle_t knet_h)
	{
	int savederrno = 0;

	set_thread_status(knet_h, KNET_THREAD_PMTUD, KNET_THREAD_REGISTERED);
	savederrno = pthread_create(&knet_h->pmtud_link_handler_thread, 0,
	_handle_pmtud_link_thread, (void *) knet_h);
	if (savederrno) {
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to start pmtud link thread: %s",
	strerror(savederrno));
	goto exit_fail;
	}

	set_thread_status(knet_h, KNET_THREAD_DST_LINK, KNET_THREAD_REGISTERED);
	savederrno = pthread_create(&knet_h->dst_link_handler_thread, 0,
	_handle_dst_link_handler_thread, (void *) knet_h);
	if (savederrno) {
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to start dst cache thread: %s",
	strerror(savederrno));
	goto exit_fail;
	}

	set_thread_status(knet_h, KNET_THREAD_TX, KNET_THREAD_REGISTERED);
	savederrno = pthread_create(&knet_h->send_to_links_thread, 0,
	_handle_send_to_links_thread, (void *) knet_h);
	if (savederrno) {
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to start datafd to link thread: %s",
	strerror(savederrno));
	goto exit_fail;
	}

	set_thread_status(knet_h, KNET_THREAD_RX, KNET_THREAD_REGISTERED);
	savederrno = pthread_create(&knet_h->recv_from_links_thread, 0,
	_handle_recv_from_links_thread, (void *) knet_h);
	if (savederrno) {
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to start link to datafd thread: %s",
	strerror(savederrno));
	goto exit_fail;
	}

	set_thread_status(knet_h, KNET_THREAD_HB, KNET_THREAD_REGISTERED);
	savederrno = pthread_create(&knet_h->heartbt_thread, 0,
	_handle_heartbt_thread, (void *) knet_h);
	if (savederrno) {
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to start heartbeat thread: %s",
	strerror(savederrno));
	goto exit_fail;
	}

	return 0;

	exit_fail:
	errno = savederrno;
	return -1;
	}

	static void _stop_threads(knet_handle_t knet_h)
	{
	void *retval;

	wait_all_threads_status(knet_h, KNET_THREAD_STOPPED);

	if (knet_h->heartbt_thread) {
	pthread_cancel(knet_h->heartbt_thread);
	pthread_join(knet_h->heartbt_thread, &retval);
	}

	if (knet_h->send_to_links_thread) {
	pthread_cancel(knet_h->send_to_links_thread);
	pthread_join(knet_h->send_to_links_thread, &retval);
	}

	if (knet_h->recv_from_links_thread) {
	pthread_cancel(knet_h->recv_from_links_thread);
	pthread_join(knet_h->recv_from_links_thread, &retval);
	}

	if (knet_h->dst_link_handler_thread) {
	pthread_cancel(knet_h->dst_link_handler_thread);
	pthread_join(knet_h->dst_link_handler_thread, &retval);
	}

	if (knet_h->pmtud_link_handler_thread) {
	pthread_cancel(knet_h->pmtud_link_handler_thread);
	pthread_join(knet_h->pmtud_link_handler_thread, &retval);
	}
	}

	knet_handle_t knet_handle_new_ex(knet_node_id_t host_id,
	int log_fd,
	uint8_t default_log_level,
	uint64_t flags)
	{
	knet_handle_t knet_h;
	int savederrno = 0;
	struct rlimit cur;

	if (getrlimit(RLIMIT_NOFILE, &cur) < 0) {
	return NULL;
	}

	if ((log_fd < 0) \|\| ((unsigned int)log_fd >= cur.rlim_max)) {
	errno = EINVAL;
	return NULL;
	}

	/*
	* validate incoming request
	*/

	if ((log_fd) && (default_log_level > KNET_LOG_DEBUG)) {
	errno = EINVAL;
	return NULL;
	}

	if (flags > KNET_HANDLE_FLAG_PRIVILEGED * 2 - 1) {
	errno = EINVAL;
	return NULL;
	}

	/*
	* allocate handle
	*/

	knet_h = malloc(sizeof(struct knet_handle));
	if (!knet_h) {
	errno = ENOMEM;
	return NULL;
	}
	memset(knet_h, 0, sizeof(struct knet_handle));

	/*
	* setting up some handle data so that we can use logging
	* also when initializing the library global locks
	* and trackers
	*/

	knet_h->flags = flags;

	/*
	* copy config in place
	*/

	knet_h->host_id = host_id;
	knet_h->logfd = log_fd;
	if (knet_h->logfd > 0) {
	memset(&knet_h->log_levels, default_log_level, KNET_MAX_SUBSYSTEMS);
	}

	/*
	* set pmtud default timers
	*/
	knet_h->pmtud_interval = KNET_PMTUD_DEFAULT_INTERVAL;

	/*
	* set transports reconnect default timers
	*/
	knet_h->reconnect_int = KNET_TRANSPORT_DEFAULT_RECONNECT_INTERVAL;

	/*
	* Set 'min' stats to the maximum value so the
	* first value we get is always less
	*/
	knet_h->stats.tx_compress_time_min = UINT64_MAX;
	knet_h->stats.rx_compress_time_min = UINT64_MAX;
	knet_h->stats.tx_crypt_time_min = UINT64_MAX;
	knet_h->stats.rx_crypt_time_min = UINT64_MAX;

	/*
	* init global shlib tracker
	*/
	savederrno = pthread_mutex_lock(&handle_config_mutex);
	if (savederrno) {
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to get handle mutex lock: %s",
	strerror(savederrno));
	free(knet_h);
	knet_h = NULL;
	errno = savederrno;
	return NULL;
	}

	knet_ref++;

	if (_init_shlib_tracker(knet_h) < 0) {
	savederrno = errno;
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to init handles traceker: %s",
	strerror(savederrno));
	errno = savederrno;
	goto exit_fail;
	}

	pthread_mutex_unlock(&handle_config_mutex);

	/*
	* init main locking structures
	*/

	if (_init_locks(knet_h)) {
	savederrno = errno;
	goto exit_fail;
	}

	/*
	* init sockets
	*/

	if (_init_socks(knet_h)) {
	savederrno = errno;
	goto exit_fail;
	}

	/*
	* allocate packet buffers
	*/

	if (_init_buffers(knet_h)) {
	savederrno = errno;
	goto exit_fail;
	}

	if (compress_init(knet_h)) {
	savederrno = errno;
	goto exit_fail;
	}

	/*
	* create epoll fds
	*/

	if (_init_epolls(knet_h)) {
	savederrno = errno;
	goto exit_fail;
	}

	/*
	* start transports
	*/

	if (start_all_transports(knet_h)) {
	savederrno = errno;
	goto exit_fail;
	}

	/*
	* start internal threads
	*/

	if (_start_threads(knet_h)) {
	savederrno = errno;
	goto exit_fail;
	}

	wait_all_threads_status(knet_h, KNET_THREAD_STARTED);

	errno = 0;
	return knet_h;

	exit_fail:
	knet_handle_free(knet_h);
	errno = savederrno;
	return NULL;
	}

	knet_handle_t knet_handle_new(knet_node_id_t host_id,
	int log_fd,
	uint8_t default_log_level)
	{
	return knet_handle_new_ex(host_id, log_fd, default_log_level, KNET_HANDLE_FLAG_PRIVILEGED);
	}

	int knet_handle_free(knet_handle_t knet_h)
	{
	int savederrno = 0;

	if (!knet_h) {
	errno = EINVAL;
	return -1;
	}

	savederrno = get_global_wrlock(knet_h);
	if (savederrno) {
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to get write lock: %s",
	strerror(savederrno));
	errno = savederrno;
	return -1;
	}

	if (knet_h->host_head != NULL) {
	savederrno = EBUSY;
	log_err(knet_h, KNET_SUB_HANDLE,
	"Unable to free handle: host(s) or listener(s) are still active: %s",
	strerror(savederrno));
	pthread_rwlock_unlock(&knet_h->global_rwlock);
	errno = savederrno;
	return -1;
	}

	knet_h->fini_in_progress = 1;

	pthread_rwlock_unlock(&knet_h->global_rwlock);

	_stop_threads(knet_h);
	stop_all_transports(knet_h);
	_close_epolls(knet_h);
	_destroy_buffers(knet_h);
	_close_socks(knet_h);
	crypto_fini(knet_h);
	compress_fini(knet_h, 1);
	_destroy_locks(knet_h);

	free(knet_h);
	knet_h = NULL;

	(void)pthread_mutex_lock(&handle_config_mutex);
	knet_ref--;
	_fini_shlib_tracker();
	pthread_mutex_unlock(&handle_config_mutex);

	errno = 0;
	return 0;
	}

	int knet_handle_enable_sock_notify(knet_handle_t knet_h,
	void *sock_notify_fn_private_data,
	void (*sock_notify_fn) (
	void *private_data,
	int datafd,
	int8_t channel,
	uint8_t tx_rx,
	int error,
	int errorno))
	{
	int savederrno = 0;

	if (!knet_h) {
	errno = EINVAL;
	return -1;
	}

	if (!sock_notify_fn) {
	errno = EINVAL;
	return -1;
	}

	savederrno = get_global_wrlock(knet_h);
	if (savederrno) {
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to get write lock: %s",
	strerror(savederrno));
	errno = savederrno;
	return -1;
	}

	knet_h->sock_notify_fn_private_data = sock_notify_fn_private_data;
	knet_h->sock_notify_fn = sock_notify_fn;
	log_debug(knet_h, KNET_SUB_HANDLE, "sock_notify_fn enabled");

	pthread_rwlock_unlock(&knet_h->global_rwlock);

	return 0;
	}

	int knet_handle_add_datafd(knet_handle_t knet_h, int datafd, int8_t channel)
	{
	int err = 0, savederrno = 0;
	int i;
	struct epoll_event ev;

	if (!knet_h) {
	errno = EINVAL;
	return -1;
	}

	if (datafd == NULL) {
	errno = EINVAL;
	return -1;
	}

	if (channel == NULL) {
	errno = EINVAL;
	return -1;
	}

	if (*channel >= KNET_DATAFD_MAX) {
	errno = EINVAL;
	return -1;
	}

	savederrno = get_global_wrlock(knet_h);
	if (savederrno) {
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to get write lock: %s",
	strerror(savederrno));
	errno = savederrno;
	return -1;
	}

	if (!knet_h->sock_notify_fn) {
	log_err(knet_h, KNET_SUB_HANDLE, "Adding datafd requires sock notify callback enabled!");
	savederrno = EINVAL;
	err = -1;
	goto out_unlock;
	}

	if (*datafd > 0) {
	for (i = 0; i < KNET_DATAFD_MAX; i++) {
	if ((knet_h->sockfd[i].in_use) && (knet_h->sockfd[i].sockfd[0] == *datafd)) {
	log_err(knet_h, KNET_SUB_HANDLE, "requested datafd: %d already exist in index: %d", *datafd, i);
	savederrno = EEXIST;
	err = -1;
	goto out_unlock;
	}
	}
	}

	/*
	* auto allocate a channel
	*/
	if (*channel < 0) {
	for (i = 0; i < KNET_DATAFD_MAX; i++) {
	if (!knet_h->sockfd[i].in_use) {
	*channel = i;
	break;
	}
	}
	if (*channel < 0) {
	savederrno = EBUSY;
	err = -1;
	goto out_unlock;
	}
	} else {
	if (knet_h->sockfd[*channel].in_use) {
	savederrno = EBUSY;
	err = -1;
	goto out_unlock;
	}
	}

	knet_h->sockfd[*channel].is_created = 0;
	knet_h->sockfd[*channel].is_socket = 0;
	knet_h->sockfd[*channel].has_error = 0;

	if (*datafd > 0) {
	int sockopt;
	socklen_t sockoptlen = sizeof(sockopt);

	if (_fdset_cloexec(*datafd)) {
	savederrno = errno;
	err = -1;
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to set CLOEXEC on datafd: %s",
	strerror(savederrno));
	goto out_unlock;
	}

	if (_fdset_nonblock(*datafd)) {
	savederrno = errno;
	err = -1;
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to set NONBLOCK on datafd: %s",
	strerror(savederrno));
	goto out_unlock;
	}

	knet_h->sockfd[channel].sockfd[0] = datafd;
	knet_h->sockfd[*channel].sockfd[1] = 0;

	if (!getsockopt(knet_h->sockfd[*channel].sockfd[0], SOL_SOCKET, SO_TYPE, &sockopt, &sockoptlen)) {
	knet_h->sockfd[*channel].is_socket = 1;
	}
	} else {
	if (_init_socketpair(knet_h, knet_h->sockfd[*channel].sockfd)) {
	savederrno = errno;
	err = -1;
	goto out_unlock;
	}

	knet_h->sockfd[*channel].is_created = 1;
	knet_h->sockfd[*channel].is_socket = 1;
	datafd = knet_h->sockfd[channel].sockfd[0];
	}

	memset(&ev, 0, sizeof(struct epoll_event));
	ev.events = EPOLLIN;
	ev.data.fd = knet_h->sockfd[channel].sockfd[knet_h->sockfd[channel].is_created];

	if (epoll_ctl(knet_h->send_to_links_epollfd,
	EPOLL_CTL_ADD, knet_h->sockfd[channel].sockfd[knet_h->sockfd[channel].is_created], &ev)) {
	savederrno = errno;
	err = -1;
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to add datafd %d to linkfd epoll pool: %s",
	knet_h->sockfd[channel].sockfd[knet_h->sockfd[channel].is_created], strerror(savederrno));
	if (knet_h->sockfd[*channel].is_created) {
	_close_socketpair(knet_h, knet_h->sockfd[*channel].sockfd);
	}
	goto out_unlock;
	}

	knet_h->sockfd[*channel].in_use = 1;

	out_unlock:
	pthread_rwlock_unlock(&knet_h->global_rwlock);
	errno = err ? savederrno : 0;
	return err;
	}

	int knet_handle_remove_datafd(knet_handle_t knet_h, int datafd)
	{
	int err = 0, savederrno = 0;
	int8_t channel = -1;
	int i;
	struct epoll_event ev;

	if (!knet_h) {
	errno = EINVAL;
	return -1;
	}

	if (datafd <= 0) {
	errno = EINVAL;
	return -1;
	}

	savederrno = get_global_wrlock(knet_h);
	if (savederrno) {
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to get write lock: %s",
	strerror(savederrno));
	errno = savederrno;
	return -1;
	}

	for (i = 0; i < KNET_DATAFD_MAX; i++) {
	if ((knet_h->sockfd[i].in_use) &&
	(knet_h->sockfd[i].sockfd[0] == datafd)) {
	channel = i;
	break;
	}
	}

	if (channel < 0) {
	savederrno = EINVAL;
	err = -1;
	goto out_unlock;
	}

	if (!knet_h->sockfd[channel].has_error) {
	memset(&ev, 0, sizeof(struct epoll_event));

	if (epoll_ctl(knet_h->send_to_links_epollfd,
	EPOLL_CTL_DEL, knet_h->sockfd[channel].sockfd[knet_h->sockfd[channel].is_created], &ev)) {
	savederrno = errno;
	err = -1;
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to del datafd %d from linkfd epoll pool: %s",
	knet_h->sockfd[channel].sockfd[0], strerror(savederrno));
	goto out_unlock;
	}
	}

	if (knet_h->sockfd[channel].is_created) {
	_close_socketpair(knet_h, knet_h->sockfd[channel].sockfd);
	}

	memset(&knet_h->sockfd[channel], 0, sizeof(struct knet_sock));

	out_unlock:
	pthread_rwlock_unlock(&knet_h->global_rwlock);
	errno = err ? savederrno : 0;
	return err;
	}

	int knet_handle_get_datafd(knet_handle_t knet_h, const int8_t channel, int *datafd)
	{
	int err = 0, savederrno = 0;

	if (!knet_h) {
	errno = EINVAL;
	return -1;
	}

	if ((channel < 0) \|\| (channel >= KNET_DATAFD_MAX)) {
	errno = EINVAL;
	return -1;
	}

	if (datafd == NULL) {
	errno = EINVAL;
	return -1;
	}

	savederrno = pthread_rwlock_rdlock(&knet_h->global_rwlock);
	if (savederrno) {
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to get read lock: %s",
	strerror(savederrno));
	errno = savederrno;
	return -1;
	}

	if (!knet_h->sockfd[channel].in_use) {
	savederrno = EINVAL;
	err = -1;
	goto out_unlock;
	}

