diff --git a/exec/coroparse.c b/exec/coroparse.c
index 87bbcebd..0acb4c24 100644
--- a/exec/coroparse.c
+++ b/exec/coroparse.c
@@ -1,1663 +1,1660 @@
 /*
  * Copyright (c) 2006-2019 Red Hat, Inc.
  *
  * All rights reserved.
  *
  * Author: Patrick Caulfield (pcaulfie@redhat.com)
  *         Jan Friesse (jfriesse@redhat.com)
  *
  * This software licensed under BSD license, the text of which follows:
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
  *
  * - Redistributions of source code must retain the above copyright notice,
  *   this list of conditions and the following disclaimer.
  * - Redistributions in binary form must reproduce the above copyright notice,
  *   this list of conditions and the following disclaimer in the documentation
  *   and/or other materials provided with the distribution.
  * - Neither the name of the MontaVista Software, Inc. nor the names of its
  *   contributors may be used to endorse or promote products derived from this
  *   software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include <config.h>
 
 #include <sys/types.h>
 #include <sys/uio.h>
 #include <sys/socket.h>
 #include <sys/stat.h>
 #include <sys/un.h>
 #include <netinet/in.h>
 #include <arpa/inet.h>
 #include <unistd.h>
 #include <fcntl.h>
 #include <stdlib.h>
 #include <stdio.h>
 #include <errno.h>
 #include <string.h>
 #include <dirent.h>
 #include <libgen.h>
 #include <limits.h>
 #include <stddef.h>
 #include <grp.h>
 #include <pwd.h>
 
 #include <qb/qblist.h>
 #include <qb/qbutil.h>
 #define LOGSYS_UTILS_ONLY 1
 #include <corosync/logsys.h>
 #include <corosync/icmap.h>
 
 #include "main.h"
 #include "util.h"
 
 enum parser_cb_type {
 	PARSER_CB_START,
 	PARSER_CB_END,
 	PARSER_CB_SECTION_START,
 	PARSER_CB_SECTION_END,
 	PARSER_CB_ITEM,
 };
 
 enum main_cp_cb_data_state {
 	MAIN_CP_CB_DATA_STATE_NORMAL,
 	MAIN_CP_CB_DATA_STATE_TOTEM,
 	MAIN_CP_CB_DATA_STATE_INTERFACE,
 	MAIN_CP_CB_DATA_STATE_LOGGER_SUBSYS,
 	MAIN_CP_CB_DATA_STATE_UIDGID,
 	MAIN_CP_CB_DATA_STATE_LOGGING_DAEMON,
 	MAIN_CP_CB_DATA_STATE_MEMBER,
 	MAIN_CP_CB_DATA_STATE_QUORUM,
 	MAIN_CP_CB_DATA_STATE_QDEVICE,
 	MAIN_CP_CB_DATA_STATE_NODELIST,
 	MAIN_CP_CB_DATA_STATE_NODELIST_NODE,
 	MAIN_CP_CB_DATA_STATE_PLOAD,
 	MAIN_CP_CB_DATA_STATE_SYSTEM,
 	MAIN_CP_CB_DATA_STATE_RESOURCES,
 	MAIN_CP_CB_DATA_STATE_RESOURCES_SYSTEM,
 	MAIN_CP_CB_DATA_STATE_RESOURCES_PROCESS,
 	MAIN_CP_CB_DATA_STATE_RESOURCES_SYSTEM_MEMUSED,
 	MAIN_CP_CB_DATA_STATE_RESOURCES_PROCESS_MEMUSED
 };
 
 typedef int (*parser_cb_f)(const char *path,
 			char *key,
 			char *value,
 			enum main_cp_cb_data_state *state,
 			enum parser_cb_type type,
 			const char **error_string,
 			icmap_map_t config_map,
 			void *user_data);
 
 struct key_value_list_item {
 	char *key;
 	char *value;
 	struct qb_list_head list;
 };
 
 struct main_cp_cb_data {
 	int linknumber;
 	char *bindnetaddr;
 	char *mcastaddr;
 	char *broadcast;
 	int mcastport;
 	int ttl;
 	int knet_link_priority;
 	int knet_ping_interval;
 	int knet_ping_timeout;
 	int knet_ping_precision;
 	int knet_pong_count;
 	int knet_pmtud_interval;
 	char *knet_transport;
 
 	struct qb_list_head logger_subsys_items_head;
 	char *subsys;
 	char *logging_daemon_name;
 	struct qb_list_head member_items_head;
 
 	int node_number;
 };
 
 static int read_config_file_into_icmap(
 	const char **error_string, icmap_map_t config_map);
 static char error_string_response[512];
 
 static int uid_determine (const char *req_user)
 {
 	int pw_uid = 0;
 	struct passwd passwd;
 	struct passwd* pwdptr = &passwd;
 	struct passwd* temp_pwd_pt;
 	char *pwdbuffer;
 	int  pwdlinelen, rc;
 	long int id;
 	char *ep;
 
 	id = strtol(req_user, &ep, 10);
 	if (*req_user != '\0' && *ep == '\0' && id >= 0 && id <= UINT_MAX) {
 		return (id);
 	}
 
 	pwdlinelen = sysconf (_SC_GETPW_R_SIZE_MAX);
 
 	if (pwdlinelen == -1) {
 	        pwdlinelen = 256;
 	}
 
 	pwdbuffer = malloc (pwdlinelen);
 
 	while ((rc = getpwnam_r (req_user, pwdptr, pwdbuffer, pwdlinelen, &temp_pwd_pt)) == ERANGE) {
 		char *n;
 
 		pwdlinelen *= 2;
 		if (pwdlinelen <= 32678) {
 			n = realloc (pwdbuffer, pwdlinelen);
 			if (n != NULL) {
 				pwdbuffer = n;
 				continue;
 			}
 		}
 	}
 	if (rc != 0) {
 		free (pwdbuffer);
 	        sprintf (error_string_response, "getpwnam_r(): %s", strerror(rc));
 	        return (-1);
 	}
 	if (temp_pwd_pt == NULL) {
 		free (pwdbuffer);
 	        sprintf (error_string_response,
 	                "The '%s' user is not found in /etc/passwd, please read the documentation.",
 	                req_user);
 	        return (-1);
 	}
 	pw_uid = passwd.pw_uid;
 	free (pwdbuffer);
 
 	return pw_uid;
 }
 
 static int gid_determine (const char *req_group)
 {
 	int corosync_gid = 0;
 	struct group group;
 	struct group * grpptr = &group;
 	struct group * temp_grp_pt;
 	char *grpbuffer;
 	int  grplinelen, rc;
 	long int id;
 	char *ep;
 
 	id = strtol(req_group, &ep, 10);
 	if (*req_group != '\0' && *ep == '\0' && id >= 0 && id <= UINT_MAX) {
 		return (id);
 	}
 
 	grplinelen = sysconf (_SC_GETGR_R_SIZE_MAX);
 
 	if (grplinelen == -1) {
 	        grplinelen = 256;
 	}
 
 	grpbuffer = malloc (grplinelen);
 
 	while ((rc = getgrnam_r (req_group, grpptr, grpbuffer, grplinelen, &temp_grp_pt)) == ERANGE) {
 		char *n;
 
 		grplinelen *= 2;
 		if (grplinelen <= 32678) {
 			n = realloc (grpbuffer, grplinelen);
 			if (n != NULL) {
 				grpbuffer = n;
 				continue;
 			}
 		}
 	}
 	if (rc != 0) {
 		free (grpbuffer);
 	        sprintf (error_string_response, "getgrnam_r(): %s", strerror(rc));
 	        return (-1);
 	}
 	if (temp_grp_pt == NULL) {
 		free (grpbuffer);
 	        sprintf (error_string_response,
 	                "The '%s' group is not found in /etc/group, please read the documentation.",
 	                req_group);
 		return (-1);
 	}
 	corosync_gid = group.gr_gid;
 	free (grpbuffer);
 
 	return corosync_gid;
 }
 static char *strchr_rs (const char *haystack, int byte)
 {
 	const char *end_address = strchr (haystack, byte);
 	if (end_address) {
 		end_address += 1; /* skip past { or = */
 
 		while (*end_address == ' ' || *end_address == '\t')
 			end_address++;
 	}
 
 	return ((char *) end_address);
 }
 
 int coroparse_configparse (icmap_map_t config_map, const char **error_string)
 {
 	if (read_config_file_into_icmap(error_string, config_map)) {
 		return -1;
 	}
 
 	return 0;
 }
 
 static char *remove_whitespace(char *string, int remove_colon_and_brace)
 {
 	char *start;
 	char *end;
 
 	start = string;
 	while (*start == ' ' || *start == '\t')
 		start++;
 
 	end = start+(strlen(start))-1;
 	while ((*end == ' ' || *end == '\t' || (remove_colon_and_brace && (*end == ':' || *end == '{'))) && end > start)
 		end--;
 	if (*end != '\0')
 		*(end + 1) = '\0';
 
 	return start;
 }
 
 
 
 static int parse_section(FILE *fp,
 			const char *fname,
 			int *line_no,
 			char *path,
 			const char **error_string,
 			int depth,
 			enum main_cp_cb_data_state state,
 			parser_cb_f parser_cb,
 			icmap_map_t config_map,
 			void *user_data)
 {
 	char line[512];
 	int i;
 	char *loc;
 	int ignore_line;
 	char new_keyname[ICMAP_KEYNAME_MAXLEN];
 	static char formated_err[384];
 	const char *tmp_error_string;
 
 	if (strcmp(path, "") == 0) {
 		parser_cb("", NULL, NULL, &state, PARSER_CB_START, error_string, config_map, user_data);
 	}
 
 	tmp_error_string = NULL;
 
 	while (fgets (line, sizeof (line), fp)) {
 		(*line_no)++;
 
 		if (strlen(line) > 0) {
 			/*
 			 * Check if complete line was read. Use feof to handle files
 			 * without ending \n at the end of the file
 			 */
 			if ((line[strlen(line) - 1] != '\n') && !feof(fp)) {
 				tmp_error_string = "Line too long";
 				goto parse_error;
 			}
 
 			if (line[strlen(line) - 1] == '\n')
 				line[strlen(line) - 1] = '\0';
 			if (strlen (line) > 0 && line[strlen(line) - 1] == '\r')
 				line[strlen(line) - 1] = '\0';
 		}
 		/*
 		 * Clear out white space and tabs
 		 */
 		for (i = strlen (line) - 1; i > -1; i--) {
 			if (line[i] == '\t' || line[i] == ' ') {
 				line[i] = '\0';
 			} else {
 				break;
 			}
 		}
 
 		ignore_line = 1;
 		for (i = 0; i < strlen (line); i++) {
 			if (line[i] != '\t' && line[i] != ' ') {
 				if (line[i] != '#')
 					ignore_line = 0;
 
 				break;
 			}
 		}
 		/*
 		 * Clear out comments and empty lines
 		 */
 		if (ignore_line) {
 			continue;
 		}
 
 		/* New section ? */
 		if ((loc = strchr_rs (line, '{'))) {
 			char *section;
 			char *after_section;
 			enum main_cp_cb_data_state newstate;
 
 			*(loc-1) = '\0';
 			section = remove_whitespace(line, 1);
 			after_section = remove_whitespace(loc, 0);
 
 			if (strcmp(section, "") == 0) {
 				tmp_error_string = "Missing section name before opening bracket '{'";
 				goto parse_error;
 			}
 
 			if (strcmp(after_section, "") != 0) {
 				tmp_error_string = "Extra characters after opening bracket '{'";
 				goto parse_error;
 			}
 
 			if (strlen(path) + strlen(section) + 1 >= ICMAP_KEYNAME_MAXLEN) {
 				tmp_error_string = "Start of section makes total cmap path too long";
 				goto parse_error;
 			}
 			strcpy(new_keyname, path);
 			if (strcmp(path, "") != 0) {
 				strcat(new_keyname, ".");
 			}
 			strcat(new_keyname, section);
 
 			/* Only use the new state for items further down the stack */
 			newstate = state;
 			if (!parser_cb(new_keyname, NULL, NULL, &newstate, PARSER_CB_SECTION_START,
 			    &tmp_error_string, config_map, user_data)) {
 				goto parse_error;
 			}
 
 			if (parse_section(fp, fname, line_no, new_keyname, error_string, depth + 1, newstate,
 			    parser_cb, config_map, user_data))
 				return -1;
 
 			continue ;
 		}
 
 		/* New key/value */
 		if ((loc = strchr_rs (line, ':'))) {
 			char *key;
 			char *value;
 
 			*(loc-1) = '\0';
 			key = remove_whitespace(line, 1);
 			value = remove_whitespace(loc, 0);
 
 			if (strlen(path) + strlen(key) + 1 >= ICMAP_KEYNAME_MAXLEN) {
 				tmp_error_string = "New key makes total cmap path too long";
 				goto parse_error;
 			}
 			strcpy(new_keyname, path);
 			if (strcmp(path, "") != 0) {
 				strcat(new_keyname, ".");
 			}
 			strcat(new_keyname, key);
 
 			if (!parser_cb(new_keyname, key, value, &state, PARSER_CB_ITEM, &tmp_error_string,
 			    config_map, user_data)) {
 				goto parse_error;
 			}
 
 			continue ;
 		}
 
 		if (strchr_rs (line, '}')) {
 			char *trimmed_line;
 			trimmed_line = remove_whitespace(line, 0);
 
 			if (strcmp(trimmed_line, "}") != 0) {
 				tmp_error_string = "Extra characters before or after closing bracket '}'";
 				goto parse_error;
 			}
 
 			if (depth == 0) {
 				tmp_error_string = "Unexpected closing brace";
 
 				goto parse_error;
 			}
 
 			if (!parser_cb(path, NULL, NULL, &state, PARSER_CB_SECTION_END, &tmp_error_string,
 			    config_map, user_data)) {
 				goto parse_error;
 			}
 
 			return 0;
 		}
 
 		/*
 		 * Line is not opening section, ending section or value -> error
 		 */
 		tmp_error_string = "Line is not opening or closing section or key value";
 		goto parse_error;
 	}
 
 	if (strcmp(path, "") != 0) {
 		tmp_error_string = "Missing closing brace";
 		goto parse_error;
 	}
 
 	if (strcmp(path, "") == 0) {
 		parser_cb("", NULL, NULL, &state, PARSER_CB_END, error_string, config_map, user_data);
 	}
 
 	return 0;
 
 parse_error:
 	if (snprintf(formated_err, sizeof(formated_err), "parser error: %s:%u: %s", fname, *line_no,
 	    tmp_error_string) >= sizeof(formated_err)) {
 		*error_string = "Can't format parser error message";
 	} else {
 		*error_string = formated_err;
 	}
 
 	return -1;
 }
 
 static int safe_atoq_range(icmap_value_types_t value_type, long long int *min_val, long long int *max_val)
 {
 	switch (value_type) {
 	case ICMAP_VALUETYPE_INT8: *min_val = INT8_MIN; *max_val = INT8_MAX; break;
 	case ICMAP_VALUETYPE_UINT8: *min_val = 0; *max_val = UINT8_MAX; break;
 	case ICMAP_VALUETYPE_INT16: *min_val = INT16_MIN; *max_val = INT16_MAX; break;
 	case ICMAP_VALUETYPE_UINT16: *min_val = 0; *max_val = UINT16_MAX; break;
 	case ICMAP_VALUETYPE_INT32: *min_val = INT32_MIN; *max_val = INT32_MAX; break;
 	case ICMAP_VALUETYPE_UINT32: *min_val = 0; *max_val = UINT32_MAX; break;
 	default:
 		return (-1);
 	}
 
 	return (0);
 }
 
 /*
  * Convert string str to long long int res. Type of result is target_type and currently only
  * ICMAP_VALUETYPE_[U]INT[8|16|32] is supported.
  * Return 0 on success, -1 on failure.
  */
 static int safe_atoq(const char *str, long long int *res, icmap_value_types_t target_type)
 {
 	long long int val;
 	long long int min_val, max_val;
 	char *endptr;
 
 	errno = 0;
 
 	val = strtoll(str, &endptr, 10);
 	if (errno == ERANGE) {
 		return (-1);
 	}
 
 	if (endptr == str) {
 		return (-1);
 	}
 
 	if (*endptr != '\0') {
 		return (-1);
 	}
 
 	if (safe_atoq_range(target_type, &min_val, &max_val) != 0) {
 		return (-1);
 	}
 
 	if (val < min_val || val > max_val) {
 		return (-1);
 	}
 
 	*res = val;
 	return (0);
 }
 
 static int str_to_ull(const char *str, unsigned long long int *res)
 {
 	unsigned long long int val;
 	char *endptr;
 
 	errno = 0;
 
 	val = strtoull(str, &endptr, 10);
 	if (errno == ERANGE) {
 		return (-1);
 	}
 
 	if (endptr == str) {
 		return (-1);
 	}
 
 	if (*endptr != '\0') {
 		return (-1);
 	}
 
 	*res = val;
 	return (0);
 }
 
 static int main_config_parser_cb(const char *path,
 			char *key,
 			char *value,
 			enum main_cp_cb_data_state *state,
 			enum parser_cb_type type,
 			const char **error_string,
 			icmap_map_t config_map,
 			void *user_data)
 {
 	int ii;
 	long long int val;
 	long long int min_val, max_val;
 	icmap_value_types_t val_type = ICMAP_VALUETYPE_BINARY;
 	unsigned long long int ull;
 	int add_as_string;
 	char key_name[ICMAP_KEYNAME_MAXLEN + 1];
 	static char formated_err[256];
 	struct main_cp_cb_data *data = (struct main_cp_cb_data *)user_data;
 	struct key_value_list_item *kv_item;
 	struct qb_list_head *iter, *tmp_iter;
 	int uid, gid;
 	cs_error_t cs_err;
 
 	cs_err = CS_OK;
 
