Merge branch 'master' of ssh://git.gnunet.org/gnunet

152 files changed, 7779 insertions, 4549 deletions

diff --git a/src/ats/ats.conf.in b/src/ats/ats.conf.in
index 4abddd99c..2c65869dd 100644
--- a/src/ats/ats.conf.in
+++ b/src/ats/ats.conf.in
@@ -15,8 +15,8 @@ MODE = proportional
 # IMPORTANT: Do not lower those quotas below 10 MiB
 # Or your peer may not bootstrap correctly.
 # Network specific inbound/outbound quotas
-UNSPECIFIED_QUOTA_IN = 10 MiB
-UNSPECIFIED_QUOTA_OUT = 10 MiB
+UNSPECIFIED_QUOTA_IN = unlimited
+UNSPECIFIED_QUOTA_OUT = unlimited
 # LOOPBACK
 LOOPBACK_QUOTA_IN = unlimited
 LOOPBACK_QUOTA_OUT = unlimited
@@ -27,8 +27,8 @@ LAN_QUOTA_OUT = unlimited
 WAN_QUOTA_IN = 10 MiB
 WAN_QUOTA_OUT = 10 MiB
 # WLAN
-WLAN_QUOTA_IN = 10 MiB
-WLAN_QUOTA_OUT = 10 MiB
+WLAN_QUOTA_IN = unlimited
+WLAN_QUOTA_OUT = unlimited
 # BLUETOOTH
 BLUETOOTH_QUOTA_IN = 10 MiB
 BLUETOOTH_QUOTA_OUT = 10 MiB
@@ -38,7 +38,7 @@ BLUETOOTH_QUOTA_OUT = 10 MiB
 # How proportional to preferences is bandwidth distribution in a network
 # 1.0: Fair with respect to addresses without preferences
 # > 1.0: The bigger, the more respect is paid to preferences
-PROP_PROPORTIONALITY_FACTOR = 2.00
-# Should we stick to existing connections are prefer to switch?
+PROP_PROPORTIONALITY_FACTOR = 10.00
+# Should we stick to existing connections or prefer to switch?
 # [1.0...2.0], lower value prefers to switch, bigger value is more tolerant
 PROP_STABILITY_FACTOR = 1.25
diff --git a/src/ats/gnunet-ats-solver-eval.c b/src/ats/gnunet-ats-solver-eval.c
index 25b963532..ba7994686 100644
--- a/src/ats/gnunet-ats-solver-eval.c
+++ b/src/ats/gnunet-ats-solver-eval.c
@@ -442,7 +442,7 @@ GNUNET_ATS_solver_logging_write_to_disk (struct LoggingHandle *l, int
     }
   }
 
-cleanup:
+  cleanup:
   next = lf_head;
   for (cur = next; NULL != cur; cur = next)
   {
@@ -1414,7 +1414,8 @@ load_op_add_address (struct GNUNET_ATS_TEST_Operation *o,
   }
   else
   {
-    GNUNET_STRINGS_utf8_toupper (op_network, op_network);
+    GNUNET_break (GNUNET_OK == GNUNET_STRINGS_utf8_toupper (op_network,
+                                                            op_network));
     if (0 == strcmp (op_network, "UNSPECIFIED"))
     {
       o->address_network = GNUNET_NT_UNSPECIFIED;
diff --git a/src/block/bg_bf.c b/src/block/bg_bf.c
index ae8ee0e51..601f605a2 100644
--- a/src/block/bg_bf.c
+++ b/src/block/bg_bf.c
@@ -61,7 +61,7 @@ struct BfGroupInternals
  * @return #GNUNET_OK on success, #GNUNET_NO if serialization is not
  *         supported, #GNUNET_SYSERR on error
  */
-static int
+static enum GNUNET_GenericReturnValue
 bf_group_serialize_cb (struct GNUNET_BLOCK_Group *bg,
                        uint32_t *nonce,
                        void **raw_data,
@@ -124,7 +124,7 @@ bf_group_mark_seen_cb (struct GNUNET_BLOCK_Group *bg,
  * @return #GNUNET_OK on success, #GNUNET_NO if the nonces were different and thus
  *         we failed.
  */
-static int
+static enum GNUNET_GenericReturnValue
 bf_group_merge_cb (struct GNUNET_BLOCK_Group *bg1,
                    const struct GNUNET_BLOCK_Group *bg2)
 {
diff --git a/src/block/block.c b/src/block/block.c
index 5824946f7..2e3c1dc70 100644
--- a/src/block/block.c
+++ b/src/block/block.c
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet.
-     Copyright (C) 2010, 2017, 2021 GNUnet e.V.
+     Copyright (C) 2010, 2017, 2021, 2022 GNUnet e.V.
 
      GNUnet is free software: you can redistribute it and/or modify it
      under the terms of the GNU Affero General Public License as published
@@ -255,35 +255,6 @@ GNUNET_BLOCK_group_create (struct GNUNET_BLOCK_Context *ctx,
 }
 
 
-enum GNUNET_BLOCK_EvaluationResult
-GNUNET_BLOCK_evaluate (struct GNUNET_BLOCK_Context *ctx,
-                       enum GNUNET_BLOCK_Type type,
-                       struct GNUNET_BLOCK_Group *group,
-                       enum GNUNET_BLOCK_EvaluationOptions eo,
-                       const struct GNUNET_HashCode *query,
-                       const void *xquery,
-                       size_t xquery_size,
-                       const void *reply_block,
-                       size_t reply_block_size)
-{
-  struct GNUNET_BLOCK_PluginFunctions *plugin = find_plugin (ctx,
-                                                             type);
-
-  if (NULL == plugin)
-    return GNUNET_BLOCK_EVALUATION_TYPE_NOT_SUPPORTED;
-  return plugin->evaluate (plugin->cls,
-                           ctx,
-                           type,
-                           group,
-                           eo,
-                           query,
-                           xquery,
-                           xquery_size,
-                           reply_block,
-                           reply_block_size);
-}
-
-
 enum GNUNET_GenericReturnValue
 GNUNET_BLOCK_get_key (struct GNUNET_BLOCK_Context *ctx,
                       enum GNUNET_BLOCK_Type type,
@@ -327,7 +298,6 @@ GNUNET_BLOCK_check_query (struct GNUNET_BLOCK_Context *ctx,
 enum GNUNET_GenericReturnValue
 GNUNET_BLOCK_check_block (struct GNUNET_BLOCK_Context *ctx,
                           enum GNUNET_BLOCK_Type type,
-                          const struct GNUNET_HashCode *query,
                           const void *block,
                           size_t block_size)
 {
@@ -338,7 +308,6 @@ GNUNET_BLOCK_check_block (struct GNUNET_BLOCK_Context *ctx,
     return GNUNET_SYSERR;
   return plugin->check_block (plugin->cls,
                               type,
-                              query,
                               block,
                               block_size);
 }
diff --git a/src/block/plugin_block_template.c b/src/block/plugin_block_template.c
index 13d9adfda..dcaf1afaa 100644
--- a/src/block/plugin_block_template.c
+++ b/src/block/plugin_block_template.c
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet
-     Copyright (C) 2010 GNUnet e.V.
+     Copyright (C) 2010, 2021, 2022 GNUnet e.V.
 
      GNUnet is free software: you can redistribute it and/or modify it
      under the terms of the GNU Affero General Public License as published
@@ -92,49 +92,6 @@ block_plugin_template_create_group (void *cls,
 
 
 /**
- * Function called to validate a reply or a request.  For
- * request evaluation, simply pass "NULL" for the reply_block.
- *
- * @param cls closure
- * @param ctx context
- * @param type block type
- * @param group block group to use
- * @param eo control flags
- * @param query original query (hash)
- * @param xquery extrended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in xquery
- * @param reply_block response to validate
- * @param reply_block_size number of bytes in reply block
- * @return characterization of result
- */
-static enum GNUNET_BLOCK_EvaluationResult
-block_plugin_template_evaluate (void *cls,
-                                struct GNUNET_BLOCK_Context *ctx,
-                                enum GNUNET_BLOCK_Type type,
-                                struct GNUNET_BLOCK_Group *group,
-                                enum GNUNET_BLOCK_EvaluationOptions eo,
-                                const struct GNUNET_HashCode *query,
-                                const void *xquery,
-                                size_t xquery_size,
-                                const void *reply_block,
-                                size_t reply_block_size)
-{
-  struct GNUNET_HashCode chash;
-
-  if (NULL == reply_block)
-    return GNUNET_BLOCK_EVALUATION_REQUEST_VALID;
-  GNUNET_CRYPTO_hash (reply_block,
-                      reply_block_size,
-                      &chash);
-  if (GNUNET_YES ==
-      GNUNET_BLOCK_GROUP_bf_test_and_set (group,
-                                          &chash))
-    return GNUNET_BLOCK_EVALUATION_OK_DUPLICATE;
-  return GNUNET_BLOCK_EVALUATION_TYPE_NOT_SUPPORTED;
-}
-
-
-/**
  * Function called to validate a query.
  *
  * @param cls closure
@@ -143,16 +100,16 @@ block_plugin_template_evaluate (void *cls,
  * @param query original query (hash)
  * @param xquery extrended query data (can be NULL, depending on type)
  * @param xquery_size number of bytes in @a xquery
- * @return #GNUNET_OK if the query is fine, #GNUNET_NO if not
+ * @return #GNUNET_OK if the query is fine, #GNUNET_NO if not, #GNUNET_SYSERR if not supported
  */
 static enum GNUNET_GenericReturnValue
 block_plugin_template_check_query (void *cls,
-                                    enum GNUNET_BLOCK_Type type,
-                                    const struct GNUNET_HashCode *query,
-                                    const void *xquery,
-                                    size_t xquery_size)
+                                   enum GNUNET_BLOCK_Type type,
+                                   const struct GNUNET_HashCode *query,
+                                   const void *xquery,
+                                   size_t xquery_size)
 {
-  return GNUNET_OK;
+  return GNUNET_SYSERR;
 }
 
 
@@ -161,19 +118,17 @@ block_plugin_template_check_query (void *cls,
  *
  * @param cls closure
  * @param type block type
- * @param query key for the block (hash), must match exactly
  * @param block block data to validate
  * @param block_size number of bytes in @a block
- * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
+ * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not, #GNUNET_SYSERR if not supported
  */
 static enum GNUNET_GenericReturnValue
 block_plugin_template_check_block (void *cls,
                                     enum GNUNET_BLOCK_Type type,
-                                    const struct GNUNET_HashCode *query,
                                     const void *block,
                                     size_t block_size)
 {
-  return GNUNET_OK;
+  return GNUNET_SYSERR;
 }
 
 
@@ -195,16 +150,16 @@ block_plugin_template_check_block (void *cls,
  */
 static enum GNUNET_BLOCK_ReplyEvaluationResult
 block_plugin_template_check_reply (
-                                        void *cls,
-                                        enum GNUNET_BLOCK_Type type,
-                                    struct GNUNET_BLOCK_Group *group,
-                                    const struct GNUNET_HashCode *query,
-                                    const void *xquery,
-                                    size_t xquery_size,
-                                    const void *reply_block,
-                                    size_t reply_block_size)
+                                   void *cls,
+                                   enum GNUNET_BLOCK_Type type,
+                                   struct GNUNET_BLOCK_Group *group,
+                                   const struct GNUNET_HashCode *query,
+                                   const void *xquery,
+                                   size_t xquery_size,
+                                   const void *reply_block,
+                                   size_t reply_block_size)
 {
-  return GNUNET_BLOCK_REPLY_OK_MORE;
+  return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
 }
 
 
@@ -245,7 +200,6 @@ libgnunet_plugin_block_template_init (void *cls)
   struct GNUNET_BLOCK_PluginFunctions *api;
 
   api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
-  api->evaluate = &block_plugin_template_evaluate;
   api->get_key = &block_plugin_template_get_key;
   api->check_query = &block_plugin_template_check_query;
   api->check_block = &block_plugin_template_check_block;
diff --git a/src/block/plugin_block_test.c b/src/block/plugin_block_test.c
index fd643c4dc..05d379387 100644
--- a/src/block/plugin_block_test.c
+++ b/src/block/plugin_block_test.c
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet
-     Copyright (C) 2010 GNUnet e.V.
+     Copyright (C) 2010, 2021, 2022 GNUnet e.V.
 
      GNUnet is free software: you can redistribute it and/or modify it
      under the terms of the GNU Affero General Public License as published
@@ -90,59 +90,6 @@ block_plugin_test_create_group (void *cls,
 
 
 /**
- * Function called to validate a reply or a request.  For
- * request evaluation, simply pass "NULL" for the reply_block.
- *
- * @param cls closure
- * @param ctx block context
- * @param type block type
- * @param group group to check against
- * @param eo control flags
- * @param query original query (hash)
- * @param xquery extrended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in @a xquery
- * @param reply_block response to validate
- * @param reply_block_size number of bytes in @a reply_block
- * @return characterization of result
- */
-static enum GNUNET_BLOCK_EvaluationResult
-block_plugin_test_evaluate (void *cls,
-                            struct GNUNET_BLOCK_Context *ctx,
-                            enum GNUNET_BLOCK_Type type,
-                            struct GNUNET_BLOCK_Group *group,
-                            enum GNUNET_BLOCK_EvaluationOptions eo,
-                            const struct GNUNET_HashCode *query,
-                            const void *xquery,
-                            size_t xquery_size,
-                            const void *reply_block,
-                            size_t reply_block_size)
-{
-  struct GNUNET_HashCode chash;
-
-  if (GNUNET_BLOCK_TYPE_TEST != type)
-  {
-    GNUNET_break (0);
-    return GNUNET_BLOCK_EVALUATION_TYPE_NOT_SUPPORTED;
-  }
-  if (0 != xquery_size)
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_REQUEST_INVALID;
-  }
-  if (NULL == reply_block)
-    return GNUNET_BLOCK_EVALUATION_REQUEST_VALID;
-  GNUNET_CRYPTO_hash (reply_block,
-                      reply_block_size,
-                      &chash);
-  if (GNUNET_YES ==
-      GNUNET_BLOCK_GROUP_bf_test_and_set (group,
-                                          &chash))
-    return GNUNET_BLOCK_EVALUATION_OK_DUPLICATE;
-  return GNUNET_BLOCK_EVALUATION_OK_MORE;
-}
-
-
-/**
  * Function called to validate a query.
  *
  * @param cls closure
@@ -151,15 +98,18 @@ block_plugin_test_evaluate (void *cls,
  * @param query original query (hash)
  * @param xquery extrended query data (can be NULL, depending on type)
  * @param xquery_size number of bytes in @a xquery
- * @return #GNUNET_OK if the query is fine, #GNUNET_NO if not
+ * @return #GNUNET_OK if the query is fine, #GNUNET_NO if not, #GNUNET_SYSERR if @a type is not supported
  */
 static enum GNUNET_GenericReturnValue
 block_plugin_test_check_query (void *cls,
-                                    enum GNUNET_BLOCK_Type type,
-                                    const struct GNUNET_HashCode *query,
-                                    const void *xquery,
-                                    size_t xquery_size)
+                               enum GNUNET_BLOCK_Type type,
+                               const struct GNUNET_HashCode *query,
+                               const void *xquery,
+                               size_t xquery_size)
 {
+  (void) cls;
+  (void) query;
+  (void) xquery;
   if (GNUNET_BLOCK_TYPE_TEST != type)
   {
     GNUNET_break (0);
@@ -168,9 +118,9 @@ block_plugin_test_check_query (void *cls,
   if (0 != xquery_size)
   {
     GNUNET_break_op (0);
-    return GNUNET_SYSERR;
+    return GNUNET_NO;
   }
-  return GNUNET_BLOCK_EVALUATION_REQUEST_VALID;
+  return GNUNET_OK;
 }
 
 
@@ -179,18 +129,19 @@ block_plugin_test_check_query (void *cls,
  *
  * @param cls closure
  * @param type block type
- * @param query key for the block (hash), must match exactly
  * @param block block data to validate
  * @param block_size number of bytes in @a block
- * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
+ * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not, #GNUNET_SYSERR if @a type is not supported
  */
 static enum GNUNET_GenericReturnValue
 block_plugin_test_check_block (void *cls,
-                                    enum GNUNET_BLOCK_Type type,
-                                    const struct GNUNET_HashCode *query,
-                                    const void *block,
-                                    size_t block_size)
+                               enum GNUNET_BLOCK_Type type,
+                               const void *block,
+                               size_t block_size)
 {
+  (void) cls;
+  (void) block;
+  (void) block_size;
   if (GNUNET_BLOCK_TYPE_TEST != type)
   {
     GNUNET_break (0);
@@ -218,16 +169,20 @@ block_plugin_test_check_block (void *cls,
  */
 static enum GNUNET_BLOCK_ReplyEvaluationResult
 block_plugin_test_check_reply (void *cls,
-                                    enum GNUNET_BLOCK_Type type,
-                                    struct GNUNET_BLOCK_Group *group,
-                                    const struct GNUNET_HashCode *query,
-                                    const void *xquery,
-                                    size_t xquery_size,
-                                    const void *reply_block,
-                                    size_t reply_block_size)
+                               enum GNUNET_BLOCK_Type type,
+                               struct GNUNET_BLOCK_Group *group,
+                               const struct GNUNET_HashCode *query,
+                               const void *xquery,
+                               size_t xquery_size,
+                               const void *reply_block,
+                               size_t reply_block_size)
 {
   struct GNUNET_HashCode chash;
 
+  (void) cls;
+  (void) query;
+  (void) xquery;
+  (void) xquery_size;
   if (GNUNET_BLOCK_TYPE_TEST != type)
   {
     GNUNET_break (0);
@@ -252,8 +207,7 @@ block_plugin_test_check_reply (void *cls,
  * @param block block to get the key for
  * @param block_size number of bytes in @a block
  * @param key set to the key (query) for the given block
- * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported
- *         (or if extracting a key from a block of this type does not work)
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported, #GNUNET_NO if extracting a key from a block of this type does not work
  */
 static enum GNUNET_GenericReturnValue
 block_plugin_test_get_key (void *cls,
@@ -262,9 +216,16 @@ block_plugin_test_get_key (void *cls,
                            size_t block_size,
                            struct GNUNET_HashCode *key)
 {
-  /* always fails since there is no fixed relationship between
-   * keys and values for test values */
-  return GNUNET_SYSERR;
+  (void) cls;
+  (void) block;
+  (void) block_size;
+  (void) key;
+  if (GNUNET_BLOCK_TYPE_TEST != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_NO;
 }
 
 
@@ -284,7 +245,6 @@ libgnunet_plugin_block_test_init (void *cls)
   struct GNUNET_BLOCK_PluginFunctions *api;
 
   api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
-  api->evaluate = &block_plugin_test_evaluate;
   api->get_key = &block_plugin_test_get_key;
   api->check_query = &block_plugin_test_check_query;
   api->check_block = &block_plugin_test_check_block;
diff --git a/src/consensus/plugin_block_consensus.c b/src/consensus/plugin_block_consensus.c
index 430a2c0cb..f30b9b0d7 100644
--- a/src/consensus/plugin_block_consensus.c
+++ b/src/consensus/plugin_block_consensus.c
@@ -47,57 +47,6 @@ struct BlockContext
 };
 
 
-/**
- * Function called to validate a reply or a request.  For
- * request evaluation, simply pass "NULL" for the reply_block.
- *
- * @param cls closure
- * @param ctx context
- * @param type block type
- * @param group block group to use
- * @param eo control flags
- * @param query original query (hash)
- * @param xquery extrended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in xquery
- * @param reply_block response to validate
- * @param reply_block_size number of bytes in reply block
- * @return characterization of result
- */
-static enum GNUNET_BLOCK_EvaluationResult
-block_plugin_consensus_evaluate (void *cls,
-                                 struct GNUNET_BLOCK_Context *ctx,
-                                 enum GNUNET_BLOCK_Type type,
-                                 struct GNUNET_BLOCK_Group *group,
-                                 enum GNUNET_BLOCK_EvaluationOptions eo,
-                                 const struct GNUNET_HashCode *query,
-                                 const void *xquery,
-                                 size_t xquery_size,
-                                 const void *reply_block,
-                                 size_t reply_block_size)
-{
-  struct BlockContext *bctx = cls;
-  const struct ConsensusElement *ce = reply_block;
-
-  if (reply_block_size < sizeof(struct ConsensusElement))
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-  if ( (0 != ce->marker) ||
-       (0 == ce->payload_type) )
-    return GNUNET_BLOCK_EVALUATION_OK_MORE;
-
-  if (NULL == bctx->bc)
-    bctx->bc = GNUNET_BLOCK_context_create (bctx->cfg);
-  return GNUNET_BLOCK_evaluate (bctx->bc,
-                                type,
-                                group,
-                                eo,
-                                query,
-                                xquery,
-                                xquery_size,
-                                &ce[1],
-                                reply_block_size
-                                - sizeof(struct ConsensusElement));
-}
-
 
 /**
  * Function called to validate a query.
@@ -128,7 +77,6 @@ block_plugin_consensus_check_query (void *cls,
  *
  * @param cls closure
  * @param type block type
- * @param query key for the block (hash), must match exactly
  * @param block block data to validate
  * @param block_size number of bytes in @a block
  * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
@@ -136,7 +84,6 @@ block_plugin_consensus_check_query (void *cls,
 static enum GNUNET_GenericReturnValue
 block_plugin_consensus_check_block (void *cls,
                                     enum GNUNET_BLOCK_Type type,
-                                    const struct GNUNET_HashCode *query,
                                     const void *block,
                                     size_t block_size)
 {
@@ -144,7 +91,10 @@ block_plugin_consensus_check_block (void *cls,
   const struct ConsensusElement *ce = block;
 
   if (block_size < sizeof(*ce))
+  {
+    GNUNET_break_op (0);
     return GNUNET_NO;
+  }
   if ( (0 != ce->marker) ||
        (0 == ce->payload_type) )
     return GNUNET_OK;
@@ -152,7 +102,6 @@ block_plugin_consensus_check_block (void *cls,
     ctx->bc = GNUNET_BLOCK_context_create (ctx->cfg);
   return GNUNET_BLOCK_check_block (ctx->bc,
                                    ntohl (ce->payload_type),
-                                   query,
                                    &ce[1],
                                    block_size - sizeof(*ce));
 }
@@ -188,8 +137,7 @@ block_plugin_consensus_check_reply (
   struct BlockContext *ctx = cls;
   const struct ConsensusElement *ce = reply_block;
 
-  if (reply_block_size < sizeof(struct ConsensusElement))
-    return GNUNET_NO;
+  GNUNET_assert (reply_block_size >= sizeof(struct ConsensusElement));
   if ( (0 != ce->marker) ||
        (0 == ce->payload_type) )
     return GNUNET_BLOCK_REPLY_OK_MORE;
@@ -246,7 +194,6 @@ libgnunet_plugin_block_consensus_init (void *cls)
   ctx->cfg = cfg;
   api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
   api->cls = ctx;
-  api->evaluate = &block_plugin_consensus_evaluate;
   api->get_key = &block_plugin_consensus_get_key;
   api->check_query = &block_plugin_consensus_check_query;
   api->check_block = &block_plugin_consensus_check_block;
diff --git a/src/consensus/test_consensus.conf b/src/consensus/test_consensus.conf
index 67b366405..df7fb6861 100644
--- a/src/consensus/test_consensus.conf
+++ b/src/consensus/test_consensus.conf
@@ -3,7 +3,7 @@ GNUNET_TEST_HOME = $GNUNET_TMP/test-consensus/
 
 [consensus]
 #OPTIONS = -L INFO
-BINARY = gnunet-service-evil-consensus
+BINARY = gnunet-service-consensus
 
 #PREFIX = valgrind
 
diff --git a/src/datacache/datacache.c b/src/datacache/datacache.c
index 944a99aad..761ab801f 100644
--- a/src/datacache/datacache.c
+++ b/src/datacache/datacache.c
@@ -114,11 +114,11 @@ env_delete_notify (void *cls,
   h->utilization -= size;
   GNUNET_CONTAINER_bloomfilter_remove (h->filter, key);
   GNUNET_STATISTICS_update (h->stats,
-                            gettext_noop ("# bytes stored"),
+                            "# bytes stored",
                             -(long long) size,
                             GNUNET_NO);
   GNUNET_STATISTICS_update (h->stats,
-                            gettext_noop ("# items stored"),
+                            "# items stored",
                             -1,
                             GNUNET_NO);
 }
@@ -136,15 +136,25 @@ GNUNET_DATACACHE_create (const struct GNUNET_CONFIGURATION_Handle *cfg,
   const struct GNUNET_OS_ProjectData *pd;
 
   if (GNUNET_OK !=
-      GNUNET_CONFIGURATION_get_value_size (cfg, section, "QUOTA", &quota))
+      GNUNET_CONFIGURATION_get_value_size (cfg,
+                                           section,
+                                           "QUOTA",
+                                           &quota))
   {
-    GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR, section, "QUOTA");
+    GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR,
+                               section,
+                               "QUOTA");
     return NULL;
   }
   if (GNUNET_OK !=
-      GNUNET_CONFIGURATION_get_value_string (cfg, section, "DATABASE", &name))
+      GNUNET_CONFIGURATION_get_value_string (cfg,
+                                             section,
+                                             "DATABASE",
+                                             &name))
   {
-    GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR, section, "DATABASE");
+    GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR,
+                               section,
+                               "DATABASE");
     return NULL;
   }
   bf_size = quota / 32; /* 8 bit per entry, 1 bit per 32 kb in DB */
@@ -152,10 +162,14 @@ GNUNET_DATACACHE_create (const struct GNUNET_CONFIGURATION_Handle *cfg,
   ret = GNUNET_new (struct GNUNET_DATACACHE_Handle);
 
   if (GNUNET_YES !=
-      GNUNET_CONFIGURATION_get_value_yesno (cfg, section, "DISABLE_BF"))
+      GNUNET_CONFIGURATION_get_value_yesno (cfg,
+                                            section,
+                                            "DISABLE_BF"))
   {
     if (GNUNET_YES !=
-        GNUNET_CONFIGURATION_get_value_yesno (cfg, section, "DISABLE_BF_RC"))
+        GNUNET_CONFIGURATION_get_value_yesno (cfg,
+                                              section,
+                                              "DISABLE_BF_RC"))
     {
       ret->bloom_name = GNUNET_DISK_mktemp ("gnunet-datacachebloom");
     }
@@ -174,7 +188,8 @@ GNUNET_DATACACHE_create (const struct GNUNET_CONFIGURATION_Handle *cfg,
                                            5);    /* approx. 3% false positives at max use */
     }
   }
-  ret->stats = GNUNET_STATISTICS_create ("datacache", cfg);
+  ret->stats = GNUNET_STATISTICS_create ("datacache",
+                                         cfg);
   ret->section = GNUNET_strdup (section);
   ret->env.cfg = cfg;
   ret->env.delete_notify = &env_delete_notify;
@@ -182,25 +197,31 @@ GNUNET_DATACACHE_create (const struct GNUNET_CONFIGURATION_Handle *cfg,
   ret->env.cls = ret;
   ret->env.delete_notify = &env_delete_notify;
   ret->env.quota = quota;
-  LOG (GNUNET_ERROR_TYPE_INFO, _ ("Loading `%s' datacache plugin\n"), name);
-  GNUNET_asprintf (&libname, "libgnunet_plugin_datacache_%s", name);
+  LOG (GNUNET_ERROR_TYPE_INFO,
+       "Loading `%s' datacache plugin\n",
+       name);
+  GNUNET_asprintf (&libname,
+                   "libgnunet_plugin_datacache_%s",
+                   name);
   ret->short_name = name;
   ret->lib_name = libname;
   /* Load the plugin within GNUnet's default context */
   pd = GNUNET_OS_project_data_get ();
   GNUNET_OS_init (GNUNET_OS_project_data_default ());
-  ret->api = GNUNET_PLUGIN_load (libname, &ret->env);
+  ret->api = GNUNET_PLUGIN_load (libname,
+                                 &ret->env);
   GNUNET_OS_init (pd);
   if (NULL == ret->api)
   {
     /* Try to load the plugin within the application's context
        This normally happens when the application is not GNUnet itself but a
        third party; inside GNUnet this is effectively a double failure. */
-    ret->api = GNUNET_PLUGIN_load (libname, &ret->env);
+    ret->api = GNUNET_PLUGIN_load (libname,
+                                   &ret->env);
     if (NULL == ret->api)
     {
       LOG (GNUNET_ERROR_TYPE_ERROR,
-           _ ("Failed to load datacache plugin for `%s'\n"),
+           "Failed to load datacache plugin for `%s'\n",
            name);
       GNUNET_DATACACHE_destroy (ret);
       return NULL;
@@ -216,7 +237,9 @@ GNUNET_DATACACHE_destroy (struct GNUNET_DATACACHE_Handle *h)
   if (NULL != h->filter)
     GNUNET_CONTAINER_bloomfilter_free (h->filter);
   if (NULL != h->api)
-    GNUNET_break (NULL == GNUNET_PLUGIN_unload (h->lib_name, h->api));
+    GNUNET_break (NULL ==
+                  GNUNET_PLUGIN_unload (h->lib_name,
+                                        h->api));
   GNUNET_free (h->lib_name);
   GNUNET_free (h->short_name);
   GNUNET_free (h->section);
@@ -270,17 +293,19 @@ GNUNET_DATACACHE_put (struct GNUNET_DATACACHE_Handle *h,
        "Stored data under key `%s' in cache\n",
        GNUNET_h2s (key));
   if (NULL != h->filter)
-    GNUNET_CONTAINER_bloomfilter_add (h->filter, key);
+    GNUNET_CONTAINER_bloomfilter_add (h->filter,
+                                      key);
   GNUNET_STATISTICS_update (h->stats,
-                            gettext_noop ("# bytes stored"),
+                            "# bytes stored",
                             used,
                             GNUNET_NO);
   GNUNET_STATISTICS_update (h->stats,
-                            gettext_noop ("# items stored"),
+                            "# items stored",
                             1,
                             GNUNET_NO);
   while (h->utilization + used > h->env.quota)
-    GNUNET_assert (GNUNET_OK == h->api->del (h->api->cls));
+    GNUNET_assert (GNUNET_OK ==
+                   h->api->del (h->api->cls));
   h->utilization += used;
   return GNUNET_OK;
 }
@@ -294,18 +319,18 @@ GNUNET_DATACACHE_get (struct GNUNET_DATACACHE_Handle *h,
                       void *iter_cls)
 {
   GNUNET_STATISTICS_update (h->stats,
-                            gettext_noop ("# requests received"),
+                            "# requests received",
                             1,
                             GNUNET_NO);
   LOG (GNUNET_ERROR_TYPE_DEBUG,
        "Processing request for key `%s'\n",
        GNUNET_h2s (key));
   if ((NULL != h->filter) &&
-      (GNUNET_OK != GNUNET_CONTAINER_bloomfilter_test (h->filter, key)))
+      (GNUNET_OK !=
+       GNUNET_CONTAINER_bloomfilter_test (h->filter, key)))
   {
     GNUNET_STATISTICS_update (h->stats,
-                              gettext_noop (
-                                "# requests filtered by bloom filter"),
+                              "# requests filtered by bloom filter",
                               1,
                               GNUNET_NO);
     LOG (GNUNET_ERROR_TYPE_DEBUG,
@@ -313,26 +338,33 @@ GNUNET_DATACACHE_get (struct GNUNET_DATACACHE_Handle *h,
          GNUNET_h2s (key));
     return 0;   /* can not be present */
   }
-  return h->api->get (h->api->cls, key, type, iter, iter_cls);
+  return h->api->get (h->api->cls,
+                      key,
+                      type,
+                      iter, iter_cls);
 }
 
 
 unsigned int
 GNUNET_DATACACHE_get_closest (struct GNUNET_DATACACHE_Handle *h,
                               const struct GNUNET_HashCode *key,
+                              enum GNUNET_BLOCK_Type type,
                               unsigned int num_results,
                               GNUNET_DATACACHE_Iterator iter,
                               void *iter_cls)
 {
   GNUNET_STATISTICS_update (h->stats,
-                            gettext_noop (
-                              "# proximity search requests received"),
+                            "# proximity search requests received",
                             1,
                             GNUNET_NO);
   LOG (GNUNET_ERROR_TYPE_DEBUG,
        "Processing proximity search at `%s'\n",
        GNUNET_h2s (key));
-  return h->api->get_closest (h->api->cls, key, num_results, iter, iter_cls);
+  return h->api->get_closest (h->api->cls,
+                              key,
+                              type,
+                              num_results,
+                              iter, iter_cls);
 }
 
 
diff --git a/src/datacache/plugin_datacache_heap.c b/src/datacache/plugin_datacache_heap.c
index fbd3aea9a..5b50468a5 100644
--- a/src/datacache/plugin_datacache_heap.c
+++ b/src/datacache/plugin_datacache_heap.c
@@ -158,7 +158,7 @@ struct PutContext
  * @param value an existing value
  * @return #GNUNET_YES if not found (to continue to iterate)
  */
-static int
+static enum GNUNET_GenericReturnValue
 put_cb (void *cls,
         const struct GNUNET_HashCode *key,
         void *value)
@@ -224,15 +224,20 @@ heap_plugin_put (void *cls,
 {
   struct Plugin *plugin = cls;
   struct Value *val;
-  struct PutContext put_ctx;
-
-  put_ctx.found = GNUNET_NO;
-  put_ctx.data = data;
-  put_ctx.size = size;
-  put_ctx.path_info = path_info;
-  put_ctx.path_info_len = path_info_len;
-  put_ctx.discard_time = discard_time;
-  put_ctx.type = type;
+  struct PutContext put_ctx = {
+    .data = data,
+    .size = size,
+    .path_info = path_info,
+    .path_info_len = path_info_len,
+    .discard_time = discard_time,
+    .type = type
+  };
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Storing %u bytes under key %s with path length %u\n",
+              (unsigned int) size,
+              GNUNET_h2s (key),
+              path_info_len);
   GNUNET_CONTAINER_multihashmap_get_multiple (plugin->map,
                                               key,
                                               &put_cb,
@@ -313,12 +318,25 @@ get_cb (void *cls,
   struct Value *val = value;
   int ret;
 
-  if ((get_ctx->type != val->type) &&
-      (GNUNET_BLOCK_TYPE_ANY != get_ctx->type))
+  if ( (get_ctx->type != val->type) &&
+       (GNUNET_BLOCK_TYPE_ANY != get_ctx->type) )
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Result for key %s does not match block type %d\n",
+                GNUNET_h2s (key),
+                get_ctx->type);
     return GNUNET_OK;
-  if (0 ==
-      GNUNET_TIME_absolute_get_remaining (val->discard_time).rel_value_us)
+  }
+  if (GNUNET_TIME_absolute_is_past (val->discard_time))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Result for key %s is expired\n",
+                GNUNET_h2s (key));
     return GNUNET_OK;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Found result for key %s\n",
+              GNUNET_h2s (key));
   if (NULL != get_ctx->iter)
     ret = get_ctx->iter (get_ctx->iter_cls,
                          key,
@@ -409,13 +427,16 @@ struct GetClosestContext
 {
   struct Value **values;
 
+  const struct GNUNET_HashCode *key;
+
+  enum GNUNET_BLOCK_Type type;
+
   unsigned int num_results;
 
-  const struct GNUNET_HashCode *key;
 };
 
 
-static int
+static enum GNUNET_GenericReturnValue
 find_closest (void *cls,
               const struct GNUNET_HashCode *key,
               void *value)
@@ -427,6 +448,9 @@ find_closest (void *cls,
   if (1 != GNUNET_CRYPTO_hash_cmp (key,
                                    gcc->key))
     return GNUNET_OK; /* useless */
+  if ( (val->type != gcc->type) &&
+       (GNUNET_BLOCK_TYPE_ANY != gcc->type) )
+    return GNUNET_OK; /* useless */
   j = gcc->num_results;
   for (unsigned int i = 0; i < gcc->num_results; i++)
   {
@@ -435,8 +459,9 @@ find_closest (void *cls,
       j = i;
       break;
     }
-    if (1 == GNUNET_CRYPTO_hash_cmp (&gcc->values[i]->key,
-                                     key))
+    if (1 ==
+        GNUNET_CRYPTO_hash_cmp (&gcc->values[i]->key,
+                                key))
     {
       j = i;
       break;
@@ -457,6 +482,7 @@ find_closest (void *cls,
  *
  * @param cls closure (internal context for the plugin)
  * @param key area of the keyspace to look into
+ * @param type desired block type for the replies
  * @param num_results number of results that should be returned to @a iter
  * @param iter maybe NULL (to just count)
  * @param iter_cls closure for @a iter
@@ -465,6 +491,7 @@ find_closest (void *cls,
 static unsigned int
 heap_plugin_get_closest (void *cls,
                          const struct GNUNET_HashCode *key,
+                         enum GNUNET_BLOCK_Type type,
                          unsigned int num_results,
                          GNUNET_DATACACHE_Iterator iter,
                          void *iter_cls)
@@ -473,14 +500,15 @@ heap_plugin_get_closest (void *cls,
   struct Value *values[num_results];
   struct GetClosestContext gcc = {
     .values = values,
-    .num_results = num_results,
+    .type = type,
+    .num_results = num_results * 2,
     .key = key
   };
 
   GNUNET_CONTAINER_multihashmap_iterate (plugin->map,
                                          &find_closest,
                                          &gcc);
-  for (unsigned int i = 0; i < num_results; i++)
+  for (unsigned int i = 0; i < num_results * 2; i++)
   {
     if (NULL == values[i])
       return i;
@@ -493,7 +521,7 @@ heap_plugin_get_closest (void *cls,
           values[i]->path_info_len,
           values[i]->path_info);
   }
-  return num_results;
+  return num_results * 2;
 }
 
 
diff --git a/src/datacache/plugin_datacache_postgres.c b/src/datacache/plugin_datacache_postgres.c
index 6a44c44a5..1a83cda86 100644
--- a/src/datacache/plugin_datacache_postgres.c
+++ b/src/datacache/plugin_datacache_postgres.c
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet
-     Copyright (C) 2006, 2009, 2010, 2012, 2015, 2017, 2018 GNUnet e.V.
+     Copyright (C) 2006, 2009, 2010, 2012, 2015, 2017, 2018, 2022 GNUnet e.V.
 
      GNUnet is free software: you can redistribute it and/or modify it
      under the terms of the GNU Affero General Public License as published
@@ -109,9 +109,20 @@ init_connection (struct Plugin *plugin)
                             " ORDER BY prox ASC, discard_time ASC LIMIT 1",
                             0),
     GNUNET_PQ_make_prepare ("get_closest",
-                            "SELECT discard_time,type,value,path,key FROM gn011dc "
-                            "WHERE key>=$1 AND discard_time >= $2 ORDER BY key ASC LIMIT $3",
-                            3),
+                            "(SELECT discard_time,type,value,path,key FROM gn011dc"
+                            " WHERE key >= $1"
+                            "   AND discard_time >= $2"
+                            "   AND ( (type = $3) OR ( 0 = $3) )"
+                            " ORDER BY key ASC"
+                            " LIMIT $4)"
+                            " UNION "
+                            "(SELECT discard_time,type,value,path,key FROM gn011dc"
+                            " WHERE key <= $1"
+                            "   AND discard_time >= $2"
+                            "   AND ( (type = $3) OR ( 0 = $3) )"
+                            " ORDER BY key DESC"
+                            " LIMIT $4)",
+                            4),
     GNUNET_PQ_make_prepare ("delrow",
                             "DELETE FROM gn011dc WHERE oid=$1",
                             1),
@@ -511,6 +522,7 @@ extract_result_cb (void *cls,
  *
  * @param cls closure (internal context for the plugin)
  * @param key area of the keyspace to look into
+ * @param type desired block type for the replies
  * @param num_results number of results that should be returned to @a iter
  * @param iter maybe NULL (to just count)
  * @param iter_cls closure for @a iter
@@ -519,16 +531,19 @@ extract_result_cb (void *cls,
 static unsigned int
 postgres_plugin_get_closest (void *cls,
                              const struct GNUNET_HashCode *key,
+                             enum GNUNET_BLOCK_Type type,
                              unsigned int num_results,
                              GNUNET_DATACACHE_Iterator iter,
                              void *iter_cls)
 {
   struct Plugin *plugin = cls;
   uint32_t num_results32 = (uint32_t) num_results;
+  uint32_t type32 = (uint32_t) type;
   struct GNUNET_TIME_Absolute now;
   struct GNUNET_PQ_QueryParam params[] = {
     GNUNET_PQ_query_param_auto_from_type (key),
     GNUNET_PQ_query_param_absolute_time (&now),
+    GNUNET_PQ_query_param_uint32 (&type32),
     GNUNET_PQ_query_param_uint32 (&num_results32),
     GNUNET_PQ_query_param_end
   };
diff --git a/src/datacache/plugin_datacache_sqlite.c b/src/datacache/plugin_datacache_sqlite.c
index d08b32caf..6f2165433 100644
--- a/src/datacache/plugin_datacache_sqlite.c
+++ b/src/datacache/plugin_datacache_sqlite.c
@@ -454,6 +454,7 @@ sqlite_plugin_del (void *cls)
  *
  * @param cls closure (internal context for the plugin)
  * @param key area of the keyspace to look into
+ * @param type desired block type for the replies
  * @param num_results number of results that should be returned to @a iter
  * @param iter maybe NULL (to just count)
  * @param iter_cls closure for @a iter
@@ -462,11 +463,13 @@ sqlite_plugin_del (void *cls)
 static unsigned int
 sqlite_plugin_get_closest (void *cls,
                            const struct GNUNET_HashCode *key,
+                           enum GNUNET_BLOCK_Type type,
                            unsigned int num_results,
                            GNUNET_DATACACHE_Iterator iter,
                            void *iter_cls)
 {
   struct Plugin *plugin = cls;
+  uint32_t type32 = type;
   uint32_t num_results32 = num_results;
   struct GNUNET_TIME_Absolute now;
   struct GNUNET_TIME_Absolute exp;
@@ -474,38 +477,46 @@ sqlite_plugin_get_closest (void *cls,
   void *dat;
   unsigned int cnt;
   size_t psize;
-  uint32_t type;
+  uint32_t rtype;
   struct GNUNET_HashCode hc;
   struct GNUNET_DHT_PathElement *path;
-  struct GNUNET_SQ_QueryParam params[] =
-  { GNUNET_SQ_query_param_auto_from_type (key),
+  struct GNUNET_SQ_QueryParam params[] = {
+    GNUNET_SQ_query_param_auto_from_type (key),
     GNUNET_SQ_query_param_absolute_time (&now),
+    GNUNET_SQ_query_param_uint32 (&type32),
     GNUNET_SQ_query_param_uint32 (&num_results32),
-    GNUNET_SQ_query_param_end };
-  struct GNUNET_SQ_ResultSpec rs[] =
-  { GNUNET_SQ_result_spec_variable_size (&dat, &size),
+    GNUNET_SQ_query_param_end
+  };
+  struct GNUNET_SQ_ResultSpec rs[] = {
+    GNUNET_SQ_result_spec_variable_size (&dat, &size),
     GNUNET_SQ_result_spec_absolute_time (&exp),
     GNUNET_SQ_result_spec_variable_size ((void **) &path, &psize),
-    GNUNET_SQ_result_spec_uint32 (&type),
+    GNUNET_SQ_result_spec_uint32 (&rtype),
     GNUNET_SQ_result_spec_auto_from_type (&hc),
-    GNUNET_SQ_result_spec_end };
+    GNUNET_SQ_result_spec_end
+  };
 
   now = GNUNET_TIME_absolute_get ();
   LOG (GNUNET_ERROR_TYPE_DEBUG,
        "Processing GET_CLOSEST for key `%s'\n",
        GNUNET_h2s (key));
-  if (GNUNET_OK != GNUNET_SQ_bind (plugin->get_closest_stmt, params))
+  if (GNUNET_OK !=
+      GNUNET_SQ_bind (plugin->get_closest_stmt,
+                      params))
   {
     LOG_SQLITE (plugin->dbh,
                 GNUNET_ERROR_TYPE_ERROR | GNUNET_ERROR_TYPE_BULK,
                 "sqlite3_bind_xxx");
-    GNUNET_SQ_reset (plugin->dbh, plugin->get_closest_stmt);
+    GNUNET_SQ_reset (plugin->dbh,
+                     plugin->get_closest_stmt);
     return 0;
   }
   cnt = 0;
   while (SQLITE_ROW == sqlite3_step (plugin->get_closest_stmt))
   {
-    if (GNUNET_OK != GNUNET_SQ_extract_result (plugin->get_closest_stmt, rs))
+    if (GNUNET_OK !=
+        GNUNET_SQ_extract_result (plugin->get_closest_stmt,
+                                  rs))
     {
       GNUNET_break (0);
       break;
@@ -522,14 +533,22 @@ sqlite_plugin_get_closest (void *cls,
          "Found %u-byte result at %s when processing GET_CLOSE\n",
          (unsigned int) size,
          GNUNET_h2s (&hc));
-    if (GNUNET_OK != iter (iter_cls, &hc, size, dat, type, exp, psize, path))
+    if (GNUNET_OK != iter (iter_cls,
+                           &hc,
+                           size,
+                           dat,
+                           rtype,
+                           exp,
+                           psize,
+                           path))
     {
       GNUNET_SQ_cleanup_result (rs);
       break;
     }
     GNUNET_SQ_cleanup_result (rs);
   }
-  GNUNET_SQ_reset (plugin->dbh, plugin->get_closest_stmt);
+  GNUNET_SQ_reset (plugin->dbh,
+                   plugin->get_closest_stmt);
   return cnt;
 }
 
@@ -620,7 +639,7 @@ libgnunet_plugin_datacache_sqlite_init (void *cls)
                    &plugin->get_stmt)) ||
       (SQLITE_OK != sq_prepare (plugin->dbh,
                                 "SELECT _ROWID_,key,value FROM ds091"
-                                " WHERE expire < ?"
+                                " WHERE expire < ?1"
                                 " ORDER BY expire ASC LIMIT 1",
                                 &plugin->del_expired_stmt)) ||
       (SQLITE_OK != sq_prepare (plugin->dbh,
@@ -632,8 +651,19 @@ libgnunet_plugin_datacache_sqlite_init (void *cls)
                                 &plugin->del_stmt)) ||
       (SQLITE_OK !=
        sq_prepare (plugin->dbh,
-                   "SELECT value,expire,path,type,key FROM ds091 "
-                   "WHERE key>=? AND expire >= ? ORDER BY KEY ASC LIMIT ?",
+                   "SELECT * FROM ("
+                   " SELECT value,expire,path,type,key FROM ds091 "
+                   " WHERE key>=?1 "
+                   "  AND expire >= ?2"
+                   "  AND ( (type=?3) or (0 == ?3) )"
+                   " ORDER BY KEY ASC LIMIT ?4)"
+                   "UNION "
+                   "SELECT * FROM ("
+                   " SELECT value,expire,path,type,key FROM ds091 "
+                   " WHERE key<=?1 "
+                   "  AND expire >= ?2"
+                   "  AND ( (type=?3) or (0 == ?3) )"
+                   " ORDER BY KEY DESC LIMIT ?4)",
                    &plugin->get_closest_stmt)))
   {
     LOG_SQLITE (plugin->dbh,
diff --git a/src/datacache/plugin_datacache_template.c b/src/datacache/plugin_datacache_template.c
index 231413ce9..2f7b41dbe 100644
--- a/src/datacache/plugin_datacache_template.c
+++ b/src/datacache/plugin_datacache_template.c
@@ -116,6 +116,7 @@ template_plugin_del (void *cls)
  *
  * @param cls closure (internal context for the plugin)
  * @param key area of the keyspace to look into
+ * @param type desired block type for the replies
  * @param num_results number of results that should be returned to @a iter
  * @param iter maybe NULL (to just count)
  * @param iter_cls closure for @a iter
@@ -124,6 +125,7 @@ template_plugin_del (void *cls)
 static unsigned int
 template_plugin_get_closest (void *cls,
                              const struct GNUNET_HashCode *key,
+                             enum GNUNET_BLOCK_Type type,
                              unsigned int num_results,
                              GNUNET_DATACACHE_Iterator iter,
                              void *iter_cls)
diff --git a/src/dht/.gitignore b/src/dht/.gitignore
index 25b1daf28..bd8af1217 100644
--- a/src/dht/.gitignore
+++ b/src/dht/.gitignore
@@ -10,3 +10,4 @@ test_dht_monitor
 test_dht_multipeer
 test_dht_tools.py
 test_dht_twopeer
+gnunet-dht-hello
diff --git a/src/dht/Makefile.am b/src/dht/Makefile.am
index be48fab02..68a17723d 100644
--- a/src/dht/Makefile.am
+++ b/src/dht/Makefile.am
@@ -50,7 +50,8 @@ libexec_PROGRAMS = \
 bin_PROGRAMS = \
  gnunet-dht-monitor \
  gnunet-dht-get \
- gnunet-dht-put
+ gnunet-dht-put \
+ gnunet-dht-hello
 
 noinst_PROGRAMS = \
  gnunet-dht-profiler
@@ -58,8 +59,6 @@ noinst_PROGRAMS = \
 gnunet_service_dht_SOURCES = \
  gnunet-service-dht.c gnunet-service-dht.h \
  gnunet-service-dht_datacache.c gnunet-service-dht_datacache.h \
- gnunet-service-dht_hello.c gnunet-service-dht_hello.h \
- gnunet-service-dht_nse.c gnunet-service-dht_nse.h \
  gnunet-service-dht_neighbours.c gnunet-service-dht_neighbours.h \
  gnunet-service-dht_routing.c gnunet-service-dht_routing.h
 gnunet_service_dht_LDADD = \
@@ -72,6 +71,7 @@ gnunet_service_dht_LDADD = \
   $(top_builddir)/src/peerinfo/libgnunetpeerinfo.la \
   $(top_builddir)/src/hello/libgnunethello.la \
   $(top_builddir)/src/block/libgnunetblock.la \
+  $(top_builddir)/src/block/libgnunetblockgroup.la \
   $(top_builddir)/src/datacache/libgnunetdatacache.la \
   $(top_builddir)/src/util/libgnunetutil.la \
   -lm
@@ -82,16 +82,22 @@ gnunet_dht_get_SOURCES = \
  gnunet-dht-get.c
 gnunet_dht_get_LDADD = \
   libgnunetdht.la \
-  $(top_builddir)/src/core/libgnunetcore.la \
   $(top_builddir)/src/util/libgnunetutil.la
 gnunet_dht_get_LDFLAGS = \
   $(GN_LIBINTL)
 
+gnunet_dht_hello_SOURCES = \
+ gnunet-dht-hello.c
+gnunet_dht_hello_LDADD = \
+  libgnunetdht.la \
+  $(top_builddir)/src/util/libgnunetutil.la
+gnunet_dht_hello_LDFLAGS = \
+  $(GN_LIBINTL)
+
 gnunet_dht_put_SOURCES = \
  gnunet-dht-put.c
 gnunet_dht_put_LDADD = \
   libgnunetdht.la \
-  $(top_builddir)/src/core/libgnunetcore.la \
   $(top_builddir)/src/util/libgnunetutil.la
 gnunet_dht_put_LDFLAGS = \
   $(GN_LIBINTL)
@@ -100,7 +106,6 @@ gnunet_dht_monitor_SOURCES = \
  gnunet-dht-monitor.c
 gnunet_dht_monitor_LDADD = \
   libgnunetdht.la \
-  $(top_builddir)/src/core/libgnunetcore.la \
   $(top_builddir)/src/util/libgnunetutil.la
 gnunet_dht_monitor_LDFLAGS = \
   $(GN_LIBINTL)
@@ -199,7 +204,6 @@ test_dht_monitor_LDADD = \
  libgnunetdht.la
 
 EXTRA_DIST = \
-  $(check_SCRIPTS) \
   gnunet-service-dht_clients.c \
   test_dht_api_data.conf \
   test_dht_api_peer1.conf \
@@ -209,7 +213,10 @@ EXTRA_DIST = \
   test_dht_line.conf \
   test_dht_tools.conf \
   test_dht_tools.py.in \
-  test_dht_multipeer_topology.dat
+  test_dht_multipeer_topology.dat \
+  dhtu_testbed_connect.sh \
+  dhtu_testbed_deploy.conf \
+  dhtu_testbed_deploy.sh
 
 if HAVE_PYTHON
 check_SCRIPTS = \
diff --git a/src/dht/dht_api.c b/src/dht/dht_api.c
index 8389bbb95..474198004 100644
--- a/src/dht/dht_api.c
+++ b/src/dht/dht_api.c
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet.
-     Copyright (C) 2009, 2010, 2011, 2012, 2016, 2018 GNUnet e.V.
+     Copyright (C) 2009-2012, 2016, 2018, 2022 GNUnet e.V.
 
      GNUnet is free software: you can redistribute it and/or modify it
      under the terms of the GNU Affero General Public License as published
@@ -197,6 +197,40 @@ struct GNUNET_DHT_MonitorHandle
 
 
 /**
+ * Handle to get a HELLO URL from the DHT for manual bootstrapping.
+ */
+struct GNUNET_DHT_HelloGetHandle
+{
+
+  /**
+   * DLL.
+   */
+  struct GNUNET_DHT_HelloGetHandle *next;
+
+  /**
+   * DLL.
+   */
+  struct GNUNET_DHT_HelloGetHandle *prev;
+
+  /**
+   * Function to call with the result.
+   */
+  GNUNET_DHT_HelloGetCallback cb;
+
+  /**
+   * Closure for @a cb.
+   */
+  void *cb_cls;
+
+  /**
+   * Connection to the DHT service.
+   */
+  struct GNUNET_DHT_Handle *dht_handle;
+
+};
+
+
+/**
  * Connection to the DHT service.
  */
 struct GNUNET_DHT_Handle
@@ -232,6 +266,16 @@ struct GNUNET_DHT_Handle
   struct GNUNET_DHT_PutHandle *put_tail;
 
   /**
+   * DLL.
+   */
+  struct GNUNET_DHT_HelloGetHandle *hgh_head;
+
+  /**
+   * DLL.
+   */
+  struct GNUNET_DHT_HelloGetHandle *hgh_tail;
+
+  /**
    * Hash map containing the current outstanding unique GET requests
    * (values are of type `struct GNUNET_DHT_GetHandle`).
    */
@@ -517,9 +561,10 @@ handle_monitor_get (void *cls,
                     const struct GNUNET_DHT_MonitorGetMessage *msg)
 {
   struct GNUNET_DHT_Handle *handle = cls;
-  struct GNUNET_DHT_MonitorHandle *mh;
 
-  for (mh = handle->monitor_head; NULL != mh; mh = mh->next)
+  for (struct GNUNET_DHT_MonitorHandle *mh = handle->monitor_head;
+       NULL != mh;
+       mh = mh->next)
   {
     if (NULL == mh->get_cb)
       continue;
@@ -582,10 +627,12 @@ handle_monitor_get_resp (void *cls,
   const struct GNUNET_DHT_PathElement *path;
   uint32_t getl = ntohl (msg->get_path_length);
   uint32_t putl = ntohl (msg->put_path_length);
-  struct GNUNET_DHT_MonitorHandle *mh;
+
 
   path = (const struct GNUNET_DHT_PathElement *) &msg[1];
-  for (mh = handle->monitor_head; NULL != mh; mh = mh->next)
+  for (struct GNUNET_DHT_MonitorHandle *mh = handle->monitor_head;
+       NULL != mh;
+       mh = mh->next)
   {
     if (NULL == mh->get_resp_cb)
       continue;
@@ -597,9 +644,9 @@ handle_monitor_get_resp (void *cls,
                        sizeof(struct GNUNET_HashCode)))))
       mh->get_resp_cb (mh->cb_cls,
                        (enum GNUNET_BLOCK_Type) ntohl (msg->type),
-                       path,
+                       &path[putl],
                        getl,
-                       &path[getl],
+                       path,
                        putl,
                        GNUNET_TIME_absolute_ntoh (msg->expiration_time),
                        &msg->key,
@@ -726,14 +773,21 @@ process_client_result (void *cls,
   const struct GNUNET_DHT_ClientResultMessage *crm = cls;
   struct GNUNET_DHT_GetHandle *get_handle = value;
   size_t msize = ntohs (crm->header.size) - sizeof(*crm);
+  uint16_t type = ntohl (crm->type);
   uint32_t put_path_length = ntohl (crm->put_path_length);
   uint32_t get_path_length = ntohl (crm->get_path_length);
-  const struct GNUNET_DHT_PathElement *put_path;
-  const struct GNUNET_DHT_PathElement *get_path;
+  const struct GNUNET_DHT_PathElement *put_path
+    = (const struct GNUNET_DHT_PathElement *) &crm[1];
+  const struct GNUNET_DHT_PathElement *get_path
+    = &put_path[put_path_length];
+  const void *data
+    = &get_path[get_path_length];
+  size_t meta_length
+    = sizeof(struct GNUNET_DHT_PathElement) * (get_path_length
+                                               + put_path_length);
+  size_t data_length
+    = msize - meta_length;
   struct GNUNET_HashCode hc;
-  size_t data_length;
-  size_t meta_length;
-  const void *data;
 
   if (crm->unique_id != get_handle->unique_id)
   {
@@ -745,12 +799,14 @@ process_client_result (void *cls,
          (unsigned long long) get_handle->unique_id);
     return GNUNET_YES;
   }
-  /* FIXME: might want to check that type matches */
-  meta_length =
-    sizeof(struct GNUNET_DHT_PathElement) * (get_path_length + put_path_length);
-  data_length = msize - meta_length;
-  put_path = (const struct GNUNET_DHT_PathElement *) &crm[1];
-  get_path = &put_path[put_path_length];
+  if ( (get_handle->type != GNUNET_BLOCK_TYPE_ANY) &&
+       (get_handle->type != type) )
+  {
+    /* type mismatch */
+    GNUNET_break (0);
+    return GNUNET_YES;
+  }
+
   {
     char *pp;
     char *gp;
@@ -768,7 +824,6 @@ process_client_result (void *cls,
     GNUNET_free (gp);
     GNUNET_free (pp);
   }
-  data = &get_path[get_path_length];
   /* remember that we've seen this result */
   GNUNET_CRYPTO_hash (data,
                       data_length,
@@ -786,7 +841,7 @@ process_client_result (void *cls,
                     get_path_length,
                     put_path,
                     put_path_length,
-                    ntohl (crm->type),
+                    type,
                     data_length,
                     data);
   return GNUNET_YES;
@@ -813,6 +868,53 @@ handle_client_result (void *cls,
 
 
 /**
+ * Process a client HELLO message received from the service.
+ *
+ * @param cls The DHT handle.
+ * @param hdr HELLO URL message from the service.
+ * @return #GNUNET_OK if @a hdr is well-formed
+ */
+static enum GNUNET_GenericReturnValue
+check_client_hello (void *cls,
+                    const struct GNUNET_MessageHeader *hdr)
+{
+  uint16_t len = ntohs (hdr->size);
+  const char *buf = (const char *) &hdr[1];
+
+  (void) cls;
+  if ('\0' != buf[len - sizeof (*hdr) - 1])
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Process a client HELLO message received from the service.
+ *
+ * @param cls The DHT handle.
+ * @param hdr HELLO URL message from the service.
+ */
+static void
+handle_client_hello (void *cls,
+                     const struct GNUNET_MessageHeader *hdr)
+{
+  struct GNUNET_DHT_Handle *handle = cls;
+  const char *url = (const char *) &hdr[1];
+  struct GNUNET_DHT_HelloGetHandle *hgh;
+
+  while (NULL != (hgh = handle->hgh_head))
+  {
+    hgh->cb (hgh->cb_cls,
+             url);
+    GNUNET_DHT_hello_get_cancel (hgh);
+  }
+}
+
+
+/**
  * Process a MQ PUT transmission notification.
  *
  * @param cls The DHT handle.
@@ -859,6 +961,10 @@ try_connect (struct GNUNET_DHT_Handle *h)
                            GNUNET_MESSAGE_TYPE_DHT_CLIENT_RESULT,
                            struct GNUNET_DHT_ClientResultMessage,
                            h),
+    GNUNET_MQ_hd_var_size (client_hello,
+                           GNUNET_MESSAGE_TYPE_DHT_CLIENT_HELLO_URL,
+                           struct GNUNET_MessageHeader,
+                           h),
     GNUNET_MQ_handler_end ()
   };
 
@@ -1194,8 +1300,7 @@ GNUNET_DHT_pp2s (const struct GNUNET_DHT_PathElement *path,
 
 
 unsigned int
-GNUNET_DHT_verify_path (const struct GNUNET_HashCode *key,
-                        const void *data,
+GNUNET_DHT_verify_path (const void *data,
                         size_t data_size,
                         struct GNUNET_TIME_Absolute exp_time,
                         const struct GNUNET_DHT_PathElement *put_path,
@@ -1207,47 +1312,125 @@ GNUNET_DHT_verify_path (const struct GNUNET_HashCode *key,
   struct GNUNET_DHT_HopSignature hs = {
     .purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_DHT_HOP),
     .purpose.size = htonl (sizeof (hs)),
-    .expiration_time = GNUNET_TIME_absolute_hton (exp_time),
-    .key = *key,
+    .expiration_time = GNUNET_TIME_absolute_hton (exp_time)
   };
+  const struct GNUNET_PeerIdentity *pred;
+  const struct GNUNET_PeerIdentity *succ;
   unsigned int i;
 
   if (0 == get_path_len + put_path_len)
     return 0;
-  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
-              "Verifying signatures with GPL: %u PPL: %u!\n",
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "%s is verifying signatures with GPL: %u PPL: %u!\n",
+              GNUNET_i2s (me),
               get_path_len,
               put_path_len);
+  for (unsigned int j = 0; j<put_path_len; j++)
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "PP%u=%s\n",
+                j,
+                GNUNET_i2s (&put_path[j].pred));
+  for (unsigned int j = 0; j<get_path_len; j++)
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "GP%u=%s\n",
+                j,
+                GNUNET_i2s (&get_path[j].pred));
+
   i = put_path_len + get_path_len - 1;
   GNUNET_CRYPTO_hash (data,
                       data_size,
                       &hs.h_data);
   while (i > 0)
   {
-    hs.pred = (i - 1 >= put_path_len)
-      ? get_path[i - put_path_len - 1].pred
-      : put_path[i - 1].pred;
+    pred = (i - 1 >= put_path_len)
+      ? &get_path[i - put_path_len - 1].pred
+      : &put_path[i - 1].pred;
     if (i + 1 == get_path_len + put_path_len)
-      hs.succ = *me;
+      succ = me;
     else
-      hs.succ = (i + 1 >= put_path_len)
-        ? get_path[i + 1 - put_path_len].pred
-        : put_path[i + 1].pred;
+      succ = (i + 1 >= put_path_len)
+        ? &get_path[i + 1 - put_path_len].pred
+        : &put_path[i + 1].pred;
+    hs.pred = *pred;
+    hs.succ = *succ;
     if (GNUNET_OK !=
         GNUNET_CRYPTO_eddsa_verify (
           GNUNET_SIGNATURE_PURPOSE_DHT_HOP,
           &hs,
           (i - 1 >= put_path_len)
-          ? &get_path[i - put_path_len - 1].sig
+            ? &get_path[i - put_path_len - 1].sig
           : &put_path[i - 1].sig,
           (i >= put_path_len)
           ? &get_path[i - put_path_len].pred.public_key
           : &put_path[i].pred.public_key))
+    {
+      GNUNET_break_op (0);
       return i;
+    }
     i--;
   }
   return i;
 }
 
 
+struct GNUNET_DHT_HelloGetHandle *
+GNUNET_DHT_hello_get (struct GNUNET_DHT_Handle *dht_handle,
+                      GNUNET_DHT_HelloGetCallback cb,
+                      void *cb_cls)
+{
+  struct GNUNET_DHT_HelloGetHandle *hgh;
+  struct GNUNET_MessageHeader *hdr;
+  struct GNUNET_MQ_Envelope *env;
+
+  hgh = GNUNET_new (struct GNUNET_DHT_HelloGetHandle);
+  hgh->cb = cb;
+  hgh->cb_cls = cb_cls;
+  hgh->dht_handle = dht_handle;
+  GNUNET_CONTAINER_DLL_insert (dht_handle->hgh_head,
+                               dht_handle->hgh_tail,
+                               hgh);
+  env = GNUNET_MQ_msg (hdr,
+                       GNUNET_MESSAGE_TYPE_DHT_CLIENT_HELLO_GET);
+  GNUNET_MQ_send (dht_handle->mq,
+                  env);
+  return hgh;
+}
+
+
+void
+GNUNET_DHT_hello_get_cancel (struct GNUNET_DHT_HelloGetHandle *hgh)
+{
+  struct GNUNET_DHT_Handle *dht_handle = hgh->dht_handle;
+
+  GNUNET_CONTAINER_DLL_remove (dht_handle->hgh_head,
+                               dht_handle->hgh_tail,
+                               hgh);
+  GNUNET_free (hgh);
+}
+
+
+void
+GNUNET_DHT_hello_offer (struct GNUNET_DHT_Handle *dht_handle,
+                        const char *url,
+                        GNUNET_SCHEDULER_TaskCallback cb,
+                        void *cb_cls)
+{
+  struct GNUNET_MessageHeader *hdr;
+  size_t slen = strlen (url) + 1;
+  struct GNUNET_MQ_Envelope *env;
+
+  env = GNUNET_MQ_msg_extra (hdr,
+                             slen,
+                             GNUNET_MESSAGE_TYPE_DHT_CLIENT_HELLO_URL);
+  memcpy (&hdr[1],
+          url,
+          slen);
+  GNUNET_MQ_notify_sent (env,
+                         cb,
+                         cb_cls);
+  GNUNET_MQ_send (dht_handle->mq,
+                  env);
+}
+
+
 /* end of dht_api.c */
diff --git a/src/dht/dhtu_testbed_connect.sh b/src/dht/dhtu_testbed_connect.sh
new file mode 100755
index 000000000..871e9eb1b
--- /dev/null
+++ b/src/dht/dhtu_testbed_connect.sh
@@ -0,0 +1,31 @@
+#!/bin/bash
+# This file is in the public domain.
+
+# Helper script for dhtu_testbed_deploy.sh.
+# Do not invoke directly.
+
+n=$1
+CFG="/tmp/deployment/${n}.conf"
+HELLO=`gnunet-dht-hello -c $CFG`
+
+# Create dense topology:
+#for OFF in `seq 1 $MAX`
+#do
+#    TCFG="/tmp/deployment/${OFF}.conf"
+#    gnunet-dht-hello -c $TCFG $HELLO
+#done
+#exit 0
+
+# Create sparse topology:
+R=1
+while test `expr $R \* $R \* $R` -lt $MAX
+do
+    END=`expr $R \* $R`
+    for M in `seq $R $R $END`
+    do
+        OFF=`expr \( $n + $M \) % $MAX`
+        TCFG="/tmp/deployment/${OFF}.conf"
+        gnunet-dht-hello -c $TCFG $HELLO
+    done
+    R=`expr $R + 1`
+done
diff --git a/src/dht/dhtu_testbed_deploy.conf b/src/dht/dhtu_testbed_deploy.conf
new file mode 100644
index 000000000..59d69894a
--- /dev/null
+++ b/src/dht/dhtu_testbed_deploy.conf
@@ -0,0 +1,26 @@
+# This file is in the public domain.
+
+# Simple configuration template to deploy a DHT testbed
+# with peers using the IP underlay.
+
+[paths]
+GNUNET_DATA_HOME=/tmp/%N%
+
+[dht]
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-service-dht-%N%.sock
+
+[dhtu-ip]
+ENABLED = YES
+NSE = 10
+UDP_PORT = %N%
+
+[dhtu-gnunet]
+ENABLED = NO
+
+[statistics]
+DISABLE = YES
+
+[dhtcache]
+DATABASE = heap
+QUOTA = 50 MB
+DISABLE_BF_RC = YES
diff --git a/src/dht/dhtu_testbed_deploy.sh b/src/dht/dhtu_testbed_deploy.sh
new file mode 100755
index 000000000..908bbf685
--- /dev/null
+++ b/src/dht/dhtu_testbed_deploy.sh
@@ -0,0 +1,84 @@
+#!/bin/bash
+# This file is in the public domain.
+
+# We will use UDP ports above this number.
+MINPORT=10000
+
+# Cleanup to run whenever we exit
+function cleanup()
+{
+    for n in `jobs -p`
+    do
+        kill $n 2> /dev/null || true
+    done
+    wait
+}
+
+# Install cleanup handler (except for kill -9)
+trap cleanup EXIT
+
+if test -z "$1"
+then
+    echo "Call with the number of peers to launch."
+    exit 1
+fi
+
+if test ! -x `which parallel`
+then
+    echo "This script requires GNU parallel"
+    exit 1
+fi
+
+if test ! -x `which gnunet-service-dht`
+then
+    echo "This script requires gnunet-service-dht in \$PATH"
+    exit 1
+fi
+
+if test ! -x `which gnunet-dht-hello`
+then
+    echo "This script requires gnunet-dht-hello in \$PATH"
+    exit 1
+fi
+
+MAX=`expr $1 - 1`
+
+# export GNUNET_FORCE_LOG="dht*;;;;DEBUG"
+
+echo -n "Starting $1 peers "
+mkdir -p /tmp/deployment
+for n in `seq 0 $MAX`
+do
+    PORT=`expr $MINPORT + $n`
+    CFG="/tmp/deployment/${n}.conf"
+    cat dhtu_testbed_deploy.conf | sed -e "s/%N%/$PORT/" > $CFG
+    gnunet-service-dht -c $CFG &> /tmp/deployment/$n.log &
+    echo -n "."
+done
+
+echo ""
+echo "$1 peers ready".
+
+unset GNUNET_FORCE_LOG
+
+function connect()
+{
+  n=$1
+}
+
+echo -n "Connecting peers ..."
+
+export MAX
+if test 0 != $MAX
+then
+  seq 0 $MAX | parallel ./dhtu_testbed_connect.sh :::
+fi
+
+
+echo ""
+echo "Network ready. Press ENTER to terminate the testbed!"
+echo "Interact with peers using '-c /tmp/deployment/\$N.conf'"
+
+read
+
+exit 0
diff --git a/src/dht/gnunet-dht-get.c b/src/dht/gnunet-dht-get.c
index f1076490b..42ffe75ba 100644
--- a/src/dht/gnunet-dht-get.c
+++ b/src/dht/gnunet-dht-get.c
@@ -58,6 +58,11 @@ static unsigned int verbose;
 static int demultixplex_everywhere;
 
 /**
+ * Use #GNUNET_DHT_RO_RECORD_ROUTE.
+ */
+static int record_route;
+
+/**
  * Handle to the DHT
  */
 static struct GNUNET_DHT_Handle *dht_handle;
@@ -160,9 +165,9 @@ get_result_iterator (void *cls,
            : _ ("Result %d, type %d:\n"),
            result_count,
            type,
-           (unsigned int) size,
+           (int) size,
            (char *) data);
-  if (verbose)
+  if (record_route && verbose)
   {
     fprintf (stdout,
              "  GET path: ");
@@ -200,6 +205,7 @@ run (void *cls,
      const struct GNUNET_CONFIGURATION_Handle *c)
 {
   struct GNUNET_HashCode key;
+  enum GNUNET_DHT_RouteOption ro;
 
   cfg = c;
   if (NULL == query_key)
@@ -228,13 +234,16 @@ run (void *cls,
              GNUNET_h2s_full (&key));
   GNUNET_SCHEDULER_add_shutdown (&cleanup_task, NULL);
   tt = GNUNET_SCHEDULER_add_delayed (timeout_request, &timeout_task, NULL);
+  ro = GNUNET_DHT_RO_NONE;
+  if (demultixplex_everywhere)
+    ro |= GNUNET_DHT_RO_DEMULTIPLEX_EVERYWHERE;
+  if (record_route)
+    ro |= GNUNET_DHT_RO_RECORD_ROUTE;
   get_handle = GNUNET_DHT_get_start (dht_handle,
                                      query_type,
                                      &key,
                                      replication,
-                                     (demultixplex_everywhere)
-                                     ? GNUNET_DHT_RO_DEMULTIPLEX_EVERYWHERE
-                                     : GNUNET_DHT_RO_NONE,
+                                     ro,
                                      NULL,
                                      0,
                                      &get_result_iterator,
@@ -265,6 +274,11 @@ main (int argc, char *const *argv)
       "LEVEL",
       gettext_noop ("how many parallel requests (replicas) to create"),
       &replication),
+    GNUNET_GETOPT_option_flag (
+      'R',
+      "record",
+      gettext_noop ("use DHT's record route option"),
+      &record_route),
     GNUNET_GETOPT_option_uint (
       't',
       "type",
diff --git a/src/dht/gnunet-dht-hello.c b/src/dht/gnunet-dht-hello.c
new file mode 100644
index 000000000..369ed5643
--- /dev/null
+++ b/src/dht/gnunet-dht-hello.c
@@ -0,0 +1,178 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2022 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file dht/gnunet-dht-hello.c
+ * @brief Obtain HELLO from DHT for bootstrapping
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_dht_service.h"
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "dht-clients", __VA_ARGS__)
+
+/**
+ * Handle to the DHT
+ */
+static struct GNUNET_DHT_Handle *dht_handle;
+
+/**
+ * Handle to the DHT hello get operation.
+ */
+static struct GNUNET_DHT_HelloGetHandle *get_hello_handle;
+
+/**
+ * Global status value
+ */
+static int global_ret;
+
+
+/**
+ * Task run to clean up on shutdown.
+ *
+ * @param cls unused
+ */
+static void
+cleanup_task (void *cls)
+{
+  if (NULL != get_hello_handle)
+  {
+    GNUNET_DHT_hello_get_cancel (get_hello_handle);
+    get_hello_handle = NULL;
+  }
+  if (NULL != dht_handle)
+  {
+    GNUNET_DHT_disconnect (dht_handle);
+    dht_handle = NULL;
+  }
+}
+
+
+/**
+ * Task run when we are finished. Triggers shutdown.
+ *
+ * @param cls unused
+ */
+static void
+hello_done_cb (void *cls)
+{
+  GNUNET_SCHEDULER_shutdown ();
+}
+
+
+/**
+ * Function called on our HELLO.
+ *
+ * @param cls closure
+ * @param url the HELLO URL
+ */
+static void
+hello_result_cb (void *cls,
+                 const char *url)
+{
+  get_hello_handle = NULL;
+  fprintf (stdout,
+           "%s\n",
+           url);
+  GNUNET_SCHEDULER_shutdown ();
+}
+
+
+/**
+ * Main function that will be run by the scheduler.
+ *
+ * @param cls closure, NULL
+ * @param args remaining command-line arguments
+ * @param cfgfile name of the configuration file used (for saving, can be NULL!)
+ * @param cfg configuration
+ */
+static void
+run (void *cls,
+     char *const *args,
+     const char *cfgfile,
+     const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  (void) cls;
+  (void) cfgfile;
+  GNUNET_SCHEDULER_add_shutdown (&cleanup_task,
+                                 NULL);
+  if (NULL == (dht_handle = GNUNET_DHT_connect (cfg,
+                                                1)))
+  {
+    fprintf (stderr,
+             _ ("Failed to connect to DHT service!\n"));
+    global_ret = EXIT_NOTCONFIGURED;
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
+  if (NULL == args[0])
+  {
+    get_hello_handle = GNUNET_DHT_hello_get (dht_handle,
+                                             &hello_result_cb,
+                                             NULL);
+    GNUNET_break (NULL != get_hello_handle);
+  }
+  else
+  {
+    GNUNET_DHT_hello_offer (dht_handle,
+                            args[0],
+                            &hello_done_cb,
+                            NULL);
+  }
+}
+
+
+/**
+ * Entry point for gnunet-dht-hello
+ *
+ * @param argc number of arguments from the command line
+ * @param argv command line arguments
+ * @return 0 ok, 1 on error
+ */
+int
+main (int argc,
+      char *const *argv)
+{
+  struct GNUNET_GETOPT_CommandLineOption options[] = {
+    GNUNET_GETOPT_OPTION_END
+  };
+  enum GNUNET_GenericReturnValue iret;
+
+  if (GNUNET_OK !=
+      GNUNET_STRINGS_get_utf8_args (argc, argv,
+                                    &argc, &argv))
+    return 2;
+  iret = GNUNET_PROGRAM_run (
+    argc,
+    argv,
+    "gnunet-dht-hello [URL]",
+    gettext_noop (
+      "Obtain HELLO from DHT or provide HELLO to DHT for bootstrapping"),
+    options,
+    &run,
+    NULL);
+  if (GNUNET_SYSERR == iret)
+    return EXIT_FAILURE;
+  if (GNUNET_NO == iret)
+    return EXIT_SUCCESS;
+  return global_ret;
+}
+
+
+/* end of gnunet-dht-hello.c */
diff --git a/src/dht/gnunet-service-dht.c b/src/dht/gnunet-service-dht.c
index da46dcfee..39433791d 100644
--- a/src/dht/gnunet-service-dht.c
+++ b/src/dht/gnunet-service-dht.c
@@ -27,53 +27,335 @@
 #include "platform.h"
 #include "gnunet_block_lib.h"
 #include "gnunet_util_lib.h"
-#include "gnunet_transport_service.h"
-#include "gnunet_transport_hello_service.h"
 #include "gnunet_hello_lib.h"
+#include "gnunet_hello_uri_lib.h"
 #include "gnunet_dht_service.h"
 #include "gnunet_statistics_service.h"
 #include "gnunet-service-dht.h"
 #include "gnunet-service-dht_datacache.h"
-#include "gnunet-service-dht_hello.h"
 #include "gnunet-service-dht_neighbours.h"
-#include "gnunet-service-dht_nse.h"
 #include "gnunet-service-dht_routing.h"
 
 /**
+ * How often do we broadcast our HELLO to neighbours if
+ * nothing special happens?
+ */
+#define HELLO_FREQUENCY GNUNET_TIME_UNIT_HOURS
+
+
+/**
+ * Information we keep per underlay.
+ */
+struct GDS_Underlay
+{
+
+  /**
+   * Kept in a DLL.
+   */
+  struct GDS_Underlay *next;
+
+  /**
+   * Kept in a DLL.
+   */
+  struct GDS_Underlay *prev;
+
+  /**
+   * Environment for this underlay.
+   */
+  struct GNUNET_DHTU_PluginEnvironment env;
+
+  /**
+   * Underlay API handle.
+   */
+  struct GNUNET_DHTU_PluginFunctions *dhtu;
+
+  /**
+   * current network size estimate for this underlay.
+   */
+  double network_size_estimate;
+
+  /**
+   * Name of the underlay (i.e. "gnunet" or "ip").
+   */
+  char *name;
+
+  /**
+   * Name of the library providing the underlay.
+   */
+  char *libname;
+};
+
+
+/**
+ * An address of this peer.
+ */
+struct MyAddress
+{
+  /**
+   * Kept in a DLL.
+   */
+  struct MyAddress *next;
+
+  /**
+   * Kept in a DLL.
+   */
+  struct MyAddress *prev;
+
+  /**
+   * Underlay handle for the address.
+   */
+  struct GNUNET_DHTU_Source *source;
+
+  /**
+   * Textual representation of the address.
+   */
+  char *url;
+
+  /**
+   * Underlay of this address.
+   */
+  struct GDS_Underlay *u;
+};
+
+
+/**
  * Our HELLO
  */
-struct GNUNET_MessageHeader *GDS_my_hello;
+struct GNUNET_HELLO_Builder *GDS_my_hello;
 
 /**
- * Handle to get our current HELLO.
+ * Identity of this peer.
  */
-static struct GNUNET_TRANSPORT_HelloGetHandle *ghh;
+struct GNUNET_PeerIdentity GDS_my_identity;
 
 /**
- * Hello address expiration
+ * Hash of the identity of this peer.
  */
-struct GNUNET_TIME_Relative hello_expiration;
+struct GNUNET_HashCode GDS_my_identity_hash;
+
+/**
+ * Our private key.
+ */
+struct GNUNET_CRYPTO_EddsaPrivateKey GDS_my_private_key;
+
+/**
+ * Task broadcasting our HELLO.
+ */
+static struct GNUNET_SCHEDULER_Task *hello_task;
+
+/**
+ * Handles for the DHT underlays.
+ */
+static struct GDS_Underlay *u_head;
+
+/**
+ * Handles for the DHT underlays.
+ */
+static struct GDS_Underlay *u_tail;
+
+/**
+ * Head of addresses of this peer.
+ */
+static struct MyAddress *a_head;
+
+/**
+ * Tail of addresses of this peer.
+ */
+static struct MyAddress *a_tail;
+
+/**
+ * log of the current network size estimate, used as the point where
+ * we switch between random and deterministic routing.
+ */
+static double log_of_network_size_estimate;
+
+
+/**
+ * Callback that is called when network size estimate is updated.
+ *
+ * @param cls a `struct GDS_Underlay`
+ * @param timestamp time when the estimate was received from the server (or created by the server)
+ * @param logestimate the log(Base 2) value of the current network size estimate
+ * @param std_dev standard deviation for the estimate
+ *
+ */
+static void
+update_network_size_estimate (void *cls,
+                              struct GNUNET_TIME_Absolute timestamp,
+                              double logestimate,
+                              double std_dev)
+{
+  struct GDS_Underlay *u = cls;
+  double sum = 0.0;
+
+  GNUNET_STATISTICS_update (GDS_stats,
+                            "# Network size estimates received",
+                            1,
+                            GNUNET_NO);
+  /* do not allow estimates < 0.5 */
+  u->network_size_estimate = pow (2.0,
+                                  GNUNET_MAX (0.5,
+                                              logestimate));
+  for (struct GDS_Underlay *p = u_head; NULL != p; p = p->next)
+    sum += p->network_size_estimate;
+  if (sum <= 2.0)
+    log_of_network_size_estimate = 0.5;
+  else
+    log_of_network_size_estimate = log2 (sum);
+}
+
+
+/**
+ * Return the current NSE
+ *
+ * @return the current NSE as a logarithm
+ */
+double
+GDS_NSE_get (void)
+{
+  return log_of_network_size_estimate;
+}
 
 
 #include "gnunet-service-dht_clients.c"
 
 
 /**
- * Receive the HELLO from transport service, free current and replace
- * if necessary.
+ * Task run periodically to broadcast our HELLO.
  *
  * @param cls NULL
- * @param message HELLO message of peer
  */
 static void
-process_hello (void *cls,
-               const struct GNUNET_MessageHeader *message)
+broadcast_hello (void *cls)
 {
-  GNUNET_free (GDS_my_hello);
-  GDS_my_hello = GNUNET_malloc (ntohs (message->size));
-  GNUNET_memcpy (GDS_my_hello,
-                 message,
-                 ntohs (message->size));
+  struct GNUNET_MessageHeader *hello;
+
+  (void) cls;
+  /* TODO: randomize! */
+  hello_task = GNUNET_SCHEDULER_add_delayed (HELLO_FREQUENCY,
+                                             &broadcast_hello,
+                                             NULL);
+  hello = GNUNET_HELLO_builder_to_dht_hello_msg (GDS_my_hello,
+                                                 &GDS_my_private_key);
+  if (NULL == hello)
+  {
+    GNUNET_break (0);
+    return;
+  }
+  GDS_NEIGHBOURS_broadcast (hello);
+  GNUNET_free (hello);
+}
+
+
+/**
+ * Function to call with new addresses of this peer.
+ *
+ * @param cls the closure
+ * @param address address under which we are likely reachable,
+ *           pointer will remain valid until @e address_del_cb is called; to be used for HELLOs. Example: "ip+udp://$PID/1.1.1.1:2086/"
+ * @param source handle for sending from this address, NULL if we can only receive
+ * @param[out] ctx storage space for DHT to use in association with this address
+ */
+static void
+u_address_add (void *cls,
+               const char *address,
+               struct GNUNET_DHTU_Source *source,
+               void **ctx)
+{
+  struct GDS_Underlay *u = cls;
+  struct MyAddress *a;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "Underlay adds address %s for this peer\n",
+              address);
+  a = GNUNET_new (struct MyAddress);
+  a->source = source;
+  a->url = GNUNET_strdup (address);
+  a->u = u;
+  GNUNET_CONTAINER_DLL_insert (a_head,
+                               a_tail,
+                               a);
+  *ctx = a;
+  GNUNET_HELLO_builder_add_address (GDS_my_hello,
+                                    address);
+  if (NULL != hello_task)
+    GNUNET_SCHEDULER_cancel (hello_task);
+  hello_task = GNUNET_SCHEDULER_add_now (&broadcast_hello,
+                                         NULL);
+}
+
+
+/**
+ * Function to call with expired addresses of this peer.
+ *
+ * @param[in] ctx storage space used by the DHT in association with this address
+ */
+static void
+u_address_del (void *ctx)
+{
+  struct MyAddress *a = ctx;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "Underlay deletes address %s for this peer\n",
+              a->url);
+  GNUNET_HELLO_builder_del_address (GDS_my_hello,
+                                    a->url);
+  GNUNET_CONTAINER_DLL_remove (a_head,
+                               a_tail,
+                               a);
+  GNUNET_free (a->url);
+  GNUNET_free (a);
+  if (NULL != hello_task)
+    GNUNET_SCHEDULER_cancel (hello_task);
+  hello_task = GNUNET_SCHEDULER_add_now (&broadcast_hello,
+                                         NULL);
+}
+
+
+void
+GDS_u_try_connect (const struct GNUNET_PeerIdentity *pid,
+                   const char *address)
+{
+  for (struct GDS_Underlay *u = u_head;
+       NULL != u;
+       u = u->next)
+    u->dhtu->try_connect (u->dhtu->cls,
+                          pid,
+                          address);
+}
+
+
+void
+GDS_u_send (struct GDS_Underlay *u,
+            struct GNUNET_DHTU_Target *target,
+            const void *msg,
+            size_t msg_size,
+            GNUNET_SCHEDULER_TaskCallback finished_cb,
+            void *finished_cb_cls)
+{
+  u->dhtu->send (u->dhtu->cls,
+                 target,
+                 msg,
+                 msg_size,
+                 finished_cb,
+                 finished_cb_cls);
+}
+
+
+void
+GDS_u_drop (struct GDS_Underlay *u,
+            struct GNUNET_DHTU_PreferenceHandle *ph)
+{
+  u->dhtu->drop (ph);
+}
+
+
+struct GNUNET_DHTU_PreferenceHandle *
+GDS_u_hold (struct GDS_Underlay *u,
+            struct GNUNET_DHTU_Target *target)
+{
+  return u->dhtu->hold (u->dhtu->cls,
+                        target);
 }
 
 
@@ -85,30 +367,97 @@ process_hello (void *cls,
 static void
 shutdown_task (void *cls)
 {
-  if (NULL != ghh)
+  struct GDS_Underlay *u;
+
+  while (NULL != (u = u_head))
   {
-    GNUNET_TRANSPORT_hello_get_cancel (ghh);
-    ghh = NULL;
+    GNUNET_PLUGIN_unload (u->libname,
+                          u->dhtu);
+    GNUNET_CONTAINER_DLL_remove (u_head,
+                                 u_tail,
+                                 u);
+    GNUNET_free (u->name);
+    GNUNET_free (u->libname);
+    GNUNET_free (u);
   }
   GDS_NEIGHBOURS_done ();
   GDS_DATACACHE_done ();
   GDS_ROUTING_done ();
-  GDS_HELLO_done ();
-  GDS_NSE_done ();
   if (NULL != GDS_block_context)
   {
     GNUNET_BLOCK_context_destroy (GDS_block_context);
     GDS_block_context = NULL;
   }
+  GDS_CLIENTS_stop ();
   if (NULL != GDS_stats)
   {
     GNUNET_STATISTICS_destroy (GDS_stats,
                                GNUNET_YES);
     GDS_stats = NULL;
   }
-  GNUNET_free (GDS_my_hello);
-  GDS_my_hello = NULL;
-  GDS_CLIENTS_stop ();
+  if (NULL != GDS_my_hello)
+  {
+    GNUNET_HELLO_builder_free (GDS_my_hello);
+    GDS_my_hello = NULL;
+  }
+  if (NULL != hello_task)
+  {
+    GNUNET_SCHEDULER_cancel (hello_task);
+    hello_task = NULL;
+  }
+}
+
+
+/**
+ * Function iterating over all configuration sections.
+ * Loads plugins for enabled DHT underlays.
+ *
+ * @param cls NULL
+ * @param section configuration section to inspect
+ */
+static void
+load_underlay (void *cls,
+               const char *section)
+{
+  struct GDS_Underlay *u;
+  char *libname;
+
+  (void) cls;
+  if (0 != strncasecmp (section,
+                        "dhtu-",
+                        strlen ("dhtu-")))
+    return;
+  if (GNUNET_YES !=
+      GNUNET_CONFIGURATION_get_value_yesno (GDS_cfg,
+                                            section,
+                                            "ENABLED"))
+    return;
+  section += strlen ("dhtu-");
+  u = GNUNET_new (struct GDS_Underlay);
+  u->env.cls = u;
+  u->env.cfg = GDS_cfg;
+  u->env.address_add_cb = &u_address_add;
+  u->env.address_del_cb = &u_address_del;
+  u->env.network_size_cb = &update_network_size_estimate;
+  u->env.connect_cb = &GDS_u_connect;
+  u->env.disconnect_cb = &GDS_u_disconnect;
+  u->env.receive_cb = &GDS_u_receive;
+  GNUNET_asprintf (&libname,
+                   "libgnunet_plugin_dhtu_%s",
+                   section);
+  u->dhtu = GNUNET_PLUGIN_load (libname,
+                                &u->env);
+  if (NULL == u->dhtu)
+  {
+    GNUNET_free (libname);
+    GNUNET_free (u);
+    return;
+  }
+  u->libname = libname;
+  u->name = GNUNET_strdup (section);
+  GNUNET_CONTAINER_DLL_insert (u_head,
+                               u_tail,
+                               u);
 }
 
