-removing legacy dns/vpn/exit code and renaming -new versions to current

11 files changed, 1503 insertions, 4323 deletions

diff --git a/src/dns/Makefile.am b/src/dns/Makefile.am
index 99e78d7d6..f8bdae94e 100644
--- a/src/dns/Makefile.am
+++ b/src/dns/Makefile.am
@@ -16,26 +16,23 @@ pkgcfg_DATA = \
   dns.conf
 
 if LINUX
-HIJACKBIN = gnunet-helper-hijack-dns gnunet-helper-dns
+HIJACKBIN = gnunet-helper-dns
 install-exec-hook:
-        $(SUDO_BINARY) chown root:root $(bindir)/gnunet-helper-hijack-dns || true
-        $(SUDO_BINARY) chmod u+s $(bindir)/gnunet-helper-hijack-dns || true
         $(SUDO_BINARY) chown root $(bindir)/gnunet-helper-dns || true
         $(SUDO_BINARY) chgrp $(GNUNETDNS_GROUP) $(bindir)/gnunet-helper-dns || true
         $(SUDO_BINARY) chmod 4750 $(bindir)/gnunet-helper-dns || true
-        $(SUDO_BINARY) chgrp $(GNUNETDNS_GROUP) $(bindir)/gnunet-service-dns-new || true
-        $(SUDO_BINARY) chmod 2755 $(bindir)/gnunet-helper-dns || true
+        $(SUDO_BINARY) chgrp $(GNUNETDNS_GROUP) $(bindir)/gnunet-service-dns || true
+        $(SUDO_BINARY) chmod 2755 $(bindir)/gnunet-service-dns || true
 else
 install-exec-hook:
 endif
 
 lib_LTLIBRARIES = \
   libgnunetdnsparser.la \
-  libgnunetdnsnew.la \
   libgnunetdns.la
 
 bin_PROGRAMS = \
-  gnunet-service-dns gnunet-service-dns-new $(HIJACKBIN)
+  gnunet-service-dns $(HIJACKBIN)
 
 noinst_PROGRAMS = \
   gnunet-dns-monitor gnunet-dns-redirector
@@ -44,50 +41,35 @@ plugin_LTLIBRARIES = \
   libgnunet_plugin_block_dns.la 
 
 
-gnunet_helper_hijack_dns_SOURCES = \
- gnunet-helper-hijack-dns.c
-
 gnunet_helper_dns_SOURCES = \
  gnunet-helper-dns.c
 
-gnunet_service_dns_SOURCES = \
- gnunet-service-dns.c 
-gnunet_service_dns_LDADD = \
-  $(top_builddir)/src/core/libgnunetcore.la \
-  $(top_builddir)/src/statistics/libgnunetstatistics.la \
-  $(top_builddir)/src/util/libgnunetutil.la \
-  $(top_builddir)/src/dht/libgnunetdht.la \
-  $(top_builddir)/src/mesh/libgnunetmesh.la \
-  $(top_builddir)/src/dns/libgnunetdnsparser.la \
-  $(GN_LIBINTL)
-gnunet_service_dns_DEPENDENCIES = \
-  libgnunetdnsparser.la
 
 gnunet_dns_monitor_SOURCES = \
  gnunet-dns-monitor.c
 gnunet_dns_monitor_LDADD = \
   $(top_builddir)/src/dns/libgnunetdnsparser.la \
-  $(top_builddir)/src/dns/libgnunetdnsnew.la \
+  $(top_builddir)/src/dns/libgnunetdns.la \
   $(top_builddir)/src/util/libgnunetutil.la \
   $(GN_LIBINTL)
 gnunet_dns_monitor_DEPENDENCIES = \
   libgnunetdnsparser.la \
-  libgnunetdnsnew.la
+  libgnunetdns.la
 
 gnunet_dns_redirector_SOURCES = \
  gnunet-dns-redirector.c
 gnunet_dns_redirector_LDADD = \
   $(top_builddir)/src/dns/libgnunetdnsparser.la \
-  $(top_builddir)/src/dns/libgnunetdnsnew.la \
+  $(top_builddir)/src/dns/libgnunetdns.la \
   $(top_builddir)/src/util/libgnunetutil.la \
   $(GN_LIBINTL)
 gnunet_dns_redirector_DEPENDENCIES = \
   libgnunetdnsparser.la \
-  libgnunetdnsnew.la
+  libgnunetdns.la
 
-gnunet_service_dns_new_SOURCES = \
- gnunet-service-dns_new.c 
-gnunet_service_dns_new_LDADD = \
+gnunet_service_dns_SOURCES = \
+ gnunet-service-dns.c 
+gnunet_service_dns_LDADD = \
   $(top_builddir)/src/statistics/libgnunetstatistics.la \
   $(top_builddir)/src/util/libgnunetutil.la \
   $(GN_LIBINTL)
@@ -106,13 +88,6 @@ libgnunetdns_la_LIBADD = \
 libgnunetdns_la_LDFLAGS = \
   $(GN_LIB_LDFLAGS)
 
-libgnunetdnsnew_la_SOURCES = \
- dns_api_new.c dns_new.h
-libgnunetdnsnew_la_LIBADD = \
- $(top_builddir)/src/util/libgnunetutil.la $(XLIB)
-libgnunetdnsnew_la_LDFLAGS = \
-  $(GN_LIB_LDFLAGS)
-
 libgnunet_plugin_block_dns_la_SOURCES = \
   plugin_block_dns.c
 libgnunet_plugin_block_dns_la_LIBADD = \
diff --git a/src/dns/dns.h b/src/dns/dns.h
index dd0f55e16..29a9f937b 100644
--- a/src/dns/dns.h
+++ b/src/dns/dns.h
@@ -1,6 +1,6 @@
 /*
       This file is part of GNUnet
-      (C) 2010, 2011, 2012 Christian Grothoff (and other contributing authors)
+      (C) 2012 Christian Grothoff (and other contributing authors)
 
       GNUnet is free software; you can redistribute it and/or modify
       it under the terms of the GNU General Public License as published
@@ -19,36 +19,83 @@
  */
 
 /**
- * @file dns/dns.h
+ * @file dns/dns_new.h
  * @brief IPC messages between DNS API and DNS service
- * @author Philipp Toelke
  * @author Christian Grothoff
  */
-#ifndef DNS_H
-#define DNS_H
+#ifndef DNS_NEW_H
+#define DNS_NEW_H
 
 GNUNET_NETWORK_STRUCT_BEGIN
 
-struct query_packet
+
+/**
+ * Message from client to DNS service to register itself.
+ */
+struct GNUNET_DNS_Register
+{
+  /**
+    * Header of type GNUNET_MESSAGE_TYPE_DNS_CLIENT_INIT
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * NBO encoding of 'enum GNUNET_DNS_Flags' for the client.
+   */
+  uint32_t flags;
+};
+
+
+/**
+ * Message from DNS service to client: please handle a request.
+ */
+struct GNUNET_DNS_Request
+{
+  /**
+    * Header of type GNUNET_MESSAGE_TYPE_DNS_CLIENT_REQUEST
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * Always zero.
+   */
+  uint32_t reserved GNUNET_PACKED;
+  
+  /**
+   * Unique request ID.
+   */
+  uint64_t request_id GNUNET_PACKED;
+
+  /* followed by original DNS request (without UDP header) */
+
+};
+
+
+/**
+ * Message from client to DNS service: here is my reply.
+ */
+struct GNUNET_DNS_Response
 {
-  struct GNUNET_MessageHeader hdr;
-
-        /**
-         * The IP-Address this query was originally sent to
-         */
-  char orig_to[16];
-        /**
-         * The IP-Address this query was originally sent from
-         */
-  char orig_from[16];
-  char addrlen;
-        /**
-         * The UDP-Port this query was originally sent from
-         */
-  uint16_t src_port GNUNET_PACKED;
-
-  unsigned char data[1];        /* The DNS-Packet */
+  /**
+   * Header of type GNUNET_MESSAGE_TYPE_DNS_CLIENT_RESPONSE
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * Zero to drop, 1 for no change (no payload), 2 for update (message has payload).
+   */
+  uint32_t drop_flag GNUNET_PACKED;
+  
+  /**
+   * Unique request ID.
+   */
+  uint64_t request_id GNUNET_PACKED;
+
+  /* followed by original DNS request (without UDP header) */
+
 };
+
+
 GNUNET_NETWORK_STRUCT_END
 
 #endif
diff --git a/src/dns/dns_api.c b/src/dns/dns_api.c
index b434fc1e7..dfce0af1b 100644
--- a/src/dns/dns_api.c
+++ b/src/dns/dns_api.c
@@ -1,342 +1,522 @@
 /*
-     This file is part of GNUnet.
-     (C) 2010 Christian Grothoff
-
-     GNUnet is free software; you can redistribute it and/or modify
-     it under the terms of the GNU General Public License as published
-     by the Free Software Foundation; either version 3, or (at your
-     option) any later version.
+      This file is part of GNUnet
+      (C) 2012 Christian Grothoff (and other contributing authors)
+
+      GNUnet is free software; you can redistribute it and/or modify
+      it under the terms of the GNU General Public License as published
+      by the Free Software Foundation; either version 2, or (at your
+      option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      General Public License for more details.
+
+      You should have received a copy of the GNU General Public License
+      along with GNUnet; see the file COPYING.  If not, write to the
+      Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+      Boston, MA 02111-1307, USA.
+ */
 
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     General Public License for more details.
+/**
+ * @file dns/dns_api_new.c
+ * @brief API to access the DNS service. 
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_dns_service.h"
+#include "dns.h"
 
-     You should have received a copy of the GNU General Public License
-     along with GNUnet; see the file COPYING.  If not, write to the
-     Free Software Foundation, Inc., 59 Temple Place - Suite 330,
-     Boston, MA 02111-1307, USA.
-*/
 
 /**
- * @file dns/dns_api.c
- * @brief
- * @author Philipp Toelke
+ * Reply to send to service.
  */
-#include <platform.h>
-#include <gnunet_common.h>
-#include <gnunet_client_lib.h>
-#include <gnunet_os_lib.h>
-#include <gnunet_mesh_service.h>
-#include <gnunet_protocols.h>
-#include <gnunet_server_lib.h>
-#include <gnunet_container_lib.h>
-#include <block_dns.h>
+struct ReplyQueueEntry
+{
+  /**
+   * Kept in DLL.
+   */
+  struct ReplyQueueEntry *next;
 
-#include "gnunet_dns_service.h"
-#include "dns.h"
+  /**
+   * Kept in DLL.
+   */
+  struct ReplyQueueEntry *prev;
+
+  /**
+   * Message to transmit, allocated at the end of this struct.
+   */
+  const struct GNUNET_MessageHeader *msg;
 
-struct query_packet_list
+};
+
+
+/**
+ * Handle to identify an individual DNS request.
+ */
+struct GNUNET_DNS_RequestHandle
 {
-  struct query_packet_list *next;
-  struct query_packet_list *prev;
-  struct query_packet pkt;
+
+  /**
+   * Handle to DNS API.
+   */
+  struct GNUNET_DNS_Handle *dh;
+
+  /**
+   * Stored in network byte order (as for us, it is just a random number).
+   */
+  uint64_t request_id;
+
+  /**
+   * Re-connect counter, to make sure we did not reconnect in the meantime.
+   */
+  uint32_t generation;
+
 };
 
 
+/**
+ * DNS handle
+ */
 struct GNUNET_DNS_Handle
 {
-  struct query_packet_list *head;
-  struct query_packet_list *tail;
+
+  /**
+   * Connection to DNS service, or NULL.
+   */
   struct GNUNET_CLIENT_Connection *dns_connection;
-  unsigned char restart_hijack;
 
+  /**
+   * Handle to active transmission request, or NULL.
+   */
   struct GNUNET_CLIENT_TransmitHandle *dns_transmit_handle;
 
+  /**
+   * Configuration to use.
+   */
   const struct GNUNET_CONFIGURATION_Handle *cfg;
 
-  GNUNET_DNS_ResponseCallback process_answer_cb;
+  /**
+   * Function to call to get replies.
+   */
+  GNUNET_DNS_RequestHandler rh;
   
-  void *process_answer_cb_cls;
-};
+  /**
+   * Closure for 'rh'.
+   */
+  void *rh_cls;
 
+  /**
+   * Head of replies to transmit.
+   */
+  struct ReplyQueueEntry *rq_head;
 
-/**
- * Callback called by notify_transmit_ready; sends dns-queries or rehijack-messages
- * to the service-dns
- * {{{
- */
-size_t
-send_query (void *cls GNUNET_UNUSED, size_t size, void *buf)
-{
-  struct GNUNET_DNS_Handle *h = cls;
+  /**
+   * Tail of replies to transmit.
+   */
+  struct ReplyQueueEntry *rq_tail;
 
-  size_t len;
+  /**
+   * Task to reconnect to the service.
+   */
+  GNUNET_SCHEDULER_TaskIdentifier reconnect_task;
 
-  h->dns_transmit_handle = NULL;
+  /**
+   * Re-connect counter, to make sure we did not reconnect in the meantime.
+   */
+  uint32_t generation;
+  
+  /**
+   * Flags for events we care about.
+   */
+  enum GNUNET_DNS_Flags flags;
 
-  /*
-   * Send the rehijack-message
+  /**
+   * Did we start the receive loop yet?
    */
-  if (h->restart_hijack == 1)
-  {
-    h->restart_hijack = 0;
-    /*
-     * The message is just a header
-     */
-    GNUNET_assert (sizeof (struct GNUNET_MessageHeader) <= size);
-    struct GNUNET_MessageHeader *hdr = buf;
-
-    len = sizeof (struct GNUNET_MessageHeader);
-    hdr->size = htons (len);
-    hdr->type = htons (GNUNET_MESSAGE_TYPE_REHIJACK);
-  }
-  else if (h->head != NULL)
-  {
-    struct query_packet_list *query = h->head;
+  int in_receive;
+
+  /**
+   * Number of GNUNET_DNS_RequestHandles we have outstanding. Must be 0 before
+   * we can be disconnected.
+   */
+  unsigned int pending_requests;
+};
+
 
-    len = ntohs (query->pkt.hdr.size);
+/**
+ * Add the given reply to our transmission queue and trigger sending if needed.
+ *
+ * @param dh handle with the connection
+ * @param qe reply to queue
+ */
+static void
+queue_reply (struct GNUNET_DNS_Handle *dh,
+             struct ReplyQueueEntry *qe);
 
-    GNUNET_assert (len <= size);
 
-    memcpy (buf, &query->pkt.hdr, len);
+/**
+ * Reconnect to the DNS service.
+ *
+ * @param cls handle with the connection to connect
+ * @param tc scheduler context (unused)
+ */
+static void
+reconnect (void *cls,
+           const struct GNUNET_SCHEDULER_TaskContext *tc)
+{
+  struct GNUNET_DNS_Handle *dh = cls;
+  struct ReplyQueueEntry *qe;
+  struct GNUNET_DNS_Register *msg;
 
-    GNUNET_CONTAINER_DLL_remove (h->head, h->tail, query);
+  dh->reconnect_task = GNUNET_SCHEDULER_NO_TASK;
+  dh->dns_connection = GNUNET_CLIENT_connect ("dns", dh->cfg);
+  if (NULL == dh->dns_connection)
+    return;
+  dh->generation++;
+  qe = GNUNET_malloc (sizeof (struct ReplyQueueEntry) +
+                      sizeof (struct GNUNET_DNS_Register));
+  msg = (struct GNUNET_DNS_Register*) &qe[1];
+  qe->msg = &msg->header;
+  msg->header.size = htons (sizeof (struct GNUNET_DNS_Register));
+  msg->header.type = htons (GNUNET_MESSAGE_TYPE_DNS_CLIENT_INIT);
+  msg->flags = htonl (dh->flags);
+  queue_reply (dh, qe);
+}
 
-    GNUNET_free (query);
-  }
-  else
+
+/**
+ * Disconnect from the DNS service.
+ *
+ * @param dh handle with the connection to disconnect
+ */
+static void
+disconnect (struct GNUNET_DNS_Handle *dh)
+{
+  struct ReplyQueueEntry *qe;
+
+  if (NULL != dh->dns_transmit_handle)
   {
-    GNUNET_break (0);
-    len = 0;
+    GNUNET_CLIENT_notify_transmit_ready_cancel (dh->dns_transmit_handle);
+    dh->dns_transmit_handle = NULL;
   }
-
-  /*
-   * Check whether more data is to be sent
-   */
-  if (h->head != NULL)
+  if (NULL != dh->dns_connection)
   {
-    h->dns_transmit_handle =
-      GNUNET_CLIENT_notify_transmit_ready (h->dns_connection,
-                                           ntohs (h->head->pkt.hdr.size),
-                                             GNUNET_TIME_UNIT_FOREVER_REL,
-                                             GNUNET_YES, &send_query, h);
+    GNUNET_CLIENT_disconnect (dh->dns_connection, GNUNET_NO);
+    dh->dns_connection = NULL;
   }
-  else if (h->restart_hijack == 1)
+  while (NULL != (qe = dh->rq_head))
   {
-    h->dns_transmit_handle =
-      GNUNET_CLIENT_notify_transmit_ready (h->dns_connection,
-                                           sizeof (struct
-                                                     GNUNET_MessageHeader),
-                                             GNUNET_TIME_UNIT_FOREVER_REL,
-                                             GNUNET_YES, &send_query, h);
+    GNUNET_CONTAINER_DLL_remove (dh->rq_head,
+                                 dh->rq_tail,
+                                 qe);
+    GNUNET_free (qe);
   }
-
-  return len;
+  dh->in_receive = GNUNET_NO;
 }
 
-/* }}} */
-
-
 
 /**
- * This receives packets from the service-dns and schedules process_answer to
- * handle it
+ * This receives packets from the DNS service and calls the application to
+ * handle it.
+ *
+ * @param cls the struct GNUNET_DNS_Handle
+ * @param msg message from the service (request)
  */
 static void
-dns_answer_handler (void *cls,
-                    const struct GNUNET_MessageHeader *msg)
+request_handler (void *cls,
+                 const struct GNUNET_MessageHeader *msg)
 {
-  struct GNUNET_DNS_Handle *h = cls;
+  struct GNUNET_DNS_Handle *dh = cls;
+  const struct GNUNET_DNS_Request *req;
+  struct GNUNET_DNS_RequestHandle *rh;
+  size_t payload_length;
 
   /* the service disconnected, reconnect after short wait */
   if (msg == NULL)
   {
-    if (h->dns_transmit_handle != NULL)
-      GNUNET_CLIENT_notify_transmit_ready_cancel (h->dns_transmit_handle);
-    h->dns_transmit_handle = NULL;
-    GNUNET_CLIENT_disconnect (h->dns_connection, GNUNET_NO);
-    h->dns_connection = NULL;
-#if 0
-    h->conn_task =
+    disconnect (dh);
+    dh->reconnect_task =
         GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_UNIT_SECONDS,
-                                      &connect_to_service_dns, h);
-#endif
+                                      &reconnect, dh);
     return;
   }
-
-  /* the service did something strange, reconnect immediately */
-  if (msg->type != htons (GNUNET_MESSAGE_TYPE_VPN_DNS_LOCAL_RESPONSE_DNS))
+  if ( (ntohs (msg->type) != GNUNET_MESSAGE_TYPE_DNS_CLIENT_REQUEST) ||
+       (ntohs (msg->size) < sizeof (struct GNUNET_DNS_Request)) )
   {
+    /* the service did something strange, reconnect immediately */
     GNUNET_break (0);
-    GNUNET_CLIENT_disconnect (h->dns_connection, GNUNET_NO);
-    h->dns_connection = NULL;
-#if 0
-    conn_task = GNUNET_SCHEDULER_add_now (&connect_to_service_dns, NULL);
-#endif
+    disconnect (dh);
+    dh->reconnect_task = GNUNET_SCHEDULER_add_now (&reconnect, dh);
     return;
   }
-  h->process_answer_cb (h->process_answer_cb_cls,
-                        (const struct answer_packet*) msg);
-  GNUNET_CLIENT_receive (h->dns_connection, &dns_answer_handler, h,
+  req = (const struct GNUNET_DNS_Request *) msg;
+  GNUNET_break (ntohl (req->reserved) == 0);
+  payload_length = ntohs (req->header.size) - sizeof (struct GNUNET_DNS_Request);
+  GNUNET_CLIENT_receive (dh->dns_connection, 
+                         &request_handler, dh,
                          GNUNET_TIME_UNIT_FOREVER_REL);
+
+  /* finally, pass request to callback for answers */
+  rh = GNUNET_malloc (sizeof (struct GNUNET_DNS_RequestHandle));
+  rh->dh =dh;
+  rh->request_id = req->request_id;
+  rh->generation = dh->generation;  
+  dh->pending_requests++;
+  dh->rh (dh->rh_cls,
+          rh,
+          payload_length,
+          (const char*) &req[1]);
 }
 
 
 /**
- * Connect to the service-dns
+ * Callback called by notify_transmit_ready; sends DNS replies
+ * to the DNS service.
+ *
+ * @param cls the struct GNUNET_DNS_Handle
+ * @param size number of bytes available in buf
+ * @param buf where to copy the message for transmission
+ * @return number of bytes copied to buf
  */
-struct GNUNET_DNS_Handle *
-GNUNET_DNS_connect (const struct GNUNET_CONFIGURATION_Handle *cfg,
-                    GNUNET_DNS_ResponseCallback cb,
-                    void *cb_cls)
+static size_t
+send_response (void *cls, size_t size, void *buf)
 {
-  struct GNUNET_DNS_Handle *h;
-
-  h = GNUNET_malloc (sizeof (struct GNUNET_DNS_Handle));
-  h->cfg = cfg;
-  h->process_answer_cb = cb;
-  h->process_answer_cb_cls = cb_cls;
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Connecting to service-dns\n");
-  h->dns_connection = GNUNET_CLIENT_connect ("dns", h->cfg);
-  /* This would most likely be a misconfiguration */
-  GNUNET_assert (NULL != h->dns_connection);
-  GNUNET_CLIENT_receive (h->dns_connection, 
-                         &dns_answer_handler, NULL,
-                         GNUNET_TIME_UNIT_FOREVER_REL);
-  /* If a packet is already in the list, schedule to send it */
-  if (h->dns_transmit_handle == NULL && h->head != NULL)
-    h->dns_transmit_handle =
-        GNUNET_CLIENT_notify_transmit_ready (h->dns_connection,
-                                             ntohs (h->head->pkt.hdr.size),
-                                             GNUNET_TIME_UNIT_FOREVER_REL,
-                                             GNUNET_YES, &send_query, h);
-  else if (h->dns_transmit_handle == NULL && h->restart_hijack == 1)
+  struct GNUNET_DNS_Handle *dh = cls;
+  struct ReplyQueueEntry *qe;
+  size_t len;
+ 
+  dh->dns_transmit_handle = NULL;
+  if (NULL == buf)
+  {
+    disconnect (dh);
+    dh->reconnect_task =
+      GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_UNIT_SECONDS,
+                                    &reconnect, dh);
+    return 0;
+  }
+  qe = dh->rq_head;
+  if (NULL == qe)
+    return 0;
+  len = ntohs (qe->msg->size);
+  if (len > size)
+  {   
+    dh->dns_transmit_handle =
+      GNUNET_CLIENT_notify_transmit_ready (dh->dns_connection,
+                                           len,
+                                           GNUNET_TIME_UNIT_FOREVER_REL,
+                                           GNUNET_NO, 
+                                           &send_response, dh);
+    return 0;
+  }
+  memcpy (buf, qe->msg, len);
+  GNUNET_CONTAINER_DLL_remove (dh->rq_head,
+                               dh->rq_tail,
+                               qe);
+  GNUNET_free (qe);
+  if (GNUNET_NO == dh->in_receive)
   {
-    h->dns_transmit_handle =
-      GNUNET_CLIENT_notify_transmit_ready (h->dns_connection,
-                                           sizeof (struct
-                                                     GNUNET_MessageHeader),
-                                             GNUNET_TIME_UNIT_FOREVER_REL,
-                                             GNUNET_YES, &send_query, NULL);
+    dh->in_receive = GNUNET_YES;
+    GNUNET_CLIENT_receive (dh->dns_connection, 
+                           &request_handler, dh,
+                           GNUNET_TIME_UNIT_FOREVER_REL);
   }
-  return h;
+  if (NULL != (qe = dh->rq_head))
+  {
+    dh->dns_transmit_handle =
+      GNUNET_CLIENT_notify_transmit_ready (dh->dns_connection,
+                                           ntohs (qe->msg->size),
+                                           GNUNET_TIME_UNIT_FOREVER_REL,
+                                           GNUNET_NO, 
+                                           &send_response, dh);
+  }
+  return len;
+} 
+
+
+/**
+ * Add the given reply to our transmission queue and trigger sending if needed.
+ *
+ * @param dh handle with the connection
+ * @param qe reply to queue
+ */
+static void
+queue_reply (struct GNUNET_DNS_Handle *dh,
+             struct ReplyQueueEntry *qe)
+{
+  if (NULL == dh->dns_connection)        
+  {
+    GNUNET_free (qe);
+    return;
+  }
+  GNUNET_CONTAINER_DLL_insert_tail (dh->rq_head,
+                                    dh->rq_tail,
+                                    qe);
+  if (NULL != dh->dns_transmit_handle)
+    return;
+  /* trigger sending */ 
+  dh->dns_transmit_handle =
+    GNUNET_CLIENT_notify_transmit_ready (dh->dns_connection,
+                                         ntohs (dh->rq_head->msg->size),
+                                         GNUNET_TIME_UNIT_FOREVER_REL,
+                                         GNUNET_NO, 
+                                         &send_response, dh);
 }
 
 
+/**
+ * If a GNUNET_DNS_RequestHandler calls this function, the request is
+ * given to other clients or the global DNS for resolution.  Once a
+ * global response has been obtained, the request handler is AGAIN
+ * called to give it a chance to observe and modify the response after
+ * the "normal" resolution.  It is not legal for the request handler
+ * to call this function if a response is already present.
+ *
+ * @param rh request that should now be forwarded
+ */
 void
-GNUNET_DNS_restart_hijack (struct GNUNET_DNS_Handle *h)
+GNUNET_DNS_request_forward (struct GNUNET_DNS_RequestHandle *rh)
 {
-  h->restart_hijack = 1;
-  if (NULL != h->dns_connection && h->dns_transmit_handle == NULL)
-    h->dns_transmit_handle =
-      GNUNET_CLIENT_notify_transmit_ready (h->dns_connection,
-                                             sizeof (struct
-                                                     GNUNET_MessageHeader),
-                                             GNUNET_TIME_UNIT_FOREVER_REL,
-                                             GNUNET_YES, &send_query, h);
+  struct ReplyQueueEntry *qe;
+  struct GNUNET_DNS_Response *resp;
+
+  GNUNET_assert (0 < rh->dh->pending_requests--);
+  if (rh->generation != rh->dh->generation)
+  {
+    GNUNET_free (rh);
+    return;
+  }
+  qe = GNUNET_malloc (sizeof (struct ReplyQueueEntry) +
+                      sizeof (struct GNUNET_DNS_Response));
+  resp = (struct GNUNET_DNS_Response*) &qe[1];
+  qe->msg = &resp->header;
+  resp->header.size = htons (sizeof (struct GNUNET_DNS_Response));
+  resp->header.type = htons (GNUNET_MESSAGE_TYPE_DNS_CLIENT_RESPONSE);
+  resp->drop_flag = htonl (1);
+  resp->request_id = rh->request_id;
+  queue_reply (rh->dh, qe);
+  GNUNET_free (rh);
 }
 