	*datafd = knet_h->sockfd[channel].sockfd[0];

	out_unlock:
	pthread_rwlock_unlock(&knet_h->global_rwlock);
	errno = err ? savederrno : 0;
	return err;
	}

	int knet_handle_get_channel(knet_handle_t knet_h, const int datafd, int8_t *channel)
	{
	int err = 0, savederrno = 0;
	int i;

	if (!knet_h) {
	errno = EINVAL;
	return -1;
	}

	if (datafd <= 0) {
	errno = EINVAL;
	return -1;
	}

	if (channel == NULL) {
	errno = EINVAL;
	return -1;
	}

	savederrno = pthread_rwlock_rdlock(&knet_h->global_rwlock);
	if (savederrno) {
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to get read lock: %s",
	strerror(savederrno));
	errno = savederrno;
	return -1;
	}

	*channel = -1;

	for (i = 0; i < KNET_DATAFD_MAX; i++) {
	if ((knet_h->sockfd[i].in_use) &&
	(knet_h->sockfd[i].sockfd[0] == datafd)) {
	*channel = i;
	break;
	}
	}

	if (*channel < 0) {
	savederrno = EINVAL;
	err = -1;
	goto out_unlock;
	}

	out_unlock:
	pthread_rwlock_unlock(&knet_h->global_rwlock);
	errno = err ? savederrno : 0;
	return err;
	}

	int knet_handle_enable_filter(knet_handle_t knet_h,
	void *dst_host_filter_fn_private_data,
	int (*dst_host_filter_fn) (
	void *private_data,
	const unsigned char *outdata,
	ssize_t outdata_len,
	uint8_t tx_rx,
	knet_node_id_t this_host_id,
	knet_node_id_t src_node_id,
	int8_t *channel,
	knet_node_id_t *dst_host_ids,
	size_t *dst_host_ids_entries))
	{
	int savederrno = 0;

	if (!knet_h) {
	errno = EINVAL;
	return -1;
	}

	savederrno = get_global_wrlock(knet_h);
	if (savederrno) {
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to get write lock: %s",
	strerror(savederrno));
	errno = savederrno;
	return -1;
	}

	knet_h->dst_host_filter_fn_private_data = dst_host_filter_fn_private_data;
	knet_h->dst_host_filter_fn = dst_host_filter_fn;
	if (knet_h->dst_host_filter_fn) {
	log_debug(knet_h, KNET_SUB_HANDLE, "dst_host_filter_fn enabled");
	} else {
	log_debug(knet_h, KNET_SUB_HANDLE, "dst_host_filter_fn disabled");
	}

	pthread_rwlock_unlock(&knet_h->global_rwlock);

	errno = 0;
	return 0;
	}

	int knet_handle_setfwd(knet_handle_t knet_h, unsigned int enabled)
	{
	int savederrno = 0;

	if (!knet_h) {
	errno = EINVAL;
	return -1;
	}

	if (enabled > 1) {
	errno = EINVAL;
	return -1;
	}

	savederrno = get_global_wrlock(knet_h);
	if (savederrno) {
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to get write lock: %s",
	strerror(savederrno));
	errno = savederrno;
	return -1;
	}

	knet_h->enabled = enabled;

	if (enabled) {
	log_debug(knet_h, KNET_SUB_HANDLE, "Data forwarding is enabled");
	} else {
	log_debug(knet_h, KNET_SUB_HANDLE, "Data forwarding is disabled");
	}

	pthread_rwlock_unlock(&knet_h->global_rwlock);

	errno = 0;
	return 0;
	}

	int knet_handle_enable_access_lists(knet_handle_t knet_h, unsigned int enabled)
	{
	int savederrno = 0;

	if (!knet_h) {
	errno = EINVAL;
	return -1;
	}

	if (enabled > 1) {
	errno = EINVAL;
	return -1;
	}

	savederrno = get_global_wrlock(knet_h);
	if (savederrno) {
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to get write lock: %s",
	strerror(savederrno));
	errno = savederrno;
	return -1;
	}

	knet_h->use_access_lists = enabled;

	if (enabled) {
	log_debug(knet_h, KNET_SUB_HANDLE, "Links access lists are enabled");
	} else {
	log_debug(knet_h, KNET_SUB_HANDLE, "Links access lists are disabled");
	}

	pthread_rwlock_unlock(&knet_h->global_rwlock);

	errno = 0;
	return 0;
	}

	int knet_handle_pmtud_getfreq(knet_handle_t knet_h, unsigned int *interval)
	{
	int savederrno = 0;

	if (!knet_h) {
	errno = EINVAL;
	return -1;
	}

	if (!interval) {
	errno = EINVAL;
	return -1;
	}

	savederrno = pthread_rwlock_rdlock(&knet_h->global_rwlock);
	if (savederrno) {
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to get read lock: %s",
	strerror(savederrno));
	errno = savederrno;
	return -1;
	}

	*interval = knet_h->pmtud_interval;

	pthread_rwlock_unlock(&knet_h->global_rwlock);

	errno = 0;
	return 0;
	}

	int knet_handle_pmtud_setfreq(knet_handle_t knet_h, unsigned int interval)
	{
	int savederrno = 0;

	if (!knet_h) {
	errno = EINVAL;
	return -1;
	}

	if ((!interval) \|\| (interval > 86400)) {
	errno = EINVAL;
	return -1;
	}

	savederrno = get_global_wrlock(knet_h);
	if (savederrno) {
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to get write lock: %s",
	strerror(savederrno));
	errno = savederrno;
	return -1;
	}

	knet_h->pmtud_interval = interval;
	log_debug(knet_h, KNET_SUB_HANDLE, "PMTUd interval set to: %u seconds", interval);

	pthread_rwlock_unlock(&knet_h->global_rwlock);

	errno = 0;
	return 0;
	}

	int knet_handle_enable_pmtud_notify(knet_handle_t knet_h,
	void *pmtud_notify_fn_private_data,
	void (*pmtud_notify_fn) (
	void *private_data,
	unsigned int data_mtu))
	{
	int savederrno = 0;

	if (!knet_h) {
	errno = EINVAL;
	return -1;
	}

	savederrno = get_global_wrlock(knet_h);
	if (savederrno) {
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to get write lock: %s",
	strerror(savederrno));
	errno = savederrno;
	return -1;
	}

	knet_h->pmtud_notify_fn_private_data = pmtud_notify_fn_private_data;
	knet_h->pmtud_notify_fn = pmtud_notify_fn;
	if (knet_h->pmtud_notify_fn) {
	log_debug(knet_h, KNET_SUB_HANDLE, "pmtud_notify_fn enabled");
	} else {
	log_debug(knet_h, KNET_SUB_HANDLE, "pmtud_notify_fn disabled");
	}

	pthread_rwlock_unlock(&knet_h->global_rwlock);

	errno = 0;
	return 0;
	}

	int knet_handle_pmtud_get(knet_handle_t knet_h,
	unsigned int *data_mtu)
	{
	int savederrno = 0;

	if (!knet_h) {
	errno = EINVAL;
	return -1;
	}

	if (!data_mtu) {
	errno = EINVAL;
	return -1;
	}

	savederrno = pthread_rwlock_rdlock(&knet_h->global_rwlock);
	if (savederrno) {
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to get read lock: %s",
	strerror(savederrno));
	errno = savederrno;
	return -1;
	}

	*data_mtu = knet_h->data_mtu;

	pthread_rwlock_unlock(&knet_h->global_rwlock);

	errno = 0;
	return 0;
	}

	int knet_handle_crypto(knet_handle_t knet_h, struct knet_handle_crypto_cfg *knet_handle_crypto_cfg)
	{
	int savederrno = 0;
	int err = 0;

	if (!knet_h) {
	errno = EINVAL;
	return -1;
	}

	if (!knet_handle_crypto_cfg) {
	errno = EINVAL;
	return -1;
	}

	savederrno = get_global_wrlock(knet_h);
	if (savederrno) {
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to get write lock: %s",
	strerror(savederrno));
	errno = savederrno;
	return -1;
	}

	- crypto_fini(knet_h);
	-
	if ((!strncmp("none", knet_handle_crypto_cfg->crypto_model, 4)) \|\|
	((!strncmp("none", knet_handle_crypto_cfg->crypto_cipher_type, 4)) &&
	(!strncmp("none", knet_handle_crypto_cfg->crypto_hash_type, 4)))) {
	+ crypto_fini(knet_h);
	log_debug(knet_h, KNET_SUB_CRYPTO, "crypto is not enabled");
	err = 0;
	goto exit_unlock;
	}

	if (knet_handle_crypto_cfg->private_key_len < KNET_MIN_KEY_LEN) {
	log_debug(knet_h, KNET_SUB_CRYPTO, "private key len too short (min %d): %u",
	KNET_MIN_KEY_LEN, knet_handle_crypto_cfg->private_key_len);
	savederrno = EINVAL;
	err = -1;
	goto exit_unlock;
	}

	if (knet_handle_crypto_cfg->private_key_len > KNET_MAX_KEY_LEN) {
	log_debug(knet_h, KNET_SUB_CRYPTO, "private key len too long (max %d): %u",
	KNET_MAX_KEY_LEN, knet_handle_crypto_cfg->private_key_len);
	savederrno = EINVAL;
	err = -1;
	goto exit_unlock;
	}

	err = crypto_init(knet_h, knet_handle_crypto_cfg);

	if (err) {
	err = -2;
	savederrno = errno;
	}

	exit_unlock:
	if (!err) {
	force_pmtud_run(knet_h, KNET_SUB_CRYPTO);
	}
	pthread_rwlock_unlock(&knet_h->global_rwlock);
	errno = err ? savederrno : 0;
	return err;
	}

	int knet_handle_compress(knet_handle_t knet_h, struct knet_handle_compress_cfg *knet_handle_compress_cfg)
	{
	int savederrno = 0;
	int err = 0;

	if (!knet_h) {
	errno = EINVAL;
	return -1;
	}

	if (!knet_handle_compress_cfg) {
	errno = EINVAL;
	return -1;
	}

	savederrno = get_global_wrlock(knet_h);
	if (savederrno) {
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to get write lock: %s",
	strerror(savederrno));
	errno = savederrno;
	return -1;
	}

	compress_fini(knet_h, 0);
	err = compress_cfg(knet_h, knet_handle_compress_cfg);
	savederrno = errno;

	pthread_rwlock_unlock(&knet_h->global_rwlock);
	errno = err ? savederrno : 0;
	return err;
	}

	ssize_t knet_recv(knet_handle_t knet_h, char *buff, const size_t buff_len, const int8_t channel)
	{
	int savederrno = 0;
	ssize_t err = 0;
	struct iovec iov_in;

	if (!knet_h) {
	errno = EINVAL;
	return -1;
	}

	if (buff == NULL) {
	errno = EINVAL;
	return -1;
	}

	if (buff_len <= 0) {
	errno = EINVAL;
	return -1;
	}

	if (buff_len > KNET_MAX_PACKET_SIZE) {
	errno = EINVAL;
	return -1;
	}

	if (channel < 0) {
	errno = EINVAL;
	return -1;
	}

	if (channel >= KNET_DATAFD_MAX) {
	errno = EINVAL;
	return -1;
	}

	savederrno = pthread_rwlock_rdlock(&knet_h->global_rwlock);
	if (savederrno) {
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to get read lock: %s",
	strerror(savederrno));
	errno = savederrno;
	return -1;
	}

	if (!knet_h->sockfd[channel].in_use) {
	savederrno = EINVAL;
	err = -1;
	goto out_unlock;
	}

	memset(&iov_in, 0, sizeof(iov_in));
	iov_in.iov_base = (void *)buff;
	iov_in.iov_len = buff_len;

	err = readv(knet_h->sockfd[channel].sockfd[0], &iov_in, 1);
	savederrno = errno;

	out_unlock:
	pthread_rwlock_unlock(&knet_h->global_rwlock);
	errno = err ? savederrno : 0;
	return err;
	}

	ssize_t knet_send(knet_handle_t knet_h, const char *buff, const size_t buff_len, const int8_t channel)
	{
	int savederrno = 0;
	ssize_t err = 0;
	struct iovec iov_out[1];

	if (!knet_h) {
	errno = EINVAL;
	return -1;
	}

	if (buff == NULL) {
	errno = EINVAL;
	return -1;
	}

	if (buff_len <= 0) {
	errno = EINVAL;
	return -1;
	}

	if (buff_len > KNET_MAX_PACKET_SIZE) {
	errno = EINVAL;
	return -1;
	}

	if (channel < 0) {
	errno = EINVAL;
	return -1;
	}

	if (channel >= KNET_DATAFD_MAX) {
	errno = EINVAL;
	return -1;
	}

	savederrno = pthread_rwlock_rdlock(&knet_h->global_rwlock);
	if (savederrno) {
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to get read lock: %s",
	strerror(savederrno));
	errno = savederrno;
	return -1;
	}

	if (!knet_h->sockfd[channel].in_use) {
	savederrno = EINVAL;
	err = -1;
	goto out_unlock;
	}

	memset(iov_out, 0, sizeof(iov_out));

	iov_out[0].iov_base = (void *)buff;
	iov_out[0].iov_len = buff_len;

	err = writev(knet_h->sockfd[channel].sockfd[0], iov_out, 1);
	savederrno = errno;

	out_unlock:
	pthread_rwlock_unlock(&knet_h->global_rwlock);
	errno = err ? savederrno : 0;
	return err;
	}

	int knet_handle_get_stats(knet_handle_t knet_h, struct knet_handle_stats *stats, size_t struct_size)
	{
	int savederrno = 0;

	if (!knet_h) {
	errno = EINVAL;
	return -1;
	}

	if (!stats) {
	errno = EINVAL;
	return -1;
	}

	savederrno = get_global_wrlock(knet_h);
	if (savederrno) {
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to get write lock: %s",
	strerror(savederrno));
	errno = savederrno;
	return -1;
	}

	if (struct_size > sizeof(struct knet_handle_stats)) {
	struct_size = sizeof(struct knet_handle_stats);
	}

	memmove(stats, &knet_h->stats, struct_size);