 	/*
 	 * Formally this check is not needed because length is checked by parse_section
 	 */
 	if (strlen(path) >= sizeof(key_name)) {
 		if (snprintf(formated_err, sizeof(formated_err),
 		    "Can't store path \"%s\" into key_name", path) >= sizeof(formated_err)) {
 			*error_string = "Can't format path into key_name error message";
 		} else {
 			*error_string = formated_err;
 		}
 		return (0);
 	}
 	/*
 	 * Key_name is used in atoi_error/icmap_set_error, but many of icmap_set*
 	 * are using path, so initialize key_name to valid value
 	 */
 	strncpy(key_name, path, sizeof(key_name) - 1);
 
 	switch (type) {
 	case PARSER_CB_START:
 		memset(data, 0, sizeof(struct main_cp_cb_data));
 		*state = MAIN_CP_CB_DATA_STATE_NORMAL;
 		break;
 	case PARSER_CB_END:
 		break;
 	case PARSER_CB_ITEM:
 		add_as_string = 1;
 
 		switch (*state) {
 		case MAIN_CP_CB_DATA_STATE_NORMAL:
 			break;
 		case MAIN_CP_CB_DATA_STATE_PLOAD:
 			if ((strcmp(path, "pload.count") == 0) ||
 			    (strcmp(path, "pload.size") == 0)) {
 				val_type = ICMAP_VALUETYPE_UINT32;
 				if (safe_atoq(value, &val, val_type) != 0) {
 					goto atoi_error;
 				}
 				if ((cs_err = icmap_set_uint32_r(config_map, path, val)) != CS_OK) {
 					goto icmap_set_error;
 				}
 				add_as_string = 0;
 			}
 			break;
 		case MAIN_CP_CB_DATA_STATE_QUORUM:
 			if ((strcmp(path, "quorum.expected_votes") == 0) ||
 			    (strcmp(path, "quorum.votes") == 0) ||
 			    (strcmp(path, "quorum.last_man_standing_window") == 0) ||
 			    (strcmp(path, "quorum.leaving_timeout") == 0)) {
 				val_type = ICMAP_VALUETYPE_UINT32;
 				if (safe_atoq(value, &val, val_type) != 0) {
 					goto atoi_error;
 				}
 				if ((cs_err = icmap_set_uint32_r(config_map, path, val)) != CS_OK) {
 					goto icmap_set_error;
 				}
 				add_as_string = 0;
 			}
 
 			if ((strcmp(path, "quorum.two_node") == 0) ||
 			    (strcmp(path, "quorum.expected_votes_tracking") == 0) ||
 			    (strcmp(path, "quorum.allow_downscale") == 0) ||
 			    (strcmp(path, "quorum.wait_for_all") == 0) ||
 			    (strcmp(path, "quorum.auto_tie_breaker") == 0) ||
 			    (strcmp(path, "quorum.last_man_standing") == 0)) {
 				val_type = ICMAP_VALUETYPE_UINT8;
 				if (safe_atoq(value, &val, val_type) != 0) {
 					goto atoi_error;
 				}
 				if ((cs_err = icmap_set_uint8_r(config_map, path, val)) != CS_OK) {
 					goto icmap_set_error;
 				}
 				add_as_string = 0;
 			}
 			break;
 		case MAIN_CP_CB_DATA_STATE_QDEVICE:
 			if ((strcmp(path, "quorum.device.timeout") == 0) ||
 			    (strcmp(path, "quorum.device.sync_timeout") == 0) ||
 			    (strcmp(path, "quorum.device.votes") == 0)) {
 				val_type = ICMAP_VALUETYPE_UINT32;
 				if (safe_atoq(value, &val, val_type) != 0) {
 					goto atoi_error;
 				}
 				if ((cs_err = icmap_set_uint32_r(config_map, path, val)) != CS_OK) {
 					goto icmap_set_error;
 				}
 				add_as_string = 0;
 			}
 			if ((strcmp(path, "quorum.device.master_wins") == 0)) {
 				val_type = ICMAP_VALUETYPE_UINT8;
 				if (safe_atoq(value, &val, val_type) != 0) {
 					goto atoi_error;
 				}
 				if ((cs_err = icmap_set_uint8_r(config_map, path, val)) != CS_OK) {
 					goto icmap_set_error;
 				}
 				add_as_string = 0;
 			}
 			break;
 		case MAIN_CP_CB_DATA_STATE_TOTEM:
 			if ((strcmp(path, "totem.version") == 0) ||
 			    (strcmp(path, "totem.nodeid") == 0) ||
 			    (strcmp(path, "totem.threads") == 0) ||
 			    (strcmp(path, "totem.token") == 0) ||
 			    (strcmp(path, "totem.token_coefficient") == 0) ||
 			    (strcmp(path, "totem.token_retransmit") == 0) ||
 			    (strcmp(path, "totem.token_warning") == 0) ||
 			    (strcmp(path, "totem.hold") == 0) ||
 			    (strcmp(path, "totem.token_retransmits_before_loss_const") == 0) ||
 			    (strcmp(path, "totem.join") == 0) ||
 			    (strcmp(path, "totem.send_join") == 0) ||
 			    (strcmp(path, "totem.consensus") == 0) ||
 			    (strcmp(path, "totem.merge") == 0) ||
 			    (strcmp(path, "totem.downcheck") == 0) ||
 			    (strcmp(path, "totem.fail_recv_const") == 0) ||
 			    (strcmp(path, "totem.seqno_unchanged_const") == 0) ||
 			    (strcmp(path, "totem.rrp_token_expired_timeout") == 0) ||
 			    (strcmp(path, "totem.rrp_problem_count_timeout") == 0) ||
 			    (strcmp(path, "totem.rrp_problem_count_threshold") == 0) ||
 			    (strcmp(path, "totem.rrp_problem_count_mcast_threshold") == 0) ||
 			    (strcmp(path, "totem.rrp_autorecovery_check_timeout") == 0) ||
 			    (strcmp(path, "totem.heartbeat_failures_allowed") == 0) ||
 			    (strcmp(path, "totem.max_network_delay") == 0) ||
 			    (strcmp(path, "totem.window_size") == 0) ||
 			    (strcmp(path, "totem.max_messages") == 0) ||
 			    (strcmp(path, "totem.miss_count_const") == 0) ||
 			    (strcmp(path, "totem.knet_pmtud_interval") == 0) ||
 			    (strcmp(path, "totem.knet_compression_threshold") == 0) ||
-#ifdef HAVE_KNET_ACCESS_LIST
-			    (strcmp(path, "totem.knet_enable_access_lists") == 0) ||
-#endif
 			    (strcmp(path, "totem.netmtu") == 0)) {
 				val_type = ICMAP_VALUETYPE_UINT32;
 				if (safe_atoq(value, &val, val_type) != 0) {
 					goto atoi_error;
 				}
 				if ((cs_err = icmap_set_uint32_r(config_map,path, val)) != CS_OK) {
 					goto icmap_set_error;
 				}
 				add_as_string = 0;
 			}
 			if (strcmp(path, "totem.knet_compression_level") == 0) {
 				val_type = ICMAP_VALUETYPE_INT32;
 				if (safe_atoq(value, &val, val_type) != 0) {
 					goto atoi_error;
 				}
 				if ((cs_err = icmap_set_int32_r(config_map, path, val)) != CS_OK) {
 					goto icmap_set_error;
 				}
 				add_as_string = 0;
 			}
 			if (strcmp(path, "totem.config_version") == 0) {
 				if (str_to_ull(value, &ull) != 0) {
 					goto atoi_error;
 				}
 				if ((cs_err = icmap_set_uint64_r(config_map, path, ull)) != CS_OK) {
 					goto icmap_set_error;
 				}
 				add_as_string = 0;
 			}
 			if (strcmp(path, "totem.ip_version") == 0) {
 				if ((strcmp(value, "ipv4") != 0) &&
 				    (strcmp(value, "ipv6") != 0) &&
 				    (strcmp(value, "ipv6-4") != 0) &&
 				    (strcmp(value, "ipv4-6") != 0)) {
 					*error_string = "Invalid ip_version type";
 
 					return (0);
 				}
 			}
 			if (strcmp(path, "totem.crypto_model") == 0) {
 				if ((strcmp(value, "nss") != 0) &&
 				    (strcmp(value, "openssl") != 0)) {
 					*error_string = "Invalid crypto model. "
 					    "Should be nss or openssl";
 
 					return (0);
 				}
 			}
 			if (strcmp(path, "totem.crypto_cipher") == 0) {
 				if ((strcmp(value, "none") != 0) &&
 				    (strcmp(value, "aes256") != 0) &&
 				    (strcmp(value, "aes192") != 0) &&
 				    (strcmp(value, "aes128") != 0)) {
 					*error_string = "Invalid cipher type. "
 					    "Should be none, aes256, aes192 or aes128";
 
 					return (0);
 				}
 			}
 			if (strcmp(path, "totem.crypto_hash") == 0) {
 				if ((strcmp(value, "none") != 0) &&
 				    (strcmp(value, "md5") != 0) &&
 				    (strcmp(value, "sha1") != 0) &&
 				    (strcmp(value, "sha256") != 0) &&
 				    (strcmp(value, "sha384") != 0) &&
 				    (strcmp(value, "sha512") != 0)) {
 					*error_string = "Invalid hash type. "
 					    "Should be none, md5, sha1, sha256, sha384 or sha512";
 
 					return (0);
 				}
 			}
 			break;
 
 		case MAIN_CP_CB_DATA_STATE_SYSTEM:
 			if (strcmp(path, "system.qb_ipc_type") == 0) {
 				if ((strcmp(value, "native") != 0) &&
 				    (strcmp(value, "shm") != 0) &&
 				    (strcmp(value, "socket") != 0)) {
 					*error_string = "Invalid system.qb_ipc_type";
 
 					return (0);
 				}
 			}
 			if (strcmp(path, "system.sched_rr") == 0) {
 				if ((strcmp(value, "yes") != 0) &&
 				    (strcmp(value, "no") != 0)) {
 					*error_string = "Invalid system.sched_rr value";
 
 					return (0);
 				}
 			}
 			if (strcmp(path, "system.move_to_root_cgroup") == 0) {
 				if ((strcmp(value, "yes") != 0) &&
 				    (strcmp(value, "no") != 0)) {
 					*error_string = "Invalid system.move_to_root_cgroup";
 
 					return (0);
 				}
 			}
 			break;
 
 		case MAIN_CP_CB_DATA_STATE_INTERFACE:
 			if (strcmp(path, "totem.interface.linknumber") == 0) {
 				val_type = ICMAP_VALUETYPE_UINT8;
 				if (safe_atoq(value, &val, val_type) != 0) {
 					goto atoi_error;
 				}
 
 				data->linknumber = val;
 				add_as_string = 0;
 			}
 			if (strcmp(path, "totem.interface.bindnetaddr") == 0) {
 				data->bindnetaddr = strdup(value);
 				add_as_string = 0;
 			}
 			if (strcmp(path, "totem.interface.mcastaddr") == 0) {
 				data->mcastaddr = strdup(value);
 				add_as_string = 0;
 			}
 			if (strcmp(path, "totem.interface.broadcast") == 0) {
 				data->broadcast = strdup(value);
 				add_as_string = 0;
 			}
 			if (strcmp(path, "totem.interface.mcastport") == 0) {
 				val_type = ICMAP_VALUETYPE_UINT16;
 				if (safe_atoq(value, &val, val_type) != 0) {
 					goto atoi_error;
 				}
 				data->mcastport = val;
 				add_as_string = 0;
 			}
 			if (strcmp(path, "totem.interface.ttl") == 0) {
 				val_type = ICMAP_VALUETYPE_UINT8;
 				if (safe_atoq(value, &val, val_type) != 0) {
 					goto atoi_error;
 				}
 				data->ttl = val;
 				add_as_string = 0;
 			}
 			if (strcmp(path, "totem.interface.knet_link_priority") == 0) {
 				val_type = ICMAP_VALUETYPE_UINT8;
 				if (safe_atoq(value, &val, val_type) != 0) {
 					goto atoi_error;
 				}
 				data->knet_link_priority = val;
 				add_as_string = 0;
 			}
 			if (strcmp(path, "totem.interface.knet_ping_interval") == 0) {
 				val_type = ICMAP_VALUETYPE_UINT32;
 				if (safe_atoq(value, &val, val_type) != 0) {
 					goto atoi_error;
 				}
 				data->knet_ping_interval = val;
 				add_as_string = 0;
 			}
 			if (strcmp(path, "totem.interface.knet_ping_timeout") == 0) {
 				val_type = ICMAP_VALUETYPE_UINT32;
 				if (safe_atoq(value, &val, val_type) != 0) {
 					goto atoi_error;
 				}
 				data->knet_ping_timeout = val;
 				add_as_string = 0;
 			}
 			if (strcmp(path, "totem.interface.knet_ping_precision") == 0) {
 				val_type = ICMAP_VALUETYPE_UINT32;
 				if (safe_atoq(value, &val, val_type) != 0) {
 					goto atoi_error;
 				}
 				data->knet_ping_precision = val;
 				add_as_string = 0;
 			}
 			if (strcmp(path, "totem.interface.knet_pong_count") == 0) {
 				val_type = ICMAP_VALUETYPE_UINT32;
 				if (safe_atoq(value, &val, val_type) != 0) {
 					goto atoi_error;
 				}
 				data->knet_pong_count = val;
 				add_as_string = 0;
 			}
 			if (strcmp(path, "totem.interface.knet_transport") == 0) {
 				val_type = ICMAP_VALUETYPE_STRING;
 				data->knet_transport = strdup(value);
 				add_as_string = 0;
 			}
 			break;
 		case MAIN_CP_CB_DATA_STATE_LOGGER_SUBSYS:
 			if (strcmp(key, "subsys") == 0) {
 				data->subsys = strdup(value);
 				if (data->subsys == NULL) {
 					*error_string = "Can't alloc memory";
 
 					return (0);
 				}
 			} else {
 				kv_item = malloc(sizeof(*kv_item));
 				if (kv_item == NULL) {
 					*error_string = "Can't alloc memory";
 
 					return (0);
 				}
 				memset(kv_item, 0, sizeof(*kv_item));
 
 				kv_item->key = strdup(key);
 				kv_item->value = strdup(value);
 				if (kv_item->key == NULL || kv_item->value == NULL) {
 					free(kv_item);
 					*error_string = "Can't alloc memory";
 
 					return (0);
 				}
 				qb_list_init(&kv_item->list);
 				qb_list_add(&kv_item->list, &data->logger_subsys_items_head);
 			}
 			add_as_string = 0;
 			break;
 		case MAIN_CP_CB_DATA_STATE_LOGGING_DAEMON:
 			if (strcmp(key, "subsys") == 0) {
 				data->subsys = strdup(value);
 				if (data->subsys == NULL) {
 					*error_string = "Can't alloc memory";
 
 					return (0);
 				}
 			} else if (strcmp(key, "name") == 0) {
 				data->logging_daemon_name = strdup(value);
 				if (data->logging_daemon_name == NULL) {
 					*error_string = "Can't alloc memory";
 
 					return (0);
 				}
 			} else {
 				kv_item = malloc(sizeof(*kv_item));
 				if (kv_item == NULL) {
 					*error_string = "Can't alloc memory";
 
 					return (0);
 				}
 				memset(kv_item, 0, sizeof(*kv_item));
 
 				kv_item->key = strdup(key);
 				kv_item->value = strdup(value);
 				if (kv_item->key == NULL || kv_item->value == NULL) {
 					free(kv_item);
 					*error_string = "Can't alloc memory";
 
 					return (0);
 				}
 				qb_list_init(&kv_item->list);
 				qb_list_add(&kv_item->list, &data->logger_subsys_items_head);
 			}
 			add_as_string = 0;
 			break;
 		case MAIN_CP_CB_DATA_STATE_UIDGID:
 			if (strcmp(key, "uid") == 0) {
 				uid = uid_determine(value);
 				if (uid == -1) {
 					*error_string = error_string_response;
 					return (0);
 				}
 				snprintf(key_name, ICMAP_KEYNAME_MAXLEN, "uidgid.config.uid.%u",
 						uid);
 				if ((cs_err = icmap_set_uint8_r(config_map, key_name, 1)) != CS_OK) {
 					goto icmap_set_error;
 				}
 				add_as_string = 0;
 			} else if (strcmp(key, "gid") == 0) {
 				gid = gid_determine(value);
 				if (gid == -1) {
 					*error_string = error_string_response;
 					return (0);
 				}
 				snprintf(key_name, ICMAP_KEYNAME_MAXLEN, "uidgid.config.gid.%u",
 						gid);
 				if ((cs_err = icmap_set_uint8_r(config_map, key_name, 1)) != CS_OK) {
 					goto icmap_set_error;
 				}
 				add_as_string = 0;
 			} else {
 				*error_string = "uidgid: Only uid and gid are allowed items";
 				return (0);
 			}
 			break;
 		case MAIN_CP_CB_DATA_STATE_MEMBER:
 			if (strcmp(key, "memberaddr") != 0) {
 				*error_string = "Only memberaddr is allowed in member section";
 
 				return (0);
 			}
 
 			kv_item = malloc(sizeof(*kv_item));
 			if (kv_item == NULL) {
 				*error_string = "Can't alloc memory";
 
 				return (0);
 			}
 			memset(kv_item, 0, sizeof(*kv_item));
 
 			kv_item->key = strdup(key);
 			kv_item->value = strdup(value);
 			if (kv_item->key == NULL || kv_item->value == NULL) {
 				free(kv_item);
 				*error_string = "Can't alloc memory";
 
 				return (0);
 			}
 			qb_list_init(&kv_item->list);
 			qb_list_add(&kv_item->list, &data->member_items_head);
 			add_as_string = 0;
 			break;
 		case MAIN_CP_CB_DATA_STATE_NODELIST:
 			break;
 		case MAIN_CP_CB_DATA_STATE_NODELIST_NODE:
 			snprintf(key_name, ICMAP_KEYNAME_MAXLEN, "nodelist.node.%u.%s", data->node_number, key);
 			if ((strcmp(key, "nodeid") == 0) ||
 			    (strcmp(key, "quorum_votes") == 0)) {
 				val_type = ICMAP_VALUETYPE_UINT32;
 				if (safe_atoq(value, &val, val_type) != 0) {
 					goto atoi_error;
 				}
 
 				if ((cs_err = icmap_set_uint32_r(config_map, key_name, val)) != CS_OK) {
 					goto icmap_set_error;
 				}
 				add_as_string = 0;
 			}
 
 			if (add_as_string) {
 				if ((cs_err = icmap_set_string_r(config_map, key_name, value)) != CS_OK) {
 					goto icmap_set_error;
 				};
 				add_as_string = 0;
 			}
 			break;
 		case MAIN_CP_CB_DATA_STATE_RESOURCES:
 			if (strcmp(key, "watchdog_timeout") == 0) {
 				val_type = ICMAP_VALUETYPE_UINT32;
 				if (safe_atoq(value, &val, val_type) != 0) {
 					goto atoi_error;
 				}
 				if ((cs_err = icmap_set_uint32_r(config_map,path, val)) != CS_OK) {
 					goto icmap_set_error;
 				}
 				add_as_string = 0;
 			}
 			break;
 		case MAIN_CP_CB_DATA_STATE_RESOURCES_SYSTEM:
 		case MAIN_CP_CB_DATA_STATE_RESOURCES_SYSTEM_MEMUSED:
 			if (strcmp(key, "poll_period") == 0) {
 				if (str_to_ull(value, &ull) != 0) {
 					goto atoi_error;
 				}
 				if ((cs_err = icmap_set_uint64_r(config_map,path, ull)) != CS_OK) {
 					goto icmap_set_error;
 				}
 				add_as_string = 0;
 			}
 			break;
 		case MAIN_CP_CB_DATA_STATE_RESOURCES_PROCESS:
 		case MAIN_CP_CB_DATA_STATE_RESOURCES_PROCESS_MEMUSED:
 			if (strcmp(key, "poll_period") == 0) {
 				if (str_to_ull(value, &ull) != 0) {
 					goto atoi_error;
 				}
 				if ((cs_err = icmap_set_uint64_r(config_map,path, ull)) != CS_OK) {
 					goto icmap_set_error;
 				}
 				add_as_string = 0;
 			}
 			break;
 		}
 
 		if (add_as_string) {
 			if ((cs_err = icmap_set_string_r(config_map, path, value)) != CS_OK) {
 				goto icmap_set_error;
 			}
 		}
 		break;
 	case PARSER_CB_SECTION_START:
 		if (strcmp(path, "totem.interface") == 0) {
 			*state = MAIN_CP_CB_DATA_STATE_INTERFACE;
 			data->linknumber = 0;
 			data->mcastport = -1;
 			data->ttl = -1;
 			data->knet_link_priority = -1;
 			data->knet_ping_interval = -1;
 			data->knet_ping_timeout = -1;
 			data->knet_ping_precision = -1;
 			data->knet_pong_count = -1;
 			data->knet_transport = NULL;
 			qb_list_init(&data->member_items_head);
 		};
 		if (strcmp(path, "totem") == 0) {
 			*state = MAIN_CP_CB_DATA_STATE_TOTEM;
 		};
 		if (strcmp(path, "system") == 0) {
 			*state = MAIN_CP_CB_DATA_STATE_SYSTEM;
 		}
 		if (strcmp(path, "logging.logger_subsys") == 0) {
 			*state = MAIN_CP_CB_DATA_STATE_LOGGER_SUBSYS;
 			qb_list_init(&data->logger_subsys_items_head);
 			data->subsys = NULL;
 		}
 		if (strcmp(path, "logging.logging_daemon") == 0) {
 			*state = MAIN_CP_CB_DATA_STATE_LOGGING_DAEMON;
 			qb_list_init(&data->logger_subsys_items_head);
 			data->subsys = NULL;
 			data->logging_daemon_name = NULL;
 		}
 		if (strcmp(path, "uidgid") == 0) {
 			*state = MAIN_CP_CB_DATA_STATE_UIDGID;
 		}
 		if (strcmp(path, "totem.interface.member") == 0) {
 			*state = MAIN_CP_CB_DATA_STATE_MEMBER;
 		}
 		if (strcmp(path, "quorum") == 0) {
 			*state = MAIN_CP_CB_DATA_STATE_QUORUM;
 		}
 		if (strcmp(path, "quorum.device") == 0) {
 			*state = MAIN_CP_CB_DATA_STATE_QDEVICE;
 		}
 		if (strcmp(path, "nodelist") == 0) {
 			*state = MAIN_CP_CB_DATA_STATE_NODELIST;
 			data->node_number = 0;
 		}
 		if (strcmp(path, "nodelist.node") == 0) {
 			*state = MAIN_CP_CB_DATA_STATE_NODELIST_NODE;
 		}
 		if (strcmp(path, "resources") == 0) {
 			*state = MAIN_CP_CB_DATA_STATE_RESOURCES;
 		}
 		if (strcmp(path, "resources.system") == 0) {
 			*state = MAIN_CP_CB_DATA_STATE_RESOURCES_SYSTEM;
 		}
 		if (strcmp(path, "resources.system.memory_used") == 0) {
 			*state = MAIN_CP_CB_DATA_STATE_RESOURCES_SYSTEM_MEMUSED;
 		}
 		if (strcmp(path, "resources.process") == 0) {
 			*state = MAIN_CP_CB_DATA_STATE_RESOURCES_PROCESS;
 		}
 		if (strcmp(path, "resources.process.memory_used") == 0) {
 			*state = MAIN_CP_CB_DATA_STATE_RESOURCES_PROCESS_MEMUSED;
 		}
 		break;
 	case PARSER_CB_SECTION_END:
 		switch (*state) {
 		case MAIN_CP_CB_DATA_STATE_INTERFACE:
 			/*
 			 * Create new interface section
 			 */
 			if (data->bindnetaddr != NULL) {
 				snprintf(key_name, ICMAP_KEYNAME_MAXLEN, "totem.interface.%u.bindnetaddr",
 						data->linknumber);
 				cs_err = icmap_set_string_r(config_map, key_name, data->bindnetaddr);
 
