Merge branch 'master' of ssh://gnunet.org/gnunet

61 files changed, 1531 insertions, 333 deletions

diff --git a/src/Makefile.am b/src/Makefile.am
index d8a869acb..564923e28 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -45,6 +45,10 @@ if HAVE_POSTGRESQL
  POSTGRES_DIR = pq
 endif
 
+if HAVE_NOLIBGCRYPT19
+  SCALARPRODUCT_DIR = scalarproduct
+endif
+
 REST_DIR = rest
 
 
@@ -93,7 +97,7 @@ SUBDIRS = \
   seti \
   setu \
   consensus \
-  scalarproduct \
+  $(SCALARPRODUCT_DIR) \
   revocation \
   vpn \
   gns \
diff --git a/src/arm/arm_api.c b/src/arm/arm_api.c
index 899b6f152..2ec913a0a 100644
--- a/src/arm/arm_api.c
+++ b/src/arm/arm_api.c
@@ -951,7 +951,8 @@ GNUNET_ARM_request_service_start (struct GNUNET_ARM_Handle *h,
    * 2) We're not connected to ARM.
    *    Cancel any reconnection attempts temporarily, then perform
    *    a service test.
-   */if (GNUNET_YES == h->currently_up)
+   */
+  if (GNUNET_YES == h->currently_up)
   {
     LOG (GNUNET_ERROR_TYPE_DEBUG,
          "ARM is already running\n");
@@ -970,7 +971,8 @@ GNUNET_ARM_request_service_start (struct GNUNET_ARM_Handle *h,
      yet complete the MQ handshake.  However, given that users
      are unlikely to hammer 'gnunet-arm -s' on a busy system,
      the above check should catch 99.99% of the cases where ARM
-     is already running. */LOG (GNUNET_ERROR_TYPE_DEBUG,
+     is already running. */
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
        "Starting ARM service\n");
   if (NULL == (sig = GNUNET_DISK_pipe (GNUNET_DISK_PF_NONE)))
   {
@@ -1003,13 +1005,13 @@ GNUNET_ARM_request_service_start (struct GNUNET_ARM_Handle *h,
                                                 op->rfd,
                                                 &notify_starting,
                                                 op);
+    GNUNET_DISK_pipe_close (sig);
   }
   else
   {
     op->async = GNUNET_SCHEDULER_add_now (&notify_starting,
                                           op);
   }
-  GNUNET_DISK_pipe_close (sig);
   return op;
 }
 
diff --git a/src/cadet/gnunet-service-cadet.c b/src/cadet/gnunet-service-cadet.c
index 2d3b548dd..c8d69e43d 100644
--- a/src/cadet/gnunet-service-cadet.c
+++ b/src/cadet/gnunet-service-cadet.c
@@ -1027,7 +1027,8 @@ handle_drop_message (void *cls,
   ch = lookup_channel (c,
                        message->ccn);
 
-  GCCH_assign_type_to_drop (ch, message);
+  if (NULL != ch)
+    GCCH_assign_type_to_drop (ch, message);
 
   GNUNET_SERVICE_client_continue (c->client);
 }
diff --git a/src/cadet/gnunet-service-cadet_channel.c b/src/cadet/gnunet-service-cadet_channel.c
index 6b22ae2b4..ae5d9210f 100644
--- a/src/cadet/gnunet-service-cadet_channel.c
+++ b/src/cadet/gnunet-service-cadet_channel.c
@@ -1858,6 +1858,7 @@ GCCH_handle_local_data (struct CadetChannel *ch,
     }
     else
     {
+      GNUNET_free (env);
       GNUNET_break (0);
       return GNUNET_SYSERR;
     }
diff --git a/src/gns/Makefile.am b/src/gns/Makefile.am
index 9f03311e1..3aaa734f2 100644
--- a/src/gns/Makefile.am
+++ b/src/gns/Makefile.am
@@ -80,9 +80,7 @@ bin_PROGRAMS = \
 noinst_PROGRAMS = \
   gnunet-gns-benchmark
 
-if LINUX
 bin_PROGRAMS += gnunet-bcd
-endif
 
 REST_PLUGIN = libgnunet_plugin_rest_gns.la
 
@@ -156,6 +154,7 @@ gnunet_bcd_SOURCES = \
  gnunet-bcd.c
 gnunet_bcd_LDADD = \
   $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/identity/libgnunetidentity.la \
   $(GN_LIBINTL) $(MHD_LIBS)
 gnunet_bcd_CFLAGS = $(MHD_CFLAGS) $(AM_CFLAGS)
 
diff --git a/src/gns/gnunet-bcd.c b/src/gns/gnunet-bcd.c
index f71f477ef..a2e94089c 100644
--- a/src/gns/gnunet-bcd.c
+++ b/src/gns/gnunet-bcd.c
@@ -27,6 +27,7 @@
 #include "platform.h"
 #include <microhttpd.h>
 #include "gnunet_util_lib.h"
+#include "gnunet_identity_service.h"
 #include "gnunet_mhd_compat.h"
 
 /**
@@ -148,7 +149,7 @@ access_handler_callback (void *cls,
     char *p;
     char *tmp;
     char *deffile;
-    struct GNUNET_CRYPTO_EcdsaPublicKey pub;
+    struct GNUNET_IDENTITY_PublicKey pub;
     size_t slen;
     FILE *f;
     struct stat st;
@@ -166,9 +167,8 @@ access_handler_callback (void *cls,
       MHD_lookup_connection_value (connection, MHD_GET_ARGUMENT_KIND, "gnskey");
     if ((NULL == gnskey) ||
         (GNUNET_OK !=
-         GNUNET_CRYPTO_ecdsa_public_key_from_string (gnskey,
-                                                     strlen (gnskey),
-                                                     &pub)))
+         GNUNET_IDENTITY_public_key_from_string (gnskey,
+                                                 &pub)))
     {
       return MHD_queue_response (connection,
                                  MHD_HTTP_OK,
@@ -218,10 +218,10 @@ access_handler_callback (void *cls,
              (NULL == gns_nick) ? "" : gns_nick);
     fclose (f);
     GNUNET_asprintf (
-      &p,
-      "cd %s; cp %s gns-bcd.tex | pdflatex --enable-write18 gns-bcd.tex > /dev/null 2> /dev/null",
-      tmp,
-      resfile);
+                     &p,
+                     "cd %s; cp %s gns-bcd.tex | pdflatex --enable-write18 gns-bcd.tex > /dev/null 2> /dev/null",
+                     tmp,
+                     resfile);
     GNUNET_free (deffile);
     ret = system (p);
     if (WIFSIGNALED (ret) || (0 != WEXITSTATUS (ret)))
@@ -506,7 +506,7 @@ main (int argc, char *const *argv)
                                  "port",
                                  "PORT",
                                  gettext_noop (
-                                   "Run HTTP serve on port PORT (default is 8888)"),
+                                               "Run HTTP serve on port PORT (default is 8888)"),
                                  &port),
     GNUNET_GETOPT_OPTION_END
   };
@@ -523,8 +523,8 @@ main (int argc, char *const *argv)
                              options,
                              &run,
                              NULL))
-        ? 0
-        : 1;
+    ? 0
+    : 1;
   GNUNET_free_nz ((void *) argv);
   return ret;
 }
diff --git a/src/gns/gnunet-dns2gns.c b/src/gns/gnunet-dns2gns.c
index 0a9b7c861..06f4c9841 100644
--- a/src/gns/gnunet-dns2gns.c
+++ b/src/gns/gnunet-dns2gns.c
@@ -309,6 +309,14 @@ dns_result_processor (void *cls,
   }
   request->packet = GNUNET_DNSPARSER_parse ((char *) dns,
                                             r);
+  if (NULL == request->packet)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                _ ("Failed to parse DNS response!\n"));
+    GNUNET_SCHEDULER_cancel (request->timeout_task);
+    do_timeout (request);
+    return;
+  }
   GNUNET_DNSSTUB_resolve_cancel (request->dns_lookup);
   send_response (request);
 }
diff --git a/src/gns/gnunet-gns-proxy.c b/src/gns/gnunet-gns-proxy.c
index 833a8da01..d02f0f576 100644
--- a/src/gns/gnunet-gns-proxy.c
+++ b/src/gns/gnunet-gns-proxy.c
@@ -1841,6 +1841,7 @@ create_response (void *cls,
   char *curlurl;
   char ipstring[INET6_ADDRSTRLEN];
   char ipaddr[INET6_ADDRSTRLEN + 2];
+  char *curl_hosts;
   const struct sockaddr *sa;
   const struct sockaddr_in *s4;
   const struct sockaddr_in6 *s6;
@@ -1900,6 +1901,14 @@ create_response (void *cls,
         GNUNET_break (0);
         return MHD_NO;
       }
+      GNUNET_asprintf (&curl_hosts,
+                       "%s:%d:%s",
+                       s5r->leho,
+                       port,
+                       ipaddr);
+      s5r->hosts = curl_slist_append (NULL,
+                                      curl_hosts);
+      GNUNET_free (curl_hosts);
     }
     else
     {
@@ -1949,21 +1958,13 @@ create_response (void *cls,
      * Pre-populate cache to resolve Hostname.
      * This is necessary as the DNS name in the CURLOPT_URL is used
      * for SNI http://de.wikipedia.org/wiki/Server_Name_Indication
-     */if (NULL != s5r->leho)
+     */
+    if ((NULL != s5r->leho) &&
+        (NULL != s5r->hosts))
     {
-      char *curl_hosts;
-
-      GNUNET_asprintf (&curl_hosts,
-                       "%s:%d:%s",
-                       s5r->leho,
-                       port,
-                       ipaddr);
-      s5r->hosts = curl_slist_append (NULL,
-                                      curl_hosts);
       curl_easy_setopt (s5r->curl,
                         CURLOPT_RESOLVE,
                         s5r->hosts);
-      GNUNET_free (curl_hosts);
     }
     if (s5r->is_gns)
     {
diff --git a/src/gns/gnunet-service-gns_interceptor.c b/src/gns/gnunet-service-gns_interceptor.c
index b53f4af6b..255f85598 100644
--- a/src/gns/gnunet-service-gns_interceptor.c
+++ b/src/gns/gnunet-service-gns_interceptor.c
@@ -323,7 +323,6 @@ handle_dns_request (void *cls,
     GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                 "Received malformed DNS packet, leaving it untouched.\n");
     GNUNET_DNS_request_forward (rh);
-    GNUNET_DNSPARSER_free_packet (p);
     return;
   }
 
diff --git a/src/gns/gnunet-service-gns_resolver.c b/src/gns/gnunet-service-gns_resolver.c
index 49c1b340a..2f8a55804 100644
--- a/src/gns/gnunet-service-gns_resolver.c
+++ b/src/gns/gnunet-service-gns_resolver.c
@@ -764,6 +764,7 @@ transmit_lookup_dns_result (struct GNS_ResolverHandle *rh)
       rd[i].data = pos->data;
       rd[i].data_size = pos->data_size;
       rd[i].record_type = pos->record_type;
+      rd[i].flags = GNUNET_GNSRECORD_RF_NONE;
       /**
        * If this is a LEHO, we added this before. It must be a supplemental
        * record #LSD0001
@@ -772,12 +773,11 @@ transmit_lookup_dns_result (struct GNS_ResolverHandle *rh)
         rd[i].flags |= GNUNET_GNSRECORD_RF_SUPPLEMENTAL;
       if (0 == pos->expiration_time)
       {
-        rd[i].flags = GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION;
+        rd[i].flags |= GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION;
         rd[i].expiration_time = 0;
       }
       else
       {
-        rd[i].flags = GNUNET_GNSRECORD_RF_NONE;
         rd[i].expiration_time = pos->expiration_time;
       }
       i++;
@@ -1764,6 +1764,8 @@ recursive_gns2dns_resolution (struct GNS_ResolverHandle *rh,
       /**
        * Records other than GNS2DNS not allowed
        */
+      if (NULL != ns)
+        GNUNET_free (ns);
       return GNUNET_SYSERR;
     }
     off = 0;
@@ -1771,15 +1773,22 @@ recursive_gns2dns_resolution (struct GNS_ResolverHandle *rh,
                                      rd[i].data_size,
                                      &off);
     ip = GNUNET_strdup (&((const char *) rd[i].data)[off]);
+    if ((NULL == n) ||
+        (NULL == ip))
+    {
+      GNUNET_break_op (0);
+      if (NULL != n)
+        GNUNET_free (n);
+      if (NULL != ip)
+        GNUNET_free (ip);
+      continue;
+    }
+
     off += strlen (ip) + 1;
 
-    if ((NULL == n) ||
-        (NULL == ip) ||
-        (off != rd[i].data_size))
+    if (off != rd[i].data_size)
     {
       GNUNET_break_op (0);
-      GNUNET_free (n);
-      GNUNET_free (ip);
       continue;
     }
     /* resolve 'ip' to determine the IP(s) of the DNS
@@ -1909,6 +1918,8 @@ recursive_gns2dns_resolution (struct GNS_ResolverHandle *rh,
       GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                   _ ("Name `%s' cannot be converted to IDNA."),
                   tmp);
+      GNUNET_free (tmp);
+      GNUNET_free (ac);
       return GNUNET_SYSERR;
     }
     GNUNET_free (tmp);
@@ -1922,6 +1933,8 @@ recursive_gns2dns_resolution (struct GNS_ResolverHandle *rh,
     GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                 _ ("GNS lookup resulted in DNS name that is too long (`%s')\n"),
                 ac->label);
+    GNUNET_free (ac->label);
+    GNUNET_free (ac);
     return GNUNET_SYSERR;
   }
   continue_with_gns2dns (ac);
diff --git a/src/gns/plugin_rest_gns.c b/src/gns/plugin_rest_gns.c
index 2ccb5be2b..3a35c9999 100644
--- a/src/gns/plugin_rest_gns.c
+++ b/src/gns/plugin_rest_gns.c
@@ -270,7 +270,9 @@ handle_gns_response (void *cls,
   result = json_dumps (result_obj, 0);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Result %s\n", result);
   resp = GNUNET_REST_create_response (result);
-  MHD_add_response_header (resp, "Content-Type", "application/json");
+  GNUNET_assert (MHD_NO != MHD_add_response_header (resp,
+                                                    "Content-Type",
+                                                    "application/json"));
   handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
   GNUNET_free (result);
   json_decref (result_obj);
diff --git a/src/gnsrecord/gnsrecord_misc.c b/src/gnsrecord/gnsrecord_misc.c
index 82c38f19a..b907eed27 100644
--- a/src/gnsrecord/gnsrecord_misc.c
+++ b/src/gnsrecord/gnsrecord_misc.c
@@ -296,15 +296,20 @@ GNUNET_GNSRECORD_data_from_identity (const struct
                                      size_t *data_size,
                                      uint32_t *type)
 {
+  char *tmp;
   *type = ntohl (key->type);
   *data_size = GNUNET_IDENTITY_key_get_length (key);
   if (0 == *data_size)
     return GNUNET_SYSERR;
-  *data = GNUNET_malloc (*data_size);
-  return (GNUNET_IDENTITY_write_key_to_buffer (key, *data, *data_size) ==
-          *data_size?
-          GNUNET_OK :
-          GNUNET_SYSERR);
+  tmp = GNUNET_malloc (*data_size);
+  if (GNUNET_IDENTITY_write_key_to_buffer (key, tmp, *data_size)
+      != *data_size) {
+    GNUNET_free (tmp);
+    *data_size = 0;
+    return GNUNET_SYSERR;
+  }
+  *data = tmp;
+  return GNUNET_OK;
 }
 