	/*
	* TX crypt stats only count the data packets sent, so add in the ping/pong/pmtud figures
	* RX is OK as it counts them before they are sorted.
	*/

	stats->tx_crypt_packets += knet_h->stats_extra.tx_crypt_ping_packets +
	knet_h->stats_extra.tx_crypt_pong_packets +
	knet_h->stats_extra.tx_crypt_pmtu_packets +
	knet_h->stats_extra.tx_crypt_pmtu_reply_packets;

	/* Tell the caller our full size in case they have an old version */
	stats->size = sizeof(struct knet_handle_stats);

	pthread_rwlock_unlock(&knet_h->global_rwlock);
	return 0;
	}

	int knet_handle_clear_stats(knet_handle_t knet_h, int clear_option)
	{
	int savederrno = 0;

	if (!knet_h) {
	errno = EINVAL;
	return -1;
	}

	if (clear_option != KNET_CLEARSTATS_HANDLE_ONLY &&
	clear_option != KNET_CLEARSTATS_HANDLE_AND_LINK) {
	errno = EINVAL;
	return -1;
	}

	savederrno = get_global_wrlock(knet_h);
	if (savederrno) {
	log_err(knet_h, KNET_SUB_HANDLE, "Unable to get write lock: %s",
	strerror(savederrno));
	errno = savederrno;
	return -1;
	}

	memset(&knet_h->stats, 0, sizeof(struct knet_handle_stats));
	memset(&knet_h->stats_extra, 0, sizeof(struct knet_handle_stats_extra));
	if (clear_option == KNET_CLEARSTATS_HANDLE_AND_LINK) {
	_link_clear_stats(knet_h);
	}

	pthread_rwlock_unlock(&knet_h->global_rwlock);
	return 0;
	}
	diff --git a/libknet/libknet.h b/libknet/libknet.h
	index 183c92d3..85c06cc1 100644
	--- a/libknet/libknet.h
	+++ b/libknet/libknet.h
	@@ -1,2183 +1,2181 @@
	/*
	* Copyright (C) 2010-2019 Red Hat, Inc. All rights reserved.
	*
	* Authors: Fabio M. Di Nitto <fabbione@kronosnet.org>
	* Federico Simoncelli <fsimon@kronosnet.org>
	*
	* This software licensed under GPL-2.0+, LGPL-2.0+
	*/

	#ifndef __LIBKNET_H__
	#define __LIBKNET_H__

	#include <stdint.h>
	#include <time.h>
	#include <netinet/in.h>
	#include <unistd.h>
	#include <limits.h>

	/**
	* @file libknet.h
	* @brief kronosnet API include file
	* @copyright Copyright (C) 2010-2019 Red Hat, Inc. All rights reserved.
	*
	* Kronosnet is an advanced VPN system for High Availability applications.
	*/

	#define KNET_API_VER 1

	/*
	* libknet limits
	*/

	/*
	* Maximum number of hosts
	*/

	typedef uint16_t knet_node_id_t;

	#define KNET_MAX_HOST 65536

	/*
	* Maximum number of links between 2 hosts
	*/

	#define KNET_MAX_LINK 8

	/*
	* Maximum packet size that should be written to datafd
	* see knet_handle_new for details
	*/

	#define KNET_MAX_PACKET_SIZE 65536

	/*
	* Buffers used for pretty logging
	* host is used to store both ip addresses and hostnames
	*/

	#define KNET_MAX_HOST_LEN 256
	#define KNET_MAX_PORT_LEN 6

	/*
	* Some notifications can be generated either on TX or RX
	*/

	#define KNET_NOTIFY_TX 0
	#define KNET_NOTIFY_RX 1

	/*
	* Link flags
	*/

	/*
	* Where possible, set traffic priority to high.
	* On Linux this sets the TOS to INTERACTIVE (6),
	* see tc-prio(8) for more infomation
	*/

	#define KNET_LINK_FLAG_TRAFFICHIPRIO (1ULL << 0)

	/*
	* Handle flags
	*/

	/*
	* Use privileged operations during socket setup.
	*/

	#define KNET_HANDLE_FLAG_PRIVILEGED (1ULL << 0)

	typedef struct knet_handle *knet_handle_t;

	/*
	* Handle structs/API calls
	*/

	/**
	* knet_handle_new_ex
	*
	* @brief create a new instance of a knet handle
	*
	* host_id - Each host in a knet is identified with a unique
	* ID. when creating a new handle local host_id
	* must be specified (0 to UINT16_MAX are all valid).
	* It is the user's responsibility to check that the value
	* is unique, or bad things might happen.
	*
	* log_fd - Write file descriptor. If set to a value > 0, it will be used
	* to write log packets from libknet to the application.
	* Setting to 0 will disable logging from libknet.
	* It is possible to enable logging at any given time (see logging API).
	* Make sure to either read from this filedescriptor properly and/or
	* mark it O_NONBLOCK, otherwise if the fd becomes full, libknet could
	* block.
	* It is strongly encouraged to use pipes (ex: pipe(2) or pipe2(2)) for
	* logging fds due to the atomic nature of writes between fds.
	* See also libknet test suite for reference and guidance.
	*
	* default_log_level -
	* If logfd is specified, it will initialize all subsystems to log
	* at default_log_level value. (see logging API)
	*
	* flags - bitwise OR of some of the following flags:
	* KNET_HANDLE_FLAG_PRIVILEGED: use privileged operations setting up the
	* communication sockets. If disabled, failure to acquire large
	* enough socket buffers is ignored but logged. Inadequate buffers
	* lead to poor performance.
	*
	* @return
	* on success, a new knet_handle_t is returned.
	* on failure, NULL is returned and errno is set.
	* knet-specific errno values:
	* ENAMETOOLONG - socket buffers couldn't be set big enough and KNET_HANDLE_FLAG_PRIVILEGED was specified
	* ERANGE - buffer size readback returned unexpected type
	*/

	knet_handle_t knet_handle_new_ex(knet_node_id_t host_id,
	int log_fd,
	uint8_t default_log_level,
	uint64_t flags);

	/**
	* knet_handle_new
	*
	* @brief knet_handle_new_ex with flags = KNET_HANDLE_FLAG_PRIVILEGED.
	*/

	knet_handle_t knet_handle_new(knet_node_id_t host_id,
	int log_fd,
	uint8_t default_log_level);

	/**
	* knet_handle_free
	*
	* @brief Destroy a knet handle, free all resources
	*
	* knet_h - pointer to knet_handle_t
	*
	* @return
	* knet_handle_free returns
	* 0 on success
	* -1 on error and errno is set.
	*/

	int knet_handle_free(knet_handle_t knet_h);

	/**
	* knet_handle_enable_sock_notify
	*
	* @brief Register a callback to receive socket events
	*
	* knet_h - pointer to knet_handle_t
	*
	* sock_notify_fn_private_data
	* void pointer to data that can be used to identify
	* the callback.
	*
	* sock_notify_fn
	* A callback function that is invoked every time
	* a socket in the datafd pool will report an error (-1)
	* or an end of read (0) (see socket.7).
	* This function MUST NEVER block or add substantial delays.
	* The callback is invoked in an internal unlocked area
	* to allow calls to knet_handle_add_datafd/knet_handle_remove_datafd
	* to swap/replace the bad fd.
	* if both err and errno are 0, it means that the socket
	* has received a 0 byte packet (EOF?).
	* The callback function must either remove the fd from knet
	* (by calling knet_handle_remove_fd()) or dup a new fd in its place.
	* Failure to do this can cause problems.
	*
	* @return
	* knet_handle_enable_sock_notify returns
	* 0 on success
	* -1 on error and errno is set.
	*/

	int knet_handle_enable_sock_notify(knet_handle_t knet_h,
	void *sock_notify_fn_private_data,
	void (*sock_notify_fn) (
	void *private_data,
	int datafd,
	int8_t channel,
	uint8_t tx_rx,
	int error,
	int errorno)); /* sorry! can't call it errno ;) */

	#define KNET_DATAFD_MAX 32

	/**
	* knet_handle_add_datafd
	*
	* @brief Install a file descriptor for communication
	*
	* IMPORTANT: In order to add datafd to knet, knet_handle_enable_sock_notify
	* _MUST_ be set and be able to handle both errors (-1) and
	* 0 bytes read / write from the provided datafd.
	* On read error (< 0) from datafd, the socket is automatically
	* removed from polling to avoid spinning on dead sockets.
	* It is safe to call knet_handle_remove_datafd even on sockets
	* that have been removed.
	*
	* knet_h - pointer to knet_handle_t
	*
	* *datafd - read/write file descriptor.
	* knet will read data here to send to the other hosts
	* and will write data received from the network.
	* Each data packet can be of max size KNET_MAX_PACKET_SIZE!
	* Applications using knet_send/knet_recv will receive a
	* proper error if the packet size is not within boundaries.
	* Applications using their own functions to write to the
	* datafd should NOT write more than KNET_MAX_PACKET_SIZE.
	*
	* Please refer to handle.c on how to set up a socketpair.
	*
	* datafd can be 0, and knet_handle_add_datafd will create a properly
	* populated socket pair the same way as ping_test, or a value
	* higher than 0. A negative number will return an error.
	* On exit knet_handle_free will take care to cleanup the
	* socketpair only if they have been created by knet_handle_add_datafd.
	*
	* It is possible to pass either sockets or normal fds.
	* User provided datafd will be marked as non-blocking and close-on-exec.
	*
	* *channel - This value is analogous to the tag in VLAN tagging.
	* A negative value will auto-allocate a channel.
	* Setting a value between 0 and 31 will try to allocate that
	* specific channel (unless already in use).
	*
	* It is possible to add up to 32 datafds but be aware that each
	* one of them must have a receiving end on the other host.
	*
	* Example:
	* hostA channel 0 will be delivered to datafd on hostB channel 0
	* hostA channel 1 to hostB channel 1.
	*
	* Each channel must have a unique file descriptor.
	*
	* If your application could have 2 channels on one host and one
	* channel on another host, then you can use dst_host_filter
	* to manipulate channel values on TX and RX.
	*
	* @return
	* knet_handle_add_datafd returns
	* @retval 0 on success,
	* *datafd will be populated with a socket if the original value was 0
	* or if a specific fd was set, the value is untouched.
	* *channel will be populated with a channel number if the original value
	* was negative or the value is untouched if a specific channel
	* was requested.
	*
	* @retval -1 on error and errno is set.
	* datafd and channel are untouched or empty.
	*/

	int knet_handle_add_datafd(knet_handle_t knet_h, int datafd, int8_t channel);

	/**
	* knet_handle_remove_datafd
	*
	* @brief Remove a file descriptor from knet
	*
	* knet_h - pointer to knet_handle_t
	*
	* datafd - file descriptor to remove.
	* NOTE that if the socket/fd was created by knet_handle_add_datafd,
	* the socket will be closed by libknet.
	*
	* @return
	* knet_handle_remove_datafd returns
	* 0 on success
	* -1 on error and errno is set.
	*/

	int knet_handle_remove_datafd(knet_handle_t knet_h, int datafd);

	/**
	* knet_handle_get_channel
	*
	* @brief Get the channel associated with a file descriptor
	*
	* knet_h - pointer to knet_handle_t
	*
	* datafd - get the channel associated to this datafd
	*
	* *channel - will contain the result
	*
	* @return
	* knet_handle_get_channel returns
	* @retval 0 on success
	* and *channel will contain the result
	* @retval -1 on error and errno is set.
	* and *channel content is meaningless
	*/

	int knet_handle_get_channel(knet_handle_t knet_h, const int datafd, int8_t *channel);

	/**
	* knet_handle_get_datafd
	*
	* @brief Get the file descriptor associated with a channel
	*
	* knet_h - pointer to knet_handle_t
	*
	* channel - get the datafd associated to this channel
	*
	* *datafd - will contain the result
	*
	* @return
	* knet_handle_get_datafd returns
	* @retval 0 on success
	* and *datafd will contain the results
	* @retval -1 on error and errno is set.
	* and *datafd content is meaningless
	*/

	int knet_handle_get_datafd(knet_handle_t knet_h, const int8_t channel, int *datafd);

	/**
	* knet_recv
	*
	* @brief Receive data from knet nodes
	*
	* knet_h - pointer to knet_handle_t
	*
	* buff - pointer to buffer to store the received data
	*
	* buff_len - buffer length
	*
	* channel - channel number
	*
	* @return
	* knet_recv is a commodity function to wrap iovec operations
	* around a socket. It returns a call to readv(2).
	*/

	ssize_t knet_recv(knet_handle_t knet_h,
	char *buff,
	const size_t buff_len,
	const int8_t channel);

