-Merge branch 'master' of ssh://gnunet.org/gnunet into gsoc2018/rest_api

18 files changed, 4610 insertions, 697 deletions

diff --git a/src/util/.gitignore b/src/util/.gitignore
index 23139a1ab..7b190ca76 100644
--- a/src/util/.gitignore
+++ b/src/util/.gitignore
@@ -69,3 +69,7 @@ perf_crypto_hash
 perf_crypto_symmetric
 perf_crypto_rsa
 perf_crypto_ecc_dlog
+test_hexcoder 
+test_regex
+test_tun
+gnunet-timeout
diff --git a/src/util/Makefile.am b/src/util/Makefile.am
index 4296199db..4ae073c2c 100644
--- a/src/util/Makefile.am
+++ b/src/util/Makefile.am
@@ -89,6 +89,8 @@ libgnunetutil_la_SOURCES = \
   crypto_rsa.c \
   disk.c \
   disk.h \
+  dnsparser.c \
+  dnsstub.c \
   getopt.c \
   getopt_helpers.c \
   helper.c \
@@ -104,12 +106,14 @@ libgnunetutil_la_SOURCES = \
   peer.c \
   plugin.c \
   program.c \
+  regex.c \
   resolver_api.c resolver.h \
   scheduler.c \
   service.c \
   signal.c \
   strings.c \
   time.c \
+  tun.c \
   speedup.c speedup.h
 
 libgnunetutil_la_LIBADD = \
@@ -117,7 +121,7 @@ libgnunetutil_la_LIBADD = \
   $(LIBGCRYPT_LIBS) \
   $(LTLIBICONV) \
   $(LTLIBINTL) \
-  -lltdl $(Z_LIBS) -lunistring $(XLIB)
+  -lltdl -lidn $(Z_LIBS) -lunistring $(XLIB)
 
 libgnunetutil_la_LDFLAGS = \
   $(GN_LIB_LDFLAGS) \
@@ -162,6 +166,7 @@ lib_LTLIBRARIES = libgnunetutil.la
 
 libexec_PROGRAMS = \
  gnunet-service-resolver \
+ gnunet-timeout \
  $(W32CONSOLEHELPER)
 
 bin_SCRIPTS =\
@@ -188,6 +193,15 @@ endif
 endif
 
 
+if !MINGW
+gnunet_timeout_SOURCES = \
+ gnunet-timeout.c
+else
+gnunet_timeout_SOURCES = \
+ gnunet-timeout-w32.c
+endif
+
+
 do_subst = $(SED) -e 's,[@]PYTHON[@],$(PYTHON),g'
 
 gnunet-qr: gnunet-qr.py.in Makefile
@@ -291,19 +305,22 @@ check_PROGRAMS = \
  test_crypto_rsa \
  test_disk \
  test_getopt \
+ test_hexcoder \
  test_mq \
  test_os_network \
  test_peer \
  test_plugin \
  test_program \
+ test_regex \
  test_resolver_api.nc \
  test_scheduler \
  test_scheduler_delay \
  test_service \
  test_strings \
  test_strings_to_data \
- test_time \
  test_speedup \
+ test_time \
+ test_tun \
  $(BENCHMARKS) \
  test_os_start_process \
  test_common_logging_runtime_loglevels
@@ -319,6 +336,20 @@ test_bio_SOURCES = \
 test_bio_LDADD = \
  libgnunetutil.la
 
+test_hexcoder_SOURCES = \
+ test_hexcoder.c
+test_hexcoder_LDADD = \
+ libgnunetutil.la
+
+test_tun_SOURCES = \
+ test_tun.c
+test_tun_LDADD = \
+ libgnunetutil.la
+
+test_regex_SOURCES = \
+ test_regex.c
+test_regex_LDADD = \
+ libgnunetutil.la
 
 test_os_start_process_SOURCES = \
  test_os_start_process.c
@@ -601,4 +632,4 @@ EXTRA_DIST = \
   test_resolver_api_data.conf \
   test_service_data.conf \
   test_speedup_data.conf \
-  gnunet-qr.py.in 
+  gnunet-qr.py.in
diff --git a/src/util/client.c b/src/util/client.c
index 44e326eab..1f569255a 100644
--- a/src/util/client.c
+++ b/src/util/client.c
@@ -11,7 +11,7 @@
      WITHOUT ANY WARRANTY; without even the implied warranty of
      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
      Affero General Public License for more details.
-    
+
      You should have received a copy of the GNU Affero General Public License
      along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
@@ -721,6 +721,17 @@ test_service_configuration (const char *service_name,
                                                 &unixpath)) &&
       (0 < strlen (unixpath)))
     ret = GNUNET_OK;
+  else if ((GNUNET_OK ==
+            GNUNET_CONFIGURATION_have_value (cfg,
+                                             service_name,
+                                             "UNIXPATH")))
+  {
+    GNUNET_log_config_invalid (GNUNET_ERROR_TYPE_ERROR,
+                               service_name,
+                               "UNIXPATH",
+                               _("not a valid filename"));
+    return GNUNET_SYSERR; /* UNIXPATH specified but invalid! */
+  }
   GNUNET_free_non_null (unixpath);
 #endif
 