 				free(data->bindnetaddr);
 				data->bindnetaddr = NULL;
 
 				if (cs_err != CS_OK) {
 					goto icmap_set_error;
 				}
 			}
 
 			if (data->mcastaddr != NULL) {
 				snprintf(key_name, ICMAP_KEYNAME_MAXLEN, "totem.interface.%u.mcastaddr",
 						data->linknumber);
 				cs_err = icmap_set_string_r(config_map, key_name, data->mcastaddr);
 
 				free(data->mcastaddr);
 				data->mcastaddr = NULL;
 
 				if (cs_err != CS_OK) {
 					goto icmap_set_error;
 				}
 			}
 
 			if (data->broadcast != NULL) {
 				snprintf(key_name, ICMAP_KEYNAME_MAXLEN, "totem.interface.%u.broadcast",
 						data->linknumber);
 				cs_err = icmap_set_string_r(config_map, key_name, data->broadcast);
 
 				free(data->broadcast);
 				data->broadcast = NULL;
 
 				if (cs_err != CS_OK) {
 					goto icmap_set_error;
 				}
 			}
 
 			if (data->mcastport > -1) {
 				snprintf(key_name, ICMAP_KEYNAME_MAXLEN, "totem.interface.%u.mcastport",
 						data->linknumber);
 				if ((cs_err = icmap_set_uint16_r(config_map, key_name,
 				    data->mcastport)) != CS_OK) {
 					goto icmap_set_error;
 				}
 			}
 
 			if (data->ttl > -1) {
 				snprintf(key_name, ICMAP_KEYNAME_MAXLEN, "totem.interface.%u.ttl",
 						data->linknumber);
 				if ((cs_err = icmap_set_uint8_r(config_map, key_name, data->ttl)) != CS_OK) {
 					goto icmap_set_error;
 				}
 			}
 			if (data->knet_link_priority > -1) {
 				snprintf(key_name, ICMAP_KEYNAME_MAXLEN, "totem.interface.%u.knet_link_priority",
 						data->linknumber);
 				if ((cs_err = icmap_set_uint8_r(config_map, key_name,
 				    data->knet_link_priority)) != CS_OK) {
 					goto icmap_set_error;
 				}
 			}
 			if (data->knet_ping_interval > -1) {
 				snprintf(key_name, ICMAP_KEYNAME_MAXLEN, "totem.interface.%u.knet_ping_interval",
 						data->linknumber);
 				if ((cs_err = icmap_set_uint32_r(config_map, key_name,
 				    data->knet_ping_interval)) != CS_OK) {
 					goto icmap_set_error;
 				}
 			}
 			if (data->knet_ping_timeout > -1) {
 				snprintf(key_name, ICMAP_KEYNAME_MAXLEN, "totem.interface.%u.knet_ping_timeout",
 						data->linknumber);
 				if ((cs_err = icmap_set_uint32_r(config_map, key_name,
 				    data->knet_ping_timeout)) != CS_OK) {
 					goto icmap_set_error;
 				}
 			}
 			if (data->knet_ping_precision > -1) {
 				snprintf(key_name, ICMAP_KEYNAME_MAXLEN, "totem.interface.%u.knet_ping_precision",
 						data->linknumber);
 				if ((cs_err = icmap_set_uint32_r(config_map, key_name,
 				    data->knet_ping_precision)) != CS_OK) {
 					goto icmap_set_error;
 				}
 			}
 			if (data->knet_pong_count > -1) {
 				snprintf(key_name, ICMAP_KEYNAME_MAXLEN, "totem.interface.%u.knet_pong_count",
 						data->linknumber);
 				if ((cs_err = icmap_set_uint32_r(config_map, key_name,
 				    data->knet_pong_count)) != CS_OK) {
 					goto icmap_set_error;
 				}
 			}
 			if (data->knet_transport) {
 				snprintf(key_name, ICMAP_KEYNAME_MAXLEN, "totem.interface.%u.knet_transport",
 						data->linknumber);
 				cs_err = icmap_set_string_r(config_map, key_name, data->knet_transport);
 				free(data->knet_transport);
 
 				if (cs_err != CS_OK) {
 					goto icmap_set_error;
 				}
 			}
 
 			ii = 0;
 
 			qb_list_for_each_safe(iter, tmp_iter, &(data->member_items_head)) {
 				kv_item = qb_list_entry(iter, struct key_value_list_item, list);
 
 				snprintf(key_name, ICMAP_KEYNAME_MAXLEN, "totem.interface.%u.member.%u",
 						data->linknumber, ii);
 				cs_err = icmap_set_string_r(config_map, key_name, kv_item->value);
 
 				free(kv_item->value);
 				free(kv_item->key);
 				free(kv_item);
 				ii++;
 
 				if (cs_err != CS_OK) {
 					goto icmap_set_error;
 				}
 			}
 
 			break;
 		case MAIN_CP_CB_DATA_STATE_LOGGER_SUBSYS:
 			if (data->subsys == NULL) {
 				*error_string = "No subsys key in logger_subsys directive";
 
 				return (0);
 			}
 
 			qb_list_for_each_safe(iter, tmp_iter, &(data->logger_subsys_items_head)) {
 				kv_item = qb_list_entry(iter, struct key_value_list_item, list);
 
 				snprintf(key_name, ICMAP_KEYNAME_MAXLEN, "logging.logger_subsys.%s.%s",
 					 data->subsys, kv_item->key);
 				cs_err = icmap_set_string_r(config_map, key_name, kv_item->value);
 
 				free(kv_item->value);
 				free(kv_item->key);
 				free(kv_item);
 
 				if (cs_err != CS_OK) {
 					goto icmap_set_error;
 				}
 			}
 
 			snprintf(key_name, ICMAP_KEYNAME_MAXLEN, "logging.logger_subsys.%s.subsys",
 					data->subsys);
 			cs_err = icmap_set_string_r(config_map, key_name, data->subsys);
 
 			free(data->subsys);
 
 			if (cs_err != CS_OK) {
 				goto icmap_set_error;
 			}
 			break;
 		case MAIN_CP_CB_DATA_STATE_LOGGING_DAEMON:
 			if (data->logging_daemon_name == NULL) {
 				*error_string = "No name key in logging_daemon directive";
 
 				return (0);
 			}
 
 			qb_list_for_each_safe(iter, tmp_iter, &(data->logger_subsys_items_head)) {
 				kv_item = qb_list_entry(iter, struct key_value_list_item, list);
 
 				if (data->subsys == NULL) {
 					if (strcmp(data->logging_daemon_name, "corosync") == 0) {
 						snprintf(key_name, ICMAP_KEYNAME_MAXLEN,
 								"logging.%s",
 								kv_item->key);
 					} else {
 						snprintf(key_name, ICMAP_KEYNAME_MAXLEN,
 								"logging.logging_daemon.%s.%s",
 								data->logging_daemon_name, kv_item->key);
 					}
 				} else {
 					if (strcmp(data->logging_daemon_name, "corosync") == 0) {
 						snprintf(key_name, ICMAP_KEYNAME_MAXLEN,
 								"logging.logger_subsys.%s.%s",
 								data->subsys,
 								kv_item->key);
 					} else {
 						snprintf(key_name, ICMAP_KEYNAME_MAXLEN,
 								"logging.logging_daemon.%s.%s.%s",
 								data->logging_daemon_name, data->subsys,
 								kv_item->key);
 					}
 				}
 				cs_err = icmap_set_string_r(config_map, key_name, kv_item->value);
 
 				free(kv_item->value);
 				free(kv_item->key);
 				free(kv_item);
 
 				if (cs_err != CS_OK) {
 					goto icmap_set_error;
 				}
 			}
 
 			if (data->subsys == NULL) {
 				if (strcmp(data->logging_daemon_name, "corosync") != 0) {
 					snprintf(key_name, ICMAP_KEYNAME_MAXLEN, "logging.logging_daemon.%s.name",
 							data->logging_daemon_name);
 					cs_err = icmap_set_string_r(config_map, key_name, data->logging_daemon_name);
 				}
 			} else {
 				if (strcmp(data->logging_daemon_name, "corosync") == 0) {
 					snprintf(key_name, ICMAP_KEYNAME_MAXLEN, "logging.logger_subsys.%s.subsys",
 							data->subsys);
 					cs_err = icmap_set_string_r(config_map, key_name, data->subsys);
 
 				} else {
 					snprintf(key_name, ICMAP_KEYNAME_MAXLEN, "logging.logging_daemon.%s.%s.subsys",
 							data->logging_daemon_name, data->subsys);
 					cs_err = icmap_set_string_r(config_map, key_name, data->subsys);
 
 					if (cs_err != CS_OK) {
 						free(data->subsys);
 						free(data->logging_daemon_name);
 
 						goto icmap_set_error;
 					}
 					snprintf(key_name, ICMAP_KEYNAME_MAXLEN, "logging.logging_daemon.%s.%s.name",
 							data->logging_daemon_name, data->subsys);
 					cs_err = icmap_set_string_r(config_map, key_name, data->logging_daemon_name);
 				}
 			}
 
 			free(data->subsys);
 			free(data->logging_daemon_name);
 
 			if (cs_err != CS_OK) {
 				goto icmap_set_error;
 			}
 			break;
 		case MAIN_CP_CB_DATA_STATE_NODELIST_NODE:
 			data->node_number++;
 			break;
 		case MAIN_CP_CB_DATA_STATE_NORMAL:
 		case MAIN_CP_CB_DATA_STATE_PLOAD:
 		case MAIN_CP_CB_DATA_STATE_UIDGID:
 		case MAIN_CP_CB_DATA_STATE_MEMBER:
 		case MAIN_CP_CB_DATA_STATE_QUORUM:
 		case MAIN_CP_CB_DATA_STATE_QDEVICE:
 		case MAIN_CP_CB_DATA_STATE_NODELIST:
 		case MAIN_CP_CB_DATA_STATE_TOTEM:
 		case MAIN_CP_CB_DATA_STATE_SYSTEM:
 			break;
 		case MAIN_CP_CB_DATA_STATE_RESOURCES:
 			*state = MAIN_CP_CB_DATA_STATE_NORMAL;
 			break;
 		case MAIN_CP_CB_DATA_STATE_RESOURCES_SYSTEM:
 			*state = MAIN_CP_CB_DATA_STATE_RESOURCES;
 			break;
 		case MAIN_CP_CB_DATA_STATE_RESOURCES_SYSTEM_MEMUSED:
 			*state = MAIN_CP_CB_DATA_STATE_RESOURCES_SYSTEM;
 			break;
 		case MAIN_CP_CB_DATA_STATE_RESOURCES_PROCESS:
 			*state = MAIN_CP_CB_DATA_STATE_RESOURCES;
 			break;
 		case MAIN_CP_CB_DATA_STATE_RESOURCES_PROCESS_MEMUSED:
 			*state = MAIN_CP_CB_DATA_STATE_RESOURCES_PROCESS;
 			break;
 		}
 		break;
 	}
 
 	return (1);
 
 atoi_error:
 	min_val = max_val = 0;
 	/*
 	 * This is really assert, because developer ether doesn't set val_type correctly or
 	 * we've got here after some nasty memory overwrite
 	 */
 	assert(safe_atoq_range(val_type, &min_val, &max_val) == 0);
 
 	if (snprintf(formated_err, sizeof(formated_err),
 	    "Value of key \"%s\" is expected to be integer in range (%lld..%lld), but \"%s\" was given",
 	    key_name, min_val, max_val, value) >= sizeof(formated_err)) {
 		*error_string = "Can't format parser error message";
 	} else {
 		*error_string = formated_err;
 	}
 
 	return (0);
 
 icmap_set_error:
 	if (snprintf(formated_err, sizeof(formated_err),
 	    "Can't store key \"%s\" into icmap, returned error is %s",
 	    key_name, cs_strerror(cs_err)) >= sizeof(formated_err)) {
 		*error_string = "Can't format parser error message";
 	} else {
 		*error_string = formated_err;
 	}
 
 	return (0);
 }
 
 static int uidgid_config_parser_cb(const char *path,
 			char *key,
 			char *value,
 			enum main_cp_cb_data_state *state,
 			enum parser_cb_type type,
 			const char **error_string,
 			icmap_map_t config_map,
 			void *user_data)
 {
 	char key_name[ICMAP_KEYNAME_MAXLEN];
 	int uid, gid;
 	static char formated_err[256];
 	cs_error_t cs_err;
 
 	switch (type) {
 	case PARSER_CB_START:
 		break;
 	case PARSER_CB_END:
 		break;
 	case PARSER_CB_ITEM:
 		if (strcmp(path, "uidgid.uid") == 0) {
 			uid = uid_determine(value);
 			if (uid == -1) {
 				*error_string = error_string_response;
 				return (0);
 			}
 			snprintf(key_name, ICMAP_KEYNAME_MAXLEN, "uidgid.config.uid.%u",
 					uid);
 			if ((cs_err = icmap_set_uint8_r(config_map, key_name, 1)) != CS_OK) {
 				goto icmap_set_error;
 			}
 		} else if (strcmp(path, "uidgid.gid") == 0) {
 			gid = gid_determine(value);
 			if (gid == -1) {
 				*error_string = error_string_response;
 				return (0);
 			}
 			snprintf(key_name, ICMAP_KEYNAME_MAXLEN, "uidgid.config.gid.%u",
 					gid);
 			if ((cs_err = icmap_set_uint8_r(config_map, key_name, 1)) != CS_OK) {
 				goto icmap_set_error;
 			}
 		} else {
 			*error_string = "uidgid: Only uid and gid are allowed items";
 			return (0);
 		}
 		break;
 	case PARSER_CB_SECTION_START:
 		if (strcmp(path, "uidgid") != 0) {
 			*error_string = "uidgid: Can't add subsection different than uidgid";
 			return (0);
 		};
 		break;
 	case PARSER_CB_SECTION_END:
 		break;
 	}
 
 	return (1);
 
 icmap_set_error:
 	if (snprintf(formated_err, sizeof(formated_err),
 	    "Can't store key \"%s\" into icmap, returned error is %s",
 	    key_name, cs_strerror(cs_err)) >= sizeof(formated_err)) {
 		*error_string = "Can't format parser error message";
 	} else {
 		*error_string = formated_err;
 	}
 
 	return (0);
 }
 
 static int read_uidgid_files_into_icmap(
 	const char **error_string,
 	icmap_map_t config_map)
 {
 	FILE *fp;
 	char *dirname_res;
 	DIR *dp;
 	struct dirent *dirent;
 	char filename[PATH_MAX + FILENAME_MAX + 1];
 	char uidgid_dirname[PATH_MAX + FILENAME_MAX + 1];
 	int res = 0;
 	struct stat stat_buf;
 	enum main_cp_cb_data_state state = MAIN_CP_CB_DATA_STATE_NORMAL;
 	char key_name[ICMAP_KEYNAME_MAXLEN];
 	int line_no;
 
 	/*
 	 * Build uidgid directory based on corosync.conf file location
 	 */
 	res = snprintf(filename, sizeof(filename), "%s",
 	    corosync_get_config_file());
 	if (res >= sizeof(filename)) {
 		*error_string = "uidgid.d path too long";
 
 		return (-1);
 	}
 
 	dirname_res = dirname(filename);
 
 	res = snprintf(uidgid_dirname, sizeof(uidgid_dirname), "%s/%s",
 	    dirname_res, "uidgid.d");
 	if (res >= sizeof(uidgid_dirname)) {
 		*error_string = "uidgid.d path too long";
 
 		return (-1);
 	}
 
 	dp = opendir (uidgid_dirname);
 
 	if (dp == NULL)
 		return 0;
 
 	for (dirent = readdir(dp);
 		dirent != NULL;
 		dirent = readdir(dp)) {
 
 		res = snprintf(filename, sizeof (filename), "%s/%s", uidgid_dirname, dirent->d_name);
 		if (res >= sizeof(filename)) {
 			res = -1;
 			*error_string = "uidgid.d dirname path too long";
 
 			goto error_exit;
 		}
 		res = stat (filename, &stat_buf);
 		if (res == 0 && S_ISREG(stat_buf.st_mode)) {
 
 			fp = fopen (filename, "r");
 			if (fp == NULL) continue;
 
 			key_name[0] = 0;
 
 			line_no = 0;
 			res = parse_section(fp, filename, &line_no, key_name, error_string, 0, state,
 			    uidgid_config_parser_cb, config_map, NULL);
 
 			fclose (fp);
 
 			if (res != 0) {
 				goto error_exit;
 			}
 		}
 	}
 
 error_exit:
 	closedir(dp);
 
 	return res;
 }
 
 /* Read config file and load into icmap */
 static int read_config_file_into_icmap(
 	const char **error_string,
 	icmap_map_t config_map)
 {
 	FILE *fp;
 	const char *filename;
 	char *error_reason = error_string_response;
 	int res;
 	char key_name[ICMAP_KEYNAME_MAXLEN];
 	struct main_cp_cb_data data;
 	enum main_cp_cb_data_state state = MAIN_CP_CB_DATA_STATE_NORMAL;
 	int line_no;
 
 	filename = corosync_get_config_file();
 
 	fp = fopen (filename, "r");
 	if (fp == NULL) {
 		char error_str[100];
 		const char *error_ptr = qb_strerror_r(errno, error_str, sizeof(error_str));
 		snprintf (error_reason, sizeof(error_string_response),
 			"Can't read file %s: %s",
 			 filename, error_ptr);
 		*error_string = error_reason;
 		return -1;
 	}
 
 	key_name[0] = 0;
 
 	line_no = 0;
 	res = parse_section(fp, filename, &line_no, key_name, error_string, 0, state,
 	    main_config_parser_cb, config_map, &data);
 
 	fclose(fp);
 
 	if (res == 0) {
 	        res = read_uidgid_files_into_icmap(error_string, config_map);
 	}
 
 	if (res == 0) {
 		snprintf (error_reason, sizeof(error_string_response),
 			"Successfully read main configuration file '%s'.", filename);
 		*error_string = error_reason;
 	}
 
 	return res;
 }
diff --git a/exec/totemknet.c b/exec/totemknet.c
index 884eefe9..2af69b3d 100644
--- a/exec/totemknet.c
+++ b/exec/totemknet.c
@@ -1,1890 +1,1889 @@
 /*
  * Copyright (c) 2016-2019 Red Hat, Inc.
  *
  * All rights reserved.
  *
  * Author: Christine Caulfield (ccaulfie@redhat.com)
 
