Merge branch 'master' of ssh://gnunet.org/gnunet

184 files changed, 4787 insertions, 2772 deletions

diff --git a/.gitignore b/.gitignore
index b7dd58739..46dc14a98 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,6 @@
 *~
 \#*\#
+*.bak
 *.a
 *.la
 *.lo
@@ -40,7 +41,7 @@ INSTALL
 confdefs.h
 confdefs.c
 confdefs.err
-gnunet-doc.scm
+guix-env-gillmann.scm
 src/namestore/test_namestore_api_zone_to_name
 src/credential/gnunet-credential
 src/credential/gnunet-service-credential
@@ -49,3 +50,8 @@ src/identity-provider/gnunet-idp
 src/namestore/perf_namestore_api_zone_iteration_flat
 src/namestore/perf_namestore_api_zone_iteration_postgres
 src/namestore/perf_namestore_api_zone_iteration_sqlite
+python-lint.log
+flake8.log
+# for pytest created data:
+.cache/
+__pycache__/
diff --git a/README b/README
index 7819b883a..80a87d274 100644
--- a/README
+++ b/README
@@ -51,7 +51,7 @@ These are the direct dependencies for running GNUnet:
 - libogg        >= 1.3.0 (optional for experimental conversation tool)
 - python-zbar   >= 0.10 (optional for gnunet-qr)
 - TeX Live      >= 2012 (optional for gnunet-bcd[*])
-- Texinfo       >= 5.2
+- Texinfo       >= 5.2 [*1]
 - libglpk       >= 4.45 (optional for experimental code)
 
 Recommended autotools for compiling the git version are:
@@ -63,6 +63,10 @@ Recommended autotools for compiling the git version are:
 [*] Mandatory for compiling the info output of the documentation,
 a limited subset ('texlive-tiny' in Guix) is enough.
 
+[*1] The default configuration is to build the info output of the documentation,
+and therefore require texinfo.  You can pass --disable-documentation to
+the configure script to change this.
+
 How to install?
 ===============
 
@@ -260,9 +264,10 @@ $ make
 $ make install
 $ make check
 
-Some of the testcases require python >= 2.6 and pexpect to be
-installed.  If any testcases fail to pass on your system, run
-"contrib/report.sh" and report the output together with
+Some of the testcases require python >= 2.6 (+ the python module "futures")
+and pexpect to be installed.  If any testcases fail to pass on your system, run
+"contrib/scripts/report.sh" (in the repository) or "gnunet-bugreport"
+when you already have GNUnet installed and report the output together with
 information about the failing testcase to the Mantis bugtracking
 system at https://gnunet.org/bugs/.
 
diff --git a/contrib/pogen.sh b/bin/pogen.sh
index 87c90adf2..87c90adf2 100755
--- a/contrib/pogen.sh
+++ b/bin/pogen.sh
diff --git a/bootstrap b/bootstrap
index f13919ba8..a1cdcfa00 100755
--- a/bootstrap
+++ b/bootstrap
@@ -6,4 +6,4 @@ which glibtoolize || which libtoolize || which libtool || {
         exit 1
 }
 autoreconf -if
-contrib/pogen.sh
+. "bin/pogen.sh"
diff --git a/configure.ac b/configure.ac
index 668ac7529..871a84f93 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1530,6 +1530,8 @@ AM_CONDITIONAL([USE_COVERAGE], [test "x$use_gcov" = "xyes"])
 
 
 # version info
+# TODO: git blame says this predates our switch to git. git-svn should be adjusted to simply git, or
+# an external script that does the job.
 AC_PATH_PROG(svnversioncommand, svnversion)
 AC_PATH_PROG(gitcommand, git)
 AC_MSG_CHECKING(for source being under a VCS)
diff --git a/contrib/3rdparty/Windows/openvpn-tap32/COPYING b/contrib/3rdparty/Windows/openvpn-tap32/COPYING
new file mode 100644
index 000000000..3912109b5
--- /dev/null
+++ b/contrib/3rdparty/Windows/openvpn-tap32/COPYING
@@ -0,0 +1,340 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 2, June 1991
+
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.
+                       51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users.  This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it.  (Some other Free Software Foundation software is covered by
+the GNU Library General Public License instead.)  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have.  You must make sure that they, too, receive or can get the
+source code.  And you must show them these terms so they know their
+rights.
+
+  We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+  Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software.  If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary.  To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                    GNU GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License.  The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language.  (Hereinafter, translation is included without limitation in
+the term "modification".)  Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+  1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+  2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) You must cause the modified files to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    b) You must cause any work that you distribute or publish, that in
+    whole or in part contains or is derived from the Program or any
+    part thereof, to be licensed as a whole at no charge to all third
+    parties under the terms of this License.
+
+    c) If the modified program normally reads commands interactively
+    when run, you must cause it, when started running for such
+    interactive use in the most ordinary way, to print or display an
+    announcement including an appropriate copyright notice and a
+    notice that there is no warranty (or else, saying that you provide
+    a warranty) and that users may redistribute the program under
+    these conditions, and telling the user how to view a copy of this
+    License.  (Exception: if the Program itself is interactive but
+    does not normally print such an announcement, your work based on
+    the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+    a) Accompany it with the complete corresponding machine-readable
+    source code, which must be distributed under the terms of Sections
+    1 and 2 above on a medium customarily used for software interchange; or,
+
+    b) Accompany it with a written offer, valid for at least three
+    years, to give any third party, for a charge no more than your
+    cost of physically performing source distribution, a complete
+    machine-readable copy of the corresponding source code, to be
+    distributed under the terms of Sections 1 and 2 above on a medium
+    customarily used for software interchange; or,
+
+    c) Accompany it with the information you received as to the offer
+    to distribute corresponding source code.  (This alternative is
+    allowed only for noncommercial distribution and only if you
+    received the program in object code or executable form with such
+    an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it.  For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable.  However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License.  Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+  5. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Program or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+  6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  8. If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded.  In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+  9. The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Program
+specifies a version number of this License which applies to it and "any
+later version", you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation.  If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+  10. If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission.  For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this.  Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+                            NO WARRANTY
+
+  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program; if not, write to the Free Software
+    Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program is interactive, make it output a short notice like this
+when it starts in an interactive mode:
+
+    Gnomovision version 69, Copyright (C) year name of author
+    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, the commands you use may
+be called something other than `show w' and `show c'; they could even be
+mouse-clicks or menu items--whatever suits your program.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
+  `Gnomovision' (which makes passes at compilers) written by James Hacker.
+
+  <signature of Ty Coon>, 1 April 1989
+  Ty Coon, President of Vice
+
+This General Public License does not permit incorporating your program into
+proprietary programs.  If your program is a subroutine library, you may
+consider it more useful to permit linking proprietary applications with the
+library.  If this is what you want to do, use the GNU Library General
+Public License instead of this License.
diff --git a/contrib/openvpn-tap32/INSTALL b/contrib/3rdparty/Windows/openvpn-tap32/INSTALL
index 8e02c1890..8e02c1890 100644
--- a/contrib/openvpn-tap32/INSTALL
+++ b/contrib/3rdparty/Windows/openvpn-tap32/INSTALL
diff --git a/contrib/openvpn-tap32/tap32-signed-i386-2.1.zip b/contrib/3rdparty/Windows/openvpn-tap32/tap32-signed-i386-2.1.zip
index e13473203..e13473203 100644
--- a/contrib/openvpn-tap32/tap32-signed-i386-2.1.zip
+++ b/contrib/3rdparty/Windows/openvpn-tap32/tap32-signed-i386-2.1.zip
diff --git a/contrib/openvpn-tap32/tap32-source-2.1.zip b/contrib/3rdparty/Windows/openvpn-tap32/tap32-source-2.1.zip
index 9ffc0b4ef..9ffc0b4ef 100644
--- a/contrib/openvpn-tap32/tap32-source-2.1.zip
+++ b/contrib/3rdparty/Windows/openvpn-tap32/tap32-source-2.1.zip
diff --git a/contrib/openvpn-tap32/tapw32/OemWin2k.inf b/contrib/3rdparty/Windows/openvpn-tap32/tapw32/OemWin2k.inf
index 167e30fff..167e30fff 100644
--- a/contrib/openvpn-tap32/tapw32/OemWin2k.inf
+++ b/contrib/3rdparty/Windows/openvpn-tap32/tapw32/OemWin2k.inf
diff --git a/contrib/openvpn-tap32/tapw32/tap0901.cat b/contrib/3rdparty/Windows/openvpn-tap32/tapw32/tap0901.cat
index a6772f9fd..a6772f9fd 100644
--- a/contrib/openvpn-tap32/tapw32/tap0901.cat
+++ b/contrib/3rdparty/Windows/openvpn-tap32/tapw32/tap0901.cat
diff --git a/contrib/openvpn-tap32/tapw32/tap0901.sys b/contrib/3rdparty/Windows/openvpn-tap32/tapw32/tap0901.sys
index 3ecf2391b..3ecf2391b 100644
--- a/contrib/openvpn-tap32/tapw32/tap0901.sys
+++ b/contrib/3rdparty/Windows/openvpn-tap32/tapw32/tap0901.sys
diff --git a/contrib/openvpn-tap32/tapw64/OemWin2k.inf b/contrib/3rdparty/Windows/openvpn-tap32/tapw64/OemWin2k.inf
index 9b1676afd..9b1676afd 100644
--- a/contrib/openvpn-tap32/tapw64/OemWin2k.inf
+++ b/contrib/3rdparty/Windows/openvpn-tap32/tapw64/OemWin2k.inf
diff --git a/contrib/openvpn-tap32/tapw64/tap0901.cat b/contrib/3rdparty/Windows/openvpn-tap32/tapw64/tap0901.cat
index 1cac5f5c4..1cac5f5c4 100644
--- a/contrib/openvpn-tap32/tapw64/tap0901.cat
+++ b/contrib/3rdparty/Windows/openvpn-tap32/tapw64/tap0901.cat
diff --git a/contrib/openvpn-tap32/tapw64/tap0901.sys b/contrib/3rdparty/Windows/openvpn-tap32/tapw64/tap0901.sys
index 566e168ea..566e168ea 100644
--- a/contrib/openvpn-tap32/tapw64/tap0901.sys
+++ b/contrib/3rdparty/Windows/openvpn-tap32/tapw64/tap0901.sys
diff --git a/contrib/Makefile.am b/contrib/Makefile.am
index 1db5b3091..8e07a5d8c 100644
--- a/contrib/Makefile.am
+++ b/contrib/Makefile.am
@@ -17,52 +17,62 @@ timeout_watchdog_SOURCES = \
 endif
 
 noinst_SCRIPTS = \
- terminate.py \
- pydiffer.py \
- gnunet_pyexpect.py \
- gnunet_janitor.py \
- gnunet-chk.py
+ scripts/terminate.py \
+ scripts/pydiffer.py \
+ scripts/removetrailingwhitespace.py \
+ scripts/gnunet_pyexpect.py \
+ scripts/gnunet_janitor.py \
+ scripts/gnunet-chk.py
 
 dist_pkgdata_DATA = \
- gns-bcd.html \
- gns-bcd.tex \
- gnunet-logo.pdf \
- gnunet-logo-color.png \
+ gns/gns-bcd.html \
+ gns/gns-bcd.tex \
+ gns/def.tex \
+ gns/gns-form-fields.xml \
+ gns/gns-form.xslt \
+ branding/logo/gnunet-logo.pdf \
+ branding/logo/gnunet-logo-color.png \
+ scripts/report.sh \
  testing_hostkeys.ecc
 
 if MINGW
 tap32_DATA = \
- openvpn-tap32/tapw32/tap0901.sys \
- openvpn-tap32/tapw32/tap0901.cat \
- openvpn-tap32/tapw32/OemWin2k.inf
+ 3rdparty/Windows/openvpn-tap32/tapw32/tap0901.sys \
+ 3rdparty/Windows/openvpn-tap32/tapw32/tap0901.cat \
+ 3rdparty/Windows/openvpn-tap32/tapw32/OemWin2k.inf
 
 tap64_DATA = \
- openvpn-tap32/tapw64/tap0901.sys \
- openvpn-tap32/tapw64/tap0901.cat \
- openvpn-tap32/tapw64/OemWin2k.inf
+ 3rdparty/Windows/openvpn-tap32/tapw64/tap0901.sys \
+ 3rdparty/Windows/openvpn-tap32/tapw64/tap0901.cat \
+ 3rdparty/Windows/openvpn-tap32/tapw64/OemWin2k.inf
 endif
 
 EXTRA_DIST = \
- no_forcestart.conf \
- no_autostart_above_core.conf \
- coverage.sh \
- nssswitch.conf \
- report.sh \
- terminate.py.in \
- gnunet_pyexpect.py.in \
- gnunet_janitor.py.in \
- gnunet-chk.py.in \
- pydiffer.py.in \
- gnunet-gns-import.sh \
- openvpn-tap32/tapw32/tap0901.sys \
- openvpn-tap32/tapw32/tap0901.cat \
- openvpn-tap32/tapw32/OemWin2k.inf \
- openvpn-tap32/tapw64/tap0901.sys \
- openvpn-tap32/tapw64/tap0901.cat \
- openvpn-tap32/tapw64/OemWin2k.inf \
- openvpn-tap32/INSTALL \
- openvpn-tap32/tap32-signed-i386-2.1.zip \
- openvpn-tap32/tap32-source-2.1.zip
+ conf/colorit/colorit.conf \
+ conf/editors/eclipse/gnunet_codingstyle.xml \
+ conf/gnunet/no_forcestart.conf \
+ conf/gnunet/no_autostart_above_core.conf \
+ conf/nss/nssswitch.conf \
+ conf/wireshark/wireshark.lua \
+ scripts/coverage.sh \
+ scripts/terminate.py.in \
+ scripts/gnunet_pyexpect.py.in \
+ scripts/gnunet_janitor.py.in \
+ scripts/gnunet-chk.py.in \
+ scripts/removetrailingwhitespace.py.in \
+ scripts/pydiffer.py.in \
+ scripts/gnunet-gns-import.sh \
+ packages/nix/default.nix \
+ packages/nix/gnunet-dex.nix \
+ 3rdparty/Windows/openvpn-tap32/tapw32/tap0901.sys \
+ 3rdparty/Windows/openvpn-tap32/tapw32/tap0901.cat \
+ 3rdparty/Windows/openvpn-tap32/tapw32/OemWin2k.inf \
+ 3rdparty/Windows/openvpn-tap32/tapw64/tap0901.sys \
+ 3rdparty/Windows/openvpn-tap32/tapw64/tap0901.cat \
+ 3rdparty/Windows/openvpn-tap32/tapw64/OemWin2k.inf \
+ 3rdparty/Windows/openvpn-tap32/INSTALL \
+ 3rdparty/Windows/openvpn-tap32/tap32-signed-i386-2.1.zip \
+ 3rdparty/Windows/openvpn-tap32/tap32-source-2.1.zip
 
 CLEANFILES = \
   $(noinst_SCRIPTS)
@@ -80,21 +90,13 @@ do_subst = $(SED) -e 's,[@]PYTHON[@],$(PYTHON),g'
 #
 # instead of this:
 
+SUFFIXES =
 SUFFIXES = .py.in .py
 
 .py.in.py:
         $(do_subst) < $< > $@
         chmod +x $@
 
-# init_gnunet_redhat \
-# init_gnunet_ubuntu \
-# visualize_stats.sh \
-# gnmessage.sh \
-# junkinsert.sh \
-# junklookup.sh \
-# namespacehelper.sh
-
-
 check_PROGRAMS = \
  test_gnunet_prefix
 
diff --git a/contrib/gnunet-logo-big.png b/contrib/branding/logo/gnunet-logo-big.png
index 54c418f8f..54c418f8f 100644
--- a/contrib/gnunet-logo-big.png
+++ b/contrib/branding/logo/gnunet-logo-big.png
diff --git a/contrib/gnunet-logo-color.png b/contrib/branding/logo/gnunet-logo-color.png
index 326822ebd..326822ebd 100644
--- a/contrib/gnunet-logo-color.png
+++ b/contrib/branding/logo/gnunet-logo-color.png
diff --git a/contrib/gnunet-logo.pdf b/contrib/branding/logo/gnunet-logo.pdf
index fcc7b10bf..fcc7b10bf 100644
--- a/contrib/gnunet-logo.pdf
+++ b/contrib/branding/logo/gnunet-logo.pdf
diff --git a/contrib/buildslave-0.8.6p1-gnunet-w32.patch b/contrib/buildslave-0.8.6p1-gnunet-w32.patch
deleted file mode 100644
index 265db4d71..000000000
--- a/contrib/buildslave-0.8.6p1-gnunet-w32.patch
+++ /dev/null
@@ -1,202 +0,0 @@
-diff -urN /src/buildbot-slave-0.8.6p1.orig/buildslave/runprocess.py /src/buildbot-slave-0.8.6p1/buildslave/runprocess.py
---- buildbot-slave-0.8.6p1.orig/buildslave/runprocess.py        2012-03-26 04:09:10 +0400
-+++ buildbot-slave-0.8.6p1/buildslave/runprocess.py     2013-03-31 05:18:55 +0400
-@@ -24,6 +24,7 @@
- import re
- import subprocess
- import traceback
-+import tempfile
- import stat
- from collections import deque
- 
-@@ -36,6 +37,89 @@
- if runtime.platformType == 'posix':
-     from twisted.internet.process import Process
- 
-+if os.name == 'nt':
-+    import win32api
-+    import win32process
-+    import win32event
-+    import pywintypes
-+
-+def safe_terminate_process (proc, code):
-+    if os.name == 'nt':
-+        log.msg ("Obtaining current process handle")
-+        cp = win32api.GetCurrentProcess ()
-+        result = False
-+        log.msg ("Expanding target process handle permissions")
-+        dupproc = win32api.DuplicateHandle (cp, proc._handle, cp, 2 | 1024 | 8 | 32 | 16 | 0x100000, 0, 0)
-+        log.msg ("Expanded.")
-+        try:
-+            log.msg ("Checking exit code of target process")
-+            exitcode = win32process.GetExitCodeProcess (dupproc)
-+            log.msg ("Exit code is %d" % exitcode)
-+            if exitcode == 0x103:
-+                log.msg ("Opening kernel32.dll")
-+                kernel32 = win32api.GetModuleHandle ("kernel32")
-+                log.msg ("Getting ExitProcess() address")
-+                exitprocess = win32api.GetProcAddress (kernel32, "ExitProcess")
-+                try:
-+                    log.msg ("Creating remote thread")
-+                    th = 0
-+                    tid = 0
-+                    failed = False
-+                    th, tid = win32process.CreateRemoteThread (dupproc, None, 0, exitprocess, code, 0)
-+                    log.msg ("Created remote thread %d" % tid)
-+                except pywintypes.error as e:
-+                    if e[0] == 5:
-+                      log.msg ("Access denied. It still might die, so don't fail yet")
-+                      pass
-+                    else:
-+                      log.msg("exception %s - %s" % (sys.exc_info()[0], sys.exc_info()[1]))
-+                      failed = True
-+                except Exception as e:
-+                    log.msg("exception %s - %s" % (sys.exc_info()[0], sys.exc_info()[1]))
-+                    failed = True
-+                if not failed:
-+                    log.msg ("Wait for 5 seconds or until it dies (usually takes around 1 microsecond)")
-+                    waitresult = win32event.WaitForSingleObject (dupproc, 5)
-+                    log.msg ("Result of waiting: %d" % waitresult)
-+                    win32api.CloseHandle (th)
-+                    if waitresult == 0:
-+                        result = True
-+            else:
-+                result = True
-+        except:
-+            log.msg("exception %s - %s" % (sys.exc_info()[0], sys.exc_info()[1]))
-+        finally:
-+            win32api.CloseHandle (dupproc)
-+        return result
-+    else:
-+        return proc.kill ()
-+
-+class Dummy(object):
-+    def SetHandle (self, h):
-+        self._handle = h
-+
-+def safe_terminate_process_by_pid (proc, code):
-+    if os.name == 'nt':
-+        try:
-+            log.msg("Opening process %d" % proc)
-+            openproc = win32api.OpenProcess (2 | 1024 | 8 | 32 | 16 | 0x100000, 0, proc)
-+            log.msg("Opened process %d" % proc)
-+            try:
-+                d = Dummy ()
-+                d.SetHandle (openproc)
-+                log.msg("Terminating it safely")
-+                safe_terminate_process (d, code)
-+                log.msg("Finished terminating")
-+            finally:
-+                log.msg("Closing process handle")
-+                win32api.CloseHandle (openproc)
-+        except:
-+            log.msg("exception %s - %s" % (sys.exc_info()[0], sys.exc_info()[1]))
-+            pass
-+    else:
-+        return os.kill (proc, code)
-+
-+       
- def shell_quote(cmd_list):
-     # attempt to quote cmd_list such that a shell will properly re-interpret
-     # it.  The pipes module is only available on UNIX, and Windows "shell"
-@@ -148,6 +232,7 @@
-         self.pending_stdin = ""
-         self.stdin_finished = False
-         self.killed = False
-+        self.scriptfile = ""
- 
-     def setStdin(self, data):
-         assert not self.connected
-@@ -198,6 +283,11 @@
-                 rc = 1
-             else:
-                 rc = -1
-+        if self.scriptfile:
-+            try:
-+                os.remove (self.scriptfile) 
-+            except:
-+                pass
-         self.command.finished(sig, rc)
- 
- 
-@@ -408,9 +498,14 @@
- 
-         if type(self.command) in types.StringTypes:
-             if runtime.platformType  == 'win32':
--                argv = os.environ['COMSPEC'].split() # allow %COMSPEC% to have args
--                if '/c' not in argv: argv += ['/c']
--                argv += [self.command]
-+                if os.environ['BUILDSLAVE_SHELL']:
-+                    argv = os.environ['BUILDSLAVE_SHELL'].split() # allow %COMSPEC% to have args
-+                    argv += [self.command]
-+                else:
-+                    argv = os.environ['COMSPEC'].split() # allow %COMSPEC% to have args
-+                    if '/c' not in argv:
-+                        argv += ['/c']
-+                    argv += [self.command]
-             else:
-                 # for posix, use /bin/sh. for other non-posix, well, doesn't
-                 # hurt to try
-@@ -424,9 +519,26 @@
-             # handle path searching, etc.
-             if runtime.platformType == 'win32' and not \
-                     (self.command[0].lower().endswith(".exe") and os.path.isabs(self.command[0])):
--                argv = os.environ['COMSPEC'].split() # allow %COMSPEC% to have args
--                if '/c' not in argv: argv += ['/c']
--                argv += list(self.command)
-+                if os.environ['BUILDSLAVE_SHELL']:
-+                    argv = os.environ['BUILDSLAVE_SHELL'].split()
-+                    # Create a temporary script file that changes current directory
-+                    # and runs the command we want
-+                    # It will be deleted after command is finished running (see RunProcessPP)
-+                    tf, tf_name = tempfile.mkstemp ()
-+                    f = os.fdopen (tf, 'wb')
-+                    fcontents = '#!/bin/sh\ncd {}\n{}'.format (
-+                        re.sub(r'(?<!\\) ','\\ ', self.workdir.replace('\\','/')),
-+                        ' '.join (self.command))
-+                    f.write (fcontents)
-+                    log.msg("Script: {}".format (fcontents))
-+                    f.close ()
-+                    self.pp.scriptfile = tf_name
-+                    argv += [tf_name.replace('\\','/')]
-+                else:
-+                    argv = os.environ['COMSPEC'].split() # allow %COMSPEC% to have args
-+                    if '/c' not in argv:
-+                      argv += ['/c']
-+                    argv += list(self.command)
-             else:
-                 argv = self.command
-             # Attempt to format this for use by a shell, although the process isn't perfect
-@@ -439,7 +551,7 @@
-             self.environ['PWD'] = os.path.abspath(self.workdir)
- 
-         # self.stdin is handled in RunProcessPP.connectionMade
--
-+        log.msg("Running {}".format (argv))
-         log.msg(" " + display)
-         self._addToBuffers('header', display+"\n")
- 
-@@ -770,9 +882,7 @@
-             if self.interruptSignal == None:
-                 log.msg("self.interruptSignal==None, only pretending to kill child")
-             else:
--                log.msg("using TASKKILL /F PID /T to kill pid %s" % self.process.pid)
--                subprocess.check_call("TASKKILL /F /PID %s /T" % self.process.pid)
--                log.msg("taskkill'd pid %s" % self.process.pid)
-+                safe_terminate_process_by_pid (self.process.pid, 1)
-                 hit = 1
- 
-         # try signalling the process itself (works on Windows too, sorta)
-@@ -795,10 +905,11 @@
-         if not hit:
-             log.msg("signalProcess/os.kill failed both times")
- 
--        if runtime.platformType == "posix":
-+        if runtime.platformType == "posix" or runtime.platformType == "win32":
-             # we only do this under posix because the win32eventreactor
-             # blocks here until the process has terminated, while closing
-             # stderr. This is weird.
-+            # LRN: Turns out, things don't work without this on W32. At all.
-             self.pp.transport.loseConnection()
- 
-         if self.deferred:
diff --git a/contrib/buildbot-update.sh b/contrib/ci/buildbot/buildbot-update.sh
index 6c9d28b25..6c9d28b25 100755
--- a/contrib/buildbot-update.sh
+++ b/contrib/ci/buildbot/buildbot-update.sh
diff --git a/contrib/ssh-config b/contrib/ci/buildbot/ssh-config
index 857354bf3..857354bf3 100644
--- a/contrib/ssh-config
+++ b/contrib/ci/buildbot/ssh-config
diff --git a/contrib/ssh-keys b/contrib/ci/buildbot/ssh-keys
index 8a786d9cd..8a786d9cd 100644
--- a/contrib/ssh-keys
+++ b/contrib/ci/buildbot/ssh-keys
diff --git a/contrib/Dockerfile b/contrib/ci/docker/Dockerfile
index d2f2d7c97..974e41a5e 100644
--- a/contrib/Dockerfile
+++ b/contrib/ci/docker/Dockerfile
@@ -5,9 +5,10 @@ RUN dnf -y update && dnf -y install which git automake texinfo gettext-devel aut
 
 WORKDIR /usr/src
 
-# Install gnurl from source at version gnurl-7.54.0
-RUN git clone https://git.taler.net/gnurl.git --branch gnurl-7.57.0
-WORKDIR /usr/src/gnurl
+# Install gnurl
+RUN wget https://ftp.gnu.org/gnu/gnunet/gnurl-7.59.0.tar.gz
+RUN tar xvzpf gnurl-7.59.0.tar.gz
+WORKDIR /usr/src/gnurl-7.59.0
 RUN autoreconf -i
 RUN ./configure --disable-ntlm-wb
 RUN make install
diff --git a/contrib/docker-entrypoint.sh b/contrib/ci/docker/docker-entrypoint.sh
index 807d86d6f..807d86d6f 100644
--- a/contrib/docker-entrypoint.sh
+++ b/contrib/ci/docker/docker-entrypoint.sh
diff --git a/contrib/colorit.conf b/contrib/conf/colorit/colorit.conf
index 77d57aa59..77d57aa59 100644
--- a/contrib/colorit.conf
+++ b/contrib/conf/colorit/colorit.conf
diff --git a/contrib/gnunet_codingstyle.xml b/contrib/conf/editors/eclipse/gnunet_codingstyle.xml
index a58c2ed0c..a58c2ed0c 100644
--- a/contrib/gnunet_codingstyle.xml
+++ b/contrib/conf/editors/eclipse/gnunet_codingstyle.xml
diff --git a/contrib/no_autostart_above_core.conf b/contrib/conf/gnunet/no_autostart_above_core.conf
index 7bcf6c8ae..7bcf6c8ae 100644
--- a/contrib/no_autostart_above_core.conf
+++ b/contrib/conf/gnunet/no_autostart_above_core.conf
diff --git a/contrib/no_forcestart.conf b/contrib/conf/gnunet/no_forcestart.conf
index a332d6da7..a332d6da7 100644
--- a/contrib/no_forcestart.conf
+++ b/contrib/conf/gnunet/no_forcestart.conf
diff --git a/contrib/nssswitch.conf b/contrib/conf/nss/nssswitch.conf
index 89af6471e..89af6471e 100644
--- a/contrib/nssswitch.conf
+++ b/contrib/conf/nss/nssswitch.conf
diff --git a/bin/wireshark.lua b/contrib/conf/wireshark/wireshark.lua
index ac77029f6..ac77029f6 100644
--- a/bin/wireshark.lua
+++ b/contrib/conf/wireshark/wireshark.lua
diff --git a/contrib/bootstrap.min.css b/contrib/gns/bootstrap.min.css
index c547283bb..c547283bb 100644
--- a/contrib/bootstrap.min.css
+++ b/contrib/gns/bootstrap.min.css
diff --git a/contrib/def.tex b/contrib/gns/def.tex
index 669302b08..669302b08 100644
--- a/contrib/def.tex
+++ b/contrib/gns/def.tex
diff --git a/contrib/gns-bcd.html b/contrib/gns/gns-bcd.html
index de2fdb6e6..de2fdb6e6 100644
--- a/contrib/gns-bcd.html
+++ b/contrib/gns/gns-bcd.html
diff --git a/contrib/gns-bcd.tex b/contrib/gns/gns-bcd.tex
index 73a302985..f3a033ebc 100644
--- a/contrib/gns-bcd.tex
+++ b/contrib/gns/gns-bcd.tex
@@ -18782,7 +18782,7 @@
                 \node[rectangle,draw=white,minimum height=7pt,text width=41mm,inner sep=0pt] at (24.25mm,-29.0mm) {\ifthenelse{\equal{#1}{english}}{\textit{\jobtitleenglish}}{\textit{\jobtitlegerman}}};
             }
             {
-                \node at (78mm,-7mm) {\logo}; %\includegraphics[height=7mm]{gnunet-logo.pdf}};
+                \node at (78mm,-7mm) {\logo}; %\includegraphics[height=7mm]{../branding/logo/gnunet-logo.pdf}};
                 \node[rectangle,draw=white,line width=1pt,inner sep=0pt] at (17mm,-17mm) {\begin{pspicture}(15mm,15mm) \psbarcode{gnunet://gns/\gns}{eclevel=Q}{qrcode}\end{pspicture}};
                 \node[rectangle,draw=white,minimum height=7pt,text width=41mm,inner sep=0pt] at (24.25mm,-35.0mm) {\ifthenelse{\equal{\prefix}{}}{}{\tiny \prefix}};
                 \node[rectangle,draw=white,minimum height=7pt,text width=41mm,inner sep=0pt] at (24.25mm,-41.5mm) {\fontsize{8pt}{8pt}\selectfont \textbf{\name}\ifthenelse{\equal{\suffix}{}}{}{, \tiny \suffix}};
diff --git a/contrib/gns-form-fields.xml b/contrib/gns/gns-form-fields.xml
index 308e66e0d..308e66e0d 100644
--- a/contrib/gns-form-fields.xml
+++ b/contrib/gns/gns-form-fields.xml
diff --git a/contrib/gns-form.xslt b/contrib/gns/gns-form.xslt
index bf2585616..bf2585616 100644
--- a/contrib/gns-form.xslt
+++ b/contrib/gns/gns-form.xslt
diff --git a/contrib/gnunet_janitor.py.in b/contrib/gnunet_janitor.py.in
deleted file mode 100644
index 74fc70886..000000000
--- a/contrib/gnunet_janitor.py.in
+++ /dev/null
@@ -1,78 +0,0 @@
-#!@PYTHON@
-#    This file is part of GNUnet.
-#    (C) 2011 Christian Grothoff (and other contributing authors)
-#
-#    GNUnet is free software; you can redistribute it and/or modify
-#    it under the terms of the GNU General Public License as published
-#    by the Free Software Foundation; either version 2, or (at your
-#    option) any later version.
-#
-#    GNUnet is distributed in the hope that it will be useful, but
-#    WITHOUT ANY WARRANTY; without even the implied warranty of
-#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-#    General Public License for more details.
-#
-#    You should have received a copy of the GNU General Public License
-#    along with GNUnet; see the file COPYING.  If not, write to the
-#    Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-#    Boston, MA 02110-1301, USA.
-#
-# Finds any gnunet processes still running in the system and kills them
-#
-# gnunet janitor can be used by invoking `make' like this:
-# TESTS_ENVIRONMENT='${top_srcdir}/contrib/gnunet_janitor.py &&' make check
-
-from __future__ import print_function
-import os
-import re
-import subprocess
-import sys
-import shutil
-import time
-import signal
-import terminate
-
-if os.name == 'nt':
-  from win32com.client import GetObject
-  WMI = GetObject('winmgmts:')
-
-def get_process_list ():
-  result = []
-  if os.name == 'nt':
-    processes = WMI.InstancesOf('Win32_Process')
-    for p in processes:
-      result.append ((p.Properties_('ProcessId').Value, re.sub (r'(.+)\.exe', r'\1', p.Properties_('Name').Value)))
-  else:
-    pids = [pid for pid in os.listdir('/proc') if pid.isdigit ()]
-    for pid in pids:
-      with open (os.path.join ('/proc', pid, 'cmdline'), 'rb') as p:
-        cmdline = p.read ().split ('\x00')
-        if len (cmdline) > 0:
-          result.append ((pid, cmdline[0]))
-  return result
-
-def main ():
-  procs = get_process_list ()
-  gnunet_procs = []
-  for p in procs:
-    if re.match (r'gnunet-.+', p[1]):
-      gnunet_procs.append (p)
-  for p in gnunet_procs:
-    if re.match (r'gnunet-service-arm', p[1]):
-      print ("killing arm process {0:5} {1}".format (p[0], p[1]))
-      try:
-        terminate.safe_terminate_process_by_pid (int (p[0]), 1)
-      except OSError as e:
-        print ("failed: {0}".format (e))
-        pass
-  for p in gnunet_procs:
-    if not re.match (r'gnunet-service-arm', p[1]):
-      print ("killing non-arm process {0:5} {1}".format (p[0], p[1]))
-      try:
-        terminate.safe_terminate_process_by_pid (int (p[0]), 1)
-      except OSError as e:
-        print ("failed: {0}".format (e))
-        pass
-
-if __name__ == '__main__':
-  sys.exit (main ())
diff --git a/contrib/gnunet_pyexpect.py.in b/contrib/gnunet_pyexpect.py.in
deleted file mode 100644
index cfeb06d8d..000000000
--- a/contrib/gnunet_pyexpect.py.in
+++ /dev/null
@@ -1,83 +0,0 @@
-#!@PYTHON@
-#    This file is part of GNUnet.
-#    (C) 2010 Christian Grothoff (and other contributing authors)
-#
-#    GNUnet is free software; you can redistribute it and/or modify
-#    it under the terms of the GNU General Public License as published
-#    by the Free Software Foundation; either version 2, or (at your
-#    option) any later version.
-#
-#    GNUnet is distributed in the hope that it will be useful, but
-#    WITHOUT ANY WARRANTY; without even the implied warranty of
-#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-#    General Public License for more details.
-#
-#    You should have received a copy of the GNU General Public License
-#    along with GNUnet; see the file COPYING.  If not, write to the
-#    Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-#    Boston, MA 02110-1301, USA.
-#
-# Testcase for gnunet-peerinfo
-from __future__ import print_function
-import os
-import re
-import subprocess
-import sys
-import shutil
-import time
-
-class pexpect (object):
-  def __init__ (self):
-    super (pexpect, self).__init__ ()
-
-  def spawn (self, stdin, arglist, *pargs, **kwargs):
-    env = kwargs.pop ('env', None)
-    if env is None:
-      env = os.environ.copy ()
-    # This messes up some testcases, disable log redirection
-    env.pop ('GNUNET_FORCE_LOGFILE', None)
-    self.proc = subprocess.Popen (arglist, *pargs, env=env, **kwargs)
-    if self.proc is None:
-      print ("Failed to spawn a process {0}".format (arglist))
-      sys.exit (1)
-    if stdin is not None:
-      self.stdo, self.stde = self.proc.communicate (stdin)
-    else:
-      self.stdo, self.stde = self.proc.communicate ()
-    return self.proc
-
-  def expect (self, s, r, flags=0):
-    stream = self.stdo if s == 'stdout' else self.stde
-    if isinstance (r, str):
-      if r == "EOF":
-        if len (stream) == 0:
-          return True
-        else:
-          print ("Failed to find `{1}' in {0}, which is `{2}' ({3})".format (s, r, stream, len (stream)))
-          sys.exit (2)
-      raise ValueError ("Argument `r' should be an instance of re.RegexObject or a special string, but is `{0}'".format (r))
-    m = r.search (stream.decode(), flags)
-    if not m:
-      print ("Failed to find `{1}' in {0}, which is is `{2}'".format (s, r.pattern, stream))
-      sys.exit (2)
-    stream = stream[m.end ():]
-    if s == 'stdout':
-      self.stdo = stream
-    else:
-      self.stde = stream
-    return m
-
-  def read (self, s, size=-1):
-    stream = self.stdo if s == 'stdout' else self.stde
-    result = ""
-    if size < 0:
-      result = stream
-      new_stream = ""
-    else:
-      result = stream[0:size]
-      new_stream = stream[size:]
-    if s == 'stdout':
-      self.stdo = new_stream
-    else:
-      self.stde = new_stream
-    return result
diff --git a/contrib/experiments/nse/infiniband.conf b/contrib/nse/experiments/infiniband.conf
index c7b7f2a59..c7b7f2a59 100644
--- a/contrib/experiments/nse/infiniband.conf
+++ b/contrib/nse/experiments/infiniband.conf
diff --git a/contrib/lrn-indent.diff b/contrib/patches/lrn-indent.diff
index 8ba3b77cc..8ba3b77cc 100644
--- a/contrib/lrn-indent.diff
+++ b/contrib/patches/lrn-indent.diff
diff --git a/contrib/texi2html5-indent.diff b/contrib/patches/texi2html5-indent.diff
index 2abbcb766..2abbcb766 100644
--- a/contrib/texi2html5-indent.diff
+++ b/contrib/patches/texi2html5-indent.diff
diff --git a/contrib/transport_ats_years.diff b/contrib/patches/transport_ats_years.diff
index f48c9555d..f48c9555d 100644
--- a/contrib/transport_ats_years.diff
+++ b/contrib/patches/transport_ats_years.diff
diff --git a/contrib/removetrailingwhitespace b/contrib/removetrailingwhitespace
deleted file mode 100755
index 9e620cbb2..000000000
--- a/contrib/removetrailingwhitespace
+++ /dev/null
@@ -1,14 +0,0 @@
-#!/usr/bin/python
-
-import sys
-import re
-
-for fileName in sys.argv[1:]:
-   f = open(fileName, 'r+')
-   fileString = f.read()
-
-   fileString = re.sub(r'[ ]+\n', r'\n', fileString)
-   fileString = re.sub(r'\r', r'', fileString)
-   f.seek(0)
-   f.write(fileString)
-   f.truncate(len(fileString))
diff --git a/contrib/repeat.sh b/contrib/repeat.sh
deleted file mode 100755
index 3efc95f07..000000000
--- a/contrib/repeat.sh
+++ /dev/null
@@ -1 +0,0 @@
-while true; do rm -rf /tmp/test-gnunetd-*; make check || break; done
diff --git a/contrib/scripts/.gitignore b/contrib/scripts/.gitignore
new file mode 100644
index 000000000..547c89185
--- /dev/null
+++ b/contrib/scripts/.gitignore
@@ -0,0 +1,2 @@
+gnunet-chk.py
+removetrailingwhitespace.py
diff --git a/contrib/coverage.sh b/contrib/scripts/coverage.sh
index dd6a6ab53..dd6a6ab53 100755
--- a/contrib/coverage.sh
+++ b/contrib/scripts/coverage.sh
diff --git a/contrib/debug b/contrib/scripts/debug
index 3de2c9a14..3de2c9a14 100755
--- a/contrib/debug
+++ b/contrib/scripts/debug
diff --git a/contrib/scripts/documentation/gnunet-doc.scm b/contrib/scripts/documentation/gnunet-doc.scm
new file mode 100644
index 000000000..d8c16fdb3
--- /dev/null
+++ b/contrib/scripts/documentation/gnunet-doc.scm
@@ -0,0 +1,184 @@
+;;; This file is part of GNUnet.
+;;; Copyright (C) 2016, 2017 GNUnet e.V.
+;;;
+;;; GNUnet is free software; you can redistribute it and/or modify
+;;; it under the terms of the GNU General Public License as published
+;;; by the Free Software Foundation; either version 3, or (at your
+;;; option) any later version.
+;;;
+;;; GNUnet is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+;;; General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNUnet; see the file COPYING.  If not, write to the
+;;; Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+;;; Boston, MA 02110-1301, USA.
+;;;
+
+(use-modules
+ (ice-9 popen)
+ (ice-9 match)
+ (ice-9 rdelim)
+ (guix packages)
+ (guix build-system gnu)
+ (guix gexp)
+ ((guix build utils) #:select (with-directory-excursion))
+ (guix git-download)
+ (guix utils) ; current-source-directory
+ (gnu packages)
+ (gnu packages aidc)
+ (gnu packages autotools)
+ (gnu packages backup)
+ (gnu packages base)
+ (gnu packages compression)
+ (gnu packages curl)
+ (gnu packages databases)
+ (gnu packages file)
+ (gnu packages gettext)
+ (gnu packages glib)
+ (gnu packages gnome)
+ (gnu packages gnunet)
+ (gnu packages gnupg)
+ (gnu packages gnuzilla)
+ (gnu packages groff)
+ (gnu packages gstreamer)
+ (gnu packages gtk)
+ (gnu packages guile)
+ (gnu packages graphviz)
+ (gnu packages image)
+ (gnu packages image-viewers)
+ (gnu packages libidn)
+ (gnu packages libunistring)
+ (gnu packages linux)
+ (gnu packages maths)
+ (gnu packages multiprecision)
+ (gnu packages perl)
+ (gnu packages pkg-config)
+ (gnu packages pulseaudio)
+ (gnu packages python)
+ (gnu packages tex)
+ (gnu packages texinfo)
+ (gnu packages tex)
+ (gnu packages tls)
+ (gnu packages video)
+ (gnu packages web)
+ (gnu packages xiph)
+ ;;(gnunet packages texlive) ;GNUnet module including texlive-2012 WIP
+ ((guix licenses) #:prefix license:))
+
+;;(define %source-dir (string-append (current-source-directory)
+;;                                   "/../../../"))
+(define %source-dir (dirname (current-filename)))
+
+(define gnunet-doc
+  (let* ((revision "2")
+         (select? (delay (or (git-predicate
+                              (string-append (current-source-directory)
+                                             "/../../../"))
+                             source-file?))))
+      (package
+      (name "gnunet-doc")
+      (version (string-append "0.10.1-" revision "." "dev"))
+      (source
+       (local-file ;;"../../.."
+                   ;;%source-dir
+                   ;;(string-append (getcwd) "/../../../")
+                   (string-append (getcwd)) ;drrty hack and this assumes one static position FIXME!
+                   #:recursive? #t))
+                   ;;#:select? (git-predicate %source-dir)))
+                   ;;#:select? (force select?)))
+      (build-system gnu-build-system)
+      (inputs
+       `(("glpk" ,glpk)
+         ("gnurl" ,gnurl)
+         ("gstreamer" ,gstreamer)
+         ("gst-plugins-base" ,gst-plugins-base)
+         ("gnutls/dane" ,gnutls/dane)
+         ("libextractor" ,libextractor)
+         ("libgcrypt" ,libgcrypt)
+         ("libidn" ,libidn)
+         ("libmicrohttpd" ,libmicrohttpd)
+         ("libltdl" ,libltdl)
+         ("libunistring" ,libunistring)
+         ("openssl" ,openssl)
+         ("opus" ,opus)
+         ("pulseaudio" ,pulseaudio)
+         ("sqlite" ,sqlite)
+         ("postgresql" ,postgresql)
+         ("mysql" ,mysql)
+         ("zlib" ,zlib)
+         ("perl" ,perl)
+         ("python-2" ,python-2) ; tests and gnunet-qr
+         ("jansson" ,jansson)
+         ("nss" ,nss)
+         ("glib" ,glib "bin")
+         ("gmp" ,gmp)
+         ("bluez" ,bluez) ; for optional bluetooth feature
+         ("glib" ,glib)
+         ;;("texlive-minimal" ,texlive-minimal) ; optional.
+         ("texlive" ,texlive) ;TODO: Stabilize Texlive-2012 package
+         ("libogg" ,libogg)))
+      (native-inputs
+       `(("pkg-config" ,pkg-config)
+         ("autoconf" ,autoconf)
+         ("automake" ,automake)
+         ("gnu-gettext" ,gnu-gettext)
+         ("graphviz" ,graphviz) ; dot
+         ("texinfo-5" ,texinfo-5) ; Debian stable
+         ("which" ,which)
+         ("libtool" ,libtool)))
+      (arguments
+       `(#:configure-flags
+         (list "--enable-documentation")
+         #:tests? #f ;Don't run tests
+         #:phases
+         (modify-phases %standard-phases
+           (add-after 'unpack 'autoconf
+             (lambda _
+               (substitute* "bootstrap"
+                 (("contrib/pogen.sh") "sh contrib/pogen.sh"))
+               (for-each (lambda (f) (chmod f #o755))
+                         (find-files "po" ""))
+               (zero? (system* "sh" "bootstrap"))))
+           (add-after 'build 'run-gendocs
+             (lambda _
+               (chdir "doc/documentation")
+               ;;(zero? (system* "make" "dev-build"))))
+               (zero? (system* "sh" "run-gendocs.sh"))))
+               ;; (zero? (system* "make" "pdf"))
+               ;; (zero? (system* "make" "html"))
+               ;; (zero? (system* "make" "info"))))
+               ;;(zero? (system* "make" "doc-all-give-me-the-noise"))))
+           (replace 'install
+             (lambda _
+               (zero? (system* "make" "doc-gendoc-install")))))))
+             ;;(lambda* (#:key outputs #:allow-other-keys)
+               ;; (let* ((out (assoc-ref outputs "out"))
+               ;;        (doc (string-append out "/share/doc/gnunet")))
+               ;;   (mkdir-p doc)
+               ;;   (copy-recursively "images"
+               ;;                     (string-append doc
+               ;;                                    "/images"))
+               ;;   (mkdir-p (string-append doc "/gnunet"))
+               ;;   (install-file "gnunet.pdf" doc)
+               ;;   (install-file "gnunet.info" doc)
+               ;;   (install-file "gnunet.log" doc) ;TODO: Move to 'dev' output?
+               ;;   (copy-recursively "gnunet"
+               ;;                     (string-append doc
+               ;;                                    "/gnunet"))
+               ;;   (install-file "gnunet-c-tutorial.pdf" doc)
+               ;;   (install-file "gnunet-c-tutorial.info" doc)
+               ;;   (install-file "gnunet-c-tutorial.log" doc) ;TODO: Move to 'dev' output?
+               ;;   (copy-recursively "gnunet-c-tutorial"
+               ;;                     (string-append doc
+               ;;                                    "/gnunet-c-tutorial")))
+               ;; #t)))))
+      (synopsis "Documentation of GNUnet")
+      (description
+       "GNUnet documentation build")
+      (license (list license:fdl1.3+ license:gpl3+))
+      (home-page "https://gnunet.org/"))))
+
+gnunet-doc
diff --git a/contrib/find_typedefs.py b/contrib/scripts/find_typedefs.py
index 68f5c2782..b344cee2b 100644
--- a/contrib/find_typedefs.py
+++ b/contrib/scripts/find_typedefs.py
@@ -1,4 +1,7 @@
+# XXX (F841): local variable 'li' is assigned to but never used
+
 from __future__ import print_function
+from __future__ import unicode_literals
 import os
 import re
 import sys
diff --git a/contrib/gdb-iterate-dll.py b/contrib/scripts/gdb-iterate-dll.py
index 79d46aa96..388ef6e11 100644
--- a/contrib/gdb-iterate-dll.py
+++ b/contrib/scripts/gdb-iterate-dll.py
@@ -1,3 +1,6 @@
+from __future__ import print_function
+from __future__ import unicode_literals
+from builtins import str
 from gdb import *
 
 
diff --git a/contrib/generate-monkey-db.sh b/contrib/scripts/generate-monkey-db.sh
index 2afe55501..2afe55501 100755
--- a/contrib/generate-monkey-db.sh
+++ b/contrib/scripts/generate-monkey-db.sh
diff --git a/contrib/gnunet-chk.py.in b/contrib/scripts/gnunet-chk.py.in
index f20153a8a..c976b2143 100755
--- a/contrib/gnunet-chk.py.in
+++ b/contrib/scripts/gnunet-chk.py.in
@@ -192,11 +192,9 @@ class Chk:
     def setSize(self, size):
         self.fsize = size
 
-    # 2to3-3.5 suggests to change the code below to:
-    # if isinstance (self.fsize, int):
     def uri(self):
         sizestr = repr(self.fsize)
-        if isinstance(self.fsize, long):
+        if isinstance(self.fsize, int):
             sizestr = sizestr[:-1]
         return GNUNET_FS_URI_PREFIX + GNUNET_FS_URI_CHK_INFIX + \
             encode_data_to_string(bytearray(self.key)) + "." + \
diff --git a/contrib/gnunet-logread b/contrib/scripts/gnunet-logread/gnunet-logread
index e4b6752b8..9b1c65401 100755
--- a/contrib/gnunet-logread
+++ b/contrib/scripts/gnunet-logread/gnunet-logread
@@ -1,4 +1,4 @@
-#!/usr/bin/env perl
+#!@PERL@
 # helper tool to make gnunet logs more readable
 # try 'gnunet-logread -h' for usage
 
diff --git a/contrib/gnunet-logread-ipc b/contrib/scripts/gnunet-logread/gnunet-logread-ipc
index 77515d890..72f9f47df 100755
--- a/contrib/gnunet-logread-ipc
+++ b/contrib/scripts/gnunet-logread/gnunet-logread-ipc
@@ -4,6 +4,7 @@
 #
 # ... obsoleted by gnunet-logread's new -f option that does the same thing
 
+# FIXME: Replace /tmp with our use of $TMPDIR and similar.
 ipc=${1:-/tmp/gnunet-logread-ipc.sock}
 test -e "$ipc" || mkfifo "$ipc"
 cat "$ipc"
diff --git a/contrib/gnunet-logread-ipc-sdedit b/contrib/scripts/gnunet-logread/gnunet-logread-ipc-sdedit
index 197e6f575..f8b7dc735 100755
--- a/contrib/gnunet-logread-ipc-sdedit
+++ b/contrib/scripts/gnunet-logread/gnunet-logread-ipc-sdedit
@@ -1,4 +1,4 @@
-#!/usr/bin/env perl
+#!@PERL@
 