diff --git a/src/util/dnsparser.c b/src/util/dnsparser.c
new file mode 100644
index 000000000..6fb6d657f
--- /dev/null
+++ b/src/util/dnsparser.c
@@ -0,0 +1,1458 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2010-2014 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/**
+ * @file dns/dnsparser.c
+ * @brief helper library to parse DNS packets.
+ * @author Philipp Toelke
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include <idna.h>
+#if WINDOWS
+#include <idn-free.h>
+#endif
+#include "gnunet_util_lib.h"
+
+
+/**
+ * Check if a label in UTF-8 format can be coded into valid IDNA.
+ * This can fail if the ASCII-conversion becomes longer than 63 characters.
+ *
+ * @param label label to check (UTF-8 string)
+ * @return #GNUNET_OK if the label can be converted to IDNA,
+ *         #GNUNET_SYSERR if the label is not valid for DNS names
+ */
+int
+GNUNET_DNSPARSER_check_label (const char *label)
+{
+  char *output;
+  size_t slen;
+
+  if (NULL != strchr (label, '.'))
+    return GNUNET_SYSERR; /* not a label! Did you mean GNUNET_DNSPARSER_check_name? */
+  if (IDNA_SUCCESS !=
+      idna_to_ascii_8z (label, &output, IDNA_ALLOW_UNASSIGNED))
+    return GNUNET_SYSERR;
+  slen = strlen (output);
+#if WINDOWS
+  idn_free (output);
+#else
+  free (output);
+#endif
+  return (slen > 63) ? GNUNET_SYSERR : GNUNET_OK;
+}
+
+
+/**
+ * Check if a label in UTF-8 format can be coded into valid IDNA.
+ * This can fail if the ASCII-conversion becomes longer than 253 characters.
+ *
+ * @param name name to check (UTF-8 string)
+ * @return #GNUNET_OK if the label can be converted to IDNA,
+ *         #GNUNET_SYSERR if the label is not valid for DNS names
+ */
+int
+GNUNET_DNSPARSER_check_name (const char *name)
+{
+  char *ldup;
+  char *output;
+  size_t slen;
+  char *tok;
+
+  ldup = GNUNET_strdup (name);
+  for (tok = strtok (ldup, "."); NULL != tok; tok = strtok (NULL, "."))
+    if (GNUNET_OK !=
+        GNUNET_DNSPARSER_check_label (tok))
+    {
+      GNUNET_free (ldup);
+      return GNUNET_SYSERR;
+    }
+  GNUNET_free (ldup);
+  if (IDNA_SUCCESS !=
+      idna_to_ascii_8z (name, &output, IDNA_ALLOW_UNASSIGNED))
+    return GNUNET_SYSERR;
+  slen = strlen (output);
+#if WINDOWS
+  idn_free (output);
+#else
+  free (output);
+#endif
+  return (slen > 253) ? GNUNET_SYSERR : GNUNET_OK;
+}
+
+
+/**
+ * Free SOA information record.
+ *
+ * @param soa record to free
+ */
+void
+GNUNET_DNSPARSER_free_soa (struct GNUNET_DNSPARSER_SoaRecord *soa)
+{
+  if (NULL == soa)
+    return;
+  GNUNET_free_non_null (soa->mname);
+  GNUNET_free_non_null (soa->rname);
+  GNUNET_free (soa);
+}
+
+
+/**
+ * Free CERT information record.
+ *
+ * @param cert record to free
+ */
+void
+GNUNET_DNSPARSER_free_cert (struct GNUNET_DNSPARSER_CertRecord *cert)
+{
+  if (NULL == cert)
+    return;
+  GNUNET_free_non_null (cert->certificate_data);
+  GNUNET_free (cert);
+}
+
+
+/**
+ * Free SRV information record.
+ *
+ * @param srv record to free
+ */
+void
+GNUNET_DNSPARSER_free_srv (struct GNUNET_DNSPARSER_SrvRecord *srv)
+{
+  if (NULL == srv)
+    return;
+  GNUNET_free_non_null (srv->target);
+  GNUNET_free (srv);
+}
+
+
+/**
+ * Free MX information record.
+ *
+ * @param mx record to free
+ */
+void
+GNUNET_DNSPARSER_free_mx (struct GNUNET_DNSPARSER_MxRecord *mx)
+{
+  if (NULL == mx)
+    return;
+  GNUNET_free_non_null (mx->mxhost);
+  GNUNET_free (mx);
+}
+
+
+/**
+ * Free the given DNS record.
+ *
+ * @param r record to free
+ */
+void
+GNUNET_DNSPARSER_free_record (struct GNUNET_DNSPARSER_Record *r)
+{
+  GNUNET_free_non_null (r->name);
+  switch (r->type)
+  {
+  case GNUNET_DNSPARSER_TYPE_MX:
+    GNUNET_DNSPARSER_free_mx (r->data.mx);
+    break;
+  case GNUNET_DNSPARSER_TYPE_SOA:
+    GNUNET_DNSPARSER_free_soa (r->data.soa);
+    break;
+  case GNUNET_DNSPARSER_TYPE_SRV:
+    GNUNET_DNSPARSER_free_srv (r->data.srv);
+    break;
+  case GNUNET_DNSPARSER_TYPE_CERT:
+    GNUNET_DNSPARSER_free_cert (r->data.cert);
+    break;
+  case GNUNET_DNSPARSER_TYPE_NS:
+  case GNUNET_DNSPARSER_TYPE_CNAME:
+  case GNUNET_DNSPARSER_TYPE_PTR:
+    GNUNET_free_non_null (r->data.hostname);
+    break;
+  default:
+    GNUNET_free_non_null (r->data.raw.data);
+    break;
+  }
+}
+
+
+/**
+ * Parse name inside of a DNS query or record.
+ *
+ * @param udp_payload entire UDP payload
+ * @param udp_payload_length length of @a udp_payload
+ * @param off pointer to the offset of the name to parse in the udp_payload (to be
+ *                    incremented by the size of the name)
+ * @param depth current depth of our recursion (to prevent stack overflow)
+ * @return name as 0-terminated C string on success, NULL if the payload is malformed
+ */
+static char *
+parse_name (const char *udp_payload,
+            size_t udp_payload_length,
+            size_t *off,
+            unsigned int depth)
+{
+  const uint8_t *input = (const uint8_t *) udp_payload;
+  char *ret;
+  char *tmp;
+  char *xstr;
+  uint8_t len;
+  size_t xoff;
+  char *utf8;
+  Idna_rc rc;
+
+  ret = GNUNET_strdup ("");
+  while (1)
+  {
+    if (*off >= udp_payload_length)
+    {
+      GNUNET_break_op (0);
+      goto error;
+    }
+    len = input[*off];
+    if (0 == len)
+    {
+      (*off)++;
+      break;
+    }
+    if (len < 64)
+    {
+      if (*off + 1 + len > udp_payload_length)
+      {
+        GNUNET_break_op (0);
+        goto error;
+      }
+      GNUNET_asprintf (&tmp,
+                       "%.*s",
+                       (int) len,
+                       &udp_payload[*off + 1]);
+      if (IDNA_SUCCESS !=
+          (rc = idna_to_unicode_8z8z (tmp, &utf8, IDNA_ALLOW_UNASSIGNED)))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                    _("Failed to convert DNS IDNA name `%s' to UTF-8: %s\n"),
+                    tmp,
+                    idna_strerror (rc));
+        GNUNET_free (tmp);
+        GNUNET_asprintf (&tmp,
+                         "%s%.*s.",
+                         ret,
+                         (int) len,
+                         &udp_payload[*off + 1]);
+      }
+      else
+      {
+        GNUNET_free (tmp);
+        GNUNET_asprintf (&tmp,
+                         "%s%s.",
+                         ret,
+                         utf8);
+#if WINDOWS
+        idn_free (utf8);
+#else
+        free (utf8);
+#endif
+      }
+      GNUNET_free (ret);
+      ret = tmp;
+      *off += 1 + len;
+    }
+    else if ((64 | 128) == (len & (64 | 128)) )
+    {
+      if (depth > 32)
+      {
+        GNUNET_break_op (0);
+        goto error; /* hard bound on stack to prevent "infinite" recursion, disallow! */
+      }
+      /* pointer to string */
+      if (*off + 1 > udp_payload_length)
+      {
+        GNUNET_break_op (0);
+        goto error;
+      }
+      xoff = ((len - (64 | 128)) << 8) + input[*off+1];
+      xstr = parse_name (udp_payload,
+                         udp_payload_length,
+                         &xoff,
+                         depth + 1);
+      if (NULL == xstr)
+      {
+        GNUNET_break_op (0);
+        goto error;
+      }
+      GNUNET_asprintf (&tmp,
+                       "%s%s.",
+                       ret,
+                       xstr);
+      GNUNET_free (ret);
+      GNUNET_free (xstr);
+      ret = tmp;
+      if (strlen (ret) > udp_payload_length)
+      {
+        GNUNET_break_op (0);
+        goto error; /* we are looping (building an infinite string) */
+      }
+      *off += 2;
+      /* pointers always terminate names */
+      break;
+    }
+    else
+    {
+      /* neither pointer nor inline string, not supported... */
+      GNUNET_break_op (0);
+      goto error;
+    }
+  }
+  if (0 < strlen(ret))
+    ret[strlen(ret)-1] = '\0'; /* eat tailing '.' */
+  return ret;
+ error:
+  GNUNET_break_op (0);
+  GNUNET_free (ret);
+  return NULL;
+}
+
+
+/**
+ * Parse name inside of a DNS query or record.
+ *
+ * @param udp_payload entire UDP payload
+ * @param udp_payload_length length of @a udp_payload
+ * @param off pointer to the offset of the name to parse in the udp_payload (to be
+ *                    incremented by the size of the name)
+ * @return name as 0-terminated C string on success, NULL if the payload is malformed
+ */
+char *
+GNUNET_DNSPARSER_parse_name (const char *udp_payload,
+                             size_t udp_payload_length,
+                             size_t *off)
+{
+  return parse_name (udp_payload, udp_payload_length, off, 0);
+}
+
+
+/**
+ * Parse a DNS query entry.
+ *
+ * @param udp_payload entire UDP payload
+ * @param udp_payload_length length of @a udp_payload
+ * @param off pointer to the offset of the query to parse in the udp_payload (to be
+ *                    incremented by the size of the query)
+ * @param q where to write the query information
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR if the query is malformed
+ */
+int
+GNUNET_DNSPARSER_parse_query (const char *udp_payload,
+                              size_t udp_payload_length,
+                              size_t *off,
+                              struct GNUNET_DNSPARSER_Query *q)
+{
+  char *name;
+  struct GNUNET_TUN_DnsQueryLine ql;
+
+  name = GNUNET_DNSPARSER_parse_name (udp_payload,
+                                      udp_payload_length,
+                                      off);
+  if (NULL == name)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  q->name = name;
+  if (*off + sizeof (struct GNUNET_TUN_DnsQueryLine) > udp_payload_length)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_memcpy (&ql, &udp_payload[*off], sizeof (ql));
+  *off += sizeof (ql);
+  q->type = ntohs (ql.type);
+  q->dns_traffic_class = ntohs (ql.dns_traffic_class);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Parse a DNS SOA record.
+ *
+ * @param udp_payload reference to UDP packet
+ * @param udp_payload_length length of @a udp_payload
+ * @param off pointer to the offset of the query to parse in the SOA record (to be
+ *                    incremented by the size of the record), unchanged on error
+ * @return the parsed SOA record, NULL on error
+ */
+struct GNUNET_DNSPARSER_SoaRecord *
+GNUNET_DNSPARSER_parse_soa (const char *udp_payload,
+                            size_t udp_payload_length,
+                            size_t *off)
+{
+  struct GNUNET_DNSPARSER_SoaRecord *soa;
+  struct GNUNET_TUN_DnsSoaRecord soa_bin;
+  size_t old_off;
+
+  old_off = *off;
+  soa = GNUNET_new (struct GNUNET_DNSPARSER_SoaRecord);
+  soa->mname = GNUNET_DNSPARSER_parse_name (udp_payload,
+                                            udp_payload_length,
+                                            off);
+  soa->rname = GNUNET_DNSPARSER_parse_name (udp_payload,
+                                            udp_payload_length,
+                                            off);
+  if ( (NULL == soa->mname) ||
+       (NULL == soa->rname) ||
+       (*off + sizeof (struct GNUNET_TUN_DnsSoaRecord) > udp_payload_length) )
+  {
+    GNUNET_break_op (0);
+    GNUNET_DNSPARSER_free_soa (soa);
+    *off = old_off;
+    return NULL;
+  }
+  GNUNET_memcpy (&soa_bin,
+          &udp_payload[*off],
+          sizeof (struct GNUNET_TUN_DnsSoaRecord));
+  soa->serial = ntohl (soa_bin.serial);
+  soa->refresh = ntohl (soa_bin.refresh);
+  soa->retry = ntohl (soa_bin.retry);
+  soa->expire = ntohl (soa_bin.expire);
+  soa->minimum_ttl = ntohl (soa_bin.minimum);
+  (*off) += sizeof (struct GNUNET_TUN_DnsSoaRecord);
+  return soa;
+}
+
+
+/**
+ * Parse a DNS MX record.
+ *
+ * @param udp_payload reference to UDP packet
+ * @param udp_payload_length length of @a udp_payload
+ * @param off pointer to the offset of the query to parse in the MX record (to be
+ *                    incremented by the size of the record), unchanged on error
+ * @return the parsed MX record, NULL on error
+ */
+struct GNUNET_DNSPARSER_MxRecord *
+GNUNET_DNSPARSER_parse_mx (const char *udp_payload,
+                           size_t udp_payload_length,
+                           size_t *off)
+{
+  struct GNUNET_DNSPARSER_MxRecord *mx;
+  uint16_t mxpref;
+  size_t old_off;
+
+  old_off = *off;
+  if (*off + sizeof (uint16_t) > udp_payload_length)
+  {
+    GNUNET_break_op (0);
+    return NULL;
+  }
+  GNUNET_memcpy (&mxpref, &udp_payload[*off], sizeof (uint16_t));
+  (*off) += sizeof (uint16_t);
+  mx = GNUNET_new (struct GNUNET_DNSPARSER_MxRecord);
+  mx->preference = ntohs (mxpref);
+  mx->mxhost = GNUNET_DNSPARSER_parse_name (udp_payload,
+                                            udp_payload_length,
+                                            off);
+  if (NULL == mx->mxhost)
+  {
+    GNUNET_break_op (0);
+    GNUNET_DNSPARSER_free_mx (mx);
+    *off = old_off;
+    return NULL;
+  }
+  return mx;
+}
+
+
+/**
+ * Parse a DNS SRV record.
+ *
+ * @param udp_payload reference to UDP packet
+ * @param udp_payload_length length of @a udp_payload
+ * @param off pointer to the offset of the query to parse in the SRV record (to be
+ *                    incremented by the size of the record), unchanged on error
+ * @return the parsed SRV record, NULL on error
+ */
+struct GNUNET_DNSPARSER_SrvRecord *
+GNUNET_DNSPARSER_parse_srv (const char *udp_payload,
+                            size_t udp_payload_length,
+                            size_t *off)
+{
+  struct GNUNET_DNSPARSER_SrvRecord *srv;
+  struct GNUNET_TUN_DnsSrvRecord srv_bin;
+  size_t old_off;
+
+  old_off = *off;
+  if (*off + sizeof (struct GNUNET_TUN_DnsSrvRecord) > udp_payload_length)
+    return NULL;
+  GNUNET_memcpy (&srv_bin,
+          &udp_payload[*off],
+          sizeof (struct GNUNET_TUN_DnsSrvRecord));
+  (*off) += sizeof (struct GNUNET_TUN_DnsSrvRecord);
+  srv = GNUNET_new (struct GNUNET_DNSPARSER_SrvRecord);
+  srv->priority = ntohs (srv_bin.prio);
+  srv->weight = ntohs (srv_bin.weight);
+  srv->port = ntohs (srv_bin.port);
+  srv->target = GNUNET_DNSPARSER_parse_name (udp_payload,
+                                             udp_payload_length,
+                                             off);
+  if (NULL == srv->target)
+  {
+    GNUNET_DNSPARSER_free_srv (srv);
+    *off = old_off;
+    return NULL;
+  }
+  return srv;
+}
+
+
+/**
+ * Parse a DNS CERT record.
+ *
+ * @param udp_payload reference to UDP packet
+ * @param udp_payload_length length of @a udp_payload
+ * @param off pointer to the offset of the query to parse in the CERT record (to be
+ *                    incremented by the size of the record), unchanged on error
+ * @return the parsed CERT record, NULL on error
+ */
+struct GNUNET_DNSPARSER_CertRecord *
+GNUNET_DNSPARSER_parse_cert (const char *udp_payload,
+                             size_t udp_payload_length,
+                             size_t *off)
+{
+  struct GNUNET_DNSPARSER_CertRecord *cert;
+  struct GNUNET_TUN_DnsCertRecord dcert;
+
+  if (*off + sizeof (struct GNUNET_TUN_DnsCertRecord) >= udp_payload_length)
+  {
+    GNUNET_break_op (0);
+    return NULL;
+  }
+  GNUNET_memcpy (&dcert,
+                 &udp_payload[*off],
+                 sizeof (struct GNUNET_TUN_DnsCertRecord));
+  (*off) += sizeof (struct GNUNET_TUN_DnsCertRecord);
+  cert = GNUNET_new (struct GNUNET_DNSPARSER_CertRecord);
+  cert->cert_type = ntohs (dcert.cert_type);
+  cert->cert_tag = ntohs (dcert.cert_tag);
+  cert->algorithm = dcert.algorithm;
+  cert->certificate_size = udp_payload_length - (*off);
+  cert->certificate_data = GNUNET_malloc (cert->certificate_size);
+  GNUNET_memcpy (cert->certificate_data,
+                 &udp_payload[*off],
+                 cert->certificate_size);
+  (*off) += cert->certificate_size;
+  return cert;
+}
+
+
+/**
+ * Parse a DNS record entry.
+ *
+ * @param udp_payload entire UDP payload
+ * @param udp_payload_length length of @a udp_payload
+ * @param off pointer to the offset of the record to parse in the udp_payload (to be
+ *                    incremented by the size of the record)
+ * @param r where to write the record information
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR if the record is malformed
+ */
+int
+GNUNET_DNSPARSER_parse_record (const char *udp_payload,
+                               size_t udp_payload_length,
+                               size_t *off,
+                               struct GNUNET_DNSPARSER_Record *r)
+{
+  char *name;
+  struct GNUNET_TUN_DnsRecordLine rl;
+  size_t old_off;
+  uint16_t data_len;
+
+  name = GNUNET_DNSPARSER_parse_name (udp_payload,
+                                      udp_payload_length,
+                                      off);
+  if (NULL == name)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  r->name = name;
+  if (*off + sizeof (struct GNUNET_TUN_DnsRecordLine) > udp_payload_length)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_memcpy (&rl, &udp_payload[*off], sizeof (rl));
+  (*off) += sizeof (rl);
+  r->type = ntohs (rl.type);
+  r->dns_traffic_class = ntohs (rl.dns_traffic_class);
+  r->expiration_time = GNUNET_TIME_relative_to_absolute (GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS,
+                                                                                        ntohl (rl.ttl)));
+  data_len = ntohs (rl.data_len);
+  if (*off + data_len > udp_payload_length)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  old_off = *off;
+  switch (r->type)
+  {
+  case GNUNET_DNSPARSER_TYPE_NS:
+  case GNUNET_DNSPARSER_TYPE_CNAME:
+  case GNUNET_DNSPARSER_TYPE_DNAME:
+  case GNUNET_DNSPARSER_TYPE_PTR:
+    r->data.hostname = GNUNET_DNSPARSER_parse_name (udp_payload,
+                                                    udp_payload_length,
+                                                    off);
+    if ( (NULL == r->data.hostname) ||
+         (old_off + data_len != *off) )
+      return GNUNET_SYSERR;
+    return GNUNET_OK;
+  case GNUNET_DNSPARSER_TYPE_SOA:
+    r->data.soa = GNUNET_DNSPARSER_parse_soa (udp_payload,
+                                              udp_payload_length,
+                                              off);
+    if ( (NULL == r->data.soa) ||
+         (old_off + data_len != *off) )
+    {
+      GNUNET_break_op (0);
+      return GNUNET_SYSERR;
+    }
+    return GNUNET_OK;
+  case GNUNET_DNSPARSER_TYPE_MX:
+    r->data.mx = GNUNET_DNSPARSER_parse_mx (udp_payload,
+                                            udp_payload_length,
+                                            off);
+    if ( (NULL == r->data.mx) ||
+         (old_off + data_len != *off) )
+    {
+      GNUNET_break_op (0);
+      return GNUNET_SYSERR;
+    }
+    return GNUNET_OK;
+  case GNUNET_DNSPARSER_TYPE_SRV:
+    r->data.srv = GNUNET_DNSPARSER_parse_srv (udp_payload,
+                                              udp_payload_length,
+                                              off);
+    if ( (NULL == r->data.srv) ||
+         (old_off + data_len != *off) )
+    {
+      GNUNET_break_op (0);
+      return GNUNET_SYSERR;
+    }
+    return GNUNET_OK;
+  default:
+    r->data.raw.data = GNUNET_malloc (data_len);
+    r->data.raw.data_len = data_len;
+    GNUNET_memcpy (r->data.raw.data,
+                   &udp_payload[*off],
+                   data_len);
+    break;
+  }
+  (*off) += data_len;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Parse a UDP payload of a DNS packet in to a nice struct for further
+ * processing and manipulation.
+ *
+ * @param udp_payload wire-format of the DNS packet
+ * @param udp_payload_length number of bytes in @a udp_payload
+ * @return NULL on error, otherwise the parsed packet
+ */
+struct GNUNET_DNSPARSER_Packet *
+GNUNET_DNSPARSER_parse (const char *udp_payload,
+                        size_t udp_payload_length)
+{
+  struct GNUNET_DNSPARSER_Packet *p;
+  const struct GNUNET_TUN_DnsHeader *dns;
+  size_t off;
+  unsigned int n;
+
+  if (udp_payload_length < sizeof (struct GNUNET_TUN_DnsHeader))
+    return NULL;
+  dns = (const struct GNUNET_TUN_DnsHeader *) udp_payload;
+  off = sizeof (struct GNUNET_TUN_DnsHeader);
+  p = GNUNET_new (struct GNUNET_DNSPARSER_Packet);
+  p->flags = dns->flags;
+  p->id = dns->id;
+  n = ntohs (dns->query_count);
+  if (n > 0)
+  {
+    p->queries = GNUNET_new_array (n,
+                                   struct GNUNET_DNSPARSER_Query);
+    p->num_queries = n;
+    for (unsigned int i=0;i<n;i++)
+      if (GNUNET_OK !=
+          GNUNET_DNSPARSER_parse_query (udp_payload,
+                                        udp_payload_length,
+                                        &off,
+                                        &p->queries[i]))
+        goto error;
+  }
+  n = ntohs (dns->answer_rcount);
+  if (n > 0)
+  {
+    p->answers = GNUNET_new_array (n,
+                                   struct GNUNET_DNSPARSER_Record);
+    p->num_answers = n;
+    for (unsigned int i=0;i<n;i++)
+      if (GNUNET_OK !=
+          GNUNET_DNSPARSER_parse_record (udp_payload,
+                                         udp_payload_length,
+                                         &off,
+                                         &p->answers[i]))
+        goto error;
+  }
+  n = ntohs (dns->authority_rcount);
+  if (n > 0)
+  {
+    p->authority_records = GNUNET_new_array (n,
+                                             struct GNUNET_DNSPARSER_Record);
+    p->num_authority_records = n;
+    for (unsigned int i=0;i<n;i++)
+      if (GNUNET_OK !=
+          GNUNET_DNSPARSER_parse_record (udp_payload,
+                                         udp_payload_length,
+                                         &off,
+                                         &p->authority_records[i]))
+        goto error;
+  }
+  n = ntohs (dns->additional_rcount);
+  if (n > 0)
+  {
+    p->additional_records = GNUNET_new_array (n,
+                                              struct GNUNET_DNSPARSER_Record);
+    p->num_additional_records = n;
+    for (unsigned int i=0;i<n;i++)
+    {
+      if (GNUNET_OK !=
+          GNUNET_DNSPARSER_parse_record (udp_payload,
+                                         udp_payload_length,
+                                         &off,
+                                         &p->additional_records[i]))
+        goto error;
+    }
+  }
+  return p;
+ error:
+  GNUNET_break_op (0);
+  GNUNET_DNSPARSER_free_packet (p);
+  return NULL;
+}
+
+
+/**
+ * Duplicate (deep-copy) the given DNS record
+ *
+ * @param r the record
+ * @return the newly allocated record
+ */
+struct GNUNET_DNSPARSER_Record *
+GNUNET_DNSPARSER_duplicate_record (const struct GNUNET_DNSPARSER_Record *r)
+{
+  struct GNUNET_DNSPARSER_Record *dup = GNUNET_memdup (r, sizeof (*r));
+
+  dup->name = GNUNET_strdup (r->name);
+  switch (r->type)
+  {
+    case GNUNET_DNSPARSER_TYPE_NS:
+    case GNUNET_DNSPARSER_TYPE_CNAME:
+    case GNUNET_DNSPARSER_TYPE_PTR:
+    {
+      dup->data.hostname = GNUNET_strdup (r->data.hostname);
+      break;
+    }
+    case GNUNET_DNSPARSER_TYPE_SOA:
+    {
+      dup->data.soa = GNUNET_DNSPARSER_duplicate_soa_record (r->data.soa);
+      break;
+    }
+    case GNUNET_DNSPARSER_TYPE_CERT:
+    {
+      dup->data.cert = GNUNET_DNSPARSER_duplicate_cert_record (r->data.cert);
+      break;
+    }
+    case GNUNET_DNSPARSER_TYPE_MX:
+    {
+      dup->data.mx = GNUNET_DNSPARSER_duplicate_mx_record (r->data.mx);
+      break;
+    }
+    case GNUNET_DNSPARSER_TYPE_SRV:
+    {
+      dup->data.srv = GNUNET_DNSPARSER_duplicate_srv_record (r->data.srv);
+      break;
+    }
+    default:
+    {
+      dup->data.raw.data = GNUNET_memdup (r->data.raw.data,
+                                          r->data.raw.data_len);
+    }
+  }
+  return dup;
+}
+
+
+/**
+ * Duplicate (deep-copy) the given DNS record
+ *
+ * @param r the record
+ * @return the newly allocated record
+ */
+struct GNUNET_DNSPARSER_SoaRecord *
+GNUNET_DNSPARSER_duplicate_soa_record (const struct GNUNET_DNSPARSER_SoaRecord *r)
+{
+  struct GNUNET_DNSPARSER_SoaRecord *dup = GNUNET_memdup (r, sizeof (*r));
+
+  dup->mname = GNUNET_strdup (r->mname);
+  dup->rname = GNUNET_strdup (r->rname);
+  return dup;
+}
+
+
+/**
+ * Duplicate (deep-copy) the given DNS record
+ *
+ * @param r the record
+ * @return the newly allocated record
+ */
+struct GNUNET_DNSPARSER_CertRecord *
+GNUNET_DNSPARSER_duplicate_cert_record (const struct GNUNET_DNSPARSER_CertRecord *r)
+{
+  struct GNUNET_DNSPARSER_CertRecord *dup = GNUNET_memdup (r, sizeof (*r));
+
+  dup->certificate_data = GNUNET_strdup (r->certificate_data);
+  return dup;
+}
+
+
+/**
+ * Duplicate (deep-copy) the given DNS record
+ *
+ * @param r the record
+ * @return the newly allocated record
+ */
+struct GNUNET_DNSPARSER_MxRecord *
+GNUNET_DNSPARSER_duplicate_mx_record (const struct GNUNET_DNSPARSER_MxRecord *r)
+{
+  struct GNUNET_DNSPARSER_MxRecord *dup = GNUNET_memdup (r, sizeof (*r));
+
+  dup->mxhost = GNUNET_strdup (r->mxhost);
+  return dup;
+}
+
+
+/**
+ * Duplicate (deep-copy) the given DNS record
+ *
+ * @param r the record
+ * @return the newly allocated record
+ */
+struct GNUNET_DNSPARSER_SrvRecord *
+GNUNET_DNSPARSER_duplicate_srv_record (const struct GNUNET_DNSPARSER_SrvRecord *r)
+{
+  struct GNUNET_DNSPARSER_SrvRecord *dup = GNUNET_memdup (r, sizeof (*r));
+
+  dup->target = GNUNET_strdup (r->target);
+  return dup;
+}
+
+
+/**
+ * Free memory taken by a packet.
+ *
+ * @param p packet to free
+ */
+void
+GNUNET_DNSPARSER_free_packet (struct GNUNET_DNSPARSER_Packet *p)
+{
+  for (unsigned int i=0;i<p->num_queries;i++)
+    GNUNET_free_non_null (p->queries[i].name);
+  GNUNET_free_non_null (p->queries);
+  for (unsigned int i=0;i<p->num_answers;i++)
+    GNUNET_DNSPARSER_free_record (&p->answers[i]);
+  GNUNET_free_non_null (p->answers);
+  for (unsigned int i=0;i<p->num_authority_records;i++)
+    GNUNET_DNSPARSER_free_record (&p->authority_records[i]);
+  GNUNET_free_non_null (p->authority_records);
+  for (unsigned int i=0;i<p->num_additional_records;i++)
+    GNUNET_DNSPARSER_free_record (&p->additional_records[i]);
+  GNUNET_free_non_null (p->additional_records);
+  GNUNET_free (p);
+}
+
+
+/* ********************** DNS packet assembly code **************** */
+
+
+/**
+ * Add a DNS name to the UDP packet at the given location, converting
+ * the name to IDNA notation as necessary.
+ *
+ * @param dst where to write the name (UDP packet)
+ * @param dst_len number of bytes in @a dst
+ * @param off pointer to offset where to write the name (increment by bytes used)
+ *            must not be changed if there is an error
+ * @param name name to write
+ * @return #GNUNET_SYSERR if @a name is invalid
+ *         #GNUNET_NO if @a name did not fit
+ *         #GNUNET_OK if @a name was added to @a dst
+ */
+int
+GNUNET_DNSPARSER_builder_add_name (char *dst,
+                                   size_t dst_len,
+                                   size_t *off,
+                                   const char *name)
+{
+  const char *dot;
+  const char *idna_name;
+  char *idna_start;
+  size_t start;
+  size_t pos;
+  size_t len;
+  Idna_rc rc;
+
+  if (NULL == name)
+    return GNUNET_SYSERR;
+
+  if (IDNA_SUCCESS !=
+      (rc = idna_to_ascii_8z (name,
+                              &idna_start,
+                              IDNA_ALLOW_UNASSIGNED)))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                _("Failed to convert UTF-8 name `%s' to DNS IDNA format: %s\n"),
+                name,
+                idna_strerror (rc));
+    return GNUNET_NO;
+  }
+  idna_name = idna_start;
+  start = *off;
+  if (start + strlen (idna_name) + 2 > dst_len)
+    goto fail;
+  pos = start;
+  do
+  {
+    dot = strchr (idna_name, '.');
+    if (NULL == dot)
+      len = strlen (idna_name);
+    else
+      len = dot - idna_name;
+    if ( (len >= 64) || (0 == len) )
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  "Invalid DNS name `%s': label with %u characters encountered\n",
+                  name,
+                  len);
+      goto fail; /* label too long or empty */
+    }
+    dst[pos++] = (char) (uint8_t) len;
+    GNUNET_memcpy (&dst[pos],
+                   idna_name,
+                   len);
+    pos += len;
+    idna_name += len + 1; /* also skip dot */
+  }
+  while (NULL != dot);
+  dst[pos++] = '\0'; /* terminator */
+  *off = pos;
+#if WINDOWS
+  idn_free (idna_start);
+#else
+  free (idna_start);
+#endif
+  return GNUNET_OK;
+ fail:
+#if WINDOWS
+  idn_free (idna_start);
+#else
+  free (idna_start);
+#endif
+  return GNUNET_NO;
+}
+
+
+/**
+ * Add a DNS query to the UDP packet at the given location.
+ *
+ * @param dst where to write the query
+ * @param dst_len number of bytes in @a dst
+ * @param off pointer to offset where to write the query (increment by bytes used)
+ *            must not be changed if there is an error
+ * @param query query to write
+ * @return #GNUNET_SYSERR if @a query is invalid
+ *         #GNUNET_NO if @a query did not fit
+ *         #GNUNET_OK if @a query was added to @a dst
+ */
+int
+GNUNET_DNSPARSER_builder_add_query (char *dst,
+                                    size_t dst_len,
+                                    size_t *off,
+                                    const struct GNUNET_DNSPARSER_Query *query)
+{
+  int ret;
+  struct GNUNET_TUN_DnsQueryLine ql;
+
+  ret = GNUNET_DNSPARSER_builder_add_name (dst, dst_len - sizeof (struct GNUNET_TUN_DnsQueryLine), off, query->name);
+  if (ret != GNUNET_OK)
+    return ret;
+  ql.type = htons (query->type);
+  ql.dns_traffic_class = htons (query->dns_traffic_class);
+  GNUNET_memcpy (&dst[*off], &ql, sizeof (ql));
+  (*off) += sizeof (ql);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Add an MX record to the UDP packet at the given location.
+ *
+ * @param dst where to write the mx record
+ * @param dst_len number of bytes in @a dst
+ * @param off pointer to offset where to write the mx information (increment by bytes used);
+ *            can also change if there was an error
+ * @param mx mx information to write
+ * @return #GNUNET_SYSERR if @a mx is invalid
+ *         #GNUNET_NO if @a mx did not fit
+ *         #GNUNET_OK if @a mx was added to @a dst
+ */
+int
+GNUNET_DNSPARSER_builder_add_mx (char *dst,
+                                 size_t dst_len,
+                                 size_t *off,
+                                 const struct GNUNET_DNSPARSER_MxRecord *mx)
+{
+  uint16_t mxpref;
+
+  if (*off + sizeof (uint16_t) > dst_len)
+    return GNUNET_NO;
+  mxpref = htons (mx->preference);
+  GNUNET_memcpy (&dst[*off],
+                 &mxpref,
+                 sizeof (mxpref));
+  (*off) += sizeof (mxpref);
+  return GNUNET_DNSPARSER_builder_add_name (dst,
+                                            dst_len,
+                                            off,
+                                            mx->mxhost);
+}
+
+
+/**
+ * Add a CERT record to the UDP packet at the given location.
+ *
+ * @param dst where to write the CERT record
+ * @param dst_len number of bytes in @a dst
+ * @param off pointer to offset where to write the CERT information (increment by bytes used);
+ *            can also change if there was an error
+ * @param cert CERT information to write
+ * @return #GNUNET_SYSERR if @a cert is invalid
+ *         #GNUNET_NO if @a cert did not fit
+ *         #GNUNET_OK if @a cert was added to @a dst
+ */
+int
+GNUNET_DNSPARSER_builder_add_cert (char *dst,
+                                   size_t dst_len,
+                                   size_t *off,
+                                   const struct GNUNET_DNSPARSER_CertRecord *cert)
+{
+  struct GNUNET_TUN_DnsCertRecord dcert;
+
+  if ( (cert->cert_type > UINT16_MAX) ||
+       (cert->algorithm > UINT8_MAX) )
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (*off + sizeof (struct GNUNET_TUN_DnsCertRecord) + cert->certificate_size > dst_len)
+    return GNUNET_NO;
+  dcert.cert_type = htons ((uint16_t) cert->cert_type);
+  dcert.cert_tag = htons ((uint16_t) cert->cert_tag);
+  dcert.algorithm = (uint8_t) cert->algorithm;
+  GNUNET_memcpy (&dst[*off], &dcert, sizeof (dcert));