  * This software licensed under BSD license, the text of which follows:
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
  *
  * - Redistributions of source code must retain the above copyright notice,
  *   this list of conditions and the following disclaimer.
  * - Redistributions in binary form must reproduce the above copyright notice,
  *   this list of conditions and the following disclaimer in the documentation
  *   and/or other materials provided with the distribution.
  * - Neither the name of the MontaVista Software, Inc. nor the names of its
  *   contributors may be used to endorse or promote products derived from this
  *   software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include <config.h>
 
 #include <assert.h>
 #include <sys/mman.h>
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <sys/socket.h>
 #include <netdb.h>
 #include <sys/un.h>
 #include <sys/ioctl.h>
 #include <sys/param.h>
 #include <netinet/in.h>
 #include <net/ethernet.h>
 #include <arpa/inet.h>
 #include <unistd.h>
 #include <fcntl.h>
 #include <stdlib.h>
 #include <stdio.h>
 #include <errno.h>
 #include <sched.h>
 #include <time.h>
 #include <sys/time.h>
 #include <sys/poll.h>
 #include <sys/uio.h>
 #include <limits.h>
 
 #include <qb/qbdefs.h>
 #include <qb/qbloop.h>
 #ifdef HAVE_LIBNOZZLE
 #include <libgen.h>
 #include <libnozzle.h>
 #endif
 
 #include <corosync/sq.h>
 #include <corosync/swab.h>
 #include <corosync/logsys.h>
 #include <corosync/icmap.h>
 #include <corosync/totem/totemip.h>
 #include "totemknet.h"
 
 #include "main.h"
 #include "util.h"
 
 #include <libknet.h>
 #include <corosync/totem/totemstats.h>
 
 #ifndef MSG_NOSIGNAL
 #define MSG_NOSIGNAL 0
 #endif
 
 #ifdef HAVE_LIBNOZZLE
 static int setup_nozzle(void *knet_context);
 #endif
 
 /* Should match that used by cfg */
 #define CFG_INTERFACE_STATUS_MAX_LEN 512
 
 struct totemknet_instance {
 	struct crypto_instance *crypto_inst;
 
 	qb_loop_t *poll_handle;
 
         knet_handle_t knet_handle;
 
 	int link_mode;
 
 	void *context;
 
 	void (*totemknet_deliver_fn) (
 		void *context,
 		const void *msg,
 		unsigned int msg_len,
 		const struct sockaddr_storage *system_from);
 
 	void (*totemknet_iface_change_fn) (
 		void *context,
 		const struct totem_ip_address *iface_address,
 		unsigned int link_no);
 
 	void (*totemknet_mtu_changed) (
 		void *context,
 		int net_mtu);
 
 	void (*totemknet_target_set_completed) (void *context);
 
 	/*
 	 * Function and data used to log messages
 	 */
 	int totemknet_log_level_security;
 
 	int totemknet_log_level_error;
 
 	int totemknet_log_level_warning;
 
 	int totemknet_log_level_notice;
 
 	int totemknet_log_level_debug;
 
 	int totemknet_subsys_id;
 
 	int knet_subsys_id;
 
 	void (*totemknet_log_printf) (
 		int level,
 		int subsys,
 		const char *function,
 		const char *file,
 		int line,
 		const char *format,
 		...)__attribute__((format(printf, 6, 7)));
 
 	void *knet_context;
 
 	char iov_buffer[KNET_MAX_PACKET_SIZE];
 
 	char *link_status[INTERFACE_MAX];
 
 	struct totem_ip_address my_ids[INTERFACE_MAX];
 
 	uint16_t ip_port[INTERFACE_MAX];
 
 	int our_nodeid;
 
 	int loopback_link;
 
 	struct totem_config *totem_config;
 
 	struct totem_ip_address token_target;
 
 	qb_loop_timer_handle timer_netif_check_timeout;
 
 	qb_loop_timer_handle timer_merge_detect_timeout;
 
 	int send_merge_detect_message;
 
 	unsigned int merge_detect_messages_sent_before_timeout;
 
 	int logpipes[2];
 	int knet_fd;
 #ifdef HAVE_LIBNOZZLE
 	char *nozzle_name;
 	char *nozzle_ipaddr;
 	char *nozzle_prefix;
 	char *nozzle_macaddr;
 	nozzle_t nozzle_handle;
 #endif
 };
 
 /* Awkward. But needed to get stats from knet */
 struct totemknet_instance *global_instance;
 
 struct work_item {
 	const void *msg;
 	unsigned int msg_len;
 	struct totemknet_instance *instance;
 };
 
 int totemknet_member_list_rebind_ip (
 	void *knet_context);
 
 static void totemknet_start_merge_detect_timeout(
 	void *knet_context);
 
 static void totemknet_stop_merge_detect_timeout(
 	void *knet_context);
 
 static void log_flush_messages (
         void *knet_context);
 
 static void totemknet_instance_initialize (struct totemknet_instance *instance)
 {
 	memset (instance, 0, sizeof (struct totemknet_instance));
 }
 
 #define knet_log_printf(level, format, args...)		\
 do {							\
         instance->totemknet_log_printf (		\
 		level, instance->totemknet_subsys_id,	\
                 __FUNCTION__, __FILE__, __LINE__,	\
 		(const char *)format, ##args);		\
 } while (0);
 
 #define libknet_log_printf(level, format, args...)		\
 do {							\
         instance->totemknet_log_printf (		\
 		level, instance->knet_subsys_id,	\
                 __FUNCTION__, "libknet.h", __LINE__,	\
 		(const char *)format, ##args);		\
 } while (0);
 
 #define KNET_LOGSYS_PERROR(err_num, level, fmt, args...)						\
 do {												\
 	char _error_str[LOGSYS_MAX_PERROR_MSG_LEN];						\
 	const char *_error_ptr = qb_strerror_r(err_num, _error_str, sizeof(_error_str));	\
         instance->totemknet_log_printf (							\
 		level, instance->totemknet_subsys_id,						\
                 __FUNCTION__, __FILE__, __LINE__,						\
 		fmt ": %s (%d)", ##args, _error_ptr, err_num);				\
 	} while(0)
 
 
 #ifdef HAVE_LIBNOZZLE
 static inline int is_ether_addr_multicast(const uint8_t *addr)
 {
 	return (addr[0] & 0x01);
 }
 static inline int is_ether_addr_zero(const uint8_t *addr)
 {
 	return (!addr[0] && !addr[1] && !addr[2] && !addr[3] && !addr[4] && !addr[5]);
 }
 
 static int ether_host_filter_fn(void *private_data,
 				const unsigned char *outdata,
 				ssize_t outdata_len,
 				uint8_t tx_rx,
 				knet_node_id_t this_host_id,
 				knet_node_id_t src_host_id,
 				int8_t *channel,
 				knet_node_id_t *dst_host_ids,
 				size_t *dst_host_ids_entries)
 {
 	struct ether_header *eth_h = (struct ether_header *)outdata;
 	uint8_t *dst_mac = (uint8_t *)eth_h->ether_dhost;
 	uint16_t dst_host_id;
 
 	if (is_ether_addr_zero(dst_mac))
 		return -1;
 
 	if (is_ether_addr_multicast(dst_mac)) {
 		return 1;
 	}
 
 	memmove(&dst_host_id, &dst_mac[4], 2);
 
 	dst_host_ids[0] = ntohs(dst_host_id);
 	*dst_host_ids_entries = 1;
 
 	return 0;
 }
 #endif
 
 static int dst_host_filter_callback_fn(void *private_data,
 				       const unsigned char *outdata,
 				       ssize_t outdata_len,
 				       uint8_t tx_rx,
 				       knet_node_id_t this_host_id,
 				       knet_node_id_t src_host_id,
 				       int8_t *channel,
 				       knet_node_id_t *dst_host_ids,
 				       size_t *dst_host_ids_entries)
 {
 	struct totem_message_header *header = (struct totem_message_header *)outdata;
 	int res;
 
 #ifdef HAVE_LIBNOZZLE
 	if (*channel != 0) {
 		return ether_host_filter_fn(private_data,
 					    outdata, outdata_len,
 					    tx_rx,
 					    this_host_id, src_host_id,
 					    channel,
 					    dst_host_ids,
 					    dst_host_ids_entries);
 	}
 #endif
 	if (header->target_nodeid) {
 		dst_host_ids[0] = header->target_nodeid;
 		*dst_host_ids_entries = 1;
 		res = 0; /* unicast message */
 	}
 	else {
 		*dst_host_ids_entries = 0;
 		res = 1; /* multicast message */
 	}
 	return res;
 }
 
 static void socket_error_callback_fn(void *private_data, int datafd, int8_t channel, uint8_t tx_rx, int error, int errorno)
 {
 	struct totemknet_instance *instance = (struct totemknet_instance *)private_data;
 
 	knet_log_printf (LOGSYS_LEVEL_DEBUG, "Knet socket ERROR notification called: txrx=%d, error=%d, errorno=%d", tx_rx, error, errorno);
 	if ((error == -1 && errorno != EAGAIN) || (error == 0)) {
 		knet_handle_remove_datafd(instance->knet_handle, datafd);
 	}
 }
 
 static void host_change_callback_fn(void *private_data, knet_node_id_t host_id, uint8_t reachable, uint8_t remote, uint8_t external)
 {
 	struct totemknet_instance *instance = (struct totemknet_instance *)private_data;
 
 	// TODO: what? if anything.
 	knet_log_printf (LOGSYS_LEVEL_DEBUG, "Knet host change callback. nodeid: %d reachable: %d", host_id, reachable);
 }
 
 static void pmtu_change_callback_fn(void *private_data, unsigned int data_mtu)
 {
 	struct totemknet_instance *instance = (struct totemknet_instance *)private_data;
 	knet_log_printf (LOGSYS_LEVEL_DEBUG, "Knet pMTU change: %d", data_mtu);
 
 	/* We don't need to tell corosync the actual knet MTU */
 //	instance->totemknet_mtu_changed(instance->context, data_mtu);
 }
 
 int totemknet_crypto_set (
 	void *knet_context,
 	const char *cipher_type,
 	const char *hash_type)
 {
 	return (0);
 }
 
 
 static inline void ucast_sendmsg (
 	struct totemknet_instance *instance,
 	struct totem_ip_address *system_to,
 	const void *msg,
 	unsigned int msg_len)
 {
 	int res = 0;
 	struct totem_message_header *header = (struct totem_message_header *)msg;
 	struct msghdr msg_ucast;
 	struct iovec iovec;
 
 	header->target_nodeid = system_to->nodeid;
 
 	iovec.iov_base = (void *)msg;
 	iovec.iov_len = msg_len;
 
 	/*
 	 * Build unicast message
 	 */
 	memset(&msg_ucast, 0, sizeof(msg_ucast));
 	msg_ucast.msg_iov = (void *)&iovec;
 	msg_ucast.msg_iovlen = 1;
 #ifdef HAVE_MSGHDR_CONTROL
 	msg_ucast.msg_control = 0;
 #endif
 #ifdef HAVE_MSGHDR_CONTROLLEN
 	msg_ucast.msg_controllen = 0;
 #endif
 #ifdef HAVE_MSGHDR_FLAGS
 	msg_ucast.msg_flags = 0;
 #endif
 #ifdef HAVE_MSGHDR_ACCRIGHTS
 	msg_ucast.msg_accrights = NULL;
 #endif
 #ifdef HAVE_MSGHDR_ACCRIGHTSLEN
 	msg_ucast.msg_accrightslen = 0;
 #endif
 
 	/*
 	 * Transmit unicast message
 	 * An error here is recovered by totemsrp
 	 */
 
 	res = sendmsg (instance->knet_fd, &msg_ucast, MSG_NOSIGNAL);
 	if (res < 0) {
 		KNET_LOGSYS_PERROR (errno, instance->totemknet_log_level_debug,
 				    "sendmsg(ucast) failed (non-critical)");
 	}
 }
 
 static inline void mcast_sendmsg (
 	struct totemknet_instance *instance,
 	const void *msg,
 	unsigned int msg_len,
 	int only_active)
 {
 	int res;
 	struct totem_message_header *header = (struct totem_message_header *)msg;
 	struct msghdr msg_mcast;
 	struct iovec iovec;
 
 	iovec.iov_base = (void *)msg;
 	iovec.iov_len = msg_len;
 
 	header->target_nodeid = 0;
 
 	/*
 	 * Build multicast message
 	 */
 	memset(&msg_mcast, 0, sizeof(msg_mcast));
 	msg_mcast.msg_iov = (void *)&iovec;
 	msg_mcast.msg_iovlen = 1;
 #ifdef HAVE_MSGHDR_CONTROL
 	msg_mcast.msg_control = 0;
 #endif
 #ifdef HAVE_MSGHDR_CONTROLLEN
 	msg_mcast.msg_controllen = 0;
 #endif
 #ifdef HAVE_MSGHDR_FLAGS
 	msg_mcast.msg_flags = 0;
 #endif
 #ifdef HAVE_MSGHDR_ACCRIGHTS
 	msg_mcast.msg_accrights = NULL;
 #endif
 #ifdef HAVE_MSGHDR_ACCRIGHTSLEN
 	msg_mcast.msg_accrightslen = 0;
 #endif
 
 
 //	log_printf (LOGSYS_LEVEL_DEBUG, "totemknet: mcast_sendmsg. only_active=%d, len=%d", only_active, msg_len);
 
 	res = sendmsg (instance->knet_fd, &msg_mcast, MSG_NOSIGNAL);
 	if (res < msg_len) {
 		knet_log_printf (LOGSYS_LEVEL_DEBUG, "totemknet: mcast_send sendmsg returned %d", res);
 	}
 
 	if (!only_active || instance->send_merge_detect_message) {
 		/*
 		 * Current message was sent to all nodes
 		 */
 		instance->merge_detect_messages_sent_before_timeout++;
 		instance->send_merge_detect_message = 0;
 	}
 }
 
 static int node_compare(const void *aptr, const void *bptr)
 {
 	uint16_t a,b;
 
 	a = *(uint16_t *)aptr;
 	b = *(uint16_t *)bptr;
 
 	return a > b;
 }
 
 int totemknet_ifaces_get (void *knet_context,
 	char ***status,
 	unsigned int *iface_count)
 {
 	struct totemknet_instance *instance = (struct totemknet_instance *)knet_context;
 	struct knet_link_status link_status;
 	knet_node_id_t host_list[KNET_MAX_HOST];
 	uint8_t link_list[KNET_MAX_LINK];
 	size_t num_hosts;
 	size_t num_links;
 	size_t link_idx;
 	int i,j;
 	char *ptr;
 	int res = 0;
 
 	/*
 	 * Don't do the whole 'link_info' bit if the caller just wants
 	 * a count of interfaces.
 	 */
 	if (status) {
 
 		res = knet_host_get_host_list(instance->knet_handle,
 					      host_list, &num_hosts);
 		if (res) {
 			return (-1);
 		}
 		qsort(host_list, num_hosts, sizeof(uint16_t), node_compare);
 
 		for (i=0; i<INTERFACE_MAX; i++) {
 			memset(instance->link_status[i], 'n', CFG_INTERFACE_STATUS_MAX_LEN-1);
 			instance->link_status[i][num_hosts] = '\0';
 		}
 
 		/* This is all a bit "inside-out" because "status" is a set of strings per link
 		 * and knet orders things by host
 		 */
 		for (j=0; j<num_hosts; j++) {
 			res = knet_link_get_link_list(instance->knet_handle,
 						      host_list[j], link_list, &num_links);
 			if (res) {
 				return (-1);
 			}
 
 			link_idx = 0;
 			for (i=0; i < num_links; i++) {
 				/*
 				 * Skip over links that are unconfigured to corosync. This is basically
 				 * link0 if corosync isn't using it for comms, as we will still
 				 * have it set up for loopback.
 				 */
 				if (!instance->totem_config->interfaces[link_list[i]].configured) {
 					continue;
 				}
 				ptr = instance->link_status[link_idx++];
 
 				res = knet_link_get_status(instance->knet_handle,
 							   host_list[j],
 							   link_list[i],
 							   &link_status,
 							   sizeof(link_status));
 				if (res == 0) {
 					ptr[j] = '0' + (link_status.enabled |
 							link_status.connected<<1 |
 							link_status.dynconnected<<2);
 				}
 				else {
 					ptr[j] = '?';
 				}
 			}
 		}
 		*status = instance->link_status;
 	}
 
 	*iface_count = INTERFACE_MAX;
 
 	return (res);
 }
 
 int totemknet_finalize (
 	void *knet_context)
 {
 	struct totemknet_instance *instance = (struct totemknet_instance *)knet_context;
 	int res = 0;
 	int i,j;
 	static knet_node_id_t nodes[KNET_MAX_HOST]; /* static to save stack */
 	uint8_t links[KNET_MAX_LINK];
 	size_t num_nodes;
 	size_t num_links;
 
 	knet_log_printf(LOG_DEBUG, "totemknet: finalize");
 
 	qb_loop_poll_del (instance->poll_handle, instance->logpipes[0]);
 	qb_loop_poll_del (instance->poll_handle, instance->knet_fd);
 
 	res = knet_host_get_host_list(instance->knet_handle, nodes, &num_nodes);
 	if (res) {
 		knet_log_printf (LOGSYS_LEVEL_ERROR, "Cannot get knet node list for shutdown: %s", strerror(errno));
 		/* Crash out anyway */
 		goto finalise_error;
 	}
 