	/**
	* knet_send
	*
	* @brief Send data to knet nodes
	*
	* knet_h - pointer to knet_handle_t
	*
	* buff - pointer to the buffer of data to send
	*
	* buff_len - length of data to send
	*
	* channel - channel number
	*
	* @return
	* knet_send is a commodity function to wrap iovec operations
	* around a socket. It returns a call to writev(2).
	*/

	ssize_t knet_send(knet_handle_t knet_h,
	const char *buff,
	const size_t buff_len,
	const int8_t channel);

	/**
	* knet_send_sync
	*
	* @brief Synchronously send data to knet nodes
	*
	* knet_h - pointer to knet_handle_t
	*
	* buff - pointer to the buffer of data to send
	*
	* buff_len - length of data to send
	*
	* channel - data channel to use (see knet_handle_add_datafd(3))
	*
	* All knet RX/TX operations are async for performance reasons.
	* There are applications that might need a sync version of data
	* transmission and receive errors in case of failure to deliver
	* to another host.
	* knet_send_sync bypasses the whole TX async layer and delivers
	* data directly to the link layer, and returns errors accordingly.
	* knet_send_sync sends only one packet to one host at a time.
	* It does NOT support multiple destinations or multicast packets.
	* Decision is still based on dst_host_filter_fn.
	*
	* @return
	* knet_send_sync returns 0 on success and -1 on error.
	* In addition to normal sendmmsg errors, knet_send_sync can fail
	* due to:
	*
	* @retval ECANCELED - data forward is disabled
	* @retval EFAULT - dst_host_filter fatal error
	* @retval EINVAL - dst_host_filter did not provide dst_host_ids_entries on unicast pckts
	* @retval E2BIG - dst_host_filter did return more than one dst_host_ids_entries on unicast pckts
	* @retval ENOMSG - received unknown message type
	* @retval EHOSTDOWN - unicast pckt cannot be delivered because dest host is not connected yet
	* @retval ECHILD - crypto failed
	* @retval EAGAIN - sendmmsg was unable to send all messages and there was no progress during retry
	*/

	int knet_send_sync(knet_handle_t knet_h,
	const char *buff,
	const size_t buff_len,
	const int8_t channel);

	/**
	* knet_handle_enable_filter
	*
	* @brief install a filter to route packets
	*
	* knet_h - pointer to knet_handle_t
	*
	* dst_host_filter_fn_private_data
	* void pointer to data that can be used to identify
	* the callback.
	*
	* dst_host_filter_fn -
	* is a callback function that is invoked every time
	* a packet hits datafd (see knet_handle_new(3)).
	* the function allows users to tell libknet where the
	* packet has to be delivered.
	*
	* const unsigned char *outdata - is a pointer to the
	* current packet
	* ssize_t outdata_len - length of the above data
	* uint8_t tx_rx - filter is called on tx or rx
	* (KNET_NOTIFY_TX, KNET_NOTIFY_RX)
	* knet_node_id_t this_host_id - host_id processing the packet
	* knet_node_id_t src_host_id - host_id that generated the
	* packet
	* knet_node_id_t *dst_host_ids - array of KNET_MAX_HOST knet_node_id_t
	* where to store the destinations
	* size_t *dst_host_ids_entries - number of hosts to send the message
	*
	* dst_host_filter_fn should return
	* -1 on error, packet is discarded.
	* 0 packet is unicast and should be sent to dst_host_ids and there are
	* dst_host_ids_entries in the buffer.
	* 1 packet is broadcast/multicast and is sent all hosts.
	* contents of dst_host_ids and dst_host_ids_entries are ignored.
	* (see also kronosnetd/etherfilter.* for an example that filters based
	* on ether protocol)
	*
	* @return
	* knet_handle_enable_filter returns
	* 0 on success
	* -1 on error and errno is set.
	*/

	int knet_handle_enable_filter(knet_handle_t knet_h,
	void *dst_host_filter_fn_private_data,
	int (*dst_host_filter_fn) (
	void *private_data,
	const unsigned char *outdata,
	ssize_t outdata_len,
	uint8_t tx_rx,
	knet_node_id_t this_host_id,
	knet_node_id_t src_host_id,
	int8_t *channel,
	knet_node_id_t *dst_host_ids,
	size_t *dst_host_ids_entries));

	/**
	* knet_handle_setfwd
	*
	* @brief Start packet forwarding
	*
	* knet_h - pointer to knet_handle_t
	*
	* enable - set to 1 to allow data forwarding, 0 to disable data forwarding.
	*
	* @return
	* knet_handle_setfwd returns
	* 0 on success
	* -1 on error and errno is set.
	*
	* By default data forwarding is off and no traffic will pass through knet until
	* it is set on.
	*/

	int knet_handle_setfwd(knet_handle_t knet_h, unsigned int enabled);

	/**
	* knet_handle_enable_access_lists
	*
	* @brief Enable or disable usage of access lists (default: off)
	*
	* knet_h - pointer to knet_handle_t
	*
	* enable - set to 1 to use access lists, 0 to disable access_lists.
	*
	* @return
	* knet_handle_enable_access_lists returns
	* 0 on success
	* -1 on error and errno is set.
	*
	* access lists are bound to links. There are 2 types of links:
	* 1) point to point, where both source and destinations are well known
	* at configuration time.
	* 2) open links, where only the source is known at configuration time.
	*
	* knet will automatically generate access lists for point to point links.
	*
	* For open links, knet provides 4 API calls to manipulate access lists:
	* knet_link_add_acl(3), knet_link_rm_acl(3), knet_link_insert_acl(3)
	* and knet_link_clear_acl(3).
	* Those API calls will work exclusively on open links as they
	* are of no use on point to point links.
	*
	* knet will not enforce any access list unless specifically enabled by
	* knet_handle_enable_access_lists(3).
	*
	* From a security / programming perspective we recommend:
	* - create the knet handle
	* - enable access lists
	* - configure hosts and links
	* - configure access lists for open links
	*/

	int knet_handle_enable_access_lists(knet_handle_t knet_h, unsigned int enabled);

	#define KNET_PMTUD_DEFAULT_INTERVAL 60

	/**
	* knet_handle_pmtud_setfreq
	*
	* @brief Set the interval between PMTUd scans
	*
	* knet_h - pointer to knet_handle_t
	*
	* interval - define the interval in seconds between PMTUd scans
	* range from 1 to 86400 (24h)
	*
	* @return
	* knet_handle_pmtud_setfreq returns
	* 0 on success
	* -1 on error and errno is set.
	*
	* default interval is 60.
	*/

	int knet_handle_pmtud_setfreq(knet_handle_t knet_h, unsigned int interval);

	/**
	* knet_handle_pmtud_getfreq
	*
	* @brief Get the interval between PMTUd scans
	*
	* knet_h - pointer to knet_handle_t
	*
	* interval - pointer where to store the current interval value
	*
	* @return
	* knet_handle_pmtud_setfreq returns
	* 0 on success
	* -1 on error and errno is set.
	*/

	int knet_handle_pmtud_getfreq(knet_handle_t knet_h, unsigned int *interval);

	/**
	* knet_handle_enable_pmtud_notify
	*
	* @brief install a callback to receive PMTUd changes
	*
	* knet_h - pointer to knet_handle_t
	*
	* pmtud_notify_fn_private_data
	* void pointer to data that can be used to identify
	* the callback.
	*
	* pmtud_notify_fn
	* is a callback function that is invoked every time
	* a path MTU size change is detected.
	* The function allows libknet to notify the user
	* of data MTU, that's the max value that can be send
	* onwire without fragmentation. The data MTU will always
	* be lower than real link MTU because it accounts for
	* protocol overhead, knet packet header and (if configured)
	* crypto overhead,
	* This function MUST NEVER block or add substantial delays.
	*
	* @return
	* knet_handle_enable_pmtud_notify returns
	* 0 on success
	* -1 on error and errno is set.
	*/

	int knet_handle_enable_pmtud_notify(knet_handle_t knet_h,
	void *pmtud_notify_fn_private_data,
	void (*pmtud_notify_fn) (
	void *private_data,
	unsigned int data_mtu));

	/**
	* knet_handle_pmtud_get
	*
	* @brief Get the current data MTU
	*
	* knet_h - pointer to knet_handle_t
	*
	* data_mtu - pointer where to store data_mtu
	*
	* @return
	* knet_handle_pmtud_get returns
	* 0 on success
	* -1 on error and errno is set.
	*/

	int knet_handle_pmtud_get(knet_handle_t knet_h,
	unsigned int *data_mtu);


	#define KNET_MIN_KEY_LEN 128
	#define KNET_MAX_KEY_LEN 4096

	struct knet_handle_crypto_cfg {
	char crypto_model[16];
	char crypto_cipher_type[16];
	char crypto_hash_type[16];
	unsigned char private_key[KNET_MAX_KEY_LEN];
	unsigned int private_key_len;
	};

	/**
	* knet_handle_crypto
	*
	* @brief set up packet cryptographic signing & encryption
	*
	* knet_h - pointer to knet_handle_t
	*
	* knet_handle_crypto_cfg -
	* pointer to a knet_handle_crypto_cfg structure
	*
	* crypto_model should contain the model name.
	* Currently only "openssl" and "nss" are supported.
	* Setting to "none" will disable crypto.
	*
	* crypto_cipher_type
	* should contain the cipher algo name.
	* It can be set to "none" to disable
	* encryption.
	* Currently supported by "nss" model:
	* "aes128", "aes192" and "aes256".
	* "openssl" model supports more modes and it strictly
	* depends on the openssl build. See: EVP_get_cipherbyname
	* openssl API call for details.
	*
	* crypto_hash_type
	* should contain the hashing algo name.
	* It can be set to "none" to disable
	* hashing.
	* Currently supported by "nss" model:
	* "md5", "sha1", "sha256", "sha384" and "sha512".
	* "openssl" model supports more modes and it strictly
	* depends on the openssl build. See: EVP_get_digestbyname
	* openssl API call for details.
	*
	* private_key will contain the private shared key.
	* It has to be at least KNET_MIN_KEY_LEN long.
	*
	* private_key_len
	* length of the provided private_key.
	*
	* Implementation notes/current limitations:
	* - enabling crypto, will increase latency as packets have
	* to processed.
	* - enabling crypto might reduce the overall throughtput
	* due to crypto data overhead.
	* - re-keying is not implemented yet.
	* - private/public key encryption/hashing is not currently
	* planned.
	* - crypto key must be the same for all hosts in the same
	* knet instance.
	* - it is safe to call knet_handle_crypto multiple times at runtime.
	* The last config will be used.
	* IMPORTANT: a call to knet_handle_crypto can fail due to:
	* 1) failure to obtain locking
	* 2) errors to initializing the crypto level.
	* This can happen even in subsequent calls to knet_handle_crypto.
	- * A failure in crypto init, might leave your traffic unencrypted!
	- * It's best to stop data forwarding (see knet_handle_setfwd(3)), change crypto config,
	- * start forward again.
	+ * A failure in crypto init will restore the previous crypto configuration.
	*
	* @return
	* knet_handle_crypto returns:
	* @retval 0 on success
	* @retval -1 on error and errno is set.
	* @retval -2 on crypto subsystem initialization error. No errno is provided at the moment (yet).
	*/

	int knet_handle_crypto(knet_handle_t knet_h,
	struct knet_handle_crypto_cfg *knet_handle_crypto_cfg);



	#define KNET_COMPRESS_THRESHOLD 100

	struct knet_handle_compress_cfg {
	char compress_model[16];
	uint32_t compress_threshold;
	int compress_level;
	};

	/**
	* knet_handle_compress
	*
	* @brief Set up packet compression
	*
	* knet_h - pointer to knet_handle_t
	*
	* knet_handle_compress_cfg -
	* pointer to a knet_handle_compress_cfg structure
	*
	* compress_model contains the model name.
	* See "compress_level" for the list of accepted values.
	* Setting the value to "none" disables compression.
	*
	* compress_threshold
	* tells the transmission thread to NOT compress
	* any packets that are smaller than the value
	* indicated. Default 100 bytes.
	* Set to 0 to reset to the default.
	* Set to 1 to compress everything.
	* Max accepted value is KNET_MAX_PACKET_SIZE.
	*
	* compress_level is the "level" parameter for most models:
	* zlib: 0 (no compression), 1 (minimal) .. 9 (max compression).
	* lz4: 1 (max compression)... 9 (fastest compression).
	* lz4hc: 1 (min compression) ... LZ4HC_MAX_CLEVEL (16) or LZ4HC_CLEVEL_MAX (12)
	* depending on the version of lz4hc libknet was built with.
	* lzma: 0 (minimal) .. 9 (max compression)
	* bzip2: 1 (minimal) .. 9 (max compression)
	* For lzo2 it selects the algorithm to use:
	* 1 : lzo1x_1_compress (default)
	* 11 : lzo1x_1_11_compress
	* 12 : lzo1x_1_12_compress
	* 15 : lzo1x_1_15_compress
	* 999: lzo1x_999_compress
	* Other values select the default algorithm.
	* Please refer to the documentation of the respective
	* compression library for guidance about setting this
	* value.
	*
	* Implementation notes:
	* - it is possible to enable/disable compression at any time.
	* - nodes can be using a different compression algorithm at any time.
	* - knet does NOT implement the compression algorithm directly. it relies
	* on external libraries for this functionality. Please read
	* the libraries man pages to figure out which algorithm/compression
	* level is best for the data you are planning to transmit.
	*
	* @return
	* knet_handle_compress returns
	* 0 on success
	* -1 on error and errno is set. EINVAL means that either the model or the
	* level are not supported.
	*/

	int knet_handle_compress(knet_handle_t knet_h,
	struct knet_handle_compress_cfg *knet_handle_compress_cfg);



	struct knet_handle_stats {
	size_t size;

	uint64_t tx_uncompressed_packets;
	uint64_t tx_compressed_packets;
	uint64_t tx_compressed_original_bytes;
	uint64_t tx_compressed_size_bytes;
	uint64_t tx_compress_time_ave;
	uint64_t tx_compress_time_min;
	uint64_t tx_compress_time_max;

	uint64_t rx_compressed_packets;
	uint64_t rx_compressed_original_bytes;
	uint64_t rx_compressed_size_bytes;
	uint64_t rx_compress_time_ave;
	uint64_t rx_compress_time_min;
	uint64_t rx_compress_time_max;

	/* Overhead times, measured in usecs */
	uint64_t tx_crypt_packets;
	uint64_t tx_crypt_byte_overhead;
	uint64_t tx_crypt_time_ave;
	uint64_t tx_crypt_time_min;
	uint64_t tx_crypt_time_max;

	uint64_t rx_crypt_packets;
	uint64_t rx_crypt_time_ave;
	uint64_t rx_crypt_time_min;
	uint64_t rx_crypt_time_max;
	};