+  (*off) += sizeof (dcert);
+  GNUNET_memcpy (&dst[*off], cert->certificate_data, cert->certificate_size);
+  (*off) += cert->certificate_size;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Add an SOA record to the UDP packet at the given location.
+ *
+ * @param dst where to write the SOA record
+ * @param dst_len number of bytes in @a dst
+ * @param off pointer to offset where to write the SOA information (increment by bytes used)
+ *            can also change if there was an error
+ * @param soa SOA information to write
+ * @return #GNUNET_SYSERR if @a soa is invalid
+ *         #GNUNET_NO if @a soa did not fit
+ *         #GNUNET_OK if @a soa was added to @a dst
+ */
+int
+GNUNET_DNSPARSER_builder_add_soa (char *dst,
+                                  size_t dst_len,
+                                  size_t *off,
+                                  const struct GNUNET_DNSPARSER_SoaRecord *soa)
+{
+  struct GNUNET_TUN_DnsSoaRecord sd;
+  int ret;
+
+  if ( (GNUNET_OK != (ret = GNUNET_DNSPARSER_builder_add_name (dst,
+                                                               dst_len,
+                                                               off,
+                                                               soa->mname))) ||
+       (GNUNET_OK != (ret = GNUNET_DNSPARSER_builder_add_name (dst,
+                                                               dst_len,
+                                                               off,
+                                                               soa->rname)) ) )
+    return ret;
+  if (*off + sizeof (struct GNUNET_TUN_DnsSoaRecord) > dst_len)
+    return GNUNET_NO;
+  sd.serial = htonl (soa->serial);
+  sd.refresh = htonl (soa->refresh);
+  sd.retry = htonl (soa->retry);
+  sd.expire = htonl (soa->expire);
+  sd.minimum = htonl (soa->minimum_ttl);
+  GNUNET_memcpy (&dst[*off], &sd, sizeof (sd));
+  (*off) += sizeof (sd);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Add an SRV record to the UDP packet at the given location.
+ *
+ * @param dst where to write the SRV record
+ * @param dst_len number of bytes in @a dst
+ * @param off pointer to offset where to write the SRV information (increment by bytes used)
+ *            can also change if there was an error
+ * @param srv SRV information to write
+ * @return #GNUNET_SYSERR if @a srv is invalid
+ *         #GNUNET_NO if @a srv did not fit
+ *         #GNUNET_OK if @a srv was added to @a dst
+ */
+int
+GNUNET_DNSPARSER_builder_add_srv (char *dst,
+                                  size_t dst_len,
+                                  size_t *off,
+                                  const struct GNUNET_DNSPARSER_SrvRecord *srv)
+{
+  struct GNUNET_TUN_DnsSrvRecord sd;
+  int ret;
+
+  if (*off + sizeof (struct GNUNET_TUN_DnsSrvRecord) > dst_len)
+    return GNUNET_NO;
+  sd.prio = htons (srv->priority);
+  sd.weight = htons (srv->weight);
+  sd.port = htons (srv->port);
+  GNUNET_memcpy (&dst[*off],
+                 &sd,
+                 sizeof (sd));
+  (*off) += sizeof (sd);
+  if (GNUNET_OK != (ret = GNUNET_DNSPARSER_builder_add_name (dst,
+                                                             dst_len,
+                                                             off,
+                                                             srv->target)))
+    return ret;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Add a DNS record to the UDP packet at the given location.
+ *
+ * @param dst where to write the query
+ * @param dst_len number of bytes in @a dst
+ * @param off pointer to offset where to write the query (increment by bytes used)
+ *            must not be changed if there is an error
+ * @param record record to write
+ * @return #GNUNET_SYSERR if @a record is invalid
+ *         #GNUNET_NO if @a record did not fit
+ *         #GNUNET_OK if @a record was added to @a dst
+ */
+static int
+add_record (char *dst,
+            size_t dst_len,
+            size_t *off,
+            const struct GNUNET_DNSPARSER_Record *record)
+{
+  int ret;
+  size_t start;
+  size_t pos;
+  struct GNUNET_TUN_DnsRecordLine rl;
+
+  start = *off;
+  ret = GNUNET_DNSPARSER_builder_add_name (dst,
+                                           dst_len - sizeof (struct GNUNET_TUN_DnsRecordLine),
+                                           off,
+                                           record->name);
+  if (GNUNET_OK != ret)
+    return ret;
+  /* '*off' is now the position where we will need to write the record line */
+
+  pos = *off + sizeof (struct GNUNET_TUN_DnsRecordLine);
+  switch (record->type)
+  {
+  case GNUNET_DNSPARSER_TYPE_MX:
+    ret = GNUNET_DNSPARSER_builder_add_mx (dst,
+                                           dst_len,
+                                           &pos,
+                                           record->data.mx);
+    break;
+  case GNUNET_DNSPARSER_TYPE_CERT:
+    ret = GNUNET_DNSPARSER_builder_add_cert (dst,
+                                             dst_len,
+                                             &pos,
+                                             record->data.cert);
+    break;
+  case GNUNET_DNSPARSER_TYPE_SOA:
+    ret = GNUNET_DNSPARSER_builder_add_soa (dst,
+                                            dst_len,
+                                            &pos,
+                                            record->data.soa);
+    break;
+  case GNUNET_DNSPARSER_TYPE_NS:
+  case GNUNET_DNSPARSER_TYPE_CNAME:
+  case GNUNET_DNSPARSER_TYPE_PTR:
+    ret = GNUNET_DNSPARSER_builder_add_name (dst,
+                                             dst_len,
+                                             &pos,
+                                             record->data.hostname);
+    break;
+  case GNUNET_DNSPARSER_TYPE_SRV:
+    ret = GNUNET_DNSPARSER_builder_add_srv (dst,
+                                            dst_len,
+                                            &pos,
+                                            record->data.srv);
+    break;
+  default:
+    if (pos + record->data.raw.data_len > dst_len)
+    {
+      ret = GNUNET_NO;
+      break;
+    }
+    GNUNET_memcpy (&dst[pos],
+                   record->data.raw.data,
+                   record->data.raw.data_len);
+    pos += record->data.raw.data_len;
+    ret = GNUNET_OK;
+    break;
+  }
+  if (GNUNET_OK != ret)
+  {
+    *off = start;
+    return GNUNET_NO;
+  }
+
+  if (pos - (*off + sizeof (struct GNUNET_TUN_DnsRecordLine)) > UINT16_MAX)
+  {
+    /* record data too long */
+    *off = start;
+    return GNUNET_NO;
+  }
+  rl.type = htons (record->type);
+  rl.dns_traffic_class = htons (record->dns_traffic_class);
+  rl.ttl = htonl (GNUNET_TIME_absolute_get_remaining (record->expiration_time).rel_value_us / 1000LL / 1000LL); /* in seconds */
+  rl.data_len = htons ((uint16_t) (pos - (*off + sizeof (struct GNUNET_TUN_DnsRecordLine))));
+  GNUNET_memcpy (&dst[*off],
+                 &rl,
+                 sizeof (struct GNUNET_TUN_DnsRecordLine));
+  *off = pos;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Given a DNS packet @a p, generate the corresponding UDP payload.
+ * Note that we do not attempt to pack the strings with pointers
+ * as this would complicate the code and this is about being
+ * simple and secure, not fast, fancy and broken like bind.
+ *
+ * @param p packet to pack
+ * @param max maximum allowed size for the resulting UDP payload
+ * @param buf set to a buffer with the packed message
+ * @param buf_length set to the length of @a buf
+ * @return #GNUNET_SYSERR if @a p is invalid
+ *         #GNUNET_NO if @a p was truncated (but there is still a result in @a buf)
+ *         #GNUNET_OK if @a p was packed completely into @a buf
+ */
+int
+GNUNET_DNSPARSER_pack (const struct GNUNET_DNSPARSER_Packet *p,
+                       uint16_t max,
+                       char **buf,
+                       size_t *buf_length)
+{
+  struct GNUNET_TUN_DnsHeader dns;
+  size_t off;
+  char tmp[max];
+  int ret;
+  int trc;
+
+  if ( (p->num_queries > UINT16_MAX) ||
+       (p->num_answers > UINT16_MAX) ||
+       (p->num_authority_records > UINT16_MAX) ||
+       (p->num_additional_records > UINT16_MAX) )
+    return GNUNET_SYSERR;
+  dns.id = p->id;
+  dns.flags = p->flags;
+  dns.query_count = htons (p->num_queries);
+  dns.answer_rcount = htons (p->num_answers);
+  dns.authority_rcount = htons (p->num_authority_records);
+  dns.additional_rcount = htons (p->num_additional_records);
+
+  off = sizeof (struct GNUNET_TUN_DnsHeader);
+  trc = GNUNET_NO;
+  for (unsigned int i=0;i<p->num_queries;i++)
+  {
+    ret = GNUNET_DNSPARSER_builder_add_query (tmp,
+                                              sizeof (tmp),
+                                              &off,
+                                              &p->queries[i]);
+    if (GNUNET_SYSERR == ret)
+      return GNUNET_SYSERR;
+    if (GNUNET_NO == ret)
+    {
+      dns.query_count = htons ((uint16_t) (i-1));
+      trc = GNUNET_YES;
+      break;
+    }
+  }
+  for (unsigned int i=0;i<p->num_answers;i++)
+  {
+    ret = add_record (tmp,
+                      sizeof (tmp),
+                      &off,
+                      &p->answers[i]);
+    if (GNUNET_SYSERR == ret)
+      return GNUNET_SYSERR;
+    if (GNUNET_NO == ret)
+    {
+      dns.answer_rcount = htons ((uint16_t) (i-1));
+      trc = GNUNET_YES;
+      break;
+    }
+  }
+  for (unsigned int i=0;i<p->num_authority_records;i++)
+  {
+    ret = add_record (tmp,
+                      sizeof (tmp),
+                      &off,
+                      &p->authority_records[i]);
+    if (GNUNET_SYSERR == ret)
+      return GNUNET_SYSERR;
+    if (GNUNET_NO == ret)
+    {
+      dns.authority_rcount = htons ((uint16_t) (i-1));
+      trc = GNUNET_YES;
+      break;
+    }
+  }
+  for (unsigned int i=0;i<p->num_additional_records;i++)
+  {
+    ret = add_record (tmp,
+                      sizeof (tmp),
+                      &off,
+                      &p->additional_records[i]);
+    if (GNUNET_SYSERR == ret)
+      return GNUNET_SYSERR;
+    if (GNUNET_NO == ret)
+    {
+      dns.additional_rcount = htons (i-1);
+      trc = GNUNET_YES;
+      break;
+    }
+  }
+
+  if (GNUNET_YES == trc)
+    dns.flags.message_truncated = 1;
+  GNUNET_memcpy (tmp,
+                 &dns,
+                 sizeof (struct GNUNET_TUN_DnsHeader));
+
+  *buf = GNUNET_malloc (off);
+  *buf_length = off;
+  GNUNET_memcpy (*buf,
+                 tmp,
+                 off);
+  if (GNUNET_YES == trc)
+    return GNUNET_NO;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Convert a block of binary data to HEX.
+ *
+ * @param data binary data to convert
+ * @param data_size number of bytes in @a data
+ * @return HEX string (lower case)
+ */
+char *
+GNUNET_DNSPARSER_bin_to_hex (const void *data,
+                             size_t data_size)
+{
+  char *ret;
+  size_t off;
+  const uint8_t *idata;
+
+  idata = data;
+  ret = GNUNET_malloc (data_size * 2 + 1);
+  for (off = 0; off < data_size; off++)
+    sprintf (&ret[off * 2],
+             "%02x",
+             idata[off]);
+  return ret;
+}
+
+
+/**
+ * Convert a HEX string to block of binary data.
+ *
+ * @param hex HEX string to convert (may contain mixed case)
+ * @param data where to write result, must be
+ *             at least `strlen(hex)/2` bytes long
+ * @return number of bytes written to data
+ */
+size_t
+GNUNET_DNSPARSER_hex_to_bin (const char *hex,
+                             void *data)
+{
+  size_t data_size;
+  size_t off;
+  uint8_t *idata;
+  unsigned int h;
+  char in[3];
+
+  data_size = strlen (hex) / 2;
+  idata = data;
+  in[2] = '\0';
+  for (off = 0; off < data_size; off++)
+  {
+    in[0] = tolower ((unsigned char) hex[off * 2]);
+    in[1] = tolower ((unsigned char) hex[off * 2 + 1]);
+    if (1 != sscanf (in, "%x", &h))
+      return off;
+    idata[off] = (uint8_t) h;
+  }
+  return off;
+}
+
+
+/* end of dnsparser.c */
diff --git a/src/util/dnsstub.c b/src/util/dnsstub.c
new file mode 100644
index 000000000..5b84e6e63
--- /dev/null
+++ b/src/util/dnsstub.c
@@ -0,0 +1,747 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2012, 2018 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+    
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+/**
+ * @file dns/dnsstub.c
+ * @brief DNS stub resolver which sends DNS requests to an actual resolver
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+/**
+ * Timeout for retrying DNS queries.
+ */
+#define DNS_RETRANSMIT_DELAY GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MILLISECONDS, 250)
+
+
+/**
+ * DNS Server used for resolution.
+ */
+struct DnsServer;
+
+
+/**
+ * UDP socket we are using for sending DNS requests to the Internet.
+ */
+struct GNUNET_DNSSTUB_RequestSocket
+{
+
+  /**
+   * UDP socket we use for this request for IPv4
+   */
+  struct GNUNET_NETWORK_Handle *dnsout4;
+
+  /**
+   * UDP socket we use for this request for IPv6
+   */
+  struct GNUNET_NETWORK_Handle *dnsout6;
+
+  /**
+   * Function to call with result.
+   */
+  GNUNET_DNSSTUB_ResultCallback rc;
+
+  /**
+   * Closure for @e rc.
+   */
+  void *rc_cls;
+
+  /**
+   * Task for reading from dnsout4 and dnsout6.
+   */
+  struct GNUNET_SCHEDULER_Task *read_task;
+
+  /**
+   * Task for retrying transmission of the query.
+   */
+  struct GNUNET_SCHEDULER_Task *retry_task;
+
+  /**
+   * Next address we sent the DNS request to.
+   */
+  struct DnsServer *ds_pos;
+
+  /**
+   * Context this request executes in.
+   */
+  struct GNUNET_DNSSTUB_Context *ctx;
+
+  /**
+   * Query we sent to @e addr.
+   */
+  void *request;
+
+  /**
+   * Number of bytes in @a request.
+   */
+  size_t request_len;
+
+};
+
+
+/**
+ * DNS Server used for resolution.
+ */
+struct DnsServer
+{
+
+  /**
+   * Kept in a DLL.
+   */
+  struct DnsServer *next;
+
+  /**
+   * Kept in a DLL.
+   */
+  struct DnsServer *prev;
+
+  /**
+   * IP address of the DNS resolver.
+   */
+  struct sockaddr_storage ss;
+};
+
+
+/**
+ * Handle to the stub resolver.
+ */
+struct GNUNET_DNSSTUB_Context
+{
+
+  /**
+   * Array of all open sockets for DNS requests.
+   */
+  struct GNUNET_DNSSTUB_RequestSocket *sockets;
+
+  /**
+   * DLL of DNS resolvers we use.
+   */
+  struct DnsServer *dns_head;
+
+  /**
+   * DLL of DNS resolvers we use.
+   */
+  struct DnsServer *dns_tail;
+
+  /**
+   * How frequently do we retry requests?
+   */
+  struct GNUNET_TIME_Relative retry_freq;
+
+  /**
+   * Length of @e sockets array.
+   */
+  unsigned int num_sockets;
+
+};
+
+
+/**
+ * We're done with a `struct GNUNET_DNSSTUB_RequestSocket`, close it for now.
+ *
+ * @param rs request socket to clean up
+ */
+static void
+cleanup_rs (struct GNUNET_DNSSTUB_RequestSocket *rs)
+{
+  if (NULL != rs->dnsout4)
+  {
+    GNUNET_NETWORK_socket_close (rs->dnsout4);
+    rs->dnsout4 = NULL;
+  }
+  if (NULL != rs->dnsout6)
+  {
+    GNUNET_NETWORK_socket_close (rs->dnsout6);
+    rs->dnsout6 = NULL;
+  }
+  if (NULL != rs->read_task)
+  {
+    GNUNET_SCHEDULER_cancel (rs->read_task);
+    rs->read_task = NULL;
+  }
+  if (NULL != rs->retry_task)
+  {
+    GNUNET_SCHEDULER_cancel (rs->retry_task);
+    rs->retry_task = NULL;
+  }
+  if (NULL != rs->request)
+  {
+    GNUNET_free (rs->request);
+    rs->request = NULL;
+  }
+}
+
+
+/**
+ * Open source port for sending DNS requests
+ *
+ * @param af AF_INET or AF_INET6
+ * @return #GNUNET_OK on success
+ */
+static struct GNUNET_NETWORK_Handle *
+open_socket (int af)
+{
+  struct sockaddr_in a4;
+  struct sockaddr_in6 a6;
+  struct sockaddr *sa;
+  socklen_t alen;
+  struct GNUNET_NETWORK_Handle *ret;
+
+  ret = GNUNET_NETWORK_socket_create (af, SOCK_DGRAM, 0);
+  if (NULL == ret)
+    return NULL;
+  switch (af)
+  {
+  case AF_INET:
+    memset (&a4, 0, alen = sizeof (struct sockaddr_in));
+    sa = (struct sockaddr *) &a4;
+    break;
+  case AF_INET6:
+    memset (&a6, 0, alen = sizeof (struct sockaddr_in6));
+    sa = (struct sockaddr *) &a6;
+    break;
+  default:
+    GNUNET_break (0);
+    GNUNET_NETWORK_socket_close (ret);
+    return NULL;
+  }
+  sa->sa_family = af;
+  if (GNUNET_OK != GNUNET_NETWORK_socket_bind (ret,
+                                               sa,
+                                               alen))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                _("Could not bind to any port: %s\n"),
+                STRERROR (errno));
+    GNUNET_NETWORK_socket_close (ret);
+    return NULL;
+  }
+  return ret;
+}
+
+
+/**
+ * Get a socket of the specified address family to send out a
+ * UDP DNS request to the Internet.
+ *
+ * @param ctx the DNSSTUB context
+ * @return NULL on error
+ */
+static struct GNUNET_DNSSTUB_RequestSocket *
+get_request_socket (struct GNUNET_DNSSTUB_Context *ctx)
+{
+  struct GNUNET_DNSSTUB_RequestSocket *rs;
+
+  for (unsigned int i=0;i<256;i++)
+  {
+    rs = &ctx->sockets[GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_NONCE,
+                                                 ctx->num_sockets)];
+    if (NULL == rs->rc)
+      break;
+  }
+  if (NULL != rs->rc)
+  {
+    /* signal "failure" */
+    rs->rc (rs->rc_cls,
+            NULL,
+            0);
+    rs->rc = NULL;
+  }
+  if (NULL != rs->read_task)
+  {
+    GNUNET_SCHEDULER_cancel (rs->read_task);
+    rs->read_task = NULL;
+  }
+  if (NULL != rs->retry_task)
+  {
+    GNUNET_SCHEDULER_cancel (rs->retry_task);
+    rs->retry_task = NULL;
+  }
+  if (NULL != rs->request)
+  {
+    GNUNET_free (rs->request);
+    rs->request = NULL;
+  }
+  rs->ctx = ctx;
+  return rs;
+}
+
+
+/**
+ * Actually do the reading of a DNS packet from our UDP socket and see
+ * if we have a valid, matching, pending request.
+ *
+ * @param rs request socket with callback details
+ * @param dnsout socket to read from
+ * @return #GNUNET_OK on success, #GNUNET_NO on drop, #GNUNET_SYSERR on IO-errors (closed socket)
+ */
+static int
+do_dns_read (struct GNUNET_DNSSTUB_RequestSocket *rs,
+             struct GNUNET_NETWORK_Handle *dnsout)
+{
+  struct GNUNET_DNSSTUB_Context *ctx = rs->ctx;
+  ssize_t r;
+  int len;
+
+#ifndef MINGW
+  if (0 != ioctl (GNUNET_NETWORK_get_fd (dnsout),
+                  FIONREAD,
+                  &len))
+  {
+    /* conservative choice: */
+    len = UINT16_MAX;
+  }
+#else
+  /* port the code above? */
+  len = UINT16_MAX;
+#endif
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Receiving %d byte DNS reply\n",
+              len);
+  {
+    unsigned char buf[len] GNUNET_ALIGN;
+    int found;
+    struct sockaddr_storage addr;
+    socklen_t addrlen;
+    struct GNUNET_TUN_DnsHeader *dns;
+
+    addrlen = sizeof (addr);
+    memset (&addr,
+            0,
+            sizeof (addr));
+    r = GNUNET_NETWORK_socket_recvfrom (dnsout,
+                                        buf,
+                                        sizeof (buf),
+                                        (struct sockaddr*) &addr,
+                                        &addrlen);
+    if (-1 == r)
+    {
+      GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR,
+                           "recvfrom");
+      GNUNET_NETWORK_socket_close (dnsout);
+      return GNUNET_SYSERR;
+    }
+    found = GNUNET_NO;
+    for (struct DnsServer *ds = ctx->dns_head; NULL != ds; ds = ds->next)
+    {
+      if (0 == memcmp (&addr,
+                       &ds->ss,
+                       GNUNET_MIN (sizeof (struct sockaddr_storage),
+                                   addrlen)))
+      {
+        found = GNUNET_YES;
+        break;
+      }
+    }
+    if (GNUNET_NO == found)
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "Received DNS response from server we never asked (ignored)");
+      return GNUNET_NO;
+    }
+    if (sizeof (struct GNUNET_TUN_DnsHeader) > (size_t) r)
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  _("Received DNS response that is too small (%u bytes)"),
+                  (unsigned int) r);
+      return GNUNET_NO;
+    }
+    dns = (struct GNUNET_TUN_DnsHeader *) buf;
+    if (NULL == rs->rc)
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "Request timeout or cancelled; ignoring reply\n");
+      return GNUNET_NO;
+    }
+    rs->rc (rs->rc_cls,
+            dns,
+            r);
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Read a DNS response from the (unhindered) UDP-Socket
+ *
+ * @param cls socket to read from
+ */
+static void
+read_response (void *cls);
+
+
+/**
+ * Schedule #read_response() task for @a rs.
+ *
+ * @param rs request to schedule read operation for
+ */
+static void
+schedule_read (struct GNUNET_DNSSTUB_RequestSocket *rs)
+{
+  struct GNUNET_NETWORK_FDSet *rset;
+
+  if (NULL != rs->read_task)
+    GNUNET_SCHEDULER_cancel (rs->read_task);
+  rset = GNUNET_NETWORK_fdset_create ();
+  if (NULL != rs->dnsout4)
+    GNUNET_NETWORK_fdset_set (rset,
+                              rs->dnsout4);
+  if (NULL != rs->dnsout6)
+    GNUNET_NETWORK_fdset_set (rset,
+                              rs->dnsout6);
+  rs->read_task = GNUNET_SCHEDULER_add_select (GNUNET_SCHEDULER_PRIORITY_DEFAULT,
+                                               GNUNET_TIME_UNIT_FOREVER_REL,
+                                               rset,
+                                               NULL,
+                                               &read_response,
+                                               rs);
+  GNUNET_NETWORK_fdset_destroy (rset);
+}
+
+
+/**
+ * Read a DNS response from the (unhindered) UDP-Socket
+ *
+ * @param cls `struct GNUNET_DNSSTUB_RequestSocket` to read from
+ */
+static void
+read_response (void *cls)
+{
+  struct GNUNET_DNSSTUB_RequestSocket *rs = cls;
+  const struct GNUNET_SCHEDULER_TaskContext *tc;
+
+  rs->read_task = NULL;
+  tc = GNUNET_SCHEDULER_get_task_context ();
+  /* read and process ready sockets */
+  if ( (NULL != rs->dnsout4) &&
+       (GNUNET_NETWORK_fdset_isset (tc->read_ready,
+                                    rs->dnsout4)) &&
+       (GNUNET_SYSERR ==
+        do_dns_read (rs,
+                     rs->dnsout4)) )
+    rs->dnsout4 = NULL;
+  if ( (NULL != rs->dnsout6) &&
+       (GNUNET_NETWORK_fdset_isset (tc->read_ready,
+                                    rs->dnsout6)) &&
+       (GNUNET_SYSERR ==
+        do_dns_read (rs,
+                     rs->dnsout6)) )
+    rs->dnsout6 = NULL;
+  /* re-schedule read task */
+  schedule_read (rs);
+}
+
+
+/**
+ * Task to (re)transmit the DNS query, possibly repeatedly until
+ * we succeed.
+ *
+ * @param cls our `struct GNUNET_DNSSTUB_RequestSocket *`
+ */
+static void
+transmit_query (void *cls)
+{
+  struct GNUNET_DNSSTUB_RequestSocket *rs = cls;
+  struct GNUNET_DNSSTUB_Context *ctx = rs->ctx;
+  const struct sockaddr *sa;
+  socklen_t salen;
+  struct DnsServer *ds;
+  struct GNUNET_NETWORK_Handle *dnsout;
+
+  rs->retry_task = GNUNET_SCHEDULER_add_delayed (ctx->retry_freq,
+                                                 &transmit_query,
+                                                 rs);
+  ds = rs->ds_pos;
+  rs->ds_pos = ds->next;
+  if (NULL == rs->ds_pos)
+    rs->ds_pos = ctx->dns_head;
+  GNUNET_assert (NULL != ds);
+  dnsout = NULL;
+  switch (ds->ss.ss_family)
+  {
+  case AF_INET:
+    if (NULL == rs->dnsout4)
+      rs->dnsout4 = open_socket (AF_INET);
+    dnsout = rs->dnsout4;
+    sa = (const struct sockaddr *) &ds->ss;
+    salen = sizeof (struct sockaddr_in);
+    break;
+  case AF_INET6:
+    if (NULL == rs->dnsout6)
+      rs->dnsout6 = open_socket (AF_INET6);
+    dnsout = rs->dnsout6;
+    sa = (const struct sockaddr *) &ds->ss;
+    salen = sizeof (struct sockaddr_in6);
+    break;
+  default:
+    return;
+  }
+  if (NULL == dnsout)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Unable to use configure DNS server, skipping\n");
+    return;
+  }
+  if (GNUNET_SYSERR ==
+      GNUNET_NETWORK_socket_sendto (dnsout,
+                                    rs->request,
+                                    rs->request_len,
+                                    sa,
+                                    salen))
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                _("Failed to send DNS request to %s: %s\n"),
+                GNUNET_a2s (sa,
+                            salen),
+                STRERROR (errno));
+  else
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                _("Sent DNS request to %s\n"),
+                GNUNET_a2s (sa,
+                            salen));
+  schedule_read (rs);
+}
+
+
+/**
+ * Perform DNS resolution using our default IP from init.
+ *
+ * @param ctx stub resolver to use
+ * @param request DNS request to transmit
+ * @param request_len number of bytes in msg
+ * @param rc function to call with result
+ * @param rc_cls closure for 'rc'
+ * @return socket used for the request, NULL on error
+ */
+struct GNUNET_DNSSTUB_RequestSocket *
+GNUNET_DNSSTUB_resolve (struct GNUNET_DNSSTUB_Context *ctx,
+                         const void *request,
+                         size_t request_len,
+                         GNUNET_DNSSTUB_ResultCallback rc,
+                         void *rc_cls)
+{
+  struct GNUNET_DNSSTUB_RequestSocket *rs;
+
+  if (NULL == ctx->dns_head)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "No DNS server configured for resolution\n");
+    return NULL;
+  }
+  if (NULL == (rs = get_request_socket (ctx)))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "No request socket available for DNS resolution\n");
+    return NULL;
+  }
+  rs->ds_pos = ctx->dns_head;
+  rs->rc = rc;
+  rs->rc_cls = rc_cls;
+  rs->request = GNUNET_memdup (request,
+                               request_len);
+  rs->request_len = request_len;
+  rs->retry_task = GNUNET_SCHEDULER_add_now (&transmit_query,
+                                             rs);
+  return rs;
+}
+
+
+/**
+ * Cancel DNS resolution.
+ *
+ * @param rs resolution to cancel
+ */
+void
+GNUNET_DNSSTUB_resolve_cancel (struct GNUNET_DNSSTUB_RequestSocket *rs)
+{
+  rs->rc = NULL;
+  if (NULL != rs->retry_task)
+  {
+    GNUNET_SCHEDULER_cancel (rs->retry_task);
+    rs->retry_task = NULL;
+  }
+  if (NULL != rs->read_task)
+  {
+    GNUNET_SCHEDULER_cancel (rs->read_task);
+    rs->read_task = NULL;
+  }
+}
+
+
+/**
+ * Start a DNS stub resolver.
+ *
+ * @param num_sockets how many sockets should we open
+ *        in parallel for DNS queries for this stub?
+ * @return NULL on error
+ */
+struct GNUNET_DNSSTUB_Context *
+GNUNET_DNSSTUB_start (unsigned int num_sockets)
+{
+  struct GNUNET_DNSSTUB_Context *ctx;
+
+  if (0 == num_sockets)
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+  ctx = GNUNET_new (struct GNUNET_DNSSTUB_Context);
+  ctx->num_sockets = num_sockets;
+  ctx->sockets = GNUNET_new_array (num_sockets,
+                                   struct GNUNET_DNSSTUB_RequestSocket);
+  ctx->retry_freq = DNS_RETRANSMIT_DELAY;
+  return ctx;
+}
+
+
+/**
+ * Add nameserver for use by the DNSSTUB.  We will use
+ * all provided nameservers for resolution (round-robin).
+ *
+ * @param ctx resolver context to modify
+ * @param dns_ip target IP address to use (as string)
+ * @return #GNUNET_OK on success
+ */
+int
+GNUNET_DNSSTUB_add_dns_ip (struct GNUNET_DNSSTUB_Context *ctx,
+                           const char *dns_ip)
+{
+  struct DnsServer *ds;
+  struct in_addr i4;
+  struct in6_addr i6;
+
+  ds = GNUNET_new (struct DnsServer);
+  if (1 == inet_pton (AF_INET,
+                      dns_ip,
+                      &i4))
+  {
+    struct sockaddr_in *s4 = (struct sockaddr_in *) &ds->ss;
+
+    s4->sin_family = AF_INET;
+    s4->sin_port = htons (53);
+    s4->sin_addr = i4;
+#if HAVE_SOCKADDR_IN_SIN_LEN
+    s4->sin_len = (u_char) sizeof (struct sockaddr_in);
+#endif
+  }
+  else if (1 == inet_pton (AF_INET6,
+                           dns_ip,
+                           &i6))
+  {
+    struct sockaddr_in6 *s6 = (struct sockaddr_in6 *) &ds->ss;
+
+    s6->sin6_family = AF_INET6;
+    s6->sin6_port = htons (53);
+    s6->sin6_addr = i6;
+#if HAVE_SOCKADDR_IN_SIN_LEN
+    s6->sin6_len = (u_char) sizeof (struct sockaddr_in6);
+#endif
+  }
+  else
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Malformed IP address `%s' for DNS server\n",
+                dns_ip);
+    GNUNET_free (ds);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_CONTAINER_DLL_insert (ctx->dns_head,
+                               ctx->dns_tail,
+                               ds);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Add nameserver for use by the DNSSTUB.  We will use
+ * all provided nameservers for resolution (round-robin).
+ *
+ * @param ctx resolver context to modify
+ * @param sa socket address of DNS resolver to use
+ * @return #GNUNET_OK on success
+ */
+int
+GNUNET_DNSSTUB_add_dns_sa (struct GNUNET_DNSSTUB_Context *ctx,
+                           const struct sockaddr *sa)
+{
+  struct DnsServer *ds;
+
+  ds = GNUNET_new (struct DnsServer);
+  switch (sa->sa_family)
+  {
+  case AF_INET:
+    GNUNET_memcpy (&ds->ss,
+                   sa,
+                   sizeof (struct sockaddr_in));
+    break;
+  case AF_INET6:
+    GNUNET_memcpy (&ds->ss,
+                   sa,
+                   sizeof (struct sockaddr_in6));
+    break;
+  default:
+    GNUNET_break (0);
+    GNUNET_free (ds);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_CONTAINER_DLL_insert (ctx->dns_head,
+                               ctx->dns_tail,
+                               ds);
+  return GNUNET_OK;
+}
+
+
+/**
+ * How long should we try requests before timing out?
+ * Only effective for requests issued after this call.
+ *
+ * @param ctx resolver context to modify
+ * @param retry_freq how long to wait between retries
+ */
+void
+GNUNET_DNSSTUB_set_retry (struct GNUNET_DNSSTUB_Context *ctx,
+                          struct GNUNET_TIME_Relative retry_freq)
+{
+  ctx->retry_freq = retry_freq;
+}
+
+
+/**
+ * Cleanup DNSSTUB resolver.
+ *
+ * @param ctx stub resolver to clean up
+ */
+void
+GNUNET_DNSSTUB_stop (struct GNUNET_DNSSTUB_Context *ctx)
+{
+  struct DnsServer *ds;
+
+  while (NULL != (ds = ctx->dns_head))
+  {
+    GNUNET_CONTAINER_DLL_remove (ctx->dns_head,
+                                 ctx->dns_tail,
+                                 ds);
+    GNUNET_free (ds);
+  }
+  for (unsigned int i=0;i<ctx->num_sockets;i++)
+    cleanup_rs (&ctx->sockets[i]);
+  GNUNET_free (ctx->sockets);
+  GNUNET_free (ctx);
+}
+
+
+/* end of dnsstub.c */
diff --git a/src/util/gnunet-config.c b/src/util/gnunet-config.c
index 16b826ee2..4528bbe24 100644
--- a/src/util/gnunet-config.c
+++ b/src/util/gnunet-config.c
@@ -75,27 +75,36 @@ print_option (void *cls,
               const char *option,
               const char *value)
 {
-  (void) section;
   const struct GNUNET_CONFIGURATION_Handle *cfg = cls;
-  char *value_fn;
+
+  (void) section;
   if (is_filename)
   {
+    char *value_fn;
+    char *fn;
+    
     GNUNET_assert (GNUNET_OK ==
-        GNUNET_CONFIGURATION_get_value_filename (cfg,
-                                                 section,
-                                                 option,
-                                                 &value_fn));
+                   GNUNET_CONFIGURATION_get_value_filename (cfg,
+                                                            section,
+                                                            option,
+                                                            &value_fn));
+    fn = GNUNET_STRINGS_filename_expand (value_fn);
+    if (NULL == fn)
+      fn = value_fn;
+    else
+      GNUNET_free (value_fn);
     fprintf (stdout,
-       "%s = %s\n",
-       option,
-       GNUNET_STRINGS_filename_expand (value_fn));
+             "%s = %s\n",
+             option,
+             fn);
+    GNUNET_free (fn);
   }
   else
   {
     fprintf (stdout,
-       "%s = %s\n",
-       option,
-       value);
+             "%s = %s\n",
+             option,
+             value);
   }
 }
 
