diff --git a/kronosnetd/vty_cli_cmds.c b/kronosnetd/vty_cli_cmds.c
index 098c082b..944729c4 100644
--- a/kronosnetd/vty_cli_cmds.c
+++ b/kronosnetd/vty_cli_cmds.c
@@ -1,1701 +1,1703 @@
 #include "config.h"
 
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <fcntl.h>
 #include <unistd.h>
 #include <limits.h>
 #include <stdio.h>
 #include <stdlib.h>
 
 #include "cfg.h"
 #include "logging.h"
 #include "libtap.h"
 #include "netutils.h"
 #include "vty.h"
 #include "vty_cli.h"
 #include "vty_cli_cmds.h"
 #include "vty_utils.h"
 
 #define KNET_VTY_MAX_MATCHES    64
 #define KNET_VTY_MATCH_HELP      0
 #define KNET_VTY_MATCH_EXEC      1
 #define KNET_VTY_MATCH_EXPAND    2
 
 #define CMDS_PARAM_NOMORE        0
 #define CMDS_PARAM_KNET          1
 #define CMDS_PARAM_IP            2
 #define CMDS_PARAM_IP_PREFIX     3
 #define CMDS_PARAM_IP_PORT       4
 #define CMDS_PARAM_BOOL          5
 #define CMDS_PARAM_INT           6
 #define CMDS_PARAM_NODEID        7
 #define CMDS_PARAM_NAME          8
 #define CMDS_PARAM_MTU           9
 #define CMDS_PARAM_CRYPTO_MODEL 10
 #define CMDS_PARAM_CRYPTO_TYPE  11
 #define CMDS_PARAM_HASH_TYPE    12
 
 /*
  * CLI helper functions - menu/node stuff starts below
  */
 
 
 /*
  * return 0 if we find a command in vty->line and cmd/len/no are set
  * return -1 if we cannot find a command. no can be trusted. cmd/len would be empty
  */
 
 static int get_command(struct knet_vty *vty, char **cmd, int *cmdlen, int *cmdoffset, int *no)
 {
 	int start = 0, idx;
 
 	for (idx = 0; idx < vty->line_idx; idx++) {
 		if (vty->line[idx] != ' ')
 			break;
 	}
 
 	if (!strncmp(&vty->line[idx], "no ", 3)) {
 		*no = 1;
 		idx = idx + 3;
 
 		for (idx = idx; idx < vty->line_idx; idx++) {
 			if (vty->line[idx] != ' ')
 				break;
 		}
 	} else {
 		*no = 0;
 	}
 
 	start = idx;
 	if (start == vty->line_idx)
 		return -1;
 
 	*cmd = &vty->line[start];
 	*cmdoffset = start;
 
 	for (idx = start; idx < vty->line_idx; idx++) {
 		if (vty->line[idx] == ' ')
 			break;
 	}
 
 	*cmdlen = idx - start;
 
 	return 0;
 }
 
 /*
  * still not sure why I need to count backwards...
  */
 static void get_n_word_from_end(struct knet_vty *vty, int n,
 					char **word, int *wlen, int *woffset)
 {
 	int widx;
 	int idx, end, start;
 
 	start = end = vty->line_idx;
 
 	for (widx = 0; widx < n; widx++) {
 		for (idx = start - 1; idx > 0; idx--) {
 			if (vty->line[idx] != ' ')
 				break;
 		}
 		end = idx;
 		for (idx = end; idx > 0; idx--) {
 			if (vty->line[idx-1] == ' ')
 				break;
 		}
 		start = idx;
 	}
 
 	*wlen = (end - start) + 1;
 	*word = &vty->line[start];
 	*woffset = start;
 }
 
 static int expected_params(const vty_param_t *params)
 {
 	int idx = 0;
 
 	while(params[idx].param != CMDS_PARAM_NOMORE)
 		idx++;
 
 	return idx;
 }
 
 static int count_words(struct knet_vty *vty,
 			 int offset)
 {
 	int idx, widx = 0;
 	int status = 0;
 
 	for (idx = offset; idx < vty->line_idx; idx++) {
 		if (vty->line[idx] == ' ') {
 			status = 0;
 			continue;
 		}
 		if ((vty->line[idx] != ' ') && (!status)) {
 			widx++;
 			status = 1;
 			continue;
 		}
 	}
 	return widx;
 }
 
 static int param_to_int(const char *param, int paramlen)
 {
 	char buf[KNET_VTY_MAX_LINE];
 
 	memset(buf, 0, sizeof(buf));
 	memcpy(buf, param, paramlen);
 	return atoi(buf);
 }
 
 static int param_to_str(char *buf, int bufsize, const char *param, int paramlen)
 {
 	if (bufsize < paramlen)
 		return -1;
 
 	memset(buf, 0, bufsize);
 	memcpy(buf, param, paramlen);
 	return paramlen;
 }
 
 static const vty_node_cmds_t *get_cmds(struct knet_vty *vty, char **cmd, int *cmdlen, int *cmdoffset)
 {
 	int no;
 	const vty_node_cmds_t *cmds =  knet_vty_nodes[vty->node].cmds;
 
 	get_command(vty, cmd, cmdlen, cmdoffset, &no);
 
 	if (no)
 		cmds = knet_vty_nodes[vty->node].no_cmds;
 
 	return cmds;
 }
 
 static int check_param(struct knet_vty *vty, const int paramtype, char *param, int paramlen)
 {
 	int err = 0;
 	char buf[KNET_VTY_MAX_LINE];
 	int tmp;
 
 	memset(buf, 0, sizeof(buf));
 
 	switch(paramtype) {
 		case CMDS_PARAM_NOMORE:
 			break;
 		case CMDS_PARAM_KNET:
 			if (paramlen >= IFNAMSIZ) {
 				knet_vty_write(vty, "interface name too long%s", telnet_newline);
 				err = -1;
 			}
 			break;
 		case CMDS_PARAM_IP:
 			break;
 		case CMDS_PARAM_IP_PREFIX:
 			break;
 		case CMDS_PARAM_IP_PORT:
 			tmp = param_to_int(param, paramlen);
 			if ((tmp < 0) || (tmp > 65279)) {
 				knet_vty_write(vty, "port number must be a value between 0 and 65279%s", telnet_newline);
 				err = -1;
 			}
 			break;
 		case CMDS_PARAM_BOOL:
 			break;
 		case CMDS_PARAM_INT:
 			break;
 		case CMDS_PARAM_NODEID:
 			tmp = param_to_int(param, paramlen);
 			if ((tmp < 0) || (tmp > 255)) {
 				knet_vty_write(vty, "node id must be a value between 0 and 255%s", telnet_newline);
 				err = -1;
 			}
 			break;
 		case CMDS_PARAM_NAME:
 			if (paramlen >= KNET_MAX_HOST_LEN) {
 				knet_vty_write(vty, "name cannot exceed %d char in len%s", KNET_MAX_HOST_LEN - 1, telnet_newline);
 			}
 			break;
 		case CMDS_PARAM_MTU:
 			tmp = param_to_int(param, paramlen);
 			if ((tmp < 576) || (tmp > 65536)) {
 				knet_vty_write(vty, "mtu should be a value between 576 and 65536 (note: max value depends on the media)%s", telnet_newline);
 				err = -1;
 			}
 			break;
 		case CMDS_PARAM_CRYPTO_MODEL:
 			param_to_str(buf, KNET_VTY_MAX_LINE, param, paramlen);
 			if (!strncmp("none", buf, 4))
 				break;
 			if (!strncmp("nss", buf, 3))
 				break;
 			knet_vty_write(vty, "unknown encryption model: %s. Supported: none/nss%s", param, telnet_newline);
 			err = -1;
 			break;
 		case CMDS_PARAM_CRYPTO_TYPE:
 			param_to_str(buf, KNET_VTY_MAX_LINE, param, paramlen);
 			if (!strncmp("none", buf, 4))
 				break;
 			if (!strncmp("aes256", buf, 6))
 				break;
 			if (!strncmp("aes192", buf, 6))
 				break;
 			if (!strncmp("aes128", buf, 6))
 				break;
-			knet_vty_write(vty, "unknown encryption method: %s. Supported: none/aes256/aes192/aes128%s", param, telnet_newline);
+			if (!strncmp("3des", buf, 4))
+				break;
+			knet_vty_write(vty, "unknown encryption method: %s. Supported: none/aes256/aes192/aes128/3des%s", param, telnet_newline);
 			err = -1;
 			break;
 		case CMDS_PARAM_HASH_TYPE:
 			param_to_str(buf, KNET_VTY_MAX_LINE, param, paramlen);
 			if (!strncmp("none", buf, 4))
 				break;
 			if (!strncmp("md5", buf, 3))
 				break;
 			if (!strncmp("sha1", buf, 4))
 				break;
 			if (!strncmp("sha256", buf, 6))
 				break;
 			if (!strncmp("sha384", buf, 6))
 				break;
 			if (!strncmp("sha512", buf, 6))
 				break;
 			knet_vty_write(vty, "unknown hash method: %s. Supported none/md5/sha1/sha256/sha384/sha512%s", param, telnet_newline);
 			err = -1;
 			break;
 		default:
 			knet_vty_write(vty, "CLI ERROR: unknown parameter type%s", telnet_newline);
 			err = -1;
 			break;
 	}
 	return err;
 }
 
 static void describe_param(struct knet_vty *vty, const int paramtype)
 {
 	switch(paramtype) {
 		case CMDS_PARAM_NOMORE:
 			knet_vty_write(vty, "no more parameters%s", telnet_newline);
 			break;
 		case CMDS_PARAM_KNET:
 			knet_vty_write(vty, "KNET_IFACE_NAME - interface name (max %d chars) eg: kronosnet0%s", IFNAMSIZ, telnet_newline);
 			break;
 		case CMDS_PARAM_IP:
 			knet_vty_write(vty, "IP address - ipv4 or ipv6 address to add/remove%s", telnet_newline);
 			break;
 		case CMDS_PARAM_IP_PREFIX:
 			knet_vty_write(vty, "IP prefix len (eg. 24, 64)%s", telnet_newline);
 			break;
 		case CMDS_PARAM_IP_PORT:
 			knet_vty_write(vty, "base port (eg: %d) %s", KNET_RING_DEFPORT, telnet_newline);
 		case CMDS_PARAM_BOOL:
 			break;
 		case CMDS_PARAM_INT:
 			break;
 		case CMDS_PARAM_NODEID:
 			knet_vty_write(vty, "NODEID - unique identifier for this interface in this kronos network (value between 0 and 255)%s", telnet_newline);
 			break;
 		case CMDS_PARAM_NAME:
 			knet_vty_write(vty, "NAME - unique name identifier for this entity (max %d chars)%s", KNET_MAX_HOST_LEN - 1, telnet_newline);
 			break;
 		case CMDS_PARAM_MTU:
 			knet_vty_write(vty, "MTU - a value between 576 and 65536 (note: max value depends on the media)%s", telnet_newline);
 			break;
 		case CMDS_PARAM_CRYPTO_MODEL:
 			knet_vty_write(vty, "MODEL - define encryption backend: none or nss%s", telnet_newline);
 			break;
 		case CMDS_PARAM_CRYPTO_TYPE:
 			knet_vty_write(vty, "CRYPTO - define packets encryption method: none or aes256%s", telnet_newline);
 			break;
 		case CMDS_PARAM_HASH_TYPE:
 			knet_vty_write(vty, "HASH - define packets hashing method: none/md5/sha1/sha256/sha384/sha512%s", telnet_newline);
 			break;
 		default: /* this should never happen */
 			knet_vty_write(vty, "CLI ERROR: unknown parameter type%s", telnet_newline);
 			break;
 	}
 }
 