 
@@ -350,7 +355,7 @@ GNUNET_GNSRECORD_block_get_expiration (const struct
   case GNUNET_GNSRECORD_TYPE_PKEY:
     return GNUNET_TIME_absolute_ntoh (block->ecdsa_block.expiration_time);
   default:
-    return GNUNET_TIME_absolute_get_zero_ ();
+    GNUNET_break (0); /* Hopefully we never get here, but we might */
   }
   return GNUNET_TIME_absolute_get_zero_ ();
 
diff --git a/src/gnsrecord/gnunet-gnsrecord-tvg.c b/src/gnsrecord/gnunet-gnsrecord-tvg.c
index 47b13bdab..d6b35544c 100644
--- a/src/gnsrecord/gnunet-gnsrecord-tvg.c
+++ b/src/gnsrecord/gnunet-gnsrecord-tvg.c
@@ -172,7 +172,7 @@ run (void *cls,
   fprintf (stdout, "RRBLOCK:\n");
   print_bytes (rrblock, block_size, 8);
   fprintf (stdout, "\n");
-
+  GNUNET_free (rdata);
 }
 
 
diff --git a/src/include/gnunet_testbed_ng_service.h b/src/include/gnunet_testbed_ng_service.h
new file mode 100644
index 000000000..a6f30889f
--- /dev/null
+++ b/src/include/gnunet_testbed_ng_service.h
@@ -0,0 +1,247 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2021 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @author t3sserakt
+ *
+ * @file
+ * API for writing tests and creating large-scale emulation testbeds for GNUnet with command pattern.
+ *
+ * @defgroup testbed  Testbed service
+ * Writing tests and creating large-scale emulation testbeds for GNUnet with command pattern.
+ *
+ * @see [Documentation](https://docs.gnunet.org/handbook/gnunet.html#TESTBED-NG-Subsystem)
+ *
+ * @{
+ */
+
+#ifndef GNUNET_TESTBED_NG_SERVICE_H
+#define GNUNET_TESTBED_NG_SERVICE_H
+
+#include "gnunet_util_lib.h"
+#include "gnunet_testing_ng_lib.h"
+
+struct ServiceState
+{
+  /**
+   * Handle to operation
+   */
+  struct GNUNET_TESTBED_Operation *operation;
+
+  /**
+   * Flag indicating if service is ready.
+   */
+  int service_ready;
+
+  /**
+   * Abort task identifier
+   */
+  struct GNUNET_SCHEDULER_Task *abort_task;
+
+  /**
+   * Label of peer command.
+   */
+  const char *peer_label;
+
+  /**
+   * Name of service to start.
+   */
+  const char *servicename;
+};
+
+struct PeerCmdState
+{
+  /**
+   * The label of a controller command.
+   */
+  const char *controller_label;
+
+  /**
+   * Handle to operation
+   */
+  struct GNUNET_TESTBED_Operation *operation;
+
+  /**
+   * Name of the host, use "NULL" for localhost.
+   */
+  const char *hostname;
+
+  /**
+   * Username to use for the login; may be NULL.
+   */
+  const char *username;
+
+  /**
+   * Port number to use for ssh; use 0 to let ssh decide.
+   */
+  uint16_t port;
+
+  /**
+   * The configuration to use as a template while starting a controller
+   * on this host.  Operation queue sizes specific to a host are also
+   * read from this configuration handle.
+   */
+  struct GNUNET_CONFIGURATION_Handle *cfg;
+
+  /**
+   * The host to run peers and controllers on
+   */
+  struct GNUNET_TESTBED_Host *host;
+
+  /**
+   * Abort task identifier
+   */
+  struct GNUNET_SCHEDULER_Task *abort_task;
+
+  /**
+   * Handle for host registration
+   */
+  struct GNUNET_TESTBED_HostRegistrationHandle *reg_handle;
+
+  /**
+   * Flag indicating if peer is ready.
+   */
+  int peer_ready;
+
+  /**
+   * Flag indicating controller is going down.
+   */
+  int peer_going_down;
+
+  /**
+   * Interpreter state.
+   */
+  struct GNUNET_TESTING_Interpreter *is;
+
+  /**
+   * Peer to start
+   */
+  struct GNUNET_TESTBED_Peer *peer;
+};
+
+struct ControllerState
+{
+  /**
+   * The ip address of the controller which will be set as TRUSTED
+   * HOST(all connections form this ip are permitted by the testbed) when
+   * starting testbed controller at host. This can either be a single ip
+   * address or a network address in CIDR notation.
+   */
+  const char *trusted_ip;
+
+  /**
+   * Name of the host, use "NULL" for localhost.
+   */
+  const char *hostname;
+
+  /**
+   * Username to use for the login; may be NULL.
+   */
+  const char *username;
+
+  /**
+   * Port number to use for ssh; use 0 to let ssh decide.
+   */
+  uint16_t port;
+
+  /**
+   * The configuration to use as a template while starting a controller
+   * on this host.  Operation queue sizes specific to a host are also
+   * read from this configuration handle.
+   */
+  struct GNUNET_CONFIGURATION_Handle *cfg;
+
+  /**
+   * The host to run peers and controllers on
+   */
+  struct GNUNET_TESTBED_Host *host;
+
+  /**
+   * The controller process
+   */
+  struct GNUNET_TESTBED_ControllerProc *cp;
+
+  /**
+   * The controller handle
+   */
+  struct GNUNET_TESTBED_Controller *controller;
+
+  /**
+   * A bit mask with set of events to call the controller for.
+   */
+  uint64_t event_mask;
+
+  /**
+   * Abort task identifier
+   */
+  struct GNUNET_SCHEDULER_Task *abort_task;
+
+  /**
+   * Handle for host registration
+   */
+  struct GNUNET_TESTBED_HostRegistrationHandle *reg_handle;
+
+  /**
+   * Flag indicating if host create with controller is ready.
+   */
+  int host_ready;
+
+  /**
+   * Flag indicating controller is going down.
+   */
+  int controller_going_down;
+
+  /**
+   * Interpreter state.
+   */
+  struct GNUNET_TESTING_Interpreter *is;
+};
+
+/**
+ * Offer data from trait
+ *
+ * @param cmd command to extract the controller from.
+ * @param pt pointer to controller.
+ * @return #GNUNET_OK on success.
+ */
+int
+GNUNET_TESTBED_get_trait_controller (const struct GNUNET_TESTING_Command *cmd,
+                                     struct GNUNET_TESTBED_Controller **
+                                     controller);
+
+struct GNUNET_TESTING_Command
+GNUNET_TESTBED_cmd_controller (const char *label,
+                               const char *trusted_ip,
+                               const char *hostname,
+                               const char *username,
+                               uint16_t port,
+                               struct GNUNET_CONFIGURATION_Handle *cfg,
+                               uint64_t event_mask);
+
+void
+GNUNET_TESTBED_shutdown_controller (struct ControllerState *cs);
+
+void
+GNUNET_TESTBED_shutdown_peer (struct PeerCmdState *ps);
+
+void
+GNUNET_TESTBED_shutdown_service (struct ServiceState *ss);
+
+#endif
diff --git a/src/include/gnunet_testbed_service.h b/src/include/gnunet_testbed_service.h
index 70cbfa90d..acdfb2034 100644
--- a/src/include/gnunet_testbed_service.h
+++ b/src/include/gnunet_testbed_service.h
@@ -27,7 +27,7 @@
  * @defgroup testbed  Testbed service
  * Writing tests and creating large-scale emulation testbeds for GNUnet.
  *
- * @see [Documentation](https://gnunet.org/gnunet-testbed-subsystem)
+ * @see [Documentation](https://docs.gnunet.org/handbook/gnunet.html#TESTBED-Subsystem)
  *
  * @{
  */
diff --git a/src/messenger/Makefile.am b/src/messenger/Makefile.am
index 1ebfbe5ed..2bb9ad922 100644
--- a/src/messenger/Makefile.am
+++ b/src/messenger/Makefile.am
@@ -25,35 +25,23 @@ bin_PROGRAMS = \
  gnunet-messenger
 
 lib_LTLIBRARIES = \
-  libgnunetmessenger_common.la \
   libgnunetmessenger.la \
   $(EXP_LIB)
 
-libgnunetmessenger_common_la_SOURCES = \
+libgnunetmessenger_la_SOURCES = \
+  messenger_api.c \
   messenger_api_ego.h \
   messenger_api_contact.c messenger_api_contact.h \
   messenger_api_contact_store.c messenger_api_contact_store.h \
   messenger_api_message.c messenger_api_message.h \
   messenger_api_list_tunnels.c messenger_api_list_tunnels.h \
-  messenger_api_util.c messenger_api_util.h
-libgnunetmessenger_common_la_LIBADD = \
-  $(top_builddir)/src/util/libgnunetutil.la \
-  $(top_builddir)/src/cadet/libgnunetcadet.la \
-  $(top_builddir)/src/identity/libgnunetidentity.la \
-  $(XLIB) \
-  $(LTLIBINTL)
-libgnunetmessenger_common_la_LDFLAGS = \
-  $(GN_LIB_LDFLAGS)  \
-  -version-info 0:0:0
-
-libgnunetmessenger_la_SOURCES = \
-  messenger_api.c \
+  messenger_api_util.c messenger_api_util.h \
   messenger_api_handle.c messenger_api_handle.h \
   messenger_api_room.c messenger_api_room.h
 libgnunetmessenger_la_LIBADD = \
   $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/cadet/libgnunetcadet.la \
   $(top_builddir)/src/identity/libgnunetidentity.la \
-  libgnunetmessenger_common.la \
   $(XLIB) \
   $(LTLIBINTL)
 libgnunetmessenger_la_LDFLAGS = \
@@ -63,10 +51,8 @@ libgnunetmessenger_la_LDFLAGS = \
 gnunet_messenger_SOURCES = \
  gnunet-messenger.c
 gnunet_messenger_LDADD = \
- libgnunetmessenger_common.la \
  libgnunetmessenger.la \
- $(top_builddir)/src/util/libgnunetutil.la \
- $(top_builddir)/src/identity/libgnunetidentity.la
+ $(top_builddir)/src/util/libgnunetutil.la
 gnunet_messenger_LDFLAGS = \
   $(GN_LIBINTL)
 
@@ -91,11 +77,10 @@ gnunet_service_messenger_SOURCES = \
   gnunet-service-messenger_room.c gnunet-service-messenger_room.h \
   gnunet-service-messenger_tunnel.c gnunet-service-messenger_tunnel.h
 gnunet_service_messenger_LDADD = \
+  libgnunetmessenger.la \
   $(top_builddir)/src/util/libgnunetutil.la \
   $(top_builddir)/src/cadet/libgnunetcadet.la \
   $(top_builddir)/src/identity/libgnunetidentity.la \
-  libgnunetmessenger_common.la \
-  libgnunetmessenger.la \
   $(GN_LIBINTL)
 
 check_PROGRAMS = \
@@ -121,7 +106,6 @@ endif
 test_messenger_api_SOURCES = \
   test_messenger.c
 test_messenger_api_LDADD = \
-  libgnunetmessenger_common.la \
   libgnunetmessenger.la \
   $(top_builddir)/src/testing/libgnunettesting.la \
   $(top_builddir)/src/util/libgnunetutil.la
@@ -129,7 +113,6 @@ test_messenger_api_LDADD = \
 test_messenger_anonymous_SOURCES = \
   test_messenger_anonymous.c
 test_messenger_anonymous_LDADD = \
-  libgnunetmessenger_common.la \
   libgnunetmessenger.la \
   $(top_builddir)/src/testing/libgnunettesting.la \
   $(top_builddir)/src/util/libgnunetutil.la
@@ -139,7 +122,6 @@ test_messenger_sync_client_SOURCES = \
   testing_messenger_barrier.c testing_messenger_barrier.h \
   testing_messenger_setup.c testing_messenger_setup.h
 test_messenger_sync_client_LDADD = \
-  libgnunetmessenger_common.la \
   libgnunetmessenger.la \
   $(top_builddir)/src/testbed/libgnunettestbed.la \
   $(top_builddir)/src/testing/libgnunettesting.la \
@@ -150,7 +132,6 @@ test_messenger_async_client_SOURCES = \
   testing_messenger_barrier.c testing_messenger_barrier.h \
   testing_messenger_setup.c testing_messenger_setup.h
 test_messenger_async_client_LDADD = \
-  libgnunetmessenger_common.la \
   libgnunetmessenger.la \
   $(top_builddir)/src/testbed/libgnunettestbed.la \
   $(top_builddir)/src/testing/libgnunettesting.la \
@@ -161,7 +142,6 @@ test_messenger_worst_client_SOURCES = \
   testing_messenger_barrier.c testing_messenger_barrier.h \
   testing_messenger_setup.c testing_messenger_setup.h
 test_messenger_worst_client_LDADD = \
-  libgnunetmessenger_common.la \
   libgnunetmessenger.la \
   $(top_builddir)/src/testbed/libgnunettestbed.la \
   $(top_builddir)/src/testing/libgnunettesting.la \
@@ -172,7 +152,6 @@ test_messenger_sync_p2p_SOURCES = \
   testing_messenger_barrier.c testing_messenger_barrier.h \
   testing_messenger_setup.c testing_messenger_setup.h
 test_messenger_sync_p2p_LDADD = \
-  libgnunetmessenger_common.la \
   libgnunetmessenger.la \
   $(top_builddir)/src/testbed/libgnunettestbed.la \
   $(top_builddir)/src/testing/libgnunettesting.la \
@@ -183,7 +162,6 @@ test_messenger_async_p2p_SOURCES = \
   testing_messenger_barrier.c testing_messenger_barrier.h \
   testing_messenger_setup.c testing_messenger_setup.h
 test_messenger_async_p2p_LDADD = \
-  libgnunetmessenger_common.la \
   libgnunetmessenger.la \
   $(top_builddir)/src/testbed/libgnunettestbed.la \
   $(top_builddir)/src/testing/libgnunettesting.la \
@@ -194,7 +172,6 @@ test_messenger_worst_p2p_SOURCES = \
   testing_messenger_barrier.c testing_messenger_barrier.h \
   testing_messenger_setup.c testing_messenger_setup.h
 test_messenger_worst_p2p_LDADD = \
-  libgnunetmessenger_common.la \
   libgnunetmessenger.la \
   $(top_builddir)/src/testbed/libgnunettestbed.la \
   $(top_builddir)/src/testing/libgnunettesting.la \
@@ -205,7 +182,6 @@ test_messenger_server_SOURCES = \
   testing_messenger_barrier.c testing_messenger_barrier.h \
   testing_messenger_setup.c testing_messenger_setup.h
 test_messenger_server_LDADD = \
-  libgnunetmessenger_common.la \
   libgnunetmessenger.la \
   $(top_builddir)/src/testbed/libgnunettestbed.la \
   $(top_builddir)/src/testing/libgnunettesting.la \
@@ -216,7 +192,6 @@ test_messenger_growth_SOURCES = \
   testing_messenger_barrier.c testing_messenger_barrier.h \
   testing_messenger_setup.c testing_messenger_setup.h
 test_messenger_growth_LDADD = \
-  libgnunetmessenger_common.la \
   libgnunetmessenger.la \
   $(top_builddir)/src/testbed/libgnunettestbed.la \
   $(top_builddir)/src/testing/libgnunettesting.la \
@@ -227,7 +202,6 @@ test_messenger_ring_SOURCES = \
   testing_messenger_barrier.c testing_messenger_barrier.h \
   testing_messenger_setup.c testing_messenger_setup.h
 test_messenger_ring_LDADD = \
-  libgnunetmessenger_common.la \
   libgnunetmessenger.la \
   $(top_builddir)/src/testbed/libgnunettestbed.la \
   $(top_builddir)/src/testing/libgnunettesting.la \
@@ -238,7 +212,6 @@ test_messenger_adapt_SOURCES = \
   testing_messenger_barrier.c testing_messenger_barrier.h \
   testing_messenger_setup.c testing_messenger_setup.h
 test_messenger_adapt_LDADD = \
-  libgnunetmessenger_common.la \
   libgnunetmessenger.la \
   $(top_builddir)/src/testbed/libgnunettestbed.la \
   $(top_builddir)/src/testing/libgnunettesting.la \
diff --git a/src/messenger/gnunet-messenger.c b/src/messenger/gnunet-messenger.c
index 737bb83c8..094ae398d 100644..100755
--- a/src/messenger/gnunet-messenger.c
+++ b/src/messenger/gnunet-messenger.c
@@ -229,18 +229,12 @@ on_identity (void *cls, struct GNUNET_MESSENGER_Handle *handle)
   if (room_key)
     GNUNET_CRYPTO_hash (room_key, strlen (room_key), &key);
 
+  struct GNUNET_PeerIdentity door_peer;
   struct GNUNET_PeerIdentity *door = NULL;
 
-  if (door_id)
-  {
-    door = GNUNET_new(struct GNUNET_PeerIdentity);
-
-    if (GNUNET_OK != GNUNET_CRYPTO_eddsa_public_key_from_string (door_id, strlen (door_id), &(door->public_key)))
-    {
-      GNUNET_free(door);
-      door = NULL;
-    }
-  }
+  if ((door_id) &&
+      (GNUNET_OK == GNUNET_CRYPTO_eddsa_public_key_from_string (door_id, strlen (door_id), &(door_peer.public_key))))
+    door = &door_peer;
 
   const char *name = GNUNET_MESSENGER_get_name (handle);
 
diff --git a/src/messenger/gnunet-service-messenger.c b/src/messenger/gnunet-service-messenger.c
index 187b65ed5..76fb31d95 100644..100755
--- a/src/messenger/gnunet-service-messenger.c
+++ b/src/messenger/gnunet-service-messenger.c
@@ -191,7 +191,7 @@ check_send_message (void *cls, const struct GNUNET_MESSENGER_SendMessage *msg)
   const uint16_t length = full_length - sizeof(*msg);
   const char *buffer = ((const char*) msg) + sizeof(*msg);
 
-  uint16_t key_length = 0;
+  ssize_t key_length = 0;
 
   if (!(flags & GNUNET_MESSENGER_FLAG_PRIVATE))
     goto check_for_message;
@@ -231,7 +231,7 @@ handle_send_message (void *cls, const struct GNUNET_MESSENGER_SendMessage *msg)
   const char *buffer = ((const char*) msg) + sizeof(*msg);
 
   const uint16_t length = ntohs (msg->header.size) - sizeof(*msg);
-  uint16_t key_length = 0;
+  ssize_t key_length = 0;
 
   struct GNUNET_IDENTITY_PublicKey public_key;
 
diff --git a/src/messenger/gnunet-service-messenger_member.c b/src/messenger/gnunet-service-messenger_member.c
index 6e39cec13..7f00e8438 100644..100755
--- a/src/messenger/gnunet-service-messenger_member.c
+++ b/src/messenger/gnunet-service-messenger_member.c
@@ -335,7 +335,11 @@ add_member_session (struct GNUNET_MESSENGER_Member *member, struct GNUNET_MESSEN
   struct GNUNET_HashCode hash;
   GNUNET_CRYPTO_hash(public_key, sizeof(*public_key), &hash);
 