 
@@ -126,34 +475,64 @@ run (void *cls,
 {
   GDS_cfg = c;
   GDS_service = service;
-  if (GNUNET_OK !=
-      GNUNET_CONFIGURATION_get_value_time (c,
-                                           "transport",
-                                           "HELLO_EXPIRATION",
-                                           &hello_expiration))
   {
-    hello_expiration = GNUNET_CONSTANTS_HELLO_ADDRESS_EXPIRATION;
+    char *keyfile;
+
+    if (GNUNET_OK !=
+        GNUNET_CONFIGURATION_get_value_filename (GDS_cfg,
+                                                 "PEER",
+                                                 "PRIVATE_KEY",
+                                                 &keyfile))
+    {
+      GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR,
+                                 "PEER",
+                                 "PRIVATE_KEY");
+      GNUNET_SCHEDULER_shutdown ();
+      return;
+    }
+    if (GNUNET_SYSERR ==
+        GNUNET_CRYPTO_eddsa_key_from_file (keyfile,
+                                           GNUNET_YES,
+                                           &GDS_my_private_key))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  "Failed to setup peer's private key\n");
+      GNUNET_free (keyfile);
+      GNUNET_SCHEDULER_shutdown ();
+      return;
+    }
+    GNUNET_free (keyfile);
   }
+  GNUNET_CRYPTO_eddsa_key_get_public (&GDS_my_private_key,
+                                      &GDS_my_identity.public_key);
+  GDS_my_hello = GNUNET_HELLO_builder_new (&GDS_my_identity);
+  GNUNET_CRYPTO_hash (&GDS_my_identity,
+                      sizeof(struct GNUNET_PeerIdentity),
+                      &GDS_my_identity_hash);
   GDS_block_context = GNUNET_BLOCK_context_create (GDS_cfg);
   GDS_stats = GNUNET_STATISTICS_create ("dht",
                                         GDS_cfg);
-  GNUNET_SERVICE_suspend (GDS_service);
   GDS_CLIENTS_init ();
   GDS_ROUTING_init ();
-  GDS_NSE_init ();
   GDS_DATACACHE_init ();
-  GDS_HELLO_init ();
-  if (GNUNET_OK != GDS_NEIGHBOURS_init ())
+  GNUNET_SCHEDULER_add_shutdown (&shutdown_task,
+                                 NULL);
+  if (GNUNET_OK !=
+      GDS_NEIGHBOURS_init ())
   {
-    shutdown_task (NULL);
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
+  GNUNET_CONFIGURATION_iterate_sections (GDS_cfg,
+                                         &load_underlay,
+                                         NULL);
+  if (NULL == u_head)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "No DHT underlays configured!\n");
+    GNUNET_SCHEDULER_shutdown ();
     return;
   }
-  GNUNET_SCHEDULER_add_shutdown (&shutdown_task,
-                                 NULL);
-  ghh = GNUNET_TRANSPORT_hello_get (GDS_cfg,
-                                    GNUNET_TRANSPORT_AC_GLOBAL,
-                                    &process_hello,
-                                    NULL);
 }
 
 
diff --git a/src/dht/gnunet-service-dht.h b/src/dht/gnunet-service-dht.h
index 367ff426e..a1513fcce 100644
--- a/src/dht/gnunet-service-dht.h
+++ b/src/dht/gnunet-service-dht.h
@@ -27,6 +27,7 @@
 #define GNUNET_SERVICE_DHT_H
 
 #include "gnunet-service-dht_datacache.h"
+#include "gnunet-service-dht_neighbours.h"
 #include "gnunet_statistics_service.h"
 #include "gnunet_transport_service.h"
 
@@ -34,6 +35,11 @@
 #define DEBUG_DHT GNUNET_EXTRA_LOGGING
 
 /**
+ * Information we keep per underlay.
+ */
+struct GDS_Underlay;
+
+/**
  * Configuration we use.
  */
 extern const struct GNUNET_CONFIGURATION_Handle *GDS_cfg;
@@ -54,9 +60,81 @@ extern struct GNUNET_BLOCK_Context *GDS_block_context;
 extern struct GNUNET_STATISTICS_Handle *GDS_stats;
 
 /**
- * Our HELLO
+ * Our HELLO builder.
+ */
+extern struct GNUNET_HELLO_Builder *GDS_my_hello;
+
+/**
+ * Identity of this peer.
+ */
+extern struct GNUNET_PeerIdentity GDS_my_identity;
+
+/**
+ * Hash of the identity of this peer.
+ */
+extern struct GNUNET_HashCode GDS_my_identity_hash;
+
+/**
+ * Our private key.
+ */
+extern struct GNUNET_CRYPTO_EddsaPrivateKey GDS_my_private_key;
+
+
+/**
+ * Ask all underlays to connect to peer @a pid at @a address.
+ *
+ * @param pid identity of the peer we would connect to
+ * @param address an address of @a pid
+ */
+void
+GDS_u_try_connect (const struct GNUNET_PeerIdentity *pid,
+                   const char *address);
+
+
+/**
+ * Send message to some other participant over the network.  Note that
+ * sending is not guaranteeing that the other peer actually received the
+ * message.  For any given @a target, the DHT must wait for the @a
+ * finished_cb to be called before calling send() again.
+ *
+ * @param u underlay to use for transmission
+ * @param target receiver identification
+ * @param msg message
+ * @param msg_size number of bytes in @a msg
+ * @param finished_cb function called once transmission is done
+ *        (not called if @a target disconnects, then only the
+ *         disconnect_cb is called).
+ * @param finished_cb_cls closure for @a finished_cb
+ */
+void
+GDS_u_send (struct GDS_Underlay *u,
+            struct GNUNET_DHTU_Target *target,
+            const void *msg,
+            size_t msg_size,
+            GNUNET_SCHEDULER_TaskCallback finished_cb,
+            void *finished_cb_cls);
+
+
+/**
+ * Drop a hold @a ph from underlay @a u.
+ *
+ * @param u the underlay controlling the hold
+ * @param ph the preference handle
+ */
+void
+GDS_u_drop (struct GDS_Underlay *u,
+            struct GNUNET_DHTU_PreferenceHandle *ph);
+
+
+/**
+ * Create a hold on @a target at underlay @a u.
+ *
+ * @param u the underlay controlling the target
+ * @param target the peer to hold the connection to
  */
-extern struct GNUNET_MessageHeader *GDS_my_hello;
+struct GNUNET_DHTU_PreferenceHandle *
+GDS_u_hold (struct GDS_Underlay *u,
+            struct GNUNET_DHTU_Target *target);
 
 
 /**
@@ -68,8 +146,9 @@ extern struct GNUNET_MessageHeader *GDS_my_hello;
  * @param query_hash hash of the original query, might not match key in @a bd
  * @param get_path_length number of entries in @a get_path
  * @param get_path path the reply has taken
+ * @return true on success, false on failures
  */
-void
+bool
 GDS_CLIENTS_handle_reply (const struct GDS_DATACACHE_BlockData *bd,
                           const struct GNUNET_HashCode *query_hash,
                           unsigned int get_path_length,
@@ -128,4 +207,12 @@ GDS_CLIENTS_process_put (enum GNUNET_DHT_RouteOption options,
                          uint32_t hop_count,
                          uint32_t desired_replication_level);
 
+/**
+ * Return the current NSE
+ *
+ * @return the current NSE as a logarithm
+ */
+double
+GDS_NSE_get (void);
+
 #endif
diff --git a/src/dht/gnunet-service-dht_clients.c b/src/dht/gnunet-service-dht_clients.c
index a1c3024de..6a4f58d1f 100644
--- a/src/dht/gnunet-service-dht_clients.c
+++ b/src/dht/gnunet-service-dht_clients.c
@@ -24,7 +24,6 @@
  * @author Christian Grothoff
  * @author Nathan Evans
  */
-
 #include "platform.h"
 #include "gnunet_constants.h"
 #include "gnunet_protocols.h"
@@ -36,6 +35,14 @@
 
 
 /**
+ * Enable slow sanity checks to debug issues.
+ * 0: do not check
+ * 1: check all external inputs
+ * 2: check internal computations as well
+ */
+#define SANITY_CHECKS 2
+
+/**
  * Should routing details be logged to stderr (for debugging)?
  */
 #define LOG_TRAFFIC(kind, ...) GNUNET_log_from (kind, "dht-traffic", \
@@ -503,6 +510,15 @@ handle_dht_local_put (void *cls,
        (unsigned long) (size - sizeof(struct GNUNET_DHT_ClientPutMessage)),
        GNUNET_h2s (&dht_msg->key),
        (unsigned int) bd.type);
+  if (GNUNET_OK !=
+      GNUNET_BLOCK_check_block (GDS_block_context,
+                                bd.type,
+                                bd.data,
+                                bd.data_size))
+  {
+    GNUNET_break (0);
+    return;
+  }
   GNUNET_STATISTICS_update (GDS_stats,
                             "# PUT requests received from clients",
                             1,
@@ -511,9 +527,9 @@ handle_dht_local_put (void *cls,
                "CLIENT-PUT %s\n",
                GNUNET_h2s_full (&dht_msg->key));
   /* give to local clients */
-  GDS_CLIENTS_handle_reply (&bd,
-                            &bd.key,
-                            0, NULL /* get path */);
+  GNUNET_break (GDS_CLIENTS_handle_reply (&bd,
+                                          &bd.key,
+                                          0, NULL /* get path */));
 
   {
     struct GNUNET_CONTAINER_BloomFilter *peer_bf;
@@ -561,10 +577,12 @@ static void
 handle_local_result (void *cls,
                      const struct GDS_DATACACHE_BlockData *bd)
 {
-  /* FIXME: use 'cls' instead of looking up the client? */
-  GDS_CLIENTS_handle_reply (bd,
-                            &bd->key,
-                            0, NULL /* get_path */);
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "Datacache provided result for query key %s\n",
+              GNUNET_h2s (&bd->key));
+  GNUNET_break (GDS_CLIENTS_handle_reply (bd,
+                                          &bd->key,
+                                          0, NULL /* get_path */));
 }
 
 
@@ -917,7 +935,7 @@ forward_reply (void *cls,
                               GNUNET_NO);
     return GNUNET_YES;          /* type mismatch */
   }
-  if ( (0 == (record->msg_options & GNUNET_DHT_RO_FIND_PEER)) &&
+  if ( (0 == (record->msg_options & GNUNET_DHT_RO_FIND_APPROXIMATE)) &&
        (0 != GNUNET_memcmp (&frc->bd->key,
                             query_hash)) )
   {
@@ -973,9 +991,6 @@ forward_reply (void *cls,
     /* should be impossible to encounter here */
     GNUNET_break (0);
     return GNUNET_YES;
-  case GNUNET_BLOCK_REPLY_INVALID:
-    GNUNET_break_op (0);
-    return GNUNET_NO;
   case GNUNET_BLOCK_REPLY_IRRELEVANT:
     return GNUNET_YES;
   default:
@@ -996,7 +1011,7 @@ forward_reply (void *cls,
   reply->put_path_length = htonl (frc->bd->put_path_length);
   reply->unique_id = record->unique_id;
   reply->expiration = GNUNET_TIME_absolute_hton (frc->bd->expiration_time);
-  reply->key = frc->bd->key;
+  reply->key = *query_hash;
   paths = (struct GNUNET_DHT_PathElement *) &reply[1];
   GNUNET_memcpy (paths,
                  frc->bd->put_path,
@@ -1004,7 +1019,8 @@ forward_reply (void *cls,
                  * frc->bd->put_path_length);
   GNUNET_memcpy (&paths[frc->bd->put_path_length],
                  frc->get_path,
-                 sizeof(struct GNUNET_DHT_PathElement) * frc->get_path_length);
+                 sizeof(struct GNUNET_DHT_PathElement)
+                 * frc->get_path_length);
   GNUNET_memcpy (&paths[frc->get_path_length + frc->bd->put_path_length],
                  frc->bd->data,
                  frc->bd->data_size);
@@ -1020,7 +1036,7 @@ forward_reply (void *cls,
 }
 
 
-void
+bool
 GDS_CLIENTS_handle_reply (const struct GDS_DATACACHE_BlockData *bd,
                           const struct GNUNET_HashCode *query_hash,
                           unsigned int get_path_length,
@@ -1035,14 +1051,31 @@ GDS_CLIENTS_handle_reply (const struct GDS_DATACACHE_BlockData *bd,
   if (msize >= GNUNET_MAX_MESSAGE_SIZE)
   {
     GNUNET_break (0);
-    return;
+    return false;
   }
+#if SANITY_CHECKS > 1
+  if (0 !=
+      GNUNET_DHT_verify_path (bd->data,
+                              bd->data_size,
+                              bd->expiration_time,
+                              bd->put_path,
+                              bd->put_path_length,
+                              get_path,
+                              get_path_length,
+                              &GDS_my_identity))
+  {
+    GNUNET_break (0);
+    return false;
+  }
+#endif
   frc.bd = bd;
   frc.get_path = get_path;
   frc.get_path_length = get_path_length;
   LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "Forwarding reply for query hash %s to client\n",
-       GNUNET_h2s (query_hash));
+       "Forwarding reply for query hash %s with GPL %u and PPL %u to client\n",
+       GNUNET_h2s (query_hash),
+       get_path_length,
+       bd->put_path_length);
   if (0 ==
       GNUNET_CONTAINER_multihashmap_get_multiple (forward_map,
                                                   query_hash,
@@ -1057,6 +1090,102 @@ GDS_CLIENTS_handle_reply (const struct GDS_DATACACHE_BlockData *bd,
                               1,
                               GNUNET_NO);
   }
+  return true;
+}
+
+
+/* **************** HELLO logic ***************** */
+
+/**
+ * Handler for HELLO GET message. Reply to client
+ * with a URL of our HELLO.
+ *
+ * @param cls the client we received this message from
+ * @param msg the actual message received
+ *
+ */
+static void
+handle_dht_local_hello_get (void *cls,
+                            const struct GNUNET_MessageHeader *msg)
+{
+  struct ClientHandle *ch = cls;
+  char *url = GNUNET_HELLO_builder_to_url (GDS_my_hello,
+                                           &GDS_my_private_key);
+  size_t slen = strlen (url) + 1;
+  struct GNUNET_MessageHeader *hdr;
+  struct GNUNET_MQ_Envelope *env;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Handling request from local client for my HELLO\n");
+  env = GNUNET_MQ_msg_extra (hdr,
+                             slen,
+                             GNUNET_MESSAGE_TYPE_DHT_CLIENT_HELLO_URL);
+  memcpy (&hdr[1],
+          url,
+          slen);
+  GNUNET_free (url);
+  GNUNET_MQ_send (ch->mq,
+                  env);
+  GNUNET_SERVICE_client_continue (ch->client);
+}
+
+
+/**
+ * Process a client HELLO message received from the service.
+ *
+ * @param cls the client we received this message from
+ * @param hdr HELLO URL message from the service.
+ * @return #GNUNET_OK if @a hdr is well-formed
+ */
+static enum GNUNET_GenericReturnValue
+check_dht_local_hello_offer (void *cls,
+                             const struct GNUNET_MessageHeader *hdr)
+{
+  uint16_t len = ntohs (hdr->size);
+  const char *buf = (const char *) &hdr[1];
+
+  (void) cls;
+  if ('\0' != buf[len - sizeof (*hdr) - 1])
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Handler for HELLO OFFER message.  Try to use the
+ * HELLO to connect to another peer.
+ *
+ * @param cls the client we received this message from
+ * @param msg the actual message received
+ */
+static void
+handle_dht_local_hello_offer (void *cls,
+                              const struct GNUNET_MessageHeader *msg)
+{
+  struct ClientHandle *ch = cls;
+  const char *url = (const char *) &msg[1];
+  struct GNUNET_HELLO_Builder *b;
+  struct GNUNET_PeerIdentity pid;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Local client provided HELLO URL %s\n",
+              url);
+  b = GNUNET_HELLO_builder_from_url (url);
+  if (NULL == b)
+  {
+    GNUNET_break (0);
+    GNUNET_SERVICE_client_drop (ch->client);
+    return;
+  }
+  GNUNET_SERVICE_client_continue (ch->client);
+  GNUNET_HELLO_builder_iterate (b,
+                                &pid,
+                                &GDS_try_connect,
+                                &pid);
+  GNUNET_HELLO_builder_free (b);
 }
 
 
@@ -1330,8 +1459,8 @@ response_action (void *cls,
                  bd->put_path_length * sizeof(struct GNUNET_DHT_PathElement));
   GNUNET_memcpy (path,
                  resp_ctx->get_path,
-                 resp_ctx->get_path_length * sizeof(struct
-                                                    GNUNET_DHT_PathElement));
+                 resp_ctx->get_path_length
+                 * sizeof(struct GNUNET_DHT_PathElement));
   GNUNET_memcpy (&path[resp_ctx->get_path_length],
                  bd->data,
                  bd->data_size);
@@ -1504,6 +1633,14 @@ GDS_CLIENTS_stop (void)
                            GNUNET_MESSAGE_TYPE_DHT_CLIENT_GET_RESULTS_KNOWN, \
                            struct GNUNET_DHT_ClientGetResultSeenMessage, \
                            NULL), \
+    GNUNET_MQ_hd_fixed_size (dht_local_hello_get,              \
+                             GNUNET_MESSAGE_TYPE_DHT_CLIENT_HELLO_GET, \
+                             struct GNUNET_MessageHeader, \
+                             NULL), \
+    GNUNET_MQ_hd_var_size (dht_local_hello_offer, \
+                           GNUNET_MESSAGE_TYPE_DHT_CLIENT_HELLO_URL, \
+                           struct GNUNET_MessageHeader, \
+                           NULL), \
     GNUNET_MQ_handler_end ())
 
 
diff --git a/src/dht/gnunet-service-dht_datacache.c b/src/dht/gnunet-service-dht_datacache.c
index cb778717b..be0a6db81 100644
--- a/src/dht/gnunet-service-dht_datacache.c
+++ b/src/dht/gnunet-service-dht_datacache.c
@@ -36,7 +36,7 @@
  * How many "closest" results to we return for migration when
  * asked (at most)?
  */
-#define NUM_CLOSEST 42
+#define NUM_CLOSEST 4
 
 
 /**
@@ -68,7 +68,7 @@ GDS_DATACACHE_handle_put (const struct GDS_DATACACHE_BlockData *bd)
                             1,
                             GNUNET_NO);
   GNUNET_CRYPTO_hash_xor (&bd->key,
-                          &my_identity_hash,
+                          &GDS_my_identity_hash,
                           &xor);
   r = GNUNET_DATACACHE_put (datacache,
                             &bd->key,
@@ -126,7 +126,7 @@ struct GetRequestContext
   /**
    * Return value to give back.
    */
-  enum GNUNET_BLOCK_EvaluationResult eval;
+  enum GNUNET_BLOCK_ReplyEvaluationResult eval;
 };
 
 
@@ -204,13 +204,6 @@ datacache_get_iterator (void *cls,
                               1,
                               GNUNET_NO);
     break;
-  case GNUNET_BLOCK_REPLY_INVALID:
-    /* maybe it expired? */
-    GNUNET_STATISTICS_update (GDS_stats,
-                              "# Invalid RESULTS found in datacache",
-                              1,
-                              GNUNET_NO);
-    break;
   case GNUNET_BLOCK_REPLY_IRRELEVANT:
     GNUNET_STATISTICS_update (GDS_stats,
                               "# Irrelevant RESULTS found in datacache",
@@ -222,7 +215,7 @@ datacache_get_iterator (void *cls,
 }
 
 
-enum GNUNET_BLOCK_EvaluationResult
+enum GNUNET_BLOCK_ReplyEvaluationResult
 GDS_DATACACHE_handle_get (const struct GNUNET_HashCode *key,
                           enum GNUNET_BLOCK_Type type,
                           const void *xquery,
@@ -231,22 +224,23 @@ GDS_DATACACHE_handle_get (const struct GNUNET_HashCode *key,
                           GDS_DATACACHE_GetCallback gc,
                           void *gc_cls)
 {
-  struct GetRequestContext ctx;
+  struct GetRequestContext ctx = {
+                                  .eval = GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED,
+    .key = *key,
+    .xquery = xquery,
+    .xquery_size = xquery_size,
+    .bg = bg,
+    .gc = gc,
+    .gc_cls = gc_cls
+  };
   unsigned int r;
 
   if (NULL == datacache)
-    return GNUNET_BLOCK_EVALUATION_REQUEST_VALID;
+    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
   GNUNET_STATISTICS_update (GDS_stats,
                             "# GET requests given to datacache",
                             1,
                             GNUNET_NO);
-  ctx.eval = GNUNET_BLOCK_EVALUATION_REQUEST_VALID;
-  ctx.key = *key;
-  ctx.xquery = xquery;
-  ctx.xquery_size = xquery_size;
-  ctx.bg = bg;
-  ctx.gc = gc;
-  ctx.gc_cls = gc_cls;
   r = GNUNET_DATACACHE_get (datacache,
                             key,
                             type,
@@ -261,85 +255,44 @@ GDS_DATACACHE_handle_get (const struct GNUNET_HashCode *key,
 }
 
 
-/**
- * Closure for #datacache_get_successors_iterator().
- */
-struct SuccContext
-{
-  /**
-   * Function to call on the result
-   */
-  GDS_DATACACHE_GetCallback cb;
-
-  /**
-   * Closure for @e cb.
-   */
-  void *cb_cls;
-
-};
-
-
-/**
- * Iterator for local get request results,
- *
- * @param cls closure with the `struct GNUNET_HashCode *` with the trail ID
- * @param key the key this data is stored under
- * @param size the size of the data identified by key
- * @param data the actual data
- * @param type the type of the data
- * @param exp when does this value expire?
- * @param put_path_length number of peers in @a put_path
- * @param put_path path the reply took on put
- * @return #GNUNET_OK to continue iteration, anything else
- * to stop iteration.
- */
-static enum GNUNET_GenericReturnValue
-datacache_get_successors_iterator (void *cls,
-                                   const struct GNUNET_HashCode *key,
-                                   size_t size,
-                                   const char *data,
-                                   enum GNUNET_BLOCK_Type type,
-                                   struct GNUNET_TIME_Absolute exp,
-                                   unsigned int put_path_length,
-                                   const struct
-                                   GNUNET_DHT_PathElement *put_path)
-{
-  const struct SuccContext *sc = cls;
-  struct GDS_DATACACHE_BlockData bd = {
-    .key = *key,
-    .expiration_time = exp,
-    .put_path = put_path,
-    .data = data,
-    .data_size = size,
-    .put_path_length = put_path_length,
-    .type = type
-  };
-
-  /* NOTE: The datacache currently does not store the RO from
-     the original 'put', so we don't know the 'correct' option
-     at this point anymore.  Thus, we conservatively assume
-     that recording is desired (for now). */
-  sc->cb (sc->cb_cls,
-          &bd);
-  return GNUNET_OK;
-}
-
-
-void
+enum GNUNET_BLOCK_ReplyEvaluationResult
 GDS_DATACACHE_get_closest (const struct GNUNET_HashCode *key,
+                           enum GNUNET_BLOCK_Type type,
+                           const void *xquery,
+                           size_t xquery_size,
+                           struct GNUNET_BLOCK_Group *bg,
                            GDS_DATACACHE_GetCallback cb,
                            void *cb_cls)
 {
-  struct SuccContext sc = {
-    .cb = cb,
-    .cb_cls = cb_cls
+  struct GetRequestContext ctx = {
+                                  .eval = GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED,
+    .key = *key,
+    .xquery = xquery,
+    .xquery_size = xquery_size,
+    .bg = bg,
+    .gc = cb,
+    .gc_cls = cb_cls
   };
+  unsigned int r;
 
-  (void) GNUNET_DATACACHE_get_closest (datacache,
-                                       key,
-                                       NUM_CLOSEST,
-                                       &datacache_get_successors_iterator,
-                                       &sc);
+  if (NULL == datacache)
+    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
+  GNUNET_STATISTICS_update (GDS_stats,
+                            "# GET closest requests given to datacache",
+                            1,
+                            GNUNET_NO);
+  r = GNUNET_DATACACHE_get_closest (datacache,
+                                    key,
+                                    type,
+                                    NUM_CLOSEST,
+                                    &datacache_get_iterator,
+                                    &ctx);
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "DATACACHE approximate GET for key %s completed (%d). %u results found.\n",
+       GNUNET_h2s (key),
+       ctx.eval,
+       r);
+  return ctx.eval;
 }
 
 
diff --git a/src/dht/gnunet-service-dht_datacache.h b/src/dht/gnunet-service-dht_datacache.h
index 691a51e0e..d860139f5 100644
--- a/src/dht/gnunet-service-dht_datacache.h
+++ b/src/dht/gnunet-service-dht_datacache.h
@@ -107,7 +107,7 @@ typedef void
  * @param gc_cls closure for @a gc
  * @return evaluation result for the local replies
  */
-enum GNUNET_BLOCK_EvaluationResult
+enum GNUNET_BLOCK_ReplyEvaluationResult
 GDS_DATACACHE_handle_get (const struct GNUNET_HashCode *key,
                           enum GNUNET_BLOCK_Type type,
                           const void *xquery,
@@ -122,11 +122,20 @@ GDS_DATACACHE_handle_get (const struct GNUNET_HashCode *key,
  * another peer.
  *
  * @param key the location at which the peer is looking for data that is close
+ * @param type requested data type
+ * @param xquery extended query
+ * @param xquery_size number of bytes in xquery
+ * @param bg block group to use for evaluation of replies
  * @param cb function to call with the result
  * @param cb_cls closure for @a cb
+ * @return evaluation result for the local replies
  */
-void
+enum GNUNET_BLOCK_ReplyEvaluationResult
 GDS_DATACACHE_get_closest (const struct GNUNET_HashCode *key,
+                           enum GNUNET_BLOCK_Type type,
+                           const void *xquery,
+                           size_t xquery_size,
+                           struct GNUNET_BLOCK_Group *bg,
                            GDS_DATACACHE_GetCallback cb,
                            void *cb_cls);
 
diff --git a/src/dht/gnunet-service-dht_hello.c b/src/dht/gnunet-service-dht_hello.c
deleted file mode 100644
index 949456575..000000000
--- a/src/dht/gnunet-service-dht_hello.c
+++ /dev/null
@@ -1,154 +0,0 @@
-/*
-     This file is part of GNUnet.
-     Copyright (C) 2011 GNUnet e.V.
-
-     GNUnet is free software: you can redistribute it and/or modify it
-     under the terms of the GNU Affero General Public License as published
-     by the Free Software Foundation, either version 3 of the License,
-     or (at your option) any later version.
-
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     Affero General Public License for more details.
-
-     You should have received a copy of the GNU Affero General Public License
-     along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-
-/**
- * @file dht/gnunet-service-dht_hello.c
- * @brief GNUnet DHT integration with peerinfo
- * @author Christian Grothoff
- *
- * TODO:
- * - consider adding mechanism to remove expired HELLOs
- */
-#include "platform.h"
-#include "gnunet-service-dht.h"
-#include "gnunet-service-dht_hello.h"
-#include "gnunet_peerinfo_service.h"
-
-
-/**
- * Handle for peerinfo notifications.
- */
-static struct GNUNET_PEERINFO_NotifyContext *pnc;
-
-/**
- * Hash map of peers to HELLOs.
- */
-static struct GNUNET_CONTAINER_MultiPeerMap *peer_to_hello;
-
-
-/**
- * Obtain a peer's HELLO if available
- *
- * @param peer peer to look for a HELLO from
- * @return HELLO for the given peer
- */
-const struct GNUNET_HELLO_Message *
-GDS_HELLO_get (const struct GNUNET_PeerIdentity *peer)
-{
-  if (NULL == peer_to_hello)
-    return NULL;
-  return GNUNET_CONTAINER_multipeermap_get (peer_to_hello,
-                                            peer);
-}
-
-
-/**
- * Function called for each HELLO known to PEERINFO.
- *
- * @param cls closure
- * @param peer id of the peer, NULL for last call
- * @param hello hello message for the peer (can be NULL)
- * @param err_msg error message (not used)
- *
- * FIXME this is called once per address. Merge instead of replacing?
- */
-static void
-process_hello (void *cls,
-               const struct GNUNET_PeerIdentity *peer,
-               const struct GNUNET_HELLO_Message *hello,
-               const char *err_msg)
-{
-  struct GNUNET_TIME_Absolute ex;
-  struct GNUNET_HELLO_Message *hm;
-
-  if (NULL == hello)
-    return;
-  ex = GNUNET_HELLO_get_last_expiration (hello);
-  if (0 == GNUNET_TIME_absolute_get_remaining (ex).rel_value_us)
-    return;
-  GNUNET_STATISTICS_update (GDS_stats,
-                            "# HELLOs obtained from peerinfo",
-                            1,
-                            GNUNET_NO);
-  hm = GNUNET_CONTAINER_multipeermap_get (peer_to_hello,
-                                          peer);
-  GNUNET_free (hm);
-  hm = GNUNET_malloc (GNUNET_HELLO_size (hello));
-  GNUNET_memcpy (hm,
-                 hello,
-                 GNUNET_HELLO_size (hello));
-  GNUNET_assert (GNUNET_SYSERR !=
-                 GNUNET_CONTAINER_multipeermap_put (peer_to_hello,
-                                                    peer,
-                                                    hm,
-                                                    GNUNET_CONTAINER_MULTIHASHMAPOPTION_REPLACE));
-}
-
-
-/**
- * Initialize HELLO subsystem.
- */
-void
-GDS_HELLO_init ()
-{
-  pnc = GNUNET_PEERINFO_notify (GDS_cfg,
-                                GNUNET_NO,
-                                &process_hello,
-                                NULL);
-  peer_to_hello = GNUNET_CONTAINER_multipeermap_create (256,
-                                                        GNUNET_NO);
-}
-
-
-/**
- * Free memory occopied by the HELLO.
- */
-static enum GNUNET_GenericReturnValue
-free_hello (void *cls,
-            const struct GNUNET_PeerIdentity *key,
-            void *hello)
-{
-  GNUNET_free (hello);
-  return GNUNET_OK;
-}
-
-
-/**
- * Shutdown HELLO subsystem.
- */
-void
-GDS_HELLO_done ()
-{
-  if (NULL != pnc)
-  {
-    GNUNET_PEERINFO_notify_cancel (pnc);
-    pnc = NULL;
-  }
-  if (NULL != peer_to_hello)
-  {
-    GNUNET_CONTAINER_multipeermap_iterate (peer_to_hello,
-                                           &free_hello,
-                                           NULL);
-    GNUNET_CONTAINER_multipeermap_destroy (peer_to_hello);
-  }
-}
-
-
-/* end of gnunet-service-dht_hello.c */
diff --git a/src/dht/gnunet-service-dht_hello.h b/src/dht/gnunet-service-dht_hello.h
deleted file mode 100644
index f8b90862d..000000000
--- a/src/dht/gnunet-service-dht_hello.h
+++ /dev/null
@@ -1,55 +0,0 @@
-/*
-     This file is part of GNUnet.
-     Copyright (C) 2011 GNUnet e.V.
-
-     GNUnet is free software: you can redistribute it and/or modify it
-     under the terms of the GNU Affero General Public License as published
-     by the Free Software Foundation, either version 3 of the License,
-     or (at your option) any later version.
-
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     Affero General Public License for more details.
-
-     You should have received a copy of the GNU Affero General Public License
-     along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-
-/**
- * @file dht/gnunet-service-dht_hello.h
- * @brief GNUnet DHT integration with peerinfo
- * @author Christian Grothoff
- */
-#ifndef GNUNET_SERVICE_DHT_HELLO_H
-#define GNUNET_SERVICE_DHT_HELLO_H
-
-#include "gnunet_util_lib.h"
-#include "gnunet_hello_lib.h"
-
-/**
- * Obtain a peer's HELLO if available
- *
- * @param peer peer to look for a HELLO from
- * @return HELLO for the given peer
- */
-const struct GNUNET_HELLO_Message *
-GDS_HELLO_get (const struct GNUNET_PeerIdentity *peer);
-
-
-/**
- * Initialize HELLO subsystem.
- */
-void
-GDS_HELLO_init (void);
-
-
-/**
- * Shutdown HELLO subsystem.
- */
-void
-GDS_HELLO_done (void);
-
-#endif
diff --git a/src/dht/gnunet-service-dht_neighbours.c b/src/dht/gnunet-service-dht_neighbours.c
index cf150ea0c..2f9cbab84 100644
--- a/src/dht/gnunet-service-dht_neighbours.c
+++ b/src/dht/gnunet-service-dht_neighbours.c
@@ -28,13 +28,10 @@
 #include "gnunet_constants.h"
 #include "gnunet_protocols.h"
 #include "gnunet_signatures.h"
-#include "gnunet_ats_service.h"
-#include "gnunet_core_service.h"
 #include "gnunet_hello_lib.h"
+#include "gnunet_hello_uri_lib.h"
 #include "gnunet-service-dht.h"
-#include "gnunet-service-dht_hello.h"
 #include "gnunet-service-dht_neighbours.h"
-#include "gnunet-service-dht_nse.h"
 #include "gnunet-service-dht_routing.h"
 #include "dht.h"
 
@@ -42,9 +39,17 @@
                                                 __VA_ARGS__)
 
 /**
- * Enable slow sanity checks to debug issues.
+ * Enable slow sanity checks to debug issues. 
+ * 
+ * TODO: might want to eventually implement probabilistic
+ * load-based path verification, but for now it is all or nothing
+ * based on this define.
+ *
+ * 0: do not check -- if signatures become performance critical
+ * 1: check all external inputs -- normal production for now
+ * 2: check internal computations as well -- for debugging 
  */
-#define SANITY_CHECKS 1
+#define SANITY_CHECKS 2
 
 /**
  * How many buckets will we allow in total.
@@ -74,6 +79,7 @@
 #define DHT_MINIMUM_FIND_PEER_INTERVAL GNUNET_TIME_relative_multiply ( \
     GNUNET_TIME_UNIT_MINUTES, 2)
 
+
 /**
  * How long to additionally wait on average per #bucket_size to send out the
  * FIND PEER requests if we did successfully connect (!) to a a new peer and
@@ -83,7 +89,7 @@
  * top).  Also the range in which we randomize, so the effective value
  * is half of the number given here.
  */
-#define DHT_AVG_FIND_PEER_INTERVAL GNUNET_TIME_relative_multiply ( \
+#define DHT_AVG_FIND_PEER_INTERVAL GNUNET_TIME_relative_multiply (    \
     GNUNET_TIME_UNIT_SECONDS, 6)
 
 /**
@@ -91,11 +97,6 @@
  */
 #define GET_TIMEOUT GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MINUTES, 2)
 
-/**
- * Hello address expiration
- */
-extern struct GNUNET_TIME_Relative hello_expiration;
-
 
 GNUNET_NETWORK_STRUCT_BEGIN
 
@@ -263,81 +264,134 @@ GNUNET_NETWORK_STRUCT_END
 /**
  * Entry for a peer in a bucket.
  */
-struct PeerInfo
+struct PeerInfo;
+
+
+/**
+ * List of targets that we can use to reach this peer.
+ */
+struct Target
 {
   /**
-   * Next peer entry (DLL)
+   * Kept in a DLL.
    */
-  struct PeerInfo *next;
+  struct Target *next;
 
   /**
-   *  Prev peer entry (DLL)
+   * Kept in a DLL.
    */
-  struct PeerInfo *prev;
+  struct Target *prev;
 
   /**
    * Handle for sending messages to this peer.
    */
-  struct GNUNET_MQ_Handle *mq;
+  struct GNUNET_DHTU_Target *utarget;
 
   /**
-   * What is the identity of the peer?
+   * Underlay providing this target.
    */
-  const struct GNUNET_PeerIdentity *id;
+  struct GDS_Underlay *u;
 
   /**
-   * Hash of @e id.
+   * Peer this is a target for.
    */
-  struct GNUNET_HashCode phash;
+  struct PeerInfo *pi;
 
   /**
-   * Which bucket is this peer in?
+   * Handle used to 'hold' the connection to this peer.
    */
-  int peer_bucket;
+  struct GNUNET_DHTU_PreferenceHandle *ph;
+
+  /**
+   * Set to number of messages are waiting for the transmission to finish.
+   */
+  unsigned int load;
+
+  /**
+   * Set to @a true if the target was dropped, but we could not clean
+   * up yet because @e busy was also true.
+   */
+  bool dropped;
+
 };
 
 
 /**
- * Peers are grouped into buckets.
+ * Entry for a peer in a bucket.
  */
-struct PeerBucket
+struct PeerInfo
 {
   /**
-   * Head of DLL
+   * What is the identity of the peer?
    */
-  struct PeerInfo *head;
+  struct GNUNET_PeerIdentity id;
 
   /**
-   * Tail of DLL
+   * Hash of @e id.
    */
-  struct PeerInfo *tail;
+  struct GNUNET_HashCode phash;
 
   /**
-   * Number of peers in the bucket.
+   * When does our HELLO from this peer expire?
    */
-  unsigned int peers_size;
+  struct GNUNET_TIME_Absolute hello_expiration;
+
+  /**
+   * Next peer entry (DLL)
+   */
+  struct PeerInfo *next;
+
+  /**
+   *  Prev peer entry (DLL)
+   */
+  struct PeerInfo *prev;
+
+  /**
+   * Head of DLL of targets for this peer.
+   */
+  struct Target *t_head;
+
+  /**
+   * Tail of DLL of targets for this peer.
+   */
+  struct Target *t_tail;
+
+  /**
+   * Block with a HELLO of this peer.
+   */
+  void *hello;
+
+  /**
+   * Number of bytes in @e hello.
+   */
+  size_t hello_size;
+
+  /**
+   * Which bucket is this peer in?
+   */
+  int peer_bucket;
 };
 
 
 /**
- * Information about a peer that we would like to connect to.
+ * Peers are grouped into buckets.
  */
-struct ConnectInfo
+struct PeerBucket
 {
   /**
-   * Handle to active HELLO offer operation, or NULL.
+   * Head of DLL
    */
-  struct GNUNET_TRANSPORT_OfferHelloHandle *oh;
+  struct PeerInfo *head;
 
   /**
-   * Handle to active connectivity suggestion operation, or NULL.
+   * Tail of DLL
    */
-  struct GNUNET_ATS_ConnectivitySuggestHandle *sh;
+  struct PeerInfo *tail;
 
   /**
-   * How much would we like to connect to this peer?
+   * Number of peers in the bucket.
    */
-  uint32_t strength;
+  unsigned int peers_size;
 };
 
 
@@ -374,12 +428,6 @@ static struct PeerBucket k_buckets[MAX_BUCKETS];
 static struct GNUNET_CONTAINER_MultiPeerMap *all_connected_peers;
 
 /**
- * Hash map of all peers we would like to be connected to.
- * Values are of type `struct ConnectInfo`.
- */
-static struct GNUNET_CONTAINER_MultiPeerMap *all_desired_peers;
-
-/**
  * Maximum size for each bucket.
  */
 static unsigned int bucket_size = DEFAULT_BUCKET_SIZE;
@@ -389,30 +437,83 @@ static unsigned int bucket_size = DEFAULT_BUCKET_SIZE;
  */
 static struct GNUNET_SCHEDULER_Task *find_peer_task;
 
-/**
- * Identity of this peer.
- */
-static struct GNUNET_PeerIdentity my_identity;
 
 /**
- * Hash of the identity of this peer.
+ * Function called whenever we finished sending to a target.
+ * Marks the transmission as finished (and the target as ready
+ * for the next message).
+ *
+ * @param cls a `struct Target *`
  */
-struct GNUNET_HashCode my_identity_hash;
+static void
+send_done_cb (void *cls)
+{
+  struct Target *t = cls;
+  struct PeerInfo *pi = t->pi; /* NULL if t->dropped! */
 
-/**
- * Handle to CORE.
- */
-static struct GNUNET_CORE_Handle *core_api;
+  GNUNET_assert (t->load > 0);
+  t->load--;
+  if (0 < t->load)
+    return;
+  if (t->dropped)
+  {
+    GNUNET_free (t);
+    return;
+  }
+  /* move target back to the front */
+  GNUNET_CONTAINER_DLL_remove (pi->t_head,
+                               pi->t_tail,
+                               t);
+  GNUNET_CONTAINER_DLL_insert (pi->t_head,
+                               pi->t_tail,
+                               t);
+}
 
-/**
- * Handle to ATS connectivity.
- */
-static struct GNUNET_ATS_ConnectivityHandle *ats_ch;
 
 /**
- * Our private key.
+ * Send @a msg to @a pi.
+ *
+ * @param pi where to send the message
+ * @param msg message to send
  */
-static struct GNUNET_CRYPTO_EddsaPrivateKey my_private_key;
+static void
+do_send (struct PeerInfo *pi,
+         const struct GNUNET_MessageHeader *msg)
+{
+  struct Target *t;
+
+  for (t = pi->t_head;
+       NULL != t;
+       t = t->next)
+    if (t->load < MAXIMUM_PENDING_PER_PEER)
+      break;
+  if (NULL == t)
+  {
+    /* all targets busy, drop message */
+    GNUNET_STATISTICS_update (GDS_stats,
+                              "# messages dropped (underlays busy)",
+                              1,
+                              GNUNET_NO);
+    return;
+  }
+  t->load++;
+  /* rotate busy targets to the end */
+  if (MAXIMUM_PENDING_PER_PEER == t->load)
+  {
+    GNUNET_CONTAINER_DLL_remove (pi->t_head,
+                                 pi->t_tail,
+                                 t);
+    GNUNET_CONTAINER_DLL_insert_tail (pi->t_head,
+                                      pi->t_tail,
+                                      t);
+  }
+  GDS_u_send (t->u,
+              t->utarget,
+              msg,
+              ntohs (msg->size),
+              &send_done_cb,
+              t);
+}
 
 
 /**
@@ -426,11 +527,10 @@ static struct GNUNET_CRYPTO_EddsaPrivateKey my_private_key;
  * @param pred predecessor peer ID
  * @param succ successor peer ID
  * @param[out] sig where to write the signature
- *      (of purpose #GNUNET_SIGNATURE_PURPOSE_DHT_HOP)
+ *      (of purpose #GNUNET_SIGNATURE_PURPOSE_DHT_PUT_HOP)
  */
 static void
-sign_path (const struct GNUNET_HashCode *key,
-           const void *data,
+sign_path (const void *data,
            size_t data_size,
            struct GNUNET_TIME_Absolute exp_time,
            const struct GNUNET_PeerIdentity *pred,
@@ -441,7 +541,6 @@ sign_path (const struct GNUNET_HashCode *key,
     .purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_DHT_HOP),
     .purpose.size = htonl (sizeof (hs)),
     .expiration_time = GNUNET_TIME_absolute_hton (exp_time),
-    .key = *key,
     .pred = *pred,
     .succ = *succ
   };
@@ -449,7 +548,7 @@ sign_path (const struct GNUNET_HashCode *key,
   GNUNET_CRYPTO_hash (data,
                       data_size,
                       &hs.h_data);
-  GNUNET_CRYPTO_eddsa_sign (&my_private_key,
+  GNUNET_CRYPTO_eddsa_sign (&GDS_my_private_key,
                             &hs,
                             sig);
 }
@@ -469,7 +568,7 @@ find_bucket (const struct GNUNET_HashCode *hc)
   unsigned int bits;
 
   GNUNET_CRYPTO_hash_xor (hc,
-                          &my_identity_hash,
+                          &GDS_my_identity_hash,
                           &xor);
   bits = GNUNET_CRYPTO_hash_count_leading_zeros (&xor);
   if (bits == MAX_BUCKETS)
@@ -483,171 +582,6 @@ find_bucket (const struct GNUNET_HashCode *hc)
 
 
 /**
- * Function called when #GNUNET_TRANSPORT_offer_hello() is done.
- * Clean up the "oh" field in the @a cls
- *
- * @param cls a `struct ConnectInfo`
- */
-static void
-offer_hello_done (void *cls)
-{
-  struct ConnectInfo *ci = cls;
-
-  ci->oh = NULL;
-}
-
-
-/**
- * Function called for all entries in #all_desired_peers to clean up.
- *
- * @param cls NULL
- * @param peer peer the entry is for
- * @param value the value to remove
- * @return #GNUNET_YES
- */
-static enum GNUNET_GenericReturnValue
-free_connect_info (void *cls,
-                   const struct GNUNET_PeerIdentity *peer,
-                   void *value)
-{
-  struct ConnectInfo *ci = value;
-
-  (void) cls;
-  GNUNET_assert (GNUNET_YES ==
-                 GNUNET_CONTAINER_multipeermap_remove (all_desired_peers,
-                                                       peer,
-                                                       ci));
-  if (NULL != ci->sh)
-  {
-    GNUNET_ATS_connectivity_suggest_cancel (ci->sh);
-    ci->sh = NULL;
-  }
-  if (NULL != ci->oh)
-  {
-    GNUNET_TRANSPORT_offer_hello_cancel (ci->oh);
-    ci->oh = NULL;
-  }
-  GNUNET_free (ci);
-  return GNUNET_YES;
-}
-
-
-/**
- * Consider if we want to connect to a given peer, and if so
- * let ATS know.  If applicable, the HELLO is offered to the
- * TRANSPORT service.
- *
- * @param pid peer to consider connectivity requirements for
- * @param h a HELLO message, or NULL
- */
-static void
-try_connect (const struct GNUNET_PeerIdentity *pid,
-             const struct GNUNET_MessageHeader *h)
-{
-  int bucket_idx;
-  struct GNUNET_HashCode pid_hash;
-  struct ConnectInfo *ci;
-  uint32_t strength;
-  struct PeerBucket *bucket;
-
-  GNUNET_CRYPTO_hash (pid,
-                      sizeof(struct GNUNET_PeerIdentity),
-                      &pid_hash);
-  bucket_idx = find_bucket (&pid_hash);
-  if (bucket_idx < 0)
-  {
-    GNUNET_break (0);
-    return; /* self!? */
-  }
-  bucket = &k_buckets[bucket_idx];
-  ci = GNUNET_CONTAINER_multipeermap_get (all_desired_peers,
-                                          pid);
-  if (bucket->peers_size < bucket_size)
-    strength = (bucket_size - bucket->peers_size) * bucket_idx;
-  else
-    strength = 0;
-  if (GNUNET_YES ==
-      GNUNET_CONTAINER_multipeermap_contains (all_connected_peers,
-                                              pid))
-    strength *= 2; /* double for connected peers */
-  if ( (0 == strength) &&
-       (NULL != ci) )
-  {
-    /* release request */
-    GNUNET_assert (GNUNET_YES ==
-                   free_connect_info (NULL,
-                                      pid,
-                                      ci));
-    return;
-  }
-  if (NULL == ci)
-  {
-    ci = GNUNET_new (struct ConnectInfo);
-    GNUNET_assert (GNUNET_OK ==
-                   GNUNET_CONTAINER_multipeermap_put (all_desired_peers,
-                                                      pid,
-                                                      ci,
-                                                      GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
-  }
-  if ( (NULL != ci->oh) &&
-       (NULL != h) )
-    GNUNET_TRANSPORT_offer_hello_cancel (ci->oh);
-  if (NULL != h)
-    ci->oh = GNUNET_TRANSPORT_offer_hello (GDS_cfg,
-                                           h,
-                                           &offer_hello_done,
-                                           ci);
-  if ( (NULL != ci->sh) &&
-       (ci->strength != strength) )
-    GNUNET_ATS_connectivity_suggest_cancel (ci->sh);
-  if (ci->strength != strength)
-  {
-    ci->sh = GNUNET_ATS_connectivity_suggest (ats_ch,
-                                              pid,
-                                              strength);
-    ci->strength = strength;
-  }
-}
-
-
-/**
- * Function called for each peer in #all_desired_peers during
- * #update_connect_preferences() if we have reason to adjust
- * the strength of our desire to keep connections to certain
- * peers.  Calls #try_connect() to update the calculations for
- * the given @a pid.
- *
- * @param cls NULL
- * @param pid peer to update
- * @param value unused
- * @return #GNUNET_YES (continue to iterate)
- */
-static enum GNUNET_GenericReturnValue
-update_desire_strength (void *cls,
-                        const struct GNUNET_PeerIdentity *pid,
-                        void *value)
-{
-  (void) cls;
-  (void) value;
-  try_connect (pid,
-               NULL);
-  return GNUNET_YES;
-}
-
-
-/**
- * Update our preferences for connectivity as given to ATS.
- */
-static void
-update_connect_preferences (void)
-{
-  GNUNET_CONTAINER_multipeermap_iterate (all_desired_peers,
-                                         &update_desire_strength,
-                                         NULL);
-}
-
-
-/**
  * Add each of the peers we already know to the Bloom filter of
  * the request so that we don't get duplicate HELLOs.
  *
@@ -702,7 +636,7 @@ send_find_peer_message (void *cls)
         GNUNET_CRYPTO_QUALITY_WEAK,
         GNUNET_TIME_relative_multiply (
           DHT_AVG_FIND_PEER_INTERVAL,
-          100 * (1 + newly_found_peers) / bucket_size).rel_value_us);
+          1 + 100 * (1 + newly_found_peers) / bucket_size).rel_value_us);
     newly_found_peers = 0;
     GNUNET_assert (NULL == find_peer_task);
     find_peer_task =
@@ -719,7 +653,7 @@ send_find_peer_message (void *cls)
     struct GNUNET_CONTAINER_BloomFilter *peer_bf;
 
     bg = GNUNET_BLOCK_group_create (GDS_block_context,
-                                    GNUNET_BLOCK_TYPE_DHT_HELLO,
+                                    GNUNET_BLOCK_TYPE_DHT_URL_HELLO,
                                     GNUNET_CRYPTO_random_u32 (
                                       GNUNET_CRYPTO_QUALITY_WEAK,
                                       UINT32_MAX),
@@ -736,12 +670,12 @@ send_find_peer_message (void *cls)
                                            DHT_BLOOM_SIZE,
                                            GNUNET_CONSTANTS_BLOOMFILTER_K);
     if (GNUNET_OK !=
-        GDS_NEIGHBOURS_handle_get (GNUNET_BLOCK_TYPE_DHT_HELLO,
-                                   GNUNET_DHT_RO_FIND_PEER
+        GDS_NEIGHBOURS_handle_get (GNUNET_BLOCK_TYPE_DHT_URL_HELLO,
+                                   GNUNET_DHT_RO_FIND_APPROXIMATE
                                    | GNUNET_DHT_RO_RECORD_ROUTE,
                                    FIND_PEER_REPLICATION_LEVEL,
                                    0, /* hop count */
-                                   &my_identity_hash,
+                                   &GDS_my_identity_hash,
                                    NULL, 0, /* xquery */
                                    bg,
                                    peer_bf))
@@ -765,123 +699,180 @@ send_find_peer_message (void *cls)
 
 
 /**
- * Method called whenever a peer connects.
+ * The list of the first #bucket_size peers of @a bucket
+ * changed. We should thus make sure we have called 'hold'
+ * all of the first bucket_size peers!
  *
- * @param cls closure
- * @param peer peer identity this notification is about
- * @param mq message queue for sending messages to @a peer
- * @return our `struct PeerInfo` for @a peer
+ * @param[in,out] bucket the bucket where the peer set changed
  */
-static void *
-handle_core_connect (void *cls,
-                     const struct GNUNET_PeerIdentity *peer,
-                     struct GNUNET_MQ_Handle *mq)
+static void
+update_hold (struct PeerBucket *bucket)
 {
+  unsigned int off = 0;
+
+  /* find the peer -- we just go over all of them, should
+     be hardly any more expensive than just finding the 'right'
+     one. */
+  for (struct PeerInfo *pos = bucket->head;
+       NULL != pos;
+       pos = pos->next)
+  {
+    if (off > bucket_size)
+      break;   /* We only hold up to #bucket_size peers per bucket */
+    off++;
+    for (struct Target *tp = pos->t_head;
+         NULL != tp;
+         tp = tp->next)
+      if (NULL == tp->ph)
+        tp->ph = GDS_u_hold (tp->u,
+                             tp->utarget);
+  }
+}
+
+
+void
+GDS_u_connect (void *cls,
+               struct GNUNET_DHTU_Target *target,
+               const struct GNUNET_PeerIdentity *pid,
+               void **ctx)
+{
+  struct GDS_Underlay *u = cls;
   struct PeerInfo *pi;
   struct PeerBucket *bucket;
+  bool do_hold = false;
 
-  (void) cls;
   /* Check for connect to self message */
-  if (0 == GNUNET_memcmp (&my_identity,
-                          peer))
-    return NULL;
+  if (0 == GNUNET_memcmp (&GDS_my_identity,
+                          pid))
+    return;
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Connected to peer %s\n",
-              GNUNET_i2s (peer));
-  GNUNET_assert (NULL ==
-                 GNUNET_CONTAINER_multipeermap_get (all_connected_peers,
-                                                    peer));
-  GNUNET_STATISTICS_update (GDS_stats,
-                            "# peers connected",
-                            1,
-                            GNUNET_NO);
-  pi = GNUNET_new (struct PeerInfo);
-  pi->id = peer;
-  pi->mq = mq;
-  GNUNET_CRYPTO_hash (peer,
-                      sizeof(struct GNUNET_PeerIdentity),
-                      &pi->phash);
-  pi->peer_bucket = find_bucket (&pi->phash);
-  GNUNET_assert ( (pi->peer_bucket >= 0) &&
-                  ((unsigned int) pi->peer_bucket < MAX_BUCKETS));
-  bucket = &k_buckets[pi->peer_bucket];
-  GNUNET_CONTAINER_DLL_insert_tail (bucket->head,
-                                    bucket->tail,
-                                    pi);
-  bucket->peers_size++;
-  closest_bucket = GNUNET_MAX (closest_bucket,
-                               (unsigned int) pi->peer_bucket + 1);
-  GNUNET_assert (GNUNET_OK ==
-                 GNUNET_CONTAINER_multipeermap_put (all_connected_peers,
-                                                    pi->id,
-                                                    pi,
-                                                    GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
-  if (bucket->peers_size <= bucket_size)
+              GNUNET_i2s (pid));
+  pi = GNUNET_CONTAINER_multipeermap_get (all_connected_peers,
+                                          pid);
+  if (NULL == pi)
   {
-    update_connect_preferences ();
-    newly_found_peers++;
+    GNUNET_STATISTICS_update (GDS_stats,
+                              "# peers connected",
+                              1,
+                              GNUNET_NO);
+    pi = GNUNET_new (struct PeerInfo);
+    pi->id = *pid;
+    GNUNET_CRYPTO_hash (pid,
+                        sizeof(*pid),
+                        &pi->phash);
+    pi->peer_bucket = find_bucket (&pi->phash);
+    GNUNET_assert ( (pi->peer_bucket >= 0) &&
+                    ((unsigned int) pi->peer_bucket < MAX_BUCKETS));
+    bucket = &k_buckets[pi->peer_bucket];
+    GNUNET_CONTAINER_DLL_insert_tail (bucket->head,
+                                      bucket->tail,
+                                      pi);
+    bucket->peers_size++;
+    closest_bucket = GNUNET_MAX (closest_bucket,
+                                 (unsigned int) pi->peer_bucket + 1);
+    GNUNET_assert (GNUNET_OK ==
+                   GNUNET_CONTAINER_multipeermap_put (all_connected_peers,
+                                                      &pi->id,
+                                                      pi,
+                                                      GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
+    if (bucket->peers_size <= bucket_size)
+    {
+      newly_found_peers++;
+      do_hold = true;
+    }
+    if ( (1 == GNUNET_CONTAINER_multipeermap_size (all_connected_peers)) &&
+         (GNUNET_YES != disable_try_connect) )
+    {
+      /* got a first connection, good time to start with FIND PEER requests... */
+      GNUNET_assert (NULL == find_peer_task);
+      find_peer_task = GNUNET_SCHEDULER_add_now (&send_find_peer_message,
+                                                 NULL);
+    }
   }
-  if ( (1 == GNUNET_CONTAINER_multipeermap_size (all_connected_peers)) &&
-       (GNUNET_YES != disable_try_connect) )
   {
-    /* got a first connection, good time to start with FIND PEER requests... */
-    GNUNET_assert (NULL == find_peer_task);
-    find_peer_task = GNUNET_SCHEDULER_add_now (&send_find_peer_message,
-                                               NULL);
+    struct Target *t;
+
+    t = GNUNET_new (struct Target);
+    t->u = u;
+    t->utarget = target;
+    t->pi = pi;
+    GNUNET_CONTAINER_DLL_insert (pi->t_head,
+                                 pi->t_tail,
+                                 t);
+    *ctx = t;
+
   }
-  return pi;
+  if (do_hold)
+    update_hold (bucket);
 }
 
 
-/**
- * Method called whenever a peer disconnects.
- *
- * @param cls closure
- * @param peer peer identity this notification is about
- * @param internal_cls our `struct PeerInfo` for @a peer
- */
-static void
-handle_core_disconnect (void *cls,
-                        const struct GNUNET_PeerIdentity *peer,
-                        void *internal_cls)
+void
+GDS_u_disconnect (void *ctx)
 {
-  struct PeerInfo *to_remove = internal_cls;
+  struct Target *t = ctx;
+  struct PeerInfo *pi;
   struct PeerBucket *bucket;
+  bool was_held = false;
 
-  (void) cls;
   /* Check for disconnect from self message (on shutdown) */
-  if (NULL == to_remove)
+  if (NULL == t)
     return;
+  pi = t->pi;
+  GNUNET_CONTAINER_DLL_remove (pi->t_head,
+                               pi->t_tail,
+                               t);
+  if (NULL != t->ph)
+  {
+    GDS_u_drop (t->u,
+                t->ph);
+    t->ph = NULL;
+    was_held = true;
+  }
+  if (t->load > 0)
+  {
+    t->dropped = true;
+    t->pi = NULL;
+  }
+  else
+  {
+    GNUNET_free (t);
+  }
+  if (NULL != pi->t_head)
+    return; /* got other connections still */
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Disconnected from peer %s\n",
-              GNUNET_i2s (peer));
+              GNUNET_i2s (&pi->id));
   GNUNET_STATISTICS_update (GDS_stats,
                             "# peers connected",
                             -1,
                             GNUNET_NO);
   GNUNET_assert (GNUNET_YES ==
                  GNUNET_CONTAINER_multipeermap_remove (all_connected_peers,
-                                                       peer,
-                                                       to_remove));
+                                                       &pi->id,
+                                                       pi));
   if ( (0 == GNUNET_CONTAINER_multipeermap_size (all_connected_peers)) &&
        (GNUNET_YES != disable_try_connect))
   {
     GNUNET_SCHEDULER_cancel (find_peer_task);
     find_peer_task = NULL;
   }
-  GNUNET_assert (to_remove->peer_bucket >= 0);
-  bucket = &k_buckets[to_remove->peer_bucket];
+  GNUNET_assert (pi->peer_bucket >= 0);
+  bucket = &k_buckets[pi->peer_bucket];
   GNUNET_CONTAINER_DLL_remove (bucket->head,
                                bucket->tail,
-                               to_remove);
+                               pi);
   GNUNET_assert (bucket->peers_size > 0);
   bucket->peers_size--;
+  if ( (was_held) &&
+       (bucket->peers_size >= bucket_size - 1) )
+    update_hold (bucket);
   while ( (closest_bucket > 0) &&
           (0 == k_buckets[closest_bucket - 1].peers_size))
     closest_bucket--;
-  if (bucket->peers_size < bucket_size)
-    update_connect_preferences ();
-  GNUNET_free (to_remove);
+  GNUNET_free (pi->hello);
+  GNUNET_free (pi);
 }
 
 
@@ -894,17 +885,14 @@ handle_core_disconnect (void *cls,
  * @return Some number of peers to forward the message to
  */
 static unsigned int
-get_forward_count (uint32_t hop_count,
-                   uint32_t target_replication)
+get_forward_count (uint16_t hop_count,
+                   uint16_t target_replication)
 {
   uint32_t random_value;
   uint32_t forward_count;
   float target_value;
+  float rm1;
 
-  if (0 == target_replication)
-    target_replication = 1; /* 0 is verboten */
-  if (target_replication > GNUNET_DHT_MAXIMUM_REPLICATION_LEVEL)
-    target_replication = GNUNET_DHT_MAXIMUM_REPLICATION_LEVEL;
   if (hop_count > GDS_NSE_get () * 4.0)
   {
     /* forcefully terminate */
@@ -919,15 +907,15 @@ get_forward_count (uint32_t hop_count,
     /* Once we have reached our ideal number of hops, only forward to 1 peer */
     return 1;
   }
-  /* bound by system-wide maximum */
+  /* bound by system-wide maximum and minimum */
+  if (0 == target_replication)
+    target_replication = 1; /* 0 is verboten */
   target_replication =
     GNUNET_MIN (GNUNET_DHT_MAXIMUM_REPLICATION_LEVEL,
                 target_replication);
+  rm1 = target_replication - 1.0;
   target_value =
-    1 + (target_replication - 1.0) / (GDS_NSE_get ()
-                                      + ((float) (target_replication - 1.0)
-                                         * hop_count));
-
+    1 + (rm1) / (GDS_NSE_get () + (rm1 * hop_count));
 
   /* Set forward count to floor of target_value */
   forward_count = (uint32_t) target_value;
@@ -956,7 +944,7 @@ enum GNUNET_GenericReturnValue
 GDS_am_closest_peer (const struct GNUNET_HashCode *key,
                      const struct GNUNET_CONTAINER_BloomFilter *bloom)
 {
-  if (0 == GNUNET_memcmp (&my_identity_hash,
+  if (0 == GNUNET_memcmp (&GDS_my_identity_hash,
                           key))
     return GNUNET_YES;
   for (int bucket_num = find_bucket (key);
@@ -983,7 +971,7 @@ GDS_am_closest_peer (const struct GNUNET_HashCode *key,
          because an unfiltered peer exists, we are not the
          closest. */
       int delta = GNUNET_CRYPTO_hash_xorcmp (&pos->phash,
-                                             &my_identity_hash,
+                                             &GDS_my_identity_hash,
                                              key);
       switch (delta)
       {
@@ -1047,7 +1035,7 @@ select_peer (const struct GNUNET_HashCode *key,
       struct GNUNET_HashCode xor;
 
       GNUNET_CRYPTO_hash_xor (key,
-                              &my_identity_hash,
+                              &GDS_my_identity_hash,
                               &xor);
       best_bucket = GNUNET_CRYPTO_hash_count_leading_zeros (&xor);
     }
@@ -1067,13 +1055,14 @@ select_peer (const struct GNUNET_HashCode *key,
         if (count >= bucket_size)
           break; /* we only consider first #bucket_size entries per bucket */
         count++;
-        if (GNUNET_YES ==
-            GNUNET_CONTAINER_bloomfilter_test (bloom,
-                                               &pos->phash))
+        if ( (NULL != bloom) &&
+             (GNUNET_YES ==
+              GNUNET_CONTAINER_bloomfilter_test (bloom,
+                                                 &pos->phash)) )
         {
           GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                       "Excluded peer `%s' due to BF match in greedy routing for %s\n",
-                      GNUNET_i2s (pos->id),
+                      GNUNET_i2s (&pos->id),
                       GNUNET_h2s (key));
           continue;
         }
@@ -1140,7 +1129,7 @@ select_peer (const struct GNUNET_HashCode *key,
     }
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                 "Selected peer `%s' in greedy routing for %s\n",
-                GNUNET_i2s (chosen->id),
+                GNUNET_i2s (&chosen->id),
                 GNUNET_h2s (key));
     return chosen;
   } /* end of 'greedy' peer selection */
@@ -1155,22 +1144,24 @@ select_peer (const struct GNUNET_HashCode *key,
 
     for (unsigned int bc = 0; bc < closest_bucket; bc++)
     {
+      struct PeerBucket *bucket = &k_buckets[bc];
       unsigned int count = 0;
 
-      for (struct PeerInfo *pos = k_buckets[bc].head;
+      for (struct PeerInfo *pos = bucket->head;
            NULL != pos;
            pos = pos->next)
       {
         count++;
         if (count > bucket_size)
           break; /* limits search to #bucket_size peers per bucket */
-        if (GNUNET_YES ==
-            GNUNET_CONTAINER_bloomfilter_test (bloom,
-                                               &pos->phash))
+        if ( (NULL != bloom) &&
+             (GNUNET_YES ==
+              GNUNET_CONTAINER_bloomfilter_test (bloom,
+                                                 &pos->phash)) )
         {
           GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                       "Excluded peer `%s' due to BF match in random routing for %s\n",
-                      GNUNET_i2s (pos->id),
+                      GNUNET_i2s (&pos->id),
                       GNUNET_h2s (key));
           continue;             /* Ignore filtered peers */
         }
@@ -1201,15 +1192,16 @@ select_peer (const struct GNUNET_HashCode *key,
         if (count > bucket_size)
           break; /* limits search to #bucket_size peers per bucket */
 
-        if (GNUNET_YES ==
-            GNUNET_CONTAINER_bloomfilter_test (bloom,
-                                               &pos->phash))
+        if ( (NULL != bloom) &&
+             (GNUNET_YES ==
+              GNUNET_CONTAINER_bloomfilter_test (bloom,
+                                                 &pos->phash)) )
           continue;             /* Ignore bloomfiltered peers */
         if (0 == selected--)
         {
           GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                       "Selected peer `%s' in random routing for %s\n",
-                      GNUNET_i2s (pos->id),
+                      GNUNET_i2s (&pos->id),
                       GNUNET_h2s (key));
           return pos;
         }
@@ -1237,8 +1229,8 @@ select_peer (const struct GNUNET_HashCode *key,
 static unsigned int
 get_target_peers (const struct GNUNET_HashCode *key,
                   struct GNUNET_CONTAINER_BloomFilter *bloom,
-                  uint32_t hop_count,
-                  uint32_t target_replication,
+                  uint16_t hop_count,
+                  uint16_t target_replication,
                   struct PeerInfo ***targets)
 {
   unsigned int target;
@@ -1294,11 +1286,36 @@ get_target_peers (const struct GNUNET_HashCode *key,
 }
 
 
+/**
+ * If we got a HELLO, consider it for our own routing table 
+ *
+ * @param bd block data we got 
+ */
+static void
+hello_check (const struct GDS_DATACACHE_BlockData *bd)
+{
+  struct GNUNET_PeerIdentity pid;
+  struct GNUNET_HELLO_Builder *b;
+
+  if (GNUNET_BLOCK_TYPE_DHT_URL_HELLO != bd->type)
+    return;
+
+  b = GNUNET_HELLO_builder_from_block (bd->data,
+                                       bd->data_size);
+  if (GNUNET_YES != disable_try_connect)
+    GNUNET_HELLO_builder_iterate (b,
+                                  &pid,
+                                  &GDS_try_connect,
+                                  &pid);
+  GNUNET_HELLO_builder_free (b);
+}
+
+
 enum GNUNET_GenericReturnValue
 GDS_NEIGHBOURS_handle_put (const struct GDS_DATACACHE_BlockData *bd,
                            enum GNUNET_DHT_RouteOption options,
-                           uint32_t desired_replication_level,
-                           uint32_t hop_count,
+                           uint16_t desired_replication_level,
+                           uint16_t hop_count,
                            struct GNUNET_CONTAINER_BloomFilter *bf)
 {
   unsigned int target_count;
@@ -1308,27 +1325,31 @@ GDS_NEIGHBOURS_handle_put (const struct GDS_DATACACHE_BlockData *bd,
   unsigned int put_path_length = bd->put_path_length;
 
   GNUNET_assert (NULL != bf);
-#if SANITY_CHECKS
+#if SANITY_CHECKS > 1
   if (0 !=
-      GNUNET_DHT_verify_path (&bd->key,
-                              bd->data,
+      GNUNET_DHT_verify_path (bd->data,
                               bd->data_size,
                               bd->expiration_time,
                               bd->put_path,
                               bd->put_path_length,
                               NULL, 0, /* get_path */
-                              &my_identity))
+                              &GDS_my_identity))
   {
     GNUNET_break_op (0);
     put_path_length = 0;
   }
 #endif
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Adding myself (%s) to PUT bloomfilter for %s\n",
-              GNUNET_i2s (&my_identity),
-              GNUNET_h2s (&bd->key));
+              "Adding myself (%s) to PUT bloomfilter for %s with RO(%s/%s)\n",
+              GNUNET_i2s (&GDS_my_identity),
+              GNUNET_h2s (&bd->key),
+              (options & GNUNET_DHT_RO_DEMULTIPLEX_EVERYWHERE) ? "x" : "-",
+              (options & GNUNET_DHT_RO_RECORD_ROUTE) ? "R" : "-");
+  
+  /* if we got a HELLO, consider it for our own routing table */
+  hello_check (bd);
   GNUNET_CONTAINER_bloomfilter_add (bf,
-                                    &my_identity_hash);
+                                    &GDS_my_identity_hash);
   GNUNET_STATISTICS_update (GDS_stats,
                             "# PUT requests routed",
                             1,
@@ -1345,7 +1366,7 @@ GDS_NEIGHBOURS_handle_put (const struct GDS_DATACACHE_BlockData *bd,
                 "Routing PUT for %s terminates after %u hops at %s\n",
                 GNUNET_h2s (&bd->key),
                 (unsigned int) hop_count,
-                GNUNET_i2s (&my_identity));
+                GNUNET_i2s (&GDS_my_identity));
     return GNUNET_NO;
   }
   msize = bd->put_path_length * sizeof(struct GNUNET_DHT_PathElement)
@@ -1367,33 +1388,23 @@ GDS_NEIGHBOURS_handle_put (const struct GDS_DATACACHE_BlockData *bd,
   for (unsigned int i = 0; i < target_count; i++)
   {
     struct PeerInfo *target = targets[i];
-    struct GNUNET_MQ_Envelope *env;
     struct PeerPutMessage *ppm;
+    char buf[sizeof (*ppm) + msize] GNUNET_ALIGN;
     struct GNUNET_DHT_PathElement *pp;
 
-    if (GNUNET_MQ_get_length (target->mq) >= MAXIMUM_PENDING_PER_PEER)
-    {
-      /* skip */
-      GNUNET_STATISTICS_update (GDS_stats,
-                                "# P2P messages dropped due to full queue",
-                                1,
-                                GNUNET_NO);
-      skip_count++;
-      continue;
-    }
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                 "Routing PUT for %s after %u hops to %s\n",
                 GNUNET_h2s (&bd->key),
                 (unsigned int) hop_count,
-                GNUNET_i2s (target->id));
-    env = GNUNET_MQ_msg_extra (ppm,
-                               msize,
-                               GNUNET_MESSAGE_TYPE_DHT_P2P_PUT);
-    ppm->options = htonl (options);
+                GNUNET_i2s (&target->id));
+    ppm = (struct PeerPutMessage *) buf;
+    ppm->header.type = htons (GNUNET_MESSAGE_TYPE_DHT_P2P_PUT);
+    ppm->header.size = htons (sizeof (buf));
     ppm->type = htonl (bd->type);
-    ppm->hop_count = htonl (hop_count + 1);
-    ppm->desired_replication_level = htonl (desired_replication_level);
-    ppm->put_path_length = htonl (put_path_length);
+    ppm->options = htons (options);
+    ppm->hop_count = htons (hop_count + 1);
+    ppm->desired_replication_level = htons (desired_replication_level);
+    ppm->put_path_length = htons (put_path_length);
     ppm->expiration_time = GNUNET_TIME_absolute_hton (bd->expiration_time);
     GNUNET_break (GNUNET_YES ==
                   GNUNET_CONTAINER_bloomfilter_test (bf,
@@ -1412,20 +1423,23 @@ GDS_NEIGHBOURS_handle_put (const struct GDS_DATACACHE_BlockData *bd,
     {
       /* Note that the signature in 'put_path' was not initialized before,
          so this is crucial to avoid sending garbage. */
-      sign_path (&bd->key,
-                 bd->data,
+      sign_path (bd->data,
                  bd->data_size,
                  bd->expiration_time,
                  &pp[put_path_length - 1].pred,
-                 target->id,
+                 &target->id,
                  &pp[put_path_length - 1].sig);
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "Signing PUT PATH %u => %s\n",
+                  put_path_length,
+                  GNUNET_B2S (&pp[put_path_length - 1].sig));
     }
 
     GNUNET_memcpy (&pp[put_path_length],
                    bd->data,
                    bd->data_size);
-    GNUNET_MQ_send (target->mq,
-                    env);
+    do_send (target,
+             &ppm->header);
   }
   GNUNET_free (targets);
   GNUNET_STATISTICS_update (GDS_stats,
@@ -1439,8 +1453,8 @@ GDS_NEIGHBOURS_handle_put (const struct GDS_DATACACHE_BlockData *bd,
 enum GNUNET_GenericReturnValue
 GDS_NEIGHBOURS_handle_get (enum GNUNET_BLOCK_Type type,
                            enum GNUNET_DHT_RouteOption options,
-                           uint32_t desired_replication_level,
-                           uint32_t hop_count,
+                           uint16_t desired_replication_level,
+                           uint16_t hop_count,
                            const struct GNUNET_HashCode *key,
                            const void *xquery,
                            size_t xquery_size,
@@ -1466,18 +1480,21 @@ GDS_NEIGHBOURS_handle_get (enum GNUNET_BLOCK_Type type,
                                    desired_replication_level,
                                    &targets);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Adding myself (%s) to GET bloomfilter for %s\n",
-              GNUNET_i2s (&my_identity),
-              GNUNET_h2s (key));
+              "Adding myself (%s) to GET bloomfilter for %s with RO(%s/%s)\n",
+              GNUNET_i2s (&GDS_my_identity),
+              GNUNET_h2s (key),
+              (options & GNUNET_DHT_RO_DEMULTIPLEX_EVERYWHERE) ? "x" : "-",
+              (options & GNUNET_DHT_RO_RECORD_ROUTE) ? "R" : "-");
+
   GNUNET_CONTAINER_bloomfilter_add (peer_bf,
-                                    &my_identity_hash);
+                                    &GDS_my_identity_hash);
   if (0 == target_count)
   {
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                 "Routing GET for %s terminates after %u hops at %s\n",
                 GNUNET_h2s (key),
                 (unsigned int) hop_count,
-                GNUNET_i2s (&my_identity));
+                GNUNET_i2s (&GDS_my_identity));
     return GNUNET_NO;
   }
   if (GNUNET_OK !=
@@ -1504,32 +1521,22 @@ GDS_NEIGHBOURS_handle_get (enum GNUNET_BLOCK_Type type,
   for (unsigned int i = 0; i < target_count; i++)
   {
     struct PeerInfo *target = targets[i];
-    struct GNUNET_MQ_Envelope *env;
     struct PeerGetMessage *pgm;
+    char buf[sizeof (*pgm) + msize] GNUNET_ALIGN;
     char *xq;
 
-    if (GNUNET_MQ_get_length (target->mq) >= MAXIMUM_PENDING_PER_PEER)
-    {
-      /* skip */
-      GNUNET_STATISTICS_update (GDS_stats,
-                                "# P2P messages dropped due to full queue",
-                                1,
-                                GNUNET_NO);
-      skip_count++;
-      continue;
-    }
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                 "Routing GET for %s after %u hops to %s\n",
                 GNUNET_h2s (key),
                 (unsigned int) hop_count,
-                GNUNET_i2s (target->id));
-    env = GNUNET_MQ_msg_extra (pgm,
-                               msize,
-                               GNUNET_MESSAGE_TYPE_DHT_P2P_GET);
-    pgm->options = htonl (options);
+                GNUNET_i2s (&target->id));
+    pgm = (struct PeerGetMessage *) buf;
+    pgm->header.type = htons (GNUNET_MESSAGE_TYPE_DHT_P2P_GET);
+    pgm->header.size = htons (sizeof (buf));
     pgm->type = htonl (type);
-    pgm->hop_count = htonl (hop_count + 1);
-    pgm->desired_replication_level = htonl (desired_replication_level);
+    pgm->options = htons (options);
+    pgm->hop_count = htons (hop_count + 1);
+    pgm->desired_replication_level = htons (desired_replication_level);
     pgm->xquery_size = htonl (xquery_size);
     pgm->bf_mutator = bf_nonce;
     GNUNET_break (GNUNET_YES ==
@@ -1547,8 +1554,8 @@ GDS_NEIGHBOURS_handle_get (enum GNUNET_BLOCK_Type type,
     GNUNET_memcpy (&xq[xquery_size],
                    reply_bf,
                    reply_bf_size);
-    GNUNET_MQ_send (target->mq,
-                    env);
+    do_send (target,
+             &pgm->header);
   }
   GNUNET_STATISTICS_update (GDS_stats,
                             "# GET messages queued for transmission",
@@ -1568,34 +1575,30 @@ GDS_NEIGHBOURS_lookup_peer (const struct GNUNET_PeerIdentity *target)
 }
 
 
-void
+bool
 GDS_NEIGHBOURS_handle_reply (struct PeerInfo *pi,
                              const struct GDS_DATACACHE_BlockData *bd,
                              const struct GNUNET_HashCode *query_hash,
                              unsigned int get_path_length,
                              const struct GNUNET_DHT_PathElement *get_path)
 {
-  struct GNUNET_MQ_Envelope *env;
-  struct PeerResultMessage *prm;
   struct GNUNET_DHT_PathElement *paths;
   size_t msize;
   unsigned int ppl = bd->put_path_length;
 
-#if SANITY_CHECKS
+#if SANITY_CHECKS > 1
   if (0 !=
-      GNUNET_DHT_verify_path (&bd->key,
-                              bd->data,
+      GNUNET_DHT_verify_path (bd->data,
                               bd->data_size,
                               bd->expiration_time,
                               bd->put_path,
                               bd->put_path_length,
                               get_path,
                               get_path_length,
-                              &my_identity))
+                              &GDS_my_identity))
   {
     GNUNET_break_op (0);
-    get_path_length = 0;
-    ppl = 0;
+    return false;
   }
 #endif
   msize = bd->data_size + (get_path_length + ppl)
@@ -1620,84 +1623,99 @@ GDS_NEIGHBOURS_handle_reply (struct PeerInfo *pi,
        (bd->data_size > GNUNET_MAX_MESSAGE_SIZE))
   {
     GNUNET_break (0);
-    return;
-  }
-  if (GNUNET_MQ_get_length (pi->mq) >= MAXIMUM_PENDING_PER_PEER)
-  {
-    /* skip */
-    GNUNET_STATISTICS_update (GDS_stats,
-                              "# P2P messages dropped due to full queue",
-                              1,
-                              GNUNET_NO);
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "Peer queue full, ignoring reply for key %s\n",
-                GNUNET_h2s (&bd->key));
-    return;
+    return false;
   }
-
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Forwarding reply for key %s to peer %s\n",
               GNUNET_h2s (query_hash),
-              GNUNET_i2s (pi->id));
+              GNUNET_i2s (&pi->id));
   GNUNET_STATISTICS_update (GDS_stats,
                             "# RESULT messages queued for transmission",
                             1,
                             GNUNET_NO);
-  env = GNUNET_MQ_msg_extra (prm,
-                             msize,
-                             GNUNET_MESSAGE_TYPE_DHT_P2P_RESULT);
-  prm->type = htonl (bd->type);
-  prm->put_path_length = htonl (ppl);
-  prm->get_path_length = htonl (get_path_length);
-  prm->expiration_time = GNUNET_TIME_absolute_hton (bd->expiration_time);
-  prm->key = *query_hash;
-  paths = (struct GNUNET_DHT_PathElement *) &prm[1];
-  GNUNET_memcpy (paths,
-                 bd->put_path,
-                 ppl * sizeof(struct GNUNET_DHT_PathElement));
-  GNUNET_memcpy (&paths[ppl],
-                 get_path,
-                 get_path_length * sizeof(struct GNUNET_DHT_PathElement));
-  /* 0 == get_path_length means path is not being tracked */
-  if (0 != get_path_length)
   {
-    /* Note that the signature in 'get_path' was not initialized before,
-       so this is crucial to avoid sending garbage. */
-    sign_path (&bd->key,
-               bd->data,
-               bd->data_size,
-               bd->expiration_time,
-               &paths[ppl + get_path_length - 1].pred,
-               pi->id,
-               &paths[ppl + get_path_length - 1].sig);
-  }
-  GNUNET_memcpy (&paths[ppl + get_path_length],
-                 bd->data,
-                 bd->data_size);
-  GNUNET_MQ_send (pi->mq,
-                  env);
-}
+    struct PeerResultMessage *prm;
+    char buf[sizeof (*prm) + msize] GNUNET_ALIGN;
+
+    prm = (struct PeerResultMessage *) buf;
+    prm->header.type = htons (GNUNET_MESSAGE_TYPE_DHT_P2P_RESULT);
+    prm->header.size = htons (sizeof (buf));
+    prm->type = htonl (bd->type);
+    prm->reserved = htonl (0);
+    prm->put_path_length = htons (ppl);
+    prm->get_path_length = htons (get_path_length);
+    prm->expiration_time = GNUNET_TIME_absolute_hton (bd->expiration_time);
+    prm->key = *query_hash;
+    paths = (struct GNUNET_DHT_PathElement *) &prm[1];
+    if (NULL != bd->put_path)
+    {
+      GNUNET_memcpy (paths,
+                     bd->put_path,
+                     ppl * sizeof(struct GNUNET_DHT_PathElement));
+    }
+    else
+    {
+      GNUNET_assert (0 == ppl);
+    }
+    if (NULL != get_path)
+    {
+      GNUNET_memcpy (&paths[ppl],
+                     get_path,
+                     get_path_length * sizeof(struct GNUNET_DHT_PathElement));
+    }
+    else
+    {
+      GNUNET_assert (0 == get_path_length);
+    }
+    /* 0 == get_path_length+ppl means path is not being tracked */
+    if (0 != (get_path_length + ppl))
+    {
+      /* Note that the last signature in 'paths' was not initialized before,
+         so this is crucial to avoid sending garbage. */
+      sign_path (bd->data,
+                 bd->data_size,
+                 bd->expiration_time,
+                 &paths[ppl + get_path_length - 1].pred,
+                 &pi->id,
+                 &paths[ppl + get_path_length - 1].sig);
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "Signing GET PATH %u/%u of %s => %s\n",
+                  ppl,
+                  get_path_length,
+                  GNUNET_h2s (query_hash),
+                  GNUNET_B2S (&paths[ppl + get_path_length - 1].sig));
+    }
+    GNUNET_memcpy (&paths[ppl + get_path_length],
+                   bd->data,
+                   bd->data_size);
 
+#if SANITY_CHECKS > 1
+    {
+      struct GNUNET_DHT_PathElement xpaths[get_path_length + 1];
 
-/**
- * To be called on core init.
- *
- * @param cls service closure
- * @param identity the public identity of this peer
- */
-static void
-core_init (void *cls,
-           const struct GNUNET_PeerIdentity *identity)
-{
-  (void) cls;
-  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
-              "CORE called, I am %s\n",
-              GNUNET_i2s (identity));
-  my_identity = *identity;
-  GNUNET_CRYPTO_hash (identity,
-                      sizeof(struct GNUNET_PeerIdentity),
-                      &my_identity_hash);
-  GNUNET_SERVICE_resume (GDS_service);
+      memcpy (xpaths,
+              &paths[ppl],
+              get_path_length * sizeof (struct GNUNET_DHT_PathElement));
+      xpaths[get_path_length].pred = GDS_my_identity;
+      if (0 !=
+          GNUNET_DHT_verify_path (bd->data,
+                                  bd->data_size,
+                                  bd->expiration_time,
+                                  paths,
+                                  ppl,
+                                  xpaths,
+                                  get_path_length + 1,
+                                  &pi->id))
+      {
+        GNUNET_break (0);
+        return false;
+      }
+    }
+#endif
+    do_send (pi,
+             &prm->header);
+  }
+  return true;
 }
 
 
@@ -1713,7 +1731,7 @@ check_dht_p2p_put (void *cls,
                    const struct PeerPutMessage *put)
 {
   uint16_t msize = ntohs (put->header.size);
-  uint32_t putlen = ntohl (put->put_path_length);
+  uint16_t putlen = ntohs (put->put_path_length);
 
   (void) cls;
   if ( (msize <
@@ -1732,34 +1750,37 @@ check_dht_p2p_put (void *cls,
 /**
  * Core handler for p2p put requests.
  *
- * @param cls closure with the `struct PeerInfo` of the sender
+ * @param cls closure with the `struct Target` of the sender
  * @param message message
  */
 static void
 handle_dht_p2p_put (void *cls,
                     const struct PeerPutMessage *put)
 {
-  struct PeerInfo *peer = cls;
+  struct Target *t = cls;
+  struct PeerInfo *peer = t->pi;
   uint16_t msize = ntohs (put->header.size);
   enum GNUNET_DHT_RouteOption options
-    = (enum GNUNET_DHT_RouteOption) ntohl (put->options);
+    = (enum GNUNET_DHT_RouteOption) ntohs (put->options);
+  const struct GNUNET_DHT_PathElement *put_path
+    = (const struct GNUNET_DHT_PathElement *) &put[1];
+  uint16_t putlen
+    = ntohs (put->put_path_length);
   struct GDS_DATACACHE_BlockData bd = {
     .key = put->key,
     .expiration_time = GNUNET_TIME_absolute_ntoh (put->expiration_time),
-    .type = ntohl (put->type)
+    .type = ntohl (put->type),
+    .data_size = msize - (sizeof(*put)
+                          + putlen * sizeof(struct GNUNET_DHT_PathElement)),
+    .data = &put_path[putlen]
   };
-  const struct GNUNET_DHT_PathElement *put_path
-    = (const struct GNUNET_DHT_PathElement *) &put[1];
-  uint32_t putlen
-    = ntohl (put->put_path_length);
 
-  bd.data_size = msize - (sizeof(*put)
-                          + putlen * sizeof(struct GNUNET_DHT_PathElement));
-  bd.data = &put_path[putlen];
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "PUT for `%s' from %s\n",
+              "PUT for `%s' from %s with RO (%s/%s)\n",
               GNUNET_h2s (&put->key),
-              GNUNET_i2s (peer->id));
+              GNUNET_i2s (&peer->id),
+              (options & GNUNET_DHT_RO_DEMULTIPLEX_EVERYWHERE) ? "x" : "-",
+              (options & GNUNET_DHT_RO_RECORD_ROUTE) ? "R" : "-");
   if (GNUNET_TIME_absolute_is_past (bd.expiration_time))
   {
     GNUNET_STATISTICS_update (GDS_stats,
@@ -1768,6 +1789,17 @@ handle_dht_p2p_put (void *cls,
                               GNUNET_NO);
     return;
   }
+  if (GNUNET_NO ==
+      GNUNET_BLOCK_check_block (GDS_block_context,
+                                bd.type,
+                                bd.data,
+                                bd.data_size))
+  {
+    GNUNET_break_op (0);
+    return;
+  }
+  if (0 == (options & GNUNET_DHT_RO_RECORD_ROUTE))
+    putlen = 0;
   GNUNET_STATISTICS_update (GDS_stats,
                             "# P2P PUT requests received",
                             1,
@@ -1796,25 +1828,14 @@ handle_dht_p2p_put (void *cls,
       }
       break;
     case GNUNET_NO:
-      GNUNET_break_op (0);
-      return;
-    case GNUNET_SYSERR:
       /* cannot verify, good luck */
       break;
+    case GNUNET_SYSERR:
+      /* block type not supported, good luck */
+      break;
     }
   }
 
-  if (GNUNET_NO ==
-      GNUNET_BLOCK_check_block (GDS_block_context,
-                                bd.type,
-                                &bd.key,
-                                bd.data,
-                                bd.data_size))
-  {
-    GNUNET_break_op (0);
-    return;
-  }
-
   {
     struct GNUNET_CONTAINER_BloomFilter *bf;
     struct GNUNET_DHT_PathElement pp[putlen + 1];
@@ -1830,42 +1851,39 @@ handle_dht_p2p_put (void *cls,
     bd.put_path_length = putlen + 1;
     if (0 != (options & GNUNET_DHT_RO_RECORD_ROUTE))
     {
-#if SANITY_CHECKS
-      for (unsigned int i = 0; i <= putlen; i++)
-      {
-        for (unsigned int j = 0; j < i; j++)
-        {
-          GNUNET_break (0 !=
-                        GNUNET_memcmp (&pp[i].pred,
-                                       &pp[j].pred));
-        }
-        GNUNET_break (0 !=
-                      GNUNET_memcmp (&pp[i].pred,
-                                     peer->id));
-      }
-      if (0 !=
-          GNUNET_DHT_verify_path (&bd.key,
-                                  bd.data,
-                                  bd.data_size,
-                                  bd.expiration_time,
-                                  bd.put_path,
-                                  putlen,
-                                  NULL, 0, /* get_path */
-                                  &my_identity))
-      {
-        GNUNET_break_op (0);
-        putlen = 0;
-      }
-#endif
+      unsigned int failure_offset;
+      
       GNUNET_memcpy (pp,
                      put_path,
                      putlen * sizeof(struct GNUNET_DHT_PathElement));
-      pp[putlen].pred = *peer->id;
+      pp[putlen].pred = peer->id;
       /* zero-out signature, not valid until we actually do forward! */
       memset (&pp[putlen].sig,
               0,
               sizeof (pp[putlen].sig));
-      putlen++;
+#if SANITY_CHECKS      
+    /* TODO: might want to eventually implement probabilistic
+       load-based path verification, but for now it is all or nothing */
+      failure_offset 
+        = GNUNET_DHT_verify_path (bd.data,
+                                  bd.data_size,
+                                  bd.expiration_time,
+                                  pp,
+                                  putlen + 1,
+                                  NULL, 0,   /* get_path */
+                                  &GDS_my_identity);
+#else
+      failure_offset = 0;
+#endif
+      if (0 != failure_offset)
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                    "Recorded put path invalid at offset %u, truncating\n",
+                    failure_offset);
+        GNUNET_assert (failure_offset <= putlen);
+        bd.put_path = &pp[failure_offset];
+        bd.put_path_length = putlen - failure_offset;
+      }      
     }
     else
     {
@@ -1873,9 +1891,9 @@ handle_dht_p2p_put (void *cls,
     }
 