 static void print_help(struct knet_vty *vty, const vty_node_cmds_t *cmds, int idx)
 {
 	if ((idx < 0) || (cmds == NULL) || (cmds[idx].cmd == NULL))
 		return;
 
 	if (cmds[idx].help != NULL) {
 		knet_vty_write(vty, "%s\t%s%s",
 			cmds[idx].cmd,
 			cmds[idx].help,
 			telnet_newline);
 	} else {
 		knet_vty_write(vty, "%s\tNo help available for this command%s",
 			cmds[idx].cmd,
 			telnet_newline);
 	}
 }
 
 static int get_param(struct knet_vty *vty, int wanted_paranum,
 			      char **param, int *paramlen, int *paramoffset)
 {
 	int eparams, tparams;
 	const vty_param_t *params = (const vty_param_t *)vty->param;
 	int paramstart = vty->paramoffset;
 
 	eparams = expected_params(params);
 	tparams = count_words(vty, paramstart);
 
 	if (tparams > eparams)
 		return -1;
 
 	if (wanted_paranum == -1) {
 		get_n_word_from_end(vty, 1, param, paramlen, paramoffset);
 		return tparams;
 	}
 
 	if (tparams < wanted_paranum)
 		return -1;
 
 	get_n_word_from_end(vty, (tparams - wanted_paranum) + 1, param, paramlen, paramoffset);
 	return tparams - wanted_paranum;
 }
 
 
 static int match_command(struct knet_vty *vty, const vty_node_cmds_t *cmds,
 			 char *cmd, int cmdlen, int cmdoffset, int mode)
 {
 	int idx = 0, found = -1, paramoffset = 0, paramlen = 0, last_param = 0;
 	char *param = NULL;
 	int paramstart = cmdlen + cmdoffset;
 	int matches[KNET_VTY_MAX_MATCHES];
 
 	memset(&matches, -1, sizeof(matches));
 
 	while ((cmds[idx].cmd != NULL) && (idx < KNET_VTY_MAX_MATCHES)) {
 		if (!strncmp(cmds[idx].cmd, cmd, cmdlen)) {
 			found++;
 			matches[found] = idx;
 		}
 		idx++;
 	}
 
 	if (idx >= KNET_VTY_MAX_MATCHES) {
 		knet_vty_write(vty, "Too many matches for this command%s", telnet_newline);
 		return -1;
 	}
 
 	if (found < 0) {
 		knet_vty_write(vty, "There is no such command%s", telnet_newline);
 		return -1;
 	}
 
 	switch(mode) {
 		case KNET_VTY_MATCH_HELP:
 			if (found == 0) {
 				if ((cmdoffset <= vty->cursor_pos) && (vty->cursor_pos <= paramstart)) {
 					print_help(vty, cmds, matches[0]);
 					break;
 				}
 				if (cmds[matches[0]].params != NULL) {
 					vty->param = (void *)cmds[matches[0]].params;
 					vty->paramoffset = paramstart;
 					last_param = get_param(vty, -1, &param, &paramlen, &paramoffset);
 
 					if ((paramoffset <= vty->cursor_pos) && (vty->cursor_pos <= (paramoffset + paramlen)))
 						last_param--;
 
 					if (last_param >= CMDS_PARAM_NOMORE) {
 						describe_param(vty, cmds[matches[0]].params[last_param].param);
 						if (paramoffset > 0)
 							check_param(vty, cmds[matches[0]].params[last_param].param, param, paramlen);
 					}
 					break;
 				}
 			}
 			if (found >= 0) {
 				idx = 0;
 				while (matches[idx] >= 0) {
 					print_help(vty, cmds, matches[idx]);
 					idx++;
 				}
 			}
 			break;
 		case KNET_VTY_MATCH_EXEC:
 			if (found == 0) {
 				int exec = 0;
 				if (cmds[matches[0]].params != NULL) {
 					int eparams, tparams;
 
 					eparams = expected_params(cmds[matches[0]].params);
 					tparams = count_words(vty, paramstart);
 
 					if (eparams != tparams) {
 						exec = -1;
 						idx = 0;
 
 						knet_vty_write(vty, "Parameter required for this command:%s", telnet_newline);
 
 						while(cmds[matches[0]].params[idx].param != CMDS_PARAM_NOMORE) {
 							describe_param(vty, cmds[matches[0]].params[idx].param);
 							idx++;
 						}
 						break;
 					}
 
 					idx = 0;
 					vty->param = (void *)cmds[matches[0]].params;
 					vty->paramoffset = paramstart;
 					while(cmds[matches[0]].params[idx].param != CMDS_PARAM_NOMORE) {
 						get_param(vty, idx + 1, &param, &paramlen, &paramoffset);
 						if (check_param(vty, cmds[matches[0]].params[idx].param,
 								param, paramlen) < 0) {
 							exec = -1;
 							if (vty->filemode)
 								return -1;
 						}
 
 						idx++;
 					}
 				}
 				if (!exec) {
 					if (cmds[matches[0]].params != NULL) {
 						vty->param = (void *)cmds[matches[0]].params;
 						vty->paramoffset = paramstart;
 					}
 					if (cmds[matches[0]].func != NULL) {
 						return cmds[matches[0]].func(vty);
 					} else { /* this will eventually disappear */
 						knet_vty_write(vty, "no fn associated to this command%s", telnet_newline);
 					}
 				}
 			}
 			if (found > 0) {
 				knet_vty_write(vty, "Ambiguous command.%s", telnet_newline);
 			}
 			break;
 		case KNET_VTY_MATCH_EXPAND:
 			if (found == 0) {
 				int cmdreallen;
 
 				if (vty->cursor_pos > cmdoffset+cmdlen) /* complete param? */
 					break;
 
 				cmdreallen = strlen(cmds[matches[0]].cmd);
 				memset(vty->line + cmdoffset, 0, cmdlen);
 				memcpy(vty->line + cmdoffset, cmds[matches[0]].cmd, cmdreallen);
 				vty->line[cmdreallen + cmdoffset] = ' ';
 				vty->line_idx = cmdreallen + cmdoffset + 1;
 				vty->cursor_pos = cmdreallen + cmdoffset + 1;
 			}
 			if (found > 0) { /* add completion to string base root */
 				int count = 0;
 				idx = 0;
 				while (matches[idx] >= 0) {
 					knet_vty_write(vty, "%s\t\t", cmds[matches[idx]].cmd);
 					idx++;
 					count++;
 					if (count == 4) {
 						knet_vty_write(vty, "%s",telnet_newline);
 						count = 0;
 					}
 				}
 				knet_vty_write(vty, "%s",telnet_newline);
 			}
 			break;
 		default: /* this should never really happen */
 			log_info("Unknown match mode");
 			break;
 	}
 	return found;
 }
 
 /* forward declarations */
 
 /* common to almost all nodes */
 static int knet_cmd_logout(struct knet_vty *vty);
 static int knet_cmd_who(struct knet_vty *vty);
 static int knet_cmd_exit_node(struct knet_vty *vty);
 static int knet_cmd_help(struct knet_vty *vty);
 
 /* root node */
 static int knet_cmd_config(struct knet_vty *vty);
 
 /* config node */
 static int knet_cmd_interface(struct knet_vty *vty);
 static int knet_cmd_no_interface(struct knet_vty *vty);
 static int knet_cmd_show_conf(struct knet_vty *vty);
 static int knet_cmd_write_conf(struct knet_vty *vty);
 
 /* interface node */
 static int knet_cmd_mtu(struct knet_vty *vty);
 static int knet_cmd_no_mtu(struct knet_vty *vty);
 static int knet_cmd_ip(struct knet_vty *vty);
 static int knet_cmd_no_ip(struct knet_vty *vty);
 static int knet_cmd_baseport(struct knet_vty *vty);
 static int knet_cmd_peer(struct knet_vty *vty);
 static int knet_cmd_no_peer(struct knet_vty *vty);
 static int knet_cmd_start(struct knet_vty *vty);
 static int knet_cmd_stop(struct knet_vty *vty);
 static int knet_cmd_crypto(struct knet_vty *vty);
 
 /* peer node */
 static int knet_cmd_link(struct knet_vty *vty);
 static int knet_cmd_no_link(struct knet_vty *vty);
 
 /* root node description */
 vty_node_cmds_t root_cmds[] = {
 	{ "configure", "enter configuration mode", NULL, knet_cmd_config },
 	{ "exit", "exit from CLI", NULL, knet_cmd_logout },
 	{ "help", "display basic help", NULL, knet_cmd_help },
 	{ "logout", "exit from CLI", NULL, knet_cmd_logout },
 	{ "who", "display users connected to CLI", NULL, knet_cmd_who },
 	{ NULL, NULL, NULL, NULL },
 };
 
 /* config node description */
 vty_param_t no_int_params[] = {
 	{ CMDS_PARAM_KNET },
 	{ CMDS_PARAM_NOMORE },
 };
 
 vty_node_cmds_t no_config_cmds[] = {
 	{ "interface", "destroy kronosnet interface", no_int_params, knet_cmd_no_interface },
 	{ NULL, NULL, NULL, NULL },
 };
 
 vty_param_t int_params[] = {
 	{ CMDS_PARAM_KNET },
 	{ CMDS_PARAM_NODEID },
 	{ CMDS_PARAM_NOMORE },
 };
 
 vty_node_cmds_t config_cmds[] = {
 	{ "exit", "exit configuration mode", NULL, knet_cmd_exit_node },
 	{ "interface", "configure kronosnet interface", int_params, knet_cmd_interface },
 	{ "show", "show running config", NULL, knet_cmd_show_conf },
 	{ "help", "display basic help", NULL, knet_cmd_help },
 	{ "logout", "exit from CLI", NULL, knet_cmd_logout },
 	{ "no", "revert command", NULL, NULL },
 	{ "who", "display users connected to CLI", NULL, knet_cmd_who },
 	{ "write", "write current config to file", NULL, knet_cmd_write_conf },
 	{ NULL, NULL, NULL, NULL },
 };
 