 
 /**
- * FIXME: we should not expost our internal structures like this.
- * Just a quick initial hack.
+ * If a GNUNET_DNS_RequestHandler calls this function, the request is
+ * to be dropped and no response should be generated.
+ *
+ * @param rh request that should now be dropped
  */
-static void
-queue_request (struct GNUNET_DNS_Handle *h,
-               struct query_packet_list *q)
+void
+GNUNET_DNS_request_drop (struct GNUNET_DNS_RequestHandle *rh)
 {
-  GNUNET_CONTAINER_DLL_insert_tail (h->head, h->tail, q);
-  if (h->dns_connection != NULL && h->dns_transmit_handle == NULL)
-    h->dns_transmit_handle =
-      GNUNET_CLIENT_notify_transmit_ready (h->dns_connection, ntohs(q->pkt.hdr.size),
-                                           GNUNET_TIME_UNIT_FOREVER_REL,
-                                           GNUNET_YES, &send_query,
-                                           h);
-}
+  struct ReplyQueueEntry *qe;
+  struct GNUNET_DNS_Response *resp;
 
+  GNUNET_assert (0 < rh->dh->pending_requests--);
+  if (rh->generation != rh->dh->generation)
+  {
+      GNUNET_free (rh);
+      return;
+  }
+  qe = GNUNET_malloc (sizeof (struct ReplyQueueEntry) +
+                      sizeof (struct GNUNET_DNS_Response));
+  resp = (struct GNUNET_DNS_Response*) &qe[1];
+  qe->msg = &resp->header;
+  resp->header.size = htons (sizeof (struct GNUNET_DNS_Response));
+  resp->header.type = htons (GNUNET_MESSAGE_TYPE_DNS_CLIENT_RESPONSE);
+  resp->request_id = rh->request_id;
+  resp->drop_flag = htonl (0);
+  queue_reply (rh->dh, qe);
+  GNUNET_free (rh);
+}
 
 
 /**
- * Process a DNS request sent to an IPv4 resolver.  Pass it
- * to the DNS service for resolution.
+ * If a GNUNET_DNS_RequestHandler calls this function, the request is
+ * supposed to be answered with the data provided to this call (with
+ * the modifications the function might have made).
  *
- * @param h DNS handle
- * @param dst_ip destination IPv4 address
- * @param src_ip source IPv4 address (usually local machine)
- * @param src_port source port (to be used for reply)
- * @param udp_packet_len length of the UDP payload in bytes
- * @param udp_packet UDP payload
+ * @param rh request that should now be answered
+ * @param reply_length size of reply (uint16_t to force sane size)
+ * @param reply reply data
  */
 void
-GNUNET_DNS_queue_request_v4 (struct GNUNET_DNS_Handle *h,
-                             const struct in_addr *dst_ip,
-                             const struct in_addr *src_ip,
-                             uint16_t src_port,
-                             size_t udp_packet_len,
-                             const char *udp_packet)
+GNUNET_DNS_request_answer (struct GNUNET_DNS_RequestHandle *rh,  
+                           uint16_t reply_length,
+                           const char *reply)
 {
-  size_t len = sizeof (struct query_packet) + udp_packet_len - 1;
-  struct query_packet_list *query =
-    GNUNET_malloc (len + sizeof (struct query_packet_list) -
-                   sizeof (struct query_packet));
-  query->pkt.hdr.type = htons (GNUNET_MESSAGE_TYPE_VPN_DNS_LOCAL_QUERY_DNS);
-  query->pkt.hdr.size = htons (len);
-  memcpy (query->pkt.orig_to, dst_ip, 4);
-  memcpy (query->pkt.orig_from, src_ip, 4);
-  query->pkt.addrlen = 4;
-  query->pkt.src_port = htons (src_port);
-  memcpy (query->pkt.data, udp_packet, udp_packet_len);  
-  queue_request (h, query);
+  struct ReplyQueueEntry *qe;
+  struct GNUNET_DNS_Response *resp;
+
+  GNUNET_assert (0 < rh->dh->pending_requests--);
+  if (rh->generation != rh->dh->generation)
+  {
+      GNUNET_free (rh);
+      return;
+  }
+  if (reply_length + sizeof (struct GNUNET_DNS_Response) >= GNUNET_SERVER_MAX_MESSAGE_SIZE)
+  {
+    GNUNET_break (0);
+    GNUNET_free (rh);
+    return;
+  }
+  qe = GNUNET_malloc (sizeof (struct ReplyQueueEntry) +
+                      sizeof (struct GNUNET_DNS_Response) + reply_length);
+  resp = (struct GNUNET_DNS_Response*) &qe[1];
+  qe->msg = &resp->header;
+  resp->header.size = htons (sizeof (struct GNUNET_DNS_Response) + reply_length);
+  resp->header.type = htons (GNUNET_MESSAGE_TYPE_DNS_CLIENT_RESPONSE);
+  resp->drop_flag = htonl (2);
+  resp->request_id = rh->request_id;
+  memcpy (&resp[1], reply, reply_length);
+  queue_reply (rh->dh, qe);
+  GNUNET_free (rh);
 }
 
 
 /**
- * Process a DNS request sent to an IPv6 resolver.  Pass it
- * to the DNS service for resolution.
+ * Connect to the service-dns
  *
- * @param h DNS handle
- * @param dst_ip destination IPv6 address
- * @param src_ip source IPv6 address (usually local machine)
- * @param src_port source port (to be used for reply)
- * @param udp_packet_len length of the UDP payload in bytes
- * @param udp_packet UDP payload
+ * @param cfg configuration to use
+ * @param flags when to call rh
+ * @param rh function to call with DNS requests
+ * @param rh_cls closure to pass to rh
+ * @return DNS handle 
  */
-void
-GNUNET_DNS_queue_request_v6 (struct GNUNET_DNS_Handle *h,
-                             const struct in6_addr *dst_ip,
-                             const struct in6_addr *src_ip,
-                             uint16_t src_port,
-                             size_t udp_packet_len,
-                             const char *udp_packet)
+struct GNUNET_DNS_Handle *
+GNUNET_DNS_connect (const struct GNUNET_CONFIGURATION_Handle *cfg,
+                    enum GNUNET_DNS_Flags flags,
+                    GNUNET_DNS_RequestHandler rh,
+                    void *rh_cls)
 {
-  size_t len =
-    sizeof (struct query_packet) + udp_packet_len - 1;
-  struct query_packet_list *query =
-    GNUNET_malloc (len + sizeof (struct query_packet_list) -
-                   sizeof (struct answer_packet));
-  query->pkt.hdr.type =
-    htons (GNUNET_MESSAGE_TYPE_VPN_DNS_LOCAL_QUERY_DNS);
-  query->pkt.hdr.size = htons (len);
-  memcpy (query->pkt.orig_to, dst_ip, 16);
-  memcpy (query->pkt.orig_from, src_ip, 16);
-  query->pkt.addrlen = 16;
-  query->pkt.src_port = htons (src_port);
-  memcpy (query->pkt.data, udp_packet,
-          udp_packet_len);
-  queue_request (h, query);
+  struct GNUNET_DNS_Handle *dh;
+  
+  dh = GNUNET_malloc (sizeof (struct GNUNET_DNS_Handle));
+  dh->cfg = cfg;
+  dh->flags = flags;
+  dh->rh = rh;
+  dh->rh_cls = rh_cls;
+  dh->reconnect_task = GNUNET_SCHEDULER_add_now (&reconnect, dh);
+  return dh;
 }
 
 
+/**
+ * Disconnect from the DNS service.
+ *
+ * @param dh DNS handle
+ */
 void
-GNUNET_DNS_disconnect (struct GNUNET_DNS_Handle *h)
+GNUNET_DNS_disconnect (struct GNUNET_DNS_Handle *dh)
 {
-  if (h->dns_connection != NULL)
+  if (GNUNET_SCHEDULER_NO_TASK != dh->reconnect_task)
   {
-    GNUNET_CLIENT_disconnect (h->dns_connection, GNUNET_NO);
-    h->dns_connection = NULL;
+    GNUNET_SCHEDULER_cancel (dh->reconnect_task);
+    dh->reconnect_task = GNUNET_SCHEDULER_NO_TASK;
   }
-  GNUNET_free (h);
+  disconnect (dh);
+  /* make sure client has no pending requests left over! */
+  GNUNET_assert (0 == dh->pending_requests);
+  GNUNET_free (dh);
 }
 
-/* end of dns_api.c */
+/* end of dns_api_new.c */
diff --git a/src/dns/dns_api_new.c b/src/dns/dns_api_new.c
deleted file mode 100644
index 9e479fce7..000000000
--- a/src/dns/dns_api_new.c
+++ /dev/null
@@ -1,522 +0,0 @@
-/*
-      This file is part of GNUnet
-      (C) 2012 Christian Grothoff (and other contributing authors)
-
-      GNUnet is free software; you can redistribute it and/or modify
-      it under the terms of the GNU General Public License as published
-      by the Free Software Foundation; either version 2, or (at your
-      option) any later version.
-
-      GNUnet is distributed in the hope that it will be useful, but
-      WITHOUT ANY WARRANTY; without even the implied warranty of
-      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-      General Public License for more details.
-
-      You should have received a copy of the GNU General Public License
-      along with GNUnet; see the file COPYING.  If not, write to the
-      Free Software Foundation, Inc., 59 Temple Place - Suite 330,
-      Boston, MA 02111-1307, USA.
- */
-
-/**
- * @file dns/dns_api_new.c
- * @brief API to access the DNS service. 
- * @author Christian Grothoff
- */
-#include "platform.h"
-#include "gnunet_dns_service-new.h"
-#include "dns_new.h"
-
-
-/**
- * Reply to send to service.
- */
-struct ReplyQueueEntry
-{
-  /**
-   * Kept in DLL.
-   */
-  struct ReplyQueueEntry *next;
-
-  /**
-   * Kept in DLL.
-   */
-  struct ReplyQueueEntry *prev;
-
-  /**
-   * Message to transmit, allocated at the end of this struct.
-   */
-  const struct GNUNET_MessageHeader *msg;
-
-};
-
-
-/**
- * Handle to identify an individual DNS request.
- */
-struct GNUNET_DNS_RequestHandle
-{
-
-  /**
-   * Handle to DNS API.
-   */
-  struct GNUNET_DNS_Handle *dh;
-
-  /**
-   * Stored in network byte order (as for us, it is just a random number).
-   */
-  uint64_t request_id;
-
-  /**
-   * Re-connect counter, to make sure we did not reconnect in the meantime.
-   */
-  uint32_t generation;
-
-};
-
-
-/**
- * DNS handle
- */
-struct GNUNET_DNS_Handle
-{
-
-  /**
-   * Connection to DNS service, or NULL.
-   */
-  struct GNUNET_CLIENT_Connection *dns_connection;
-
-  /**
-   * Handle to active transmission request, or NULL.
-   */
-  struct GNUNET_CLIENT_TransmitHandle *dns_transmit_handle;
-
-  /**
-   * Configuration to use.
-   */
-  const struct GNUNET_CONFIGURATION_Handle *cfg;
-
-  /**
-   * Function to call to get replies.
-   */
-  GNUNET_DNS_RequestHandler rh;
-  
-  /**
-   * Closure for 'rh'.
-   */
-  void *rh_cls;
-
-  /**
-   * Head of replies to transmit.
-   */
-  struct ReplyQueueEntry *rq_head;
-
-  /**
-   * Tail of replies to transmit.
-   */
-  struct ReplyQueueEntry *rq_tail;
-
-  /**
-   * Task to reconnect to the service.
-   */
-  GNUNET_SCHEDULER_TaskIdentifier reconnect_task;
-
-  /**
-   * Re-connect counter, to make sure we did not reconnect in the meantime.
-   */
-  uint32_t generation;
-  
-  /**
-   * Flags for events we care about.
-   */
-  enum GNUNET_DNS_Flags flags;
-
-  /**
-   * Did we start the receive loop yet?
-   */
-  int in_receive;
-
-  /**
-   * Number of GNUNET_DNS_RequestHandles we have outstanding. Must be 0 before
-   * we can be disconnected.
-   */
-  unsigned int pending_requests;
-};
-
-
-/**
- * Add the given reply to our transmission queue and trigger sending if needed.
- *
- * @param dh handle with the connection
- * @param qe reply to queue
- */
-static void
-queue_reply (struct GNUNET_DNS_Handle *dh,
-             struct ReplyQueueEntry *qe);
-
-
-/**
- * Reconnect to the DNS service.
- *
- * @param cls handle with the connection to connect
- * @param tc scheduler context (unused)
- */
-static void
-reconnect (void *cls,
-           const struct GNUNET_SCHEDULER_TaskContext *tc)
-{
-  struct GNUNET_DNS_Handle *dh = cls;
-  struct ReplyQueueEntry *qe;
-  struct GNUNET_DNS_Register *msg;
-
-  dh->reconnect_task = GNUNET_SCHEDULER_NO_TASK;
-  dh->dns_connection = GNUNET_CLIENT_connect ("dns", dh->cfg);
-  if (NULL == dh->dns_connection)
-    return;
-  dh->generation++;
-  qe = GNUNET_malloc (sizeof (struct ReplyQueueEntry) +
-                      sizeof (struct GNUNET_DNS_Register));
-  msg = (struct GNUNET_DNS_Register*) &qe[1];
-  qe->msg = &msg->header;
-  msg->header.size = htons (sizeof (struct GNUNET_DNS_Register));
-  msg->header.type = htons (GNUNET_MESSAGE_TYPE_DNS_CLIENT_INIT);
-  msg->flags = htonl (dh->flags);
-  queue_reply (dh, qe);
-}
-
-
-/**
- * Disconnect from the DNS service.
- *
- * @param dh handle with the connection to disconnect
- */
-static void
-disconnect (struct GNUNET_DNS_Handle *dh)
-{
-  struct ReplyQueueEntry *qe;
-
-  if (NULL != dh->dns_transmit_handle)
-  {
-    GNUNET_CLIENT_notify_transmit_ready_cancel (dh->dns_transmit_handle);
-    dh->dns_transmit_handle = NULL;
-  }
-  if (NULL != dh->dns_connection)
-  {
-    GNUNET_CLIENT_disconnect (dh->dns_connection, GNUNET_NO);
-    dh->dns_connection = NULL;
-  }
-  while (NULL != (qe = dh->rq_head))
-  {
-    GNUNET_CONTAINER_DLL_remove (dh->rq_head,
-                                 dh->rq_tail,
-                                 qe);
-    GNUNET_free (qe);
-  }
-  dh->in_receive = GNUNET_NO;
-}
-
-
-/**
- * This receives packets from the DNS service and calls the application to
- * handle it.
- *
- * @param cls the struct GNUNET_DNS_Handle
- * @param msg message from the service (request)
- */
-static void
-request_handler (void *cls,
-                 const struct GNUNET_MessageHeader *msg)
-{
-  struct GNUNET_DNS_Handle *dh = cls;
-  const struct GNUNET_DNS_Request *req;
-  struct GNUNET_DNS_RequestHandle *rh;
-  size_t payload_length;
-
-  /* the service disconnected, reconnect after short wait */
-  if (msg == NULL)
-  {
-    disconnect (dh);
-    dh->reconnect_task =
-        GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_UNIT_SECONDS,
-                                      &reconnect, dh);
-    return;
-  }
-  if ( (ntohs (msg->type) != GNUNET_MESSAGE_TYPE_DNS_CLIENT_REQUEST) ||
-       (ntohs (msg->size) < sizeof (struct GNUNET_DNS_Request)) )
-  {
-    /* the service did something strange, reconnect immediately */
-    GNUNET_break (0);
-    disconnect (dh);
-    dh->reconnect_task = GNUNET_SCHEDULER_add_now (&reconnect, dh);
-    return;
-  }
-  req = (const struct GNUNET_DNS_Request *) msg;
-  GNUNET_break (ntohl (req->reserved) == 0);
-  payload_length = ntohs (req->header.size) - sizeof (struct GNUNET_DNS_Request);
-  GNUNET_CLIENT_receive (dh->dns_connection, 
-                         &request_handler, dh,
-                         GNUNET_TIME_UNIT_FOREVER_REL);
-
-  /* finally, pass request to callback for answers */
-  rh = GNUNET_malloc (sizeof (struct GNUNET_DNS_RequestHandle));
-  rh->dh =dh;
-  rh->request_id = req->request_id;
-  rh->generation = dh->generation;  
-  dh->pending_requests++;
-  dh->rh (dh->rh_cls,
-          rh,
-          payload_length,
-          (const char*) &req[1]);
-}
-
-
-/**
- * Callback called by notify_transmit_ready; sends DNS replies
- * to the DNS service.
- *
- * @param cls the struct GNUNET_DNS_Handle
- * @param size number of bytes available in buf
- * @param buf where to copy the message for transmission
- * @return number of bytes copied to buf
- */
-static size_t
-send_response (void *cls, size_t size, void *buf)
-{
-  struct GNUNET_DNS_Handle *dh = cls;
-  struct ReplyQueueEntry *qe;
-  size_t len;
- 
-  dh->dns_transmit_handle = NULL;
-  if (NULL == buf)
-  {
-    disconnect (dh);
-    dh->reconnect_task =
-      GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_UNIT_SECONDS,
-                                    &reconnect, dh);
-    return 0;
-  }
-  qe = dh->rq_head;
-  if (NULL == qe)
-    return 0;
-  len = ntohs (qe->msg->size);
-  if (len > size)
-  {   
-    dh->dns_transmit_handle =
-      GNUNET_CLIENT_notify_transmit_ready (dh->dns_connection,
-                                           len,
-                                           GNUNET_TIME_UNIT_FOREVER_REL,
-                                           GNUNET_NO, 
-                                           &send_response, dh);
-    return 0;
-  }
-  memcpy (buf, qe->msg, len);
-  GNUNET_CONTAINER_DLL_remove (dh->rq_head,
-                               dh->rq_tail,
-                               qe);
-  GNUNET_free (qe);
-  if (GNUNET_NO == dh->in_receive)
-  {
-    dh->in_receive = GNUNET_YES;
-    GNUNET_CLIENT_receive (dh->dns_connection, 
-                           &request_handler, dh,
-                           GNUNET_TIME_UNIT_FOREVER_REL);
-  }
-  if (NULL != (qe = dh->rq_head))
-  {
-    dh->dns_transmit_handle =
-      GNUNET_CLIENT_notify_transmit_ready (dh->dns_connection,
-                                           ntohs (qe->msg->size),
-                                           GNUNET_TIME_UNIT_FOREVER_REL,
-                                           GNUNET_NO, 
-                                           &send_response, dh);
-  }
-  return len;
-} 
-
-
-/**
- * Add the given reply to our transmission queue and trigger sending if needed.
- *
- * @param dh handle with the connection
- * @param qe reply to queue
- */
-static void
-queue_reply (struct GNUNET_DNS_Handle *dh,
-             struct ReplyQueueEntry *qe)
-{
-  if (NULL == dh->dns_connection)        
-  {
-    GNUNET_free (qe);
-    return;
-  }
-  GNUNET_CONTAINER_DLL_insert_tail (dh->rq_head,
-                                    dh->rq_tail,
-                                    qe);
-  if (NULL != dh->dns_transmit_handle)
-    return;
-  /* trigger sending */ 
-  dh->dns_transmit_handle =
-    GNUNET_CLIENT_notify_transmit_ready (dh->dns_connection,
-                                         ntohs (dh->rq_head->msg->size),
-                                         GNUNET_TIME_UNIT_FOREVER_REL,
-                                         GNUNET_NO, 
-                                         &send_response, dh);
-}
-
-
-/**
- * If a GNUNET_DNS_RequestHandler calls this function, the request is
- * given to other clients or the global DNS for resolution.  Once a
- * global response has been obtained, the request handler is AGAIN
- * called to give it a chance to observe and modify the response after
- * the "normal" resolution.  It is not legal for the request handler
- * to call this function if a response is already present.
- *
- * @param rh request that should now be forwarded
- */
-void
-GNUNET_DNS_request_forward (struct GNUNET_DNS_RequestHandle *rh)
-{
-  struct ReplyQueueEntry *qe;
-  struct GNUNET_DNS_Response *resp;
-
-  GNUNET_assert (0 < rh->dh->pending_requests--);
-  if (rh->generation != rh->dh->generation)
-  {
-    GNUNET_free (rh);
-    return;
-  }
-  qe = GNUNET_malloc (sizeof (struct ReplyQueueEntry) +
-                      sizeof (struct GNUNET_DNS_Response));
-  resp = (struct GNUNET_DNS_Response*) &qe[1];
-  qe->msg = &resp->header;
-  resp->header.size = htons (sizeof (struct GNUNET_DNS_Response));
-  resp->header.type = htons (GNUNET_MESSAGE_TYPE_DNS_CLIENT_RESPONSE);
-  resp->drop_flag = htonl (1);
-  resp->request_id = rh->request_id;
-  queue_reply (rh->dh, qe);
-  GNUNET_free (rh);
-}
-
-
-/**
- * If a GNUNET_DNS_RequestHandler calls this function, the request is
- * to be dropped and no response should be generated.
- *
- * @param rh request that should now be dropped
- */
-void
-GNUNET_DNS_request_drop (struct GNUNET_DNS_RequestHandle *rh)
-{
-  struct ReplyQueueEntry *qe;
-  struct GNUNET_DNS_Response *resp;
-
-  GNUNET_assert (0 < rh->dh->pending_requests--);
-  if (rh->generation != rh->dh->generation)
-  {
-      GNUNET_free (rh);
-      return;
-  }
-  qe = GNUNET_malloc (sizeof (struct ReplyQueueEntry) +
-                      sizeof (struct GNUNET_DNS_Response));
-  resp = (struct GNUNET_DNS_Response*) &qe[1];
-  qe->msg = &resp->header;
-  resp->header.size = htons (sizeof (struct GNUNET_DNS_Response));
-  resp->header.type = htons (GNUNET_MESSAGE_TYPE_DNS_CLIENT_RESPONSE);
-  resp->request_id = rh->request_id;
-  resp->drop_flag = htonl (0);
-  queue_reply (rh->dh, qe);
-  GNUNET_free (rh);
-}
-
-
-/**
- * If a GNUNET_DNS_RequestHandler calls this function, the request is
- * supposed to be answered with the data provided to this call (with
- * the modifications the function might have made).
- *
- * @param rh request that should now be answered
- * @param reply_length size of reply (uint16_t to force sane size)
- * @param reply reply data
- */
-void
-GNUNET_DNS_request_answer (struct GNUNET_DNS_RequestHandle *rh,  
-                           uint16_t reply_length,
-                           const char *reply)
-{
-  struct ReplyQueueEntry *qe;
-  struct GNUNET_DNS_Response *resp;
-
-  GNUNET_assert (0 < rh->dh->pending_requests--);
-  if (rh->generation != rh->dh->generation)
-  {
-      GNUNET_free (rh);
-      return;
-  }
-  if (reply_length + sizeof (struct GNUNET_DNS_Response) >= GNUNET_SERVER_MAX_MESSAGE_SIZE)
-  {
-    GNUNET_break (0);
-    GNUNET_free (rh);
-    return;
-  }
-  qe = GNUNET_malloc (sizeof (struct ReplyQueueEntry) +
-                      sizeof (struct GNUNET_DNS_Response) + reply_length);
-  resp = (struct GNUNET_DNS_Response*) &qe[1];
-  qe->msg = &resp->header;
-  resp->header.size = htons (sizeof (struct GNUNET_DNS_Response) + reply_length);
-  resp->header.type = htons (GNUNET_MESSAGE_TYPE_DNS_CLIENT_RESPONSE);
-  resp->drop_flag = htonl (2);
-  resp->request_id = rh->request_id;
-  memcpy (&resp[1], reply, reply_length);
-  queue_reply (rh->dh, qe);
-  GNUNET_free (rh);
-}
-
-
-/**
- * Connect to the service-dns
- *
- * @param cfg configuration to use
- * @param flags when to call rh
- * @param rh function to call with DNS requests
- * @param rh_cls closure to pass to rh
- * @return DNS handle 
- */
-struct GNUNET_DNS_Handle *
-GNUNET_DNS_connect (const struct GNUNET_CONFIGURATION_Handle *cfg,
-                    enum GNUNET_DNS_Flags flags,
-                    GNUNET_DNS_RequestHandler rh,
-                    void *rh_cls)
-{
-  struct GNUNET_DNS_Handle *dh;
-  
-  dh = GNUNET_malloc (sizeof (struct GNUNET_DNS_Handle));
-  dh->cfg = cfg;
-  dh->flags = flags;
-  dh->rh = rh;
-  dh->rh_cls = rh_cls;
-  dh->reconnect_task = GNUNET_SCHEDULER_add_now (&reconnect, dh);
-  return dh;
-}
-
-
-/**
- * Disconnect from the DNS service.
- *
- * @param dh DNS handle
- */
-void
-GNUNET_DNS_disconnect (struct GNUNET_DNS_Handle *dh)
-{
-  if (GNUNET_SCHEDULER_NO_TASK != dh->reconnect_task)
-  {
-    GNUNET_SCHEDULER_cancel (dh->reconnect_task);
-    dh->reconnect_task = GNUNET_SCHEDULER_NO_TASK;
-  }
-  disconnect (dh);
-  /* make sure client has no pending requests left over! */
-  GNUNET_assert (0 == dh->pending_requests);
-  GNUNET_free (dh);
-}
-
-/* end of dns_api_new.c */
diff --git a/src/dns/dns_new.h b/src/dns/dns_new.h
deleted file mode 100644
index 29a9f937b..000000000
--- a/src/dns/dns_new.h
+++ /dev/null
@@ -1,101 +0,0 @@
-/*
-      This file is part of GNUnet
-      (C) 2012 Christian Grothoff (and other contributing authors)
-
-      GNUnet is free software; you can redistribute it and/or modify
-      it under the terms of the GNU General Public License as published
-      by the Free Software Foundation; either version 2, or (at your
-      option) any later version.
-
-      GNUnet is distributed in the hope that it will be useful, but
-      WITHOUT ANY WARRANTY; without even the implied warranty of
-      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-      General Public License for more details.
-
-      You should have received a copy of the GNU General Public License
-      along with GNUnet; see the file COPYING.  If not, write to the
-      Free Software Foundation, Inc., 59 Temple Place - Suite 330,
-      Boston, MA 02111-1307, USA.
- */
-
-/**
- * @file dns/dns_new.h
- * @brief IPC messages between DNS API and DNS service
- * @author Christian Grothoff
- */
-#ifndef DNS_NEW_H
-#define DNS_NEW_H
-
-GNUNET_NETWORK_STRUCT_BEGIN
-
-
-/**
- * Message from client to DNS service to register itself.
- */
-struct GNUNET_DNS_Register
-{
-  /**
-    * Header of type GNUNET_MESSAGE_TYPE_DNS_CLIENT_INIT
-   */
-  struct GNUNET_MessageHeader header;
-
-  /**
-   * NBO encoding of 'enum GNUNET_DNS_Flags' for the client.
-   */
-  uint32_t flags;
-};
-
-
-/**
- * Message from DNS service to client: please handle a request.
- */
-struct GNUNET_DNS_Request
-{
-  /**
-    * Header of type GNUNET_MESSAGE_TYPE_DNS_CLIENT_REQUEST
-   */
-  struct GNUNET_MessageHeader header;
-
-  /**
-   * Always zero.
-   */
-  uint32_t reserved GNUNET_PACKED;
-  
-  /**
-   * Unique request ID.
-   */
-  uint64_t request_id GNUNET_PACKED;
-
-  /* followed by original DNS request (without UDP header) */
-
-};
-
-
-/**
- * Message from client to DNS service: here is my reply.
- */
-struct GNUNET_DNS_Response
-{
-  /**
-   * Header of type GNUNET_MESSAGE_TYPE_DNS_CLIENT_RESPONSE
-   */
-  struct GNUNET_MessageHeader header;
-
-  /**
-   * Zero to drop, 1 for no change (no payload), 2 for update (message has payload).
-   */
-  uint32_t drop_flag GNUNET_PACKED;
-  
-  /**
-   * Unique request ID.
-   */
-  uint64_t request_id GNUNET_PACKED;
-
-  /* followed by original DNS request (without UDP header) */
-
-};
-
-
-GNUNET_NETWORK_STRUCT_END
-
-#endif
diff --git a/src/dns/dnsparser.c b/src/dns/dnsparser.c
index 2e9e73f1c..12253a2e7 100644
--- a/src/dns/dnsparser.c
+++ b/src/dns/dnsparser.c
@@ -793,331 +793,4 @@ GNUNET_DNSPARSER_pack (const struct GNUNET_DNSPARSER_Packet *p,
   return GNUNET_OK;
 }
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-/* legacy code follows */
-
-/**
- * Parse a name from DNS to a normal .-delimited, 0-terminated string.
- *
- * @param d The destination of the name. Should have at least 255 bytes allocated.
- * @param src The DNS-Packet
- * @param idx The offset inside the Packet from which on the name should be read
- * @returns The offset of the first unparsed byte (the byte right behind the name)
- */
-static unsigned int
-parse_dns_name (char *d, const unsigned char *src, unsigned short idx)
-{                               /*{{{ */
-  char *dest = d;
-
-  int len = src[idx++];
-
-  while (len != 0)
-  {
-    if (len & 0xC0)
-    {                           /* Compressed name, offset in this and the next octet */
-      unsigned short offset = ((len & 0x3F) << 8) | src[idx++];
-
-      parse_dns_name (dest, src, offset - 12);  /* 12 for the Header of the DNS-Packet, idx starts at 0 which is 12 bytes from the start of the packet */
-      return idx;
-    }
-    memcpy (dest, src + idx, len);
-    idx += len;
-    dest += len;
-    *dest = '.';
-    dest++;
-    len = src[idx++];
-  };
-  *dest = 0;
-
-  return idx;
-}
-
-/*}}}*/
-
-/**
- * Parse a complete DNS-Record from raw DNS-data to a struct dns_record
- *
- * @param data The DNS-data
- * @param dst Pointer to count pointers; individual pointers will be allocated
- * @param count Number of records to parse
- * @param idx The offset inside the Packet from which on the name should be read
- * @returns The offset of the first unparsed byte (the byte right behind the last record)
- */
-static unsigned short
-parse_dns_record (unsigned char *data,  /*{{{ */
-                  struct dns_record **dst, unsigned short count,
-                  unsigned short idx)
-{
-  int i;
-  unsigned short _idx;
-
-  for (i = 0; i < count; i++)
-  {
-    dst[i] = GNUNET_malloc (sizeof (struct dns_record));
-    dst[i]->name = alloca (255);        // see RFC1035, no name can be longer than this.
-    char *name = dst[i]->name;
-
-    _idx = parse_dns_name (name, data, idx);
-    dst[i]->namelen = _idx - idx;
-
-    dst[i]->name = GNUNET_malloc (dst[i]->namelen);
-    memcpy (dst[i]->name, name, dst[i]->namelen);
-
-    idx = _idx;
-
-    dst[i]->type = *((unsigned short *) (data + idx));
-    idx += 2;
-    dst[i]->class = *((unsigned short *) (data + idx));
-    idx += 2;
-    dst[i]->ttl = *((unsigned int *) (data + idx));
-    idx += 4;
-    dst[i]->data_len = *((unsigned short *) (data + idx));
-    idx += 2;
-    dst[i]->data = GNUNET_malloc (ntohs (dst[i]->data_len));
-    memcpy (dst[i]->data, data + idx, ntohs (dst[i]->data_len));
-    idx += ntohs (dst[i]->data_len);
-  }
-  return idx;
-}                               /*}}} */
-
-/**
- * Parse a raw DNS-Packet into an usable struct
- */
-struct dns_pkt_parsed *
-parse_dns_packet (struct dns_pkt *pkt)
-{                               /*{{{ */
-  struct dns_pkt_parsed *ppkt = GNUNET_malloc (sizeof (struct dns_pkt_parsed));
-
-  memcpy (&ppkt->s, &pkt->s, sizeof pkt->s);
-
-  unsigned short qdcount = ntohs (ppkt->s.qdcount);
-  unsigned short ancount = ntohs (ppkt->s.ancount);
-  unsigned short nscount = ntohs (ppkt->s.nscount);
-  unsigned short arcount = ntohs (ppkt->s.arcount);
-
-  ppkt->queries = GNUNET_malloc (qdcount * sizeof (struct dns_query *));
-  ppkt->answers = GNUNET_malloc (ancount * sizeof (struct dns_record *));
-  ppkt->nameservers = GNUNET_malloc (nscount * sizeof (struct dns_record *));
-  ppkt->additional = GNUNET_malloc (arcount * sizeof (struct dns_record *));
-
-  unsigned short idx = 0, _idx; /* This keeps track how far we have parsed the data */
-
-  /* Parse the Query */
-  int i;
-
-  for (i = 0; i < qdcount; i++)
-  {                             /*{{{ */
-    ppkt->queries[i] = GNUNET_malloc (sizeof (struct dns_query));
-    char *name = alloca (255);  /* see RFC1035, it can't be more than this. */
-
-    _idx = parse_dns_name (name, pkt->data, idx);
-    ppkt->queries[i]->namelen = _idx - idx;
-    idx = _idx;
-
-    ppkt->queries[i]->name = GNUNET_malloc (ppkt->queries[i]->namelen);
-    memcpy (ppkt->queries[i]->name, name, ppkt->queries[i]->namelen);
-
-    ppkt->queries[i]->qtype = *((unsigned short *) (pkt->data + idx));
-    idx += 2;
-    ppkt->queries[i]->qclass = *((unsigned short *) (pkt->data + idx));
-    idx += 2;
-  }
-  /*}}} */
-  idx = parse_dns_record (pkt->data, ppkt->answers, ancount, idx);
-  idx = parse_dns_record (pkt->data, ppkt->nameservers, nscount, idx);
-  idx = parse_dns_record (pkt->data, ppkt->additional, arcount, idx);
-  return ppkt;
-}                               /*}}} */
-
-static void
-unparse_dns_name (char *dest, char *src, size_t len)
-{
-  char *b = dest;
-  char cnt = 0;
-
-  dest++;
-  while (*src != 0)
-  {
-    while (*src != '.' && *src != 0)
-    {
-      *dest = *src;
-      src++;
-      dest++;
-      cnt++;
-    }
-    *b = cnt;
-    cnt = 0;
-    b = dest;
-    dest++;
-    src++;
-  }
-  *b = 0;
-}
-
-struct dns_pkt *
-unparse_dns_packet (struct dns_pkt_parsed *ppkt)
-{
-  size_t size = sizeof (struct dns_pkt) - 1;
-  int i;
-
-  for (i = 0; i < ntohs (ppkt->s.qdcount); i++)
-    size += ppkt->queries[i]->namelen + 1;
-
-  for (i = 0; i < ntohs (ppkt->s.ancount); i++)
-  {
-    size += ppkt->answers[i]->namelen + 1;
-    size += ppkt->answers[i]->data_len;
-  }
-  for (i = 0; i < ntohs (ppkt->s.nscount); i++)
-  {
-    size += ppkt->nameservers[i]->namelen + 1;
-    size += ppkt->nameservers[i]->data_len;
-  }
-  for (i = 0; i < ntohs (ppkt->s.arcount); i++)
-  {
-    size += ppkt->additional[i]->namelen + 1;
-    size += ppkt->additional[i]->data_len;
-  }
-
-  size +=
-      4 * ntohs (ppkt->s.qdcount) + 10 * (ntohs (ppkt->s.ancount) +
-                                          ntohs (ppkt->s.arcount) +
-                                          ntohs (ppkt->s.nscount));
-
-  struct dns_pkt *pkt = GNUNET_malloc (size);
-  char *pkt_c = (char *) pkt;
-
-  memcpy (&pkt->s, &ppkt->s, sizeof ppkt->s);
-  size_t idx = sizeof ppkt->s;
-
-  for (i = 0; i < ntohs (ppkt->s.qdcount); i++)
-  {
-    unparse_dns_name (&pkt_c[idx], ppkt->queries[i]->name,
-                      ppkt->queries[i]->namelen);
-    idx += ppkt->queries[i]->namelen;
-    struct dns_query_line *d = (struct dns_query_line *) &pkt_c[idx];
-
-    d->class = ppkt->queries[i]->qclass;
-    d->type = ppkt->queries[i]->qtype;
-    idx += sizeof (struct dns_query_line);
-  }
-
-  for (i = 0; i < ntohs (ppkt->s.ancount); i++)
-  {
-    unparse_dns_name (&pkt_c[idx], ppkt->answers[i]->name,
-                      ppkt->answers[i]->namelen);
-    idx += ppkt->answers[i]->namelen;
-    struct dns_record_line *r = (struct dns_record_line *) &pkt_c[idx];
-
-    r->type = ppkt->answers[i]->type;
-    r->class = ppkt->answers[i]->class;
-    r->ttl = ppkt->answers[i]->ttl;
-    r->data_len = ppkt->answers[i]->data_len;
-    idx += sizeof (struct dns_record_line);
-    memcpy (&r->data, ppkt->answers[i]->data, ppkt->answers[i]->data_len);
-    idx += ppkt->answers[i]->data_len;
-  }
-
-  for (i = 0; i < ntohs (ppkt->s.nscount); i++)
-  {
-    unparse_dns_name (&pkt_c[idx], ppkt->nameservers[i]->name,
-                      ppkt->nameservers[i]->namelen);
-    idx += ppkt->nameservers[i]->namelen;
-    struct dns_record_line *r = (struct dns_record_line *) &pkt_c[idx];
-
-    r->type = ppkt->nameservers[i]->type;
-    r->class = ppkt->nameservers[i]->class;
-    r->ttl = ppkt->nameservers[i]->ttl;
-    r->data_len = ppkt->nameservers[i]->data_len;
-    idx += sizeof (struct dns_record_line);
-    memcpy (&r->data, ppkt->nameservers[i]->data,
-            ppkt->nameservers[i]->data_len);
-    idx += ppkt->nameservers[i]->data_len;
-  }
-
-  for (i = 0; i < ntohs (ppkt->s.arcount); i++)
-  {
-    unparse_dns_name (&pkt_c[idx], ppkt->additional[i]->name,
-                      ppkt->additional[i]->namelen);
-    idx += ppkt->additional[i]->namelen;
-    struct dns_record_line *r = (struct dns_record_line *) &pkt_c[idx];
-
-    r->type = ppkt->additional[i]->type;
-    r->class = ppkt->additional[i]->class;
-    r->ttl = ppkt->additional[i]->ttl;
-    r->data_len = ppkt->additional[i]->data_len;
-    idx += sizeof (struct dns_record_line);
-    memcpy (&r->data, ppkt->additional[i]->data, ppkt->additional[i]->data_len);
-    idx += ppkt->additional[i]->data_len;
-  }
-
-  return pkt;
-}
-
-void
-free_parsed_dns_packet (struct dns_pkt_parsed *ppkt)
-{
-  unsigned short qdcount = ntohs (ppkt->s.qdcount);
-  unsigned short ancount = ntohs (ppkt->s.ancount);
-  unsigned short nscount = ntohs (ppkt->s.nscount);
-  unsigned short arcount = ntohs (ppkt->s.arcount);
-
-  int i;
-
-  for (i = 0; i < qdcount; i++)
-  {
-    GNUNET_free (ppkt->queries[i]->name);
-    GNUNET_free (ppkt->queries[i]);
-  }
-  GNUNET_free (ppkt->queries);
-  for (i = 0; i < ancount; i++)
-  {
-    GNUNET_free (ppkt->answers[i]->name);
-    GNUNET_free (ppkt->answers[i]->data);
-    GNUNET_free (ppkt->answers[i]);
-  }
-  GNUNET_free (ppkt->answers);
-  for (i = 0; i < nscount; i++)
-  {
-    GNUNET_free (ppkt->nameservers[i]->name);
-    GNUNET_free (ppkt->nameservers[i]->data);
-    GNUNET_free (ppkt->nameservers[i]);
-  }
-  GNUNET_free (ppkt->nameservers);
-  for (i = 0; i < arcount; i++)
-  {
-    GNUNET_free (ppkt->additional[i]->name);
-    GNUNET_free (ppkt->additional[i]->data);
-    GNUNET_free (ppkt->additional[i]);
-  }
-  GNUNET_free (ppkt->additional);
-  GNUNET_free (ppkt);
-}
+/* end of dnsparser.c */
diff --git a/src/dns/gnunet-dns-monitor.c b/src/dns/gnunet-dns-monitor.c
index 9e86f9c2d..3c7f31985 100644
--- a/src/dns/gnunet-dns-monitor.c
+++ b/src/dns/gnunet-dns-monitor.c
@@ -26,7 +26,7 @@
 