-  GNUNET_CONTAINER_multihashmap_put(member->sessions, &hash, session, GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_FAST);
+  if (GNUNET_OK != GNUNET_CONTAINER_multihashmap_put(
+      member->sessions, &hash, session,
+      GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_FAST))
+    GNUNET_log(GNUNET_ERROR_TYPE_WARNING, "Adding a member session failed: %s\n",
+               GNUNET_h2s(&hash));
 }
 
 void
@@ -348,7 +352,9 @@ remove_member_session (struct GNUNET_MESSENGER_Member *member, struct GNUNET_MES
   struct GNUNET_HashCode hash;
   GNUNET_CRYPTO_hash(public_key, sizeof(*public_key), &hash);
 
-  GNUNET_CONTAINER_multihashmap_remove(member->sessions, &hash, session);
+  if (GNUNET_YES != GNUNET_CONTAINER_multihashmap_remove(member->sessions, &hash, session))
+    GNUNET_log(GNUNET_ERROR_TYPE_WARNING, "Removing a member session failed: %s\n",
+               GNUNET_h2s(&hash));
 }
 
 struct GNUNET_MESSENGER_ClosureIterateSessions {
diff --git a/src/messenger/gnunet-service-messenger_message_store.c b/src/messenger/gnunet-service-messenger_message_store.c
index 1f3d262ac..b143c6c98 100644..100755
--- a/src/messenger/gnunet-service-messenger_message_store.c
+++ b/src/messenger/gnunet-service-messenger_message_store.c
@@ -158,6 +158,8 @@ load_message_store_links (struct GNUNET_MESSENGER_MessageStore *store, const cha
   struct GNUNET_MESSENGER_MessageLinkStorage storage;
   struct GNUNET_MESSENGER_MessageLink *link = NULL;
 
+  memset(&storage, 0, sizeof(storage));
+
   do
   {
     if ((sizeof(storage.hash) != GNUNET_DISK_file_read (entries, &(storage.hash), sizeof(storage.hash))) ||
@@ -311,6 +313,8 @@ save_message_store (struct GNUNET_MESSENGER_MessageStore *store, const char *dir
   save.store = store;
   save.storage = GNUNET_DISK_file_open (filename, GNUNET_DISK_OPEN_WRITE | GNUNET_DISK_OPEN_CREATE, permission);
 
+  GNUNET_free(filename);
+
   if (!save.storage)
     goto save_entries;
 
@@ -324,7 +328,6 @@ close_links:
   GNUNET_DISK_file_close (save.storage);
 
 save_entries:
-  GNUNET_free(filename);
   GNUNET_asprintf (&filename, "%s%s", directory, "entries.store");
 
   save.store = store;
@@ -417,7 +420,10 @@ get_store_message (struct GNUNET_MESSENGER_MessageStore *store, const struct GNU
 
   if ((GNUNET_YES != decoding) || (GNUNET_CRYPTO_hash_cmp (hash, &check) != 0))
   {
-    GNUNET_CONTAINER_multihashmap_remove (store->entries, hash, entry);
+    if (GNUNET_YES != GNUNET_CONTAINER_multihashmap_remove (store->entries, hash, entry))
+      GNUNET_log(GNUNET_ERROR_TYPE_WARNING, "Corrupted entry could not be removed from store: %s\n",
+                 GNUNET_h2s(hash));
+
     store->rewrite_entries = GNUNET_YES;
 
     goto free_message;
diff --git a/src/messenger/gnunet-service-messenger_operation_store.c b/src/messenger/gnunet-service-messenger_operation_store.c
index 05985ef84..a32fbad2c 100644..100755
--- a/src/messenger/gnunet-service-messenger_operation_store.c
+++ b/src/messenger/gnunet-service-messenger_operation_store.c
@@ -184,7 +184,9 @@ cancel_store_operation (struct GNUNET_MESSENGER_OperationStore *store,
 
   stop_operation(op);
 
-  GNUNET_CONTAINER_multihashmap_remove(store->operations, hash, op);
+  if (GNUNET_YES != GNUNET_CONTAINER_multihashmap_remove(store->operations, hash, op))
+    GNUNET_log(GNUNET_ERROR_TYPE_WARNING, "Canceled operation could not be removed: %s\n",
+               GNUNET_h2s(hash));
 
   destroy_operation(op);
 }
diff --git a/src/messenger/messenger_api_contact_store.c b/src/messenger/messenger_api_contact_store.c
index 5238b2c58..6a517c2e0 100644..100755
--- a/src/messenger/messenger_api_contact_store.c
+++ b/src/messenger/messenger_api_contact_store.c
@@ -155,8 +155,10 @@ update_store_contact (struct GNUNET_MESSENGER_ContactStore *store, struct GNUNET
         store, next_context, &hash
     );
 
-    GNUNET_CONTAINER_multihashmap_put (map, &hash, contact,
-                                       GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_FAST);
+    if (GNUNET_OK != GNUNET_CONTAINER_multihashmap_put (map, &hash, contact,
+                                                        GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_FAST))
+      GNUNET_log(GNUNET_ERROR_TYPE_WARNING, "Updating a contact failed: %s\n",
+                 GNUNET_h2s(&hash));
   }
 }
 
@@ -176,7 +178,8 @@ remove_store_contact (struct GNUNET_MESSENGER_ContactStore *store, struct GNUNET
   );
 
   if (GNUNET_YES != GNUNET_CONTAINER_multihashmap_remove (map, &hash, contact))
-    return;
+    GNUNET_log(GNUNET_ERROR_TYPE_WARNING, "Removing a contact failed: %s\n",
+               GNUNET_h2s(&hash));
 
   destroy_contact (contact);
 }
diff --git a/src/messenger/messenger_api_message.c b/src/messenger/messenger_api_message.c
index d88859186..0d885f9ee 100644..100755
--- a/src/messenger/messenger_api_message.c
+++ b/src/messenger/messenger_api_message.c
@@ -590,7 +590,7 @@ int
 decode_message (struct GNUNET_MESSENGER_Message *message, uint16_t length, const char *buffer,
                 int include_signature, uint16_t *padding)
 {
-  GNUNET_assert((message) && (buffer));
+  GNUNET_assert((message) && (buffer) && (length >= sizeof(message->header)));
 
   uint16_t offset = 0;
 
diff --git a/src/messenger/messenger_api_room.c b/src/messenger/messenger_api_room.c
index df141ca12..5b7edee60 100644..100755
--- a/src/messenger/messenger_api_room.c
+++ b/src/messenger/messenger_api_room.c
@@ -106,7 +106,7 @@ get_room_sender (const struct GNUNET_MESSENGER_Room *room, const struct GNUNET_H
   return (entry? entry->sender : NULL);
 }
 
-static void
+static struct GNUNET_MESSENGER_Contact*
 handle_join_message (struct GNUNET_MESSENGER_Room *room, struct GNUNET_MESSENGER_Contact *sender,
                      const struct GNUNET_MESSENGER_Message *message, const struct GNUNET_HashCode *hash)
 {
@@ -124,6 +124,8 @@ handle_join_message (struct GNUNET_MESSENGER_Room *room, struct GNUNET_MESSENGER
       (GNUNET_OK == GNUNET_CONTAINER_multishortmap_put(room->members, &(message->header.sender_id), sender,
                                                        GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE)))
     increase_contact_rc(sender);
+
+  return sender;
 }
 
 static void
@@ -140,7 +142,7 @@ handle_leave_message (struct GNUNET_MESSENGER_Room *room, struct GNUNET_MESSENGE
   struct GNUNET_MESSENGER_ContactStore *store = get_handle_contact_store(room->handle);
 
   if (GNUNET_YES == decrease_contact_rc(sender))
-    remove_store_contact(store, sender, &context);
+    GNUNET_log(GNUNET_ERROR_TYPE_DEBUG, "A contact does not share any room with you anymore!\n");
 }
 
 static void
@@ -216,17 +218,17 @@ handle_delete_message (struct GNUNET_MESSENGER_Room *room, struct GNUNET_MESSENG
   }
 }
 
-void
+struct GNUNET_MESSENGER_Contact*
 handle_room_message (struct GNUNET_MESSENGER_Room *room, struct GNUNET_MESSENGER_Contact *sender,
                      const struct GNUNET_MESSENGER_Message *message, const struct GNUNET_HashCode *hash)
 {
   if (GNUNET_NO != GNUNET_CONTAINER_multihashmap_contains (room->messages, hash))
-    return;
+    return sender;
 
   switch (message->header.kind)
   {
   case GNUNET_MESSENGER_KIND_JOIN:
-    handle_join_message (room, sender, message, hash);
+    sender = handle_join_message (room, sender, message, hash);
     break;
   case GNUNET_MESSENGER_KIND_LEAVE:
     handle_leave_message (room, sender, message, hash);
@@ -253,7 +255,7 @@ handle_room_message (struct GNUNET_MESSENGER_Room *room, struct GNUNET_MESSENGER
   struct GNUNET_MESSENGER_RoomMessageEntry *entry = GNUNET_new(struct GNUNET_MESSENGER_RoomMessageEntry);
 
   if (!entry)
-    return;
+    return sender;
 
   entry->sender = sender;
   entry->message = copy_message (message);
@@ -264,6 +266,8 @@ handle_room_message (struct GNUNET_MESSENGER_Room *room, struct GNUNET_MESSENGER
     destroy_message (entry->message);
     GNUNET_free(entry);
   }
+
+  return sender;
 }
 
 struct GNUNET_MESSENGER_MemberCall
diff --git a/src/messenger/messenger_api_room.h b/src/messenger/messenger_api_room.h
index 9455fd43b..eb41cf740 100644..100755
--- a/src/messenger/messenger_api_room.h
+++ b/src/messenger/messenger_api_room.h
@@ -100,12 +100,16 @@ get_room_sender (const struct GNUNET_MESSENGER_Room *room, const struct GNUNET_H
  * Handles a <i>message</i> with a given <i>hash</i> in a <i>room</i> for the client API to update
  * members and its information. The function also stores the message in map locally for access afterwards.
  *
+ * The contact of the message's sender could be updated or even created. It may not be freed or destroyed though!
+ * (The contact may still be in use for old messages...)
+ *
  * @param[in/out] room Room
  * @param[in/out] sender Contact of sender
  * @param[in] message Message
  * @param[in] hash Hash of message
+ * @return Contact of sender
  */
-void
+struct GNUNET_MESSENGER_Contact*
 handle_room_message (struct GNUNET_MESSENGER_Room *room, struct GNUNET_MESSENGER_Contact *sender,
                      const struct GNUNET_MESSENGER_Message *message, const struct GNUNET_HashCode *hash);
 
diff --git a/src/namestore/gnunet-service-namestore.c b/src/namestore/gnunet-service-namestore.c
index d6774b37b..79210939f 100644
--- a/src/namestore/gnunet-service-namestore.c
+++ b/src/namestore/gnunet-service-namestore.c
@@ -743,13 +743,14 @@ send_lookup_response (struct NamestoreClient *nc,
     nick->flags =
       (nick->flags | GNUNET_GNSRECORD_RF_PRIVATE) ^ GNUNET_GNSRECORD_RF_PRIVATE;
     merge_with_nick_records (nick, rd_count, rd, &res_count, &res);
-    GNUNET_free (nick);
   }
   else
   {
     res_count = rd_count;
     res = (struct GNUNET_GNSRECORD_Data *) rd;
   }
+  if (NULL != nick)
+    GNUNET_free (nick);
 
   GNUNET_assert (-1 != GNUNET_GNSRECORD_records_get_size (res_count, res));
 
@@ -758,12 +759,16 @@ send_lookup_response (struct NamestoreClient *nc,
   rd_ser_len = GNUNET_GNSRECORD_records_get_size (res_count, res);
   if (rd_ser_len < 0)
   {
+    if (rd != res)
+      GNUNET_free (res);
     GNUNET_break (0);
     GNUNET_SERVICE_client_drop (nc->client);
     return;
   }
   if (((size_t) rd_ser_len) >= UINT16_MAX - name_len - sizeof(*zir_msg))
   {
+    if (rd != res)
+      GNUNET_free (res);
     GNUNET_break (0);
     GNUNET_SERVICE_client_drop (nc->client);
     return;
@@ -920,12 +925,15 @@ refresh_block (struct NamestoreClient *nc,
     nick->flags =
       (nick->flags | GNUNET_GNSRECORD_RF_PRIVATE) ^ GNUNET_GNSRECORD_RF_PRIVATE;
     merge_with_nick_records (nick, rd_count, rd, &res_count, &res);
-    GNUNET_free (nick);
   }
+  if (NULL != nick)
+    GNUNET_free (nick);
   if (0 == res_count)
   {
     if (NULL != nc)
       send_store_response (nc, GNUNET_OK, rid);
+    if (rd != res)
+      GNUNET_free (res);
     return;   /* no data, no need to update cache */
   }
   if (GNUNET_YES == disable_namecache)
@@ -936,6 +944,8 @@ refresh_block (struct NamestoreClient *nc,
                               GNUNET_NO);
     if (NULL != nc)
       send_store_response (nc, GNUNET_OK, rid);
+    if (rd != res)
+      GNUNET_free (res);
     return;
   }
   exp_time = GNUNET_GNSRECORD_record_get_expiration_time (res_count, res);
@@ -970,6 +980,8 @@ refresh_block (struct NamestoreClient *nc,
                                           &finish_cache_operation,
                                           cop);
   GNUNET_free (block);
+  if (rd != res)
+    GNUNET_free (res);
 }
 
 
diff --git a/src/namestore/namestore_api.c b/src/namestore/namestore_api.c
index c845b5019..2d5327e06 100644
--- a/src/namestore/namestore_api.c
+++ b/src/namestore/namestore_api.c
@@ -690,6 +690,12 @@ handle_zone_to_name_response (void *cls,
 
   LOG (GNUNET_ERROR_TYPE_DEBUG, "Received ZONE_TO_NAME_RESPONSE\n");
   qe = find_qe (h, ntohl (msg->gns_header.r_id));
+  if (NULL == qe)
+  {
+    LOG (GNUNET_ERROR_TYPE_WARNING,
+         "Response queue already gone...\n");
+    return;
+  }
   res = ntohs (msg->res);
   switch (res)
   {
diff --git a/src/namestore/plugin_rest_namestore.c b/src/namestore/plugin_rest_namestore.c
index edcbeb874..ae93e5eff 100644
--- a/src/namestore/plugin_rest_namestore.c
+++ b/src/namestore/plugin_rest_namestore.c
@@ -375,6 +375,8 @@ get_egoentry_namestore (struct RequestHandle *handle, char *name)
   if (NULL == name)
     return NULL;
   tmp = strtok (copy, "/");
+  if (NULL == tmp)
+    return NULL;
   for (ego_entry = ego_head; NULL != ego_entry;
        ego_entry = ego_entry->next)
   {
diff --git a/src/peerinfo-tool/plugin_rest_peerinfo.c b/src/peerinfo-tool/plugin_rest_peerinfo.c
index 4bbc7442e..f969a175b 100644
--- a/src/peerinfo-tool/plugin_rest_peerinfo.c
+++ b/src/peerinfo-tool/plugin_rest_peerinfo.c
@@ -379,7 +379,9 @@ peerinfo_list_finished (void *cls)
   result_str = json_dumps (handle->response, 0);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Result %s\n", result_str);
   resp = GNUNET_REST_create_response (result_str);
-  MHD_add_response_header (resp, "Content-Type", "application/json");
+  GNUNET_assert (MHD_NO != MHD_add_response_header (resp,
+                                                    "Content-Type",
+                                                    "application/json"));
   handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
   GNUNET_free (result_str);
   GNUNET_SCHEDULER_add_now (&cleanup_handle, handle);
diff --git a/src/peerstore/peerstore_api.c b/src/peerstore/peerstore_api.c
index db5aee0d5..196d44faa 100644
--- a/src/peerstore/peerstore_api.c
+++ b/src/peerstore/peerstore_api.c
@@ -823,7 +823,12 @@ reconnect (void *cls)
                                  &handle_client_error,
                                  h);
   if (NULL == h->mq)
+  {
+    h->reconnect_task =
+      GNUNET_SCHEDULER_add_delayed (h->reconnect_delay, &reconnect, h);
+    h->reconnect_delay = GNUNET_TIME_STD_BACKOFF (h->reconnect_delay);
     return;
+  }
   LOG (GNUNET_ERROR_TYPE_DEBUG,
        "Resending pending requests after reconnect.\n");
   if (NULL != h->watches)
diff --git a/src/peerstore/test_peerstore_api_sync.c b/src/peerstore/test_peerstore_api_sync.c
index 4c826c654..5057c98b5 100644
--- a/src/peerstore/test_peerstore_api_sync.c
+++ b/src/peerstore/test_peerstore_api_sync.c
@@ -67,6 +67,24 @@ static const char *val = "test_peerstore_api_store_val";
 