 /* interface node description */
 
 vty_param_t ip_params[] = {
 	{ CMDS_PARAM_IP },
 	{ CMDS_PARAM_IP_PREFIX },
 	{ CMDS_PARAM_NOMORE },
 };
 
 vty_param_t peer_params[] = {
 	{ CMDS_PARAM_NAME },
 	{ CMDS_PARAM_NODEID },
 	{ CMDS_PARAM_NOMORE },
 };
 
 vty_node_cmds_t no_interface_cmds[] = {
 	{ "ip", "remove ip address", ip_params, knet_cmd_no_ip },
 	{ "mtu", "revert to default MTU", NULL, knet_cmd_no_mtu },
 	{ "peer", "remove peer from this interface", peer_params, knet_cmd_no_peer },
 	{ NULL, NULL, NULL, NULL },
 };
 
 vty_param_t mtu_params[] = {
 	{ CMDS_PARAM_MTU },
 	{ CMDS_PARAM_NOMORE },
 };
 
 vty_param_t baseport_params[] = {
 	{ CMDS_PARAM_IP_PORT },
 	{ CMDS_PARAM_NOMORE },
 };
 
 vty_param_t crypto_params[] = {
 	{ CMDS_PARAM_CRYPTO_MODEL },
 	{ CMDS_PARAM_CRYPTO_TYPE },
 	{ CMDS_PARAM_HASH_TYPE },
 	{ CMDS_PARAM_NOMORE },
 };
 
 vty_node_cmds_t interface_cmds[] = {
 	{ "baseport", "set base listening port for this interface", baseport_params, knet_cmd_baseport },
 	{ "crypto", "enable crypto/hmac", crypto_params, knet_cmd_crypto },
 	{ "exit", "exit configuration mode", NULL, knet_cmd_exit_node },
 	{ "help", "display basic help", NULL, knet_cmd_help },
 	{ "ip", "add ip address", ip_params, knet_cmd_ip },
 	{ "logout", "exit from CLI", NULL, knet_cmd_logout },
 	{ "mtu", "set mtu", mtu_params, knet_cmd_mtu },
 	{ "no", "revert command", NULL, NULL },
 	{ "peer", "add peer endpoint", peer_params, knet_cmd_peer },
 	{ "show", "show running config", NULL, knet_cmd_show_conf },
 	{ "start", "start forwarding engine", NULL, knet_cmd_start },
 	{ "stop", "stop forwarding engine", NULL, knet_cmd_stop },
 	{ "who", "display users connected to CLI", NULL, knet_cmd_who },
 	{ "write", "write current config to file", NULL, knet_cmd_write_conf },
 	{ NULL, NULL, NULL, NULL },
 };
 
 /* peer node description */
 
 vty_param_t link_params[] = {
 	{ CMDS_PARAM_IP },
 	{ CMDS_PARAM_NOMORE },
 };
 
 vty_node_cmds_t no_peer_cmds[] = {
 	{ "link", "remove peer endpoint", link_params, knet_cmd_no_link},
 	{ NULL, NULL, NULL, NULL },
 };
 
 vty_node_cmds_t peer_cmds[] = {
 	{ "exit", "exit configuration mode", NULL, knet_cmd_exit_node },
 	{ "help", "display basic help", NULL, knet_cmd_help },
 	{ "link", "add peer endpoint", link_params, knet_cmd_link },
 	{ "logout", "exit from CLI", NULL, knet_cmd_logout },
 	{ "no", "revert command", NULL, NULL },
 	{ "show", "show running config", NULL, knet_cmd_show_conf },
 	{ "who", "display users connected to CLI", NULL, knet_cmd_who },
 	{ "write", "write current config to file", NULL, knet_cmd_write_conf },
 	{ NULL, NULL, NULL, NULL },
 };
 
 /* link node description */
 
 vty_node_cmds_t link_cmds[] = {
 	{ "exit", "exit configuration mode", NULL, knet_cmd_exit_node },
 	{ "help", "display basic help", NULL, knet_cmd_help },
 	{ "logout", "exit from CLI", NULL, knet_cmd_logout },
 	{ "no", "revert command", NULL, NULL },
 	{ "show", "show running config", NULL, knet_cmd_show_conf },
 	{ "who", "display users connected to CLI", NULL, knet_cmd_who },
 	{ "write", "write current config to file", NULL, knet_cmd_write_conf },
 	{ NULL, NULL, NULL, NULL },
 };
 
 /* nodes */
 vty_nodes_t knet_vty_nodes[] = {
 	{ NODE_ROOT, "knet", root_cmds, NULL },
 	{ NODE_CONFIG, "config", config_cmds, no_config_cmds },
 	{ NODE_INTERFACE, "iface", interface_cmds, no_interface_cmds },
 	{ NODE_PEER, "peer", peer_cmds, no_peer_cmds },
 	{ NODE_LINK, "link", link_cmds, NULL },
 	{ -1, NULL, NULL },
 };
 
 /* command execution */
 
 /* links */
 
 static int knet_cmd_no_link(struct knet_vty *vty)
 {
 	struct knet_cfg *knet_iface = (struct knet_cfg *)vty->iface;
 	struct knet_host *host = (struct knet_host *)vty->host;
 	int j, paramlen = 0, paramoffset = 0, found = 0;
 	char *param = NULL;
 	char ipaddr[KNET_MAX_HOST_LEN], port[6];
 
 	get_param(vty, 1, &param, &paramlen, &paramoffset);
 	param_to_str(ipaddr, KNET_MAX_HOST_LEN, param, paramlen);
 
 	memset(port, 0, sizeof(port));
 	snprintf(port, 6, "%d", knet_iface->cfg_ring.base_port + knet_iface->cfg_eth.node_id);
 
 	for (j = 0; j < KNET_MAX_LINK; j++) {
 		if (!strcmp(host->link[j].ipaddr, ipaddr)
 					&& !strcmp(host->link[j].port, port)) {
 			found = 1;
 			break;
 		}
 	}
 
 	if (!found) {
 		knet_vty_write(vty, "Error: unable to find link%s", telnet_newline);
 		return -1;
 	}
 
 	host->link[j].configured = 0;
 	if (knet_host_dst_cache_update(knet_iface->cfg_ring.knet_h, host->node_id))
 		knet_vty_write(vty, "Error: unable to update switching cache%s", telnet_newline);
 
 	return 0;
 }
 
 static int knet_cmd_link(struct knet_vty *vty)
 {
 	struct knet_cfg *knet_iface = (struct knet_cfg *)vty->iface;
 	struct knet_host *host = (struct knet_host *)vty->host;
 	struct knet_link *klink = NULL;
 	int j, paramlen = 0, paramoffset = 0, err = 0, found = 0;
 	char *param = NULL;
 	char ipaddr[KNET_MAX_HOST_LEN], port[6];
 
 	get_param(vty, 1, &param, &paramlen, &paramoffset);
 	param_to_str(ipaddr, KNET_MAX_HOST_LEN, param, paramlen);
 
 	memset(port, 0, sizeof(port));
 	snprintf(port, 6, "%d", knet_iface->cfg_ring.base_port + knet_iface->cfg_eth.node_id);
 
 	for (j = 0; j < KNET_MAX_LINK; j++) {
 		if ((klink == NULL) && (host->link[j].configured == 0)) {
 			klink = &host->link[j];
 		}
 		if (!strcmp(host->link[j].ipaddr, ipaddr)
 					&& !strcmp(host->link[j].port, port)) {
 			found = 1;
 			break;
 		}
 	}
 
 	if (!found) {
 		if (!klink) {
 			knet_vty_write(vty, "Error: all links are in use!%s", telnet_newline);
 			return -1;
 		}
 
 		memcpy(klink->ipaddr, ipaddr, strlen(ipaddr));
 		memcpy(klink->port, port, strlen(port));
 
 		if (strtoaddr(klink->ipaddr, klink->port, (struct sockaddr *)&klink->address, sizeof(klink->address)) != 0) {
 			knet_vty_write(vty, "Error: unable to convert ip addr to sockaddr!%s", telnet_newline);
 			err = -1;
 			goto out_clean;
 		}
 
 		klink->sock = host->listener->sock;
 
 		knet_link_timeout(klink, 1000, 5000, 2048);
 
 		klink->configured = 1;
 	}
 
 	vty->link = (void *)klink;
 	vty->node = NODE_LINK;
 
 out_clean:
 	return err;
 }
 
 static int knet_find_host(struct knet_vty *vty, struct knet_host **host,
 					const char *nodename, const uint16_t requested_node_id)
 {
 	struct knet_cfg *knet_iface = (struct knet_cfg *)vty->iface;
 	struct knet_host *head = NULL;
 	int err = 0;
 
 	*host = NULL;
 	if (knet_host_acquire(knet_iface->cfg_ring.knet_h, &head)) {
 		knet_vty_write(vty, "Error: unable to acquire lock on peer list!%s", telnet_newline);
 		return -1;
 	}
 
 	while (head != NULL) {
 		if (!strcmp(head->name, nodename)) {
 			if (head->node_id == requested_node_id) {
 				*host = head;
 				err = 1;
 				goto out_clean;
 			} else {
 				knet_vty_write(vty, "Error: requested peer exists with another nodeid%s", telnet_newline);
 				err = -1;
 				goto out_clean;
 			}
 		} else {
 			if (head->node_id == requested_node_id) {
 				knet_vty_write(vty, "Error: requested peer nodeid already exists%s", telnet_newline);
 				err = -1;
 				goto out_clean;
 			}
 		}
 		head = head->next;
 	}
 
 out_clean:
 	while (knet_host_release(knet_iface->cfg_ring.knet_h, &head) != 0) {
 		knet_vty_write(vty, "Error: unable to release lock on peer list!%s", telnet_newline);
 		sleep(1);
 	}
 
 	return err;
 }
 
 static int knet_cmd_no_peer(struct knet_vty *vty)
 {
 	struct knet_cfg *knet_iface = (struct knet_cfg *)vty->iface;
 	int paramlen = 0, paramoffset = 0, requested_node_id = 0, err = 0;
 	char *param = NULL;
 	struct knet_host *host = NULL;
 	char nodename[KNET_MAX_HOST_LEN];
 
 	get_param(vty, 1, &param, &paramlen, &paramoffset);
 	param_to_str(nodename, sizeof(nodename), param, paramlen);
 
 	get_param(vty, 2, &param, &paramlen, &paramoffset);
 	requested_node_id = param_to_int(param, paramlen);
 
 	if (requested_node_id == knet_iface->cfg_eth.node_id) {
 		knet_vty_write(vty, "Error: remote peer id cannot be the same as local id%s", telnet_newline);
 		return -1;
 	}
 
 	err = knet_find_host(vty, &host, nodename, requested_node_id);
 	if (err < 0)
 		goto out_clean;
 
 	if (err == 0) {
 		knet_vty_write(vty, "Error: peer not found in list%s", telnet_newline);
 		goto out_clean;
 	}
 
 	if (host->listener) {
 		if (knet_listener_remove(knet_iface->cfg_ring.knet_h, host->listener) == -EBUSY) {
 			knet_vty_write(vty, "Error: unable to remove listener from current peer%s", telnet_newline);
 			err = -1;
 			goto out_clean;
 		}
 	}
 
 	if (knet_host_remove(knet_iface->cfg_ring.knet_h, requested_node_id) < 0) {
 		knet_vty_write(vty, "Error: unable to remove peer from current config%s", telnet_newline);
 		err = -1;
 		goto out_clean;
 	}
 
 out_clean:
 	return err;
 }
 
 static int knet_cmd_peer(struct knet_vty *vty)
 {
 	struct knet_cfg *knet_iface = (struct knet_cfg *)vty->iface;
 	int paramlen = 0, paramoffset = 0, requested_node_id = 0, err = 0;
 	char *param = NULL;
 	struct knet_host *host, *temp = NULL;
 	struct knet_listener *listener = NULL;
 	char nodename[KNET_MAX_HOST_LEN];
 
 	get_param(vty, 1, &param, &paramlen, &paramoffset);
 	param_to_str(nodename, sizeof(nodename), param, paramlen);
 
 	get_param(vty, 2, &param, &paramlen, &paramoffset);
 	requested_node_id = param_to_int(param, paramlen);
 
 	if (requested_node_id == knet_iface->cfg_eth.node_id) {
 		knet_vty_write(vty, "Error: remote peer id cannot be the same as local id%s", telnet_newline);
 		return -1;
 	}
 
