:Merge branch 'master' of ssh://gnunet.org/gnunet

22 files changed, 876 insertions, 302 deletions

diff --git a/debian/changelog b/debian/changelog
index 79aeb5ae9..a8888ff89 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,15 @@
+gnunet (0.14.1-8) unstable; urgency=low
+
+  * Allow configuration entry point to fall back to /etc/.
+
+ -- Florian Dold <florian@dold.me>  Thu, 29 Jul 2021 15:03:08 +0200
+
+gnunet (0.14.1-7) unstable; urgency=low
+
+  * Implement new configuration directives and diagnostics.
+
+ -- Florian Dold <florian@dold.me>  Wed, 28 Jul 2021 21:23:36 +0200
+
 gnunet (0.14.1-6) unstable; urgency=low
 
   * Fix path resolution of inlined config files.
diff --git a/src/ats-tests/Makefile.am b/src/ats-tests/Makefile.am
index 543fed287..d515d3e17 100644
--- a/src/ats-tests/Makefile.am
+++ b/src/ats-tests/Makefile.am
@@ -61,6 +61,7 @@ gnunet_ats_sim_SOURCES = \
 gnunet_ats_sim_LDADD = \
  $(top_builddir)/src/util/libgnunetutil.la \
  $(top_builddir)/src/ats-tests/libgnunetatstesting.la \
+ $(top_builddir)/src/testing/libgnunettesting.la \
  $(top_builddir)/src/testbed/libgnunettestbed.la \
  $(top_builddir)/src/ats/libgnunetats.la \
  $(top_builddir)/src/core/libgnunetcore.la \
diff --git a/src/consensus/Makefile.am b/src/consensus/Makefile.am
index 24e685fb9..cf1d32e74 100644
--- a/src/consensus/Makefile.am
+++ b/src/consensus/Makefile.am
@@ -40,6 +40,7 @@ gnunet_consensus_profiler_SOURCES = \
 gnunet_consensus_profiler_LDADD = \
   $(top_builddir)/src/util/libgnunetutil.la \
   libgnunetconsensus.la \
+  $(top_builddir)/src/testing/libgnunettesting.la \
   $(top_builddir)/src/testbed/libgnunettestbed.la \
   $(GN_LIBINTL)
 
diff --git a/src/dht/Makefile.am b/src/dht/Makefile.am
index 2182d1c7f..919eca438 100644
--- a/src/dht/Makefile.am
+++ b/src/dht/Makefile.am
@@ -112,6 +112,7 @@ gnunet_dht_profiler_LDADD = \
   libgnunetdht.la \
   $(top_builddir)/src/core/libgnunetcore.la \
   $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/testing/libgnunettesting.la \
  $(top_builddir)/src/testbed/libgnunettestbed.la
 gnunet_dht_profiler_LDFLAGS = \
   $(GN_LIBINTL)
diff --git a/src/fs/Makefile.am b/src/fs/Makefile.am
index 25590c6f7..2400d412e 100644
--- a/src/fs/Makefile.am
+++ b/src/fs/Makefile.am
@@ -105,6 +105,7 @@ endif
 gnunet_fs_profiler_SOURCES = \
  gnunet-fs-profiler.c
 gnunet_fs_profiler_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
   $(top_builddir)/src/testbed/libgnunettestbed.la \
   $(top_builddir)/src/util/libgnunetutil.la \
   $(GN_LIBINTL)
diff --git a/src/include/gnunet_configuration_lib.h b/src/include/gnunet_configuration_lib.h
index 68ed570a3..02e656196 100644
--- a/src/include/gnunet_configuration_lib.h
+++ b/src/include/gnunet_configuration_lib.h
@@ -113,6 +113,18 @@ GNUNET_CONFIGURATION_default (void);
 
 
 /**
+ * Return the filename of the default configuration filename
+ * that is used when no explicit configuration entry point
+ * has been specified.
+ *
+ * @returns NULL if no default configuration file can be located,
+ *          a newly allocated string otherwise
+ */
+char *
+GNUNET_CONFIGURATION_default_filename (void);
+
+
+/**
  * Parse a configuration file, add all of the options in the
  * file to the configuration environment.
  *
@@ -139,6 +151,19 @@ GNUNET_CONFIGURATION_serialize (const struct GNUNET_CONFIGURATION_Handle *cfg,
 
 
 /**
+ * Serializes the given configuration with diagnostics information.
+ * Diagnostics information will only be available if diagnostics
+ * have been enabled before parsing.
+ *
+ * @param cfg configuration to serialize
+ * @return the memory block where the serialized configuration is
+ *           present. This memory should be freed by the caller
+ */
+char *
+GNUNET_CONFIGURATION_serialize_diagnostics (const struct
+                                            GNUNET_CONFIGURATION_Handle *cfg);
+
+/**
  * De-serializes configuration
  *
  * @param cfg configuration to update
@@ -234,6 +259,16 @@ GNUNET_CONFIGURATION_parse_and_run (const char *filename,
                                     GNUNET_CONFIGURATION_Callback cb,
                                     void *cb_cls);
 
+/**
+ * Enable extra diagnostics.  Will produce more log output
+ * and allocate more memory.
+ *
+ * @param cfg configuration handle
+ */
+void
+GNUNET_CONFIGURATION_enable_diagnostics (struct
+                                         GNUNET_CONFIGURATION_Handle *cfg);
+
 
 /**
  * Function to iterate over options.
diff --git a/src/json/Makefile.am b/src/json/Makefile.am
index 3c19f96bf..2e97cecb9 100644
--- a/src/json/Makefile.am
+++ b/src/json/Makefile.am
@@ -13,7 +13,9 @@ libgnunetjson_la_LDFLAGS = \
   $(GN_LIBINTL) \
   -version-info 0:0:0 \
   -no-undefined
-libgnunetjson_la_CFLAGS = $(MHD_CFLAGS) $(AM_CFLAGS)
+libgnunetjson_la_CFLAGS = \
+  $(MHD_CFLAGS) \
+  $(AM_CFLAGS)
 libgnunetjson_la_SOURCES = \
   json.c \
   json_generator.c \
@@ -26,9 +28,6 @@ libgnunetjson_la_LIBADD = \
   $(MHD_LIBS) \
   $(XLIB) \
   $(Z_LIBS)
-libgnunetjson_la_DEPENDENCIES = \
-  $(top_builddir)/src/util/libgnunetutil.la
-
 
 check_PROGRAMS = \
   test_json \
diff --git a/src/json/json_pack.c b/src/json/json_pack.c
index 20db47cd4..d86baff41 100644
--- a/src/json/json_pack.c
+++ b/src/json/json_pack.c
@@ -109,7 +109,7 @@ GNUNET_JSON_pack_uint64 (const char *name,
   };
   
 #if JSON_INTEGER_IS_LONG_LONG
-  GNUNET_assert (num <= LONG_LONG_MAX);
+  GNUNET_assert (num <= LLONG_MAX);
 #else
   GNUNET_assert (num <= LONG_MAX);
 #endif
@@ -127,8 +127,8 @@ GNUNET_JSON_pack_int64 (const char *name,
   };
   
 #if JSON_INTEGER_IS_LONG_LONG
-  GNUNET_assert (num <= LONG_LONG_MAX);
-  GNUNET_assert (num >= LONG_LONG_MIN);
+  GNUNET_assert (num <= LLONG_MAX);
+  GNUNET_assert (num >= LLONG_MIN);
 #else
   GNUNET_assert (num <= LONG_MAX);
   GNUNET_assert (num >= LONG_MIN);
diff --git a/src/nse/Makefile.am b/src/nse/Makefile.am
index 85ae4d3be..824aa10d4 100644
--- a/src/nse/Makefile.am
+++ b/src/nse/Makefile.am
@@ -47,6 +47,7 @@ gnunet_nse_profiler_LDADD = -lm \
   libgnunetnse.la \
   $(top_builddir)/src/util/libgnunetutil.la \
   $(top_builddir)/src/statistics/libgnunetstatistics.la \
+  $(top_builddir)/src/testing/libgnunettesting.la \
   $(top_builddir)/src/testbed/libgnunettestbed.la \
   $(GN_LIBINTL)
 