     /* give to local clients */
-    GDS_CLIENTS_handle_reply (&bd,
-                              &bd.key,
-                              0, NULL /* get path */);
+    GNUNET_break (GDS_CLIENTS_handle_reply (&bd,
+                                            &bd.key,
+                                            0, NULL /* get path */));
 
     /* store locally */
     if ( (0 != (options & GNUNET_DHT_RO_DEMULTIPLEX_EVERYWHERE)) ||
@@ -1889,8 +1907,8 @@ handle_dht_p2p_put (void *cls,
       forwarded
         = GDS_NEIGHBOURS_handle_put (&bd,
                                      options,
-                                     ntohl (put->desired_replication_level),
-                                     ntohl (put->hop_count),
+                                     ntohs (put->desired_replication_level),
+                                     ntohs (put->hop_count),
                                      bf);
       /* notify monitoring clients */
       GDS_CLIENTS_process_put (options
@@ -1898,8 +1916,8 @@ handle_dht_p2p_put (void *cls,
                                 ? GNUNET_DHT_RO_LAST_HOP
                                 : 0),
                                &bd,
-                               ntohl (put->hop_count),
-                               ntohl (put->desired_replication_level));
+                               ntohs (put->hop_count),
+                               ntohs (put->desired_replication_level));
     }
     GNUNET_CONTAINER_bloomfilter_free (bf);
   }
@@ -1907,49 +1925,64 @@ handle_dht_p2p_put (void *cls,
 
 
 /**
- * We have received a FIND PEER request.  Send matching
- * HELLOs back.
+ * We have received a request for a HELLO.  Sends our
+ * HELLO back.
  *
- * @param pi sender of the FIND PEER request
+ * @param pi sender of the request
  * @param key peers close to this key are desired
  * @param bg group for filtering peers
  */
 static void
-handle_find_peer (struct PeerInfo *pi,
-                  const struct GNUNET_HashCode *query_hash,
-                  struct GNUNET_BLOCK_Group *bg)
+handle_find_my_hello (struct PeerInfo *pi,
+                      const struct GNUNET_HashCode *query_hash,
+                      struct GNUNET_BLOCK_Group *bg)
 {
-  int bucket_idx;
-  struct PeerBucket *bucket;
-  struct PeerInfo *peer;
-  unsigned int choice;
-  struct GDS_DATACACHE_BlockData bd = {
-    .type = GNUNET_BLOCK_TYPE_DHT_HELLO
-  };
-
-  /* first, check about our own HELLO */
-  if (NULL != GDS_my_hello)
+  size_t block_size = 0;
+
+  /* TODO: consider caching our HELLO block for a bit, to
+     avoid signing too often here... */
+  GNUNET_break (GNUNET_NO ==
+                GNUNET_HELLO_builder_to_block (GDS_my_hello,
+                                               &GDS_my_private_key,
+                                               NULL,
+                                               &block_size));
   {
-    bd.expiration_time = GNUNET_TIME_relative_to_absolute (
-      hello_expiration),
-    bd.key = my_identity_hash,
-    bd.data = GDS_my_hello;
-    bd.data_size = GNUNET_HELLO_size (
-      (const struct GNUNET_HELLO_Message *) GDS_my_hello);
-    GNUNET_break (bd.data_size >= sizeof(struct GNUNET_MessageHeader));
-    if (GNUNET_BLOCK_REPLY_OK_MORE ==
-        GNUNET_BLOCK_check_reply (GDS_block_context,
-                                  GNUNET_BLOCK_TYPE_DHT_HELLO,
-                                  bg,
-                                  &my_identity_hash,
-                                  NULL, 0,
-                                  bd.data,
-                                  bd.data_size))
+    char block[block_size];
+
+    if (GNUNET_OK !=
+        GNUNET_HELLO_builder_to_block (GDS_my_hello,
+                                       &GDS_my_private_key,
+                                       block,
+                                       &block_size))
     {
-      GDS_NEIGHBOURS_handle_reply (pi,
-                                   &bd,
-                                   query_hash,
-                                   0, NULL /* get path */);
+      GNUNET_STATISTICS_update (GDS_stats,
+                                "# FIND PEER requests ignored due to lack of HELLO",
+                                1,
+                                GNUNET_NO);
+    }
+    else if (GNUNET_BLOCK_REPLY_OK_MORE ==
+             GNUNET_BLOCK_check_reply (GDS_block_context,
+                                       GNUNET_BLOCK_TYPE_DHT_URL_HELLO,
+                                       bg,
+                                       &GDS_my_identity_hash,
+                                       NULL, 0,
+                                       block,
+                                       block_size))
+    {
+      struct GDS_DATACACHE_BlockData bd = {
+        .type = GNUNET_BLOCK_TYPE_DHT_URL_HELLO,
+        .expiration_time
+          = GNUNET_TIME_relative_to_absolute (
+              GNUNET_HELLO_ADDRESS_EXPIRATION),
+        .key = GDS_my_identity_hash,
+        .data = block,
+        .data_size = block_size
+      };
+
+      GNUNET_break (GDS_NEIGHBOURS_handle_reply (pi,
+                                                 &bd,
+                                                 query_hash,
+                                                 0, NULL /* get path */));
     }
     else
     {
@@ -1959,70 +1992,52 @@ handle_find_peer (struct PeerInfo *pi,
                                 GNUNET_NO);
     }
   }
-  else
-  {
-    GNUNET_STATISTICS_update (GDS_stats,
-                              "# FIND PEER requests ignored due to lack of HELLO",
-                              1,
-                              GNUNET_NO);
-  }
+}
 
-  /* then, also consider sending a random HELLO from the closest bucket */
-  /* FIXME: How can this be true? Shouldnt we just do find_bucket() ? */
-  if (0 ==
-      GNUNET_memcmp (&my_identity_hash,
-                     query_hash))
-    bucket_idx = closest_bucket - 1;
-  else
-    bucket_idx = GNUNET_MIN ((int) closest_bucket - 1,
-                             find_bucket (query_hash));
-  if (bucket_idx < 0)
-    return;
-  bucket = &k_buckets[bucket_idx];
-  if (bucket->peers_size == 0)
-    return;
-  choice = GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK,
-                                     bucket->peers_size);
-  peer = bucket->head;
-  while (choice > 0)
-  {
-    GNUNET_assert (NULL != peer);
-    peer = peer->next;
-    choice--;
-  }
-  choice = bucket->peers_size;
 
-  {
-    const struct GNUNET_HELLO_Message *hello;
-    size_t hello_size;
+/**
+ * We have received a request for nearby HELLOs.  Sends matching
+ * HELLOs back.
+ *
+ * @param pi sender of the request
+ * @param key peers close to this key are desired
+ * @param bg group for filtering peers
+ */
+static void
+handle_find_local_hello (struct PeerInfo *pi,
+                         const struct GNUNET_HashCode *query_hash,
+                         struct GNUNET_BLOCK_Group *bg)
+{
+  /* Force non-random selection by hop count */
+  struct PeerInfo *peer;
 
-    do
-    {
-      peer = peer->next;
-      if (0 == choice--)
-        return;                 /* no non-masked peer available */
-      if (NULL == peer)
-        peer = bucket->head;
-      hello = GDS_HELLO_get (peer->id);
-    } while ( (NULL == hello) ||
-              (GNUNET_BLOCK_REPLY_OK_MORE !=
-               GNUNET_BLOCK_check_reply (
-                 GDS_block_context,
-                 GNUNET_BLOCK_TYPE_DHT_HELLO,
-                 bg,
-                 &peer->phash,
-                 NULL, 0, /* xquery */
-                 hello,
-                 (hello_size = GNUNET_HELLO_size (hello)))));
-    bd.expiration_time = GNUNET_TIME_relative_to_absolute (
-      GNUNET_CONSTANTS_HELLO_ADDRESS_EXPIRATION);
-    bd.key = peer->phash;
-    bd.data = hello;
-    bd.data_size = hello_size;
-    GDS_NEIGHBOURS_handle_reply (pi,
-                                 &bd,
-                                 query_hash,
-                                 0, NULL /* get path */);
+  peer = select_peer (query_hash,
+                      NULL,
+                      GDS_NSE_get () + 1);
+  if ( (NULL != peer->hello) &&
+       (! GNUNET_TIME_absolute_is_past (peer->hello_expiration)) &&
+       (GNUNET_BLOCK_REPLY_OK_MORE ==
+        GNUNET_BLOCK_check_reply (
+          GDS_block_context,
+          GNUNET_BLOCK_TYPE_DHT_URL_HELLO,
+          bg,
+          &peer->phash,
+          NULL, 0,        /* xquery */
+          peer->hello,
+          peer->hello_size)) )
+  {
+    struct GDS_DATACACHE_BlockData bd = {
+      .type = GNUNET_BLOCK_TYPE_DHT_URL_HELLO,
+      .expiration_time = peer->hello_expiration,
+      .key = peer->phash,
+      .data = peer->hello,
+      .data_size = peer->hello_size
+    };
+
+    GNUNET_break (GDS_NEIGHBOURS_handle_reply (pi,
+                                               &bd,
+                                               query_hash,
+                                               0, NULL /* get path */));
   }
 }
 
@@ -2039,17 +2054,17 @@ handle_local_result (void *cls,
 {
   struct PeerInfo *peer = cls;
 
-  GDS_NEIGHBOURS_handle_reply (peer,
-                               bd,
-                               &bd->key,
-                               0, NULL /* get path */);
+  GNUNET_break (GDS_NEIGHBOURS_handle_reply (peer,
+                                             bd,
+                                             &bd->key,
+                                             0, NULL /* get path */));
 }
 
 
 /**
  * Check validity of p2p get request.
  *
- * @param cls closure with the `struct PeerInfo` of the sender
+ * @param cls closure with the `struct Target` of the sender
  * @param get the message
  * @return #GNUNET_OK if the message is well-formed
  */
@@ -2073,20 +2088,21 @@ check_dht_p2p_get (void *cls,
 /**
  * Core handler for p2p get requests.
  *
- * @param cls closure with the `struct PeerInfo` of the sender
+ * @param cls closure with the `struct Target` of the sender
  * @param get the message
  */
 static void
 handle_dht_p2p_get (void *cls,
                     const struct PeerGetMessage *get)
 {
-  struct PeerInfo *peer = cls;
+  struct Target *t = cls;
+  struct PeerInfo *peer = t->pi;
   uint16_t msize = ntohs (get->header.size);
   uint32_t xquery_size = ntohl (get->xquery_size);
-  uint32_t hop_count = ntohl (get->hop_count);
+  uint32_t hop_count = ntohs (get->hop_count);
   size_t reply_bf_size = msize - (sizeof(*get) + xquery_size);
   enum GNUNET_BLOCK_Type type = (enum GNUNET_BLOCK_Type) ntohl (get->type);
-  enum GNUNET_DHT_RouteOption options = (enum GNUNET_DHT_RouteOption)  ntohl (
+  enum GNUNET_DHT_RouteOption options = (enum GNUNET_DHT_RouteOption)  ntohs (
     get->options);
   enum GNUNET_BLOCK_ReplyEvaluationResult eval = GNUNET_BLOCK_REPLY_OK_MORE;
   const void *xquery = (const void *) &get[1];
@@ -2133,32 +2149,45 @@ handle_dht_p2p_get (void *cls,
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                 "GET for %s at %s after %u hops\n",
                 GNUNET_h2s (&get->key),
-                GNUNET_i2s (&my_identity),
+                GNUNET_i2s (&GDS_my_identity),
                 (unsigned int) hop_count);
-    /* local lookup (this may update the reply_bf) */
+    /* local lookup (this may update the bg) */
     if ( (0 != (options & GNUNET_DHT_RO_DEMULTIPLEX_EVERYWHERE)) ||
          (GDS_am_closest_peer (&get->key,
                                peer_bf)) )
     {
-      if ((0 != (options & GNUNET_DHT_RO_FIND_PEER)))
+      if (GNUNET_BLOCK_TYPE_DHT_URL_HELLO == type)
       {
         GNUNET_STATISTICS_update (GDS_stats,
-                                  "# P2P FIND PEER requests processed",
+                                  "# P2P HELLO lookup requests processed",
                                   1,
                                   GNUNET_NO);
-        handle_find_peer (peer,
-                          &get->key,
-                          bg);
+        handle_find_my_hello (peer,
+                              &get->key,
+                              bg);
+        if (0 != (options & GNUNET_DHT_RO_FIND_APPROXIMATE))
+          handle_find_local_hello (peer,
+                                   &get->key,
+                                   bg);
       }
       else
       {
-        eval = GDS_DATACACHE_handle_get (&get->key,
-                                         type,
-                                         xquery,
-                                         xquery_size,
-                                         bg,
-                                         &handle_local_result,
-                                         peer);
+        if (0 != (options & GNUNET_DHT_RO_FIND_APPROXIMATE))
+          eval = GDS_DATACACHE_get_closest (&get->key,
+                                            type,
+                                            xquery,
+                                            xquery_size,
+                                            bg,
+                                            &handle_local_result,
+                                            peer);
+        else
+          eval = GDS_DATACACHE_handle_get (&get->key,
+                                           type,
+                                           xquery,
+                                           xquery_size,
+                                           bg,
+                                           &handle_local_result,
+                                           peer);
       }
     }
     else
@@ -2169,8 +2198,10 @@ handle_dht_p2p_get (void *cls,
                                 GNUNET_NO);
     }
 
-    /* remember request for routing replies */
-    GDS_ROUTING_add (peer->id,
+    /* remember request for routing replies
+       TODO: why should we do this if GNUNET_BLOCK_REPLY_OK_LAST == eval?
+    */
+    GDS_ROUTING_add (&peer->id,
                      type,
                      bg,      /* bg now owned by routing, but valid at least until end of this function! */
                      options,
@@ -2181,7 +2212,7 @@ handle_dht_p2p_get (void *cls,
     /* P2P forwarding */
     {
       bool forwarded = false;
-      uint32_t desired_replication_level = ntohl (
+      uint16_t desired_replication_level = ntohs (
         get->desired_replication_level);
 
       if (eval != GNUNET_BLOCK_REPLY_OK_LAST)
@@ -2220,18 +2251,25 @@ handle_dht_p2p_get (void *cls,
  * @param query_hash hash of the original query, might not match key in @a bd
  * @param get_path_length number of entries in @a get_path
  * @param get_path path the reply has taken
+ * @return true on success
  */
-static void
+static bool
 process_reply_with_path (const struct GDS_DATACACHE_BlockData *bd,
                          const struct GNUNET_HashCode *query_hash,
                          unsigned int get_path_length,
                          const struct GNUNET_DHT_PathElement *get_path)
 {
   /* forward to local clients */
-  GDS_CLIENTS_handle_reply (bd,
-                            query_hash,
-                            get_path_length,
-                            get_path);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Forwarding reply to local clients\n");
+  if (! GDS_CLIENTS_handle_reply (bd,
+                                  query_hash,
+                                  get_path_length,
+                                  get_path))
+  {
+    GNUNET_break (0);
+    return false;
+  }
   GDS_CLIENTS_process_get_resp (bd,
                                 get_path,
                                 get_path_length);
@@ -2256,6 +2294,7 @@ process_reply_with_path (const struct GDS_DATACACHE_BlockData *bd,
                        query_hash,
                        get_path_length,
                        get_path);
+  return true;
 }
 
 
@@ -2270,8 +2309,8 @@ static enum GNUNET_GenericReturnValue
 check_dht_p2p_result (void *cls,
                       const struct PeerResultMessage *prm)
 {
-  uint32_t get_path_length = ntohl (prm->get_path_length);
-  uint32_t put_path_length = ntohl (prm->put_path_length);
+  uint16_t get_path_length = ntohs (prm->get_path_length);
+  uint16_t put_path_length = ntohs (prm->put_path_length);
   uint16_t msize = ntohs (prm->header.size);
 
   (void) cls;
@@ -2301,18 +2340,20 @@ static void
 handle_dht_p2p_result (void *cls,
                        const struct PeerResultMessage *prm)
 {
-  struct PeerInfo *peer = cls;
+  struct Target *t = cls;
+  struct PeerInfo *peer = t->pi;
   uint16_t msize = ntohs (prm->header.size);
-  uint32_t get_path_length = ntohl (prm->get_path_length);
+  uint16_t get_path_length = ntohs (prm->get_path_length);
   struct GDS_DATACACHE_BlockData bd = {
     .expiration_time  = GNUNET_TIME_absolute_ntoh (prm->expiration_time),
     .put_path = (const struct GNUNET_DHT_PathElement *) &prm[1],
-    .put_path_length = ntohl (prm->put_path_length),
+    .put_path_length = ntohs (prm->put_path_length),
+    .key = prm->key,
     .type = ntohl (prm->type)
   };
   const struct GNUNET_DHT_PathElement *get_path
     = &bd.put_path[bd.put_path_length];
-
+    
   /* parse and validate message */
   if (GNUNET_TIME_absolute_is_past (bd.expiration_time))
   {
@@ -2327,6 +2368,15 @@ handle_dht_p2p_result (void *cls,
   bd.data_size = msize - (sizeof(struct PeerResultMessage)
                           + (get_path_length + bd.put_path_length)
                           * sizeof(struct GNUNET_DHT_PathElement));
+  if (GNUNET_OK !=
+      GNUNET_BLOCK_check_block (GDS_block_context,
+                                bd.type,
+                                bd.data,
+                                bd.data_size))
+  {
+    GNUNET_break_op (0);
+    return;
+  }
   GNUNET_STATISTICS_update (GDS_stats,
                             "# P2P RESULTS received",
                             1,
@@ -2337,7 +2387,6 @@ handle_dht_p2p_result (void *cls,
                             GNUNET_NO);
   {
     enum GNUNET_GenericReturnValue ret;
-    const struct GNUNET_HashCode *pquery;
 
     ret = GNUNET_BLOCK_get_key (GDS_block_context,
                                 bd.type,
@@ -2345,102 +2394,274 @@ handle_dht_p2p_result (void *cls,
                                 bd.data_size,
                                 &bd.key);
     if (GNUNET_NO == ret)
-    {
-      GNUNET_break_op (0);
-      return;
-    }
-    pquery = (GNUNET_OK == ret) ? &bd.key : &prm->key;
-    if (GNUNET_OK !=
-        GNUNET_BLOCK_check_block (GDS_block_context,
-                                  bd.type,
-                                  pquery,
-                                  bd.data,
-                                  bd.data_size))
-    {
-      GNUNET_break_op (0);
-      return;
-    }
+      bd.key = prm->key;
   }
 
   /* if we got a HELLO, consider it for our own routing table */
-  if (GNUNET_BLOCK_TYPE_DHT_HELLO == bd.type)
-  {
-    const struct GNUNET_MessageHeader *h = bd.data;
-    struct GNUNET_PeerIdentity pid;
-
-    /* Should be a HELLO, validate and consider using it! */
-    if (bd.data_size < sizeof(struct GNUNET_HELLO_Message))
-    {
-      GNUNET_break (0);
-      return;
-    }
-    if (bd.data_size != ntohs (h->size))
-    {
-      GNUNET_break (0);
-      return;
-    }
-    if (GNUNET_OK !=
-        GNUNET_HELLO_get_id ((const struct GNUNET_HELLO_Message *) h,
-                             &pid))
-    {
-      GNUNET_break_op (0);
-      return;
-    }
-    if ( (GNUNET_YES != disable_try_connect) &&
-         (0 != GNUNET_memcmp (&my_identity,
-                              &pid)) )
-      try_connect (&pid,
-                   h);
-  }
+  hello_check (&bd);
 
-  /* First, check if 'peer' is already on the path, and if
-     so, truncate it instead of expanding. */
-  for (unsigned int i = 0; i <= get_path_length; i++)
-    if (0 == GNUNET_memcmp (&get_path[i].pred,
-                            peer->id))
-    {
-      process_reply_with_path (&bd,
-                               &prm->key,
-                               i, get_path);
-      return;
-    }
-
-  /* Need to append 'peer' to 'get_path' (normal case) */
+  /* Need to append 'peer' to 'get_path' */
   {
     struct GNUNET_DHT_PathElement xget_path[get_path_length + 1];
+    struct GNUNET_DHT_PathElement *gp = xget_path;
+    unsigned int failure_offset;
 
     GNUNET_memcpy (xget_path,
                    get_path,
                    get_path_length * sizeof(struct GNUNET_DHT_PathElement));
-    xget_path[get_path_length].pred = *peer->id;
+    xget_path[get_path_length].pred = peer->id;
     memset (&xget_path[get_path_length].sig,
             0,
             sizeof (xget_path[get_path_length].sig));
-    process_reply_with_path (&bd,
-                             &prm->key,
-                             get_path_length + 1, xget_path);
+#if SANITY_CHECKS
+    /* TODO: might want to eventually implement probabilistic
+       load-based path verification, but for now it is all or nothing */
+    failure_offset 
+      = GNUNET_DHT_verify_path (bd.data,
+                                bd.data_size,
+                                bd.expiration_time,
+                                bd.put_path,
+                                bd.put_path_length,
+                                xget_path,
+                                get_path_length + 1,
+                                &GDS_my_identity);
+#else
+    failure_offset = 0;
+#endif
+    if (0 != failure_offset)
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                  "Recorded path invalid at offset %u, truncating\n",
+                  failure_offset);
+      GNUNET_assert (failure_offset <= bd.put_path_length + get_path_length);
+      if (failure_offset >= bd.put_path_length)
+      {
+        /* failure on get path */
+        get_path_length -= (failure_offset - bd.put_path_length);
+        gp = &xget_path[failure_offset - bd.put_path_length];
+        bd.put_path_length = 0;
+      }
+      else
+      {
+        /* failure on put path */
+        bd.put_path = &bd.put_path[failure_offset];
+        bd.put_path_length -= failure_offset;
+      }
+    }
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Extending GET path of length %u with %s\n",
+                get_path_length,
+                GNUNET_i2s (&peer->id));
+    GNUNET_break (process_reply_with_path (&bd,
+                                           &prm->key,
+                                           get_path_length + 1,
+                                           gp));
   }
 }
 
 
-enum GNUNET_GenericReturnValue
-GDS_NEIGHBOURS_init ()
+/**
+ * Check validity of a p2p hello message.
+ *
+ * @param cls closure
+ * @param hello message
+ * @return #GNUNET_YES if the message is well-formed
+ */
+static enum GNUNET_GenericReturnValue
+check_dht_p2p_hello (void *cls,
+                     const struct GNUNET_MessageHeader *hello)
 {
+  struct Target *t = cls;
+  struct PeerInfo *peer = t->pi;
+  enum GNUNET_GenericReturnValue ret;
+  size_t hellob_size;
+  void *hellob;
+  struct GNUNET_TIME_Absolute expiration;
+
+  ret = GNUNET_HELLO_dht_msg_to_block (hello,
+                                       &peer->id,
+                                       &hellob,
+                                       &hellob_size,
+                                       &expiration);
+  GNUNET_free (hellob);
+  return ret;
+}
+
+
+/**
+ * Core handler for p2p HELLO messages.
+ *
+ * @param cls closure
+ * @param message message
+ */
+static void
+handle_dht_p2p_hello (void *cls,
+                      const struct GNUNET_MessageHeader *hello)
+{
+  struct Target *t = cls;
+  struct PeerInfo *peer = t->pi;
+
+  GNUNET_free (peer->hello);
+  peer->hello_size = 0;
+  GNUNET_break (GNUNET_OK ==
+                GNUNET_HELLO_dht_msg_to_block (hello,
+                                               &peer->id,
+                                               &peer->hello,
+                                               &peer->hello_size,
+                                               &peer->hello_expiration));
+}
+
+
+void
+GDS_u_receive (void *cls,
+               void **tctx,
+               void **sctx,
+               const void *message,
+               size_t message_size)
+{
+  struct Target *t = *tctx;
   struct GNUNET_MQ_MessageHandler core_handlers[] = {
     GNUNET_MQ_hd_var_size (dht_p2p_get,
                            GNUNET_MESSAGE_TYPE_DHT_P2P_GET,
                            struct PeerGetMessage,
-                           NULL),
+                           t),
     GNUNET_MQ_hd_var_size (dht_p2p_put,
                            GNUNET_MESSAGE_TYPE_DHT_P2P_PUT,
                            struct PeerPutMessage,
-                           NULL),
+                           t),
     GNUNET_MQ_hd_var_size (dht_p2p_result,
                            GNUNET_MESSAGE_TYPE_DHT_P2P_RESULT,
                            struct PeerResultMessage,
-                           NULL),
+                           t),
+    GNUNET_MQ_hd_var_size (dht_p2p_hello,
+                           GNUNET_MESSAGE_TYPE_DHT_P2P_HELLO,
+                           struct GNUNET_MessageHeader,
+                           t),
     GNUNET_MQ_handler_end ()
   };
+  const struct GNUNET_MessageHeader *mh = message;
+
+  (void) cls; /* the 'struct GDS_Underlay' */
+  (void) sctx; /* our receiver address */
+  if (NULL == t)
+  {
+    /* Received message claiming to originate from myself?
+       Ignore! */
+    GNUNET_break_op (0);
+    return;
+  }
+  if (message_size < sizeof (*mh))
+  {
+    GNUNET_break_op (0);
+    return;
+  }
+  if (message_size != ntohs (mh->size))
+  {
+    GNUNET_break_op (0);
+    return;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Handling message of type %u from peer %s\n",
+              ntohs (mh->type),
+              GNUNET_i2s (&t->pi->id));
+  if (GNUNET_OK !=
+      GNUNET_MQ_handle_message (core_handlers,
+                                mh))
+  {
+    GNUNET_break_op (0);
+    return;
+  }
+}
+
+
+/**
+ * Callback function used to extract URIs from a builder.
+ * Called when we should consider connecting to a peer.
+ *
+ * @param cls closure pointing to a `struct GNUNET_PeerIdentity *`
+ * @param uri one of the URIs
+ */
+void
+GDS_try_connect (void *cls,
+                 const char *uri)
+{
+  const struct GNUNET_PeerIdentity *pid = cls;
+  struct GNUNET_HashCode phash;
+  int peer_bucket;
+  struct PeerBucket *bucket;
+
+  if (0 == GNUNET_memcmp (&GDS_my_identity,
+                          pid))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Got a HELLO for my own PID, ignoring it\n");
+    return; /* that's us! */
+  }
+  GNUNET_CRYPTO_hash (pid,
+                      sizeof(*pid),
+                      &phash);
+  peer_bucket = find_bucket (&phash);
+  GNUNET_assert ( (peer_bucket >= 0) &&
+                  ((unsigned int) peer_bucket < MAX_BUCKETS));
+  bucket = &k_buckets[peer_bucket];
+  if (bucket->peers_size >= bucket_size)
+    return; /* do not care */
+  for (struct PeerInfo *pi = bucket->head;
+       NULL != pi;
+       pi = pi->next)
+    if (0 ==
+        GNUNET_memcmp (&pi->id,
+                       pid))
+    {
+      /* already connected */
+      /* TODO: maybe consider 'uri' anyway as an additional
+         alternative address??? */
+      return;
+    }
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "Discovered peer %s at %s suitable for bucket %d (%u/%u), trying to connect\n",
+              GNUNET_i2s (pid),
+              uri,
+              peer_bucket,
+              bucket->peers_size,
+              bucket_size);
+  /* new peer that we like! */
+  GDS_u_try_connect (pid,
+                     uri);
+}
+
+
+/**
+ * Send @a msg to all peers in our buckets.
+ *
+ * @param msg message to broadcast
+ */
+void
+GDS_NEIGHBOURS_broadcast (const struct GNUNET_MessageHeader *msg)
+{
+  for (unsigned int bc = 0; bc<closest_bucket; bc++)
+  {
+    struct PeerBucket *bucket = &k_buckets[bc];
+    unsigned int count = 0;
+
+    for (struct PeerInfo *pos = bucket->head;
+         NULL != pos;
+         pos = pos->next)
+    {
+      if (count >= bucket_size)
+        break;   /* we only consider first #bucket_size entries per bucket */
+      count++;
+      do_send (pos,
+               msg);
+    }
+  }
+}
+
+
+enum GNUNET_GenericReturnValue
+GDS_NEIGHBOURS_init ()
+{
+
   unsigned long long temp_config_num;
 
   disable_try_connect
@@ -2457,45 +2678,8 @@ GDS_NEIGHBOURS_init ()
     = GNUNET_CONFIGURATION_get_value_yesno (GDS_cfg,
                                             "DHT",
                                             "CACHE_RESULTS");
-  {
-    char *keyfile;
-
-    if (GNUNET_OK !=
-        GNUNET_CONFIGURATION_get_value_filename (GDS_cfg,
-                                                 "PEER",
-                                                 "PRIVATE_KEY",
-                                                 &keyfile))
-    {
-      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                  "Core service is lacking HOSTKEY configuration setting.  Exiting.\n");
-      return GNUNET_SYSERR;
-    }
-    if (GNUNET_SYSERR ==
-        GNUNET_CRYPTO_eddsa_key_from_file (keyfile,
-                                           GNUNET_YES,
-                                           &my_private_key))
-    {
-      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                  "Failed to setup peer's private key\n");
-      GNUNET_free (keyfile);
-      return GNUNET_SYSERR;
-    }
-    GNUNET_free (keyfile);
-  }
-
-  ats_ch = GNUNET_ATS_connectivity_init (GDS_cfg);
-  core_api = GNUNET_CORE_connect (GDS_cfg,
-                                  NULL,
-                                  &core_init,
-                                  &handle_core_connect,
-                                  &handle_core_disconnect,
-                                  core_handlers);
-  if (NULL == core_api)
-    return GNUNET_SYSERR;
   all_connected_peers = GNUNET_CONTAINER_multipeermap_create (256,
                                                               GNUNET_YES);
-  all_desired_peers = GNUNET_CONTAINER_multipeermap_create (256,
-                                                            GNUNET_NO);
   return GNUNET_OK;
 }
 
@@ -2503,21 +2687,12 @@ GDS_NEIGHBOURS_init ()
 void
 GDS_NEIGHBOURS_done ()
 {
-  if (NULL == core_api)
+  if (NULL == all_connected_peers)
     return;
-  GNUNET_CORE_disconnect (core_api);
-  core_api = NULL;
   GNUNET_assert (0 ==
                  GNUNET_CONTAINER_multipeermap_size (all_connected_peers));
   GNUNET_CONTAINER_multipeermap_destroy (all_connected_peers);
   all_connected_peers = NULL;
-  GNUNET_CONTAINER_multipeermap_iterate (all_desired_peers,
-                                         &free_connect_info,
-                                         NULL);
-  GNUNET_CONTAINER_multipeermap_destroy (all_desired_peers);
-  all_desired_peers = NULL;
-  GNUNET_ATS_connectivity_done (ats_ch);
-  ats_ch = NULL;
   GNUNET_assert (NULL == find_peer_task);
 }
 
@@ -2525,7 +2700,7 @@ GDS_NEIGHBOURS_done ()
 struct GNUNET_PeerIdentity *
 GDS_NEIGHBOURS_get_id ()
 {
-  return &my_identity;
+  return &GDS_my_identity;
 }
 
 
diff --git a/src/dht/gnunet-service-dht_neighbours.h b/src/dht/gnunet-service-dht_neighbours.h
index 35bbb125d..4f4172f71 100644
--- a/src/dht/gnunet-service-dht_neighbours.h
+++ b/src/dht/gnunet-service-dht_neighbours.h
@@ -30,13 +30,9 @@
 #include "gnunet_util_lib.h"
 #include "gnunet_block_lib.h"
 #include "gnunet_dht_service.h"
+#include "gnunet_dhtu_plugin.h"
 #include "gnunet-service-dht_datacache.h"
 
-/**
- * Hash of the identity of this peer.
- */
-extern struct GNUNET_HashCode my_identity_hash;
-
 
 struct PeerInfo;
 
@@ -67,8 +63,8 @@ GDS_NEIGHBOURS_lookup_peer (const struct GNUNET_PeerIdentity *target);
 enum GNUNET_GenericReturnValue
 GDS_NEIGHBOURS_handle_put (const struct GDS_DATACACHE_BlockData *bd,
                            enum GNUNET_DHT_RouteOption options,
-                           uint32_t desired_replication_level,
-                           uint32_t hop_count,
+                           uint16_t desired_replication_level,
+                           uint16_t hop_count,
                            struct GNUNET_CONTAINER_BloomFilter *bf);
 
 
@@ -92,8 +88,8 @@ GDS_NEIGHBOURS_handle_put (const struct GDS_DATACACHE_BlockData *bd,
 enum GNUNET_GenericReturnValue
 GDS_NEIGHBOURS_handle_get (enum GNUNET_BLOCK_Type type,
                            enum GNUNET_DHT_RouteOption options,
-                           uint32_t desired_replication_level,
-                           uint32_t hop_count,
+                           uint16_t desired_replication_level,
+                           uint16_t hop_count,
                            const struct GNUNET_HashCode *key,
                            const void *xquery,
                            size_t xquery_size,
@@ -112,8 +108,9 @@ GDS_NEIGHBOURS_handle_get (enum GNUNET_BLOCK_Type type,
  * @param query_hash query that was used for the request
  * @param get_path_length number of entries in put_path
  * @param get_path peers this reply has traversed so far (if tracked)
+ * @return true on success
  */
-void
+bool
 GDS_NEIGHBOURS_handle_reply (struct PeerInfo *pi,
                              const struct GDS_DATACACHE_BlockData *bd,
                              const struct GNUNET_HashCode *query_hash,
@@ -137,6 +134,73 @@ GDS_am_closest_peer (const struct GNUNET_HashCode *key,
 
 
 /**
+ * Callback function used to extract URIs from a builder.
+ * Called when we should consider connecting to a peer.
+ *
+ * @param cls closure pointing to a `struct GNUNET_PeerIdentity *`
+ * @param uri one of the URIs
+ */
+void
+GDS_try_connect (void *cls,
+                 const char *uri);
+
+
+/**
+ * Function to call when we connect to a peer and can henceforth transmit to
+ * that peer.
+ *
+ * @param cls the closure, must be a `struct GDS_Underlay`
+ * @param target handle to the target,
+ *    pointer will remain valid until @e disconnect_cb is called
+ * @para pid peer identity,
+ *    pointer will remain valid until @e disconnect_cb is called
+ * @param[out] ctx storage space for DHT to use in association with this target
+ */
+void
+GDS_u_connect (void *cls,
+               struct GNUNET_DHTU_Target *target,
+               const struct GNUNET_PeerIdentity *pid,
+               void **ctx);
+
+
+/**
+ * Function to call when we disconnected from a peer and can henceforth
+ * cannot transmit to that peer anymore.
+ *
+ * @param[in] ctx storage space used by the DHT in association with this target
+ */
+void
+GDS_u_disconnect (void *ctx);
+
+
+/**
+ * Function to call when we receive a message.
+ *
+ * @param cls the closure
+ * @param origin where the message originated from
+ * @param[in,out] tctx ctx of target address where we received the message from
+ * @param[in,out] sctx ctx of our own source address at which we received the message
+ * @param message the message we received @param message_size number of
+ * bytes in @a message
+ */
+void
+GDS_u_receive (void *cls,
+               void **tctx,
+               void **sctx,
+               const void *message,
+               size_t message_size);
+
+
+/**
+ * Send @a msg to all peers in our buckets.
+ *
+ * @param msg message to broadcast
+ */
+void
+GDS_NEIGHBOURS_broadcast (const struct GNUNET_MessageHeader *msg);
+
+
+/**
  * Initialize neighbours subsystem.
  *
  * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
diff --git a/src/dht/gnunet-service-dht_nse.c b/src/dht/gnunet-service-dht_nse.c
deleted file mode 100644
index 58f18816a..000000000
--- a/src/dht/gnunet-service-dht_nse.c
+++ /dev/null
@@ -1,121 +0,0 @@
-/*
-     This file is part of GNUnet.
-     Copyright (C) 2009, 2010, 2011 GNUnet e.V.
-
-     GNUnet is free software: you can redistribute it and/or modify it
-     under the terms of the GNU Affero General Public License as published
-     by the Free Software Foundation, either version 3 of the License,
-     or (at your option) any later version.
-
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     Affero General Public License for more details.
-
-     You should have received a copy of the GNU Affero General Public License
-     along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-
-/**
- * @file dht/gnunet-service-dht_nse.c
- * @brief GNUnet DHT integration with NSE
- * @author Christian Grothoff
- */
-#include "platform.h"
-#include "gnunet_nse_service.h"
-#include "gnunet-service-dht.h"
-#include "gnunet-service-dht_nse.h"
-
-/**
- * log of the current network size estimate, used as the point where
- * we switch between random and deterministic routing.  Default
- * value of 4.0 is used if NSE module is not available (i.e. not
- * configured).
- */
-static double log_of_network_size_estimate = 4.0;
-
-/**
- * Network size estimation handle.
- */
-static struct GNUNET_NSE_Handle *nse;
-
-
-/**
- * Callback that is called when network size estimate is updated.
- *
- * @param cls closure
- * @param timestamp time when the estimate was received from the server (or created by the server)
- * @param logestimate the log(Base 2) value of the current network size estimate
- * @param std_dev standard deviation for the estimate
- *
- */
-static void
-update_network_size_estimate (void *cls,
-                              struct GNUNET_TIME_Absolute timestamp,
-                              double logestimate,
-                              double std_dev)
-{
-  GNUNET_STATISTICS_update (GDS_stats,
-                            "# Network size estimates received",
-                            1, GNUNET_NO);
-  /* do not allow estimates < 0.5 */
-  log_of_network_size_estimate = GNUNET_MAX (0.5, logestimate);
-}
-
-
-/**
- * Return the log of the current network size estimate.
- *
- * @return log of NSE
- */
-double
-GDS_NSE_get ()
-{
-  return log_of_network_size_estimate;
-}
-
-
-/**
- * Initialize NSE subsystem.
- */
-void
-GDS_NSE_init ()
-{
-  unsigned long long hops;
-
-  if ( (GNUNET_YES ==
-        GNUNET_CONFIGURATION_have_value (GDS_cfg,
-                                         "dht",
-                                         "FORCE_NSE")) &&
-       (GNUNET_OK ==
-        GNUNET_CONFIGURATION_get_value_number (GDS_cfg,
-                                               "dht",
-                                               "FORCE_NSE",
-                                               &hops)) )
-  {
-    log_of_network_size_estimate = (double) hops;
-    return;
-  }
-  nse = GNUNET_NSE_connect (GDS_cfg,
-                            &update_network_size_estimate,
-                            NULL);
-}
-
-
-/**
- * Shutdown NSE subsystem.
- */
-void
-GDS_NSE_done ()
-{
-  if (NULL != nse)
-  {
-    GNUNET_NSE_disconnect (nse);
-    nse = NULL;
-  }
-}
-
-
-/* end of gnunet-service-dht_nse.c */
diff --git a/src/dht/gnunet-service-dht_nse.h b/src/dht/gnunet-service-dht_nse.h
deleted file mode 100644
index e99389e74..000000000
--- a/src/dht/gnunet-service-dht_nse.h
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
-     This file is part of GNUnet.
-     Copyright (C) 2011 GNUnet e.V.
-
-     GNUnet is free software: you can redistribute it and/or modify it
-     under the terms of the GNU Affero General Public License as published
-     by the Free Software Foundation, either version 3 of the License,
-     or (at your option) any later version.
-
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     Affero General Public License for more details.
-
-     You should have received a copy of the GNU Affero General Public License
-     along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-
-/**
- * @file dht/gnunet-service-dht_nse.h
- * @brief GNUnet DHT integration with NSE
- * @author Christian Grothoff
- */
-#ifndef GNUNET_SERVICE_DHT_NSE_H
-#define GNUNET_SERVICE_DHT_NSE_H
-
-
-/**
- * Return the log of the current network size estimate.
- *
- * @return log of NSE
- */
-double
-GDS_NSE_get (void);
-
-
-/**
- * Initialize NSE subsystem.
- */
-void
-GDS_NSE_init (void);
-
-
-/**
- * Shutdown NSE subsystem.
- */
-void
-GDS_NSE_done (void);
-
-#endif
diff --git a/src/dht/gnunet-service-dht_routing.c b/src/dht/gnunet-service-dht_routing.c
index e7b5c3571..6deb5fa16 100644
--- a/src/dht/gnunet-service-dht_routing.c
+++ b/src/dht/gnunet-service-dht_routing.c
@@ -27,6 +27,7 @@
 #include "gnunet-service-dht_neighbours.h"
 #include "gnunet-service-dht_routing.h"
 #include "gnunet-service-dht.h"
+#include "gnunet_block_group_lib.h"
 
 
 /**
@@ -151,7 +152,7 @@ process (void *cls,
     bdx.put_path_length = 0;
     bdx.put_path = NULL;
   }
-  if ( (0 == (rr->options & GNUNET_DHT_RO_FIND_PEER)) &&
+  if ( (0 == (rr->options & GNUNET_DHT_RO_FIND_APPROXIMATE)) &&
        (0 != GNUNET_memcmp (query_hash,
                             &bdx.key)) )
   {
@@ -174,6 +175,22 @@ process (void *cls,
               GNUNET_h2s (&bdx.key),
               bdx.type,
               eval);
+  if (GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED == eval)
+  {
+    /* If we do not know the block type, we still filter
+       exact duplicates by the block content */
+    struct GNUNET_HashCode chash;
+    
+    GNUNET_CRYPTO_hash (bdx.data,
+                        bdx.data_size,
+                        &chash);
+    if (GNUNET_YES ==
+        GNUNET_BLOCK_GROUP_bf_test_and_set (rr->bg,
+                                            &chash))
+      eval = GNUNET_BLOCK_REPLY_OK_DUPLICATE;
+    else
+      eval = GNUNET_BLOCK_REPLY_OK_MORE;
+  }
   switch (eval)
   {
   case GNUNET_BLOCK_REPLY_OK_MORE:
@@ -195,10 +212,11 @@ process (void *cls,
                     GNUNET_h2s (query_hash));
         return GNUNET_OK;
       }
-      GDS_NEIGHBOURS_handle_reply (pi,
-                                   &bdx,
-                                   query_hash,
-                                   get_path_length, pc->get_path);
+      GNUNET_break (GDS_NEIGHBOURS_handle_reply (pi,
+                                                 &bdx,
+                                                 query_hash,
+                                                 get_path_length,
+                                                 pc->get_path));
     }
     break;
   case GNUNET_BLOCK_REPLY_OK_DUPLICATE:
@@ -207,13 +225,6 @@ process (void *cls,
                               1,
                               GNUNET_NO);
     return GNUNET_OK;
-  case GNUNET_BLOCK_REPLY_INVALID:
-    GNUNET_break (0);
-    GNUNET_STATISTICS_update (GDS_stats,
-                              "# Invalid REPLIES matched against routing table",
-                              1,
-                              GNUNET_NO);
-    return GNUNET_OK;
   case GNUNET_BLOCK_REPLY_IRRELEVANT:
     GNUNET_STATISTICS_update (GDS_stats,
                               "# Irrelevant REPLIES matched against routing table",
@@ -325,6 +336,7 @@ try_combine_recent (void *cls,
  *
  * @param sender peer that originated the request
  * @param type type of the block
+ * @param[in] bg block group for filtering duplicate replies
  * @param options options for processing
  * @param key key for the content
  * @param xquery extended query
diff --git a/src/dht/plugin_block_dht.c b/src/dht/plugin_block_dht.c
index 7c6fb9ed6..3dd3dd792 100644
--- a/src/dht/plugin_block_dht.c
+++ b/src/dht/plugin_block_dht.c
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet
-     Copyright (C) 2010, 2017 GNUnet e.V.
+     Copyright (C) 2010, 2017, 2022 GNUnet e.V.
 
      GNUnet is free software: you can redistribute it and/or modify it
      under the terms of the GNU Affero General Public License as published
@@ -28,6 +28,7 @@
 #include "platform.h"
 #include "gnunet_constants.h"
 #include "gnunet_hello_lib.h"
+#include "gnunet_hello_uri_lib.h"
 #include "gnunet_block_plugin.h"
 #include "gnunet_block_group_lib.h"
 
@@ -89,80 +90,9 @@ block_plugin_dht_create_group (void *cls,
 
 
 /**
- * Function called to validate a reply or a request.  For
- * request evaluation, simply pass "NULL" for the @a reply_block.
- *
- * @param cls closure
- * @param ctx context
- * @param type block type
- * @param group block group to check against
- * @param eo control flags
- * @param query original query (hash)
- * @param xquery extended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in @a xquery
- * @param reply_block response to validate
- * @param reply_block_size number of bytes in @a reply_block
- * @return characterization of result
- */
-static enum GNUNET_BLOCK_EvaluationResult
-block_plugin_dht_evaluate (void *cls,
-                           struct GNUNET_BLOCK_Context *ctx,
-                           enum GNUNET_BLOCK_Type type,
-                           struct GNUNET_BLOCK_Group *group,
-                           enum GNUNET_BLOCK_EvaluationOptions eo,
-                           const struct GNUNET_HashCode *query,
-                           const void *xquery,
-                           size_t xquery_size,
-                           const void *reply_block,
-                           size_t reply_block_size)
-{
-  const struct GNUNET_HELLO_Message *hello;
-  struct GNUNET_PeerIdentity pid;
-  const struct GNUNET_MessageHeader *msg;
-  struct GNUNET_HashCode phash;
-
-  if (type != GNUNET_BLOCK_TYPE_DHT_HELLO)
-    return GNUNET_BLOCK_EVALUATION_TYPE_NOT_SUPPORTED;
-  if (0 != xquery_size)
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_REQUEST_INVALID;
-  }
-  if (NULL == reply_block)
-    return GNUNET_BLOCK_EVALUATION_REQUEST_VALID;
-  if (reply_block_size < sizeof(struct GNUNET_MessageHeader))
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-  }
-  msg = reply_block;
-  if (reply_block_size != ntohs (msg->size))
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-  }
-  hello = reply_block;
-  if (GNUNET_OK != GNUNET_HELLO_get_id (hello, &pid))
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-  }
-  GNUNET_CRYPTO_hash (&pid,
-                      sizeof(pid),
-                      &phash);
-  if (GNUNET_YES ==
-      GNUNET_BLOCK_GROUP_bf_test_and_set (group,
-                                          &phash))
-    return GNUNET_BLOCK_EVALUATION_OK_DUPLICATE;
-  return GNUNET_BLOCK_EVALUATION_OK_MORE;
-}
-
-
-/**
  * Function called to validate a query.
  *
  * @param cls closure
- * @param ctx block context
  * @param type block type
  * @param query original query (hash)
  * @param xquery extrended query data (can be NULL, depending on type)
@@ -171,19 +101,31 @@ block_plugin_dht_evaluate (void *cls,
  */
 static enum GNUNET_GenericReturnValue
 block_plugin_dht_check_query (void *cls,
-                                    enum GNUNET_BLOCK_Type type,
-                                    const struct GNUNET_HashCode *query,
-                                    const void *xquery,
-                                    size_t xquery_size)
+                              enum GNUNET_BLOCK_Type type,
+                              const struct GNUNET_HashCode *query,
+                              const void *xquery,
+                              size_t xquery_size)
 {
-  if (type != GNUNET_BLOCK_TYPE_DHT_HELLO)
-    return GNUNET_SYSERR;
-  if (0 != xquery_size)
+  switch (type)
   {
-    GNUNET_break_op (0);
-    return GNUNET_NO;
+  case GNUNET_BLOCK_TYPE_DHT_HELLO:
+    if (0 != xquery_size)
+    {
+      GNUNET_break_op (0);
+      return GNUNET_NO;
+    }
+    return GNUNET_OK;
+  case GNUNET_BLOCK_TYPE_DHT_URL_HELLO:
+    if (0 != xquery_size)
+    {
+      GNUNET_break_op (0);
+      return GNUNET_NO;
+    }
+    return GNUNET_OK;
+  default:
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
   }
-  return GNUNET_OK;
 }
 
 
@@ -192,44 +134,71 @@ block_plugin_dht_check_query (void *cls,
  *
  * @param cls closure
  * @param type block type
- * @param query key for the block (hash), must match exactly
  * @param block block data to validate
  * @param block_size number of bytes in @a block
  * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
  */
 static enum GNUNET_GenericReturnValue
 block_plugin_dht_check_block (void *cls,
-                                    enum GNUNET_BLOCK_Type type,
-                                    const struct GNUNET_HashCode *query,
-                                    const void *block,
-                                    size_t block_size)
+                              enum GNUNET_BLOCK_Type type,
+                              const void *block,
+                              size_t block_size)
 {
-  const struct GNUNET_HELLO_Message *hello;
-  struct GNUNET_PeerIdentity pid;
-  const struct GNUNET_MessageHeader *msg;
-
-  if (type != GNUNET_BLOCK_TYPE_DHT_HELLO)
-    return GNUNET_SYSERR;
-  if (block_size < sizeof(struct GNUNET_MessageHeader))
-  {
-    GNUNET_break_op (0);
-    return GNUNET_NO;
-  }
-  msg = block;
-  if (block_size != ntohs (msg->size))
-  {
-    GNUNET_break_op (0);
-    return GNUNET_NO;
-  }
-  hello = block;
-  if (GNUNET_OK !=
-      GNUNET_HELLO_get_id (hello,
-                           &pid))
+  switch (type)
   {
-    GNUNET_break_op (0);
-    return GNUNET_NO;
+  case GNUNET_BLOCK_TYPE_DHT_HELLO:
+    {
+      const struct GNUNET_HELLO_Message *hello;
+      struct GNUNET_PeerIdentity pid;
+      const struct GNUNET_MessageHeader *msg;
+
+      if (block_size < sizeof(struct GNUNET_MessageHeader))
+      {
+        GNUNET_break_op (0);
+        return GNUNET_NO;
+      }
+      msg = block;
+      if (block_size != ntohs (msg->size))
+      {
+        GNUNET_break_op (0);
+        return GNUNET_NO;
+      }
+      hello = block;
+      if (GNUNET_OK !=
+          GNUNET_HELLO_get_id (hello,
+                               &pid))
+      {
+        GNUNET_break_op (0);
+        return GNUNET_NO;
+      }
+      return GNUNET_OK;
+    }
+  case GNUNET_BLOCK_TYPE_DHT_URL_HELLO:
+    {
+      struct GNUNET_HELLO_Builder *b;
+      struct GNUNET_PeerIdentity pid;
+      struct GNUNET_HashCode h_pid;
+
+      b = GNUNET_HELLO_builder_from_block (block,
+                                           block_size);
+      if (NULL == b)
+      {
+        GNUNET_break (0);
+        return GNUNET_NO;
+      }
+      GNUNET_HELLO_builder_iterate (b,
+                                    &pid,
+                                    NULL, NULL);
+      GNUNET_CRYPTO_hash (&pid,
+                          sizeof (pid),
+                          &h_pid);
+      GNUNET_HELLO_builder_free (b);
+      return GNUNET_OK;
+    }
+  default:
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
   }
-  return GNUNET_OK;
 }
 
 
@@ -251,49 +220,63 @@ block_plugin_dht_check_block (void *cls,
  */
 static enum GNUNET_BLOCK_ReplyEvaluationResult
 block_plugin_dht_check_reply (
-                                        void *cls,
-                                        enum GNUNET_BLOCK_Type type,
-                                    struct GNUNET_BLOCK_Group *group,
-                                    const struct GNUNET_HashCode *query,
-                                    const void *xquery,
-                                    size_t xquery_size,
-                                    const void *reply_block,
-                                    size_t reply_block_size)
+  void *cls,
+  enum GNUNET_BLOCK_Type type,
+  struct GNUNET_BLOCK_Group *group,
+  const struct GNUNET_HashCode *query,
+  const void *xquery,
+  size_t xquery_size,
+  const void *reply_block,
+  size_t reply_block_size)
 {
-  const struct GNUNET_HELLO_Message *hello;
-  struct GNUNET_PeerIdentity pid;
-  const struct GNUNET_MessageHeader *msg;
-  struct GNUNET_HashCode phash;
-
-  if (type != GNUNET_BLOCK_TYPE_DHT_HELLO)
-    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
-  if (reply_block_size < sizeof(struct GNUNET_MessageHeader))
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_REPLY_INVALID;
-  }
-  msg = reply_block;
-  if (reply_block_size != ntohs (msg->size))
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_REPLY_INVALID;
-  }
-  hello = reply_block;
-  if (GNUNET_OK !=
-      GNUNET_HELLO_get_id (hello,
-                           &pid))
+  switch (type)
   {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_REPLY_INVALID;
+  case GNUNET_BLOCK_TYPE_DHT_HELLO:
+    {
+      const struct GNUNET_MessageHeader *msg = reply_block;
+      const struct GNUNET_HELLO_Message *hello = reply_block;
+      struct GNUNET_PeerIdentity pid;
+      struct GNUNET_HashCode phash;
+
+      GNUNET_assert (reply_block_size >= sizeof(struct GNUNET_MessageHeader));
+      GNUNET_assert (reply_block_size == ntohs (msg->size));
+      GNUNET_assert (GNUNET_OK ==
+                     GNUNET_HELLO_get_id (hello,
+                                          &pid));
+      GNUNET_CRYPTO_hash (&pid,
+                          sizeof(pid),
+                          &phash);
+      if (GNUNET_YES ==
+          GNUNET_BLOCK_GROUP_bf_test_and_set (group,
+                                              &phash))
+        return GNUNET_BLOCK_REPLY_OK_DUPLICATE;
+      return GNUNET_BLOCK_REPLY_OK_MORE;
+    }
+  case GNUNET_BLOCK_TYPE_DHT_URL_HELLO:
+    {
+      struct GNUNET_HELLO_Builder *b;
+      struct GNUNET_PeerIdentity pid;
+      struct GNUNET_HashCode h_pid;
+
+      b = GNUNET_HELLO_builder_from_block (reply_block,
+                                           reply_block_size);
+      GNUNET_assert (NULL != b);
+      GNUNET_HELLO_builder_iterate (b,
+                                    &pid,
+                                    NULL, NULL);
+      GNUNET_CRYPTO_hash (&pid,
+                          sizeof (pid),
+                          &h_pid);
+      GNUNET_HELLO_builder_free (b);
+      if (GNUNET_YES ==
+          GNUNET_BLOCK_GROUP_bf_test_and_set (group,
+                                              &h_pid))
+        return GNUNET_BLOCK_REPLY_OK_DUPLICATE;
+      return GNUNET_BLOCK_REPLY_OK_MORE;
+    }
+  default:
+    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
   }
-  GNUNET_CRYPTO_hash (&pid,
-                      sizeof(pid),
-                      &phash);
-  if (GNUNET_YES ==
-      GNUNET_BLOCK_GROUP_bf_test_and_set (group,
-                                          &phash))
-    return GNUNET_BLOCK_REPLY_OK_DUPLICATE;
-  return GNUNET_BLOCK_REPLY_OK_MORE;
 }
 
 
@@ -315,41 +298,76 @@ block_plugin_dht_get_key (void *cls,
                           size_t block_size,
                           struct GNUNET_HashCode *key)
 {
-  const struct GNUNET_MessageHeader *msg;
-  const struct GNUNET_HELLO_Message *hello;
-  struct GNUNET_PeerIdentity *pid;
-
-  if (type != GNUNET_BLOCK_TYPE_DHT_HELLO)
-    return GNUNET_SYSERR;
-  if (block_size < sizeof(struct GNUNET_MessageHeader))
+  switch (type)
   {
-    GNUNET_log_from (GNUNET_ERROR_TYPE_ERROR,
-                     "block-dht",
-                     _ ("Block not of type %u\n"),
-                     GNUNET_BLOCK_TYPE_DHT_HELLO);
-    return GNUNET_NO;
-  }
-  msg = block;
-  if (block_size != ntohs (msg->size))
-  {
-    GNUNET_log_from (GNUNET_ERROR_TYPE_ERROR,
-                     "block-dht",
-                     _ ("Size mismatch for block with type %u\n"),
-                     GNUNET_BLOCK_TYPE_DHT_HELLO);
-    return GNUNET_NO;
-  }
-  hello = block;
-  memset (key, 0, sizeof(*key));
-  pid = (struct GNUNET_PeerIdentity *) key;
-  if (GNUNET_OK != GNUNET_HELLO_get_id (hello, pid))
-  {
-    GNUNET_log_from (GNUNET_ERROR_TYPE_ERROR,
-                     "block-dht",
-                     _ ("Block of type %u is malformed\n"),
-                     GNUNET_BLOCK_TYPE_DHT_HELLO);
-    return GNUNET_NO;
+  case GNUNET_BLOCK_TYPE_DHT_HELLO:
+    {
+      const struct GNUNET_MessageHeader *msg;
+      const struct GNUNET_HELLO_Message *hello;
+      struct GNUNET_PeerIdentity *pid;
+
+      if (block_size < sizeof(struct GNUNET_MessageHeader))
+      {
+        GNUNET_break_op (0);
+        memset (key,
+                0,
+                sizeof (*key));
+        return GNUNET_OK;
+      }
+      msg = block;
+      if (block_size != ntohs (msg->size))
+      {
+        GNUNET_break_op (0);
+        memset (key,
+                0,
+                sizeof (*key));
+        return GNUNET_OK;
+      }
+      hello = block;
+      memset (key,
+              0,
+              sizeof(*key));
+      pid = (struct GNUNET_PeerIdentity *) key;
+      if (GNUNET_OK !=
+          GNUNET_HELLO_get_id (hello,
+                               pid))
+      {
+        GNUNET_break_op (0);
+        memset (key,
+                0,
+                sizeof (*key));
+        return GNUNET_OK;
+      }
+      return GNUNET_OK;
+    }
+  case GNUNET_BLOCK_TYPE_DHT_URL_HELLO:
+    {
+      struct GNUNET_HELLO_Builder *b;
+      struct GNUNET_PeerIdentity pid;
+
+      b = GNUNET_HELLO_builder_from_block (block,
+                                           block_size);
+      if (NULL == b)
+      {
+        GNUNET_break (0);
+        memset (key,
+                0,
+                sizeof (*key));
+        return GNUNET_OK;
+      }
+      GNUNET_HELLO_builder_iterate (b,
+                                    &pid,
+                                    NULL, NULL);
+      GNUNET_CRYPTO_hash (&pid,
+                          sizeof (pid),
+                          key);
+      GNUNET_HELLO_builder_free (b);
+      return GNUNET_OK;
+    }
+  default:
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
   }
-  return GNUNET_OK;
 }
 
 
@@ -361,12 +379,12 @@ libgnunet_plugin_block_dht_init (void *cls)
 {
   static enum GNUNET_BLOCK_Type types[] = {
     GNUNET_BLOCK_TYPE_DHT_HELLO,
+    GNUNET_BLOCK_TYPE_DHT_URL_HELLO,
     GNUNET_BLOCK_TYPE_ANY       /* end of list */
   };
   struct GNUNET_BLOCK_PluginFunctions *api;
 
   api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
-  api->evaluate = &block_plugin_dht_evaluate;
   api->get_key = &block_plugin_dht_get_key;
   api->check_query = &block_plugin_dht_check_query;
   api->check_block = &block_plugin_dht_check_block;
diff --git a/src/dht/test_dht_topo.c b/src/dht/test_dht_topo.c
index eb7e80d3b..4830ba629 100644
--- a/src/dht/test_dht_topo.c
+++ b/src/dht/test_dht_topo.c
@@ -326,7 +326,7 @@ timeout_cb (void *cls)
  *
  * @param cls closure with our 'struct GetOperation'
  * @param exp when will this value expire
- * @param key key of the result
+ * @param query query hash
  * @param get_path peers on reply path (or NULL if not recorded)
  * @param get_path_length number of entries in @a get_path
  * @param put_path peers on the PUT path (or NULL if not recorded)
@@ -338,7 +338,7 @@ timeout_cb (void *cls)
 static void
 dht_get_handler (void *cls,
                  struct GNUNET_TIME_Absolute exp,
-                 const struct GNUNET_HashCode *key,
+                 const struct GNUNET_HashCode *query,
                  const struct GNUNET_DHT_PathElement *get_path,
                  unsigned int get_path_length,
                  const struct GNUNET_DHT_PathElement *put_path,
@@ -359,8 +359,15 @@ dht_get_handler (void *cls,
     GNUNET_break (0);
     return;
   }
-  GNUNET_CRYPTO_hash (key,
-                      sizeof(*key),
+  if (0 != GNUNET_memcmp (query,
+                          &get_op->key))
+  {
+    /* exact search should only yield exact results */
+    GNUNET_break (0);
+    return;
+  }
+  GNUNET_CRYPTO_hash (query,
+                      sizeof(*query),
                       &want);
   if (0 != memcmp (&want,
                    data,
@@ -370,18 +377,21 @@ dht_get_handler (void *cls,
     return;
   }
   if (0 !=
-      GNUNET_DHT_verify_path (key,
-                              data,
+      GNUNET_DHT_verify_path (data,
                               size,
                               exp,
-                              get_path,
-                              get_path_length,
                               put_path,
                               put_path_length,
+                              get_path,
+                              get_path_length,
                               &get_op->me))
   {
+    GNUNET_break (0);
     GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                "Path signature verification failed!\n");
+                "Path signature (%u/%u) verification failed for peer %s!\n",
+                get_path_length,
+                put_path_length,
+                GNUNET_i2s (&get_op->me));
   }
   else
   {
diff --git a/src/dhtu/Makefile.am b/src/dhtu/Makefile.am
index 0e10721cd..ebffa9ecf 100644
--- a/src/dhtu/Makefile.am
+++ b/src/dhtu/Makefile.am
@@ -10,6 +10,10 @@ if USE_COVERAGE
   XLIBS = -lgcov
 endif
 
+pkgcfg_DATA = \
+  dhtu.conf
+
+
 plugin_LTLIBRARIES = \
   libgnunet_plugin_dhtu_gnunet.la \
   libgnunet_plugin_dhtu_ip.la
@@ -67,6 +71,9 @@ test_dhtu_ip_LDADD = \
 check_PROGRAMS = \
  test_dhtu_ip
 
+EXTRA_DIST = \
+  dhtu.conf
+
 if ENABLE_TEST_RUN
 AM_TESTS_ENVIRONMENT=export GNUNET_PREFIX=$${GNUNET_PREFIX:-@libdir@};export PATH=$${GNUNET_PREFIX:-@prefix@}/bin:$$PATH;unset XDG_DATA_HOME;unset XDG_CONFIG_HOME;
 TESTS = \
diff --git a/src/dhtu/dhtu.conf b/src/dhtu/dhtu.conf
new file mode 100644
index 000000000..ea5ade752
--- /dev/null
+++ b/src/dhtu/dhtu.conf
@@ -0,0 +1,7 @@
+[dhtu-gnunet]
+ENABLED = YES
+
+[dhtu-ip]
+ENABLED = NO
+NSE = 4
+UDP_PORT = 6666
diff --git a/src/dhtu/plugin_dhtu_gnunet.c b/src/dhtu/plugin_dhtu_gnunet.c
index 2163af941..b072be2be 100644
--- a/src/dhtu/plugin_dhtu_gnunet.c
+++ b/src/dhtu/plugin_dhtu_gnunet.c
@@ -70,11 +70,6 @@ struct GNUNET_DHTU_Source
 {
 
   /**
-   * Hash of @e pid, position of this peer in the DHT overlay.
-   */
-  struct GNUNET_DHTU_HashKey id;
-
-  /**
    * Application context for this source.
    */
   void *app_ctx;
@@ -125,11 +120,6 @@ struct GNUNET_DHTU_Target
   struct GNUNET_PeerIdentity pid;
 
   /**
-   * Hash of @e pid, position of this peer in the DHT overlay.
-   */
-  struct GNUNET_DHTU_HashKey id;
-
-  /**
    * Preference counter, length of the @a ph_head DLL.
    */
   unsigned int ph_count;
@@ -240,27 +230,26 @@ hello_offered_cb (void *cls)
  * Request creation of a session with a peer at the given @a address.
  *
  * @param cls closure (internal context for the plugin)
+ * @param pid target identity of the peer to connect to
  * @param address target address to connect to
  */
 static void
-ip_try_connect (void *cls,
-                const char *address)
+gnunet_try_connect (void *cls,
+                    const struct GNUNET_PeerIdentity *pid,
+                    const char *address)
 {
   struct Plugin *plugin = cls;
   struct GNUNET_HELLO_Message *hello = NULL;
   struct HelloHandle *hh;
   struct GNUNET_CRYPTO_EddsaPublicKey pubkey;
 
+  (void) pid; /* will be needed with future address URIs */
   if (GNUNET_OK !=
       GNUNET_HELLO_parse_uri (address,
                               &pubkey,
                               &hello,
                               &GPI_plugins_find))
-  {
-    GNUNET_break (0);
     return;
-  }
-
   hh = GNUNET_new (struct HelloHandle);
   hh->plugin = plugin;
   GNUNET_CONTAINER_DLL_insert (plugin->hh_head,
@@ -283,8 +272,8 @@ ip_try_connect (void *cls,
  * @param target connection to keep alive
  */
 static struct GNUNET_DHTU_PreferenceHandle *
-ip_hold (void *cls,
-         struct GNUNET_DHTU_Target *target)
+gnunet_hold (void *cls,
+             struct GNUNET_DHTU_Target *target)
 {
   struct Plugin *plugin = cls;
   struct GNUNET_DHTU_PreferenceHandle *ph;
@@ -312,7 +301,7 @@ ip_hold (void *cls,
  * @param target connection to keep alive
  */
 static void
-ip_drop (struct GNUNET_DHTU_PreferenceHandle *ph)
+gnunet_drop (struct GNUNET_DHTU_PreferenceHandle *ph)
 {
   struct GNUNET_DHTU_Target *target = ph->target;
   struct Plugin *plugin = target->plugin;
@@ -350,12 +339,12 @@ ip_drop (struct GNUNET_DHTU_PreferenceHandle *ph)
  * @param finished_cb_cls closure for @a finished_cb
  */
 static void
-ip_send (void *cls,
-         struct GNUNET_DHTU_Target *target,
-         const void *msg,
-         size_t msg_size,
-         GNUNET_SCHEDULER_TaskCallback finished_cb,
-         void *finished_cb_cls)
+gnunet_send (void *cls,
+             struct GNUNET_DHTU_Target *target,
+             const void *msg,
+             size_t msg_size,
+             GNUNET_SCHEDULER_TaskCallback finished_cb,
+             void *finished_cb_cls)
 {
   struct GNUNET_MQ_Envelope *env;
   struct GNUNET_MessageHeader *cmsg;
@@ -394,12 +383,9 @@ core_connect_cb (void *cls,
   target->plugin = plugin;
   target->mq = mq;
   target->pid = *peer;
-  GNUNET_CRYPTO_hash (peer,
-                      sizeof (*peer),
-                      &target->id.sha512);
   plugin->env->connect_cb (plugin->env->cls,
                            target,
-                           &target->id,
+                           &target->pid,
                            &target->app_ctx);
   return target;
 }
@@ -461,11 +447,7 @@ peerinfo_cb (void *cls,
                                    &GPI_plugins_find);
   if (NULL == addr)
     return;
-  GNUNET_CRYPTO_hash (peer,
-                      sizeof (*peer),
-                      &plugin->src.id.sha512);
   plugin->env->address_add_cb (plugin->env->cls,
-                               &plugin->src.id,
                                addr,
                                &plugin->src,
                                &plugin->src.app_ctx);
@@ -584,6 +566,10 @@ libgnunet_plugin_dhtu_gnunet_done (void *cls)
   }
   if (NULL != plugin->nse)
     GNUNET_NSE_disconnect (plugin->nse);
+  plugin->env->network_size_cb (plugin->env->cls,
+                                GNUNET_TIME_UNIT_FOREVER_ABS,
+                                0.0,
+                                0.0);
   if (NULL != plugin->core)
     GNUNET_CORE_disconnect (plugin->core);
   if (NULL != plugin->ats)
@@ -604,7 +590,7 @@ libgnunet_plugin_dhtu_gnunet_done (void *cls)
  * @return the plugin's API
  */
 void *
-libgnunet_plugin_dhtu_ip_init (void *cls)
+libgnunet_plugin_dhtu_gnunet_init (void *cls)
 {
   struct GNUNET_DHTU_PluginEnvironment *env = cls;
   struct GNUNET_DHTU_PluginFunctions *api;
@@ -621,10 +607,10 @@ libgnunet_plugin_dhtu_ip_init (void *cls)
   plugin->env = env;
   api = GNUNET_new (struct GNUNET_DHTU_PluginFunctions);
   api->cls = plugin;
-  api->try_connect = &ip_try_connect;
-  api->hold = &ip_hold;
-  api->drop = &ip_drop;
-  api->send = &ip_send;
+  api->try_connect = &gnunet_try_connect;
+  api->hold = &gnunet_hold;
+  api->drop = &gnunet_drop;
+  api->send = &gnunet_send;
   plugin->ats = GNUNET_ATS_connectivity_init (env->cfg);
   plugin->core = GNUNET_CORE_connect (env->cfg,
                                       plugin,
@@ -640,6 +626,7 @@ libgnunet_plugin_dhtu_ip_init (void *cls)
        (NULL == plugin->nse) )
   {
     GNUNET_break (0);
+    GNUNET_free (api);
     libgnunet_plugin_dhtu_gnunet_done (plugin);
     return NULL;
   }
diff --git a/src/dhtu/plugin_dhtu_ip.c b/src/dhtu/plugin_dhtu_ip.c
index 8eec6294b..612d2c119 100644
--- a/src/dhtu/plugin_dhtu_ip.c
+++ b/src/dhtu/plugin_dhtu_ip.c
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet
-     Copyright (C) 2021 GNUnet e.V.
+     Copyright (C) 2021, 2022 GNUnet e.V.
 
      GNUnet is free software: you can redistribute it and/or modify it
      under the terms of the GNU Affero General Public License as published
@@ -56,17 +56,12 @@ struct GNUNET_DHTU_Source
   struct GNUNET_DHTU_Source *prev;
 
   /**
-   * Position of this peer in the DHT.
-   */
-  struct GNUNET_DHTU_HashKey id;
-
-  /**
    * Application context for this source.
    */
   void *app_ctx;
 
   /**
-   * Address in URL form ("ip+udp://$IP:$PORT")
+   * Address in URL form ("ip+udp://$PID/$IP:$PORT")
    */
   char *address;
 
@@ -121,9 +116,9 @@ struct GNUNET_DHTU_Target
   struct GNUNET_DHTU_PreferenceHandle *ph_tail;
 
   /**
-   * Position of this peer in the DHT.
+   * Peer's identity.
    */
-  struct GNUNET_DHTU_HashKey id;
+  struct GNUNET_PeerIdentity pid;
 
   /**
    * Target IP address.
@@ -217,14 +212,24 @@ struct Plugin
   char *port;
 
   /**
+   * My UDP socket.
+   */
+  struct GNUNET_NETWORK_Handle *sock;
+
+  /**
+   * My identity.
+   */
+  struct GNUNET_PeerIdentity my_id;
+
+  /**
    * How often have we scanned for IPs?
    */
   unsigned int scan_generation;
 
   /**
-   * My UDP socket.
+   * Port as a 16-bit value.
    */
-  struct GNUNET_NETWORK_Handle *sock;
+  uint16_t port16;
 };
 
 
@@ -232,18 +237,20 @@ struct Plugin
  * Create a target to which we may send traffic.
  *
  * @param plugin our plugin
+ * @param pid presumed identity of the target
  * @param addr target address
  * @param addrlen number of bytes in @a addr
  * @return new target object
  */
 static struct GNUNET_DHTU_Target *
 create_target (struct Plugin *plugin,
+               const struct GNUNET_PeerIdentity *pid,
                const struct sockaddr *addr,
                socklen_t addrlen)
 {
   struct GNUNET_DHTU_Target *dst;
 
-  if (MAX_DESTS >
+  if (MAX_DESTS <=
       GNUNET_CONTAINER_multihashmap_size (plugin->dsts))
   {
     struct GNUNET_HashCode key;
@@ -275,42 +282,16 @@ create_target (struct Plugin *plugin,
   }
   dst = GNUNET_new (struct GNUNET_DHTU_Target);
   dst->addrlen = addrlen;
+  dst->pid = *pid;
   memcpy (&dst->addr,
           addr,
           addrlen);
-  switch (addr->sa_family)
-  {
-  case AF_INET:
-    {
-      const struct sockaddr_in *s4 = (const struct sockaddr_in *) addr;
-
-      GNUNET_assert (sizeof (struct sockaddr_in) == addrlen);
-      GNUNET_CRYPTO_hash (&s4->sin_addr,
-                          sizeof (struct in_addr),
-                          &dst->id.sha512);
-    }
-    break;
-  case AF_INET6:
-    {
-      const struct sockaddr_in6 *s6 = (const struct sockaddr_in6 *) addr;
-
-      GNUNET_assert (sizeof (struct sockaddr_in6) == addrlen);
-      GNUNET_CRYPTO_hash (&s6->sin6_addr,
-                          sizeof (struct in6_addr),
-                          &dst->id.sha512);
-    }
-    break;
-  default:
-    GNUNET_break (0);
-    GNUNET_free (dst);
-    return NULL;
-  }
   GNUNET_CONTAINER_DLL_insert (plugin->dst_head,
                                plugin->dst_tail,
                                dst);
   plugin->env->connect_cb (plugin->env->cls,
                            dst,
-                           &dst->id,
+                           &dst->pid,
                            &dst->app_ctx);
   return dst;
 }
@@ -321,6 +302,7 @@ create_target (struct Plugin *plugin,
  * create one!
  *
  * @param plugin the plugin handle
+ * @param pid presumed identity of the target
  * @param src source target is from, or NULL if unknown
  * @param addr socket address to find
  * @param addrlen number of bytes in @a addr
@@ -328,6 +310,7 @@ create_target (struct Plugin *plugin,
  */
 static struct GNUNET_DHTU_Target *
 find_target (struct Plugin *plugin,
+             const struct GNUNET_PeerIdentity *pid,
              const void *addr,
              size_t addrlen)
 {
@@ -342,6 +325,7 @@ find_target (struct Plugin *plugin,
   if (NULL == dst)
   {
     dst = create_target (plugin,
+                         pid,
                          (const struct sockaddr *) addr,
                          addrlen);
     GNUNET_assert (GNUNET_YES ==
@@ -370,10 +354,12 @@ find_target (struct Plugin *plugin,
  * Request creation of a session with a peer at the given @a address.
  *
  * @param cls closure (internal context for the plugin)
+ * @param pid identity of the target peer
  * @param address target address to connect to
  */
 static void
 ip_try_connect (void *cls,
+                const struct GNUNET_PeerIdentity *pid,
                 const char *address)
 {
   struct Plugin *plugin = cls;
@@ -389,19 +375,13 @@ ip_try_connect (void *cls,
       strncmp (address,
                "ip+",
                strlen ("ip+")))
-  {
-    GNUNET_break (0);
     return;
-  }
   address += strlen ("ip+");
   if (0 !=
       strncmp (address,
                "udp://",
                strlen ("udp://")))
-  {
-    GNUNET_break (0);
     return;
-  }
   address += strlen ("udp://");
   addr = GNUNET_strdup (address);
   colon = strchr (addr, ':');
@@ -426,6 +406,7 @@ ip_try_connect (void *cls,
   }
   GNUNET_free (addr);
   (void) find_target (plugin,
+                      pid,
                       result->ai_addr,
                       result->ai_addrlen);
   freeaddrinfo (result);
@@ -499,10 +480,17 @@ ip_send (void *cls,
          void *finished_cb_cls)
 {
   struct Plugin *plugin = cls;
-
+  char buf[sizeof (plugin->my_id) + msg_size];
+
+  memcpy (buf,
+          &plugin->my_id,
+          sizeof (plugin->my_id));
+  memcpy (&buf[sizeof (plugin->my_id)],
+          msg,
+          msg_size);
   GNUNET_NETWORK_socket_sendto (plugin->sock,
-                                msg,
-                                msg_size,
+                                buf,
+                                sizeof (buf),
                                 (const struct sockaddr *) &target->addr,
                                 target->addrlen);
   finished_cb (finished_cb_cls);
@@ -538,9 +526,6 @@ create_source (struct Plugin *plugin,
       char buf[INET_ADDRSTRLEN];
 
       GNUNET_assert (sizeof (struct sockaddr_in) == addrlen);
-      GNUNET_CRYPTO_hash (&s4->sin_addr,
-                          sizeof (struct in_addr),
-                          &src->id.sha512);
       GNUNET_asprintf (&src->address,
                        "ip+udp://%s:%u",
                        inet_ntop (AF_INET,
@@ -556,9 +541,6 @@ create_source (struct Plugin *plugin,
       char buf[INET6_ADDRSTRLEN];
 
       GNUNET_assert (sizeof (struct sockaddr_in6) == addrlen);
-      GNUNET_CRYPTO_hash (&s6->sin6_addr,
-                          sizeof (struct in6_addr),
-                          &src->id.sha512);
       GNUNET_asprintf (&src->address,
                        "ip+udp://[%s]:%u",
                        inet_ntop (AF_INET6,
@@ -577,7 +559,6 @@ create_source (struct Plugin *plugin,
                                plugin->src_tail,
                                src);
   plugin->env->address_add_cb (plugin->env->cls,
-                               &src->id,
                                src->address,
                                src,
                                &src->app_ctx);
@@ -586,6 +567,101 @@ create_source (struct Plugin *plugin,
 
 
 /**
+ * Compare two addresses excluding the ports for equality. Only compares IP
+ * address. Must only be called on AF_INET or AF_INET6 addresses.
+ *
+ * @param a1 address to compare
+ * @param a2 address to compare
+ * @param alen number of bytes in @a a1 and @a a2
+ * @return 0 if @a a1 == @a a2.
+ */
+static int
+addrcmp_np (const struct sockaddr *a1,
+            const struct sockaddr *a2,
+            size_t alen)
+{
+  GNUNET_assert (a1->sa_family == a2->sa_family);
+  switch (a1->sa_family)
+  {
+  case AF_INET:
+    GNUNET_assert (sizeof (struct sockaddr_in) == alen);
+    {
+      const struct sockaddr_in *s1 = (const struct sockaddr_in *) a1;
+      const struct sockaddr_in *s2 = (const struct sockaddr_in *) a2;
+
+      if (s1->sin_addr.s_addr != s2->sin_addr.s_addr)
+        return 1;
+      break;
+    }
+  case AF_INET6:
+    GNUNET_assert (sizeof (struct sockaddr_in6) == alen);
+    {
+      const struct sockaddr_in6 *s1 = (const struct sockaddr_in6 *) a1;
+      const struct sockaddr_in6 *s2 = (const struct sockaddr_in6 *) a2;
+
+      if (0 != GNUNET_memcmp (&s1->sin6_addr,
+                              &s2->sin6_addr))
+        return 1;
+      break;
+    }
+  default:
+    GNUNET_assert (0);
+  }
+  return 0;
+}
+
+
+/**
+ * Compare two addresses for equality. Only
+ * compares IP address and port. Must only be
+ * called on AF_INET or AF_INET6 addresses.
+ *
+ * @param a1 address to compare
+ * @param a2 address to compare
+ * @param alen number of bytes in @a a1 and @a a2
+ * @return 0 if @a a1 == @a a2.
+ */
+static int
+addrcmp (const struct sockaddr *a1,
+         const struct sockaddr *a2,
+         size_t alen)
+{
+  GNUNET_assert (a1->sa_family == a2->sa_family);
+  switch (a1->sa_family)
+  {
+  case AF_INET:
+    GNUNET_assert (sizeof (struct sockaddr_in) == alen);
+    {
+      const struct sockaddr_in *s1 = (const struct sockaddr_in *) a1;
+      const struct sockaddr_in *s2 = (const struct sockaddr_in *) a2;
+
+      if (s1->sin_port != s2->sin_port)
+        return 1;
+      if (s1->sin_addr.s_addr != s2->sin_addr.s_addr)
+        return 1;
+      break;
+    }
+  case AF_INET6:
+    GNUNET_assert (sizeof (struct sockaddr_in6) == alen);
+    {
+      const struct sockaddr_in6 *s1 = (const struct sockaddr_in6 *) a1;
+      const struct sockaddr_in6 *s2 = (const struct sockaddr_in6 *) a2;
+
+      if (s1->sin6_port != s2->sin6_port)
+        return 1;
+      if (0 != GNUNET_memcmp (&s1->sin6_addr,
+                              &s2->sin6_addr))
+        return 1;
+      break;
+    }
+  default:
+    GNUNET_assert (0);
+  }
+  return 0;
+}
+
+
+/**
  * Callback function invoked for each interface found.
  *
  * @param cls closure
@@ -597,7 +673,7 @@ create_source (struct Plugin *plugin,
  * @param addrlen length of the address
  * @return #GNUNET_OK to continue iteration, #GNUNET_SYSERR to abort
  */
-static int
+static enum GNUNET_GenericReturnValue
 process_ifcs (void *cls,
               const char *name,
               int isDefault,
@@ -614,17 +690,45 @@ process_ifcs (void *cls,
        src = src->next)
   {
     if ( (addrlen == src->addrlen) &&
-         (0 == memcmp (addr,
-                       &src->addr,
-                       addrlen)) )
+         (0 == addrcmp_np (addr,
+                           (const struct sockaddr *) &src->addr,
+                           addrlen)) )
     {
       src->scan_generation = plugin->scan_generation;
       return GNUNET_OK;
     }
   }
-  (void) create_source (plugin,
-                        addr,
-                        addrlen);
+  switch (addr->sa_family)
+  {
+  case AF_INET:
+    {
+      struct sockaddr_in v4;
+
+      GNUNET_assert (sizeof(v4) == addrlen);
+      memcpy (&v4,
+              addr,
+              addrlen);
+      v4.sin_port = htons (plugin->port16);
+      (void) create_source (plugin,
+                            (const struct sockaddr *) &v4,
+                            sizeof (v4));
+      break;
+    }
+  case AF_INET6:
+    {
+      struct sockaddr_in6 v6;
+
+      GNUNET_assert (sizeof(v6) == addrlen);
+      memcpy (&v6,
+              addr,
+              addrlen);
+      v6.sin6_port = htons (plugin->port16);
+      (void) create_source (plugin,
+                            (const struct sockaddr *) &v6,
+                            sizeof (v6));
+      break;
+    }
+  }
   return GNUNET_OK;
 }
 
@@ -648,7 +752,7 @@ scan (void *cls)
        src = next)
   {
     next = src->next;
-    if (src->scan_generation == plugin->scan_generation)
+    if (src->scan_generation >= plugin->scan_generation)
       continue;
     GNUNET_CONTAINER_DLL_remove (plugin->src_head,
                                  plugin->src_tail,
@@ -682,9 +786,9 @@ find_source (struct Plugin *plugin,
        src = src->next)
   {
     if ( (addrlen == src->addrlen) &&
-         (0 == memcmp (addr,
-                       &src->addr,
-                       addrlen)) )
+         (0 == addrcmp (addr,
+                        (const struct sockaddr *) &src->addr,
+                        addrlen)) )
       return src;
   }
 
@@ -704,7 +808,8 @@ read_cb (void *cls)
 {
   struct Plugin *plugin = cls;
   ssize_t ret;
-  char buf[65536];
+  const struct GNUNET_PeerIdentity *pid;
+  char buf[65536] GNUNET_ALIGN;
   struct sockaddr_storage sa;
   struct iovec iov = {
     .iov_base = buf,
@@ -719,98 +824,120 @@ read_cb (void *cls)
     .msg_control = ctl,
     .msg_controllen = sizeof (ctl)
   };
+  struct GNUNET_DHTU_Target *dst = NULL;
+  struct GNUNET_DHTU_Source *src = NULL;
 
   ret = recvmsg  (GNUNET_NETWORK_get_fd (plugin->sock),
                   &mh,
                   MSG_DONTWAIT);
-  if (ret >= 0)
+  plugin->read_task = GNUNET_SCHEDULER_add_read_net (
+    GNUNET_TIME_UNIT_FOREVER_REL,
+    plugin->sock,
+    &read_cb,
+    plugin);
+  if (ret < 0)
+    return; /* read failure, hopefully EAGAIN */
+  if (ret < sizeof (*pid))
+  {
+    GNUNET_break_op (0);
+    return;
+  }
+  /* find IP where we received message */
+  for (struct cmsghdr *cmsg = CMSG_FIRSTHDR (&mh);
+       NULL != cmsg;
+       cmsg = CMSG_NXTHDR (&mh,
+                           cmsg))
   {
-    struct GNUNET_DHTU_Target *dst = NULL;
-    struct GNUNET_DHTU_Source *src = NULL;
-    struct cmsghdr *cmsg;
-
-    /* find IP where we received message */
-    for (cmsg = CMSG_FIRSTHDR (&mh);
-         NULL != cmsg;
-         cmsg = CMSG_NXTHDR (&mh,
-                             cmsg))
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                "Got CMSG level %u (%d/%d), type %u (%d/%d)\n",
+                cmsg->cmsg_level,
+                (cmsg->cmsg_level == IPPROTO_IP),
+                (cmsg->cmsg_level == IPPROTO_IPV6),
+                cmsg->cmsg_type,
+                (cmsg->cmsg_type == IP_PKTINFO),
+                (cmsg->cmsg_type == IPV6_PKTINFO));
+    if ( (cmsg->cmsg_level == IPPROTO_IP) &&
+         (cmsg->cmsg_type == IP_PKTINFO) )
     {
-      if ( (cmsg->cmsg_level == IPPROTO_IP) &&
-           (cmsg->cmsg_type == IP_PKTINFO) )
+      if (CMSG_LEN (sizeof (struct in_pktinfo)) ==
+          cmsg->cmsg_len)
       {
-        if (CMSG_LEN (sizeof (struct in_pktinfo)) ==
-            cmsg->cmsg_len)
+        struct in_pktinfo pi;
+
+        memcpy (&pi,
+                CMSG_DATA (cmsg),
+                sizeof (pi));
         {
-          struct in_pktinfo pi;
-
-          memcpy (&pi,
-                  CMSG_DATA (cmsg),
-                  sizeof (pi));
-          {
-            struct sockaddr_in sa = {
-              .sin_family = AF_INET,
-              .sin_addr = pi.ipi_addr
-            };
-
-            src = find_source (plugin,
-                               &sa,
-                               sizeof (sa));
-          }
-          break;
+          struct sockaddr_in sa = {
+            .sin_family = AF_INET,
+            .sin_addr = pi.ipi_addr,
+            .sin_port = htons (plugin->port16)
+          };
+
+          src = find_source (plugin,
+                             &sa,
+                             sizeof (sa));
+          /* For sources we discovered by reading,
+             force the generation far into the future */
+          src->scan_generation = plugin->scan_generation + 60;
         }
-        else
-          GNUNET_break (0);
+        break;
       }
-      if ( (cmsg->cmsg_level == IPPROTO_IPV6) &&
-           (cmsg->cmsg_type == IPV6_RECVPKTINFO) )
+      else
+        GNUNET_break (0);
+    }
+    if ( (cmsg->cmsg_level == IPPROTO_IPV6) &&
+         (cmsg->cmsg_type == IPV6_PKTINFO) )
+    {
+      if (CMSG_LEN (sizeof (struct in6_pktinfo)) ==
+          cmsg->cmsg_len)
       {
-        if (CMSG_LEN (sizeof (struct in6_pktinfo)) ==
-            cmsg->cmsg_len)
+        struct in6_pktinfo pi;
+
+        memcpy (&pi,
+                CMSG_DATA (cmsg),
+                sizeof (pi));
         {
-          struct in6_pktinfo pi;
-
-          memcpy (&pi,
-                  CMSG_DATA (cmsg),
-                  sizeof (pi));
-          {
-            struct sockaddr_in6 sa = {
-              .sin6_family = AF_INET6,
-              .sin6_addr = pi.ipi6_addr,
-              .sin6_scope_id = pi.ipi6_ifindex
-            };
-
-            src = find_source (plugin,
-                               &sa,
-                               sizeof (sa));
-            break;
-          }
+          struct sockaddr_in6 sa = {
+            .sin6_family = AF_INET6,
+            .sin6_addr = pi.ipi6_addr,
+            .sin6_port = htons (plugin->port16),
+            .sin6_scope_id = pi.ipi6_ifindex
+          };
+
+          src = find_source (plugin,
+                             &sa,
+                             sizeof (sa));
+          /* For sources we discovered by reading,
+             force the generation far into the future */
+          src->scan_generation = plugin->scan_generation + 60;
+          break;
         }
-        else
-          GNUNET_break (0);
       }
-    }
-    dst = find_target (plugin,
-                       &sa,
-                       mh.msg_namelen);
-    if ( (NULL == src) ||
-         (NULL == dst) )
-    {
-      GNUNET_break (0);
-    }
-    else
-    {
-      plugin->env->receive_cb (plugin->env->cls,
-                               dst->app_ctx,
-                               src->app_ctx,
-                               buf,
-                               ret);
+      else
+        GNUNET_break (0);
     }
   }
-  plugin->read_task = GNUNET_SCHEDULER_add_read_net (
-    GNUNET_TIME_UNIT_FOREVER_REL,
-    plugin->sock,
-    &read_cb,
-    plugin);
+  if (NULL == src)
+  {
+    GNUNET_break (0);
+    return;
+  }
+  pid = (const struct GNUNET_PeerIdentity *) buf;
+  dst = find_target (plugin,
+                     pid,
+                     &sa,
+                     mh.msg_namelen);
+  if (NULL == dst)
+  {
+    GNUNET_break (0);
+    return;
+  }
+  plugin->env->receive_cb (plugin->env->cls,
+                           &dst->app_ctx,
+                           &src->app_ctx,
+                           &buf[sizeof(*pid)],
+                           ret - sizeof (*pid));
 }
 
 
@@ -874,6 +1001,14 @@ libgnunet_plugin_dhtu_ip_init (void *cls)
   plugin = GNUNET_new (struct Plugin);
   plugin->env = env;
   plugin->port = port;
+  plugin->port16 = (uint16_t) nport;
+  if (GNUNET_OK !=
+      GNUNET_CRYPTO_get_peer_identity (env->cfg,
+                                       &plugin->my_id))
+  {
+    GNUNET_free (plugin);
+    return NULL;
+  }
   af = AF_INET6;
   sock = socket (af,
                  SOCK_DGRAM,
@@ -1017,9 +1152,18 @@ libgnunet_plugin_dhtu_ip_done (void *cls)
     GNUNET_free (src->address);
     GNUNET_free (src);
   }
+  plugin->env->network_size_cb (plugin->env->cls,
+                                GNUNET_TIME_UNIT_FOREVER_ABS,
+                                0.0,
+                                0.0);
   GNUNET_CONTAINER_multihashmap_destroy (plugin->dsts);
+  if (NULL != plugin->read_task)
+  {
+    GNUNET_SCHEDULER_cancel (plugin->read_task);
+    plugin->read_task = NULL;
+  }
   GNUNET_SCHEDULER_cancel (plugin->scan_task);
-  GNUNET_break (0 ==
+  GNUNET_break (GNUNET_OK ==
                 GNUNET_NETWORK_socket_close (plugin->sock));
   GNUNET_free (plugin->port);
   GNUNET_free (plugin);
diff --git a/src/dns/plugin_block_dns.c b/src/dns/plugin_block_dns.c
index d3eb7d2b9..a596beb28 100644
--- a/src/dns/plugin_block_dns.c
+++ b/src/dns/plugin_block_dns.c
@@ -90,93 +90,6 @@ block_plugin_dns_create_group (void *cls,
 
 
 /**
- * Function called to validate a reply or a request.  For
- * request evaluation, simply pass "NULL" for the reply_block.
- *
- * @param cls closure
- * @param ctx block context
- * @param type block type
- * @param bg group to evaluate against
- * @param eo control flags
- * @param query original query (hash)
- * @param xquery extended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in @a xquery
- * @param reply_block response to validate
- * @param reply_block_size number of bytes in @a reply_block
- * @return characterization of result
- */
-static enum GNUNET_BLOCK_EvaluationResult
-block_plugin_dns_evaluate (void *cls,
-                           struct GNUNET_BLOCK_Context *ctx,
-                           enum GNUNET_BLOCK_Type type,
-                           struct GNUNET_BLOCK_Group *bg,
-                           enum GNUNET_BLOCK_EvaluationOptions eo,
-                           const struct GNUNET_HashCode *query,
-                           const void *xquery,
-                           size_t xquery_size,
-                           const void *reply_block,
-                           size_t reply_block_size)
-{
-  const struct GNUNET_DNS_Advertisement *ad;
-  struct GNUNET_HashCode phash;
-
-  switch (type)
-  {
-  case GNUNET_BLOCK_TYPE_DNS:
-    if (0 != xquery_size)
-      return GNUNET_BLOCK_EVALUATION_REQUEST_INVALID;
-
-    if (NULL == reply_block)
-      return GNUNET_BLOCK_EVALUATION_REQUEST_VALID;
-
-    if (sizeof(struct GNUNET_DNS_Advertisement) != reply_block_size)
-    {
-      GNUNET_break_op (0);
-      return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-    }
-    ad = reply_block;
-
-    if (ntohl (ad->purpose.size) !=
-        sizeof(struct GNUNET_DNS_Advertisement)
-        - sizeof(struct GNUNET_CRYPTO_EddsaSignature))
-    {
-      GNUNET_break_op (0);
-      return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-    }
-    if (0 ==
-        GNUNET_TIME_absolute_get_remaining (GNUNET_TIME_absolute_ntoh
-                                              (ad->expiration_time)).
-        rel_value_us)
-    {
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  "DNS advertisement has expired\n");
-      return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-    }
-    if (GNUNET_OK !=
-        GNUNET_CRYPTO_eddsa_verify_ (GNUNET_SIGNATURE_PURPOSE_DNS_RECORD,
-                                     &ad->purpose,
-                                     &ad->signature,
-                                     &ad->peer.public_key))
-    {
-      GNUNET_break_op (0);
-      return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-    }
-    GNUNET_CRYPTO_hash (reply_block,
-                        reply_block_size,
-                        &phash);
-    if (GNUNET_YES ==
-        GNUNET_BLOCK_GROUP_bf_test_and_set (bg,
-                                            &phash))
-      return GNUNET_BLOCK_EVALUATION_OK_DUPLICATE;
-    return GNUNET_BLOCK_EVALUATION_OK_MORE;
-
-  default:
-    return GNUNET_BLOCK_EVALUATION_TYPE_NOT_SUPPORTED;
-  }
-}
-
-
-/**
  * Function called to validate a query.
  *
  * @param cls closure
@@ -198,9 +111,13 @@ block_plugin_dns_check_query (void *cls,
   {
   case GNUNET_BLOCK_TYPE_DNS:
     if (0 != xquery_size)
-      return GNUNET_NO;
+      {
+        GNUNET_break_op (0);
+        return GNUNET_NO;
+      }
     return GNUNET_OK;
   default:
+    GNUNET_break (0);
     return GNUNET_SYSERR;
   }
 }
@@ -211,17 +128,15 @@ block_plugin_dns_check_query (void *cls,
  *
  * @param cls closure
  * @param type block type
- * @param query key for the block (hash), must match exactly
  * @param block block data to validate
  * @param block_size number of bytes in @a block
  * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
  */
 static enum GNUNET_GenericReturnValue
 block_plugin_dns_check_block (void *cls,
-                                    enum GNUNET_BLOCK_Type type,
-                                    const struct GNUNET_HashCode *query,
-                                    const void *block,
-                                    size_t block_size)
+                              enum GNUNET_BLOCK_Type type,
+                              const void *block,
+                              size_t block_size)
 {
   const struct GNUNET_DNS_Advertisement *ad;
 
@@ -260,6 +175,7 @@ block_plugin_dns_check_block (void *cls,
     }
     return GNUNET_OK;
   default:
+    GNUNET_break (0);
     return GNUNET_SYSERR;
   }
 }
@@ -283,14 +199,14 @@ block_plugin_dns_check_block (void *cls,
  */
 static enum GNUNET_BLOCK_ReplyEvaluationResult
 block_plugin_dns_check_reply (
-                                   void *cls,
-                                   enum GNUNET_BLOCK_Type type,
-                                    struct GNUNET_BLOCK_Group *group,
-                                    const struct GNUNET_HashCode *query,
-                                    const void *xquery,
-                                    size_t xquery_size,
-                                    const void *reply_block,
-                                    size_t reply_block_size)
+                              void *cls,
+                              enum GNUNET_BLOCK_Type type,
+                              struct GNUNET_BLOCK_Group *group,
+                              const struct GNUNET_HashCode *query,
+                              const void *xquery,
+                              size_t xquery_size,
+                              const void *reply_block,
+                              size_t reply_block_size)
 {
   struct GNUNET_HashCode phash;
 
@@ -306,6 +222,7 @@ block_plugin_dns_check_reply (
       return GNUNET_BLOCK_REPLY_OK_DUPLICATE;
     return GNUNET_BLOCK_REPLY_OK_MORE;
   default:
+    GNUNET_break (0);
     return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
   }
 }
@@ -329,8 +246,12 @@ block_plugin_dns_get_key (void *cls,
                           size_t block_size,
                           struct GNUNET_HashCode *key)
 {
-  /* we cannot extract a key from a block of this type */
-  return GNUNET_SYSERR;
+  if (GNUNET_BLOCK_TYPE_DNS != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_NO;
 }
 
 
@@ -347,7 +268,6 @@ libgnunet_plugin_block_dns_init (void *cls)
   struct GNUNET_BLOCK_PluginFunctions *api;
 
   api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
-  api->evaluate = &block_plugin_dns_evaluate;
   api->get_key = &block_plugin_dns_get_key;
   api->check_query = &block_plugin_dns_check_query;
   api->check_block = &block_plugin_dns_check_block;
diff --git a/src/fs/fs_file_information.c b/src/fs/fs_file_information.c
index 3324abd58..c5faa14d4 100644
--- a/src/fs/fs_file_information.c
+++ b/src/fs/fs_file_information.c
@@ -57,7 +57,7 @@ GNUNET_FS_file_information_get_id (struct GNUNET_FS_FileInformation *s)
  * @return "filename" field of the structure (can be NULL)
  */
 const char *
-GNUNET_FS_file_information_get_filename (struct GNUNET_FS_FileInformation *s)
+GNUNET_FS_file_information_get_filename (const struct GNUNET_FS_FileInformation *s)
 {
   return s->filename;
 }
diff --git a/src/fs/fs_uri.c b/src/fs/fs_uri.c
index 73ea5d60d..2d5566b54 100644
--- a/src/fs/fs_uri.c
+++ b/src/fs/fs_uri.c
@@ -653,18 +653,24 @@ GNUNET_FS_uri_parse (const char *uri, char **emsg)
       *emsg = GNUNET_strdup (_ ("invalid argument"));
     return NULL;
   }
-  if (NULL == emsg)
-    emsg = &msg;
-  *emsg = NULL;
-  if ((NULL != (ret = uri_chk_parse (uri, emsg))) ||
-      (NULL != (ret = uri_ksk_parse (uri, emsg))) ||
-      (NULL != (ret = uri_sks_parse (uri, emsg))) ||
-      (NULL != (ret = uri_loc_parse (uri, emsg))))
+  /**
+   * FIXME: Do we want to log this?
+   */
+  msg = NULL;
+  if (NULL != (ret = uri_chk_parse (uri, &msg)))
+    return ret;
+  GNUNET_free (msg);
+  if (NULL != (ret = uri_ksk_parse (uri, &msg)))
+    return ret;
+  GNUNET_free (msg);
+  if (NULL != (ret = uri_sks_parse (uri, &msg)))
+    return ret;
+  GNUNET_free (msg);
+  if (NULL != (ret = uri_loc_parse (uri, &msg)))
     return ret;
-  if (NULL == *emsg)
+  GNUNET_free (msg);
+  if (NULL != emsg)
     *emsg = GNUNET_strdup (_ ("Unrecognized URI type"));
-  if (emsg == &msg)
-    GNUNET_free (msg);
   return NULL;
 }
 
diff --git a/src/fs/gnunet-search.c b/src/fs/gnunet-search.c
index 3bf013650..7e2e4d2a6 100644
--- a/src/fs/gnunet-search.c
+++ b/src/fs/gnunet-search.c
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet.
-     Copyright (C) 2001, 2002, 2004, 2005, 2006, 2007, 2009 GNUnet e.V.
+     Copyright (C) 2001, 2002, 2004, 2005, 2006, 2007, 2009, 2022 GNUnet e.V.
 