 	err = knet_find_host(vty, &host, nodename, requested_node_id);
 	if (err < 0)
 		goto out_clean;
 
 	if (err == 0) {
 		if (knet_host_add(knet_iface->cfg_ring.knet_h, requested_node_id) < 0) {
 			knet_vty_write(vty, "Error: unable to allocate memory for host struct!%s", telnet_newline);
 			err = -1;
 			goto out_clean;
 		}
 		knet_host_get(knet_iface->cfg_ring.knet_h, requested_node_id, &temp);
 		host = temp;
 		knet_host_release(knet_iface->cfg_ring.knet_h, &temp);
 		memcpy(host->name, nodename, strlen(nodename));
 
 		host->link_handler_policy = KNET_LINK_POLICY_PASSIVE;
 
 		listener = malloc(sizeof(struct knet_listener));
 		if (!listener) {
 			knet_vty_write(vty, "Error: unable to allocate memory for listener struct!%s", telnet_newline);
 			err = -1;
 			goto out_clean;
 		}
 		memset(listener, 0, sizeof(struct knet_listener));
 		snprintf(listener->ipaddr, KNET_MAX_HOST_LEN, "::");
 		snprintf(listener->port, 6, "%d", knet_iface->cfg_ring.base_port + requested_node_id);
 		if (strtoaddr(listener->ipaddr, listener->port, (struct sockaddr *)&listener->address, sizeof(listener->address)) != 0) {
 			knet_vty_write(vty, "Error: unable to convert ip addr to sockaddr!%s", telnet_newline);
 			err = -1;
 			goto out_clean;
 		}
 		if (knet_listener_add(knet_iface->cfg_ring.knet_h, listener) != 0) {
 			knet_vty_write(vty, "Error: unable to start listener!%s", telnet_newline);
 			err = -1;
 			goto out_clean;
 		}
 		host->listener = listener;
 	}
 
 	vty->host = (void *)host;
 	vty->node = NODE_PEER;
 
 out_clean:
 	if (err < 0) {
 		if (listener)
 			free(listener);
 		if (host)
 			knet_host_remove(knet_iface->cfg_ring.knet_h, host->node_id);
 	}
 
 	return err;
 }
 
 static int active_listeners(struct knet_vty *vty)
 {
 	struct knet_cfg *knet_iface = (struct knet_cfg *)vty->iface;
 	struct knet_host *head = NULL;
 	int listeners = 0;
 
 	if (knet_host_acquire(knet_iface->cfg_ring.knet_h, &head)) {
 		knet_vty_write(vty, "Error: unable to acquire lock on peer list!%s", telnet_newline);
 		return -1;
 	}
 
 	while (head != NULL) {
 		if (head->listener)
 			listeners++;
 		head = head->next;
 	}
 
 	while (knet_host_release(knet_iface->cfg_ring.knet_h, &head) != 0) {
 		knet_vty_write(vty, "Error: unable to release lock on peer list!%s", telnet_newline);
 		sleep(1);
 	}
 
 	return listeners;
 }
 
 static int knet_cmd_baseport(struct knet_vty *vty)
 {
 	struct knet_cfg *knet_iface = (struct knet_cfg *)vty->iface;
 	int paramlen = 0, paramoffset = 0, err = 0;
 	char *param = NULL;
 
 	get_param(vty, 1, &param, &paramlen, &paramoffset);
 
 	/* need to check if baseport is in use by other interfaces */
 	err = active_listeners(vty);
 	if (!err) {
 		knet_iface->cfg_ring.base_port = param_to_int(param, paramlen);
 	}
 	if (err > 0) {
 		knet_vty_write(vty, "Error: cannot switch baseport when listeners are active%s", telnet_newline);
 		err = -1;
 	}
 
 	return err;
 }
 
 static int knet_cmd_no_ip(struct knet_vty *vty)
 {
 	int paramlen = 0, paramoffset = 0;
 	char *param = NULL;
 	char ipaddr[KNET_MAX_HOST_LEN], prefix[4];
 	struct knet_cfg *knet_iface = (struct knet_cfg *)vty->iface;
 	char *error_string = NULL;
 
 	get_param(vty, 1, &param, &paramlen, &paramoffset);
 	param_to_str(ipaddr, sizeof(ipaddr), param, paramlen);
 
 	get_param(vty, 2, &param, &paramlen, &paramoffset);
 	param_to_str(prefix, sizeof(prefix), param, paramlen);
 
 	if (tap_del_ip(knet_iface->cfg_eth.tap, ipaddr, prefix, &error_string) < 0) {
 		knet_vty_write(vty, "Error: Unable to del ip addr %s/%s on device %s%s",
 				ipaddr, prefix, tap_get_name(knet_iface->cfg_eth.tap), telnet_newline);
 		if (error_string) {
 			knet_vty_write(vty, "(%s)%s", error_string, telnet_newline);
 			free(error_string);
 		}
 		return -1;
 	}
 
 	return 0;
 }
 
 static int knet_cmd_ip(struct knet_vty *vty)
 {
 	int paramlen = 0, paramoffset = 0;
 	char *param = NULL;
 	char ipaddr[512], prefix[4];
 	struct knet_cfg *knet_iface = (struct knet_cfg *)vty->iface;
 	char *error_string = NULL;
 
 	get_param(vty, 1, &param, &paramlen, &paramoffset);
 	param_to_str(ipaddr, sizeof(ipaddr), param, paramlen);
 
 	get_param(vty, 2, &param, &paramlen, &paramoffset);
 	param_to_str(prefix, sizeof(prefix), param, paramlen);
 
 	if (tap_add_ip(knet_iface->cfg_eth.tap, ipaddr, prefix, &error_string) < 0) {
 		knet_vty_write(vty, "Error: Unable to set ip addr %s/%s on device %s%s",
 				ipaddr, prefix, tap_get_name(knet_iface->cfg_eth.tap), telnet_newline);
 		if (error_string) {
 			knet_vty_write(vty, "(%s)%s", error_string, telnet_newline);
 			free(error_string);
 		}
 		return -1;
 	}
 
 	return 0;
 }
 
 static int knet_cmd_no_mtu(struct knet_vty *vty)
 {
 	struct knet_cfg *knet_iface = (struct knet_cfg *)vty->iface;
 
 	if (tap_reset_mtu(knet_iface->cfg_eth.tap) < 0) {
 		knet_vty_write(vty, "Error: Unable to set default mtu on device %s%s",
 				tap_get_name(knet_iface->cfg_eth.tap), telnet_newline);
 				return -1;
 	}
 
 	return 0;
 }
 
 static int knet_cmd_mtu(struct knet_vty *vty)
 {
 	struct knet_cfg *knet_iface = (struct knet_cfg *)vty->iface;
 	int paramlen = 0, paramoffset = 0, expected_mtu = 0;
 	char *param = NULL;
 
 	get_param(vty, 1, &param, &paramlen, &paramoffset);
 	expected_mtu = param_to_int(param, paramlen);
 
 	if (tap_set_mtu(knet_iface->cfg_eth.tap, expected_mtu) < 0) {
 		knet_vty_write(vty, "Error: Unable to set requested mtu %d on device %s%s",
 				expected_mtu, tap_get_name(knet_iface->cfg_eth.tap), telnet_newline);
 				return -1;
 	}
 
 	return 0;
 }
 
 static int knet_cmd_stop(struct knet_vty *vty)
 {
 	struct knet_cfg *knet_iface = (struct knet_cfg *)vty->iface;
 	char *error_down = NULL, *error_postdown = NULL;
 	int err = 0;
 
 	err = tap_set_down(knet_iface->cfg_eth.tap, &error_down, &error_postdown);
 	if (err < 0) {
 		knet_vty_write(vty, "Error: Unable to set interface %s down!%s", tap_get_name(knet_iface->cfg_eth.tap), telnet_newline);
 	} else {
 		knet_handle_setfwd(knet_iface->cfg_ring.knet_h, 0);
 		knet_iface->active = 0;
 	}
 	if (error_down) {
 		knet_vty_write(vty, "down script output:%s(%s)%s", telnet_newline, error_down, telnet_newline);
 		free(error_down);
 	}
 	if (error_postdown) {
 		knet_vty_write(vty, "post-down script output:%s(%s)%s", telnet_newline, error_postdown, telnet_newline);
 		free(error_postdown);
 	}
 
 	return err;
 }
 
 static int knet_cmd_crypto(struct knet_vty *vty)
 {
 	struct knet_cfg *knet_iface = (struct knet_cfg *)vty->iface;
 	int paramlen = 0, paramoffset = 0;
 	char *param = NULL;
 	int err = 0;
 
 	if (knet_iface->active) {
 		knet_vty_write(vty, "Error: Unable to activate encryption while interface is active%s", telnet_newline);
 		return -1;
 	}
 
 	get_param(vty, 1, &param, &paramlen, &paramoffset);
 	param_to_str(knet_iface->knet_handle_crypto_cfg.crypto_model,
 		     sizeof(knet_iface->knet_handle_crypto_cfg.crypto_model), param, paramlen);
 
 	get_param(vty, 2, &param, &paramlen, &paramoffset);
 	param_to_str(knet_iface->knet_handle_crypto_cfg.crypto_cipher_type,
 		     sizeof(knet_iface->knet_handle_crypto_cfg.crypto_cipher_type), param, paramlen);
 
 	get_param(vty, 3, &param, &paramlen, &paramoffset);
 	param_to_str(knet_iface->knet_handle_crypto_cfg.crypto_hash_type,
 		     sizeof(knet_iface->knet_handle_crypto_cfg.crypto_hash_type), param, paramlen);
 
 	if ((strncmp("none", knet_iface->knet_handle_crypto_cfg.crypto_cipher_type, 4)) ||
 	    (strncmp("none", knet_iface->knet_handle_crypto_cfg.crypto_hash_type, 4))) {
 		int fd = -1;
 		char keyfile[PATH_MAX];
 		struct stat sb;
 
 		memset(keyfile, 0, PATH_MAX);
 		snprintf(keyfile, PATH_MAX - 1, DEFAULT_CONFIG_DIR "/cryptokeys.d/%s", tap_get_name(knet_iface->cfg_eth.tap));
 
 		fd = open(keyfile, O_RDONLY);
 		if (fd < 0) {
 			knet_vty_write(vty, "Error: Unable to open security key: %s%s", keyfile, telnet_newline);
 			err = -1;
 			return -1;
 		}
 
 		if (fstat(fd, &sb)) {
 			knet_vty_write(vty, "Error: Unable to verify security key: %s%s", keyfile, telnet_newline);
 			goto key_error;
 		}
 
 		if (!S_ISREG(sb.st_mode)) {
 			knet_vty_write(vty, "Error: Key %s does not appear to be a regular file%s",
 				       keyfile, telnet_newline);
 			goto key_error;
 		}
 
 		knet_iface->knet_handle_crypto_cfg.private_key_len = (unsigned int)sb.st_size;
 		if ((knet_iface->knet_handle_crypto_cfg.private_key_len < KNET_MIN_KEY_LEN) ||
 		    (knet_iface->knet_handle_crypto_cfg.private_key_len > KNET_MAX_KEY_LEN)) {
 			knet_vty_write(vty, "Error: Key %s is %u long. Must be %u <= key_len <= %u%s",
 				       keyfile, knet_iface->knet_handle_crypto_cfg.private_key_len,
 				       KNET_MIN_KEY_LEN, KNET_MAX_KEY_LEN, telnet_newline);
 			goto key_error;
 		}
 