 	/* Tidily shut down all nodes & links. This ensures that the LEAVE message will be sent */
 	for (i=0; i<num_nodes; i++) {
 
 		res = knet_link_get_link_list(instance->knet_handle, nodes[i], links, &num_links);
 		if (res) {
 			knet_log_printf (LOGSYS_LEVEL_ERROR, "Cannot get knet link list for node %d: %s", nodes[i], strerror(errno));
 			goto finalise_error;
 		}
 		for (j=0; j<num_links; j++) {
 			res = knet_link_set_enable(instance->knet_handle, nodes[i], links[j], 0);
 			if (res) {
 				knet_log_printf (LOGSYS_LEVEL_ERROR, "totemknet: knet_link_set_enable(node %d, link %d) failed: %s", nodes[i], links[j], strerror(errno));
 			}
 			res = knet_link_clear_config(instance->knet_handle, nodes[i], links[j]);
 			if (res) {
 				knet_log_printf (LOGSYS_LEVEL_ERROR, "totemknet: knet_link_clear_config(node %d, link %d) failed: %s", nodes[i], links[j], strerror(errno));
 			}
 		}
 		res = knet_host_remove(instance->knet_handle, nodes[i]);
 		if (res) {
 			knet_log_printf (LOGSYS_LEVEL_ERROR, "totemknet: knet_host_remove(node %d) failed: %s", nodes[i], strerror(errno));
 		}
 	}
 
 finalise_error:
 	res = knet_handle_setfwd(instance->knet_handle, 0);
 	if (res) {
 		knet_log_printf (LOGSYS_LEVEL_CRIT, "totemknet: knet_handle_setfwd failed: %s", strerror(errno));
 	}
 	res = knet_handle_free(instance->knet_handle);
 	if (res) {
 		knet_log_printf (LOGSYS_LEVEL_CRIT, "totemknet: knet_handle_free failed: %s", strerror(errno));
 	}
 
 	totemknet_stop_merge_detect_timeout(instance);
 
 	log_flush_messages(instance);
 
 	return (res);
 }
 
 static int log_deliver_fn (
 	int fd,
 	int revents,
 	void *data)
 {
 	struct totemknet_instance *instance = (struct totemknet_instance *)data;
 	char buffer[sizeof(struct knet_log_msg)*4];
 	char *bufptr = buffer;
 	int done = 0;
 	int len;
 
 	len = read(fd, buffer, sizeof(buffer));
 	while (done < len) {
 		struct knet_log_msg *msg = (struct knet_log_msg *)bufptr;
 		switch (msg->msglevel) {
 		case KNET_LOG_ERR:
 			libknet_log_printf (LOGSYS_LEVEL_ERROR, "%s: %s",
 					    knet_log_get_subsystem_name(msg->subsystem),
 					    msg->msg);
 			break;
 		case KNET_LOG_WARN:
 			libknet_log_printf (LOGSYS_LEVEL_WARNING, "%s: %s",
 					    knet_log_get_subsystem_name(msg->subsystem),
 					    msg->msg);
 			break;
 		case KNET_LOG_INFO:
 			libknet_log_printf (LOGSYS_LEVEL_INFO, "%s: %s",
 					    knet_log_get_subsystem_name(msg->subsystem),
 					    msg->msg);
 			break;
 		case KNET_LOG_DEBUG:
 			libknet_log_printf (LOGSYS_LEVEL_DEBUG, "%s: %s",
 					    knet_log_get_subsystem_name(msg->subsystem),
 					    msg->msg);
 			break;
 		}
 		bufptr += sizeof(struct knet_log_msg);
 		done += sizeof(struct knet_log_msg);
 	}
 	return 0;
 }
 
 static int data_deliver_fn (
 	int fd,
 	int revents,
 	void *data)
 {
 	struct totemknet_instance *instance = (struct totemknet_instance *)data;
 	struct msghdr msg_hdr;
 	struct iovec iov_recv;
 	struct sockaddr_storage system_from;
 	ssize_t msg_len;
 	int truncated_packet;
 
 	iov_recv.iov_base = instance->iov_buffer;
 	iov_recv.iov_len = KNET_MAX_PACKET_SIZE;
 
 	msg_hdr.msg_name = &system_from;
 	msg_hdr.msg_namelen = sizeof (struct sockaddr_storage);
 	msg_hdr.msg_iov = &iov_recv;
 	msg_hdr.msg_iovlen = 1;
 #ifdef HAVE_MSGHDR_CONTROL
 	msg_hdr.msg_control = 0;
 #endif
 #ifdef HAVE_MSGHDR_CONTROLLEN
 	msg_hdr.msg_controllen = 0;
 #endif
 #ifdef HAVE_MSGHDR_FLAGS
 	msg_hdr.msg_flags = 0;
 #endif
 #ifdef HAVE_MSGHDR_ACCRIGHTS
 	msg_hdr.msg_accrights = NULL;
 #endif
 #ifdef HAVE_MSGHDR_ACCRIGHTSLEN
 	msg_hdr.msg_accrightslen = 0;
 #endif
 
 	msg_len = recvmsg (fd, &msg_hdr, MSG_NOSIGNAL | MSG_DONTWAIT);
 	if (msg_len <= 0) {
 		return (0);
 	}
 
 	truncated_packet = 0;
 
 #ifdef HAVE_MSGHDR_FLAGS
 	if (msg_hdr.msg_flags & MSG_TRUNC) {
 		truncated_packet = 1;
 	}
 #else
 	/*
 	 * We don't have MSGHDR_FLAGS, but we can (hopefully) safely make assumption that
 	 * if bytes_received == KNET_MAX_PACKET_SIZE then packet is truncated
 	 */
 	if (bytes_received == KNET_MAX_PACKET_SIZE) {
 		truncated_packet = 1;
 	}
 #endif
 
 	if (truncated_packet) {
 		knet_log_printf(instance->totemknet_log_level_error,
 				"Received too big message. This may be because something bad is happening"
 				"on the network (attack?), or you tried join more nodes than corosync is"
 				"compiled with (%u) or bug in the code (bad estimation of "
 				"the KNET_MAX_PACKET_SIZE). Dropping packet.", PROCESSOR_COUNT_MAX);
 		return (0);
 	}
 
 	/*
 	 * Handle incoming message
 	 */
 	instance->totemknet_deliver_fn (
 		instance->context,
 		instance->iov_buffer,
 		msg_len,
 		&system_from);
 
 	return (0);
 }
 
 static void timer_function_netif_check_timeout (
 	void *data)
 {
 	struct totemknet_instance *instance = (struct totemknet_instance *)data;
 	int i;
 
 	for (i=0; i < INTERFACE_MAX; i++) {
 		if (!instance->totem_config->interfaces[i].configured) {
 			continue;
 		}
 		instance->totemknet_iface_change_fn (instance->context,
 						     &instance->my_ids[i],
 						     i);
 	}
 }
 
 static void knet_set_access_list_config(struct totemknet_instance *instance)
 {
 #ifdef HAVE_KNET_ACCESS_LIST
-	uint32_t value = 0; /* disable by default */
+	uint32_t value;
 	cs_error_t err;
 
-	if (icmap_get_uint32("totem.knet_enable_access_lists", &value) == CS_OK) {
-		knet_log_printf (LOGSYS_LEVEL_DEBUG, "knet_enable access list: %d", value);
-        }
+	value = instance->totem_config->block_unlisted_ips;
+	knet_log_printf (LOGSYS_LEVEL_DEBUG, "knet_enable access list: %d", value);
 
 	err = knet_handle_enable_access_lists(instance->knet_handle, value);
 	if (err) {
 	        KNET_LOGSYS_PERROR(errno, LOGSYS_LEVEL_WARNING, "knet_handle_enable_access_lists failed");
 	}
 #endif
 }
 
 
 /* NOTE: this relies on the fact that totem_reload_notify() is called first */
 static void totemknet_refresh_config(
 	int32_t event,
 	const char *key_name,
 	struct icmap_notify_value new_val,
 	struct icmap_notify_value old_val,
 	void *user_data)
 {
 	uint8_t reloading;
 	uint32_t value;
 	uint32_t link_no;
 	size_t num_nodes;
 	knet_node_id_t host_ids[KNET_MAX_HOST];
 	int i;
 	int err;
 	struct totemknet_instance *instance = (struct totemknet_instance *)user_data;
 
 	ENTER();
 
 	/*
 	 * If a full reload is in progress then don't do anything until it's done and
 	 * can reconfigure it all atomically
 	 */
 	if (icmap_get_uint8("config.totemconfig_reload_in_progress", &reloading) == CS_OK && reloading) {
 		return;
 	}
 
 	knet_set_access_list_config(instance);
 
 	if (icmap_get_uint32("totem.knet_pmtud_interval", &value) == CS_OK) {
 
 		instance->totem_config->knet_pmtud_interval = value;
 		knet_log_printf (LOGSYS_LEVEL_DEBUG, "knet_pmtud_interval now %d", value);
 		err = knet_handle_pmtud_setfreq(instance->knet_handle, instance->totem_config->knet_pmtud_interval);
 		if (err) {
 			KNET_LOGSYS_PERROR(errno, LOGSYS_LEVEL_WARNING, "knet_handle_pmtud_setfreq failed");
 		}
 	}
 
 	/* Configure link parameters for each node */
 	err = knet_host_get_host_list(instance->knet_handle, host_ids, &num_nodes);
 	if (err != 0) {
 		KNET_LOGSYS_PERROR(errno, LOGSYS_LEVEL_ERROR, "knet_host_get_host_list failed");
 	}
 
 	for (i=0; i<num_nodes; i++) {
 		for (link_no = 0; link_no < INTERFACE_MAX; link_no++) {
 			if (host_ids[i] == instance->our_nodeid || !instance->totem_config->interfaces[link_no].configured) {
 				continue;
 			}
 
 			err = knet_link_set_ping_timers(instance->knet_handle, host_ids[i], link_no,
 							instance->totem_config->interfaces[link_no].knet_ping_interval,
 							instance->totem_config->interfaces[link_no].knet_ping_timeout,
 							instance->totem_config->interfaces[link_no].knet_ping_precision);
 			if (err) {
 				KNET_LOGSYS_PERROR(errno, LOGSYS_LEVEL_ERROR, "knet_link_set_ping_timers for node %d link %d failed", host_ids[i], link_no);
 			}
 			err = knet_link_set_pong_count(instance->knet_handle, host_ids[i], link_no,
 						       instance->totem_config->interfaces[link_no].knet_pong_count);
 			if (err) {
 				KNET_LOGSYS_PERROR(errno, LOGSYS_LEVEL_ERROR, "knet_link_set_pong_count for node %d link %d failed",host_ids[i], link_no);
 			}
 			err = knet_link_set_priority(instance->knet_handle, host_ids[i], link_no,
 						     instance->totem_config->interfaces[link_no].knet_link_priority);
 			if (err) {
 				KNET_LOGSYS_PERROR(errno, LOGSYS_LEVEL_ERROR, "knet_link_set_priority for node %d link %d failed", host_ids[i], link_no);
 			}
 
 		}
 	}
 
 	LEAVE();
 }
 
 static void totemknet_add_config_notifications(struct totemknet_instance *instance)
 {
 	icmap_track_t icmap_track_totem = NULL;
 	icmap_track_t icmap_track_reload = NULL;
 
 	ENTER();
 
 	icmap_track_add("totem.",
 		ICMAP_TRACK_ADD | ICMAP_TRACK_DELETE | ICMAP_TRACK_MODIFY | ICMAP_TRACK_PREFIX,
 		totemknet_refresh_config,
 		instance,
 		&icmap_track_totem);
 
 	icmap_track_add("config.totemconfig_reload_in_progress",
 		ICMAP_TRACK_ADD | ICMAP_TRACK_MODIFY,
 		totemknet_refresh_config,
 		instance,
 		&icmap_track_reload);
 
 	LEAVE();
 }
 
 /*
  * Create an instance
  */
 int totemknet_initialize (
 	qb_loop_t *poll_handle,
 	void **knet_context,
 	struct totem_config *totem_config,
 	totemsrp_stats_t *stats,
 	void *context,
 
 	void (*deliver_fn) (
 		void *context,
 		const void *msg,
 		unsigned int msg_len,
 		const struct sockaddr_storage *system_from),
 
 	void (*iface_change_fn) (
 		void *context,
 		const struct totem_ip_address *iface_address,
 		unsigned int link_no),
 
 	void (*mtu_changed) (
 		void *context,
 		int net_mtu),
 
 	void (*target_set_completed) (
 		void *context))
 {
 	struct totemknet_instance *instance;
 	int8_t channel=0;
 	int res;
 	int i;
 
 	instance = malloc (sizeof (struct totemknet_instance));
 	if (instance == NULL) {
 		return (-1);
 	}
 
 	totemknet_instance_initialize (instance);
 
 	instance->totem_config = totem_config;
 
 	/*
 	* Configure logging
 	*/
 	instance->totemknet_log_level_security = 1; //totem_config->totem_logging_configuration.log_level_security;
 	instance->totemknet_log_level_error = totem_config->totem_logging_configuration.log_level_error;
 	instance->totemknet_log_level_warning = totem_config->totem_logging_configuration.log_level_warning;
 	instance->totemknet_log_level_notice = totem_config->totem_logging_configuration.log_level_notice;
 	instance->totemknet_log_level_debug = totem_config->totem_logging_configuration.log_level_debug;
 	instance->totemknet_subsys_id = totem_config->totem_logging_configuration.log_subsys_id;
 	instance->totemknet_log_printf = totem_config->totem_logging_configuration.log_printf;
 
 	instance->knet_subsys_id = _logsys_subsys_create("KNET", "libknet.h");
 
 	/*
 	 * Initialize local variables for totemknet
 	 */
 
 	instance->our_nodeid = instance->totem_config->node_id;
 
 	for (i=0; i< INTERFACE_MAX; i++) {
 		totemip_copy(&instance->my_ids[i], &totem_config->interfaces[i].bindnet);
 		instance->my_ids[i].nodeid = instance->our_nodeid;
 		instance->ip_port[i] = totem_config->interfaces[i].ip_port;
 
 		/* Needed for totemsrp */
 		totem_config->interfaces[i].boundto.nodeid = instance->our_nodeid;
 	}
 
 	instance->poll_handle = poll_handle;
 
 	instance->context = context;
 	instance->totemknet_deliver_fn = deliver_fn;
 
 	instance->totemknet_iface_change_fn = iface_change_fn;
 
 	instance->totemknet_mtu_changed = mtu_changed;
 
 	instance->totemknet_target_set_completed = target_set_completed;
 
 	instance->loopback_link = 0;
 
 	res = pipe(instance->logpipes);
 	if (res == -1) {
 	    KNET_LOGSYS_PERROR(errno, LOGSYS_LEVEL_CRIT, "failed to create pipe for instance->logpipes");
 	    goto exit_error;
 	}
 	fcntl(instance->logpipes[0], F_SETFL, O_NONBLOCK);
 	fcntl(instance->logpipes[1], F_SETFL, O_NONBLOCK);
 
 #if !defined(KNET_API_VER) || (KNET_API_VER == 1)
 	instance->knet_handle = knet_handle_new(instance->totem_config->node_id, instance->logpipes[1], KNET_LOG_DEBUG);
 #endif
 #if KNET_API_VER == 2
 	instance->knet_handle = knet_handle_new(instance->totem_config->node_id, instance->logpipes[1], KNET_LOG_DEBUG, KNET_HANDLE_FLAG_PRIVILEGED);
 #endif
 
 	if (!instance->knet_handle) {
 		KNET_LOGSYS_PERROR(errno, LOGSYS_LEVEL_CRIT, "knet_handle_new failed");
 		goto exit_error;
 	}
 
 	knet_set_access_list_config(instance);
 
 	res = knet_handle_pmtud_setfreq(instance->knet_handle, instance->totem_config->knet_pmtud_interval);
 	if (res) {
 		KNET_LOGSYS_PERROR(errno, LOGSYS_LEVEL_WARNING, "knet_handle_pmtud_setfreq failed");
 	}
 	res = knet_handle_enable_filter(instance->knet_handle, instance, dst_host_filter_callback_fn);
 	if (res) {
 		KNET_LOGSYS_PERROR(errno, LOGSYS_LEVEL_WARNING, "knet_handle_enable_filter failed");
 	}
 	res = knet_handle_enable_sock_notify(instance->knet_handle, instance, socket_error_callback_fn);
 	if (res) {
 		KNET_LOGSYS_PERROR(errno, LOGSYS_LEVEL_WARNING, "knet_handle_enable_sock_notify failed");
 	}
 	res = knet_host_enable_status_change_notify(instance->knet_handle, instance, host_change_callback_fn);
 	if (res) {
 		KNET_LOGSYS_PERROR(errno, LOGSYS_LEVEL_WARNING, "knet_host_enable_status_change_notify failed");
 	}
 	res = knet_handle_enable_pmtud_notify(instance->knet_handle, instance, pmtu_change_callback_fn);
 	if (res) {
 		KNET_LOGSYS_PERROR(errno, LOGSYS_LEVEL_WARNING, "knet_handle_enable_pmtud_notify failed");
 	}
 	global_instance = instance;
 
 	/* Get an fd into knet */
 	instance->knet_fd = 0;
 	res = knet_handle_add_datafd(instance->knet_handle, &instance->knet_fd, &channel);
 	if (res) {
 		knet_log_printf(LOG_DEBUG, "knet_handle_add_datafd failed: %s", strerror(errno));
 		goto exit_error;
 	}
 
 	/* Enable crypto if requested */
 	if (strcmp(instance->totem_config->crypto_cipher_type, "none") != 0) {
 		struct knet_handle_crypto_cfg crypto_cfg;
 
 		strcpy(crypto_cfg.crypto_model, instance->totem_config->crypto_model);
 		strcpy(crypto_cfg.crypto_cipher_type, instance->totem_config->crypto_cipher_type);
 		strcpy(crypto_cfg.crypto_hash_type, instance->totem_config->crypto_hash_type);
 		memcpy(crypto_cfg.private_key, instance->totem_config->private_key, instance->totem_config->private_key_len);
 		crypto_cfg.private_key_len = instance->totem_config->private_key_len;
 
 		res = knet_handle_crypto(instance->knet_handle, &crypto_cfg);
 		if (res == -1) {
 			knet_log_printf(LOGSYS_LEVEL_ERROR, "knet_handle_crypto failed: %s", strerror(errno));
 			goto exit_error;
 		}
 		if (res == -2) {
 			knet_log_printf(LOGSYS_LEVEL_ERROR, "knet_handle_crypto failed: -2");
 			goto exit_error;
 		}
 		knet_log_printf(LOG_INFO, "kronosnet crypto initialized: %s/%s", crypto_cfg.crypto_cipher_type, crypto_cfg.crypto_hash_type);
 	}
 
 	/* Set up compression */
 	totemknet_reconfigure(instance, instance->totem_config);
 
 	knet_handle_setfwd(instance->knet_handle, 1);
 
 	instance->link_mode = KNET_LINK_POLICY_PASSIVE;
 	if (strcmp(instance->totem_config->link_mode, "active")==0) {
 		instance->link_mode = KNET_LINK_POLICY_ACTIVE;
 	}
 	if (strcmp(instance->totem_config->link_mode, "rr")==0) {
 		instance->link_mode = KNET_LINK_POLICY_RR;
 	}
 
 	for (i=0; i<INTERFACE_MAX; i++) {
 		instance->link_status[i] = malloc(CFG_INTERFACE_STATUS_MAX_LEN);
 		if (!instance->link_status[i]) {
 			goto exit_error;
 		}
 	}
 
 	qb_loop_poll_add (instance->poll_handle,
 		QB_LOOP_MED,
 		instance->logpipes[0],
 		POLLIN, instance, log_deliver_fn);
 
 	qb_loop_poll_add (instance->poll_handle,
 		QB_LOOP_HIGH,
 		instance->knet_fd,
 		POLLIN, instance, data_deliver_fn);
 
 	/*
 	 * Upper layer isn't ready to receive message because it hasn't
 	 * initialized yet.  Add short timer to check the interfaces.
 	 */
 	qb_loop_timer_add (instance->poll_handle,
 		QB_LOOP_MED,
 		100*QB_TIME_NS_IN_MSEC,
 		(void *)instance,
 		timer_function_netif_check_timeout,
 		&instance->timer_netif_check_timeout);
 
 	totemknet_start_merge_detect_timeout(instance);
 
 	/* Start listening for config changes */
 	totemknet_add_config_notifications(instance);
 