      GNUnet is free software: you can redistribute it and/or modify it
      under the terms of the GNU Affero General Public License as published
@@ -24,10 +24,57 @@
  * @author Krista Bennett
  * @author James Blackwell
  * @author Igor Wronsky
+ * @author madmurphy
  */
+#include <ctype.h>
+#include <inttypes.h>
+#include <limits.h>
 #include "platform.h"
 #include "gnunet_fs_service.h"
 
+
+#define GNUNET_SEARCH_log(kind, ...) \
+        GNUNET_log_from(kind, "gnunet-search", __VA_ARGS__)
+
+
+/*  The default settings that we use for the printed output  */
+
+#define DEFAULT_DIR_FORMAT       "#%n:\ngnunet-download -o \"%f\" -R %u\n\n"
+#define HELP_DEFAULT_DIR_FORMAT  "#%n:\\ngnunet-download -o \"%f\" -R %u\\n\\n"
+#define DEFAULT_FILE_FORMAT      "#%n:\ngnunet-download -o \"%f\" %u\n\n"
+#define HELP_DEFAULT_FILE_FORMAT "#%n:\\ngnunet-download -o \"%f\" %u\\n\\n"
+#define VERB_DEFAULT_DIR_FORMAT  DEFAULT_DIR_FORMAT "%a\n"
+#define VERB_DEFAULT_FILE_FORMAT DEFAULT_FILE_FORMAT "%a\n"
+
+#if HAVE_LIBEXTRACTOR
+#define DEFAULT_META_FORMAT      "  %t: %p\n"
+#define HELP_DEFAULT_META_FORMAT "  %t: %p\\n"
+#define HELP_EXTRACTOR_TEXTADD   ", %t"
+#else
+#define DEFAULT_META_FORMAT      "  MetaType #%i: %p\n"
+#define HELP_DEFAULT_META_FORMAT "  MetaType #%i: %p\\n"
+#define HELP_EXTRACTOR_TEXTADD   ""
+#endif
+
+#define GENERIC_DIRECTORY_NAME   "collection"
+#define GENERIC_FILE_NAME        "no-name"
+#define GENERIC_FILE_MIMETYPE    "application/octet-stream"
+
+
+enum GNUNET_SEARCH_MetadataPrinterFlags {
+  METADATA_PRINTER_FLAG_NONE = 0,
+  METADATA_PRINTER_FLAG_ONE_RUN = 1,
+  METADATA_PRINTER_FLAG_HAVE_TYPE = 2
+};
+
+
+struct GNUNET_SEARCH_MetadataPrinterInfo {
+  unsigned int counter;
+  unsigned int flags;
+  int type;
+};
+
+
 static int ret;
 
 static const struct GNUNET_CONFIGURATION_Handle *cfg;
@@ -38,6 +85,12 @@ static struct GNUNET_FS_SearchContext *sc;
 
 static char *output_filename;
 
+static char *format_string;
+
+static char *dir_format_string;
+
+static char *meta_format_string;
+
 static struct GNUNET_FS_DirectoryBuilder *db;
 
 static unsigned int anonymity = 1;
@@ -53,16 +106,79 @@ static unsigned int results;
 
 static unsigned int verbose;
 
+static int bookmark_only;
+
 static int local_only;
 
+static int silent_mode;
+
 static struct GNUNET_SCHEDULER_Task *tt;
 
 
 /**
+ * Print the escape sequence at the beginning of a string.
+ *
+ * @param esc a string that **must** begin with a backslash (the function only
+ *        assumes that it does, but does not check)
+ * @return the fragment that follows what has been printed
+ * @author madmurphy
+ *
+ * If `"\\nfoo"` is passed as argument, this function prints a new line and
+ * returns `"foo"`
+ */
+static const char *
+print_escape_sequence (const char *const esc)
+{
+  unsigned int probe;
+  const char * cursor = esc + 1;
+  char tmp;
+  switch (*cursor)
+  {
+  /*  Trivia  */
+  case '\\': putchar ('\\'); return cursor + 1;
+  case 'a': putchar ('\a'); return cursor + 1;
+  case 'b': putchar ('\b'); return cursor + 1;
+  case 'e': putchar ('\x1B'); return cursor + 1;
+  case 'f': putchar ('\f'); return cursor + 1;
+  case 'n': putchar ('\n'); return cursor + 1;
+  case 'r': putchar ('\r'); return cursor + 1;
+  case 't': putchar ('\t'); return cursor + 1;
+  case 'v': putchar ('\v'); return cursor + 1;
+
+  /*  Possibly hexadecimal code point  */
+  case 'x':
+    probe = 0;
+    while (probe < 256 && isxdigit((tmp = *++cursor)))
+      probe = (probe << 4) + tmp - (tmp > 96 ? 87 : tmp > 64 ? 55 : 48);
+    goto maybe_codepoint;
+
+  /*  Possibly octal code point  */
+  case '0': case '1': case '2': case '3':
+  case '4': case '5': case '6': case '7':
+    probe = *cursor++ - 48;
+    do probe = (probe << 3) + *cursor++ - 48;
+    while (probe < 256 && cursor < esc + 4 && *cursor > 47 && *cursor < 56);
+    goto maybe_codepoint;
+
+  /*  Boredom  */
+  case '\0': putchar ('\\'); return cursor;
+  default: printf ("\\%c", *cursor); return cursor + 1;
+  }
+
+maybe_codepoint:
+  if (probe < 256)
+    putchar (probe);
+  else
+    fwrite (esc, 1, cursor - esc, stdout);
+  return cursor;
+}
+
+
+/**
  * Type of a function that libextractor calls for each
  * meta data item found.
  *
- * @param cls closure (user-defined, unused)
+ * @param cls closure (user-defined, used for the iteration info)
  * @param plugin_name name of the plugin that produced this value;
  *        special values can be used (e.g. '&lt;zlib&gt;' for zlib being
  *        used in the main libextractor library and yielding
@@ -76,33 +192,228 @@ static struct GNUNET_SCHEDULER_Task *tt;
  * @return 0 to continue extracting, 1 to abort
  */
 static int
-item_printer (void *cls,
-              const char *plugin_name,
-              enum EXTRACTOR_MetaType type,
-              enum EXTRACTOR_MetaFormat format,
-              const char *data_mime_type,
-              const char *data,
-              size_t data_size)
+item_printer (void *const cls,
+              const char *const plugin_name,
+              const enum EXTRACTOR_MetaType type,
+              const enum EXTRACTOR_MetaFormat format,
+              const char *const data_mime_type,
+              const char *const data,
+              const size_t data_size)
 {
-  if ((format != EXTRACTOR_METAFORMAT_UTF8) &&
-      (format != EXTRACTOR_METAFORMAT_C_STRING))
+#define info ((struct GNUNET_SEARCH_MetadataPrinterInfo *) cls)
+  if ((format != EXTRACTOR_METAFORMAT_UTF8 &&
+       format != EXTRACTOR_METAFORMAT_C_STRING) ||
+      type == EXTRACTOR_METATYPE_GNUNET_ORIGINAL_FILENAME)
     return 0;
-  if (type == EXTRACTOR_METATYPE_GNUNET_ORIGINAL_FILENAME)
+  info->counter++;
+  if ((info->flags & METADATA_PRINTER_FLAG_HAVE_TYPE) && type != info->type)
     return 0;
+
+  const char *cursor = meta_format_string;
+  const char *next_spec = strchr(cursor, '%');
+  const char *next_esc = strchr(cursor, '\\');
+
+parse_format:
+
+  /*  If an escape sequence exists before the next format specifier...  */
+  if (next_esc && (!next_spec || next_esc < next_spec))
+  {
+    if (next_esc > cursor)
+      fwrite (cursor, 1, next_esc - cursor, stdout);
+
+    cursor = print_escape_sequence (next_esc);
+    next_esc = strchr(cursor, '\\');
+    goto parse_format;
+  }
+
+  /*  If a format specifier exists before the next escape sequence...  */
+  if (next_spec && (!next_esc || next_spec < next_esc))
+  {
+    if (next_spec > cursor)
+      fwrite (cursor, 1, next_spec - cursor, stdout);
+
+    switch (*++next_spec)
+    {
+    case '%': putchar('%'); break;
+    case 'i': printf ("%d", type); break;
+    case 'l': printf ("%lu", (long unsigned int) data_size); break;
+    case 'n': printf ("%u", info->counter); break;
+    case 'p': printf ("%s", data); break;
 #if HAVE_LIBEXTRACTOR
-  printf ("\t%20s: %s\n",
-          dgettext (LIBEXTRACTOR_GETTEXT_DOMAIN,
-                    EXTRACTOR_metatype_to_string (type)),
-          data);
-#else
-  printf ("\t%20d: %s\n", type, data);
+    case 't':
+      printf ("%s",
+              dgettext (LIBEXTRACTOR_GETTEXT_DOMAIN,
+                        EXTRACTOR_metatype_to_string (type)));
+      break;
 #endif
-  return 0;
+    case 'w': printf ("%s", plugin_name); break;
+    case '\0': putchar('%'); return 0;
+    default: printf ("%%%c", *next_spec); break;
+    }
+    cursor = next_spec + 1;
+    next_spec = strchr(cursor, '%');
+    goto parse_format;
+  }
+
+  if (*cursor)
+    printf ("%s", cursor);
+
+  return info->flags & METADATA_PRINTER_FLAG_ONE_RUN;
+#undef info
+}
+
+
+/**
+ * Print a search result according to the current formats
+ *
+ * @param filename the filename for this result
+ * @param uri the `struct GNUNET_FS_Uri` this result refers to
+ * @param metadata the `struct GNUNET_CONTAINER_MetaData` associated with this
+          result
+ * @param resultnum the result number
+ * @param is_directory GNUNET_YES if this is a directory, otherwise GNUNET_NO
+ * @author madmurphy
+ */
+static void
+print_search_result (const char *const filename,
+                     const struct GNUNET_FS_Uri *const uri,
+                     const struct GNUNET_CONTAINER_MetaData *const metadata,
+                     const unsigned int resultnum,
+                     const int is_directory)
+{
+
+  const char *cursor = GNUNET_YES == is_directory ?
+                         dir_format_string
+                       : format_string;
+
+  const char *next_spec = strchr(cursor, '%');
+  const char *next_esc = strchr(cursor, '\\');
+  char *placeholder;
+  struct GNUNET_SEARCH_MetadataPrinterInfo info;
+
+parse_format:
+  /*  If an escape sequence exists before the next format specifier...  */
+  if (next_esc && (!next_spec || next_esc < next_spec))
+  {
+    if (next_esc > cursor)
+      fwrite (cursor, 1, next_esc - cursor, stdout);
+
+    cursor = print_escape_sequence (next_esc);
+    next_esc = strchr(cursor, '\\');
+    goto parse_format;
+  }
+
+  /*  If a format specifier exists before the next escape sequence...  */
+  if (next_spec && (!next_esc || next_spec < next_esc))
+  {
+    if (next_spec > cursor)
+      fwrite (cursor, 1, next_spec - cursor, stdout);
+
+    switch (*++next_spec)
+    {
+    /*  All metadata fields  */
+    case 'a':
+      info.flags = METADATA_PRINTER_FLAG_NONE;
+
+iterate_meta:
+      info.counter = 0;
+      GNUNET_CONTAINER_meta_data_iterate (metadata, &item_printer, &info);
+      break;
+    /*  File's name  */
+    case 'f':
+      if (GNUNET_YES == is_directory)
+      {
+        printf ("%s%s", filename, GNUNET_FS_DIRECTORY_EXT);
+        break;
+      }
+      printf ("%s", filename);
+      break;
+    /*  Only the first metadata field  */
+    case 'j':
+      info.flags = METADATA_PRINTER_FLAG_ONE_RUN;
+      goto iterate_meta;
+    /*  File name's length  */
+    case 'l':
+      printf ("%lu",
+              (long unsigned int) (  GNUNET_YES == is_directory ?
+                                       strlen(filename) +
+                                       (sizeof(GNUNET_FS_DIRECTORY_EXT) - 1)
+                                   :
+                                       strlen(filename)));
+      break;
+    /*  File's mime type  */
+    case 'm':
+      if (GNUNET_YES == is_directory)
+      {
+        printf ("%s", GNUNET_FS_DIRECTORY_MIME);
+        break;
+      }
+      placeholder = GNUNET_CONTAINER_meta_data_get_by_type (
+        metadata,
+        EXTRACTOR_METATYPE_MIMETYPE);
+      printf ("%s", placeholder ? placeholder : GENERIC_FILE_MIMETYPE);
+      GNUNET_free (placeholder);
+      break;
+    /*  Result number  */
+    case 'n': printf ("%u", resultnum); break;
+    /*  File's size  */
+    case 's':
+      printf ("%" PRIu64, GNUNET_FS_uri_chk_get_file_size (uri));
+      break;
+    /*  File's URI  */
+    case 'u':
+      placeholder = GNUNET_FS_uri_to_string (uri);
+      printf ("%s", placeholder);
+      GNUNET_free (placeholder);
+      break;
+
+    /*  We can add as many cases as we want here...  */
+
+    /*  Handle `%123#a` and `%123#j` (e.g. `%5#j` is a book title)  */
+    case '0': case '1': case '2': case '3': case '4':
+    case '5': case '6': case '7': case '8': case '9':
+      cursor = next_spec;
+      info.type = *cursor - 48;
+      while (isdigit(*++cursor) && info.type < (INT_MAX - *cursor + 48) / 10)
+        info.type = info.type * 10 + *cursor - 48;
+      if (info.type == 0 || *cursor != '#')
+        goto not_a_specifier;
+      switch (*++cursor)
+      {
+      /*  All metadata fields of type `info.type`   */
+      case 'a':
+        next_spec = cursor;
+        info.flags = METADATA_PRINTER_FLAG_HAVE_TYPE;
+        goto iterate_meta;
+
+      /*  Only the first metadata field of type `info.type`  */
+      case 'j':
+        next_spec = cursor;
+        info.flags = METADATA_PRINTER_FLAG_HAVE_TYPE |
+                     METADATA_PRINTER_FLAG_ONE_RUN;
+        goto iterate_meta;
+      }
+      goto not_a_specifier;
+
+    /*  All other cases  */
+    case '%': putchar('%'); break;
+    case '\0': putchar('%'); return;
+
+not_a_specifier:
+    default: printf ("%%%c", *next_spec); break;
+    }
+    cursor = next_spec + 1;
+    next_spec = strchr(cursor, '%');
+    goto parse_format;
+  }
+
+  if (*cursor)
+    printf ("%s", cursor);
 }
 
 
 static void
-clean_task (void *cls)
+clean_task (void *const cls)
 {
   size_t dsize;
   void *ddata;
@@ -126,9 +437,10 @@ clean_task (void *cls)
                             GNUNET_DISK_PERM_USER_READ
                             | GNUNET_DISK_PERM_USER_WRITE))
   {
-    fprintf (stderr,
-             _ ("Failed to write directory with search results to `%s'\n"),
-             output_filename);
+    GNUNET_SEARCH_log(GNUNET_ERROR_TYPE_ERROR,
+                      _ ("Failed to write directory with search results to "
+                         "`%s'\n"),
+                      output_filename);
   }
   GNUNET_free (ddata);
   GNUNET_free (output_filename);
@@ -149,11 +461,11 @@ clean_task (void *cls)
  *         field in the GNUNET_FS_ProgressInfo struct.
  */
 static void *
-progress_cb (void *cls, const struct GNUNET_FS_ProgressInfo *info)
+progress_cb (void *const cls,
+             const struct GNUNET_FS_ProgressInfo *const info)
 {
   static unsigned int cnt;
   int is_directory;
-  char *uri;
   char *filename;
 
   switch (info->status)
@@ -162,13 +474,17 @@ progress_cb (void *cls, const struct GNUNET_FS_ProgressInfo *info)
     break;
 
   case GNUNET_FS_STATUS_SEARCH_RESULT:
+    if (silent_mode)
+      break;
+
     if (db != NULL)
-      GNUNET_FS_directory_builder_add (db,
-                                       info->value.search.specifics.result.uri,
-                                       info->value.search.specifics.result.meta,
-                                       NULL);
-    uri = GNUNET_FS_uri_to_string (info->value.search.specifics.result.uri);
-    printf ("#%u:\n", ++cnt);
+      GNUNET_FS_directory_builder_add (
+        db,
+        info->value.search.specifics.result.uri,
+        info->value.search.specifics.result.meta,
+        NULL);
+
+    cnt++;
     filename = GNUNET_CONTAINER_meta_data_get_by_type (
       info->value.search.specifics.result.meta,
       EXTRACTOR_METATYPE_GNUNET_ORIGINAL_FILENAME);
@@ -179,45 +495,37 @@ progress_cb (void *cls, const struct GNUNET_FS_ProgressInfo *info)
       while ((filename[0] != '\0') && ('/' == filename[strlen (filename) - 1]))
         filename[strlen (filename) - 1] = '\0';
       GNUNET_DISK_filename_canonicalize (filename);
-      if (GNUNET_YES == is_directory)
-        printf ("gnunet-download -o \"%s%s\" -R %s\n",
-                filename,
-                GNUNET_FS_DIRECTORY_EXT,
-                uri);
-      else
-        printf ("gnunet-download -o \"%s\" %s\n", filename, uri);
     }
-    else if (GNUNET_YES == is_directory)
-      printf ("gnunet-download -o \"collection%s\" -R %s\n",
-              GNUNET_FS_DIRECTORY_EXT,
-              uri);
-    else
-      printf ("gnunet-download %s\n", uri);
-    if (verbose)
-      GNUNET_CONTAINER_meta_data_iterate (info->value.search.specifics.result
-                                          .meta,
-                                          &item_printer,
-                                          NULL);
-    printf ("\n");
+    print_search_result (  filename ?
+                             filename
+                         : is_directory ?
+                             GENERIC_DIRECTORY_NAME
+                         :
+                             GENERIC_FILE_NAME,
+                         info->value.search.specifics.result.uri,
+                         info->value.search.specifics.result.meta,
+                         cnt,
+                         is_directory);
     fflush (stdout);
     GNUNET_free (filename);
-    GNUNET_free (uri);
     results++;
     if ((results_limit > 0) && (results >= results_limit))
+    {
       GNUNET_SCHEDULER_shutdown ();
+      /*  otherwise the function might keep printing results for a while...  */
+      silent_mode = GNUNET_YES;
+    }
     break;
 
   case GNUNET_FS_STATUS_SEARCH_UPDATE:
-    break;
-
   case GNUNET_FS_STATUS_SEARCH_RESULT_STOPPED:
     /* ignore */
     break;
 
   case GNUNET_FS_STATUS_SEARCH_ERROR:
-    fprintf (stderr,
-             _ ("Error searching: %s.\n"),
-             info->value.search.specifics.error.message);
+    GNUNET_SEARCH_log(GNUNET_ERROR_TYPE_ERROR,
+                      _ ("Error searching: %s.\n"),
+                      info->value.search.specifics.error.message);
     GNUNET_SCHEDULER_shutdown ();
     break;
 
@@ -226,7 +534,9 @@ progress_cb (void *cls, const struct GNUNET_FS_ProgressInfo *info)
     break;
 
   default:
-    fprintf (stderr, _ ("Unexpected status: %d\n"), info->status);
+    GNUNET_SEARCH_log(GNUNET_ERROR_TYPE_ERROR,
+                      _ ("Unexpected status: %d\n"),
+                      info->status);
     break;
   }
   return NULL;
@@ -234,7 +544,7 @@ progress_cb (void *cls, const struct GNUNET_FS_ProgressInfo *info)
 
 
 static void
-shutdown_task (void *cls)
+shutdown_task (void *const cls)
 {
   if (sc != NULL)
   {
@@ -245,9 +555,10 @@ shutdown_task (void *cls)
 
 
 static void
-timeout_task (void *cls)
+timeout_task (void *const cls)
 {
   tt = NULL;
+  silent_mode = GNUNET_YES;
   GNUNET_SCHEDULER_shutdown ();
 }
 
@@ -258,18 +569,47 @@ timeout_task (void *cls)
  * @param cls closure
  * @param args remaining command-line arguments
  * @param cfgfile name of the configuration file used (for saving, can be NULL!)
- * @param c configuration
+ * @param cfgarg configuration
  */
 static void
-run (void *cls,
-     char *const *args,
-     const char *cfgfile,
-     const struct GNUNET_CONFIGURATION_Handle *c)
+run (void *const cls,
+     char *const *const args,
+     const char *const cfgfile,
+     const struct GNUNET_CONFIGURATION_Handle *const cfgarg)
 {
   struct GNUNET_FS_Uri *uri;
   unsigned int argc;
   enum GNUNET_FS_SearchOptions options;
 
+  if (silent_mode && bookmark_only)
+  {
+    fprintf (stderr,
+             _ ("Conflicting options --bookmark-only and --silent.\n"));
+    ret = 1;
+    return;
+  }
+  if (bookmark_only && output_filename)
+  {
+    fprintf (stderr,
+             _ ("Conflicting options --bookmark-only and --output.\n"));
+    ret = 1;
+    return;
+  }
+  if (silent_mode && !output_filename)
+  {
+    fprintf (stderr, _ ("An output file is mandatory for silent mode.\n"));
+    ret = 1;
+    return;
+  }
+  if (NULL == dir_format_string)
+    dir_format_string = format_string ? format_string
+                      : verbose ? VERB_DEFAULT_DIR_FORMAT
+                      : DEFAULT_DIR_FORMAT;
+  if (NULL == format_string)
+    format_string = verbose ? VERB_DEFAULT_FILE_FORMAT
+                  : DEFAULT_FILE_FORMAT;
+  if (NULL == meta_format_string)
+    meta_format_string = DEFAULT_META_FORMAT;
   argc = 0;
   while (NULL != args[argc])
     argc++;
@@ -282,7 +622,27 @@ run (void *cls,
     ret = 1;
     return;
   }
-  cfg = c;
+  if (!GNUNET_FS_uri_test_ksk (uri) && !GNUNET_FS_uri_test_sks (uri))
+  {
+    fprintf (stderr,
+             "%s",
+             _ ("Invalid URI. Valid URIs for searching are keyword query "
+                "URIs\n(\"gnunet://fs/ksk/...\") and namespace content URIs "
+                "(\"gnunet://fs/sks/...\").\n"));
+    GNUNET_FS_uri_destroy (uri);
+    ret = 1;
+    return;
+  }
+  if (bookmark_only)
+  {
+    char * bmstr = GNUNET_FS_uri_to_string (uri);
+    printf ("%s\n", bmstr);
+    GNUNET_free (bmstr);
+    GNUNET_FS_uri_destroy (uri);
+    ret = 0;
+    return;
+  }
+  cfg = cfgarg;
   ctx = GNUNET_FS_start (cfg,
                          "gnunet-search",
                          &progress_cb,
@@ -291,7 +651,7 @@ run (void *cls,
                          GNUNET_FS_OPTIONS_END);
   if (NULL == ctx)
   {
-    fprintf (stderr, _ ("Could not initialize `%s' subsystem.\n"), "FS");
+    fprintf (stderr, _ ("Could not initialize the `%s` subsystem.\n"), "FS");
     GNUNET_FS_uri_destroy (uri);
     ret = 1;
     return;
@@ -321,18 +681,59 @@ run (void *cls,
  *
  * @param argc number of arguments from the command line
  * @param argv command line arguments
- * @return 0 ok, 1 on error
+ * @return 0 ok, an error number on error
  */
 int
 main (int argc, char *const *argv)
 {
   struct GNUNET_GETOPT_CommandLineOption options[] =
-  { GNUNET_GETOPT_option_uint ('a',
-                               "anonymity",
-                               "LEVEL",
-                               gettext_noop (
-                                 "set the desired LEVEL of receiver-anonymity"),
-                               &anonymity),
+  { GNUNET_GETOPT_option_uint (
+      'a',
+      "anonymity",
+      "LEVEL",
+      gettext_noop ("set the desired LEVEL of receiver-anonymity (default: "
+                    "1)"),
+      &anonymity),
+    GNUNET_GETOPT_option_flag (
+      'b',
+      "bookmark-only",
+      gettext_noop ("do not search, print only the URI that points to this "
+                    "search"),
+      &bookmark_only),
+    GNUNET_GETOPT_option_string (
+      'F',
+      "dir-printf",
+      "FORMAT",
+      gettext_noop ("write search results for directories according to "
+                    "FORMAT; accepted placeholders are: %a, %f, %j, %l, %m, "
+                    "%n, %s; defaults to the value of --printf when omitted "
+                    "or to `" HELP_DEFAULT_DIR_FORMAT "` if --printf is "
+                    "omitted too"),
+      &dir_format_string),
+    GNUNET_GETOPT_option_string (
+      'f',
+      "printf",
+      "FORMAT",
+      gettext_noop ("write search results according to FORMAT; accepted "
+                    "placeholders are: %a, %f, %j, %l, %m, %n, %s; defaults "
+                    "to `" HELP_DEFAULT_FILE_FORMAT "` when omitted"),
+      &format_string),
+    GNUNET_GETOPT_option_string (
+      'i',
+      "iter-printf",
+      "FORMAT",
+      gettext_noop ("when the %a or %j placeholders appear in --printf or "
+                    "--dir-printf, list each metadata property according to "
+                    "FORMAT; accepted placeholders are: %i, %l, %n, %p"
+                    HELP_EXTRACTOR_TEXTADD ", %w; defaults to `"
+                    HELP_DEFAULT_META_FORMAT "` when omitted"),
+      &meta_format_string),
+    GNUNET_GETOPT_option_uint ('N',
+                               "results",
+                               "VALUE",
+                               gettext_noop ("automatically terminate search "
+                                             "after VALUE results are found"),
+                               &results_limit),
     GNUNET_GETOPT_option_flag (
       'n',
       "no-network",
@@ -341,39 +742,49 @@ main (int argc, char *const *argv)
     GNUNET_GETOPT_option_string (
       'o',
       "output",
-      "PREFIX",
-      gettext_noop ("write search results to file starting with PREFIX"),
+      "FILENAME",
+      gettext_noop ("create a GNUnet directory with search results at "
+                    "FILENAME (e.g. `gnunet-search --output=commons"
+                    GNUNET_FS_DIRECTORY_EXT " commons`)"),
       &output_filename),
+    GNUNET_GETOPT_option_flag (
+      's',
+      "silent",
+      gettext_noop ("silent mode (requires the --output argument)"),
+      &silent_mode),
     GNUNET_GETOPT_option_relative_time (
       't',
       "timeout",
       "DELAY",
-      gettext_noop ("automatically terminate search after DELAY"),
+      gettext_noop ("automatically terminate search after DELAY; the value "
+                    "given must be a number followed by a space and a time "
+                    "unit, for example \"500 ms\"; without a unit it defaults "
+                    "to microseconds - 1000000 = 1 second; if 0 or omitted "
+                    "it means to wait for CTRL-C"),
       &timeout),
-    GNUNET_GETOPT_option_verbose (&verbose),
-    GNUNET_GETOPT_option_uint ('N',
-                               "results",
-                               "VALUE",
-                               gettext_noop ("automatically terminate search "
-                                             "after VALUE results are found"),
-                               &results_limit),
+    GNUNET_GETOPT_option_increment_uint (
+      'V',
+      "verbose",
+      gettext_noop ("be verbose (append \"%a\\n\" to the default --printf and "
+                    "--dir-printf arguments - ignored when these are provided "
+                    "by the user)"),
+      &verbose),
     GNUNET_GETOPT_OPTION_END };
 
   if (GNUNET_OK != GNUNET_STRINGS_get_utf8_args (argc, argv, &argc, &argv))
-    return 2;
-
-  ret =
-    (GNUNET_OK ==
-     GNUNET_PROGRAM_run (argc,
-                         argv,
-                         "gnunet-search [OPTIONS] KEYWORD",
-                         gettext_noop (
-                           "Search GNUnet for files that were published on GNUnet"),
+    return 12;
+
+  if (GNUNET_SYSERR == 
+      GNUNET_PROGRAM_run (argc,
+                          argv,
+                          "gnunet-search [OPTIONS] KEYWORD1 KEYWORD2 ...",
+                          gettext_noop ("Search for files that have been "
+                                        "published on GNUnet\n"),
                          options,
                          &run,
                          NULL))
-    ? ret
-    : 1;
+    ret = 1;
+
   GNUNET_free_nz ((void *) argv);
   return ret;
 }
diff --git a/src/fs/gnunet-service-fs_pr.c b/src/fs/gnunet-service-fs_pr.c
index beb29a506..154c454ca 100644
--- a/src/fs/gnunet-service-fs_pr.c
+++ b/src/fs/gnunet-service-fs_pr.c
@@ -247,7 +247,8 @@ static unsigned long long max_pending_requests = (32 * 1024);
  * @param pr request for which the BF is to be recomputed
  */
 static void
-refresh_bloomfilter (enum GNUNET_BLOCK_Type type, struct GSF_PendingRequest *pr)
+refresh_bloomfilter (enum GNUNET_BLOCK_Type type,
+                     struct GSF_PendingRequest *pr)
 {
   if (NULL != pr->bg)
   {
@@ -406,7 +407,7 @@ GSF_pending_request_create_ (enum GSF_PendingRequestOptions options,
         break;     /* let the request live briefly... */
       if (NULL != dpr->rh)
         dpr->rh (dpr->rh_cls,
-                 GNUNET_BLOCK_EVALUATION_REQUEST_VALID,
+                 GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED,
                  dpr,
                  UINT32_MAX,
                  GNUNET_TIME_UNIT_FOREVER_ABS,
@@ -557,7 +558,10 @@ GSF_pending_request_get_message_ (struct GSF_PendingRequest *pr)
     k++;
   }
   if (GNUNET_OK !=
-      GNUNET_BLOCK_group_serialize (pr->bg, &bf_nonce, &bf_data, &bf_size))
+      GNUNET_BLOCK_group_serialize (pr->bg,
+                                    &bf_nonce,
+                                    &bf_data,
+                                    &bf_size))
   {
     bf_size = 0;
     bf_data = NULL;
@@ -765,11 +769,6 @@ struct ProcessReplyClosure
   enum GNUNET_BLOCK_Type type;
 
   /**
-   * Control flags for evaluation.
-   */
-  enum GNUNET_BLOCK_EvaluationOptions eo;
-
-  /**
    * How much was this reply worth to us?
    */
   uint32_t priority;
@@ -850,7 +849,6 @@ process_reply (void *cls,
   case GNUNET_BLOCK_REPLY_OK_MORE:
     update_request_performance_data (prq, pr);
     break;
-
   case GNUNET_BLOCK_REPLY_OK_LAST:
     /* short cut: stop processing early, no BF-update, etc. */
     update_request_performance_data (prq, pr);
@@ -885,7 +883,6 @@ process_reply (void *cls,
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                 "Duplicate response, discarding.\n");
     return GNUNET_YES;   /* duplicate */
-
   case GNUNET_BLOCK_REPLY_IRRELEVANT:
     GNUNET_STATISTICS_update (GSF_stats,
                               "# irrelevant replies discarded",
@@ -894,8 +891,6 @@ process_reply (void *cls,
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                 "Irrelevant response, ignoring.\n");
     return GNUNET_YES;
-  case GNUNET_BLOCK_REPLY_INVALID:
-    return GNUNET_YES;
   case GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED:
     GNUNET_break (0); /* bad installation? */
     return GNUNET_NO;
@@ -1127,8 +1122,9 @@ handle_dht_reply (void *cls,
                                              prq.expiration);
   prq.size = size;
   prq.type = type;
-  prq.eo = GNUNET_BLOCK_EO_NONE;
-  process_reply (&prq, key, pr);
+  process_reply (&prq,
+                 key,
+                 pr);
   if ((GNUNET_YES == active_to_migration) &&
       (GNUNET_NO == test_put_load_too_high (prq.priority)))
   {
@@ -1229,6 +1225,15 @@ cadet_reply_proc (void *cls,
   struct GNUNET_HashCode query;
 
   pr->cadet_request = NULL;
+  if (GNUNET_OK !=
+      GNUNET_BLOCK_check_block (GSF_block_ctx,
+                                type,
+                                data,
+                                data_size))
+  {
+    GNUNET_break_op (0);
+    return;
+  }
   if (GNUNET_BLOCK_TYPE_ANY == type)
   {
     GNUNET_break (NULL == data);
@@ -1247,7 +1252,11 @@ cadet_reply_proc (void *cls,
     return;
   }
   if (GNUNET_YES !=
-      GNUNET_BLOCK_get_key (GSF_block_ctx, type, data, data_size, &query))
+      GNUNET_BLOCK_get_key (GSF_block_ctx,
+                            type,
+                            data,
+                            data_size,
+                            &query))
   {
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                 "Failed to derive key for block of type %d\n",
@@ -1268,8 +1277,9 @@ cadet_reply_proc (void *cls,
                                              prq.expiration);
   prq.size = data_size;
   prq.type = type;
-  prq.eo = GNUNET_BLOCK_EO_NONE;
-  process_reply (&prq, &query, pr);
+  process_reply (&prq,
+                 &query,
+                 pr);
 }
 
 
@@ -1611,7 +1621,11 @@ called_from_on_demand:
   prq.expiration = expiration;
   prq.size = size;
   if (GNUNET_OK !=
-      GNUNET_BLOCK_get_key (GSF_block_ctx, type, data, size, &query))
+      GNUNET_BLOCK_get_key (GSF_block_ctx,
+                            type,
+                            data,
+                            size,
+                            &query))
   {
     GNUNET_break (0);
     GNUNET_DATASTORE_remove (GSF_dsh,
@@ -1631,8 +1645,9 @@ called_from_on_demand:
   prq.anonymity_level = anonymity;
   if ((0 == old_rf) && (0 == pr->public_data.results_found))
     GSF_update_datastore_delay_ (pr->public_data.start_time);
-  prq.eo = GNUNET_BLOCK_EO_LOCAL_SKIP_CRYPTO;
-  process_reply (&prq, key, pr);
+  process_reply (&prq,
+                 key,
+                 pr);
   pr->local_result = prq.eval;
   if (GNUNET_BLOCK_REPLY_OK_LAST == prq.eval)
   {
@@ -1720,7 +1735,8 @@ GSF_local_lookup_ (struct GSF_PendingRequest *pr,
  * @param put the actual message
  */
 void
-handle_p2p_put (void *cls, const struct PutMessage *put)
+handle_p2p_put (void *cls,
+                const struct PutMessage *put)
 {
   struct GSF_ConnectedPeer *cp = cls;
   uint16_t msize;
@@ -1746,7 +1762,20 @@ handle_p2p_put (void *cls, const struct PutMessage *put)
                                            GNUNET_TIME_UNIT_YEARS),
                                          expiration);
   if (GNUNET_OK !=
-      GNUNET_BLOCK_get_key (GSF_block_ctx, type, &put[1], dsize, &query))
+      GNUNET_BLOCK_check_block (GSF_block_ctx,
+                                type,
+                                &put[1],
+                                dsize))
+  {
+    GNUNET_break_op (0);
+    return;
+  }
+  if (GNUNET_OK !=
+      GNUNET_BLOCK_get_key (GSF_block_ctx,
+                            type,
+                            &put[1],
+                            dsize,
+                            &query))
   {
     GNUNET_break_op (0);
     return;
@@ -1764,7 +1793,6 @@ handle_p2p_put (void *cls, const struct PutMessage *put)
   prq.priority = 0;
   prq.anonymity_level = UINT32_MAX;
   prq.request_found = GNUNET_NO;
-  prq.eo = GNUNET_BLOCK_EO_NONE;
   GNUNET_CONTAINER_multihashmap_get_multiple (pr_map,
                                               &query,
                                               &process_reply,
diff --git a/src/fs/plugin_block_fs.c b/src/fs/plugin_block_fs.c
index 43380b3b6..029f95bc5 100644
--- a/src/fs/plugin_block_fs.c
+++ b/src/fs/plugin_block_fs.c
@@ -111,110 +111,6 @@ block_plugin_fs_create_group (void *cls,
 
 
 /**
- * Function called to validate a reply or a request.  For
- * request evaluation, simply pass "NULL" for the reply_block.
- * Note that it is assumed that the reply has already been
- * matched to the key (and signatures checked) as it would
- * be done with the #GNUNET_BLOCK_get_key() function.
- *
- * @param cls closure
- * @param ctx block context
- * @param type block type
- * @param bg group to use for evaluation
- * @param eo control flags
- * @param query original query (hash)
- * @param xquery extrended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in @a xquery
- * @param reply_block response to validate
- * @param reply_block_size number of bytes in @a reply_block
- * @return characterization of result
- */
-static enum GNUNET_BLOCK_EvaluationResult
-block_plugin_fs_evaluate (void *cls,
-                          struct GNUNET_BLOCK_Context *ctx,
-                          enum GNUNET_BLOCK_Type type,
-                          struct GNUNET_BLOCK_Group *bg,
-                          enum GNUNET_BLOCK_EvaluationOptions eo,
-                          const struct GNUNET_HashCode *query,
-                          const void *xquery,
-                          size_t xquery_size,
-                          const void *reply_block,
-                          size_t reply_block_size)
-{
-  const struct UBlock *ub;
-  struct GNUNET_HashCode hc;
-  struct GNUNET_HashCode chash;
-
-  switch (type)
-  {
-  case GNUNET_BLOCK_TYPE_FS_DBLOCK:
-  case GNUNET_BLOCK_TYPE_FS_IBLOCK:
-    if (0 != xquery_size)
-    {
-      GNUNET_break_op (0);
-      return GNUNET_BLOCK_EVALUATION_REQUEST_INVALID;
-    }
-    if (NULL == reply_block)
-      return GNUNET_BLOCK_EVALUATION_REQUEST_VALID;
-    return GNUNET_BLOCK_EVALUATION_OK_LAST;
-
-  case GNUNET_BLOCK_TYPE_FS_UBLOCK:
-    if (0 != xquery_size)
-    {
-      GNUNET_break_op (0);
-      return GNUNET_BLOCK_EVALUATION_REQUEST_INVALID;
-    }
-    if (NULL == reply_block)
-      return GNUNET_BLOCK_EVALUATION_REQUEST_VALID;
-
-    if (reply_block_size < sizeof(struct UBlock))
-    {
-      GNUNET_break_op (0);
-      return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-    }
-    ub = reply_block;
-    GNUNET_CRYPTO_hash (&ub->verification_key,
-                        sizeof(ub->verification_key),
-                        &hc);
-    if (0 != memcmp (&hc,
-                     query,
-                     sizeof(struct GNUNET_HashCode)))
-    {
-      GNUNET_break_op (0);
-      return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-    }
-    if (reply_block_size != ntohl (ub->purpose.size) + sizeof(struct
-                                                              GNUNET_CRYPTO_EcdsaSignature))
-    {
-      GNUNET_break_op (0);
-      return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-    }
-    if ((0 == (eo & GNUNET_BLOCK_EO_LOCAL_SKIP_CRYPTO)) &&
-        (GNUNET_OK !=
-         GNUNET_CRYPTO_ecdsa_verify_ (GNUNET_SIGNATURE_PURPOSE_FS_UBLOCK,
-                                      &ub->purpose,
-                                      &ub->signature,
-                                      &ub->verification_key)))
-    {
-      GNUNET_break_op (0);
-      return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-    }
-    GNUNET_CRYPTO_hash (reply_block,
-                        reply_block_size,
-                        &chash);
-    if (GNUNET_YES ==
-        GNUNET_BLOCK_GROUP_bf_test_and_set (bg,
-                                            &chash))
-      return GNUNET_BLOCK_EVALUATION_OK_DUPLICATE;
-    return GNUNET_BLOCK_EVALUATION_OK_MORE;
-
-  default:
-    return GNUNET_BLOCK_EVALUATION_TYPE_NOT_SUPPORTED;
-  }
-}
-
-
-/**
  * Function called to obtain the key for a block.
  *
  * @param cls closure
@@ -245,8 +141,11 @@ block_plugin_fs_get_key (void *cls,
   case GNUNET_BLOCK_TYPE_FS_UBLOCK:
     if (block_size < sizeof(struct UBlock))
     {
-      GNUNET_break (0);
-      return GNUNET_SYSERR;
+      GNUNET_break_op (0);
+      memset (key,
+              0,
+              sizeof (*key));
+      return GNUNET_OK;
     }
     ub = block;
     GNUNET_CRYPTO_hash (&ub->verification_key,
@@ -290,6 +189,7 @@ block_plugin_fs_check_query (void *cls,
     }
     return GNUNET_OK;
   default:
+    GNUNET_break (0);
     return GNUNET_SYSERR;
   }
 }
@@ -300,7 +200,6 @@ block_plugin_fs_check_query (void *cls,
  *
  * @param cls closure
  * @param type block type
- * @param query key for the block (hash), must match exactly
  * @param block block data to validate
  * @param block_size number of bytes in @a block
  * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
@@ -308,7 +207,6 @@ block_plugin_fs_check_query (void *cls,
 static enum GNUNET_GenericReturnValue
 block_plugin_fs_check_block (void *cls,
                              enum GNUNET_BLOCK_Type type,
-                             const struct GNUNET_HashCode *query,
                              const void *block,
                              size_t block_size)
 {
@@ -346,6 +244,7 @@ block_plugin_fs_check_block (void *cls,
       return GNUNET_OK;
     }
   default:
+    GNUNET_break (0);
     return GNUNET_SYSERR;
   }
 }
@@ -396,6 +295,7 @@ block_plugin_fs_check_reply (void *cls,
       return GNUNET_BLOCK_REPLY_OK_MORE;
     }
   default:
+    GNUNET_break (0);
     return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
   }
 }
@@ -416,7 +316,6 @@ libgnunet_plugin_block_fs_init (void *cls)
   struct GNUNET_BLOCK_PluginFunctions *api;
 
   api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
-  api->evaluate = &block_plugin_fs_evaluate;
   api->get_key = &block_plugin_fs_get_key;
   api->create_group = &block_plugin_fs_create_group;
   api->check_query = &block_plugin_fs_check_query;
diff --git a/src/gns/Makefile.am b/src/gns/Makefile.am
index 315b4dbf3..d49e0c5c8 100644
--- a/src/gns/Makefile.am
+++ b/src/gns/Makefile.am
@@ -155,6 +155,7 @@ gnunet_dns2gns_LDADD = \
   $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
   libgnunetgns.la \
   $(top_builddir)/src/util/libgnunetutil.la \
+  $(USE_VPN) \
   $(top_builddir)/src/identity/libgnunetidentity.la \
   $(GN_LIBINTL)
 
@@ -218,7 +219,6 @@ gnunet_service_gns_LDADD = \
   $(top_builddir)/src/dht/libgnunetdht.la \
   $(top_builddir)/src/namecache/libgnunetnamecache.la \
   $(LIBIDN) $(LIBIDN2) \
-  $(USE_VPN) \
   $(GN_LIBINTL)
 
 
@@ -270,8 +270,7 @@ check_SCRIPTS = \
   test_gns_rel_expiration.sh\
   test_gns_soa_lookup.sh\
   test_gns_revocation.sh\
-  test_gns_cname_lookup.sh\
-  test_proxy.sh
+  test_gns_redirect_lookup.sh
 
 if HAVE_GNUTLS
 if HAVE_LIBGNURL
@@ -292,7 +291,26 @@ EXTRA_DIST = \
   zonefiles/J7POEUT41A8PBFS7KVVDRF88GBOU4HK8PSU5QKVLVE3R9T91E99G.zkey \
   zonefiles/OEFL7A4VEF1B40QLEMTG5D8G1CN6EN16QUSG5R2DT71GRJN34LSG.zkey \
   zonefiles/test_zonekey \
-  $(check_SCRIPTS) \
+  test_gns_lookup.sh \
+  test_gns_config_lookup.sh \
+  test_gns_ipv6_lookup.sh\
+  test_gns_txt_lookup.sh\
+  test_gns_caa_lookup.sh\
+  test_gns_mx_lookup.sh \
+  test_gns_gns2dns_lookup.sh \
+  test_gns_gns2dns_zkey_lookup.sh \
+  test_gns_gns2dns_cname_lookup.sh \
+  test_gns_dht_lookup.sh\
+  test_gns_delegated_lookup.sh \
+  test_gns_at_lookup.sh\
+  test_gns_zkey_lookup.sh\
+  test_gns_rel_expiration.sh\
+  test_gns_soa_lookup.sh\
+  test_gns_revocation.sh\
+  test_gns_redirect_lookup.sh\
+  test_proxy.sh\
+  test_plugin_rest_gns.sh\
+  test_proxy.sh \
   $(pkgdata_DATA) \
   test_gnunet_gns.sh.in
 
diff --git a/src/gns/gnunet-bcd.c b/src/gns/gnunet-bcd.c
index 83efcfba5..60fe25945 100644
--- a/src/gns/gnunet-bcd.c
+++ b/src/gns/gnunet-bcd.c
@@ -419,6 +419,8 @@ create_response (void *cls,
              "\\def\\gpglineone{%s}\n\\def\\gpglinetwo{%s}\n",
              line1,
              line2);
+    GNUNET_free (line1);
+    GNUNET_free (line2);
   }
 
   fprintf (deffile,
diff --git a/src/gns/gnunet-dns2gns.c b/src/gns/gnunet-dns2gns.c
index 06f4c9841..46659cdda 100644
--- a/src/gns/gnunet-dns2gns.c
+++ b/src/gns/gnunet-dns2gns.c
@@ -27,6 +27,7 @@
 #include <gnunet_dnsparser_lib.h>
 #include <gnunet_gns_service.h>
 #include <gnunet_dnsstub_lib.h>
+#include "gnunet_vpn_service.h"
 #include "gns.h"
 
 /**
@@ -35,6 +36,46 @@
 #define TIMEOUT GNUNET_TIME_UNIT_MINUTES
 
 /**
+ * Default timeout for VPN redirections.
+ */
+#define VPN_TIMEOUT GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MINUTES, 30)
+
+
+struct Request;
+
+/**
+ * Closure for #vpn_allocation_cb.
+ */
+struct VpnContext
+{
+  /**
+   * Which resolution process are we processing.
+   */
+  struct Request *request;
+
+  /**
+   * Handle to the VPN request that we were performing.
+   */
+  struct GNUNET_VPN_RedirectionRequest *vpn_request;
+
+  /**
+   * Number of records serialized in @e rd_data.
+   */
+  unsigned int rd_count;
+
+  /**
+   * Serialized records.
+   */
+  char *rd_data;
+
+  /**
+   * Number of bytes in @e rd_data.
+   */
+  ssize_t rd_data_size;
+};
+
+
+/**
  * Data kept per request.
  */
 struct Request
@@ -72,6 +113,11 @@ struct Request
   struct GNUNET_SCHEDULER_Task *timeout_task;
 
   /**
+   * Vpn resulution context
+   */
+  struct VpnContext *vpn_ctx;
+
+  /**
    * Original UDP request message.
    */
   char *udp_msg;
@@ -90,6 +136,7 @@ struct Request
    * ID of the original request.
    */
   uint16_t original_request_id;
+
 };
 
 /**
@@ -109,6 +156,11 @@ static struct in6_addr address6;
 struct GNUNET_GNS_Handle *gns;
 
 /**
+ * Our handle to the vpn service
+ */
+static struct GNUNET_VPN_Handle *vpn_handle;
+
+/**
  * Stub resolver
  */
 struct GNUNET_DNSSTUB_Context *dns_stub;
@@ -183,6 +235,11 @@ do_shutdown (void *cls)
     GNUNET_GNS_disconnect (gns);
     gns = NULL;
   }
+  if (NULL != vpn_handle)
+  {
+    GNUNET_VPN_disconnect (vpn_handle);
+    vpn_handle = NULL;
+  }
   if (NULL != dns_stub)
   {
     GNUNET_DNSSTUB_stop (dns_stub);
@@ -269,6 +326,7 @@ static void
 do_timeout (void *cls)
 {
   struct Request *request = cls;
+  struct VpnContext *vpn_ctx;
 
   if (NULL != request->packet)
     GNUNET_DNSPARSER_free_packet (request->packet);
@@ -277,6 +335,12 @@ do_timeout (void *cls)
   if (NULL != request->dns_lookup)
     GNUNET_DNSSTUB_resolve_cancel (request->dns_lookup);
   GNUNET_free (request->udp_msg);
+  if (NULL != (vpn_ctx = request->vpn_ctx))
+  {
+    GNUNET_VPN_cancel_request (vpn_ctx->vpn_request);
+    GNUNET_free (vpn_ctx->rd_data);
+    GNUNET_free (vpn_ctx);
+  }
   GNUNET_free (request);
 }
 
@@ -321,6 +385,79 @@ dns_result_processor (void *cls,
   send_response (request);
 }
 
+/**
+ * Callback invoked from the VPN service once a redirection is
+ * available.  Provides the IP address that can now be used to
+ * reach the requested destination.  Replaces the "VPN" record
+ * with the respective A/AAAA record and continues processing.
+ *
+ * @param cls closure
+ * @param af address family, AF_INET or AF_INET6; AF_UNSPEC on error;
+ *                will match 'result_af' from the request
+ * @param address IP address (struct in_addr or struct in_addr6, depending on 'af')
+ *                that the VPN allocated for the redirection;
+ *                traffic to this IP will now be redirected to the
+ *                specified target peer; NULL on error
+ */
+static void
+vpn_allocation_cb (void *cls,
+                   int af,
+                   const void *address)
+{
+  struct VpnContext *vpn_ctx = cls;
+  struct Request *request = vpn_ctx->request;
+  struct GNUNET_GNSRECORD_Data rd[vpn_ctx->rd_count];
+  unsigned int i;
+
+  vpn_ctx->vpn_request = NULL;
+  request->vpn_ctx = NULL;
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_GNSRECORD_records_deserialize (
+                   (size_t) vpn_ctx->rd_data_size,
+                   vpn_ctx->rd_data,
+                   vpn_ctx->rd_count,
+                   rd));
+  for (i = 0; i < vpn_ctx->rd_count; i++)
+  {
+    if (GNUNET_GNSRECORD_TYPE_VPN == rd[i].record_type)
+    {
+      switch (af)
+      {
+      case AF_INET:
+        rd[i].record_type = GNUNET_DNSPARSER_TYPE_A;
+        rd[i].data_size = sizeof(struct in_addr);
+        rd[i].expiration_time = GNUNET_TIME_relative_to_absolute (
+          VPN_TIMEOUT).abs_value_us;
+        rd[i].flags = 0;
+        rd[i].data = address;
+        break;
+
+      case AF_INET6:
+        rd[i].record_type = GNUNET_DNSPARSER_TYPE_AAAA;
+        rd[i].expiration_time = GNUNET_TIME_relative_to_absolute (
+          VPN_TIMEOUT).abs_value_us;
+        rd[i].flags = 0;
+        rd[i].data = address;
+        rd[i].data_size = sizeof(struct in6_addr);
+        break;
+
+      default:
+        GNUNET_assert (0);
+      }
+      break;
+    }
+  }
+  GNUNET_assert (i < vpn_ctx->rd_count);
+  if (0 == vpn_ctx->rd_count)
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                _ ("VPN returned empty result for `%s'\n"),
+                request->packet->queries[0].name);
+  send_response (request);
+  GNUNET_free (vpn_ctx->rd_data);
+  GNUNET_free (vpn_ctx);
+}
+
+
 
 /**
  * Iterator called on obtained result for a GNS lookup.
@@ -339,6 +476,11 @@ result_processor (void *cls,
   struct Request *request = cls;
   struct GNUNET_DNSPARSER_Packet *packet;
   struct GNUNET_DNSPARSER_Record rec;
+  struct VpnContext *vpn_ctx;
+  const struct GNUNET_TUN_GnsVpnRecord *vpn;
+  const char *vname;
+  struct GNUNET_HashCode vhash;
+  int af;
 
   request->lookup = NULL;
   if (GNUNET_NO == was_gns)
@@ -415,6 +557,67 @@ result_processor (void *cls,
                            packet->num_answers,
                            rec);
       break;
+    case GNUNET_GNSRECORD_TYPE_VPN:
+      if ((GNUNET_DNSPARSER_TYPE_A != request->packet->queries[0].type) &&
+          (GNUNET_DNSPARSER_TYPE_AAAA != request->packet->queries[0].type))
+        break;
+      af = (GNUNET_DNSPARSER_TYPE_A == request->packet->queries[0].type) ? AF_INET :
+           AF_INET6;
+      if (sizeof(struct GNUNET_TUN_GnsVpnRecord) >
+          rd[i].data_size)
+      {
+        GNUNET_break_op (0);
+        break;
+      }
+      vpn = (const struct GNUNET_TUN_GnsVpnRecord *) rd[i].data;
+      vname = (const char *) &vpn[1];
+      if ('\0' != vname[rd[i].data_size - 1 - sizeof(struct
+                                                     GNUNET_TUN_GnsVpnRecord)
+          ])
+      {
+        GNUNET_break_op (0);
+        break;
+      }
+      GNUNET_TUN_service_name_to_hash (vname,
+                                       &vhash);
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "Attempting VPN allocation for %s-%s (AF: %d, proto %d)\n",
+                  GNUNET_i2s (&vpn->peer),
+                  vname,
+                  (int) af,
+                  (int) ntohs (vpn->proto));
+      vpn_ctx = GNUNET_new (struct VpnContext);
+      request->vpn_ctx = vpn_ctx;
+      vpn_ctx->request = request;
+      vpn_ctx->rd_data_size = GNUNET_GNSRECORD_records_get_size (rd_count,
+                                                                 rd);
+      if (vpn_ctx->rd_data_size < 0)
+      {
+        GNUNET_break_op (0);
+        GNUNET_free (vpn_ctx);
+        break;
+      }
+      vpn_ctx->rd_data = GNUNET_malloc ((size_t) vpn_ctx->rd_data_size);
+      vpn_ctx->rd_count = rd_count;
+      GNUNET_assert (vpn_ctx->rd_data_size ==
+                     GNUNET_GNSRECORD_records_serialize (rd_count,
+                                                         rd,
+                                                         (size_t) vpn_ctx
+                                                         ->rd_data_size,
+                                                         vpn_ctx->rd_data));
+      vpn_ctx->vpn_request = GNUNET_VPN_redirect_to_peer (vpn_handle,
+                                                          af,
+                                                          ntohs (
+                                                            vpn->proto),
+                                                          &vpn->peer,
+                                                          &vhash,
+                                                          GNUNET_TIME_relative_to_absolute (
+                                                            VPN_TIMEOUT),
+                                                          &
+                                                          vpn_allocation_cb,
+                                                          vpn_ctx);
+      return;
+
 
     default:
       /* skip */
@@ -641,6 +844,8 @@ run (void *cls,
                                  NULL);
   if (NULL == (gns = GNUNET_GNS_connect (cfg)))
     return;
+  if (NULL == (vpn_handle = GNUNET_VPN_connect (cfg)))
+    return;
   GNUNET_assert (NULL != (dns_stub = GNUNET_DNSSTUB_start (128)));
   if (GNUNET_OK !=
       GNUNET_DNSSTUB_add_dns_ip (dns_stub,
@@ -649,6 +854,8 @@ run (void *cls,
     GNUNET_DNSSTUB_stop (dns_stub);
     GNUNET_GNS_disconnect (gns);
     gns = NULL;
+    GNUNET_VPN_disconnect (vpn_handle);
+    vpn_handle = NULL;
     return;
   }
 
@@ -750,6 +957,8 @@ run (void *cls,
   {
     GNUNET_GNS_disconnect (gns);
     gns = NULL;
+    GNUNET_VPN_disconnect (vpn_handle);
+    vpn_handle = NULL;
     GNUNET_DNSSTUB_stop (dns_stub);
     dns_stub = NULL;
     return;
diff --git a/src/gns/gnunet-service-gns.c b/src/gns/gnunet-service-gns.c
index 5833f4d0b..b28236fed 100644
--- a/src/gns/gnunet-service-gns.c
+++ b/src/gns/gnunet-service-gns.c
@@ -420,15 +420,11 @@ handle_lookup (void *cls,
                const struct LookupMessage *sh_msg)
 {
   struct GnsClient *gc = cls;
-  char name[GNUNET_DNSPARSER_MAX_NAME_LENGTH + 1];
   struct ClientLookupHandle *clh;
-  char *nameptr = name;
-  const char *utf_in;
+  const char *name;
 
   GNUNET_SERVICE_client_continue (gc->client);
-  utf_in = (const char *) &sh_msg[1];
-  GNUNET_STRINGS_utf8_tolower (utf_in,
-                               nameptr);
+  name = (const char *) &sh_msg[1];
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Received LOOKUP `%s' message\n",
               name);
diff --git a/src/gns/gnunet-service-gns_resolver.c b/src/gns/gnunet-service-gns_resolver.c
index 51e650b4f..72b228f33 100644
--- a/src/gns/gnunet-service-gns_resolver.c
+++ b/src/gns/gnunet-service-gns_resolver.c
@@ -52,7 +52,6 @@
 #include "gns.h"
 #include "gnunet-service-gns.h"
 #include "gnunet-service-gns_resolver.h"
-#include "gnunet_vpn_service.h"
 
 
 /**
@@ -68,11 +67,6 @@
     GNUNET_TIME_UNIT_SECONDS, 15)
 
 /**
- * Default timeout for VPN redirections.
- */
-#define VPN_TIMEOUT GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MINUTES, 30)
-
-/**
  * DHT replication level
  */
 #define DHT_GNS_REPLICATION_LEVEL 10
@@ -255,38 +249,6 @@ struct DnsResult
 
 
 /**
- * Closure for #vpn_allocation_cb.
- */
-struct VpnContext
-{
-  /**
-   * Which resolution process are we processing.
-   */
-  struct GNS_ResolverHandle *rh;
-
-  /**
-   * Handle to the VPN request that we were performing.
-   */
-  struct GNUNET_VPN_RedirectionRequest *vpn_request;
-
-  /**
-   * Number of records serialized in @e rd_data.
-   */
-  unsigned int rd_count;
-
-  /**
-   * Serialized records.
-   */
-  char *rd_data;
-
-  /**
-   * Number of bytes in @e rd_data.
-   */
-  ssize_t rd_data_size;
-};
-
-
-/**
  * Handle to a currently pending resolution.  On result (positive or
  * negative) the #GNS_ResultProcessor is called.
  */
@@ -322,10 +284,6 @@ struct GNS_ResolverHandle
    */
   struct GNUNET_DHT_GetHandle *get_handle;
 
-  /**
-   * Handle to a VPN request, NULL if none is active.
-   */
-  struct VpnContext *vpn_ctx;
 
   /**
    * Socket for a DNS request, NULL if none is active.
@@ -463,11 +421,6 @@ struct CacheOps
 static struct GNUNET_NAMECACHE_Handle *namecache_handle;
 
 /**
- * Our handle to the vpn service
- */
-static struct GNUNET_VPN_Handle *vpn_handle;
-
-/**
  * Resolver handle to the dht
  */
 static struct GNUNET_DHT_Handle *dht_handle;
@@ -1235,16 +1188,16 @@ recursive_dns_resolution (struct GNS_ResolverHandle *rh)
 
 
 /**
- * We encountered a CNAME record during our resolution.
+ * We encountered a REDIRECT record during our resolution.
  * Merge it into our chain.
  *
  * @param rh resolution we are performing
- * @param cname value of the cname record we got for the current
+ * @param rname value of the redirect record we got for the current
  *        authority chain tail
  */
 static void
-handle_gns_cname_result (struct GNS_ResolverHandle *rh,
-                         const char *cname)
+handle_gns_redirect_result (struct GNS_ResolverHandle *rh,
+                            const char *rname)
 {
   size_t nlen;
   char *res;
@@ -1253,14 +1206,17 @@ handle_gns_cname_result (struct GNS_ResolverHandle *rh,
   int af;
   struct GNUNET_IDENTITY_PublicKey zone;
 
-  nlen = strlen (cname);
-  tld = GNS_get_tld (cname);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Handling GNS REDIRECT result `%s'\n",
+              rname);
+  nlen = strlen (rname);
+  tld = GNS_get_tld (rname);
   if (0 == strcmp ("+", tld))
   {
-    /* CNAME resolution continues relative to current domain */
+    /* REDIRECT resolution continues relative to current domain */
     if (0 == rh->name_resolution_pos)
     {
-      res = GNUNET_strndup (cname, nlen - 2);
+      res = GNUNET_strndup (rname, nlen - 2);
       rh->name_resolution_pos = nlen - 2;
     }
     else
@@ -1270,7 +1226,7 @@ handle_gns_cname_result (struct GNS_ResolverHandle *rh,
                        (int) rh->name_resolution_pos,
                        rh->name,
                        (int) (nlen - 2),
-                       cname);
+                       rname);
       rh->name_resolution_pos = strlen (res);
     }
     GNUNET_free (rh->name);
@@ -1291,13 +1247,13 @@ handle_gns_cname_result (struct GNS_ResolverHandle *rh,
   }
   if (GNUNET_OK == GNUNET_GNSRECORD_zkey_to_pkey (tld, &zone))
   {
-    /* CNAME resolution continues relative to current domain */
+    /* REDIRECT resolution continues relative to current domain */
     if (0 == rh->name_resolution_pos)
     {
       GNUNET_asprintf (&res,
                        "%.*s",
-                       (int) (strlen (cname) - (strlen (tld) + 1)),
-                       cname);
+                       (int) (strlen (rname) - (strlen (tld) + 1)),
+                       rname);
     }
     else
     {
@@ -1305,8 +1261,8 @@ handle_gns_cname_result (struct GNS_ResolverHandle *rh,
                        "%.*s.%.*s",
                        (int) rh->name_resolution_pos,
                        rh->name,
-                       (int) (strlen (cname) - (strlen (tld) + 1)),
-                       cname);
+                       (int) (strlen (rname) - (strlen (tld) + 1)),
+                       rname);
     }
     rh->name_resolution_pos = strlen (res);
     GNUNET_free (rh->name);
@@ -1326,18 +1282,62 @@ handle_gns_cname_result (struct GNS_ResolverHandle *rh,
   }
 
   GNUNET_log (GNUNET_ERROR_TYPE_INFO,
-              "Got CNAME `%s' from GNS for `%s'\n",
-              cname,
+              "Got REDIRECT `%s' from GNS for `%s'\n",
+              rname,
               rh->name);
   if (NULL != rh->std_resolve)
   {
     GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
-                "Multiple CNAME results from GNS resolving `%s'! Not really allowed...\n",
+                "Multiple REDIRECT results from GNS resolving `%s'! Not really allowed...\n",
                 rh->name);
     GNUNET_RESOLVER_request_cancel (rh->std_resolve);
   }
   /* name is absolute, go to DNS */
   GNUNET_free (rh->name);
+  rh->name = GNUNET_strdup (rname);
+  rh->name_resolution_pos = strlen (rh->name);
+  switch (rh->record_type)
+  {
+  case GNUNET_DNSPARSER_TYPE_A:
+    af = AF_INET;
+    break;
+
+  case GNUNET_DNSPARSER_TYPE_AAAA:
+    af = AF_INET6;
+    break;
+
+  default:
+    af = AF_UNSPEC;
+    break;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Doing standard DNS lookup for `%s'\n",
+              rh->name);
+
+  rh->std_resolve = GNUNET_RESOLVER_ip_get (rh->name,
+                                            af,
+                                            DNS_LOOKUP_TIMEOUT,
+                                            &handle_dns_result,
+                                            rh);
+}
+
+
+
+/**
+ * We encountered a CNAME record during our resolution.
+ * Merge it into our chain.
+ *
+ * @param rh resolution we are performing
+ * @param cname value of the cname record we got for the current
+ *        authority chain tail
+ */
+static void
+handle_gns_cname_result (struct GNS_ResolverHandle *rh,
+                         const char *cname)
+{
+  int af;
+
+  GNUNET_free (rh->name);
   rh->name = GNUNET_strdup (cname);
   rh->name_resolution_pos = strlen (rh->name);
   switch (rh->record_type)
@@ -1379,80 +1379,6 @@ handle_gns_resolution_result (void *cls,
                               const struct GNUNET_GNSRECORD_Data *rd);
 
 
-/**
- * Callback invoked from the VPN service once a redirection is
- * available.  Provides the IP address that can now be used to
- * reach the requested destination.  Replaces the "VPN" record
- * with the respective A/AAAA record and continues processing.
- *
- * @param cls closure
- * @param af address family, AF_INET or AF_INET6; AF_UNSPEC on error;
- *                will match 'result_af' from the request
- * @param address IP address (struct in_addr or struct in_addr6, depending on 'af')
- *                that the VPN allocated for the redirection;
- *                traffic to this IP will now be redirected to the
- *                specified target peer; NULL on error
- */
-static void
-vpn_allocation_cb (void *cls,
-                   int af,
-                   const void *address)
-{
-  struct VpnContext *vpn_ctx = cls;
-  struct GNS_ResolverHandle *rh = vpn_ctx->rh;
-  struct GNUNET_GNSRECORD_Data rd[vpn_ctx->rd_count];
-  unsigned int i;
-
-  vpn_ctx->vpn_request = NULL;
-  rh->vpn_ctx = NULL;
-  GNUNET_assert (GNUNET_OK ==
-                 GNUNET_GNSRECORD_records_deserialize (
-                   (size_t) vpn_ctx->rd_data_size,
-                   vpn_ctx->rd_data,
-                   vpn_ctx->rd_count,
-                   rd));
-  for (i = 0; i < vpn_ctx->rd_count; i++)
-  {
-    if (GNUNET_GNSRECORD_TYPE_VPN == rd[i].record_type)
-    {
-      switch (af)
-      {
-      case AF_INET:
-        rd[i].record_type = GNUNET_DNSPARSER_TYPE_A;
-        rd[i].data_size = sizeof(struct in_addr);
-        rd[i].expiration_time = GNUNET_TIME_relative_to_absolute (
-          VPN_TIMEOUT).abs_value_us;
-        rd[i].flags = 0;
-        rd[i].data = address;
-        break;
-
-      case AF_INET6:
-        rd[i].record_type = GNUNET_DNSPARSER_TYPE_AAAA;
-        rd[i].expiration_time = GNUNET_TIME_relative_to_absolute (
-          VPN_TIMEOUT).abs_value_us;
-        rd[i].flags = 0;
-        rd[i].data = address;
-        rd[i].data_size = sizeof(struct in6_addr);
-        break;
-
-      default:
-        GNUNET_assert (0);
-      }
-      break;
-    }
-  }
-  GNUNET_assert (i < vpn_ctx->rd_count);
-  if (0 == vpn_ctx->rd_count)
-    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
-                _ ("VPN returned empty result for `%s'\n"),
-                rh->name);
-  handle_gns_resolution_result (rh,
-                                vpn_ctx->rd_count,
-                                rd);
-  GNUNET_free (vpn_ctx->rd_data);
-  GNUNET_free (vpn_ctx);
-}
-
 
 /**
  * We have resolved one or more of the nameservers for a
@@ -1653,6 +1579,20 @@ handle_gns2dns_ip (void *cls,
     ac->authority_info.dns_authority.found = GNUNET_YES;
 }
 
+/**
+ * We found a REDIRECT record, perform recursive resolution on it.
+ *
+ * @param rh resolution handle
+ * @param rd record with CNAME to resolve recursively
+ */
+static void
+recursive_redirect_resolution (struct GNS_ResolverHandle *rh,
+                               const struct GNUNET_GNSRECORD_Data *rd)
+{
+  handle_gns_redirect_result (rh,
+                              rd->data);
+}
+
 
 /**
  * We found a CNAME record, perform recursive resolution on it.
@@ -1956,11 +1896,6 @@ handle_gns_resolution_result (void *cls,
 {
   struct GNS_ResolverHandle *rh = cls;
   char *cname;
-  struct VpnContext *vpn_ctx;
-  const struct GNUNET_TUN_GnsVpnRecord *vpn;
-  const char *vname;
-  struct GNUNET_HashCode vhash;
-  int af;
   char scratch[UINT16_MAX];
   size_t scratch_off;
   size_t scratch_start;
@@ -2006,8 +1941,18 @@ handle_gns_resolution_result (void *cls,
       GNUNET_free (cname);
       return;
     }
-    /* If A/AAAA was requested, but we got a VPN
-       record, we convert it to A/AAAA using GNUnet VPN */
+    if ((rd_count > 0) &&
+        (GNUNET_GNSRECORD_TYPE_REDIRECT == rd[0].record_type) &&
+        (GNUNET_GNSRECORD_TYPE_REDIRECT != rh->record_type))
+    {
+      handle_gns_redirect_result (rh,
+                                  rd[0].data);
+      return;
+    }
+
+
+    /* If A/AAAA was requested,
+     * but we got a GNS2DNS record */
     if ((GNUNET_DNSPARSER_TYPE_A == rh->record_type) ||
         (GNUNET_DNSPARSER_TYPE_AAAA == rh->record_type))
     {
@@ -2015,69 +1960,6 @@ handle_gns_resolution_result (void *cls,
       {
         switch (rd[i].record_type)
         {
-        case GNUNET_GNSRECORD_TYPE_VPN:
-          {
-            af = (GNUNET_DNSPARSER_TYPE_A == rh->record_type) ? AF_INET :
-                 AF_INET6;
-            if (sizeof(struct GNUNET_TUN_GnsVpnRecord) >
-                rd[i].data_size)
-            {
-              GNUNET_break_op (0);
-              fail_resolution (rh);
-              return;
-            }
-            vpn = (const struct GNUNET_TUN_GnsVpnRecord *) rd[i].data;
-            vname = (const char *) &vpn[1];
-            if ('\0' != vname[rd[i].data_size - 1 - sizeof(struct
-                                                           GNUNET_TUN_GnsVpnRecord)
-                ])
-            {
-              GNUNET_break_op (0);
-              fail_resolution (rh);
-              return;
-            }
-            GNUNET_TUN_service_name_to_hash (vname,
-                                             &vhash);
-            GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                        "Attempting VPN allocation for %s-%s (AF: %d, proto %d)\n",
-                        GNUNET_i2s (&vpn->peer),
-                        vname,
-                        (int) af,
-                        (int) ntohs (vpn->proto));
-            vpn_ctx = GNUNET_new (struct VpnContext);
-            rh->vpn_ctx = vpn_ctx;
-            vpn_ctx->rh = rh;
-            vpn_ctx->rd_data_size = GNUNET_GNSRECORD_records_get_size (rd_count,
-                                                                       rd);
-            if (vpn_ctx->rd_data_size < 0)
-            {
-              GNUNET_break_op (0);
-              GNUNET_free (vpn_ctx);
-              fail_resolution (rh);
-              return;
-            }
-            vpn_ctx->rd_data = GNUNET_malloc ((size_t) vpn_ctx->rd_data_size);
-            vpn_ctx->rd_count = rd_count;
-            GNUNET_assert (vpn_ctx->rd_data_size ==
-                           GNUNET_GNSRECORD_records_serialize (rd_count,
-                                                               rd,
-                                                               (size_t) vpn_ctx
-                                                               ->rd_data_size,
-                                                               vpn_ctx->rd_data));
-            vpn_ctx->vpn_request = GNUNET_VPN_redirect_to_peer (vpn_handle,
-                                                                af,
-                                                                ntohs (
-                                                                  vpn->proto),
-                                                                &vpn->peer,
-                                                                &vhash,
-                                                                GNUNET_TIME_relative_to_absolute (
-                                                                  VPN_TIMEOUT),
-                                                                &
-                                                                vpn_allocation_cb,
-                                                                vpn_ctx);
-            return;
-          }
-
         case GNUNET_GNSRECORD_TYPE_GNS2DNS:
           {
             /* delegation to DNS */
@@ -2117,6 +1999,23 @@ handle_gns_resolution_result (void *cls,
          so we can free it afterwards. */
       switch (rd[i].record_type)
       {
+      case GNUNET_GNSRECORD_TYPE_REDIRECT:
+        {
+          char *rname;
+          rname = GNUNET_strndup (rd[i].data, rd[i].data_size);
+          rname = translate_dot_plus (rh, rname);
+          GNUNET_break (NULL != rname);
+          scratch_start = scratch_off;
+          memcpy (&scratch[scratch_start], rname, strlen (rname) + 1);
+          scratch_off += strlen (rname) + 1;
+          GNUNET_assert (rd_off < rd_count);
+          rd_new[rd_off].data = &scratch[scratch_start];
+          rd_new[rd_off].data_size = scratch_off - scratch_start;
+          rd_off++;
+          GNUNET_free (rname);
+        }
+        break;
+
       case GNUNET_DNSPARSER_TYPE_CNAME:
         {
           char *cname;
@@ -2380,6 +2279,12 @@ handle_gns_resolution_result (void *cls,
 
   switch (rd[0].record_type)
   {
+  case GNUNET_GNSRECORD_TYPE_REDIRECT:
+    GNUNET_break_op (1 == rd_count);  /* REDIRECT should be unique */
+    recursive_redirect_resolution (rh,
+                                   &rd[0]);
+    return;
+
   case GNUNET_DNSPARSER_TYPE_CNAME:
     GNUNET_break_op (1 == rd_count);  /* CNAME should be unique */
     recursive_cname_resolution (rh,
@@ -2393,15 +2298,21 @@ handle_gns_resolution_result (void *cls,
                                &rd[0]);
     return;
 
-  default:
+  case GNUNET_GNSRECORD_TYPE_GNS2DNS:
     if (GNUNET_OK ==
         recursive_gns2dns_resolution (rh,
                                       rd_count,
                                       rd))
       return;
     break;
+  default:
+    if (GNUNET_YES != GNUNET_GNSRECORD_is_critical (rd[0].record_type))
+      return;
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                _ ("Unable to process critical delegation record\n"));
+    break;
   }
-fail:
+  fail:
   GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
               _ ("GNS lookup recursion failed (no delegation record found)\n"));
   fail_resolution (rh);
@@ -2618,6 +2529,13 @@ handle_namecache_block_response (void *cls,
 
   GNUNET_assert (NULL != rh->namecache_qe);
   rh->namecache_qe = NULL;
+  if (NULL == block)
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "No block found\n");
+  else
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Got block with expiration %s\n",
+                GNUNET_STRINGS_absolute_time_to_string (GNUNET_GNSRECORD_block_get_expiration (block)));
   if (((GNUNET_GNS_LO_DEFAULT == rh->options) ||
        ((GNUNET_GNS_LO_LOCAL_MASTER == rh->options) &&
         (ac != rh->ac_head))) &&
@@ -2916,7 +2834,6 @@ GNS_resolver_lookup_cancel (struct GNS_ResolverHandle *rh)
 {
   struct DnsResult *dr;
   struct AuthorityChain *ac;
-  struct VpnContext *vpn_ctx;
 
   GNUNET_CONTAINER_DLL_remove (rlh_head,
                                rlh_tail,
@@ -2981,12 +2898,6 @@ GNS_resolver_lookup_cancel (struct GNS_ResolverHandle *rh)
     GNUNET_CONTAINER_heap_remove_node (rh->dht_heap_node);
     rh->dht_heap_node = NULL;
   }
-  if (NULL != (vpn_ctx = rh->vpn_ctx))
-  {
-    GNUNET_VPN_cancel_request (vpn_ctx->vpn_request);
-    GNUNET_free (vpn_ctx->rd_data);
-    GNUNET_free (vpn_ctx);
-  }
   if (NULL != rh->namecache_qe)
   {
     GNUNET_NAMECACHE_cancel (rh->namecache_qe);
@@ -3046,7 +2957,6 @@ GNS_resolver_init (struct GNUNET_NAMECACHE_Handle *nc,
   if (GNUNET_YES == disable_cache)
     GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                 "Namecache disabled\n");
-  vpn_handle = GNUNET_VPN_connect (cfg);
 }
 
 
@@ -3077,8 +2987,6 @@ GNS_resolver_done ()
   }
   GNUNET_CONTAINER_heap_destroy (dht_lookup_heap);
   dht_lookup_heap = NULL;
-  GNUNET_VPN_disconnect (vpn_handle);
-  vpn_handle = NULL;
   dht_handle = NULL;
   namecache_handle = NULL;
 }
diff --git a/src/gns/plugin_block_gns.c b/src/gns/plugin_block_gns.c
index 407754a8c..fd9c99cb4 100644
--- a/src/gns/plugin_block_gns.c
+++ b/src/gns/plugin_block_gns.c
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet
-     Copyright (C) 2010-2013 GNUnet e.V.
+     Copyright (C) 2010-2013, 2021, 2022 GNUnet e.V.
 