diff --git a/src/regex/Makefile.am b/src/regex/Makefile.am
index 13413f242..0b55d134f 100644
--- a/src/regex/Makefile.am
+++ b/src/regex/Makefile.am
@@ -126,6 +126,7 @@ gnunet_regex_profiler_SOURCES = \
   gnunet-regex-profiler.c
 gnunet_regex_profiler_LDADD = -lm \
   $(top_builddir)/src/arm/libgnunetarm.la \
+  $(top_builddir)/src/testing/libgnunettesting.la \
   $(top_builddir)/src/testbed/libgnunettestbed.la \
   libgnunetregex_internal.a \
   $(top_builddir)/src/dht/libgnunetdht.la \
diff --git a/src/secretsharing/Makefile.am b/src/secretsharing/Makefile.am
index 787cfa0c1..9ae6e7892 100644
--- a/src/secretsharing/Makefile.am
+++ b/src/secretsharing/Makefile.am
@@ -24,6 +24,7 @@ gnunet_secretsharing_profiler_SOURCES = \
  gnunet-secretsharing-profiler.c
 gnunet_secretsharing_profiler_LDADD = \
   libgnunetsecretsharing.la \
+  $(top_builddir)/src/testing/libgnunettesting.la \
   $(top_builddir)/src/testbed/libgnunettestbed.la \
   $(top_builddir)/src/util/libgnunetutil.la \
   $(GN_LIBINTL)
diff --git a/src/testbed/Makefile.am b/src/testbed/Makefile.am
index 347d16007..b4b2cff97 100644
--- a/src/testbed/Makefile.am
+++ b/src/testbed/Makefile.am
@@ -76,6 +76,7 @@ gnunet_service_testbed_LDADD = $(XLIB) \
 gnunet_testbed_profiler_SOURCES = \
   gnunet-testbed-profiler.c
 gnunet_testbed_profiler_LDADD = $(XLIB) \
+ $(top_builddir)/src/testing/libgnunettesting.la \
  $(top_builddir)/src/util/libgnunetutil.la \
  libgnunettestbed.la
 gnunet_testbed_profiler_LDFLAGS = \
@@ -169,6 +170,7 @@ libgnunettestbed_la_LDFLAGS = \
 
 generate_underlay_topology_SOURCES = generate-underlay-topology.c
 generate_underlay_topology_LDADD = $(XLIB) \
+ $(top_builddir)/src/testing/libgnunettesting.la \
  $(top_builddir)/src/util/libgnunetutil.la \
  libgnunettestbed.la \
  $(LTLIBINTL) -lsqlite3
diff --git a/src/transport/Makefile.am b/src/transport/Makefile.am
index e19ebd8e9..55a338729 100644
--- a/src/transport/Makefile.am
+++ b/src/transport/Makefile.am
@@ -398,20 +398,20 @@ plugin_LTLIBRARIES = \
   $(HTTP_SERVER_PLUGIN_LA) \
   $(HTTPS_SERVER_PLUGIN_LA) \
   $(WLAN_PLUGIN_LA) \
-  $(BT_PLUGIN_LA) \
-  libgnunet_plugin_cmd_simple_send.la
-
-libgnunet_plugin_cmd_simple_send_la_SOURCES = \
- plugin_cmd_simple_send.c
-libgnunet_plugin_cmd_simple_send_la_LIBADD = \
-  $(top_builddir)/src/util/libgnunetutil.la \
-  $(top_builddir)/src/testing/libgnunettesting.la \
-  $(top_builddir)/src/statistics/libgnunetstatistics.la \
-  $(top_builddir)/src/testbed/libgnunettestbed.la \
-  libgnunettransporttesting2.la \
-  $(LTLIBINTL)
-libgnunet_plugin_cmd_simple_send_la_LDFLAGS = \
-  $(GN_PLUGIN_LDFLAGS)
+  $(BT_PLUGIN_LA) 
+#  libgnunet_plugin_cmd_simple_send.la
+
+#libgnunet_plugin_cmd_simple_send_la_SOURCES = \
+# plugin_cmd_simple_send.c
+#libgnunet_plugin_cmd_simple_send_la_LIBADD = \
+#  $(top_builddir)/src/util/libgnunetutil.la \
+#  $(top_builddir)/src/testing/libgnunettesting.la \
+#  $(top_builddir)/src/statistics/libgnunetstatistics.la \
+#  $(top_builddir)/src/testbed/libgnunettestbed.la \
+#  libgnunettransporttesting2.la \
+#  $(LTLIBINTL)
+#libgnunet_plugin_cmd_simple_send_la_LDFLAGS = \
+#  $(GN_PLUGIN_LDFLAGS)
 
 if HAVE_EXPERIMENTAL
 plugin_LTLIBRARIES += libgnunet_plugin_transport_udp.la
diff --git a/src/util/Makefile.am b/src/util/Makefile.am
index e720112be..89d040a0c 100644
--- a/src/util/Makefile.am
+++ b/src/util/Makefile.am
@@ -49,7 +49,6 @@ libgnunetutil_la_SOURCES = \
   common_endian.c \
   common_logging.c \
   configuration.c \
-  configuration_loader.c \
   consttime_memcmp.c \
   container_bloomfilter.c \
   container_heap.c \
@@ -243,11 +242,11 @@ gnunet_qr_LDADD = \
 gnunet_qr_LDFLAGS= -lzbar
 
 plugin_LTLIBRARIES = \
-  libgnunet_plugin_test.la
+  libgnunet_plugin_utiltest.la
 
-libgnunet_plugin_test_la_SOURCES = \
+libgnunet_plugin_utiltest_la_SOURCES = \
   test_plugin_plug.c
-libgnunet_plugin_test_la_LDFLAGS = \
+libgnunet_plugin_utiltest_la_LDFLAGS = \
  $(GN_PLUGIN_LDFLAGS)
 
 if HAVE_BENCHMARKS
diff --git a/src/util/configuration.c b/src/util/configuration.c
index 06938be67..e515c7c46 100644
--- a/src/util/configuration.c
+++ b/src/util/configuration.c
@@ -28,6 +28,8 @@
 #include "gnunet_os_lib.h"
 #include "gnunet_configuration_lib.h"
 #include "gnunet_disk_lib.h"
+#include "gnunet_buffer_lib.h"
+#include "gnunet_container_lib.h"
 
 #define LOG(kind, ...) GNUNET_log_from (kind, "util", __VA_ARGS__)
 
@@ -53,6 +55,16 @@ struct ConfigEntry
    * current, committed value
    */
   char *val;
+
+  /**
+   * Diagnostics information for the filename.
+   */
+  char *hint_filename;
+
+  /**
+   * Diagnostics information for the line number.
+   */
+  unsigned int hint_lineno;
 };
 
 
@@ -83,6 +95,54 @@ struct ConfigSection
    * directive, but the referenced file can't be found or accessed.
    */
   bool inaccessible;
+
+  /**
+   * Diagnostics hint for the secret file.
+   */
+  char *hint_secret_filename;
+
+  /**
+   * Extra information regarding permissions of the secret file.
+   */
+  char *hint_secret_stat;
+
+  /**
+   * For secret sections:  Where was this inlined from?
+   */
+  char *hint_inlined_from_filename;
+
+  /**
+   * For secret sections:  Where was this inlined from?
+   */
+  unsigned int hint_inlined_from_line;
+};
+
+struct ConfigFile
+{
+  /**
+   * Source filename.
+   */
+  char *source_filename;
+
+  /**
+   * Level in the tree of loaded config files.
+   */
+  unsigned int level;
+
+  struct ConfigFile *prev;
+
+  struct ConfigFile *next;
+
+  /**
+   * Was this configuration file parsed via
+   * @inline-secret@?
+   */
+  char *hint_restrict_section;
+
+  /**
+   * Was this configuration file inaccessible?
+   */
+  bool hint_inaccessible;
 };
 
 
@@ -97,6 +157,26 @@ struct GNUNET_CONFIGURATION_Handle
   struct ConfigSection *sections;
 
   /**
+   * Linked list of loaded files.
+   */
+  struct ConfigFile *loaded_files_head;
+
+  /**
+   * Linked list of loaded files.
+   */
+  struct ConfigFile *loaded_files_tail;
+
+  /**
+   * Current nesting level of file loading.
+   */
+  unsigned int current_nest_level;
+
+  /**
+   * Enable diagnostics.
+   */
+  bool diagnostics;
+
+  /**
    * Modification indication since last save
    * #GNUNET_NO if clean, #GNUNET_YES if dirty,
    * #GNUNET_SYSERR on error (i.e. last save failed)
@@ -104,9 +184,21 @@ struct GNUNET_CONFIGURATION_Handle
   enum GNUNET_GenericReturnValue dirty;
 