 # 1. Start sdedit and enable 'RT diagram server' in 'Global preferences'.
 #
diff --git a/contrib/gnunet-suidfix b/contrib/scripts/gnunet-suidfix
index 992378966..992378966 100755
--- a/contrib/gnunet-suidfix
+++ b/contrib/scripts/gnunet-suidfix
diff --git a/contrib/scripts/gnunet_janitor.py.in b/contrib/scripts/gnunet_janitor.py.in
new file mode 100644
index 000000000..91d2a4377
--- /dev/null
+++ b/contrib/scripts/gnunet_janitor.py.in
@@ -0,0 +1,81 @@
+#!@PYTHON@
+#    This file is part of GNUnet.
+#    (C) 2011, 2018 Christian Grothoff (and other contributing authors)
+#
+#    GNUnet is free software; you can redistribute it and/or modify
+#    it under the terms of the GNU General Public License as published
+#    by the Free Software Foundation; either version 2, or (at your
+#    option) any later version.
+#
+#    GNUnet is distributed in the hope that it will be useful, but
+#    WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+#    General Public License for more details.
+#
+#    You should have received a copy of the GNU General Public License
+#    along with GNUnet; see the file COPYING.  If not, write to the
+#    Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#    Boston, MA 02110-1301, USA.
+#
+# Finds any gnunet processes still running in the system and kills them
+#
+# gnunet janitor can be used by invoking `make' like this:
+# TESTS_ENVIRONMENT='${top_srcdir}/contrib/scripts/gnunet_janitor.py &&' make check
+
+from __future__ import print_function
+import os
+import re
+import subprocess
+import sys
+import shutil
+import time
+import signal
+import terminate
+
+if os.name == 'nt':
+    from win32com.client import GetObject
+    WMI = GetObject('winmgmts:')
+
+
+def get_process_list():
+    result = []
+    if os.name == 'nt':
+        processes = WMI.InstancesOf('Win32_Process')
+        for p in processes:
+            result.append((p.Properties_('ProcessId').Value, re.sub(r'(.+)\.exe', r'\1', p.Properties_('Name').Value)))
+    else:
+        pids = [pid for pid in os.listdir('/proc') if pid.isdigit()]
+        for pid in pids:
+            with open(os.path.join('/proc', pid, 'cmdline'), 'rb') as p:
+                cmdline = p.read().split('\x00')
+                if len(cmdline) > 0:
+                    result.append((pid, cmdline[0]))
+    return result
+
+
+def main():
+    procs = get_process_list()
+    gnunet_procs = []
+    for p in procs:
+        if re.match(r'gnunet-.+', p[1]):
+            gnunet_procs.append(p)
+    for p in gnunet_procs:
+        if re.match(r'gnunet-service-arm', p[1]):
+            print("killing arm process {0:5} {1}".format(p[0], p[1]))
+            try:
+                terminate.safe_terminate_process_by_pid(int(p[0]), 1)
+            except OSError as e:
+                print("failed: {0}".format(e))
+                pass
+    for p in gnunet_procs:
+        if not re.match(r'gnunet-service-arm', p[1]):
+            print("killing non-arm process {0:5} {1}".format(p[0], p[1]))
+            try:
+                terminate.safe_terminate_process_by_pid(int(p[0]), 1)
+            except OSError as e:
+                print("failed: {0}".format(e))
+                pass
+
+
+if __name__ == '__main__':
+    sys.exit(main())
diff --git a/contrib/scripts/gnunet_pyexpect.py.in b/contrib/scripts/gnunet_pyexpect.py.in
new file mode 100644
index 000000000..23f01603f
--- /dev/null
+++ b/contrib/scripts/gnunet_pyexpect.py.in
@@ -0,0 +1,84 @@
+#!@PYTHON@
+#    This file is part of GNUnet.
+#    (C) 2010, 2018 Christian Grothoff (and other contributing authors)
+#
+#    GNUnet is free software; you can redistribute it and/or modify
+#    it under the terms of the GNU General Public License as published
+#    by the Free Software Foundation; either version 2, or (at your
+#    option) any later version.
+#
+#    GNUnet is distributed in the hope that it will be useful, but
+#    WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+#    General Public License for more details.
+#
+#    You should have received a copy of the GNU General Public License
+#    along with GNUnet; see the file COPYING.  If not, write to the
+#    Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#    Boston, MA 02110-1301, USA.
+#
+# Testcase for gnunet-peerinfo
+from __future__ import print_function
+import os
+import re
+import subprocess
+import sys
+import shutil
+import time
+
+
+class pexpect (object):
+    def __init__(self):
+        super(pexpect, self).__init__()
+
+    def spawn(self, stdin, arglist, *pargs, **kwargs):
+        env = kwargs.pop('env', None)
+        if env is None:
+            env = os.environ.copy()
+        # This messes up some testcases, disable log redirection
+        env.pop('GNUNET_FORCE_LOGFILE', None)
+        self.proc = subprocess.Popen(arglist, *pargs, env=env, **kwargs)
+        if self.proc is None:
+            print("Failed to spawn a process {0}".format(arglist))
+            sys.exit(1)
+        if stdin is not None:
+            self.stdo, self.stde = self.proc.communicate(stdin)
+        else:
+            self.stdo, self.stde = self.proc.communicate()
+        return self.proc
+
+    def expect(self, s, r, flags=0):
+        stream = self.stdo if s == 'stdout' else self.stde
+        if isinstance(r, str):
+            if r == "EOF":
+                if len(stream) == 0:
+                    return True
+                else:
+                    print("Failed to find `{1}' in {0}, which is `{2}' ({3})".format(s, r, stream, len(stream)))
+                    sys.exit(2)
+            raise ValueError("Argument `r' should be an instance of re.RegexObject or a special string, but is `{0}'".format(r))
+        m = r.search(stream.decode(), flags)
+        if not m:
+            print("Failed to find `{1}' in {0}, which is is `{2}'".format(s, r.pattern, stream))
+            sys.exit(2)
+        stream = stream[m.end():]
+        if s == 'stdout':
+            self.stdo = stream
+        else:
+            self.stde = stream
+        return m
+
+    def read(self, s, size=-1):
+        stream = self.stdo if s == 'stdout' else self.stde
+        result = ""
+        if size < 0:
+            result = stream
+            new_stream = ""
+        else:
+            result = stream[0:size]
+            new_stream = stream[size:]
+        if s == 'stdout':
+            self.stdo = new_stream
+        else:
+            self.stde = new_stream
+        return result
diff --git a/contrib/scripts/lint-python.sh b/contrib/scripts/lint-python.sh
new file mode 100755
index 000000000..9f7e0462d
--- /dev/null
+++ b/contrib/scripts/lint-python.sh
@@ -0,0 +1,24 @@
+#!/bin/sh
+# check python style (and 2 to 3 migration)
+
+rm python-lint.log
+
+if [ -e "python" ]
+then
+    python --version >> python-lint.log
+fi
+
+if [ -e "python2" ]
+then
+    python2 --version >> python-lint.log
+fi
+
+if [ -e "python3" ]
+then
+    python3 --version >> python-lint.log
+fi
+
+flake8 >> python-lint.log
+
+2to3 -v -d . >> python-lint.log
+2to3 -v -p . >> python-lint.log
diff --git a/contrib/process_log.sh b/contrib/scripts/process_log.sh
index c25c515c2..c25c515c2 100755
--- a/contrib/process_log.sh
+++ b/contrib/scripts/process_log.sh
diff --git a/contrib/pydiffer.py.in b/contrib/scripts/pydiffer.py.in
index 10145371c..10145371c 100644
--- a/contrib/pydiffer.py.in
+++ b/contrib/scripts/pydiffer.py.in
diff --git a/contrib/pydmesg b/contrib/scripts/pydmesg
index d60e08fe3..d60e08fe3 100755
--- a/contrib/pydmesg
+++ b/contrib/scripts/pydmesg
diff --git a/contrib/regression.sh b/contrib/scripts/regression.sh
index 1f799797a..1f799797a 100755
--- a/contrib/regression.sh
+++ b/contrib/scripts/regression.sh
diff --git a/contrib/scripts/removetrailingwhitespace.py.in b/contrib/scripts/removetrailingwhitespace.py.in
new file mode 100755
index 000000000..5824fb591
--- /dev/null
+++ b/contrib/scripts/removetrailingwhitespace.py.in
@@ -0,0 +1,15 @@
+#!@PYTHON@
+
+import sys
+import re
+
+
+for fileName in sys.argv[1:]:
+    f = open(fileName, 'r+')
+    fileString = f.read()
+
+    fileString = re.sub(r'[ ]+\n', r'\n', fileString)
+    fileString = re.sub(r'\r', r'', fileString)
+    f.seek(0)
+    f.write(fileString)
+    f.truncate(len(fileString))
diff --git a/contrib/report.sh b/contrib/scripts/report.sh
index 7fbb2f46c..7fbb2f46c 100755
--- a/contrib/report.sh
+++ b/contrib/scripts/report.sh
diff --git a/contrib/revisionary.sh b/contrib/scripts/revisionary.sh
index 5778cf148..5778cf148 100755
--- a/contrib/revisionary.sh
+++ b/contrib/scripts/revisionary.sh
diff --git a/contrib/scripts/terminate.py.in b/contrib/scripts/terminate.py.in
new file mode 100644
index 000000000..c6acfdba8
--- /dev/null
+++ b/contrib/scripts/terminate.py.in
@@ -0,0 +1,68 @@
+#!@PYTHON@
+#    This file is part of GNUnet.
+#    (C) 2011, 2018 Christian Grothoff (and other contributing authors)
+#
+#    GNUnet is free software; you can redistribute it and/or modify
+#    it under the terms of the GNU General Public License as published
+#    by the Free Software Foundation; either version 2, or (at your
+#    option) any later version.
+#
+#    GNUnet is distributed in the hope that it will be useful, but
+#    WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+#    General Public License for more details.
+#
+#    You should have received a copy of the GNU General Public License
+#    along with GNUnet; see the file COPYING.  If not, write to the
+#    Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#    Boston, MA 02110-1301, USA.
+#
+# Utility module that implements safe process termination for W32.
+# For other platforms it's equivalent to Popen.kill ()
+# Requires pywin32 on W32.
+
+import sys
+import subprocess
+import os
+if os.name == 'nt':
+    import win32api
+    import win32process
+
+
+class dummyobj (object):
+    pass
+
+
+def safe_terminate_process_by_pid(pid, code):
+    if os.name == 'nt':
+        p = dummyobj()
+        p._handle = win32api.OpenProcess(2 | 1024 | 8 | 32 | 16, 0, pid)
+        result = safe_terminate_process(p, code)
+        win32api.CloseHandle(p._handle)
+        return result
+    else:
+        # XXX (F821): Undefined name 'SIGKILL'
+        return os.kill(int(pid), SIGKILL)
+
+
+def safe_terminate_process(proc, code):
+    if os.name == 'nt':
+        cp = win32api.GetCurrentProcess()
+        result = False
+        dupproc = win32api.DuplicateHandle(cp, proc._handle, cp, 2 | 1024 | 8 | 32 | 16, 0, 0)
+        try:
+            exitcode = win32process.GetExitCodeProcess(dupproc)
+            if exitcode == 0x103:
+                kernel32 = win32api.GetModuleHandle("kernel32")
+                exitprocess = win32api.GetProcAddress(kernel32, "ExitProcess")
+                th, tid = win32process.CreateRemoteThread(dupproc, None, 0, exitprocess, code, 0)
+                win32api.CloseHandle(th)
+                result = True
+            else:
+                result = True
+        # except failed to get exit code? failed to get module handle?
+        finally:
+            win32api.CloseHandle(dupproc)
+        return result
+    else:
+        return proc.kill()
diff --git a/contrib/testbed_cleanup.sh b/contrib/scripts/testbed_cleanup.sh
index 57413fba0..57413fba0 100755
--- a/contrib/testbed_cleanup.sh
+++ b/contrib/scripts/testbed_cleanup.sh
diff --git a/doc/hacks.el b/contrib/scripts/texinfo-hacks.el
index 9f271b3af..bfb5c98fa 100644
--- a/doc/hacks.el
+++ b/contrib/scripts/texinfo-hacks.el
@@ -1,6 +1,7 @@
 ;;;; hacks.el --- a few functions to help me work on the manual
 ;;;; Jim Blandy <jimb@red-bean.com> --- October 1998
 ;;;; -- imported from https://git.savannah.gnu.org/cgit/guile.git/tree/doc/hacks.el
+;;;; This code should be covered by the same license as GNU Guile (GPL3).
 
 (defun jh-exemplify-region (start end)
   (interactive "r")
diff --git a/contrib/visualize_stats.sh b/contrib/scripts/visualize_stats.sh
index aaa5e657b..aaa5e657b 100755
--- a/contrib/visualize_stats.sh
+++ b/contrib/scripts/visualize_stats.sh
diff --git a/contrib/zonewalk-to-types.sh b/contrib/scripts/zonewalk-to-types.sh
index c453702e6..dfe15a8e3 100755
--- a/contrib/zonewalk-to-types.sh
+++ b/contrib/scripts/zonewalk-to-types.sh
@@ -10,10 +10,10 @@ NUM_CLIENTS=3
 # FILE ($1) contains results from DNS lookup; strip
 # everything but the hostnames, remove duplicates
 # and then randomize the order.
-cat $1 | awk '{print $1}' | sort | uniq | shuf > $1.tmp
+cat $1 | grep -v SOA | awk '{print $1}' | sort | uniq | shuf > $1.tmp
 TOTAL=`cat $1.tmp | wc -l`
-GROUP_SIZE=`expr $TOTAL / \( $NUM_TYPES + 1 \)`
-
+GROUP_SIZE=`expr $TOTAL / \( $NUM_CLIENTS + 1 \)`
+echo "Creating $NUM_CLIENTS benchmark sets with 2x $GROUP_SIZE entries each."
 # First group (0) is to be shared among all clients
 for i in `seq 1 $NUM_CLIENTS`
 do
@@ -21,7 +21,7 @@ do
 done
 
 # Second group (1) is unique per client
-OFF=0
+OFF=$GROUP_SIZE
 for i in `seq 1 $NUM_CLIENTS`
 do
   END=`expr $OFF + $GROUP_SIZE`
diff --git a/contrib/terminate.py.in b/contrib/terminate.py.in
deleted file mode 100644
index 4a6719f38..000000000
--- a/contrib/terminate.py.in
+++ /dev/null
@@ -1,64 +0,0 @@
-#!@PYTHON@
-#    This file is part of GNUnet.
-#    (C) 2011 Christian Grothoff (and other contributing authors)
-#
-#    GNUnet is free software; you can redistribute it and/or modify
-#    it under the terms of the GNU General Public License as published
-#    by the Free Software Foundation; either version 2, or (at your
-#    option) any later version.
-#
-#    GNUnet is distributed in the hope that it will be useful, but
-#    WITHOUT ANY WARRANTY; without even the implied warranty of
-#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-#    General Public License for more details.
-#
-#    You should have received a copy of the GNU General Public License
-#    along with GNUnet; see the file COPYING.  If not, write to the
-#    Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-#    Boston, MA 02110-1301, USA.
-#
-# Utility module that implements safe process termination for W32.
-# For other platforms it's equivalent to Popen.kill ()
-# Requires pywin32 on W32.
-
-import sys
-import os
-import subprocess
-if os.name == 'nt':
-  import win32api
-  import win32process
-
-class dummyobj (object):
-  pass
-
-def safe_terminate_process_by_pid (pid, code):
-  if os.name == 'nt':
-    p = dummyobj ()
-    p._handle = win32api.OpenProcess (2 | 1024 | 8 | 32 | 16, 0, pid)
-    result = safe_terminate_process (p, code)
-    win32api.CloseHandle (p._handle)
-    return result
-  else:
-    return os.kill (int (pid), SIGKILL)
-
-def safe_terminate_process (proc, code):
-  if os.name == 'nt':
-    cp = win32api.GetCurrentProcess ()
-    result = False
-    dupproc = win32api.DuplicateHandle (cp, proc._handle, cp, 2 | 1024 | 8 | 32 | 16, 0, 0)
-    try:
-      exitcode = win32process.GetExitCodeProcess (dupproc)
-      if exitcode == 0x103:
-        kernel32 = win32api.GetModuleHandle ("kernel32")
-        exitprocess = win32api.GetProcAddress (kernel32, "ExitProcess")
-        th, tid = win32process.CreateRemoteThread (dupproc, None, 0, exitprocess, code, 0)
-        win32api.CloseHandle (th)
-        result = True
-      else:
-        result = True
-    # except failed to get exit code? failed to get module handle?
-    finally:
-      win32api.CloseHandle (dupproc)
-    return result
-  else:
-    return proc.kill ()
diff --git a/contrib/testbed_perfhacks.patch b/contrib/testbed_perfhacks.patch
deleted file mode 100644
index 1ad524a30..000000000
--- a/contrib/testbed_perfhacks.patch
+++ /dev/null
@@ -1,90 +0,0 @@
-Index: src/include/gnunet_constants.h
-===================================================================
---- src/include/gnunet_constants.h      (revision 26030)
-+++ src/include/gnunet_constants.h      (working copy)
-@@ -49,7 +49,7 @@
-  * After how long do we consider a connection to a peer dead
-  * if we don't receive messages from the peer?
-  */
--#define GNUNET_CONSTANTS_IDLE_CONNECTION_TIMEOUT GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MINUTES, 5)
-+#define GNUNET_CONSTANTS_IDLE_CONNECTION_TIMEOUT GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_YEARS, 5)
- 
- /**
-  * How long do we delay reading more from a peer after a quota violation?
-@@ -61,7 +61,7 @@
-  * even if we assume that the service commonly does not
-  * respond instantly (DNS, Database, etc.).
-  */
--#define GNUNET_CONSTANTS_SERVICE_TIMEOUT GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MINUTES, 10)
-+#define GNUNET_CONSTANTS_SERVICE_TIMEOUT GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_YEARS, 10)
- 
- /**
-  * How long do we delay messages to get larger packet sizes (CORKing)?
-Index: src/transport/gnunet-service-transport_neighbours.c
-===================================================================
---- src/transport/gnunet-service-transport_neighbours.c (revision 26030)
-+++ src/transport/gnunet-service-transport_neighbours.c (working copy)
-@@ -65,7 +65,7 @@
-  * send 3 keepalives in each interval, so 3 messages would need to be
-  * lost in a row for a disconnect).
-  */
--#define KEEPALIVE_FREQUENCY GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 100)
-+#define KEEPALIVE_FREQUENCY GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_YEARS, 100)
- 
- /**
-  * How long are we willing to wait for a response from ATS before timing out?
-Index: src/transport/gnunet-service-transport_validation.c
-===================================================================
---- src/transport/gnunet-service-transport_validation.c (revision 26030)
-+++ src/transport/gnunet-service-transport_validation.c (working copy)
-@@ -43,7 +43,7 @@
-  * OTOH, we don't want to spend too much time generating PONG signatures,
-  * so they must have some lifetime to reduce our CPU usage.
-  */
--#define PONG_SIGNATURE_LIFETIME GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_HOURS, 1)
-+#define PONG_SIGNATURE_LIFETIME GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_HOURS, 12)
- 
- /**
-  * After how long do we expire an address in a HELLO that we just
-@@ -58,24 +58,24 @@
-  * we cannot validate (because after this time we can destroy the
-  * validation record).
-  */
--#define UNVALIDATED_PING_KEEPALIVE GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MINUTES, 5)
-+#define UNVALIDATED_PING_KEEPALIVE GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_HOURS, 4)
- 
- /**
-  * How often do we PING an address that we have successfully validated
-  * in the past but are not actively using?  Should be (significantly)
-  * smaller than HELLO_ADDRESS_EXPIRATION.
-  */
--#define VALIDATED_PING_FREQUENCY GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MINUTES, 15)
-+#define VALIDATED_PING_FREQUENCY GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_HOURS, 6)
- 
- /**
-  * How often do we PING an address that we are currently using?
-  */
--#define CONNECTED_PING_FREQUENCY GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MINUTES, 2)
-+#define CONNECTED_PING_FREQUENCY GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_YEARS, 2)
- 
- /**
-  * How much delay is acceptable for sending the PING or PONG?
-  */
--#define ACCEPTABLE_PING_DELAY GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 1)
-+#define ACCEPTABLE_PING_DELAY GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MINUTES, 1)
- 
- /**
-  * Size of the validation map hashmap.
-@@ -745,9 +745,9 @@
- void
- GST_validation_start (unsigned int max_fds)
- {
--       validation_next = GNUNET_TIME_absolute_get();
--       validation_delay.rel_value = (GNUNET_CONSTANTS_IDLE_CONNECTION_TIMEOUT.rel_value) /  max_fds;
--       GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Delay between validations: %u ms\n ", validation_delay.rel_value);
-+  validation_next = GNUNET_TIME_absolute_get();
-+  validation_delay.rel_value = GNUNET_TIME_UNIT_MILLISECONDS.rel_value;
-+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Delay between validations: %u ms\n ", validation_delay.rel_value);
-   validation_map = GNUNET_CONTAINER_multihashmap_create (VALIDATION_MAP_SIZE,
-                                                         GNUNET_NO);
-   pnc = GNUNET_PEERINFO_notify (GST_cfg, &process_peerinfo_hello, NULL);
diff --git a/contrib/testbed_setup_pre_ecc_tree.sh b/contrib/testbed_setup_pre_ecc_tree.sh
deleted file mode 100755
index 4c6920144..000000000
--- a/contrib/testbed_setup_pre_ecc_tree.sh
+++ /dev/null
@@ -1,9 +0,0 @@
-#!/bin/sh
-
-svn up -r26032 
-svn up -r26167 src/nse/
-svn up -r26079 src/include/gnunet_helper_lib.h src/util/helper.c
-svn up -r26219 src/include/gnunet_protocols.h
-svn up src/include/gnunet_testbed_service.h src/testbed/ src/regex/ src/dht/
-svn up contrib
-svn up configure.ac
diff --git a/contrib/testing_hostkeys.ecc b/contrib/testing_hostkeys.ecc
index 23e5d3379..194d0da78 100644
--- a/contrib/testing_hostkeys.ecc
+++ b/contrib/testing_hostkeys.ecc
diff --git a/contrib/transpot_delay.patch b/contrib/transpot_delay.patch
deleted file mode 100644
index 9ba806960..000000000
--- a/contrib/transpot_delay.patch
+++ /dev/null
@@ -1,77 +0,0 @@
-Index: src/transport/gnunet-service-transport_neighbours.c
-===================================================================
---- src/transport/gnunet-service-transport_neighbours.c (revision 27335)
-+++ src/transport/gnunet-service-transport_neighbours.c (working copy)
-@@ -65,7 +65,7 @@
-  * send 3 keepalives in each interval, so 3 messages would need to be
-  * lost in a row for a disconnect).
-  */
--#define KEEPALIVE_FREQUENCY GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 100)
-+#define KEEPALIVE_FREQUENCY GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_YEARS, 100)
- 
- /**
-  * How long are we willing to wait for a response from ATS before timing out?
-Index: src/transport/gnunet-service-transport_validation.c
-===================================================================
---- src/transport/gnunet-service-transport_validation.c (revision 27335)
-+++ src/transport/gnunet-service-transport_validation.c (working copy)
-@@ -42,7 +42,7 @@
-  * OTOH, we don't want to spend too much time generating PONG signatures,
-  * so they must have some lifetime to reduce our CPU usage.
-  */
--#define PONG_SIGNATURE_LIFETIME GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_HOURS, 1)
-+#define PONG_SIGNATURE_LIFETIME GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_HOURS, 12)
- 
- /**
-  * After how long do we expire an address in a HELLO that we just
-@@ -57,24 +57,24 @@
-  * we cannot validate (because after this time we can destroy the
-  * validation record).
-  */
--#define UNVALIDATED_PING_KEEPALIVE GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MINUTES, 5)
-+#define UNVALIDATED_PING_KEEPALIVE GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_HOURS, 4)
- 
- /**
-  * How often do we PING an address that we have successfully validated
-  * in the past but are not actively using?  Should be (significantly)
-  * smaller than HELLO_ADDRESS_EXPIRATION.
-  */
--#define VALIDATED_PING_FREQUENCY GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MINUTES, 15)
-+#define VALIDATED_PING_FREQUENCY GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_HOURS, 6)
- 
- /**
-  * How often do we PING an address that we are currently using?
-  */
--#define CONNECTED_PING_FREQUENCY GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MINUTES, 2)
-+#define CONNECTED_PING_FREQUENCY GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_YEARS, 2)
- 
- /**
-  * How much delay is acceptable for sending the PING or PONG?
-  */
--#define ACCEPTABLE_PING_DELAY GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 1)
-+#define ACCEPTABLE_PING_DELAY GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MINUTES, 1)
- 
- /**
-  * Size of the validation map hashmap.
-Index: src/include/gnunet_constants.h
-===================================================================
---- src/include/gnunet_constants.h      (revision 27335)
-+++ src/include/gnunet_constants.h      (working copy)
-@@ -49,7 +49,7 @@
-  * After how long do we consider a connection to a peer dead
-  * if we don't receive messages from the peer?
-  */
--#define GNUNET_CONSTANTS_IDLE_CONNECTION_TIMEOUT GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MINUTES, 5)
-+#define GNUNET_CONSTANTS_IDLE_CONNECTION_TIMEOUT GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_YEARS, 5)
- 
- /**
-  * How long do we delay reading more from a peer after a quota violation?
-@@ -61,7 +61,7 @@
-  * even if we assume that the service commonly does not
-  * respond instantly (DNS, Database, etc.).
-  */
--#define GNUNET_CONSTANTS_SERVICE_TIMEOUT GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MINUTES, 10)
-+#define GNUNET_CONSTANTS_SERVICE_TIMEOUT GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_YEARS, 10)
- 
- /**
-  * How long do we delay messages to get larger packet sizes (CORKing)?
diff --git a/contrib/log.php b/contrib/web/log.php
index b2ca9ed6c..b2ca9ed6c 100644
--- a/contrib/log.php
+++ b/contrib/web/log.php
diff --git a/doc/Makefile.am b/doc/Makefile.am
index 28db606c5..1070974d1 100644
--- a/doc/Makefile.am
+++ b/doc/Makefile.am
@@ -7,4 +7,4 @@ if !DOCUMENTATION
 endif
 
 EXTRA_DIST =                                                    \
-        outdated-and-old-installation-instructions.txt          
+        outdated-and-old-installation-instructions.txt
diff --git a/doc/documentation/.gitignore b/doc/documentation/.gitignore
index 2e914d9c9..f490c3412 100644
--- a/doc/documentation/.gitignore
+++ b/doc/documentation/.gitignore
@@ -1,2 +1,9 @@
 stamp-1
 version2.texi
+manual
+*.fn
+*.fns
+*.ky
+*.pg
+*.tp
+*.vr
diff --git a/doc/documentation/README.txt b/doc/documentation/README.txt
deleted file mode 100644
index 9e76394c3..000000000
--- a/doc/documentation/README.txt
+++ /dev/null
@@ -1,63 +0,0 @@
-* Completion Levels:
-
-** chapters/philosophy: around 100% fixed after initial export.
-
-* What's left to do
-
-- Which Texlive modules are needed? Decrease the size.
-  - distro specific, or can we set requirements?
-- Update the content of gnunet documentation.
-- XXX: images are only generated for the html documentation
-  with gendoc.sh … FIXME!
-- XXX: png,dot, and svg images MUST be converted to eps by the
-  build system. Right now they aren't, as a result: No images.
-
-* How to use (hack) on this
-
-** with guix
-
-Adjust accordingly, ie read the Guix Documentation:
-setenv GUIX_PACKAGE_PATH "gnunet/contrib/packages/guix/packages"
-guix environment gnunet-doc
-and
-guix build -f contrib/packages/guix/gnunet-doc.scm
-
-** without guix
-
-You need to have Texinfo and Texlive in your path.
-sh bootstrap
-./configure --enable-documentation
-cd doc
-make (format you want)
-
-for example: make html, make info, make pdf
-
-* structure (relations)
-
-** gnunet.texi
- -> chapters/developer.texi
- -> chapters/installation.texi
- -> chapters/philosophy.texi
- -> chapters/user.texi
- -> chapters/vocabulary.texi
- -> images/*
- -> gpl-3.0.texi
- -> fdl-1.3.texi
-
-** gnunet-c-tutorial.texi
- -> figs/Service.pdf
- -> figs/System.pdf
- -> tutorial-examples/*.c
- -> gpl-3.0.texi
- -> fdl-1.3.texi
-
-- gnunet-c-tutorial-v1.pdf: original LaTeX "gnunet-c-tutorial.pdf".
-- man folder: the man pages.
-- doxygen folder
-- outdated-and-old-installation-instructions.txt: self described within the file.
-
-
-Use `gendocs', add to the manual/ directory of the web site.
-
-  $ cd doc
-  $ gendocs.sh gnunet "GNUnet 0.10.X Reference Manual"
diff --git a/doc/documentation/TODO b/doc/documentation/TODO
new file mode 100644
index 000000000..fa1ce7a23
--- /dev/null
+++ b/doc/documentation/TODO
@@ -0,0 +1,106 @@
+-*- mode: org -*-
+
+TODO - or: the Documentation Masterplan.
+
+To some extent this duplicates the Mantis tickets on this topic.
+
+* Motivation
+My motivation is to read into good documentations and create a self-contained collection of books,
+which can be understood without expecting too much background knowledge in every topic.
+** User Handbook:
+The content of the User book should be mostly concerned with our current and future graphical (gtk
+as well as terminal user interface) applications. After reading Preface and maybe Philosophy, the
+person reading the User Handbook should understand with the least possible strugle the application
+they intend to use. Examples should be given and concepts explained.
+** Installation Handbook:
+As seen with requests on the mailinglist, we will have to pick up people where they are, similar
+to the User Handbook. People already used to compiling and installing should have the chance to
+skip to the end, everyone else should: have step-by-step instructions, which will either already
+include OS specific notes or will be followed by OS specific instructions. It is up for discussion
+if configuring GNUnet is 'User Handbook' or 'Installation Handbook', the current mixture in
+the Installation Handbook is not good.
+** Contributors Handbook:
+This chapter could either be reduced to a couple of sections following the theme of 'contributing
+to GNUnet' or the chapter could be extended. If we extend it, we should explain a range of topics
+that can be useful for contributors. It can be understood as a recommended reading in addition to
+the Developer Handbook then, and the Developer Handbook could simply become a better commented
+reference for the code-base.
+** Developer Handbook:
+As outlined in the last sentences, the Developer Handbook could be reduced to the necessary bits
+with enough comments to be understood without reading into the papers published over the years.
+
+
+* DONE 1. Drupal books export to LaTeX.
+* DONE 2. LaTeX conversion to Texinfo.
+* DONE 3. (initial) Fixup of syntax errors introduced in conversion chain.
+* TODO 4. Update content.
+* TODO 5. Create API Reference or similar
+* TODO 6. Create Concept Index
+* TODO 7. Create Procedure Index
+* TODO 8. Create Type Index
+* TODO 9. Create Functions Index
+* TODO 10. Properly address concerns and criticism people had/have on the old and current documentation.
+* TODO 11. Reorder structure
+* TODO more TODO.
+
+
+* Status Progress / Completion Levels
+
+** chapters/philosophy: around 100% fixed after initial export.
+
+* System Integration Tasks
+
+* Which Texlive modules are needed for every output we generate?
+* Generate the images from their dot sources.
+
+* How to use (hack) on this
+
+This section will find its way into the documentation sooner or later.
+Potentially outdated or inaccurate bits.
+
+** with guix
+
+Adjust accordingly, ie read the Guix Documentation:
+guix environment gnunet-doc
+and
+guix build -f contrib/packages/guix/gnunet-doc.scm
+
+** without guix
+
+You need to have Texinfo and Texlive in your path.
+sh bootstrap
+./configure --enable-documentation
+cd doc
+make (format you want)
+
+for example: make html, make info, make pdf
+
+* structure (relations) (old!)
+
+** gnunet.texi
+ -> chapters/developer.texi
+ -> chapters/installation.texi
+ -> chapters/philosophy.texi
+ -> chapters/user.texi
+ -> chapters/vocabulary.texi
+ -> images/*
+ -> gpl-3.0.texi
+ -> fdl-1.3.texi
+
+** gnunet-c-tutorial.texi
+ -> figs/Service.pdf
+ -> figs/System.pdf
+ -> tutorial-examples/*.c
+ -> gpl-3.0.texi
+ -> fdl-1.3.texi
+
+- gnunet-c-tutorial-v1.pdf: original LaTeX "gnunet-c-tutorial.pdf".
+- man folder: the man pages.
+- doxygen folder
+- outdated-and-old-installation-instructions.txt: self described within the file.
+
+
+Use `gendocs', add to the manual/ directory of the web site.
+
+  $ cd doc
+  $ gendocs.sh gnunet "GNUnet 0.10.X Reference Manual"
diff --git a/doc/documentation/chapters/installation.texi b/doc/documentation/chapters/installation.texi
index f2042033e..665f980be 100644
--- a/doc/documentation/chapters/installation.texi
+++ b/doc/documentation/chapters/installation.texi
@@ -19,6 +19,7 @@ it in the form of new chapters or insightful comments.
 * Build instructions for Debian 7.5::
 * Installing GNUnet from Git on Ubuntu 14.4::
 * Build instructions for Debian 8::
+* Build instructions for macOS::
 @c * Build instructions for OpenBSD 6.2::
 * Outdated build instructions for previous revisions::
 @c * Portable GNUnet::
@@ -1472,6 +1473,59 @@ with the default Sqlite database. Sqlite is usually fine for most
 applications, but MySQL can offer better performance and Postgres better
 resillience.
 
+@node Build instructions for macOS
+@section Build instructions for macOS
+@c FIXME: I -> we
+
+These are the installation guidelines for macOS.
+They were tested on macOS High Sierra.
+
+@menu
+* Installing dependencies::
+* Compile from Source::
+@end menu
+
+@node Installing dependencies
+@subsection Installing dependencies
+
+First, install XCode in the newest version.
+See https://developer.apple.com/xcode/.
+
+Install Homebrew (https://brew.sh) and then install the dependencies listed above.
+If a dependency does not exists in brew, you need to compile it from source.
+
+@example
+# brew install <dependency>
+@end example
+
+@node Compile from Source
+@subsection Compile from Source
+
+Before you start building GNUnet, you need to setup your environment.
+This means that you have to make sure the proper tools are used in the build process.
+For example, after installing texinfo you need to make sure the new texinfo is actually used:
+
+@example
+# echo 'export PATH="/usr/local/opt/texinfo/bin:$PATH"' >> ~/.bash_profile 
+@end example
+
+Note: brew tells you the appropriate command when executing
+
+@example
+# brew info texinfo
+@end example
+
+This may also be necessary for the gettext package.
+
+Before you start compiling, you need to make sure gcc is used and not the clang compile of your macOS system.
+On my system, gcc was actually ``gcc-7'' and gcc pointed to the clang compiler.
+
+@example
+# export CC=gcc-7
+@end example
+
+After this the standard compile instructions apply.
+
 @c @node Build instructions for OpenBSD 6.2
 @c @section Build instructions for OpenBSD 6.2
 
diff --git a/doc/documentation/gnunet-c-tutorial.texi b/doc/documentation/gnunet-c-tutorial.texi
index 7eafa9ea9..0e2adaee7 100644
--- a/doc/documentation/gnunet-c-tutorial.texi
+++ b/doc/documentation/gnunet-c-tutorial.texi
@@ -10,7 +10,7 @@
 @include version2.texi
 
 @copying
-Copyright @copyright{} 2001-2017 GNUnet e.V.
+Copyright @copyright{} 2001-2018 GNUnet e.V.
 
 Permission is granted to copy, distribute and/or modify this document
 under the terms of the GNU Free Documentation License, Version 1.3 or
@@ -68,9 +68,10 @@ dependencies can be found on our website at
 Reference Documentation (GNUnet Handbook).
 
 Please read this tutorial carefully since every single step is
-important and do not hesitate to contact the GNUnet team if you have
-any questions or problems! Check here how to contact the GNUnet
-team: @uref{https://gnunet.org/contact_information}
+important, and do not hesitate to contact the GNUnet team if you have
+any questions or problems! Visit this link in your webbrowser to learn
+how to contact the GNUnet team:
+@uref{https://gnunet.org/contact_information}
 
 @menu
 
@@ -151,7 +152,7 @@ $ gpg --verify-files gnunet-@value{VERSION}.tar.gz.sig
 
 @noindent
 If this command fails because you do not have the required public key,
-then you need to run this command to import it:
+then you need to run the following command to import it:
 
 @example
 $ gpg --keyserver keys.gnupg.net --recv-keys 48426C7E
@@ -167,19 +168,22 @@ revoked}. You will get an error message stating that
 The next release of GNUnet will have a valid signature
 again. We are sorry for the inconvenience this causes.
 Another possible source you could use is our
-"gnunet" git repository which has mandatory signed commits
-by every developer.
+"gnunet" git repository which, since the change from SVN to git in 2016,
+has mandatory signed commits by every developer.
 
-Now you can extract the tarball and rename the resulting
-directory to @file{gnunet} which we will be using in the
-remainder of this document.
+After verifying the signature you can extract the tarball.
+The resulting directory will be renamed to @file{gnunet}, which we will
+be using in the remainder of this document to refer to the
+root of the source directory.
 
 @example
 $ tar xvzf gnunet-@value{VERSION}.tar.gz
 $ mv gnunet-@value{VERSION} gnunet
-$ cd gnunet
 @end example
 
+@c FIXME: This can be irritating for the reader - First we say git should
+@c be avoid unless it is really required, and then we write this
+@c paragraph:
 @noindent
 However, please note that stable versions can be very outdated.
 As a developer you are @b{strongly} encouraged to use the version
@@ -192,32 +196,40 @@ To successfully compile GNUnet, you need the tools to build GNUnet and
 the required dependencies. Please take a look at the
 GNUnet Reference Documentation
 (@pxref{Dependencies, The GNUnet Reference Documentation,, gnunet, The GNUnet Reference Documentation})
-for a list of required dependencies
-and
+for a list of required dependencies and
 (@pxref{Generic installation instructions, The GNUnet Reference Documentation,, gnunet, The GNUnet Reference Documentation})
 read its Installation chapter for specific instructions for
-your operating system.
+your Operating System.
 Please check the notes at the end of the configure process about
 required dependencies.
 
 For GNUnet bootstrapping support and the HTTP(S) plugin you should
 install @uref{https://gnunet.org/gnurl, libgnurl}.
 For the filesharing service you should install at least one of the
-datastore backends. MySQL, SQlite and PostgreSQL are supported.
+datastore backends (MySQL, SQlite and PostgreSQL are supported).
 
 @node Obtaining the latest version from Git
 @section Obtaining the latest version from Git
 
-The latest development version can obtained from our Git repository.
-To obtain the code you need to have @code{Git} installed, which is
-required for obtaining the repository via:
+The latest development version can be obtained from our Git repository.
+To get the code you need to have @code{Git} installed. Usually your
+Operating System package manager should provide a suitable distribution
+of git (otherwise check out Guix or Nix). If you are using an Operating
+System based on Debian's apt:
+
+@example
+$ sudo apt-get install git
+@end example
+
+This is required for obtaining the repository, which is achieved with
+the following command:
 
 @example
 $ git clone https://gnunet.org/git/gnunet
 @end example
 
 @noindent
-After cloning the repository you have to execute the @file{bootstrap}
+After cloning the repository, you have to execute the @file{bootstrap}
 script in the new directory:
 
 @example
@@ -275,6 +287,7 @@ you do not specifiy a prefix, GNUnet is installed in the directory
 to enable verbose logging by adding @code{--enable-logging=verbose}:
 
 @example
+$ export PREFIX=$HOME
 $ ./configure --prefix=$PREFIX --enable-logging
 $ make
 $ make install
@@ -303,11 +316,14 @@ binaries and run GNUnet's self check.
 
 @example
 $ which gnunet-arm
+$PREFIX/bin/gnunet-arm
 @end example
 
 @noindent
-should return $PREFIX/bin/gnunet-arm. It should be located in your
+should return $PREFIX/bin/gnunet-arm (where $PREFIX is the location
+you  have set earlier). It should be located in your
 GNUnet installation and the output should not be empty.
+
 If you see an output like:
 
 @example
@@ -318,9 +334,11 @@ $ which gnunet-arm
 check your PATH variable to ensure GNUnet's @file{bin} directory is
 included.
 
-GNUnet provides tests for all of its subcomponents. Run
+GNUnet provides tests for all of its subcomponents. Assuming you have
+successfully built GNUnet, run
 
 @example
+$ cd gnunet
 $ make check
 @end example
 
@@ -387,7 +405,7 @@ a mesh on top of a DHT).
 @c \end{figure}
 
 The main service implementation runs as a standalone process in the
-operating system and the client code runs as part of the client program,
+Operating System and the client code runs as part of the client program,
 so crashes of a client do not affect the service process or other clients.
 The service and the clients communicate via a message protocol to be
 defined and implemented by the programmer.
diff --git a/guix-env.scm b/guix-env.scm
index 213b2769e..11e5451e2 100644
--- a/guix-env.scm
+++ b/guix-env.scm
@@ -134,8 +134,6 @@
          (modify-phases %standard-phases
            (add-after 'unpack 'patch-bin-sh
              (lambda _
-               (substitute* "bootstrap"
-                 (("contrib/pogen.sh") "sh contrib/pogen.sh"))
                (for-each (lambda (f) (chmod f #o755))
                          (find-files "po" ""))
                #t))
diff --git a/pkgconfig/gnunetgns.pc.in b/pkgconfig/gnunetgns.pc.in
index fa0f8eac8..f7e7c6143 100644
--- a/pkgconfig/gnunetgns.pc.in
+++ b/pkgconfig/gnunetgns.pc.in
@@ -8,5 +8,5 @@ Description: Provides API to access the GNUnet Naming System
 URL: http://gnunet.org
 Version: @VERSION@
 Requires:
-Libs: -L${libdir} -lgnunetgns
+Libs: -L${libdir} -lgnunetgns -lgnunetgnsrecord
 Cflags: -I${includedir}
diff --git a/po/POTFILES.in b/po/POTFILES.in
index 50cf97613..120e3be78 100644
--- a/po/POTFILES.in
+++ b/po/POTFILES.in
@@ -119,7 +119,7 @@ src/dns/gnunet-dns-monitor.c
 src/dns/gnunet-dns-redirector.c
 src/dns/gnunet-helper-dns.c
 src/dns/gnunet-service-dns.c
-src/dns/gnunet-zoneimport.c
+src/dns/gnunet-zonewalk.c
 src/dns/plugin_block_dns.c
 src/dv/dv_api.c
 src/dv/gnunet-dv.c
@@ -172,6 +172,7 @@ src/gns/gns_api.c
 src/gns/gns_tld_api.c
 src/gns/gnunet-bcd.c
 src/gns/gnunet-dns2gns.c
+src/gns/gnunet-gns-benchmark.c
 src/gns/gnunet-gns-helper-service-w32.c
 src/gns/gnunet-gns-import.c
 src/gns/gnunet-gns-proxy.c
@@ -350,6 +351,8 @@ src/social/gnunet-service-social.c
 src/social/gnunet-social.c
 src/social/social_api.c
 src/sq/sq.c
+src/sq/sq_exec.c
+src/sq/sq_prepare.c
 src/sq/sq_query_helper.c
 src/sq/sq_result_helper.c
 src/statistics/gnunet-service-statistics.c
@@ -454,6 +457,7 @@ src/util/container_multihashmap32.c
 src/util/container_multipeermap.c
 src/util/container_multishortmap.c
 src/util/crypto_abe.c
+src/util/crypto_bug.c
 src/util/crypto_crc.c
 src/util/crypto_ecc.c
 src/util/crypto_ecc_dlog.c
@@ -507,6 +511,7 @@ src/vpn/gnunet-helper-vpn.c
 src/vpn/gnunet-service-vpn.c
 src/vpn/gnunet-vpn.c
 src/vpn/vpn_api.c
+src/zonemaster/gnunet-service-zonemaster-monitor.c
 src/zonemaster/gnunet-service-zonemaster.c
 src/fs/fs_api.h
 src/include/gnunet_common.h
diff --git a/po/update.pl b/po/update.pl.in
index c7c34b612..7b7af52ef 100644
--- a/po/update.pl
+++ b/po/update.pl.in
@@ -1,4 +1,4 @@
-#!/usr/bin/perl -w
+#!@PERL@ -w
 
 #  GNOME po update utility.
 #  (C) 2000 The Free Software Foundation
diff --git a/pre-commit b/pre-commit
index 5213f2cf4..777728a6b 100755
--- a/pre-commit
+++ b/pre-commit
@@ -12,8 +12,8 @@ find $PATHS -name "*.c" -exec indent {} \;
 find $PATHS -name "*.h" -exec indent {} \;
 find $PATHS -name "*.c" -exec indent {} \;
 find $PATHS -name "*.h" -exec indent {} \;
-find $PATHS -name "*.c" -exec contrib/removetrailingwhitespace {} \;
-find $PATHS -name "*.h" -exec contrib/removetrailingwhitespace {} \;
+find $PATHS -name "*.c" -exec contrib/removetrailingwhitespace.py {} \;
+find $PATHS -name "*.h" -exec contrib/removetrailingwhitespace.py {} \;
 if test -x "`which 'dos2unix'`"
 then
   find $PATHS -name "*.c" -exec dos2unix {} \;
diff --git a/src/arm/test_arm_api_data.conf b/src/arm/test_arm_api_data.conf
index 57799ccc8..b032cc95a 100644
--- a/src/arm/test_arm_api_data.conf
+++ b/src/arm/test_arm_api_data.conf
@@ -1,5 +1,5 @@
-@INLINE@ ../../contrib/no_forcestart.conf
-@INLINE@ ../../contrib/no_autostart_above_core.conf
+@INLINE@ ../../contrib/conf/gnunet/no_forcestart.conf
+@INLINE@ ../../contrib/conf/gnunet/no_autostart_above_core.conf
 
 [PATHS]
 GNUNET_TEST_HOME = $GNUNET_TMP/test-gnunet-arm/
diff --git a/src/arm/test_gnunet_arm.py.in b/src/arm/test_gnunet_arm.py.in
index cdd69251b..10bb58a9c 100644
--- a/src/arm/test_gnunet_arm.py.in
+++ b/src/arm/test_gnunet_arm.py.in
@@ -7,100 +7,107 @@ import re
 import subprocess
 import time
 
+# FIXME: There's too much repetition, move generally used parts into reusable modules.
 if os.name == "nt":
-  tmp = os.getenv ("TEMP")
+    tmp = os.getenv("TEMP")
 else:
-  tmp = "/tmp"
+    tmp = "/tmp"
 
 if os.name == 'nt':
-  st = 'gnunet-statistics.exe'
-  arm = './gnunet-arm.exe'
+    st = 'gnunet-statistics.exe'
+    arm = './gnunet-arm.exe'
 else:
-  st = 'gnunet-statistics'
-  arm = './gnunet-arm'
+    st = 'gnunet-statistics'
+    arm = './gnunet-arm'
 
 run_arm = [arm, '-c', 'test_arm_api_data.conf', '--no-stdout', '--no-stderr']
-debug = os.getenv ('DEBUG')
+debug = os.getenv('DEBUG')
 if debug:
-  run_arm += [debug.split (' ')]
-
-def cleanup ():
-  shutil.rmtree (os.path.join (tmp, "test-gnunetd-arm"), True)
-
-def sub_run (args, want_stdo = True, want_stde = False, nofail = False):
-  if want_stdo:
-    stdo = subprocess.PIPE
-  else:
-    stdo = None
-  if want_stde:
-    stde = subprocess.PIPE
-  else:
-    stde = None
-  p = subprocess.Popen (args, stdout = stdo, stderr = stde)
-  stdo, stde = p.communicate ()
-  if not nofail:
-    if p.returncode != 0:
-      sys.exit (p.returncode)
-  return (p.returncode, stdo, stde)
-
-def fail (result):
-  print (result)
-  r_arm (['-e'], want_stdo = False)
-  sys.exit (1)
-
-
-def end_arm_failer (command, rc, stdo, stde, normal):
-  if normal:
-    if rc != 0:
-      fail ("FAIL: error running {}\nCommand output was:\n{}\n{}".format (command, stdo, stde))
-  else:
-    if rc == 0:
-      fail ("FAIL: expected error while running {}\nCommand output was:\n{}\n{}".format (command, stdo, stde))
-
-def print_only_failer (command, rc, stdo, stde, normal):
-  if normal:
-    if rc != 0:
-      print ("FAIL: error running {}\nCommand output was:\n{}\n{}".format (command, stdo, stde))
-      sys.exit (1)
-  else:
-    if rc == 0:
-      print ("FAIL: expected error while running {}\nCommand output was:\n{}\n{}".format (command, stdo, stde))
-      sys.exit (1)
-
-
-def r_something (to_run, extra_args, failer = None, normal = True, **kw):
-  rc, stdo, stde = sub_run (to_run + extra_args, nofail = True, want_stde = True, **kw)
-  if failer is not None:
-    failer (to_run + extra_args, rc, stdo, stde, normal)
-  return (rc, stdo, stde)
-
-def r_arm (extra_args, **kw):
-  return r_something (run_arm, extra_args, **kw)
-
-cleanup ()
-
-print ("TEST: Bad argument checking...", end='')
-r_arm (['-x'], normal = False, failer = print_only_failer)
-print ("PASS")
-
-print ("TEST: Start ARM...", end='')
-r_arm (['-s'], failer = print_only_failer)
-time.sleep (1)
-print ("PASS")
-
-print ("TEST: Start another service...", end='')
-r_arm (['-i', 'resolver'], failer = end_arm_failer)
-time.sleep (1)
-print ("PASS")
-
-print ("TEST: Stop a service...", end='')
-r_arm (['-k', 'resolver'], failer = end_arm_failer)
-time.sleep (1)
-print ("PASS")
-
-print ("TEST: Stop ARM...", end='')
-r_arm (['-e'], failer = print_only_failer)
-time.sleep (1)
-print ("PASS")
-
-cleanup ()
+    run_arm += [debug.split(' ')]
+
+
+def cleanup():
+    shutil.rmtree(os.path.join(tmp, "test-gnunetd-arm"), True)
+
+
+def sub_run(args, want_stdo=True, want_stde=False, nofail=False):
+    if want_stdo:
+        stdo = subprocess.PIPE
+    else:
+        stdo = None
+    if want_stde:
+        stde = subprocess.PIPE
+    else:
+        stde = None
+    p = subprocess.Popen(args, stdout=stdo, stderr=stde)
+    stdo, stde = p.communicate()
+    if not nofail:
+        if p.returncode != 0:
+            sys.exit(p.returncode)
+    return (p.returncode, stdo, stde)
+
+
+def fail(result):
+    print(result)
+    r_arm(['-e'], want_stdo=False)
+    sys.exit(1)
+
+
+def end_arm_failer(command, rc, stdo, stde, normal):
+    if normal:
+        if rc != 0:
+            fail("FAIL: error running {}\nCommand output was:\n{}\n{}".format(command, stdo, stde))
+    else:
+        if rc == 0:
+            fail("FAIL: expected error while running {}\nCommand output was:\n{}\n{}".format(command, stdo, stde))
+
+
+def print_only_failer(command, rc, stdo, stde, normal):
+    if normal:
+        if rc != 0:
+            print("FAIL: error running {}\nCommand output was:\n{}\n{}".format(command, stdo, stde))
+            sys.exit(1)
+    else:
+        if rc == 0:
+            print("FAIL: expected error while running {}\nCommand output was:\n{}\n{}".format(command, stdo, stde))
+            sys.exit(1)
+
+
+def r_something(to_run, extra_args, failer=None, normal=True, **kw):
+    rc, stdo, stde = sub_run(to_run + extra_args, nofail=True, want_stde=True, **kw)
+    if failer is not None:
+        failer(to_run + extra_args, rc, stdo, stde, normal)
+    return (rc, stdo, stde)
+
+
+def r_arm(extra_args, **kw):
+    return r_something(run_arm, extra_args, **kw)
+
+
+cleanup()
+
+print("TEST: Bad argument checking...", end='')
+r_arm(['-x'], normal=False, failer=print_only_failer)
+print("PASS")
+
+print("TEST: Start ARM...", end='')
+r_arm(['-s'], failer=print_only_failer)
+time.sleep(1)
+print("PASS")
+
+print("TEST: Start another service...", end='')
+r_arm(['-i', 'resolver'], failer=end_arm_failer)
+time.sleep(1)
+print("PASS")
+
+print("TEST: Stop a service...", end='')
+r_arm(['-k', 'resolver'], failer=end_arm_failer)
+time.sleep(1)
+print("PASS")
+
+print("TEST: Stop ARM...", end='')
+r_arm(['-e'], failer=print_only_failer)
+time.sleep(1)
+print("PASS")
+
+cleanup()
diff --git a/src/ats-tests/template_perf_ats.conf b/src/ats-tests/template_perf_ats.conf
index 9d320c3dd..74f608bfb 100644
--- a/src/ats-tests/template_perf_ats.conf
+++ b/src/ats-tests/template_perf_ats.conf
@@ -1,4 +1,4 @@
-@INLINE@ ../../contrib/no_forcestart.conf
+@INLINE@ ../../contrib/conf/gnunet/no_forcestart.conf
 