 		if (((sb.st_mode & S_IRWXU) != S_IRUSR) ||
 		    (sb.st_mode & S_IRWXG) ||
 		    (sb.st_mode & S_IRWXO)) {
 			knet_vty_write(vty, "Error: Key %s does not have the correct permission (must be user read-only)%s",
 				       keyfile, telnet_newline);
 			goto key_error;
 		}
 		if (read(fd,
 			 &knet_iface->knet_handle_crypto_cfg.private_key,
 			 knet_iface->knet_handle_crypto_cfg.private_key_len) != knet_iface->knet_handle_crypto_cfg.private_key_len) {
 			knet_vty_write(vty, "Error: Unable to read key %s%s", keyfile, telnet_newline);
 			goto key_error;
 		}
 
 		close(fd);
 		goto key_clean;
 
 key_error:
 		close(fd);
 		err = -1;
 	}
 key_clean:
 
 	if (!err) {
 		err = knet_handle_crypto(knet_iface->cfg_ring.knet_h,
 					 &knet_iface->knet_handle_crypto_cfg);
 	}
 
 	return err;
 }
 
 static int knet_cmd_start(struct knet_vty *vty)
 {
 	struct knet_cfg *knet_iface = (struct knet_cfg *)vty->iface;
 	char *error_preup = NULL, *error_up = NULL;
 	int err = 0;
 
 	err = tap_set_up(knet_iface->cfg_eth.tap, &error_preup, &error_up);
 	if (err < 0) {
 		knet_vty_write(vty, "Error: Unable to set interface %s up!%s", tap_get_name(knet_iface->cfg_eth.tap), telnet_newline);
 		knet_handle_setfwd(knet_iface->cfg_ring.knet_h, 0);
 	} else {
 		knet_handle_setfwd(knet_iface->cfg_ring.knet_h, 1);
 		knet_iface->active = 1;
 	}
 	if (error_preup) {
 		knet_vty_write(vty, "pre-up script output:%s(%s)%s", telnet_newline, error_preup, telnet_newline);
 		free(error_preup);
 	}
 	if (error_up) {
 		knet_vty_write(vty, "up script output:%s(%s)%s", telnet_newline, error_up, telnet_newline);
 		free(error_up);
 	}
 
 	return err;
 }
 
 static int knet_cmd_no_interface(struct knet_vty *vty)
 {
 	int err = 0, paramlen = 0, paramoffset = 0;
 	char *param = NULL;
 	char device[IFNAMSIZ];
 	struct knet_cfg *knet_iface = NULL;
 	struct knet_host *host;
 	char *ip_list = NULL;
 	int ip_list_entries = 0, i, offset = 0;
 	char *error_string = NULL;
 
 	get_param(vty, 1, &param, &paramlen, &paramoffset);
 	param_to_str(device, IFNAMSIZ, param, paramlen);
 
 	knet_iface = knet_get_iface(device, 0);
 	if (!knet_iface) {
 		knet_vty_write(vty, "Error: Unable to find requested interface%s", telnet_newline);
 		return -1;
 	}
 
 	vty->iface = (void *)knet_iface;
 
 	tap_get_ips(knet_iface->cfg_eth.tap, &ip_list, &ip_list_entries);
 	if ((ip_list) && (ip_list_entries > 0)) {
 		for (i = 1; i <= ip_list_entries; i++) {
 			tap_del_ip(knet_iface->cfg_eth.tap,
 					ip_list + offset,
 					ip_list + offset + strlen(ip_list + offset) + 1, &error_string);
 			if (error_string) {
 				free(error_string);
 				error_string = NULL;
 			}
 			offset = offset + strlen(ip_list) + 1;
 			offset = offset + strlen(ip_list + offset) + 1;
 		}
 		free(ip_list);
 		ip_list = NULL;
 		ip_list_entries = 0;
 	}
 
 	while (1) {
 		struct knet_host *head;
 
 		while (knet_host_acquire(knet_iface->cfg_ring.knet_h, &head) != 0) {
 			log_error("CLI ERROR: unable to acquire peer lock.. will retry in 1 sec"); 
 			sleep (1);
 		}
 
 		if (head == NULL)
 			break;
 
 		host = head;
 
 		while (knet_host_release(knet_iface->cfg_ring.knet_h, &head) != 0) {
 			log_error("CLI ERROR: unable to release peer lock.. will retry in 1 sec");
 			sleep (1);
 		}
 
 		for (i = 0; i < KNET_MAX_LINK; i++)
 			host->link[i].configured = 0;
 
 		knet_listener_remove(knet_iface->cfg_ring.knet_h, host->listener);
 
 		while (knet_host_remove(knet_iface->cfg_ring.knet_h, host->node_id) != 0) {
 			log_error("CLI ERROR: unable to release peer.. will retry in 1 sec");
 			sleep (1);
 		}
 	}
 
 	knet_cmd_stop(vty);
 
 	if (knet_iface->cfg_ring.knet_h)
 		knet_handle_free(knet_iface->cfg_ring.knet_h);
 
 	if (knet_iface->cfg_eth.tap)
 		tap_close(knet_iface->cfg_eth.tap);
 
 	if (knet_iface)
 		knet_destroy_iface(knet_iface);
 
 	return err;
 }
 
 static int knet_cmd_interface(struct knet_vty *vty)
 {
 	int err = 0, paramlen = 0, paramoffset = 0, found = 0, requested_id;
 	char *param = NULL;
 	char device[IFNAMSIZ];
 	char mac[18];
 	struct knet_cfg *knet_iface = NULL;
 	struct knet_handle_cfg knet_handle_cfg;
 
 	get_param(vty, 1, &param, &paramlen, &paramoffset);
 	param_to_str(device, IFNAMSIZ, param, paramlen);
 
 	get_param(vty, 2, &param, &paramlen, &paramoffset);
 	requested_id = param_to_int(param, paramlen);
 
 	knet_iface = knet_get_iface(device, 1);
 	if (!knet_iface) {
 		knet_vty_write(vty, "Error: Unable to allocate memory for config structures%s",
 				telnet_newline);
 		return -1;
 	}
 
 	if (knet_iface->cfg_eth.tap) {
 		found = 1;
 		goto tap_found;
 	}
 
 	if (!knet_iface->cfg_eth.tap)
 		knet_iface->cfg_eth.tap = tap_open(device, IFNAMSIZ, DEFAULT_CONFIG_DIR);
 
 	if ((!knet_iface->cfg_eth.tap) && (errno = EBUSY)) {
 		knet_vty_write(vty, "Error: interface %s seems to exist in the system%s",
 				device, telnet_newline);
 		err = -1;
 		goto out_clean;
 	}
 
 	if (!knet_iface->cfg_eth.tap) {
 		knet_vty_write(vty, "Error: Unable to create %s system tap device%s",
 				device, telnet_newline);
 		err = -1;
 		goto out_clean;
 	}
 tap_found:
 
 	if (knet_iface->cfg_ring.knet_h)
 		goto knet_found;
 
 	memset(&knet_handle_cfg, 0, sizeof(struct knet_handle_cfg));
 	knet_handle_cfg.fd = tap_get_fd(knet_iface->cfg_eth.tap);
 	knet_handle_cfg.node_id = requested_id;
 	knet_handle_cfg.dst_host_filter = KNET_DST_FILTER_ENABLE;
 	knet_handle_cfg.dst_host_filter_fn = ether_host_filter_fn;
 
 	knet_iface->cfg_ring.knet_h = knet_handle_new(&knet_handle_cfg);
 	if (!knet_iface->cfg_ring.knet_h) {
 		knet_vty_write(vty, "Error: Unable to create ring handle for device %s%s",
 				device, telnet_newline);
 		err = -1;
 		goto out_clean;
 	}
 
 knet_found:
 	if (found) {
 		if (requested_id == knet_iface->cfg_eth.node_id)
 			goto out_found;
 
 		knet_vty_write(vty, "Error: no interface %s with nodeid %d found%s",
 				device, requested_id, telnet_newline);
 		goto out_clean;
 
 	} else {
 		knet_iface->cfg_eth.node_id = requested_id;
 	}
 
 	memset(&mac, 0, sizeof(mac));
 	snprintf(mac, sizeof(mac) - 1, "54:54:0:0:0:%x", knet_iface->cfg_eth.node_id);
 	if (tap_set_mac(knet_iface->cfg_eth.tap, mac) < 0) {
 		knet_vty_write(vty, "Error: Unable to set mac address %s on device %s%s",
 				mac, device, telnet_newline); 
 		err = -1;
 		goto out_clean;
 	}
 
 out_found:
 
 	vty->node = NODE_INTERFACE;
 	vty->iface = (void *)knet_iface;
 
 out_clean:
 	if (err) {
 		if (knet_iface->cfg_ring.knet_h)
 			knet_handle_free(knet_iface->cfg_ring.knet_h);
 
 		if (knet_iface->cfg_eth.tap)
 			tap_close(knet_iface->cfg_eth.tap);
  
 		knet_destroy_iface(knet_iface);
 	}
 	return err;
 }
 
 static int knet_cmd_exit_node(struct knet_vty *vty)
 {
 	knet_vty_exit_node(vty);
 	return 0;
 }
 
 static int knet_cmd_print_conf(struct knet_vty *vty)
 {
 	int i;
 	struct knet_cfg *knet_iface = knet_cfg_head.knet_cfg;
 	struct knet_host *host = NULL;
 	const char *nl = telnet_newline;
 	char *ip_list = NULL;
 	int ip_list_entries = 0, offset = 0;
 
 	if (vty->filemode)
 		nl = file_newline;
 
 	knet_vty_write(vty, "configure%s", nl);
 
 	while (knet_iface != NULL) {
 		knet_vty_write(vty, " interface %s %u%s", tap_get_name(knet_iface->cfg_eth.tap),
 							  knet_iface->cfg_eth.node_id, nl);
 
 		knet_vty_write(vty, "  mtu %d%s", tap_get_mtu(knet_iface->cfg_eth.tap), nl);
 
 		tap_get_ips(knet_iface->cfg_eth.tap, &ip_list, &ip_list_entries);
 		if ((ip_list) && (ip_list_entries > 0)) {
 			for (i = 1; i <= ip_list_entries; i++) {
 				knet_vty_write(vty, "  ip %s %s%s", ip_list + offset, ip_list + offset + strlen(ip_list + offset) + 1, nl);
 				offset = offset + strlen(ip_list) + 1;
 				offset = offset + strlen(ip_list + offset) + 1;
 		}
 			free(ip_list);
 			ip_list = NULL;
 			ip_list_entries = 0;
 		}
 
 		knet_vty_write(vty, "  baseport %d%s", knet_iface->cfg_ring.base_port, nl);
 
 		knet_vty_write(vty, "  crypto %s %s %s%s",
 			       knet_iface->knet_handle_crypto_cfg.crypto_model,
 			       knet_iface->knet_handle_crypto_cfg.crypto_cipher_type,
 			       knet_iface->knet_handle_crypto_cfg.crypto_hash_type, nl);
 
 		while (knet_host_acquire(knet_iface->cfg_ring.knet_h, &host)) {
 			log_error("CLI ERROR: waiting for peer lock");
 			sleep(1);
 		}
 