 	/* Add stats keys to icmap */
 	stats_knet_add_handle();
 
 	knet_log_printf (LOGSYS_LEVEL_INFO, "totemknet initialized");
 	*knet_context = instance;
 
 	return (0);
 
 exit_error:
 	log_flush_messages(instance);
 	free(instance);
 	return (-1);
 }
 
 void *totemknet_buffer_alloc (void)
 {
 	/* Need to have space for a message AND a struct mcast in case of encapsulated messages */
 	return malloc(KNET_MAX_PACKET_SIZE + 512);
 }
 
 void totemknet_buffer_release (void *ptr)
 {
 	return free (ptr);
 }
 
 int totemknet_processor_count_set (
 	void *knet_context,
 	int processor_count)
 {
 	return (0);
 }
 
 int totemknet_recv_flush (void *knet_context)
 {
 	return (0);
 }
 
 int totemknet_send_flush (void *knet_context)
 {
 	return (0);
 }
 
 int totemknet_token_send (
 	void *knet_context,
 	const void *msg,
 	unsigned int msg_len)
 {
 	struct totemknet_instance *instance = (struct totemknet_instance *)knet_context;
 	int res = 0;
 
 	ucast_sendmsg (instance, &instance->token_target, msg, msg_len);
 
 	return (res);
 }
 int totemknet_mcast_flush_send (
 	void *knet_context,
 	const void *msg,
 	unsigned int msg_len)
 {
 	struct totemknet_instance *instance = (struct totemknet_instance *)knet_context;
 	int res = 0;
 
 	mcast_sendmsg (instance, msg, msg_len, 0);
 
 	return (res);
 }
 
 int totemknet_mcast_noflush_send (
 	void *knet_context,
 	const void *msg,
 	unsigned int msg_len)
 {
 	struct totemknet_instance *instance = (struct totemknet_instance *)knet_context;
 	int res = 0;
 
 	mcast_sendmsg (instance, msg, msg_len, 1);
 
 	return (res);
 }
 
 
 extern int totemknet_iface_check (void *knet_context)
 {
 	struct totemknet_instance *instance = (struct totemknet_instance *)knet_context;
 	int res = 0;
 
 	knet_log_printf(LOG_DEBUG, "totemknet: iface_check");
 
 	return (res);
 }
 
 extern void totemknet_net_mtu_adjust (void *knet_context, struct totem_config *totem_config)
 {
 	struct totemknet_instance *instance = (struct totemknet_instance *)knet_context;
 
 	knet_log_printf(LOG_DEBUG, "totemknet: Returning MTU of %d", totem_config->net_mtu);
 }
 
 int totemknet_token_target_set (
 	void *knet_context,
 	unsigned int nodeid)
 {
 	struct totemknet_instance *instance = (struct totemknet_instance *)knet_context;
 	int res = 0;
 
 	instance->token_target.nodeid = nodeid;
 
 	instance->totemknet_target_set_completed (instance->context);
 
 	return (res);
 }
 
 extern int totemknet_recv_mcast_empty (
 	void *knet_context)
 {
 	struct totemknet_instance *instance = (struct totemknet_instance *)knet_context;
 	unsigned int res;
 	struct sockaddr_storage system_from;
 	struct msghdr msg_hdr;
 	struct iovec iov_recv;
 	struct pollfd ufd;
 	int nfds;
 	int msg_processed = 0;
 
 	iov_recv.iov_base = instance->iov_buffer;
 	iov_recv.iov_len = KNET_MAX_PACKET_SIZE;
 
 	msg_hdr.msg_name = &system_from;
 	msg_hdr.msg_namelen = sizeof (struct sockaddr_storage);
 	msg_hdr.msg_iov = &iov_recv;
 	msg_hdr.msg_iovlen = 1;
 #ifdef HAVE_MSGHDR_CONTROL
 	msg_hdr.msg_control = 0;
 #endif
 #ifdef HAVE_MSGHDR_CONTROLLEN
 	msg_hdr.msg_controllen = 0;
 #endif
 #ifdef HAVE_MSGHDR_FLAGS
 	msg_hdr.msg_flags = 0;
 #endif
 #ifdef HAVE_MSGHDR_ACCRIGHTS
 	msg_msg_hdr.msg_accrights = NULL;
 #endif
 #ifdef HAVE_MSGHDR_ACCRIGHTSLEN
 	msg_msg_hdr.msg_accrightslen = 0;
 #endif
 
 	do {
 		ufd.fd = instance->knet_fd;
 		ufd.events = POLLIN;
 		nfds = poll (&ufd, 1, 0);
 		if (nfds == 1 && ufd.revents & POLLIN) {
 			res = recvmsg (instance->knet_fd, &msg_hdr, MSG_NOSIGNAL | MSG_DONTWAIT);
 			if (res != -1) {
 				msg_processed = 1;
 			} else {
 				msg_processed = -1;
 			}
 		}
 	} while (nfds == 1);
 
 	return (msg_processed);
 }
 
 int totemknet_iface_set (void *knet_context,
 	const struct totem_ip_address *local_addr,
 	unsigned short ip_port,
 	unsigned int iface_no)
 {
 	struct totemknet_instance *instance = (struct totemknet_instance *)knet_context;
 
 	totemip_copy(&instance->my_ids[iface_no], local_addr);
 
 	knet_log_printf(LOG_INFO, "Configured link number %d: local addr: %s, port=%d", iface_no, totemip_print(local_addr), ip_port);
 
 	instance->ip_port[iface_no] = ip_port;
 
 	return 0;
 }
 
 
 int totemknet_member_add (
 	void *knet_context,
 	const struct totem_ip_address *local,
 	const struct totem_ip_address *member,
 	int link_no)
 {
 	struct totemknet_instance *instance = (struct totemknet_instance *)knet_context;
 	int err;
 	int port = instance->ip_port[link_no];
 	struct sockaddr_storage remote_ss;
 	struct sockaddr_storage local_ss;
 	int addrlen;
 	int i;
 	int host_found = 0;
 	knet_node_id_t host_ids[KNET_MAX_HOST];
 	size_t num_host_ids;
 
 	/* Only create 1 loopback link and use link 0 */
 	if (member->nodeid == instance->our_nodeid) {
 		if (!instance->loopback_link) {
 			link_no = 0;
 			instance->loopback_link = 1;
 		} else {
 			/* Already done */
 			return 0;
 		}
 	}
 
 	knet_log_printf (LOGSYS_LEVEL_DEBUG, "knet: member_add: %d (%s), link=%d", member->nodeid, totemip_print(member), link_no);
 	knet_log_printf (LOGSYS_LEVEL_DEBUG, "knet:      local: %d (%s)", local->nodeid, totemip_print(local));
 
 
 	/* Only add the host if it doesn't already exist in knet */
 	err = knet_host_get_host_list(instance->knet_handle, host_ids, &num_host_ids);
 	if (err) {
 		KNET_LOGSYS_PERROR(errno, LOGSYS_LEVEL_ERROR, "knet_host_get_host_list");
 		return -1;
 	}
 	for (i=0; i<num_host_ids; i++) {
 		if (host_ids[i] == member->nodeid) {
 			host_found = 1;
 		}
 	}
 
 	if (!host_found) {
 		err = knet_host_add(instance->knet_handle, member->nodeid);
 		if (err != 0 && errno != EEXIST) {
 			KNET_LOGSYS_PERROR(errno, LOGSYS_LEVEL_ERROR, "knet_host_add");
 			return -1;
 		}
 	} else {
 		knet_log_printf (LOGSYS_LEVEL_DEBUG, "nodeid %d already added", member->nodeid);
 	}
 
 
 	if (err == 0) {
 		if (knet_host_set_policy(instance->knet_handle, member->nodeid, instance->link_mode)) {
 			KNET_LOGSYS_PERROR(errno, LOGSYS_LEVEL_ERROR, "knet_set_policy failed");
 			return -1;
 		}
 	}
 
 	memset(&local_ss, 0, sizeof(local_ss));
 	/* Casts to remove const */
 	totemip_totemip_to_sockaddr_convert((struct totem_ip_address *)member, port, &remote_ss, &addrlen);
 	totemip_totemip_to_sockaddr_convert((struct totem_ip_address *)local, port, &local_ss, &addrlen);
 
 	if (member->nodeid == instance->our_nodeid) {
 		knet_log_printf (LOGSYS_LEVEL_DEBUG, "knet: loopback link is %d\n", link_no);
 
 		err = knet_link_set_config(instance->knet_handle, member->nodeid, link_no,
 					   KNET_TRANSPORT_LOOPBACK,
 					   &local_ss, &remote_ss, KNET_LINK_FLAG_TRAFFICHIPRIO);
 	}
 	else {
 		err = knet_link_set_config(instance->knet_handle, member->nodeid, link_no,
 					   instance->totem_config->interfaces[link_no].knet_transport,
 					   &local_ss, &remote_ss, KNET_LINK_FLAG_TRAFFICHIPRIO);
 	}
 	if (err) {
 		KNET_LOGSYS_PERROR(errno, LOGSYS_LEVEL_ERROR, "knet_link_set_config failed");
 		return -1;
 	}
 
 	knet_log_printf (LOGSYS_LEVEL_DEBUG, "knet: member_add: Setting link prio to %d",
 		    instance->totem_config->interfaces[link_no].knet_link_priority);
 
 	err = knet_link_set_priority(instance->knet_handle, member->nodeid, link_no,
 			       instance->totem_config->interfaces[link_no].knet_link_priority);
 	if (err) {
 		KNET_LOGSYS_PERROR(errno, LOGSYS_LEVEL_ERROR, "knet_link_set_priority for nodeid %d, link %d failed", member->nodeid, link_no);
 	}
 
 	/* ping timeouts maybe 0 here for a newly added interface so we leave this till later, it will
 	   get done in totemknet_refresh_config */
 	if (instance->totem_config->interfaces[link_no].knet_ping_interval != 0) {
 		err = knet_link_set_ping_timers(instance->knet_handle, member->nodeid, link_no,
 						instance->totem_config->interfaces[link_no].knet_ping_interval,
 						instance->totem_config->interfaces[link_no].knet_ping_timeout,
 						instance->totem_config->interfaces[link_no].knet_ping_precision);
 		if (err) {
 			KNET_LOGSYS_PERROR(errno, LOGSYS_LEVEL_ERROR, "knet_link_set_ping_timers for nodeid %d, link %d failed", member->nodeid, link_no);
 		}
 		err = knet_link_set_pong_count(instance->knet_handle, member->nodeid, link_no,
 					       instance->totem_config->interfaces[link_no].knet_pong_count);
 		if (err) {
 			KNET_LOGSYS_PERROR(errno, LOGSYS_LEVEL_ERROR, "knet_link_set_pong_count for nodeid %d, link %d failed", member->nodeid, link_no);
 		}
 	}
 
 	err = knet_link_set_enable(instance->knet_handle, member->nodeid, link_no, 1);
 	if (err) {
 		KNET_LOGSYS_PERROR(errno, LOGSYS_LEVEL_ERROR, "knet_link_set_enable for nodeid %d, link %d failed", member->nodeid, link_no);
 		return -1;
 	}
 
 	/* register stats */
 	stats_knet_add_member(member->nodeid, link_no);
 	return (0);
 }
 
 int totemknet_member_remove (
 	void *knet_context,
 	const struct totem_ip_address *token_target,
 	int link_no)
 {
 	struct totemknet_instance *instance = (struct totemknet_instance *)knet_context;
 	int res;
 	uint8_t link_list[KNET_MAX_LINK];
 	size_t num_links;
 
 	knet_log_printf (LOGSYS_LEVEL_DEBUG, "knet: member_remove: %d, link=%d", token_target->nodeid, link_no);
 
 	/* Don't remove the link with the loopback on it until we shut down */
 	if (token_target->nodeid == instance->our_nodeid) {
 		return 0;
 	}
 
 	/* Tidy stats */
 	stats_knet_del_member(token_target->nodeid, link_no);
 
 	/* Remove the link first */
 	res = knet_link_set_enable(instance->knet_handle, token_target->nodeid, link_no, 0);
 	if (res != 0) {
 		KNET_LOGSYS_PERROR(errno, LOGSYS_LEVEL_ERROR, "knet_link_set enable(off) for nodeid %d, link %d failed", token_target->nodeid, link_no);
 		return res;
 	}
 
 	res = knet_link_clear_config(instance->knet_handle, token_target->nodeid, link_no);
 	if (res != 0) {
 		KNET_LOGSYS_PERROR(errno, LOGSYS_LEVEL_ERROR, "knet_link_clear_config for nodeid %d, link %d failed", token_target->nodeid, link_no);
 		return res;
 	}
 
 	/* If this is the last link, then remove the node */
 	res = knet_link_get_link_list(instance->knet_handle,
 				      token_target->nodeid, link_list, &num_links);
 	if (res) {
 		return (0); /* not really  failure */
 	}
 
 	if (num_links == 0) {
 		res = knet_host_remove(instance->knet_handle, token_target->nodeid);
 	}
 	return res;
 }
 
 int totemknet_member_list_rebind_ip (
 	void *knet_context)
 {
 	return (0);
 }
 
 int totemknet_reconfigure (
 	void *knet_context,
 	struct totem_config *totem_config)
 {
 	struct totemknet_instance *instance = (struct totemknet_instance *)knet_context;
 	struct knet_handle_compress_cfg compress_cfg;
 	int res = 0;
 
 	if (totem_config->knet_compression_model) {
 		strcpy(compress_cfg.compress_model, totem_config->knet_compression_model);
 		compress_cfg.compress_threshold = totem_config->knet_compression_threshold;
 		compress_cfg.compress_level = totem_config->knet_compression_level;
 
 		res = knet_handle_compress(instance->knet_handle, &compress_cfg);
 		if (res) {
 			KNET_LOGSYS_PERROR(errno, LOGSYS_LEVEL_ERROR, "knet_handle_compress failed");
 		}
 	}
 
 #ifdef HAVE_LIBNOZZLE
 	/* Set up nozzle device(s) */
 	setup_nozzle(instance);
 #endif
 	return (res);
 }
 
 
 void totemknet_stats_clear (
 	void *knet_context)
 {
 	struct totemknet_instance *instance = (struct totemknet_instance *)knet_context;
 
 	(void) knet_handle_clear_stats(instance->knet_handle, KNET_CLEARSTATS_HANDLE_AND_LINK);
 }
 
 /* For the stats module */
 int totemknet_link_get_status (
 	knet_node_id_t node, uint8_t link_no,
 	struct knet_link_status *status)
 {
 	int res;
 	int ret = CS_OK;
 
 	/* We are probably not using knet */
 	if (!global_instance) {
 		return CS_ERR_NOT_EXIST;
 	}
 
 	if (link_no >= INTERFACE_MAX) {
 		return CS_ERR_NOT_EXIST; /* Invalid link number */
 	}
 
 	res = knet_link_get_status(global_instance->knet_handle, node, link_no, status, sizeof(struct knet_link_status));
 	if (res) {
 		switch (errno) {
 			case EINVAL:
 				ret = CS_ERR_INVALID_PARAM;
 				break;
 			case EBUSY:
 				ret = CS_ERR_BUSY;
 				break;
 			case EDEADLK:
 				ret = CS_ERR_TRY_AGAIN;
 				break;
 			default:
 				ret = CS_ERR_LIBRARY;
 				break;
 		}
 	}
 
 	return (ret);
 }
 
 int totemknet_handle_get_stats (
 	struct knet_handle_stats *stats)
 {
 	/* We are probably not using knet */
 	if (!global_instance) {
 		return CS_ERR_NOT_EXIST;
 	}
 
 	return knet_handle_get_stats(global_instance->knet_handle, stats, sizeof(struct knet_handle_stats));
 }
 
 static void timer_function_merge_detect_timeout (
 	void *data)
 {
 	struct totemknet_instance *instance = (struct totemknet_instance *)data;
 
 	if (instance->merge_detect_messages_sent_before_timeout == 0) {
 		instance->send_merge_detect_message = 1;
 	}
 
 	instance->merge_detect_messages_sent_before_timeout = 0;
 
 	totemknet_start_merge_detect_timeout(instance);
 }
 
 static void totemknet_start_merge_detect_timeout(
 	void *knet_context)
 {
 	struct totemknet_instance *instance = (struct totemknet_instance *)knet_context;
 
 	qb_loop_timer_add(instance->poll_handle,
 	    QB_LOOP_MED,
 	    instance->totem_config->merge_timeout * 2 * QB_TIME_NS_IN_MSEC,
 	    (void *)instance,
 	    timer_function_merge_detect_timeout,
 	    &instance->timer_merge_detect_timeout);
 
 }
 
 static void totemknet_stop_merge_detect_timeout(
 	void *knet_context)
 {
 	struct totemknet_instance *instance = (struct totemknet_instance *)knet_context;
 
 	qb_loop_timer_del(instance->poll_handle,
 	    instance->timer_merge_detect_timeout);
 }
 
 static void log_flush_messages (void *knet_context)
 {
 	struct pollfd pfd;
 	struct totemknet_instance *instance = (struct totemknet_instance *)knet_context;
 	int cont;
 
 	cont = 1;
 
 	while (cont) {
 		pfd.fd = instance->logpipes[0];
 		pfd.events = POLLIN;
 		pfd.revents = 0;
 
 		if ((poll(&pfd, 1, 0) > 0) &&
 		    (pfd.revents & POLLIN) &&
 		    (log_deliver_fn(instance->logpipes[0], POLLIN, instance) == 0)) {
 			cont = 1;
 		} else {
 			cont = 0;
 		}
 	}
 }
 
 
 #ifdef HAVE_LIBNOZZLE
 #define NOZZLE_NAME    "nozzle.name"
 #define NOZZLE_IPADDR  "nozzle.ipaddr"
 #define NOZZLE_PREFIX  "nozzle.ipprefix"
 #define NOZZLE_MACADDR "nozzle.macaddr"
 
 #define NOZZLE_CHANNEL 1
 
 
 static char *get_nozzle_script_dir(void *knet_context)
 {
 	struct totemknet_instance *instance = (struct totemknet_instance *)knet_context;
 	char filename[PATH_MAX + FILENAME_MAX + 1];
 	static char updown_dirname[PATH_MAX + FILENAME_MAX + 1];
 	int res;
 	const char *dirname_res;
 
 	/*
 	 * Build script directory based on corosync.conf file location
 	 */
 	res = snprintf(filename, sizeof(filename), "%s",
 	    corosync_get_config_file());
 	if (res >= sizeof(filename)) {
 		knet_log_printf (LOGSYS_LEVEL_DEBUG, "nozzle up/down path too long");
 		return NULL;
 	}
 
 	dirname_res = dirname(filename);
 
 	res = snprintf(updown_dirname, sizeof(updown_dirname), "%s/%s",
 	    dirname_res, "updown.d");
 	if (res >= sizeof(updown_dirname)) {
 		knet_log_printf (LOGSYS_LEVEL_DEBUG, "nozzle up/down path too long");
 		return NULL;
 	}
 	return updown_dirname;
 }
 
 /*
  * Deliberately doesn't return the status as caller doesn't care.
  * The result will be logged though
  */
 static void run_nozzle_script(struct totemknet_instance *instance, int type, const char *typename)
 {
 	int res;
 	char *exec_string;
 
 	res = nozzle_run_updown(instance->nozzle_handle, type, &exec_string);
 	if (res == -1 && errno != ENOENT) {
 		knet_log_printf (LOGSYS_LEVEL_INFO, "exec nozzle %s script failed: %s", typename, strerror(errno));
 	} else if (res == -2) {
 		knet_log_printf (LOGSYS_LEVEL_INFO, "nozzle %s script failed", typename);
 		knet_log_printf (LOGSYS_LEVEL_INFO, "%s", exec_string);
 	}
 }
 
 /*
  * Reparse IP address to add in our node ID
  * IPv6 addresses must end in '::'
  * IPv4 addresses must just be valid
  * '/xx' lengths are optional for IPv6, mandatory for IPv4
  *
  * Returns the modified IP address as a string to pass into libnozzle
  */
 static int reparse_nozzle_ip_address(struct totemknet_instance *instance,
 				     const char *input_addr,
 				     const char *prefix, int nodeid,
 				     char *output_addr, size_t output_len)
 {
 	char *coloncolon;
 	int bits;
 	int max_prefix = 64;
 	uint32_t nodeid_mask;
 	uint32_t addr_mask;
 	uint32_t masked_nodeid;
 	struct in_addr *addr;
 	struct totem_ip_address totemip;
 
 	coloncolon = strstr(input_addr, "::");
 	if (!coloncolon) {
 		max_prefix = 30;
 	}
 
 	bits = atoi(prefix);
 	if (bits < 8 || bits > max_prefix) {
 		knet_log_printf(LOGSYS_LEVEL_ERROR, "nozzle IP address prefix must be >= 8 and <= %d (got %d)", max_prefix, bits);
 		return -1;
 	}
 
 	/* IPv6 is easy */
 	if (coloncolon) {
 		memcpy(output_addr, input_addr, coloncolon-input_addr);
 		sprintf(output_addr + (coloncolon-input_addr), "::%x", nodeid);
 		return 0;
 	}
 