 [testbed]
 # How long should operations wait?
diff --git a/src/ats/test_ats_api.conf b/src/ats/test_ats_api.conf
index e0cb495c8..d45e84d18 100644
--- a/src/ats/test_ats_api.conf
+++ b/src/ats/test_ats_api.conf
@@ -1,4 +1,4 @@
-@INLINE@ ../../contrib/no_forcestart.conf
+@INLINE@ ../../contrib/conf/gnunet/no_forcestart.conf
 
 [PATHS]
 GNUNET_TEST_HOME = $GNUNET_TMP/test-ats-api-scheduling/
diff --git a/src/ats/test_ats_api_delayed.conf b/src/ats/test_ats_api_delayed.conf
index f4d771448..3aac88cf9 100644
--- a/src/ats/test_ats_api_delayed.conf
+++ b/src/ats/test_ats_api_delayed.conf
@@ -1,4 +1,4 @@
-@INLINE@ ../../contrib/no_forcestart.conf
+@INLINE@ ../../contrib/conf/gnunet/no_forcestart.conf
 
 [PATHS]
 GNUNET_TEST_HOME = $GNUNET_TMP/test-ats-api-scheduling/
diff --git a/src/ats/test_ats_api_mlp.conf b/src/ats/test_ats_api_mlp.conf
index 6a8e24177..d5f05a3c4 100644
--- a/src/ats/test_ats_api_mlp.conf
+++ b/src/ats/test_ats_api_mlp.conf
@@ -1,4 +1,4 @@
-@INLINE@ ../../contrib/no_forcestart.conf
+@INLINE@ ../../contrib/conf/gnunet/no_forcestart.conf
 
 [PATHS]
 GNUNET_TEST_HOME = $GNUNET_TMP/test-ats-mlp/
diff --git a/src/ats/test_ats_api_proportional.conf b/src/ats/test_ats_api_proportional.conf
index e121c14ea..21f8218ee 100644
--- a/src/ats/test_ats_api_proportional.conf
+++ b/src/ats/test_ats_api_proportional.conf
@@ -1,4 +1,4 @@
-@INLINE@ ../../contrib/no_forcestart.conf
+@INLINE@ ../../contrib/conf/gnunet/no_forcestart.conf
 
 [PATHS]
 GNUNET_TEST_HOME = $GNUNET_TMP/test-ats-proportional/
diff --git a/src/ats/test_ats_api_ril.conf b/src/ats/test_ats_api_ril.conf
index d6f4f6101..5f5fb006b 100644
--- a/src/ats/test_ats_api_ril.conf
+++ b/src/ats/test_ats_api_ril.conf
@@ -1,4 +1,4 @@
-@INLINE@ ../../contrib/no_forcestart.conf
+@INLINE@ ../../contrib/conf/gnunet/no_forcestart.conf
 
 [PATHS]
 GNUNET_TEST_HOME = $GNUNET_TMP/test-ats-ril/
diff --git a/src/ats/test_ats_solver_default.conf b/src/ats/test_ats_solver_default.conf
index e419c8f35..2d8927abd 100644
--- a/src/ats/test_ats_solver_default.conf
+++ b/src/ats/test_ats_solver_default.conf
@@ -1,2 +1,2 @@
-@INLINE@ ../../contrib/no_forcestart.conf
+@INLINE@ ../../contrib/conf/gnunet/no_forcestart.conf
 
diff --git a/src/cadet/cadet_api.c b/src/cadet/cadet_api.c
index 3c142a95c..59f0bfe85 100644
--- a/src/cadet/cadet_api.c
+++ b/src/cadet/cadet_api.c
@@ -464,6 +464,10 @@ cadet_mq_send_now (void *cls)
   }
   ch->allow_send--;
   ch->pending_env = NULL;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Sending message on channel %s to CADET, new window size is %u\n",
+              GNUNET_i2s (&ch->peer),
+              ch->allow_send);
   GNUNET_MQ_send (ch->cadet->mq,
                   env);
   GNUNET_MQ_impl_send_continue (ch->mq);
@@ -781,6 +785,11 @@ handle_local_ack (void *cls,
     return;
   }
   ch->allow_send++;
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Got an ACK on mq channel %X (peer %s); new window size is %u!\n",
+       ntohl (ch->ccn.channel_of_client),
+       GNUNET_i2s (&ch->peer),
+       ch->allow_send);
   if (NULL == ch->pending_env)
   {
     LOG (GNUNET_ERROR_TYPE_DEBUG,
@@ -792,9 +801,6 @@ handle_local_ack (void *cls,
   }
   if (NULL != ch->mq_cont)
     return; /* already working on it! */
-  LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "Got an ACK on mq channel %X, sending pending message!\n",
-       ntohl (ch->ccn.channel_of_client));
   ch->mq_cont
     = GNUNET_SCHEDULER_add_now (&cadet_mq_send_now,
                                 ch);
@@ -992,6 +998,7 @@ check_get_tunnels (void *cls,
 {
   size_t esize;
 
+  (void) cls;
   esize = ntohs (message->size);
   if (sizeof (struct GNUNET_CADET_LocalInfoTunnel) == esize)
     return GNUNET_OK;
@@ -1051,6 +1058,7 @@ check_get_tunnel (void *cls,
   size_t esize;
   size_t msize;
 
+  (void) cls;
   /* Verify message sanity */
   msize = ntohs (msg->header.size);
   esize = sizeof (struct GNUNET_CADET_LocalInfoTunnel);
@@ -1096,7 +1104,6 @@ handle_get_tunnel (void *cls,
 
   if (NULL == h->info_cb.tunnel_cb)
     return;
-
   ch_n = ntohl (msg->channels);
   c_n = ntohl (msg->connections);
 
@@ -1191,13 +1198,8 @@ destroy_channel_cb (void *cls,
   /* struct GNUNET_CADET_Handle *handle = cls; */
   struct GNUNET_CADET_Channel *ch = value;
 
-  if (ntohl (ch->ccn.channel_of_client) >= GNUNET_CADET_LOCAL_CHANNEL_ID_CLI)
-  {
-    GNUNET_break (0);
-    LOG (GNUNET_ERROR_TYPE_DEBUG,
-         "channel %X not destroyed\n",
-         ntohl (ch->ccn.channel_of_client));
-  }
+  (void) cls;
+  (void) cid;
   GNUNET_log (GNUNET_ERROR_TYPE_INFO,
               "Destroying channel due to GNUNET_CADET_disconnect()\n");
   destroy_channel (ch);
@@ -1222,6 +1224,7 @@ destroy_port_cb (void *cls,
   /* struct GNUNET_CADET_Handle *handle = cls; */
   struct GNUNET_CADET_Port *port = value;
 
+  (void) cls;
   /* This is a warning, the app should have cleanly closed all open ports */
   GNUNET_break (0);
   GNUNET_CADET_close_port (port);
diff --git a/src/cadet/cadet_protocol.h b/src/cadet/cadet_protocol.h
index de0cec5d0..d4a40f9e5 100644
--- a/src/cadet/cadet_protocol.h
+++ b/src/cadet/cadet_protocol.h
@@ -28,6 +28,14 @@
 #ifndef CADET_PROTOCOL_H_
 #define CADET_PROTOCOL_H_
 
+/**
+ * At best, enable when debugging #5328!
+ */
+#define DEBUG_KX 0
+#if DEBUG_KX
+#warning NEVER run this in production! KX debugging is on!
+#endif
+
 #include "platform.h"
 #include "gnunet_util_lib.h"
 #include "cadet.h"
@@ -234,6 +242,22 @@ struct GNUNET_CADET_TunnelKeyExchangeMessage
    */
   struct GNUNET_CRYPTO_EcdhePublicKey ephemeral_key;
 
+#if DEBUG_KX
+  /**
+   * Sender's ephemeral public ECC key encoded in a
+   * format suitable for network transmission, as created
+   * using 'gcry_sexp_sprint'.
+   */
+  struct GNUNET_CRYPTO_EcdhePrivateKey ephemeral_key_XXX; // for debugging KX-crypto!
+
+  /**
+   * Sender's ephemeral public ECC key encoded in a
+   * format suitable for network transmission, as created
+   * using 'gcry_sexp_sprint'.
+   */
+  struct GNUNET_CRYPTO_EddsaPrivateKey private_key_XXX; // for debugging KX-crypto!
+#endif
+
   /**
    * Sender's next ephemeral public ECC key encoded in a
    * format suitable for network transmission, as created
@@ -256,6 +280,15 @@ struct GNUNET_CADET_TunnelKeyExchangeAuthMessage
    */
   struct GNUNET_CADET_TunnelKeyExchangeMessage kx;
 
+#if DEBUG_KX
+  /**
+   * Received ephemeral public ECC key encoded in a
+   * format suitable for network transmission, as created
+   * using 'gcry_sexp_sprint'.
+   */
+  struct GNUNET_CRYPTO_EcdhePublicKey r_ephemeral_key_XXX; // for debugging KX-crypto!
+#endif
+
   /**
    * KDF-proof that sender could compute the 3-DH, used in lieu of a
    * signature or payload data.
diff --git a/src/cadet/cadet_test_lib.c b/src/cadet/cadet_test_lib.c
index 20ef028b2..0efb81ab4 100644
--- a/src/cadet/cadet_test_lib.c
+++ b/src/cadet/cadet_test_lib.c
@@ -110,7 +110,7 @@ struct GNUNET_CADET_TEST_AdapterContext
    * Port handlers for open ports.
    */
   struct GNUNET_CADET_Port **ports;
- 
+
   /**
    * General context.
    */
@@ -135,14 +135,13 @@ cadet_connect_adapter (void *cls,
   struct GNUNET_CADET_TEST_AdapterContext *actx = cls;
   struct GNUNET_CADET_TEST_Context *ctx = actx->ctx;
   struct GNUNET_CADET_Handle *h;
-  unsigned int i;
 
   h = GNUNET_CADET_connect (cfg);
   if (NULL == ctx->ports)
     return h;
-
-  actx->ports = GNUNET_new_array (ctx->port_count, struct GNUNET_CADET_Port *);
-  for (i = 0; i < ctx->port_count; i++)
+  actx->ports = GNUNET_new_array (ctx->port_count,
+                                  struct GNUNET_CADET_Port *);
+  for (unsigned int i = 0; i < ctx->port_count; i++)
   {
     actx->ports[i] = GNUNET_CADET_open_port (h,
                                              ctx->ports[i],
@@ -165,14 +164,14 @@ cadet_connect_adapter (void *cls,
  */
 static void
 cadet_disconnect_adapter (void *cls,
-                         void *op_result)
+                          void *op_result)
 {
   struct GNUNET_CADET_Handle *cadet = op_result;
   struct GNUNET_CADET_TEST_AdapterContext *actx = cls;
 
   if (NULL != actx->ports)
   {
-    for (int i = 0; i < actx->ctx->port_count; i++)
+    for (unsigned int i = 0; i < actx->ctx->port_count; i++)
     {
       GNUNET_CADET_close_port (actx->ports[i]);
       actx->ports[i] = NULL;
@@ -201,22 +200,24 @@ cadet_connect_cb (void *cls,
                  const char *emsg)
 {
   struct GNUNET_CADET_TEST_Context *ctx = cls;
-  unsigned int i;
 
   if (NULL != emsg)
   {
-    fprintf (stderr, "Failed to connect to CADET service: %s\n",
+    fprintf (stderr,
+             "Failed to connect to CADET service: %s\n",
              emsg);
     GNUNET_SCHEDULER_shutdown ();
     return;
   }
-  for (i = 0; i < ctx->num_peers; i++)
+  for (unsigned int i = 0; i < ctx->num_peers; i++)
     if (op == ctx->ops[i])
     {
       ctx->cadets[i] = ca_result;
-      GNUNET_log (GNUNET_ERROR_TYPE_INFO, "...cadet %u connected\n", i);
+      GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                  "...cadet %u connected\n",
+                  i);
     }
-  for (i = 0; i < ctx->num_peers; i++)
+  for (unsigned int i = 0; i < ctx->num_peers; i++)
     if (NULL == ctx->cadets[i])
       return; /* still some CADET connections missing */
   /* all CADET connections ready! */
@@ -231,9 +232,7 @@ cadet_connect_cb (void *cls,
 void
 GNUNET_CADET_TEST_cleanup (struct GNUNET_CADET_TEST_Context *ctx)
 {
-  unsigned int i;
-
-  for (i = 0; i < ctx->num_peers; i++)
+  for (unsigned int i = 0; i < ctx->num_peers; i++)
   {
     GNUNET_assert (NULL != ctx->ops[i]);
     GNUNET_TESTBED_operation_done (ctx->ops[i]);
@@ -269,33 +268,37 @@ cadet_test_run (void *cls,
                unsigned int links_failed)
 {
   struct GNUNET_CADET_TEST_Context *ctx = cls;
-  unsigned int i;
 
   if (0 != links_failed)
   {
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Some links failed (%u), ending\n",
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Some links failed (%u), ending\n",
                 links_failed);
     exit (2);
   }
-
   if  (num_peers != ctx->num_peers)
   {
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Peers started %u/%u, ending\n",
-                num_peers, ctx->num_peers);
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Peers started %u/%u, ending\n",
+                num_peers,
+                ctx->num_peers);
     exit (1);
   }
-
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Testbed up, %u peers and %u links\n",
-              num_peers, links_succeeded);
+              num_peers,
+              links_succeeded);
   ctx->peers = peers;
-  for (i = 0; i < num_peers; i++)
+  for (unsigned int i = 0; i < num_peers; i++)
   {
     struct GNUNET_CADET_TEST_AdapterContext *newctx;
+
     newctx = GNUNET_new (struct GNUNET_CADET_TEST_AdapterContext);
     newctx->peer = i;
     newctx->ctx = ctx;
-    GNUNET_log (GNUNET_ERROR_TYPE_INFO, "Connecting to cadet %u\n", i);
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                "Connecting to cadet %u\n",
+                i);
     ctx->ops[i] = GNUNET_TESTBED_service_connect (ctx,
                                                   peers[i],
                                                   "cadet",
@@ -304,7 +307,9 @@ cadet_test_run (void *cls,
                                                   &cadet_connect_adapter,
                                                   &cadet_disconnect_adapter,
                                                   newctx);
-    GNUNET_log (GNUNET_ERROR_TYPE_INFO, "op handle %p\n", ctx->ops[i]);
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                "op handle %p\n",
+                ctx->ops[i]);
   }
 }
 
@@ -340,8 +345,10 @@ GNUNET_CADET_TEST_ruN (const char *testname,
 
   ctx = GNUNET_new (struct GNUNET_CADET_TEST_Context);
   ctx->num_peers = num_peers;
-  ctx->ops = GNUNET_new_array (num_peers, struct GNUNET_TESTBED_Operation *);
-  ctx->cadets = GNUNET_new_array (num_peers, struct GNUNET_CADET_Handle *);
+  ctx->ops = GNUNET_new_array (num_peers,
+                               struct GNUNET_TESTBED_Operation *);
+  ctx->cadets = GNUNET_new_array (num_peers,
+                                  struct GNUNET_CADET_Handle *);
   ctx->app_main = tmain;
   ctx->app_main_cls = tmain_cls;
   ctx->connects = connects;
@@ -352,12 +359,12 @@ GNUNET_CADET_TEST_ruN (const char *testname,
   ctx->port_count = 0;
   while (NULL != ctx->ports[ctx->port_count])
     ctx->port_count++;
-
   GNUNET_TESTBED_test_run (testname,
                            cfgfile,
                            num_peers,
                            0LL, NULL, NULL,
-                           &cadet_test_run, ctx);
+                           &cadet_test_run,
+                           ctx);
 }
 
 /* end of cadet_test_lib.c */
diff --git a/src/cadet/gnunet-service-cadet.c b/src/cadet/gnunet-service-cadet.c
index 20e4c363e..23a4bc247 100644
--- a/src/cadet/gnunet-service-cadet.c
+++ b/src/cadet/gnunet-service-cadet.c
@@ -763,6 +763,7 @@ handle_local_data (void *cls,
                               buf,
                               payload_size))
   {
+    GNUNET_break (0);
     GNUNET_SERVICE_client_drop (c->client);
     return;
   }
diff --git a/src/cadet/gnunet-service-cadet_channel.c b/src/cadet/gnunet-service-cadet_channel.c
index 1a2b32be0..2d8d36c6c 100644
--- a/src/cadet/gnunet-service-cadet_channel.c
+++ b/src/cadet/gnunet-service-cadet_channel.c
@@ -411,7 +411,7 @@ GCCH_2s (const struct CadetChannel *ch)
 
 
 /**
- * Hash the @a port and @a initiator and @a listener to 
+ * Hash the @a port and @a initiator and @a listener to
  * calculate the "challenge" @a h_port we send to the other
  * peer on #GNUNET_MESSAGE_TYPE_CADET_CHANNEL_OPEN.
  *
@@ -1186,7 +1186,7 @@ GCCH_handle_channel_open_ack (struct CadetChannel *ch,
                      port,
                      sizeof (struct GNUNET_HashCode)))
     {
-      /* Other peer failed to provide the right port, 
+      /* Other peer failed to provide the right port,
          refuse connection. */
       GNUNET_break_op (0);
       return;
@@ -1279,8 +1279,7 @@ GCCH_handle_channel_plaintext_data (struct CadetChannel *ch,
   uint32_t delta;
 
   GNUNET_assert (GNUNET_NO == ch->is_loopback);
-  if ( (GNUNET_YES == ch->destroy) &&
-       (NULL == ch->owner) &&
+  if ( (NULL == ch->owner) &&
        (NULL == ch->dest) )
   {
     /* This client is gone, but we still have messages to send to
@@ -1290,8 +1289,9 @@ GCCH_handle_channel_plaintext_data (struct CadetChannel *ch,
          "Dropping incoming payload on %s as this end is already closed\n",
          GCCH_2s (ch));
     /* send back DESTROY notification to stop further retransmissions! */
-    GCT_send_channel_destroy (ch->t,
-                              ch->ctn);
+    if (GNUNET_YES == ch->destroy)
+      GCT_send_channel_destroy (ch->t,
+                                ch->ctn);
     return;
   }
   payload_size = ntohs (msg->header.size) - sizeof (*msg);
@@ -1822,7 +1822,7 @@ GCCH_handle_local_data (struct CadetChannel *ch,
 {
   struct CadetReliableMessage *crm;
 
-  if (ch->pending_messages > ch->max_pending_messages)
+  if (ch->pending_messages >= ch->max_pending_messages)
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
diff --git a/src/cadet/gnunet-service-cadet_connection.c b/src/cadet/gnunet-service-cadet_connection.c
index 82ab5cc2c..9ff62b29f 100644
--- a/src/cadet/gnunet-service-cadet_connection.c
+++ b/src/cadet/gnunet-service-cadet_connection.c
@@ -39,6 +39,13 @@
 
 
 /**
+ * How long do we wait initially before retransmitting the KX?
+ * TODO: replace by 2 RTT if/once we have connection-level RTT data!
+ */
+#define INITIAL_CONNECTION_CREATE_RETRY_DELAY GNUNET_TIME_relative_multiply(GNUNET_TIME_UNIT_MILLISECONDS, 200)
+
+
+/**
  * All the states a connection can be in.
  */
 enum CadetConnectionState
@@ -134,6 +141,16 @@ struct CadetConnection
   struct GNUNET_TIME_Relative retry_delay;
 
   /**
+   * Earliest time for re-trying CREATE
+   */
+  struct GNUNET_TIME_Absolute create_at;
+
+  /**
+   * Earliest time for re-trying CREATE_ACK
+   */
+  struct GNUNET_TIME_Absolute create_ack_at;
+
+  /**
    * Performance metrics for this connection.
    */
   struct CadetConnectionMetrics metrics;
@@ -482,8 +499,9 @@ GCC_latency_observed (const struct GNUNET_CADET_ConnectionTunnelIdentifier *cid,
 
 
 /**
- * A #GNUNET_MESSAGE_TYPE_CADET_CONNECTION_CREATE_ACK was received for this connection, implying
- * that the end-to-end connection is up.  Process it.
+ * A #GNUNET_MESSAGE_TYPE_CADET_CONNECTION_CREATE_ACK was received for
+ * this connection, implying that the end-to-end connection is up.
+ * Process it.
  *
  * @param cc the connection that got the ACK.
  */
@@ -525,6 +543,11 @@ void
 GCC_handle_kx (struct CadetConnection *cc,
                const struct GNUNET_CADET_TunnelKeyExchangeMessage *msg)
 {
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Received KX message with ephermal %s on CC %s in state %d\n",
+       GNUNET_e2s (&msg->ephemeral_key),
+       GNUNET_sh2s (&cc->cid.connection_of_tunnel),
+       cc->state);
   if (CADET_CONNECTION_SENT == cc->state)
   {
     /* We didn't get the CADET_CONNECTION_CREATE_ACK, but instead got payload. That's fine,
@@ -549,6 +572,11 @@ void
 GCC_handle_kx_auth (struct CadetConnection *cc,
                     const struct GNUNET_CADET_TunnelKeyExchangeAuthMessage *msg)
 {
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Received KX AUTH message with ephermal %s on CC %s in state %d\n",
+       GNUNET_e2s (&msg->kx.ephemeral_key),
+       GNUNET_sh2s (&cc->cid.connection_of_tunnel),
+       cc->state);
   if (CADET_CONNECTION_SENT == cc->state)
   {
     /* We didn't get the CADET_CONNECTION_CREATE_ACK, but instead got payload. That's fine,
@@ -601,25 +629,26 @@ send_create (void *cls)
   struct GNUNET_CADET_ConnectionCreateMessage *create_msg;
   struct GNUNET_PeerIdentity *pids;
   struct GNUNET_MQ_Envelope *env;
-  unsigned int path_length;
 
   cc->task = NULL;
   GNUNET_assert (GNUNET_YES == cc->mqm_ready);
-  path_length = GCPP_get_length (cc->path);
   env = GNUNET_MQ_msg_extra (create_msg,
-                             (1 + path_length) * sizeof (struct GNUNET_PeerIdentity),
+                             (2 + cc->off) * sizeof (struct GNUNET_PeerIdentity),
                              GNUNET_MESSAGE_TYPE_CADET_CONNECTION_CREATE);
   create_msg->options = htonl ((uint32_t) cc->options);
   create_msg->cid = cc->cid;
   pids = (struct GNUNET_PeerIdentity *) &create_msg[1];
   pids[0] = my_full_id;
-  for (unsigned int i=0;i<path_length;i++)
+  for (unsigned int i=0;i<=cc->off;i++)
     pids[i + 1] = *GCP_get_id (GCPP_get_peer_at_offset (cc->path,
                                                         i));
   LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "Sending CADET_CONNECTION_CREATE message for %s\n",
-       GCC_2s (cc));
+       "Sending CADET_CONNECTION_CREATE message for %s with %u hops\n",
+       GCC_2s (cc),
+       cc->off + 2);
   cc->env = env;
+  cc->retry_delay = GNUNET_TIME_STD_BACKOFF (cc->retry_delay);
+  cc->create_at = GNUNET_TIME_relative_to_absolute (cc->retry_delay);
   update_state (cc,
                 CADET_CONNECTION_SENT,
                 GNUNET_NO);
@@ -641,7 +670,6 @@ send_create_ack (void *cls)
   struct GNUNET_MQ_Envelope *env;
 
   cc->task = NULL;
-  GNUNET_assert (CADET_CONNECTION_CREATE_RECEIVED == cc->state);
   LOG (GNUNET_ERROR_TYPE_DEBUG,
        "Sending CONNECTION_CREATE_ACK message for %s\n",
        GCC_2s (cc));
@@ -650,9 +678,16 @@ send_create_ack (void *cls)
                        GNUNET_MESSAGE_TYPE_CADET_CONNECTION_CREATE_ACK);
   ack_msg->cid = cc->cid;
   cc->env = env;
-  update_state (cc,
-                CADET_CONNECTION_READY,
-                GNUNET_NO);
+  cc->retry_delay = GNUNET_TIME_STD_BACKOFF (cc->retry_delay);
+  cc->create_ack_at = GNUNET_TIME_relative_to_absolute (cc->retry_delay);
+  if (CADET_CONNECTION_CREATE_RECEIVED == cc->state)
+    update_state (cc,
+                  CADET_CONNECTION_READY,
+                  GNUNET_NO);
+  if (CADET_CONNECTION_READY == cc->state)
+    cc->task = GNUNET_SCHEDULER_add_delayed (keepalive_period,
+                                             &send_keepalive,
+                                             cc);
   GCP_send (cc->mq_man,
             env);
 }
@@ -681,8 +716,9 @@ GCC_handle_duplicate_create (struct CadetConnection *cc)
                   cc->mqm_ready);
     if (NULL != cc->task)
       GNUNET_SCHEDULER_cancel (cc->task);
-    cc->task = GNUNET_SCHEDULER_add_now (&send_create_ack,
-                                         cc);
+    cc->task = GNUNET_SCHEDULER_add_at (cc->create_ack_at,
+                                        &send_create_ack,
+                                        cc);
   }
   else
   {
@@ -721,7 +757,7 @@ manage_first_hop_mq (void *cls,
     update_state (cc,
                   CADET_CONNECTION_NEW,
                   GNUNET_NO);
-    cc->retry_delay = GNUNET_TIME_UNIT_ZERO;
+    cc->retry_delay = INITIAL_CONNECTION_CREATE_RETRY_DELAY;
     if (NULL != cc->task)
     {
       GNUNET_SCHEDULER_cancel (cc->task);
@@ -741,8 +777,9 @@ manage_first_hop_mq (void *cls,
   {
   case CADET_CONNECTION_NEW:
     /* Transmit immediately */
-    cc->task = GNUNET_SCHEDULER_add_now (&send_create,
-                                         cc);
+    cc->task = GNUNET_SCHEDULER_add_at (cc->create_at,
+                                        &send_create,
+                                        cc);
     break;
   case CADET_CONNECTION_SENDING_CREATE:
     /* Should not be possible to be called in this state. */
@@ -750,16 +787,16 @@ manage_first_hop_mq (void *cls,
     break;
   case CADET_CONNECTION_SENT:
     /* Retry a bit later... */
-    cc->retry_delay = GNUNET_TIME_STD_BACKOFF (cc->retry_delay);
-    cc->task = GNUNET_SCHEDULER_add_delayed (cc->retry_delay,
-                                             &send_create,
-                                             cc);
+    cc->task = GNUNET_SCHEDULER_add_at (cc->create_at,
+                                        &send_create,
+                                        cc);
     break;
   case CADET_CONNECTION_CREATE_RECEIVED:
     /* We got the 'CREATE' (incoming connection), should send the CREATE_ACK */
     cc->metrics.age = GNUNET_TIME_absolute_get ();
-    cc->task = GNUNET_SCHEDULER_add_now (&send_create_ack,
-                                         cc);
+    cc->task = GNUNET_SCHEDULER_add_at (cc->create_ack_at,
+                                        &send_create_ack,
+                                        cc);
     break;
   case CADET_CONNECTION_READY:
     if ( (NULL == cc->keepalive_qe) &&
@@ -814,6 +851,8 @@ connection_create (struct CadetPeer *destination,
   cc->state = init_state;
   cc->ct = ct;
   cc->cid = *cid;
+  cc->retry_delay = GNUNET_TIME_relative_multiply (INITIAL_CONNECTION_CREATE_RETRY_DELAY,
+                                                   off);
   GNUNET_assert (GNUNET_OK ==
                  GNUNET_CONTAINER_multishortmap_put (connections,
                                                      &GCC_get_id (cc)->connection_of_tunnel,
@@ -824,9 +863,10 @@ connection_create (struct CadetPeer *destination,
   cc->path = path;
   cc->off = off;
   LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "Creating %s using path %s\n",
+       "Creating %s using path %s (offset: %u)\n",
        GCC_2s (cc),
-       GCPP_2s (path));
+       GCPP_2s (path),
+       off);
   GCPP_add_connection (path,
                        off,
                        cc);
@@ -834,7 +874,6 @@ connection_create (struct CadetPeer *destination,
     GCP_add_connection (GCPP_get_peer_at_offset (path,
                                                  i),
                         cc);
-
   first_hop = GCPP_get_peer_at_offset (path,
                                        0);
   cc->mq_man = GCP_request_mq (first_hop,
@@ -1001,11 +1040,14 @@ GCC_transmit (struct CadetConnection *cc,
  * Obtain the path used by this connection.
  *
  * @param cc connection
+ * @param off[out] set to the length of the path we use
  * @return path to @a cc
  */
 struct CadetPeerPath *
-GCC_get_path (struct CadetConnection *cc)
+GCC_get_path (struct CadetConnection *cc,
+              unsigned int *off)
 {
+  *off = cc->off;
   return cc->path;
 }
 
diff --git a/src/cadet/gnunet-service-cadet_connection.h b/src/cadet/gnunet-service-cadet_connection.h
index fdb184366..1c0475d40 100644
--- a/src/cadet/gnunet-service-cadet_connection.h
+++ b/src/cadet/gnunet-service-cadet_connection.h
@@ -300,10 +300,12 @@ GCC_get_ct (struct CadetConnection *cc);
  * Obtain the path used by this connection.
  *
  * @param cc connection
+ * @param off[out] set to offset in this path where the connection @a cc ends
  * @return path to @a cc
  */
 struct CadetPeerPath *
-GCC_get_path (struct CadetConnection *cc);
+GCC_get_path (struct CadetConnection *cc,
+              unsigned int *off);
 
 
 /**
diff --git a/src/cadet/gnunet-service-cadet_core.c b/src/cadet/gnunet-service-cadet_core.c
index 84aff1857..65738504e 100644
--- a/src/cadet/gnunet-service-cadet_core.c
+++ b/src/cadet/gnunet-service-cadet_core.c
@@ -406,6 +406,28 @@ route_message (struct CadetPeer *prev,
        (NULL != dir->env_head) )
     discard_buffer (dir,
                     dir->env_head);
+  /* Check for duplicates */
+  for (const struct GNUNET_MQ_Envelope *env = dir->env_head;
+       NULL != env;
+       env = GNUNET_MQ_env_next (env))
+  {
+    const struct GNUNET_MessageHeader *hdr = GNUNET_MQ_env_get_msg (env);
+
+    if ( (hdr->size == msg->size) &&
+         (0 == memcmp (hdr,
+                       msg,
+                       ntohs (msg->size))) )
+    {
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "Received duplicate of message already in buffer, dropping\n");
+      GNUNET_STATISTICS_update (stats,
+                                "# messages dropped due to duplicate in buffer",
+                                1,
+                                GNUNET_NO);
+      return;
+    }
+  }
+
   rung = dir->rung;
   if (cur_buffers == max_buffers)
   {
@@ -434,7 +456,7 @@ route_message (struct CadetPeer *prev,
   GNUNET_CONTAINER_DLL_remove (rung->rd_head,
                                rung->rd_tail,
                                dir);
-  /* make 'nxt' point to the next higher rung, creat if necessary */
+  /* make 'nxt' point to the next higher rung, create if necessary */
   nxt = rung->next;
   if ( (NULL == nxt) ||
        (rung->rung_off + 1 != nxt->rung_off) )
@@ -631,7 +653,7 @@ timeout_cb (void *cls)
                                               NULL);
       return;
     }
-    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
                 "Sending BROKEN due to timeout (%s was last use, %s linger)\n",
                 GNUNET_STRINGS_absolute_time_to_string (r->last_use),
                 GNUNET_STRINGS_relative_time_to_string (linger,
@@ -693,7 +715,7 @@ dir_ready_cb (void *cls,
     return;
   }
   odir = (dir == &route->next) ? &route->prev : &route->next;
-  GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Sending BROKEN due to MQ going down\n");
   send_broken (&route->next,
                &route->cid,
@@ -781,31 +803,45 @@ handle_connection_create (void *cls,
   if (0 == path_length)
   {
     LOG (GNUNET_ERROR_TYPE_DEBUG,
-      "Dropping CADET_CONNECTION_CREATE with empty path\n");
+         "Dropping CADET_CONNECTION_CREATE with empty path\n");
     GNUNET_break_op (0);
     return;
   }
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Handling CADET_CONNECTION_CREATE from %s for CID %s with %u hops\n",
+       GCP_2s (sender),
+       GNUNET_sh2s (&msg->cid.connection_of_tunnel),
+       path_length);
   /* Check for loops */
-  struct GNUNET_CONTAINER_MultiPeerMap *map;
-  map = GNUNET_CONTAINER_multipeermap_create (path_length * 2,
-                                              GNUNET_YES);
-  GNUNET_assert (NULL != map);
-  for (off = 0; off < path_length; off++) {
-    if (GNUNET_SYSERR ==
-        GNUNET_CONTAINER_multipeermap_put (map,
-                                           &pids[off],
-                                           NULL,
-                                           GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY)) {
-      /* bogus request */
-      GNUNET_CONTAINER_multipeermap_destroy (map);
+  {
+    struct GNUNET_CONTAINER_MultiPeerMap *map;
+
+    map = GNUNET_CONTAINER_multipeermap_create (path_length * 2,
+                                                GNUNET_YES);
+    GNUNET_assert (NULL != map);
+    for (unsigned int i=0;i<path_length;i++)
+    {
       LOG (GNUNET_ERROR_TYPE_DEBUG,
-        "Dropping CADET_CONNECTION_CREATE with cyclic path\n");
-      GNUNET_break_op (0);
-      return;
+           "CADET_CONNECTION_CREATE has peer %s at offset %u\n",
+           GNUNET_i2s (&pids[i]),
+           i);
+      if (GNUNET_SYSERR ==
+          GNUNET_CONTAINER_multipeermap_put (map,
+                                             &pids[i],
+                                             NULL,
+                                             GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY))
+      {
+        /* bogus request */
+        GNUNET_CONTAINER_multipeermap_destroy (map);
+        LOG (GNUNET_ERROR_TYPE_DEBUG,
+             "Dropping CADET_CONNECTION_CREATE with cyclic path\n");
+        GNUNET_break_op (0);
+        return;
+      }
     }
+    GNUNET_CONTAINER_multipeermap_destroy (map);
   }
-  GNUNET_CONTAINER_multipeermap_destroy (map);
-  /* Initiator is at offset 0. */
+  /* Initiator is at offset 0, find us */
   for (off=1;off<path_length;off++)
     if (0 == memcmp (&my_full_id,
                      &pids[off],
@@ -814,7 +850,7 @@ handle_connection_create (void *cls,
   if (off == path_length)
   {
     LOG (GNUNET_ERROR_TYPE_DEBUG,
-      "Dropping CADET_CONNECTION_CREATE without us in the path\n");
+         "Dropping CADET_CONNECTION_CREATE without us in the path\n");
     GNUNET_break_op (0);
     return;
   }
@@ -823,14 +859,15 @@ handle_connection_create (void *cls,
                          GNUNET_NO))
   {
     LOG (GNUNET_ERROR_TYPE_DEBUG,
-      "Dropping CADET_CONNECTION_CREATE without sender in the path\n");
+         "Dropping CADET_CONNECTION_CREATE without sender at previous hop in the path\n");
     GNUNET_break_op (0);
     return;
   }
   if (NULL !=
-      get_route (&msg->cid))
+      (route = get_route (&msg->cid)))
   {
     /* Duplicate CREATE, pass it on, previous one might have been lost! */
+
     LOG (GNUNET_ERROR_TYPE_DEBUG,
          "Passing on duplicate CADET_CONNECTION_CREATE message on connection %s\n",
          GNUNET_sh2s (&msg->cid.connection_of_tunnel));
@@ -859,7 +896,7 @@ handle_connection_create (void *cls,
     origin = GCP_get (&pids[0],
                       GNUNET_YES);
     LOG (GNUNET_ERROR_TYPE_DEBUG,
-         "Received CADET_CONNECTION_CREATE message from %s for connection %s, building inverse path\n",
+         "I am destination for CADET_CONNECTION_CREATE message from %s for connection %s, building inverse path\n",
          GCP_2s (origin),
          GNUNET_sh2s (&msg->cid.connection_of_tunnel));
     path = GCPP_get_path_from_route (path_length - 1,
@@ -949,6 +986,10 @@ handle_connection_create (void *cls,
                                                                                 3),
                                                  &timeout_cb,
                                                  NULL);
+  /* also pass CREATE message along to next hop */
+  route_message (sender,
+                 &msg->cid,
+                 &msg->header);
 }
 
 
@@ -970,7 +1011,9 @@ handle_connection_create_ack (void *cls,
   if (NULL != cc)
   {
     /* verify ACK came from the right direction */
-    struct CadetPeerPath *path = GCC_get_path (cc);
+    unsigned int len;
+    struct CadetPeerPath *path = GCC_get_path (cc,
+                                               &len);
 
     if (peer !=
         GCPP_get_peer_at_offset (path,
@@ -1014,7 +1057,9 @@ handle_connection_broken (void *cls,
   if (NULL != cc)
   {
     /* verify message came from the right direction */
-    struct CadetPeerPath *path = GCC_get_path (cc);
+    unsigned int len;
+    struct CadetPeerPath *path = GCC_get_path (cc,
+                                               &len);
 
     if (peer !=
         GCPP_get_peer_at_offset (path,
@@ -1063,7 +1108,9 @@ handle_connection_destroy (void *cls,
   if (NULL != cc)
   {
     /* verify message came from the right direction */
-    struct CadetPeerPath *path = GCC_get_path (cc);
+    unsigned int len;
+    struct CadetPeerPath *path = GCC_get_path (cc,
+                                               &len);
 
     if (peer !=
         GCPP_get_peer_at_offset (path,
@@ -1108,11 +1155,19 @@ handle_tunnel_kx (void *cls,
   struct CadetConnection *cc;
 
   /* First, check if message belongs to a connection that ends here. */
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Routing KX with ephemeral %s on CID %s\n",
+       GNUNET_e2s (&msg->ephemeral_key),
+       GNUNET_sh2s (&msg->cid.connection_of_tunnel));
+
+
   cc = GCC_lookup (&msg->cid);
   if (NULL != cc)
   {
     /* verify message came from the right direction */
-    struct CadetPeerPath *path = GCC_get_path (cc);
+    unsigned int len;
+    struct CadetPeerPath *path = GCC_get_path (cc,
+                                               &len);
 
     if (peer !=
         GCPP_get_peer_at_offset (path,
@@ -1152,7 +1207,9 @@ handle_tunnel_kx_auth (void *cls,
   if (NULL != cc)
   {
     /* verify message came from the right direction */
-    struct CadetPeerPath *path = GCC_get_path (cc);
+    unsigned int len;
+    struct CadetPeerPath *path = GCC_get_path (cc,
+                                               &len);
 
     if (peer !=
         GCPP_get_peer_at_offset (path,
@@ -1208,7 +1265,9 @@ handle_tunnel_encrypted (void *cls,
   if (NULL != cc)
   {
     /* verify message came from the right direction */
-    struct CadetPeerPath *path = GCC_get_path (cc);
+    unsigned int len;
+    struct CadetPeerPath *path = GCC_get_path (cc,
+                                               &len);
 
     if (peer !=
         GCPP_get_peer_at_offset (path,
diff --git a/src/cadet/gnunet-service-cadet_paths.c b/src/cadet/gnunet-service-cadet_paths.c
index b443cf9e8..5218d0848 100644
--- a/src/cadet/gnunet-service-cadet_paths.c
+++ b/src/cadet/gnunet-service-cadet_paths.c
@@ -146,7 +146,7 @@ GCPP_add_connection (struct CadetPeerPath *path,
   struct CadetPeerPathEntry *entry;
 
   LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "Adding connection %s to path %s at offset %u\n",
+       "Adding %s to path %s at offset %u\n",
        GCC_2s (cc),
        GCPP_2s (path),
        off);
diff --git a/src/cadet/gnunet-service-cadet_peer.c b/src/cadet/gnunet-service-cadet_peer.c
index 05555e693..35e2c6148 100644
--- a/src/cadet/gnunet-service-cadet_peer.c
+++ b/src/cadet/gnunet-service-cadet_peer.c
@@ -242,12 +242,15 @@ struct CadetPeer
 const char *
 GCP_2s (const struct CadetPeer *cp)
 {
-  static char buf[32];
-
-  GNUNET_snprintf (buf,
-                   sizeof (buf),
-                   "P(%s)",
-                   GNUNET_i2s (&cp->pid));
+  static char buf[5];
+  char *ret;
+
+  ret = GNUNET_CRYPTO_eddsa_public_key_to_string (&cp->pid.public_key);
+  strncpy (buf,
+           ret,
+           sizeof (buf) - 1);
+  GNUNET_free (ret);
+  buf[4] = '\0';
   return buf;
 }
 
@@ -649,6 +652,27 @@ mqm_execute (struct GCP_MessageQueueManager *mqm)
   }
   else
   {
+    {
+      const struct GNUNET_MessageHeader *mh;
+
+      mh = GNUNET_MQ_env_get_msg (mqm->env);
+      switch (ntohs (mh->type))
+      {
+      case GNUNET_MESSAGE_TYPE_CADET_TUNNEL_KX:
+        {
+          const struct GNUNET_CADET_TunnelKeyExchangeMessage *msg
+            = (const struct GNUNET_CADET_TunnelKeyExchangeMessage *) mh;
+          LOG (GNUNET_ERROR_TYPE_DEBUG,
+               "P2P forwarding KX with ephemeral %s to %s on CID %s\n",
+               GNUNET_e2s (&msg->ephemeral_key),
+               GCP_2s (cp),
+               GNUNET_sh2s (&msg->cid.connection_of_tunnel));
+        }
+        break;
+      default:
+        break;
+      }
+    }
     LOG (GNUNET_ERROR_TYPE_DEBUG,
          "Sending to peer %s from MQM %p\n",
          GCP_2s (cp),
@@ -1044,7 +1068,7 @@ GCP_add_connection (struct CadetPeer *cp,
                     struct CadetConnection *cc)
 {
   LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "Adding connection %s to peer %s\n",
+       "Adding %s to peer %s\n",
        GCC_2s (cc),
        GCP_2s (cp));
   GNUNET_assert (GNUNET_OK ==
diff --git a/src/cadet/gnunet-service-cadet_tunnels.c b/src/cadet/gnunet-service-cadet_tunnels.c
index 75d454522..dbd84a818 100644
--- a/src/cadet/gnunet-service-cadet_tunnels.c
+++ b/src/cadet/gnunet-service-cadet_tunnels.c
@@ -1369,6 +1369,15 @@ send_kx (struct CadetTunnel *t,
   msg->cid = *GCC_get_id (cc);
   GNUNET_CRYPTO_ecdhe_key_get_public (&ax->kx_0,
                                       &msg->ephemeral_key);
+#if DEBUG_KX
+  msg->ephemeral_key_XXX = ax->kx_0;
+  msg->private_key_XXX = *my_private_key;
+#endif
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Sending KX message to %s with ephemeral %s on CID %s\n",
+       GCT_2s (t),
+       GNUNET_e2s (&msg->ephemeral_key),
+       GNUNET_sh2s (&msg->cid.connection_of_tunnel));
   GNUNET_CRYPTO_ecdhe_key_get_public (&ax->DHRs,
                                       &msg->ratchet_key);
   mark_connection_unready (ct);
@@ -1435,6 +1444,17 @@ send_kx_auth (struct CadetTunnel *t,
                                       &msg->kx.ephemeral_key);
   GNUNET_CRYPTO_ecdhe_key_get_public (&ax->DHRs,
                                       &msg->kx.ratchet_key);
+#if DEBUG_KX
+  msg->kx.ephemeral_key_XXX = ax->kx_0;
+  msg->kx.private_key_XXX = *my_private_key;
+  msg->r_ephemeral_key_XXX = ax->last_ephemeral;
+#endif
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Sending KX_AUTH message to %s with ephemeral %s on CID %s\n",
+       GCT_2s (t),
+       GNUNET_e2s (&msg->kx.ephemeral_key),
+       GNUNET_sh2s (&msg->kx.cid.connection_of_tunnel));
+
   /* Compute authenticator (this is the main difference to #send_kx()) */
   GNUNET_CRYPTO_hash (&ax->RK,
                       sizeof (ax->RK),
@@ -1705,12 +1725,19 @@ GCT_handle_kx (struct CadetTConnection *ct,
                             "# KX received",
                             1,
                             GNUNET_NO);
-  if (GNUNET_YES == alice_or_bob (GCP_get_id (t->destination)))
+  if (GNUNET_YES ==
+      alice_or_bob (GCP_get_id (t->destination)))
   {
     /* Bob is not allowed to send KX! */
     GNUNET_break_op (0);
     return;
   }
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Received KX message from %s with ephemeral %s from %s on connection %s\n",
+       GCT_2s (t),
+       GNUNET_e2s (&msg->ephemeral_key),
+       GNUNET_i2s (GCP_get_id (t->destination)),
+       GCC_2s (ct->cc));
 #if 1
   if ( (0 ==
         memcmp (&t->ax.DHRr,
@@ -1823,6 +1850,75 @@ GCT_handle_kx (struct CadetTConnection *ct,
 }
 
 
+#if DEBUG_KX
+static void
+check_ee (const struct GNUNET_CRYPTO_EcdhePrivateKey *e1,
+          const struct GNUNET_CRYPTO_EcdhePrivateKey *e2)
+{
+  struct GNUNET_CRYPTO_EcdhePublicKey p1;
+  struct GNUNET_CRYPTO_EcdhePublicKey p2;
+  struct GNUNET_HashCode hc1;
+  struct GNUNET_HashCode hc2;
+
+  GNUNET_CRYPTO_ecdhe_key_get_public (e1,
+                                      &p1);
+  GNUNET_CRYPTO_ecdhe_key_get_public (e2,
+                                      &p2);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_CRYPTO_ecc_ecdh (e1,
+                                         &p2,
+                                         &hc1));
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_CRYPTO_ecc_ecdh (e2,
+                                         &p1,
+                                         &hc2));
+  GNUNET_break (0 == memcmp (&hc1,
+                             &hc2,
+                             sizeof (hc1)));
+}
+
+
+static void
+check_ed (const struct GNUNET_CRYPTO_EcdhePrivateKey *e1,
+          const struct GNUNET_CRYPTO_EddsaPrivateKey *e2)
+{
+  struct GNUNET_CRYPTO_EcdhePublicKey p1;
+  struct GNUNET_CRYPTO_EddsaPublicKey p2;
+  struct GNUNET_HashCode hc1;
+  struct GNUNET_HashCode hc2;
+
+  GNUNET_CRYPTO_ecdhe_key_get_public (e1,
+                                      &p1);
+  GNUNET_CRYPTO_eddsa_key_get_public (e2,
+                                      &p2);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_CRYPTO_ecdh_eddsa (e1,
+                                           &p2,
+                                           &hc1));
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_CRYPTO_eddsa_ecdh (e2,
+                                           &p1,
+                                           &hc2));
+  GNUNET_break (0 == memcmp (&hc1,
+                             &hc2,
+                             sizeof (hc1)));
+}
+
+
+static void
+test_crypto_bug (const struct GNUNET_CRYPTO_EcdhePrivateKey *e1,
+                 const struct GNUNET_CRYPTO_EcdhePrivateKey *e2,
+                 const struct GNUNET_CRYPTO_EddsaPrivateKey *d1,
+                 const struct GNUNET_CRYPTO_EddsaPrivateKey *d2)
+{
+  check_ee (e1, e2);
+  check_ed (e1, d2);
+  check_ed (e2, d1);
+}
+
+#endif
+
+
 /**
  * Handle KX_AUTH message.
  *
@@ -1852,8 +1948,9 @@ GCT_handle_kx_auth (struct CadetTConnection *ct,
     return;
   }
   LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "Handling KX_AUTH message for %s\n",
-       GCT_2s (t));
+       "Handling KX_AUTH message from %s with ephemeral %s\n",
+       GCT_2s (t),
+       GNUNET_e2s (&msg->kx.ephemeral_key));
   /* We do everything in ax_tmp until we've checked the authentication
      so we don't clobber anything we care about by accident. */
   ax_tmp = t->ax;
@@ -1889,6 +1986,32 @@ GCT_handle_kx_auth (struct CadetTConnection *ct,
                               GNUNET_NO);
     LOG (GNUNET_ERROR_TYPE_WARNING,
          "KX AUTH missmatch!\n");
+#if DEBUG_KX
+    {
+      struct GNUNET_CRYPTO_EcdhePublicKey ephemeral_key;
+
+      GNUNET_CRYPTO_ecdhe_key_get_public (&ax_tmp.kx_0,
+                                          &ephemeral_key);
+      if (0 != memcmp (&ephemeral_key,
+                       &msg->r_ephemeral_key_XXX,
+                       sizeof (ephemeral_key)))
+      {
+        LOG (GNUNET_ERROR_TYPE_WARNING,
+           "My ephemeral is %s!\n",
+             GNUNET_e2s (&ephemeral_key));
+        LOG (GNUNET_ERROR_TYPE_WARNING,
+             "Response is for ephemeral %s!\n",
+             GNUNET_e2s (&msg->r_ephemeral_key_XXX));
+      }
+      else
+      {
+        test_crypto_bug (&ax_tmp.kx_0,
+                         &msg->kx.ephemeral_key_XXX,
+                         my_private_key,
+                         &msg->kx.private_key_XXX);
+      }
+    }
+#endif
     if (NULL == t->kx_task)
       t->kx_task
         = GNUNET_SCHEDULER_add_at (t->next_kx_attempt,
@@ -2301,6 +2424,8 @@ connection_ready_cb (void *cls,
     /* Do not begin KX if WE have no channels waiting! */
     if (0 == GCT_count_channels (t))
       return;
+    if (0 != GNUNET_TIME_absolute_get_remaining (t->next_kx_attempt).rel_value_us)
+      return; /* wait for timeout before retrying */
     /* We are uninitialized, just transmit immediately,
        without undue delay. */
     if (NULL != t->kx_task)
@@ -2326,6 +2451,8 @@ connection_ready_cb (void *cls,
   case CADET_TUNNEL_KEY_OK:
     if (GNUNET_YES == t->kx_auth_requested)
     {
+      if (0 != GNUNET_TIME_absolute_get_remaining (t->next_kx_attempt).rel_value_us)
+        return; /* wait for timeout */
       if (NULL != t->kx_task)
       {
         GNUNET_SCHEDULER_cancel (t->kx_task);
@@ -2433,15 +2560,21 @@ evaluate_connection (void *cls,
 {
   struct EvaluationSummary *es = cls;
   struct CadetConnection *cc = ct->cc;
-  struct CadetPeerPath *ps = GCC_get_path (cc);
+  unsigned int ct_length;
+  struct CadetPeerPath *ps;
   const struct CadetConnectionMetrics *metrics;
   GNUNET_CONTAINER_HeapCostType ct_desirability;
   struct GNUNET_TIME_Relative uptime;
   struct GNUNET_TIME_Relative last_use;
-  uint32_t ct_length;
   double score;
   double success_rate;
 