 		while (host != NULL) {
 			knet_vty_write(vty, "  peer %s %u%s", host->name, host->node_id, nl);
 			for (i = 0; i < KNET_MAX_LINK; i++) {
 				if (host->link[i].configured == 1) {
 					knet_vty_write(vty, "   link %s%s", host->link[i].ipaddr, nl);
 					/* print link properties */
 					knet_vty_write(vty, "    exit%s", nl);
 				}
 			}
 			knet_vty_write(vty, "   exit%s", nl);
 			host = host->next;
 		}
 
 		while (knet_host_release(knet_iface->cfg_ring.knet_h, &host) != 0) {
 			log_error("CLI ERROR: unable to release peer lock.. will retry in 1 sec");
 			sleep(1);
 		}
 
 		if (knet_iface->active)
 			knet_vty_write(vty, "  start%s", nl);
 
 		knet_vty_write(vty, "  exit%s", nl);
 		knet_iface = knet_iface->next;
 	}
 
 	knet_vty_write(vty, " exit%sexit%s", nl, nl);
 
 	return 0;
 }
 
 static int knet_cmd_show_conf(struct knet_vty *vty)
 {
 	return knet_cmd_print_conf(vty);
 }
 
 static int knet_cmd_write_conf(struct knet_vty *vty)
 {
 	int fd = 1, vty_sock, err = 0, backup = 1;
 	char tempfile[PATH_MAX];
 
 	memset(tempfile, 0, sizeof(tempfile));
 
 	snprintf(tempfile, sizeof(tempfile), "%s.sav", knet_cfg_head.conffile);
 	err = rename(knet_cfg_head.conffile, tempfile);
 	if ((err < 0) && (errno != ENOENT)) {
 		knet_vty_write(vty, "Unable to create backup config file %s %s", tempfile, telnet_newline);
 		return -1;
 	}
 	if ((err < 0) && (errno == ENOENT))
 		backup = 0;
 
 	fd = open(knet_cfg_head.conffile,
 		  O_RDWR | O_CREAT | O_EXCL | O_TRUNC,
 		  S_IRUSR | S_IWUSR);
 	if (fd < 0) {
 		knet_vty_write(vty, "Error unable to open file%s", telnet_newline);
 		return -1;
 	}
 
 	vty_sock = vty->vty_sock;
 	vty->vty_sock = fd;
 	vty->filemode = 1;
 	knet_cmd_print_conf(vty);
 	vty->vty_sock = vty_sock;
 	vty->filemode = 0;
 
 	close(fd);
 
 	knet_vty_write(vty, "Configuration saved to %s%s", knet_cfg_head.conffile, telnet_newline);
 	if (backup)
 		knet_vty_write(vty, "Old configuration file has been stored in %s%s",
 				tempfile, telnet_newline);
 
 	return err;
 }
 
 static int knet_cmd_config(struct knet_vty *vty)
 {
 	int err = 0;
 
 	if (!vty->user_can_enable) {
 		knet_vty_write(vty, "Error: user %s does not have enough privileges to perform config operations%s", vty->username, telnet_newline);
 		return -1;
 	}
 
 	pthread_mutex_lock(&knet_vty_mutex);
 	if (knet_vty_config >= 0) {
 		knet_vty_write(vty, "Error: configuration is currently locked by user %s on vty(%d). Try again later%s", vty->username, knet_vty_config, telnet_newline);
 		err = -1;
 		goto out_clean;
 	}
 	vty->node = NODE_CONFIG;
 	knet_vty_config = vty->conn_num;
 out_clean:
 	pthread_mutex_unlock(&knet_vty_mutex);
 	return err;
 }
 
 static int knet_cmd_logout(struct knet_vty *vty)
 {
 	vty->got_epipe = 1;
 	return 0;
 }
 
 static int knet_cmd_who(struct knet_vty *vty)
 {
 	int conn_index;
 
 	pthread_mutex_lock(&knet_vty_mutex);
 
 	for(conn_index = 0; conn_index < KNET_VTY_TOTAL_MAX_CONN; conn_index++) {
 		if (knet_vtys[conn_index].active) {
 			knet_vty_write(vty, "User %s connected on vty(%d) from %s%s",
 				knet_vtys[conn_index].username,
 				knet_vtys[conn_index].conn_num,
 				knet_vtys[conn_index].ip,
 				telnet_newline);
 		}
 	}
 
 	pthread_mutex_unlock(&knet_vty_mutex);
 
 	return 0;
 }
 
 static int knet_cmd_help(struct knet_vty *vty)
 {
 	knet_vty_write(vty, PACKAGE " VTY provides advanced help feature.%s%s"
 			    "When you need help, anytime at the command line please press '?'.%s%s"
 			    "If nothing matches, the help list will be empty and you must backup%s"
 			    " until entering a '?' shows the available options.%s",
 			    telnet_newline, telnet_newline, telnet_newline, telnet_newline, 
 			    telnet_newline, telnet_newline);
 	return 0;
 }
 
 /* exported API to vty_cli.c */
 
 int knet_vty_execute_cmd(struct knet_vty *vty)
 {
 	const vty_node_cmds_t *cmds = NULL;
 	char *cmd = NULL;
 	int cmdlen = 0;
 	int cmdoffset = 0;
 
 	if (knet_vty_is_line_empty(vty))
 		return 0;
 
 	cmds = get_cmds(vty, &cmd, &cmdlen, &cmdoffset);
 
 	/* this will eventually disappear. keep it as safeguard for now */
 	if (cmds == NULL) {
 		knet_vty_write(vty, "No commands associated to this node%s", telnet_newline);
 		return 0;
 	}
 
 	return match_command(vty, cmds, cmd, cmdlen, cmdoffset, KNET_VTY_MATCH_EXEC);
 }
 
 int knet_read_conf(void)
 {
 	int err = 0, len = 0, line = 0;
 	struct knet_vty *vty = &knet_vtys[0];
 	FILE *file = NULL;
 
 	file = fopen(knet_cfg_head.conffile, "r");
 
 	if ((file == NULL) && (errno != ENOENT)) {
 		log_error("Unable to open config file for reading %s", knet_cfg_head.conffile);
 		return -1;
 	}
 
 	if ((file == NULL) && (errno == ENOENT)) {
 		log_info("Configuration file %s not found, starting with default empty config", knet_cfg_head.conffile);
 		return 0;
 	}
 
 	vty->vty_sock = 1;
 	vty->user_can_enable = 1;
 	vty->filemode = 1;
 
 	while(fgets(vty->line, sizeof(vty->line), file) != NULL) {
 		line++;
 		len = strlen(vty->line) - 1;
 		memset(&vty->line[len], 0, 1);
 		vty->line_idx = len;
 		err = knet_vty_execute_cmd(vty);
 		if (err != 0)  {
 			log_error("line[%d]: %s", line, vty->line);
 			break;
 		}
 	}
 
 	fclose(file);
 
 	memset(vty, 0, sizeof(vty));
 
 	return err;
 }
 
 void knet_vty_help(struct knet_vty *vty)
 {
 	int idx = 0;
 	const vty_node_cmds_t *cmds = NULL;
 	char *cmd = NULL;
 	int cmdlen = 0;
 	int cmdoffset = 0;
 
 	cmds = get_cmds(vty, &cmd, &cmdlen, &cmdoffset);
 
 	/* this will eventually disappear. keep it as safeguard for now */
 	if (cmds == NULL) {
 		knet_vty_write(vty, "No commands associated to this node%s", telnet_newline);
 		return;
 	}
 
 	if (knet_vty_is_line_empty(vty) || cmd == NULL) {
 		while (cmds[idx].cmd != NULL) {
 			print_help(vty, cmds, idx);
 			idx++;
 		}
 		return;
 	}
 
 	match_command(vty, cmds, cmd, cmdlen, cmdoffset, KNET_VTY_MATCH_HELP);
 }
 
 void knet_vty_tab_completion(struct knet_vty *vty)
 {
 	const vty_node_cmds_t *cmds = NULL;
 	char *cmd = NULL;
 	int cmdlen = 0;
 	int cmdoffset = 0;
 
 	if (knet_vty_is_line_empty(vty))
 		return;
 
 	knet_vty_write(vty, "%s", telnet_newline);
 
 	cmds = get_cmds(vty, &cmd, &cmdlen, &cmdoffset);
 
 	/* this will eventually disappear. keep it as safeguard for now */
 	if (cmds == NULL) {
 		knet_vty_write(vty, "No commands associated to this node%s", telnet_newline);
 		return;
 	}
 
 	match_command(vty, cmds, cmd, cmdlen, cmdoffset, KNET_VTY_MATCH_EXPAND);
 
 	knet_vty_prompt(vty);
 	knet_vty_write(vty, "%s", vty->line);
 }
diff --git a/libknet/nsscrypto.c b/libknet/nsscrypto.c
index 22783618..ed541944 100644
--- a/libknet/nsscrypto.c
+++ b/libknet/nsscrypto.c
@@ -1,636 +1,642 @@
 #include "config.h"
 
 #include <nss.h>
 #include <pk11pub.h>
 #include <pkcs11.h>
 #include <prerror.h>
 #include <blapit.h>
 #include <hasht.h>
 
 #include "crypto.h"
 #include "nsscrypto.h"
 #include "libknet-private.h"
 
 #ifdef CRYPTO_DEBUG
 #include <stdio.h>
 #define log_printf(format, args...) fprintf(stderr, format "\n", ##args);
 #else
 #define log_printf(format, args...);
 #endif
 
 /*
  * crypto definitions and conversion tables
  */
 
 #define SALT_SIZE 16
 #define KNET_DATABUFSIZE_CRYPT KNET_DATABUFSIZE * 2
 
 enum crypto_crypt_t {
 	CRYPTO_CIPHER_TYPE_NONE = 0,
 	CRYPTO_CIPHER_TYPE_AES256 = 1,
 	CRYPTO_CIPHER_TYPE_AES192 = 2,
-	CRYPTO_CIPHER_TYPE_AES128 = 3
+	CRYPTO_CIPHER_TYPE_AES128 = 3,
+	CRYPTO_CIPHER_TYPE_3DES = 4
 };
 
 CK_MECHANISM_TYPE cipher_to_nss[] = {
 	0,				/* CRYPTO_CIPHER_TYPE_NONE */
 	CKM_AES_CBC_PAD,		/* CRYPTO_CIPHER_TYPE_AES256 */
 	CKM_AES_CBC_PAD,		/* CRYPTO_CIPHER_TYPE_AES192 */
-	CKM_AES_CBC_PAD			/* CRYPTO_CIPHER_TYPE_AES128 */
+	CKM_AES_CBC_PAD,		/* CRYPTO_CIPHER_TYPE_AES128 */
+	CKM_DES3_CBC_PAD 		/* CRYPTO_CIPHER_TYPE_3DES */
 };
 
 size_t cipher_key_len[] = {
 	0,				/* CRYPTO_CIPHER_TYPE_NONE */
 	AES_256_KEY_LENGTH,		/* CRYPTO_CIPHER_TYPE_AES256 */
 	AES_192_KEY_LENGTH,		/* CRYPTO_CIPHER_TYPE_AES192 */
-	AES_128_KEY_LENGTH		/* CRYPTO_CIPHER_TYPE_AES128 */
+	AES_128_KEY_LENGTH,		/* CRYPTO_CIPHER_TYPE_AES128 */
+	16				/* CRYPTO_CIPHER_TYPE_3DES */
 };
 
 size_t cypher_block_len[] = {
 	0,				/* CRYPTO_CIPHER_TYPE_NONE */
 	AES_BLOCK_SIZE,			/* CRYPTO_CIPHER_TYPE_AES256 */
 	AES_BLOCK_SIZE,			/* CRYPTO_CIPHER_TYPE_AES192 */
-	AES_BLOCK_SIZE			/* CRYPTO_CIPHER_TYPE_AES128 */
+	AES_BLOCK_SIZE,			/* CRYPTO_CIPHER_TYPE_AES128 */
+	0				/* CRYPTO_CIPHER_TYPE_3DES */
 };
 