   /**
+   * Was the configuration ever loaded via GNUNET_CONFIGURATION_load?
+   */
+  bool load_called;
+
+  /**
    * Name of the entry point configuration file.
    */
   char *main_filename;
+
+  /**
+   * When parsing into this configuration, and this value
+   * is non-NULL, only parse sections of the same name,
+   * and ban import statements.
+   */
+  const char *restrict_section;
 };
 
 
@@ -122,6 +214,14 @@ struct DiffHandle
 };
 
 
+void
+GNUNET_CONFIGURATION_enable_diagnostics (struct
+                                         GNUNET_CONFIGURATION_Handle *cfg)
+{
+  cfg->diagnostics = true;
+}
+
+
 struct GNUNET_CONFIGURATION_Handle *
 GNUNET_CONFIGURATION_create ()
 {
@@ -211,9 +311,18 @@ void
 GNUNET_CONFIGURATION_destroy (struct GNUNET_CONFIGURATION_Handle *cfg)
 {
   struct ConfigSection *sec;
+  struct ConfigFile *cf;
 
   while (NULL != (sec = cfg->sections))
     GNUNET_CONFIGURATION_remove_section (cfg, sec->name);
+  while (NULL != (cf = cfg->loaded_files_head))
+  {
+    GNUNET_free (cf->hint_restrict_section);
+    GNUNET_free (cf->source_filename);
+    GNUNET_CONTAINER_DLL_remove (cfg->loaded_files_head,
+                                 cfg->loaded_files_tail,
+                                 cf);
+  }
   GNUNET_free (cfg);
 }
 
@@ -240,14 +349,19 @@ GNUNET_CONFIGURATION_parse_and_run (const char *filename,
 
 
 /**
- * Closure to inline_glob_cb.
+ * Closure to collect_files_cb.
  */
-struct InlineGlobClosure
+struct CollectFilesContext
 {
   /**
-   * Configuration to read inlined configuration into.
+   * Collected files from globbing.
    */
-  struct GNUNET_CONFIGURATION_Handle *cfg;
+  char **files;
+
+  /**
+   * Size of the files array.
+   */
+  unsigned int files_length;
 };
 
 
@@ -261,21 +375,14 @@ struct InlineGlobClosure
  *  #GNUNET_SYSERR to abort iteration with error!
  */
 static int
-inline_glob_cb (void *cls,
-                const char *filename)
+collect_files_cb (void *cls,
+                  const char *filename)
 {
-  struct InlineGlobClosure *igc = cls;
+  struct CollectFilesContext *igc = cls;
 
-  LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "Reading globbed config file '%s'\n",
-       filename);
-
-  if (GNUNET_OK !=
-      GNUNET_CONFIGURATION_parse (igc->cfg,
-                                  filename))
-  {
-    return GNUNET_SYSERR;
-  }
+  GNUNET_array_append (igc->files,
+                       igc->files_length,
+                       GNUNET_strdup (filename));
   return GNUNET_OK;
 }
 
@@ -300,24 +407,10 @@ find_section (const struct GNUNET_CONFIGURATION_Handle *cfg,
 }
 
 
-static void
-set_section_inaccessible (struct GNUNET_CONFIGURATION_Handle *cfg,
-                          const char *section)
+static int
+pstrcmp (const void *a, const void *b)
 {
-  struct ConfigSection *sec;
-
-  sec = find_section (cfg, section);
-
-  if (NULL == sec)
-  {
-    sec = GNUNET_new (struct ConfigSection);
-    sec->name = GNUNET_strdup (section);
-    sec->next = cfg->sections;
-    cfg->sections = sec;
-    sec->entries = NULL;
-  }
-
-  sec->inaccessible = true;
+  return strcmp (*((const char **) a), *((const char **) b));
 }
 
 
@@ -331,9 +424,17 @@ handle_inline (struct GNUNET_CONFIGURATION_Handle *cfg,
                const char *path_or_glob,
                bool path_is_glob,
                const char *restrict_section,
-               const char *source_filename)
+               const char *source_filename,
+               unsigned int source_lineno)
 {
   char *inline_path;
+  struct GNUNET_CONFIGURATION_Handle *other_cfg = NULL;
+  struct CollectFilesContext igc = {
+    .files = NULL,
+    .files_length = 0,
+  };
+  enum GNUNET_GenericReturnValue fun_ret;
+  unsigned int old_nest_level = cfg->current_nest_level++;
 
   /* We support the section restriction only for non-globs */
   GNUNET_assert (! (path_is_glob && (NULL != restrict_section)));
@@ -343,8 +444,10 @@ handle_inline (struct GNUNET_CONFIGURATION_Handle *cfg,
     LOG (GNUNET_ERROR_TYPE_DEBUG,
          "Refusing to parse inline configurations, "
          "not allowed without source filename!\n");
-    return GNUNET_SYSERR;
+    fun_ret = GNUNET_SYSERR;
+    goto cleanup;
   }
+
   if ('/' == *path_or_glob)
     inline_path = GNUNET_strdup (path_or_glob);
   else
@@ -362,7 +465,8 @@ handle_inline (struct GNUNET_CONFIGURATION_Handle *cfg,
       /* Couldn't even resolve path of base dir. */
       GNUNET_break (0);
       /* failed to parse included config */
-      return GNUNET_SYSERR;
+      fun_ret = GNUNET_SYSERR;
+      goto cleanup;
     }
     endsep = strrchr (source_realpath, '/');
     GNUNET_assert (NULL != endsep);
@@ -373,46 +477,113 @@ handle_inline (struct GNUNET_CONFIGURATION_Handle *cfg,
                      path_or_glob);
     free (source_realpath);
   }
+
   if (path_is_glob)
   {
     int nret;
-    struct InlineGlobClosure igc = {
-      .cfg = cfg,
-    };
 
     LOG (GNUNET_ERROR_TYPE_DEBUG,
          "processing config glob '%s'\n",
          inline_path);
 
-    nret = GNUNET_DISK_glob (inline_path, inline_glob_cb, &igc);
+    nret = GNUNET_DISK_glob (inline_path, collect_files_cb, &igc);
     if (-1 == nret)
     {
-      GNUNET_free (inline_path);
-      return GNUNET_SYSERR;
+      fun_ret = GNUNET_SYSERR;
+      goto cleanup;
+    }
+    GNUNET_assert (nret == igc.files_length);
+    qsort (igc.files, igc.files_length, sizeof (char *), pstrcmp);
+    for (int i = 0; i < nret; i++)
+    {
+      if (GNUNET_OK !=
+          GNUNET_CONFIGURATION_parse (cfg,
+                                      igc.files[i]))
+      {
+        fun_ret = GNUNET_SYSERR;
+        goto cleanup;
+      }
     }
+    fun_ret = GNUNET_OK;
   }
   else if (NULL != restrict_section)
   {
-    struct GNUNET_CONFIGURATION_Handle *other_cfg;
-    enum GNUNET_GenericReturnValue fret;
+    enum GNUNET_GenericReturnValue inner_ret;
     struct ConfigSection *cs;
+    struct ConfigFile *cf = GNUNET_new (struct ConfigFile);
 
-    fret = GNUNET_DISK_file_test_read (inline_path);
+    inner_ret = GNUNET_DISK_file_test_read (inline_path);
 
-    if (GNUNET_OK != fret)
+    cs = find_section (cfg, restrict_section);
+
+    if (NULL == cs)
     {
-      set_section_inaccessible (cfg, restrict_section);
-      GNUNET_free (inline_path);
-      return GNUNET_OK;
+      cs = GNUNET_new (struct ConfigSection);
+      cs->name = GNUNET_strdup (restrict_section);
+      cs->next = cfg->sections;
+      cfg->sections = cs;
+      cs->entries = NULL;
+    }
+    if (cfg->diagnostics)
+    {
+      char *sfn = GNUNET_STRINGS_filename_expand (inline_path);
+      struct stat istat;
+
+      cs->hint_secret_filename = sfn;
+      if (0 == stat (sfn, &istat))
+      {
+        struct passwd *pw = getpwuid (istat.st_uid);
+        struct group *gr = getgrgid (istat.st_gid);
+        char *pwname = (NULL == pw) ? "<unknown>" : pw->pw_name;
+        char *grname = (NULL == gr) ? "<unknown>" : gr->gr_name;
+
+        GNUNET_asprintf (&cs->hint_secret_stat,
+                         "%s:%s %o",
+                         pwname,
+                         grname,
+                         istat.st_mode);
+      }
+      else
+      {
+        cs->hint_secret_stat = GNUNET_strdup ("<can't stat file>");
+      }
+      if (source_filename)
+      {
+        /* Possible that this secret section has been inlined before */
+        GNUNET_free (cs->hint_inlined_from_filename);
+        cs->hint_inlined_from_filename = GNUNET_strdup (source_filename);
+        cs->hint_inlined_from_line = source_lineno;
+      }
+    }
+
+    /* Put file in the load list for diagnostics, even if we can't access it. */
+    {
+      cf->level = cfg->current_nest_level;
+      cf->source_filename = GNUNET_strdup (inline_path);
+      cf->hint_restrict_section = GNUNET_strdup (restrict_section);
+      GNUNET_CONTAINER_DLL_insert_tail (cfg->loaded_files_head,
+                                        cfg->loaded_files_tail,
+                                        cf);
+    }
+
+    if (GNUNET_OK != inner_ret)
+    {
+      cs->inaccessible = true;
+      cf->hint_inaccessible = true;
+      /* File can't be accessed, but that's okay. */
+      fun_ret = GNUNET_OK;
+      goto cleanup;
     }
 