+  ps = GCC_get_path (cc,
+                     &ct_length);
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Evaluating path %s of existing %s\n",
+       GCPP_2s (ps),
+       GCC_2s (cc));
   if (ps == es->path)
   {
     LOG (GNUNET_ERROR_TYPE_DEBUG,
@@ -2450,8 +2583,39 @@ evaluate_connection (void *cls,
     es->duplicate = GNUNET_YES;
     return;
   }
+  if (NULL != es->path)
+  {
+    int duplicate = GNUNET_YES;
+
+    for (unsigned int i=0;i<ct_length;i++)
+    {
+      GNUNET_assert (GCPP_get_length (es->path) > i);
+      if (GCPP_get_peer_at_offset (es->path,
+                                   i) !=
+          GCPP_get_peer_at_offset (ps,
+                                   i))
+      {
+        duplicate = GNUNET_NO;
+        break;
+      }
+    }
+    if (GNUNET_YES == duplicate)
+    {
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "Ignoring overlapping path %s.\n",
+           GCPP_2s (es->path));
+      es->duplicate = GNUNET_YES;
+      return;
+    }
+    else
+    {
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "Known path %s differs from proposed path\n",
+           GCPP_2s (ps));
+    }
+  }
+
   ct_desirability = GCPP_get_desirability (ps);
-  ct_length = GCPP_get_length (ps);
   metrics = GCC_get_metrics (cc);
   uptime = GNUNET_TIME_absolute_get_duration (metrics->age);
   last_use = GNUNET_TIME_absolute_get_duration (metrics->last_use);
@@ -2500,6 +2664,8 @@ consider_path_cb (void *cls,
   struct CadetTConnection *ct;
 
   GNUNET_assert (off < GCPP_get_length (path));
+  GNUNET_assert (GCPP_get_peer_at_offset (path,
+                                          off) == t->destination);
   es.min_length = UINT_MAX;
   es.max_length = 0;
   es.max_desire = 0;
@@ -2509,6 +2675,13 @@ consider_path_cb (void *cls,
   es.worst = NULL;
 
   /* Compute evaluation summary over existing connections. */
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Evaluating proposed path %s for target %s\n",
+       GCPP_2s (path),
+       GCT_2s (t));
+  /* FIXME: suspect this does not ACTUALLY iterate
+     over all existing paths, otherwise dup detection
+     should work!!! */
   GCT_iterate_connections (t,
                            &evaluate_connection,
                            &es);
@@ -2653,9 +2826,10 @@ GCT_consider_path (struct CadetTunnel *t,
                    unsigned int off)
 {
   LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "Considering %s for %s\n",
+       "Considering %s for %s (offset %u)\n",
        GCPP_2s (p),
-       GCT_2s (t));
+       GCT_2s (t),
+       off);
   (void) consider_path_cb (t,
                            p,
                            off);
diff --git a/src/cadet/test_cadet.c b/src/cadet/test_cadet.c
index b9f177652..608136e56 100644
--- a/src/cadet/test_cadet.c
+++ b/src/cadet/test_cadet.c
@@ -402,8 +402,11 @@ stats_cont (void *cls,
  * @return #GNUNET_OK to continue, #GNUNET_SYSERR to abort iteration
  */
 static int
-stats_iterator (void *cls, const struct GNUNET_TESTBED_Peer *peer,
-                const char *subsystem, const char *name, uint64_t value,
+stats_iterator (void *cls,
+                const struct GNUNET_TESTBED_Peer *peer,
+                const char *subsystem,
+                const char *name,
+                uint64_t value,
                 int is_persistent)
 {
   static const char *s_sent = "# keepalives sent";
@@ -614,10 +617,9 @@ reschedule_timeout_task (long line)
  *         #GNUNET_SYSERR to close it (signal serious error).
  */
 static int
-check_data (void *cls, const struct GNUNET_MessageHeader *message)
+check_data (void *cls,
+            const struct GNUNET_MessageHeader *message)
 {
-  if (sizeof (struct GNUNET_MessageHeader) >= ntohs (message->size))
-    return GNUNET_SYSERR;
   return GNUNET_OK;             /* all is well-formed */
 }
 
@@ -646,24 +648,33 @@ handle_data (void *cls,
 
   if (channel == outgoing_ch)
   {
-    GNUNET_log (GNUNET_ERROR_TYPE_INFO, "Root client got a message.\n");
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                "Root client got a message.\n");
   }
   else if (channel == incoming_ch)
   {
-    GNUNET_log (GNUNET_ERROR_TYPE_INFO, "Leaf client got a message.\n");
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                "Leaf client got a message.\n");
   }
   else
   {
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Unknown channel %p.\n", channel);
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Unknown channel %p.\n",
+                channel);
     GNUNET_assert (0);
   }
 
-  GNUNET_log (GNUNET_ERROR_TYPE_INFO, " ok: (%d/%d)\n", ok, ok_goal);
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              " ok: (%d/%d)\n",
+              ok,
+              ok_goal);
   data = (uint32_t *) &message[1];
   payload = ntohl (*data);
   if (payload == *counter)
   {
-    GNUNET_log (GNUNET_ERROR_TYPE_INFO, " payload as expected: %u\n", payload);
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                " payload as expected: %u\n",
+                payload);
   }
   else
   {
@@ -679,7 +690,8 @@ handle_data (void *cls,
     if (SPEED == test)
     {
       GNUNET_assert (incoming_ch == channel);
-      send_next_msg_task = GNUNET_SCHEDULER_add_now (&send_next_msg, NULL);
+      send_next_msg_task = GNUNET_SCHEDULER_add_now (&send_next_msg,
+                                                     NULL);
       return;
     }
   }
@@ -740,7 +752,8 @@ handle_data (void *cls,
  *           received on the @a channel.
  */
 static void *
-connect_handler (void *cls, struct GNUNET_CADET_Channel *channel,
+connect_handler (void *cls,
+                 struct GNUNET_CADET_Channel *channel,
                  const struct GNUNET_PeerIdentity *source)
 {
   struct CadetTestChannelWrapper *ch;
@@ -748,15 +761,20 @@ connect_handler (void *cls, struct GNUNET_CADET_Channel *channel,
 
   GNUNET_log (GNUNET_ERROR_TYPE_INFO,
               "Incoming channel from %s to %ld: %p\n",
-              GNUNET_i2s (source), peer, channel);
+              GNUNET_i2s (source),
+              peer,
+              channel);
   ok++;
-  GNUNET_log (GNUNET_ERROR_TYPE_INFO, " ok: %d\n", ok);
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              " ok: %d\n",
+              ok);
   if (peer == peers_requested - 1)
   {
     if (NULL != incoming_ch)
     {
       GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                  "Duplicate incoming channel for client %lu\n", (long) cls);
+                  "Duplicate incoming channel for client %lu\n",
+                  (long) cls);
       GNUNET_assert (0);
     }
     incoming_ch = channel;
@@ -764,7 +782,8 @@ connect_handler (void *cls, struct GNUNET_CADET_Channel *channel,
   else
   {
     GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
-                "Incoming channel for unexpected peer #%lu\n", (long) cls);
+                "Incoming channel for unexpected peer #%lu\n",
+                (long) cls);
     GNUNET_assert (0);
   }
   if (NULL != disconnect_task)
@@ -1003,7 +1022,6 @@ main (int argc, char *argv[])
                                         "short_time",
                                         gettext_noop ("set short timeout"),
                                         &short_time),
-
     GNUNET_GETOPT_option_uint ('m',
                                "messages",
                                "NUM_MESSAGES",
diff --git a/src/cadet/test_cadet_flow.c b/src/cadet/test_cadet_flow.c
new file mode 100644
index 000000000..554ee1d85
--- /dev/null
+++ b/src/cadet/test_cadet_flow.c
@@ -0,0 +1,888 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2011, 2017 GNUnet e.V.
+
+     GNUnet is free software; you can redistribute it and/or modify
+     it under the terms of the GNU General Public License as published
+     by the Free Software Foundation; either version 3, or (at your
+     option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     General Public License for more details.
+
+     You should have received a copy of the GNU General Public License
+     along with GNUnet; see the file COPYING.  If not, write to the
+     Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+     Boston, MA 02110-1301, USA.
+*/
+/**
+ * @file cadet/test_cadet_flow.c
+ * @author Bart Polot
+ * @author Christian Grothoff
+ * @brief Test for flow control of CADET service
+ */
+#include <stdio.h>
+#include "platform.h"
+#include "cadet_test_lib.h"
+#include "gnunet_cadet_service.h"
+#include "gnunet_statistics_service.h"
+#include <gauger.h>
+
+
+/**
+ * Ugly workaround to unify data handlers on incoming and outgoing channels.
+ */
+struct CadetTestChannelWrapper
+{
+  /**
+   * Channel pointer.
+   */
+  struct GNUNET_CADET_Channel *ch;
+};
+
+/**
+ * How many messages to send by default.
+ */
+#define TOTAL_PACKETS_DEFAULT 500
+
+/**
+ * How long until we give up on connecting the peers?
+ */
+#define TIMEOUT GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 120)
+
+/**
+ * Time to wait by default  for stuff that should be rather fast.
+ */
+#define SHORT_TIME GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 20)
+
+/**
+ * How fast do we send messages?
+ */
+#define SEND_INTERVAL GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MILLISECONDS, 10)
+
+
+/**
+ * How many packets to send.
+ */
+static unsigned int total_packets = TOTAL_PACKETS_DEFAULT;
+
+/**
+ * Time to wait for fast operations.
+ */
+static struct GNUNET_TIME_Relative short_time;
+
+/**
+ * Size of each test packet's payload
+ */
+static size_t size_payload = sizeof (uint32_t);
+
+/**
+ * Operation to get peer ids.
+ */
+static struct GNUNET_TESTBED_Operation *t_op[2];
+
+/**
+ * Peer ids.
+ */
+static struct GNUNET_PeerIdentity *p_id[2];
+
+/**
+ * Port ID
+ */
+static struct GNUNET_HashCode port;
+
+/**
+ * Peer ids counter.
+ */
+static unsigned int p_ids;
+
+/**
+ * Is the setup initialized?
+ */
+static int initialized;
+
+/**
+ * Number of payload packes sent.
+ */
+static int data_sent;
+
+/**
+ * Number of payload packets received.
+ */
+static int data_received;
+
+/**
+ * Number of payload packed acknowledgements sent.
+ */
+static int ack_sent;
+
+/**
+ * Number of payload packed explicitly (app level) acknowledged.
+ */
+static int ack_received;
+
+/**
+ * Total number of peers asked to run.
+ */
+static unsigned int peers_requested = 2;
+
+/**
+ * Number of currently running peers (should be same as @c peers_requested).
+ */
+static unsigned int peers_running;
+
+/**
+ * Test context (to shut down).
+ */
+struct GNUNET_CADET_TEST_Context *test_ctx;
+
+/**
+ * Task called to disconnect peers.
+ */
+static struct GNUNET_SCHEDULER_Task *disconnect_task;
+
+/**
+ * Task To perform tests
+ */
+static struct GNUNET_SCHEDULER_Task *test_task;
+
+/**
+ * Task runnining #send_next_msg().
+ */
+static struct GNUNET_SCHEDULER_Task *send_next_msg_task;
+
+/**
+ * Cadet handle for the root peer
+ */
+static struct GNUNET_CADET_Handle *h1;
+
+/**
+ * Cadet handle for the first leaf peer
+ */
+static struct GNUNET_CADET_Handle *h2;
+
+/**
+ * Channel handle for the root peer
+ */
+static struct GNUNET_CADET_Channel *outgoing_ch;
+
+/**
+ * Channel handle for the dest peer
+ */
+static struct GNUNET_CADET_Channel *incoming_ch;
+
+/**
+ * Time we started the data transmission (after channel has been established
+ * and initilized).
+ */
+static struct GNUNET_TIME_Absolute start_time;
+
+/**
+ * Peers handle.
+ */
+static struct GNUNET_TESTBED_Peer **testbed_peers;
+
+/**
+ * Statistics operation handle.
+ */
+static struct GNUNET_TESTBED_Operation *stats_op;
+
+/**
+ * Keepalives sent.
+ */
+static unsigned int ka_sent;
+
+/**
+ * Keepalives received.
+ */
+static unsigned int ka_received;
+
+/**
+ * How many messages were dropped by CADET because of full buffers?
+ */
+static unsigned int msg_dropped;
+
+
+/**
+ * Show the results of the test (banwidth acheived) and log them to GAUGER
+ */
+static void
+show_end_data (void)
+{
+  static struct GNUNET_TIME_Absolute end_time;
+  static struct GNUNET_TIME_Relative total_time;
+
+  end_time = GNUNET_TIME_absolute_get ();
+  total_time = GNUNET_TIME_absolute_get_difference (start_time, end_time);
+  FPRINTF (stderr,
+           "\nResults of test \"%s\"\n",
+           test_name);
+  FPRINTF (stderr,
+           "Test time %s\n",
+           GNUNET_STRINGS_relative_time_to_string (total_time, GNUNET_YES));
+  FPRINTF (stderr,
+           "Test bandwidth: %f kb/s\n",
+           4 * total_packets * 1.0 / (total_time.rel_value_us / 1000));    // 4bytes * ms
+  FPRINTF (stderr,
+           "Test throughput: %f packets/s\n\n",
+           total_packets * 1000.0 / (total_time.rel_value_us / 1000));     // packets * ms
+  GAUGER ("CADET",
+          test_name,
+          total_packets * 1000.0 / (total_time.rel_value_us / 1000),
+          "packets/s");
+}
+
+
+/**
+ * Shut down peergroup, clean up.
+ *
+ * @param cls Closure (unused).
+ * @param tc Task Context.
+ */
+static void
+shutdown_task (void *cls)
+{
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Ending test.\n");
+  if (NULL != send_next_msg_task)
+  {
+    GNUNET_SCHEDULER_cancel (send_next_msg_task);
+    send_next_msg_task = NULL;
+  }
+  if (NULL != test_task)
+  {
+    GNUNET_SCHEDULER_cancel (test_task);
+    test_task = NULL;
+  }
+  for (unsigned int i = 0; i < 2; i++)
+    GNUNET_TESTBED_operation_done (t_op[i]);
+  if (NULL != outgoing_ch)
+  {
+    GNUNET_CADET_channel_destroy (outgoing_ch);
+    outgoing_ch = NULL;
+  }
+  if (NULL != incoming_ch)
+  {
+    GNUNET_CADET_channel_destroy (incoming_ch);
+    incoming_ch = NULL;
+  }
+  GNUNET_CADET_TEST_cleanup (test_ctx);
+}
+
+
+/**
+ * Stats callback. Finish the stats testbed operation and when all stats have
+ * been iterated, shutdown the test.
+ *
+ * @param cls Closure (line number from which termination was requested).
+ * @param op the operation that has been finished
+ * @param emsg error message in case the operation has failed; will be NULL if
+ *          operation has executed successfully.
+ */
+static void
+stats_cont (void *cls,
+            struct GNUNET_TESTBED_Operation *op,
+            const char *emsg)
+{
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "KA sent: %u, KA received: %u\n",
+              ka_sent,
+              ka_received);
+  if ((KEEPALIVE == test) && ((ka_sent < 2) || (ka_sent > ka_received + 1)))
+  {
+    GNUNET_break (0);
+    ok--;
+  }
+  GNUNET_TESTBED_operation_done (stats_op);
+
+  if (NULL != disconnect_task)
+    GNUNET_SCHEDULER_cancel (disconnect_task);
+  disconnect_task = GNUNET_SCHEDULER_add_now (&disconnect_cadet_peers,
+                                              cls);
+}
+
+
+/**
+ * Process statistic values.
+ *
+ * @param cls closure (line number, unused)
+ * @param peer the peer the statistic belong to
+ * @param subsystem name of subsystem that created the statistic
+ * @param name the name of the datum
+ * @param value the current value
+ * @param is_persistent #GNUNET_YES if the value is persistent, #GNUNET_NO if not
+ * @return #GNUNET_OK to continue, #GNUNET_SYSERR to abort iteration
+ */
+static int
+stats_iterator (void *cls,
+                const struct GNUNET_TESTBED_Peer *peer,
+                const char *subsystem,
+                const char *name,
+                uint64_t value,
+                int is_persistent)
+{
+  static const char *s_sent = "# keepalives sent";
+  static const char *s_recv = "# keepalives received";
+  static const char *rdrops = "# messages dropped due to full buffer";
+  static const char *cdrops = "# messages dropped due to slow client";
+  uint32_t i;
+
+  i = GNUNET_TESTBED_get_index (peer);
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO, "STATS PEER %u - %s [%s]: %llu\n", i,
+              subsystem, name, (unsigned long long) value);
+  if (0 == strncmp (s_sent, name, strlen (s_sent)) && 0 == i)
+    ka_sent = value;
+  if (0 == strncmp (s_recv, name, strlen (s_recv)) && peers_requested - 1 == i)
+    ka_received = value;
+  if (0 == strncmp (rdrops, name, strlen (rdrops)))
+    msg_dropped += value;
+  if (0 == strncmp (cdrops, name, strlen (cdrops)))
+    msg_dropped += value;
+
+  return GNUNET_OK;
+}
+
+
+/**
+ * Task to gather all statistics.
+ *
+ * @param cls Closure (line from which the task was scheduled).
+ */
+static void
+gather_stats_and_exit (void *cls)
+{
+  long l = (long) cls;
+
+  disconnect_task = NULL;
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "gathering statistics from line %ld\n",
+              l);
+  if (NULL != outgoing_ch)
+  {
+    GNUNET_CADET_channel_destroy (outgoing_ch);
+    outgoing_ch = NULL;
+  }
+  stats_op = GNUNET_TESTBED_get_statistics (peers_running,
+                                            testbed_peers,
+                                            "cadet",
+                                            NULL,
+                                            &stats_iterator,
+                                            stats_cont,
+                                            cls);
+}
+
+
+/**
+ * Abort test: schedule disconnect and shutdown immediately
+ *
+ * @param line Line in the code the abort is requested from (__LINE__).
+ */
+static void
+abort_test (long line)
+{
+  if (NULL != disconnect_task)
+  {
+    GNUNET_SCHEDULER_cancel (disconnect_task);
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Aborting test from %ld\n",
+                line);
+    disconnect_task =
+        GNUNET_SCHEDULER_add_now (&disconnect_cadet_peers,
+                                  (void *) line);
+  }
+}
+
+
+/**
+ * Send a message on the channel with the appropriate size and payload.
+ *
+ * Update the appropriate *_sent counter.
+ *
+ * @param channel Channel to send the message on.
+ */
+static void
+send_test_message (struct GNUNET_CADET_Channel *channel)
+{
+  struct GNUNET_MQ_Envelope *env;
+  struct GNUNET_MessageHeader *msg;
+  uint32_t *data;
+  int payload;
+  int size;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Sending test message on channel %p\n",
+              channel);
+  size = size_payload;
+  if (GNUNET_NO == initialized)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Sending INITIALIZER\n");
+    size += 1000;
+    payload = data_sent;
+    if (SPEED_ACK == test) // FIXME unify SPEED_ACK with an initializer
+        data_sent++;
+  }
+  else if (SPEED == test || SPEED_ACK == test)
+  {
+    if (get_target_channel() == channel)
+    {
+      payload = ack_sent;
+      size += ack_sent;
+      ack_sent++;
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "Sending ACK %u [%d bytes]\n",
+                  payload, size);
+    }
+    else
+    {
+      payload = data_sent;
+      size += data_sent;
+      data_sent++;
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "Sending DATA %u [%d bytes]\n",
+                  data_sent, size);
+    }
+  }
+  else if (FORWARD == test)
+  {
+    payload = ack_sent;
+  }
+  else if (P2P_SIGNAL == test)
+  {
+    payload = data_sent;
+  }
+  else
+  {
+    GNUNET_assert (0);
+  }
+  env = GNUNET_MQ_msg_extra (msg, size, GNUNET_MESSAGE_TYPE_DUMMY);
+
+  data = (uint32_t *) &msg[1];
+  *data = htonl (payload);
+  GNUNET_MQ_send (GNUNET_CADET_get_mq (channel), env);
+}
+
+
+/**
+ * Task to request a new data transmission in a SPEED test, without waiting
+ * for previous messages to be sent/arrrive.
+ *
+ * @param cls Closure (unused).
+ */
+static void
+send_next_msg (void *cls)
+{
+  struct GNUNET_CADET_Channel *channel;
+
+  send_next_msg_task = NULL;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Sending next message: %d\n",
+              data_sent);
+
+  channel = GNUNET_YES == test_backwards ? incoming_ch : outgoing_ch;
+  GNUNET_assert (NULL != channel);
+  GNUNET_assert (SPEED == test);
+  send_test_message (channel);
+  if (data_sent < total_packets)
+  {
+    /* SPEED test: Send all messages as soon as possible */
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Scheduling message %d\n",
+                data_sent + 1);
+    send_next_msg_task =
+      GNUNET_SCHEDULER_add_delayed (SEND_INTERVAL,
+                                      &send_next_msg,
+                                      NULL);
+  }
+}
+
+
+/**
+ * Check if payload is sane (size contains payload).
+ *
+ * @param cls should match #ch
+ * @param message The actual message.
+ * @return #GNUNET_OK to keep the channel open,
+ *         #GNUNET_SYSERR to close it (signal serious error).
+ */
+static int
+check_data (void *cls,
+            const struct GNUNET_MessageHeader *message)
+{
+  return GNUNET_OK;             /* all is well-formed */
+}
+
+
+/**
+ * Function is called whenever a message is received.
+ *
+ * @param cls closure (set from GNUNET_CADET_connect(), peer number)
+ * @param message the actual message
+ */
+static void
+handle_data (void *cls,
+             const struct GNUNET_MessageHeader *message)
+{
+  struct CadetTestChannelWrapper *ch = cls;
+  struct GNUNET_CADET_Channel *channel = ch->ch;
+  uint32_t *data;
+  uint32_t payload;
+  int *counter;
+
+  GNUNET_CADET_receive_done (channel);
+  counter = get_target_channel () == channel ? &data_received : &ack_received;
+  if (channel == outgoing_ch)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                "Root client got a message.\n");
+  }
+  else if (channel == incoming_ch)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                "Leaf client got a message.\n");
+  }
+  else
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Unknown channel %p.\n",
+                channel);
+    GNUNET_assert (0);
+  }
+
+  data = (uint32_t *) &message[1];
+  payload = ntohl (*data);
+  if (payload == *counter)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                "Payload as expected: %u\n",
+                payload);
+  }
+  else
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Received payload %u, expected: %u\n",
+                payload, *counter);
+  }
+  (*counter)++;
+  if (get_target_channel () == channel) /* Got "data" */
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                " received data %u\n",
+                data_received);
+    if (data_received < total_packets)
+      return;
+  }
+  else /* Got "ack" */
+  {
+    if (SPEED_ACK == test || SPEED == test)
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_INFO, " received ack %u\n", ack_received);
+      /* Send more data */
+      send_test_message (channel);
+      if (ack_received < total_packets && SPEED != test)
+        return;
+      if (ok == 2 && SPEED == test)
+        return;
+      show_end_data ();
+    }
+    if (test == P2P_SIGNAL)
+    {
+      GNUNET_CADET_channel_destroy (incoming_ch);
+      incoming_ch = NULL;
+    }
+    else
+    {
+      GNUNET_CADET_channel_destroy (outgoing_ch);
+      outgoing_ch = NULL;
+    }
+  }
+}
+
+
+/**
+ * Method called whenever a peer connects to a port in MQ-based CADET.
+ *
+ * @param cls Closure from #GNUNET_CADET_open_port (peer # as long).
+ * @param channel New handle to the channel.
+ * @param source Peer that started this channel.
+ * @return Closure for the incoming @a channel. It's given to:
+ *         - The #GNUNET_CADET_DisconnectEventHandler (given to
+ *           #GNUNET_CADET_open_port) when the channel dies.
+ *         - Each the #GNUNET_MQ_MessageCallback handlers for each message
+ *           received on the @a channel.
+ */
+static void *
+connect_handler (void *cls,
+                 struct GNUNET_CADET_Channel *channel,
+                 const struct GNUNET_PeerIdentity *source)
+{
+  struct CadetTestChannelWrapper *ch;
+  long peer = (long) cls;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "Incoming channel from %s to %ld: %p\n",
+              GNUNET_i2s (source),
+              peer,
+              channel);
+  if (peer == peers_requested - 1)
+  {
+    if (NULL != incoming_ch)
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  "Duplicate incoming channel for client %lu\n",
+                  (long) cls);
+      GNUNET_assert (0);
+    }
+    incoming_ch = channel;
+  }
+  else
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "Incoming channel for unexpected peer #%lu\n",
+                (long) cls);
+    GNUNET_assert (0);
+  }
+  ch = GNUNET_new (struct CadetTestChannelWrapper);
+  ch->ch = channel;
+
+  return ch;
+}
+
+
+/**
+ * Function called whenever an MQ-channel is destroyed, even if the destruction
+ * was requested by #GNUNET_CADET_channel_destroy.
+ * It must NOT call #GNUNET_CADET_channel_destroy on the channel.
+ *
+ * It should clean up any associated state, including cancelling any pending
+ * transmission on this channel.
+ *
+ * @param cls Channel closure (channel wrapper).
+ * @param channel Connection to the other end (henceforth invalid).
+ */
+static void
+disconnect_handler (void *cls,
+                    const struct GNUNET_CADET_Channel *channel)
+{
+  struct CadetTestChannelWrapper *ch_w = cls;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "Channel disconnected at %d\n",
+              ok);
+  GNUNET_assert (ch_w->ch == channel);
+  if (channel == incoming_ch)
+    incoming_ch = NULL;
+  else if (outgoing_ch == channel)
+    outgoing_ch = NULL;
+  else
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "Disconnect on unknown channel %p\n",
+                channel);
+  if (NULL != disconnect_task)
+    GNUNET_SCHEDULER_cancel (disconnect_task);
+  disconnect_task = GNUNET_SCHEDULER_add_now (&gather_stats_and_exit,
+                                              (void *) __LINE__);
+  GNUNET_free (ch_w);
+}
+
+
+/**
+ * Start the testcase, we know the peers and have handles to CADET.
+ *
+ * Testcase continues when the root receives confirmation of connected peers,
+ * on callback function ch.
+ *
+ * @param cls Closure (unused).
+ */
+static void
+start_test (void *cls)
+{
+  struct GNUNET_MQ_MessageHandler handlers[] = {
+    GNUNET_MQ_hd_var_size (data,
+                           GNUNET_MESSAGE_TYPE_DUMMY,
+                           struct GNUNET_MessageHeader,
+                           NULL),
+    GNUNET_MQ_handler_end ()
+  };
+  struct CadetTestChannelWrapper *ch;
+  enum GNUNET_CADET_ChannelOption flags;
+
+  test_task = NULL;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "In start_test\n");
+  start_time = GNUNET_TIME_absolute_get ();
+  ch = GNUNET_new (struct CadetTestChannelWrapper);
+  outgoing_ch = GNUNET_CADET_channel_create (h1,
+                                             ch,
+                                             p_id[1],
+                                             &port,
+                                             flags,
+                                             NULL,
+                                             &disconnect_handler,
+                                             handlers);
+  ch->ch = outgoing_ch;
+  GNUNET_assert (NULL == disconnect_task);
+  disconnect_task
+    = GNUNET_SCHEDULER_add_delayed (short_time,
+                                    &gather_stats_and_exit,
+                                    (void *) __LINE__);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Sending data initializer on channel %p...\n",
+              outgoing_ch);
+  send_test_message (outgoing_ch);
+}
+
+
+/**
+ * Callback to be called when the requested peer information is available
+ *
+ * @param cls the closure from GNUNET_TESTBED_peer_get_information()
+ * @param op the operation this callback corresponds to
+ * @param pinfo the result; will be NULL if the operation has failed
+ * @param emsg error message if the operation has failed;
+ *             NULL if the operation is successfull
+ */
+static void
+pi_cb (void *cls,
+       struct GNUNET_TESTBED_Operation *op,
+       const struct GNUNET_TESTBED_PeerInformation *pinfo,
+       const char *emsg)
+{
+  long i = (long) cls;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "ID callback for %ld\n",
+              i);
+  if ( (NULL == pinfo) ||
+       (NULL != emsg) )
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "pi_cb: %s\n",
+                emsg);
+    abort_test (__LINE__);
+    return;
+  }
+  p_id[i] = pinfo->result.id;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "id: %s\n",
+              GNUNET_i2s (p_id[i]));
+  p_ids++;
+  if (p_ids < 2)
+    return;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Got all IDs, starting test\n");
+  test_task = GNUNET_SCHEDULER_add_now (&start_test,
+                                        NULL);
+}
+
+
+/**
+ * test main: start test when all peers are connected
+ *
+ * @param cls Closure.
+ * @param ctx Argument to give to GNUNET_CADET_TEST_cleanup on test end.
+ * @param num_peers Number of peers that are running.
+ * @param peers Array of peers.
+ * @param cadets Handle to each of the CADETs of the peers.
+ */
+static void
+tmain (void *cls,
+       struct GNUNET_CADET_TEST_Context *ctx,
+       unsigned int num_peers,
+       struct GNUNET_TESTBED_Peer **peers,
+       struct GNUNET_CADET_Handle **cadets)
+{
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "test main\n");
+  test_ctx = ctx;
+  peers_running = num_peers;
+  GNUNET_assert (peers_running == peers_requested);
+  testbed_peers = peers;
+  h1 = cadets[0];
+  h2 = cadets[num_peers - 1];
+  GNUNET_SCHEDULER_add_shutdown (&shutdown_task,
+                                 NULL);
+  p_ids = 0;
+  t_op[0] = GNUNET_TESTBED_peer_get_information (peers[0],
+                                                 GNUNET_TESTBED_PIT_IDENTITY,
+                                                 &pi_cb,
+                                                 (void *) 0L);
+  t_op[1] = GNUNET_TESTBED_peer_get_information (peers[num_peers - 1],
+                                                 GNUNET_TESTBED_PIT_IDENTITY,
+                                                 &pi_cb,
+                                                 (void *) 1L);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "requested peer ids\n");
+}
+
+
+/**
+ * Main: start test
+ */
+int
+main (int argc,
+      char *argv[])
+{
+  static const struct GNUNET_HashCode *ports[2];
+  struct GNUNET_MQ_MessageHandler handlers[] = {
+    GNUNET_MQ_hd_var_size (data,
+                           GNUNET_MESSAGE_TYPE_DUMMY,
+                           struct GNUNET_MessageHeader,
+                           NULL),
+    GNUNET_MQ_handler_end ()
+  };
+  const char *config_file = "test_cadet.conf";
+  char port_id[] = "test port";
+  struct GNUNET_GETOPT_CommandLineOption options[] = {
+    GNUNET_GETOPT_option_relative_time ('t',
+                                        "time",
+                                        "short_time",
+                                        gettext_noop ("set short timeout"),
+                                        &short_time),
+    GNUNET_GETOPT_option_uint ('m',
+                               "messages",
+                               "NUM_MESSAGES",
+                               gettext_noop ("set number of messages to send"),
+                               &total_packets),
+    GNUNET_GETOPT_option_uint ('p',
+                               "peers",
+                               "NUM_PEERS",
+                               gettext_noop ("number of peers to launch"),
+                               &peers_requested),
+    GNUNET_GETOPT_OPTION_END
+  };
+
+  GNUNET_log_setup ("test-cadet-flow",
+                    "DEBUG",
+                    NULL);
+  total_packets = TOTAL_PACKETS;
+  short_time = SHORT_TIME;
+  if (-1 == GNUNET_GETOPT_run (argv[0],
+                               options,
+                               argc,
+                               argv))
+  {
+    FPRINTF (stderr,
+             "test failed: problem with CLI parameters\n");
+    return 1;
+  }
+  GNUNET_CRYPTO_hash (port_id,
+                      sizeof (port_id),
+                      &port);
+  ports[0] = &port;
+  ports[1] = NULL;
+  GNUNET_CADET_TEST_ruN ("test_cadet_flow",
+                         config_file,
+                         peers_requested,
+                         &tmain,
+                         NULL,        /* tmain cls */
+                         &connect_handler,
+                         NULL,
+                         &disconnect_handler,
+                         handlers,
+                         ports);
+  return 0;
+}
+
+/* end of test_cadet_flow.c */
diff --git a/src/cadet/test_cadet_local_mq.c b/src/cadet/test_cadet_local_mq.c
index 3089c7fbb..2ea754743 100644
--- a/src/cadet/test_cadet_local_mq.c
+++ b/src/cadet/test_cadet_local_mq.c
@@ -19,7 +19,7 @@
 */
 
 /**
- * @file cadet/test_cadet_local.c
+ * @file cadet/test_cadet_local_mq.c
  * @brief test cadet local: test of cadet channels with just one peer
  * @author Bartlomiej Polot
  */
@@ -123,7 +123,9 @@ do_shutdown (void *cls)
 static void
 do_abort (void *cls)
 {
-  GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "ABORT from line %ld\n", (long) cls);
+  GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+              "ABORT from line %ld\n",
+              (long) cls);
   result = GNUNET_SYSERR;
   abort_task = NULL;
   GNUNET_SCHEDULER_shutdown ();
@@ -148,7 +150,8 @@ connected (void *cls,
 {
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "connected %s, cls: %p\n",
-              GNUNET_i2s(source), cls);
+              GNUNET_i2s(source),
+              cls);
   return channel;
 }
 
@@ -206,7 +209,8 @@ handle_data_received (void *cls,
 static void
 message_sent (void *cls)
 {
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "message sent\n");
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "message sent\n");
 }
 
 
diff --git a/src/consensus/.gitignore b/src/consensus/.gitignore
index d49147d17..8050d760e 100644
--- a/src/consensus/.gitignore
+++ b/src/consensus/.gitignore
@@ -3,3 +3,4 @@ gnunet-consensus-profiler
 gnunet-service-consensus
 test_consensus_api
 resource.log.master
+consensus-simulation.py
diff --git a/src/consensus/Makefile.am b/src/consensus/Makefile.am
index c0205ee5d..991e36a95 100644
--- a/src/consensus/Makefile.am
+++ b/src/consensus/Makefile.am
@@ -27,6 +27,17 @@ libexec_PROGRAMS += \
  gnunet-service-evil-consensus
 endif
 
+do_subst = $(SED) -e 's,[@]PYTHON[@],$(PYTHON),g'
+
+SUFFIXES = .py.in .py
+
+.py.in.py:
+        $(do_subst) < $< > $@
+        chmod +x $@
+
+check-python-style:
+        flake8 consensus-simulation.py.in
+
 lib_LTLIBRARIES = \
   libgnunetconsensus.la
 
@@ -103,5 +114,12 @@ test_consensus_api_LDADD = \
   $(top_builddir)/src/testing/libgnunettesting.la \
   libgnunetconsensus.la
 
+noinst_SCRIPTS = \
+        consensus-simulation.py
+
+CLEANFILES = \
+        $(noinst_SCRIPTS)
+
 EXTRA_DIST = \
-  test_consensus.conf
+  test_consensus.conf \
+  consensus-simulation.py.in
diff --git a/src/consensus/consensus-simulation.py b/src/consensus/consensus-simulation.py
deleted file mode 100644
index 542fe0dac..000000000
--- a/src/consensus/consensus-simulation.py
+++ /dev/null
@@ -1,108 +0,0 @@
-#!/usr/bin/python
-# This file is part of GNUnet
-# (C) 2013 Christian Grothoff (and other contributing authors)
-#
-# GNUnet is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published
-# by the Free Software Foundation; either version 2, or (at your
-# option) any later version.
-#
-# GNUnet is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-# General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with GNUnet; see the file COPYING.  If not, write to the
-# Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-# Boston, MA 02110-1301, USA.
-
-from __future__ import absolute_import
-from __future__ import print_function
-import argparse
-import random
-from math import ceil,log,floor
-
-
-def bsc(n):
-  """ count the bits set in n"""
-  l = n.bit_length()
-  c = 0
-  x = 1
-  for _ in range(0, l):
-    if n & x:
-      c = c + 1
-    x = x << 1
-  return c
-
-
-def simulate(k, n, verbose):
-  assert k < n
-  largest_arc = int(2**ceil(log(n, 2))) / 2
-  num_ghosts = (2 * largest_arc) - n
-  if verbose:
-    print "we have", num_ghosts, "ghost peers"
-  # n.b. all peers with idx<k are evil
-  peers = range(n)
-  info = [1 << x for x in xrange(n)]
-  def done_p():
-    for x in xrange(k, n):
-      if bsc(info[x]) < n-k:
-        return False
-    return True
-  rounds = 0
-  while not done_p():
-    if verbose:
-      print "-- round --"
-    arc = 1
-    while arc <= largest_arc:
-      if verbose:
-        print "-- subround --"
-      new_info = [x for x in info]
-      for peer_physical in xrange(n):
-        peer_logical = peers[peer_physical]
-        peer_type = None
-        partner_logical = (peer_logical + arc) % n
-        partner_physical = peers.index(partner_logical)
-        if peer_physical < k or partner_physical < k:
-          if verbose:
-            print "bad peer in connection", peer_physical, "--", partner_physical
-          continue
-        if peer_logical & arc == 0:
-          # we are outgoing
-          if verbose:
-            print peer_physical, "connects to", partner_physical
-          peer_type = "outgoing"
-          if peer_logical < num_ghosts:
-            # we have a ghost, check if the peer who connects
-            # to our ghost is actually outgoing
-            ghost_partner_logical = (peer_logical - arc) % n
-            if ghost_partner_logical & arc == 0:
-              peer_type = peer_type + ", ghost incoming"
-          new_info[peer_physical] = new_info[peer_physical] | info[peer_physical] | info[partner_physical]
-          new_info[partner_physical] = new_info[partner_physical] | info[peer_physical] | info[partner_physical]
-        else:
-          peer_type = "incoming"
-        if verbose > 1:
-          print "type of", str(peer_physical) + ":", peer_type
-      info = new_info
-      arc = arc << 1;
-    rounds = rounds + 1
-    random.shuffle(peers)
-  return rounds
-
-
-if __name__ == "__main__":
-  parser = argparse.ArgumentParser()
-  parser.add_argument("k", metavar="k", type=int, help="#(bad peers)")
-  parser.add_argument("n", metavar="n", type=int, help="#(all peers)")
-  parser.add_argument("r", metavar="r", type=int, help="#(rounds)")
-  parser.add_argument('--verbose', '-v', action='count')
-
-  args = parser.parse_args()
-  sum = 0.0;
-  for n in xrange (0, args.r):
-    sum += simulate(args.k, args.n, args.verbose)
-  printsum / args.r;
-
-
diff --git a/src/consensus/consensus-simulation.py.in b/src/consensus/consensus-simulation.py.in
new file mode 100644
index 000000000..6629ffaa8
--- /dev/null
+++ b/src/consensus/consensus-simulation.py.in
@@ -0,0 +1,110 @@
+#!@PYTHON@
+# This file is part of GNUnet
+# (C) 2013, 2018 Christian Grothoff (and other contributing authors)
+#
+# GNUnet is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published
+# by the Free Software Foundation; either version 2, or (at your
+# option) any later version.
+#
+# GNUnet is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with GNUnet; see the file COPYING.  If not, write to the
+# Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+# Boston, MA 02110-1301, USA.
+
+from __future__ import absolute_import
+from __future__ import print_function
+import argparse
+import random
+from math import ceil, log, floor
+from past.builtins import xrange
+
+
+def bsc(n):
+    """ count the bits set in n"""
+    l = n.bit_length()
+    c = 0
+    x = 1
+    for _ in range(0, l):
+        if n & x:
+            c = c + 1
+        x = x << 1
+    return c
+
+
+def simulate(k, n, verbose):
+    assert k < n
+    largest_arc = int(2**ceil(log(n, 2))) / 2
+    num_ghosts = (2 * largest_arc) - n
+    if verbose:
+        print("we have", num_ghosts, "ghost peers")
+        # n.b. all peers with idx<k are evil
+    peers = range(n)
+    # py2-3 compatible, backwards.
+    # refer to http://python-future.org/compatible_idioms.html#xrange
+    info = [1 << x for x in xrange(n)]
+
+    def done_p():
+        for x in xrange(k, n):
+            if bsc(info[x]) < n-k:
+                return False
+        return True
+    rounds = 0
+    while not done_p():
+        if verbose:
+            print("-- round --")
+        arc = 1
+        while arc <= largest_arc:
+            if verbose:
+                print("-- subround --")
+            new_info = [x for x in info]
+            for peer_physical in xrange(n):
+                peer_logical = peers[peer_physical]
+                peer_type = None
+                partner_logical = (peer_logical + arc) % n
+                partner_physical = peers.index(partner_logical)
+                if peer_physical < k or partner_physical < k:
+                    if verbose:
+                        print("bad peer in connection", peer_physical, "--", partner_physical)
+                    continue
+                if peer_logical & arc == 0:
+                    # we are outgoing
+                    if verbose:
+                        print(peer_physical, "connects to", partner_physical)
+                    peer_type = "outgoing"
+                    if peer_logical < num_ghosts:
+                        # we have a ghost, check if the peer who connects
+                        # to our ghost is actually outgoing
+                        ghost_partner_logical = (peer_logical - arc) % n
+                        if ghost_partner_logical & arc == 0:
+                            peer_type = peer_type + ", ghost incoming"
+                    new_info[peer_physical] = new_info[peer_physical] | info[peer_physical] | info[partner_physical]
+                    new_info[partner_physical] = new_info[partner_physical] | info[peer_physical] | info[partner_physical]
+                else:
+                    peer_type = "incoming"
+                if verbose > 1:
+                    print("type of", str(peer_physical) + ":", peer_type)
+            info = new_info
+            arc = arc << 1
+        rounds = rounds + 1
+        random.shuffle(peers)
+    return rounds
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser()
+    parser.add_argument("k", metavar="k", type=int, help="#(bad peers)")
+    parser.add_argument("n", metavar="n", type=int, help="#(all peers)")
+    parser.add_argument("r", metavar="r", type=int, help="#(rounds)")
+    parser.add_argument('--verbose', '-v', action='count')
+
+    args = parser.parse_args()
+    sum = 0.0
+    for n in xrange(0, args.r):
+        sum += simulate(args.k, args.n, args.verbose)
+    print(sum / args.r)
diff --git a/src/conversation/test_conversation.conf b/src/conversation/test_conversation.conf
index 87c4b8f07..e77b41003 100644
--- a/src/conversation/test_conversation.conf
+++ b/src/conversation/test_conversation.conf
@@ -1,4 +1,4 @@
-@INLINE@ ../../contrib/no_forcestart.conf
+@INLINE@ ../../contrib/conf/gnunet/no_forcestart.conf
 
 [conversation]
 LINE=1
diff --git a/src/core/test_core_defaults.conf b/src/core/test_core_defaults.conf
index 669dd2a9c..7c7dad99e 100644
--- a/src/core/test_core_defaults.conf
+++ b/src/core/test_core_defaults.conf
@@ -1,5 +1,5 @@
-@INLINE@ ../../contrib/no_forcestart.conf
-@INLINE@ ../../contrib/no_autostart_above_core.conf
+@INLINE@ ../../contrib/conf/gnunet/no_forcestart.conf
+@INLINE@ ../../contrib/conf/gnunet/no_autostart_above_core.conf
 
 [PATHS]
 GNUNET_TEST_HOME = $GNUNET_TMP/test-gnunet-core/
diff --git a/src/credential/test_credential_defaults.conf b/src/credential/test_credential_defaults.conf
index 328846a10..39f82ad16 100644
--- a/src/credential/test_credential_defaults.conf
+++ b/src/credential/test_credential_defaults.conf
@@ -1,4 +1,4 @@
-@INLINE@ ../../contrib/no_forcestart.conf
+@INLINE@ ../../contrib/conf/gnunet/no_forcestart.conf
 
 [PATHS]
 GNUNET_TEST_HOME = $GNUNET_TMP/test-gnunet-credential-testing/
diff --git a/src/datastore/test_defaults.conf b/src/datastore/test_defaults.conf
index 67d782f3a..08e630eb0 100644
--- a/src/datastore/test_defaults.conf
+++ b/src/datastore/test_defaults.conf
@@ -1,5 +1,5 @@
-@inline@ ../../contrib/no_autostart_above_core.conf
-@inline@ ../../contrib/no_forcestart.conf
+@inline@ ../../contrib/conf/gnunet/no_autostart_above_core.conf
+@inline@ ../../contrib/conf/gnunet/no_forcestart.conf
 
 [datastore]
 PORT = 22654
diff --git a/src/dht/gnunet_dht_profiler.c b/src/dht/gnunet_dht_profiler.c
index 403deb38a..5341e7d61 100644
--- a/src/dht/gnunet_dht_profiler.c
+++ b/src/dht/gnunet_dht_profiler.c
@@ -45,7 +45,7 @@ static unsigned int put_probability = 100;
 /**
  * Configuration
  */
-static struct GNUNET_CONFIGURATION_Handle *cfg;
+static const struct GNUNET_CONFIGURATION_Handle *cfg;
 
 /**
  * Name of the file with the hosts to run the test over
@@ -917,7 +917,7 @@ run (void *cls,
                 num_peers);
     return;
   }
-  cfg = GNUNET_CONFIGURATION_dup (config);
+  cfg = config;
   event_mask = 0;
   GNUNET_TESTBED_run (hosts_file,
                       cfg,
diff --git a/src/dht/plugin_block_dht.c b/src/dht/plugin_block_dht.c
index 24f8b21b2..9f2861b50 100644
--- a/src/dht/plugin_block_dht.c
+++ b/src/dht/plugin_block_dht.c
@@ -66,7 +66,8 @@ block_plugin_dht_create_group (void *cls,
   guard = va_arg (va, const char *);
   if (0 == strcmp (guard,
                    "seen-set-size"))
-    bf_size = GNUNET_BLOCK_GROUP_compute_bloomfilter_size (va_arg (va, unsigned int),
+    bf_size = GNUNET_BLOCK_GROUP_compute_bloomfilter_size (va_arg (va,
+                                                                   unsigned int),
                                                            BLOOMFILTER_K);
   else if (0 == strcmp (guard,
                         "filter-size"))
@@ -183,14 +184,17 @@ block_plugin_dht_get_key (void *cls,
     return GNUNET_SYSERR;
   if (block_size < sizeof (struct GNUNET_MessageHeader))
   {
-    GNUNET_log_from (GNUNET_ERROR_TYPE_ERROR, "block-dht",
-                     _("Block not of type %u\n"), GNUNET_BLOCK_TYPE_DHT_HELLO);
+    GNUNET_log_from (GNUNET_ERROR_TYPE_ERROR,
+                     "block-dht",
+                     _("Block not of type %u\n"),
+                     GNUNET_BLOCK_TYPE_DHT_HELLO);
     return GNUNET_NO;
   }
   msg = block;
   if (block_size != ntohs (msg->size))
   {
-    GNUNET_log_from (GNUNET_ERROR_TYPE_ERROR, "block-dht",
+    GNUNET_log_from (GNUNET_ERROR_TYPE_ERROR,
+                     "block-dht",
                      _("Size mismatch for block\n"),
                      GNUNET_BLOCK_TYPE_DHT_HELLO);
     return GNUNET_NO;
@@ -200,7 +204,8 @@ block_plugin_dht_get_key (void *cls,
   pid = (struct GNUNET_PeerIdentity *) key;
   if (GNUNET_OK != GNUNET_HELLO_get_id (hello, pid))
   {
-    GNUNET_log_from (GNUNET_ERROR_TYPE_ERROR, "block-dht",
+    GNUNET_log_from (GNUNET_ERROR_TYPE_ERROR,
+                     "block-dht",
                      _("Block of type %u is malformed\n"),
                      GNUNET_BLOCK_TYPE_DHT_HELLO);
     return GNUNET_NO;
diff --git a/src/dht/test_dht_2dtorus.conf b/src/dht/test_dht_2dtorus.conf
index de138e537..a541e8443 100644
--- a/src/dht/test_dht_2dtorus.conf
+++ b/src/dht/test_dht_2dtorus.conf
@@ -1,5 +1,5 @@
-@INLINE@ ../../contrib/no_forcestart.conf
-@INLINE@ ../../contrib/no_autostart_above_core.conf
+@INLINE@ ../../contrib/conf/gnunet/no_forcestart.conf
+@INLINE@ ../../contrib/conf/gnunet/no_autostart_above_core.conf
 [PATHS]
 GNUNET_TEST_HOME = $GNUNET_TMP/test_dht_2dtorus/
 
diff --git a/src/dht/test_dht_api_data.conf b/src/dht/test_dht_api_data.conf
index 6f5bf8525..a2c1829c6 100644
--- a/src/dht/test_dht_api_data.conf
+++ b/src/dht/test_dht_api_data.conf
@@ -1,5 +1,5 @@
-@INLINE@ ../../contrib/no_forcestart.conf
-@INLINE@ ../../contrib/no_autostart_above_core.conf
+@INLINE@ ../../contrib/conf/gnunet/no_forcestart.conf
+@INLINE@ ../../contrib/conf/gnunet/no_autostart_above_core.conf
 
 [PATHS]
 GNUNET_TEST_HOME = $GNUNET_TMP/test-dht-api/
diff --git a/src/dht/test_dht_api_peer1.conf b/src/dht/test_dht_api_peer1.conf
index b563f5096..b4164077f 100644
--- a/src/dht/test_dht_api_peer1.conf
+++ b/src/dht/test_dht_api_peer1.conf
@@ -1,5 +1,5 @@
-@INLINE@ ../../contrib/no_forcestart.conf
-@INLINE@ ../../contrib/no_autostart_above_core.conf
+@INLINE@ ../../contrib/conf/gnunet/no_forcestart.conf
+@INLINE@ ../../contrib/conf/gnunet/no_autostart_above_core.conf
 
 [dhtcache]
 QUOTA = 1 MB
diff --git a/src/dht/test_dht_line.conf b/src/dht/test_dht_line.conf
index 81ce94390..5368b0baf 100644
--- a/src/dht/test_dht_line.conf
+++ b/src/dht/test_dht_line.conf
@@ -1,5 +1,5 @@
-@INLINE@ ../../contrib/no_forcestart.conf
-@INLINE@ ../../contrib/no_autostart_above_core.conf
+@INLINE@ ../../contrib/conf/gnunet/no_forcestart.conf
+@INLINE@ ../../contrib/conf/gnunet/no_autostart_above_core.conf
 [PATHS]
 GNUNET_TEST_HOME = $GNUNET_TMP/test_dht_line/
 
diff --git a/src/dht/test_dht_monitor.conf b/src/dht/test_dht_monitor.conf
index e33563746..c0d457e89 100644
--- a/src/dht/test_dht_monitor.conf
+++ b/src/dht/test_dht_monitor.conf
@@ -1,5 +1,5 @@
-@INLINE@ ../../contrib/no_forcestart.conf
-@INLINE@ ../../contrib/no_autostart_above_core.conf
+@INLINE@ ../../contrib/conf/gnunet/no_forcestart.conf
+@INLINE@ ../../contrib/conf/gnunet/no_autostart_above_core.conf
 