 #include "platform.h"
 #include "gnunet_util_lib.h"
-#include "gnunet_dns_service-new.h"
+#include "gnunet_dns_service.h"
 #include "gnunet_dnsparser_lib.h"
 
 /**
diff --git a/src/dns/gnunet-dns-redirector.c b/src/dns/gnunet-dns-redirector.c
index 4eabc8c79..41667ee9f 100644
--- a/src/dns/gnunet-dns-redirector.c
+++ b/src/dns/gnunet-dns-redirector.c
@@ -26,7 +26,7 @@
 
 #include "platform.h"
 #include "gnunet_util_lib.h"
-#include "gnunet_dns_service-new.h"
+#include "gnunet_dns_service.h"
 #include "gnunet_dnsparser_lib.h"
 
 /**
diff --git a/src/dns/gnunet-helper-hijack-dns.c b/src/dns/gnunet-helper-hijack-dns.c
deleted file mode 100644
index 833bda8ad..000000000
--- a/src/dns/gnunet-helper-hijack-dns.c
+++ /dev/null
@@ -1,328 +0,0 @@
-/*
-   This file is part of GNUnet.
-   (C) 2010, 2011, 2012 Christian Grothoff
-
-   GNUnet is free software; you can redistribute it and/or modify
-   it under the terms of the GNU General Public License as published
-   by the Free Software Foundation; either version 3, or (at your
-   option) any later version.
-
-   GNUnet is distributed in the hope that it will be useful, but
-   WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with GNUnet; see the file COPYING.  If not, write to the
-   Free Software Foundation, Inc., 59 Temple Place - Suite 330,
-   Boston, MA 02111-1307, USA.
-   */
-
-/**
- * @file dns/gnunet-helper-hijack-dns.c
- * @brief helper to install firewall rules to hijack all DNS traffic
- *        and send it to our virtual interface except for DNS traffic
- *        that originates on the specified port. 
- * @author Philipp Tölke
- * @author Christian Grothoff
- *
- * This program alters the Linux firewall rules so that DNS traffic
- * that ordinarily exits the system can be intercepted and managed by
- * a virtual interface.  In order to achieve this, DNS traffic is
- * marked with the DNS_MARK given in below and re-routed to a custom
- * table with the DNS_TABLE ID given below.  Systems and
- * administrators must take care to not cause conflicts with these
- * values (it was deemed safest to hardcode them as passing these
- * values as arguments might permit messing with arbitrary firewall
- * rules, which would be dangerous).
- *
- * Note that having this binary SUID is only partially safe: it will
- * allow redirecting (and intercepting / mangling) of all DNS traffic
- * originating from this system by any user who can create a virtual
- * interface (and this is again enabled by other GNUnet SUID
- * binaries).  Furthermore, even without the ability to create a
- * tunnel interface, this code will make it possible to DoS all DNS
- * traffic originating from the current system, simply by sending it
- * to nowhere.  
- *
- * Naturally, neither of these problems can be helped as this is the
- * fundamental purpose of the binary.  Certifying that this code is
- * "safe" thus only means that it doesn't allow anything else (such
- * as local priv. escalation, etc.). 
- *
- * The following list of people have reviewed this code and considered
- * it safe (within specifications) since the last modification (if you
- * reviewed it, please have your name added to the list):
- *
- * - Christian Grothoff 
- */
-#include "platform.h"
-
-/**
- * Name and full path of IPTABLES binary.
- */
-#define SBIN_IPTABLES "/sbin/iptables"
-
-/**
- * Name and full path of IPTABLES binary.
- */
-#define SBIN_IP "/sbin/ip"
-
-/**
- * Port for DNS traffic.
- */
-#define DNS_PORT "53"
-
-/**
- * Marker we set for our hijacked DNS traffic.  We use GNUnet's
- * port (2086) plus the DNS port (53) in HEX to make a 32-bit mark
- * (which is hopefully long enough to not collide); so
- * 0x08260035 = 136708149 (hopefully unique enough...).
- */
-#define DNS_MARK "136708149"
-
-/**
- * Table we use for our DNS rules.  0-255 is the range and
- * 0, 253, 254 and 255 are already reserved.  As this is about
- * DNS and as "53" is likely (fingers crossed!) high enough to
- * not usually conflict with a normal user's setup, we use 53
- * to give a hint that this has something to do with DNS.
- */
-#define DNS_TABLE "53"
-
-
-/**
- * Run the given command and wait for it to complete.
- * 
- * @param file name of the binary to run
- * @param cmd command line arguments (as given to 'execv')
- * @return 0 on success, 1 on any error
- */
-static int
-fork_and_exec (const char *file, 
-               char *const cmd[])
-{
-  int status;
-  pid_t pid;
-  pid_t ret;
-
-  pid = fork ();
-  if (-1 == pid)
-  {
-    fprintf (stderr, 
-             "fork failed: %s\n", 
-             strerror (errno));
-    return 1;
-  }
-  if (0 == pid)
-  {
-    /* we are the child process */
-    (void) execv (file, cmd);
-    /* can only get here on error */
-    fprintf (stderr, 
-             "exec `%s' failed: %s\n", 
-             file,
-             strerror (errno));
-    _exit (1);
-  }
-  /* keep running waitpid as long as the only error we get is 'EINTR' */
-  while ( (-1 == (ret = waitpid (pid, &status, 0))) &&
-          (errno == EINTR) ); 
-  if (-1 == ret)
-  {
-    fprintf (stderr, 
-             "waitpid failed: %s\n", 
-             strerror (errno));
-    return 1;
-  }
-  if (! (WIFEXITED (status) && (0 == WEXITSTATUS (status))))
-    return 1;
-  /* child process completed and returned success, we're happy */
-  return 0;
-}
-
-
-/**
- * Main function of "gnunet-helper-hijack-dns".  
- * Use "-d" as the first argument to remove the firewall rules.
- * The other arguments are the DNS source port to NOT affect
- * by the rules, followed by the name of the virtual interface
- * to redirect all of the remaining DNS traffic to.
- *
- * @param argc number of arguments
- * @param argv ["-d"] PORT VTUN
- * @return 0 on success, otherwise code indicating type of error:
- *         1 wrong number of arguments
- *         2 invalid port number
- *         3 iptables not executable
- *         4 ip not executable
- *         8 failed to change routing table, cleanup successfull
- *         16-31 failed to undo some changes to routing table
- *         31-47 failed to fully change routing table and then might have failed to undo everything
- */
-int
-main (int argc, char *const*argv)
-{
-  int delete;
-  unsigned int port;
-  char *virt_dns;
-  char localport[6];
-  int r;
-
-  /* check command-line arguments */
-  if (argc < 3)
-  {
-    fprintf (stderr, 
-             "Syntax: gnunet-helper-hijack-dns [-d] PORT INTERFACENAME\n");
-    return 1;
-  }
-  if (0 == strcmp (argv[1], "-d"))
-    delete = 1;
-  else
-    delete = 0;
-  if (argc != 3 + delete)
-  {
-    fprintf (stderr, 
-             "Syntax: gnunet-helper-hijack-dns [-d] PORT INTERFACENAME\n");
-    return 1;
-  }  
-  port = atoi (argv[1 + delete]);
-  virt_dns = argv[2 + delete];
-  if ( (port == 0) || (port >= 65536) )
-  {
-    fprintf (stderr, 
-             "Port `%u' is invalid\n",
-             port);
-    return 2;
-  }
-  /* verify that the binaries were care about are executable */
-  if (0 != access (SBIN_IPTABLES, X_OK))
-  {
-    fprintf (stderr, 
-             "`%s' is not executable: %s\n", 
-             SBIN_IPTABLES,
-             strerror (errno));
-    return 3;
-  }
-  if (0 != access (SBIN_IP, X_OK))
-  {
-    fprintf (stderr, 
-             "`%s' is not executable: %s\n", 
-             SBIN_IP,
-             strerror (errno));
-    return 4;
-  }
-
-  /* print port number to string for command-line use*/
-  (void) snprintf (localport,
-                   sizeof (localport), 
-                   "%u", 
-                   port);
-
-  /* update routing tables -- this is why we are SUID! */
-  if (! delete)
-  {
-    /* Forward everything from the given local port (with destination
-       to port 53, and only for UDP) without hijacking */
-    {
-      char *const mangle_args[] = 
-        {
-          "iptables", "-t", "mangle", "-I", "OUTPUT", "1", "-p",
-          "udp", "--sport", localport, "--dport", DNS_PORT, "-j",
-          "ACCEPT", NULL
-        };
-      if (0 != fork_and_exec (SBIN_IPTABLES, mangle_args))
-        goto cleanup_mangle_1;
-    }    
-    /* Mark all of the other DNS traffic using our mark DNS_MARK */
-    {
-      char *const mark_args[] =
-        {
-          "iptables", "-t", "mangle", "-I", "OUTPUT", DNS_TABLE, "-p",
-          "udp", "--dport", DNS_PORT, "-j", "MARK", "--set-mark", DNS_MARK,
-          NULL
-        };
-      if (0 != fork_and_exec (SBIN_IPTABLES, mark_args))
-        goto cleanup_mark_2;
-    }
-    /* Forward all marked DNS traffic to our DNS_TABLE */
-    {
-      char *const forward_args[] =
-        {
-          "ip", "rule", "add", "fwmark", DNS_MARK, "table", DNS_TABLE, NULL
-        };
-      if (0 != fork_and_exec (SBIN_IP, forward_args))
-        goto cleanup_forward_3;
-    }
-    /* Finally, add rule in our forwarding table to pass to our virtual interface */
-    {
-      char *const route_args[] =
-        {
-          "ip", "route", "add", "default", "via", virt_dns,
-          "table", DNS_TABLE, NULL
-        };
-      if (0 != fork_and_exec (SBIN_IP, route_args))
-        goto cleanup_route_4;
-    }
-  }
-  else
-  {
-    r = 0;
-    /* delete or clean-up-on-error case */
-cleanup_route_4:
-    {
-      char *const route_clean_args[] =                   
-        {
-          "ip", "route", "del", "default", "via", virt_dns,
-          "table", DNS_TABLE, NULL
-        };
-      if (0 != fork_and_exec (SBIN_IP, route_clean_args))
-        r += 1;
-    }
-cleanup_forward_3:
-    {
-      char *const forward_clean_args[] =
-        {
-          "ip", "rule", "del", "fwmark", DNS_MARK, "table", DNS_TABLE, NULL
-        };
-      if (0 != fork_and_exec (SBIN_IP, forward_clean_args))
-        r += 2; 
-    }
-cleanup_mark_2:
-    {
-      char *const mark_clean_args[] =
-        {
-          "iptables", "-t", "mangle", "-D", "OUTPUT", "-p", "udp",
-          "--dport", DNS_PORT, "-j", "MARK", "--set-mark", DNS_MARK, NULL
-        };
-      if (0 != fork_and_exec (SBIN_IPTABLES, mark_clean_args))
-        r += 4;
-    }   
-cleanup_mangle_1:
-    {
-      char *const mangle_clean_args[] =
-        {
-          "iptables", "-t", "mangle", "-D", "OUTPUT", "-p", "udp",
-          "--sport", localport, "--dport", DNS_PORT, "-j", "ACCEPT",
-          NULL
-        };
-      if (0 != fork_and_exec (SBIN_IPTABLES, mangle_clean_args))
-        r += 8;
-    }
-    if (r != 0)
-    {
-      if (delete)
-        return 16 + r; /* failed to delete */
-      return 32 + r; /* first failed to install, then also failed to clean up! */
-    }
-    if (! delete)
-    {
-      /* got here via goto to clean up handler, failed to install, succeeded with clean up */
-      return 8;
-    }
-  } 
-  /* success ! */
-  return 0;
-}
-
-/* end of gnunet-helper-hijack-dns.c */
diff --git a/src/dns/gnunet-service-dns.c b/src/dns/gnunet-service-dns.c
index c0e7e56ff..764ede782 100644
--- a/src/dns/gnunet-service-dns.c
+++ b/src/dns/gnunet-service-dns.c
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet.
-     (C) 2009 Christian Grothoff (and other contributing authors)
+     (C) 2012 Christian Grothoff (and other contributing authors)
 
      GNUnet is free software; you can redistribute it and/or modify
      it under the terms of the GNU General Public License as published
@@ -20,119 +20,177 @@
 
 /**
  * @file dns/gnunet-service-dns.c
- * @author Philipp Toelke
+ * @author Christian Grothoff
  */
 #include "platform.h"
-#include "gnunet_getopt_lib.h"
-#include "gnunet_service_lib.h"
-#include <gnunet_constants.h>
-#include "gnunet_network_lib.h"
-#include "gnunet_os_lib.h"
-#include "gnunet_dns_service.h"
-#include "gnunet_connection_lib.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_constants.h"
 #include "gnunet_protocols.h"
-#include "gnunet_applications.h"
-#include "gnunet_container_lib.h"
-#include "gnunet_dnsparser_lib.h"
-#include "gnunet_dht_service.h"
-#include "gnunet_block_lib.h"
-#include "block_dns.h"
-#include "gnunet_crypto_lib.h"
-#include "gnunet_mesh_service.h"
 #include "gnunet_signatures.h"
-
 #include "dns.h"
+#include "gnunet_dns_service.h"
+#include "gnunet_statistics_service.h"
+#include "tcpip_tun.h"
 
-/**
- * A structure containing a mapping from network-byte-ordered DNS-id (16 bit) to
- * some information needed to handle this query
- *
- * It currently allocates at least
- * (1 + machine-width + machine-width + 32 + 32 + 16 + machine-width + 8) * 65536 bit
- * = 17 MiB on 64 bit.
- * = 11 MiB on 32 bit.
- */
-static struct
-{
-  unsigned valid:1;
-  struct GNUNET_SERVER_Client *client;
-  struct GNUNET_MESH_Tunnel *tunnel;
-  char local_ip[16];
-  char remote_ip[16];
-  char addrlen;
-  uint16_t local_port;
-  char *name;
-  uint8_t namelen;
-  uint16_t qtype;
-} query_states[UINT16_MAX + 1];
+#ifndef IPVERSION
+#define IPVERSION 4
+#endif
 
 /**
- * A struct used to give more than one value as
- * closure to receive_dht
+ * Phases each request goes through.
  */
-struct receive_dht_cls
+enum RequestPhase
 {
-  uint16_t id;
-  struct GNUNET_DHT_GetHandle *handle;
-};
+  /**
+   * Request has just been received.
+   */
+  RP_INIT,
 
-struct tunnel_notify_queue
-{
-  struct tunnel_notify_queue *next;
-  struct tunnel_notify_queue *prev;
-  void *cls;
-  size_t len;
-  GNUNET_CONNECTION_TransmitReadyNotify cb;
-};
+  /**
+   * Showing the request to all monitor clients.  If
+   * client list is empty, will enter QUERY phase.
+   */
+  RP_REQUEST_MONITOR,
 
-struct tunnel_state
-{
-  struct tunnel_notify_queue *head, *tail;
-  struct GNUNET_MESH_TransmitHandle *th;
+  /**
+   * Showing the request to PRE-RESOLUTION clients to find an answer.
+   * If client list is empty, will trigger global DNS request.
+   */
+  RP_QUERY,
+
+  /**
+   * Global Internet query is now pending.
+   */
+  RP_INTERNET_DNS,
+  
+  /**
+   * Client (or global DNS request) has resulted in a response.
+   * Forward to all POST-RESOLUTION clients.  If client list is empty,
+   * will enter RESPONSE_MONITOR phase.
+   */
+  RP_MODIFY,
+
+  /**
+   * Showing the request to all monitor clients.  If
+   * client list is empty, give the result to the hijacker (and be done).
+   */
+  RP_RESPONSE_MONITOR,
+
+  /**
+   * Some client has told us to drop the request.
+   */
+  RP_DROP
 };
 