 	/* For IPv4 we need to parse the address into binary, mask off the required bits,
 	 * add in the masked_nodeid and 'print' it out again
 	 */
 	nodeid_mask = UINT32_MAX & ((1<<(32 - bits)) - 1);
 	addr_mask   = UINT32_MAX ^ nodeid_mask;
 	masked_nodeid = nodeid & nodeid_mask;
 
 	if (totemip_parse(&totemip, input_addr, AF_INET)) {
 		knet_log_printf(LOGSYS_LEVEL_ERROR, "Failed to parse IPv4 nozzle IP address");
 		return -1;
 	}
 	addr = (struct in_addr *)&totemip.addr;
 	addr->s_addr &= htonl(addr_mask);
 	addr->s_addr |= htonl(masked_nodeid);
 
 	inet_ntop(AF_INET, addr, output_addr, output_len);
 	return 0;
 }
 
 static int create_nozzle_device(void *knet_context, const char *name,
 				const char *ipaddr, const char *prefix,
 				const char *macaddr)
 {
 	struct totemknet_instance *instance = (struct totemknet_instance *)knet_context;
 	char device_name[IFNAMSIZ+1];
 	size_t size = IFNAMSIZ;
 	int8_t channel = NOZZLE_CHANNEL;
 	nozzle_t nozzle_dev;
 	int nozzle_fd;
 	int res;
 	char *updown_dir;
 	char parsed_ipaddr[INET6_ADDRSTRLEN];
 	char mac[19];
 
 	memset(device_name, 0, size);
 	memset(&mac, 0, sizeof(mac));
 	strncpy(device_name, name, size);
 
 	updown_dir = get_nozzle_script_dir(knet_context);
 	knet_log_printf (LOGSYS_LEVEL_INFO, "nozzle script dir is %s", updown_dir);
 
 	nozzle_dev = nozzle_open(device_name, size, updown_dir);
 	if (!nozzle_dev) {
 		knet_log_printf (LOGSYS_LEVEL_ERROR, "Unable to init nozzle device %s: %s", device_name, strerror(errno));
 		return -1;
 	}
 	instance->nozzle_handle = nozzle_dev;
 
 	if (nozzle_set_mac(nozzle_dev, macaddr) < 0) {
 		knet_log_printf (LOGSYS_LEVEL_ERROR, "Unable to add set nozzle MAC to %s: %s", mac, strerror(errno));
 		goto out_clean;
 	}
 
 	if (reparse_nozzle_ip_address(instance, ipaddr, prefix, instance->our_nodeid, parsed_ipaddr, sizeof(parsed_ipaddr))) {
 		/* Prints its own errors */
 		goto out_clean;
 	}
 	knet_log_printf (LOGSYS_LEVEL_INFO, "Local nozzle IP address is %s / %d", parsed_ipaddr, atoi(prefix));
 	if (ipaddr) {
 		if (nozzle_add_ip(nozzle_dev, parsed_ipaddr, prefix) < 0) {
 			knet_log_printf (LOGSYS_LEVEL_ERROR, "Unable to add set nozzle IP addr to %s/%s: %s", parsed_ipaddr, prefix, strerror(errno));
 			goto out_clean;
 		}
 	}
 
 	nozzle_fd = nozzle_get_fd(nozzle_dev);
 	knet_log_printf (LOGSYS_LEVEL_INFO, "Opened '%s' on fd %d", device_name, nozzle_fd);
 
 	res = knet_handle_add_datafd(instance->knet_handle, &nozzle_fd, &channel);
 	if (res != 0) {
 		knet_log_printf (LOGSYS_LEVEL_ERROR, "Unable to add nozzle FD to knet: %s", strerror(errno));
 		goto out_clean;
 	}
 
 	run_nozzle_script(instance, NOZZLE_PREUP, "pre-up");
 
 	res = nozzle_set_up(nozzle_dev);
 	if (res != 0) {
 		knet_log_printf (LOGSYS_LEVEL_ERROR, "Unable to set nozzle interface UP: %s", strerror(errno));
 		goto out_clean;
 	}
 	run_nozzle_script(instance, NOZZLE_UP, "up");
 
 	return 0;
 
 out_clean:
 	nozzle_close(nozzle_dev);
 	return -1;
 }
 
 static int remove_nozzle_device(void *knet_context)
 {
 	struct totemknet_instance *instance = (struct totemknet_instance *)knet_context;
 	int res;
 	int datafd;
 
 	res = knet_handle_get_datafd(instance->knet_handle, NOZZLE_CHANNEL, &datafd);
 	if (res != 0) {
 		knet_log_printf (LOGSYS_LEVEL_ERROR, "Can't find datafd for channel %d: %s", NOZZLE_CHANNEL, strerror(errno));
 		return -1;
 	}
 
 	res = knet_handle_remove_datafd(instance->knet_handle, datafd);
 	if (res != 0) {
 		knet_log_printf (LOGSYS_LEVEL_ERROR, "Can't remove datafd for nozzle channel %d: %s", NOZZLE_CHANNEL, strerror(errno));
 		return -1;
 	}
 
 	run_nozzle_script(instance, NOZZLE_DOWN, "pre-down");
 	res = nozzle_set_down(instance->nozzle_handle);
 	if (res != 0) {
 		knet_log_printf (LOGSYS_LEVEL_ERROR, "Can't set nozzle device down: %s", strerror(errno));
 		return -1;
 	}
 	run_nozzle_script(instance, NOZZLE_POSTDOWN, "post-down");
 
 	res = nozzle_close(instance->nozzle_handle);
 	if (res != 0) {
 		knet_log_printf (LOGSYS_LEVEL_ERROR, "Can't close nozzle device: %s", strerror(errno));
 		return -1;
 	}
 	knet_log_printf (LOGSYS_LEVEL_INFO, "Removed nozzle device");
 	return 0;
 }
 
 static void free_nozzle(struct totemknet_instance *instance)
 {
 	free(instance->nozzle_name);
 	free(instance->nozzle_ipaddr);
 	free(instance->nozzle_prefix);
 	free(instance->nozzle_macaddr);
 
 	instance->nozzle_name =	instance->nozzle_ipaddr = instance->nozzle_prefix =
 		instance->nozzle_macaddr = NULL;
 }
 
 static int setup_nozzle(void *knet_context)
 {
 	struct totemknet_instance *instance = (struct totemknet_instance *)knet_context;
 	char *ipaddr_str = NULL;
 	char *name_str = NULL;
 	char *prefix_str = NULL;
 	char *macaddr_str = NULL;
 	char mac[32];
 	int name_res;
 	int macaddr_res;
 	int res;
 
 	icmap_get_string(NOZZLE_IPADDR, &ipaddr_str);
 	icmap_get_string(NOZZLE_PREFIX, &prefix_str);
 	macaddr_res = icmap_get_string(NOZZLE_MACADDR, &macaddr_str);
 	name_res = icmap_get_string(NOZZLE_NAME, &name_str);
 
 	/* Is is being removed? */
 	if (name_res == CS_ERR_NOT_EXIST && instance->nozzle_handle) {
 		remove_nozzle_device(instance);
 		free_nozzle(instance);
 		goto out_free;
 	}
 
 	if (!name_str) {
 		/* no nozzle */
 		goto out_free;
 	}
 
 	if (!ipaddr_str) {
 		knet_log_printf (LOGSYS_LEVEL_ERROR, "No IP address supplied for Nozzle device");
 		goto out_free;
 	}
 
 	if (!prefix_str) {
 		knet_log_printf (LOGSYS_LEVEL_ERROR, "No prefix supplied for Nozzle IP address");
 		goto out_free;
 	}
 
 	if (macaddr_str && strlen(macaddr_str) != 17) {
 		knet_log_printf (LOGSYS_LEVEL_ERROR, "macaddr for nozzle device is not in the correct format '%s'", macaddr_str);
 		goto out_free;
 	}
 	if (!macaddr_str) {
 		macaddr_str = (char*)"54:54:01:00:00:00";
 	}
 
 	if (instance->nozzle_name &&
 	    (strcmp(name_str, instance->nozzle_name) == 0) &&
 	    (strcmp(ipaddr_str, instance->nozzle_ipaddr) == 0) &&
 	    (strcmp(prefix_str, instance->nozzle_prefix) == 0) &&
 	    ((macaddr_str == NULL && instance->nozzle_macaddr == NULL) ||
 	     strcmp(macaddr_str, instance->nozzle_macaddr) == 0)) {
 		/* Nothing has changed */
 		knet_log_printf (LOGSYS_LEVEL_DEBUG, "Nozzle device info not changed");
 		goto out_free;
 	}
 
 	/* Add nodeid into MAC address */
 	memcpy(mac, macaddr_str, 12);
 	snprintf(mac+12, sizeof(mac) - 13, "%02x:%02x",
 		 instance->our_nodeid >> 8,
 		 instance->our_nodeid & 0xFF);
 	knet_log_printf (LOGSYS_LEVEL_INFO, "Local nozzle MAC address is %s", mac);
 
 	if (name_res == CS_OK && name_str) {
 		/* Reconfigure */
 		if (instance->nozzle_name) {
 			remove_nozzle_device(instance);
 			free_nozzle(instance);
 		}
 
 		res = create_nozzle_device(knet_context, name_str, ipaddr_str, prefix_str,
 					   mac);
 
 		instance->nozzle_name = strdup(name_str);
 		instance->nozzle_ipaddr = strdup(ipaddr_str);
 		instance->nozzle_prefix = strdup(prefix_str);
 		instance->nozzle_macaddr = strdup(macaddr_str);
 		if (!instance->nozzle_name || !instance->nozzle_ipaddr ||
 		    !instance->nozzle_prefix) {
 			knet_log_printf (LOGSYS_LEVEL_ERROR, "strdup failed in nozzle allocation");
 			/*
 			 * This 'free' will cause a complete reconfigure of the device next time we reload
 			 * but will also let the the current device keep working until then.
 			 * remove_nozzle() only needs the, statically-allocated, nozzle_handle
 			 */
 			free_nozzle(instance);
 		}
 	}
 
 out_free:
 	free(name_str);
 	free(ipaddr_str);
 	free(prefix_str);
 	if (macaddr_res == CS_OK) {
 		free(macaddr_str);
 	}
 
 	return res;
 }
 #endif // HAVE_LIBNOZZLE
diff --git a/man/corosync.conf.5 b/man/corosync.conf.5
index 953c830d..0e1ef88a 100644
--- a/man/corosync.conf.5
+++ b/man/corosync.conf.5
@@ -1,988 +1,983 @@
 .\"/*
 .\" * Copyright (c) 2005 MontaVista Software, Inc.
 .\" * Copyright (c) 2006-2019 Red Hat, Inc.
 .\" *
 .\" * All rights reserved.
 .\" *
 .\" * Author: Steven Dake (sdake@redhat.com)
 .\" *
 .\" * This software licensed under BSD license, the text of which follows:
 .\" *
 .\" * Redistribution and use in source and binary forms, with or without
 .\" * modification, are permitted provided that the following conditions are met:
 .\" *
 .\" * - Redistributions of source code must retain the above copyright notice,
 .\" *   this list of conditions and the following disclaimer.
 .\" * - Redistributions in binary form must reproduce the above copyright notice,
 .\" *   this list of conditions and the following disclaimer in the documentation
 .\" *   and/or other materials provided with the distribution.
 .\" * - Neither the name of the MontaVista Software, Inc. nor the names of its
 .\" *   contributors may be used to endorse or promote products derived from this
 .\" *   software without specific prior written permission.
 .\" *
 .\" * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 .\" * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 .\" * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 .\" * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
 .\" * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 .\" * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 .\" * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 .\" * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 .\" * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 .\" * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
 .\" * THE POSSIBILITY OF SUCH DAMAGE.
 .\" */
 .TH COROSYNC_CONF 5 2019-05-24 "corosync Man Page" "Corosync Cluster Engine Programmer's Manual"
 .SH NAME
 corosync.conf - corosync executive configuration file
 
 .SH SYNOPSIS
 /etc/corosync/corosync.conf
 
 .SH DESCRIPTION
 The corosync.conf instructs the corosync executive about various parameters
 needed to control the corosync executive.  Empty lines and lines starting with
 # character are ignored.  The configuration file consists of bracketed top level
 directives.  The possible directive choices are:
 
 .TP
 totem { }
 This top level directive contains configuration options for the totem protocol.
 .TP
 logging { }
 This top level directive contains configuration options for logging.
 .TP
 quorum { }
 This top level directive contains configuration options for quorum.
 .TP
 nodelist { }
 This top level directive contains configuration options for nodes in cluster.
 .TP
 system { }
 This top level directive contains configuration options related to system.
 .TP
 resources { }
 This top level directive contains configuration options for resources.
 .TP
 nozzle { }
 This top level directive contains configuration options for a libnozzle device.
 
 .PP
 The
 .B interface sub-directive of totem is optional for UDP and knet transports.
 
 For knet, multiple interface subsections define parameters for each knet link on the
 system.
 
 For UDPU an interface section is not needed and it is recommended that the nodelist
 is used to define cluster nodes.
 
 .TP
 linknumber
 This specifies the link number for the interface.  When using the knet
 protocol, each interface should specify separate link numbers to uniquely
 identify to the membership protocol which interface to use for which link.
 The linknumber must start at 0. For UDP the only supported linknumber is 0.
 
 .TP
 knet_link_priority
 This specifies the priority for the link when knet is used in 'passive'
 mode. (see link_mode below)
 
 .TP
 knet_ping_interval
 This specifies the interval between knet link pings.
 knet_ping_interval and knet_ping_timeout
 are a pair, if one is specified the other should be too, otherwise one will be calculated from
 the token timeout and one will be taken from the config file.
 (default is token timeout / (knet_pong_count*2))
 
 .TP
 knet_ping_timeout
 If no ping is received within this time, the knet link is declared dead.
 knet_ping_interval and knet_ping_timeout
 are a pair, if one is specified the other should be too, otherwise one will be calculated from
 the token timeout and one will be taken from the config file.
 (default is token timeout / knet_pong_count)
 
 .TP
 knet_ping_precision
 How many values of latency are used to calculate
 the average link latency. (default 2048 samples)
 
 .TP
 knet_pong_count
 How many valid ping/pongs before a link is marked UP. (default 5)
 .TP
 
 knet_transport
 Which IP transport knet should use. valid values are "sctp" or "udp". (default: udp)
 
 .TP
 bindnetaddr (udp only)
 This specifies the network address the corosync executive should bind
 to when using udp.
 
 bindnetaddr (udp only)
 should be an IP address configured on the system, or a network
 address.
 
 For example, if the local interface is 192.168.5.92 with netmask
 255.255.255.0, you should set bindnetaddr to 192.168.5.92 or 192.168.5.0.
 If the local interface is 192.168.5.92 with netmask 255.255.255.192,
 set bindnetaddr to 192.168.5.92 or 192.168.5.64, and so forth.
 
 This may also be an IPV6 address, in which case IPV6 networking will be used.
 In this case, the exact address must be specified and there is no automatic
 selection of the network interface within a specific subnet as with IPv4.
 
 If IPv6 networking is used, the nodeid field in nodelist must be specified.
 
 .TP
 broadcast (udp only)
 This is optional and can be set to yes.  If it is set to yes, the broadcast
 address will be used for communication.  If this option is set, mcastaddr
 should not be set.
 
 .TP
 mcastaddr (udp only)
 This is the multicast address used by corosync executive.  The default
 should work for most networks, but the network administrator should be queried
 about a multicast address to use.  Avoid 224.x.x.x because this is a "config"
 multicast address.
 
 This may also be an IPV6 multicast address, in which case IPV6 networking
 will be used.  If IPv6 networking is used, the nodeid field in nodelist must
 be specified.
 
 It's not necessary to use this option if cluster_name option is used. If both options
 are used, mcastaddr has higher priority.
 
 .TP
 mcastport (udp only)
 This specifies the UDP port number.  It is possible to use the same multicast
 address on a network with the corosync services configured for different
 UDP ports.
 Please note corosync uses two UDP ports mcastport (for mcast receives) and
 mcastport - 1 (for mcast sends).
 If you have multiple clusters on the same network using the same mcastaddr
 please configure the mcastports with a gap.
 
 .TP
 ttl (udp only)
 This specifies the Time To Live (TTL). If you run your cluster on a routed
 network then the default of "1" will be too small. This option provides
 a way to increase this up to 255. The valid range is 0..255.
 
 .PP
 .PP
 Within the
 .B totem
 directive, there are seven configuration options of which one is required,
 five are optional, and one is required when IPV6 is configured in the interface
 subdirective.  The required directive controls the version of the totem
 configuration.  The optional option unless using IPV6 directive controls
 identification of the processor.  The optional options control secrecy and
 authentication, the network mode of operation and maximum network MTU
 field.
 
 .TP
 version
 This specifies the version of the configuration file.  Currently the only
 valid version for this directive is 2.
 
 .PP
 clear_node_high_bit
 This configuration option is optional and is only relevant when no nodeid is
 specified.  Some corosync clients require a signed 32 bit nodeid that is greater
 than zero however by default corosync uses all 32 bits of the IPv4 address space
 when generating a nodeid.  Set this option to yes to force the high bit to be
 zero and therefore ensure the nodeid is a positive signed 32 bit integer.
 
 WARNING: Cluster behavior is undefined if this option is enabled on only
 a subset of the cluster (for example during a rolling upgrade).
 
 .TP
 crypto_model
 This specifies which cryptographic library should be used by knet. Options
 are nss and openssl.
 
 The default is nss.
 
 .TP
 crypto_hash
 This specifies which HMAC authentication should be used to authenticate all
 messages. Valid values are none (no authentication), md5, sha1, sha256,
 sha384 and sha512. Encrypted transmission is only supported for
 the knet transport.
 
 The default is none.
 
 .TP
 crypto_cipher
 This specifies which cipher should be used to encrypt all messages.
 Valid values are none (no encryption), aes256, aes192 and aes128.
 Enabling crypto_cipher, requires also enabling of crypto_hash. Encrypted
 transmission is only supported for the knet transport.
 
 The default is none.
 
 .TP
 secauth
 This implies crypto_cipher=aes256 and crypto_hash=sha256, unless those options
 are explicitly set. Encrypted transmission is only supported for the knet
 transport.
 
 The default is off.
 
 .TP
 keyfile
 This specifies the fully qualified path to the shared key used to
 authenticate and encrypt data used within the Totem protocol.
 
 The default is /etc/corosync/authkey.
 
 .TP
 key
 Shared key stored in configuration instead of authkey file. This option
 has lower precedence than keyfile option so it's
 used only when keyfile is not specified.
 Using this option is not recommended for security reasons.
 
 .TP
 link_mode
 This specifies the Kronosnet mode, which may be passive, active, or
 rr (round-robin).
 .B passive:
 the active link with the lowest priority will be used. If one or more
 links share the same priority the one with the lowest link ID will
 be used.
 .B active:
 All active links will be used simultaneously to send traffic.
 link priority is ignored.
 .B rr:
 Round-Robin policy. Each packet will be sent to the next active link in
 order.
 
 If only one interface directive is specified, passive is automatically chosen.
 
 The maximum number of interface directives that is allowed with Kronosnet
 is 8. For other transports it is 1.
 
 .TP
 netmtu
 This specifies the network maximum transmit unit.  To set this value beyond
 1500, the regular frame MTU, requires ethernet devices that support large, or
 also called jumbo, frames.  If any device in the network doesn't support large
 frames, the protocol will not operate properly.  The hosts must also have their
 mtu size set from 1500 to whatever frame size is specified here.
 
 Please note while some NICs or switches claim large frame support, they support
 9000 MTU as the maximum frame size including the IP header.  Setting the netmtu
 and host MTUs to 9000 will cause totem to use the full 9000 bytes of the frame.
 Then Linux will add a 18 byte header moving the full frame size to 9018.  As a
 result some hardware will not operate properly with this size of data.  A netmtu
 of 8982 seems to work for the few large frame devices that have been tested.
 Some manufacturers claim large frame support when in fact they support frame
 sizes of 4500 bytes.
 
 When sending multicast traffic, if the network frequently reconfigures, chances are
 that some device in the network doesn't support large frames.
 
 Choose hardware carefully if intending to use large frame support.
 
 The default is 1500.
 
 .TP
 transport
 This directive controls the transport mechanism used.
 The default is knet.  The transport type can also be set to udpu or udp.
 Only knet allows crypto or multiple interfaces per node.
 
 .TP
 cluster_name
 This specifies the name of cluster and it's used for automatic generating
 of multicast address.
 
 .TP
 config_version
 This specifies version of config file. This is converted to unsigned 64-bit int.
 By default it's 0. Option is used to prevent joining old nodes with not
 up-to-date configuration. If value is not 0, and node is going for first time
 (only for first time, join after split doesn't follow this rules)
 from single-node membership to multiple nodes membership, other nodes
 config_versions are collected. If current node config_version is not
 equal to highest of collected versions, corosync is terminated.
 