 
 [dhtcache]
diff --git a/src/dht/test_dht_multipeer.conf b/src/dht/test_dht_multipeer.conf
index 5251883aa..4296d783e 100644
--- a/src/dht/test_dht_multipeer.conf
+++ b/src/dht/test_dht_multipeer.conf
@@ -1,5 +1,5 @@
-@INLINE@ ../../contrib/no_forcestart.conf
-@INLINE@ ../../contrib/no_autostart_above_core.conf
+@INLINE@ ../../contrib/conf/gnunet/no_forcestart.conf
+@INLINE@ ../../contrib/conf/gnunet/no_autostart_above_core.conf
 
 [dht]
 AUTOSTART = YES
diff --git a/src/dht/test_dht_tools.py.in b/src/dht/test_dht_tools.py.in
index 2d4ab9adc..05582cbd0 100644
--- a/src/dht/test_dht_tools.py.in
+++ b/src/dht/test_dht_tools.py.in
@@ -21,105 +21,113 @@ import subprocess
 import time
 import tempfile
 
-os.environ["PATH"] = "@bindir@" + ":" + os.environ["PATH"];
+os.environ["PATH"] = "@bindir@" + ":" + os.environ["PATH"]
 
 if os.name == "nt":
-  tmp = os.getenv ("TEMP")
+    tmp = os.getenv("TEMP")
 else:
-  tmp = "/tmp"
+    tmp = "/tmp"
 
 if os.name == 'nt':
-  get = './gnunet-dht-get.exe'
-  put = './gnunet-dht-put.exe'
-  arm = 'gnunet-arm.exe'
+    get = './gnunet-dht-get.exe'
+    put = './gnunet-dht-put.exe'
+    arm = 'gnunet-arm.exe'
 else:
-  get = './gnunet-dht-get'
-  put = './gnunet-dht-put'
-  arm = 'gnunet-arm'
+    get = './gnunet-dht-get'
+    put = './gnunet-dht-put'
+    arm = 'gnunet-arm'
 
 cfgfile = 'test_dht_api_peer1.conf'
-  
 run_get = [get, '-c', cfgfile]
 run_put = [put, '-c', cfgfile]
 run_arm = [arm, '-c', cfgfile]
-debug = os.getenv ('DEBUG')
+debug = os.getenv('DEBUG')
 if debug:
-  run_arm += [debug.split (' ')]
-
-def cleanup (exitcode):
-  sys.exit (exitcode)
-
-def sub_run (args, want_stdo = True, want_stde = False, nofail = False):
-  if want_stdo:
-    stdo = subprocess.PIPE
-  else:
-    stdo = None
-  if want_stde:
-    stde = subprocess.PIPE
-  else:
-    stde = None
-  p = subprocess.Popen (args, stdout = stdo, stderr = stde)
-  stdo, stde = p.communicate ()
-  if not nofail:
-    if p.returncode != 0:
-      sys.exit (p.returncode)
-  return (p.returncode, stdo, stde)
-
-def fail (result):
-  print (result)
-  r_arm (['-e'], want_stdo = False)
-  cleanup (1)
-
-def r_something (to_run, extra_args, failer = None, normal = True, **kw):
-  rc, stdo, stde = sub_run (to_run + extra_args, nofail = True, **kw)
-  if failer is not None:
-    failer (to_run + extra_args, rc, stdo, stde, normal)
-  return (rc, stdo, stde)
-
-def r_arm (extra_args, **kw):
-  return r_something (run_arm, extra_args, **kw)
-
-def r_get (extra_args, **kw):
-  return r_something (run_get, extra_args, **kw)
-
-def r_put (extra_args, **kw):
-  return r_something (run_put, extra_args, **kw)
-
-def end_arm_failer (command, rc, stdo, stde, normal):
-  if normal:
-    if rc != 0:
-      fail ("FAIL: error running {}\nCommand output was:\n{}\n{}".format (command, stdo, stde))
-  else:
-    if rc == 0:
-      fail ("FAIL: expected error while running {}\nCommand output was:\n{}\n{}".format (command, stdo, stde))
-
-def print_only_failer (command, rc, stdo, stde, normal):
-  if normal:
-    if rc != 0:
-      print ("FAIL: error running {}\nCommand output was:\n{}\n{}".format (command, stdo, stde))
-      cleanup (1)
-  else:
-    if rc == 0:
-      print ("FAIL: expected error while running {}\nCommand output was:\n{}\n{}".format (command, stdo, stde))
-      cleanup (1)
-
-
-print ("TEST: Starting ARM...", end='')
-r_arm (['-s'], failer = end_arm_failer, want_stdo = False, want_stde = False)
-print ("PASS")
-time.sleep (1)
-
-print ("TEST: Testing put...", end='')
-r_put (['-k', 'testkey', '-d', 'testdata', '-t', '8'], failer = end_arm_failer)
-print ("PASS")
-time.sleep (1)
-
-print ("TEST: Testing get...", end='')
-rc, stdo, stde = r_get (['-k', 'testkey', '-T', '50 ms', '-t', '8'], want_stdo = True, failer = end_arm_failer)
-stdo = stdo.replace ('\r', '').splitlines ()
+    run_arm += [debug.split(' ')]
+
+
+def cleanup(exitcode):
+    sys.exit(exitcode)
+
+
+def sub_run(args, want_stdo=True, want_stde=False, nofail=False):
+    if want_stdo:
+        stdo = subprocess.PIPE
+    else:
+        stdo = None
+    if want_stde:
+        stde = subprocess.PIPE
+    else:
+        stde = None
+    p = subprocess.Popen(args, stdout=stdo, stderr=stde)
+    stdo, stde = p.communicate()
+    if not nofail:
+        if p.returncode != 0:
+            sys.exit(p.returncode)
+    return (p.returncode, stdo, stde)
+
+
+def fail(result):
+    print(result)
+    r_arm(['-e'], want_stdo=False)
+    cleanup(1)
+
+
+def r_something(to_run, extra_args, failer=None, normal=True, **kw):
+    rc, stdo, stde = sub_run(to_run + extra_args, nofail=True, **kw)
+    if failer is not None:
+        failer(to_run + extra_args, rc, stdo, stde, normal)
+    return (rc, stdo, stde)
+
+
+def r_arm(extra_args, **kw):
+    return r_something(run_arm, extra_args, **kw)
+
+
+def r_get(extra_args, **kw):
+    return r_something(run_get, extra_args, **kw)
+
+
+def r_put(extra_args, **kw):
+    return r_something(run_put, extra_args, **kw)
+
+
+def end_arm_failer(command, rc, stdo, stde, normal):
+    if normal:
+        if rc != 0:
+            fail("FAIL: error running {}\nCommand output was:\n{}\n{}".format(command, stdo, stde))
+    else:
+        if rc == 0:
+            fail("FAIL: expected error while running {}\nCommand output was:\n{}\n{}".format(command, stdo, stde))
+
+
+def print_only_failer(command, rc, stdo, stde, normal):
+    if normal:
+        if rc != 0:
+            print("FAIL: error running {}\nCommand output was:\n{}\n{}".format(command, stdo, stde))
+            cleanup(1)
+    else:
+        if rc == 0:
+            print("FAIL: expected error while running {}\nCommand output was:\n{}\n{}".format(command, stdo, stde))
+            cleanup(1)
+
+
+print("TEST: Starting ARM...", end='')
+r_arm(['-s'], failer=end_arm_failer, want_stdo=False, want_stde=False)
+print("PASS")
+time.sleep(1)
+
+print("TEST: Testing put...", end='')
+r_put(['-k', 'testkey', '-d', 'testdata', '-t', '8'], failer=end_arm_failer)
+print("PASS")
+time.sleep(1)
+
+print("TEST: Testing get...", end='')
+rc, stdo, stde = r_get(['-k', 'testkey', '-T', '50 ms', '-t', '8'], want_stdo=True, failer=end_arm_failer)
+stdo = stdo.replace('\r', '').splitlines()
 expect = "Result 0, type 8:\ntestdata".splitlines()
-if len (stdo) != 2 or len (expect) != 2 or stdo[0] != expect[0] or stdo[1] != expect[1]:
-  fail ("output `{}' differs from expected `{}'".format (stdo, expect))
-print ("PASS")
+if len(stdo) != 2 or len(expect) != 2 or stdo[0] != expect[0] or stdo[1] != expect[1]:
+    fail("output `{}' differs from expected `{}'".format(stdo, expect))
+print("PASS")
 
-r_arm (['-e', '-d'], failer = print_only_failer)
+r_arm(['-e', '-d'], failer=print_only_failer)
diff --git a/src/fs/test_fs_defaults.conf b/src/fs/test_fs_defaults.conf
index 79344cd66..42661b25d 100644
--- a/src/fs/test_fs_defaults.conf
+++ b/src/fs/test_fs_defaults.conf
@@ -1,4 +1,4 @@
-@INLINE@ ../../contrib/no_forcestart.conf
+@INLINE@ ../../contrib/conf/gnunet/no_forcestart.conf
 
 [PATHS]
 GNUNET_TEST_HOME = $GNUNET_TMP/gnunet-test-fs-lib/
diff --git a/src/fs/test_gnunet_fs_idx.py.in b/src/fs/test_gnunet_fs_idx.py.in
index bd8aa5f7a..a669998fb 100755
--- a/src/fs/test_gnunet_fs_idx.py.in
+++ b/src/fs/test_gnunet_fs_idx.py.in
@@ -25,50 +25,50 @@ import re
 import shutil
 
 srcdir = "../.."
-gnunet_pyexpect_dir = os.path.join (srcdir, "contrib")
+gnunet_pyexpect_dir = os.path.join(srcdir, "contrib/scripts")
 if gnunet_pyexpect_dir not in sys.path:
-  sys.path.append (gnunet_pyexpect_dir)
+    sys.path.append(gnunet_pyexpect_dir)
 
 from gnunet_pyexpect import pexpect
 
 if os.name == 'posix':
-  download = './gnunet-download'
-  gnunetarm = 'gnunet-arm'
-  publish = './gnunet-publish'
-  unindex = './gnunet-unindex'
+    download = './gnunet-download'
+    gnunetarm = 'gnunet-arm'
+    publish = './gnunet-publish'
+    unindex = './gnunet-unindex'
 elif os.name == 'nt':
-  download = './gnunet-download.exe'
-  gnunetarm = 'gnunet-arm.exe'
-  publish = './gnunet-publish.exe'
-  unindex = './gnunet-unindex.exe'
+    download = './gnunet-download.exe'
+    gnunetarm = 'gnunet-arm.exe'
+    publish = './gnunet-publish.exe'
+    unindex = './gnunet-unindex.exe'
 
 if os.name == "nt":
-  shutil.rmtree (os.path.join (os.getenv ("TEMP"), "gnunet-test-fs-py-idx"), True)
+    shutil.rmtree(os.path.join(os.getenv("TEMP"), "gnunet-test-fs-py-idx"), True)
 else:
-  shutil.rmtree ("/tmp/gnunet-test-fs-py-idx", True)
+    shutil.rmtree("/tmp/gnunet-test-fs-py-idx", True)
 
-arm = subprocess.Popen ([gnunetarm, '-sq', '-c', 'test_gnunet_fs_idx_data.conf'])
-arm.communicate ()
+arm = subprocess.Popen([gnunetarm, '-sq', '-c', 'test_gnunet_fs_idx_data.conf'])
+arm.communicate()
 
 try:
-  pub = pexpect ()
+    pub = pexpect()
 
-  pub.spawn (None, [publish, '-c', 'test_gnunet_fs_idx_data.conf', '-m', "description:Test archive", '-k', 'tst', 'test_gnunet_fs_rec_data.tgz'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
-  pub.expect ("stdout", re.compile (r"URI is `gnunet://fs/chk/2ZMHKPV74CB6GB1GFKQRR95BXJQA2SER25FN48GAW7WSBPA0GDEM5Y74V1ZJHM0NA6919TVW376BHTFDRE3RYS0KRY92M1QJVKPHFCR\.49BT3V5C10KA1695JF71FCT8ZZG4JMJSH04BD9CT22R6KEM915A7CEST17RD0QYTHXV5M4HHEGJMEZSFRDB7JAYC0EMJAN2V781E9DG\.17822'\.\r?\n"))
+    pub.spawn(None, [publish, '-c', 'test_gnunet_fs_idx_data.conf', '-m', "description:Test archive", '-k', 'tst', 'test_gnunet_fs_rec_data.tgz'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+    pub.expect("stdout", re.compile(r"URI is `gnunet://fs/chk/2ZMHKPV74CB6GB1GFKQRR95BXJQA2SER25FN48GAW7WSBPA0GDEM5Y74V1ZJHM0NA6919TVW376BHTFDRE3RYS0KRY92M1QJVKPHFCR\.49BT3V5C10KA1695JF71FCT8ZZG4JMJSH04BD9CT22R6KEM915A7CEST17RD0QYTHXV5M4HHEGJMEZSFRDB7JAYC0EMJAN2V781E9DG\.17822'\.\r?\n"))
 
-  down = pexpect ()
-  down.spawn (None, [download, '-c', 'test_gnunet_fs_idx_data.conf', '-o', 'test_gnunet_fs_rec_data.tar.gz', 'gnunet://fs/chk/2ZMHKPV74CB6GB1GFKQRR95BXJQA2SER25FN48GAW7WSBPA0GDEM5Y74V1ZJHM0NA6919TVW376BHTFDRE3RYS0KRY92M1QJVKPHFCR.49BT3V5C10KA1695JF71FCT8ZZG4JMJSH04BD9CT22R6KEM915A7CEST17RD0QYTHXV5M4HHEGJMEZSFRDB7JAYC0EMJAN2V781E9DG.17822'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
-  down.expect ("stdout", re.compile (r"Downloading `test_gnunet_fs_rec_data.tar.gz' done (.*).\r?\n"))
-  os.remove ("test_gnunet_fs_rec_data.tar.gz")
+    down = pexpect()
+    down.spawn(None, [download, '-c', 'test_gnunet_fs_idx_data.conf', '-o', 'test_gnunet_fs_rec_data.tar.gz', 'gnunet://fs/chk/2ZMHKPV74CB6GB1GFKQRR95BXJQA2SER25FN48GAW7WSBPA0GDEM5Y74V1ZJHM0NA6919TVW376BHTFDRE3RYS0KRY92M1QJVKPHFCR.49BT3V5C10KA1695JF71FCT8ZZG4JMJSH04BD9CT22R6KEM915A7CEST17RD0QYTHXV5M4HHEGJMEZSFRDB7JAYC0EMJAN2V781E9DG.17822'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+    down.expect("stdout", re.compile(r"Downloading `test_gnunet_fs_rec_data.tar.gz' done (.*).\r?\n"))
+    os.remove("test_gnunet_fs_rec_data.tar.gz")
 
-  un = pexpect ()
-  un.spawn (None, [unindex, '-c', 'test_gnunet_fs_idx_data.conf', 'test_gnunet_fs_rec_data.tgz'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
-  un.expect ("stdout", re.compile (r'Unindexing done\.\r?\n'))
+    un = pexpect()
+    un.spawn(None, [unindex, '-c', 'test_gnunet_fs_idx_data.conf', 'test_gnunet_fs_rec_data.tgz'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+    un.expect("stdout", re.compile(r'Unindexing done\.\r?\n'))
 
 finally:
-  arm = subprocess.Popen ([gnunetarm, '-eq', '-c', 'test_gnunet_fs_idx_data.conf'])
-  arm.communicate ()
-  if os.name == "nt":
-    shutil.rmtree (os.path.join (os.getenv ("TEMP"), "gnunet-test-fs-py-idx"), True)
-  else:
-    shutil.rmtree ("/tmp/gnunet-test-fs-py-idx", True)
+    arm = subprocess.Popen([gnunetarm, '-eq', '-c', 'test_gnunet_fs_idx_data.conf'])
+    arm.communicate()
+    if os.name == "nt":
+        shutil.rmtree(os.path.join(os.getenv("TEMP"), "gnunet-test-fs-py-idx"), True)
+    else:
+        shutil.rmtree("/tmp/gnunet-test-fs-py-idx", True)
diff --git a/src/fs/test_gnunet_fs_psd.py.in b/src/fs/test_gnunet_fs_psd.py.in
index 601797c82..4b27b4532 100755
--- a/src/fs/test_gnunet_fs_psd.py.in
+++ b/src/fs/test_gnunet_fs_psd.py.in
@@ -29,59 +29,60 @@ except NameError:
     # python3.4:
     from importlib import reload
 
+
 # Force encoding to utf-8, as this test otherwise fails
 # on some systems (see #5094).
 reload(sys)
 sys.setdefaultencoding('utf8')
 
 srcdir = "../.."
-gnunet_pyexpect_dir = os.path.join (srcdir, "contrib")
+gnunet_pyexpect_dir = os.path.join(srcdir, "contrib/scripts")
 if gnunet_pyexpect_dir not in sys.path:
-  sys.path.append (gnunet_pyexpect_dir)
+    sys.path.append(gnunet_pyexpect_dir)
 
 from gnunet_pyexpect import pexpect
 
 if os.name == 'posix':
-  download = './gnunet-download'
-  gnunetarm = 'gnunet-arm'
-  publish = './gnunet-publish'
-  unindex = './gnunet-unindex'
-  search = './gnunet-search'
+    download = './gnunet-download'
+    gnunetarm = 'gnunet-arm'
+    publish = './gnunet-publish'
+    unindex = './gnunet-unindex'
+    search = './gnunet-search'
 elif os.name == 'nt':
-  download = './gnunet-download.exe'
-  gnunetarm = 'gnunet-arm.exe'
-  publish = './gnunet-publish.exe'
-  unindex = './gnunet-unindex.exe'
-  search = './gnunet-search.exe'
+    download = './gnunet-download.exe'
+    gnunetarm = 'gnunet-arm.exe'
+    publish = './gnunet-publish.exe'
+    unindex = './gnunet-unindex.exe'
+    search = './gnunet-search.exe'
 
 if os.name == "nt":
-  shutil.rmtree (os.path.join (os.getenv ("TEMP"), "gnunet-test-fs-py-psd"), True)
+    shutil.rmtree(os.path.join(os.getenv("TEMP"), "gnunet-test-fs-py-psd"), True)
 else:
-  shutil.rmtree ("/tmp/gnunet-test-fs-py-psd", True)
+    shutil.rmtree("/tmp/gnunet-test-fs-py-psd", True)
 
-arm = subprocess.Popen ([gnunetarm, '-sq', '-c', 'test_gnunet_fs_psd_data.conf'])
-arm.communicate ()
+arm = subprocess.Popen([gnunetarm, '-sq', '-c', 'test_gnunet_fs_psd_data.conf'])
+arm.communicate()
 
 # first, basic publish-search-download run
 try:
-  pub = pexpect ()
-  pub.spawn (None, [publish, '-c', 'test_gnunet_fs_psd_data.conf', '-n', '-m', "description:Test archive", '-k', 'tst', 'test_gnunet_fs_rec_data.tgz'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
-  pub.expect ("stdout", re.compile (r"Publishing `.+test_gnunet_fs_rec_data.tgz' done\.\r?\n"))
-  pub.expect ("stdout", re.compile (r"URI is `gnunet://fs/chk/2ZMHKPV74CB6GB1GFKQRR95BXJQA2SER25FN48GAW7WSBPA0GDEM5Y74V1ZJHM0NA6919TVW376BHTFDRE3RYS0KRY92M1QJVKPHFCR\.49BT3V5C10KA1695JF71FCT8ZZG4JMJSH04BD9CT22R6KEM915A7CEST17RD0QYTHXV5M4HHEGJMEZSFRDB7JAYC0EMJAN2V781E9DG\.17822'\.\r?\n"))
+    pub = pexpect()
+    pub.spawn(None, [publish, '-c', 'test_gnunet_fs_psd_data.conf', '-n', '-m', "description:Test archive", '-k', 'tst', 'test_gnunet_fs_rec_data.tgz'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+    pub.expect("stdout", re.compile(r"Publishing `.+test_gnunet_fs_rec_data.tgz' done\.\r?\n"))
+    pub.expect("stdout", re.compile(r"URI is `gnunet://fs/chk/2ZMHKPV74CB6GB1GFKQRR95BXJQA2SER25FN48GAW7WSBPA0GDEM5Y74V1ZJHM0NA6919TVW376BHTFDRE3RYS0KRY92M1QJVKPHFCR\.49BT3V5C10KA1695JF71FCT8ZZG4JMJSH04BD9CT22R6KEM915A7CEST17RD0QYTHXV5M4HHEGJMEZSFRDB7JAYC0EMJAN2V781E9DG\.17822'\.\r?\n"))
 
-  s = pexpect ()
-  s.spawn (None, [search, '-V', '-t', '1000 ms', '-N', '1', '-c', 'test_gnunet_fs_psd_data.conf', 'tst'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
-  s.expect ("stdout", re.compile (r'gnunet-download -o "test_gnunet_fs_rec_data.tgz" gnunet://fs/chk/2ZMHKPV74CB6GB1GFKQRR95BXJQA2SER25FN48GAW7WSBPA0GDEM5Y74V1ZJHM0NA6919TVW376BHTFDRE3RYS0KRY92M1QJVKPHFCR\.49BT3V5C10KA1695JF71FCT8ZZG4JMJSH04BD9CT22R6KEM915A7CEST17RD0QYTHXV5M4HHEGJMEZSFRDB7JAYC0EMJAN2V781E9DG\.17822\r?\n'))
+    s = pexpect()
+    s.spawn(None, [search, '-V', '-t', '1000 ms', '-N', '1', '-c', 'test_gnunet_fs_psd_data.conf', 'tst'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+    s.expect("stdout", re.compile(r'gnunet-download -o "test_gnunet_fs_rec_data.tgz" gnunet://fs/chk/2ZMHKPV74CB6GB1GFKQRR95BXJQA2SER25FN48GAW7WSBPA0GDEM5Y74V1ZJHM0NA6919TVW376BHTFDRE3RYS0KRY92M1QJVKPHFCR\.49BT3V5C10KA1695JF71FCT8ZZG4JMJSH04BD9CT22R6KEM915A7CEST17RD0QYTHXV5M4HHEGJMEZSFRDB7JAYC0EMJAN2V781E9DG\.17822\r?\n'))
 
-  down = pexpect ()
-  down.spawn (None, [download, '-c', 'test_gnunet_fs_psd_data.conf', '-o', 'test_gnunet_fs_rec_data.tar.gz', 'gnunet://fs/chk/2ZMHKPV74CB6GB1GFKQRR95BXJQA2SER25FN48GAW7WSBPA0GDEM5Y74V1ZJHM0NA6919TVW376BHTFDRE3RYS0KRY92M1QJVKPHFCR.49BT3V5C10KA1695JF71FCT8ZZG4JMJSH04BD9CT22R6KEM915A7CEST17RD0QYTHXV5M4HHEGJMEZSFRDB7JAYC0EMJAN2V781E9DG.17822'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
-  down.expect ("stdout", re.compile (r"Downloading `test_gnunet_fs_rec_data.tar.gz' done (.*).\r?\n"))
-  os.remove ("test_gnunet_fs_rec_data.tar.gz")
+    down = pexpect()
+    down.spawn(None, [download, '-c', 'test_gnunet_fs_psd_data.conf', '-o', 'test_gnunet_fs_rec_data.tar.gz', 'gnunet://fs/chk/2ZMHKPV74CB6GB1GFKQRR95BXJQA2SER25FN48GAW7WSBPA0GDEM5Y74V1ZJHM0NA6919TVW376BHTFDRE3RYS0KRY92M1QJVKPHFCR.49BT3V5C10KA1695JF71FCT8ZZG4JMJSH04BD9CT22R6KEM915A7CEST17RD0QYTHXV5M4HHEGJMEZSFRDB7JAYC0EMJAN2V781E9DG.17822'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+    down.expect("stdout", re.compile(r"Downloading `test_gnunet_fs_rec_data.tar.gz' done (.*).\r?\n"))
+    os.remove("test_gnunet_fs_rec_data.tar.gz")
 
 finally:
-  arm = subprocess.Popen ([gnunetarm, '-eq', '-c', 'test_gnunet_fs_psd_data.conf'])
-  arm.communicate ()
-  if os.name == "nt":
-    shutil.rmtree (os.path.join (os.getenv ("TEMP"), "gnunet-test-fs-py-psd"), True)
-  else:
-    shutil.rmtree ("/tmp/gnunet-test-fs-py-psd", True)
+    arm = subprocess.Popen([gnunetarm, '-eq', '-c', 'test_gnunet_fs_psd_data.conf'])
+    arm.communicate()
+    if os.name == "nt":
+        shutil.rmtree(os.path.join(os.getenv("TEMP"), "gnunet-test-fs-py-psd"), True)
+    else:
+        shutil.rmtree("/tmp/gnunet-test-fs-py-psd", True)
diff --git a/src/fs/test_gnunet_fs_rec.py.in b/src/fs/test_gnunet_fs_rec.py.in
index 3828a65c9..aa9b7b461 100755
--- a/src/fs/test_gnunet_fs_rec.py.in
+++ b/src/fs/test_gnunet_fs_rec.py.in
@@ -27,88 +27,90 @@ import tarfile
 import filecmp
 
 srcdir = "../.."
-gnunet_pyexpect_dir = os.path.join (srcdir, "contrib")
+gnunet_pyexpect_dir = os.path.join(srcdir, "contrib/scripts")
 if gnunet_pyexpect_dir not in sys.path:
-  sys.path.append (gnunet_pyexpect_dir)
+    sys.path.append(gnunet_pyexpect_dir)
 
 from gnunet_pyexpect import pexpect
 from pydiffer import dcdiff
 
 if os.name == 'posix':
-  download = './gnunet-download'
-  gnunetarm = 'gnunet-arm'
-  publish = './gnunet-publish'
-  unindex = './gnunet-unindex'
-  search = './gnunet-search'
-  directory = './gnunet-directory'
+    download = './gnunet-download'
+    gnunetarm = 'gnunet-arm'
+    publish = './gnunet-publish'
+    unindex = './gnunet-unindex'
+    search = './gnunet-search'
+    directory = './gnunet-directory'
 elif os.name == 'nt':
-  download = './gnunet-download.exe'
-  gnunetarm = 'gnunet-arm.exe'
-  publish = './gnunet-publish.exe'
-  unindex = './gnunet-unindex.exe'
-  search = './gnunet-search.exe'
-  directory = './gnunet-directory.exe'
+    download = './gnunet-download.exe'
+    gnunetarm = 'gnunet-arm.exe'
+    publish = './gnunet-publish.exe'
+    unindex = './gnunet-unindex.exe'
+    search = './gnunet-search.exe'
+    directory = './gnunet-directory.exe'
 
 if os.name == "nt":
-  shutil.rmtree (os.path.join (os.getenv ("TEMP"), "gnunet-test-fs-py-rec"), True)
+    shutil.rmtree(os.path.join(os.getenv("TEMP"), "gnunet-test-fs-py-rec"), True)
 else:
-  shutil.rmtree ("/tmp/gnunet-test-fs-py-rec", True)
+    shutil.rmtree("/tmp/gnunet-test-fs-py-rec", True)
 
-arm = subprocess.Popen ([gnunetarm, '-sq', '-c', 'test_gnunet_fs_rec_data.conf'])
-arm.communicate ()
+arm = subprocess.Popen([gnunetarm, '-sq', '-c', 'test_gnunet_fs_rec_data.conf'])
+arm.communicate()
 
-# pray that `tar' is in PATH
-tar = tarfile.open ('test_gnunet_fs_rec_data.tgz')
-tar.extractall ()
+# pray that `tar' is in PATH.
+# FIXME: Actually we should check for that and output
+#        a message if it isn't found.
+tar = tarfile.open('test_gnunet_fs_rec_data.tgz')
+tar.extractall()
 # first, basic publish-search-download run
 try:
-  pub = pexpect ()
-  pub.spawn (None, [publish, '-c', 'test_gnunet_fs_rec_data.conf', '-d', '-k', 'testdir', 'dir/'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
-  # Can't say much for publishing, except that the last one is the toplevel directory
-  pub.expect ("stdout", re.compile (r"Publishing `.+' done\.\r?\n"))
-  pub.expect ("stdout", re.compile (r"URI is `gnunet://fs/chk/[A-Z0-9]{103}\.[A-Z0-9]{103}\.\d+'\.\r?\n"))
-  pub.expect ("stdout", re.compile (r"Publishing `.+' done\.\r?\n"))
-  pub.expect ("stdout", re.compile (r"URI is `gnunet://fs/chk/[A-Z0-9]{103}\.[A-Z0-9]{103}\.\d+'\.\r?\n"))
-  pub.expect ("stdout", re.compile (r"Publishing `.+' done\.\r?\n"))
-  pub.expect ("stdout", re.compile (r"URI is `gnunet://fs/chk/[A-Z0-9]{103}\.[A-Z0-9]{103}\.\d+'\.\r?\n"))
-  pub.expect ("stdout", re.compile (r"Publishing `.+' done\.\r?\n"))
-  pub.expect ("stdout", re.compile (r"URI is `gnunet://fs/chk/[A-Z0-9]{103}\.[A-Z0-9]{103}\.\d+'\.\r?\n"))
-  pub.expect ("stdout", re.compile (r"Publishing `.+' done\.\r?\n"))
-  pub.expect ("stdout", re.compile (r"URI is `gnunet://fs/chk/[A-Z0-9]{103}\.[A-Z0-9]{103}\.\d+'\.\r?\n"))
-  pub.expect ("stdout", re.compile (r"Publishing `.+' done\.\r?\n"))
-  pub.expect ("stdout", re.compile (r"URI is `gnunet://fs/chk/[A-Z0-9]{103}\.[A-Z0-9]{103}\.\d+'\.\r?\n"))
-  pub.expect ("stdout", re.compile (r"Publishing `.+[\\/]dir[\\/]' done\.\r?\n"))
-  m = pub.expect ("stdout", re.compile (r".+\r?\n"))
-  if not m:
-    sys.exit (3)
-  output = m.string
-  url = output[output.find ("`")+1:output.find("'")]
+    pub = pexpect()
+    pub.spawn(None, [publish, '-c', 'test_gnunet_fs_rec_data.conf', '-d', '-k', 'testdir', 'dir/'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+    # Can't say much for publishing, except that the last one is the toplevel directory
+    pub.expect("stdout", re.compile(r"Publishing `.+' done\.\r?\n"))
+    pub.expect("stdout", re.compile(r"URI is `gnunet://fs/chk/[A-Z0-9]{103}\.[A-Z0-9]{103}\.\d+'\.\r?\n"))
+    pub.expect("stdout", re.compile(r"Publishing `.+' done\.\r?\n"))
+    pub.expect("stdout", re.compile(r"URI is `gnunet://fs/chk/[A-Z0-9]{103}\.[A-Z0-9]{103}\.\d+'\.\r?\n"))
+    pub.expect("stdout", re.compile(r"Publishing `.+' done\.\r?\n"))
+    pub.expect("stdout", re.compile(r"URI is `gnunet://fs/chk/[A-Z0-9]{103}\.[A-Z0-9]{103}\.\d+'\.\r?\n"))
+    pub.expect("stdout", re.compile(r"Publishing `.+' done\.\r?\n"))
+    pub.expect("stdout", re.compile(r"URI is `gnunet://fs/chk/[A-Z0-9]{103}\.[A-Z0-9]{103}\.\d+'\.\r?\n"))
+    pub.expect("stdout", re.compile(r"Publishing `.+' done\.\r?\n"))
+    pub.expect("stdout", re.compile(r"URI is `gnunet://fs/chk/[A-Z0-9]{103}\.[A-Z0-9]{103}\.\d+'\.\r?\n"))
+    pub.expect("stdout", re.compile(r"Publishing `.+' done\.\r?\n"))
+    pub.expect("stdout", re.compile(r"URI is `gnunet://fs/chk/[A-Z0-9]{103}\.[A-Z0-9]{103}\.\d+'\.\r?\n"))
+    pub.expect("stdout", re.compile(r"Publishing `.+[\\/]dir[\\/]' done\.\r?\n"))
+    m = pub.expect("stdout", re.compile(r".+\r?\n"))
+    if not m:
+        sys.exit(3)
+    output = m.string
+    url = output[output.find("`")+1:output.find("'")]
 
-  down = pexpect ()
-  down.spawn (None, [download, '-c', 'test_gnunet_fs_rec_data.conf', '-R', '-o', 'rdir.gnd', url], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
-  down.expect ("stdout", re.compile (r"Downloading `rdir.gnd' done (.*).\r?\n"))
+    down = pexpect()
+    down.spawn(None, [download, '-c', 'test_gnunet_fs_rec_data.conf', '-R', '-o', 'rdir.gnd', url], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+    down.expect("stdout", re.compile(r"Downloading `rdir.gnd' done (.*).\r?\n"))
 
-  d = pexpect ()
-  d.spawn (None, [directory, '-c', 'test_gnunet_fs_rec_data.conf', 'rdir/a.gnd'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
-  d.expect ("stdout", re.compile (r"Directory `a/' meta data:\r?\n"))
-  d.expect ("stdout", re.compile (r"Directory `a/' contents:\r?\n"))
-  d.expect ("stdout", re.compile (r"COPYING (.*)\r?\n"))
-  d.expect ("stdout", re.compile (r"INSTALL (.*)\r?\n"))
+    d = pexpect()
+    d.spawn(None, [directory, '-c', 'test_gnunet_fs_rec_data.conf', 'rdir/a.gnd'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+    d.expect("stdout", re.compile(r"Directory `a/' meta data:\r?\n"))
+    d.expect("stdout", re.compile(r"Directory `a/' contents:\r?\n"))
+    d.expect("stdout", re.compile(r"COPYING (.*)\r?\n"))
+    d.expect("stdout", re.compile(r"INSTALL (.*)\r?\n"))
+
+    os.remove("rdir/b.gnd")
+    os.remove("rdir/a.gnd")
+    diff = dcdiff('dir', 'rdir')
+    if len(diff) != 0:
+        raise Exception("Unexpected difference between source directory and downloaded result:\n{}".format(diff))
 
-  os.remove ("rdir/b.gnd")
-  os.remove ("rdir/a.gnd")
-  diff = dcdiff ('dir', 'rdir')
-  if len (diff) != 0:
-    raise Exception ("Unexpected difference between source directory and downloaded result:\n{}".format (diff))
-  
 
 finally:
-  arm = subprocess.Popen ([gnunetarm, '-eq', '-c', 'test_gnunet_fs_rec_data.conf'])
-  arm.communicate ()
-  if os.name == "nt":
-    shutil.rmtree (os.path.join (os.getenv ("TEMP"), "gnunet-test-fs-py-rec"), True)
-  else:
-    shutil.rmtree ("/tmp/gnunet-test-fs-py-rec", True)
-  shutil.rmtree ("dir", True)
-  shutil.rmtree ("rdir", True)
-  shutil.rmtree ("rdir.gnd", True)
+    arm = subprocess.Popen([gnunetarm, '-eq', '-c', 'test_gnunet_fs_rec_data.conf'])
+    arm.communicate()
+    if os.name == "nt":
+        shutil.rmtree(os.path.join(os.getenv("TEMP"), "gnunet-test-fs-py-rec"), True)
+    else:
+        shutil.rmtree("/tmp/gnunet-test-fs-py-rec", True)
+    shutil.rmtree("dir", True)
+    shutil.rmtree("rdir", True)
+    shutil.rmtree("rdir.gnd", True)
diff --git a/src/gns/Makefile.am b/src/gns/Makefile.am
index ac11c834e..46642113f 100644
--- a/src/gns/Makefile.am
+++ b/src/gns/Makefile.am
@@ -264,6 +264,7 @@ check_SCRIPTS = \
   test_gns_txt_lookup.sh\
   test_gns_mx_lookup.sh \
   test_gns_gns2dns_lookup.sh \
+  test_gns_gns2dns_cname_lookup.sh \
   test_gns_dht_lookup.sh\
   test_gns_delegated_lookup.sh \
   test_gns_at_lookup.sh\
diff --git a/src/gns/gnunet-gns-benchmark.c b/src/gns/gnunet-gns-benchmark.c
index d5afae9f6..0ab6cefd5 100644
--- a/src/gns/gnunet-gns-benchmark.c
+++ b/src/gns/gnunet-gns-benchmark.c
@@ -84,7 +84,7 @@ struct Request
    * this struct (optimizing memory consumption by reducing
    * total number of allocations).
    */
-  char *hostname;
+  const char *hostname;
 
   /**
    * While we are fetching the record, the value is set to the
@@ -176,6 +176,11 @@ static struct GNUNET_TIME_Relative request_delay;
  */
 static struct GNUNET_TIME_Relative timeout;
 
+/**
+ * Number of requests we have concurrently active.
+ */
+static unsigned int active_cnt;
+
 
 /**
  * Free @a req and data structures reachable from it.
@@ -210,6 +215,10 @@ process_result (void *cls,
   (void) gns_tld;
   (void) rd_count;
   (void) rd;
+  active_cnt--;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Got response for request `%s'\n",
+              req->hostname);
   req->lr = NULL;
   req->latency = GNUNET_TIME_absolute_get_duration (req->op_start_time);
   GNUNET_CONTAINER_DLL_remove (act_head,
@@ -247,7 +256,11 @@ process_queue (void *cls)
     GNUNET_CONTAINER_DLL_remove (act_head,
                                  act_tail,
                                  req);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Failing request `%s' due to timeout\n",
+                req->hostname);
     failures[req->cat]++;
+    active_cnt--;
     free_request (req);
   }
   if (NULL == (req = todo_head))
@@ -273,7 +286,12 @@ process_queue (void *cls)
                                     act_tail,
                                     req);
   lookups[req->cat]++;
+  active_cnt++;
   req->op_start_time = GNUNET_TIME_absolute_get ();
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Starting request `%s' (%u in parallel)\n",
+              req->hostname,
+              active_cnt);
   req->lr = GNUNET_GNS_lookup_with_tld (gns,
                                         req->hostname,
                                         GNUNET_GNSRECORD_TYPE_ANY,
@@ -439,7 +457,7 @@ queue (const char *hostname,
   req = GNUNET_malloc (sizeof (struct Request) + hlen);
   req->cat = cat;
   req->hostname = (char *) &req[1];
-  GNUNET_memcpy (req->hostname,
+  GNUNET_memcpy (&req[1],
                  hostname,
                  hlen);
   GNUNET_CONTAINER_DLL_insert (todo_head,
diff --git a/src/gns/gnunet-service-gns.c b/src/gns/gnunet-service-gns.c
index cffae824d..aaa4aeb0e 100644
--- a/src/gns/gnunet-service-gns.c
+++ b/src/gns/gnunet-service-gns.c
@@ -334,30 +334,43 @@ client_connect_cb (void *cls,
  * @param rd the record data
  */
 static void
-send_lookup_response (void* cls,
+send_lookup_response (void *cls,
                       uint32_t rd_count,
                       const struct GNUNET_GNSRECORD_Data *rd)
 {
   struct ClientLookupHandle *clh = cls;
   struct GnsClient *gc = clh->gc;
- struct GNUNET_MQ_Envelope *env;
+  struct GNUNET_MQ_Envelope *env;
   struct LookupResultMessage *rmsg;
-  size_t len;
+  ssize_t len;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Sending LOOKUP_RESULT message with %u results\n",
               (unsigned int) rd_count);
   len = GNUNET_GNSRECORD_records_get_size (rd_count,
                                            rd);
+  if (len < 0)
+  {
+    GNUNET_break (0);
+    GNUNET_SERVICE_client_drop (gc->client);
+    return;
+  }
+  if (len > UINT16_MAX - sizeof (*rmsg))
+  {
+    GNUNET_break (0);
+    GNUNET_SERVICE_client_drop (gc->client);
+    return;
+  }
   env = GNUNET_MQ_msg_extra (rmsg,
                              len,
                              GNUNET_MESSAGE_TYPE_GNS_LOOKUP_RESULT);
   rmsg->id = clh->request_id;
   rmsg->rd_count = htonl (rd_count);
-  GNUNET_GNSRECORD_records_serialize (rd_count,
-                                      rd,
-                                      len,
-                                      (char*) &rmsg[1]);
+  GNUNET_assert (len ==
+                 GNUNET_GNSRECORD_records_serialize (rd_count,
+                                                     rd,
+                                                     len,
+                                                     (char*) &rmsg[1]));
   GNUNET_MQ_send (GNUNET_SERVICE_client_get_mq (gc->client),
                   env);
   GNUNET_CONTAINER_DLL_remove (gc->clh_head,
diff --git a/src/gns/gnunet-service-gns_resolver.c b/src/gns/gnunet-service-gns_resolver.c
index 542085910..8b20f2ae3 100644
--- a/src/gns/gnunet-service-gns_resolver.c
+++ b/src/gns/gnunet-service-gns_resolver.c
@@ -151,16 +151,6 @@ struct AuthorityChain
   char *label;
 
   /**
-   * label/name suggested for shortening to the authority
-   */
-  char *suggested_shortening_label;
-
-  /**
-   * Do we already try to shorten this authority?
-   */
-  int shortening_started;
-
-  /**
    * #GNUNET_YES if the authority was a GNS authority,
    * #GNUNET_NO if the authority was a DNS authority.
    */
@@ -290,7 +280,7 @@ struct VpnContext
   /**
    * Number of bytes in @e rd_data.
    */
-  size_t rd_data_size;
+  ssize_t rd_data_size;
 };
 
 
@@ -946,35 +936,45 @@ dns_result_parser (void *cls,
   if ( (p->num_answers > 0) &&
        (GNUNET_DNSPARSER_TYPE_CNAME == p->answers[0].type) &&
        (GNUNET_DNSPARSER_TYPE_CNAME != rh->record_type) )
-    {
-      int af;
+  {
+    int af;
 
-      GNUNET_free (rh->name);
-      rh->name = GNUNET_strdup (p->answers[0].data.hostname);
-      rh->name_resolution_pos = strlen (rh->name);
-      switch (rh->record_type)
-      {
-      case GNUNET_DNSPARSER_TYPE_A:
-        af = AF_INET;
-        break;
-      case GNUNET_DNSPARSER_TYPE_AAAA:
-        af = AF_INET6;
-        break;
-      default:
-        af = AF_UNSPEC;
-        break;
-      }
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  "Doing standard DNS lookup for `%s'\n",
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                "Got CNAME `%s' from DNS for `%s'\n",
+                p->answers[0].data.hostname,
+                rh->name);
+    if (NULL != rh->std_resolve)
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                  "Multiple CNAME results from DNS resolving `%s'! Not really allowed...\n",
                   rh->name);
-      rh->std_resolve = GNUNET_RESOLVER_ip_get (rh->name,
-                                                af,
-                                                DNS_LOOKUP_TIMEOUT,
-                                                &handle_dns_result,
-                                                rh);
-      GNUNET_DNSPARSER_free_packet (p);
-      return;
+      GNUNET_RESOLVER_request_cancel (rh->std_resolve);
+    }
+    GNUNET_free (rh->name);
+    rh->name = GNUNET_strdup (p->answers[0].data.hostname);
+    rh->name_resolution_pos = strlen (rh->name);
+    switch (rh->record_type)
+    {
+    case GNUNET_DNSPARSER_TYPE_A:
+      af = AF_INET;
+      break;
+    case GNUNET_DNSPARSER_TYPE_AAAA:
+      af = AF_INET6;
+      break;
+    default:
+      af = AF_UNSPEC;
+      break;
     }
+    rh->std_resolve = GNUNET_RESOLVER_ip_get (rh->name,
+                                              af,
+                                              DNS_LOOKUP_TIMEOUT,
+                                              &handle_dns_result,
+                                              rh);
+    GNUNET_DNSPARSER_free_packet (p);
+    GNUNET_DNSSTUB_resolve_cancel (rh->dns_request);
+    rh->dns_request = NULL;
+    return;
+  }
 
   /* convert from (parsed) DNS to (binary) GNS format! */
   rd_count = p->num_answers + p->num_authority_records + p->num_additional_records;
@@ -1112,6 +1112,8 @@ dns_result_parser (void *cls,
     rh->proc (rh->proc_cls,
               rd_count - skip,
               rd);
+    GNUNET_DNSSTUB_resolve_cancel (rh->dns_request);
+    rh->dns_request = NULL;
   }
   GNUNET_DNSPARSER_free_packet (p);
   if (NULL != rh->task_id)
@@ -1235,8 +1237,6 @@ handle_gns_cname_result (struct GNS_ResolverHandle *rh,
     ac->gns_authority = GNUNET_YES;
     ac->authority_info.gns_authority = rh->ac_tail->authority_info.gns_authority;
     ac->label = resolver_lookup_get_next_label (rh);
-    ac->suggested_shortening_label = NULL;
-    ac->shortening_started = GNUNET_NO;
     /* add AC to tail */
     GNUNET_CONTAINER_DLL_insert_tail (rh->ac_head,
                                       rh->ac_tail,
@@ -1245,6 +1245,17 @@ handle_gns_cname_result (struct GNS_ResolverHandle *rh,
                                             rh);
     return;
   }
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "Got CNAME `%s' from GNS for `%s'\n",
+              cname,
+              rh->name);
+  if (NULL != rh->std_resolve)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "Multiple CNAME results from GNS resolving `%s'! Not really allowed...\n",
+                rh->name);
+    GNUNET_RESOLVER_request_cancel (rh->std_resolve);
+  }
   /* name is absolute, go to DNS */
   GNUNET_free (rh->name);
   rh->name = GNUNET_strdup (cname);
@@ -1312,7 +1323,7 @@ vpn_allocation_cb (void *cls,
   vpn_ctx->vpn_request = NULL;
   rh->vpn_ctx = NULL;
   GNUNET_assert (GNUNET_OK ==
-                 GNUNET_GNSRECORD_records_deserialize (vpn_ctx->rd_data_size,
+                 GNUNET_GNSRECORD_records_deserialize ((size_t) vpn_ctx->rd_data_size,
                                                        vpn_ctx->rd_data,
                                                        vpn_ctx->rd_count,
                                                        rd));
@@ -1601,8 +1612,6 @@ recursive_pkey_resolution (struct GNS_ResolverHandle *rh,
   ac = GNUNET_new (struct AuthorityChain);
   ac->rh = rh;
   ac->gns_authority = GNUNET_YES;
-  ac->suggested_shortening_label = NULL;
-  ac->shortening_started = GNUNET_NO;
   GNUNET_memcpy (&ac->authority_info.gns_authority,
                  rd->data,
                  sizeof (struct GNUNET_CRYPTO_EcdsaPublicKey));
@@ -1649,6 +1658,8 @@ recursive_gns2dns_resolution (struct GNS_ResolverHandle *rh,
     size_t off;
     struct Gns2DnsPending *gp;
     struct GNUNET_CRYPTO_EcdsaPublicKey zone;
+    struct sockaddr_in v4;
+    struct sockaddr_in6 v6;
 
     if (GNUNET_GNSRECORD_TYPE_GNS2DNS != rd[i].record_type)
       continue;
@@ -1690,10 +1701,16 @@ recursive_gns2dns_resolution (struct GNS_ResolverHandle *rh,
     }
 
     /* check if 'ip' is already an IPv4/IPv6 address */
-    if (GNUNET_OK ==
-        GNUNET_DNSSTUB_add_dns_ip (ac->authority_info.dns_authority.dns_handle,
-                                   ip))
+    if ( (1 == inet_pton (AF_INET,
+                          ip,
+                          &v4)) ||
+         (1 == inet_pton (AF_INET6,
+                          ip,
+                          &v6)) )
     {
+      GNUNET_break (GNUNET_OK ==
+                    GNUNET_DNSSTUB_add_dns_ip (ac->authority_info.dns_authority.dns_handle,
+                                               ip));
       ac->authority_info.dns_authority.found = GNUNET_YES;
       GNUNET_free (ip);
       continue;
@@ -1798,7 +1815,6 @@ handle_gns_resolution_result (void *cls,
                               const struct GNUNET_GNSRECORD_Data *rd)
 {
   struct GNS_ResolverHandle *rh = cls;
-  struct AuthorityChain *shorten_ac;
   char *cname;
   struct VpnContext *vpn_ctx;
   const struct GNUNET_TUN_GnsVpnRecord *vpn;
@@ -1889,13 +1905,20 @@ handle_gns_resolution_result (void *cls,
             vpn_ctx->rh = rh;
             vpn_ctx->rd_data_size = GNUNET_GNSRECORD_records_get_size (rd_count,
                                                                        rd);
-            vpn_ctx->rd_data = GNUNET_malloc (vpn_ctx->rd_data_size);
+            if (vpn_ctx->rd_data_size < 0)
+            {
+              GNUNET_break_op (0);
+              GNUNET_free (vpn_ctx);
+              fail_resolution (rh);
+              return;
+            }
+            vpn_ctx->rd_data = GNUNET_malloc ((size_t) vpn_ctx->rd_data_size);
             vpn_ctx->rd_count = rd_count;
             GNUNET_assert (vpn_ctx->rd_data_size ==
-                           (size_t) GNUNET_GNSRECORD_records_serialize (rd_count,
-                                                                        rd,
-                                                                        vpn_ctx->rd_data_size,
-                                                                        vpn_ctx->rd_data));
+                           GNUNET_GNSRECORD_records_serialize (rd_count,
+                                                               rd,
+                                                               (size_t) vpn_ctx->rd_data_size,
+                                                               vpn_ctx->rd_data));
             vpn_ctx->vpn_request = GNUNET_VPN_redirect_to_peer (vpn_handle,
                                                                 af,
                                                                 ntohs (vpn->proto),
@@ -1928,7 +1951,6 @@ handle_gns_resolution_result (void *cls,
        using 'scratch' array for memory allocations */
     scratch_off = 0;
     rd_off = 0;
-    shorten_ac = rh->ac_tail;
     for (unsigned int i=0;i<rd_count;i++)
     {
       GNUNET_assert (rd_off <= i);
@@ -2106,8 +2128,6 @@ handle_gns_resolution_result (void *cls,
             GNUNET_break_op (0);
             break;
           }
-          if (NULL == shorten_ac->suggested_shortening_label)
-            shorten_ac->suggested_shortening_label = GNUNET_strdup (nick);
           break;
         }
       case GNUNET_GNSRECORD_TYPE_PKEY:
@@ -2133,8 +2153,6 @@ handle_gns_resolution_result (void *cls,
             ac->gns_authority = GNUNET_YES;
             ac->authority_info.gns_authority = pub;
             ac->label = GNUNET_strdup (GNUNET_GNS_EMPTY_LABEL_AT);
-            ac->suggested_shortening_label = NULL;
-            ac->shortening_started = GNUNET_NO;
             GNUNET_CONTAINER_DLL_insert_tail (rh->ac_head,
                                               rh->ac_tail,
                                               ac);
@@ -2386,7 +2404,8 @@ start_dht_request (struct GNS_ResolverHandle *rh,
   if (GNUNET_CONTAINER_heap_get_size (dht_lookup_heap) > max_allowed_background_queries)
   {
     /* fail longest-standing DHT request */
-    rx = GNUNET_CONTAINER_heap_peek (dht_lookup_heap);
+    rx = GNUNET_CONTAINER_heap_remove_root (dht_lookup_heap);
+    rx->dht_heap_node = NULL;
     GNUNET_assert (NULL != rx);
     fail_resolution (rx);
   }
@@ -2656,7 +2675,6 @@ start_resolver_lookup (void *cls)
   ac = GNUNET_new (struct AuthorityChain);
   ac->rh = rh;
   ac->label = resolver_lookup_get_next_label (rh);
-  ac->suggested_shortening_label = NULL;
   if (NULL == ac->label)
     /* name was just the "TLD", so we default to label
        #GNUNET_GNS_EMPTY_LABEL_AT */
@@ -2770,7 +2788,6 @@ GNS_resolver_lookup_cancel (struct GNS_ResolverHandle *rh)
       GNUNET_DNSSTUB_stop (ac->authority_info.dns_authority.dns_handle);
     }
     GNUNET_free (ac->label);
-    GNUNET_free_non_null (ac->suggested_shortening_label);
     GNUNET_free (ac);
   }
   if (NULL != rh->task_id)
diff --git a/src/gns/test_gns_defaults.conf b/src/gns/test_gns_defaults.conf
index 261dab6ed..01825fafe 100644
--- a/src/gns/test_gns_defaults.conf
+++ b/src/gns/test_gns_defaults.conf
@@ -1,4 +1,4 @@
-@INLINE@ ../../contrib/no_forcestart.conf
+@INLINE@ ../../contrib/conf/gnunet/no_forcestart.conf
 