 
 /**
+ * Timeout
+ */
+#define TIMEOUT GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 10)
+
+/**
+ * Timeout task
+ */
+static struct GNUNET_SCHEDULER_Task *to;
+
+/**
+ * Iterate handle
+ */
+static struct GNUNET_PEERSTORE_IterateContext *it;
+
+static void
+test_cont (void *cls);
+
+/**
  * Function that should be called with the result of the
  * lookup, and finally once with NULL to signal the end
  * of the iteration.
@@ -89,9 +107,24 @@ iterate_cb (void *cls,
   GNUNET_break (NULL == emsg);
   if (NULL == record)
   {
-    GNUNET_PEERSTORE_disconnect (h,
-                                 GNUNET_NO);
-    GNUNET_SCHEDULER_shutdown ();
+    it = NULL;
+    if (0 == ok)
+    {
+      GNUNET_PEERSTORE_disconnect (h,
+                                   GNUNET_NO);
+      if (NULL != to)
+      {
+        GNUNET_SCHEDULER_cancel (to);
+        to = NULL;
+      }
+      GNUNET_SCHEDULER_shutdown ();
+      return;
+    }
+    /**
+     * Try again
+     */
+    GNUNET_SCHEDULER_add_now (&test_cont,
+                              NULL);
     return;
   }
   rec_val = record->value;
@@ -100,6 +133,22 @@ iterate_cb (void *cls,
 }
 
 
+static void
+timeout_task (void *cls)
+{
+  to = NULL;
+  GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+              "Timeout reached\n");
+  if (NULL != it)
+    GNUNET_PEERSTORE_iterate_cancel (it);
+  it = NULL;
+  GNUNET_PEERSTORE_disconnect (h,
+                               GNUNET_NO);
+  GNUNET_SCHEDULER_shutdown ();
+  return;
+}
+
+
 /**
  * Run the 2nd stage of the test where we fetch the
  * data that should have been stored.
@@ -109,12 +158,11 @@ iterate_cb (void *cls,
 static void
 test_cont (void *cls)
 {
-  h = GNUNET_PEERSTORE_connect (cfg);
-  GNUNET_PEERSTORE_iterate (h,
-                            subsystem,
-                            &pid, key,
-                            &iterate_cb,
-                            NULL);
+  it = GNUNET_PEERSTORE_iterate (h,
+                                 subsystem,
+                                 &pid, key,
+                                 &iterate_cb,
+                                 NULL);
 }
 
 
@@ -122,10 +170,9 @@ static void
 disc_cont (void *cls)
 {
   GNUNET_PEERSTORE_disconnect (h, GNUNET_YES);
-  h = NULL;
-  GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_UNIT_SECONDS,
-                                &test_cont,
-                                NULL);
+  h = GNUNET_PEERSTORE_connect (cfg);
+  GNUNET_SCHEDULER_add_now (&test_cont,
+                            NULL);
 }
 
 
@@ -133,12 +180,17 @@ static void
 store_cont (void *cls, int success)
 {
   ok = success;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Success: %s\n",
+              (GNUNET_SYSERR == ok) ? "no" : "yes");
   /* We need to wait a little bit to give the disconnect
      a chance to actually finish the operation; otherwise,
      the test may fail non-deterministically if the new
      connection is faster than the cleanup routine of the
-     old one. */GNUNET_SCHEDULER_add_now (&disc_cont,
-                            NULL);
+     old one. */
+  GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_UNIT_SECONDS,
+                                &disc_cont,
+                                NULL);
 }
 
 
@@ -174,7 +226,10 @@ run (void *cls,
 {
   cfg = c;
   memset (&pid, 1, sizeof(pid));
-  test1 ();
+  to = GNUNET_SCHEDULER_add_delayed (TIMEOUT,
+                                     &timeout_task,
+                                     NULL);
+  GNUNET_SCHEDULER_add_now (&test1, NULL);
 }
 
 
diff --git a/src/reclaim/gnunet-service-reclaim.c b/src/reclaim/gnunet-service-reclaim.c
index 913b667b7..04c12735b 100644
--- a/src/reclaim/gnunet-service-reclaim.c
+++ b/src/reclaim/gnunet-service-reclaim.c
@@ -731,9 +731,12 @@ static int
 check_issue_ticket_message (void *cls, const struct IssueTicketMessage *im)
 {
   uint16_t size;
+  size_t attrs_len;
 
   size = ntohs (im->header.size);
-  if (size <= sizeof(struct IssueTicketMessage))
+  attrs_len = ntohs (im->attr_len);
+
+  if (attrs_len > size - sizeof(struct IssueTicketMessage))
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
diff --git a/src/reclaim/gnunet-service-reclaim_tickets.c b/src/reclaim/gnunet-service-reclaim_tickets.c
index ef2303bd7..48b3fe214 100644
--- a/src/reclaim/gnunet-service-reclaim_tickets.c
+++ b/src/reclaim/gnunet-service-reclaim_tickets.c
@@ -690,7 +690,10 @@ rvk_move_attr_cb (void *cls,
     return;
   }
   GNUNET_RECLAIM_id_generate (&rvk->move_attr->new_id);
-  new_label = NULL;
+  new_label =
+    GNUNET_STRINGS_data_to_string_alloc (&rvk->move_attr->new_id,
+                                         sizeof (rvk->move_attr->new_id));
+
   attr_data = NULL;
   // new_rd = *rd;
   for (int i = 0; i < rd_count; i++)
@@ -714,9 +717,6 @@ rvk_move_attr_cb (void *cls,
       new_rd[i].record_type = rd[i].record_type;
       new_rd[i].flags = rd[i].flags;
       new_rd[i].expiration_time = rd[i].expiration_time;
-      new_label =
-        GNUNET_STRINGS_data_to_string_alloc (&rvk->move_attr->new_id,
-                                             sizeof (rvk->move_attr->new_id));
       GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Adding attribute %s\n", new_label);
       GNUNET_free (claim);
     }
@@ -738,9 +738,6 @@ rvk_move_attr_cb (void *cls,
       new_rd[i].record_type = rd[i].record_type;
       new_rd[i].flags = rd[i].flags;
       new_rd[i].expiration_time = rd[i].expiration_time;
-      new_label =
-        GNUNET_STRINGS_data_to_string_alloc (&rvk->move_attr->new_id,
-                                             sizeof (rvk->move_attr->new_id));
       GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Adding credential %s\n",
                   new_label);
       GNUNET_free (credential);
@@ -1400,7 +1397,7 @@ issue_ticket (struct TicketIssueHandle *ih)
                                               attrs_record,
                                               &store_ticket_issue_cont,
                                               ih);
-  for (j = 0; j > i; j++)
+  for (j = 0; j < i; j++)
   {
     if (attrs_record[j].record_type
         != GNUNET_GNSRECORD_TYPE_RECLAIM_PRESENTATION)
@@ -1585,7 +1582,7 @@ filter_tickets_cb (void *cls,
     cleanup_issue_handle (tih);
     return;
   }
-
+  GNUNET_RECLAIM_presentation_list_destroy (ticket_presentations);
   // ticket not found in current record, checking next record set
   GNUNET_NAMESTORE_zone_iterator_next (tih->ns_it, 1);
 }
diff --git a/src/reclaim/oidc_helper.c b/src/reclaim/oidc_helper.c
index bd3a8ee05..7b24ee598 100644
--- a/src/reclaim/oidc_helper.c
+++ b/src/reclaim/oidc_helper.c
@@ -839,11 +839,17 @@ int
 OIDC_access_token_parse (const char *token,
                          struct GNUNET_RECLAIM_Ticket **ticket)
 {
-  if (sizeof (struct GNUNET_RECLAIM_Ticket) !=
-      GNUNET_STRINGS_base64_decode (token,
-                                    strlen (token),
-                                    (void**) ticket))
+  size_t sret;
+  char *decoded;
+  sret = GNUNET_STRINGS_base64_decode (token,
+                                       strlen (token),
+                                       (void**) &decoded);
+  if (sizeof (struct GNUNET_RECLAIM_Ticket) != sret)
+  {
+    GNUNET_free (decoded);
     return GNUNET_SYSERR;
+  }
+  *ticket = (struct GNUNET_RECLAIM_Ticket *) decoded;
   return GNUNET_OK;
 }
 
diff --git a/src/reclaim/plugin_rest_openid_connect.c b/src/reclaim/plugin_rest_openid_connect.c
index 0ee61755b..c6259d745 100644
--- a/src/reclaim/plugin_rest_openid_connect.c
+++ b/src/reclaim/plugin_rest_openid_connect.c
@@ -686,7 +686,10 @@ do_userinfo_error (void *cls)
                    handle->emsg,
                    (NULL != handle->edesc) ? handle->edesc : "");
   resp = GNUNET_REST_create_response ("");
-  MHD_add_response_header (resp, MHD_HTTP_HEADER_WWW_AUTHENTICATE, "Bearer");
+  GNUNET_assert (MHD_NO !=
+                 MHD_add_response_header (resp,
+                                          MHD_HTTP_HEADER_WWW_AUTHENTICATE,
+                                          "Bearer"));
   handle->proc (handle->proc_cls, resp, handle->response_code);
   cleanup_handle (handle);
   GNUNET_free (error);
@@ -713,7 +716,8 @@ do_redirect_error (void *cls)
                    (NULL != handle->oidc->state) ? "&state=" : "",
                    (NULL != handle->oidc->state) ? handle->oidc->state : "");
   resp = GNUNET_REST_create_response ("");
-  MHD_add_response_header (resp, "Location", redirect);
+  GNUNET_assert (MHD_NO != MHD_add_response_header (resp,
+                                                    "Location", redirect));
   handle->proc (handle->proc_cls, resp, MHD_HTTP_FOUND);
   cleanup_handle (handle);
   GNUNET_free (redirect);
@@ -1022,7 +1026,8 @@ oidc_ticket_issue_cb (void *cls,
                      handle->oidc->state);
   }
   resp = GNUNET_REST_create_response ("");
-  MHD_add_response_header (resp, "Location", redirect_uri);
+  GNUNET_assert (MHD_NO != MHD_add_response_header (resp,
+                                                    "Location", redirect_uri));
   handle->proc (handle->proc_cls, resp, MHD_HTTP_FOUND);
   cleanup_handle (handle);
   GNUNET_free (redirect_uri);
@@ -1381,7 +1386,8 @@ build_redirect (void *cls)
                        handle->oidc->state);
     }
     resp = GNUNET_REST_create_response ("");
-    MHD_add_response_header (resp, "Location", redirect_uri);
+    GNUNET_assert (MHD_NO != MHD_add_response_header (resp,
+                                                      "Location", redirect_uri));
     handle->proc (handle->proc_cls, resp, MHD_HTTP_FOUND);
     cleanup_handle (handle);
     GNUNET_free (redirect_uri);
@@ -1764,8 +1770,12 @@ login_cont (struct GNUNET_REST_RequestHandle *con_handle,
                    "%s;Max-Age=%d",
                    cookie,
                    OIDC_COOKIE_EXPIRATION);
-  MHD_add_response_header (resp, "Set-Cookie", header_val);
-  MHD_add_response_header (resp, "Access-Control-Allow-Methods", "POST");
+  GNUNET_assert (MHD_NO != MHD_add_response_header (resp,
+                                                    "Set-Cookie", header_val));
+  GNUNET_assert (MHD_NO !=
+                 MHD_add_response_header (resp,
+                                          "Access-Control-Allow-Methods",
+                                          "POST"));
   GNUNET_CRYPTO_hash (cookie, strlen (cookie), &cache_key);
 
   if (0 != strcmp (json_string_value (identity), "Denied"))
@@ -1880,7 +1890,8 @@ parse_credentials_post_body (struct RequestHandle *handle,
   }
   pass = GNUNET_CONTAINER_multihashmap_get (handle->rest_handle->url_param_map,
                                             &cache_key);
-  if (NULL == pass) {
+  if (NULL == pass)
+  {
     GNUNET_free (*client_id);
     *client_id = NULL;
     return GNUNET_SYSERR;
@@ -2134,6 +2145,8 @@ token_endpoint (struct GNUNET_REST_RequestHandle *con_handle,
     GNUNET_free (code);
     if (NULL != nonce)
       GNUNET_free (nonce);
+    GNUNET_RECLAIM_attribute_list_destroy (cl);
+    GNUNET_RECLAIM_presentation_list_destroy (pl);
     GNUNET_SCHEDULER_add_now (&do_error, handle);
     return;
   }
@@ -2149,6 +2162,8 @@ token_endpoint (struct GNUNET_REST_RequestHandle *con_handle,
     handle->edesc = GNUNET_strdup ("No signing secret configured!");
     handle->response_code = MHD_HTTP_INTERNAL_SERVER_ERROR;
     GNUNET_free (code);
+    GNUNET_RECLAIM_attribute_list_destroy (cl);
+    GNUNET_RECLAIM_presentation_list_destroy (pl);
     if (NULL != nonce)
       GNUNET_free (nonce);
     GNUNET_SCHEDULER_add_now (&do_error, handle);
@@ -2191,9 +2206,14 @@ token_endpoint (struct GNUNET_REST_RequestHandle *con_handle,
                              &json_response);
 
   resp = GNUNET_REST_create_response (json_response);
-  MHD_add_response_header (resp, "Cache-Control", "no-store");
-  MHD_add_response_header (resp, "Pragma", "no-cache");
-  MHD_add_response_header (resp, "Content-Type", "application/json");
+  GNUNET_assert (MHD_NO != MHD_add_response_header (resp,
+                                                    "Cache-Control",
+                                                    "no-store"));
+  GNUNET_assert (MHD_NO != MHD_add_response_header (resp,
+                                                    "Pragma", "no-cache"));
+  GNUNET_assert (MHD_NO != MHD_add_response_header (resp,
+                                                    "Content-Type",
+                                                    "application/json"));
   handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
   GNUNET_RECLAIM_attribute_list_destroy (cl);
   GNUNET_RECLAIM_presentation_list_destroy (pl);
@@ -2665,8 +2685,14 @@ oidc_config_cors (struct GNUNET_REST_RequestHandle *con_handle,
 
   // For now, independent of path return all options
   resp = GNUNET_REST_create_response (NULL);
-  MHD_add_response_header (resp, "Access-Control-Allow-Methods", allow_methods);
-  MHD_add_response_header (resp, "Access-Control-Allow-Origin", "*");
+  GNUNET_assert (MHD_NO !=
+                 MHD_add_response_header (resp,
+                                          "Access-Control-Allow-Methods",
+                                          allow_methods));
+  GNUNET_assert (MHD_NO !=
+                 MHD_add_response_header (resp,
+                                          "Access-Control-Allow-Origin",
+                                          "*"));
   handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
   cleanup_handle (handle);
   return;
diff --git a/src/reclaim/plugin_rest_reclaim.c b/src/reclaim/plugin_rest_reclaim.c
index 84456b386..39d24ea61 100644
--- a/src/reclaim/plugin_rest_reclaim.c
+++ b/src/reclaim/plugin_rest_reclaim.c
@@ -353,14 +353,18 @@ finished_cont (void *cls, int32_t success, const char *emsg)
   struct MHD_Response *resp;
 
   handle->idp_op = NULL;
-  resp = GNUNET_REST_create_response (emsg);
-  MHD_add_response_header (resp, "Content-Type", "application/json");
-  MHD_add_response_header (resp, "Access-Control-Allow-Methods", allow_methods);
   if (GNUNET_OK != success)
   {
     GNUNET_SCHEDULER_add_now (&do_error, handle);
     return;
   }
+  resp = GNUNET_REST_create_response (emsg);
+  GNUNET_assert (MHD_NO != MHD_add_response_header (resp,
+                                                    "Content-Type",
+                                                    "application/json"));
+  GNUNET_assert (MHD_NO != MHD_add_response_header (resp,
+                                                    "Access-Control-Allow-Methods",
+                                                    allow_methods));
   handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
   GNUNET_SCHEDULER_add_now (&cleanup_handle, handle);
 }
@@ -372,13 +376,15 @@ delete_finished_cb (void *cls, int32_t success, const char *emsg)
   struct RequestHandle *handle = cls;
   struct MHD_Response *resp;
 