 /*
  * hash definitions and conversion tables
  */
 
 enum crypto_hash_t {
 	CRYPTO_HASH_TYPE_NONE	= 0,
 	CRYPTO_HASH_TYPE_MD5	= 1,
 	CRYPTO_HASH_TYPE_SHA1	= 2,
 	CRYPTO_HASH_TYPE_SHA256	= 3,
 	CRYPTO_HASH_TYPE_SHA384	= 4,
 	CRYPTO_HASH_TYPE_SHA512	= 5
 };
 
 CK_MECHANISM_TYPE hash_to_nss[] = {
 	 0,				/* CRYPTO_HASH_TYPE_NONE */
 	CKM_MD5_HMAC,			/* CRYPTO_HASH_TYPE_MD5 */
 	CKM_SHA_1_HMAC,			/* CRYPTO_HASH_TYPE_SHA1 */
 	CKM_SHA256_HMAC,		/* CRYPTO_HASH_TYPE_SHA256 */
 	CKM_SHA384_HMAC,		/* CRYPTO_HASH_TYPE_SHA384 */
 	CKM_SHA512_HMAC			/* CRYPTO_HASH_TYPE_SHA512 */
 };
 
 size_t hash_len[] = {
 	 0,				/* CRYPTO_HASH_TYPE_NONE */
 	MD5_LENGTH,			/* CRYPTO_HASH_TYPE_MD5 */
 	SHA1_LENGTH,			/* CRYPTO_HASH_TYPE_SHA1 */
 	SHA256_LENGTH,			/* CRYPTO_HASH_TYPE_SHA256 */
 	SHA384_LENGTH,			/* CRYPTO_HASH_TYPE_SHA384 */
 	SHA512_LENGTH			/* CRYPTO_HASH_TYPE_SHA512 */
 };
 
 size_t hash_block_len[] = {
 	 0,				/* CRYPTO_HASH_TYPE_NONE */
 	MD5_BLOCK_LENGTH,		/* CRYPTO_HASH_TYPE_MD5 */
 	SHA1_BLOCK_LENGTH,		/* CRYPTO_HASH_TYPE_SHA1 */
 	SHA256_BLOCK_LENGTH,		/* CRYPTO_HASH_TYPE_SHA256 */
 	SHA384_BLOCK_LENGTH,		/* CRYPTO_HASH_TYPE_SHA384 */
 	SHA512_BLOCK_LENGTH		/* CRYPTO_HASH_TYPE_SHA512 */
 };
 
 struct nsscrypto_instance {
 	PK11SymKey   *nss_sym_key;
 	PK11SymKey   *nss_sym_key_sign;
 
 	unsigned char *private_key;
 
 	unsigned int private_key_len;
 
 	int crypto_cipher_type;
 
 	int crypto_hash_type;
 };
 
 /*
  * crypt/decrypt functions
  */
 
 static int string_to_crypto_cipher_type(const char* crypto_cipher_type)
 {
 	if (strcmp(crypto_cipher_type, "none") == 0) {
 		return CRYPTO_CIPHER_TYPE_NONE;
 	} else if (strcmp(crypto_cipher_type, "aes256") == 0) {
 		return CRYPTO_CIPHER_TYPE_AES256;
 	} else if (strcmp(crypto_cipher_type, "aes192") == 0) {
 		return CRYPTO_CIPHER_TYPE_AES192;
 	} else if (strcmp(crypto_cipher_type, "aes128") == 0) {
 		return CRYPTO_CIPHER_TYPE_AES128;
+	} else if (strcmp(crypto_cipher_type, "3des") == 0) {
+		return CRYPTO_CIPHER_TYPE_3DES;
 	}
 	return -1;
 }
 
 static int init_nss_crypto(struct nsscrypto_instance *instance)
 {
 	PK11SlotInfo*	crypt_slot = NULL;
 	SECItem		crypt_param;
 
 	if (!cipher_to_nss[instance->crypto_cipher_type]) {
 		return 0;
 	}
 
 	crypt_param.type = siBuffer;
 	crypt_param.data = instance->private_key;
 	crypt_param.len = cipher_key_len[instance->crypto_cipher_type];
 
 	crypt_slot = PK11_GetBestSlot(cipher_to_nss[instance->crypto_cipher_type], NULL);
 	if (crypt_slot == NULL) {
 		log_printf("Unable to find security slot (err %d)",
 			   PR_GetError());
 		return -1;
 	}
 
 	instance->nss_sym_key = PK11_ImportSymKey(crypt_slot,
 						  cipher_to_nss[instance->crypto_cipher_type],
 						  PK11_OriginUnwrap, CKA_ENCRYPT|CKA_DECRYPT,
 						  &crypt_param, NULL);
 	if (instance->nss_sym_key == NULL) {
 		log_printf("Failure to import key into NSS (err %d)",
 			   PR_GetError());
 		return -1;
 	}
 
 	PK11_FreeSlot(crypt_slot);
 
 	return 0;
 }
 
 static int encrypt_nss(
 	struct nsscrypto_instance *instance,
 	const unsigned char *buf_in,
 	const ssize_t buf_in_len,
 	unsigned char *buf_out,
 	ssize_t *buf_out_len)
 {
 	PK11Context*	crypt_context = NULL;
 	SECItem		crypt_param;
 	SECItem		*nss_sec_param = NULL;
 	int		tmp1_outlen = 0;
 	unsigned int	tmp2_outlen = 0;
 	unsigned char	*salt = buf_out;
 	unsigned char	*data = buf_out + SALT_SIZE;
 	int		err = -1;
 
 	if (PK11_GenerateRandom (salt, SALT_SIZE) != SECSuccess) {
 		log_printf("Failure to generate a random number %d",
 			   PR_GetError());
 		goto out;
 	}
 
 	crypt_param.type = siBuffer;
 	crypt_param.data = salt;
 	crypt_param.len = SALT_SIZE;
 
 	nss_sec_param = PK11_ParamFromIV (cipher_to_nss[instance->crypto_cipher_type],
 					  &crypt_param);
 	if (nss_sec_param == NULL) {
 		log_printf("Failure to set up PKCS11 param (err %d)",
 			   PR_GetError());
 		goto out;
 	}
 
 	/*
 	 * Create cipher context for encryption
 	 */
 	crypt_context = PK11_CreateContextBySymKey (cipher_to_nss[instance->crypto_cipher_type],
 						    CKA_ENCRYPT,
 						    instance->nss_sym_key,
 						    nss_sec_param);
 	if (!crypt_context) {
 		log_printf("PK11_CreateContext failed (encrypt) crypt_type=%d (err %d)",
 			   (int)cipher_to_nss[instance->crypto_cipher_type],
 			   PR_GetError());
 		goto out;
 	}
 
 	if (PK11_CipherOp(crypt_context, data,
 			  &tmp1_outlen,
 			  KNET_DATABUFSIZE_CRYPT,
 			  (unsigned char *)buf_in, buf_in_len) != SECSuccess) {
 		log_printf("PK11_CipherOp failed (encrypt) crypt_type=%d (err %d)",
 			   (int)cipher_to_nss[instance->crypto_cipher_type],
 			   PR_GetError());
 		goto out;
 	}
 
 	if (PK11_DigestFinal(crypt_context, data + tmp1_outlen,
 			     &tmp2_outlen, KNET_DATABUFSIZE_CRYPT - tmp1_outlen) != SECSuccess) {
 		log_printf("PK11_DigestFinal failed (encrypt) crypt_type=%d (err %d)",
 			   (int)cipher_to_nss[instance->crypto_cipher_type],
 			   PR_GetError());
 		goto out;
 
 	}
 
 	*buf_out_len = tmp1_outlen + tmp2_outlen + SALT_SIZE;
 
 	err = 0;
 
 out:
 	if (crypt_context) {
 		PK11_DestroyContext(crypt_context, PR_TRUE);
 	}
 	if (nss_sec_param) {
 		SECITEM_FreeItem(nss_sec_param, PR_TRUE);
 	}
 	return err;
 }
 
 static int decrypt_nss (
 	struct nsscrypto_instance *instance,
 	unsigned char *buf,
 	ssize_t *buf_len)
 {
 	PK11Context*	decrypt_context = NULL;
 	SECItem		decrypt_param;
 	int		tmp1_outlen = 0;
 	unsigned int	tmp2_outlen = 0;
 	unsigned char	*salt = buf;
 	unsigned char	*data = salt + SALT_SIZE;
 	int		datalen = *buf_len - SALT_SIZE;
 	unsigned char	outbuf[KNET_DATABUFSIZE_CRYPT];
 	int		outbuf_len;
 	int		err = -1;
 
 	/* Create cipher context for decryption */
 	decrypt_param.type = siBuffer;
 	decrypt_param.data = salt;
 	decrypt_param.len = SALT_SIZE;
 
 	decrypt_context = PK11_CreateContextBySymKey(cipher_to_nss[instance->crypto_cipher_type],
 						     CKA_DECRYPT,
 						     instance->nss_sym_key, &decrypt_param);
 	if (!decrypt_context) {
 		log_printf("PK11_CreateContext (decrypt) failed (err %d)",
 			   PR_GetError());
 		goto out;
 	}
 
 	if (PK11_CipherOp(decrypt_context, outbuf, &tmp1_outlen,
 			  sizeof(outbuf), data, datalen) != SECSuccess) {
 		log_printf("PK11_CipherOp (decrypt) failed (err %d)",
 			   PR_GetError());
 		goto out;
 	}
 
 	if (PK11_DigestFinal(decrypt_context, outbuf + tmp1_outlen, &tmp2_outlen,
 			     sizeof(outbuf) - tmp1_outlen) != SECSuccess) {
 		log_printf("PK11_DigestFinal (decrypt) failed (err %d)",
 			   PR_GetError()); 
 		goto out;
 	}
 
 	outbuf_len = tmp1_outlen + tmp2_outlen;
 
 	memset(buf, 0, *buf_len);
 	memcpy(buf, outbuf, outbuf_len);
 