     other_cfg = GNUNET_CONFIGURATION_create ();
-    if (GNUNET_OK != GNUNET_CONFIGURATION_parse (other_cfg,
-                                                 inline_path))
+    other_cfg->restrict_section = restrict_section;
+    inner_ret = GNUNET_CONFIGURATION_parse (other_cfg,
+                                            inline_path);
+    if (GNUNET_OK != inner_ret)
     {
-      GNUNET_free (inline_path);
-      GNUNET_CONFIGURATION_destroy (other_cfg);
-      return GNUNET_SYSERR;
+      cf->hint_inaccessible = true;
+      fun_ret = inner_ret;
+      goto cleanup;
     }
 
     cs = find_section (other_cfg, restrict_section);
@@ -422,9 +593,8 @@ handle_inline (struct GNUNET_CONFIGURATION_Handle *cfg,
            "inlined configuration '%s' does not contain section '%s'\n",
            inline_path,
            restrict_section);
-      GNUNET_free (inline_path);
-      GNUNET_free (other_cfg);
-      return GNUNET_SYSERR;
+      fun_ret = GNUNET_SYSERR;
+      goto cleanup;
     }
     for (struct ConfigEntry *ce = cs->entries;
          NULL != ce;
@@ -433,17 +603,92 @@ handle_inline (struct GNUNET_CONFIGURATION_Handle *cfg,
                                              restrict_section,
                                              ce->key,
                                              ce->val);
-    GNUNET_CONFIGURATION_destroy (other_cfg);
+    fun_ret = GNUNET_OK;
   }
   else if (GNUNET_OK !=
            GNUNET_CONFIGURATION_parse (cfg,
                                        inline_path))
   {
-    GNUNET_free (inline_path);
-    return GNUNET_SYSERR;
+    fun_ret = GNUNET_SYSERR;
+    goto cleanup;
   }
+  else
+  {
+    fun_ret = GNUNET_OK;
+  }
+cleanup:
+  cfg->current_nest_level = old_nest_level;
+  if (NULL != other_cfg)
+    GNUNET_CONFIGURATION_destroy (other_cfg);
   GNUNET_free (inline_path);
-  return GNUNET_OK;
+  if (igc.files_length > 0)
+  {
+    for (size_t i = 0; i < igc.files_length; i++)
+      GNUNET_free (igc.files[i]);
+    GNUNET_array_grow (igc.files, igc.files_length, 0);
+  }
+  return fun_ret;
+}
+
+
+/**
+ * Find an entry from a configuration.
+ *
+ * @param cfg handle to the configuration
+ * @param section section the option is in
+ * @param key the option
+ * @return matching entry, NULL if not found
+ */
+static struct ConfigEntry *
+find_entry (const struct GNUNET_CONFIGURATION_Handle *cfg,
+            const char *section,
+            const char *key)
+{
+  struct ConfigSection *sec;
+  struct ConfigEntry *pos;
+
+  if (NULL == (sec = find_section (cfg, section)))
+    return NULL;
+  if (sec->inaccessible)
+  {
+    LOG (GNUNET_ERROR_TYPE_WARNING,
+         "Section '%s' is marked as inaccessible, because the configuration "
+         " file that contains the section can't be read.  Attempts to use "
+         "option '%s' will fail.\n",
+         section,
+         key);
+    return NULL;
+  }
+  pos = sec->entries;
+  while ((pos != NULL) && (0 != strcasecmp (key, pos->key)))
+    pos = pos->next;
+  return pos;
+}
+
+
+/**
+ * Set a configuration hint.
+ *
+ * @param cfg configuration handle
+ * @param section section
+ * @param option config option
+ * @param hint_filename
+ * @param hint_line
+ */
+static void
+set_entry_hint (struct GNUNET_CONFIGURATION_Handle *cfg,
+                const char *section,
+                const char *option,
+                const char *hint_filename,
+                unsigned int hint_line)
+{
+  struct ConfigEntry *e = find_entry (cfg, section, option);
+  if (! cfg->diagnostics)
+    return;
+  if (! e)
+    return;
+  e->hint_filename = GNUNET_strdup (hint_filename);
+  e->hint_lineno = hint_line;
 }
 
 
@@ -530,6 +775,17 @@ GNUNET_CONFIGURATION_deserialize (struct GNUNET_CONFIGURATION_Handle *cfg,
       char *directive;
       enum GNUNET_GenericReturnValue directive_ret;
 
+      if (NULL != cfg->restrict_section)
+      {
+        LOG (GNUNET_ERROR_TYPE_WARNING,
+             _ (
+               "Illegal directive in line %u (parsing restricted section %s)\n"),
+             nr,
+             cfg->restrict_section);
+        ret = GNUNET_SYSERR;
+        break;
+      }
+
       if (NULL == end)
       {
         LOG (GNUNET_ERROR_TYPE_WARNING,
@@ -553,7 +809,8 @@ GNUNET_CONFIGURATION_deserialize (struct GNUNET_CONFIGURATION_Handle *cfg,
                                        path,
                                        false,
                                        NULL,
-                                       source_filename);
+                                       source_filename,
+                                       nr);
       }
       else if (0 == strcasecmp (directive, "INLINE-MATCHING"))
       {
@@ -567,7 +824,8 @@ GNUNET_CONFIGURATION_deserialize (struct GNUNET_CONFIGURATION_Handle *cfg,
                                        path,
                                        true,
                                        NULL,
-                                       source_filename);
+                                       source_filename,
+                                       nr);
       }
       else if (0 == strcasecmp (directive, "INLINE-SECRET"))
       {
@@ -600,7 +858,8 @@ GNUNET_CONFIGURATION_deserialize (struct GNUNET_CONFIGURATION_Handle *cfg,
                                        path,
                                        false,
                                        secname,
-                                       source_filename);
+                                       source_filename,
+                                       nr);
       }
       else
       {
@@ -613,11 +872,7 @@ GNUNET_CONFIGURATION_deserialize (struct GNUNET_CONFIGURATION_Handle *cfg,
       }
       if (GNUNET_OK != directive_ret)
       {
-        LOG (GNUNET_ERROR_TYPE_WARNING,
-             _ ("Bad directive '%s' in line %u\n"),
-             directive,
-             nr);
-        ret = GNUNET_SYSERR;
+        ret = directive_ret;
         break;
       }
       continue;
@@ -660,6 +915,14 @@ GNUNET_CONFIGURATION_deserialize (struct GNUNET_CONFIGURATION_Handle *cfg,
         value++;
       }
       GNUNET_CONFIGURATION_set_value_string (cfg, section, tag, &value[i]);
+      if (cfg->diagnostics)
+      {
+        set_entry_hint (cfg,
+                        section,
+                        tag,
+                        source_filename ? source_filename : "<input>",
+                        nr);
+      }
       GNUNET_free (tag);
       continue;
     }
@@ -694,6 +957,55 @@ GNUNET_CONFIGURATION_parse (struct GNUNET_CONFIGURATION_Handle *cfg,
   LOG (GNUNET_ERROR_TYPE_DEBUG, "Asked to parse config file `%s'\n", fn);
   if (NULL == fn)
     return GNUNET_SYSERR;
+
+
+  /* Check for cycles */
+  {
+    unsigned int lvl = cfg->current_nest_level;
+    struct ConfigFile *cf = cfg->loaded_files_tail;
+    struct ConfigFile *parent = NULL;
+
+
+    for (; NULL != cf; parent = cf, cf = cf->prev)
+    {
+      /* Check parents based on level, skipping children of siblings. */
+      if (cf->level >= lvl)
+        continue;
+      lvl = cf->level;
+      if ( (NULL == cf->source_filename) || (NULL == filename))
+        continue;
+      if (0 == strcmp (cf->source_filename, filename))
+      {
+        if (NULL == parent)
+        {
+          LOG (GNUNET_ERROR_TYPE_ERROR,
+               "Forbidden direct cyclic configuration import (%s -> %s)\n",
+               cf->source_filename,
+               filename);
+        }
+        else
+          LOG (GNUNET_ERROR_TYPE_ERROR,
+               "Forbidden indirect cyclic configuration import (%s -> ... -> %s -> %s)\n",
+               cf->source_filename,
+               parent->source_filename,
+               filename);
+        return GNUNET_SYSERR;
+      }
+    }
+
+  }
+
+  /* Keep track of loaded files.*/
+  {
+    struct ConfigFile *cf = GNUNET_new (struct ConfigFile);
+
+    cf->level = cfg->current_nest_level;
+    cf->source_filename = GNUNET_strdup (filename ? filename : "<input>");
+    GNUNET_CONTAINER_DLL_insert_tail (cfg->loaded_files_head,
+                                      cfg->loaded_files_tail,
+                                      cf);
+  }
+
   dirty = cfg->dirty; /* back up value! */
   if (GNUNET_SYSERR ==
       GNUNET_DISK_file_size (fn, &fs64, GNUNET_YES, GNUNET_YES))
@@ -725,7 +1037,7 @@ GNUNET_CONFIGURATION_parse (struct GNUNET_CONFIGURATION_Handle *cfg,
                                           mem,
                                           fs,
                                           fn);
-  if (GNUNET_OK != ret)
+  if (GNUNET_SYSERR == ret)
   {
     GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                 _ ("Failed to parse configuration file `%s'\n"),
@@ -799,6 +1111,8 @@ GNUNET_CONFIGURATION_serialize (const struct GNUNET_CONFIGURATION_Handle *cfg,
        NULL != sec;
        sec = sec->next)
   {
+    if (sec->inaccessible)
+      continue;
     /* For each section we need to add 3 characters: {'[',']','\n'} */
     m_size += strlen (sec->name) + 3;
     for (struct ConfigEntry *ent = sec->entries;
@@ -878,6 +1192,117 @@ GNUNET_CONFIGURATION_serialize (const struct GNUNET_CONFIGURATION_Handle *cfg,
 }
 