	/**
	* knet_handle_get_stats
	*
	* @brief Get statistics for compression & crypto
	*
	* knet_h - pointer to knet_handle_t
	*
	* knet_handle_stats
	* pointer to a knet_handle_stats structure
	*
	* struct_size
	* size of knet_handle_stats structure to allow
	* for backwards compatibility. libknet will only
	* copy this much data into the stats structure
	* so that older callers will not get overflowed if
	* new fields are added.
	*
	* @return
	* 0 on success
	* -1 on error and errno is set.
	*
	*/

	int knet_handle_get_stats(knet_handle_t knet_h, struct knet_handle_stats *stats, size_t struct_size);

	/*
	* Tell knet_handle_clear_stats whether to clear just the handle stats
	* or all of them.
	*/
	#define KNET_CLEARSTATS_HANDLE_ONLY 1
	#define KNET_CLEARSTATS_HANDLE_AND_LINK 2

	/**
	* knet_handle_clear_stats
	*
	* @brief Clear knet stats, link and/or handle
	*
	* knet_h - pointer to knet_handle_t
	*
	* clear_option - Which stats to clear, must be one of
	*
	* KNET_CLEARSTATS_HANDLE_ONLY or
	* KNET_CLEARSTATS_HANDLE_AND_LINK
	*
	* @return
	* 0 on success
	* -1 on error and errno is set.
	*
	*/

	int knet_handle_clear_stats(knet_handle_t knet_h, int clear_option);



	struct knet_crypto_info {
	const char name; / openssl,nss,etc.. */
	uint8_t properties; /* currently unused */
	char pad[256]; /* currently unused */
	};

	/**
	* knet_get_crypto_list
	*
	* @brief Get a list of supported crypto libraries
	*
	* crypto_list - array of struct knet_crypto_info *
	* If NULL then only the number of structs is returned in crypto_list_entries
	* to allow the caller to allocate sufficient space.
	* libknet does not allow more than 256 crypto methods at the moment.
	* it is safe to allocate 256 structs to avoid calling
	* knet_get_crypto_list twice.
	*
	* crypto_list_entries - returns the number of structs in crypto_list
	*
	* @return
	* knet_get_crypto_list returns
	* 0 on success
	* -1 on error and errno is set.
	*/

	int knet_get_crypto_list(struct knet_crypto_info *crypto_list,
	size_t *crypto_list_entries);



	struct knet_compress_info {
	const char name; / bzip2, lz4, etc.. */
	uint8_t properties; /* currently unused */
	char pad[256]; /* currently unused */
	};

	/**
	* knet_get_compress_list
	*
	* @brief Get a list of support compression types
	*
	* compress_list - array of struct knet_compress_info *
	* If NULL then only the number of structs is returned in compress_list_entries
	* to allow the caller to allocate sufficient space.
	* libknet does not allow more than 256 compress methods at the moment.
	* it is safe to allocate 256 structs to avoid calling
	* knet_get_compress_list twice.
	*
	* compress_list_entries - returns the number of structs in compress_list
	*
	* @return
	* knet_get_compress_list returns
	* 0 on success
	* -1 on error and errno is set.
	*/

	int knet_get_compress_list(struct knet_compress_info *compress_list,
	size_t *compress_list_entries);

	/*
	* host structs/API calls
	*/

	/**
	* knet_host_add
	*
	* @brief Add a new host ID to knet
	*
	* knet_h - pointer to knet_handle_t
	*
	* host_id - each host in a knet is identified with a unique ID
	* (see also knet_handle_new(3))
	*
	* @return
	* knet_host_add returns:
	* 0 on success
	* -1 on error and errno is set.
	*/

	int knet_host_add(knet_handle_t knet_h, knet_node_id_t host_id);

	/**
	* knet_host_remove
	*
	* @brief Remove a host ID from knet
	*
	* knet_h - pointer to knet_handle_t
	*
	* host_id - each host in a knet is identified with a unique ID
	* (see also knet_handle_new(3))
	*
	* @return
	* knet_host_remove returns:
	* 0 on success
	* -1 on error and errno is set.
	*/

	int knet_host_remove(knet_handle_t knet_h, knet_node_id_t host_id);

	/**
	* knet_host_set_name
	*
	* @brief Set the name of a knet host
	*
	* knet_h - pointer to knet_handle_t
	*
	* host_id - see knet_host_add(3)
	*
	* name - this name will be used for pretty logging and eventually
	* search for hosts (see also knet_handle_host_get_name(2) and knet_handle_host_get_id(3)).
	* Only up to KNET_MAX_HOST_LEN - 1 bytes will be accepted and
	* name has to be unique for each host.
	*
	* @return
	* knet_host_set_name returns:
	* 0 on success
	* -1 on error and errno is set.
	*/

	int knet_host_set_name(knet_handle_t knet_h, knet_node_id_t host_id,
	const char *name);

	/**
	* knet_host_get_name_by_host_id
	*
	* @brief Get the name of a host given its ID
	*
	* knet_h - pointer to knet_handle_t
	*
	* host_id - see knet_host_add(3)
	*
	* name - pointer to a preallocated buffer of at least size KNET_MAX_HOST_LEN
	* where the current host name will be stored
	* (as set by knet_host_set_name or default by knet_host_add)
	*
	* @return
	* knet_host_get_name_by_host_id returns:
	* 0 on success
	* -1 on error and errno is set (name is left untouched)
	*/

	int knet_host_get_name_by_host_id(knet_handle_t knet_h, knet_node_id_t host_id,
	char *name);

	/**
	* knet_host_get_id_by_host_name
	*
	* @brief Get the ID of a host given its name
	*
	* knet_h - pointer to knet_handle_t
	*
	* name - name to lookup, max len KNET_MAX_HOST_LEN
	*
	* host_id - where to store the result
	*
	* @return
	* knet_host_get_id_by_host_name returns:
	* 0 on success
	* -1 on error and errno is set.
	*/

	int knet_host_get_id_by_host_name(knet_handle_t knet_h, const char *name,
	knet_node_id_t *host_id);

	/**
	* knet_host_get_host_list
	*
	* @brief Get a list of hosts known to knet
	*
	* knet_h - pointer to knet_handle_t
	*
	* host_ids - array of at lest KNET_MAX_HOST size
	*
	* host_ids_entries -
	* number of entries writted in host_ids
	*
	* @return
	* knet_host_get_host_list returns
	* 0 on success
	* -1 on error and errno is set.
	*/

	int knet_host_get_host_list(knet_handle_t knet_h,
	knet_node_id_t host_ids, size_t host_ids_entries);

	/*
	* define switching policies
	*/

	#define KNET_LINK_POLICY_PASSIVE 0
	#define KNET_LINK_POLICY_ACTIVE 1
	#define KNET_LINK_POLICY_RR 2

	/**
	* knet_host_set_policy
	*
	* @brief Set the switching policy for a host's links
	*
	* knet_h - pointer to knet_handle_t
	*
	* host_id - see knet_host_add(3)
	*
	* policy - there are currently 3 kind of simple switching policies
	* based on link configuration.
	* KNET_LINK_POLICY_PASSIVE - the active link with the lowest
	* priority will be used.
	* if one or more active links share
	* the same priority, the one with
	* lowest link_id will be used.
	*
	* KNET_LINK_POLICY_ACTIVE - all active links will be used
	* simultaneously to send traffic.
	* link priority is ignored.
	*
	* KNET_LINK_POLICY_RR - round-robin policy, every packet
	* will be send on a different active
	* link.
	*
	* @return
	* knet_host_set_policy returns
	* 0 on success
	* -1 on error and errno is set.
	*/

	int knet_host_set_policy(knet_handle_t knet_h, knet_node_id_t host_id,
	uint8_t policy);

	/**
	* knet_host_get_policy
	*
	* @brief Get the switching policy for a host's links
	*
	* knet_h - pointer to knet_handle_t
	*
	* host_id - see knet_host_add(3)
	*
	* policy - will contain the current configured switching policy.
	* Default is passive when creating a new host.
	*
	* @return
	* knet_host_get_policy returns
	* 0 on success
	* -1 on error and errno is set.
	*/

	int knet_host_get_policy(knet_handle_t knet_h, knet_node_id_t host_id,
	uint8_t *policy);

	/**
	* knet_host_enable_status_change_notify
	*
	* @brief Install a callback to get host status change events
	*
	* knet_h - pointer to knet_handle_t
	*
	* host_status_change_notify_fn_private_data -
	* void pointer to data that can be used to identify
	* the callback
	*
	* host_status_change_notify_fn -
	* is a callback function that is invoked every time
	* there is a change in the host status.
	* host status is identified by:
	* - reachable, this host can send/receive data to/from host_id
	* - remote, 0 if the host_id is connected locally or 1 if
	* the there is one or more knet host(s) in between.
	* NOTE: re-switching is NOT currently implemented,
	* but this is ready for future and can avoid
	* an API/ABI breakage later on.
	* - external, 0 if the host_id is configured locally or 1 if
	* it has been added from remote nodes config.
	* NOTE: dynamic topology is NOT currently implemented,
	* but this is ready for future and can avoid
	* an API/ABI breakage later on.
	* This function MUST NEVER block or add substantial delays.
	*
	* @return
	* knet_host_status_change_notify returns
	* 0 on success
	* -1 on error and errno is set.
	*/

	int knet_host_enable_status_change_notify(knet_handle_t knet_h,
	void *host_status_change_notify_fn_private_data,
	void (*host_status_change_notify_fn) (
	void *private_data,
	knet_node_id_t host_id,
	uint8_t reachable,
	uint8_t remote,
	uint8_t external));

	/*
	* define host status structure for quick lookup
	* struct is in flux as more stats will be added soon
	*
	* reachable host_id can be seen either directly connected
	* or via another host_id
	*
	* remote 0 = node is connected locally, 1 is visible via
	* via another host_id
	*
	* external 0 = node is configured/known locally,
	* 1 host_id has been received via another host_id
	*/

	struct knet_host_status {
	uint8_t reachable;
	uint8_t remote;
	uint8_t external;
	/* add host statistics */
	};

	/**
	* knet_host_get_status
	*
	* @brief Get the status of a host
	*
	* knet_h - pointer to knet_handle_t
	*
	* host_id - see knet_host_add(3)
	*
	* status - pointer to knet_host_status struct
	*
	* @return
	* knet_handle_pmtud_get returns
	* 0 on success
	* -1 on error and errno is set.
	*/

	int knet_host_get_status(knet_handle_t knet_h, knet_node_id_t host_id,
	struct knet_host_status *status);

	/*
	* link structs/API calls
	*
	* every host allocated/managed by knet_host_* has
	* KNET_MAX_LINK structures to define the network
	* paths that connect 2 hosts.
	*
	* Each link is identified by a link_id that has a
	* values between 0 and KNET_MAX_LINK - 1.
	*
	* KNOWN LIMITATIONS:
	*
	* - let's assume the scenario where two hosts are connected
	* with any number of links. link_id must match on both sides.
	* If host_id 0 link_id 0 is configured to connect IP1 to IP2 and
	* host_id 0 link_id 1 is configured to connect IP3 to IP4,
	* host_id 1 link_id 0 _must_ connect IP2 to IP1 and likewise
	* host_id 1 link_id 1 _must_ connect IP4 to IP3.
	* We might be able to lift this restriction in future, by using
	* other data to determine src/dst link_id, but for now, deal with it.
	*/

	/*
	* commodity functions to convert strings to sockaddr and viceversa
	*/

	/**
	* knet_strtoaddr
	*
	* @brief Convert a hostname string to an address
	*
	* host - IPaddr/hostname to convert
	* be aware only the first IP address will be returned
	* in case a hostname resolves to multiple IP
	*
	* port - port to connect to
	*
	* ss - sockaddr_storage where to store the converted data
	*
	* sslen - len of the sockaddr_storage
	*
	* @return
	* knet_strtoaddr returns same error codes as getaddrinfo
	*
	*/

	int knet_strtoaddr(const char host, const char port,
	struct sockaddr_storage *ss, socklen_t sslen);

	/**
	* knet_addrtostr
	*
	* @brief Convert an address to a host name
	*
	* ss - sockaddr_storage to convert
	*
	* sslen - len of the sockaddr_storage
	*
	* host - IPaddr/hostname where to store data
	* (recommended size: KNET_MAX_HOST_LEN)
	*
	* port - port buffer where to store data
	* (recommended size: KNET_MAX_PORT_LEN)
	*
	* @return
	* knet_strtoaddr returns same error codes as getnameinfo
	*/

	int knet_addrtostr(const struct sockaddr_storage *ss, socklen_t sslen,
	char *addr_buf, size_t addr_buf_size,
	char *port_buf, size_t port_buf_size);



	#define KNET_TRANSPORT_LOOPBACK 0
	#define KNET_TRANSPORT_UDP 1
	#define KNET_TRANSPORT_SCTP 2
	#define KNET_MAX_TRANSPORTS UINT8_MAX

	/*
	* The Loopback transport is only valid for connections to localhost, the host
	* with the same node_id specified in knet_handle_new(). Only one link of this
	* type is allowed. Data sent down a LOOPBACK link will be copied directly from
	* the knet send datafd to the knet receive datafd so the application must be set
	* up to take data from that socket at least as often as it is sent or deadlocks
	* could occur. If used, a LOOPBACK link must be the only link configured to the
	* local host.
	*/

	struct knet_transport_info {
	const char name; / UDP/SCTP/etc... */
	uint8_t id; /* value that can be used for link_set_config */
	uint8_t properties; /* currently unused */
	char pad[256]; /* currently unused */
	};

	/**
	* knet_get_transport_list
	*
	* @brief Get a list of the transports support by this build of knet
	*
	* transport_list - an array of struct transport_info that must be
	* at least of size struct transport_info * KNET_MAX_TRANSPORTS
	*
	* transport_list_entries - pointer to a size_t where to store how many transports
	* are available in this build of libknet.
	*
	* @return
	* knet_get_transport_list returns
	* 0 on success
	* -1 on error and errno is set.
	*/

	int knet_get_transport_list(struct knet_transport_info *transport_list,
	size_t *transport_list_entries);