diff --git a/src/util/gnunet-service-resolver.c b/src/util/gnunet-service-resolver.c
index d90d8ec10..5b890261b 100644
--- a/src/util/gnunet-service-resolver.c
+++ b/src/util/gnunet-service-resolver.c
@@ -27,721 +27,559 @@
 #include "gnunet_statistics_service.h"
 #include "resolver.h"
 
+
+struct Record
+{
+  struct Record *next;
+
+  struct Record *prev;
+
+  struct GNUNET_DNSPARSER_Record *record;
+};
+
 /**
- * A cached DNS lookup result (for reverse lookup).
+ * A cached DNS lookup result.
  */
-struct IPCache
+struct ResolveCache
 {
   /**
    * This is a doubly linked list.
    */
-  struct IPCache *next;
+  struct ResolveCache *next;
 
   /**
    * This is a doubly linked list.
    */
-  struct IPCache *prev;
+  struct ResolveCache *prev;
 
   /**
-   * Hostname in human-readable form.
+   * type of queried DNS record
    */
-  char *addr;
+  uint16_t record_type;
 
   /**
-   * Binary IP address, allocated at the end of this struct.
+   * a pointer to the request_id if a query for this hostname/record_type
+   * is currently pending, NULL otherwise.
    */
-  const void *ip;
+  int16_t *request_id;
 
   /**
-   * Last time this entry was updated.
+   * The client that queried the records contained in this cache entry.
    */
-  struct GNUNET_TIME_Absolute last_refresh;
+  struct GNUNET_SERVICE_Client *client;
 
   /**
-   * Last time this entry was requested.
+   * head of a double linked list containing the lookup results
    */
-  struct GNUNET_TIME_Absolute last_request;
+  struct Record *records_head;
 
   /**
-   * Number of bytes in ip.
+   * tail of a double linked list containing the lookup results
    */
-  size_t ip_len;
+  struct Record *records_tail;
 
   /**
-   * Address family of the IP.
+   * handle for cancelling a request
    */
-  int af;
+  struct GNUNET_DNSSTUB_RequestSocket *resolve_handle;
+
+  /**
+   * handle for the resolution timeout task
+   */
+  struct GNUNET_SCHEDULER_Task *timeout_task;
+
 };
 
 
 /**
  * Start of the linked list of cached DNS lookup results.
  */
-static struct IPCache *cache_head;
+static struct ResolveCache *cache_head;
 
 /**
  * Tail of the linked list of cached DNS lookup results.
  */
-static struct IPCache *cache_tail;
+static struct ResolveCache *cache_tail;
 
 /**
- * Pipe for asynchronously notifying about resolve result
+ * context of dnsstub library
  */
-static struct GNUNET_DISK_PipeHandle *resolve_result_pipe;
+static struct GNUNET_DNSSTUB_Context *dnsstub_ctx;
 
-/**
- * Task for reading from resolve_result_pipe
- */
-static struct GNUNET_SCHEDULER_Task *resolve_result_pipe_task;
 
-
-#if HAVE_GETNAMEINFO
-/**
- * Resolve the given request using getnameinfo
- *
- * @param cache the request to resolve (and where to store the result)
- */
-static void
-getnameinfo_resolve (struct IPCache *cache)
+void free_cache_entry (struct ResolveCache *entry)
 {
-  char hostname[256];
-  const struct sockaddr *sa;
-  struct sockaddr_in v4;
-  struct sockaddr_in6 v6;
-  size_t salen;
-  int ret;
-
-  switch (cache->af)
+  struct Record *pos;
+  struct Record *next;
+ 
+  next = entry->records_head;
+  while (NULL != (pos = next))
   {
-  case AF_INET:
-    GNUNET_assert (cache->ip_len == sizeof (struct in_addr));
-    sa = (const struct sockaddr*) &v4;
-    memset (&v4, 0, sizeof (v4));
-    v4.sin_addr = * (const struct in_addr*) cache->ip;
-    v4.sin_family = AF_INET;
-#if HAVE_SOCKADDR_IN_SIN_LEN
-    v4.sin_len = sizeof (v4);
-#endif
-    salen = sizeof (v4);
-    break;
-  case AF_INET6:
-    GNUNET_assert (cache->ip_len == sizeof (struct in6_addr));
-    sa = (const struct sockaddr*) &v6;
-    memset (&v6, 0, sizeof (v6));
-    v6.sin6_addr = * (const struct in6_addr*) cache->ip;
-    v6.sin6_family = AF_INET6;
-#if HAVE_SOCKADDR_IN_SIN_LEN
-    v6.sin6_len = sizeof (v6);
-#endif
-    salen = sizeof (v6);
-    break;
-  default:
-    GNUNET_assert (0);
+    next = pos->next;
+    GNUNET_CONTAINER_DLL_remove (entry->records_head,
+                                 entry->records_tail,
+                                 pos);
+    if (NULL != pos->record)
+    {
+      GNUNET_DNSPARSER_free_record (pos->record);
+      GNUNET_free (pos->record);
+    }
+    GNUNET_free (pos);
   }
-
-  if (0 ==
-      (ret = getnameinfo (sa, salen,
-                          hostname, sizeof (hostname),
-                          NULL,
-                          0, 0)))
+  if (NULL != entry->resolve_handle)
   {
-    cache->addr = GNUNET_strdup (hostname);
+    GNUNET_DNSSTUB_resolve_cancel (entry->resolve_handle);
+    entry->resolve_handle = NULL;
   }
-  else
+  if (NULL != entry->timeout_task)
   {
-    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
-                "getnameinfo failed: %s\n",
-                gai_strerror (ret));
+    GNUNET_SCHEDULER_cancel (entry->timeout_task);
+    entry->timeout_task = NULL;
   }
+  GNUNET_free_non_null (entry->request_id);
+  GNUNET_free (entry);
 }
-#endif
 
 
-#if HAVE_GETHOSTBYADDR
+static char*
+extract_dns_server (const char* line, size_t line_len)
+{
+  if (0 == strncmp (line, "nameserver ", 11))
+    return GNUNET_strndup (line + 11, line_len - 11);
+  return NULL;
+}
+
+ 
 /**
- * Resolve the given request using gethostbyaddr
+ * reads the list of nameservers from /etc/resolve.conf
  *
- * @param cache the request to resolve (and where to store the result)
+ * @param server_addrs[out] a list of null-terminated server address strings
+ * @return the number of server addresses in @server_addrs, -1 on error
  */
-static void
-gethostbyaddr_resolve (struct IPCache *cache)
+static ssize_t
+lookup_dns_servers (char ***server_addrs)
 {
-  struct hostent *ent;
-
-  ent = gethostbyaddr (cache->ip,
-                       cache->ip_len,
-                       cache->af);
-  if (NULL != ent)
+  struct GNUNET_DISK_FileHandle *fh;
+  char buf[2048];
+  ssize_t bytes_read;
+  size_t read_offset = 0;
+  unsigned int num_dns_servers = 0;
+    
+  fh = GNUNET_DISK_file_open ("/etc/resolv.conf",
+                              GNUNET_DISK_OPEN_READ,
+                              GNUNET_DISK_PERM_NONE);
+  if (NULL == fh)
   {
-    cache->addr = GNUNET_strdup (ent->h_name);
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Could not open /etc/resolv.conf. "
+                "DNS resolution will not be possible.\n");
+    return -1;
   }
-  else
+  bytes_read = GNUNET_DISK_file_read (fh,
+                                      buf,
+                                      sizeof (buf));
+  *server_addrs = NULL;
+  while (read_offset < bytes_read)
   {
-    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
-                "gethostbyaddr failed: %s\n",
-                hstrerror (h_errno));
+    char *newline;
+    size_t line_len;
+    char *dns_server;
+    
+    newline = strchr (buf + read_offset, '\n');
+    if (NULL == newline)
+    {
+      break;
+    }
+    line_len = newline - buf - read_offset;
+    dns_server = extract_dns_server (buf + read_offset, line_len);
+    if (NULL != dns_server)
+    {
+      GNUNET_array_append (*server_addrs,
+                           num_dns_servers,
+                           dns_server);
+    }
+    read_offset += line_len + 1;
   }
+  GNUNET_DISK_file_close (fh);
+  return num_dns_servers;
 }
-#endif
 
 
-/**
- * Resolve the given request using the available methods.
- *
- * @param cache the request to resolve (and where to store the result)
- */
-static void
-cache_resolve (struct IPCache *cache)
+static char *
+make_reverse_hostname (const void *ip, int af)
 {
-#if HAVE_GETNAMEINFO
-  if (NULL == cache->addr)
-    getnameinfo_resolve (cache);
-#endif
-#if HAVE_GETHOSTBYADDR
-  if (NULL == cache->addr)
-    gethostbyaddr_resolve (cache);
-#endif
+  char *buf = GNUNET_new_array (80, char);
+  int pos = 0;
+  if (AF_INET == af)
+  {
+    struct in_addr *addr = (struct in_addr *)ip;
+    uint32_t ip_int = addr->s_addr;
+    for (int i = 3; i >= 0; i--)
+    {
+      int n = GNUNET_snprintf (buf + pos,
+                               80 - pos,
+                               "%u.",
+                               ((uint8_t *)&ip_int)[i]);
+      if (n < 0)
+      {
+        GNUNET_free (buf);
+        return NULL;
+      }
+      pos += n;
+    }
+    pos += GNUNET_snprintf (buf + pos, 80 - pos, "in-addr.arpa");
+  }
+  else if (AF_INET6 == af)
+  {
+    struct in6_addr *addr = (struct in6_addr *)ip;
+    for (int i = 15; i >= 0; i--)
+    {
+      int n = GNUNET_snprintf (buf + pos, 80 - pos, "%x.", addr->s6_addr[i] & 0xf);
+      if (n < 0)
+      {
+        GNUNET_free (buf);
+        return NULL;
+      }
+      pos += n;
+      n = GNUNET_snprintf (buf + pos, 80 - pos, "%x.", addr->s6_addr[i] >> 4);
+      if (n < 0)
+      {
+        GNUNET_free (buf);
+        return NULL;
+      }
+      pos += n;
+    }
+    pos += GNUNET_snprintf (buf + pos, 80 - pos, "ip6.arpa");
+  }
+  buf[pos] = '\0';
+  return buf;
 }
 
 
-/**
- * Function called after the replies for the request have all
- * been transmitted to the client, and we can now read the next
- * request from the client.
- *
- * @param cls the `struct GNUNET_SERVICE_Client` to continue with
- */
 static void
-notify_service_client_done (void *cls)
+send_reply (struct GNUNET_DNSPARSER_Record *record,
+            uint16_t request_id,
+            struct GNUNET_SERVICE_Client *client)
 {
-  struct GNUNET_SERVICE_Client *client = cls;
-
-  GNUNET_SERVICE_client_continue (client);
-}
-
-
-/**
- * Get an IP address as a string (works for both IPv4 and IPv6).  Note
- * that the resolution happens asynchronously and that the first call
- * may not immediately result in the FQN (but instead in a
- * human-readable IP address).
- *
- * @param client handle to the client making the request (for sending the reply)
- * @param af AF_INET or AF_INET6
- * @param ip `struct in_addr` or `struct in6_addr`
- */
-static void
-get_ip_as_string (struct GNUNET_SERVICE_Client *client,
-                  int af,
-                  const void *ip,
-                  uint32_t request_id)
-{
-  struct IPCache *pos;
-  struct IPCache *next;
-  struct GNUNET_TIME_Absolute now;
-  struct GNUNET_MQ_Envelope *env;
-  struct GNUNET_MQ_Handle *mq;
   struct GNUNET_RESOLVER_ResponseMessage *msg;
-  size_t ip_len;
-  struct in6_addr ix;
-  size_t alen;
+  struct GNUNET_MQ_Envelope *env;
+  void *payload;
+  size_t payload_len;
 
-  switch (af)
-  {
-  case AF_INET:
-    ip_len = sizeof (struct in_addr);
-    break;
-  case AF_INET6:
-    ip_len = sizeof (struct in6_addr);
-    break;
-  default:
-    GNUNET_assert (0);
-  }
-  now = GNUNET_TIME_absolute_get ();
-  next = cache_head;
-  while ( (NULL != (pos = next)) &&
-          ( (pos->af != af) ||
-            (pos->ip_len != ip_len) ||
-            (0 != memcmp (pos->ip, ip, ip_len))) )
+  switch (record->type)
   {
-    next = pos->next;
-    if (GNUNET_TIME_absolute_get_duration (pos->last_request).rel_value_us <
-        60 * 60 * 1000 * 1000LL)
+    case GNUNET_DNSPARSER_TYPE_PTR:
     {
-      GNUNET_CONTAINER_DLL_remove (cache_head,
-                                   cache_tail,
-                                   pos);
-      GNUNET_free_non_null (pos->addr);
-      GNUNET_free (pos);
-      continue;
+      char *hostname = record->data.hostname;
+      payload = hostname;
+      payload_len = strlen (hostname) + 1;
+      break;
     }
-  }
-  if (NULL != pos)
-  {
-    if ( (1 == inet_pton (af,
-                          pos->ip,
-                          &ix)) &&
-         (GNUNET_TIME_absolute_get_duration (pos->last_request).rel_value_us >
-          120 * 1000 * 1000LL) )
+    case GNUNET_DNSPARSER_TYPE_A:
+    case GNUNET_DNSPARSER_TYPE_AAAA:
     {
-      /* try again if still numeric AND 2 minutes have expired */
-      GNUNET_free_non_null (pos->addr);
-      pos->addr = NULL;
-      cache_resolve (pos);
-      pos->last_request = now;
+      payload = record->data.raw.data;
+      payload_len = record->data.raw.data_len;
+      break;         
+    }
+    default:
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  "Cannot handle DNS response type: unimplemented\n");
+      return;
     }
   }
-  else
-  {
-    pos = GNUNET_malloc (sizeof (struct IPCache) + ip_len);
-    pos->ip = &pos[1];
-    GNUNET_memcpy (&pos[1],
-                   ip,
-                   ip_len);
-    pos->last_request = now;
-    pos->last_refresh = now;
-    pos->ip_len = ip_len;
-    pos->af = af;
-    GNUNET_CONTAINER_DLL_insert (cache_head,
-                                 cache_tail,
-                                 pos);
-    cache_resolve (pos);
-  }
-  if (NULL != pos->addr)
-    alen = strlen (pos->addr) + 1;
-  else
-    alen = 0;
-  mq = GNUNET_SERVICE_client_get_mq (client);
   env = GNUNET_MQ_msg_extra (msg,
-                             alen,
-                             GNUNET_MESSAGE_TYPE_RESOLVER_RESPONSE);
+                             payload_len,
+                             GNUNET_MESSAGE_TYPE_RESOLVER_RESPONSE);
   msg->id = request_id;
   GNUNET_memcpy (&msg[1],
-                 pos->addr,
-                 alen);
-  GNUNET_MQ_send (mq,
-                  env);
-  // send end message
-  env = GNUNET_MQ_msg (msg,
-                       GNUNET_MESSAGE_TYPE_RESOLVER_RESPONSE);
-  msg->id = request_id;
-  GNUNET_MQ_notify_sent (env,
-                         &notify_service_client_done,
-                         client);
-  GNUNET_MQ_send (mq,
-                  env);
+                 payload,
+                 payload_len);
+  GNUNET_MQ_send (GNUNET_SERVICE_client_get_mq (client),
+                  env);
 }
 