 
-struct answer_packet_list
+/**
+ * Entry we keep for each client.
+ */ 
+struct ClientRecord
 {
-  struct answer_packet_list *next;
-  struct answer_packet_list *prev;
+  /**
+   * Kept in doubly-linked list.
+   */ 
+  struct ClientRecord *next;
+
+  /**
+   * Kept in doubly-linked list.
+   */ 
+  struct ClientRecord *prev;
+
+  /**
+   * Handle to the client.
+   */ 
   struct GNUNET_SERVER_Client *client;
-  struct answer_packet pkt;
+
+  /**
+   * Flags for the client.
+   */
+  enum GNUNET_DNS_Flags flags;
+
 };
 
-GNUNET_NETWORK_STRUCT_BEGIN
-struct tunnel_cls
+
+/**
+ * Entry we keep for each active request.
+ */ 
+struct RequestRecord
 {
-  struct GNUNET_MESH_Tunnel *tunnel;
-  struct GNUNET_MessageHeader hdr;
-  struct dns_pkt dns;
-};
-GNUNET_NETWORK_STRUCT_END
 
-struct tunnel_cls *remote_pending[UINT16_MAX];
+  /**
+   * List of clients that still need to see this request (each entry
+   * is set to NULL when the client is done).
+   */
+  struct ClientRecord **client_wait_list;
 
+  /**
+   * Payload of the UDP packet (the UDP payload), can be either query
+   * or already the response.
+   */
+  char *payload;
 
-static struct GNUNET_MESH_Handle *mesh_handle;
+  /**
+   * Source address of the original request (for sending response).
+   */
+  struct sockaddr_storage src_addr;
+
+  /**
+   * Destination address of the original request (for potential use as exit).
+   */
+  struct sockaddr_storage dst_addr;
+
+  /**
+   * ID of this request, also basis for hashing.  Lowest 16 bit will
+   * be our message ID when doing a global DNS request and our index
+   * into the 'requests' array.
+   */
+  uint64_t request_id;
+
+  /**
+   * Number of bytes in payload.
+   */ 
+  size_t payload_length;
+
+  /**
+   * Length of the client wait list.
+   */
+  unsigned int client_wait_list_length;
+
+  /**
+   * In which phase this this request?
+   */
+  enum RequestPhase phase;
+
+};
 
-static struct GNUNET_CONNECTION_TransmitHandle *server_notify;
 
 /**
- * The UDP-Socket through which DNS-Resolves will be sent if they are not to be
+ * The IPv4 UDP-Socket through which DNS-Resolves will be sent if they are not to be
  * sent through gnunet. The port of this socket will not be hijacked.
  */
-static struct GNUNET_NETWORK_Handle *dnsout;
+static struct GNUNET_NETWORK_Handle *dnsout4;
 
+/**
+ * The IPv6 UDP-Socket through which DNS-Resolves will be sent if they are not to be
+ * sent through gnunet. The port of this socket will not be hijacked.
+ */
 static struct GNUNET_NETWORK_Handle *dnsout6;
 
 /**
- * The port bound to the socket dnsout
+ * Task for reading from dnsout4.
  */
-static unsigned short dnsoutport;
+static GNUNET_SCHEDULER_TaskIdentifier read4_task;
 
 /**
- * A handle to the DHT-Service
+ * Task for reading from dnsout6.
  */
-static struct GNUNET_DHT_Handle *dht;
+static GNUNET_SCHEDULER_TaskIdentifier read6_task;
+
+/**
+ * The port bound to the socket dnsout (and/or dnsout6).  We always (try) to bind
+ * both sockets to the same port.
+ */
+static uint16_t dnsoutport;
 
 /**
  * The configuration to use
@@ -140,1538 +198,975 @@ static struct GNUNET_DHT_Handle *dht;
 static const struct GNUNET_CONFIGURATION_Handle *cfg;
 
 /**
- * A list of DNS-Responses that have to be sent to the requesting client
+ * Statistics.
  */
-static struct answer_packet_list *head;
+static struct GNUNET_STATISTICS_Handle *stats;
 
 /**
- * The tail of the list of DNS-responses
+ * Handle to DNS hijacker helper process ("gnunet-helper-dns").
  */
-static struct answer_packet_list *tail;
+static struct GNUNET_HELPER_Handle *hijacker;
 
+/**
+ * Command-line arguments we are giving to the hijacker process.
+ */
+static char *helper_argv[8];
 
-static size_t
-send_answer (void *cls, size_t size, void *buf);
+/**
+ * Head of DLL of clients we consult.
+ */
+static struct ClientRecord *clients_head;
 
-static void
-client_disconnect (void *cls, struct GNUNET_SERVER_Client *client)
-{
-  if (NULL == head)
-    return;
+/**
+ * Tail of DLL of clients we consult.
+ */
+static struct ClientRecord *clients_tail;
 
-  if (head->client == client)
-  {
-    GNUNET_CONNECTION_notify_transmit_ready_cancel (server_notify);
-    server_notify =
-        GNUNET_SERVER_notify_transmit_ready (head->next->client,
-                                             ntohs (head->next->pkt.hdr.size),
-                                             GNUNET_TIME_UNIT_FOREVER_REL,
-                                             &send_answer, NULL);
-  }
+/**
+ * Our notification context.
+ */
+static struct GNUNET_SERVER_NotificationContext *nc;
 
-  struct answer_packet_list *element = head;
+/**
+ * Array of all open requests.
+ */
+static struct RequestRecord requests[UINT16_MAX + 1];
 
-  while (element != NULL)
-  {
-    if (element->client == client)
-    {
-      GNUNET_SERVER_client_drop (client);
-      GNUNET_CONTAINER_DLL_remove (head, tail, element);
-      struct answer_packet_list *t = element;
+/**
+ * Generator for unique request IDs.
+ */
+static uint64_t request_id_gen;
 
-      element = element->next;
-      GNUNET_free (t);
-    }
-    else
-      element = element->next;
-  }
-}
 
 /**
- * Hijack all outgoing DNS-Traffic but for traffic leaving "our" port.
+ * We're done processing a DNS request, free associated memory.
+ *
+ * @param rr request to clean up
  */
 static void
-hijack (void *cls GNUNET_UNUSED, const struct GNUNET_SCHEDULER_TaskContext *tc)
+cleanup_rr (struct RequestRecord *rr)
 {
-  if (0 != (tc->reason & GNUNET_SCHEDULER_REASON_SHUTDOWN))
-    return;
-
-  if (0 == dnsoutport)
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
-                "Delaying the hijacking, port is still %d!\n", dnsoutport);
-    GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_UNIT_SECONDS, &hijack, NULL);
-    return;
-  }
-
-  char port_s[6];
-  char *virt_dns;
-  struct GNUNET_OS_Process *proc;
-
-  if (GNUNET_SYSERR ==
-      GNUNET_CONFIGURATION_get_value_string (cfg, "vpn", "VIRTDNS", &virt_dns))
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                "No entry 'VIRTDNS' in configuration!\n");
-    exit (1);
-  }
-
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Hijacking, port is %d\n", dnsoutport);
-  snprintf (port_s, 6, "%d", dnsoutport);
-  if (NULL !=
-      (proc =
-       GNUNET_OS_start_process (NULL, NULL, "gnunet-helper-hijack-dns",
-                                "gnunet-hijack-dns", port_s, virt_dns, NULL)))
-  {
-    GNUNET_break (GNUNET_OK == GNUNET_OS_process_wait (proc));
-    GNUNET_OS_process_close (proc);
-  }
-  GNUNET_free (virt_dns);
-}
-
-static void *
-new_tunnel (void *cls GNUNET_UNUSED, struct GNUNET_MESH_Tunnel *tunnel,
-            const struct GNUNET_PeerIdentity *initiator GNUNET_UNUSED,
-            const struct GNUNET_ATS_Information *ats GNUNET_UNUSED)
-{
-  struct tunnel_state *s = GNUNET_malloc (sizeof *s);
-
-  s->head = NULL;
-  s->tail = NULL;
-  s->th = NULL;
-  return s;
+  GNUNET_free_non_null (rr->payload);
+  rr->payload = NULL;
+  rr->payload_length = 0;
+  GNUNET_array_grow (rr->client_wait_list,
+                     rr->client_wait_list_length,
+                     0);
 }
 
-static void
-clean_tunnel (void *cls GNUNET_UNUSED, const struct GNUNET_MESH_Tunnel *tunnel,
-              void *tunnel_ctx)
-{
-  GNUNET_free (tunnel_ctx);
-}
 
 /**
- * Delete the hijacking-routes
+ * Task run during shutdown.
+ *
+ * @param cls unused
+ * @param tc unused
  */
 static void
-unhijack (unsigned short port)
+cleanup_task (void *cls GNUNET_UNUSED,
+              const struct GNUNET_SCHEDULER_TaskContext *tc)
 {
-  char port_s[6];
-  char *virt_dns;
-  struct GNUNET_OS_Process *proc;
+  unsigned int i;
 
-  if (GNUNET_SYSERR ==
-      GNUNET_CONFIGURATION_get_value_string (cfg, "vpn", "VIRTDNS", &virt_dns))
+  GNUNET_HELPER_stop (hijacker);
+  hijacker = NULL;
+  for (i=0;i<8;i++)
+    GNUNET_free_non_null (helper_argv[i]);
+  if (NULL != dnsout4)
   {
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                "No entry 'VIRTDNS' in configuration!\n");
-    exit (1);
+    GNUNET_NETWORK_socket_close (dnsout4);
+    dnsout4 = NULL;
   }
-
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "unHijacking, port is %d\n", port);
-  snprintf (port_s, 6, "%d", port);
-  if (NULL !=
-      (proc =
-       GNUNET_OS_start_process (NULL, NULL, "gnunet-helper-hijack-dns",
-                                "gnunet-hijack-dns", "-d", port_s, virt_dns,
-                                NULL)))
+  if (GNUNET_SCHEDULER_NO_TASK != read4_task)
   {
-    GNUNET_break (GNUNET_OK == GNUNET_OS_process_wait (proc));
-    GNUNET_OS_process_close (proc);
+    GNUNET_SCHEDULER_cancel (read4_task);
+    read4_task = GNUNET_SCHEDULER_NO_TASK;
   }
-  GNUNET_free (virt_dns);
-}
-
-/**
- * Send the DNS-Response to the client. Gets called via the notify_transmit_ready-
- * system.
- */
-static size_t
-send_answer (void *cls, size_t size, void *buf)
-{
-  server_notify = NULL;
-  struct answer_packet_list *query = head;
-  size_t len = ntohs (query->pkt.hdr.size);
-
-  GNUNET_assert (len <= size);
-
-  memcpy (buf, &query->pkt.hdr, len);
-
-  GNUNET_CONTAINER_DLL_remove (head, tail, query);
-
-  /* When more data is to be sent, reschedule */
-  if (head != NULL)
-    server_notify =
-        GNUNET_SERVER_notify_transmit_ready (head->client,
-                                             ntohs (head->pkt.hdr.size),
-                                             GNUNET_TIME_UNIT_FOREVER_REL,
-                                             &send_answer, NULL);
-
-  GNUNET_SERVER_client_drop (query->client);
-  GNUNET_free (query);
-  return len;
-}
-
-
-static size_t
-mesh_send_response (void *cls, size_t size, void *buf)
-{
-  GNUNET_assert (size >= sizeof (struct GNUNET_MessageHeader));
-  struct GNUNET_MessageHeader *hdr = buf;
-  uint32_t *sz = cls;
-  struct GNUNET_MESH_Tunnel **tunnel = (struct GNUNET_MESH_Tunnel **) (sz + 1);
-  struct dns_pkt *dns = (struct dns_pkt *) (tunnel + 1);
-
-  GNUNET_MESH_tunnel_set_data (*tunnel, NULL);
-
-  hdr->type = htons (GNUNET_MESSAGE_TYPE_VPN_REMOTE_ANSWER_DNS);
-  hdr->size = htons (*sz + sizeof (struct GNUNET_MessageHeader));
-
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Sending response, size=%d, sz=%d, sz+hdr=%d\n", size, *sz,
-              *sz + sizeof (struct GNUNET_MessageHeader));
-
-  GNUNET_assert (size >= (*sz + sizeof (struct GNUNET_MessageHeader)));
-
-  memcpy (hdr + 1, dns, *sz);
-  struct tunnel_state *s = GNUNET_MESH_tunnel_get_data (*tunnel);
-
-  if (NULL != s->head)
+  if (NULL != dnsout6)
   {
-    struct tunnel_notify_queue *element = s->head;
-    struct tunnel_notify_queue *head = s->head;
-    struct tunnel_notify_queue *tail = s->tail;
-
-    GNUNET_CONTAINER_DLL_remove (head, tail, element);
-
-    s->th =
-        GNUNET_MESH_notify_transmit_ready (*tunnel, GNUNET_NO, 42,
-                                           GNUNET_TIME_relative_divide
-                                           (GNUNET_CONSTANTS_MAX_CORK_DELAY, 2),
-                                           (const struct GNUNET_PeerIdentity *)
-                                           NULL, element->len, element->cb,
-                                           element->cls);
+    GNUNET_NETWORK_socket_close (dnsout6);
+    dnsout6 = NULL;
   }
-
-  GNUNET_free (cls);
-
-  return ntohs (hdr->size);
-}
-
-static size_t
-mesh_send (void *cls, size_t size, void *buf)
-{
-  struct tunnel_cls *cls_ = (struct tunnel_cls *) cls;
-
-  GNUNET_MESH_tunnel_set_data (cls_->tunnel, NULL);
-
-  GNUNET_assert (cls_->hdr.size <= size);
-
-  size = cls_->hdr.size;
-  cls_->hdr.size = htons (cls_->hdr.size);
-
-  memcpy (buf, &cls_->hdr, size);
-
-  struct tunnel_state *s = GNUNET_MESH_tunnel_get_data (cls_->tunnel);
-
-  if (NULL != s->head)
+  if (GNUNET_SCHEDULER_NO_TASK != read6_task)
   {
-    struct tunnel_notify_queue *element = s->head;
-    struct tunnel_notify_queue *head = s->head;
-    struct tunnel_notify_queue *tail = s->tail;;
-
-    GNUNET_CONTAINER_DLL_remove (head, tail, element);
-
-    s->th =
-        GNUNET_MESH_notify_transmit_ready (cls_->tunnel, GNUNET_NO, 42,
-                                           GNUNET_TIME_relative_divide
-                                           (GNUNET_CONSTANTS_MAX_CORK_DELAY, 2),
-                                           (const struct GNUNET_PeerIdentity *)
-                                           NULL, element->len, element->cb,
-                                           element->cls);
-
-    GNUNET_free (element);
+    GNUNET_SCHEDULER_cancel (read6_task);
+    read6_task = GNUNET_SCHEDULER_NO_TASK;
   }
-
-  return size;
-}
-
-
-static void
-mesh_connect (void *cls, const struct GNUNET_PeerIdentity *peer,
-              const struct GNUNET_ATS_Information *atsi GNUNET_UNUSED)
-{
-  if (NULL == peer)
-    return;
-  struct tunnel_cls *cls_ = (struct tunnel_cls *) cls;
-
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Connected to peer %s, %x, sending query with id %d\n",
-              GNUNET_i2s (peer), peer, ntohs (cls_->dns.s.id));
-
-  struct tunnel_state *s = GNUNET_MESH_tunnel_get_data (cls_->tunnel);
-
-  if (NULL == s->head)
-  {
-    s->th =
-        GNUNET_MESH_notify_transmit_ready (cls_->tunnel, GNUNET_YES, 42,
-                                           GNUNET_TIME_UNIT_MINUTES, NULL,
-                                           cls_->hdr.size, mesh_send, cls);
-
-  }
-  else
+  for (i=0;i<65536;i++)
+    cleanup_rr (&requests[i]);
+  GNUNET_SERVER_notification_context_destroy (nc);
+  nc = NULL;
+  if (stats != NULL)
   {
-    struct tunnel_notify_queue *head = s->head;
-    struct tunnel_notify_queue *tail = s->tail;
-
-    struct tunnel_notify_queue *element =
-        GNUNET_malloc (sizeof (struct tunnel_notify_queue));
-    element->cls = cls;
-    element->len = cls_->hdr.size;
-    element->cb = mesh_send;
-
-    GNUNET_CONTAINER_DLL_insert_tail (head, tail, element);
+    GNUNET_STATISTICS_destroy (stats, GNUNET_YES);
+    stats = NULL;
   }
 }
 
 
+/**
+ * We're done with some request, finish processing.
+ *
+ * @param rr request send to the network or just clean up.
+ */
 static void
-send_mesh_query (void *cls, const struct GNUNET_SCHEDULER_TaskContext *tc)
-{
-  if (0 != (tc->reason & GNUNET_SCHEDULER_REASON_SHUTDOWN))
-    return;
-
-  struct tunnel_cls *cls_ = (struct tunnel_cls *) cls;
-
-  struct tunnel_state *s = GNUNET_malloc (sizeof *s);
-
-  s->head = NULL;
-  s->tail = NULL;
-  s->th = NULL;
-
-  cls_->tunnel =
-      GNUNET_MESH_tunnel_create (mesh_handle, s, mesh_connect, NULL, cls_);
-
-  GNUNET_MESH_peer_request_connect_by_type (cls_->tunnel,
-                                            GNUNET_APPLICATION_TYPE_INTERNET_RESOLVER);
-
-  remote_pending[cls_->dns.s.id] = cls_;
-}
-
-static int
-receive_mesh_query (void *cls GNUNET_UNUSED, struct GNUNET_MESH_Tunnel *tunnel,
-                    void **ctx GNUNET_UNUSED,
-                    const struct GNUNET_PeerIdentity *sender GNUNET_UNUSED,
-                    const struct GNUNET_MessageHeader *message,
-                    const struct GNUNET_ATS_Information *atsi GNUNET_UNUSED)
+request_done (struct RequestRecord *rr)
 {
-  struct dns_pkt *dns = (struct dns_pkt *) (message + 1);
-
-  struct sockaddr_in dest;
-
-  struct dns_pkt_parsed *pdns = parse_dns_packet (dns);
-
-  memset (&dest, 0, sizeof dest);
-  dest.sin_port = htons (53);
-  char *dns_resolver;
-
-  if (GNUNET_OK !=
-      GNUNET_CONFIGURATION_get_value_string (cfg, "dns", "EXTERNAL_DNS",
-                                             &dns_resolver) ||
-      1 != inet_pton (AF_INET, dns_resolver, &dest.sin_addr))
-    inet_pton (AF_INET, "8.8.8.8", &dest.sin_addr);
-
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Querying for remote, id=%d\n",
-              ntohs (dns->s.id));
-  query_states[dns->s.id].tunnel = tunnel;
-  query_states[dns->s.id].valid = GNUNET_YES;
-
-  int i;
-
-  for (i = 0; i < ntohs (pdns->s.qdcount); i++)
+  struct GNUNET_MessageHeader *hdr;
+  size_t reply_len;
+  uint16_t spt;
+  uint16_t dpt;
+
+  GNUNET_array_grow (rr->client_wait_list,
+                     rr->client_wait_list_length,
+                     0); 
+  if (RP_RESPONSE_MONITOR != rr->phase)
   {
-    if (pdns->queries[i]->qtype == htons (28) ||
-        pdns->queries[i]->qtype == htons (1))
-    {
-      query_states[dns->s.id].qtype = pdns->queries[i]->qtype;
-      break;
-    }
-  }
-  free_parsed_dns_packet (pdns);
-
-  GNUNET_NETWORK_socket_sendto (dnsout, dns,
-                                ntohs (message->size) -
-                                sizeof (struct GNUNET_MessageHeader),
-                                (struct sockaddr *) &dest, sizeof dest);
-
-  return GNUNET_SYSERR;
-}
-
-static int
-receive_mesh_answer (void *cls GNUNET_UNUSED, struct GNUNET_MESH_Tunnel *tunnel,
-                     void **ctx GNUNET_UNUSED,
-                     const struct GNUNET_PeerIdentity *sender,
-                     const struct GNUNET_MessageHeader *message,
-                     const struct GNUNET_ATS_Information *atsi GNUNET_UNUSED)
-{
-  /* TODo: size check */
-  struct dns_pkt *dns = (struct dns_pkt *) (message + 1);
-
-  /* They sent us a packet we were not waiting for */
-  if (remote_pending[dns->s.id] == NULL ||
-      remote_pending[dns->s.id]->tunnel != tunnel)
-    return GNUNET_OK;
-
-  GNUNET_free (remote_pending[dns->s.id]);
-  remote_pending[dns->s.id] = NULL;
-
-  if (query_states[dns->s.id].valid != GNUNET_YES)
-    return GNUNET_SYSERR;
-  query_states[dns->s.id].valid = GNUNET_NO;
-
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Received answer from peer %s, dns-id %d\n", GNUNET_i2s (sender),
-              ntohs (dns->s.id));
-
-  size_t len = sizeof (struct answer_packet) - 1 + sizeof (struct dns_static) + query_states[dns->s.id].namelen + sizeof (struct dns_query_line) + 2    /* To hold the pointer (as defined in RFC1035) to the name */
-      + sizeof (struct dns_record_line) - 1 + 16;       /* To hold the IPv6-Address */
-
-  struct answer_packet_list *answer =
-      GNUNET_malloc (len + sizeof (struct answer_packet_list) -
-                     sizeof (struct answer_packet));
-
-  answer->pkt.hdr.type = htons (GNUNET_MESSAGE_TYPE_VPN_DNS_LOCAL_RESPONSE_DNS);
-  answer->pkt.hdr.size = htons (len);
-
-  struct dns_pkt_parsed *pdns = parse_dns_packet (dns);
-
-  if (ntohs (pdns->s.ancount) < 1)
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Answer only contains %d answers.\n",
-                ntohs (pdns->s.ancount));
-    free_parsed_dns_packet (pdns);
-    GNUNET_free (answer);
-    return GNUNET_OK;
-  }
-
-  int i = 0;
-
-  while (i < ntohs (pdns->s.ancount) && ntohs (pdns->answers[i]->type) != 28 &&
-         ntohs (pdns->answers[i]->type) != 1)
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Answer contains %d.\n",
-                ntohs (pdns->answers[i]->type));
-    i++;
+    /* no response, drop */
+    cleanup_rr (rr);
+    return;
   }
-
-  if (i >= ntohs (pdns->s.ancount))
+  
+  /* send response via hijacker */
+  reply_len = sizeof (struct GNUNET_MessageHeader);
+  reply_len += sizeof (struct tun_header);
+  switch (rr->src_addr.ss_family)
   {
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "Answer does not contain any usable answers.\n");
-    free_parsed_dns_packet (pdns);
-    GNUNET_free (answer);
-    return GNUNET_OK;
+  case AF_INET:
+    reply_len += sizeof (struct ip4_header);
+    break;
+  case AF_INET6:
+    reply_len += sizeof (struct ip6_header);
+    break;
+  default:
+    GNUNET_break (0);
+    cleanup_rr (rr);
+    return;   
   }
-
-  answer->pkt.addrsize = ntohs (pdns->answers[i]->data_len);
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "The first answer has the addrlen %d\n",
-              answer->pkt.addrsize);
-  memcpy (answer->pkt.addr, pdns->answers[i]->data,
-          ntohs (pdns->answers[i]->data_len));
-
-  memcpy (answer->pkt.from, query_states[dns->s.id].remote_ip,
-          query_states[dns->s.id].addrlen);
-  memcpy (answer->pkt.to, query_states[dns->s.id].local_ip,
-          query_states[dns->s.id].addrlen);
-  answer->pkt.addrlen = query_states[dns->s.id].addrlen;
-  answer->pkt.dst_port = query_states[dns->s.id].local_port;
-
-  struct dns_pkt *dpkt = (struct dns_pkt *) answer->pkt.data;
-
-  dpkt->s.id = dns->s.id;
-  dpkt->s.aa = 1;
-  dpkt->s.qr = 1;
-  dpkt->s.ra = 1;
-  dpkt->s.qdcount = htons (1);
-  dpkt->s.ancount = htons (1);
-
-  memcpy (dpkt->data, query_states[dns->s.id].name,
-          query_states[dns->s.id].namelen);
-  GNUNET_free (query_states[dns->s.id].name);
-  query_states[dns->s.id].name = NULL;
-
-  struct dns_query_line *dque =
-      (struct dns_query_line *) (dpkt->data +
-                                 (query_states[dns->s.id].namelen));
-
-  struct dns_record_line *drec_data =
-      (struct dns_record_line *) (dpkt->data +
-                                  (query_states[dns->s.id].namelen) +
-                                  sizeof (struct dns_query_line) + 2);
-  if (htons (28) == query_states[dns->s.id].qtype)
+  reply_len += sizeof (struct udp_packet);
+  reply_len += rr->payload_length;
+  if (reply_len >= GNUNET_SERVER_MAX_MESSAGE_SIZE)
   {
-    answer->pkt.subtype = GNUNET_DNS_ANSWER_TYPE_REMOTE_AAAA;
-    dque->type = htons (28);    /* AAAA */
-    drec_data->type = htons (28);       /* AAAA */
-    drec_data->data_len = htons (16);
+    /* response too big, drop */
+    GNUNET_break (0); /* how can this be? */
+    cleanup_rr(rr);
+    return;    
   }
-  else if (htons (1) == query_states[dns->s.id].qtype)
   {
-    answer->pkt.subtype = GNUNET_DNS_ANSWER_TYPE_REMOTE_A;
-    dque->type = htons (1);     /* A */
-    drec_data->type = htons (1);        /* A */
-    drec_data->data_len = htons (4);
-  }
-  else
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "dns-answer with pending qtype = %d\n",
-                query_states[dns->s.id].qtype);
-    GNUNET_assert (0);
-  }
-  dque->class = htons (1);      /* IN */
-
-  char *anname =
-      (char *) (dpkt->data + (query_states[dns->s.id].namelen) +
-                sizeof (struct dns_query_line));
-  memcpy (anname, "\xc0\x0c", 2);
-  drec_data->class = htons (1); /* IN */
-
-  drec_data->ttl = pdns->answers[i]->ttl;
+    char buf[reply_len];
+    size_t off;
+    uint32_t udp_crc_sum;
 
-  /* Calculate at which offset in the packet the IPv6-Address belongs, it is
-   * filled in by the daemon-vpn */
-  answer->pkt.addroffset =
-      htons ((unsigned short) ((unsigned long) (&drec_data->data) -
-                               (unsigned long) (&answer->pkt)));
+    /* first, GNUnet message header */
+    hdr = (struct GNUNET_MessageHeader*) buf;
+    hdr->type = htons (GNUNET_MESSAGE_TYPE_DNS_HELPER);
+    hdr->size = htons ((uint16_t) reply_len);
+    off = sizeof (struct GNUNET_MessageHeader);
 
-  GNUNET_CONTAINER_DLL_insert_after (head, tail, tail, answer);
-  answer->client = query_states[dns->s.id].client;
+    /* first, TUN header */
+    {
+      struct tun_header tun;
 
-  if (server_notify == NULL)
-    server_notify =
-        GNUNET_SERVER_notify_transmit_ready (query_states[dns->s.id].client,
-                                             len, GNUNET_TIME_UNIT_FOREVER_REL,
-                                             &send_answer, NULL);
+      tun.flags = htons (0);
+      if (rr->src_addr.ss_family == AF_INET)
+        tun.proto = htons (ETH_P_IPV4); 
+      else
+        tun.proto = htons (ETH_P_IPV6);
+      memcpy (&buf[off], &tun, sizeof (struct tun_header));
+      off += sizeof (struct tun_header);
+    }
 