-  resp = GNUNET_REST_create_response (emsg);
-  MHD_add_response_header (resp, "Access-Control-Allow-Methods", allow_methods);
   if (GNUNET_OK != success)
   {
     GNUNET_SCHEDULER_add_now (&do_error, handle);
     return;
   }
+  resp = GNUNET_REST_create_response (emsg);
+  GNUNET_assert (MHD_NO != MHD_add_response_header (resp,
+                                                    "Access-Control-Allow-Methods",
+                                                    allow_methods));
   handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
   GNUNET_SCHEDULER_add_now (&cleanup_handle, handle);
 }
@@ -399,7 +405,10 @@ return_response (void *cls)
   result_str = json_dumps (handle->resp_object, 0);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Result %s\n", result_str);
   resp = GNUNET_REST_create_response (result_str);
-  MHD_add_response_header (resp, "Access-Control-Allow-Methods", allow_methods);
+  GNUNET_assert (MHD_NO !=
+                 MHD_add_response_header (resp,
+                                          "Access-Control-Allow-Methods",
+                                          allow_methods));
   handle->proc (handle->proc_cls, resp, MHD_HTTP_OK);
   GNUNET_free (result_str);
   cleanup_handle (handle);
@@ -461,8 +470,8 @@ ticket_collect (void *cls, const struct GNUNET_RECLAIM_Ticket *ticket)
 
 static void
 add_credential_cont (struct GNUNET_REST_RequestHandle *con_handle,
-                      const char *url,
-                      void *cls)
+                     const char *url,
+                     void *cls)
 {
   struct RequestHandle *handle = cls;
   const struct GNUNET_IDENTITY_PrivateKey *identity_priv;
@@ -513,7 +522,15 @@ add_credential_cont (struct GNUNET_REST_RequestHandle *con_handle,
                  handle->rest_handle->data,
                  handle->rest_handle->data_size);
   data_json = json_loads (term_data, JSON_DECODE_ANY, &err);
-  GNUNET_JSON_parse (data_json, attrspec, NULL, NULL);
+  if (GNUNET_OK != GNUNET_JSON_parse (data_json, attrspec, NULL, NULL))
+  {
+    json_decref (data_json);
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Unable to parse JSON from %s\n",
+                term_data);
+    GNUNET_SCHEDULER_add_now (&do_error, handle);
+    return;
+  }
   json_decref (data_json);
   if (NULL == attribute)
   {
@@ -530,11 +547,11 @@ add_credential_cont (struct GNUNET_REST_RequestHandle *con_handle,
     GNUNET_RECLAIM_id_generate (&attribute->id);
   exp = GNUNET_TIME_UNIT_HOURS;
   handle->idp_op = GNUNET_RECLAIM_credential_store (idp,
-                                                     identity_priv,
-                                                     attribute,
-                                                     &exp,
-                                                     &finished_cont,
-                                                     handle);
+                                                    identity_priv,
+                                                    attribute,
+                                                    &exp,
+                                                    &finished_cont,
+                                                    handle);
   GNUNET_JSON_parse_free (attrspec);
 }
 
@@ -545,8 +562,8 @@ add_credential_cont (struct GNUNET_REST_RequestHandle *con_handle,
  */
 static void
 cred_collect (void *cls,
-                const struct GNUNET_IDENTITY_PublicKey *identity,
-                const struct GNUNET_RECLAIM_Credential *cred)
+              const struct GNUNET_IDENTITY_PublicKey *identity,
+              const struct GNUNET_RECLAIM_Credential *cred)
 {
   struct RequestHandle *handle = cls;
   struct GNUNET_RECLAIM_AttributeList *attrs;
@@ -565,8 +582,8 @@ cred_collect (void *cls,
   attrs = GNUNET_RECLAIM_credential_get_attributes (cred);
   issuer = GNUNET_RECLAIM_credential_get_issuer (cred);
   tmp_value = GNUNET_RECLAIM_credential_value_to_string (cred->type,
-                                                          cred->data,
-                                                          cred->data_size);
+                                                         cred->data,
+                                                         cred->data_size);
   cred_obj = json_object ();
   json_object_set_new (cred_obj, "value", json_string (tmp_value));
   json_object_set_new (cred_obj, "name", json_string (cred->name));
@@ -578,7 +595,7 @@ cred_collect (void *cls,
     GNUNET_free (issuer);
   }
   if (GNUNET_OK == GNUNET_RECLAIM_credential_get_expiration (cred,
-                                                              &exp))
+                                                             &exp))
   {
     json_object_set_new (cred_obj, "expiration", json_integer (
                            exp.abs_value_us));
@@ -613,7 +630,8 @@ cred_collect (void *cls,
     json_object_set_new (cred_obj, "attributes", attr_arr);
   }
   json_array_append_new (handle->resp_object, cred_obj);
-  GNUNET_RECLAIM_attribute_list_destroy (attrs);
+  if (NULL != attrs)
+    GNUNET_RECLAIM_attribute_list_destroy (attrs);
   GNUNET_RECLAIM_get_credentials_next (handle->cred_it);
 }
 
@@ -627,8 +645,8 @@ cred_collect (void *cls,
  */
 static void
 list_credential_cont (struct GNUNET_REST_RequestHandle *con_handle,
-                       const char *url,
-                       void *cls)
+                      const char *url,
+                      void *cls)
 {
   struct RequestHandle *handle = cls;
   const struct GNUNET_IDENTITY_PrivateKey *priv_key;
@@ -664,14 +682,14 @@ list_credential_cont (struct GNUNET_REST_RequestHandle *con_handle,
   }
   priv_key = GNUNET_IDENTITY_ego_get_private_key (ego_entry->ego);
   handle->cred_it = GNUNET_RECLAIM_get_credentials_start (idp,
-                                                             priv_key,
-                                                             &collect_error_cb,
-                                                             handle,
-                                                             &cred_collect,
-                                                             handle,
-                                                             &
-                                                             collect_finished_cb,
-                                                             handle);
+                                                          priv_key,
+                                                          &collect_error_cb,
+                                                          handle,
+                                                          &cred_collect,
+                                                          handle,
+                                                          &
+                                                          collect_finished_cb,
+                                                          handle);
 }
 
 
@@ -684,8 +702,8 @@ list_credential_cont (struct GNUNET_REST_RequestHandle *con_handle,
  */
 static void
 delete_credential_cont (struct GNUNET_REST_RequestHandle *con_handle,
-                         const char *url,
-                         void *cls)
+                        const char *url,
+                        void *cls)
 {
   struct RequestHandle *handle = cls;
   const struct GNUNET_IDENTITY_PrivateKey *priv_key;
@@ -734,10 +752,10 @@ delete_credential_cont (struct GNUNET_REST_RequestHandle *con_handle,
   GNUNET_STRINGS_string_to_data (id, strlen (id), &attr.id, sizeof(attr.id));
   attr.name = "";
   handle->idp_op = GNUNET_RECLAIM_credential_delete (idp,
-                                                      priv_key,
-                                                      &attr,
-                                                      &delete_finished_cb,
-                                                      handle);
+                                                     priv_key,
+                                                     &attr,
+                                                     &delete_finished_cb,
+                                                     handle);
   GNUNET_free (identity_id_str);
 }
 
@@ -900,8 +918,8 @@ parse_jwt (const struct GNUNET_RECLAIM_Credential *cred,
   json_error_t *json_err = NULL;
 
   jwt_string = GNUNET_RECLAIM_credential_value_to_string (cred->type,
-                                                           cred->data,
-                                                           cred->data_size);
+                                                          cred->data,
+                                                          cred->data_size);
   char *jwt_body = strtok (jwt_string, delim);
   jwt_body = strtok (NULL, delim);
   GNUNET_STRINGS_base64_decode (jwt_body, strlen (jwt_body),
@@ -1424,25 +1442,24 @@ rest_identity_process_request (struct GNUNET_REST_RequestHandle *rest_handle,
   static const struct GNUNET_REST_RequestHandler handlers[] =
   { { MHD_HTTP_METHOD_GET,
       GNUNET_REST_API_NS_RECLAIM_ATTRIBUTES, &list_attribute_cont },
-  { MHD_HTTP_METHOD_POST,
-    GNUNET_REST_API_NS_RECLAIM_ATTRIBUTES, &add_attribute_cont },
-  { MHD_HTTP_METHOD_DELETE,
-    GNUNET_REST_API_NS_RECLAIM_ATTRIBUTES, &delete_attribute_cont },
-  { MHD_HTTP_METHOD_GET,
-    GNUNET_REST_API_NS_RECLAIM_CREDENTIAL, &list_credential_cont },
-  { MHD_HTTP_METHOD_POST,
-    GNUNET_REST_API_NS_RECLAIM_CREDENTIAL, &add_credential_cont },
-  { MHD_HTTP_METHOD_DELETE,
-    GNUNET_REST_API_NS_RECLAIM_CREDENTIAL, &delete_credential_cont },
-  { MHD_HTTP_METHOD_GET,
-    GNUNET_REST_API_NS_IDENTITY_TICKETS, &list_tickets_cont },
-  { MHD_HTTP_METHOD_POST,
-    GNUNET_REST_API_NS_IDENTITY_REVOKE, &revoke_ticket_cont },
-  { MHD_HTTP_METHOD_POST,
-    GNUNET_REST_API_NS_IDENTITY_CONSUME, &consume_ticket_cont },
-  { MHD_HTTP_METHOD_OPTIONS, GNUNET_REST_API_NS_RECLAIM, &options_cont },
-  GNUNET_REST_HANDLER_END
-  };
+    { MHD_HTTP_METHOD_POST,
+      GNUNET_REST_API_NS_RECLAIM_ATTRIBUTES, &add_attribute_cont },
+    { MHD_HTTP_METHOD_DELETE,
+      GNUNET_REST_API_NS_RECLAIM_ATTRIBUTES, &delete_attribute_cont },
+    { MHD_HTTP_METHOD_GET,
+      GNUNET_REST_API_NS_RECLAIM_CREDENTIAL, &list_credential_cont },
+    { MHD_HTTP_METHOD_POST,
+      GNUNET_REST_API_NS_RECLAIM_CREDENTIAL, &add_credential_cont },
+    { MHD_HTTP_METHOD_DELETE,
+      GNUNET_REST_API_NS_RECLAIM_CREDENTIAL, &delete_credential_cont },
+    { MHD_HTTP_METHOD_GET,
+      GNUNET_REST_API_NS_IDENTITY_TICKETS, &list_tickets_cont },
+    { MHD_HTTP_METHOD_POST,
+      GNUNET_REST_API_NS_IDENTITY_REVOKE, &revoke_ticket_cont },
+    { MHD_HTTP_METHOD_POST,
+      GNUNET_REST_API_NS_IDENTITY_CONSUME, &consume_ticket_cont },
+    { MHD_HTTP_METHOD_OPTIONS, GNUNET_REST_API_NS_RECLAIM, &options_cont },
+    GNUNET_REST_HANDLER_END};
 
   handle->response_code = 0;
   handle->timeout = GNUNET_TIME_UNIT_FOREVER_REL;
diff --git a/src/reclaim/reclaim_api.c b/src/reclaim/reclaim_api.c
index f4f2b946a..c08cc868c 100644
--- a/src/reclaim/reclaim_api.c
+++ b/src/reclaim/reclaim_api.c
@@ -651,18 +651,15 @@ handle_consume_ticket_result (void *cls,
                         le->attribute, NULL);
           }
         }
-        if (NULL != attrs)
-          GNUNET_RECLAIM_attribute_list_destroy (attrs);
-        if (NULL != pl)
-          GNUNET_RECLAIM_presentation_list_destroy (pl);
-        attrs = NULL;
-        pl = NULL;
       }
       op->atr_cb (op->cls, NULL, NULL, NULL);
     }
+    if (NULL != attrs)
+      GNUNET_RECLAIM_attribute_list_destroy (attrs);
+    if (NULL != pl)
+      GNUNET_RECLAIM_presentation_list_destroy (pl);
     GNUNET_CONTAINER_DLL_remove (h->op_head, h->op_tail, op);
     free_op (op);
-    GNUNET_free (attrs);
     return;
   }
   GNUNET_assert (0);
@@ -804,7 +801,7 @@ check_credential_result (void *cls, const struct CredentialResultMessage *msg)
  */
 static void
 handle_credential_result (void *cls, const struct
-                           CredentialResultMessage *msg)
+                          CredentialResultMessage *msg)
 {
   static struct GNUNET_IDENTITY_PrivateKey identity_dummy;
   struct GNUNET_RECLAIM_Handle *h = cls;
@@ -871,6 +868,7 @@ handle_credential_result (void *cls, const struct
   GNUNET_assert (0);
 }
 
+
 /**
    * Handle an incoming message of type
    * #GNUNET_MESSAGE_TYPE_RECLAIM_TICKET_RESULT
@@ -925,7 +923,7 @@ handle_ticket_result (void *cls, const struct TicketResultMessage *msg)
   if (NULL != op)
   {
     if (0 < pres_len)
-      pres = GNUNET_RECLAIM_presentation_list_deserialize ((char*)&msg[1],
+      pres = GNUNET_RECLAIM_presentation_list_deserialize ((char*) &msg[1],
                                                            pres_len);
     GNUNET_CONTAINER_DLL_remove (handle->op_head, handle->op_tail, op);
     if (0 ==
@@ -1485,7 +1483,7 @@ GNUNET_RECLAIM_get_credentials_start (
  */
 void
 GNUNET_RECLAIM_get_credentials_next (struct
-                                      GNUNET_RECLAIM_CredentialIterator *ait)
+                                     GNUNET_RECLAIM_CredentialIterator *ait)
 {
   struct GNUNET_RECLAIM_Handle *h = ait->h;
   struct CredentialIterationNextMessage *msg;
@@ -1507,7 +1505,7 @@ GNUNET_RECLAIM_get_credentials_next (struct
  */
 void
 GNUNET_RECLAIM_get_credentials_stop (struct
-                                      GNUNET_RECLAIM_CredentialIterator *ait)
+                                     GNUNET_RECLAIM_CredentialIterator *ait)
 {
   struct GNUNET_RECLAIM_Handle *h = ait->h;
   struct GNUNET_MQ_Envelope *env;
diff --git a/src/rest/plugin_rest_copying.c b/src/rest/plugin_rest_copying.c
index 6d074d3d1..52783a81a 100644
--- a/src/rest/plugin_rest_copying.c
+++ b/src/rest/plugin_rest_copying.c
@@ -138,9 +138,9 @@ options_cont (struct GNUNET_REST_RequestHandle *con_handle,
   struct RequestHandle *handle = cls;
 
   resp = GNUNET_REST_create_response (NULL);
-  MHD_add_response_header (resp,
-                           "Access-Control-Allow-Methods",
-                           MHD_HTTP_METHOD_GET);
+  GNUNET_assert (MHD_NO != MHD_add_response_header (resp,
+                                                    "Access-Control-Allow-Methods",
+                                                    MHD_HTTP_METHOD_GET));
   handle->proc (handle->proc_cls,
                 resp,
                 MHD_HTTP_OK);
diff --git a/src/revocation/gnunet-revocation.c b/src/revocation/gnunet-revocation.c
index b5737158b..99fecdd35 100644
--- a/src/revocation/gnunet-revocation.c
+++ b/src/revocation/gnunet-revocation.c
@@ -307,17 +307,9 @@ calculate_pow (void *cls)
     return;
   }
   pow_passes++;
-  /**
-   * Otherwise CTRL-C does not work
-   */
-  if (0 == pow_passes % 128)
-    pow_task = GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_UNIT_MILLISECONDS,
-                                             &calculate_pow,
-                                             ph);
-  else
-    pow_task = GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_UNIT_MILLISECONDS,
-                                             &calculate_pow,
-                                             ph);
+  pow_task = GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_UNIT_MILLISECONDS,
+                                           &calculate_pow,
+                                           ph);
 