 
-#if HAVE_GETADDRINFO_A
-struct AsyncCls
-{
-  struct gaicb *host;
-  struct sigevent *sig;
-  struct GNUNET_MQ_Handle *mq;
-  uint32_t request_id;
-};
-
-
 static void
-resolve_result_pipe_cb (void *cls)
+send_end_msg (uint16_t request_id,
+              struct GNUNET_SERVICE_Client *client)
 {
-  struct AsyncCls *async_cls;
-  struct gaicb *host;
   struct GNUNET_RESOLVER_ResponseMessage *msg;
   struct GNUNET_MQ_Envelope *env;
 
-  GNUNET_DISK_file_read (GNUNET_DISK_pipe_handle (resolve_result_pipe,
-                                                  GNUNET_DISK_PIPE_END_READ),
-                         &async_cls,
-                         sizeof (struct AsyncCls *));
-  resolve_result_pipe_task =
-    GNUNET_SCHEDULER_add_read_file (GNUNET_TIME_UNIT_FOREVER_REL,
-                                    GNUNET_DISK_pipe_handle (resolve_result_pipe,
-                                                             GNUNET_DISK_PIPE_END_READ),
-                                    &resolve_result_pipe_cb,
-                                    NULL);
-  host = async_cls->host;
-  for (struct addrinfo *pos = host->ar_result; pos != NULL; pos = pos->ai_next)
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Sending end message\n");
+  env = GNUNET_MQ_msg (msg,
+                       GNUNET_MESSAGE_TYPE_RESOLVER_RESPONSE);
+  msg->id = request_id;
+  GNUNET_MQ_send (GNUNET_SERVICE_client_get_mq (client),
+                  env);
+}
+
+
+static void
+handle_resolve_result (void *cls,
+                       const struct GNUNET_TUN_DnsHeader *dns,
+                       size_t dns_len)
+{
+  struct ResolveCache *cache = cls;
+  struct GNUNET_DNSPARSER_Packet *parsed;
+  uint16_t request_id = *cache->request_id;
+  struct GNUNET_SERVICE_Client *client = cache->client;
+
+  parsed = GNUNET_DNSPARSER_parse ((const char *)dns,
+                                   dns_len);
+  if (NULL == parsed)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to parse DNS reply (request ID %u\n",
+                request_id);
+    return;
+  }
+  if (request_id != ntohs (parsed->id))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Request ID in DNS reply does not match\n");
+    return;
+  }
+  else if (0 == parsed->num_answers)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "DNS reply (request ID %u) contains no answers\n",
+                request_id);
+    GNUNET_CONTAINER_DLL_remove (cache_head,
+                                 cache_tail,
+                                 cache);
+    free_cache_entry (cache);
+    cache = NULL;
+  }
+  else
   {
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "Lookup result for hostname %s: %s (request ID %u)\n",
-                host->ar_name,
-                GNUNET_a2s (pos->ai_addr, pos->ai_addrlen),
-                async_cls->request_id);
-    switch (pos->ai_family)
+                "Got reply for request ID %u\n",
+                request_id);
+    for (unsigned int i = 0; i != parsed->num_answers; i++)
     {
-    case AF_INET:
-      env = GNUNET_MQ_msg_extra (msg,
-                                 sizeof (struct in_addr),
-                                 GNUNET_MESSAGE_TYPE_RESOLVER_RESPONSE);
-      msg->id = async_cls->request_id;
-      GNUNET_memcpy (&msg[1],
-                     &((struct sockaddr_in*) pos->ai_addr)->sin_addr,
-                     sizeof (struct in_addr));
-      GNUNET_MQ_send (async_cls->mq,
-                      env);
-      break;
-    case AF_INET6:
-      env = GNUNET_MQ_msg_extra (msg,
-                                 sizeof (struct in6_addr),
-                                 GNUNET_MESSAGE_TYPE_RESOLVER_RESPONSE);
-      msg->id = async_cls->request_id;
-      GNUNET_memcpy (&msg[1],
-                     &((struct sockaddr_in6*) pos->ai_addr)->sin6_addr,
-                     sizeof (struct in6_addr));
-      GNUNET_MQ_send (async_cls->mq,
-                      env);
-      break;
-    default:
-      /* unsupported, skip */
-      break;
+      struct Record *cache_entry = GNUNET_new (struct Record);
+      struct GNUNET_DNSPARSER_Record *record = &parsed->answers[i];
+      cache_entry->record = GNUNET_DNSPARSER_duplicate_record (record);
+      GNUNET_CONTAINER_DLL_insert (cache->records_head,
+                                   cache->records_tail,
+                                   cache_entry);
+      send_reply (cache_entry->record,
+                  request_id,
+                  cache->client);
     }
+    GNUNET_free_non_null (cache->request_id);
+    cache->request_id = NULL;
   }
-  // send end message
-  env = GNUNET_MQ_msg (msg,
-                       GNUNET_MESSAGE_TYPE_RESOLVER_RESPONSE);
-  msg->id = async_cls->request_id;
-  GNUNET_MQ_send (async_cls->mq,
-                  env);
-  freeaddrinfo (host->ar_result);
-  GNUNET_free ((struct gaicb *)host->ar_request); // free hints
-  GNUNET_free (host);
-  GNUNET_free (async_cls->sig);
-  GNUNET_free (async_cls);
+  send_end_msg (request_id,
+                client);
+  if (NULL != cache)
+    cache->client = NULL;
+  if (NULL != cache)
+  {
+    if (NULL != cache->timeout_task)
+    { 
+      GNUNET_SCHEDULER_cancel (cache->timeout_task);
+      cache->timeout_task = NULL;
+    }
+    if (NULL != cache->resolve_handle)
+    {
+      GNUNET_DNSSTUB_resolve_cancel (cache->resolve_handle);
+      cache->resolve_handle = NULL;
+    }
+  }
+  GNUNET_DNSPARSER_free_packet (parsed);
 }
 
 
 static void
-handle_async_result (union sigval val) 
+handle_resolve_timeout (void *cls)
 {
-  GNUNET_DISK_file_write (GNUNET_DISK_pipe_handle (resolve_result_pipe,
-                                                   GNUNET_DISK_PIPE_END_WRITE),
-                          &val.sival_ptr,
-                          sizeof (val.sival_ptr));
+  struct ResolveCache *cache = cls;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, 
+              "timeout!\n");
+  if (NULL != cache->resolve_handle)
+  {
+    GNUNET_DNSSTUB_resolve_cancel (cache->resolve_handle);
+    cache->resolve_handle = NULL;
+  }
+  GNUNET_CONTAINER_DLL_remove (cache_head,
+                               cache_tail,
+                               cache);
+  free_cache_entry (cache);
 }
 
 
 static int
-getaddrinfo_a_resolve (struct GNUNET_MQ_Handle *mq,
-                       const char *hostname,
-                       int af,
-                       uint32_t request_id)
+resolve_and_cache (const char* hostname,
+                   uint16_t record_type,
+                   uint16_t request_id,
+                   struct GNUNET_SERVICE_Client *client)
 {
-  int ret;
-  struct gaicb *host;
-  struct addrinfo *hints; 
-  struct sigevent *sig;
-  struct AsyncCls *async_cls;
-
-  host = GNUNET_new (struct gaicb);
-  hints = GNUNET_new (struct addrinfo);
-  sig = GNUNET_new (struct sigevent);
-  async_cls = GNUNET_new (struct AsyncCls);
-  memset (hints,
+  char *packet_buf;
+  size_t packet_size;
+  struct GNUNET_DNSPARSER_Query query;
+  struct GNUNET_DNSPARSER_Packet packet;
+  struct ResolveCache *cache;
+  struct GNUNET_TIME_Relative timeout =
+    GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 5);
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "resolve_and_cache\n");
+  query.name = (char *)hostname;
+  query.type = record_type;
+  query.dns_traffic_class = GNUNET_TUN_DNS_CLASS_INTERNET;
+  memset (&packet,
           0,
-          sizeof (struct addrinfo));
-  memset (sig,
-          0,
-          sizeof (struct sigevent));
-  hints->ai_family = af;
-  hints->ai_socktype = SOCK_STREAM;      /* go for TCP */
-  host->ar_name = hostname;
-  host->ar_service = NULL;
-  host->ar_request = hints;
-  host->ar_result = NULL;
-  sig->sigev_notify = SIGEV_THREAD;
-  sig->sigev_value.sival_ptr = async_cls;
-  sig->sigev_notify_function = &handle_async_result; 
-  async_cls->host = host;
-  async_cls->sig = sig;
-  async_cls->mq = mq;
-  async_cls->request_id = request_id;
-  ret = getaddrinfo_a (GAI_NOWAIT,
-                       &host,
-                       1,
-                       sig);
-  if (0 != ret)
+          sizeof (packet));
+  packet.num_queries = 1;
+  packet.queries = &query;
+  packet.id = htons (request_id);
+  packet.flags.recursion_desired = 1;
+  if (GNUNET_OK != 
+      GNUNET_DNSPARSER_pack (&packet,
+                             UINT16_MAX,
+                             &packet_buf,
+                             &packet_size))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to pack query for hostname `%s'\n",
+                hostname);
     return GNUNET_SYSERR;
+ 
+  }
+  cache = GNUNET_malloc (sizeof (struct ResolveCache));
+  cache->record_type = record_type;
+  cache->request_id = GNUNET_memdup (&request_id, sizeof (request_id));
+  cache->client = client;
+  cache->timeout_task = GNUNET_SCHEDULER_add_delayed (timeout,
+                                                      &handle_resolve_timeout,
+                                                      cache);
+  cache->resolve_handle = 
+    GNUNET_DNSSTUB_resolve (dnsstub_ctx,
+                            packet_buf,
+                            packet_size,
+                            &handle_resolve_result,
+                            cache);
+  GNUNET_CONTAINER_DLL_insert (cache_head,
+                               cache_tail,
+                               cache);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "resolve %s, request_id = %u\n",
+              hostname,
+              request_id);
+  GNUNET_free (packet_buf);
   return GNUNET_OK;
 }
 
 
-#elif HAVE_GETADDRINFO
-static int
-getaddrinfo_resolve (struct GNUNET_MQ_Handle *mq,
-                     const char *hostname,
-                     int af,
-                     uint32_t request_id)
+static const char *
+get_hostname (struct ResolveCache *cache_entry)
 {
-  int s;
-  struct addrinfo hints;
-  struct addrinfo *result;
-  struct addrinfo *pos;
-  struct GNUNET_RESOLVER_ResponseMessage *msg;
-  struct GNUNET_MQ_Envelope *env;
-
-#ifdef WINDOWS
-  /* Due to a bug, getaddrinfo will not return a mix of different families */
-  if (AF_UNSPEC == af)
+  if (NULL != cache_entry->records_head)
   {
-    int ret1;
-    int ret2;
-    ret1 = getaddrinfo_resolve (mq,
-                                hostname,
-                                AF_INET,
-                                request_id);
-    ret2 = getaddrinfo_resolve (mq,
-                                hostname,
-                                AF_INET6,
-                                request_id);
-    if ( (ret1 == GNUNET_OK) ||
-         (ret2 == GNUNET_OK) )
-      return GNUNET_OK;
-    if ( (ret1 == GNUNET_SYSERR) ||
-         (ret2 == GNUNET_SYSERR) )
-      return GNUNET_SYSERR;
-    return GNUNET_NO;
+    GNUNET_assert (NULL != cache_entry->records_head);
+    GNUNET_assert (NULL != cache_entry->records_head->record);
+    GNUNET_assert (NULL != cache_entry->records_head->record->name);
+    return cache_entry->records_head->record->name;
   }
-#endif
-
-  memset (&hints,
-          0,
-          sizeof (struct addrinfo));
-  hints.ai_family = af;
-  hints.ai_socktype = SOCK_STREAM;      /* go for TCP */
-
-  if (0 != (s = getaddrinfo (hostname,
-                             NULL,
-                             &hints,
-                             &result)))
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
-                _("Could not resolve `%s' (%s): %s\n"),
-                hostname,
-                (af ==
-                 AF_INET) ? "IPv4" : ((af == AF_INET6) ? "IPv6" : "any"),
-                gai_strerror (s));
-    if ( (s == EAI_BADFLAGS) ||
-#ifndef WINDOWS
-         (s == EAI_SYSTEM) ||
-#endif
-         (s == EAI_MEMORY) )
-      return GNUNET_NO;         /* other function may still succeed */
-    return GNUNET_SYSERR;
-  }
-  if (NULL == result)
-    return GNUNET_SYSERR;
-  for (pos = result; pos != NULL; pos = pos->ai_next)
-  {
-    switch (pos->ai_family)
-    {
-    case AF_INET:
-      env = GNUNET_MQ_msg_extra (msg,
-                                 sizeof (struct in_addr),
-                                 GNUNET_MESSAGE_TYPE_RESOLVER_RESPONSE);
-      msg->id = request_id;
-      GNUNET_memcpy (&msg[1],
-                     &((struct sockaddr_in*) pos->ai_addr)->sin_addr,
-                     sizeof (struct in_addr));
-      GNUNET_MQ_send (mq,
-                      env);
-      break;
-    case AF_INET6:
-      env = GNUNET_MQ_msg_extra (msg,
-                                 sizeof (struct in6_addr),
-                                 GNUNET_MESSAGE_TYPE_RESOLVER_RESPONSE);
-      msg->id = request_id;
-      GNUNET_memcpy (&msg[1],
-                     &((struct sockaddr_in6*) pos->ai_addr)->sin6_addr,
-                     sizeof (struct in6_addr));
-      GNUNET_MQ_send (mq,
-                      env);
-      break;
-    default:
-      /* unsupported, skip */
-      break;
-    }
-  }
-  freeaddrinfo (result);
-  return GNUNET_OK;
+  return NULL;
 }
 
 
-#elif HAVE_GETHOSTBYNAME2
-
-
-static int
-gethostbyname2_resolve (struct GNUNET_MQ_Handle *mq,
-                        const char *hostname,
-                        int af,
-                        uint32_t request_id)
+static const uint16_t *
+get_record_type (struct ResolveCache *cache_entry)
 {
-  struct hostent *hp;
-  int ret1;
-  int ret2;
-  struct GNUNET_MQ_Envelope *env;
-  struct GNUNET_RESOLVER_ResponseMessage *msg;
+  if (NULL != cache_entry->records_head)
+    return &cache_entry->record_type;
+  return NULL; 
+}
 
-#ifdef WINDOWS
-  /* gethostbyname2() in plibc is a compat dummy that calls gethostbyname(). */
-  return GNUNET_NO;
-#endif
 
-  if (af == AF_UNSPEC)
-  {
-    ret1 = gethostbyname2_resolve (mq,
-                                   hostname,
-                                   AF_INET,
-                                   request_id);
-    ret2 = gethostbyname2_resolve (mq,
-                                   hostname,
-                                   AF_INET6,
-                                   request_id);
-    if ( (ret1 == GNUNET_OK) ||
-         (ret2 == GNUNET_OK) )
-      return GNUNET_OK;
-    if ( (ret1 == GNUNET_SYSERR) ||
-         (ret2 == GNUNET_SYSERR) )
-      return GNUNET_SYSERR;
-    return GNUNET_NO;
-  }
-  hp = gethostbyname2 (hostname,
-                       af);
-  if (hp == NULL)
-  {
-    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
-                _("Could not find IP of host `%s': %s\n"),
-                hostname,
-                hstrerror (h_errno));
-    return GNUNET_SYSERR;
-  }
-  GNUNET_assert (hp->h_addrtype == af);
-  switch (af)
-  {
-  case AF_INET:
-    GNUNET_assert (hp->h_length == sizeof (struct in_addr));
-    env = GNUNET_MQ_msg_extra (msg,
-                               hp->h_length,
-                               GNUNET_MESSAGE_TYPE_RESOLVER_RESPONSE);
-    msg->id = request_id;
-    GNUNET_memcpy (&msg[1],
-                   hp->h_addr_list[0],
-                   hp->h_length);
-    GNUNET_MQ_send (mq,
-                    env);
-    break;
-  case AF_INET6:
-    GNUNET_assert (hp->h_length == sizeof (struct in6_addr));
-    env = GNUNET_MQ_msg_extra (msg,
-                               hp->h_length,
-                               GNUNET_MESSAGE_TYPE_RESOLVER_RESPONSE);
-    msg->id = request_id;
-    GNUNET_memcpy (&msg[1],
-                   hp->h_addr_list[0],
-                   hp->h_length);
-    GNUNET_MQ_send (mq,
-                    env);
-    break;
-  default:
-    GNUNET_break (0);
-    return GNUNET_SYSERR;
-  }
-  return GNUNET_OK;
+static const struct GNUNET_TIME_Absolute *
+get_expiration_time (struct ResolveCache *cache_entry)
+{
+  if (NULL != cache_entry->records_head)
+    return &cache_entry->records_head->record->expiration_time;
+  return NULL;
 }
 
-#elif HAVE_GETHOSTBYNAME
-
 
 static int
-gethostbyname_resolve (struct GNUNET_MQ_Handle *mq,
-                       const char *hostname,
-                       uint32_t request_id)
+remove_if_expired (struct ResolveCache *cache_entry)
 {
-  struct hostent *hp;
-  struct GNUNET_RESOLVER_ResponseMessage *msg;
-  struct GNUNET_MQ_Envelope *env;
+  struct GNUNET_TIME_Absolute now = GNUNET_TIME_absolute_get ();
 
-  hp = GETHOSTBYNAME (hostname);
-  if (NULL == hp)
+  if ( (NULL != cache_entry->records_head) &&
+       (now.abs_value_us > get_expiration_time (cache_entry)->abs_value_us) )
   {
-    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
-                _("Could not find IP of host `%s': %s\n"),
-                hostname,
-                hstrerror (h_errno));
-    return GNUNET_SYSERR;
-  }
-  if (hp->h_addrtype != AF_INET)
-  {
-    GNUNET_break (0);
-    return GNUNET_SYSERR;
+    GNUNET_CONTAINER_DLL_remove (cache_head,
+                                 cache_tail,
+                                 cache_entry);
+    free_cache_entry (cache_entry);
+    return GNUNET_YES;
   }
-  GNUNET_assert (hp->h_length == sizeof (struct in_addr));
-  env = GNUNET_MQ_msg_extra (msg,
-                             hp->h_length,
-                             GNUNET_MESSAGE_TYPE_RESOLVER_RESPONSE);
-  msg->id = request_id;
-  GNUNET_memcpy (&msg[1],
-                 hp->h_addr_list[0],
-                 hp->h_length);
-  GNUNET_MQ_send (mq,
-                  env);
-  return GNUNET_OK;
+  return GNUNET_NO;
 }
-#endif
 
 
 /**
- * Convert a string to an IP address.
+ * Get an IP address as a string (works for both IPv4 and IPv6).  Note
+ * that the resolution happens asynchronously and that the first call
+ * may not immediately result in the FQN (but instead in a
+ * human-readable IP address).
  *
- * @param client where to send the IP address
- * @param hostname the hostname to resolve
- * @param af AF_INET or AF_INET6; use AF_UNSPEC for "any"
+ * @param client handle to the client making the request (for sending the reply)
+ * @param af AF_INET or AF_INET6
+ * @param ip `struct in_addr` or `struct in6_addr`
  */
-static void
-get_ip_from_hostname (struct GNUNET_SERVICE_Client *client,
-                      const char *hostname,
-                      int af,
-                      uint32_t request_id)
+static int
+try_cache (const char *hostname,
+           uint16_t record_type,
+           uint16_t request_id,
+           struct GNUNET_SERVICE_Client *client)
 {
-  struct GNUNET_MQ_Envelope *env;
-  struct GNUNET_RESOLVER_ResponseMessage *msg;
-  struct GNUNET_MQ_Handle *mq;
-
-  mq = GNUNET_SERVICE_client_get_mq (client);
-#if HAVE_GETADDRINFO_A
-  getaddrinfo_a_resolve (mq,
-                         hostname,
-                         af,
-                         request_id);
-  GNUNET_SERVICE_client_continue (client);
-  return;
-#elif HAVE_GETADDRINFO
-  getaddrinfo_resolve (mq,
-                       hostname,
-                       af,
-                       request_id);
-#elif HAVE_GETHOSTBYNAME2
-  gethostbyname2_resolve (mq,
-                          hostname,
-                          af,
-                          request_id);
-#elif HAVE_GETHOSTBYNAME
-  if ( ( (af == AF_UNSPEC) ||
-         (af == PF_INET) ) )
-    gethostbyname_resolve (mq,
-                           hostname,
-                           request_id);
-#endif
-  // send end message
-  env = GNUNET_MQ_msg (msg,
-                       GNUNET_MESSAGE_TYPE_RESOLVER_RESPONSE);
-  msg->id = request_id;
-  GNUNET_MQ_notify_sent (env,
-                         &notify_service_client_done,
-                         client);
-  GNUNET_MQ_send (mq,
-                  env);
+  struct ResolveCache *pos;
+  struct ResolveCache *next;
+
+  next = cache_head;
+  while ( (NULL != (pos = next)) &&
+          ( (NULL == pos->records_head) ||
+            (0 != strcmp (get_hostname (pos), hostname)) ||
+            (*get_record_type (pos) != record_type) ) )
+  {
+    next = pos->next;
+    remove_if_expired (pos);
+  }
+  if (NULL != pos)
+  {
+    if (GNUNET_NO == remove_if_expired (pos))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "found cache entry for '%s', record type '%u'\n",
+                  hostname,
+                  record_type);
+      struct Record *cache_pos = pos->records_head;
+      while (NULL != cache_pos)
+      {
+        send_reply (cache_pos->record,
+                    request_id,
+                    client);
+        cache_pos = cache_pos->next;
+      }
+      send_end_msg (request_id,
+                    client);
+      return GNUNET_YES;
+    }
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "no cache entry for '%s'\n",
+              hostname);
+  return GNUNET_NO;
 }
 