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Sent answer of length %d on to client, addroffset = %d\n", len,
-              answer->pkt.addroffset);
+    /* now IP header */
+    udp_crc_sum = 0;    
+    switch (rr->src_addr.ss_family)
+    {
+    case AF_INET:
+      {
+        struct sockaddr_in *src = (struct sockaddr_in *) &rr->src_addr;
+        struct sockaddr_in *dst = (struct sockaddr_in *) &rr->dst_addr;
+        struct ip4_header ip;
+        
+        spt = dst->sin_port;
+        dpt = src->sin_port;
+        ip.header_length =  sizeof (struct ip4_header) / 4;
+        ip.version = IPVERSION; /* aka 4 */
+        ip.diff_serv = 0;
+        ip.total_length = htons ((uint16_t) reply_len - off);
+        ip.identification = (uint16_t) GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK, 
+                                                        65536);
+        ip.flags = 0;
+        ip.fragmentation_offset = 0;
+        ip.ttl = 255; /* or lower? */
+        ip.protocol = IPPROTO_UDP;
+        ip.checksum = 0; /* checksum is optional */
+        ip.source_address = dst->sin_addr;
+        ip.destination_address = src->sin_addr;
+        ip.checksum = GNUNET_CRYPTO_crc16_n (&ip, sizeof (ip));
+
+        udp_crc_sum = GNUNET_CRYPTO_crc16_step (udp_crc_sum, 
+                                                &ip.source_address,
+                                                sizeof (struct in_addr) * 2);
+        {
+          uint16_t tmp;
+          
+          tmp = htons (IPPROTO_UDP);
+          udp_crc_sum = GNUNET_CRYPTO_crc16_step (udp_crc_sum, 
+                                                  &tmp, 
+                                                  sizeof (uint16_t));
+          tmp = htons (rr->payload_length + sizeof (struct udp_packet));
+          udp_crc_sum = GNUNET_CRYPTO_crc16_step (udp_crc_sum, 
+                                                  &tmp, 
+                                                  sizeof (uint16_t));
+        }
+        memcpy (&buf[off], &ip, sizeof (ip));
+        off += sizeof (ip);
+      }
+      break;
+    case AF_INET6:
+      {
+        struct sockaddr_in6 *src = (struct sockaddr_in6 *) &rr->src_addr;
+        struct sockaddr_in6 *dst = (struct sockaddr_in6 *) &rr->dst_addr;
+        struct ip6_header ip;
+
+        spt = dst->sin6_port;
+        dpt = src->sin6_port;
+        ip.traffic_class_h = 0;
+        ip.version  = 6; /* is there a named constant? I couldn't find one */
+        ip.traffic_class_l = 0;
+        ip.flow_label = 0;
+        ip.payload_length = htons ((uint16_t) reply_len);
+        ip.next_header = IPPROTO_UDP;
+        ip.hop_limit = 255; /* or lower? */
+        ip.source_address = dst->sin6_addr;
+        ip.destination_address = src->sin6_addr;
+        udp_crc_sum = GNUNET_CRYPTO_crc16_step (udp_crc_sum,
+                                                &ip.source_address, 
+                                                sizeof (struct in6_addr) * 2);
+        {
+          uint32_t tmp;
+          
+          tmp = htons (rr->payload_length + sizeof (struct udp_packet));
+          udp_crc_sum = GNUNET_CRYPTO_crc16_step (udp_crc_sum, 
+                                                  &tmp, 
+                                                  sizeof (uint32_t));
+          tmp = htons (IPPROTO_UDP);
+          udp_crc_sum = GNUNET_CRYPTO_crc16_step (udp_crc_sum, 
+                                                  &tmp, 
+                                                  sizeof (uint32_t));
+        }
+        memcpy (&buf[off], &ip, sizeof (ip));
+        off += sizeof (ip);
+      }
+      break;
+    default:
+      GNUNET_assert (0);
+    }
 
-  free_parsed_dns_packet (pdns);
-  return GNUNET_OK;
+    /* now UDP header */
+    {
+      struct udp_packet udp;
+
+      udp.spt = spt;
+      udp.dpt = dpt;
+      udp.len = htons (reply_len - off);
+      udp.crc = 0; 
+      udp_crc_sum = GNUNET_CRYPTO_crc16_step (udp_crc_sum, 
+                                              &udp, 
+                                              sizeof (udp));
+      udp_crc_sum = GNUNET_CRYPTO_crc16_step (udp_crc_sum, 
+                                              rr->payload,
+                                              rr->payload_length);
+      udp.crc = GNUNET_CRYPTO_crc16_finish (udp_crc_sum);
+      memcpy (&buf[off], &udp, sizeof (udp));
+      off += sizeof (udp);
+    }
+    /* now DNS payload */
+    {
+      memcpy (&buf[off], rr->payload, rr->payload_length);
+      off += rr->payload_length;
+    }
+    /* final checks & sending */
+    GNUNET_assert (off == reply_len);
+    GNUNET_HELPER_send (hijacker,
+                        hdr,
+                        GNUNET_YES,
+                        NULL, NULL);
+    GNUNET_STATISTICS_update (stats,
+                              gettext_noop ("# DNS requests answered via TUN interface"),
+                              1, GNUNET_NO);
+  }
+  /* clean up, we're done */
+  cleanup_rr (rr);
 }
 
 
-static void
-send_rev_query (void *cls, const struct GNUNET_SCHEDULER_TaskContext *tc)
-{
-  if (0 != (tc->reason & GNUNET_SCHEDULER_REASON_SHUTDOWN))
-    return;
-
-  struct dns_pkt_parsed *pdns = (struct dns_pkt_parsed *) cls;
-
-  unsigned short id = pdns->s.id;
-
-  free_parsed_dns_packet (pdns);
-
-  if (query_states[id].valid != GNUNET_YES)
-    return;
-  query_states[id].valid = GNUNET_NO;
-
-  GNUNET_assert (query_states[id].namelen == 74);
-
-  size_t len = sizeof (struct answer_packet) - 1 + sizeof (struct dns_static) + 74      /* this is the length of a reverse ipv6-lookup */
-      + sizeof (struct dns_query_line) + 2      /* To hold the pointer (as defined in RFC1035) to the name */
-      + sizeof (struct dns_record_line) - 1 -
-      2 /* We do not know the lenght of the answer yet */ ;
-
-  struct answer_packet_list *answer =
-      GNUNET_malloc (len + sizeof (struct answer_packet_list) -
-                     sizeof (struct answer_packet));
-
-  answer->pkt.hdr.type = htons (GNUNET_MESSAGE_TYPE_VPN_DNS_LOCAL_RESPONSE_DNS);
-  answer->pkt.hdr.size = htons (len);
-  answer->pkt.subtype = GNUNET_DNS_ANSWER_TYPE_REV;
-
-  memcpy (answer->pkt.from, query_states[id].remote_ip,
-          query_states[id].addrlen);
-  memcpy (answer->pkt.to, query_states[id].local_ip, query_states[id].addrlen);
-
-  answer->pkt.dst_port = query_states[id].local_port;
-
-  struct dns_pkt *dpkt = (struct dns_pkt *) answer->pkt.data;
-
-  dpkt->s.id = id;
-  dpkt->s.aa = 1;
-  dpkt->s.qr = 1;
-  dpkt->s.ra = 1;
-  dpkt->s.qdcount = htons (1);
-  dpkt->s.ancount = htons (1);
-
-  memcpy (dpkt->data, query_states[id].name, query_states[id].namelen);
-  GNUNET_free (query_states[id].name);
-  query_states[id].name = NULL;
-
-  struct dns_query_line *dque =
-      (struct dns_query_line *) (dpkt->data + (query_states[id].namelen));
-  dque->type = htons (12);      /* PTR */
-  dque->class = htons (1);      /* IN */
-
-  char *anname =
-      (char *) (dpkt->data + (query_states[id].namelen) +
-                sizeof (struct dns_query_line));
-  memcpy (anname, "\xc0\x0c", 2);
-
-  struct dns_record_line *drec_data =
-      (struct dns_record_line *) (dpkt->data + (query_states[id].namelen) +
-                                  sizeof (struct dns_query_line) + 2);
-  drec_data->type = htons (12); /* AAAA */
-  drec_data->class = htons (1); /* IN */
-  /* FIXME: read the TTL from block:
-   * GNUNET_TIME_absolute_get_remaining(rec->expiration_time)
-   *
-   * But how to get the seconds out of this?
-   */
-  drec_data->ttl = htonl (3600);
-
-  /* Calculate at which offset in the packet the length of the name and the
-   * name, it is filled in by the daemon-vpn */
-  answer->pkt.addroffset =
-      htons ((unsigned short) ((unsigned long) (&drec_data->data_len) -
-                               (unsigned long) (&answer->pkt)));
-
-  GNUNET_CONTAINER_DLL_insert_after (head, tail, tail, answer);
-  answer->client = query_states[id].client;
-
-  if (server_notify == NULL)
-    server_notify =
-        GNUNET_SERVER_notify_transmit_ready (query_states[id].client, len,
-                                             GNUNET_TIME_UNIT_FOREVER_REL,
-                                             &send_answer, NULL);
-}
-
 /**
- * Receive a block from the dht.
+ * Show the payload of the given request record to the client
+ * (and wait for a response).
+ *
+ * @param rr request to send to client
+ * @param client client to send the response to
  */
 static void
-receive_dht (void *cls, struct GNUNET_TIME_Absolute exp GNUNET_UNUSED,
-             const GNUNET_HashCode * key GNUNET_UNUSED,
-             const struct GNUNET_PeerIdentity *get_path GNUNET_UNUSED,
-             unsigned int get_path_length GNUNET_UNUSED,
-             const struct GNUNET_PeerIdentity *put_path GNUNET_UNUSED,
-             unsigned int put_path_length GNUNET_UNUSED,
-             enum GNUNET_BLOCK_Type type, size_t size, const void *data)
+send_request_to_client (struct RequestRecord *rr,
+                        struct GNUNET_SERVER_Client *client)
 {
+  char buf[sizeof (struct GNUNET_DNS_Request) + rr->payload_length];
+  struct GNUNET_DNS_Request *req;
 
-  unsigned short id = ((struct receive_dht_cls *) cls)->id;
-  struct GNUNET_DHT_GetHandle *handle =
-      ((struct receive_dht_cls *) cls)->handle;
-  GNUNET_free (cls);
-
-  GNUNET_DHT_get_stop (handle);
-
-  GNUNET_assert (type == GNUNET_BLOCK_TYPE_DNS);
-
-  /* If no query with this id is pending, ignore the block */
-  if (query_states[id].valid != GNUNET_YES)
+  if (sizeof (buf) >= GNUNET_SERVER_MAX_MESSAGE_SIZE)
+  {
+    GNUNET_break (0);
+    cleanup_rr (rr);
     return;
-  query_states[id].valid = GNUNET_NO;
-
-  const struct GNUNET_DNS_Record *rec = data;
-
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Got block of size %d, peer: %08x, desc: %08x\n", size,
-              *((unsigned int *) &rec->peer),
-              *((unsigned int *) &rec->service_descriptor));
-
-  size_t len = sizeof (struct answer_packet) - 1 + sizeof (struct dns_static) + query_states[id].namelen + sizeof (struct dns_query_line) + 2   /* To hold the pointer (as defined in RFC1035) to the name */
-      + sizeof (struct dns_record_line) - 1 + 16;       /* To hold the IPv6-Address */
-
-  struct answer_packet_list *answer =
-      GNUNET_malloc (len + sizeof (struct answer_packet_list) -
-                     sizeof (struct answer_packet));
-
-  answer->pkt.hdr.type = htons (GNUNET_MESSAGE_TYPE_VPN_DNS_LOCAL_RESPONSE_DNS);
-  answer->pkt.hdr.size = htons (len);
-  answer->pkt.subtype = GNUNET_DNS_ANSWER_TYPE_SERVICE;
-  answer->client = query_states[id].client;
-
-  GNUNET_CRYPTO_hash (&rec->peer,
-                      sizeof (struct GNUNET_CRYPTO_RsaPublicKeyBinaryEncoded),
-                      &answer->pkt.service_descr.peer);
-
-  memcpy (&answer->pkt.service_descr.service_descriptor,
-          &rec->service_descriptor, sizeof (GNUNET_HashCode));
-  memcpy (&answer->pkt.service_descr.service_type, &rec->service_type,
-          sizeof (answer->pkt.service_descr.service_type));
-  memcpy (&answer->pkt.service_descr.ports, &rec->ports,
-          sizeof (answer->pkt.service_descr.ports));
-
-  memcpy (answer->pkt.from, query_states[id].remote_ip,
-          query_states[id].addrlen);
-  memcpy (answer->pkt.to, query_states[id].local_ip, query_states[id].addrlen);
-  answer->pkt.addrlen = query_states[id].addrlen;
-
-  answer->pkt.dst_port = query_states[id].local_port;
-
-  struct dns_pkt *dpkt = (struct dns_pkt *) answer->pkt.data;
-
-  dpkt->s.id = id;
-  dpkt->s.aa = 1;
-  dpkt->s.qr = 1;
-  dpkt->s.ra = 1;
-  dpkt->s.qdcount = htons (1);
-  dpkt->s.ancount = htons (1);
-
-  memcpy (dpkt->data, query_states[id].name, query_states[id].namelen);
-  GNUNET_free (query_states[id].name);
-  query_states[id].name = NULL;
-
-  struct dns_query_line *dque =
-      (struct dns_query_line *) (dpkt->data + (query_states[id].namelen));
-  dque->type = htons (28);      /* AAAA */
-  dque->class = htons (1);      /* IN */
-
-  char *anname =
-      (char *) (dpkt->data + (query_states[id].namelen) +
-                sizeof (struct dns_query_line));
-  memcpy (anname, "\xc0\x0c", 2);
-
-  struct dns_record_line *drec_data =
-      (struct dns_record_line *) (dpkt->data + (query_states[id].namelen) +
-                                  sizeof (struct dns_query_line) + 2);
-  drec_data->type = htons (28); /* AAAA */
-  drec_data->class = htons (1); /* IN */
-
-  /* FIXME: read the TTL from block:
-   * GNUNET_TIME_absolute_get_remaining(rec->expiration_time)
-   *
-   * But how to get the seconds out of this?
-   */
-  drec_data->ttl = htonl (3600);
-  drec_data->data_len = htons (16);
-
-  /* Calculate at which offset in the packet the IPv6-Address belongs, it is
-   * filled in by the daemon-vpn */
-  answer->pkt.addroffset =
-      htons ((unsigned short) ((unsigned long) (&drec_data->data) -
-                               (unsigned long) (&answer->pkt)));
-
-  GNUNET_CONTAINER_DLL_insert_after (head, tail, tail, answer);
-
-  if (server_notify == NULL)
-    server_notify =
-        GNUNET_SERVER_notify_transmit_ready (answer->client, len,
-                                             GNUNET_TIME_UNIT_FOREVER_REL,
-                                             &send_answer, NULL);
+  }
+  req = (struct GNUNET_DNS_Request*) buf;
+  req->header.type = htons (GNUNET_MESSAGE_TYPE_DNS_CLIENT_REQUEST);
+  req->header.size = htons (sizeof (buf));
+  req->reserved = htonl (0);
+  req->request_id = rr->request_id;
+  memcpy (&req[1], rr->payload, rr->payload_length);
+  GNUNET_SERVER_notification_context_unicast (nc, 
+                                              client,
+                                              &req->header,
+                                              GNUNET_NO);
 }
 
-/**
- * This receives a GNUNET_MESSAGE_TYPE_REHIJACK and rehijacks the DNS
- */
-static void
-rehijack (void *cls GNUNET_UNUSED, struct GNUNET_SERVER_Client *client,
-          const struct GNUNET_MessageHeader *message GNUNET_UNUSED)
-{
-  unhijack (dnsoutport);
-  GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_UNIT_SECONDS, &hijack, NULL);
-
-  GNUNET_SERVER_receive_done (client, GNUNET_OK);
-}
 
 /**
- * This receives the dns-payload from the daemon-vpn and sends it on over the udp-socket
+ * A client has completed its processing for this
+ * request.  Move on.
+ *
+ * @param rr request to process further
  */
 static void
-receive_query (void *cls GNUNET_UNUSED, struct GNUNET_SERVER_Client *client,
-               const struct GNUNET_MessageHeader *message)
+next_phase (struct RequestRecord *rr)
 {
-  struct query_packet *pkt = (struct query_packet *) message;
-  struct dns_pkt *dns = (struct dns_pkt *) pkt->data;
-  struct dns_pkt_parsed *pdns = parse_dns_packet (dns);
+  struct ClientRecord *cr;
+  int nz;
+  unsigned int j;
+  struct GNUNET_NETWORK_Handle *dnsout;
+  socklen_t salen;
 
-  query_states[dns->s.id].valid = GNUNET_YES;
-  query_states[dns->s.id].client = client;
-  GNUNET_SERVER_client_keep (client);
-  memcpy (query_states[dns->s.id].local_ip, pkt->orig_from, pkt->addrlen);
-  query_states[dns->s.id].addrlen = pkt->addrlen;
-  query_states[dns->s.id].local_port = pkt->src_port;
-  memcpy (query_states[dns->s.id].remote_ip, pkt->orig_to, pkt->addrlen);
-  query_states[dns->s.id].namelen = strlen ((char *) dns->data) + 1;
-  if (query_states[dns->s.id].name != NULL)
-    GNUNET_free (query_states[dns->s.id].name);
-  query_states[dns->s.id].name =
-      GNUNET_malloc (query_states[dns->s.id].namelen);
-  memcpy (query_states[dns->s.id].name, dns->data,
-          query_states[dns->s.id].namelen);
-
-  int i;
-
-  for (i = 0; i < ntohs (pdns->s.qdcount); i++)
+  if (rr->phase == RP_DROP)
+  {
+    cleanup_rr (rr);
+    return;
+  }
+  nz = -1;
+  for (j=0;j<rr->client_wait_list_length;j++)
   {
-    if (pdns->queries[i]->qtype == htons (28) ||
-        pdns->queries[i]->qtype == htons (1))
+    if (NULL != rr->client_wait_list[j])
     {
-      query_states[dns->s.id].qtype = pdns->queries[i]->qtype;
+      nz = (int) j;
       break;
     }
-  }
-
-  /* The query is for a .gnunet-address */
-  if (pdns->queries[0]->namelen > 9 &&
-      0 == strncmp (pdns->queries[0]->name + (pdns->queries[0]->namelen - 9),
-                    ".gnunet.", 9))
+  }  
+  if (-1 != nz) 
   {
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Query for .gnunet!\n");
-    GNUNET_HashCode key;
-
-    GNUNET_CRYPTO_hash (pdns->queries[0]->name, pdns->queries[0]->namelen,
-                        &key);
-
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Getting with key %08x, len is %d\n",
-                *((unsigned int *) &key), pdns->queries[0]->namelen);
-
-    struct receive_dht_cls *cls =
-        GNUNET_malloc (sizeof (struct receive_dht_cls));
-    cls->id = dns->s.id;
-
-    cls->handle =
-        GNUNET_DHT_get_start (dht, GNUNET_TIME_UNIT_MINUTES,
-                              GNUNET_BLOCK_TYPE_DNS, &key,
-                              5 /* DEFAULT_GET_REPLICATION */ ,
-                              GNUNET_DHT_RO_NONE, NULL, 0, &receive_dht, cls);
-
-    goto outfree;
+    send_request_to_client (rr, rr->client_wait_list[nz]->client);
+    return;
   }
-
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Query for '%s'; namelen=%d\n",
-              pdns->queries[0]->name, pdns->queries[0]->namelen);
-
-  /* This is a PTR-Query. Check if it is for "our" network */
-  if (htons (pdns->queries[0]->qtype) == 12 && 74 == pdns->queries[0]->namelen)
+  /* done with current phase, advance! */
+  switch (rr->phase)
   {
-    char *ipv6addr;
-    char ipv6[16];
-    char ipv6rev[74] =
-        "X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.X.ip6.arpa.";
-    unsigned int i;
-    unsigned long long ipv6prefix;
-    unsigned int comparelen;
-
-    GNUNET_assert (GNUNET_OK ==
-                   GNUNET_CONFIGURATION_get_value_string (cfg, "vpn",
-                                                          "IPV6ADDR",
-                                                          &ipv6addr));
-    inet_pton (AF_INET6, ipv6addr, ipv6);
-    GNUNET_free (ipv6addr);
-
-    GNUNET_assert (GNUNET_OK ==
-                   GNUNET_CONFIGURATION_get_value_number (cfg, "vpn",
-                                                          "IPV6PREFIX",
-                                                          &ipv6prefix));
-    GNUNET_assert (ipv6prefix < 127);
-    ipv6prefix = (ipv6prefix + 7) / 8;
-
-    for (i = ipv6prefix; i < 16; i++)
-      ipv6[i] = 0;
-
-    for (i = 0; i < 16; i++)
+  case RP_INIT:
+    rr->phase = RP_REQUEST_MONITOR;
+    for (cr = clients_head; NULL != cr; cr = cr->next)
     {
-      unsigned char c1 = ipv6[i] >> 4;
-      unsigned char c2 = ipv6[i] & 0xf;
-
-      if (c1 <= 9)
-        ipv6rev[62 - (4 * i)] = c1 + '0';
-      else
-        ipv6rev[62 - (4 * i)] = c1 + 87;        /* 87 is the difference between 'a' and 10 */
-
-      if (c2 <= 9)
-        ipv6rev[62 - ((4 * i) + 2)] = c2 + '0';
-      else
-        ipv6rev[62 - ((4 * i) + 2)] = c2 + 87;
+      if (0 != (cr->flags & GNUNET_DNS_FLAG_REQUEST_MONITOR))
+        GNUNET_array_append (rr->client_wait_list,
+                             rr->client_wait_list_length,
+                             cr);
     }
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "My network is %s'.\n", ipv6rev);
-    comparelen = 10 + 4 * ipv6prefix;
-    if (0 ==
-        strncmp (pdns->queries[0]->name +
-                 (pdns->queries[0]->namelen - comparelen),
-                 ipv6rev + (74 - comparelen), comparelen))
+    next_phase (rr);
+    return;
+  case RP_REQUEST_MONITOR:
+    rr->phase = RP_QUERY;
+    for (cr = clients_head; NULL != cr; cr = cr->next)
     {
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Reverse-Query for .gnunet!\n");
-
-      GNUNET_SCHEDULER_add_now (send_rev_query, pdns);
-
-      goto out;
+      if (0 != (cr->flags & GNUNET_DNS_FLAG_PRE_RESOLUTION))
+        GNUNET_array_append (rr->client_wait_list,
+                             rr->client_wait_list_length,
+                             cr);
     }
-  }
-
-  unsigned char virt_dns_bytes[16];
-
-  if (pkt->addrlen == 4)
-  {
-    char *virt_dns;
-
-    if (GNUNET_SYSERR ==
-        GNUNET_CONFIGURATION_get_value_string (cfg, "vpn", "VIRTDNS",
-                                               &virt_dns))
+    next_phase (rr);
+    return;
+  case RP_QUERY:
+    rr->phase = RP_INTERNET_DNS;
+    switch (rr->dst_addr.ss_family)
     {
-      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                  "No entry 'VIRTDNS' in configuration!\n");
-      exit (1);
+    case AF_INET:
+      dnsout = dnsout4;
+      salen = sizeof (struct ip4_header);
+      break;
+    case AF_INET6:
+      dnsout = dnsout6;
+      salen = sizeof (struct ip6_header);
+      break;
+    default:
+      GNUNET_break (0);
+      cleanup_rr (rr);
+      return;   
     }
-
-    if (1 != inet_pton (AF_INET, virt_dns, &virt_dns_bytes))
+    if (NULL == dnsout)
     {
-      GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Error parsing 'VIRTDNS': %s; %m!\n",
-                  virt_dns);
-      exit (1);
+      GNUNET_STATISTICS_update (stats,
+                                gettext_noop ("# DNS exit failed (address family not supported)"),
+                                1, GNUNET_NO);
+      cleanup_rr (rr);
+      return;
     }
-
-    GNUNET_free (virt_dns);
-  }
-  else if (pkt->addrlen == 16)
-  {
-    char *virt_dns;
-
-    if (GNUNET_SYSERR ==
-        GNUNET_CONFIGURATION_get_value_string (cfg, "vpn", "VIRTDNS6",
-                                               &virt_dns))
+    GNUNET_NETWORK_socket_sendto (dnsout,
+                                  rr->payload,
+                                  rr->payload_length,
+                                  (struct sockaddr*) &rr->dst_addr,
+                                  salen);
+    return;
+  case RP_INTERNET_DNS:
+    rr->phase = RP_MODIFY;
+    for (cr = clients_head; NULL != cr; cr = cr->next)
     {
-      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                  "No entry 'VIRTDNS6' in configuration!\n");
-      exit (1);
+      if (0 != (cr->flags & GNUNET_DNS_FLAG_POST_RESOLUTION))
+        GNUNET_array_append (rr->client_wait_list,
+                             rr->client_wait_list_length,
+                             cr);
     }
-
-    if (1 != inet_pton (AF_INET6, virt_dns, &virt_dns_bytes))
+    next_phase (rr);
+    return;
+  case RP_MODIFY:
+    rr->phase = RP_RESPONSE_MONITOR;
+    for (cr = clients_head; NULL != cr; cr = cr->next)
     {
-      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                  "Error parsing 'VIRTDNS6': %s; %m!\n", virt_dns);
-      exit (1);
+      if (0 != (cr->flags & GNUNET_DNS_FLAG_RESPONSE_MONITOR))
+        GNUNET_array_append (rr->client_wait_list,
+                             rr->client_wait_list_length,
+                             cr);
     }
-
-    GNUNET_free (virt_dns);
-  }
-  else
-  {
-    GNUNET_assert (0);
+    next_phase (rr);
+    return;
+ case RP_RESPONSE_MONITOR:
+    request_done (rr);
+    break;
+  case RP_DROP:
+    cleanup_rr (rr);
+    break;
+  default:
+    GNUNET_break (0);
+    cleanup_rr (rr);
+    break;
   }
+}
 
-  if (memcmp (virt_dns_bytes, pkt->orig_to, pkt->addrlen) == 0)
-  {
-    /* This is a packet that was sent directly to the virtual dns-server
-     *
-     * This means we have to send this query over gnunet
-     */
-
-    size_t size =
-        sizeof (struct GNUNET_MESH_Tunnel *) +
-        sizeof (struct GNUNET_MessageHeader) + (ntohs (message->size) -
-                                                sizeof (struct query_packet) +
-                                                1);
-    struct tunnel_cls *cls_ = GNUNET_malloc (size);
-
-    cls_->hdr.size = size - sizeof (struct GNUNET_MESH_Tunnel *);
-
-    cls_->hdr.type = ntohs (GNUNET_MESSAGE_TYPE_VPN_REMOTE_QUERY_DNS);
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "size: %d\n", size);
 
-    memcpy (&cls_->dns, dns,
-            cls_->hdr.size - sizeof (struct GNUNET_MessageHeader));
-    GNUNET_SCHEDULER_add_now (send_mesh_query, cls_);
+/**
+ * A client disconnected, clean up after it.
+ *
+ * @param cls unused
+ * @param client handle of client that disconnected
+ */ 
+static void
+client_disconnect (void *cls, struct GNUNET_SERVER_Client *client)
+{
+  struct ClientRecord *cr;
+  struct RequestRecord *rr;
+  unsigned int i;
+  unsigned int j;
 