 [PATHS]
 GNUNET_TEST_HOME = $GNUNET_TMP/test-gnunet-gns-testing/
diff --git a/src/gns/test_gns_gns2dns_cname_lookup.sh b/src/gns/test_gns_gns2dns_cname_lookup.sh
new file mode 100755
index 000000000..32e730d4c
--- /dev/null
+++ b/src/gns/test_gns_gns2dns_cname_lookup.sh
@@ -0,0 +1,89 @@
+#!/bin/bash
+trap "gnunet-arm -e -c test_gns_lookup.conf" SIGINT
+
+LOCATION=$(which gnunet-config)
+if [ -z $LOCATION ]
+then
+  LOCATION="gnunet-config"
+fi
+$LOCATION --version 1> /dev/null
+if test $? != 0
+then
+        echo "GNUnet command line tools cannot be found, check environmental variables PATH and GNUNET_PREFIX"
+        exit 77
+fi
+
+rm -rf `gnunet-config -c test_gns_lookup.conf -f -s paths -o GNUNET_TEST_HOME`
+# IP address of 'www.gnunet.org'
+TEST_IP="131.159.74.67"
+# IPv6 address of 'gnunet.org'
+TEST_IP6="2001:4ca0:2001:42:225:90ff:fe6b:d60"
+
+# main label used during resolution
+TEST_RECORD_NAME="homepage"
+
+XNS=ns.joker.com
+
+if ! nslookup gnunet.org a.$XNS &> /dev/null
+then
+  echo "Cannot reach DNS, skipping test"
+  exit 77
+fi
+
+# helper record for pointing to the DNS resolver
+TEST_RESOLVER_LABEL="resolver"
+# GNS2DNS record value: delegate to DNS domain 'gnunet.org'
+# using the TEST_RESOLVER_LABEL DNS server for resolution
+TEST_RECORD_GNS2DNS1="gnunet.org@a.$XNS"
+TEST_RECORD_GNS2DNS2="gnunet.org@b.$XNS"
+TEST_RECORD_GNS2DNS3="gnunet.org@c.$XNS"
+
+MY_EGO="myego"
+# various names we will use for resolution
+TEST_DOMAIN="www.${TEST_RECORD_NAME}.$MY_EGO"
+
+gnunet-arm -s -c test_gns_lookup.conf
+gnunet-identity -C $MY_EGO -c test_gns_lookup.conf
+
+# set IP address for DNS resolver for resolving in gnunet.org domain
+# map '$TEST_RECORD_NAME.$MY_EGO' to 'gnunet.org' in DNS
+gnunet-namestore -p -z $MY_EGO -a -n $TEST_RECORD_NAME -t GNS2DNS -V $TEST_RECORD_GNS2DNS1 -e never -c test_gns_lookup.conf
+gnunet-namestore -p -z $MY_EGO -a -n $TEST_RECORD_NAME -t GNS2DNS -V $TEST_RECORD_GNS2DNS2 -e never -c test_gns_lookup.conf
+gnunet-namestore -p -z $MY_EGO -a -n $TEST_RECORD_NAME -t GNS2DNS -V $TEST_RECORD_GNS2DNS3 -e never -c test_gns_lookup.conf
+
+which timeout &> /dev/null && DO_TIMEOUT="timeout 15"
+
+echo "EGOs:"
+gnunet-identity -d
+
+# lookup 'www.gnunet.org', IPv4
+RES_IP=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN -t A -c test_gns_lookup.conf`
+# lookup 'www.gnunet.org', IPv6
+RES_IP6=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN -t AAAA -c test_gns_lookup.conf`
+
+# clean up
+gnunet-namestore -z $MY_EGO -d -n $TEST_RECORD_NAME -t GNS2DNS -V $TEST_RECORD_GNS2DNS1 -e never -c test_gns_lookup.conf
+gnunet-namestore -z $MY_EGO -d -n $TEST_RECORD_NAME -t GNS2DNS -V $TEST_RECORD_GNS2DNS2 -e never -c test_gns_lookup.conf
+gnunet-namestore -z $MY_EGO -d -n $TEST_RECORD_NAME -t GNS2DNS -V $TEST_RECORD_GNS2DNS3 -e never -c test_gns_lookup.conf
+gnunet-identity -D $MY_EGO -c test_gns_lookup.conf
+gnunet-arm -e -c test_gns_lookup.conf
+rm -rf `gnunet-config -c test_gns_lookup.conf -f -s paths -o GNUNET_TEST_HOME`
+
+ret=0
+if [ "$RES_IP" == "$TEST_IP" ]
+then
+  echo "PASS: Resolved $TEST_DOMAIN to $RES_IP."
+else
+  echo "Failed to resolve to proper IP for $TEST_DOMAIN, got $RES_IP, wanted $TEST_IP."
+  ret=1
+fi
+
+if [ "$RES_IP6" == "$TEST_IP6" ]
+then
+  echo "PASS: Resolved $TEST_DOMAIN to $RES_IP6."
+else
+  echo "Failed to resolve to proper IP for $TEST_DOMAIN, got $RES_IP6, wanted $TEST_IP6."
+  ret=1
+fi
+
+exit $ret
diff --git a/src/gnsrecord/gnsrecord_crypto.c b/src/gnsrecord/gnsrecord_crypto.c
index 6d59a545a..6d3887392 100644
--- a/src/gnsrecord/gnsrecord_crypto.c
+++ b/src/gnsrecord/gnsrecord_crypto.c
@@ -87,9 +87,8 @@ block_create (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
               const struct GNUNET_GNSRECORD_Data *rd,
               unsigned int rd_count)
 {
-  size_t payload_len = GNUNET_GNSRECORD_records_get_size (rd_count,
-                                                          rd);
-  char payload[sizeof (uint32_t) + payload_len];
+  ssize_t payload_len = GNUNET_GNSRECORD_records_get_size (rd_count,
+                                                           rd);
   struct GNUNET_GNSRECORD_Block *block;
   struct GNUNET_CRYPTO_EcdsaPrivateKey *dkey;
   struct GNUNET_CRYPTO_SymmetricInitializationVector iv;
@@ -98,8 +97,16 @@ block_create (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
   uint32_t rd_count_nbo;
   struct GNUNET_TIME_Absolute now;
 
+  if (payload_len < 0)
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
   if (payload_len > GNUNET_GNSRECORD_MAX_BLOCK_SIZE)
+  {
+    GNUNET_break (0);
     return NULL;
+  }
   /* convert relative to absolute times */
   now = GNUNET_TIME_absolute_get ();
   for (unsigned int i=0;i<rd_count;i++)
@@ -117,39 +124,43 @@ block_create (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
   }
   /* serialize */
   rd_count_nbo = htonl (rd_count);
-  GNUNET_memcpy (payload,
-                 &rd_count_nbo,
-                 sizeof (uint32_t));
-  GNUNET_assert (payload_len ==
-                 GNUNET_GNSRECORD_records_serialize (rd_count,
-                                                     rdc,
-                                                     payload_len,
-                                                     &payload[sizeof (uint32_t)]));
-  block = GNUNET_malloc (sizeof (struct GNUNET_GNSRECORD_Block) +
-                         sizeof (uint32_t) +
-                         payload_len);
-  block->purpose.size = htonl (sizeof (uint32_t) +
-                               payload_len +
-                               sizeof (struct GNUNET_CRYPTO_EccSignaturePurpose) +
-                               sizeof (struct GNUNET_TIME_AbsoluteNBO));
-  block->purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_GNS_RECORD_SIGN);
-  block->expiration_time = GNUNET_TIME_absolute_hton (expire);
-  /* encrypt and sign */
-  dkey = GNUNET_CRYPTO_ecdsa_private_key_derive (key,
-                                                 label,
-                                                 "gns");
-  GNUNET_CRYPTO_ecdsa_key_get_public (dkey,
-                                      &block->derived_key);
-  derive_block_aes_key (&iv,
-                        &skey,
-                        label,
-                        pkey);
-  GNUNET_break (payload_len + sizeof (uint32_t) ==
-                GNUNET_CRYPTO_symmetric_encrypt (payload,
-                                                 payload_len + sizeof (uint32_t),
-                                                 &skey,
-                                                 &iv,
-                                                 &block[1]));
+  {
+    char payload[sizeof (uint32_t) + payload_len];
+
+    GNUNET_memcpy (payload,
+                   &rd_count_nbo,
+                   sizeof (uint32_t));
+    GNUNET_assert (payload_len ==
+                   GNUNET_GNSRECORD_records_serialize (rd_count,
+                                                       rdc,
+                                                       payload_len,
+                                                       &payload[sizeof (uint32_t)]));
+    block = GNUNET_malloc (sizeof (struct GNUNET_GNSRECORD_Block) +
+                           sizeof (uint32_t) +
+                           payload_len);
+    block->purpose.size = htonl (sizeof (uint32_t) +
+                                 payload_len +
+                                 sizeof (struct GNUNET_CRYPTO_EccSignaturePurpose) +
+                                 sizeof (struct GNUNET_TIME_AbsoluteNBO));
+    block->purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_GNS_RECORD_SIGN);
+    block->expiration_time = GNUNET_TIME_absolute_hton (expire);
+    /* encrypt and sign */
+    dkey = GNUNET_CRYPTO_ecdsa_private_key_derive (key,
+                                                   label,
+                                                   "gns");
+    GNUNET_CRYPTO_ecdsa_key_get_public (dkey,
+                                        &block->derived_key);
+    derive_block_aes_key (&iv,
+                          &skey,
+                          label,
+                          pkey);
+    GNUNET_break (payload_len + sizeof (uint32_t) ==
+                  GNUNET_CRYPTO_symmetric_encrypt (payload,
+                                                   payload_len + sizeof (uint32_t),
+                                                   &skey,
+                                                   &iv,
+                                                   &block[1]));
+  }
   if (GNUNET_OK !=
       GNUNET_CRYPTO_ecdsa_sign (dkey,
                                 &block->purpose,
diff --git a/src/gnsrecord/gnsrecord_serialization.c b/src/gnsrecord/gnsrecord_serialization.c
index 1db27464f..77118ab94 100644
--- a/src/gnsrecord/gnsrecord_serialization.c
+++ b/src/gnsrecord/gnsrecord_serialization.c
@@ -37,6 +37,12 @@
 
 #define LOG(kind,...) GNUNET_log_from (kind, "gnsrecord",__VA_ARGS__)
 
+/**
+ * Set to 1 to check that all records are well-formed (can be converted
+ * to string) during serialization/deserialization.
+ */
+#define DEBUG_GNSRECORDS 0
+
 GNUNET_NETWORK_STRUCT_BEGIN
 
 
@@ -78,9 +84,9 @@ GNUNET_NETWORK_STRUCT_END
  *
  * @param rd_count number of records in the rd array
  * @param rd array of #GNUNET_GNSRECORD_Data with @a rd_count elements
- * @return the required size to serialize
+ * @return the required size to serialize, -1 on error
  */
-size_t
+ssize_t
 GNUNET_GNSRECORD_records_get_size (unsigned int rd_count,
                                    const struct GNUNET_GNSRECORD_Data *rd)
 {
@@ -89,10 +95,34 @@ GNUNET_GNSRECORD_records_get_size (unsigned int rd_count,
   ret = sizeof (struct NetworkRecord) * rd_count;
   for (unsigned int i=0;i<rd_count;i++)
   {
-    GNUNET_assert ((ret + rd[i].data_size) >= ret);
+    if ((ret + rd[i].data_size) < ret)
+    {
+      GNUNET_break (0);
+      return -1;
+    }
     ret += rd[i].data_size;
+#if DEBUG_GNSRECORDS
+    {
+      char *str;
+
+      str = GNUNET_GNSRECORD_value_to_string (rd[i].record_type,
+                                              rd[i].data,
+                                              rd[i].data_size);
+      if (NULL == str)
+      {
+        GNUNET_break_op (0);
+        return -1;
+      }
+      GNUNET_free (str);
+    }
+#endif
+  }
+  if (ret > SSIZE_MAX)
+  {
+    GNUNET_break (0);
+    return -1;
   }
-  return ret;
+  return (ssize_t) ret;
 }
 
 
@@ -126,7 +156,8 @@ GNUNET_GNSRECORD_records_serialize (unsigned int rd_count,
     rec.data_size = htonl ((uint32_t) rd[i].data_size);
     rec.record_type = htonl (rd[i].record_type);
     rec.flags = htonl (rd[i].flags);
-    if (off + sizeof (rec) > dest_size)
+    if ( (off + sizeof (rec) > dest_size) ||
+         (off + sizeof (rec) < off) )
     {
       GNUNET_break (0);
       return -1;
@@ -135,7 +166,8 @@ GNUNET_GNSRECORD_records_serialize (unsigned int rd_count,
                    &rec,
                    sizeof (rec));
     off += sizeof (rec);
-    if (off + rd[i].data_size > dest_size)
+    if ( (off + rd[i].data_size > dest_size) ||
+         (off + rd[i].data_size < off) )
     {
       GNUNET_break (0);
       return -1;
@@ -144,7 +176,7 @@ GNUNET_GNSRECORD_records_serialize (unsigned int rd_count,
                    rd[i].data,
                    rd[i].data_size);
     off += rd[i].data_size;
-#if GNUNET_EXTRA_LOGGING
+#if DEBUG_GNSRECORDS
     {
       char *str;
 
@@ -154,7 +186,7 @@ GNUNET_GNSRECORD_records_serialize (unsigned int rd_count,
       if (NULL == str)
       {
         GNUNET_break_op (0);
-        return GNUNET_SYSERR;
+        return -1;
       }
       GNUNET_free (str);
     }
@@ -185,7 +217,8 @@ GNUNET_GNSRECORD_records_deserialize (size_t len,
   off = 0;
   for (unsigned int i=0;i<rd_count;i++)
   {
-    if (off + sizeof (rec) > len)
+    if ( (off + sizeof (rec) > len) ||
+         (off + sizeof (rec) < off) )
     {
       GNUNET_break_op (0);
       return GNUNET_SYSERR;
@@ -198,7 +231,8 @@ GNUNET_GNSRECORD_records_deserialize (size_t len,
     dest[i].record_type = ntohl (rec.record_type);
     dest[i].flags = ntohl (rec.flags);
     off += sizeof (rec);
-    if (off + dest[i].data_size > len)
+    if ( (off + dest[i].data_size > len) ||
+         (off + dest[i].data_size < off) )
     {
       GNUNET_break_op (0);
       return GNUNET_SYSERR;
diff --git a/src/hostlist/test_hostlist_defaults.conf b/src/hostlist/test_hostlist_defaults.conf
index 64e9acd51..dcd2790b0 100644
--- a/src/hostlist/test_hostlist_defaults.conf
+++ b/src/hostlist/test_hostlist_defaults.conf
@@ -1,5 +1,5 @@
-@INLINE@ ../../contrib/no_forcestart.conf
-@INLINE@ ../../contrib/no_autostart_above_core.conf
+@INLINE@ ../../contrib/conf/gnunet/no_forcestart.conf
+@INLINE@ ../../contrib/conf/gnunet/no_autostart_above_core.conf
 
 [PATHS]
 GNUNET_TEST_HOME = $GNUNET_TMP/test-gnunet-hostlist/
diff --git a/src/identity-provider/test_idp_defaults.conf b/src/identity-provider/test_idp_defaults.conf
index d7de3ce12..a9a197dea 100644
--- a/src/identity-provider/test_idp_defaults.conf
+++ b/src/identity-provider/test_idp_defaults.conf
@@ -1,4 +1,4 @@
-@INLINE@ ../../contrib/no_forcestart.conf
+@INLINE@ ../../contrib/conf/gnunet/no_forcestart.conf
 
 [PATHS]
 GNUNET_TEST_HOME = $GNUNET_TMP/test-gnunet-idp-testing/
diff --git a/src/include/gnunet_gnsrecord_lib.h b/src/include/gnunet_gnsrecord_lib.h
index 38346ada3..56dadef3a 100644
--- a/src/include/gnunet_gnsrecord_lib.h
+++ b/src/include/gnunet_gnsrecord_lib.h
@@ -411,9 +411,9 @@ GNUNET_GNSRECORD_number_to_typename (uint32_t type);
  *
  * @param rd_count number of records in the @a rd array
  * @param rd array of #GNUNET_GNSRECORD_Data with @a rd_count elements
- * @return the required size to serialize
+ * @return the required size to serialize, -1 on error
  */
-size_t
+ssize_t
 GNUNET_GNSRECORD_records_get_size (unsigned int rd_count,
                                    const struct GNUNET_GNSRECORD_Data *rd);
 
diff --git a/src/include/gnunet_mq_lib.h b/src/include/gnunet_mq_lib.h
index ecee1b223..fe699c48f 100644
--- a/src/include/gnunet_mq_lib.h
+++ b/src/include/gnunet_mq_lib.h
@@ -135,6 +135,26 @@ struct GNUNET_MQ_Envelope;
 
 
 /**
+ * Obtain message contained in envelope.
+ *
+ * @param env the envelope
+ * @return message contained in the envelope
+ */
+const struct GNUNET_MessageHeader *
+GNUNET_MQ_env_get_msg (const struct GNUNET_MQ_Envelope *env);
+
+
+/**
+ * Return next envelope in queue.
+ *
+ * @param env a queued envelope
+ * @return next one, or NULL
+ */
+const struct GNUNET_MQ_Envelope *
+GNUNET_MQ_env_next (const struct GNUNET_MQ_Envelope *env);
+
+
+/**
  * Implementation of the #GNUNET_MQ_msg_nested_mh macro.
  *
  * @param mhp pointer to the message header pointer that will be changed to allocate at
diff --git a/src/integration-tests/confs/test_defaults.conf b/src/integration-tests/confs/test_defaults.conf
index 1be582650..39020515f 100644
--- a/src/integration-tests/confs/test_defaults.conf
+++ b/src/integration-tests/confs/test_defaults.conf
@@ -1,5 +1,5 @@
-@INLINE@ ../../../contrib/no_forcestart.conf
-@INLINE@ ../../../contrib/no_autostart_above_core.conf
+@INLINE@ ../../../contrib/conf/gnunet/no_forcestart.conf
+@INLINE@ ../../../contrib/conf/gnunet/no_autostart_above_core.conf
 
 [fs]
 FORCESTART = YES
diff --git a/src/integration-tests/gnunet_testing.py.in b/src/integration-tests/gnunet_testing.py.in
index cc3e18b06..d18f2b9f8 100644
--- a/src/integration-tests/gnunet_testing.py.in
+++ b/src/integration-tests/gnunet_testing.py.in
@@ -1,6 +1,6 @@
 #!@PYTHON@
 #    This file is part of GNUnet.
-#    (C) 2010, 2017 Christian Grothoff (and other contributing authors)
+#    (C) 2010, 2017, 2018 Christian Grothoff (and other contributing authors)
 #
 #    GNUnet is free software; you can redistribute it and/or modify
 #    it under the terms of the GNU General Public License as published
@@ -25,86 +25,99 @@ import shutil
 import time
 from gnunet_pyexpect import pexpect
 
+
 class Check:
     def __init__(self, test):
         self.fulfilled = False
         self.conditions = list()
         self.test = test
-    def add (self, condition):
+
+    def add(self, condition):
         self.conditions.append(condition)
-    def run (self):
+
+    def run(self):
         fulfilled = True
         pos = 0
         neg = 0
         for c in self.conditions:
-            if (False == c.check ()):
+            if (False == c.check()):
                 fulfilled = False
                 neg += 1
             else:
                 pos += 1
         return fulfilled
-    def run_blocking (self, timeout, pos_cont, neg_cont):
-        execs = 0;
+
+    def run_blocking(self, timeout, pos_cont, neg_cont):
+        execs = 0
         res = False
         while ((False == res) and (execs < timeout)):
             res = self.run()
             time.sleep(1)
             execs += 1
         if ((False == res) and (execs >= timeout)):
-           print(('Check had timeout after ' +str(timeout)+ ' seconds'))
-           neg_cont (self)
+            print(('Check had timeout after ' + str(timeout) + ' seconds'))
+            neg_cont(self)
         elif ((False == res) and (execs < timeout)):
             if (None != neg_cont):
-                neg_cont (self)
+                neg_cont(self)
         else:
             if (None != pos_cont):
-                pos_cont (self)
-        return res     
-    def run_once (self, pos_cont, neg_cont):
-        execs = 0;
+                pos_cont(self)
+        return res
+
+    def run_once(self, pos_cont, neg_cont):
+        execs = 0
         res = False
         res = self.run()
         if ((res == False) and (neg_cont != None)):
-            neg_cont (self)
+            neg_cont(self)
         if ((res == True) and (pos_cont != None)):
-            pos_cont (self)            
+            pos_cont(self)
         return res
-    def evaluate (self, failed_only):
+
+    def evaluate(self, failed_only):
         pos = 0
         neg = 0
         for c in self.conditions:
-            if (False == c.evaluate (failed_only)):
+            if (False == c.evaluate(failed_only)):
                 neg += 1
             else:
                 pos += 1
-        print((str(pos) +' out of '+ str (pos+neg) + ' conditions fulfilled'))
+        print((str(pos) + ' out of ' + str(pos+neg) + ' conditions fulfilled'))
         return self.fulfilled
-    def reset (self):
-                self.fulfilled = False     
-                for c in self.conditions:
-                        c.fulfilled = False
-        
+
+    def reset(self):
+        self.fulfilled = False
+        for c in self.conditions:
+            c.fulfilled = False
+
+
 class Condition:
     def __init__(self):
         self.fulfilled = False
         self.type = 'generic'
+
     def __init__(self, type):
         self.fulfilled = False
         self.type = type
+
     def check(self):
-        return False;
-    def evaluate (self, failed_only):
+        return False
+
+    def evaluate(self, failed_only):
         if ((self.fulfilled == False) and (failed_only == True)):
             print(str(self.type) + 'condition for was ' + str(self.fulfilled))
-        elif (failed_only == False): 
+        elif (failed_only == False):
             print(str(self.type) + 'condition for was ' + str(self.fulfilled))
-        return self.fulfilled            
+        return self.fulfilled
+
 
-class FileExistCondition (Condition):
+class FileExistCondition(Condition):
     def __init__(self, file):
         self.fulfilled = False
         self.type = 'file'
         self.file = file
+
     def check(self):
         if (self.fulfilled == False):
             res = os.path.isfile(self.file)
@@ -115,25 +128,28 @@ class FileExistCondition (Condition):
                 return False
         else:
             return True
-    def evaluate (self, failed_only):
+
+    def evaluate(self, failed_only):
         if ((self.fulfilled == False) and (failed_only == True)):
             print(str(self.type) + 'condition for file '+self.file+' was ' + str(self.fulfilled))
-        elif (failed_only == False): 
+        elif (failed_only == False):
             print(str(self.type) + 'condition for file '+self.file+' was ' + str(self.fulfilled))
         return self.fulfilled
 
+
 class StatisticsCondition (Condition):
     def __init__(self, peer, subsystem, name, value):
         self.fulfilled = False
         self.type = 'statistics'
-        self.peer = peer;
-        self.subsystem = subsystem;
-        self.name = name;
-        self.value = value;
-        self.result = -1;
+        self.peer = peer
+        self.subsystem = subsystem
+        self.name = name
+        self.value = value
+        self.result = -1
+
     def check(self):
         if (self.fulfilled == False):
-            self.result = self.peer.get_statistics_value (self.subsystem, self.name)
+            self.result = self.peer.get_statistics_value(self.subsystem, self.name)
             if (str(self.result) == str(self.value)):
                 self.fulfilled = True
                 return True
@@ -141,38 +157,41 @@ class StatisticsCondition (Condition):
                 return False
         else:
             return True
-    def evaluate (self, failed_only):
+
+    def evaluate(self, failed_only):
         if (self.result == -1):
             res = 'NaN'
         else:
             res = str(self.result)
         if (self.fulfilled == False):
-            fail = " FAIL!" 
+            fail = " FAIL!"
             op = " != "
-        else: 
+        else:
             fail = ""
             op = " == "
         if (((self.fulfilled == False) and (failed_only == True)) or (failed_only == False)):
-            print(self.peer.id[:4] + " " +self.peer.cfg + " " +  str(self.type) + ' condition in subsystem "' + self.subsystem.ljust(12) +'" : "' + self.name.ljust(30) +'" : (expected/real value) ' + str(self.value) + op + res + fail)
-        return self.fulfilled    
+            print(self.peer.id[:4] + " " + self.peer.cfg + " " + str(self.type) + ' condition in subsystem "' + self.subsystem.ljust(12) + '" : "' + self.name.ljust(30) + '" : (expected/real value) ' + str(self.value) + op + res + fail)
+        return self.fulfilled
 
-# Specify two statistic values and check if they are equal  
+
+# Specify two statistic values and check if they are equal
 class EqualStatisticsCondition (Condition):
     def __init__(self, peer, subsystem, name, peer2, subsystem2, name2):
         self.fulfilled = False
         self.type = 'equalstatistics'
-        self.peer = peer;
-        self.subsystem = subsystem;
-        self.name = name;
-        self.result = -1;
-        self.peer2 = peer2;
-        self.subsystem2 = subsystem2;
-        self.name2 = name2;
-        self.result2 = -1;
+        self.peer = peer
+        self.subsystem = subsystem
+        self.name = name
+        self.result = -1
+        self.peer2 = peer2
+        self.subsystem2 = subsystem2
+        self.name2 = name2
+        self.result2 = -1
+
     def check(self):
         if (self.fulfilled == False):
-            self.result = self.peer.get_statistics_value (self.subsystem, self.name);
-            self.result2 = self.peer2.get_statistics_value (self.subsystem2, self.name2);
+            self.result = self.peer.get_statistics_value(self.subsystem, self.name)
+            self.result2 = self.peer2.get_statistics_value(self.subsystem2, self.name2)
             if (str(self.result) == str(self.result2)):
                 self.fulfilled = True
                 return True
@@ -180,7 +199,8 @@ class EqualStatisticsCondition (Condition):
                 return False
         else:
             return True
-    def evaluate (self, failed_only):
+
+    def evaluate(self, failed_only):
         if (self.result == -1):
             res = 'NaN'
         else:
@@ -188,27 +208,28 @@ class EqualStatisticsCondition (Condition):
         if (self.result2 == -1):
             res2 = 'NaN'
         else:
-            res2 = str(self.result2)            
+            res2 = str(self.result2)
         if (self.fulfilled == False):
-            fail = " FAIL!" 
+            fail = " FAIL!"
             op = " != "
-        else: 
+        else:
             fail = ""
             op = " == "
         if (((self.fulfilled == False) and (failed_only == True)) or (failed_only == False)):
-            print(self.peer.id[:4] + ' "'  + self.subsystem.ljust(12) + '" "' + self.name.ljust(30) + '" == ' + str(self.result) +" " + self.peer2.id[:4] + ' "'  + self.subsystem2.ljust(12) + '" '+ self.name2.ljust(30) +  '" ' + str(self.result2))
-        return self.fulfilled                    
-        
+            print(self.peer.id[:4] + ' "' + self.subsystem.ljust(12) + '" "' + self.name.ljust(30) + '" == ' + str(self.result) + " " + self.peer2.id[:4] + ' "' + self.subsystem2.ljust(12) + '" ' + self.name2.ljust(30) + '" ' + str(self.result2))
+        return self.fulfilled
+
+
 class Test:
     def __init__(self, testname, verbose):
         self.peers = list()
-        self.verbose = verbose;
-        self.name = testname;
+        self.verbose = verbose
+        self.name = testname
         srcdir = "../.."
-        gnunet_pyexpect_dir = os.path.join (srcdir, "contrib")
+        gnunet_pyexpect_dir = os.path.join(srcdir, "contrib/scripts")
         if gnunet_pyexpect_dir not in sys.path:
-            sys.path.append (gnunet_pyexpect_dir)
-        self.gnunetarm = ''        
+            sys.path.append(gnunet_pyexpect_dir)
+        self.gnunetarm = ''
         self.gnunetstatistics = ''
         if os.name == 'posix':
             self.gnunetarm = 'gnunet-arm'
@@ -217,17 +238,20 @@ class Test:
         elif os.name == 'nt':
             self.gnunetarm = 'gnunet-arm.exe'
             self.gnunetstatistics = 'gnunet-statistics.exe'
-            self.gnunetpeerinfo = 'gnunet-peerinfo.exe'    
+            self.gnunetpeerinfo = 'gnunet-peerinfo.exe'
         if os.name == "nt":
-            shutil.rmtree (os.path.join (os.getenv ("TEMP"), testname), True)
+            shutil.rmtree(os.path.join(os.getenv("TEMP"), testname), True)
         else:
-            shutil.rmtree ("/tmp/" + testname, True)
-    def add_peer (self, peer):
+            shutil.rmtree("/tmp/" + testname, True)
+
+    def add_peer(self, peer):
         self.peers.append(peer)
-    def p (self, msg):
+
+    def p(self, msg):
         if (self.verbose == True):
             print(msg)
 
+
 class Peer:
     def __init__(self, test, cfg_file):
         if (False == os.path.isfile(cfg_file)):
@@ -235,53 +259,57 @@ class Peer:
         self.id = "<NaN>"
         self.test = test
         self.started = False
-        self.cfg = cfg_file 
+        self.cfg = cfg_file
+
     def __del__(self):
-        if (self.started == True): 
+        if (self.started == True):
             print('ERROR! Peer using cfg ' + self.cfg + ' was not stopped')
-            ret = self.stop ()
+            ret = self.stop()
             if (False == ret):
                 print('ERROR! Peer using cfg ' + self.cfg + ' could not be stopped')
                 self.started = False
             return ret
         else:
             return False
-    def start (self):
-        self.test.p ("Starting peer using cfg " + self.cfg)
+
+    def start(self):
+        self.test.p("Starting peer using cfg " + self.cfg)
         try:
-            server = subprocess.Popen ([self.test.gnunetarm, '-sq', '-c', self.cfg])
-            server.communicate ()    
+            server = subprocess.Popen([self.test.gnunetarm, '-sq', '-c', self.cfg])
+            server.communicate()
         except OSError:
             print("Can not start peer")
             self.started = False
             return False
-        self.started = True;
+        self.started = True
         test = ''
         try:
-            server = pexpect ()
-            server.spawn (None, [self.test.gnunetpeerinfo, '-c', self.cfg ,'-s'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+            server = pexpect()
+            server.spawn(None, [self.test.gnunetpeerinfo, '-c', self.cfg, '-s'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
             test = server.read("stdout", 1024)
         except OSError:
             print("Can not get peer identity")
         test = (test.split('`')[1])
         self.id = test.split('\'')[0]
-        return True 
-    def stop (self):
+        return True
+
+    def stop(self):
         if (self.started == False):
             return False
-        self.test.p ("Stopping peer using cfg " + self.cfg)
+        self.test.p("Stopping peer using cfg " + self.cfg)
         try:
-            server = subprocess.Popen ([self.test.gnunetarm, '-eq', '-c', self.cfg])
-            server.communicate ()    
+            server = subprocess.Popen([self.test.gnunetarm, '-eq', '-c', self.cfg])
+            server.communicate()
         except OSError:
             print("Can not stop peer")
             return False
         self.started = False
-        return True;
-    def get_statistics_value (self, subsystem, name):
-        server = pexpect ()
-        server.spawn (None, [self.test.gnunetstatistics, '-c', self.cfg ,'-q','-n', name, '-s', subsystem ], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
-        #server.expect ("stdout", re.compile (r""))
+        return True
+
+    def get_statistics_value(self, subsystem, name):
+        server = pexpect()
+        server.spawn(None, [self.test.gnunetstatistics, '-c', self.cfg, '-q', '-n', name, '-s', subsystem], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+        # server.expect ("stdout", re.compile (r""))
         test = server.read("stdout", 10240)
         tests = test.partition('\n')
         # On W32 GNUnet outputs with \r\n, rather than \n
@@ -292,4 +320,3 @@ class Peer:
             return tests
         else:
             return -1
-        
diff --git a/src/integration-tests/test_integration_bootstrap_and_connect.py.in b/src/integration-tests/test_integration_bootstrap_and_connect.py.in
index 01e36f81c..2a7768c6a 100755
--- a/src/integration-tests/test_integration_bootstrap_and_connect.py.in
+++ b/src/integration-tests/test_integration_bootstrap_and_connect.py.in
@@ -17,7 +17,7 @@
 #    Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
 #    Boston, MA 02110-1301, USA.
 #
-# 
+#
 import signal
 import sys
 import os
@@ -29,177 +29,183 @@ from gnunet_testing import Peer
 from gnunet_testing import Test
 from gnunet_testing import Check
 from gnunet_testing import Condition
-from gnunet_testing import * 
- 
+from gnunet_testing import *
+
 
 #
 # This test tests if a fresh peer bootstraps from a hostlist server and then
-# successfully connects to the server 
+# successfully connects to the server
 #
 # Conditions for successful exit:
 # Both peers have 1 connected peer in transport, core, topology, fs
 
 #
 # This test tests if a fresh peer bootstraps from a hostlist server and then
-# successfully connects to the server 
+# successfully connects to the server
 #
 # Conditions for successful exit:
 # Both peers have 1 connected peer in transport, core, topology, fs
 
-#definitions
+# definitions
 
 testname = "test_integration_bootstrap_and_connect"
 verbose = False
 check_timeout = 180
 
 if os.name == "nt":
-  tmp = os.getenv ("TEMP")
-  signals = [signal.SIGTERM, signal.SIGINT]
+    tmp = os.getenv("TEMP")
+    signals = [signal.SIGTERM, signal.SIGINT]
 else:
-  tmp = "/tmp"
-  signals = [signal.SIGTERM, signal.SIGINT, signal.SIGHUP, signal.SIGQUIT]
-
-def cleanup_onerror (function, path, excinfo):
-  import stat
-  if not os.path.exists (path):
-    pass
-  elif not os.access(path, os.W_OK):
-    # Is the error an access error ?
-    os.chmod (path, stat.S_IWUSR)
-    function (path)
-  else:
-    raise
-
-def cleanup ():
+    tmp = "/tmp"
+    signals = [signal.SIGTERM, signal.SIGINT, signal.SIGHUP, signal.SIGQUIT]
+
+
+def cleanup_onerror(function, path, excinfo):
+    import stat
+    if not os.path.exists(path):
+        pass
+    elif not os.access(path, os.W_OK):
+        # Is the error an access error ?
+        os.chmod(path, stat.S_IWUSR)
+        function(path)
+    else:
+        raise
+
+
+def cleanup():
     retries = 10
-    path = os.path.join (tmp, "c_bootstrap_server")  
-    test.p ("Removing " + path)      
+    path = os.path.join(tmp, "c_bootstrap_server")
+    test.p("Removing " + path)
     while ((os.path.exists(path)) and (retries > 0)):
-        shutil.rmtree ((path), False, cleanup_onerror)
-        time.sleep (1)
+        shutil.rmtree((path), False, cleanup_onerror)
+        time.sleep(1)
         retries -= 1
     if (os.path.exists(path)):
-        test.p ("Failed to remove " + path) 
-    
-    
+        test.p("Failed to remove " + path)
+
     retries = 10
-    path = os.path.join (tmp, "c_no_nat_client")    
-    test.p ("Removing " + path)    
+    path = os.path.join(tmp, "c_no_nat_client")
+    test.p("Removing " + path)
     while ((os.path.exists(path)) and (retries > 0)):
-        shutil.rmtree ((path), False, cleanup_onerror)
-        time.sleep (1)
+        shutil.rmtree((path), False, cleanup_onerror)
+        time.sleep(1)
         retries -= 1
     if (os.path.exists(path)):
-        test.p ("Failed to remove " + path)     
-                
-def success_cont (check):
+        test.p("Failed to remove " + path)
+
+
+def success_cont(check):
     global success
-    success = True;
+    success = True
     print('Peers connected successfully')
-    
-def fail_cont (check):    
-    global success 
-    success = False;
+
+
+def fail_cont(check):
+    global success
+    success = False
     print('Peers did not connect')
     check.evaluate(True)
 
-def check ():
-  check = Check (test)
-  check.add (StatisticsCondition (client, 'transport', '# peers connected',1))
-  check.add (StatisticsCondition (client, 'core', '# peers connected',1))
-  check.add (StatisticsCondition (client, 'topology', '# peers connected',1))
-  check.add (StatisticsCondition (client, 'dht', '# peers connected',1))  
-  check.add (StatisticsCondition (client, 'fs', '# peers connected',1))
-  
-  check.add (StatisticsCondition (server, 'transport', '# peers connected',1))
-  check.add (StatisticsCondition (server, 'core', '# peers connected',1))
-  check.add (StatisticsCondition (server, 'topology', '# peers connected',1))
-  check.add (StatisticsCondition (server, 'dht', '# peers connected',1))  
-  check.add (StatisticsCondition (server, 'fs', '# peers connected',1))  
-  
-  check.run_blocking (check_timeout, success_cont, fail_cont)
-
-# 
+
+def check():
+    check = Check(test)
+    check.add(StatisticsCondition(client, 'transport', '# peers connected', 1))
+    check.add(StatisticsCondition(client, 'core', '# peers connected', 1))
+    check.add(StatisticsCondition(client, 'topology', '# peers connected', 1))
+    check.add(StatisticsCondition(client, 'dht', '# peers connected', 1))
+    check.add(StatisticsCondition(client, 'fs', '# peers connected', 1))
+
+    check.add(StatisticsCondition(server, 'transport', '# peers connected', 1))
+    check.add(StatisticsCondition(server, 'core', '# peers connected', 1))
+    check.add(StatisticsCondition(server, 'topology', '# peers connected', 1))
+    check.add(StatisticsCondition(server, 'dht', '# peers connected', 1))
+    check.add(StatisticsCondition(server, 'fs', '# peers connected', 1))
+
+    check.run_blocking(check_timeout, success_cont, fail_cont)
+
+#
 # Test execution
-# 
-
-def SigHandler(signum = None, frame = None):
-        global success  
-        global server
-        global client  
-        
-        print('Test was aborted!')
-        if (None != server):
-                server.stop ()
-        if (None != client):            
-                client.stop ()
-        cleanup ()
-        sys.exit(success)
-
-def run ():
-        global success
-        global test
-        global server
-        global client    
-        
-        server = None
-        client = None
-        success = False  
-        
-        for sig in signals:
-                signal.signal(sig, SigHandler)
-
-        test = Test ('test_integration_bootstrap_and_connect.py', verbose)
-        cleanup ()
-        
-        server = Peer(test, './confs/c_bootstrap_server.conf');
-        client = Peer(test, './confs/c_no_nat_client.conf');
-        
-        if (True != server.start()):
-                print('Failed to start server')
-                if (None != server):
-                        server.stop ()
-                if (None != server):            
-                        client.stop ()
-                cleanup ()
-                sys.exit(success)
-                
-        # Give the server time to start
-        time.sleep(5)
-        
-        if (True != client.start()):
-                print('Failed to start client')
-                if (None != server):
-                        server.stop ()
-                if (None != server):            
-                        client.stop ()
-                cleanup ()
-                sys.exit(success)
-        
-        if ((client.started == True) and (server.started == True)):
-                test.p ('Peers started, running check')
-                time.sleep(5)
-                check ()
-        server.stop ()
-        client.stop ()
-        
-        cleanup ()
-        
-        if (success == False):
-                print ('Test failed')
-                return False 
-        else:
-                return True
+#
+
+
+def SigHandler(signum=None, frame=None):
+    global success
+    global server
+    global client
+
+    print('Test was aborted!')
+    if (None != server):
+        server.stop()
+    if (None != client):
+        client.stop()
+    cleanup()
+    sys.exit(success)
+
+
+def run():
+    global success
+    global test
+    global server
+    global client
+
+    server = None
+    client = None
+    success = False
+
+    for sig in signals:
+        signal.signal(sig, SigHandler)
+
+    test = Test('test_integration_bootstrap_and_connect.py', verbose)
+    cleanup()
+
+    server = Peer(test, './confs/c_bootstrap_server.conf')
+    client = Peer(test, './confs/c_no_nat_client.conf')
+
+    if (True != server.start()):
+        print('Failed to start server')
+        if (None != server):
+            server.stop()
+        if (None != server):
+            client.stop()
+        cleanup()
+        sys.exit(success)
+
+    # Give the server time to start
+    time.sleep(5)
+
+    if (True != client.start()):
+        print('Failed to start client')
+        if (None != server):
+            server.stop()
+        if (None != server):
+            client.stop()
+        cleanup()
+        sys.exit(success)
+
+    if ((client.started == True) and (server.started == True)):
+        test.p('Peers started, running check')
+        time.sleep(5)
+        check()
+    server.stop()
+    client.stop()
+
+    cleanup()
+
+    if (success == False):
+        print('Test failed')
+        return False
+    else:
+        return True
+
 
 try:
-        run ()
-except (KeyboardInterrupt, SystemExit):    
-        print('Test interrupted')
-        server.stop ()
-        client.stop ()
-        cleanup ()
+    run()
+except (KeyboardInterrupt, SystemExit):
+    print('Test interrupted')
+    server.stop()
+    client.stop()
+    cleanup()
 if (success == False):
-        sys.exit(1)   
+    sys.exit(1)
 else:
-        sys.exit(0)    
-    
+    sys.exit(0)
diff --git a/src/integration-tests/test_integration_clique.py.in b/src/integration-tests/test_integration_clique.py.in
index f8b60f33d..b4c53da58 100755
--- a/src/integration-tests/test_integration_clique.py.in
+++ b/src/integration-tests/test_integration_clique.py.in
@@ -17,13 +17,13 @@
 #    Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
 #    Boston, MA 02110-1301, USA.
 #
-# 
 #
-# This test starts 3 peers (nated, server, no nat)and expects bootstrap 
+#
+# This test starts 3 peers (nated, server, no nat)and expects bootstrap
 # and a connected clique
 #
 # Conditions for successful exit:
-# Both peers have 2 connected peers in transport, core, topology, fs and dht 
+# Both peers have 2 connected peers in transport, core, topology, fs and dht
 
 import sys
 import signal
@@ -36,192 +36,195 @@ from gnunet_testing import Peer
 from gnunet_testing import Test
 from gnunet_testing import Check
 from gnunet_testing import Condition
-from gnunet_testing import * 
- 
+from gnunet_testing import *
+
 if os.name == "nt":
-  tmp = os.getenv ("TEMP")
+    tmp = os.getenv("TEMP")
 else:
-  tmp = "/tmp"
+    tmp = "/tmp"
 
-#definitions
+# definitions
 
 testname = "test_integration_clique"
 verbose = True
 check_timeout = 180
 
-def cleanup_onerror (function, path, excinfo):
-  import stat
-  if not os.path.exists (path):
-    pass
-  elif not os.access(path, os.W_OK):
-    # Is the error an access error ?
-    os.chmod (path, stat.S_IWUSR)
-    function (path)
-  else:
-    raise
-
-def cleanup ():
+
+def cleanup_onerror(function, path, excinfo):
+    import stat
+    if not os.path.exists(path):
+        pass
+    elif not os.access(path, os.W_OK):
+        # Is the error an access error ?
+        os.chmod(path, stat.S_IWUSR)
+        function(path)
+    else:
+        raise
+
+
+def cleanup():
     retries = 10
-    path = os.path.join (tmp, "c_bootstrap_server")  
-    test.p ("Removing " + path)      
+    path = os.path.join(tmp, "c_bootstrap_server")
+    test.p("Removing " + path)
     while ((os.path.exists(path)) and (retries > 0)):
-        shutil.rmtree ((path), False, cleanup_onerror)
-        time.sleep (1)
+        shutil.rmtree((path), False, cleanup_onerror)
+        time.sleep(1)
         retries -= 1
     if (os.path.exists(path)):
-        test.p ("Failed to remove " + path) 
+        test.p("Failed to remove " + path)
     retries = 10
-    path = os.path.join (tmp, "c_no_nat_client")  
-    test.p ("Removing " + path)      
+    path = os.path.join(tmp, "c_no_nat_client")
+    test.p("Removing " + path)
     while ((os.path.exists(path)) and (retries > 0)):
-        shutil.rmtree ((path), False, cleanup_onerror)
-        time.sleep (1)
+        shutil.rmtree((path), False, cleanup_onerror)
+        time.sleep(1)
         retries -= 1
     if (os.path.exists(path)):
-        test.p ("Failed to remove " + path)     
+        test.p("Failed to remove " + path)
         retries = 10
-    path = os.path.join (tmp, "c_nat_client")  
-    test.p ("Removing " + path)      
+    path = os.path.join(tmp, "c_nat_client")
+    test.p("Removing " + path)
     while ((os.path.exists(path)) and (retries > 0)):
-        shutil.rmtree ((path), False, cleanup_onerror)
-        time.sleep (1)
+        shutil.rmtree((path), False, cleanup_onerror)
+        time.sleep(1)
         retries -= 1
     if (os.path.exists(path)):
-        test.p ("Failed to remove " + path) 
+        test.p("Failed to remove " + path)
 
 
-def success_cont (check):
-    global success 
-    success = True;
+def success_cont(check):
+    global success
+    success = True
     print('Connected clique successfully')
 
-def fail_cont (check):    
-    global success 
-    success= False;
+
+def fail_cont(check):
+    global success
+    success = False
     check.evaluate(True)
     print('Failed to connect clique')
 
-def check_connect ():
-  check = Check (test)
-  check.add (StatisticsCondition (client, 'transport', '# peers connected',2))
-  check.add (StatisticsCondition (client, 'core', '# peers connected',2))
-  check.add (StatisticsCondition (client, 'topology', '# peers connected',2))
-  check.add (StatisticsCondition (client, 'dht', '# peers connected',2))
-  check.add (StatisticsCondition (client, 'fs', '# peers connected',2))
-
-  check.add (StatisticsCondition (client_nat, 'transport', '# peers connected',2))
-  check.add (StatisticsCondition (client_nat, 'core', '# peers connected',2))
-  check.add (StatisticsCondition (client_nat, 'topology', '# peers connected',2))
-  check.add (StatisticsCondition (client_nat, 'dht', '# peers connected',2))
-  check.add (StatisticsCondition (client_nat, 'fs', '# peers connected',2))
-  
-  check.add (StatisticsCondition (server, 'transport', '# peers connected',2))
-  check.add (StatisticsCondition (server, 'core', '# peers connected',2))
-  check.add (StatisticsCondition (server, 'topology', '# peers connected',2))
-  check.add (StatisticsCondition (server, 'dht', '# peers connected',2))
-  check.add (StatisticsCondition (server, 'fs', '# peers connected',2))  
-  
-  check.run_blocking (check_timeout, success_cont, fail_cont)
-
-# 
+
+def check_connect():
+    check = Check(test)
+    check.add(StatisticsCondition(client, 'transport', '# peers connected', 2))
+    check.add(StatisticsCondition(client, 'core', '# peers connected', 2))
+    check.add(StatisticsCondition(client, 'topology', '# peers connected', 2))
+    check.add(StatisticsCondition(client, 'dht', '# peers connected', 2))
+    check.add(StatisticsCondition(client, 'fs', '# peers connected', 2))
+
+    check.add(StatisticsCondition(client_nat, 'transport', '# peers connected', 2))
+    check.add(StatisticsCondition(client_nat, 'core', '# peers connected', 2))
+    check.add(StatisticsCondition(client_nat, 'topology', '# peers connected', 2))
+    check.add(StatisticsCondition(client_nat, 'dht', '# peers connected', 2))
+    check.add(StatisticsCondition(client_nat, 'fs', '# peers connected', 2))
+
+    check.add(StatisticsCondition(server, 'transport', '# peers connected', 2))
+    check.add(StatisticsCondition(server, 'core', '# peers connected', 2))
+    check.add(StatisticsCondition(server, 'topology', '# peers connected', 2))
+    check.add(StatisticsCondition(server, 'dht', '# peers connected', 2))
+    check.add(StatisticsCondition(server, 'fs', '# peers connected', 2))
+
+    check.run_blocking(check_timeout, success_cont, fail_cont)
+
+#
 # Test execution
-# 
-
-def SigHandler(signum = None, frame = None):
-        global success  
-        global server
-        global client
-        global client_nat    
-        
-        print('Test was aborted!')
-        if (None != server):
-                server.stop ()
-        if (None != client):            
-                client.stop ()
-        if (None != client_nat):                
-                client_nat.stop ()              
-        cleanup ()
-        sys.exit(success)
-
-def run ():
-        global success
-        global test
-        global server
-        global client
-        global client_nat       
-        
-        success = False
-        server = None
-        client = None
-        client_nat = None
-        test = Test ('test_integration_clique', verbose)
-        cleanup ()
-        
-        server = Peer(test, './confs/c_bootstrap_server.conf');
-        if (True != server.start()):
-                print('Failed to start server')
-                if (None != server):
-                        server.stop ()
-                cleanup ()
-                sys.exit(success)
-        
-        # Server has to settle down
-        time.sleep(5)
-        
-        client = Peer(test, './confs/c_no_nat_client.conf');
-        if (True != client.start()):
-                print('Failed to start client')
-                if (None != server):
-                        server.stop ()
-                if (None != client):
-                        client.stop ()                  
-                cleanup ()
-                sys.exit(success)
-        
-        # Server has to settle down
-        time.sleep(5)
-        
-        
-        client_nat = Peer(test, './confs/c_nat_client.conf');
-        if (True != client_nat.start()):
-                print('Failed to start client_nat')
-                if (None != server):
-                        server.stop ()
-                if (None != client):
-                        client.stop ()
-                if (None != client_nat):
-                        client_nat.stop ()                                                              
-                cleanup ()
-                sys.exit(success)       
-        
-        if ((client.started == True) and (client_nat.started == True) and (server.started == True)):
-            test.p ('Peers started, running check')
-            check_connect ()
-            
-        server.stop ()    
-        client.stop ()
-        client_nat.stop ()
-        
-        cleanup ()
-        
-        if (success == False):
-                print ('Test failed')
-                return False 
-        else:
-                return True
-
-    
+#
+
+
+def SigHandler(signum=None, frame=None):
+    global success
+    global server
+    global client
+    global client_nat
+
+    print('Test was aborted!')
+    if (None != server):
+        server.stop()
+    if (None != client):
+        client.stop()
+    if (None != client_nat):
+        client_nat.stop()
+    cleanup()
+    sys.exit(success)
+
+
+def run():
+    global success
+    global test
+    global server
+    global client
+    global client_nat
+
+    success = False
+    server = None
+    client = None
+    client_nat = None
+    test = Test('test_integration_clique', verbose)
+    cleanup()
+
+    server = Peer(test, './confs/c_bootstrap_server.conf')
+    if (True != server.start()):
+        print('Failed to start server')
+        if (None != server):
+            server.stop()
+        cleanup()
+        sys.exit(success)
+
+    # Server has to settle down
+    time.sleep(5)
+
+    client = Peer(test, './confs/c_no_nat_client.conf')
+    if (True != client.start()):
+        print('Failed to start client')
+        if (None != server):
+            server.stop()
+        if (None != client):
+            client.stop()
+        cleanup()
+        sys.exit(success)
+
+    # Server has to settle down
+    time.sleep(5)
+
+    client_nat = Peer(test, './confs/c_nat_client.conf')
+    if (True != client_nat.start()):
+        print('Failed to start client_nat')
+        if (None != server):
+            server.stop()
+        if (None != client):
+            client.stop()
+        if (None != client_nat):
+            client_nat.stop()
+        cleanup()
+        sys.exit(success)
+
+    if ((client.started == True) and (client_nat.started == True) and (server.started == True)):
+        test.p('Peers started, running check')
+        check_connect()
+
+    server.stop()
+    client.stop()
+    client_nat.stop()
+
+    cleanup()
+
+    if (success == False):
+        print('Test failed')
+        return False
+    else:
+        return True
+
+
 try:
-    run ()
-except (KeyboardInterrupt, SystemExit):    
+    run()
+except (KeyboardInterrupt, SystemExit):
     print('Test interrupted')
-    server.stop ()
-    client.stop ()
-    client_nat.stop ()
-    cleanup ()
+    server.stop()
+    client.stop()
+    client_nat.stop()
+    cleanup()
 if (success == False):
-        sys.exit(1)   
+    sys.exit(1)
 else:
-        sys.exit(0)    
-            
-
+    sys.exit(0)
diff --git a/src/integration-tests/test_integration_disconnect_nat.py.in b/src/integration-tests/test_integration_disconnect_nat.py.in
index 611255a09..12c268bd6 100755
--- a/src/integration-tests/test_integration_disconnect_nat.py.in
+++ b/src/integration-tests/test_integration_disconnect_nat.py.in
@@ -17,7 +17,7 @@
 #    Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
 #    Boston, MA 02110-1301, USA.
 #
-# 
+#
 import sys
 import signal
 import os
@@ -29,8 +29,8 @@ from gnunet_testing import Peer
 from gnunet_testing import Test
 from gnunet_testing import Check
 from gnunet_testing import Condition
-from gnunet_testing import * 
- 
+from gnunet_testing import *
+
 