 
+char *
+GNUNET_CONFIGURATION_serialize_diagnostics (const struct
+                                            GNUNET_CONFIGURATION_Handle *cfg)
+{
+  struct GNUNET_Buffer buf = { 0 };
+
+  GNUNET_buffer_write_fstr (&buf,
+                            "#\n# Configuration file diagnostics\n#\n");
+  GNUNET_buffer_write_fstr (&buf,
+                            "# Entry point: %s\n",
+                            cfg->main_filename ? cfg->main_filename :
+                            "<none>");
+  GNUNET_buffer_write_fstr (&buf,
+                            "#\n# Files Loaded:\n");
+
+  for (struct ConfigFile *cfil = cfg->loaded_files_head;
+       NULL != cfil;
+       cfil = cfil->next)
+  {
+    GNUNET_buffer_write_fstr (&buf,
+                              "# ");
+    for (unsigned int i = 0; i < cfil->level; i++)
+      GNUNET_buffer_write_fstr (&buf,
+                                "+");
+    if (0 != cfil->level)
+      GNUNET_buffer_write_fstr (&buf,
+                                " ");
+
+    GNUNET_buffer_write_fstr (&buf,
+                              "%s",
+                              cfil->source_filename);
+
+    if (NULL != cfil->hint_restrict_section)
+      GNUNET_buffer_write_fstr (&buf,
+                                " (%s secret section %s)",
+                                cfil->hint_inaccessible
+                                  ? "inaccessible"
+                                  : "loaded",
+                                cfil->hint_restrict_section);
+
+    GNUNET_buffer_write_str (&buf,
+                             "\n");
+  }
+
+  GNUNET_buffer_write_fstr (&buf,
+                            "#\n\n");
+
+  for (struct ConfigSection *sec = cfg->sections;
+       NULL != sec;
+       sec = sec->next)
+  {
+    if (sec->hint_secret_filename)
+      GNUNET_buffer_write_fstr (&buf,
+                                "# secret section from %s\n# secret file stat %s\n",
+                                sec->hint_secret_filename,
+                                sec->hint_secret_stat);
+    if (sec->hint_inlined_from_filename)
+    {
+      GNUNET_buffer_write_fstr (&buf,
+                                "# inlined from %s:%u\n",
+                                sec->hint_inlined_from_filename,
+                                sec->hint_inlined_from_line);
+    }
+    GNUNET_buffer_write_fstr (&buf,
+                              "[%s]\n\n",
+                              sec->name);
+    if (sec->inaccessible)
+    {
+      GNUNET_buffer_write_fstr (&buf,
+                                "# <section contents inaccessible>\n\n\n");
+      continue;
+    }
+    for (struct ConfigEntry *ent = sec->entries;
+         NULL != ent;
+         ent = ent->next)
+    {
+      if (do_skip (sec->name,
+                   ent->key))
+        continue;
+      if (NULL != ent->val)
+      {
+        char *pos;
+        char *val = GNUNET_malloc (strlen (ent->val) * 2 + 1);
+        strcpy (val, ent->val);
+        while (NULL != (pos = strstr (val, "\n")))
+        {
+          memmove (&pos[2], &pos[1], strlen (&pos[1]));
+          pos[0] = '\\';
+          pos[1] = 'n';
+        }
+        if (NULL != ent->hint_filename)
+        {
+          GNUNET_buffer_write_fstr (&buf,
+                                    "# %s:%u\n",
+                                    ent->hint_filename,
+                                    ent->hint_lineno);
+        }
+        GNUNET_buffer_write_fstr (&buf,
+                                  "%s = %s\n",
+                                  ent->key,
+                                  val);
+        GNUNET_free (val);
+      }
+      GNUNET_buffer_write_str (&buf, "\n");
+    }
+    GNUNET_buffer_write_str (&buf, "\n");
+  }
+  return GNUNET_buffer_reap_str (&buf);
+}
+
+
 enum GNUNET_GenericReturnValue
 GNUNET_CONFIGURATION_write (struct GNUNET_CONFIGURATION_Handle *cfg,
                             const char *filename)
@@ -1028,10 +1453,14 @@ GNUNET_CONFIGURATION_remove_section (struct GNUNET_CONFIGURATION_Handle *cfg,
         spos->entries = ent->next;
         GNUNET_free (ent->key);
         GNUNET_free (ent->val);
+        GNUNET_free (ent->hint_filename);
         GNUNET_free (ent);
         cfg->dirty = GNUNET_YES;
       }
       GNUNET_free (spos->name);
+      GNUNET_free (spos->hint_secret_filename);
+      GNUNET_free (spos->hint_secret_stat);
+      GNUNET_free (spos->hint_inlined_from_filename);
       GNUNET_free (spos);
       return;
     }
@@ -1074,41 +1503,6 @@ GNUNET_CONFIGURATION_dup (const struct GNUNET_CONFIGURATION_Handle *cfg)
 
 
 /**
- * Find an entry from a configuration.
- *
- * @param cfg handle to the configuration
- * @param section section the option is in
- * @param key the option
- * @return matching entry, NULL if not found
- */
-static struct ConfigEntry *
-find_entry (const struct GNUNET_CONFIGURATION_Handle *cfg,
-            const char *section,
-            const char *key)
-{
-  struct ConfigSection *sec;
-  struct ConfigEntry *pos;
-
-  if (NULL == (sec = find_section (cfg, section)))
-    return NULL;
-  if (sec->inaccessible)
-  {
-    LOG (GNUNET_ERROR_TYPE_WARNING,
-         "Section '%s' is marked as inaccessible, because the configuration "
-         " file that contains the section can't be read.  Attempts to use "
-         "option '%s' will fail.\n",
-         section,
-         key);
-    return NULL;
-  }
-  pos = sec->entries;
-  while ((pos != NULL) && (0 != strcasecmp (key, pos->key)))
-    pos = pos->next;
-  return pos;
-}
-
-
-/**
  * A callback function, compares entries from two configurations
  * (default against a new configuration) and write the diffs in a
  * diff-configuration object (the callback object).
@@ -1871,41 +2265,104 @@ GNUNET_CONFIGURATION_remove_value_filename (
 }
 