-    if (ntohs (pdns->s.qdcount) == 1)
+  for (cr = clients_head; NULL != cr; cr = cr->next)
+  {
+    if (cr->client == client)
     {
-      if (ntohs (pdns->queries[0]->qtype) == 1)
-        pdns->queries[0]->qtype = htons (28);
-      else if (ntohs (pdns->queries[0]->qtype) == 28)
-        pdns->queries[0]->qtype = htons (1);
-      else
+      GNUNET_SERVER_client_drop (client);
+      GNUNET_CONTAINER_DLL_remove (clients_head,
+                                   clients_tail,
+                                   cr);
+      for (i=0;i<UINT16_MAX;i++)
       {
-        GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "not sending second packet\n");
-        goto outfree;
+        rr = &requests[i];
+        if (0 == rr->client_wait_list_length)
+          continue; /* not in use */
+        for (j=0;j<rr->client_wait_list_length;j++)
+        {
+          if (rr->client_wait_list[j] == cr)
+          {
+            rr->client_wait_list[j] = NULL;
+            next_phase (rr); 
+          }
+        }
       }
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "sending second packet\n");
-      struct dns_pkt *rdns = unparse_dns_packet (pdns);
-      size_t size =
-          sizeof (struct GNUNET_MESH_Tunnel *) +
-          sizeof (struct GNUNET_MessageHeader) + (ntohs (message->size) -
-                                                  sizeof (struct query_packet) +
-                                                  1);
-      struct tunnel_cls *cls_ = GNUNET_malloc (size);
-
-      cls_->hdr.size = size - sizeof (struct GNUNET_MESH_Tunnel *);
-
-      cls_->hdr.type = ntohs (GNUNET_MESSAGE_TYPE_VPN_REMOTE_QUERY_DNS);
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "size: %d\n", size);
-
-      memcpy (&cls_->dns, rdns,
-              cls_->hdr.size - sizeof (struct GNUNET_MessageHeader));
-      GNUNET_SCHEDULER_add_now (send_mesh_query, cls_);
-      GNUNET_free (rdns);
+      GNUNET_free (cr);
+      return;
     }
-
-    goto outfree;
-  }
-
-
-  /* The query should be sent to the network */
-  if (pkt->addrlen == 4)
-  {
-    struct sockaddr_in dest;
-
-    memset (&dest, 0, sizeof dest);
-    dest.sin_port = htons (53);
-    memcpy (&dest.sin_addr.s_addr, pkt->orig_to, pkt->addrlen);
-
-    GNUNET_NETWORK_socket_sendto (dnsout, dns,
-                                  ntohs (pkt->hdr.size) -
-                                  sizeof (struct query_packet) + 1,
-                                  (struct sockaddr *) &dest, sizeof dest);
   }
-  else if (pkt->addrlen == 16)
-  {
-    struct sockaddr_in6 dest;
-
-    memset (&dest, 0, sizeof dest);
-    dest.sin6_port = htons (53);
-    memcpy (&dest.sin6_addr, pkt->orig_to, pkt->addrlen);
-
-    GNUNET_NETWORK_socket_sendto (dnsout6, dns,
-                                  ntohs (pkt->hdr.size) -
-                                  sizeof (struct query_packet) + 1,
-                                  (struct sockaddr *) &dest, sizeof dest);
-  }
-
-outfree:
-  free_parsed_dns_packet (pdns);
-  pdns = NULL;
-out:
-  GNUNET_SERVER_receive_done (client, GNUNET_OK);
 }
 
-static void
-read_response (void *cls, const struct GNUNET_SCHEDULER_TaskContext *tc);
 
+/**
+ * Read a DNS response from the (unhindered) UDP-Socket
+ *
+ * @param cls socket to read from
+ * @param tc scheduler context (must be shutdown or read ready)
+ */
 static void
-read_response6 (void *cls, const struct GNUNET_SCHEDULER_TaskContext *tc);
-
-static int
-open_port6 ()
+read_response (void *cls,
+               const struct GNUNET_SCHEDULER_TaskContext *tc)
 {
-  struct sockaddr_in6 addr;
+  struct GNUNET_NETWORK_Handle *dnsout = cls;
+  struct sockaddr_in addr4;
+  struct sockaddr_in6 addr6;
+  struct sockaddr *addr;
+  struct dns_header *dns;
+  socklen_t addrlen;
+  struct RequestRecord *rr;
+  ssize_t r;
+  int len;
 
-  dnsout6 = GNUNET_NETWORK_socket_create (AF_INET6, SOCK_DGRAM, 0);
-  if (dnsout6 == NULL)
+  if (dnsout == dnsout4)
   {
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Could not create socket: %m\n");
-    return GNUNET_SYSERR;
+    addrlen = sizeof (struct sockaddr_in);
+    addr = (struct sockaddr* ) &addr4;
+    read4_task = GNUNET_SCHEDULER_add_read_net (GNUNET_TIME_UNIT_FOREVER_REL, 
+                                                dnsout,
+                                                &read_response, 
+                                                dnsout);
   }
-  memset (&addr, 0, sizeof (struct sockaddr_in6));
-
-  addr.sin6_family = AF_INET6;
-  int err = GNUNET_NETWORK_socket_bind (dnsout6,
-                                        (struct sockaddr *) &addr,
-                                        sizeof (struct sockaddr_in6));
+  else
+  {
+    addrlen = sizeof (struct sockaddr_in6);
+    addr = (struct sockaddr* ) &addr6;
+    read6_task = GNUNET_SCHEDULER_add_read_net (GNUNET_TIME_UNIT_FOREVER_REL, 
+                                                dnsout,
+                                                &read_response, 
+                                                dnsout);
+  }
+  if (0 != (tc->reason & GNUNET_SCHEDULER_REASON_SHUTDOWN))
+    return;
 
-  if (err != GNUNET_OK)
+#ifndef MINGW
+  if (0 != ioctl (GNUNET_NETWORK_get_fd (dnsout), FIONREAD, &len))
   {
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Could not bind a port: %m\n");
-    return GNUNET_SYSERR;
+    /* conservative choice: */
+    len = 65536;
   }
+#else
+  /* port the code above? */
+  len = 65536;
+#endif
 
-  GNUNET_SCHEDULER_add_read_net (GNUNET_TIME_UNIT_FOREVER_REL, dnsout6,
-                                 &read_response6, NULL);
+  {
+    unsigned char buf[len];
 
-  return GNUNET_YES;
+    memset (addr, 0, addrlen);  
+    r = GNUNET_NETWORK_socket_recvfrom (dnsout, 
+                                        buf, sizeof (buf),
+                                        addr, &addrlen);
+    if (-1 == r)
+    {
+      GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR, "recvfrom");
+      return;
+    }
+    if (sizeof (struct dns_header) > r)
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR, 
+                  _("Received DNS response that is too small (%u bytes)"),
+                  r);
+      return;
+    }
+    dns = (struct dns_header *) buf;
+    rr = &requests[dns->id];
+    if (rr->phase != RP_INTERNET_DNS) 
+    {
+      /* unexpected / bogus reply */
+      GNUNET_STATISTICS_update (stats,
+                                gettext_noop ("# External DNS response discarded (no matching request)"),
+                                1, GNUNET_NO);
+      return; 
+    }
+    GNUNET_free_non_null (rr->payload);
+    rr->payload = GNUNET_malloc (len);
+    memcpy (rr->payload, buf, len);
+    rr->payload_length = len;
+    next_phase (rr);
+  }  
 }
 
+
+/**
+ * Open source port for sending DNS request on IPv4.
+ *
+ * @return GNUNET_OK on success
+ */ 
 static int
-open_port ()
+open_port4 ()
 {
   struct sockaddr_in addr;
+  socklen_t addrlen;
 
-  dnsout = GNUNET_NETWORK_socket_create (AF_INET, SOCK_DGRAM, 0);
-  if (dnsout == NULL)
+  dnsout4 = GNUNET_NETWORK_socket_create (AF_INET, SOCK_DGRAM, 0);
+  if (dnsout4 == NULL)
     return GNUNET_SYSERR;
-  memset (&addr, 0, sizeof (struct sockaddr_in));
 
+  memset (&addr, 0, sizeof (struct sockaddr_in));
   addr.sin_family = AF_INET;
-  int err = GNUNET_NETWORK_socket_bind (dnsout,
+  int err = GNUNET_NETWORK_socket_bind (dnsout4,
                                         (struct sockaddr *) &addr,
                                         sizeof (struct sockaddr_in));
 
   if (err != GNUNET_OK)
   {
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Could not bind a port: %m\n");
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, 
+                _("Could not bind to any port: %s\n"),
+                STRERROR (errno));
+    GNUNET_NETWORK_socket_close (dnsout4);
+    dnsout4 = NULL;
     return GNUNET_SYSERR;
   }
 
   /* Read the port we bound to */
-  socklen_t addrlen = sizeof (struct sockaddr_in);
-
-  err =
-      getsockname (GNUNET_NETWORK_get_fd (dnsout), (struct sockaddr *) &addr,
-                   &addrlen);
-
+  addrlen = sizeof (struct sockaddr_in);
+  if (0 != getsockname (GNUNET_NETWORK_get_fd (dnsout4), 
+                        (struct sockaddr *) &addr,
+                        &addrlen))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, 
+                _("Could not determine port I got: %s\n"),
+                STRERROR (errno));
+    GNUNET_NETWORK_socket_close (dnsout4);
+    dnsout4 = NULL;
+    return GNUNET_SYSERR;
+  }
   dnsoutport = htons (addr.sin_port);
 
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Bound to port %d.\n", dnsoutport);
-
-  GNUNET_SCHEDULER_add_read_net (GNUNET_TIME_UNIT_FOREVER_REL, dnsout,
-                                 &read_response, NULL);
-
-  return GNUNET_YES;
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO, 
+              _("GNUnet DNS will exit on source port %u\n"),
+              (unsigned int) dnsoutport);
+  read4_task = GNUNET_SCHEDULER_add_read_net (GNUNET_TIME_UNIT_FOREVER_REL, 
+                                              dnsout4,
+                                              &read_response, dnsout4);
+  return GNUNET_OK;
 }
 
-static void
-handle_response (struct dns_pkt *dns, struct sockaddr *addr, socklen_t addrlen,
-                 int r);
 
 /**
- * Read a response-packet of the UDP-Socket
- */
-static void
-read_response6 (void *cls GNUNET_UNUSED,
-                const struct GNUNET_SCHEDULER_TaskContext *tc)
+ * Open source port for sending DNS request on IPv6.  Should be 
+ * called AFTER open_port4.
+ *
+ * @return GNUNET_OK on success
+ */ 
+static int
+open_port6 ()
 {
   struct sockaddr_in6 addr;
-  socklen_t addrlen = sizeof (addr);
-  int r;
-  int len;
-
-  if (tc->reason & GNUNET_SCHEDULER_REASON_SHUTDOWN)
-    return;
-
-  memset (&addr, 0, sizeof addr);
-
-#ifndef MINGW
-  if (0 != ioctl (GNUNET_NETWORK_get_fd (dnsout6), FIONREAD, &len))
-  {
-    (void) open_port6 ();
-    return;
-  }
-#else
-  /* port the code above? */
-  len = 65536;
-#endif
-
-  unsigned char buf[len];
-  struct dns_pkt *dns = (struct dns_pkt *) buf;
-
-  r = GNUNET_NETWORK_socket_recvfrom (dnsout, buf, sizeof (buf),
-                                      (struct sockaddr *) &addr, &addrlen);
-
-  if (r < 0)
-  {
-    (void) open_port6 ();
-    return;
-  }
-
-  struct sockaddr *addr_ = GNUNET_malloc (sizeof addr);
+  socklen_t addrlen;
 
-  memcpy (addr_, &addr, sizeof addr);
-  handle_response (dns, addr_, 4, r);
-
-  GNUNET_SCHEDULER_add_read_net (GNUNET_TIME_UNIT_FOREVER_REL, dnsout6,
-                                 &read_response6, NULL);
-}
-
-/**
- * Read a response-packet of the UDP-Socket
- */
-static void
-read_response (void *cls GNUNET_UNUSED,
-               const struct GNUNET_SCHEDULER_TaskContext *tc)
-{
-  struct sockaddr_in addr;
-  socklen_t addrlen = sizeof (addr);
-  int r;
-  int len;
-
-  if (tc->reason & GNUNET_SCHEDULER_REASON_SHUTDOWN)
-    return;
-
-  memset (&addr, 0, sizeof addr);
-
-#ifndef MINGW
-  if (0 != ioctl (GNUNET_NETWORK_get_fd (dnsout), FIONREAD, &len))
+  dnsout6 = GNUNET_NETWORK_socket_create (AF_INET6, SOCK_DGRAM, 0);
+  if (dnsout6 == NULL)
   {
-    GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING, "ioctl");
-    unhijack (dnsoutport);
-    if (GNUNET_YES == open_port ())
-      GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_UNIT_SECONDS, &hijack, NULL);
-    return;
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, 
+                _("Could not create IPv6 socket: %s\n"),
+                STRERROR (errno));
+    return GNUNET_SYSERR;
   }
-#else
-  /* port the code above? */
-  len = 65536;
-#endif
-
-  unsigned char buf[len];
-  struct dns_pkt *dns = (struct dns_pkt *) buf;
-
-  r = GNUNET_NETWORK_socket_recvfrom (dnsout, buf, sizeof (buf),
-                                      (struct sockaddr *) &addr, &addrlen);
+  memset (&addr, 0, sizeof (struct sockaddr_in6));
+  addr.sin6_family = AF_INET6;
+  addr.sin6_port = htons (dnsoutport);
+  int err = GNUNET_NETWORK_socket_bind (dnsout6,
+                                        (struct sockaddr *) &addr,
+                                        sizeof (struct sockaddr_in6));
 
-  if (r < 0)
+  if (err != GNUNET_OK)
   {
-    GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING, "recvfrom");
-    unhijack (dnsoutport);
-    if (GNUNET_YES == open_port ())
-      GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_UNIT_SECONDS, &hijack, NULL);
-    return;
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                _("Could not bind to port %u: %s\n"),
+                (unsigned int) dnsoutport,
+                STRERROR (errno));
+    GNUNET_NETWORK_socket_close (dnsout6);
+    dnsout6 = NULL;
+    return GNUNET_SYSERR;
   }
-
-  struct sockaddr *addr_ = GNUNET_malloc (sizeof addr);
-
-  memcpy (addr_, &addr, sizeof addr);
-  handle_response (dns, addr_, 4, r);
-
-  GNUNET_SCHEDULER_add_read_net (GNUNET_TIME_UNIT_FOREVER_REL, dnsout,
-                                 &read_response, NULL);
-}
-
-static void
-handle_response (struct dns_pkt *dns, struct sockaddr *addr, socklen_t addrlen,
-                 int r)
-{
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Answer to query %d\n",
-              ntohs (dns->s.id));
-
-
-  if (query_states[dns->s.id].valid == GNUNET_YES)
+  if (0 == dnsoutport)
   {
-    if (query_states[dns->s.id].tunnel != NULL)
+    addrlen = sizeof (struct sockaddr_in6);
+    if (0 != getsockname (GNUNET_NETWORK_get_fd (dnsout6), 
+                          (struct sockaddr *) &addr,
+                          &addrlen))
     {
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  "Answer to query %d for a remote peer!\n", ntohs (dns->s.id));
-      /* This response should go through a tunnel */
-      uint32_t *c =
-          GNUNET_malloc (4 + sizeof (struct GNUNET_MESH_Tunnel *) + r);
-      *c = r;
-      struct GNUNET_MESH_Tunnel **t = (struct GNUNET_MESH_Tunnel **) (c + 1);
-
-      *t = query_states[dns->s.id].tunnel;
-      memcpy (t + 1, dns, r);
-      struct tunnel_state *s =
-          GNUNET_MESH_tunnel_get_data (query_states[dns->s.id].tunnel);
-      if (NULL == s->th)
-      {
-        s->th =
-            GNUNET_MESH_notify_transmit_ready (query_states[dns->s.id].tunnel,
-                                               GNUNET_YES, 32,
-                                               GNUNET_TIME_UNIT_MINUTES, NULL,
-                                               r +
-                                               sizeof (struct
-                                                       GNUNET_MessageHeader),
-                                               mesh_send_response, c);
-      }
-      else
-      {
-        struct tunnel_notify_queue *element =
-            GNUNET_malloc (sizeof (struct tunnel_notify_queue));
-        element->cls = c;
-        element->len = r + sizeof (struct GNUNET_MessageHeader);
-        element->cb = mesh_send_response;
-
-        GNUNET_CONTAINER_DLL_insert_tail (s->head, s->tail, element);
-      }
-    }
-    else
-    {
-      query_states[dns->s.id].valid = GNUNET_NO;
-
-      size_t len = sizeof (struct answer_packet) + r - 1;       /* 1 for the unsigned char data[1]; */
-      struct answer_packet_list *answer =
-          GNUNET_malloc (len + sizeof (struct answer_packet_list) -
-                         (sizeof (struct answer_packet)));
-      answer->pkt.hdr.type =
-          htons (GNUNET_MESSAGE_TYPE_VPN_DNS_LOCAL_RESPONSE_DNS);
-      answer->pkt.hdr.size = htons (len);
-      answer->pkt.subtype = GNUNET_DNS_ANSWER_TYPE_IP;
-      answer->pkt.addrlen = addrlen;
-      if (addrlen == 16)
-      {
-        struct sockaddr_in6 *addr_ = (struct sockaddr_in6 *) addr;
-
-        memcpy (answer->pkt.from, &addr_->sin6_addr, addrlen);
-        memcpy (answer->pkt.to, query_states[dns->s.id].local_ip, addrlen);
-      }
-      else if (addrlen == 4)
-      {
-        struct sockaddr_in *addr_ = (struct sockaddr_in *) addr;
-
-        memcpy (answer->pkt.from, &addr_->sin_addr.s_addr, addrlen);
-        memcpy (answer->pkt.to, query_states[dns->s.id].local_ip, addrlen);
-      }
-      else
-      {
-        GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "addrlen = %d\n", addrlen);
-        GNUNET_assert (0);
-      }
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "sending answer with addrlen = %d\n",
-                  addrlen);
-      answer->pkt.dst_port = query_states[dns->s.id].local_port;
-      memcpy (answer->pkt.data, dns, r);
-      answer->client = query_states[dns->s.id].client;
-
-      GNUNET_CONTAINER_DLL_insert_after (head, tail, tail, answer);
-
-      if (server_notify == NULL)
-        server_notify =
-            GNUNET_SERVER_notify_transmit_ready (query_states[dns->s.id].client,
-                                                 len,
-                                                 GNUNET_TIME_UNIT_FOREVER_REL,
-                                                 &send_answer, NULL);
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR, 
+                  _("Could not determine port I got: %s\n"),
+                  STRERROR (errno));
+      GNUNET_NETWORK_socket_close (dnsout6);
+      dnsout6 = NULL;
+      return GNUNET_SYSERR;
     }
   }
-  GNUNET_free (addr);
+  dnsoutport = htons (addr.sin6_port);
+  read6_task = GNUNET_SCHEDULER_add_read_net (GNUNET_TIME_UNIT_FOREVER_REL,
+                                              dnsout6,
+                                              &read_response, dnsout6);
+  return GNUNET_YES;
 }
 
 
 /**
- * Task run during shutdown.
+ * We got a new client.  Make sure all new DNS requests pass by its desk.
  *
  * @param cls unused
- * @param tc unused
+ * @param client the new client
+ * @param message the init message (unused)
  */
 static void
-cleanup_task (void *cls GNUNET_UNUSED,
-              const struct GNUNET_SCHEDULER_TaskContext *tc)
+handle_client_init (void *cls GNUNET_UNUSED, 
+                    struct GNUNET_SERVER_Client *client,
+                    const struct GNUNET_MessageHeader *message)
 {
-  GNUNET_assert (0 != (tc->reason & GNUNET_SCHEDULER_REASON_SHUTDOWN));
+  struct ClientRecord *cr;
+  const struct GNUNET_DNS_Register *reg = (const struct GNUNET_DNS_Register*) message;
 
-  unhijack (dnsoutport);
-  GNUNET_DHT_disconnect (dht);
-  GNUNET_MESH_disconnect (mesh_handle);
+  cr = GNUNET_malloc (sizeof (struct ClientRecord));
+  cr->client = client;
+  cr->flags = (enum GNUNET_DNS_Flags) ntohl (reg->flags);  
+  GNUNET_SERVER_client_keep (client);
+  GNUNET_CONTAINER_DLL_insert (clients_head,
+                               clients_tail,
+                               cr);
+  GNUNET_SERVER_notification_context_add (nc, client);
+  GNUNET_SERVER_receive_done (client, GNUNET_OK);
 }
 
+
 /**
- * @brief Create a port-map from udp and tcp redirects
- *
- * @param udp_redirects
- * @param tcp_redirects
+ * We got a response from a client.
  *
- * @return
+ * @param cls unused
+ * @param client the client
+ * @param message the response
  */
-static uint64_t
-get_port_from_redirects (const char *udp_redirects, const char *tcp_redirects)
+static void
+handle_client_response (void *cls GNUNET_UNUSED, 
+                        struct GNUNET_SERVER_Client *client,
+                        const struct GNUNET_MessageHeader *message)
 {
-  uint64_t ret = 0;
-  char *cpy, *hostname, *redirect;
-  int local_port;
-  unsigned int count = 0;
-
-  cpy = NULL;
-  if (NULL != udp_redirects)
+  const struct GNUNET_DNS_Response *resp;
+  struct RequestRecord *rr;
+  unsigned int i;
+  uint16_t msize;
+  uint16_t off;
+
+  msize = ntohs (message->size);
+  if (msize < sizeof (struct GNUNET_DNS_Response))
   {
-    cpy = GNUNET_strdup (udp_redirects);
-    for (redirect = strtok (cpy, " "); redirect != NULL;
-         redirect = strtok (NULL, " "))
-    {
-      if (NULL == (hostname = strstr (redirect, ":")))
-      {
-        GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
-                    "Warning: option %s is not formatted correctly!\n",
-                    redirect);
-        continue;
-      }
-      hostname[0] = '\0';
-      local_port = atoi (redirect);
-      if (!((local_port > 0) && (local_port < 65536)))
-        GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
-                    "Warning: %s is not a correct port.", redirect);
-
-      ret |= (0xFFFF & htons (local_port));
-      ret <<= 16;
-      count++;
-
-      if (count > 4)
-      {
-        ret = 0;
-        goto out;
-      }
-    }
-    GNUNET_free (cpy);
-    cpy = NULL;
+    GNUNET_break (0);
+    GNUNET_SERVER_receive_done (client, GNUNET_SYSERR);
+    return;
   }
-
-  if (NULL != tcp_redirects)
+  resp = (const struct GNUNET_DNS_Response*) message;
+  off = (uint16_t) resp->request_id;
+  rr = &requests[off];
+  if (rr->request_id != resp->request_id)
   {
-    cpy = GNUNET_strdup (tcp_redirects);
-    for (redirect = strtok (cpy, " "); redirect != NULL;
-         redirect = strtok (NULL, " "))
+    GNUNET_STATISTICS_update (stats,
+                              gettext_noop ("# Client response discarded (no matching request)"),
+                              1, GNUNET_NO);
+    GNUNET_SERVER_receive_done (client, GNUNET_OK);
+    return;
+  }
+  for (i=0;i<rr->client_wait_list_length;i++)
+  {
+    if (NULL == rr->client_wait_list[i])
+      continue;
+    if (rr->client_wait_list[i]->client != client)
+      continue;
+    rr->client_wait_list[i] = NULL;
+    switch (ntohl (resp->drop_flag))
     {
-      if (NULL == (hostname = strstr (redirect, ":")))
+    case 0: /* drop */
+      rr->phase = RP_DROP;
+      break;
+    case 1: /* no change */
+      break;
+    case 2: /* update */
+      msize -= sizeof (struct GNUNET_DNS_Response);
+      if ( (sizeof (struct dns_header) > msize) ||
+           (RP_REQUEST_MONITOR == rr->phase) ||
+           (RP_RESPONSE_MONITOR == rr->phase) )
       {
-        GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
-                    "Warning: option %s is not formatted correctly!\n",
-                    redirect);
-        continue;
+        GNUNET_break (0);
+        GNUNET_SERVER_receive_done (client, GNUNET_SYSERR);
+        next_phase (rr); 
+        return;
       }
-      hostname[0] = '\0';
-      local_port = atoi (redirect);
-      if (!((local_port > 0) && (local_port < 65536)))
-        GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
-                    "Warning: %s is not a correct port.", redirect);
-
-      ret |= (0xFFFF & htons (local_port));
-      ret <<= 16;
-      count++;
-
-      if (count > 4)
+      GNUNET_free_non_null (rr->payload);
+#if DEBUG_DNS
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  _("Changing DNS reply according to client specifications\n"));
+#endif
+      rr->payload = GNUNET_malloc (msize);
+      rr->payload_length = msize;
+      memcpy (rr->payload, &resp[1], msize);
+      if (rr->phase == RP_QUERY)
       {
-        ret = 0;
-        goto out;
+        /* clear wait list, we're moving to MODIFY phase next */
+        GNUNET_array_grow (rr->client_wait_list,
+                           rr->client_wait_list_length,
+                           0);
       }
+      break;
     }
-    GNUNET_free (cpy);
-    cpy = NULL;
+    next_phase (rr); 
+    GNUNET_SERVER_receive_done (client, GNUNET_OK);
+    return;      
   }
-
-out:
-  GNUNET_free_non_null (cpy);
-  return ret;
-}
-
-static void
-publish_name (const char *name, uint64_t ports, uint32_t service_type,
-              struct GNUNET_CRYPTO_RsaPrivateKey *my_private_key)
-{
-  size_t size = sizeof (struct GNUNET_DNS_Record);
-  struct GNUNET_DNS_Record data;
-
-  memset (&data, 0, size);
-
-  data.purpose.size = htonl (size - sizeof (struct GNUNET_CRYPTO_RsaSignature));
-  data.purpose.purpose = GNUNET_SIGNATURE_PURPOSE_DNS_RECORD;
-
-  GNUNET_CRYPTO_hash (name, strlen (name) + 1, &data.service_descriptor);
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Store with key1 %x\n",
-              *((unsigned long long *) &data.service_descriptor));
-
-  data.service_type = service_type;
-  data.ports = ports;
-
-  GNUNET_CRYPTO_rsa_key_get_public (my_private_key, &data.peer);
-
-  data.expiration_time =
-      GNUNET_TIME_absolute_hton (GNUNET_TIME_relative_to_absolute
-                                 (GNUNET_TIME_relative_multiply
-                                  (GNUNET_TIME_UNIT_HOURS, 2)));
-
-  /* Sign the block */
-  if (GNUNET_OK !=
-      GNUNET_CRYPTO_rsa_sign (my_private_key, &data.purpose, &data.signature))
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "could not sign DNS_Record\n");
-    return;
-  }
-
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Putting with key %08x, size = %d\n",
-              *((unsigned int *) &data.service_descriptor), size);
-
-  GNUNET_DHT_put (dht, &data.service_descriptor,
-                  5 /* DEFAULT_PUT_REPLICATION */ ,
-                  GNUNET_DHT_RO_NONE, GNUNET_BLOCK_TYPE_DNS, size,
-                  (char *) &data,
-                  GNUNET_TIME_relative_to_absolute (GNUNET_TIME_UNIT_HOURS),
-                  GNUNET_TIME_UNIT_MINUTES, NULL, NULL);
+  /* odd, client was not on our list for the request, that ought
+     to be an error */
+  GNUNET_break (0);
+  GNUNET_SERVER_receive_done (client, GNUNET_SYSERR);
 }
 