 
@@ -801,6 +639,23 @@ check_get (void *cls,
 }
 
 
+static void
+process_get (const char *hostname,
+             uint16_t record_type,
+             uint16_t request_id,
+             struct GNUNET_SERVICE_Client *client)
+{
+  if (GNUNET_NO == try_cache (hostname, record_type, request_id, client))
+  {
+    int result = resolve_and_cache (hostname,
+                                    record_type,
+                                    request_id,
+                                    client);
+    GNUNET_assert (GNUNET_OK == result);
+  }
+}
+
+
 /**
  * Handle GET-message.
  *
@@ -812,45 +667,100 @@ handle_get (void *cls,
             const struct GNUNET_RESOLVER_GetMessage *msg)
 {
   struct GNUNET_SERVICE_Client *client = cls;
-  const void *ip;
   int direction;
   int af;
-  uint32_t id;
+  uint16_t request_id;
+  const char *hostname;
 
   direction = ntohl (msg->direction);
   af = ntohl (msg->af);
-  id = ntohl (msg->id);
+  request_id = ntohs (msg->id);
   if (GNUNET_NO == direction)
   {
     /* IP from hostname */
-    const char *hostname;
-
-    hostname = (const char *) &msg[1];
-    get_ip_from_hostname (client,
-                          hostname,
-                          af,
-                          id);
-    return;
+    hostname = GNUNET_strdup ((const char *) &msg[1]);
+    switch (af)
+    {
+      case AF_UNSPEC:
+      {
+        process_get (hostname, GNUNET_DNSPARSER_TYPE_ALL, request_id, client);
+        break;
+      }
+      case AF_INET:
+      {
+        process_get (hostname, GNUNET_DNSPARSER_TYPE_A, request_id, client);
+        break;
+      }
+      case AF_INET6:
+      {
+        process_get (hostname, GNUNET_DNSPARSER_TYPE_AAAA, request_id, client);
+        break;
+      }
+      default:
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "got invalid af: %d\n",
+                  af);
+        GNUNET_assert (0);
+      }
+    }
+  }
+  else
+  {
+    /* hostname from IP */
+    hostname = make_reverse_hostname (&msg[1], af); 
+    process_get (hostname, GNUNET_DNSPARSER_TYPE_PTR, request_id, client);
   }
-  ip = &msg[1];
+  GNUNET_free_non_null ((char *)hostname);
+  GNUNET_SERVICE_client_continue (client);
+}
 
-#if !defined(GNUNET_CULL_LOGGING)
+
+static void 
+shutdown_task (void *cls)
+{
+  (void) cls;
+  struct ResolveCache *pos;
+
+  while (NULL != (pos = cache_head))
   {
-    char buf[INET6_ADDRSTRLEN];
+    GNUNET_CONTAINER_DLL_remove (cache_head,
+                                 cache_tail,
+                                 pos);
+    free_cache_entry (pos);
+  }
+  GNUNET_DNSSTUB_stop (dnsstub_ctx);
+}
+
 
+static void
+init_cb (void *cls,
+         const struct GNUNET_CONFIGURATION_Handle *cfg,
+         struct GNUNET_SERVICE_Handle *sh)
+{
+  (void) cfg;
+  (void) sh;
+
+  GNUNET_SCHEDULER_add_shutdown (&shutdown_task,
+                                 cls);
+  dnsstub_ctx = GNUNET_DNSSTUB_start (128);
+  char **dns_servers;
+  ssize_t num_dns_servers = lookup_dns_servers (&dns_servers);
+  if (0 == num_dns_servers)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "no DNS server available. DNS resolution will not be possible.\n");
+  }
+  for (int i = 0; i != num_dns_servers; i++)
+  {
+    int result = GNUNET_DNSSTUB_add_dns_ip (dnsstub_ctx, dns_servers[i]);
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "Resolver asked to look up IP address `%s (request ID %u)'.\n",
-                inet_ntop (af,
-                           ip,
-                           buf,
-                           sizeof (buf)),
-                id);
+                "Adding DNS server '%s': %s\n",
+                dns_servers[i],
+                GNUNET_OK == result ? "success" : "failure");
+    GNUNET_free (dns_servers[i]);
   }
-#endif
-  get_ip_as_string (client,
-                    af,
-                    ip,
-                    id);
+  GNUNET_free_non_null (dns_servers);
 }
 
 
@@ -870,19 +780,6 @@ connect_cb (void *cls,
   (void) cls;
   (void) mq;
 
-#if HAVE_GETADDRINFO_A
-  resolve_result_pipe = GNUNET_DISK_pipe (GNUNET_NO,
-                                          GNUNET_NO,
-                                          GNUNET_NO,
-                                          GNUNET_NO);
-  GNUNET_assert (NULL != resolve_result_pipe);
-  resolve_result_pipe_task =
-    GNUNET_SCHEDULER_add_read_file (GNUNET_TIME_UNIT_FOREVER_REL,
-                                    GNUNET_DISK_pipe_handle (resolve_result_pipe,
-                                                             GNUNET_DISK_PIPE_END_READ),
-                                    &resolve_result_pipe_cb,
-                                    NULL);
-#endif
   return c;
 }
 
@@ -900,19 +797,16 @@ disconnect_cb (void *cls,
                void *internal_cls)
 {
   (void) cls;
+  struct ResolveCache *pos = cache_head; 
 
-#if HAVE_GETADDRINFO_A
-  if (NULL != resolve_result_pipe_task)
-  {
-    GNUNET_SCHEDULER_cancel (resolve_result_pipe_task);
-    resolve_result_pipe_task = NULL;
-  }
-  if (NULL != resolve_result_pipe)
+  while (NULL != pos)
   {
-    GNUNET_DISK_pipe_close (resolve_result_pipe);
-    resolve_result_pipe = NULL;
+    if (pos->client == c)
+    {
+      pos->client = NULL;
+    }
+    pos = pos->next;
   }
-#endif
   GNUNET_assert (c == internal_cls);
 }
 
@@ -923,7 +817,7 @@ disconnect_cb (void *cls,
 GNUNET_SERVICE_MAIN
 ("resolver",
  GNUNET_SERVICE_OPTION_NONE,
- NULL,
+ &init_cb,
  &connect_cb,
  &disconnect_cb,
  NULL,
@@ -950,23 +844,4 @@ GNUNET_RESOLVER_memory_init ()
 #endif
 
 
-/**
- * Free globals on exit.
- */
-void __attribute__ ((destructor))
-GNUNET_RESOLVER_memory_done ()
-{
-  struct IPCache *pos;
-
-  while (NULL != (pos = cache_head))
-  {
-    GNUNET_CONTAINER_DLL_remove (cache_head,
-                                 cache_tail,
-                                 pos);
-    GNUNET_free_non_null (pos->addr);
-    GNUNET_free (pos);
-  }
-}
-
-
 /* end of gnunet-service-resolver.c */
diff --git a/src/util/gnunet-timeout-w32.c b/src/util/gnunet-timeout-w32.c
new file mode 100644
index 000000000..78b268fe2
--- /dev/null
+++ b/src/util/gnunet-timeout-w32.c
@@ -0,0 +1,191 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2010 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License, or
+     (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+/**
+ * @file src/util/gnunet-timeout-w32.c
+ * @brief small tool starting a child process, waiting that it terminates or killing it after a given timeout period
+ * @author LRN
+ */
+
+#include <windows.h>
+#include <sys/types.h>
+#include <stdio.h>
+
+int
+main (int argc, char *argv[])
+{
+  int i;
+  DWORD wait_result;
+  wchar_t *commandline;
+  wchar_t **wargv;
+  wchar_t *arg;
+  unsigned int cmdlen;
+  STARTUPINFOW start;
+  PROCESS_INFORMATION proc;
+
+  wchar_t wpath[MAX_PATH + 1];
+
+  wchar_t *pathbuf;
+  DWORD pathbuf_len, alloc_len;
+  wchar_t *ptr;
+  wchar_t *non_const_filename;
+  wchar_t *wcmd;
+  int wargc;
+  int timeout = 0;
+  ssize_t wrote;
+
+  HANDLE job;
+
+  if (argc < 3)
+    {
+      printf
+        ("arg 1: timeout in sec., arg 2: executable, arg<n> arguments\n");
+      exit (1);
+    }
+
+  timeout = atoi (argv[1]);
+
+  if (timeout == 0)
+    timeout = 600;
+
+  commandline =  GetCommandLineW ();
+  if (commandline == NULL)
+  {
+    printf ("Failed to get commandline: %lu\n", GetLastError ());
+    exit (2);
+  }
+
+  wargv = CommandLineToArgvW (commandline, &wargc);
+  if (wargv == NULL || wargc <= 1)
+  {
+    printf ("Failed to get parse commandline: %lu\n", GetLastError ());
+    exit (3);
+  }
+
+  job = CreateJobObject (NULL, NULL);
+  if (job == NULL)
+  {
+    printf ("Failed to create a job: %lu\n", GetLastError ());
+    exit (4);
+  }
+
+  pathbuf_len = GetEnvironmentVariableW (L"PATH", (wchar_t *) &pathbuf, 0);
+
+  alloc_len = pathbuf_len + 1;
+
+  pathbuf = malloc (alloc_len * sizeof (wchar_t));
+
+  ptr = pathbuf;
+
+  alloc_len = GetEnvironmentVariableW (L"PATH", ptr, pathbuf_len);
+
+  cmdlen = wcslen (wargv[2]);
+  if (cmdlen < 5 || wcscmp (&wargv[2][cmdlen - 4], L".exe") != 0)
+  {
+    non_const_filename = malloc (sizeof (wchar_t) * (cmdlen + 5));
+    swprintf (non_const_filename, cmdlen + 5, L"%S.exe", wargv[2]);
+  }
+  else
+  {
+    non_const_filename = wcsdup (wargv[2]);
+  }
+
+  /* Check that this is the full path. If it isn't, search. */
+  if (non_const_filename[1] == L':')
+    swprintf (wpath, sizeof (wpath) / sizeof (wchar_t), L"%S", non_const_filename);
+  else if (!SearchPathW
+           (pathbuf, non_const_filename, NULL, sizeof (wpath) / sizeof (wchar_t),
+            wpath, NULL))
+  {
+    printf ("Failed to get find executable: %lu\n", GetLastError ());
+    exit (5);
+  }
+  free (pathbuf);
+  free (non_const_filename);
+
+  cmdlen = wcslen (wpath) + 4;
+  i = 3;
+  while (NULL != (arg = wargv[i++]))
+    cmdlen += wcslen (arg) + 4;
+
+  wcmd = malloc (sizeof (wchar_t) * (cmdlen + 1));
+  wrote = 0;
+  i = 2;
+  while (NULL != (arg = wargv[i++]))
+  {
+    /* This is to escape trailing slash */
+    wchar_t arg_lastchar = arg[wcslen (arg) - 1];
+    if (wrote == 0)
+    {
+      wrote += swprintf (&wcmd[wrote], cmdlen + 1 - wrote, L"\"%S%S\" ", wpath,
+          arg_lastchar == L'\\' ? L"\\" : L"");
+    }
+    else
+    {
+      if (wcschr (arg, L' ') != NULL)
+        wrote += swprintf (&wcmd[wrote], cmdlen + 1 - wrote, L"\"%S%S\"%S", arg,
+            arg_lastchar == L'\\' ? L"\\" : L"", i == wargc ? L"" : L" ");
+      else
+        wrote += swprintf (&wcmd[wrote], cmdlen + 1 - wrote, L"%S%S%S", arg,
+            arg_lastchar == L'\\' ? L"\\" : L"", i == wargc ? L"" : L" ");
+    }
+  }
+
+  LocalFree (wargv);
+
+  memset (&start, 0, sizeof (start));
+  start.cb = sizeof (start);
+
+  if (!CreateProcessW (wpath, wcmd, NULL, NULL, TRUE, CREATE_SUSPENDED,
+       NULL, NULL, &start, &proc))
+  {
+    wprintf (L"Failed to get spawn process `%S' with arguments `%S': %lu\n", wpath, wcmd, GetLastError ());
+    exit (6);
+  }
+
+  AssignProcessToJobObject (job, proc.hProcess);
+
+  ResumeThread (proc.hThread);
+  CloseHandle (proc.hThread);
+
+  free (wcmd);
+
+  wait_result = WaitForSingleObject (proc.hProcess, timeout * 1000);
+  if (wait_result == WAIT_OBJECT_0)
+  {
+    DWORD status;
+    wait_result = GetExitCodeProcess (proc.hProcess, &status);
+    CloseHandle (proc.hProcess);
+    if (wait_result != 0)
+    {
+      printf ("Test process exited with result %lu\n", status);
+      TerminateJobObject (job, status);
+      exit (status);
+    }
+    printf ("Test process exited (failed to obtain exit status)\n");
+    TerminateJobObject (job, 0);
+    exit (0);
+  }
+  printf ("Child processes were killed after timeout of %u seconds\n",
+          timeout);
+  TerminateJobObject (job, 1);
+  CloseHandle (proc.hProcess);
+  exit (1);
+}
+
+/* end of timeout_watchdog_w32.c */
diff --git a/src/util/gnunet-timeout.c b/src/util/gnunet-timeout.c
new file mode 100644
index 000000000..8dfb6ad17
--- /dev/null
+++ b/src/util/gnunet-timeout.c
@@ -0,0 +1,128 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2010 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License, or
+     (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+/**
+ * @file src/util/gnunet-timeout.c
+ * @brief small tool starting a child process, waiting that it terminates or killing it after a given timeout period
+ * @author Matthias Wachs
+ */
+
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+static pid_t child;
+
+
+static void
+sigchld_handler (int val)
+{
+  int status = 0;
+  int ret = 0;
+
+  (void) val;
+  waitpid (child,
+           &status,
+           0);
+  if (WIFEXITED (status) != 0)
+  {
+    ret = WEXITSTATUS (status);
+    fprintf (stderr,
+             "Process exited with result %u\n",
+             ret);
+    exit (ret); /* return same status code */
+  }
+  if (WIFSIGNALED (status) != 0)
+  {
+    ret = WTERMSIG (status);
+    fprintf (stderr,
+             "Process received signal %u\n",
+             ret);
+    kill (getpid (),
+          ret); /* kill self with the same signal */
+  }
+  exit (-1);
+}
+
+
+static void
+sigint_handler (int val)
+{
+  kill (0,
+        val);
+  exit (val);
+}
+
+
+int
+main (int argc,
+      char *argv[])
+{
+  int timeout = 0;
+  pid_t gpid = 0;
+
+  if (argc < 3)
+  {
+    fprintf (stderr,
+             "arg 1: timeout in sec., arg 2: executable, arg<n> arguments\n");
+    exit (-1);
+  }
+
+  timeout = atoi (argv[1]);
+
+  if (timeout == 0)
+    timeout = 600;
+
+  /* with getpgid() it does not compile, but getpgrp is the BSD version and working */
+  gpid = getpgrp ();
+
+  signal (SIGCHLD, sigchld_handler);
+  signal (SIGABRT, sigint_handler);
+  signal (SIGFPE, sigint_handler);
+  signal (SIGILL, sigint_handler);
+  signal (SIGINT, sigint_handler);
+  signal (SIGSEGV, sigint_handler);
+  signal (SIGTERM, sigint_handler);
+
+  child = fork ();
+  if (child == 0)
+  {
+    /*  int setpgrp(pid_t pid, pid_t pgid); is not working on this machine */
+    //setpgrp (0, pid_t gpid);
+    if (-1 != gpid)
+      setpgid (0, gpid);
+    execvp (argv[2],
+            &argv[2]);
+    exit (-1);
+  }
+  if (child > 0)
+  {
+    sleep (timeout);
+    printf ("Child processes were killed after timeout of %u seconds\n",
+            timeout);
+    kill (0,
+          SIGTERM);
+    exit (3);
+  }
+  exit (-1);
+}
+
+/* end of timeout_watchdog.c */
diff --git a/src/util/os_priority.c b/src/util/os_priority.c
index d13991334..a758f24f1 100644
--- a/src/util/os_priority.c
+++ b/src/util/os_priority.c
@@ -1588,7 +1588,7 @@ GNUNET_OS_start_process_s (int pipe_control,
 
 
 /**
- * Retrieve the status of a process, waiting on him if dead.
+ * Retrieve the status of a process, waiting on it if dead.
  * Nonblocking version.
  *
  * @param proc process ID
@@ -1705,7 +1705,7 @@ process_status (struct GNUNET_OS_Process *proc,
 
 
 /**
- * Retrieve the status of a process, waiting on him if dead.
+ * Retrieve the status of a process, waiting on it if dead.
  * Nonblocking version.
  *
  * @param proc process ID
@@ -1726,7 +1726,7 @@ GNUNET_OS_process_status (struct GNUNET_OS_Process *proc,
 