      GNUnet is free software: you can redistribute it and/or modify it
      under the terms of the GNU Affero General Public License as published
@@ -92,98 +92,16 @@ block_plugin_gns_create_group (void *cls,
 
 
 /**
- * Function called to validate a reply or a request.  For
- * request evaluation, simply pass "NULL" for the reply_block.
- * Note that it is assumed that the reply has already been
- * matched to the key (and signatures checked) as it would
- * be done with the "get_key" function.
- *
- * @param cls closure
- * @param ctx block context
- * @param type block type
- * @param bg block group to use for evaluation
- * @param eo control flags
- * @param query original query (hash)
- * @param xquery extrended query data (can be NULL, depending on @a type)
- * @param xquery_size number of bytes in @a xquery
- * @param reply_block response to validate
- * @param reply_block_size number of bytes in @a reply_block
- * @return characterization of result
- */
-static enum GNUNET_BLOCK_EvaluationResult
-block_plugin_gns_evaluate (void *cls,
-                           struct GNUNET_BLOCK_Context *ctx,
-                           enum GNUNET_BLOCK_Type type,
-                           struct GNUNET_BLOCK_Group *bg,
-                           enum GNUNET_BLOCK_EvaluationOptions eo,
-                           const struct GNUNET_HashCode *query,
-                           const void *xquery,
-                           size_t xquery_size,
-                           const void *reply_block,
-                           size_t reply_block_size)
-{
-  const struct GNUNET_GNSRECORD_Block *block;
-  struct GNUNET_HashCode h;
-  struct GNUNET_HashCode chash;
-
-  if (type != GNUNET_BLOCK_TYPE_GNS_NAMERECORD)
-    return GNUNET_BLOCK_EVALUATION_TYPE_NOT_SUPPORTED;
-  if (NULL == reply_block)
-  {
-    if (0 != xquery_size)
-    {
-      GNUNET_break_op (0);
-      return GNUNET_BLOCK_EVALUATION_REQUEST_INVALID;
-    }
-    return GNUNET_BLOCK_EVALUATION_REQUEST_VALID;
-  }
-
-  /* this is a reply */
-  if (reply_block_size < sizeof(struct GNUNET_GNSRECORD_Block))
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-  }
-  block = reply_block;
-  if (GNUNET_GNSRECORD_block_get_size (block) > reply_block_size)
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-  }
-  GNUNET_GNSRECORD_query_from_block (block,
-                                     &h);
-  if (0 != GNUNET_memcmp (&h, query))
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-  }
-  if (GNUNET_OK !=
-      GNUNET_GNSRECORD_block_verify (block))
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-  }
-  GNUNET_CRYPTO_hash (reply_block,
-                      reply_block_size,
-                      &chash);
-  if (GNUNET_YES ==
-      GNUNET_BLOCK_GROUP_bf_test_and_set (bg,
-                                          &chash))
-    return GNUNET_BLOCK_EVALUATION_OK_DUPLICATE;
-  return GNUNET_BLOCK_EVALUATION_OK_MORE;
-}
-
-
-/**
  * Function called to obtain the key for a block.
+ * If the @a block is malformed, the function should
+ * zero-out @a key and return #GNUNET_OK.
  *
  * @param cls closure
  * @param type block type
  * @param reply_block block to get the key for
  * @param reply_block_size number of bytes in @a reply_block
  * @param key set to the key (query) for the given block
- * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported
- *         (or if extracting a key from a block of this type does not work)
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported, #GNUNET_NO if extracting a key from a block of this type does not work
  */
 static enum GNUNET_GenericReturnValue
 block_plugin_gns_get_key (void *cls,
@@ -194,12 +112,18 @@ block_plugin_gns_get_key (void *cls,
 {
   const struct GNUNET_GNSRECORD_Block *block;
 
-  if (type != GNUNET_BLOCK_TYPE_GNS_NAMERECORD)
+  if (GNUNET_BLOCK_TYPE_GNS_NAMERECORD != type)
+  {
+    GNUNET_break (0);
     return GNUNET_SYSERR;
+  }
   if (reply_block_size < sizeof(struct GNUNET_GNSRECORD_Block))
   {
     GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
+    memset (key,
+            0,
+            sizeof (*key));
+    return GNUNET_OK;
   }
   block = reply_block;
   GNUNET_GNSRECORD_query_from_block (block,
@@ -227,8 +151,11 @@ block_plugin_gns_check_query (void *cls,
                               const void *xquery,
                               size_t xquery_size)
 {
-  if (type != GNUNET_BLOCK_TYPE_GNS_NAMERECORD)
+  if (GNUNET_BLOCK_TYPE_GNS_NAMERECORD != type)
+  {
+    GNUNET_break (0);
     return GNUNET_SYSERR;
+  }
   if (0 != xquery_size)
   {
     GNUNET_break_op (0);
@@ -243,7 +170,6 @@ block_plugin_gns_check_query (void *cls,
  *
  * @param cls closure
  * @param type block type
- * @param query key for the block (hash), must match exactly
  * @param block block data to validate
  * @param block_size number of bytes in @a block
  * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
@@ -251,14 +177,16 @@ block_plugin_gns_check_query (void *cls,
 static enum GNUNET_GenericReturnValue
 block_plugin_gns_check_block (void *cls,
                               enum GNUNET_BLOCK_Type type,
-                              const struct GNUNET_HashCode *query,
                               const void *block,
                               size_t block_size)
 {
   const struct GNUNET_GNSRECORD_Block *gblock;
   
-  if (type != GNUNET_BLOCK_TYPE_GNS_NAMERECORD)
+  if (GNUNET_BLOCK_TYPE_GNS_NAMERECORD != type)
+  {
+    GNUNET_break (0);
     return GNUNET_SYSERR;
+  }
   if (block_size < sizeof(struct GNUNET_GNSRECORD_Block))
   {
     GNUNET_break_op (0);
@@ -306,23 +234,16 @@ block_plugin_gns_check_reply (void *cls,
                               const void *reply_block,
                               size_t reply_block_size)
 {
-  const struct GNUNET_GNSRECORD_Block *block;
+  const struct GNUNET_GNSRECORD_Block *block = reply_block;
   struct GNUNET_HashCode chash;
 
-  if (type != GNUNET_BLOCK_TYPE_GNS_NAMERECORD)
-    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
-  /* this is a reply */
-  if (reply_block_size < sizeof(struct GNUNET_GNSRECORD_Block))
+  if (GNUNET_BLOCK_TYPE_GNS_NAMERECORD != type)
   {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_REPLY_INVALID;
-  }
-  block = reply_block;
-  if (GNUNET_GNSRECORD_block_get_size (block) > reply_block_size)
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_REPLY_INVALID;
+    GNUNET_break (0);
+    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
   }
+  GNUNET_assert (reply_block_size >= sizeof(struct GNUNET_GNSRECORD_Block));
+  GNUNET_assert (GNUNET_GNSRECORD_block_get_size (block) > reply_block_size);
   GNUNET_CRYPTO_hash (reply_block,
                       reply_block_size,
                       &chash);
@@ -347,7 +268,6 @@ libgnunet_plugin_block_gns_init (void *cls)
   struct GNUNET_BLOCK_PluginFunctions *api;
 
   api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
-  api->evaluate = &block_plugin_gns_evaluate;
   api->get_key = &block_plugin_gns_get_key;
   api->create_group = &block_plugin_gns_create_group;
   api->check_query = &block_plugin_gns_check_query;
diff --git a/src/gns/plugin_gnsrecord_gns.c b/src/gns/plugin_gnsrecord_gns.c
index 391144925..dc7ffa9b2 100644
--- a/src/gns/plugin_gnsrecord_gns.c
+++ b/src/gns/plugin_gnsrecord_gns.c
@@ -64,8 +64,7 @@ gns_value_to_string (void *cls,
     return GNUNET_IDENTITY_public_key_to_string (&pk);
 
   case GNUNET_GNSRECORD_TYPE_NICK:
-    return GNUNET_strndup (data, data_size);
-
+  case GNUNET_GNSRECORD_TYPE_REDIRECT:
   case GNUNET_GNSRECORD_TYPE_LEHO:
     return GNUNET_strndup (data, data_size);
 
@@ -133,7 +132,9 @@ gns_value_to_string (void *cls,
       GNUNET_free (ival);
       return box_str;
     }
-
+  case GNUNET_GNSRECORD_TYPE_TOMBSTONE: {
+    return GNUNET_strdup (_("This is a memento of an older block for internal maintenance."));
+  }
   default:
     return NULL;
   }
@@ -184,16 +185,13 @@ gns_string_to_value (void *cls,
     if (record_type != type)
     {
       GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                  _("Record type does not match parsed record type\n"));
+                  _ ("Record type does not match parsed record type\n"));
       return GNUNET_SYSERR;
     }
     return GNUNET_OK;
 
   case GNUNET_GNSRECORD_TYPE_NICK:
-    *data = GNUNET_strdup (s);
-    *data_size = strlen (s);
-    return GNUNET_OK;
-
+  case GNUNET_GNSRECORD_TYPE_REDIRECT:
   case GNUNET_GNSRECORD_TYPE_LEHO:
     *data = GNUNET_strdup (s);
     *data_size = strlen (s);
@@ -301,6 +299,12 @@ gns_string_to_value (void *cls,
       GNUNET_free (bval);
       return GNUNET_OK;
     }
+  case GNUNET_GNSRECORD_TYPE_TOMBSTONE: {
+      *data_size = 0;
+      *data = NULL;
+      return GNUNET_OK;
+    }
+
 
   default:
     return GNUNET_SYSERR;
@@ -317,12 +321,16 @@ static struct
   const char *name;
   uint32_t number;
 } gns_name_map[] = { { "PKEY", GNUNET_GNSRECORD_TYPE_PKEY },
-                     { "EDKEY", GNUNET_GNSRECORD_TYPE_PKEY },
+                     { "EDKEY", GNUNET_GNSRECORD_TYPE_EDKEY },
                      { "NICK", GNUNET_GNSRECORD_TYPE_NICK },
                      { "LEHO", GNUNET_GNSRECORD_TYPE_LEHO },
                      { "VPN", GNUNET_GNSRECORD_TYPE_VPN },
                      { "GNS2DNS", GNUNET_GNSRECORD_TYPE_GNS2DNS },
                      { "BOX", GNUNET_GNSRECORD_TYPE_BOX },
+                     { "REDIRECT", GNUNET_GNSRECORD_TYPE_REDIRECT },
+                     /* Tombstones should never be added manually
+                      * so this makes sense, kind of */
+                     { "\u271E", GNUNET_GNSRECORD_TYPE_TOMBSTONE },
                      { NULL, UINT32_MAX } };
 
 
@@ -365,6 +373,19 @@ gns_number_to_typename (void *cls, uint32_t type)
 }
 
 
+static enum GNUNET_GenericReturnValue
+gns_is_critical (void *cls, uint32_t type)
+{
+  return ((type == GNUNET_GNSRECORD_TYPE_PKEY) ||
+          (type == GNUNET_GNSRECORD_TYPE_EDKEY) ||
+          (type == GNUNET_GNSRECORD_TYPE_GNS2DNS) ||
+          (type == GNUNET_GNSRECORD_TYPE_REDIRECT) ?
+          GNUNET_YES : GNUNET_NO);
+}
+
+
+
+
 /**
  * Entry point for the plugin.
  *
@@ -381,6 +402,7 @@ libgnunet_plugin_gnsrecord_gns_init (void *cls)
   api->string_to_value = &gns_string_to_value;
   api->typename_to_number = &gns_typename_to_number;
   api->number_to_typename = &gns_number_to_typename;
+  api->is_critical = &gns_is_critical;
   return api;
 }
 
diff --git a/src/gns/test_gns_cname_lookup.sh b/src/gns/test_gns_cname_lookup.sh
deleted file mode 100755
index 3a189e1e2..000000000
--- a/src/gns/test_gns_cname_lookup.sh
+++ /dev/null
@@ -1,99 +0,0 @@
-#!/bin/sh
-# This file is in the public domain.
-trap "gnunet-arm -e -c test_gns_lookup.conf" INT
-
-LOCATION=$(which gnunet-config)
-if [ -z $LOCATION ]
-then
-  LOCATION="gnunet-config"
-fi
-$LOCATION --version 1> /dev/null
-if test $? != 0
-then
-        echo "GNUnet command line tools cannot be found, check environmental variables PATH and GNUNET_PREFIX"
-        exit 77
-fi
-
-# permissive DNS resolver we will use for the test
-DNS_RESOLVER="8.8.8.8"
-if ! nslookup gnunet.org $DNS_RESOLVER > /dev/null 2>&1
-then
-  echo "Cannot reach DNS, skipping test"
-  exit 77
-fi
-
-
-rm -rf `gnunet-config -c test_gns_lookup.conf -f -s paths -o GNUNET_TEST_HOME`
-
-TEST_IP_PLUS="127.0.0.1"
-TEST_IP_DNS="131.159.74.67"
-TEST_RECORD_CNAME_SERVER="server"
-TEST_RECORD_CNAME_PLUS="server.+"
-TEST_RECORD_CNAME_DNS="gnunet.org"
-TEST_RECORD_NAME_SERVER="server"
-TEST_RECORD_NAME_PLUS="www"
-TEST_RECORD_NAME_ZKEY="www2"
-TEST_RECORD_NAME_DNS="www3"
-MY_EGO="myego"
-TEST_DOMAIN_PLUS="www.$MY_EGO"
-TEST_DOMAIN_ZKEY="www2.$MY_EGO"
-TEST_DOMAIN_DNS="www3.$MY_EGO"
-which timeout > /dev/null 2>&1 && DO_TIMEOUT="timeout 15"
-
-gnunet-arm -s -c test_gns_lookup.conf
-gnunet-identity -C $MY_EGO -c test_gns_lookup.conf
-MY_EGO_PKEY=$(gnunet-identity -d -c test_gns_lookup.conf | grep ${MY_EGO} | awk '{print $3}')
-TEST_RECORD_CNAME_ZKEY="server.${MY_EGO_PKEY}"
-gnunet-namestore -p -z $MY_EGO -a -n $TEST_RECORD_NAME_DNS -t CNAME -V $TEST_RECORD_CNAME_DNS -e never -c test_gns_lookup.conf
-gnunet-namestore -p -z $MY_EGO -a -n $TEST_RECORD_NAME_PLUS -t CNAME -V $TEST_RECORD_CNAME_PLUS -e never -c test_gns_lookup.conf
-gnunet-namestore -p -z $MY_EGO -a -n $TEST_RECORD_NAME_ZKEY -t CNAME -V $TEST_RECORD_CNAME_ZKEY -e never -c test_gns_lookup.conf
-gnunet-namestore -p -z $MY_EGO -a -n $TEST_RECORD_CNAME_SERVER -t A -V $TEST_IP_PLUS -e never -c test_gns_lookup.conf
-RES_CNAME=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN_PLUS -t A -c test_gns_lookup.conf`
-RES_CNAME_RAW=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN_PLUS -t CNAME -c test_gns_lookup.conf`
-RES_CNAME_ZKEY=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN_ZKEY -t A -c test_gns_lookup.conf`
-RES_CNAME_DNS=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN_DNS -t A -c test_gns_lookup.conf | grep $TEST_IP_DNS`
-
-TESTEGOZONE=`gnunet-identity -c test_gns_lookup.conf -d | awk '{print $3}'`
-gnunet-namestore -p -z $MY_EGO -d -n $TEST_RECORD_NAME_DNS -t CNAME -V $TEST_RECORD_CNAME_DNS -e never -c test_gns_lookup.conf
-gnunet-namestore -p -z $MY_EGO -d -n $TEST_RECORD_NAME_PLUS -t CNAME -V $TEST_RECORD_CNAME_PLUS -e never -c test_gns_lookup.conf
-gnunet-namestore -p -z $MY_EGO -d -n $TEST_RECORD_NAME_ZKEY -t CNAME -V $TEST_RECORD_CNAME_ZKEY -e never -c test_gns_lookup.conf
-gnunet-namestore -p -z $MY_EGO -d -n $TEST_RECORD_CNAME_SERVER -t A -V $TEST_IP_PLUS -e never -c test_gns_lookup.conf
-gnunet-identity -D $MY_EGO -c test_gns_lookup.conf
-gnunet-arm -e -c test_gns_lookup.conf
-rm -rf `gnunet-config -c test_gns_lookup.conf -f -s paths -o GNUNET_TEST_HOME`
-
-# make cmp case-insensitive by converting to lower case first
-RES_CNAME_RAW=`echo $RES_CNAME_RAW | tr [A-Z] [a-z]`
-TESTEGOZONE=`echo $TESTEGOZONE | tr [A-Z] [a-z]`
-if [ "$RES_CNAME_RAW" = "server.$TESTEGOZONE" ]
-then
-  echo "PASS: CNAME resolution from GNS"
-else
-  echo "FAIL: CNAME resolution from GNS, got $RES_CNAME_RAW, expected server.$TESTEGOZONE."
-  exit 1
-fi
-
-if [ "$RES_CNAME" = "$TEST_IP_PLUS" ]
-then
-  echo "PASS: IP resolution from GNS (.+)"
-else
-  echo "FAIL: IP resolution from GNS (.+), got $RES_CNAME, expected $TEST_IP_PLUS."
-  exit 1
-fi
-
-if [ "$RES_CNAME_ZKEY" = "$TEST_IP_PLUS" ]
-then
-  echo "PASS: IP resolution from GNS (.zkey)"
-else
-  echo "FAIL: IP resolution from GNS (.zkey), got $RES_CNAME, expected $TEST_IP_PLUS."
-  exit 1
-fi
-
-if echo "$RES_CNAME_DNS" | grep "$TEST_IP_DNS" > /dev/null
-then
-  echo "PASS: IP resolution from DNS"
-  exit 0
-else
-  echo "FAIL: IP resolution from DNS, got $RES_CNAME_DNS, expected $TEST_IP_DNS."
-  exit 1
-fi
diff --git a/src/gns/test_gns_gns2dns_cname_lookup.sh b/src/gns/test_gns_gns2dns_cname_lookup.sh
index ce1afacf4..9315f6b2f 100755
--- a/src/gns/test_gns_gns2dns_cname_lookup.sh
+++ b/src/gns/test_gns_gns2dns_cname_lookup.sh
@@ -16,9 +16,11 @@ fi
 
 rm -rf `gnunet-config -c test_gns_lookup.conf -f -s paths -o GNUNET_TEST_HOME`
 # IP address of 'www.gnunet.org'
-TEST_IP="131.159.74.67"
+TEST_IP="147.87.255.218"
+# IP address of 'gnunet.org'
+TEST_IPALT="131.159.74.67"
 # IPv6 address of 'gnunet.org'
-TEST_IP6="2001:4ca0:2001:42:225:90ff:fe6b:d60"
+TEST_IP6="2a07:6b47:100:464::9357:ffdb"
 
 # main label used during resolution
 TEST_RECORD_NAME="homepage"
@@ -46,7 +48,7 @@ TEST_DOMAIN="www.${TEST_RECORD_NAME}.$MY_EGO"
 which timeout > /dev/null 2>&1 && DO_TIMEOUT="timeout 15"
 
 gnunet-arm -s -c test_gns_lookup.conf
-OUT=`$DO_TIMEOUT gnunet-resolver -c test_gns_lookup.conf gnunet.org`
+OUT=`$DO_TIMEOUT gnunet-resolver -c test_gns_lookup.conf www.gnunet.org`
 echo $OUT | grep $TEST_IP - > /dev/null || { gnunet-arm -e -c test_gns_lookup.conf ; echo "IPv4 for gnunet.org not found ($OUT), skipping test"; exit 77; }
 echo $OUT | grep $TEST_IP6 - > /dev/null || { gnunet-arm -e -c test_gns_lookup.conf ; echo "IPv6 for gnunet.org not found ($OUT), skipping test"; exit 77; }
 
@@ -59,6 +61,7 @@ gnunet-namestore -p -z $MY_EGO -a -n $TEST_RECORD_NAME -t GNS2DNS -V $TEST_RECOR
 gnunet-namestore -p -z $MY_EGO -a -n $TEST_RECORD_NAME -t GNS2DNS -V $TEST_RECORD_GNS2DNS2 -e never -c test_gns_lookup.conf
 gnunet-namestore -p -z $MY_EGO -a -n $TEST_RECORD_NAME -t GNS2DNS -V $TEST_RECORD_GNS2DNS3 -e never -c test_gns_lookup.conf
 
+gnunet-namestore -z $MY_EGO -D -c test_gns_lookup.conf
 
 echo "EGOs:"
 gnunet-identity -d
diff --git a/src/gns/test_gns_gns2dns_lookup.sh b/src/gns/test_gns_gns2dns_lookup.sh
index dcad594b3..240e441a4 100755
--- a/src/gns/test_gns_gns2dns_lookup.sh
+++ b/src/gns/test_gns_gns2dns_lookup.sh
@@ -17,9 +17,11 @@ rm -rf `gnunet-config -c test_gns_lookup.conf -f -s paths -o GNUNET_TEST_HOME`
 # IP address of 'docs.gnunet.org'
 TEST_IP_ALT2="147.87.255.218"
 # IP address of 'www.gnunet.org'
-TEST_IP="131.159.74.67"
+TEST_IP="147.87.255.218"
+# IP address of 'gnunet.org'
+TEST_IP_ALT="131.159.74.67"
 # IPv6 address of 'gnunet.org'
-TEST_IP6="2001:4ca0:2001:42:225:90ff:fe6b:d60"
+TEST_IP6="2a07:6b47:100:464::9357:ffdb"
 # permissive DNS resolver we will use for the test
 TEST_IP_GNS2DNS="8.8.8.8"
 
@@ -49,7 +51,7 @@ which timeout > /dev/null 2>&1 && DO_TIMEOUT="timeout 15"
 
 gnunet-arm -s -c test_gns_lookup.conf
 
-OUT=`$DO_TIMEOUT gnunet-resolver -c test_gns_lookup.conf gnunet.org`
+OUT=`$DO_TIMEOUT gnunet-resolver -c test_gns_lookup.conf www.gnunet.org`
 echo $OUT | grep $TEST_IP - > /dev/null || { gnunet-arm -e -c test_gns_lookup.conf ; echo "IPv4 for gnunet.org not found ($OUT), skipping test"; exit 77; }
 echo $OUT | grep $TEST_IP6 - > /dev/null || { gnunet-arm -e -c test_gns_lookup.conf ; echo "IPv6 for gnunet.org not found ($OUT), skipping test"; exit 77; }
 
@@ -69,7 +71,7 @@ gnunet-identity -d
 # lookup 'www.gnunet.org', IPv4
 RES_IP=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN -t A -c test_gns_lookup.conf`
 # lookup 'www.gnunet.org', IPv6
-RES_IP6=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN -t AAAA -c test_gns_lookup.conf`
+RES_IP6=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN -t AAAA -c test_gns_lookup.conf | head -n1`
 # lookup 'gnunet.org', IPv4
 RES_IP_ALT=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN_ALT -t A -c test_gns_lookup.conf`
 # lookup 'docs.gnunet.org', IPv4
@@ -91,7 +93,7 @@ else
   ret=1
 fi
 
-if [ "$RES_IP6" = "$TEST_IP6" ]
+if [ "${RES_IP6%?}" = "${TEST_IP6%?}" ]
 then
   echo "PASS: Resolved $TEST_DOMAIN to $RES_IP6."
 else
@@ -99,7 +101,7 @@ else
   ret=1
 fi
 
-if echo "$RES_IP_ALT" | grep "$TEST_IP" > /dev/null
+if echo "$RES_IP_ALT" | grep "$TEST_IP_ALT" > /dev/null
 then
   echo "PASS: Resolved $TEST_DOMAIN_ALT to $RES_IP_ALT."
 else
diff --git a/src/gns/test_gns_gns2dns_zkey_lookup.sh b/src/gns/test_gns_gns2dns_zkey_lookup.sh
index 1f8e34c42..a299c34b6 100755
--- a/src/gns/test_gns_gns2dns_zkey_lookup.sh
+++ b/src/gns/test_gns_gns2dns_zkey_lookup.sh
@@ -17,9 +17,11 @@ rm -rf `gnunet-config -c test_gns_lookup.conf -f -s paths -o GNUNET_TEST_HOME`
 # IP address of 'docs.gnunet.org'
 TEST_IP_ALT2="147.87.255.218"
 # IP address of 'www.gnunet.org'
-TEST_IP="131.159.74.67"
+TEST_IP="147.87.255.218"
+# IP address of 'www.gnunet.org'
+TEST_IP_ALT="131.159.74.67"
 # IPv6 address of 'gnunet.org'
-TEST_IP6="2001:4ca0:2001:42:225:90ff:fe6b:d60"
+TEST_IP6="2a07:6b47:100:464::9357:ffdb"
 # permissive DNS resolver we will use for the test
 TEST_IP_GNS2DNS="8.8.8.8"
 
@@ -46,7 +48,7 @@ which timeout > /dev/null 2>&1 && DO_TIMEOUT="timeout 15"
 
 gnunet-arm -s -c test_gns_lookup.conf
 
-OUT=`$DO_TIMEOUT gnunet-resolver -c test_gns_lookup.conf gnunet.org`
+OUT=`$DO_TIMEOUT gnunet-resolver -c test_gns_lookup.conf www.gnunet.org`
 echo $OUT | grep $TEST_IP - > /dev/null || { gnunet-arm -e -c test_gns_lookup.conf ; echo "IPv4 for gnunet.org not found ($OUT), skipping test"; exit 77; }
 echo $OUT | grep $TEST_IP6 - > /dev/null || { gnunet-arm -e -c test_gns_lookup.conf ; echo "IPv6 for gnunet.org not found ($OUT), skipping test"; exit 77; }
 
@@ -66,7 +68,7 @@ gnunet-namestore -p -z $MY_EGO -a -n $TEST_RECORD_NAME -t GNS2DNS -V $TEST_RECOR
 # lookup 'www.gnunet.org', IPv4
 RES_IP=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN -t A -c test_gns_lookup.conf`
 # lookup 'www.gnunet.org', IPv6
-RES_IP6=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN -t AAAA -c test_gns_lookup.conf`
+RES_IP6=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN -t AAAA -c test_gns_lookup.conf | head -n1`
 # lookup 'gnunet.org', IPv4
 RES_IP_ALT=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN_ALT -t A -c test_gns_lookup.conf`
 # lookup 'docs.gnunet.org', IPv4
@@ -88,7 +90,7 @@ else
   ret=1
 fi
 
-if [ "$RES_IP6" = "$TEST_IP6" ]
+if [ "${RES_IP6%?}" = "${TEST_IP6%?}" ]
 then
   echo "PASS: Resolved $TEST_DOMAIN to $RES_IP6."
 else
@@ -96,7 +98,7 @@ else
   ret=1
 fi
 
-if echo "$RES_IP_ALT" | grep "$TEST_IP" > /dev/null
+if echo "$RES_IP_ALT" | grep "$TEST_IP_ALT" > /dev/null
 then
   echo "PASS: Resolved $TEST_DOMAIN_ALT to $RES_IP_ALT."
 else
diff --git a/src/gns/test_gns_redirect_lookup.sh b/src/gns/test_gns_redirect_lookup.sh
new file mode 100755
index 000000000..dfe5087ef
--- /dev/null
+++ b/src/gns/test_gns_redirect_lookup.sh
@@ -0,0 +1,100 @@
+#!/bin/sh
+# This file is in the public domain.
+trap "gnunet-arm -e -c test_gns_lookup.conf" INT
+
+LOCATION=$(which gnunet-config)
+if [ -z $LOCATION ]
+then
+  LOCATION="gnunet-config"
+fi
+$LOCATION --version 1> /dev/null
+if test $? != 0
+then
+        echo "GNUnet command line tools cannot be found, check environmental variables PATH and GNUNET_PREFIX"
+        exit 77
+fi
+
+# permissive DNS resolver we will use for the test
+DNS_RESOLVER="8.8.8.8"
+if ! nslookup gnunet.org $DNS_RESOLVER > /dev/null 2>&1
+then
+  echo "Cannot reach DNS, skipping test"
+  exit 77
+fi
+
+
+rm -rf `gnunet-config -c test_gns_lookup.conf -f -s paths -o GNUNET_TEST_HOME`
+
+TEST_IP_PLUS="127.0.0.1"
+TEST_IP_DNS="131.159.74.67"
+TEST_RECORD_REDIRECT_SERVER="server"
+TEST_RECORD_REDIRECT_PLUS="server.+"
+TEST_RECORD_REDIRECT_DNS="gnunet.org"
+TEST_RECORD_NAME_SERVER="server"
+TEST_RECORD_NAME_PLUS="www"
+TEST_RECORD_NAME_ZKEY="www2"
+TEST_RECORD_NAME_DNS="www3"
+MY_EGO="myego"
+TEST_DOMAIN_PLUS="www.$MY_EGO"
+TEST_DOMAIN_ZKEY="www2.$MY_EGO"
+TEST_DOMAIN_DNS="www3.$MY_EGO"
+which timeout > /dev/null 2>&1 && DO_TIMEOUT="timeout 15"
+
+gnunet-arm -s -c test_gns_lookup.conf
+gnunet-identity -C $MY_EGO -c test_gns_lookup.conf
+MY_EGO_PKEY=$(gnunet-identity -d -c test_gns_lookup.conf | grep ${MY_EGO} | awk '{print $3}')
+TEST_RECORD_REDIRECT_ZKEY="server.${MY_EGO_PKEY}"
+gnunet-namestore -p -z $MY_EGO -a -n $TEST_RECORD_NAME_DNS -t REDIRECT -V $TEST_RECORD_REDIRECT_DNS -e never -c test_gns_lookup.conf
+gnunet-namestore -p -z $MY_EGO -a -n $TEST_RECORD_NAME_PLUS -t REDIRECT -V $TEST_RECORD_REDIRECT_PLUS -e never -c test_gns_lookup.conf
+gnunet-namestore -p -z $MY_EGO -a -n $TEST_RECORD_NAME_ZKEY -t REDIRECT -V $TEST_RECORD_REDIRECT_ZKEY -e never -c test_gns_lookup.conf
+gnunet-namestore -p -z $MY_EGO -a -n $TEST_RECORD_REDIRECT_SERVER -t A -V $TEST_IP_PLUS -e never -c test_gns_lookup.conf
+gnunet-namestore -D -z $MY_EGO
+RES_REDIRECT=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN_PLUS -t A -c test_gns_lookup.conf`
+RES_REDIRECT_RAW=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN_PLUS -t REDIRECT -c test_gns_lookup.conf`
+RES_REDIRECT_ZKEY=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN_ZKEY -t A -c test_gns_lookup.conf`
+RES_REDIRECT_DNS=`$DO_TIMEOUT gnunet-gns --raw -u $TEST_DOMAIN_DNS -t A -c test_gns_lookup.conf | grep $TEST_IP_DNS`
+
+TESTEGOZONE=`gnunet-identity -c test_gns_lookup.conf -d | awk '{print $3}'`
+gnunet-namestore -p -z $MY_EGO -d -n $TEST_RECORD_NAME_DNS -t REDIRECT -V $TEST_RECORD_REDIRECT_DNS -e never -c test_gns_lookup.conf
+gnunet-namestore -p -z $MY_EGO -d -n $TEST_RECORD_NAME_PLUS -t REDIRECT -V $TEST_RECORD_REDIRECT_PLUS -e never -c test_gns_lookup.conf
+gnunet-namestore -p -z $MY_EGO -d -n $TEST_RECORD_NAME_ZKEY -t REDIRECT -V $TEST_RECORD_REDIRECT_ZKEY -e never -c test_gns_lookup.conf
+gnunet-namestore -p -z $MY_EGO -d -n $TEST_RECORD_REDIRECT_SERVER -t A -V $TEST_IP_PLUS -e never -c test_gns_lookup.conf
+gnunet-identity -D $MY_EGO -c test_gns_lookup.conf
+gnunet-arm -e -c test_gns_lookup.conf
+rm -rf `gnunet-config -c test_gns_lookup.conf -f -s paths -o GNUNET_TEST_HOME`
+
+# make cmp case-insensitive by converting to lower case first
+RES_REDIRECT_RAW=`echo $RES_REDIRECT_RAW | tr [A-Z] [a-z]`
+TESTEGOZONE=`echo $TESTEGOZONE | tr [A-Z] [a-z]`
+if [ "$RES_REDIRECT_RAW" = "server.$TESTEGOZONE" ]
+then
+  echo "PASS: REDIRECT resolution from GNS"
+else
+  echo "FAIL: REDIRECT resolution from GNS, got $RES_REDIRECT_RAW, expected server.$TESTEGOZONE."
+  exit 1
+fi
+
+if [ "$RES_REDIRECT" = "$TEST_IP_PLUS" ]
+then
+  echo "PASS: IP resolution from GNS (.+)"
+else
+  echo "FAIL: IP resolution from GNS (.+), got $RES_REDIRECT, expected $TEST_IP_PLUS."
+  exit 1
+fi
+
+if [ "$RES_REDIRECT_ZKEY" = "$TEST_IP_PLUS" ]
+then
+  echo "PASS: IP resolution from GNS (.zkey)"
+else
+  echo "FAIL: IP resolution from GNS (.zkey), got $RES_REDIRECT, expected $TEST_IP_PLUS."
+  exit 1
+fi
+
+if echo "$RES_REDIRECT_DNS" | grep "$TEST_IP_DNS" > /dev/null
+then
+  echo "PASS: IP resolution from DNS"
+  exit 0
+else
+  echo "FAIL: IP resolution from DNS, got $RES_REDIRECT_DNS, expected $TEST_IP_DNS."
+  exit 1
+fi
diff --git a/src/gnsrecord/Makefile.am b/src/gnsrecord/Makefile.am
index 4308d9c1a..e2538b1a2 100644
--- a/src/gnsrecord/Makefile.am
+++ b/src/gnsrecord/Makefile.am
@@ -20,7 +20,6 @@ check_PROGRAMS = \
  test_gnsrecord_crypto \
  test_gnsrecord_serialization \
  test_gnsrecord_block_expiration \
- test_gnsrecord_testvectors \
  perf_gnsrecord_crypto
 
 if ENABLE_TEST_RUN
@@ -35,7 +34,8 @@ lib_LTLIBRARIES = \
   libgnunetgnsrecordjson.la
 
 gnunet_gnsrecord_tvg_SOURCES = \
- gnunet-gnsrecord-tvg.c
+ gnunet-gnsrecord-tvg.c \
+ gnsrecord_crypto.h
 gnunet_gnsrecord_tvg_LDADD = \
   $(top_builddir)/src/util/libgnunetutil.la \
   $(top_builddir)/src/identity/libgnunetidentity.la \
@@ -86,13 +86,13 @@ libgnunet_plugin_gnsrecord_dns_la_LDFLAGS = \
 EXTRA_DIST = \
   $(check_SCRIPTS)
 
-test_gnsrecord_testvectors_SOURCES = \
- test_gnsrecord_testvectors.c
-test_gnsrecord_testvectors_LDADD = \
-  $(top_builddir)/src/testing/libgnunettesting.la \
-        $(top_builddir)/src/identity/libgnunetidentity.la \
-  libgnunetgnsrecord.la \
-  $(top_builddir)/src/util/libgnunetutil.la
+#test_gnsrecord_testvectors_SOURCES = \
+# test_gnsrecord_testvectors.c
+#test_gnsrecord_testvectors_LDADD = \
+#  $(top_builddir)/src/testing/libgnunettesting.la \
+#       $(top_builddir)/src/identity/libgnunetidentity.la \
+#  libgnunetgnsrecord.la \
+#  $(top_builddir)/src/util/libgnunetutil.la
 
 
 test_gnsrecord_serialization_SOURCES = \
diff --git a/src/gnsrecord/gnsrecord.c b/src/gnsrecord/gnsrecord.c
index e9994a868..52c480ef6 100644
--- a/src/gnsrecord/gnsrecord.c
+++ b/src/gnsrecord/gnsrecord.c
@@ -260,4 +260,25 @@ GNUNET_GNSRECORD_number_to_typename (uint32_t type)
 }
 
 
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_is_critical (uint32_t type)
+{
+  struct Plugin *plugin;
+
+  if (GNUNET_GNSRECORD_TYPE_ANY == type)
+    return GNUNET_NO;
+  init ();
+  for (unsigned int i = 0; i < num_plugins; i++)
+  {
+    plugin = gns_plugins[i];
+    if (NULL == plugin->api->is_critical)
+      continue;
+    if (GNUNET_NO == plugin->api->is_critical (plugin->api->cls, type))
+      continue;
+    return GNUNET_YES;
+  }
+  return GNUNET_NO;
+}
+
+
 /* end of gnsrecord.c */
diff --git a/src/gnsrecord/gnsrecord_crypto.c b/src/gnsrecord/gnsrecord_crypto.c
index 890ddb011..ff92911de 100644
--- a/src/gnsrecord/gnsrecord_crypto.c
+++ b/src/gnsrecord/gnsrecord_crypto.c
@@ -223,7 +223,6 @@ block_create_ecdsa (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
   unsigned char ctr[GNUNET_CRYPTO_AES_KEY_LENGTH / 2];
   unsigned char skey[GNUNET_CRYPTO_AES_KEY_LENGTH];
   struct GNUNET_GNSRECORD_Data rdc[GNUNET_NZL (rd_count)];
-  uint32_t rd_count_nbo;
   struct GNUNET_TIME_Absolute now;
 
   if (payload_len < 0)
@@ -254,7 +253,6 @@ block_create_ecdsa (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
   /* serialize */
   *block = GNUNET_malloc (sizeof (struct GNUNET_GNSRECORD_Block) + payload_len);
   (*block)->size = htonl(sizeof (struct GNUNET_GNSRECORD_Block) + payload_len);
-  rd_count_nbo = htonl (rd_count);
   {
     char payload[payload_len];
 
@@ -282,12 +280,12 @@ block_create_ecdsa (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
                               label,
                               ecblock->expiration_time.abs_value_us__,
                               pkey);
-    GNUNET_break (payload_len ==
-                  ecdsa_symmetric_encrypt (payload,
-                                           payload_len,
-                                           skey,
-                                           ctr,
-                                           &ecblock[1]));
+    GNUNET_assert (payload_len ==
+                   ecdsa_symmetric_encrypt (payload,
+                                            payload_len,
+                                            skey,
+                                            ctr,
+                                            &ecblock[1]));
     GNUNET_memcpy (&gnr_block[1], &ecblock[1], payload_len);
   }
   if (GNUNET_OK !=
@@ -298,8 +296,10 @@ block_create_ecdsa (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
     GNUNET_break (0);
     GNUNET_free (*block);
     GNUNET_free (dkey);
+    GNUNET_free (gnr_block);
     return GNUNET_SYSERR;
   }
+  GNUNET_free (gnr_block);
   GNUNET_free (dkey);
   return GNUNET_OK;
 }
@@ -348,7 +348,6 @@ block_create_eddsa (const struct GNUNET_CRYPTO_EddsaPrivateKey *key,
   unsigned char nonce[crypto_secretbox_NONCEBYTES];
   unsigned char skey[crypto_secretbox_KEYBYTES];
   struct GNUNET_GNSRECORD_Data rdc[GNUNET_NZL (rd_count)];
-  uint32_t rd_count_nbo;
   struct GNUNET_TIME_Absolute now;
 
   if (payload_len < 0)
@@ -381,7 +380,6 @@ block_create_eddsa (const struct GNUNET_CRYPTO_EddsaPrivateKey *key,
                           + payload_len + crypto_secretbox_MACBYTES);
   (*block)->size = htonl(sizeof (struct GNUNET_GNSRECORD_Block)
                  + payload_len + crypto_secretbox_MACBYTES);
-  rd_count_nbo = htonl (rd_count);
   {
     char payload[payload_len];
 
@@ -415,12 +413,12 @@ block_create_eddsa (const struct GNUNET_CRYPTO_EddsaPrivateKey *key,
                                  label,
                                  edblock->expiration_time.abs_value_us__,
                                  pkey);
-    GNUNET_break (GNUNET_OK ==
-                  eddsa_symmetric_encrypt (payload,
-                                           payload_len,
-                                           skey,
-                                           nonce,
-                                           &edblock[1]));
+    GNUNET_assert (GNUNET_OK ==
+                   eddsa_symmetric_encrypt (payload,
+                                            payload_len,
+                                            skey,
+                                            nonce,
+                                            &edblock[1]));
     GNUNET_memcpy (&gnr_block[1], &edblock[1],
                    payload_len + crypto_secretbox_MACBYTES);
 
@@ -438,7 +436,7 @@ GNUNET_GNSRECORD_block_calculate_size (const struct
                                        unsigned int rd_count)
 {
   struct GNUNET_IDENTITY_PublicKey pkey;
-  ssize_t res;
+  ssize_t res = -1;
 
   GNUNET_IDENTITY_key_get_public (key,
                                   &pkey);
@@ -453,7 +451,7 @@ GNUNET_GNSRECORD_block_calculate_size (const struct
   default:
     GNUNET_assert (0);
   }
-  return -1;
+  return res;
 
 }
 
@@ -593,8 +591,9 @@ GNUNET_GNSRECORD_block_verify (const struct GNUNET_GNSRECORD_Block *block)
   purp = GNUNET_malloc (sizeof (struct GNRBlockPS) + payload_len);
   purp->purpose.size = htonl (sizeof (struct GNRBlockPS) + payload_len);
   purp->purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_GNS_RECORD_SIGN);
-  GNUNET_memcpy (&purp[1], &block[1], payload_len);
-
+  GNUNET_memcpy (&purp[1],
+                 &block[1],
+                 payload_len);
   switch (ntohl (block->type))
   {
   case GNUNET_GNSRECORD_TYPE_PKEY:
@@ -650,10 +649,10 @@ block_decrypt_ecdsa (const struct GNUNET_GNSRECORD_Block *block,
     char payload[payload_len];
     unsigned int rd_count;
 
-    GNUNET_break (payload_len ==
-                  ecdsa_symmetric_decrypt (&block[1], payload_len,
-                                           key, ctr,
-                                           payload));
+    GNUNET_assert (payload_len ==
+                   ecdsa_symmetric_decrypt (&block[1], payload_len,
+                                            key, ctr,
+                                            payload));
     rd_count = GNUNET_GNSRECORD_records_deserialize_get_size (payload_len,
                                                               payload);
     if (rd_count > 2048)
@@ -754,7 +753,6 @@ block_decrypt_eddsa (const struct GNUNET_GNSRECORD_Block *block,
                      GNUNET_GNSRECORD_RecordCallback proc,
                      void *proc_cls)
 {
-  const struct GNUNET_GNSRECORD_EddsaBlock *edblock = &block->eddsa_block;
   size_t payload_len = ntohl (block->size) - sizeof (struct
                                                      GNUNET_GNSRECORD_Block);
   unsigned char nonce[crypto_secretbox_NONCEBYTES];
@@ -776,10 +774,10 @@ block_decrypt_eddsa (const struct GNUNET_GNSRECORD_Block *block,
     char payload[payload_len];
     unsigned int rd_count;
 
-    GNUNET_break (GNUNET_OK ==
-                  eddsa_symmetric_decrypt (&block[1], payload_len,
-                                           key, nonce,
-                                           payload));
+    GNUNET_assert (GNUNET_OK ==
+                   eddsa_symmetric_decrypt (&block[1], payload_len,
+                                            key, nonce,
+                                            payload));
     payload_len -= crypto_secretbox_MACBYTES;
     rd_count = GNUNET_GNSRECORD_records_deserialize_get_size (payload_len,
                                                               payload);
@@ -909,7 +907,7 @@ GNUNET_GNSRECORD_block_decrypt (const struct GNUNET_GNSRECORD_Block *block,
                                proc_cls);
     break;
   default:
-    return GNUNET_SYSERR;
+    res = GNUNET_SYSERR;
   }
   GNUNET_free (norm_label);
   return res;
diff --git a/src/gnsrecord/gnsrecord_misc.c b/src/gnsrecord/gnsrecord_misc.c
index 61604c730..54d8fb860 100644
--- a/src/gnsrecord/gnsrecord_misc.c
+++ b/src/gnsrecord/gnsrecord_misc.c
@@ -38,23 +38,26 @@
 #define LOG(kind, ...) GNUNET_log_from (kind, "gnsrecord", __VA_ARGS__)
 
 char *
-GNUNET_GNSRECORD_string_to_lowercase (const char *src)
+GNUNET_GNSRECORD_string_normalize (const char *src)
 {
-  char *res;
-
-  res = GNUNET_strdup (src);
-  GNUNET_STRINGS_utf8_tolower (src, res);
-  return res;
+  /*FIXME: We may want to follow RFC5890/RFC5891 */
+  return GNUNET_STRINGS_utf8_normalize (src);
 }
 
-char *
-GNUNET_GNSRECORD_string_normalize (const char *src)
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_label_check (const char*label, char **emsg)
 {
-  char *res;
-  res = GNUNET_strdup (src);
-  GNUNET_STRINGS_utf8_tolower (src, res);
-  GNUNET_STRINGS_utf8_normalize (src, res);
-  return res;
+  if (NULL == label)
+  {
+    *emsg = GNUNET_strdup (_ ("Label is NULL which is not allowed\n"));
+    return GNUNET_NO;
+  }
+  if (0 != strchr (label, '.'))
+  {
+    *emsg = GNUNET_strdup (_ ("Label  contains `.' which is not allowed\n"));
+    return GNUNET_NO;
+  }
+  return GNUNET_OK;
 }
 
 /**
@@ -144,19 +147,11 @@ GNUNET_GNSRECORD_records_cmp (const struct GNUNET_GNSRECORD_Data *a,
 }
 
 
-/**
- * Returns the expiration time of the given block of records. The block
- * expiration time is the expiration time of the record with smallest
- * expiration time.
- *
- * @param rd_count number of records given in @a rd
- * @param rd array of records
- * @return absolute expiration time
- */
 struct GNUNET_TIME_Absolute
 GNUNET_GNSRECORD_record_get_expiration_time (unsigned int rd_count,
                                              const struct
-                                             GNUNET_GNSRECORD_Data *rd)
+                                             GNUNET_GNSRECORD_Data *rd,
+                                             struct GNUNET_TIME_Absolute min)
 {
   struct GNUNET_TIME_Absolute expire;
   struct GNUNET_TIME_Absolute at;
@@ -164,8 +159,8 @@ GNUNET_GNSRECORD_record_get_expiration_time (unsigned int rd_count,
   struct GNUNET_TIME_Absolute at_shadow;
   struct GNUNET_TIME_Relative rt_shadow;
 
-  if (NULL == rd)
-    return GNUNET_TIME_UNIT_ZERO_ABS;
+  if (0 == rd_count)
+    return GNUNET_TIME_absolute_max (GNUNET_TIME_UNIT_ZERO_ABS, min);
   expire = GNUNET_TIME_UNIT_FOREVER_ABS;
   for (unsigned int c = 0; c < rd_count; c++)
   {
@@ -202,6 +197,7 @@ GNUNET_GNSRECORD_record_get_expiration_time (unsigned int rd_count,
     expire = GNUNET_TIME_absolute_min (at,
                                        expire);
   }
+  expire = GNUNET_TIME_absolute_max (expire, min);
   LOG (GNUNET_ERROR_TYPE_DEBUG,
        "Determined expiration time for block with %u records to be %s\n",
        rd_count,
@@ -284,12 +280,24 @@ GNUNET_GNSRECORD_identity_from_data (const char *data,
 {
   if (GNUNET_NO == GNUNET_GNSRECORD_is_zonekey_type (type))
     return GNUNET_SYSERR;
-  if (data_size > sizeof (struct GNUNET_IDENTITY_PublicKey))
-    return GNUNET_SYSERR;
-  return (GNUNET_IDENTITY_read_key_from_buffer (key, data, data_size) ==
-          data_size?
-          GNUNET_OK :
-          GNUNET_SYSERR);
+  switch (type)
+  {
+  case GNUNET_GNSRECORD_TYPE_PKEY:
+    if (data_size > sizeof (struct GNUNET_CRYPTO_EcdsaPublicKey))
+      return GNUNET_SYSERR;
+    memcpy (&key->ecdsa_key, data, data_size);
+    break;
+  case GNUNET_GNSRECORD_TYPE_EDKEY:
+    if (data_size > sizeof (struct GNUNET_CRYPTO_EddsaPublicKey))
+      return GNUNET_SYSERR;
+    memcpy (&key->eddsa_key, data, data_size);
+    break;
+  default:
+    return GNUNET_NO;
+  }
+  key->type = htonl (type);
+
+  return GNUNET_YES;
 }
 
 
@@ -302,16 +310,11 @@ GNUNET_GNSRECORD_data_from_identity (const struct
 {
   char *tmp;
   *type = ntohl (key->type);
-  *data_size = GNUNET_IDENTITY_key_get_length (key);
+  *data_size = GNUNET_IDENTITY_key_get_length (key) - sizeof (key->type);
   if (0 == *data_size)
     return GNUNET_SYSERR;
   tmp = GNUNET_malloc (*data_size);
-  if (GNUNET_IDENTITY_write_key_to_buffer (key, tmp, *data_size)
-      != *data_size) {
-    GNUNET_free (tmp);
-    *data_size = 0;
-    return GNUNET_SYSERR;
-  }
+  memcpy (tmp, ((char*) key) + sizeof (key->type), *data_size);
   *data = tmp;
   return GNUNET_OK;
 }
@@ -406,5 +409,176 @@ GNUNET_GNSRECORD_record_to_identity_key (const struct GNUNET_GNSRECORD_Data *rd,
 
 }
 
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_normalize_record_set (const char *label,
+                                       const struct
+                                       GNUNET_GNSRECORD_Data *rd,
+                                       unsigned int rd_count,
+                                       struct GNUNET_GNSRECORD_Data *
+                                       rd_public,
+                                       unsigned int *rd_count_public,
+                                       struct GNUNET_TIME_Absolute *expiry,
+                                       int include_private,
+                                       char **emsg)
+{
+  struct GNUNET_TIME_Absolute now;
+  struct GNUNET_TIME_Absolute minimum_expiration;
+  int have_zone_delegation = GNUNET_NO;
+  int have_gns2dns = GNUNET_NO;
+  int have_other = GNUNET_NO;
+  int have_redirect = GNUNET_NO;
+  int have_empty_label = (0 == strcmp (GNUNET_GNS_EMPTY_LABEL_AT, label));
+  unsigned int rd_count_tmp;
+
+  minimum_expiration = GNUNET_TIME_UNIT_ZERO_ABS;
+  now = GNUNET_TIME_absolute_get ();
+  rd_count_tmp = 0;
+  for (unsigned int i = 0; i < rd_count; i++)
+  {
+    /* Ignore the tombstone. For maintenance only. Remember expiration time. */
+    if (GNUNET_GNSRECORD_TYPE_TOMBSTONE == rd[i].record_type)
+    {
+      minimum_expiration.abs_value_us = rd[i].expiration_time;
+      continue;
+    }
+    /* No NICK records unless empty label */
+    if (have_empty_label &&
+        (GNUNET_GNSRECORD_TYPE_NICK == rd[i].record_type))
+      continue;
+
+    /**
+     * Check for delegation and redirect consistency.
+     * Note that we check for consistency BEFORE we filter for
+     * private records ON PURPOSE.
+     * We also want consistent record sets in our local zone(s).
+     * The only exception is the tombstone (above) which we ignore
+     * for the consistency check(s).
+     * FIXME: What about shadow records? Should we ignore them?
+     */
+    if (GNUNET_YES == GNUNET_GNSRECORD_is_zonekey_type (rd[i].record_type))
+    {
+      /* No delegation records under empty label*/
+      if (have_empty_label)
+      {
+        *emsg = GNUNET_strdup (_ (
+                                 "Zone delegation record not allowed in apex."));
+        return GNUNET_SYSERR;
+      }
+      if ((GNUNET_YES == have_other) ||
+          (GNUNET_YES == have_redirect) ||
+          (GNUNET_YES == have_gns2dns))
+      {
+        *emsg = GNUNET_strdup (_ (
+                                 "Zone delegation record set contains mutually exclusive records."));
+        return GNUNET_SYSERR;
+      }
+      have_zone_delegation = GNUNET_YES;
+    }
+    else if (GNUNET_GNSRECORD_TYPE_REDIRECT == rd[i].record_type)
+    {
+      if (GNUNET_YES == have_redirect)
+      {
+        *emsg = GNUNET_strdup (_ (
+                                 "Multiple REDIRECT records."));
+        return GNUNET_SYSERR;
+
+      }
+      if ((GNUNET_YES == have_other) ||
+          (GNUNET_YES == have_zone_delegation) ||
+          (GNUNET_YES == have_gns2dns))
+      {
+        *emsg = GNUNET_strdup (_ (
+                                 "Redirection record set conains mutually exclusive records."));
+        return GNUNET_SYSERR;
+      }
+      /* No redirection records under empty label*/
+      if (have_empty_label)
+      {
+        *emsg = GNUNET_strdup (_ (
+                                 "Redirection records not allowed in apex."));
+        return GNUNET_SYSERR;
+      }
+      have_redirect = GNUNET_YES;
+    }
+    else if (GNUNET_GNSRECORD_TYPE_GNS2DNS == rd[i].record_type)
+    {
+      /* No gns2dns records under empty label*/
+      if (have_empty_label)
+      {
+        *emsg = GNUNET_strdup (_ (
+                                 "Redirection records not allowed in apex.."));
+        return GNUNET_SYSERR;
+      }
+      if ((GNUNET_YES == have_other) ||
+          (GNUNET_YES == have_redirect) ||
+          (GNUNET_YES == have_zone_delegation))
+      {
+        *emsg = GNUNET_strdup (_ (
+                                 "Redirection record set conains mutually exclusive records."));
+        return GNUNET_SYSERR;
+      }
+      have_gns2dns = GNUNET_YES;
+    }
+    else
+    {
+      /* Some other record.
+       * Not allowed for zone delegations or redirections */
+      if ((GNUNET_YES == have_zone_delegation) ||
+          (GNUNET_YES == have_redirect) ||
+          (GNUNET_YES == have_gns2dns))
+      {
+        *emsg = GNUNET_strdup (_ (
+                                 "Mutually exclusive records."));
+        return GNUNET_SYSERR;
+      }
+      have_other = GNUNET_YES;
+    }
+
+    /* Ignore private records for public record set */
+
+    if ((GNUNET_NO == include_private) &&
+        (0 != (rd[i].flags & GNUNET_GNSRECORD_RF_PRIVATE)))
+      continue;
+    /* Skip expired records */
+    if ((0 == (rd[i].flags & GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION)) &&
+        (rd[i].expiration_time < now.abs_value_us))
+      continue;     /* record already expired, skip it */
+    rd_public[rd_count_tmp] = rd[i];
+    /* Make sure critical record types are marked as such */
+    if (GNUNET_YES == GNUNET_GNSRECORD_is_critical (rd[i].record_type))
+      rd_public[rd_count_tmp].flags |= GNUNET_GNSRECORD_RF_CRITICAL;
+    rd_count_tmp++;
+  }
+
+  *expiry = GNUNET_GNSRECORD_record_get_expiration_time (rd_count_tmp,
+                                                         rd_public,
+                                                         minimum_expiration);
+  *rd_count_public = rd_count_tmp;
+  return GNUNET_OK;
+}
+
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_convert_records_for_export (const char *label,
+                                             const struct
+                                             GNUNET_GNSRECORD_Data *rd,
+                                             unsigned int rd_count,
+                                             struct GNUNET_GNSRECORD_Data *
+                                             rd_public,
+                                             unsigned int *rd_count_public,
+                                             struct GNUNET_TIME_Absolute *expiry,
+                                             char **emsg)
+{
+  return GNUNET_GNSRECORD_normalize_record_set (label,
+                                                rd,
+                                                rd_count,
+                                                rd_public,
+                                                rd_count_public,
+                                                expiry,
+                                                GNUNET_NO,
+                                                emsg);
+
+}
+
+
 
 /* end of gnsrecord_misc.c */
diff --git a/src/gnsrecord/gnunet-gnsrecord-tvg.c b/src/gnsrecord/gnunet-gnsrecord-tvg.c
index f9b83e48b..87de32066 100644
--- a/src/gnsrecord/gnunet-gnsrecord-tvg.c
+++ b/src/gnsrecord/gnunet-gnsrecord-tvg.c
@@ -33,9 +33,6 @@
 #include <inttypes.h>
 #include "gnsrecord_crypto.h"
 
-#define TEST_RECORD_LABEL "test"
-#define TEST_RECORD_A "1.2.3.4"
-#define TEST_RRCOUNT 2
 
 static char *d_pkey =
   "50d7b652a4efeadff37396909785e5952171a02178c8e7d450fa907925fafd98";
@@ -43,7 +40,9 @@ static char *d_pkey =
 static char *d_edkey =
   "5af7020ee19160328832352bbc6a68a8d71a7cbe1b929969a7c66d415a0d8f65";
 
-int parsehex (char *src, char *dst, size_t dstlen, int invert)
+
+static int
+parsehex (char *src, char *dst, size_t dstlen, int invert)
 {
   char *line = src;
   char *data = line;
@@ -83,6 +82,7 @@ print_bytes_ (void *buf,
   printf ("\n");
 }
 
+
 static void
 print_bytes (void *buf,
              size_t buf_len,
@@ -95,7 +95,7 @@ print_bytes (void *buf,
 static void
 print_record (const struct GNUNET_GNSRECORD_Data *rd)
 {
-
+  uint16_t flags = htons (rd->flags);
   fprintf (stdout,
            "EXPIRATION: %" PRIu64 "\n", rd->expiration_time);
   fprintf (stdout,
@@ -103,7 +103,9 @@ print_record (const struct GNUNET_GNSRECORD_Data *rd)
   fprintf (stdout,
            "TYPE: %d\n", rd->record_type);
   fprintf (stdout,
-           "FLAGS: %d\n", rd->flags);
+           "FLAGS: ");
+  print_bytes ((void*) &flags, sizeof (flags), 8);
+  printf ("\n");
   fprintf (stdout,
            "DATA:\n");
   print_bytes ((char*) rd->data, rd->data_size, 8);
@@ -120,15 +122,9 @@ print_record (const struct GNUNET_GNSRECORD_Data *rd)
  * @param cfg configuration
  */
 static void
-run_pkey (void)
+run_pkey (struct GNUNET_GNSRECORD_Data *rd, int rd_count, const char *label)
 {
-  struct GNUNET_GNSRECORD_Data rd[2];
   struct GNUNET_TIME_Absolute expire;
-  struct GNUNET_TIME_Absolute now = GNUNET_TIME_absolute_get ();
-  struct GNUNET_TIME_Absolute exp1;
-  struct GNUNET_TIME_Absolute exp2;
-  struct GNUNET_TIME_Relative delta1;
-  struct GNUNET_TIME_Relative delta2;
   struct GNUNET_GNSRECORD_Block *rrblock;
   char *bdata;
   struct GNUNET_IDENTITY_PrivateKey id_priv;
@@ -136,24 +132,12 @@ run_pkey (void)
   struct GNUNET_IDENTITY_PrivateKey pkey_data_p;
   struct GNUNET_IDENTITY_PublicKey pkey_data;
   struct GNUNET_HashCode query;
-  void *data;
-  size_t data_size;
   char *rdata;
   size_t rdata_size;
-  uint32_t rd_count_nbo;
   char ztld[128];
   unsigned char ctr[GNUNET_CRYPTO_AES_KEY_LENGTH / 2];
   unsigned char skey[GNUNET_CRYPTO_AES_KEY_LENGTH];
 
-  /*
-   * Make two different expiration times
-   */
-  GNUNET_STRINGS_fancy_time_to_absolute ("2048-01-23 10:51:34",
-                                         &exp1);
-  GNUNET_STRINGS_fancy_time_to_absolute ("3540-05-22 07:55:01",
-                                         &exp2);
-
-
   id_priv.type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
   GNUNET_CRYPTO_ecdsa_key_create (&id_priv.ecdsa_key);
   parsehex (d_pkey,
@@ -168,13 +152,14 @@ run_pkey (void)
                 sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey), 8, 1);
   fprintf (stdout, "\n");
   fprintf (stdout, "Zone identifier (ztype|zkey):\n");
+  GNUNET_assert (0 < GNUNET_IDENTITY_key_get_length (&id_pub));
   print_bytes (&id_pub, GNUNET_IDENTITY_key_get_length (&id_pub), 8);
   GNUNET_STRINGS_data_to_string (&id_pub,
                                  GNUNET_IDENTITY_key_get_length (&id_pub),
                                  ztld,
                                  sizeof (ztld));
   fprintf (stdout, "\n");
-  fprintf (stdout, "Encoded zone identifier (zkl = zTLD):\n");
+  fprintf (stdout, "zTLD:\n");
   fprintf (stdout, "%s\n", ztld);
   fprintf (stdout, "\n");
 
@@ -183,39 +168,31 @@ run_pkey (void)
   GNUNET_IDENTITY_key_get_public (&pkey_data_p,
                                   &pkey_data);
   fprintf (stdout,
-           "Label: %s\nRRCOUNT: %d\n\n", TEST_RECORD_LABEL, TEST_RRCOUNT);
-  memset (rd, 0, sizeof (struct GNUNET_GNSRECORD_Data) * 2);
-  GNUNET_assert (GNUNET_OK == GNUNET_GNSRECORD_string_to_value (
-                   GNUNET_DNSPARSER_TYPE_A, TEST_RECORD_A, &data, &data_size));
-  rd[0].data = data;
-  rd[0].data_size = data_size;
-  rd[0].expiration_time = exp1.abs_value_us;
-  rd[0].record_type = GNUNET_DNSPARSER_TYPE_A;
-  fprintf (stdout, "Record #0\n");
-  print_record (&rd[0]);
+           "Label: %s\nRRCOUNT: %d\n\n", label, rd_count);
 
-  rd[1].data = "Some nick";
-  rd[1].data_size = sizeof (struct GNUNET_IDENTITY_PublicKey);
-  rd[1].expiration_time = exp2.abs_value_us;
-  rd[1].record_type = GNUNET_GNSRECORD_TYPE_NICK;
-  rd[1].flags = GNUNET_GNSRECORD_RF_PRIVATE;
-  fprintf (stdout, "Record #1\n");
-  print_record (&rd[1]);
+  for (int i = 0; i < rd_count; i++)
+  {
+    fprintf (stdout, "Record #%d\n", i);
+    print_record (&rd[i]);
+  }
 
-  rdata_size = GNUNET_GNSRECORD_records_get_size (TEST_RRCOUNT,
+  rdata_size = GNUNET_GNSRECORD_records_get_size (rd_count,
                                                   rd);
   rdata = GNUNET_malloc (rdata_size);
-  GNUNET_GNSRECORD_records_serialize (2,
+  GNUNET_GNSRECORD_records_serialize (rd_count,
                                       rd,
-                                      rdata_size,
+                                      (size_t) rdata_size,
                                       rdata);
   fprintf (stdout, "RDATA:\n");
-  print_bytes (rdata, rdata_size, 8);
+  print_bytes (rdata,
+               (size_t) rdata_size,
+               8);
   fprintf (stdout, "\n");
-  expire = GNUNET_GNSRECORD_record_get_expiration_time (TEST_RRCOUNT, rd);
+  expire = GNUNET_GNSRECORD_record_get_expiration_time (rd_count, rd,
+                                                        GNUNET_TIME_UNIT_ZERO_ABS);
   GNR_derive_block_aes_key (ctr,
                             skey,
-                            TEST_RECORD_LABEL,
+                            label,
                             GNUNET_TIME_absolute_hton (
                               expire).abs_value_us__,
                             &id_pub.ecdsa_key);
@@ -227,25 +204,26 @@ run_pkey (void)
   print_bytes (skey, sizeof (skey), 8);
   fprintf (stdout, "\n");
   GNUNET_GNSRECORD_query_from_public_key (&id_pub,
-                                          TEST_RECORD_LABEL,
+                                          label,
                                           &query);
   fprintf (stdout, "Storage key (q):\n");
   print_bytes (&query, sizeof (query), 8);
   fprintf (stdout, "\n");
   GNUNET_assert (GNUNET_OK == GNUNET_GNSRECORD_block_create (&id_priv,
                                                              expire,
-                                                             TEST_RECORD_LABEL,
+                                                             label,
                                                              rd,
-                                                             TEST_RRCOUNT,
+                                                             rd_count,
                                                              &rrblock));
-  size_t bdata_size = ntohl(rrblock->size) - sizeof (struct GNUNET_GNSRECORD_Block);
+  size_t bdata_size = ntohl (rrblock->size) - sizeof (struct
+                                                      GNUNET_GNSRECORD_Block);
 
   bdata = (char*) &(&rrblock->ecdsa_block)[1];
   fprintf (stdout, "BDATA:\n");
   print_bytes (bdata, bdata_size, 8);
   fprintf (stdout, "\n");
   fprintf (stdout, "RRBLOCK:\n");
-  print_bytes (rrblock, ntohl(rrblock->size), 8);
+  print_bytes (rrblock, ntohl (rrblock->size), 8);
   fprintf (stdout, "\n");
   GNUNET_free (rdata);
 }
@@ -260,15 +238,9 @@ run_pkey (void)
  * @param cfg configuration
  */
 static void
-run_edkey (void)
+run_edkey (struct GNUNET_GNSRECORD_Data *rd, int rd_count, const char*label)
 {
-  struct GNUNET_GNSRECORD_Data rd[2];
   struct GNUNET_TIME_Absolute expire;
-  struct GNUNET_TIME_Absolute now = GNUNET_TIME_absolute_get ();
-  struct GNUNET_TIME_Absolute exp1;
-  struct GNUNET_TIME_Absolute exp2;
-  struct GNUNET_TIME_Relative delta1;
-  struct GNUNET_TIME_Relative delta2;
   struct GNUNET_GNSRECORD_Block *rrblock;
   char *bdata;
   struct GNUNET_IDENTITY_PrivateKey id_priv;
@@ -276,23 +248,13 @@ run_edkey (void)
   struct GNUNET_IDENTITY_PrivateKey pkey_data_p;
   struct GNUNET_IDENTITY_PublicKey pkey_data;
   struct GNUNET_HashCode query;
-  void *data;
-  size_t data_size;
   char *rdata;
   size_t rdata_size;
-  uint32_t rd_count_nbo;
+
   char ztld[128];
   unsigned char nonce[crypto_secretbox_NONCEBYTES];
   unsigned char skey[crypto_secretbox_KEYBYTES];
 
-  /*
-   * Make two different expiration times
-   */
-  GNUNET_STRINGS_fancy_time_to_absolute ("%2048-01-23 10:51:34",
-                                         &exp1);
-  GNUNET_STRINGS_fancy_time_to_absolute ("3540-05-22 07:55:01",
-                                         &exp2);
-
   id_priv.type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
   GNUNET_CRYPTO_ecdsa_key_create (&id_priv.ecdsa_key);
   GNUNET_IDENTITY_key_get_public (&id_priv,
@@ -311,13 +273,14 @@ run_edkey (void)
                                            GNUNET_CRYPTO_EddsaPrivateKey), 8);
   fprintf (stdout, "\n");
   fprintf (stdout, "Zone identifier (ztype|zkey):\n");
+  GNUNET_assert (0 < GNUNET_IDENTITY_key_get_length (&id_pub));
   print_bytes (&id_pub, GNUNET_IDENTITY_key_get_length (&id_pub), 8);
   GNUNET_STRINGS_data_to_string (&id_pub,
                                  GNUNET_IDENTITY_key_get_length (&id_pub),
                                  ztld,
                                  sizeof (ztld));
   fprintf (stdout, "\n");
-  fprintf (stdout, "Encoded zone identifier (zkl = zTLD):\n");
+  fprintf (stdout, "zTLD:\n");
   fprintf (stdout, "%s\n", ztld);
   fprintf (stdout, "\n");
 
@@ -326,40 +289,33 @@ run_edkey (void)
   GNUNET_IDENTITY_key_get_public (&pkey_data_p,
                                   &pkey_data);
   fprintf (stdout,
-           "Label: %s\nRRCOUNT: %d\n\n", TEST_RECORD_LABEL, TEST_RRCOUNT);
-  memset (rd, 0, sizeof (struct GNUNET_GNSRECORD_Data) * 2);
-  GNUNET_assert (GNUNET_OK == GNUNET_GNSRECORD_string_to_value (
-                   GNUNET_DNSPARSER_TYPE_A, TEST_RECORD_A, &data, &data_size));
-  rd[0].data = data;
-  rd[0].data_size = data_size;
-  rd[0].expiration_time = exp1.abs_value_us;
-  rd[0].record_type = GNUNET_DNSPARSER_TYPE_A;
-  fprintf (stdout, "Record #0\n");
-  print_record (&rd[0]);
+           "Label: %s\nRRCOUNT: %d\n\n", label, rd_count);
 
-  rd[1].data = "My Nick";
-  rd[1].data_size = sizeof (struct GNUNET_IDENTITY_PublicKey);
-  rd[1].expiration_time = exp2.abs_value_us;
-  rd[1].record_type = GNUNET_GNSRECORD_TYPE_NICK;
-  rd[1].flags = GNUNET_GNSRECORD_RF_PRIVATE;
-  fprintf (stdout, "Record #1\n");
-  print_record (&rd[1]);
+  for (int i = 0; i < rd_count; i++)
+  {
+    fprintf (stdout, "Record #%d\n", i);
+    print_record (&rd[i]);
+  }
 
-  rdata_size = GNUNET_GNSRECORD_records_get_size (TEST_RRCOUNT,
+  rdata_size = GNUNET_GNSRECORD_records_get_size (rd_count,
                                                   rd);
-  expire = GNUNET_GNSRECORD_record_get_expiration_time (TEST_RRCOUNT,
-                                                        rd);
-  rdata = GNUNET_malloc (rdata_size);
-  GNUNET_GNSRECORD_records_serialize (2,
+  expire = GNUNET_GNSRECORD_record_get_expiration_time (rd_count,
+                                                        rd,
+                                                        GNUNET_TIME_UNIT_ZERO_ABS);
+  GNUNET_assert (0 < rdata_size);
+  rdata = GNUNET_malloc ((size_t) rdata_size);
+  GNUNET_GNSRECORD_records_serialize (rd_count,
                                       rd,
-                                      rdata_size,
+                                      (size_t) rdata_size,
                                       rdata);
   fprintf (stdout, "RDATA:\n");
-  print_bytes (rdata, rdata_size, 8);
+  print_bytes (rdata,
+               (size_t) rdata_size,
+               8);
   fprintf (stdout, "\n");
   GNR_derive_block_xsalsa_key (nonce,
                                skey,
-                               TEST_RECORD_LABEL,
+                               label,
                                GNUNET_TIME_absolute_hton (
                                  expire).abs_value_us__,
                                &id_pub.eddsa_key);
@@ -370,7 +326,7 @@ run_edkey (void)
   print_bytes (skey, sizeof (skey), 8);
   fprintf (stdout, "\n");
   GNUNET_GNSRECORD_query_from_public_key (&id_pub,
-                                          TEST_RECORD_LABEL,
+                                          label,
                                           &query);
   fprintf (stdout, "Storage key (q):\n");
   print_bytes (&query, sizeof (query), 8);
@@ -378,18 +334,19 @@ run_edkey (void)
 
   GNUNET_assert (GNUNET_OK ==  GNUNET_GNSRECORD_block_create (&id_priv,
                                                               expire,
-                                                              TEST_RECORD_LABEL,
+                                                              label,
                                                               rd,
-                                                              TEST_RRCOUNT,
+                                                              rd_count,
                                                               &rrblock));
-  size_t bdata_size = ntohl(rrblock->size) - sizeof (struct GNUNET_GNSRECORD_Block);
+  size_t bdata_size = ntohl (rrblock->size) - sizeof (struct
+                                                      GNUNET_GNSRECORD_Block);
 
   bdata = (char*) &(&rrblock->eddsa_block)[1];
   fprintf (stdout, "BDATA:\n");
   print_bytes (bdata, bdata_size, 8);
   fprintf (stdout, "\n");
   fprintf (stdout, "RRBLOCK:\n");
-  print_bytes (rrblock, ntohl(rrblock->size), 8);
+  print_bytes (rrblock, ntohl (rrblock->size), 8);
   fprintf (stdout, "\n");
   GNUNET_free (rdata);
 }
@@ -409,8 +366,67 @@ run (void *cls,
      const char *cfgfile,
      const struct GNUNET_CONFIGURATION_Handle *cfg)
 {
-  run_pkey ();
-  run_edkey ();
+  struct GNUNET_GNSRECORD_Data rd_pkey;
+  struct GNUNET_GNSRECORD_Data rd[3];
+  struct GNUNET_TIME_Absolute exp1;
+  struct GNUNET_TIME_Absolute exp2;
+  struct GNUNET_TIME_Relative exp3;
+  size_t pkey_data_size;
+  size_t ip_data_size;
+  char *pkey_data;
+  char *ip_data;
+
+  /*
+   * Make different expiration times
+   */
+  GNUNET_STRINGS_fancy_time_to_absolute ("2048-01-23 10:51:34",
+                                         &exp1);
+  GNUNET_STRINGS_fancy_time_to_absolute ("3540-05-22 07:55:01",
+                                         &exp2);
+  GNUNET_STRINGS_fancy_time_to_relative ("100y",
+                                         &exp3);
+
+
+  memset (&rd_pkey, 0, sizeof (struct GNUNET_GNSRECORD_Data));
+  GNUNET_assert (GNUNET_OK == GNUNET_GNSRECORD_string_to_value (
+                   GNUNET_GNSRECORD_TYPE_PKEY,
+                   "000G0011WESGZY9VRV9NNJ66W3GKNZFZF56BFD2BQF3MHMJST2G2GKDYGG",
+                   (void**) &pkey_data,
+                   &pkey_data_size));
+  rd_pkey.data = pkey_data;
+  rd_pkey.data_size = pkey_data_size;
+  rd_pkey.expiration_time = exp1.abs_value_us;
+  rd_pkey.record_type = GNUNET_GNSRECORD_TYPE_PKEY;
+  rd_pkey.flags = GNUNET_GNSRECORD_RF_CRITICAL;
+  GNUNET_assert (GNUNET_OK == GNUNET_GNSRECORD_string_to_value (
+                   GNUNET_DNSPARSER_TYPE_AAAA,
+                   "::dead:beef",
+                   (void**) &ip_data,
+                   &ip_data_size));
+
+  rd[0].data = ip_data;
+  rd[0].data_size = ip_data_size;
+  rd[0].expiration_time = exp1.abs_value_us;
+  rd[0].record_type = GNUNET_DNSPARSER_TYPE_AAAA;
+  rd[0].flags = GNUNET_GNSRECORD_RF_NONE;
+
+  rd[1].data = "\u611b\u79f0";
+  rd[1].data_size = strlen (rd[1].data);
+  rd[1].expiration_time = exp2.abs_value_us;
+  rd[1].record_type = GNUNET_GNSRECORD_TYPE_NICK;
+  rd[1].flags = GNUNET_GNSRECORD_RF_PRIVATE;
+
+  rd[2].data = "Hello World";
+  rd[2].data_size = strlen (rd[2].data);
+  rd[2].expiration_time = exp3.rel_value_us;
+  rd[2].record_type = GNUNET_DNSPARSER_TYPE_TXT;
+  rd[2].flags = GNUNET_GNSRECORD_RF_SUPPLEMENTAL
+                | GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION;
+
+  run_pkey (&rd_pkey, 1, "testdelegation");
+  run_pkey (rd, 3, "namesystem");
+  run_edkey (&rd_pkey, 1, "testdelegation");
+  run_edkey (rd, 3, "namesystem");
 }
 
 
diff --git a/src/gnsrecord/perf_gnsrecord_crypto.c b/src/gnsrecord/perf_gnsrecord_crypto.c
index d9a3c20cf..6b5f84235 100644
--- a/src/gnsrecord/perf_gnsrecord_crypto.c
+++ b/src/gnsrecord/perf_gnsrecord_crypto.c
@@ -90,12 +90,12 @@ run (void *cls,
   start_time = GNUNET_TIME_absolute_get ();
   for (unsigned int i = 0; i < ROUNDS; i++)
   {
-    GNUNET_assert (NULL != (block =
-                              GNUNET_GNSRECORD_block_create2 (&privkey,
+    GNUNET_assert (GNUNET_OK == GNUNET_GNSRECORD_block_create2 (&privkey,
                                                               expire,
                                                               s_name,
                                                               s_rd,
-                                                              RECORDS)));
+                                                              RECORDS,
+                                                              &block));
     GNUNET_GNSRECORD_query_from_private_key (&privkey,
                                              s_name,
                                              &query);
diff --git a/src/gnsrecord/plugin_gnsrecord_dns.c b/src/gnsrecord/plugin_gnsrecord_dns.c
index 123c59905..649133cd1 100644
--- a/src/gnsrecord/plugin_gnsrecord_dns.c
+++ b/src/gnsrecord/plugin_gnsrecord_dns.c
@@ -773,6 +773,12 @@ dns_number_to_typename (void *cls, uint32_t type)
 }
 
 
+static enum GNUNET_GenericReturnValue
+dns_is_critical (void *cls, uint32_t type)
+{
+  return GNUNET_NO;
+}
+
 /**
  * Entry point for the plugin.
  *
@@ -789,6 +795,7 @@ libgnunet_plugin_gnsrecord_dns_init (void *cls)
   api->string_to_value = &dns_string_to_value;
   api->typename_to_number = &dns_typename_to_number;
   api->number_to_typename = &dns_number_to_typename;
+  api->is_critical = &dns_is_critical;
   return api;
 }
 
diff --git a/src/gnsrecord/test_gnsrecord_block_expiration.c b/src/gnsrecord/test_gnsrecord_block_expiration.c
index b53d7d7e8..d14ce3914 100644
--- a/src/gnsrecord/test_gnsrecord_block_expiration.c
+++ b/src/gnsrecord/test_gnsrecord_block_expiration.c
@@ -72,7 +72,8 @@ run (void *cls, char *const *args, const char *cfgfile,
 
   GNUNET_assert (expiration_abs.abs_value_us ==
                  GNUNET_GNSRECORD_record_get_expiration_time (2,
-                                                              rd).abs_value_us);
+                                                              rd,
+                                                              GNUNET_TIME_UNIT_ZERO_ABS).abs_value_us);
 
   rd[1].expiration_time = expiration_abs_shadow.abs_value_us;
   rd[1].record_type = TEST_RECORD_TYPE;
@@ -83,7 +84,8 @@ run (void *cls, char *const *args, const char *cfgfile,
 
   GNUNET_assert (expiration_abs_shadow.abs_value_us ==
                  GNUNET_GNSRECORD_record_get_expiration_time (2,
-                                                              rd).abs_value_us);
+                                                              rd,
+                                                              GNUNET_TIME_UNIT_ZERO_ABS).abs_value_us);
   res = 0;
 }
 
diff --git a/src/gnsrecord/test_gnsrecord_testvectors.c b/src/gnsrecord/test_gnsrecord_testvectors.c
index 153c56261..bb4922417 100644
--- a/src/gnsrecord/test_gnsrecord_testvectors.c
+++ b/src/gnsrecord/test_gnsrecord_testvectors.c
@@ -10,16 +10,16 @@
 
 
 static char *d =
-"50d7b652a4efeadff37396909785e5952171a02178c8e7d450fa907925fafd98";
+  "50d7b652a4efeadff37396909785e5952171a02178c8e7d450fa907925fafd98";
 
 
 static char *zid =
-"00010000677c477d2d93097c85b195c6f96d84ff61f5982c2c4fe02d5a11fedfb0c2901f";
+  "00010000677c477d2d93097c85b195c6f96d84ff61f5982c2c4fe02d5a11fedfb0c2901f";
 
 #define RRCOUNT 2
-#define LABEL "test"
+#define LABEL "namesystem"
 
-#define R0_EXPIRATION 14888744139323793
+#define R0_EXPIRATION 
 #define R0_DATA_SIZE 4
 #define R0_TYPE 1
 #define R0_FLAGS 0
@@ -31,12 +31,12 @@ static char *zid =
 #define R1_TYPE 65536
 #define R1_FLAGS 2
 #define R1_DATA \
-"000100000e601be42eb57fb4697610cf3a3b18347b65a33f025b5b174abefb30807bfecf"
+  "000100000e601be42eb57fb4697610cf3a3b18347b65a33f025b5b174abefb30807bfecf"
 
 #define R1_RRBLOCK \
-"000100008e16da87203b5159c5538e9b765742e968c54af9afbc0890dc80205ad14c84e107b0c115fc0089aa38b9c7ab9cbe1d77040d282a51a2ad493f61f3495f02d8170fe473a55ec6bdf9a509ab1701ffc37ea3bb4cac4a672520986df96e67cc1a73000000940000000f0034e53be193799100e4837eb5d04f92903de4b5234e8ccac5736c9793379a59c33375fc8951aca2eb7aad067bf9af60bf26758646a17f5e5c3b6215f94079545b1c4d4f1b2ebb22c2b4dad44126817b6f001530d476401dd67ac0148554e806353da9e4298079f3e1b16942c48d90c4360c61238c40d9d52911aea52cc0037ac7160bb3cf5b2f4a722fd96b"
+  "000100008e16da87203b5159c5538e9b765742e968c54af9afbc0890dc80205ad14c84e107b0c115fc0089aa38b9c7ab9cbe1d77040d282a51a2ad493f61f3495f02d8170fe473a55ec6bdf9a509ab1701ffc37ea3bb4cac4a672520986df96e67cc1a73000000940000000f0034e53be193799100e4837eb5d04f92903de4b5234e8ccac5736c9793379a59c33375fc8951aca2eb7aad067bf9af60bf26758646a17f5e5c3b6215f94079545b1c4d4f1b2ebb22c2b4dad44126817b6f001530d476401dd67ac0148554e806353da9e4298079f3e1b16942c48d90c4360c61238c40d9d52911aea52cc0037ac7160bb3cf5b2f4a722fd96b"
 
-int parsehex(char *src, char *dst, size_t dstlen, int invert)
+int parsehex (char *src, char *dst, size_t dstlen, int invert)
 {
   char *line = src;
   char *data = line;
@@ -44,7 +44,8 @@ int parsehex(char *src, char *dst, size_t dstlen, int invert)
   int read_byte;
   int data_len = 0;
 
-  while (sscanf(data, " %02x%n", &read_byte, &off) == 1) {
+  while (sscanf (data, " %02x%n", &read_byte, &off) == 1)
+  {
     if (invert)
       dst[dstlen - 1 - data_len++] = read_byte;
     else
@@ -62,8 +63,8 @@ res_checker (void *cls,
   int r1_found = 0;
   char r0_data[R0_DATA_SIZE];
   char r1_data[R1_DATA_SIZE];
-  parsehex(R0_DATA, (char*)r0_data, 0, 0);
-  parsehex(R1_DATA, (char*)r1_data, 0, 0);
+  parsehex (R0_DATA, (char*) r0_data, 0, 0);
+  parsehex (R1_DATA, (char*) r1_data, 0, 0);
   GNUNET_assert (rd_count == RRCOUNT);
   for (int i = 0; i < RRCOUNT; i++)
   {
@@ -104,7 +105,7 @@ res_checker (void *cls,
 
 
 int
-main()
+main ()
 {
   struct GNUNET_IDENTITY_PrivateKey priv;
   struct GNUNET_IDENTITY_PublicKey pub;
@@ -112,13 +113,15 @@ main()
   struct GNUNET_GNSRECORD_Block *rrblock;
   char *bdata;
 
-  parsehex(d,(char*)&priv.ecdsa_key, sizeof (priv.ecdsa_key), 1);
+  parsehex (d,(char*) &priv.ecdsa_key, sizeof (priv.ecdsa_key), 1);
   priv.type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
-  parsehex(zid,(char*)&pub_parsed, 0, 0);
-  GNUNET_IDENTITY_key_get_public(&priv, &pub);
+  parsehex (zid,(char*) &pub_parsed, 0, 0);
+  GNUNET_IDENTITY_key_get_public (&priv, &pub);
   GNUNET_assert (0 == memcmp (&pub, &pub_parsed, sizeof (pub)));
   rrblock = GNUNET_malloc (strlen (R1_RRBLOCK) / 2);
-  parsehex(R1_RRBLOCK, (char*)rrblock, 0, 0);
+  parsehex (R1_RRBLOCK, (char*) rrblock, 0, 0);
+  GNUNET_assert (GNUNET_YES
+                 == GNUNET_GNSRECORD_is_critical (GNUNET_GNSRECORD_TYPE_PKEY));
   GNUNET_GNSRECORD_block_decrypt (rrblock,
                                   &pub_parsed,
                                   LABEL,
diff --git a/src/hello/.gitignore b/src/hello/.gitignore
index bb49ceb20..d175d148e 100644
--- a/src/hello/.gitignore
+++ b/src/hello/.gitignore
@@ -1,3 +1,5 @@
 gnunet-hello
 test_friend_hello
 test_hello
+test_hello-uri
+test_hello-ng
diff --git a/src/hello/Makefile.am b/src/hello/Makefile.am
index 6a250e42f..c04b85106 100644
--- a/src/hello/Makefile.am
+++ b/src/hello/Makefile.am
@@ -11,7 +11,8 @@ lib_LTLIBRARIES = libgnunethello.la
 libgnunethello_la_SOURCES = \
   hello.c \
   address.c \
-  hello-ng.c
+  hello-ng.c \
+  hello-uri.c
 libgnunethello_la_LIBADD = \
  $(top_builddir)/src/util/libgnunetutil.la $(XLIB) \
  $(LTLIBINTL)
@@ -24,6 +25,7 @@ noinst_PROGRAMS = \
 
 check_PROGRAMS = \
  test_hello \
+ test_hello-uri \
  test_friend_hello \
  test_hello-ng
 