 
-/**
- * Wrapper around #GNUNET_CONFIGURATION_parse.  Called on each
- * file in a directory, we trigger parsing on those files that
- * end with ".conf".
- *
- * @param cls the cfg
- * @param filename file to parse
- * @return #GNUNET_OK on success
- */
-static enum GNUNET_GenericReturnValue
-parse_configuration_file (void *cls, const char *filename)
+enum GNUNET_GenericReturnValue
+GNUNET_CONFIGURATION_load_from (struct GNUNET_CONFIGURATION_Handle *cfg,
+                                const char *defaults_d)
 {
-  struct GNUNET_CONFIGURATION_Handle *cfg = cls;
-  char *ext;
+  struct CollectFilesContext files_context = {
+    .files = NULL,
+    .files_length = 0,
+  };
+  enum GNUNET_GenericReturnValue fun_ret;
 
-  /* Examine file extension */
-  ext = strrchr (filename, '.');
-  if ((NULL == ext) || (0 != strcmp (ext, ".conf")))
+  if (GNUNET_SYSERR ==
+      GNUNET_DISK_directory_scan (defaults_d, &collect_files_cb,
+                                  &files_context))
+    return GNUNET_SYSERR; /* no configuration at all found */
+  qsort (files_context.files,
+         files_context.files_length,
+         sizeof (char *),
+         pstrcmp);
+  for (unsigned int i = 0; i < files_context.files_length; i++)
   {
-    GNUNET_log (GNUNET_ERROR_TYPE_WARNING, "Skipping file `%s'\n", filename);
-    return GNUNET_OK;
-  }
+    char *ext;
+    const char *filename = files_context.files[i];
 
-  return GNUNET_CONFIGURATION_parse (cfg, filename);
+    /* Examine file extension */
+    ext = strrchr (filename, '.');
+    if ((NULL == ext) || (0 != strcmp (ext, ".conf")))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_WARNING, "Skipping file `%s'\n", filename);
+      fun_ret = GNUNET_OK;
+      goto cleanup;
+    }
+    fun_ret = GNUNET_CONFIGURATION_parse (cfg, filename);
+    if (fun_ret != GNUNET_OK)
+      break;
+  }
+cleanup:
+  if (files_context.files_length > 0)
+  {
+    for (size_t i = 0; i < files_context.files_length; i++)
+      GNUNET_free (files_context.files[i]);
+    GNUNET_array_grow (files_context.files,
+                       files_context.files_length,
+                       0);
+  }
+  return fun_ret;
 }
 
 
-enum GNUNET_GenericReturnValue
-GNUNET_CONFIGURATION_load_from (struct GNUNET_CONFIGURATION_Handle *cfg,
-                                const char *defaults_d)
+char *
+GNUNET_CONFIGURATION_default_filename (void)
 {
-  if (GNUNET_SYSERR ==
-      GNUNET_DISK_directory_scan (defaults_d, &parse_configuration_file, cfg))
-    return GNUNET_SYSERR; /* no configuration at all found */
-  return GNUNET_OK;
+  char *cfg_fn;
+  const struct GNUNET_OS_ProjectData *pd = GNUNET_OS_project_data_get ();
+  const char *xdg = getenv ("XDG_CONFIG_HOME");
+
+  if (NULL != xdg)
+    GNUNET_asprintf (&cfg_fn,
+                     "%s%s%s",
+                     xdg,
+                     DIR_SEPARATOR_STR,
+                     pd->config_file);
+  else
+    cfg_fn = GNUNET_strdup (pd->user_config_file);
+
+  if (GNUNET_OK == GNUNET_DISK_file_test_read (cfg_fn))
+    return cfg_fn;
+
+  GNUNET_free (cfg_fn);
+
+  /* Fall back to /etc/ for the default configuration.
+     Should be okay to use forward slashes here. */
+
+  GNUNET_asprintf (&cfg_fn,
+                   "/etc/%s",
+                   pd->config_file);
+
+  if (GNUNET_OK == GNUNET_DISK_file_test_read (cfg_fn))
+    return cfg_fn;
+
+  GNUNET_free (cfg_fn);
+
+  GNUNET_asprintf (&cfg_fn,
+                   "/etc/%s",
+                   pd->config_file);
+
+  if (GNUNET_OK == GNUNET_DISK_file_test_read (cfg_fn))
+    return cfg_fn;
+
+  GNUNET_asprintf (&cfg_fn,
+                   "/etc/%s/%s",
+                   pd->project_dirname,
+                   pd->config_file);
+
+  if (GNUNET_OK == GNUNET_DISK_file_test_read (cfg_fn))
+    return cfg_fn;
+
+  GNUNET_free (cfg_fn);
+  return NULL;
 }
 
 
@@ -1939,7 +2396,9 @@ GNUNET_CONFIGURATION_default (void)
   if (GNUNET_OK != GNUNET_DISK_file_test (cfgname))
   {
     GNUNET_free (cfgname);
-    GNUNET_asprintf (&cfgname, "/etc/%s/%s", pd->project_dirname,
+    GNUNET_asprintf (&cfgname,
+                     "/etc/%s/%s",
+                     pd->project_dirname,
                      pd->config_file);
   }
   if (GNUNET_OK != GNUNET_DISK_file_test (cfgname))
@@ -1971,4 +2430,81 @@ GNUNET_CONFIGURATION_default (void)
 }
 
 
+/**
+ * Load configuration (starts with defaults, then loads
+ * system-specific configuration).
+ *
+ * @param cfg configuration to update
+ * @param filename name of the configuration file, NULL to load defaults
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
+ */
+int
+GNUNET_CONFIGURATION_load (struct GNUNET_CONFIGURATION_Handle *cfg,
+                           const char *filename)
+{
+  char *baseconfig;
+  const char *base_config_varname;
+
+  if (cfg->load_called)
+  {
+    /* FIXME:  Make this a GNUNET_assert later */
+    GNUNET_break (0);
+    GNUNET_free (cfg->main_filename);
+  }
+  cfg->load_called = true;
+  if (NULL != filename)
+    cfg->main_filename = GNUNET_strdup (filename);
+
+  base_config_varname = GNUNET_OS_project_data_get ()->base_config_varname;
+
+  if ((NULL != base_config_varname)
+      && (NULL != (baseconfig = getenv (base_config_varname))))
+  {
+    baseconfig = GNUNET_strdup (baseconfig);
+  }
+  else
+  {
+    char *ipath;
+
+    ipath = GNUNET_OS_installation_get_path (GNUNET_OS_IPK_DATADIR);
+    if (NULL == ipath)
+    {
+      GNUNET_break (0);
+      return GNUNET_SYSERR;
+    }
+    GNUNET_asprintf (&baseconfig, "%s%s", ipath, "config.d");
+    GNUNET_free (ipath);
+  }
+
+  char *dname = GNUNET_STRINGS_filename_expand (baseconfig);
+  GNUNET_free (baseconfig);
+
+  if ((GNUNET_YES == GNUNET_DISK_directory_test (dname, GNUNET_YES)) &&
+      (GNUNET_SYSERR == GNUNET_CONFIGURATION_load_from (cfg, dname)))
+  {
+    LOG (GNUNET_ERROR_TYPE_WARNING,
+         "Failed to load base configuration from '%s'\n",
+         filename);
+    GNUNET_free (dname);
+    return GNUNET_SYSERR;       /* no configuration at all found */
+  }
+  GNUNET_free (dname);
+  if ((NULL != filename) &&
+      (GNUNET_OK != GNUNET_CONFIGURATION_parse (cfg, filename)))
+  {
+    /* specified configuration not found */
+    LOG (GNUNET_ERROR_TYPE_WARNING,
+         "Failed to load configuration from file '%s'\n",
+         filename);
+    return GNUNET_SYSERR;
+  }
+  if (((GNUNET_YES !=
+        GNUNET_CONFIGURATION_have_value (cfg, "PATHS", "DEFAULTCONFIG"))) &&
+      (filename != NULL))
+    GNUNET_CONFIGURATION_set_value_string (cfg, "PATHS", "DEFAULTCONFIG",
+                                           filename);
+  return GNUNET_OK;
+}
+
+
 /* end of configuration.c */
diff --git a/src/util/configuration_loader.c b/src/util/configuration_loader.c
deleted file mode 100644
index a59477b25..000000000
--- a/src/util/configuration_loader.c
+++ /dev/null
@@ -1,91 +0,0 @@
-/*
-     This file is part of GNUnet.
-     Copyright (C) 2006, 2007, 2008, 2009, 2013 GNUnet e.V.
-
-     GNUnet is free software: you can redistribute it and/or modify it
-     under the terms of the GNU Affero General Public License as published
-     by the Free Software Foundation, either version 3 of the License,
-     or (at your option) any later version.
-
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     Affero General Public License for more details.
-
-     You should have received a copy of the GNU Affero General Public License
-     along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-
-/**
- * @file src/util/configuration_loader.c
- * @brief configuration loading
- * @author Christian Grothoff
- */
-
-#include "platform.h"
-#include "gnunet_util_lib.h"
-
-#define LOG(kind, ...) GNUNET_log_from (kind, "util-configuration", __VA_ARGS__)
-
-
-/**
- * Load configuration (starts with defaults, then loads
- * system-specific configuration).
- *
- * @param cfg configuration to update
- * @param filename name of the configuration file, NULL to load defaults
- * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
- */
-int
-GNUNET_CONFIGURATION_load (struct GNUNET_CONFIGURATION_Handle *cfg,
-                           const char *filename)
-{
-  char *baseconfig;
-  const char *base_config_varname;
-
-  base_config_varname = GNUNET_OS_project_data_get ()->base_config_varname;
-
-  if (NULL != base_config_varname
-      && NULL != (baseconfig = getenv (base_config_varname)))
-  {
-    baseconfig = GNUNET_strdup (baseconfig);
-  }
-  else
-  {
-    char *ipath;
-
-    ipath = GNUNET_OS_installation_get_path (GNUNET_OS_IPK_DATADIR);
-    if (NULL == ipath)
-      return GNUNET_SYSERR;
-    GNUNET_asprintf (&baseconfig, "%s%s", ipath, "config.d");
-    GNUNET_free (ipath);
-  }
-
-  char *dname = GNUNET_STRINGS_filename_expand (baseconfig);
-  GNUNET_free (baseconfig);
-
-  if (GNUNET_YES == GNUNET_DISK_directory_test (dname, GNUNET_YES) &&
-      GNUNET_SYSERR == GNUNET_CONFIGURATION_load_from (cfg, dname))
-  {
-    GNUNET_free (dname);
-    return GNUNET_SYSERR;       /* no configuration at all found */
-  }
-  GNUNET_free (dname);
-  if ((NULL != filename) &&
-      (GNUNET_OK != GNUNET_CONFIGURATION_parse (cfg, filename)))
-  {
-    /* specified configuration not found */
-    return GNUNET_SYSERR;
-  }
-  if (((GNUNET_YES !=
-        GNUNET_CONFIGURATION_have_value (cfg, "PATHS", "DEFAULTCONFIG"))) &&
-      (filename != NULL))
-    GNUNET_CONFIGURATION_set_value_string (cfg, "PATHS", "DEFAULTCONFIG",
-                                           filename);
-  return GNUNET_OK;
-}
-
-
-/* end of configuration_loader.c */
diff --git a/src/util/disk.c b/src/util/disk.c
index f68b32db5..ada35249f 100644
--- a/src/util/disk.c
+++ b/src/util/disk.c
@@ -434,7 +434,7 @@ GNUNET_DISK_directory_test (const char *fil, int is_readable)
 