 }
 
diff --git a/src/revocation/gnunet-service-revocation.c b/src/revocation/gnunet-service-revocation.c
index 863289aae..6f70720ba 100644
--- a/src/revocation/gnunet-service-revocation.c
+++ b/src/revocation/gnunet-service-revocation.c
@@ -306,12 +306,19 @@ publicize_rm (const struct RevokeMessage *rm)
   struct RevokeMessage *cp;
   struct GNUNET_HashCode hc;
   struct GNUNET_SETU_Element e;
+  ssize_t pklen;
   const struct GNUNET_IDENTITY_PublicKey *pk;
 
   struct GNUNET_REVOCATION_PowP *pow = (struct GNUNET_REVOCATION_PowP *) &rm[1];
   pk = (const struct GNUNET_IDENTITY_PublicKey *) &pow[1];
+  pklen = GNUNET_IDENTITY_key_get_length (pk);
+  if (0 > pklen)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
   GNUNET_CRYPTO_hash (pk,
-                      GNUNET_IDENTITY_key_get_length (pk),
+                      pklen,
                       &hc);
   if (GNUNET_YES ==
       GNUNET_CONTAINER_multihashmap_contains (revocation_map,
@@ -384,7 +391,8 @@ check_revoke_message (void *cls,
   uint16_t size;
 
   size = ntohs (rm->header.size);
-  if (size <= sizeof(struct RevokeMessage))
+  if (size <= sizeof(struct RevokeMessage) ||
+      (size > UINT16_MAX))
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
diff --git a/src/revocation/plugin_block_revocation.c b/src/revocation/plugin_block_revocation.c
index 3c9344a49..1928d09cd 100644
--- a/src/revocation/plugin_block_revocation.c
+++ b/src/revocation/plugin_block_revocation.c
@@ -134,6 +134,7 @@ block_plugin_revocation_evaluate (void *cls,
 {
   struct InternalContext *ic = cls;
   struct GNUNET_HashCode chash;
+  ssize_t pklen;
   const struct RevokeMessage *rm = reply_block;
 
   if (NULL == reply_block)
@@ -153,8 +154,14 @@ block_plugin_revocation_evaluate (void *cls,
     GNUNET_break_op (0);
     return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
   }
+  pklen = GNUNET_IDENTITY_key_get_length (pk);
+  if (0 > pklen)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
+  }
   GNUNET_CRYPTO_hash (pk,
-                      GNUNET_IDENTITY_key_get_length (pk),
+                      pklen,
                       &chash);
   if (GNUNET_YES ==
       GNUNET_BLOCK_GROUP_bf_test_and_set (group,
diff --git a/src/revocation/revocation_api.c b/src/revocation/revocation_api.c
index 5cf191847..e2f871c23 100644
--- a/src/revocation/revocation_api.c
+++ b/src/revocation/revocation_api.c
@@ -492,6 +492,7 @@ GNUNET_REVOCATION_check_pow (const struct GNUNET_REVOCATION_PowP *pow,
   unsigned int tmp_score = 0;
   unsigned int epochs;
   uint64_t pow_val;
+  ssize_t pklen;
   const struct GNUNET_IDENTITY_PublicKey *pk;
 
   pk = (const struct GNUNET_IDENTITY_PublicKey *) &pow[1];
@@ -517,9 +518,15 @@ GNUNET_REVOCATION_check_pow (const struct GNUNET_REVOCATION_PowP *pow,
   GNUNET_memcpy (&buf[sizeof(uint64_t)],
                  &pow->timestamp,
                  sizeof (uint64_t));
+  pklen = GNUNET_IDENTITY_key_get_length (pk);
+  if (0 > pklen)
+  {
+    GNUNET_break (0);
+    return GNUNET_NO;
+  }
   GNUNET_memcpy (&buf[sizeof(uint64_t) * 2],
                  pk,
-                 GNUNET_IDENTITY_key_get_length (pk));
+                 pklen);
   for (unsigned int i = 0; i < POW_COUNT; i++)
   {
     pow_val = GNUNET_ntohll (pow->pow[i]);
diff --git a/src/rps/gnunet-rps-profiler.c b/src/rps/gnunet-rps-profiler.c
index 82aeffb79..908dcca17 100644
--- a/src/rps/gnunet-rps-profiler.c
+++ b/src/rps/gnunet-rps-profiler.c
@@ -3067,9 +3067,10 @@ run (void *cls,
     }
     else
     {
-      duration = GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS,
-                                                (timeout.rel_value_us / 1000000)
-                                                * 0.75);
+      duration = GNUNET_TIME_relative_multiply (
+          GNUNET_TIME_UNIT_SECONDS,
+          ( (double) timeout.rel_value_us /  (double) 1000000)
+          * 0.75);
     }
   }
   else
diff --git a/src/rps/gnunet-service-rps.c b/src/rps/gnunet-service-rps.c
index dc4c5dab7..56eab288e 100644
--- a/src/rps/gnunet-service-rps.c
+++ b/src/rps/gnunet-service-rps.c
@@ -965,8 +965,6 @@ remove_channel_ctx (struct ChannelCtx *channel_ctx)
     channel_ctx->destruction_task = NULL;
   }
 
-  GNUNET_free (channel_ctx);
-
   if (NULL == peer_ctx)
     return;
   if (channel_ctx == peer_ctx->send_channel_ctx)
@@ -978,6 +976,7 @@ remove_channel_ctx (struct ChannelCtx *channel_ctx)
   {
     peer_ctx->recv_channel_ctx = NULL;
   }
+  GNUNET_free (channel_ctx);
 }
 
 
@@ -2637,7 +2636,7 @@ insert_in_sampler (void *cls,
   }
 #ifdef TO_FILE
   sub->num_observed_peers++;
-  GNUNET_CONTAINER_multipeermap_put
+  (void) GNUNET_CONTAINER_multipeermap_put
     (sub->observed_unique_peers,
     peer,
     NULL,
@@ -2802,7 +2801,7 @@ clean_peer (struct Sub *sub,
                                                              peer))) &&
       (GNUNET_NO == View_contains_peer (sub->view, peer)) &&
       (GNUNET_NO == CustomPeerMap_contains_peer (sub->push_map, peer)) &&
-      (GNUNET_NO == CustomPeerMap_contains_peer (sub->push_map, peer)) &&
+      (GNUNET_NO == CustomPeerMap_contains_peer (sub->pull_map, peer)) &&
       (0 == RPS_sampler_count_id (sub->sampler, peer)) &&
       (GNUNET_YES == check_removable (get_peer_ctx (sub->peer_map, peer))))
   {   /* We can safely remove this peer */
@@ -2836,13 +2835,20 @@ cleanup_destroyed_channel (void *cls,
   (void) channel;
 
   channel_ctx->channel = NULL;
-  remove_channel_ctx (channel_ctx);
   if ((NULL != peer_ctx) &&
       (peer_ctx->send_channel_ctx == channel_ctx) &&
-      (GNUNET_YES == check_sending_channel_needed (channel_ctx->peer_ctx)) )
+      (GNUNET_YES == check_sending_channel_needed (peer_ctx)) )
   {
+    remove_channel_ctx (channel_ctx);
     remove_peer (peer_ctx->sub, &peer_ctx->peer_id);
   }
+  else
+  {
+    /* We need this if-else construct because we need to make sure the channel
+     * (context) is cleaned up before removing the peer, but still neet to
+     * compare it while checking the condition */
+    remove_channel_ctx (channel_ctx);
+  }
 }
 
 
diff --git a/src/rps/gnunet-service-rps_custommap.c b/src/rps/gnunet-service-rps_custommap.c
index 54e361d32..392c29397 100644
--- a/src/rps/gnunet-service-rps_custommap.c
+++ b/src/rps/gnunet-service-rps_custommap.c
@@ -206,6 +206,7 @@ CustomPeerMap_remove_peer (const struct CustomPeerMap *c_peer_map,
   struct GNUNET_PeerIdentity *p;
   uint32_t *last_index;
   struct GNUNET_PeerIdentity *last_p;
+  int ret;
 
   if (GNUNET_NO == CustomPeerMap_contains_peer (c_peer_map,
                                                 peer))
@@ -234,9 +235,11 @@ CustomPeerMap_remove_peer (const struct CustomPeerMap *c_peer_map,
                                                     last_p);
     GNUNET_assert (NULL != last_index);
     GNUNET_assert (CustomPeerMap_size (c_peer_map) == *last_index);
-    GNUNET_CONTAINER_multihashmap32_put (c_peer_map->hash_map,
-                                         *index, last_p,
-                                         GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY);
+    ret = GNUNET_CONTAINER_multihashmap32_put (c_peer_map->hash_map,
+                                               *index,
+                                               last_p,
+                                               GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY);
+    GNUNET_assert (GNUNET_OK == ret);
     GNUNET_CONTAINER_multihashmap32_remove_all (c_peer_map->hash_map,
                                                 *last_index);
     *last_index = *index;
diff --git a/src/rps/rps-test_util.c b/src/rps/rps-test_util.c
index 497225973..6dee20c95 100644
--- a/src/rps/rps-test_util.c
+++ b/src/rps/rps-test_util.c
@@ -152,12 +152,16 @@ close_all_files ()
 {
   int ret;
 
-  ret = GNUNET_CONTAINER_multihashmap_iterate (open_files,
-                                               close_files_iter,
-                                               NULL);
-  GNUNET_CONTAINER_multihashmap_destroy (open_files);
-  open_files = NULL;
-  return ret;
+  if (NULL != open_files)
+  {
+    ret = GNUNET_CONTAINER_multihashmap_iterate (open_files,
+                                                 close_files_iter,
+                                                 NULL);
+    GNUNET_CONTAINER_multihashmap_destroy (open_files);
+    open_files = NULL;
+    return ret;
+  }
+  return GNUNET_YES;
 }
 