	/**
	* knet_get_transport_name_by_id
	*
	* @brief Get a transport name from its ID number
	*
	* transport - one of the KNET_TRANSPORT_xxx constants
	*
	* @return
	* knet_get_transport_name_by_id returns:
	*
	* @retval pointer to the name on success or
	* @retval NULL on error and errno is set.
	*/

	const char *knet_get_transport_name_by_id(uint8_t transport);

	/**
	* knet_get_transport_id_by_name
	*
	* @brief Get a transport ID from its name
	*
	* name - transport name (UDP/SCTP/etc)
	*
	* @return
	* knet_get_transport_name_by_id returns:
	*
	* @retval KNET_MAX_TRANSPORTS on error and errno is set accordingly
	* @retval KNET_TRANSPORT_xxx on success.
	*/

	uint8_t knet_get_transport_id_by_name(const char *name);



	#define KNET_TRANSPORT_DEFAULT_RECONNECT_INTERVAL 1000

	/**
	* knet_handle_set_transport_reconnect_interval
	*
	* @brief Set the interval between transport attempts to reconnect a failed link
	*
	* knet_h - pointer to knet_handle_t
	*
	* msecs - milliseconds
	*
	* @return
	* knet_handle_set_transport_reconnect_interval returns
	* 0 on success
	* -1 on error and errno is set.
	*/

	int knet_handle_set_transport_reconnect_interval(knet_handle_t knet_h, uint32_t msecs);

	/**
	* knet_handle_get_transport_reconnect_interval
	*
	* @brief Get the interval between transport attempts to reconnect a failed link
	*
	* knet_h - pointer to knet_handle_t
	*
	* msecs - milliseconds
	*
	* @return
	* knet_handle_get_transport_reconnect_interval returns
	* 0 on success
	* -1 on error and errno is set.
	*/

	int knet_handle_get_transport_reconnect_interval(knet_handle_t knet_h, uint32_t *msecs);

	/**
	* knet_link_set_config
	*
	* @brief Configure the link to a host
	*
	* knet_h - pointer to knet_handle_t
	*
	* host_id - see knet_host_add(3)
	*
	* link_id - see knet_link_set_config(3)
	*
	* transport - one of the KNET_TRANSPORT_xxx constants
	*
	* src_addr - sockaddr_storage that can be either IPv4 or IPv6
	*
	* dst_addr - sockaddr_storage that can be either IPv4 or IPv6
	* this can be null if we don't know the incoming
	* IP address/port and the link will remain quiet
	* till the node on the other end will initiate a
	* connection
	*
	* flags - KNET_LINK_FLAG_*
	*
	* @return
	* knet_link_set_config returns
	* 0 on success
	* -1 on error and errno is set.
	*/

	int knet_link_set_config(knet_handle_t knet_h, knet_node_id_t host_id, uint8_t link_id,
	uint8_t transport,
	struct sockaddr_storage *src_addr,
	struct sockaddr_storage *dst_addr,
	uint64_t flags);

	/**
	* knet_link_get_config
	*
	* @brief Get the link configutation information
	*
	* knet_h - pointer to knet_handle_t
	*
	* host_id - see knet_host_add(3)
	*
	* link_id - see knet_link_set_config(3)
	*
	* transport - see knet_link_set_config(3)
	*
	* src_addr - sockaddr_storage that can be either IPv4 or IPv6
	*
	* dst_addr - sockaddr_storage that can be either IPv4 or IPv6
	*
	* dynamic - 0 if dst_addr is static or 1 if dst_addr is dynamic.
	* In case of 1, dst_addr can be NULL and it will be left
	* untouched.
	*
	* flags - KNET_LINK_FLAG_*
	*
	* @return
	* knet_link_get_config returns
	* 0 on success.
	* -1 on error and errno is set.
	*/

	int knet_link_get_config(knet_handle_t knet_h, knet_node_id_t host_id, uint8_t link_id,
	uint8_t *transport,
	struct sockaddr_storage *src_addr,
	struct sockaddr_storage *dst_addr,
	uint8_t *dynamic,
	uint64_t *flags);

	/**
	* knet_link_clear_config
	*
	* @brief Clear link information and disconnect the link
	*
	* knet_h - pointer to knet_handle_t
	*
	* host_id - see knet_host_add(3)
	*
	* link_id - see knet_link_set_config(3)
	*
	* @return
	* knet_link_clear_config returns
	* 0 on success.
	* -1 on error and errno is set.
	*/

	int knet_link_clear_config(knet_handle_t knet_h, knet_node_id_t host_id, uint8_t link_id);

	/*
	* Access lists management for open links
	* see also knet_handle_enable_access_lists(3)
	*/

	/**
	* check_type_t
	* @brief address type enum for knet access lists
	*
	* CHECK_TYPE_ADDRESS is the equivalent of a single entry / IP address.
	* for example: 10.1.9.3
	* and the entry is stored in ss1. ss2 can be NULL.
	*
	* CHECK_TYPE_MASK is used to configure network/netmask.
	* for example: 192.168.0.0/24
	* the network is stored in ss1 and the netmask in ss2.
	*
	* CHECK_TYPE_RANGE defines a value / range of ip addresses.
	* for example: 172.16.0.1-172.16.0.10
	* the start is stored in ss1 and the end in ss2.
	*
	* Please be aware that the above examples refer only to IP based protocols.
	* Other protocols might use ss1 and ss2 in slightly different ways.
	* At the moment knet only supports IP based protocol, though that might change
	* in the future.
	*/

	typedef enum {
	CHECK_TYPE_ADDRESS,
	CHECK_TYPE_MASK,
	CHECK_TYPE_RANGE
	} check_type_t;

	/**
	* check_acceptreject_t
	* @brief enum for accept/reject in knet access lists
	*
	* accept or reject incoming packets defined in the access list entry
	*/

	typedef enum {
	CHECK_ACCEPT,
	CHECK_REJECT
	} check_acceptreject_t;

	/**
	* knet_link_add_acl
	*
	* @brief Add access list entry to an open link
	*
	* knet_h - pointer to knet_handle_t
	*
	* host_id - see knet_host_add(3)
	*
	* link_id - see knet_link_set_config(3)
	*
	* ss1 / ss2 / type / acceptreject - see typedef definitions for details
	*
	* IMPORTANT: the order in which access lists are added is critical and it
	* is left to the user to add them in the right order. knet
	* will not attempt to logically sort them.
	*
	* For example:
	* 1 - accept from 10.0.0.0/8
	* 2 - reject from 10.0.0.1/32
	*
	* is not the same as:
	*
	* 1 - reject from 10.0.0.1/32
	* 2 - accept from 10.0.0.0/8
	*
	* In the first example, rule number 2 will never match because
	* packets from 10.0.0.1 will be accepted by rule number 1.
	*
	* @return
	* knet_link_add_acl returns
	* 0 on success.
	* -1 on error and errno is set.
	*/

	int knet_link_add_acl(knet_handle_t knet_h, knet_node_id_t host_id, uint8_t link_id,
	struct sockaddr_storage *ss1,
	struct sockaddr_storage *ss2,
	check_type_t type, check_acceptreject_t acceptreject);

	/**
	* knet_link_insert_acl
	*
	* @brief Insert access list entry to an open link at given index
	*
	* knet_h - pointer to knet_handle_t
	*
	* host_id - see knet_host_add(3)
	*
	* link_id - see knet_link_set_config(3)
	*
	* index - insert at position "index" where 0 is the first entry and -1
	* appends to the current list.
	*
	* ss1 / ss2 / type / acceptreject - see typedef definitions for details
	*
	* @return
	* knet_link_insert_acl returns
	* 0 on success.
	* -1 on error and errno is set.
	*/

	int knet_link_insert_acl(knet_handle_t knet_h, knet_node_id_t host_id, uint8_t link_id,
	int index,
	struct sockaddr_storage *ss1,
	struct sockaddr_storage *ss2,
	check_type_t type, check_acceptreject_t acceptreject);

	/**
	* knet_link_rm_acl
	*
	* @brief Remove access list entry from an open link
	*
	* knet_h - pointer to knet_handle_t
	*
	* host_id - see knet_host_add(3)
	*
	* link_id - see knet_link_set_config(3)
	*
	* ss1 / ss2 / type / acceptreject - see typedef definitions for details
	*
	* IMPORTANT: the data passed to this API call must match exactly that passed
	* to knet_link_add_acl(3).
	*
	* @return
	* knet_link_rm_acl returns
	* 0 on success.
	* -1 on error and errno is set.
	*/

	int knet_link_rm_acl(knet_handle_t knet_h, knet_node_id_t host_id, uint8_t link_id,
	struct sockaddr_storage *ss1,
	struct sockaddr_storage *ss2,
	check_type_t type, check_acceptreject_t acceptreject);

	/**
	* knet_link_clear_acl
	*
	* @brief Remove all access list entries from an open link
	*
	* knet_h - pointer to knet_handle_t
	*
	* host_id - see knet_host_add(3)
	*
	* link_id - see knet_link_set_config(3)
	*
	* @return
	* knet_link_clear_acl returns
	* 0 on success.
	* -1 on error and errno is set.
	*/

	int knet_link_clear_acl(knet_handle_t knet_h, knet_node_id_t host_id, uint8_t link_id);

	/**
	* knet_link_set_enable
	*
	* @brief Enable traffic on a link
	*
	* knet_h - pointer to knet_handle_t
	*
	* host_id - see knet_host_add(3)
	*
	* link_id - see knet_link_set_config(3)
	*
	* enabled - 0 disable the link, 1 enable the link
	*
	* @return
	* knet_link_set_enable returns
	* 0 on success
	* -1 on error and errno is set.
	*/

	int knet_link_set_enable(knet_handle_t knet_h, knet_node_id_t host_id, uint8_t link_id,
	unsigned int enabled);

	/**
	* knet_link_get_enable
	*
	* @brief Find out whether a link is enabled or not
	*
	* knet_h - pointer to knet_handle_t
	*
	* host_id - see knet_host_add(3)
	*
	* link_id - see knet_link_set_config(3)
	*
	* enabled - 0 disable the link, 1 enable the link
	*
	* @return
	* knet_link_get_enable returns
	* 0 on success
	* -1 on error and errno is set.
	*/

	int knet_link_get_enable(knet_handle_t knet_h, knet_node_id_t host_id, uint8_t link_id,
	unsigned int *enabled);



	#define KNET_LINK_DEFAULT_PING_INTERVAL 1000 /* 1 second */
	#define KNET_LINK_DEFAULT_PING_TIMEOUT 2000 /* 2 seconds */
	#define KNET_LINK_DEFAULT_PING_PRECISION 2048 /* samples */

	/**
	* knet_link_set_ping_timers
	*
	* @brief Set the ping timers for a link
	*
	* knet_h - pointer to knet_handle_t
	*
	* host_id - see knet_host_add(3)
	*
	* link_id - see knet_link_set_config(3)
	*
	* interval - specify the ping interval in milliseconds.
	*
	* timeout - if no pong is received within this time,
	* the link is declared dead, in milliseconds.
	* NOTE: in future it will be possible to set timeout to 0
	* for an autocalculated timeout based on interval, pong_count
	* and latency. The API already accept 0 as value and it will
	* return ENOSYS / -1. Once the automatic calculation feature
	* will be implemented, this call will only return EINVAL
	* for incorrect values.
	*
	* precision - how many values of latency are used to calculate
	* the average link latency (see also knet_link_get_status(3))
	*
	* @return
	* knet_link_set_ping_timers returns
	* 0 on success
	* -1 on error and errno is set.
	*/

	int knet_link_set_ping_timers(knet_handle_t knet_h, knet_node_id_t host_id, uint8_t link_id,
	time_t interval, time_t timeout, unsigned int precision);

	/**
	* knet_link_get_ping_timers
	*
	* @brief Get the ping timers for a link
	*
	* knet_h - pointer to knet_handle_t
	*
	* host_id - see knet_host_add(3)
	*
	* link_id - see knet_link_set_config(3)
	*
	* interval - ping interval
	*
	* timeout - if no pong is received within this time,
	* the link is declared dead
	*
	* precision - how many values of latency are used to calculate
	* the average link latency (see also knet_link_get_status(3))
	*
	* @return
	* knet_link_get_ping_timers returns
	* 0 on success
	* -1 on error and errno is set.
	*/

	int knet_link_get_ping_timers(knet_handle_t knet_h, knet_node_id_t host_id, uint8_t link_id,
	time_t interval, time_t timeout, unsigned int *precision);



	#define KNET_LINK_DEFAULT_PONG_COUNT 5

	/**
	* knet_link_set_pong_count
	*
	* @brief Set the pong count for a link
	*
	* knet_h - pointer to knet_handle_t
	*
	* host_id - see knet_host_add(3)
	*
	* link_id - see knet_link_set_config(3)
	*
	* pong_count - how many valid ping/pongs before a link is marked UP.
	* default: 5, value should be > 0
	*
	* @return
	* knet_link_set_pong_count returns
	* 0 on success
	* -1 on error and errno is set.
	*/

	int knet_link_set_pong_count(knet_handle_t knet_h, knet_node_id_t host_id, uint8_t link_id,
	uint8_t pong_count);

	/**
	* knet_link_get_pong_count
	*
	* @brief Get the pong count for a link
	*
	* knet_h - pointer to knet_handle_t
	*
	* host_id - see knet_host_add(3)
	*
	* link_id - see knet_link_set_config(3)
	*
	* pong_count - how many valid ping/pongs before a link is marked UP.
	* default: 5, value should be > 0
	*
	* @return
	* knet_link_get_pong_count returns
	* 0 on success
	* -1 on error and errno is set.
	*/

	int knet_link_get_pong_count(knet_handle_t knet_h, knet_node_id_t host_id, uint8_t link_id,
	uint8_t *pong_count);

	/**
	* knet_link_set_priority
	*
	* @brief Set the priority for a link
	*
	* knet_h - pointer to knet_handle_t
	*
	* host_id - see knet_host_add(3)
	*
	* link_id - see knet_link_set_config(3)
	*
	* priority - specify the switching priority for this link
	* see also knet_host_set_policy
	*
	* @return
	* knet_link_set_priority returns
	* 0 on success
	* -1 on error and errno is set.
	*/

	int knet_link_set_priority(knet_handle_t knet_h, knet_node_id_t host_id, uint8_t link_id,
	uint8_t priority);