@@ -36,25 +38,32 @@ test_hello_SOURCES = \
  test_hello.c
 test_hello_LDADD = \
  libgnunethello.la \
- $(top_builddir)/src/util/libgnunetutil.la  
+ $(top_builddir)/src/util/libgnunetutil.la
 
 test_hello_ng_SOURCES = \
  test_hello-ng.c
 test_hello_ng_LDADD = \
  libgnunethello.la \
- $(top_builddir)/src/util/libgnunetutil.la  
+ $(top_builddir)/src/util/libgnunetutil.la
+
+test_hello_uri_SOURCES = \
+ test_hello-uri.c
+test_hello_uri_LDADD = \
+ libgnunethello.la \
+ $(top_builddir)/src/util/libgnunetutil.la \
+ -lgcrypt
 
 
 test_friend_hello_SOURCES = \
  test_friend_hello.c
 test_friend_hello_LDADD = \
  libgnunethello.la \
- $(top_builddir)/src/util/libgnunetutil.la  
+ $(top_builddir)/src/util/libgnunetutil.la
 
 gnunet_hello_SOURCES = \
  gnunet-hello.c
 gnunet_hello_LDADD = \
  libgnunethello.la \
- $(top_builddir)/src/util/libgnunetutil.la  
+ $(top_builddir)/src/util/libgnunetutil.la
 gnunet_hello_LDFLAGS = \
   $(GN_LIBINTL)
diff --git a/src/hello/hello-uri.c b/src/hello/hello-uri.c
new file mode 100644
index 000000000..bacaf697e
--- /dev/null
+++ b/src/hello/hello-uri.c
@@ -0,0 +1,891 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2022 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file hello/hello-uri.c
+ * @brief helper library for handling URI-based HELLOs
+ * @author Christian Grothoff
+ *
+ * Note:
+ * - Current API does not support deserializing HELLO of
+ *   another peer and then serializing it into another
+ *   format (we always require the private key).
+ *   Not sure if we need this, but if we do, we need
+ *   to extend the builder and the API.
+ * - Current API does not allow overriding the default
+ *   HELLO expiration time. We may want to add a function
+ *   that does this to create bootstrap HELLOs shipped with
+ *   the TGZ.
+ */
+#include "platform.h"
+#include "gnunet_signatures.h"
+#include "gnunet_hello_uri_lib.h"
+#include "gnunet_protocols.h"
+#include "gnunet_util_lib.h"
+
+
+GNUNET_NETWORK_STRUCT_BEGIN
+
+/**
+ * Message signed as part of a HELLO block/URL.
+ */
+struct HelloSignaturePurpose
+{
+  /**
+   * Purpose must be #GNUNET_SIGNATURE_PURPOSE_HELLO
+   */
+  struct GNUNET_CRYPTO_EccSignaturePurpose purpose;
+
+  /**
+   * When does the signature expire?
+   */
+  struct GNUNET_TIME_AbsoluteNBO expiration_time;
+
+  /**
+   * Hash over all addresses.
+   */
+  struct GNUNET_HashCode h_addrs;
+
+};
+
+/**
+ * Message used when gossiping HELLOs between peers.
+ */
+struct HelloUriMessage
+{
+  /**
+   * Type must be #GNUNET_MESSAGE_TYPE_HELLO_URI
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * Reserved. 0.
+   */
+  uint16_t reserved GNUNET_PACKED;
+
+  /**
+   * Number of URLs encoded after the end of the struct, in NBO.
+   */
+  uint16_t url_counter GNUNET_PACKED;
+
+  /* followed by a 'block' */
+};
+
+
+/**
+ * Start of a 'block'.
+ */
+struct BlockHeader
+{
+  /**
+   * Public key of the peer.
+   */
+  struct GNUNET_PeerIdentity pid;
+
+  /**
+   * Signature over the block, of purpose #GNUNET_SIGNATURE_PURPOSE_HELLO.
+   */
+  struct GNUNET_CRYPTO_EddsaSignature sig;
+
+  /**
+   * When does the HELLO expire?
+   */
+  struct GNUNET_TIME_AbsoluteNBO expiration_time;
+
+};
+
+
+/**
+ * Message used when a DHT provides its HELLO to direct
+ * neighbours.
+ */
+struct DhtHelloMessage
+{
+  /**
+   * Type must be #GNUNET_MESSAGE_TYPE_DHT_P2P_HELLO
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * Reserved. 0.
+   */
+  uint16_t reserved GNUNET_PACKED;
+
+  /**
+   * Number of URLs encoded after the end of the struct, in NBO.
+   */
+  uint16_t url_counter GNUNET_PACKED;
+
+  /**
+   * Signature over the block, of purpose #GNUNET_SIGNATURE_PURPOSE_HELLO.
+   */
+  struct GNUNET_CRYPTO_EddsaSignature sig;
+
+  /**
+   * When does the HELLO expire?
+   */
+  struct GNUNET_TIME_AbsoluteNBO expiration_time;
+
+  /* followed by the serialized addresses of the 'block' */
+};
+
+
+GNUNET_NETWORK_STRUCT_END
+
+
+/**
+ * Address of a peer.
+ */
+struct Address
+{
+  /**
+   * Kept in a DLL.
+   */
+  struct Address *next;
+
+  /**
+   * Kept in a DLL.
+   */
+  struct Address *prev;
+
+  /**
+   * Actual URI, allocated at the end of this struct.
+   */
+  const char *uri;
+
+  /**
+   * Length of @a uri including 0-terminator.
+   */
+  size_t uri_len;
+};
+
+
+/**
+ * Context for building (or parsing) HELLO URIs.
+ */
+struct GNUNET_HELLO_Builder
+{
+  /**
+   * Public key of the peer.
+   */
+  struct GNUNET_PeerIdentity pid;
+
+  /**
+   * Head of the addresses DLL.
+   */
+  struct Address *a_head;
+
+  /**
+   * Tail of the addresses DLL.
+   */
+  struct Address *a_tail;
+
+  /**
+   * Length of the @a a_head DLL.
+   */
+  unsigned int a_length;
+
+};
+
+
+/**
+ * Compute @a hash over addresses in @a builder.
+ *
+ * @param builder the builder to hash addresses of
+ * @param[out] hash where to write the hash
+ */
+static void
+hash_addresses (const struct GNUNET_HELLO_Builder *builder,
+                struct GNUNET_HashCode *hash)
+{
+  struct GNUNET_HashContext *hc;
+
+  hc = GNUNET_CRYPTO_hash_context_start ();
+  for (struct Address *a = builder->a_head;
+       NULL != a;
+       a = a->next)
+  {
+    GNUNET_CRYPTO_hash_context_read (hc,
+                                     a->uri,
+                                     a->uri_len);
+  }
+  GNUNET_CRYPTO_hash_context_finish (hc,
+                                     hash);
+
+}
+
+
+/**
+ * Create HELLO signature.
+ *
+ * @param builder the builder to use
+ * @param et expiration time to sign
+ * @param priv key to sign with
+ * @param[out] sig where to write the signature
+ */
+static void
+sign_hello (const struct GNUNET_HELLO_Builder *builder,
+            struct GNUNET_TIME_Timestamp et,
+            const struct GNUNET_CRYPTO_EddsaPrivateKey *priv,
+            struct GNUNET_CRYPTO_EddsaSignature *sig)
+{
+  struct HelloSignaturePurpose hsp = {
+    .purpose.size = htonl (sizeof (hsp)),
+    .purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_HELLO),
+    .expiration_time = GNUNET_TIME_absolute_hton (et.abs_time)
+  };
+
+  hash_addresses (builder,
+                  &hsp.h_addrs);
+  GNUNET_CRYPTO_eddsa_sign (priv,
+                            &hsp,
+                            sig);
+}
+
+
+/**
+ * Verify HELLO signature.
+ *
+ * @param builder the builder to use
+ * @param et expiration time to verify
+ * @param sig signature to verify
+ * @return #GNUNET_OK if everything is ok, #GNUNET_NO if the
+ *    HELLO expired, #GNUNET_SYSERR if the signature is wrong
+ */
+static enum GNUNET_GenericReturnValue
+verify_hello (const struct GNUNET_HELLO_Builder *builder,
+              struct GNUNET_TIME_Absolute et,
+              const struct GNUNET_CRYPTO_EddsaSignature *sig)
+{
+  struct HelloSignaturePurpose hsp = {
+    .purpose.size = htonl (sizeof (hsp)),
+    .purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_HELLO),
+    .expiration_time = GNUNET_TIME_absolute_hton (et)
+  };
+
+  hash_addresses (builder,
+                  &hsp.h_addrs);
+  if (GNUNET_OK !=
+      GNUNET_CRYPTO_eddsa_verify (GNUNET_SIGNATURE_PURPOSE_HELLO,
+                                  &hsp,
+                                  sig,
+                                  &builder->pid.public_key))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  if (GNUNET_TIME_absolute_is_past (et))
+    return GNUNET_NO;
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_HELLO_Builder *
+GNUNET_HELLO_builder_new (const struct GNUNET_PeerIdentity *pid)
+{
+  struct GNUNET_HELLO_Builder *builder;
+
+  builder = GNUNET_new (struct GNUNET_HELLO_Builder);
+  builder->pid = *pid;
+  return builder;
+}
+
+
+void
+GNUNET_HELLO_builder_free (struct GNUNET_HELLO_Builder *builder)
+{
+  struct Address *a;
+
+  while (NULL != (a = builder->a_head))
+  {
+    GNUNET_CONTAINER_DLL_remove (builder->a_head,
+                                 builder->a_tail,
+                                 a);
+    builder->a_length--;
+    GNUNET_free (a);
+  }
+  GNUNET_assert (0 == builder->a_length);
+  GNUNET_free (builder);
+}
+
+
+struct GNUNET_HELLO_Builder *
+GNUNET_HELLO_builder_from_msg (const struct GNUNET_MessageHeader *msg)
+{
+  const struct HelloUriMessage *h;
+  uint16_t size = ntohs (msg->size);
+
+  if (GNUNET_MESSAGE_TYPE_HELLO_URI != ntohs (msg->type))
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+  if (sizeof (struct HelloUriMessage) > size)
+  {
+    GNUNET_break_op (0);
+    return NULL;
+  }
+  h = (const struct HelloUriMessage *) msg;
+  size -= sizeof (*h);
+  return GNUNET_HELLO_builder_from_block (&h[1],
+                                          size);
+}
+
+
+struct GNUNET_HELLO_Builder *
+GNUNET_HELLO_builder_from_block (const void *block,
+                                 size_t block_size)
+{
+  const struct BlockHeader *bh = block;
+  struct GNUNET_HELLO_Builder *b;
+
+  if (block_size < sizeof (*bh))
+  {
+    GNUNET_break_op (0);
+    return NULL;
+  }
+  b = GNUNET_HELLO_builder_new (&bh->pid);
+  block += sizeof (*bh);
+  block_size -= sizeof (*bh);
+  while (block_size > 0)
+  {
+    const void *end = memchr (block,
+                              '\0',
+                              block_size);
+
+    if (NULL == end)
+    {
+      GNUNET_break_op (0);
+      GNUNET_HELLO_builder_free (b);
+      return NULL;
+    }
+    if (GNUNET_OK !=
+        GNUNET_HELLO_builder_add_address (b,
+                                          block))
+    {
+      GNUNET_break_op (0);
+      GNUNET_HELLO_builder_free (b);
+      return NULL;
+    }
+    end++;
+    block_size -= (end - block);
+    block = end;
+  }
+  {
+    enum GNUNET_GenericReturnValue ret;
+
+    ret = verify_hello (b,
+                        GNUNET_TIME_absolute_ntoh (bh->expiration_time),
+                        &bh->sig);
+    GNUNET_break (GNUNET_SYSERR != ret);
+    if (GNUNET_OK != ret)
+    {
+      GNUNET_HELLO_builder_free (b);
+      return NULL;
+    }
+  }
+  return b;
+}
+
+
+struct GNUNET_HELLO_Builder *
+GNUNET_HELLO_builder_from_url (const char *url)
+{
+  const char *q;
+  const char *s1;
+  const char *s2;
+  struct GNUNET_PeerIdentity pid;
+  struct GNUNET_CRYPTO_EddsaSignature sig;
+  struct GNUNET_TIME_Absolute et;
+  size_t len;
+  struct GNUNET_HELLO_Builder *b;
+
+  if (0 != strncasecmp (url,
+                        "gnunet://hello/",
+                        strlen ("gnunet://hello/")))
+    return NULL;
+  url += strlen ("gnunet://hello/");
+  s1 = strchr (url, '/');
+  if (NULL == s1)
+  {
+    GNUNET_break_op (0);
+    return NULL;
+  }
+  s2 = strchr (s1 + 1, '/');
+  if (NULL == s1)
+  {
+    GNUNET_break_op (0);
+    return NULL;
+  }
+  q = strchr (url, '?');
+  if (NULL == q)
+    q = url + strlen (url);
+  if (GNUNET_OK !=
+      GNUNET_STRINGS_string_to_data (url,
+                                     s1 - url,
+                                     &pid,
+                                     sizeof(pid)))
+  {
+    GNUNET_break_op (0);
+    return NULL;
+  }
+  if (GNUNET_OK !=
+      GNUNET_STRINGS_string_to_data (s1 + 1,
+                                     s2 - (s1 + 1),
+                                     &sig,
+                                     sizeof(sig)))
+  {
+    GNUNET_break_op (0);
+    return NULL;
+  }
+  {
+    unsigned long long sec;
+    char dummy = '?';
+
+    if ( (0 == sscanf (s2 + 1,
+                       "%llu%c",
+                       &sec,
+                       &dummy)) ||
+         ('?' != dummy) )
+    {
+      GNUNET_break_op (0);
+      return NULL;
+    }
+    et = GNUNET_TIME_absolute_from_s (sec);
+  }
+
+  b = GNUNET_HELLO_builder_new (&pid);
+  len = strlen (q);
+  while (len > 0)
+  {
+    const char *eq;
+    const char *amp;
+    char *addr = NULL;
+    char *uri;
+
+    /* skip ?/& separator */
+    len--;
+    q++;
+    eq = strchr (q, '=');
+    if ( (eq == q) ||
+         (NULL == eq) )
+    {
+      GNUNET_break_op (0);
+      GNUNET_HELLO_builder_free (b);
+      return NULL;
+    }
+    amp = strchr (eq, '&');
+    if (NULL == amp)
+      amp = &q[len];
+    GNUNET_STRINGS_urldecode (eq + 1,
+                              amp - (eq + 1),
+                              &addr);
+    if ( (NULL == addr) ||
+         (0 == strlen (addr)) )
+    {
+      GNUNET_free (addr);
+      GNUNET_break_op (0);
+      GNUNET_HELLO_builder_free (b);
+      return NULL;
+    }
+    GNUNET_asprintf (&uri,
+                     "%.*s://%s",
+                     (int) (eq - q),
+                     q,
+                     addr);
+    GNUNET_free (addr);
+    if (GNUNET_OK !=
+        GNUNET_HELLO_builder_add_address (b,
+                                          uri))
+    {
+      GNUNET_break_op (0);
+      GNUNET_free (uri);
+      GNUNET_HELLO_builder_free (b);
+      return NULL;
+    }
+    GNUNET_free (uri);
+    /* move to next URL */
+    len -= (amp - q);
+    q = amp;
+  }
+
+  {
+    enum GNUNET_GenericReturnValue ret;
+
+    ret = verify_hello (b,
+                        et,
+                        &sig);
+    GNUNET_break (GNUNET_SYSERR != ret);
+    if (GNUNET_OK != ret)
+    {
+      GNUNET_HELLO_builder_free (b);
+      return NULL;
+    }
+  }
+  return b;
+}
+
+
+struct GNUNET_MQ_Envelope *
+GNUNET_HELLO_builder_to_env (const struct GNUNET_HELLO_Builder *builder,
+                             const struct GNUNET_CRYPTO_EddsaPrivateKey *priv)
+{
+  struct GNUNET_MQ_Envelope *env;
+  struct HelloUriMessage *msg;
+  size_t blen;
+
+  if (builder->a_length > UINT16_MAX)
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+  blen = 0;
+  GNUNET_assert (GNUNET_NO ==
+                 GNUNET_HELLO_builder_to_block (builder,
+                                                priv,
+                                                NULL,
+                                                &blen));
+  env = GNUNET_MQ_msg_extra (msg,
+                             blen,
+                             GNUNET_MESSAGE_TYPE_HELLO_URI);
+  msg->url_counter = htonl ((uint16_t) builder->a_length);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_HELLO_builder_to_block (builder,
+                                                priv,
+                                                &msg[1],
+                                                &blen));
+  return env;
+}
+
+
+struct GNUNET_MessageHeader *
+GNUNET_HELLO_builder_to_dht_hello_msg (
+  const struct GNUNET_HELLO_Builder *builder,
+  const struct GNUNET_CRYPTO_EddsaPrivateKey *priv)
+{
+  struct DhtHelloMessage *msg;
+  size_t blen;
+
+  if (builder->a_length > UINT16_MAX)
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+  blen = 0;
+  GNUNET_assert (GNUNET_NO ==
+                 GNUNET_HELLO_builder_to_block (builder,
+                                                priv,
+                                                NULL,
+                                                &blen));
+  GNUNET_assert (blen < UINT16_MAX);
+  GNUNET_assert (blen >= sizeof (struct BlockHeader));
+  {
+    char buf[blen] GNUNET_ALIGN;
+    const struct BlockHeader *block = (const struct BlockHeader *) buf;
+
+    GNUNET_assert (GNUNET_OK ==
+                   GNUNET_HELLO_builder_to_block (builder,
+                                                  priv,
+                                                  buf,
+                                                  &blen));
+    msg = GNUNET_malloc (sizeof (*msg)
+                         + blen
+                         - sizeof (*block));
+    msg->header.type = htons (GNUNET_MESSAGE_TYPE_DHT_P2P_HELLO);
+    msg->header.size = htons (sizeof (*msg)
+                              + blen
+                              - sizeof (*block));
+    memcpy (&msg[1],
+            &block[1],
+            blen - sizeof (*block));
+    msg->sig = block->sig;
+    msg->expiration_time = block->expiration_time;
+  }
+  msg->url_counter = htonl ((uint16_t) builder->a_length);
+  return &msg->header;
+}
+
+
+char *
+GNUNET_HELLO_builder_to_url (const struct GNUNET_HELLO_Builder *builder,
+                             const struct GNUNET_CRYPTO_EddsaPrivateKey *priv)
+{
+  struct GNUNET_CRYPTO_EddsaSignature sig;
+  struct GNUNET_TIME_Timestamp et;
+  char *result;
+  char *pids;
+  char *sigs;
+  const char *sep = "?";
+
+  et = GNUNET_TIME_relative_to_timestamp (GNUNET_HELLO_ADDRESS_EXPIRATION);
+  sign_hello (builder,
+              et,
+              priv,
+              &sig);
+  pids = GNUNET_STRINGS_data_to_string_alloc (&builder->pid,
+                                              sizeof (builder->pid));
+  sigs = GNUNET_STRINGS_data_to_string_alloc (&sig,
+                                              sizeof (sig));
+  GNUNET_asprintf (&result,
+                   "gnunet://hello/%s/%s/%llu",
+                   pids,
+                   sigs,
+                   (unsigned long long) GNUNET_TIME_timestamp_to_s (et));
+  GNUNET_free (sigs);
+  GNUNET_free (pids);
+  for (struct Address *a = builder->a_head;
+       NULL != a;
+       a = a->next)
+  {
+    char *ue;
+    char *tmp;
+    int pfx_len;
+    const char *eou;
+
+    eou = strstr (a->uri,
+                  "://");
+    if (NULL == eou)
+    {
+      GNUNET_break (0);
+      GNUNET_free (result);
+      return NULL;
+    }
+    pfx_len = eou - a->uri;
+    eou += 3;
+    GNUNET_STRINGS_urlencode (eou,
+                              a->uri_len - 4 - pfx_len,
+                              &ue);
+    GNUNET_asprintf (&tmp,
+                     "%s%s%.*s=%s",
+                     result,
+                     sep,
+                     pfx_len,
+                     a->uri,
+                     ue);
+    GNUNET_free (ue);
+    GNUNET_free (result);
+    result = tmp;
+    sep = "&";
+  }
+  return result;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_HELLO_builder_to_block (const struct GNUNET_HELLO_Builder *builder,
+                               const struct GNUNET_CRYPTO_EddsaPrivateKey *priv,
+                               void *block,
+                               size_t *block_size)
+{
+  struct BlockHeader bh;
+  size_t needed = sizeof (bh);
+  char *pos;
+  struct GNUNET_TIME_Timestamp et;
+
+  for (struct Address *a = builder->a_head;
+       NULL != a;
+       a = a->next)
+  {
+    GNUNET_assert (needed + a->uri_len > needed);
+    needed += a->uri_len;
+  }
+  if ( (NULL == block) ||
+       (needed < *block_size) )
+  {
+    *block_size = needed;
+    return GNUNET_NO;
+  }
+  bh.pid = builder->pid;
+  et = GNUNET_TIME_relative_to_timestamp (GNUNET_HELLO_ADDRESS_EXPIRATION);
+  bh.expiration_time = GNUNET_TIME_absolute_hton (et.abs_time);
+  sign_hello (builder,
+              et,
+              priv,
+              &bh.sig);
+  memcpy (block,
+          &bh,
+          sizeof (bh));
+  pos = block + sizeof (bh);
+  for (struct Address *a = builder->a_head;
+       NULL != a;
+       a = a->next)
+  {
+    memcpy (pos,
+            a->uri,
+            a->uri_len);
+    pos += a->uri_len;
+  }
+  *block_size = needed;
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_HELLO_builder_add_address (struct GNUNET_HELLO_Builder *builder,
+                                  const char *address)
+{
+  size_t alen = strlen (address) + 1;
+  struct Address *a;
+  const char *e;
+
+  if (NULL == (e = strstr (address,
+                           "://")))
+  {
+    GNUNET_break_op (0);
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Invalid address `%s'\n",
+                address);
+    return GNUNET_SYSERR;
+  }
+  if (e == address)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  for (const char *p = address; p != e; p++)
+    if ( (! isalpha ((unsigned char) *p)) &&
+         ('+' != *p) )
+    {
+      GNUNET_break_op (0);
+      return GNUNET_SYSERR;
+    }
+  /* check for duplicates */
+  for (a = builder->a_head;
+       NULL != a;
+       a = a->next)
+    if (0 == strcmp (address,
+                     a->uri))
+      return GNUNET_NO;
+  a = GNUNET_malloc (sizeof (struct Address) + alen);
+  a->uri_len = alen;
+  memcpy (&a[1],
+          address,
+          alen);
+  a->uri = (const char *) &a[1];
+  GNUNET_CONTAINER_DLL_insert_tail (builder->a_head,
+                                    builder->a_tail,
+                                    a);
+  builder->a_length++;
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_HELLO_builder_del_address (struct GNUNET_HELLO_Builder *builder,
+                                  const char *address)
+{
+  struct Address *a;
+
+  /* check for duplicates */
+  for (a = builder->a_head;
+       NULL != a;
+       a = a->next)
+    if (0 == strcmp (address,
+                     a->uri))
+      break;
+  if (NULL == a)
+    return GNUNET_NO;
+  GNUNET_CONTAINER_DLL_remove (builder->a_head,
+                               builder->a_tail,
+                               a);
+  builder->a_length--;
+  GNUNET_free (a);
+  return GNUNET_OK;
+}
+
+
+void
+GNUNET_HELLO_builder_iterate (const struct GNUNET_HELLO_Builder *builder,
+                              struct GNUNET_PeerIdentity *pid,
+                              GNUNET_HELLO_UriCallback uc,
+                              void *uc_cls)
+{
+  struct Address *nxt;
+
+  *pid = builder->pid;
+  if (NULL == uc)
+    return;
+  for (struct Address *a = builder->a_head;
+       NULL != a;
+       a = nxt)
+  {
+    nxt = a->next;
+    uc (uc_cls,
+        a->uri);
+  }
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_HELLO_dht_msg_to_block (const struct GNUNET_MessageHeader *hello,
+                               const struct GNUNET_PeerIdentity *pid,
+                               void **block,
+                               size_t *block_size,
+                               struct GNUNET_TIME_Absolute *block_expiration)
+{
+  const struct DhtHelloMessage *msg
+    = (const struct DhtHelloMessage *) hello;
+  uint16_t len = ntohs (hello->size);
+  struct BlockHeader *bh;
+  struct GNUNET_HELLO_Builder *b;
+  enum GNUNET_GenericReturnValue ret;
+
+  if (GNUNET_MESSAGE_TYPE_DHT_P2P_HELLO != ntohs (hello->type))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (len < sizeof (*msg))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  len -= sizeof (*msg);
+  *block_size = len + sizeof (*bh);
+  *block = GNUNET_malloc (*block_size);
+  bh = *block;
+  bh->pid = *pid;
+  bh->sig = msg->sig;
+  bh->expiration_time = msg->expiration_time;
+  *block_expiration = GNUNET_TIME_absolute_ntoh (msg->expiration_time);
+  memcpy (&bh[1],
+          &msg[1],
+          len);
+  b = GNUNET_HELLO_builder_from_block (*block,
+                                       *block_size);
+  if (NULL == b)
+  {
+    GNUNET_break_op (0);
+    GNUNET_free (*block);
+    *block_size = 0;
+    return GNUNET_SYSERR;
+  }
+  ret = verify_hello (b,
+                      *block_expiration,
+                      &msg->sig);
+  GNUNET_HELLO_builder_free (b);
+  if (GNUNET_SYSERR == ret)
+  {
+    GNUNET_free (*block);
+    *block_size = 0;
+    return GNUNET_SYSERR;
+  }
+  return ret;
+}
diff --git a/src/hello/test_hello-ng.c b/src/hello/test_hello-ng.c
index e6b1d42a0..4ace9439f 100644
--- a/src/hello/test_hello-ng.c
+++ b/src/hello/test_hello-ng.c
@@ -1,3 +1,22 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2022 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
 #include "platform.h"
 #include "gnunet_util_lib.h"
 #include "gnunet_nt_lib.h"
@@ -23,12 +42,12 @@ main (int argc,
                              GNUNET_NT_LAN,
                              t,
                              &privKey,
-                             (void**)&res,
+                             (void**) &res,
                              &res_len);
   GNUNET_log (GNUNET_ERROR_TYPE_MESSAGE,
               "%s\n", res);
   GNUNET_assert (NULL !=
-                 GNUNET_HELLO_extract_address ((void**)res,
+                 GNUNET_HELLO_extract_address ((void**) res,
                                                res_len,
                                                &pid,
                                                &nt,
diff --git a/src/hello/test_hello-uri.c b/src/hello/test_hello-uri.c
new file mode 100644
index 000000000..7e70d6763
--- /dev/null
+++ b/src/hello/test_hello-uri.c
@@ -0,0 +1,212 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2022 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file hello/test_hello-uri.c
+ * @brief test for helper library for handling URI-based HELLOs
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_signatures.h"
+#include "gnunet_hello_uri_lib.h"
+#include "gnunet_util_lib.h"
+
+
+/**
+ * Check for expected URIs.
+ *
+ * @param cls a `unsigned int*`, bitmask set to found URIs
+ * @param uri URI to check for
+ */
+static void
+check_uris (void *cls,
+            const char *uri)
+{
+  unsigned int *found = cls;
+
+  if (0 == strcmp (uri,
+                   "test://address"))
+    *found |= 1;
+  else if (0 == strcmp (uri,
+                        "test://more"))
+    *found |= 2;
+  else
+    *found = (unsigned int) -1;
+}
+
+
+int
+main (int argc,
+      char *argv[])
+{
+  struct GNUNET_PeerIdentity pid;
+  struct GNUNET_HELLO_Builder *b;
+  struct GNUNET_CRYPTO_EddsaPrivateKey priv;
+
+  GNUNET_log_setup ("test-hell-uri",
+                    "WARNING",
+                    NULL);
+  GNUNET_CRYPTO_eddsa_key_create (&priv);
+  GNUNET_CRYPTO_eddsa_key_get_public (&priv,
+                                      &pid.public_key);
+  b = GNUNET_HELLO_builder_new (&pid);
+  GNUNET_assert (GNUNET_SYSERR ==
+                 GNUNET_HELLO_builder_add_address (b,
+                                                   "invalid"));
+  GNUNET_assert (GNUNET_SYSERR ==
+                 GNUNET_HELLO_builder_add_address (b,
+                                                   "i%v://bla"));
+  GNUNET_assert (GNUNET_SYSERR ==
+                 GNUNET_HELLO_builder_add_address (b,
+                                                   "://empty"));
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_HELLO_builder_add_address (b,
+                                                   "test://address"));
+  GNUNET_assert (GNUNET_NO ==
+                 GNUNET_HELLO_builder_add_address (b,
+                                                   "test://address"));
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_HELLO_builder_add_address (b,
+                                                   "test://more"));
+  {
+    void *block;
+    size_t block_size = 0;
+    struct GNUNET_HELLO_Builder *b2;
+    struct GNUNET_PeerIdentity p2;
+    unsigned int found;
+
+    GNUNET_assert (GNUNET_NO ==
+                   GNUNET_HELLO_builder_to_block (b,
+                                                  &priv,
+                                                  NULL,
+                                                  &block_size));
+    GNUNET_assert (GNUNET_NO ==
+                   GNUNET_HELLO_builder_to_block (b,
+                                                  &priv,
+                                                  NULL,
+                                                  &block_size));
+    GNUNET_assert (0 != block_size);
+    block = GNUNET_malloc (block_size);
+    GNUNET_assert (GNUNET_OK ==
+                   GNUNET_HELLO_builder_to_block (b,
+                                                  &priv,
+                                                  block,
+                                                  &block_size));
+    b2 = GNUNET_HELLO_builder_from_block (block,
+                                          block_size);
+    GNUNET_free (block);
+    GNUNET_assert (NULL != b2);
+    found = 0;
+    GNUNET_HELLO_builder_iterate (b2,
+                                  &p2,
+                                  &check_uris,
+                                  &found);
+    GNUNET_assert (3 == found);
+    GNUNET_assert (0 ==
+                   GNUNET_memcmp (&p2,
+                                  &pid));
+    GNUNET_HELLO_builder_free (b2);
+  }
+
+  {
+    char *url;
+    struct GNUNET_HELLO_Builder *b2;
+    struct GNUNET_PeerIdentity p2;
+    unsigned int found;
+
+    url = GNUNET_HELLO_builder_to_url (b,
+                                       &priv);
+    b2 = GNUNET_HELLO_builder_from_url (url);
+    GNUNET_free (url);
+    GNUNET_assert (NULL != b2);
+    found = 0;
+    GNUNET_HELLO_builder_iterate (b2,
+                                  &p2,
+                                  &check_uris,
+                                  &found);
+    GNUNET_assert (3 == found);
+    GNUNET_assert (0 ==
+                   GNUNET_memcmp (&p2,
+                                  &pid));
+    GNUNET_HELLO_builder_free (b2);
+  }
+
+  {
+    struct GNUNET_MQ_Envelope *env;
+    struct GNUNET_HELLO_Builder *b2;
+    struct GNUNET_PeerIdentity p2;
+    unsigned int found;
+
+    env = GNUNET_HELLO_builder_to_env (b,
+                                       &priv);
+    b2 = GNUNET_HELLO_builder_from_msg (GNUNET_MQ_env_get_msg (env));
+    GNUNET_free (env);
+    GNUNET_assert (NULL != b2);
+    found = 0;
+    GNUNET_HELLO_builder_iterate (b2,
+                                  &p2,
+                                  &check_uris,
+                                  &found);
+    GNUNET_assert (3 == found);
+    GNUNET_assert (0 ==
+                   GNUNET_memcmp (&p2,
+                                  &pid));
+    GNUNET_HELLO_builder_free (b2);
+  }
+
+  GNUNET_HELLO_builder_free (b);
+
+  GNUNET_CRYPTO_mpi_print_unsigned (priv.d,
+                                    sizeof (priv.d),
+                                    GCRYMPI_CONST_ONE);
+  priv.d[0] &= 248;
+  priv.d[31] &= 127;
+  priv.d[31] |= 64;
+  {
+    char *buf;
+
+    buf = GNUNET_STRINGS_data_to_string_alloc (&priv,
+                                               sizeof (priv));
+    fprintf (stderr,
+             "PK: %s\n",
+             buf);
+    GNUNET_free (buf);
+  }
+  GNUNET_CRYPTO_eddsa_key_get_public (&priv,
+                                      &pid.public_key);
+  b = GNUNET_HELLO_builder_new (&pid);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_HELLO_builder_add_address (b,
+                                                   "a://first"));
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_HELLO_builder_add_address (b,
+                                                   "b://second"));
+  {
+    char *url;
+
+    url = GNUNET_HELLO_builder_to_url (b,
+                                       &priv);
+    fprintf (stderr,
+             "TV: %s\n",
+             url);
+    GNUNET_free (url);
+  }
+
+  return 0;
+}
diff --git a/src/hostlist/gnunet-daemon-hostlist_client.c b/src/hostlist/gnunet-daemon-hostlist_client.c
index 44966d3de..1f7d4cc35 100644
--- a/src/hostlist/gnunet-daemon-hostlist_client.c
+++ b/src/hostlist/gnunet-daemon-hostlist_client.c
@@ -1635,7 +1635,11 @@ GNUNET_HOSTLIST_client_start (const struct GNUNET_CONFIGURATION_Handle *c,
                                                             "PROXY_TYPE",
                                                             &proxytype_str))
     {
-      GNUNET_STRINGS_utf8_toupper (proxytype_str, proxytype_str);
+      if (GNUNET_OK != GNUNET_STRINGS_utf8_toupper (proxytype_str,
+                                                    proxytype_str))
+        GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                    "Unable to convert `%s' to UTF-8 uppercase\n",
+                    proxytype_str);
       proxy_type = CURLPROXY_HTTP;
       if (0 == strcmp (proxytype_str, "HTTP"))
         proxy_type = CURLPROXY_HTTP;
diff --git a/src/identity/Makefile.am b/src/identity/Makefile.am
index e535c208a..5a2110974 100644
--- a/src/identity/Makefile.am
+++ b/src/identity/Makefile.am
@@ -95,6 +95,7 @@ test_identity_defaults_LDADD = \
   $(top_builddir)/src/util/libgnunetutil.la 
 
 EXTRA_DIST = \
-  test_identity.conf 
+  test_identity.conf \
+  test_identity_messages.sh 
 
 
diff --git a/src/identity/gnunet-service-identity.c b/src/identity/gnunet-service-identity.c
index 2bb4b0897..51f897557 100644
--- a/src/identity/gnunet-service-identity.c
+++ b/src/identity/gnunet-service-identity.c
@@ -489,8 +489,7 @@ handle_get_default_message (void *cls,
   char *identifier;
 
   name = GNUNET_strdup ((const char *) &gdm[1]);
-  GNUNET_STRINGS_utf8_tolower ((const char *) &gdm[1],
-                               name);
+  GNUNET_STRINGS_utf8_tolower ((const char *) &gdm[1], name);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Received GET_DEFAULT for service `%s' from client\n",
               name);
diff --git a/src/include/Makefile.am b/src/include/Makefile.am
index e4b02b8ee..8808f6802 100644
--- a/src/include/Makefile.am
+++ b/src/include/Makefile.am
@@ -57,6 +57,7 @@ gnunetinclude_HEADERS = \
   gnunet_gnsrecord_plugin.h \
   gnu_name_system_record_types.h \
   gnunet_hello_lib.h \
+  gnunet_hello_uri_lib.h \
   gnunet_helper_lib.h \
   gnunet_identity_service.h \
   gnunet_abe_lib.h \
diff --git a/src/include/gnunet_block_group_lib.h b/src/include/gnunet_block_group_lib.h
index 6cb601757..b03e913c6 100644
--- a/src/include/gnunet_block_group_lib.h
+++ b/src/include/gnunet_block_group_lib.h
@@ -94,7 +94,7 @@ GNUNET_BLOCK_GROUP_bf_create (void *cls,
  * @return #GNUNET_YES if @a hc is (likely) a duplicate
  *         #GNUNET_NO if @a hc was definitively not in @bg (but now is)
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_BLOCK_GROUP_bf_test_and_set (struct GNUNET_BLOCK_Group *bg,
                                     const struct GNUNET_HashCode *hc);
 
diff --git a/src/include/gnunet_block_lib.h b/src/include/gnunet_block_lib.h
index 5640209a6..515b8256c 100644
--- a/src/include/gnunet_block_lib.h
+++ b/src/include/gnunet_block_lib.h
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet.
-     Copyright (C) 2010 GNUnet e.V.
+     Copyright (C) 2010, 2022 GNUnet e.V.
 
      GNUnet is free software: you can redistribute it and/or modify it
      under the terms of the GNU Affero General Public License as published
@@ -119,6 +119,12 @@ enum GNUNET_BLOCK_Type
   GNUNET_BLOCK_TYPE_REVOCATION = 12,
 
   /**
+   * Type of a block that contains a DHT-NG HELLO for a peer (for
+   * DHT and CADET find-peer operations).
+   */
+  GNUNET_BLOCK_TYPE_DHT_URL_HELLO = 13,
+
+  /**
    * Block to store a cadet regex state
    */
   GNUNET_BLOCK_TYPE_REGEX = 22,
@@ -156,108 +162,35 @@ enum GNUNET_BLOCK_Type
 
 
 /**
- * Flags that can be set to control the evaluation.
- * @deprecated
- */
-enum GNUNET_BLOCK_EvaluationOptions
-{
-  /**
-   * Default behavior.
-   */
-  GNUNET_BLOCK_EO_NONE = 0,
-
-  /**
-   * The block is obtained from the local database, skip cryptographic
-   * checks.
-   */
-  GNUNET_BLOCK_EO_LOCAL_SKIP_CRYPTO = 1
-};
-
-
-/**
  * Possible ways for how a block may relate to a query.
- * @deprecated
  */
-enum GNUNET_BLOCK_EvaluationResult
+enum GNUNET_BLOCK_ReplyEvaluationResult
 {
-  /**
-   * Valid result, and there may be more.
-   */
-  GNUNET_BLOCK_EVALUATION_OK_MORE = 0,
 
   /**
-   * Last possible valid result.
+   * Specified block type not supported by any plugin.
    */
-  GNUNET_BLOCK_EVALUATION_OK_LAST = 1,
+  GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED = -1,
 
   /**
    * Valid result, but suppressed because it is a duplicate.
    */
-  GNUNET_BLOCK_EVALUATION_OK_DUPLICATE = 2,
-
-  /**
-   * Block does not match query (invalid result)
-   */
-  GNUNET_BLOCK_EVALUATION_RESULT_INVALID = 3,
+  GNUNET_BLOCK_REPLY_OK_DUPLICATE = 0,
 
   /**
    * Block does not match xquery (valid result, not relevant for the request)
    */
-  GNUNET_BLOCK_EVALUATION_RESULT_IRRELEVANT = 4,
-
-  /**
-   * Query is valid, no reply given.
-   */
-  GNUNET_BLOCK_EVALUATION_REQUEST_VALID = 10,
-
-  /**
-   * Query format does not match block type (invalid query).  For
-   * example, xquery not given or xquery_size not appropriate for
-   * type.
-   */
-  GNUNET_BLOCK_EVALUATION_REQUEST_INVALID = 11,
-
-  /**
-   * Specified block type not supported by this plugin.
-   */
-  GNUNET_BLOCK_EVALUATION_TYPE_NOT_SUPPORTED = 20
-};
-
-
-/**
- * Possible ways for how a block may relate to a query.
- */
-enum GNUNET_BLOCK_ReplyEvaluationResult
-{
-  /**
-   * Valid result, but suppressed because it is a duplicate.
-   */
-  GNUNET_BLOCK_REPLY_OK_DUPLICATE = 0,
+  GNUNET_BLOCK_REPLY_IRRELEVANT = 1,
 
   /**
    * Valid result, and there may be more.
    */
-  GNUNET_BLOCK_REPLY_OK_MORE = 1,
+  GNUNET_BLOCK_REPLY_OK_MORE = 2,
 
   /**
    * Last possible valid result.
    */
-  GNUNET_BLOCK_REPLY_OK_LAST = 2,
-
-  /**
-   * Specified block type not supported by any plugin.
-   */
-  GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED = -1,
-
-  /**
-   * Block does not match query (invalid result)
-   */
-  GNUNET_BLOCK_REPLY_INVALID = -2,
-
-  /**
-   * Block does not match xquery (valid result, not relevant for the request)
-   */
-  GNUNET_BLOCK_REPLY_IRRELEVANT = -3,
+  GNUNET_BLOCK_REPLY_OK_LAST = 3
 
 };
 
@@ -356,44 +289,12 @@ GNUNET_BLOCK_group_destroy (struct GNUNET_BLOCK_Group *bg);
 
 
 /**
- * Function called to validate a reply or a request.  For
- * request evaluation, simply pass "NULL" for the @a reply_block.
- * Note that it is assumed that the reply has already been
- * matched to the key (and signatures checked) as it would
- * be done with the #GNUNET_BLOCK_get_key() function.
- *
- * @param ctx block contxt
- * @param type block type
- * @param group block group to use for evaluation
- * @param eo evaluation options to control evaluation
- * @param query original query (hash)
- * @param xquery extrended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in @a xquery
- * @param reply_block response to validate
- * @param reply_block_size number of bytes in @a reply_block
- * @return characterization of result
- * @deprecated
- */
-enum GNUNET_BLOCK_EvaluationResult
-GNUNET_BLOCK_evaluate (struct GNUNET_BLOCK_Context *ctx,
-                       enum GNUNET_BLOCK_Type type,
-                       struct GNUNET_BLOCK_Group *group,
-                       enum GNUNET_BLOCK_EvaluationOptions eo,
-                       const struct GNUNET_HashCode *query,
-                       const void *xquery,
-                       size_t xquery_size,
-                       const void *reply_block,
-                       size_t reply_block_size);
-
-
-/**
- * Function called to validate a reply.
- * Also checks the query key against the block contents
- * as it would be done with the #GNUNET_BLOCK_get_key() function.
+ * Function called to validate if a reply is good for a
+ * particular query.
  *
  * @param ctx block contxt
  * @param type block type
- * @param group block group to use for evaluation
+ * @param[in,out] group block group to use for evaluation
  * @param query original query (hash)
  * @param xquery extrended query data (can be NULL, depending on type)
  * @param xquery_size number of bytes in @a xquery
@@ -436,7 +337,6 @@ GNUNET_BLOCK_check_query (struct GNUNET_BLOCK_Context *ctx,
  *
  * @param ctx block contxt
  * @param type block type
- * @param query query key (hash)
  * @param block payload to put
  * @param block_size number of bytes in @a block
  * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not,
@@ -445,13 +345,14 @@ GNUNET_BLOCK_check_query (struct GNUNET_BLOCK_Context *ctx,
 enum GNUNET_GenericReturnValue
 GNUNET_BLOCK_check_block (struct GNUNET_BLOCK_Context *ctx,
                           enum GNUNET_BLOCK_Type type,
-                          const struct GNUNET_HashCode *query,
                           const void *block,
                           size_t block_size);
 
 
 /**
- * Function called to obtain the key for a block.
+ * Function called to obtain the @a key for a @a block.
+ * If the @a block is malformed, the function should
+ * zero-out @a key and return #GNUNET_OK.
  *
  * @param ctx block context
  * @param type block type
@@ -459,9 +360,8 @@ GNUNET_BLOCK_check_block (struct GNUNET_BLOCK_Context *ctx,
  * @param block_size number of bytes in @a block
  * @param key set to the key (query) for the given block
  * @return #GNUNET_YES on success,
- *         #GNUNET_NO if the block is malformed
- *         #GNUNET_SYSERR if type not supported
- *         (or if extracting a key from a block of this type does not work)
+ *         #GNUNET_NO if extracting a key from a block of this @a type does not work
+ *         #GNUNET_SYSERR if @a type not supported
  */
 enum GNUNET_GenericReturnValue
 GNUNET_BLOCK_get_key (struct GNUNET_BLOCK_Context *ctx,
diff --git a/src/include/gnunet_block_plugin.h b/src/include/gnunet_block_plugin.h
index 2c9a3839d..1fa7ccf8b 100644
--- a/src/include/gnunet_block_plugin.h
+++ b/src/include/gnunet_block_plugin.h
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet
-     Copyright (C) 2010,2013,2017 GNUnet e.V.
+     Copyright (C) 2010, 2013, 2017, 2021, 2022 GNUnet e.V.
 
      GNUnet is free software: you can redistribute it and/or modify it
      under the terms of the GNU Affero General Public License as published
@@ -163,43 +163,9 @@ typedef struct GNUNET_BLOCK_Group *
 
 
 /**
- * Function called to validate a reply or a request.  For
- * request evaluation, simply pass "NULL" for the @a reply_block.
- * Note that it is assumed that the reply has already been
- * matched to the key (and signatures checked) as it would
- * be done with the "get_key" function.
- *
- * @param cls closure
- * @param ctx block context
- * @param type block type
- * @param group which block group to use for evaluation
- * @param eo evaluation options to control evaluation
- * @param query original query (hash)
- * @param xquery extrended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in @a xquery
- * @param reply_block response to validate
- * @param reply_block_size number of bytes in @a reply_block
- * @return characterization of result
- * @deprecated
- */
-typedef enum GNUNET_BLOCK_EvaluationResult
-(*GNUNET_BLOCK_EvaluationFunction)(void *cls,
-                                   struct GNUNET_BLOCK_Context *ctx,
-                                   enum GNUNET_BLOCK_Type type,
-                                   struct GNUNET_BLOCK_Group *group,
-                                   enum GNUNET_BLOCK_EvaluationOptions eo,
-                                   const struct GNUNET_HashCode *query,
-                                   const void *xquery,
-                                   size_t xquery_size,
-                                   const void *reply_block,
-                                   size_t reply_block_size);
-
-
-/**
  * Function called to validate a query.
  *
  * @param cls closure
- * @param ctx block context
  * @param type block type
  * @param query original query (hash)
  * @param xquery extrended query data (can be NULL, depending on type)
@@ -215,19 +181,17 @@ typedef enum GNUNET_GenericReturnValue
 
 
 /**
- * Function called to validate a block for storage.
+ * Function called to validate a @a block for storage.
  *
  * @param cls closure
  * @param type block type
- * @param query key for the block (hash), must match exactly
  * @param block block data to validate
  * @param block_size number of bytes in @a block
- * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
+ * @return #GNUNET_OK if the @a block is fine, #GNUNET_NO if not, #GNUNET_SYSERR if the @a type is not supported
  */
 typedef enum GNUNET_GenericReturnValue
 (*GNUNET_BLOCK_BlockEvaluationFunction)(void *cls,
                                         enum GNUNET_BLOCK_Type type,
-                                        const struct GNUNET_HashCode *query,
                                         const void *block,
                                         size_t block_size);
 
@@ -260,17 +224,18 @@ typedef enum GNUNET_BLOCK_ReplyEvaluationResult
 
 
 /**
- * Function called to obtain the key for a block.
+ * Function called to obtain the @a key for a block.
+ * If the @a block is malformed, the function should
+ * zero-out @a key and return #GNUNET_OK.
  *
  * @param cls closure
  * @param type block type
- * @param block block to get the key for
+ * @param block block to get the @a key for
  * @param block_size number of bytes in @a block
  * @param[out] key set to the key (query) for the given block
  * @return #GNUNET_YES on success,
- *         #GNUNET_NO if the block is malformed
- *         #GNUNET_SYSERR if type not supported
- *         (or if extracting a key from a block of this type does not work)
+ *         #GNUNET_NO if extracting a key for this @a type does not work
+ *         #GNUNET_SYSERR if @a type not supported
  */
 typedef enum GNUNET_GenericReturnValue
 (*GNUNET_BLOCK_GetKeyFunction) (void *cls,
@@ -297,14 +262,6 @@ struct GNUNET_BLOCK_PluginFunctions
   const enum GNUNET_BLOCK_Type *types;
 
   /**
-   * Main function of a block plugin.  Allows us to check if a
-   * block matches a query.
-   *
-   * @param deprecated
-   */
-  GNUNET_BLOCK_EvaluationFunction evaluate;
-
-  /**
    * Obtain the key for a given block (if possible).
    */
   GNUNET_BLOCK_GetKeyFunction get_key;
diff --git a/src/include/gnunet_common.h b/src/include/gnunet_common.h
index 4472d3ee8..9bcd99c7b 100644
--- a/src/include/gnunet_common.h
+++ b/src/include/gnunet_common.h
@@ -623,6 +623,31 @@ GNUNET_abort_ (void) GNUNET_NORETURN;
 
 
 /**
+ * Convert a buffer to an 8-character string
+ * representative of the contents. This is used
+ * for logging binary data when debugging.
+ *
+ * @param buf buffer to log
+ * @param buf_size number of bytes in @a buf
+ * @return text representation of buf, valid until next
+ *         call to this function
+ */
+const char *
+GNUNET_b2s (const void *buf,
+           size_t buf_size);
+
+
+/**
+ * Convert a fixed-sized object to a string using
+ * #GNUNET_b2s().
+ *
+ * @param obj address of object to convert
+ * @return string representing the binary obj buffer
+ */
+#define GNUNET_B2S(obj) GNUNET_b2s ((obj), sizeof (*(obj)))
+
+
+/**
  * @ingroup logging
  * Ignore the next @a n calls to the log function.
  *
@@ -1240,7 +1265,7 @@ GNUNET_is_zero_ (const void *a,
  * @return GNUNET_YES if a is zero, GNUNET_NO otherwise
  */
 #define GNUNET_is_zero(a)           \
-  GNUNET_is_zero_ (a, sizeof (*a))
+  GNUNET_is_zero_ ((a), sizeof (*(a)))
 
 
 /**
diff --git a/src/include/gnunet_crypto_lib.h b/src/include/gnunet_crypto_lib.h
index 1ab135d80..72d783148 100644
--- a/src/include/gnunet_crypto_lib.h
+++ b/src/include/gnunet_crypto_lib.h
@@ -307,7 +307,7 @@ struct GNUNET_CRYPTO_SymmetricSessionKey
 /**
  * Type of a nonce used for challenges.
  */
-struct ChallengeNonceP
+struct GNUNET_CRYPTO_ChallengeNonceP
 {
   /**
    * The value of the nonce.  Note that this is NOT a hash.
@@ -2551,9 +2551,9 @@ GNUNET_CRYPTO_cs_private_key_generate (struct GNUNET_CRYPTO_CsPrivateKey *priv);
  * @param[out] pub where to write the public key
  */
 void
-GNUNET_CRYPTO_cs_private_key_get_public (const struct
-                                         GNUNET_CRYPTO_CsPrivateKey *priv,
-                                         struct GNUNET_CRYPTO_CsPublicKey *pub);
+GNUNET_CRYPTO_cs_private_key_get_public (
+  const struct GNUNET_CRYPTO_CsPrivateKey *priv,
+  struct GNUNET_CRYPTO_CsPublicKey *pub);
 
 
 /**
@@ -2565,11 +2565,13 @@ GNUNET_CRYPTO_cs_private_key_get_public (const struct
  * Comment: Can be done in one HKDF shot and split output.
  *
  * @param nonce is a random nonce
+ * @param seed seed to use in derivation
  * @param lts is a long-term-secret in form of a private key
  * @param[out] r array containing derived secrets r0 and r1
  */
 void
 GNUNET_CRYPTO_cs_r_derive (const struct GNUNET_CRYPTO_CsNonce *nonce,
+                           const char *seed,
                            const struct GNUNET_CRYPTO_CsPrivateKey *lts,
                            struct GNUNET_CRYPTO_CsRSecret r[2]);
 
@@ -2595,10 +2597,9 @@ GNUNET_CRYPTO_cs_r_get_public (const struct GNUNET_CRYPTO_CsRSecret *r_priv,
  * @param[out] bs array containing the two derived blinding secrets
  */
 void
-GNUNET_CRYPTO_cs_blinding_secrets_derive (const struct
-                                          GNUNET_CRYPTO_CsNonce *blind_seed,
-                                          struct GNUNET_CRYPTO_CsBlindingSecret
-                                          bs[2]);
+GNUNET_CRYPTO_cs_blinding_secrets_derive (
+  const struct GNUNET_CRYPTO_CsNonce *blind_seed,
+  struct GNUNET_CRYPTO_CsBlindingSecret bs[2]);
 
 
 /**
@@ -2614,15 +2615,14 @@ GNUNET_CRYPTO_cs_blinding_secrets_derive (const struct
  * @param[out] blinded_r_pub array of the two blinded R
  */
 void
-GNUNET_CRYPTO_cs_calc_blinded_c (const struct GNUNET_CRYPTO_CsBlindingSecret
-                                 bs[2],
-                                 const struct GNUNET_CRYPTO_CsRPublic r_pub[2],
-                                 const struct GNUNET_CRYPTO_CsPublicKey *pub,
-                                 const void *msg,
-                                 size_t msg_len,
-                                 struct GNUNET_CRYPTO_CsC blinded_c[2],
-                                 struct GNUNET_CRYPTO_CsRPublic
-                                 blinded_r_pub[2]);
+GNUNET_CRYPTO_cs_calc_blinded_c (
+  const struct GNUNET_CRYPTO_CsBlindingSecret bs[2],
+  const struct GNUNET_CRYPTO_CsRPublic r_pub[2],
+  const struct GNUNET_CRYPTO_CsPublicKey *pub,
+  const void *msg,
+  size_t msg_len,
+  struct GNUNET_CRYPTO_CsC blinded_c[2],
+  struct GNUNET_CRYPTO_CsRPublic blinded_r_pub[2]);
 
 
 /**
@@ -2642,13 +2642,12 @@ GNUNET_CRYPTO_cs_calc_blinded_c (const struct GNUNET_CRYPTO_CsBlindingSecret
  * @return 0 or 1 for b (see Clause Blind Signature Scheme)
  */
 unsigned int
-GNUNET_CRYPTO_cs_sign_derive (const struct GNUNET_CRYPTO_CsPrivateKey *priv,
-                              const struct GNUNET_CRYPTO_CsRSecret r[2],
-                              const struct GNUNET_CRYPTO_CsC c[2],
-                              const struct GNUNET_CRYPTO_CsNonce *nonce,
-                              struct GNUNET_CRYPTO_CsBlindS *
-                              blinded_signature_scalar
-                              );
+GNUNET_CRYPTO_cs_sign_derive (
+  const struct GNUNET_CRYPTO_CsPrivateKey *priv,
+  const struct GNUNET_CRYPTO_CsRSecret r[2],
+  const struct GNUNET_CRYPTO_CsC c[2],
+  const struct GNUNET_CRYPTO_CsNonce *nonce,
+  struct GNUNET_CRYPTO_CsBlindS *blinded_signature_scalar);
 
 
 /**
@@ -2659,10 +2658,10 @@ GNUNET_CRYPTO_cs_sign_derive (const struct GNUNET_CRYPTO_CsPrivateKey *priv,
  * @param[out] signature_scalar where to write the unblinded signature
  */
 void
-GNUNET_CRYPTO_cs_unblind (const struct
-                          GNUNET_CRYPTO_CsBlindS *blinded_signature_scalar,
-                          const struct GNUNET_CRYPTO_CsBlindingSecret *bs,
-                          struct GNUNET_CRYPTO_CsS *signature_scalar);
+GNUNET_CRYPTO_cs_unblind (
+  const struct GNUNET_CRYPTO_CsBlindS *blinded_signature_scalar,
+  const struct GNUNET_CRYPTO_CsBlindingSecret *bs,
+  struct GNUNET_CRYPTO_CsS *signature_scalar);
 
 
 /**
diff --git a/src/include/gnunet_datacache_lib.h b/src/include/gnunet_datacache_lib.h
index 11076e3e7..737a5c845 100644
--- a/src/include/gnunet_datacache_lib.h
+++ b/src/include/gnunet_datacache_lib.h
@@ -154,6 +154,7 @@ GNUNET_DATACACHE_get (struct GNUNET_DATACACHE_Handle *h,
  *
  * @param h handle to the datacache
  * @param key area of the keyspace to look into
+ * @param type entries of which type are relevant?
  * @param num_results number of results that should be returned to @a iter
  * @param iter maybe NULL (to just count)
  * @param iter_cls closure for @a iter
@@ -162,6 +163,7 @@ GNUNET_DATACACHE_get (struct GNUNET_DATACACHE_Handle *h,
 unsigned int
 GNUNET_DATACACHE_get_closest (struct GNUNET_DATACACHE_Handle *h,
                               const struct GNUNET_HashCode *key,
+                              enum GNUNET_BLOCK_Type type,
                               unsigned int num_results,
                               GNUNET_DATACACHE_Iterator iter,
                               void *iter_cls);
diff --git a/src/include/gnunet_datacache_plugin.h b/src/include/gnunet_datacache_plugin.h
index 24570be72..34bf5f277 100644
--- a/src/include/gnunet_datacache_plugin.h
+++ b/src/include/gnunet_datacache_plugin.h
@@ -158,14 +158,16 @@ struct GNUNET_DATACACHE_PluginFunctions
 
 
   /**
-   * Iterate over the results that are "close" to a particular key in
-   * the datacache.  "close" is defined as numerically larger than @a
-   * key (when interpreted as a circular address space), with small
-   * distance.
+   * Iterate over the results that are "close" to a particular key in the
+   * datacache.  "close" is defined as returning the @a num_results that are
+   * numerically closest and larger than @a key and also @a num_results that
+   * are numerically lower than @a key. Thus, the maximum number of results
+   * returned is actually twice @a num_results.
    *
    * @param cls closure (internal context for the plugin)
    * @param key area of the keyspace to look into
-   * @param num_results number of results that should be returned to @a iter
+   * @param type desired block type for the replies
+   * @param num_results half the number of results that should be returned to @a iter
    * @param iter maybe NULL (to just count)
    * @param iter_cls closure for @a iter
    * @return the number of results found
@@ -173,6 +175,7 @@ struct GNUNET_DATACACHE_PluginFunctions
   unsigned int
   (*get_closest) (void *cls,
                   const struct GNUNET_HashCode *key,
+                  enum GNUNET_BLOCK_Type type,
                   unsigned int num_results,
                   GNUNET_DATACACHE_Iterator iter,
                   void *iter_cls);
diff --git a/src/include/gnunet_dht_service.h b/src/include/gnunet_dht_service.h
index 768b19fb1..22b659d66 100644
--- a/src/include/gnunet_dht_service.h
+++ b/src/include/gnunet_dht_service.h
@@ -101,14 +101,14 @@ enum GNUNET_DHT_RouteOption
   GNUNET_DHT_RO_RECORD_ROUTE = 2,
 
   /**
-   * This is a 'FIND-PEER' request, so approximate results are fine.
+   * Approximate results are fine.
    */
-  GNUNET_DHT_RO_FIND_PEER = 4,
+  GNUNET_DHT_RO_FIND_APPROXIMATE = 4,
 
   /**
-    * Flag given to monitors if this was the last hop for a GET/PUT.
-    * This is only used for internal processing.
-    */
+   * Flag given to monitors if this was the last hop for a GET/PUT.
+   * This is only used for internal processing.
+   */
   GNUNET_DHT_RO_LAST_HOP = 65535
 };
 
@@ -131,11 +131,6 @@ struct GNUNET_DHT_HopSignature
   struct GNUNET_TIME_AbsoluteNBO expiration_time;
 
   /**
-   * Key of the block.
-   */
-  struct GNUNET_HashCode key;
-
-  /**
    * Hash over the payload of the block.
    */
   struct GNUNET_HashCode h_data;
@@ -181,6 +176,7 @@ struct GNUNET_DHT_PathElement
 
 };
 
+
 GNUNET_NETWORK_STRUCT_END
 
 /**
@@ -266,7 +262,7 @@ GNUNET_DHT_put_cancel (struct GNUNET_DHT_PutHandle *ph);
  *
  * @param cls closure
  * @param exp when will this value expire
- * @param key key of the result
+ * @param query_hash key of the query
  * @param get_path peers on reply path (or NULL if not recorded)
  *                 [0] = datastore's first neighbor, [length - 1] = local peer
  * @param get_path_length number of entries in @a get_path
@@ -282,7 +278,7 @@ GNUNET_DHT_put_cancel (struct GNUNET_DHT_PutHandle *ph);
 typedef void
 (*GNUNET_DHT_GetIterator) (void *cls,
                            struct GNUNET_TIME_Absolute exp,
-                           const struct GNUNET_HashCode *key,
+                           const struct GNUNET_HashCode *query_hash,
                            const struct GNUNET_DHT_PathElement *get_path,
                            unsigned int get_path_length,
                            const struct GNUNET_DHT_PathElement *put_path,
@@ -487,7 +483,6 @@ GNUNET_DHT_pp2s (const struct GNUNET_DHT_PathElement *path,
  * the last signature on the path is never verified as that is the slot where
  * our peer (@a me) would need to sign.
  *
- * @param key key of the data (not necessarily the query hash)
  * @param data payload (the block)
  * @param data_size number of bytes in @a data
  * @param exp_time expiration time of @a data
@@ -501,8 +496,7 @@ GNUNET_DHT_pp2s (const struct GNUNET_DHT_PathElement *path,
  *         @a get_path_len + @a put_path_len - 1 if no signature was valid
  */
 unsigned int
-GNUNET_DHT_verify_path (const struct GNUNET_HashCode *key,
-                        const void *data,
+GNUNET_DHT_verify_path (const void *data,
                         size_t data_size,
                         struct GNUNET_TIME_Absolute exp_time,
                         const struct GNUNET_DHT_PathElement *put_path,
@@ -512,6 +506,63 @@ GNUNET_DHT_verify_path (const struct GNUNET_HashCode *key,
                         const struct GNUNET_PeerIdentity *me);
 
 
+/**
+ * Handle to get a HELLO URL from the DHT for manual bootstrapping.
+ */
+struct GNUNET_DHT_HelloGetHandle;
+
+
+/**
+ * Signature called with the result of a HELLO GET operation.
+ *
+ * @param cls closure
+ * @param hello_url the resulting HELLO URL, NULL on error
+ */
+typedef void
+(*GNUNET_DHT_HelloGetCallback)(void *cls,
+                               const char *hello_url);
+
+
+/**
+ * Obtain HELLO URL of the DHT identified by @a dht_handle.
+ *
+ * @param dht_handle DHT to query
+ * @param cb function to call with the result
+ * @param cb_cls closure for @a cb
+ * @return NULL on failure
+ */
+struct GNUNET_DHT_HelloGetHandle *
+GNUNET_DHT_hello_get (struct GNUNET_DHT_Handle *dht_handle,
+                      GNUNET_DHT_HelloGetCallback cb,
+                      void *cb_cls);
+
+
+/**
+ * Cancel hello get operation.
+ *
+ * @param[in] hgh operation to cancel.
+ */
+void
+GNUNET_DHT_hello_get_cancel (struct GNUNET_DHT_HelloGetHandle *hgh);
+
+
+/**
+ * Offer HELLO URL of the DHT identified by @a dht_handle.
+ * Callback may be invoked once, only way to cancel is to
+ * disconnect @a dht_handle.
+ *
+ * @param dht_handle DHT to query
+ * @param url URL with a HELLO to offer to the DHT
+ * @param cb function called when done
+ * @param cb_cls closure for @a cb
+ */
+void
+GNUNET_DHT_hello_offer (struct GNUNET_DHT_Handle *dht_handle,
+                        const char *url,
+                        GNUNET_SCHEDULER_TaskCallback cb,
+                        void *cb_cls);
+
+
 #if 0                           /* keep Emacsens' auto-indent happy */
 {
 #endif
diff --git a/src/include/gnunet_dhtu_plugin.h b/src/include/gnunet_dhtu_plugin.h
index 2c97d5848..fa0b5f667 100644
--- a/src/include/gnunet_dhtu_plugin.h
+++ b/src/include/gnunet_dhtu_plugin.h
@@ -59,15 +59,6 @@ struct GNUNET_DHTU_PreferenceHandle;
 
 
 /**
- * Key used to identify peer's position in the DHT.
- */
-struct GNUNET_DHTU_HashKey
-{
-  struct GNUNET_HashCode sha512;
-};
-
-
-/**
  * The datastore service will pass a pointer to a struct
  * of this type as the first and only argument to the
  * entry point of each datastore plugin.
@@ -88,7 +79,6 @@ struct GNUNET_DHTU_PluginEnvironment
    * Function to call with new addresses of this peer.
    *
    * @param cls the closure
-   * @param key hash position of this address in the DHT
    * @param address address under which we are likely reachable,
    *           pointer will remain valid until @e address_del_cb is called; to be used for HELLOs. Example: "ip+udp://1.1.1.1:2086/"
    * @param source handle for sending from this address, NULL if we can only receive
@@ -96,7 +86,6 @@ struct GNUNET_DHTU_PluginEnvironment
    */
   void
   (*address_add_cb)(void *cls,
-                    struct GNUNET_DHTU_HashKey *key,
                     const char *address,
                     struct GNUNET_DHTU_Source *source,
                     void **ctx);
@@ -128,20 +117,19 @@ struct GNUNET_DHTU_PluginEnvironment
    * that peer.
    *
    * @param cls the closure
-   * @param pk public key of the target,
-   *    pointer will remain valid until @e disconnect_cb is called
-   * @para peer_id hash position of the peer,
-   *    pointer will remain valid until @e disconnect_cb is called
    * @param target handle to the target,
    *    pointer will remain valid until @e disconnect_cb is called
+   * @para pid peer identity,
+   *    pointer will remain valid until @e disconnect_cb is called
    * @param[out] ctx storage space for DHT to use in association with this target
    */
   void
   (*connect_cb)(void *cls,
                 struct GNUNET_DHTU_Target *target,
-                struct GNUNET_DHTU_HashKey *key,
+                const struct GNUNET_PeerIdentity *pid,
                 void **ctx);
 
+
   /**
    * Function to call when we disconnected from a peer and can henceforth
    * cannot transmit to that peer anymore.
@@ -185,10 +173,12 @@ struct GNUNET_DHTU_PluginFunctions
    * Request creation of a session with a peer at the given @a address.
    *
    * @param cls closure (internal context for the plugin)
-   * @param address target address to connect to
+   * @param pid target identity of the peer to connect to
+   * @param address target address URI to connect to
    */
   void
   (*try_connect) (void *cls,
+                  const struct GNUNET_PeerIdentity *pid,
                   const char *address);
 
 
@@ -205,7 +195,7 @@ struct GNUNET_DHTU_PluginFunctions
           struct GNUNET_DHTU_Target *target);
 
   /**
-   * Do no long request underlay to keep the connection alive.
+   * Do no longer request underlay to keep the connection alive.
    *
    * @param cls closure
    * @param target connection to keep alive
diff --git a/src/include/gnunet_fs_service.h b/src/include/gnunet_fs_service.h
index 686035e2c..96936bad2 100644
--- a/src/include/gnunet_fs_service.h
+++ b/src/include/gnunet_fs_service.h
@@ -1729,7 +1729,7 @@ GNUNET_FS_file_information_get_id (struct GNUNET_FS_FileInformation *s);
  * @return "filename" field of the structure (can be NULL)
  */
 const char *
-GNUNET_FS_file_information_get_filename (struct GNUNET_FS_FileInformation *s);
+GNUNET_FS_file_information_get_filename (const struct GNUNET_FS_FileInformation *s);
 
 
 /**
diff --git a/src/include/gnunet_gns_service.h b/src/include/gnunet_gns_service.h
index 3f6c9b9aa..5c06f8045 100644
--- a/src/include/gnunet_gns_service.h
+++ b/src/include/gnunet_gns_service.h
@@ -48,12 +48,6 @@ extern "C" {
 
 
 /**
- * String we use to indicate an empty label (top-level
- * entry in the zone).  DNS uses "@", so do we.
- */
-#define GNUNET_GNS_EMPTY_LABEL_AT "@"
-
-/**
  * Connection to the GNS service.
  */
 struct GNUNET_GNS_Handle;
diff --git a/src/include/gnunet_gnsrecord_lib.h b/src/include/gnunet_gnsrecord_lib.h
index fdbac3cf5..51dd5972d 100644
--- a/src/include/gnunet_gnsrecord_lib.h
+++ b/src/include/gnunet_gnsrecord_lib.h
@@ -44,6 +44,12 @@ extern "C" {
 #endif
 
 /**
+ * String we use to indicate an empty label (top-level
+ * entry in the zone).  DNS uses "@", so do we.
+ */
+#define GNUNET_GNS_EMPTY_LABEL_AT "@"
+
+/**
  * Maximum size of a value that can be stored in a GNS block.
  */
 #define GNUNET_GNSRECORD_MAX_BLOCK_SIZE (63 * 1024)
@@ -299,8 +305,6 @@ struct GNUNET_GNSRECORD_ReverseRecord
   /* followed by the name the delegator uses to refer to our namespace */
 };
 
-GNUNET_NETWORK_STRUCT_END
-
 
 /**
  * Process a records that were decrypted from a block.
@@ -427,7 +431,8 @@ GNUNET_GNSRECORD_is_expired (const struct GNUNET_GNSRECORD_Data *rd);
 
 
 /**
- * Normalize a UTF-8 string to UTF-8 NFC
+ * Normalize a UTF-8 string to a GNS name
+ *
  * @param src source string
  * @return converted result
  */
@@ -436,15 +441,6 @@ GNUNET_GNSRECORD_string_normalize (const char *src);
 
 
 /**
- * Convert a UTF-8 string to UTF-8 lowercase
- * @param src source string
- * @return converted result
- */
-char *
-GNUNET_GNSRECORD_string_to_lowercase (const char *src);
-
-
-/**
  * Convert a zone to a string (for printing debug messages).
  * This is one of the very few calls in the entire API that is
  * NOT reentrant!
@@ -616,11 +612,14 @@ GNUNET_GNSRECORD_records_cmp (const struct GNUNET_GNSRECORD_Data *a,
  *
  * @param rd_count number of records given in @a rd
  * @param rd array of records
+ * @param min minimum expiration time
  * @return absolute expiration time
  */
 struct GNUNET_TIME_Absolute
-GNUNET_GNSRECORD_record_get_expiration_time (
-  unsigned int rd_count, const struct GNUNET_GNSRECORD_Data *rd);
+GNUNET_GNSRECORD_record_get_expiration_time (unsigned int rd_count,
+                                             const struct
+                                             GNUNET_GNSRECORD_Data *rd,
+                                             struct GNUNET_TIME_Absolute min);
 
 
 /**
@@ -700,6 +699,77 @@ GNUNET_GNSRECORD_data_from_identity (const struct
 enum GNUNET_GenericReturnValue
 GNUNET_GNSRECORD_is_zonekey_type (uint32_t type);
 
+/**
+ * Check if this type is a critical record.
+ *
+ * @param type the type to check
+ * @return GNUNET_YES if it is critical.
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_is_critical (uint32_t type);
+
+/**
+ * Normalize namestore records: Check for consistency and
+ * expirations. Purge expired records. Returns a "clean" record set.
+ * Also returns the minimum expiration time this block should be
+ * published under.
+ * Also checks rules with respect to labels (e.g. no delegations under
+ * the empty label)
+ *
+ * @param label the label under which this set (supposed to be) stored.
+ * @param rd input records
+ * @param rd_count size of the @a rd and @a rd_public arrays
+ * @param rd_public where to write the converted records
+ * @param rd_public_count number of records written to @a rd_public
+ * @param min_expiry the minimum expiration of this set
+ * @param include_private GNUNET_YES if private records should be included.
+ * @param emsg the error message if something went wrong
+ * @return GNUNET_OK if set could be normalized and is consistent
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_normalize_record_set (const char *label,
+                                       const struct GNUNET_GNSRECORD_Data *rd,
+                                       unsigned int rd_count,
+                                       struct GNUNET_GNSRECORD_Data *rd_public,
+                                       unsigned int *rd_count_public,
+                                       struct GNUNET_TIME_Absolute *min_expiry,
+                                       int include_private,
+                                       char **emsg);
+
+
+/**
+ * Convert namestore records from the internal format to that
+ * suitable for publication (removes private records).
+ *
+ * @param label the label under which this set is (supposed to be) published.
+ * @param rd input records
+ * @param rd_count size of the @a rd and @a rd_public arrays
+ * @param rd_public where to write the converted records
+ * @param rd_public_count number of records written to @a rd_public
+ * @param expiry the expiration of the block
+ * @param emsg the error message if something went wrong
+ * @return GNUNET_OK if set is consistent and can be exported
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_convert_records_for_export (const char *label,
+                                             const struct
+                                             GNUNET_GNSRECORD_Data *rd,
+                                             unsigned int rd_count,
+                                             struct GNUNET_GNSRECORD_Data *
+                                             rd_public,
+                                             unsigned int *rd_count_public,
+                                             struct GNUNET_TIME_Absolute *expiry,
+                                             char **emsg);
+
+/**
+ * Check label for invalid characters.
+ *
+ * @param label the label to check
+ * @param emsg an error message (NULL if label is valid). Will be allocated.
+ * @return GNUNET_OK if label is valid.
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_label_check (const char*label, char **emsg);
 
 #if 0 /* keep Emacsens' auto-indent happy */
 {
diff --git a/src/include/gnunet_gnsrecord_plugin.h b/src/include/gnunet_gnsrecord_plugin.h
index aec22c3af..84b7c3c23 100644
--- a/src/include/gnunet_gnsrecord_plugin.h
+++ b/src/include/gnunet_gnsrecord_plugin.h
@@ -105,6 +105,18 @@ typedef const char *
 (*GNUNET_GNSRECORD_NumberToTypenameFunction) (void *cls,
                                               uint32_t type);
 
+/**
+ * Function called to check for critical records.
+ *
+ * @param cls closure
+ * @param type number of a type to check
+ * @return GNUNET_YES if critical, otherwise GNUNET_NO
+ */
+typedef enum GNUNET_GenericReturnValue
+(*GNUNET_GNSRECORD_IsCriticalFunction) (void *cls,
+                                        uint32_t type);
+
+
 
 /**
  * Each plugin is required to return a pointer to a struct of this
@@ -136,6 +148,11 @@ struct GNUNET_GNSRECORD_PluginFunctions
    * Number to typename.
    */
   GNUNET_GNSRECORD_NumberToTypenameFunction number_to_typename;
+
+  /**
+   * Is critical.
+   */
+  GNUNET_GNSRECORD_IsCriticalFunction is_critical;
 };
 
 /** @} */  /* end of group */
diff --git a/src/include/gnunet_hello_uri_lib.h b/src/include/gnunet_hello_uri_lib.h
new file mode 100644
index 000000000..c109a151a
--- /dev/null
+++ b/src/include/gnunet_hello_uri_lib.h
@@ -0,0 +1,248 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2022 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @author Christian Grothoff
+ * @file
+ * Helper library for handling HELLO URIs
+ *
+ * @defgroup hello_uri  Hello_Uri library
+ * Helper library for handling HELLO URIs
+ *
+ * @{
+ */
+
+#ifndef GNUNET_HELLO_URI_LIB_H
+#define GNUNET_HELLO_URI_LIB_H
+
+#ifdef __cplusplus
+extern "C" {
+#if 0 /* keep Emacsens' auto-indent happy */
+}
+#endif
+#endif
+
+#include "gnunet_util_lib.h"
+
+
+/**
+ * Context for building (or parsing) HELLO URIs.
+ */
+struct GNUNET_HELLO_Builder;
+
+
+/**
+ * For how long are HELLO signatures valid?
+ */
+#define GNUNET_HELLO_ADDRESS_EXPIRATION GNUNET_TIME_relative_multiply ( \
+    GNUNET_TIME_UNIT_DAYS, 2)
+
+
+/**
+ * Allocate builder.
+ *
+ * @param pid peer the builder is for
+ * @return new builder
+ */
+struct GNUNET_HELLO_Builder *
+GNUNET_HELLO_builder_new (const struct GNUNET_PeerIdentity *pid);
+
+
+/**
+ * Release resources of a @a builder.
+ *
+ * @param[in] builder to free
+ */
+void
+GNUNET_HELLO_builder_free (struct GNUNET_HELLO_Builder *builder);
+
+
+/**
+ * Parse @a msg into builder.
+ *
+ * @param msg message to parse
+ * @return builder, NULL on failure
+ */
+struct GNUNET_HELLO_Builder *
+GNUNET_HELLO_builder_from_msg (const struct GNUNET_MessageHeader *msg);
+
+
+/**
+ * Parse @a block into builder.
+ *
+ * @param block DHT block to parse
+ * @param block_size number of bytes in @a block
+ * @return builder, NULL on failure
+ */
+struct GNUNET_HELLO_Builder *
+GNUNET_HELLO_builder_from_block (const void *block,
+                                 size_t block_size);
+
+
+/**
+ * Parse GNUnet HELLO @a url into builder.
+ *
+ * @param url URL to parse
+ * @return builder, NULL on failure
+ */
+struct GNUNET_HELLO_Builder *
+GNUNET_HELLO_builder_from_url (const char *url);
+
+
+/**
+ * Generate envelope with GNUnet HELLO message (including
+ * peer ID) from a @a builder
+ *
+ * @param builder builder to serialize
+ * @param priv private key to use to sign the result
+ * @return HELLO message matching @a builder
+ */
+struct GNUNET_MQ_Envelope *
+GNUNET_HELLO_builder_to_env (const struct GNUNET_HELLO_Builder *builder,
+                             const struct GNUNET_CRYPTO_EddsaPrivateKey *priv);
+
+
+/**
+ * Generate DHT HELLO message (without peer ID) from a @a builder
+ *
+ * @param builder builder to serialize
+ * @param priv private key to use to sign the result
+ * @return HELLO message matching @a builder
+ */
+struct GNUNET_MessageHeader *
+GNUNET_HELLO_builder_to_dht_hello_msg (
+  const struct GNUNET_HELLO_Builder *builder,
+  const struct GNUNET_CRYPTO_EddsaPrivateKey *priv);
+
+
+/**
+ * Generate GNUnet HELLO URI from a @a builder
+ *
+ * @param builder builder to serialize
+ * @param priv private key to use to sign the result
+ * @return hello URI
+ */
+char *
+GNUNET_HELLO_builder_to_url (const struct GNUNET_HELLO_Builder *builder,
+                             const struct GNUNET_CRYPTO_EddsaPrivateKey *priv);
+
+/**
+ * Generate DHT block from a @a builder
+ *
+ * @param builder the builder to serialize
+ * @param priv private key to use to sign the result
+ * @param[out] block where to write the block, NULL to only calculate @a block_size
+ * @param[in,out] block_size input is number of bytes available in @a block,
+ *                           output is number of bytes needed in @a block
+ * @return #GNUNET_OK on success, #GNUNET_NO if @a block_size was too small
+ *      or if @a block was NULL
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_HELLO_builder_to_block (const struct GNUNET_HELLO_Builder *builder,
+                               const struct GNUNET_CRYPTO_EddsaPrivateKey *priv,
+                               void *block,
+                               size_t *block_size);
+
+
+/**
+ * Add individual @a address to the @a builder
+ *
+ * @param[in,out] builder to update
+ * @param address address URI to add
+ * @return #GNUNET_OK on success, #GNUNET_NO if @a address was already
+ *     in @a builder
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_HELLO_builder_add_address (struct GNUNET_HELLO_Builder *builder,
+                                  const char *address);
+
+
+/**
+ * Remove individual @a address from the @a builder
+ *
+ * @param[in,out] builder to update
+ * @param address address URI to remove
+ * @return #GNUNET_OK on success, #GNUNET_NO if @a address was not
+ *     in @a builder
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_HELLO_builder_del_address (struct GNUNET_HELLO_Builder *builder,
+                                  const char *address);
+
+
+/**
+ * Callback function used to extract URIs from a builder.
+ *
+ * @param cls closure
+ * @param uri one of the URIs
+ */
+typedef void
+(*GNUNET_HELLO_UriCallback) (void *cls,
+                             const char *uri);
+
+
+/**
+ * Iterate over URIs in a builder.
+ *
+ * @param builder builder to iterate over
+ * @param[out] pid set to the peer the @a builder is for
+ * @param uc callback invoked for each URI, can be NULL
+ * @param uc_cls closure for @a addrgen
+ */
+void
+GNUNET_HELLO_builder_iterate (const struct GNUNET_HELLO_Builder *builder,
+                              struct GNUNET_PeerIdentity *pid,
+                              GNUNET_HELLO_UriCallback uc,
+                              void *uc_cls);
+
+
+/**
+ * Convert a DHT @a hello message to a HELLO @a block.
+ *
+ * @param hello the HELLO message
+ * @param pid peer that created the @a hello
+ * @param[out] block set to the HELLO block
+ * @param[out] block_size set to number of bytes in @a block
+ * @param[out] block_expiration set to expiration time of @a block
+ * @return #GNUNET_OK on success,
+ *         #GNUNET_NO if the @a hello is expired (@a block is set!)
+ *         #GNUNET_SYSERR if @a hello is invalid (@a block will be set to NULL)
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_HELLO_dht_msg_to_block (const struct GNUNET_MessageHeader *hello,
+                               const struct GNUNET_PeerIdentity *pid,
+                               void **block,
+                               size_t *block_size,
+                               struct GNUNET_TIME_Absolute *block_expiration);
+
+
+#if 0 /* keep Emacsens' auto-indent happy */
+{
+#endif
+#ifdef __cplusplus
+}
+#endif
+
+/* ifndef GNUNET_HELLO_URI_LIB_H */
+#endif
+
+/** @} */ /* end of group */
+
+/* end of gnunet_hello_uri_lib.h */
diff --git a/src/include/gnunet_json_lib.h b/src/include/gnunet_json_lib.h
index 7d101196c..6e73a3365 100644
--- a/src/include/gnunet_json_lib.h
+++ b/src/include/gnunet_json_lib.h
@@ -48,10 +48,10 @@ struct GNUNET_JSON_Specification;
  * @return #GNUNET_SYSERR on error,
  *         #GNUNET_OK on success
  */
-typedef int
-(*GNUNET_JSON_Parser) (void *cls,
-                       json_t *root,
-                       struct GNUNET_JSON_Specification *spec);
+typedef enum GNUNET_GenericReturnValue
+(*GNUNET_JSON_Parser)(void *cls,
+                      json_t *root,
+                      struct GNUNET_JSON_Specification *spec);
 
 
 /**
diff --git a/src/include/gnunet_namestore_service.h b/src/include/gnunet_namestore_service.h
index 2482b97a5..619b81aed 100644
--- a/src/include/gnunet_namestore_service.h
+++ b/src/include/gnunet_namestore_service.h
@@ -134,6 +134,39 @@ GNUNET_NAMESTORE_records_store (struct GNUNET_NAMESTORE_Handle *h,
                                 GNUNET_NAMESTORE_ContinuationWithStatus cont,
                                 void *cont_cls);
 
+/**
+ * Store an item in the namestore.  If the item is already present,
+ * it is replaced with the new record.  Use an empty array to
+ * remove all records under the given name.
+ *
+ * The continuation is called after the value has been stored in the
+ * database. Monitors may be notified asynchronously (basically with
+ * a buffer). However, if any monitor is consistently too slow to
+ * keep up with the changes, calling @a cont will be delayed until the
+ * monitors do keep up.
+ *
+ * @param h handle to the namestore
+ * @param pkey private key of the zone
+ * @param label name that is being mapped
+ * @param rd_count number of records in the 'rd' array
+ * @param rd array of records with data to store
+ * @param is_zonemaster update tombstones, do not process monitors
+ * @param cont continuation to call when done
+ * @param cont_cls closure for @a cont
+ * @return handle to abort the request
+ */
+struct GNUNET_NAMESTORE_QueueEntry *
+GNUNET_NAMESTORE_records_store_ (struct GNUNET_NAMESTORE_Handle *h,
+                                 const struct GNUNET_IDENTITY_PrivateKey *pkey,
+                                 const char *label,
+                                 unsigned int rd_count,
+                                 const struct GNUNET_GNSRECORD_Data *rd,
+                                 int is_zonemaster,
+                                 GNUNET_NAMESTORE_ContinuationWithStatus cont,
+                                 void *cont_cls);
+
+
+
 
 /**
  * Process a record that was stored in the namestore.
@@ -179,6 +212,61 @@ GNUNET_NAMESTORE_records_lookup (struct GNUNET_NAMESTORE_Handle *h,
 
 
 /**
+ * Open a record set for editing.
+ * Retrieves an exclusive lock on this set.
+ * Must be commited using @a GNUNET_NAMESTORE_records_commit
+ *
+ * @param h handle to the namestore
+ * @param pkey private key of the zone
+ * @param label name that is being mapped
+ * @param error_cb function to call on error (i.e. disconnect or unable to get lock)
+ *        the handle is afterwards invalid
+ * @param error_cb_cls closure for @a error_cb
+ * @param rm function to call with the result (with 0 records if we don't have that label)
+ * @param rm_cls closure for @a rm
+ * @return handle to abort the request
+ */
+struct GNUNET_NAMESTORE_QueueEntry *
+GNUNET_NAMESTORE_records_open (struct GNUNET_NAMESTORE_Handle *h,
+                               const struct
+                               GNUNET_IDENTITY_PrivateKey *pkey,
+                               const char *label,
+                               GNUNET_SCHEDULER_TaskCallback error_cb,
+                               void *error_cb_cls,
+                               GNUNET_NAMESTORE_RecordMonitor rm,
+                               void *rm_cls);
+
+/**
+ * Commit the record set to the namestore.
+ * Releases the lock on the record set.
+ * Use an empty array to
+ * remove all records under the given name.
+ *
+ * The continuation is called after the value has been stored in the
+ * database. Monitors may be notified asynchronously (basically with
+ * a buffer). However, if any monitor is consistently too slow to
+ * keep up with the changes, calling @a cont will be delayed until the
+ * monitors do keep up.
+ *
+ * @param h handle to the namestore
+ * @param pkey private key of the zone
+ * @param label name that is being mapped
+ * @param rd_count number of records in the 'rd' array
+ * @param rd array of records with data to store
+ * @param cont continuation to call when done
+ * @param cont_cls closure for @a cont
+ * @return handle to abort the request
+ */
+struct GNUNET_NAMESTORE_QueueEntry *
+GNUNET_NAMESTORE_records_commit (struct GNUNET_NAMESTORE_Handle *h,
+                                 const struct GNUNET_IDENTITY_PrivateKey *pkey,
+                                 const char *label,
+                                 unsigned int rd_count,
+                                 const struct GNUNET_GNSRECORD_Data *rd,
+                                 GNUNET_NAMESTORE_ContinuationWithStatus cont,
+                                 void *cont_cls);
+
+/**
  * Look for an existing PKEY delegation record for a given public key.
  * Returns at most one result to the processor.
  *
diff --git a/src/include/gnunet_protocols.h b/src/include/gnunet_protocols.h
index 9e278eb92..f2892e125 100644
--- a/src/include/gnunet_protocols.h
+++ b/src/include/gnunet_protocols.h
@@ -153,10 +153,10 @@ extern "C" {
  ******************************************************************************/
 
 /**
- * Previously used for HELLO messages used for communicating peer addresses.
+ * Latest HELLO messages used for communicating peer addresses.
  * Managed by libgnunethello.
  */
-#define GNUNET_MESSAGE_TYPE_HELLO_LEGACY 16
+#define GNUNET_MESSAGE_TYPE_HELLO_URI 16
 
 /**
  * HELLO message with friend only flag used for communicating peer addresses.
@@ -660,13 +660,26 @@ extern "C" {
 #define GNUNET_MESSAGE_TYPE_DHT_CLIENT_GET_RESULTS_KNOWN 156
 
 /**
- * DHT wants to use CORE to transmit data.
+ * HELLO advertising a neighbours addresses.
  */
-#define GNUNET_MESSAGE_TYPE_DHT_CORE 143
+#define GNUNET_MESSAGE_TYPE_DHT_P2P_HELLO 157
 
 /**
- * Further X-VINE DHT messages continued from 880
+ * Encapsulation of DHT messages in CORE service.
  */
+#define GNUNET_MESSAGE_TYPE_DHT_CORE 158
+
+/**
+ * HELLO URL send between client and service (in
+ * either direction).
+ */
+#define GNUNET_MESSAGE_TYPE_DHT_CLIENT_HELLO_URL 159
+
+/**
+ * Client requests DHT service's HELLO URL.
+ */
+#define GNUNET_MESSAGE_TYPE_DHT_CLIENT_HELLO_GET 161
+
 
 /*******************************************************************************
  * HOSTLIST message types
@@ -1796,7 +1809,6 @@ extern "C" {
 #define GNUNET_MESSAGE_TYPE_SETU_P2P_SEND_FULL 710
 
 
-
 /*******************************************************************************
  * SETI message types
  ******************************************************************************/
diff --git a/src/include/gnunet_strings_lib.h b/src/include/gnunet_strings_lib.h
index 9dd2f733e..bb8577b7a 100644
--- a/src/include/gnunet_strings_lib.h
+++ b/src/include/gnunet_strings_lib.h
@@ -159,14 +159,12 @@ GNUNET_STRINGS_to_utf8 (const char *input,
 
 /**
  * Normalize the utf-8 input string to NFC.
- * Output needs to be allocated appropriately.
  *
  * @param input input string
- * @param output output buffer
+ * @return result (freshly allocated) or NULL on error.
  */
-void
-GNUNET_STRINGS_utf8_normalize (const char *input,
-                               char *output);
+char*
+GNUNET_STRINGS_utf8_normalize (const char *input);
 
 
 /**
@@ -192,8 +190,9 @@ GNUNET_STRINGS_from_utf8 (const char *input,
  *
  * @param input input string
  * @param output output buffer
+ * @return GNUNET_OK on success
  */
-void
+enum GNUNET_GenericReturnValue
 GNUNET_STRINGS_utf8_tolower (const char *input,
                              char *output);
 
@@ -204,8 +203,9 @@ GNUNET_STRINGS_utf8_tolower (const char *input,
  *
  * @param input input string
  * @param output output buffer
+ * @return GNUNET_OK on success
  */
-void
+enum GNUNET_GenericReturnValue
 GNUNET_STRINGS_utf8_toupper (const char *input,
                              char *output);
 
@@ -458,7 +458,7 @@ GNUNET_STRINGS_base64url_decode (const char *data,
  *
  * @param data the data to encode
  * @param len the length of the input
- * @param output where to write the output (*output should be NULL,
+ * @param[out] out where to write the output (*output should be NULL,
  *   is allocated)
  * @return the size of the output
  */
diff --git a/src/include/gnunet_time_lib.h b/src/include/gnunet_time_lib.h
index b14439462..96413c3cc 100644
--- a/src/include/gnunet_time_lib.h
+++ b/src/include/gnunet_time_lib.h
@@ -762,11 +762,22 @@ GNUNET_TIME_absolute_from_s (uint64_t s_after_epoch);
  *
  * @param s_after_epoch seconds after epoch to convert
  * @return converted time value
- */struct GNUNET_TIME_Timestamp
+ */
+struct GNUNET_TIME_Timestamp
 GNUNET_TIME_timestamp_from_s (uint64_t s_after_epoch);
 
 
 /**
+ * Convert timestamp to number of seconds after the UNIX epoch.
+ *
+ * @param ts timestamp to convert
+ * @return converted time value
+ */
+uint64_t
+GNUNET_TIME_timestamp_to_s (struct GNUNET_TIME_Timestamp ts);
+
+
+/**
  * Convert absolute time from network byte order.
  *
  * @param a time to convert
diff --git a/src/json/json_pack.c b/src/json/json_pack.c
index 296f56104..cc1ca3e97 100644
--- a/src/json/json_pack.c
+++ b/src/json/json_pack.c
@@ -31,6 +31,12 @@ GNUNET_JSON_pack_ (struct GNUNET_JSON_PackSpec spec[])
 {
   json_t *ret;
 
+  if (NULL == spec[0].field_name)
+  {
+    ret = spec[0].object;
+    spec[0].object = NULL;
+    return ret;
+  }
   ret = json_object ();
   GNUNET_assert (NULL != ret);
   for (unsigned int i = 0;
diff --git a/src/messenger/gnunet-service-messenger.c b/src/messenger/gnunet-service-messenger.c
index 546f4c0d2..31bffec18 100644
--- a/src/messenger/gnunet-service-messenger.c
+++ b/src/messenger/gnunet-service-messenger.c
@@ -170,9 +170,7 @@ handle_room_close (void *cls,
 
   if (GNUNET_YES == close_handle_room (msg_client->handle, &(msg->key)))
   {
-    const struct GNUNET_ShortHashCode *member_id = get_handle_member_id (msg_client->handle, &(msg->key));
-
-    GNUNET_log(GNUNET_ERROR_TYPE_DEBUG, "Closing room with member id: %s\n", GNUNET_sh2s (member_id));
+    GNUNET_log(GNUNET_ERROR_TYPE_DEBUG, "Closing room succeeded: %s\n", GNUNET_h2s (&(msg->key)));
 
     struct GNUNET_MESSENGER_RoomMessage *response;
     struct GNUNET_MQ_Envelope *env;
diff --git a/src/messenger/gnunet-service-messenger_member_session.c b/src/messenger/gnunet-service-messenger_member_session.c
index 846dbbe2b..6bd1d24b8 100644
--- a/src/messenger/gnunet-service-messenger_member_session.c
+++ b/src/messenger/gnunet-service-messenger_member_session.c
@@ -84,6 +84,9 @@ check_member_session_completion (struct GNUNET_MESSENGER_MemberSession *session)
 {
   GNUNET_assert (session);
 
+  GNUNET_log(GNUNET_ERROR_TYPE_DEBUG, "Check session history (%s) for completion.\n",
+             GNUNET_sh2s(get_member_session_id(session)));
+
   if (!session->messages.tail)
   {
     session->completed = GNUNET_YES;
@@ -142,7 +145,10 @@ check_member_session_completion (struct GNUNET_MESSENGER_MemberSession *session)
 completion:
   if (GNUNET_YES == is_member_session_completed(session))
   {
-    GNUNET_CONTAINER_multihashmap_destroy (session->history);
+    GNUNET_log(GNUNET_ERROR_TYPE_DEBUG, "Completed session history (%s)\n",
+               GNUNET_sh2s(get_member_session_id(session)));
+
+    GNUNET_CONTAINER_multihashmap_clear (session->history);
 
     struct GNUNET_MESSENGER_ContactStore *store = get_member_contact_store(session->member->store);
 
diff --git a/src/messenger/gnunet-service-messenger_room.c b/src/messenger/gnunet-service-messenger_room.c
index 7f2fd0ca6..7a20d2191 100644
--- a/src/messenger/gnunet-service-messenger_room.c
+++ b/src/messenger/gnunet-service-messenger_room.c
@@ -92,14 +92,14 @@ static void
 handle_room_messages (struct GNUNET_MESSENGER_SrvRoom *room);
 
 void
-destroy_room (struct GNUNET_MESSENGER_SrvRoom *room)
+destroy_room (struct GNUNET_MESSENGER_SrvRoom *room,
+              int deletion)
 {
   GNUNET_assert(room);
 
   if (room->idle)
   {
     GNUNET_SCHEDULER_cancel (room->idle);
-
     room->idle = NULL;
   }
 