 /**
  * Check if fil can be accessed using amode.
- * 
+ *
  * @param fil file to check for
  * @param amode access mode
  * @returns GNUnet error code
@@ -455,7 +455,7 @@ file_test_internal (const char *fil, int amode)
   {
     if (errno != ENOENT)
     {
-      LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_WARNING, "stat", rdir);
+      LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_DEBUG, "stat", rdir);
       GNUNET_free (rdir);
       return GNUNET_SYSERR;
     }
@@ -469,7 +469,7 @@ file_test_internal (const char *fil, int amode)
   }
   if (access (rdir, amode) < 0)
   {
-    LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_WARNING, "access", rdir);
+    LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_DEBUG, "access", rdir);
     GNUNET_free (rdir);
     return GNUNET_SYSERR;
   }
@@ -956,6 +956,11 @@ struct GlobClosure
   const char *glob;
   GNUNET_FileNameCallback cb;
   void *cls;
+
+  /**
+   * Number of files that actually matched the glob pattern.
+   */
+  int nres;
 };
 
 /**
@@ -984,10 +989,15 @@ glob_cb (void *cls,
 
   if (glob_match (gc->glob, fn))
   {
+    enum GNUNET_GenericReturnValue cbret;
+
     LOG (GNUNET_ERROR_TYPE_DEBUG,
          "found glob match '%s'\n",
          filename);
-    gc->cb (gc->cls, filename);
+    gc->nres++;
+    cbret = gc->cb (gc->cls, filename);
+    if (GNUNET_OK != cbret)
+      return cbret;
   }
   return GNUNET_OK;
 }
@@ -1002,6 +1012,17 @@ GNUNET_DISK_glob (const char *glob_pattern,
   char *sep;
   int ret;
 
+  if ( (NULL != strrchr (glob_pattern, '+')) ||
+       (NULL != strrchr (glob_pattern, '[')) ||
+       (NULL != strrchr (glob_pattern, '+')) ||
+       (NULL != strrchr (glob_pattern, '~')) )
+  {
+    LOG (GNUNET_ERROR_TYPE_ERROR,
+         "unsupported glob pattern: '%s'\n",
+         glob_pattern);
+    return -1;
+  }
+
   sep = strrchr (mypat, DIR_SEPARATOR);
   if (NULL == sep)
   {
@@ -1025,6 +1046,7 @@ GNUNET_DISK_glob (const char *glob_pattern,
       .glob = sep + 1,
       .cb = callback,
       .cls = callback_cls,
+      .nres = 0,
     };
     LOG (GNUNET_ERROR_TYPE_DEBUG,
          "scanning directory '%s' for glob matches on '%s'\n",
@@ -1034,9 +1056,9 @@ GNUNET_DISK_glob (const char *glob_pattern,
                                       glob_cb,
                                       &gc
                                       );
+    GNUNET_free (mypat);
+    return (ret < 0) ? ret : gc.nres;
   }
-  GNUNET_free (mypat);
-  return ret;
 }
 
 
diff --git a/src/util/gnunet-config.c b/src/util/gnunet-config.c
index 3932ff1bf..807df0d74 100644
--- a/src/util/gnunet-config.c
+++ b/src/util/gnunet-config.c
@@ -70,6 +70,12 @@ static int global_ret;
 static int rewrite;
 
 /**
+ * Should we give extra diagnostics?
+ */
+static int diagnostics;
+
+
+/**
  * Should the generated configuration file contain the whole configuration?
  */
 static int full;
@@ -162,6 +168,17 @@ run (void *cls,
     GNUNET_free (name);
     return;
   }
+
+  if (diagnostics)
+  {
+    struct GNUNET_CONFIGURATION_Handle *ncfg;
+    /* Re-parse the configuration with diagnostics enabled. */
+    ncfg = GNUNET_CONFIGURATION_create ();
+    GNUNET_CONFIGURATION_enable_diagnostics (ncfg);
+    GNUNET_CONFIGURATION_load (ncfg, cfgfile);
+    cfg = ncfg;
+  }
+
   if (full)
     rewrite = GNUNET_YES;
   if (list_sections)
@@ -176,16 +193,26 @@ run (void *cls,
   if ( (! rewrite) &&
        (NULL == section) )
   {
-    fprintf (stderr,
-             _ ("%s or %s argument is required\n"),
-             "--section",
-             "--list-sections");
-    global_ret = 1;
-    return;
-  }
+    char *serialization;
 