 
diff --git a/src/testbed/Makefile.am b/src/testbed/Makefile.am
index 7c1e217bb..7a59670cb 100644
--- a/src/testbed/Makefile.am
+++ b/src/testbed/Makefile.am
@@ -94,6 +94,9 @@ lib_LTLIBRARIES = \
 libgnunettestbed_la_SOURCES = \
   testbed_api.c testbed_api.h testbed.h \
   testbed_api_hosts.c testbed_api_hosts.h testbed_helper.h \
+  testbed_api_cmd_controller.c \
+  testbed_api_cmd_peer.c \
+  testbed_api_cmd_service.c \
   testbed_api_operations.c testbed_api_operations.h \
   testbed_api_peers.c testbed_api_peers.h \
   testbed_api_services.c \
diff --git a/src/testbed/testbed_api_cmd_controller.c b/src/testbed/testbed_api_cmd_controller.c
new file mode 100644
index 000000000..d65f41760
--- /dev/null
+++ b/src/testbed/testbed_api_cmd_controller.c
@@ -0,0 +1,294 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2021 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file testbed/testbed_api_cmd_controller.c
+ * @brief Command to create a controller.
+ * @author t3sserakt
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_testing_ng_lib.h"
+#include "gnunet-service-testbed.h"
+#include "testbed_api_hosts.h"
+#include "gnunet_testbed_ng_service.h"
+
+
+/**
+ * Generic logging shortcut
+ */
+#define LOG(kind, ...)                           \
+  GNUNET_log (kind, __VA_ARGS__)
+
+
+/**
+ * abort task to run on test timed out
+ *
+ * @param cls NULL
+ * @param tc the task context
+ */
+static void
+do_abort (void *cls)
+{
+  struct ControllerState *cs = cls;
+
+  if (GNUNET_NO == cs->host_ready)
+  {
+    LOG (GNUNET_ERROR_TYPE_WARNING, "Test timedout -- Aborting\n");
+    cs->abort_task = NULL;
+    GNUNET_TESTBED_shutdown_controller (cs);
+  }
+}
+
+
+/**
+*
+*
+* @param cls closure
+* @param cmd current CMD being cleaned up.
+*/
+static void
+controller_cleanup (void *cls,
+                    const struct GNUNET_TESTING_Command *cmd)
+{
+  (void) cls;
+}
+
+
+/**
+ * Signature of the event handler function called by the
+ * respective event controller.
+ *
+ * @param cls closure
+ * @param event information about the event
+ */
+static void
+controller_cb (void *cls,
+               const struct GNUNET_TESTBED_EventInformation *event)
+{
+  struct ControllerState *cs = cls;
+
+  if (NULL != event->details.operation_finished.emsg)
+  {
+    LOG (GNUNET_ERROR_TYPE_ERROR, "There was an operation error: %s\n",
+         event->details.operation_finished.emsg);
+    GNUNET_TESTBED_shutdown_controller (cs);
+  }
+  else if (NULL == event->details.operation_finished.generic)
+  {
+    GNUNET_TESTBED_operation_done (event->op);
+  }
+}
+
+
+/**
+ * Callback which will be called to after a host registration succeeded or failed
+ *
+ * @param cls the host which has been registered
+ * @param emsg the error message; NULL if host registration is successful
+ */
+static void
+registration_comp (void *cls,
+                   const char *emsg)
+{
+  struct ControllerState *cs = cls;
+
+  if (NULL != emsg)
+  {
+    LOG (GNUNET_ERROR_TYPE_ERROR,
+         "There was an error during host registration: %s\n",
+         emsg);
+    GNUNET_TESTBED_shutdown_controller (cs);
+  }
+  else
+  {
+    cs->reg_handle = NULL;
+    cs->host_ready = GNUNET_YES;
+    GNUNET_TESTING_interpreter_next (cs->is);
+  }
+}
+
+
+/**
+ * Callback to signal successfull startup of the controller process
+ *
+ * @param cls the closure from GNUNET_TESTBED_controller_start()
+ * @param cfg the configuration with which the controller has been started;
+ *          NULL if status is not #GNUNET_OK
+ * @param status #GNUNET_OK if the startup is successfull; #GNUNET_SYSERR if not,
+ *          GNUNET_TESTBED_controller_stop() shouldn't be called in this case
+ */
+static void
+controller_status_cb (void *cls,
+                      const struct GNUNET_CONFIGURATION_Handle *cfg_,
+                      int status)
+{
+  struct ControllerState *cs = cls;
+
+  if (GNUNET_OK != status)
+  {
+    cs->cp = NULL;
+    return;
+  }
+
+  cs->controller =
+    GNUNET_TESTBED_controller_connect (cs->host, cs->event_mask, &controller_cb,
+                                       cs);
+  cs->reg_handle =
+    GNUNET_TESTBED_register_host (cs->controller, cs->host, &registration_comp,
+                                  cs);
+}
+
+
+static void
+controller_run (void *cls,
+                const struct GNUNET_TESTING_Command *cmd,
+                struct GNUNET_TESTING_Interpreter *is)
+{
+  struct ControllerState *cs = cls;
+
+  cs->is = is;
+  cs->host = GNUNET_TESTBED_host_create (cs->hostname, cs->username, cs->cfg,
+                                         cs->port);
+  cs->cp = GNUNET_TESTBED_controller_start (cs->trusted_ip,
+                                            cs->host,
+                                            &controller_status_cb,
+                                            cs);
+  cs->abort_task =
+    GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_relative_multiply
+                                    (GNUNET_TIME_UNIT_MINUTES, 5),
+                                  &do_abort,
+                                  cs);
+}
+
+/**
+*
+*
+* @param cls closure.
+* @param[out] ret result
+* @param trait name of the trait.
+* @param index index number of the object to offer.
+* @return #GNUNET_OK on success.
+*/
+static int
+controller_traits (void *cls,
+                   const void **ret,
+                   const char *trait,
+                   unsigned int index)
+{
+  (void) cls;
+
+  struct ControllerState *cs = cls;
+
+
+  struct GNUNET_TESTING_Trait traits[] = {
+    {
+      .index = 0,
+      .trait_name = "controller",
+      .ptr = (const void *) cs->controller,
+    },
+    GNUNET_TESTING_trait_end ()
+  };
+
+  return GNUNET_TESTING_get_trait (traits,
+                                   ret,
+                                   trait,
+                                   index);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Offer data from trait
+ *
+ * @param cmd command to extract the controller from.
+ * @param pt pointer to controller.
+ * @return #GNUNET_OK on success.
+ */
+int
+GNUNET_TESTBED_get_trait_controller (const struct GNUNET_TESTING_Command *cmd,
+                                     struct GNUNET_TESTBED_Controller **
+                                     controller)
+{
+  return cmd->traits (cmd->cls,
+                      (const void **) controller,
+                      "controller",
+                      (unsigned int) 0);
+}
+
+
+/**
+ * Shutdown nicely
+ *
+ * @param cs controller state.
+ */
+void
+GNUNET_TESTBED_shutdown_controller (struct ControllerState *cs)
+{
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Shutting down...\n");
+
+  cs->controller_going_down = GNUNET_YES;
+
+  if (NULL != cs->abort_task)
+    GNUNET_SCHEDULER_cancel (cs->abort_task);
+  if (NULL != cs->reg_handle)
+    GNUNET_TESTBED_cancel_registration (cs->reg_handle);
+  if (NULL != cs->controller)
+    GNUNET_TESTBED_controller_disconnect (cs->controller);
+  if (NULL != cs->cfg)
+    GNUNET_CONFIGURATION_destroy (cs->cfg);
+  if (NULL != cs->cp)
+    GNUNET_TESTBED_controller_stop (cs->cp);
+  if (NULL != cs->host)
+    GNUNET_TESTBED_host_destroy (cs->host);
+}
+
+
+
+struct GNUNET_TESTING_Command
+GNUNET_TESTBED_cmd_controller (const char *label,
+                               const char *trusted_ip,
+                               const char *hostname,
+                               const char *username,
+                               uint16_t port,
+                               struct GNUNET_CONFIGURATION_Handle *cfg,
+                               uint64_t event_mask)
+{
+  struct ControllerState *cs;
+
+  cs = GNUNET_new (struct ControllerState);
+  cs->event_mask = event_mask;
+  cs->trusted_ip = trusted_ip;
+  cs->hostname = hostname;
+  cs->username = username;
+  cs->port = port;
+  cs->cfg = cfg;
+
+  struct GNUNET_TESTING_Command cmd = {
+    .cls = cs,
+    .label = label,
+    .run = &controller_run,
+    .cleanup = &controller_cleanup,
+    .traits = &controller_traits
+  };
+
+  return cmd;
+}
diff --git a/src/testbed/testbed_api_cmd_peer.c b/src/testbed/testbed_api_cmd_peer.c
new file mode 100644
index 000000000..4a727bc94
--- /dev/null
+++ b/src/testbed/testbed_api_cmd_peer.c
@@ -0,0 +1,249 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2021 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+
+/**
+ * @file testbed/testbed_api_cmd_controller.c
+ * @brief Command to create a controller.
+ * @author t3sserakt
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_testing_ng_lib.h"
+#include "gnunet_testbed_ng_service.h"
+#include "gnunet-service-testbed.h"
+#include "testbed_api_peers.h"
+
+
+/**
+ * Generic logging shortcut
+ */
+#define LOG(kind, ...)                           \
+  GNUNET_log (kind, __VA_ARGS__)
+
+
+/**
+*
+*
+* @param cls closure.
+* @param[out] ret result
+* @param trait name of the trait.
+* @param index index number of the object to offer.
+* @return #GNUNET_OK on success.
+*/
+static int
+peer_traits (void *cls,
+             const void **ret,
+             const char *trait,
+             unsigned int index)
+{
+  (void) cls;
+  return GNUNET_OK;
+}
+
+
+/**
+*
+*
+* @param cls closure
+* @param cmd current CMD being cleaned up.
+*/
+static void
+peer_cleanup (void *cls,
+              const struct GNUNET_TESTING_Command *cmd)
+{
+  (void) cls;
+}
+
+
+/**
+ * abort task to run on test timed out
+ *
+ * @param cls NULL
+ * @param tc the task context
+ */
+static void
+do_abort (void *cls)
+{
+  struct PeerCmdState *ps = cls;
+
+  if (GNUNET_NO == ps->peer_ready)
+  {
+    LOG (GNUNET_ERROR_TYPE_WARNING, "Test timedout -- Aborting\n");
+    ps->abort_task = NULL;
+    GNUNET_TESTBED_shutdown_peer (ps);
+  }
+}
+
+
+/**
+ * Functions of this signature are called when a peer has been successfully
+ * created
+ *
+ * @param cls the closure from GNUNET_TESTBED_peer_create()
+ * @param emsg MAY contain an error description, if starting peer failed.
+ */
+static void
+peer_started_cb (void *cls,
+                 const char *emsg)
+{
+  struct PeerCmdState *ps = cls;
+
+  GNUNET_TESTBED_operation_done (ps->operation);
+  if (NULL == emsg)
+  {
+    ps->peer_ready = GNUNET_YES;
+    GNUNET_TESTING_interpreter_next (ps->is);
+  }
+  else
+  {
+    LOG (GNUNET_ERROR_TYPE_ERROR, "There was an error starting a peer: %s\n",
+         emsg);
+  }
+
+}
+
+
+/**
+ * Functions of this signature are called when a peer has been successfully
+ * created
+ *
+ * @param cls the closure from GNUNET_TESTBED_peer_create()
+ * @param peer the handle for the created peer; NULL on any error during
+ *          creation
+ * @param emsg NULL if peer is not NULL; else MAY contain the error description
+ */
+static void
+peer_create_cb (void *cls,
+                struct GNUNET_TESTBED_Peer *peer,
+                const char *emsg)
+{
+  struct PeerCmdState *ps = cls;
+
+  ps->peer = peer;
+  GNUNET_TESTBED_operation_done (ps->operation);
+  ps->operation = GNUNET_TESTBED_peer_start (NULL,
+                                             peer,
+                                             &peer_started_cb,
+                                             ps);
+}
+
+
+static void
+peer_run (void *cls,
+          const struct GNUNET_TESTING_Command *cmd,
+          struct GNUNET_TESTING_Interpreter *is)
+{
+  struct PeerCmdState *ps = cls;
+  const struct GNUNET_TESTING_Command *controller_cmd;
+  struct GNUNET_TESTBED_Controller *controller;
+
+  ps->is = is;
+  controller_cmd = GNUNET_TESTING_interpreter_lookup_command (
+    ps->controller_label);
+  GNUNET_TESTBED_get_trait_controller (controller_cmd,
+                                       &controller);
+  ps->host = GNUNET_TESTBED_host_create (ps->hostname, ps->username, ps->cfg,
+                                         ps->port);
+  ps->operation =
+    GNUNET_TESTBED_peer_create (controller,
+                                ps->host,
+                                ps->cfg,
+                                &peer_create_cb,
+                                ps);
+
+  ps->abort_task =
+    GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_relative_multiply
+                                    (GNUNET_TIME_UNIT_MINUTES, 5),
+                                  &do_abort,
+                                  ps);
+}
+
+
+void
+peer_stopped_cb (void *cls,
+                 const char *emsg)
+{
+  struct PeerCmdState *ps = cls;
+
+  if (NULL != emsg)
+  {
+    LOG (GNUNET_ERROR_TYPE_ERROR, "There was an error stopping a peer: %s\n",
+         emsg);
+  }
+  GNUNET_TESTBED_operation_done (ps->operation);
+  GNUNET_TESTBED_peer_destroy (ps->peer);
+}
+
+
+/**
+ * Shutdown nicely
+ *
+ * @param cs controller state.
+ */
+void
+GNUNET_TESTBED_shutdown_peer (struct PeerCmdState *ps)
+{
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Shutting down...\n");
+
+  ps->peer_going_down = GNUNET_YES;
+
+  if (NULL != ps->abort_task)
+    GNUNET_SCHEDULER_cancel (ps->abort_task);
+  if (NULL != ps->cfg)
+    GNUNET_CONFIGURATION_destroy (ps->cfg);
+  if (NULL != ps->host)
+    GNUNET_TESTBED_host_destroy (ps->host);
+
+  GNUNET_TESTBED_operation_done (ps->operation);
+  ps->operation = GNUNET_TESTBED_peer_stop (NULL, ps->peer, peer_stopped_cb,
+                                            ps);
+
+}
+
+
+struct GNUNET_TESTING_Command
+GNUNET_TESTBED_cmd_peer (const char *label,
+                         const char *controller_label,
+                         const char *hostname,
+                         const char *username,
+                         uint16_t port,
+                         struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  struct PeerCmdState *ps;
+
+  ps = GNUNET_new (struct PeerCmdState);
+  ps->hostname = hostname;
+  ps->username = username;
+  ps->port = port;
+  ps->cfg = cfg;
+  ps->controller_label = controller_label;
+
+  struct GNUNET_TESTING_Command cmd = {
+    .cls = ps,
+    .label = label,
+    .run = &peer_run,
+    .cleanup = &peer_cleanup,
+    .traits = &peer_traits
+  };
+
+  return cmd;
+}
diff --git a/src/testbed/testbed_api_cmd_service.c b/src/testbed/testbed_api_cmd_service.c
new file mode 100644
index 000000000..58b3309de
--- /dev/null
+++ b/src/testbed/testbed_api_cmd_service.c
@@ -0,0 +1,140 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2021 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file testbed/testbed_api_cmd_controller.c
+ * @brief Command to create a controller.
+ * @author t3sserakt
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_testing_ng_lib.h"
+#include "gnunet-service-testbed.h"
+#include "testbed_api_hosts.h"
+#include "gnunet_testbed_ng_service.h"
+
+/**
+ * Generic logging shortcut
+ */
+#define LOG(kind, ...)                           \
+  GNUNET_log (kind, __VA_ARGS__)
+
+
+/**
+ * abort task to run on test timed out
+ *
+ * @param cls NULL
+ * @param tc the task context
+ */
+static void
+do_abort (void *cls)
+{
+  struct ServiceState *ss = cls;
+
+  if (GNUNET_NO == ss->service_ready)
+  {
+    LOG (GNUNET_ERROR_TYPE_WARNING, "Test timedout -- Aborting\n");
+    ss->abort_task = NULL;
+    GNUNET_TESTBED_shutdown_service (ss);
+  }
+}
+
+/**
+*
+*
+* @param cls closure
+* @param cmd current CMD being cleaned up.
+*/
+static void
+service_cleanup (void *cls,
+                 const struct GNUNET_TESTING_Command *cmd)
+{
+  (void) cls;
+}
+
+/**
+*
+*
+* @param cls closure.
+* @param[out] ret result
+* @param trait name of the trait.
+* @param index index number of the object to offer.
+* @return #GNUNET_OK on success.
+*/
+static int
+service_traits (void *cls,
+                const void **ret,
+                const char *trait,
+                unsigned int index)
+{
+  (void) cls;
+  return GNUNET_OK;
+}
+
+static void
+service_run (void *cls,
+             const struct GNUNET_TESTING_Command *cmd,
+             struct GNUNET_TESTING_Interpreter *is)
+{
+  struct ServiceState *ss = cls;
+
+  // TODO this is unfinished code!
+  ss->operation =
+    GNUNET_TESTBED_service_connect (NULL, NULL, NULL,
+                                    NULL, NULL,
+                                    NULL,
+                                    NULL, NULL);
+
+}
+
+/**
+ * Shutdown nicely
+ *
+ * @param cs service state.
+ */
+void
+GNUNET_TESTBED_shutdown_service (struct ServiceState *cs)
+{
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Shutting down...\n");
+}
+
+
+struct GNUNET_TESTING_Command
+GNUNET_TESTBED_cmd_service (const char *label,
+                            const char *peer_label,
+                            const char *servicename)
+{
+  struct ServiceState *ss;
+
+  ss = GNUNET_new (struct ServiceState);
+  ss->servicename = servicename;
+  ss->peer_label = peer_label;
+
+  struct GNUNET_TESTING_Command cmd = {
+    .cls = ss,
+    .label = label,
+    .run = &service_run,
+    .cleanup = &service_cleanup,
+    .traits = &service_traits
+  };
+
+  return cmd;
+}
diff --git a/src/testing/testing_api_cmd_hello_world_birth.c b/src/testing/testing_api_cmd_hello_world_birth.c
index 546b30212..0faf93cd8 100644
--- a/src/testing/testing_api_cmd_hello_world_birth.c
+++ b/src/testing/testing_api_cmd_hello_world_birth.c
@@ -118,10 +118,8 @@ hello_world_birth_run (void *cls,
 /**
  * Offer data from trait
  *
- * @param cmd command to extract the url from.
- * @param pt which url is to be picked, in case
- *        multiple are offered.
- * @param[out] url where to write the url.
+ * @param cmd command to extract the message from.
+ * @param pt pointer to message.
  * @return #GNUNET_OK on success.
  */
 int
diff --git a/src/transport/gnunet-communicator-tcp.c b/src/transport/gnunet-communicator-tcp.c
index c8a4c0375..9dd2797df 100644
--- a/src/transport/gnunet-communicator-tcp.c
+++ b/src/transport/gnunet-communicator-tcp.c
@@ -877,12 +877,14 @@ queue_destroy (struct Queue *queue)
 {
   struct ListenTask *lt = NULL;
   struct GNUNET_HashCode h_sock;
+  int sockfd;
 
-  GNUNET_CRYPTO_hash (queue->listen_sock,
-                      sizeof(queue->listen_sock),
+  sockfd = GNUNET_NETWORK_get_fd (queue->listen_sock);
+  GNUNET_CRYPTO_hash (&sockfd,
+                      sizeof(int),
                       &h_sock);
 
-  lt =   GNUNET_CONTAINER_multihashmap_get (lt_map, &h_sock);
+  lt = GNUNET_CONTAINER_multihashmap_get (lt_map, &h_sock);
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Disconnecting queue for peer `%s'\n",
@@ -1263,7 +1265,8 @@ rekey_monotime_cb (void *cls,
                                                      pid,
                                                      GNUNET_PEERSTORE_TRANSPORT_TCP_COMMUNICATOR_REKEY,
                                                      rekey_monotonic_time,
-                                                     sizeof(rekey_monotonic_time),
+                                                     sizeof(*
+                                                            rekey_monotonic_time),
                                                      GNUNET_TIME_UNIT_FOREVER_ABS,
                                                      GNUNET_PEERSTORE_STOREOPTION_REPLACE,
                                                      &rekey_monotime_store_cb,
@@ -1413,18 +1416,18 @@ handshake_ack_monotime_cb (void *cls,
     queue_finish (queue);
     return;
   }
-  queue->handshake_ack_monotime_sc = GNUNET_PEERSTORE_store (peerstore,
-                                                             "transport_tcp_communicator",
-                                                             pid,
-                                                             GNUNET_PEERSTORE_TRANSPORT_TCP_COMMUNICATOR_HANDSHAKE_ACK,
-                                                             handshake_ack_monotonic_time,
-                                                             sizeof(
-                                                               handshake_ack_monotonic_time),
-                                                             GNUNET_TIME_UNIT_FOREVER_ABS,
-                                                             GNUNET_PEERSTORE_STOREOPTION_REPLACE,
-                                                             &
-                                                             handshake_ack_monotime_store_cb,
-                                                             queue);
+  queue->handshake_ack_monotime_sc =
+    GNUNET_PEERSTORE_store (peerstore,
+                            "transport_tcp_communicator",
+                            pid,
+                            GNUNET_PEERSTORE_TRANSPORT_TCP_COMMUNICATOR_HANDSHAKE_ACK,
+                            handshake_ack_monotonic_time,
+                            sizeof(*handshake_ack_monotonic_time),
+                            GNUNET_TIME_UNIT_FOREVER_ABS,
+                            GNUNET_PEERSTORE_STOREOPTION_REPLACE,
+                            &
+                            handshake_ack_monotime_store_cb,
+                            queue);
 }
 
 
@@ -3255,6 +3258,7 @@ init_socket (struct sockaddr *addr,
   socklen_t sto_len;
   struct GNUNET_NETWORK_Handle *listen_sock;
   struct ListenTask *lt;
+  int sockfd;
   struct GNUNET_HashCode h_sock;
 
   if (NULL == addr)
@@ -3343,8 +3347,9 @@ init_socket (struct sockaddr *addr,
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "creating hash\n");
-  GNUNET_CRYPTO_hash (lt->listen_sock,
-                      sizeof(lt->listen_sock),
+  sockfd = GNUNET_NETWORK_get_fd (lt->listen_sock);
+  GNUNET_CRYPTO_hash (&sockfd,
+                      sizeof(int),
                       &h_sock);
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
@@ -3564,6 +3569,7 @@ run (void *cls,
   peerstore = GNUNET_PEERSTORE_connect (cfg);
   if (NULL == peerstore)
   {
+    GNUNET_free (bindto);
     GNUNET_break (0);
     GNUNET_SCHEDULER_shutdown ();
     return;
@@ -3596,7 +3602,6 @@ run (void *cls,
     GNUNET_free (po);
     nat_register ();
     GNUNET_free (bindto);
-
     return;
   }
 
@@ -3609,8 +3614,8 @@ run (void *cls,
     in = tcp_address_to_sockaddr_numeric_v4 (&in_len, v4, bind_port);
     init_socket (in, in_len);
     nat_register ();
+    GNUNET_free (start);
     GNUNET_free (bindto);
-
     return;
   }
 
@@ -3620,8 +3625,8 @@ run (void *cls,
     in = tcp_address_to_sockaddr_numeric_v6 (&in_len, v6, bind_port);
     init_socket (in, in_len);
     nat_register ();
+    GNUNET_free (start);
     GNUNET_free (bindto);
-
     return;
   }
 
@@ -3635,6 +3640,7 @@ run (void *cls,
                                                    &init_socket_resolv,
                                                    &port);
   GNUNET_free (bindto);
+  GNUNET_free (start);
 }
 
 
diff --git a/src/transport/gnunet-communicator-udp.c b/src/transport/gnunet-communicator-udp.c
index 415dc4b48..d75f4ae00 100644
--- a/src/transport/gnunet-communicator-udp.c
+++ b/src/transport/gnunet-communicator-udp.c
@@ -1492,16 +1492,9 @@ add_acks (struct SharedSecret *ss, int acks_to_add)
 
   struct ReceiverAddress *receiver = ss->receiver;
 
-  if (NULL == ss)
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "secret NULL!\n");
-
-  if (NULL == receiver)
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "Receiver NULL!\n");
-  if (NULL == receiver->d_qh)
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "Queue NULL!\n");
+  GNUNET_assert (NULL != ss);
+  GNUNET_assert (NULL != receiver);
+  GNUNET_assert (NULL != receiver->d_qh);
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Tell transport we have %u more acks!\n",
diff --git a/src/transport/gnunet-service-tng.c b/src/transport/gnunet-service-tng.c
index 3cba49250..cbf795eea 100644
--- a/src/transport/gnunet-service-tng.c
+++ b/src/transport/gnunet-service-tng.c
@@ -6976,7 +6976,6 @@ handle_dv_learn (void *cls, const struct TransportDVLearnMessage *dvl)
   if (MAX_DV_HOPS_ALLOWED == nhops)
   {
     /* At limit, we're out of here! */
-    finish_cmc_handling (cmc);
     return;
   }
 
@@ -9640,11 +9639,13 @@ handle_add_queue_message (void *cls,
   {
     if (queue->qid != aqm->qid)
       continue;
-    neighbour = queue->neighbour;
     break;
   }
-  if (NULL == queue)
+
+  if (NULL != queue)
   {
+    neighbour = queue->neighbour;
+  } else {
     neighbour = lookup_neighbour (&aqm->receiver);
     if (NULL == neighbour)
     {
diff --git a/src/transport/transport-testing-communicator.c b/src/transport/transport-testing-communicator.c
index de356fb9c..040f16d5d 100644
--- a/src/transport/transport-testing-communicator.c
+++ b/src/transport/transport-testing-communicator.c
@@ -548,6 +548,11 @@ handle_update_queue_message (void *cls,
       tc_queue = tc_queue->next;
     }
   }
+  if (NULL == tc_queue)
+  {
+    GNUNET_SERVICE_client_continue (client->client);
+    return;
+  }
   GNUNET_assert (tc_queue->qid == msg->qid);
   GNUNET_assert (0 == GNUNET_memcmp (&tc_queue->peer_id, &msg->receiver));
   tc_queue->nt = msg->nt;
diff --git a/src/util/Makefile.am b/src/util/Makefile.am
index 6b9e083a7..e2614e5e3 100644
--- a/src/util/Makefile.am
+++ b/src/util/Makefile.am
@@ -25,6 +25,11 @@ if ENABLE_BENCHMARK
   PTHREAD = -lpthread
 endif
 