@@ -107,18 +107,22 @@ destroy_room (struct GNUNET_MESSENGER_SrvRoom *room)
     GNUNET_CADET_close_port (room->port);
 
   GNUNET_CONTAINER_multipeermap_iterate (room->tunnels, iterate_destroy_tunnels, NULL);
-
   handle_room_messages (room);
 
-  if (room->service->dir)
+  if (!(room->service->dir))
+    goto skip_saving;
+
+  if (GNUNET_YES == deletion)
+    remove_room (room);
+  else
     save_room (room);
 
+skip_saving:
   clear_member_store (get_room_member_store(room));
   clear_message_store (get_room_message_store(room));
   clear_operation_store(get_room_operation_store(room));
 
   GNUNET_CONTAINER_multipeermap_destroy (room->tunnels);
-
   clear_list_tunnels (&(room->basement));
   clear_message_state(&(room->state));
 
@@ -1221,6 +1225,20 @@ save_room (struct GNUNET_MESSENGER_SrvRoom *room)
   GNUNET_free(room_dir);
 }
 
+void
+remove_room (struct GNUNET_MESSENGER_SrvRoom *room)
+{
+  GNUNET_assert(room);
+
+  char *room_dir;
+  get_room_data_subdir (room, &room_dir);
+
+  if (GNUNET_YES == GNUNET_DISK_directory_test (room_dir, GNUNET_YES))
+    GNUNET_DISK_directory_remove(room_dir);
+
+  GNUNET_free(room_dir);
+}
+
 static void
 remove_room_member_session (struct GNUNET_MESSENGER_SrvRoom *room,
                             struct GNUNET_MESSENGER_MemberSession *session)
diff --git a/src/messenger/gnunet-service-messenger_room.h b/src/messenger/gnunet-service-messenger_room.h
index 4b3811104..58edc4121 100644
--- a/src/messenger/gnunet-service-messenger_room.h
+++ b/src/messenger/gnunet-service-messenger_room.h
@@ -95,10 +95,15 @@ create_room (struct GNUNET_MESSENGER_SrvHandle *handle,
 /**
  * Destroys a room and frees its memory fully.
  *
+ * The <i>deletion</i> flag should only be set to #GNUNET_YES if the
+ * room gets dropped by the service, otherwise #GNUNET_NO.
+ *
  * @param[in/out] room Room
+ * @param[in] deletion Flag to indicate context of destruction
  */
 void
-destroy_room (struct GNUNET_MESSENGER_SrvRoom *room);
+destroy_room (struct GNUNET_MESSENGER_SrvRoom *room,
+              int deletion);
 
 /**
  * Returns the used member store of a given <i>room</i>.
@@ -364,4 +369,12 @@ load_room (struct GNUNET_MESSENGER_SrvRoom *room);
 void
 save_room (struct GNUNET_MESSENGER_SrvRoom *room);
 
+/**
+ * Removes the configuration for a given <i>room</i> of a service.
+ *
+ * @param[in] room Room
+ */
+void
+remove_room (struct GNUNET_MESSENGER_SrvRoom *room);
+
 #endif //GNUNET_SERVICE_MESSENGER_ROOM_H
diff --git a/src/messenger/gnunet-service-messenger_service.c b/src/messenger/gnunet-service-messenger_service.c
index b53b72af8..83d7632d8 100644
--- a/src/messenger/gnunet-service-messenger_service.c
+++ b/src/messenger/gnunet-service-messenger_service.c
@@ -94,7 +94,7 @@ iterate_destroy_rooms (void *cls,
                        void *value)
 {
   struct GNUNET_MESSENGER_SrvRoom *room = value;
-  destroy_room (room);
+  destroy_room (room, GNUNET_NO);
   return GNUNET_YES;
 }
 
@@ -220,7 +220,7 @@ open_service_room (struct GNUNET_MESSENGER_Service *service,
                                                        GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_FAST)))
     return GNUNET_YES;
 
-  destroy_room (room);
+  destroy_room (room, GNUNET_YES);
   return GNUNET_NO;
 }
 
@@ -253,7 +253,7 @@ entry_service_room (struct GNUNET_MESSENGER_Service *service,
   }
   else
   {
-    destroy_room (room);
+    destroy_room (room, GNUNET_YES);
     return GNUNET_NO;
   }
 
@@ -287,7 +287,7 @@ close_service_room (struct GNUNET_MESSENGER_Service *service,
   {
     if (GNUNET_OK == GNUNET_CONTAINER_multihashmap_remove (service->rooms, key, room))
     {
-      destroy_room (room);
+      destroy_room (room, GNUNET_YES);
       return GNUNET_YES;
     }
     else
diff --git a/src/messenger/messenger.conf.in b/src/messenger/messenger.conf.in
index 6b54550ea..ef0544681 100644
--- a/src/messenger/messenger.conf.in
+++ b/src/messenger/messenger.conf.in
@@ -1,12 +1,12 @@
 [messenger]
-START_ON_DEMAND = YES
+START_ON_DEMAND = @START_ON_DEMAND@
 RUN_PER_USER = YES
-PORT = 2097
+@JAVAPORT@PORT = 2125
 HOSTNAME = localhost
 BINARY = gnunet-service-messenger
 ACCEPT_FROM = 127.0.0.1;
 ACCEPT_FROM6 = ::1;
-UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-service-messenger.sock
+UNIXPATH = $GNUNET_USER_RUNTIME_DIR/gnunet-service-messenger.sock
 UNIX_MATCH_UID = NO
 UNIX_MATCH_GID = YES
 
diff --git a/src/messenger/messenger_api_message.c b/src/messenger/messenger_api_message.c
index 496c98dbf..3814def70 100644
--- a/src/messenger/messenger_api_message.c
+++ b/src/messenger/messenger_api_message.c
@@ -219,6 +219,10 @@ get_message_body_kind_size (enum GNUNET_MESSENGER_MessageKind kind)
   case GNUNET_MESSENGER_KIND_PRIVATE:
     length += member_size(struct GNUNET_MESSENGER_Message, body.privacy.key);
     break;
+  case GNUNET_MESSENGER_KIND_DELETE:
+    length += member_size(struct GNUNET_MESSENGER_Message, body.deletion.hash);
+    length += member_size(struct GNUNET_MESSENGER_Message, body.deletion.delay);
+    break;
   default:
     break;
   }
@@ -445,6 +449,10 @@ encode_message_body (enum GNUNET_MESSENGER_MessageKind kind,
     encode_step(buffer, offset, &(body->privacy.key));
     encode_step_ext(buffer, offset, body->privacy.data, min(length - offset, body->privacy.length));
     break;
+  case GNUNET_MESSENGER_KIND_DELETE:
+    encode_step(buffer, offset, &(body->deletion.hash));
+    encode_step(buffer, offset, &(body->deletion.delay));
+    break;
   default:
     break;
   }
@@ -616,6 +624,10 @@ decode_message_body (enum GNUNET_MESSENGER_MessageKind *kind,
     body->privacy.length = (length - offset);
     decode_step_malloc(buffer, offset, body->privacy.data, length - offset, 0);
     break;
+  case GNUNET_MESSENGER_KIND_DELETE:
+    decode_step(buffer, offset, &(body->deletion.hash));
+    decode_step(buffer, offset, &(body->deletion.delay));
+    break;
   default:
     *kind = GNUNET_MESSENGER_KIND_UNKNOWN;
     break;
diff --git a/src/namecache/test_namecache_api_cache_block.c b/src/namecache/test_namecache_api_cache_block.c
index 310c4de42..6188fb014 100644
--- a/src/namecache/test_namecache_api_cache_block.c
+++ b/src/namecache/test_namecache_api_cache_block.c
@@ -187,9 +187,10 @@ run (void *cls,
   rd.data = GNUNET_malloc (TEST_RECORD_DATALEN);
   rd.flags = 0;
   memset ((char *) rd.data, 'a', TEST_RECORD_DATALEN);
-  block = GNUNET_GNSRECORD_block_create (&privkey,
-                                         GNUNET_TIME_UNIT_FOREVER_ABS,
-                                         name, &rd, 1);
+  GNUNET_assert (GNUNET_OK == GNUNET_GNSRECORD_block_create (&privkey,
+                                                             GNUNET_TIME_UNIT_FOREVER_ABS,
+                                                             name, &rd, 1,
+                                                             &block));
   if (NULL == block)
   {
     GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
diff --git a/src/namestore/Makefile.am b/src/namestore/Makefile.am
index 51708dd67..2441b864a 100644
--- a/src/namestore/Makefile.am
+++ b/src/namestore/Makefile.am
@@ -39,6 +39,7 @@ if HAVE_SQLITE
 SQLITE_PLUGIN = libgnunet_plugin_namestore_sqlite.la
 SQLITE_TESTS = test_plugin_namestore_sqlite \
  test_namestore_api_store_sqlite \
+ test_namestore_api_store_locking_sqlite \
  test_namestore_api_store_update_sqlite \
  test_namestore_api_zone_iteration_sqlite \
  test_namestore_api_remove_sqlite \
@@ -249,6 +250,16 @@ test_namestore_api_store_sqlite_LDADD = \
   $(top_builddir)/src/identity/libgnunetidentity.la \
   libgnunetnamestore.la
 
+test_namestore_api_store_locking_sqlite_SOURCES = \
+ test_namestore_api_store_locking.c
+test_namestore_api_store_locking_sqlite_LDADD = \
+  $(top_builddir)/src/testing/libgnunettesting.la \
+  $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
+  $(top_builddir)/src/identity/libgnunetidentity.la \
+  libgnunetnamestore.la
+
+
 test_namestore_api_store_postgres_SOURCES = \
  test_namestore_api_store.c
 test_namestore_api_store_postgres_LDADD = \
diff --git a/src/namestore/gnunet-namestore.c b/src/namestore/gnunet-namestore.c
index 852d99608..af40f2dbe 100644
--- a/src/namestore/gnunet-namestore.c
+++ b/src/namestore/gnunet-namestore.c
@@ -33,6 +33,12 @@
 #include <gnunet_gns_service.h>
 #include <gnunet_namestore_service.h>
 
+/**
+ * The upper bound for the zone iteration interval
+ * (per record).
+ */
+#define WARN_RELATIVE_EXPIRATION_LIMIT GNUNET_TIME_relative_multiply ( \
+    GNUNET_TIME_UNIT_MINUTES, 15)
 
 /**
  * Entry in record set for bulk processing.
@@ -430,6 +436,8 @@ display_record (const char *rname,
     if ((GNUNET_GNSRECORD_TYPE_NICK == rd[i].record_type) &&
         (0 != strcmp (rname, GNUNET_GNS_EMPTY_LABEL_AT)))
       continue;
+    if (GNUNET_GNSRECORD_TYPE_TOMBSTONE == rd[i].record_type)
+      continue;
     if ((type != rd[i].record_type) && (GNUNET_GNSRECORD_TYPE_ANY != type))
       continue;
     have_record = GNUNET_YES;
@@ -447,6 +455,8 @@ display_record (const char *rname,
     if ((GNUNET_GNSRECORD_TYPE_NICK == rd[i].record_type) &&
         (0 != strcmp (rname, GNUNET_GNS_EMPTY_LABEL_AT)))
       continue;
+    if (GNUNET_GNSRECORD_TYPE_TOMBSTONE == rd[i].record_type)
+      continue;
     if ((type != rd[i].record_type) && (GNUNET_GNSRECORD_TYPE_ANY != type))
       continue;
     typestr = GNUNET_GNSRECORD_number_to_typename (rd[i].record_type);
@@ -649,28 +659,6 @@ get_existing_record (void *cls,
   {
     switch (rd[i].record_type)
     {
-    case GNUNET_DNSPARSER_TYPE_CNAME:
-      fprintf (
-        stderr,
-        _ (
-          "A %s record exists already under `%s', no other records can be added.\n"),
-        "CNAME",
-        rec_name);
-      ret = 1;
-      test_finished ();
-      return;
-
-    case GNUNET_GNSRECORD_TYPE_PKEY:
-    case GNUNET_GNSRECORD_TYPE_EDKEY:
-      fprintf (
-        stderr,
-        _ (
-          "A zone key record exists already under `%s', no other records can be added.\n"),
-        rec_name);
-      ret = 1;
-      test_finished ();
-      return;
-
     case GNUNET_DNSPARSER_TYPE_SOA:
       if (GNUNET_DNSPARSER_TYPE_SOA == type)
       {
@@ -686,51 +674,6 @@ get_existing_record (void *cls,
       break;
     }
   }
-  switch (type)
-  {
-  case GNUNET_DNSPARSER_TYPE_CNAME:
-    if (0 != rd_count)
-    {
-      fprintf (stderr,
-               _ (
-                 "Records already exist under `%s', cannot add `%s' record.\n"),
-               rec_name,
-               "CNAME");
-      ret = 1;
-      test_finished ();
-      return;
-    }
-    break;
-
-  case GNUNET_GNSRECORD_TYPE_PKEY:
-  case GNUNET_GNSRECORD_TYPE_EDKEY:
-    if (0 != rd_count)
-    {
-      fprintf (stderr,
-               _ (
-                 "Records already exist under `%s', cannot add record.\n"),
-               rec_name);
-      ret = 1;
-      test_finished ();
-      return;
-    }
-    break;
-
-  case GNUNET_GNSRECORD_TYPE_GNS2DNS:
-    for (unsigned int i = 0; i < rd_count; i++)
-      if (GNUNET_GNSRECORD_TYPE_GNS2DNS != rd[i].record_type)
-      {
-        fprintf (
-          stderr,
-          _ (
-            "Non-GNS2DNS records already exist under `%s', cannot add GNS2DNS record.\n"),
-          rec_name);
-        ret = 1;
-        test_finished ();
-        return;
-      }
-    break;
-  }
   memset (rdn, 0, sizeof(struct GNUNET_GNSRECORD_Data));
   GNUNET_memcpy (&rdn[1], rd, rd_count * sizeof(struct GNUNET_GNSRECORD_Data));
   rde = &rdn[0];
@@ -929,6 +872,13 @@ parse_expiration (const char *expirationstring,
   {
     *etime_is_rel = GNUNET_YES;
     *etime = etime_rel.rel_value_us;
+    if (GNUNET_TIME_relative_cmp (etime_rel, <, WARN_RELATIVE_EXPIRATION_LIMIT))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                  "Relative expiration times of less than %s are not recommended. To improve availability, consider increasing this value.\n",
+                  GNUNET_STRINGS_relative_time_to_string (
+                    WARN_RELATIVE_EXPIRATION_LIMIT, GNUNET_NO));
+    }
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                 "Storing record with relative expiration time of %s\n",
                 GNUNET_STRINGS_relative_time_to_string (etime_rel, GNUNET_NO));
@@ -1212,8 +1162,8 @@ run_with_zone_pkey (const struct GNUNET_CONFIGURATION_Handle *cfg)
     char sname[64];
     struct GNUNET_IDENTITY_PublicKey pkey;
 
-    memset(sh, 0, 105);
-    memset(sname, 0, 64);
+    memset (sh, 0, 105);
+    memset (sname, 0, 64);
 
     if ((2 != (sscanf (uri, "gnunet://gns/%58s/%63s", sh, sname))) ||
         (GNUNET_OK !=
@@ -1286,15 +1236,6 @@ identity_cb (void *cls, struct GNUNET_IDENTITY_Ego *ego)
   const struct GNUNET_CONFIGURATION_Handle *cfg = cls;
 
   el = NULL;
-  if ((NULL != name) && (0 != strchr (name, '.')))
-  {
-    fprintf (stderr,
-             _ ("Label `%s' contains `.' which is not allowed\n"),
-             name);
-    GNUNET_SCHEDULER_shutdown ();
-    ret = -1;
-    return;
-  }
 
   if (NULL == ego)
   {
@@ -1705,13 +1646,13 @@ main (int argc, char *const *argv)
                                   NULL)))
   {
     GNUNET_free_nz ((void *) argv);
-    //FIXME
-    //GNUNET_CRYPTO_ecdsa_key_clear (&zone_pkey);
+    // FIXME
+    // GNUNET_CRYPTO_ecdsa_key_clear (&zone_pkey);
     return lret;
   }
   GNUNET_free_nz ((void *) argv);
-  //FIXME
-  //GNUNET_CRYPTO_ecdsa_key_clear (&zone_pkey);
+  // FIXME
+  // GNUNET_CRYPTO_ecdsa_key_clear (&zone_pkey);
   return ret;
 }
 
diff --git a/src/namestore/gnunet-service-namestore.c b/src/namestore/gnunet-service-namestore.c
index 9b2d9b6f3..d735822fb 100644
--- a/src/namestore/gnunet-service-namestore.c
+++ b/src/namestore/gnunet-service-namestore.c
@@ -121,6 +121,23 @@ struct ZoneIteration
   int send_end;
 };
 
+/**
+ * Lock on a record set
+ */
+struct RecordsLock
+{
+  /* DLL */
+  struct RecordsLock *prev;
+
+  /* DLL */
+  struct RecordsLock *next;
+
+  /* Hash of the locked label */
+  struct GNUNET_HashCode label_hash;
+
+  /* Client locking the zone */
+  struct NamestoreClient *client;
+};
 
 /**
  * A namestore client
@@ -394,6 +411,16 @@ static struct StoreActivity *sa_head;
 static struct StoreActivity *sa_tail;
 
 /**
+ * Head of the DLL of record set locks
+ */
+static struct RecordsLock *locks_head;
+
+/**
+ * Tail of the DLL of record set locks
+ */
+static struct RecordsLock *locks_tail;
+
+/**
  * Notification context shared by all monitors.
  */
 static struct GNUNET_NotificationContext *monitor_nc;
@@ -420,6 +447,7 @@ static void
 cleanup_task (void *cls)
 {
   struct CacheOperation *cop;
+  struct RecordsLock *lock;
 
   (void) cls;
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Stopping namestore service\n");
@@ -431,6 +459,14 @@ cleanup_task (void *cls)
     GNUNET_CONTAINER_DLL_remove (cop_head, cop_tail, cop);
     GNUNET_free (cop);
   }
+  while (NULL != (lock = locks_head))
+  {
+    GNUNET_CONTAINER_DLL_remove (locks_head,
+                                 locks_tail,
+                                 lock);
+    GNUNET_free (lock);
+  }
+
   if (NULL != namecache)
   {
     GNUNET_NAMECACHE_disconnect (namecache);
@@ -808,7 +844,8 @@ send_lookup_response (struct NamestoreClient *nc,
  * @param rid client's request ID
  */
 static void
-send_store_response (struct NamestoreClient *nc, int res, uint32_t rid)
+send_store_response (struct NamestoreClient *nc, int res, const char*emsg,
+                     uint32_t rid)
 {
   struct GNUNET_MQ_Envelope *env;
   struct RecordStoreResponseMessage *rcr_msg;
@@ -820,10 +857,17 @@ send_store_response (struct NamestoreClient *nc, int res, uint32_t rid)
                             "Store requests completed",
                             1,
                             GNUNET_NO);
-  env = GNUNET_MQ_msg (rcr_msg,
-                       GNUNET_MESSAGE_TYPE_NAMESTORE_RECORD_STORE_RESPONSE);
+  env = GNUNET_MQ_msg_extra (rcr_msg,
+                             (NULL != emsg) ? strlen (emsg) + 1 : 0,
+                             GNUNET_MESSAGE_TYPE_NAMESTORE_RECORD_STORE_RESPONSE);
   rcr_msg->gns_header.r_id = htonl (rid);
   rcr_msg->op_result = htonl (res);
+  rcr_msg->reserved = htons (0);
+  if (NULL != emsg)
+  {
+    rcr_msg->emsg_len = htons (strlen (emsg) + 1);
+    memcpy (&rcr_msg[1], emsg, strlen (emsg) + 1);
+  }
   GNUNET_MQ_send (nc->mq, env);
 }
 
@@ -874,7 +918,7 @@ finish_cache_operation (void *cls, int32_t success, const char *emsg)
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "CACHE operation completed\n");
   GNUNET_CONTAINER_DLL_remove (cop_head, cop_tail, cop);
   if (NULL != cop->nc)
-    send_store_response (cop->nc, success, cop->rid);
+    send_store_response (cop->nc, success, emsg, cop->rid);
   if (NULL != (zi = cop->zi))
   {
     zi->cache_ops--;
@@ -910,29 +954,40 @@ refresh_block (struct NamestoreClient *nc,
                const struct GNUNET_GNSRECORD_Data *rd)
 {
   struct GNUNET_GNSRECORD_Block *block;
+  struct GNUNET_GNSRECORD_Data rd_clean[rd_count];
   struct CacheOperation *cop;
   struct GNUNET_IDENTITY_PublicKey pkey;
   struct GNUNET_GNSRECORD_Data *nick;
   struct GNUNET_GNSRECORD_Data *res;
   unsigned int res_count;
+  unsigned int rd_count_clean;
   struct GNUNET_TIME_Absolute exp_time;
 
+  /** Do not block-cache tombstones */
+  rd_count_clean = 0;
+  for (int i = 0; i < rd_count; i++)
+  {
+    if (GNUNET_GNSRECORD_TYPE_TOMBSTONE == rd[i].record_type)
+      continue;
+    rd_clean[rd_count_clean++] = rd[i];
+  }
+
   nick = get_nick_record (zone_key);
-  res_count = rd_count;
-  res = (struct GNUNET_GNSRECORD_Data *) rd;  /* fixme: a bit unclean... */
+  res_count = rd_count_clean;
+  res = (struct GNUNET_GNSRECORD_Data *) rd_clean;  /* fixme: a bit unclean... */
   if ((NULL != nick) && (0 != strcmp (name, GNUNET_GNS_EMPTY_LABEL_AT)))
   {
     nick->flags =
       (nick->flags | GNUNET_GNSRECORD_RF_PRIVATE) ^ GNUNET_GNSRECORD_RF_PRIVATE;
-    merge_with_nick_records (nick, rd_count, rd, &res_count, &res);
+    merge_with_nick_records (nick, rd_count_clean, rd_clean, &res_count, &res);
   }
   if (NULL != nick)
     GNUNET_free (nick);
   if (0 == res_count)
   {
     if (NULL != nc)
-      send_store_response (nc, GNUNET_OK, rid);
-    if (rd != res)
+      send_store_response (nc, GNUNET_OK, NULL, rid);
+    if (rd_clean != res)
       GNUNET_free (res);
     return;   /* no data, no need to update cache */
   }
@@ -943,20 +998,21 @@ refresh_block (struct NamestoreClient *nc,
                               1,
                               GNUNET_NO);
     if (NULL != nc)
-      send_store_response (nc, GNUNET_OK, rid);
-    if (rd != res)
+      send_store_response (nc, GNUNET_OK, NULL, rid);
+    if (rd_clean != res)
       GNUNET_free (res);
     return;
   }
-  exp_time = GNUNET_GNSRECORD_record_get_expiration_time (res_count, res);
+  exp_time = GNUNET_GNSRECORD_record_get_expiration_time (res_count, res,
+                                                          GNUNET_TIME_UNIT_ZERO_ABS);
   if (cache_keys)
     GNUNET_assert (GNUNET_OK ==
-      GNUNET_GNSRECORD_block_create2 (zone_key, exp_time, name,
-                                      res, res_count, &block));
+                   GNUNET_GNSRECORD_block_create2 (zone_key, exp_time, name,
+                                                   res, res_count, &block));
   else
     GNUNET_assert (GNUNET_OK ==
-      GNUNET_GNSRECORD_block_create (zone_key, exp_time, name,
-                                     res, res_count, &block));
+                   GNUNET_GNSRECORD_block_create (zone_key, exp_time, name,
+                                                  res, res_count, &block));
   GNUNET_assert (NULL != block);
   GNUNET_IDENTITY_key_get_public (zone_key, &pkey);
   GNUNET_log (
@@ -974,7 +1030,7 @@ refresh_block (struct NamestoreClient *nc,
   cop->nc = nc;
   cop->zi = zi;
   if (NULL != zi)
-    zi->cache_ops++;
+    zi->cache_ops ++;
   cop->rid = rid;
   GNUNET_CONTAINER_DLL_insert (cop_head, cop_tail, cop);
   cop->qe = GNUNET_NAMECACHE_block_cache (namecache,
@@ -982,7 +1038,7 @@ refresh_block (struct NamestoreClient *nc,
                                           &finish_cache_operation,
                                           cop);
   GNUNET_free (block);
-  if (rd != res)
+  if (rd_clean != res)
     GNUNET_free (res);
 }
 
@@ -1098,6 +1154,7 @@ client_disconnect_cb (void *cls,
   struct NamestoreClient *nc = app_ctx;
   struct ZoneIteration *no;
   struct CacheOperation *cop;
+  struct RecordsLock *lock;
 
   (void) cls;
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Client %p disconnected\n", client);
@@ -1148,6 +1205,15 @@ client_disconnect_cb (void *cls,
   for (cop = cop_head; NULL != cop; cop = cop->next)
     if (nc == cop->nc)
       cop->nc = NULL;
+  for (lock = locks_head; NULL != lock; lock = lock->next)
+  {
+    if (nc != lock->client)
+      continue;
+    GNUNET_CONTAINER_DLL_remove (locks_head,
+                                 locks_tail,
+                                 lock);
+    GNUNET_free (lock);
+  }
   GNUNET_free (nc);
 }
 
@@ -1341,6 +1407,105 @@ check_record_lookup (void *cls, const struct LabelLookupMessage *ll_msg)
   return GNUNET_OK;
 }
 
+static void
+calculate_lock_hash (const char *label,
+                     const struct GNUNET_IDENTITY_PrivateKey *zone,
+                     struct GNUNET_HashCode *result)
+{
+  struct GNUNET_HashContext *hctx;
+
+  hctx = GNUNET_CRYPTO_hash_context_start ();
+  GNUNET_CRYPTO_hash_context_read (hctx, label, strlen (label));
+  GNUNET_CRYPTO_hash_context_read (hctx, zone,
+                                   sizeof (*zone));
+  GNUNET_CRYPTO_hash_context_finish (hctx, result);
+}
+
+/**
+ * Release a lock on a record set.
+ * Does nothing if lock not held.
+ *
+ * @param label the label of the record set
+ * @param zone the zone
+ * @param nc the client releasing the lock
+ */
+static void
+NST_label_lock_release (const char *label,
+                        const struct GNUNET_IDENTITY_PrivateKey *zone,
+                        const struct NamestoreClient *nc)
+{
+  struct GNUNET_HashCode label_hash;
+  struct RecordsLock *lock;
+
+  calculate_lock_hash (label, zone, &label_hash);
+  for (lock = locks_head; NULL != lock; lock = lock->next)
+    if (0 == memcmp (&label_hash, &lock->label_hash, sizeof (label_hash)))
+      break;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Record locked: %s\n", (NULL == lock) ? "No" : "Yes");
+  if (NULL == lock)
+    return;
+  if (lock->client != nc)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "Lock is held by other client on `%s'\n", label);
+    return;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Unocking %s\n", GNUNET_h2s (&label_hash));
+  GNUNET_CONTAINER_DLL_remove (locks_head,
+                               locks_tail,
+                               lock);
+  GNUNET_free (lock);
+}
+
+/**
+ * Get/set a lock on a record set.
+ * May be called multiple times but will
+ * not aquire additional locks.
+ *
+ * @param the label of the record set
+ * @param the zone
+ * @param the client doing the locking
+ * @return GNUNET_YES if lock retrieved or set already.
+ */
+static enum GNUNET_GenericReturnValue
+NST_label_lock (const char *label,
+                const struct GNUNET_IDENTITY_PrivateKey *zone,
+                struct NamestoreClient *nc)
+{
+  struct GNUNET_HashCode label_hash;
+  struct RecordsLock *lock;
+
+  calculate_lock_hash (label, zone, &label_hash);
+  for (lock = locks_head; NULL != lock; lock = lock->next)
+    if (0 == memcmp (&label_hash, &lock->label_hash, sizeof (label_hash)))
+      break;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Record locked: %s\n", (NULL == lock) ? "No" : "Yes");
+  if (NULL != lock)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Client holds lock: %s\n", (lock->client != nc) ? "No" : "Yes");
+    if (lock->client != nc)
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                  "Lock is held by other client on `%s'\n", label);
+      return GNUNET_NO;
+    }
+    return GNUNET_YES;
+  }
+  lock = GNUNET_new (struct RecordsLock);
+  lock->client = nc;
+  memcpy (&lock->label_hash, &label_hash, sizeof (label_hash));
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Locking %s\n", GNUNET_h2s (&label_hash));
+  GNUNET_CONTAINER_DLL_insert (locks_head,
+                               locks_tail,
+                               lock);
+  return GNUNET_YES;
+}
+
 
 /**
  * Handles a #GNUNET_MESSAGE_TYPE_NAMESTORE_RECORD_LOOKUP message
@@ -1355,13 +1520,14 @@ handle_record_lookup (void *cls, const struct LabelLookupMessage *ll_msg)
   struct GNUNET_MQ_Envelope *env;
   struct LabelLookupResponseMessage *llr_msg;
   struct RecordLookupContext rlc;
+  struct RecordsLock *lock;
+  struct GNUNET_HashCode label_hash;
   const char *name_tmp;
   char *res_name;
   char *conv_name;
   uint32_t name_len;
   int res;
 
-  name_len = ntohl (ll_msg->label_len);
   name_tmp = (const char *) &ll_msg[1];
   GNUNET_SERVICE_client_continue (nc->client);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
@@ -1377,6 +1543,29 @@ handle_record_lookup (void *cls, const struct LabelLookupMessage *ll_msg)
     GNUNET_SERVICE_client_drop (nc->client);
     return;
   }
+  name_len = strlen (conv_name) + 1;
+  if (GNUNET_YES == ntohl (ll_msg->locking))
+  {
+    if (GNUNET_NO == NST_label_lock (conv_name, &ll_msg->zone, nc))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                  "Lock is held by other client on `%s'\n", conv_name);
+      env =
+        GNUNET_MQ_msg_extra (llr_msg,
+                             name_len,
+                             GNUNET_MESSAGE_TYPE_NAMESTORE_RECORD_LOOKUP_RESPONSE);
+      llr_msg->gns_header.r_id = ll_msg->gns_header.r_id;
+      llr_msg->private_key = ll_msg->zone;
+      llr_msg->name_len = htons (name_len);
+      llr_msg->rd_count = htons (0);
+      llr_msg->rd_len = htons (0);
+      llr_msg->found = htons (GNUNET_SYSERR);
+      GNUNET_memcpy (&llr_msg[1], conv_name, name_len);
+      GNUNET_MQ_send (nc->mq, env);
+      GNUNET_free (conv_name);
+      return;
+    }
+  }
   rlc.label = conv_name;
   rlc.found = GNUNET_NO;
   rlc.res_rd_count = 0;
@@ -1388,7 +1577,6 @@ handle_record_lookup (void *cls, const struct LabelLookupMessage *ll_msg)
                                       conv_name,
                                       &lookup_it,
                                       &rlc);
-  GNUNET_free (conv_name);
   env =
     GNUNET_MQ_msg_extra (llr_msg,
                          name_len + rlc.rd_ser_len,
@@ -1400,16 +1588,18 @@ handle_record_lookup (void *cls, const struct LabelLookupMessage *ll_msg)
   llr_msg->rd_len = htons (rlc.rd_ser_len);
   res_name = (char *) &llr_msg[1];
   if ((GNUNET_YES == rlc.found) && (GNUNET_OK == res))
-    llr_msg->found = ntohs (GNUNET_YES);
+    llr_msg->found = htons (GNUNET_YES);
   else
-    llr_msg->found = ntohs (GNUNET_NO);
-  GNUNET_memcpy (&llr_msg[1], name_tmp, name_len);
+    llr_msg->found = htons (GNUNET_NO);
+  GNUNET_memcpy (&llr_msg[1], conv_name, name_len);
   GNUNET_memcpy (&res_name[name_len], rlc.res_rd, rlc.rd_ser_len);
   GNUNET_MQ_send (nc->mq, env);
   GNUNET_free (rlc.res_rd);
+  GNUNET_free (conv_name);
 }
 
 
+
 /**
  * Checks a #GNUNET_MESSAGE_TYPE_NAMESTORE_RECORD_STORE message
  *
@@ -1452,6 +1642,45 @@ check_record_store (void *cls, const struct RecordStoreMessage *rp_msg)
 
 
 /**
+ * Check if set contains a tombstone, store if necessary
+ *
+ * @param cls a `struct GNUNET_GNSRECORD_Data **` for storing the nick (if found)
+ * @param seq sequence number of the record, MUST NOT BE ZERO
+ * @param private_key the private key of the zone (unused)
+ * @param label should be #GNUNET_GNS_EMPTY_LABEL_AT
+ * @param rd_count number of records in @a rd
+ * @param rd records stored under @a label in the zone
+ */
+static void
+get_block_exp_existing (void *cls,
+                        uint64_t seq,
+                        const struct
+                        GNUNET_IDENTITY_PrivateKey *private_key,
+                        const char *label,
+                        unsigned int rd_count,
+                        const struct GNUNET_GNSRECORD_Data *rd)
+{
+  struct GNUNET_TIME_Absolute *exp = cls;
+  struct GNUNET_GNSRECORD_Data rd_pub[rd_count];
+  unsigned int rd_pub_count;
+  char *emsg;
+
+  if (GNUNET_OK != GNUNET_GNSRECORD_convert_records_for_export (label,
+                                                                rd,
+                                                                rd_count,
+                                                                rd_pub,
+                                                                &rd_pub_count,
+                                                                exp,
+                                                                &emsg))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "%s\n", emsg);
+    GNUNET_free (emsg);
+  }
+}
+
+
+/**
  * Handles a #GNUNET_MESSAGE_TYPE_NAMESTORE_RECORD_STORE message
  *
  * @param cls client sending the message
@@ -1470,37 +1699,75 @@ handle_record_store (void *cls, const struct RecordStoreMessage *rp_msg)
   unsigned int rd_count;
   int res;
   struct StoreActivity *sa;
+  struct RecordsLock *lock;
+  struct GNUNET_HashCode label_hash;
+  struct GNUNET_TIME_Absolute existing_block_exp;
+  struct GNUNET_TIME_Absolute new_block_exp;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Received NAMESTORE_RECORD_STORE message\n");
+  existing_block_exp = GNUNET_TIME_UNIT_ZERO_ABS;
+  new_block_exp = GNUNET_TIME_UNIT_ZERO_ABS;
   rid = ntohl (rp_msg->gns_header.r_id);
   name_len = ntohs (rp_msg->name_len);
   rd_count = ntohs (rp_msg->rd_count);
   rd_ser_len = ntohs (rp_msg->rd_len);
-  GNUNET_break (0 == ntohs (rp_msg->reserved));
   name_tmp = (const char *) &rp_msg[1];
   rd_ser = &name_tmp[name_len];
   {
     struct GNUNET_GNSRECORD_Data rd[GNUNET_NZL (rd_count)];
-
-    if (GNUNET_OK !=
-        GNUNET_GNSRECORD_records_deserialize (rd_ser_len, rd_ser, rd_count, rd))
-    {
-      GNUNET_break (0);
-      GNUNET_SERVICE_client_drop (nc->client);
-      return;
-    }
+    char *emsg;
 
     /* Extracting and converting private key */
     conv_name = GNUNET_GNSRECORD_string_normalize (name_tmp);
     if (NULL == conv_name)
     {
       GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                  "Error converting name `%s'\n",
+                  "Error normalizing name `%s'\n",
                   name_tmp);
-      GNUNET_SERVICE_client_drop (nc->client);
+      send_store_response (nc, GNUNET_SYSERR, _ ("Error normalizing name."),
+                           rid);
+      GNUNET_SERVICE_client_continue (nc->client);
+      return;
+    }
+
+    /* Check name for validity */
+    if (GNUNET_OK != GNUNET_GNSRECORD_label_check (conv_name, &emsg))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  "Label invalid: `%s'\n",
+                  emsg);
+      send_store_response (nc, GNUNET_SYSERR, emsg, rid);
+      GNUNET_free (emsg);
+      GNUNET_free (conv_name);
+      GNUNET_SERVICE_client_continue (nc->client);
+      return;
+    }
+
+    if (GNUNET_OK !=
+        GNUNET_GNSRECORD_records_deserialize (rd_ser_len, rd_ser, rd_count, rd))
+    {
+      send_store_response (nc, GNUNET_SYSERR,
+                           _ ("Error deserializing records."), rid);
+      GNUNET_free (conv_name);
+      GNUNET_SERVICE_client_continue (nc->client);
       return;
     }
+    if (GNUNET_YES == ntohl (rp_msg->locking))
+    {
+      if (GNUNET_NO == NST_label_lock (conv_name, &rp_msg->private_key, nc))
+      {
+        send_store_response (nc, GNUNET_SYSERR, _ ("Record set locked."), rid);
+        GNUNET_SERVICE_client_continue (nc->client);
+        GNUNET_free (conv_name);
+        return;
+      }
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "Client has lock on `%s', continuing.\n", conv_name);
+      if (GNUNET_YES == ntohl (rp_msg->locking))
+        NST_label_lock_release (conv_name, &rp_msg->private_key, nc);
+    }
+
     GNUNET_STATISTICS_update (statistics,
                               "Well-formed store requests received",
                               1,
@@ -1509,12 +1776,12 @@ handle_record_store (void *cls, const struct RecordStoreMessage *rp_msg)
                 "Creating %u records for name `%s'\n",
                 (unsigned int) rd_count,
                 conv_name);
-    if ((0 == rd_count) &&
-        (GNUNET_NO == GSN_database->lookup_records (GSN_database->cls,
+    if ((GNUNET_NO == GSN_database->lookup_records (GSN_database->cls,
                                                     &rp_msg->private_key,
                                                     conv_name,
-                                                    NULL,
-                                                    0)))
+                                                    &get_block_exp_existing,
+                                                    &existing_block_exp)) &&
+        (rd_count == 0))
     {
       /* This name does not exist, so cannot be removed */
       GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
@@ -1525,9 +1792,18 @@ handle_record_store (void *cls, const struct RecordStoreMessage *rp_msg)
     else
     {
       /* remove "NICK" records, unless this is for the
-       #GNUNET_GNS_EMPTY_LABEL_AT label */
+       #GNUNET_GNS_EMPTY_LABEL_AT label
+       We may need one additional record later for tombstone.
+       FIXME: Since we must normalize the record set (check for
+       consistency etc) we have to iterate the set twice.
+       May be inefficient.
+       We cannot really move the nick caching into GNSRECORD.
+       */
       struct GNUNET_GNSRECORD_Data rd_clean[GNUNET_NZL (rd_count)];
+      struct GNUNET_GNSRECORD_Data rd_nf[GNUNET_NZL (rd_count) + 1];
       unsigned int rd_clean_off;
+      unsigned int rd_nf_count;
+      char *emsg;
       int have_nick;
 
       rd_clean_off = 0;
@@ -1535,6 +1811,7 @@ handle_record_store (void *cls, const struct RecordStoreMessage *rp_msg)
       for (unsigned int i = 0; i < rd_count; i++)
       {
         rd_clean[rd_clean_off] = rd[i];
+
         if ((0 == strcmp (GNUNET_GNS_EMPTY_LABEL_AT, conv_name)) ||
             (GNUNET_GNSRECORD_TYPE_NICK != rd[i].record_type))
           rd_clean_off++;
@@ -1546,6 +1823,38 @@ handle_record_store (void *cls, const struct RecordStoreMessage *rp_msg)
           have_nick = GNUNET_YES;
         }
       }
+      if (GNUNET_OK != GNUNET_GNSRECORD_normalize_record_set (conv_name,
+                                                              rd_clean,
+                                                              rd_clean_off,
+                                                              rd_nf,
+                                                              &rd_nf_count,
+                                                              &new_block_exp,
+                                                              GNUNET_YES,
+                                                              &emsg))
+      {
+        send_store_response (nc, GNUNET_SYSERR, emsg, rid);
+        GNUNET_free (emsg);
+        GNUNET_SERVICE_client_continue (nc->client);
+        GNUNET_free (conv_name);
+        return;
+      }
+      /*
+       * If existing_block_exp is 0, then there was not record set
+       * and no tombstone.
+       * Otherwise, if the existing block expiration is after the
+       * new block expiration would be, we need to add a tombstone
+       * or update it.
+       */
+      if (GNUNET_TIME_absolute_cmp (new_block_exp, <=, existing_block_exp))
+      {
+        rd_nf[rd_nf_count].record_type = GNUNET_GNSRECORD_TYPE_TOMBSTONE;
+        rd_nf[rd_nf_count].expiration_time =
+          existing_block_exp.abs_value_us;
+        rd_nf[rd_nf_count].data = NULL;
+        rd_nf[rd_nf_count].data_size = 0;
+        rd_nf[rd_nf_count].flags = GNUNET_GNSRECORD_RF_PRIVATE;
+        rd_nf_count++;
+      }
       if ((0 == strcmp (GNUNET_GNS_EMPTY_LABEL_AT, conv_name)) &&
           (GNUNET_NO == have_nick))
       {
@@ -1555,19 +1864,18 @@ handle_record_store (void *cls, const struct RecordStoreMessage *rp_msg)
       res = GSN_database->store_records (GSN_database->cls,
                                          &rp_msg->private_key,
                                          conv_name,
-                                         rd_clean_off,
-                                         rd_clean);
+                                         rd_nf_count,
+                                         rd_nf);
     }
 
     if (GNUNET_OK != res)
     {
-      /* store not successful, not need to tell monitors */
-      send_store_response (nc, res, rid);
+      /* store not successful, no need to tell monitors */
+      send_store_response (nc, res, _ ("Store failed"), rid);
       GNUNET_SERVICE_client_continue (nc->client);
       GNUNET_free (conv_name);
       return;
     }
-
     sa = GNUNET_malloc (sizeof(struct StoreActivity)
                         + ntohs (rp_msg->gns_header.header.size));
     GNUNET_CONTAINER_DLL_insert (sa_head, sa_tail, sa);
diff --git a/src/namestore/namestore.h b/src/namestore/namestore.h
index fd9a8ed47..0f3ffa837 100644
--- a/src/namestore/namestore.h
+++ b/src/namestore/namestore.h
@@ -68,6 +68,11 @@ struct RecordStoreMessage
   struct GNUNET_TIME_AbsoluteNBO expire;
 
   /**
+   * Unock the label with this request.
+   */
+  uint32_t locking GNUNET_PACKED;
+
+  /**
    * Name length
    */
   uint16_t name_len GNUNET_PACKED;
@@ -83,7 +88,7 @@ struct RecordStoreMessage
   uint16_t rd_count GNUNET_PACKED;
 
   /**
-   * always zero (for alignment)
+   * Reserved for alignment.
    */
   uint16_t reserved GNUNET_PACKED;
 
@@ -113,6 +118,20 @@ struct RecordStoreResponseMessage
    * #GNUNET_SYSERR on failure, #GNUNET_OK on success
    */
   int32_t op_result GNUNET_PACKED;
+
+  /**
+   * Error message length
+   */
+  uint16_t emsg_len GNUNET_PACKED;
+
+  /**
+   * Reserved for alignment.
+   */
+  uint16_t reserved GNUNET_PACKED;
+
+  /**
+   * Followed by error message
+   */
 };
 
 
@@ -132,6 +151,11 @@ struct LabelLookupMessage
   uint32_t label_len GNUNET_PACKED;
 
   /**
+   * Lock the label with this lookup
+   */
+  uint32_t locking GNUNET_PACKED;
+
+  /**
    * The private key of the zone to look up in
    */
   struct GNUNET_IDENTITY_PrivateKey zone;
@@ -171,7 +195,7 @@ struct LabelLookupResponseMessage
    * Was the label found in the database??
    * #GNUNET_YES or #GNUNET_NO
    */
-  uint16_t found GNUNET_PACKED;
+  int16_t found GNUNET_PACKED;
 
   /**
    * The private key of the authority.
diff --git a/src/namestore/namestore_api.c b/src/namestore/namestore_api.c
index b24db9b26..a7380bbde 100644
--- a/src/namestore/namestore_api.c
+++ b/src/namestore/namestore_api.c
@@ -346,6 +346,44 @@ check_rd (size_t rd_len, const void *rd_buf, unsigned int rd_count)
   return GNUNET_OK;
 }
 
+/**
+ * Handle an incoming message of type
+ * #GNUNET_MESSAGE_TYPE_NAMESTORE_RECORD_STORE_RESPONSE
+ *
+ * @param cls
+ * @param msg the message we received
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
+ */
+static int
+check_record_store_response (void *cls,
+                             const struct RecordStoreResponseMessage *msg)
+{
+  const char *emsg;
+  size_t msg_len;
+  size_t emsg_len;
+
+  (void) cls;
+  msg_len = ntohs (msg->gns_header.header.size);
+  emsg_len = ntohs (msg->emsg_len);
+  if (0 != ntohs (msg->reserved))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (msg_len != sizeof(struct RecordStoreResponseMessage) + emsg_len)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  emsg = (const char *) &msg[1];
+  if ((0 != emsg_len) && ('\0' != emsg[emsg_len - 1]))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
 
 /**
  * Handle an incoming message of type
@@ -364,19 +402,16 @@ handle_record_store_response (void *cls,
   const char *emsg;
 
   qe = find_qe (h, ntohl (msg->gns_header.r_id));
+  emsg = (const char *) &msg[1];
   res = ntohl (msg->op_result);
   LOG (GNUNET_ERROR_TYPE_DEBUG,
        "Received RECORD_STORE_RESPONSE with result %d\n",
        res);
-  /* TODO: add actual error message from namestore to response... */
-  if (GNUNET_SYSERR == res)
-    emsg = _ ("Namestore failed to store record\n");
-  else
-    emsg = NULL;
   if (NULL == qe)
     return;
   if (NULL != qe->cont)
-    qe->cont (qe->cont_cls, res, emsg);
+    qe->cont (qe->cont_cls, res,
+             (GNUNET_OK == res) ? NULL : emsg);
   free_qe (qe);
 }
 
@@ -444,8 +479,10 @@ handle_lookup_result (void *cls, const struct LabelLookupResponseMessage *msg)
   size_t name_len;
   size_t rd_len;
   unsigned int rd_count;
+  int16_t found = (int16_t) ntohs (msg->found);
 
-  LOG (GNUNET_ERROR_TYPE_DEBUG, "Received RECORD_LOOKUP_RESULT\n");
+  LOG (GNUNET_ERROR_TYPE_DEBUG, "Received RECORD_LOOKUP_RESULT (found=%i)\n",
+        found);
   qe = find_qe (h, ntohl (msg->gns_header.r_id));
   if (NULL == qe)
     return;
@@ -453,7 +490,7 @@ handle_lookup_result (void *cls, const struct LabelLookupResponseMessage *msg)
   rd_count = ntohs (msg->rd_count);
   name_len = ntohs (msg->name_len);
   name = (const char *) &msg[1];
-  if (GNUNET_NO == ntohs (msg->found))
+  if (GNUNET_NO == found)
   {
     /* label was not in namestore */
     if (NULL != qe->proc)
@@ -461,6 +498,13 @@ handle_lookup_result (void *cls, const struct LabelLookupResponseMessage *msg)
     free_qe (qe);
     return;
   }
+  if (GNUNET_SYSERR == found)
+  {
+    if (NULL != qe->error_cb)
+      qe->error_cb (qe->error_cb_cls);
+    free_qe (qe);
+    return;
+  }
 
   rd_tmp = &name[name_len];
   {
@@ -775,7 +819,7 @@ static void
 reconnect (struct GNUNET_NAMESTORE_Handle *h)
 {
   struct GNUNET_MQ_MessageHandler handlers[] =
-  { GNUNET_MQ_hd_fixed_size (record_store_response,
+  { GNUNET_MQ_hd_var_size (record_store_response,
                              GNUNET_MESSAGE_TYPE_NAMESTORE_RECORD_STORE_RESPONSE,
                              struct RecordStoreResponseMessage,
                              h),
@@ -969,30 +1013,16 @@ warn_delay (void *cls)
   GNUNET_NAMESTORE_cancel (qe);
 }
 
-
-/**
- * Store an item in the namestore.  If the item is already present,
- * it is replaced with the new record.  Use an empty array to
- * remove all records under the given name.
- *
- * @param h handle to the namestore
- * @param pkey private key of the zone
- * @param label name that is being mapped (at most 255 characters long)
- * @param rd_count number of records in the @a rd array
- * @param rd array of records with data to store
- * @param cont continuation to call when done
- * @param cont_cls closure for @a cont
- * @return handle to abort the request
- */
 struct GNUNET_NAMESTORE_QueueEntry *
-GNUNET_NAMESTORE_records_store (
+records_store_ (
   struct GNUNET_NAMESTORE_Handle *h,
   const struct GNUNET_IDENTITY_PrivateKey *pkey,
   const char *label,
   unsigned int rd_count,
   const struct GNUNET_GNSRECORD_Data *rd,
   GNUNET_NAMESTORE_ContinuationWithStatus cont,
-  void *cont_cls)
+  void *cont_cls,
+  int locking)
 {
   struct GNUNET_NAMESTORE_QueueEntry *qe;
   struct GNUNET_MQ_Envelope *env;
@@ -1037,8 +1067,9 @@ GNUNET_NAMESTORE_records_store (
   msg->name_len = htons (name_len);
   msg->rd_count = htons (rd_count);
   msg->rd_len = htons (rd_ser_len);
-  msg->reserved = htons (0);
+  msg->reserved = ntohs(0);
   msg->private_key = *pkey;
+  msg->locking = htonl (locking);
 
   name_tmp = (char *) &msg[1];
   GNUNET_memcpy (name_tmp, label, name_len);
@@ -1070,28 +1101,45 @@ GNUNET_NAMESTORE_records_store (
   return qe;
 }
 
+struct GNUNET_NAMESTORE_QueueEntry *
+GNUNET_NAMESTORE_records_store (
+  struct GNUNET_NAMESTORE_Handle *h,
+  const struct GNUNET_IDENTITY_PrivateKey *pkey,
+  const char *label,
+  unsigned int rd_count,
+  const struct GNUNET_GNSRECORD_Data *rd,
+  GNUNET_NAMESTORE_ContinuationWithStatus cont,
+  void *cont_cls)
+{
+  return records_store_ (h, pkey, label,
+                         rd_count, rd, cont, cont_cls, GNUNET_NO);
+}
+
+struct GNUNET_NAMESTORE_QueueEntry *
+GNUNET_NAMESTORE_records_commit (
+  struct GNUNET_NAMESTORE_Handle *h,
+  const struct GNUNET_IDENTITY_PrivateKey *pkey,
+  const char *label,
+  unsigned int rd_count,
+  const struct GNUNET_GNSRECORD_Data *rd,
+  GNUNET_NAMESTORE_ContinuationWithStatus cont,
+  void *cont_cls)
+{
+  return records_store_ (h, pkey, label,
+                         rd_count, rd, cont, cont_cls, GNUNET_YES);
+}
+
 
-/**
- * Lookup an item in the namestore.
- *
- * @param h handle to the namestore
- * @param pkey private key of the zone
- * @param label name that is being mapped (at most 255 characters long)
- * @param error_cb function to call on error (i.e. disconnect)
- * @param error_cb_cls closure for @a error_cb
- * @param rm function to call with the result (with 0 records if we don't have that label)
- * @param rm_cls closure for @a rm
- * @return handle to abort the request
- */
 struct GNUNET_NAMESTORE_QueueEntry *
-GNUNET_NAMESTORE_records_lookup (
+records_lookup_ (
   struct GNUNET_NAMESTORE_Handle *h,
   const struct GNUNET_IDENTITY_PrivateKey *pkey,
   const char *label,
   GNUNET_SCHEDULER_TaskCallback error_cb,
   void *error_cb_cls,
   GNUNET_NAMESTORE_RecordMonitor rm,
-  void *rm_cls)
+  void *rm_cls,
+  int locking)
 {
   struct GNUNET_NAMESTORE_QueueEntry *qe;
   struct GNUNET_MQ_Envelope *env;
@@ -1119,6 +1167,7 @@ GNUNET_NAMESTORE_records_lookup (
   msg->gns_header.r_id = htonl (qe->op_id);
   msg->zone = *pkey;
   msg->label_len = htonl (label_len);
+  msg->locking = htonl (locking);
   GNUNET_memcpy (&msg[1], label, label_len);
   if (NULL == h->mq)
     qe->env = env;
@@ -1127,22 +1176,34 @@ GNUNET_NAMESTORE_records_lookup (
   return qe;
 }
 
+struct GNUNET_NAMESTORE_QueueEntry *
+GNUNET_NAMESTORE_records_lookup (
+  struct GNUNET_NAMESTORE_Handle *h,
+  const struct GNUNET_IDENTITY_PrivateKey *pkey,
+  const char *label,
+  GNUNET_SCHEDULER_TaskCallback error_cb,
+  void *error_cb_cls,
+  GNUNET_NAMESTORE_RecordMonitor rm,
+  void *rm_cls)
+{
+  return records_lookup_ (h, pkey, label,
+                          error_cb, error_cb_cls, rm, rm_cls, GNUNET_NO);
+}
+
+struct GNUNET_NAMESTORE_QueueEntry *
+GNUNET_NAMESTORE_records_open (
+  struct GNUNET_NAMESTORE_Handle *h,
+  const struct GNUNET_IDENTITY_PrivateKey *pkey,
+  const char *label,
+  GNUNET_SCHEDULER_TaskCallback error_cb,
+  void *error_cb_cls,
+  GNUNET_NAMESTORE_RecordMonitor rm,
+  void *rm_cls)
+{
+  return records_lookup_ (h, pkey, label,
+                          error_cb, error_cb_cls, rm, rm_cls, GNUNET_YES);
+}
 
-/**
- * Look for an existing PKEY delegation record for a given public key.
- * Returns at most one result to the processor.
- *
- * @param h handle to the namestore
- * @param zone public key of the zone to look up in, never NULL
- * @param value_zone public key of the target zone (value), never NULL
- * @param error_cb function to call on error (i.e. disconnect)
- * @param error_cb_cls closure for @a error_cb
- * @param proc function to call on the matching records, or with
- *        NULL (rd_count == 0) if there are no matching records
- * @param proc_cls closure for @a proc
- * @return a handle that can be used to
- *         cancel
- */
 struct GNUNET_NAMESTORE_QueueEntry *
 GNUNET_NAMESTORE_zone_to_name (
   struct GNUNET_NAMESTORE_Handle *h,
diff --git a/src/namestore/plugin_namestore_sqlite.c b/src/namestore/plugin_namestore_sqlite.c
index 7cb9b7ed0..0b3aac84f 100644
--- a/src/namestore/plugin_namestore_sqlite.c
+++ b/src/namestore/plugin_namestore_sqlite.c
@@ -329,6 +329,11 @@ namestore_sqlite_store_records (void *cls,
           0,
           sizeof(pkey));
   for (unsigned int i = 0; i < rd_count; i++)
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Checking if `%d' is zonekey type\n",
+       rd[i].record_type);
+
     if (GNUNET_YES == GNUNET_GNSRECORD_is_zonekey_type (rd[i].record_type))
     {
       GNUNET_break (GNUNET_YES ==
@@ -336,8 +341,13 @@ namestore_sqlite_store_records (void *cls,
                                                          rd[i].data_size,
                                                          rd[i].record_type,
                                                          &pkey));
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Storing delegation zone record value `%s'\n",
+       GNUNET_GNSRECORD_z2s (&pkey));
+
       break;
     }
+  }
   rvalue = GNUNET_CRYPTO_random_u64 (GNUNET_CRYPTO_QUALITY_WEAK,
                                      UINT64_MAX);
   data_size = GNUNET_GNSRECORD_records_get_size (rd_count,
diff --git a/src/namestore/test_namestore_api_lookup_nick.c b/src/namestore/test_namestore_api_lookup_nick.c
index 6ce969c9b..7decf39f8 100644
--- a/src/namestore/test_namestore_api_lookup_nick.c
+++ b/src/namestore/test_namestore_api_lookup_nick.c
@@ -262,12 +262,12 @@ nick_cont (void *cls, int32_t success, const char *emsg)
               "Nick added : %s\n",
               (success == GNUNET_OK) ? "SUCCESS" : "FAIL");
 
-  rd_orig.expiration_time = GNUNET_TIME_absolute_get ().abs_value_us;
+  rd_orig.expiration_time = GNUNET_TIME_UNIT_HOURS.rel_value_us;
   rd_orig.record_type = TEST_RECORD_TYPE;
   rd_orig.data_size = TEST_RECORD_DATALEN;
   record_data = GNUNET_malloc (TEST_RECORD_DATALEN);
   rd_orig.data = record_data;
-  rd_orig.flags = 0;
+  rd_orig.flags = GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION;
   memset ((char *) rd_orig.data, 'a', TEST_RECORD_DATALEN);
 
   nsqe = GNUNET_NAMESTORE_records_store (nsh, &privkey,
diff --git a/src/namestore/test_namestore_api_lookup_public.c b/src/namestore/test_namestore_api_lookup_public.c
index 5e3e7bbd8..cd69b96ef 100644
--- a/src/namestore/test_namestore_api_lookup_public.c
+++ b/src/namestore/test_namestore_api_lookup_public.c
@@ -188,7 +188,7 @@ run (void *cls,
      struct GNUNET_TESTING_Peer *peer)
 {
   struct GNUNET_GNSRECORD_Data rd;
-  const char *name = "dummy.dummy.gnunet";
+  const char *name = "dummy";
 
   endbadly_task = GNUNET_SCHEDULER_add_delayed (TIMEOUT,
                                                 &endbadly,
diff --git a/src/namestore/test_namestore_api_lookup_shadow.c b/src/namestore/test_namestore_api_lookup_shadow.c
index 79fa4c9c6..8f47d1280 100644
--- a/src/namestore/test_namestore_api_lookup_shadow.c
+++ b/src/namestore/test_namestore_api_lookup_shadow.c
@@ -223,7 +223,7 @@ run (void *cls,
      struct GNUNET_TESTING_Peer *peer)
 {
   struct GNUNET_GNSRECORD_Data rd;
-  const char *name = "dummy.dummy.gnunet";
+  const char *name = "dummy";
 
   endbadly_task = GNUNET_SCHEDULER_add_delayed (TIMEOUT,
                                                 &endbadly,
diff --git a/src/namestore/test_namestore_api_lookup_shadow_filter.c b/src/namestore/test_namestore_api_lookup_shadow_filter.c
index 4fc197750..0bcd130f9 100644
--- a/src/namestore/test_namestore_api_lookup_shadow_filter.c
+++ b/src/namestore/test_namestore_api_lookup_shadow_filter.c
@@ -32,7 +32,7 @@
 
 #define TEST_RECORD_TYPE GNUNET_DNSPARSER_TYPE_TXT
 
-#define TEST_NAME "dummy.dummy.gnunet"
+#define TEST_NAME "gnunet"
 #define TEST_RECORD_DATALEN 123
 #define TEST_RECORD_DATA 'a'
 #define TEST_SHADOW_RECORD_DATA 'b'
diff --git a/src/namestore/test_namestore_api_remove.c b/src/namestore/test_namestore_api_remove.c
index b6254e531..e8124c595 100644
--- a/src/namestore/test_namestore_api_remove.c
+++ b/src/namestore/test_namestore_api_remove.c
@@ -153,7 +153,7 @@ run (void *cls,
      struct GNUNET_TESTING_Peer *peer)
 {
   struct GNUNET_GNSRECORD_Data rd;
-  const char *name = "dummy.dummy.gnunet";
+  const char *name = "dummy";
 
   endbadly_task = GNUNET_SCHEDULER_add_delayed (TIMEOUT,
                                                 &endbadly,
diff --git a/src/namestore/test_namestore_api_remove_not_existing_record.c b/src/namestore/test_namestore_api_remove_not_existing_record.c
index e66992909..958ea4bf2 100644
--- a/src/namestore/test_namestore_api_remove_not_existing_record.c
+++ b/src/namestore/test_namestore_api_remove_not_existing_record.c
@@ -127,7 +127,7 @@ run (void *cls,
      const struct GNUNET_CONFIGURATION_Handle *cfg,
      struct GNUNET_TESTING_Peer *peer)
 {
-  const char *name = "dummy.dummy.gnunet";
+  const char *name = "dummy";
 
   endbadly_task = GNUNET_SCHEDULER_add_delayed (TIMEOUT,
                                                 &endbadly,
diff --git a/src/namestore/test_namestore_api_zone_to_name.c b/src/namestore/test_namestore_api_zone_to_name.c
index 3fd10e4a1..1e2f8248b 100644
--- a/src/namestore/test_namestore_api_zone_to_name.c
+++ b/src/namestore/test_namestore_api_zone_to_name.c
@@ -216,11 +216,11 @@ run (void *cls,
   {
     struct GNUNET_GNSRECORD_Data rd;
 
-    rd.expiration_time = GNUNET_TIME_absolute_get ().abs_value_us;
+    rd.expiration_time = GNUNET_TIME_UNIT_HOURS.rel_value_us;
     rd.record_type = GNUNET_GNSRECORD_TYPE_PKEY;
-    rd.data_size = GNUNET_IDENTITY_key_get_length (&s_zone_value);
-    rd.data = &s_zone_value;
-    rd.flags = 0;
+    rd.data_size = sizeof (s_zone_value.ecdsa_key);
+    rd.data = &s_zone_value.ecdsa_key;
+    rd.flags = GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION;
 
     nsh = GNUNET_NAMESTORE_connect (cfg);
     GNUNET_break (NULL != nsh);
@@ -230,7 +230,7 @@ run (void *cls,
                                     1,
                                     &rd,
                                     &put_cont,
-                                    NULL);
+                                    s_name);
   }
 }
 
diff --git a/src/namestore/test_namestore_delete.sh b/src/namestore/test_namestore_delete.sh
index 44ea1e66c..b861a4bc0 100755
--- a/src/namestore/test_namestore_delete.sh
+++ b/src/namestore/test_namestore_delete.sh
@@ -61,15 +61,7 @@ for LINE in $OUTPUT ;
 stop_peer
 
 
-if [ $FOUND_NAME = false -a $FOUND_IP != false ]
-then
-  echo "PASS: Delete name in namestore"
-  exit 0
-elif [ $FOUND_NAME = true ]
-then
-  echo "FAIL: Delete name in namestore: name returned"
-  exit 1
-elif [ $FOUND_IP = true ]
+if [ $FOUND_IP = true ]
 then
   echo "FAIL: Delete name in namestore: IP returned"
   exit 1
diff --git a/src/namestore/test_plugin_rest_namestore.sh b/src/namestore/test_plugin_rest_namestore.sh
index 8a45cebf5..50b3c8c12 100755
--- a/src/namestore/test_plugin_rest_namestore.sh
+++ b/src/namestore/test_plugin_rest_namestore.sh
@@ -78,15 +78,16 @@ curl_delete () {
 
 TEST_ID="test"
 gnunet-arm -s -c test_namestore_api.conf
-gnunet-arm -i rest -c test_namestore_api.conf
 #Test GET
 gnunet-identity -C $TEST_ID -c test_namestore_api.conf
 test="$(gnunet-namestore -D -z $TEST_ID -c test_namestore_api.conf)"
 name=$TEST_ID
 public="$(gnunet-identity -d -c test_namestore_api.conf | grep $TEST_ID | awk 'NR==1{print $3}')"
 echo "$name $public"
-valgrind gnunet-namestore -z $name -p -a -n "test_entry" -e "1d" -V "000G006WVZ8HQ5YTVFNX09HK0VJVVQ9ZCBYDSCH3ERT04N5ZRBKEB82EP8" -t "PKEY" -c test_namestore_api.conf
-#curl_get "${namestore_link}" "HTTP/1.1 200 OK"
+gnunet-namestore -z $name -p -a -n "test_entry" -e "1d" -V "000G006WVZ8HQ5YTVFNX09HK0VJVVQ9ZCBYDSCH3ERT04N5ZRBKEB82EP8" -t "PKEY" -c test_namestore_api.conf
+sleep 1
+gnunet-arm -i rest -c test_namestore_api.conf
+sleep 1
 curl_get "${namestore_link}/$name" "HTTP/1.1 200 OK"
 curl_get "${namestore_link}/$public" "error"
 gnunet-namestore -z $name -d -n "test_entry" -c test_namestore_api.conf
@@ -128,9 +129,6 @@ gnunet-namestore -z $name -d -n "test_entry"  -c test_namestore_api.conf > /dev/
 #Test DELETE
 gnunet-namestore -z $name -p -a -n "test_entry" -e "1d" -V "000G006WVZ8HQ5YTVFNX09HK0VJVVQ9ZCBYDSCH3ERT04N5ZRBKEB82EP8" -t "PKEY"  -c test_namestore_api.conf
 curl_delete "${namestore_link}/$name/test_entry" "HTTP/1.1 204" 
-curl_delete "${namestore_link}/$name/test_entry" "error" 
-gnunet-namestore -z $name -p -a -n "test_entry" -e "1d" -V "000G006WVZ8HQ5YTVFNX09HK0VJVVQ9ZCBYDSCH3ERT04N5ZRBKEB82EP8" -t "PKEY"  -c test_namestore_api.conf
-curl_delete "${namestore_link}/$public/test_entry" "error" 
 
 gnunet-arm -e  -c test_namestore_api.conf
 exit 0;
diff --git a/src/reclaim/reclaim_api.c b/src/reclaim/reclaim_api.c
index f41473f9f..bc6b835c9 100644
--- a/src/reclaim/reclaim_api.c
+++ b/src/reclaim/reclaim_api.c
@@ -1550,7 +1550,6 @@ GNUNET_RECLAIM_ticket_issue (
   struct IssueTicketMessage *tim;
   size_t attr_len;
 
-  fprintf (stderr, "Issuing ticket\n");
   op = GNUNET_new (struct GNUNET_RECLAIM_Operation);
   op->h = h;
   op->ti_cb = cb;
diff --git a/src/reclaim/test_reclaim.conf b/src/reclaim/test_reclaim.conf
index ec19056e4..2dc53fe81 100644
--- a/src/reclaim/test_reclaim.conf
+++ b/src/reclaim/test_reclaim.conf
@@ -15,7 +15,7 @@ PLUGINS =
 
 [reclaim]
 START_ON_DEMAND = YES
-TICKET_REFRESH_INTERVAL = 15s
+TICKET_REFRESH_INTERVAL = 30 s
 #PREFIX = valgrind --leak-check=full --show-leak-kinds=all --track-origins=yes --log-file=$GNUNET_TMP/idplog
 
 [gns]
diff --git a/src/reclaim/test_reclaim_consume.sh b/src/reclaim/test_reclaim_consume.sh
index 9186d3cb1..c012862c3 100755
--- a/src/reclaim/test_reclaim_consume.sh
+++ b/src/reclaim/test_reclaim_consume.sh
@@ -32,12 +32,14 @@ TEST_KEY=$(gnunet-identity -d -e testego -q -c test_reclaim.conf)
 gnunet-reclaim -e testego -a email -V john@doe.gnu -c test_reclaim.conf
 gnunet-reclaim -e testego -a name -V John -c test_reclaim.conf
 TICKET=$(gnunet-reclaim -e testego -i "email,name" -r $SUBJECT_KEY -c test_reclaim.conf | awk '{print $1}')
-gnunet-reclaim -e rpego -C $TICKET -c test_reclaim.conf >/dev/null 2>&1
+gnunet-reclaim -e rpego -C $TICKET -c test_reclaim.conf #>/dev/null 2>&1
 
-if test $? != 0
+RES=$?
+gnunet-identity -D testego -c test_reclaim.conf
+gnunet-identity -D rpego -c test_reclaim.conf
+gnunet-arm -e -c test_reclaim.conf
+if test $RES != 0
 then
-  "Failed."
-  exit 1
+  echo "Failed."
 fi
-#curl http://localhost:7776/reclaim/tickets/testego
-gnunet-arm -e -c test_reclaim.conf
+
diff --git a/src/regex/plugin_block_regex.c b/src/regex/plugin_block_regex.c
index 0953830ab..61442ac10 100644
--- a/src/regex/plugin_block_regex.c
+++ b/src/regex/plugin_block_regex.c
@@ -93,242 +93,6 @@ block_plugin_regex_create_group (void *cls,
 
 
 /**
- * Function called to validate a reply or a request of type
- * #GNUNET_BLOCK_TYPE_REGEX.
- * For request evaluation, pass "NULL" for the reply_block.
- * Note that it is assumed that the reply has already been
- * matched to the key (and signatures checked) as it would
- * be done with the #GNUNET_BLOCK_get_key() function.
- *
- * @param cls closure
- * @param type block type
- * @param bg block group to evaluate against
- * @param eo control flags
- * @param query original query (hash)
- * @param xquery extrended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in @a xquery
- * @param reply_block response to validate
- * @param reply_block_size number of bytes in @a reply_block
- * @return characterization of result
- */
-static enum GNUNET_BLOCK_EvaluationResult
-evaluate_block_regex (void *cls,
-                      enum GNUNET_BLOCK_Type type,
-                      struct GNUNET_BLOCK_Group *bg,
-                      enum GNUNET_BLOCK_EvaluationOptions eo,
-                      const struct GNUNET_HashCode *query,
-                      const void *xquery,
-                      size_t xquery_size,
-                      const void *reply_block,
-                      size_t reply_block_size)
-{
-  struct GNUNET_HashCode chash;
-
-  if (NULL == reply_block)
-  {
-    if (0 != xquery_size)
-    {
-      const char *s;
-
-      s = (const char *) xquery;
-      if ('\0' != s[xquery_size - 1])     /* must be valid 0-terminated string */
-      {
-        GNUNET_break_op (0);
-        return GNUNET_BLOCK_EVALUATION_REQUEST_INVALID;
-      }
-    }
-    return GNUNET_BLOCK_EVALUATION_REQUEST_VALID;
-  }
-  if (0 != xquery_size)
-  {
-    const char *s;
-
-    s = (const char *) xquery;
-    if ('\0' != s[xquery_size - 1])   /* must be valid 0-terminated string */
-    {
-      GNUNET_break_op (0);
-      return GNUNET_BLOCK_EVALUATION_REQUEST_INVALID;
-    }
-  }
-  else if (NULL != query)
-  {
-    /* xquery is required for regex GETs, at least an empty string */
-    GNUNET_break_op (0);
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "type %d, query %p, xquery %p\n",
-                type, query, xquery);
-    return GNUNET_BLOCK_EVALUATION_REQUEST_INVALID;
-  }
-  switch (REGEX_BLOCK_check (reply_block,
-                             reply_block_size,
-                             query,
-                             xquery))
-  {
-  case GNUNET_SYSERR:
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-
-  case GNUNET_NO:
-    /* xquery mismatch, can happen */
-    return GNUNET_BLOCK_EVALUATION_RESULT_IRRELEVANT;
-
-  default:
-    break;
-  }
-  GNUNET_CRYPTO_hash (reply_block,
-                      reply_block_size,
-                      &chash);
-  if (GNUNET_YES ==
-      GNUNET_BLOCK_GROUP_bf_test_and_set (bg,
-                                          &chash))
-    return GNUNET_BLOCK_EVALUATION_OK_DUPLICATE;
-  return GNUNET_BLOCK_EVALUATION_OK_MORE;
-}
-
-
-/**
- * Function called to validate a reply or a request of type
- * #GNUNET_BLOCK_TYPE_REGEX_ACCEPT.
- * For request evaluation, pass "NULL" for the reply_block.
- * Note that it is assumed that the reply has already been
- * matched to the key (and signatures checked) as it would
- * be done with the #GNUNET_BLOCK_get_key() function.
- *
- * @param cls closure
- * @param type block type
- * @param bg block group to evaluate against
- * @param eo control flags
- * @param query original query (hash)
- * @param xquery extrended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in @a xquery
- * @param reply_block response to validate
- * @param reply_block_size number of bytes in @a reply_block
- * @return characterization of result
- */
-static enum GNUNET_BLOCK_EvaluationResult
-evaluate_block_regex_accept (void *cls,
-                             enum GNUNET_BLOCK_Type type,
-                             struct GNUNET_BLOCK_Group *bg,
-                             enum GNUNET_BLOCK_EvaluationOptions eo,
-                             const struct GNUNET_HashCode *query,
-                             const void *xquery,
-                             size_t xquery_size, const void *reply_block,
-                             size_t reply_block_size)
-{
-  const struct RegexAcceptBlock *rba;
-  struct GNUNET_HashCode chash;
-
-  if (0 != xquery_size)
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_REQUEST_INVALID;
-  }
-  if (NULL == reply_block)
-    return GNUNET_BLOCK_EVALUATION_REQUEST_VALID;
-  if (sizeof(struct RegexAcceptBlock) != reply_block_size)
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-  }
-  rba = reply_block;
-  if (ntohl (rba->purpose.size) !=
-      sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose)
-      + sizeof(struct GNUNET_TIME_AbsoluteNBO)
-      + sizeof(struct GNUNET_HashCode))
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-  }
-  if (0 == GNUNET_TIME_absolute_get_remaining (GNUNET_TIME_absolute_ntoh (
-                                                 rba->expiration_time)).
-      rel_value_us)
-  {
-    /* technically invalid, but can happen without an error, so
-       we're nice by reporting it as a 'duplicate' */
-    return GNUNET_BLOCK_EVALUATION_OK_DUPLICATE;
-  }
-  if (GNUNET_OK !=
-      GNUNET_CRYPTO_eddsa_verify_ (GNUNET_SIGNATURE_PURPOSE_REGEX_ACCEPT,
-                                   &rba->purpose,
-                                   &rba->signature,
-                                   &rba->peer.public_key))
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-  }
-  GNUNET_CRYPTO_hash (reply_block,
-                      reply_block_size,
-                      &chash);
-  if (GNUNET_YES ==
-      GNUNET_BLOCK_GROUP_bf_test_and_set (bg,
-                                          &chash))
-    return GNUNET_BLOCK_EVALUATION_OK_DUPLICATE;
-  return GNUNET_BLOCK_EVALUATION_OK_MORE;
-}
-
-
-/**
- * Function called to validate a reply or a request.  For
- * request evaluation, simply pass "NULL" for the reply_block.
- * Note that it is assumed that the reply has already been
- * matched to the key (and signatures checked) as it would
- * be done with the #GNUNET_BLOCK_get_key() function.
- *
- * @param cls closure
- * @param ctx block context
- * @param type block type
- * @param bg group to evaluate against
- * @param eo control flags
- * @param query original query (hash)
- * @param xquery extrended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in xquery
- * @param reply_block response to validate
- * @param reply_block_size number of bytes in reply block
- * @return characterization of result
- */
-static enum GNUNET_BLOCK_EvaluationResult
-block_plugin_regex_evaluate (void *cls,
-                             struct GNUNET_BLOCK_Context *ctx,
-                             enum GNUNET_BLOCK_Type type,
-                             struct GNUNET_BLOCK_Group *bg,
-                             enum GNUNET_BLOCK_EvaluationOptions eo,
-                             const struct GNUNET_HashCode *query,
-                             const void *xquery,
-                             size_t xquery_size,
-                             const void *reply_block,
-                             size_t reply_block_size)
-{
-  enum GNUNET_BLOCK_EvaluationResult result;
-
-  switch (type)
-  {
-  case GNUNET_BLOCK_TYPE_REGEX:
-    result = evaluate_block_regex (cls,
-                                   type,
-                                   bg,
-                                   eo,
-                                   query,
-                                   xquery, xquery_size,
-                                   reply_block, reply_block_size);
-    break;
-
-  case GNUNET_BLOCK_TYPE_REGEX_ACCEPT:
-    result = evaluate_block_regex_accept (cls,
-                                          type,
-                                          bg,
-                                          eo,
-                                          query,
-                                          xquery, xquery_size,
-                                          reply_block, reply_block_size);
-    break;
-
-  default:
-    result = GNUNET_BLOCK_EVALUATION_TYPE_NOT_SUPPORTED;
-  }
-  return result;
-}
-
-
-/**
  * Function called to validate a query.
  *
  * @param cls closure
@@ -341,10 +105,10 @@ block_plugin_regex_evaluate (void *cls,
  */
 static enum GNUNET_GenericReturnValue
 block_plugin_regex_check_query (void *cls,
-                                    enum GNUNET_BLOCK_Type type,
-                                    const struct GNUNET_HashCode *query,
-                                    const void *xquery,
-                                    size_t xquery_size)
+                                enum GNUNET_BLOCK_Type type,
+                                const struct GNUNET_HashCode *query,
+                                const void *xquery,
+                                size_t xquery_size)
 {
   switch (type)
   {
@@ -380,7 +144,6 @@ block_plugin_regex_check_query (void *cls,
  *
  * @param cls closure
  * @param type block type
- * @param query key for the block (hash), must match exactly
  * @param block block data to validate
  * @param block_size number of bytes in @a block
  * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
@@ -388,7 +151,6 @@ block_plugin_regex_check_query (void *cls,
 static enum GNUNET_GenericReturnValue
 block_plugin_regex_check_block (void *cls,
                                     enum GNUNET_BLOCK_Type type,
-                                    const struct GNUNET_HashCode *query,
                                     const void *block,
                                     size_t block_size)
 {
@@ -398,7 +160,7 @@ block_plugin_regex_check_block (void *cls,
     if (GNUNET_SYSERR ==
         REGEX_BLOCK_check (block,
                            block_size,
-                           query,
+                           NULL,
                            NULL))
       return GNUNET_NO;
     return GNUNET_OK;
@@ -480,12 +242,7 @@ block_plugin_regex_check_reply (
       const char *s;
       
       s = (const char *) xquery;
-      if ('\0' != s[xquery_size - 1])   /* must be valid 0-terminated string */
-      {
-        /* Technically, the query is invalid ... */
-        GNUNET_break (0);
-        return GNUNET_BLOCK_REPLY_INVALID;
-      }
+      GNUNET_assert ('\0' == s[xquery_size - 1]);
     }
     switch (REGEX_BLOCK_check (reply_block,
                                reply_block_size,
@@ -493,8 +250,7 @@ block_plugin_regex_check_reply (
                                xquery))
     {
     case GNUNET_SYSERR:
-      GNUNET_break_op (0);
-      return GNUNET_BLOCK_REPLY_INVALID;
+      GNUNET_assert (0);
     case GNUNET_NO:
       /* xquery mismatch, can happen */
       return GNUNET_BLOCK_REPLY_IRRELEVANT;
@@ -513,20 +269,12 @@ block_plugin_regex_check_reply (
     {
     const struct RegexAcceptBlock *rba;
 
-    if (sizeof(struct RegexAcceptBlock) != reply_block_size)
-    {
-      GNUNET_break_op (0);
-      return GNUNET_BLOCK_REPLY_INVALID;
-    }
+    GNUNET_assert (sizeof(struct RegexAcceptBlock) == reply_block_size);
     rba = reply_block;
-    if (ntohl (rba->purpose.size) !=
+    GNUNET_assert (ntohl (rba->purpose.size) ==
         sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose)
         + sizeof(struct GNUNET_TIME_AbsoluteNBO)
-        + sizeof(struct GNUNET_HashCode))
-    {
-      GNUNET_break_op (0);
-      return GNUNET_BLOCK_REPLY_INVALID;
-    }
+                   + sizeof(struct GNUNET_HashCode));
     GNUNET_CRYPTO_hash (reply_block,
                         reply_block_size,
                         &chash);
@@ -552,8 +300,8 @@ block_plugin_regex_check_reply (
  * @param block block to get the key for
  * @param block_size number of bytes in @a block
  * @param key set to the key (query) for the given block
- * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported
- *         (or if extracting a key from a block of this type does not work)
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported,
+ *         #GNUNET_NO if extracting a key from a block of this type does not work
  */
 static enum GNUNET_GenericReturnValue
 block_plugin_regex_get_key (void *cls,
@@ -571,14 +319,20 @@ block_plugin_regex_get_key (void *cls,
                              key))
     {
       GNUNET_break_op (0);
-      return GNUNET_NO;
+      memset (key,
+              0,
+              sizeof (*key));
+      return GNUNET_OK;
     }
     return GNUNET_OK;
   case GNUNET_BLOCK_TYPE_REGEX_ACCEPT:
     if (sizeof(struct RegexAcceptBlock) != block_size)
     {
       GNUNET_break_op (0);
-      return GNUNET_NO;
+      memset (key,
+              0,
+              sizeof (*key));
+      return GNUNET_OK;
     }
     *key = ((struct RegexAcceptBlock *) block)->key;
     return GNUNET_OK;
@@ -603,7 +357,6 @@ libgnunet_plugin_block_regex_init (void *cls)
   struct GNUNET_BLOCK_PluginFunctions *api;
 
   api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
-  api->evaluate = &block_plugin_regex_evaluate;
   api->get_key = &block_plugin_regex_get_key;
   api->check_query = &block_plugin_regex_check_query;
   api->check_block = &block_plugin_regex_check_block;
diff --git a/src/revocation/gnunet-revocation-tvg.c b/src/revocation/gnunet-revocation-tvg.c
index 3ba5b56fa..a34a6bc98 100644
--- a/src/revocation/gnunet-revocation-tvg.c
+++ b/src/revocation/gnunet-revocation-tvg.c
@@ -159,6 +159,7 @@ run (void *cls,
   print_bytes (pow,
                GNUNET_REVOCATION_proof_get_size (pow),
                8);
+  GNUNET_free (ph);
 }
 
 
diff --git a/src/revocation/plugin_block_revocation.c b/src/revocation/plugin_block_revocation.c
index 3beae60bb..12ec555e4 100644
--- a/src/revocation/plugin_block_revocation.c
+++ b/src/revocation/plugin_block_revocation.c
@@ -44,65 +44,6 @@ struct InternalContext
 
 
 /**
- * Function called to validate a reply or a request.  For
- * request evaluation, simply pass "NULL" for the reply_block.
- *
- * @param cls our `struct InternalContext`
- * @param ctx context
- * @param type block type
- * @param group block group to use
- * @param eo control flags
- * @param query original query (hash)
- * @param xquery extrended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in xquery
- * @param reply_block response to validate
- * @param reply_block_size number of bytes in reply block
- * @return characterization of result
- */
-static enum GNUNET_BLOCK_EvaluationResult
-block_plugin_revocation_evaluate (void *cls,
-                                  struct GNUNET_BLOCK_Context *ctx,
-                                  enum GNUNET_BLOCK_Type type,
-                                  struct GNUNET_BLOCK_Group *group,
-                                  enum GNUNET_BLOCK_EvaluationOptions eo,
-                                  const struct GNUNET_HashCode *query,
-                                  const void *xquery,
-                                  size_t xquery_size,
-                                  const void *reply_block,
-                                  size_t reply_block_size)
-{
-  struct InternalContext *ic = cls;
-  ssize_t pklen;
-  const struct RevokeMessage *rm = reply_block;
-
-  if (NULL == reply_block)
-    return GNUNET_BLOCK_EVALUATION_REQUEST_VALID;
-  if (reply_block_size != sizeof(*rm))
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-  }
-  struct GNUNET_REVOCATION_PowP *pow = (struct GNUNET_REVOCATION_PowP *) &rm[1];
-  const struct GNUNET_IDENTITY_PublicKey *pk;
-  pk = (const struct GNUNET_IDENTITY_PublicKey *) &pow[1];
-  if (GNUNET_YES != GNUNET_REVOCATION_check_pow (pow,
-                                                 ic->matching_bits,
-                                                 ic->epoch_duration))
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-  }
-  pklen = GNUNET_IDENTITY_key_get_length (pk);
-  if (0 > pklen)
-  {
-    GNUNET_break_op (0);
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-  }
-  return GNUNET_BLOCK_EVALUATION_OK_LAST;
-}
-
-
-/**
  * Function called to validate a query.
  *
  * @param cls closure
@@ -124,7 +65,10 @@ block_plugin_revocation_check_query (void *cls,
   (void) query;
   (void) xquery;
   if (GNUNET_BLOCK_TYPE_REVOCATION != type)
+  {
+    GNUNET_break (0);
     return GNUNET_SYSERR;
+  }
   if (0 != xquery_size)
     return GNUNET_NO;
   return GNUNET_OK;
@@ -136,7 +80,6 @@ block_plugin_revocation_check_query (void *cls,
  *
  * @param cls closure
  * @param type block type
- * @param query key for the block (hash), must match exactly
  * @param block block data to validate
  * @param block_size number of bytes in @a block
  * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
@@ -144,7 +87,6 @@ block_plugin_revocation_check_query (void *cls,
 static enum GNUNET_GenericReturnValue
 block_plugin_revocation_check_block (void *cls,
                                     enum GNUNET_BLOCK_Type type,
-                                    const struct GNUNET_HashCode *query,
                                     const void *block,
                                     size_t block_size)
 {
@@ -157,7 +99,10 @@ block_plugin_revocation_check_block (void *cls,
   size_t left;
 
   if (GNUNET_BLOCK_TYPE_REVOCATION != type)
+  {
+    GNUNET_break (0);
     return GNUNET_SYSERR;
+  }
   if (block_size < sizeof(*rm) + sizeof(*pow))
   {
     GNUNET_break_op (0);
@@ -224,7 +169,10 @@ block_plugin_revocation_check_reply (
   (void) reply_block;
   (void) reply_block_size;
   if (GNUNET_BLOCK_TYPE_REVOCATION != type)
+  {
+    GNUNET_break (0);
     return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
+  }
   return GNUNET_BLOCK_REPLY_OK_LAST;
 }
 
@@ -255,7 +203,10 @@ block_plugin_revocation_get_key (void *cls,
   size_t left;
 
   if (GNUNET_BLOCK_TYPE_REVOCATION != type)
+  {
+    GNUNET_break (0);
     return GNUNET_SYSERR;
+  }
   if (block_size < sizeof(*rm) + sizeof(*pow))
   {
     GNUNET_break_op (0);
@@ -314,7 +265,6 @@ libgnunet_plugin_block_revocation_init (void *cls)
     return NULL;
 
   api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
-  api->evaluate = &block_plugin_revocation_evaluate;
   api->get_key = &block_plugin_revocation_get_key;
   api->check_query = &block_plugin_revocation_check_query;
   api->check_block = &block_plugin_revocation_check_block;
diff --git a/src/revocation/revocation_api.c b/src/revocation/revocation_api.c
index bc5dae021..9080ab862 100644
--- a/src/revocation/revocation_api.c
+++ b/src/revocation/revocation_api.c
@@ -758,13 +758,11 @@ GNUNET_REVOCATION_proof_get_size (const struct GNUNET_REVOCATION_PowP *pow)
   size_t size;
   size_t ksize;
   const struct GNUNET_IDENTITY_PublicKey *pk;
-  const struct GNUNET_IDENTITY_Signature *sig;
 
   size = sizeof (struct GNUNET_REVOCATION_PowP);
   pk = (const struct GNUNET_IDENTITY_PublicKey *) &pow[1];
   ksize = GNUNET_IDENTITY_key_get_length (pk);
   size += ksize;
-  sig = (struct GNUNET_IDENTITY_Signature *) ((char*) &pow[1] + ksize);
   size += GNUNET_IDENTITY_signature_get_raw_length_by_type (pk->type);
   return size;
 }
diff --git a/src/set/plugin_block_set_test.c b/src/set/plugin_block_set_test.c
index 3d66831bb..cb5cef5ad 100644
--- a/src/set/plugin_block_set_test.c
+++ b/src/set/plugin_block_set_test.c
@@ -30,46 +30,9 @@
 
 
 /**
- * Function called to validate a reply or a request.  For
- * request evaluation, simply pass "NULL" for the reply_block.
- *
- * @param cls closure
- * @param ctx block context
- * @param type block type
- * @param group block group to use
- * @param eo control flags
- * @param query original query (hash)
- * @param xquery extrended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in xquery
- * @param reply_block response to validate
- * @param reply_block_size number of bytes in reply block
- * @return characterization of result
- */
-static enum GNUNET_BLOCK_EvaluationResult
-block_plugin_set_test_evaluate (void *cls,
-                                struct GNUNET_BLOCK_Context *ctx,
-                                enum GNUNET_BLOCK_Type type,
-                                struct GNUNET_BLOCK_Group *group,
-                                enum GNUNET_BLOCK_EvaluationOptions eo,
-                                const struct GNUNET_HashCode *query,
-                                const void *xquery,
-                                size_t xquery_size,
-                                const void *reply_block,
-                                size_t reply_block_size)
-{
-  if ((NULL == reply_block) ||
-      (reply_block_size == 0) ||
-      (0 != ((char *) reply_block)[0]))
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-  return GNUNET_BLOCK_EVALUATION_OK_MORE;
-}
-
-
-/**
  * Function called to validate a query.
  *
  * @param cls closure
- * @param ctx block context
  * @param type block type
  * @param query original query (hash)
  * @param xquery extrended query data (can be NULL, depending on type)
@@ -92,7 +55,6 @@ block_plugin_set_test_check_query (void *cls,
  *
  * @param cls closure
  * @param type block type
- * @param query key for the block (hash), must match exactly
  * @param block block data to validate
  * @param block_size number of bytes in @a block
  * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
@@ -100,7 +62,6 @@ block_plugin_set_test_check_query (void *cls,
 static enum GNUNET_GenericReturnValue
 block_plugin_set_test_check_block (void *cls,
                                     enum GNUNET_BLOCK_Type type,
-                                    const struct GNUNET_HashCode *query,
                                     const void *block,
                                     size_t block_size)
 {
@@ -141,7 +102,7 @@ block_plugin_set_test_check_reply (void *cls,
   if ((NULL == reply_block) ||
       (0 == reply_block_size) ||
       (0 != ((char *) reply_block)[0]))
-    return GNUNET_BLOCK_REPLY_INVALID;
+    GNUNET_assert (0);
   return GNUNET_BLOCK_REPLY_OK_MORE;
 }
 