 
 /**
- * @brief Publishes the record defined by the section section
+ * Functions with this signature are called whenever a complete
+ * message is received by the tokenizer from the DNS hijack process.
  *
  * @param cls closure
- * @param section the current section
+ * @param client identification of the client
+ * @param message the actual message, a DNS request we should handle
  */
 static void
-publish_iterate (void *cls GNUNET_UNUSED, const char *section)
+process_helper_messages (void *cls GNUNET_UNUSED, void *client,
+                         const struct GNUNET_MessageHeader *message)
 {
-  char *udp_redirects;
-  char *tcp_redirects;
-  char *alternative_names;
-  char *alternative_name;
-  char *keyfile;
-
-  if ((strlen (section) < 8) ||
-      (0 != strcmp (".gnunet.", section + (strlen (section) - 8))))
-    return;
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Parsing dns-name %s\n", section);
-  if (GNUNET_OK !=
-      GNUNET_CONFIGURATION_get_value_string (cfg, section, "UDP_REDIRECTS",
-                                             &udp_redirects))
-    udp_redirects = NULL;
-  if (GNUNET_OK !=
-      GNUNET_CONFIGURATION_get_value_string (cfg, section, "TCP_REDIRECTS",
-                                             &tcp_redirects))
-    tcp_redirects = NULL;
-
-  if (GNUNET_OK !=
-      GNUNET_CONFIGURATION_get_value_filename (cfg, "GNUNETD", "HOSTKEY",
-                                               &keyfile))
+  uint16_t msize;
+  const struct tun_header *tun;
+  const struct ip4_header *ip4;
+  const struct ip6_header *ip6;
+  const struct udp_packet *udp;
+  const struct dns_header *dns;
+  struct RequestRecord *rr;
+  struct sockaddr_in *srca4;
+  struct sockaddr_in6 *srca6;
+  struct sockaddr_in *dsta4;
+  struct sockaddr_in6 *dsta6;
+
+  msize = ntohs (message->size);
+  if (msize < sizeof (struct GNUNET_MessageHeader) + sizeof (struct tun_header) + sizeof (struct ip4_header))
   {
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "could not read keyfile-value\n");
-    if (keyfile != NULL)
-      GNUNET_free (keyfile);
+    /* non-IP packet received on TUN!? */
+    GNUNET_break (0);
     return;
   }
-
-  struct GNUNET_CRYPTO_RsaPrivateKey *my_private_key =
-      GNUNET_CRYPTO_rsa_key_create_from_file (keyfile);
-  GNUNET_free (keyfile);
-  GNUNET_assert (my_private_key != NULL);
-
-  uint64_t ports = get_port_from_redirects (udp_redirects, tcp_redirects);
-  uint32_t service_type = 0;
-
-  if (NULL != udp_redirects)
-    service_type = GNUNET_DNS_SERVICE_TYPE_UDP;
-
-  if (NULL != tcp_redirects)
-    service_type |= GNUNET_DNS_SERVICE_TYPE_TCP;
-
-  service_type = htonl (service_type);
-
-
-  publish_name (section, ports, service_type, my_private_key);
-  if (GNUNET_OK ==
-      GNUNET_CONFIGURATION_get_value_string (cfg, section, "ALTERNATIVE_NAMES",
-                                             &alternative_names))
+  msize -= sizeof (struct GNUNET_MessageHeader);
+  tun = (const struct tun_header *) &message[1];
+  msize -= sizeof (struct tun_header);
+  switch (ntohs (tun->proto))
   {
-    for (alternative_name = strtok (alternative_names, " ");
-         alternative_name != NULL; alternative_name = strtok (NULL, " "))
+  case ETH_P_IPV4:
+    ip4 = (const struct ip4_header *) &tun[1];
+    if ( (msize < sizeof (struct ip4_header)) ||
+         (ip4->version != IPVERSION) ||
+         (ip4->header_length != sizeof (struct ip4_header) / 4) ||
+         (ntohs(ip4->total_length) != msize) ||
+         (ip4->protocol != IPPROTO_UDP) )
     {
-      char *altname =
-          alloca (strlen (alternative_name) + strlen (section) + 1 + 1);
-      strcpy (altname, alternative_name);
-      strcpy (altname + strlen (alternative_name) + 1, section);
-      altname[strlen (alternative_name)] = '.';
-
-      publish_name (altname, ports, service_type, my_private_key);
+      /* non-IP/UDP packet received on TUN (or with options) */
+      GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                  _("Received malformed IPv4-UDP packet on TUN interface.\n"));
+      return;
+    }
+    udp = (const struct udp_packet*) &ip4[1];
+    msize -= sizeof (struct ip4_header);
+    break;
+  case ETH_P_IPV6:
+    ip6 = (const struct ip6_header *) &tun[1];
+    if ( (msize < sizeof (struct ip6_header)) ||
+         (ip6->version != 6) ||
+         (ntohs (ip6->payload_length) != msize) ||
+         (ip6->next_header != IPPROTO_UDP) )
+    {
+      /* non-IP/UDP packet received on TUN (or with extensions) */
+      GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                  _("Received malformed IPv6-UDP packet on TUN interface.\n"));
+      return;
     }
-    GNUNET_free (alternative_names);
+    udp = (const struct udp_packet*) &ip6[1];
+    msize -= sizeof (struct ip6_header);
+    break;
+  default:
+    /* non-IP packet received on TUN!? */
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                _("Got non-IP packet with %u bytes and protocol %u from TUN\n"),
+                (unsigned int) msize,
+                ntohs (tun->proto));
+    return;
   }
-  GNUNET_CRYPTO_rsa_key_free (my_private_key);
-  GNUNET_free_non_null (udp_redirects);
-  GNUNET_free_non_null (tcp_redirects);
-}
-
-/**
- * Publish a DNS-record in the DHT.
- */
-static void
-publish_names (void *cls GNUNET_UNUSED,
-               const struct GNUNET_SCHEDULER_TaskContext *tc)
-{
-  if (0 != (tc->reason & GNUNET_SCHEDULER_REASON_SHUTDOWN))
+  if (msize <= sizeof (struct udp_packet) + sizeof (struct dns_header))
+  {    
+    /* non-DNS packet received on TUN, ignore */
+    GNUNET_STATISTICS_update (stats,
+                              gettext_noop ("# Non-DNS UDP packet received via TUN interface"),
+                              1, GNUNET_NO);
     return;
-
-  GNUNET_CONFIGURATION_iterate_sections (cfg, &publish_iterate, NULL);
-
-  GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_UNIT_HOURS, &publish_names, NULL);
+  }
+  msize -= sizeof (struct udp_packet);
+  dns = (const struct dns_header*) &udp[1];
+  rr = &requests[dns->id];
+
+  /* clean up from previous request */
+  GNUNET_free_non_null (rr->payload);
+  rr->payload = NULL;
+  GNUNET_array_grow (rr->client_wait_list,
+                     rr->client_wait_list_length,
+                     0);
+
+  /* setup new request */
+  rr->phase = RP_INIT;
+  if (ip4->version == IPVERSION)
+  {
+    srca4 = (struct sockaddr_in*) &rr->src_addr;
+    dsta4 = (struct sockaddr_in*) &rr->dst_addr;
+    memset (srca4, 0, sizeof (struct sockaddr_in));
+    memset (dsta4, 0, sizeof (struct sockaddr_in));
+    srca4->sin_family = AF_INET;
+    dsta4->sin_family = AF_INET;
+    srca4->sin_addr = ip4->source_address;
+    dsta4->sin_addr = ip4->destination_address;
+    srca4->sin_port = udp->spt;
+    dsta4->sin_port = udp->dpt;
+#if HAVE_SOCKADDR_IN_SIN_LEN
+    srca4->sin_len = sizeof (sizeof (struct sockaddr_in));
+    dsta4->sin_len = sizeof (sizeof (struct sockaddr_in));
+#endif
+  }
+  else /* ipv6 */
+  {
+    srca6 = (struct sockaddr_in6*) &rr->src_addr;
+    dsta6 = (struct sockaddr_in6*) &rr->dst_addr;
+    memset (srca6, 0, sizeof (struct sockaddr_in6));
+    memset (dsta6, 0, sizeof (struct sockaddr_in6));
+    srca6->sin6_family = AF_INET6;
+    dsta6->sin6_family = AF_INET6;
+    srca6->sin6_addr = ip6->source_address;
+    dsta6->sin6_addr = ip6->destination_address;
+    srca6->sin6_port = udp->spt;
+    dsta6->sin6_port = udp->dpt;
+#if HAVE_SOCKADDR_IN_SIN_LEN
+    srca6->sin6_len = sizeof (sizeof (struct sockaddr_in6));
+    dsta6->sin6_len = sizeof (sizeof (struct sockaddr_in6));
+#endif
+  }
+  rr->payload = GNUNET_malloc (msize);
+  rr->payload_length = msize;
+  memcpy (rr->payload, dns, msize);
+  rr->request_id = dns->id | (request_id_gen << 16);
+  request_id_gen++;
+
+  GNUNET_STATISTICS_update (stats,
+                            gettext_noop ("# DNS requests received via TUN interface"),
+                            1, GNUNET_NO);
+  /* start request processing state machine */
+  next_phase (rr);
 }
 
+
 /**
  * @param cls closure
  * @param server the initialized server
@@ -1683,51 +1178,102 @@ run (void *cls, struct GNUNET_SERVER_Handle *server,
 {
   static const struct GNUNET_SERVER_MessageHandler handlers[] = {
     /* callback, cls, type, size */
-    {&receive_query, NULL, GNUNET_MESSAGE_TYPE_VPN_DNS_LOCAL_QUERY_DNS, 0},
-    {&rehijack, NULL, GNUNET_MESSAGE_TYPE_REHIJACK,
-     sizeof (struct GNUNET_MessageHeader)},
+    {&handle_client_init, NULL, GNUNET_MESSAGE_TYPE_DNS_CLIENT_INIT, 
+     sizeof (struct GNUNET_DNS_Register)},
+    {&handle_client_response, NULL, GNUNET_MESSAGE_TYPE_DNS_CLIENT_RESPONSE, 0},
     {NULL, NULL, 0, 0}
   };
+  char port_s[6];
+  char *ifc_name;
+  char *ipv4addr;
+  char *ipv4mask;
+  char *ipv6addr;
+  char *ipv6prefix;
 
-  static const struct GNUNET_MESH_MessageHandler mesh_handlers[] = {
-    {receive_mesh_query, GNUNET_MESSAGE_TYPE_VPN_REMOTE_QUERY_DNS, 0},
-    {receive_mesh_answer, GNUNET_MESSAGE_TYPE_VPN_REMOTE_ANSWER_DNS, 0},
-    {NULL, 0, 0}
-  };
-
-  static GNUNET_MESH_ApplicationType apptypes[] = {
-    GNUNET_APPLICATION_TYPE_END,
-    GNUNET_APPLICATION_TYPE_END
-  };
+  cfg = cfg_;
+  stats = GNUNET_STATISTICS_create ("dns", cfg);
+  nc = GNUNET_SERVER_notification_context_create (server, 1);
+  GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_UNIT_FOREVER_REL, &cleanup_task,
+                                cls);
+  if (GNUNET_YES ==
+      GNUNET_CONFIGURATION_get_value_yesno (cfg_, "dns", "PROVIDE_EXIT"))
+  {
+    if ( (GNUNET_OK != open_port4 ()) &&
+         (GNUNET_OK != open_port6 ()) )
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  _("Failed to open any port to provide DNS exit\n"));
+      GNUNET_SCHEDULER_shutdown ();
+      return;
+    }
+  }
 
-  if (GNUNET_YES != open_port6 ())
+  helper_argv[0] = GNUNET_strdup ("gnunet-dns");
+  if (GNUNET_SYSERR ==
+      GNUNET_CONFIGURATION_get_value_string (cfg, "dns", "IFNAME", &ifc_name))
   {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "No entry 'IFNAME' in configuration!\n");
     GNUNET_SCHEDULER_shutdown ();
     return;
   }
-
-  if (GNUNET_YES != open_port ())
+  helper_argv[1] = ifc_name;
+  if ( (GNUNET_SYSERR ==
+        GNUNET_CONFIGURATION_get_value_string (cfg, "dns", "IPV6ADDR",
+                                               &ipv6addr)) )
   {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "No entry 'IPV6ADDR' in configuration!\n");
     GNUNET_SCHEDULER_shutdown ();
     return;
   }
+  helper_argv[2] = ipv6addr;
+  if (GNUNET_SYSERR ==
+      GNUNET_CONFIGURATION_get_value_string (cfg, "dns", "IPV6PREFIX",
+                                             &ipv6prefix))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "No entry 'IPV6PREFIX' in configuration!\n");
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
+  helper_argv[3] = ipv6prefix;
 
-  if (GNUNET_YES ==
-      GNUNET_CONFIGURATION_get_value_yesno (cfg_, "dns", "PROVIDE_EXIT"))
-    apptypes[0] = GNUNET_APPLICATION_TYPE_INTERNET_RESOLVER;
-  mesh_handle =
-      GNUNET_MESH_connect (cfg_, 42, NULL, new_tunnel, clean_tunnel,
-                           mesh_handlers, apptypes);
-
-  cfg = cfg_;
-  dht = GNUNET_DHT_connect (cfg, 1024);
-  GNUNET_SCHEDULER_add_now (publish_names, NULL);
+  if (GNUNET_SYSERR ==
+      GNUNET_CONFIGURATION_get_value_string (cfg, "dns", "IPV4ADDR",
+                                             &ipv4addr))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "No entry 'IPV4ADDR' in configuration!\n");
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
+  helper_argv[4] = ipv4addr;
+  if (GNUNET_SYSERR ==
+      GNUNET_CONFIGURATION_get_value_string (cfg, "dns", "IPV4MASK",
+                                             &ipv4mask))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "No entry 'IPV4MASK' in configuration!\n");
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
+  helper_argv[5] = ipv4mask;
+  GNUNET_snprintf (port_s, 
+                   sizeof (port_s), 
+                   "%u", 
+                   (unsigned int) dnsoutport);
+  helper_argv[6] = GNUNET_strdup (port_s);
+  helper_argv[7] = NULL;
+  hijacker = GNUNET_HELPER_start ("gnunet-helper-dns",
+                                  helper_argv,
+                                  &process_helper_messages,
+                                  NULL);
   GNUNET_SERVER_add_handlers (server, handlers);
   GNUNET_SERVER_disconnect_notify (server, &client_disconnect, NULL);
-  GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_UNIT_FOREVER_REL, &cleanup_task,
-                                cls);
 }
 