 #
 # This test tests if a fresh peer bootstraps from a hostlist server and then
@@ -40,173 +40,175 @@ from gnunet_testing import *
 # Conditions for successful exit:
 # Client peer has 0 connected peer in transport, core, topology, dht, fs
 
-#definitions
+# definitions
 
 testname = "test_integration_disconnect"
 verbose = True
 check_timeout = 180
 
 if os.name == "nt":
-  tmp = os.getenv ("TEMP")
-  signals = [signal.SIGTERM, signal.SIGINT]
+    tmp = os.getenv("TEMP")
+    signals = [signal.SIGTERM, signal.SIGINT]
 else:
-  tmp = "/tmp"
-  signals = [signal.SIGTERM, signal.SIGINT, signal.SIGHUP, signal.SIGQUIT]
-
-def cleanup_onerror (function, path, excinfo):
-  import stat
-  if not os.path.exists (path):
-    pass
-  elif not os.access(path, os.W_OK):
-    # Is the error an access error ?
-    os.chmod (path, stat.S_IWUSR)
-    function (path)
-  else:
-    raise
-
-def cleanup ():
-  shutil.rmtree (os.path.join (tmp, "c_bootstrap_server"), False, cleanup_onerror)
-  shutil.rmtree (os.path.join (tmp, "c_nat_client"), False, cleanup_onerror)
-
-
-def success_disconnect_cont (check):
-        print('Peers disconnected successfully')
-        global success 
-        success = True;
-
-
-def fail_disconnect_cont (check):    
-        global success 
-        success = False;
-        print('Peers failed to disconnect')
-        check.evaluate(True)   
-  
-def check_disconnect ():
-  global server
-  global nat_client  
-  test.p ('Shutting down nat client')
-  nat_client.stop ()
-  check = Check (test)
-  check.add (StatisticsCondition (server, 'transport', '# peers connected',0))
-  check.add (StatisticsCondition (server, 'core', '# peers connected',0))
-  check.add (StatisticsCondition (server, 'topology', '# peers connected',0))
-  check.add (StatisticsCondition (server, 'dht', '# peers connected',0))
-  check.add (StatisticsCondition (server, 'fs', '# peers connected',0))
-  check.run_blocking (check_timeout, success_disconnect_cont, fail_disconnect_cont)
-
-
-def success_connect_cont (check):
-        print('Peers connected successfully')
-        check_disconnect ()
-
-
-def fail_connect_cont (check):    
-  global success 
-  success= False
-  print('Peers failed to connected!')
-  check.evaluate(True)
-
-
-def check_connect ():
-  global server
-  global nat_client  
-  check = Check (test)
-  check.add (StatisticsCondition (nat_client, 'transport', '# peers connected',1))
-  check.add (StatisticsCondition (nat_client, 'core', '# peers connected',1))
-  check.add (StatisticsCondition (nat_client, 'topology', '# peers connected',1))
-  check.add (StatisticsCondition (nat_client, 'dht', '# peers connected',1))
-  check.add (StatisticsCondition (nat_client, 'fs', '# peers connected',1))
-  
-  check.add (StatisticsCondition (server, 'transport', '# peers connected',1))
-  check.add (StatisticsCondition (server, 'core', '# peers connected',1))
-  check.add (StatisticsCondition (server, 'topology', '# peers connected',1))
-  check.add (StatisticsCondition (server, 'dht', '# peers connected',1))
-  check.add (StatisticsCondition (server, 'fs', '# peers connected',1))  
-  
-  check.run_blocking (check_timeout, success_connect_cont, fail_connect_cont)
-
-# 
+    tmp = "/tmp"
+    signals = [signal.SIGTERM, signal.SIGINT, signal.SIGHUP, signal.SIGQUIT]
+
+
+def cleanup_onerror(function, path, excinfo):
+    import stat
+    if not os.path.exists(path):
+        pass
+    elif not os.access(path, os.W_OK):
+        # Is the error an access error ?
+        os.chmod(path, stat.S_IWUSR)
+        function(path)
+    else:
+        raise
+
+
+def cleanup():
+    shutil.rmtree(os.path.join(tmp, "c_bootstrap_server"), False, cleanup_onerror)
+    shutil.rmtree(os.path.join(tmp, "c_nat_client"), False, cleanup_onerror)
+
+
+def success_disconnect_cont(check):
+    print('Peers disconnected successfully')
+    global success
+    success = True
+
+
+def fail_disconnect_cont(check):
+    global success
+    success = False;
+    print('Peers failed to disconnect')
+    check.evaluate(True)
+
+
+def check_disconnect():
+    global server
+    global nat_client
+    test.p('Shutting down nat client')
+    nat_client.stop()
+    check = Check(test)
+    check.add(StatisticsCondition(server, 'transport', '# peers connected', 0))
+    check.add(StatisticsCondition(server, 'core', '# peers connected', 0))
+    check.add(StatisticsCondition(server, 'topology', '# peers connected', 0))
+    check.add(StatisticsCondition(server, 'dht', '# peers connected', 0))
+    check.add(StatisticsCondition(server, 'fs', '# peers connected', 0))
+    check.run_blocking(check_timeout, success_disconnect_cont, fail_disconnect_cont)
+
+
+def success_connect_cont(check):
+    print('Peers connected successfully')
+    check_disconnect()
+
+
+def fail_connect_cont(check):
+    global success
+    success = False
+    print('Peers failed to connected!')
+    check.evaluate(True)
+
+
+def check_connect():
+    global server
+    global nat_client
+    check = Check(test)
+    check.add(StatisticsCondition(nat_client, 'transport', '# peers connected', 1))
+    check.add(StatisticsCondition(nat_client, 'core', '# peers connected', 1))
+    check.add(StatisticsCondition(nat_client, 'topology', '# peers connected', 1))
+    check.add(StatisticsCondition(nat_client, 'dht', '# peers connected', 1))
+    check.add(StatisticsCondition(nat_client, 'fs', '# peers connected', 1))
+
+    check.add(StatisticsCondition(server, 'transport', '# peers connected', 1))
+    check.add(StatisticsCondition(server, 'core', '# peers connected', 1))
+    check.add(StatisticsCondition(server, 'topology', '# peers connected', 1))
+    check.add(StatisticsCondition(server, 'dht', '# peers connected', 1))
+    check.add(StatisticsCondition(server, 'fs', '# peers connected', 1))
+
+    check.run_blocking(check_timeout, success_connect_cont, fail_connect_cont)
+
+
+#
 # Test execution
-# 
-
-def SigHandler(signum = None, frame = None):
-        global success  
-        global server
-        global nat_client  
-        
-        print('Test was aborted!')
-        if (None != server):
-                server.stop ()
-        if (None != nat_client):                
-                nat_client.stop ()
-        cleanup ()
-        sys.exit(success)
-
-def run ():
-        global success
-        global test
-        global server
-        global nat_client    
-        
-        server = None
-        nat_client = None
-        success = False  
-        
-        for sig in signals:
-                signal.signal(sig, SigHandler)
-
-        test = Test ('test_integration_bootstrap_and_connect.py', verbose)
-        cleanup ()
-        
-        server = Peer(test, './confs/c_bootstrap_server.conf');
-        nat_client = Peer(test, './confs/c_nat_client.conf');
-        
-        if (True != server.start()):
-                print('Failed to start server')
-                if (None != server):
-                        server.stop ()
-                cleanup ()
-                sys.exit(success)
-                
-        # Give the server time to start
-        time.sleep(5)
-                
-        if (True != nat_client.start()):
-                print('Failed to start nat_client')
-                if (None != server):
-                        server.stop ()
-                if (None != nat_client):                
-                        nat_client.stop ()
-                cleanup ()
-                sys.exit(success)
-        
-        if ((nat_client.started == True) and (server.started == True)):
-                test.p ('Peers started, running check')
-                time.sleep(5)
-                check_connect ()
-        server.stop ()
-        nat_client.stop ()
-        
-        cleanup ()
-        
-        if (success == False):
-                print ('Test failed')
-                return False 
-        else:
-                return True
+#
+
+def SigHandler(signum=None, frame=None):
+    global success
+    global server
+    global nat_client
+
+    print('Test was aborted!')
+    if (None != server):
+        server.stop()
+    if (None != nat_client):
+        nat_client.stop()
+    cleanup()
+    sys.exit(success)
+
+
+def run():
+    global success
+    global test
+    global server
+    global nat_client
+
+    server = None
+    nat_client = None
+    success = False
+
+    for sig in signals:
+        signal.signal(sig, SigHandler)
+
+    test = Test('test_integration_bootstrap_and_connect.py', verbose)
+    cleanup()
+
+    server = Peer(test, './confs/c_bootstrap_server.conf')
+    nat_client = Peer(test, './confs/c_nat_client.conf')
+
+    if (True != server.start()):
+        print('Failed to start server')
+        if (None != server):
+            server.stop()
+        cleanup()
+        sys.exit(success)
+
+    # Give the server time to start
+    time.sleep(5)
+
+    if (True != nat_client.start()):
+        print('Failed to start nat_client')
+        if (None != server):
+            server.stop()
+        if (None != nat_client):
+            nat_client.stop()
+        cleanup()
+        sys.exit(success)
+
+    if ((nat_client.started == True) and (server.started == True)):
+        test.p('Peers started, running check')
+        time.sleep(5)
+        check_connect()
+    server.stop()
+    nat_client.stop()
+
+    cleanup()
+
+    if (success == False):
+        print('Test failed')
+        return False
+    else:
+        return True
+
 
 try:
-        run ()
-except (KeyboardInterrupt, SystemExit):    
-        print('Test interrupted')
-        server.stop ()
-        nat_client.stop ()
-        cleanup ()
+    run()
+except(KeyboardInterrupt, SystemExit):
+    print('Test interrupted')
+    server.stop()
+    nat_client.stop()
+    cleanup()
 if (success == False):
-        sys.exit(1)   
+    sys.exit(1)
 else:
-        sys.exit(0)    
-     
-        
-     
-        
+    sys.exit(0)
diff --git a/src/integration-tests/test_integration_reconnect_nat.py.in b/src/integration-tests/test_integration_reconnect_nat.py.in
index 78c75c335..81cff7833 100755
--- a/src/integration-tests/test_integration_reconnect_nat.py.in
+++ b/src/integration-tests/test_integration_reconnect_nat.py.in
@@ -17,7 +17,7 @@
 #    Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
 #    Boston, MA 02110-1301, USA.
 #
-# 
+#
 import sys
 import os
 import subprocess
@@ -29,18 +29,18 @@ from gnunet_testing import Peer
 from gnunet_testing import Test
 from gnunet_testing import Check
 from gnunet_testing import Condition
-from gnunet_testing import * 
- 
+from gnunet_testing import *
+
 
 #
 # This test tests if a fresh peer bootstraps from a hostlist server and then
 # successfully connects to the server. When both peers are connected
-# in transport, core, topology, fs, botth peers are shutdown and restarted 
+# in transport, core, topology, fs, botth peers are shutdown and restarted
 #
 # Conditions for successful exit:
 # Both peers have 1 connected peer in transport, core, topology, fs after restart
 
-#definitions
+# definitions
 
 
 testname = "test_integration_restart"
@@ -48,191 +48,190 @@ verbose = True
 check_timeout = 180
 
 if os.name == "nt":
-  tmp = os.getenv ("TEMP")
-  signals = [signal.SIGTERM, signal.SIGINT]
+    tmp = os.getenv("TEMP")
+    signals = [signal.SIGTERM, signal.SIGINT]
 else:
-  tmp = "/tmp"
-  signals = [signal.SIGTERM, signal.SIGINT, signal.SIGHUP, signal.SIGQUIT]
-
-def cleanup_onerror (function, path, excinfo):
-  import stat
-  if not os.path.exists (path):
-    pass
-  elif not os.access(path, os.W_OK):
-    # Is the error an access error ?
-    os.chmod (path, stat.S_IWUSR)
-    function (path)
-  else:
-    raise
-
-def cleanup ():
+    tmp = "/tmp"
+    signals = [signal.SIGTERM, signal.SIGINT, signal.SIGHUP, signal.SIGQUIT]
+
+
+def cleanup_onerror(function, path, excinfo):
+    import stat
+    if not os.path.exists(path):
+        pass
+    elif not os.access(path, os.W_OK):
+        # Is the error an access error ?
+        os.chmod(path, stat.S_IWUSR)
+        function(path)
+    else:
+        raise
+
+
+def cleanup():
     retries = 10
-    path = os.path.join (tmp, "c_bootstrap_server")  
-    test.p ("Removing " + path)      
+    path = os.path.join(tmp, "c_bootstrap_server")
+    test.p("Removing " + path)
     while ((os.path.exists(path)) and (retries > 0)):
-        shutil.rmtree ((path), False, cleanup_onerror)
-        time.sleep (1)
+        shutil.rmtree((path), False, cleanup_onerror)
+        time.sleep(1)
         retries -= 1
     if (os.path.exists(path)):
-        test.p ("Failed to remove " + path) 
-        
-    
+        test.p("Failed to remove " + path)
+
     retries = 10
-    path = os.path.join (tmp, "c_nat_client")  
-    test.p ("Removing " + path)      
-    while ((os.path.exists(path)) and (retries > 0)):
-        shutil.rmtree ((path), False, cleanup_onerror)
-        time.sleep (1)
+    path = os.path.join(tmp, "c_nat_client")
+    test.p("Removing " + path)
+    while((os.path.exists(path)) and(retries > 0)):
+        shutil.rmtree((path), False, cleanup_onerror)
+        time.sleep(1)
         retries -= 1
     if (os.path.exists(path)):
-        test.p ("Failed to remove " + path) 
-
-def success_restart_cont (check):
-        global success 
-        print('Peers connected successfully after restart')
-        server.stop ()
-        client.stop ()
-        success = True; 
-
-
-def fail_restart_cont (check):    
-        global success 
-        success = False;
-        print('Peers failed to connect after restart')
-        check.evaluate(True)   
-    
-
-def success_connect_cont (check):
-        print('Peers connected successfully')
-        server.stop ()
-        client.stop ()
-        
-        time.sleep(5)
-        
-        test.p ('Restarting client & server')
-        server.start ()
-        client.start ()
-        
-        check = Check (test)
-        check.add (StatisticsCondition (client, 'transport', '# peers connected',1))
-        check.add (StatisticsCondition (client, 'core', '# peers connected',1))
-        check.add (StatisticsCondition (client, 'topology', '# peers connected',1))
-        check.add (StatisticsCondition (client, 'fs', '# peers connected',1))
-        
-        check.add (StatisticsCondition (server, 'transport', '# peers connected',1))
-        check.add (StatisticsCondition (server, 'core', '# peers connected',1))
-        check.add (StatisticsCondition (server, 'topology', '# peers connected',1))
-        check.add (StatisticsCondition (server, 'fs', '# peers connected',1))  
-        
-        check.run_blocking (check_timeout, success_restart_cont, fail_restart_cont)
-
-
-def fail_connect_cont (check):    
-        global success 
-        success= False;
-        print('Peers failed to connect')
-        check.evaluate(True)
-
-
-def check_connect ():
-        check = Check (test)
-        check.add (StatisticsCondition (client, 'transport', '# peers connected',1))
-        check.add (StatisticsCondition (client, 'core', '# peers connected',1))
-        check.add (StatisticsCondition (client, 'topology', '# peers connected',1))
-        check.add (StatisticsCondition (client, 'fs', '# peers connected',1))
-        
-        check.add (StatisticsCondition (server, 'transport', '# peers connected',1))
-        check.add (StatisticsCondition (server, 'core', '# peers connected',1))
-        check.add (StatisticsCondition (server, 'topology', '# peers connected',1))
-        check.add (StatisticsCondition (server, 'fs', '# peers connected',1))  
-        
-        check.run_blocking (check_timeout, success_connect_cont, fail_connect_cont)
-
-# 
+        test.p("Failed to remove " + path)
+
+
+def success_restart_cont(check):
+        global success
+        print('Peers connected successfully after restart')
+        server.stop()
+        client.stop()
+        success = True
+
+
+def fail_restart_cont(check):
+        global success
+        success = False
+        print('Peers failed to connect after restart')
+        check.evaluate(True)
+
+
+def success_connect_cont(check):
+    print('Peers connected successfully')
+    server.stop()
+    client.stop()
+
+    time.sleep(5)
+
+    test.p('Restarting client & server')
+    server.start()
+    client.start()
+
+    check = Check(test)
+    check.add(StatisticsCondition(client, 'transport', '# peers connected', 1))
+    check.add(StatisticsCondition(client, 'core', '# peers connected', 1))
+    check.add(StatisticsCondition(client, 'topology', '# peers connected', 1))
+    check.add(StatisticsCondition(client, 'fs', '# peers connected', 1))
+
+    check.add(StatisticsCondition(server, 'transport', '# peers connected', 1))
+    check.add(StatisticsCondition(server, 'core', '# peers connected', 1))
+    check.add(StatisticsCondition(server, 'topology', '# peers connected', 1))
+    check.add(StatisticsCondition(server, 'fs', '# peers connected', 1))
+
+    check.run_blocking(check_timeout, success_restart_cont, fail_restart_cont)
+
+
+def fail_connect_cont(check):
+    global success
+    success = False
+    print('Peers failed to connect')
+    check.evaluate(True)
+
+
+def check_connect():
+    check = Check(test)
+    check.add(StatisticsCondition(client, 'transport', '# peers connected', 1))
+    check.add(StatisticsCondition(client, 'core', '# peers connected', 1))
+    check.add(StatisticsCondition(client, 'topology', '# peers connected', 1))
+    check.add(StatisticsCondition(client, 'fs', '# peers connected', 1))
+
+    check.add(StatisticsCondition(server, 'transport', '# peers connected', 1))
+    check.add(StatisticsCondition(server, 'core', '# peers connected', 1))
+    check.add(StatisticsCondition(server, 'topology', '# peers connected', 1))
+    check.add(StatisticsCondition(server, 'fs', '# peers connected', 1))
+
+    check.run_blocking(check_timeout, success_connect_cont, fail_connect_cont)
+
+#
 # Test execution
-# 
-
-
-def SigHandler(signum = None, frame = None):
-        global success  
-        global server
-        global client  
-        
-        print('Test was aborted!')
-        if (None != server):
-                server.stop ()
-        if (None != client):            
-                client.stop ()
-        cleanup ()
-        sys.exit(success)
-
-def run ():
-        global success
-        global test
-        global server
-        global client
-        
-        success = False
-        server = None
-        client = None   
-
-        for sig in signals:
-                signal.signal(sig, SigHandler)
-        
-        
-        test = Test ('test_integration_disconnect', verbose)
-        cleanup ()
-        server = Peer(test, './confs/c_bootstrap_server.conf');
-        server.start();
-        
-        client = Peer(test, './confs/c_nat_client.conf');
-        client.start();
-        
-
-        if (True != server.start()):
-                print('Failed to start server')
-                if (None != server):
-                        server.stop ()
-                if (None != server):            
-                        client.stop ()
-                cleanup ()
-                sys.exit(success)
-                
-        # Give the server time to start
-        time.sleep(5)
-                        
-        if (True != client.start()):
-                print('Failed to start client')
-                if (None != server):
-                        server.stop ()
-                if (None != server):            
-                        client.stop ()
-                cleanup ()
-                sys.exit(success)
-        
-        check_connect ()
-        
-        server.stop ()    
-        client.stop ()
-        cleanup ()
-        
-        if (success == False):
-                print ('Test failed')
-                return True
-        else:
-                return False
-
-        
+#
+
+
+def SigHandler(signum=None, frame=None):
+    global success
+    global server
+    global client
+
+    print('Test was aborted!')
+    if (None != server):
+        server.stop()
+    if (None != client):
+        client.stop()
+    cleanup()
+    sys.exit(success)
+
+
+def run():
+    global success
+    global test
+    global server
+    global client
+
+    success = False
+    server = None
+    client = None
+
+    for sig in signals:
+        signal.signal(sig, SigHandler)
+
+    test = Test('test_integration_disconnect', verbose)
+    cleanup()
+    server = Peer(test, './confs/c_bootstrap_server.conf')
+    server.start()
+
+    client = Peer(test, './confs/c_nat_client.conf')
+    client.start()
+
+    if (True != server.start()):
+        print('Failed to start server')
+        if (None != server):
+            server.stop()
+        if (None != server):
+            client.stop()
+        cleanup()
+        sys.exit(success)
+
+    # Give the server time to start
+    time.sleep(5)
+
+    if (True != client.start()):
+        print('Failed to start client')
+        if (None != server):
+            server.stop()
+        if (None != server):
+            client.stop()
+        cleanup()
+        sys.exit(success)
+
+    check_connect()
+
+    server.stop()
+    client.stop()
+    cleanup()
+
+    if (success == False):
+        print('Test failed')
+        return True
+    else:
+        return False
+
+
 try:
-    run ()
-except (KeyboardInterrupt, SystemExit):    
+    run()
+except(KeyboardInterrupt, SystemExit):
     print('Test interrupted')
-    server.stop ()
-    client.stop ()
-    cleanup ()
+    server.stop()
+    client.stop()
+    cleanup()
 if (success == False):
-        sys.exit(1)   
+    sys.exit(1)
 else:
-        sys.exit(0)    
-
-        
+    sys.exit(0)
diff --git a/src/namestore/gnunet-namestore.c b/src/namestore/gnunet-namestore.c
index 753ee79d1..83a7ee349 100644
--- a/src/namestore/gnunet-namestore.c
+++ b/src/namestore/gnunet-namestore.c
@@ -641,14 +641,6 @@ get_existing_record (void *cls,
       ret = 1;
       test_finished ();
       return;
-    case GNUNET_GNSRECORD_TYPE_GNS2DNS:
-      fprintf (stderr,
-               _("A %s record exists already under `%s', no other records can be added.\n"),
-               "GNS2DNS",
-               rec_name);
-      ret = 1;
-      test_finished ();
-      return;
     }
   }
   switch (type)
@@ -678,16 +670,16 @@ get_existing_record (void *cls,
     }
     break;
   case GNUNET_GNSRECORD_TYPE_GNS2DNS:
-    if (0 != rd_count)
-    {
-      fprintf (stderr,
-               _("Records already exist under `%s', cannot add `%s' record.\n"),
-               rec_name,
-               "GNS2DNS");
-      ret = 1;
-      test_finished ();
-      return;
-    }
+    for (unsigned int i=0;i<rd_count;i++)
+      if (GNUNET_GNSRECORD_TYPE_GNS2DNS != rd[i].record_type)
+      {
+        fprintf (stderr,
+                 _("Non-GNS2DNS records already exist under `%s', cannot add GNS2DNS record.\n"),
+                 rec_name);
+        ret = 1;
+        test_finished ();
+        return;
+      }
     break;
   }
   memset (rdn,
diff --git a/src/namestore/gnunet-service-namestore.c b/src/namestore/gnunet-service-namestore.c
index 8e88558de..2044010df 100644
--- a/src/namestore/gnunet-service-namestore.c
+++ b/src/namestore/gnunet-service-namestore.c
@@ -278,12 +278,6 @@ struct StoreActivity
   const struct RecordStoreMessage *rsm;
 
   /**
-   * Array of record data to store (without NICK unless this is about
-   * #GNUNET_GNS_EMPTY_LABEL_AT).  Length is in @e rd_count.
-   */
-  struct GNUNET_GNSRECORD_Data *rd;
-
-  /**
    * Next zone monitor that still needs to be notified about this PUT.
    */
   struct ZoneMonitor *zm_pos;
@@ -293,11 +287,6 @@ struct StoreActivity
    */
   char *conv_name;
 
-  /**
-   * How many records do we try to store?
-   */
-  unsigned int rd_count;
-
 };
 
 
@@ -436,9 +425,6 @@ free_store_activity (struct StoreActivity *sa)
   GNUNET_CONTAINER_DLL_remove (sa_head,
                                sa_tail,
                                sa);
-  GNUNET_array_grow (sa->rd,
-                     sa->rd_count,
-                     0);
   GNUNET_free (sa->conv_name);
   GNUNET_free (sa);
 }
@@ -551,6 +537,7 @@ merge_with_nick_records (const struct GNUNET_GNSRECORD_Data *nick_rd,
   size_t req;
   char *data;
   size_t data_offset;
+  struct GNUNET_GNSRECORD_Data *target;
 
   (*rdc_res) = 1 + rd2_length;
   if (0 == 1 + rd2_length)
@@ -560,38 +547,52 @@ merge_with_nick_records (const struct GNUNET_GNSRECORD_Data *nick_rd,
     return;
   }
   req = sizeof (struct GNUNET_GNSRECORD_Data) + nick_rd->data_size;
-  for (unsigned int c=0; c< rd2_length; c++)
-    req += sizeof (struct GNUNET_GNSRECORD_Data) + rd2[c].data_size;
-  (*rd_res) = GNUNET_malloc (req);
-  data = (char *) &(*rd_res)[1 + rd2_length];
+  for (unsigned int i=0; i<rd2_length; i++)
+  {
+    const struct GNUNET_GNSRECORD_Data *orig = &rd2[i];
+
+    if (req + sizeof (struct GNUNET_GNSRECORD_Data) + orig->data_size < req)
+    {
+      GNUNET_break (0);
+      (*rd_res) = NULL;
+      return;
+    }
+    req += sizeof (struct GNUNET_GNSRECORD_Data) + orig->data_size;
+  }
+  target = GNUNET_malloc (req);
+  (*rd_res) = target;
+  data = (char *) &target[1 + rd2_length];
   data_offset = 0;
   latest_expiration = 0;
-  for (unsigned int c=0; c< rd2_length; c++)
+  for (unsigned int i=0;i<rd2_length;i++)
   {
-    if (0 != (rd2[c].flags & GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION))
+    const struct GNUNET_GNSRECORD_Data *orig = &rd2[i];
+
+    if (0 != (orig->flags & GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION))
     {
-      if ((GNUNET_TIME_absolute_get().abs_value_us + rd2[c].expiration_time) >
-        latest_expiration)
-          latest_expiration = rd2[c].expiration_time;
+      if ((GNUNET_TIME_absolute_get().abs_value_us + orig->expiration_time) >
+          latest_expiration)
+        latest_expiration = orig->expiration_time;
     }
-    else if (rd2[c].expiration_time > latest_expiration)
-      latest_expiration = rd2[c].expiration_time;
-    (*rd_res)[c] = rd2[c];
-    (*rd_res)[c].data = (void *) &data[data_offset];
+    else if (orig->expiration_time > latest_expiration)
+      latest_expiration = orig->expiration_time;
+    target[i] = *orig;
+    target[i].data = (void *) &data[data_offset];
     GNUNET_memcpy (&data[data_offset],
-                   rd2[c].data,
-                   rd2[c].data_size);
-    data_offset += (*rd_res)[c].data_size;
+                   orig->data,
+                   orig->data_size);
+    data_offset += orig->data_size;
   }
   /* append nick */
-  (*rd_res)[rd2_length] = *nick_rd;
-  (*rd_res)[rd2_length].expiration_time = latest_expiration;
-  (*rd_res)[rd2_length].data = (void *) &data[data_offset];
-  GNUNET_memcpy ((void *) (*rd_res)[rd2_length].data,
+  target[rd2_length] = *nick_rd;
+  target[rd2_length].expiration_time = latest_expiration;
+  target[rd2_length].data = (void *) &data[data_offset];
+  GNUNET_memcpy (&data[data_offset],
                  nick_rd->data,
                  nick_rd->data_size);
-  data_offset += (*rd_res)[rd2_length].data_size;
-  GNUNET_assert (req == (sizeof (struct GNUNET_GNSRECORD_Data)) * (*rdc_res) + data_offset);
+  data_offset += nick_rd->data_size;
+  GNUNET_assert (req ==
+                 (sizeof (struct GNUNET_GNSRECORD_Data)) * (*rdc_res) + data_offset);
 }
 
 
@@ -620,11 +621,16 @@ send_lookup_response (struct NamestoreClient *nc,
   struct GNUNET_GNSRECORD_Data *res;
   unsigned int res_count;
   size_t name_len;
-  size_t rd_ser_len;
+  ssize_t rd_ser_len;
   char *name_tmp;
   char *rd_ser;
 
   nick = get_nick_record (zone_key);
+
+  GNUNET_assert (-1 !=
+                 GNUNET_GNSRECORD_records_get_size (rd_count,
+                                                    rd));
+
   if ( (NULL != nick) &&
        (0 != strcmp (name,
                      GNUNET_GNS_EMPTY_LABEL_AT)))
@@ -643,26 +649,44 @@ send_lookup_response (struct NamestoreClient *nc,
     res = (struct GNUNET_GNSRECORD_Data *) rd;
   }
 
+  GNUNET_assert (-1 !=
+                 GNUNET_GNSRECORD_records_get_size (res_count,
+                                                    res));
+
+
   name_len = strlen (name) + 1;
   rd_ser_len = GNUNET_GNSRECORD_records_get_size (res_count,
                                                   res);
+  if (rd_ser_len < 0)
+  {
+    GNUNET_break (0);
+    GNUNET_SERVICE_client_drop (nc->client);
+    return;
+  }
+  if (rd_ser_len >= UINT16_MAX - name_len - sizeof (*zir_msg))
+  {
+    GNUNET_break (0);
+    GNUNET_SERVICE_client_drop (nc->client);
+    return;
+  }
   env = GNUNET_MQ_msg_extra (zir_msg,
                              name_len + rd_ser_len,
                              GNUNET_MESSAGE_TYPE_NAMESTORE_RECORD_RESULT);
   zir_msg->gns_header.r_id = htonl (request_id);
   zir_msg->name_len = htons (name_len);
   zir_msg->rd_count = htons (res_count);
-  zir_msg->rd_len = htons (rd_ser_len);
+  zir_msg->rd_len = htons ((uint16_t) rd_ser_len);
   zir_msg->private_key = *zone_key;
   name_tmp = (char *) &zir_msg[1];
   GNUNET_memcpy (name_tmp,
                  name,
                  name_len);
   rd_ser = &name_tmp[name_len];
-  GNUNET_GNSRECORD_records_serialize (res_count,
-                                      res,
-                                      rd_ser_len,
-                                      rd_ser);
+  GNUNET_assert (rd_ser_len ==
+                 GNUNET_GNSRECORD_records_serialize (res_count,
+                                                     res,
+                                                     rd_ser_len,
+                                                     rd_ser));
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Sending RECORD_RESULT message with %u records\n",
               res_count);
@@ -865,72 +889,70 @@ static void
 continue_store_activity (struct StoreActivity *sa)
 {
   const struct RecordStoreMessage *rp_msg = sa->rsm;
+  unsigned int rd_count;
+  size_t name_len;
+  size_t rd_ser_len;
+  uint32_t rid;
+  const char *name_tmp;
+  const char *rd_ser;
 
-  for (struct ZoneMonitor *zm = sa->zm_pos;
-       NULL != zm;
-       zm = sa->zm_pos)
-  {
-    if ( (0 != memcmp (&rp_msg->private_key,
-                       &zm->zone,
-                       sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey))) &&
-         (0 != memcmp (&zm->zone,
-                       &zero,
-                       sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey))) )
-      sa->zm_pos = zm->next; /* not interesting to this monitor */
-    if (zm->limit == zm->iteration_cnt)
-    {
-      zm->sa_waiting = GNUNET_YES;
-      zm->sa_waiting_start = GNUNET_TIME_absolute_get ();
-      if (NULL != zm->sa_wait_warning)
-        GNUNET_SCHEDULER_cancel (zm->sa_wait_warning);
-      zm->sa_wait_warning = GNUNET_SCHEDULER_add_delayed (MONITOR_STALL_WARN_DELAY,
-                                                          &warn_monitor_slow,
-                                                          zm);
-      return; /* blocked on zone monitor */
-    }
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "Notifying monitor about changes under label `%s'\n",
-                sa->conv_name);
-    zm->limit--;
-    send_lookup_response (zm->nc,
-                          0,
-                          &rp_msg->private_key,
-                          sa->conv_name,
-                          sa->rd_count,
-                          sa->rd);
-    sa->zm_pos = zm->next;
-  }
-  /* great, done with the monitors, unpack (again) for refresh_block operation */
+  rid = ntohl (rp_msg->gns_header.r_id);
+  name_len = ntohs (rp_msg->name_len);
+  rd_count = ntohs (rp_msg->rd_count);
+  rd_ser_len = ntohs (rp_msg->rd_len);
+  name_tmp = (const char *) &rp_msg[1];
+  rd_ser = &name_tmp[name_len];
   {
-    size_t name_len;
-    size_t rd_ser_len;
-    uint32_t rid;
-    const char *name_tmp;
-    const char *rd_ser;
-    unsigned int rd_count;
-
-    rid = ntohl (rp_msg->gns_header.r_id);
-    name_len = ntohs (rp_msg->name_len);
-    rd_count = ntohs (rp_msg->rd_count);
-    rd_ser_len = ntohs (rp_msg->rd_len);
-    name_tmp = (const char *) &rp_msg[1];
-    rd_ser = &name_tmp[name_len];
+    struct GNUNET_GNSRECORD_Data rd[GNUNET_NZL(rd_count)];
+
+    /* We did this before, must succeed again */
+    GNUNET_assert (GNUNET_OK ==
+                   GNUNET_GNSRECORD_records_deserialize (rd_ser_len,
+                                                         rd_ser,
+                                                         rd_count,
+                                                         rd));
+
+    for (struct ZoneMonitor *zm = sa->zm_pos;
+         NULL != zm;
+         zm = sa->zm_pos)
     {
-      struct GNUNET_GNSRECORD_Data rd[rd_count];
-
-      /* We did this before, must succeed again */
-      GNUNET_assert (GNUNET_OK ==
-                     GNUNET_GNSRECORD_records_deserialize (rd_ser_len,
-                                                           rd_ser,
-                                                           rd_count,
-                                                           rd));
-      refresh_block (sa->nc,
-                     rid,
-                     &rp_msg->private_key,
-                     sa->conv_name,
-                     rd_count,
-                     rd);
+      if ( (0 != memcmp (&rp_msg->private_key,
+                         &zm->zone,
+                         sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey))) &&
+           (0 != memcmp (&zm->zone,
+                         &zero,
+                         sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey))) )
+        sa->zm_pos = zm->next; /* not interesting to this monitor */
+      if (zm->limit == zm->iteration_cnt)
+      {
+        zm->sa_waiting = GNUNET_YES;
+        zm->sa_waiting_start = GNUNET_TIME_absolute_get ();
+        if (NULL != zm->sa_wait_warning)
+          GNUNET_SCHEDULER_cancel (zm->sa_wait_warning);
+        zm->sa_wait_warning = GNUNET_SCHEDULER_add_delayed (MONITOR_STALL_WARN_DELAY,
+                                                            &warn_monitor_slow,
+                                                            zm);
+        return; /* blocked on zone monitor */
+      }
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "Notifying monitor about changes under label `%s'\n",
+                  sa->conv_name);
+      zm->limit--;
+      send_lookup_response (zm->nc,
+                            0,
+                            &rp_msg->private_key,
+                            sa->conv_name,
+                            rd_count,
+                            rd);
+      sa->zm_pos = zm->next;
     }
+    /* great, done with the monitors, unpack (again) for refresh_block operation */
+    refresh_block (sa->nc,
+                   rid,
+                   &rp_msg->private_key,
+                   sa->conv_name,
+                   rd_count,
+                   rd);
   }
   GNUNET_SERVICE_client_continue (sa->nc->client);
   free_store_activity (sa);
@@ -1073,12 +1095,13 @@ struct RecordLookupContext
   /**
    * FIXME.
    */
-  size_t rd_ser_len;
+  ssize_t rd_ser_len;
 };
 
 
 /**
  * FIXME.
+ *
  * @param seq sequence number of the record
  */
 static void
@@ -1090,60 +1113,93 @@ lookup_it (void *cls,
            const struct GNUNET_GNSRECORD_Data *rd)
 {
   struct RecordLookupContext *rlc = cls;
-  struct GNUNET_GNSRECORD_Data *rd_res;
-  unsigned int rdc_res;
 
   (void) private_key;
   (void) seq;
-  if (0 == strcmp (label,
+  if (0 != strcmp (label,
                    rlc->label))
+    return;
+  rlc->found = GNUNET_YES;
+  if (0 == rd_count)
   {
-    rlc->found = GNUNET_YES;
-    if (0 != rd_count)
+    rlc->rd_ser_len = 0;
+    rlc->res_rd_count = 0;
+    rlc->res_rd = NULL;
+    return;
+  }
+  if ( (NULL != rlc->nick) &&
+       (0 != strcmp (label,
+                     GNUNET_GNS_EMPTY_LABEL_AT)) )
+  {
+    /* Merge */
+    struct GNUNET_GNSRECORD_Data *rd_res;
+    unsigned int rdc_res;
+
+    rd_res = NULL;
+    rdc_res = 0;
+    rlc->nick->flags = (rlc->nick->flags | GNUNET_GNSRECORD_RF_PRIVATE) ^ GNUNET_GNSRECORD_RF_PRIVATE;
+    merge_with_nick_records (rlc->nick,
+                             rd_count,
+                             rd,
+                             &rdc_res,
+                             &rd_res);
+    rlc->rd_ser_len = GNUNET_GNSRECORD_records_get_size (rdc_res,
+                                                         rd_res);
+    if (rlc->rd_ser_len < 0)
     {
-      if ( (NULL != rlc->nick) &&
-           (0 != strcmp (label,
-                         GNUNET_GNS_EMPTY_LABEL_AT)) )
-      {
-        /* Merge */
-        rd_res = NULL;
-        rdc_res = 0;
-        rlc->nick->flags = (rlc->nick->flags | GNUNET_GNSRECORD_RF_PRIVATE) ^ GNUNET_GNSRECORD_RF_PRIVATE;
-        merge_with_nick_records (rlc->nick,
-                                 rd_count,
-                                 rd,
-                                 &rdc_res,
-                                 &rd_res);
-        rlc->rd_ser_len = GNUNET_GNSRECORD_records_get_size (rdc_res,
-                                                             rd_res);
-        rlc->res_rd_count = rdc_res;
-        rlc->res_rd = GNUNET_malloc (rlc->rd_ser_len);
+      GNUNET_break (0);
+      GNUNET_free  (rd_res);
+      rlc->found = GNUNET_NO;
+      rlc->rd_ser_len = 0;
+      return;
+    }
+    rlc->res_rd_count = rdc_res;
+    rlc->res_rd = GNUNET_malloc (rlc->rd_ser_len);
+    if (rlc->rd_ser_len !=
         GNUNET_GNSRECORD_records_serialize (rdc_res,
                                             rd_res,
                                             rlc->rd_ser_len,
-                                            rlc->res_rd);
-
-        GNUNET_free  (rd_res);
-        GNUNET_free  (rlc->nick);
-        rlc->nick = NULL;
-      }
-      else
-      {
-        rlc->rd_ser_len = GNUNET_GNSRECORD_records_get_size (rd_count,
-                                                             rd);
-        rlc->res_rd_count = rd_count;
-        rlc->res_rd = GNUNET_malloc (rlc->rd_ser_len);
+                                            rlc->res_rd))
+    {
+      GNUNET_break (0);
+      GNUNET_free  (rlc->res_rd);
+      rlc->res_rd = NULL;
+      rlc->res_rd_count = 0;
+      rlc->rd_ser_len = 0;
+      GNUNET_free  (rd_res);
+      rlc->found = GNUNET_NO;
+      return;
+    }
+    GNUNET_free (rd_res);
+    GNUNET_free (rlc->nick);
+    rlc->nick = NULL;
+  }
+  else
+  {
+    rlc->rd_ser_len = GNUNET_GNSRECORD_records_get_size (rd_count,
+                                                         rd);
+    if (rlc->rd_ser_len < 0)
+    {
+      GNUNET_break (0);
+      rlc->found = GNUNET_NO;
+      rlc->rd_ser_len = 0;
+      return;
+    }
+    rlc->res_rd_count = rd_count;
+    rlc->res_rd = GNUNET_malloc (rlc->rd_ser_len);
+    if (rlc->rd_ser_len !=
         GNUNET_GNSRECORD_records_serialize (rd_count,
                                             rd,
                                             rlc->rd_ser_len,
-                                            rlc->res_rd);
-      }
-    }
-    else
+                                            rlc->res_rd))
     {
-      rlc->rd_ser_len = 0;
-      rlc->res_rd_count = 0;
+      GNUNET_break (0);
+      GNUNET_free  (rlc->res_rd);
       rlc->res_rd = NULL;
+      rlc->res_rd_count = 0;
+      rlc->rd_ser_len = 0;
+      rlc->found = GNUNET_NO;
+      return;
     }
   }
 }
@@ -1331,8 +1387,6 @@ handle_record_store (void *cls,
   rd_ser = &name_tmp[name_len];
   {
     struct GNUNET_GNSRECORD_Data rd[GNUNET_NZL(rd_count)];
-    struct GNUNET_GNSRECORD_Data rd_clean[GNUNET_NZL(rd_count)];
-    unsigned int rd_clean_off;
 
     if (GNUNET_OK !=
         GNUNET_GNSRECORD_records_deserialize (rd_ser_len,
@@ -1381,6 +1435,9 @@ handle_record_store (void *cls,
     {
       /* remove "NICK" records, unless this is for the
          #GNUNET_GNS_EMPTY_LABEL_AT label */
+      struct GNUNET_GNSRECORD_Data rd_clean[GNUNET_NZL(rd_count)];
+      unsigned int rd_clean_off;
+
       rd_clean_off = 0;
       for (unsigned int i=0;i<rd_count;i++)
       {
@@ -1420,12 +1477,6 @@ handle_record_store (void *cls,
                    ntohs (rp_msg->gns_header.header.size));
     sa->zm_pos = monitor_head;
     sa->conv_name = conv_name;
-    GNUNET_array_grow (sa->rd,
-                       sa->rd_count,
-                       rd_clean_off);
-    GNUNET_memcpy (sa->rd,
-                   rd_clean,
-                   sizeof (struct GNUNET_GNSRECORD_Data) * rd_clean_off);
     continue_store_activity (sa);
   }
 }
@@ -1479,7 +1530,7 @@ handle_zone_to_name_it (void *cls,
   struct ZoneToNameResponseMessage *ztnr_msg;
   int16_t res;
   size_t name_len;
-  size_t rd_ser_len;
+  ssize_t rd_ser_len;
   size_t msg_size;
   char *name_tmp;
   char *rd_tmp;
@@ -1490,7 +1541,14 @@ handle_zone_to_name_it (void *cls,
               name);
   res = GNUNET_YES;
   name_len = (NULL == name) ? 0 : strlen (name) + 1;
-  rd_ser_len = GNUNET_GNSRECORD_records_get_size (rd_count, rd);
+  rd_ser_len = GNUNET_GNSRECORD_records_get_size (rd_count,
+                                                  rd);
+  if (rd_ser_len < 0)
+  {
+    GNUNET_break (0);
+    ztn_ctx->success = GNUNET_SYSERR;
+    return;
+  }
   msg_size = sizeof (struct ZoneToNameResponseMessage) + name_len + rd_ser_len;
   if (msg_size >= GNUNET_MAX_MESSAGE_SIZE)
   {
@@ -1513,10 +1571,11 @@ handle_zone_to_name_it (void *cls,
                  name,
                  name_len);
   rd_tmp = &name_tmp[name_len];
-  GNUNET_GNSRECORD_records_serialize (rd_count,
-                                      rd,
-                                      rd_ser_len,
-                                      rd_tmp);
+  GNUNET_assert (rd_ser_len ==
+                 GNUNET_GNSRECORD_records_serialize (rd_count,
+                                                     rd,
+                                                     rd_ser_len,
+                                                     rd_tmp));
   ztn_ctx->success = GNUNET_OK;
   GNUNET_MQ_send (ztn_ctx->nc->mq,
                   env);
diff --git a/src/namestore/gnunet-zoneimport.c b/src/namestore/gnunet-zoneimport.c
index b394178a6..44c9fe89e 100644
--- a/src/namestore/gnunet-zoneimport.c
+++ b/src/namestore/gnunet-zoneimport.c
@@ -1494,6 +1494,16 @@ do_shutdown (void *cls)
 
 
 /**
+ * Iterate over all of the zones we care about and see which records
+ * we may need to re-fetch when.
+ *
+ * @param cls NULL
+ */
+static void
+iterate_zones (void *cls);
+
+
+/**
  * Function called if #GNUNET_NAMESTORE_records_lookup() failed.
  * Just logs an error.
  *
@@ -1507,6 +1517,9 @@ ns_lookup_error_cb (void *cls)
   GNUNET_log (GNUNET_ERROR_TYPE_INFO,
               "Failed to load data from namestore for zone `%s'\n",
               zone->domain);
+  zone_it = NULL;
+  ns_iterator_trigger_next = 0;
+  iterate_zones (NULL);
 }
 
 
@@ -1842,7 +1855,7 @@ process_stdin (void *cls)
       delta = GNUNET_TIME_absolute_get_duration (last);
       last = GNUNET_TIME_absolute_get ();
       fprintf (stderr,
-               "Read 10000 domain names in %s\n",
+               "Read 100000 domain names in %s\n",
                GNUNET_STRINGS_relative_time_to_string (delta,
                                                        GNUNET_YES));
       GNUNET_STATISTICS_set (stats,
diff --git a/src/namestore/namestore_api.c b/src/namestore/namestore_api.c
index 57bf8f81b..f2aaa43c8 100644
--- a/src/namestore/namestore_api.c
+++ b/src/namestore/namestore_api.c
@@ -1033,7 +1033,7 @@ GNUNET_NAMESTORE_records_store (struct GNUNET_NAMESTORE_Handle *h,
   struct GNUNET_MQ_Envelope *env;
   char *name_tmp;
   char *rd_ser;
-  size_t rd_ser_len;
+  ssize_t rd_ser_len;
   size_t name_len;
   uint32_t rid;
   struct RecordStoreMessage *msg;
@@ -1045,6 +1045,18 @@ GNUNET_NAMESTORE_records_store (struct GNUNET_NAMESTORE_Handle *h,
     GNUNET_break (0);
     return NULL;
   }
+  rd_ser_len = GNUNET_GNSRECORD_records_get_size (rd_count,
+                                                  rd);
+  if (rd_ser_len < 0)
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+  if (rd_ser_len > UINT16_MAX)
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
   rid = get_op_id (h);
   qe = GNUNET_new (struct GNUNET_NAMESTORE_QueueEntry);
   qe->h = h;
@@ -1056,8 +1068,6 @@ GNUNET_NAMESTORE_records_store (struct GNUNET_NAMESTORE_Handle *h,
                                     qe);
 
   /* setup msg */
-  rd_ser_len = GNUNET_GNSRECORD_records_get_size (rd_count,
-                                                  rd);
   env = GNUNET_MQ_msg_extra (msg,
                              name_len + rd_ser_len,
                              GNUNET_MESSAGE_TYPE_NAMESTORE_RECORD_STORE);
@@ -1077,8 +1087,10 @@ GNUNET_NAMESTORE_records_store (struct GNUNET_NAMESTORE_Handle *h,
                                              rd,
                                              rd_ser_len,
                                              rd_ser);
-  if (0 > sret)
+  if ( (0 > sret) ||
+       (sret != rd_ser_len) )
   {
+    GNUNET_break (0);
     GNUNET_free (env);
     return NULL;
   }
diff --git a/src/namestore/namestore_api_monitor.c b/src/namestore/namestore_api_monitor.c
index 9ba90833b..16780ad0c 100644
--- a/src/namestore/namestore_api_monitor.c
+++ b/src/namestore/namestore_api_monitor.c
@@ -144,6 +144,11 @@ check_result (void *cls,
   rd_len = ntohs (lrm->rd_len);
   rd_count = ntohs (lrm->rd_count);
   name_len = ntohs (lrm->name_len);
+  if (name_len > MAX_NAME_LEN)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
   exp_lrm_len = sizeof (struct RecordResultMessage) + name_len + rd_len;
   if (lrm_len != exp_lrm_len)
   {
@@ -156,7 +161,7 @@ check_result (void *cls,
     return GNUNET_SYSERR;
   }
   name_tmp = (const char *) &lrm[1];
-  if ((name_tmp[name_len -1] != '\0') || (name_len > MAX_NAME_LEN))
+  if (name_tmp[name_len -1] != '\0')
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
diff --git a/src/namestore/plugin_namestore_flat.c b/src/namestore/plugin_namestore_flat.c
index 35d8424b4..95edb9d87 100644
--- a/src/namestore/plugin_namestore_flat.c
+++ b/src/namestore/plugin_namestore_flat.c
@@ -301,7 +301,7 @@ store_and_free_entries (void *cls,
   char *line;
   char *zone_private_key;
   char *record_data_b64;
-  size_t data_size;
+  ssize_t data_size;
 