 
 /**
- * Retrieve the status of a process, waiting on him if dead.
+ * Retrieve the status of a process, waiting on it if dead.
  * Blocking version.
  *
  * @param proc pointer to process structure
diff --git a/src/util/regex.c b/src/util/regex.c
new file mode 100644
index 000000000..7565a9eac
--- /dev/null
+++ b/src/util/regex.c
@@ -0,0 +1,834 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2012, 2013, 2015 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+    
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+/**
+ * @file src/tun/regex.c
+ * @brief functions to convert IP networks to regexes
+ * @author Maximilian Szengel
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_tun_lib.h"
+
+/**
+ * 'wildcard', matches all possible values (for HEX encoding).
+ */
+#define DOT "(0|1|2|3|4|5|6|7|8|9|A|B|C|D|E|F)"
+
+
+/**
+ * Create a regex in @a rxstr from the given @a ip and @a netmask.
+ *
+ * @param ip IPv4 representation.
+ * @param port destination port
+ * @param rxstr generated regex, must be at least #GNUNET_TUN_IPV4_REGEXLEN
+ *              bytes long.
+ */
+void
+GNUNET_TUN_ipv4toregexsearch (const struct in_addr *ip,
+                              uint16_t port,
+                              char *rxstr)
+{
+  GNUNET_snprintf (rxstr,
+                   GNUNET_TUN_IPV4_REGEXLEN,
+                   "4-%04X-%08X",
+                   (unsigned int) port,
+                   ntohl (ip->s_addr));
+}
+
+
+/**
+ * Create a regex in @a rxstr from the given @a ipv6 and @a prefixlen.
+ *
+ * @param ipv6 IPv6 representation.
+ * @param port destination port
+ * @param rxstr generated regex, must be at least #GNUNET_TUN_IPV6_REGEXLEN
+ *              bytes long.
+ */
+void
+GNUNET_TUN_ipv6toregexsearch (const struct in6_addr *ipv6,
+                              uint16_t port,
+                              char *rxstr)
+{
+  const uint32_t *addr;
+
+  addr = (const uint32_t *) ipv6;
+  GNUNET_snprintf (rxstr,
+                   GNUNET_TUN_IPV6_REGEXLEN,
+                   "6-%04X-%08X%08X%08X%08X",
+                   (unsigned int) port,
+                   ntohl (addr[0]),
+                   ntohl (addr[1]),
+                   ntohl (addr[2]),
+                   ntohl (addr[3]));
+}
+
+
+/**
+ * Convert the given 4-bit (!) number to a regex.
+ *
+ * @param value the value, only the lowest 4 bits will be looked at
+ * @param mask which bits in value are wildcards (any value)?
+ */
+static char *
+nibble_to_regex (uint8_t value,
+                 uint8_t mask)
+{
+  char *ret;
+
+  value &= mask;
+  switch (mask)
+  {
+  case 0:
+    return GNUNET_strdup (DOT);
+  case 8:
+    GNUNET_asprintf (&ret,
+                     "(%X|%X|%X|%X|%X|%X|%X|%X)",
+                     value,
+                     value + 1,
+                     value + 2,
+                     value + 3,
+                     value + 4,
+                     value + 5,
+                     value + 6,
+                     value + 7);
+    return ret;
+  case 12:
+    GNUNET_asprintf (&ret,
+                     "(%X|%X|%X|%X)",
+                     value,
+                     value + 1,
+                     value + 2,
+                     value + 3);
+    return ret;
+  case 14:
+    GNUNET_asprintf (&ret,
+                     "(%X|%X)",
+                     value,
+                     value + 1);
+    return ret;
+  case 15:
+    GNUNET_asprintf (&ret,
+                     "%X",
+                     value);
+    return ret;
+  default:
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                _("Bad mask: %d\n"),
+                mask);
+    GNUNET_break (0);
+    return NULL;
+  }
+}
+
+
+/**
+ * Convert the given 16-bit number to a regex.
+ *
+ * @param value the value
+ * @param mask which bits in value are wildcards (any value)?
+ */
+static char *
+num_to_regex (uint16_t value,
+              uint16_t mask)
+{
+  const uint8_t *v = (const uint8_t *) &value;
+  const uint8_t *m = (const uint8_t *) &mask;
+  char *a;
+  char *b;
+  char *c;
+  char *d;
+  char *ret;
+
+  a = nibble_to_regex (v[0] >> 4, m[0] >> 4);
+  b = nibble_to_regex (v[0] & 15, m[0] & 15);
+  c = nibble_to_regex (v[1] >> 4, m[1] >> 4);
+  d = nibble_to_regex (v[1] & 15, m[1] & 15);
+  ret = NULL;
+  if ( (NULL != a) &&
+       (NULL != b) &&
+       (NULL != c) &&
+       (NULL != d) )
+    GNUNET_asprintf (&ret,
+                     "%s%s%s%s",
+                     a, b, c, d);
+  GNUNET_free_non_null (a);
+  GNUNET_free_non_null (b);
+  GNUNET_free_non_null (c);
+  GNUNET_free_non_null (d);
+  return ret;
+}
+
+
+/**
+ * Do we need to put parents around the given argument?
+ *
+ * @param arg part of a regular expression
+ * @return #GNUNET_YES if we should parens,
+ *         #GNUNET_NO if not
+ */
+static int
+needs_parens (const char *arg)
+{
+  size_t off;
+  size_t len;
+  unsigned int op;
+
+  op = 0;
+  len = strlen (arg);
+  for (off=0;off<len;off++)
+  {
+    switch (arg[off])
+    {
+    case '(':
+      op++;
+      break;
+    case ')':
+      GNUNET_assert (op > 0);
+      op--;
+      break;
+    case '|':
+      if (0 == op)
+        return GNUNET_YES;
+      break;
+    default:
+      break;
+    }
+  }
+  return GNUNET_NO;
+}
+
+
+/**
+ * Compute port policy for the given range of
+ * port numbers.
+ *
+ * @param start starting offset
+ * @param end end offset
+ * @param step increment level (power of 16)
+ * @param pp port policy to convert
+ * @return corresponding regex
+ */
+static char *
+compute_policy (unsigned int start,
+                unsigned int end,
+                unsigned int step,
+                const struct GNUNET_STRINGS_PortPolicy *pp)
+{
+  unsigned int i;
+  char before[36]; /* 16 * 2 + 3 dots + 0-terminator */
+  char middlel[33]; /* 16 * 2 + 0-terminator */
+  char middleh[33]; /* 16 * 2 + 0-terminator */
+  char after[36]; /* 16 * 2 + 3 dots + 0-terminator */
+  char beforep[36+2]; /* 16 * 2 + 3 dots + 0-terminator + ()*/
+  char middlehp[33+2]; /* 16 * 2 + 0-terminator + () */
+  char middlelp[33+2]; /* 16 * 2 + 0-terminator + () */
+  char afterp[36+2]; /* 16 * 2 + 3 dots + 0-terminator + () */
+  char dots[5 * strlen (DOT)];
+  char buf[3];
+  char *middle;
+  char *ret;
+  unsigned int xstep;
+  char *recl;
+  char *rech;
+  char *reclp;
+  char *rechp;
+  unsigned int start_port;
+  unsigned int end_port;
+
+  GNUNET_assert (GNUNET_YES == pp->negate_portrange);
+  start_port = pp->start_port;
+  if (1 == start_port)
+    start_port = 0;
+  end_port = pp->end_port;
+  GNUNET_assert ((end - start) / step <= 0xF);
+  before[0] = '\0';
+  middlel[0] = '\0';
+  middleh[0] = '\0';
+  after[0] = '\0';
+  for (i=start;i<=end;i+=step)
+  {
+    GNUNET_snprintf (buf,
+                     sizeof (buf),
+                     "%X|",
+                     (i - start) / step);
+    if (i / step < start_port / step)
+      strcat (before, buf);
+    else if (i / step > end_port / step)
+      strcat (after, buf);
+    else if (i / step == start_port / step)
+      strcat (middlel, buf);
+    else if (i / step == end_port / step)
+      strcat (middleh, buf);
+  }
+  if (strlen (before) > 0)
+    before[strlen (before)-1] = '\0';
+  if (strlen (middlel) > 0)
+    middlel[strlen (middlel)-1] = '\0';
+  if (strlen (middleh) > 0)
+    middleh[strlen (middleh)-1] = '\0';
+  if (strlen (after) > 0)
+    after[strlen (after)-1] = '\0';
+  if (needs_parens (before))
+    GNUNET_snprintf (beforep,
+                     sizeof (beforep),
+                     "(%s)",
+                     before);
+  else
+    strcpy (beforep, before);
+  if (needs_parens (middlel))
+    GNUNET_snprintf (middlelp,
+                     sizeof (middlelp),
+                     "(%s)",
+                     middlel);
+  else
+    strcpy (middlelp, middlel);
+  if (needs_parens (middleh))
+    GNUNET_snprintf (middlehp,
+                     sizeof (middlehp),
+                     "(%s)",
+                     middleh);
+  else
+    strcpy (middlehp, middleh);
+  if (needs_parens (after))
+    GNUNET_snprintf (afterp,
+                     sizeof (afterp),
+                     "(%s)",
+                     after);
+  else
+    strcpy (afterp, after);
+  dots[0] = '\0';
+  for (xstep=step/16;xstep>0;xstep/=16)
+    strcat (dots, DOT);
+  if (step >= 16)
+  {
+    if (strlen (middlel) > 0)
+      recl = compute_policy ((start_port / step) * step,
+                             (start_port / step) * step + step - 1,
+                             step / 16,
+                             pp);
+    else
+      recl = GNUNET_strdup ("");
+    if (strlen (middleh) > 0)
+      rech = compute_policy ((end_port / step) * step,
+                             (end_port / step) * step + step - 1,
+                             step / 16,
+                             pp);
+    else
+      rech = GNUNET_strdup ("");
+  }
+  else
+  {
+    recl = GNUNET_strdup ("");
+    rech = GNUNET_strdup ("");
+    middlel[0] = '\0';
+    middlelp[0] = '\0';
+    middleh[0] = '\0';
+    middlehp[0] = '\0';
+  }
+  if (needs_parens (recl))
+    GNUNET_asprintf (&reclp,
+                     "(%s)",
+                     recl);
+  else
+    reclp = GNUNET_strdup (recl);
+  if (needs_parens (rech))
+    GNUNET_asprintf (&rechp,
+                     "(%s)",
+                     rech);
+  else
+    rechp = GNUNET_strdup (rech);
+
+  if ( (strlen (middleh) > 0) &&
+       (strlen (rech) > 0) &&
+       (strlen (middlel) > 0) &&
+       (strlen (recl) > 0) )
+  {
+    GNUNET_asprintf (&middle,
+                     "%s%s|%s%s",
+                     middlel,
+                     reclp,
+                     middleh,
+                     rechp);
+  }
+  else if ( (strlen (middleh) > 0) &&
+            (strlen (rech) > 0) )
+  {
+    GNUNET_asprintf (&middle,
+                     "%s%s",
+                     middleh,
+                     rechp);
+  }
+  else if ( (strlen (middlel) > 0) &&
+            (strlen (recl) > 0) )
+  {
+    GNUNET_asprintf (&middle,
+                     "%s%s",
+                     middlel,
+                     reclp);
+  }
+  else
+  {
+    middle = GNUNET_strdup ("");
+  }
+  if ( (strlen(before) > 0) &&
+       (strlen(after) > 0) )
+  {
+    if (strlen (dots) > 0)
+    {
+      if (strlen (middle) > 0)
+        GNUNET_asprintf (&ret,
+                         "(%s%s|%s|%s%s)",
+                         beforep, dots,
+                         middle,
+                         afterp, dots);
+      else
+        GNUNET_asprintf (&ret,
+                         "(%s|%s)%s",
+                         beforep,
+                         afterp,
+                         dots);
+    }
+    else
+    {
+      if (strlen (middle) > 0)
+        GNUNET_asprintf (&ret,
+                         "(%s|%s|%s)",
+                         before,
+                         middle,
+                         after);
+      else if (1 == step)
+        GNUNET_asprintf (&ret,
+                         "%s|%s",
+                         before,
+                         after);
+      else
+        GNUNET_asprintf (&ret,
+                         "(%s|%s)",
+                         before,
+                         after);
+    }
+  }
+  else if (strlen (before) > 0)
+  {
+    if (strlen (dots) > 0)
+    {
+      if (strlen (middle) > 0)
+        GNUNET_asprintf (&ret,
+                         "(%s%s|%s)",
+                         beforep, dots,
+                         middle);
+      else
+        GNUNET_asprintf (&ret,
+                         "%s%s",
+                         beforep, dots);
+    }
+    else
+    {
+      if (strlen (middle) > 0)
+        GNUNET_asprintf (&ret,
+                         "(%s|%s)",
+                         before,
+                         middle);
+      else
+        GNUNET_asprintf (&ret,
+                         "%s",
+                         before);
+    }
+  }
+  else if (strlen (after) > 0)
+  {
+    if (strlen (dots) > 0)
+    {
+      if (strlen (middle) > 0)
+        GNUNET_asprintf (&ret,
+                         "(%s|%s%s)",
+                         middle,
+                         afterp, dots);
+      else
+        GNUNET_asprintf (&ret,
+                         "%s%s",
+                         afterp, dots);
+    }
+    else
+    {
+      if (strlen (middle) > 0)
+        GNUNET_asprintf (&ret,
+                         "%s|%s",
+                         middle,
+                         after);
+      else
+        GNUNET_asprintf (&ret,
+                         "%s",
+                         after);
+    }
+  }
+  else if (strlen (middle) > 0)
+  {
+    GNUNET_asprintf (&ret,
+                     "%s",
+                     middle);
+  }
+  else
+  {
+    ret = GNUNET_strdup ("");
+  }
+  GNUNET_free (middle);
+  GNUNET_free (reclp);
+  GNUNET_free (rechp);
+  GNUNET_free (recl);
+  GNUNET_free (rech);
+  return ret;
+}
+
+
+/**
+ * Convert a port policy to a regular expression.  Note: this is a
+ * very simplistic implementation, we might want to consider doing
+ * something more sophisiticated (resulting in smaller regular
+ * expressions) at a later time.
+ *
+ * @param pp port policy to convert
+ * @return NULL on error
+ */
+static char *
+port_to_regex (const struct GNUNET_STRINGS_PortPolicy *pp)
+{
+  char *reg;
+  char *ret;
+  char *pos;
+  unsigned int i;
+  unsigned int cnt;
+
+  if ( (0 == pp->start_port) ||
+       ( (1 == pp->start_port) &&
+         (0xFFFF == pp->end_port) &&
+         (GNUNET_NO == pp->negate_portrange)) )
+    return GNUNET_strdup (DOT DOT DOT DOT);
+  if ( (pp->start_port == pp->end_port) &&
+       (GNUNET_NO == pp->negate_portrange))
+  {
+    GNUNET_asprintf (&ret,
+                     "%04X",
+                     pp->start_port);
+    return ret;
+  }
+  if (pp->end_port < pp->start_port)
+    return NULL;
+
+  if (GNUNET_YES == pp->negate_portrange)
+  {
+    ret = compute_policy (0, 0xFFFF, 0x1000, pp);
+  }
+  else
+  {
+    cnt = pp->end_port - pp->start_port + 1;
+    reg = GNUNET_malloc (cnt * 5 + 1);
+    pos = reg;
+    for (i=1;i<=0xFFFF;i++)
+    {
+      if ( (i >= pp->start_port) && (i <= pp->end_port) )
+      {
+        if (pos == reg)
+        {
+          GNUNET_snprintf (pos,
+                           5,
+                           "%04X",
+                           i);
+        }
+        else
+        {
+          GNUNET_snprintf (pos,
+                           6,
+                           "|%04X",
+                           i);
+        }
+        pos += strlen (pos);
+      }
+    }
+    GNUNET_asprintf (&ret,
+                     "(%s)",
+                     reg);
+    GNUNET_free (reg);
+  }
+  return ret;
+}
+
+
+/**
+ * Convert an address (IPv4 or IPv6) to a regex.
+ *
+ * @param addr address
+ * @param mask network mask
+ * @param len number of bytes in @a addr and @a mask
+ * @return NULL on error, otherwise regex for the address
+ */
+static char *
+address_to_regex (const void *addr,
+                  const void *mask,
+                  size_t len)
+{
+  const uint16_t *a = addr;
+  const uint16_t *m = mask;
+  char *ret;
+  char *tmp;
+  char *reg;
+  unsigned int i;
+
+  ret = NULL;
+  GNUNET_assert (1 != (len % 2));
+  for (i=0;i<len / 2;i++)
+  {
+    reg = num_to_regex (a[i], m[i]);
+    if (NULL == reg)
+    {
+      GNUNET_free_non_null (ret);
+      return NULL;
+    }
+    if (NULL == ret)
+    {
+      ret = reg;
+    }
+    else
+    {
+      GNUNET_asprintf (&tmp,
+                       "%s%s",
+                       ret, reg);
+      GNUNET_free (ret);
+      GNUNET_free (reg);
+      ret = tmp;
+    }
+  }
+  return ret;
+}
+
+
+/**
+ * Convert a single line of an IPv4 policy to a regular expression.
+ *
+ * @param v4 line to convert
+ * @return NULL on error
+ */
+static char *
+ipv4_to_regex (const struct GNUNET_STRINGS_IPv4NetworkPolicy *v4)
+{
+  char *reg;
+  char *pp;
+  char *ret;
+
+  reg = address_to_regex (&v4->network,
+                          &v4->netmask,
+                          sizeof (struct in_addr));
+  if (NULL == reg)
+    return NULL;
+  pp = port_to_regex (&v4->pp);
+  if (NULL == pp)
+  {
+    GNUNET_free (reg);
+    return NULL;
+  }
+  GNUNET_asprintf (&ret,
+                   "4-%s-%s",
+                   pp, reg);
+  GNUNET_free (pp);
+  GNUNET_free (reg);
+  return ret;
+}
+
+
+/**
+ * Convert a single line of an IPv4 policy to a regular expression.
+ *
+ * @param v6 line to convert
+ * @return NULL on error
+ */
+static char *
+ipv6_to_regex (const struct GNUNET_STRINGS_IPv6NetworkPolicy *v6)
+{
+  char *reg;
+  char *pp;
+  char *ret;
+
+  reg = address_to_regex (&v6->network,
+                          &v6->netmask,
+                          sizeof (struct in6_addr));
+  if (NULL == reg)
+    return NULL;
+  pp = port_to_regex (&v6->pp);
+  if (NULL == pp)
+  {
+    GNUNET_free (reg);
+    return NULL;
+  }
+  GNUNET_asprintf (&ret,
+                   "6-%s-%s",
+                   pp, reg);
+  GNUNET_free (pp);
+  GNUNET_free (reg);
+  return ret;
+}
+
+
+/**
+ * Convert an exit policy to a regular expression.  The exit policy
+ * specifies a set of subnets this peer is willing to serve as an
+ * exit for; the resulting regular expression will match the
+ * IPv4 address strings as returned by #GNUNET_TUN_ipv4toregexsearch().
+ *
+ * @param policy exit policy specification
+ * @return regular expression, NULL on error
+ */
+char *
+GNUNET_TUN_ipv4policy2regex (const char *policy)
+{
+  struct GNUNET_STRINGS_IPv4NetworkPolicy *np;
+  char *reg;
+  char *tmp;
+  char *line;
+  unsigned int i;
+
+  np = GNUNET_STRINGS_parse_ipv4_policy (policy);
+  if (NULL == np)
+    return NULL;
+  reg = NULL;
+  for (i=0; (0 == i) || (0 != np[i].network.s_addr); i++)
+  {
+    line = ipv4_to_regex (&np[i]);
+    if (NULL == line)
+    {
+      GNUNET_free_non_null (reg);
+      GNUNET_free (np);
+      return NULL;
+    }
+    if (NULL == reg)
+    {
+      reg = line;
+    }
+    else
+    {
+      GNUNET_asprintf (&tmp,
+                       "%s|(%s)",
+                       reg, line);
+      GNUNET_free (reg);
+      GNUNET_free (line);
+      reg = tmp;
+    }
+    if (0 == np[i].network.s_addr)
+      break;
+  }
+  GNUNET_free (np);
+  return reg;
+}
+
+
+/**
+ * Convert an exit policy to a regular expression.  The exit policy
+ * specifies a set of subnets this peer is willing to serve as an
+ * exit for; the resulting regular expression will match the
+ * IPv6 address strings as returned by #GNUNET_TUN_ipv6toregexsearch().
+ *
+ * @param policy exit policy specification
+ * @return regular expression, NULL on error
+ */
+char *
+GNUNET_TUN_ipv6policy2regex (const char *policy)
+{
+  struct in6_addr zero;
+  struct GNUNET_STRINGS_IPv6NetworkPolicy *np;
+  char *reg;
+  char *tmp;
+  char *line;
+  unsigned int i;
+
+  np = GNUNET_STRINGS_parse_ipv6_policy (policy);
+  if (NULL == np)
+    return NULL;
+  reg = NULL;
+  memset (&zero, 0, sizeof (struct in6_addr));
+  for (i=0; (0 == i) || (0 != memcmp (&zero, &np[i].network, sizeof (struct in6_addr))); i++)
+  {
+    line = ipv6_to_regex (&np[i]);
+    if (NULL == line)
+    {
+      GNUNET_free_non_null (reg);
+      GNUNET_free (np);
+      return NULL;
+    }
+    if (NULL == reg)
+    {
+      reg = line;
+    }
+    else
+    {
+      GNUNET_asprintf (&tmp,
+                       "%s|(%s)",
+                       reg, line);
+      GNUNET_free (reg);
+      GNUNET_free (line);
+      reg = tmp;
+    }
+    if (0 == memcmp (&zero, &np[i].network, sizeof (struct in6_addr)))
+      break;
+  }
+  GNUNET_free (np);
+  return reg;
+}
+
+
+/**
+ * Hash the service name of a hosted service to the
+ * hash code that is used to identify the service on
+ * the network.
+ *
+ * @param service_name a string
+ * @param hc corresponding hash
+ */
+void
+GNUNET_TUN_service_name_to_hash (const char *service_name,
+                                 struct GNUNET_HashCode *hc)
+{
+  GNUNET_CRYPTO_hash (service_name,
+                      strlen (service_name),
+                      hc);
+}
+
+
+/**
+ * Compute the CADET port given a service descriptor
+ * (returned from #GNUNET_TUN_service_name_to_hash) and
+ * a TCP/UDP port @a ip_port.
+ *
+ * @param desc service shared secret
+ * @param ip_port TCP/UDP port, use 0 for ICMP
+ * @param[out] cadet_port CADET port to use
+ */
+void
+GNUNET_TUN_compute_service_cadet_port (const struct GNUNET_HashCode *desc,
+                                       uint16_t ip_port,
+                                       struct GNUNET_HashCode *cadet_port)
+{
+  uint16_t be_port = htons (ip_port);
+
+  *cadet_port = *desc;
+  GNUNET_memcpy (cadet_port,
+                 &be_port,
+                 sizeof (uint16_t));
+}
+
+
+/* end of regex.c */
diff --git a/src/util/resolver.h b/src/util/resolver.h
index a0f105afa..07851d052 100644
--- a/src/util/resolver.h
+++ b/src/util/resolver.h
@@ -60,7 +60,7 @@ struct GNUNET_RESOLVER_GetMessage
    * identifies the request and is contained in the response message. The
    * client has to match response to request by this identifier.
    */
-  uint32_t id GNUNET_PACKED;
+  uint16_t id GNUNET_PACKED;
 
   /* followed by 0-terminated string for A/AAAA-lookup or
      by 'struct in_addr' / 'struct in6_addr' for reverse lookup */
@@ -79,7 +79,7 @@ struct GNUNET_RESOLVER_ResponseMessage
   * identifies the request this message responds to. The client
   * has to match response to request by this identifier.
   */
-  uint32_t id GNUNET_PACKED;
+  uint16_t id GNUNET_PACKED;
 
   /* followed by 0-terminated string for response to a reverse lookup
    * or by 'struct in_addr' / 'struct in6_addr' for response to
diff --git a/src/util/resolver_api.c b/src/util/resolver_api.c
index b94819f06..8a054327b 100644
--- a/src/util/resolver_api.c
+++ b/src/util/resolver_api.c
@@ -68,10 +68,10 @@ static struct GNUNET_RESOLVER_RequestHandle *req_head;
  */
 static struct GNUNET_RESOLVER_RequestHandle *req_tail;
 
-/**
- * ID of the last request we sent to the service
- */
-static uint32_t last_request_id;
+///**
+// * ID of the last request we sent to the service
+// */
+//static uint16_t last_request_id;
 
 /**
  * How long should we wait to reconnect?
@@ -445,7 +445,7 @@ process_requests ()
                              GNUNET_MESSAGE_TYPE_RESOLVER_REQUEST);
   msg->direction = htonl (rh->direction);
   msg->af = htonl (rh->af);
-  msg->id = htonl (rh->id);
+  msg->id = htons (rh->id);
   GNUNET_memcpy (&msg[1],
                  &rh[1],
                  rh->data_len);
@@ -491,7 +491,7 @@ handle_response (void *cls,
   struct GNUNET_RESOLVER_RequestHandle *rh = req_head;
   uint16_t size;
   char *nret;
-  uint32_t request_id = msg->id;
+  uint16_t request_id = msg->id;
 
   for (; rh != NULL; rh = rh->next)
   {
@@ -911,6 +911,14 @@ handle_lookup_timeout (void *cls)
 }
 
 
+static uint16_t
+get_request_id ()
+{
+  return (uint16_t) GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_NONCE,
+                                              UINT16_MAX);
+}
+
+
 /**
  * Convert a string to one or more IP addresses.
  *
@@ -945,7 +953,8 @@ GNUNET_RESOLVER_ip_get (const char *hostname,
        hostname);
   rh = GNUNET_malloc (sizeof (struct GNUNET_RESOLVER_RequestHandle) + slen);
   rh->af = af;
-  rh->id = ++last_request_id;
+  //rh->id = ++last_request_id;
+  rh->id = get_request_id ();
   rh->addr_callback = callback;
   rh->cls = callback_cls;
   GNUNET_memcpy (&rh[1],
@@ -1092,7 +1101,8 @@ GNUNET_RESOLVER_hostname_get (const struct sockaddr *sa,
   rh->name_callback = callback;
   rh->cls = cls;
   rh->af = sa->sa_family;
-  rh->id = ++last_request_id;
+  //rh->id = ++last_request_id;
+  rh->id = get_request_id ();
   rh->timeout = GNUNET_TIME_relative_to_absolute (timeout);
   GNUNET_memcpy (&rh[1],
                  ip,
diff --git a/src/util/strings.c b/src/util/strings.c
index 5ed195933..ea3c8cfb9 100644
--- a/src/util/strings.c
+++ b/src/util/strings.c
@@ -11,7 +11,7 @@
      WITHOUT ANY WARRANTY; without even the implied warranty of
      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
      Affero General Public License for more details.
-    
+
      You should have received a copy of the GNU Affero General Public License
      along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
@@ -1947,27 +1947,27 @@ static char *cvt =
 /**
  * Encode into Base64.
  *
- * @param data the data to encode
+ * @param in the data to encode
  * @param len the length of the input
  * @param output where to write the output (*output should be NULL,
  *   is allocated)
  * @return the size of the output
  */
 size_t
-GNUNET_STRINGS_base64_encode (const char *data,
+GNUNET_STRINGS_base64_encode (const void *in,
                               size_t len,
                               char **output)
 {
-  size_t i;
-  char c;
+  const char *data = in;
   size_t ret;
   char *opt;
 
   ret = 0;
   opt = GNUNET_malloc (2 + (len * 4 / 3) + 8);
-  *output = opt;
-  for (i = 0; i < len; ++i)
+  for (size_t i = 0; i < len; ++i)
   {
+    char c;
+
     c = (data[i] >> 2) & 0x3f;
     opt[ret++] = cvt[(int) c];
     c = (data[i] << 4) & 0x3f;
@@ -1997,6 +1997,7 @@ GNUNET_STRINGS_base64_encode (const char *data,
     }
   }
   opt[ret++] = FILLCHAR;
+  *output = opt;
   return ret;
 }
 
@@ -2018,11 +2019,10 @@ GNUNET_STRINGS_base64_encode (const char *data,
  */
 size_t
 GNUNET_STRINGS_base64_decode (const char *data,
-                              size_t len, char **output)
+                              size_t len,
+                              void **out)
 {
-  size_t i;
-  char c;
-  char c1;
+  char *output;
   size_t ret = 0;
 
 #define CHECK_CRLF  while (data[i] == '\r' || data[i] == '\n') {\
@@ -2031,12 +2031,15 @@ GNUNET_STRINGS_base64_decode (const char *data,
                         if (i >= len) goto END;  \
                 }
 