	/**
	* knet_link_get_priority
	*
	* @brief Get the priority for a link
	*
	* knet_h - pointer to knet_handle_t
	*
	* host_id - see knet_host_add(3)
	*
	* link_id - see knet_link_set_config(3)
	*
	* priority - gather the switching priority for this link
	* see also knet_host_set_policy
	*
	* @return
	* knet_link_get_priority returns
	* 0 on success
	* -1 on error and errno is set.
	*/

	int knet_link_get_priority(knet_handle_t knet_h, knet_node_id_t host_id, uint8_t link_id,
	uint8_t *priority);

	/**
	* knet_link_get_link_list
	*
	* @brief Get a list of links connecting a host
	*
	* knet_h - pointer to knet_handle_t
	*
	* link_ids - array of at lest KNET_MAX_LINK size
	* with the list of configured links for a certain host.
	*
	* link_ids_entries -
	* number of entries contained in link_ids
	*
	* @return
	* knet_link_get_link_list returns
	* 0 on success
	* -1 on error and errno is set.
	*/

	int knet_link_get_link_list(knet_handle_t knet_h, knet_node_id_t host_id,
	uint8_t link_ids, size_t link_ids_entries);

	/*
	* define link status structure for quick lookup
	*
	* src/dst_{ipaddr,port} strings are filled by
	* getnameinfo(3) when configuring the link.
	* if the link is dynamic (see knet_link_set_config(3))
	* dst_ipaddr/port will contain ipaddr/port of the currently
	* connected peer or "Unknown" if it was not possible
	* to determine the ipaddr/port at runtime.
	*
	* enabled see also knet_link_set/get_enable.
	*
	* connected the link is connected to a peer and ping/pong traffic
	* is flowing.
	*
	* dynconnected the link has dynamic ip on the other end, and
	* we can see the other host is sending pings to us.
	*
	* latency average latency of this link
	* see also knet_link_set/get_timeout.
	*
	* pong_last if the link is down, this value tells us how long
	* ago this link was active. A value of 0 means that the link
	* has never been active.
	*
	* knet_link_stats structure that contains details statistics for the link
	*/

	#define MAX_LINK_EVENTS 16

	struct knet_link_stats {
	/* onwire values */
	uint64_t tx_data_packets;
	uint64_t rx_data_packets;
	uint64_t tx_data_bytes;
	uint64_t rx_data_bytes;
	uint64_t rx_ping_packets;
	uint64_t tx_ping_packets;
	uint64_t rx_ping_bytes;
	uint64_t tx_ping_bytes;
	uint64_t rx_pong_packets;
	uint64_t tx_pong_packets;
	uint64_t rx_pong_bytes;
	uint64_t tx_pong_bytes;
	uint64_t rx_pmtu_packets;
	uint64_t tx_pmtu_packets;
	uint64_t rx_pmtu_bytes;
	uint64_t tx_pmtu_bytes;

	/* Only filled in when requested */
	uint64_t tx_total_packets;
	uint64_t rx_total_packets;
	uint64_t tx_total_bytes;
	uint64_t rx_total_bytes;
	uint64_t tx_total_errors;
	uint64_t tx_total_retries;

	uint32_t tx_pmtu_errors;
	uint32_t tx_pmtu_retries;
	uint32_t tx_ping_errors;
	uint32_t tx_ping_retries;
	uint32_t tx_pong_errors;
	uint32_t tx_pong_retries;
	uint32_t tx_data_errors;
	uint32_t tx_data_retries;

	/* measured in usecs */
	uint32_t latency_min;
	uint32_t latency_max;
	uint32_t latency_ave;
	uint32_t latency_samples;

	/* how many times the link has been going up/down */
	uint32_t down_count;
	uint32_t up_count;

	/*
	* circular buffer of time_t structs collecting the history
	* of up/down events on this link.
	* the index indicates current/last event.
	* it is safe to walk back the history by decreasing the index
	*/
	time_t last_up_times[MAX_LINK_EVENTS];
	time_t last_down_times[MAX_LINK_EVENTS];
	int8_t last_up_time_index;
	int8_t last_down_time_index;
	/* Always add new stats at the end */
	};

	struct knet_link_status {
	size_t size; /* For ABI checking */
	char src_ipaddr[KNET_MAX_HOST_LEN];
	char src_port[KNET_MAX_PORT_LEN];
	char dst_ipaddr[KNET_MAX_HOST_LEN];
	char dst_port[KNET_MAX_PORT_LEN];
	uint8_t enabled; /* link is configured and admin enabled for traffic */
	uint8_t connected; /* link is connected for data (local view) */
	uint8_t dynconnected; /* link has been activated by remote dynip */
	unsigned long long latency; /* average latency computed by fix/exp */
	struct timespec pong_last;
	unsigned int mtu; /* current detected MTU on this link */
	unsigned int proto_overhead; /* contains the size of the IP protocol, knet headers and
	* crypto headers (if configured). This value is filled in
	* ONLY after the first PMTUd run on that given link,
	* and can change if link configuration or crypto configuration
	* changes at runtime.
	* WARNING: in general mtu + proto_overhead might or might
	* not match the output of ifconfig mtu due to crypto
	* requirements to pad packets to some specific boundaries. */
	/* Link statistics */
	struct knet_link_stats stats;
	};

	/**
	* knet_link_get_status
	*
	* @brief Get the status (and statistics) for a link
	*
	* knet_h - pointer to knet_handle_t
	*
	* host_id - see knet_host_add(3)
	*
	* link_id - see knet_link_set_config(3)
	*
	* status - pointer to knet_link_status struct
	*
	* struct_size - max size of knet_link_status - allows library to
	* add fields without ABI change. Returned structure
	* will be truncated to this length and .size member
	* indicates the full size.
	*
	* @return
	* knet_link_get_status returns
	* 0 on success
	* -1 on error and errno is set.
	*/

	int knet_link_get_status(knet_handle_t knet_h, knet_node_id_t host_id, uint8_t link_id,
	struct knet_link_status *status, size_t struct_size);

	/*
	* logging structs/API calls
	*/

	/*
	* libknet is composed of several subsystems. In order
	* to easily distinguish log messages coming from different
	* places, each subsystem has its own ID.
	*
	* 0-19 config/management
	* 20-39 internal threads
	* 40-59 transports
	* 60-69 crypto implementations
	*/

	#define KNET_SUB_COMMON 0 /* common.c */
	#define KNET_SUB_HANDLE 1 /* handle.c alloc/dealloc config changes */
	#define KNET_SUB_HOST 2 /* host add/del/modify */
	#define KNET_SUB_LISTENER 3 /* listeners add/del/modify... */
	#define KNET_SUB_LINK 4 /* link add/del/modify */
	#define KNET_SUB_TRANSPORT 5 /* Transport common */
	#define KNET_SUB_CRYPTO 6 /* crypto.c config generic layer */
	#define KNET_SUB_COMPRESS 7 /* compress.c config generic layer */

	#define KNET_SUB_FILTER 19 /* allocated for users to log from dst_filter */

	#define KNET_SUB_DSTCACHE 20 /* switching thread (destination cache handling) */
	#define KNET_SUB_HEARTBEAT 21 /* heartbeat thread */
	#define KNET_SUB_PMTUD 22 /* Path MTU Discovery thread */
	#define KNET_SUB_TX 23 /* send to link thread */
	#define KNET_SUB_RX 24 /* recv from link thread */

	#define KNET_SUB_TRANSP_BASE 40 /* Base log level for transports */
	#define KNET_SUB_TRANSP_LOOPBACK (KNET_SUB_TRANSP_BASE + KNET_TRANSPORT_LOOPBACK)
	#define KNET_SUB_TRANSP_UDP (KNET_SUB_TRANSP_BASE + KNET_TRANSPORT_UDP)
	#define KNET_SUB_TRANSP_SCTP (KNET_SUB_TRANSP_BASE + KNET_TRANSPORT_SCTP)

	#define KNET_SUB_NSSCRYPTO 60 /* nsscrypto.c */
	#define KNET_SUB_OPENSSLCRYPTO 61 /* opensslcrypto.c */

	#define KNET_SUB_ZLIBCOMP 70 /* compress_zlib.c */
	#define KNET_SUB_LZ4COMP 71 /* compress_lz4.c */
	#define KNET_SUB_LZ4HCCOMP 72 /* compress_lz4.c */
	#define KNET_SUB_LZO2COMP 73 /* compress_lzo.c */
	#define KNET_SUB_LZMACOMP 74 /* compress_lzma.c */
	#define KNET_SUB_BZIP2COMP 75 /* compress_bzip2.c */
	#define KNET_SUB_ZSTDCOMP 76 /* compress_zstd.c */

	#define KNET_SUB_UNKNOWN UINT8_MAX - 1
	#define KNET_MAX_SUBSYSTEMS UINT8_MAX

	/*
	* Convert between subsystem IDs and names
	*/

	/**
	* knet_log_get_subsystem_name
	*
	* @brief Get a logging system name from its numeric ID
	*
	* @return
	* returns internal name of the subsystem or "common"
	*/

	const char *knet_log_get_subsystem_name(uint8_t subsystem);

	/**
	* knet_log_get_subsystem_id
	*
	* @brief Get a logging system ID from its name
	*
	* @return
	* returns internal ID of the subsystem or KNET_SUB_COMMON
	*/

	uint8_t knet_log_get_subsystem_id(const char *name);

	/*
	* 4 log levels are enough for everybody
	*/

	#define KNET_LOG_ERR 0 /* unrecoverable errors/conditions */
	#define KNET_LOG_WARN 1 /* recoverable errors/conditions */
	#define KNET_LOG_INFO 2 /* info, link up/down, config changes.. */
	#define KNET_LOG_DEBUG 3

	/*
	* Convert between log level values and names
	*/

	/**
	* knet_log_get_loglevel_name
	*
	* @brief Get a logging level name from its numeric ID
	*
	* @return
	* returns internal name of the log level or "ERROR" for unknown values
	*/

	const char *knet_log_get_loglevel_name(uint8_t level);

	/**
	* knet_log_get_loglevel_id
	*
	* @brief Get a logging level ID from its name
	*
	* @return
	* returns internal log level ID or KNET_LOG_ERR for invalid names
	*/

	uint8_t knet_log_get_loglevel_id(const char *name);

	/*
	* every log message is composed by a text message
	* and message level/subsystem IDs.
	* In order to make debugging easier it is possible to send those packets
	* straight to stdout/stderr (see knet_bench.c stdout option).
	*/

	#define KNET_MAX_LOG_MSG_SIZE 254
	#if KNET_MAX_LOG_MSG_SIZE > PIPE_BUF
	#error KNET_MAX_LOG_MSG_SIZE cannot be bigger than PIPE_BUF for guaranteed system atomic writes
	#endif

	struct knet_log_msg {
	char msg[KNET_MAX_LOG_MSG_SIZE];
	uint8_t subsystem; /* KNET_SUB_* */
	uint8_t msglevel; /* KNET_LOG_* */
	};

	/**
	* knet_log_set_loglevel
	*
	* @brief Set the logging level for a subsystem
	*
	* knet_h - same as above
	*
	* subsystem - same as above
	*
	* level - same as above
	*
	* knet_log_set_loglevel allows fine control of log levels by subsystem.
	* See also knet_handle_new for defaults.
	*
	* @return
	* knet_log_set_loglevel returns
	* 0 on success
	* -1 on error and errno is set.
	*/

	int knet_log_set_loglevel(knet_handle_t knet_h, uint8_t subsystem,
	uint8_t level);

	/**
	* knet_log_get_loglevel
	*
	* @brief Get the logging level for a subsystem
	*
	* knet_h - same as above
	*
	* subsystem - same as above
	*
	* level - same as above
	*
	* @return
	* knet_log_get_loglevel returns
	* 0 on success
	* -1 on error and errno is set.
	*/

	int knet_log_get_loglevel(knet_handle_t knet_h, uint8_t subsystem,
	uint8_t *level);

	#endif
	diff --git a/libknet/tests/api_knet_handle_crypto.c b/libknet/tests/api_knet_handle_crypto.c
	index 1805909b..9dbf5bc0 100644
	--- a/libknet/tests/api_knet_handle_crypto.c
	+++ b/libknet/tests/api_knet_handle_crypto.c
	@@ -1,240 +1,332 @@
	/*
	* Copyright (C) 2016-2019 Red Hat, Inc. All rights reserved.
	*
	* Authors: Fabio M. Di Nitto <fabbione@kronosnet.org>
	*
	* This software licensed under GPL-2.0+, LGPL-2.0+
	*/

	#include "config.h"

	#include <errno.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <unistd.h>

	#include "libknet.h"

	#include "internals.h"
	+#include "crypto_model.h"
	#include "test-common.h"