 .TP
 ip_version
 This specifies version of IP to ask DNS resolver for.
 The value can be one of
 .B ipv4
 (look only for an IPv4 address)
 ,
 .B ipv6
 (check only IPv6 address)
 ,
 .B ipv4-6
 (look for all address families and use first IPv4 address found in the list if there is such address,
 otherwise use first IPv6 address) and
 .B ipv6-4
 (look for all address families and use first IPv6 address found in the list if there is such address,
 otherwise use first IPv4 address).
 
 Default (if unspecified) is
 .B ipv6-4
 for knet and udpu transports and
 .B ipv4
 for udp.
 
 The knet transport supports IPv4 and IPv6 addresses concurrently,
 provided they are consistent on each link.
 
 Within the
 .B totem
 directive, there are several configuration options which are used to control
 the operation of the protocol.  It is generally not recommended to change any
 of these values without proper guidance and sufficient testing.  Some networks
 may require larger values if suffering from frequent reconfigurations.  Some
 applications may require faster failure detection times which can be achieved
 by reducing the token timeout.
 
 .TP
 token
 This timeout is used directly or as a base for real token timeout calculation (explained in
 .B token_coefficient
 section). Token timeout specifies in milliseconds until a token loss is declared after not
 receiving a token.  This is the time spent detecting a failure of a processor
 in the current configuration.  Reforming a new configuration takes about 50
 milliseconds in addition to this timeout.
 
 For real token timeout used by totem it's possible to read cmap value of
 .B runtime.config.totem.token
 key.
 
 Be careful to use the same timeout values on each of the nodes in the cluster
 or unpredictable results may occur.
 
 The default is 1000 milliseconds.
 
 .TP
 token_warning
 Specifies the interval between warnings that the token has not been received.  The
 value is a percentage of the token timeout and can be set to 0 to disable
 warnings.
 
 The default is 75%.
 
 .TP
 token_coefficient
 This value is used only when
 .B nodelist
 section is specified and contains at least 3 nodes. If so, real token timeout
 is then computed as token + (number_of_nodes - 2) * token_coefficient.
 This allows cluster to scale without manually changing token timeout
 every time new node is added. This value can be set to 0 resulting
 in effective removal of this feature.
 
 The default is 650 milliseconds.
 
 .TP
 token_retransmit
 This timeout specifies in milliseconds after how long before receiving a token
 the token is retransmitted.  This will be automatically calculated if token
 is modified.  It is not recommended to alter this value without guidance from
 the corosync community.
 
 The minimum is 30 milliseconds. If not set and error occur, make sure
 token / (token_retransmits_before_loss_const + 0.2) is more than 30.
 
 The default is 238 milliseconds for two nodes cluster. Three or more nodes reference
 .B token_coefficient.
 
 .TP
 knet_compression_model
 The (optional) type of compression used by Kronosnet. The values available depend on
 the build and also avaialable libraries. Typically zlib and lz4 will be available
 but bzip2 and others could also be allowed. The default is 'none'
 
 .TP
 knet_compression_threshold
 Tells knet to NOT compress any packets that are smaller than the value
 indicated. Default 100 bytes.
 
 Set to 0 to reset to the default.
 Set to 1 to compress everything.
 
 .TP
 knet_compression_level
 Many compression libraries allow tuning of compression parameters. For example
 0 or 1 ... 9 are commonly used to determine the level of compression. This value
 is passed unmodified to the compression library so it is recommended to consult
 the library's documentation for more detailed information.
 
 .TP
 hold
 This timeout specifies in milliseconds how long the token should be held by
 the representative when the protocol is under low utilization.   It is not
 recommended to alter this value without guidance from the corosync community.
 
 The default is 180 milliseconds.
 
 .TP
 token_retransmits_before_loss_const
 This value identifies how many token retransmits should be attempted before
 forming a new configuration.  If this value is set, retransmit and hold will
 be automatically calculated from retransmits_before_loss and token.
 
 The default is 4 retransmissions.
 
 .TP
 join
 This timeout specifies in milliseconds how long to wait for join messages in
 the membership protocol.
 
 The default is 50 milliseconds.
 
 .TP
 send_join
 This timeout specifies in milliseconds an upper range between 0 and send_join
 to wait before sending a join message.  For configurations with less than
 32 nodes, this parameter is not necessary.  For larger rings, this parameter
 is necessary to ensure the NIC is not overflowed with join messages on
 formation of a new ring.  A reasonable value for large rings (128 nodes) would
 be 80msec.  Other timer values must also change if this value is changed.  Seek
 advice from the corosync mailing list if trying to run larger configurations.
 
 The default is 0 milliseconds.
 
 .TP
 consensus
 This timeout specifies in milliseconds how long to wait for consensus to be
 achieved before starting a new round of membership configuration.  The minimum
 value for consensus must be 1.2 * token.  This value will be automatically
 calculated at 1.2 * token if the user doesn't specify a consensus value.
 
 For two node clusters, a consensus larger than the join timeout but less than
 token is safe.  For three node or larger clusters, consensus should be larger
 than token.  There is an increasing risk of odd membership changes, which still
 guarantee virtual synchrony,  as node count grows if consensus is less than
 token.
 
 The default is 1200 milliseconds.
 
 .TP
 merge
 This timeout specifies in milliseconds how long to wait before checking for
 a partition when no multicast traffic is being sent.  If multicast traffic
 is being sent, the merge detection happens automatically as a function of
 the protocol.
 
 The default is 200 milliseconds.
 
 .TP
 downcheck
 This timeout specifies in milliseconds how long to wait before checking
 that a network interface is back up after it has been downed.
 
 The default is 1000 milliseconds.
 
 .TP
 fail_recv_const
 This constant specifies how many rotations of the token without receiving any
 of the messages when messages should be received may occur before a new
 configuration is formed.
 
 The default is 2500 failures to receive a message.
 
 .TP
 seqno_unchanged_const
 This constant specifies how many rotations of the token without any multicast
 traffic should occur before the hold timer is started.
 
 The default is 30 rotations.
 
 .TP
 heartbeat_failures_allowed
 [HeartBeating mechanism]
 Configures the optional HeartBeating mechanism for faster failure detection. Keep in
 mind that engaging this mechanism in lossy networks could cause faulty loss declaration
 as the mechanism relies on the network for heartbeating.
 
 So as a rule of thumb use this mechanism if you require improved failure in low to
 medium utilized networks.
 
 This constant specifies the number of heartbeat failures the system should tolerate
 before declaring heartbeat failure e.g 3. Also if this value is not set or is 0 then the
 heartbeat mechanism is not engaged in the system and token rotation is the method
 of failure detection
 
 The default is 0 (disabled).
 
 .TP
 max_network_delay
 [HeartBeating mechanism]
 This constant specifies in milliseconds the approximate delay that your network takes
 to transport one packet from one machine to another. This value is to be set by system
 engineers and please don't change if not sure as this effects the failure detection
 mechanism using heartbeat.
 
 The default is 50 milliseconds.
 
 .TP
 window_size
 This constant specifies the maximum number of messages that may be sent on one
 token rotation.  If all processors perform equally well, this value could be
 large (300), which would introduce higher latency from origination to delivery
 for very large rings.  To reduce latency in large rings(16+), the defaults are
 a safe compromise.  If 1 or more slow processor(s) are present among fast
 processors, window_size should be no larger than 256000 / netmtu to avoid
 overflow of the kernel receive buffers.  The user is notified of this by
 the display of a retransmit list in the notification logs.  There is no loss
 of data, but performance is reduced when these errors occur.
 
 The default is 50 messages.
 
 .TP
 max_messages
 This constant specifies the maximum number of messages that may be sent by one
 processor on receipt of the token.  The max_messages parameter is limited to
 256000 / netmtu to prevent overflow of the kernel transmit buffers.
 
 The default is 17 messages.
 
 .TP
 miss_count_const
 This constant defines the maximum number of times on receipt of a token
 a message is checked for retransmission before a retransmission occurs.  This
 parameter is useful to modify for switches that delay multicast packets
 compared to unicast packets.  The default setting works well for nearly all
 modern switches.
 
 The default is 5 messages.
 
 .TP
 knet_pmtud_interval
 How often the knet PMTUd runs to look for network MTU changes.
 Value in seconds, default: 30
 
-.TP
-knet_enable_access_lists
-Allow knet to drop packets from IP addresses that are not known to corosync.
-Value is 0 (off) and 1 (on). Default: 0.
-
 .TP
 block_unlisted_ips
-Allow UDPU to drop packets from IP addresses that are not known
+Allow UDPU and KNET to drop packets from IP addresses that are not known
 (nodes which don't exist in the nodelist) to corosync.
 Value is yes or no.
 
 The default value is yes.
 
 .PP
 Within the
 .B logging
 directive, there are several configuration options which are all optional.
 
 .PP
 The following 3 options are valid only for the top level logging directive:
 
 .TP
 timestamp
 This specifies that a timestamp is placed on all log messages. It can be one
 of off (no timestamp), on (second precision timestamp) or
 hires (millisecond precision timestamp - only when supported by LibQB).
 
 The default is hires (or on if hires is not supported).
 
 .TP
 fileline
 This specifies that file and line should be printed.
 
 The default is off.
 
 .TP
 function_name
 This specifies that the code function name should be printed.
 
 The default is off.
 
 .TP
 blackbox
 This specifies that blackbox functionality should be enabled.
 
 The default is on.
 
 .PP
 The following options are valid both for top level logging directive
 and they can be overridden in logger_subsys entries.
 
 .TP
 to_stderr
 .TP
 to_logfile
 .TP
 to_syslog
 These specify the destination of logging output. Any combination of
 these options may be specified. Valid options are
 .B yes
 and
 .B no.
 
 The default is syslog and stderr.
 
 Please note, if you are using to_logfile and want to rotate the file, use logrotate(8)
 with the option
 .B
 copytruncate.
 eg.
 .ne 18
 .RS
 .nf
 .ft CW
 /var/log/corosync.log {
 	missingok
 	compress
 	notifempty
 	daily
 	rotate 7
 	copytruncate
 }
 .ft
 .fi
 .RE
 
 .TP
 logfile
 If the
 .B to_logfile
 directive is set to
 .B yes
 , this option specifies the pathname of the log file.
 
 No default.
 
 .TP
 logfile_priority
 This specifies the logfile priority for this particular subsystem. Ignored if debug is on.
 Possible values are: alert, crit, debug (same as debug = on), emerg, err, info, notice, warning.
 
 The default is: info.
 
 .TP
 syslog_facility
 This specifies the syslog facility type that will be used for any messages
 sent to syslog. options are daemon, local0, local1, local2, local3, local4,
 local5, local6 & local7.
 
 The default is daemon.
 
 .TP
 syslog_priority
 This specifies the syslog level for this particular subsystem. Ignored if debug is on.
 Possible values are: alert, crit, debug (same as debug = on), emerg, err, info, notice, warning.
 
 The default is: info.
 
 .TP
 debug
 This specifies whether debug output is logged for this particular logger. Also can contain
 value trace, what is highest level of debug information.
 
 The default is off.
 
 .PP
 Within the
 .B logging
 directive, logger_subsys directives are optional.
 
 .PP
 Within the
 .B logger_subsys
 sub-directive, all of the above logging configuration options are valid and
 can be used to override the default settings.
 The subsys entry, described below, is mandatory to identify the subsystem.
 
 .TP
 subsys
 This specifies the subsystem identity (name) for which logging is specified. This is the
 name used by a service in the log_init() call. E.g. 'CPG'. This directive is
 required.
 
 .PP
 Within the
 .B quorum
 directive it is possible to specify the quorum algorithm to use with the
 
 .TP
 provider
 directive. At the time of writing only corosync_votequorum is supported.
 See votequorum(5) for configuration options.
 
 .PP
 Within the
 .B nodelist
 directive it is possible to specify specific information about nodes in cluster. Directive
 can contain only
 .B node
 sub-directive, which specifies every node that should be a member of the membership, and where
 non-default options are needed. Every node must have at least ring0_addr field filled.
 
 Every node that should be a member of the membership must be specified.
 
 Possible options are:
 .TP
 ringX_addr
 This specifies IP or network hostname address of the particular node.
 X is a link number.
 
 .TP
 nodeid
 This configuration option is required for each node for Kronosnet mode.
 It is a 32 bit value specifying the node identifier delivered to the
 cluster membership service. The node identifier value of zero is
 reserved and should not be used. If knet is set, this field must be set.
 
 .TP
 name
 This option is used mainly with knet transport to identify local node.
 It's also used by client software (pacemaker).
 Algorithm for identifying local node is following:
 .RS
 .IP 1.
 Looks up $HOSTNAME in the nodelist
 .IP 2.
 If this fails strip the domain name from $HOSTNAME and looks up
 that in the nodelist
 .IP 3.
 If this fails look in the nodelist for a fully-qualified name whose
 short version matches the short version of $HOSTNAME
 .IP 4.
 If all this fails then search the interfaces list for an address that
 matches a name in the nodelist
 .RE
 
 .PP
 Within the
 .B system
 directive it is possible to specify system options.
 
 Possible options are:
 .TP
 qb_ipc_type
 This specifies type of IPC to use. Can be one of native (default), shm and socket.
 Native means one of shm or socket, depending on what is supported by OS. On systems
 with support for both, SHM is selected. SHM is generally faster, but need to allocate
 ring buffer file in /dev/shm.
 
 .TP
 sched_rr
 Should be set to yes (default) if corosync should try to set round robin realtime
 scheduling with maximal priority to itself. When setting of scheduler fails, fallback to set
 maximal priority.
 
 .TP
 priority
 Set priority of corosync process. Valid only when sched_rr is set to no.
 Can be ether numeric value with similar meaning as
 .BR nice (1)
 or
 .B max
 /
 .B min
 meaning maximal / minimal priority (so minimal / maximal nice value).
 
 .TP
 move_to_root_cgroup
 Should be set to yes (default) if corosync should try to move itself to root
 cgroup. This feature is available only for systems with cgroups with RT
 sched enabled (Linux with CONFIG_RT_GROUP_SCHED kernel option).
 
 .TP
 state_dir
 Existing directory where corosync should chdir into. Corosync stores
 important state files and blackboxes there.
 
 The default is /var/lib/corosync.
 
 .PP
 Within the
 .B resources
 directive it is possible to specify options for resources.
 
 Possible option is:
 .TP
 watchdog_device
 (Valid only if Corosync was compiled with watchdog support.)
 .br
 Watchdog device to use, for example /dev/watchdog.
 If unset, empty or "off", no watchdog is used.
 .IP
 In a cluster with properly configured power fencing a watchdog
 provides no additional value.  On the other hand, slow watchdog
 communication may incur multi-second delays in the Corosync main loop,
 potentially breaking down membership.  IPMI watchdogs are particularly
 notorious in this regard: read about kipmid_max_busy_us in IPMI.txt in
 the Linux kernel documentation.
 
 
 .PP
 Within the
 .B nozzle
 directive it is possible to specify options for a libnozzle device. This is a pseudo
 ethernet device that routes network traffic through a channel on the corosync knet network
 (NOT cpg or any corosync internal service) to other nodes in the cluster. This allows
 applications to take advantage of knet features such as multipathing, automatic failover,
 link switching etc. Note that libnozzle is not a reliable transport, but you can tunnel TCP
 through it for reliable communications.
 .br
 libnozzle also supports optional interface up/down scripts that are kept under a
 /etc/corosync/updown.d/ directory. See the knet documentation for more information.
 .br
 Only one nozzle device is allowed.
 .br
 The nozzle stanza takes several options:
 .TP
 name
 The name of the network device to be created. On Linux this may be any name at all, other
 platforms have restrictions on the name.
 .TP
 ipaddr
 The IP address (IPv6 or IPv4) of the interface. The bottom part of this address will be replaced
 by the local node's nodeid in conjunction with ipprefix. so, eg
 ipaddr: 192.168.1.0
 ipprefix: 24
 will make nodeids 1,2,5 use IP addresses 192.168.1.1, 192.168.1.2 & 192.168.1.5.
 If a prefix length of 16 is used then the bottom two bytes will be filled in with nodeid numbers.
 IPv6 addresses must end in '::', the nodeid will be added after the two colons to make the
 local IP address.
 Only one IP address is currently supported in the corosync.conf file. Additional IP addresses
 can be added in the ifup script if necessary.
 .TP
 ipprefix
 specifies the IP address prefix for the nozzle device (see above)
 .TP
 macaddr
 Specifies the MAC address prefix for the nozzle device. As for the IP address, the bottom part
 of the MAC address will be filled in with the node id. In this case no prefix applies, the bottom
 two bytes of the MAC address will always be overwritten with the node id. So specifying
 macaddr: 54:54:12:24:12:12 on nodeid 1 will result in it having a MAC address of 54:54:12:24:00:01
 
 .SH "TO ADD A NEW NODE TO THE CLUSTER"
 For example to add a node with address 10.24.38.108 with nodeid 3. The node has the name NEW
 (in DNS or /etc/hosts) and is not currently running corosync. The current corosync.conf nodelist
 looks like this:
 .PP
 .nf
 .RS
 nodelist {
     node {
         nodeid: 1
         ring0_addr: 10.24.38.101
         name: node1
     }
     node {
         nodeid: 2
         ring0_addr: 10.24.38.102
         name: node2
 
     }
 }
 .RE
 .fi
 .PP
 Add a new entry for the node below the existing nodes. Node entries don't have
 to be in nodeid order, but it will help keep you sane. So the nodelist now looks like this:
 .PP
 .nf
 .RS
 nodelist {
     node {
         nodeid: 1
         ring0_addr: 10.24.38.101
         name: node1
     }
     node {
         nodeid: 2
         ring0_addr: 10.24.38.102
         name: node2
 
     }
     node {
         nodeid: 3
         ring0_addr: 10.24.38.108
         name: NEW
 
     }
 }
 .RE
 .fi
 .PP
 
 .PP
 This file must then be copied onto all three nodes -  the existing two nodes, and the new one.
 On one of the existing corosync nodes, tell corosync to re-read the updated config file into memory:
 .PP
 .nf
 .RS
 corosync-cfgtool -R
 .RE
 .fi
 .PP
 This command only needs to be run on one node in the cluster. You may then start corosync on the NEW node
 and it should join the cluster. If this doesn't work as expected then check the communications between all
 three nodes is working, and check the syslog files on all nodes for more information. It's important to note
 that the key bit of information about a node failing to join might be on a different node than you expect.
 
 .SH "TO REMOVE A NODE FROM THE CLUSTER"
 This is the reverse procedure to 'Adding a node' above. First you need to shut down the node you will
 be removing from the cluster.
 .PP
 .nf
 .RS
 corosync-cfgtool -H
 .RE
 .fi
 
 
 .PP
 Then delete the nodelist stanza from corosync.conf and finally update corosync on the remaining nodes by
 running
 .PP
 .nf
 .RS
 corosync-cfgtool -R
 .RE
 .fi
 .TP
 on one of them.
 
 .SH "ADDRESS RESOLUTION"
 corosync resolves ringX_addr names/IP addresses using the getaddrinfo(3) call with respect
 of totem.ip_version setting.
 
 getaddrinfo() function uses a sophisticated algorithm to sort node addresses into a preferred
 order and corosync always chooses the first address in that list of the required family.
 As such it is essential that your DNS or /etc/hosts files are correctly configured so that
 all addresses for ringX appear on the same network (or are reachable with minimal hops)
 and over the same IP protocol. If this is not the case then some nodes might not be able
 to join the cluster. It is possible to override the search order used
 by getaddrinfo() using the configuration file /etc/gai.conf(5) if necessary,
 but this is not recommended.
 
 If there is any doubt about the order of addresses returned from getaddrinfo() then it might be simpler to use
 IP addresses (v4 or v6) in the ringX_addr field.
 
 .SH "FILES"
 .TP
 /etc/corosync/corosync.conf
 The corosync executive configuration file.
 
 .SH "SEE ALSO"
 .BR corosync_overview (7),
 .BR votequorum (5),
 .BR corosync-qdevice (8),
 .BR logrotate (8)
 .BR getaddrinfo (3)
 .BR gai.conf (5)
 .PP