-  *output = GNUNET_malloc ((len * 3 / 4) + 8);
+  output = GNUNET_malloc ((len * 3 / 4) + 8);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "base64_decode decoding len=%d\n",
               (int) len);
-  for (i = 0; i < len; ++i)
+  for (size_t i = 0; i < len; ++i)
   {
+    char c;
+    char c1;
+
     CHECK_CRLF;
     if (FILLCHAR == data[i])
       break;
@@ -2045,7 +2048,7 @@ GNUNET_STRINGS_base64_decode (const char *data,
     CHECK_CRLF;
     c1 = (char) cvtfind (data[i]);
     c = (c << 2) | ((c1 >> 4) & 0x3);
-    (*output)[ret++] = c;
+    output[ret++] = c;
     if (++i < len)
     {
       CHECK_CRLF;
@@ -2054,7 +2057,7 @@ GNUNET_STRINGS_base64_decode (const char *data,
         break;
       c = (char) cvtfind (c);
       c1 = ((c1 << 4) & 0xf0) | ((c >> 2) & 0xf);
-      (*output)[ret++] = c1;
+      output[ret++] = c1;
     }
     if (++i < len)
     {
@@ -2065,15 +2068,13 @@ GNUNET_STRINGS_base64_decode (const char *data,
 
       c1 = (char) cvtfind (c1);
       c = ((c << 6) & 0xc0) | c1;
-      (*output)[ret++] = c;
+      output[ret++] = c;
     }
   }
 END:
+  *out = output;
   return ret;
 }
 
 
-
-
-
 /* end of strings.c */
diff --git a/src/util/test_hexcoder.c b/src/util/test_hexcoder.c
new file mode 100644
index 000000000..441d7e200
--- /dev/null
+++ b/src/util/test_hexcoder.c
@@ -0,0 +1,54 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2014 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+    
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+*/
+/**
+ * @author Christian Grothoff
+ * @file dns/test_hexcoder.c
+ * @brief test for #GNUNET_DNSPARSER_hex_to_bin() and
+ *                 #GNUNET_DNSPARSER_bin_to_hex()
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_dnsparser_lib.h"
+
+#define TESTSTRING "Hello World!"
+
+
+int
+main (int argc,
+      char *argv[])
+{
+  char buf[strlen (TESTSTRING)  + 1];
+  char *ret;
+
+  GNUNET_log_setup ("test-hexcoder", "WARNING", NULL);
+  ret = GNUNET_DNSPARSER_bin_to_hex (TESTSTRING,
+                                     strlen (TESTSTRING) + 1);
+  GNUNET_assert (NULL != ret);
+  GNUNET_assert (sizeof (buf) ==
+                 GNUNET_DNSPARSER_hex_to_bin (ret,
+                                              buf));
+  GNUNET_assert (0 == memcmp (TESTSTRING,
+                              buf,
+                              sizeof (buf)));
+  GNUNET_free (ret);
+  return 0;
+}
+
+
+/* end of test_hexcoder.c */
diff --git a/src/util/test_regex.c b/src/util/test_regex.c
new file mode 100644
index 000000000..2e7d52828
--- /dev/null
+++ b/src/util/test_regex.c
@@ -0,0 +1,179 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2012, 2013 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+    
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+/**
+ * @file tun/test_regex.c
+ * @brief simple test for regex.c iptoregex functions
+ * @author Maximilian Szengel
+ */
+#include "platform.h"
+#include "gnunet_tun_lib.h"
+
+/**
+ * 'wildcard', matches all possible values (for HEX encoding).
+ */
+#define DOT "(0|1|2|3|4|5|6|7|8|9|A|B|C|D|E|F)"
+
+
+static int
+test_iptoregex (const char *ipv4,
+                uint16_t port,
+                const char *expectedv4,
+                const char *ipv6,
+                uint16_t port6,
+                const char *expectedv6)
+{
+  int error = 0;
+
+  struct in_addr a;
+  struct in6_addr b;
+  char rxv4[GNUNET_TUN_IPV4_REGEXLEN];
+  char rxv6[GNUNET_TUN_IPV6_REGEXLEN];
+
+  GNUNET_assert (1 == inet_pton (AF_INET, ipv4, &a));
+  GNUNET_TUN_ipv4toregexsearch (&a, port, rxv4);
+
+  if (0 != strcmp (rxv4, expectedv4))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Expected: %s but got: %s\n",
+                expectedv4,
+                rxv4);
+    error++;
+  }
+
+  GNUNET_assert (1 == inet_pton (AF_INET6, ipv6, &b));
+  GNUNET_TUN_ipv6toregexsearch (&b, port6, rxv6);
+  if (0 != strcmp (rxv6, expectedv6))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Expected: %s but got: %s\n",
+                expectedv6, rxv6);
+    error++;
+  }
+  return error;
+}
+
+
+static int
+test_policy4toregex (const char *policy,
+                     const char *regex)
+{
+  char *r;
+  int ret;
+
+  ret = 0;
+  r = GNUNET_TUN_ipv4policy2regex (policy);
+  if (NULL == r)
+  {
+    GNUNET_break (0);
+    return 1;
+  }
+  if (0 != strcmp (regex, r))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Expected: `%s' but got: `%s'\n",
+                regex, r);
+    ret = 2;
+  }
+  GNUNET_free (r);
+  return ret;
+}
+
+
+static int
+test_policy6toregex (const char *policy,
+                     const char *regex)
+{
+  char *r;
+  int ret;
+
+  ret = 0;
+  r = GNUNET_TUN_ipv6policy2regex (policy);
+  if (NULL == r)
+  {
+    GNUNET_break (0);
+    return 1;
+  }
+  if (0 != strcmp (regex, r))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Expected: `%s' but got: `%s'\n",
+                regex, r);
+    ret = 2;
+  }
+  GNUNET_free (r);
+  return ret;
+}
+
+
+int
+main (int argc, char *argv[])
+{
+  int error;
+  char *r;
+
+  GNUNET_log_setup ("test-regex", "WARNING", NULL);
+  error = 0;
+
+  /* this is just a performance test ... */
+  r = GNUNET_TUN_ipv4policy2regex ("1.2.3.4/16:!25;");
+  GNUNET_break (NULL != r);
+  GNUNET_free (r);
+
+  error +=
+    test_iptoregex ("192.1.2.3", 2086,
+                    "4-0826-C0010203",
+                    "FFFF::1", 8080,
+                    "6-1F90-FFFF0000000000000000000000000001");
+  error +=
+    test_iptoregex ("187.238.255.0", 80,
+                    "4-0050-BBEEFF00",
+                    "E1E1:73F9:51BE::0", 49,
+                    "6-0031-E1E173F951BE00000000000000000000");
+  error +=
+    test_policy4toregex ("192.1.2.0/24:80;",
+                         "4-0050-C00102" DOT DOT);
+  error +=
+    test_policy4toregex ("192.1.0.0/16;",
+                         "4-" DOT DOT DOT DOT "-C001" DOT DOT DOT DOT);
+  error +=
+    test_policy4toregex ("192.1.0.0/16:80-81;",
+                         "4-(0050|0051)-C001" DOT DOT DOT DOT);
+  error +=
+    test_policy4toregex ("192.1.0.0/8:!3-65535;",
+                         "4-000(0|1|2)-C0" DOT DOT DOT DOT DOT DOT);
+  error +=
+    test_policy4toregex ("192.1.0.0/8:!25-56;",
+                         "4-(0(0(0"DOT"|1(0|1|2|3|4|5|6|7|8)|3(9|A|B|C|D|E|F)|(4|5|6|7|8|9|A|B|C|D|E|F)"DOT")|(1|2|3|4|5|6|7|8|9|A|B|C|D|E|F)"DOT DOT")|(1|2|3|4|5|6|7|8|9|A|B|C|D|E|F)"DOT DOT DOT")-C0"DOT DOT DOT DOT DOT DOT);
+  error +=
+    test_policy6toregex ("E1E1::1;",
+                         "6-"DOT DOT DOT DOT"-E1E10000000000000000000000000001");
+  error +=
+    test_policy6toregex ("E1E1:ABCD::1/120;",
+                         "6-"DOT DOT DOT DOT"-E1E1ABCD0000000000000000000000" DOT DOT);
+  error +=
+    test_policy6toregex ("E1E1:ABCD::ABCD/126;",
+                         "6-"DOT DOT DOT DOT"-E1E1ABCD00000000000000000000ABC(C|D|E|F)");
+  error +=
+    test_policy6toregex ("E1E1:ABCD::ABCD/127;",
+                         "6-"DOT DOT DOT DOT"-E1E1ABCD00000000000000000000ABC(C|D)");
+  error +=
+    test_policy6toregex ("E1E1:ABCD::ABCD/128:80;",
+                         "6-0050-E1E1ABCD00000000000000000000ABCD");
+  return error;
+}
diff --git a/src/util/test_tun.c b/src/util/test_tun.c
new file mode 100644
index 000000000..edbd4c05d
--- /dev/null
+++ b/src/util/test_tun.c
@@ -0,0 +1,72 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2010, 2011, 2012 Christian Grothoff
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+    
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+/**
+ * @file tun/test_tun.c
+ * @brief test for tun.c
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_tun_lib.h"
+
+static int ret;
+
+static void
+test_udp (size_t pll,
+          int pl_fill,
+          uint16_t crc)
+{
+  struct GNUNET_TUN_IPv4Header ip;
+  struct GNUNET_TUN_UdpHeader udp;
+  char payload[pll];
+  struct in_addr src;
+  struct in_addr dst;
+
+  GNUNET_assert (1 == inet_pton (AF_INET, "1.2.3.4", &src));
+  GNUNET_assert (1 == inet_pton (AF_INET, "122.2.3.5", &dst));
+  memset (payload, pl_fill, sizeof (payload));
+  GNUNET_TUN_initialize_ipv4_header (&ip,
+                                     IPPROTO_UDP,
+                                     pll + sizeof (udp),
+                                     &src,
+                                     &dst);
+  udp.source_port = htons (4242);
+  udp.destination_port = htons (4242);
+  udp.len = htons (pll);
+  GNUNET_TUN_calculate_udp4_checksum (&ip,
+                                      &udp,
+                                      payload,
+                                      pll);
+  if (crc != ntohs (udp.crc))
+  {
+    fprintf (stderr, "Got CRC: %u, wanted: %u\n",
+             ntohs (udp.crc),
+             crc);
+    ret = 1;
+  }
+}
+
+int main (int argc,
+          char **argv)
+{
+  test_udp (4, 3, 22439);
+  test_udp (4, 1, 23467);
+  test_udp (7, 17, 6516);
+  test_udp (12451, 251, 42771);
+  return ret;
+}
diff --git a/src/util/tun.c b/src/util/tun.c
new file mode 100644
index 000000000..25e729e58
--- /dev/null
+++ b/src/util/tun.c
@@ -0,0 +1,309 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2010, 2011, 2012 Christian Grothoff
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+/**
+ * @file tun/tun.c
+ * @brief standard IP calculations for TUN interaction
+ * @author Philipp Toelke
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+/**
+ * IP TTL we use for packets that we assemble (8 bit unsigned integer)
+ */
+#define FRESH_TTL 64
+
+
+/**
+ * Initialize an IPv4 header.
+ *
+ * @param ip header to initialize
+ * @param protocol protocol to use (i.e. IPPROTO_UDP)
+ * @param payload_length number of bytes of payload that follow (excluding IPv4 header)
+ * @param src source IP address to use
+ * @param dst destination IP address to use
+ */
+void
+GNUNET_TUN_initialize_ipv4_header (struct GNUNET_TUN_IPv4Header *ip,
+                                   uint8_t protocol,
+                                   uint16_t payload_length,
+                                   const struct in_addr *src,
+                                   const struct in_addr *dst)
+{
+  GNUNET_assert (20 == sizeof (struct GNUNET_TUN_IPv4Header));
+  GNUNET_assert (payload_length <= UINT16_MAX - sizeof (struct GNUNET_TUN_IPv4Header));
+  memset (ip, 0, sizeof (struct GNUNET_TUN_IPv4Header));
+  ip->header_length =  sizeof (struct GNUNET_TUN_IPv4Header) / 4;
+  ip->version = 4;
+  ip->total_length = htons (sizeof (struct GNUNET_TUN_IPv4Header) + payload_length);
+  ip->identification = (uint16_t) GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK,
+                                                            65536);
+  ip->ttl = FRESH_TTL;
+  ip->protocol = protocol;
+  ip->source_address = *src;
+  ip->destination_address = *dst;
+  ip->checksum = GNUNET_CRYPTO_crc16_n (ip, sizeof (struct GNUNET_TUN_IPv4Header));
+}
+
+
+/**
+ * Initialize an IPv6 header.
+ *
+ * @param ip header to initialize
+ * @param protocol protocol to use (i.e. IPPROTO_UDP), technically "next_header" for IPv6
+ * @param payload_length number of bytes of payload that follow (excluding IPv6 header)
+ * @param src source IP address to use
+ * @param dst destination IP address to use
+ */
+void
+GNUNET_TUN_initialize_ipv6_header (struct GNUNET_TUN_IPv6Header *ip,
+                                   uint8_t protocol,
+                                   uint16_t payload_length,
+                                   const struct in6_addr *src,
+                                   const struct in6_addr *dst)
+{
+  GNUNET_assert (40 == sizeof (struct GNUNET_TUN_IPv6Header));
+  GNUNET_assert (payload_length <= UINT16_MAX - sizeof (struct GNUNET_TUN_IPv6Header));
+  memset (ip, 0, sizeof (struct GNUNET_TUN_IPv6Header));
+  ip->version = 6;
+  ip->next_header = protocol;
+  ip->payload_length = htons ((uint16_t) payload_length);
+  ip->hop_limit = FRESH_TTL;
+  ip->destination_address = *dst;
+  ip->source_address = *src;
+}
+
+
+/**
+ * Calculate IPv4 TCP checksum.
+ *
+ * @param ip ipv4 header fully initialized
+ * @param tcp TCP header (initialized except for CRC)
+ * @param payload the TCP payload
+ * @param payload_length number of bytes of TCP payload
+ */
+void
+GNUNET_TUN_calculate_tcp4_checksum (const struct GNUNET_TUN_IPv4Header *ip,
+                                    struct GNUNET_TUN_TcpHeader *tcp,
+                                    const void *payload,
+                                    uint16_t payload_length)
+{
+  uint32_t sum;
+  uint16_t tmp;
+
+  GNUNET_assert (20 == sizeof (struct GNUNET_TUN_TcpHeader));
+  GNUNET_assert (payload_length + sizeof (struct GNUNET_TUN_IPv4Header) + sizeof (struct GNUNET_TUN_TcpHeader) ==
+                 ntohs (ip->total_length));
+  GNUNET_assert (IPPROTO_TCP == ip->protocol);
+
+  tcp->crc = 0;
+  sum = GNUNET_CRYPTO_crc16_step (0,
+                                  &ip->source_address,
+                                  sizeof (struct in_addr) * 2);
+  tmp = htons (IPPROTO_TCP);
+  sum = GNUNET_CRYPTO_crc16_step (sum, &tmp, sizeof (uint16_t));
+  tmp = htons (payload_length + sizeof (struct GNUNET_TUN_TcpHeader));
+  sum = GNUNET_CRYPTO_crc16_step (sum, &tmp, sizeof (uint16_t));
+  sum = GNUNET_CRYPTO_crc16_step (sum, tcp, sizeof (struct GNUNET_TUN_TcpHeader));
+  sum = GNUNET_CRYPTO_crc16_step (sum, payload, payload_length);
+  tcp->crc = GNUNET_CRYPTO_crc16_finish (sum);
+}
+
+
+/**
+ * Calculate IPv6 TCP checksum.
+ *
+ * @param ip ipv6 header fully initialized
+ * @param tcp header (initialized except for CRC)
+ * @param payload the TCP payload
+ * @param payload_length number of bytes of TCP payload
+ */
+void
+GNUNET_TUN_calculate_tcp6_checksum (const struct GNUNET_TUN_IPv6Header *ip,
+                                    struct GNUNET_TUN_TcpHeader *tcp,
+                                    const void *payload,
+                                    uint16_t payload_length)
+{
+  uint32_t sum;
+  uint32_t tmp;
+
+  GNUNET_assert (20 == sizeof (struct GNUNET_TUN_TcpHeader));
+  GNUNET_assert (payload_length + sizeof (struct GNUNET_TUN_TcpHeader) ==
+                 ntohs (ip->payload_length));
+  GNUNET_assert (IPPROTO_TCP == ip->next_header);
+  tcp->crc = 0;
+  sum = GNUNET_CRYPTO_crc16_step (0, &ip->source_address, 2 * sizeof (struct in6_addr));
+  tmp = htonl (sizeof (struct GNUNET_TUN_TcpHeader) + payload_length);
+  sum = GNUNET_CRYPTO_crc16_step (sum, &tmp, sizeof (uint32_t));
+  tmp = htonl (IPPROTO_TCP);
+  sum = GNUNET_CRYPTO_crc16_step (sum, &tmp, sizeof (uint32_t));
+  sum = GNUNET_CRYPTO_crc16_step (sum, tcp,
+                                  sizeof (struct GNUNET_TUN_TcpHeader));
+  sum = GNUNET_CRYPTO_crc16_step (sum, payload, payload_length);
+  tcp->crc = GNUNET_CRYPTO_crc16_finish (sum);
+}
+
+
+/**
+ * Calculate IPv4 UDP checksum.
+ *
+ * @param ip ipv4 header fully initialized
+ * @param udp UDP header (initialized except for CRC)
+ * @param payload the UDP payload
+ * @param payload_length number of bytes of UDP payload
+ */
+void
+GNUNET_TUN_calculate_udp4_checksum (const struct GNUNET_TUN_IPv4Header *ip,
+                                    struct GNUNET_TUN_UdpHeader *udp,
+                                    const void *payload,
+                                    uint16_t payload_length)
+{
+  uint32_t sum;
+  uint16_t tmp;
+
+  GNUNET_assert (8 == sizeof (struct GNUNET_TUN_UdpHeader));
+  GNUNET_assert (payload_length + sizeof (struct GNUNET_TUN_IPv4Header) + sizeof (struct GNUNET_TUN_UdpHeader) ==
+                 ntohs (ip->total_length));
+  GNUNET_assert (IPPROTO_UDP == ip->protocol);
+
+  udp->crc = 0; /* technically optional, but we calculate it anyway, just to be sure */
+  sum = GNUNET_CRYPTO_crc16_step (0,
+                                  &ip->source_address,
+                                  sizeof (struct in_addr) * 2);
+  tmp = htons (IPPROTO_UDP);
+  sum = GNUNET_CRYPTO_crc16_step (sum,
+                                  &tmp,
+                                  sizeof (uint16_t));
+  tmp = htons (sizeof (struct GNUNET_TUN_UdpHeader) + payload_length);
+  sum = GNUNET_CRYPTO_crc16_step (sum,
+                                  &tmp,
+                                  sizeof (uint16_t));
+  sum = GNUNET_CRYPTO_crc16_step (sum,
+                                  udp,
+                                  sizeof (struct GNUNET_TUN_UdpHeader));
+  sum = GNUNET_CRYPTO_crc16_step (sum,
+                                  payload,
+                                  payload_length);
+  udp->crc = GNUNET_CRYPTO_crc16_finish (sum);
+}
+
+
+/**
+ * Calculate IPv6 UDP checksum.
+ *
+ * @param ip ipv6 header fully initialized
+ * @param udp UDP header (initialized except for CRC)
+ * @param payload the UDP payload
+ * @param payload_length number of bytes of UDP payload
+ */
+void
+GNUNET_TUN_calculate_udp6_checksum (const struct GNUNET_TUN_IPv6Header *ip,
+                                    struct GNUNET_TUN_UdpHeader *udp,
+                                    const void *payload,
+                                    uint16_t payload_length)
+{
+  uint32_t sum;
+  uint32_t tmp;
+
+  GNUNET_assert (payload_length + sizeof (struct GNUNET_TUN_UdpHeader) ==
+                 ntohs (ip->payload_length));
+  GNUNET_assert (payload_length + sizeof (struct GNUNET_TUN_UdpHeader) ==
+                 ntohs (udp->len));
+  GNUNET_assert (IPPROTO_UDP == ip->next_header);
+
+  udp->crc = 0;
+  sum = GNUNET_CRYPTO_crc16_step (0,
+                                  &ip->source_address,
+                                  sizeof (struct in6_addr) * 2);
+  tmp = htons (sizeof (struct GNUNET_TUN_UdpHeader) + payload_length); /* aka udp->len */
+  sum = GNUNET_CRYPTO_crc16_step (sum, &tmp, sizeof (uint32_t));
+  tmp = htons (ip->next_header);
+  sum = GNUNET_CRYPTO_crc16_step (sum, &tmp, sizeof (uint32_t));
+  sum = GNUNET_CRYPTO_crc16_step (sum, udp, sizeof (struct GNUNET_TUN_UdpHeader));
+  sum = GNUNET_CRYPTO_crc16_step (sum, payload, payload_length);
+  udp->crc = GNUNET_CRYPTO_crc16_finish (sum);
+}
+
+
+/**
+ * Calculate ICMP checksum.
+ *
+ * @param icmp IMCP header (initialized except for CRC)
+ * @param payload the ICMP payload
+ * @param payload_length number of bytes of ICMP payload
+ */
+void
+GNUNET_TUN_calculate_icmp_checksum (struct GNUNET_TUN_IcmpHeader *icmp,
+                                    const void *payload,
+                                    uint16_t payload_length)
+{
+  uint32_t sum;
+
+  GNUNET_assert (8 == sizeof (struct GNUNET_TUN_IcmpHeader));
+  icmp->crc = 0;
+  sum = GNUNET_CRYPTO_crc16_step (0,
+                                  icmp,
+                                  sizeof (struct GNUNET_TUN_IcmpHeader));
+  sum = GNUNET_CRYPTO_crc16_step (sum, payload, payload_length);
+  icmp->crc = GNUNET_CRYPTO_crc16_finish (sum);
+}
+
+
+/**
+ * Check if two sockaddrs are equal.
+ *
+ * @param sa one address
+ * @param sb another address
+ * @param include_port also check ports
+ * @return #GNUNET_YES if they are equal
+ */
+int
+GNUNET_TUN_sockaddr_cmp (const struct sockaddr *sa,
+                         const struct sockaddr *sb,
+                         int include_port)
+{
+  if (sa->sa_family != sb->sa_family)
+    return GNUNET_NO;
+
+  switch (sa->sa_family)
+  {
+  case AF_INET:
+    {
+      const struct sockaddr_in *sa4 = (const struct sockaddr_in *) sa;
+      const struct sockaddr_in *sb4 = (const struct sockaddr_in *) sb;
+      return (sa4->sin_addr.s_addr == sb4->sin_addr.s_addr);
+    }
+  case AF_INET6:
+    {
+      const struct sockaddr_in6 *sa6 = (const struct sockaddr_in6 *) sa;
+      const struct sockaddr_in6 *sb6 = (const struct sockaddr_in6 *) sb;
+
+      return (0 == memcmp(&sa6->sin6_addr,
+                          &sb6->sin6_addr,
+                          sizeof (struct in6_addr)));
+    }
+  default:
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+}
+
+
+/* end of tun.c */