 	*buf_len = outbuf_len;
 
 	err = 0;
 
 out:
 	if (decrypt_context) {
 		PK11_DestroyContext(decrypt_context, PR_TRUE);
 	}
 
 	return err;
 }
 
 
 /*
  * hash/hmac/digest functions
  */
 
 static int string_to_crypto_hash_type(const char* crypto_hash_type)
 {
 	if (strcmp(crypto_hash_type, "none") == 0) {
 		return CRYPTO_HASH_TYPE_NONE;
 	} else if (strcmp(crypto_hash_type, "md5") == 0) {
 		return CRYPTO_HASH_TYPE_MD5;
 	} else if (strcmp(crypto_hash_type, "sha1") == 0) {
 		return CRYPTO_HASH_TYPE_SHA1;
 	} else if (strcmp(crypto_hash_type, "sha256") == 0) {
 		return CRYPTO_HASH_TYPE_SHA256;
 	} else if (strcmp(crypto_hash_type, "sha384") == 0) {
 		return CRYPTO_HASH_TYPE_SHA384;
 	} else if (strcmp(crypto_hash_type, "sha512") == 0) {
 		return CRYPTO_HASH_TYPE_SHA512;
 	}
 
 	return -1;
 }
 
 static int init_nss_hash(struct nsscrypto_instance *instance)
 {
 	PK11SlotInfo*	hash_slot = NULL;
 	SECItem		hash_param;
 
 	if (!hash_to_nss[instance->crypto_hash_type]) {
 		return 0;
 	}
 
 	hash_param.type = siBuffer;
 	hash_param.data = 0;
 	hash_param.len = 0;
 
 	hash_slot = PK11_GetBestSlot(hash_to_nss[instance->crypto_hash_type], NULL);
 	if (hash_slot == NULL) {
 		log_printf("Unable to find security slot (err %d)",
 			   PR_GetError());
 		return -1;
 	}
 
 	instance->nss_sym_key_sign = PK11_ImportSymKey(hash_slot,
 						       hash_to_nss[instance->crypto_hash_type],
 						       PK11_OriginUnwrap, CKA_SIGN,
 						       &hash_param, NULL);
 	if (instance->nss_sym_key_sign == NULL) {
 		log_printf("Failure to import key into NSS (err %d)",
 			   PR_GetError());
 		return -1;
 	}
 
 	PK11_FreeSlot(hash_slot);
 
 	return 0;
 }
 
 static int calculate_nss_hash(
 	struct nsscrypto_instance *instance,
 	const unsigned char *buf,
 	const size_t buf_len,
 	unsigned char *hash)
 {
 	PK11Context*	hash_context = NULL;
 	SECItem		hash_param;
 	unsigned int	hash_tmp_outlen = 0;
 	unsigned char	hash_block[hash_block_len[instance->crypto_hash_type]];
 	int		err = -1;
 
 	/* Now do the digest */
 	hash_param.type = siBuffer;
 	hash_param.data = 0;
 	hash_param.len = 0;
 
 	hash_context = PK11_CreateContextBySymKey(hash_to_nss[instance->crypto_hash_type],
 						 CKA_SIGN,
 						 instance->nss_sym_key_sign,
 						 &hash_param);
 
 	if (!hash_context) {
 		log_printf("PK11_CreateContext failed (hash) hash_type=%d (err %d)",
 			   (int)hash_to_nss[instance->crypto_hash_type],
 			   PR_GetError());
 		goto out;
 	}
 
 	if (PK11_DigestBegin(hash_context) != SECSuccess) {
 		log_printf("PK11_DigestBegin failed (hash) hash_type=%d (err %d)",
 			   (int)hash_to_nss[instance->crypto_hash_type],
 			   PR_GetError());
 		goto out;
 	}
 
 	if (PK11_DigestOp(hash_context,
 			  buf,
 			  buf_len) != SECSuccess) {
 		log_printf("PK11_DigestOp failed (hash) hash_type=%d (err %d)",
 			   (int)hash_to_nss[instance->crypto_hash_type],
 			   PR_GetError());
 		goto out;
 	}
 
 	if (PK11_DigestFinal(hash_context,
 			     hash_block,
 			     &hash_tmp_outlen,
 			     hash_block_len[instance->crypto_hash_type]) != SECSuccess) {
 		log_printf("PK11_DigestFinale failed (hash) hash_type=%d (err %d)",
 			   (int)hash_to_nss[instance->crypto_hash_type],
 			   PR_GetError());
 		goto out;
 	}
 
 	memcpy(hash, hash_block, hash_len[instance->crypto_hash_type]);
 	err = 0;
 
 out:
 	if (hash_context) {
 		PK11_DestroyContext(hash_context, PR_TRUE);
 	}
 
 	return err;
 }
 
 /*
  * global/glue nss functions
  */
 
 static int init_nss_db(struct nsscrypto_instance *instance)
 {
 	if ((!cipher_to_nss[instance->crypto_cipher_type]) &&
 	    (!hash_to_nss[instance->crypto_hash_type])) {
 		return 0;
 	}
 
 	if (NSS_NoDB_Init(".") != SECSuccess) {
 		log_printf("NSS DB initialization failed (err %d)",
 			   PR_GetError());
 		return -1;
 	}
 
 	return 0;
 }
 
 static int init_nss(struct nsscrypto_instance *instance)
 {
 	if (init_nss_db(instance) < 0) {
 		return -1;
 	}
 
 	if (init_nss_crypto(instance) < 0) {
 		return -1;
 	}
 
 	if (init_nss_hash(instance) < 0) {
 		return -1;
 	}
 
 	return 0;
 }
 
 /*
  * exported API
  */
 
 int nsscrypto_encrypt_and_sign (
 	void *model_instance,
 	const unsigned char *buf_in,
 	const ssize_t buf_in_len,
 	unsigned char *buf_out,
 	ssize_t *buf_out_len)
 {
 	struct nsscrypto_instance *instance = model_instance;
 
 	if (cipher_to_nss[instance->crypto_cipher_type]) {
 		if (encrypt_nss(instance, buf_in, buf_in_len, buf_out, buf_out_len) < 0) {
 			return -1;
 		}
 	} else {
 		memcpy(buf_out, buf_in, buf_in_len);
 		*buf_out_len = buf_in_len;
 	}
 
 	if (hash_to_nss[instance->crypto_hash_type]) {
 		if (calculate_nss_hash(instance, buf_out, *buf_out_len, buf_out + *buf_out_len) < 0) {
 			return -1;
 		}
 		*buf_out_len = *buf_out_len + hash_len[instance->crypto_hash_type];
 	}
 
 	return 0;
 }
 
 int nsscrypto_authenticate_and_decrypt (
 	void *model_instance,
 	unsigned char *buf,
 	ssize_t *buf_len)
 {
 	struct nsscrypto_instance *instance = model_instance;
 
 	if (hash_to_nss[instance->crypto_hash_type]) {
 		unsigned char	tmp_hash[hash_len[instance->crypto_hash_type]];
 
 		if (calculate_nss_hash(instance, buf, *buf_len - hash_len[instance->crypto_hash_type], tmp_hash) < 0) {
 			return -1;
 		}
 
 		if (memcmp(tmp_hash, buf + (*buf_len - hash_len[instance->crypto_hash_type]), hash_len[instance->crypto_hash_type]) != 0) {
 			log_printf("Digest does not match");
 			return -1;
 		}
 
 		*buf_len = *buf_len - hash_len[instance->crypto_hash_type];
 	}
 
 	if (cipher_to_nss[instance->crypto_cipher_type]) {
 		if (decrypt_nss(instance, buf, buf_len) < 0) {
 			return -1;
 		}
 	}
 
 	return 0;
 }
 
 int nsscrypto_init(
 	knet_handle_t knet_h,
 	struct knet_handle_crypto_cfg *knet_handle_crypto_cfg)
 {
 	struct nsscrypto_instance *nsscrypto_instance = NULL;
 
 	log_printf("Initizializing nss crypto module [%s/%s]",
 		  knet_handle_crypto_cfg->crypto_cipher_type,
 		  knet_handle_crypto_cfg->crypto_hash_type);
 
 	knet_h->crypto_instance->model_instance = malloc(sizeof(struct nsscrypto_instance));
 	if (!knet_h->crypto_instance->model_instance) {
 		return -1;
 	}
 
 	nsscrypto_instance = knet_h->crypto_instance->model_instance;
 
 	memset(nsscrypto_instance, 0, sizeof(struct nsscrypto_instance));
 
 	if (!knet_handle_crypto_cfg->crypto_cipher_type) {
 		goto out_err;
 	}
 
 	nsscrypto_instance->crypto_cipher_type = string_to_crypto_cipher_type(knet_handle_crypto_cfg->crypto_cipher_type);
 	if (nsscrypto_instance->crypto_cipher_type < 0) {
 		goto out_err;
 	}
 
 	if (!knet_handle_crypto_cfg->crypto_hash_type) {
 		goto out_err;
 	}
 
 	nsscrypto_instance->crypto_hash_type = string_to_crypto_hash_type(knet_handle_crypto_cfg->crypto_hash_type);
 	if (nsscrypto_instance->crypto_hash_type < 0) {
 		goto out_err;
 	}
 
 	nsscrypto_instance->private_key = knet_handle_crypto_cfg->private_key;
 	nsscrypto_instance->private_key_len = knet_handle_crypto_cfg->private_key_len;
 
 	if ((nsscrypto_instance->crypto_cipher_type > 0) ||
 	    (nsscrypto_instance->crypto_hash_type > 0)) {
 		if ((!nsscrypto_instance->private_key) ||
 		    (nsscrypto_instance->private_key_len < KNET_MIN_KEY_LEN) ||
 		    (nsscrypto_instance->private_key_len > KNET_MAX_KEY_LEN)) {
 			goto out_err;
 		}
 	}
 
 	knet_h->tap_to_links_buf_crypt = malloc(KNET_DATABUFSIZE_CRYPT);
 	if (!knet_h->tap_to_links_buf_crypt)
 		goto out_err;
 
 	knet_h->pingbuf_crypt = malloc(KNET_DATABUFSIZE_CRYPT);
 	if (!knet_h->pingbuf_crypt)
 		goto out_err;
 
 	knet_h->recv_from_links_buf_crypt = malloc(KNET_DATABUFSIZE_CRYPT);
 	if (!knet_h->recv_from_links_buf_crypt)
 		goto out_err;
 
 	nsscrypto_instance->private_key = knet_handle_crypto_cfg->private_key;
 	nsscrypto_instance->private_key_len = knet_handle_crypto_cfg->private_key_len;
 
 	if (init_nss(nsscrypto_instance) < 0) {
 		goto out_err;
 	}
 
 	return 0;
 
 out_err:
 	nsscrypto_fini(knet_h);
 	return -1;
 }
 
 void nsscrypto_fini(
 	knet_handle_t knet_h)
 {
 	struct nsscrypto_instance *nsscrypto_instance = knet_h->crypto_instance->model_instance;
 
 	if (nsscrypto_instance) {
 		if (nsscrypto_instance->nss_sym_key) {
 			PK11_FreeSymKey(nsscrypto_instance->nss_sym_key);
 			nsscrypto_instance->nss_sym_key = NULL;
 		}
 		if (nsscrypto_instance->nss_sym_key_sign) {
 			PK11_FreeSymKey(nsscrypto_instance->nss_sym_key_sign);
 			nsscrypto_instance->nss_sym_key_sign = NULL;
 		}
 		if (knet_h->pingbuf_crypt) {
 			free(knet_h->pingbuf_crypt);
 			knet_h->pingbuf_crypt = NULL;
 		}
 		if (knet_h->tap_to_links_buf_crypt) {
 			free(knet_h->tap_to_links_buf_crypt);
 			knet_h->tap_to_links_buf_crypt = NULL;
 		}
 		if (knet_h->recv_from_links_buf_crypt) {
 			free(knet_h->recv_from_links_buf_crypt);
 			knet_h->recv_from_links_buf_crypt = NULL;
 		}
 
 		free(nsscrypto_instance);
 		knet_h->crypto_instance->model_instance = NULL;
 	}
 
 	return;
 }