-  if ( (NULL != section) &&
-       (NULL == value) )
+    if (! diagnostics)
+    {
+      fprintf (stderr,
+               _ ("%s, %s or %s argument is required\n"),
+               "--section",
+               "--list-sections",
+               "--diagnostics");
+      global_ret = 1;
+      return;
+    }
+    serialization = GNUNET_CONFIGURATION_serialize_diagnostics (cfg);
+    fprintf (stdout,
+             "%s",
+             serialization);
+    GNUNET_free (serialization);
+  }
+  else if ( (NULL != section) &&
+            (NULL == value) )
   {
     if (NULL == option)
     {
@@ -348,6 +375,12 @@ main (int argc, char *const *argv)
       gettext_noop (
         "rewrite the configuration file, even if nothing changed"),
       &rewrite),
+    GNUNET_GETOPT_option_flag (
+      'd',
+      "diagnostics",
+      gettext_noop (
+        "output extra diagnostics"),
+      &diagnostics),
     GNUNET_GETOPT_option_flag ('S',
                                "list-sections",
                                gettext_noop (
diff --git a/src/util/plugin.c b/src/util/plugin.c
index feb661f24..39874a588 100644
--- a/src/util/plugin.c
+++ b/src/util/plugin.c
@@ -447,8 +447,12 @@ GNUNET_PLUGIN_load_all_in_context (const struct GNUNET_OS_ProjectData *ctx,
                                    void *cb_cls)
 {
   const struct GNUNET_OS_ProjectData *cpd = GNUNET_OS_project_data_get ();
+
   GNUNET_OS_init (ctx);
-  GNUNET_PLUGIN_load_all (basename, arg, cb, cb_cls);
+  GNUNET_PLUGIN_load_all (basename,
+                          arg,
+                          cb,
+                          cb_cls);
   GNUNET_OS_init (cpd);
 }
 
diff --git a/src/util/program.c b/src/util/program.c
index e34b37370..a79e07d19 100644
--- a/src/util/program.c
+++ b/src/util/program.c
@@ -140,7 +140,6 @@ GNUNET_PROGRAM_run2 (int argc,
   char *loglev;
   char *logfile;
   char *cfg_fn;
-  const char *xdg;
   enum GNUNET_GenericReturnValue ret;
   int iret;
   unsigned int cnt;
@@ -149,12 +148,13 @@ GNUNET_PROGRAM_run2 (int argc,
   long long clock_offset;
   struct GNUNET_CONFIGURATION_Handle *cfg;
   const struct GNUNET_OS_ProjectData *pd = GNUNET_OS_project_data_get ();
-  struct GNUNET_GETOPT_CommandLineOption defoptions[] =
-  { GNUNET_GETOPT_option_cfgfile (&cc.cfgfile),
+  struct GNUNET_GETOPT_CommandLineOption defoptions[] = {
+    GNUNET_GETOPT_option_cfgfile (&cc.cfgfile),
     GNUNET_GETOPT_option_help (binaryHelp),
     GNUNET_GETOPT_option_loglevel (&loglev),
     GNUNET_GETOPT_option_logfile (&logfile),
-    GNUNET_GETOPT_option_version (pd->version) };
+    GNUNET_GETOPT_option_version (pd->version)
+  };
   struct GNUNET_GETOPT_CommandLineOption *allopts;
   const char *gargs;
   char *lpfx;
@@ -219,17 +219,7 @@ GNUNET_PROGRAM_run2 (int argc,
          &cmd_sorter);
   loglev = NULL;
   if ((NULL != pd->config_file) && (NULL != pd->user_config_file))
-  {
-    xdg = getenv ("XDG_CONFIG_HOME");
-    if (NULL != xdg)
-      GNUNET_asprintf (&cfg_fn,
-                       "%s%s%s",
-                       xdg,
-                       DIR_SEPARATOR_STR,
-                       pd->config_file);
-    else
-      cfg_fn = GNUNET_strdup (pd->user_config_file);
-  }
+    cfg_fn = GNUNET_CONFIGURATION_default_filename ();
   else
     cfg_fn = NULL;
   lpfx = GNUNET_strdup (binaryName);
@@ -251,6 +241,9 @@ GNUNET_PROGRAM_run2 (int argc,
   }
   if (NULL != cc.cfgfile)
   {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Loading configuration from entry point specified as option (%s)\n",
+                cc.cfgfile);
     if ((GNUNET_YES != GNUNET_DISK_file_test (cc.cfgfile)) ||
         (GNUNET_SYSERR == GNUNET_CONFIGURATION_load (cfg, cc.cfgfile)))
     {
@@ -266,6 +259,9 @@ GNUNET_PROGRAM_run2 (int argc,
   }
   else
   {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Loading configuration default entry point (%s)\n",
+                cc.cfgfile);
     if ((NULL != cfg_fn) && (GNUNET_YES == GNUNET_DISK_file_test (cfg_fn)))
     {
       if (GNUNET_SYSERR == GNUNET_CONFIGURATION_load (cfg, cfg_fn))
@@ -283,8 +279,9 @@ GNUNET_PROGRAM_run2 (int argc,
     }
     else if (NULL != cfg_fn)
     {
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "Loading configuration without entry point\n");
       GNUNET_free (cfg_fn);
-      cfg_fn = NULL;
       if (GNUNET_OK != GNUNET_CONFIGURATION_load (cfg, NULL))
       {
         GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
@@ -349,7 +346,7 @@ GNUNET_PROGRAM_run2 (int argc,
     cc.task (cc.task_cls, cc.args, cc.cfgfile, cc.cfg);
   }
   ret = GNUNET_OK;
-cleanup:
+  cleanup:
   GNUNET_CONFIGURATION_destroy (cfg);
   GNUNET_free (cc.cfgfile);
   GNUNET_free (cfg_fn);
diff --git a/src/util/test_plugin.c b/src/util/test_plugin.c
index c0eb717d6..e739d17c9 100644
--- a/src/util/test_plugin.c
+++ b/src/util/test_plugin.c
@@ -26,15 +26,22 @@
 
 
 static void
-test_cb (void *cls, const char *libname, void *lib_ret)
+test_cb (void *cls,
+         const char *libname,
+         void *lib_ret)
 {
-  void *ret;
+  const char *test_cls = cls;
+  char *ret;
 
-  GNUNET_assert (0 == strcmp (cls, "test"));
-  GNUNET_assert (0 == strcmp (lib_ret, "Hello"));
-  ret = GNUNET_PLUGIN_unload (libname, "out");
+  GNUNET_assert (0 == strcmp (test_cls,
+                              "test-closure"));
+  GNUNET_assert (0 == strcmp (lib_ret,
+                              "Hello"));
+  ret = GNUNET_PLUGIN_unload (libname,
+                              "out");
   GNUNET_assert (NULL != ret);
-  GNUNET_assert (0 == strcmp (ret, "World"));
+  GNUNET_assert (0 == strcmp (ret,
+                              "World"));
   free (ret);
 }
 
@@ -44,24 +51,35 @@ main (int argc, char *argv[])
 {
   void *ret;
 
-  GNUNET_log_setup ("test-plugin", "WARNING", NULL);
-  GNUNET_log_skip (1, GNUNET_NO);
-  ret = GNUNET_PLUGIN_load ("libgnunet_plugin_missing", NULL);
+  GNUNET_log_setup ("test-plugin",
+                    "WARNING",
+                    NULL);
+  GNUNET_log_skip (1,
+                   GNUNET_NO);
+  ret = GNUNET_PLUGIN_load ("libgnunet_plugin_missing",
+                            NULL);
   GNUNET_log_skip (0, GNUNET_NO);
-  if (ret != NULL)
+  if (NULL != ret)
     return 1;
-  ret = GNUNET_PLUGIN_load ("libgnunet_plugin_test", "in");
-  if (ret == NULL)
+  ret = GNUNET_PLUGIN_load ("libgnunet_plugin_utiltest",
+                            "in");
+  if (NULL == ret)
     return 1;
-  if (0 != strcmp (ret, "Hello"))
+  if (0 != strcmp (ret,
+                   "Hello"))
     return 2;
-  ret = GNUNET_PLUGIN_unload ("libgnunet_plugin_test", "out");
-  if (ret == NULL)
+  ret = GNUNET_PLUGIN_unload ("libgnunet_plugin_utiltest",
+                              "out");
+  if (NULL == ret)
     return 3;
-  if (0 != strcmp (ret, "World"))
+  if (0 != strcmp (ret,
+                   "World"))
     return 4;
   free (ret);
-  GNUNET_PLUGIN_load_all ("libgnunet_plugin_tes", "in", &test_cb, "test");
+  GNUNET_PLUGIN_load_all ("libgnunet_plugin_utiltes",
+                          "in",
+                          &test_cb,
+                          "test-closure");
   return 0;
 }
 
diff --git a/src/util/test_plugin_plug.c b/src/util/test_plugin_plug.c
index 39c8774b1..bfaad52e8 100644
--- a/src/util/test_plugin_plug.c
+++ b/src/util/test_plugin_plug.c
@@ -23,8 +23,9 @@
  */
 #include "platform.h"
 
+
 void *
-libgnunet_plugin_test_init (void *arg)
+libgnunet_plugin_utiltest_init (void *arg)
 {
   if (0 == strcmp (arg, "in"))
     return "Hello";
@@ -33,7 +34,7 @@ libgnunet_plugin_test_init (void *arg)
 
 
 void *
-libgnunet_plugin_test_done (void *arg)
+libgnunet_plugin_utiltest_done (void *arg)
 {
   if (0 == strcmp (arg, "out"))
     return strdup ("World");