+
 /**
  * The main function for the dns service.
  *
@@ -1742,3 +1288,6 @@ main (int argc, char *const *argv)
           GNUNET_SERVICE_run (argc, argv, "dns", GNUNET_SERVICE_OPTION_NONE,
                               &run, NULL)) ? 0 : 1;
 }
+
+
+/* end of gnunet-service-dns_new.c */
diff --git a/src/dns/gnunet-service-dns_new.c b/src/dns/gnunet-service-dns_new.c
deleted file mode 100644
index 0bb7fb21c..000000000
--- a/src/dns/gnunet-service-dns_new.c
+++ /dev/null
@@ -1,1293 +0,0 @@
-/*
-     This file is part of GNUnet.
-     (C) 2012 Christian Grothoff (and other contributing authors)
-
-     GNUnet is free software; you can redistribute it and/or modify
-     it under the terms of the GNU General Public License as published
-     by the Free Software Foundation; either version 3, or (at your
-     option) any later version.
-
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     General Public License for more details.
-
-     You should have received a copy of the GNU General Public License
-     along with GNUnet; see the file COPYING.  If not, write to the
-     Free Software Foundation, Inc., 59 Temple Place - Suite 330,
-     Boston, MA 02111-1307, USA.
-*/
-
-/**
- * @file dns/gnunet-service-dns_new.c
- * @author Christian Grothoff
- */
-#include "platform.h"
-#include "gnunet_util_lib.h"
-#include "gnunet_constants.h"
-#include "gnunet_protocols.h"
-#include "gnunet_signatures.h"
-#include "dns_new.h"
-#include "gnunet_dns_service-new.h"
-#include "gnunet_statistics_service.h"
-#include "tcpip_tun.h"
-
-#ifndef IPVERSION
-#define IPVERSION 4
-#endif
-
-/**
- * Phases each request goes through.
- */
-enum RequestPhase
-{
-  /**
-   * Request has just been received.
-   */
-  RP_INIT,
-
-  /**
-   * Showing the request to all monitor clients.  If
-   * client list is empty, will enter QUERY phase.
-   */
-  RP_REQUEST_MONITOR,
-
-  /**
-   * Showing the request to PRE-RESOLUTION clients to find an answer.
-   * If client list is empty, will trigger global DNS request.
-   */
-  RP_QUERY,
-
-  /**
-   * Global Internet query is now pending.
-   */
-  RP_INTERNET_DNS,
-  
-  /**
-   * Client (or global DNS request) has resulted in a response.
-   * Forward to all POST-RESOLUTION clients.  If client list is empty,
-   * will enter RESPONSE_MONITOR phase.
-   */
-  RP_MODIFY,
-
-  /**
-   * Showing the request to all monitor clients.  If
-   * client list is empty, give the result to the hijacker (and be done).
-   */
-  RP_RESPONSE_MONITOR,
-
-  /**
-   * Some client has told us to drop the request.
-   */
-  RP_DROP
-};
-
-
-/**
- * Entry we keep for each client.
- */ 
-struct ClientRecord
-{
-  /**
-   * Kept in doubly-linked list.
-   */ 
-  struct ClientRecord *next;
-
-  /**
-   * Kept in doubly-linked list.
-   */ 
-  struct ClientRecord *prev;
-
-  /**
-   * Handle to the client.
-   */ 
-  struct GNUNET_SERVER_Client *client;
-
-  /**
-   * Flags for the client.
-   */
-  enum GNUNET_DNS_Flags flags;
-
-};
-
-
-/**
- * Entry we keep for each active request.
- */ 
-struct RequestRecord
-{
-
-  /**
-   * List of clients that still need to see this request (each entry
-   * is set to NULL when the client is done).
-   */
-  struct ClientRecord **client_wait_list;
-
-  /**
-   * Payload of the UDP packet (the UDP payload), can be either query
-   * or already the response.
-   */
-  char *payload;
-
-  /**
-   * Source address of the original request (for sending response).
-   */
-  struct sockaddr_storage src_addr;
-
-  /**
-   * Destination address of the original request (for potential use as exit).
-   */
-  struct sockaddr_storage dst_addr;
-
-  /**
-   * ID of this request, also basis for hashing.  Lowest 16 bit will
-   * be our message ID when doing a global DNS request and our index
-   * into the 'requests' array.
-   */
-  uint64_t request_id;
-
-  /**
-   * Number of bytes in payload.
-   */ 
-  size_t payload_length;
-
-  /**
-   * Length of the client wait list.
-   */
-  unsigned int client_wait_list_length;
-
-  /**
-   * In which phase this this request?
-   */
-  enum RequestPhase phase;
-
-};
-
-
-/**
- * The IPv4 UDP-Socket through which DNS-Resolves will be sent if they are not to be
- * sent through gnunet. The port of this socket will not be hijacked.
- */
-static struct GNUNET_NETWORK_Handle *dnsout4;
-
-/**
- * The IPv6 UDP-Socket through which DNS-Resolves will be sent if they are not to be
- * sent through gnunet. The port of this socket will not be hijacked.
- */
-static struct GNUNET_NETWORK_Handle *dnsout6;
-
-/**
- * Task for reading from dnsout4.
- */
-static GNUNET_SCHEDULER_TaskIdentifier read4_task;
-
-/**
- * Task for reading from dnsout6.
- */
-static GNUNET_SCHEDULER_TaskIdentifier read6_task;
-
-/**
- * The port bound to the socket dnsout (and/or dnsout6).  We always (try) to bind
- * both sockets to the same port.
- */
-static uint16_t dnsoutport;
-
-/**
- * The configuration to use
- */
-static const struct GNUNET_CONFIGURATION_Handle *cfg;
-
-/**
- * Statistics.
- */
-static struct GNUNET_STATISTICS_Handle *stats;
-
-/**
- * Handle to DNS hijacker helper process ("gnunet-helper-dns").
- */
-static struct GNUNET_HELPER_Handle *hijacker;
-
-/**
- * Command-line arguments we are giving to the hijacker process.
- */
-static char *helper_argv[8];
-
-/**
- * Head of DLL of clients we consult.
- */
-static struct ClientRecord *clients_head;
-
-/**
- * Tail of DLL of clients we consult.
- */
-static struct ClientRecord *clients_tail;
-
-/**
- * Our notification context.
- */
-static struct GNUNET_SERVER_NotificationContext *nc;
-
-/**
- * Array of all open requests.
- */
-static struct RequestRecord requests[UINT16_MAX + 1];
-
-/**
- * Generator for unique request IDs.
- */
-static uint64_t request_id_gen;
-
-
-/**
- * We're done processing a DNS request, free associated memory.
- *
- * @param rr request to clean up
- */
-static void
-cleanup_rr (struct RequestRecord *rr)
-{
-  GNUNET_free_non_null (rr->payload);
-  rr->payload = NULL;
-  rr->payload_length = 0;
-  GNUNET_array_grow (rr->client_wait_list,
-                     rr->client_wait_list_length,
-                     0);
-}
-
-
-/**
- * Task run during shutdown.
- *
- * @param cls unused
- * @param tc unused
- */
-static void
-cleanup_task (void *cls GNUNET_UNUSED,
-              const struct GNUNET_SCHEDULER_TaskContext *tc)
-{
-  unsigned int i;
-
-  GNUNET_HELPER_stop (hijacker);
-  hijacker = NULL;
-  for (i=0;i<8;i++)
-    GNUNET_free_non_null (helper_argv[i]);
-  if (NULL != dnsout4)
-  {
-    GNUNET_NETWORK_socket_close (dnsout4);
-    dnsout4 = NULL;
-  }
-  if (GNUNET_SCHEDULER_NO_TASK != read4_task)
-  {
-    GNUNET_SCHEDULER_cancel (read4_task);
-    read4_task = GNUNET_SCHEDULER_NO_TASK;
-  }
-  if (NULL != dnsout6)
-  {
-    GNUNET_NETWORK_socket_close (dnsout6);
-    dnsout6 = NULL;
-  }
-  if (GNUNET_SCHEDULER_NO_TASK != read6_task)
-  {
-    GNUNET_SCHEDULER_cancel (read6_task);
-    read6_task = GNUNET_SCHEDULER_NO_TASK;
-  }
-  for (i=0;i<65536;i++)
-    cleanup_rr (&requests[i]);
-  GNUNET_SERVER_notification_context_destroy (nc);
-  nc = NULL;
-  if (stats != NULL)
-  {
-    GNUNET_STATISTICS_destroy (stats, GNUNET_YES);
-    stats = NULL;
-  }
-}
-
-
-/**
- * We're done with some request, finish processing.
- *
- * @param rr request send to the network or just clean up.
- */
-static void
-request_done (struct RequestRecord *rr)
-{
-  struct GNUNET_MessageHeader *hdr;
-  size_t reply_len;
-  uint16_t spt;
-  uint16_t dpt;
-
-  GNUNET_array_grow (rr->client_wait_list,
-                     rr->client_wait_list_length,
-                     0); 
-  if (RP_RESPONSE_MONITOR != rr->phase)
-  {
-    /* no response, drop */
-    cleanup_rr (rr);
-    return;
-  }
-  
-  /* send response via hijacker */
-  reply_len = sizeof (struct GNUNET_MessageHeader);
-  reply_len += sizeof (struct tun_header);
-  switch (rr->src_addr.ss_family)
-  {
-  case AF_INET:
-    reply_len += sizeof (struct ip4_header);
-    break;
-  case AF_INET6:
-    reply_len += sizeof (struct ip6_header);
-    break;
-  default:
-    GNUNET_break (0);
-    cleanup_rr (rr);
-    return;   
-  }
-  reply_len += sizeof (struct udp_packet);
-  reply_len += rr->payload_length;
-  if (reply_len >= GNUNET_SERVER_MAX_MESSAGE_SIZE)
-  {
-    /* response too big, drop */
-    GNUNET_break (0); /* how can this be? */
-    cleanup_rr(rr);
-    return;    
-  }
-  {
-    char buf[reply_len];
-    size_t off;
-    uint32_t udp_crc_sum;
-
-    /* first, GNUnet message header */
-    hdr = (struct GNUNET_MessageHeader*) buf;
-    hdr->type = htons (GNUNET_MESSAGE_TYPE_DNS_HELPER);
-    hdr->size = htons ((uint16_t) reply_len);
-    off = sizeof (struct GNUNET_MessageHeader);
-
-    /* first, TUN header */
-    {
-      struct tun_header tun;
-
-      tun.flags = htons (0);
-      if (rr->src_addr.ss_family == AF_INET)
-        tun.proto = htons (ETH_P_IPV4); 
-      else
-        tun.proto = htons (ETH_P_IPV6);
-      memcpy (&buf[off], &tun, sizeof (struct tun_header));
-      off += sizeof (struct tun_header);
-    }
-
-    /* now IP header */
-    udp_crc_sum = 0;    
-    switch (rr->src_addr.ss_family)
-    {
-    case AF_INET:
-      {
-        struct sockaddr_in *src = (struct sockaddr_in *) &rr->src_addr;
-        struct sockaddr_in *dst = (struct sockaddr_in *) &rr->dst_addr;
-        struct ip4_header ip;
-        
-        spt = dst->sin_port;
-        dpt = src->sin_port;
-        ip.header_length =  sizeof (struct ip4_header) / 4;
-        ip.version = IPVERSION; /* aka 4 */
-        ip.diff_serv = 0;
-        ip.total_length = htons ((uint16_t) reply_len - off);
-        ip.identification = (uint16_t) GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK, 
-                                                        65536);
-        ip.flags = 0;
-        ip.fragmentation_offset = 0;
-        ip.ttl = 255; /* or lower? */
-        ip.protocol = IPPROTO_UDP;
-        ip.checksum = 0; /* checksum is optional */
-        ip.source_address = dst->sin_addr;
-        ip.destination_address = src->sin_addr;
-        ip.checksum = GNUNET_CRYPTO_crc16_n (&ip, sizeof (ip));
-
-        udp_crc_sum = GNUNET_CRYPTO_crc16_step (udp_crc_sum, 
-                                                &ip.source_address,
-                                                sizeof (struct in_addr) * 2);
-        {
-          uint16_t tmp;
-          
-          tmp = htons (IPPROTO_UDP);
-          udp_crc_sum = GNUNET_CRYPTO_crc16_step (udp_crc_sum, 
-                                                  &tmp, 
-                                                  sizeof (uint16_t));
-          tmp = htons (rr->payload_length + sizeof (struct udp_packet));
-          udp_crc_sum = GNUNET_CRYPTO_crc16_step (udp_crc_sum, 
-                                                  &tmp, 
-                                                  sizeof (uint16_t));
-        }
-        memcpy (&buf[off], &ip, sizeof (ip));
-        off += sizeof (ip);
-      }
-      break;
-    case AF_INET6:
-      {
-        struct sockaddr_in6 *src = (struct sockaddr_in6 *) &rr->src_addr;
-        struct sockaddr_in6 *dst = (struct sockaddr_in6 *) &rr->dst_addr;
-        struct ip6_header ip;
-
-        spt = dst->sin6_port;
-        dpt = src->sin6_port;
-        ip.traffic_class_h = 0;
-        ip.version  = 6; /* is there a named constant? I couldn't find one */
-        ip.traffic_class_l = 0;
-        ip.flow_label = 0;
-        ip.payload_length = htons ((uint16_t) reply_len);
-        ip.next_header = IPPROTO_UDP;
-        ip.hop_limit = 255; /* or lower? */
-        ip.source_address = dst->sin6_addr;
-        ip.destination_address = src->sin6_addr;
-        udp_crc_sum = GNUNET_CRYPTO_crc16_step (udp_crc_sum,
-                                                &ip.source_address, 
-                                                sizeof (struct in6_addr) * 2);
-        {
-          uint32_t tmp;
-          
-          tmp = htons (rr->payload_length + sizeof (struct udp_packet));
-          udp_crc_sum = GNUNET_CRYPTO_crc16_step (udp_crc_sum, 
-                                                  &tmp, 
-                                                  sizeof (uint32_t));
-          tmp = htons (IPPROTO_UDP);
-          udp_crc_sum = GNUNET_CRYPTO_crc16_step (udp_crc_sum, 
-                                                  &tmp, 
-                                                  sizeof (uint32_t));
-        }
-        memcpy (&buf[off], &ip, sizeof (ip));
-        off += sizeof (ip);
-      }
-      break;
-    default:
-      GNUNET_assert (0);
-    }
-
-    /* now UDP header */
-    {
-      struct udp_packet udp;
-
-      udp.spt = spt;
-      udp.dpt = dpt;
-      udp.len = htons (reply_len - off);
-      udp.crc = 0; 
-      udp_crc_sum = GNUNET_CRYPTO_crc16_step (udp_crc_sum, 
-                                              &udp, 
-                                              sizeof (udp));
-      udp_crc_sum = GNUNET_CRYPTO_crc16_step (udp_crc_sum, 
-                                              rr->payload,
-                                              rr->payload_length);
-      udp.crc = GNUNET_CRYPTO_crc16_finish (udp_crc_sum);
-      memcpy (&buf[off], &udp, sizeof (udp));
-      off += sizeof (udp);
-    }
-    /* now DNS payload */
-    {
-      memcpy (&buf[off], rr->payload, rr->payload_length);
-      off += rr->payload_length;
-    }
-    /* final checks & sending */
-    GNUNET_assert (off == reply_len);
-    GNUNET_HELPER_send (hijacker,
-                        hdr,
-                        GNUNET_YES,
-                        NULL, NULL);
-    GNUNET_STATISTICS_update (stats,
-                              gettext_noop ("# DNS requests answered via TUN interface"),
-                              1, GNUNET_NO);
-  }
-  /* clean up, we're done */
-  cleanup_rr (rr);
-}
-
-
-/**
- * Show the payload of the given request record to the client
- * (and wait for a response).
- *
- * @param rr request to send to client
- * @param client client to send the response to
- */
-static void
-send_request_to_client (struct RequestRecord *rr,
-                        struct GNUNET_SERVER_Client *client)
-{
-  char buf[sizeof (struct GNUNET_DNS_Request) + rr->payload_length];
-  struct GNUNET_DNS_Request *req;
-
-  if (sizeof (buf) >= GNUNET_SERVER_MAX_MESSAGE_SIZE)
-  {
-    GNUNET_break (0);
-    cleanup_rr (rr);
-    return;
-  }
-  req = (struct GNUNET_DNS_Request*) buf;
-  req->header.type = htons (GNUNET_MESSAGE_TYPE_DNS_CLIENT_REQUEST);
-  req->header.size = htons (sizeof (buf));
-  req->reserved = htonl (0);
-  req->request_id = rr->request_id;
-  memcpy (&req[1], rr->payload, rr->payload_length);
-  GNUNET_SERVER_notification_context_unicast (nc, 
-                                              client,
-                                              &req->header,
-                                              GNUNET_NO);
-}
-
-
-/**
- * A client has completed its processing for this
- * request.  Move on.
- *
- * @param rr request to process further
- */
-static void
-next_phase (struct RequestRecord *rr)
-{
-  struct ClientRecord *cr;
-  int nz;
-  unsigned int j;
-  struct GNUNET_NETWORK_Handle *dnsout;
-  socklen_t salen;
-
-  if (rr->phase == RP_DROP)
-  {
-    cleanup_rr (rr);
-    return;
-  }
-  nz = -1;
-  for (j=0;j<rr->client_wait_list_length;j++)
-  {
-    if (NULL != rr->client_wait_list[j])
-    {
-      nz = (int) j;
-      break;
-    }
-  }  
-  if (-1 != nz) 
-  {
-    send_request_to_client (rr, rr->client_wait_list[nz]->client);
-    return;
-  }
-  /* done with current phase, advance! */
-  switch (rr->phase)
-  {
-  case RP_INIT:
-    rr->phase = RP_REQUEST_MONITOR;
-    for (cr = clients_head; NULL != cr; cr = cr->next)
-    {
-      if (0 != (cr->flags & GNUNET_DNS_FLAG_REQUEST_MONITOR))
-        GNUNET_array_append (rr->client_wait_list,
-                             rr->client_wait_list_length,
-                             cr);
-    }
-    next_phase (rr);
-    return;
-  case RP_REQUEST_MONITOR:
-    rr->phase = RP_QUERY;
-    for (cr = clients_head; NULL != cr; cr = cr->next)
-    {
-      if (0 != (cr->flags & GNUNET_DNS_FLAG_PRE_RESOLUTION))
-        GNUNET_array_append (rr->client_wait_list,
-                             rr->client_wait_list_length,
-                             cr);
-    }
-    next_phase (rr);
-    return;
-  case RP_QUERY:
-    rr->phase = RP_INTERNET_DNS;
-    switch (rr->dst_addr.ss_family)
-    {
-    case AF_INET:
-      dnsout = dnsout4;
-      salen = sizeof (struct ip4_header);
-      break;
-    case AF_INET6:
-      dnsout = dnsout6;
-      salen = sizeof (struct ip6_header);
-      break;
-    default:
-      GNUNET_break (0);
-      cleanup_rr (rr);
-      return;   
-    }
-    if (NULL == dnsout)
-    {
-      GNUNET_STATISTICS_update (stats,
-                                gettext_noop ("# DNS exit failed (address family not supported)"),
-                                1, GNUNET_NO);
-      cleanup_rr (rr);
-      return;
-    }
-    GNUNET_NETWORK_socket_sendto (dnsout,
-                                  rr->payload,
-                                  rr->payload_length,
-                                  (struct sockaddr*) &rr->dst_addr,
-                                  salen);
-    return;
-  case RP_INTERNET_DNS:
-    rr->phase = RP_MODIFY;
-    for (cr = clients_head; NULL != cr; cr = cr->next)
-    {
-      if (0 != (cr->flags & GNUNET_DNS_FLAG_POST_RESOLUTION))
-        GNUNET_array_append (rr->client_wait_list,
-                             rr->client_wait_list_length,
-                             cr);
-    }
-    next_phase (rr);
-    return;
-  case RP_MODIFY:
-    rr->phase = RP_RESPONSE_MONITOR;
-    for (cr = clients_head; NULL != cr; cr = cr->next)
-    {
-      if (0 != (cr->flags & GNUNET_DNS_FLAG_RESPONSE_MONITOR))
-        GNUNET_array_append (rr->client_wait_list,
-                             rr->client_wait_list_length,
-                             cr);
-    }
-    next_phase (rr);
-    return;
- case RP_RESPONSE_MONITOR:
-    request_done (rr);
-    break;
-  case RP_DROP:
-    cleanup_rr (rr);
-    break;
-  default:
-    GNUNET_break (0);
-    cleanup_rr (rr);
-    break;
-  }
-}
-
-
-/**
- * A client disconnected, clean up after it.
- *
- * @param cls unused
- * @param client handle of client that disconnected
- */ 
-static void
-client_disconnect (void *cls, struct GNUNET_SERVER_Client *client)
-{
-  struct ClientRecord *cr;
-  struct RequestRecord *rr;
-  unsigned int i;
-  unsigned int j;
-
-  for (cr = clients_head; NULL != cr; cr = cr->next)
-  {
-    if (cr->client == client)
-    {
-      GNUNET_SERVER_client_drop (client);
-      GNUNET_CONTAINER_DLL_remove (clients_head,
-                                   clients_tail,
-                                   cr);
-      for (i=0;i<UINT16_MAX;i++)
-      {
-        rr = &requests[i];
-        if (0 == rr->client_wait_list_length)
-          continue; /* not in use */
-        for (j=0;j<rr->client_wait_list_length;j++)
-        {
-          if (rr->client_wait_list[j] == cr)
-          {
-            rr->client_wait_list[j] = NULL;
-            next_phase (rr); 
-          }
-        }
-      }
-      GNUNET_free (cr);
-      return;
-    }
-  }
-}
-
-
-/**
- * Read a DNS response from the (unhindered) UDP-Socket
- *
- * @param cls socket to read from
- * @param tc scheduler context (must be shutdown or read ready)
- */
-static void
-read_response (void *cls,
-               const struct GNUNET_SCHEDULER_TaskContext *tc)
-{
-  struct GNUNET_NETWORK_Handle *dnsout = cls;
-  struct sockaddr_in addr4;
-  struct sockaddr_in6 addr6;
-  struct sockaddr *addr;
-  struct dns_header *dns;
-  socklen_t addrlen;
-  struct RequestRecord *rr;
-  ssize_t r;
-  int len;
-
-  if (dnsout == dnsout4)
-  {
-    addrlen = sizeof (struct sockaddr_in);
-    addr = (struct sockaddr* ) &addr4;
-    read4_task = GNUNET_SCHEDULER_add_read_net (GNUNET_TIME_UNIT_FOREVER_REL, 
-                                                dnsout,
-                                                &read_response, 
-                                                dnsout);
-  }
-  else
-  {
-    addrlen = sizeof (struct sockaddr_in6);
-    addr = (struct sockaddr* ) &addr6;
-    read6_task = GNUNET_SCHEDULER_add_read_net (GNUNET_TIME_UNIT_FOREVER_REL, 
-                                                dnsout,
-                                                &read_response, 
-                                                dnsout);
-  }
-  if (0 != (tc->reason & GNUNET_SCHEDULER_REASON_SHUTDOWN))
-    return;
-
-#ifndef MINGW
-  if (0 != ioctl (GNUNET_NETWORK_get_fd (dnsout), FIONREAD, &len))
-  {
-    /* conservative choice: */
-    len = 65536;
-  }
-#else
-  /* port the code above? */
-  len = 65536;
-#endif
-
-  {
-    unsigned char buf[len];
-
-    memset (addr, 0, addrlen);  
-    r = GNUNET_NETWORK_socket_recvfrom (dnsout, 
-                                        buf, sizeof (buf),
-                                        addr, &addrlen);
-    if (-1 == r)
-    {
-      GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR, "recvfrom");
-      return;
-    }
-    if (sizeof (struct dns_header) > r)
-    {
-      GNUNET_log (GNUNET_ERROR_TYPE_ERROR, 
-                  _("Received DNS response that is too small (%u bytes)"),
-                  r);
-      return;
-    }
-    dns = (struct dns_header *) buf;
-    rr = &requests[dns->id];
-    if (rr->phase != RP_INTERNET_DNS) 
-    {
-      /* unexpected / bogus reply */
-      GNUNET_STATISTICS_update (stats,
-                                gettext_noop ("# External DNS response discarded (no matching request)"),
-                                1, GNUNET_NO);
-      return; 
-    }
-    GNUNET_free_non_null (rr->payload);
-    rr->payload = GNUNET_malloc (len);
-    memcpy (rr->payload, buf, len);
-    rr->payload_length = len;
-    next_phase (rr);
-  }  
-}
-
-
-/**
- * Open source port for sending DNS request on IPv4.
- *
- * @return GNUNET_OK on success
- */ 
-static int
-open_port4 ()
-{
-  struct sockaddr_in addr;
-  socklen_t addrlen;
-
-  dnsout4 = GNUNET_NETWORK_socket_create (AF_INET, SOCK_DGRAM, 0);
-  if (dnsout4 == NULL)
-    return GNUNET_SYSERR;
-
-  memset (&addr, 0, sizeof (struct sockaddr_in));
-  addr.sin_family = AF_INET;
-  int err = GNUNET_NETWORK_socket_bind (dnsout4,
-                                        (struct sockaddr *) &addr,
-                                        sizeof (struct sockaddr_in));
-
-  if (err != GNUNET_OK)
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, 
-                _("Could not bind to any port: %s\n"),
-                STRERROR (errno));
-    GNUNET_NETWORK_socket_close (dnsout4);
-    dnsout4 = NULL;
-    return GNUNET_SYSERR;
-  }
-
-  /* Read the port we bound to */
-  addrlen = sizeof (struct sockaddr_in);
-  if (0 != getsockname (GNUNET_NETWORK_get_fd (dnsout4), 
-                        (struct sockaddr *) &addr,
-                        &addrlen))
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, 
-                _("Could not determine port I got: %s\n"),
-                STRERROR (errno));
-    GNUNET_NETWORK_socket_close (dnsout4);
-    dnsout4 = NULL;
-    return GNUNET_SYSERR;
-  }
-  dnsoutport = htons (addr.sin_port);
-
-  GNUNET_log (GNUNET_ERROR_TYPE_INFO, 
-              _("GNUnet DNS will exit on source port %u\n"),
-              (unsigned int) dnsoutport);
-  read4_task = GNUNET_SCHEDULER_add_read_net (GNUNET_TIME_UNIT_FOREVER_REL, 
-                                              dnsout4,
-                                              &read_response, dnsout4);
-  return GNUNET_OK;
-}
-
-
-/**
- * Open source port for sending DNS request on IPv6.  Should be 
- * called AFTER open_port4.
- *
- * @return GNUNET_OK on success
- */ 
-static int
-open_port6 ()
-{
-  struct sockaddr_in6 addr;
-  socklen_t addrlen;
-
-  dnsout6 = GNUNET_NETWORK_socket_create (AF_INET6, SOCK_DGRAM, 0);
-  if (dnsout6 == NULL)
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, 
-                _("Could not create IPv6 socket: %s\n"),
-                STRERROR (errno));
-    return GNUNET_SYSERR;
-  }
-  memset (&addr, 0, sizeof (struct sockaddr_in6));
-  addr.sin6_family = AF_INET6;
-  addr.sin6_port = htons (dnsoutport);
-  int err = GNUNET_NETWORK_socket_bind (dnsout6,
-                                        (struct sockaddr *) &addr,
-                                        sizeof (struct sockaddr_in6));
-
-  if (err != GNUNET_OK)
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                _("Could not bind to port %u: %s\n"),
-                (unsigned int) dnsoutport,
-                STRERROR (errno));
-    GNUNET_NETWORK_socket_close (dnsout6);
-    dnsout6 = NULL;
-    return GNUNET_SYSERR;
-  }
-  if (0 == dnsoutport)
-  {
-    addrlen = sizeof (struct sockaddr_in6);
-    if (0 != getsockname (GNUNET_NETWORK_get_fd (dnsout6), 
-                          (struct sockaddr *) &addr,
-                          &addrlen))
-    {
-      GNUNET_log (GNUNET_ERROR_TYPE_ERROR, 
-                  _("Could not determine port I got: %s\n"),
-                  STRERROR (errno));
-      GNUNET_NETWORK_socket_close (dnsout6);
-      dnsout6 = NULL;
-      return GNUNET_SYSERR;
-    }
-  }
-  dnsoutport = htons (addr.sin6_port);
-  read6_task = GNUNET_SCHEDULER_add_read_net (GNUNET_TIME_UNIT_FOREVER_REL,
-                                              dnsout6,
-                                              &read_response, dnsout6);
-  return GNUNET_YES;
-}
-
-
-/**
- * We got a new client.  Make sure all new DNS requests pass by its desk.
- *
- * @param cls unused
- * @param client the new client
- * @param message the init message (unused)
- */
-static void
-handle_client_init (void *cls GNUNET_UNUSED, 
-                    struct GNUNET_SERVER_Client *client,
-                    const struct GNUNET_MessageHeader *message)
-{
-  struct ClientRecord *cr;
-  const struct GNUNET_DNS_Register *reg = (const struct GNUNET_DNS_Register*) message;
-
-  cr = GNUNET_malloc (sizeof (struct ClientRecord));
-  cr->client = client;
-  cr->flags = (enum GNUNET_DNS_Flags) ntohl (reg->flags);  
-  GNUNET_SERVER_client_keep (client);
-  GNUNET_CONTAINER_DLL_insert (clients_head,
-                               clients_tail,
-                               cr);
-  GNUNET_SERVER_notification_context_add (nc, client);
-  GNUNET_SERVER_receive_done (client, GNUNET_OK);
-}
-
-
-/**
- * We got a response from a client.
- *
- * @param cls unused
- * @param client the client
- * @param message the response
- */
-static void
-handle_client_response (void *cls GNUNET_UNUSED, 
-                        struct GNUNET_SERVER_Client *client,
-                        const struct GNUNET_MessageHeader *message)
-{
-  const struct GNUNET_DNS_Response *resp;
-  struct RequestRecord *rr;
-  unsigned int i;
-  uint16_t msize;
-  uint16_t off;
-
-  msize = ntohs (message->size);
-  if (msize < sizeof (struct GNUNET_DNS_Response))
-  {
-    GNUNET_break (0);
-    GNUNET_SERVER_receive_done (client, GNUNET_SYSERR);
-    return;
-  }
-  resp = (const struct GNUNET_DNS_Response*) message;
-  off = (uint16_t) resp->request_id;
-  rr = &requests[off];
-  if (rr->request_id != resp->request_id)
-  {
-    GNUNET_STATISTICS_update (stats,
-                              gettext_noop ("# Client response discarded (no matching request)"),
-                              1, GNUNET_NO);
-    GNUNET_SERVER_receive_done (client, GNUNET_OK);
-    return;
-  }
-  for (i=0;i<rr->client_wait_list_length;i++)
-  {
-    if (NULL == rr->client_wait_list[i])
-      continue;
-    if (rr->client_wait_list[i]->client != client)
-      continue;
-    rr->client_wait_list[i] = NULL;
-    switch (ntohl (resp->drop_flag))
-    {
-    case 0: /* drop */
-      rr->phase = RP_DROP;
-      break;
-    case 1: /* no change */
-      break;
-    case 2: /* update */
-      msize -= sizeof (struct GNUNET_DNS_Response);
-      if ( (sizeof (struct dns_header) > msize) ||
-           (RP_REQUEST_MONITOR == rr->phase) ||
-           (RP_RESPONSE_MONITOR == rr->phase) )
-      {
-        GNUNET_break (0);
-        GNUNET_SERVER_receive_done (client, GNUNET_SYSERR);
-        next_phase (rr); 
-        return;
-      }
-      GNUNET_free_non_null (rr->payload);
-#if DEBUG_DNS
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  _("Changing DNS reply according to client specifications\n"));
-#endif
-      rr->payload = GNUNET_malloc (msize);
-      rr->payload_length = msize;
-      memcpy (rr->payload, &resp[1], msize);
-      if (rr->phase == RP_QUERY)
-      {
-        /* clear wait list, we're moving to MODIFY phase next */
-        GNUNET_array_grow (rr->client_wait_list,
-                           rr->client_wait_list_length,
-                           0);
-      }
-      break;
-    }
-    next_phase (rr); 
-    GNUNET_SERVER_receive_done (client, GNUNET_OK);
-    return;      
-  }
-  /* odd, client was not on our list for the request, that ought
-     to be an error */
-  GNUNET_break (0);
-  GNUNET_SERVER_receive_done (client, GNUNET_SYSERR);
-}
-
-
-/**
- * Functions with this signature are called whenever a complete
- * message is received by the tokenizer from the DNS hijack process.
- *
- * @param cls closure
- * @param client identification of the client
- * @param message the actual message, a DNS request we should handle
- */
-static void
-process_helper_messages (void *cls GNUNET_UNUSED, void *client,
-                         const struct GNUNET_MessageHeader *message)
-{
-  uint16_t msize;
-  const struct tun_header *tun;
-  const struct ip4_header *ip4;
-  const struct ip6_header *ip6;
-  const struct udp_packet *udp;
-  const struct dns_header *dns;
-  struct RequestRecord *rr;
-  struct sockaddr_in *srca4;
-  struct sockaddr_in6 *srca6;
-  struct sockaddr_in *dsta4;
-  struct sockaddr_in6 *dsta6;
-
-  msize = ntohs (message->size);
-  if (msize < sizeof (struct GNUNET_MessageHeader) + sizeof (struct tun_header) + sizeof (struct ip4_header))
-  {
-    /* non-IP packet received on TUN!? */
-    GNUNET_break (0);
-    return;
-  }
-  msize -= sizeof (struct GNUNET_MessageHeader);
-  tun = (const struct tun_header *) &message[1];
-  msize -= sizeof (struct tun_header);
-  switch (ntohs (tun->proto))
-  {
-  case ETH_P_IPV4:
-    ip4 = (const struct ip4_header *) &tun[1];
-    if ( (msize < sizeof (struct ip4_header)) ||
-         (ip4->version != IPVERSION) ||
-         (ip4->header_length != sizeof (struct ip4_header) / 4) ||
-         (ntohs(ip4->total_length) != msize) ||
-         (ip4->protocol != IPPROTO_UDP) )
-    {
-      /* non-IP/UDP packet received on TUN (or with options) */
-      GNUNET_log (GNUNET_ERROR_TYPE_INFO,
-                  _("Received malformed IPv4-UDP packet on TUN interface.\n"));
-      return;
-    }
-    udp = (const struct udp_packet*) &ip4[1];
-    msize -= sizeof (struct ip4_header);
-    break;
-  case ETH_P_IPV6:
-    ip6 = (const struct ip6_header *) &tun[1];
-    if ( (msize < sizeof (struct ip6_header)) ||
-         (ip6->version != 6) ||
-         (ntohs (ip6->payload_length) != msize) ||
-         (ip6->next_header != IPPROTO_UDP) )
-    {
-      /* non-IP/UDP packet received on TUN (or with extensions) */
-      GNUNET_log (GNUNET_ERROR_TYPE_INFO,
-                  _("Received malformed IPv6-UDP packet on TUN interface.\n"));
-      return;
-    }
-    udp = (const struct udp_packet*) &ip6[1];
-    msize -= sizeof (struct ip6_header);
-    break;
-  default:
-    /* non-IP packet received on TUN!? */
-    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
-                _("Got non-IP packet with %u bytes and protocol %u from TUN\n"),
-                (unsigned int) msize,
-                ntohs (tun->proto));
-    return;
-  }
-  if (msize <= sizeof (struct udp_packet) + sizeof (struct dns_header))
-  {    
-    /* non-DNS packet received on TUN, ignore */
-    GNUNET_STATISTICS_update (stats,
-                              gettext_noop ("# Non-DNS UDP packet received via TUN interface"),
-                              1, GNUNET_NO);
-    return;
-  }
-  msize -= sizeof (struct udp_packet);
-  dns = (const struct dns_header*) &udp[1];
-  rr = &requests[dns->id];
-
-  /* clean up from previous request */
-  GNUNET_free_non_null (rr->payload);
-  rr->payload = NULL;
-  GNUNET_array_grow (rr->client_wait_list,
-                     rr->client_wait_list_length,
-                     0);
-
-  /* setup new request */
-  rr->phase = RP_INIT;
-  if (ip4->version == IPVERSION)
-  {
-    srca4 = (struct sockaddr_in*) &rr->src_addr;
-    dsta4 = (struct sockaddr_in*) &rr->dst_addr;
-    memset (srca4, 0, sizeof (struct sockaddr_in));
-    memset (dsta4, 0, sizeof (struct sockaddr_in));
-    srca4->sin_family = AF_INET;
-    dsta4->sin_family = AF_INET;
-    srca4->sin_addr = ip4->source_address;
-    dsta4->sin_addr = ip4->destination_address;
-    srca4->sin_port = udp->spt;
-    dsta4->sin_port = udp->dpt;
-#if HAVE_SOCKADDR_IN_SIN_LEN
-    srca4->sin_len = sizeof (sizeof (struct sockaddr_in));
-    dsta4->sin_len = sizeof (sizeof (struct sockaddr_in));
-#endif
-  }
-  else /* ipv6 */
-  {
-    srca6 = (struct sockaddr_in6*) &rr->src_addr;
-    dsta6 = (struct sockaddr_in6*) &rr->dst_addr;
-    memset (srca6, 0, sizeof (struct sockaddr_in6));
-    memset (dsta6, 0, sizeof (struct sockaddr_in6));
-    srca6->sin6_family = AF_INET6;
-    dsta6->sin6_family = AF_INET6;
-    srca6->sin6_addr = ip6->source_address;
-    dsta6->sin6_addr = ip6->destination_address;
-    srca6->sin6_port = udp->spt;
-    dsta6->sin6_port = udp->dpt;
-#if HAVE_SOCKADDR_IN_SIN_LEN
-    srca6->sin6_len = sizeof (sizeof (struct sockaddr_in6));
-    dsta6->sin6_len = sizeof (sizeof (struct sockaddr_in6));
-#endif
-  }
-  rr->payload = GNUNET_malloc (msize);
-  rr->payload_length = msize;
-  memcpy (rr->payload, dns, msize);
-  rr->request_id = dns->id | (request_id_gen << 16);
-  request_id_gen++;
-
-  GNUNET_STATISTICS_update (stats,
-                            gettext_noop ("# DNS requests received via TUN interface"),
-                            1, GNUNET_NO);
-  /* start request processing state machine */
-  next_phase (rr);
-}
-
-
-/**
- * @param cls closure
- * @param server the initialized server
- * @param cfg_ configuration to use
- */
-static void
-run (void *cls, struct GNUNET_SERVER_Handle *server,
-     const struct GNUNET_CONFIGURATION_Handle *cfg_)
-{
-  static const struct GNUNET_SERVER_MessageHandler handlers[] = {
-    /* callback, cls, type, size */
-    {&handle_client_init, NULL, GNUNET_MESSAGE_TYPE_DNS_CLIENT_INIT, 
-     sizeof (struct GNUNET_DNS_Register)},
-    {&handle_client_response, NULL, GNUNET_MESSAGE_TYPE_DNS_CLIENT_RESPONSE, 0},
-    {NULL, NULL, 0, 0}
-  };
-  char port_s[6];
-  char *ifc_name;
-  char *ipv4addr;
-  char *ipv4mask;
-  char *ipv6addr;
-  char *ipv6prefix;
-
-  cfg = cfg_;
-  stats = GNUNET_STATISTICS_create ("dns", cfg);
-  nc = GNUNET_SERVER_notification_context_create (server, 1);
-  GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_UNIT_FOREVER_REL, &cleanup_task,
-                                cls);
-  if (GNUNET_YES ==
-      GNUNET_CONFIGURATION_get_value_yesno (cfg_, "dns", "PROVIDE_EXIT"))
-  {
-    if ( (GNUNET_OK != open_port4 ()) &&
-         (GNUNET_OK != open_port6 ()) )
-    {
-      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                  _("Failed to open any port to provide DNS exit\n"));
-      GNUNET_SCHEDULER_shutdown ();
-      return;
-    }
-  }
-
-  helper_argv[0] = GNUNET_strdup ("gnunet-dns");
-  if (GNUNET_SYSERR ==
-      GNUNET_CONFIGURATION_get_value_string (cfg, "dns", "IFNAME", &ifc_name))
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                "No entry 'IFNAME' in configuration!\n");
-    GNUNET_SCHEDULER_shutdown ();
-    return;
-  }
-  helper_argv[1] = ifc_name;
-  if ( (GNUNET_SYSERR ==
-        GNUNET_CONFIGURATION_get_value_string (cfg, "dns", "IPV6ADDR",
-                                               &ipv6addr)) )
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                "No entry 'IPV6ADDR' in configuration!\n");
-    GNUNET_SCHEDULER_shutdown ();
-    return;
-  }
-  helper_argv[2] = ipv6addr;
-  if (GNUNET_SYSERR ==
-      GNUNET_CONFIGURATION_get_value_string (cfg, "dns", "IPV6PREFIX",
-                                             &ipv6prefix))
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                "No entry 'IPV6PREFIX' in configuration!\n");
-    GNUNET_SCHEDULER_shutdown ();
-    return;
-  }
-  helper_argv[3] = ipv6prefix;
-
-  if (GNUNET_SYSERR ==
-      GNUNET_CONFIGURATION_get_value_string (cfg, "dns", "IPV4ADDR",
-                                             &ipv4addr))
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                "No entry 'IPV4ADDR' in configuration!\n");
-    GNUNET_SCHEDULER_shutdown ();
-    return;
-  }
-  helper_argv[4] = ipv4addr;
-  if (GNUNET_SYSERR ==
-      GNUNET_CONFIGURATION_get_value_string (cfg, "dns", "IPV4MASK",
-                                             &ipv4mask))
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                "No entry 'IPV4MASK' in configuration!\n");
-    GNUNET_SCHEDULER_shutdown ();
-    return;
-  }
-  helper_argv[5] = ipv4mask;
-  GNUNET_snprintf (port_s, 
-                   sizeof (port_s), 
-                   "%u", 
-                   (unsigned int) dnsoutport);
-  helper_argv[6] = GNUNET_strdup (port_s);
-  helper_argv[7] = NULL;
-  hijacker = GNUNET_HELPER_start ("gnunet-helper-dns",
-                                  helper_argv,
-                                  &process_helper_messages,
-                                  NULL);
-  GNUNET_SERVER_add_handlers (server, handlers);
-  GNUNET_SERVER_disconnect_notify (server, &client_disconnect, NULL);
-}
-
-
-/**
- * The main function for the dns service.
- *
- * @param argc number of arguments from the command line
- * @param argv command line arguments
- * @return 0 ok, 1 on error
- */
-int
-main (int argc, char *const *argv)
-{
-  return (GNUNET_OK ==
-          GNUNET_SERVICE_run (argc, argv, "dns", GNUNET_SERVICE_OPTION_NONE,
-                              &run, NULL)) ? 0 : 1;
-}
-
-
-/* end of gnunet-service-dns_new.c */