@@ -164,7 +125,7 @@ block_plugin_set_test_get_key (void *cls,
                                size_t block_size,
                                struct GNUNET_HashCode *key)
 {
-  return GNUNET_SYSERR;
+  return GNUNET_NO;
 }
 
 
@@ -181,7 +142,6 @@ libgnunet_plugin_block_set_test_init (void *cls)
   struct GNUNET_BLOCK_PluginFunctions *api;
 
   api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
-  api->evaluate = &block_plugin_set_test_evaluate;
   api->get_key = &block_plugin_set_test_get_key;
   api->check_query = &block_plugin_set_test_check_query;
   api->check_block = &block_plugin_set_test_check_block;
diff --git a/src/seti/plugin_block_seti_test.c b/src/seti/plugin_block_seti_test.c
index af86e1af6..5b9196cef 100644
--- a/src/seti/plugin_block_seti_test.c
+++ b/src/seti/plugin_block_seti_test.c
@@ -30,42 +30,6 @@
 
 
 /**
- * Function called to validate a reply or a request.  For
- * request evaluation, simply pass "NULL" for the reply_block.
- *
- * @param cls closure
- * @param ctx block context
- * @param type block type
- * @param group block group to use
- * @param eo control flags
- * @param query original query (hash)
- * @param xquery extrended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in xquery
- * @param reply_block response to validate
- * @param reply_block_size number of bytes in reply block
- * @return characterization of result
- */
-static enum GNUNET_BLOCK_EvaluationResult
-block_plugin_seti_test_evaluate (void *cls,
-                                 struct GNUNET_BLOCK_Context *ctx,
-                                 enum GNUNET_BLOCK_Type type,
-                                 struct GNUNET_BLOCK_Group *group,
-                                 enum GNUNET_BLOCK_EvaluationOptions eo,
-                                 const struct GNUNET_HashCode *query,
-                                 const void *xquery,
-                                 size_t xquery_size,
-                                 const void *reply_block,
-                                 size_t reply_block_size)
-{
-  if ((NULL == reply_block) ||
-      (reply_block_size == 0) ||
-      (0 != ((char *) reply_block)[0]))
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-  return GNUNET_BLOCK_EVALUATION_OK_MORE;
-}
-
-
-/**
  * Function called to validate a query.
  *
  * @param cls closure
@@ -83,6 +47,16 @@ block_plugin_seti_test_check_query (void *cls,
                                     const void *xquery,
                                     size_t xquery_size)
 {
+  if (GNUNET_BLOCK_TYPE_SETI_TEST != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (0 != xquery_size)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_NO;
+  }
   return GNUNET_OK;
 }
 
@@ -92,7 +66,6 @@ block_plugin_seti_test_check_query (void *cls,
  *
  * @param cls closure
  * @param type block type
- * @param query key for the block (hash), must match exactly
  * @param block block data to validate
  * @param block_size number of bytes in @a block
  * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
@@ -100,10 +73,15 @@ block_plugin_seti_test_check_query (void *cls,
 static enum GNUNET_GenericReturnValue
 block_plugin_seti_test_check_block (void *cls,
                                     enum GNUNET_BLOCK_Type type,
-                                    const struct GNUNET_HashCode *query,
                                     const void *block,
                                     size_t block_size)
 {
+  (void) cls;
+  if (GNUNET_BLOCK_TYPE_SETI_TEST != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
   if ((NULL == block) ||
       (0 == block_size) ||
       (0 != ((char *) block)[0]))
@@ -138,10 +116,18 @@ block_plugin_seti_test_check_reply (void *cls,
                                     const void *reply_block,
                                     size_t reply_block_size)
 {
+  (void) cls;
+  (void) xquery;
+  (void) xquery_size;
+  if (GNUNET_BLOCK_TYPE_SETI_TEST != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
+  }
   if ( (NULL == reply_block) ||
        (0 == reply_block_size) ||
        (0 != ((char *) reply_block)[0]) )
-    return GNUNET_BLOCK_REPLY_INVALID;
+    GNUNET_assert (0);
   return GNUNET_BLOCK_REPLY_OK_MORE;
 }
 
@@ -164,7 +150,12 @@ block_plugin_seti_test_get_key (void *cls,
                                 size_t block_size,
                                 struct GNUNET_HashCode *key)
 {
-  return GNUNET_SYSERR;
+  if (GNUNET_BLOCK_TYPE_SETI_TEST != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_NO;
 }
 
 
@@ -181,7 +172,6 @@ libgnunet_plugin_block_seti_test_init (void *cls)
   struct GNUNET_BLOCK_PluginFunctions *api;
 
   api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
-  api->evaluate = &block_plugin_seti_test_evaluate;
   api->get_key = &block_plugin_seti_test_get_key;
   api->check_query = &block_plugin_seti_test_check_query;
   api->check_block = &block_plugin_seti_test_check_block;
diff --git a/src/setu/plugin_block_setu_test.c b/src/setu/plugin_block_setu_test.c
index 9872bba39..178ad3314 100644
--- a/src/setu/plugin_block_setu_test.c
+++ b/src/setu/plugin_block_setu_test.c
@@ -23,49 +23,12 @@
  * @brief set test block, recognizes elements with non-zero first byte as invalid
  * @author Christian Grothoff
  */
-
 #include "platform.h"
 #include "gnunet_block_plugin.h"
 #include "gnunet_block_group_lib.h"
 
 
 /**
- * Function called to validate a reply or a request.  For
- * request evaluation, simply pass "NULL" for the reply_block.
- *
- * @param cls closure
- * @param ctx block context
- * @param type block type
- * @param group block group to use
- * @param eo control flags
- * @param query original query (hash)
- * @param xquery extrended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in xquery
- * @param reply_block response to validate
- * @param reply_block_size number of bytes in reply block
- * @return characterization of result
- */
-static enum GNUNET_BLOCK_EvaluationResult
-block_plugin_setu_test_evaluate (void *cls,
-                                 struct GNUNET_BLOCK_Context *ctx,
-                                 enum GNUNET_BLOCK_Type type,
-                                 struct GNUNET_BLOCK_Group *group,
-                                 enum GNUNET_BLOCK_EvaluationOptions eo,
-                                 const struct GNUNET_HashCode *query,
-                                 const void *xquery,
-                                 size_t xquery_size,
-                                 const void *reply_block,
-                                 size_t reply_block_size)
-{
-  if ((NULL == reply_block) ||
-      (reply_block_size == 0) ||
-      (0 != ((char *) reply_block)[0]))
-    return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
-  return GNUNET_BLOCK_EVALUATION_OK_MORE;
-}
-
-
-/**
  * Function called to validate a query.
  *
  * @param cls closure
@@ -83,6 +46,16 @@ block_plugin_setu_test_check_query (void *cls,
                                     const void *xquery,
                                     size_t xquery_size)
 {
+  if (GNUNET_BLOCK_TYPE_SETU_TEST != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (0 != xquery_size)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_NO;
+  }
   return GNUNET_OK;
 }
 
@@ -92,7 +65,6 @@ block_plugin_setu_test_check_query (void *cls,
  *
  * @param cls closure
  * @param type block type
- * @param query key for the block (hash), must match exactly
  * @param block block data to validate
  * @param block_size number of bytes in @a block
  * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
@@ -100,14 +72,18 @@ block_plugin_setu_test_check_query (void *cls,
 static enum GNUNET_GenericReturnValue
 block_plugin_setu_test_check_block (void *cls,
                                     enum GNUNET_BLOCK_Type type,
-                                    const struct GNUNET_HashCode *query,
                                     const void *block,
                                     size_t block_size)
 {
+  if (GNUNET_BLOCK_TYPE_SETU_TEST != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
   if ( (NULL == block) ||
        (0 == block_size) ||
        (0 != ((char *) block)[0]) )
-    return GNUNET_SYSERR;
+    return GNUNET_NO;
   return GNUNET_OK;
 }
 
@@ -138,10 +114,18 @@ block_plugin_setu_test_check_reply (void *cls,
                                     const void *reply_block,
                                     size_t reply_block_size)
 {
+  (void) cls;
+  (void) xquery;
+  (void) xquery_size;
+  if (GNUNET_BLOCK_TYPE_SETU_TEST != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
+  }
   if ( (NULL == reply_block) ||
        (0 == reply_block_size) ||
        (0 != ((char *) reply_block)[0]) )
-    return GNUNET_BLOCK_REPLY_INVALID;
+    GNUNET_assert (0);
   return GNUNET_BLOCK_REPLY_OK_MORE;
 }
 
@@ -164,7 +148,12 @@ block_plugin_setu_test_get_key (void *cls,
                                 size_t block_size,
                                 struct GNUNET_HashCode *key)
 {
-  return GNUNET_SYSERR;
+  if (GNUNET_BLOCK_TYPE_SETU_TEST != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_NO;
 }
 
 
@@ -175,13 +164,12 @@ void *
 libgnunet_plugin_block_setu_test_init (void *cls)
 {
   static enum GNUNET_BLOCK_Type types[] = {
-    GNUNET_BLOCK_TYPE_SETU_TEST,
+                                           GNUNET_BLOCK_TYPE_SETU_TEST,
     GNUNET_BLOCK_TYPE_ANY       /* end of list */
   };
   struct GNUNET_BLOCK_PluginFunctions *api;
 
   api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
-  api->evaluate = &block_plugin_setu_test_evaluate;
   api->get_key = &block_plugin_setu_test_get_key;
   api->check_query = &block_plugin_setu_test_check_query;
   api->check_block = &block_plugin_setu_test_check_block;
diff --git a/src/transport/Makefile.am b/src/transport/Makefile.am
index ec00bc917..69b05fb13 100644
--- a/src/transport/Makefile.am
+++ b/src/transport/Makefile.am
@@ -773,6 +773,8 @@ TESTS += \
 endif
 endif
 
+# Only test TNG if we run experimental
+if HAVE_EXPERIMENTAL
 check_SCRIPTS= \
   test_transport_simple_send_string.sh \
   test_transport_simple_send.sh \
@@ -780,6 +782,7 @@ check_SCRIPTS= \
   test_transport_udp_backchannel.sh \
   test_transport_simple_send_dv_circle.sh 
   # test_transport_simple_send_dv_inverse.sh
+endif
 
 test_transport_start_with_config_SOURCES = \
  test_transport_start_with_config.c
@@ -1521,7 +1524,10 @@ test_transport_api_slow_ats_LDADD = \
 
 
 EXTRA_DIST = \
-$(check_SCRIPTS) \
+test_transport_simple_send_string.sh \
+test_transport_simple_send.sh \
+test_transport_simple_send_broadcast.sh \
+test_transport_udp_backchannel.sh \
 gnunet-transport-certificate-creation.in \
 communicator-unix.conf \
 test_plugin_hostkey \
diff --git a/src/transport/gnunet-communicator-tcp.c b/src/transport/gnunet-communicator-tcp.c
index 3bfdeaa90..be75fa0e8 100644
--- a/src/transport/gnunet-communicator-tcp.c
+++ b/src/transport/gnunet-communicator-tcp.c
@@ -143,7 +143,7 @@ struct TcpHandshakeSignature
   /**
    * Challenge value used to protect against replay attack, if there is no stored monotonic time value.
    */
-  struct ChallengeNonceP challenge;
+  struct GNUNET_CRYPTO_ChallengeNonceP challenge;
 };
 
 /**
@@ -176,7 +176,7 @@ struct TcpHandshakeAckSignature
   /**
    * Challenge value used to protect against replay attack, if there is no stored monotonic time value.
    */
-  struct ChallengeNonceP challenge;
+  struct GNUNET_CRYPTO_ChallengeNonceP challenge;
 };
 
 /**
@@ -203,7 +203,7 @@ struct TCPConfirmation
   /**
    * Challenge value used to protect against replay attack, if there is no stored monotonic time value.
    */
-  struct ChallengeNonceP challenge;
+  struct GNUNET_CRYPTO_ChallengeNonceP challenge;
 
 };
 
@@ -238,7 +238,7 @@ struct TCPConfirmationAck
   /**
    * Challenge value used to protect against replay attack, if there is no stored monotonic time value.
    */
-  struct ChallengeNonceP challenge;
+  struct GNUNET_CRYPTO_ChallengeNonceP challenge;
 
 };
 
@@ -587,12 +587,12 @@ struct Queue
   /**
    * Challenge value used to protect against replay attack, if there is no stored monotonic time value.
    */
-  struct ChallengeNonceP challenge;
+  struct GNUNET_CRYPTO_ChallengeNonceP challenge;
 
   /**
    * Challenge value received. In case of inbound connection we have to remember the value, because we send the challenge back later after we received the GNUNET_MESSAGE_TYPE_COMMUNICATOR_TCP_CONFIRMATION_ACK.
    */
-  struct ChallengeNonceP challenge_received;
+  struct GNUNET_CRYPTO_ChallengeNonceP challenge_received;
 
   /**
    * Iteration Context for retrieving the monotonic time send with key for rekeying.
@@ -1447,7 +1447,7 @@ handshake_ack_monotime_cb (void *cls,
  * @param queue The queue context.
  */
 static void
-send_challenge (struct ChallengeNonceP challenge, struct Queue *queue)
+send_challenge (struct GNUNET_CRYPTO_ChallengeNonceP challenge, struct Queue *queue)
 {
   struct TCPConfirmationAck tca;
   struct TcpHandshakeAckSignature thas;
@@ -1680,7 +1680,7 @@ try_handle_plaintext (struct Queue *queue)
   uint16_t type;
   size_t size = 0; /* make compiler happy */
   struct TcpHandshakeAckSignature thas;
-  const struct ChallengeNonceP challenge = queue->challenge;
+  const struct GNUNET_CRYPTO_ChallengeNonceP challenge = queue->challenge;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "try handle plaintext!\n");
diff --git a/src/transport/gnunet-service-tng.c b/src/transport/gnunet-service-tng.c
index 0427bd229..21c9be05c 100644
--- a/src/transport/gnunet-service-tng.c
+++ b/src/transport/gnunet-service-tng.c
@@ -581,7 +581,7 @@ struct DvInitPS
   /**
    * Challenge value used by the initiator to re-identify the path.
    */
-  struct ChallengeNonceP challenge;
+  struct GNUNET_CRYPTO_ChallengeNonceP challenge;
 };
 
 
@@ -621,7 +621,7 @@ struct DvHopPS
   /**
    * Challenge value used by the initiator to re-identify the path.
    */
-  struct ChallengeNonceP challenge;
+  struct GNUNET_CRYPTO_ChallengeNonceP challenge;
 };
 
 
@@ -715,7 +715,7 @@ struct TransportDVLearnMessage
   /**
    * Challenge value used by the initiator to re-identify the path.
    */
-  struct ChallengeNonceP challenge;
+  struct GNUNET_CRYPTO_ChallengeNonceP challenge;
 
   /* Followed by @e num_hops `struct DVPathEntryP` values,
      excluding the initiator of the DV trace; the last entry is the
@@ -834,7 +834,7 @@ struct TransportValidationChallengeMessage
   /**
    * Challenge to be signed by the receiving peer.
    */
-  struct ChallengeNonceP challenge;
+  struct GNUNET_CRYPTO_ChallengeNonceP challenge;
 
   /**
    * Timestamp of the sender, to be copied into the reply to allow
@@ -864,7 +864,7 @@ struct TransportValidationPS
   /**
    * Challenge signed by the receiving peer.
    */
-  struct ChallengeNonceP challenge;
+  struct GNUNET_CRYPTO_ChallengeNonceP challenge;
 };
 
 
@@ -893,7 +893,7 @@ struct TransportValidationResponseMessage
   /**
    * The challenge that was signed by the receiving peer.
    */
-  struct ChallengeNonceP challenge;
+  struct GNUNET_CRYPTO_ChallengeNonceP challenge;
 
   /**
    * Original timestamp of the sender (was @code{sender_time}),
@@ -1056,7 +1056,7 @@ struct LearnLaunchEntry
   /**
    * Challenge that uniquely identifies this activity.
    */
-  struct ChallengeNonceP challenge;
+  struct GNUNET_CRYPTO_ChallengeNonceP challenge;
 
   /**
    * When did we transmit the DV learn message (used to calculate RTT) and
@@ -2569,7 +2569,7 @@ struct ValidationState
    * (We must not rotate more often as otherwise we may discard valid answers
    * due to packet losses, latency and reorderings on the network).
    */
-  struct ChallengeNonceP challenge;
+  struct GNUNET_CRYPTO_ChallengeNonceP challenge;
 
   /**
    * Claimed address of the peer.
@@ -6886,7 +6886,7 @@ static int
 validate_dv_initiator_signature (
   struct GNUNET_TIME_AbsoluteNBO sender_monotonic_time,
   const struct GNUNET_PeerIdentity *init,
-  const struct ChallengeNonceP *challenge,
+  const struct GNUNET_CRYPTO_ChallengeNonceP *challenge,
   const struct GNUNET_CRYPTO_EddsaSignature *init_sig)
 {
   struct DvInitPS ip = { .purpose.purpose = htonl (
@@ -8340,7 +8340,7 @@ struct CheckKnownChallengeContext
   /**
    * Set to the challenge we are looking for.
    */
-  const struct ChallengeNonceP *challenge;
+  const struct GNUNET_CRYPTO_ChallengeNonceP *challenge;
 
   /**
    * Set to a matching validation state, if one was found.
diff --git a/src/transport/gnunet-service-transport.c b/src/transport/gnunet-service-transport.c
index 24cc6464a..fad2ca4a1 100644
--- a/src/transport/gnunet-service-transport.c
+++ b/src/transport/gnunet-service-transport.c
@@ -1628,8 +1628,8 @@ GST_receive_callback (void *cls,
   GST_neighbours_notify_data_recv (address, message);
   switch (type)
   {
-  case GNUNET_MESSAGE_TYPE_HELLO_LEGACY:
-    /* Legacy HELLO message, discard  */
+  case GNUNET_MESSAGE_TYPE_HELLO_URI:
+    /* Future HELLO message, discard  */
     return ret;
 
   case GNUNET_MESSAGE_TYPE_HELLO:
diff --git a/src/transport/test_transport_simple_send.sh b/src/transport/test_transport_simple_send.sh
index 3d5266622..0250070be 100755
--- a/src/transport/test_transport_simple_send.sh
+++ b/src/transport/test_transport_simple_send.sh
@@ -2,9 +2,10 @@
 if ! [ -d "/run/netns" ]; then
     echo You have to create the directory /run/netns.
 fi
-if  [ "$(cat /proc/sys/kernel/unprivileged_userns_clone)" == 1 ]; then
-    exec unshare -r -nmU bash -c "mount -t tmpfs --make-rshared tmpfs /run/netns; ./test_transport_start_with_config test_transport_simple_send_topo.conf"
-else
+if [ -f /proc/sys/kernel/unprivileged_userns_clone ]; then
+  if  [ "$(cat /proc/sys/kernel/unprivileged_userns_clone)" != 1 ]; then
     echo -e "Error during test setup: The kernel parameter kernel.unprivileged_userns_clone has to be set to 1! One has to execute\n\n sysctl kernel.unprivileged_userns_clone=1\n"
     exit 78
+  fi
 fi
+exec unshare -r -nmU bash -c "mount -t tmpfs --make-rshared tmpfs /run/netns; ./test_transport_start_with_config test_transport_simple_send_topo.conf"
diff --git a/src/transport/test_transport_simple_send_broadcast.sh b/src/transport/test_transport_simple_send_broadcast.sh
index f264b1203..a4801bf70 100755
--- a/src/transport/test_transport_simple_send_broadcast.sh
+++ b/src/transport/test_transport_simple_send_broadcast.sh
@@ -2,10 +2,10 @@
 if ! [ -d "/run/netns" ]; then
     echo You have to create the directory /run/netns.
 fi
-if  [ "$(cat /proc/sys/kernel/unprivileged_userns_clone)" == 1 ]; then
-    # exec unshare -r -nmU bash -c "mount -t tmpfs --make-rshared tmpfs /run/netns; valgrind --leak-check=full --track-origins=yes --trace-children=yes --trace-children-skip=/usr/bin/awk,/usr/bin/cut,/usr/bin/seq,/sbin/ip/sed/bash  ./test_transport_start_with_config test_transport_simple_send_broadcast_topo.conf"
-    exec unshare -r -nmU bash -c "mount -t tmpfs --make-rshared tmpfs /run/netns; ./test_transport_start_with_config test_transport_simple_send_broadcast_topo.conf"
-else
+if [ -f /proc/sys/kernel/unprivileged_userns_clone ]; then
+  if  [ "$(cat /proc/sys/kernel/unprivileged_userns_clone)" != 1 ]; then
     echo -e "Error during test setup: The kernel parameter kernel.unprivileged_userns_clone has to be set to 1! One has to execute\n\n sysctl kernel.unprivileged_userns_clone=1\n"
     exit 78
+  fi
 fi
+exec unshare -r -nmU bash -c "mount -t tmpfs --make-rshared tmpfs /run/netns; ./test_transport_start_with_config test_transport_simple_send_broadcast_topo.conf"
diff --git a/src/transport/test_transport_simple_send_dv.sh b/src/transport/test_transport_simple_send_dv.sh
index fa127cfa4..b57ee0629 100755
--- a/src/transport/test_transport_simple_send_dv.sh
+++ b/src/transport/test_transport_simple_send_dv.sh
@@ -2,10 +2,10 @@
 if ! [ -d "/run/netns" ]; then
     echo You have to create the directory /run/netns.
 fi
-if  [ "$(cat /proc/sys/kernel/unprivileged_userns_clone)" == 1 ]; then
-    # exec unshare -r -nmU bash -c "mount -t tmpfs --make-rshared tmpfs /run/netns; valgrind --leak-check=full --track-origins=yes --trace-children=yes --trace-children-skip=/usr/bin/awk,/usr/bin/cut,/usr/bin/seq,/sbin/ip/sed/bash  ./test_transport_start_with_config test_transport_distance_vector_topo.conf"
-    exec unshare -r -nmU bash -c "mount -t tmpfs --make-rshared tmpfs /run/netns; ./test_transport_start_with_config test_transport_distance_vector_topo.conf"
-else
+if [ -f /proc/sys/kernel/unprivileged_userns_clone ]; then
+  if  [ "$(cat /proc/sys/kernel/unprivileged_userns_clone)" != 1 ]; then
     echo -e "Error during test setup: The kernel parameter kernel.unprivileged_userns_clone has to be set to 1! One has to execute\n\n sysctl kernel.unprivileged_userns_clone=1\n"
     exit 78
+  fi
 fi
+exec unshare -r -nmU bash -c "mount -t tmpfs --make-rshared tmpfs /run/netns; ./test_transport_start_with_config test_transport_distance_vector_topo.conf"
diff --git a/src/transport/test_transport_simple_send_dv_circle.sh b/src/transport/test_transport_simple_send_dv_circle.sh
index de16df356..bd5f00abe 100755
--- a/src/transport/test_transport_simple_send_dv_circle.sh
+++ b/src/transport/test_transport_simple_send_dv_circle.sh
@@ -2,11 +2,10 @@
 if ! [ -d "/run/netns" ]; then
     echo You have to create the directory /run/netns.
 fi
-if  [ "$(cat /proc/sys/kernel/unprivileged_userns_clone)" == 1 ]; then
-    # exec unshare -r -nmU bash -c "mount -t tmpfs --make-rshared tmpfs /run/netns; valgrind --leak-check=full --track-origins=yes --trace-children=yes --trace-children-skip=/usr/bin/awk,/usr/bin/cut,/usr/bin/seq,/sbin/ip/sed/bash  ./test_transport_start_with_config test_transport_distance_vector_topo.conf"
-    exec unshare -r -nmU bash -c "mount -t tmpfs --make-rshared tmpfs /run/netns; ./test_transport_start_with_config test_transport_distance_vector_circle_topo.conf"
-    #./test_transport_start_with_config test_transport_distance_vector_circle_topo.conf
-else
+if [ -f /proc/sys/kernel/unprivileged_userns_clone ]; then
+  if  [ "$(cat /proc/sys/kernel/unprivileged_userns_clone)" != 1 ]; then
     echo -e "Error during test setup: The kernel parameter kernel.unprivileged_userns_clone has to be set to 1! One has to execute\n\n sysctl kernel.unprivileged_userns_clone=1\n"
     exit 78
+  fi
 fi
+exec unshare -r -nmU bash -c "mount -t tmpfs --make-rshared tmpfs /run/netns; ./test_transport_start_with_config test_transport_distance_vector_circle_topo.conf"
diff --git a/src/transport/test_transport_simple_send_string.sh b/src/transport/test_transport_simple_send_string.sh
index b2bd05d5f..211abb494 100755
--- a/src/transport/test_transport_simple_send_string.sh
+++ b/src/transport/test_transport_simple_send_string.sh
@@ -11,9 +11,11 @@ EOF
 if ! [ -d "/run/netns" ]; then
     echo You have to create the directory /run/netns.
 fi
-if  [ "$(cat /proc/sys/kernel/unprivileged_userns_clone)" == 1 ]; then
-    exec unshare -r -nmU bash -c "mount -t tmpfs --make-rshared tmpfs /run/netns; ./test_transport_start_with_config -s '$string'"
-else
+if [ -f /proc/sys/kernel/unprivileged_userns_clone ]; then
+  if  [ "$(cat /proc/sys/kernel/unprivileged_userns_clone)" != 1 ]; then
     echo -e "Error during test setup: The kernel parameter kernel.unprivileged_userns_clone has to be set to 1! One has to execute\n\n sysctl kernel.unprivileged_userns_clone=1\n"
     exit 78
+  fi
 fi
+
+exec unshare -r -nmU bash -c "mount -t tmpfs --make-rshared tmpfs /run/netns; ./test_transport_start_with_config -s '$string'"
diff --git a/src/transport/test_transport_udp_backchannel.sh b/src/transport/test_transport_udp_backchannel.sh
index c52734a55..1a7c83385 100755
--- a/src/transport/test_transport_udp_backchannel.sh
+++ b/src/transport/test_transport_udp_backchannel.sh
@@ -5,11 +5,10 @@ fi
 if ! [ -d "/run/netns" ]; then
     echo You have to create the directory /run/netns.
 fi
-if  [ "$(cat /proc/sys/kernel/unprivileged_userns_clone)" == 1 ]; then
-#exec unshare -r -nmU bash -c "mount -t tmpfs --make-rshared tmpfs /run/netns; valgrind --leak-check=full --track-origins=yes --trace-children=yes --trace-children-skip=/usr/bin/awk,/usr/bin/cut,/usr/bin/seq,/sbin/ip ./test_transport_start_with_config test_transport_udp_backchannel_topo.conf"
-exec unshare -r -nmU bash -c "mount -t tmpfs --make-rshared tmpfs /run/netns; GNUNET_FORCE_LOG=';;;;DEBUG' GNUNET_FORCE_LOGFILE='test.out' ./test_transport_start_with_config test_transport_udp_backchannel_topo.conf"
-# exec unshare -r -nmU bash -c "mount -t tmpfs --make-rshared tmpfs /run/netns; valgrind --leak-check=full --track-origins=yes ./test_transport_start_with_config test_transport_udp_backchannel_topo.conf"
-else
+if [ -f /proc/sys/kernel/unprivileged_userns_clone ]; then
+  if  [ "$(cat /proc/sys/kernel/unprivileged_userns_clone)" != 1 ]; then
     echo -e "Error during test setup: The kernel parameter kernel.unprivileged_userns_clone has to be set to 1! One has to execute\n\n sysctl kernel.unprivileged_userns_clone=1\n"
     exit 78
+  fi
 fi
+exec unshare -r -nmU bash -c "mount -t tmpfs --make-rshared tmpfs /run/netns; GNUNET_FORCE_LOG=';;;;DEBUG' GNUNET_FORCE_LOGFILE='test.out' ./test_transport_start_with_config test_transport_udp_backchannel_topo.conf"
diff --git a/src/util/common_logging.c b/src/util/common_logging.c
index cba37cd2f..b07f3fc0b 100644
--- a/src/util/common_logging.c
+++ b/src/util/common_logging.c
@@ -321,6 +321,28 @@ log_rotate (const char *new_name)
 }
 
 
+const char *
+GNUNET_b2s (const void *buf,
+            size_t buf_size)
+{
+  static GNUNET_THREAD_LOCAL char ret[9];
+  struct GNUNET_HashCode hc;
+  char *tmp;
+
+  GNUNET_CRYPTO_hash (buf,
+                      buf_size,
+                      &hc);
+  tmp = GNUNET_STRINGS_data_to_string_alloc (&hc,
+                                             sizeof (hc));
+  memcpy (ret,
+          tmp,
+          8);
+  GNUNET_free (tmp);
+  ret[8] = '\0';
+  return ret;
+}
+
+
 /**
  * Setup the log file.
  *
@@ -1015,7 +1037,8 @@ mylog (enum GNUNET_ErrorType kind,
     else
     {
       /* RFC 3339 timestamp, with snprintf placeholder for microseconds */
-      if (0 == strftime (date2, DATE_STR_SIZE, "%Y-%m-%dT%H:%M:%S.%%06u%z", tmptr))
+      if (0 == strftime (date2, DATE_STR_SIZE, "%Y-%m-%dT%H:%M:%S.%%06u%z",
+                         tmptr))
         abort ();
       /* Fill in microseconds */
       if (0 > snprintf (date, sizeof(date), date2, timeofday.tv_usec))
diff --git a/src/util/crypto_cs.c b/src/util/crypto_cs.c
index c89ba5d83..4c6648229 100644
--- a/src/util/crypto_cs.c
+++ b/src/util/crypto_cs.c
@@ -40,11 +40,6 @@
  */
 
 
-/**
- * Create a new random private key.
- *
- * @param[out] priv where to write the fresh private key
- */
 void
 GNUNET_CRYPTO_cs_private_key_generate (struct GNUNET_CRYPTO_CsPrivateKey *priv)
 {
@@ -52,16 +47,10 @@ GNUNET_CRYPTO_cs_private_key_generate (struct GNUNET_CRYPTO_CsPrivateKey *priv)
 }
 
 
-/**
- * Extract the public key of the given private key.
- *
- * @param priv the private key
- * @param[out] pub where to write the public key
- */
 void
-GNUNET_CRYPTO_cs_private_key_get_public (const struct
-                                         GNUNET_CRYPTO_CsPrivateKey *priv,
-                                         struct GNUNET_CRYPTO_CsPublicKey *pub)
+GNUNET_CRYPTO_cs_private_key_get_public (
+  const struct GNUNET_CRYPTO_CsPrivateKey *priv,
+  struct GNUNET_CRYPTO_CsPublicKey *pub)
 {
   GNUNET_assert (0 == crypto_scalarmult_ed25519_base_noclamp (pub->point.y,
                                                               priv->scalar.d));
@@ -69,63 +58,40 @@ GNUNET_CRYPTO_cs_private_key_get_public (const struct
 
 
 /**
- * maps 32 random bytes to a scalar
- * this is necessary because libsodium expects scalar to be in the prime order subgroup
- * @param[out] scalar containing 32 byte char array, is modified to be in prime order subgroup
+ * Maps 32 random bytes to a scalar.  This is necessary because libsodium
+ * expects scalar to be in the prime order subgroup.
+ *
+ * @param[in,out] scalar containing 32 byte char array, is modified to be in prime order subgroup
  */
 static void
 map_to_scalar_subgroup (struct GNUNET_CRYPTO_Cs25519Scalar *scalar)
 {
-  // perform clamping as described in RFC7748
+  /* perform clamping as described in RFC7748 */
   scalar->d[0] &= 248;
   scalar->d[31] &= 127;
   scalar->d[31] |= 64;
 }
 
 
-/**
- * Derive a new secret r pair r0 and r1.
- * In original papers r is generated randomly
- * To provide abort-idempotency, r needs to be derived but still needs to be UNPREDICTABLE
- * To ensure unpredictability a new nonce should be used when a new r needs to be derived.
- * Uses HKDF internally.
- * Comment: Can be done in one HKDF shot and split output.
- *
- * @param nonce is a random nonce
- * @param lts is a long-term-secret in form of a private key
- * @param[out] r array containing derived secrets r0 and r1
- */
 void
 GNUNET_CRYPTO_cs_r_derive (const struct GNUNET_CRYPTO_CsNonce *nonce,
+                           const char *seed,
                            const struct GNUNET_CRYPTO_CsPrivateKey *lts,
                            struct GNUNET_CRYPTO_CsRSecret r[2])
 {
-  GNUNET_assert (GNUNET_YES ==
-                 GNUNET_CRYPTO_hkdf (r,
-                                     sizeof (struct GNUNET_CRYPTO_CsRSecret)
-                                     * 2,
-                                     GCRY_MD_SHA512,
-                                     GCRY_MD_SHA256,
-                                     "r",
-                                     strlen ("r"),
-                                     lts,
-                                     sizeof (*lts),
-                                     nonce,
-                                     sizeof (*nonce),
-                                     NULL,
-                                     0));
-
+  GNUNET_assert (
+    GNUNET_YES ==
+    GNUNET_CRYPTO_kdf (
+      r,     sizeof (struct GNUNET_CRYPTO_CsRSecret) * 2,
+      seed,   strlen (seed),
+      lts,   sizeof (*lts),
+      nonce, sizeof (*nonce),
+      NULL,  0));
   map_to_scalar_subgroup (&r[0].scalar);
   map_to_scalar_subgroup (&r[1].scalar);
 }
 
 
-/**
- * Extract the public R of the given secret r.
- *
- * @param r_priv the private key
- * @param[out] r_pub where to write the public key
- */
 void
 GNUNET_CRYPTO_cs_r_get_public (const struct GNUNET_CRYPTO_CsRSecret *r_priv,
                                struct GNUNET_CRYPTO_CsRPublic *r_pub)
@@ -135,36 +101,23 @@ GNUNET_CRYPTO_cs_r_get_public (const struct GNUNET_CRYPTO_CsRSecret *r_priv,
 }
 
 
-/**
- * Derives new random blinding factors.
- * In original papers blinding factors are generated randomly
- * To provide abort-idempotency, blinding factors need to be derived but still need to be UNPREDICTABLE
- * To ensure unpredictability a new nonce has to be used.
- * Uses HKDF internally
- *
- * @param secret is secret to derive blinding factors
- * @param secret_len secret length
- * @param[out] bs array containing the two derived blinding secrets
- */
 void
-GNUNET_CRYPTO_cs_blinding_secrets_derive (const struct
-                                          GNUNET_CRYPTO_CsNonce *blind_seed,
-                                          struct GNUNET_CRYPTO_CsBlindingSecret
-                                          bs[2])
+GNUNET_CRYPTO_cs_blinding_secrets_derive (
+  const struct GNUNET_CRYPTO_CsNonce *blind_seed,
+  struct GNUNET_CRYPTO_CsBlindingSecret bs[2])
 {
-  GNUNET_assert (GNUNET_YES ==
-                 GNUNET_CRYPTO_hkdf (bs,
-                                     sizeof (struct
-                                             GNUNET_CRYPTO_CsBlindingSecret)
-                                     * 2,
-                                     GCRY_MD_SHA512,
-                                     GCRY_MD_SHA256,
-                                     "alphabeta",
-                                     strlen ("alphabeta"),
-                                     blind_seed,
-                                     sizeof(*blind_seed),
-                                     NULL,
-                                     0));
+  GNUNET_assert (
+    GNUNET_YES ==
+    GNUNET_CRYPTO_hkdf (bs,
+                        sizeof (struct GNUNET_CRYPTO_CsBlindingSecret) * 2,
+                        GCRY_MD_SHA512,
+                        GCRY_MD_SHA256,
+                        "alphabeta",
+                        strlen ("alphabeta"),
+                        blind_seed,
+                        sizeof(*blind_seed),
+                        NULL,
+                        0));
   map_to_scalar_subgroup (&bs[0].alpha);
   map_to_scalar_subgroup (&bs[0].beta);
   map_to_scalar_subgroup (&bs[1].alpha);
@@ -205,11 +158,16 @@ cs_full_domain_hash (const struct GNUNET_CRYPTO_CsRPublic *r_dash,
   memcpy (r_m_concat, r_dash, sizeof(struct GNUNET_CRYPTO_CsRPublic));
   memcpy (r_m_concat + sizeof(struct GNUNET_CRYPTO_CsRPublic), msg, msg_len);
   struct GNUNET_HashCode prehash;
-  GNUNET_CRYPTO_hash (r_m_concat, r_m_concat_len, &prehash);
+
+  GNUNET_CRYPTO_hash (r_m_concat,
+                      r_m_concat_len,
+                      &prehash);
 
   // modulus converted to MPI representation
   gcry_mpi_t l_mpi;
-  GNUNET_CRYPTO_mpi_scan_unsigned (&l_mpi, L_BIG_ENDIAN, sizeof(L_BIG_ENDIAN));
+  GNUNET_CRYPTO_mpi_scan_unsigned (&l_mpi,
+                                   L_BIG_ENDIAN,
+                                   sizeof(L_BIG_ENDIAN));
 
   // calculate full domain hash
   gcry_mpi_t c_mpi;
@@ -224,7 +182,9 @@ cs_full_domain_hash (const struct GNUNET_CRYPTO_CsRPublic *r_dash,
 
   // convert c from mpi
   unsigned char c_big_endian[256 / 8];
-  GNUNET_CRYPTO_mpi_print_unsigned (c_big_endian, sizeof(c_big_endian), c_mpi);
+  GNUNET_CRYPTO_mpi_print_unsigned (c_big_endian,
+                                    sizeof(c_big_endian),
+                                    c_mpi);
   gcry_mpi_release (c_mpi);
   for (size_t i = 0; i<32; i++)
     c->scalar.d[i] = c_big_endian[31 - i];
@@ -266,28 +226,15 @@ calc_r_dash (const struct GNUNET_CRYPTO_CsBlindingSecret *bs,
 }
 
 
-/**
- * Calculate two blinded c's
- * Comment: One would be insecure due to Wagner's algorithm solving ROS
- *
- * @param bs array of the two blinding factor structs each containing alpha and beta
- * @param r_pub array of the two signer's nonce R
- * @param pub the public key of the signer
- * @param msg the message to blind in preparation for signing
- * @param msg_len length of message msg
- * @param[out] blinded_c array of the two blinded c's
- * @param[out] blinded_r_pub array of the two blinded R
- */
 void
-GNUNET_CRYPTO_cs_calc_blinded_c (const struct GNUNET_CRYPTO_CsBlindingSecret
-                                 bs[2],
-                                 const struct GNUNET_CRYPTO_CsRPublic r_pub[2],
-                                 const struct GNUNET_CRYPTO_CsPublicKey *pub,
-                                 const void *msg,
-                                 size_t msg_len,
-                                 struct GNUNET_CRYPTO_CsC blinded_c[2],
-                                 struct GNUNET_CRYPTO_CsRPublic
-                                 blinded_r_pub[2])
+GNUNET_CRYPTO_cs_calc_blinded_c (
+  const struct GNUNET_CRYPTO_CsBlindingSecret bs[2],
+  const struct GNUNET_CRYPTO_CsRPublic r_pub[2],
+  const struct GNUNET_CRYPTO_CsPublicKey *pub,
+  const void *msg,
+  size_t msg_len,
+  struct GNUNET_CRYPTO_CsC blinded_c[2],
+  struct GNUNET_CRYPTO_CsRPublic blinded_r_pub[2])
 {
   // for i 0/1: R'i = Ri + alpha i*G + beta i*pub
   calc_r_dash (&bs[0], &r_pub[0], pub, &blinded_r_pub[0]);
@@ -309,30 +256,13 @@ GNUNET_CRYPTO_cs_calc_blinded_c (const struct GNUNET_CRYPTO_CsBlindingSecret
 }
 
 
-/**
- * Sign a blinded c
- * This function derives b from a nonce and a longterm secret
- * In original papers b is generated randomly
- * To provide abort-idempotency, b needs to be derived but still need to be UNPREDICTABLE.
- * To ensure unpredictability a new nonce has to be used for every signature
- * HKDF is used internally for derivation
- * r0 and r1 can be derived prior by using GNUNET_CRYPTO_cs_r_derive
- *
- * @param priv private key to use for the signing and as LTS in HKDF
- * @param r array of the two secret nonce from the signer
- * @param c array of the two blinded c to sign c_b
- * @param nonce is a random nonce
- * @param[out] blinded_signature_scalar where to write the signature
- * @return 0 or 1 for b (see Clause Blind Signature Scheme)
- */
 unsigned int
-GNUNET_CRYPTO_cs_sign_derive (const struct GNUNET_CRYPTO_CsPrivateKey *priv,
-                              const struct GNUNET_CRYPTO_CsRSecret r[2],
-                              const struct GNUNET_CRYPTO_CsC c[2],
-                              const struct GNUNET_CRYPTO_CsNonce *nonce,
-                              struct GNUNET_CRYPTO_CsBlindS *
-                              blinded_signature_scalar
-                              )
+GNUNET_CRYPTO_cs_sign_derive (
+  const struct GNUNET_CRYPTO_CsPrivateKey *priv,
+  const struct GNUNET_CRYPTO_CsRSecret r[2],
+  const struct GNUNET_CRYPTO_CsC c[2],
+  const struct GNUNET_CRYPTO_CsNonce *nonce,
+  struct GNUNET_CRYPTO_CsBlindS *blinded_signature_scalar)
 {
   uint32_t hkdf_out;
 
@@ -365,18 +295,11 @@ GNUNET_CRYPTO_cs_sign_derive (const struct GNUNET_CRYPTO_CsPrivateKey *priv,
 }
 
 
-/**
- * Unblind a blind-signed signature using a c that was blinded
- *
- * @param blinded_signature_scalar the signature made on the blinded c
- * @param bs the blinding factors used in the blinding
- * @param[out] signature_scalar where to write the unblinded signature
- */
 void
-GNUNET_CRYPTO_cs_unblind (const struct
-                          GNUNET_CRYPTO_CsBlindS *blinded_signature_scalar,
-                          const struct GNUNET_CRYPTO_CsBlindingSecret *bs,
-                          struct GNUNET_CRYPTO_CsS *signature_scalar)
+GNUNET_CRYPTO_cs_unblind (
+  const struct GNUNET_CRYPTO_CsBlindS *blinded_signature_scalar,
+  const struct GNUNET_CRYPTO_CsBlindingSecret *bs,
+  struct GNUNET_CRYPTO_CsS *signature_scalar)
 {
   crypto_core_ed25519_scalar_add (signature_scalar->scalar.d,
                                   blinded_signature_scalar->scalar.d,
@@ -384,16 +307,6 @@ GNUNET_CRYPTO_cs_unblind (const struct
 }
 
 
-/**
- * Verify whether the given message corresponds to the given signature and the
- * signature is valid with respect to the given public key.
- *
- * @param sig signature that is being validated
- * @param pub public key of the signer
- * @param msg is the message that should be signed by @a sig  (message is used to calculate c)
- * @param msg_len is the message length
- * @returns #GNUNET_YES on success, #GNUNET_SYSERR if signature invalid
- */
 enum GNUNET_GenericReturnValue
 GNUNET_CRYPTO_cs_verify (const struct GNUNET_CRYPTO_CsSignature *sig,
                          const struct GNUNET_CRYPTO_CsPublicKey *pub,
@@ -402,7 +315,12 @@ GNUNET_CRYPTO_cs_verify (const struct GNUNET_CRYPTO_CsSignature *sig,
 {
   // calculate c' = H(R, m)
   struct GNUNET_CRYPTO_CsC c_dash;
-  cs_full_domain_hash (&sig->r_point, msg, msg_len, pub, &c_dash);
+
+  cs_full_domain_hash (&sig->r_point,
+                       msg,
+                       msg_len,
+                       pub,
+                       &c_dash);
 
   // s'G ?= R' + c' pub
   struct GNUNET_CRYPTO_Cs25519Point sig_scal_mul_base;
diff --git a/src/util/crypto_hash.c b/src/util/crypto_hash.c
index dcd46e5f9..f516f5474 100644
--- a/src/util/crypto_hash.c
+++ b/src/util/crypto_hash.c
@@ -76,7 +76,8 @@ GNUNET_CRYPTO_hash_from_string2 (const char *enc,
   char upper_enc[enclen];
   char *up_ptr = upper_enc;
 
-  GNUNET_STRINGS_utf8_toupper (enc, up_ptr);
+  if (GNUNET_OK != GNUNET_STRINGS_utf8_toupper (enc, up_ptr))
+    return GNUNET_SYSERR;
 
   return GNUNET_STRINGS_string_to_data (upper_enc, enclen,
                                         (unsigned char *) result,
diff --git a/src/util/dnsstub.c b/src/util/dnsstub.c
index 1ac274c92..c2f2a441f 100644
--- a/src/util/dnsstub.c
+++ b/src/util/dnsstub.c
@@ -324,24 +324,50 @@ do_dns_read (struct GNUNET_DNSSTUB_RequestSocket *rs,
     found = GNUNET_NO;
     for (struct DnsServer *ds = ctx->dns_head; NULL != ds; ds = ds->next)
     {
-      if (0 == memcmp (&addr,
-                       &ds->ss,
-                       GNUNET_MIN (sizeof(struct sockaddr_storage), addrlen)))
+      if (ds->ss.ss_family != addr.ss_family)
+        continue;
+      if (addr.ss_family == AF_INET)
       {
-        found = GNUNET_YES;
-        break;
+        struct sockaddr_in *v4 = (struct sockaddr_in *) &addr;
+        struct sockaddr_in *ds_v4 = (struct sockaddr_in *) &ds->ss;
+
+
+        if ((0 == memcmp (&v4->sin_addr,
+                         &ds_v4->sin_addr,
+                         sizeof(struct sockaddr_in))) &&
+            (v4->sin_port == ds_v4->sin_port))
+        {
+          found = GNUNET_YES;
+          break;
+        }
+      }
+      else
+      {
+        struct sockaddr_in6 *v6 = (struct sockaddr_in6 *) &addr;
+        struct sockaddr_in6 *ds_v6 = (struct sockaddr_in6 *) &ds->ss;
+
+        if (0 == memcmp (&v6->sin6_addr,
+                         &ds_v6->sin6_addr,
+                         sizeof (v6->sin6_addr)) &&
+            (v6->sin6_port == ds_v6->sin6_port))
+        {
+          found = GNUNET_YES;
+          break;
+        }
+
       }
     }
     if (GNUNET_NO == found)
     {
       GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  "Received DNS response from server we never asked (ignored)");
+                  "Received DNS response from server we never asked (ignored)\n");
+
       return GNUNET_NO;
     }
     if (sizeof(struct GNUNET_TUN_DnsHeader) > (size_t) r)
     {
       GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                  _ ("Received DNS response that is too small (%u bytes)"),
+                  _ ("Received DNS response that is too small (%u bytes)\n"),
                   (unsigned int) r);
       return GNUNET_NO;
     }
@@ -648,7 +674,7 @@ GNUNET_DNSSTUB_add_dns_sa (struct GNUNET_DNSSTUB_Context *ctx,
   ds = GNUNET_new (struct DnsServer);
   switch (sa->sa_family)
   {
-  case AF_INET:
+  case AF_INET :
     GNUNET_memcpy (&ds->ss, sa, sizeof(struct sockaddr_in));
     break;
 
diff --git a/src/util/getopt_helpers.c b/src/util/getopt_helpers.c
index 917aa440b..96aee40e3 100644
--- a/src/util/getopt_helpers.c
+++ b/src/util/getopt_helpers.c
@@ -174,7 +174,8 @@ OUTER:
     i++;
   }
   pd = GNUNET_OS_project_data_get ();
-  printf ("Report bugs to %s.\n"
+  printf ("\n"
+          "Report bugs to %s.\n"
           "Home page: %s\n",
           pd->bug_email,
           pd->homepage);
diff --git a/src/util/gnunet-crypto-tvg.c b/src/util/gnunet-crypto-tvg.c
index 6b2a7f472..0071f3e90 100644
--- a/src/util/gnunet-crypto-tvg.c
+++ b/src/util/gnunet-crypto-tvg.c
@@ -852,7 +852,7 @@ checkvec (const char *operation,
       return GNUNET_SYSERR;
     }
 
-    if ((b != 1)&& (b != 0))
+    if ((b != 1) && (b != 0))
     {
       GNUNET_break (0);
       return GNUNET_SYSERR;
@@ -869,9 +869,14 @@ checkvec (const char *operation,
     unsigned int b_comp;
 
 
-    GNUNET_CRYPTO_cs_r_derive (&nonce, &priv, r_priv_comp);
-    GNUNET_CRYPTO_cs_r_get_public (&r_priv_comp[0], &r_pub_comp[0]);
-    GNUNET_CRYPTO_cs_r_get_public (&r_priv_comp[1], &r_pub_comp[1]);
+    GNUNET_CRYPTO_cs_r_derive (&nonce,
+                               "rw",
+                               &priv,
+                               r_priv_comp);
+    GNUNET_CRYPTO_cs_r_get_public (&r_priv_comp[0],
+                                   &r_pub_comp[0]);
+    GNUNET_CRYPTO_cs_r_get_public (&r_priv_comp[1],
+                                   &r_pub_comp[1]);
     GNUNET_assert (0 == memcmp (&r_priv_comp,
                                 &r_priv,
                                 sizeof(struct GNUNET_CRYPTO_CsRSecret) * 2));
@@ -1316,9 +1321,14 @@ output_vectors ()
                                                      strlen ("nonce_secret"),
                                                      NULL,
                                                      0));
-    GNUNET_CRYPTO_cs_r_derive (&nonce, &priv, r_priv);
-    GNUNET_CRYPTO_cs_r_get_public (&r_priv[0], &r_pub[0]);
-    GNUNET_CRYPTO_cs_r_get_public (&r_priv[1], &r_pub[1]);
+    GNUNET_CRYPTO_cs_r_derive (&nonce,
+                               "rw",
+                               &priv,
+                               r_priv);
+    GNUNET_CRYPTO_cs_r_get_public (&r_priv[0],
+                                   &r_pub[0]);
+    GNUNET_CRYPTO_cs_r_get_public (&r_priv[1],
+                                   &r_pub[1]);
     GNUNET_CRYPTO_cs_blinding_secrets_derive (&nonce,
                                               bs);
     GNUNET_CRYPTO_cs_calc_blinded_c (bs,
diff --git a/src/util/network.c b/src/util/network.c
index 688c37665..2f77bc54e 100644
--- a/src/util/network.c
+++ b/src/util/network.c
@@ -350,7 +350,8 @@ initialize_network_handle (struct GNUNET_NETWORK_Handle *h,
 
   if (h->fd >= FD_SETSIZE)
   {
-    GNUNET_break (GNUNET_OK == GNUNET_NETWORK_socket_close (h));
+    GNUNET_break (GNUNET_OK ==
+                  GNUNET_NETWORK_socket_close (h));
     errno = EMFILE;
     return GNUNET_SYSERR;
   }
diff --git a/src/util/plugin.c b/src/util/plugin.c
index 39874a588..6ee41eec9 100644
--- a/src/util/plugin.c
+++ b/src/util/plugin.c
@@ -289,12 +289,12 @@ GNUNET_PLUGIN_unload (const char *library_name,
   done = resolve_function (pos,
                            "done");
   ret = NULL;
-  if (NULL != done)
-    ret = done (arg);
   if (NULL == prev)
     plugins = pos->next;
   else
     prev->next = pos->next;
+  if (NULL != done)
+    ret = done (arg);
   lt_dlclose (pos->handle);
   GNUNET_free (pos->name);
   GNUNET_free (pos);
diff --git a/src/util/strings.c b/src/util/strings.c
index ece096f72..7e218cc59 100644
--- a/src/util/strings.c
+++ b/src/util/strings.c
@@ -390,7 +390,7 @@ GNUNET_STRINGS_conv (const char *input,
   ret[encoded_string_length] = '\0';
   free (encoded_string);
   return ret;
-fail:
+  fail:
   LOG (GNUNET_ERROR_TYPE_WARNING,
        _ ("Character sets requested were `%s'->`%s'\n"),
        "UTF-8",
@@ -426,24 +426,27 @@ GNUNET_STRINGS_from_utf8 (const char *input,
 }
 
 
-void
-GNUNET_STRINGS_utf8_normalize (const char *input,
-                               char *output)
+char *
+GNUNET_STRINGS_utf8_normalize (const char *input)
 {
   uint8_t *tmp;
   size_t len;
-
+  char *output;
   tmp = u8_normalize (UNINORM_NFC,
                       (uint8_t *) input,
                       strlen ((char*) input),
                       NULL,
                       &len);
+  if (NULL == tmp)
+    return NULL;
+  output = GNUNET_malloc (len + 1);
   GNUNET_memcpy (output, tmp, len);
   output[len] = '\0';
   free (tmp);
+  return output;
 }
 
-void
+enum GNUNET_GenericReturnValue
 GNUNET_STRINGS_utf8_tolower (const char *input,
                              char *output)
 {
@@ -456,13 +459,16 @@ GNUNET_STRINGS_utf8_tolower (const char *input,
                        UNINORM_NFD,
                        NULL,
                        &len);
+  if (NULL == tmp_in)
+    return GNUNET_SYSERR;
   GNUNET_memcpy (output, tmp_in, len);
   output[len] = '\0';
-  free (tmp_in);
+  GNUNET_free (tmp_in);
+  return GNUNET_OK;
 }
 
 
-void
+enum GNUNET_GenericReturnValue
 GNUNET_STRINGS_utf8_toupper (const char *input,
                              char *output)
 {
@@ -475,9 +481,13 @@ GNUNET_STRINGS_utf8_toupper (const char *input,
                        UNINORM_NFD,
                        NULL,
                        &len);
+  if (NULL == tmp_in)
+    return GNUNET_SYSERR;
+  /* 0-terminator does not fit */
   GNUNET_memcpy (output, tmp_in, len);
   output[len] = '\0';
-  free (tmp_in);
+  GNUNET_free (tmp_in);
+  return GNUNET_OK;
 }
 
 
@@ -1604,7 +1614,7 @@ GNUNET_STRINGS_base64_encode (const void *in,
   char *opt;
 
   ret = 0;
-  GNUNET_assert (len < SIZE_MAX / 4 * 3 );
+  GNUNET_assert (len < SIZE_MAX / 4 * 3);
   opt = GNUNET_malloc (2 + (len * 4 / 3) + 8);
   for (size_t i = 0; i < len; ++i)
   {
@@ -1741,7 +1751,7 @@ GNUNET_STRINGS_base64_decode (const char *data,
       output[ret++] = c;
     }
   }
-END:
+  END:
   *out = output;
   return ret;
 }
@@ -1803,12 +1813,19 @@ GNUNET_STRINGS_urldecode (const char *data,
   char *wpos = *out;
   size_t resl = 0;
 
-  while ('\0' != *rpos)
+  while ( ('\0' != *rpos) &&
+          (data + len != rpos) )
   {
     unsigned int num;
     switch (*rpos)
     {
     case '%':
+      if (rpos + 3 > data + len)
+      {
+        GNUNET_break_op (0);
+        GNUNET_free (*out);
+        return 0;
+      }
       if (1 != sscanf (rpos + 1, "%2x", &num))
         break;
       *wpos = (char) ((unsigned char) num);
diff --git a/src/util/test_crypto_cs.c b/src/util/test_crypto_cs.c
index d3406516e..914ded9bc 100644
--- a/src/util/test_crypto_cs.c
+++ b/src/util/test_crypto_cs.c
@@ -1,6 +1,6 @@
 /*
    This file is part of GNUnet
-   Copyright (C) 2014,2015 GNUnet e.V.
+   Copyright (C) 2021,2022 GNUnet e.V.
 
    GNUnet is free software: you can redistribute it and/or modify it
    under the terms of the GNU Affero General Public License as published
@@ -30,148 +30,168 @@
 
 #define ITER 25
 
-void
+static void
 test_create_priv (struct GNUNET_CRYPTO_CsPrivateKey *priv)
 {
   /* TEST 1
    * Check that privkey is set
    */
   struct GNUNET_CRYPTO_CsPrivateKey other_priv;
-  memcpy (&other_priv.scalar, &priv->scalar, sizeof(other_priv.scalar));
 
+  other_priv = *priv;
   GNUNET_CRYPTO_cs_private_key_generate (priv);
-
-  GNUNET_assert (0 != memcmp (&other_priv.scalar,
-                              &priv->scalar,
-                              sizeof(other_priv.scalar)));
+  GNUNET_assert (0 !=
+                 GNUNET_memcmp (&other_priv.scalar,
+                                &priv->scalar));
 }
 
 
-void
+static void
 test_generate_pub (const struct GNUNET_CRYPTO_CsPrivateKey *priv,
-                       struct GNUNET_CRYPTO_CsPublicKey *pub)
+                   struct GNUNET_CRYPTO_CsPublicKey *pub)
 {
   /* TEST 1
    * Check that pubkey is set
    */
   struct GNUNET_CRYPTO_CsPublicKey other_pub;
-  memcpy (&other_pub.point, &pub->point, sizeof(other_pub.point));
-
-  GNUNET_CRYPTO_cs_private_key_get_public (priv, pub);
 
-  GNUNET_assert (0 != memcmp (&other_pub.point,
-                              &pub->point,
-                              sizeof(other_pub.point)));
+  other_pub = *pub;
+  GNUNET_CRYPTO_cs_private_key_get_public (priv,
+                                           pub);
+  GNUNET_assert (0 !=
+                 GNUNET_memcmp (&other_pub.point,
+                                &pub->point));
 
   /* TEST 2
    * Check that pubkey is a valid point
    */
-  GNUNET_assert (1 == crypto_core_ed25519_is_valid_point (pub->point.y));
+  GNUNET_assert (1 ==
+                 crypto_core_ed25519_is_valid_point (pub->point.y));
 
   /* TEST 3
    * Check if function gives the same result for the same output
    */
-  memcpy (&other_pub.point, &pub->point, sizeof(other_pub.point));
-
-  for (int i = 0; i<ITER; i++) {
-    GNUNET_CRYPTO_cs_private_key_get_public (priv, pub);
-    GNUNET_assert (0 == memcmp (&other_pub.point,
-                                &pub->point,
-                                sizeof(other_pub.point)));
+  other_pub = *pub;
+  for (unsigned int i = 0; i<ITER; i++)
+  {
+    GNUNET_CRYPTO_cs_private_key_get_public (priv,
+                                             pub);
+    GNUNET_assert (0 ==
+                   GNUNET_memcmp (&other_pub.point,
+                                  &pub->point));
   }
 }
 
 
-void
+static void
 test_derive_rsecret (const struct GNUNET_CRYPTO_CsNonce *nonce,
-                   const struct GNUNET_CRYPTO_CsPrivateKey *priv,
-                   struct GNUNET_CRYPTO_CsRSecret r[2])
+                     const struct GNUNET_CRYPTO_CsPrivateKey *priv,
+                     struct GNUNET_CRYPTO_CsRSecret r[2])
 {
   /* TEST 1
    * Check that r are set
    */
   struct GNUNET_CRYPTO_CsPrivateKey other_r[2];
-  memcpy (&other_r[0], &r[0], sizeof(struct GNUNET_CRYPTO_CsPrivateKey) * 2);
 
-  GNUNET_CRYPTO_cs_r_derive (nonce, priv, r);
-
-  GNUNET_assert (0 != memcmp (&other_r[0],
-                              &r[0],
-                              sizeof(struct GNUNET_CRYPTO_CsPrivateKey) * 2));
+  memcpy (other_r,
+          r,
+          sizeof(struct GNUNET_CRYPTO_CsPrivateKey) * 2);
+  GNUNET_CRYPTO_cs_r_derive (nonce,
+                             "nw",
+                             priv,
+                             r);
+  GNUNET_assert (0 !=
+                 memcmp (&other_r[0],
+                         &r[0],
+                         sizeof(struct GNUNET_CRYPTO_CsPrivateKey) * 2));
 
   /* TEST 2
    * Check if function gives the same result for the same input.
    * This test ensures that the derivation is deterministic.
    */
-  memcpy (&other_r[0], &r[0], sizeof(struct GNUNET_CRYPTO_CsPrivateKey) * 2);
-  for (int i = 0; i<ITER; i++) {
-    GNUNET_CRYPTO_cs_r_derive (nonce, priv, r);
-    GNUNET_assert (0 == memcmp (&other_r[0],
-                                &r[0],
-                                sizeof(struct GNUNET_CRYPTO_CsPrivateKey) * 2));
+  memcpy (other_r,
+          r,
+          sizeof(struct GNUNET_CRYPTO_CsPrivateKey) * 2);
+  for (unsigned int i = 0; i<ITER; i++)
+  {
+    GNUNET_CRYPTO_cs_r_derive (nonce,
+                               "nw",
+                               priv,
+                               r);
+    GNUNET_assert (0 ==
+                   memcmp (other_r,
+                           r,
+                           sizeof(struct GNUNET_CRYPTO_CsPrivateKey) * 2));
   }
 }
 
 
-void
+static void
 test_generate_rpublic (const struct GNUNET_CRYPTO_CsRSecret *r_priv,
-                     struct GNUNET_CRYPTO_CsRPublic *r_pub)
+                       struct GNUNET_CRYPTO_CsRPublic *r_pub)
 {
   /* TEST 1
    * Check that r_pub is set
    */
   struct GNUNET_CRYPTO_CsRPublic other_r_pub;
-  memcpy (&other_r_pub.point, &r_pub->point, sizeof(other_r_pub.point));
-
-  GNUNET_CRYPTO_cs_r_get_public (r_priv, r_pub);
-
-  GNUNET_assert (0 != memcmp (&other_r_pub.point,
-                              &r_pub->point,
-                              sizeof(other_r_pub.point)));
 
+  other_r_pub = *r_pub;
+  GNUNET_CRYPTO_cs_r_get_public (r_priv,
+                                 r_pub);
+  GNUNET_assert (0 !=
+                 GNUNET_memcmp (&other_r_pub.point,
+                                &r_pub->point));
   /* TEST 2
    * Check that r_pub is a valid point
    */
-  GNUNET_assert (1 == crypto_core_ed25519_is_valid_point (r_pub->point.y));
+  GNUNET_assert (1 ==
+                 crypto_core_ed25519_is_valid_point (r_pub->point.y));
 
   /* TEST 3
    * Check if function gives the same result for the same output
    */
-  memcpy (&other_r_pub.point, &r_pub->point, sizeof(other_r_pub.point));
-  for (int i = 0; i<ITER; i++) {
-    GNUNET_CRYPTO_cs_r_get_public (r_priv, r_pub);
-    GNUNET_assert (0 == memcmp (&other_r_pub.point,
-                                &r_pub->point,
-                                sizeof(other_r_pub.point)));
+  other_r_pub.point = r_pub->point;
+  for (int i = 0; i<ITER; i++)
+  {
+    GNUNET_CRYPTO_cs_r_get_public (r_priv,
+                                   r_pub);
+    GNUNET_assert (0 ==
+                   GNUNET_memcmp (&other_r_pub.point,
+                                  &r_pub->point));
   }
 }
 
 
-void
+static void
 test_derive_blindingsecrets (const struct GNUNET_CRYPTO_CsNonce *blind_seed,
-                           struct GNUNET_CRYPTO_CsBlindingSecret bs[2])
+                             struct GNUNET_CRYPTO_CsBlindingSecret bs[2])
 {
   /* TEST 1
    * Check that blinding secrets are set
    */
   struct GNUNET_CRYPTO_CsBlindingSecret other_bs[2];
-  memcpy (&other_bs[0], &bs[0], sizeof(struct GNUNET_CRYPTO_CsBlindingSecret)
-          * 2);
+
+  memcpy (other_bs,
+          bs,
+          sizeof(struct GNUNET_CRYPTO_CsBlindingSecret) * 2);
 
   GNUNET_CRYPTO_cs_blinding_secrets_derive (blind_seed, bs);
 
-  GNUNET_assert (0 != memcmp (&other_bs[0],
-                              &bs[0],
-                              sizeof(struct GNUNET_CRYPTO_CsBlindingSecret)
-                              * 2));
+  GNUNET_assert (0 !=
+                 memcmp (other_bs,
+                         bs,
+                         sizeof(struct GNUNET_CRYPTO_CsBlindingSecret)
+                         * 2));
 
   /* TEST 2
    * Check if function gives the same result for the same input.
    * This test ensures that the derivation is deterministic.
    */
-  memcpy (&other_bs[0], &bs[0], sizeof(struct GNUNET_CRYPTO_CsBlindingSecret)
-          * 2);
-  for (int i = 0; i<ITER; i++) {
+  memcpy (other_bs,
+          bs,
+          sizeof(struct GNUNET_CRYPTO_CsBlindingSecret) * 2);
+  for (unsigned int i = 0; i<ITER; i++)
+  {
     GNUNET_CRYPTO_cs_blinding_secrets_derive (blind_seed, bs);
     GNUNET_assert (0 == memcmp (&other_bs[0],
                                 &bs[0],
@@ -181,19 +201,20 @@ test_derive_blindingsecrets (const struct GNUNET_CRYPTO_CsNonce *blind_seed,
 }
 
 
-void
+static void
 test_calc_blindedc (const struct GNUNET_CRYPTO_CsBlindingSecret bs[2],
-                  const struct GNUNET_CRYPTO_CsRPublic r_pub[2],
-                  const struct GNUNET_CRYPTO_CsPublicKey *pub,
-                  const void *msg,
-                  size_t msg_len,
-                  struct GNUNET_CRYPTO_CsC blinded_cs[2],
-                  struct GNUNET_CRYPTO_CsRPublic blinded_r_pub[2])
+                    const struct GNUNET_CRYPTO_CsRPublic r_pub[2],
+                    const struct GNUNET_CRYPTO_CsPublicKey *pub,
+                    const void *msg,
+                    size_t msg_len,
+                    struct GNUNET_CRYPTO_CsC blinded_cs[2],
+                    struct GNUNET_CRYPTO_CsRPublic blinded_r_pub[2])
 {
   /* TEST 1
    * Check that the blinded c's and blinded r's
    */
   struct GNUNET_CRYPTO_CsC other_blinded_c[2];
+
   memcpy (&other_blinded_c[0],
           &blinded_cs[0],
           sizeof(struct GNUNET_CRYPTO_CsC) * 2);
@@ -222,7 +243,8 @@ test_calc_blindedc (const struct GNUNET_CRYPTO_CsBlindingSecret bs[2],
    * Check if R' - aG -bX = R for b = 0
    * This test does the opposite operations and checks wether the equation is still correct.
    */
-  for (unsigned int b = 0; b <= 1; b++) {
+  for (unsigned int b = 0; b <= 1; b++)
+  {
     struct GNUNET_CRYPTO_Cs25519Point aG;
     struct GNUNET_CRYPTO_Cs25519Point bX;
     struct GNUNET_CRYPTO_Cs25519Point r_min_aG;
@@ -252,7 +274,6 @@ test_calc_blindedc (const struct GNUNET_CRYPTO_CsBlindingSecret bs[2],
   }
 
 
-
   /* TEST 3
    * Check that the blinded r_pubs' are valid points
    */
@@ -271,7 +292,8 @@ test_calc_blindedc (const struct GNUNET_CRYPTO_CsBlindingSecret bs[2],
           &blinded_r_pub[0],
           sizeof(struct GNUNET_CRYPTO_CsRPublic) * 2);
 
-  for (int i = 0; i<ITER; i++) {
+  for (unsigned int i = 0; i<ITER; i++)
+  {
     GNUNET_CRYPTO_cs_calc_blinded_c (bs,
                                      r_pub,
                                      pub,
@@ -289,13 +311,13 @@ test_calc_blindedc (const struct GNUNET_CRYPTO_CsBlindingSecret bs[2],
 }
 
 
-void
+static void
 test_blind_sign (unsigned int *b,
-               const struct GNUNET_CRYPTO_CsPrivateKey *priv,
-               const struct GNUNET_CRYPTO_CsRSecret r[2],
-               const struct GNUNET_CRYPTO_CsC c[2],
-               const struct GNUNET_CRYPTO_CsNonce *nonce,
-               struct GNUNET_CRYPTO_CsBlindS *blinded_s)
+                 const struct GNUNET_CRYPTO_CsPrivateKey *priv,
+                 const struct GNUNET_CRYPTO_CsRSecret r[2],
+                 const struct GNUNET_CRYPTO_CsC c[2],
+                 const struct GNUNET_CRYPTO_CsNonce *nonce,
+                 struct GNUNET_CRYPTO_CsBlindS *blinded_s)
 {
   /* TEST 1
    * Check that blinded_s is set
@@ -336,8 +358,10 @@ test_blind_sign (unsigned int *b,
    * Check if function gives the same result for the same input.
    */
   memcpy (&other_blinded_s, blinded_s, sizeof(struct GNUNET_CRYPTO_CsBlindS));
-  unsigned int other_b;
-  for (int i = 0; i<ITER; i++) {
+  for (unsigned int i = 0; i<ITER; i++)
+  {
+    unsigned int other_b;
+
     other_b = GNUNET_CRYPTO_cs_sign_derive (priv, r, c, nonce, blinded_s);
 
     GNUNET_assert (other_b == *b);
@@ -348,10 +372,10 @@ test_blind_sign (unsigned int *b,
 }
 
 
-void
+static void
 test_unblinds (const struct GNUNET_CRYPTO_CsBlindS *blinded_signature_scalar,
-              const struct GNUNET_CRYPTO_CsBlindingSecret *bs,
-              struct GNUNET_CRYPTO_CsS *signature_scalar)
+               const struct GNUNET_CRYPTO_CsBlindingSecret *bs,
+               struct GNUNET_CRYPTO_CsS *signature_scalar)
 {
   /* TEST 1
    * Check that signature_scalar is set
@@ -387,7 +411,8 @@ test_unblinds (const struct GNUNET_CRYPTO_CsBlindS *blinded_signature_scalar,
   memcpy (&other_signature_scalar, signature_scalar,
           sizeof(struct GNUNET_CRYPTO_CsS));
 
-  for (int i = 0; i<ITER; i++) {
+  for (unsigned int i = 0; i<ITER; i++)
+  {
     GNUNET_CRYPTO_cs_unblind (blinded_signature_scalar, bs, signature_scalar);
     GNUNET_assert (0 == memcmp (&other_signature_scalar,
                                 signature_scalar,
@@ -396,10 +421,10 @@ test_unblinds (const struct GNUNET_CRYPTO_CsBlindS *blinded_signature_scalar,
 }
 
 
-void
+static void
 test_blind_verify (const struct GNUNET_CRYPTO_CsSignature *sig,
-                 const struct GNUNET_CRYPTO_CsPublicKey *pub,
-                 const struct GNUNET_CRYPTO_CsC *c)
+                   const struct GNUNET_CRYPTO_CsPublicKey *pub,
+                   const struct GNUNET_CRYPTO_CsC *c)
 {
   /* TEST 1
    * Test verifies the blinded signature sG == Rb + cbX
@@ -425,28 +450,30 @@ test_blind_verify (const struct GNUNET_CRYPTO_CsSignature *sig,
 }
 
 
-void
+static void
 test_verify (const struct GNUNET_CRYPTO_CsSignature *sig,
-            const struct GNUNET_CRYPTO_CsPublicKey *pub,
-            const void *msg,
-            size_t msg_len)
+             const struct GNUNET_CRYPTO_CsPublicKey *pub,
+             const void *msg,
+             size_t msg_len)
 {
   /* TEST 1
    * Test simple verification
    */
-  GNUNET_assert (GNUNET_YES == GNUNET_CRYPTO_cs_verify (sig,
-                                                        pub,
-                                                        msg,
-                                                        msg_len));
+  GNUNET_assert (GNUNET_YES ==
+                 GNUNET_CRYPTO_cs_verify (sig,
+                                          pub,
+                                          msg,
+                                          msg_len));
   /* TEST 2
    * Test verification of "wrong" message
    */
   char other_msg[] = "test massege";
   size_t other_msg_len = strlen ("test massege");
-  GNUNET_assert (GNUNET_SYSERR == GNUNET_CRYPTO_cs_verify (sig,
-                                                       pub,
-                                                       other_msg,
-                                                       other_msg_len));
+  GNUNET_assert (GNUNET_SYSERR ==
+                 GNUNET_CRYPTO_cs_verify (sig,
+                                          pub,
+                                          other_msg,
+                                          other_msg_len));
 }
 
 
@@ -461,71 +488,122 @@ main (int argc,
   size_t message_len = strlen ("test message");
 
   struct GNUNET_CRYPTO_CsPrivateKey priv;
+
+  memset (&priv,
+          42,
+          sizeof (priv));
   test_create_priv (&priv);
 
   struct GNUNET_CRYPTO_CsPublicKey pub;
-  test_generate_pub (&priv, &pub);
+
+  memset (&pub,
+          42,
+          sizeof (pub));
+  test_generate_pub (&priv,
+                     &pub);
 
   // derive nonce
   struct GNUNET_CRYPTO_CsNonce nonce;
-  GNUNET_assert (GNUNET_YES == GNUNET_CRYPTO_hkdf (nonce.nonce,
-                                                   sizeof(nonce.nonce),
-                                                   GCRY_MD_SHA512,
-                                                   GCRY_MD_SHA256,
-                                                   "nonce",
-                                                   strlen ("nonce"),
-                                                   "nonce_secret",
-                                                   strlen ("nonce_secret"),
-                                                   NULL,
-                                                   0));
+  GNUNET_assert (GNUNET_YES ==
+                 GNUNET_CRYPTO_kdf (nonce.nonce,
+                                    sizeof(nonce.nonce),
+                                    "nonce",
+                                    strlen ("nonce"),
+                                    "nonce_secret",
+                                    strlen ("nonce_secret"),
+                                    NULL,
+                                    0));
 
   // generate r, R
   struct GNUNET_CRYPTO_CsRSecret r_secrets[2];
-  test_derive_rsecret (&nonce, &priv, r_secrets);
+
+  memset (r_secrets,
+          42,
+          sizeof (r_secrets));
+  test_derive_rsecret (&nonce,
+                       &priv,
+                       r_secrets);
 
   struct GNUNET_CRYPTO_CsRPublic r_publics[2];
-  test_generate_rpublic (&r_secrets[0], &r_publics[0]);
-  test_generate_rpublic (&r_secrets[1], &r_publics[1]);
+
+  memset (r_publics,
+          42,
+          sizeof (r_publics));
+  test_generate_rpublic (&r_secrets[0],
+                         &r_publics[0]);
+  test_generate_rpublic (&r_secrets[1],
+                         &r_publics[1]);
 
   // ---------- actions performed by user
 
   // generate blinding secrets
   struct GNUNET_CRYPTO_CsBlindingSecret blindingsecrets[2];
+
+  memset (blindingsecrets,
+          42,
+          sizeof (blindingsecrets));
   test_derive_blindingsecrets (&nonce,
                                blindingsecrets);
 
   // calculate blinded c's
   struct GNUNET_CRYPTO_CsC blinded_cs[2];
   struct GNUNET_CRYPTO_CsRPublic blinded_r_pubs[2];
+
+  memset (blinded_cs,
+          42,
+          sizeof (blinded_cs));
+  memset (blinded_r_pubs,
+          42,
+          sizeof (blinded_r_pubs));
   test_calc_blindedc (blindingsecrets,
-                    r_publics,
-                    &pub,
-                    message,
-                    message_len,
-                    blinded_cs,
-                    blinded_r_pubs);
+                      r_publics,
+                      &pub,
+                      message,
+                      message_len,
+                      blinded_cs,
+                      blinded_r_pubs);
 
   // ---------- actions performed by signer
   // sign blinded c's and get b and s in return
   unsigned int b;
   struct GNUNET_CRYPTO_CsBlindS blinded_s;
-  test_blind_sign (&b, &priv, r_secrets, blinded_cs, &nonce, &blinded_s);
+
+  memset (&blinded_s,
+          42,
+          sizeof (blinded_s));
+  test_blind_sign (&b,
+                   &priv,
+                   r_secrets,
+                   blinded_cs,
+                   &nonce,
+                   &blinded_s);
 
   // verify blinded signature
   struct GNUNET_CRYPTO_CsSignature blinded_signature;
+
   blinded_signature.r_point = r_publics[b];
   blinded_signature.s_scalar.scalar = blinded_s.scalar;
-  test_blind_verify (&blinded_signature, &pub, &blinded_cs[b]);
+  test_blind_verify (&blinded_signature,
+                     &pub,
+                     &blinded_cs[b]);
 
   // ---------- actions performed by user
-    struct GNUNET_CRYPTO_CsS sig_scalar;
-  test_unblinds (&blinded_s, &blindingsecrets[b], &sig_scalar);
+  struct GNUNET_CRYPTO_CsS sig_scalar;
+
+  memset (&sig_scalar,
+          42,
+          sizeof (sig_scalar));
+  test_unblinds (&blinded_s,
+                 &blindingsecrets[b],
+                 &sig_scalar);
 
   // verify unblinded signature
   struct GNUNET_CRYPTO_CsSignature signature;
   signature.r_point = blinded_r_pubs[b];
   signature.s_scalar = sig_scalar;
-  test_verify (&signature, &pub, message, message_len);
-
+  test_verify (&signature,
+               &pub,
+               message,
+               message_len);
   return 0;
 }
diff --git a/src/util/test_strings.c b/src/util/test_strings.c
index 1ecd31464..cccffcaf5 100644
--- a/src/util/test_strings.c
+++ b/src/util/test_strings.c
@@ -114,10 +114,9 @@ main (int argc, char *argv[])
   /* Normalization */
   r = "q\u0307\u0323"; /* Non-canonical order */
 
-  GNUNET_STRINGS_utf8_normalize (r,
-                                 buf);
-  GNUNET_assert (0 == strcmp ("q\u0323\u0307", buf));
-
+  b = GNUNET_STRINGS_utf8_normalize (r);
+  GNUNET_assert (0 == strcmp ("q\u0323\u0307", b));
+  GNUNET_free (b);
   b = GNUNET_STRINGS_to_utf8 ("TEST", 4, "ASCII");
   WANT ("TEST", b);
 
diff --git a/src/util/time.c b/src/util/time.c
index 83b39b4e8..68a6937a0 100644
--- a/src/util/time.c
+++ b/src/util/time.c
@@ -695,6 +695,13 @@ GNUNET_TIME_timestamp_from_s (uint64_t s_after_epoch)
 }
 
 
+uint64_t
+GNUNET_TIME_timestamp_to_s (struct GNUNET_TIME_Timestamp ts)
+{
+  return ts.abs_time.abs_value_us / GNUNET_TIME_UNIT_SECONDS.rel_value_us;
+}
+
+
 struct GNUNET_TIME_Absolute
 GNUNET_TIME_absolute_ntoh (struct GNUNET_TIME_AbsoluteNBO a)
 {
diff --git a/src/zonemaster/gnunet-service-zonemaster-monitor.c b/src/zonemaster/gnunet-service-zonemaster-monitor.c
index 3392a19d7..748a0f342 100644
--- a/src/zonemaster/gnunet-service-zonemaster-monitor.c
+++ b/src/zonemaster/gnunet-service-zonemaster-monitor.c
@@ -29,7 +29,6 @@
 #include "gnunet_namestore_service.h"
 #include "gnunet_statistics_service.h"
 
-
 #define LOG_STRERROR_FILE(kind, syscall, \
                           filename) GNUNET_log_from_strerror_file (kind, "util", \
                                                                    syscall, \
@@ -58,7 +57,6 @@
  */
 #define DHT_GNS_REPLICATION_LEVEL 5
 
-
 /**
  * Handle for DHT PUT activity triggered from the namestore monitor.
  */
@@ -197,39 +195,6 @@ dht_put_monitor_continuation (void *cls)
 
 
 /**
- * Convert namestore records from the internal format to that
- * suitable for publication (removes private records, converts
- * to absolute expiration time).
- *
- * @param rd input records
- * @param rd_count size of the @a rd and @a rd_public arrays
- * @param rd_public where to write the converted records
- * @return number of records written to @a rd_public
- */
-static unsigned int
-convert_records_for_export (const struct GNUNET_GNSRECORD_Data *rd,
-                            unsigned int rd_count,
-                            struct GNUNET_GNSRECORD_Data *rd_public)
-{
-  struct GNUNET_TIME_Absolute now;
-  unsigned int rd_public_count;
-
-  rd_public_count = 0;
-  now = GNUNET_TIME_absolute_get ();
-  for (unsigned int i = 0; i < rd_count; i++)
-  {
-    if (0 != (rd[i].flags & GNUNET_GNSRECORD_RF_PRIVATE))
-      continue;
-    if ((0 == (rd[i].flags & GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION)) &&
-        (rd[i].expiration_time < now.abs_value_us))
-      continue;   /* record already expired, skip it */
-    rd_public[rd_public_count++] = rd[i];
-  }
-  return rd_public_count;
-}
-
-
-/**
  * Store GNS records in the DHT.
  *
  * @param key key of the zone
@@ -244,16 +209,14 @@ perform_dht_put (const struct GNUNET_IDENTITY_PrivateKey *key,
                  const char *label,
                  const struct GNUNET_GNSRECORD_Data *rd_public,
                  unsigned int rd_public_count,
+                 struct GNUNET_TIME_Absolute expire,
                  struct DhtPutActivity *ma)
 {
   struct GNUNET_GNSRECORD_Block *block;
   struct GNUNET_HashCode query;
-  struct GNUNET_TIME_Absolute expire;
   size_t block_size;
   struct GNUNET_DHT_PutHandle *ret;
 
-  expire = GNUNET_GNSRECORD_record_get_expiration_time (rd_public_count,
-                                                        rd_public);
   if (cache_keys)
     GNUNET_assert (GNUNET_OK == GNUNET_GNSRECORD_block_create2 (key,
                                                                 expire,
@@ -301,7 +264,6 @@ perform_dht_put (const struct GNUNET_IDENTITY_PrivateKey *key,
   return ret;
 }
 
-
 /**
  * Process a record that was stored in the namestore
  * (invoked by the monitor).
@@ -322,6 +284,8 @@ handle_monitor_event (void *cls,
   struct GNUNET_GNSRECORD_Data rd_public[rd_count];
   unsigned int rd_public_count;
   struct DhtPutActivity *ma;
+  struct GNUNET_TIME_Absolute expire;
+  char *emsg;
 
   (void) cls;
   GNUNET_STATISTICS_update (statistics,
@@ -334,9 +298,21 @@ handle_monitor_event (void *cls,
               label);
   /* filter out records that are not public, and convert to
      absolute expiration time. */
-  rd_public_count = convert_records_for_export (rd,
-                                                rd_count,
-                                                rd_public);
+  if (GNUNET_OK != GNUNET_GNSRECORD_convert_records_for_export (label,
+                                                                rd,
+                                                                rd_count,
+                                                                rd_public,
+                                                                &rd_public_count,
+                                                                &expire,
+                                                                &emsg))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Zonemaster-monitor failed: %s\n", emsg);
+    GNUNET_free (emsg);
+    GNUNET_NAMESTORE_zone_monitor_next (zmon,
+                                        1);
+    return;   /* nothing to do */
+  }
   if (0 == rd_public_count)
   {
     GNUNET_NAMESTORE_zone_monitor_next (zmon,
@@ -347,8 +323,9 @@ handle_monitor_event (void *cls,
   ma->start_date = GNUNET_TIME_absolute_get ();
   ma->ph = perform_dht_put (zone,
                             label,
-                            rd,
-                            rd_count,
+                            rd_public,
+                            rd_public_count,
+                            expire,
                             ma);
   if (NULL == ma->ph)
   {
diff --git a/src/zonemaster/gnunet-service-zonemaster.c b/src/zonemaster/gnunet-service-zonemaster.c
index bacafb97c..c6b86bf71 100644
--- a/src/zonemaster/gnunet-service-zonemaster.c
+++ b/src/zonemaster/gnunet-service-zonemaster.c
@@ -30,7 +30,6 @@
 #include "gnunet_namestore_service.h"
 #include "gnunet_statistics_service.h"
 
-
 #define LOG_STRERROR_FILE(kind, syscall, \
                           filename) GNUNET_log_from_strerror_file (kind, "util", \
                                                                    syscall, \
@@ -90,7 +89,6 @@
  */
 #define DHT_GNS_REPLICATION_LEVEL 5
 
-
 /**
  * Handle for DHT PUT activity triggered from the namestore monitor.
  */
@@ -527,46 +525,6 @@ dht_put_continuation (void *cls)
 }
 
 
-/**
- * Convert namestore records from the internal format to that
- * suitable for publication (removes private records, converts
- * to absolute expiration time).
- *
- * @param rd input records
- * @param rd_count size of the @a rd and @a rd_public arrays
- * @param rd_public where to write the converted records
- * @return number of records written to @a rd_public
- */
-static unsigned int
-convert_records_for_export (const struct GNUNET_GNSRECORD_Data *rd,
-                            unsigned int rd_count,
-                            struct GNUNET_GNSRECORD_Data *rd_public)
-{
-  struct GNUNET_TIME_Absolute now;
-  unsigned int rd_public_count;
-
-  rd_public_count = 0;
-  now = GNUNET_TIME_absolute_get ();
-  for (unsigned int i = 0; i < rd_count; i++)
-  {
-    if (0 != (rd[i].flags & GNUNET_GNSRECORD_RF_PRIVATE))
-      continue;
-    if ((0 == (rd[i].flags & GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION)) &&
-        (rd[i].expiration_time < now.abs_value_us))
-      continue;   /* record already expired, skip it */
-    if (0 != (rd[i].flags & GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION))
-    {
-      /* GNUNET_GNSRECORD_block_create will convert to absolute time;
-         we just need to adjust our iteration frequency */
-      min_relative_record_time.rel_value_us =
-        GNUNET_MIN (rd[i].expiration_time,
-                    min_relative_record_time.rel_value_us);
-    }
-    rd_public[rd_public_count++] = rd[i];
-  }
-  return rd_public_count;
-}
-
 
 /**
  * Store GNS records in the DHT.
@@ -583,30 +541,28 @@ perform_dht_put (const struct GNUNET_IDENTITY_PrivateKey *key,
                  const char *label,
                  const struct GNUNET_GNSRECORD_Data *rd_public,
                  unsigned int rd_public_count,
+                 const struct GNUNET_TIME_Absolute expire,
                  struct DhtPutActivity *ma)
 {
   struct GNUNET_GNSRECORD_Block *block;
   struct GNUNET_HashCode query;
-  struct GNUNET_TIME_Absolute expire;
   size_t block_size;
   struct GNUNET_DHT_PutHandle *ret;
 
-  expire = GNUNET_GNSRECORD_record_get_expiration_time (rd_public_count,
-                                                        rd_public);
   if (cache_keys)
     GNUNET_assert (GNUNET_OK == GNUNET_GNSRECORD_block_create2 (key,
-                                            expire,
-                                            label,
-                                            rd_public,
-                                            rd_public_count,
-                                            &block));
+                                                                expire,
+                                                                label,
+                                                                rd_public,
+                                                                rd_public_count,
+                                                                &block));
   else
     GNUNET_assert (GNUNET_OK ==  GNUNET_GNSRECORD_block_create (key,
-                                           expire,
-                                           label,
-                                           rd_public,
-                                           rd_public_count,
-                                           &block));
+                                                                expire,
+                                                                label,
+                                                                rd_public,
+                                                                rd_public_count,
+                                                                &block));
   if (NULL == block)
   {
     GNUNET_break (0);
@@ -713,7 +669,6 @@ zone_iteration_finished (void *cls)
   }
 }
 
-
 /**
  * Function used to put all records successively into the DHT.
  *
@@ -733,12 +688,26 @@ put_gns_record (void *cls,
   struct GNUNET_GNSRECORD_Data rd_public[rd_count];
   unsigned int rd_public_count;
   struct DhtPutActivity *ma;
+  struct GNUNET_TIME_Absolute expire;
+  char *emsg;
 
   (void) cls;
   ns_iteration_left--;
-  rd_public_count = convert_records_for_export (rd,
-                                                rd_count,
-                                                rd_public);
+  if (GNUNET_OK != GNUNET_GNSRECORD_convert_records_for_export (label,
+                                                                rd,
+                                                                rd_count,
+                                                                rd_public,
+                                                                &rd_public_count,
+                                                                &expire,
+                                                                &emsg))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Record set inconsistent, moving to next record set: %s\n",
+                emsg);
+    GNUNET_free (emsg);
+    check_zone_namestore_next ();
+    return;
+  }
   if (0 == rd_public_count)
   {
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
@@ -746,15 +715,30 @@ put_gns_record (void *cls,
     check_zone_namestore_next ();
     return;
   }
+  for (unsigned int i = 0; i < rd_public_count; i++)
+  {
+    if (0 != (rd_public[i].flags & GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION))
+    {
+      /* GNUNET_GNSRECORD_block_create will convert to absolute time;
+         we just need to adjust our iteration frequency */
+      min_relative_record_time.rel_value_us =
+        GNUNET_MIN (rd_public[i].expiration_time,
+                    min_relative_record_time.rel_value_us);
+    }
+  }
+
+
   /* We got a set of records to publish */
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Starting DHT PUT\n");
+
   ma = GNUNET_new (struct DhtPutActivity);
   ma->start_date = GNUNET_TIME_absolute_get ();
   ma->ph = perform_dht_put (key,
                             label,
                             rd_public,
                             rd_public_count,
+                            expire,
                             ma);
   put_cnt++;
   if (0 == put_cnt % DELTA_INTERVAL)
@@ -788,7 +772,6 @@ put_gns_record (void *cls,
   }
 }
 
-
 /**
  * Periodically iterate over all zones and store everything in DHT
  *