   (void) key;
   GNUNET_STRINGS_base64_encode ((char*)entry->private_key,
@@ -309,6 +309,18 @@ store_and_free_entries (void *cls,
                                 &zone_private_key);
   data_size = GNUNET_GNSRECORD_records_get_size (entry->record_count,
                                                  entry->record_data);
+  if (data_size < 0)
+  {
+    GNUNET_break (0);
+    GNUNET_free (zone_private_key);
+    return GNUNET_SYSERR;
+  }
+  if (data_size >= UINT16_MAX)
+  {
+    GNUNET_break (0);
+    GNUNET_free (zone_private_key);
+    return GNUNET_SYSERR;
+  }
   {
     char data[data_size];
     ssize_t ret;
@@ -318,7 +330,7 @@ store_and_free_entries (void *cls,
                                               data_size,
                                               data);
     if ( (ret < 0) ||
-         (data_size != (size_t) ret) )
+         (data_size != ret) )
     {
       GNUNET_break (0);
       GNUNET_free (zone_private_key);
diff --git a/src/namestore/plugin_namestore_postgres.c b/src/namestore/plugin_namestore_postgres.c
index d7907b1a6..09fdd760f 100644
--- a/src/namestore/plugin_namestore_postgres.c
+++ b/src/namestore/plugin_namestore_postgres.c
@@ -220,7 +220,7 @@ namestore_postgres_store_records (void *cls,
   struct GNUNET_CRYPTO_EcdsaPublicKey pkey;
   uint64_t rvalue;
   uint32_t rd_count32 = (uint32_t) rd_count;
-  size_t data_size;
+  ssize_t data_size;
 
   memset (&pkey,
           0,
@@ -238,7 +238,12 @@ namestore_postgres_store_records (void *cls,
                                      UINT64_MAX);
   data_size = GNUNET_GNSRECORD_records_get_size (rd_count,
                                                  rd);
-  if (data_size > 64 * 65536)
+  if (data_size < 0)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (data_size >= UINT16_MAX)
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
@@ -287,7 +292,7 @@ namestore_postgres_store_records (void *cls,
                                               data_size,
                                               data);
     if ( (ret < 0) ||
-         (data_size != (size_t) ret) )
+         (data_size != ret) )
     {
       GNUNET_break (0);
       return GNUNET_SYSERR;
diff --git a/src/namestore/plugin_namestore_sqlite.c b/src/namestore/plugin_namestore_sqlite.c
index 34e548613..81391ce8a 100644
--- a/src/namestore/plugin_namestore_sqlite.c
+++ b/src/namestore/plugin_namestore_sqlite.c
@@ -313,7 +313,7 @@ namestore_sqlite_store_records (void *cls,
   int n;
   struct GNUNET_CRYPTO_EcdsaPublicKey pkey;
   uint64_t rvalue;
-  size_t data_size;
+  ssize_t data_size;
 
   memset (&pkey,
           0,
@@ -332,6 +332,11 @@ namestore_sqlite_store_records (void *cls,
                                      UINT64_MAX);
   data_size = GNUNET_GNSRECORD_records_get_size (rd_count,
                                                  rd);
+  if (data_size < 0)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
   if (data_size > 64 * 65536)
   {
     GNUNET_break (0);
@@ -352,7 +357,7 @@ namestore_sqlite_store_records (void *cls,
                                               data_size,
                                               data);
     if ( (ret < 0) ||
-         (data_size != (size_t) ret) )
+         (data_size != ret) )
     {
       GNUNET_break (0);
       return GNUNET_SYSERR;
diff --git a/src/namestore/test_namestore_api.conf b/src/namestore/test_namestore_api.conf
index 07409ea2b..5e96eab7c 100644
--- a/src/namestore/test_namestore_api.conf
+++ b/src/namestore/test_namestore_api.conf
@@ -1,5 +1,5 @@
-@INLINE@ ../../contrib/no_forcestart.conf
-@INLINE@ ../../contrib/no_autostart_above_core.conf
+@INLINE@ ../../contrib/conf/gnunet/no_forcestart.conf
+@INLINE@ ../../contrib/conf/gnunet/no_autostart_above_core.conf
 
 [PATHS]
 GNUNET_TEST_HOME = $GNUNET_TMP/test-gnunet-namestore/
diff --git a/src/peerinfo-tool/test_gnunet_peerinfo.py.in b/src/peerinfo-tool/test_gnunet_peerinfo.py.in
index 3207c2c2f..fb5941121 100755
--- a/src/peerinfo-tool/test_gnunet_peerinfo.py.in
+++ b/src/peerinfo-tool/test_gnunet_peerinfo.py.in
@@ -1,6 +1,6 @@
 #!@PYTHON@
 #    This file is part of GNUnet.
-#    (C) 2010 Christian Grothoff (and other contributing authors)
+#    (C) 2010, 2018 Christian Grothoff (and other contributing authors)
 #
 #    GNUnet is free software; you can redistribute it and/or modify
 #    it under the terms of the GNU General Public License as published
@@ -26,70 +26,70 @@ import shutil
 import time
 
 srcdir = "../.."
-gnunet_pyexpect_dir = os.path.join (srcdir, "contrib")
+gnunet_pyexpect_dir = os.path.join(srcdir, "contrib/scripts")
 if gnunet_pyexpect_dir not in sys.path:
-  sys.path.append (gnunet_pyexpect_dir)
+    sys.path.append(gnunet_pyexpect_dir)
 
 from gnunet_pyexpect import pexpect
 
 if os.name == 'posix':
-  peerinfo = './gnunet-peerinfo'
-  gnunetarm = 'gnunet-arm'
-  gnunettesting = 'gnunet-testing'
+    peerinfo = './gnunet-peerinfo'
+    gnunetarm = 'gnunet-arm'
+    gnunettesting = 'gnunet-testing'
 elif os.name == 'nt':
-  peerinfo = './gnunet-peerinfo.exe'
-  gnunetarm = 'gnunet-arm.exe'
-  gnunettesting = 'gnunet-testing.exe'
+    peerinfo = './gnunet-peerinfo.exe'
+    gnunetarm = 'gnunet-arm.exe'
+    gnunettesting = 'gnunet-testing.exe'
 
-pinfo = pexpect ()
+pinfo = pexpect()
 
 
 if os.name == "nt":
-  shutil.rmtree (os.path.join (os.getenv ("TEMP"), "gnunet-test-peerinfo"), True)
+    shutil.rmtree(os.path.join(os.getenv("TEMP"), "gnunet-test-peerinfo"), True)
 else:
-  shutil.rmtree ("/tmp/gnunet-test-peerinfo", True)
+    shutil.rmtree("/tmp/gnunet-test-peerinfo", True)
 
-# create hostkey via testing lib
-hkk = subprocess.Popen ([gnunettesting, '-n', '1', '-c', 'test_gnunet_peerinfo_data.conf', '-k', '/tmp/gnunet-test-peerinfo/.hostkey'])
-hkk.communicate ()
+# create hostkey via testing lib  # FIXME: The /tmp/ location needs to be adjusted to the TMP variable!
+hkk = subprocess.Popen([gnunettesting, '-n', '1', '-c', 'test_gnunet_peerinfo_data.conf', '-k', '/tmp/gnunet-test-peerinfo/.hostkey'])
+hkk.communicate()
 
-arm = subprocess.Popen ([gnunetarm, '-sq', '-c', 'test_gnunet_peerinfo_data.conf'])
-arm.communicate ()
+arm = subprocess.Popen([gnunetarm, '-sq', '-c', 'test_gnunet_peerinfo_data.conf'])
+arm.communicate()
 
 try:
-  pinfo.spawn (None, [peerinfo, '-c', 'test_gnunet_peerinfo_data.conf', '-s'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
-  pinfo.expect ("stdout", re.compile (r'I am peer `.*\'.\r?\n'))
+    pinfo.spawn(None, [peerinfo, '-c', 'test_gnunet_peerinfo_data.conf', '-s'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+    pinfo.expect("stdout", re.compile(r'I am peer `.*\'.\r?\n'))
 
-  pinfo.spawn (None, [peerinfo, '-c', 'test_gnunet_peerinfo_data.conf', '-qs'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
-  pinfo.expect ("stdout", re.compile (r'....................................................\r?\n'))
+    pinfo.spawn(None, [peerinfo, '-c', 'test_gnunet_peerinfo_data.conf', '-qs'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+    pinfo.expect("stdout", re.compile(r'....................................................\r?\n'))
 
-  pinfo.spawn (None, [peerinfo, '-c', 'test_gnunet_peerinfo_data.conf', 'invalid'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
-  pinfo.expect ("stdout", re.compile (r'Invalid command line argument `invalid\'\r?\n'))
+    pinfo.spawn(None, [peerinfo, '-c', 'test_gnunet_peerinfo_data.conf', 'invalid'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+    pinfo.expect("stdout", re.compile(r'Invalid command line argument `invalid\'\r?\n'))
 
-  arm = subprocess.Popen ([gnunetarm, '-q', '-i', 'transport', '-c', 'test_gnunet_peerinfo_data.conf'])
-  arm.communicate ()
-  time.sleep (1)
+    arm = subprocess.Popen([gnunetarm, '-q', '-i', 'transport', '-c', 'test_gnunet_peerinfo_data.conf'])
+    arm.communicate()
+    time.sleep(1)
 
-  pinfo.spawn (None, [peerinfo, '-i', '-c', 'test_gnunet_peerinfo_data.conf'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
-  pinfo.expect ("stdout", re.compile ("Peer `.*'\r?\n"))
-  m = pinfo.expect ("stdout", re.compile ("\s.*:24357\r?\n"))
-  while len (m.group (0)) > 0:
-    m = pinfo.expect ("stdout", re.compile ("(\s.*:24357\r?\n|\r?\n|)"))
+    pinfo.spawn(None, [peerinfo, '-i', '-c', 'test_gnunet_peerinfo_data.conf'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+    pinfo.expect("stdout", re.compile("Peer `.*'\r?\n"))
+    m = pinfo.expect("stdout", re.compile("\s.*:24357\r?\n"))
+    while len(m.group(0)) > 0:
+        m = pinfo.expect("stdout", re.compile("(\s.*:24357\r?\n|\r?\n|)"))
 
-  pinfo.spawn (None, [peerinfo, '-i', '-c', 'test_gnunet_peerinfo_data.conf', '-n'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
-  pinfo.expect ("stdout", re.compile ("Peer `.*'\r?\n"))
-  m = pinfo.expect ("stdout", re.compile ("\s.*:24357\r?\n"))
-  while len (m.group (0)) > 0:
-    m = pinfo.expect ("stdout", re.compile ("(\s.*:24357\r?\n|\r?\n|)"))
+    pinfo.spawn(None, [peerinfo, '-i', '-c', 'test_gnunet_peerinfo_data.conf', '-n'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+    pinfo.expect("stdout", re.compile("Peer `.*'\r?\n"))
+    m = pinfo.expect("stdout", re.compile("\s.*:24357\r?\n"))
+    while len(m.group(0)) > 0:
+        m = pinfo.expect("stdout", re.compile("(\s.*:24357\r?\n|\r?\n|)"))
 
-  pinfo.spawn (None, [peerinfo, '-c', 'test_gnunet_peerinfo_data.conf', '-qs'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
-  pid = pinfo.read ("stdout")
-  pid.strip ()
+    pinfo.spawn(None, [peerinfo, '-c', 'test_gnunet_peerinfo_data.conf', '-qs'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+    pid = pinfo.read("stdout")
+    pid.strip()
 
 finally:
-  arm = subprocess.Popen ([gnunetarm, '-eq', '-c', 'test_gnunet_peerinfo_data.conf'])
-  arm.communicate ()
-  if os.name == "nt":
-    shutil.rmtree (os.path.join (os.getenv ("TEMP"), "gnunet-test-peerinfo"), True)
-  else:
-    shutil.rmtree ("/tmp/gnunet-test-peerinfo", True)
+    arm = subprocess.Popen([gnunetarm, '-eq', '-c', 'test_gnunet_peerinfo_data.conf'])
+    arm.communicate()
+    if os.name == "nt":
+        shutil.rmtree(os.path.join(os.getenv("TEMP"), "gnunet-test-peerinfo"), True)
+    else:
+        shutil.rmtree("/tmp/gnunet-test-peerinfo", True)
diff --git a/src/peerinfo-tool/test_gnunet_peerinfo_data.conf b/src/peerinfo-tool/test_gnunet_peerinfo_data.conf
index 32b096809..d18d3cf96 100644
--- a/src/peerinfo-tool/test_gnunet_peerinfo_data.conf
+++ b/src/peerinfo-tool/test_gnunet_peerinfo_data.conf
@@ -1,4 +1,4 @@
-@INLINE@ ../../contrib/no_forcestart.conf
+@INLINE@ ../../contrib/conf/gnunet/no_forcestart.conf
 
 [PATHS]
 GNUNET_TEST_HOME = $GNUNET_TMP/gnunet-test-peerinfo/
diff --git a/src/psyc/test_psyc.conf b/src/psyc/test_psyc.conf
index 836255163..4e2563a8a 100644
--- a/src/psyc/test_psyc.conf
+++ b/src/psyc/test_psyc.conf
@@ -1,4 +1,4 @@
-@INLINE@ ../../contrib/no_forcestart.conf
+@INLINE@ ../../contrib/conf/gnunet/no_forcestart.conf
 
 [testbed]
 HOSTNAME = localhost
diff --git a/src/regex/test_regex_api_data.conf b/src/regex/test_regex_api_data.conf
index 8c87eeb96..60dcdc0b6 100644
--- a/src/regex/test_regex_api_data.conf
+++ b/src/regex/test_regex_api_data.conf
@@ -1,5 +1,5 @@
-@INLINE@ ../../contrib/no_forcestart.conf
-@INLINE@ ../../contrib/no_autostart_above_core.conf
+@INLINE@ ../../contrib/conf/gnunet/no_forcestart.conf
+@INLINE@ ../../contrib/conf/gnunet/no_autostart_above_core.conf
 
 [PATHS]
 GNUNET_TEST_HOME = $GNUNET_TMP/test-regex-api/
diff --git a/src/revocation/test_local_revocation.py.in b/src/revocation/test_local_revocation.py.in
index 28257715f..067091b58 100644
--- a/src/revocation/test_local_revocation.py.in
+++ b/src/revocation/test_local_revocation.py.in
@@ -1,6 +1,6 @@
 #!@PYTHON@
 #    This file is part of GNUnet.
-#    (C) 2010 Christian Grothoff (and other contributing authors)
+#    (C) 2010, 2018 Christian Grothoff (and other contributing authors)
 #
 #    GNUnet is free software; you can redistribute it and/or modify
 #    it under the terms of the GNU General Public License as published
@@ -26,90 +26,89 @@ import re
 import shutil
 
 if os.name == 'posix':
-  config = 'gnunet-config'
-  gnunetarm = 'gnunet-arm'
-  ident = 'gnunet-identity'
-  revoc = './gnunet-revocation'
+    config = 'gnunet-config'
+    gnunetarm = 'gnunet-arm'
+    ident = 'gnunet-identity'
+    revoc = './gnunet-revocation'
 elif os.name == 'nt':
-  config = 'gnunet-config.exe'
-  gnunetarm = 'gnunet-arm.exe'
-  ident = 'gnunet-identity.exe'
-  revoc = './gnunet-revocation.exe'
+    config = 'gnunet-config.exe'
+    gnunetarm = 'gnunet-arm.exe'
+    ident = 'gnunet-identity.exe'
+    revoc = './gnunet-revocation.exe'
 
 TEST_CONFIGURATION = "test_revocation.conf"
 TEST_REVOCATION_EGO = "revoc_test"
 
-
-get_clean = subprocess.Popen ([config, '-c', TEST_CONFIGURATION, '-s', 'PATHS', '-o', 'GNUNET_HOME', '-f'], stdout=subprocess.PIPE)
-cleandir, x = get_clean.communicate ()
+get_clean = subprocess.Popen([config, '-c', TEST_CONFIGURATION, '-s', 'PATHS', '-o', 'GNUNET_HOME', '-f'], stdout=subprocess.PIPE)
+cleandir, x = get_clean.communicate()
 cleandir = cleandir.decode("utf-8")
-cleandir = cleandir.rstrip ('\n').rstrip ('\r')
+cleandir = cleandir.rstrip('\n').rstrip('\r')
 
-if os.path.isdir (cleandir):
-  shutil.rmtree (cleandir, True)
+if os.path.isdir(cleandir):
+    shutil.rmtree(cleandir, True)
 
 res = 0
-arm = subprocess.Popen ([gnunetarm, '-s', '-c', TEST_CONFIGURATION])
-arm.communicate ()
+arm = subprocess.Popen([gnunetarm, '-s', '-c', TEST_CONFIGURATION])
+arm.communicate()
 
 try:
-  print ("Creating an ego " + TEST_REVOCATION_EGO)
-  sys.stdout.flush ()
-  sys.stderr.flush ()
-  idc = subprocess.Popen ([ident, '-C', TEST_REVOCATION_EGO, '-c', TEST_CONFIGURATION])
-  idc.communicate ()
-  if idc.returncode != 0:
-    raise Exception ("gnunet-identity failed to create an ego `" + TEST_REVOCATION_EGO + "'")
+    print("Creating an ego " + TEST_REVOCATION_EGO)
+    sys.stdout.flush()
+    sys.stderr.flush()
+    idc = subprocess.Popen([ident, '-C', TEST_REVOCATION_EGO, '-c', TEST_CONFIGURATION])
+    idc.communicate()
+    if idc.returncode != 0:
+        raise Exception("gnunet-identity failed to create an ego `" + TEST_REVOCATION_EGO + "'")
 
-  sys.stdout.flush ()
-  sys.stderr.flush ()
-  idd = subprocess.Popen ([ident, '-d'], stdout=subprocess.PIPE)
-  rev_key, x = idd.communicate ()
-  rev_key = rev_key.decode("utf-8")
-  if len (rev_key.split ()) < 3:
-    raise Exception ("can't get revocation key out of `" + rev_key + "'")
-  rev_key = rev_key.split ()[2]
+    sys.stdout.flush()
+    sys.stderr.flush()
+    idd = subprocess.Popen([ident, '-d'], stdout=subprocess.PIPE)
+    rev_key, x = idd.communicate()
+    rev_key = rev_key.decode("utf-8")
+    if len(rev_key.split()) < 3:
+        raise Exception("can't get revocation key out of `" + rev_key + "'")
+    rev_key = rev_key.split()[2]
 
-  print ("Testing key " + rev_key)
-  sys.stdout.flush ()
-  sys.stderr.flush ()
-  tst = subprocess.Popen ([revoc, '-t', rev_key, '-c', TEST_CONFIGURATION], stdout=subprocess.PIPE)
-  output_not_revoked, x = tst.communicate ()
-  output_not_revoked = output_not_revoked.decode("utf-8")
-  if tst.returncode != 0:
-    raise Exception ("gnunet-revocation failed to test a key - " + str (tst.returncode) + ": " + output_not_revoked)
-  if 'valid' not in output_not_revoked:
-    res = 1
-    print ("Key was not valid")
-  else:
-    print ("Key was valid")
+    print("Testing key " + rev_key)
+    sys.stdout.flush()
+    sys.stderr.flush()
+    tst = subprocess.Popen([revoc, '-t', rev_key, '-c', TEST_CONFIGURATION], stdout=subprocess.PIPE)
+    output_not_revoked, x = tst.communicate()
+    output_not_revoked = output_not_revoked.decode("utf-8")
+    if tst.returncode != 0:
+        raise Exception("gnunet-revocation failed to test a key - " + str(tst.returncode) + ": " + output_not_revoked)
+    if 'valid' not in output_not_revoked:
+        res = 1
+        print("Key was not valid")
+    else:
+        print("Key was valid")
 
-  print ("Revoking key " + rev_key)
-  sys.stdout.flush ()
-  sys.stderr.flush ()
-  rev = subprocess.Popen ([revoc, '-R', TEST_REVOCATION_EGO, '-p', '-c', TEST_CONFIGURATION])
-  rev.communicate ()
-  if rev.returncode != 0:
-    raise Exception ("gnunet-revocation failed to revoke a key")
+    print("Revoking key " + rev_key)
+    sys.stdout.flush()
+    sys.stderr.flush()
+    rev = subprocess.Popen([revoc, '-R', TEST_REVOCATION_EGO, '-p', '-c', TEST_CONFIGURATION])
+    rev.communicate()
+    if rev.returncode != 0:
+        raise Exception("gnunet-revocation failed to revoke a key")
 
-  print ("Testing revoked key " + rev_key)
-  sys.stdout.flush ()
-  sys.stderr.flush ()
-  tst = subprocess.Popen ([revoc, '-t', rev_key, '-c', TEST_CONFIGURATION], stdout=subprocess.PIPE)
-  output_revoked, x = tst.communicate ()
-  output_revoked = output_revoked.decode("utf-8")
-  if tst.returncode != 0:
-    raise Exception ("gnunet-revocation failed to test a revoked key")
-  if 'revoked' not in output_revoked:
-    res = 1
-    print ("Key was not revoked")
-  else:
-    print ("Key was revoked")
+    print("Testing revoked key " + rev_key)
+    sys.stdout.flush()
+    sys.stderr.flush()
+    tst = subprocess.Popen([revoc, '-t', rev_key, '-c', TEST_CONFIGURATION], stdout=subprocess.PIPE)
+    output_revoked, x = tst.communicate()
+    output_revoked = output_revoked.decode("utf-8")
+    if tst.returncode != 0:
+        raise Exception("gnunet-revocation failed to test a revoked key")
+    if 'revoked' not in output_revoked:
+        res = 1
+        print("Key was not revoked")
+    else:
+        print("Key was revoked")
 
 finally:
-  arm = subprocess.Popen ([gnunetarm, '-e', '-c', TEST_CONFIGURATION])
-  arm.communicate ()
-  if os.path.isdir (cleandir):
-    shutil.rmtree (cleandir, True)
+    arm = subprocess.Popen([gnunetarm, '-e', '-c', TEST_CONFIGURATION])
+    arm.communicate()
+    if os.path.isdir(cleandir):
+        shutil.rmtree(cleandir, True)
 
-sys.exit (res)
+sys.exit(res)
diff --git a/src/revocation/test_revocation.conf b/src/revocation/test_revocation.conf
index 1beeba931..14ecf6064 100644
--- a/src/revocation/test_revocation.conf
+++ b/src/revocation/test_revocation.conf
@@ -1,4 +1,4 @@
-@INLINE@ ../../contrib/no_forcestart.conf
+@INLINE@ ../../contrib/conf/gnunet/no_forcestart.conf
 
 [paths]
 GNUNET_HOME=$GNUNET_TMP/test-revocation-service
diff --git a/src/rps/test_rps.conf b/src/rps/test_rps.conf
index f171335d6..cf6b3150c 100644
--- a/src/rps/test_rps.conf
+++ b/src/rps/test_rps.conf
@@ -29,7 +29,7 @@ HOSTNAME = localhost
 # MAX_PARALLEL_TOPOLOGY_CONFIG_OPERATIONS = 100
 OVERLAY_TOPOLOGY = CLIQUE
 #OVERLAY_TOPOLOGY = SMALL_WORLD
-#SCALE_FREE_TOPOLOGY_CAP = 
+#SCALE_FREE_TOPOLOGY_CAP =
 
 # OVERLAY_RANDOM_LINKS = 25
 
@@ -74,6 +74,7 @@ DISABLE_TRY_CONNECT = YES
 [cadet]
 DISABLE_TRY_CONNECT = YES
 #OPTIONS=-l /tmp/rps_profiler_logs/cadet-[]-%Y-%m-%d.log
+#PREFIX = valgrind
 
 #[arm]
 #GLOBAL_POSTFIX=-l /tmp/rps_profiler_logs/other-[]-%Y-%m-%d.log
@@ -120,4 +121,3 @@ AUTOSTART = NO
 [fs]
 FORCESTART = NO
 AUTOSTART = NO
-
diff --git a/src/scalarproduct/test_scalarproduct.conf b/src/scalarproduct/test_scalarproduct.conf
index fca141108..c7e2b55f5 100644
--- a/src/scalarproduct/test_scalarproduct.conf
+++ b/src/scalarproduct/test_scalarproduct.conf
@@ -1,4 +1,4 @@
-@INLINE@ ../../contrib/no_forcestart.conf
+@INLINE@ ../../contrib/conf/gnunet/no_forcestart.conf
 
 [PATHS]
 GNUNET_TEST_HOME = $GNUNET_TMP/test-scalarproduct/
diff --git a/src/set/test_set.conf b/src/set/test_set.conf
index 58bd07773..02afd2ec5 100644
--- a/src/set/test_set.conf
+++ b/src/set/test_set.conf
@@ -1,4 +1,4 @@
-@INLINE@ ../../contrib/no_forcestart.conf
+@INLINE@ ../../contrib/conf/gnunet/no_forcestart.conf
 
 [PATHS]
 GNUNET_TEST_HOME = $GNUNET_TMP/test-gnunet-set/
diff --git a/src/social/test_social.conf b/src/social/test_social.conf
index 701789313..df9815fd2 100644
--- a/src/social/test_social.conf
+++ b/src/social/test_social.conf
@@ -1,4 +1,4 @@
-@INLINE@ ../../contrib/no_forcestart.conf
+@INLINE@ ../../contrib/conf/gnunet/no_forcestart.conf
 
 [PATHS]
 GNUNET_TEST_HOME = $GNUNET_TMP/gnunet-test-social/
diff --git a/src/statistics/test_gnunet_statistics.py.in b/src/statistics/test_gnunet_statistics.py.in
index 96714cf9a..64e66f238 100644
--- a/src/statistics/test_gnunet_statistics.py.in
+++ b/src/statistics/test_gnunet_statistics.py.in
@@ -8,7 +8,7 @@ import subprocess
 import time
 
 if os.name == "nt":
-    tmp = os.getenv ("TEMP")
+    tmp = os.getenv("TEMP")
 elif None != os.environ.get("TMPDIR"):
     tmp = os.getenv("TMPDIR")
 elif None != os.environ.get("TMP"):
@@ -17,136 +17,142 @@ else:
     tmp = "/tmp"
 
 if os.name == 'nt':
-  st = './gnunet-statistics.exe'
-  arm = 'gnunet-arm.exe'
+    st = './gnunet-statistics.exe'
+    arm = 'gnunet-arm.exe'
 else:
-  st = './gnunet-statistics'
-  arm = 'gnunet-arm'
+    st = './gnunet-statistics'
+    arm = 'gnunet-arm'
 
 run_st = [st, '-c', 'test_statistics_api_data.conf']
 run_arm = [arm, '-c', 'test_statistics_api_data.conf']
-debug = os.getenv ('DEBUG')
+debug = os.getenv('DEBUG')
 if debug:
-  run_arm += [debug.split (' ')]
-
-def cleanup ():
-  shutil.rmtree (os.path.join (tmp, "gnunet/test-gnunet-statistics"), True)
-
-def sub_run (args, want_stdo = True, want_stde = False, nofail = False):
-  if want_stdo:
-    stdo = subprocess.PIPE
-  else:
-    stdo = None
-  if want_stde:
-    stde = subprocess.PIPE
-  else:
-    stde = None
-  p = subprocess.Popen (args, stdout = stdo, stderr = stde)
-  stdo, stde = p.communicate ()
-  if not nofail:
-    if p.returncode != 0:
-      sys.exit (p.returncode)
-  return (p.returncode, stdo, stde)
-
-def fail (result):
-  print (result)
-  r_arm (['-e'], want_stdo = False)
-  sys.exit (1)
-
-def r_arm (extra_args, **kw):
-  rc, stdo, stde = sub_run (run_arm + extra_args, **kw)
-  if rc != 0:
-    fail ("FAIL: error running {}".format (run_arm))
-  return (rc, stdo, stde)
-
-def r_st (extra_args, normal = True, **kw):
-  rc, stdo, stde = sub_run (run_st + extra_args, **kw)
-  if normal:
+    run_arm += [debug.split(' ')]
+
+
+def cleanup():
+    shutil.rmtree(os.path.join(tmp, "gnunet/test-gnunet-statistics"), True)
+
+
+def sub_run(args, want_stdo=True, want_stde=False, nofail=False):
+    if want_stdo:
+        stdo = subprocess.PIPE
+    else:
+        stdo = None
+    if want_stde:
+        stde = subprocess.PIPE
+    else:
+        stde = None
+    p = subprocess.Popen(args, stdout=stdo, stderr=stde)
+    stdo, stde = p.communicate()
+    if not nofail:
+        if p.returncode != 0:
+            sys.exit(p.returncode)
+    return (p.returncode, stdo, stde)
+
+
+def fail(result):
+    print(result)
+    r_arm(['-e'], want_stdo=False)
+    sys.exit(1)
+
+
+def r_arm(extra_args, **kw):
+    rc, stdo, stde = sub_run(run_arm + extra_args, **kw)
     if rc != 0:
-      fail ("FAIL: error running {}".format (run_st))
-  else:
-    if rc == 0:
-      fail ("FAIL: expected error while running {}".format (run_st))
-  return (rc, stdo, stde)
-
-def restart ():
-  print ("Restarting service...")
-  t = r_arm (['-k', 'statistics'])
-  time.sleep (1)
-  t = r_arm (['-i', 'statistics'])
-  time.sleep (1)
-
-
-cleanup ()
-
-print ("Preparing: Starting service...")
-t = r_arm (['-s'], want_stdo = False)
-time.sleep (1)
-t = r_arm (['-i', 'statistics'], want_stdo = False)
-time.sleep (1)
-
-print ("TEST: Bad argument checking...", end='')
-r_st (['-x'], normal = False, nofail = True, want_stdo = False, want_stde = True)
-print ("PASS")
-
-print ("TEST: Set value...", end='')
-r_st (['-n', 'test', '-s', 'subsystem', b'42'], nofail = True, want_stdo = False)
-print ("PASS")
-
-print ("TEST: Set another value...", end='')
-r_st (['-n', 'other', '-s', 'osystem', b'43'], nofail = True, want_stdo = False)
-print ("PASS")
-
-print ("TEST: Viewing all stats...", end='')
-rc, stdo, stde = r_st ([], nofail = True, want_stdo = True)
-if len (stdo.splitlines ()) != 2:
-  fail ("FAIL: unexpected output:\n{}".format (stdo))
-print ("PASS")
-
-print ("TEST: Viewing stats by name...", end='')
-rc, stdo, stde = r_st (['-n', 'other'], nofail = True, want_stdo = True)
-if len ([x for x in stdo.splitlines () if re.search (b'43', x)]) != 1:
-  fail ("FAIL: unexpected output:\n{}".format (stdo))
-print ("PASS")
-
-print ("TEST: Viewing stats by subsystem...", end='')
-rc, stdo, stde = r_st (['-s', 'subsystem'], nofail = True, want_stdo = True)
-if len ([x for x in stdo.splitlines () if re.search (b'42', x)]) != 1:
-  fail ("FAIL: unexpected output:\n{}".format (stdo))
-print ("PASS")
-
-print ("TEST: Set persistent value...", end='')
-rc, stdo, stde = r_st (['-n', 'lasting', '-s', 'subsystem', '40', '-p'], nofail = True, want_stdo = False)
-rc, stdo, stde = r_st ([], nofail = True, want_stdo = True)
-if len ([x for x in stdo.splitlines () if re.search (b'40', x)]) != 1:
-  fail ("FAIL: unexpected output:\n{}".format (stdo))
-print ("PASS")
-
-restart ()
-
-print ("TEST: Checking persistence...", end='')
-rc, stdo, stde = r_st ([], nofail = True, want_stdo = True)
-if len ([x for x in stdo.splitlines () if re.search (b'40', x)]) != 1:
-  fail ("FAIL: unexpected output:\n{}".format (stdo))
-print ("PASS")
-
-print ("TEST: Removing persistence...", end='')
-rc, stdo, stde = r_st (['-n', 'lasting', '-s', 'subsystem', '40'], nofail = True, want_stdo = False)
-rc, stdo, stde = r_st ([], nofail = True, want_stdo = True)
-if len ([x for x in stdo.splitlines () if re.search (b'!', x)]) != 0:
-  fail ("FAIL: unexpected output:\n{}".format (stdo))
-print ("PASS")
-
-restart ()
-
-print ("TEST: Checking removed persistence...", end='')
-rc, stdo, stde = r_st ([], nofail = True, want_stdo = True)
-if len ([x for x in stdo.splitlines () if re.search (b'40', x)]) != 0:
-  fail ("FAIL: unexpected output:\n{}".format (stdo))
-print ("PASS")
-
-print ("Stopping service...")
-t = r_arm (['-e'], want_stdo = False)
-time.sleep (1)
-
-cleanup ()
+        fail("FAIL: error running {}".format(run_arm))
+    return (rc, stdo, stde)
+
+
+def r_st(extra_args, normal=True, **kw):
+    rc, stdo, stde = sub_run(run_st + extra_args, **kw)
+    if normal:
+        if rc != 0:
+            fail("FAIL: error running {}".format(run_st))
+    else:
+        if rc == 0:
+            fail("FAIL: expected error while running {}".format(run_st))
+    return (rc, stdo, stde)
+
+
+def restart():
+    print("Restarting service...")
+    t = r_arm(['-k', 'statistics'])
+    time.sleep(1)
+    t = r_arm(['-i', 'statistics'])
+    time.sleep(1)
+
+
+cleanup()
+
+print("Preparing: Starting service...")
+t = r_arm(['-s'], want_stdo=False)
+time.sleep(1)
+t = r_arm(['-i', 'statistics'], want_stdo=False)
+time.sleep(1)
+
+print("TEST: Bad argument checking...", end='')
+r_st(['-x'], normal=False, nofail=True, want_stdo=False, want_stde=True)
+print("PASS")
+
+print("TEST: Set value...", end='')
+r_st(['-n', 'test', '-s', 'subsystem', b'42'], nofail=True, want_stdo=False)
+print("PASS")
+
+print("TEST: Set another value...", end='')
+r_st(['-n', 'other', '-s', 'osystem', b'43'], nofail=True, want_stdo=False)
+print("PASS")
+
+print("TEST: Viewing all stats...", end='')
+rc, stdo, stde = r_st([], nofail=True, want_stdo=True)
+if len(stdo.splitlines()) != 2:
+    fail("FAIL: unexpected output:\n{}".format(stdo))
+print("PASS")
+
+print("TEST: Viewing stats by name...", end='')
+rc, stdo, stde = r_st(['-n', 'other'], nofail=True, want_stdo=True)
+if len([x for x in stdo.splitlines() if re.search(b'43', x)]) != 1:
+    fail("FAIL: unexpected output:\n{}".format(stdo))
+print("PASS")
+
+print("TEST: Viewing stats by subsystem...", end='')
+rc, stdo, stde = r_st(['-s', 'subsystem'], nofail=True, want_stdo=True)
+if len([x for x in stdo.splitlines() if re.search(b'42', x)]) != 1:
+    fail("FAIL: unexpected output:\n{}".format(stdo))
+print("PASS")
+
+print("TEST: Set persistent value...", end='')
+rc, stdo, stde = r_st(['-n', 'lasting', '-s', 'subsystem', '40', '-p'], nofail=True, want_stdo=False)
+rc, stdo, stde = r_st([], nofail=True, want_stdo=True)
+if len([x for x in stdo.splitlines() if re.search(b'40', x)]) != 1:
+    fail("FAIL: unexpected output:\n{}".format(stdo))
+print("PASS")
+
+restart()
+
+print("TEST: Checking persistence...", end='')
+rc, stdo, stde = r_st([], nofail=True, want_stdo=True)
+if len([x for x in stdo.splitlines() if re.search(b'40', x)]) != 1:
+    fail("FAIL: unexpected output:\n{}".format(stdo))
+print("PASS")
+
+print("TEST: Removing persistence...", end='')
+rc, stdo, stde = r_st(['-n', 'lasting', '-s', 'subsystem', '40'], nofail=True, want_stdo=False)
+rc, stdo, stde = r_st([], nofail=True, want_stdo=True)
+if len([x for x in stdo.splitlines() if re.search(b'!', x)]) != 0:
+    fail("FAIL: unexpected output:\n{}".format(stdo))
+print("PASS")
+
+restart()
+
+print("TEST: Checking removed persistence...", end='')
+rc, stdo, stde = r_st([], nofail=True, want_stdo=True)
+if len([x for x in stdo.splitlines() if re.search(b'40', x)]) != 0:
+    fail("FAIL: unexpected output:\n{}".format(stdo))
+print("PASS")
+
+print("Stopping service...")
+t = r_arm(['-e'], want_stdo=False)
+time.sleep(1)
+
+cleanup()
diff --git a/src/statistics/test_statistics_api_data.conf b/src/statistics/test_statistics_api_data.conf
index 9ef8d0673..d437c2aa8 100644
--- a/src/statistics/test_statistics_api_data.conf
+++ b/src/statistics/test_statistics_api_data.conf
@@ -1,5 +1,5 @@
-@INLINE@ ../../contrib/no_forcestart.conf
-@INLINE@ ../../contrib/no_autostart_above_core.conf
+@INLINE@ ../../contrib/conf/gnunet/no_forcestart.conf
+@INLINE@ ../../contrib/conf/gnunet/no_autostart_above_core.conf
 
 [PATHS]
 GNUNET_TEST_HOME = $GNUNET_TMP/test-gnunet-statistics/
diff --git a/src/testbed/buildvars.py.in b/src/testbed/buildvars.py.in
index 3ed65ad82..2a881b8f0 100644
--- a/src/testbed/buildvars.py.in
+++ b/src/testbed/buildvars.py.in
@@ -1,5 +1,5 @@
 # This file is part of GNUnet.
-# (C) 2008--2013 Christian Grothoff (and other contributing authors)
+# (C) 2008--2013, 2018 Christian Grothoff (and other contributing authors)
 #
 # GNUnet is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published
@@ -18,7 +18,7 @@
 
 
 # file:     testbed/buildvars.py
-# brief:    file for importing variables from build syste into python
+# brief:    file for importing variables from build system into python
 # author:   Sree Harsha Totakura
 
 import os
@@ -26,9 +26,10 @@ import os
 exec_prefix = '@exec_prefix@'
 libexecdir = '@libexecdir@'
 
-if libexecdir.startswith (exec_prefix):
-  libexecdir = libexecdir[len (exec_prefix):]
+if libexecdir.startswith(exec_prefix):
+    libexecdir = libexecdir[len(exec_prefix):]
 
-gnunet_prefix = os.environ.get ('GNUNET_PREFIX', None)
-if gnunet_prefix and libexecdir.startswith ('/'):
-  libexecdir = os.path.join (gnunet_prefix, libexecdir[1:])
+gnunet_prefix = os.environ.get('GNUNET_PREFIX', None)
+
+if gnunet_prefix and libexecdir.startswith('/'):
+    libexecdir = os.path.join(gnunet_prefix, libexecdir[1:])
diff --git a/src/testbed/test_testbed_api_template.conf b/src/testbed/test_testbed_api_template.conf
index 89f16ed67..049829842 100644
--- a/src/testbed/test_testbed_api_template.conf
+++ b/src/testbed/test_testbed_api_template.conf
@@ -1,5 +1,5 @@
-@INLINE@ ../../contrib/no_forcestart.conf
-@INLINE@ ../../contrib/no_autostart_above_core.conf
+@INLINE@ ../../contrib/conf/gnunet/no_forcestart.conf
+@INLINE@ ../../contrib/conf/gnunet/no_autostart_above_core.conf
 
 [testbed]
 AUTOSTART = NO
diff --git a/src/transport/test_transport_api_limited_sockets_tcp_peer1.conf b/src/transport/test_transport_api_limited_sockets_tcp_peer1.conf
index 9804f171e..e0ad5f847 100644
--- a/src/transport/test_transport_api_limited_sockets_tcp_peer1.conf
+++ b/src/transport/test_transport_api_limited_sockets_tcp_peer1.conf
@@ -1,5 +1,5 @@
 @INLINE@ template_cfg_peer1.conf
-@INLINE@ ../../contrib/no_autostart_above_core.conf
+@INLINE@ ../../contrib/conf/gnunet/no_autostart_above_core.conf
 [PATHS]
 GNUNET_TEST_HOME = $GNUNET_TMP/test-transport/api-tcp-p1/
 
diff --git a/src/transport/test_transport_api_limited_sockets_tcp_peer2.conf b/src/transport/test_transport_api_limited_sockets_tcp_peer2.conf
index 16dddf744..bb466abba 100644
--- a/src/transport/test_transport_api_limited_sockets_tcp_peer2.conf
+++ b/src/transport/test_transport_api_limited_sockets_tcp_peer2.conf
@@ -1,5 +1,5 @@
 @INLINE@ template_cfg_peer2.conf
-@INLINE@ ../../contrib/no_autostart_above_core.conf
+@INLINE@ ../../contrib/conf/gnunet/no_autostart_above_core.conf
 
 [PATHS]
 GNUNET_TEST_HOME = $GNUNET_TMP/test-transport/api-tcp-p2/
diff --git a/src/transport/test_transport_defaults.conf b/src/transport/test_transport_defaults.conf
index ddb523986..3f38eeab7 100644
--- a/src/transport/test_transport_defaults.conf
+++ b/src/transport/test_transport_defaults.conf
@@ -1,4 +1,4 @@
-@INLINE@ ../../contrib/no_forcestart.conf
+@INLINE@ ../../contrib/conf/gnunet/no_forcestart.conf
 
 [PATHS]
 GNUNET_TEST_HOME = $GNUNET_TMP/test-transport-api/
diff --git a/src/util/common_logging.c b/src/util/common_logging.c
index df501fbcd..ce9bd6e46 100644
--- a/src/util/common_logging.c
+++ b/src/util/common_logging.c
@@ -1344,14 +1344,15 @@ GNUNET_h2s_full (const struct GNUNET_HashCode * hc)
 const char *
 GNUNET_i2s (const struct GNUNET_PeerIdentity *pid)
 {
-  static char buf[256];
+  static char buf[5];
   char *ret;
 
   if (NULL == pid)
     return "NULL";
   ret = GNUNET_CRYPTO_eddsa_public_key_to_string (&pid->public_key);
-  strcpy (buf,
-          ret);
+  strncpy (buf,
+           ret,
+           sizeof (buf) - 1);
   GNUNET_free (ret);
   buf[4] = '\0';
   return buf;
@@ -1372,14 +1373,15 @@ GNUNET_i2s (const struct GNUNET_PeerIdentity *pid)
 const char *
 GNUNET_i2s2 (const struct GNUNET_PeerIdentity *pid)
 {
-  static char buf[256];
+  static char buf[5];
   char *ret;
 
   if (NULL == pid)
     return "NULL";
   ret = GNUNET_CRYPTO_eddsa_public_key_to_string (&pid->public_key);
-  strcpy (buf,
-          ret);
+  strncpy (buf,
+           ret,
+           sizeof (buf) - 1);
   GNUNET_free (ret);
   buf[4] = '\0';
   return buf;
diff --git a/src/util/crypto_bug.c b/src/util/crypto_bug.c
index c25e79c63..1c3e9225e 100644
--- a/src/util/crypto_bug.c
+++ b/src/util/crypto_bug.c
@@ -28,7 +28,7 @@
  * Enable work-around.  Will cause code to call #check_eddsa_key() to
  * see if we have a bad key, and if so, create a new one.
  */
-#define CRYPTO_BUG 1
+#define CRYPTO_BUG 0
 
 
 #if CRYPTO_BUG
diff --git a/src/util/crypto_ecc.c b/src/util/crypto_ecc.c
index 1abf0fddc..8d9091b23 100644
--- a/src/util/crypto_ecc.c
+++ b/src/util/crypto_ecc.c
@@ -1281,6 +1281,16 @@ eddsa_d_to_a (gcry_mpi_t d)
                  gcry_mpi_print (GCRYMPI_FMT_USG,
                                  rawmpi, rawmpilen, &rawmpilen,
                                  d));
+  if (rawmpilen < 32)
+  {
+    memmove (rawmpi + 32 - rawmpilen,
+             rawmpi,
+             rawmpilen);
+    memset (rawmpi,
+            0,
+            32 - rawmpilen);
+    rawmpilen = 32;
+  }
   hvec[0].data = digest;
   hvec[0].off = 0;
   hvec[0].len = b > rawmpilen ? (b - rawmpilen) : 0;
diff --git a/src/util/gnunet-qr.py.in b/src/util/gnunet-qr.py.in
index 549ce5af1..a5918fdf8 100755
--- a/src/util/gnunet-qr.py.in
+++ b/src/util/gnunet-qr.py.in
@@ -4,105 +4,106 @@ import getopt
 import subprocess
 from sys import argv
 try:
-        import zbar
+    import zbar
 except ImportError as e:
-        print('Cannot run gnunet-qr, please install zbar-python')
-        sys.exit (1)
+    print('Cannot run gnunet-qr, please install zbar-python')
+    sys.exit(1)
 
-def help ():
- print('gnunet-qr\n\
+
+def help():
+    print('gnunet-qr\n\
 Scan a QR code using a video device and import\n\
 Arguments mandatory for long options are also mandatory for short options.\n\
   -c, --config=FILENAME      use configuration file FILENAME\n\
   -d, --device=DEVICE        use device DEVICE\n\
   -s, --silent               do not show preview windows\n\
   -h, --help                 print this help\n\
-  -v, --verbose                                                  be verbose\n\
+  -v, --verbose              be verbose\n\
 Report bugs to gnunet-developers@gnu.org.\n\
 GNUnet home page: http://www.gnu.org/software/gnunet/\n\
 General help using GNU software: http://www.gnu.org/gethelp/')
 
 
 if __name__ == '__main__':
-        configuration = ''
-        device = '/dev/video0'
-        url = ''
-        verbose = False 
-        silent = False
-        # Parse arguments
-        try:
-                opts, args = getopt.gnu_getopt(sys.argv[1:], "c:hd:sv", ["config","help", "device","silent","verbose"])
-        except getopt.GetoptError as e:
-                help ()
-                print(str (e))
-                exit (1)
-        for o,a in opts:
-                if o in ("-h", "--help"):
-                        help ()            
-                        sys.exit (0)
-                elif o in ("-c", "--config"):
-                        configuration = a
-                elif o in ("-d", "--device"):
-                        device = a
-                elif o in ("-s", "--silent"):
-                        silent = True
-                elif o in ("-v", "--verbose"):
-                        verbose = True                  
-        if (True == verbose):
-                print('Initializing')
-        # create a Processor
-        proc = zbar.Processor()
+        configuration = ''
+        device = '/dev/video0'
+        url = ''
+        verbose = False
+        silent = False
+        # Parse arguments
+        try:
+                opts, args = getopt.gnu_getopt(sys.argv[1:], "c:hd:sv", ["config", "help", "device", "silent", "verbose"])
+        except getopt.GetoptError as e:
+                help()
+                print(str(e))
+                exit(1)
+        for o, a in opts:
+                if o in ("-h", "--help"):
+                        help()
+                        sys.exit(0)
+                elif o in ("-c", "--config"):
+                        configuration = a
+                elif o in ("-d", "--device"):
+                        device = a
+                elif o in ("-s", "--silent"):
+                        silent = True
+                elif o in ("-v", "--verbose"):
+                        verbose = True
+        if (True == verbose):
+                print('Initializing')
+        # create a Processor
+        proc = zbar.Processor()
+
+        # configure the Processor
+        proc.parse_config('enable')
+
+        # initialize the Processor
+        try:
+                if (True == verbose):
+                        print('Opening video device ' + device)
+                proc.init(device)
+        except Exception as e:
+                print('Failed to open device ' + device)
+                exit(1)
+
+        # enable the preview window
+        # if (True == silent):
+        #       proc.visible = True
+        # else:
+        #               proc.visible = False
+
+        proc.visible = True
+        # read at least one barcode (or until window closed)
+        try:
+                if (True == verbose):
+                        print('Capturing')
+                proc.process_one()
+        except Exception as e:
+                # Window was closed without finding code
+                exit(1)
 
-        # configure the Processor
-        proc.parse_config('enable')
+        # hide the preview window
+        proc.visible = False
 
-        # initialize the Processor
-        try:
-                if (True == verbose):
-                        print('Opening video device ' + device)
-                proc.init(device)
-        except Exception as e:
-                print('Failed to open device ' + device)
-                exit (1)
-        
-        # enable the preview window
-        #if (True == silent):
-        #       proc.visible = True
-        #else:
-        #               proc.visible = False
-        
-        proc.visible = True
-        # read at least one barcode (or until window closed)
-        try:
-                if (True == verbose):
-                        print('Capturing')
-                proc.process_one()
-        except Exception as e:
-                # Window was closed without finding code
-                exit (1)
-        
-        # hide the preview window
-        proc.visible = False
-        
-        # extract results
-        for symbol in proc.results:
-                # do something useful with results
-                if (True == verbose):
-                        print('Found ', symbol.type, ' symbol ', '"%s"' % symbol.data)
-                args = list()
-                args.append("gnunet-uri")
-                if (configuration != ''):
-                        args.append (str("-c " + str(configuration)))
-                args.append (str(symbol.data))
-                cmd = ''
-                for a in args:
-                        cmd += " " + str(a)
-                if (verbose):
-                        print('Running `' + cmd +'`')
-                res=subprocess.call(args)
-                if (0 != res):
-                        print('Failed to add URI ' + str(symbol.data))
-                else: 
-                        print('Added URI ' + str(symbol.data))
-                exit (res)
-        exit (1)
+        # extract results
+        for symbol in proc.results:
+                # do something useful with results
+                if (True == verbose):
+                        print('Found ', symbol.type, ' symbol ', '"%s"' % symbol.data)
+                args = list()
+                args.append("gnunet-uri")
+                if (configuration != ''):
+                        args.append(str("-c " + str(configuration)))
+                args.append(str(symbol.data))
+                cmd = ''
+                for a in args:
+                        cmd += " " + str(a)
+                if (verbose):
+                        print('Running `' + cmd +'`')
+                res=subprocess.call(args)
+                if (0 != res):
+                        print('Failed to add URI ' + str(symbol.data))
+                else:
+                        print('Added URI ' + str(symbol.data))
+                exit(res)
+        exit(1)
diff --git a/src/util/mq.c b/src/util/mq.c
index dbcce704d..81a42e0c6 100644
--- a/src/util/mq.c
+++ b/src/util/mq.c
@@ -1071,6 +1071,32 @@ GNUNET_MQ_set_options (struct GNUNET_MQ_Handle *mq,
 
 
 /**
+ * Obtain message contained in envelope.
+ *
+ * @param env the envelope
+ * @return message contained in the envelope
+ */
+const struct GNUNET_MessageHeader *
+GNUNET_MQ_env_get_msg (const struct GNUNET_MQ_Envelope *env)
+{
+  return env->mh;
+}
+
+
+/**
+ * Return next envelope in queue.
+ *
+ * @param env a queued envelope
+ * @return next one, or NULL
+ */
+const struct GNUNET_MQ_Envelope *
+GNUNET_MQ_env_next (const struct GNUNET_MQ_Envelope *env)
+{
+  return env->next;
+}
+
+
+/**
  * Register function to be called whenever @a mq is being
  * destroyed.
  *
diff --git a/src/util/resolver_api.c b/src/util/resolver_api.c
index 68f02587a..21f902578 100644
--- a/src/util/resolver_api.c
+++ b/src/util/resolver_api.c
@@ -515,8 +515,8 @@ handle_response (void *cls,
       if ( (NULL != rh->addr_callback) &&
            (GNUNET_SYSERR != rh->was_transmitted) )
           rh->addr_callback (rh->cls,
-                           NULL,
-                           0);
+                             NULL,
+                             0);
     }
     rh->was_transmitted = GNUNET_NO;
     GNUNET_RESOLVER_request_cancel (rh);
diff --git a/tox.ini b/tox.ini
index 090ac8f8e..c91f2de94 100644
--- a/tox.ini
+++ b/tox.ini
@@ -1,3 +1,4 @@
 [flake8]
 max-line-length = 160
-exclude = .git
\ No newline at end of file
+exclude = .git
+filename = *.py*
\ No newline at end of file