+if HAVE_NOLIBGCRYPT19
+  DLOG = crypto_ecc_dlog.c
+  DLOG_TEST = test_crypto_ecc_dlog
+endif
+
 gnunet_config_diff_SOURCES = \
  gnunet-config-diff.c
 gnunet_config_diff_LDADD = \
@@ -58,7 +63,7 @@ libgnunetutil_la_SOURCES = \
   crypto_symmetric.c \
   crypto_crc.c \
   crypto_ecc.c \
-  crypto_ecc_dlog.c \
+  $(DLOG) \
   crypto_ecc_setup.c \
   crypto_hash.c \
   crypto_hash_file.c \
@@ -248,7 +253,6 @@ libgnunet_plugin_test_la_LDFLAGS = \
 if HAVE_BENCHMARKS
  BENCHMARKS = \
   perf_crypto_hash \
-  perf_crypto_ecc_dlog \
   perf_crypto_rsa \
   perf_crypto_paillier \
   perf_crypto_symmetric \
@@ -256,6 +260,10 @@ if HAVE_BENCHMARKS
   perf_malloc \
   perf_mq \
   perf_scheduler
+
+if HAVE_NOLIBGCRYPT19
+  BENCHMARKS += perf_crypto_ecc_dlog
+endif
 endif
 
 if HAVE_SSH_KEY
@@ -287,7 +295,7 @@ check_PROGRAMS = \
  test_crypto_ecdhe \
  test_crypto_ecdh_eddsa \
  test_crypto_ecdh_ecdsa \
- test_crypto_ecc_dlog \
+ $(DLOG_TEST) \
  test_crypto_hash \
  test_crypto_hash_context \
  test_crypto_hkdf \
@@ -448,11 +456,13 @@ test_crypto_eddsa_LDADD = \
  libgnunetutil.la \
  $(LIBGCRYPT_LIBS)
 
+if HAVE_NOLIBGCRYPT19
 test_crypto_ecc_dlog_SOURCES = \
  test_crypto_ecc_dlog.c
 test_crypto_ecc_dlog_LDADD = \
  libgnunetutil.la \
  $(LIBGCRYPT_LIBS)
+endif
 
 test_crypto_ecdhe_SOURCES = \
  test_crypto_ecdhe.c
@@ -595,11 +605,13 @@ perf_crypto_hash_SOURCES = \
 perf_crypto_hash_LDADD = \
  libgnunetutil.la
 
+if HAVE_NOLIBGCRYPT19
 perf_crypto_ecc_dlog_SOURCES = \
  perf_crypto_ecc_dlog.c
 perf_crypto_ecc_dlog_LDADD = \
  libgnunetutil.la \
  -lgcrypt
+endif
 
 perf_crypto_rsa_SOURCES = \
  perf_crypto_rsa.c
diff --git a/src/util/configuration.c b/src/util/configuration.c
index bda643b83..3294d11f4 100644
--- a/src/util/configuration.c
+++ b/src/util/configuration.c
@@ -606,6 +606,7 @@ GNUNET_CONFIGURATION_write (struct GNUNET_CONFIGURATION_Handle *cfg,
     if (NULL == h)
     {
       GNUNET_free (fn);
+      GNUNET_free (cfg_buf);
       return GNUNET_SYSERR;
     }
     if (((ssize_t) size) !=
diff --git a/src/util/container_meta_data.c b/src/util/container_meta_data.c
index b66a7b258..efaac1136 100644
--- a/src/util/container_meta_data.c
+++ b/src/util/container_meta_data.c
@@ -964,6 +964,9 @@ GNUNET_CONTAINER_meta_data_serialize (const struct GNUNET_CONTAINER_MetaData
     {
       /* does not fit! */
       GNUNET_free (ent);
+      if (NULL != cdata)
+        GNUNET_free (cdata);
+      cdata = NULL;
       return GNUNET_SYSERR;
     }
 
@@ -976,9 +979,9 @@ GNUNET_CONTAINER_meta_data_serialize (const struct GNUNET_CONTAINER_MetaData
     if (NULL != pos->mime_type)
       left -= strlen (pos->mime_type) + 1;
 
-    GNUNET_free (cdata);
+    if (NULL != cdata)
+      GNUNET_free (cdata);
     cdata = NULL;
-
     i++;
   }
   GNUNET_free (ent);
diff --git a/src/util/crypto_rsa.c b/src/util/crypto_rsa.c
index 63232cab6..5e4c4d1e6 100644
--- a/src/util/crypto_rsa.c
+++ b/src/util/crypto_rsa.c
@@ -863,6 +863,7 @@ rsa_sign_mpi (const struct GNUNET_CRYPTO_RsaPrivateKey *key,
          __FILE__,
          __LINE__,
          gcry_strerror (rc));
+    gcry_sexp_release (data);
     GNUNET_break (0);
     return NULL;
   }
diff --git a/src/util/gnunet-crypto-tvg.c b/src/util/gnunet-crypto-tvg.c
index 8949f427c..28e44e28b 100644
--- a/src/util/gnunet-crypto-tvg.c
+++ b/src/util/gnunet-crypto-tvg.c
@@ -128,6 +128,7 @@ d2j (json_t *vec,
   json_object_set_new (vec, label, json);
 }
 
+
 /**
  * Add a number to a test vector.
  *
@@ -138,8 +139,8 @@ d2j (json_t *vec,
  */
 static void
 uint2j (json_t *vec,
-     const char *label,
-     unsigned int num)
+        const char *label,
+        unsigned int num)
 {
   json_t *json = json_integer (num);
 
@@ -154,7 +155,7 @@ expect_data_fixed (json_t *vec,
                    size_t expect_len)
 {
   const char *s = json_string_value (json_object_get (vec, name));
-  
+
   if (NULL == s)
     return GNUNET_NO;
 
@@ -166,6 +167,7 @@ expect_data_fixed (json_t *vec,
   return GNUNET_OK;
 }
 
+
 static int
 expect_data_dynamic (json_t *vec,
                      const char *name,
@@ -173,6 +175,7 @@ expect_data_dynamic (json_t *vec,
                      size_t *ret_len)
 {
   const char *s = json_string_value (json_object_get (vec, name));
+  char *tmp;
   size_t len;
 
   if (NULL == s)
@@ -181,10 +184,14 @@ expect_data_dynamic (json_t *vec,
   len = (strlen (s) * 5) / 8;
   if (NULL != ret_len)
     *ret_len = len;
-  *data = GNUNET_malloc (len);
+  tmp = GNUNET_malloc (len);
 
-  if (GNUNET_OK != GNUNET_STRINGS_string_to_data (s, strlen (s), *data, len))
+  if (GNUNET_OK != GNUNET_STRINGS_string_to_data (s, strlen (s), tmp, len))
+  {
+    GNUNET_free (tmp);
     return GNUNET_NO;
+  }
+  *data = tmp;
   return GNUNET_OK;
 }
 
@@ -197,7 +204,7 @@ expect_data_dynamic (json_t *vec,
  *
  * @returns GNUNET_OK if the vector is okay
  */
-static int 
+static int
 checkvec (const char *operation,
           json_t *vec)
 {
@@ -220,10 +227,11 @@ checkvec (const char *operation,
       return GNUNET_SYSERR;
     }
     if (GNUNET_OK != expect_data_fixed (vec,
-                                 "output",
-                                 &hash_out,
-                                 sizeof (hash_out)))
+                                        "output",
+                                        &hash_out,
+                                        sizeof (hash_out)))
     {
+      GNUNET_free (data);
       GNUNET_break (0);
       return GNUNET_NO;
     }
@@ -232,9 +240,11 @@ checkvec (const char *operation,
 
     if (0 != GNUNET_memcmp (&hc, &hash_out))
     {
+      GNUNET_free (data);
       GNUNET_break (0);
       return GNUNET_NO;
     }
+    GNUNET_free (data);
   }
   else if (0 == strcmp (operation, "ecc_ecdh"))
   {
@@ -245,33 +255,33 @@ checkvec (const char *operation,
     struct GNUNET_HashCode skm_comp;
 
     if (GNUNET_OK != expect_data_fixed (vec,
-                                 "priv1",
-                                 &priv1,
-                                 sizeof (priv1)))
+                                        "priv1",
+                                        &priv1,
+                                        sizeof (priv1)))
     {
       GNUNET_break (0);
       return GNUNET_NO;
     }
     if (GNUNET_OK != expect_data_fixed (vec,
-                                 "priv2",
-                                 &priv2,
-                                 sizeof (priv2)))
+                                        "priv2",
+                                        &priv2,
+                                        sizeof (priv2)))
     {
       GNUNET_break (0);
       return GNUNET_NO;
     }
     if (GNUNET_OK != expect_data_fixed (vec,
-                                 "pub1",
-                                 &pub1,
-                                 sizeof (pub1)))
+                                        "pub1",
+                                        &pub1,
+                                        sizeof (pub1)))
     {
       GNUNET_break (0);
       return GNUNET_NO;
     }
     if (GNUNET_OK != expect_data_fixed (vec,
-                                 "skm",
-                                 &skm,
-                                 sizeof (skm)))
+                                        "skm",
+                                        &skm,
+                                        sizeof (skm)))
     {
       GNUNET_break (0);
       return GNUNET_NO;
@@ -407,6 +417,8 @@ checkvec (const char *operation,
                                           &ikm,
                                           &ikm_len))
     {
+      GNUNET_free (out);
+      GNUNET_free (out_comp);
       GNUNET_break (0);
       return GNUNET_SYSERR;
     }
@@ -416,6 +428,9 @@ checkvec (const char *operation,
                                           &salt,
                                           &salt_len))
     {
+      GNUNET_free (out);
+      GNUNET_free (out_comp);
+      GNUNET_free (ikm);
       GNUNET_break (0);
       return GNUNET_SYSERR;
     }
@@ -425,6 +440,10 @@ checkvec (const char *operation,
                                           &ctx,
                                           &ctx_len))
     {
+      GNUNET_free (out);
+      GNUNET_free (out_comp);
+      GNUNET_free (ikm);
+      GNUNET_free (salt);
       GNUNET_break (0);
       return GNUNET_SYSERR;
     }
@@ -442,10 +461,19 @@ checkvec (const char *operation,
 
     if (0 != memcmp (out, out_comp, out_len))
     {
+      GNUNET_free (out);
+      GNUNET_free (out_comp);
+      GNUNET_free (ikm);
+      GNUNET_free (salt);
+      GNUNET_free (ctx);
       GNUNET_break (0);
       return GNUNET_NO;
     }
-
+    GNUNET_free (out);
+    GNUNET_free (out_comp);
+    GNUNET_free (ikm);
+    GNUNET_free (salt);
+    GNUNET_free (ctx);
   }
   else if (0 == strcmp (operation, "eddsa_ecdh"))
   {
@@ -562,6 +590,7 @@ checkvec (const char *operation,
                                           &public_enc_data,
                                           &public_enc_len))
     {
+      GNUNET_free (blinded_data);
       GNUNET_break (0);
       return GNUNET_SYSERR;
     }
@@ -571,6 +600,8 @@ checkvec (const char *operation,
                                           &secret_enc_data,
                                           &secret_enc_len))
     {
+      GNUNET_free (blinded_data);
+      GNUNET_free (public_enc_data);
       GNUNET_break (0);
       return GNUNET_SYSERR;
     }
@@ -580,6 +611,9 @@ checkvec (const char *operation,
                                           &sig_enc_data,
                                           &sig_enc_length))
     {
+      GNUNET_free (blinded_data);
+      GNUNET_free (public_enc_data);
+      GNUNET_free (secret_enc_data);
       GNUNET_break (0);
       return GNUNET_SYSERR;
     }
@@ -601,6 +635,11 @@ checkvec (const char *operation,
                                                             blinded_data_comp,
                                                             blinded_len)) )
     {
+      GNUNET_free (blinded_data);
+      GNUNET_free (public_enc_data);
+      GNUNET_free (secret_enc_data);
+      GNUNET_free (sig_enc_data);
+      GNUNET_free (skey);
       GNUNET_break (0);
       return GNUNET_NO;
     }
@@ -611,14 +650,27 @@ checkvec (const char *operation,
                                                            pkey));
     public_enc_len = GNUNET_CRYPTO_rsa_public_key_encode (pkey,
                                                           &public_enc_data);
-    sig_enc_length_comp = GNUNET_CRYPTO_rsa_signature_encode (sig, &sig_enc_data_comp);
+    sig_enc_length_comp = GNUNET_CRYPTO_rsa_signature_encode (sig,
+                                                              &sig_enc_data_comp);
 
     if ( (sig_enc_length != sig_enc_length_comp) ||
          (0 != memcmp (sig_enc_data, sig_enc_data_comp, sig_enc_length) ))
     {
+      GNUNET_free (blinded_sig);
+      GNUNET_free (blinded_data);
+      GNUNET_free (public_enc_data);
+      GNUNET_free (secret_enc_data);
+      GNUNET_free (sig_enc_data);
+      GNUNET_free (skey);
       GNUNET_break (0);
       return GNUNET_NO;
     }
+    GNUNET_free (blinded_sig);
+    GNUNET_free (blinded_data);
+    GNUNET_free (public_enc_data);
+    GNUNET_free (secret_enc_data);
+    GNUNET_free (sig_enc_data);
+    GNUNET_free (skey);
   }
   else
   {
@@ -629,6 +681,7 @@ checkvec (const char *operation,
   return GNUNET_OK;
 }
 
+
 /**
  * Check test vectors from stdin.
  *
@@ -656,7 +709,7 @@ check_vectors ()
     return 1;
   }
   vectors = json_object_get (vecfile, "vectors");
-  if (!json_is_array (vectors))
+  if (! json_is_array (vectors))
   {
     GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "bad vectors\n");
     json_decref (vecfile);
@@ -692,6 +745,7 @@ check_vectors ()
   }
 }
 
+
 /**
  * Output test vectors.
  *
@@ -868,20 +922,20 @@ output_vectors ()
     GNUNET_CRYPTO_ecdh_eddsa (&priv_ecdhe, &pub_eddsa, &key_material);
 
     d2j (vec, "priv_ecdhe",
-                  &priv_ecdhe,
-                  sizeof (struct GNUNET_CRYPTO_EcdhePrivateKey));
+         &priv_ecdhe,
+         sizeof (struct GNUNET_CRYPTO_EcdhePrivateKey));
     d2j (vec, "pub_ecdhe",
-                  &pub_ecdhe,
-                  sizeof (struct GNUNET_CRYPTO_EcdhePublicKey));
+         &pub_ecdhe,
+         sizeof (struct GNUNET_CRYPTO_EcdhePublicKey));
     d2j (vec, "priv_eddsa",
-                  &priv_eddsa,
-                  sizeof (struct GNUNET_CRYPTO_EddsaPrivateKey));
+         &priv_eddsa,
+         sizeof (struct GNUNET_CRYPTO_EddsaPrivateKey));
     d2j (vec, "pub_eddsa",
-                  &pub_eddsa,
-                  sizeof (struct GNUNET_CRYPTO_EddsaPublicKey));
+         &pub_eddsa,
+         sizeof (struct GNUNET_CRYPTO_EddsaPublicKey));
     d2j (vec, "key_material",
-                  &key_material,
-                  sizeof (struct GNUNET_HashCode));
+         &key_material,
+         sizeof (struct GNUNET_HashCode));
   }
 
   {
@@ -968,6 +1022,7 @@ output_vectors ()
     GNUNET_free (blinded_data);
     GNUNET_free (sig_enc_data);
     GNUNET_free (blinded_sig_enc_data);
+    GNUNET_free (secret_enc_data);
   }
 
   json_dumpf (vecfile, stdout, JSON_INDENT (2));
@@ -977,6 +1032,7 @@ output_vectors ()
   return 0;
 }
 
+
 /**
  * Main function that will be run.
  *
diff --git a/src/util/os_installation.c b/src/util/os_installation.c
index d1e5e0da5..02d4d439d 100644
--- a/src/util/os_installation.c
+++ b/src/util/os_installation.c
@@ -736,7 +736,12 @@ GNUNET_OS_get_suid_binary_path (const struct GNUNET_CONFIGURATION_Handle *cfg,
                                            "SUID_BINARY_PATH",
                                            &path);
   if ((NULL == path) || (0 == strlen (path)))
+  {
+    if (NULL != path)
+      GNUNET_free (path);
+    cache = NULL;
     return GNUNET_OS_get_libexec_binary_path (progname);
+  }
   path_len = strlen (path);
   GNUNET_asprintf (&binary,
                    "%s%s%s",