	-static void test(const char *model)
	+static void test(const char model, const char model2)
	{
	knet_handle_t knet_h;
	int logfds[2];
	struct knet_handle_crypto_cfg knet_handle_crypto_cfg;
	+ struct crypto_instance *current = NULL;

	memset(&knet_handle_crypto_cfg, 0, sizeof(struct knet_handle_crypto_cfg));

	printf("Test knet_handle_crypto incorrect knet_h\n");

	if ((!knet_handle_crypto(NULL, &knet_handle_crypto_cfg)) \|\| (errno != EINVAL)) {
	printf("knet_handle_crypto accepted invalid knet_h or returned incorrect error: %s\n", strerror(errno));
	exit(FAIL);
	}

	setup_logpipes(logfds);

	knet_h = knet_handle_start(logfds, KNET_LOG_DEBUG);

	flush_logs(logfds[0], stdout);

	printf("Test knet_handle_crypto with invalid cfg\n");

	if ((!knet_handle_crypto(knet_h, NULL)) \|\| (errno != EINVAL)) {
	printf("knet_handle_crypto accepted invalid cfg or returned incorrect error: %s\n", strerror(errno));
	knet_handle_free(knet_h);
	flush_logs(logfds[0], stdout);
	close_logpipes(logfds);
	exit(FAIL);
	}

	flush_logs(logfds[0], stdout);

	printf("Test knet_handle_crypto with un-initialized cfg\n");

	if ((!knet_handle_crypto(knet_h, &knet_handle_crypto_cfg)) \|\| (errno != EINVAL)) {
	printf("knet_handle_crypto accepted invalid un-initialized cfg\n");
	knet_handle_free(knet_h);
	flush_logs(logfds[0], stdout);
	close_logpipes(logfds);
	exit(FAIL);
	}

	flush_logs(logfds[0], stdout);

	printf("Test knet_handle_crypto with none crypto model (disable crypto)\n");

	memset(&knet_handle_crypto_cfg, 0, sizeof(struct knet_handle_crypto_cfg));
	strncpy(knet_handle_crypto_cfg.crypto_model, "none", sizeof(knet_handle_crypto_cfg.crypto_model) - 1);
	strncpy(knet_handle_crypto_cfg.crypto_cipher_type, "aes128", sizeof(knet_handle_crypto_cfg.crypto_cipher_type) - 1);
	strncpy(knet_handle_crypto_cfg.crypto_hash_type, "sha1", sizeof(knet_handle_crypto_cfg.crypto_hash_type) - 1);

	if (knet_handle_crypto(knet_h, &knet_handle_crypto_cfg) != 0) {
	printf("knet_handle_crypto did not accept none crypto mode cfg\n");
	knet_handle_free(knet_h);
	flush_logs(logfds[0], stdout);
	close_logpipes(logfds);
	exit(FAIL);
	}

	flush_logs(logfds[0], stdout);

	printf("Test knet_handle_crypto with none crypto cipher and hash (disable crypto)\n");

	memset(&knet_handle_crypto_cfg, 0, sizeof(struct knet_handle_crypto_cfg));
	strncpy(knet_handle_crypto_cfg.crypto_model, model, sizeof(knet_handle_crypto_cfg.crypto_model) - 1);
	strncpy(knet_handle_crypto_cfg.crypto_cipher_type, "none", sizeof(knet_handle_crypto_cfg.crypto_cipher_type) - 1);
	strncpy(knet_handle_crypto_cfg.crypto_hash_type, "none", sizeof(knet_handle_crypto_cfg.crypto_hash_type) - 1);

	if (knet_handle_crypto(knet_h, &knet_handle_crypto_cfg) != 0) {
	printf("knet_handle_crypto did not accept none crypto cipher and hash cfg\n");
	knet_handle_free(knet_h);
	flush_logs(logfds[0], stdout);
	close_logpipes(logfds);
	exit(FAIL);
	}

	flush_logs(logfds[0], stdout);

	printf("Test knet_handle_crypto with %s/aes128/sha1 and too short key\n", model);

	memset(&knet_handle_crypto_cfg, 0, sizeof(struct knet_handle_crypto_cfg));
	strncpy(knet_handle_crypto_cfg.crypto_model, model, sizeof(knet_handle_crypto_cfg.crypto_model) - 1);
	strncpy(knet_handle_crypto_cfg.crypto_cipher_type, "aes128", sizeof(knet_handle_crypto_cfg.crypto_cipher_type) - 1);
	strncpy(knet_handle_crypto_cfg.crypto_hash_type, "sha1", sizeof(knet_handle_crypto_cfg.crypto_hash_type) - 1);
	knet_handle_crypto_cfg.private_key_len = 10;

	if ((!knet_handle_crypto(knet_h, &knet_handle_crypto_cfg)) \|\| (errno != EINVAL)) {
	printf("knet_handle_crypto accepted too short private key\n");
	knet_handle_free(knet_h);
	flush_logs(logfds[0], stdout);
	close_logpipes(logfds);
	exit(FAIL);
	}

	flush_logs(logfds[0], stdout);

	printf("Test knet_handle_crypto with %s/aes128/sha1 and too long key\n", model);

	memset(&knet_handle_crypto_cfg, 0, sizeof(struct knet_handle_crypto_cfg));
	strncpy(knet_handle_crypto_cfg.crypto_model, model, sizeof(knet_handle_crypto_cfg.crypto_model) - 1);
	strncpy(knet_handle_crypto_cfg.crypto_cipher_type, "aes128", sizeof(knet_handle_crypto_cfg.crypto_cipher_type) - 1);
	strncpy(knet_handle_crypto_cfg.crypto_hash_type, "sha1", sizeof(knet_handle_crypto_cfg.crypto_hash_type) - 1);
	knet_handle_crypto_cfg.private_key_len = 10000;

	if ((!knet_handle_crypto(knet_h, &knet_handle_crypto_cfg)) \|\| (errno != EINVAL)) {
	printf("knet_handle_crypto accepted too long private key\n");
	knet_handle_free(knet_h);
	flush_logs(logfds[0], stdout);
	close_logpipes(logfds);
	exit(FAIL);
	}

	flush_logs(logfds[0], stdout);

	printf("Test knet_handle_crypto with %s/aes128/sha1 and normal key\n", model);

	memset(&knet_handle_crypto_cfg, 0, sizeof(struct knet_handle_crypto_cfg));
	strncpy(knet_handle_crypto_cfg.crypto_model, model, sizeof(knet_handle_crypto_cfg.crypto_model) - 1);
	strncpy(knet_handle_crypto_cfg.crypto_cipher_type, "aes128", sizeof(knet_handle_crypto_cfg.crypto_cipher_type) - 1);
	strncpy(knet_handle_crypto_cfg.crypto_hash_type, "sha1", sizeof(knet_handle_crypto_cfg.crypto_hash_type) - 1);
	knet_handle_crypto_cfg.private_key_len = 2000;

	if (knet_handle_crypto(knet_h, &knet_handle_crypto_cfg)) {
	printf("knet_handle_crypto failed with correct config: %s\n", strerror(errno));
	knet_handle_free(knet_h);
	flush_logs(logfds[0], stdout);
	close_logpipes(logfds);
	exit(FAIL);
	}

	flush_logs(logfds[0], stdout);

	+ printf("Test knet_handle_crypto reconfig with %s/aes128/sha1 and normal key\n", model2);
	+
	+ current = knet_h->crypto_instance;
	+
	+ memset(&knet_handle_crypto_cfg, 0, sizeof(struct knet_handle_crypto_cfg));
	+ strncpy(knet_handle_crypto_cfg.crypto_model, model, sizeof(knet_handle_crypto_cfg.crypto_model) - 1);
	+ strncpy(knet_handle_crypto_cfg.crypto_cipher_type, "aes128", sizeof(knet_handle_crypto_cfg.crypto_cipher_type) - 1);
	+ strncpy(knet_handle_crypto_cfg.crypto_hash_type, "sha1", sizeof(knet_handle_crypto_cfg.crypto_hash_type) - 1);
	+ knet_handle_crypto_cfg.private_key_len = 2000;
	+
	+ if (knet_handle_crypto(knet_h, &knet_handle_crypto_cfg)) {
	+ printf("knet_handle_crypto failed with correct config: %s\n", strerror(errno));
	+ knet_handle_free(knet_h);
	+ flush_logs(logfds[0], stdout);
	+ close_logpipes(logfds);
	+ exit(FAIL);
	+ }
	+
	+ flush_logs(logfds[0], stdout);
	+
	+ if (current == knet_h->crypto_instance) {
	+ printf("knet_handle_crypto failed to install new correct config: %s\n", strerror(errno));
	+ knet_handle_free(knet_h);
	+ flush_logs(logfds[0], stdout);
	+ close_logpipes(logfds);
	+ exit(FAIL);
	+ }
	+
	+ flush_logs(logfds[0], stdout);
	+
	+ printf("Test knet_handle_crypto reconfig with %s/aes128/sha1 and normal key\n", model);
	+
	+ current = knet_h->crypto_instance;
	+
	+ memset(&knet_handle_crypto_cfg, 0, sizeof(struct knet_handle_crypto_cfg));
	+ strncpy(knet_handle_crypto_cfg.crypto_model, model, sizeof(knet_handle_crypto_cfg.crypto_model) - 1);
	+ strncpy(knet_handle_crypto_cfg.crypto_cipher_type, "aes128", sizeof(knet_handle_crypto_cfg.crypto_cipher_type) - 1);
	+ strncpy(knet_handle_crypto_cfg.crypto_hash_type, "sha1", sizeof(knet_handle_crypto_cfg.crypto_hash_type) - 1);
	+ knet_handle_crypto_cfg.private_key_len = 2000;
	+
	+ if (knet_handle_crypto(knet_h, &knet_handle_crypto_cfg)) {
	+ printf("knet_handle_crypto failed with correct config: %s\n", strerror(errno));
	+ knet_handle_free(knet_h);
	+ flush_logs(logfds[0], stdout);
	+ close_logpipes(logfds);
	+ exit(FAIL);
	+ }
	+
	+ flush_logs(logfds[0], stdout);
	+
	+ if (current == knet_h->crypto_instance) {
	+ printf("knet_handle_crypto failed to install new correct config: %s\n", strerror(errno));
	+ knet_handle_free(knet_h);
	+ flush_logs(logfds[0], stdout);
	+ close_logpipes(logfds);
	+ exit(FAIL);
	+ }
	+
	+ flush_logs(logfds[0], stdout);
	+
	+ printf("Test knet_handle_crypto reconfig with %s/aes129/sha1 and normal key\n", model);
	+
	+ current = knet_h->crypto_instance;
	+
	+ memset(&knet_handle_crypto_cfg, 0, sizeof(struct knet_handle_crypto_cfg));
	+ strncpy(knet_handle_crypto_cfg.crypto_model, model, sizeof(knet_handle_crypto_cfg.crypto_model) - 1);
	+ strncpy(knet_handle_crypto_cfg.crypto_cipher_type, "aes129", sizeof(knet_handle_crypto_cfg.crypto_cipher_type) - 1);
	+ strncpy(knet_handle_crypto_cfg.crypto_hash_type, "sha1", sizeof(knet_handle_crypto_cfg.crypto_hash_type) - 1);
	+ knet_handle_crypto_cfg.private_key_len = 2000;
	+
	+ if (!knet_handle_crypto(knet_h, &knet_handle_crypto_cfg)) {
	+ printf("knet_handle_crypto failed to detect incorrect config: %s\n", strerror(errno));
	+ knet_handle_free(knet_h);
	+ flush_logs(logfds[0], stdout);
	+ close_logpipes(logfds);
	+ exit(FAIL);
	+ }
	+
	+ flush_logs(logfds[0], stdout);
	+
	+ if (current != knet_h->crypto_instance) {
	+ printf("knet_handle_crypto failed to restore correct config: %s\n", strerror(errno));
	+ knet_handle_free(knet_h);
	+ flush_logs(logfds[0], stdout);
	+ close_logpipes(logfds);
	+ exit(FAIL);
	+ }
	+
	+ flush_logs(logfds[0], stdout);
	+
	printf("Test knet_handle_crypto with %s/aes128/none and normal key\n", model);

	memset(&knet_handle_crypto_cfg, 0, sizeof(struct knet_handle_crypto_cfg));
	strncpy(knet_handle_crypto_cfg.crypto_model, model, sizeof(knet_handle_crypto_cfg.crypto_model) - 1);
	strncpy(knet_handle_crypto_cfg.crypto_cipher_type, "aes128", sizeof(knet_handle_crypto_cfg.crypto_cipher_type) - 1);
	strncpy(knet_handle_crypto_cfg.crypto_hash_type, "none", sizeof(knet_handle_crypto_cfg.crypto_hash_type) - 1);
	knet_handle_crypto_cfg.private_key_len = 2000;

	if (!knet_handle_crypto(knet_h, &knet_handle_crypto_cfg)) {
	printf("knet_handle_crypto accepted crypto without hashing\n");
	knet_handle_free(knet_h);
	flush_logs(logfds[0], stdout);
	close_logpipes(logfds);
	exit(FAIL);
	}

	flush_logs(logfds[0], stdout);

	printf("Test knet_handle_crypto with %s/aes128/sha1 and key where (key_len %% wrap_key_block_size != 0)\n", model);

	memset(&knet_handle_crypto_cfg, 0, sizeof(struct knet_handle_crypto_cfg));
	strncpy(knet_handle_crypto_cfg.crypto_model, model, sizeof(knet_handle_crypto_cfg.crypto_model) - 1);
	strncpy(knet_handle_crypto_cfg.crypto_cipher_type, "aes128", sizeof(knet_handle_crypto_cfg.crypto_cipher_type) - 1);
	strncpy(knet_handle_crypto_cfg.crypto_hash_type, "sha1", sizeof(knet_handle_crypto_cfg.crypto_hash_type) - 1);
	/*
	* Prime number so chance that (private_key_len % wrap_key_block_size == 0) is minimalized
	*/
	knet_handle_crypto_cfg.private_key_len = 2003;

	if (knet_handle_crypto(knet_h, &knet_handle_crypto_cfg) < 0) {
	printf("knet_handle_crypto doesn't accept private_ley with len 2003: %s\n", strerror(errno));
	knet_handle_free(knet_h);
	flush_logs(logfds[0], stdout);
	close_logpipes(logfds);
	exit(FAIL);
	}

	flush_logs(logfds[0], stdout);

	printf("Shutdown crypto\n");

	memset(&knet_handle_crypto_cfg, 0, sizeof(struct knet_handle_crypto_cfg));
	strncpy(knet_handle_crypto_cfg.crypto_model, "none", sizeof(knet_handle_crypto_cfg.crypto_model) - 1);
	strncpy(knet_handle_crypto_cfg.crypto_cipher_type, "none", sizeof(knet_handle_crypto_cfg.crypto_cipher_type) - 1);
	strncpy(knet_handle_crypto_cfg.crypto_hash_type, "none", sizeof(knet_handle_crypto_cfg.crypto_hash_type) - 1);
	knet_handle_crypto_cfg.private_key_len = 2000;

	if (knet_handle_crypto(knet_h, &knet_handle_crypto_cfg) < 0) {
	printf("Unable to shutdown crypto: %s\n", strerror(errno));
	knet_handle_free(knet_h);
	flush_logs(logfds[0], stdout);
	close_logpipes(logfds);
	exit(FAIL);
	}

	flush_logs(logfds[0], stdout);

	knet_handle_free(knet_h);
	flush_logs(logfds[0], stdout);
	close_logpipes(logfds);
	}

	int main(int argc, char *argv[])
	{
	struct knet_crypto_info crypto_list[16];
	size_t crypto_list_entries;
	size_t i;

	memset(crypto_list, 0, sizeof(crypto_list));

	if (knet_get_crypto_list(crypto_list, &crypto_list_entries) < 0) {
	printf("knet_get_crypto_list failed: %s\n", strerror(errno));
	return FAIL;
	}

	if (crypto_list_entries == 0) {
	printf("no crypto modules detected. Skipping\n");
	return SKIP;
	}

	for (i=0; i < crypto_list_entries; i++) {
	- test(crypto_list[i].name);
	+ test(crypto_list[i].name, crypto_list[0].name);
	}

	return PASS;
	}

File Metadata

Mime Type: text/x-diff
Expires: Mon, Feb 24, 3:32 PM (1 h, 29 m ago)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1464300
Default Alt Text: (168 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions